1. 02 Jun, 2017 2 commits
    • Thinh Nguyen's avatar
      usb: gadget: f_mass_storage: Serialize wake and sleep execution · dc9217b6
      Thinh Nguyen authored
      f_mass_storage has a memorry barrier issue with the sleep and wake
      functions that can cause a deadlock. This results in intermittent hangs
      during MSC file transfer. The host will reset the device after receiving
      no response to resume the transfer. This issue is seen when dwc3 is
      processing 2 transfer-in-progress events at the same time, invoking
      completion handlers for CSW and CBW. Also this issue occurs depending on
      the system timing and latency.
      
      To increase the chance to hit this issue, you can force dwc3 driver to
      wait and process those 2 events at once by adding a small delay (~100us)
      in dwc3_check_event_buf() whenever the request is for CSW and read the
      event count again. Avoid debugging with printk and ftrace as extra
      delays and memory barrier will mask this issue.
      
      Scenario which can lead to failure:
      -----------------------------------
      1) The main thread sleeps and waits for the next command in
         get_next_command().
      2) bulk_in_complete() wakes up main thread for CSW.
      3) bulk_out_complete() tries to wake up the running main thread for CBW.
      4) thread_wakeup_needed is not loaded with correct value in
         sleep_thread().
      5) Main thread goes to sleep again.
      
      The pattern is shown below. Note the 2 critical variables.
       * common->thread_wakeup_needed
       * bh->state
      
      	CPU 0 (sleep_thread)		CPU 1 (wakeup_thread)
      	==============================  ===============================
      
      					bh->state = BH_STATE_FULL;
      					smp_wmb();
      	thread_wakeup_needed = 0;	thread_wakeup_needed = 1;
      	smp_rmb();
      	if (bh->state != BH_STATE_FULL)
      		sleep again ...
      
      As pointed out by Alan Stern, this is an R-pattern issue. The issue can
      be seen when there are two wakeups in quick succession. The
      thread_wakeup_needed can be overwritten in sleep_thread, and the read of
      the bh->state maybe reordered before the write to thread_wakeup_needed.
      
      This patch applies full memory barrier smp_mb() in both sleep_thread()
      and wakeup_thread() to ensure the order which the thread_wakeup_needed
      and bh->state are written and loaded.
      
      However, a better solution in the future would be to use wait_queue
      method that takes care of managing memory barrier between waker and
      waiter.
      
      Cc: <stable@vger.kernel.org>
      Acked-by: default avatarAlan Stern <stern@rowland.harvard.edu>
      Signed-off-by: default avatarThinh Nguyen <thinhn@synopsys.com>
      Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
      dc9217b6
    • Martin Blumenstingl's avatar
      usb: dwc2: add support for the DWC2 controller on Meson8 SoCs · 55b644fd
      Martin Blumenstingl authored
      USB support in the Meson8 SoCs is provided by a DWC2 controller which
      works with the same settings as Meson8b and GXBB. Using the generic
      "snps,dwc2" binding results in an endless stream of "Overcurrent change
      detected" messages.
      Acked-by: default avatarRob Herring <robh@kernel.org>
      Signed-off-by: default avatarMartin Blumenstingl <martin.blumenstingl@googlemail.com>
      Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
      55b644fd
  2. 29 May, 2017 1 commit
  3. 28 May, 2017 1 commit
  4. 27 May, 2017 14 commits
    • Linus Torvalds's avatar
      Merge tag 'tty-4.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty · 249f1efd
      Linus Torvalds authored
      Pull tty/serial fixes from Greg KH:
       "Here are some serial and tty fixes for 4.12-rc3. They are a bit bigger
        than normal, which is why I had them bake in linux-next for a few
        weeks and didn't send them to you for -rc2.
      
        They revert a few of the serdev patches from 4.12-rc1, and bring
        things back to how they were in 4.11, to try to make things a bit more
        stable there. Rob and Johan both agree that this is the way forward,
        so this isn't people squabbling over semantics. Other than that, just
        a few minor serial driver fixes that people have had problems with.
      
        All of these have been in linux-next for a few weeks with no reported
        issues"
      
      * tag 'tty-4.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
        serial: altera_uart: call iounmap() at driver remove
        serial: imx: ensure UCR3 and UFCR are setup correctly
        MAINTAINERS/serial: Change maintainer of jsm driver
        serial: enable serdev support
        tty/serdev: add serdev registration interface
        serdev: Restore serdev_device_write_buf for atomic context
        serial: core: fix crash in uart_suspend_port
        tty: fix port buffer locking
        tty: ehv_bytechan: clean up init error handling
        serial: ifx6x60: fix use-after-free on module unload
        serial: altera_jtaguart: adding iounmap()
        serial: exar: Fix stuck MSIs
        serial: efm32: Fix parity management in 'efm32_uart_console_get_options()'
        serdev: fix tty-port client deregistration
        Revert "tty_port: register tty ports with serdev bus"
        drivers/tty: 8250: only call fintek_8250_probe when doing port I/O
      249f1efd
    • Linus Torvalds's avatar
      Merge tag 'powerpc-4.12-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux · 6f68a6ae
      Linus Torvalds authored
      Pull powerpc fixes from Michael Ellerman:
       "Fix running SPU programs on Cell, and a few other minor fixes.
      
