Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1668409 > unrolled thread

[PATCH for v4.9 LTS 01/86] sparc64: Handle PIO & MEM non-resumable errors.

Back to article view | Back to linux.kernel

Contents

  [PATCH for v4.9 LTS 01/86] sparc64: Handle PIO & MEM non-resumable  errors. "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:30 +0200
    [PATCH for v4.9 LTS 80/86] be2net: don't delete MAC on close on  unprivileged BE3 VFs "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:30 +0200
    [PATCH for v4.9 LTS 81/86] be2net: fix MAC addr setting on privileged  BE3 VFs "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:30 +0200
    [PATCH for v4.9 LTS 85/86] perf probe: Fix to probe on gcc generated  functions in modules "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:30 +0200
    [PATCH for v4.9 LTS 03/86] net: ethtool: add support for 2500BaseT  and 5000BaseT link modes "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:30 +0200
    [PATCH for v4.9 LTS 59/86] usb: gadget: composite: Fix function used  to free memory "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:30 +0200
    [PATCH for v4.9 LTS 79/86] be2net: fix status check in  be_cmd_pmac_add() "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:30 +0200
    [PATCH for v4.9 LTS 50/86] Documentation: devicetree: change the  mediatek ethernet compatible string "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:30 +0200
    [PATCH for v4.9 LTS 82/86] perf probe: Fix to show correct locations  for events on modules "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:30 +0200
    [PATCH for v4.9 LTS 84/86] tipc: allocate user memory with GFP_KERNEL  flag "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:30 +0200
    [PATCH for v4.9 LTS 22/86] net: phy: dp83848: add DP83620 PHY support "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:30 +0200
    [PATCH for v4.9 LTS 10/86] ARM64: dts: meson-gx: Add firmware  reserved memory zones "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:30 +0200
    [PATCH for v4.9 LTS 60/86] usb: dwc3: exynos fix axius clock error  path to do cleanup "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:30 +0200
    [PATCH for v4.9 LTS 20/86] drm/amdgpu: fix program vce instance logic  error. "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:30 +0200
    [PATCH for v4.9 LTS 76/86] swiotlb: ensure that page-sized mappings  are page-aligned "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:30 +0200
    [PATCH for v4.9 LTS 32/86] Btrfs: fix truncate down when no_holes  feature is enabled "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:30 +0200
    [PATCH for v4.9 LTS 83/86] net: phy: dp83867: allow  RGMII_TXID/RGMII_RXID interface types "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:30 +0200
    [PATCH for v4.9 LTS 54/86] net: phy: marvell: fix Marvell 88E1512  used in SGMII mode "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:30 +0200
    [PATCH for v4.9 LTS 52/86] perf/x86/intel/uncore: Fix hardcoded  socket 0 assumption in the Haswell init code "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:30 +0200
    [PATCH for v4.9 LTS 65/86] drm/amd/powerplay: fix vce cg logic error  on CZ/St. "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:30 +0200
    [PATCH for v4.9 LTS 43/86] vfio/spapr: fail tce_iommu_attach_group()  when iommu_data is null "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
    [PATCH for v4.9 LTS 33/86] virtio_console: fix a crash in  config_work_handler "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
    [PATCH for v4.9 LTS 55/86] mac80211: recalculate min channel width on  VHT opmode changes "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
    [PATCH for v4.9 LTS 49/86] kernel/panic.c: add missing \n "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
    [PATCH for v4.9 LTS 74/86] aio: fix lock dep warning "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
    [PATCH for v4.9 LTS 47/86] vxlan: do not age static remote mac  entries "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
    [PATCH for v4.9 LTS 36/86] xen-netfront: Fix Rx stall during network  stress and OOM "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
    [PATCH for v4.9 LTS 40/86] amd-xgbe: Check xgbe_init() return code "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
    [PATCH for v4.9 LTS 29/86] objtool: Fix IRET's opcode "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
    [PATCH for v4.9 LTS 67/86] pmem: return EIO on read_pmem() failure "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
    [PATCH for v4.9 LTS 56/86] perf/x86/intel: Use ULL constant to  prevent undefined shift behaviour "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
    [PATCH for v4.9 LTS 30/86] gianfar: Do not reuse pages from emergency  reserve "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
    [PATCH for v4.9 LTS 21/86] drm/amdgpu: add support for new hainan  variants "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
    [PATCH for v4.9 LTS 35/86] net: sctp: fix array overrun read on  sctp_timer_tbl "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
    [PATCH for v4.9 LTS 57/86] HID: i2c-hid: Add sleep between POWER ON  and RESET "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
    [PATCH for v4.9 LTS 46/86] ip6_tunnel: must reload ipv6h in  ip6ip6_tnl_xmit() "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
    [PATCH for v4.9 LTS 78/86] usb: dwc2: gadget: Fix GUSBCFG.USBTRDTIM  value "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
    [PATCH for v4.9 LTS 53/86] pinctrl: intel: Set pin direction properly "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
    [PATCH for v4.9 LTS 86/86] net/mlx4_core: Eliminate warning messages  for SRQ_LIMIT under SRIOV "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
    [PATCH for v4.9 LTS 42/86] drm/amdgpu: check ring being ready before  using "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
    [PATCH for v4.9 LTS 70/86] x86/tsc: Add the Intel Denverton Processor  to native_calibrate_tsc() "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
    [PATCH for v4.9 LTS 37/86] scsi: virtio_scsi: Reject commands when  virtqueue is broken "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
    [PATCH for v4.9 LTS 64/86] drm/radeon/si: load special ucode for  certain MC configs "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
    [PATCH for v4.9 LTS 58/86] scsi: lpfc: avoid double free of resource  identifiers "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
    [PATCH for v4.9 LTS 51/86] drm/etnaviv: trick drm_mm into giving out  a low IOVA "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
    [PATCH for v4.9 LTS 62/86] arm64: assembler: make adr_l work in  modules under KASLR "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
    [PATCH for v4.9 LTS 69/86] KVM: arm64: Access CNTHCTL_EL2 bit fields  correctly on VHE systems "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
    [PATCH for v4.9 LTS 41/86] net: dsa: Check return value of  phy_connect_direct() "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
    [PATCH for v4.9 LTS 63/86] net: thunderx: acpi: fix LMAC  initialization "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
    [PATCH for v4.9 LTS 75/86] coredump: Ensure proper size of sparse  core files "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
    [PATCH for v4.9 LTS 71/86] x86/mpx: Use compatible types in  comparison to fix sparse error "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
    [PATCH for v4.9 LTS 44/86] mlxsw: spectrum_router: Correctly  reallocate adjacency entries "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
    [PATCH for v4.9 LTS 45/86] virtio_net: fix PAGE_SIZE > 64k "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
    [PATCH for v4.9 LTS 38/86] iwlwifi: fix kernel crash when  unregistering thermal zone "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
    [PATCH for v4.9 LTS 34/86] swiotlb-xen: update dev_addr after  swapping pages "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
    [PATCH for v4.9 LTS 68/86] mac80211: initialize SMPS field in HT  capabilities "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
    [PATCH for v4.9 LTS 14/86] KVM: x86: fix fixing of hypercalls "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:50 +0200
    [PATCH for v4.9 LTS 24/86] net: ethtool: Initialize buffer when  querying device channel settings "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:50 +0200
    [PATCH for v4.9 LTS 23/86] powerpc/eeh: Enable IO path on permanent  error "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:50 +0200
    [PATCH for v4.9 LTS 26/86] xen-netback: protect resource cleaning on  XenBus disconnect "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:50 +0200
    [PATCH for v4.9 LTS 07/86] net: phy: use boolean dt properties for  eee broken modes "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:50 +0200
    [PATCH for v4.9 LTS 04/86] net: phy: add an option to disable EEE  advertisement "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:50 +0200
    [PATCH for v4.9 LTS 08/86] dt: bindings: net: use boolean dt  properties for eee broken modes "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:50 +0200
    [PATCH for v4.9 LTS 13/86] ubifs: allow encryption ioctls in compat  mode "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:50 +0200
      Re: [PATCH for v4.9 LTS 13/86] ubifs: allow encryption ioctls in  compat mode Eric Biggers <ebiggers@google.com> - 2017-06-19 19:10 +0200
        Re: [PATCH for v4.9 LTS 13/86] ubifs: allow encryption ioctls in  compat mode Richard Weinberger <richard@nod.at> - 2017-06-19 21:30 +0200
          Re: [PATCH for v4.9 LTS 13/86] ubifs: allow encryption ioctls in  compat mode "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-19 21:50 +0200
            Re: [PATCH for v4.9 LTS 13/86] ubifs: allow encryption ioctls in  compat mode Richard Weinberger <richard@nod.at> - 2017-06-19 22:10 +0200
    [PATCH for v4.9 LTS 25/86] xen-netback: fix memory leaks on XenBus  disconnect "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:50 +0200
    [PATCH for v4.9 LTS 11/86] ARM64: dts: meson-gxbb-odroidc2: fix GbE  tx link breakage "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:50 +0200
    [PATCH for v4.9 LTS 27/86] bnxt_en: Fix "uninitialized variable" bug  in TPA code path. "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:50 +0200
    [PATCH for v4.9 LTS 02/86] sparc64: Zero pages on allocation for  mondo and error queues. "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:50 +0200
    [PATCH for v4.9 LTS 31/86] Btrfs: Fix deadlock between direct IO and  fast fsync "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:50 +0200
    [PATCH for v4.9 LTS 19/86] qla2xxx: Fix erroneous invalid handle  message "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:50 +0200
    [PATCH for v4.9 LTS 06/86] net: phy: fix sign type error in  genphy_config_eee_advert "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:50 +0200
    [PATCH for v4.9 LTS 15/86] scsi: sd: Fix wrong DPOFUA disable in  sd_read_cache_type "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:50 +0200
    [PATCH for v4.9 LTS 16/86] stmmac: add missing of_node_put "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:50 +0200
    [PATCH for v4.9 LTS 05/86] dt-bindings: net: add EEE capability  constants "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:50 +0200
    [PATCH for v4.9 LTS 18/86] qla2xxx: Terminate exchange if corrupted "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:50 +0200
    [PATCH for v4.9 LTS 12/86] perf/x86/intel: Handle exclusive threadid  correctly on CPU hotplug "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:50 +0200
    [PATCH for v4.9 LTS 28/86] bpf: don't trigger OOM killer under  pressure with map alloc "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:50 +0200

