1. 02 Aug, 2019 14 commits
    • Linus Torvalds's avatar
      Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi · 6e6d0536
      Linus Torvalds authored
      Pull SCSI fixes from James Bottomley:
       "Seven fixes to four drivers with no core changes.
      
        The mpt3sas one is theoretical until we get a CPU that goes up to 64
        bits physical, the qla2xxx one fixes an oops in a driver
        initialization error leg and the others are mostly cosmetic"
      
      [ The fcoe patches may be worth highlighting - they may be "just"
        cleanups, but they simplify and fix the odd fc_rport_priv structure
        handling rules so that the new gcc-9 warnings about memset crossing
        structure boundaries are gone.
      
        The old code was hard for humans to understand too, and really
        confused the compiler sanity checks  - Linus ]
      
      * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
        scsi: qla2xxx: Fix possible fcport null-pointer dereferences
        scsi: mpt3sas: Use 63-bit DMA addressing on SAS35 HBA
        scsi: hpsa: remove printing internal cdb on tag collision
        scsi: hpsa: correct scsi command status issue after reset
        scsi: fcoe: pass in fcoe_rport structure instead of fc_rport_priv
        scsi: fcoe: Embed fc_rport_priv in fcoe_rport structure
        scsi: libfc: Whitespace cleanup in libfc.h
      6e6d0536
    • Linus Torvalds's avatar
      Merge tag 'for-linus-20190802' of git://git.kernel.dk/linux-block · 10e5ddd7
      Linus Torvalds authored
      Pull block fixes from Jens Axboe:
       "Here's a small collection of fixes that should go into this series.
        This contains:
      
         - io_uring potential use-after-free fix (Jackie)
      
         - loop regression fix (Jan)
      
         - O_DIRECT fragmented bio regression fix (Damien)
      
         - Mark Denis as the new floppy maintainer (Denis)
      
         - ataflop switch fall-through annotation (Gustavo)
      
         - libata zpodd overflow fix (Kees)
      
         - libata ahci deferred probe fix (Miquel)
      
         - nbd invalidation BUG_ON() fix (Munehisa)
      
         - dasd endless loop fix (Stefan)"
      
      * tag 'for-linus-20190802' of git://git.kernel.dk/linux-block:
        s390/dasd: fix endless loop after read unit address configuration
        block: Fix __blkdev_direct_IO() for bio fragments
        MAINTAINERS: floppy: take over maintainership
        nbd: replace kill_bdev() with __invalidate_device() again
        ata: libahci: do not complain in case of deferred probe
        io_uring: fix KASAN use after free in io_sq_wq_submit_work
        loop: Fix mount(2) failure due to race with LOOP_SET_FD
        libata: zpodd: Fix small read overflow in zpodd_get_mech_type()
        ataflop: Mark expected switch fall-through
      10e5ddd7
    • Linus Torvalds's avatar
      Merge tag 'for-5.3/dm-fixes-1' of... · b2c74237
      Linus Torvalds authored
      Merge tag 'for-5.3/dm-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm
      
      Pull device mapper fixes from Mike Snitzer:
       "Fix NULL pointer and various whitespace issues with DM's recent DAX
        code changes from commit in 5.3 merge"
      
      * tag 'for-5.3/dm-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm:
        dm table: fix various whitespace issues with recent DAX code
        dm table: fix dax_dev NULL dereference in device_synchronous()
      b2c74237
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma · b07042ca
      Linus Torvalds authored
      Pull rdma fixes from Doug Ledford:
       "Here's our second -rc pull request. Nothing particularly special in
        this one. The client removal deadlock fix is kindy tricky, but we had
        multiple eyes on it and no one could find a fault in it. A couple
        Spectre V1 fixes too. Otherwise, all just normal -rc fodder:
      
         - A couple Spectre V1 fixes (umad, hfi1)
      
         - Fix a tricky deadlock in the rdma core code with refcounting
           instead of locks (client removal patches)
      
         - Build errors (hns)
      
         - Fix a scheduling while atomic issue (mlx5)
      
         - Use after free fix (mad)
      
         - Fix error path return code (hns)
      
         - Null deref fix (siw_crypto_hash)
      
         - A few other misc. minor fixes"
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:
        RDMA/hns: Fix error return code in hns_roce_v1_rsv_lp_qp()
        RDMA/mlx5: Release locks during notifier unregister
        IB/hfi1: Fix Spectre v1 vulnerability
        IB/mad: Fix use-after-free in ib mad completion handling
        RDMA/restrack: Track driver QP types in resource tracker
        IB/mlx5: Fix MR registration flow to use UMR properly
        RDMA/devices: Remove the lock around remove_client_context
        RDMA/devices: Do not deadlock during client removal
        IB/core: Add mitigation for Spectre V1
        Do not dereference 'siw_crypto_shash' before checking
        RDMA/qedr: Fix the hca_type and hca_rev returned in device attributes
        RDMA/hns: Fix build error
      b07042ca
    • Linus Torvalds's avatar
      Merge tag 'for-5.3-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux · d38c3fa6
      Linus Torvalds authored
      Pull btrfs fixes from David Sterba:
      
       - tiny race window during 2 transactions aborting at the same time can
         accidentally lead to a commit
      
       - regression fix, possible deadlock during fiemap
      
       - fix for an old bug when incremental send can fail on a file that has
         been deduplicated in a special way
      
      * tag 'for-5.3-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
        Btrfs: fix deadlock between fiemap and transaction commits
        Btrfs: fix race leading to fs corruption after transaction abort
        Btrfs: fix incremental send failure after deduplication
      d38c3fa6
    • Linus Torvalds's avatar
      Merge tag 'gfs2-v5.3-rc2.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2 · 97b00aff
      Linus Torvalds authored
      Pull gfs2 fix from Andreas Gruenbacher:
       "Fix gfs2 cluster coherency bug"
      
      * tag 'gfs2-v5.3-rc2.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2:
        gfs2: Inode dirtying fix
      97b00aff
    • Linus Torvalds's avatar
      Merge tag 'pm-5.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm · 755f1fed
      Linus Torvalds authored
      Pull power management fix from Rafael Wysocki:
       "Fix recent regression affecting ACPI device power management"
      
      * tag 'pm-5.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
        ACPI: PM: Fix regression in acpi_device_set_power()
      755f1fed
    • Linus Torvalds's avatar
      Merge tag 'sound-5.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound · 75cdf416
      Linus Torvalds authored
      Pull sound fixes from Takashi Iwai:
      
       - A further fix for syzcaller issues with USB-audio, addressing NULL
         dereference that was introduced by the recent fix
      
       - Avoid a long delay at boot with HD-audio when i915 module was built
         but not installed, found on some Debian systems
      
       - A fix of small race window at PCM draining
      
      * tag 'sound-5.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
        ALSA: usb-audio: Fix gpf in snd_usb_pipe_sanity_check
        ALSA: pcm: fix lost wakeup event scenarios in snd_pcm_drain
        ALSA: hda: Fix 1-minute detection delay when i915 module is not available
      75cdf416
    • Linus Torvalds's avatar
      Merge tag 'drm-fixes-2019-08-02' of git://anongit.freedesktop.org/drm/drm · f26dbb23
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "Thanks to Daniel for handling the email the last couple of weeks, flus
        and break-ins combined to derail me. Surprised nothing materialised
        today to take me out again.
      
