profile
viewpoint
Vivek Goyal rhvgoyal Red Hat Inc.

create barnchrhvgoyal/linux

branch : cleanup-for-5.5

created branch time in 14 days

push eventrhvgoyal/linux

Jaska Uimonen

commit sha a315e76fc544f09daf619530a7b2f85865e6b25e

ASoC: rt5682: add NULL handler to set_jack function Implement NULL handler in set_jack function to disable irq's. Signed-off-by: Jaska Uimonen <jaska.uimonen@intel.com> Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com> Link: https://lore.kernel.org/r/20190927201408.925-4-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown <broonie@kernel.org>

view details

Jaska Uimonen

commit sha 6ba5041c23c1062d4e8287b2b76a1181538c6df1

ASoC: intel: sof_rt5682: add remove function to disable jack When removing sof module the rt5682 jack handler will oops if jack detection is not disabled. So add remove function, which disables the jack detection. Signed-off-by: Jaska Uimonen <jaska.uimonen@intel.com> Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com> Link: https://lore.kernel.org/r/20190927201408.925-5-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown <broonie@kernel.org>

view details

Jaska Uimonen

commit sha 2bdf194e2030fce4f2e91300817338353414ab3b

ASoC: intel: bytcr_rt5651: add null check to support_button_press When removing sof module the support_button_press function will oops because hp_jack pointer is not checked for NULL. So add a check to fix this. Signed-off-by: Jaska Uimonen <jaska.uimonen@intel.com> Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com> Link: https://lore.kernel.org/r/20190927201408.925-2-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown <broonie@kernel.org>

view details

Yizhuo

commit sha 1252b283141f03c3dffd139292c862cae10e174d

regulator: pfuze100-regulator: Variable "val" in pfuze100_regulator_probe() could be uninitialized In function pfuze100_regulator_probe(), variable "val" could be initialized if regmap_read() fails. However, "val" is used to decide the control flow later in the if statement, which is potentially unsafe. Signed-off-by: Yizhuo <yzhai003@ucr.edu> Link: https://lore.kernel.org/r/20190929170957.14775-1-yzhai003@ucr.edu Signed-off-by: Mark Brown <broonie@kernel.org>

view details

Zygo Blaxell

commit sha 7a54789074a54f64addf5b49bf1994f478337a83

btrfs: fix balance convert to single on 32-bit host CPUs Currently, the command: btrfs balance start -dconvert=single,soft . on a Raspberry Pi produces the following kernel message: BTRFS error (device mmcblk0p2): balance: invalid convert data profile single This fails because we use is_power_of_2(unsigned long) to validate the new data profile, the constant for 'single' profile uses bit 48, and there are only 32 bits in a long on ARM. Fix by open-coding the check using u64 variables. Tested by completing the original balance command on several Raspberry Pis. Fixes: 818255feece6 ("btrfs: use common helper instead of open coding a bit test") CC: stable@vger.kernel.org # 4.20+ Signed-off-by: Zygo Blaxell <ce3g8jdj@umail.furryterror.org> Reviewed-by: David Sterba <dsterba@suse.com> Signed-off-by: David Sterba <dsterba@suse.com>

view details

Josef Bacik

commit sha 11a19a90870ea5496a8ded69b86f5b476b6d3355

btrfs: allocate new inode in NOFS context A user reported a lockdep splat ====================================================== WARNING: possible circular locking dependency detected 5.2.11-gentoo #2 Not tainted ------------------------------------------------------ kswapd0/711 is trying to acquire lock: 000000007777a663 (sb_internal){.+.+}, at: start_transaction+0x3a8/0x500 but task is already holding lock: 000000000ba86300 (fs_reclaim){+.+.}, at: __fs_reclaim_acquire+0x0/0x30 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (fs_reclaim){+.+.}: kmem_cache_alloc+0x1f/0x1c0 btrfs_alloc_inode+0x1f/0x260 alloc_inode+0x16/0xa0 new_inode+0xe/0xb0 btrfs_new_inode+0x70/0x610 btrfs_symlink+0xd0/0x420 vfs_symlink+0x9c/0x100 do_symlinkat+0x66/0xe0 do_syscall_64+0x55/0x1c0 entry_SYSCALL_64_after_hwframe+0x49/0xbe -> #0 (sb_internal){.+.+}: __sb_start_write+0xf6/0x150 start_transaction+0x3a8/0x500 btrfs_commit_inode_delayed_inode+0x59/0x110 btrfs_evict_inode+0x19e/0x4c0 evict+0xbc/0x1f0 inode_lru_isolate+0x113/0x190 __list_lru_walk_one.isra.4+0x5c/0x100 list_lru_walk_one+0x32/0x50 prune_icache_sb+0x36/0x80 super_cache_scan+0x14a/0x1d0 do_shrink_slab+0x131/0x320 shrink_node+0xf7/0x380 balance_pgdat+0x2d5/0x640 kswapd+0x2ba/0x5e0 kthread+0x147/0x160 ret_from_fork+0x24/0x30 other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(fs_reclaim); lock(sb_internal); lock(fs_reclaim); lock(sb_internal); *** DEADLOCK *** 3 locks held by kswapd0/711: #0: 000000000ba86300 (fs_reclaim){+.+.}, at: __fs_reclaim_acquire+0x0/0x30 #1: 000000004a5100f8 (shrinker_rwsem){++++}, at: shrink_node+0x9a/0x380 #2: 00000000f956fa46 (&type->s_umount_key#30){++++}, at: super_cache_scan+0x35/0x1d0 stack backtrace: CPU: 7 PID: 711 Comm: kswapd0 Not tainted 5.2.11-gentoo #2 Hardware name: Dell Inc. Precision Tower 3620/0MWYPT, BIOS 2.4.2 09/29/2017 Call Trace: dump_stack+0x85/0xc7 print_circular_bug.cold.40+0x1d9/0x235 __lock_acquire+0x18b1/0x1f00 lock_acquire+0xa6/0x170 ? start_transaction+0x3a8/0x500 __sb_start_write+0xf6/0x150 ? start_transaction+0x3a8/0x500 start_transaction+0x3a8/0x500 btrfs_commit_inode_delayed_inode+0x59/0x110 btrfs_evict_inode+0x19e/0x4c0 ? var_wake_function+0x20/0x20 evict+0xbc/0x1f0 inode_lru_isolate+0x113/0x190 ? discard_new_inode+0xc0/0xc0 __list_lru_walk_one.isra.4+0x5c/0x100 ? discard_new_inode+0xc0/0xc0 list_lru_walk_one+0x32/0x50 prune_icache_sb+0x36/0x80 super_cache_scan+0x14a/0x1d0 do_shrink_slab+0x131/0x320 shrink_node+0xf7/0x380 balance_pgdat+0x2d5/0x640 kswapd+0x2ba/0x5e0 ? __wake_up_common_lock+0x90/0x90 kthread+0x147/0x160 ? balance_pgdat+0x640/0x640 ? __kthread_create_on_node+0x160/0x160 ret_from_fork+0x24/0x30 This is because btrfs_new_inode() calls new_inode() under the transaction. We could probably move the new_inode() outside of this but for now just wrap it in memalloc_nofs_save(). Reported-by: Zdenek Sojka <zsojka@seznam.cz> Fixes: 712e36c5f2a7 ("btrfs: use GFP_KERNEL in btrfs_alloc_inode") CC: stable@vger.kernel.org # 4.16+ Reviewed-by: Filipe Manana <fdmanana@suse.com> Signed-off-by: Josef Bacik <josef@toxicpanda.com> Reviewed-by: David Sterba <dsterba@suse.com> Signed-off-by: David Sterba <dsterba@suse.com>

view details

Nishad Kamdar

commit sha 6184488a19be96d89cb6c36fb4bc277198309484

x86: Use the correct SPDX License Identifier in headers Correct the SPDX License Identifier format in a couple of headers. Suggested-by: Joe Perches <joe@perches.com> Signed-off-by: Nishad Kamdar <nishadkamdar@gmail.com> Signed-off-by: Borislav Petkov <bp@suse.de> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: "H. Peter Anvin" <hpa@zytor.com> Cc: Ingo Molnar <mingo@redhat.com> Cc: Sean Christopherson <sean.j.christopherson@intel.com> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Cc: Waiman Long <longman@redhat.com> Cc: x86-ml <x86@kernel.org> Link: https://lkml.kernel.org/r/697848ff866ade29e78e872525d7a3067642fd37.1555427420.git.nishadkamdar@gmail.com

view details

Dexuan Cui

commit sha 6a297c90efa68b2864483193b8bfb0d19478600c

HID: hyperv: Use in-place iterator API in the channel callback Simplify the ring buffer handling with the in-place API. Also avoid the dynamic allocation and the memory leak in the channel callback function. Signed-off-by: Dexuan Cui <decui@microsoft.com> Acked-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Sasha Levin <sashal@kernel.org>

view details

Dexuan Cui

commit sha 83b50f83a96899f30c6369ef5988412fa2354ab2

Drivers: hv: vmbus: Fix harmless building warnings without CONFIG_PM_SLEEP If CONFIG_PM_SLEEP is not set, we can comment out these functions to avoid the below warnings: drivers/hv/vmbus_drv.c:2208:12: warning: ‘vmbus_bus_resume’ defined but not used [-Wunused-function] drivers/hv/vmbus_drv.c:2128:12: warning: ‘vmbus_bus_suspend’ defined but not used [-Wunused-function] drivers/hv/vmbus_drv.c:937:12: warning: ‘vmbus_resume’ defined but not used [-Wunused-function] drivers/hv/vmbus_drv.c:918:12: warning: ‘vmbus_suspend’ defined but not used [-Wunused-function] Fixes: 271b2224d42f ("Drivers: hv: vmbus: Implement suspend/resume for VSC drivers for hibernation") Fixes: f53335e3289f ("Drivers: hv: vmbus: Suspend/resume the vmbus itself for hibernation") Reported-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Dexuan Cui <decui@microsoft.com> Reviewed-by: Michael Kelley <mikelley@microsoft.com> Signed-off-by: Sasha Levin <sashal@kernel.org>

view details

Brian Vazquez

commit sha 86c1aea84b97120a6d428ce17a2ebd55be677f56

selftests/bpf: test_progs: Don't leak server_fd in tcp_rtt server_fd needs to be closed if pthread can't be created. Fixes: 8a03222f508b ("selftests/bpf: test_progs: fix client/server race in tcp_rtt") Signed-off-by: Brian Vazquez <brianvv@google.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Reviewed-by: Stanislav Fomichev <sdf@google.com> Link: https://lore.kernel.org/bpf/20191001173728.149786-2-brianvv@google.com

view details

Brian Vazquez

commit sha a2d074e4c6e81ec9ab359d54f0b88273c738de37

selftests/bpf: test_progs: Don't leak server_fd in test_sockopt_inherit server_fd needs to be closed if pthread can't be created. Fixes: e3e02e1d9c24 ("selftests/bpf: test_progs: convert test_sockopt_inherit") Signed-off-by: Brian Vazquez <brianvv@google.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Reviewed-by: Stanislav Fomichev <sdf@google.com> Link: https://lore.kernel.org/bpf/20191001173728.149786-3-brianvv@google.com

view details

Stanislaw Gruszka

commit sha c91a9cfe9f6d136172a52ff6e01b3f83ba850c19

rt2x00: initialize last_reset Initialize last_reset variable to INITIAL_JIFFIES, otherwise it is not possible to test H/W reset for first 5 minutes of system run. Fixes: e403fa31ed71 ("rt2x00: add restart hw") Reported-and-tested-by: Jonathan Liu <net147@gmail.com> Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

view details

Nayna Jain

commit sha 82af5b6609673f1cc7d3453d0be3d292dfffc813

sysfs: Fixes __BIN_ATTR_WO() macro This patch fixes the size and write parameter for the macro __BIN_ATTR_WO(). Fixes: 7f905761e15a8 ("sysfs: add BIN_ATTR_WO() macro") Signed-off-by: Nayna Jain <nayna@linux.ibm.com> Link: https://lore.kernel.org/r/1569973038-2710-1-git-send-email-nayna@linux.ibm.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

view details

Beni Mahler

commit sha 357f16d9e0194cdbc36531ff88b453481560b76a

USB: serial: ftdi_sio: add device IDs for Sienna and Echelon PL-20 Both devices added here have a FTDI chip inside. The device from Echelon is called 'Network Interface' it is actually a LON network gateway. ID 0403:8348 Future Technology Devices International, Ltd https://www.eltako.com/fileadmin/downloads/de/datenblatt/Datenblatt_PL-SW-PROF.pdf ID 0920:7500 Network Interface https://www.echelon.com/products/u20-usb-network-interface Signed-off-by: Beni Mahler <beni.mahler@gmx.net> Cc: stable <stable@vger.kernel.org> Signed-off-by: Johan Hovold <johan@kernel.org>

view details

Daniele Palmas

commit sha 5eb3f4b87a0e7e949c976f32f296176a06d1a93b

USB: serial: option: add Telit FN980 compositions This patch adds the following Telit FN980 compositions: 0x1050: tty, adb, rmnet, tty, tty, tty, tty 0x1051: tty, adb, mbim, tty, tty, tty, tty 0x1052: rndis, tty, adb, tty, tty, tty, tty 0x1053: tty, adb, ecm, tty, tty, tty, tty Signed-off-by: Daniele Palmas <dnlplm@gmail.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Johan Hovold <johan@kernel.org>

view details

Stuart Henderson

commit sha 3ae7359c0e39f42a96284d6798fc669acff38140

ASoC: wm_adsp: Don't generate kcontrols without READ flags User space always expects to be able to read ALSA controls, so ensure no kcontrols are generated without an appropriate READ flag. In the case of a read of such a control zeros will be returned. Signed-off-by: Stuart Henderson <stuarth@opensource.cirrus.com> Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com> Link: https://lore.kernel.org/r/20191002084240.21589-1-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown <broonie@kernel.org>

view details

ZhangXiaoxu

commit sha 33ea5aaa87cdae0f9af4d6b7ee4f650a1a36fd1d

nfs: Fix nfsi->nrequests count error on nfs_inode_remove_request When xfstests testing, there are some WARNING as below: WARNING: CPU: 0 PID: 6235 at fs/nfs/inode.c:122 nfs_clear_inode+0x9c/0xd8 Modules linked in: CPU: 0 PID: 6235 Comm: umount.nfs Hardware name: linux,dummy-virt (DT) pstate: 60000005 (nZCv daif -PAN -UAO) pc : nfs_clear_inode+0x9c/0xd8 lr : nfs_evict_inode+0x60/0x78 sp : fffffc000f68fc00 x29: fffffc000f68fc00 x28: fffffe00c53155c0 x27: fffffe00c5315000 x26: fffffc0009a63748 x25: fffffc000f68fd18 x24: fffffc000bfaaf40 x23: fffffc000936d3c0 x22: fffffe00c4ff5e20 x21: fffffc000bfaaf40 x20: fffffe00c4ff5d10 x19: fffffc000c056000 x18: 000000000000003c x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000040 x14: 0000000000000228 x13: fffffc000c3a2000 x12: 0000000000000045 x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000 x8 : 0000000000000000 x7 : 0000000000000000 x6 : fffffc00084b027c x5 : fffffc0009a64000 x4 : fffffe00c0e77400 x3 : fffffc000c0563a8 x2 : fffffffffffffffb x1 : 000000000000764e x0 : 0000000000000001 Call trace: nfs_clear_inode+0x9c/0xd8 nfs_evict_inode+0x60/0x78 evict+0x108/0x380 dispose_list+0x70/0xa0 evict_inodes+0x194/0x210 generic_shutdown_super+0xb0/0x220 nfs_kill_super+0x40/0x88 deactivate_locked_super+0xb4/0x120 deactivate_super+0x144/0x160 cleanup_mnt+0x98/0x148 __cleanup_mnt+0x38/0x50 task_work_run+0x114/0x160 do_notify_resume+0x2f8/0x308 work_pending+0x8/0x14 The nrequest should be increased/decreased only if PG_INODE_REF flag was setted. But in the nfs_inode_remove_request function, it maybe decrease when no PG_INODE_REF flag, this maybe lead nrequests count error. Reported-by: Hulk Robot <hulkci@huawei.com> Signed-off-by: ZhangXiaoxu <zhangxiaoxu5@huawei.com> Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>

