2020-08-20 12:27:27

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 4.19 00/92] 4.19.141-rc1 review

This is the start of the stable review cycle for the 4.19.141 release.
There are 92 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.

Responses should be made by Sat, 22 Aug 2020 09:15:09 +0000.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.141-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>
Linux 4.19.141-rc1

Sandeep Raghuraman <[email protected]>
drm/amdgpu: Fix bug where DPM is not enabled after hibernate and resume

Marius Iacob <[email protected]>
drm: Added orientation quirk for ASUS tablet model T103HAF

Denis Efremov <[email protected]>
drm/radeon: fix fb_div check in ni_init_smc_spll_table()

Tomasz Maciej Nowak <[email protected]>
arm64: dts: marvell: espressobin: add ethernet alias

Hugh Dickins <[email protected]>
khugepaged: retract_page_tables() remember to test exit

Geert Uytterhoeven <[email protected]>
sh: landisk: Add missing initialization of sh_io_port_base

Daniel Díaz <[email protected]>
tools build feature: Quote CC and CXX for their arguments

Vincent Whitchurch <[email protected]>
perf bench mem: Always memset source before memcpy

Dinghao Liu <[email protected]>
ALSA: echoaudio: Fix potential Oops in snd_echo_resume()

Andy Shevchenko <[email protected]>
mfd: dln2: Run event handler loop under spinlock

Tiezhu Yang <[email protected]>
test_kmod: avoid potential double free in trigger_config_run_type()

Colin Ian King <[email protected]>
fs/ufs: avoid potential u32 multiplication overflow

Eric Biggers <[email protected]>
fs/minix: remove expected error message in block_to_path()

Eric Biggers <[email protected]>
fs/minix: fix block limit check for V1 filesystems

Eric Biggers <[email protected]>
fs/minix: set s_maxbytes correctly

Jeffrey Mitchell <[email protected]>
nfs: Fix getxattr kernel panic and memory overflow

Wang Hai <[email protected]>
net: qcom/emac: add missed clk_disable_unprepare in error path of emac_clks_phase1_init

Dan Carpenter <[email protected]>
drm/vmwgfx: Fix two list_for_each loop exit tests

Dan Carpenter <[email protected]>
drm/vmwgfx: Use correct vmw_legacy_display_unit pointer

Colin Ian King <[email protected]>
Input: sentelic - fix error return when fsp_reg_write fails

Krzysztof Sobota <[email protected]>
watchdog: initialize device before misc_register

Ewan D. Milne <[email protected]>
scsi: lpfc: nvmet: Avoid hang / use-after-free again when destroying targetport

Stafford Horne <[email protected]>
openrisc: Fix oops caused when dumping stack

Wolfram Sang <[email protected]>
i2c: rcar: avoid race when unregistering slave

Thomas Hebb <[email protected]>
tools build feature: Use CC and CXX from parent

Rayagonda Kokatanur <[email protected]>
pwm: bcm-iproc: handle clk_get_rate() return

Xu Wang <[email protected]>
clk: clk-atlas6: fix return value check in atlas6_clk_init()

Wolfram Sang <[email protected]>
i2c: rcar: slave: only send STOP event when we have been addressed

Liu Yi L <[email protected]>
iommu/vt-d: Enforce PASID devTLB field mask

Colin Ian King <[email protected]>
iommu/omap: Check for failure of a call to omap_iommu_dump_ctx

Aneesh Kumar K.V <[email protected]>
selftests/powerpc: ptrace-pkey: Don't update expected UAMOR value

Aneesh Kumar K.V <[email protected]>
selftests/powerpc: ptrace-pkey: Update the test to mark an invalid pkey correctly

Aneesh Kumar K.V <[email protected]>
selftests/powerpc: ptrace-pkey: Rename variables to make it easier to follow code

Ming Lei <[email protected]>
dm rq: don't call blk_mq_queue_stopped() in dm_stop_queue()

Steve Longerbeam <[email protected]>
gpu: ipu-v3: image-convert: Combine rotate/no-rotate irq handlers

Yoshihiro Shimoda <[email protected]>
mmc: renesas_sdhi_internal_dmac: clean up the code for dma complete

Johan Hovold <[email protected]>
USB: serial: ftdi_sio: fix break and sysrq handling

Johan Hovold <[email protected]>
USB: serial: ftdi_sio: clean up receive processing

Johan Hovold <[email protected]>
USB: serial: ftdi_sio: make process-packet buffer unsigned

Paul Kocialkowski <[email protected]>
media: rockchip: rga: Only set output CSC mode for RGB input

Paul Kocialkowski <[email protected]>
media: rockchip: rga: Introduce color fmt macros and refactor CSC mode logic

Jason Gunthorpe <[email protected]>
RDMA/ipoib: Fix ABBA deadlock with ipoib_reap_ah()

Kamal Heib <[email protected]>
RDMA/ipoib: Return void from ipoib_ib_dev_stop()

Charles Keepax <[email protected]>
mfd: arizona: Ensure 32k clock is put on driver unbind and error

Liu Ying <[email protected]>
drm/imx: imx-ldb: Disable both channels for split mode in enc->disable()

Sibi Sankar <[email protected]>
remoteproc: qcom: q6v5: Update running state before requesting stop

Adrian Hunter <[email protected]>
perf intel-pt: Fix FUP packet state

Kees Cook <[email protected]>
module: Correctly truncate sysfs sections output

Anton Blanchard <[email protected]>
pseries: Fix 64 bit logical memory block panic

Ahmad Fatoum <[email protected]>
watchdog: f71808e_wdt: clear watchdog timeout occurred flag

Ahmad Fatoum <[email protected]>
watchdog: f71808e_wdt: remove use of wrong watchdog_info option

Ahmad Fatoum <[email protected]>
watchdog: f71808e_wdt: indicate WDIOF_CARDRESET support in watchdog_info.options

Steven Rostedt (VMware) <[email protected]>
tracing: Use trace_sched_process_free() instead of exit() for pid tracing

Kevin Hao <[email protected]>
tracing/hwlat: Honor the tracing_cpumask

Muchun Song <[email protected]>
kprobes: Fix NULL pointer dereference at kprobe_ftrace_handler

Chengming Zhou <[email protected]>
ftrace: Setup correct FTRACE_FL_REGS flags for module

Michal Koutný <[email protected]>
mm/page_counter.c: fix protection usage propagation

Junxiao Bi <[email protected]>
ocfs2: change slot number type s16 to u16

Mikulas Patocka <[email protected]>
ext2: fix missing percpu_counter_inc

Huacai Chen <[email protected]>
MIPS: CPU#0 is not hotpluggable

Lukas Wunner <[email protected]>
driver core: Avoid binding drivers to dead devices

