1. 20 Jun, 2019 5 commits
    • Linus Torvalds's avatar
      Merge tag 's390-5.2-5' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux · a409de61
      Linus Torvalds authored
      Pull s390 fixes from Heiko Carstens:
      
       - Disable address-of-packed-member warning in s390 specific boot code
         to get rid of a gcc9 warning which otherwise is already disabled for
         the whole kernel.
      
       - Fix yet another compiler error seen with CONFIG_OPTIMIZE_INLINING
         enabled.
      
       - Fix memory leak in vfio-ccw code on module exit.
      
      * tag 's390-5.2-5' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
        vfio-ccw: Destroy kmem cache region on module exit
        s390/ctl_reg: mark __ctl_set_bit and __ctl_clear_bit as __always_inline
        s390/boot: disable address-of-packed-member warning
      a409de61
    • Linus Torvalds's avatar
      Merge tag 'for_v5.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs · d72558b2
      Linus Torvalds authored
      Pull two misc vfs fixes from Jan Kara:
       "One small quota fix fixing spurious EDQUOT errors and one fanotify fix
        fixing a bug in the new fanotify FID reporting code"
      
      * tag 'for_v5.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:
        fanotify: update connector fsid cache on add mark
        quota: fix a problem about transfer quota
      d72558b2
    • Linus Torvalds's avatar
      Merge tag 'mmc-v5.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc · 6331d118
      Linus Torvalds authored
      Pull MMC fixes from Ulf Hansson:
       "Here's quite a few MMC fixes intended for v5.2-rc6. This time it also
        contains fixes for a WiFi driver, which device is attached to the SDIO
        interface. Patches for the WiFi driver have been acked by the
        corresponding maintainers.
      
        Summary:
      
        MMC core:
         - Make switch to eMMC HS400 more robust for some controllers
         - Add two SDIO func API to manage re-tuning constraints
         - Prevent processing SDIO IRQs when the card is suspended
      
        MMC host:
         - sdhi: Disallow broken HS400 for M3-W ES1.2, RZ/G2M and V3H
         - mtk-sd: Fixup support for SDIO IRQs
         - sdhci-pci-o2micro: Fixup support for tuning
      
        Wireless BRCMFMAC (SDIO):
         - Deal with expected transmission errors related to the idle states
           (handled by the Always-On-Subsystem or AOS) on the SDIO-based WiFi
           on rk3288-veyron-minnie, rk3288-veyron-speedy and
           rk3288-veyron-mickey"
      
      * tag 'mmc-v5.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:
        mmc: core: Prevent processing SDIO IRQs when the card is suspended
        mmc: sdhci: sdhci-pci-o2micro: Correctly set bus width when tuning
        brcmfmac: sdio: Don't tune while the card is off
        mmc: core: Add sdio_retune_hold_now() and sdio_retune_release()
        brcmfmac: sdio: Disable auto-tuning around commands expected to fail
        mmc: core: API to temporarily disable retuning for SDIO CRC errors
        Revert "brcmfmac: disable command decode in sdio_aos"
        mmc: mediatek: fix SDIO IRQ detection issue
        mmc: mediatek: fix SDIO IRQ interrupt handle flow
        mmc: core: complete HS400 before checking status
        mmc: sdhi: disallow HS400 for M3-W ES1.2, RZ/G2M, and V3H
      6331d118
    • Linus Torvalds's avatar
      Merge tag 'for-linus-20190620' of git://git.kernel.dk/linux-block · 41a247d8
      Linus Torvalds authored
      Pull block fixes from Jens Axboe:
       "Three fixes that should go into this series.
      
        One is a set of two patches from Christoph, fixing a page leak on same
        page merges. Boiled down version of a bigger fix, but this one is more
        appropriate for this late in the cycle (and easier to backport to
        stable).
      
        The last patch is for a divide error in MD, from Mariusz (via Song)"
      
      * tag 'for-linus-20190620' of git://git.kernel.dk/linux-block:
        md: fix for divide error in status_resync
        block: fix page leak when merging to same page
        block: return from __bio_try_merge_page if merging occured in the same page
      41a247d8
    • J. Bruce Fields's avatar
      nfsd: replace Jeff by Chuck as nfsd co-maintainer · 241e3900
      J. Bruce Fields authored
      Jeff's picking up more responsibilities elsewhere, and Chuck's agreed to
      take over.
      
      For now, as before, nothing's changing day-to-day, but I want to have a
      co-maintainer if only for bus factor.
      Acked-by: default avatarJeff Layton <jlayton@redhat.com>
      Signed-off-by: default avatarJ. Bruce Fields <bfields@redhat.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      241e3900
  2. 19 Jun, 2019 5 commits
  3. 18 Jun, 2019 20 commits
    • Mike Salvatore's avatar
      apparmor: reset pos on failure to unpack for various functions · 156e4299
      Mike Salvatore authored
      Each function that manipulates the aa_ext struct should reset it's "pos"
      member on failure. This ensures that, on failure, no changes are made to
      the state of the aa_ext struct.
      