        Just more amdgpu navi fixes, msm fixes and a single nouveau regression
        fix:
      
        amdgpu:
         - navi10 temperature and pstate fixes
         - vcn dynamic power management fix
         - CS ioctl error handling fix
         - debugfs info leak fix
         - amdkfd VegaM fix
      
        msm:
         - dma sync call fix
         - mdp5 dsi command mode fix
         - fall-through fixes
         - disabled GPU fix
      
        nouveau:
         - regression fix for displayport MST support"
      
      * tag 'drm-fixes-2019-08-02' of git://anongit.freedesktop.org/drm/drm:
        drm/nouveau: Only release VCPI slots on mode changes
        drm: msm: Fix add_gpu_components
        drm/msm: Annotate intentional switch statement fall throughs
        drm/msm: add support for per-CRTC max_vblank_count on mdp5
        drm/msm: Use the correct dma_sync calls in msm_gem
        drm/amd/powerplay: correct UVD/VCE/VCN power status retrieval
        drm/amd/powerplay: correct Navi10 VCN powergate control (v2)
        drm/amd/powerplay: support VCN powergate status retrieval for SW SMU
        drm/amd/powerplay: support VCN powergate status retrieval on Raven
        drm/amd/powerplay: add new sensor type for VCN powergate status
        drm/amdgpu: fix a potential information leaking bug
        drm/amdgpu: fix error handling in amdgpu_cs_process_fence_dep
        drm/amd/powerplay: enable SW SMU reset functionality
        drm/amd/powerplay: fix null pointer dereference around dpm state relates
        drm/amdgpu/powerplay: use proper revision id for navi
        drm/amd/powerplay: fix temperature granularity error in smu11
        drm/amd/powerplay: add callback function of get_thermal_temperature_range
        drm/amdkfd: Fix byte align on VegaM
      f26dbb23
    • Linus Torvalds's avatar
      Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux · 42d21900
      Linus Torvalds authored
      Pull clk fixes from Stephen Boyd:
       "A few fixes for code that came in during the merge window or that
        started getting exercised differently this time around:
      
         - Select regmap MMIO kconfig in spreadtrum driver to avoid compile
           errors
      
         - Complete kerneldoc on devm_clk_bulk_get_optional()
      
         - Register an essential clk earlier on mediatek mt8183 SoCs so the
           clocksource driver can use it
      
         - Fix divisor math in the at91 driver
      
         - Plug a race in Renesas reset control logic"
      
      * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux:
        clk: renesas: cpg-mssr: Fix reset control race condition
        clk: sprd: Select REGMAP_MMIO to avoid compile errors
        clk: mediatek: mt8183: Register 13MHz clock earlier for clocksource
        clk: Add missing documentation of devm_clk_bulk_get_optional() argument
        clk: at91: generated: Truncate divisor to GENERATED_MAX_DIV + 1
      42d21900
    • Linus Torvalds's avatar
      Merge tag 'arm-swiotlb-5.3' of git://git.infradead.org/users/hch/dma-mapping · 234172f6
      Linus Torvalds authored
      Pull arm swiotlb support from Christoph Hellwig:
       "This fixes a cascade of regressions that originally started with the
        addition of the ia64 port, but only got fatal once we removed most
        uses of block layer bounce buffering in Linux 4.18.
      
        The reason is that while the original i386/PAE code that was the first
        architecture that supported > 4GB of memory without an iommu decided
        to leave bounce buffering to the subsystems, which in those days just
        mean block and networking as no one else consumed arbitrary userspace
        memory.
      
        Later with ia64, x86_64 and other ports we assumed that either an
        iommu or something that fakes it up ("software IOTLB" in beautiful
        Intel speak) is present and that subsystems can rely on that for
        dealing with addressing limitations in devices. Except that the ARM
        LPAE scheme that added larger physical address to 32-bit ARM did not
        follow that scheme and thus only worked by chance and only for block
        and networking I/O directly to highmem.
      
        Long story, short fix - add swiotlb support to arm when build for LPAE
        platforms, which actuallys turns out to be pretty trivial with the
        modern dma-direct / swiotlb code to fix the Linux 4.18-ish regression"
      
      * tag 'arm-swiotlb-5.3' of git://git.infradead.org/users/hch/dma-mapping:
        arm: use swiotlb for bounce buffering on LPAE configs
        dma-mapping: check pfn validity in dma_common_{mmap,get_sgtable}
      234172f6
    • Linus Torvalds's avatar
      Merge tag 'dma-mapping-5.3-3' of git://git.infradead.org/users/hch/dma-mapping · 35fca9f8
      Linus Torvalds authored
      Pull dma-mapping regression fixes from Christoph Hellwig:
       "Two related regression fixes for changes from this merge window to fix
        alignment issues introduced in the CMA allocation rework (Nicolin
        Chen)"
      
      * tag 'dma-mapping-5.3-3' of git://git.infradead.org/users/hch/dma-mapping:
        dma-contiguous: page-align the size in dma_free_contiguous()
        dma-contiguous: do not overwrite align in dma_alloc_contiguous()
      35fca9f8
    • Stefan Haberland's avatar
      s390/dasd: fix endless loop after read unit address configuration · 41995342
      Stefan Haberland authored
      After getting a storage server event that causes the DASD device driver
      to update its unit address configuration during a device shutdown there is
      the possibility of an endless loop in the device driver.
      
      In the system log there will be ongoing DASD error messages with RC: -19.
      
      The reason is that the loop starting the ruac request only terminates when
      the retry counter is decreased to 0. But in the sleep_on function there are
      early exit paths that do not decrease the retry counter.
      
      Prevent an endless loop by handling those cases separately.
      
      Remove the unnecessary do..while loop since the sleep_on function takes
      care of retries by itself.
      
      Fixes: 8e09f215 ("[S390] dasd: add hyper PAV support to DASD device driver, part 1")
      Cc: stable@vger.kernel.org # 2.6.25+
      Signed-off-by: default avatarStefan Haberland <sth@linux.ibm.com>
      Reviewed-by: default avatarJan Hoeppner <hoeppner@linux.ibm.com>
      Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
      41995342
    • Dave Airlie's avatar
      Merge tag 'msm-fixes-2019_08_01' of https://gitlab.freedesktop.org/drm/msm into drm-fixes · f8981e03
      Dave Airlie authored
      - Fix the dma_sync calls applied last week (Rob)
      - Fix mdp5 dsi command mode (Brian)
      - Squash fall through warnings (Jordan)
      - Don't add disabled gpu nodes to the of device list (Jeffrey)
      
      Cc: Jeffrey Hugo <jeffrey.l.hugo@gmail.com>
      Cc: Jordan Crouse <jcrouse@codeaurora.org>
      Cc: Brian Masney <masneyb@onstation.org>
      Cc: Rob Clark <robdclark@chromium.org>
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      
      # gpg: Signature made Fri 02 Aug 2019 05:54:27 AM AEST
      # gpg:                using RSA key 96F70DFDA84A070A
      # gpg: Can't check signature: public key not found
      From: Sean Paul <sean@poorly.run>
      Link: https://patchwork.freedesktop.org/patch/msgid/20190801200439.GV104440@art_vandelay
      f8981e03
  2. 01 Aug, 2019 18 commits
    • Lyude Paul's avatar
      drm/nouveau: Only release VCPI slots on mode changes · 412e85b6
      Lyude Paul authored
      Looks like a regression got introduced into nv50_mstc_atomic_check()
      that somehow didn't get found until now. If userspace changes
      crtc_state->active to false but leaves the CRTC enabled, we end up
      calling drm_dp_atomic_find_vcpi_slots() using the PBN calculated in
      asyh->dp.pbn. However, if the display is inactive we end up calculating
      a PBN of 0, which inadvertently causes us to have an allocation of 0.
      >From there, if userspace then disables the CRTC afterwards we end up
      accidentally attempting to free the VCPI twice:
      