view details

amy.shih

commit sha 539ad001d1557731cb38d4a9d0e8e16244b2d913

hwmon: (nct7904) Fix the incorrect value of vsen_mask in nct7904_data struct Voltage sensors overlap with external temperature sensors. Detect the multi-function of voltage, thermal diode and thermistor from register VT_ADC_MD_REG to set value of vsen_mask in nct7904_data struct. Signed-off-by: amy.shih <amy.shih@advantech.com.tw> Link: https://lore.kernel.org/r/20190918084801.9859-1-Amy.Shih@advantech.com.tw Signed-off-by: Guenter Roeck <linux@roeck-us.net>

view details

Lukas Zapletal

commit sha 43fd0cf4c6dcd5a0e383e60168428bda0bc56374

hwmon: (k10temp) Update documentation and add temp2_input info It's been a while since the k10temp documentation has been updated. There are new CPU families supported as well as Tdie temp was added. This patch adds all missing families which I was able to find from git history and provides more info about Tctl vs Tdie exported temps. Signed-off-by: Lukas Zapletal <lzap+git@redhat.com> Link: https://lore.kernel.org/r/20190923105931.27881-1-lzap+git@redhat.com [groeck: Formatting] Signed-off-by: Guenter Roeck <linux@roeck-us.net>

view details

Nuno Sá

commit sha 30945d31e5761436d9eba6b8cff468a5f7c9c266

hwmon: Fix HWMON_P_MIN_ALARM mask Both HWMON_P_MIN_ALARM and HWMON_P_MAX_ALARM were using BIT(hwmon_power_max_alarm). Fixes: aa7f29b07c870 ("hwmon: Add support for power min, lcrit, min_alarm and lcrit_alarm") CC: <stable@vger.kernel.org> Signed-off-by: Nuno Sá <nuno.sa@analog.com> Link: https://lore.kernel.org/r/20190924124945.491326-2-nuno.sa@analog.com Signed-off-by: Guenter Roeck <linux@roeck-us.net>

view details

push time in 14 days

create barnchrhvgoyal/linux

branch : fix-bg-lock

created branch time in a month

create barnchrhvgoyal/linux

branch : mod-name-virtiofs

created branch time in a month

push eventrhvgoyal/linux

Marc Zyngier

commit sha b6749e20d5710c955fc6d4322f8fd98c915b2573

arm64: KVM: Drop hyp_alternate_select for checking for ARM64_WORKAROUND_834220 There is no reason for using hyp_alternate_select when checking for ARM64_WORKAROUND_834220, as each of the capabilities is also backed by a static key. Just replace the KVM-specific construct with cpus_have_const_cap(ARM64_WORKAROUND_834220). Signed-off-by: Marc Zyngier <maz@kernel.org> Reviewed-by: Christoffer Dall <christoffer.dall@arm.com> Reviewed-by: Andrew Jones <drjones@redhat.com>

view details

Marc Zyngier

commit sha aa979fa899c5cf592e63ce7b34bc767224225c6a

arm64: KVM: Replace hyp_alternate_select with has_vhe() Given that the TLB invalidation path is pretty rarely used, there was never any advantage to using hyp_alternate_select() here. has_vhe(), being a glorified static key, is the right tool for the job. Off you go. Signed-off-by: Marc Zyngier <maz@kernel.org> Reviewed-by: Christoffer Dall <christoffer.dall@arm.com> Reviewed-by: Andrew Jones <drjones@redhat.com>

view details

Marc Zyngier

commit sha 084b5a80e87258997632dbd975ec3e5fda6bb943

arm64: KVM: Kill hyp_alternate_select() hyp_alternate_select() is now completely unused. Goodbye. Signed-off-by: Marc Zyngier <maz@kernel.org> Reviewed-by: Christoffer Dall <christoffer.dall@arm.com> Reviewed-by: Andrew Jones <drjones@redhat.com>

view details

Zenghui Yu

commit sha aac60f1a867773de9eb164013d89c99f3ea1f009

KVM: arm/arm64: vgic: Use the appropriate TRACE_INCLUDE_PATH Commit 49dfe94fe5ad ("KVM: arm/arm64: Fix TRACE_INCLUDE_PATH") fixes TRACE_INCLUDE_PATH to the correct relative path to the define_trace.h and explains why did the old one work. The same fix should be applied to virt/kvm/arm/vgic/trace.h. Reviewed-by: Masahiro Yamada <yamada.masahiro@socionext.com> Signed-off-by: Zenghui Yu <yuzenghui@huawei.com> Signed-off-by: Marc Zyngier <maz@kernel.org>

view details

Johan Hovold

commit sha 7fd25e6fc035f4b04b75bca6d7e8daa069603a76

ieee802154: atusb: fix use-after-free at disconnect The disconnect callback was accessing the hardware-descriptor private data after having having freed it. Fixes: 7490b008d123 ("ieee802154: add support for atusb transceiver") Cc: stable <stable@vger.kernel.org> # 4.2 Cc: Alexander Aring <alex.aring@gmail.com> Reported-by: syzbot+f4509a9138a1472e7e80@syzkaller.appspotmail.com Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>

view details

Lowry Li (Arm Technology China)

commit sha 8581d51055a08cc6eb061c8856062290e8582ce4

drm: Free the writeback_job when it with an empty fb Adds the check if the writeback_job with an empty fb, then it should be freed in atomic_check phase. With this change, the driver users will not check empty fb case any more. So refined accordingly. Signed-off-by: Lowry Li (Arm Technology China) <lowry.li@arm.com> Reviewed-by: Liviu Dudau <liviu.dudau@arm.com> Reviewed-by: James Qian Wang (Arm Technology China) <james.qian.wang@arm.com> Signed-off-by: james qian wang (Arm Technology China) <james.qian.wang@arm.com> Link: https://patchwork.freedesktop.org/patch/msgid/1564571048-15029-2-git-send-email-lowry.li@arm.com

view details

Lowry Li (Arm Technology China)

commit sha b1066a123538044117f0a78ba8c6a50cf5a04c86

drm: Clear the fence pointer when writeback job signaled During it signals the completion of a writeback job, after releasing the out_fence, we'd clear the pointer. Check if fence left over in drm_writeback_cleanup_job(), release it. Signed-off-by: Lowry Li (Arm Technology China) <lowry.li@arm.com> Reviewed-by: Brian Starkey <brian.starkey@arm.com> Reviewed-by: James Qian Wang (Arm Technology China) <james.qian.wang@arm.com> Signed-off-by: james qian wang (Arm Technology China) <james.qian.wang@arm.com> Link: https://patchwork.freedesktop.org/patch/msgid/1564571048-15029-3-git-send-email-lowry.li@arm.com

view details

Tony Lindgren

commit sha dd8882a255388ba66175098b1560d4f81c100d30

clk: ti: dra7: Fix mcasp8 clock bits There's a typo for dra7 mcasp clkctrl bit, it should be 22 like the other macasp instances, and not 24. And in dra7xx_clks[] we have the bits wrong way around. Fixes: dffa9051d546 ("clk: ti: dra7: add new clkctrl data") Cc: linux-clk@vger.kernel.org Cc: Michael Turquette <mturquette@baylibre.com> Cc: Stephen Boyd <sboyd@kernel.org> Cc: Suman Anna <s-anna@ti.com> Cc: Tero Kristo <t-kristo@ti.com> Acked-by: Stephen Boyd <sboyd@kernel.org> Signed-off-by: Tony Lindgren <tony@atomide.com>

view details

Tony Lindgren

commit sha 2d3c8ba3cffa00f76bedb713c8c2126c82d8cd13

ARM: dts: Fix wrong clocks for dra7 mcasp The ahclkr clkctrl clock bit 28 only exists for mcasp 1 and 2 on dra7. This causes the following warning on beagle-x15: ti-sysc 48468000.target-module: could not add child clock ahclkr: -19 Also the mcasp clkctrl clock bits are wrong: For mcasp1 and 2 we have four clocks at bits 28, 24, 22 and 0: bit 28 is ahclkr bit 24 is ahclkx bit 22 is auxclk bit 0 is fck For mcasp3 to 8 we have three clocks at bits 24, 22 and 0. bit 24 is ahclkx bit 22 is auxclk bit 0 is fck We do not have currently mapped auxclk at bit 22 for the drivers, that can be added if needed. Fixes: 5241ccbf2819 ("ARM: dts: Add missing ranges for dra7 mcasp l3 ports") Cc: Suman Anna <s-anna@ti.com> Cc: Tero Kristo <t-kristo@ti.com> Signed-off-by: Tony Lindgren <tony@atomide.com>

view details

H. Nikolaus Schaller

commit sha f1f028ff89cb0d37db299d48e7b2ce19be040d52

DTS: ARM: gta04: introduce legacy spi-cs-high to make display work again commit 6953c57ab172 "gpio: of: Handle SPI chipselect legacy bindings" did introduce logic to centrally handle the legacy spi-cs-high property in combination with cs-gpios. This assumes that the polarity of the CS has to be inverted if spi-cs-high is missing, even and especially if non-legacy GPIO_ACTIVE_HIGH is specified. The DTS for the GTA04 was orginally introduced under the assumption that there is no need for spi-cs-high if the gpio is defined with proper polarity GPIO_ACTIVE_HIGH. This was not a problem until gpiolib changed the interpretation of GPIO_ACTIVE_HIGH and missing spi-cs-high. The effect is that the missing spi-cs-high is now interpreted as CS being low (despite GPIO_ACTIVE_HIGH) which turns off the SPI interface when the panel is to be programmed by the panel driver. Therefore, we have to add the redundant and legacy spi-cs-high property to properly activate CS. Cc: stable@vger.kernel.org Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com> Signed-off-by: Tony Lindgren <tony@atomide.com>

view details

Tony Lindgren

commit sha c01f5120ca7cf2994336c42b8a9cae697121ffb3

Merge branch 'fixes-merge-window-pt2' into fixes

view details

Adam Ford

commit sha 04e0e1777a792223897b8c21eb4e0a5b2624d9df

ARM: omap2plus_defconfig: Enable DRM_TI_TFP410 The TFP410 driver was removed but the replacement driver was never enabled. This patch enableds the DRM_TI_TFP410 Fixes: be3143d8b27f ("drm/omap: Remove TFP410 and DVI connector drivers") Signed-off-by: Adam Ford <aford173@gmail.com> Signed-off-by: Tony Lindgren <tony@atomide.com>

view details

Tony Lindgren

commit sha 1d70ded8567ccf70353ff97e3b13f267c889f934

ARM: omap2plus_defconfig: Enable more droid4 devices as loadable modules Droid4 needs USB option serial driver for modem, and lm3532 for the LCD backlight. Note that the LCD backlight does not yet get enabled automatically, but needs to be done manually with: # echo 50 > /sys/class/leds/lm3532::backlight/brightness Signed-off-by: Tony Lindgren <tony@atomide.com>

view details

John Pittman

commit sha 0ec64895b05269c1814ea5befcadcd1184a12915

nvmet: change ppl to lpp In nvmet_bdev_set_limits() the number of logical blocks per physical block is calculated, but the opposite is mentioned in the associated comment and reflected in the variable name. Correct the comment and adjust the variable name to reflect the calculation done. Signed-off-by: John Pittman <jpittman@redhat.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com> Signed-off-by: Sagi Grimberg <sagi@grimberg.me>

view details

Balbir Singh

commit sha b224726de5e496dbf78147a66755c3d81e28bdd2

nvme-pci: Fix a race in controller removal User space programs like udevd may try to read to partitions at the same time the driver detects a namespace is unusable, and may deadlock if revalidate_disk() is called while such a process is waiting to enter the frozen queue. On detecting a dead namespace, move the disk revalidate after unblocking dispatchers that may be holding bd_butex. changelog Suggested-by: Keith Busch <kbusch@kernel.org> Signed-off-by: Balbir Singh <sblbir@amzn.com> Reviewed-by: Keith Busch <kbusch@kernel.org> Signed-off-by: Sagi Grimberg <sagi@grimberg.me>

view details

Laurence Oberman

commit sha c9c53749375ccce0191f89b86732e642f914bd82

scsi: bnx2fc: Handle scope bits when array returns BUSY or TSF The qla2xxx driver had this issue as well when the newer array firmware returned the retry_delay_timer in the fcp_rsp. The bnx2fc is not handling the masking of the scope bits either so the retry_delay_timestamp value lands up being a large value added to the timer timestamp delaying I/O for up to 27 Minutes. This patch adds similar code to handle this to the bnx2fc driver to avoid the huge delay. Link: https://lore.kernel.org/r/1568210202-12794-1-git-send-email-loberman@redhat.com Signed-off-by: Laurence Oberman <loberman@redhat.com> Reported-by: David Jeffery <djeffery@redhat.com> Reported-by: kbuild test robot <lkp@intel.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

view details

Stanley Chu

commit sha f51913eef23f74c3bd07899dc7f1ed6df9e521d8

scsi: ufs: skip shutdown if hba is not powered In some cases, hba may go through shutdown flow without successful initialization and then make system hang. For example, if ufshcd_change_power_mode() gets error and leads to ufshcd_hba_exit() to release resources of the host, future shutdown flow may hang the system since the host register will be accessed in unpowered state. To solve this issue, simply add checking to skip shutdown for above kind of situation. Link: https://lore.kernel.org/r/1568780438-28753-1-git-send-email-stanley.chu@mediatek.com Signed-off-by: Stanley Chu <stanley.chu@mediatek.com> Acked-by: Bean Huo <beanhuo@micron.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

view details

Austin Kim

commit sha 4b062e7cf940aa4f38fedc3a964b24cb095373f0

scsi: qedf: Remove always false 'tmp_prio < 0' statement Since tmp_prio is declared as u8, the following statement is always false. tmp_prio < 0 So remove 'always false' statement. Link: https://lore.kernel.org/r/20190919075548.GA112801@LGEARND20B15 Signed-off-by: Austin Kim <austindh.kim@gmail.com> Acked-by: Saurav Kashyap <skashyap@marvell.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

view details

Long Li

commit sha 0ed8810276907c8a633dc8cecc48dabb6678cd23

scsi: storvsc: setup 1:1 mapping between hardware queue and CPU queue storvsc doesn't use a dedicated hardware queue for a given CPU queue. When issuing I/O, it selects returning CPU (hardware queue) dynamically based on vmbus channel usage across all channels. This patch advertises num_present_cpus() as number of hardware queues. This will have upper layer setup 1:1 mapping between hardware queue and CPU queue and avoid unnecessary locking when issuing I/O. Link: https://lore.kernel.org/r/1567790660-48142-1-git-send-email-longli@linuxonhyperv.com Signed-off-by: Long Li <longli@microsoft.com> Reviewed-by: Michael Kelley <mikelley@microsoft.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