      There are paths were elements are optional and the error path is
      used to indicate the optional element is not present. This means
      instead of just aborting on error the unpack stream can become
      unsynchronized on optional elements, if using one of the affected
      functions.
      
      Cc: stable@vger.kernel.org
      Fixes: 736ec752 ("AppArmor: policy routines for loading and unpacking policy")
      Signed-off-by: default avatarMike Salvatore <mike.salvatore@canonical.com>
      Signed-off-by: default avatarJohn Johansen <john.johansen@canonical.com>
      156e4299
    • Jann Horn's avatar
      apparmor: enforce nullbyte at end of tag string · 8404d7a6
      Jann Horn authored
      A packed AppArmor policy contains null-terminated tag strings that are read
      by unpack_nameX(). However, unpack_nameX() uses string functions on them
      without ensuring that they are actually null-terminated, potentially
      leading to out-of-bounds accesses.
      
      Make sure that the tag string is null-terminated before passing it to
      strcmp().
      
      Cc: stable@vger.kernel.org
      Fixes: 736ec752 ("AppArmor: policy routines for loading and unpacking policy")
      Signed-off-by: default avatarJann Horn <jannh@google.com>
      Signed-off-by: default avatarJohn Johansen <john.johansen@canonical.com>
      8404d7a6
    • John Johansen's avatar
      apparmor: fix PROFILE_MEDIATES for untrusted input · 23375b13
      John Johansen authored
      While commit 11c236b8 ("apparmor: add a default null dfa") ensure
      every profile has a policy.dfa it does not resize the policy.start[]
      to have entries for every possible start value. Which means
      PROFILE_MEDIATES is not safe to use on untrusted input. Unforunately
      commit b9590ad4 ("apparmor: remove POLICY_MEDIATES_SAFE") did not
      take into account the start value usage.
      
      The input string in profile_query_cb() is user controlled and is not
      properly checked to be within the limited start[] entries, even worse
      it can't be as userspace policy is allowed to make us of entries types
      the kernel does not know about. This mean usespace can currently cause
      the kernel to access memory up to 240 entries beyond the start array
      bounds.
      
      Cc: stable@vger.kernel.org
      Fixes: b9590ad4 ("apparmor: remove POLICY_MEDIATES_SAFE")
      Signed-off-by: default avatarJohn Johansen <john.johansen@canonical.com>
      23375b13
    • Jens Axboe's avatar
      Merge branch 'md-fixes' of https://github.com/liu-song-6/linux into for-linus · 440078db
      Jens Axboe authored
      Pull MD fix from Song.
      
      * 'md-fixes' of https://github.com/liu-song-6/linux:
        md: fix for divide error in status_resync
      440078db
    • Linus Torvalds's avatar
      Merge tag 'for-5.2-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux · bed3c0d8
      Linus Torvalds authored
      Pull btrfs fixes from David Sterba:
      
       - regression where properties stored as xattrs are not properly
         persisted
      
       - a small readahead fix (the fstests testcase for that fix hangs on
         unpatched kernel, so we'd like get it merged to ease future testing)
      
       - fix a race during block group creation and deletion
      
      * tag 'for-5.2-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
        Btrfs: fix failure to persist compression property xattr deletion on fsync
        btrfs: start readahead also in seed devices
        Btrfs: fix race between block group removal and block group allocation
      bed3c0d8
    • Linus Torvalds's avatar
      Merge tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc · 7b306892
      Linus Torvalds authored
      Pull ARM SoC fixes from Olof Johansson:
       "I've been bad at collecting fixes this release cycle, so this is a
        fairly large batch that's been trickling in for a while.
      
        It's the usual mix, more or less.
      
        Some of the bigger things fixed:
      
         - Voltage fix for MMC on TI DRA7 that sometimes would overvoltage
           cards
      
         - Regression fixes for D_CAN on am355x
      
         - i.MX6SX cpuidle fix to deal with wakeup latency (dropped uart
           chars)
      
         - DT fixes for some DRA7 variants that don't share the superset of
           blocks on the chip
      
        plus the usual mix of stuff: minor build/warning fixes, Kconfig
        dependencies, and some DT fixlets"
      
      * tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (28 commits)
        soc: ixp4xx: npe: Fix an IS_ERR() vs NULL check in probe
        ARM: ixp4xx: include irqs.h where needed
        ARM: ixp4xx: mark ixp4xx_irq_setup as __init
        ARM: ixp4xx: don't select SERIAL_OF_PLATFORM
        firmware: trusted_foundations: add ARMv7 dependency
        MAINTAINERS: Change QCOM repo location
        ARM: davinci: da8xx: specify dma_coherent_mask for lcdc
        ARM: davinci: da850-evm: call regulator_has_full_constraints()
        ARM: mvebu_v7_defconfig: fix Ethernet on Clearfog
        ARM: dts: am335x phytec boards: Fix cd-gpios active level
        ARM: dts: dra72x: Disable usb4_tm target module
        arm64: arch_k3: Fix kconfig dependency warning
        ARM: dts: Drop bogus CLKSEL for timer12 on dra7
        MAINTAINERS: Update Stefan Wahren email address
        ARM: dts: bcm: Add missing device_type = "memory" property
        soc: bcm: brcmstb: biuctrl: Register writes require a barrier
        soc: brcmstb: Fix error path for unsupported CPUs
        ARM: dts: dra71x: Disable usb4_tm target module
        ARM: dts: dra71x: Disable rtc target module
        ARM: dts: dra76x: Disable usb4_tm target module
        ...
      7b306892
    • Linus Torvalds's avatar
      Merge tag 'meminit-v5.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux · 915ed932
      Linus Torvalds authored
      Pull stack init fix from Kees Cook:
       "This is a small update to the stack auto-initialization self-test code
        to deal with the Clang initialization pattern.
      
        It's been in linux-next for a couple weeks; I had waited a bit
        wondering if anything more substantial was going to show up, but
        nothing has, so I'm sending this now before it gets too late"
      
      * tag 'meminit-v5.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
        lib/test_stackinit: Handle Clang auto-initialization pattern
      915ed932
    • Mariusz Tkaczyk's avatar
      md: fix for divide error in status_resync · 9642fa73
      Mariusz Tkaczyk authored
      Stopping external metadata arrays during resync/recovery causes
      retries, loop of interrupting and starting reconstruction, until it
      hit at good moment to stop completely. While these retries
      curr_mark_cnt can be small- especially on HDD drives, so subtraction
      result can be smaller than 0. However it is casted to uint without
      checking. As a result of it the status bar in /proc/mdstat while stopping
      is strange (it jumps between 0% and 99%).
      
      The real problem occurs here after commit 72deb455 ("block: remove
      CONFIG_LBDAF"). Sector_div() macro has been changed, now the
      divisor is casted to uint32. For db = -8 the divisior(db/32-1) becomes 0.
      
      Check if db value can be really counted and replace these macro by
      div64_u64() inline.
      Signed-off-by: default avatarMariusz Tkaczyk <mariusz.tkaczyk@intel.com>
      Signed-off-by: default avatarSong Liu <songliubraving@fb.com>
      9642fa73
    • Dan Carpenter's avatar
      soc: ixp4xx: npe: Fix an IS_ERR() vs NULL check in probe · cd3967be
      Dan Carpenter authored
      The devm_ioremap_resource() function doesn't return NULL, it returns
      error pointers.
      
      Fixes: 0b458d7b ("soc: ixp4xx: npe: Pass addresses as resources")
      Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Reviewed-by: default avatarLinus Walleij <linus.walleij@linaro.org>
      Signed-off-by: default avatarOlof Johansson <olof@lixom.net>
      cd3967be
    • Ulf Hansson's avatar
      mmc: core: Prevent processing SDIO IRQs when the card is suspended · 83293386
      Ulf Hansson authored
      Processing of SDIO IRQs must obviously be prevented while the card is
      system suspended, otherwise we may end up trying to communicate with an
      uninitialized SDIO card.
      
      Reports throughout the years shows that this is not only a theoretical
      problem, but a real issue. So, let's finally fix this problem, by keeping
      track of the state for the card and bail out before processing the SDIO
      IRQ, in case the card is suspended.
      
      Cc: stable@vger.kernel.org
      Reported-by: default avatarDouglas Anderson <dianders@chromium.org>
      Tested-by: default avatarDouglas Anderson <dianders@chromium.org>
      Signed-off-by: default avatarUlf Hansson <ulf.hansson@linaro.org>
      83293386
    • Raul E Rangel's avatar
      mmc: sdhci: sdhci-pci-o2micro: Correctly set bus width when tuning · 0f7b79a4
      Raul E Rangel authored
      The O2Micro controller only supports tuning at 4-bits. So the host driver
      needs to change the bus width while tuning and then set it back when done.
      