        Thanks to Alistair Popple, Jeremy Kerr, Michael Neuling, Nicholas
        Piggin"
      
      * tag 'powerpc-4.12-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
        powerpc: Add PPC_FEATURE userspace bits for SCV and DARN instructions
        powerpc/spufs: Fix hash faults for kernel regions
        powerpc: Fix booting P9 hash with CONFIG_PPC_RADIX_MMU=N
        powerpc/powernv/npu-dma.c: Fix opal_npu_destroy_context() call
        selftests/powerpc: Fix TM resched DSCR test with some compilers
      6f68a6ae
    • Linus Torvalds's avatar
      Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 38e6bf23
      Linus Torvalds authored
      Pull x86 fixes from Thomas Gleixner:
       "A series of fixes for X86:
      
         - The final fix for the end-of-stack issue in the unwinder
         - Handle non PAT systems gracefully
         - Prevent access to uninitiliazed memory
         - Move early delay calaibration after basic init
         - Fix Kconfig help text
         - Fix a cross compile issue
         - Unbreak older make versions"
      
      * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        x86/timers: Move simple_udelay_calibration past init_hypervisor_platform
        x86/alternatives: Prevent uninitialized stack byte read in apply_alternatives()
        x86/PAT: Fix Xorg regression on CPUs that don't support PAT
        x86/watchdog: Fix Kconfig help text file path reference to lockup watchdog documentation
        x86/build: Permit building with old make versions
        x86/unwind: Add end-of-stack check for ftrace handlers
        Revert "x86/entry: Fix the end of the stack for newly forked tasks"
        x86/boot: Use CROSS_COMPILE prefix for readelf
      38e6bf23
    • Linus Torvalds's avatar
      Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 39b8ab31
      Linus Torvalds authored
      Pull timer fixlet from Thomas Gleixner:
       "Silence dmesg spam by making the posix cpu timer printks depend on
        print_fatal_signals"
      
      * 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        posix-timers: Make signal printks conditional
      39b8ab31
    • Linus Torvalds's avatar
      Merge branch 'ras-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · de0b9d75
      Linus Torvalds authored
      Pull RAS fixes from Thomas Gleixner:
       "Two fixlets for RAS:
      
         - Export memory_error() so the NFIT module can utilize it
      
         - Handle memory errors in NFIT correctly"
      
      * 'ras-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        acpi, nfit: Fix the memory error check in nfit_handle_mce()
        x86/MCE: Export memory_error()
      de0b9d75
    • Linus Torvalds's avatar
      Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · fac3fcae
      Linus Torvalds authored
      Pull perf tooling fixes from Thomas Gleixner:
      
       - Synchronization of tools and kernel headers
      
       - A series of fixes for perf report addressing various failures:
          * Handle invalid maps proper
          * Plug a memory leak
          * Handle frames and callchain order correctly
      
       - Fixes for handling inlines and children mode
      
      * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        tools/include: Sync kernel ABI headers with tooling headers
        perf tools: Put caller above callee in --children mode
        perf report: Do not drop last inlined frame
        perf report: Always honor callchain order for inlined nodes
        perf script: Add --inline option for debugging
        perf report: Fix off-by-one for non-activation frames
        perf report: Fix memory leak in addr2line when called by addr2inlines
        perf report: Don't crash on invalid maps in `-g srcline` mode
      fac3fcae
    • Linus Torvalds's avatar
      Merge branch 'locking-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 805f2869
      Linus Torvalds authored
      Pull locking fix from Thomas Gleixner:
       "A fix for a state leak which was introduced in the recent rework of
        futex/rtmutex interaction"
      
      * 'locking-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        futex,rt_mutex: Fix rt_mutex_cleanup_proxy_lock()
      805f2869
    • Linus Torvalds's avatar
      Merge branch 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · d024baa5
      Linus Torvalds authored
      Pull kthread fix from Thomas Gleixner:
       "A single fix which prevents a use after free when kthread fork fails"
      
      * 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        kthread: Fix use-after-free if kthread fork fails
      d024baa5
    • Linus Torvalds's avatar
      Merge tag 'trace-v4.12-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace · 77d64656
      Linus Torvalds authored
      Pull ftrace fixes from Steven Rostedt:
       "There's been a few memory issues found with ftrace.
      
        One was simply a memory leak where not all was being freed that should
        have been in releasing a file pointer on set_graph_function.
      
        Then Thomas found that the ftrace trampolines were marked for
        read/write as well as execute. To shrink the possible attack surface,
        he added calls to set them to ro. Which also uncovered some other
        issues with freeing module allocated memory that had its permissions
        changed.
      