Page 2 of 5 — ← Prev page 1 [2] 3 4 5  Next page →

#1668431 — [PATCH for v4.9 LTS 43/86] vfio/spapr: fail tce_iommu_attach_group() when iommu_data is null

From: Greg Kurz <groug@kaod.org>

[ Upstream commit bd00fdf198e2da475a2f4265a83686ab42d998a8 ]

The recently added mediated VFIO driver doesn't know about powerpc iommu.
It thus doesn't register a struct iommu_table_group in the iommu group
upon device creation. The iommu_data pointer hence remains null.

This causes a kernel oops when userspace tries to set the iommu type of a
container associated with a mediated device to VFIO_SPAPR_TCE_v2_IOMMU.

[   82.585440] mtty mtty: MDEV: Registered
[   87.655522] iommu: Adding device 83b8f4f2-509f-382f-3c1e-e6bfe0fa1001 to group 10
[   87.655527] vfio_mdev 83b8f4f2-509f-382f-3c1e-e6bfe0fa1001: MDEV: group_id = 10
[  116.297184] Unable to handle kernel paging request for data at address 0x00000030
[  116.297389] Faulting instruction address: 0xd000000007870524
[  116.297465] Oops: Kernel access of bad area, sig: 11 [#1]
[  116.297611] SMP NR_CPUS=2048
[  116.297611] NUMA
[  116.297627] PowerNV
...
[  116.297954] CPU: 33 PID: 7067 Comm: qemu-system-ppc Not tainted 4.10.0-rc5-mdev-test #8
[  116.297993] task: c000000e7718b680 task.stack: c000000e77214000
[  116.298025] NIP: d000000007870524 LR: d000000007870518 CTR: 0000000000000000
[  116.298064] REGS: c000000e77217990 TRAP: 0300   Not tainted  (4.10.0-rc5-mdev-test)
[  116.298103] MSR: 9000000000009033 <SF,HV,EE,ME,IR,DR,RI,LE>
[  116.298107]   CR: 84004444  XER: 00000000
[  116.298154] CFAR: c00000000000888c DAR: 0000000000000030 DSISR: 40000000 SOFTE: 1
               GPR00: d000000007870518 c000000e77217c10 d00000000787b0ed c000000eed2103c0
               GPR04: 0000000000000000 0000000000000000 c000000eed2103e0 0000000f24320000
               GPR08: 0000000000000104 0000000000000001 0000000000000000 d0000000078729b0
               GPR12: c00000000025b7e0 c00000000fe08400 0000000000000001 000001002d31d100
               GPR16: 000001002c22c850 00003ffff315c750 0000000043145680 0000000043141bc0
               GPR20: ffffffffffffffed fffffffffffff000 0000000020003b65 d000000007706018
               GPR24: c000000f16cf0d98 d000000007706000 c000000003f42980 c000000003f42980
               GPR28: c000000f1575ac00 c000000003f429c8 0000000000000000 c000000eed2103c0
[  116.298504] NIP [d000000007870524] tce_iommu_attach_group+0x10c/0x360 [vfio_iommu_spapr_tce]
[  116.298555] LR [d000000007870518] tce_iommu_attach_group+0x100/0x360 [vfio_iommu_spapr_tce]
[  116.298601] Call Trace:
[  116.298610] [c000000e77217c10] [d000000007870518] tce_iommu_attach_group+0x100/0x360 [vfio_iommu_spapr_tce] (unreliable)
[  116.298671] [c000000e77217cb0] [d0000000077033a0] vfio_fops_unl_ioctl+0x278/0x3e0 [vfio]
[  116.298713] [c000000e77217d40] [c0000000002a3ebc] do_vfs_ioctl+0xcc/0x8b
0
[  116.298745] [c000000e77217de0] [c0000000002a4700] SyS_ioctl+0x60/0xc0
[  116.298782] [c000000e77217e30] [c00000000000b220] system_call+0x38/0xfc
[  116.298812] Instruction dump:
[  116.298828] 7d3f4b78 409effc8 3d220000 e9298020 3c800140 38a00018 608480c0 e8690028
[  116.298869] 4800249d e8410018 7c7f1b79 41820230 <e93e0030> 2fa90000 419e0114 e9090020
[  116.298914] ---[ end trace 1e10b0ced08b9120 ]---

This patch fixes the oops.

