1. 08 Apr, 2020 10 commits
    • Jann Horn's avatar
      locking/refcount: Document interaction with PID_MAX_LIMIT · a13f58a0
      Jann Horn authored
      Document the circumstances under which refcount_t's saturation mechanism
      works deterministically.
      Acked-by: default avatarKees Cook <keescook@chromium.org>
      Acked-by: default avatarWill Deacon <will@kernel.org>
      Signed-off-by: default avatarJann Horn <jannh@google.com>
      Signed-off-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
      Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
      Link: https://lkml.kernel.org/r/20200303105427.260620-1-jannh@google.com
      a13f58a0
    • Qian Cai's avatar
      locking/percpu-rwsem: Fix a task_struct refcount · d22cc7f6
      Qian Cai authored
      The following commit:
      
        7f26482a ("locking/percpu-rwsem: Remove the embedded rwsem")
      
      introduced task_struct memory leaks due to messing up the task_struct
      refcount.
      
      At the beginning of percpu_rwsem_wake_function(), it calls get_task_struct(),
      but if the trylock failed, it will remain in the waitqueue. However, it
      will run percpu_rwsem_wake_function() again with get_task_struct() to
      increase the refcount but then only call put_task_struct() once the trylock
      succeeded.
      
      Fix it by adjusting percpu_rwsem_wake_function() a bit to guard against
      when percpu_rwsem_wait() observing !private, terminating the wait and
      doing a quick exit() while percpu_rwsem_wake_function() then doing
      wake_up_process(p) as a use-after-free.
      
      Fixes: 7f26482a ("locking/percpu-rwsem: Remove the embedded rwsem")
      Suggested-by: default avatarPeter Zijlstra <peterz@infradead.org>
      Signed-off-by: default avatarQian Cai <cai@lca.pw>
      Signed-off-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
      Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
      Link: https://lkml.kernel.org/r/20200330213002.2374-1-cai@lca.pw
      d22cc7f6
    • Linus Torvalds's avatar
      Merge tag 'drm-next-2020-04-08' of git://anongit.freedesktop.org/drm/drm · f5e94d10
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "This is a set of fixes that have queued up, I think I might have
        another pull with some more before rc1 but I'd like to dequeue what I
        have now just in case Easter is more eggciting that expected.
      
        The main thing in here is a fix for a longstanding nouveau power
        management issues on certain laptops, it should help runtime
        suspend/resume for a lot of people.
      
        There is also a reverted patch for some drm_mm behaviour in atomic
        contexts.
      
        Summary:
      
        core:
         - revert drm_mm atomic patch
         - dt binding fixes
      
        fbcon:
         - null ptr error fix
      
        i915:
         - GVT fixes
      
        nouveau:
         - runpm fix
         - svm fixes
      
        amdgpu:
         - HDCP fixes
         - gfx10 fix
         - Misc display fixes
         - BACO fixes
      
        amdkfd:
         - Fix memory leak
      
        vboxvideo:
         - remove conflicting fbs
      
        vc4:
         - mode validation fix
      
        xen:
         - fix PTR_ERR usage"
      
