Commit Graph

796979 Commits

Author SHA1 Message Date
H. Peter Anvin (Intel)
d0ffb805b7 arch/alpha, termios: implement BOTHER, IBSHIFT and termios2
Alpha has had c_ispeed and c_ospeed, but still set speeds in c_cflags
using arbitrary flags. Because BOTHER is not defined, the general
Linux code doesn't allow setting arbitrary baud rates, and because
CBAUDEX == 0, we can have an array overrun of the baud_rate[] table in
drivers/tty/tty_baudrate.c if (c_cflags & CBAUD) == 037.

Resolve both problems by #defining BOTHER to 037 on Alpha.

However, userspace still needs to know if setting BOTHER is actually
safe given legacy kernels (does anyone actually care about that on
Alpha anymore?), so enable the TCGETS2/TCSETS*2 ioctls on Alpha, even
though they use the same structure. Define struct termios2 just for
compatibility; it is the exact same structure as struct termios. In a
future patchset, this will be cleaned up so the uapi headers are
usable from libc.

Signed-off-by: H. Peter Anvin (Intel) <hpa@zytor.com>
Cc: Jiri Slaby <jslaby@suse.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Richard Henderson <rth@twiddle.net>
Cc: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
Cc: Matt Turner <mattst88@gmail.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Kate Stewart <kstewart@linuxfoundation.org>
Cc: Philippe Ombredanne <pombredanne@nexb.com>
Cc: Eugene Syromiatnikov <esyr@redhat.com>
Cc: <linux-alpha@vger.kernel.org>
Cc: <linux-serial@vger.kernel.org>
Cc: Johan Hovold <johan@kernel.org>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-11-08 04:09:30 -08:00
Linus Torvalds
b00d209241 Small improvements to Compiler Attributes:
- Define asm_volatile_goto for non-gcc compilers
     From Nick Desaulniers
 
   - Improve the explanation of compiler_attributes.h
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEPjU5OPd5QIZ9jqqOGXyLc2htIW0FAlvkElAACgkQGXyLc2ht
 IW1QnhAA3RDKTCK2Y5GsTbZpA3NDItnjKXqCFW24YyHookcgnKrytnsZgFCUKZBA
 ys551crML+7HeFC2HdipORLuG+cXbjEl5IzblTAqOQQGmPa9g+kVWOiMiZhJWTVT
 gHrkwZKxSV3ndbsCHtnX9UEFwjOWFGfdvdhe33pcFZefAXd7y/fjLnlPBdPq5zh0
 BnHoLPRvuWFR+m2qOWbVTn/bq1JqpfTsn1fFC5aFFTruQRGBcPbpa1yoPiB6tVsJ
 OLdlScnS9J7zafGE65Ig+x57rYADV7c7Wm8kupwpo7Qvrmnhg4skUp7YGb/O4XiO
 sbH6N+Tn0PD3EzxxZGq1ZBq+ZirM2sfqYsWJmf+igfUU+fP/tmkl5JZtuIeW9c2J
 9GZcMfn5LZkraPGV6eZBTou7Kdz33vLmPXGPOc49BZGWSthjQ/8NYD5yjfZvK2xv
 TFV2DdQ+WQizejwdsuAUrxOHCUUeLJEjsAkQrHKhzPWRs448bkAVWTy3IN1Z+g1o
 spElAy8PIK8XFVyAa8o/SPhB0sghIHERA4p7Y+utKdF/D/sy13cDd27R/Dzf/282
 tu0tpb00glFYUHtDUpYKBFjYY76upcukPJ/QtQXDzI7ohRfULs7lHrxqFQBqzlKy
 mqDh5tmLNKdziQp5nttCAh3q/s8Bl591M/0aTKRYcY9yFp2Ezs0=
 =QZoP
 -----END PGP SIGNATURE-----

Merge tag 'compiler-attributes-for-linus-v4.20-rc2' of https://github.com/ojeda/linux

Pull compiler attribute fixlets from Miguel Ojeda:
 "Small improvements to Compiler Attributes:

   - Define asm_volatile_goto for non-gcc compilers (Nick Desaulniers)

   - Improve the explanation of compiler_attributes.h"

* tag 'compiler-attributes-for-linus-v4.20-rc2' of https://github.com/ojeda/linux:
  Compiler Attributes: improve explanation of header
  include/linux/compiler*.h: define asm_volatile_goto
2018-11-08 07:06:58 -05:00
Linus Torvalds
d50ffc585d MTD changes:
* Kill a VLA in sa1100
 
 SPI NOR changes:
 * Make sure ->addr_width is restored when SFDP parsing fails
 * Propate errors happening in cqspi_direct_read_execute()
 
 NAND changes:
 * Fix kernel-doc mismatch
 * Fix nanddev_neraseblocks() to return the correct value
 * Avoid selection of BCH_CONST_PARAMS when some users require
   dynamic BCH settings
 -----BEGIN PGP SIGNATURE-----
 
 iQJQBAABCgA6FiEEKmCqpbOU668PNA69Ze02AX4ItwAFAlvkDewcHGJvcmlzLmJy
 ZXppbGxvbkBib290bGluLmNvbQAKCRBl7TYBfgi3ACLTD/9DyyWKnH5xJAc/bjj0
 o2cka+L5xW/jUiUMUhNJqwcOCD11PiuXAxsHlJY6HhGXldl4hm8T6rFagmo0B897
 HaK2rn0guTERzJUk6EUKiX8wwenwuv6lpAfEGfcUPJe7EMEm5L7e5ETtwGUVEWBt
 rcRakt5m3VTIW7g7BzExxAalcNuAs80u8RVflsvS2TRLuFo63SnyI4JCo/7k/11a
 3itq3x4PNQJcsuKZzX0b7rWO3crB/McCtRStSF11ZCDD5X7KmHKrULBEhaDMfezS
 2SzRYe9l8ZtEE3INZny+73H6s6aIhPdTR5UMj9vIyZLDe58nsrzwBBs0jUwttogD
 QZkzRylGSkNKBfN/FIFkL3NcTY5ub5caVIT04JCdSc28k/HdprHfQC7VMj9o9iLU
 FcNsCMU6lmrL3WxudzSng4mZ89JCzoZyjOI5i5i9lM4Hxj+hTehKyIZllc9aT7PR
 l1H9zr+djscNXfQSHEljJbzcFuHVbViILobO3ASbOIsaUiv6RTTZ4kiyEeXoke0C
 Tg2TNCo3az5xZGhHrY9qvJXYFlNJrilU3K926gKAG3s0LVOCXK43D+N1Nm2q6ISu
 Bzzg6ND6Lzey2l4zhFGGqpLyA81bbhgyKs6xi5NCSU7NDAdAo2+fwgbkE95/SXP/
 w7oJq1FSia9PDgaBUeTPFdT7EA==
 =uVyq
 -----END PGP SIGNATURE-----

Merge tag 'mtd/fixes-for-4.20-rc2' of git://git.infradead.org/linux-mtd

Pull MTD fixes from Boris Brezillon:
 "MTD changes:
   - Kill a VLA in sa1100

  SPI NOR changes:
   - Make sure ->addr_width is restored when SFDP parsing fails
   - Propate errors happening in cqspi_direct_read_execute()

  NAND changes:
   - Fix kernel-doc mismatch
   - Fix nanddev_neraseblocks() to return the correct value
   - Avoid selection of BCH_CONST_PARAMS when some users require dynamic
     BCH settings"

* tag 'mtd/fixes-for-4.20-rc2' of git://git.infradead.org/linux-mtd:
  mtd: nand: Fix nanddev_pos_next_page() kernel-doc header
  mtd: sa1100: avoid VLA in sa1100_setup_mtd
  mtd: spi-nor: Reset nor->addr_width when SFDP parsing failed
  mtd: spi-nor: cadence-quadspi: Return error code in cqspi_direct_read_execute()
  mtd: nand: Fix nanddev_neraseblocks()
  mtd: nand: drop kernel-doc notation for a deleted function parameter
  mtd: docg3: don't set conflicting BCH_CONST_PARAMS option
2018-11-08 07:04:29 -05:00
H. Peter Anvin
991a251940 termios, tty/tty_baudrate.c: fix buffer overrun
On architectures with CBAUDEX == 0 (Alpha and PowerPC), the code in tty_baudrate.c does
not do any limit checking on the tty_baudrate[] array, and in fact a
buffer overrun is possible on both architectures. Add a limit check to
prevent that situation.