Reported-by: Vaibhav Jain <vaibhav@linux.vnet.ibm.com>
Signed-off-by: Greg Kurz <groug@kaod.org>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
---
 drivers/vfio/vfio_iommu_spapr_tce.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/vfio/vfio_iommu_spapr_tce.c b/drivers/vfio/vfio_iommu_spapr_tce.c
index 79ddcb05d126..85d3e648bdea 100644
--- a/drivers/vfio/vfio_iommu_spapr_tce.c
+++ b/drivers/vfio/vfio_iommu_spapr_tce.c
@@ -1292,6 +1292,10 @@ static int tce_iommu_attach_group(void *iommu_data,
 	/* pr_debug("tce_vfio: Attaching group #%u to iommu %p\n",
 			iommu_group_id(iommu_group), iommu_group); */
 	table_group = iommu_group_get_iommudata(iommu_group);
+	if (!table_group) {
+		ret = -ENODEV;
+		goto unlock_exit;
+	}
 
 	if (tce_groups_attached(container) && (!table_group->ops ||
 			!table_group->ops->take_ownership ||
-- 
2.11.0

[toc] | [prev] | [next] | [standalone]

#1668432 — [PATCH for v4.9 LTS 33/86] virtio_console: fix a crash in config_work_handler

From: "G. Campana" <gcampana@quarkslab.com>

[ Upstream commit 8379cadf71c3ee8173a1c6fc1ea7762a9638c047 ]

Using control_work instead of config_work as the 3rd argument to
container_of results in an invalid portdev pointer. Indeed, the work
structure is initialized as below:

    INIT_WORK(&portdev->config_work, &config_work_handler);

It leads to a crash when portdev->vdev is dereferenced later. This
bug
is triggered when the guest uses a virtio-console without multiport
feature and receives a config_changed virtio interrupt.

Signed-off-by: G. Campana <gcampana@quarkslab.com>
Reviewed-by: Amit Shah <amit.shah@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
---
 drivers/char/virtio_console.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index 471a301d63e3..8f890c1aca57 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -1870,7 +1870,7 @@ static void config_work_handler(struct work_struct *work)
 {
 	struct ports_device *portdev;
 
-	portdev = container_of(work, struct ports_device, control_work);
+	portdev = container_of(work, struct ports_device, config_work);
 	if (!use_multiport(portdev)) {
 		struct virtio_device *vdev;
 		struct port *port;
-- 
2.11.0

[toc] | [prev] | [next] | [standalone]

#1668433 — [PATCH for v4.9 LTS 55/86] mac80211: recalculate min channel width on VHT opmode changes

From: Johannes Berg <johannes.berg@intel.com>

[ Upstream commit d2941df8fbd9708035d66d889ada4d3d160170ce ]

When an associated station changes its VHT operating mode this
can/will affect the bandwidth it's using, and consequently we
must recalculate the minimum bandwidth we need to use. Failure
to do so can lead to one of two scenarios:
 1) we use a too high bandwidth, this is benign
 2) we use a too narrow bandwidth, causing rate control and
    actual PHY configuration to be out of sync, which can in
    turn cause problems/crashes

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
---
 net/mac80211/iface.c | 21 +++++++++++++++++++++
 net/mac80211/rx.c    |  9 +--------
 net/mac80211/vht.c   |  4 +++-
 3 files changed, 25 insertions(+), 9 deletions(-)

diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 8d7747e98fdb..37bec0f864b7 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -6,6 +6,7 @@
  * Copyright (c) 2006 Jiri Benc <jbenc@suse.cz>
  * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
  * Copyright 2013-2014  Intel Mobile Communications GmbH
+ * Copyright (c) 2016        Intel Deutschland GmbH
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -1307,6 +1308,26 @@ static void ieee80211_iface_work(struct work_struct *work)
 		} else if (ieee80211_is_action(mgmt->frame_control) &&
 			   mgmt->u.action.category == WLAN_CATEGORY_VHT) {
 			switch (mgmt->u.action.u.vht_group_notif.action_code) {
+			case WLAN_VHT_ACTION_OPMODE_NOTIF: {
+				struct ieee80211_rx_status *status;
+				enum nl80211_band band;
+				u8 opmode;
+
+				status = IEEE80211_SKB_RXCB(skb);
+				band = status->band;
+				opmode = mgmt->u.action.u.vht_opmode_notif.operating_mode;
+
+				mutex_lock(&local->sta_mtx);
+				sta = sta_info_get_bss(sdata, mgmt->sa);
+
+				if (sta)
+					ieee80211_vht_handle_opmode(sdata, sta,
+								    opmode,
+								    band);
+
+				mutex_unlock(&local->sta_mtx);
+				break;
+			}
 			case WLAN_VHT_ACTION_GROUPID_MGMT:
 				ieee80211_process_mu_groups(sdata, mgmt);
 				break;
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index acaaf616da71..c2a028eb7723 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2918,17 +2918,10 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
 
 		switch (mgmt->u.action.u.vht_opmode_notif.action_code) {
 		case WLAN_VHT_ACTION_OPMODE_NOTIF: {
-			u8 opmode;
-
 			/* verify opmode is present */
 			if (len < IEEE80211_MIN_ACTION_SIZE + 2)
 				goto invalid;
-
-			opmode = mgmt->u.action.u.vht_opmode_notif.operating_mode;
-
-			ieee80211_vht_handle_opmode(rx->sdata, rx->sta,
-						    opmode, status->band);
-			goto handled;
+			goto queue;
 		}
 		case WLAN_VHT_ACTION_GROUPID_MGMT: {
 			if (len < IEEE80211_MIN_ACTION_SIZE + 25)
diff --git a/net/mac80211/vht.c b/net/mac80211/vht.c
index 6832bf6ab69f..43e45bb660bc 100644
--- a/net/mac80211/vht.c
+++ b/net/mac80211/vht.c
@@ -527,8 +527,10 @@ void ieee80211_vht_handle_opmode(struct ieee80211_sub_if_data *sdata,
 
 	u32 changed = __ieee80211_vht_handle_opmode(sdata, sta, opmode, band);
 
-	if (changed > 0)
+	if (changed > 0) {
+		ieee80211_recalc_min_chandef(sdata);
 		rate_control_rate_update(local, sband, sta, changed);
+	}
 }
 
 void ieee80211_get_vht_mask_from_cap(__le16 vht_cap,
-- 
2.11.0

[toc] | [prev] | [next] | [standalone]

#1668434 — [PATCH for v4.9 LTS 49/86] kernel/panic.c: add missing \n

From: Jiri Slaby <jslaby@suse.cz>

[ Upstream commit ff7a28a074ccbea999dadbb58c46212cf90984c6 ]

When a system panics, the "Rebooting in X seconds.." message is never
printed because it lacks a new line.  Fix it.