        Kprobes had a similar issue which is fixed and a selftest was added to
        trigger that issue again"
      
      * tag 'trace-v4.12-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
        x86/ftrace: Make sure that ftrace trampolines are not RWX
        x86/mm/ftrace: Do not bug in early boot on irqs_disabled in cpu_flush_range()
        selftests/ftrace: Add a testcase for many kprobe events
        kprobes/x86: Fix to set RWX bits correctly before releasing trampoline
        ftrace: Fix memory leak in ftrace_graph_release()
      77d64656
    • Thomas Gleixner's avatar
      x86/ftrace: Make sure that ftrace trampolines are not RWX · 6ee98ffe
      Thomas Gleixner authored
      ftrace use module_alloc() to allocate trampoline pages. The mapping of
      module_alloc() is RWX, which makes sense as the memory is written to right
      after allocation. But nothing makes these pages RO after writing to them.
      
      Add proper set_memory_rw/ro() calls to protect the trampolines after
      modification.
      
      Link: http://lkml.kernel.org/r/alpine.DEB.2.20.1705251056410.1862@nanosSigned-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Signed-off-by: default avatarSteven Rostedt (VMware) <rostedt@goodmis.org>
      6ee98ffe
    • Steven Rostedt (VMware)'s avatar
      x86/mm/ftrace: Do not bug in early boot on irqs_disabled in cpu_flush_range() · a53276e2
      Steven Rostedt (VMware) authored
      With function tracing starting in early bootup and having its trampoline
      pages being read only, a bug triggered with the following:
      
      kernel BUG at arch/x86/mm/pageattr.c:189!
      invalid opcode: 0000 [#1] SMP
      Modules linked in:
      CPU: 0 PID: 0 Comm: swapper Not tainted 4.12.0-rc2-test+ #3
      Hardware name: MSI MS-7823/CSM-H87M-G43 (MS-7823), BIOS V1.6 02/22/2014
      task: ffffffffb4222500 task.stack: ffffffffb4200000
      RIP: 0010:change_page_attr_set_clr+0x269/0x302
      RSP: 0000:ffffffffb4203c88 EFLAGS: 00010046
      RAX: 0000000000000046 RBX: 0000000000000000 RCX: 00000001b6000000
      RDX: ffffffffb4203d40 RSI: 0000000000000000 RDI: ffffffffb4240d60
      RBP: ffffffffb4203d18 R08: 00000001b6000000 R09: 0000000000000001
      R10: ffffffffb4203aa8 R11: 0000000000000003 R12: ffffffffc029b000
      R13: ffffffffb4203d40 R14: 0000000000000001 R15: 0000000000000000
      FS:  0000000000000000(0000) GS:ffff9a639ea00000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: ffff9a636b384000 CR3: 00000001ea21d000 CR4: 00000000000406b0
      Call Trace:
       change_page_attr_clear+0x1f/0x21
       set_memory_ro+0x1e/0x20
       arch_ftrace_update_trampoline+0x207/0x21c
       ? ftrace_caller+0x64/0x64
       ? 0xffffffffc029b000
       ftrace_startup+0xf4/0x198
       register_ftrace_function+0x26/0x3c
       function_trace_init+0x5e/0x73
       tracer_init+0x1e/0x23
       tracing_set_tracer+0x127/0x15a
       register_tracer+0x19b/0x1bc
       init_function_trace+0x90/0x92
       early_trace_init+0x236/0x2b3
       start_kernel+0x200/0x3f5
       x86_64_start_reservations+0x29/0x2b
       x86_64_start_kernel+0x17c/0x18f
       secondary_startup_64+0x9f/0x9f
       ? secondary_startup_64+0x9f/0x9f
      
      Interrupts should not be enabled at this early in the boot process. It is
      also fine to leave interrupts enabled during this time as there's only one
      CPU running, and on_each_cpu() means to only run on the current CPU.
      
      If early_boot_irqs_disabled is set, it is safe to run cpu_flush_range() with
      interrupts disabled. Don't trigger a BUG_ON() in that case.
      
      Link: http://lkml.kernel.org/r/20170526093717.0be3b849@gandalf.local.homeSuggested-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Signed-off-by: default avatarSteven Rostedt (VMware) <rostedt@goodmis.org>
      a53276e2
    • Masami Hiramatsu's avatar
      selftests/ftrace: Add a testcase for many kprobe events · bdd7e3d6
      Masami Hiramatsu authored
      Add a testcase to test kprobes via ftrace interface
      with many concurrent kprobe events.
      
      This tries to add many kprobe events (up to 256) on
      kernel functions. To avoid making ftrace-based
      kprobes (kprobes on fentry), it skips first N bytes
      (on x86 N=5, on ppc or arm N=4) of function entry.
      After that, it enables all those events, disable it,
      and remove it.
      
      Since the unoptimization buffer reclaiming will
      be delayed, after removing events, it will wait
      enough time.
      