This will be followed by a much bigger cleanup/simplification patch.

Signed-off-by: H. Peter Anvin (Intel) <hpa@zytor.com>
Requested-by: Cc: Johan Hovold <johan@kernel.org>
Cc: Jiri Slaby <jslaby@suse.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Richard Henderson <rth@twiddle.net>
Cc: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
Cc: Matt Turner <mattst88@gmail.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Kate Stewart <kstewart@linuxfoundation.org>
Cc: Philippe Ombredanne <pombredanne@nexb.com>
Cc: Eugene Syromiatnikov <esyr@redhat.com>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-11-08 03:36:45 -08:00
Mikulas Patocka
943210ba80 vt: fix broken display when running aptitude
If you run aptitude on framebuffer console, the display is corrupted. The
corruption is caused by the commit d8ae7242. The patch adds "offset" to
"start" when calling scr_memsetw, but it forgets to do the same addition
on a subsequent call to do_update_region.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Fixes: d8ae724271 ("vt: preserve unicode values corresponding to screen characters")
Reviewed-by: Nicolas Pitre <nico@linaro.org>
Cc: stable@vger.kernel.org	# 4.19
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-11-08 03:36:40 -08:00
Miguel Ojeda
24efee412c Compiler Attributes: improve explanation of header
Explain better what "optional" attributes are, and avoid calling
them so to avoid confusion. Simply retain "Optional" as a word
to look for in the comments.

Moreover, add a couple sentences to explain a bit more the intention
and the documentation links.

Signed-off-by: Miguel Ojeda <miguel.ojeda.sandonis@gmail.com>
2018-11-08 11:33:52 +01:00
Eric W. Biederman
9c8e0a1b68 mount: Prevent MNT_DETACH from disconnecting locked mounts
Timothy Baldwin <timbaldwin@fastmail.co.uk> wrote:
> As per mount_namespaces(7) unprivileged users should not be able to look under mount points:
>
>   Mounts that come as a single unit from more privileged mount are locked
>   together and may not be separated in a less privileged mount namespace.
>
> However they can:
>
> 1. Create a mount namespace.
> 2. In the mount namespace open a file descriptor to the parent of a mount point.
> 3. Destroy the mount namespace.
> 4. Use the file descriptor to look under the mount point.
>
> I have reproduced this with Linux 4.16.18 and Linux 4.18-rc8.
>
> The setup:
>
> $ sudo sysctl kernel.unprivileged_userns_clone=1
> kernel.unprivileged_userns_clone = 1
> $ mkdir -p A/B/Secret
> $ sudo mount -t tmpfs hide A/B
>
>
> "Secret" is indeed hidden as expected:
>
> $ ls -lR A
> A:
> total 0
> drwxrwxrwt 2 root root 40 Feb 12 21:08 B
>
> A/B:
> total 0
>
>
> The attack revealing "Secret":
>
> $ unshare -Umr sh -c "exec unshare -m ls -lR /proc/self/fd/4/ 4<A"
> /proc/self/fd/4/:
> total 0
> drwxr-xr-x 3 root root 60 Feb 12 21:08 B
>
> /proc/self/fd/4/B:
> total 0
> drwxr-xr-x 2 root root 40 Feb 12 21:08 Secret
>
> /proc/self/fd/4/B/Secret:
> total 0

I tracked this down to put_mnt_ns running passing UMOUNT_SYNC and
disconnecting all of the mounts in a mount namespace.  Fix this by
factoring drop_mounts out of drop_collected_mounts and passing
0 instead of UMOUNT_SYNC.

There are two possible behavior differences that result from this.
- No longer setting UMOUNT_SYNC will no longer set MNT_SYNC_UMOUNT on
  the vfsmounts being unmounted.  This effects the lazy rcu walk by
  kicking the walk out of rcu mode and forcing it to be a non-lazy
  walk.
- No longer disconnecting locked mounts will keep some mounts around
  longer as they stay because the are locked to other mounts.

There are only two users of drop_collected mounts: audit_tree.c and
put_mnt_ns.

In audit_tree.c the mounts are private and there are no rcu lazy walks
only calls to iterate_mounts. So the changes should have no effect
except for a small timing effect as the connected mounts are disconnected.

In put_mnt_ns there may be references from process outside the mount
namespace to the mounts.  So the mounts remaining connected will
be the bug fix that is needed.  That rcu walks are allowed to continue
appears not to be a problem especially as the rcu walk change was about
an implementation detail not about semantics.

Cc: stable@vger.kernel.org
Fixes: 5ff9d8a65c ("vfs: Lock in place mounts from more privileged users")
Reported-by: Timothy Baldwin <timbaldwin@fastmail.co.uk>
Tested-by: Timothy Baldwin <timbaldwin@fastmail.co.uk>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
2018-11-08 01:05:32 -06:00
Thomas Richter
0bb2ae1b26 s390/perf: Change CPUM_CF return code in event init function
The function perf_init_event() creates a new event and
assignes it to a PMU. This a done in a loop over all existing
PMUs. For each listed PMU the event init function is called
and if this function does return any other error than -ENOENT,
the loop is terminated the creation of the event fails.

If the event is invalid, return -ENOENT to try other PMUs.

Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Reviewed-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-11-08 07:58:16 +01:00
Juri Lelli
e6a2d72c10 posix-cpu-timers: Remove useless call to check_dl_overrun()
check_dl_overrun() is used to send a SIGXCPU to users that asked to be
informed when a SCHED_DEADLINE runtime overruns occur.

The function is called by check_thread_timers() already, so the call in
check_process_timers() is redundant/wrong (even though harmless).

Remove it.

Fixes: 34be39305a ("sched/deadline: Implement "runtime overrun signal" support")
Signed-off-by: Juri Lelli <juri.lelli@redhat.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Daniel Bristot de Oliveira <bristot@redhat.com>
Reviewed-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Cc: linux-rt-users@vger.kernel.org
Cc: mtk.manpages@gmail.com
Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Luca Abeni <luca.abeni@santannapisa.it>
Cc: Claudio Scordino <claudio@evidence.eu.com>
Link: https://lkml.kernel.org/r/20181107111032.32291-1-juri.lelli@redhat.com
2018-11-08 07:43:35 +01:00
Michał Mirosław
b25ddb00bc qlcnic: remove assumption that vlan_tci != 0
VLAN.TCI == 0 is perfectly valid (802.1p), so allow it to be accelerated.

Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-11-07 22:37:55 -08:00
Michał Mirosław
e84b47941e ibmvnic: fix accelerated VLAN handling
Don't request tag insertion when it isn't present in outgoing skb.

Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-11-07 22:36:21 -08:00
Eric W. Biederman
df7342b240 mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts
Jonathan Calmels from NVIDIA reported that he's able to bypass the
mount visibility security check in place in the Linux kernel by using
a combination of the unbindable property along with the private mount
propagation option to allow a unprivileged user to see a path which
was purposefully hidden by the root user.

Reproducer:
  # Hide a path to all users using a tmpfs
  root@castiana:~# mount -t tmpfs tmpfs /sys/devices/
  root@castiana:~#

  # As an unprivileged user, unshare user namespace and mount namespace
  stgraber@castiana:~$ unshare -U -m -r

  # Confirm the path is still not accessible
  root@castiana:~# ls /sys/devices/

  # Make /sys recursively unbindable and private
  root@castiana:~# mount --make-runbindable /sys
  root@castiana:~# mount --make-private /sys

  # Recursively bind-mount the rest of /sys over to /mnnt
  root@castiana:~# mount --rbind /sys/ /mnt

  # Access our hidden /sys/device as an unprivileged user
  root@castiana:~# ls /mnt/devices/
  breakpoint cpu cstate_core cstate_pkg i915 intel_pt isa kprobe
  LNXSYSTM:00 msr pci0000:00 platform pnp0 power software system
  tracepoint uncore_arb uncore_cbox_0 uncore_cbox_1 uprobe virtual

Solve this by teaching copy_tree to fail if a mount turns out to be
both unbindable and locked.

Cc: stable@vger.kernel.org
Fixes: 5ff9d8a65c ("vfs: Lock in place mounts from more privileged users")
Reported-by: Jonathan Calmels <jcalmels@nvidia.com>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
2018-11-08 00:30:30 -06:00
Eric W. Biederman
25d202ed82 mount: Retest MNT_LOCKED in do_umount
It was recently pointed out that the one instance of testing MNT_LOCKED
outside of the namespace_sem is in ksys_umount.

Fix that by adding a test inside of do_umount with namespace_sem and
the mount_lock held.  As it helps to fail fails the existing test is
maintained with an additional comment pointing out that it may be racy
because the locks are not held.

Cc: stable@vger.kernel.org
Reported-by: Al Viro <viro@ZenIV.linux.org.uk>
Fixes: 5ff9d8a65c ("vfs: Lock in place mounts from more privileged users")
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
2018-11-08 00:14:21 -06:00
David S. Miller
b1870a6d3f Merge branch 'FDDI-defza-Fix-a-bunch-of-small-issues'
Maciej W. Rozycki says:

====================
FDDI: defza: Fix a bunch of small issues

 Here is a bunch of small fixes addressing issues that I missed in my
final round of testing.  None of these affect run-time behaviour.  One was
actually found by the kbuild bot, which turned out to be more pedantic
than my compiler.  See individual change descriptions for details.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2018-11-07 21:53:31 -08:00
Maciej W. Rozycki
8f5365ebf7 FDDI: defza: Make the driver version string constant
The driver version string is obviously not meant to be changed at run
time, so mark it `const'.

Signed-off-by: Maciej W. Rozycki <macro@linux-mips.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-11-07 21:53:31 -08:00
Maciej W. Rozycki
04453b6b24 FDDI: defza: Move SMT Tx data buffer declaration next to its skb
Move the temporary data buffer used when tapping into the SMT Tx queue
from the outer function level into the conditional block it's actually
used in and its containing skb is also declared, making the structure of
code better.

Signed-off-by: Maciej W. Rozycki <macro@linux-mips.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-11-07 21:53:31 -08:00
Maciej W. Rozycki
5f5fae37db FDDI: defza: Add missing comment closing
Fix:

drivers/net/fddi/defza.h:238:1: warning: "/*" within comment [-Wcomment]

by adding a missing comment closing.

Signed-off-by: Maciej W. Rozycki <macro@linux-mips.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-11-07 21:53:30 -08:00
Maciej W. Rozycki
96ed82cc1f FDDI: defza: Fix SPDX annotation
The SPDX annotation for this driver does not match the license text,
which specifies GNU GPL 2 or later.  Make the two match by correcting
the SPDX tag.

Signed-off-by: Maciej W. Rozycki <macro@linux-mips.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-11-07 21:53:30 -08:00
Jann Horn
d2f007dbe7 userns: also map extents in the reverse map to kernel IDs
The current logic first clones the extent array and sorts both copies, then
maps the lower IDs of the forward mapping into the lower namespace, but
doesn't map the lower IDs of the reverse mapping.

This means that code in a nested user namespace with >5 extents will see
incorrect IDs. It also breaks some access checks, like
inode_owner_or_capable() and privileged_wrt_inode_uidgid(), so a process
can incorrectly appear to be capable relative to an inode.

To fix it, we have to make sure that the "lower_first" members of extents
in both arrays are translated; and we have to make sure that the reverse
map is sorted *after* the translation (since otherwise the translation can
break the sorting).

This is CVE-2018-18955.

Fixes: 6397fac491 ("userns: bump idmap limits to 340")
Cc: stable@vger.kernel.org
Signed-off-by: Jann Horn <jannh@google.com>
Tested-by: Eric W. Biederman <ebiederm@xmission.com>
Reviewed-by: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
2018-11-07 23:51:16 -06:00
Vasily Averin
de59fae004 ext4: fix buffer leak in __ext4_read_dirblock() on error path
Fixes: dc6982ff4d ("ext4: refactor code to read directory blocks ...")
Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org # 3.9
2018-11-07 22:36:23 -05:00
David S. Miller
69e362985f Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/net-queue
Jeff Kirsher says:

====================
Intel Wired LAN Driver Updates 2018-11-07

This series contains fixes to igb, i40e and ice drivers.

Anirudh fixes an issue during rebuild of the ice driver, where we need
to set the carrier state, as well as start or stop the queues all based
on the link status.  Removed functions that were duplicating current
functionality in the VSI rebuild/replay framework.

Dave fixes a potential resource collision during the remove path, so add
a check to see if we are in the middle of a reset.  Fixed the remove
path to ensure we call netif_napi_del() to free vectors before we set
vsi->netdev to NULL.

Akeem fixes an issue when the receive or transmit pause parameter is
set, results in link loss on the interface.  Fixed the spelling of
"Enabling" in error message.

Victor fixes potential memory leak by also freeing the related VSI
contexts in the unload path.

Md Fahad fixes a flag during port VLAN insertion, which was not being
set properly.

Brett fixes a transmit timeout during stress due to the hardware tail
and software tail were incorrectly out of sync.

Miroslav Lichvar fixes the igb PHC timecounter update interval to be
sure the timecounter is updated in time.

Chinh fixes the req_speeds variable to be u16 instead of u8 so that it
can handle all the link speeds.