      There was a bug in the original implementation in that mmc->ios.bus_width
      also wasn't updated. Thus setting the incorrect blocksize in
      sdhci_send_tuning which results in a tuning failure.
      Signed-off-by: default avatarRaul E Rangel <rrangel@chromium.org>
      Fixes: 0086fc21 ("mmc: sdhci: Add support for O2 hardware tuning")
      Acked-by: default avatarAdrian Hunter <adrian.hunter@intel.com>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarUlf Hansson <ulf.hansson@linaro.org>
      0f7b79a4
    • Douglas Anderson's avatar
      brcmfmac: sdio: Don't tune while the card is off · 65dade60
      Douglas Anderson authored
      When Broadcom SDIO cards are idled they go to sleep and a whole
      separate subsystem takes over their SDIO communication.  This is the
      Always-On-Subsystem (AOS) and it can't handle tuning requests.
      
      Specifically, as tested on rk3288-veyron-minnie (which reports having
      BCM4354/1 in dmesg), if I force a retune in brcmf_sdio_kso_control()
      when "on = 1" (aka we're transition from sleep to wake) by whacking:
        bus->sdiodev->func1->card->host->need_retune = 1
      ...then I can often see tuning fail.  In this case dw_mmc reports "All
      phases bad!").  Note that I don't get 100% failure, presumably because
      sometimes the card itself has already transitioned away from the AOS
      itself by the time we try to wake it up.  If I force retuning when "on
      = 0" (AKA force retuning right before sending the command to go to
      sleep) then retuning is always OK.
      
      NOTE: we need _both_ this patch and the patch to avoid triggering
      tuning due to CRC errors in the sleep/wake transition, AKA ("brcmfmac:
      sdio: Disable auto-tuning around commands expected to fail").  Though
      both patches handle issues with Broadcom's AOS, the problems are
      distinct:
      1. We want to defer (but not ignore) asynchronous (like
         timer-requested) tuning requests till the card is awake.  However,
         we want to ignore CRC errors during the transition, we don't want
         to queue deferred tuning request.
      2. You could imagine that the AOS could implement retuning but we
         could still get errors while transitioning in and out of the AOS.
         Similarly you could imagine a seamless transition into and out of
         the AOS (with no CRC errors) even if the AOS couldn't handle
         tuning.
      
      ALSO NOTE: presumably there is never a desperate need to retune in
      order to wake up the card, since doing so is impossible.  Luckily the
      only way the card can get into sleep state is if we had a good enough
      tuning to send it the command to put it into sleep, so presumably that
      "good enough" tuning is enough to wake us up, at least with a few
      retries.
      
      Cc: stable@vger.kernel.org #v4.18+
      Signed-off-by: default avatarDouglas Anderson <dianders@chromium.org>
      Acked-by: default avatarAdrian Hunter <adrian.hunter@intel.com>
      Reviewed-by: default avatarArend van Spriel <arend.vanspriel@broadcom.com>
      Acked-by: default avatarKalle Valo <kvalo@codeaurora.org>
      Signed-off-by: default avatarUlf Hansson <ulf.hansson@linaro.org>
      65dade60
    • Douglas Anderson's avatar
      mmc: core: Add sdio_retune_hold_now() and sdio_retune_release() · b4c9f938
      Douglas Anderson authored
      We want SDIO drivers to be able to temporarily stop retuning when the
      driver knows that the SDIO card is not in a state where retuning will
      work (maybe because the card is asleep).  We'll move the relevant
      functions to a place where drivers can call them.
      
      Cc: stable@vger.kernel.org #v4.18+
      Signed-off-by: default avatarDouglas Anderson <dianders@chromium.org>
      Acked-by: default avatarAdrian Hunter <adrian.hunter@intel.com>
      Acked-by: default avatarKalle Valo <kvalo@codeaurora.org>
      Signed-off-by: default avatarUlf Hansson <ulf.hansson@linaro.org>
      b4c9f938
    • Douglas Anderson's avatar
      brcmfmac: sdio: Disable auto-tuning around commands expected to fail · 2de0b42d
      Douglas Anderson authored
      There are certain cases, notably when transitioning between sleep and
      active state, when Broadcom SDIO WiFi cards will produce errors on the
      SDIO bus.  This is evident from the source code where you can see that
      we try commands in a loop until we either get success or we've tried
      too many times.  The comment in the code reinforces this by saying
      "just one write attempt may fail"
      
      Unfortunately these failures sometimes end up causing an "-EILSEQ"
      back to the core which triggers a retuning of the SDIO card and that
      blocks all traffic to the card until it's done.
      
      Let's disable retuning around the commands we expect might fail.
      
      Cc: stable@vger.kernel.org #v4.18+
      Signed-off-by: default avatarDouglas Anderson <dianders@chromium.org>
      Acked-by: default avatarAdrian Hunter <adrian.hunter@intel.com>
      Reviewed-by: default avatarArend van Spriel <arend.vanspriel@broadcom.com>
      Acked-by: default avatarKalle Valo <kvalo@codeaurora.org>
      Signed-off-by: default avatarUlf Hansson <ulf.hansson@linaro.org>
      2de0b42d
    • Douglas Anderson's avatar
      mmc: core: API to temporarily disable retuning for SDIO CRC errors · 0a55f4ab
      Douglas Anderson authored
      Normally when the MMC core sees an "-EILSEQ" error returned by a host
      controller then it will trigger a retuning of the card.  This is
      generally a good idea.
      
