Commit Graph

983394 Commits

Author SHA1 Message Date
John Ogness
89ccf18f03 printk: fix kmsg_dump_get_buffer length calulations
kmsg_dump_get_buffer() uses @syslog to determine if the syslog
prefix should be written to the buffer. However, when calculating
the maximum number of records that can fit into the buffer, it
always counts the bytes from the syslog prefix.

Use @syslog when calculating the maximum number of records that can
fit into the buffer.

Fixes: e2ae715d66 ("kmsg - kmsg_dump() use iterator to receive log buffer content")
Signed-off-by: John Ogness <john.ogness@linutronix.de>
Reviewed-by: Petr Mladek <pmladek@suse.com>
Acked-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Signed-off-by: Petr Mladek <pmladek@suse.com>
Link: https://lore.kernel.org/r/20210113164413.1599-1-john.ogness@linutronix.de
2021-01-15 11:32:52 +01:00
John Ogness
668af87f99 printk: ringbuffer: fix line counting
Counting text lines in a record simply involves counting the number
of newline characters (+1). However, it is searching the full data
block for newline characters, even though the text data can be (and
often is) a subset of that area. Since the extra area in the data
block was never initialized, the result is that extra newlines may
be seen and counted.

Restrict newline searching to the text data length.

Fixes: b6cf8b3f33 ("printk: add lockless ringbuffer")
Signed-off-by: John Ogness <john.ogness@linutronix.de>
Reviewed-by: Petr Mladek <pmladek@suse.com>
Acked-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Signed-off-by: Petr Mladek <pmladek@suse.com>
Link: https://lore.kernel.org/r/20210113144234.6545-1-john.ogness@linutronix.de
2021-01-15 11:30:03 +01:00
Kai-Chuan Hsieh
f84d3a1ec3 ALSA: hda: Add Cometlake-R PCI ID
Add HD Audio Device PCI ID for the Intel Cometlake-R platform

Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
Signed-off-by: Kai-Chuan Hsieh <kaichuan.hsieh@canonical.com>
Link: https://lore.kernel.org/r/20210115031515.13100-1-kaichuan.hsieh@canonical.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2021-01-15 11:15:53 +01:00
Mark Brown
3a57a643a8 arm64: selftests: Fix spelling of 'Mismatch'
The SVE and FPSIMD stress tests have a spelling mistake in the output, fix
it.

Signed-off-by: Mark Brown <broonie@kernel.org>
Link: https://lore.kernel.org/r/20210108183144.673-1-broonie@kernel.org
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
2021-01-15 10:05:27 +00:00
Mark Rutland
b6d8878d24 arm64: syscall: include prototype for EL0 SVC functions
The kbuild test robot reports that when building with W=1, GCC will warn
for a couple of missing prototypes in syscall.c:

|  arch/arm64/kernel/syscall.c:157:6: warning: no previous prototype for 'do_el0_svc' [-Wmissing-prototypes]
|    157 | void do_el0_svc(struct pt_regs *regs)
|        |      ^~~~~~~~~~
|  arch/arm64/kernel/syscall.c:164:6: warning: no previous prototype for 'do_el0_svc_compat' [-Wmissing-prototypes]
|    164 | void do_el0_svc_compat(struct pt_regs *regs)
|        |      ^~~~~~~~~~~~~~~~~

While this isn't a functional problem, as a general policy we should
include the prototype for functions wherever possible to catch any
accidental divergence between the prototype and implementation. Here we
can easily include <asm/exception.h>, so let's do so.

While there are a number of warnings elsewhere and some warnings enabled
under W=1 are of questionable benefit, this change helps to make the
code more robust as it evolved and reduces the noise somewhat, so it
seems worthwhile.

Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Reported-by: kernel test robot <lkp@intel.com>
Cc: Will Deacon <will@kernel.org>
Link: https://lore.kernel.org/r/202101141046.n8iPO3mw-lkp@intel.com
Link: https://lore.kernel.org/r/20210114124812.17754-1-mark.rutland@arm.com
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
2021-01-15 10:05:27 +00:00
Will Deacon
dca5244d2f compiler.h: Raise minimum version of GCC to 5.1 for arm64
GCC versions >= 4.9 and < 5.1 have been shown to emit memory references
beyond the stack pointer, resulting in memory corruption if an interrupt
is taken after the stack pointer has been adjusted but before the
reference has been executed. This leads to subtle, infrequent data
corruption such as the EXT4 problems reported by Russell King at the
link below.

Life is too short for buggy compilers, so raise the minimum GCC version
required by arm64 to 5.1.

Reported-by: Russell King <linux@armlinux.org.uk>
Suggested-by: Arnd Bergmann <arnd@kernel.org>
Signed-off-by: Will Deacon <will@kernel.org>
Tested-by: Nathan Chancellor <natechancellor@gmail.com>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
Acked-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: <stable@vger.kernel.org>
Cc: Theodore Ts'o <tytso@mit.edu>
Cc: Florian Weimer <fweimer@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Nick Desaulniers <ndesaulniers@google.com>
Link: https://lore.kernel.org/r/20210105154726.GD1551@shell.armlinux.org.uk
Link: https://lore.kernel.org/r/20210112224832.10980-1-will@kernel.org
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
2021-01-15 10:04:49 +00:00
Takashi Iwai
217bfbb8b0 ALSA: seq: oss: Fix missing error check in snd_seq_oss_synth_make_info()
snd_seq_oss_synth_make_info() didn't check the error code from
snd_seq_oss_midi_make_info(), and this leads to the call of strlcpy()
with the uninitialized string as the source, which may lead to the
access over the limit.

Add the proper error check for avoiding the failure.

Reported-by: syzbot+e42504ff21cff05a595f@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210115093428.15882-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2021-01-15 10:35:17 +01:00
Greg Kroah-Hartman
a1bfb0ccf9 First set of IIO and counter fixes for the 5.11 cycle.
Counter fixes
 
 ti,eqep
 - Remove floor interface as the device always wraps to 0.
 
