Convert to a time_after() expression. #98

kjenova · 2014-05-30T09:43:04Z

No description provided.

Jumping between chains doesn't mix well with flush ruleset. Rules from a different chain and set elements may still refer to us. [ 353.373791] ------------[ cut here ]------------ [ 353.373845] kernel BUG at net/netfilter/nf_tables_api.c:1159! [ 353.373896] invalid opcode: 0000 [#1] SMP [ 353.373942] Modules linked in: intel_powerclamp uas iwldvm iwlwifi [ 353.374017] CPU: 0 PID: 6445 Comm: 31c3.nft Not tainted 3.18.0 #98 [ 353.374069] Hardware name: LENOVO 5129CTO/5129CTO, BIOS 6QET47WW (1.17 ) 07/14/2010 [...] [ 353.375018] Call Trace: [ 353.375046] [<ffffffff81964c31>] ? nf_tables_commit+0x381/0x540 [ 353.375101] [<ffffffff81949118>] nfnetlink_rcv+0x3d8/0x4b0 [ 353.375150] [<ffffffff81943fc5>] netlink_unicast+0x105/0x1a0 [ 353.375200] [<ffffffff8194438e>] netlink_sendmsg+0x32e/0x790 [ 353.375253] [<ffffffff818f398e>] sock_sendmsg+0x8e/0xc0 [ 353.375300] [<ffffffff818f36b9>] ? move_addr_to_kernel.part.20+0x19/0x70 [ 353.375357] [<ffffffff818f44f9>] ? move_addr_to_kernel+0x19/0x30 [ 353.375410] [<ffffffff819016d2>] ? verify_iovec+0x42/0xd0 [ 353.375459] [<ffffffff818f3e10>] ___sys_sendmsg+0x3f0/0x400 [ 353.375510] [<ffffffff810615fa>] ? native_sched_clock+0x2a/0x90 [ 353.375563] [<ffffffff81176697>] ? acct_account_cputime+0x17/0x20 [ 353.375616] [<ffffffff8110dc78>] ? account_user_time+0x88/0xa0 [ 353.375667] [<ffffffff818f4bbd>] __sys_sendmsg+0x3d/0x80 [ 353.375719] [<ffffffff81b184f4>] ? int_check_syscall_exit_work+0x34/0x3d [ 353.375776] [<ffffffff818f4c0d>] SyS_sendmsg+0xd/0x20 [ 353.375823] [<ffffffff81b1826d>] system_call_fastpath+0x16/0x1b Release objects in this order: rules -> sets -> chains -> tables, to make sure no references to chains are held anymore. Reported-by: Asbjoern Sloth Toennesen <[email protected]> Signed-off-by: Pablo Neira Ayuso <[email protected]>

commit a2f18db upstream. Jumping between chains doesn't mix well with flush ruleset. Rules from a different chain and set elements may still refer to us. [ 353.373791] ------------[ cut here ]------------ [ 353.373845] kernel BUG at net/netfilter/nf_tables_api.c:1159! [ 353.373896] invalid opcode: 0000 [#1] SMP [ 353.373942] Modules linked in: intel_powerclamp uas iwldvm iwlwifi [ 353.374017] CPU: 0 PID: 6445 Comm: 31c3.nft Not tainted 3.18.0 #98 [ 353.374069] Hardware name: LENOVO 5129CTO/5129CTO, BIOS 6QET47WW (1.17 ) 07/14/2010 [...] [ 353.375018] Call Trace: [ 353.375046] [<ffffffff81964c31>] ? nf_tables_commit+0x381/0x540 [ 353.375101] [<ffffffff81949118>] nfnetlink_rcv+0x3d8/0x4b0 [ 353.375150] [<ffffffff81943fc5>] netlink_unicast+0x105/0x1a0 [ 353.375200] [<ffffffff8194438e>] netlink_sendmsg+0x32e/0x790 [ 353.375253] [<ffffffff818f398e>] sock_sendmsg+0x8e/0xc0 [ 353.375300] [<ffffffff818f36b9>] ? move_addr_to_kernel.part.20+0x19/0x70 [ 353.375357] [<ffffffff818f44f9>] ? move_addr_to_kernel+0x19/0x30 [ 353.375410] [<ffffffff819016d2>] ? verify_iovec+0x42/0xd0 [ 353.375459] [<ffffffff818f3e10>] ___sys_sendmsg+0x3f0/0x400 [ 353.375510] [<ffffffff810615fa>] ? native_sched_clock+0x2a/0x90 [ 353.375563] [<ffffffff81176697>] ? acct_account_cputime+0x17/0x20 [ 353.375616] [<ffffffff8110dc78>] ? account_user_time+0x88/0xa0 [ 353.375667] [<ffffffff818f4bbd>] __sys_sendmsg+0x3d/0x80 [ 353.375719] [<ffffffff81b184f4>] ? int_check_syscall_exit_work+0x34/0x3d [ 353.375776] [<ffffffff818f4c0d>] SyS_sendmsg+0xd/0x20 [ 353.375823] [<ffffffff81b1826d>] system_call_fastpath+0x16/0x1b Release objects in this order: rules -> sets -> chains -> tables, to make sure no references to chains are held anymore. Reported-by: Asbjoern Sloth Toennesen <[email protected]> Signed-off-by: Pablo Neira Ayuso <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>

Odroidc 3.10.y

This patch removes unnecessary mutex queue unlock/lock sequence causing bad unlock balance in v4l2_m2m_poll when the last buffer on the destination queue has been dequeued and adds spin lock protection for the done list list_empty calls. [ 144.990873] ===================================== [ 144.995584] [ BUG: bad unlock balance detected! ] [ 145.000301] 4.1.0-00137-ga105070 torvalds#98 Tainted: G W [ 145.006140] ------------------------------------- [ 145.010851] demux:sink/487 is trying to release lock (&dev->dev_mutex) at: [ 145.017785] [<808cc578>] mutex_unlock+0x18/0x1c [ 145.022322] but there are no more locks to release! [ 145.027205] [ 145.027205] other info that might help us debug this: [ 145.033741] no locks held by demux:sink/487. [ 145.038015] [ 145.038015] stack backtrace: [ 145.042385] CPU: 2 PID: 487 Comm: demux:sink Tainted: G W 4.1.0-00137-ga105070 torvalds#98 [ 145.051089] Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree) [ 145.057622] Backtrace: [ 145.060102] [<80014a4c>] (dump_backtrace) from [<80014cc4>] (show_stack+0x20/0x24) [ 145.067679] r6:80cedf78 r5:00000000 r4:00000000 r3:00000000 [ 145.073421] [<80014ca4>] (show_stack) from [<808c61e0>] (dump_stack+0x8c/0xa4) [ 145.080661] [<808c6154>] (dump_stack) from [<80072b64>] (print_unlock_imbalance_bug+0xb8/0xe8) [ 145.089277] r6:808cc578 r5:ac6cd050 r4:ac38e400 r3:00000001 [ 145.095020] [<80072aac>] (print_unlock_imbalance_bug) from [<80077db4>] (lock_release+0x1a4/0x250) [ 145.103983] r6:808cc578 r5:ac6cd050 r4:ac38e400 r3:00000000 [ 145.109728] [<80077c10>] (lock_release) from [<808cc470>] (__mutex_unlock_slowpath+0xc4/0x1b4) [ 145.118344] r9:acb27a41 r8:00000000 r7:81553814 r6:808cc578 r5:60030013 r4:ac6cd01c [ 145.126190] [<808cc3ac>] (__mutex_unlock_slowpath) from [<808cc578>] (mutex_unlock+0x18/0x1c) [ 145.134720] r7:00000000 r6:aced7cd4 r5:00000041 r4:acb87800 [ 145.140468] [<808cc560>] (mutex_unlock) from [<805a98b8>] (v4l2_m2m_fop_poll+0x5c/0x64) [ 145.148494] [<805a985c>] (v4l2_m2m_fop_poll) from [<805955a0>] (v4l2_poll+0x6c/0xa0) [ 145.156243] r6:aced7bec r5:00000000 r4:ac6cc380 r3:805a985c [ 145.161991] [<80595534>] (v4l2_poll) from [<80156edc>] (do_sys_poll+0x230/0x4c0) [ 145.169391] r5:00000000 r4:aced7be4 [ 145.173013] [<80156cac>] (do_sys_poll) from [<801574a8>] (SyS_ppoll+0x1d4/0x1fc) [ 145.180414] r10:00000000 r9:aced6000 r8:00000000 r7:00000000 r6:75c04538 r5:00000002 [ 145.188338] r4:00000000 [ 145.190906] [<801572d4>] (SyS_ppoll) from [<800108c0>] (ret_fast_syscall+0x0/0x54) [ 145.198481] r8:80010aa4 r7:00000150 r6:75c04538 r5:00000002 r4:00000008 Signed-off-by: Zahari Doychev <[email protected]> Acked-by: Marek Szyprowski <[email protected]> Signed-off-by: Hans Verkuil <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>

commit a2f18db upstream. Jumping between chains doesn't mix well with flush ruleset. Rules from a different chain and set elements may still refer to us. [ 353.373791] ------------[ cut here ]------------ [ 353.373845] kernel BUG at net/netfilter/nf_tables_api.c:1159! [ 353.373896] invalid opcode: 0000 [#1] SMP [ 353.373942] Modules linked in: intel_powerclamp uas iwldvm iwlwifi [ 353.374017] CPU: 0 PID: 6445 Comm: 31c3.nft Not tainted 3.18.0 torvalds#98 [ 353.374069] Hardware name: LENOVO 5129CTO/5129CTO, BIOS 6QET47WW (1.17 ) 07/14/2010 [...] [ 353.375018] Call Trace: [ 353.375046] [<ffffffff81964c31>] ? nf_tables_commit+0x381/0x540 [ 353.375101] [<ffffffff81949118>] nfnetlink_rcv+0x3d8/0x4b0 [ 353.375150] [<ffffffff81943fc5>] netlink_unicast+0x105/0x1a0 [ 353.375200] [<ffffffff8194438e>] netlink_sendmsg+0x32e/0x790 [ 353.375253] [<ffffffff818f398e>] sock_sendmsg+0x8e/0xc0 [ 353.375300] [<ffffffff818f36b9>] ? move_addr_to_kernel.part.20+0x19/0x70 [ 353.375357] [<ffffffff818f44f9>] ? move_addr_to_kernel+0x19/0x30 [ 353.375410] [<ffffffff819016d2>] ? verify_iovec+0x42/0xd0 [ 353.375459] [<ffffffff818f3e10>] ___sys_sendmsg+0x3f0/0x400 [ 353.375510] [<ffffffff810615fa>] ? native_sched_clock+0x2a/0x90 [ 353.375563] [<ffffffff81176697>] ? acct_account_cputime+0x17/0x20 [ 353.375616] [<ffffffff8110dc78>] ? account_user_time+0x88/0xa0 [ 353.375667] [<ffffffff818f4bbd>] __sys_sendmsg+0x3d/0x80 [ 353.375719] [<ffffffff81b184f4>] ? int_check_syscall_exit_work+0x34/0x3d [ 353.375776] [<ffffffff818f4c0d>] SyS_sendmsg+0xd/0x20 [ 353.375823] [<ffffffff81b1826d>] system_call_fastpath+0x16/0x1b Release objects in this order: rules -> sets -> chains -> tables, to make sure no references to chains are held anymore. Reported-by: Asbjoern Sloth Toennesen <[email protected]> Signed-off-by: Pablo Neira Ayuso <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]> Signed-off-by: Sasha Levin <[email protected]>

Discrepancy between cpu_online_mask and cpuset's effective CPU masks on cpuset hierarchy is inevitable since cpuset defers updating of effective CPU masks with workqueue while nothing prevents system from doing CPU hotplug. For that reason guarantee_online_cpus() walks up the cpuset hierarchy until it finds intersection under the assumption that top cpuset's effective CPU mask intersects with cpu_online_mask even under such race. However a sequence of CPU hotplugs can open a time window which is none of effective CPUs in the top cpuset intersects with cpu_online_mask. For example when there are 4 possible CPUs 0-3 where only CPU0 is online: ======================== =========================== cpu_online_mask top_cpuset.effective_cpus ======================== =========================== echo 1 > cpu2/online. CPU hotplug notifier woke up hotplug work but not yet scheduled. [0,2] [0] echo 0 > cpu0/online. The workqueue is still runnable. [2] [0] ======================== =========================== Now there is no intersection between cpu_online_mask and top_cpuset.effective_cpus. Thus invoking sys_sched_setaffinity() at this moment can cause following: Unable to handle kernel NULL pointer dereference at virtual address 000000d0 ------------[ cut here ]------------ Kernel BUG at ffffffc0001389b0 [verbose debug info unavailable] Internal error: Oops - BUG: 96000005 [#1] PREEMPT SMP Modules linked in: CPU: 2 PID: 1420 Comm: taskset Tainted: G W 4.4.8+ torvalds#98 task: ffffffc06a5c4880 ti: ffffffc06e124000 task.ti: ffffffc06e124000 PC is at guarantee_online_cpus+0x2c/0x58 LR is at cpuset_cpus_allowed+0x4c/0x6c <snip> Process taskset (pid: 1420, stack limit = 0xffffffc06e124020) Call trace: [<ffffffc0001389b0>] guarantee_online_cpus+0x2c/0x58 [<ffffffc00013b208>] cpuset_cpus_allowed+0x4c/0x6c [<ffffffc0000d61f0>] sched_setaffinity+0xc0/0x1ac [<ffffffc0000d6374>] SyS_sched_setaffinity+0x98/0xac [<ffffffc000085cb0>] el0_svc_naked+0x24/0x28 The top cpuset's effective_cpus are guaranteed to be identical to online CPUs eventually. Hence fall back to online CPU mask when there is no intersection between top cpuset's effective_cpus and online CPU mask. Signed-off-by: Joonwoo Park <[email protected]> Cc: Li Zefan <[email protected]> Cc: [email protected] Cc: [email protected]

A discrepancy between cpu_online_mask and cpuset's effective_cpus mask is inevitable during hotplug since cpuset defers updating of effective_cpus mask using a workqueue, during which time nothing prevents the system from more hotplug operations. For that reason guarantee_online_cpus() walks up the cpuset hierarchy until it finds an intersection under the assumption that top cpuset's effective_cpus mask intersects with cpu_online_mask even with such a race occurring. However a sequence of CPU hotplugs can open a time window, during which none of the effective CPUs in the top cpuset intersect with cpu_online_mask. For example when there are 4 possible CPUs 0-3 and only CPU0 is online: ======================== =========================== cpu_online_mask top_cpuset.effective_cpus ======================== =========================== echo 1 > cpu2/online. CPU hotplug notifier woke up hotplug work but not yet scheduled. [0,2] [0] echo 0 > cpu0/online. The workqueue is still runnable. [2] [0] ======================== =========================== Now there is no intersection between cpu_online_mask and top_cpuset.effective_cpus. Thus invoking sys_sched_setaffinity() at this moment can cause following: Unable to handle kernel NULL pointer dereference at virtual address 000000d0 ------------[ cut here ]------------ Kernel BUG at ffffffc0001389b0 [verbose debug info unavailable] Internal error: Oops - BUG: 96000005 [#1] PREEMPT SMP Modules linked in: CPU: 2 PID: 1420 Comm: taskset Tainted: G W 4.4.8+ torvalds#98 task: ffffffc06a5c4880 ti: ffffffc06e124000 task.ti: ffffffc06e124000 PC is at guarantee_online_cpus+0x2c/0x58 LR is at cpuset_cpus_allowed+0x4c/0x6c <snip> Process taskset (pid: 1420, stack limit = 0xffffffc06e124020) Call trace: [<ffffffc0001389b0>] guarantee_online_cpus+0x2c/0x58 [<ffffffc00013b208>] cpuset_cpus_allowed+0x4c/0x6c [<ffffffc0000d61f0>] sched_setaffinity+0xc0/0x1ac [<ffffffc0000d6374>] SyS_sched_setaffinity+0x98/0xac [<ffffffc000085cb0>] el0_svc_naked+0x24/0x28 The top cpuset's effective_cpus are guaranteed to be identical to cpu_online_mask eventually. Hence fall back to cpu_online_mask when there is no intersection between top cpuset's effective_cpus and cpu_online_mask. Signed-off-by: Joonwoo Park <[email protected]> Cc: Li Zefan <[email protected]> Cc: Tejun Heo <[email protected]> Cc: [email protected] Cc: [email protected] Cc: <[email protected]> # 3.17+

A discrepancy between cpu_online_mask and cpuset's effective_cpus mask is inevitable during hotplug since cpuset defers updating of effective_cpus mask using a workqueue, during which time nothing prevents the system from more hotplug operations. For that reason guarantee_online_cpus() walks up the cpuset hierarchy until it finds an intersection under the assumption that top cpuset's effective_cpus mask intersects with cpu_online_mask even with such a race occurring. However a sequence of CPU hotplugs can open a time window, during which none of the effective CPUs in the top cpuset intersect with cpu_online_mask. For example when there are 4 possible CPUs 0-3 and only CPU0 is online: ======================== =========================== cpu_online_mask top_cpuset.effective_cpus ======================== =========================== echo 1 > cpu2/online. CPU hotplug notifier woke up hotplug work but not yet scheduled. [0,2] [0] echo 0 > cpu0/online. The workqueue is still runnable. [2] [0] ======================== =========================== Now there is no intersection between cpu_online_mask and top_cpuset.effective_cpus. Thus invoking sys_sched_setaffinity() at this moment can cause following: Unable to handle kernel NULL pointer dereference at virtual address 000000d0 ------------[ cut here ]------------ Kernel BUG at ffffffc0001389b0 [verbose debug info unavailable] Internal error: Oops - BUG: 96000005 [#1] PREEMPT SMP Modules linked in: CPU: 2 PID: 1420 Comm: taskset Tainted: G W 4.4.8+ torvalds#98 task: ffffffc06a5c4880 ti: ffffffc06e124000 task.ti: ffffffc06e124000 PC is at guarantee_online_cpus+0x2c/0x58 LR is at cpuset_cpus_allowed+0x4c/0x6c <snip> Process taskset (pid: 1420, stack limit = 0xffffffc06e124020) Call trace: [<ffffffc0001389b0>] guarantee_online_cpus+0x2c/0x58 [<ffffffc00013b208>] cpuset_cpus_allowed+0x4c/0x6c [<ffffffc0000d61f0>] sched_setaffinity+0xc0/0x1ac [<ffffffc0000d6374>] SyS_sched_setaffinity+0x98/0xac [<ffffffc000085cb0>] el0_svc_naked+0x24/0x28 The top cpuset's effective_cpus are guaranteed to be identical to cpu_online_mask eventually. Hence fall back to cpu_online_mask when there is no intersection between top cpuset's effective_cpus and cpu_online_mask. Signed-off-by: Joonwoo Park <[email protected]> Acked-by: Li Zefan <[email protected]> Cc: Tejun Heo <[email protected]> Cc: [email protected] Cc: [email protected] Cc: <[email protected]> # 3.17+ Signed-off-by: Tejun Heo <[email protected]>