Jake fixes i40e to add back the missing feature flags, which was causing
IP-in-IP offloads to be reported as not supported.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2018-11-07 17:08:51 -08:00
Lyude Paul
63237f8748 drm/amd/amdgpu/dm: Fix dm_dp_create_fake_mst_encoder()
[why]
Removing connector reusage from DM to match the rest of the tree ended
up revealing an issue that was surprisingly subtle. The original amdgpu
code for DC that was submitted appears to have left a chunk in
dm_dp_create_fake_mst_encoder() that tries to find a "master encoder",
the likes of which isn't actually used or stored anywhere. It does so at
the wrong time as well by trying to access parts of the drm_connector
from the encoder init before it's actually been initialized. This
results in a NULL pointer deref on MST hotplugs:

[  160.696613] BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
[  160.697234] PGD 0 P4D 0
[  160.697814] Oops: 0010 [#1] SMP PTI
[  160.698430] CPU: 2 PID: 64 Comm: kworker/2:1 Kdump: loaded Tainted: G           O      4.19.0Lyude-Test+ #2
[  160.699020] Hardware name: HP HP ZBook 15 G4/8275, BIOS P70 Ver. 01.22 05/17/2018
[  160.699672] Workqueue: events_long drm_dp_mst_link_probe_work [drm_kms_helper]
[  160.700322] RIP: 0010:          (null)
[  160.700920] Code: Bad RIP value.
[  160.701541] RSP: 0018:ffffc9000029fc78 EFLAGS: 00010206
[  160.702183] RAX: 0000000000000000 RBX: ffff8804440ed468 RCX: ffff8804440e9158
[  160.702778] RDX: 0000000000000000 RSI: ffff8804556c5700 RDI: ffff8804440ed000
[  160.703408] RBP: ffff880458e21800 R08: 0000000000000002 R09: 000000005fca0a25
[  160.704002] R10: ffff88045a077a3d R11: ffff88045a077a3c R12: ffff8804440ed000
[  160.704614] R13: ffff880458e21800 R14: ffff8804440e9000 R15: ffff8804440e9000
[  160.705260] FS:  0000000000000000(0000) GS:ffff88045f280000(0000) knlGS:0000000000000000
[  160.705854] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  160.706478] CR2: ffffffffffffffd6 CR3: 000000000200a001 CR4: 00000000003606e0
[  160.707124] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  160.707724] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  160.708372] Call Trace:
[  160.708998]  ? dm_dp_add_mst_connector+0xed/0x1d0 [amdgpu]
[  160.709625]  ? drm_dp_add_port+0x2fa/0x470 [drm_kms_helper]
[  160.710284]  ? wake_up_q+0x54/0x70
[  160.710877]  ? __mutex_unlock_slowpath.isra.18+0xb3/0x110
[  160.711512]  ? drm_dp_dpcd_access+0xe7/0x110 [drm_kms_helper]
[  160.712161]  ? drm_dp_send_link_address+0x155/0x1e0 [drm_kms_helper]
[  160.712762]  ? drm_dp_check_and_send_link_address+0xa3/0xd0 [drm_kms_helper]
[  160.713408]  ? drm_dp_mst_link_probe_work+0x4b/0x80 [drm_kms_helper]
[  160.714013]  ? process_one_work+0x1a1/0x3a0
[  160.714667]  ? worker_thread+0x30/0x380
[  160.715326]  ? wq_update_unbound_numa+0x10/0x10
[  160.715939]  ? kthread+0x112/0x130
[  160.716591]  ? kthread_create_worker_on_cpu+0x70/0x70
[  160.717262]  ? ret_from_fork+0x35/0x40
[  160.717886] Modules linked in: amdgpu(O) vfat fat snd_hda_codec_generic joydev i915 chash gpu_sched ttm i2c_algo_bit drm_kms_helper snd_hda_codec_hdmi hp_wmi syscopyarea iTCO_wdt sysfillrect sparse_keymap sysimgblt fb_sys_fops snd_hda_intel usbhid wmi_bmof drm snd_hda_codec btusb snd_hda_core intel_rapl btrtl x86_pkg_temp_thermal btbcm btintel coretemp snd_pcm crc32_pclmul bluetooth psmouse snd_timer snd pcspkr i2c_i801 mei_me i2c_core soundcore mei tpm_tis wmi tpm_tis_core hp_accel ecdh_generic lis3lv02d tpm video rfkill acpi_pad input_polldev hp_wireless pcc_cpufreq crc32c_intel serio_raw tg3 xhci_pci xhci_hcd [last unloaded: amdgpu]
[  160.720141] CR2: 0000000000000000

Somehow the connector reusage DM was using for MST connectors managed to
paper over this issue entirely; hence why this was never caught until
now.

[how]
Since this code isn't used anywhere and seems useless anyway, we can
just drop it entirely. This appears to fix the issue on my HP ZBook with
an AMD WX4150.

Signed-off-by: Lyude Paul <lyude@redhat.com>
Reviewed-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2018-11-07 18:21:05 -05:00
Jerry (Fangzhi) Zuo
0e6613e46f drm/amd/display: Drop reusing drm connector for MST
[why]
It is not safe to keep existing connector while entire topology
has been removed. Could lead potential impact to uapi.
Entirely unregister all the connectors on the topology,
and use a new set of connectors when the topology is plugged back
on.

[How]
Remove the drm connector entirely each time when the
corresponding MST topology is gone.
When hotunplug a connector (e.g., DP2)
1. Remove connector from userspace.
2. Drop it's reference.
When hotplug back on:
1. Detect new topology, and create new connectors.
2. Notify userspace with sysfs hotplug event.
3. Reprobe new connectors, and reassign CRTC from old (e.g., DP2)
to new (e.g., DP3) connector.

Signed-off-by: Jerry (Fangzhi) Zuo <Jerry.Zuo@amd.com>
Reviewed-by: Harry Wentland <harry.wentland@amd.com>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2018-11-07 18:20:56 -05:00
Jerry (Fangzhi) Zuo
8be17ac95f drm/amd/display: Cleanup MST non-atomic code workaround
[why]
It is not correct to touch aconnector within atomic_check.

[How]
It was added as workaround before, and no longer needed.

Signed-off-by: Jerry (Fangzhi) Zuo <Jerry.Zuo@amd.com>
Reviewed-by: Harry Wentland <harry.wentland@amd.com>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2018-11-07 18:20:49 -05:00
Evan Quan
108110a3ff drm/amd/powerplay: always use fast UCLK switching when UCLK DPM enabled
With UCLK DPM enabled, slow switching is not supported any more.

Signed-off-by: Evan Quan <evan.quan@amd.com>
Reviewed-by: Feifei Xu <Feifei.Xu@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2018-11-07 18:20:40 -05:00
Evan Quan
3c7eda0b65 drm/amd/powerplay: set a default fclk/gfxclk ratio
Otherwise big gap between these two clocks may causes
some hangs.

Signed-off-by: Evan Quan <evan.quan@amd.com>
Reviewed-by: Feifei Xu <Feifei.Xu@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2018-11-07 18:20:32 -05:00
Keith Busch
f3587d76da block: Clear kernel memory before copying to user
If the kernel allocates a bounce buffer for user read data, this memory
needs to be cleared before copying it to the user, otherwise it may leak
kernel memory to user space.

Laurence Oberman <loberman@redhat.com>
Signed-off-by: Keith Busch <keith.busch@intel.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2018-11-07 15:41:31 -07:00
Geert Uytterhoeven
e31d36b0a4 MAINTAINERS: Fix remaining pointers to obsolete libata.git
libata.git no longer exists.  Replace the remaining pointers to it by
pointers to the block tree, which is where all libata development
happens now.

Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2018-11-07 15:27:26 -07:00
Jens Axboe
6961cd4d0f ubd: fix missing lock around request issue
We need to hold the device lock (and disable interrupts) while
writing new commands, or we could be interrupted while that
is happening and read invalid requests in the completion path.

Fixes: 4e6da0fe80 ("um: Convert ubd driver to blk-mq")
Tested-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2018-11-07 14:34:05 -07:00
Geert Uytterhoeven
406e7f986b Documentation: ABI: led-trigger-pattern: Fix typos
- Spelling s/brigntess/brightness/,
  - Double "use".

Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Acked-by: Pavel Machek <pavel@ucw.cz>
Signed-off-by: Jacek Anaszewski <jacek.anaszewski@gmail.com>
2018-11-07 21:43:46 +01:00
Baolin Wang
3a40cfe8ba leds: trigger: Fix sleeping function called from invalid context
We will meet below issue due to mutex_lock() is called in interrupt context.
The mutex lock is used to protect the pattern trigger data, but before changing
new pattern trigger data (pattern values or repeat value) by users, we always
cancel the timer firstly to clear previous patterns' performance. That means
there is no race in pattern_trig_timer_function(), so we can drop the mutex
lock in pattern_trig_timer_function() to avoid this issue.

Moreover we can move the timer cancelling into mutex protection, since there
is no deadlock risk if we remove the mutex lock in pattern_trig_timer_function().

BUG: sleeping function called from invalid context at kernel/locking/mutex.c:254
in_atomic(): 1, irqs_disabled(): 0, pid: 0, name: swapper/1
CPU: 1 PID: 0 Comm: swapper/1 Not tainted
4.20.0-rc1-koelsch-00841-ga338c8181013c1a9 #171
Hardware name: Generic R-Car Gen2 (Flattened Device Tree)
[<c020f19c>] (unwind_backtrace) from [<c020aecc>] (show_stack+0x10/0x14)
[<c020aecc>] (show_stack) from [<c07affb8>] (dump_stack+0x7c/0x9c)
[<c07affb8>] (dump_stack) from [<c02417d4>] (___might_sleep+0xf4/0x158)
[<c02417d4>] (___might_sleep) from [<c07c92c4>] (mutex_lock+0x18/0x60)
[<c07c92c4>] (mutex_lock) from [<c067b28c>] (pattern_trig_timer_function+0x1c/0x11c)
[<c067b28c>] (pattern_trig_timer_function) from [<c027f6fc>] (call_timer_fn+0x1c/0x90)
[<c027f6fc>] (call_timer_fn) from [<c027f944>] (expire_timers+0x94/0xa4)
[<c027f944>] (expire_timers) from [<c027fc98>] (run_timer_softirq+0x108/0x15c)
[<c027fc98>] (run_timer_softirq) from [<c02021cc>] (__do_softirq+0x1d4/0x258)
[<c02021cc>] (__do_softirq) from [<c0224d24>] (irq_exit+0x64/0xc4)
[<c0224d24>] (irq_exit) from [<c0268dd0>] (__handle_domain_irq+0x80/0xb4)
[<c0268dd0>] (__handle_domain_irq) from [<c045e1b0>] (gic_handle_irq+0x58/0x90)
[<c045e1b0>] (gic_handle_irq) from [<c02019f8>] (__irq_svc+0x58/0x74)
Exception stack(0xeb483f60 to 0xeb483fa8)
3f60: 00000000 00000000 eb9afaa0 c0217e80 00000000 ffffe000 00000000 c0e06408
3f80: 00000002 c0e0647c c0c6a5f0 00000000 c0e04900 eb483fb0 c0207ea8 c0207e98
3fa0: 60020013 ffffffff
[<c02019f8>] (__irq_svc) from [<c0207e98>] (arch_cpu_idle+0x1c/0x38)
[<c0207e98>] (arch_cpu_idle) from [<c0247ca8>] (do_idle+0x138/0x268)
[<c0247ca8>] (do_idle) from [<c0248050>] (cpu_startup_entry+0x18/0x1c)
[<c0248050>] (cpu_startup_entry) from [<402022ec>] (0x402022ec)

Fixes: 5fd752b6b3 ("leds: core: Introduce LED pattern trigger")
Signed-off-by: Baolin Wang <baolin.wang@linaro.org>
Reported-by: Geert Uytterhoeven <geert+renesas@glider.be>
Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Jacek Anaszewski <jacek.anaszewski@gmail.com>
2018-11-07 21:43:25 +01:00
Johannes Thumshirn
df376b2ed5 block: respect virtual boundary mask in bvecs
With drivers that are settting a virtual boundary constrain, we are
seeing a lot of bio splitting and smaller I/Os being submitted to the
driver.

This happens because the bio gap detection code does not account cases
where PAGE_SIZE - 1 is bigger than queue_virt_boundary() and thus will
split the bio unnecessarily.

Cc: Jan Kara <jack@suse.cz>
Cc: Bart Van Assche <bvanassche@acm.org>
Cc: Ming Lei <ming.lei@redhat.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Johannes Thumshirn <jthumshirn@suse.de>
Acked-by: Keith Busch <keith.busch@intel.com>
Reviewed-by: Ming Lei <ming.lei@redhat.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2018-11-07 13:04:22 -07:00
Linus Torvalds
85758777c2 hwmon fixes for v4.20-rc2
- Remove bogus __init annotations in ibmpowernv driver
 - Fix double-free in error handling of __hwmon_device_register()
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABAgAGBQJb4enqAAoJEMsfJm/On5mBcX4QAJntHN4e0jXYqe6kY0lq5DBT
 pvL43WoqkpjM5//vOzyLXBAvM2nlZvisCBPGVnB9TD0kPZ8cdG00SEuwrOXyt8Pr
 RoTbiPXV4PY3t2Ksmm8KPmbkysbAJMKsNsfGCQqy3HK+8OrbHjgsrBvdrDF9bCDO
 d4tPttVidZuTx4X7+kSCkpwUqTslOFw1kcOs4meGSPi1lHphwRXwI2+pC/fgz+IQ
 voqG5v20fJEZ6AM9rVEn/qRQubNGmBxenMyo5LuPjwJzTLo6xtVgdE6zGtxiKeJE
 NIgJxKvwFAdVsHOqMU1O+THsi7l1HefMK0K/1vS1X49UOnwE/CcOLznxRfdd9yqm
 dxaqqnTrUQ453HCjnlT79FSQPINAWDMsyu7ztsHQ2864rfkCZgpiEPDtvt15rT/K
 f5QutzRYOO2bma+tSumprlAU3TXnXuTohbFBxis+384N1VuBtxwJ63dY3cG9Ed6v
 xCOqxndB/y8epHErujFBSX1NO5NE8bU3W9eW7CITrqrxclUuG9F5RkKDbyFYyRnk
 HNR7RB2SBF5M4XdZQwjH+IGR9j288ChUGKbzEJNDVFbTfdD29Sw6MbSS4dmkNepL
 9KKdBWEu/Q2py5Z0SXpY+kAwIl3MIixZ0Uofqt43R9KGdHZaBRxuKrcd8Kppsu7A
 4OZxBtHSF9Z9MAWvDTiv
 =MwAW
 -----END PGP SIGNATURE-----

Merge tag 'hwmon-for-v4.20-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging

Pull hwmon fixes from Guenter Roeck:

 - Remove bogus __init annotations in ibmpowernv driver

 - Fix double-free in error handling of __hwmon_device_register()

* tag 'hwmon-for-v4.20-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
  hwmon: (ibmpowernv) Remove bogus __init annotations
  hwmon: (core) Fix double-free in __hwmon_device_register()
2018-11-07 11:39:07 -08:00
Omar Sandoval
d6fd0ae25c Btrfs: fix missing delayed iputs on unmount
There's a race between close_ctree() and cleaner_kthread().
close_ctree() sets btrfs_fs_closing(), and the cleaner stops when it
sees it set, but this is racy; the cleaner might have already checked
the bit and could be cleaning stuff. In particular, if it deletes unused
block groups, it will create delayed iputs for the free space cache
inodes. As of "btrfs: don't run delayed_iputs in commit", we're no
longer running delayed iputs after a commit. Therefore, if the cleaner
creates more delayed iputs after delayed iputs are run in
btrfs_commit_super(), we will leak inodes on unmount and get a busy
inode crash from the VFS.