Johannes Berg <[email protected]>
mac80211: fix misplaced while instead of if

Coly Li <[email protected]>
bcache: fix overflow in offset_to_stripe()

Coly Li <[email protected]>
bcache: allocate meta data pages as compound pages

ChangSyun Peng <[email protected]>
md/raid5: Fix Force reconstruct-write io stuck in degraded raid5

Kees Cook <[email protected]>
net/compat: Add missing sock updates for SCM_RIGHTS

Jonathan McDowell <[email protected]>
net: stmmac: dwmac1000: provide multicast filter fallback

Jonathan McDowell <[email protected]>
net: ethernet: stmmac: Disable hardware multicast filter

Eugeniu Rosca <[email protected]>
media: vsp1: dl: Fix NULL pointer dereference on unbind

Michael Ellerman <[email protected]>
powerpc: Fix circular dependency between percpu.h and mmu.h

Michael Ellerman <[email protected]>
powerpc: Allow 4224 bytes of stack expansion for the signal frame

Paul Aurich <[email protected]>
cifs: Fix leak when handling lease break for cached root fid

Max Filippov <[email protected]>
xtensa: fix xtensa_pmu_setup prototype

Alexandru Ardelean <[email protected]>
iio: dac: ad5592r: fix unbalanced mutex unlocks in ad5592r_read_raw()

Christian Eggers <[email protected]>
dt-bindings: iio: io-channel-mux: Fix compatible string in example code

Pavel Machek <[email protected]>
btrfs: fix return value mixup in btrfs_get_extent

Filipe Manana <[email protected]>
btrfs: fix memory leaks after failure to lookup checksums during inode logging

Josef Bacik <[email protected]>
btrfs: only search for left_info if there is no right_info in try_merge_free_space

David Sterba <[email protected]>
btrfs: fix messages after changing compression level by remount

Josef Bacik <[email protected]>
btrfs: open device without device_list_mutex

Anand Jain <[email protected]>
btrfs: don't traverse into the seed devices in show_devname

Tom Rix <[email protected]>
btrfs: ref-verify: fix memory leak in add_block_entry

Qu Wenruo <[email protected]>
btrfs: don't allocate anonymous block device for user invisible roots

Qu Wenruo <[email protected]>
btrfs: free anon block device right after subvolume deletion

Bjorn Helgaas <[email protected]>
PCI: Probe bridge window attributes once at enumeration-time

Ansuel Smith <[email protected]>
PCI: qcom: Add support for tx term offset for rev 2.1.0

Ansuel Smith <[email protected]>
PCI: qcom: Define some PARF params needed for ipq8064 SoC

Rajat Jain <[email protected]>
PCI: Add device even if driver attach failed

Kai-Heng Feng <[email protected]>
PCI: Mark AMD Navi10 GPU rev 0x00 ATS as broken

Rafael J. Wysocki <[email protected]>
PCI: hotplug: ACPI: Fix context refcounting in acpiphp_grab_context()

Thomas Gleixner <[email protected]>
genirq/affinity: Make affinity setting if activated opt-in

Steve French <[email protected]>
smb3: warn on confusing error scenario with sec=krb5


-------------

Diffstat:

.../bindings/iio/multiplexer/io-channel-mux.txt | 2 +-
Makefile | 4 +-
.../boot/dts/marvell/armada-3720-espressobin.dts | 6 ++
arch/mips/kernel/topology.c | 2 +-
arch/openrisc/kernel/stacktrace.c | 18 +++++-
arch/powerpc/include/asm/percpu.h | 4 +-
arch/powerpc/mm/fault.c | 7 ++-
arch/powerpc/platforms/pseries/hotplug-memory.c | 2 +-
arch/sh/boards/mach-landisk/setup.c | 3 +
arch/x86/kernel/apic/vector.c | 4 ++
arch/xtensa/kernel/perf_event.c | 2 +-
drivers/base/dd.c | 4 +-
drivers/clk/sirf/clk-atlas6.c | 2 +-
drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c | 5 +-
drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 ++
drivers/gpu/drm/imx/imx-ldb.c | 7 ++-
drivers/gpu/drm/radeon/ni_dpm.c | 2 +-
drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | 8 +--
drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c | 5 +-
drivers/gpu/ipu-v3/ipu-image-convert.c | 58 ++++++-----------
drivers/i2c/busses/i2c-rcar.c | 15 +++--
drivers/iio/dac/ad5592r-base.c | 4 +-
drivers/infiniband/ulp/ipoib/ipoib.h | 2 +-
drivers/infiniband/ulp/ipoib/ipoib_ib.c | 67 +++++++++-----------
drivers/infiniband/ulp/ipoib/ipoib_main.c | 2 +
drivers/input/mouse/sentelic.c | 2 +-
drivers/iommu/omap-iommu-debug.c | 3 +
drivers/irqchip/irq-gic-v3-its.c | 5 +-
drivers/md/bcache/bcache.h | 2 +-
drivers/md/bcache/bset.c | 2 +-
drivers/md/bcache/btree.c | 2 +-
drivers/md/bcache/journal.c | 4 +-
drivers/md/bcache/super.c | 2 +-
drivers/md/bcache/writeback.c | 14 +++--
drivers/md/bcache/writeback.h | 19 +++++-
drivers/md/dm-rq.c | 3 -
drivers/md/raid5.c | 3 +-
drivers/media/platform/rockchip/rga/rga-hw.c | 29 +++++----
drivers/media/platform/rockchip/rga/rga-hw.h | 5 ++
drivers/media/platform/vsp1/vsp1_dl.c | 2 +
drivers/mfd/arizona-core.c | 18 ++++++
drivers/mfd/dln2.c | 4 ++
drivers/mmc/host/renesas_sdhi_internal_dmac.c | 18 ++++--
drivers/net/ethernet/qualcomm/emac/emac.c | 17 ++++-
.../net/ethernet/stmicro/stmmac/dwmac-ipq806x.c | 1 +
.../net/ethernet/stmicro/stmmac/dwmac1000_core.c | 3 +
drivers/pci/bus.c | 6 +-
drivers/pci/controller/dwc/pcie-qcom.c | 41 +++++++++++-
drivers/pci/hotplug/acpiphp_glue.c | 14 ++++-
drivers/pci/probe.c | 52 +++++++++++++++
drivers/pci/quirks.c | 5 +-
drivers/pci/setup-bus.c | 45 ++-----------
drivers/pwm/pwm-bcm-iproc.c | 9 ++-
drivers/remoteproc/qcom_q6v5.c | 2 +
drivers/scsi/lpfc/lpfc_nvmet.c | 2 +-
drivers/usb/serial/ftdi_sio.c | 57 ++++++++++-------
drivers/watchdog/f71808e_wdt.c | 13 +++-
drivers/watchdog/watchdog_dev.c | 18 +++---
fs/btrfs/disk-io.c | 13 +++-
fs/btrfs/free-space-cache.c | 4 +-
fs/btrfs/inode.c | 4 +-
fs/btrfs/ref-verify.c | 2 +
fs/btrfs/super.c | 35 +++++------
fs/btrfs/tree-log.c | 8 +--
fs/btrfs/volumes.c | 21 ++++++-
fs/cifs/smb2misc.c | 73 +++++++++++++++-------
fs/cifs/smb2pdu.c | 2 +
fs/ext2/ialloc.c | 3 +-
fs/minix/inode.c | 12 ++--
fs/minix/itree_v1.c | 12 ++--
fs/minix/itree_v2.c | 13 ++--
fs/minix/minix.h | 1 -
fs/nfs/nfs4proc.c | 2 -
fs/nfs/nfs4xdr.c | 6 +-
fs/ocfs2/ocfs2.h | 4 +-
fs/ocfs2/suballoc.c | 4 +-
fs/ocfs2/super.c | 4 +-
fs/ufs/super.c | 2 +-
include/linux/intel-iommu.h | 4 +-
include/linux/irq.h | 13 ++++
include/linux/pci.h | 3 +
include/net/sock.h | 4 ++
kernel/irq/manage.c | 6 +-
kernel/kprobes.c | 7 +++
kernel/module.c | 22 ++++++-
kernel/trace/ftrace.c | 15 +++--
kernel/trace/trace_events.c | 4 +-
kernel/trace/trace_hwlat.c | 5 +-
lib/test_kmod.c | 2 +-
mm/khugepaged.c | 22 ++++---
mm/page_counter.c | 6 +-
net/compat.c | 1 +
net/core/sock.c | 21 +++++++
net/mac80211/sta_info.c | 2 +-
sound/pci/echoaudio/echoaudio.c | 2 -
tools/build/Makefile.feature | 2 +-
tools/build/feature/Makefile | 2 -
tools/perf/bench/mem-functions.c | 21 ++++---
.../perf/util/intel-pt-decoder/intel-pt-decoder.c | 21 +++----
.../testing/selftests/powerpc/ptrace/ptrace-pkey.c | 55 ++++++++--------
100 files changed, 715 insertions(+), 413 deletions(-)