Link: http://lkml.kernel.org/r/20170119114751.2724-1-jslaby@suse.cz
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
---
 kernel/panic.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/panic.c b/kernel/panic.c
index e6480e20379e..dbec387099b1 100644
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -249,7 +249,7 @@ void panic(const char *fmt, ...)
 		 * Delay timeout seconds before rebooting the machine.
 		 * We can't use the "normal" timers since we just panicked.
 		 */
-		pr_emerg("Rebooting in %d seconds..", panic_timeout);
+		pr_emerg("Rebooting in %d seconds..\n", panic_timeout);
 
 		for (i = 0; i < panic_timeout * 1000; i += PANIC_TIMER_STEP) {
 			touch_nmi_watchdog();
-- 
2.11.0

[toc] | [prev] | [next] | [standalone]

#1668435 — [PATCH for v4.9 LTS 74/86] aio: fix lock dep warning

From: Shaohua Li <shli@fb.com>

[ Upstream commit a12f1ae61c489076a9aeb90bddca7722bf330df3 ]

lockdep reports a warnning. file_start_write/file_end_write only
acquire/release the lock for regular files. So checking the files in aio
side too.

[  453.532141] ------------[ cut here ]------------
[  453.533011] WARNING: CPU: 1 PID: 1298 at ../kernel/locking/lockdep.c:3514 lock_release+0x434/0x670
[  453.533011] DEBUG_LOCKS_WARN_ON(depth <= 0)
[  453.533011] Modules linked in:
[  453.533011] CPU: 1 PID: 1298 Comm: fio Not tainted 4.9.0+ #964
[  453.533011] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.9.0-1.fc24 04/01/2014
[  453.533011]  ffff8803a24b7a70 ffffffff8196cffb ffff8803a24b7ae8 0000000000000000
[  453.533011]  ffff8803a24b7ab8 ffffffff81091ee1 ffff8803a5dba700 00000dba00000008
[  453.533011]  ffffed0074496f59 ffff8803a5dbaf54 ffff8803ae0f8488 fffffffffffffdef
[  453.533011] Call Trace:
[  453.533011]  [<ffffffff8196cffb>] dump_stack+0x67/0x9c
[  453.533011]  [<ffffffff81091ee1>] __warn+0x111/0x130
[  453.533011]  [<ffffffff81091f97>] warn_slowpath_fmt+0x97/0xb0
[  453.533011]  [<ffffffff81091f00>] ? __warn+0x130/0x130
[  453.533011]  [<ffffffff8191b789>] ? blk_finish_plug+0x29/0x60
[  453.533011]  [<ffffffff811205d4>] lock_release+0x434/0x670
[  453.533011]  [<ffffffff8198af94>] ? import_single_range+0xd4/0x110
[  453.533011]  [<ffffffff81322195>] ? rw_verify_area+0x65/0x140
[  453.533011]  [<ffffffff813aa696>] ? aio_write+0x1f6/0x280
[  453.533011]  [<ffffffff813aa6c9>] aio_write+0x229/0x280
[  453.533011]  [<ffffffff813aa4a0>] ? aio_complete+0x640/0x640
[  453.533011]  [<ffffffff8111df20>] ? debug_check_no_locks_freed+0x1a0/0x1a0
[  453.533011]  [<ffffffff8114793a>] ? debug_lockdep_rcu_enabled.part.2+0x1a/0x30
[  453.533011]  [<ffffffff81147985>] ? debug_lockdep_rcu_enabled+0x35/0x40
[  453.533011]  [<ffffffff812a92be>] ? __might_fault+0x7e/0xf0
[  453.533011]  [<ffffffff813ac9bc>] do_io_submit+0x94c/0xb10
[  453.533011]  [<ffffffff813ac2ae>] ? do_io_submit+0x23e/0xb10
[  453.533011]  [<ffffffff813ac070>] ? SyS_io_destroy+0x270/0x270
[  453.533011]  [<ffffffff8111d7b3>] ? mark_held_locks+0x23/0xc0
[  453.533011]  [<ffffffff8100201a>] ? trace_hardirqs_on_thunk+0x1a/0x1c
[  453.533011]  [<ffffffff813acb90>] SyS_io_submit+0x10/0x20
[  453.533011]  [<ffffffff824f96aa>] entry_SYSCALL_64_fastpath+0x18/0xad
[  453.533011]  [<ffffffff81119190>] ? trace_hardirqs_off_caller+0xc0/0x110
[  453.533011] ---[ end trace b2fbe664d1cc0082 ]---

Cc: Dmitry Monakhov <dmonakhov@openvz.org>
Cc: Jan Kara <jack@suse.cz>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Shaohua Li <shli@fb.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
---
 fs/aio.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/fs/aio.c b/fs/aio.c
index 428484f2f841..0fcb49ad67d4 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -1085,7 +1085,8 @@ static void aio_complete(struct kiocb *kiocb, long res, long res2)
 		 * Tell lockdep we inherited freeze protection from submission
 		 * thread.
 		 */
-		__sb_writers_acquired(file_inode(file)->i_sb, SB_FREEZE_WRITE);
+		if (S_ISREG(file_inode(file)->i_mode))
+			__sb_writers_acquired(file_inode(file)->i_sb, SB_FREEZE_WRITE);
 		file_end_write(file);
 	}
 
@@ -1492,7 +1493,8 @@ static ssize_t aio_write(struct kiocb *req, struct iocb *iocb, bool vectored,
 		 * by telling it the lock got released so that it doesn't
 		 * complain about held lock when we return to userspace.
 		 */
-		__sb_writers_release(file_inode(file)->i_sb, SB_FREEZE_WRITE);
+		if (S_ISREG(file_inode(file)->i_mode))
+			__sb_writers_release(file_inode(file)->i_sb, SB_FREEZE_WRITE);
 	}
 	kfree(iovec);
 	return ret;
-- 
2.11.0

[toc] | [prev] | [next] | [standalone]

#1668436 — [PATCH for v4.9 LTS 47/86] vxlan: do not age static remote mac entries

From: Balakrishnan Raman <ramanb@cumulusnetworks.com>

[ Upstream commit efb5f68f32995c146944a9d4257c3cf8eae2c4a1 ]

Mac aging is applicable only for dynamically learnt remote mac
entries. Check for user configured static remote mac entries
and skip aging.