Fix it by parking the cleaner before we actually close anything. Then,
any remaining delayed iputs will always be handled in
btrfs_commit_super(). This also ensures that the commit in close_ctree()
is really the last commit, so we can get rid of the commit in
cleaner_kthread().

The fstest/generic/475 followed by 476 can trigger a crash that
manifests as a slab corruption caused by accessing the freed kthread
structure by a wake up function. Sample trace:

[ 5657.077612] BUG: unable to handle kernel NULL pointer dereference at 00000000000000cc
[ 5657.079432] PGD 1c57a067 P4D 1c57a067 PUD da10067 PMD 0
[ 5657.080661] Oops: 0000 [#1] PREEMPT SMP
[ 5657.081592] CPU: 1 PID: 5157 Comm: fsstress Tainted: G        W         4.19.0-rc8-default+ #323
[ 5657.083703] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.11.2-0-gf9626cc-prebuilt.qemu-project.org 04/01/2014
[ 5657.086577] RIP: 0010:shrink_page_list+0x2f9/0xe90
[ 5657.091937] RSP: 0018:ffffb5c745c8f728 EFLAGS: 00010287
[ 5657.092953] RAX: 0000000000000074 RBX: ffffb5c745c8f830 RCX: 0000000000000000
[ 5657.094590] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff9a8747fdf3d0
[ 5657.095987] RBP: ffffb5c745c8f9e0 R08: 0000000000000000 R09: 0000000000000000
[ 5657.097159] R10: ffff9a8747fdf5e8 R11: 0000000000000000 R12: ffffb5c745c8f788
[ 5657.098513] R13: ffff9a877f6ff2c0 R14: ffff9a877f6ff2c8 R15: dead000000000200
[ 5657.099689] FS:  00007f948d853b80(0000) GS:ffff9a877d600000(0000) knlGS:0000000000000000
[ 5657.101032] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 5657.101953] CR2: 00000000000000cc CR3: 00000000684bd000 CR4: 00000000000006e0
[ 5657.103159] Call Trace:
[ 5657.103776]  shrink_inactive_list+0x194/0x410
[ 5657.104671]  shrink_node_memcg.constprop.84+0x39a/0x6a0
[ 5657.105750]  shrink_node+0x62/0x1c0
[ 5657.106529]  try_to_free_pages+0x1a4/0x500
[ 5657.107408]  __alloc_pages_slowpath+0x2c9/0xb20
[ 5657.108418]  __alloc_pages_nodemask+0x268/0x2b0
[ 5657.109348]  kmalloc_large_node+0x37/0x90
[ 5657.110205]  __kmalloc_node+0x236/0x310
[ 5657.111014]  kvmalloc_node+0x3e/0x70

Fixes: 30928e9baa ("btrfs: don't run delayed_iputs in commit")
Signed-off-by: Omar Sandoval <osandov@fb.com>
Reviewed-by: David Sterba <dsterba@suse.com>
[ add trace ]
Signed-off-by: David Sterba <dsterba@suse.com>
2018-11-07 20:17:45 +01:00
Jacob Keller
d5596fd467 i40e: enable NETIF_F_NTUPLE and NETIF_F_HW_TC at driver load
The assignment of the feature flag NETIF_F_NTUPLE and NETIF_F_HW_TC
occurs prior to the initial setup of the local hw_features variable.

This means the features are set as user-changeable, but are not set in
the currently active feature list. This results in the features being
disabled at the driver's initial load.

Move the assignment after the initial assignment of hw_features, and
assign to the local variable. This ensures that NETIF_F_NTUPLE and
NETIF_F_HW_TC are marked as user-changeable, and also enables them by
default when the driver loads.

Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
2018-11-07 10:32:15 -08:00
Jacob Keller
ba766b8b99 i40e: restore NETIF_F_GSO_IPXIP[46] to netdev features
Since commit bacd75cfac ("i40e/i40evf: Add capability exchange for
outer checksum", 2017-04-06) the i40e driver has not reported support
for IP-in-IP offloads. This likely occurred due to a bad rebase, as the
commit extracts hw_enc_features into its own variable. As part of this
change, it dropped the NETIF_F_FSO_IPXIP flags from the
netdev->hw_enc_features. This was unfortunately not caught during code
review.

Fix this by adding back the missing feature flags.

For reference, NETIF_F_GSO_IPXIP4 was added in commit 7e13318daa
("net: define gso types for IPx over IPv4 and IPv6", 2016-05-20),
replacing NETIF_F_GSO_IPIP and NETIF_F_GSO_SIT.

NETIF_F_GSO_IPXIP6 was added in commit bf2d1df395 ("intel: Add support
for IPv6 IP-in-IP offload", 2016-05-20).

Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
2018-11-07 09:45:42 -08:00
Chinh T Cao
ffe498237b ice: Change req_speeds to be u16
Since the req_speeds field in struct ice_link_status is a u8,
req_speeds & ICE_AQ_LINK_SPEED_40GB always returns 0. This was caught
by a coverity scan.

Fix this by changing req_speeds to be u16.

Reported-by: Bruce Allan <bruce.w.allan@intel.com>
Signed-off-by: Chinh T Cao <chinh.t.cao@intel.com>
Signed-off-by: Anirudh Venkataramanan <anirudh.venkataramanan@intel.com>
Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
2018-11-07 09:37:28 -08:00
Linus Torvalds
e09d51adfb ARM: SoC fixes
A few more fixes that have come in, and one revert of a previous fix.
 
 I was a bit too trigger happy to enable PREEMPT on multi_v7_defconfig,
 and it ended up regressing at least BeagleBone XM boards. While we get
 that debugged for next merge window, let's disable it again.
 
 Beyond that:
 
  - Stratix change to fix multicast filtering
  - Minor DT fixes for Renesas and i.MX
  - Ethernet fix for a Renesas board (switching main interfaces)
  - Ethernet phy regulator fix for i.MX6SX
 -----BEGIN PGP SIGNATURE-----
 
 iQJDBAABCAAtFiEElf+HevZ4QCAJmMQ+jBrnPN6EHHcFAlvjEnwPHG9sb2ZAbGl4
 b20ubmV0AAoJEIwa5zzehBx3zjYQAJB8E//hINASE0TQvEnk6YfN5a/ruA8Z+FAx
 qtxHu9x0JPLtiRig/icnZeTm7Apn7qkMBPgwTuHCkYGeFmrxNmaG/9SZCSoXMUbT
 mPIjbQ9Z0WKaSa4dvwqBsVpoYEy/f94WhlFcnpuSTpXhFwny9N96VDCYOEaBeRwa
 PAUY7WEiuIp3B9TEmMk8UX7fVhGMsTwNw+SppxxHpnybNVIH2IYerYEaiQZ5+ndP
 zKInvfCtjq5CoYcUnwQr7oRKrkkkx/QwUF9zgYOwMXaF3ZhqqGEQmEjNGKAOO6r9
 ppjK0tlFU7HqFmFswW4Ik0mPvWLphR82qCc1Dxq/9kOyp3xTowJwNXxqoL9usjrn
 9YHZodSV6K+9BgRjBuwuYI2ueLHbW2v2LPUntUhYF1Ru0vd3yi6EMe3MB7ya/MWG
 jmabmYRzIYO/i2rmyifi6iZ7Ur76LpD9xD5iO3NBz6Ua3KTYEAXOghv3jucl+vtn
 ewPKl6F5UULGgbehL6SicoyFqNt4PBb8ZlN5cahmVLENDa3RcOM9acJutSliyp6L
 4tofHg2hyx0d1FCu5BePcLDnQjkFEXR1Q9eY1J7K/C58bIwlKir7FjHWQpc8sXOr
 bYgnY1csXuMKKx8btyDgNKY/2Kc9npj0noawIdghpGIKCav889HRb9bKVYiwPlbH
 RxEIXcsW
 =smBp
 -----END PGP SIGNATURE-----

Merge tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc

Pull ARM SoC fixes from Olof Johansson:
 "A few more fixes that have come in, and one revert of a previous fix.

