Commit Graph

971653 Commits

Author SHA1 Message Date
Yongqin Liu
cfe05bdbf9 ANDROID: abi_gki_aarch64_db845c: Update for the DMABUF_HEAPS_SYSTEM change
After recent changes to the DMABUF_HEAPS_SYSTEM config, we need the following
symbols in the symbol list.

Generated with:
  BUILD_CONFIG=common/build.config.db845c build/build_abi.sh -s

Fixes: 9ebbf23bfb ("ANDROID: defconfig: Enable DMA-BUF system heap as a module")

Signed-off-by: Yongqin Liu <yongqin.liu@linaro.org>
Change-Id: I6ee22dfa07f794cdb30ad2fc312bb229b66f6518
2021-01-01 21:10:24 +08:00
Greg Kroah-Hartman
19057a6a6b Merge 5.10.4 into android12-5.10
Changes in 5.10.4
	hwmon: (k10temp) Remove support for displaying voltage and current on Zen CPUs
	drm/gma500: fix double free of gma_connector
	iio: adc: at91_adc: add Kconfig dep on the OF symbol and remove of_match_ptr()
	drm/aspeed: Fix Kconfig warning & subsequent build errors
	drm/mcde: Fix handling of platform_get_irq() error
	drm/tve200: Fix handling of platform_get_irq() error
	arm64: dts: renesas: hihope-rzg2-ex: Drop rxc-skew-ps from ethernet-phy node
	arm64: dts: renesas: cat875: Remove rxc-skew-ps from ethernet-phy node
	soc: renesas: rmobile-sysc: Fix some leaks in rmobile_init_pm_domains()
	soc: mediatek: Check if power domains can be powered on at boot time
	arm64: dts: mediatek: mt8183: fix gce incorrect mbox-cells value
	arm64: dts: ipq6018: update the reserved-memory node
	arm64: dts: qcom: sc7180: Fix one forgotten interconnect reference
	soc: qcom: geni: More properly switch to DMA mode
	Revert "i2c: i2c-qcom-geni: Fix DMA transfer race"
	RDMA/bnxt_re: Set queue pair state when being queried
	rtc: pcf2127: fix pcf2127_nvmem_read/write() returns
	RDMA/bnxt_re: Fix entry size during SRQ create
	selinux: fix error initialization in inode_doinit_with_dentry()
	ARM: dts: aspeed-g6: Fix the GPIO memory size
	ARM: dts: aspeed: s2600wf: Fix VGA memory region location
	RDMA/core: Fix error return in _ib_modify_qp()
	RDMA/rxe: Compute PSN windows correctly
	x86/mm/ident_map: Check for errors from ident_pud_init()
	ARM: p2v: fix handling of LPAE translation in BE mode
	RDMA/rtrs-clt: Remove destroy_con_cq_qp in case route resolving failed
	RDMA/rtrs-clt: Missing error from rtrs_rdma_conn_established
	RDMA/rtrs-srv: Don't guard the whole __alloc_srv with srv_mutex
	x86/apic: Fix x2apic enablement without interrupt remapping
	ASoC: qcom: fix unsigned int bitwidth compared to less than zero
	sched/deadline: Fix sched_dl_global_validate()
	sched: Reenable interrupts in do_sched_yield()
	drm/amdgpu: fix incorrect enum type
	crypto: talitos - Endianess in current_desc_hdr()
	crypto: talitos - Fix return type of current_desc_hdr()
	crypto: inside-secure - Fix sizeof() mismatch
	ASoC: sun4i-i2s: Fix lrck_period computation for I2S justified mode
	drm/msm: Add missing stub definition
	ARM: dts: aspeed: tiogapass: Remove vuart
	drm/amdgpu: fix build_coefficients() argument
	powerpc/64: Set up a kernel stack for secondaries before cpu_restore()
	spi: img-spfi: fix reference leak in img_spfi_resume
	f2fs: call f2fs_get_meta_page_retry for nat page
	RDMA/mlx5: Fix corruption of reg_pages in mlx5_ib_rereg_user_mr()
	perf test: Use generic event for expand_libpfm_events()
	drm/msm/dp: DisplayPort PHY compliance tests fixup
	drm/msm/dsi_pll_7nm: restore VCO rate during restore_state
	drm/msm/dsi_pll_10nm: restore VCO rate during restore_state
	drm/msm/dpu: fix clock scaling on non-sc7180 board
	spi: spi-mem: fix reference leak in spi_mem_access_start
	scsi: aacraid: Improve compat_ioctl handlers
	pinctrl: core: Add missing #ifdef CONFIG_GPIOLIB
	ASoC: pcm: DRAIN support reactivation
	drm/bridge: tpd12s015: Fix irq registering in tpd12s015_probe
	crypto: arm64/poly1305-neon - reorder PAC authentication with SP update
	crypto: arm/aes-neonbs - fix usage of cbc(aes) fallback
	crypto: caam - fix printing on xts fallback allocation error path
	selinux: fix inode_doinit_with_dentry() LABEL_INVALID error handling
	nl80211/cfg80211: fix potential infinite loop
	spi: stm32: fix reference leak in stm32_spi_resume
	bpf: Fix tests for local_storage
	x86/mce: Correct the detection of invalid notifier priorities
	drm/edid: Fix uninitialized variable in drm_cvt_modes()
	ath11k: Initialize complete alpha2 for regulatory change
	ath11k: Fix number of rules in filtered ETSI regdomain
	ath11k: fix wmi init configuration
	brcmfmac: Fix memory leak for unpaired brcmf_{alloc/free}
	arm64: dts: exynos: Include common syscon restart/poweroff for Exynos7
	arm64: dts: exynos: Correct psci compatible used on Exynos7
	drm/panel: simple: Add flags to boe_nv133fhm_n61
	Bluetooth: Fix null pointer dereference in hci_event_packet()
	Bluetooth: Fix: LL PRivacy BLE device fails to connect
	Bluetooth: hci_h5: fix memory leak in h5_close