Signed-off-by: Balakrishnan Raman <ramanb@cumulusnetworks.com>
Signed-off-by: Roopa Prabhu <roopa@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
---
 drivers/net/vxlan.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 55c4408892be..963e5339a4d7 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -2285,7 +2285,7 @@ static void vxlan_cleanup(unsigned long arg)
 				= container_of(p, struct vxlan_fdb, hlist);
 			unsigned long timeout;
 
-			if (f->state & NUD_PERMANENT)
+			if (f->state & (NUD_PERMANENT | NUD_NOARP))
 				continue;
 
 			timeout = f->used + vxlan->cfg.age_interval * HZ;
-- 
2.11.0

[toc] | [prev] | [next] | [standalone]

#1668437 — [PATCH for v4.9 LTS 36/86] xen-netfront: Fix Rx stall during network stress and OOM

From: Vineeth Remanan Pillai <vineethp@amazon.com>

[ Upstream commit 90c311b0eeead647b708a723dbdde1eda3dcad05 ]

During an OOM scenario, request slots could not be created as skb
allocation fails. So the netback cannot pass in packets and netfront
wrongly assumes that there is no more work to be done and it disables
polling. This causes Rx to stall.

The issue is with the retry logic which schedules the timer if the
created slots are less than NET_RX_SLOTS_MIN. The count of new request
slots to be pushed are calculated as a difference between new req_prod
and rsp_cons which could be more than the actual slots, if there are
unconsumed responses.

The fix is to calculate the count of newly created slots as the
difference between new req_prod and old req_prod.

Signed-off-by: Vineeth Remanan Pillai <vineethp@amazon.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
---
 drivers/net/xen-netfront.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index 0cdcb2169083..599cf5090030 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -321,7 +321,7 @@ static void xennet_alloc_rx_buffers(struct netfront_queue *queue)
 	queue->rx.req_prod_pvt = req_prod;
 
 	/* Not enough requests? Try again later. */
-	if (req_prod - queue->rx.rsp_cons < NET_RX_SLOTS_MIN) {
+	if (req_prod - queue->rx.sring->req_prod < NET_RX_SLOTS_MIN) {
 		mod_timer(&queue->rx_refill_timer, jiffies + (HZ/10));
 		return;
 	}
-- 
2.11.0

[toc] | [prev] | [next] | [standalone]

#1668438 — [PATCH for v4.9 LTS 40/86] amd-xgbe: Check xgbe_init() return code

From: "Lendacky, Thomas" <Thomas.Lendacky@amd.com>

[ Upstream commit 738f7f647371ff4cfc9646c99dba5b58ad142db3 ]

The xgbe_init() routine returns a return code indicating success or
failure, but the return code is not checked. Add code to xgbe_init()
to issue a message when failures are seen and add code to check the
xgbe_init() return code.

Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
---
 drivers/net/ethernet/amd/xgbe/xgbe-dev.c | 4 +++-
 drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 4 +++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-dev.c b/drivers/net/ethernet/amd/xgbe/xgbe-dev.c
index ca106d4275cc..3424435a39dd 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-dev.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-dev.c
@@ -2825,8 +2825,10 @@ static int xgbe_init(struct xgbe_prv_data *pdata)
 
 	/* Flush Tx queues */
 	ret = xgbe_flush_tx_queues(pdata);
-	if (ret)
+	if (ret) {
+		netdev_err(pdata->netdev, "error flushing TX queues\n");
 		return ret;
+	}
 
 	/*
 	 * Initialize DMA related features
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
index 0f0f30149e5a..1e4e8b245cd5 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
@@ -877,7 +877,9 @@ static int xgbe_start(struct xgbe_prv_data *pdata)
 
 	DBGPR("-->xgbe_start\n");
 
-	hw_if->init(pdata);
+	ret = hw_if->init(pdata);
+	if (ret)
+		return ret;
 
 	ret = phy_if->phy_start(pdata);
 	if (ret)
-- 
2.11.0

[toc] | [prev] | [next] | [standalone]

#1668440 — [PATCH for v4.9 LTS 29/86] objtool: Fix IRET's opcode

From: Jiri Slaby <jslaby@suse.cz>

[ Upstream commit b5b46c4740aed1538544f0fa849c5b76c7823469 ]

The IRET opcode is 0xcf according to the Intel manual and also to objdump of my
vmlinux:

    1ea8:       48 cf                   iretq

Fix the opcode in arch_decode_instruction().

The previous value (0xc5) seems to correspond to LDS.

Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Acked-by: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/20170118132921.19319-1-jslaby@suse.cz
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
---
 tools/objtool/arch/x86/decode.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/objtool/arch/x86/decode.c b/tools/objtool/arch/x86/decode.c
index 5e0dea2cdc01..039636ffb6c8 100644
--- a/tools/objtool/arch/x86/decode.c
+++ b/tools/objtool/arch/x86/decode.c
@@ -150,9 +150,9 @@ int arch_decode_instruction(struct elf *elf, struct section *sec,
 		*type = INSN_RETURN;
 		break;
 
-	case 0xc5: /* iret */
 	case 0xca: /* retf */
 	case 0xcb: /* retf */
+	case 0xcf: /* iret */
 		*type = INSN_CONTEXT_SWITCH;
 		break;
 
-- 
2.11.0

[toc] | [prev] | [next] | [standalone]

#1668441 — [PATCH for v4.9 LTS 67/86] pmem: return EIO on read_pmem() failure

From: Stefan Hajnoczi <stefanha@redhat.com>

[ Upstream commit d47d1d27fd6206c18806440f6ebddf51a806be4f ]

The read_pmem() function uses memcpy_mcsafe() on x86 where an EFAULT
error code indicates a failed read.  Block I/O should use EIO to
indicate failure.  Other pmem code paths (like bad blocks) already use
EIO so let's be consistent.

This fixes compatibility with consumers like btrfs that try to parse the
specific error code rather than treat all errors the same.

Reviewed-by: Jeff Moyer <jmoyer@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
---
 drivers/nvdimm/pmem.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/nvdimm/pmem.c b/drivers/nvdimm/pmem.c
index b4808590870c..3456f532077c 100644
--- a/drivers/nvdimm/pmem.c
+++ b/drivers/nvdimm/pmem.c
@@ -87,7 +87,9 @@ static int read_pmem(struct page *page, unsigned int off,
 
 	rc = memcpy_from_pmem(mem + off, pmem_addr, len);
 	kunmap_atomic(mem);
-	return rc;
+	if (rc)
+		return -EIO;
+	return 0;
 }
 
 static int pmem_do_bvec(struct pmem_device *pmem, struct page *page,
-- 
2.11.0

[toc] | [prev] | [next] | [standalone]

#1668442 — [PATCH for v4.9 LTS 56/86] perf/x86/intel: Use ULL constant to prevent undefined shift behaviour

From: Colin King <colin.king@canonical.com>

[ Upstream commit ad5013d5699d30ded0cdbbc68b93b2aa28222c6e ]

When x86_pmu.num_counters is 32 the shift of the integer constant 1 is
exceeding 32bit and therefor undefined behaviour.

Fix this by shifting 1ULL instead of 1.

