OSDN Git Service
Linux Build Service Account [Thu, 4 Oct 2018 21:58:29 +0000 (14:58 -0700)]
Merge "fbdev/msm: sanitize debugfs inputs when reading mdp memory"
Linux Build Service Account [Thu, 4 Oct 2018 21:58:24 +0000 (14:58 -0700)]
Merge "drm/msm: add checksum for HDR infoframe"
Linux Build Service Account [Thu, 4 Oct 2018 02:21:11 +0000 (19:21 -0700)]
Merge "cnss2: Add support for genoa pcie"
Linux Build Service Account [Thu, 4 Oct 2018 02:21:10 +0000 (19:21 -0700)]
Merge "soc: qcom: hab: fix the soft lockup in vchan free schedule"
Linux Build Service Account [Thu, 4 Oct 2018 02:21:09 +0000 (19:21 -0700)]
Merge "soc: hab: change lifecycle of exp_id from vchan to ctx"
Linux Build Service Account [Thu, 4 Oct 2018 02:21:08 +0000 (19:21 -0700)]
Merge "soc: hab: fix mmap failure issue when hab import"
Linux Build Service Account [Thu, 4 Oct 2018 02:21:07 +0000 (19:21 -0700)]
Merge "ARM: dts: msm: Add pin control settings for UFS reset on SDM660"
Linux Build Service Account [Thu, 4 Oct 2018 02:21:06 +0000 (19:21 -0700)]
Merge "pinctrl: qcom: Add UFS_RESET pin data for sdm660"
Linux Build Service Account [Thu, 4 Oct 2018 02:21:05 +0000 (19:21 -0700)]
Merge "dwc3: resize txfifo of IN/INT endpoint before enabling it"
Linux Build Service Account [Thu, 4 Oct 2018 02:21:04 +0000 (19:21 -0700)]
Merge "Merge android-4.4.157 (
c139ea66) into msm-4.4"
Linux Build Service Account [Thu, 4 Oct 2018 02:21:03 +0000 (19:21 -0700)]
Merge "Merge android-4.4.156 (
7eb7037) into msm-4.4"
Linux Build Service Account [Thu, 4 Oct 2018 02:21:03 +0000 (19:21 -0700)]
Merge "drm/msm: add additional HDR state transition"
Linux Build Service Account [Thu, 4 Oct 2018 02:21:02 +0000 (19:21 -0700)]
Merge "ARM: dts: msm: Enable Native SSR for WLAN on GVMQ"
Linux Build Service Account [Thu, 4 Oct 2018 02:21:01 +0000 (19:21 -0700)]
Merge "clk: qcom: mdss: add support for dynamic refresh on DSI 14nm PLL"
Linux Build Service Account [Thu, 4 Oct 2018 02:20:59 +0000 (19:20 -0700)]
Merge "page-flags: define PG_locked behavior on compound pages"
Linux Build Service Account [Thu, 4 Oct 2018 02:20:57 +0000 (19:20 -0700)]
Merge "drm/msm: clear colorimetry block info for HDMI"
Linux Build Service Account [Thu, 4 Oct 2018 02:20:56 +0000 (19:20 -0700)]
Merge "msm: vidc: copy the crop info during dequeue buf"
Linux Build Service Account [Thu, 4 Oct 2018 02:20:55 +0000 (19:20 -0700)]
Merge "usb: dwc3-msm: Release PM wakelock in host mode only for auto targets"
Abhinav Kumar [Sat, 22 Sep 2018 06:51:50 +0000 (23:51 -0700)]
drm/msm: add checksum for HDR infoframe
Checksum for the HDR infoframe is set to zero by default
as this is not a mandatory field as per the HDMI spec.
However certain HDMI sinks still expect a non-zero
checksum. Otherwise they disregard the infoframe
and the sink does not enter HDR mode despite other fields
of the infoframe being valid.
Add a valid checksum to the HDR infoframe to improve
interoperability of our HDR solution for HDMI.
Change-Id: Ie826e5e637fc1f053203bdcf6a829d0246a9ed67
Signed-off-by: Abhinav Kumar <abhinavk@codeaurora.org>
Yao Jiang [Thu, 27 Sep 2018 01:43:32 +0000 (09:43 +0800)]
soc: qcom: hab: fix the soft lockup in vchan free schedule
With a certain probability soft lockup when do hab vchan free schedule.
one vchan do the local hab close while another vchan in the same context
through softirq also try to acquire write lock in the free schedule at the
same time, it will cause watchdog bite. Disable local softirq could avoid
race condition handling between tasklet and process context.
Change-Id: I4ee9b980dab7ecb1986af1d61f70157fc30d1048
Signed-off-by: Yao Jiang <yaojia@codeaurora.org>
Jayachandran Sreekumaran [Tue, 3 Jul 2018 13:24:07 +0000 (18:54 +0530)]
cnss2: Add support for genoa pcie
Add genoa pcie specific qmi and power up/down handling.
Change-Id: I08e640f775de5436071b457225a8b61f13574d01
CRs-fixed:
2272303
Signed-off-by: Jayachandran Sreekumaran <jsreekum@codeaurora.org>
Abhinav Kumar [Wed, 19 Sep 2018 01:59:12 +0000 (18:59 -0700)]
drm/msm: add additional HDR state transition
Add an additional HDR state transition to cover the HDR
teardown sequence case.
This will avoid the HDR infoframe to be programmed repeatedly
if there is no change in its contents.
Change-Id: Ic2f077f0c2ff01e19db5a59b218c4d824e039773
Signed-off-by: Abhinav Kumar <abhinavk@codeaurora.org>
Signed-off-by: Navid Bahrani <nbahrani@codeaurora.org>
Srinivasarao P [Thu, 27 Sep 2018 08:38:40 +0000 (14:08 +0530)]
pinctrl: qcom: Add UFS_RESET pin data for sdm660
UFS_RESET is a single purpose output only pin which can be used to
send reset to connected UFS device. This change adds UFS_RESET
pin data.
Change-Id: I539ae2bef003bccf8aa9c23fb5dde0b263844629
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
Kirill A. Shutemov [Sat, 16 Jan 2016 00:51:24 +0000 (16:51 -0800)]
page-flags: define PG_locked behavior on compound pages
lock_page() must operate on the whole compound page. It doesn't make
much sense to lock part of compound page. Change code to use head
page's PG_locked, if tail page is passed.
This patch also gets rid of custom helper functions --
__set_page_locked() and __clear_page_locked(). They are replaced with
helpers generated by __SETPAGEFLAG/__CLEARPAGEFLAG. Tail pages to these
helper would trigger VM_BUG_ON().
SLUB uses PG_locked as a bit spin locked. IIUC, tail pages should never
appear there. VM_BUG_ON() is added to make sure that this assumption is
correct.
[akpm@linux-foundation.org: fix fs/cifs/file.c]
Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Dave Hansen <dave.hansen@intel.com>
Cc: Mel Gorman <mgorman@suse.de>
Cc: Rik van Riel <riel@redhat.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Christoph Lameter <cl@linux.com>
Cc: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Cc: Steve Capper <steve.capper@linaro.org>
Cc: "Aneesh Kumar K.V" <aneesh.kumar@linux.vnet.ibm.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Michal Hocko <mhocko@suse.cz>
Cc: Jerome Marchand <jmarchan@redhat.com>
Cc: Jérôme Glisse <jglisse@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Change-Id: Ifeeb98c789880ff34b286383568db60e08672205
Git-Commit:
48c935ad88f5be20eb5445a77c171351b1eb5111
Git-Repo: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
Signed-off-by: Vinayak Menon <vinmenon@codeaurora.org>
Kirill A. Shutemov [Sat, 16 Jan 2016 00:51:21 +0000 (16:51 -0800)]
page-flags: introduce page flags policies wrt compound pages
This patch adds a third argument to macros which create function
definitions for page flags. This argument defines how page-flags
helpers behave on compound functions.
For now we define four policies:
- PF_ANY: the helper function operates on the page it gets, regardless
if it's non-compound, head or tail.
- PF_HEAD: the helper function operates on the head page of the
compound page if it gets tail page.
- PF_NO_TAIL: only head and non-compond pages are acceptable for this
helper function.
- PF_NO_COMPOUND: only non-compound pages are acceptable for this
helper function.
For now we use policy PF_ANY for all helpers, which matches current
behaviour.
We do not enforce the policy for TESTPAGEFLAG, because we have flags
checked for random pages all over the kernel. Noticeable exception to
this is PageTransHuge() which triggers VM_BUG_ON() for tail page.