view details

Xiang Chen

commit sha 70054aa39a013fa52eff432f2223b8bd5c0048f8

scsi: megaraid: disable device when probe failed after enabled device For pci device, need to disable device when probe failed after enabled device. Link: https://lore.kernel.org/r/1567818450-173315-1-git-send-email-chenxiang66@hisilicon.com Signed-off-by: Xiang Chen <chenxiang66@hisilicon.com> Reviewed-by: John Garry <john.garry@huawei.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

view details

push time in a month

create barnchrhvgoyal/linux

branch : vivek

created branch time in a month

push eventrhvgoyal/linux

Randy Dunlap

commit sha 6a090e97972dc7bb6f2661eda3eabd8ae21e9b6d

arch/microblaze: support get_user() of size 8 bytes arch/microblaze/ is missing support for get_user() of size 8 bytes, so add it by using __copy_from_user(). While there, also drop a lot of the code duplication. Fixes these build errors: drivers/infiniband/core/uverbs_main.o: In function `ib_uverbs_write': drivers/infiniband/core/.tmp_gl_uverbs_main.o:(.text+0x13a4): undefined reference to `__user_bad' drivers/android/binder.o: In function `binder_thread_write': drivers/android/.tmp_gl_binder.o:(.text+0xda6c): undefined reference to `__user_bad' drivers/android/.tmp_gl_binder.o:(.text+0xda98): undefined reference to `__user_bad' drivers/android/.tmp_gl_binder.o:(.text+0xdf10): undefined reference to `__user_bad' drivers/android/.tmp_gl_binder.o:(.text+0xe498): undefined reference to `__user_bad' drivers/android/binder.o:drivers/android/.tmp_gl_binder.o:(.text+0xea78): more undefined references to `__user_bad' follow 'make allmodconfig' now builds successfully for arch/microblaze/. Fixes: 538722ca3b76 ("microblaze: fix get_user/put_user side-effects") Reported-by: kbuild test robot <lkp@intel.com> Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Acked-by: Linus Torvalds <torvalds@linux-foundation.org> Cc: Al Viro <viro@zeniv.linux.org.uk> Cc: Steven J. Magnani <steve@digidescorp.com> Cc: Michal Simek <monstr@monstr.eu> Cc: Jason Gunthorpe <jgg@mellanox.com> Cc: Leon Romanovsky <leonro@mellanox.com> Cc: Andrew Morton <akpm@linux-foundation.org> Cc: Doug Ledford <dledford@redhat.com> Signed-off-by: Michal Simek <michal.simek@xilinx.com>

view details

Michal Simek

commit sha 6be76fd94ba31dae3f62e77d687614ddb75d6b3a

microblaze: Enable Xilinx AXI emac driver by default Enable Xilinx AXI emac ethernet driver for Microblaze. Signed-off-by: Michal Simek <michal.simek@xilinx.com>

view details

Michal Simek

commit sha 1c62ed908363e249f3b0e1879d9d982e8431fb3f

microblaze: defconfig synchronization Kconfig structure has changed that's why make sense to do synchronization. Signed-off-by: Michal Simek <michal.simek@xilinx.com>

view details

Daniel Vetter

commit sha e0f32f78e51b9989ee89f608fd0dd10e9c230652

drm/kms: Duct-tape for mode object lifetime checks commit 4f5368b5541a902f6596558b05f5c21a9770dd32 Author: Daniel Vetter <daniel.vetter@ffwll.ch> Date: Fri Jun 14 08:17:23 2019 +0200 drm/kms: Catch mode_object lifetime errors uncovered a bit a mess in dp drivers. Most drivers (from a quick look, all except i915) register all the dp stuff in their init code, which is too early. With CONFIG_DRM_DP_AUX_CHARDEV this will blow up, because drm_dp_aux_register tries to add a child to a device in sysfs (the connector) which doesn't even exist yet. No one seems to have cared thus far. But with the above change I also moved the setting of dev->registered after the ->load callback, in an attempt to keep old drivers from hitting any WARN_ON backtraces. But that moved radeon.ko from the "working, by accident" to "now also broken" category. Since this is a huge mess I figured a revert would be simplest. But this check has already caught issues in i915: commit 1b9bd09630d4db4827cc04d358a41a16a6bc2cb0 Author: Ville Syrjälä <ville.syrjala@linux.intel.com> Date: Tue Aug 20 19:16:57 2019 +0300 drm/i915: Do not create a new max_bpc prop for MST connectors Hence I'd like to retain it. Fix the radeon regression by moving the setting of dev->registered back to were it was, and stop the backtraces with an explicit check for dev->driver->load. Everyone else will stay as broken with CONFIG_DRM_DP_AUX_CHARDEV. The next patch will improve the kerneldoc and add a todo entry for this. Fixes: 4f5368b5541a ("drm/kms: Catch mode_object lifetime errors") Cc: Sean Paul <sean@poorly.run> Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Reported-by: Michel Dänzer <michel@daenzer.net> Reviewed-by: Michel Dänzer <mdaenzer@redhat.com> Tested-by: Michel Dänzer <mdaenzer@redhat.com> Cc: Michel Dänzer <michel@daenzer.net> Signed-off-by: Daniel Vetter <daniel.vetter@intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20190917120936.7501-1-daniel.vetter@ffwll.ch

view details

Gregory CLEMENT

commit sha 0dce49efc70536a8c3b4bb5354a71b727ba31b80

ASoC: atmel_ssc_dai: Remove wrong spinlock usage A potential bug was reported in the email "[BUG] atmel_ssc_dai: a possible sleep-in-atomic bug in atmel_ssc_shutdown"[1] Indeed in the function atmel_ssc_shutdown() free_irq() was called in a critical section protected by spinlock. However this spinlock is only used in atmel_ssc_shutdown() and atmel_ssc_startup() functions. After further analysis, it occurred that the call to these function are already protected by mutex used on the calling functions. Then we can remove the spinlock which will fix this bug as a side effect. Thanks to this patch the following message disappears: "BUG: sleeping function called from invalid context at kernel/locking/mutex.c:909" [1]: https://www.spinics.net/lists/alsa-devel/msg71286.html Reviewed-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com> Link: https://lore.kernel.org/r/20190918100344.23629-1-gregory.clement@bootlin.com Signed-off-by: Mark Brown <broonie@kernel.org>

view details

Jeremy Cline

commit sha 799c85105233514309b201a2d2d7a7934458c999

arm64: Fix reference to docs for ARM64_TAGGED_ADDR_ABI The referenced file does not exist, but tagged-address-abi.rst does. Signed-off-by: Jeremy Cline <jcline@redhat.com> Signed-off-by: Will Deacon <will@kernel.org>

view details

Qian Cai

commit sha 42fd8baab31f53bed2952485fcf0e92f244c5e55

sched/core: Convert vcpu_is_preempted() from macro to an inline function Clang reports this warning: kernel/locking/osq_lock.c:25:19: warning: unused function 'node_cpu' [-Wunused-function] due to osq_lock() calling vcpu_is_preempted(node_cpu(node->prev))), but vcpu_is_preempted() is compiled away. Fix it by converting the dummy vcpu_is_preempted() from a macro to a proper static inline function. Signed-off-by: Qian Cai <cai@lca.pw> Acked-by: Mel Gorman <mgorman@suse.de> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: bsegall@google.com Cc: dietmar.eggemann@arm.com Cc: juri.lelli@redhat.com Cc: rostedt@goodmis.org Cc: vincent.guittot@linaro.org Link: https://lkml.kernel.org/r/1568730894-10483-1-git-send-email-cai@lca.pw Signed-off-by: Ingo Molnar <mingo@kernel.org>

view details

Sudeep Holla

commit sha 11ed5cf064beac3ca345bb75fdf2429e03ac106a

firmware: arm_scmi: reset: fix reset_state assignment in scmi_domain_reset Fix the copy paste typo that incorrectly assigns domain_id with the passed 'state' parameter instead of reset_state. Fixes: 95a15d80aa0d ("firmware: arm_scmi: Add RESET protocol in SCMI v2.0") Reported-by: Etienne Carriere <etienne.carriere@linaro.org> Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>

view details

Sudeep Holla

commit sha 61423712dbb86e02af4aa5de65b9041493c92cac

reset: reset-scmi: add missing handle initialisation scmi_reset_data->handle needs to be initialised at probe, so that it can be later used to access scmi reset protocol APIs using the same. Since it was tested with a module that obtained handle elsewhere, it was missed easily. Add the missing scmi_reset_data->handle initialisation to fix the issue. Fixes: c8ae9c2da1cc ("reset: Add support for resets provided by SCMI") Acked-by: Philipp Zabel <p.zabel@pengutronix.de> Reported-by: Etienne Carriere <etienne.carriere@linaro.org> Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>

view details

Stefan Hajnoczi

commit sha 2d1d25d0a224dcd2021004d52342fc1727ccd85f

virtio-fs: add Documentation/filesystems/virtiofs.rst Add information about the new "virtiofs" file system. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>

view details

Alex Deucher

commit sha e16a7cbced7110866dcde84e504909ea85099bbd

drm/amdgpu: flag navi12 and 14 as experimental for 5.4 We can remove this later as things get closer to launch. Reviewed-by: Xiaojie Yuan <xiaojie.yuan@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

view details

Matt Delco

commit sha b60fe990c6b07ef6d4df67bc0530c7c90a62623a

KVM: coalesced_mmio: add bounds checking The first/last indexes are typically shared with a user app. The app can change the 'last' index that the kernel uses to store the next result. This change sanity checks the index before using it for writing to a potentially arbitrary address. This fixes CVE-2019-14821. Cc: stable@vger.kernel.org Fixes: 5f94c1741bdc ("KVM: Add coalesced MMIO support (common part)") Signed-off-by: Matt Delco <delco@chromium.org> Signed-off-by: Jim Mattson <jmattson@google.com> Reported-by: syzbot+983c866c3dd6efa3662a@syzkaller.appspotmail.com [Use READ_ONCE. - Paolo] Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

view details

Joshua Clayton

commit sha 337c22ab1d4f316f37e7a7c78bdea3d768270542

HID: core: reformat and reduce hid_printk macros Reformat hid_printk macros to use standard __VA_ARGS__ syntax. Per Joe Perches hid_printk(), hid_emerg(), hid_crit(), and hid_alert() are unlikely ever to be used. Remove them. Signed-off-by: Joshua Clayton <stillcompiling@gmail.com> Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>

view details

Joshua Clayton

commit sha aaeabb121a6271775cef35ec3197e9ef124fdb2a

HID: core: Add printk_once variants to hid_warn() etc hid_warn_once() is needed. Add the others as part of the block. Signed-off-by: Joshua Clayton <stillcompiling@gmail.com> Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>

view details

Joshua Clayton

commit sha 0af10eed9b7308187c7865024248b2a2a5aa382a

HID: core: fix dmesg flooding if report field larger than 32bit Only warn once of oversize hid report value field On HP spectre x360 convertible the message: hid-sensor-hub 001F:8087:0AC2.0002: hid_field_extract() called with n (192) > 32! (kworker/1:2) is continually printed many times per second, crowding out all else. Protect dmesg by printing the warning only one time. The size of the hid report field data structure should probably be increased. The data structure is treated as a u32 in Linux, but an unlimited number of bits in the USB hid spec, so there is some rearchitecture needed now that devices are sending more than 32 bits. Signed-off-by: Joshua Clayton <stillcompiling@gmail.com> Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>

view details

Theodore Ts'o

commit sha 040823b5372b445d1d9483811e85a24d71314d33

Merge tag 'unicode-next-v5.4' of https://git.kernel.org/pub/scm/linux/kernel/git/krisman/unicode into dev fs/unicode patches for 5.4-rc1 This includes two fixes for the unicode system for inclusion into Linux v5.4. - A patch from Krzysztof Wilczynski solving a build time warning. - A patch from Colin King making a parsing format static, to reduce stack size. Build validated and run time tested using xfstests casefold testcase. Signed-off-by: Gabriel Krisman Bertazi <krisman@collabora.com>

view details

Linus Torvalds

commit sha 404e634fdb96a3c99c7517353bfafbd88e04ab41

Merge tag 'for-linus-urgent' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull KVM fix from Paolo Bonzini: "Fix missing bounds-checking in coalesced_mmio (CVE-2019-14821)" * tag 'for-linus-urgent' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: coalesced_mmio: add bounds checking

view details

Daniel Vetter

commit sha 26b1d3b527e7bf3e24b814d617866ac5199ce68d

drm/atomic: Take the atomic toys away from X The -modesetting ddx has a totally broken idea of how atomic works: - doesn't disable old connectors, assuming they get auto-disable like with the legacy setcrtc - assumes ASYNC_FLIP is wired through for the atomic ioctl - not a single call to TEST_ONLY Iow the implementation is a 1:1 translation of legacy ioctls to atomic, which is a) broken b) pointless. We already have bugs in both i915 and amdgpu-DC where this prevents us from enabling neat features. If anyone ever cares about atomic in X we can easily add a new atomic level (req->value == 2) for X to get back the shiny toys. Since these broken versions of -modesetting have been shipping, there's really no other way to get out of this bind. v2: - add an informational dmesg output (Rob, Ajax) - reorder after the DRIVER_ATOMIC check to avoid useless noise (Ilia) - allow req->value > 2 so that X can do another attempt at atomic in the future v3: Go with paranoid, insist that the X should be first (suggested by Rob) Cc: Ilia Mirkin <imirkin@alum.mit.edu> References: https://gitlab.freedesktop.org/xorg/xserver/issues/629 References: https://gitlab.freedesktop.org/xorg/xserver/merge_requests/180 References: abbc0697d5fb ("drm/fb: revert the i915 Actually configure untiled displays from master") Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> (v1) Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com> (v1) Cc: Michel Dänzer <michel@daenzer.net> Cc: Alex Deucher <alexdeucher@gmail.com> Cc: Adam Jackson <ajax@redhat.com> Acked-by: Adam Jackson <ajax@redhat.com> Cc: Sean Paul <sean@poorly.run> Cc: David Airlie <airlied@linux.ie> Cc: Rob Clark <robdclark@gmail.com> Acked-by: Rob Clark <robdclark@gmail.com> Cc: stable@vger.kernel.org Signed-off-by: Daniel Vetter <daniel.vetter@intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20190905185318.31363-1-daniel.vetter@ffwll.ch

view details

Daniel Vetter

commit sha f2cbda2dba11de868759cae9c0d2bab5b8411406

drm/atomic: Reject FLIP_ASYNC unconditionally It's never been wired up. Only userspace that tried to use it (and didn't actually check whether anything works, but hey it builds) is the -modesetting atomic implementation. And we just shut that up. If there's anyone else then we need to silently accept this flag no matter what, and find a new one. Because once a flag is tainted, it's lost. Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com> Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Cc: Michel Dänzer <michel@daenzer.net> Cc: Alex Deucher <alexdeucher@gmail.com> Cc: Adam Jackson <ajax@redhat.com> Cc: Sean Paul <sean@poorly.run> Cc: David Airlie <airlied@linux.ie> Cc: stable@vger.kernel.org Signed-off-by: Daniel Vetter <daniel.vetter@intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20190903190642.32588-2-daniel.vetter@ffwll.ch

view details

Jackie Liu

commit sha 954dab193d19cbbff8f83b58c9360bf00ddb273c

io_uring: use kmemdup instead of kmalloc and memcpy Just clean up the code, no function changes. Signed-off-by: Jackie Liu <liuyun01@kylinos.cn> Signed-off-by: Jens Axboe <axboe@kernel.dk>