Reported-by: CoverityScan CID#1192105 ("Bad bit shift operation")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Kan Liang <kan.liang@intel.com>
Cc: Stephane Eranian <eranian@google.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Link: http://lkml.kernel.org/r/20170111114310.17928-1-colin.king@canonical.com
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
---
 arch/x86/events/intel/core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
index 8d7a6a0f7d2f..2d60044624b3 100644
--- a/arch/x86/events/intel/core.c
+++ b/arch/x86/events/intel/core.c
@@ -3978,7 +3978,7 @@ __init int intel_pmu_init(void)
 		     x86_pmu.num_counters, INTEL_PMC_MAX_GENERIC);
 		x86_pmu.num_counters = INTEL_PMC_MAX_GENERIC;
 	}
-	x86_pmu.intel_ctrl = (1 << x86_pmu.num_counters) - 1;
+	x86_pmu.intel_ctrl = (1ULL << x86_pmu.num_counters) - 1;
 
 	if (x86_pmu.num_counters_fixed > INTEL_PMC_MAX_FIXED) {
 		WARN(1, KERN_ERR "hw perf events fixed %d > max(%d), clipping!",
-- 
2.11.0

[toc] | [prev] | [next] | [standalone]

#1668443 — [PATCH for v4.9 LTS 30/86] gianfar: Do not reuse pages from emergency reserve

From: Eric Dumazet <edumazet@google.com>

[ Upstream commit 69fed99baac186013840ced3524562841296034f ]

A driver using dev_alloc_page() must not reuse a page that had to
use emergency memory reserve.

Otherwise all packets using this page will be immediately dropped,
unless for very specific sockets having SOCK_MEMALLOC bit set.

This issue might be hard to debug, because only a fraction of the RX
ring buffer would suffer from drops.

Fixes: 75354148ce69 ("gianfar: Add paged allocation and Rx S/G")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Claudiu Manoil <claudiu.manoil@freescale.com>
Acked-by: Claudiu Manoil <claudiu.manoil@nxp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
---
 drivers/net/ethernet/freescale/gianfar.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
index d391beebe591..3f4e71148808 100644
--- a/drivers/net/ethernet/freescale/gianfar.c
+++ b/drivers/net/ethernet/freescale/gianfar.c
@@ -2951,7 +2951,7 @@ static bool gfar_add_rx_frag(struct gfar_rx_buff *rxb, u32 lstatus,
 	}
 
 	/* try reuse page */
-	if (unlikely(page_count(page) != 1))
+	if (unlikely(page_count(page) != 1 || page_is_pfmemalloc(page)))
 		return false;
 
 	/* change offset to the other half */
-- 
2.11.0

[toc] | [prev] | [next] | [standalone]

#1668444 — [PATCH for v4.9 LTS 21/86] drm/amdgpu: add support for new hainan variants

From: Alex Deucher <alexander.deucher@amd.com>

[ Upstream commit 17324b6add82d6c0bf119f1d1944baef392a4e39 ]

New hainan parts require updated smc firmware.

Cc: Sonny Jiang <sonny.jiang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
---
 drivers/gpu/drm/amd/amdgpu/si_dpm.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/si_dpm.c b/drivers/gpu/drm/amd/amdgpu/si_dpm.c
index 6f3c89178b6a..4cb347e88cf0 100644
--- a/drivers/gpu/drm/amd/amdgpu/si_dpm.c
+++ b/drivers/gpu/drm/amd/amdgpu/si_dpm.c
@@ -64,6 +64,7 @@ MODULE_FIRMWARE("radeon/oland_smc.bin");
 MODULE_FIRMWARE("radeon/oland_k_smc.bin");
 MODULE_FIRMWARE("radeon/hainan_smc.bin");
 MODULE_FIRMWARE("radeon/hainan_k_smc.bin");
+MODULE_FIRMWARE("radeon/banks_k_2_smc.bin");
 
 union power_info {
 	struct _ATOM_POWERPLAY_INFO info;
@@ -7721,10 +7722,11 @@ static int si_dpm_init_microcode(struct amdgpu_device *adev)
 			((adev->pdev->device == 0x6660) ||
 			(adev->pdev->device == 0x6663) ||
 			(adev->pdev->device == 0x6665) ||
-			(adev->pdev->device == 0x6667))) ||
-		    ((adev->pdev->revision == 0xc3) &&
-			(adev->pdev->device == 0x6665)))
+			 (adev->pdev->device == 0x6667))))
 			chip_name = "hainan_k";
+		else if ((adev->pdev->revision == 0xc3) &&
+			 (adev->pdev->device == 0x6665))
+			chip_name = "banks_k_2";
 		else
 			chip_name = "hainan";
 		break;
-- 
2.11.0

[toc] | [prev] | [next] | [standalone]

#1668445 — [PATCH for v4.9 LTS 35/86] net: sctp: fix array overrun read on sctp_timer_tbl

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit 0e73fc9a56f22f2eec4d2b2910c649f7af67b74d ]

The comparison on the timeout can lead to an array overrun
read on sctp_timer_tbl because of an off-by-one error. Fix
this by using < instead of <= and also compare to the array
size rather than SCTP_EVENT_TIMEOUT_MAX.

Fixes CoverityScan CID#1397639 ("Out-of-bounds read")

Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
---
 net/sctp/debug.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/sctp/debug.c b/net/sctp/debug.c
index 95d7b15dad21..e371a0d90068 100644
--- a/net/sctp/debug.c
+++ b/net/sctp/debug.c
@@ -166,7 +166,7 @@ static const char *const sctp_timer_tbl[] = {
 /* Lookup timer debug name. */
 const char *sctp_tname(const sctp_subtype_t id)
 {
-	if (id.timeout <= SCTP_EVENT_TIMEOUT_MAX)
+	if (id.timeout < ARRAY_SIZE(sctp_timer_tbl))
 		return sctp_timer_tbl[id.timeout];
 	return "unknown_timer";
 }
-- 
2.11.0

[toc] | [prev] | [next] | [standalone]

#1668446 — [PATCH for v4.9 LTS 57/86] HID: i2c-hid: Add sleep between POWER ON and RESET

From: Brendan McGrath <redmcg@redmandi.dyndns.org>

[ Upstream commit a89af4abdf9b353cdd6f61afc0eaaac403304873 ]

Support for the Asus Touchpad was recently added. It turns out this
device can fail initialisation (and become unusable) when the RESET
command is sent too soon after the POWER ON command.

Unfortunately the i2c-hid specification does not specify the need for
a delay between these two commands. But it was discovered the Windows
driver has a 1ms delay.

As a result, this patch modifies the i2c-hid module to add a sleep
inbetween the POWER ON and RESET commands which lasts between 1ms and 5ms.

See https://github.com/vlasenko/hid-asus-dkms/issues/24 for further
details.