Change-Id: I7b7847a06d9ddaa91ec8fabbbf36772dd4501fb2
Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Dave Hansen <dave.hansen@intel.com>
Cc: Mel Gorman <mgorman@suse.de>
Cc: Rik van Riel <riel@redhat.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Christoph Lameter <cl@linux.com>
Cc: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Cc: Steve Capper <steve.capper@linaro.org>
Cc: "Aneesh Kumar K.V" <aneesh.kumar@linux.vnet.ibm.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Michal Hocko <mhocko@suse.cz>
Cc: Jerome Marchand <jmarchan@redhat.com>
Cc: Jérôme Glisse <jglisse@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Git-Commit:
95ad97554ac81b31139d4fe5ed8757a07087cd90
Git-Repo: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
Signed-off-by: Vinayak Menon <vinmenon@codeaurora.org>
Kirill A. Shutemov [Sat, 16 Jan 2016 00:51:17 +0000 (16:51 -0800)]
page-flags: move code around
The preparation patch: we are going to use compound_head(), PageTail()
and PageCompound() to define page-flags helpers.
Let's define them before macros.
We cannot user PageHead() helper in PageCompound() as it's not yet
defined -- use test_bit(PG_head, &page->flags) instead.
Change-Id: I7b6fb5e29c571f740a6390af87794496c5b4d240
Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Dave Hansen <dave.hansen@intel.com>
Cc: Mel Gorman <mgorman@suse.de>
Cc: Rik van Riel <riel@redhat.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Christoph Lameter <cl@linux.com>
Cc: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Cc: Steve Capper <steve.capper@linaro.org>
Cc: "Aneesh Kumar K.V" <aneesh.kumar@linux.vnet.ibm.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Michal Hocko <mhocko@suse.cz>
Cc: Jerome Marchand <jmarchan@redhat.com>
Cc: Jérôme Glisse <jglisse@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Git-Commit:
0e6d31a7336f41ef0375f5398c79e54de8e219b6
Git-Repo: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
Signed-off-by: Vinayak Menon <vinmenon@codeaurora.org>
Mayank Rana [Tue, 25 Apr 2017 20:48:46 +0000 (13:48 -0700)]
dwc3: resize txfifo of IN/INT endpoint before enabling it
USB IN/INT endpoint stalls when performing TX FIFO resize functionality
when IN/INT endpoint is already active i.e. usb endpoint is enabled and
usb request is pending with it. Fix this issue by making sure that TX
FIFO resize is performed before enabling endpoint which shall happen
after set_alt(1) and before any function queues request with its allocated
USB endpoint.
CRs-Fixed:
2039310
Change-Id: I13a590f87ab8492f7c95a15b2da9f00c9c63c4f9
Signed-off-by: Mayank Rana <mrana@codeaurora.org>
Signed-off-by: Ajay Agarwal <ajaya@codeaurora.org>
Paras Nagda [Fri, 21 Sep 2018 07:04:33 +0000 (12:34 +0530)]
msm: vidc: copy the crop info during dequeue buf
User-space expects the crop data to be notified from the
driver as it was done in kernel 3.16 as part-of
reserved field of v4l2planes.
On 4.4 kernel, as the v4l2planes are removed this
change is required for indicating the crop info
to user client.
Change-Id: I065e514cdd45bfe17206e0e18416a2313bc6a344
Signed-off-by: Paras Nagda <pnagda@codeaurora.org>
Venkata Rao Kakani [Thu, 20 Sep 2018 07:01:23 +0000 (12:31 +0530)]
ARM: dts: msm: Enable Native SSR for WLAN on GVMQ
Since WLAN is passthrough block for LA-GVM, Enable
native SSR instead of virtual SSR.
Change-Id: I1de983dc570101c508557368b2f7215126221ee5
Signed-off-by: Venkata Rao Kakani <vkakani@codeaurora.org>
Abhinav Kumar [Sat, 15 Sep 2018 02:11:57 +0000 (19:11 -0700)]
drm/msm: fix HDR programming sequence for mastering infoframe
Fix the HDR programming sequence in the HDMI driver to make it
compatible as per the latest hardware programming guide.
Change-Id: Ife5d0ce675a9653e0e44a413bda68b98d506a205
Signed-off-by: Abhinav Kumar <abhinavk@codeaurora.org>
Gerrit - the friendly Code Review server [Fri, 28 Sep 2018 18:48:11 +0000 (11:48 -0700)]
Merge changes into msm-4.4
Linux Build Service Account [Fri, 28 Sep 2018 12:48:49 +0000 (05:48 -0700)]
Merge "mdss: mdp: Fix fudge factor overflow check"
Linux Build Service Account [Fri, 28 Sep 2018 12:48:48 +0000 (05:48 -0700)]
Merge "mdss: mdp: Add null check for ctl"
Linux Build Service Account [Fri, 28 Sep 2018 12:48:46 +0000 (05:48 -0700)]
Merge "msm: dba: adv7533: Fix DSI-HDMI display not up issue"
Srinivasarao P [Fri, 28 Sep 2018 06:41:51 +0000 (12:11 +0530)]
Merge android-4.4.157 (
c139ea66) into msm-4.4
* refs/heads/tmp-
c139ea66
Linux 4.4.157
mm: get rid of vmacache_flush_all() entirely
x86/speculation/l1tf: Increase l1tf memory limit for Nehalem+
autofs: fix autofs_sbi() does not check super block type
mtd: ubi: wl: Fix error return code in ubi_wl_init()
crypto: vmx - Fix sleep-in-atomic bugs
ethernet: ti: davinci_emac: add missing of_node_put after calling of_parse_phandle
net: ethernet: ti: cpsw: fix mdio device reference leak
drivers: net: cpsw: fix parsing of phy-handle DT property in dual_emac config
netfilter: x_tables: avoid stack-out-of-bounds read in xt_copy_counters_from_user
vmw_balloon: include asm/io.h
xhci: Fix use-after-free in xhci_free_virt_device
RDMA/cma: Do not ignore net namespace for unbound cm_id
MIPS: WARN_ON invalid DMA cache maintenance, not BUG_ON
f2fs: fix to do sanity check with {sit,nat}_ver_bitmap_bytesize
mfd: ti_am335x_tscadc: Fix struct clk memory leak
iommu/ipmmu-vmsa: Fix allocation in atomic context
partitions/aix: fix usage of uninitialized lv_info and lvname structures
partitions/aix: append null character to print data from disk
Input: atmel_mxt_ts - only use first T9 instance
net: dcb: For wild-card lookups, use priority -1, not 0
MIPS: Octeon: add missing of_node_put()
net: mvneta: fix mtu change on port without link
gpio: ml-ioh: Fix buffer underwrite on probe error path
x86/mm: Remove in_nmi() warning from vmalloc_fault()
Bluetooth: hidp: Fix handling of strncpy for hid->name information
ath10k: disable bundle mgmt tx completion event support
scsi: 3ware: fix return 0 on the error path of probe
ata: libahci: Correct setting of DEVSLP register
MIPS: Fix ISA virt/bus conversion for non-zero PHYS_OFFSET
ath10k: prevent active scans on potential unusable channels
macintosh/via-pmu: Add missing mmio accessors
NFSv4.0 fix client reference leak in callback
perf tools: Allow overriding MAX_NR_CPUS at compile time
f2fs: do not set free of current section
tty: rocket: Fix possible buffer overwrite on register_PCI
uio: potential double frees if __uio_register_device() fails
misc: ti-st: Fix memory leak in the error path of probe()
md/raid5: fix data corruption of replacements after originals dropped
scsi: target: fix __transport_register_session locking
gpio: tegra: Move driver registration to subsys_init level
Bluetooth: h5: Fix missing dependency on BT_HCIUART_SERDEV
ethtool: Remove trailing semicolon for static inline
misc: mic: SCIF Fix scif_get_new_port() error handling
ARC: [plat-axs*]: Enable SWAP
locking/osq_lock: Fix osq_lock queue corruption
selinux: use GFP_NOWAIT in the AVC kmem_caches
locking/rwsem-xadd: Fix missed wakeup due to reordering of load
block,blkcg: use __GFP_NOWARN for best-effort allocations in blkcg
staging/rts5208: Fix read overflow in memcpy
staging: rt5208: Fix a sleep-in-atomic bug in xd_copy_page
kthread: fix boot hang (regression) on MIPS/OpenRISC
kthread: Fix use-after-free if kthread fork fails
cfq: Give a chance for arming slice idle timer in case of group_idle
ALSA: hda - Fix cancel_work_sync() stall from jackpoll work
i2c: i801: fix DNV's SMBCTRL register offset
i2c: xiic: Make the start and the byte count write atomic
Conflicts:
block/blk-cgroup.c
drivers/net/wireless/ath/ath10k/wmi-tlv.c
kernel/locking/rwsem-xadd.c
Change-Id: If6c24e0c16e173dc2a22e047200bbd7a4f11f713
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
Srinivasarao P [Fri, 28 Sep 2018 06:35:13 +0000 (12:05 +0530)]
Merge android-4.4.156 (
7eb7037) into msm-4.4
* refs/heads/tmp-
7eb7037
Linux 4.4.156
btrfs: use correct compare function of dirty_metadata_bytes
ASoC: wm8994: Fix missing break in switch
s390/lib: use expoline for all bcr instructions
mei: me: allow runtime pm for platform with D0i3
sch_tbf: fix two null pointer dereferences on init failure
sch_netem: avoid null pointer deref on init failure
sch_hhf: fix null pointer dereference on init failure
sch_multiq: fix double free on init failure
sch_htb: fix crash on init failure
ovl: proper cleanup of workdir
ovl: override creds with the ones from the superblock mounter
ovl: rename is_merge to is_lowest
irqchip/gic: Make interrupt ID 1020 invalid
irqchip/gic-v3: Add missing barrier to 32bit version of gic_read_iar()
irqchip/gicv3-its: Avoid cache flush beyond ITS_BASERn memory size
irqchip/gicv3-its: Fix memory leak in its_free_tables()
irqchip/gic-v3-its: Recompute the number of pages on page size change
genirq: Delay incrementing interrupt count if it's disabled/pending
Fixes: Commit
cdbf92675fad ("mm: numa: avoid waiting on freed migrated pages")
enic: do not call enic_change_mtu in enic_probe
Revert "ARM: imx_v6_v7_defconfig: Select ULPI support"
irda: Only insert new objects into the global database via setsockopt
irda: Fix memory leak caused by repeated binds of irda socket
kbuild: make missing $DEPMOD a Warning instead of an Error
x86/pae: use 64 bit atomic xchg function in native_ptep_get_and_clear
debugobjects: Make stack check warning more informative
btrfs: Don't remove block group that still has pinned down bytes
btrfs: relocation: Only remove reloc rb_trees if reloc control has been initialized
btrfs: replace: Reset on-disk dev stats value after replace
powerpc/pseries: Avoid using the size greater than RTAS_ERROR_LOG_MAX.