 IIO
 
 adi,ad5504
 - Fix inverted power state control.
 bosch,bma255
 - Fix a difference in part naming between dt-binding doc and the driver.
 melexis,mlx90632
 - Add a delay after reset command.
 semtech,sx9310
 - Off by one error.
 - Fix an issue due to need to skip a value in a power of 2 series.
 st,st_sensors
 - Fix a possible infinite loop if data read is not define or reading it fails.
 ti,am335x
 - Remove a left over iio_kfifo_free after managed allocation conversion.
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCAAvFiEEbilms4eEBlKRJoGxVIU0mcT0FogFAmAAwYcRHGppYzIzQGtl
 cm5lbC5vcmcACgkQVIU0mcT0Fogmzw/+ISxGbk8nRSN6B/h5ldc8Cpz897H2TW0L
 7xIygn9Kw5HlITP2VdyBgkU8Otz1/W0UJnUTp2SJqLZ126wYURn08ZeEHSwdsGCx
 Im9di/QF3aBeb5c0D/dd31EVjWwfpvM2zjbHnzQxxn/5tncUCaNBpkBxguSCwh80
 +e1MB7h+tCKnYnJ3htiServgjnMHwumN3bTyv5IRJiuYkdAgB3Cg8l00dIHZLP1a
 hF5bV+1BiHBGiZYiFPVPFl0HuoLviudAqzFzGjHv7V4POGpBlpq5vjN0WjhhrXAs
 Q60Nh3lgZtP/rHifCL9p8ty1yWvohQ91rcy5bauNuSqOj2IE7yLDsovU4blKhNNx
 iallCMJB3OIPeGRqQsd8wym5lcVI5puY+8y9y1qXX6SHzR2JVa2ZCIvzC1tICNra
 9qDnFrdZYPdodZkAFu6lAEZ3tFOzx/wMMVgOPvIXiZniVYtCIOtow5jzBgF6LKS6
 PpOH/EmNJFhS1uqIiX2m5oYyolh8la4Y4Ly062T9EIAXt/noShu2pySgDI7Eu8ro
 PtovWE0sVJ1p6MSOHlVfRNdvmQe2pAFxHJPj7TIveHNzQbKYGdjwa8NGVSjOlLDg
 3XZe98HzTWtoORYF6s3fQN+MEEDFDteG4ysB78RU1pO3NeXqUCow2UyOVmALId15
 M5rueMyrodQ=
 =61oM
 -----END PGP SIGNATURE-----

Merge tag 'iio-fixes-for-5.11a' of https://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio into staging-linus

Jonathan writes:

First set of IIO and counter fixes for the 5.11 cycle.

Counter fixes

ti,eqep
- Remove floor interface as the device always wraps to 0.

IIO

adi,ad5504
- Fix inverted power state control.
bosch,bma255
- Fix a difference in part naming between dt-binding doc and the driver.
melexis,mlx90632
- Add a delay after reset command.
semtech,sx9310
- Off by one error.
- Fix an issue due to need to skip a value in a power of 2 series.
st,st_sensors
- Fix a possible infinite loop if data read is not define or reading it fails.
ti,am335x
- Remove a left over iio_kfifo_free after managed allocation conversion.

* tag 'iio-fixes-for-5.11a' of https://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio:
  iio: sx9310: Fix semtech,avg-pos-strength setting when > 16
  iio: common: st_sensors: fix possible infinite loop in st_sensors_irq_thread
  iio: ad5504: Fix setting power-down state
  counter:ti-eqep: remove floor
  drivers: iio: temperature: Add delay after the addressed reset command in mlx90632.c
  iio: adc: ti_am335x_adc: remove omitted iio_kfifo_free()
  dt-bindings: iio: accel: bma255: Fix bmc150/bmi055 compatible
  iio: sx9310: Off by one in sx9310_read_thresh()
2021-01-15 08:16:35 +01:00
Dave Airlie
584265dfec Merge branch '04.01-ampere-lite' of git://github.com/skeggsb/linux into topic/nouveau-ampere-modeset
This adds support for basic modeseting on the nvidia ampere chipsets. This code should all
be contained to just those and have no effect on current hardware.

Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Ben Skeggs <skeggsb@gmail.com>
Link: https://patchwork.freedesktop.org/patch/msgid/CACAvsv5LmMP+HbDUQBf_dy1-0eS9fA32k8HWo4y5X4-7rsw-yw@mail.gmail.com
2021-01-15 14:48:18 +10:00
Linus Torvalds
5ee8805788 drm fixes for 5.11-rc4
dma-buf:
 - Fix a memory leak in CMAV heap
 
 core:
 - Fix format check for legacy pageflips
 
 ttm:
 - Pass correct address to dma_mapping_error()
 - Use mutex in pool shrinker
 
 i915:
 - Allow the sysadmin to override security mitigations
 - Restore clear-residual mitigations for ivb/byt
 - Limit VFE threads based on GT
 - GVT: fix vfio edid and full display detection
 - Fix DSI DSC power refcounting
 - Fix LPT CPU mode backlight takeover
 - Disable RPM wakeref assertions during driver shutdown
 - Fix DSI sequence sleeps
 
 amdgpu:
 - Update repo location in MAINTAINERS
 - Add some new renoir PCI IDs
 - Revert CRC UAPI changes
 - Revert OLED display fix which cases clocking problems for some systems
 - Misc vangogh fixes
 - GFX fix for sienna cichlid
 - DCN1.0 fix for pipe split
 - Fix incorrect PSP command
 
 amdkfd:
 - Fix possible out of bounds read in vcrat creation
 
 nouveau:
 - irq handling fix
 - expansion ROM fix
 - hw init dpcd disable
 - aux semaphore owner field fix
 - vram heap sizing fix
 - notifier at 0 is valid fix
 -----BEGIN PGP SIGNATURE-----
 
 iQIcBAABAgAGBQJgAQ/EAAoJEAx081l5xIa+KyIP/3xSMMMzzkYFii8yPeKjKavx
 kpXzy0eMG5a/t0LGicfJbQxujE94BW2Y7MZPsKKyfs/PqPWCFM9NrmQK5/Dqg+Z8
 R4lXC4+B/ha8Xhl+jK6UW5HLWRN24nB9uH1/oN0xV1WrhJDffdc85qh0Qm9AAaav
 zfpXYu5s+37EMuw5u9jE51OWk9mmgwrpYjXH/SQ2eiSJ4UHeX8CE1b3WgRT8z7cP
 hep43/6GQ+sczcL1Ekg1guaV/2q9dy+QliP5Z6rv/E9lzeoRQgb8O+Lf95f8yR3t
 NSzXllS3Y5bUXzIRkNioTmfydmO6oFxY/1TBkfa08TSqveHJSGCtBb12WkDxSNO5
 NRBXwHd+WBV6+8dX9Dmm3k/5C9LK9Y/rUI+yEwdE9Soh/frMOWtXA4PLn8p1XofA
 rfLu5Y5mBR+c/r8rABefUSNaJZ+tl6vfpWSZ1WNyUi8gL+Rknpq5p+5OpX1TQSI+
 BBPEKpLFyD0mr1de/SdW41lofFyIgUajVnClg26ynMOU6bkGOq+UWduw+cpDvUCS
 2g2YYi+YXkCnZGwLg9NaXSM5N2JCJARRynncehuAl0F1frigPzy3F+Ty0mmlBa1O
 WuYpbTsNJjDVP6kPNDv0/CYv/dnPb4PJczTq4SDwAtSkD3/SaAKh0jYK/NqGL9sM
 Nk1psZTXjcbD/rzR/kX9
 =hTNV
 -----END PGP SIGNATURE-----

Merge tag 'drm-fixes-2021-01-15' of git://anongit.freedesktop.org/drm/drm

Pull drm fixes from Dave Airlie:
 "Regular fixes for rc4, a bunch of fixes across i915, amdgpu and
  nouveau here, along with a couple of TTM fixes, and dma-buf and one
  core pageflip/modifier interaction fix.