      * tag 'drm-next-2020-04-08' of git://anongit.freedesktop.org/drm/drm: (41 commits)
        drm/nouveau/kms/nv50-: wait for FIFO space on PIO channels
        drm/nouveau/nvif: protect waits against GPU falling off the bus
        drm/nouveau/nvif: access PTIMER through usermode class, if available
        drm/nouveau/gr/gp107,gp108: implement workaround for HW hanging during init
        drm/nouveau: workaround runpm fail by disabling PCI power management on certain intel bridges
        drm/nouveau/svm: remove useless SVM range check
        drm/nouveau/svm: check for SVM initialized before migrating
        drm/nouveau/svm: fix vma range check for migration
        drm/nouveau: remove checks for return value of debugfs functions
        drm/nouveau/ttm: evict other IO mappings when running out of BAR1 space
        drm/amdkfd: kfree the wrong pointer
        drm/amd/display: increase HDCP authentication delay
        drm/amd/display: Correctly cancel future watchdog and callback events
        drm/amd/display: Don't try hdcp1.4 when content_type is set to type1
        drm/amd/powerplay: move the ASIC specific nbio operation out of smu_v11_0.c
        drm/amd/powerplay: drop redundant BIF doorbell interrupt operations
        drm/amd/display: Fix dcn21 num_states
        drm/amd/display: Enable BT2020 in COLOR_ENCODING property
        drm/amd/display: LFC not working on 2.0x range monitors (v2)
        drm/amd/display: Support plane level CTM
        ...
      f5e94d10
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input · 9ebe5422
      Linus Torvalds authored
      Pull input updates from Dmitry Torokhov:
       "An update to the Goodix touchscreen driver to enable it work properly
        on various Bay Trail and Cherry Trail devices, and a few other
        assorted changes"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (26 commits)
        Input: update SPDX tag for input-event-codes.h
        Input: i8042 - add Acer Aspire 5738z to nomux list
        Input: goodix - fix compilation when ACPI support is disabled
        dt-bindings: touchscreen: Convert edt-ft5x06 to json-schema
        Input: of_touchscreen - explicitly choose axis
        Input: goodix - support gt9147 touchpanel
        dt-bindings: touchscreen: goodix: support of gt9147
        Input: goodix - add support for Goodix GT917S
        Input: goodix - use string-based chip ID
        dt-bindings: input: touchscreen: add compatible string for Goodix GT917S
        Input: goodix - add support for more then one touch-key
        Input: goodix - fix spurious key release events
        Input: goodix - try to reset the controller if the i2c-test fails
        Input: goodix - restore config on resume if necessary
        Input: goodix - make goodix_send_cfg() take a raw buffer as argument
        Input: goodix - add minimum firmware size check
        Input: goodix - save a copy of the config from goodix_read_config()
        Input: goodix - move defines to above struct goodix_ts_data declaration
        Input: goodix - add support for controlling the IRQ pin through ACPI methods
        Input: goodix - add support for getting IRQ + reset GPIOs on Bay Trail devices
        ...
      9ebe5422
    • Linus Torvalds's avatar
      Merge tag 'thermal-v5.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/thermal/linux · 34183ddd
      Linus Torvalds authored
      Pull thermal updates from Daniel Lezcano:
      
       - Convert tsens configuration DT binding to yaml (Rajeshwari)
      
       - Add interrupt support on the rcar sensor (Niklas Söderlund)
      
       - Add a new Spreadtrum thermal driver (Baolin Wang)
      
       - Add thermal binding for the fsl scu board, a new API to retrieve the
         sensor id bound to the thermal zone and i.MX system controller sensor
         (Anson Huang))
      
       - Remove warning log when a deferred probe is requested on Exynos
         (Marek Szyprowski)
      
       - Add the thermal monitoring unit support for imx8mm with its DT
         bindings (Anson Huang)
      
       - Rephrase the Kconfig text for clarity (Linus Walleij)
      
       - Use the gpio descriptor for the ti-soc-thermal (Linus Walleij)
      
       - Align msg structure to 4 bytes for i.MX SC, fix the Kconfig
         dependency, add the __may_be unused annotation for PM functions and
         the COMPILE_TEST option for imx8mm (Anson Huang)
      
       - Fix a dependency on regmap in Kconfig for qoriq (Yuantian Tang)
      
       - Add DT binding and support for the rcar gen3 r8a77961 and improve the
         error path on the rcar init function (Niklas Söderlund)
      
       - Cleanup and improvements for the tsens Qcom sensor (Amit Kucheria)
      
       - Improve code by removing lock and caching values in the rcar thermal
         sensor (Niklas Söderlund)
      
       - Cleanup in the qoriq drivers and add a call to
         imx_thermal_unregister_legacy_cooling in the removal function (Anson
         Huang)
      
       - Remove redundant 'maxItems' in tsens and sprd DT bindings (Rob
         Herring)
      
       - Change the thermal DT bindings by making the cooling-maps optional
         (Yuantian Tang)
      
       - Add Tiger Lake support (Sumeet Pawnikar)
      
       - Use scnprintf() for avoiding potential buffer overflow (Takashi Iwai)
      
       - Make pkg_temp_lock a raw_spinlock_t(Clark Williams)
      
       - Fix incorrect data types by changing them to signed on i.MX SC (Anson
         Huang)
      
       - Replace zero-length array with flexible-array member (Gustavo A. R.
         Silva)
      