2020-08-20 12:27:47

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 4.19 17/92] btrfs: fix return value mixup in btrfs_get_extent

From: Pavel Machek <[email protected]>

commit 881a3a11c2b858fe9b69ef79ac5ee9978a266dc9 upstream.

btrfs_get_extent() sets variable ret, but out: error path expect error
to be in variable err so the error code is lost.

Fixes: 6bf9e4bd6a27 ("btrfs: inode: Verify inode mode to avoid NULL pointer dereference")
CC: [email protected] # 5.4+
Reviewed-by: Nikolay Borisov <[email protected]>
Signed-off-by: Pavel Machek (CIP) <[email protected]>
Reviewed-by: David Sterba <[email protected]>
Signed-off-by: David Sterba <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
fs/btrfs/inode.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -7014,7 +7014,7 @@ struct extent_map *btrfs_get_extent(stru
found_type == BTRFS_FILE_EXTENT_PREALLOC) {
/* Only regular file could have regular/prealloc extent */
if (!S_ISREG(inode->vfs_inode.i_mode)) {
- ret = -EUCLEAN;
+ err = -EUCLEAN;
btrfs_crit(fs_info,
"regular/prealloc extent found for non-regular inode %llu",
btrfs_ino(inode));


2020-08-20 12:27:54

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 4.19 27/92] net/compat: Add missing sock updates for SCM_RIGHTS

From: Kees Cook <[email protected]>

commit d9539752d23283db4692384a634034f451261e29 upstream.

Add missed sock updates to compat path via a new helper, which will be
used more in coming patches. (The net/core/scm.c code is left as-is here
to assist with -stable backports for the compat path.)

Cc: Christoph Hellwig <[email protected]>
Cc: Sargun Dhillon <[email protected]>
Cc: Jakub Kicinski <[email protected]>
Cc: [email protected]
Fixes: 48a87cc26c13 ("net: netprio: fd passed in SCM_RIGHTS datagram not set correctly")
Fixes: d84295067fc7 ("net: net_cls: fd passed in SCM_RIGHTS datagram not set correctly")
Acked-by: Christian Brauner <[email protected]>
Signed-off-by: Kees Cook <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
include/net/sock.h | 4 ++++
net/compat.c | 1 +
net/core/sock.c | 21 +++++++++++++++++++++
3 files changed, 26 insertions(+)

--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -845,6 +845,8 @@ static inline int sk_memalloc_socks(void
{
return static_branch_unlikely(&memalloc_socks_key);
}
+
+void __receive_sock(struct file *file);
#else

static inline int sk_memalloc_socks(void)
@@ -852,6 +854,8 @@ static inline int sk_memalloc_socks(void
return 0;
}

+static inline void __receive_sock(struct file *file)
+{ }
#endif

static inline gfp_t sk_gfp_mask(const struct sock *sk, gfp_t gfp_mask)
--- a/net/compat.c
+++ b/net/compat.c
@@ -289,6 +289,7 @@ void scm_detach_fds_compat(struct msghdr
break;
}
/* Bump the usage count and install the file. */
+ __receive_sock(fp[i]);
fd_install(new_fd, get_file(fp[i]));
}

--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -2636,6 +2636,27 @@ int sock_no_mmap(struct file *file, stru
}
EXPORT_SYMBOL(sock_no_mmap);

+/*
+ * When a file is received (via SCM_RIGHTS, etc), we must bump the
+ * various sock-based usage counts.
+ */
+void __receive_sock(struct file *file)
+{
+ struct socket *sock;
+ int error;
+
+ /*
+ * The resulting value of "error" is ignored here since we only
+ * need to take action when the file is a socket and testing
+ * "sock" for NULL is sufficient.
+ */
+ sock = sock_from_file(file, &error);
+ if (sock) {
+ sock_update_netprioidx(&sock->sk->sk_cgrp_data);
+ sock_update_classid(&sock->sk->sk_cgrp_data);
+ }
+}
+
ssize_t sock_no_sendpage(struct socket *sock, struct page *page, int offset, size_t size, int flags)
{
ssize_t res;


2020-08-20 12:28:05

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 4.19 26/92] net: stmmac: dwmac1000: provide multicast filter fallback

From: Jonathan McDowell <[email protected]>

commit 592d751c1e174df5ff219946908b005eb48934b3 upstream.