  One notable i915 fix is a HSW GT1 regression fix that has been
  outstanding for quite a while. (Thanks to Matt Turner for kicking
  Intel into getting it fixed).

  dma-buf:
   - Fix a memory leak in CMAV heap

  core:
   - Fix format check for legacy pageflips

  ttm:
   - Pass correct address to dma_mapping_error()
   - Use mutex in pool shrinker

  i915:
   - Allow the sysadmin to override security mitigations
   - Restore clear-residual mitigations for ivb/byt
   - Limit VFE threads based on GT
   - GVT: fix vfio edid and full display detection
   - Fix DSI DSC power refcounting
   - Fix LPT CPU mode backlight takeover
   - Disable RPM wakeref assertions during driver shutdown
   - Fix DSI sequence sleeps

  amdgpu:
   - Update repo location in MAINTAINERS
   - Add some new renoir PCI IDs
   - Revert CRC UAPI changes
   - Revert OLED display fix which cases clocking problems for some systems
   - Misc vangogh fixes
   - GFX fix for sienna cichlid
   - DCN1.0 fix for pipe split
   - Fix incorrect PSP command

  amdkfd:
   - Fix possible out of bounds read in vcrat creation

  nouveau:
   - irq handling fix
   - expansion ROM fix
   - hw init dpcd disable
   - aux semaphore owner field fix
   - vram heap sizing fix
   - notifier at 0 is valid fix"

* tag 'drm-fixes-2021-01-15' of git://anongit.freedesktop.org/drm/drm: (37 commits)
  drm/nouveau/kms/nv50-: fix case where notifier buffer is at offset 0
  drm/nouveau/mmu: fix vram heap sizing
  drm/nouveau/i2c/gm200: increase width of aux semaphore owner fields
  drm/nouveau/i2c/gk110-: disable hw-initiated dpcd reads
  drm/nouveau/i2c/gk110: split out from i2c/gk104
  drm/nouveau/privring: ack interrupts the same way as RM
  drm/nouveau/bios: fix issue shadowing expansion ROMs
  drm/amd/display: Fix to be able to stop crc calculation
  Revert "drm/amd/display: Expose new CRC window property"
  Revert "drm/amdgpu/disply: fix documentation warnings in display manager"
  Revert "drm/amd/display: Fix unused variable warning"
  drm/amdgpu: set power brake sequence
  drm/amdgpu: add new device id for Renior
  drm/amdgpu: add green_sardine device id (v2)
  drm/amdgpu: fix vram type and bandwidth error for DDR5 and DDR4
  drm/amdgpu/gfx10: add updated GOLDEN_TSC_COUNT_UPPER/LOWER register offsets for VGH
  drm/amdkfd: Fix out-of-bounds read in kdf_create_vcrat_image_cpu()
  Revert "drm/amd/display: Fixed Intermittent blue screen on OLED panel"
  drm/amd/display: disable dcn10 pipe split by default
  drm/amd/display: Add a missing DCN3.01 API mapping
  ...
2021-01-14 20:10:06 -08:00
Linus Torvalds
cdaed11031 Update bootconf scripts for tracing_on option
The tracing_on option is supported by bootconfig entries, but the scripts to
 convert from ftrace to a bootconfig and back were not updated.
 -----BEGIN PGP SIGNATURE-----
 
 iIoEABYIADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCYAEA4RQccm9zdGVkdEBn
 b29kbWlzLm9yZwAKCRAp5XQQmuv6ql1IAQDRIhEtOER8pCWC/MgRtX9sXgmHPtyr
 OmGCbhlNNRohRQD+KKhtTORIUwqSQqItyuT/YWp7nEh25lLUC3a1LBD4Ugw=
 =YZ7S
 -----END PGP SIGNATURE-----

Merge tag 'trace-v5.11-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace

Pull bootconfig fix from Steven Rostedt:
 "Update bootconf scripts for tracing_on option

  The tracing_on option is supported by bootconfig entries, but the
  scripts to convert from ftrace to a bootconfig and back were not
  updated"

* tag 'trace-v5.11-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
  tools/bootconfig: Add tracing_on support to helper scripts
2021-01-14 20:06:29 -08:00
Dave Airlie
c8f6364f35 Merge branch '04.00-ampere-lite-fixes' of git://github.com/skeggsb/linux into drm-fixes
As requested, here's a tree with the non-Ampere-specific fixes split
out, as most of them are potentially relevant to already-supported
GPUs.

- irq handling fix
- expansion ROM fix
- hw init dpcd disable
- aux semaphore owner field fix
- vram heap sizing fix
- notifier at 0 is valid fix

Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Ben Skeggs <skeggsb@gmail.com>
Link: https://patchwork.freedesktop.org/patch/msgid/CACAvsv4P90mcF_ByAh+ghz+ZVD2N2bPbD7xHYYArE1kYrvsGcQ@mail.gmail.com
2021-01-15 13:26:44 +10:00
Brian King
764907293e scsi: ibmvfc: Set default timeout to avoid crash during migration
While testing live partition mobility, we have observed occasional crashes
of the Linux partition. What we've seen is that during the live migration,
for specific configurations with large amounts of memory, slow network
links, and workloads that are changing memory a lot, the partition can end
up being suspended for 30 seconds or longer. This resulted in the following
scenario:

CPU 0                          CPU 1
-------------------------------  ----------------------------------
scsi_queue_rq                    migration_store
 -> blk_mq_start_request          -> rtas_ibm_suspend_me
  -> blk_add_timer                 -> on_each_cpu(rtas_percpu_suspend_me
              _______________________________________V
             |
             V
    -> IPI from CPU 1
     -> rtas_percpu_suspend_me
                                     -> __rtas_suspend_last_cpu

-- Linux partition suspended for > 30 seconds --
                                      -> for_each_online_cpu(cpu)
                                           plpar_hcall_norets(H_PROD
 -> scsi_dispatch_cmd
                                      -> scsi_times_out
                                       -> scsi_abort_command
                                        -> queue_delayed_work
  -> ibmvfc_queuecommand_lck
   -> ibmvfc_send_event
    -> ibmvfc_send_crq
     - returns H_CLOSED
   <- returns SCSI_MLQUEUE_HOST_BUSY
-> __blk_mq_requeue_request

                                      -> scmd_eh_abort_handler
                                       -> scsi_try_to_abort_cmd
                                         - returns SUCCESS
                                       -> scsi_queue_insert

Normally, the SCMD_STATE_COMPLETE bit would protect against the command
completion and the timeout, but that doesn't work here, since we don't
check that at all in the SCSI_MLQUEUE_HOST_BUSY path.

In this case we end up calling scsi_queue_insert on a request that has
already been queued, or possibly even freed, and we crash.