      However, if a command is expected to sometimes cause transfer errors
      then these transfer errors shouldn't cause a re-tuning.  This
      re-tuning will be a needless waste of time.  One example case where a
      transfer is expected to cause errors is when transitioning between
      idle (sometimes referred to as "sleep" in Broadcom code) and active
      state on certain Broadcom WiFi SDIO cards.  Specifically if the card
      was already transitioning between states when the command was sent it
      could cause an error on the SDIO bus.
      
      Let's add an API that the SDIO function drivers can call that will
      temporarily disable the auto-tuning functionality.  Then we can add a
      call to this in the Broadcom WiFi driver and any other driver that
      might have similar needs.
      
      NOTE: this makes the assumption that the card is already tuned well
      enough that it's OK to disable the auto-retuning during one of these
      error-prone situations.  Presumably the driver code performing the
      error-prone transfer knows how to recover / retry from errors.  ...and
      after we can get back to a state where transfers are no longer
      error-prone then we can enable the auto-retuning again.  If we truly
      find ourselves in a case where the card needs to be retuned sometimes
      to handle one of these error-prone transfers then we can always try a
      few transfers first without auto-retuning and then re-try with
      auto-retuning if the first few fail.
      
      Without this change on rk3288-veyron-minnie I periodically see this in
      the logs of a machine just sitting there idle:
        dwmmc_rockchip ff0d0000.dwmmc: Successfully tuned phase to XYZ
      
      Cc: stable@vger.kernel.org #v4.18+
      Signed-off-by: default avatarDouglas Anderson <dianders@chromium.org>
      Acked-by: default avatarAdrian Hunter <adrian.hunter@intel.com>
      Acked-by: default avatarKalle Valo <kvalo@codeaurora.org>
      Signed-off-by: default avatarUlf Hansson <ulf.hansson@linaro.org>
      0a55f4ab
    • Douglas Anderson's avatar
      Revert "brcmfmac: disable command decode in sdio_aos" · abdd5dcc
      Douglas Anderson authored
      This reverts commit 29f65891.
      
      After that patch landed I find that my kernel log on
      rk3288-veyron-minnie and rk3288-veyron-speedy is filled with:
      brcmfmac: brcmf_sdio_bus_sleep: error while changing bus sleep state -110
      
      This seems to happen every time the Broadcom WiFi transitions out of
      sleep mode.  Reverting the commit fixes the problem for me, so that's
      what this patch does.
      
      Note that, in general, the justification in the original commit seemed
      a little weak.  It looked like someone was testing on a SD card
      controller that would sometimes die if there were CRC errors on the
      bus.  This used to happen back in early days of dw_mmc (the controller
      on my boards), but we fixed it.  Disabling a feature on all boards
      just because one SD card controller is broken seems bad.
      
      Fixes: 29f65891 ("brcmfmac: disable command decode in sdio_aos")
      Cc: Wright Feng <wright.feng@cypress.com>
      Cc: Double Lo <double.lo@cypress.com>
      Cc: Madhan Mohan R <madhanmohan.r@cypress.com>
      Cc: Chi-Hsien Lin <chi-hsien.lin@cypress.com>
      Signed-off-by: default avatarDouglas Anderson <dianders@chromium.org>
      Cc: stable@vger.kernel.org
      Acked-by: default avatarKalle Valo <kvalo@codeaurora.org>
      Signed-off-by: default avatarUlf Hansson <ulf.hansson@linaro.org>
      abdd5dcc
    • Arnd Bergmann's avatar
      ARM: ixp4xx: include irqs.h where needed · 140d9009
      Arnd Bergmann authored
      Multiple ixp4xx specific files require macros from irqs.h that
      were moved out from mach/irqs.h, e.g.:
      
      arch/arm/mach-ixp4xx/vulcan-pci.c:41:19: error: this function declaration is not a prototype [-Werror,-Wstrict-prototypes]
      arch/arm/mach-ixp4xx/vulcan-pci.c:49:10: error: implicit declaration of function 'IXP4XX_GPIO_IRQ' [-Werror,-Wimplicit-function-declaration]
                      return IXP4XX_GPIO_IRQ(INTA);
      
      Include this header in all files that failed to build because of
      that.
      