SMB3: Number of requests sent should be displayed for SMB3 not just CIFS
smb3: fix reset of bytes read and written stats
selftests/powerpc: Kill child processes on SIGINT
staging: comedi: ni_mio_common: fix subdevice flags for PFI subdevice
dm kcopyd: avoid softlockup in run_complete_job
PCI: mvebu: Fix I/O space end address calculation
scsi: aic94xx: fix an error code in aic94xx_init()
s390/dasd: fix hanging offline processing due to canceled worker
powerpc: Fix size calculation using resource_size()
net/9p: fix error path of p9_virtio_probe
irqchip/bcm7038-l1: Hide cpu offline callback when building for !SMP
platform/x86: asus-nb-wmi: Add keymap entry for lid flip action on UX360
mfd: sm501: Set coherent_dma_mask when creating subdevices
ipvs: fix race between ip_vs_conn_new() and ip_vs_del_dest()
fs/dcache.c: fix kmemcheck splat at take_dentry_name_snapshot()
mm/fadvise.c: fix signed overflow UBSAN complaint
scripts: modpost: check memory allocation results
fat: validate ->i_start before using
hfsplus: fix NULL dereference in hfsplus_lookup()
reiserfs: change j_timestamp type to time64_t
fork: don't copy inconsistent signal handler state to child
hfs: prevent crash on exit from failed search
hfsplus: don't return 0 when fill_super() failed
cifs: check if SMB2 PDU size has been padded and suppress the warning
vti6: remove !skb->ignore_df check from vti6_xmit()
tcp: do not restart timewait timer on rst reception
qlge: Fix netdev features configuration.
net: bcmgenet: use MAC link status for fixed phy
staging: android: ion: fix ION_IOC_{MAP,SHARE} use-after-free
x86/speculation/l1tf: Fix up pte->pfn conversion for PAE
Conflicts:
drivers/staging/android/ion/ion.c
Change-Id: I7153f61c3a676a788f64eeb8bab13e840bbbf985
[readded the function ion_handle_get_by_id() which got deleted with
commit 'staging: android: ion: fix ION_IOC_{MAP,SHARE} use-after-free'
since it is used in msm/msm_ion.c]
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
Abhinav Kumar [Fri, 28 Sep 2018 01:08:07 +0000 (18:08 -0700)]
drm/msm: clear colorimetry block info for HDMI
SDE connector stores the information related to the HDMI
colorimetry data block. This connector information is
retained till the connector is destroyed which does not
happen across hotplug.
Clear the HDMI colorimetry block related data fields when
the bridge is disabled so that across a hotplug stale
information is not retained.
Change-Id: I2333af8835af98f78934df056301648e1cb6f8be
Signed-off-by: Abhinav Kumar <abhinavk@codeaurora.org>
Yajun Li [Tue, 25 Sep 2018 08:45:20 +0000 (16:45 +0800)]
soc: hab: fix mmap failure issue when hab import
If hab client import the same buffer with different
size, only checking pages_list->index is not enough,
so add the buffer size checking.
Change-Id: I92d16d124e69131cee9b81a49dc9fa02075a96b6
Signed-off-by: Yajun Li <yajunl@codeaurora.org>
Yajun Li [Thu, 6 Sep 2018 08:37:24 +0000 (16:37 +0800)]
soc: hab: change lifecycle of exp_id from vchan to ctx
To make sure unexport/unimport the same buffer successfully
in different threads from export/import function, only check
pchan's validation, instead of vchan id.
Change-Id: I3203f198c37e8b169090d8f93d92e87bbd4cdb6e
Signed-off-by: Yajun Li <yajunl@codeaurora.org>
Linux Build Service Account [Wed, 26 Sep 2018 17:40:35 +0000 (10:40 -0700)]
Merge "soc: qcom: fix race condition while freeing private data"
Linux Build Service Account [Wed, 26 Sep 2018 17:40:32 +0000 (10:40 -0700)]
Merge "ARM: dts: msm: change ION layout for msm8996 ivi vplatform"
Linux Build Service Account [Wed, 26 Sep 2018 17:40:26 +0000 (10:40 -0700)]
Merge "defconfig: msm-auto: Disable IOMMU_TESTS from msm8996 auto."
Linux Build Service Account [Wed, 26 Sep 2018 17:40:08 +0000 (10:40 -0700)]
Merge "iommu/debug: Remove dependency on CONFIG_IOMMU_DEBUG_TRACKING"
Linux Build Service Account [Wed, 26 Sep 2018 17:40:04 +0000 (10:40 -0700)]
Merge "ARM: dts: msm: Add support for FHD+ video mode panel"
Linux Build Service Account [Wed, 26 Sep 2018 17:40:02 +0000 (10:40 -0700)]
Merge "msm: camera: Fix arbitrary kernel write"
Linux Build Service Account [Wed, 26 Sep 2018 17:40:01 +0000 (10:40 -0700)]
Merge "ARM: dts: msm: Disable mhi and esoc for msm8996 CV2X"
Linux Build Service Account [Wed, 26 Sep 2018 17:40:00 +0000 (10:40 -0700)]
Merge "wqcrypto: qcedev: Add null pointer check on sg_src"
Linux Build Service Account [Wed, 26 Sep 2018 17:39:55 +0000 (10:39 -0700)]
Merge "soc: soundwire: Fix wsa mute issue for stereo playback"
Linux Build Service Account [Wed, 26 Sep 2018 17:39:53 +0000 (10:39 -0700)]
Merge "soc: swr-wcd-ctrl: Fix wsa mute issue for stereo playback"
Ajay Agarwal [Wed, 26 Sep 2018 11:42:10 +0000 (17:12 +0530)]
usb: dwc3-msm: Release PM wakelock in host mode only for auto targets
Currently the driver releases PM wakelock in host mode. This
causes pm_suspend to get triggered. Although pm_suspend bails out
but xhci_bus_suspend transitions the bus to a bad state leading
to host mode failure.
Fix this by releasing wakelock only for targets on which we allow
PM suspend in host mode irrespective of runtimePM.
Change-Id: I6648991272c0f22b032b526bce3a76864fec63a5
Signed-off-by: Ajay Agarwal <ajaya@codeaurora.org>
Padmanabhan Komanduru [Tue, 18 Sep 2018 12:56:01 +0000 (18:26 +0530)]
clk: qcom: mdss: add support for dynamic refresh on DSI 14nm PLL
Add CLK_SET_RATE_NO_REPARENT flag for the software mux clocks in
DSI 14nm PLL driver which is needed for dynamic refresh feature.
Update the dynamic fps structure to align the PLL codes with
vco frequency instead of fps.
Change-Id: I533f615ce51be7229171b6accac3f14ab2dca949
Signed-off-by: Padmanabhan Komanduru <pkomandu@codeaurora.org>
Sayali Lokhande [Wed, 26 Sep 2018 07:24:24 +0000 (12:54 +0530)]
ARM: dts: msm: Add pin control settings for UFS reset on SDM660
This change adds pin control settings to support UFS device reset
operation on sdm660 target.
