2019-12-19 19:08:31

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 4.9 000/199] 4.9.207-stable review

This is the start of the stable review cycle for the 4.9.207 release.
There are 199 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.

Responses should be made by Sat, 21 Dec 2019 18:24:44 +0000.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.207-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>
Linux 4.9.207-rc1

Aaro Koskinen <[email protected]>
net: stmmac: don't stop NAPI processing when dropping a packet

Aaro Koskinen <[email protected]>
net: stmmac: use correct DMA buffer size in the RX descriptor

Mathias Nyman <[email protected]>
xhci: fix USB3 device initiated resume race with roothub autosuspend

Alex Deucher <[email protected]>
drm/radeon: fix r1xx/r2xx register checker for POT textures

Bart Van Assche <[email protected]>
scsi: iscsi: Fix a potential deadlock in the timeout handler

Hou Tao <[email protected]>
dm btree: increase rebalance threshold in __rebalance2()

Navid Emamdoost <[email protected]>
dma-buf: Fix memory leak in sync_file_merge()

Jiang Yi <[email protected]>
vfio/pci: call irq_bypass_unregister_producer() before freeing irq

Dmitry Osipenko <[email protected]>
ARM: tegra: Fix FLOW_CTLR_HALT register clobbering by tegra_resume()

Lihua Yao <[email protected]>
ARM: dts: s3c64xx: Fix init order of clock providers

Pavel Shilovsky <[email protected]>
CIFS: Respect O_SYNC and O_DIRECT flags during reconnect

Max Filippov <[email protected]>
xtensa: fix TLB sanity checker

Jian-Hong Pan <[email protected]>
PCI/MSI: Fix incorrect MSI-X masking on resume

Steffen Liebergeld <[email protected]>
PCI: Fix Intel ACS quirk UPDCR register address

Greg Kroah-Hartman <[email protected]>
Revert "regulator: Defer init completion for a while after late_initcall"

Guillaume Nault <[email protected]>
tcp: Protect accesses to .ts_recent_stamp with {READ,WRITE}_ONCE()

Guillaume Nault <[email protected]>
tcp: tighten acceptance of ACKs not matching a child socket

Guillaume Nault <[email protected]>
tcp: fix rejected syncookies due to stale timestamps

Eric Dumazet <[email protected]>
inet: protect against too small mtu values.

Taehee Yoo <[email protected]>
tipc: fix ordering of tipc module init and exit routine

Eric Dumazet <[email protected]>
tcp: md5: fix potential overestimation of TCP option space

Aaron Conole <[email protected]>
openvswitch: support asymmetric conntrack

Grygorii Strashko <[email protected]>
net: ethernet: ti: cpsw: fix extra rx interrupt

Nikolay Aleksandrov <[email protected]>
net: bridge: deny dev_set_mac_address() when unregistering

Ivan Bornyakov <[email protected]>
nvme: host: core: fix precedence of ternary operator

Konstantin Khorenko <[email protected]>
kernel/module.c: wakeup processes in module_wq on module unload

Eran Ben Elisha <[email protected]>
net/mlx5e: Fix SFF 8472 eeprom length

Pavel Tikhomirov <[email protected]>
sunrpc: fix crash when cache_head become valid before update

Tejun Heo <[email protected]>
workqueue: Fix missing kfree(rescuer) in destroy_workqueue()

Ming Lei <[email protected]>
blk-mq: make sure that line break can be printed

yangerkun <[email protected]>
ext4: fix a bug in ext4_wait_for_tail_page_commit

Chen Jun <[email protected]>
mm/shmem.c: cast the type of unmap_start to u64

Will Deacon <[email protected]>
firmware: qcom: scm: Ensure 'a0' status code is treated as signed

Jeff Mahoney <[email protected]>
reiserfs: fix extended attributes on the root directory

Vincenzo Frascino <[email protected]>
powerpc: Fix vDSO clock_getres()

Bart Van Assche <[email protected]>
scsi: qla2xxx: Always check the qla2x00_wait_for_hba_online() return value

Bart Van Assche <[email protected]>
scsi: qla2xxx: Fix qla24xx_process_bidir_cmd()

Bart Van Assche <[email protected]>
scsi: qla2xxx: Fix session lookup in qlt_abort_work()

Himanshu Madhani <[email protected]>
scsi: qla2xxx: Fix DMA unmap leak

Krzysztof Kozlowski <[email protected]>
pinctrl: samsung: Fix device node refcount leaks in S3C64xx wakeup controller init

Jarkko Nikula <[email protected]>
ARM: dts: omap3-tao3530: Fix incorrect MMC card detection GPIO polarity

Miaoqing Pan <[email protected]>
ath10k: fix fw crash by moving chip reset after napi disabled

Shirish S <[email protected]>
x86/MCE/AMD: Carve out the MC4_MISC thresholding quirk

Shirish S <[email protected]>
x86/MCE/AMD: Turn off MC4_MISC thresholding on all family 0x15 models

YueHaibing <[email protected]>
e100: Fix passing zero to 'PTR_ERR' warning in e100_load_ucode_wait

James Smart <[email protected]>
scsi: lpfc: Cap NPIV vports to 256

H. Nikolaus Schaller <[email protected]>
omap: pdata-quirks: remove openpandora quirks for mmc3 and wl1251

Filipe Manana <[email protected]>
Btrfs: fix negative subv_writers counter and data space leak after buffered write

Nuno Sá <[email protected]>
iio: adis16480: Add debugfs_reg_access entry

Mathias Nyman <[email protected]>
xhci: make sure interrupts are restored to correct state

Mika Westerberg <[email protected]>
xhci: Fix memory leak in xhci_add_in_port()

Henry Lin <[email protected]>
usb: xhci: only set D3hot for pci device

Steffen Maier <[email protected]>
scsi: zfcp: trace channel log even for FCP command responses

Dmitry Monakhov <[email protected]>
quota: fix livelock in dquot_writeback_dquots

Chengguang Xu <[email protected]>
ext2: check err when partial != NULL

Dmitry Monakhov <[email protected]>
quota: Check that quota is not dirty before release

Ville Syrjälä <[email protected]>
video/hdmi: Fix AVI bar unpack

Alastair D'Silva <[email protected]>
powerpc: Allow 64bit VDSO __kernel_sync_dicache to work across ranges >4GB

Arnd Bergmann <[email protected]>
ppdev: fix PPGETTIME/PPSETTIME ioctls

H. Nikolaus Schaller <[email protected]>
mmc: host: omap_hsmmc: add code for special init of wl1251 to get rid of pandora_wl1251_init_card

Krzysztof Kozlowski <[email protected]>
pinctrl: samsung: Fix device node refcount leaks in init code

Krzysztof Kozlowski <[email protected]>
pinctrl: samsung: Fix device node refcount leaks in S3C24xx wakeup controller init

Rafael J. Wysocki <[email protected]>
ACPI: PM: Avoid attaching ACPI PM domain to certain devices

Vamshi K Sthambamkadi <[email protected]>
ACPI: bus: Fix NULL pointer check in acpi_bus_get_private_data()

Francesco Ruggeri <[email protected]>
ACPI: OSL: only free map once in osl.c

Leonard Crestez <[email protected]>
PM / devfreq: Lock devfreq in trans_stat_show

Zhenzhong Duan <[email protected]>
cpuidle: Do not unset the driver if it is there already

Johan Hovold <[email protected]>
media: radio: wl1273: fix interrupt masking on release

Johan Hovold <[email protected]>
media: bdisp: fix memleak on release

Denis Efremov <[email protected]>
ar5523: check NULL before memcpy() in ar5523_cmd()

Aleksa Sarai <[email protected]>
cgroup: pids: use atomic64_t for pids->limit

Ming Lei <[email protected]>
blk-mq: avoid sysfs buffer overflow with too many CPU cores

Pawel Harlozinski <[email protected]>
ASoC: Jack: Fix NULL pointer dereference in snd_soc_jack_report

Tejun Heo <[email protected]>
workqueue: Fix pwq ref leak in rescuer_thread()

Tejun Heo <[email protected]>
workqueue: Fix spurious sanity check failures in destroy_workqueue()

Takashi Iwai <[email protected]>
ALSA: hda - Fix pending unsol events at shutdown

Greg Kroah-Hartman <[email protected]>
lib: raid6: fix awk build warnings

Larry Finger <[email protected]>
rtlwifi: rtl8192de: Fix missing enable interrupt flag

Larry Finger <[email protected]>
rtlwifi: rtl8192de: Fix missing callback that tests for hw release of buffer

Larry Finger <[email protected]>
rtlwifi: rtl8192de: Fix missing code to retrieve RX buffer address

Josef Bacik <[email protected]>
btrfs: record all roots for rename exchange on a subvol

Filipe Manana <[email protected]>
Btrfs: send, skip backreference walking for extents with many references

Qu Wenruo <[email protected]>
btrfs: Remove btrfs_bio::flags member

Josef Bacik <[email protected]>
btrfs: check page->mapping when loading free space cache

David Hildenbrand <[email protected]>
virtio-balloon: fix managed page counts when migrating pages between zones

Miquel Raynal <[email protected]>
mtd: spear_smi: Fix Write Burst mode

Pete Zaitcev <[email protected]>
usb: mon: Fix a deadlock in usbmon between mmap and read

Emiliano Ingrassia <[email protected]>
usb: core: urb: fix URB structure initialization function

Johan Hovold <[email protected]>
USB: adutux: fix interface sanity check

Johan Hovold <[email protected]>
USB: serial: io_edgeport: fix epic endpoint lookup

Johan Hovold <[email protected]>
USB: idmouse: fix interface sanity checks

Johan Hovold <[email protected]>
USB: atm: ueagle-atm: add missing endpoint check

Chris Lesiak <[email protected]>
iio: humidity: hdc100x: fix IIO_HUMIDITYRELATIVE channel reporting

H. Nikolaus Schaller <[email protected]>
ARM: dts: pandora-common: define wl1251 as child node of mmc3

Kai-Heng Feng <[email protected]>
xhci: Increase STS_HALT timeout in xhci_suspend()