      WARNING: CPU: 0 PID: 1484 at drivers/gpu/drm/drm_dp_mst_topology.c:3336
      drm_dp_atomic_release_vcpi_slots+0x87/0xb0 [drm_kms_helper]
      RIP: 0010:drm_dp_atomic_release_vcpi_slots+0x87/0xb0 [drm_kms_helper]
      Call Trace:
       drm_atomic_helper_check_modeset+0x3f3/0xa60 [drm_kms_helper]
       ? drm_atomic_check_only+0x43/0x780 [drm]
       drm_atomic_helper_check+0x15/0x90 [drm_kms_helper]
       nv50_disp_atomic_check+0x83/0x1d0 [nouveau]
       drm_atomic_check_only+0x54d/0x780 [drm]
       ? drm_atomic_set_crtc_for_connector+0xec/0x100 [drm]
       drm_atomic_commit+0x13/0x50 [drm]
       drm_atomic_helper_set_config+0x81/0x90 [drm_kms_helper]
       drm_mode_setcrtc+0x194/0x6a0 [drm]
       ? vprintk_emit+0x16a/0x230
       ? drm_ioctl+0x163/0x390 [drm]
       ? drm_mode_getcrtc+0x180/0x180 [drm]
       drm_ioctl_kernel+0xaa/0xf0 [drm]
       drm_ioctl+0x208/0x390 [drm]
       ? drm_mode_getcrtc+0x180/0x180 [drm]
       nouveau_drm_ioctl+0x63/0xb0 [nouveau]
       do_vfs_ioctl+0x405/0x660
       ? recalc_sigpending+0x17/0x50
       ? _copy_from_user+0x37/0x60
       ksys_ioctl+0x5e/0x90
       ? exit_to_usermode_loop+0x92/0xe0
       __x64_sys_ioctl+0x16/0x20
       do_syscall_64+0x59/0x190
       entry_SYSCALL_64_after_hwframe+0x44/0xa9
      WARNING: CPU: 0 PID: 1484 at drivers/gpu/drm/drm_dp_mst_topology.c:3336
      drm_dp_atomic_release_vcpi_slots+0x87/0xb0 [drm_kms_helper]
      ---[ end trace 4c395c0c51b1f88d ]---
      [drm:drm_dp_atomic_release_vcpi_slots [drm_kms_helper]] *ERROR* no VCPI for
      [MST PORT:00000000e288eb7d] found in mst state 000000008e642070
      
      So, fix this by doing what we probably should have done from the start: only
      call drm_dp_atomic_find_vcpi_slots() when crtc_state->mode_changed is set, so
      that VCPI allocations remain for as long as the CRTC is enabled.
      Signed-off-by: default avatarLyude Paul <lyude@redhat.com>
      Fixes: 232c9eec ("drm/nouveau: Use atomic VCPI helpers for MST")
      Cc: Lyude Paul <lyude@redhat.com>
      Cc: Ben Skeggs <bskeggs@redhat.com>
      Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
      Cc: David Airlie <airlied@redhat.com>
      Cc: Jerry Zuo <Jerry.Zuo@amd.com>
      Cc: Harry Wentland <harry.wentland@amd.com>
      Cc: Juston Li <juston.li@intel.com>
      Cc: Karol Herbst <karolherbst@gmail.com>
      Cc: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
      Cc: Ilia Mirkin <imirkin@alum.mit.edu>
      Cc: <stable@vger.kernel.org> # v5.1+
      Acked-by: default avatarBen Skeggs <bskeggs@redhat.com>
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20190801220216.15323-1-lyude@redhat.com
      412e85b6
    • Dave Airlie's avatar
      Merge tag 'drm-fixes-5.3-2019-07-31' of git://people.freedesktop.org/~agd5f/linux into drm-fixes · 4b381ee2
      Dave Airlie authored
      drm-fixes-5.3-2019-07-31:
      
      amdgpu:
      - Fix temperature granularity for navi
      - Fix stable pstate setting for navi
      - Fix VCN DPM enablement on navi
      - Fix error handling on CS ioctl when processing dependencies
      - Fix possible information leak in debugfs
      
      amdkfd:
      - fix memory alignment for VegaM
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      From: Alex Deucher <alexdeucher@gmail.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20190731191648.25729-1-alexander.deucher@amd.com
      4b381ee2
    • Rafael J. Wysocki's avatar
      ACPI: PM: Fix regression in acpi_device_set_power() · 42787ed7
      Rafael J. Wysocki authored
      Commit f850a48a ("ACPI: PM: Allow transitions to D0 to occur in
      special cases") overlooked the fact that acpi_power_transition() may
      change the power.state value for the target device and if that
      happens, it may confuse acpi_device_set_power() and cause it to
      omit the _PS0 evaluation which on some systems is necessary to
      change power states of devices from low-power to D0.
      
      Fix that by saving the current value of power.state for the
      target device before passing it to acpi_power_transition() and
      using the saved value in a subsequent check.
      
      Fixes: f850a48a ("ACPI: PM: Allow transitions to D0 to occur in special cases")
      Reported-by: default avatarKai-Heng Feng <kai.heng.feng@canonical.com>
      Reported-by: default avatarMario Limonciello <mario.limonciello@dell.com>
      Signed-off-by: default avatarRafael J. Wysocki <rafael.j.wysocki@intel.com>
      Tested-by: default avatarKai-Heng Feng <kai.heng.feng@canonical.com>
      Tested-by: default avatarMario Limonciello <mario.limonciello@dell.com>
      42787ed7
    • Damien Le Moal's avatar
      block: Fix __blkdev_direct_IO() for bio fragments · 0eb6ddfb
      Damien Le Moal authored
      The recent fix to properly handle IOCB_NOWAIT for async O_DIRECT IO
      (patch 6a43074e) introduced two problems with BIO fragment handling
      for direct IOs:
      1) The dio size processed is calculated by incrementing the ret variable
      by the size of the bio fragment issued for the dio. However, this size
      is obtained directly from bio->bi_iter.bi_size AFTER the bio submission
      which may result in referencing the bi_size value after the bio
      completed, resulting in an incorrect value use.
      2) The ret variable is not incremented by the size of the last bio
      fragment issued for the bio, leading to an invalid IO size being
      returned to the user.
      
      Fix both problem by using dio->size (which is incremented before the bio
      submission) to update the value of ret after bio submissions, including
      for the last bio fragment issued.
      
      Fixes: 6a43074e ("block: properly handle IOCB_NOWAIT for async O_DIRECT IO")
      Reported-by: default avatarMasato Suzuki <masato.suzuki@wdc.com>
      Signed-off-by: default avatarDamien Le Moal <damien.lemoal@wdc.com>
      Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
      0eb6ddfb
    • Wei Yongjun's avatar
      RDMA/hns: Fix error return code in hns_roce_v1_rsv_lp_qp() · 020fb3be
      Wei Yongjun authored
      Fix to return error code -ENOMEM from the rdma_zalloc_drv_obj() error
      handling case instead of 0, as done elsewhere in this function.
      