If we don't have a hardware multicast filter available then instead of
silently failing to listen for the requested ethernet broadcast
addresses fall back to receiving all multicast packets, in a similar
fashion to other drivers with no multicast filter.

Cc: [email protected]
Signed-off-by: Jonathan McDowell <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c | 3 +++
1 file changed, 3 insertions(+)

--- a/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c
@@ -176,6 +176,9 @@ static void dwmac1000_set_filter(struct
value = GMAC_FRAME_FILTER_PR;
} else if (dev->flags & IFF_ALLMULTI) {
value = GMAC_FRAME_FILTER_PM; /* pass all multi */
+ } else if (!netdev_mc_empty(dev) && (mcbitslog2 == 0)) {
+ /* Fall back to all multicast if we've no filter */
+ value = GMAC_FRAME_FILTER_PM;
} else if (!netdev_mc_empty(dev)) {
struct netdev_hw_addr *ha;



2020-08-20 12:28:09

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 4.19 15/92] btrfs: only search for left_info if there is no right_info in try_merge_free_space

From: Josef Bacik <[email protected]>

commit bf53d4687b8f3f6b752f091eb85f62369a515dfd upstream.

In try_to_merge_free_space we attempt to find entries to the left and
right of the entry we are adding to see if they can be merged. We
search for an entry past our current info (saved into right_info), and
then if right_info exists and it has a rb_prev() we save the rb_prev()
into left_info.

However there's a slight problem in the case that we have a right_info,
but no entry previous to that entry. At that point we will search for
an entry just before the info we're attempting to insert. This will
simply find right_info again, and assign it to left_info, making them
both the same pointer.

Now if right_info _can_ be merged with the range we're inserting, we'll
add it to the info and free right_info. However further down we'll
access left_info, which was right_info, and thus get a use-after-free.

Fix this by only searching for the left entry if we don't find a right
entry at all.

The CVE referenced had a specially crafted file system that could
trigger this use-after-free. However with the tree checker improvements
we no longer trigger the conditions for the UAF. But the original
conditions still apply, hence this fix.

Reference: CVE-2019-19448
Fixes: 963030817060 ("Btrfs: use hybrid extents+bitmap rb tree for free space")
CC: [email protected] # 4.4+
Signed-off-by: Josef Bacik <[email protected]>
Signed-off-by: David Sterba <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
fs/btrfs/free-space-cache.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

--- a/fs/btrfs/free-space-cache.c
+++ b/fs/btrfs/free-space-cache.c
@@ -2169,7 +2169,7 @@ out:
static bool try_merge_free_space(struct btrfs_free_space_ctl *ctl,
struct btrfs_free_space *info, bool update_stat)
{
- struct btrfs_free_space *left_info;
+ struct btrfs_free_space *left_info = NULL;
struct btrfs_free_space *right_info;
bool merged = false;
u64 offset = info->offset;
@@ -2184,7 +2184,7 @@ static bool try_merge_free_space(struct
if (right_info && rb_prev(&right_info->offset_index))
left_info = rb_entry(rb_prev(&right_info->offset_index),
struct btrfs_free_space, offset_index);
- else
+ else if (!right_info)
left_info = tree_search_offset(ctl, offset - 1, 0, 0);

if (right_info && !right_info->bitmap) {


2020-08-20 12:28:18

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 4.19 24/92] media: vsp1: dl: Fix NULL pointer dereference on unbind

From: Eugeniu Rosca <[email protected]>

commit c92d30e4b78dc331909f8c6056c2792aa14e2166 upstream.

In commit f3b98e3c4d2e16 ("media: vsp1: Provide support for extended
command pools"), the vsp pointer used for referencing the VSP1 device
structure from a command pool during vsp1_dl_ext_cmd_pool_destroy() was
not populated.

Correctly assign the pointer to prevent the following
null-pointer-dereference when removing the device:

[*] h3ulcb-kf #>
echo fea28000.vsp > /sys/bus/platform/devices/fea28000.vsp/driver/unbind
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000028
Mem abort info:
ESR = 0x96000006
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
Data abort info:
ISV = 0, ISS = 0x00000006
CM = 0, WnR = 0
user pgtable: 4k pages, 48-bit VAs, pgdp=00000007318be000
[0000000000000028] pgd=00000007333a1003, pud=00000007333a6003, pmd=0000000000000000
Internal error: Oops: 96000006 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 486 Comm: sh Not tainted 5.7.0-rc6-arm64-renesas-00118-ge644645abf47 #185
Hardware name: Renesas H3ULCB Kingfisher board based on r8a77951 (DT)
pstate: 40000005 (nZcv daif -PAN -UAO)
pc : vsp1_dlm_destroy+0xe4/0x11c
lr : vsp1_dlm_destroy+0xc8/0x11c
sp : ffff800012963b60
x29: ffff800012963b60 x28: ffff0006f83fc440
x27: 0000000000000000 x26: ffff0006f5e13e80
x25: ffff0006f5e13ed0 x24: ffff0006f5e13ed0
x23: ffff0006f5e13ed0 x22: dead000000000122
x21: ffff0006f5e3a080 x20: ffff0006f5df2938
x19: ffff0006f5df2980 x18: 0000000000000003
x17: 0000000000000000 x16: 0000000000000016
x15: 0000000000000003 x14: 00000000000393c0
x13: ffff800011a5ec18 x12: ffff800011d8d000
x11: ffff0006f83fcc68 x10: ffff800011a53d70
x9 : ffff8000111f3000 x8 : 0000000000000000
x7 : 0000000000210d00 x6 : 0000000000000000
x5 : ffff800010872e60 x4 : 0000000000000004
x3 : 0000000078068000 x2 : ffff800012781000
x1 : 0000000000002c00 x0 : 0000000000000000
Call trace:
vsp1_dlm_destroy+0xe4/0x11c
vsp1_wpf_destroy+0x10/0x20
vsp1_entity_destroy+0x24/0x4c
vsp1_destroy_entities+0x54/0x130
vsp1_remove+0x1c/0x40
platform_drv_remove+0x28/0x50
__device_release_driver+0x178/0x220
device_driver_detach+0x44/0xc0
unbind_store+0xe0/0x104
drv_attr_store+0x20/0x30
sysfs_kf_write+0x48/0x70
kernfs_fop_write+0x148/0x230
__vfs_write+0x18/0x40
vfs_write+0xdc/0x1c4
ksys_write+0x68/0xf0
__arm64_sys_write+0x18/0x20
el0_svc_common.constprop.0+0x70/0x170
do_el0_svc+0x20/0x80
el0_sync_handler+0x134/0x1b0
el0_sync+0x140/0x180
Code: b40000c2 f9403a60 d2800084 a9400663 (f9401400)
---[ end trace 3875369841fb288a ]---