Johan Hovold <[email protected]>
staging: gigaset: add endpoint-type sanity check

Johan Hovold <[email protected]>
staging: gigaset: fix illegal free on probe errors

Johan Hovold <[email protected]>
staging: gigaset: fix general protection fault on probe

Johan Hovold <[email protected]>
staging: rtl8712: fix interface sanity check

Johan Hovold <[email protected]>
staging: rtl8188eu: fix interface sanity check

Kai-Heng Feng <[email protected]>
usb: Allow USB device to be warm reset in suspended state

Oliver Neukum <[email protected]>
USB: uas: heed CAPACITY_HEURISTICS

Oliver Neukum <[email protected]>
USB: uas: honor flag to avoid CAPACITY16

Wei Yongjun <[email protected]>
usb: gadget: configfs: Fix missing spin_lock_init()

YueHaibing <[email protected]>
appletalk: Set error code if register_snap_client failed

YueHaibing <[email protected]>
appletalk: Fix potential NULL pointer dereference in unregister_snap_client

Paolo Bonzini <[email protected]>
KVM: x86: fix out-of-bounds write in KVM_GET_EMULATED_CPUID (CVE-2019-19332)

Wei Wang <[email protected]>
thermal: Fix deadlock in thermal thermal_zone_device_check

Viresh Kumar <[email protected]>
RDMA/qib: Validate ->show()/store() callbacks before calling them

Gregory CLEMENT <[email protected]>
spi: atmel: Fix CS high support

Navid Emamdoost <[email protected]>
crypto: user - fix memory leak in crypto_report

Ard Biesheuvel <[email protected]>
crypto: ecdh - fix big endian bug in ECC library

Mark Salter <[email protected]>
crypto: ccp - fix uninitialized list head

Christian Lamparter <[email protected]>
crypto: crypto4xx - fix double-free in crypto4xx_destroy_sdr

Paolo Bonzini <[email protected]>
KVM: x86: fix presentation of TSX feature in ARCH_CAPABILITIES

Paolo Bonzini <[email protected]>
KVM: x86: do not modify masked bits of shared MSRs

Dan Carpenter <[email protected]>
drm/i810: Prevent underflow in ioctl

Jan Kara <[email protected]>
jbd2: Fix possible overflow in jbd2_log_space_left()

Jouni Hogander <[email protected]>
can: slcan: Fix use-after-free Read in slcan_open

Dmitry Torokhov <[email protected]>
tty: vt: keyboard: reject invalid keycodes

Pavel Shilovsky <[email protected]>
CIFS: Fix SMB2 oplock break processing

Pavel Shilovsky <[email protected]>
CIFS: Fix NULL-pointer dereference in smb2_push_mandatory_locks

Kai-Heng Feng <[email protected]>
x86/PCI: Avoid AMD FCH XHCI USB PME# from D0 defect

Mike Leach <[email protected]>
coresight: etm4x: Fix input validation for sysfs.

Hans de Goede <[email protected]>
Input: goodix - add upside-down quirk for Teclast X89 tablet

Takashi Iwai <[email protected]>
ALSA: pcm: oss: Avoid potential buffer overflows

Miklos Szeredi <[email protected]>
fuse: verify attributes

Miklos Szeredi <[email protected]>
fuse: verify nlink

Xuewei Zhang <[email protected]>
sched/fair: Scale bandwidth quota and period without losing quota/period ratio precision

Rob Herring <[email protected]>
ARM: dts: sunxi: Fix PMU compatible strings

Qian Cai <[email protected]>
mlx4: Use snprintf instead of complicated strcpy

Andreas Pape <[email protected]>
media: stkwebcam: Bugfix for wrong return values

Dmitry Safonov <[email protected]>
tty: Don't block on IO when ldisc change is pending

zhengbin <[email protected]>
nfsd: Return EPERM, not EACCES, in some SETATTR cases

Aaro Koskinen <[email protected]>
MIPS: OCTEON: cvmx_pko_mem_debug8: use oldest forward compatible definition

Joel Stanley <[email protected]>
powerpc/math-emu: Update macros from GCC

Erez Alfasi <[email protected]>
net/mlx4_core: Fix return codes of unsupported operations

David Teigland <[email protected]>
dlm: fix invalid cluster name warning

Rob Herring <[email protected]>
ARM: dts: realview: Fix some more duplicate regulator nodes

Chen-Yu Tsai <[email protected]>
clk: sunxi-ng: h3/h5: Fix CSI_MCLK parent

Daniel Mack <[email protected]>
ARM: dts: pxa: clean up USB controller nodes

Miquel Raynal <[email protected]>
mtd: fix mtd_oobavail() incoherent returned value

Masahiro Yamada <[email protected]>
kbuild: fix single target build for external module

Paul Walmsley <[email protected]>
modpost: skip ELF local symbols during section mismatch check

Yuchung Cheng <[email protected]>
tcp: fix SNMP TCP timeout under-estimation

Yuchung Cheng <[email protected]>
tcp: fix off-by-one bug on aborting window-probing socket

Rob Herring <[email protected]>
ARM: dts: realview-pbx: Fix duplicate regulator nodes

Lubomir Rintel <[email protected]>
ARM: dts: mmp2: fix the gpio interrupt cell number

Martin Schiller <[email protected]>
net/x25: fix null_x25_address handling

Martin Schiller <[email protected]>
net/x25: fix called/calling length calculation in x25_parse_address_block

Aaro Koskinen <[email protected]>
ARM: OMAP1/2: fix SoC name printing

Scott Mayhew <[email protected]>
nfsd: fix a warning in __cld_pipe_upcall()

Clément Péron <[email protected]>
ARM: debug: enable UART1 for socfpga Cyclone5

Wen Yang <[email protected]>
dlm: NULL check before kmem_cache_destroy is not needed

Lucas Stach <[email protected]>
i2c: imx: don't print error message on probe defer

Stefan Agner <[email protected]>
serial: imx: fix error handling in console_setup

Colin Ian King <[email protected]>
altera-stapl: check for a null key before strcasecmp'ing it

Niklas Söderlund <[email protected]>
dma-mapping: fix return type of dma_set_max_seg_size()

Alexey Dobriyan <[email protected]>
ACPI: fix acpi_find_child_device() invocation in acpi_preset_companion()

Brian Norris <[email protected]>
usb: dwc3: don't log probe deferrals; but do log other error codes

Vinod Koul <[email protected]>
dmaengine: coh901318: Remove unused variable

Jia-Ju Bai <[email protected]>
dmaengine: coh901318: Fix a double-lock bug

Hans Verkuil <[email protected]>
media: pulse8-cec: return 0 when invalidating the logical address

Marek Szyprowski <[email protected]>
ARM: dts: exynos: Use Samsung SoC specific compatible for DWC2 module

Baruch Siach <[email protected]>
rtc: dt-binding: abx80x: fix resistance scale

Christophe JAILLET <[email protected]>
rtc: max8997: Fix the returned value in case of error in 'max8997_rtc_read_alarm()'

Vincent Chen <[email protected]>
math-emu/soft-fp.h: (_FP_ROUND_ZERO) cast 0 to void to fix warning

Aaro Koskinen <[email protected]>
MIPS: OCTEON: octeon-platform: fix typing

Mark Brown <[email protected]>
regulator: Fix return value of _set_load() stub

Shreeya Patel <[email protected]>
Staging: iio: adt7316: Fix i2c data reading, set the data field

Brian Masney <[email protected]>
pinctrl: qcom: ssbi-gpio: fix gpio-hog related boot issues

Steffen Maier <[email protected]>
scsi: zfcp: drop default switch case which might paper over missing case

Maciej W. Rozycki <[email protected]>
MIPS: SiByte: Enable ZONE_DMA32 for LittleSur

David Teigland <[email protected]>
dlm: fix missing idr_destroy for recover_idr

John Keeping <[email protected]>
ARM: dts: rockchip: Fix rk3288-rock2 vcc_flash name

Heiko Stuebner <[email protected]>
clk: rockchip: fix rk3188 sclk_mac_lbtest parameter ordering

Finley Xiao <[email protected]>
clk: rockchip: fix rk3188 sclk_smc gate data

Marek Szyprowski <[email protected]>
extcon: max8997: Fix lack of path setting in USB device mode

Moni Shoua <[email protected]>
net/mlx5: Release resource on error flow

Vincent Whitchurch <[email protected]>
ARM: 8813/1: Make aligned 2-byte getuser()/putuser() atomic on ARMv6+

Andrei Otcheretianski <[email protected]>
iwlwifi: mvm: Send non offchannel traffic via AP sta

Arjun Vynipadath <[email protected]>
cxgb4vf: fix memleak in mac_hlist initialization

Douglas Anderson <[email protected]>
serial: core: Allow processing sysrq at port unlock time

Chuhong Yuan <[email protected]>
net: ep93xx_eth: fix mismatch of request_mem_region in remove

Chuhong Yuan <[email protected]>
rsxx: add missed destroy_workqueue calls in remove

paulhsia <[email protected]>
ALSA: pcm: Fix stream lock usage in snd_pcm_period_elapsed()

Pan Bian <[email protected]>
Input: cyttsp4_core - fix use after free bug

Stephan Gerhold <[email protected]>
NFC: nxp-nci: Fix NULL pointer dereference after I2C communication error

Al Viro <[email protected]>
audit_get_nd(): don't unlock parent too early

Al Viro <[email protected]>
exportfs_decode_fh(): negative pinned may become positive without the parent locked

Sirong Wang <[email protected]>
RDMA/hns: Correct the value of HNS_ROCE_HEM_CHUNK_LEN

Al Viro <[email protected]>
autofs: fix a leak in autofs_expire_indirect()

Chuhong Yuan <[email protected]>
serial: ifx6x60: add missed pm_runtime_disable

Jiangfeng Xiao <[email protected]>
serial: serial_core: Perform NULL checks for break_ctl ops

Vincent Whitchurch <[email protected]>
serial: pl011: Fix DMA ->flush_buffer()