view details

push time in a month

create barnchrhvgoyal/linux

branch : fuse-for-next

created branch time in 2 months

push eventrhvgoyal/linux

Vivek Goyal

commit sha 8ce6cbb38b0727201267a19f3fe758e95be8adad

virtiofs: Remove request from processing list before calling end In error path we are calling fuse_request_end() but we need to clear FR_SENT bit as well as remove request from processing queue. Otherwise fuse_request_end() triggers a warning as well as other issues show up. Signed-off-by: Vivek Goyal <vgoyal@redhat.com>

view details

Vivek Goyal

commit sha d5caa145a1f1cdc718a481a2bc5693aa60225e52

virtiofs: Check whether hiprio queue is connected at submission time For hiprio queue (forget requests), we are keeping a state in queue whether queue is connected or not. If queue is not connected, do not try to submit request and return error instead. As of now, we are checking for this state only in path where worker tries to submit forget after first attempt failed. Check this state even in the path when request is being submitted first time. Signed-off-by: Vivek Goyal <vgoyal@redhat.com>

view details

Vivek Goyal

commit sha 5fc339001cbc79feed627ad4009e59564ceed52d

virtiofs: Pass fsvq instead of vq as parameter to virtio_fs_enqueue_req Pass fsvq instead of vq as parameter to virtio_fs_enqueue_req(). We will retrieve vq from fsvq under spin lock. Later in the patch series we will retrieve vq only if fsvq is still connected other vq might have been cleaned up by device ->remove code and we will return error. Signed-off-by: Vivek Goyal <vgoyal@redhat.com>

view details

Vivek Goyal

commit sha 197d63ab585271298821e57ecf0710541f655c5b

virtiofs: Check connected state for VQ_REQUEST queue as well Right now we are checking ->connected state only for VQ_HIPRIO. Now we want to make use of this method for all queues. So check it for VQ_REQUEST as well. This will be helpful if device has been removed and virtqueue is gone. In that case ->connected will be false and request can't be submitted anymore and user space will see error -ENOTCONN. Signed-off-by: Vivek Goyal <vgoyal@redhat.com>

view details

Vivek Goyal

commit sha dde73c1f6a9f3ea4f52d5b85eecaba01ef4a79c1

Maintain count of in flight requests for VQ_REQUEST queue As of now we maintain this count only for VQ_HIPRIO. Maintain it for VQ_REQUEST as well so that later it can be used to drain VQ_REQUEST queue. Signed-off-by: Vivek Goyal <vgoyal@redhat.com>

view details

Vivek Goyal

commit sha 49bf6b4b47bcd38bd579abaa23cf09aeab306dae

virtiofs: ->remove should not clean virtiofs fuse devices We maintain a fuse device per virt queue. This fuse devices are allocated and installed during mount time and should be cleaned up when super block is going away. Device removal should not clean it. Device removal should stop queues and virtuques can go away. Signed-off-by: Vivek Goyal <vgoyal@redhat.com>

view details

Vivek Goyal

commit sha 1d7611dd4c4e8f0552295c2434ff3da1ad6eef40

virtiofs: Stop virtiofs queues when device is being removed Stop all the virt queues when device is going away. This will ensure that no new requests are submitted to virtqueue and and request will end with error -ENOTCONN. Signed-off-by: Vivek Goyal <vgoyal@redhat.com>

view details

Vivek Goyal

commit sha 7c0ef85b6cc54f31786cbb215ff42bebbc680412

virtiofs: Drain all pending requests during ->remove time When device is going away, drain all pending requests. Signed-off-by: Vivek Goyal <vgoyal@redhat.com>

view details

Vivek Goyal

commit sha c92cafbe0d47b3b8cb23244dc004e9373bde2eb1

virtiofs: Add an helper to start all the queues This just marks are the queues are connected and ready to accept the request. Signed-off-by: Vivek Goyal <vgoyal@redhat.com>

view details

Vivek Goyal

commit sha 8c373ca95ac357582733ec5d8ac69ea60a54712e

virtiofs: Do not use device managed mem for virtio_fs and virtio_fs_vq These data structures should go away when virtio_fs object is going away. When deivce is going away, we need to just make sure virtqueues can go away and after that none of the code accesses vq and all the requests get error. So allocate memory for virtio_fs and virtio_fs_vq normally and free it at right time. This patch still frees up memory during device remove time. A later patch will make virtio_fs object reference counted and this memory will be freed when last reference to object is dropped. Signed-off-by: Vivek Goyal <vgoyal@redhat.com>

view details

Vivek Goyal

commit sha 32d813cc0fbe29e341cef86d1cd7c0fdec98035c

virtiofs: stop and drain queues after sending DESTROY During virtio_kill_sb() we first stop forget queue and drain it and then call fuse_kill_sb_anon(). This will result in sending DESTROY request to fuse server. Once finished, stop all the queues and drain one more time just to be sure and then free up the devices. Given drain queues will call flush_work() on various workers, remove this logic from virtio_free_devs(). Signed-off-by: Vivek Goyal <vgoyal@redhat.com>

view details

Vivek Goyal

commit sha e348ce1b14e0fba470ffa62cb9e5e5902d0a9b88

virtiofs: Use virtio_fs_free_devs() in error path We already have an helper to cleanup fuse devices. Use that instead of duplicating the code. Signed-off-by: Vivek Goyal <vgoyal@redhat.com>

view details

Vivek Goyal

commit sha 94d9d781d338637841209f0f6c4fc0900d08315c

virtiofs: Do not access virtqueue in request submission path In request submission path it is possible that virtqueue is already gone due to driver->remove(). So do not access it in dev_dbg(). Use pr_debug() instead. If virtuqueue is gone, this will result in NULL pointer deference. Signed-off-by: Vivek Goyal <vgoyal@redhat.com>

view details

Vivek Goyal

commit sha cc55eadac34cd69e4a9307528239de582efc0dde

virtiofs: Add a fuse_iqueue operation to put() reference Soon I will make virtio_fs object reference counted, where reference will be taken by device as well as by fuse_conn (fuse_conn->fuse_iqueue->fiq_priv). When fuse_connection is going away, it should put its reference on virtio_fs object. So add a fuse_iqueue method which can be used to call into virtio_fs to put the reference on the object (fiq_priv). Signed-off-by: Vivek Goyal <vgoyal@redhat.com>

view details

Vivek Goyal

commit sha 02de34eb5c80106df81b46be87739251157adc66

virtiofs: Make virtio_fs object refcounted This object is used both by fuse_connection as well virt device. So make this object reference counted and that makes it easy to define life cycle of the object. Now deivce can be removed while filesystem is still mounted. This will cleanup all the virtqueues but virtio_fs object will still be around and will be cleaned when filesystem is unmounted and sb/fc drops its reference. Removing a device also stops all virt queues and any new reuqest gets error -ENOTCONN. All existing in flight requests are drained before ->remove returns. Signed-off-by: Vivek Goyal <vgoyal@redhat.com>

view details

Vivek Goyal

commit sha 79bb1cf9f61d99b8c9e31c7d2908d85b3e7e0111

virtiofs: Use virtio_fs_mutex for races w.r.t ->remove and mount path It is possible that a mount is in progress and device is being removed at the same time. Use virtio_fs_mutex to avoid races. This also takes care of bunch of races and removes some TODO items. Signed-off-by: Vivek Goyal <vgoyal@redhat.com>

view details

Vivek Goyal

commit sha 425ee3e56b0b675f3d23317b30691e5b1313bbf9

virtiofs: Remove TODO to quiesce/end_requests We now stop queues and drain all the pending requests from all virtqueues. So this is not a TODO anymore. Got rid of incrementing fc->dev_count as well. It did not seem meaningful for virtio_fs. Signed-off-by: Vivek Goyal <vgoyal@redhat.com>

view details

Vivek Goyal

commit sha a8fec1cc57eb6fae488092c4c2bb42b926402dd3

virtiofs: Remove TODO item from virtio_fs_free_devs() virtio_fs_free_devs() is now called from ->kill_sb(). By this time all device queues have been quiesced. I am assuming that while ->kill_sb() is in progress, another mount instance will wait for it to finish (sb->s_umount mutex provides mutual exclusion). W.r.t ->remove path, we should be fine as we are not touching vdev or virtqueues. And we have reference on virtio_fs object, so we know rest of the data structures are valid. So I can't see the need of any additional locking yet. Signed-off-by: Vivek Goyal <vgoyal@redhat.com>

view details

push time in 2 months

push eventrhvgoyal/linux

Wanpeng Li

commit sha 17e433b54393a6269acbcb792da97791fe1592d8

KVM: Fix leak vCPU's VMCS value into other pCPU After commit d73eb57b80b (KVM: Boost vCPUs that are delivering interrupts), a five years old bug is exposed. Running ebizzy benchmark in three 80 vCPUs VMs on one 80 pCPUs Skylake server, a lot of rcu_sched stall warning splatting in the VMs after stress testing: INFO: rcu_sched detected stalls on CPUs/tasks: { 4 41 57 62 77} (detected by 15, t=60004 jiffies, g=899, c=898, q=15073) Call Trace: flush_tlb_mm_range+0x68/0x140 tlb_flush_mmu.part.75+0x37/0xe0 tlb_finish_mmu+0x55/0x60 zap_page_range+0x142/0x190 SyS_madvise+0x3cd/0x9c0 system_call_fastpath+0x1c/0x21 swait_active() sustains to be true before finish_swait() is called in kvm_vcpu_block(), voluntarily preempted vCPUs are taken into account by kvm_vcpu_on_spin() loop greatly increases the probability condition kvm_arch_vcpu_runnable(vcpu) is checked and can be true, when APICv is enabled the yield-candidate vCPU's VMCS RVI field leaks(by vmx_sync_pir_to_irr()) into spinning-on-a-taken-lock vCPU's current VMCS. This patch fixes it by checking conservatively a subset of events. Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Radim Krčmář <rkrcmar@redhat.com> Cc: Christian Borntraeger <borntraeger@de.ibm.com> Cc: Marc Zyngier <Marc.Zyngier@arm.com> Cc: stable@vger.kernel.org Fixes: 98f4a1467 (KVM: add kvm_arch_vcpu_runnable() test to kvm_vcpu_on_spin() loop) Signed-off-by: Wanpeng Li <wanpengli@tencent.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

view details

Paolo Bonzini

commit sha 741cbbae0768b828be2d48331eb371a4f08bbea8

KVM: remove kvm_arch_has_vcpu_debugfs() There is no need for this function as all arches have to implement kvm_arch_create_vcpu_debugfs() no matter what. A #define symbol let us actually simplify the code. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

view details

Greg KH

commit sha 3e7093d045196b1016517631645e874fe903db7e

KVM: no need to check return value of debugfs_create functions When calling debugfs functions, there is no need to ever check the return value. The function can work or not, but the code logic should never do something different based on this. Also, when doing this, change kvm_arch_create_vcpu_debugfs() to return void instead of an integer, as we should not care at all about if this function actually does anything or not. Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: "Radim Krčmář" <rkrcmar@redhat.com> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Ingo Molnar <mingo@redhat.com> Cc: Borislav Petkov <bp@alien8.de> Cc: "H. Peter Anvin" <hpa@zytor.com> Cc: <x86@kernel.org> Cc: <kvm@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

view details

Paolo Bonzini

commit sha 57b76bdb20ecb05c87f4e12b7ced66bc03a976c3

x86: kvm: remove useless calls to kvm_para_available Most code in arch/x86/kernel/kvm.c is called through x86_hyper_kvm, and thus only runs if KVM has been detected. There is no need to check again for the CPUID base. Cc: Sergio Lopez <slp@redhat.com> Cc: Jan Kiszka <jan.kiszka@siemens.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

view details

Yoshiaki Okamoto

commit sha 7e7ae38bf928c5cfa6dd6e9a2cf8b42c84a27c92

USB: serial: option: Add support for ZTE MF871A This patch adds support for MF871A USB modem (aka Speed USB STICK U03) to option driver. This modem is manufactured by ZTE corporation, and sold by KDDI. Interface layout: 0: AT 1: MODEM usb-devices output: T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 9 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=19d2 ProdID=1481 Rev=52.87 S: Manufacturer=ZTE,Incorporated S: Product=ZTE Technologies MSM S: SerialNumber=1234567890ABCDEF C: #Ifs= 2 Cfg#= 1 Atr=80 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option Co-developed-by: Hiroyuki Yamamoto <hyamamo@allied-telesis.co.jp> Signed-off-by: Hiroyuki Yamamoto <hyamamo@allied-telesis.co.jp> Signed-off-by: Yoshiaki Okamoto <yokamoto@allied-telesis.co.jp> Cc: stable <stable@vger.kernel.org> Signed-off-by: Johan Hovold <johan@kernel.org>

view details

Rogan Dawes

commit sha 552573e42aab5f75aff9bab855a9677979d9a7d5

USB: serial: option: add D-Link DWM-222 device ID Add device id for D-Link DWM-222 A2. MI_00 D-Link HS-USB Diagnostics MI_01 D-Link HS-USB Modem MI_02 D-Link HS-USB AT Port MI_03 D-Link HS-USB NMEA MI_04 D-Link HS-USB WWAN Adapter (qmi_wwan) MI_05 USB Mass Storage Device Cc: stable@vger.kernel.org Signed-off-by: Rogan Dawes <rogan@dawes.za.net> Signed-off-by: Johan Hovold <johan@kernel.org>

view details

Eugeniy Paltsev

commit sha ce0eff0d9b4d37702df48a39e3fddb5e39b2c25b

ARC: [plat-hsdk]: allow to switch between AXI DMAC port configurations We want to use DW AXI DMAC on HSDK board in our automated verification to test cache & dma kernel code changes. This is perfect candidate as we don't depend on any external peripherals like MMC card / USB storage / etc. To increase test coverage we want to test both options: * DW AXI DMAC is connected through IOC port & dma direct ops used * DW AXI DMAC is connected to DDR port & dma noncoherent ops used Introduce 'arc_hsdk_axi_dmac_coherent' global variable which can be modified by debugger (same way as we patch 'ioc_enable') to switch between these options without recompiling the kernel. Depend on this value we tweak memory bridge configuration and "dma-coherent" DTS property of DW AXI DMAC. Signed-off-by: Eugeniy Paltsev <Eugeniy.Paltsev@synopsys.com> Acked-by: Alexey Brodkin <abrodkin@synopsys.com> Signed-off-by: Vineet Gupta <vgupta@synopsys.com>

view details

Douglas Anderson

commit sha f7ccbed656f78212593ca965d9a8f34bf24e0aab

drm/rockchip: Suspend DP late In commit fe64ba5c6323 ("drm/rockchip: Resume DP early") we moved resume to be early but left suspend at its normal time. This seems like it could be OK, but casues problems if a suspend gets interrupted partway through. The OS only balances matching suspend/resume levels. ...so if suspend was called then resume will be called. If suspend late was called then resume early will be called. ...but if suspend was called resume early might not get called. This leads to an unbalance in the clock enables / disables. Lets take the simple fix and just move suspend to be late to match. This makes the PM core take proper care in keeping things balanced. Fixes: fe64ba5c6323 ("drm/rockchip: Resume DP early") Signed-off-by: Douglas Anderson <dianders@chromium.org> Signed-off-by: Sean Paul <seanpaul@chromium.org> Link: https://patchwork.freedesktop.org/patch/msgid/20190802184616.44822-1-dianders@chromium.org