      Fixes: dc8ef8cd ("ARM: ixp4xx: Convert to SPARSE_IRQ")
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Signed-off-by: default avatarOlof Johansson <olof@lixom.net>
      140d9009
    • Arnd Bergmann's avatar
      ARM: ixp4xx: mark ixp4xx_irq_setup as __init · 4ea10150
      Arnd Bergmann authored
      Kbuild complains about ixp4xx_irq_setup not being __init
      itself in some configurations:
      
      WARNING: vmlinux.o(.text+0x85bae4): Section mismatch in reference from the function ixp4xx_irq_setup() to the function .init.text:set_handle_irq()
      The function ixp4xx_irq_setup() references
      the function __init set_handle_irq().
      This is often because ixp4xx_irq_setup lacks a __init
      annotation or the annotation of set_handle_irq is wrong.
      
      I suspect it normally gets inlined, so we get no such warning,
      but clang makes this obvious when the function is left out
      of line.
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Signed-off-by: default avatarOlof Johansson <olof@lixom.net>
      4ea10150
    • Arnd Bergmann's avatar
      ARM: ixp4xx: don't select SERIAL_OF_PLATFORM · 6d8df602
      Arnd Bergmann authored
      Platforms should not normally select all the device drivers, leave that
      up to the user and the defconfig file.
      
      In this case, we get a warning for randconfig builds:
      
      WARNING: unmet direct dependencies detected for SERIAL_OF_PLATFORM
        Depends on [n]: TTY [=y] && HAS_IOMEM [=y] && SERIAL_8250 [=n] && OF [=y]
        Selected by [y]:
        - MACH_IXP4XX_OF [=y] && ARCH_IXP4XX [=y]
      
      Fixes: 9540724c ("ARM: ixp4xx: Add device tree boot support")
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Signed-off-by: default avatarOlof Johansson <olof@lixom.net>
      6d8df602
    • Arnd Bergmann's avatar
      firmware: trusted_foundations: add ARMv7 dependency · cad47b32
      Arnd Bergmann authored
      The "+sec" extension is invalid for older ARM architectures, but
      the code can now be built on any ARM configuration:
      
      /tmp/trusted_foundations-2d0882.s: Assembler messages:
      /tmp/trusted_foundations-2d0882.s:194: Error: architectural extension `sec' is not allowed for the current base architecture
      /tmp/trusted_foundations-2d0882.s:201: Error: selected processor does not support `smc #0' in ARM mode
      /tmp/trusted_foundations-2d0882.s:213: Error: architectural extension `sec' is not allowed for the current base architecture
      /tmp/trusted_foundations-2d0882.s:220: Error: selected processor does not support `smc #0' in ARM mode
      
      Add a dependency on ARMv7 for the build.
      
      Fixes: 4cb5d9ec ("firmware: Move Trusted Foundations support")
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Signed-off-by: default avatarOlof Johansson <olof@lixom.net>
      cad47b32
  4. 17 Jun, 2019 10 commits
    • Linus Torvalds's avatar
      Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs · 29f785ff
      Linus Torvalds authored
      Pull vfs fixes from Al Viro:
       "MS_MOVE regression fix + breakage in fsmount(2) (also introduced in
        this cycle, along with fsmount(2) itself).
      
        I'm still digging through the piles of mail, so there might be more
        fixes to follow, but these two are obvious and self-contained, so
        there's no point delaying those..."
      
      * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
        fs/namespace: fix unprivileged mount propagation
        vfs: fsmount: add missing mntget()
      29f785ff
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · da0f3820
      Linus Torvalds authored
      Pull networking fixes from David Miller:
       "Lots of bug fixes here:
      
         1) Out of bounds access in __bpf_skc_lookup, from Lorenz Bauer.
      
         2) Fix rate reporting in cfg80211_calculate_bitrate_he(), from John
            Crispin.
      
         3) Use after free in psock backlog workqueue, from John Fastabend.
      
         4) Fix source port matching in fdb peer flow rule of mlx5, from Raed
            Salem.
      
         5) Use atomic_inc_not_zero() in fl6_sock_lookup(), from Eric Dumazet.
      
         6) Network header needs to be set for packet redirect in nfp, from
            John Hurley.
      
         7) Fix udp zerocopy refcnt, from Willem de Bruijn.
      
         8) Don't assume linear buffers in vxlan and geneve error handlers,
            from Stefano Brivio.
      
         9) Fix TOS matching in mlxsw, from Jiri Pirko.
      
        10) More SCTP cookie memory leak fixes, from Neil Horman.
      
        11) Fix VLAN filtering in rtl8366, from Linus Walluij.
      
        12) Various TCP SACK payload size and fragmentation memory limit fixes
            from Eric Dumazet.
      
        13) Use after free in pneigh_get_next(), also from Eric Dumazet.
      