Jeffrey Hugo <[email protected]>
tty: serial: msm_serial: Fix flow control

Peng Fan <[email protected]>
tty: serial: fsl_lpuart: use the sg count from dma_map_sg

Michał Mirosław <[email protected]>
usb: gadget: u_serial: add missing port entry locking

Jon Hunter <[email protected]>
arm64: tegra: Fix 'active-low' warning for Jetson TX1 regulator


-------------

Diffstat:

.../devicetree/bindings/rtc/abracon,abx80x.txt | 2 +-
Makefile | 15 ++--
arch/arm/Kconfig.debug | 23 ++++--
arch/arm/boot/dts/arm-realview-pb1176.dts | 4 +-
arch/arm/boot/dts/arm-realview-pb11mp.dts | 4 +-
arch/arm/boot/dts/arm-realview-pbx.dtsi | 5 +-
arch/arm/boot/dts/exynos3250.dtsi | 2 +-
arch/arm/boot/dts/mmp2.dtsi | 2 +-
arch/arm/boot/dts/omap3-pandora-common.dtsi | 36 ++++++++-
arch/arm/boot/dts/omap3-tao3530.dtsi | 2 +-
arch/arm/boot/dts/pxa27x.dtsi | 2 +-
arch/arm/boot/dts/pxa2xx.dtsi | 7 --
arch/arm/boot/dts/pxa3xx.dtsi | 2 +-
arch/arm/boot/dts/rk3288-rock2-som.dtsi | 2 +-
arch/arm/boot/dts/s3c6410-mini6410.dts | 4 +
arch/arm/boot/dts/s3c6410-smdk6410.dts | 4 +
arch/arm/boot/dts/sun6i-a31.dtsi | 2 +-
arch/arm/boot/dts/sun7i-a20.dtsi | 2 +-
arch/arm/include/asm/uaccess.h | 18 +++++
arch/arm/lib/getuser.S | 11 +++
arch/arm/lib/putuser.S | 20 ++---
arch/arm/mach-omap1/id.c | 6 +-
arch/arm/mach-omap2/id.c | 4 +-
arch/arm/mach-omap2/pdata-quirks.c | 93 ----------------------
arch/arm/mach-tegra/reset-handler.S | 6 +-
arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi | 2 +-
arch/mips/Kconfig | 1 +
arch/mips/cavium-octeon/executive/cvmx-cmd-queue.c | 2 +-
arch/mips/cavium-octeon/octeon-platform.c | 2 +-
arch/mips/include/asm/octeon/cvmx-pko.h | 2 +-
arch/powerpc/include/asm/sfp-machine.h | 92 +++++++--------------
arch/powerpc/include/asm/vdso_datapage.h | 2 +
arch/powerpc/kernel/asm-offsets.c | 2 +-
arch/powerpc/kernel/time.c | 1 +
arch/powerpc/kernel/vdso32/gettimeofday.S | 7 +-
arch/powerpc/kernel/vdso64/cacheflush.S | 4 +-
arch/powerpc/kernel/vdso64/gettimeofday.S | 7 +-
arch/x86/kernel/cpu/mcheck/mce.c | 30 -------
arch/x86/kernel/cpu/mcheck/mce_amd.c | 36 +++++++++
arch/x86/kvm/cpuid.c | 5 +-
arch/x86/kvm/x86.c | 14 +++-
arch/x86/pci/fixup.c | 11 +++
arch/xtensa/mm/tlb.c | 4 +-
block/blk-mq-sysfs.c | 15 ++--
crypto/crypto_user.c | 4 +-
crypto/ecc.c | 3 +-
drivers/acpi/bus.c | 2 +-
drivers/acpi/device_pm.c | 12 ++-
drivers/acpi/osl.c | 28 ++++---
drivers/block/rsxx/core.c | 2 +
drivers/char/ppdev.c | 16 +++-
drivers/clk/rockchip/clk-rk3188.c | 8 +-
drivers/clk/sunxi-ng/ccu-sun8i-h3.c | 2 +-
drivers/cpuidle/driver.c | 15 ++--
drivers/crypto/amcc/crypto4xx_core.c | 6 +-
drivers/crypto/ccp/ccp-dmaengine.c | 1 +
drivers/devfreq/devfreq.c | 12 ++-
drivers/dma-buf/sync_file.c | 2 +-
drivers/dma/coh901318.c | 5 --
drivers/extcon/extcon-max8997.c | 10 +--
drivers/firmware/qcom_scm-64.c | 2 +-
drivers/gpu/drm/i810/i810_dma.c | 4 +-
drivers/gpu/drm/radeon/r100.c | 4 +-
drivers/gpu/drm/radeon/r200.c | 4 +-
.../hwtracing/coresight/coresight-etm4x-sysfs.c | 21 +++--
drivers/i2c/busses/i2c-imx.c | 3 +-
drivers/iio/humidity/hdc100x.c | 2 +-
drivers/iio/imu/adis16480.c | 1 +
drivers/infiniband/hw/hns/hns_roce_hem.h | 2 +-
drivers/infiniband/hw/mlx4/sysfs.c | 12 +--
drivers/infiniband/hw/qib/qib_sysfs.c | 6 ++
drivers/input/touchscreen/cyttsp4_core.c | 7 --
drivers/input/touchscreen/goodix.c | 9 +++
drivers/isdn/gigaset/usb-gigaset.c | 23 ++++--
drivers/md/persistent-data/dm-btree-remove.c | 8 +-
drivers/media/platform/sti/bdisp/bdisp-v4l2.c | 3 +-
drivers/media/radio/radio-wl1273.c | 3 +-
drivers/media/usb/stkwebcam/stk-webcam.c | 6 +-
drivers/misc/altera-stapl/altera.c | 3 +-
drivers/mmc/host/omap_hsmmc.c | 30 +++++++
drivers/mtd/devices/spear_smi.c | 38 ++++++++-
drivers/net/can/slcan.c | 1 +
.../net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c | 6 +-
drivers/net/ethernet/cirrus/ep93xx_eth.c | 5 +-
drivers/net/ethernet/intel/e100.c | 4 +-
drivers/net/ethernet/mellanox/mlx4/main.c | 11 ++-
.../net/ethernet/mellanox/mlx5/core/en_ethtool.c | 2 +-
drivers/net/ethernet/mellanox/mlx5/core/qp.c | 4 +-
drivers/net/ethernet/stmicro/stmmac/common.h | 2 +-
drivers/net/ethernet/stmicro/stmmac/descs_com.h | 23 ++++--
drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c | 2 +-
drivers/net/ethernet/stmicro/stmmac/enh_desc.c | 10 ++-
drivers/net/ethernet/stmicro/stmmac/norm_desc.c | 10 ++-
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 20 ++---
drivers/net/ethernet/ti/cpsw.c | 2 +-
drivers/net/wireless/ath/ar5523/ar5523.c | 3 +-
drivers/net/wireless/ath/ath10k/pci.c | 9 ++-
drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 15 ++++
.../net/wireless/realtek/rtlwifi/rtl8192de/hw.c | 9 ++-
.../net/wireless/realtek/rtlwifi/rtl8192de/sw.c | 1 +
.../net/wireless/realtek/rtlwifi/rtl8192de/trx.c | 25 +++++-
.../net/wireless/realtek/rtlwifi/rtl8192de/trx.h | 2 +
drivers/nfc/nxp-nci/i2c.c | 6 +-
drivers/nvme/host/core.c | 4 +-
drivers/pci/msi.c | 2 +-
drivers/pci/quirks.c | 2 +-
drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c | 23 ++++--
drivers/pinctrl/samsung/pinctrl-s3c24xx.c | 6 +-
drivers/pinctrl/samsung/pinctrl-s3c64xx.c | 3 +
drivers/pinctrl/samsung/pinctrl-samsung.c | 10 ++-
drivers/regulator/core.c | 42 +++-------
drivers/rtc/rtc-max8997.c | 2 +-
drivers/s390/scsi/zfcp_dbf.c | 8 +-
drivers/s390/scsi/zfcp_erp.c | 3 -
drivers/scsi/libiscsi.c | 4 +-
drivers/scsi/lpfc/lpfc.h | 3 +-
drivers/scsi/lpfc/lpfc_attr.c | 12 ++-
drivers/scsi/lpfc/lpfc_init.c | 3 +
drivers/scsi/qla2xxx/qla_attr.c | 3 +-
drivers/scsi/qla2xxx/qla_bsg.c | 15 ++--
drivers/scsi/qla2xxx/qla_target.c | 11 +--
drivers/spi/spi-atmel.c | 6 +-
drivers/staging/iio/addac/adt7316-i2c.c | 2 +
drivers/staging/media/pulse8-cec/pulse8-cec.c | 2 +-
drivers/staging/rtl8188eu/os_dep/usb_intf.c | 2 +-
drivers/staging/rtl8712/usb_intf.c | 2 +-
drivers/thermal/thermal_core.c | 4 +-
drivers/tty/n_hdlc.c | 4 +-
drivers/tty/n_r3964.c | 2 +-
drivers/tty/n_tty.c | 8 +-
drivers/tty/serial/amba-pl011.c | 6 +-
drivers/tty/serial/fsl_lpuart.c | 4 +-
drivers/tty/serial/ifx6x60.c | 3 +
drivers/tty/serial/imx.c | 2 +-
drivers/tty/serial/msm_serial.c | 6 +-
drivers/tty/serial/serial_core.c | 2 +-
drivers/tty/tty_ldisc.c | 7 ++
drivers/tty/vt/keyboard.c | 2 +-
drivers/usb/atm/ueagle-atm.c | 18 +++--
drivers/usb/core/hub.c | 5 +-
drivers/usb/core/urb.c | 1 +
drivers/usb/dwc3/core.c | 3 +-
drivers/usb/gadget/configfs.c | 1 +
drivers/usb/gadget/function/u_serial.c | 2 +
drivers/usb/host/xhci-hub.c | 16 +++-
drivers/usb/host/xhci-mem.c | 4 +
drivers/usb/host/xhci-pci.c | 13 +++
drivers/usb/host/xhci-ring.c | 6 +-
drivers/usb/host/xhci.c | 7 +-
drivers/usb/host/xhci.h | 2 +
drivers/usb/misc/adutux.c | 2 +-
drivers/usb/misc/idmouse.c | 2 +-
drivers/usb/mon/mon_bin.c | 32 +++++---
drivers/usb/serial/io_edgeport.c | 10 ++-
drivers/usb/storage/uas.c | 10 +++
drivers/vfio/pci/vfio_pci_intrs.c | 2 +-
drivers/video/hdmi.c | 8 +-
drivers/virtio/virtio_balloon.c | 11 +++
fs/autofs4/expire.c | 5 +-
fs/btrfs/file.c | 2 +-
fs/btrfs/free-space-cache.c | 6 ++
fs/btrfs/inode.c | 3 +
fs/btrfs/send.c | 25 +++++-
fs/btrfs/volumes.h | 1 -
fs/cifs/file.c | 14 +++-
fs/cifs/smb2misc.c | 7 +-
fs/dlm/lockspace.c | 1 +
fs/dlm/memory.c | 9 +--
fs/dlm/user.c | 3 +-
fs/exportfs/expfs.c | 31 +++++---
fs/ext2/inode.c | 7 +-
fs/ext4/inode.c | 12 ++-
fs/fuse/dir.c | 27 +++++--
fs/fuse/fuse_i.h | 2 +
fs/nfsd/nfs4recover.c | 17 ++--
fs/nfsd/vfs.c | 17 +++-
fs/ocfs2/quota_global.c | 2 +-
fs/quota/dquot.c | 11 +--
fs/reiserfs/inode.c | 12 ++-
fs/reiserfs/namei.c | 7 +-
fs/reiserfs/reiserfs.h | 2 +
fs/reiserfs/super.c | 2 +
fs/reiserfs/xattr.c | 19 +++--
fs/reiserfs/xattr_acl.c | 4 +-
include/linux/acpi.h | 2 +-
include/linux/atalk.h | 2 +-
include/linux/dma-mapping.h | 3 +-
include/linux/jbd2.h | 4 +-
include/linux/mtd/mtd.h | 2 +-
include/linux/netdevice.h | 5 ++
include/linux/quotaops.h | 10 +++
include/linux/regulator/consumer.h | 2 +-
include/linux/serial_core.h | 37 ++++++++-
include/linux/time.h | 12 +++
include/linux/tty.h | 7 ++
include/math-emu/soft-fp.h | 2 +-
include/net/ip.h | 5 ++
include/net/tcp.h | 18 +++--
kernel/audit_watch.c | 2 +-
kernel/cgroup_pids.c | 11 +--
kernel/module.c | 2 +
kernel/sched/fair.c | 36 +++++----
kernel/workqueue.c | 38 +++++++--
lib/raid6/unroll.awk | 2 +-
mm/shmem.c | 2 +-
net/appletalk/aarp.c | 15 +++-
net/appletalk/ddp.c | 21 +++--
net/bridge/br_device.c | 6 ++
net/core/dev.c | 3 +-
net/ipv4/devinet.c | 5 --
net/ipv4/ip_output.c | 14 ++--
net/ipv4/tcp_output.c | 5 +-
net/ipv4/tcp_timer.c | 10 +--
net/openvswitch/conntrack.c | 11 +++
net/sunrpc/cache.c | 6 --
net/tipc/core.c | 29 +++----
net/x25/af_x25.c | 18 +++--
scripts/mod/modpost.c | 12 +++
sound/core/oss/linear.c | 2 +
sound/core/oss/mulaw.c | 2 +
sound/core/oss/route.c | 2 +
sound/core/pcm_lib.c | 8 +-
sound/pci/hda/hda_bind.c | 4 +
sound/pci/hda/hda_intel.c | 3 +
sound/soc/soc-jack.c | 3 +-
225 files changed, 1265 insertions(+), 749 deletions(-)