GIT c872503677d0b2209065cf0b739db82a2de84f2d commit c872503677d0b2209065cf0b739db82a2de84f2d Author: Stephen Rothwell <[email protected]> Date: Wed Sep 14 14:22:25 2016 +1000 partial revert of 797da5598f3a ("PM / devfreq: Add COMPILE_TEST for build coverage") Signed-off-by: Stephen Rothwell <[email protected]> commit e74e83724808b72173b557bd8008202109fb6091 Author: Fabio Estevam <[email protected]> Date: Thu Sep 8 09:34:32 2016 -0300 usb: chipidea: udc: Use the preferred form for passing a size of a struct According to Documentation/CodingStyle: "The preferred form for passing a size of a struct is the following: p = kmalloc(sizeof(*p), ...); " , so do as suggested to improve readability. Signed-off-by: Fabio Estevam <[email protected]> Signed-off-by: Peter Chen <[email protected]> commit 58001effe172f300d558dffbd723c8521b9404f2 Author: Fabio Estevam <[email protected]> Date: Thu Sep 8 09:34:31 2016 -0300 usb: chipidea: udc: Fit into a single line No need to split the dma_pool_zalloc() line into two as it can perfectly fit into a single line. Signed-off-by: Fabio Estevam <[email protected]> Signed-off-by: Peter Chen <[email protected]> commit 382c1b38d8e70b2fe239c96bb9137c10f3229ba3 Author: Fabio Estevam <[email protected]> Date: Thu Sep 8 09:34:30 2016 -0300 usb: chipidea: udc: Use dma_pool_zalloc() We can make the code simpler by using dma_pool_zalloc() instead of calling dma_pool_alloc() and then a memset(). Signed-off-by: Fabio Estevam <[email protected]> Signed-off-by: Peter Chen <[email protected]> commit c744a0db756b34c7e2b60100bcfc58beb6b68c99 Author: Lucas Stach <[email protected]> Date: Mon Aug 15 16:09:07 2016 +0200 usb: chipidea: host: disable io watchdog The Chipidea EHCI core seems to behave sanely and doesn't need the IO watchdog. This kills off 10 non-deferrable wakeup events per second when the controller is otherwise idle. Signed-off-by: Lucas Stach <[email protected]> Tested-by: Stefan Agner <[email protected]> Signed-off-by: Peter Chen <[email protected]> commit c6ee9f2345a2d95a986309a6486ae780f563230a Author: Stefan Wahren <[email protected]> Date: Thu Aug 11 17:19:13 2016 +0000 usb: chipidea: udc: Use direction flags consequently This driver make assumptions about the value of the direction flags. So better use them in comparisons to improve the readability. Signed-off-by: Stefan Wahren <[email protected]> Signed-off-by: Peter Chen <[email protected]> commit 9dba516ed282e3d16481051be547b54caa312029 Author: Li Jun <[email protected]> Date: Wed Jul 20 16:02:42 2016 +0800 usb: chipidea: imx: set over current polarity per dts setting imx usb over current polarity is low active by default, with over-current-active-high property added, user can config it to be high active. Meanwhile keep this setting unchanged for existing platforms so new platform must set the right value for active low by its usbmisc init function if over current is enabled. Signed-off-by: Li Jun <[email protected]> Signed-off-by: Peter Chen <[email protected]> commit e5b3253dcc8c6a2cb2b13916e77afe9fdfe55d27 Author: Li Jun <[email protected]> Date: Wed Jul 20 16:02:41 2016 +0800 doc: usb: ci-hdrc-usb2: add property over-current-active-high Adding over-current-active-high to indicate the over current flag is high active as typically we use active low for over current polarity. Signed-off-by: Li Jun <[email protected]> Signed-off-by: Peter Chen <[email protected]> Acked-by: Rob Herring <[email protected]> commit 5de97f8bd74dd87d8856f17b585a7c221b535969 Author: Li Jun <[email protected]> Date: Wed Jul 20 16:02:40 2016 +0800 doc: usb: usbmisc-imx: add imx7d compatible string Add compatible string for imx7d-usbmisc. Acked-by: Rob Herring <[email protected]> Signed-off-by: Li Jun <[email protected]> Signed-off-by: Peter Chen <[email protected]> commit 8007eb4e1824e52483ad99fb229fc56e6a73cec6 Author: Stefan Wahren <[email protected]> Date: Sat Jul 9 14:16:39 2016 +0000 usb: chipidea: udc: Don't flush endpoint fifo twice The endpoint fifo is already flushed in _ep_nuke so there is no need to flush it twice. Signed-off-by: Stefan Wahren <[email protected]> Signed-off-by: Peter Chen <[email protected]> commit 66b76dbe37df88b250ffdac186adba3e5dc24631 Author: Stefan Wahren <[email protected]> Date: Sat Jul 9 14:16:38 2016 +0000 usb: chipidea: udc: move write barrier into hw_ep_prime Since there should be a write barrier before every call of hw_ep_prime we could move it into hw_ep_prime. Signed-off-by: Stefan Wahren <[email protected]> Signed-off-by: Peter Chen <[email protected]> commit 2e06285655b59362847b610a7cfad204fee9640b Author: Baoyou Xie <[email protected]> Date: Thu Sep 1 19:15:35 2016 +0800 vfio: platform: mark symbols static where possible We get a few warnings when building kernel with W=1: drivers/vfio/platform/vfio_platform_common.c:76:5: warning: no previous prototype for 'vfio_platform_acpi_call_reset' [-Wmissing-prototypes] drivers/vfio/platform/vfio_platform_common.c:98:6: warning: no previous prototype for 'vfio_platform_acpi_has_reset' [-Wmissing-prototypes] drivers/vfio/platform/vfio_platform_common.c:640:5: warning: no previous prototype for 'vfio_platform_of_probe' [-Wmissing-prototypes] drivers/vfio/platform/reset/vfio_platform_amdxgbe.c:59:5: warning: no previous prototype for 'vfio_platform_amdxgbe_reset' [-Wmissing-prototypes] drivers/vfio/platform/reset/vfio_platform_calxedaxgmac.c:60:5: warning: no previous prototype for 'vfio_platform_calxedaxgmac_reset' [-Wmissing-prototypes] .... In fact, these functions are only used in the file in which they are declared and don't need a declaration, but can be made static. so this patch marks these functions with 'static'. Signed-off-by: Baoyou Xie <[email protected]> Acked-by: Arnd Bergmann <[email protected]> Reviewed-by: Eric Auger <[email protected]> Reviewed-by: Baptiste Reynal <[email protected]> Signed-off-by: Alex Williamson <[email protected]> commit 9b6a9ecc2d88ccdc57efc22d69436b9dd7e2eceb Author: Wei Yongjun <[email protected]> Date: Sat Sep 10 07:43:48 2016 +0000 selinux: fix error return code in policydb_read() Fix to return error code -EINVAL from the error handling case instead of 0 (rc is overwrite to 0 when policyvers >= POLICYDB_VERSION_ROLETRANS), as done elsewhere in this function. Signed-off-by: Wei Yongjun <[email protected]> [PM: normalize "selinux" in patch subject, description line wrap] Signed-off-by: Paul Moore <[email protected]> commit 035ee288ae7ade4152f1c3cf23a587b04fdc526c Author: Lukas Wunner <[email protected]> Date: Tue Sep 6 06:20:46 2016 +0200 PCI: Fix bridge_d3 update on device removal Starting with v4.8, we allow a PCIe port to runtime suspend to D3hot if the port itself and its children satisfy a number of conditions. Once a child is removed, we recheck those conditions in case the removed device was blocking the port from suspending. The rechecking needs to happen *after* the device has been removed from the bus it resides on. Otherwise when walking the port's subordinate bus in pci_bridge_d3_update(), the device being removed would erroneously still be taken into account. However the device is removed from the bus_list in pci_destroy_dev() and we currently recheck *before* that. Fix it. Fixes: 9d26d3a8f1b0 ("PCI: Put PCIe ports into D3 during suspend") Signed-off-by: Lukas Wunner <[email protected]> Signed-off-by: Bjorn Helgaas <[email protected]> Reviewed-by: Mika Westerberg <[email protected]> Acked-by: Rafael J. Wysocki <[email protected]> commit 649d7df29ca83b2c9e81a4a305a8de8ab02b5e9d Author: Jaegeuk Kim <[email protected]> Date: Tue Sep 6 11:02:03 2016 -0700 f2fs: fix to set PageUptodate in f2fs_write_end correctly Previously, f2fs_write_begin sets PageUptodate all the time. But, when user tries to update the entire page (i.e., len == PAGE_SIZE), we need to consider that the page is able to be copied partially afterwards. In such the case, we will lose the remaing region in the page. This patch fixes this by setting PageUptodate in f2fs_write_end as given copied result. In the short copy case, it returns zero to let generic_perform_write retry copying user data again. As a result, f2fs_write_end() works: PageUptodate len copied return retry 1. no 4096 4096 4096 false -> return 4096 2. no 4096 1024 0 true -> goto #1 case 3. yes 2048 2048 2048 false -> return 2048 4. yes 2048 1024 1024 false -> return 1024 Suggested-by: Al Viro <[email protected]> Signed-off-by: Jaegeuk Kim <[email protected]> commit 61e4da1172d18f5277be847a40559eacd3169ce7 Author: Fan Li <[email protected]> Date: Sat Sep 10 11:19:37 2016 +0800 f2fs: fix parameters of __exchange_data_block __exchange_data_block should take block indexes as parameters instead of offsets in bytes. Signed-off-by: Fan li <[email protected]> Signed-off-by: Jaegeuk Kim <[email protected]> commit 9512929608891830f4194e1959b667b43d86e619 Author: Chao Yu <[email protected]> Date: Fri Sep 9 08:38:20 2016 +0800 MAINTAINERS: update f2fs entry This patch includes below modifications: 1. change my maintainership from reviewer to maintainer. 2. remove maintainership of Changman Lee since he is not active about one and a half year. 3. change website of f2fs from wiki to kernel one. Signed-off-by: Chao Yu <[email protected]> Signed-off-by: Jaegeuk Kim <[email protected]> commit e8ea9b3d7e278d2ef4b60e703f780ceee70cb331 Author: Jaegeuk Kim <[email protected]> Date: Fri Sep 9 16:59:39 2016 -0700 f2fs: avoid ENOMEM during roll-forward recovery This patch gives another chances during roll-forward recovery regarding to -ENOMEM. Signed-off-by: Jaegeuk Kim <[email protected]> commit f148b41e8b2e114d0aba023adf326b03368f3246 Author: Masahiro Yamada <[email protected]> Date: Sun Sep 11 14:58:21 2016 +0900 x86: Clean up various simple wrapper functions Remove unneeded variables and assignments. While we are here, let's fix the following as well: - Remove unnecessary parentheses - Remove unnecessary unsigned-suffix 'U' from constant values - Reword the comment in set_apic_id() (suggested by Thomas Gleixner) Signed-off-by: Masahiro Yamada <[email protected]> Cc: Alex Thorlton <[email protected]> Cc: Andrew Banman <[email protected]> Cc: Borislav Petkov <[email protected]> Cc: Daniel J Blueman <[email protected]> Cc: Denys Vlasenko <[email protected]> Cc: Dimitri Sivanich <[email protected]> Cc: Linus Torvalds <[email protected]> Cc: Matt Fleming <[email protected]> Cc: Mike Travis <[email protected]> Cc: Nathan Zimmer <[email protected]> Cc: Paul Gortmaker <[email protected]> Cc: Peter Zijlstra <[email protected]> Cc: Steffen Persvold <[email protected]> Cc: Thomas Gleixner <[email protected]> Cc: Toshi Kani <[email protected]> Cc: Wei Jiangang <[email protected]> Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Ingo Molnar <[email protected]> commit 85063fac1f72419eec4349621fe829b07f9acb1e Author: Andy Lutomirski <[email protected]> Date: Mon Sep 12 15:05:51 2016 -0700 x86/entry/64: Clean up and document espfix64 stack setup The espfix64 setup code was a bit inscrutible and contained an unnecessary push of RAX. Remove that push, update all the stack offsets to match, and document the whole mess. Reported-By: Borislav Petkov <[email protected]> Signed-off-by: Andy Lutomirski <[email protected]> Reviewed-by: Borislav Petkov <[email protected]> Cc: Borislav Petkov <[email protected]> Cc: Brian Gerst <[email protected]> Cc: Denys Vlasenko <[email protected]> Cc: H. Peter Anvin <[email protected]> Cc: Josh Poimboeuf <[email protected]> Cc: Linus Torvalds <[email protected]> Cc: Peter Zijlstra <[email protected]> Cc: Thomas Gleixner <[email protected]> Link: http://lkml.kernel.org/r/e5459eb10cf1175c8b36b840bc425f210d045f35.1473717910.git.luto@kernel.org Signed-off-by: Ingo Molnar <[email protected]> commit 1ef0199a1a698d82ecd39d11d1daa3f4ab006c75 Author: Andy Lutomirski <[email protected]> Date: Mon Sep 12 15:05:50 2016 -0700 selftests/x86/sigreturn: Use CX, not AX, as the scratch register RAX is handled specially in ESPFIX64. Use CX as our scratch register so that, if something goes wrong with RAX handling, we'll notice. Signed-off-by: Andy Lutomirski <[email protected]> Reviewed-by: Borislav Petkov <[email protected]> Cc: Borislav Petkov <[email protected]> Cc: Brian Gerst <[email protected]> Cc: Denys Vlasenko <[email protected]> Cc: H. Peter Anvin <[email protected]> Cc: Josh Poimboeuf <[email protected]> Cc: Linus Torvalds <[email protected]> Cc: Peter Zijlstra <[email protected]> Cc: Shuah Khan <[email protected]> Cc: Thomas Gleixner <[email protected]> Link: http://lkml.kernel.org/r/9ceeb24ea56925586c330dc46306f757ddea9fb5.1473717910.git.luto@kernel.org Signed-off-by: Ingo Molnar <[email protected]> commit d59dc7bcfa649ef2128a76b6487b16f4b3f14d23 Author: Rik van Riel <[email protected]> Date: Thu Sep 8 21:30:53 2016 -0400 sched/numa, mm: Revert to checking pmd/pte_write instead of VMA flags Commit: 4d9424669946 ("mm: convert p[te|md]_mknonnuma and remaining page table manipulations") changed NUMA balancing from _PAGE_NUMA to using PROT_NONE, and was quickly found to introduce a regression with NUMA grouping. It was followed up by these commits: 53da3bc2ba9e ("mm: fix up numa read-only thread grouping logic") bea66fbd11af ("mm: numa: group related processes based on VMA flags instead of page table flags") b191f9b106ea ("mm: numa: preserve PTE write permissions across a NUMA hinting fault") The first of those two commits try alternate approaches to NUMA grouping, which apparently do not work as well as looking at the PTE write permissions. The latter patch preserves the PTE write permissions across a NUMA protection fault. However, it forgets to revert the condition for whether or not to group tasks together back to what it was before v3.19, even though the information is now preserved in the page tables once again. This patch brings the NUMA grouping heuristic back to what it was before commit 4d9424669946, which the changelogs of subsequent commits suggest worked best. We have all the information again. We should probably use it. Signed-off-by: Rik van Riel <[email protected]> Cc: Linus Torvalds <[email protected]> Cc: Peter Zijlstra <[email protected]> Cc: Thomas Gleixner <[email protected]> Cc: [email protected] Cc: [email protected] Cc: [email protected] Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Ingo Molnar <[email protected]> commit f1e19f7a76548726df866e1f16aead5e19acc0a3 Author: Johannes Berg <[email protected]> Date: Tue Sep 13 17:08:23 2016 +0200 cfg80211: allow connect keys only with default (TX) key There's no point in allowing connect keys when one of them isn't also configured as the TX key, it would just confuse drivers and probably cause them to pick something for TX. Disallow this confusing and erroneous configuration. Signed-off-by: Johannes Berg <[email protected]> commit 89b706fb28e431fa7639348536c284fb375eb3c0 Author: Johannes Berg <[email protected]> Date: Tue Sep 13 16:39:38 2016 +0200 cfg80211: reduce connect key caching struct size After the previous patches, connect keys can only (correctly) be used for storing static WEP keys. Therefore, remove all the data for dealing with key index 4/5 and reduce the size of the key material to the maximum for WEP keys. Signed-off-by: Johannes Berg <[email protected]> commit e9c8f8d3a4d54106a30f2b981b53d658c9bc0c8e Author: Johannes Berg <[email protected]> Date: Tue Sep 13 16:37:40 2016 +0200 cfg80211: validate key index better Don't accept it if a key_idx < 0 snuck through, reject WEP keys with key index 4 and 5 (which are used for IGTKs) and don't allow IGTKs with key indices other than 4 and 5. This makes the key data match expectations better. Signed-off-by: Johannes Berg <[email protected]> commit 9381e267b69acfea96c8429dc99da3e78835cef1 Author: Johannes Berg <[email protected]> Date: Tue Sep 13 16:11:32 2016 +0200 cfg80211: wext: only allow WEP keys to be configured before connected When not connected, anything but WEP keys shouldn't be allowed to be configured for later - only static WEP keys make sense at this point. Change wext to reject anything else just like nl80211 does. Signed-off-by: Johannes Berg <[email protected]> commit 386b1f273850380a1887044673922843736c6d0a Author: Johannes Berg <[email protected]> Date: Tue Sep 13 16:10:02 2016 +0200 nl80211: only allow WEP keys during connect command This was already documented that way in nl80211.h, but the parsing code still accepted other key types. Change it to really only accept WEP keys as documented. Signed-off-by: Johannes Berg <[email protected]> commit 42ee231cd12c2e1eb015163d04a65950e895d4b7 Author: Johannes Berg <[email protected]> Date: Tue Sep 13 15:51:03 2016 +0200 nl80211: fix connect keys range check Only key index 0-3 should be accepted, 4/5 are for IGTKs and cannot be used as connect keys. Fix the range checking to not allow such erroneous configurations. Signed-off-by: Johannes Berg <[email protected]> commit b6b5555bc89f52e49244104ca4d7764c7b0f11cd Author: Johannes Berg <[email protected]> Date: Tue Sep 13 16:25:58 2016 +0200 cfg80211: disallow shared key authentication with key index 4 Key index 4 can only be used for an IGTK, so the range checks for shared key authentication should treat 4 as an error, fix that in the code. Signed-off-by: Johannes Berg <[email protected]> commit ad5987b47e96a0fb6d13fea250e936aed000093c Author: Johannes Berg <[email protected]> Date: Tue Sep 13 15:53:55 2016 +0200 nl80211: validate number of probe response CSA counters Due to an apparent copy/paste bug, the number of counters for the beacon configuration were checked twice, instead of checking the number of probe response counters. Fix this to check the number of probe response counters before parsing those. Cc: [email protected] Fixes: 9a774c78e211 ("cfg80211: Support multiple CSA counters") Signed-off-by: Johannes Berg <[email protected]> commit b9d66a36aa7737d0f975d99aabc200b7496e26b8 Author: Ido Schimmel <[email protected]> Date: Mon Sep 12 13:26:27 2016 +0200 mlxsw: spectrum: Add support for new ethtool API Remove the deprecated {get,set}_settings callbacks and instead add {get,set}_link_ksettings along with support for newly available speeds. Signed-off-by: Ido Schimmel <[email protected]> Signed-off-by: Jiri Pirko <[email protected]> Signed-off-by: David S. Miller <[email protected]> commit 91bdc7a43ac7cfe044caa5ab7e74dca114f15904 Author: Ido Schimmel <[email protected]> Date: Mon Sep 12 13:26:26 2016 +0200 mlxsw: spectrum: Indicate support of multiple port types The device can support multiple port types, so don't return on first match. Signed-off-by: Ido Schimmel <[email protected]> Signed-off-by: Jiri Pirko <[email protected]> Signed-off-by: David S. Miller <[email protected]> commit 0213424adad63bfea08ef19cd6c997648ddcf44e Author: Ido Schimmel <[email protected]> Date: Mon Sep 12 13:26:25 2016 +0200 mlxsw: spectrum: Report port type according to operational speed In case port isn't operational we shouldn't report the port type, but instead return PORT_OTHER. This is consistent with most other drivers that return PORT_OTHER when media type can't be determined. Signed-off-by: Ido Schimmel <[email protected]> Signed-off-by: Jiri Pirko <[email protected]> Signed-off-by: David S. Miller <[email protected]> commit 4149b97f728edc9247939ece42a784c14b4e212f Author: Ido Schimmel <[email protected]> Date: Mon Sep 12 13:26:24 2016 +0200 mlxsw: spectrum: Report link partner's advertised speeds If autonegotiation was performed successfully, then we should report the link partner's advertised speeds instead of the operational speed of the port. Signed-off-by: Ido Schimmel <[email protected]> Signed-off-by: Jiri Pirko <[email protected]> Signed-off-by: David S. Miller <[email protected]> commit 0c83f88c02085a762d52ebcd9cc4ca3df39db797 Author: Ido Schimmel <[email protected]> Date: Mon Sep 12 13:26:23 2016 +0200 mlxsw: spectrum: Correctly report autonegotiation Up until now the device always reported autonegotiation to be off although it was on by default. Allow the user to disable / enable autonegotiation and report its status correctly. Signed-off-by: Ido Schimmel <[email protected]> Signed-off-by: Jiri Pirko <[email protected]> Signed-off-by: David S. Miller <[email protected]> commit 440f895aa97f81a2bdc02993da5360a1f6da2fb5 Author: Christophe Jaillet <[email protected]> Date: Sun Sep 11 21:43:34 2016 +0200 drivers: net: phy: xgene: Fix 'remove' function If 'IS_ERR(pdata->clk)' is true, then 'clk_disable_unprepare(pdata->clk)' will do nothing. It is likely that 'if (!IS_ERR(pdata->clk))' was expected here. In fact, the test can even be removed because 'clk_disable_unprepare' already handles such cases. Signed-off-by: Christophe JAILLET <[email protected]> Signed-off-by: David S. Miller <[email protected]> commit dd3e3bbf1445ba20a3a8e8c86fababad2b277a81 Author: Arnd Bergmann <[email protected]> Date: Tue Sep 13 18:01:40 2016 +0200 arm-soc: document merges Signed-off-by: Arnd Bergmann <[email protected]> commit 57ccdf449f962ab5fc8cbf26479402f13bdb8be7 Author: Wanpeng Li <[email protected]> Date: Wed Sep 7 18:51:13 2016 +0800 tick/nohz: Prevent stopping the tick on an offline CPU can_stop_full_tick() has no check for offline cpus. So it allows to stop the tick on an offline cpu from the interrupt return path, which is wrong and subsequently makes irq_work_needs_cpu() warn about being called for an offline cpu. Commit f7ea0fd639c2c4 ("tick: Don't invoke tick_nohz_stop_sched_tick() if the cpu is offline") added prevention for can_stop_idle_tick(), but forgot to do the same in can_stop_full_tick(). Add it. [ tglx: Massaged changelog ] Signed-off-by: Wanpeng Li <[email protected]> Cc: Peter Zijlstra <[email protected]> Cc: Frederic Weisbecker <[email protected]> Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Thomas Gleixner <[email protected]> commit 36a19b299536746f5c01d7716dac962f831e4d38 Author: Philippe Reynes <[email protected]> Date: Sun Sep 11 17:54:04 2016 +0200 net: ethernet: apm: xgene: use new api ethtool_{get|set}_link_ksettings The ethtool api {get|set}_settings is deprecated. We move this driver to new api {get|set}_link_ksettings. Signed-off-by: Philippe Reynes <[email protected]> Signed-off-by: David S. Miller <[email protected]> commit 971d3a44c00dcb27353f929c4c28367956c15527 Author: Philippe Reynes <[email protected]> Date: Sun Sep 11 17:54:03 2016 +0200 net: ethernet: apm: xgene: use phydev from struct net_device The private structure contain a pointer to phydev, but the structure net_device already contain such pointer. So we can remove the pointer phy_dev in the private structure, and update the driver to use the one contained in struct net_device. Signed-off-by: Philippe Reynes <[email protected]> Signed-off-by: David S. Miller <[email protected]> commit 715f5552b1e90ba3eecf6d1a6d044d0d5226663f Author: Xin Long <[email protected]> Date: Sat Sep 10 23:11:23 2016 +0800 sctp: hold the transport before using it in sctp_hash_cmp Since commit 4f0087812648 ("sctp: apply rhashtable api to send/recv path"), sctp uses transport rhashtable with .obj_cmpfn sctp_hash_cmp, in which it compares the members of the transport with the rhashtable args to check if it's the right transport. But sctp uses the transport without holding it in sctp_hash_cmp, it can cause a use-after-free panic. As after it gets transport from hashtable, another CPU may close the sk and free the asoc. In sctp_association_free, it frees all the transports, meanwhile, the assoc's refcnt may be reduced to 0, assoc can be destroyed by sctp_association_destroy. So after that, transport->assoc is actually an unavailable memory address in sctp_hash_cmp. Although sctp_hash_cmp is under rcu_read_lock, it still can not avoid this, as assoc is not freed by RCU. This patch is to hold the transport before checking it's members with sctp_transport_hold, in which it checks the refcnt first, holds it if it's not 0. Fixes: 4f0087812648 ("sctp: apply rhashtable api to send/recv path") Signed-off-by: Xin Long <[email protected]> Acked-by: Marcelo Ricardo Leitner <[email protected]> Signed-off-by: David S. Miller <[email protected]> commit a5f54fcc8a63f4e93ea48243c3a762aa848299d5 Author: Wei Yongjun <[email protected]> Date: Sat Sep 10 12:31:30 2016 +0000 net: ethernet: dwmac: fix non static symbol warning Fixes the following sparse warning: drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c:172:1: warning: symbol 'stm32_dwmac_pm_ops' was not declared. Should it be static? Signed-off-by: Wei Yongjun <[email protected]> Signed-off-by: David S. Miller <[email protected]> commit a7c22bda52e24094c7bc96afcd897ddad2b28bc0 Author: Wei Yongjun <[email protected]> Date: Sat Sep 10 11:17:57 2016 +0000 net: macb: fix missing unlock on error in macb_start_xmit() Fix missing unlock before return from function macb_start_xmit() in the error handling case. Fixes: 007e4ba3ee13 ("net: macb: initialize checksum when using checksum offloading") Signed-off-by: Wei Yongjun <[email protected]> Acked-by: Nicolas Ferre <[email protected]> Signed-off-by: David S. Miller <[email protected]> commit 99c1790e5bbd31fe2b646bff868a55a13b1eeeb2 Author: Michael Ellerman <[email protected]> Date: Sat Sep 10 19:59:05 2016 +1000 net: Remove NO_IRQ from powerpc-only network drivers We'd like to eventually remove NO_IRQ on powerpc, so remove usages of it from powerpc-only drivers. Signed-off-by: Michael Ellerman <[email protected]> Signed-off-by: David S. Miller <[email protected]> commit c20cb8119337052a84e40cba94af732d870e22e3 Author: Wei Yongjun <[email protected]> Date: Sat Sep 10 00:56:55 2016 +0000 tipc: fix possible memory leak in tipc_udp_enable() 'ub' is malloced in tipc_udp_enable() and should be freed before leaving from the error handling cases, otherwise it will cause memory leak. Fixes: ba5aa84a2d22 ("tipc: split UDP nl address parsing") Signed-off-by: Wei Yongjun <[email protected]> Signed-off-by: David S. Miller <[email protected]> commit 9c0da3cc61f1233c2782e2d3d91e3d0707dd4ba5 Author: Mark Rutland <[email protected]> Date: Fri Sep 2 17:34:50 2016 +0100 ARM: dts: explicitly mark skeleton.dtsi as deprecated As noted in commit 3ebee5a2e141496b ("arm64: dts: kill skeleton.dtsi"), there are a number of problems with skeleton.dtsi, and it would be prefereable to remove it entirely. As there are a large number of existing users, fixing these up will take a while. This patch adds a note to arm's skeleton.dtsi noting that this is the case, to make this more obvious and hopefully minimize new uptake of skeleton.dtsi in the mean time. Signed-off-by: Mark Rutland <[email protected]> Acked-by: Rob Herring <[email protected]> Cc: Arnd Bergmann <[email protected]> Cc: Olof Johansson <[email protected]> Signed-off-by: Arnd Bergmann <[email protected]> commit 28b89b9e6f7b6c8fef7b3af39828722bca20cfee Author: Joonwoo Park <[email protected]> Date: Sun Sep 11 21:14:58 2016 -0700 cpuset: handle race between CPU hotplug and cpuset_hotplug_work A discrepancy between cpu_online_mask and cpuset's effective_cpus mask is inevitable during hotplug since cpuset defers updating of effective_cpus mask using a workqueue, during which time nothing prevents the system from more hotplug operations. For that reason guarantee_online_cpus() walks up the cpuset hierarchy until it finds an intersection under the assumption that top cpuset's effective_cpus mask intersects with cpu_online_mask even with such a race occurring. However a sequence of CPU hotplugs can open a time window, during which none of the effective CPUs in the top cpuset intersect with cpu_online_mask. For example when there are 4 possible CPUs 0-3 and only CPU0 is online: ======================== =========================== cpu_online_mask top_cpuset.effective_cpus ======================== =========================== echo 1 > cpu2/online. CPU hotplug notifier woke up hotplug work but not yet scheduled. [0,2] [0] echo 0 > cpu0/online. The workqueue is still runnable. [2] [0] ======================== =========================== Now there is no intersection between cpu_online_mask and top_cpuset.effective_cpus. Thus invoking sys_sched_setaffinity() at this moment can cause following: Unable to handle kernel NULL pointer dereference at virtual address 000000d0 ------------[ cut here ]------------ Kernel BUG at ffffffc0001389b0 [verbose debug info unavailable] Internal error: Oops - BUG: 96000005 [#1] PREEMPT SMP Modules linked in: CPU: 2 PID: 1420 Comm: taskset Tainted: G W 4.4.8+ #98 task: ffffffc06a5c4880 ti: ffffffc06e124000 task.ti: ffffffc06e124000 PC is at guarantee_online_cpus+0x2c/0x58 LR is at cpuset_cpus_allowed+0x4c/0x6c <snip> Process taskset (pid: 1420, stack limit = 0xffffffc06e124020) Call trace: [<ffffffc0001389b0>] guarantee_online_cpus+0x2c/0x58 [<ffffffc00013b208>] cpuset_cpus_allowed+0x4c/0x6c [<ffffffc0000d61f0>] sched_setaffinity+0xc0/0x1ac [<ffffffc0000d6374>] SyS_sched_setaffinity+0x98/0xac [<ffffffc000085cb0>] el0_svc_naked+0x24/0x28 The top cpuset's effective_cpus are guaranteed to be identical to cpu_online_mask eventually. Hence fall back to cpu_online_mask when there is no intersection between top cpuset's effective_cpus and cpu_online_mask. Signed-off-by: Joonwoo Park <[email protected]> Acked-by: Li Zefan <[email protected]> Cc: Tejun Heo <[email protected]> Cc: [email protected] Cc: [email protected] Cc: <[email protected]> # 3.17+ Signed-off-by: Tejun Heo <[email protected]> commit 3e1be7ad2d38c6bd6aeef96df9bd0a7822f4e51c Author: Baoquan He <[email protected]> Date: Fri Sep 9 22:43:12 2016 +0800 bnx2: Reset device during driver initialization When system enters into kdump kernel because of kernel panic, it won't shutdown devices. On-flight DMA will continue transferring data until device driver initializes. All devices are supposed to reset during driver initialization. And this property is used to fix the kdump failure in system with intel iommu. Other systems with hardware iommu should be similar. Please check commit 091d42e ("iommu/vt-d: Copy translation tables from old kernel") and those commits around. But bnx2 driver doesn't reset device during driver initialization. The device resetting is deferred to net device up stage. This will cause hardware iommu handling failure on bnx2 device. And its resetting relies on firmware. So in this patch move the firmware requesting code to earlier bnx2_init_one(), then next call bnx2_reset_chip to reset device. Signed-off-by: Baoquan He <[email protected]> Signed-off-by: David S. Miller <[email protected]> commit 308433155a67cb097142292c8943e0aa8d1a1c79 Author: Vivien Didelot <[email protected]> Date: Thu Sep 8 12:50:43 2016 -0400 net: bridge: add helper to call /sbin/bridge-stp If /sbin/bridge-stp is available on the system, bridge tries to execute it instead of the kernel implementation when starting/stopping STP. If anything goes wrong with /sbin/bridge-stp, bridge silently falls back to kernel STP, making hard to debug userspace STP. This patch adds a br_stp_call_user helper to start/stop userspace STP and debug errors from the program: abnormal exit status is stored in the lower byte and normal exit status is stored in higher byte. Below is a simple example on a kernel with dynamic debug enabled: # ln -s /bin/false /sbin/bridge-stp # brctl stp br0 on br0: failed to start userspace STP (256) # dmesg br0: /sbin/bridge-stp exited with code 1 br0: failed to start userspace STP (256) br0: using kernel STP Signed-off-by: Vivien Didelot <[email protected]> Signed-off-by: David S. Miller <[email protected]> commit 5eb0d6eb3fac3daa60d9190eed9fa41cf809c756 Author: Boris Brezillon <[email protected]> Date: Tue Sep 13 15:58:29 2016 +0200 irqchip/atmel-aic: Fix potential deadlock in ->xlate() aic5_irq_domain_xlate() and aic_irq_domain_xlate() take the generic chip lock without disabling interrupts, which can lead to a deadlock if an interrupt occurs while the lock is held in one of these functions. Replace irq_gc_{lock,unlock}() calls by irq_gc_{lock_irqsave,unlock_irqrestore}() ones to prevent this bug from happening. Fixes: b1479ebb7720 ("irqchip: atmel-aic: Add atmel AIC/AIC5 drivers") Signed-off-by: Boris Brezillon <[email protected]> Acked-by: Marc Zyngier <[email protected]> Cc: Jason Cooper <[email protected]> Cc: Nicolas Ferre <[email protected]> Cc: [email protected] Cc: Alexandre Belloni <[email protected]> Link: http://lkml.kernel.org/r/1473775109-4192-2-git-send-email-boris.brezillon@free-electrons.com Signed-off-by: Thomas Gleixner <[email protected]> commit ebf9ff753c041b296241990aef76163bbb2cc9c8 Author: Boris Brezillon <[email protected]> Date: Tue Sep 13 15:58:28 2016 +0200 genirq: Provide irq_gc_{lock_irqsave,unlock_irqrestore}() helpers Some irqchip drivers need to take the generic chip lock outside of the irq context. Provide the irq_gc_{lock_irqsave,unlock_irqrestore}() helpers to allow one to disable irqs while entering a critical section protected by gc->lock. Note that we do not provide optimized version of these helpers for !SMP, because they are not called from the hot-path. [ tglx: Added a comment when these helpers should be [not] used ] Signed-off-by: Boris Brezillon <[email protected]> Cc: Jason Cooper <[email protected]> Cc: Marc Zyngier <[email protected]> Cc: Nicolas Ferre <[email protected]> Cc: [email protected] Cc: Alexandre Belloni <[email protected]> Link: http://lkml.kernel.org/r/1473775109-4192-1-git-send-email-boris.brezillon@free-electrons.com Signed-off-by: Thomas Gleixner <[email protected]> commit ecebca79f6976ddaddfd054d699272515869ea28 Author: Chris Wilson <[email protected]> Date: Mon Aug 29 19:16:13 2016 +0100 dma-buf/sync-file: Avoid enable fence signaling if poll(.timeout=0) If we being polled with a timeout of zero, a nonblocking busy query, we don't need to install any fence callbacks as we will not be waiting. As we only install the callback once, the overhead comes from the atomic bit test that also causes serialisation between threads. Signed-off-by: Chris Wilson <[email protected]> Cc: Sumit Semwal <[email protected]> Cc: Gustavo Padovan <[email protected]> Cc: [email protected] Cc: [email protected] Cc: [email protected] Reviewed-by: Gustavo Padovan <[email protected]> Signed-off-by: Sumit Semwal <[email protected]> Link: http://patchwork.freedesktop.org/patch/msgid/[email protected] commit 92467a5fd55974bae4209da4543d621df605db5e Author: Lars Persson <[email protected]> Date: Tue Aug 23 16:00:52 2016 +0200 ARM: dts: artpec: set irq affinity on pmu interrupts The irq affinity is required for pmu interrupts. Signed-off-by: Lars Persson <[email protected]> Signed-off-by: Arnd Bergmann <[email protected]> commit 1b875160af6ca08bcb63d0201f38cca98e16601c Author: Lars Persson <[email protected]> Date: Tue Aug 23 16:00:51 2016 +0200 ARM: dts: artpec: use optimized pl310 settings Use the cache settings that were determined to give best performance on artpec-6 typical workloads. Signed-off-by: Lars Persson <[email protected]> Signed-off-by: Arnd Bergmann <[email protected]> commit d09ea47ac8dbd391d8d1103ffe841c75f0c1d8e7 Author: Lars Persson <[email protected]> Date: Tue Aug 23 16:00:50 2016 +0200 ARM: dts: artpec: use clock binding header Use defines from the clock binding header as clock indexes. Signed-off-by: Lars Persson <[email protected]> Signed-off-by: Arnd Bergmann <[email protected]> commit ba6d018e3d2f6a0fad58a668cadf66b2d1f80f59 Author: Nicolas Iooss <[email protected]> Date: Sat Sep 10 20:30:45 2016 +0200 x86/mm/pkeys: Do not skip PKRU register if debug registers are not used __show_regs() fails to dump the PKRU state when the debug registers are in their default state because there is a return statement on the debug register state. Change the logic to report PKRU value even when debug registers are in their default state. Fixes:c0b17b5bd4b7 ("x86/mm/pkeys: Dump PKRU with other kernel registers") Signed-off-by: Nicolas Iooss <[email protected]> Acked-by: Dave Hansen <[email protected]> Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Thomas Gleixner <[email protected]> commit 69b05825e1f883d15d3d051d0eab3171e247ecaa Author: Takashi Sakamoto <[email protected]> Date: Tue Sep 13 19:37:53 2016 +0900 ALSA: seq: fix to copy from/to user space When checking value of request for copy operation, current implementation compares shifted value to macros, while these macros are already shifted. As a result, it never performs to copy from/to user space. This commit fixes the bug. Fixes: 8ce8eb601c71('ALSA: seq: add an alternative way to handle ioctl requests' Signed-off-by: Takashi Sakamoto <[email protected]> Signed-off-by: Takashi Iwai <[email protected]> commit d2f3e1058c7ff9dc18d14548f6263dcf13af67f7 Author: Simon Chopin <[email protected]> Date: Sat Sep 10 07:11:52 2016 +0200 staging: fwserial: fix checkpatch permission warnings Fix the following warnings: Symbolic permissions are not preferred. Consider using octal permissions. Signed-off-by: Simon Chopin <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]> commit 4854f175c3182816d906c4bc34be5f30556346a5 Author: Johannes Berg <[email protected]> Date: Tue Sep 13 15:39:29 2016 +0200 mac80211: remove useless open_count check __ieee80211_suspend() checks early on if there's anything to do by checking open_count, so there's no need to check again later in the function. Remove the useless check. Signed-off-by: Johannes Berg <[email protected]> commit 7cc4ef8ed132e72ba44804cae3ddb2587ff757d6 Author: Borislav Petkov <[email protected]> Date: Mon Sep 12 09:59:41 2016 +0200 x86/RAS/mce_amd_inj: Fix some W= warnings In particular: arch/x86/ras/mce_amd_inj.c: In function ‘prepare_msrs’: arch/x86/ras/mce_amd_inj.c:249:13: warning: declaration of ‘i_mce’ shadows a global declaration [-Wshadow] struct mce i_mce = *(struct mce *)info; ^~~~~ arch/x86/ras/mce_amd_inj.c: In function ‘init_mce_inject’: arch/x86/ras/mce_amd_inj.c:453:16: warning: comparison between signed and unsigned integer expressions [-Wsign-compare] for (i = 0; i < ARRAY_SIZE(dfs_fls); i++) { Signed-off-by: Borislav Petkov <[email protected]> Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Thomas Gleixner <[email protected]> commit a884675b873a0185d2626d1f304987c94cef6d74 Author: Yazen Ghannam <[email protected]> Date: Mon Sep 12 09:59:40 2016 +0200 x86/MCE/AMD, EDAC: Handle reserved bank 4 on Fam17h properly Bank 4 is reserved on family 0x17 and shouldn't generate any MCE records. However, broken hardware and software is not something unheard of so warn about bank 4 errors. They shouldn't be coming from bank 4 naturally but users can still use mce_amd_inj to simulate errors from it for testing purposed. Also, avoid special handling in the injector mce_amd_inj like it is being done on the older families. [ bp: Rewrite commit message and merge into one patch. Use boot_cpu_data. ] Signed-off-by: Yazen Ghannam <[email protected]> Signed-off-by: Borislav Petkov <[email protected]> Reviewed-by: Aravind Gopalakrishnan <[email protected]> Link: http://lkml.kernel.org/r/[email protected] Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Thomas Gleixner <[email protected]> commit 4f29b73bae158e3635b8f289f77376b054904ef5 Author: Yazen Ghannam <[email protected]> Date: Mon Sep 12 09:59:39 2016 +0200 x86/mce/AMD: Extract the error address on SMCA systems The MCA_ADDR registers on Scalable MCA systems contain the ErrorAddr in bits [55:0] and the least significant bit of the address in bits [61:56]. We should extract the valid ErrorAddr bits from the MCA_ADDR register rather than saving the raw value to struct mce. Signed-off-by: Yazen Ghannam <[email protected]> Signed-off-by: Borislav Petkov <[email protected]> Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Thomas Gleixner <[email protected]> commit 4b711f92c9b21878794597997ecda1428acc334c Author: Yazen Ghannam <[email protected]> Date: Mon Sep 12 09:59:38 2016 +0200 x86/mce, EDAC/mce_amd: Print MCA_SYND and MCA_IPID during MCE on SMCA systems The MCA_SYND and MCA_IPID registers contain valuable information and should be included in MCE output. The MCA_SYND register contains syndrome and other error information, and the MCA_IPID register will uniquely identify the MCA bank's type without having to rely on system software. Signed-off-by: Yazen Ghannam <[email protected]> Signed-off-by: Borislav Petkov <[email protected]> Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Thomas Gleixner <[email protected]> commit 5828c46f2c07b97d758da6dc6afd5c374768d44d Author: Yazen Ghannam <[email protected]> Date: Mon Sep 12 09:59:37 2016 +0200 x86/mce/AMD: Save MCA_IPID in MCE struct on SMCA systems The MCA_IPID register uniquely identifies a bank's type and instance on Scalable MCA systems. We should save the value of this register in struct mce along with the other relevant error information. This ensures that we can decode errors without relying on system software to correlate the bank to the type. Signed-off-by: Yazen Ghannam <[email protected]> Signed-off-by: Borislav Petkov <[email protected]> Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Thomas Gleixner <[email protected]> commit 66ef269dbbe45e264ccf7146d5db32b04478d148 Author: Yazen Ghannam <[email protected]> Date: Mon Sep 12 09:59:36 2016 +0200 x86/mce/AMD: Ensure the deferred error interrupt is of type APIC on SMCA systems The Deferred Error Interrupt Type is set per bank on Scalable MCA systems. This is done in a bitfield in the MCA_CONFIG register of each bank. We should set its type to APIC-based interrupt and not assume BIOS has set it for us. Signed-off-by: Yazen Ghannam <[email protected]> Signed-off-by: Borislav Petkov <[email protected]> Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Thomas Gleixner <[email protected]> commit 87a6d4091bd795b43d684bfc87253e04a263af1c Author: Yazen Ghannam <[email protected]> Date: Mon Sep 12 09:59:35 2016 +0200 x86/mce/AMD: Update sysfs bank names for SMCA systems Define a bank's sysfs filename based on its IP type and InstanceId. Credits go to Aravind for: * The general idea and proto- get_name(). * Defining smca_umc_block_names[] and buf_mcatype[]. Signed-off-by: Yazen Ghannam <[email protected]> Signed-off-by: Borislav Petkov <[email protected]> Cc: Aravind Gopalakrishnan <[email protected]> Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Thomas Gleixner <[email protected]> commit 5896820e0aa32572ad03b30563c539655b6c6375 Author: Yazen Ghannam <[email protected]> Date: Mon Sep 12 09:59:34 2016 +0200 x86/mce/AMD, EDAC/mce_amd: Define and use tables for known SMCA IP types Scalable MCA defines a number of IP types. An MCA bank on an SMCA system is defined as one of these IP types. A bank's type is uniquely identified by the combination of the HWID and MCATYPE values read from its MCA_IPID register. Add the required tables in order to be able to lookup error descriptions based on a bank's type and the error's extended error code. [ bp: Align comments, simplify a bit. ] Signed-off-by: Yazen Ghannam <[email protected]> Signed-off-by: Borislav Petkov <[email protected]> Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Thomas Gleixner <[email protected]> commit 856095b1794be487527771dbd2fe28e34e94b266 Author: Yazen Ghannam <[email protected]> Date: Mon Sep 12 09:59:33 2016 +0200 EDAC/mce_amd: Use SMCA prefix for error descriptions arrays The error descriptions defined for Fam17h can be reused for other SMCA systems, so their names should reflect this. Change f17h prefix to smca for error descriptions. Signed-off-by: Yazen Ghannam <[email protected]> Signed-off-by: Borislav Petkov <[email protected]> Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Thomas Gleixner <[email protected]> commit c019b951e1f9f1de0c5b0726032e3adf34c523a7 Author: Yazen Ghannam <[email protected]> Date: Mon Sep 12 09:59:32 2016 +0200 EDAC/mce_amd: Add missing SMCA error descriptions Add missing SMCA error descriptions to the error descriptions arrays. Signed-off-by: Yazen Ghannam <[email protected]> Signed-off-by: Borislav Petkov <[email protected]> Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Thomas Gleixner <[email protected]> commit cfee4f6f0b2026380c6bc6913dbd27943df17371 Author: Yazen Ghannam <[email protected]> Date: Mon Sep 12 09:59:31 2016 +0200 x86/mce/AMD: Read MSRs on the CPU allocating the threshold blocks Scalable MCA systems allow non-core MCA banks to only be accessible by certain CPUs. The MSRs for these banks are Read-as-Zero on other CPUs. During allocate_threshold_blocks(), get_block_address() can be scheduled on CPUs other than the one allocating the block. This causes the MSRs to be read on the wrong CPU and results in incorrect behavior. Add a @cpu parameter to get_block_address() and pass this in to ensure that the MSRs are only read on the CPU that is allocating the block. Signed-off-by: Yazen Ghannam <[email protected]> Signed-off-by: Borislav Petkov <[email protected]> Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Thomas Gleixner <[email protected]> commit bad744b7f29d264c2c2ad8fb723dd480e6c9b007 Author: Yazen Ghannam <[email protected]> Date: Mon Sep 12 09:59:30 2016 +0200 x86/RAS: Add syndrome support to mce_amd_inj Add a debugfs file which holds the error syndrome (written into MCA_SYND) of an injected error. Only write it on SMCA systems. Update README file, while at it. Signed-off-by: Yazen Ghannam <[email protected]> Signed-off-by: Borislav Petkov <[email protected]> Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Thomas Gleixner <[email protected]> commit b300e87300b68120aa5374341b252875a1cb6ea1 Author: Yazen Ghannam <[email protected]> Date: Mon Sep 12 09:59:29 2016 +0200 EDAC/mce_amd: Print syndrome register value on SMCA systems Print SyndV bit status and print the raw value of the MCA_SYND register. Further decoding of the syndrome from struct mce.synd can be done in other places where appropriate, e.g. DRAM ECC. Boris: make the error stanza more compact by putting the error address and syndrome on the same line: [Hardware Error]: Corrected error, no action required. [Hardware Error]: CPU:2 (17:0:0) MC4_STATUS[-|CE|-|PCC|AddrV|-|-|SyndV|CECC]: 0x96204100001e0117 [Hardware Error]: Error Addr: 0x000000007f4c52e3, Syndrome: 0x0000000000000000 [Hardware Error]: Invalid IP block specified. [Hardware Error]: cache level: L3/GEN, tx: DATA, mem-tx: RD Signed-off-by: Yazen Ghannam <[email protected]> Signed-off-by: Borislav Petkov <[email protected]> Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Thomas Gleixner <[email protected]> commit db819d60f6720080150a365080ff656cf239f88f Author: Yazen Ghannam <[email protected]> Date: Mon Sep 12 09:59:28 2016 +0200 x86/mce: Add support for new MCA_SYND register Syndrome information is no longer contained in MCA_STATUS for SMCA systems but in a new register - MCA_SYND. Add a synd field to struct mce to hold MCA_SYND register value. Add it to the end of struct mce to maintain compatibility with old versions of mcelog. Also, add it to the respective tracepoint. Signed-off-by: Yazen Ghannam <[email protected]> Signed-off-by: Borislav Petkov <[email protected]> Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Thomas Gleixner <[email protected]> commit 74ab0e7a836a7df772af50cac21267eb43688841 Author: Yazen Ghannam <[email protected]> Date: Mon Sep 12 09:59:27 2016 +0200 x86/mce/AMD: Use msr_ops.misc() in allocate_threshold_blocks() Change MSR_IA32_MCx_MISC() macro to msr_ops.misc() because SMCA machines define a different set of MSRs and msr_ops will give you the correct MISC register. Signed-off-by: Yazen Ghannam <[email protected]> Signed-off-by: Borislav Petkov <[email protected]> Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Thomas Gleixner <[email protected]> commit 1d191e1057aec4f9f635556d49f4f0ef90b704d4 Author: Bhumika Goyal <[email protected]> Date: Tue Sep 13 17:41:26 2016 +0530 Staging: wilc1000: Remove struct typedef Remove typedef from structure tstrRSSI as using typedef for structures is not preferred. Found using coccinelle: @r1@ type T; @@ typedef struct { ... } T; @script:python c1@ T2; T << r1.T; @@ if T[-2:] =="_t": coccinelle.T2 = T[:-2]; print T else: coccinelle.T2=T; @r2@ type r1.T; identifier c1.T2; @@ -typedef struct + T2 { ... } -T ; @r3@ type r1.T; identifier c1.T2; @@ - T + struct T2 Signed-off-by: Bhumika Goyal <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]> commit 65f5c3ea622dfca230e96e5098603f1df9e0a902 Author: Ryan Swan <[email protected]> Date: Mon Sep 12 09:58:20 2016 -0400 staging: vme/devices: vme_user.c: fix: converted decimal permissions to octal Ran checkpatch.pl -f vme_user.c Fixed: ERROR: Use 4 digit octal (0777) not decimal permissions Signed-off-by: Ryan Swan <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]> commit b9ac4b65b5c0b16a34c12e3f0a3edf1452d4c34a Author: sayli karnik <[email protected]> Date: Mon Sep 12 20:54:07 2016 +0530 staging: gs_fpga_boot: Remove multiple blank lines This patch fixes the following checkpatch warning for the gs_fpgaboot driver: CHECK: Please don't use multiple blank lines. Signed-off-by: sayli karnik <[email protected]> Acked-by: Julia Lawall <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]> commit c7e65f4d2f7968de8605ef1b83ac1019e8e51d22 Author: sayli karnik <[email protected]> Date: Tue Sep 13 02:47:28 2016 +0530 staging: ks7010: Remove the explicit NULL comparison The patch removes the explicit null comparisons entirely for the ks7010 driver. This was detected by checkpatch.pl Signed-off-by: sayli karnik <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]> commit 8b70d6961f03483a7c9db9aecba2c3b3b467cce2 Author: Mike Kofron <[email protected]> Date: Mon Sep 12 14:23:31 2016 -0400 staging: netlogic: Make net_device_ops const This patch fixes the checkpatch.pl warning: WARNING: struct net_device_ops should normally be const Signed-off-by: Mike Kofron <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]> commit b8a7b474672321c7f0550620b32cd676501c3506 Author: Bhumika Goyal <[email protected]> Date: Tue Sep 13 00:38:19 2016 +0530 Staging: vt6655: Remove unused function vnt_key_init_table The function vnt_key_init_table is not used anywhere in the kernel. Therefore, remove the function definition and prototype. Grepped to find occurences. Signed-off-by: Bhumika Goyal <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]> commit c371ffa79c4ca29b8cd7da4d30157179162130c8 Author: Gargi Sharma <[email protected]> Date: Tue Sep 13 00:42:07 2016 +0530 staging: slicoss: add new line after struct declaration checkpatch generates a warning for no blank line after struct declaration. Inserted a new line. Signed-off-by: Gargi Sharma <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]> commit 602facfd96397298461cd71f6a6f9e17b82f9788 Author: Andrey Shvetsov <[email protected]> Date: Mon Sep 12 16:26:14 2016 +0200 staging: most: core: constify structure member This patch adds the const qualifier to the declaration of the member name_suffix of structure most_channel_capability. It is needed since it points to string literals. Signed-off-by: Andrey Shvetsov <[email protected]> Signed-off-by: Christian Gromm <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]> commit bc5f96a15658f390aba8688408526542c9329d7e Author: Christian Gromm <[email protected]> Date: Mon Sep 12 16:26:13 2016 +0200 staging: most: core: show all linked channels This patch is needed to have all linked channels being reported by the show() function of the attribute file add_link. Currently user space can only read back the latest link that has been established to a certain channel. Signed-off-by: Andrey Shvetsov <[email protected]> Signed-off-by: Christian Gromm <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]> commit 25b80dbe3fa6d76d8f19af0623d1fd8ed0dd671e Author: Bhumika Goyal <[email protected]> Date: Mon Sep 12 23:02:47 2016 +0530 Staging: comedi: drivers: Delete NULL check before pci_dev_put The function pci_dev_put checks whether its argument is NULL and returns immediately. Therefore, NULL test before the call if not needed. Found using coccinelle: @@ expression x; @@ - if(x) - pci_dev_put(x); + pci_dev_put(x); Signed-off-by: Bhumika Goyal <[email protected]> Reviewed-by: Ian Abbott <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]> commit 6e30293976983daf09eea8e882d48a09c80d5987 Author: Matias Mucciolo <[email protected]> Date: Mon Sep 12 10:18:59 2016 -0300 staging: comedi: comedi_fops: coding style fixes - Fixed coding style in comedi_fops.c Symbolic to octal permission. Signed-off-by: Matias Mucciolo <[email protected]> Reviewed-by: Ian Abbott <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]> commit 601e59fa5149f428737c569b7f8a01c6ccb3e223 Author: sayli karnik <[email protected]> Date: Mon Sep 12 17:13:09 2016 +0530 staging: gdm724x: Add spaces around the '*' operator This patch fixes the checkpatch.pl warning: Spaces required around the '*' operator. Signed-off-by: sayli karnik <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]> commit 4a2a867f5bada15b3f81168089258a28eb02dc04 Author: Shaily Sangwan <[email protected]> Date: Tue Sep 13 02:54:14 2016 +0530 staging: rtl8712: fix block comments This patch fixes the following checkpatch.pl warning: Block comments use * on subsequent lines Signed-off-by: Shaily Sangwan <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]> commit 12bc1d1e9cb18176dcd80564067114b32d189d24 Author: Omri Arad <[email protected]> Date: Mon Sep 12 21:02:25 2016 +0300 staging: rtl8712: fix coding style error reported from checkpatch removed the following: ERROR: code indent should use tabs where possible WARNING: please, no spaces at the start of a line WARNING: Statements should start on a tabstop Signed-off-by: Omri Arad <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]> commit d147d54899339b321f8319dfb25d05f1eec0e77d Author: Linus Walleij <[email protected]> Date: Tue Sep 13 14:43:23 2016 +0200 Revert "gpio: pca953x: initialize ret to zero to avoid returning garbage" This reverts commit 313b9a9938bf4076425741121d5d766826793e5d. This was already fixed by commit bf62efeb164343916ebb89dca6dfe5e6b6751700 "gpio: pca954x: fix undefined error code from remove" The latter is a better fix since it makes it easier to detect erronous code by not assigning a default error code. Reported-by: Arnd Bergmann <[email protected]> Signed-off-by: Linus Walleij <[email protected]> commit e2753293ac4bce8623650bb2d610b7e657bc869f Author: Dave Hansen <[email protected]> Date: Mon Sep 12 13:38:42 2016 -0700 x86/pkeys: Fix pkeys build breakage for some non-x86 arches Guenter Roeck reported breakage on the h8300 and c6x architectures (among others) caused by the new memory protection keys syscalls. This patch does what Arnd suggested and adds them to kernel/sys_ni.c. Fixes: a60f7b69d92c ("generic syscalls: Wire up memory protection keys syscalls") Reported-and-tested-by: Guenter Roeck <[email protected]> Signed-off-by: Dave Hansen <[email protected]> Acked-by: Arnd Bergmann <[email protected]> Cc: [email protected] Cc: Dave Hansen <[email protected]> Cc: [email protected] Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Thomas Gleixner <[email protected]> commit 36e09e1f874baf581604a76ce81aae0538eb0a23 Author: Masahiro Yamada <[email protected]> Date: Tue Sep 13 04:27:54 2016 +0900 crypto: squash lines for simple wrapper functions Remove unneeded variables and assignments. Signed-off-by: Masahiro Yamada <[email protected]> Signed-off-by: Herbert Xu <[email protected]> commit e9afc746299d39f415fdb13b1213137deb4fc497 Author: PrasannaKumar Muralidharan <[email protected]> Date: Sun Sep 11 20:54:26 2016 +0530 hwrng: geode - Use linux/io.h instead of asm/io.h Fix checkpatch.pl warning by changing from asm/io.h to linux/io.h. In the mean time arrange the includes in alphabetical order. Signed-off-by: PrasannaKumar Muralidharan <[email protected]> Signed-off-by: Herbert Xu <[email protected]> commit 6e9b5e76882cbdd99caaea50ef3917a31edead75 Author: PrasannaKumar Muralidharan <[email protected]> Date: Sun Sep 11 20:53:21 2016 +0530 hwrng: geode - Migrate to managed API Use devm_ioremap and devm_hwrng_register instead of ioremap and hwrng_register. This removes error handling code. Also moved code around by removing goto statements. This improves code readability. Signed-off-by: PrasannaKumar Muralidharan <[email protected]> Signed-off-by: Herbert Xu <[email protected]> commit 94879fa82275f161f3b4fdabab00cd4d625781f3 Author: Wei Yongjun <[email protected]> Date: Sat Sep 10 12:03:42 2016 +0000 hwrng: st - Fix missing clk_disable_unprepare() on error in st_rng_probe() Fix the missing clk_disable_unprepare() before return from st_rng_probe() in the error handling case. Signed-off-by: Wei Yongjun <[email protected]> Acked-by: Patrice Chotard <[email protected]> Acked-by: Peter Griffin <[email protected]> Signed-off-by: Herbert Xu <[email protected]> commit 31b2a73c9c5f1f02c896c4e434957b831dd50a7f Author: PrasannaKumar Muralidharan <[email protected]> Date: Fri Sep 9 13:28:23 2016 +0530 hwrng: amd - Migrate to managed API Managed API eliminates error handling code, thus reduces several lines of code. Signed-off-by: PrasannaKumar Muralidharan <[email protected]> Signed-off-by: Herbert Xu <[email protected]> commit 58b022acac8dd435dad0b162ad92cbe8ec90a703 Author: PrasannaKumar Muralidharan <[email protected]> Date: Wed Sep 7 20:18:02 2016 +0530 hwrng: core - Allocate memory during module init …