Fixes: f3b98e3c4d2e16 ("media: vsp1: Provide support for extended command pools")
Cc: [email protected] # v4.19+
Signed-off-by: Eugeniu Rosca <[email protected]>
Reviewed-by: Kieran Bingham <[email protected]>
Tested-by: Kieran Bingham <[email protected]>
Reviewed-by: Laurent Pinchart <[email protected]>
Signed-off-by: Hans Verkuil <[email protected]>
Signed-off-by: Mauro Carvalho Chehab <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
drivers/media/platform/vsp1/vsp1_dl.c | 2 ++
1 file changed, 2 insertions(+)

--- a/drivers/media/platform/vsp1/vsp1_dl.c
+++ b/drivers/media/platform/vsp1/vsp1_dl.c
@@ -431,6 +431,8 @@ vsp1_dl_cmd_pool_create(struct vsp1_devi
if (!pool)
return NULL;

+ pool->vsp1 = vsp1;
+
spin_lock_init(&pool->lock);
INIT_LIST_HEAD(&pool->free);



2020-08-20 12:28:35

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 4.19 21/92] cifs: Fix leak when handling lease break for cached root fid

From: Paul Aurich <[email protected]>

commit baf57b56d3604880ccb3956ec6c62ea894f5de99 upstream.

Handling a lease break for the cached root didn't free the
smb2_lease_break_work allocation, resulting in a leak:

unreferenced object 0xffff98383a5af480 (size 128):
comm "cifsd", pid 684, jiffies 4294936606 (age 534.868s)
hex dump (first 32 bytes):
c0 ff ff ff 1f 00 00 00 88 f4 5a 3a 38 98 ff ff ..........Z:8...
88 f4 5a 3a 38 98 ff ff 80 88 d6 8a ff ff ff ff ..Z:8...........
backtrace:
[<0000000068957336>] smb2_is_valid_oplock_break+0x1fa/0x8c0
[<0000000073b70b9e>] cifs_demultiplex_thread+0x73d/0xcc0
[<00000000905fa372>] kthread+0x11c/0x150
[<0000000079378e4e>] ret_from_fork+0x22/0x30

Avoid this leak by only allocating when necessary.

Fixes: a93864d93977 ("cifs: add lease tracking to the cached root fid")
Signed-off-by: Paul Aurich <[email protected]>
CC: Stable <[email protected]> # v4.18+
Reviewed-by: Aurelien Aptel <[email protected]>
Signed-off-by: Steve French <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
fs/cifs/smb2misc.c | 73 +++++++++++++++++++++++++++++++++++++----------------
1 file changed, 52 insertions(+), 21 deletions(-)

--- a/fs/cifs/smb2misc.c
+++ b/fs/cifs/smb2misc.c
@@ -509,15 +509,31 @@ cifs_ses_oplock_break(struct work_struct
kfree(lw);
}

+static void
+smb2_queue_pending_open_break(struct tcon_link *tlink, __u8 *lease_key,
+ __le32 new_lease_state)
+{
+ struct smb2_lease_break_work *lw;
+
+ lw = kmalloc(sizeof(struct smb2_lease_break_work), GFP_KERNEL);
+ if (!lw) {
+ cifs_put_tlink(tlink);
+ return;
+ }
+
+ INIT_WORK(&lw->lease_break, cifs_ses_oplock_break);
+ lw->tlink = tlink;
+ lw->lease_state = new_lease_state;
+ memcpy(lw->lease_key, lease_key, SMB2_LEASE_KEY_SIZE);
+ queue_work(cifsiod_wq, &lw->lease_break);
+}
+
static bool
-smb2_tcon_has_lease(struct cifs_tcon *tcon, struct smb2_lease_break *rsp,
- struct smb2_lease_break_work *lw)
+smb2_tcon_has_lease(struct cifs_tcon *tcon, struct smb2_lease_break *rsp)
{
- bool found;
__u8 lease_state;
struct list_head *tmp;
struct cifsFileInfo *cfile;
- struct cifs_pending_open *open;
struct cifsInodeInfo *cinode;
int ack_req = le32_to_cpu(rsp->Flags &
SMB2_NOTIFY_BREAK_LEASE_FLAG_ACK_REQUIRED);
@@ -556,22 +572,29 @@ smb2_tcon_has_lease(struct cifs_tcon *tc
&cinode->flags);

cifs_queue_oplock_break(cfile);
- kfree(lw);
return true;
}

- found = false;
+ return false;
+}
+
+static struct cifs_pending_open *
+smb2_tcon_find_pending_open_lease(struct cifs_tcon *tcon,
+ struct smb2_lease_break *rsp)
+{
+ __u8 lease_state = le32_to_cpu(rsp->NewLeaseState);
+ int ack_req = le32_to_cpu(rsp->Flags &
+ SMB2_NOTIFY_BREAK_LEASE_FLAG_ACK_REQUIRED);
+ struct cifs_pending_open *open;
+ struct cifs_pending_open *found = NULL;
+
list_for_each_entry(open, &tcon->pending_opens, olist) {
if (memcmp(open->lease_key, rsp->LeaseKey,
SMB2_LEASE_KEY_SIZE))
continue;

if (!found && ack_req) {
- found = true;
- memcpy(lw->lease_key, open->lease_key,
- SMB2_LEASE_KEY_SIZE);
- lw->tlink = cifs_get_tlink(open->tlink);
- queue_work(cifsiod_wq, &lw->lease_break);
+ found = open;
}

cifs_dbg(FYI, "found in the pending open list\n");
@@ -592,14 +615,7 @@ smb2_is_valid_lease_break(char *buffer)
struct TCP_Server_Info *server;
struct cifs_ses *ses;
struct cifs_tcon *tcon;
- struct smb2_lease_break_work *lw;
-
- lw = kmalloc(sizeof(struct smb2_lease_break_work), GFP_KERNEL);
- if (!lw)
- return false;
-
- INIT_WORK(&lw->lease_break, cifs_ses_oplock_break);
- lw->lease_state = rsp->NewLeaseState;
+ struct cifs_pending_open *open;

cifs_dbg(FYI, "Checking for lease break\n");