       - Add support for i.MX8MP in the driver and in the DT bindings (Anson
         Huang)
      
       - Fix return value of the cpufreq_set_cur_state() function (Willy
         Wolff)
      
       - Remove abusing and scary WARN_ON in the cpufreq cooling device
         (Daniel Lezcano)
      
       - Fix build warning of incorrect argument type reported by sparse on
         imx8mm (Anson Huang)
      
       - Fix stub for the devfreq cooling device (Martin Blumenstingl)
      
       - Fix cpu idle cooling documentation (Sergey Vidishev)
      
      * tag 'thermal-v5.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/thermal/linux: (52 commits)
        Documentation: cpu-idle-cooling: Fix diagram for 33% duty cycle
        thermal: devfreq_cooling: inline all stubs for CONFIG_DEVFREQ_THERMAL=n
        thermal: imx8mm: Fix build warning of incorrect argument type
        thermal/drivers/cpufreq_cooling: Remove abusing WARN_ON
        thermal/drivers/cpufreq_cooling: Fix return of cpufreq_set_cur_state
        thermal: imx8mm: Add i.MX8MP support
        dt-bindings: thermal: imx8mm-thermal: Add support for i.MX8MP
        thermal: qcom: tsens.h: Replace zero-length array with flexible-array member
        thermal: imx_sc_thermal: Fix incorrect data type
        thermal: int340x_thermal: Use scnprintf() for avoiding potential buffer overflow
        thermal: int340x: processor_thermal: Add Tiger Lake support
        thermal/x86_pkg_temp: Make pkg_temp_lock a raw_spinlock_t
        dt-bindings: thermal: make cooling-maps property optional
        dt-bindings: thermal: qcom-tsens: Remove redundant 'maxItems'
        dt-bindings: thermal: sprd: Remove redundant 'maxItems'
        thermal: imx: Calling imx_thermal_unregister_legacy_cooling() in .remove
        thermal: qoriq: Sort includes alphabetically
        thermal: qoriq: Use devm_add_action_or_reset() to handle all cleanups
        thermal: rcar_thermal: Remove lock in rcar_thermal_get_current_temp()
        thermal: rcar_thermal: Do not store ctemp in rcar_thermal_priv
        ...
      34183ddd
    • Linus Torvalds's avatar
      Merge tag 'mfd-next-5.7' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd · 8645f09b
      Linus Torvalds authored
      Pull mfd updates from Lee Jones:
       "New Drivers:
         - Add support for IQS620A/621/622/624/625 Azoteq IQS62X Sensors
      
        New Device Support:
         - Add support for ADC, IRQ, Regulator, RTC and WDT to Ricoh RN5T618 PMIC
         - Add support for Comet Lake to Intel LPSS
      
        New Functionality:
         - Add support for Charger Detection to Spreadtrum SC27xx PMICs
         - Add support for Interrupt Polarity to Dialog Semi DA9062/61 PMIC
         - Add ACPI enumeration support to Diolan DLN2 USB Adaptor
      
        Fix-ups:
         - Device Tree; iqs62x, rn5t618, cros_ec_dev, stm32-lptimer, rohm,bd71837, rohm,bd71847
         - I2C registration; rn5t618
         - Kconfig; MFD_CPCAP, AB8500_CORE, MFD_WM8994, MFD_WM97xx, MFD_STPMIC1
         - Use flexible-array members; omap-usb-tll, qcom-pm8xxx
         - Remove unnecessary casts; omap-usb-host, omap-usb-tll
         - Power (suspend/resume/poweroff) enhancements; rk808
         - Improve error/sanity checking; dln2
         - Use snprintf(); aat2870-core
      
        Bug Fixes:
         - Fix PCI IDs in intel-lpss-pci"
      