GIT e3b3656 commit 231e97e Author: Li Zhong <[email protected]> Date: Wed Sep 28 15:22:38 2016 -0700 mem-hotplug: use nodes that contain memory as mask in new_node_page() 9bb627b ("mem-hotplug: don't clear the only node in new_node_page()") prevents allocating from an empty nodemask, but as David points out, it is still wrong. As node_online_map may include memoryless nodes, only allocating from these nodes is meaningless. This patch uses node_states[N_MEMORY] mask to prevent the above case. Fixes: 9bb627b ("mem-hotplug: don't clear the only node in new_node_page()") Fixes: 394e31d ("mem-hotplug: alloc new page from a nearest neighbor node when mem-offline") Link: http://lkml.kernel.org/r/1474447117.28370.6.camel@TP420 Signed-off-by: Li Zhong <[email protected]> Suggested-by: David Rientjes <[email protected]> Acked-by: Vlastimil Babka <[email protected]> Cc: Michal Hocko <[email protected]> Cc: John Allen <[email protected]> Cc: Xishi Qiu <[email protected]> Cc: Joonsoo Kim <[email protected]> Cc: Naoya Horiguchi <[email protected]> Cc: Tetsuo Handa <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]> commit e436fd6 Author: Dmitry Vyukov <[email protected]> Date: Wed Sep 28 15:22:36 2016 -0700 scripts/recordmcount.c: account for .softirqentry.text be7635e ("arch, ftrace: for KASAN put hard/soft IRQ entries into separate sections") added .softirqentry.text section, but it was not added to recordmcount. So functions in the section are untracable. Add the section to scripts/recordmcount.c and scripts/recordmcount.pl. Fixes: be7635e ("arch, ftrace: for KASAN put hard/soft IRQ entries into separate sections") Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Dmitry Vyukov <[email protected]> Acked-by: Steve Rostedt <[email protected]> Cc: <[email protected]> [4.6+] Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]> commit 2481366 Author: Andrey Smirnov <[email protected]> Date: Wed Sep 28 15:22:33 2016 -0700 dma-mapping.h: preserve unmap info for CONFIG_DMA_API_DEBUG When CONFIG_DMA_API_DEBUG is enabled we need to preserve unmapping address even if "unmap" is a no-op for our architecutre because we need debug_dma_unmap_page() to correctly cleanup all of the debug bookkeeping. Failing to do so results in a false positive warnings about previously mapped areas never being unmapped. Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Andrey Smirnov <[email protected]> Reviewed-by: Robin Murphy <[email protected]> Cc: Joerg Roedel <[email protected]> Cc: Will Deacon <[email protected]> Cc: Zhen Lei <[email protected]> Cc: "Luis R. Rodriguez" <[email protected]> Cc: Christian Borntraeger <[email protected]> Cc: Geliang Tang <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]> commit 5b398e4 Author: zhong jiang <[email protected]> Date: Wed Sep 28 15:22:30 2016 -0700 mm,ksm: fix endless looping in allocating memory when ksm enable I hit the following hung task when runing a OOM LTP test case with 4.1 kernel. Call trace: [<ffffffc000086a88>] __switch_to+0x74/0x8c [<ffffffc000a1bae0>] __schedule+0x23c/0x7bc [<ffffffc000a1c09c>] schedule+0x3c/0x94 [<ffffffc000a1eb84>] rwsem_down_write_failed+0x214/0x350 [<ffffffc000a1e32c>] down_write+0x64/0x80 [<ffffffc00021f794>] __ksm_exit+0x90/0x19c [<ffffffc0000be650>] mmput+0x118/0x11c [<ffffffc0000c3ec4>] do_exit+0x2dc/0xa74 [<ffffffc0000c46f8>] do_group_exit+0x4c/0xe4 [<ffffffc0000d0f34>] get_signal+0x444/0x5e0 [<ffffffc000089fcc>] do_signal+0x1d8/0x450 [<ffffffc00008a35c>] do_notify_resume+0x70/0x78 The oom victim cannot terminate because it needs to take mmap_sem for write while the lock is held by ksmd for read which loops in the page allocator ksm_do_scan scan_get_next_rmap_item down_read get_next_rmap_item alloc_rmap_item #ksmd will loop permanently. There is no way forward because the oom victim cannot release any memory in 4.1 based kernel. Since 4.6 we have the oom reaper which would solve this problem because it would release the memory asynchronously. Nevertheless we can relax alloc_rmap_item requirements and use __GFP_NORETRY because the allocation failure is acceptable as ksm_do_scan would just retry later after the lock got dropped. Such a patch would be also easy to backport to older stable kernels which do not have oom_reaper. While we are at it add GFP_NOWARN so the admin doesn't have to be alarmed by the allocation failure. Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: zhong jiang <[email protected]> Suggested-by: Hugh Dickins <[email protected]> Suggested-by: Michal Hocko <[email protected]> Acked-by: Michal Hocko <[email protected]> Acked-by: Hugh Dickins <[email protected]> Cc: <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]> commit 0a966fa Author: Mark Fasheh <[email protected]> Date: Wed Sep 28 12:51:04 2016 -0700 MAINTAINERS: Update my e-mail I will be starting employment at Versity next week and would like to update my MAINTAINERS e-mail to reflect that change. My versity e-mail is already activated so I shouldn't get any bounces on the new one. My ability to help with Ocfs2 kernel maintenance won't change as a result of the new job. Signed-off-by: Mark Fasheh <[email protected]> Signed-off-by: Linus Torvalds <[email protected]> commit 90fd68d Author: David Herrmann <[email protected]> Date: Fri Sep 23 12:36:02 2016 +0200 drm/udl: fix line iterator in damage handling The udl damage handler is supposed to render 'height' lines, but its iterator has an obvious typo that makes it miss most lines if the rectangle does not cover 0/0. Fix the damage handler to correctly render all lines. This is a fallout from: commit e375882 Author: Noralf Trønnes <[email protected]> Date: Thu Apr 28 17:18:37 2016 +0200 drm/udl: Use drm_fb_helper deferred_io support Tested-by: poma <[email protected]> Cc: [email protected] # 4.7+ Reviewed-by: Daniel Vetter <[email protected]> Signed-off-by: David Herrmann <[email protected]> Reviewed-by: Eric Engestrom <[email protected]> Signed-off-by: Dave Airlie <[email protected]> commit 670bb4f Author: Alex Deucher <[email protected]> Date: Mon Sep 26 15:32:50 2016 -0400 drm/radeon/si/dpm: add workaround for for Jet parts Add clock quirks for Jet parts. Reviewed-by: Sonny Jiang <[email protected]> Tested-by: Sonny Jiang <[email protected]> Signed-off-by: Alex Deucher <[email protected]> Cc: [email protected] Signed-off-by: Alex Deucher <[email protected]> commit a951ed8 Author: Grazvydas Ignotas <[email protected]> Date: Sun Sep 25 23:34:48 2016 +0300 drm/amdgpu: disable CRTCs before teardown Some code called by drm_crtc_force_disable_all() wants to wait for all fences, so only do fence teardown after CRTCs are disabled. Fixes: 84b89bd ("drm/amdgpu: Turn off CRTCs on driver unload") Cc: [email protected] # v4.8+ Signed-off-by: Grazvydas Ignotas <[email protected]> Signed-off-by: Alex Deucher <[email protected]> commit 595c730 Author: Dan Williams <[email protected]> Date: Fri Sep 23 17:53:52 2016 -0700 libnvdimm, region: fix flush hint table thinko The definition of the flush hint table as: void __iomem *flush_wpq[0][0]; ...passed the unit test, but is broken as flush_wpq[0][1] and flush_wpq[1][0] refer to the same entry. Fix this to use a helper that calculates a slot in the table based on the geometry of flush hints in the region. This is important to get right since virtualization solutions use this mechanism to trigger hypervisor flushes to platform persistence. Reported-by: Dave Jiang <[email protected]> Tested-by: Dave Jiang <[email protected]> Signed-off-by: Dan Williams <[email protected]> commit 9157056 Author: Tejun Heo <[email protected]> Date: Fri Sep 23 16:55:49 2016 -0400 cgroup: fix invalid controller enable rejections with cgroup namespace On the v2 hierarchy, "cgroup.subtree_control" rejects controller enables if the cgroup has processes in it. The enforcement of this logic assumes that the cgroup wouldn't have any css_sets associated with it if there are no tasks in the cgroup, which is no longer true since a79a908 ("cgroup: introduce cgroup namespaces"). When a cgroup namespace is created, it pins the css_set of the creating task to use it as the root css_set of the namespace. This extra reference stays as long as the namespace is around and makes "cgroup.subtree_control" think that the namespace root cgroup is not empty even when it is and thus reject controller enables. Fix it by making cgroup_subtree_control() walk and test emptiness of each css_set instead of testing whether the list_head is empty. While at it, update the comment of cgroup_task_count() to indicate that the returned value may be higher than the number of tasks, which has always been true due to temporary references and doesn't break anything. Signed-off-by: Tejun Heo <[email protected]> Reported-by: Evgeny Vereshchagin <[email protected]> Cc: Serge E. Hallyn <[email protected]> Cc: Aditya Kali <[email protected]> Cc: Eric W. Biederman <[email protected]> Cc: [email protected] # v4.6+ Fixes: a79a908 ("cgroup: introduce cgroup namespaces") Link: systemd/systemd#3589 (comment) commit bad3d80 Author: Karol Herbst <[email protected]> Date: Sun Sep 18 12:21:56 2016 +0200 drm/nouveau: Revert "bus: remove cpu_coherent flag" This reverts commit aff5117. The commit caused fence timeouts within nvc0_screen_destroy and most likely other places as well. The most obvious effect is, that userspace processes take minutes to actually quit. Signed-off-by: Karol Herbst <[email protected]> Signed-off-by: Ben Skeggs <[email protected]> commit 666ca3d Author: Ilia Mirkin <[email protected]> Date: Fri Sep 9 22:34:02 2016 -0400 drm/nouveau/fifo/nv04: avoid ramht race against cookie insertion Signed-off-by: Ilia Mirkin <[email protected]> Cc: [email protected] Signed-off-by: Ben Skeggs <[email protected]> commit 11294d6 Author: Dan Williams <[email protected]> Date: Wed Sep 21 09:21:26 2016 -0700 nfit: fail DSMs that return non-zero status by default For the DSMs where the kernel knows the format of the output buffer and originates those DSMs from within the kernel, return -EIO for any non-zero status. If the BIOS is indicating a status that we do not know how to handle, fail the DSM. Cc: <[email protected]> Signed-off-by: Dan Williams <[email protected]> commit ecfb6d8 Author: Dan Williams <[email protected]> Date: Wed Sep 21 09:22:33 2016 -0700 libnvdimm: fix devm_nvdimm_memremap() error path The internal alloc_nvdimm_map() helper might fail, particularly if the memory region is already busy. Report request_mem_region() failures and check for the failure. Reported-by: Ryan Chen <[email protected]> Signed-off-by: Dan Williams <[email protected]> commit 9d15ce9 Author: Dan Williams <[email protected]> Date: Mon Sep 19 13:49:48 2016 -0700 tools/testing/nvdimm: fix allocation range for mock flush hint tables Commit 480b683 "nvdimm: fix PHYS_PFN/PFN_PHYS mixup" identified that we were passing an invalid address to devm_nvdimm_ioremap(). With that fixed it exposed a bug in the memory reservation size for flush hint tables. Since we map a full page we need to mock a full page of memory to back the flush hint table entries. Cc: Oliver O'Halloran <[email protected]> Signed-off-by: Dan Williams <[email protected]> commit 480b683 Author: Oliver O'Halloran <[email protected]> Date: Mon Sep 19 20:19:00 2016 +1000 nvdimm: fix PHYS_PFN/PFN_PHYS mixup nd_activate_region() iomaps any hint addresses required when activating a region. To prevent duplicate mappings it checks the PFN of the hint to be mapped against the PFNs of the already mapped hints. Unfortunately it doesn't convert the PFN back into a physical address before passing it to devm_nvdimm_ioremap(). Instead it applies PHYS_PFN a second time which ends about as well as you would imagine. Signed-off-by: Oliver O'Halloran <[email protected]> Signed-off-by: Dan Williams <[email protected]> commit 8a15b81 Author: Wei Yongjun <[email protected]> Date: Fri Sep 16 13:02:37 2016 +0000 cpuset: fix non static symbol warning Fixes the following sparse warning: kernel/cpuset.c:2088:6: warning: symbol 'cpuset_fork' was not declared. Should it be static? Signed-off-by: Wei Yongjun <[email protected]> Signed-off-by: Tejun Heo <[email protected]> commit 28b89b9 Author: Joonwoo Park <[email protected]> Date: Sun Sep 11 21:14:58 2016 -0700 cpuset: handle race between CPU hotplug and cpuset_hotplug_work A discrepancy between cpu_online_mask and cpuset's effective_cpus mask is inevitable during hotplug since cpuset defers updating of effective_cpus mask using a workqueue, during which time nothing prevents the system from more hotplug operations. For that reason guarantee_online_cpus() walks up the cpuset hierarchy until it finds an intersection under the assumption that top cpuset's effective_cpus mask intersects with cpu_online_mask even with such a race occurring. However a sequence of CPU hotplugs can open a time window, during which none of the effective CPUs in the top cpuset intersect with cpu_online_mask. For example when there are 4 possible CPUs 0-3 and only CPU0 is online: ======================== =========================== cpu_online_mask top_cpuset.effective_cpus ======================== =========================== echo 1 > cpu2/online. CPU hotplug notifier woke up hotplug work but not yet scheduled. [0,2] [0] echo 0 > cpu0/online. The workqueue is still runnable. [2] [0] ======================== =========================== Now there is no intersection between cpu_online_mask and top_cpuset.effective_cpus. Thus invoking sys_sched_setaffinity() at this moment can cause following: Unable to handle kernel NULL pointer dereference at virtual address 000000d0 ------------[ cut here ]------------ Kernel BUG at ffffffc0001389b0 [verbose debug info unavailable] Internal error: Oops - BUG: 96000005 [#1] PREEMPT SMP Modules linked in: CPU: 2 PID: 1420 Comm: taskset Tainted: G W 4.4.8+ torvalds#98 task: ffffffc06a5c4880 ti: ffffffc06e124000 task.ti: ffffffc06e124000 PC is at guarantee_online_cpus+0x2c/0x58 LR is at cpuset_cpus_allowed+0x4c/0x6c <snip> Process taskset (pid: 1420, stack limit = 0xffffffc06e124020) Call trace: [<ffffffc0001389b0>] guarantee_online_cpus+0x2c/0x58 [<ffffffc00013b208>] cpuset_cpus_allowed+0x4c/0x6c [<ffffffc0000d61f0>] sched_setaffinity+0xc0/0x1ac [<ffffffc0000d6374>] SyS_sched_setaffinity+0x98/0xac [<ffffffc000085cb0>] el0_svc_naked+0x24/0x28 The top cpuset's effective_cpus are guaranteed to be identical to cpu_online_mask eventually. Hence fall back to cpu_online_mask when there is no intersection between top cpuset's effective_cpus and cpu_online_mask. Signed-off-by: Joonwoo Park <[email protected]> Acked-by: Li Zefan <[email protected]> Cc: Tejun Heo <[email protected]> Cc: [email protected] Cc: [email protected] Cc: <[email protected]> # 3.17+ Signed-off-by: Tejun Heo <[email protected]> commit f6d7c1b Author: Karl Beldan <[email protected]> Date: Mon Aug 29 07:45:49 2016 +0000 mtd: nand: davinci: Reinitialize the HW ECC engine in 4bit hwctl This fixes subpage writes when using 4-bit HW ECC. There has been numerous reports about ECC errors with devices using this driver for a while. Also the 4-bit ECC has been reported as broken with subpages in [1] and with 16 bits NANDs in the driver and in mach* board files both in mainline and in the vendor BSPs. What I saw with 4-bit ECC on a 16bits NAND (on an LCDK) which got me to try reinitializing the ECC engine: - R/W on whole pages properly generates/checks RS code - try writing the 1st subpage only of a blank page, the subpage is well written and the RS code properly generated, re-reading the same page the HW detects some ECC error, reading the same page again no ECC error is detected Note that the ECC engine is already reinitialized in the 1-bit case. Tested on my LCDK with UBI+UBIFS using subpages. This could potentially get rid of the issue workarounded in [1]. [1] 28c015a ("mtd: davinci-nand: disable subpage write for keystone-nand") Fixes: 6a4123e ("mtd: nand: davinci_nand, 4-bit ECC for smallpage") Cc: <[email protected]> Signed-off-by: Karl Beldan <[email protected]> Acked-by: Boris Brezillon <[email protected]> Signed-off-by: Brian Norris <[email protected]> commit a93295a Author: Roger Quadros <[email protected]> Date: Mon Aug 15 10:47:39 2016 +0300 mtd: nand: omap2: Don't call dma_release_channel() if dma_request_chan() failed dma_request_chan() can fail returning an error pointer. In this case prevent calling dma_release_channel() to prevent a ERR_PTR() dereference. As error path can be called even with no DMA configuration, info->dma can be NULL so don't call dma_release_channel() for that case either. Fixes: de3bfc4: ("mtd: nand: omap2: fix return value check in omap_nand_probe()") Reported-by: Dan Carpenter <[email protected]> Signed-off-by: Roger Quadros <[email protected]> Acked-by: Boris Brezillon <[email protected]> Signed-off-by: Brian Norris <[email protected]>