@@ -617,11 +633,27 @@ smb2_is_valid_lease_break(char *buffer)
spin_lock(&tcon->open_file_lock);
cifs_stats_inc(
&tcon->stats.cifs_stats.num_oplock_brks);
- if (smb2_tcon_has_lease(tcon, rsp, lw)) {
+ if (smb2_tcon_has_lease(tcon, rsp)) {
spin_unlock(&tcon->open_file_lock);
spin_unlock(&cifs_tcp_ses_lock);
return true;
}
+ open = smb2_tcon_find_pending_open_lease(tcon,
+ rsp);
+ if (open) {
+ __u8 lease_key[SMB2_LEASE_KEY_SIZE];
+ struct tcon_link *tlink;
+
+ tlink = cifs_get_tlink(open->tlink);
+ memcpy(lease_key, open->lease_key,
+ SMB2_LEASE_KEY_SIZE);
+ spin_unlock(&tcon->open_file_lock);
+ spin_unlock(&cifs_tcp_ses_lock);
+ smb2_queue_pending_open_break(tlink,
+ lease_key,
+ rsp->NewLeaseState);
+ return true;
+ }
spin_unlock(&tcon->open_file_lock);

if (tcon->crfid.is_valid &&
@@ -639,7 +671,6 @@ smb2_is_valid_lease_break(char *buffer)
}
}
spin_unlock(&cifs_tcp_ses_lock);
- kfree(lw);
cifs_dbg(FYI, "Can not process lease break - no lease matched\n");
return false;
}


2020-08-20 12:28:43

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 4.19 06/92] PCI: qcom: Define some PARF params needed for ipq8064 SoC

From: Ansuel Smith <[email protected]>

commit 5149901e9e6deca487c01cc434a3ac4125c7b00b upstream.

Set some specific value for Tx De-Emphasis, Tx Swing and Rx equalization
needed on some ipq8064 based device (Netgear R7800 for example). Without
this the system locks on kernel load.

Link: https://lore.kernel.org/r/[email protected]
Fixes: 82a823833f4e ("PCI: qcom: Add Qualcomm PCIe controller driver")
Signed-off-by: Ansuel Smith <[email protected]>
Signed-off-by: Lorenzo Pieralisi <[email protected]>
Reviewed-by: Rob Herring <[email protected]>
Acked-by: Stanimir Varbanov <[email protected]>
Cc: [email protected] # v4.5+
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
drivers/pci/controller/dwc/pcie-qcom.c | 24 ++++++++++++++++++++++++
1 file changed, 24 insertions(+)

--- a/drivers/pci/controller/dwc/pcie-qcom.c
+++ b/drivers/pci/controller/dwc/pcie-qcom.c
@@ -76,6 +76,18 @@
#define DBI_RO_WR_EN 1

#define PERST_DELAY_US 1000
+/* PARF registers */
+#define PCIE20_PARF_PCS_DEEMPH 0x34
+#define PCS_DEEMPH_TX_DEEMPH_GEN1(x) ((x) << 16)
+#define PCS_DEEMPH_TX_DEEMPH_GEN2_3_5DB(x) ((x) << 8)
+#define PCS_DEEMPH_TX_DEEMPH_GEN2_6DB(x) ((x) << 0)
+
+#define PCIE20_PARF_PCS_SWING 0x38
+#define PCS_SWING_TX_SWING_FULL(x) ((x) << 8)
+#define PCS_SWING_TX_SWING_LOW(x) ((x) << 0)
+
+#define PCIE20_PARF_CONFIG_BITS 0x50
+#define PHY_RX0_EQ(x) ((x) << 24)

#define PCIE20_v3_PARF_SLV_ADDR_SPACE_SIZE 0x358
#define SLV_ADDR_SPACE_SZ 0x10000000
@@ -275,6 +287,7 @@ static int qcom_pcie_init_2_1_0(struct q
struct qcom_pcie_resources_2_1_0 *res = &pcie->res.v2_1_0;
struct dw_pcie *pci = pcie->pci;
struct device *dev = pci->dev;
+ struct device_node *node = dev->of_node;
u32 val;
int ret;

@@ -319,6 +332,17 @@ static int qcom_pcie_init_2_1_0(struct q
val &= ~BIT(0);
writel(val, pcie->parf + PCIE20_PARF_PHY_CTRL);

+ if (of_device_is_compatible(node, "qcom,pcie-ipq8064")) {
+ writel(PCS_DEEMPH_TX_DEEMPH_GEN1(24) |
+ PCS_DEEMPH_TX_DEEMPH_GEN2_3_5DB(24) |
+ PCS_DEEMPH_TX_DEEMPH_GEN2_6DB(34),
+ pcie->parf + PCIE20_PARF_PCS_DEEMPH);
+ writel(PCS_SWING_TX_SWING_FULL(120) |
+ PCS_SWING_TX_SWING_LOW(120),
+ pcie->parf + PCIE20_PARF_PCS_SWING);
+ writel(PHY_RX0_EQ(4), pcie->parf + PCIE20_PARF_CONFIG_BITS);
+ }
+
/* enable external reference clock */
val = readl(pcie->parf + PCIE20_PARF_PHY_REFCLK);
val |= BIT(16);


2020-08-20 12:28:52

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 4.19 10/92] btrfs: dont allocate anonymous block device for user invisible roots

From: Qu Wenruo <[email protected]>

commit 851fd730a743e072badaf67caf39883e32439431 upstream.

[BUG]
When a lot of subvolumes are created, there is a user report about
transaction aborted:

BTRFS: Transaction aborted (error -24)
WARNING: CPU: 17 PID: 17041 at fs/btrfs/transaction.c:1576 create_pending_snapshot+0xbc4/0xd10 [btrfs]
RIP: 0010:create_pending_snapshot+0xbc4/0xd10 [btrfs]
Call Trace:
create_pending_snapshots+0x82/0xa0 [btrfs]
btrfs_commit_transaction+0x275/0x8c0 [btrfs]
btrfs_mksubvol+0x4b9/0x500 [btrfs]
btrfs_ioctl_snap_create_transid+0x174/0x180 [btrfs]
btrfs_ioctl_snap_create_v2+0x11c/0x180 [btrfs]
btrfs_ioctl+0x11a4/0x2da0 [btrfs]
do_vfs_ioctl+0xa9/0x640
ksys_ioctl+0x67/0x90
__x64_sys_ioctl+0x1a/0x20
do_syscall_64+0x5a/0x110
entry_SYSCALL_64_after_hwframe+0x44/0xa9
---[ end trace 33f2f83f3d5250e9 ]---
BTRFS: error (device sda1) in create_pending_snapshot:1576: errno=-24 unknown
BTRFS info (device sda1): forced readonly
BTRFS warning (device sda1): Skipping commit of aborted transaction.
BTRFS: error (device sda1) in cleanup_transaction:1831: errno=-24 unknown

[CAUSE]
The error is EMFILE (Too many files open) and comes from the anonymous
block device allocation. The ids are in a shared pool of size 1<<20.

The ids are assigned to live subvolumes, ie. the root structure exists
in memory (eg. after creation or after the root appears in some path).
The pool could be exhausted if the numbers are not reclaimed fast
enough, after subvolume deletion or if other system component uses the
anon block devices.