Change-Id: I59befba3c019a15e4626f825516787c8c2a1ad7d
Signed-off-by: Sayali Lokhande <sayalil@codeaurora.org>
Vivek Kumar [Mon, 10 Sep 2018 08:53:27 +0000 (14:23 +0530)]
defconfig: msm-auto: Disable IOMMU_TESTS from msm8996 auto.
Disable CONFIG_IOMMU_TESTS for msm8996 auto boards,
as iommu test functions are not mulithread-safe
currently.
Change-Id: I0884a86cef33664712788b863e0eb06f42a5c2b9
Signed-off-by: Vivek Kumar <vivekuma@codeaurora.org>
Vivek Kumar [Mon, 10 Sep 2018 08:39:01 +0000 (14:09 +0530)]
iommu/debug: Remove dependency on CONFIG_IOMMU_DEBUG_TRACKING
Compile 'iommu_debug_attr_to_string' function only when
CONFIG_IOMMU_TESTS is enabled ,because it is called
only from iommu test functions.
Change-Id: Ifb3624690abc8134c1176b8915dc1cfe0454a91e
Signed-off-by: Vivek Kumar <vivekuma@codeaurora.org>
Linux Build Service Account [Tue, 25 Sep 2018 12:11:14 +0000 (05:11 -0700)]
Merge "soc: hab: add more return error checking"
Rashi Bindra [Mon, 24 Sep 2018 11:18:48 +0000 (16:48 +0530)]
ARM: dts: msm: Add support for FHD+ video mode panel
Change to add support for FHD+ Video mode panel node for
sdm630 MTP and CDP platform.
Change-Id: I3c6b1298e754ac9419fe132374bb7f9e35395aca
Signed-off-by: Rashi Bindra <rbindra@codeaurora.org>
Yimin Peng [Fri, 3 Aug 2018 09:28:23 +0000 (17:28 +0800)]
ARM: dts: msm: change ION layout for msm8996 ivi vplatform
Add carveout audio ION heap and change system ION heap from
CARVEOUT to SYSTEM.
Change-Id: I38698441a3479e213533d981aa06cc850b77d723
Signed-off-by: Yimin Peng <yiminp@codeaurora.org>
Animesh Kishore [Tue, 27 Mar 2018 19:23:31 +0000 (00:53 +0530)]
mdss: mdp: Fix fudge factor overflow check
Fudge adjustment is always 64 bit operation
irrespective of underlying architecture is
32/64 bit. Fix max value to compare overflow
against. Add warning if adjustments can't go
through without overflow.
Change-Id: I9c15ea8c1754c9ddb997546dc476bb6d45198524
Signed-off-by: Animesh Kishore <animeshk@codeaurora.org>
Animesh Kishore [Fri, 16 Mar 2018 09:48:07 +0000 (15:18 +0530)]
mdss: mdp: Add null check for ctl
Check if ctl is NULL and flag error.
Change-Id: I3a1a1d04ff1dab0aada06071498529b48222c465
Signed-off-by: Animesh Kishore <animeshk@codeaurora.org>
Amine Najahi [Mon, 17 Sep 2018 20:05:25 +0000 (16:05 -0400)]
fbdev/msm: sanitize debugfs inputs when reading mdp memory
Sanitize debugfs inputs to only allow access to mdp memory block
specified in dtsi file. This change will allow only one single block
to be read at the time and will avoid accessing memory outside of valid
decode space which can trigger AHB error bus response.
Change-Id: Icede9a8939a66faa59d674c18183fb0ebcf67908
Signed-off-by: Amine Najahi <anajahi@codeaurora.org>
Linux Build Service Account [Fri, 21 Sep 2018 16:14:57 +0000 (09:14 -0700)]
Merge "msm: gvmq: avoid uninitialized access for data member"
Linux Build Service Account [Fri, 21 Sep 2018 16:14:56 +0000 (09:14 -0700)]
Merge "wcnss: Fix buffer overflow in wcnss_prealloc_get"
Linux Build Service Account [Fri, 21 Sep 2018 16:14:55 +0000 (09:14 -0700)]
Merge "ARM: dts: msm: Display changes for SDM455"
Linux Build Service Account [Fri, 21 Sep 2018 16:14:54 +0000 (09:14 -0700)]
Merge "icnss: Add check for rejuvenate in fw_down"
Linux Build Service Account [Fri, 21 Sep 2018 16:14:53 +0000 (09:14 -0700)]
Merge "soc: hab: add bootmarker for hab driver"
Linux Build Service Account [Fri, 21 Sep 2018 16:14:51 +0000 (09:14 -0700)]
Merge "Merge android-4.4.155 (
b3f777e) into msm-4.4"
Linux Build Service Account [Fri, 21 Sep 2018 16:14:50 +0000 (09:14 -0700)]
Merge "diag: Update the logging codes of events, logs and msgs"
Linux Build Service Account [Fri, 21 Sep 2018 16:14:49 +0000 (09:14 -0700)]
Merge "ARM: dts: msm: Add support for speed bin 3 for SDM630"
Linux Build Service Account [Fri, 21 Sep 2018 16:14:48 +0000 (09:14 -0700)]
Merge "Merge remote-tracking branch 'origin/caf/BosSen-msm-44/master' into msm-4.4"
Linux Build Service Account [Fri, 21 Sep 2018 16:14:47 +0000 (09:14 -0700)]
Merge "drm: msm: Fix kernel panic error"
Linux Build Service Account [Fri, 21 Sep 2018 16:14:44 +0000 (09:14 -0700)]
Merge "qseecom: fix kclient free issue in qseecom_remove"
Ramandeep Trehan [Tue, 4 Sep 2018 13:10:23 +0000 (18:40 +0530)]
wqcrypto: qcedev: Add null pointer check on sg_src
Add a null pointer check on sg_src to avoid a possible
null pointer dereference in qcedev driver.
Change-Id: I9d4f9147ae6c340064110381c98d064f29fd9444
Signed-off-by: Ramandeep Trehan <rtrehan@codeaurora.org>
Yajun Li [Tue, 18 Sep 2018 06:24:24 +0000 (14:24 +0800)]
soc: hab: add more return error checking
If the exported buffer has been freed in other threads,
dma_buf_get maybe return error, therefore need error
checking here.
Change-Id: Ic1674cada8dc6e0d6b09d75abf695a68896b8bff
Signed-off-by: Yajun Li <yajunl@codeaurora.org>
Venkata Rao Kakani [Fri, 21 Sep 2018 09:07:40 +0000 (14:37 +0530)]
msm: gvmq: avoid uninitialized access for data member
Resolve Uninitalized access of data member with initialization
of same.
Change-Id: Ie2ba7ac47e55e55daf6e1dc3b8c8ce73a20320de
Signed-off-by: Venkata Rao Kakani <vkakani@codeaurora.org>
Greg Kroah-Hartman [Thu, 20 Sep 2018 09:14:55 +0000 (11:14 +0200)]
Merge 4.4.157 into android-4.4
Changes in 4.4.157
i2c: xiic: Make the start and the byte count write atomic
i2c: i801: fix DNV's SMBCTRL register offset
ALSA: hda - Fix cancel_work_sync() stall from jackpoll work
cfq: Give a chance for arming slice idle timer in case of group_idle
kthread: Fix use-after-free if kthread fork fails
kthread: fix boot hang (regression) on MIPS/OpenRISC
staging: rt5208: Fix a sleep-in-atomic bug in xd_copy_page
staging/rts5208: Fix read overflow in memcpy
block,blkcg: use __GFP_NOWARN for best-effort allocations in blkcg
locking/rwsem-xadd: Fix missed wakeup due to reordering of load
selinux: use GFP_NOWAIT in the AVC kmem_caches
locking/osq_lock: Fix osq_lock queue corruption
ARC: [plat-axs*]: Enable SWAP
misc: mic: SCIF Fix scif_get_new_port() error handling
ethtool: Remove trailing semicolon for static inline
Bluetooth: h5: Fix missing dependency on BT_HCIUART_SERDEV
gpio: tegra: Move driver registration to subsys_init level
scsi: target: fix __transport_register_session locking
md/raid5: fix data corruption of replacements after originals dropped
misc: ti-st: Fix memory leak in the error path of probe()
uio: potential double frees if __uio_register_device() fails
tty: rocket: Fix possible buffer overwrite on register_PCI
f2fs: do not set free of current section
perf tools: Allow overriding MAX_NR_CPUS at compile time
NFSv4.0 fix client reference leak in callback
macintosh/via-pmu: Add missing mmio accessors
ath10k: prevent active scans on potential unusable channels
MIPS: Fix ISA virt/bus conversion for non-zero PHYS_OFFSET
ata: libahci: Correct setting of DEVSLP register
scsi: 3ware: fix return 0 on the error path of probe
ath10k: disable bundle mgmt tx completion event support
Bluetooth: hidp: Fix handling of strncpy for hid->name information
x86/mm: Remove in_nmi() warning from vmalloc_fault()
gpio: ml-ioh: Fix buffer underwrite on probe error path
net: mvneta: fix mtu change on port without link
MIPS: Octeon: add missing of_node_put()
net: dcb: For wild-card lookups, use priority -1, not 0
Input: atmel_mxt_ts - only use first T9 instance
partitions/aix: append null character to print data from disk
partitions/aix: fix usage of uninitialized lv_info and lvname structures
iommu/ipmmu-vmsa: Fix allocation in atomic context
mfd: ti_am335x_tscadc: Fix struct clk memory leak
f2fs: fix to do sanity check with {sit,nat}_ver_bitmap_bytesize
MIPS: WARN_ON invalid DMA cache maintenance, not BUG_ON
RDMA/cma: Do not ignore net namespace for unbound cm_id
xhci: Fix use-after-free in xhci_free_virt_device
vmw_balloon: include asm/io.h
netfilter: x_tables: avoid stack-out-of-bounds read in xt_copy_counters_from_user
drivers: net: cpsw: fix parsing of phy-handle DT property in dual_emac config
net: ethernet: ti: cpsw: fix mdio device reference leak
ethernet: ti: davinci_emac: add missing of_node_put after calling of_parse_phandle
crypto: vmx - Fix sleep-in-atomic bugs
mtd: ubi: wl: Fix error return code in ubi_wl_init()
autofs: fix autofs_sbi() does not check super block type
x86/speculation/l1tf: Increase l1tf memory limit for Nehalem+
mm: get rid of vmacache_flush_all() entirely
Linux 4.4.157
Change-Id: I30fc9e099e9065aff5e53c648d822c405525bb07
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Laxminath Kasam [Fri, 14 Sep 2018 13:18:04 +0000 (18:48 +0530)]
soc: soundwire: Fix wsa mute issue for stereo playback
When stereo playback start and temperature read
initiated at same time, one of speaker PA bits are
not set in particular race scenario. Handle the
broadcast check in soundwire framework to ensure
broadcast is disabled only when respective gr_sid
slave calls swr_remove_from_group.