The patch below simply increases the default I/O timeout to avoid this race
condition. This is also the timeout value that nearly all IBM SAN storage
recommends setting as the default value.

Link: https://lore.kernel.org/r/1610463998-19791-1-git-send-email-brking@linux.vnet.ibm.com
Signed-off-by: Brian King <brking@linux.vnet.ibm.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2021-01-14 22:02:59 -05:00
Shin'ichiro Kawasaki
780e138468 scsi: target: tcmu: Fix use-after-free of se_cmd->priv
Commit a35129024e ("scsi: target: tcmu: Use priv pointer in se_cmd")
modified tcmu_free_cmd() to set NULL to priv pointer in se_cmd. However,
se_cmd can be already freed by work queue triggered in
target_complete_cmd(). This caused BUG KASAN use-after-free [1].

To fix the bug, do not touch priv pointer in tcmu_free_cmd(). Instead, set
NULL to priv pointer before target_complete_cmd() calls. Also, to avoid
unnecessary priv pointer change in tcmu_queue_cmd(), modify priv pointer in
the function only when tcmu_free_cmd() is not called.

[1]
BUG: KASAN: use-after-free in tcmu_handle_completions+0x1172/0x1770 [target_core_user]
Write of size 8 at addr ffff88814cf79a40 by task cmdproc-uio0/14842

CPU: 2 PID: 14842 Comm: cmdproc-uio0 Not tainted 5.11.0-rc2 #1
Hardware name: Supermicro Super Server/X10SRL-F, BIOS 3.2 11/22/2019
Call Trace:
 dump_stack+0x9a/0xcc
 ? tcmu_handle_completions+0x1172/0x1770 [target_core_user]
 print_address_description.constprop.0+0x18/0x130
 ? tcmu_handle_completions+0x1172/0x1770 [target_core_user]
 ? tcmu_handle_completions+0x1172/0x1770 [target_core_user]
 kasan_report.cold+0x7f/0x10e
 ? tcmu_handle_completions+0x1172/0x1770 [target_core_user]
 tcmu_handle_completions+0x1172/0x1770 [target_core_user]
 ? queue_tmr_ring+0x5d0/0x5d0 [target_core_user]
 tcmu_irqcontrol+0x28/0x60 [target_core_user]
 uio_write+0x155/0x230
 ? uio_vma_fault+0x460/0x460
 ? security_file_permission+0x4f/0x440
 vfs_write+0x1ce/0x860
 ksys_write+0xe9/0x1b0
 ? __ia32_sys_read+0xb0/0xb0
 ? syscall_enter_from_user_mode+0x27/0x70
 ? trace_hardirqs_on+0x1c/0x110
 do_syscall_64+0x33/0x40
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7fcf8b61905f
Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 b9 fc ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 0c fd ff ff 48
RSP: 002b:00007fcf7b3e6c30 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fcf8b61905f
RDX: 0000000000000004 RSI: 00007fcf7b3e6c78 RDI: 000000000000000c
RBP: 00007fcf7b3e6c80 R08: 0000000000000000 R09: 00007fcf7b3e6aa8
R10: 000000000b01c000 R11: 0000000000000293 R12: 00007ffe0c32a52e
R13: 00007ffe0c32a52f R14: 0000000000000000 R15: 00007fcf7b3e7640

Allocated by task 383:
 kasan_save_stack+0x1b/0x40
 ____kasan_kmalloc.constprop.0+0x84/0xa0
 kmem_cache_alloc+0x142/0x330
 tcm_loop_queuecommand+0x2a/0x4e0 [tcm_loop]
 scsi_queue_rq+0x12ec/0x2d20
 blk_mq_dispatch_rq_list+0x30a/0x1db0
 __blk_mq_do_dispatch_sched+0x326/0x830
 __blk_mq_sched_dispatch_requests+0x2c8/0x3f0
 blk_mq_sched_dispatch_requests+0xca/0x120
 __blk_mq_run_hw_queue+0x93/0xe0
 process_one_work+0x7b6/0x1290
 worker_thread+0x590/0xf80
 kthread+0x362/0x430
 ret_from_fork+0x22/0x30

Freed by task 11655:
 kasan_save_stack+0x1b/0x40
 kasan_set_track+0x1c/0x30
 kasan_set_free_info+0x20/0x30
 ____kasan_slab_free+0xec/0x120
 slab_free_freelist_hook+0x53/0x160
 kmem_cache_free+0xf4/0x5c0
 target_release_cmd_kref+0x3ea/0x9e0 [target_core_mod]
 transport_generic_free_cmd+0x28b/0x2f0 [target_core_mod]
 target_complete_ok_work+0x250/0xac0 [target_core_mod]
 process_one_work+0x7b6/0x1290
 worker_thread+0x590/0xf80
 kthread+0x362/0x430
 ret_from_fork+0x22/0x30

Last potentially related work creation:
 kasan_save_stack+0x1b/0x40
 kasan_record_aux_stack+0xa3/0xb0
 insert_work+0x48/0x2e0
 __queue_work+0x4e8/0xdf0
 queue_work_on+0x78/0x80
 tcmu_handle_completions+0xad0/0x1770 [target_core_user]
 tcmu_irqcontrol+0x28/0x60 [target_core_user]
 uio_write+0x155/0x230
 vfs_write+0x1ce/0x860
 ksys_write+0xe9/0x1b0
 do_syscall_64+0x33/0x40
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Second to last potentially related work creation:
 kasan_save_stack+0x1b/0x40
 kasan_record_aux_stack+0xa3/0xb0
 insert_work+0x48/0x2e0
 __queue_work+0x4e8/0xdf0
 queue_work_on+0x78/0x80
 tcm_loop_queuecommand+0x1c3/0x4e0 [tcm_loop]
 scsi_queue_rq+0x12ec/0x2d20
 blk_mq_dispatch_rq_list+0x30a/0x1db0
 __blk_mq_do_dispatch_sched+0x326/0x830
 __blk_mq_sched_dispatch_requests+0x2c8/0x3f0
 blk_mq_sched_dispatch_requests+0xca/0x120
 __blk_mq_run_hw_queue+0x93/0xe0
 process_one_work+0x7b6/0x1290
 worker_thread+0x590/0xf80
 kthread+0x362/0x430
 ret_from_fork+0x22/0x30

The buggy address belongs to the object at ffff88814cf79800 which belongs
to the cache tcm_loop_cmd_cache of size 896.