      Link: http://lkml.kernel.org/r/149577388470.11702.11832460851769204511.stgit@devboxSigned-off-by: default avatarMasami Hiramatsu <mhiramat@kernel.org>
      Suggested-by: default avatarSteven Rostedt <rostedt@goodmis.org>
      Signed-off-by: default avatarSteven Rostedt (VMware) <rostedt@goodmis.org>
      bdd7e3d6
    • Masami Hiramatsu's avatar
      kprobes/x86: Fix to set RWX bits correctly before releasing trampoline · c93f5cf5
      Masami Hiramatsu authored
      Fix kprobes to set(recover) RWX bits correctly on trampoline
      buffer before releasing it. Releasing readonly page to
      module_memfree() crash the kernel.
      
      Without this fix, if kprobes user register a bunch of kprobes
      in function body (since kprobes on function entry usually
      use ftrace) and unregister it, kernel hits a BUG and crash.
      
      Link: http://lkml.kernel.org/r/149570868652.3518.14120169373590420503.stgit@devboxSigned-off-by: default avatarMasami Hiramatsu <mhiramat@kernel.org>
      Fixes: d0381c81 ("kprobes/x86: Set kprobes pages read-only")
      Signed-off-by: default avatarSteven Rostedt (VMware) <rostedt@goodmis.org>
      c93f5cf5
    • Luis Henriques's avatar
      ftrace: Fix memory leak in ftrace_graph_release() · f9797c2f
      Luis Henriques authored
      ftrace_hash is being kfree'ed in ftrace_graph_release(), however the
      ->buckets field is not.  This results in a memory leak that is easily
      captured by kmemleak:
      
      unreferenced object 0xffff880038afe000 (size 8192):
        comm "trace-cmd", pid 238, jiffies 4294916898 (age 9.736s)
        hex dump (first 32 bytes):
          00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
          00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        backtrace:
          [<ffffffff815f561e>] kmemleak_alloc+0x4e/0xb0
          [<ffffffff8113964d>] __kmalloc+0x12d/0x1a0
          [<ffffffff810bf6d1>] alloc_ftrace_hash+0x51/0x80
          [<ffffffff810c0523>] __ftrace_graph_open.isra.39.constprop.46+0xa3/0x100
          [<ffffffff810c05e8>] ftrace_graph_open+0x68/0xa0
          [<ffffffff8114003d>] do_dentry_open.isra.1+0x1bd/0x2d0
          [<ffffffff81140df7>] vfs_open+0x47/0x60
          [<ffffffff81150f95>] path_openat+0x2a5/0x1020
          [<ffffffff81152d6a>] do_filp_open+0x8a/0xf0
          [<ffffffff811411df>] do_sys_open+0x12f/0x200
          [<ffffffff811412ce>] SyS_open+0x1e/0x20
          [<ffffffff815fa6e0>] entry_SYSCALL_64_fastpath+0x13/0x94
          [<ffffffffffffffff>] 0xffffffffffffffff
      
      Link: http://lkml.kernel.org/r/20170525152038.7661-1-lhenriques@suse.com
      
      Cc: stable@vger.kernel.org
      Fixes: b9b0c831 ("ftrace: Convert graph filter to use hash tables")
      Signed-off-by: default avatarLuis Henriques <lhenriques@suse.com>
      Signed-off-by: default avatarSteven Rostedt (VMware) <rostedt@goodmis.org>
      f9797c2f
  5. 26 May, 2017 22 commits
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input · c86daad2
      Linus Torvalds authored
      Pull input layer fixes from Dmitry Torokhov:
       "Just a few fixups to a couple of drivers"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
        Input: elan_i2c - ignore signals when finishing updating firmware
        Input: elan_i2c - clear INT before resetting controller
        Input: atmel_mxt_ts - add T100 as a readable object
        Input: edt-ft5x06 - increase allowed data range for threshold parameter
      c86daad2
    • Linus Torvalds's avatar
      Merge tag 'led_fixes_for_4-12-rc3' of... · e2a9aa5a
      Linus Torvalds authored
      Merge tag 'led_fixes_for_4-12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/j.anaszewski/linux-leds
      
      Pull LED fix from Jacek Anaszewski:
       "A single LED fix for 4.12-rc3.
      
        leds-pca955x driver uses only i2c_smbus API and thus it should pass
        I2C_FUNC_SMBUS_BYTE_DATA flag to i2c_check_functionality"
      
      * tag 'led_fixes_for_4-12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/j.anaszewski/linux-leds:
        leds: pca955x: Correct I2C Functionality
      e2a9aa5a
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · 6741d516
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Fix state pruning in bpf verifier wrt. alignment, from Daniel
          Borkmann.
      
       2) Handle non-linear SKBs properly in SCTP ICMP parsing, from Davide
          Caratti.
      
       3) Fix bit field definitions for rss_hash_type of descriptors in mlx5
          driver, from Jesper Brouer.
      
       4) Defer slave->link updates until bonding is ready to do a full commit
          to the new settings, from Nithin Sujir.
      
       5) Properly reference count ipv4 FIB metrics to avoid use after free
          situations, from Eric Dumazet and several others including Cong Wang
          and Julian Anastasov.
      
       6) Fix races in llc_ui_bind(), from Lin Zhang.
      