      * tag 'mfd-next-5.7' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd: (33 commits)
        mfd: intel-lpss: Fix Intel Elkhart Lake LPSS I2C input clock
        mfd: aat2870: Use scnprintf() for avoiding potential buffer overflow
        mfd: dln2: Allow to be enumerated via ACPI
        mfd: da9062: Add support for interrupt polarity defined in device tree
        dt-bindings: bd718x7: Yamlify and add BD71850
        mfd: dln2: Fix sanity checking for endpoints
        mfd: intel-lpss: Add Intel Comet Lake PCH-V PCI IDs
        mfd: sc27xx: Add USB charger type detection support
        dt-bindings: mfd: Document STM32 low power timer bindings
        mfd: rk808: Convert RK805 to shutdown/suspend hooks
        mfd: rk808: Reduce shutdown duplication
        mfd: rk808: Stop using syscore ops
        mfd: rk808: Ensure suspend/resume hooks always work
        mfd: rk808: Always use poweroff when requested
        mfd: omap: Remove useless cast for driver.name
        mfd: Kconfig: Fix some misspelling of the word functionality
        mfd: pm8xxx: Replace zero-length array with flexible-array member
        mfd: omap-usb-tll: Replace zero-length array with flexible-array member
        mfd: cpcap: Fix compile if MFD_CORE is not selected
        mfd: cros_ec: Check DT node for usbpd-notify add
        ...
      8645f09b
    • Linus Torvalds's avatar
      Merge tag 'backlight-next-5.7' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight · b574beb6
      Linus Torvalds authored
      Pull backlight updates from Lee Jones:
       "Switch pwm_bl and corgi_lcd drivers to use GPIO descriptors"
      
      * tag 'backlight-next-5.7' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight:
        backlight: corgi: Convert to use GPIO descriptors
        backlight: pwm_bl: Switch to full GPIO descriptor
      b574beb6
    • Linus Torvalds's avatar
      Merge tag 'leds-5.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/pavel/linux-leds · 38e2c63e
      Linus Torvalds authored
      Pull LED updates from Pavel Machek:
       "One new driver, some driver changes, and some late minute cleanups --
        but those are just whitespace so should be okay.
      
        There are some major changes being prepared (multicolor, triggers) so
        the next release likely will be more interesting"
      
      * tag 'leds-5.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/pavel/linux-leds:
        leds: core: Fix warning message when init_data
        leds: make functions easier to understand
        leds: sort Makefile entries
        leds: old enums are not really applicable to new code
        leds: ip30: label power LED as such
        leds: lm3532: make bitfield 'enabled' unsigned
        leds: leds-pwm: Replace zero-length array with flexible-array member
        leds: leds-is31fl32xx: Replace zero-length array with flexible-array member
        leds: pwm: remove useless pwm_period_ns
        leds: pwm: remove header
        leds: pwm: convert to atomic PWM API
        leds: pwm: simplify if condition
        leds: add SGI IP30 led support
        leds: lm3697: fix spelling mistake "To" -> "Too"
        leds: leds-bd2802: remove set but not used variable 'pdata'
        leds: ns2: Convert to GPIO descriptors
        leds: ns2: Absorb platform data
      38e2c63e
    • Peter Xu's avatar
      mm/gup: Mark lock taken only after a successful retake · c7b6a566
      Peter Xu authored
      It's definitely incorrect to mark the lock as taken even if
      down_read_killable() failed.
      
      This wass overlooked when we switched from down_read() to
      down_read_killable() because down_read() won't fail while
      down_read_killable() could.
      
      Fixes: 71335f37 ("mm/gup: allow to react to fatal signals")
      Reported-by: syzbot+a8c70b7f3579fc0587dc@syzkaller.appspotmail.com
      Signed-off-by: default avatarPeter Xu <peterx@redhat.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      c7b6a566
    • Peter Xu's avatar
      mm/mempolicy: Allow lookup_node() to handle fatal signal · ba841078
      Peter Xu authored
      lookup_node() uses gup to pin the page and get node information.  It
      checks against ret>=0 assuming the page will be filled in.  However it's
      also possible that gup will return zero, for example, when the thread is
      quickly killed with a fatal signal.  Teach lookup_node() to gracefully
      return an error -EFAULT if it happens.
      
      Meanwhile, initialize "page" to NULL to avoid potential risk of
      exploiting the pointer.
      
      Fixes: 4426e945 ("mm/gup: allow VM_FAULT_RETRY for multiple times")
      Reported-by: syzbot+693dc11fcb53120b5559@syzkaller.appspotmail.com
      Signed-off-by: default avatarPeter Xu <peterx@redhat.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      ba841078
  2. 07 Apr, 2020 30 commits