Link: https://lore.kernel.org/r/20210113024508.1264992-1-shinichiro.kawasaki@wdc.com
Fixes: a35129024e ("scsi: target: tcmu: Use priv pointer in se_cmd")
Cc: stable@vger.kernel.org # v5.9+
Acked-by: Bodo Stroesser <bostroesser@gmail.com>
Signed-off-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2021-01-14 21:56:43 -05:00
Kefeng Wang
dec822771b
riscv: stacktrace: Move register keyword to beginning of declaration
Using global sp_in_global directly to fix the following warning,

arch/riscv/kernel/stacktrace.c:31:3: warning: ‘register’ is not at beginning of declaration [-Wold-style-declaration]
31 |   const register unsigned long current_sp = sp_in_global;
   |   ^~~~~

Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com>
Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
2021-01-14 18:31:47 -08:00
Dave Airlie
8e1095901d Merge tag 'amd-drm-fixes-5.11-2021-01-14' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes
amd-drm-fixes-5.11-2021-01-14:

amdgpu:
- Update repo location in MAINTAINERS
- Add some new renoir PCI IDs
- Revert CRC UAPI changes
- Revert OLED display fix which cases clocking problems for some systems
- Misc vangogh fixes
- GFX fix for sienna cichlid
- DCN1.0 fix for pipe split
- Fix incorrect PSP command

amdkfd:
- Fix possible out of bounds read in vcrat creation

Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Alex Deucher <alexdeucher@gmail.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20210114201354.3998-1-alexander.deucher@amd.com
2021-01-15 11:56:22 +10:00
Dave Airlie
667d11dcd6 Merge tag 'drm-intel-fixes-2021-01-14' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes
drm/i915 fixes for v5.11-rc4:
- Allow the sysadmin to override security mitigations
- Restore clear-residual mitigations for ivb/byt
- Limit VFE threads based on GT
- GVT: fix vfio edid and full display detection
- Fix DSI DSC power refcounting
- Fix LPT CPU mode backlight takeover
- Disable RPM wakeref assertions during driver shutdown
- Fix DSI sequence sleeps

Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Jani Nikula <jani.nikula@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/87sg73pz42.fsf@intel.com
2021-01-15 11:47:05 +10:00
Ben Skeggs
8ef23b6f6a drm/nouveau/disp/ga10[24]: initial support
UEFI/RM no longer use IED scripts from the VBIOS, though they appear to
have been updated for use by the x86 VBIOS code, so we should be able to
continue using them for the moment.

Unfortunately, we require some hacks to do so, as the BeforeLinkTraining
IED script became a pointer to an array of scripts instead, without a
revbump of the relevant tables.

There's also some changes to SOR clock divider fiddling, which are
hopefully correct enough that things work as they should.

AFAIK, GA100 shouldn't have display, so it hasn't been added.

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2021-01-15 10:25:24 +10:00
Ben Skeggs
a6cf0320aa drm/nouveau/dmaobj/ga10[24]: initial support
Appears to be compatible with GV100 code, and not required on GA100, as
it shouldn't have display.

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2021-01-15 10:25:24 +10:00
Ben Skeggs
8a0412265f drm/nouveau/i2c/ga10[024]: initial support
Appears to be compatible with GM200 code.

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2021-01-15 10:25:23 +10:00
Ben Skeggs
c28efb15f9 drm/nouveau/gpio/ga10[024]: initial support
GA100 appears to be compatible with GK104 code, the others have some
register moves.

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2021-01-15 10:25:23 +10:00
Ben Skeggs
f5cbe7c8bd drm/nouveau/bar/ga10[024]: initial support
Appears to be compatible with TU102 code.

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2021-01-15 10:25:22 +10:00
Ben Skeggs
a3abc23ac4 drm/nouveau/mmu/ga10[024]: initial support
Appears to be compatible with TU102 code.

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2021-01-15 10:25:22 +10:00
Ben Skeggs
6f300e0a0b drm/nouveau/timer/ga10[024]: initial support
Appears to be compatible with GK20A code.

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2021-01-15 10:25:21 +10:00
Ben Skeggs
41ba806f40 drm/nouveau/fb/ga10[024]: initial support
No VPR scrub.  GA102 and GA104 have a new VRAM size detection method.

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2021-01-15 10:25:21 +10:00
Ben Skeggs
de4781d0f2 drm/nouveau/imem/ga10[024]: initial support
Appears to be compatible with NV50 code.

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2021-01-15 10:25:20 +10:00
Ben Skeggs
e0df4bbfc3 drm/nouveau/privring/ga10[024]: initial support
Appears to be compatible with GM200 code.

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2021-01-15 10:25:20 +10:00
Ben Skeggs
5961c62d20 drm/nouveau/mc/ga10[024]: initial support
Fortunately, all the interrupts we need to bring up basic display support
are contained in a single leaf register, allowing this basic (but hackish)
implementation.

There's a bunch more invasive patches to come implementing all this in a
better/more complete way, but trying to get a minimal series out first.

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2021-01-15 10:25:20 +10:00
Ben Skeggs
7ddf5e9597 drm/nouveau/devinit/ga10[024]: initial support
VPLL regs changed a bit.  There's more stuff to do around these, but it's
less invasive to stick those changes into disp for now.

None of that belongs here anymore anyhow - fix that someday.

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2021-01-15 10:25:19 +10:00
Ben Skeggs
a34632482f drm/nouveau/bios/ga10[024]: initial support
Forcing PRAMIN-shadowing off for GA100, as it requires display, and we don't
know if/where the fuse register for detecting its presence is.

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2021-01-15 10:25:19 +10:00
Ben Skeggs
70afbe4bdc drm/nouveau/pci/ga10[024]: initial support
Appears to be compatible with GP100 code.

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2021-01-15 10:25:18 +10:00
Ben Skeggs
caeb6ab899 drm/nouveau/kms/nv50-: fix case where notifier buffer is at offset 0
VRAM offset 0 is a valid address, triggered on GA102.

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2021-01-15 10:25:17 +10:00
Ben Skeggs
3b050680c8 drm/nouveau/core: recognise GA10[024]
GA100 hidden behind a module option, as it's not been as well verified
since initial bring-up and may need additional changes.

There's no display anyway, so this can wait for a bit.

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2021-01-15 10:25:17 +10:00
Ben Skeggs
add42781ad drm/nouveau/mmu: fix vram heap sizing
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2021-01-15 10:25:17 +10:00
Ben Skeggs
ba6e9ab0fc drm/nouveau/i2c/gm200: increase width of aux semaphore owner fields
Noticed while debugging GA102.

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2021-01-15 10:25:16 +10:00
Ben Skeggs
8ad95edc39 drm/nouveau/i2c/gk110-: disable hw-initiated dpcd reads
RM does this around transactions, and it seemed to help while debugging
AUXCH issues on GA102.

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2021-01-15 10:25:16 +10:00
Ben Skeggs
b5510d1e21 drm/nouveau/i2c/gk110: split out from i2c/gk104
No functional changes here yet.

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2021-01-15 10:25:15 +10:00
Ben Skeggs
e05e06cd34 drm/nouveau/privring: ack interrupts the same way as RM
Whatever it is that we were doing before doesn't work on Ampere.

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2021-01-15 10:25:15 +10:00
Ben Skeggs
402a89660e drm/nouveau/bios: fix issue shadowing expansion ROMs
This issue has generally been covered up by the presence of additional
expansion ROMs after the ones we're interested in, with header fetches
of subsequent images loading enough of the ROM to hide the issue.