CRs-Fixed:
2282230
Change-Id: I6f82a8c3c0f39dc20c1def09c1728ce4c26c2f5d
Signed-off-by: Laxminath Kasam <lkasam@codeaurora.org>
Laxminath Kasam [Fri, 14 Sep 2018 13:20:12 +0000 (18:50 +0530)]
soc: swr-wcd-ctrl: Fix wsa mute issue for stereo playback
When temperature on a single wsa881x device is being read,
then soundwire master wakes up both wsa881x devices but
regcache_sync is happening only for one wsa881x device on
which the temperature is being read. This results in
audio playback mute after temperature read. Fix the
regcache sync during temperature read and playback usecase.
CRs-Fixed:
2282230
Change-Id: I856b96517c629ac685bbc25caabee841037106c8
Signed-off-by: Laxminath Kasam <lkasam@codeaurora.org>
Laxminath Kasam [Fri, 14 Sep 2018 13:16:06 +0000 (18:46 +0530)]
ASoC: wsa881x: Fix regcache sync issue during playback
When temperature on a single wsa881x device is being read,
then soundwire master wakes up both wsa881x devices but
regcache_sync is happening only for one wsa881x device on
which the temperature is being read. This results in
audio playback mute after temperature read. Fix the
regcache sync during temperature read and playback usecase.
CRs-Fixed:
2282230
Change-Id: I054f4432d7ae7bce922341ad62b20544cccd5865
Signed-off-by: Sudheer Papothi <spapothi@codeaurora.org>
Signed-off-by: Laxminath Kasam <lkasam@codeaurora.org>
Anurag Chouhan [Wed, 19 Sep 2018 07:45:13 +0000 (13:15 +0530)]
wcnss: Fix buffer overflow in wcnss_prealloc_get
There is potential integer truncation in the wcnss_prealloc_get api.
size_t is 8 byte on x64 platform and "unsigned int" is 4 byte.
To avoid this integer truncation, pass size as size_t instead
of unsigned int.
CRs-Fixed:
2269610
Change-Id: I14b274dd7cad98b55fdce1aaa27783272231afde
Signed-off-by: Anurag Chouhan <achouhan@codeaurora.org>
Nirmal Abraham [Tue, 18 Sep 2018 12:47:52 +0000 (18:17 +0530)]
ARM: dts: msm: Display changes for SDM455
Disable 'assertive display', 'destination scaler' and
'display port' support for SDM455.
Change-Id: I4de89658a6c5b20c97e9fc0f611aaa81f701a9d7
Signed-off-by: Nirmal Abraham <nabrah@codeaurora.org>
Greg Kroah-Hartman [Wed, 19 Sep 2018 20:49:00 +0000 (22:49 +0200)]
Linux 4.4.157
Linus Torvalds [Thu, 13 Sep 2018 09:57:48 +0000 (23:57 -1000)]
mm: get rid of vmacache_flush_all() entirely
commit
7a9cdebdcc17e426fb5287e4a82db1dfe86339b2 upstream.
Jann Horn points out that the vmacache_flush_all() function is not only
potentially expensive, it's buggy too. It also happens to be entirely
unnecessary, because the sequence number overflow case can be avoided by
simply making the sequence number be 64-bit. That doesn't even grow the
data structures in question, because the other adjacent fields are
already 64-bit.
So simplify the whole thing by just making the sequence number overflow
case go away entirely, which gets rid of all the complications and makes
the code faster too. Win-win.
[ Oleg Nesterov points out that the VMACACHE_FULL_FLUSHES statistics
also just goes away entirely with this ]
Reported-by: Jann Horn <jannh@google.com>
Suggested-by: Will Deacon <will.deacon@arm.com>
Acked-by: Davidlohr Bueso <dave@stgolabs.net>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Andi Kleen [Mon, 3 Sep 2018 17:19:13 +0000 (10:19 -0700)]
x86/speculation/l1tf: Increase l1tf memory limit for Nehalem+
[upstream
cc51e5428ea54f575d49cfcede1d4cb3a72b4ec4 for 4.4.
Note there might be still a trivial conflict with the backport
for
b0a182f875689647b014bc01d36b340217792852, but should
be easy to resolve]
On Nehalem and newer core CPUs the CPU cache internally uses 44 bits
physical address space. The L1TF workaround is limited by this internal
cache address width, and needs to have one bit free there for the
mitigation to work.
Older client systems report only 36bit physical address space so the range
check decides that L1TF is not mitigated for a 36bit phys/32GB system with
some memory holes.
But since these actually have the larger internal cache width this warning
is bogus because it would only really be needed if the system had more than
43bits of memory.
Add a new internal x86_cache_bits field. Normally it is the same as the
physical bits field reported by CPUID, but for Nehalem and newerforce it to
be at least 44bits.
Change the L1TF memory size warning to use the new cache_bits field to
avoid bogus warnings and remove the bogus comment about memory size.
Fixes:
17dbca119312 ("x86/speculation/l1tf: Add sysfs reporting for l1tf")
Reported-by: George Anchev <studio@anchev.net>
Reported-by: Christopher Snowhill <kode54@gmail.com>
Signed-off-by: Andi Kleen <ak@linux.intel.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: x86@kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: Michael Hocko <mhocko@suse.com>
Cc: vbabka@suse.cz
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/20180824170351.34874-1-andi@firstfloor.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Ian Kent [Wed, 22 Aug 2018 04:51:45 +0000 (21:51 -0700)]
autofs: fix autofs_sbi() does not check super block type
commit
0633da48f0793aeba27f82d30605624416723a91 upstream.
autofs_sbi() does not check the superblock magic number to verify it has
been given an autofs super block.
Backport Note: autofs4 has been renamed to autofs upstream. As a result
the upstream patch does not apply cleanly onto 4.14.y.
Link: http://lkml.kernel.org/r/153475422934.17131.7563724552005298277.stgit@pluto.themaw.net
Reported-by: <syzbot+87c3c541582e56943277@syzkaller.appspotmail.com>
Signed-off-by: Ian Kent <raven@themaw.net>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Zubin Mithra <zsm@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Wei Yongjun [Thu, 18 Jan 2018 14:05:05 +0000 (14:05 +0000)]
mtd: ubi: wl: Fix error return code in ubi_wl_init()
commit
7233982ade15eeac05c6f351e8d347406e6bcd2f upstream.
Fix to return error code -ENOMEM from the kmem_cache_alloc() error
handling case instead of 0, as done elsewhere in this function.
Fixes:
f78e5623f45b ("ubi: fastmap: Erase outdated anchor PEBs during
attach")
Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
Reviewed-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Cc: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Ondrej Mosnacek [Wed, 22 Aug 2018 06:26:31 +0000 (08:26 +0200)]
crypto: vmx - Fix sleep-in-atomic bugs
commit
0522236d4f9c5ab2e79889cb020d1acbe5da416e upstream.