      Fixes: e8ac9389 ("RDMA: Fix allocation failure on pointer pd")
      Fixes: 21a428a0 ("RDMA: Handle PD allocations by IB/core")
      Signed-off-by: default avatarWei Yongjun <weiyongjun1@huawei.com>
      Reviewed-by: default avatarLeon Romanovsky <leonro@mellanox.com>
      Link: https://lore.kernel.org/r/20190801012725.150493-1-weiyongjun1@huawei.comSigned-off-by: default avatarDoug Ledford <dledford@redhat.com>
      020fb3be
    • Jeffrey Hugo's avatar
      drm: msm: Fix add_gpu_components · 9ca7ad6c
      Jeffrey Hugo authored
      add_gpu_components() adds found GPU nodes from the DT to the match list,
      regardless of the status of the nodes.  This is a problem, because if the
      nodes are disabled, they should not be on the match list because they will
      not be matched.  This prevents display from initing if a GPU node is
      defined, but it's status is disabled.
      
      Fix this by checking the node's status before adding it to the match list.
      
      Fixes: dc3ea265 (drm/msm: Drop the gpu binding)
      Reviewed-by: default avatarRob Clark <robdclark@gmail.com>
      Signed-off-by: default avatarJeffrey Hugo <jeffrey.l.hugo@gmail.com>
      Signed-off-by: default avatarSean Paul <seanpaul@chromium.org>
      Link: https://patchwork.freedesktop.org/patch/msgid/20190626180015.45242-1-jeffrey.l.hugo@gmail.com
      9ca7ad6c
    • Leon Romanovsky's avatar
      RDMA/mlx5: Release locks during notifier unregister · 23eaf3b5
      Leon Romanovsky authored
      The below kernel panic was observed when created bond mode LACP
      with GRE tunnel on top. The reason to it was not released spinlock
      during mlx5 notify unregsiter sequence.
      
      [  234.562007] BUG: scheduling while atomic: sh/10900/0x00000002
      [  234.563005] Preemption disabled at:
      [  234.566864] ------------[ cut here ]------------
      [  234.567120] DEBUG_LOCKS_WARN_ON(val > preempt_count())
      [  234.567139] WARNING: CPU: 16 PID: 10900 at kernel/sched/core.c:3203 preempt_count_sub+0xca/0x170
      [  234.569550] CPU: 16 PID: 10900 Comm: sh Tainted: G        W 5.2.0-rc1-for-linust-dbg-2019-05-25_04-57-33-60 #1
      [  234.569886] Hardware name: Dell Inc. PowerEdge R720/0X3D66, BIOS 2.6.1 02/12/2018
      [  234.570183] RIP: 0010:preempt_count_sub+0xca/0x170
      [  234.570404] Code: 03 38
      d0 7c 08 84 d2 0f 85 b0 00 00 00 8b 15 dd 02 03 04 85 d2 75 ba 48 c7 c6
      00 e1 88 83 48 c7 c7 40 e1 88 83 e8 76 11 f7 ff <0f> 0b 5b c3 65 8b 05
      d3 1f d8 7e 84 c0 75 82 e8 62 c3 c3 00 85 c0
      [  234.570911] RSP: 0018:ffff888b94477b08 EFLAGS: 00010286
      [  234.571133] RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000
      [  234.571391] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000246
      [  234.571648] RBP: ffff888ba5560000 R08: fffffbfff08962d5 R09: fffffbfff08962d5
      [  234.571902] R10: 0000000000000001 R11: fffffbfff08962d4 R12: ffff888bac6e9548
      [  234.572157] R13: ffff888babfaf728 R14: ffff888bac6e9568 R15: ffff888babfaf750
      [  234.572412] FS: 00007fcafa59b740(0000) GS:ffff888bed200000(0000) knlGS:0000000000000000
      [  234.572686] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [  234.572914] CR2: 00007f984f16b140 CR3: 0000000b2bf0a001 CR4: 00000000001606e0
      [  234.573172] Call Trace:
      [  234.573336] _raw_spin_unlock+0x2e/0x50
      [  234.573542] mlx5_ib_unbind_slave_port+0x1bc/0x690 [mlx5_ib]
      [  234.573793] mlx5_ib_cleanup_multiport_master+0x1d3/0x660 [mlx5_ib]
      [  234.574039] mlx5_ib_stage_init_cleanup+0x4c/0x360 [mlx5_ib]
      [  234.574271]  ? kfree+0xf5/0x2f0
      [  234.574465] __mlx5_ib_remove+0x61/0xd0 [mlx5_ib]
      [  234.574688]  ? __mlx5_ib_remove+0xd0/0xd0 [mlx5_ib]
      [  234.574951] mlx5_remove_device+0x234/0x300 [mlx5_core]
      [  234.575224] mlx5_unregister_device+0x4d/0x1e0 [mlx5_core]
      [  234.575493] remove_one+0x4f/0x160 [mlx5_core]
      [  234.575704] pci_device_remove+0xef/0x2a0
      [  234.581407]  ? pcibios_free_irq+0x10/0x10
      [  234.587143]  ? up_read+0xc1/0x260
      [  234.592785] device_release_driver_internal+0x1ab/0x430
      [  234.598442] unbind_store+0x152/0x200
      [  234.604064]  ? sysfs_kf_write+0x3b/0x180
      [  234.609441]  ? sysfs_file_ops+0x160/0x160
      [  234.615021] kernfs_fop_write+0x277/0x440
      [  234.620288]  ? __sb_start_write+0x1ef/0x2c0
      [  234.625512] vfs_write+0x15e/0x460
      [  234.630786] ksys_write+0x156/0x1e0
      [  234.635988]  ? __ia32_sys_read+0xb0/0xb0
      [  234.641120]  ? trace_hardirqs_off_thunk+0x1a/0x1c
      [  234.646163] do_syscall_64+0x95/0x470
      [  234.651106] entry_SYSCALL_64_after_hwframe+0x49/0xbe
      [  234.656004] RIP: 0033:0x7fcaf9c9cfd0
      [  234.660686] Code: 73 01
      c3 48 8b 0d c0 6e 2d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00
      83 3d cd cf 2d 00 00 75 10 b8 01 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73
      31 c3 48 83 ec 08 e8 ee cb 01 00 48 89 04 24
      [  234.670128] RSP: 002b:00007ffd3b01ddd8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
      [  234.674811] RAX: ffffffffffffffda RBX: 000000000000000d RCX: 00007fcaf9c9cfd0
      [  234.679387] RDX: 000000000000000d RSI: 00007fcafa5c1000 RDI: 0000000000000001
      [  234.683848] RBP: 00007fcafa5c1000 R08: 000000000000000a R09: 00007fcafa59b740
      [  234.688167] R10: 00007ffd3b01d8e0 R11: 0000000000000246 R12: 00007fcaf9f75400
      [  234.692386] R13: 000000000000000d R14: 0000000000000001 R15: 0000000000000000
      [  234.696495] irq event stamp: 153067
      [  234.700525] hardirqs last enabled at (153067): [<ffffffff83258c39>] _raw_spin_unlock_irqrestore+0x59/0x70
      [  234.704665] hardirqs last disabled at (153066): [<ffffffff83259382>] _raw_spin_lock_irqsave+0x22/0x90
      [  234.708722] softirqs last enabled at (153058): [<ffffffff836006c5>] __do_softirq+0x6c5/0xb4e
      [  234.712673] softirqs last disabled at (153051): [<ffffffff81227c1d>] irq_exit+0x17d/0x1d0
      [  234.716601] ---[ end trace 5dbf096843ee9ce6 ]---
      
      Fixes: df097a27 ("IB/mlx5: Use the new mlx5 core notifier API")
      Signed-off-by: default avatarLeon Romanovsky <leonro@mellanox.com>
      Link: https://lore.kernel.org/r/20190731083852.584-1-leon@kernel.orgSigned-off-by: default avatarDoug Ledford <dledford@redhat.com>
      23eaf3b5
    • Gustavo A. R. Silva's avatar
      IB/hfi1: Fix Spectre v1 vulnerability · 6497d0a9
      Gustavo A. R. Silva authored
      sl is controlled by user-space, hence leading to a potential
      exploitation of the Spectre variant 1 vulnerability.
      