commit 28b89b9 upstream. A discrepancy between cpu_online_mask and cpuset's effective_cpus mask is inevitable during hotplug since cpuset defers updating of effective_cpus mask using a workqueue, during which time nothing prevents the system from more hotplug operations. For that reason guarantee_online_cpus() walks up the cpuset hierarchy until it finds an intersection under the assumption that top cpuset's effective_cpus mask intersects with cpu_online_mask even with such a race occurring. However a sequence of CPU hotplugs can open a time window, during which none of the effective CPUs in the top cpuset intersect with cpu_online_mask. For example when there are 4 possible CPUs 0-3 and only CPU0 is online: ======================== =========================== cpu_online_mask top_cpuset.effective_cpus ======================== =========================== echo 1 > cpu2/online. CPU hotplug notifier woke up hotplug work but not yet scheduled. [0,2] [0] echo 0 > cpu0/online. The workqueue is still runnable. [2] [0] ======================== =========================== Now there is no intersection between cpu_online_mask and top_cpuset.effective_cpus. Thus invoking sys_sched_setaffinity() at this moment can cause following: Unable to handle kernel NULL pointer dereference at virtual address 000000d0 ------------[ cut here ]------------ Kernel BUG at ffffffc0001389b0 [verbose debug info unavailable] Internal error: Oops - BUG: 96000005 [#1] PREEMPT SMP Modules linked in: CPU: 2 PID: 1420 Comm: taskset Tainted: G W 4.4.8+ torvalds#98 task: ffffffc06a5c4880 ti: ffffffc06e124000 task.ti: ffffffc06e124000 PC is at guarantee_online_cpus+0x2c/0x58 LR is at cpuset_cpus_allowed+0x4c/0x6c <snip> Process taskset (pid: 1420, stack limit = 0xffffffc06e124020) Call trace: [<ffffffc0001389b0>] guarantee_online_cpus+0x2c/0x58 [<ffffffc00013b208>] cpuset_cpus_allowed+0x4c/0x6c [<ffffffc0000d61f0>] sched_setaffinity+0xc0/0x1ac [<ffffffc0000d6374>] SyS_sched_setaffinity+0x98/0xac [<ffffffc000085cb0>] el0_svc_naked+0x24/0x28 The top cpuset's effective_cpus are guaranteed to be identical to cpu_online_mask eventually. Hence fall back to cpu_online_mask when there is no intersection between top cpuset's effective_cpus and cpu_online_mask. Signed-off-by: Joonwoo Park <[email protected]> Acked-by: Li Zefan <[email protected]> Cc: Tejun Heo <[email protected]> Cc: [email protected] Cc: [email protected] Signed-off-by: Tejun Heo <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>