2019-12-19 19:08:47

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 4.9 035/199] rtc: dt-binding: abx80x: fix resistance scale

From: Baruch Siach <[email protected]>

[ Upstream commit 73852e56827f5cb5db9d6e8dd8191fc2f2e8f424 ]

The abracon,tc-resistor property value is in kOhm.

Signed-off-by: Baruch Siach <[email protected]>
Signed-off-by: Alexandre Belloni <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
Documentation/devicetree/bindings/rtc/abracon,abx80x.txt | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Documentation/devicetree/bindings/rtc/abracon,abx80x.txt b/Documentation/devicetree/bindings/rtc/abracon,abx80x.txt
index be789685a1c24..18b892d010d87 100644
--- a/Documentation/devicetree/bindings/rtc/abracon,abx80x.txt
+++ b/Documentation/devicetree/bindings/rtc/abracon,abx80x.txt
@@ -27,4 +27,4 @@ and valid to enable charging:

- "abracon,tc-diode": should be "standard" (0.6V) or "schottky" (0.3V)
- "abracon,tc-resistor": should be <0>, <3>, <6> or <11>. 0 disables the output
- resistor, the other values are in ohm.
+ resistor, the other values are in kOhm.
--
2.20.1



2019-12-19 19:08:47

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 4.9 007/199] serial: ifx6x60: add missed pm_runtime_disable

From: Chuhong Yuan <[email protected]>

commit 50b2b571c5f3df721fc81bf9a12c521dfbe019ba upstream.

The driver forgets to call pm_runtime_disable in remove.
Add the missed calls to fix it.

Signed-off-by: Chuhong Yuan <[email protected]>
Cc: stable <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
drivers/tty/serial/ifx6x60.c | 3 +++
1 file changed, 3 insertions(+)

--- a/drivers/tty/serial/ifx6x60.c
+++ b/drivers/tty/serial/ifx6x60.c
@@ -1244,6 +1244,9 @@ static int ifx_spi_spi_remove(struct spi
struct ifx_spi_device *ifx_dev = spi_get_drvdata(spi);
/* stop activity */
tasklet_kill(&ifx_dev->io_work_tasklet);
+
+ pm_runtime_disable(&spi->dev);
+
/* free irq */
free_irq(gpio_to_irq(ifx_dev->gpio.reset_out), ifx_dev);
free_irq(gpio_to_irq(ifx_dev->gpio.srdy), ifx_dev);


2019-12-19 19:09:00

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 4.9 062/199] dlm: fix invalid cluster name warning

From: David Teigland <[email protected]>

[ Upstream commit 3595c559326d0b660bb088a88e22e0ca630a0e35 ]

The warning added in commit 3b0e761ba83
"dlm: print log message when cluster name is not set"

did not account for the fact that lockspaces created
from userland do not supply a cluster name, so bogus
warnings are printed every time a userland lockspace
is created.

Signed-off-by: David Teigland <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
fs/dlm/user.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/dlm/user.c b/fs/dlm/user.c
index 57f2aacec97f5..bb0d307deadd3 100644
--- a/fs/dlm/user.c
+++ b/fs/dlm/user.c
@@ -25,6 +25,7 @@
#include "lvb_table.h"
#include "user.h"
#include "ast.h"
+#include "config.h"

static const char name_prefix[] = "dlm";
static const struct file_operations device_fops;
@@ -402,7 +403,7 @@ static int device_create_lockspace(struct dlm_lspace_params *params)
if (!capable(CAP_SYS_ADMIN))
return -EPERM;

- error = dlm_new_lockspace(params->name, NULL, params->flags,
+ error = dlm_new_lockspace(params->name, dlm_config.ci_cluster_name, params->flags,
DLM_USER_LVB_LEN, NULL, NULL, NULL,
&lockspace);
if (error)
--
2.20.1



2019-12-19 19:09:05

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 4.9 024/199] clk: rockchip: fix rk3188 sclk_mac_lbtest parameter ordering

From: Heiko Stuebner <[email protected]>

[ Upstream commit ac8cb53829a6ba119082e067f5bc8fab3611ce6a ]

Similar to commit a9f0c0e56371 ("clk: rockchip: fix rk3188 sclk_smc
gate data") there is one other gate clock in the rk3188 clock driver
with a similar wrong ordering, the sclk_mac_lbtest. So fix it as well.

Signed-off-by: Heiko Stuebner <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/clk/rockchip/clk-rk3188.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/clk/rockchip/clk-rk3188.c b/drivers/clk/rockchip/clk-rk3188.c
index a4c49906acf2c..d62031eedbe64 100644
--- a/drivers/clk/rockchip/clk-rk3188.c
+++ b/drivers/clk/rockchip/clk-rk3188.c
@@ -361,8 +361,8 @@ static struct rockchip_clk_branch common_clk_branches[] __initdata = {
RK2928_CLKGATE_CON(2), 5, GFLAGS),
MUX(SCLK_MAC, "sclk_macref", mux_sclk_macref_p, CLK_SET_RATE_PARENT,
RK2928_CLKSEL_CON(21), 4, 1, MFLAGS),
- GATE(0, "sclk_mac_lbtest", "sclk_macref",
- RK2928_CLKGATE_CON(2), 12, 0, GFLAGS),
+ GATE(0, "sclk_mac_lbtest", "sclk_macref", 0,
+ RK2928_CLKGATE_CON(2), 12, GFLAGS),

COMPOSITE(0, "hsadc_src", mux_pll_src_gpll_cpll_p, 0,
RK2928_CLKSEL_CON(22), 0, 1, MFLAGS, 8, 8, DFLAGS,
--
2.20.1



2019-12-19 19:09:10

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 4.9 023/199] clk: rockchip: fix rk3188 sclk_smc gate data

From: Finley Xiao <[email protected]>

[ Upstream commit a9f0c0e563717b9f63b3bb1c4a7c2df436a206d9 ]

Fix sclk_smc gate data.
Change variable order, flags come before the register address.