view details

Marc Zyngier

commit sha 5eeaf10eec394b28fad2c58f1f5c3a5da0e87d1c

KVM: arm/arm64: Sync ICH_VMCR_EL2 back when about to block Since commit commit 328e56647944 ("KVM: arm/arm64: vgic: Defer touching GICH_VMCR to vcpu_load/put"), we leave ICH_VMCR_EL2 (or its GICv2 equivalent) loaded as long as we can, only syncing it back when we're scheduled out. There is a small snag with that though: kvm_vgic_vcpu_pending_irq(), which is indirectly called from kvm_vcpu_check_block(), needs to evaluate the guest's view of ICC_PMR_EL1. At the point were we call kvm_vcpu_check_block(), the vcpu is still loaded, and whatever changes to PMR is not visible in memory until we do a vcpu_put(). Things go really south if the guest does the following: mov x0, #0 // or any small value masking interrupts msr ICC_PMR_EL1, x0 [vcpu preempted, then rescheduled, VMCR sampled] mov x0, #ff // allow all interrupts msr ICC_PMR_EL1, x0 wfi // traps to EL2, so samping of VMCR [interrupt arrives just after WFI] Here, the hypervisor's view of PMR is zero, while the guest has enabled its interrupts. kvm_vgic_vcpu_pending_irq() will then say that no interrupts are pending (despite an interrupt being received) and we'll block for no reason. If the guest doesn't have a periodic interrupt firing once it has blocked, it will stay there forever. To avoid this unfortuante situation, let's resync VMCR from kvm_arch_vcpu_blocking(), ensuring that a following kvm_vcpu_check_block() will observe the latest value of PMR. This has been found by booting an arm64 Linux guest with the pseudo NMI feature, and thus using interrupt priorities to mask interrupts instead of the usual PSTATE masking. Cc: stable@vger.kernel.org # 4.12 Fixes: 328e56647944 ("KVM: arm/arm64: vgic: Defer touching GICH_VMCR to vcpu_load/put") Signed-off-by: Marc Zyngier <maz@kernel.org>

view details

Suzuki K Poulose

commit sha fc05481b2fcabaaeccf63e32ac1baab54e5b6963

usb: yurex: Fix use-after-free in yurex_delete syzbot reported the following crash [0]: BUG: KASAN: use-after-free in usb_free_coherent+0x79/0x80 drivers/usb/core/usb.c:928 Read of size 8 at addr ffff8881b18599c8 by task syz-executor.4/16007 CPU: 0 PID: 16007 Comm: syz-executor.4 Not tainted 5.3.0-rc2+ #23 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xca/0x13e lib/dump_stack.c:113 print_address_description+0x6a/0x32c mm/kasan/report.c:351 __kasan_report.cold+0x1a/0x33 mm/kasan/report.c:482 kasan_report+0xe/0x12 mm/kasan/common.c:612 usb_free_coherent+0x79/0x80 drivers/usb/core/usb.c:928 yurex_delete+0x138/0x330 drivers/usb/misc/yurex.c:100 kref_put include/linux/kref.h:65 [inline] yurex_release+0x66/0x90 drivers/usb/misc/yurex.c:392 __fput+0x2d7/0x840 fs/file_table.c:280 task_work_run+0x13f/0x1c0 kernel/task_work.c:113 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_usermode_loop+0x1d2/0x200 arch/x86/entry/common.c:163 prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline] syscall_return_slowpath arch/x86/entry/common.c:274 [inline] do_syscall_64+0x45f/0x580 arch/x86/entry/common.c:299 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x413511 Code: 75 14 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 04 1b 00 00 c3 48 83 ec 08 e8 0a fc ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 53 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01 RSP: 002b:00007ffc424ea2e0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 RAX: 0000000000000000 RBX: 0000000000000007 RCX: 0000000000413511 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000006 RBP: 0000000000000001 R08: 0000000029a2fc22 R09: 0000000029a2fc26 R10: 00007ffc424ea3c0 R11: 0000000000000293 R12: 000000000075c9a0 R13: 000000000075c9a0 R14: 0000000000761938 R15: ffffffffffffffff Allocated by task 2776: save_stack+0x1b/0x80 mm/kasan/common.c:69 set_track mm/kasan/common.c:77 [inline] __kasan_kmalloc mm/kasan/common.c:487 [inline] __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:460 kmalloc include/linux/slab.h:552 [inline] kzalloc include/linux/slab.h:748 [inline] usb_alloc_dev+0x51/0xf95 drivers/usb/core/usb.c:583 hub_port_connect drivers/usb/core/hub.c:5004 [inline] hub_port_connect_change drivers/usb/core/hub.c:5213 [inline] port_event drivers/usb/core/hub.c:5359 [inline] hub_event+0x15c0/0x3640 drivers/usb/core/hub.c:5441 process_one_work+0x92b/0x1530 kernel/workqueue.c:2269 worker_thread+0x96/0xe20 kernel/workqueue.c:2415 kthread+0x318/0x420 kernel/kthread.c:255 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 Freed by task 16007: save_stack+0x1b/0x80 mm/kasan/common.c:69 set_track mm/kasan/common.c:77 [inline] __kasan_slab_free+0x130/0x180 mm/kasan/common.c:449 slab_free_hook mm/slub.c:1423 [inline] slab_free_freelist_hook mm/slub.c:1470 [inline] slab_free mm/slub.c:3012 [inline] kfree+0xe4/0x2f0 mm/slub.c:3953 device_release+0x71/0x200 drivers/base/core.c:1064 kobject_cleanup lib/kobject.c:693 [inline] kobject_release lib/kobject.c:722 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x171/0x280 lib/kobject.c:739 put_device+0x1b/0x30 drivers/base/core.c:2213 usb_put_dev+0x1f/0x30 drivers/usb/core/usb.c:725 yurex_delete+0x40/0x330 drivers/usb/misc/yurex.c:95 kref_put include/linux/kref.h:65 [inline] yurex_release+0x66/0x90 drivers/usb/misc/yurex.c:392 __fput+0x2d7/0x840 fs/file_table.c:280 task_work_run+0x13f/0x1c0 kernel/task_work.c:113 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_usermode_loop+0x1d2/0x200 arch/x86/entry/common.c:163 prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline] syscall_return_slowpath arch/x86/entry/common.c:274 [inline] do_syscall_64+0x45f/0x580 arch/x86/entry/common.c:299 entry_SYSCALL_64_after_hwframe+0x49/0xbe The buggy address belongs to the object at ffff8881b1859980 which belongs to the cache kmalloc-2k of size 2048 The buggy address is located 72 bytes inside of 2048-byte region [ffff8881b1859980, ffff8881b185a180) The buggy address belongs to the page: page:ffffea0006c61600 refcount:1 mapcount:0 mapping:ffff8881da00c000 index:0x0 compound_mapcount: 0 flags: 0x200000000010200(slab|head) raw: 0200000000010200 0000000000000000 0000000100000001 ffff8881da00c000 raw: 0000000000000000 00000000000f000f 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8881b1859880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8881b1859900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc > ffff8881b1859980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8881b1859a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8881b1859a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== A quick look at the yurex_delete() shows that we drop the reference to the usb_device before releasing any buffers associated with the device. Delay the reference drop until we have finished the cleanup. [0] https://lore.kernel.org/lkml/0000000000003f86d8058f0bd671@google.com/ Fixes: 6bc235a2e24a5e ("USB: add driver for Meywa-Denki & Kayac YUREX") Cc: Jiri Kosina <jkosina@suse.cz> Cc: Tomoki Sekiyama <tomoki.sekiyama@gmail.com> Cc: Oliver Neukum <oneukum@suse.com> Cc: andreyknvl@google.com Cc: gregkh@linuxfoundation.org Cc: Alan Stern <stern@rowland.harvard.edu> Cc: syzkaller-bugs@googlegroups.com Cc: dtor@chromium.org Reported-by: syzbot+d1fedb1c1fdb07fca507@syzkaller.appspotmail.com Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com> Cc: stable <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20190805111528.6758-1-suzuki.poulose@arm.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

view details

Gavin Li

commit sha c43f28dfdc4654e738aa6d3fd08a105b2bee758d

usb: usbfs: fix double-free of usb memory upon submiturb error Upon an error within proc_do_submiturb(), dec_usb_memory_use_count() gets called once by the error handling tail and again by free_async(). Remove the first call. Signed-off-by: Gavin Li <git@thegavinli.com> Acked-by: Alan Stern <stern@rowland.harvard.edu> Cc: stable <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20190804235044.22327-1-gavinli@thegavinli.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

view details

Nishad Kamdar

commit sha 0dda5907b0fc60f72f67f479f224e02c95d06e21

i2c: stm32: Use the correct style for SPDX License Identifier This patch corrects the SPDX License Identifier style in header file related to STM32 Driver for I2C hardware bus support. For C header files Documentation/process/license-rules.rst mandates C-like comments (opposed to C source files where C++ style should be used) Changes made by using a script provided by Joe Perches here: https://lkml.org/lkml/2019/2/7/46 Suggested-by: Joe Perches <joe@perches.com> Signed-off-by: Nishad Kamdar <nishadkamdar@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

view details

Nuno Sá

commit sha 82a5008a341d301da3ab529ca888c64f529bd075

iio: frequency: adf4371: Fix output frequency setting The fract1 word was not being properly programmed on the device leading to wrong output frequencies. Fixes: 7f699bd14913 (iio: frequency: adf4371: Add support for ADF4371 PLL) Signed-off-by: Nuno Sá <nuno.sa@analog.com> Reviewed-by: Stefan Popa <stefan.popa@analog.com> Cc: <Stable@vger.kernel.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>

view details

Jacopo Mondi

commit sha b9ddd5091160793ee9fac10da765cf3f53d2aaf0

iio: adc: max9611: Fix temperature reading in probe The max9611 driver reads the die temperature at probe time to validate the communication channel. Use the actual read value to perform the test instead of the read function return value, which was mistakenly used so far. The temperature reading test was only successful because the 0 return value is in the range of supported temperatures. Fixes: 69780a3bbc0b ("iio: adc: Add Maxim max9611 ADC driver") Signed-off-by: Jacopo Mondi <jacopo+renesas@jmondi.org> Cc: <Stable@vger.kernel.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>

view details

Andrea Arcangeli

commit sha cc798c83898ea0a77fcaa1a92afda35c3c3ded74

kernfs: fix memleak in kernel_ops_readdir() If getdents64 is killed or hits on segfault, it'll leave cgroups directories in sysfs pinned leaking memory because the kernfs node won't be freed on rmdir and the parent neither. Repro: # for i in `seq 1000`; do mkdir $i; done # rmdir * # for i in `seq 1000`; do mkdir $i; done # rmdir * # for i in `seq 1000`; do while :; do ls $i/ >/dev/null; done & done # while :; do killall ls; done kernfs_node_cache in /proc/slabinfo keeps going up as expected. Signed-off-by: Andrea Arcangeli <aarcange@redhat.com> Signed-off-by: Tejun Heo <tj@kernel.org> Cc: stable@vger.kernel.org # goes way back to original sysfs days Link: https://lore.kernel.org/r/20190805173404.GF136335@devbig004.ftw2.facebook.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

view details

Logan Gunthorpe

commit sha 49da065f7b1f27be625de65d6d55bdd22ac6b5c2

NTB/msi: remove incorrect MODULE defines msi.c is not a module on its own right and should not have the MODULE_[LICENSE|VERSION|AUTHOR|DESCRIPTION] definitions. This caused a regression noticed by lkp with the following back trace: WARNING: CPU: 0 PID: 1 at kernel/params.c:861 param_sysfs_init+0xb1/0x20a Modules linked in: CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.2.0-rc1-00018-g26b3a37b928457 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014 RIP: 0010:param_sysfs_init+0xb1/0x20a Code: 24 38 e8 ec 17 2e fd 49 8b 7c 24 38 e8 76 fe ff ff 48 85 c0 48 89 c5 74 25 31 d2 4c 89 e6 48 89 c7 e8 6d 6f 3c fd 85 c0 74 02 <0f> 0b 48 89 ef 31 f6 e8 5d 70 a7 fe 48 89 ef e8 95 52 a7 fe 48 83 RSP: 0000:ffff88806b0ffe30 EFLAGS: 00010282 RAX: 00000000ffffffef RBX: ffffffff83774220 RCX: ffff88806a85e880 RDX: 00000000ffffffef RSI: ffff88806b000400 RDI: ffff88806a8608c0 RBP: ffff88806b392000 R08: ffffed100d61ff59 R09: ffffed100d61ff59 R10: 0000000000000001 R11: ffffed100d61ff58 R12: ffffffff83974bc0 R13: 0000000000000004 R14: 0000000000000028 R15: 00000000000003b9 FS: 0000000000000000(0000) GS:ffff88806b800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000000380e000 CR4: 00000000000406b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ? file_caps_disable+0x10/0x10 ? locate_module_kobject+0xf2/0xf2 do_one_initcall+0x47/0x1f0 kernel_init_freeable+0x1b1/0x243 ? rest_init+0xd0/0xd0 kernel_init+0xa/0x130 ? calculate_sigpending+0x63/0x80 ? rest_init+0xd0/0xd0 ret_from_fork+0x1f/0x30 ---[ end trace 78201497ae74cc91 ]--- Reported-by: kernel test robot <lkp@intel.com> Fixes: 26b3a37b9284 ("NTB: Introduce MSI library") Signed-off-by: Logan Gunthorpe <logang@deltatee.com> Signed-off-by: Jon Mason <jdmason@kudzu.us>

view details

zhengbin

commit sha b33d567560c1aadf3033290d74d4fd67af47aa61

auxdisplay: panel: need to delete scan_timer when misc_register fails in panel_attach In panel_attach, if misc_register fails, we need to delete scan_timer, which was setup in keypad_init->init_scan_timer. Reported-by: Hulk Robot <hulkci@huawei.com> Signed-off-by: zhengbin <zhengbin13@huawei.com> Signed-off-by: Miguel Ojeda <miguel.ojeda.sandonis@gmail.com>

view details

Mans Rullgard

commit sha ba2c1340d7c8e1ba5957d814ec18592b315fd4de

auxdisplay: charlcd: add help text for backlight initial state While the individual CHARLCD_BL_xxx options have help texts, the menu itself does not. Fix this. Suggested-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Mans Rullgard <mans@mansr.com> [Added a bit more text to address Linus' suggestion] Signed-off-by: Miguel Ojeda <miguel.ojeda.sandonis@gmail.com>

view details

Neil Armstrong

commit sha 3d4bacdc207a7b62941700b374e7199cbb184a43

arm64: dts: meson-g12a: add missing dwc2 phy-names The G12A USB2 OTG capable PHY uses a 8bit large UTMI bus, and the OTG controller gets the PHY but width by probing the associated phy. By default it will use 16bit wide settings if a phy is not specified, in our case we specified the phy, but not the phy-names. The dwc2 bindings specifies that if phys is present, phy-names shall be "usb2-phy". Adding phy-names = "usb2-phy" solves the OTG PHY bus configuration. Fixes: 9baf7d6be730 ("arm64: dts: meson: g12a: Add G12A USB nodes") Signed-off-by: Neil Armstrong <narmstrong@baylibre.com> Signed-off-by: Kevin Hilman <khilman@baylibre.com>

view details

Neil Armstrong

commit sha 54f374d1fd302fe6ca21220174c1dcb294049311

arm64: dts: meson-g12a-sei510: enable IR controller Enable the IR receiver controller on the SEI510 board. Signed-off-by: Neil Armstrong <narmstrong@baylibre.com> Signed-off-by: Kevin Hilman <khilman@baylibre.com>