	spi: stm32-qspi: fix reference leak in stm32 qspi operations
	spi: spi-ti-qspi: fix reference leak in ti_qspi_setup
	spi: mt7621: fix missing clk_disable_unprepare() on error in mt7621_spi_probe
	spi: tegra20-slink: fix reference leak in slink ops of tegra20
	spi: tegra20-sflash: fix reference leak in tegra_sflash_resume
	spi: tegra114: fix reference leak in tegra spi ops
	spi: bcm63xx-hsspi: fix missing clk_disable_unprepare() on error in bcm63xx_hsspi_resume
	spi: imx: fix reference leak in two imx operations
	ASoC: qcom: common: Fix refcounting in qcom_snd_parse_of()
	ath11k: Handle errors if peer creation fails
	mwifiex: fix mwifiex_shutdown_sw() causing sw reset failure
	drm/msm/a6xx: Clear shadow on suspend
	drm/msm/a5xx: Clear shadow on suspend
	firmware: tegra: fix strncpy()/strncat() confusion
	drm/msm/dp: return correct connection status after suspend
	drm/msm/dp: skip checking LINK_STATUS_UPDATED bit
	drm/msm/dp: do not notify audio subsystem if sink doesn't support audio
	selftests/run_kselftest.sh: fix dry-run typo
	selftest/bpf: Add missed ip6ip6 test back
	ASoC: wm8994: Fix PM disable depth imbalance on error
	ASoC: wm8998: Fix PM disable depth imbalance on error
	spi: sprd: fix reference leak in sprd_spi_remove
	virtiofs fix leak in setup
	ASoC: arizona: Fix a wrong free in wm8997_probe
	RDMa/mthca: Work around -Wenum-conversion warning
	ASoC: SOF: Intel: fix Kconfig dependency for SND_INTEL_DSP_CONFIG
	arm64: dts: ti: k3-am65*/j721e*: Fix unit address format error for dss node
	MIPS: BCM47XX: fix kconfig dependency bug for BCM47XX_BCMA
	drm/amdgpu: fix compute queue priority if num_kcq is less than 4
	soc: ti: omap-prm: Do not check rstst bit on deassert if already deasserted
	crypto: Kconfig - CRYPTO_MANAGER_EXTRA_TESTS requires the manager
	crypto: qat - fix status check in qat_hal_put_rel_rd_xfer()
	firmware: arm_scmi: Fix missing destroy_workqueue()
	drm/udl: Fix missing error code in udl_handle_damage()
	staging: greybus: codecs: Fix reference counter leak in error handling
	staging: gasket: interrupt: fix the missed eventfd_ctx_put() in gasket_interrupt.c
	scripts: kernel-doc: Restore anonymous enum parsing
	drm/amdkfd: Put ACPI table after using it
	ionic: use mc sync for multicast filters
	ionic: flatten calls to ionic_lif_rx_mode
	ionic: change set_rx_mode from_ndo to can_sleep
	media: tm6000: Fix sizeof() mismatches
	media: platform: add missing put_device() call in mtk_jpeg_clk_init()
	media: mtk-vcodec: add missing put_device() call in mtk_vcodec_init_dec_pm()
	media: mtk-vcodec: add missing put_device() call in mtk_vcodec_release_dec_pm()
	media: mtk-vcodec: add missing put_device() call in mtk_vcodec_init_enc_pm()
	media: v4l2-fwnode: Return -EINVAL for invalid bus-type
	media: v4l2-fwnode: v4l2_fwnode_endpoint_parse caller must init vep argument
	media: ov5640: fix support of BT656 bus mode
	media: staging: rkisp1: cap: fix runtime PM imbalance on error
	media: cedrus: fix reference leak in cedrus_start_streaming
	media: platform: add missing put_device() call in mtk_jpeg_probe() and mtk_jpeg_remove()
	media: venus: core: change clk enable and disable order in resume and suspend
	media: venus: core: vote for video-mem path
	media: venus: core: vote with average bandwidth and peak bandwidth as zero
	RDMA/cma: Add missing error handling of listen_id
	ASoC: meson: fix COMPILE_TEST error
	spi: dw: fix build error by selecting MULTIPLEXER
	scsi: core: Fix VPD LUN ID designator priorities
	media: venus: put dummy vote on video-mem path after last session release
	media: solo6x10: fix missing snd_card_free in error handling case
	video: fbdev: atmel_lcdfb: fix return error code in atmel_lcdfb_of_init()
	mmc: sdhci: tegra: fix wrong unit with busy_timeout
	drm/omap: dmm_tiler: fix return error code in omap_dmm_probe()
	drm/meson: Free RDMA resources after tearing down DRM
	drm/meson: Unbind all connectors on module removal
	drm/meson: dw-hdmi: Register a callback to disable the regulator
	drm/meson: dw-hdmi: Ensure that clocks are enabled before touching the TOP registers
	ASoC: intel: SND_SOC_INTEL_KEEMBAY should depend on ARCH_KEEMBAY
	iommu/vt-d: include conditionally on CONFIG_INTEL_IOMMU_SVM
	Input: ads7846 - fix race that causes missing releases
	Input: ads7846 - fix integer overflow on Rt calculation
	Input: ads7846 - fix unaligned access on 7845
	bus: mhi: core: Remove double locking from mhi_driver_remove()
	bus: mhi: core: Fix null pointer access when parsing MHI configuration
	usb/max3421: fix return error code in max3421_probe()
	spi: mxs: fix reference leak in mxs_spi_probe
	selftests/bpf: Fix broken riscv build
	powerpc: Avoid broken GCC __attribute__((optimize))
	powerpc/feature: Fix CPU_FTRS_ALWAYS by removing CPU_FTRS_GENERIC_32