  I was a bit too trigger happy to enable PREEMPT on multi_v7_defconfig,
  and it ended up regressing at least BeagleBone XM boards. While we get
  that debugged for next merge window, let's disable it again.

  Beyond that:

   - Stratix change to fix multicast filtering

   - Minor DT fixes for Renesas and i.MX

   - Ethernet fix for a Renesas board (switching main interfaces)

   - Ethernet phy regulator fix for i.MX6SX"

* tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
  arm64: dts: stratix10: fix multicast filtering
  ARM: defconfig: Disable PREEMPT again on  multi_v7
  arm64: dts: renesas: condor: switch from EtherAVB to GEther
  dt-bindings: arm: Fix RZ/G2E part number
  arm64: dts: renesas: r8a7795: add missing dma-names on hscif2
  ARM: dts: imx6sx-sdb: Fix enet phy regulator
  ARM: dts: fsl: Fix improperly quoted stdout-path values
  ARM: dts: imx6sll: fix typo for fsl,imx6sll-i2c node
2018-11-07 09:13:34 -08:00
Linus Torvalds
ecb4d529f1 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid
Pull HID fixes from Jiri Kosina:

 - hid.git is moving towards group maintainership (where group is myself
   and Benjamin Tissoires), therefore this pull request updates
   MAINTAINERS accordingly

 - fix for hid-asus config dependency from Arnd Bergmann

 - two device-specific quirks for i2c-hid from Julian Sax and Kai-Heng
   Feng

 - other few small assorted fixes

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid:
  HID: fix up .raw_event() documentation
  HID: asus: fix build warning wiht CONFIG_ASUS_WMI disabled
  HID: i2c-hid: add Direkt-Tek DTLAPY133-1 to descriptor override
  HID: moving to group maintainership model
  HID: alps: allow incoming reports when only the trackstick is opened
  Revert "HID: add NOGET quirk for Eaton Ellipse MAX UPS"
  HID: i2c-hid: Add a small delay after sleep command for Raydium touchpanel
  HID: hiddev: fix potential Spectre v1
2018-11-07 09:05:58 -08:00
Vasily Averin
53692ec074 ext4: fix buffer leak in ext4_expand_extra_isize_ea() on error path
Fixes: de05ca8526 ("ext4: move call to ext4_error() into ...")
Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org # 4.17
2018-11-07 11:14:35 -05:00
Vasily Averin
6bdc9977fc ext4: fix buffer leak in ext4_xattr_move_to_block() on error path
Fixes: 3f2571c1f9 ("ext4: factor out xattr moving")
Fixes: 6dd4ee7cab ("ext4: Expand extra_inodes space per ...")
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org # 2.6.23
2018-11-07 11:10:21 -05:00
Olof Johansson
a89f84a56e ARM: dts: stratix10: fix multicast filtering
-----BEGIN PGP SIGNATURE-----
 
 iQJIBAABCgAyFiEEoHhMeiyk5VmwVMwNGZQEC4GjKPQFAlvjC0gUHGRpbmd1eWVu
 QGtlcm5lbC5vcmcACgkQGZQEC4GjKPS0Xw//RyxgxowjoKqabX0DbVsxdeaMRwPt
 Pql/7oLrVBdbbcEkQZQA7Vo8Ryt7GPTV0v6mepWm3Fm8cIMxfU0wxoB49HIAr8cH
 KZlmn57WlMMCB4o1H7l9lxyPWuAcmEoPTUs71ZatfdWv8sBYEkT6Sc/TwkvLqTMV
 DJtFD8XBtZrXePjTwCKSPaAJ96yqcdLJ5znVmD7a3h3oyVLdW6X5kVNWWGtKHBim
 z/KV46wBsJbyXTsjoCLU3S474dfjUsI34cr6EbbLDu9OFiAJFGcDwDyxtiRX75Hw
 GodJ+TfaEO4EAKX5fl8y1hgbO+KQpbcvWhEPoowbO+TLrJjBsUO4nLN7uhN6QFW+
 LNg1kWLVsA7xqVcF4XeUZ1YBc56lJeWQ4QCTYfl3ilaJkBzzEQlqx0nFuTMqAFfo
 ME9r9ti1lCc/9uSi6jrh1dOix+8Sl2vtcGMStjQ9TMUrOX4h4GY6zHS8csSW90ys
 OKO1xy7f+CcKSQx2GBxoAeVRNmwqzlhwxw4DjOt3/PaqTJqZMtNza51XGatuoaht
 eCXH1LG2NtVKo0o/TOdnNrugF6Tc01kMfWXcKkpShiDFUd805Pq1EZW0SMG1+8OS
 kYVUvldV4cqhUntVryx/b4RFpu9tp6OCITInjyDWs0Jcflr687GxJbglHTAnuFMd
 hzjrPkKspkYzeNY=
 =7zP6
 -----END PGP SIGNATURE-----

Merge tag 'stratix10_dts_fix_for_v4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux into fixes

ARM: dts: stratix10: fix multicast filtering

On Stratix 10, the EMAC has 256 hash buckets for multicast filtering. This
needs to be specified in DTS, otherwise the stmmac driver defaults to 64
buckets and initializes the filter incorrectly. As a result, e.g. valid
IPv6 multicast traffic ends up being dropped.

* tag 'stratix10_dts_fix_for_v4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux:
  arm64: dts: stratix10: fix multicast filtering

Signed-off-by: Olof Johansson <olof@lixom.net>
2018-11-07 08:09:50 -08:00
Vasily Averin
45ae932d24 ext4: release bs.bh before re-using in ext4_xattr_block_find()
bs.bh was taken in previous ext4_xattr_block_find() call,
it should be released before re-using

Fixes: 7e01c8e542 ("ext3/4: fix uninitialized bs in ...")
Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org # 2.6.26
2018-11-07 11:07:01 -05:00
Vasily Averin
ecaaf40847 ext4: fix buffer leak in ext4_xattr_get_block() on error path
Fixes: dec214d00e ("ext4: xattr inode deduplication")
Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org # 4.13
2018-11-07 11:01:33 -05:00
Olof Johansson
9be66f55b1 Renesas ARM Based SoC Fixes for v4.20
* R-Car V3H (r8a77980) based Condor board
   - Switch from EtherAVB to GEther to match offical boards
 