This patch fixes sleep-in-atomic bugs in AES-CBC and AES-XTS VMX
implementations. The problem is that the blkcipher_* functions should
not be called in atomic context.
The bugs can be reproduced via the AF_ALG interface by trying to
encrypt/decrypt sufficiently large buffers (at least 64 KiB) using the
VMX implementations of 'cbc(aes)' or 'xts(aes)'. Such operations then
trigger BUG in crypto_yield():
[ 891.863680] BUG: sleeping function called from invalid context at include/crypto/algapi.h:424
[ 891.864622] in_atomic(): 1, irqs_disabled(): 0, pid: 12347, name: kcapi-enc
[ 891.864739] 1 lock held by kcapi-enc/12347:
[ 891.864811] #0:
00000000f5d42c46 (sk_lock-AF_ALG){+.+.}, at: skcipher_recvmsg+0x50/0x530
[ 891.865076] CPU: 5 PID: 12347 Comm: kcapi-enc Not tainted 4.19.0-0.rc0.git3.1.fc30.ppc64le #1
[ 891.865251] Call Trace:
[ 891.865340] [
c0000003387578c0] [
c000000000d67ea4] dump_stack+0xe8/0x164 (unreliable)
[ 891.865511] [
c000000338757910] [
c000000000172a58] ___might_sleep+0x2f8/0x310
[ 891.865679] [
c000000338757990] [
c0000000006bff74] blkcipher_walk_done+0x374/0x4a0
[ 891.865825] [
c0000003387579e0] [
d000000007e73e70] p8_aes_cbc_encrypt+0x1c8/0x260 [vmx_crypto]
[ 891.865993] [
c000000338757ad0] [
c0000000006c0ee0] skcipher_encrypt_blkcipher+0x60/0x80
[ 891.866128] [
c000000338757b10] [
c0000000006ec504] skcipher_recvmsg+0x424/0x530
[ 891.866283] [
c000000338757bd0] [
c000000000b00654] sock_recvmsg+0x74/0xa0
[ 891.866403] [
c000000338757c10] [
c000000000b00f64] ___sys_recvmsg+0xf4/0x2f0
[ 891.866515] [
c000000338757d90] [
c000000000b02bb8] __sys_recvmsg+0x68/0xe0
[ 891.866631] [
c000000338757e30] [
c00000000000bbe4] system_call+0x5c/0x70
Fixes:
8c755ace357c ("crypto: vmx - Adding CBC routines for VMX module")
Fixes:
c07f5d3da643 ("crypto: vmx - Adding support for XTS")
Cc: stable@vger.kernel.org
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Peter Chen [Mon, 1 Aug 2016 07:02:43 +0000 (15:02 +0800)]
ethernet: ti: davinci_emac: add missing of_node_put after calling of_parse_phandle
commit
5817f977527e5cdbea9ca56d2b95824f59c8747d upstream.
of_node_put needs to be called when the device node which is got
from of_parse_phandle has finished using.
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: SZ Lin (林上智) <sz.lin@moxa.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Johan Hovold [Thu, 17 Nov 2016 16:39:59 +0000 (17:39 +0100)]
net: ethernet: ti: cpsw: fix mdio device reference leak
commit
86e1d5adcef961eb383ce4eacbe0ef22f06e2045 upstream.
Make sure to drop the reference taken by of_find_device_by_node() when
looking up an mdio device from a phy_id property during probe.
Fixes:
549985ee9c72 ("cpsw: simplify the setup of the register
pointers")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: SZ Lin (林上智) <sz.lin@moxa.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
David Rivshin [Thu, 28 Apr 2016 01:25:25 +0000 (21:25 -0400)]
drivers: net: cpsw: fix parsing of phy-handle DT property in dual_emac config
commit
552165bcf7060b998b4a9b5b86110b6a5e04dfd9 upstream.
Commit
9e42f715264ff158478fa30eaed847f6e131366b ("drivers: net: cpsw: add
phy-handle parsing") saved the "phy-handle" phandle into a new cpsw_priv
field. However, phy connections are per-slave, so the phy_node field should
be in cpsw_slave_data rather than cpsw_priv.
This would go unnoticed in a single emac configuration. But in dual_emac
mode, the last "phy-handle" property parsed for either slave would be used
by both of them, causing them both to refer to the same phy_device.
Fixes:
9e42f715264f ("drivers: net: cpsw: add phy-handle parsing")
Signed-off-by: David Rivshin <drivshin@allworx.com>
Tested-by: Nicolas Chauvet <kwizart@gmail.com>
Tested-by: Andrew Goodbody <andrew.goodbody@cambrionix.com>
Reviewed-by: Mugunthan V N <mugunthanvnm@ti.com>
Reviewed-by: Grygorii Strashko <grygorii.strashko@ti.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: SZ Lin (林上智) <sz.lin@moxa.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Eric Dumazet [Thu, 5 Oct 2017 09:50:07 +0000 (02:50 -0700)]
netfilter: x_tables: avoid stack-out-of-bounds read in xt_copy_counters_from_user
commit
e466af75c074e76107ae1cd5a2823e9c61894ffb upstream.
syzkaller reports an out of bound read in strlcpy(), triggered
by xt_copy_counters_from_user()
Fix this by using memcpy(), then forcing a zero byte at the last position
of the destination, as Florian did for the non COMPAT code.
Fixes:
d7591f0c41ce ("netfilter: x_tables: introduce and use xt_copy_counters_from_user")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Willem de Bruijn <willemb@google.com>
Acked-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Cc: Greg Hackmann <ghackmann@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Nadav Amit [Thu, 13 Sep 2018 20:18:52 +0000 (13:18 -0700)]
vmw_balloon: include asm/io.h
Fix a build error due to missing virt_to_phys()
Reported-by: kbuild test robot <lkp@intel.com>
Fixes:
f0a1bf29d821b ("vmw_balloon: fix inflation with batching")
Cc: stable@vger.kernel.org
Cc: Xavier Deguillard <xdeguillard@vmware.com>
Signed-off-by: Nadav Amit <namit@vmware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Mathias Nyman [Thu, 3 May 2018 14:30:07 +0000 (17:30 +0300)]
xhci: Fix use-after-free in xhci_free_virt_device
commit
44a182b9d17765514fa2b1cc911e4e65134eef93 upstream.
KASAN found a use-after-free in xhci_free_virt_device+0x33b/0x38e
where xhci_free_virt_device() sets slot id to 0 if udev exists:
if (dev->udev && dev->udev->slot_id)
dev->udev->slot_id = 0;
dev->udev will be true even if udev is freed because dev->udev is
not set to NULL.
set dev->udev pointer to NULL in xhci_free_dev()
The original patch went to stable so this fix needs to be applied
there as well.
Fixes:
a400efe455f7 ("xhci: zero usb device slot_id member when disabling and freeing a xhci slot")
Cc: <stable@vger.kernel.org>
Reported-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Matthias Kaehlcke <mka@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Parav Pandit [Mon, 16 Jul 2018 08:50:13 +0000 (11:50 +0300)]
RDMA/cma: Do not ignore net namespace for unbound cm_id
[ Upstream commit
643d213a9a034fa04f5575a40dfc8548e33ce04f ]
Currently if the cm_id is not bound to any netdevice, than for such cm_id,
net namespace is ignored; which is incorrect.
Regardless of cm_id bound to a netdevice or not, net namespace must
match. When a cm_id is bound to a netdevice, in such case net namespace
and netdevice both must match.
Fixes:
4c21b5bcef73 ("IB/cma: Add net_dev and private data checks to RDMA CM")
Signed-off-by: Parav Pandit <parav@mellanox.com>
Reviewed-by: Daniel Jurgens <danielj@mellanox.com>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Paul Burton [Fri, 25 Nov 2016 18:46:09 +0000 (18:46 +0000)]
MIPS: WARN_ON invalid DMA cache maintenance, not BUG_ON
[ Upstream commit
d4da0e97baea8768b3d66ccef3967bebd50dfc3b ]
If a driver causes DMA cache maintenance with a zero length then we
currently BUG and kill the kernel. As this is a scenario that we may
well be able to recover from, WARN & return in the condition instead.
Signed-off-by: Paul Burton <paul.burton@mips.com>
Acked-by: Florian Fainelli <f.fainelli@gmail.com>
Patchwork: https://patchwork.linux-mips.org/patch/14623/
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: linux-mips@linux-mips.org
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Chao Yu [Sat, 23 Jun 2018 03:25:19 +0000 (11:25 +0800)]
f2fs: fix to do sanity check with {sit,nat}_ver_bitmap_bytesize
[ Upstream commit
c77ec61ca0a49544ca81881cc5d5529858f7e196 ]
This patch adds to do sanity check with {sit,nat}_ver_bitmap_bytesize
during mount, in order to avoid accessing across cache boundary with
this abnormal bitmap size.