Signed-off-by: Finley Xiao <[email protected]>
Signed-off-by: Johan Jonker <[email protected]>
Signed-off-by: Heiko Stuebner <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/clk/rockchip/clk-rk3188.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/clk/rockchip/clk-rk3188.c b/drivers/clk/rockchip/clk-rk3188.c
index 523378d1396e8..a4c49906acf2c 100644
--- a/drivers/clk/rockchip/clk-rk3188.c
+++ b/drivers/clk/rockchip/clk-rk3188.c
@@ -390,8 +390,8 @@ static struct rockchip_clk_branch common_clk_branches[] __initdata = {
* Clock-Architecture Diagram 4
*/

- GATE(SCLK_SMC, "sclk_smc", "hclk_peri",
- RK2928_CLKGATE_CON(2), 4, 0, GFLAGS),
+ GATE(SCLK_SMC, "sclk_smc", "hclk_peri", 0,
+ RK2928_CLKGATE_CON(2), 4, GFLAGS),

COMPOSITE_NOMUX(SCLK_SPI0, "sclk_spi0", "pclk_peri", 0,
RK2928_CLKSEL_CON(25), 0, 7, DFLAGS,
--
2.20.1



2019-12-19 19:09:15

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 4.9 021/199] net/mlx5: Release resource on error flow

From: Moni Shoua <[email protected]>

[ Upstream commit 698114968a22f6c0c9f42e983ba033cc36bb7217 ]

Fix reference counting leakage when the event handler aborts due to an
unsupported event for the resource type.

Fixes: a14c2d4beee5 ("net/mlx5_core: Warn on unsupported events of QP/RQ/SQ")
Signed-off-by: Moni Shoua <[email protected]>
Reviewed-by: Majd Dibbiny <[email protected]>
Signed-off-by: Leon Romanovsky <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/net/ethernet/mellanox/mlx5/core/qp.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/qp.c b/drivers/net/ethernet/mellanox/mlx5/core/qp.c
index 9346f3985edf3..354338c8a510e 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/qp.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/qp.c
@@ -125,7 +125,7 @@ void mlx5_rsc_event(struct mlx5_core_dev *dev, u32 rsn, int event_type)
if (!is_event_type_allowed((rsn >> MLX5_USER_INDEX_LEN), event_type)) {
mlx5_core_warn(dev, "event 0x%.2x is not allowed on resource 0x%.8x\n",
event_type, rsn);
- return;
+ goto out;
}

switch (common->res) {
@@ -139,7 +139,7 @@ void mlx5_rsc_event(struct mlx5_core_dev *dev, u32 rsn, int event_type)
default:
mlx5_core_warn(dev, "invalid resource type for 0x%x\n", rsn);
}
-
+out:
mlx5_core_put_rsc(common);
}

--
2.20.1



2019-12-19 19:09:17

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 4.9 048/199] nfsd: fix a warning in __cld_pipe_upcall()

From: Scott Mayhew <[email protected]>

[ Upstream commit b493fd31c0b89d9453917e977002de58bebc3802 ]

__cld_pipe_upcall() emits a "do not call blocking ops when
!TASK_RUNNING" warning due to the dput() call in rpc_queue_upcall().
Fix it by using a completion instead of hand coding the wait.

Signed-off-by: Scott Mayhew <[email protected]>
Signed-off-by: J. Bruce Fields <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
fs/nfsd/nfs4recover.c | 17 ++++++-----------
1 file changed, 6 insertions(+), 11 deletions(-)

diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c
index 66eaeb1e8c2ce..dc9586feab317 100644
--- a/fs/nfsd/nfs4recover.c
+++ b/fs/nfsd/nfs4recover.c
@@ -661,7 +661,7 @@ struct cld_net {
struct cld_upcall {
struct list_head cu_list;
struct cld_net *cu_net;
- struct task_struct *cu_task;
+ struct completion cu_done;
struct cld_msg cu_msg;
};

@@ -670,23 +670,18 @@ __cld_pipe_upcall(struct rpc_pipe *pipe, struct cld_msg *cmsg)
{
int ret;
struct rpc_pipe_msg msg;
+ struct cld_upcall *cup = container_of(cmsg, struct cld_upcall, cu_msg);

memset(&msg, 0, sizeof(msg));
msg.data = cmsg;
msg.len = sizeof(*cmsg);

- /*
- * Set task state before we queue the upcall. That prevents
- * wake_up_process in the downcall from racing with schedule.
- */
- set_current_state(TASK_UNINTERRUPTIBLE);
ret = rpc_queue_upcall(pipe, &msg);
if (ret < 0) {
- set_current_state(TASK_RUNNING);
goto out;
}

- schedule();
+ wait_for_completion(&cup->cu_done);

if (msg.errno < 0)
ret = msg.errno;
@@ -753,7 +748,7 @@ cld_pipe_downcall(struct file *filp, const char __user *src, size_t mlen)
if (copy_from_user(&cup->cu_msg, src, mlen) != 0)
return -EFAULT;

- wake_up_process(cup->cu_task);
+ complete(&cup->cu_done);
return mlen;
}

@@ -768,7 +763,7 @@ cld_pipe_destroy_msg(struct rpc_pipe_msg *msg)
if (msg->errno >= 0)
return;

- wake_up_process(cup->cu_task);
+ complete(&cup->cu_done);
}

static const struct rpc_pipe_ops cld_upcall_ops = {
@@ -899,7 +894,7 @@ restart_search:
goto restart_search;
}
}
- new->cu_task = current;
+ init_completion(&new->cu_done);
new->cu_msg.cm_vers = CLD_UPCALL_VERSION;
put_unaligned(cn->cn_xid++, &new->cu_msg.cm_xid);
new->cu_net = cn;
--
2.20.1



2019-12-19 19:09:20

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 4.9 017/199] serial: core: Allow processing sysrq at port unlock time

From: Douglas Anderson <[email protected]>

[ Upstream commit d6e1935819db0c91ce4a5af82466f3ab50d17346 ]

Right now serial drivers process sysrq keys deep in their character
receiving code. This means that they've already grabbed their
port->lock spinlock. This can end up getting in the way if we've go
to do serial stuff (especially kgdb) in response to the sysrq.

Serial drivers have various hacks in them to handle this. Looking at
'8250_port.c' you can see that the console_write() skips locking if
we're in the sysrq handler. Looking at 'msm_serial.c' you can see
that the port lock is dropped around uart_handle_sysrq_char().

It turns out that these hacks aren't exactly perfect. If you have
lockdep turned on and use something like the 8250_port hack you'll get
a splat that looks like:

WARNING: possible circular locking dependency detected
[...] is trying to acquire lock:
... (console_owner){-.-.}, at: console_unlock+0x2e0/0x5e4

but task is already holding lock:
... (&port_lock_key){-.-.}, at: serial8250_handle_irq+0x30/0xe4

which lock already depends on the new lock.

the existing dependency chain (in reverse order) is:

-> #1 (&port_lock_key){-.-.}:
_raw_spin_lock_irqsave+0x58/0x70
serial8250_console_write+0xa8/0x250
univ8250_console_write+0x40/0x4c
console_unlock+0x528/0x5e4
register_console+0x2c4/0x3b0
uart_add_one_port+0x350/0x478
serial8250_register_8250_port+0x350/0x3a8
dw8250_probe+0x67c/0x754
platform_drv_probe+0x58/0xa4
really_probe+0x150/0x294
driver_probe_device+0xac/0xe8
__driver_attach+0x98/0xd0
bus_for_each_dev+0x84/0xc8
driver_attach+0x2c/0x34
bus_add_driver+0xf0/0x1ec
driver_register+0xb4/0x100
__platform_driver_register+0x60/0x6c
dw8250_platform_driver_init+0x20/0x28
...

-> #0 (console_owner){-.-.}:
lock_acquire+0x1e8/0x214
console_unlock+0x35c/0x5e4
vprintk_emit+0x230/0x274
vprintk_default+0x7c/0x84
vprintk_func+0x190/0x1bc
printk+0x80/0xa0
__handle_sysrq+0x104/0x21c
handle_sysrq+0x30/0x3c
serial8250_read_char+0x15c/0x18c
serial8250_rx_chars+0x34/0x74
serial8250_handle_irq+0x9c/0xe4
dw8250_handle_irq+0x98/0xcc
serial8250_interrupt+0x50/0xe8
...

other info that might help us debug this:

Possible unsafe locking scenario:

CPU0 CPU1
---- ----
lock(&port_lock_key);
lock(console_owner);
lock(&port_lock_key);
lock(console_owner);

*** DEADLOCK ***

The hack used in 'msm_serial.c' doesn't cause the above splats but it
seems a bit ugly to unlock / lock our spinlock deep in our irq
handler.

It seems like we could defer processing the sysrq until the end of the
interrupt handler right after we've unlocked the port. With this
scheme if a whole batch of sysrq characters comes in one irq then we
won't handle them all, but that seems like it should be a fine
compromise.