view details

push time in 2 months

push eventrhvgoyal/linux

Vivek Goyal

commit sha 43ec518fc8a4edafd33af25629bd0a2ae6673219

virtiofs: Remove request from processing list before calling end In error path we are calling fuse_request_end() but we need to clear FR_SENT bit as well as remove request from processing queue. Otherwise fuse_request_end() triggers a warning as well as other issues show up. Signed-off-by: Vivek Goyal <vgoyal@redhat.com>

view details

Vivek Goyal

commit sha 5d28d790f34517339137c75df2f6e841276e3706

virtiofs: Check whether hiprio queue is connected at submission time For hiprio queue (forget requests), we are keeping a state in queue whether queue is connected or not. If queue is not connected, do not try to submit request and return error instead. As of now, we are checking for this state only in path where worker tries to submit forget after first attempt failed. Check this state even in the path when request is being submitted first time. Signed-off-by: Vivek Goyal <vgoyal@redhat.com>

view details

Vivek Goyal

commit sha 49905736b86e870ed4e2c3c5323f07d8479320ef

virtiofs: Pass fsvq instead of vq as parameter to virtio_fs_enqueue_req Pass fsvq instead of vq as parameter to virtio_fs_enqueue_req(). We will retrieve vq from fsvq under spin lock. Later in the patch series we will retrieve vq only if fsvq is still connected other vq might have been cleaned up by device ->remove code and we will return error. Signed-off-by: Vivek Goyal <vgoyal@redhat.com>

view details

Vivek Goyal

commit sha d4ccbaef9acc87a31f50a6301b2179d3ec99eb83

virtiofs: Check connected state for VQ_REQUEST queue as well Right now we are checking ->connected state only for VQ_HIPRIO. Now we want to make use of this method for all queues. So check it for VQ_REQUEST as well. This will be helpful if device has been removed and virtqueue is gone. In that case ->connected will be false and request can't be submitted anymore and user space will see error -ENOTCONN. Signed-off-by: Vivek Goyal <vgoyal@redhat.com>

view details

Vivek Goyal

commit sha f74b00d1dcf860db33eaeccc9afbf9daeec410e6

Maintain count of in flight requests for VQ_REQUEST queue As of now we maintain this count only for VQ_HIPRIO. Maintain it for VQ_REQUEST as well so that later it can be used to drain VQ_REQUEST queue. Signed-off-by: Vivek Goyal <vgoyal@redhat.com>

view details

Vivek Goyal

commit sha c124e7e8b869da51696267201df80e003dd4f70a

virtiofs: ->remove should not clean virtiofs fuse devices We maintain a fuse device per virt queue. This fuse devices are allocated and installed during mount time and should be cleaned up when super block is going away. Device removal should not clean it. Device removal should stop queues and virtuques can go away. Signed-off-by: Vivek Goyal <vgoyal@redhat.com>

view details

Vivek Goyal

commit sha a85364fb019ba9642b29f39fdb8cac2982142612

virtiofs: Stop virtiofs queues when device is being removed Stop all the virt queues when device is going away. This will ensure that no new requests are submitted to virtqueue and and request will end with error -ENOTCONN. Signed-off-by: Vivek Goyal <vgoyal@redhat.com>

view details

Vivek Goyal

commit sha 60d99701f9549c49e367cd4f3a29f3ce34146dd6

virtiofs: Drain all pending requests during ->remove time When device is going away, drain all pending requests. Signed-off-by: Vivek Goyal <vgoyal@redhat.com>

view details

Vivek Goyal

commit sha b7112c7d042798ccad358dfa1d8af312f9da188b

virtiofs: Add an helper to start all the queues This just marks are the queues are connected and ready to accept the request. Signed-off-by: Vivek Goyal <vgoyal@redhat.com>

view details

Vivek Goyal

commit sha c527f83a645b95ea11cb49a1a75b5d082131a058

virtiofs: Do not use device managed mem for virtio_fs and virtio_fs_vq These data structures should go away when virtio_fs object is going away. When deivce is going away, we need to just make sure virtqueues can go away and after that none of the code accesses vq and all the requests get error. So allocate memory for virtio_fs and virtio_fs_vq normally and free it at right time. This patch still frees up memory during device remove time. A later patch will make virtio_fs object reference counted and this memory will be freed when last reference to object is dropped. Signed-off-by: Vivek Goyal <vgoyal@redhat.com>

view details

Vivek Goyal

commit sha 56f0e44eaa946a52d5f3ee43d7604148ed39e3d0

virtiofs: stop and drain queues after sending DESTROY During virtio_kill_sb() we first stop forget queue and drain it and then call fuse_kill_sb_anon(). This will result in sending DESTROY request to fuse server. Once finished, stop all the queues and drain one more time just to be sure and then free up the devices. Given drain queues will call flush_work() on various workers, remove this logic from virtio_free_devs(). Signed-off-by: Vivek Goyal <vgoyal@redhat.com>

view details

Vivek Goyal

commit sha b99a89c2e1181ace59f481a032c29f33f1c5ff3a

use-virtiofs-free-dev-in-error-path

view details

Vivek Goyal

commit sha bae09713683e730e4f10fa034c0406424cb611af

virtiofs: Do not access virtqueue in request submission path In request submission path it is possible that virtqueue is already gone due to driver->remove(). So do not access it in dev_dbg(). Use pr_debug() instead. If virtuqueue is gone, this will result in NULL pointer deference. Signed-off-by: Vivek Goyal <vgoyal@redhat.com>

view details

Vivek Goyal

commit sha 647cf700aeaac562c57bd6d018561d692a038469

virtiofs: Add a fuse_iqueue operation to put() reference Soon I will make virtio_fs object reference counted, where reference will be taken by device as well as by fuse_conn (fuse_conn->fuse_iqueue->fiq_priv). When fuse_connection is going away, it should put its reference on virtio_fs object. So add a fuse_iqueue method which can be used to call into virtio_fs to put the reference on the object (fiq_priv). Signed-off-by: Vivek Goyal <vgoyal@redhat.com>

view details

Vivek Goyal

commit sha 9119e70fb32df45c21b510f30dfcfa776bbf716d

virtiofs: Make virtio_fs object refcounted This object is used both by fuse_connection as well virt device. So make this object reference counted and that makes it easy to define life cycle of the object. Now deivce can be removed while filesystem is still mounted. This will cleanup all the virtqueues but virtio_fs object will still be around and will be cleaned when filesystem is unmounted and sb/fc drops its reference. Removing a device also stops all virt queues and any new reuqest gets error -ENOTCONN. All existing in flight requests are drained before ->remove returns. Signed-off-by: Vivek Goyal <vgoyal@redhat.com>

view details

Vivek Goyal

commit sha 2d51ee5810e98b155057bfe8a2f50b7109e11cfd

virtiofs: Use virtio_fs_mutex for races w.r.t ->remove and mount path It is possible that a mount is in progress and device is being removed at the same time. Use virtio_fs_mutex to avoid races. This also takes care of bunch of races and removes some TODO items. Signed-off-by: Vivek Goyal <vgoyal@redhat.com>

view details

Vivek Goyal

commit sha 61a3d9bb379ef0485ccee082913c2139ff5c1601

virtiofs: Remove TODO to quiesce/end_requests We now stop queues and drain all the pending requests from all virtqueues. So this is not a TODO anymore. Got rid of incrementing fc->dev_count as well. It did not seem meaningful for virtio_fs. Signed-off-by: Vivek Goyal <vgoyal@redhat.com>

view details

Vivek Goyal

commit sha 43adeab0a378f85f895cae9f38337c9b5d94b41d

virtiofs: Remove TODO item from virtio_fs_free_devs() virtio_fs_free_devs() is now called from ->kill_sb(). By this time all device queues have been quiesced. I am assuming that while ->kill_sb() is in progress, another mount instance will wait for it to finish (sb->s_umount mutex provides mutual exclusion). W.r.t ->remove path, we should be fine as we are not touching vdev or virtqueues. And we have reference on virtio_fs object, so we know rest of the data structures are valid. So I can't see the need of any additional locking yet. Signed-off-by: Vivek Goyal <vgoyal@redhat.com>

view details

push time in 2 months

create barnchrhvgoyal/linux

branch : virtiofs-cleanup

created branch time in 2 months

push eventrhvgoyal/linux

Tzung-Bi Shih

commit sha 6cd249cfad68a231336983e2216d75b3ddfde1d6

ASoC: max98357a: use mdelay for sdmode-delay max98357a_daiops_trigger() is possible to be called in atomic context if the .nonatomic flag is equal to 0 in the DAI links. When cancel_delayed_work_sync() in max98357a_daiops_trigger() is called in atomic context, kernel emits the following message: "BUG: sleeping function called from invalid context". According to the DT binding document, value less than or equal to 5ms of sdmod-delay should be sufficient to avoid the pop noise. Use mdelay (i.e. busy loop) for such low delay should be acceptable. Fixes: cec5b01f8f1c ("ASoC: max98357a: avoid speaker pop when playback startup") Signed-off-by: Tzung-Bi Shih <tzungbi@google.com> Link: https://lore.kernel.org/r/20190708141901.68797-1-tzungbi@google.com Signed-off-by: Mark Brown <broonie@kernel.org>

view details

Joe Perches

commit sha 72365164cbefe3afa7a146d27d502ed688bf7323

ASoC: rt1308: Remove executable attribute from source files These are source files not executable. Signed-off-by: Joe Perches <joe@perches.com> Link: https://lore.kernel.org/r/d198a3e6ed3a0e9070afeb6aca69903c3e985149.camel@perches.com Signed-off-by: Mark Brown <broonie@kernel.org>

view details

Kirill Marinushkin

commit sha 9e944c9be2456159fb8c36b0ba3170b2f01c3887

ASoC: Relocate my e-mail to .com domain zone Signed-off-by: Kirill Marinushkin <kmarinushkin@birdec.com> Link: https://lore.kernel.org/r/20190710055135.21377-1-kmarinushkin@birdec.com Signed-off-by: Mark Brown <broonie@kernel.org>

view details

Kuninori Morimoto

commit sha 52db6685932e326ed607644ab7ebdae8c194adda

ASoC: simple_card_utils.h: care NULL dai at asoc_simple_debug_dai() props->xxx_dai might be NULL when DPCM. This patch cares it for debug. Fixes: commit 0580dde59438 ("ASoC: simple-card-utils: add asoc_simple_debug_info()") Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Link: https://lore.kernel.org/r/87o922gw4u.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>

view details

Kuninori Morimoto

commit sha 794fcee8da3c0c8a01b08ecad1c181cb0a622868

ASoC: simple-card-utils: care no Platform for DPCM commit 34614739988ad ("ASoC: soc-core: support dai_link with platforms_num != 1") supports multi Platform, and commit 9f3eb91753451 ("ASoC: simple-card-utils: consider CPU-Platform possibility") removed no Platform from simple-card. Multi Platform is now checking both Platform name/of_node are NULL case. But in normal case, DPCM be doesn't have Platform. asoc_simple_canonicalize_platform() try to use CPU of_node to Platform (This is needed for DMAEngine platform case), but it still might be NULL at DPCM be. This patch try to use no Platform after that if Platform of_node is still NULL. It can't probe without this patch. Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Link: https://lore.kernel.org/r/87muhmgw2o.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>

view details

Wen Yang

commit sha 724808ad556c15e9473418d082f8aae81dd267f6

ASoC: simple-card: fix an use-after-free in simple_dai_link_of_dpcm() The node variable is still being used after the of_node_put() call, which may result in use-after-free. Fixes: cfc652a73331 ("ASoC: simple-card: tidyup prefix for snd_soc_codec_conf") Link: https://lore.kernel.org/r/1562743509-30496-2-git-send-email-wen.yang99@zte.com.cn Signed-off-by: Wen Yang <wen.yang99@zte.com.cn> Acked-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Signed-off-by: Mark Brown <broonie@kernel.org>

view details

Wen Yang

commit sha 27862d5a3325bc531ec15e3c607e44aa0fd57f6f

ASoC: simple-card: fix an use-after-free in simple_for_each_link() The codec variable is still being used after the of_node_put() call, which may result in use-after-free. Fixes: d947cdfd4be2 ("ASoC: simple-card: cleanup DAI link loop method - step1") Link: https://lore.kernel.org/r/1562743509-30496-3-git-send-email-wen.yang99@zte.com.cn Signed-off-by: Wen Yang <wen.yang99@zte.com.cn> Acked-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Signed-off-by: Mark Brown <broonie@kernel.org>

view details

Wen Yang

commit sha aa2e362cb6b3f5ca88093ada01e1a0ace8a517b2

ASoC: audio-graph-card: fix use-after-free in graph_dai_link_of_dpcm() After calling of_node_put() on the ports, port, and node variables, they are still being used, which may result in use-after-free. Fix this issue by calling of_node_put() after the last usage. Fixes: dd98fbc558a0 ("ASoC: audio-graph-card: cleanup DAI link loop method - step1") Link: https://lore.kernel.org/r/1562743509-30496-4-git-send-email-wen.yang99@zte.com.cn Signed-off-by: Wen Yang <wen.yang99@zte.com.cn> Acked-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Signed-off-by: Mark Brown <broonie@kernel.org>

view details

Wen Yang

commit sha c152f8491a8d9a4b25afd65a86eb5e55e2a8c380

ASoC: audio-graph-card: fix an use-after-free in graph_get_dai_id() After calling of_node_put() on the node variable, it is still being used, which may result in use-after-free. Fix this issue by calling of_node_put() after the last usage. Fixes: a0c426fe1433 ("ASoC: simple-card-utils: check "reg" property on asoc_simple_card_get_dai_id()") Link: https://lore.kernel.org/r/1562743509-30496-5-git-send-email-wen.yang99@zte.com.cn Signed-off-by: Wen Yang <wen.yang99@zte.com.cn> Acked-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Signed-off-by: Mark Brown <broonie@kernel.org>

view details

Shuming Fan

commit sha 09297c2f7a5428776369ba3b9904718a358e5559

ASoC: rt1011: fix DC calibration offset not applying There are two issues to fix: - DC offset calibration data will be reset after stopping playback. - DC offset calibration data should be applied in the initial setting. Signed-off-by: Shuming Fan <shumingf@realtek.com> Link: https://lore.kernel.org/r/20190711082214.8142-1-shumingf@realtek.com Signed-off-by: Mark Brown <broonie@kernel.org>

view details

Kuninori Morimoto

commit sha ec3042ad39d4e2ddbc3a3344f90bb10d8feb53bc

ASoC: audio-graph-card: add missing const at graph_get_dai_id() commit c152f8491a8d9 ("ASoC: audio-graph-card: fix an use-after-free in graph_get_dai_id()") fixups use-after-free issue, but, it need to use "const" for reg. This patch adds it. We will have below without this patch LINUX/sound/soc/generic/audio-graph-card.c: In function 'graph_get_dai_id': LINUX/sound/soc/generic/audio-graph-card.c:87:7: warning: assignment discards\ 'const' qualifier from pointer target type [-Wdiscarded-qualifiers] reg = of_get_property(node, "reg", NULL); Fixes: c152f8491a8d9 ("ASoC: audio-graph-card: fix an use-after-free in graph_get_dai_id()") Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Acked-by: Wen Yang <wen.yang99@zte.com.cn> Link: https://lore.kernel.org/r/87sgrd43ja.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>

view details

Joe Perches

commit sha ae8cc91a7d85e018c0c267f580820b2bb558cd48

iio: adc: max9611: Fix misuse of GENMASK macro Arguments are supposed to be ordered high then low. Signed-off-by: Joe Perches <joe@perches.com> Fixes: 69780a3bbc0b ("iio: adc: Add Maxim max9611 ADC driver") Cc: <Stable@vger.kernel.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>