[WORKAROUND]
Since it's not possible to completely solve the problem, we can only
minimize the time the id is allocated to a subvolume root.

Firstly, we can reduce the use of anon_dev by trees that are not
subvolume roots, like data reloc tree.

This patch will do extra check on root objectid, to skip roots that
don't need anon_dev. Currently it's only data reloc tree and orphan
roots.

Reported-by: Greed Rong <[email protected]>
Link: https://lore.kernel.org/linux-btrfs/CA+UqX+NTrZ6boGnWHhSeZmEY5J76CTqmYjO2S+=tHJX7nb9DPw@mail.gmail.com/
CC: [email protected] # 4.4+
Reviewed-by: Josef Bacik <[email protected]>
Signed-off-by: Qu Wenruo <[email protected]>
Reviewed-by: David Sterba <[email protected]>
Signed-off-by: David Sterba <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
fs/btrfs/disk-io.c | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)

--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -1500,9 +1500,16 @@ int btrfs_init_fs_root(struct btrfs_root
spin_lock_init(&root->ino_cache_lock);
init_waitqueue_head(&root->ino_cache_wait);

- ret = get_anon_bdev(&root->anon_dev);
- if (ret)
- goto fail;
+ /*
+ * Don't assign anonymous block device to roots that are not exposed to
+ * userspace, the id pool is limited to 1M
+ */
+ if (is_fstree(root->root_key.objectid) &&
+ btrfs_root_refs(&root->root_item) > 0) {
+ ret = get_anon_bdev(&root->anon_dev);
+ if (ret)
+ goto fail;
+ }

mutex_lock(&root->objectid_mutex);
ret = btrfs_find_highest_objectid(root,


2020-08-20 12:28:56

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 4.19 34/92] ext2: fix missing percpu_counter_inc

From: Mikulas Patocka <[email protected]>

commit bc2fbaa4d3808aef82dd1064a8e61c16549fe956 upstream.

sbi->s_freeinodes_counter is only decreased by the ext2 code, it is never
increased. This patch fixes it.

Note that sbi->s_freeinodes_counter is only used in the algorithm that
tries to find the group for new allocations, so this bug is not easily
visible (the only visibility is that the group finding algorithm selects
inoptinal result).

Link: https://lore.kernel.org/r/alpine.LRH.2.02.2004201538300.19436@file01.intranet.prod.int.rdu2.redhat.com
Signed-off-by: Mikulas Patocka <[email protected]>
Cc: [email protected]
Signed-off-by: Jan Kara <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
fs/ext2/ialloc.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

--- a/fs/ext2/ialloc.c
+++ b/fs/ext2/ialloc.c
@@ -80,6 +80,7 @@ static void ext2_release_inode(struct su
if (dir)
le16_add_cpu(&desc->bg_used_dirs_count, -1);
spin_unlock(sb_bgl_lock(EXT2_SB(sb), group));
+ percpu_counter_inc(&EXT2_SB(sb)->s_freeinodes_counter);
if (dir)
percpu_counter_dec(&EXT2_SB(sb)->s_dirs_counter);
mark_buffer_dirty(bh);
@@ -531,7 +532,7 @@ got:
goto fail;
}

- percpu_counter_add(&sbi->s_freeinodes_counter, -1);
+ percpu_counter_dec(&sbi->s_freeinodes_counter);
if (S_ISDIR(mode))
percpu_counter_inc(&sbi->s_dirs_counter);



2020-08-20 12:29:06

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 4.19 32/92] driver core: Avoid binding drivers to dead devices

From: Lukas Wunner <[email protected]>

commit 654888327e9f655a9d55ad477a9583e90e8c9b5c upstream.

Commit 3451a495ef24 ("driver core: Establish order of operations for
device_add and device_del via bitflag") sought to prevent asynchronous
driver binding to a device which is being removed. It added a
per-device "dead" flag which is checked in the following code paths:

* asynchronous binding in __driver_attach_async_helper()
* synchronous binding in device_driver_attach()
* asynchronous binding in __device_attach_async_helper()

It did *not* check the flag upon:

* synchronous binding in __device_attach()

However __device_attach() may also be called asynchronously from:

deferred_probe_work_func()
bus_probe_device()
device_initial_probe()
__device_attach()

So if the commit's intention was to check the "dead" flag in all
asynchronous code paths, then a check is also necessary in
__device_attach(). Add the missing check.

Fixes: 3451a495ef24 ("driver core: Establish order of operations for device_add and device_del via bitflag")
Signed-off-by: Lukas Wunner <[email protected]>
Cc: [email protected] # v5.1+
Cc: Alexander Duyck <[email protected]>
Link: https://lore.kernel.org/r/de88a23a6fe0ef70f7cfd13c8aea9ab51b4edab6.1594214103.git.lukas@wunner.de
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
drivers/base/dd.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)

--- a/drivers/base/dd.c
+++ b/drivers/base/dd.c
@@ -792,7 +792,9 @@ static int __device_attach(struct device
int ret = 0;

device_lock(dev);
- if (dev->driver) {
+ if (dev->p->dead) {
+ goto out_unlock;
+ } else if (dev->driver) {
if (device_is_bound(dev)) {
ret = 1;
goto out_unlock;


2020-08-20 12:29:47

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 4.19 28/92] md/raid5: Fix Force reconstruct-write io stuck in degraded raid5

From: ChangSyun Peng <[email protected]>

commit a1c6ae3d9f3dd6aa5981a332a6f700cf1c25edef upstream.

In degraded raid5, we need to read parity to do reconstruct-write when
data disks fail. However, we can not read parity from
handle_stripe_dirtying() in force reconstruct-write mode.

Reproducible Steps:

1. Create degraded raid5
mdadm -C /dev/md2 --assume-clean -l5 -n3 /dev/sda2 /dev/sdb2 missing
2. Set rmw_level to 0
echo 0 > /sys/block/md2/md/rmw_level
3. IO to raid5

Now some io may be stuck in raid5. We can use handle_stripe_fill() to read
the parity in this situation.

Cc: <[email protected]> # v4.4+
Reviewed-by: Alex Wu <[email protected]>
Reviewed-by: BingJing Chang <[email protected]>
Reviewed-by: Danny Shih <[email protected]>
Signed-off-by: ChangSyun Peng <[email protected]>
Signed-off-by: Song Liu <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
drivers/md/raid5.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -3596,6 +3596,7 @@ static int need_this_block(struct stripe
* is missing/faulty, then we need to read everything we can.
*/
if (sh->raid_conf->level != 6 &&
+ sh->raid_conf->rmw_level != PARITY_DISABLE_RMW &&
sh->sector < sh->raid_conf->mddev->recovery_cp)
/* reconstruct-write isn't being forced */
return 0;
@@ -4832,7 +4833,7 @@ static void handle_stripe(struct stripe_
* or to load a block that is being partially written.
*/
if (s.to_read || s.non_overwrite
- || (conf->level == 6 && s.to_write && s.failed)
+ || (s.to_write && s.failed)
|| (s.syncing && (s.uptodate + s.compute < disks))
|| s.replacing
|| s.expanding)


2020-08-20 12:30:52

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 4.19 03/92] PCI: hotplug: ACPI: Fix context refcounting in acpiphp_grab_context()

From: Rafael J. Wysocki <[email protected]>

commit dae68d7fd4930315389117e9da35b763f12238f9 upstream.