      Fix this by sanitizing sl before using it to index ibp->sl_to_sc.
      
      Notice that given that speculation windows are large, the policy is
      to kill the speculation on the first load and not worry if it can be
      completed with a dependent load/store [1].
      
      [1] https://lore.kernel.org/lkml/20180423164740.GY17484@dhcp22.suse.cz/
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarGustavo A. R. Silva <gustavo@embeddedor.com>
      Link: https://lore.kernel.org/r/20190731175428.GA16736@embeddedorSigned-off-by: default avatarDoug Ledford <dledford@redhat.com>
      6497d0a9
    • Jack Morgenstein's avatar
      IB/mad: Fix use-after-free in ib mad completion handling · 770b7d96
      Jack Morgenstein authored
      We encountered a use-after-free bug when unloading the driver:
      
      [ 3562.116059] BUG: KASAN: use-after-free in ib_mad_post_receive_mads+0xddc/0xed0 [ib_core]
      [ 3562.117233] Read of size 4 at addr ffff8882ca5aa868 by task kworker/u13:2/23862
      [ 3562.118385]
      [ 3562.119519] CPU: 2 PID: 23862 Comm: kworker/u13:2 Tainted: G           OE     5.1.0-for-upstream-dbg-2019-05-19_16-44-30-13 #1
      [ 3562.121806] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu2 04/01/2014
      [ 3562.123075] Workqueue: ib-comp-unb-wq ib_cq_poll_work [ib_core]
      [ 3562.124383] Call Trace:
      [ 3562.125640]  dump_stack+0x9a/0xeb
      [ 3562.126911]  print_address_description+0xe3/0x2e0
      [ 3562.128223]  ? ib_mad_post_receive_mads+0xddc/0xed0 [ib_core]
      [ 3562.129545]  __kasan_report+0x15c/0x1df
      [ 3562.130866]  ? ib_mad_post_receive_mads+0xddc/0xed0 [ib_core]
      [ 3562.132174]  kasan_report+0xe/0x20
      [ 3562.133514]  ib_mad_post_receive_mads+0xddc/0xed0 [ib_core]
      [ 3562.134835]  ? find_mad_agent+0xa00/0xa00 [ib_core]
      [ 3562.136158]  ? qlist_free_all+0x51/0xb0
      [ 3562.137498]  ? mlx4_ib_sqp_comp_worker+0x1970/0x1970 [mlx4_ib]
      [ 3562.138833]  ? quarantine_reduce+0x1fa/0x270
      [ 3562.140171]  ? kasan_unpoison_shadow+0x30/0x40
      [ 3562.141522]  ib_mad_recv_done+0xdf6/0x3000 [ib_core]
      [ 3562.142880]  ? _raw_spin_unlock_irqrestore+0x46/0x70
      [ 3562.144277]  ? ib_mad_send_done+0x1810/0x1810 [ib_core]
      [ 3562.145649]  ? mlx4_ib_destroy_cq+0x2a0/0x2a0 [mlx4_ib]
      [ 3562.147008]  ? _raw_spin_unlock_irqrestore+0x46/0x70
      [ 3562.148380]  ? debug_object_deactivate+0x2b9/0x4a0
      [ 3562.149814]  __ib_process_cq+0xe2/0x1d0 [ib_core]
      [ 3562.151195]  ib_cq_poll_work+0x45/0xf0 [ib_core]
      [ 3562.152577]  process_one_work+0x90c/0x1860
      [ 3562.153959]  ? pwq_dec_nr_in_flight+0x320/0x320
      [ 3562.155320]  worker_thread+0x87/0xbb0
      [ 3562.156687]  ? __kthread_parkme+0xb6/0x180
      [ 3562.158058]  ? process_one_work+0x1860/0x1860
      [ 3562.159429]  kthread+0x320/0x3e0
      [ 3562.161391]  ? kthread_park+0x120/0x120
      [ 3562.162744]  ret_from_fork+0x24/0x30
      ...
      [ 3562.187615] Freed by task 31682:
      [ 3562.188602]  save_stack+0x19/0x80
      [ 3562.189586]  __kasan_slab_free+0x11d/0x160
      [ 3562.190571]  kfree+0xf5/0x2f0
      [ 3562.191552]  ib_mad_port_close+0x200/0x380 [ib_core]
      [ 3562.192538]  ib_mad_remove_device+0xf0/0x230 [ib_core]
      [ 3562.193538]  remove_client_context+0xa6/0xe0 [ib_core]
      [ 3562.194514]  disable_device+0x14e/0x260 [ib_core]
      [ 3562.195488]  __ib_unregister_device+0x79/0x150 [ib_core]
      [ 3562.196462]  ib_unregister_device+0x21/0x30 [ib_core]
      [ 3562.197439]  mlx4_ib_remove+0x162/0x690 [mlx4_ib]
      [ 3562.198408]  mlx4_remove_device+0x204/0x2c0 [mlx4_core]
      [ 3562.199381]  mlx4_unregister_interface+0x49/0x1d0 [mlx4_core]
      [ 3562.200356]  mlx4_ib_cleanup+0xc/0x1d [mlx4_ib]
      [ 3562.201329]  __x64_sys_delete_module+0x2d2/0x400
      [ 3562.202288]  do_syscall_64+0x95/0x470
      [ 3562.203277]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
      
      The problem was that the MAD PD was deallocated before the MAD CQ.
      There was completion work pending for the CQ when the PD got deallocated.
      When the mad completion handling reached procedure
      ib_mad_post_receive_mads(), we got a use-after-free bug in the following
      line of code in that procedure:
         sg_list.lkey = qp_info->port_priv->pd->local_dma_lkey;
      (the pd pointer in the above line is no longer valid, because the
      pd has been deallocated).
      
      We fix this by allocating the PD before the CQ in procedure
      ib_mad_port_open(), and deallocating the PD after freeing the CQ
      in procedure ib_mad_port_close().
      
      Since the CQ completion work queue is flushed during ib_free_cq(),
      no completions will be pending for that CQ when the PD is later
      deallocated.
      
      Note that freeing the CQ before deallocating the PD is the practice
      in the ULPs.
      
      Fixes: 4be90bc6 ("IB/mad: Remove ib_get_dma_mr calls")
      Signed-off-by: default avatarJack Morgenstein <jackm@dev.mellanox.co.il>
      Signed-off-by: default avatarLeon Romanovsky <leonro@mellanox.com>
      Link: https://lore.kernel.org/r/20190801121449.24973-1-leon@kernel.orgSigned-off-by: default avatarDoug Ledford <dledford@redhat.com>
      770b7d96
    • Gal Pressman's avatar
      RDMA/restrack: Track driver QP types in resource tracker · 52e0a118
      Gal Pressman authored
      The check for QP type different than XRC has excluded driver QP
      types from the resource tracker.
      As a result, "rdma resource show" user command would not show opened
      driver QPs which does not reflect the real state of the system.
      