       7) Fix regression of ESP UDP encapsulation for TCP packets, from
          Steffen Klassert.
      
       8) Fix mdio-octeon driver Kconfig deps, from Randy Dunlap.
      
       9) Fix regression in setting DSCP on ipv6/GRE encapsulation, from Peter
          Dawson.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (43 commits)
        ipv4: add reference counting to metrics
        net: ethernet: ax88796: don't call free_irq without request_irq first
        ip6_tunnel, ip6_gre: fix setting of DSCP on encapsulated packets
        sctp: fix ICMP processing if skb is non-linear
        net: llc: add lock_sock in llc_ui_bind to avoid a race condition
        bonding: Don't update slave->link until ready to commit
        test_bpf: Add a couple of tests for BPF_JSGE.
        bpf: add various verifier test cases
        bpf: fix wrong exposure of map_flags into fdinfo for lpm
        bpf: add bpf_clone_redirect to bpf_helper_changes_pkt_data
        bpf: properly reset caller saved regs after helper call and ld_abs/ind
        bpf: fix incorrect pruning decision when alignment must be tracked
        arp: fixed -Wuninitialized compiler warning
        tcp: avoid fastopen API to be used on AF_UNSPEC
        net: move somaxconn init from sysctl code
        net: fix potential null pointer dereference
        geneve: fix fill_info when using collect_metadata
        virtio-net: enable TSO/checksum offloads for Q-in-Q vlans
        be2net: Fix offload features for Q-in-Q packets
        vlan: Fix tcp checksum offloads in Q-in-Q vlans
        ...
      6741d516
    • Linus Torvalds's avatar
      Merge tag 'xfs-4.12-fixes-2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux · cdbe0206
      Linus Torvalds authored
      Pull XFS fixes from Darrick Wong:
       "A few miscellaneous bug fixes & cleanups:
      
         - Fix indlen block reservation accounting bug when splitting delalloc
           extent
      
         - Fix warnings about unused variables that appeared in -rc1.
      
         - Don't spew errors when bmapping a local format directory
      
         - Fix an off-by-one error in a delalloc eof assertion
      
         - Make fsmap only return inode information for CAP_SYS_ADMIN
      
         - Fix a potential mount time deadlock recovering cow extents
      
         - Fix unaligned memory access in _btree_visit_blocks
      
         - Fix various SEEK_HOLE/SEEK_DATA bugs"
      
      * tag 'xfs-4.12-fixes-2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:
        xfs: Move handling of missing page into one place in xfs_find_get_desired_pgoff()
        xfs: Fix off-by-in in loop termination in xfs_find_get_desired_pgoff()
        xfs: Fix missed holes in SEEK_HOLE implementation
        xfs: fix off-by-one on max nr_pages in xfs_find_get_desired_pgoff()
        xfs: fix unaligned access in xfs_btree_visit_blocks
        xfs: avoid mount-time deadlock in CoW extent recovery
        xfs: only return detailed fsmap info if the caller has CAP_SYS_ADMIN
        xfs: bad assertion for delalloc an extent that start at i_size
        xfs: fix warnings about unused stack variables
        xfs: BMAPX shouldn't barf on inline-format directories
        xfs: fix indlen accounting error on partial delalloc conversion
      cdbe0206
    • Eric Dumazet's avatar
      ipv4: add reference counting to metrics · 3fb07daf
      Eric Dumazet authored
      Andrey Konovalov reported crashes in ipv4_mtu()
      
      I could reproduce the issue with KASAN kernels, between
      10.246.7.151 and 10.246.7.152 :
      
      1) 20 concurrent netperf -t TCP_RR -H 10.246.7.152 -l 1000 &
      
      2) At the same time run following loop :
      while :
      do
       ip ro add 10.246.7.152 dev eth0 src 10.246.7.151 mtu 1500
       ip ro del 10.246.7.152 dev eth0 src 10.246.7.151 mtu 1500
      done
      
      Cong Wang attempted to add back rt->fi in commit
      82486aa6 ("ipv4: restore rt->fi for reference counting")
      but this proved to add some issues that were complex to solve.
      
      Instead, I suggested to add a refcount to the metrics themselves,
      being a standalone object (in particular, no reference to other objects)
      
      I tried to make this patch as small as possible to ease its backport,
      instead of being super clean. Note that we believe that only ipv4 dst
      need to take care of the metric refcount. But if this is wrong,
      this patch adds the basic infrastructure to extend this to other
      families.
      
      Many thanks to Julian Anastasov for reviewing this patch, and Cong Wang
      for his efforts on this problem.
      
      Fixes: 2860583f ("ipv4: Kill rt->fi")
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Reported-by: default avatarAndrey Konovalov <andreyknvl@google.com>
      Reviewed-by: default avatarJulian Anastasov <ja@ssi.bg>
      Acked-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      3fb07daf
    • Uwe Kleine-König's avatar
      net: ethernet: ax88796: don't call free_irq without request_irq first · 82533ad9
      Uwe Kleine-König authored
      The function ax_init_dev (which is called only from the driver's .probe
      function) calls free_irq in the error path without having requested the
      irq in the first place. So drop the free_irq call in the error path.
      