[ Upstream commit 28b89b9 ] A discrepancy between cpu_online_mask and cpuset's effective_cpus mask is inevitable during hotplug since cpuset defers updating of effective_cpus mask using a workqueue, during which time nothing prevents the system from more hotplug operations. For that reason guarantee_online_cpus() walks up the cpuset hierarchy until it finds an intersection under the assumption that top cpuset's effective_cpus mask intersects with cpu_online_mask even with such a race occurring. However a sequence of CPU hotplugs can open a time window, during which none of the effective CPUs in the top cpuset intersect with cpu_online_mask. For example when there are 4 possible CPUs 0-3 and only CPU0 is online: ======================== =========================== cpu_online_mask top_cpuset.effective_cpus ======================== =========================== echo 1 > cpu2/online. CPU hotplug notifier woke up hotplug work but not yet scheduled. [0,2] [0] echo 0 > cpu0/online. The workqueue is still runnable. [2] [0] ======================== =========================== Now there is no intersection between cpu_online_mask and top_cpuset.effective_cpus. Thus invoking sys_sched_setaffinity() at this moment can cause following: Unable to handle kernel NULL pointer dereference at virtual address 000000d0 ------------[ cut here ]------------ Kernel BUG at ffffffc0001389b0 [verbose debug info unavailable] Internal error: Oops - BUG: 96000005 [#1] PREEMPT SMP Modules linked in: CPU: 2 PID: 1420 Comm: taskset Tainted: G W 4.4.8+ torvalds#98 task: ffffffc06a5c4880 ti: ffffffc06e124000 task.ti: ffffffc06e124000 PC is at guarantee_online_cpus+0x2c/0x58 LR is at cpuset_cpus_allowed+0x4c/0x6c <snip> Process taskset (pid: 1420, stack limit = 0xffffffc06e124020) Call trace: [<ffffffc0001389b0>] guarantee_online_cpus+0x2c/0x58 [<ffffffc00013b208>] cpuset_cpus_allowed+0x4c/0x6c [<ffffffc0000d61f0>] sched_setaffinity+0xc0/0x1ac [<ffffffc0000d6374>] SyS_sched_setaffinity+0x98/0xac [<ffffffc000085cb0>] el0_svc_naked+0x24/0x28 The top cpuset's effective_cpus are guaranteed to be identical to cpu_online_mask eventually. Hence fall back to cpu_online_mask when there is no intersection between top cpuset's effective_cpus and cpu_online_mask. Signed-off-by: Joonwoo Park <[email protected]> Acked-by: Li Zefan <[email protected]> Cc: Tejun Heo <[email protected]> Cc: [email protected] Cc: [email protected] Cc: <[email protected]> # 3.17+ Signed-off-by: Tejun Heo <[email protected]> Signed-off-by: Sasha Levin <[email protected]>