      Check QP type explicitly instead of assuming enum values/ordering.
      
      Fixes: 40909f66 ("RDMA/efa: Add EFA verbs implementation")
      Signed-off-by: default avatarGal Pressman <galpress@amazon.com>
      Reviewed-by: default avatarLeon Romanovsky <leonro@mellanox.com>
      Link: https://lore.kernel.org/r/20190801104354.11417-1-galpress@amazon.comSigned-off-by: default avatarDoug Ledford <dledford@redhat.com>
      52e0a118
    • Guy Levi's avatar
      IB/mlx5: Fix MR registration flow to use UMR properly · e5366d30
      Guy Levi authored
      Driver shouldn't allow to use UMR to register a MR when
      umr_modify_atomic_disabled is set. Otherwise it will always end up with a
      failure in the post send flow which sets the UMR WQE to modify atomic access
      right.
      
      Fixes: c8d75a98 ("IB/mlx5: Respect new UMR capabilities")
      Signed-off-by: default avatarGuy Levi <guyle@mellanox.com>
      Reviewed-by: default avatarMoni Shoua <monis@mellanox.com>
      Signed-off-by: default avatarLeon Romanovsky <leonro@mellanox.com>
      Link: https://lore.kernel.org/r/20190731081929.32559-1-leon@kernel.orgSigned-off-by: default avatarDoug Ledford <dledford@redhat.com>
      e5366d30
    • Jason Gunthorpe's avatar
      RDMA/devices: Remove the lock around remove_client_context · 9cd58817
      Jason Gunthorpe authored
      Due to the complexity of client->remove() callbacks it is desirable to not
      hold any locks while calling them. Remove the last one by tracking only
      the highest client ID and running backwards from there over the xarray.
      
      Since the only purpose of that lock was to protect the linked list, we can
      drop the lock.
      Signed-off-by: default avatarJason Gunthorpe <jgg@mellanox.com>
      Signed-off-by: default avatarLeon Romanovsky <leonro@mellanox.com>
      Link: https://lore.kernel.org/r/20190731081841.32345-3-leon@kernel.orgSigned-off-by: default avatarDoug Ledford <dledford@redhat.com>
      9cd58817
    • Jason Gunthorpe's avatar
      RDMA/devices: Do not deadlock during client removal · 621e55ff
      Jason Gunthorpe authored
      lockdep reports:
      
         WARNING: possible circular locking dependency detected
      
         modprobe/302 is trying to acquire lock:
         0000000007c8919c ((wq_completion)ib_cm){+.+.}, at: flush_workqueue+0xdf/0x990
      
         but task is already holding lock:
         000000002d3d2ca9 (&device->client_data_rwsem){++++}, at: remove_client_context+0x79/0xd0 [ib_core]
      
         which lock already depends on the new lock.
      
         the existing dependency chain (in reverse order) is:
      
         -> #2 (&device->client_data_rwsem){++++}:
                down_read+0x3f/0x160
                ib_get_net_dev_by_params+0xd5/0x200 [ib_core]
                cma_ib_req_handler+0x5f6/0x2090 [rdma_cm]
                cm_process_work+0x29/0x110 [ib_cm]
                cm_req_handler+0x10f5/0x1c00 [ib_cm]
                cm_work_handler+0x54c/0x311d [ib_cm]
                process_one_work+0x4aa/0xa30
                worker_thread+0x62/0x5b0
                kthread+0x1ca/0x1f0
                ret_from_fork+0x24/0x30
      
         -> #1 ((work_completion)(&(&work->work)->work)){+.+.}:
                process_one_work+0x45f/0xa30
                worker_thread+0x62/0x5b0
                kthread+0x1ca/0x1f0
                ret_from_fork+0x24/0x30
      
         -> #0 ((wq_completion)ib_cm){+.+.}:
                lock_acquire+0xc8/0x1d0
                flush_workqueue+0x102/0x990
                cm_remove_one+0x30e/0x3c0 [ib_cm]
                remove_client_context+0x94/0xd0 [ib_core]
                disable_device+0x10a/0x1f0 [ib_core]
                __ib_unregister_device+0x5a/0xe0 [ib_core]
                ib_unregister_device+0x21/0x30 [ib_core]
                mlx5_ib_stage_ib_reg_cleanup+0x9/0x10 [mlx5_ib]
                __mlx5_ib_remove+0x3d/0x70 [mlx5_ib]
                mlx5_ib_remove+0x12e/0x140 [mlx5_ib]
                mlx5_remove_device+0x144/0x150 [mlx5_core]
                mlx5_unregister_interface+0x3f/0xf0 [mlx5_core]
                mlx5_ib_cleanup+0x10/0x3a [mlx5_ib]
                __x64_sys_delete_module+0x227/0x350
                do_syscall_64+0xc3/0x6a4
                entry_SYSCALL_64_after_hwframe+0x49/0xbe
      
      Which is due to the read side of the client_data_rwsem being obtained
      recursively through a work queue flush during cm client removal.
      
      The lock is being held across the remove in remove_client_context() so
      that the function is a fence, once it returns the client is removed. This
      is required so that the two callers do not proceed with destruction until
      the client completes removal.
      
      Instead of using client_data_rwsem use the existing device unregistration
      refcount and add a similar client unregistration (client->uses) refcount.
      
      This will fence the two unregistration paths without holding any locks.
      
      Cc: <stable@vger.kernel.org>
      Fixes: 921eab11 ("RDMA/devices: Re-organize device.c locking")
      Signed-off-by: default avatarJason Gunthorpe <jgg@mellanox.com>
      Signed-off-by: default avatarLeon Romanovsky <leonro@mellanox.com>
      Link: https://lore.kernel.org/r/20190731081841.32345-2-leon@kernel.orgSigned-off-by: default avatarDoug Ledford <dledford@redhat.com>
      621e55ff
    • Luck, Tony's avatar
      IB/core: Add mitigation for Spectre V1 · 61f25982
      Luck, Tony authored
      Some processors may mispredict an array bounds check and
      speculatively access memory that they should not. With
      a user supplied array index we like to play things safe
      by masking the value with the array size before it is
      used as an index.
      Signed-off-by: default avatarTony Luck <tony.luck@intel.com>
      Link: https://lore.kernel.org/r/20190731043957.GA1600@agluck-desk2.amr.corp.intel.comSigned-off-by: default avatarDoug Ledford <dledford@redhat.com>
      61f25982
    • Jordan Crouse's avatar
      drm/msm: Annotate intentional switch statement fall throughs · c14b5dce
      Jordan Crouse authored
      Explicitly mark intentional fall throughs in switch statements to keep
      -Wimplicit-fallthrough from complaining.
      Reviewed-by: default avatarRob Clark <robdclark@gmail.com>
      Signed-off-by: default avatarJordan Crouse <jcrouse@codeaurora.org>
      Signed-off-by: default avatarSean Paul <seanpaul@chromium.org>
      Link: https://patchwork.freedesktop.org/patch/msgid/1564073588-27386-1-git-send-email-jcrouse@codeaurora.org
      c14b5dce
    • Brian Masney's avatar
      drm/msm: add support for per-CRTC max_vblank_count on mdp5 · 2bab52af
      Brian Masney authored
      The mdp5 drm/kms driver currently does not work on command-mode DSI
      panels due to 'vblank wait timed out' errors. This causes a latency
      of seconds, or tens of seconds in some cases, before content is shown
      on the panel. This hardware does not have the something that we can use
      as a frame counter available when running in command mode, so we need to
      fall back to using timestamps by setting the max_vblank_count to zero.
      This can be done on a per-CRTC basis, so the convert mdp5 to use
      drm_crtc_set_max_vblank_count().
      