Signed-off-by: Douglas Anderson <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
include/linux/serial_core.h | 37 ++++++++++++++++++++++++++++++++++++-
1 file changed, 36 insertions(+), 1 deletion(-)

diff --git a/include/linux/serial_core.h b/include/linux/serial_core.h
index eb4f6456521e9..cd95b5e395a30 100644
--- a/include/linux/serial_core.h
+++ b/include/linux/serial_core.h
@@ -161,6 +161,7 @@ struct uart_port {
struct console *cons; /* struct console, if any */
#if defined(CONFIG_SERIAL_CORE_CONSOLE) || defined(SUPPORT_SYSRQ)
unsigned long sysrq; /* sysrq timeout */
+ unsigned int sysrq_ch; /* char for sysrq */
#endif

/* flags must be updated while holding port mutex */
@@ -470,8 +471,42 @@ uart_handle_sysrq_char(struct uart_port *port, unsigned int ch)
}
return 0;
}
+static inline int
+uart_prepare_sysrq_char(struct uart_port *port, unsigned int ch)
+{
+ if (port->sysrq) {
+ if (ch && time_before(jiffies, port->sysrq)) {
+ port->sysrq_ch = ch;
+ port->sysrq = 0;
+ return 1;
+ }
+ port->sysrq = 0;
+ }
+ return 0;
+}
+static inline void
+uart_unlock_and_check_sysrq(struct uart_port *port, unsigned long irqflags)
+{
+ int sysrq_ch;
+
+ sysrq_ch = port->sysrq_ch;
+ port->sysrq_ch = 0;
+
+ spin_unlock_irqrestore(&port->lock, irqflags);
+
+ if (sysrq_ch)
+ handle_sysrq(sysrq_ch);
+}
#else
-#define uart_handle_sysrq_char(port,ch) ({ (void)port; 0; })
+static inline int
+uart_handle_sysrq_char(struct uart_port *port, unsigned int ch) { return 0; }
+static inline int
+uart_prepare_sysrq_char(struct uart_port *port, unsigned int ch) { return 0; }
+static inline void
+uart_unlock_and_check_sysrq(struct uart_port *port, unsigned long irqflags)
+{
+ spin_unlock_irqrestore(&port->lock, irqflags);
+}
#endif

/*
--
2.20.1



2019-12-19 19:09:24

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 4.9 012/199] NFC: nxp-nci: Fix NULL pointer dereference after I2C communication error

From: Stephan Gerhold <[email protected]>

[ Upstream commit a71a29f50de1ef97ab55c151a1598eb12dde379d ]

I2C communication errors (-EREMOTEIO) during the IRQ handler of nxp-nci
result in a NULL pointer dereference at the moment:

BUG: kernel NULL pointer dereference, address: 0000000000000000
Oops: 0002 [#1] PREEMPT SMP NOPTI
CPU: 1 PID: 355 Comm: irq/137-nxp-nci Not tainted 5.4.0-rc6 #1
RIP: 0010:skb_queue_tail+0x25/0x50
Call Trace:
nci_recv_frame+0x36/0x90 [nci]
nxp_nci_i2c_irq_thread_fn+0xd1/0x285 [nxp_nci_i2c]
? preempt_count_add+0x68/0xa0
? irq_forced_thread_fn+0x80/0x80
irq_thread_fn+0x20/0x60
irq_thread+0xee/0x180
? wake_threads_waitq+0x30/0x30
kthread+0xfb/0x130
? irq_thread_check_affinity+0xd0/0xd0
? kthread_park+0x90/0x90
ret_from_fork+0x1f/0x40

Afterward the kernel must be rebooted to work properly again.

This happens because it attempts to call nci_recv_frame() with skb == NULL.
However, unlike nxp_nci_fw_recv_frame(), nci_recv_frame() does not have any
NULL checks for skb, causing the NULL pointer dereference.

Change the code to call only nxp_nci_fw_recv_frame() in case of an error.
Make sure to log it so it is obvious that a communication error occurred.
The error above then becomes:

nxp-nci_i2c i2c-NXP1001:00: NFC: Read failed with error -121
nci: __nci_request: wait_for_completion_interruptible_timeout failed 0
nxp-nci_i2c i2c-NXP1001:00: NFC: Read failed with error -121

Fixes: 6be88670fc59 ("NFC: nxp-nci_i2c: Add I2C support to NXP NCI driver")
Signed-off-by: Stephan Gerhold <[email protected]>
Reviewed-by: Andy Shevchenko <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/nfc/nxp-nci/i2c.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/nfc/nxp-nci/i2c.c b/drivers/nfc/nxp-nci/i2c.c
index 06a157c63416a..7eab97585f22b 100644
--- a/drivers/nfc/nxp-nci/i2c.c
+++ b/drivers/nfc/nxp-nci/i2c.c
@@ -238,8 +238,10 @@ static irqreturn_t nxp_nci_i2c_irq_thread_fn(int irq, void *phy_id)

if (r == -EREMOTEIO) {
phy->hard_fault = r;
- skb = NULL;
- } else if (r < 0) {
+ if (info->mode == NXP_NCI_MODE_FW)
+ nxp_nci_fw_recv_frame(phy->ndev, NULL);
+ }
+ if (r < 0) {
nfc_err(&client->dev, "Read failed with error %d\n", r);
goto exit_irq_handled;
}
--
2.20.1



2019-12-19 19:09:25

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 4.9 014/199] ALSA: pcm: Fix stream lock usage in snd_pcm_period_elapsed()

From: paulhsia <[email protected]>

[ Upstream commit f5cdc9d4003a2f66ea57b3edd3e04acc2b1a4439 ]

If the nullity check for `substream->runtime` is outside of the lock
region, it is possible to have a null runtime in the critical section
if snd_pcm_detach_substream is called right before the lock.

Signed-off-by: paulhsia <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Takashi Iwai <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
sound/core/pcm_lib.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c
index 3acb373674c37..f09ae7efc6957 100644
--- a/sound/core/pcm_lib.c
+++ b/sound/core/pcm_lib.c
@@ -1877,11 +1877,14 @@ void snd_pcm_period_elapsed(struct snd_pcm_substream *substream)
struct snd_pcm_runtime *runtime;
unsigned long flags;

- if (PCM_RUNTIME_CHECK(substream))
+ if (snd_BUG_ON(!substream))
return;
- runtime = substream->runtime;

snd_pcm_stream_lock_irqsave(substream, flags);
+ if (PCM_RUNTIME_CHECK(substream))
+ goto _unlock;
+ runtime = substream->runtime;
+
if (!snd_pcm_running(substream) ||
snd_pcm_update_hw_ptr0(substream, 1) < 0)
goto _end;
@@ -1892,6 +1895,7 @@ void snd_pcm_period_elapsed(struct snd_pcm_substream *substream)
#endif
_end:
kill_fasync(&runtime->fasync, SIGIO, POLL_IN);
+ _unlock:
snd_pcm_stream_unlock_irqrestore(substream, flags);
}

--
2.20.1



2019-12-19 19:09:31

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 4.9 025/199] ARM: dts: rockchip: Fix rk3288-rock2 vcc_flash name

From: John Keeping <[email protected]>

[ Upstream commit 03d9f8fa2bfdc791865624d3adc29070cf67814e ]

There is no functional change from this, but it is confusing to find two
copies of vcc_sys and no vcc_flash when looking in
/sys/class/regulator/*/name.

Signed-off-by: John Keeping <[email protected]>
Signed-off-by: Heiko Stuebner <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
arch/arm/boot/dts/rk3288-rock2-som.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/rk3288-rock2-som.dtsi b/arch/arm/boot/dts/rk3288-rock2-som.dtsi
index bb1f01e037ba7..c1c576875bc85 100644
--- a/arch/arm/boot/dts/rk3288-rock2-som.dtsi
+++ b/arch/arm/boot/dts/rk3288-rock2-som.dtsi
@@ -63,7 +63,7 @@

vcc_flash: flash-regulator {
compatible = "regulator-fixed";
- regulator-name = "vcc_sys";
+ regulator-name = "vcc_flash";
regulator-min-microvolt = <1800000>;
regulator-max-microvolt = <1800000>;
startup-delay-us = <150>;
--
2.20.1



2019-12-19 19:09:38

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 4.9 011/199] audit_get_nd(): dont unlock parent too early

From: Al Viro <[email protected]>

[ Upstream commit 69924b89687a2923e88cc42144aea27868913d0e ]

if the child has been negative and just went positive
under us, we want coherent d_is_positive() and ->d_inode.
Don't unlock the parent until we'd done that work...

Signed-off-by: Al Viro <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
kernel/audit_watch.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/audit_watch.c b/kernel/audit_watch.c
index f036b6ada6efc..712469a3103ac 100644
--- a/kernel/audit_watch.c
+++ b/kernel/audit_watch.c
@@ -365,12 +365,12 @@ static int audit_get_nd(struct audit_watch *watch, struct path *parent)
struct dentry *d = kern_path_locked(watch->path, parent);
if (IS_ERR(d))
return PTR_ERR(d);
- inode_unlock(d_backing_inode(parent->dentry));
if (d_is_positive(d)) {
/* update watch filter fields */
watch->dev = d->d_sb->s_dev;
watch->ino = d_backing_inode(d)->i_ino;
}
+ inode_unlock(d_backing_inode(parent->dentry));
dput(d);
return 0;
}
--
2.20.1



2019-12-19 19:09:51

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 4.9 006/199] serial: serial_core: Perform NULL checks for break_ctl ops

From: Jiangfeng Xiao <[email protected]>

commit 7d73170e1c282576419f8b50a771f1fcd2b81a94 upstream.

Doing fuzz test on sbsa uart device, causes a kernel crash
due to NULL pointer dereference:

------------[ cut here ]------------
Unable to handle kernel paging request at virtual address fffffffffffffffc
pgd = ffffffe331723000
[fffffffffffffffc] *pgd=0000002333595003, *pud=0000002333595003, *pmd=00000
Internal error: Oops: 96000005 [#1] PREEMPT SMP
Modules linked in: ping(O) jffs2 rtos_snapshot(O) pramdisk(O) hisi_sfc(O)
Drv_Nandc_K(O) Drv_SysCtl_K(O) Drv_SysClk_K(O) bsp_reg(O) hns3(O)
hns3_uio_enet(O) hclgevf(O) hclge(O) hnae3(O) mdio_factory(O)
mdio_registry(O) mdio_dev(O) mdio(O) hns3_info(O) rtos_kbox_panic(O)
uart_suspend(O) rsm(O) stp llc tunnel4 xt_tcpudp ipt_REJECT nf_reject_ipv4
iptable_filter ip_tables x_tables sd_mod xhci_plat_hcd xhci_pci xhci_hcd
usbmon usbhid usb_storage ohci_platform ohci_pci ohci_hcd hid_generic hid
ehci_platform ehci_pci ehci_hcd vfat fat usbcore usb_common scsi_mod
yaffs2multi(O) ext4 jbd2 ext2 mbcache ofpart i2c_dev i2c_core uio ubi nand
nand_ecc nand_ids cfi_cmdset_0002 cfi_cmdset_0001 cfi_probe gen_probe
cmdlinepart chipreg mtdblock mtd_blkdevs mtd nfsd auth_rpcgss oid_registry
nfsv3 nfs nfs_acl lockd sunrpc grace autofs4
CPU: 2 PID: 2385 Comm: tty_fuzz_test Tainted: G O 4.4.193 #1
task: ffffffe32b23f110 task.stack: ffffffe32bda4000
PC is at uart_break_ctl+0x44/0x84
LR is at uart_break_ctl+0x34/0x84
pc : [<ffffff8393196098>] lr : [<ffffff8393196088>] pstate: 80000005
sp : ffffffe32bda7cc0
x29: ffffffe32bda7cc0 x28: ffffffe32b23f110
x27: ffffff8393402000 x26: 0000000000000000
x25: ffffffe32b233f40 x24: ffffffc07a8ec680
x23: 0000000000005425 x22: 00000000ffffffff
x21: ffffffe33ed73c98 x20: 0000000000000000
x19: ffffffe33ed94168 x18: 0000000000000004
x17: 0000007f92ae9d30 x16: ffffff8392fa6064
x15: 0000000000000010 x14: 0000000000000000
x13: 0000000000000000 x12: 0000000000000000
x11: 0000000000000020 x10: 0000007ffdac1708
x9 : 0000000000000078 x8 : 000000000000001d
x7 : 0000000052a64887 x6 : ffffffe32bda7e08
x5 : ffffffe32b23c000 x4 : 0000005fbc5b0000
x3 : ffffff83938d5018 x2 : 0000000000000080
x1 : ffffffe32b23c040 x0 : ffffff83934428f8
virtual start addr offset is 38ac00000
module base offset is 2cd4cf1000
linear region base offset is : 0
Process tty_fuzz_test (pid: 2385, stack limit = 0xffffffe32bda4000)
Stack: (0xffffffe32bda7cc0 to 0xffffffe32bda8000)
7cc0: ffffffe32bda7cf0 ffffff8393177718 ffffffc07a8ec680 ffffff8393196054
7ce0: 000000001739f2e0 0000007ffdac1978 ffffffe32bda7d20 ffffff8393179a1c
7d00: 0000000000000000 ffffff8393c0a000 ffffffc07a8ec680 cb88537fdc8ba600
7d20: ffffffe32bda7df0 ffffff8392fa5a40 ffffff8393c0a000 0000000000005425
7d40: 0000007ffdac1978 ffffffe32b233f40 ffffff8393178dcc 0000000000000003
7d60: 000000000000011d 000000000000001d ffffffe32b23f110 000000000000029e
7d80: ffffffe34fe8d5d0 0000000000000000 ffffffe32bda7e14 cb88537fdc8ba600
7da0: ffffffe32bda7e30 ffffff8393042cfc ffffff8393c41720 ffffff8393c46410
7dc0: ffffff839304fa68 ffffffe32b233f40 0000000000005425 0000007ffdac1978
7de0: 000000000000011d cb88537fdc8ba600 ffffffe32bda7e70 ffffff8392fa60cc
7e00: 0000000000000000 ffffffe32b233f40 ffffffe32b233f40 0000000000000003
7e20: 0000000000005425 0000007ffdac1978 ffffffe32bda7e70 ffffff8392fa60b0
7e40: 0000000000000280 ffffffe32b233f40 ffffffe32b233f40 0000000000000003
7e60: 0000000000005425 cb88537fdc8ba600 0000000000000000 ffffff8392e02e78
7e80: 0000000000000280 0000005fbc5b0000 ffffffffffffffff 0000007f92ae9d3c
7ea0: 0000000060000000 0000000000000015 0000000000000003 0000000000005425
7ec0: 0000007ffdac1978 0000000000000000 00000000a54c910e 0000007f92b95014
7ee0: 0000007f92b95090 0000000052a64887 000000000000001d 0000000000000078
7f00: 0000007ffdac1708 0000000000000020 0000000000000000 0000000000000000
7f20: 0000000000000000 0000000000000010 000000556acf0090 0000007f92ae9d30
7f40: 0000000000000004 000000556acdef10 0000000000000000 000000556acdebd0
7f60: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
7f80: 0000000000000000 0000000000000000 0000000000000000 0000007ffdac1840
7fa0: 000000556acdedcc 0000007ffdac1840 0000007f92ae9d3c 0000000060000000
7fc0: 0000000000000000 0000000000000000 0000000000000003 000000000000001d
7fe0: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
Call trace:
Exception stack(0xffffffe32bda7ab0 to 0xffffffe32bda7bf0)
7aa0: 0000000000001000 0000007fffffffff
7ac0: ffffffe32bda7cc0 ffffff8393196098 0000000080000005 0000000000000025
7ae0: ffffffe32b233f40 ffffff83930d777c ffffffe32bda7b30 ffffff83930d777c
7b00: ffffffe32bda7be0 ffffff83938d5000 ffffffe32bda7be0 ffffffe32bda7c20
7b20: ffffffe32bda7b60 ffffff83930d777c ffffffe32bda7c10 ffffff83938d5000
7b40: ffffffe32bda7c10 ffffffe32bda7c50 ffffff8393c0a000 ffffffe32b23f110
7b60: ffffffe32bda7b70 ffffff8392e09df4 ffffffe32bda7bb0 cb88537fdc8ba600
7b80: ffffff83934428f8 ffffffe32b23c040 0000000000000080 ffffff83938d5018
7ba0: 0000005fbc5b0000 ffffffe32b23c000 ffffffe32bda7e08 0000000052a64887
7bc0: 000000000000001d 0000000000000078 0000007ffdac1708 0000000000000020
7be0: 0000000000000000 0000000000000000
[<ffffff8393196098>] uart_break_ctl+0x44/0x84
[<ffffff8393177718>] send_break+0xa0/0x114
[<ffffff8393179a1c>] tty_ioctl+0xc50/0xe84
[<ffffff8392fa5a40>] do_vfs_ioctl+0xc4/0x6e8
[<ffffff8392fa60cc>] SyS_ioctl+0x68/0x9c
[<ffffff8392e02e78>] __sys_trace_return+0x0/0x4
Code: b9410ea0 34000160 f9408aa0 f9402814 (b85fc280)
---[ end trace 8606094f1960c5e0 ]---
Kernel panic - not syncing: Fatal exception

Fix this problem by adding NULL checks prior to calling break_ctl ops.

Signed-off-by: Jiangfeng Xiao <[email protected]>
Cc: stable <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>

---
drivers/tty/serial/serial_core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -1106,7 +1106,7 @@ static int uart_break_ctl(struct tty_str
if (!uport)
goto out;

- if (uport->type != PORT_UNKNOWN)
+ if (uport->type != PORT_UNKNOWN && uport->ops->break_ctl)
uport->ops->break_ctl(uport, break_state);
ret = 0;
out:


2019-12-19 19:10:08

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 4.9 027/199] MIPS: SiByte: Enable ZONE_DMA32 for LittleSur

From: Maciej W. Rozycki <[email protected]>

[ Upstream commit 756d6d836dbfb04a5a486bc2ec89397aa4533737 ]

The LittleSur board is marked for high memory support and therefore
clearly must provide a way to have enough memory installed for some to
be present outside the low 4GiB physical address range. With the memory
map of the BCM1250 SOC it has been built around it means over 1GiB of
actual DRAM, as only the first 1GiB is mapped in the low 4GiB physical
address range[1].

Complement commit cce335ae47e2 ("[MIPS] 64-bit Sibyte kernels need
DMA32.") then and also enable ZONE_DMA32 for LittleSur.


[1] "BCM1250/BCM1125/BCM1125H User Manual", Revision 1250_1125-UM100-R,
Broadcom Corporation, 21 Oct 2002, Section 3: "System Overview",
"Memory Map", pp. 34-38

Signed-off-by: Maciej W. Rozycki <[email protected]>
Signed-off-by: Paul Burton <[email protected]>
Reviewed-by: Christoph Hellwig <[email protected]>
Patchwork: https://patchwork.linux-mips.org/patch/21107/
Fixes: cce335ae47e2 ("[MIPS] 64-bit Sibyte kernels need DMA32.")
Cc: Ralf Baechle <[email protected]>
Cc: [email protected]
Cc: [email protected]
Signed-off-by: Sasha Levin <[email protected]>
---
arch/mips/Kconfig | 1 +
1 file changed, 1 insertion(+)

diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index 92bcde046b6b4..f8a529c852795 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -804,6 +804,7 @@ config SIBYTE_LITTLESUR
select SYS_SUPPORTS_BIG_ENDIAN
select SYS_SUPPORTS_HIGHMEM
select SYS_SUPPORTS_LITTLE_ENDIAN
+ select ZONE_DMA32 if 64BIT

config SIBYTE_SENTOSA
bool "Sibyte BCM91250E-Sentosa"
--
2.20.1



2019-12-19 19:10:09

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 4.9 030/199] Staging: iio: adt7316: Fix i2c data reading, set the data field

From: Shreeya Patel <[email protected]>

[ Upstream commit 688cd642ba0c393344c802647848da5f0d925d0e ]

adt7316_i2c_read function nowhere sets the data field.
It is necessary to have an appropriate value for it.
Hence, assign the value stored in 'ret' variable to data field.

This is an ancient bug, and as no one seems to have noticed,
probably no sense in applying it to stable.

Signed-off-by: Shreeya Patel <[email protected]>
Signed-off-by: Jonathan Cameron <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/staging/iio/addac/adt7316-i2c.c | 2 ++
1 file changed, 2 insertions(+)

diff --git a/drivers/staging/iio/addac/adt7316-i2c.c b/drivers/staging/iio/addac/adt7316-i2c.c
index 0ccf192b9a032..5950225e45d15 100644
--- a/drivers/staging/iio/addac/adt7316-i2c.c
+++ b/drivers/staging/iio/addac/adt7316-i2c.c
@@ -35,6 +35,8 @@ static int adt7316_i2c_read(void *client, u8 reg, u8 *data)
return ret;
}

+ *data = ret;
+
return 0;
}

--
2.20.1



2019-12-19 19:10:16

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 4.9 020/199] ARM: 8813/1: Make aligned 2-byte getuser()/putuser() atomic on ARMv6+

From: Vincent Whitchurch <[email protected]>

[ Upstream commit 344eb5539abf3e0b6ce22568c03e86450073e097 ]

getuser() and putuser() (and there underscored variants) use two
strb[t]/ldrb[t] instructions when they are asked to get/put 16-bits.
This means that the read/write is not atomic even when performed to a
16-bit-aligned address.