If context is not NULL in acpiphp_grab_context(), but the
is_going_away flag is set for the device's parent, the reference
counter of the context needs to be decremented before returning
NULL or the context will never be freed, so make that happen.

Fixes: edf5bf34d408 ("ACPI / dock: Use callback pointers from devices' ACPI hotplug contexts")
Reported-by: Vasily Averin <[email protected]>
Cc: 3.15+ <[email protected]> # 3.15+
Signed-off-by: Rafael J. Wysocki <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
drivers/pci/hotplug/acpiphp_glue.c | 14 +++++++++++---
1 file changed, 11 insertions(+), 3 deletions(-)

--- a/drivers/pci/hotplug/acpiphp_glue.c
+++ b/drivers/pci/hotplug/acpiphp_glue.c
@@ -122,13 +122,21 @@ static struct acpiphp_context *acpiphp_g
struct acpiphp_context *context;

acpi_lock_hp_context();
+
context = acpiphp_get_context(adev);
- if (!context || context->func.parent->is_going_away) {
- acpi_unlock_hp_context();
- return NULL;
+ if (!context)
+ goto unlock;
+
+ if (context->func.parent->is_going_away) {
+ acpiphp_put_context(context);
+ context = NULL;
+ goto unlock;
}
+
get_bridge(context->func.parent);
acpiphp_put_context(context);
+
+unlock:
acpi_unlock_hp_context();
return context;
}


2020-08-20 21:49:37

by Guenter Roeck

[permalink] [raw]
Subject: Re: [PATCH 4.19 00/92] 4.19.141-rc1 review

On Thu, Aug 20, 2020 at 11:20:45AM +0200, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.19.141 release.
> There are 92 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sat, 22 Aug 2020 09:15:09 +0000.
> Anything received after that time might be too late.
>

Build results:
total: 155 pass: 155 fail: 0
Qemu test results:
total: 421 pass: 421 fail: 0

Guenter

2020-08-20 21:50:44

by Guenter Roeck

[permalink] [raw]
Subject: Re: [PATCH 4.19 00/92] 4.19.141-rc1 review

On Thu, Aug 20, 2020 at 11:20:45AM +0200, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.19.141 release.
> There are 92 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sat, 22 Aug 2020 09:15:09 +0000.
> Anything received after that time might be too late.
>

Tested-by: Guenter Roeck <[email protected]>

2020-08-21 00:02:15

by Shuah Khan

[permalink] [raw]
Subject: Re: [PATCH 4.19 00/92] 4.19.141-rc1 review

On 8/20/20 3:20 AM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.19.141 release.
> There are 92 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sat, 22 Aug 2020 09:15:09 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.141-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>

Compiled and booted on my test system. No dmesg regressions.

Tested-by: Shuah Khan <[email protected]>

thanks,
-- Shuah

2020-08-21 07:10:27

by Naresh Kamboju

[permalink] [raw]
Subject: Re: [PATCH 4.19 00/92] 4.19.141-rc1 review

On Thu, 20 Aug 2020 at 15:22, Greg Kroah-Hartman
<[email protected]> wrote:
>
> This is the start of the stable review cycle for the 4.19.141 release.
> There are 92 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sat, 22 Aug 2020 09:15:09 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.141-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>

Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.

Summary
------------------------------------------------------------------------

kernel: 4.19.141-rc1
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git branch: linux-4.19.y
git commit: 294e46de3a1d3cb90ac476ac92ffc835a7a1e716
git describe: v4.19.140-93-g294e46de3a1d
Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-4.19-oe/build/v4.19.140-93-g294e46de3a1d

No regressions (compared to build v4.19.140)

No fixes (compared to build v4.19.140)


Ran 34142 total tests in the following environments and test suites.

Environments
--------------
- dragonboard-410c - arm64
- hi6220-hikey - arm64
- i386
- juno-r2 - arm64
- juno-r2-compat
- juno-r2-kasan
- nxp-ls2088
- qemu_arm
- qemu_arm64
- qemu_i386
- qemu_x86_64
- x15 - arm
- x86_64
- x86-kasan

Test Suites
-----------
* build
* igt-gpu-tools
* install-android-platform-tools-r2600
* kselftest
* kselftest/drivers
* kselftest/filesystems
* kselftest/net
* kvm-unit-tests
* linux-log-parser
* ltp-cap_bounds-tests
* ltp-commands-tests
* ltp-containers-tests
* ltp-controllers-tests
* ltp-cpuhotplug-tests
* ltp-crypto-tests
* ltp-cve-tests
* ltp-dio-tests
* ltp-io-tests
* ltp-ipc-tests
* ltp-math-tests
* ltp-sched-tests
* ltp-tracing-tests
* perf
* libhugetlbfs
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-hugetlb-tests
* ltp-mm-tests
* ltp-nptl-tests
* ltp-pty-tests
* ltp-securebits-tests
* ltp-syscalls-tests
* network-basic-tests
* v4l2-compliance
* ltp-open-posix-tests
* ssuite
* kselftest-vsyscall-mode-native
* kselftest-vsyscall-mode-native/drivers
* kselftest-vsyscall-mode-native/filesystems
* kselftest-vsyscall-mode-native/net
* kselftest-vsyscall-mode-none
* kselftest-vsyscall-mode-none/drivers
* kselftest-vsyscall-mode-none/filesystems
* kselftest-vsyscall-mode-none/net

--
Linaro LKFT
https://lkft.linaro.org

2020-08-21 07:41:10

by Pavel Machek

[permalink] [raw]
Subject: Re: [PATCH 4.19 00/92] 4.19.141-rc1 review

On Thu 2020-08-20 11:20:45, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.19.141 release.
> There are 92 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sat, 22 Aug 2020 09:15:09 +0000.
> Anything received after that time might be too late.

Here are test results:

https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/pipelines/180031554

de0-nano failure is because we do not have any available targets, so
-cip testing did not find any problems.

Best regards,
Pavel
--
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html


Attachments:
(No filename) (815.00 B)
signature.asc (188.00 B)
Digital signature
Download all attachments