BugLink: http://bugs.launchpad.net/bugs/1631468 commit 28b89b9 upstream. A discrepancy between cpu_online_mask and cpuset's effective_cpus mask is inevitable during hotplug since cpuset defers updating of effective_cpus mask using a workqueue, during which time nothing prevents the system from more hotplug operations. For that reason guarantee_online_cpus() walks up the cpuset hierarchy until it finds an intersection under the assumption that top cpuset's effective_cpus mask intersects with cpu_online_mask even with such a race occurring. However a sequence of CPU hotplugs can open a time window, during which none of the effective CPUs in the top cpuset intersect with cpu_online_mask. For example when there are 4 possible CPUs 0-3 and only CPU0 is online: ======================== =========================== cpu_online_mask top_cpuset.effective_cpus ======================== =========================== echo 1 > cpu2/online. CPU hotplug notifier woke up hotplug work but not yet scheduled. [0,2] [0] echo 0 > cpu0/online. The workqueue is still runnable. [2] [0] ======================== =========================== Now there is no intersection between cpu_online_mask and top_cpuset.effective_cpus. Thus invoking sys_sched_setaffinity() at this moment can cause following: Unable to handle kernel NULL pointer dereference at virtual address 000000d0 ------------[ cut here ]------------ Kernel BUG at ffffffc0001389b0 [verbose debug info unavailable] Internal error: Oops - BUG: 96000005 [#1] PREEMPT SMP Modules linked in: CPU: 2 PID: 1420 Comm: taskset Tainted: G W 4.4.8+ torvalds#98 task: ffffffc06a5c4880 ti: ffffffc06e124000 task.ti: ffffffc06e124000 PC is at guarantee_online_cpus+0x2c/0x58 LR is at cpuset_cpus_allowed+0x4c/0x6c <snip> Process taskset (pid: 1420, stack limit = 0xffffffc06e124020) Call trace: [<ffffffc0001389b0>] guarantee_online_cpus+0x2c/0x58 [<ffffffc00013b208>] cpuset_cpus_allowed+0x4c/0x6c [<ffffffc0000d61f0>] sched_setaffinity+0xc0/0x1ac [<ffffffc0000d6374>] SyS_sched_setaffinity+0x98/0xac [<ffffffc000085cb0>] el0_svc_naked+0x24/0x28 The top cpuset's effective_cpus are guaranteed to be identical to cpu_online_mask eventually. Hence fall back to cpu_online_mask when there is no intersection between top cpuset's effective_cpus and cpu_online_mask. Signed-off-by: Joonwoo Park <[email protected]> Acked-by: Li Zefan <[email protected]> Cc: Tejun Heo <[email protected]> Cc: [email protected] Cc: [email protected] Signed-off-by: Tejun Heo <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]> Signed-off-by: Tim Gardner <[email protected]>

…h-fixes WARNING: line over 80 characters torvalds#98: FILE: mm/migrate.c:222: + /* Recheck VMA as permissions can change since migration started */ total: 0 errors, 1 warnings, 127 lines checked NOTE: For some of the reported defects, checkpatch may be able to mechanically convert to the typical style using --fix or --fix-inplace. ./patches/mm-convert-remove_migration_pte-to-use-page_vma_mapped_walk.patch has style problems, please review. NOTE: If any of the errors are false positives, please report them to the maintainer, see CHECKPATCH in MAINTAINERS. Please run checkpatch prior to sending patches Cc: Kirill A. Shutemov <[email protected]> Signed-off-by: Andrew Morton <[email protected]>

WARNING: line length of 108 exceeds 100 columns torvalds#97: FILE: tools/testing/selftests/vm/mremap_test.c:136: + char *start = mmap(NULL, 3 * page_size, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); WARNING: Missing a blank line after declarations torvalds#98: FILE: tools/testing/selftests/vm/mremap_test.c:137: + char *start = mmap(NULL, 3 * page_size, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); + munmap(start + page_size, page_size); ERROR: space required before the open parenthesis '(' torvalds#107: FILE: tools/testing/selftests/vm/mremap_test.c:146: + while(getline(&line, &len, fp) != -1) { ERROR: space required after that ',' (ctx:VxV) torvalds#108: FILE: tools/testing/selftests/vm/mremap_test.c:147: + char *first = strtok(line,"- "); ^ ERROR: space required after that ',' (ctx:VxV) torvalds#110: FILE: tools/testing/selftests/vm/mremap_test.c:149: + char *second = strtok(NULL,"- "); ^ WARNING: Missing a blank line after declarations torvalds#112: FILE: tools/testing/selftests/vm/mremap_test.c:151: + void *second_val = (void *) strtol(second, NULL, 16); + if (first_val == start && second_val == start + 3 * page_size) { total: 3 errors, 3 warnings, 113 lines checked NOTE: For some of the reported defects, checkpatch may be able to mechanically convert to the typical style using --fix or --fix-inplace. ./patches/mm-add-merging-after-mremap-resize.patch has style problems, please review. NOTE: If any of the errors are false positives, please report them to the maintainer, see CHECKPATCH in MAINTAINERS. Please run checkpatch prior to sending patches Cc: Jakub Matěna <[email protected]> Signed-off-by: Andrew Morton <[email protected]>

…ip_fwnode Commit faa87ce ("regmap-irq: Introduce config registers for irq types") added the num_config_regs, then commit 9edd4f5 ("regmap-irq: Deprecate type registers and virtual registers") suggested to replace num_type_reg with it. However, regmap_add_irq_chip_fwnode wasn't modified to use the new property. Later on, commit 255a03b ("ASoC: wcd9335: Convert irq chip to config regs") removed the old num_type_reg property from the WCD9335 driver's struct regmap_irq_chip, causing a null pointer dereference in regmap_irq_set_type when it tried to index d->type_buf as it was never allocated in regmap_add_irq_chip_fwnode: [ 39.199374] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 39.199383] Mem abort info: [ 39.199390] ESR = 0x0000000096000004 [ 39.199397] EC = 0x25: DABT (current EL), IL = 32 bits [ 39.199408] SET = 0, FnV = 0 [ 39.199415] EA = 0, S1PTW = 0 [ 39.199422] FSC = 0x04: level 0 translation fault [ 39.199430] Data abort info: [ 39.199436] ISV = 0, ISS = 0x00000004 [ 39.199443] CM = 0, WnR = 0 [ 39.199449] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000084549000 [ 39.199458] [0000000000000000] pgd=0000000000000000, p4d=0000000000000000 [ 39.199474] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP [ 39.199483] Modules linked in: snd_soc_wcd9335 regmap_slimbus panel_lgphilips_sw43101 ath10k_pci ath10k_core q6asm_dai msm venus_dec venus_enc ath q6routing q6afe_dai videobuf2_dma_contig mac80211 snd_soc_apq8096 q6asm q6adm snd_soc_qcom_common snd_q6dsp_common q6afe snd_soc_core q6core drm_dp_aux_bus ak7375 imx318 gpu_sched apr snd_compress libarc4 qcom_camss soundwire_bus v4l2_fwnode venus_core v4l2_async snd_pcm drm_display_helper videobuf2_dma_sg v4l2_mem2mem videobuf2_memops nxp_nci_i2c drm_kms_helper videobuf2_v4l2 nxp_nci hci_uart snd_timer btqca syscopyarea videobuf2_common nci snd sysfillrect videodev slim_qcom_ngd_ctrl soundcore sysimgblt nfc bluetooth pdr_interface fb_sys_fops mc i2c_qcom_cci lzo_rle slimbus qcom_spmi_haptics qcom_q6v5_pas qcom_q6v5_mss qcom_pil_info qcom_common qcom_q6v5 qcom_sysmon qmi_helpers socinfo mdt_loader pwm_ir_tx rmtfs_mem cfg80211 rfkill zram zsmalloc atmel_mxt_ts drm drm_panel_orientation_quirks ip_tables [ 39.199764] CPU: 0 PID: 214 Comm: kworker/u8:5 Tainted: G W 6.1.0-rc4+ torvalds#98 [ 39.199775] Hardware name: Xiaomi Mi Note 2 (DT) [ 39.199784] Workqueue: events_unbound deferred_probe_work_func [ 39.199809] pstate: 400000c5 (nZcv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 39.199819] pc : regmap_irq_set_type+0x84/0x1c0 [ 39.199833] lr : regmap_irq_set_type+0x58/0x1c0 [ 39.199846] sp : ffff80000b813810 [ 39.199852] x29: ffff80000b813810 x28: 0000000000000000 x27: ffff8000256b5df0 [ 39.199869] x26: 0000000000000000 x25: ffff0000b12ad400 x24: ffff0000044ee660 [ 39.199884] x23: 0000000000000000 x22: ffff800025691868 x21: 0000000000000001 [ 39.199900] x20: ffff800025691870 x19: ffff000002d04e00 x18: ffffffffffffffff [ 39.199915] x17: 0000000000000000 x16: ffff800008153b10 x15: 0000000000000006 [ 39.199930] x14: 0000000000000000 x13: ffff800009216eb0 x12: 0000000000000831 [ 39.199945] x11: 00000000000002bb x10: ffff80000926eeb0 x9 : ffff800009216eb0 [ 39.199960] x8 : 00000000ffffefff x7 : ffff80000926eeb0 x6 : 80000000fffff000 [ 39.199975] x5 : ffff0000fdce09d0 x4 : 0000000000000000 x3 : 0000000000000000 [ 39.199991] x2 : 0000000000000000 x1 : 0000000000000001 x0 : 0000000000000001 [ 39.200006] Call trace: [ 39.200014] regmap_irq_set_type+0x84/0x1c0 [ 39.200026] __irq_set_trigger+0x60/0x1c0 [ 39.200040] __setup_irq+0x2f4/0x78c [ 39.200051] request_threaded_irq+0xe8/0x1a0 [ 39.200063] devm_request_threaded_irq+0x80/0x100 [ 39.200074] wcd9335_codec_probe+0x21c/0x2f0 [snd_soc_wcd9335] [ 39.200098] snd_soc_component_probe+0x28/0x7c [snd_soc_core] [ 39.200167] soc_probe_component+0x1cc/0x380 [snd_soc_core] [ 39.200206] snd_soc_bind_card+0x45c/0xc80 [snd_soc_core] [ 39.200244] snd_soc_register_card+0xf0/0x110 [snd_soc_core] [ 39.200283] devm_snd_soc_register_card+0x4c/0xa4 [snd_soc_core] [ 39.200334] apq8096_platform_probe+0xd0/0xf0 [snd_soc_apq8096] [ 39.200353] platform_probe+0x68/0xc0 [ 39.200366] really_probe+0xc0/0x3dc [ 39.200375] __driver_probe_device+0x7c/0x190 [ 39.200384] driver_probe_device+0x3c/0x110 [ 39.200392] __device_attach_driver+0xbc/0x160 [ 39.200401] bus_for_each_drv+0x78/0xd0 [ 39.200414] __device_attach+0x9c/0x1c0 [ 39.200422] device_initial_probe+0x14/0x20 [ 39.200431] bus_probe_device+0x9c/0xa4 [ 39.200441] deferred_probe_work_func+0x9c/0xf0 [ 39.200456] process_one_work+0x1d4/0x330 [ 39.200471] worker_thread+0x6c/0x430 [ 39.200481] kthread+0x108/0x10c [ 39.200490] ret_from_fork+0x10/0x20 [ 39.200507] Code: f940c663 b9400681 1ac00af7 937e7ee4 (b8646860) [ 39.200518] ---[ end trace 0000000000000000 ]--- Use num_config_regs in regmap_add_irq_chip_fwnode instead of num_type_reg, and fall back to it if num_config_regs isn't defined to maintain backward compatibility. Fixes: faa87ce ("regmap-irq: Introduce config registers for irq types") Signed-off-by: Yassine Oudjana <[email protected]>