- Overview
buffer overrun in build_sit_info() when mounting a crafted f2fs image
- Reproduce
- Kernel message
[ 548.580867] F2FS-fs (loop0): Invalid log blocks per segment (8201)
[ 548.580877] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock
[ 548.584979] ==================================================================
[ 548.586568] BUG: KASAN: use-after-free in kmemdup+0x36/0x50
[ 548.587715] Read of size 64 at addr
ffff8801e9c265ff by task mount/1295
[ 548.589428] CPU: 1 PID: 1295 Comm: mount Not tainted 4.18.0-rc1+ #4
[ 548.589432] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
[ 548.589438] Call Trace:
[ 548.589474] dump_stack+0x7b/0xb5
[ 548.589487] print_address_description+0x70/0x290
[ 548.589492] kasan_report+0x291/0x390
[ 548.589496] ? kmemdup+0x36/0x50
[ 548.589509] check_memory_region+0x139/0x190
[ 548.589514] memcpy+0x23/0x50
[ 548.589518] kmemdup+0x36/0x50
[ 548.589545] f2fs_build_segment_manager+0x8fa/0x3410
[ 548.589551] ? __asan_loadN+0xf/0x20
[ 548.589560] ? f2fs_sanity_check_ckpt+0x1be/0x240
[ 548.589566] ? f2fs_flush_sit_entries+0x10c0/0x10c0
[ 548.589587] ? __put_user_ns+0x40/0x40
[ 548.589604] ? find_next_bit+0x57/0x90
[ 548.589610] f2fs_fill_super+0x194b/0x2b40
[ 548.589617] ? f2fs_commit_super+0x1b0/0x1b0
[ 548.589637] ? set_blocksize+0x90/0x140
[ 548.589651] mount_bdev+0x1c5/0x210
[ 548.589655] ? f2fs_commit_super+0x1b0/0x1b0
[ 548.589667] f2fs_mount+0x15/0x20
[ 548.589672] mount_fs+0x60/0x1a0
[ 548.589683] ? alloc_vfsmnt+0x309/0x360
[ 548.589688] vfs_kern_mount+0x6b/0x1a0
[ 548.589699] do_mount+0x34a/0x18c0
[ 548.589710] ? lockref_put_or_lock+0xcf/0x160
[ 548.589716] ? copy_mount_string+0x20/0x20
[ 548.589728] ? memcg_kmem_put_cache+0x1b/0xa0
[ 548.589734] ? kasan_check_write+0x14/0x20
[ 548.589740] ? _copy_from_user+0x6a/0x90
[ 548.589744] ? memdup_user+0x42/0x60
[ 548.589750] ksys_mount+0x83/0xd0
[ 548.589755] __x64_sys_mount+0x67/0x80
[ 548.589781] do_syscall_64+0x78/0x170
[ 548.589797] entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 548.589820] RIP: 0033:0x7f76fc331b9a
[ 548.589821] Code: 48 8b 0d 01 c3 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d ce c2 2b 00 f7 d8 64 89 01 48
[ 548.589880] RSP: 002b:
00007ffd4f0a0e48 EFLAGS:
00000206 ORIG_RAX:
00000000000000a5
[ 548.589890] RAX:
ffffffffffffffda RBX:
000000000146c030 RCX:
00007f76fc331b9a
[ 548.589892] RDX:
000000000146c210 RSI:
000000000146df30 RDI:
0000000001474ec0
[ 548.589895] RBP:
0000000000000000 R08:
0000000000000000 R09:
0000000000000013
[ 548.589897] R10:
00000000c0ed0000 R11:
0000000000000206 R12:
0000000001474ec0
[ 548.589900] R13:
000000000146c210 R14:
0000000000000000 R15:
0000000000000003
[ 548.590242] The buggy address belongs to the page:
[ 548.591243] page:
ffffea0007a70980 count:0 mapcount:0 mapping:
0000000000000000 index:0x0
[ 548.592886] flags: 0x2ffff0000000000()
[ 548.593665] raw:
02ffff0000000000 dead000000000100 dead000000000200 0000000000000000
[ 548.595258] raw:
0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[ 548.603713] page dumped because: kasan: bad access detected
[ 548.605203] Memory state around the buggy address:
[ 548.606198]
ffff8801e9c26480: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 548.607676]
ffff8801e9c26500: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 548.609157] >
ffff8801e9c26580: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 548.610629] ^
[ 548.612088]
ffff8801e9c26600: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 548.613674]
ffff8801e9c26680: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 548.615141] ==================================================================
[ 548.616613] Disabling lock debugging due to kernel taint
[ 548.622871] WARNING: CPU: 1 PID: 1295 at mm/page_alloc.c:4065 __alloc_pages_slowpath+0xe4a/0x1420
[ 548.622878] Modules linked in: snd_hda_codec_generic snd_hda_intel snd_hda_codec snd_hwdep snd_hda_core snd_pcm snd_timer snd mac_hid i2c_piix4 soundcore ib_iser rdma_cm iw_cm ib_cm ib_core iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx raid1 raid0 multipath linear 8139too crct10dif_pclmul crc32_pclmul qxl drm_kms_helper syscopyarea aesni_intel sysfillrect sysimgblt fb_sys_fops ttm drm aes_x86_64 crypto_simd cryptd 8139cp glue_helper mii pata_acpi floppy
[ 548.623217] CPU: 1 PID: 1295 Comm: mount Tainted: G B 4.18.0-rc1+ #4
[ 548.623219] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
[ 548.623226] RIP: 0010:__alloc_pages_slowpath+0xe4a/0x1420
[ 548.623227] Code: ff ff 01 89 85 c8 fe ff ff e9 91 fc ff ff 41 89 c5 e9 5c fc ff ff 0f 0b 89 f8 25 ff ff f7 ff 89 85 8c fe ff ff e9 d5 f2 ff ff <0f> 0b e9 65 f2 ff ff 65 8b 05 38 81 d2 47 f6 c4 01 74 1c 65 48 8b
[ 548.623281] RSP: 0018:
ffff8801f28c7678 EFLAGS:
00010246
[ 548.623284] RAX:
0000000000000000 RBX:
00000000006040c0 RCX:
ffffffffb82f73b7
[ 548.623287] RDX:
1ffff1003e518eeb RSI:
000000000000000c RDI:
0000000000000000
[ 548.623290] RBP:
ffff8801f28c7880 R08:
0000000000000000 R09:
ffffed0047fff2c5
[ 548.623292] R10:
0000000000000001 R11:
ffffed0047fff2c4 R12:
ffff8801e88de040
[ 548.623295] R13:
00000000006040c0 R14:
000000000000000c R15:
ffff8801f28c7938
[ 548.623299] FS:
00007f76fca51840(0000) GS:
ffff8801f6f00000(0000) knlGS:
0000000000000000
[ 548.623302] CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033
[ 548.623304] CR2:
00007f19b9171760 CR3:
00000001ed952000 CR4:
00000000000006e0
[ 548.623317] Call Trace:
[ 548.623325] ? kasan_check_read+0x11/0x20
[ 548.623330] ? __zone_watermark_ok+0x92/0x240
[ 548.623336] ? get_page_from_freelist+0x1c3/0x1d90
[ 548.623347] ? _raw_spin_lock_irqsave+0x2a/0x60
[ 548.623353] ? warn_alloc+0x250/0x250
[ 548.623358] ? save_stack+0x46/0xd0
[ 548.623361] ? kasan_kmalloc+0xad/0xe0
[ 548.623366] ? __isolate_free_page+0x2a0/0x2a0
[ 548.623370] ? mount_fs+0x60/0x1a0
[ 548.623374] ? vfs_kern_mount+0x6b/0x1a0
[ 548.623378] ? do_mount+0x34a/0x18c0
[ 548.623383] ? ksys_mount+0x83/0xd0
[ 548.623387] ? __x64_sys_mount+0x67/0x80
[ 548.623391] ? do_syscall_64+0x78/0x170
[ 548.623396] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 548.623401] __alloc_pages_nodemask+0x3c5/0x400
[ 548.623407] ? __alloc_pages_slowpath+0x1420/0x1420
[ 548.623412] ? __mutex_lock_slowpath+0x20/0x20
[ 548.623417] ? kvmalloc_node+0x31/0x80
[ 548.623424] alloc_pages_current+0x75/0x110
[ 548.623436] kmalloc_order+0x24/0x60
[ 548.623442] kmalloc_order_trace+0x24/0xb0
[ 548.623448] __kmalloc_track_caller+0x207/0x220
[ 548.623455] ? f2fs_build_node_manager+0x399/0xbb0
[ 548.623460] kmemdup+0x20/0x50
[ 548.623465] f2fs_build_node_manager+0x399/0xbb0
[ 548.623470] f2fs_fill_super+0x195e/0x2b40
[ 548.623477] ? f2fs_commit_super+0x1b0/0x1b0
[ 548.623481] ? set_blocksize+0x90/0x140
[ 548.623486] mount_bdev+0x1c5/0x210
[ 548.623489] ? f2fs_commit_super+0x1b0/0x1b0
[ 548.623495] f2fs_mount+0x15/0x20
[ 548.623498] mount_fs+0x60/0x1a0
[ 548.623503] ? alloc_vfsmnt+0x309/0x360
[ 548.623508] vfs_kern_mount+0x6b/0x1a0