Noticed on GA102, which lacks a type 0x70 image compared to TU102,.

[  906.364197] nouveau 0000:09:00.0: bios: 00000000: type 00, 65024 bytes
[  906.381205] nouveau 0000:09:00.0: bios: 0000fe00: type 03, 91648 bytes
[  906.405213] nouveau 0000:09:00.0: bios: 00026400: type e0, 22016 bytes
[  906.410984] nouveau 0000:09:00.0: bios: 0002ba00: type e0, 366080 bytes

vs

[   22.961901] nouveau 0000:09:00.0: bios: 00000000: type 00, 60416 bytes
[   22.984174] nouveau 0000:09:00.0: bios: 0000ec00: type 03, 71168 bytes
[   23.010446] nouveau 0000:09:00.0: bios: 00020200: type e0, 48128 bytes
[   23.028220] nouveau 0000:09:00.0: bios: 0002be00: type e0, 140800 bytes
[   23.080196] nouveau 0000:09:00.0: bios: 0004e400: type 70, 7168 bytes

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2021-01-15 10:25:14 +10:00
Dave Airlie
61502e3bb9 Short summary of fixes pull:
* dma-buf: Fix a memory leak in CMAV heap
  * drm: Fix format check for legacy pageflips
  * ttm: Pass correct address to dma_mapping_error(); Use mutex in pool
    shrinker
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCAAdFiEEchf7rIzpz2NEoWjlaA3BHVMLeiMFAl/9odoACgkQaA3BHVML
 eiNthwf/T8NqIzmrqOVskJA1JrfVe0L5WTsX4rQMtTwvfSeRV33raoXQfbr8fVHs
 PQ+Z7i3LjAeTsXh9iNwz9j9yu8l2BLNbhqI8vjbXIaHWwl4zw44N5njBwCCtqAje
 wbyBzIsen1s/aHeN4hW9osCAg3N6DkDXN9hJhryIIKv6UKkT4/jXLmsNLkYelD1l
 E6nqe0vu7mpwNiEtCkHajE/d/RtRzE6IPvB+uoAqPI3COHR3vq0PAnQENYRj8vu0
 wG9IyheLKzbR3TpNxBRYn1PqlJMSrH321GP+Xja3CxAmbah2jahMtL8M9dO8GztF
 f1zqPrRTG/AMgd9GPE9FOIQciREs+g==
 =FeqQ
 -----END PGP SIGNATURE-----

Merge tag 'drm-misc-fixes-2021-01-12' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes

Short summary of fixes pull:

 * dma-buf: Fix a memory leak in CMAV heap
 * drm: Fix format check for legacy pageflips
 * ttm: Pass correct address to dma_mapping_error(); Use mutex in pool
   shrinker

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patchwork.freedesktop.org/patch/msgid/X/2iXO4ofFSZ39/v@linux-uq9g
2021-01-15 10:16:46 +10:00
Jens Axboe
b4f664252f nvme fixes for 5.11:
- don't initialize hwmon for discover controllers (Sagi Grimberg)
  - fix iov_iter handling in nvme-tcp (Sagi Grimberg)
  - fix a preempt warning in nvme-tcp (Sagi Grimberg)
  - fix a possible NULL pointer dereference in nvme (Israel Rukshin)
 -----BEGIN PGP SIGNATURE-----
 
 iQI/BAABCgApFiEEgdbnc3r/njty3Iq9D55TZVIEUYMFAmAAm0ULHGhjaEBsc3Qu
 ZGUACgkQD55TZVIEUYMm/hAAn0MWP9KhG2lM2nN+GyxktrCG9znX2qy4t5ykOfro
 2G3flWZP4eP0c0M2VbG22UAIAkMGbzXquVQEk7xK6mPt2fw0AJvK5GJrh9GncaZF
 RyNiz+Pj9KNJYNZYmqhMwiGR8ULSVcHKqD1qgQGOJQzExQKFvluXdEmHcsodgoA5
 35FNlnjU9W7NdD03nSzRl4T7qYuQI5mA42XYu8t9ObGW1eg7e5PWtbN9n8BVPxbM
 bGQa1UUXYYTJlNIbu0o9Ij7UUiR2dGUa4Gb2u9BzpIogrdniHz/lIDdaVmt9jETW
 PJGcuFRfDTikqGJAu6LOXtyT7gM596psCLxUoBg+sVXxvttCOfB/xNqZz+XqG41g
 6yZ/VRq7P34h71cGESUNEpRxUYmQLd58j7NuZ9lzVGqgT8VWKnNQZwb7TGiBZKyG
 LGcUlWnUuO33n0mGx+dlAO9IGSSN4hdvOwP64PFPfd4V7mu0KOjmPkWg4B+F26eE
 9L1otfMee+K0Z/8Z6SOY2/QwsBpkxRQyN2eJXvZfWex8tgZB8ZzvQiGnmeG455MF
 urAgHez0K3pE1BAdfQxq0ql60JlgnyVX+RSd7JnUwnYpsNfFEYyxkrnAR6m+0jO7
 gHAWkDvX7IoEnJH0ZF50VxrP5ByURqHY0WSRD2dKhAUL7fJ+OPLP/57blIEC8V21
 H4E=
 =bI86
 -----END PGP SIGNATURE-----

Merge tag 'nvme-5.11-2021-01-14' of git://git.infradead.org/nvme into block-5.11

Pull NVMe fixes from Christoph:

"nvme fixes for 5.11:

 - don't initialize hwmon for discover controllers (Sagi Grimberg)
 - fix iov_iter handling in nvme-tcp (Sagi Grimberg)
 - fix a preempt warning in nvme-tcp (Sagi Grimberg)
 - fix a possible NULL pointer dereference in nvme (Israel Rukshin)"

* tag 'nvme-5.11-2021-01-14' of git://git.infradead.org/nvme:
  nvme: don't intialize hwmon for discovery controllers
  nvme-tcp: fix possible data corruption with bio merges
  nvme-tcp: Fix warning with CONFIG_DEBUG_PREEMPT
  nvmet-rdma: Fix NULL deref when setting pi_enable and traddr INADDR_ANY
2021-01-14 15:17:33 -07:00
Linus Torvalds
1466205062 linux-kselftest-fixes-5.11-rc4
This Kselftest fixes update for Linux 5.11-rc4 consists of one single fix
 to skip BPF selftests by default. BPF selftests have a hard dependency on
 cutting edge versions of tools in the BPF ecosystem including LLVM.
 