        14) LAPB control block leak fix from Jeremy Sowden"
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (145 commits)
        lapb: fixed leak of control-blocks.
        tipc: purge deferredq list for each grp member in tipc_group_delete
        ax25: fix inconsistent lock state in ax25_destroy_timer
        neigh: fix use-after-free read in pneigh_get_next
        tcp: fix compile error if !CONFIG_SYSCTL
        hv_sock: Suppress bogus "may be used uninitialized" warnings
        be2net: Fix number of Rx queues used for flow hashing
        net: handle 802.1P vlan 0 packets properly
        tcp: enforce tcp_min_snd_mss in tcp_mtu_probing()
        tcp: add tcp_min_snd_mss sysctl
        tcp: tcp_fragment() should apply sane memory limits
        tcp: limit payload size of sacked skbs
        Revert "net: phylink: set the autoneg state in phylink_phy_change"
        bpf: fix nested bpf tracepoints with per-cpu data
        bpf: Fix out of bounds memory access in bpf_sk_storage
        vsock/virtio: set SOCK_DONE on peer shutdown
        net: dsa: rtl8366: Fix up VLAN filtering
        net: phylink: set the autoneg state in phylink_phy_change
        net: add high_order_alloc_disable sysctl/static key
        tcp: add tcp_tx_skb_cache sysctl
        ...
      da0f3820
    • Christian Brauner's avatar
      fs/namespace: fix unprivileged mount propagation · d728cf79
      Christian Brauner authored
      When propagating mounts across mount namespaces owned by different user
      namespaces it is not possible anymore to move or umount the mount in the
      less privileged mount namespace.
      
      Here is a reproducer:
      
        sudo mount -t tmpfs tmpfs /mnt
        sudo --make-rshared /mnt
      
        # create unprivileged user + mount namespace and preserve propagation
        unshare -U -m --map-root --propagation=unchanged
      
        # now change back to the original mount namespace in another terminal:
        sudo mkdir /mnt/aaa
        sudo mount -t tmpfs tmpfs /mnt/aaa
      
        # now in the unprivileged user + mount namespace
        mount --move /mnt/aaa /opt
      
      Unfortunately, this is a pretty big deal for userspace since this is
      e.g. used to inject mounts into running unprivileged containers.
      So this regression really needs to go away rather quickly.
      
      The problem is that a recent change falsely locked the root of the newly
      added mounts by setting MNT_LOCKED. Fix this by only locking the mounts
      on copy_mnt_ns() and not when adding a new mount.
      
      Fixes: 3bd045cc ("separate copying and locking mount tree on cross-userns copies")
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      Cc: <stable@vger.kernel.org>
      Tested-by: default avatarChristian Brauner <christian@brauner.io>
      Acked-by: default avatarChristian Brauner <christian@brauner.io>
      Signed-off-by: default avatar"Eric W. Biederman" <ebiederm@xmission.com>
      Signed-off-by: default avatarChristian Brauner <christian@brauner.io>
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      d728cf79
    • Eric Biggers's avatar
      vfs: fsmount: add missing mntget() · 1b0b9cc8
      Eric Biggers authored
      sys_fsmount() needs to take a reference to the new mount when adding it
      to the anonymous mount namespace.  Otherwise the filesystem can be
      unmounted while it's still in use, as found by syzkaller.
      Reported-by: default avatarMark Rutland <mark.rutland@arm.com>
      Reported-by: syzbot+99de05d099a170867f22@syzkaller.appspotmail.com
      Reported-by: syzbot+7008b8b8ba7df475fdc8@syzkaller.appspotmail.com
      Fixes: 93766fbd ("vfs: syscall: Add fsmount() to create a mount for a superblock")
      Signed-off-by: default avatarEric Biggers <ebiggers@google.com>
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      1b0b9cc8
    • David S. Miller's avatar
      Merge branch 'tcp-fixes' · 4fddbf8a
      David S. Miller authored
      Eric Dumazet says:
      
      ====================
      tcp: make sack processing more robust
      
      Jonathan Looney brought to our attention multiple problems
      in TCP stack at the sender side.
      
      SACK processing can be abused by malicious peers to either
      cause overflows, or increase of memory usage.
      
      First two patches fix the immediate problems.
      
      Since the malicious peers abuse senders by advertizing a very
      small MSS in their SYN or SYNACK packet, the last two
      patches add a new sysctl so that admins can chose a higher
      limit for MSS clamping.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      4fddbf8a
    • Linus Torvalds's avatar
      Merge tag 'riscv-for-v5.2/fixes-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux · eb7c825b
      Linus Torvalds authored
      Pull RISC-V fixes from Paul Walmsley:
       "This contains fixes, defconfig, and DT data changes for the v5.2-rc
        series.
      
        The fixes are relatively straightforward:
      
         - Addition of a TLB fence in the vmalloc_fault path, so the CPU
           doesn't enter an infinite page fault loop
      
         - Readdition of the pm_power_off export, so device drivers that
           reassign it can now be built as modules
      
         - A udelay() fix for RV32, fixing a miscomputation of the delay time
      
         - Removal of deprecated smp_mb__*() barriers
      
        This also adds initial DT data infrastructure for arch/riscv, along
        with initial data for the SiFive FU540-C000 SoC and the corresponding
        HiFive Unleashed board.
      