The eprobe's trigger, for the event it is attached to, needs access to the trace record in order to perform its function. This need is indicated by the TRIGGER_COND flag and properly set by the update_cond_flag() function. Currently, the cond flag is set after calling trace_event_trigger_enable_disable(), which leaves a small time gap in which the eprobe's trigger could be invoked without a trace record, causing a NULL pointer dereference issue. This issue can be easily reproduced by enabling an event probe for kmem/mm_page_alloc using any of its fields as such: root@localhost:/sys/kernel/tracing# echo 'e kmem/mm_page_alloc $gfp_flags' > dynamic_events root@localhost:/sys/kernel/tracing# echo 1 > events/eprobes/enable [ 30.847000] general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN PTI [ 30.848618] KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f] [ 30.849498] CPU: 0 PID: 223 Comm: bash Not tainted 6.1.0-rc5+ torvalds#98 [...] stripped [ 30.850623] RIP: 0010:get_event_field.isra.0+0x1b8/0x3f0 [...] stripped [ 30.856173] Call Trace: [ 30.856340] <TASK> [ 30.856489] process_fetch_insn+0x1289/0x19b0 [ 30.856789] ? write_comp_data+0x2f/0x90 [ 30.857061] ? __sanitizer_cov_trace_pc+0x25/0x60 [ 30.857379] ? __trace_eprobe_create+0x1d30/0x1d30 [ 30.857701] ? __sanitizer_cov_trace_pc+0x25/0x60 [ 30.858019] ? write_comp_data+0x2f/0x90 [ 30.858289] ? write_comp_data+0x2f/0x90 [ 30.858562] eprobe_trigger_func+0x1253/0x2180 [ 30.858867] ? kasan_poison.part.0+0x3c/0x50 [ 30.859165] ? process_fetch_insn+0x19b0/0x19b0 [ 30.859473] ? get_page_from_freelist+0x10c1/0x29c0 [ 30.859806] ? rcu_read_lock_bh_held+0xd0/0xd0 [ 30.860114] ? write_comp_data+0x2f/0x90 [ 30.860387] event_triggers_call+0x293/0x410 [ 30.860683] __trace_trigger_soft_disabled+0xbb/0xe0 [ 30.861019] trace_event_raw_event_mm_page_alloc+0xb5/0xc0 [ 30.861389] __alloc_pages+0x4cd/0x760 [ 30.861651] ? __alloc_pages_slowpath.constprop.0+0x2480/0x2480 [ 30.862047] ? tracepoint_probe_register_prio_may_exist+0x100/0x100 [ 30.862464] ? __sanitizer_cov_trace_pc+0x25/0x60 [ 30.862780] ? write_comp_data+0x2f/0x90 [ 30.863055] trace_buffered_event_enable+0xc6/0x440 [ 30.863381] __ftrace_event_enable_disable+0x16a/0x880 [ 30.863728] trace_event_enable_disable+0x2a/0x40 [ 30.864043] trace_event_trigger_enable_disable.part.0+0x70/0x90 [ 30.864446] trace_event_trigger_enable_disable+0x31/0xc0 [ 30.864806] eprobe_register+0x49a/0xdf0 [ 30.865080] ? disable_eprobe+0x370/0x370 [ 30.865360] ? mutex_unlock+0x16/0x20 [ 30.865618] ? write_comp_data+0x2f/0x90 [ 30.865897] __ftrace_event_enable_disable+0x4c1/0x880 [ 30.866247] __ftrace_set_clr_event_nolock+0x297/0x390 [ 30.866598] __ftrace_set_clr_event+0x43/0x70 [ 30.866901] system_enable_write+0x1f7/0x2a0 [ 30.867214] ? event_enable_write+0x290/0x290 [ 30.867521] ? rcu_read_lock_held+0xc0/0xc0 [ 30.867842] ? write_comp_data+0x2f/0x90 [ 30.868176] ? write_comp_data+0x2f/0x90 [ 30.868467] vfs_write+0x311/0xe50 [ 30.868752] ? event_enable_write+0x290/0x290 [ 30.869067] ? kernel_write+0x5b0/0x5b0 [ 30.869329] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 30.869675] ? lock_is_held_type+0xaf/0x120 [ 30.869954] ? close_fd+0x6e/0xb0 [ 30.870182] ? write_comp_data+0x2f/0x90 [ 30.870453] ? __sanitizer_cov_trace_pc+0x25/0x60 [ 30.870772] ? write_comp_data+0x2f/0x90 [ 30.871043] ? write_comp_data+0x2f/0x90 [ 30.871315] ksys_write+0x158/0x2a0 [ 30.871558] ? __ia32_sys_read+0xc0/0xc0 [ 30.871827] ? syscall_enter_from_user_mode+0x25/0x70 [ 30.872169] ? do_syscall_64+0x3b/0x90 [ 30.872432] __x64_sys_write+0x7c/0xc0 [ 30.872691] ? syscall_enter_from_user_mode+0x25/0x70 [ 30.873028] do_syscall_64+0x60/0x90 [ 30.873279] ? syscall_exit_to_user_mode+0x4a/0x60 [ 30.873597] ? do_syscall_64+0x6d/0x90 [ 30.873857] ? fpregs_assert_state_consistent+0x90/0xf0 [ 30.874214] ? syscall_exit_to_user_mode+0x4a/0x60 [ 30.874535] ? do_syscall_64+0x6d/0x90 [ 30.874794] ? do_syscall_64+0x6d/0x90 [ 30.875118] ? do_syscall_64+0x6d/0x90 [ 30.875379] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 30.875712] RIP: 0033:0x7f7cc14da8f3 [...] stripped [ 30.879875] </TASK> [...] stripped [ 30.881930] ---[ end trace 0000000000000000 ]--- [ 30.882237] RIP: 0010:get_event_field.isra.0+0x1b8/0x3f0 [...] stripped [ 30.887734] note: bash[223] exited with preempt_count 2 That happens because enable_eprobe() will eventually trigger the kmem/mm_page_alloc trace event: - enable_eprobe [trace_eprobe.c] - trace_event_trigger_enable_disable [trace_events_trigger.c] - trace_event_enable_disable [trace_events.c] - __ftrace_event_enable_disable [trace_events.c] - trace_buffered_event_enable [trace.c] - alloc_pages_node [gfp.h] ... - __alloc_pages [page_alloc.c] - trace_mm_page_alloc // eprobe event file without TRIGGER_COND bit set By the time kmem/mm_page_alloc trace event is hit, the eprobe event file does not have the TRIGGER_COND flag set yet, which causes the eprobe's trigger to be invoked (through the trace_trigger_soft_disabled() path) without a trace record, causing a NULL pointer dereference when fetching the event fields. Fix this by setting the cond flag beforehand when enabling the eprobe's trigger. Fixes: 7491e2c ("tracing: Add a probe that attaches to trace events") Signed-off-by: Rafael Mendonca <[email protected]>

[ Upstream commit a61df3c ] syzkaller found the following JFFS2 splat: Unable to handle kernel paging request at virtual address dfffa00000000001 Mem abort info: ESR = 0x96000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 Data abort info: ISV = 0, ISS = 0x00000004 CM = 0, WnR = 0 [dfffa00000000001] address between user and kernel address ranges Internal error: Oops: 96000004 [#1] SMP Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: CPU: 0 PID: 12745 Comm: syz-executor.5 Tainted: G S 5.9.0-rc8+ torvalds#98 Hardware name: linux,dummy-virt (DT) pstate: 20400005 (nzCv daif +PAN -UAO BTYPE=--) pc : jffs2_parse_param+0x138/0x308 fs/jffs2/super.c:206 lr : jffs2_parse_param+0x108/0x308 fs/jffs2/super.c:205 sp : ffff000022a57910 x29: ffff000022a57910 x28: 0000000000000000 x27: ffff000057634008 x26: 000000000000d800 x25: 000000000000d800 x24: ffff0000271a9000 x23: ffffa0001adb5dc0 x22: ffff000023fdcf00 x21: 1fffe0000454af2c x20: ffff000024cc9400 x19: 0000000000000000 x18: 0000000000000000 x17: 0000000000000000 x16: ffffa000102dbdd0 x15: 0000000000000000 x14: ffffa000109e44bc x13: ffffa00010a3a26c x12: ffff80000476e0b3 x11: 1fffe0000476e0b2 x10: ffff80000476e0b2 x9 : ffffa00010a3ad60 x8 : ffff000023b70593 x7 : 0000000000000003 x6 : 00000000f1f1f1f1 x5 : ffff000023fdcf00 x4 : 0000000000000002 x3 : ffffa00010000000 x2 : 0000000000000001 x1 : dfffa00000000000 x0 : 0000000000000008 Call trace: jffs2_parse_param+0x138/0x308 fs/jffs2/super.c:206 vfs_parse_fs_param+0x234/0x4e8 fs/fs_context.c:117 vfs_parse_fs_string+0xe8/0x148 fs/fs_context.c:161 generic_parse_monolithic+0x17c/0x208 fs/fs_context.c:201 parse_monolithic_mount_data+0x7c/0xa8 fs/fs_context.c:649 do_new_mount fs/namespace.c:2871 [inline] path_mount+0x548/0x1da8 fs/namespace.c:3192 do_mount+0x124/0x138 fs/namespace.c:3205 __do_sys_mount fs/namespace.c:3413 [inline] __se_sys_mount fs/namespace.c:3390 [inline] __arm64_sys_mount+0x164/0x238 fs/namespace.c:3390 __invoke_syscall arch/arm64/kernel/syscall.c:36 [inline] invoke_syscall arch/arm64/kernel/syscall.c:48 [inline] el0_svc_common.constprop.0+0x15c/0x598 arch/arm64/kernel/syscall.c:149 do_el0_svc+0x60/0x150 arch/arm64/kernel/syscall.c:195 el0_svc+0x34/0xb0 arch/arm64/kernel/entry-common.c:226 el0_sync_handler+0xc8/0x5b4 arch/arm64/kernel/entry-common.c:236 el0_sync+0x15c/0x180 arch/arm64/kernel/entry.S:663 Code: d2d40001 f2fbffe1 91002260 d343fc02 (38e16841) ---[ end trace 4edf690313deda44 ]--- This is because since ec10a24, the option parsing happens before fill_super and so the MTD device isn't associated with the filesystem. Defer the size check until there is a valid association. Fixes: ec10a24 ("vfs: Convert jffs2 to use the new mount API") Cc: <[email protected]> Cc: David Howells <[email protected]> Signed-off-by: Jamie Iles <[email protected]> Signed-off-by: Richard Weinberger <[email protected]> Signed-off-by: Sasha Levin <[email protected]>

There are several places where either chan->lock or chan->vchan.lock was not held. Add appropriate locking. This fixes lockdep warnings like [ 31.077578] ------------[ cut here ]------------ [ 31.077831] WARNING: CPU: 2 PID: 40 at drivers/dma/xilinx/xilinx_dpdma.c:834 xilinx_dpdma_chan_queue_transfer+0x274/0x5e0 [ 31.077953] Modules linked in: [ 31.078019] CPU: 2 PID: 40 Comm: kworker/u12:1 Not tainted 6.6.20+ torvalds#98 [ 31.078102] Hardware name: xlnx,zynqmp (DT) [ 31.078169] Workqueue: events_unbound deferred_probe_work_func [ 31.078272] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 31.078377] pc : xilinx_dpdma_chan_queue_transfer+0x274/0x5e0 [ 31.078473] lr : xilinx_dpdma_chan_queue_transfer+0x270/0x5e0 [ 31.078550] sp : ffffffc083bb2e10 [ 31.078590] x29: ffffffc083bb2e10 x28: 0000000000000000 x27: ffffff880165a168 [ 31.078754] x26: ffffff880164e920 x25: ffffff880164eab8 x24: ffffff880164d480 [ 31.078920] x23: ffffff880165a148 x22: ffffff880164e988 x21: 0000000000000000 [ 31.079132] x20: ffffffc082aa3000 x19: ffffff880164e880 x18: 0000000000000000 [ 31.079295] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 [ 31.079453] x14: 0000000000000000 x13: ffffff8802263dc0 x12: 0000000000000001 [ 31.079613] x11: 0001ffc083bb2e34 x10: 0001ff880164e98f x9 : 0001ffc082aa3def [ 31.079824] x8 : 0001ffc082aa3dec x7 : 0000000000000000 x6 : 0000000000000516 [ 31.079982] x5 : ffffffc7f8d43000 x4 : ffffff88003c9c40 x3 : ffffffffffffffff [ 31.080147] x2 : ffffffc7f8d43000 x1 : 00000000000000c0 x0 : 0000000000000000 [ 31.080307] Call trace: [ 31.080340] xilinx_dpdma_chan_queue_transfer+0x274/0x5e0 [ 31.080518] xilinx_dpdma_issue_pending+0x11c/0x120 [ 31.080595] zynqmp_disp_layer_update+0x180/0x3ac [ 31.080712] zynqmp_dpsub_plane_atomic_update+0x11c/0x21c [ 31.080825] drm_atomic_helper_commit_planes+0x20c/0x684 [ 31.080951] drm_atomic_helper_commit_tail+0x5c/0xb0 [ 31.081139] commit_tail+0x234/0x294 [ 31.081246] drm_atomic_helper_commit+0x1f8/0x210 [ 31.081363] drm_atomic_commit+0x100/0x140 [ 31.081477] drm_client_modeset_commit_atomic+0x318/0x384 [ 31.081634] drm_client_modeset_commit_locked+0x8c/0x24c [ 31.081725] drm_client_modeset_commit+0x34/0x5c [ 31.081812] __drm_fb_helper_restore_fbdev_mode_unlocked+0x104/0x168 [ 31.081899] drm_fb_helper_set_par+0x50/0x70 [ 31.081971] fbcon_init+0x538/0xc48 [ 31.082047] visual_init+0x16c/0x23c [ 31.082207] do_bind_con_driver.isra.0+0x2d0/0x634 [ 31.082320] do_take_over_console+0x24c/0x33c [ 31.082429] do_fbcon_takeover+0xbc/0x1b0 [ 31.082503] fbcon_fb_registered+0x2d0/0x34c [ 31.082663] register_framebuffer+0x27c/0x38c [ 31.082767] __drm_fb_helper_initial_config_and_unlock+0x5c0/0x91c [ 31.082939] drm_fb_helper_initial_config+0x50/0x74 [ 31.083012] drm_fbdev_dma_client_hotplug+0xb8/0x108 [ 31.083115] drm_client_register+0xa0/0xf4 [ 31.083195] drm_fbdev_dma_setup+0xb0/0x1cc [ 31.083293] zynqmp_dpsub_drm_init+0x45c/0x4e0 [ 31.083431] zynqmp_dpsub_probe+0x444/0x5e0 [ 31.083616] platform_probe+0x8c/0x13c [ 31.083713] really_probe+0x258/0x59c [ 31.083793] __driver_probe_device+0xc4/0x224 [ 31.083878] driver_probe_device+0x70/0x1c0 [ 31.083961] __device_attach_driver+0x108/0x1e0 [ 31.084052] bus_for_each_drv+0x9c/0x100 [ 31.084125] __device_attach+0x100/0x298 [ 31.084207] device_initial_probe+0x14/0x20 [ 31.084292] bus_probe_device+0xd8/0xdc [ 31.084368] deferred_probe_work_func+0x11c/0x180 [ 31.084451] process_one_work+0x3ac/0x988 [ 31.084643] worker_thread+0x398/0x694 [ 31.084752] kthread+0x1bc/0x1c0 [ 31.084848] ret_from_fork+0x10/0x20 [ 31.084932] irq event stamp: 64549 [ 31.084970] hardirqs last enabled at (64548): [<ffffffc081adf35c>] _raw_spin_unlock_irqrestore+0x80/0x90 [ 31.085157] hardirqs last disabled at (64549): [<ffffffc081adf010>] _raw_spin_lock_irqsave+0xc0/0xdc [ 31.085277] softirqs last enabled at (64503): [<ffffffc08001071c>] __do_softirq+0x47c/0x500 [ 31.085390] softirqs last disabled at (64498): [<ffffffc080017134>] ____do_softirq+0x10/0x1c [ 31.085501] ---[ end trace 0000000000000000 ]--- Fixes: 7cbb0c6 ("dmaengine: xilinx: dpdma: Add the Xilinx DisplayPort DMA engine driver") Signed-off-by: Sean Anderson <[email protected]>

There are several places where either chan->lock or chan->vchan.lock was not held. Add appropriate locking. This fixes lockdep warnings like [ 31.077578] ------------[ cut here ]------------ [ 31.077831] WARNING: CPU: 2 PID: 40 at drivers/dma/xilinx/xilinx_dpdma.c:834 xilinx_dpdma_chan_queue_transfer+0x274/0x5e0 [ 31.077953] Modules linked in: [ 31.078019] CPU: 2 PID: 40 Comm: kworker/u12:1 Not tainted 6.6.20+ torvalds#98 [ 31.078102] Hardware name: xlnx,zynqmp (DT) [ 31.078169] Workqueue: events_unbound deferred_probe_work_func [ 31.078272] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 31.078377] pc : xilinx_dpdma_chan_queue_transfer+0x274/0x5e0 [ 31.078473] lr : xilinx_dpdma_chan_queue_transfer+0x270/0x5e0 [ 31.078550] sp : ffffffc083bb2e10 [ 31.078590] x29: ffffffc083bb2e10 x28: 0000000000000000 x27: ffffff880165a168 [ 31.078754] x26: ffffff880164e920 x25: ffffff880164eab8 x24: ffffff880164d480 [ 31.078920] x23: ffffff880165a148 x22: ffffff880164e988 x21: 0000000000000000 [ 31.079132] x20: ffffffc082aa3000 x19: ffffff880164e880 x18: 0000000000000000 [ 31.079295] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 [ 31.079453] x14: 0000000000000000 x13: ffffff8802263dc0 x12: 0000000000000001 [ 31.079613] x11: 0001ffc083bb2e34 x10: 0001ff880164e98f x9 : 0001ffc082aa3def [ 31.079824] x8 : 0001ffc082aa3dec x7 : 0000000000000000 x6 : 0000000000000516 [ 31.079982] x5 : ffffffc7f8d43000 x4 : ffffff88003c9c40 x3 : ffffffffffffffff [ 31.080147] x2 : ffffffc7f8d43000 x1 : 00000000000000c0 x0 : 0000000000000000 [ 31.080307] Call trace: [ 31.080340] xilinx_dpdma_chan_queue_transfer+0x274/0x5e0 [ 31.080518] xilinx_dpdma_issue_pending+0x11c/0x120 [ 31.080595] zynqmp_disp_layer_update+0x180/0x3ac [ 31.080712] zynqmp_dpsub_plane_atomic_update+0x11c/0x21c [ 31.080825] drm_atomic_helper_commit_planes+0x20c/0x684 [ 31.080951] drm_atomic_helper_commit_tail+0x5c/0xb0 [ 31.081139] commit_tail+0x234/0x294 [ 31.081246] drm_atomic_helper_commit+0x1f8/0x210 [ 31.081363] drm_atomic_commit+0x100/0x140 [ 31.081477] drm_client_modeset_commit_atomic+0x318/0x384 [ 31.081634] drm_client_modeset_commit_locked+0x8c/0x24c [ 31.081725] drm_client_modeset_commit+0x34/0x5c [ 31.081812] __drm_fb_helper_restore_fbdev_mode_unlocked+0x104/0x168 [ 31.081899] drm_fb_helper_set_par+0x50/0x70 [ 31.081971] fbcon_init+0x538/0xc48 [ 31.082047] visual_init+0x16c/0x23c [ 31.082207] do_bind_con_driver.isra.0+0x2d0/0x634 [ 31.082320] do_take_over_console+0x24c/0x33c [ 31.082429] do_fbcon_takeover+0xbc/0x1b0 [ 31.082503] fbcon_fb_registered+0x2d0/0x34c [ 31.082663] register_framebuffer+0x27c/0x38c [ 31.082767] __drm_fb_helper_initial_config_and_unlock+0x5c0/0x91c [ 31.082939] drm_fb_helper_initial_config+0x50/0x74 [ 31.083012] drm_fbdev_dma_client_hotplug+0xb8/0x108 [ 31.083115] drm_client_register+0xa0/0xf4 [ 31.083195] drm_fbdev_dma_setup+0xb0/0x1cc [ 31.083293] zynqmp_dpsub_drm_init+0x45c/0x4e0 [ 31.083431] zynqmp_dpsub_probe+0x444/0x5e0 [ 31.083616] platform_probe+0x8c/0x13c [ 31.083713] really_probe+0x258/0x59c [ 31.083793] __driver_probe_device+0xc4/0x224 [ 31.083878] driver_probe_device+0x70/0x1c0 [ 31.083961] __device_attach_driver+0x108/0x1e0 [ 31.084052] bus_for_each_drv+0x9c/0x100 [ 31.084125] __device_attach+0x100/0x298 [ 31.084207] device_initial_probe+0x14/0x20 [ 31.084292] bus_probe_device+0xd8/0xdc [ 31.084368] deferred_probe_work_func+0x11c/0x180 [ 31.084451] process_one_work+0x3ac/0x988 [ 31.084643] worker_thread+0x398/0x694 [ 31.084752] kthread+0x1bc/0x1c0 [ 31.084848] ret_from_fork+0x10/0x20 [ 31.084932] irq event stamp: 64549 [ 31.084970] hardirqs last enabled at (64548): [<ffffffc081adf35c>] _raw_spin_unlock_irqrestore+0x80/0x90 [ 31.085157] hardirqs last disabled at (64549): [<ffffffc081adf010>] _raw_spin_lock_irqsave+0xc0/0xdc [ 31.085277] softirqs last enabled at (64503): [<ffffffc08001071c>] __do_softirq+0x47c/0x500 [ 31.085390] softirqs last disabled at (64498): [<ffffffc080017134>] ____do_softirq+0x10/0x1c [ 31.085501] ---[ end trace 0000000000000000 ]--- Fixes: 7cbb0c6 ("dmaengine: xilinx: dpdma: Add the Xilinx DisplayPort DMA engine driver") Signed-off-by: Sean Anderson <[email protected]> Reviewed-by: Tomi Valkeinen <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Vinod Koul <[email protected]>