      Fixes: 825a2ff1 ("AX88796 network driver")
      Signed-off-by: default avatarUwe Kleine-König <u.kleine-koenig@pengutronix.de>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      82533ad9
    • Peter Dawson's avatar
      ip6_tunnel, ip6_gre: fix setting of DSCP on encapsulated packets · 0e9a7095
      Peter Dawson authored
      This fix addresses two problems in the way the DSCP field is formulated
       on the encapsulating header of IPv6 tunnels.
      Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=195661
      
      1) The IPv6 tunneling code was manipulating the DSCP field of the
       encapsulating packet using the 32b flowlabel. Since the flowlabel is
       only the lower 20b it was incorrect to assume that the upper 12b
       containing the DSCP and ECN fields would remain intact when formulating
       the encapsulating header. This fix handles the 'inherit' and
       'fixed-value' DSCP cases explicitly using the extant dsfield u8 variable.
      
      2) The use of INET_ECN_encapsulate(0, dsfield) in ip6_tnl_xmit was
       incorrect and resulted in the DSCP value always being set to 0.
      
      Commit 90427ef5 ("ipv6: fix flow labels when the traffic class
       is non-0") caused the regression by masking out the flowlabel
       which exposed the incorrect handling of the DSCP portion of the
       flowlabel in ip6_tunnel and ip6_gre.
      
      Fixes: 90427ef5 ("ipv6: fix flow labels when the traffic class is non-0")
      Signed-off-by: default avatarPeter Dawson <peter.a.dawson@boeing.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0e9a7095
    • Davide Caratti's avatar
      sctp: fix ICMP processing if skb is non-linear · 804ec7eb
      Davide Caratti authored
      sometimes ICMP replies to INIT chunks are ignored by the client, even if
      the encapsulated SCTP headers match an open socket. This happens when the
      ICMP packet is carried by a paged skb: use skb_header_pointer() to read
      packet contents beyond the SCTP header, so that chunk header and initiate
      tag are validated correctly.
      
      v2:
      - don't use skb_header_pointer() to read the transport header, since
        icmp_socket_deliver() already puts these 8 bytes in the linear area.
      - change commit message to make specific reference to INIT chunks.
      Signed-off-by: default avatarDavide Caratti <dcaratti@redhat.com>
      Acked-by: default avatarMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
      Acked-by: default avatarVlad Yasevich <vyasevich@gmail.com>
      Reviewed-by: default avatarXin Long <lucien.xin@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      804ec7eb
    • linzhang's avatar
      net: llc: add lock_sock in llc_ui_bind to avoid a race condition · 0908cf4d
      linzhang authored
      There is a race condition in llc_ui_bind if two or more processes/threads
      try to bind a same socket.
      
      If more processes/threads bind a same socket success that will lead to
      two problems, one is this action is not what we expected, another is
      will lead to kernel in unstable status or oops(in my simple test case,
      cause llc2.ko can't unload).
      
      The current code is test SOCK_ZAPPED bit to avoid a process to
      bind a same socket twice but that is can't avoid more processes/threads
      try to bind a same socket at the same time.
      
      So, add lock_sock in llc_ui_bind like others, such as llc_ui_connect.
      Signed-off-by: default avatarLin Zhang <xiaolou4617@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0908cf4d
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.dk/linux-block · 1b8f2ffc
      Linus Torvalds authored
      Pull block fixes from Jens Axboe:
       "A collection of fixes that should go into this series. This contains:
      
         - A set of NVMe fixes, pulled from Christoph. This includes a set of
           fixes for the fiber channel bits from James Smart, rdma queue depth
           fix from Marta, controller removal fixes from Ming, and some more
           APST quirk updates from Andy.
      
         - A blk-mq debugfs fix from Bart, fixing a problem with the
           untangling of the sysfs and debugfs blk-mq bits that was added in
           this series.
      
         - Error code fix in add_partition() from Dan.
      
         - A small series of fixes for the new blk-throttle code from Shaohua"
      
      * 'for-linus' of git://git.kernel.dk/linux-block: (21 commits)
        blk-mq: Only register debugfs attributes for blk-mq queues
        nvme: Quirk APST on Intel 600P/P3100 devices
        nvme: only setup block integrity if supported by the driver
        nvme: replace is_flags field in nvme_ctrl_ops with a flags field
        nvme-pci: consistencly use ctrl->device for logging
        partitions/msdos: FreeBSD UFS2 file systems are not recognized
        block: fix an error code in add_partition()
        blk-throttle: force user to configure all settings for io.low
        blk-throttle: respect 0 bps/iops settings for io.low
        blk-throttle: output some debug info in trace
        blk-throttle: add hierarchy support for latency target and idle time
        nvme_fc: remove extra controller reference taken on reconnect
        nvme_fc: correct nvme status set on abort
        nvme_fc: set logging level on resets/deletes
        nvme_fc: revise comment on teardown
        nvme_fc: Support ctrl_loss_tmo
        nvme_fc: get rid of local reconnect_delay
        blk-mq: remove blk_mq_abort_requeue_list()
        nvme: avoid to use blk_mq_abort_requeue_list()
        nvme: use blk_mq_start_hw_queues() in nvme_kill_queues()
        ...
      1b8f2ffc
    • Linus Torvalds's avatar
      Merge tag 'pci-v4.12-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci · 6ce47829
      Linus Torvalds authored
      Pull PCI fixes from Bjorn Helgaas:
      