        We also update the RV64 defconfig to include some core drivers for the
        FU540 in the build"
      
      * tag 'riscv-for-v5.2/fixes-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:
        riscv: remove unused barrier defines
        riscv: mm: synchronize MMU after pte change
        riscv: dts: add initial board data for the SiFive HiFive Unleashed
        riscv: dts: add initial support for the SiFive FU540-C000 SoC
        dt-bindings: riscv: convert cpu binding to json-schema
        dt-bindings: riscv: sifive: add YAML documentation for the SiFive FU540
        arch: riscv: add support for building DTB files from DT source data
        riscv: Fix udelay in RV32.
        riscv: export pm_power_off again
        RISC-V: defconfig: enable clocks, serial console
      eb7c825b
    • Christoph Hellwig's avatar
      block: fix page leak when merging to same page · 45691804
      Christoph Hellwig authored
      When multiple iovecs reference the same page, each get_user_page call
      will add a reference to the page.  But once we've created the bio that
      information gets lost and only a single reference will be dropped after
      I/O completion.  Use the same_page information returned from
      __bio_try_merge_page to drop additional references to pages that were
      already present in the bio.
      
      Based on a patch from Ming Lei.
      
      Link: https://lkml.org/lkml/2019/4/23/64
      Fixes: 576ed913 ("block: use bio_add_page in bio_iov_iter_get_pages")
      Reported-by: default avatarDavid Gibson <david@gibson.dropbear.id.au>
      Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
      Reviewed-by: default avatarMing Lei <ming.lei@redhat.com>
      Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
      45691804
    • Christoph Hellwig's avatar
      block: return from __bio_try_merge_page if merging occured in the same page · ff896738
      Christoph Hellwig authored
      We currently have an input same_page parameter to __bio_try_merge_page
      to prohibit merging in the same page.  The rationale for that is that
      some callers need to account for every page added to a bio.  Instead of
      letting these callers call twice into the merge code to account for the
      new vs existing page cases, just turn the paramter into an output one that
      returns if a merge in the same page occured and let them act accordingly.
      Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
      Reviewed-by: default avatarMing Lei <ming.lei@redhat.com>
      Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
      ff896738
    • Filipe Manana's avatar
      Btrfs: fix failure to persist compression property xattr deletion on fsync · 3763771c
      Filipe Manana authored
      After the recent series of cleanups in the properties and xattrs modules
      that landed in the 5.2 merge window, we ended up with a regression where
      after deleting the compression xattr property through the setflags ioctl,
      we don't set the BTRFS_INODE_COPY_EVERYTHING flag in the inode anymore.
      As a consequence, if the inode was fsync'ed when it had the compression
      property set, after deleting the compression property through the setflags
      ioctl and fsync'ing again the inode, the log will still contain the
      compression xattr, because the inode did not had that bit set, which
      made the fsync not delete all xattrs from the log and copy all xattrs
      from the subvolume tree to the log tree.
      
      This regression happens due to the fact that that series of cleanups
      made btrfs_set_prop() call the old function do_setxattr() (which is now
      named btrfs_setxattr()), and not the old version of btrfs_setxattr(),
      which is now called btrfs_setxattr_trans().
      
      Fix this by setting the BTRFS_INODE_COPY_EVERYTHING bit in the current
      btrfs_setxattr() function and remove it from everywhere else, including
      its setup at btrfs_ioctl_setflags(). This is cleaner, avoids similar
      regressions in the future, and centralizes the setup of the bit. After
      all, the need to setup this bit should only be in the xattrs module,
      since it is an implementation of xattrs.
      
      Fixes: 04e6863b ("btrfs: split btrfs_setxattr calls regarding transaction")
      CC: stable@vger.kernel.org # 4.4+
      Signed-off-by: default avatarFilipe Manana <fdmanana@suse.com>
      Signed-off-by: default avatarDavid Sterba <dsterba@suse.com>
      3763771c
    • Rolf Eike Beer's avatar
      riscv: remove unused barrier defines · 259931fd
      Rolf Eike Beer authored
      They were introduced in commit fab957c1 ("RISC-V: Atomic and
      Locking Code") long after commit 2e39465a ("locking: Remove
      deprecated smp_mb__() barriers") removed the remnants of all previous
      instances from the tree.
      Signed-off-by: default avatarRolf Eike Beer <eb@emlix.com>
      [paul.walmsley@sifive.com: stripped spurious mbox header from patch
       description; fixed commit references in patch header]
      Signed-off-by: default avatarPaul Walmsley <paul.walmsley@sifive.com>
      259931fd