 Skipping BPF allows by default will make it easier for users interested in
 running kselftest as a whole. Users can include BPF in Kselftest build by
 via SKIP_TARGETS variable.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEPZKym/RZuOCGeA/kCwJExA0NQxwFAmAAqfUACgkQCwJExA0N
 QxzocA/8Dw1oEbrU10CP9YACcrX8w31FS6do8ufA7xnQWjV6/nekJkO1dtDfQJmo
 8FvQJAez1NNXXd0Gtt/thSVEQn8XfyDRpwsosoleJcYlS4AjcCkvdWoLUsBlzvSW
 UWc17qgVlSsAk9CV5pd7wCHZ7wtfC/F7pNWFUpeVLTpreAgEPgoynZ9fAlJaHDnV
 iVON2YQmWP48WT3CNTPzyxKR2TxV8sf+m9zSOSj8sYXWUjPrpsz121yDAw4WcJ74
 5P3qvUjYkAIMrV7usVrZlHm3VxdE/AabFeJ81Bq8kqbFcid9Y6ikK4JyHwudVAzE
 lLZwlj/KoLIC4i9AcmAw3LRWCwjryq7dThNiWHstLeh5+XTAVLHdW2dgL2w5TeA4
 5QxdufxB39wz6T9zLOpAGVoT4ZDrKXpcF6herE1wTxPmz9C5gC1QeSu9/aK+Suzg
 r/yJUkSUlEXPtaJKf6hneikMM52gRdB7RuS6IezFtfCUE/xDP+QUKvdseS6gjAdb
 0emYEhm6MMGHHYnP05TXrNBcXZwWSkAgEhtoKfdjNU/lGxqryIm1WWYdIQq7Zlut
 uY0OhcJzHdBSaNy9yFP9iza2+6ME0aFPeUuSsLgf1E4rPtMmpna3M1rJz1CsV+jG
 Qae0B6MtKdXmJMCh02nXUAnY3RPwCwtPrF4xpkTM3IzXQowAIqk=
 =AdEo
 -----END PGP SIGNATURE-----

Merge tag 'linux-kselftest-fixes-5.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest

Pull kselftest fixes from Shuah Khan:
 "One single fix to skip BPF selftests by default.

  BPF selftests have a hard dependency on cutting edge versions of tools
  in the BPF ecosystem including LLVM.

  Skipping BPF allows by default will make it easier for users
  interested in running kselftest as a whole. Users can include BPF in
  Kselftest build by via SKIP_TARGETS variable"

* tag 'linux-kselftest-fixes-5.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest:
  selftests: Skip BPF seftests by default
2021-01-14 13:54:09 -08:00
Linus Torvalds
e8c13a6bc8 Networking fixes for 5.11-rc4, including fixes from can and netfilter.
Current release - regressions:
 
  - fix feature enforcement to allow NETIF_F_HW_TLS_TX
    if IP_CSUM && IPV6_CSUM
 
  - dcb: accept RTM_GETDCB messages carrying set-like DCB commands
         if user is admin for backward-compatibility
 
  - selftests/tls: fix selftests build after adding ChaCha20-Poly1305
 
 Current release - always broken:
 
  - ppp: fix refcount underflow on channel unbridge
 
  - bnxt_en: clear DEFRAG flag in firmware message when retry flashing
 
  - smc: fix out of bound access in the new netlink interface
 
 Previous releases - regressions:
 
  - fix use-after-free with UDP GRO by frags
 
  - mptcp: better msk-level shutdown
 
  - rndis_host: set proper input size for OID_GEN_PHYSICAL_MEDIUM request
 
  - i40e: xsk: fix potential NULL pointer dereferencing
 
 Previous releases - always broken:
 
  - skb frag: kmap_atomic fixes
 
  - avoid 32 x truesize under-estimation for tiny skbs
 
  - fix issues around register_netdevice() failures
 
  - udp: prevent reuseport_select_sock from reading uninitialized socks
 
  - dsa: unbind all switches from tree when DSA master unbinds
 
  - dsa: clear devlink port type before unregistering slave netdevs
 
  - can: isotp: isotp_getname(): fix kernel information leak
 
  - mlxsw: core: Thermal control fixes
 
  - ipv6: validate GSO SKB against MTU before finish IPv6 processing
 
  - stmmac: use __napi_schedule() for PREEMPT_RT
 
  - net: mvpp2: remove Pause and Asym_Pause support
 
 Misc:
 
  - remove from MAINTAINERS folks who had been inactive for >5yrs
 
 Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEE6jPA+I1ugmIBA4hXMUZtbf5SIrsFAmAAnyYACgkQMUZtbf5S
 IrsdmhAAotkTNVS1zEsvwIirI9KUKKMXvNvscpO0+HJgsQHVnCGkfrj0BQmqQR21
 D9njJIkGRiIANRO/Y/3wVCew55a0bxLmyE3JaU6krGLpvcNUFX6+fvuuzFSiWtKu
 1c/AaXFIDTa8uVtXP/Ve8DfxKZmh3YPX5pNtk3fS6OlymbUfu8pOEPY5k69/Nlmr
 QwbGZO0Q5Ab18rmPztgWpcZi8wLbpZYbrIR2E45u3k+LnXG3UUVYeYTC9Hi89wkz
 8YiS0PIs6GmWeSWnWK9TWXFSaxV8ttABsFxpbmzWW6oqkaviGjLfPg7kYYRgPu08
 nCyYx7LN58shQ8FTfZm1yBpJ1fbPV/5RIMZKQ6Fg4cICgCab63E4N6xxoA9mLNu9
 hP/qgeynQ2w1FbPw5yQVbDCVmcyfPb5V4WC1OccHQdgaAzz2SFPxvsUTOoBRxY8m
 DmZDHjBi2ZXB3/PSkwWmIsW9PuPq6de8xgHIQtjrCeduvVvmOYkrcdfkMxTx9HC0
 LH2a5x9VCL/cf/Y/tQ2TZSntweSq8MhlRV9vOIO1FOqiviYHlnD8+EuIBMe8To14
 XRIDMl92lpY5xjJpKdRhZ7Yh4CNMk199yFf5bt3xSlM4A3ALUlwqRKES6I2MZiiF
 0Yvxsr2qVShaHx6XpmBAimaUXxTmmUV7X1hf19EEzzmTdiMjad4=
 =e8t6
 -----END PGP SIGNATURE-----

Merge tag 'net-5.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Pull networking fixes from Jakub Kicinski:
 "We have a few fixes for long standing issues, in particular Eric's fix
  to not underestimate the skb sizes, and my fix for brokenness of
  register_netdevice() error path. They may uncover other bugs so we
  will keep an eye on them. Also included are Willem's fixes for
  kmap(_atomic).

  Looking at the "current release" fixes, it seems we are about one rc
  behind a normal cycle. We've previously seen an uptick of "people had
  run their test suites" / "humans actually tried to use new features"
  fixes between rc2 and rc3.