	ARM: dts: tacoma: Fix node vs reg mismatch for flash memory
	Revert "powerpc/pseries/hotplug-cpu: Remove double free in error path"
	powerpc/powernv/sriov: fix unsigned int win compared to less than zero
	mfd: htc-i2cpld: Add the missed i2c_put_adapter() in htcpld_register_chip_i2c()
	mfd: MFD_SL28CPLD should depend on ARCH_LAYERSCAPE
	mfd: stmfx: Fix dev_err_probe() call in stmfx_chip_init()
	mfd: cpcap: Fix interrupt regression with regmap clear_ack
	EDAC/mce_amd: Use struct cpuinfo_x86.cpu_die_id for AMD NodeId
	scsi: ufs: Avoid to call REQ_CLKS_OFF to CLKS_OFF
	scsi: ufs: Fix clkgating on/off
	rcu: Allow rcu_irq_enter_check_tick() from NMI
	rcu,ftrace: Fix ftrace recursion
	rcu/tree: Defer kvfree_rcu() allocation to a clean context
	crypto: crypto4xx - Replace bitwise OR with logical OR in crypto4xx_build_pd
	crypto: omap-aes - Fix PM disable depth imbalance in omap_aes_probe
	crypto: sun8i-ce - fix two error path's memory leak
	spi: fix resource leak for drivers without .remove callback
	drm/meson: dw-hdmi: Disable clocks on driver teardown
	drm/meson: dw-hdmi: Enable the iahb clock early enough
	PCI: Disable MSI for Pericom PCIe-USB adapter
	PCI: brcmstb: Initialize "tmp" before use
	soc: ti: knav_qmss: fix reference leak in knav_queue_probe
	soc: ti: Fix reference imbalance in knav_dma_probe
	drivers: soc: ti: knav_qmss_queue: Fix error return code in knav_queue_probe
	soc: qcom: initialize local variable
	arm64: dts: qcom: sm8250: correct compatible for sm8250-mtp
	arm64: dts: qcom: msm8916-samsung-a2015: Disable muic i2c pin bias
	Input: omap4-keypad - fix runtime PM error handling
	clk: meson: Kconfig: fix dependency for G12A
	staging: mfd: hi6421-spmi-pmic: fix error return code in hi6421_spmi_pmic_probe()
	ath11k: Fix the rx_filter flag setting for peer rssi stats
	RDMA/cxgb4: Validate the number of CQEs
	soundwire: Fix DEBUG_LOCKS_WARN_ON for uninitialized attribute
	pinctrl: sunxi: fix irq bank map for the Allwinner A100 pin controller
	memstick: fix a double-free bug in memstick_check
	ARM: dts: at91: sam9x60: add pincontrol for USB Host
	ARM: dts: at91: sama5d4_xplained: add pincontrol for USB Host
	ARM: dts: at91: sama5d3_xplained: add pincontrol for USB Host
	mmc: pxamci: Fix error return code in pxamci_probe
	brcmfmac: fix error return code in brcmf_cfg80211_connect()
	orinoco: Move context allocation after processing the skb
	qtnfmac: fix error return code in qtnf_pcie_probe()
	rsi: fix error return code in rsi_reset_card()
	cw1200: fix missing destroy_workqueue() on error in cw1200_init_common
	dmaengine: mv_xor_v2: Fix error return code in mv_xor_v2_probe()
	arm64: dts: qcom: sdm845: Limit ipa iommu streams
	leds: netxbig: add missing put_device() call in netxbig_leds_get_of_pdata()
	leds: lp50xx: Fix an error handling path in 'lp50xx_probe_dt()'
	leds: turris-omnia: check for LED_COLOR_ID_RGB instead LED_COLOR_ID_MULTI
	arm64: tegra: Fix DT binding for IO High Voltage entry
	RDMA/cma: Fix deadlock on &lock in rdma_cma_listen_on_all() error unwind
	soundwire: qcom: Fix build failure when slimbus is module
	drm/imx/dcss: fix rotations for Vivante tiled formats
	media: siano: fix memory leak of debugfs members in smsdvb_hotplug
	platform/x86: mlx-platform: Remove PSU EEPROM from default platform configuration
	platform/x86: mlx-platform: Remove PSU EEPROM from MSN274x platform configuration
	arm64: dts: qcom: sc7180: limit IPA iommu streams
	RDMA/hns: Only record vlan info for HIP08
	RDMA/hns: Fix missing fields in address vector
	RDMA/hns: Avoid setting loopback indicator when smac is same as dmac
	serial: 8250-mtk: Fix reference leak in mtk8250_probe
	samples: bpf: Fix lwt_len_hist reusing previous BPF map
	media: imx214: Fix stop streaming
	mips: cdmm: fix use-after-free in mips_cdmm_bus_discover
	media: max2175: fix max2175_set_csm_mode() error code
	slimbus: qcom-ngd-ctrl: Avoid sending power requests without QMI
	RDMA/core: Track device memory MRs
	drm/mediatek: Use correct aliases name for ovl
	HSI: omap_ssi: Don't jump to free ID in ssi_add_controller()
	ARM: dts: Remove non-existent i2c1 from 98dx3236
	arm64: dts: armada-3720-turris-mox: update ethernet-phy handle name
	power: supply: bq25890: Use the correct range for IILIM register
	arm64: dts: rockchip: Set dr_mode to "host" for OTG on rk3328-roc-cc
	power: supply: max17042_battery: Fix current_{avg,now} hiding with no current sense
	power: supply: axp288_charger: Fix HP Pavilion x2 10 DMI matching
	power: supply: bq24190_charger: fix reference leak
	genirq/irqdomain: Don't try to free an interrupt that has no mapping
	arm64: dts: ls1028a: fix ENETC PTP clock input
	arm64: dts: ls1028a: fix FlexSPI clock input
	arm64: dts: freescale: sl28: combine SPI MTD partitions