Signed-off-by: Brendan McGrath <redmcg@redmandi.dyndns.org>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
---
 drivers/hid/i2c-hid/i2c-hid.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c
index b1bce804fe97..8008e06b7efe 100644
--- a/drivers/hid/i2c-hid/i2c-hid.c
+++ b/drivers/hid/i2c-hid/i2c-hid.c
@@ -427,6 +427,15 @@ static int i2c_hid_hwreset(struct i2c_client *client)
 	if (ret)
 		goto out_unlock;
 
+	/*
+	 * The HID over I2C specification states that if a DEVICE needs time
+	 * after the PWR_ON request, it should utilise CLOCK stretching.
+	 * However, it has been observered that the Windows driver provides a
+	 * 1ms sleep between the PWR_ON and RESET requests and that some devices
+	 * rely on this.
+	 */
+	usleep_range(1000, 5000);
+
 	i2c_hid_dbg(ihid, "resetting...\n");
 
 	ret = i2c_hid_command(client, &hid_reset_cmd, NULL, 0);
-- 
2.11.0

[toc] | [prev] | [next] | [standalone]

#1668447 — [PATCH for v4.9 LTS 46/86] ip6_tunnel: must reload ipv6h in ip6ip6_tnl_xmit()

From: Eric Dumazet <edumazet@google.com>

[ Upstream commit 21b995a9cb093fff33ec91d7cb3822b882a90a1e ]

Since ip6_tnl_parse_tlv_enc_lim() can call pskb_may_pull(),
we must reload any pointer that was related to skb->head
(or skb->data), or risk use after free.

Fixes: c12b395a4664 ("gre: Support GRE over IPv6")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Dmitry Kozlov <xeb@mail.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
---
 net/ipv6/ip6_gre.c    | 3 +++
 net/ipv6/ip6_tunnel.c | 2 ++
 2 files changed, 5 insertions(+)

diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 0a5922055da2..a5fdc1aa7a9a 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -582,6 +582,9 @@ static inline int ip6gre_xmit_ipv6(struct sk_buff *skb, struct net_device *dev)
 		return -1;
 
 	offset = ip6_tnl_parse_tlv_enc_lim(skb, skb_network_header(skb));
+	/* ip6_tnl_parse_tlv_enc_lim() might have reallocated skb->head */
+	ipv6h = ipv6_hdr(skb);
+
 	if (offset > 0) {
 		struct ipv6_tlv_tnl_enc_lim *tel;
 		tel = (struct ipv6_tlv_tnl_enc_lim *)&skb_network_header(skb)[offset];
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 116b4da06820..63fad2467a7e 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1313,6 +1313,8 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
 		fl6.flowlabel = key->label;
 	} else {
 		offset = ip6_tnl_parse_tlv_enc_lim(skb, skb_network_header(skb));
+		/* ip6_tnl_parse_tlv_enc_lim() might have reallocated skb->head */
+		ipv6h = ipv6_hdr(skb);
 		if (offset > 0) {
 			struct ipv6_tlv_tnl_enc_lim *tel;
 
-- 
2.11.0

[toc] | [prev] | [next] | [standalone]

#1668448 — [PATCH for v4.9 LTS 78/86] usb: dwc2: gadget: Fix GUSBCFG.USBTRDTIM value

From: Amelie Delaunay <amelie.delaunay@st.com>

[ Upstream commit ca02954ada711b08e5b0d84590a631fd63ed39f9 ]

USBTrdTim must be programmed to 0x5 when phy has a UTMI+ 16-bit wide
interface or 0x9 when it has a 8-bit wide interface.
GUSBCFG reset value (Value After Reset: 0x1400) sets USBTrdTim to 0x5.
In case of 8-bit UTMI+, without clearing GUSBCFG.USBTRDTIM mask, USBTrdTim
results in 0xD (0x5 | 0x9).
That's why we need to clear GUSBCFG.USBTRDTIM mask before setting USBTrdTim
value, to ensure USBTrdTim is correctly set in case of 8-bit UTMI+.

Signed-off-by: Amelie Delaunay <amelie.delaunay@st.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
---
 drivers/usb/dwc2/gadget.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
index 24fbebc9b409..cfdd5c3da236 100644
--- a/drivers/usb/dwc2/gadget.c
+++ b/drivers/usb/dwc2/gadget.c
@@ -2532,7 +2532,7 @@ void dwc2_hsotg_core_init_disconnected(struct dwc2_hsotg *hsotg,
 	/* keep other bits untouched (so e.g. forced modes are not lost) */
 	usbcfg = dwc2_readl(hsotg->regs + GUSBCFG);
 	usbcfg &= ~(GUSBCFG_TOUTCAL_MASK | GUSBCFG_PHYIF16 | GUSBCFG_SRPCAP |
-		GUSBCFG_HNPCAP);
+		GUSBCFG_HNPCAP | GUSBCFG_USBTRDTIM_MASK);
 
 	/* set the PLL on, remove the HNP/SRP and set the PHY */
 	val = (hsotg->phyif == GUSBCFG_PHYIF8) ? 9 : 5;
@@ -3403,7 +3403,7 @@ static void dwc2_hsotg_init(struct dwc2_hsotg *hsotg)
 	/* keep other bits untouched (so e.g. forced modes are not lost) */
 	usbcfg = dwc2_readl(hsotg->regs + GUSBCFG);
 	usbcfg &= ~(GUSBCFG_TOUTCAL_MASK | GUSBCFG_PHYIF16 | GUSBCFG_SRPCAP |
-		GUSBCFG_HNPCAP);
+		GUSBCFG_HNPCAP | GUSBCFG_USBTRDTIM_MASK);
 
 	/* set the PLL on, remove the HNP/SRP and set the PHY */
 	trdtim = (hsotg->phyif == GUSBCFG_PHYIF8) ? 9 : 5;
-- 
2.11.0

[toc] | [prev] | [next] | [standalone]

#1668449 — [PATCH for v4.9 LTS 53/86] pinctrl: intel: Set pin direction properly

From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>

[ Upstream commit 17fab473693e8357a9aa6fee4fbed6c13a34bd81 ]

There are two bits in the PADCFG0 register to configure direction, one per
TX/RX buffers.

For now we wrongly assume that the GPIO is always requested before it is being
used, which is not true when the GPIO is used through irqchip. In this case the
GPIO is never requested and we never enable RX buffer for it.

Fix this by setting both bits accordingly.

Reported-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
---
 drivers/pinctrl/intel/pinctrl-intel.c | 30 +++++++++++++++++++-----------
 1 file changed, 19 insertions(+), 11 deletions(-)

diff --git a/drivers/pinctrl/intel/pinctrl-intel.c b/drivers/pinctrl/intel/pinctrl-intel.c
index 01443762e570..b40a074822cf 100644
--- a/drivers/pinctrl/intel/pinctrl-intel.c
+++ b/drivers/pinctrl/intel/pinctrl-intel.c
@@ -353,6 +353,21 @@ static int intel_pinmux_set_mux(struct pinctrl_dev *pctldev, unsigned function,
 	return 0;
 }
 