       - fix PCI_ENDPOINT build error (merged for v4.12)
      
       - fix Switchtec driver (merged for v4.12)
      
       - fix imx6 config read timeouts, fallout from changing to non-postable
         reads
      
       - add PM "needs_resume" flag for i915 suspend issue
      
      * tag 'pci-v4.12-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci:
        PCI/PM: Add needs_resume flag to avoid suspend complete optimization
        PCI: imx6: Fix config read timeout handling
        switchtec: Fix minor bug with partition ID register
        switchtec: Use new cdev_device_add() helper function
        PCI: endpoint: Make PCI_ENDPOINT depend on HAS_DMA
      6ce47829
    • Linus Torvalds's avatar
      Merge tag 'ceph-for-4.12-rc3' of git://github.com/ceph/ceph-client · 80941b2a
      Linus Torvalds authored
      Pul ceph fixes from Ilya Dryomov:
       "A bunch of make W=1 and static checker fixups, a RECONNECT_SEQ
        messenger patch from Zheng and Luis' fallocate fix"
      
      * tag 'ceph-for-4.12-rc3' of git://github.com/ceph/ceph-client:
        ceph: check that the new inode size is within limits in ceph_fallocate()
        libceph: cleanup old messages according to reconnect seq
        libceph: NULL deref on crush_decode() error path
        libceph: fix error handling in process_one_ticket()
        libceph: validate blob_struct_v in process_one_ticket()
        libceph: drop version variable from ceph_monmap_decode()
        libceph: make ceph_msg_data_advance() return void
        libceph: use kbasename() and kill ceph_file_part()
      80941b2a
    • Linus Torvalds's avatar
      Merge tag 'mmc-v4.12-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc · a38b461e
      Linus Torvalds authored
      Pull MMC fixes from Ulf Hansson:
       "This contains fixes to make the WiFi work again for the ARM64 Hikey
        board.
      
        Together with a couple of DTS updates for the Hikey board we have also
        extended the mmc pwrseq_simple, to support a new power-off-delay-us DT
        property, as that was required to enable a graceful power off sequence
        for the WiFi chip"
      
      * tag 'mmc-v4.12-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:
        arm64: dts: hikey: Fix WiFi support
        arm64: dts: hi6220: Move board data from the dwmmc nodes to hikey dts
        arm64: dts: hikey: Add the SYS_5V and the VDD_3V3 regulators
        arm64: dts: hi6220: Move the fixed_5v_hub regulator to the hikey dts
        arm64: dts: hikey: Add clock for the pmic mfd
        mfd: dts: hi655x: Add clock binding for the pmic
        mmc: pwrseq_simple: Parse DTS for the power-off-delay-us property
        mmc: dt: pwrseq-simple: Invent power-off-delay-us
      a38b461e
    • Linus Torvalds's avatar
      Merge tag 'sound-4.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound · e95806df
      Linus Torvalds authored
      Pull sound fixes from Takashi Iwai:
       "This contains a few HD-audio device-specific quirks and an endianess
        fix for USB-audio, as well as the update of quirk model list document.
        All fixes are small and trivial.
      
        The document update could have been postponed, but it's a good thing
        for user and has absolutely zero risk of breakage, so included here"
      
      * tag 'sound-4.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
        ALSA: hda - apply STAC_9200_DELL_M22 quirk for Dell Latitude D430
        ALSA: hda - Update the list of quirk models
        ALSA: hda - Provide dual-codecs model option for a few Realtek codecs
        ALSA: hda - Apply dual-codec quirk for MSI Z270-Gaming mobo
        ALSA: hda - No loopback on ALC299 codec
        ALSA: usb-audio: fix Amanero Combo384 quirk on big-endian hosts
      e95806df
    • Linus Torvalds's avatar
      Merge tag 'drm-fixes-for-v4.12-rc3' of git://people.freedesktop.org/~airlied/linux · 876ca8f3
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "Not a whole lot happening here, a set of amdgpu fixes and one core
        deadlock fix, and some misc drivers fixes"
      