	phy: tegra: xusb: Fix usb_phy device driver field
	arm64: dts: qcom: c630: Polish i2c-hid devices
	arm64: dts: qcom: c630: Fix pinctrl pins properties
	PCI: Bounds-check command-line resource alignment requests
	PCI: Fix overflow in command-line resource alignment requests
	PCI: iproc: Fix out-of-bound array accesses
	PCI: iproc: Invalidate correct PAXB inbound windows
	arm64: dts: meson: fix spi-max-frequency on Khadas VIM2
	arm64: dts: meson-sm1: fix typo in opp table
	soc: amlogic: canvas: add missing put_device() call in meson_canvas_get()
	scsi: hisi_sas: Fix up probe error handling for v3 hw
	scsi: pm80xx: Do not sleep in atomic context
	spi: spi-fsl-dspi: Use max_native_cs instead of num_chipselect to set SPI_MCR
	ARM: dts: at91: at91sam9rl: fix ADC triggers
	RDMA/hns: Fix 0-length sge calculation error
	RDMA/hns: Bugfix for calculation of extended sge
	mailbox: arm_mhu_db: Fix mhu_db_shutdown by replacing kfree with devm_kfree
	soundwire: master: use pm_runtime_set_active() on add
	platform/x86: dell-smbios-base: Fix error return code in dell_smbios_init
	ASoC: Intel: Boards: tgl_max98373: update TDM slot_width
	media: max9271: Fix GPIO enable/disable
	media: rdacm20: Enable GPIO1 explicitly
	media: i2c: imx219: Selection compliance fixes
	ath11k: Don't cast ath11k_skb_cb to ieee80211_tx_info.control
	ath11k: Reset ath11k_skb_cb before setting new flags
	ath11k: Fix an error handling path
	ath10k: Fix the parsing error in service available event
	ath10k: Fix an error handling path
	ath10k: Release some resources in an error handling path
	SUNRPC: rpc_wake_up() should wake up tasks in the correct order
	NFSv4.2: condition READDIR's mask for security label based on LSM state
	SUNRPC: xprt_load_transport() needs to support the netid "rdma6"
	NFSv4: Fix the alignment of page data in the getdeviceinfo reply
	net: sunrpc: Fix 'snprintf' return value check in 'do_xprt_debugfs'
	lockd: don't use interval-based rebinding over TCP
	NFS: switch nfsiod to be an UNBOUND workqueue.
	selftests/seccomp: Update kernel config
	vfio-pci: Use io_remap_pfn_range() for PCI IO memory
	hwmon: (ina3221) Fix PM usage counter unbalance in ina3221_write_enable
	f2fs: fix double free of unicode map
	media: tvp5150: Fix wrong return value of tvp5150_parse_dt()
	media: saa7146: fix array overflow in vidioc_s_audio()
	powerpc/perf: Fix crash with is_sier_available when pmu is not set
	powerpc/64: Fix an EMIT_BUG_ENTRY in head_64.S
	powerpc/xmon: Fix build failure for 8xx
	powerpc/perf: Fix to update radix_scope_qual in power10
	powerpc/perf: Update the PMU group constraints for l2l3 events in power10
	powerpc/perf: Fix the PMU group constraints for threshold events in power10
	clocksource/drivers/orion: Add missing clk_disable_unprepare() on error path
	clocksource/drivers/cadence_ttc: Fix memory leak in ttc_setup_clockevent()
	clocksource/drivers/ingenic: Fix section mismatch
	clocksource/drivers/riscv: Make RISCV_TIMER depends on RISCV_SBI
	arm64: mte: fix prctl(PR_GET_TAGGED_ADDR_CTRL) if TCF0=NONE
	iio: hrtimer-trigger: Mark hrtimer to expire in hard interrupt context
	libbpf: Sanitise map names before pinning
	ARM: dts: at91: sam9x60ek: remove bypass property
	ARM: dts: at91: sama5d2: map securam as device
	scripts: kernel-doc: fix parsing function-like typedefs
	bpf: Fix bpf_put_raw_tracepoint()'s use of __module_address()
	selftests/bpf: Fix invalid use of strncat in test_sockmap
	pinctrl: falcon: add missing put_device() call in pinctrl_falcon_probe()
	soc: rockchip: io-domain: Fix error return code in rockchip_iodomain_probe()
	arm64: dts: rockchip: Fix UART pull-ups on rk3328
	memstick: r592: Fix error return in r592_probe()
	MIPS: Don't round up kernel sections size for memblock_add()
	mt76: mt7663s: fix a possible ple quota underflow
	mt76: mt7915: set fops_sta_stats.owner to THIS_MODULE
	mt76: set fops_tx_stats.owner to THIS_MODULE
	mt76: dma: fix possible deadlock running mt76_dma_cleanup
	net/mlx5: Properly convey driver version to firmware
	mt76: fix memory leak if device probing fails
	mt76: fix tkip configuration for mt7615/7663 devices
	ASoC: jz4740-i2s: add missed checks for clk_get()
	ASoC: q6afe-clocks: Add missing parent clock rate
	dm ioctl: fix error return code in target_message
	ASoC: cros_ec_codec: fix uninitialized memory read
	ASoC: atmel: mchp-spdifrx needs COMMON_CLK
	ASoC: qcom: fix QDSP6 dependencies, attempt #3
	phy: mediatek: allow compile-testing the hdmi phy
	phy: renesas: rcar-gen3-usb2: disable runtime pm in case of failure
	memory: ti-emif-sram: only build for ARMv7
	memory: jz4780_nemc: Fix potential NULL dereference in jz4780_nemc_probe()
	drm/msm: a5xx: Make preemption reset case reentrant
	drm/msm: add IOMMU_SUPPORT dependency
	clocksource/drivers/arm_arch_timer: Use stable count reader in erratum sne