[ 548.623513] do_mount+0x34a/0x18c0
[ 548.623518] ? lockref_put_or_lock+0xcf/0x160
[ 548.623523] ? copy_mount_string+0x20/0x20
[ 548.623528] ? memcg_kmem_put_cache+0x1b/0xa0
[ 548.623533] ? kasan_check_write+0x14/0x20
[ 548.623537] ? _copy_from_user+0x6a/0x90
[ 548.623542] ? memdup_user+0x42/0x60
[ 548.623547] ksys_mount+0x83/0xd0
[ 548.623552] __x64_sys_mount+0x67/0x80
[ 548.623557] do_syscall_64+0x78/0x170
[ 548.623562] entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 548.623566] RIP: 0033:0x7f76fc331b9a
[ 548.623567] Code: 48 8b 0d 01 c3 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d ce c2 2b 00 f7 d8 64 89 01 48
[ 548.623632] RSP: 002b:
00007ffd4f0a0e48 EFLAGS:
00000206 ORIG_RAX:
00000000000000a5
[ 548.623636] RAX:
ffffffffffffffda RBX:
000000000146c030 RCX:
00007f76fc331b9a
[ 548.623639] RDX:
000000000146c210 RSI:
000000000146df30 RDI:
0000000001474ec0
[ 548.623641] RBP:
0000000000000000 R08:
0000000000000000 R09:
0000000000000013
[ 548.623643] R10:
00000000c0ed0000 R11:
0000000000000206 R12:
0000000001474ec0
[ 548.623646] R13:
000000000146c210 R14:
0000000000000000 R15:
0000000000000003
[ 548.623650] ---[ end trace
4ce02f25ff7d3df5 ]---
[ 548.623656] F2FS-fs (loop0): Failed to initialize F2FS node manager
[ 548.627936] F2FS-fs (loop0): Invalid log blocks per segment (8201)
[ 548.627940] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock
[ 548.635835] F2FS-fs (loop0): Failed to initialize F2FS node manager
- Location
https://elixir.bootlin.com/linux/v4.18-rc1/source/fs/f2fs/segment.c#L3578
sit_i->sit_bitmap = kmemdup(src_bitmap, bitmap_size, GFP_KERNEL);
Buffer overrun happens when doing memcpy. I suspect there is missing (inconsistent) checks on bitmap_size.
Reported by Wen Xu (wen.xu@gatech.edu) from SSLab, Gatech.
Reported-by: Wen Xu <wen.xu@gatech.edu>
Signed-off-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Zumeng Chen [Wed, 4 Jul 2018 04:35:29 +0000 (12:35 +0800)]
mfd: ti_am335x_tscadc: Fix struct clk memory leak
[ Upstream commit
c2b1509c77a99a0dcea0a9051ca743cb88385f50 ]
Use devm_elk_get() to let Linux manage struct clk memory to avoid the following
memory leakage report:
unreferenced object 0xdd75efc0 (size 64):
comm "systemd-udevd", pid 186, jiffies
4294945126 (age 1195.750s)
hex dump (first 32 bytes):
61 64 63 5f 74 73 63 5f 66 63 6b 00 00 00 00 00 adc_tsc_fck.....
00 00 00 00 92 03 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<
c0a15260>] kmemleak_alloc+0x40/0x74
[<
c0287a10>] __kmalloc_track_caller+0x198/0x388
[<
c0255610>] kstrdup+0x40/0x5c
[<
c025565c>] kstrdup_const+0x30/0x3c
[<
c0636630>] __clk_create_clk+0x60/0xac
[<
c0630918>] clk_get_sys+0x74/0x144
[<
c0630cdc>] clk_get+0x5c/0x68
[<
bf0ac540>] ti_tscadc_probe+0x260/0x468 [ti_am335x_tscadc]
[<
c06f3c0c>] platform_drv_probe+0x60/0xac
[<
c06f1abc>] driver_probe_device+0x214/0x2dc
[<
c06f1c18>] __driver_attach+0x94/0xc0
[<
c06efe2c>] bus_for_each_dev+0x90/0xa0
[<
c06f1470>] driver_attach+0x28/0x30
[<
c06f1030>] bus_add_driver+0x184/0x1ec
[<
c06f2b74>] driver_register+0xb0/0xf0
[<
c06f3b4c>] __platform_driver_register+0x40/0x54
Signed-off-by: Zumeng Chen <zumeng.chen@gmail.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Geert Uytterhoeven [Fri, 20 Jul 2018 16:16:59 +0000 (18:16 +0200)]
iommu/ipmmu-vmsa: Fix allocation in atomic context
[ Upstream commit
46583e8c48c5a094ba28060615b3a7c8c576690f ]
When attaching a device to an IOMMU group with
CONFIG_DEBUG_ATOMIC_SLEEP=y:
BUG: sleeping function called from invalid context at mm/slab.h:421
in_atomic(): 1, irqs_disabled(): 128, pid: 61, name: kworker/1:1
...
Call trace:
...
arm_lpae_alloc_pgtable+0x114/0x184
arm_64_lpae_alloc_pgtable_s1+0x2c/0x128
arm_32_lpae_alloc_pgtable_s1+0x40/0x6c
alloc_io_pgtable_ops+0x60/0x88
ipmmu_attach_device+0x140/0x334
ipmmu_attach_device() takes a spinlock, while arm_lpae_alloc_pgtable()
allocates memory using GFP_KERNEL. Originally, the ipmmu-vmsa driver
had its own custom page table allocation implementation using
GFP_ATOMIC, hence the spinlock was fine.
Fix this by replacing the spinlock by a mutex, like the arm-smmu driver
does.
Fixes:
f20ed39f53145e45 ("iommu/ipmmu-vmsa: Use the ARM LPAE page table allocator")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Mauricio Faria de Oliveira [Thu, 26 Jul 2018 01:46:28 +0000 (22:46 -0300)]
partitions/aix: fix usage of uninitialized lv_info and lvname structures
[ Upstream commit
14cb2c8a6c5dae57ee3e2da10fa3db2b9087e39e ]
The if-block that sets a successful return value in aix_partition()
uses 'lvip[].pps_per_lv' and 'n[].name' potentially uninitialized.
For example, if 'numlvs' is zero or alloc_lvn() fails, neither is
initialized, but are used anyway if alloc_pvd() succeeds after it.
So, make the alloc_pvd() call conditional on their initialization.
This has been hit when attaching an apparently corrupted/stressed
AIX LUN, misleading the kernel to pr_warn() invalid data and hang.
[...] partition (null) (11 pp's found) is not contiguous
[...] partition (null) (2 pp's found) is not contiguous
[...] partition (null) (3 pp's found) is not contiguous
[...] partition (null) (64 pp's found) is not contiguous
Fixes:
6ceea22bbbc8 ("partitions: add aix lvm partition support files")
Signed-off-by: Mauricio Faria de Oliveira <mfo@canonical.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Mauricio Faria de Oliveira [Thu, 26 Jul 2018 01:46:29 +0000 (22:46 -0300)]
partitions/aix: append null character to print data from disk
[ Upstream commit
d43fdae7bac2def8c4314b5a49822cb7f08a45f1 ]
Even if properly initialized, the lvname array (i.e., strings)
is read from disk, and might contain corrupt data (e.g., lack
the null terminating character for strings).
So, make sure the partition name string used in pr_warn() has
the null terminating character.
Fixes:
6ceea22bbbc8 ("partitions: add aix lvm partition support files")
Suggested-by: Daniel J. Axtens <daniel.axtens@canonical.com>
Signed-off-by: Mauricio Faria de Oliveira <mfo@canonical.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Nick Dyer [Fri, 27 Jul 2018 18:44:20 +0000 (11:44 -0700)]
Input: atmel_mxt_ts - only use first T9 instance
[ Upstream commit
36f5d9ef26e52edff046b4b097855db89bf0cd4a ]
The driver only registers one input device, which uses the screen
parameters from the first T9 instance. The first T63 instance also uses
those parameters.
It is incorrect to send input reports from the second instances of these
objects if they are enabled: the input scaling will be wrong and the
positions will be mashed together.
This also causes problems on Android if the number of slots exceeds 32.
In the future, this could be handled by looking for enabled touch object
instances and creating an input device for each one.
Signed-off-by: Nick Dyer <nick.dyer@itdev.co.uk>
Acked-by: Benson Leung <bleung@chromium.org>
Acked-by: Yufeng Shen <miletus@chromium.org>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>