      * tag 'drm-fixes-for-v4.12-rc3' of git://people.freedesktop.org/~airlied/linux:
        drm/amdgpu: fix null point error when rmmod amdgpu.
        drm/amd/powerplay: fix a signedness bugs
        drm/amdgpu: fix NULL pointer panic of emit_gds_switch
        drm/radeon: Unbreak HPD handling for r600+
        drm/amd/powerplay/smu7: disable mclk switching for high refresh rates
        drm/amd/powerplay/smu7: add vblank check for mclk switching (v2)
        drm/radeon/ci: disable mclk switching for high refresh rates (v2)
        drm/amdgpu/ci: disable mclk switching for high refresh rates (v2)
        drm/amdgpu: fix fundamental suspend/resume issue
        drm/gma500/psb: Actually use VBT mode when it is found
        drm: Fix deadlock retry loop in page_flip_ioctl
        drm: qxl: Delay entering atomic context during cursor update
        drm/radeon: Fix oops upon driver load on PowerXpress laptops
      876ca8f3
    • Christoph Hellwig's avatar
      PCI/msi: fix the pci_alloc_irq_vectors_affinity stub · 83b4605b
      Christoph Hellwig authored
      We need to return an error for any call that asks for MSI / MSI-X
      vectors only, so that non-trivial fallback logic can work properly.
      
      Also valid dev->irq and use the "correct" errno value based on feedback
      from Linus.
      Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
      Reported-by: default avatarSteven Rostedt <rostedt@goodmis.org>
      Fixes: aff17164 ("PCI: Provide sensible IRQ vector alloc/free routines")
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      83b4605b
    • Jens Axboe's avatar
      Merge branch 'nvme-4.12' of git://git.infradead.org/nvme into for-linus · 8aa63829
      Jens Axboe authored
      Christoph writes:
      
      "A couple of fixes for the next rc on the nvme front. Various FC fixes
      from James, controller removal fixes from Ming (including a block layer
      patch), a APST related device quirk from Andy, a RDMA fix for small
      queue depth device from Marta, as well as fixes for the lack of
      metadata support in non-PCIe drivers and the printk logging format from
      me."
      8aa63829
    • Bart Van Assche's avatar
      blk-mq: Only register debugfs attributes for blk-mq queues · a8ecdd71
      Bart Van Assche authored
      The code in blk-mq-debugfs.c assumes that it is working on a blk-mq
      queue and is not intended to work on a blk-sq queue. Hence only
      register blk-mq debugfs attributes for blk-mq queues.
      
      Fixes: commit 9c1051aa ("blk-mq: untangle debugfs and sysfs")
      Signed-off-by: default avatarBart Van Assche <bart.vanassche@sandisk.com>
      Cc: Christoph Hellwig <hch@lst.de>
      Cc: Ming Lei <ming.lei@redhat.com>
      Reviewed-by: default avatarOmar Sandoval <osandov@fb.com>
      Reviewed-by: default avatarHannes Reinecke <hare@suse.com>
      Signed-off-by: default avatarJens Axboe <axboe@fb.com>
      a8ecdd71
    • Jan Kiszka's avatar
      x86/timers: Move simple_udelay_calibration past init_hypervisor_platform · 702644ec
      Jan Kiszka authored
      This ensures that adjustments to x86_platform done by the hypervisor
      setup is already respected by this simple calibration.
      
      The current user of this, introduced by 1b5aeebf ("x86/earlyprintk:
      Add support for earlyprintk via USB3 debug port"), comes much later
      into play.
      
      Fixes: dd759d93 ("x86/timers: Add simple udelay calibration")
      Signed-off-by: default avatarJan Kiszka <jan.kiszka@siemens.com>
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Acked-by: default avatarLu Baolu <baolu.lu@linux.intel.com>
      Link: http://lkml.kernel.org/r/5e89fe60-aab3-2c1c-aba8-32f8ad376189@siemens.com
      702644ec
    • Andy Lutomirski's avatar
      nvme: Quirk APST on Intel 600P/P3100 devices · 50af47d0
      Andy Lutomirski authored
      They have known firmware bugs.  A fix is apparently in the works --
      once fixed firmware is available, someone from Intel (Hi, Keith!)
      can adjust the quirk accordingly.
      
      Cc: stable@vger.kernel.org # v4.11
      Cc: Kai-Heng Feng <kai.heng.feng@canonical.com>
      Cc: Mario Limonciello <mario_limonciello@dell.com>
      Signed-off-by: default avatarAndy Lutomirski <luto@kernel.org>
      Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
      50af47d0
    • Christoph Hellwig's avatar
      nvme: only setup block integrity if supported by the driver · c81bfba9
      Christoph Hellwig authored
      Currently only the PCIe driver supports metadata, so we should not claim
      integrity support for the other drivers.  This prevents nasty crashes
      with targets that advertise metadata support on fabrics.
      
      Also use the opportunity to factor out some code into a separate helper
      that isn't even compiled if CONFIG_BLK_DEV_INTEGRITY is disabled.
      Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
      Reviewed-by: default avatarKeith Busch <keith.busch@intel.com>
      c81bfba9
    • Christoph Hellwig's avatar
      nvme: replace is_flags field in nvme_ctrl_ops with a flags field · d3d5b87d
      Christoph Hellwig authored
      So that we can have more flags for transport-specific behavior.
      Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
      Reviewed-by: default avatarKeith Busch <keith.busch@intel.com>
      d3d5b87d