      This change was tested on a LG Nexus 5 (hammerhead) phone.
      Suggested-by: default avatarJeffrey Hugo <jeffrey.l.hugo@gmail.com>
      Reviewed-by: default avatarJeffrey Hugo <jeffrey.l.hugo@gmail.com>
      Signed-off-by: default avatarBrian Masney <masneyb@onstation.org>
      Signed-off-by: default avatarSean Paul <seanpaul@chromium.org>
      Link: https://patchwork.freedesktop.org/patch/msgid/20190531094619.31704-3-masneyb@onstation.org
      2bab52af
    • Linus Torvalds's avatar
      Merge tag 'mmc-v5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc · 1e78030e
      Linus Torvalds authored
      Pull MMC fixes from Ulf Hansson:
      
       - sdhci-sprd: Add a missing pm_runtime_put_noidle() to fix deferred
         probe
      
       - dw_mmc: Fix occasional hang after tuning on eMMC
      
       - meson-mx-sdio: Fix misuse of GENMASK macro
      
       - mmc_spi: Fix CRC problems for writes by using BDI_CAP_STABLE_WRITES
      
      * tag 'mmc-v5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:
        mmc: mmc_spi: Enable stable writes
        mmc: meson-mx-sdio: Fix misuse of GENMASK macro
        mmc: dw_mmc: Fix occasional hang after tuning on eMMC
        mmc: host: sdhci-sprd: Fix the missing pm_runtime_put_noidle()
      1e78030e
    • Linus Torvalds's avatar
      Merge tag 'gpio-v5.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio · 28f5ab1e
      Linus Torvalds authored
      Pull GPIO fixes from Linus Walleij:
       "Three GPIO fixes, all touching the core, so quite important:
      
         - Fix the request of active low GPIO line events.
      
         - Don't issue WARN() stuff on NULL descriptors if the GPIOLIB is
           disabled.
      
         - Preserve the descriptor flags when setting the initial direction on
           lines"
      
      * tag 'gpio-v5.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio:
        gpiolib: Preserve desc->flags when setting state
        gpio: don't WARN() on NULL descs if gpiolib is disabled
        gpiolib: fix incorrect IRQ requesting of an active-low lineevent
      28f5ab1e
  3. 31 Jul, 2019 8 commits
    • Rob Clark's avatar
      drm/msm: Use the correct dma_sync calls in msm_gem · 3de433c5
      Rob Clark authored
      [subject was: drm/msm: shake fist angrily at dma-mapping]
      
      So, using dma_sync_* for our cache needs works out w/ dma iommu ops, but
      it falls appart with dma direct ops.  The problem is that, depending on
      display generation, we can have either set of dma ops (mdp4 and dpu have
      iommu wired to mdss node, which maps to toplevel drm device, but mdp5
      has iommu wired up to the mdp sub-node within mdss).
      
      Fixes this splat on mdp5 devices:
      
         Unable to handle kernel paging request at virtual address ffffffff80000000
         Mem abort info:
           ESR = 0x96000144
           Exception class = DABT (current EL), IL = 32 bits
           SET = 0, FnV = 0
           EA = 0, S1PTW = 0
         Data abort info:
           ISV = 0, ISS = 0x00000144
           CM = 1, WnR = 1
         swapper pgtable: 4k pages, 48-bit VAs, pgdp=00000000810e4000
         [ffffffff80000000] pgd=0000000000000000
         Internal error: Oops: 96000144 [#1] SMP
         Modules linked in: btqcomsmd btqca bluetooth cfg80211 ecdh_generic ecc rfkill libarc4 panel_simple msm wcnss_ctrl qrtr_smd drm_kms_helper venus_enc venus_dec videobuf2_dma_sg videobuf2_memops drm venus_core ipv6 qrtr qcom_wcnss_pil v4l2_mem2mem qcom_sysmon videobuf2_v4l2 qmi_helpers videobuf2_common crct10dif_ce mdt_loader qcom_common videodev qcom_glink_smem remoteproc bmc150_accel_i2c bmc150_magn_i2c bmc150_accel_core bmc150_magn snd_soc_lpass_apq8016 snd_soc_msm8916_analog mms114 mc nf_defrag_ipv6 snd_soc_lpass_cpu snd_soc_apq8016_sbc industrialio_triggered_buffer kfifo_buf snd_soc_lpass_platform snd_soc_msm8916_digital drm_panel_orientation_quirks
         CPU: 2 PID: 33 Comm: kworker/2:1 Not tainted 5.3.0-rc2 #1
         Hardware name: Samsung Galaxy A5U (EUR) (DT)
         Workqueue: events deferred_probe_work_func
         pstate: 80000005 (Nzcv daif -PAN -UAO)
         pc : __clean_dcache_area_poc+0x20/0x38
         lr : arch_sync_dma_for_device+0x28/0x30
         sp : ffff0000115736a0
         x29: ffff0000115736a0 x28: 0000000000000001
         x27: ffff800074830800 x26: ffff000011478000
         x25: 0000000000000000 x24: 0000000000000001
         x23: ffff000011478a98 x22: ffff800009fd1c10
         x21: 0000000000000001 x20: ffff800075ad0a00
         x19: 0000000000000000 x18: ffff0000112b2000
         x17: 0000000000000000 x16: 0000000000000000
         x15: 00000000fffffff0 x14: ffff000011455d70
         x13: 0000000000000000 x12: 0000000000000028
         x11: 0000000000000001 x10: ffff00001106c000
         x9 : ffff7e0001d6b380 x8 : 0000000000001000
         x7 : ffff7e0001d6b380 x6 : ffff7e0001d6b382
         x5 : 0000000000000000 x4 : 0000000000001000
         x3 : 000000000000003f x2 : 0000000000000040
         x1 : ffffffff80001000 x0 : ffffffff80000000
         Call trace:
          __clean_dcache_area_poc+0x20/0x38
          dma_direct_sync_sg_for_device+0xb8/0xe8
          get_pages+0x22c/0x250 [msm]
          msm_gem_get_and_pin_iova+0xdc/0x168 [msm]
          ...
      
      Fixes the combination of two patches:
      
      Fixes: 0036bc73 (drm/msm: stop abusing dma_map/unmap for cache)
      Fixes: 449fa54d (dma-direct: correct the physical addr in dma_direct_sync_sg_for_cpu/device)
      Tested-by: default avatarStephan Gerhold <stephan@gerhold.net>
      Signed-off-by: default avatarRob Clark <robdclark@chromium.org>
      [seanpaul changed subject to something more desriptive]
      Signed-off-by: default avatarSean Paul <seanpaul@chromium.org>
      Link: https://patchwork.freedesktop.org/patch/msgid/20190730214633.17820-1-robdclark@gmail.com
      3de433c5
    • Linus Torvalds's avatar
      Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs · 5c620753
      Linus Torvalds authored
      Pull mount_capable() fix from Al Viro.
      
      * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
        Unbreak mount_capable()
      5c620753
    • Vladis Dronov's avatar
      Bluetooth: hci_uart: check for missing tty operations · b36a1552
      Vladis Dronov authored
      Certain ttys operations (pty_unix98_ops) lack tiocmget() and tiocmset()
      functions which are called by the certain HCI UART protocols (hci_ath,
      hci_bcm, hci_intel, hci_mrvl, hci_qca) via hci_uart_set_flow_control()
      or directly. This leads to an execution at NULL and can be triggered by
      an unprivileged user. Fix this by adding a helper function and a check
      for the missing tty operations in the protocols code.
      