+static void __intel_gpio_set_direction(void __iomem *padcfg0, bool input)
+{
+	u32 value;
+
+	value = readl(padcfg0);
+	if (input) {
+		value &= ~PADCFG0_GPIORXDIS;
+		value |= PADCFG0_GPIOTXDIS;
+	} else {
+		value &= ~PADCFG0_GPIOTXDIS;
+		value |= PADCFG0_GPIORXDIS;
+	}
+	writel(value, padcfg0);
+}
+
 static int intel_gpio_request_enable(struct pinctrl_dev *pctldev,
 				     struct pinctrl_gpio_range *range,
 				     unsigned pin)
@@ -375,11 +390,11 @@ static int intel_gpio_request_enable(struct pinctrl_dev *pctldev,
 	/* Disable SCI/SMI/NMI generation */
 	value &= ~(PADCFG0_GPIROUTIOXAPIC | PADCFG0_GPIROUTSCI);
 	value &= ~(PADCFG0_GPIROUTSMI | PADCFG0_GPIROUTNMI);
-	/* Disable TX buffer and enable RX (this will be input) */
-	value &= ~PADCFG0_GPIORXDIS;
-	value |= PADCFG0_GPIOTXDIS;
 	writel(value, padcfg0);
 
+	/* Disable TX buffer and enable RX (this will be input) */
+	__intel_gpio_set_direction(padcfg0, true);
+
 	raw_spin_unlock_irqrestore(&pctrl->lock, flags);
 
 	return 0;
@@ -392,18 +407,11 @@ static int intel_gpio_set_direction(struct pinctrl_dev *pctldev,
 	struct intel_pinctrl *pctrl = pinctrl_dev_get_drvdata(pctldev);
 	void __iomem *padcfg0;
 	unsigned long flags;
-	u32 value;
 
 	raw_spin_lock_irqsave(&pctrl->lock, flags);
 
 	padcfg0 = intel_get_padcfg(pctrl, pin, PADCFG0);
-
-	value = readl(padcfg0);
-	if (input)
-		value |= PADCFG0_GPIOTXDIS;
-	else
-		value &= ~PADCFG0_GPIOTXDIS;
-	writel(value, padcfg0);
+	__intel_gpio_set_direction(padcfg0, input);
 
 	raw_spin_unlock_irqrestore(&pctrl->lock, flags);
 
-- 
2.11.0

[toc] | [prev] | [next] | [standalone]

#1668450 — [PATCH for v4.9 LTS 86/86] net/mlx4_core: Eliminate warning messages for SRQ_LIMIT under SRIOV

From: Jack Morgenstein <jackm@dev.mellanox.co.il>

[ Upstream commit 9577b174cd0323d287c994ef0891db71666d0765 ]

When running SRIOV, warnings for SRQ LIMIT events flood the Hypervisor's
message log when (correct, normally operating) apps use SRQ LIMIT events
as a trigger to post WQEs to SRQs.

Add more information to the existing debug printout for SRQ_LIMIT, and
output the warning messages only for the SRQ CATAS ERROR event.

Fixes: acba2420f9d2 ("mlx4_core: Add wrapper functions and comm channel and slave event support to EQs")
Fixes: e0debf9cb50d ("mlx4_core: Reduce warning message for SRQ_LIMIT event to debug level")
Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
Signed-off-by: Tariq Toukan <tariqt@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
---
 drivers/net/ethernet/mellanox/mlx4/eq.c | 23 ++++++++++++++---------
 1 file changed, 14 insertions(+), 9 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx4/eq.c b/drivers/net/ethernet/mellanox/mlx4/eq.c
index cd3638e6fe25..0509996957d9 100644
--- a/drivers/net/ethernet/mellanox/mlx4/eq.c
+++ b/drivers/net/ethernet/mellanox/mlx4/eq.c
@@ -554,8 +554,9 @@ static int mlx4_eq_int(struct mlx4_dev *dev, struct mlx4_eq *eq)
 			break;
 
 		case MLX4_EVENT_TYPE_SRQ_LIMIT:
-			mlx4_dbg(dev, "%s: MLX4_EVENT_TYPE_SRQ_LIMIT\n",
-				 __func__);
+			mlx4_dbg(dev, "%s: MLX4_EVENT_TYPE_SRQ_LIMIT. srq_no=0x%x, eq 0x%x\n",
+				 __func__, be32_to_cpu(eqe->event.srq.srqn),
+				 eq->eqn);
 		case MLX4_EVENT_TYPE_SRQ_CATAS_ERROR:
 			if (mlx4_is_master(dev)) {
 				/* forward only to slave owning the SRQ */
@@ -570,15 +571,19 @@ static int mlx4_eq_int(struct mlx4_dev *dev, struct mlx4_eq *eq)
 						  eq->eqn, eq->cons_index, ret);
 					break;
 				}
-				mlx4_warn(dev, "%s: slave:%d, srq_no:0x%x, event: %02x(%02x)\n",
-					  __func__, slave,
-					  be32_to_cpu(eqe->event.srq.srqn),
-					  eqe->type, eqe->subtype);
+				if (eqe->type ==
+				    MLX4_EVENT_TYPE_SRQ_CATAS_ERROR)
+					mlx4_warn(dev, "%s: slave:%d, srq_no:0x%x, event: %02x(%02x)\n",
+						  __func__, slave,
+						  be32_to_cpu(eqe->event.srq.srqn),
+						  eqe->type, eqe->subtype);
 
 				if (!ret && slave != dev->caps.function) {
-					mlx4_warn(dev, "%s: sending event %02x(%02x) to slave:%d\n",
-						  __func__, eqe->type,
-						  eqe->subtype, slave);
+					if (eqe->type ==
+					    MLX4_EVENT_TYPE_SRQ_CATAS_ERROR)
+						mlx4_warn(dev, "%s: sending event %02x(%02x) to slave:%d\n",
+							  __func__, eqe->type,
+							  eqe->subtype, slave);
 					mlx4_slave_event(dev, slave, eqe);
 					break;
 				}
-- 
2.11.0

[toc] | [prev] | [next] | [standalone]

#1668451 — [PATCH for v4.9 LTS 42/86] drm/amdgpu: check ring being ready before using

From: Ding Pixel <pding@amd.com>

[ Upstream commit c5f21c9f878b8dcd54d0b9739c025ca73cb4c091 ]

Return success when the ring is properly initialized, otherwise return
failure.

Tonga SRIOV VF doesn't have UVD and VCE engines, the initialization of
these IPs is bypassed. The system crashes if application submit IB to
their rings which are not ready to use. It could be a common issue if
IP having ring buffer is disabled for some reason on specific ASIC, so
it should check the ring being ready to use.

Bug: amdgpu_test crashes system on Tonga VF.

Signed-off-by: Ding Pixel <Pixel.Ding@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
index 82dc8d20e28a..bfb4b91869e7 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
@@ -83,6 +83,13 @@ int amdgpu_cs_get_ring(struct amdgpu_device *adev, u32 ip_type,
 		}
 		break;
 	}
+
+	if (!(*out_ring && (*out_ring)->adev)) {
+		DRM_ERROR("Ring %d is not initialized on IP %d\n",
+			  ring, ip_type);
+		return -EINVAL;
+	}
+
 	return 0;
 }
 
-- 
2.11.0

[toc] | [prev] | [next] | [standalone]

Page 2 of 5 — ← Prev page 1 [2] 3 4 5  Next page →

Back to top | Article view | linux.kernel

csiph-web