view details

Maarten ter Huurne

commit sha 5a304e1a4ea000177cf25f5ecf26e786dda25b98

IIO: Ingenic JZ47xx: Set clock divider on probe The SADC component can run at up to 8 MHz on JZ4725B, but is fed a 12 MHz input clock (EXT). Divide it by two to get 6 MHz, then set up another divider to match, to produce a 10us clock. If the clock dividers are left on their power-on defaults (a divider of 1), the SADC mostly works, but will occasionally produce erroneous readings. This led to button presses being detected out of nowhere on the RS90 every few minutes. With this change, no ghost button presses were logged in almost a day worth of testing. The ADCLK register for configuring clock dividers doesn't exist on JZ4740, so avoid writing it there. A function has been introduced rather than a flag because there is a lot of variation between the ADCLK registers on JZ47xx SoCs, both in the internal layout of the register and in the frequency range supported by the SADC. So this solution should make it easier to add support for other JZ47xx SoCs later. Fixes: 1a78daea107d ("iio: adc: probe should set clock divider") Signed-off-by: Maarten ter Huurne <maarten@treewalker.org> Signed-off-by: Artur Rojek <contact@artur-rojek.eu> Cc: <Stable@vger.kernel.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>

view details

Gwendal Grignou

commit sha 6cdff99c9f7d7d28b87cf05dd464f7c7736332ae

iio: cros_ec_accel_legacy: Fix incorrect channel setting INFO_SCALE is set both for each channel and all channels. iio is using all channel setting, so the error was not user visible. Signed-off-by: Gwendal Grignou <gwendal@chromium.org> Cc: <Stable@vger.kernel.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>

view details

Jean-Baptiste Maneyrol

commit sha 1244a720572fd1680ac8d6b8a4235f2e8557b810

iio: imu: mpu6050: add missing available scan masks Driver only supports 3-axis gyro and/or 3-axis accel. For icm20602, temp data is mandatory for all configurations. Fix all single and double axis configurations (almost never used) and more importantly fix 3-axis gyro and 6-axis accel+gyro buffer on icm20602 when temp data is not enabled. Signed-off-by: Jean-Baptiste Maneyrol <jmaneyrol@invensense.com> Fixes: 1615fe41a195 ("iio: imu: mpu6050: Fix FIFO layout for ICM20602") Cc: <Stable@vger.kernel.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>

view details

Wen Yang

commit sha 9b6d104a6b150bd4d3e5b039340e1f6b20c2e3c1

ASoC: samsung: odroid: fix an use-after-free issue for codec The codec variable is still being used after the of_node_put() call, which may result in use-after-free. Fixes: bc3cf17b575a ("ASoC: samsung: odroid: Add support for secondary CPU DAI") Signed-off-by: Wen Yang <wen.yang99@zte.com.cn> Cc: Krzysztof Kozlowski <krzk@kernel.org> Cc: Sangbeom Kim <sbkim73@samsung.com> Cc: Sylwester Nawrocki <s.nawrocki@samsung.com> Cc: Liam Girdwood <lgirdwood@gmail.com> Cc: Mark Brown <broonie@kernel.org> Cc: Jaroslav Kysela <perex@perex.cz> Cc: Takashi Iwai <tiwai@suse.com> Cc: alsa-devel@alsa-project.org Cc: linux-kernel@vger.kernel.org Link: https://lore.kernel.org/r/1562989575-33785-2-git-send-email-wen.yang99@zte.com.cn Signed-off-by: Mark Brown <broonie@kernel.org>

view details

Wen Yang

commit sha 2abee12c0ab1924a69993d2c063a39a952e7d836

ASoC: samsung: odroid: fix a double-free issue for cpu_dai The cpu_dai variable is still being used after the of_node_put() call, which may result in double-free: of_node_put(cpu_dai); ---> released here ret = devm_snd_soc_register_card(dev, card); if (ret < 0) { ... goto err_put_clk_i2s; --> jump to err_put_clk_i2s ... err_put_clk_i2s: clk_put(priv->clk_i2s_bus); err_put_sclk: clk_put(priv->sclk_i2s); err_put_cpu_dai: of_node_put(cpu_dai); --> double-free here Fixes: d832d2b246c5 ("ASoC: samsung: odroid: Fix of_node refcount unbalance") Signed-off-by: Wen Yang <wen.yang99@zte.com.cn> Cc: Krzysztof Kozlowski <krzk@kernel.org> Cc: Sangbeom Kim <sbkim73@samsung.com> Cc: Sylwester Nawrocki <s.nawrocki@samsung.com> Cc: Liam Girdwood <lgirdwood@gmail.com> Cc: Mark Brown <broonie@kernel.org> Cc: Jaroslav Kysela <perex@perex.cz> Cc: Takashi Iwai <tiwai@suse.com> Cc: alsa-devel@alsa-project.org Cc: linux-kernel@vger.kernel.org Link: https://lore.kernel.org/r/1562989575-33785-3-git-send-email-wen.yang99@zte.com.cn Signed-off-by: Mark Brown <broonie@kernel.org>

view details

Hans de Goede

commit sha aa2ba991c4206d5b778dcaa7b4997396e79f8e90

ASoC: Intel: bytcht_es8316: Add quirk for Irbis NB41 netbook The Irbis NB41 netbook has its internal mic on IN2, inverted jack-detect and stereo speakers, add a quirk for this. Cc: russianneuromancer@ya.ru Reported-and-tested-by: russianneuromancer@ya.ru Signed-off-by: Hans de Goede <hdegoede@redhat.com> Link: https://lore.kernel.org/r/20190712112708.25327-1-hdegoede@redhat.com Signed-off-by: Mark Brown <broonie@kernel.org>

view details

Ronald Tschalär

commit sha a7cd67e2b76edd46fbd2517078eeba369f933575

Input: applespi - fix warnings detected by sparse This makes sure that we convert from on-wire to CPU endianness in applespi_debug_update_dimensions() and also marks as "static" as it is not needed to be visible outside of the driver. Reported-by: kbuild test robot <lkp@intel.com> Signed-off-by: Ronald Tschalär <ronald@innovation.ch> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

view details

Charles Keepax

commit sha 8dd26dff00c0636b1d8621acaeef3f6f3a39dd77

ASoC: dapm: Fix handling of custom_stop_condition on DAPM graph walks DPCM uses snd_soc_dapm_dai_get_connected_widgets to build a list of the widgets connected to a specific front end DAI so it can search through this list for available back end DAIs. The custom_stop_condition was added to is_connected_ep to facilitate this list not containing more widgets than is necessary. Doing so both speeds up the DPCM handling as less widgets need to be searched and avoids issues with CODEC to CODEC links as these would be confused with back end DAIs if they appeared in the list of available widgets. custom_stop_condition was implemented by aborting the graph walk when the condition is triggered, however there is an issue with this approach. Whilst walking the graph is_connected_ep should update the endpoints cache on each widget, if the walk is aborted the number of attached end points is unknown for that sub-graph. When the stop condition triggered, the original patch ignored the triggering widget and returned zero connected end points; a later patch updated this to set the triggering widget's cache to 1 and return that. Both of these approaches result in inaccurate values being stored in various end point caches as the values propagate back through the graph, which can result in later issues with widgets powering/not powering unexpectedly. As the original goal was to reduce the size of the widget list passed to the DPCM code, the simplest solution is to limit the functionality of the custom_stop_condition to the widget list. This means the rest of the graph will still be processed resulting in correct end point caches, but only widgets up to the stop condition will be added to the returned widget list. Fixes: 6742064aef7f ("ASoC: dapm: support user-defined stop condition in dai_get_connected_widgets") Fixes: 5fdd022c2026 ("ASoC: dpcm: play nice with CODEC<->CODEC links") Fixes: 09464974eaa8 ("ASoC: dapm: Fix to return correct path list in is_connected_ep.") Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com> Link: https://lore.kernel.org/r/20190718084333.15598-1-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown <broonie@kernel.org>

view details

push time in 3 months

created tagrhvgoyal/linux

tagvivek-5.3-aug-21-2019

Linux kernel source tree

created time in 3 months

push eventrhvgoyal/virtiofs-tests

Vivek Goyal

commit sha dfd57da285a4b0b67f654870f35c9ddda55a56d9

Increase fsync interval to 1024 writes 64 seems to be too small a number. Bump it to 1024. So that every 4MB of data written (for bs 4K), an fsync will be issued. Signed-off-by: Vivek Goyal <vgoyal@redhat.com>

view details

push time in 3 months

push eventrhvgoyal/virtiofs-tests

Vivek Goyal

commit sha c8c9e3ba228d4b4b430501d598fc6ad0a63ea70d

Add ioengine=libaio jobs Signed-off-by: Vivek Goyal <vgoyal@redhat.com>

view details

push time in 3 months

push eventrhvgoyal/virtiofs-tests

Vivek Goyal

commit sha 174f8323587c6d29cab4f97bd9fcef1995304601

Add seqwrite-psync-multi job Signed-off-by: Vivek Goyal <vgoyal@redhat.com>

view details

push time in 3 months

push eventrhvgoyal/virtiofs-tests

Vivek Goyal

commit sha bc543931045ff3bd34a64635c840e98766c8d79c

Add seqread-psync-multi job Signed-off-by: Vivek Goyal <vgoyal@redhat.com>

view details

Vivek Goyal

commit sha 9927a82b1f5a7b84ca80f9f33aced66b8acaf103

Parse seqread-psync-multi job Signed-off-by: Vivek Goyal <vgoyal@redhat.com>

view details

push time in 3 months

push eventrhvgoyal/virtiofs-tests

Vivek Goyal

commit sha 04aab8aa30e689184aef1158a0704b56a2e43e53

For write jobs, fsync after every 128 writes. This should give more meaningful numbers when buffered writes are happening. Signed-off-by: Vivek Goyal <vgoyal@redhat.com>

view details

push time in 3 months

push eventrhvgoyal/virtiofs-tests

Vivek Goyal

commit sha ed73eeaefc6669138971c779b408bd5e60051eea

Subject: Rename few jobs Rename some files and jobs Signed-off-by: Vivek Goyal <vgoyal@redhat.com>

view details

push time in 3 months

push eventrhvgoyal/virtiofs-tests

Vivek Goyal

commit sha cab32b26bf5337bf3c76b37f454ec9f048d3d5f0

No need to specify numjobs=1 Its 1 by default. So no need to specify it explicitly. Signed-off-by: Vivek Goyal <vgoyal@redhat.com>

view details

Vivek Goyal

commit sha f23bb81fc967302a65cee9974642f0784e94c95d

Remove unnecessary group_reporting=1 Single file jobs don't need to specify group_reporting=1 Signed-off-by: Vivek Goyal <vgoyal@redhat.com>

view details

Vivek Goyal

commit sha c7a8e65505162a83bb383178b7656d3ffbbef413

Add an option for specifying blocksize Add option --blocksize Signed-off-by: Vivek Goyal <vgoyal@redhat.com>

view details

Vivek Goyal

commit sha 7ebb387a66654dca2ca63a4b08133e2bed86f4f6

Fix file names Do not use mmap in filename. Same file is used with non-mmap ioengine as well. Signed-off-by: Vivek Goyal <vgoyal@redhat.com>

view details

push time in 3 months

push eventrhvgoyal/virtiofs-tests

Vivek Goyal

commit sha c44eef282c0cc0fefbb9d7d01050e1677f096b1f

Output value of fio options at start This will help reconstruct fio job file. And easy to figure out what fio options did we use. Signed-off-by: Vivek Goyal <vgoyal@redhat.com>

view details

push time in 3 months

push eventrhvgoyal/virtiofs-tests

Vivek Goyal

commit sha c45924e4aaa0003863f70190933d2c7e037aa818

Add an option to specify file size and direct I/O Add option --size and --direct Signed-off-by: Vivek Goyal <vgoyal@redhat.com>

view details

push time in 3 months

push eventrhvgoyal/virtiofs-tests

Vivek Goyal

commit sha 6ac9cda7cb7757ca17cff2c286a472311fa91851

Add option --iodepth Add option --iodepth to configure number of outstanding I/Os. Signed-off-by: Vivek Goyal <vgoyal@redhat.com>

view details

push time in 3 months

push eventrhvgoyal/virtiofs-tests

Vivek Goyal

commit sha 466cf094945ce8e61f34e0313eef9e13a7373343

Add an option --runtime Allow user to specify runtime for which to run each job. Default is 30 seconds. Signed-off-by: Vivek Goyal <vgoyal@redhat.com>

view details

Vivek Goyal

commit sha 2b98003acf4b4c11b4c113ab1ec46c674e391a9f

Add an option --loops This determines how many times each fio job is run. By default loops is 3. Signed-off-by: Vivek Goyal <vgoyal@redhat.com>

view details

push time in 3 months

push eventrhvgoyal/virtiofs-tests

Vivek Goyal

commit sha 7380171967b17a99d9895cace9cd1af3aa1d79c2

capture some system info while running tests This info can be useful to figure out system config. Signed-off-by: Vivek Goyal <vgoyal@redhat.com>

view details

push time in 3 months

push eventrhvgoyal/virtiofs-tests

Vivek Goyal

commit sha ef72a98aadc7981c850bc4c87d3a81d1925a6f1a

Drop caches after parsing command line Drop caches after parsing command line. Signed-off-by: Vivek Goyal <vgoyal@redhat.com>

view details

push time in 3 months

created tagrhvgoyal/linux

tagvivek-5.3-aug-14-2019

Linux kernel source tree

created time in 3 months

push eventrhvgoyal/linux

Miklos Szeredi

commit sha e46d9bac5bb7e822792b7f5a9f5433eff2834b40

fuse: delete dentry if timeout is zero Don't hold onto dentry in lru list if need to re-lookup it anyway at next access. More advanced version of this patch would periodically flush out dentries from the lru which have gone stale. Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>

view details

Miklos Szeredi

commit sha 21c70f6e42b42615792b48ff00e6dc6314b12742

fuse: Use default_file_splice_read for direct IO

view details

Stefan Hajnoczi

commit sha e00a0a389ecd2bac38d3dfc5661c68dc8d42e421

fuse: export fuse_end_request() virtio-fs will need to complete requests from outside fs/fuse/dev.c. Make the symbol visible. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

view details

Stefan Hajnoczi

commit sha a1ce82efbc044bb456e40b54c8946b97bdaffafc

fuse: export fuse_len_args() virtio-fs will need to query the length of fuse_arg lists. Make the symbol visible. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

view details

Vivek Goyal

commit sha 43ac0e6c139cc0a58b21e9f2a3f47b483e01acd1

fuse: Export fuse_send_init_request() This will be used by virtio-fs to send init request to fuse server after initialization of virt queues. Signed-off-by: Vivek Goyal <vgoyal@redhat.com>

view details

Stefan Hajnoczi

commit sha 7eeff202245fbd22ef0a01ec45b80f1646d8b151

fuse: export fuse_get_unique() virtio-fs will need unique IDs for FORGET requests from outside fs/fuse/dev.c. Make the symbol visible. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

view details

Vivek Goyal

commit sha e80347e15d08950874c4f5bd0ae64681bcaecd2f

Export fuse_dequeue_forget() function File systems like virtio-fs need to do not have to play directly with forget list data structures. There is a helper function use that instead. Rename dequeue_forget() to fuse_dequeue_forget() and export it so that stacked filesystems can use it. Signed-off-by: Vivek Goyal <vgoyal@redhat.com>