      This fixes CVE-2019-10207. The Fixes: lines list commits where calls to
      tiocm[gs]et() or hci_uart_set_flow_control() were added to the HCI UART
      protocols.
      
      Link: https://syzkaller.appspot.com/bug?id=1b42faa2848963564a5b1b7f8c837ea7b55ffa50
      Reported-by: syzbot+79337b501d6aa974d0f6@syzkaller.appspotmail.com
      Cc: stable@vger.kernel.org # v2.6.36+
      Fixes: b3190df6 ("Bluetooth: Support for Atheros AR300x serial chip")
      Fixes: 118612fb ("Bluetooth: hci_bcm: Add suspend/resume PM functions")
      Fixes: ff289559 ("Bluetooth: hci_intel: Add Intel baudrate configuration support")
      Fixes: 162f812f ("Bluetooth: hci_uart: Add Marvell support")
      Fixes: fa9ad876 ("Bluetooth: hci_qca: Add support for Qualcomm Bluetooth chip wcn3990")
      Signed-off-by: default avatarVladis Dronov <vdronov@redhat.com>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      Reviewed-by: default avatarYu-Chen, Cho <acho@suse.com>
      Tested-by: default avatarYu-Chen, Cho <acho@suse.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      b36a1552
    • Laura Abbott's avatar
      mm: slub: Fix slab walking for init_on_free · 1b7e816f
      Laura Abbott authored
      To properly clear the slab on free with slab_want_init_on_free, we walk
      the list of free objects using get_freepointer/set_freepointer.
      
      The value we get from get_freepointer may not be valid.  This isn't an
      issue since an actual value will get written later but this means
      there's a chance of triggering a bug if we use this value with
      set_freepointer:
      
        kernel BUG at mm/slub.c:306!
        invalid opcode: 0000 [#1] PREEMPT PTI
        CPU: 0 PID: 0 Comm: swapper Not tainted 5.2.0-05754-g6471384a #4
        RIP: 0010:kfree+0x58a/0x5c0
        Code: 48 83 05 78 37 51 02 01 0f 0b 48 83 05 7e 37 51 02 01 48 83 05 7e 37 51 02 01 48 83 05 7e 37 51 02 01 48 83 05 d6 37 51 02 01 <0f> 0b 48 83 05 d4 37 51 02 01 48 83 05 d4 37 51 02 01 48 83 05 d4
        RSP: 0000:ffffffff82603d90 EFLAGS: 00010002
        RAX: ffff8c3976c04320 RBX: ffff8c3976c04300 RCX: 0000000000000000
        RDX: ffff8c3976c04300 RSI: 0000000000000000 RDI: ffff8c3976c04320
        RBP: ffffffff82603db8 R08: 0000000000000000 R09: 0000000000000000
        R10: ffff8c3976c04320 R11: ffffffff8289e1e0 R12: ffffd52cc8db0100
        R13: ffff8c3976c01a00 R14: ffffffff810f10d4 R15: ffff8c3976c04300
        FS:  0000000000000000(0000) GS:ffffffff8266b000(0000) knlGS:0000000000000000
        CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
        CR2: ffff8c397ffff000 CR3: 0000000125020000 CR4: 00000000000406b0
        Call Trace:
         apply_wqattrs_prepare+0x154/0x280
         apply_workqueue_attrs_locked+0x4e/0xe0
         apply_workqueue_attrs+0x36/0x60
         alloc_workqueue+0x25a/0x6d0
         workqueue_init_early+0x246/0x348
         start_kernel+0x3c7/0x7ec
         x86_64_start_reservations+0x40/0x49
         x86_64_start_kernel+0xda/0xe4
         secondary_startup_64+0xb6/0xc0
        Modules linked in:
        ---[ end trace f67eb9af4d8d492b ]---
      
      Fix this by ensuring the value we set with set_freepointer is either NULL
      or another value in the chain.
      Reported-by: default avatarkernel test robot <rong.a.chen@intel.com>
      Signed-off-by: default avatarLaura Abbott <labbott@redhat.com>
      Fixes: 6471384a ("mm: security: introduce init_on_alloc=1 and init_on_free=1 boot options")
      Reviewed-by: default avatarKees Cook <keescook@chromium.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      1b7e816f
    • Linus Torvalds's avatar
      Merge tag 'trace-v5.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace · d2eee9fc
      Linus Torvalds authored
      Pull tracing fixes from Steven Rostedt:
       "Two minor fixes:
      
         - Fix trace event header include guards, as several did not match the
           #define to the #ifdef
      
         - Remove a redundant test to ftrace_graph_notrace_addr() that was
           accidentally added"
      
      * tag 'trace-v5.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
        fgraph: Remove redundant ftrace_graph_notrace_addr() test
        tracing: Fix header include guards in trace event headers
      d2eee9fc
    • Linus Torvalds's avatar
      Merge tag 'for-linus-5.3-2' of git://github.com/cminyard/linux-ipmi · 52fde434
      Linus Torvalds authored
      Pull IPMI fix from Corey Minyard:
       "One necessary fix for an uninitialized variable in the new IPMB driver.
      
        Nothing else has come in besides things that need to wait until later"
      
      * tag 'for-linus-5.3-2' of git://github.com/cminyard/linux-ipmi:
        Fix uninitialized variable in ipmb_dev_int.c
      52fde434
    • Andreas Gruenbacher's avatar
      gfs2: Inode dirtying fix · 706cb549
      Andreas Gruenbacher authored
      With the recent iomap write page reclaim deadlock fix, it turns out that the
      GLF_DIRTY flag isn't always set when it needs to be anymore: previously, this
      happened as a side effect of always adding the inode buffer head to the current
      transaction with gfs2_trans_add_meta, but this isn't happening consistently
      anymore.  Fix by removing an additional unnecessary gfs2_trans_add_meta call
      and by setting the GLF_DIRTY flag in gfs2_iomap_end.
      
      (The GLF_DIRTY flag causes inode_go_sync to flush the transaction log when
      syncing out the glock of that inode.  When the flag isn't set, inode_go_sync
      will skip inodes, including ones with an i_state of I_DIRTY_PAGES, which will
      lead to cluster incoherency.)
      
      In addition, in gfs2_iomap_page_done, if the metadata has changed, mark the
      inode as I_DIRTY_DATASYNC to have the inode added to the current transaction:
      we don't expect metadata to change here, but let's err on the safe side.
      
      Fixes: d0a22a4b ("gfs2: Fix iomap write page reclaim deadlock");
      Signed-off-by: default avatarAndreas Gruenbacher <agruenba@redhat.com>
      706cb549
    • Al Viro's avatar
      Unbreak mount_capable() · c2c44ec2
      Al Viro authored
      In "consolidate the capability checks in sget_{fc,userns}())" the
      wrong argument had been passed to mount_capable() by sget_fc().
      That mistake had been further obscured later, when switching
      mount_capable() to fs_context has moved the calculation of
      bogus argument from sget_fc() to mount_capable() itself.  It
      should've been fc->user_ns all along.
      Screwed-up-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      Reported-by: default avatarChristian Brauner <christian@brauner.io>
      Tested-by: default avatarChristian Brauner <christian@brauner.io>
      Reviewed-by: default avatarDavid Howells <dhowells@redhat.com>
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      c2c44ec2