  Summary:

  Current release - regressions:

   - fix feature enforcement to allow NETIF_F_HW_TLS_TX if IP_CSUM &&
     IPV6_CSUM

   - dcb: accept RTM_GETDCB messages carrying set-like DCB commands if
     user is admin for backward-compatibility

   - selftests/tls: fix selftests build after adding ChaCha20-Poly1305

  Current release - always broken:

   - ppp: fix refcount underflow on channel unbridge

   - bnxt_en: clear DEFRAG flag in firmware message when retry flashing

   - smc: fix out of bound access in the new netlink interface

  Previous releases - regressions:

   - fix use-after-free with UDP GRO by frags

   - mptcp: better msk-level shutdown

   - rndis_host: set proper input size for OID_GEN_PHYSICAL_MEDIUM
     request

   - i40e: xsk: fix potential NULL pointer dereferencing

  Previous releases - always broken:

   - skb frag: kmap_atomic fixes

   - avoid 32 x truesize under-estimation for tiny skbs

   - fix issues around register_netdevice() failures

   - udp: prevent reuseport_select_sock from reading uninitialized socks

   - dsa: unbind all switches from tree when DSA master unbinds

   - dsa: clear devlink port type before unregistering slave netdevs

   - can: isotp: isotp_getname(): fix kernel information leak

   - mlxsw: core: Thermal control fixes

   - ipv6: validate GSO SKB against MTU before finish IPv6 processing

   - stmmac: use __napi_schedule() for PREEMPT_RT

   - net: mvpp2: remove Pause and Asym_Pause support

  Misc:

   - remove from MAINTAINERS folks who had been inactive for >5yrs"

* tag 'net-5.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (58 commits)
  mptcp: fix locking in mptcp_disconnect()
  net: Allow NETIF_F_HW_TLS_TX if IP_CSUM && IPV6_CSUM
  MAINTAINERS: dccp: move Gerrit Renker to CREDITS
  MAINTAINERS: ipvs: move Wensong Zhang to CREDITS
  MAINTAINERS: tls: move Aviad to CREDITS
  MAINTAINERS: ena: remove Zorik Machulsky from reviewers
  MAINTAINERS: vrf: move Shrijeet to CREDITS
  MAINTAINERS: net: move Alexey Kuznetsov to CREDITS
  MAINTAINERS: altx: move Jay Cliburn to CREDITS
  net: avoid 32 x truesize under-estimation for tiny skbs
  nt: usb: USB_RTL8153_ECM should not default to y
  net: stmmac: fix taprio configuration when base_time is in the past
  net: stmmac: fix taprio schedule configuration
  net: tip: fix a couple kernel-doc markups
  net: sit: unregister_netdevice on newlink's error path
  net: stmmac: Fixed mtu channged by cache aligned
  cxgb4/chtls: Fix tid stuck due to wrong update of qid
  i40e: fix potential NULL pointer dereferencing
  net: stmmac: use __napi_schedule() for PREEMPT_RT
  can: mcp251xfd: mcp251xfd_handle_rxif_one(): fix wrong NULL pointer check
  ...
2021-01-14 13:31:07 -08:00
Lorenzo Bianconi
c13cf5c159 mac80211: check if atf has been disabled in __ieee80211_schedule_txq
Check if atf has been disabled in __ieee80211_schedule_txq() in order to
avoid a given sta is always put to the beginning of the active_txqs list
and never moved to the end since deficit is not decremented in
ieee80211_sta_register_airtime()

Fixes: b4809e9484 ("mac80211: Add airtime accounting and scheduling to TXQs")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
Link: https://lore.kernel.org/r/93889406c50f1416214c079ca0b8c9faecc5143e.1608975195.git.lorenzo@kernel.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2021-01-14 22:27:38 +01:00
Felix Fietkau
2463ec86cd mac80211: do not drop tx nulldata packets on encrypted links
ieee80211_tx_h_select_key drops any non-mgmt packets without a key when
encryption is used. This is wrong for nulldata packets that can't be
encrypted and are sent out for probing clients and indicating 4-address
mode.

Reported-by: Sebastian Gottschall <s.gottschall@dd-wrt.com>
Fixes: a0761a3017 ("mac80211: drop data frames without key on encrypted links")
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Link: https://lore.kernel.org/r/20201218191525.1168-1-nbd@nbd.name
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2021-01-14 22:26:10 +01:00
Felix Fietkau
b101dd2d22 mac80211: fix encryption key selection for 802.3 xmit
When using WEP, the default unicast key needs to be selected, instead of
the STA PTK.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
Link: https://lore.kernel.org/r/20201218184718.93650-4-nbd@nbd.name
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2021-01-14 22:25:43 +01:00
Felix Fietkau
622d3b4e39 mac80211: fix fast-rx encryption check
When using WEP, the default unicast key needs to be selected, instead of
the STA PTK.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
Link: https://lore.kernel.org/r/20201218184718.93650-5-nbd@nbd.name
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2021-01-14 22:25:28 +01:00
Shayne Chen
6020d534fa mac80211: fix incorrect strlen of .write in debugfs
This fixes strlen mismatch problems happening in some .write callbacks
of debugfs.

When trying to configure airtime_flags in debugfs, an error appeared:
ash: write error: Invalid argument

The error is returned from kstrtou16() since a wrong length makes it
miss the real end of input string.  To fix this, use count as the string
length, and set proper end of string for a char buffer.

The debug print is shown - airtime_flags_write: count = 2, len = 8,
where the actual length is 2, but "len = strlen(buf)" gets 8.

Also cleanup the other similar cases for the sake of consistency.

Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
Link: https://lore.kernel.org/r/20210112032028.7482-1-shayne.chen@mediatek.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2021-01-14 22:23:56 +01:00
Mauro Carvalho Chehab
c2083e280a cfg80211: fix a kerneldoc markup
A function has a different name between their prototype
and its kernel-doc markup:
	../include/net/cfg80211.h:1766: warning: expecting prototype for struct cfg80211_sar_chan_ranges. Prototype was for struct cfg80211_sar_freq_ranges instead

Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Link: https://lore.kernel.org/r/c7ed4bc4d9e992ead16d3d2df246f3b56dbfb1fb.1610610937.git.mchehab+huawei@kernel.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2021-01-14 22:21:53 +01:00
Stephen Boyd
b8653aff1c iio: sx9310: Fix semtech,avg-pos-strength setting when > 16
This DT property can be 0, 16, and then 64, but not 32. The math here
doesn't recognize this slight bump in the power of 2 numbers and
translates a DT property of 64 into the register value '3' when it
really should be '2'. Fix it by subtracting one more if the number being
translated is larger than 31. Also use clamp() because we're here.

Cc: Daniel Campello <campello@chromium.org>
Cc: Lars-Peter Clausen <lars@metafoo.de>
Cc: Peter Meerwald-Stadler <pmeerw@pmeerw.net>
Cc: Douglas Anderson <dianders@chromium.org>
Cc: Gwendal Grignou <gwendal@chromium.org>
Cc: Evan Green <evgreen@chromium.org>
Signed-off-by: Stephen Boyd <swboyd@chromium.org>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Link: https://lore.kernel.org/r/20201202200252.986230-1-swboyd@chromium.org
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2021-01-14 21:01:22 +00:00