	clocksource/drivers/arm_arch_timer: Correct fault programming of CNTKCTL_EL1.EVNTI
	cpufreq: ap806: Add missing MODULE_DEVICE_TABLE
	cpufreq: highbank: Add missing MODULE_DEVICE_TABLE
	cpufreq: mediatek: Add missing MODULE_DEVICE_TABLE
	cpufreq: qcom: Add missing MODULE_DEVICE_TABLE
	cpufreq: st: Add missing MODULE_DEVICE_TABLE
	cpufreq: sun50i: Add missing MODULE_DEVICE_TABLE
	cpufreq: loongson1: Add missing MODULE_ALIAS
	cpufreq: scpi: Add missing MODULE_ALIAS
	cpufreq: vexpress-spc: Add missing MODULE_ALIAS
	cpufreq: imx: fix NVMEM_IMX_OCOTP dependency
	macintosh/adb-iop: Always wait for reply message from IOP
	macintosh/adb-iop: Send correct poll command
	staging: bcm2835: fix vchiq_mmal dependencies
	staging: greybus: audio: Fix possible leak free widgets in gbaudio_dapm_free_controls
	spi: dw: Fix error return code in dw_spi_bt1_probe()
	Bluetooth: btusb: Add the missed release_firmware() in btusb_mtk_setup_firmware()
	Bluetooth: btmtksdio: Add the missed release_firmware() in mtk_setup_firmware()
	Bluetooth: sco: Fix crash when using BT_SNDMTU/BT_RCVMTU option
	block/rnbd-clt: Dynamically alloc buffer for pathname & blk_symlink_name
	block/rnbd: fix a null pointer dereference on dev->blk_symlink_name
	Bluetooth: btusb: Fix detection of some fake CSR controllers with a bcdDevice val of 0x0134
	platform/x86: intel-vbtn: Fix SW_TABLET_MODE always reporting 1 on some HP x360 models
	adm8211: fix error return code in adm8211_probe()
	mtd: spi-nor: sst: fix BPn bits for the SST25VF064C
	mtd: spi-nor: ignore errors in spi_nor_unlock_all()
	mtd: spi-nor: atmel: remove global protection flag
	mtd: spi-nor: atmel: fix unlock_all() for AT25FS010/040
	arm64: dts: meson: g12b: odroid-n2: fix PHY deassert timing requirements
	arm64: dts: meson: fix PHY deassert timing requirements
	ARM: dts: meson: fix PHY deassert timing requirements
	arm64: dts: meson: g12a: x96-max: fix PHY deassert timing requirements
	arm64: dts: meson: g12b: w400: fix PHY deassert timing requirements
	clk: fsl-sai: fix memory leak
	scsi: qedi: Fix missing destroy_workqueue() on error in __qedi_probe
	scsi: pm80xx: Fix error return in pm8001_pci_probe()
	scsi: iscsi: Fix inappropriate use of put_device()
	seq_buf: Avoid type mismatch for seq_buf_init
	scsi: fnic: Fix error return code in fnic_probe()
	platform/x86: mlx-platform: Fix item counter assignment for MSN2700, MSN24xx systems
	platform/x86: mlx-platform: Fix item counter assignment for MSN2700/ComEx system
	ARM: 9030/1: entry: omit FP emulation for UND exceptions taken in kernel mode
	powerpc/pseries/hibernation: drop pseries_suspend_begin() from suspend ops
	powerpc/pseries/hibernation: remove redundant cacheinfo update
	powerpc/powermac: Fix low_sleep_handler with CONFIG_VMAP_STACK
	drm/mediatek: avoid dereferencing a null hdmi_phy on an error message
	ASoC: amd: change clk_get() to devm_clk_get() and add missed checks
	coresight: remove broken __exit annotations
	ASoC: max98390: Fix error codes in max98390_dsm_init()
	powerpc/mm: sanity_check_fault() should work for all, not only BOOK3S
	usb: ehci-omap: Fix PM disable depth umbalance in ehci_hcd_omap_probe
	usb: oxu210hp-hcd: Fix memory leak in oxu_create
	speakup: fix uninitialized flush_lock
	nfsd: Fix message level for normal termination
	NFSD: Fix 5 seconds delay when doing inter server copy
	nfs_common: need lock during iterate through the list
	x86/kprobes: Restore BTF if the single-stepping is cancelled
	scsi: qla2xxx: Fix FW initialization error on big endian machines
	scsi: qla2xxx: Fix N2N and NVMe connect retry failure
	platform/chrome: cros_ec_spi: Don't overwrite spi::mode
	misc: pci_endpoint_test: fix return value of error branch
	bus: fsl-mc: add back accidentally dropped error check
	bus: fsl-mc: fix error return code in fsl_mc_object_allocate()
	fsi: Aspeed: Add mutex to protect HW access
	s390/cio: fix use-after-free in ccw_device_destroy_console
	iwlwifi: dbg-tlv: fix old length in is_trig_data_contained()
	iwlwifi: mvm: hook up missing RX handlers
	erofs: avoid using generic_block_bmap
	clk: renesas: r8a779a0: Fix R and OSC clocks
	can: m_can: m_can_config_endisable(): remove double clearing of clock stop request bit
	powerpc/sstep: Emulate prefixed instructions only when CPU_FTR_ARCH_31 is set
	powerpc/sstep: Cover new VSX instructions under CONFIG_VSX
	slimbus: qcom: fix potential NULL dereference in qcom_slim_prg_slew()
	ALSA: hda/hdmi: fix silent stream for first playback to DP
	RDMA/core: Do not indicate device ready when device enablement fails
	RDMA/uverbs: Fix incorrect variable type
	remoteproc/mediatek: change MT8192 CFG register base
	remoteproc/mtk_scp: surround DT device IDs with CONFIG_OF
	remoteproc: q6v5-mss: fix error handling in q6v5_pds_enable