 * RZ/G2E (ra8774c0) SoC: correct documentation of part number
 
 * R-Car H3 (r8a7795) SoC: reinstate all DMA channels on HSCIF2
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEE4nzZofWswv9L/nKF189kaWo3T74FAlvho1MACgkQ189kaWo3
 T74ANBAAkjEzeIuF29/TFOAFs+EB9izdNSdj5WFv2Ec7jVxhB4knYf+eJ+U1nSUA
 gU8xRQBlZMULNxkFJIQYxjoE7yDQbNcUu3aiwuVripYTWxako95EeS0JrsRGdvia
 VEJYYqwx9ySNYHAFIesRfW5a8A9AF/WHRACvDZlX216hviy1sXNDyd8/pgbeMQGK
 ilRaUGkrdlqrQFbfneK3OWQiCkvmpaVV/t41EVILDQPe7PAPhDAYeYhzMOkKUAP6
 N0pBJHAppFh0MvkD6RWVIFCoHPNYssd+abE3QWP26NED4mP3RVLH9xHggJuqwDX7
 ocJf53Rh1HeZf8CXRuxx/vHdlSBfiUvYkvxgQCTbJbgj/u8hEgLOqHYoREw9NDR5
 B0uE1cP+KRZiiFlqNcsBWgNUasfSlDciQ5Z9HrpO/VaKnVkkv3DfskaqjxC+XkEt
 TSVlKVYKBR2QmNxbsf7ofr3SnQ7NuY5I854fpqba76xEDog39BTIf14zzrpJhi+H
 isAaT5KjqhwwdLdFeMSHkPrm03tqv0fpO8U65tGvS9lHw+gSGSsonb7T8ZimVLv5
 sDXO1j102N/e4vMbKSnRz02S9+oj9cBlIW3C1DohAEuUH8+xqnJ7BGKz0CY0zcOi
 sgWWlhUNswYspuM74PLPyY7Jm5S4BE1vvKqH7i+ZrUJd4tS7dSs=
 =D2ob
 -----END PGP SIGNATURE-----

Merge tag 'renesas-fixes-for-v4.20' of https://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas into fixes

Renesas ARM Based SoC Fixes for v4.20

* R-Car V3H (r8a77980) based Condor board
  - Switch from EtherAVB to GEther to match offical boards

* RZ/G2E (ra8774c0) SoC: correct documentation of part number

* R-Car H3 (r8a7795) SoC: reinstate all DMA channels on HSCIF2

* tag 'renesas-fixes-for-v4.20' of https://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas:
  arm64: dts: renesas: condor: switch from EtherAVB to GEther
  dt-bindings: arm: Fix RZ/G2E part number
  arm64: dts: renesas: r8a7795: add missing dma-names on hscif2

Signed-off-by: Olof Johansson <olof@lixom.net>
2018-11-07 07:59:33 -08:00
Vasily Averin
af18e35bfd ext4: fix possible leak of s_journal_flag_rwsem in error path
Fixes: c8585c6fca ("ext4: fix races between changing inode journal ...")
Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org # 4.7
2018-11-07 10:56:28 -05:00
Borislav Petkov
f26621e60b resource/docs: Complete kernel-doc style function documentation
Add the missing kernel-doc style function parameters documentation.

Signed-off-by: Borislav Petkov <bp@suse.de>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: akpm@linux-foundation.org
Cc: linux-tip-commits@vger.kernel.org
Cc: rdunlap@infradead.org
Fixes: b69c2e20f6 ("resource: Clean it up a bit")
Link: http://lkml.kernel.org/r/20181105093307.GA12445@zn.tnic
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2018-11-07 16:47:47 +01:00
Theodore Ts'o
9e463084cd ext4: fix possible leak of sbi->s_group_desc_leak in error path
Fixes: bfe0a5f47a ("ext4: add more mount time checks of the superblock")
Reported-by: Vasily Averin <vvs@virtuozzo.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org # 4.18
2018-11-07 10:32:53 -05:00
Joonas Lahtinen
214782da8f Merge tag 'gvt-fixes-2018-11-07' of https://github.com/intel/gvt-linux into drm-intel-fixes
gvt-fixes-2018-11-07

- Fix invalidate of old ggtt entry (Hang)
- Fix partial ggtt entry update in any order (Hang)
- Fix one mask setting for chicken reg (Xinyun)
- Fix eDP warning in guest (Longhe)

Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
From: Zhenyu Wang <zhenyuw@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20181107023137.GO25194@zhen-hp.sh.intel.com
2018-11-07 15:34:10 +02:00
Dave Airlie
d08f44b18c Three regressions
- Revert frame counter support
   . This patch fixes a issue which doesn't work extension and clone
     mode because some CRTC devices don't provide frame counter value
     properly.
 - Fix lack of fbdev on Rinato and trats boards.
   . This patch considers for connector to be registered by DSI after
     DRM device is registered, and also it makes fbdev initializaion
     to be done even if no connector at the moment.
 - Check for dsi->panel object correctly
   . This patch fixes checking for dsi->panel. of_drm_find_panel
     function returns panel object or error value so error value
     should be checked using IS_ERR macro.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABAgAGBQJb4ALpAAoJEFc4NIkMQxK47E0P/1z6vSaUkj7zdo62QZMMnkMO
 0udPS16+qfJAw3VgyUNiIxagVzfXZRiG8EvcAAvJGb+Id94kH0FvUmE3BmRBPOps
 AKIii6Y8GIl4bvRYHSK2k08lFVHTyTay42UTMBAfljzEYVUFw1Xk7woZ3XuDVkjM
 9bFHIsYcyj+AL7dwerxdjsRIkdrdwZsdMq6VSxDVkxJ1GmPzrlVEQXIlnk9dG0eG
 YZeVmGT9DrK3c1+A2c7NVGdziTRr8A9iHQMxsjNlZ/FtIFDar2vxpPtTTa22bNcX
 uD407rTUSoD7U5+l+5s9tO4sCYtlZtAdUqWA4xMIbzMs1FTjLjzy/im5khqwvJ3G
 B4fZKnkMCP5YHjzpPHr4XaO52W1GjLmvW2GVMff+ILHBjpTGpWEoVb6+bJRM+KfY
 H0K18IccN0SpMlXKFtB0U2Il1KGXJdHHIRfr2W66sXOWOD3B2ZiDyalY6dfGso7w
 pIJfeIFSswVC15I+QkJiNAqHvuEJfJVERSJSb6jT1l/C35+zRWP1V+MmAdrcwXnu
 0pWrqUd8JWEFJL7bYAdqJb5wwrgfvf9FkXpMKIO1WkDeayAH0VgUM4mQMEiCp4l+
 Fzsp00DhWw54PU+JFsGTixLS9/ZLM22LnmxXwz6IT6GqIUDcXITaLZa3jWYAF/pc
 RBnlF2hZQ6KZ8dM3lKHP
 =iKNH
 -----END PGP SIGNATURE-----

Merge tag 'exynos-drm-fixes-for-v4.20-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos into drm-fixes

Three regressions
- Revert frame counter support
  . This patch fixes a issue which doesn't work extension and clone
    mode because some CRTC devices don't provide frame counter value
    properly.
- Fix lack of fbdev on Rinato and trats boards.
  . This patch considers for connector to be registered by DSI after
    DRM device is registered, and also it makes fbdev initializaion
    to be done even if no connector at the moment.
- Check for dsi->panel object correctly
  . This patch fixes checking for dsi->panel. of_drm_find_panel
    function returns panel object or error value so error value
    should be checked using IS_ERR macro.

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Inki Dae <inki.dae@samsung.com>
Link: https://patchwork.freedesktop.org/patch/msgid/1541407733-7632-1-git-send-email-inki.dae@samsung.com
2018-11-07 09:33:00 +10:00