This leads to problems with vhost: vhost uses __getuser() to read the
vring's 16-bit avail.index field, and if it happens to observe a partial
update of the index, wrong descriptors will be used which will lead to a
breakdown of the virtio communication. A similar problem exists for
__putuser() which is used to write to the vring's used.index field.

The reason these functions use strb[t]/ldrb[t] is because strht/ldrht
instructions did not exist until ARMv6T2/ARMv7. So we should be easily
able to fix this on ARMv7. Also, since all ARMv6 processors also don't
actually use the unprivileged instructions anymore for uaccess (since
CONFIG_CPU_USE_DOMAINS is not used) we can easily fix them too.

Signed-off-by: Vincent Whitchurch <[email protected]>
Signed-off-by: Russell King <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
arch/arm/include/asm/uaccess.h | 18 ++++++++++++++++++
arch/arm/lib/getuser.S | 11 +++++++++++
arch/arm/lib/putuser.S | 20 ++++++++++----------
3 files changed, 39 insertions(+), 10 deletions(-)

diff --git a/arch/arm/include/asm/uaccess.h b/arch/arm/include/asm/uaccess.h
index 0f6c6b873bc5f..e05c31af48d1b 100644
--- a/arch/arm/include/asm/uaccess.h
+++ b/arch/arm/include/asm/uaccess.h
@@ -379,6 +379,13 @@ do { \
#define __get_user_asm_byte(x, addr, err) \
__get_user_asm(x, addr, err, ldrb)

+#if __LINUX_ARM_ARCH__ >= 6
+
+#define __get_user_asm_half(x, addr, err) \
+ __get_user_asm(x, addr, err, ldrh)
+
+#else
+
#ifndef __ARMEB__
#define __get_user_asm_half(x, __gu_addr, err) \
({ \
@@ -397,6 +404,8 @@ do { \
})
#endif

+#endif /* __LINUX_ARM_ARCH__ >= 6 */
+
#define __get_user_asm_word(x, addr, err) \
__get_user_asm(x, addr, err, ldr)
#endif
@@ -472,6 +481,13 @@ do { \
#define __put_user_asm_byte(x, __pu_addr, err) \
__put_user_asm(x, __pu_addr, err, strb)

+#if __LINUX_ARM_ARCH__ >= 6
+
+#define __put_user_asm_half(x, __pu_addr, err) \
+ __put_user_asm(x, __pu_addr, err, strh)
+
+#else
+
#ifndef __ARMEB__
#define __put_user_asm_half(x, __pu_addr, err) \
({ \
@@ -488,6 +504,8 @@ do { \
})
#endif

+#endif /* __LINUX_ARM_ARCH__ >= 6 */
+
#define __put_user_asm_word(x, __pu_addr, err) \
__put_user_asm(x, __pu_addr, err, str)

diff --git a/arch/arm/lib/getuser.S b/arch/arm/lib/getuser.S
index 746e7801dcdf7..b2e4bc3a635e2 100644
--- a/arch/arm/lib/getuser.S
+++ b/arch/arm/lib/getuser.S
@@ -42,6 +42,12 @@ _ASM_NOKPROBE(__get_user_1)

ENTRY(__get_user_2)
check_uaccess r0, 2, r1, r2, __get_user_bad
+#if __LINUX_ARM_ARCH__ >= 6
+
+2: TUSER(ldrh) r2, [r0]
+
+#else
+
#ifdef CONFIG_CPU_USE_DOMAINS
rb .req ip
2: ldrbt r2, [r0], #1
@@ -56,6 +62,9 @@ rb .req r0
#else
orr r2, rb, r2, lsl #8
#endif
+
+#endif /* __LINUX_ARM_ARCH__ >= 6 */
+
mov r0, #0
ret lr
ENDPROC(__get_user_2)
@@ -145,7 +154,9 @@ _ASM_NOKPROBE(__get_user_bad8)
.pushsection __ex_table, "a"
.long 1b, __get_user_bad
.long 2b, __get_user_bad
+#if __LINUX_ARM_ARCH__ < 6
.long 3b, __get_user_bad
+#endif
.long 4b, __get_user_bad
.long 5b, __get_user_bad8
.long 6b, __get_user_bad8
diff --git a/arch/arm/lib/putuser.S b/arch/arm/lib/putuser.S
index 38d660d3705f4..515eeaa9975c6 100644
--- a/arch/arm/lib/putuser.S
+++ b/arch/arm/lib/putuser.S
@@ -41,16 +41,13 @@ ENDPROC(__put_user_1)

ENTRY(__put_user_2)
check_uaccess r0, 2, r1, ip, __put_user_bad
- mov ip, r2, lsr #8
-#ifdef CONFIG_THUMB2_KERNEL
-#ifndef __ARMEB__
-2: TUSER(strb) r2, [r0]
-3: TUSER(strb) ip, [r0, #1]
+#if __LINUX_ARM_ARCH__ >= 6
+
+2: TUSER(strh) r2, [r0]
+
#else
-2: TUSER(strb) ip, [r0]
-3: TUSER(strb) r2, [r0, #1]
-#endif
-#else /* !CONFIG_THUMB2_KERNEL */
+
+ mov ip, r2, lsr #8
#ifndef __ARMEB__
2: TUSER(strb) r2, [r0], #1
3: TUSER(strb) ip, [r0]
@@ -58,7 +55,8 @@ ENTRY(__put_user_2)
2: TUSER(strb) ip, [r0], #1
3: TUSER(strb) r2, [r0]
#endif
-#endif /* CONFIG_THUMB2_KERNEL */
+
+#endif /* __LINUX_ARM_ARCH__ >= 6 */
mov r0, #0
ret lr
ENDPROC(__put_user_2)
@@ -91,7 +89,9 @@ ENDPROC(__put_user_bad)
.pushsection __ex_table, "a"
.long 1b, __put_user_bad
.long 2b, __put_user_bad
+#if __LINUX_ARM_ARCH__ < 6
.long 3b, __put_user_bad
+#endif
.long 4b, __put_user_bad
.long 5b, __put_user_bad
.long 6b, __put_user_bad
--
2.20.1



2019-12-20 04:45:06

by Shuah Khan

[permalink] [raw]
Subject: Re: [PATCH 4.9 000/199] 4.9.207-stable review

On 12/19/19 11:31 AM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.9.207 release.
> There are 199 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sat, 21 Dec 2019 18:24:44 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.207-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>

Compiled and booted on my test system. No dmesg regressions.

thanks,
-- Shuah

2019-12-20 05:35:16

by Naresh Kamboju

[permalink] [raw]
Subject: Re: [PATCH 4.9 000/199] 4.9.207-stable review

On Fri, 20 Dec 2019 at 00:13, Greg Kroah-Hartman
<[email protected]> wrote:
>
> This is the start of the stable review cycle for the 4.9.207 release.
> There are 199 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sat, 21 Dec 2019 18:24:44 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.207-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h

Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.

Summary
------------------------------------------------------------------------

kernel: 4.9.207-rc1
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git branch: linux-4.9.y
git commit: c87cf142499122d38d7dc3cb92c9e9072d646591
git describe: v4.9.206-200-gc87cf1424991
Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-4.9-oe/build/v4.9.206-200-gc87cf1424991


No regressions (compared to build v4.9.206)

No fixes (compared to build v4.9.206)


Ran 23314 total tests in the following environments and test suites.

Environments
--------------
- dragonboard-410c - arm64
- hi6220-hikey - arm64
- i386
- juno-r2 - arm64
- qemu_arm
- qemu_arm64
- qemu_i386
- qemu_x86_64
- x15 - arm
- x86_64

Test Suites
-----------
* build
* install-android-platform-tools-r2600
* linux-log-parser
* ltp-cap_bounds-tests
* ltp-commands-tests
* ltp-containers-tests
* ltp-cpuhotplug-tests
* ltp-cve-tests
* ltp-dio-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-hugetlb-tests
* ltp-io-tests
* ltp-ipc-tests
* ltp-math-tests
* ltp-mm-tests
* ltp-nptl-tests
* ltp-pty-tests
* ltp-sched-tests
* ltp-securebits-tests
* ltp-syscalls-tests
* perf
* spectre-meltdown-checker-test
* v4l2-compliance
* kselftest
* libhugetlbfs
* ltp-fs-tests
* network-basic-tests
* ltp-open-posix-tests
* prep-tmp-disk
* kvm-unit-tests
* kselftest-vsyscall-mode-native
* ssuite

--
Linaro LKFT
https://lkft.linaro.org

2019-12-20 10:31:22

by Jon Hunter

[permalink] [raw]
Subject: Re: [PATCH 4.9 000/199] 4.9.207-stable review


On 19/12/2019 18:31, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.9.207 release.
> There are 199 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sat, 21 Dec 2019 18:24:44 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.207-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
> -------------

All tests are passing for Tegra ...

Test results for stable-v4.9:
8 builds: 8 pass, 0 fail
16 boots: 16 pass, 0 fail
24 tests: 24 pass, 0 fail

Linux version: 4.9.207-rc1-gc87cf1424991
Boards tested: tegra124-jetson-tk1, tegra20-ventana,
tegra210-p2371-2180, tegra30-cardhu-a04

Cheers
Jon

--
nvpublic

2019-12-20 18:48:51

by Guenter Roeck

[permalink] [raw]
Subject: Re: [PATCH 4.9 000/199] 4.9.207-stable review

On Thu, Dec 19, 2019 at 07:31:22PM +0100, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.9.207 release.
> There are 199 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sat, 21 Dec 2019 18:24:44 +0000.
> Anything received after that time might be too late.
>

Build results:
total: 172 pass: 172 fail: 0
Qemu test results:
total: 359 pass: 359 fail: 0

Guenter