[ Upstream commit 244296c ] There are several places where either chan->lock or chan->vchan.lock was not held. Add appropriate locking. This fixes lockdep warnings like [ 31.077578] ------------[ cut here ]------------ [ 31.077831] WARNING: CPU: 2 PID: 40 at drivers/dma/xilinx/xilinx_dpdma.c:834 xilinx_dpdma_chan_queue_transfer+0x274/0x5e0 [ 31.077953] Modules linked in: [ 31.078019] CPU: 2 PID: 40 Comm: kworker/u12:1 Not tainted 6.6.20+ torvalds#98 [ 31.078102] Hardware name: xlnx,zynqmp (DT) [ 31.078169] Workqueue: events_unbound deferred_probe_work_func [ 31.078272] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 31.078377] pc : xilinx_dpdma_chan_queue_transfer+0x274/0x5e0 [ 31.078473] lr : xilinx_dpdma_chan_queue_transfer+0x270/0x5e0 [ 31.078550] sp : ffffffc083bb2e10 [ 31.078590] x29: ffffffc083bb2e10 x28: 0000000000000000 x27: ffffff880165a168 [ 31.078754] x26: ffffff880164e920 x25: ffffff880164eab8 x24: ffffff880164d480 [ 31.078920] x23: ffffff880165a148 x22: ffffff880164e988 x21: 0000000000000000 [ 31.079132] x20: ffffffc082aa3000 x19: ffffff880164e880 x18: 0000000000000000 [ 31.079295] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 [ 31.079453] x14: 0000000000000000 x13: ffffff8802263dc0 x12: 0000000000000001 [ 31.079613] x11: 0001ffc083bb2e34 x10: 0001ff880164e98f x9 : 0001ffc082aa3def [ 31.079824] x8 : 0001ffc082aa3dec x7 : 0000000000000000 x6 : 0000000000000516 [ 31.079982] x5 : ffffffc7f8d43000 x4 : ffffff88003c9c40 x3 : ffffffffffffffff [ 31.080147] x2 : ffffffc7f8d43000 x1 : 00000000000000c0 x0 : 0000000000000000 [ 31.080307] Call trace: [ 31.080340] xilinx_dpdma_chan_queue_transfer+0x274/0x5e0 [ 31.080518] xilinx_dpdma_issue_pending+0x11c/0x120 [ 31.080595] zynqmp_disp_layer_update+0x180/0x3ac [ 31.080712] zynqmp_dpsub_plane_atomic_update+0x11c/0x21c [ 31.080825] drm_atomic_helper_commit_planes+0x20c/0x684 [ 31.080951] drm_atomic_helper_commit_tail+0x5c/0xb0 [ 31.081139] commit_tail+0x234/0x294 [ 31.081246] drm_atomic_helper_commit+0x1f8/0x210 [ 31.081363] drm_atomic_commit+0x100/0x140 [ 31.081477] drm_client_modeset_commit_atomic+0x318/0x384 [ 31.081634] drm_client_modeset_commit_locked+0x8c/0x24c [ 31.081725] drm_client_modeset_commit+0x34/0x5c [ 31.081812] __drm_fb_helper_restore_fbdev_mode_unlocked+0x104/0x168 [ 31.081899] drm_fb_helper_set_par+0x50/0x70 [ 31.081971] fbcon_init+0x538/0xc48 [ 31.082047] visual_init+0x16c/0x23c [ 31.082207] do_bind_con_driver.isra.0+0x2d0/0x634 [ 31.082320] do_take_over_console+0x24c/0x33c [ 31.082429] do_fbcon_takeover+0xbc/0x1b0 [ 31.082503] fbcon_fb_registered+0x2d0/0x34c [ 31.082663] register_framebuffer+0x27c/0x38c [ 31.082767] __drm_fb_helper_initial_config_and_unlock+0x5c0/0x91c [ 31.082939] drm_fb_helper_initial_config+0x50/0x74 [ 31.083012] drm_fbdev_dma_client_hotplug+0xb8/0x108 [ 31.083115] drm_client_register+0xa0/0xf4 [ 31.083195] drm_fbdev_dma_setup+0xb0/0x1cc [ 31.083293] zynqmp_dpsub_drm_init+0x45c/0x4e0 [ 31.083431] zynqmp_dpsub_probe+0x444/0x5e0 [ 31.083616] platform_probe+0x8c/0x13c [ 31.083713] really_probe+0x258/0x59c [ 31.083793] __driver_probe_device+0xc4/0x224 [ 31.083878] driver_probe_device+0x70/0x1c0 [ 31.083961] __device_attach_driver+0x108/0x1e0 [ 31.084052] bus_for_each_drv+0x9c/0x100 [ 31.084125] __device_attach+0x100/0x298 [ 31.084207] device_initial_probe+0x14/0x20 [ 31.084292] bus_probe_device+0xd8/0xdc [ 31.084368] deferred_probe_work_func+0x11c/0x180 [ 31.084451] process_one_work+0x3ac/0x988 [ 31.084643] worker_thread+0x398/0x694 [ 31.084752] kthread+0x1bc/0x1c0 [ 31.084848] ret_from_fork+0x10/0x20 [ 31.084932] irq event stamp: 64549 [ 31.084970] hardirqs last enabled at (64548): [<ffffffc081adf35c>] _raw_spin_unlock_irqrestore+0x80/0x90 [ 31.085157] hardirqs last disabled at (64549): [<ffffffc081adf010>] _raw_spin_lock_irqsave+0xc0/0xdc [ 31.085277] softirqs last enabled at (64503): [<ffffffc08001071c>] __do_softirq+0x47c/0x500 [ 31.085390] softirqs last disabled at (64498): [<ffffffc080017134>] ____do_softirq+0x10/0x1c [ 31.085501] ---[ end trace 0000000000000000 ]--- Fixes: 7cbb0c6 ("dmaengine: xilinx: dpdma: Add the Xilinx DisplayPort DMA engine driver") Signed-off-by: Sean Anderson <[email protected]> Reviewed-by: Tomi Valkeinen <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Vinod Koul <[email protected]> Signed-off-by: Sasha Levin <[email protected]>

Zijian Zhang says: ==================== Several fixes to test_sockmap and added push/pop logic for msg_verify_data Before the fixes, some of the tests in test_sockmap are problematic, resulting in pseudo-correct result. 1. txmsg_pass is not set in some tests, as a result, no eBPF program is attached to the sockmap. 2. In SENDPAGE, a wrong iov_length in test_send_large may result in some test skippings and failures. 3. The calculation of total_bytes in msg_loop_rx is wrong, which may cause msg_loop_rx end early and skip some data tests. Besides, for msg_verify_data, I added push/pop checking logic to function msg_verify_data and added more tests for different cases. After that, I found that there are some bugs in bpf_msg_push_data, bpf_msg_pop_data and sk_msg_reset_curr, and fix them. I guess the reason why they have not been exposed is that because of the above problems, they will not be triggered. With the fixes, we can pass the sockmap test with data integrity test now. However, the fixes to test_sockmap expose more problems in sockhash test with SENDPAGE and ktls with SENDPAGE. v1 -> v2: - Rebased to the latest bpf-next net branch. The problem I observed, 1. In sockhash test, a NULL pointer kernel BUG will be reported for nearly every cork test. More inspections are needed for splice_to_socket. BUG: kernel NULL pointer dereference, address: 0000000000000008 PGD 0 P4D 0 Oops: Oops: 0000 [#3] PREEMPT SMP PTI CPU: 3 UID: 0 PID: 2122 Comm: test_sockmap 6.12.0-rc2.bm.1-amd64+ torvalds#98 Tainted: [D]=DIE Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:splice_to_socket+0x34a/0x480 Call Trace: <TASK> ? __die_body+0x1e/0x60 ? page_fault_oops+0x159/0x4d0 ? exc_page_fault+0x7e/0x180 ? asm_exc_page_fault+0x26/0x30 ? splice_to_socket+0x34a/0x480 ? __memcg_slab_post_alloc_hook+0x205/0x3c0 ? alloc_pipe_info+0xd6/0x1f0 ? __kmalloc_noprof+0x37f/0x3b0 direct_splice_actor+0x40/0x100 splice_direct_to_actor+0xfd/0x290 ? __pfx_direct_splice_actor+0x10/0x10 do_splice_direct_actor+0x82/0xb0 ? __pfx_direct_file_splice_eof+0x10/0x10 do_splice_direct+0x13/0x20 ? __pfx_direct_splice_actor+0x10/0x10 do_sendfile+0x33c/0x3f0 __x64_sys_sendfile64+0xa7/0xc0 do_syscall_64+0x62/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e </TASK> Modules linked in: CR2: 0000000000000008 ---[ end trace 0000000000000000 ]--- 2. txmsg_pass are not set before, and some tests are skipped. Now after the fixes, we have some failure cases now. More fixes are needed either for the selftest or the ktls kernel code. 1/ 6 sockhash:ktls:txmsg test passthrough:OK 2/ 6 sockhash:ktls:txmsg test redirect:OK 3/ 1 sockhash:ktls:txmsg test redirect wait send mem:OK 4/ 6 sockhash:ktls:txmsg test drop:OK 5/ 6 sockhash:ktls:txmsg test ingress redirect:OK 6/ 7 sockhash:ktls:txmsg test skb:OK 7/12 sockhash:ktls:txmsg test apply:OK 8/12 sockhash:ktls:txmsg test cork:OK 9/ 3 sockhash:ktls:txmsg test hanging corks:OK detected data corruption @Iov[0]:0 17 != 00, 03 ?= 01 data verify msg failed: Unknown error -2001 rx thread exited with err 1. detected data corruption @Iov[0]:0 17 != 00, 03 ?= 01 data verify msg failed: Unknown error -2001 rx thread exited with err 1. 10/11 sockhash:ktls:txmsg test push_data:FAIL detected data corruption @Iov[0]:0 17 != 00, 00 ?= 01 data verify msg failed: Unknown error -2001 rx thread exited with err 1. detected data corruption @Iov[0]:0 17 != 00, 00 ?= 01 data verify msg failed: Unknown error -2001 rx thread exited with err 1. detected data corruption @Iov[0]:0 17 != 00, 03 ?= 01 data verify msg failed: Unknown error -2001 rx thread exited with err 1. detected data corruption @Iov[0]:0 17 != 00, 03 ?= 01 data verify msg failed: Unknown error -2001 rx thread exited with err 1. detected data corruption @Iov[0]:0 17 != 00, 03 ?= 01 data verify msg failed: Unknown error -2001 rx thread exited with err 1. detected data corruption @Iov[0]:0 17 != 00, 03 ?= 01 data verify msg failed: Unknown error -2001 rx thread exited with err 1. detected data corruption @Iov[0]:0 17 != 00, 03 ?= 01 data verify msg failed: Unknown error -2001 rx thread exited with err 1. detected data corruption @Iov[0]:0 17 != 00, 03 ?= 01 data verify msg failed: Unknown error -2001 rx thread exited with err 1. 11/17 sockhash:ktls:txmsg test pull-data:FAIL recv failed(): Invalid argument rx thread exited with err 1. recv failed(): Invalid argument rx thread exited with err 1. recv failed(): Bad message rx thread exited with err 1. detected data corruption @Iov[0]:0 17 != 00, 03 ?= 01 data verify msg failed: Unknown error -2001 rx thread exited with err 1. detected data corruption @Iov[0]:0 17 != 00, 03 ?= 01 data verify msg failed: Unknown error -2001 rx thread exited with err 1. 12/ 9 sockhash:ktls:txmsg test pop-data:FAIL recv failed(): Bad message rx thread exited with err 1. recv failed(): Bad message rx thread exited with err 1. 13/ 6 sockhash:ktls:txmsg test push/pop data:FAIL 14/ 1 sockhash:ktls:txmsg test ingress parser:OK 15/ 0 sockhash:ktls:txmsg test ingress parser2:OK Pass: 11 Fail: 17 ==================== Signed-off-by: Martin KaFai Lau <[email protected]>

There are several places where either chan->lock or chan->vchan.lock was not held. Add appropriate locking. This fixes lockdep warnings like [ 31.077578] ------------[ cut here ]------------ [ 31.077831] WARNING: CPU: 2 PID: 40 at drivers/dma/xilinx/xilinx_dpdma.c:834 xilinx_dpdma_chan_queue_transfer+0x274/0x5e0 [ 31.077953] Modules linked in: [ 31.078019] CPU: 2 PID: 40 Comm: kworker/u12:1 Not tainted 6.6.20+ torvalds#98 [ 31.078102] Hardware name: xlnx,zynqmp (DT) [ 31.078169] Workqueue: events_unbound deferred_probe_work_func [ 31.078272] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 31.078377] pc : xilinx_dpdma_chan_queue_transfer+0x274/0x5e0 [ 31.078473] lr : xilinx_dpdma_chan_queue_transfer+0x270/0x5e0 [ 31.078550] sp : ffffffc083bb2e10 [ 31.078590] x29: ffffffc083bb2e10 x28: 0000000000000000 x27: ffffff880165a168 [ 31.078754] x26: ffffff880164e920 x25: ffffff880164eab8 x24: ffffff880164d480 [ 31.078920] x23: ffffff880165a148 x22: ffffff880164e988 x21: 0000000000000000 [ 31.079132] x20: ffffffc082aa3000 x19: ffffff880164e880 x18: 0000000000000000 [ 31.079295] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 [ 31.079453] x14: 0000000000000000 x13: ffffff8802263dc0 x12: 0000000000000001 [ 31.079613] x11: 0001ffc083bb2e34 x10: 0001ff880164e98f x9 : 0001ffc082aa3def [ 31.079824] x8 : 0001ffc082aa3dec x7 : 0000000000000000 x6 : 0000000000000516 [ 31.079982] x5 : ffffffc7f8d43000 x4 : ffffff88003c9c40 x3 : ffffffffffffffff [ 31.080147] x2 : ffffffc7f8d43000 x1 : 00000000000000c0 x0 : 0000000000000000 [ 31.080307] Call trace: [ 31.080340] xilinx_dpdma_chan_queue_transfer+0x274/0x5e0 [ 31.080518] xilinx_dpdma_issue_pending+0x11c/0x120 [ 31.080595] zynqmp_disp_layer_update+0x180/0x3ac [ 31.080712] zynqmp_dpsub_plane_atomic_update+0x11c/0x21c [ 31.080825] drm_atomic_helper_commit_planes+0x20c/0x684 [ 31.080951] drm_atomic_helper_commit_tail+0x5c/0xb0 [ 31.081139] commit_tail+0x234/0x294 [ 31.081246] drm_atomic_helper_commit+0x1f8/0x210 [ 31.081363] drm_atomic_commit+0x100/0x140 [ 31.081477] drm_client_modeset_commit_atomic+0x318/0x384 [ 31.081634] drm_client_modeset_commit_locked+0x8c/0x24c [ 31.081725] drm_client_modeset_commit+0x34/0x5c [ 31.081812] __drm_fb_helper_restore_fbdev_mode_unlocked+0x104/0x168 [ 31.081899] drm_fb_helper_set_par+0x50/0x70 [ 31.081971] fbcon_init+0x538/0xc48 [ 31.082047] visual_init+0x16c/0x23c [ 31.082207] do_bind_con_driver.isra.0+0x2d0/0x634 [ 31.082320] do_take_over_console+0x24c/0x33c [ 31.082429] do_fbcon_takeover+0xbc/0x1b0 [ 31.082503] fbcon_fb_registered+0x2d0/0x34c [ 31.082663] register_framebuffer+0x27c/0x38c [ 31.082767] __drm_fb_helper_initial_config_and_unlock+0x5c0/0x91c [ 31.082939] drm_fb_helper_initial_config+0x50/0x74 [ 31.083012] drm_fbdev_dma_client_hotplug+0xb8/0x108 [ 31.083115] drm_client_register+0xa0/0xf4 [ 31.083195] drm_fbdev_dma_setup+0xb0/0x1cc [ 31.083293] zynqmp_dpsub_drm_init+0x45c/0x4e0 [ 31.083431] zynqmp_dpsub_probe+0x444/0x5e0 [ 31.083616] platform_probe+0x8c/0x13c [ 31.083713] really_probe+0x258/0x59c [ 31.083793] __driver_probe_device+0xc4/0x224 [ 31.083878] driver_probe_device+0x70/0x1c0 [ 31.083961] __device_attach_driver+0x108/0x1e0 [ 31.084052] bus_for_each_drv+0x9c/0x100 [ 31.084125] __device_attach+0x100/0x298 [ 31.084207] device_initial_probe+0x14/0x20 [ 31.084292] bus_probe_device+0xd8/0xdc [ 31.084368] deferred_probe_work_func+0x11c/0x180 [ 31.084451] process_one_work+0x3ac/0x988 [ 31.084643] worker_thread+0x398/0x694 [ 31.084752] kthread+0x1bc/0x1c0 [ 31.084848] ret_from_fork+0x10/0x20 [ 31.084932] irq event stamp: 64549 [ 31.084970] hardirqs last enabled at (64548): [<ffffffc081adf35c>] _raw_spin_unlock_irqrestore+0x80/0x90 [ 31.085157] hardirqs last disabled at (64549): [<ffffffc081adf010>] _raw_spin_lock_irqsave+0xc0/0xdc [ 31.085277] softirqs last enabled at (64503): [<ffffffc08001071c>] __do_softirq+0x47c/0x500 [ 31.085390] softirqs last disabled at (64498): [<ffffffc080017134>] ____do_softirq+0x10/0x1c [ 31.085501] ---[ end trace 0000000000000000 ]--- Fixes: 7cbb0c6 ("dmaengine: xilinx: dpdma: Add the Xilinx DisplayPort DMA engine driver") Signed-off-by: Sean Anderson <[email protected]> Reviewed-by: Tomi Valkeinen <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Vinod Koul <[email protected]> Signed-off-by: Sasha Levin <[email protected]> State: upstream (244296c)

Convert to a time_after() expression.

fdb9c7f

kjenova closed this May 30, 2014

kjenova deleted the patch-2 branch May 30, 2014 10:03

kjenova restored the patch-2 branch May 30, 2014 11:52

kjenova reopened this May 30, 2014

kjenova closed this May 30, 2014

kjenova deleted the patch-2 branch May 30, 2014 19:17

cjdelisle mentioned this pull request Feb 22, 2015

Reliable crashes of nodejs MIPS/CI20_linux#21

Closed

apxii pushed a commit to apxii/linux that referenced this pull request May 6, 2015

Merge pull request torvalds#98 from funman/odroidc-3.10.y

decbf48

Odroidc 3.10.y

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Convert to a time_after() expression. #98

Convert to a time_after() expression. #98

kjenova commented May 30, 2014

Convert to a time_after() expression. #98

Convert to a time_after() expression. #98

Conversation

kjenova commented May 30, 2014