view details

Stefan Hajnoczi

commit sha 30ea04ace9c8b39cb98199133136e687592f5d7f

fuse: extract fuse_fill_super_common() fuse_fill_super() includes code to process the fd= option and link the struct fuse_dev to the fd's struct file. In virtio-fs there is no file descriptor because /dev/fuse is not used. This patch extracts fuse_fill_super_common() so that both classic fuse and virtio-fs can share the code to initialize a mount. parse_fuse_opt() is also extracted so that the fuse_fill_super_common() caller has access to the mount options. This allows classic fuse to handle the fd= option outside fuse_fill_super_common(). Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>

view details

Stefan Hajnoczi

commit sha 8e09066d540c1cdbe71a8932ccf5cceb1760c172

fuse: add fuse_iqueue_ops callbacks The /dev/fuse device uses fiq->waitq and fasync to signal that requests are available. These mechanisms do not apply to virtio-fs. This patch introduces callbacks so alternative behavior can be used. Note that queue_interrupt() changes along these lines: spin_lock(&fiq->waitq.lock); wake_up_locked(&fiq->waitq); + kill_fasync(&fiq->fasync, SIGIO, POLL_IN); spin_unlock(&fiq->waitq.lock); - kill_fasync(&fiq->fasync, SIGIO, POLL_IN); Since queue_request() and queue_forget() also call kill_fasync() inside the spinlock this should be safe. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>

view details

Vivek Goyal

commit sha 186545e7090d04ca48953041a1b466b7ac0fb9d6

fuse: Separate fuse device allocation and installation in fuse_conn As of now fuse_dev_alloc() both allocates a fuse device and installs it in fuse_conn list. fuse_dev_alloc() can fail if fuse_device allocation fails. virtio-fs needs to initialize multiple fuse devices (one per virtio queue). It initializes one fuse device as part of call to fuse_fill_super_common() and rest of the devices are allocated and installed after that. But, we can't affort to fail after calling fuse_fill_super_common() as we don't have a way to undo all the actions done by fuse_fill_super_common(). So to avoid failures after the call to fuse_fill_super_common(), pre-allocate all fuse devices early and install them into fuse connection later. This patch provides two separate helpers for fuse device allocation and fuse device installation in fuse_conn. Signed-off-by: Vivek Goyal <vgoyal@redhat.com>

view details

Stefan Hajnoczi

commit sha 6cfdc18ca4d4985ba900a30c21a2483a719e1d4b

virtio_fs: add skeleton virtio_fs.ko module Add a basic file system module for virtio-fs. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Vivek Goyal <vgoyal@redhat.com> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>

view details

Vivek Goyal

commit sha f02f2b24be82cf4efb72238f0174057185084695

virtio-fs: Do not provide abort interface in fusectl virtio-fs does not support aborting requests which are being processed. That is requests which have been sent to fuse daemon on host. So do not provide "abort" interface for virtio-fs in fusectl. Signed-off-by: Vivek Goyal <vgoyal@redhat.com>

view details

Vivek Goyal

commit sha 7c854a7a2ac7d20a9b048cf402ccc9119b42d766

init/do_mounts.c: add virtio_fs root fs support It is useful to mount the root file system via virtio_fs. During testing a monolithic kernel is more convenient than an initramfs but we'll need to teach the kernel how to boot directly from virtio_fs. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

view details

Stefan Hajnoczi

commit sha 95342434ce48360224b5d912a7c24f685b204dd9

dax: remove block device dependencies Although struct dax_device itself is not tied to a block device, some DAX code assumes there is a block device. Make block devices optional by allowing bdev to be NULL in commonly used DAX APIs. When there is no block device: * Skip the partition offset calculation in bdev_dax_pgoff() * Skip the blkdev_issue_zeroout() optimization Note that more block device assumptions remain but I haven't reach those code paths yet. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

view details

Vivek Goyal

commit sha d4c41be89f9f4c6c6be1c3cd10279bf8aa54b5cd

dax: Pass dax_dev to dax_writeback_mapping_range() Right now dax_writeback_mapping_range() is passed a bdev and dax_dev is searched from that bdev name. virtio-fs does not have a bdev. So pass in dax_dev also to dax_writeback_mapping_range(). If dax_dev is passed in, bdev is not used otherwise dax_dev is searched using bdev. Signed-off-by: Vivek Goyal <vgoyal@redhat.com>

view details

Sebastien Boeuf

commit sha 48487d51381f7d4dc18435aff43e6b5b84950f0a

virtio: Add get_shm_region method Virtio defines 'shared memory regions' that provide a continuously shared region between the host and guest. Provide a method to find a particular region on a device. Signed-off-by: Sebastien Boeuf <sebastien.boeuf@intel.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>

view details

Sebastien Boeuf

commit sha 60dfd88e73dfde8232f8792cc74dcf63abee38a7

virtio: Implement get_shm_region for PCI transport On PCI the shm regions are found using capability entries; find a region by searching for the capability. Signed-off-by: Sebastien Boeuf <sebastien.boeuf@intel.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: kbuild test robot <lkp@intel.com>

view details

Sebastien Boeuf

commit sha ec0a019747b6aa3d59b4047f3d1a7db84a847666

virtio: Implement get_shm_region for MMIO transport On MMIO a new set of registers is defined for finding SHM regions. Add their definitions and use them to find the region. Signed-off-by: Sebastien Boeuf <sebastien.boeuf@intel.com>

view details

Stefan Hajnoczi

commit sha 327022673a4d90e257e91ed509c7240ab33c65f3

fuse, dax: add fuse_conn->dax_dev field A struct dax_device instance is a prerequisite for the DAX filesystem APIs. Let virtio_fs associate a dax_device with a fuse_conn. Classic FUSE and CUSE set the pointer to NULL, disabling DAX. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

view details

Stefan Hajnoczi

commit sha becd09d3c8c38e30eed8a063433802b66ed2e6a4

virtio_fs, dax: Set up virtio_fs dax_device Setup a dax device. Use the shm capability to find the cache entry and map it. The DAX window is accessed by the fs/dax.c infrastructure and must have struct pages (at least on x86). Use devm_memremap_pages() to map the DAX window PCI BAR and allocate struct page. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Vivek Goyal <vgoyal@redhat.com> Signed-off-by: Sebastien Boeuf <sebastien.boeuf@intel.com> Signed-off-by: Liu Bo <bo.liu@linux.alibaba.com>

view details

push time in 3 months

push eventrhvgoyal/libfuse

William Woodruff

commit sha 3dd29049f8eff0e9896b710eb834c3ad6f5fac37

fuse.h: fix typo (currenlty -> currently)

view details

Laszlo Boszormenyi (GCS)

commit sha 644ec8ceca783b51f4eb57319c2f7547c6a31b92

Fix manpage filename for mount.fuse3

view details

Laszlo Boszormenyi (GCS)

commit sha edb0c09bbe18e04e45c49fdbda29710e167b31b9

Source LSB init functions

view details

Nikolaus Rath

commit sha db165f59f2cbcd0ce1c92beac9536a4a4b4b894a

Document that access() is also called on chdir(). Source: Miklos Szeredi on fuse-devel, Wednesday, 4 July 2018 15:29.

view details

Nikolaus Rath

commit sha 0a519c9772e2101c77848da6fa8bf9f8ca2ec56b

Use triple quotes for multiline string. Single quotes will become an error in a future meson release.

view details

Nikolaus Rath

commit sha 415f084ec1cb305930f352dbbb9b468e95c394f9

Don't assume sub-second resolution for st_atime/st_mtime. Fixes: #224

view details

Nikolaus Rath

commit sha 9b74ebdf1b995a3ce56349880287b35f649d0690

Released 3.2.4

view details

Jann Horn

commit sha 34c62ee90c69b07998629f6b5a06ab0120be681c

fusermount: prevent silent truncation of mount options Currently, in the kernel, copy_mount_options() copies in one page of userspace memory (or less if some of that memory area is not mapped). do_mount() then writes a null byte to the last byte of the copied page. This means that mount option strings longer than PAGE_SIZE-1 bytes get truncated silently. Therefore, this can happen: user@d9-ut:~$ _FUSE_COMMFD=10000 fusermount -o "$(perl -e 'print ","x4000')" mount sending file descriptor: Bad file descriptor user@d9-ut:~$ grep /mount /proc/mounts /dev/fuse /home/user/mount fuse rw,nosuid,nodev,relatime,user_id=1000,group_id=1000 0 0 user@d9-ut:~$ fusermount -u mount user@d9-ut:~$ _FUSE_COMMFD=10000 fusermount -o "$(perl -e 'print ","x4050')" mount sending file descriptor: Bad file descriptor user@d9-ut:~$ grep /mount /proc/mounts /dev/fuse /home/user/mount fuse rw,nosuid,nodev,relatime,user_id=1000,group_id=100 0 0 user@d9-ut:~$ fusermount -u mount user@d9-ut:~$ _FUSE_COMMFD=10000 fusermount -o "$(perl -e 'print ","x4051')" mount sending file descriptor: Bad file descriptor user@d9-ut:~$ grep /mount /proc/mounts /dev/fuse /home/user/mount fuse rw,nosuid,nodev,relatime,user_id=1000,group_id=10 0 0 user@d9-ut:~$ fusermount -u mount user@d9-ut:~$ _FUSE_COMMFD=10000 fusermount -o "$(perl -e 'print ","x4052')" mount sending file descriptor: Bad file descriptor user@d9-ut:~$ grep /mount /proc/mounts /dev/fuse /home/user/mount fuse rw,nosuid,nodev,relatime,user_id=1000,group_id=1 0 0 user@d9-ut:~$ fusermount -u mount I'm not aware of any context in which this is actually exploitable - you'd still need the UIDs to fit, and you can't do it if the three GIDs of the process don't match (in the case of a typical setgid binary), but it does look like something that should be fixed. I also plan to try to get this fixed on the kernel side.

view details

Jann Horn

commit sha 28bdae3d113ef479c1660a581ef720cdc33bf466

fusermount: don't feed "escaped commas" into mount options The old code permits the following behavior: $ _FUSE_COMMFD=10000 priv_strace -etrace=mount -s200 fusermount -o 'foobar=\,allow_other' mount mount("/dev/fuse", ".", "fuse", MS_NOSUID|MS_NODEV, "foobar=\\,allow_other,fd=3,rootmode=40000,user_id=1000,group_id=1000") = -1 EINVAL (Invalid argument) However, backslashes do not have any special meaning for the kernel here. As it happens, you can't abuse this because there is no FUSE mount option that takes a string value that can contain backslashes; but this is very brittle. Don't interpret "escape characters" in places where they don't work.

view details

Jann Horn

commit sha cc315f5aa7fae04e16dda419859b2995992977cd

fusermount: bail out on transient config read failure If an attacker wishes to use the default configuration instead of the system's actual configuration, they can attempt to trigger a failure in read_conf(). This only permits increasing mount_max if it is lower than the default, so it's not particularly interesting. Still, this should probably be prevented robustly; bail out if funny stuff happens when we're trying to read the config. Note that the classic attack trick of opening so many files that the system-wide limit is reached won't work here - because fusermount only drops the fsuid, not the euid, the process is running with euid=0 and CAP_SYS_ADMIN, so it bypasses the number-of-globally-open-files check in get_empty_filp() (unless you're inside a user namespace).

view details

Jann Horn

commit sha 5018a0c016495155ee598b7e0167b43d5d902414

fusermount: refuse unknown options Blacklists are notoriously fragile; especially if the kernel wishes to add some security-critical mount option at a later date, all existing systems with older versions of fusermount installed will suddenly have a security problem. Additionally, if the kernel's option parsing became a tiny bit laxer, the blacklist could probably be bypassed. Whitelist known-harmless flags instead, even if it's slightly more inconvenient.

view details

Jann Horn

commit sha 795ad5d77434f3502e63a70c8a3fda94fa347e3d

fusermount: whitelist known-good filesystems for mountpoints Before: $ _FUSE_COMMFD=1 priv_strace -s8000 -e trace=mount util/fusermount3 /proc/self/fd mount("/dev/fuse", ".", "fuse", MS_NOSUID|MS_NODEV, "fd=3,rootmode=40000,user_id=379777,group_id=5001") = 0 sending file descriptor: Socket operation on non-socket +++ exited with 1 +++ After: $ _FUSE_COMMFD=1 priv_strace -s8000 -e trace=mount util/fusermount3 /proc/self/fd util/fusermount3: mounting over filesystem type 0x009fa0 is forbidden +++ exited with 1 +++ This patch could potentially have security impact on some systems that are configured with allow_other; see https://launchpad.net/bugs/1530566 for an example of how a similar issue in the ecryptfs mount helper was exploitable. However, the FUSE mount helper performs slightly different security checks, so that exact attack doesn't work with fusermount; I don't know of any specific attack you could perform using this, apart from faking the SELinux context of your process when someone's looking at a process listing. Potential targets for overwrite are (looking on a system with a 4.9 kernel): writable only for the current process: /proc/self/{fd,map_files} (Yes, "ls -l" claims that you don't have write access, but that's not true; "find -writable" will show you what access you really have.) writable also for other owned processes: /proc/$pid/{sched,autogroup,comm,mem,clear_refs,attr/*,oom_adj, oom_score_adj,loginuid,coredump_filter,uid_map,gid_map,projid_map, setgroups,timerslack_ns}

view details

Rostislav

commit sha 5f125c5e6be24c8d216a4d3c623dc73d742c8c86

Fix readdir() bug when a non-zero offset is specified in filler (#269) The bug occurs when a filesystem client reads a directory until the end, seeks using seekdir() to some valid non-zero position and calls readdir(). A valid 'struct dirent *' is expected, but NULL is returned instead. Pseudocode demonstrating the bug: DIR *dp = opendir("some_dir"); struct dirent *de = readdir(dp); /* Get offset of the second entry */ long offset = telldir(dp); /* Read directory until the end */ while (de) de = readdir(de); seekdir(dp, offset); de = readdir(dp); /* de must contain the second entry, but NULL is returned instead */ The reason of the bug is that when the end of directory is reached, the kernel calls FUSE_READDIR op with an offset at the end of directory, so the filesystem's .readdir callback never calls the filler function, and we end up with dh->filled set to 1. After seekdir(), FUSE_READDIR is called again with a new offset, but this time the filesystem's .readdir callback is never called, and an empty reply is returned. Fix by setting dh->filled to 1 only when zero offsets are given to filler function.

view details

Rostislav Skudnov

commit sha efa3032bc9a6d9028084a8c33c9b31946b16aea1

fusermount: Fix memory leaks

view details

Rostislav Skudnov

commit sha c7ae066cb455ba7beafe8a8b9091a05a36c9bd55

test_write_cache: Fix memory leaks

view details

Rostislav Skudnov

commit sha a2a09e7cca6ddda42c5523654df057fa1578500e

example/{hello,null}: Fix memory leaks

view details

Rostislav Skudnov

commit sha 055fcec831aff1037f5240f50481827b847f8cfa

test_write_cache: Use fuse_session_exit() to stop filesystem thread Using fuse_session_exit() followed by fuse_session_unmount() ensures that a proper cleanup and shutdown is performed.

view details

Nikolaus Rath

commit sha 237147e6e09bec52145e9a25a46aff36ac4459da

Added ChangeLog entry for hardening patches.

view details

Nikolaus Rath

commit sha 932f4190e2b65419cef9960e27a7f94fcab9c816

Released 3.2.5

view details

Rostislav Skudnov

commit sha af47e3e5e63a2732f67b92267cb77790e5f31046

Remove unused member of 'struct fuse_dh'

view details

push time in 3 months

more