	remoteproc: qcom: fix reference leak in adsp_start
	remoteproc: qcom: pas: fix error handling in adsp_pds_enable
	remoteproc: k3-dsp: Fix return value check in k3_dsp_rproc_of_get_memories()
	remoteproc: qcom: Fix potential NULL dereference in adsp_init_mmio()
	remoteproc/mediatek: unprepare clk if scp_before_load fails
	clk: qcom: gcc-sc7180: Use floor ops for sdcc clks
	clk: tegra: Fix duplicated SE clock entry
	mtd: rawnand: gpmi: fix reference count leak in gpmi ops
	mtd: rawnand: meson: Fix a resource leak in init
	mtd: rawnand: gpmi: Fix the random DMA timeout issue
	samples/bpf: Fix possible hang in xdpsock with multiple threads
	fs: Handle I_DONTCACHE in iput_final() instead of generic_drop_inode()
	extcon: max77693: Fix modalias string
	crypto: atmel-i2c - select CONFIG_BITREVERSE
	mac80211: don't set set TDLS STA bandwidth wider than possible
	mac80211: fix a mistake check for rx_stats update
	ASoC: wm_adsp: remove "ctl" from list on error in wm_adsp_create_control()
	irqchip/alpine-msi: Fix freeing of interrupts on allocation error path
	irqchip/ti-sci-inta: Fix printing of inta id on probe success
	irqchip/ti-sci-intr: Fix freeing of irqs
	dmaengine: ti: k3-udma: Correct normal channel offset when uchan_cnt is not 0
	RDMA/hns: Limit the length of data copied between kernel and userspace
	RDMA/hns: Normalization the judgment of some features
	RDMA/hns: Do shift on traffic class when using RoCEv2
	gpiolib: irq hooks: fix recursion in gpiochip_irq_unmask
	ath11k: Fix incorrect tlvs in scan start command
	irqchip/qcom-pdc: Fix phantom irq when changing between rising/falling
	watchdog: armada_37xx: Add missing dependency on HAS_IOMEM
	watchdog: sirfsoc: Add missing dependency on HAS_IOMEM
	watchdog: sprd: remove watchdog disable from resume fail path
	watchdog: sprd: check busy bit before new loading rather than after that
	watchdog: Fix potential dereferencing of null pointer
	ubifs: Fix error return code in ubifs_init_authentication()
	um: Monitor error events in IRQ controller
	um: tty: Fix handling of close in tty lines
	um: chan_xterm: Fix fd leak
	sunrpc: fix xs_read_xdr_buf for partial pages receive
	RDMA/mlx5: Fix MR cache memory leak
	RDMA/cma: Don't overwrite sgid_attr after device is released
	nfc: s3fwrn5: Release the nfc firmware
	drm: mxsfb: Silence -EPROBE_DEFER while waiting for bridge
	powerpc/perf: Fix Threshold Event Counter Multiplier width for P10
	powerpc/ps3: use dma_mapping_error()
	perf test: Fix metric parsing test
	drm/amdgpu: fix regression in vbios reservation handling on headless
	mm/gup: reorganize internal_get_user_pages_fast()
	mm/gup: prevent gup_fast from racing with COW during fork
	mm/gup: combine put_compound_head() and unpin_user_page()
	mm: memcg/slab: fix return of child memcg objcg for root memcg
	mm: memcg/slab: fix use after free in obj_cgroup_charge
	mm/rmap: always do TTU_IGNORE_ACCESS
	sparc: fix handling of page table constructor failure
	mm/vmalloc: Fix unlock order in s_stop()
	mm/vmalloc.c: fix kasan shadow poisoning size
	mm,memory_failure: always pin the page in madvise_inject_error
	hugetlb: fix an error code in hugetlb_reserve_pages()
	mm: don't wake kswapd prematurely when watermark boosting is disabled
	proc: fix lookup in /proc/net subdirectories after setns(2)
	checkpatch: fix unescaped left brace
	s390/test_unwind: fix CALL_ON_STACK tests
	lan743x: fix rx_napi_poll/interrupt ping-pong
	ice, xsk: clear the status bits for the next_to_use descriptor
	i40e, xsk: clear the status bits for the next_to_use descriptor
	net: dsa: qca: ar9331: fix sleeping function called from invalid context bug
	dpaa2-eth: fix the size of the mapped SGT buffer
	net: bcmgenet: Fix a resource leak in an error handling path in the probe functin
	net: mscc: ocelot: Fix a resource leak in the error handling path of the probe function
	net: allwinner: Fix some resources leak in the error handling path of the probe and in the remove function
	block/rnbd-clt: Get rid of warning regarding size argument in strlcpy
	block/rnbd-clt: Fix possible memleak
	NFS/pNFS: Fix a typo in ff_layout_resend_pnfs_read()
	net: korina: fix return value
	devlink: use _BITUL() macro instead of BIT() in the UAPI header
	libnvdimm/label: Return -ENXIO for no slot in __blk_label_update
	powerpc/32s: Fix cleanup_cpu_mmu_context() compile bug
	watchdog: qcom: Avoid context switch in restart handler
	watchdog: coh901327: add COMMON_CLK dependency
	clk: ti: Fix memleak in ti_fapll_synth_setup
	pwm: zx: Add missing cleanup in error path
	pwm: lp3943: Dynamically allocate PWM chip base
	pwm: imx27: Fix overflow for bigger periods
	pwm: sun4i: Remove erroneous else branch
	io_uring: cancel only requests of current task
	tools build: Add missing libcap to test-all.bin target
	perf record: Fix memory leak when using '--user-regs=?' to list registers
	qlcnic: Fix error code in probe
	nfp: move indirect block cleanup to flower app stop callback
	vdpa/mlx5: Use write memory barrier after updating CQ index
	virtio_ring: Cut and paste bugs in vring_create_virtqueue_packed()
	virtio_net: Fix error code in probe()
	virtio_ring: Fix two use after free bugs
	vhost scsi: fix error return code in vhost_scsi_set_endpoint()
	epoll: check for events when removing a timed out thread from the wait queue
	clk: bcm: dvp: Add MODULE_DEVICE_TABLE()
	clk: at91: sama7g5: fix compilation error
	clk: at91: sam9x60: remove atmel,osc-bypass support
	clk: s2mps11: Fix a resource leak in error handling paths in the probe function
	clk: sunxi-ng: Make sure divider tables have sentinel
	clk: vc5: Use "idt,voltage-microvolt" instead of "idt,voltage-microvolts"
	kconfig: fix return value of do_error_if()
	powerpc/boot: Fix build of dts/fsl
	powerpc/smp: Add __init to init_big_cores()
	ARM: 9044/1: vfp: use undef hook for VFP support detection
	ARM: 9036/1: uncompress: Fix dbgadtb size parameter name
	perf probe: Fix memory leak when synthesizing SDT probes
	io_uring: fix racy IOPOLL flush overflow
	io_uring: cancel reqs shouldn't kill overflow list
	Smack: Handle io_uring kernel thread privileges
	proc mountinfo: make splice available again
	io_uring: fix io_cqring_events()'s noflush
	io_uring: fix racy IOPOLL completions
	io_uring: always let io_iopoll_complete() complete polled io
	vfio/pci: Move dummy_resources_list init in vfio_pci_probe()
	vfio/pci/nvlink2: Do not attempt NPU2 setup on POWER8NVL NPU
	media: gspca: Fix memory leak in probe
	io_uring: fix io_wqe->work_list corruption
	io_uring: fix 0-iov read buffer select
	io_uring: hold uring_lock while completing failed polled io in io_wq_submit_work()
	io_uring: fix ignoring xa_store errors
	io_uring: fix double io_uring free
	io_uring: make ctx cancel on exit targeted to actual ctx
	media: sunxi-cir: ensure IR is handled when it is continuous
	media: netup_unidvb: Don't leak SPI master in probe error path
	media: ipu3-cio2: Remove traces of returned buffers
	media: ipu3-cio2: Return actual subdev format
	media: ipu3-cio2: Serialise access to pad format
	media: ipu3-cio2: Validate mbus format in setting subdev format
	media: ipu3-cio2: Make the field on subdev format V4L2_FIELD_NONE
	Input: cyapa_gen6 - fix out-of-bounds stack access
	ALSA: hda/ca0132 - Change Input Source enum strings.
	ACPI: NFIT: Fix input validation of bus-family
	PM: ACPI: PCI: Drop acpi_pm_set_bridge_wakeup()
	Revert "ACPI / resources: Use AE_CTRL_TERMINATE to terminate resources walks"
	ACPI: PNP: compare the string length in the matching_id()
	ALSA: hda: Fix regressions on clear and reconfig sysfs
	ALSA: hda/ca0132 - Fix AE-5 rear headphone pincfg.
	ALSA: hda/realtek: make bass spk volume adjustable on a yoga laptop
	ALSA: hda/realtek - Enable headset mic of ASUS X430UN with ALC256
	ALSA: hda/realtek - Enable headset mic of ASUS Q524UQK with ALC255
	ALSA: hda/realtek - Add supported for more Lenovo ALC285 Headset Button
	ALSA: pcm: oss: Fix a few more UBSAN fixes
	ALSA/hda: apply jack fixup for the Acer Veriton N4640G/N6640G/N2510G
	ALSA: hda/realtek: Add quirk for MSI-GP73
	ALSA: hda/realtek: Apply jack fixup for Quanta NL3
	ALSA: hda/realtek: Remove dummy lineout on Acer TravelMate P648/P658
	ALSA: hda/realtek - Supported Dell fixed type headset
	ALSA: usb-audio: Add VID to support native DSD reproduction on FiiO devices
	ALSA: usb-audio: Disable sample read check if firmware doesn't give back
	ALSA: usb-audio: Add alias entry for ASUS PRIME TRX40 PRO-S
	ALSA: core: memalloc: add page alignment for iram
	s390/smp: perform initial CPU reset also for SMT siblings
	s390/kexec_file: fix diag308 subcode when loading crash kernel
	s390/idle: add missing mt_cycles calculation
	s390/idle: fix accounting with machine checks
	s390/dasd: fix hanging device offline processing
	s390/dasd: prevent inconsistent LCU device data
	s390/dasd: fix list corruption of pavgroup group list
	s390/dasd: fix list corruption of lcu list
	binder: add flag to clear buffer on txn complete
	ASoC: cx2072x: Fix doubly definitions of Playback and Capture streams
	ASoC: AMD Renoir - add DMI table to avoid the ACP mic probe (broken BIOS)
	ASoC: AMD Raven/Renoir - fix the PCI probe (PCI revision)
	staging: comedi: mf6x4: Fix AI end-of-conversion detection
	z3fold: simplify freeing slots
	z3fold: stricter locking and more careful reclaim
	perf/x86/intel: Add event constraint for CYCLE_ACTIVITY.STALLS_MEM_ANY
	perf/x86/intel: Fix rtm_abort_event encoding on Ice Lake
	perf/x86/intel/lbr: Fix the return type of get_lbr_cycles()
	powerpc/perf: Exclude kernel samples while counting events in user space.
	cpufreq: intel_pstate: Use most recent guaranteed performance values
	crypto: ecdh - avoid unaligned accesses in ecdh_set_secret()
	crypto: arm/aes-ce - work around Cortex-A57/A72 silion errata
	m68k: Fix WARNING splat in pmac_zilog driver
	Documentation: seqlock: s/LOCKTYPE/LOCKNAME/g
	EDAC/i10nm: Use readl() to access MMIO registers
	EDAC/amd64: Fix PCI component registration
	cpuset: fix race between hotplug work and later CPU offline
	dyndbg: fix use before null check
	USB: serial: mos7720: fix parallel-port state restore
	USB: serial: digi_acceleport: fix write-wakeup deadlocks
	USB: serial: keyspan_pda: fix dropped unthrottle interrupts
	USB: serial: keyspan_pda: fix write deadlock
	USB: serial: keyspan_pda: fix stalled writes
	USB: serial: keyspan_pda: fix write-wakeup use-after-free
	USB: serial: keyspan_pda: fix tx-unthrottle use-after-free
	USB: serial: keyspan_pda: fix write unthrottling
	btrfs: do not shorten unpin len for caching block groups
	btrfs: update last_byte_to_unpin in switch_commit_roots
	btrfs: fix race when defragmenting leads to unnecessary IO
	ext4: fix an IS_ERR() vs NULL check
	ext4: fix a memory leak of ext4_free_data
	ext4: fix deadlock with fs freezing and EA inodes
	ext4: don't remount read-only with errors=continue on reboot
	RISC-V: Fix usage of memblock_enforce_memory_limit
	arm64: dts: ti: k3-am65: mark dss as dma-coherent
	arm64: dts: marvell: keep SMMU disabled by default for Armada 7040 and 8040
	KVM: arm64: Introduce handling of AArch32 TTBCR2 traps
	KVM: x86: reinstate vendor-agnostic check on SPEC_CTRL cpuid bits
	KVM: SVM: Remove the call to sev_platform_status() during setup
	iommu/arm-smmu: Allow implementation specific write_s2cr
	iommu/arm-smmu-qcom: Read back stream mappings
	iommu/arm-smmu-qcom: Implement S2CR quirk
	ARM: dts: pandaboard: fix pinmux for gpio user button of Pandaboard ES
	ARM: dts: at91: sama5d2: fix CAN message ram offset and size
	ARM: tegra: Populate OPP table for Tegra20 Ventana
	xprtrdma: Fix XDRBUF_SPARSE_PAGES support
	powerpc/32: Fix vmap stack - Properly set r1 before activating MMU on syscall too
	powerpc: Fix incorrect stw{, ux, u, x} instructions in __set_pte_at
	powerpc/rtas: Fix typo of ibm,open-errinjct in RTAS filter
	powerpc/bitops: Fix possible undefined behaviour with fls() and fls64()
	powerpc/feature: Add CPU_FTR_NOEXECUTE to G2_LE
	powerpc/xmon: Change printk() to pr_cont()
	powerpc/8xx: Fix early debug when SMC1 is relocated
	powerpc/mm: Fix verification of MMU_FTR_TYPE_44x
	powerpc/powernv/npu: Do not attempt NPU2 setup on POWER8NVL NPU
	powerpc/powernv/memtrace: Don't leak kernel memory to user space
	powerpc/powernv/memtrace: Fix crashing the kernel when enabling concurrently
	ovl: make ioctl() safe
	ima: Don't modify file descriptor mode on the fly
	um: Remove use of asprinf in umid.c
	um: Fix time-travel mode
	ceph: fix race in concurrent __ceph_remove_cap invocations
	SMB3: avoid confusing warning message on mount to Azure
	SMB3.1.1: remove confusing mount warning when no SPNEGO info on negprot rsp
	SMB3.1.1: do not log warning message if server doesn't populate salt
	ubifs: wbuf: Don't leak kernel memory to flash
	jffs2: Fix GC exit abnormally
	jffs2: Fix ignoring mounting options problem during remounting
	fsnotify: generalize handle_inode_event()
	inotify: convert to handle_inode_event() interface
	fsnotify: fix events reported to watching parent and child
	jfs: Fix array index bounds check in dbAdjTree
	drm/panfrost: Fix job timeout handling
	drm/panfrost: Move the GPU reset bits outside the timeout handler
	platform/x86: mlx-platform: remove an unused variable
	drm/amdgpu: only set DP subconnector type on DP and eDP connectors
	drm/amd/display: Fix memory leaks in S3 resume
	drm/dp_aux_dev: check aux_dev before use in drm_dp_aux_dev_get_by_minor()
	drm/i915: Fix mismatch between misplaced vma check and vma insert
	iio: ad_sigma_delta: Don't put SPI transfer buffer on the stack
	spi: pxa2xx: Fix use-after-free on unbind
	spi: spi-sh: Fix use-after-free on unbind
	spi: atmel-quadspi: Fix use-after-free on unbind
	spi: spi-mtk-nor: Don't leak SPI master in probe error path
	spi: ar934x: Don't leak SPI master in probe error path
	spi: davinci: Fix use-after-free on unbind
	spi: fsl: fix use of spisel_boot signal on MPC8309
	spi: gpio: Don't leak SPI master in probe error path
	spi: mxic: Don't leak SPI master in probe error path
	spi: npcm-fiu: Disable clock in probe error path
	spi: pic32: Don't leak DMA channels in probe error path
	spi: rb4xx: Don't leak SPI master in probe error path
	spi: rpc-if: Fix use-after-free on unbind
	spi: sc18is602: Don't leak SPI master in probe error path
	spi: spi-geni-qcom: Fix use-after-free on unbind
	spi: spi-qcom-qspi: Fix use-after-free on unbind
	spi: st-ssc4: Fix unbalanced pm_runtime_disable() in probe error path
	spi: synquacer: Disable clock in probe error path
	spi: mt7621: Disable clock in probe error path
	spi: mt7621: Don't leak SPI master in probe error path
	spi: atmel-quadspi: Disable clock in probe error path
	spi: atmel-quadspi: Fix AHB memory accesses
	soc: qcom: smp2p: Safely acquire spinlock without IRQs
	mtd: spinand: Fix OOB read
	mtd: parser: cmdline: Fix parsing of part-names with colons
	mtd: core: Fix refcounting for unpartitioned MTDs
	mtd: rawnand: qcom: Fix DMA sync on FLASH_STATUS register read
	mtd: rawnand: meson: fix meson_nfc_dma_buffer_release() arguments
	scsi: qla2xxx: Fix crash during driver load on big endian machines
	scsi: lpfc: Fix invalid sleeping context in lpfc_sli4_nvmet_alloc()
	scsi: lpfc: Fix scheduling call while in softirq context in lpfc_unreg_rpi
	scsi: lpfc: Re-fix use after free in lpfc_rq_buf_free()
	openat2: reject RESOLVE_BENEATH|RESOLVE_IN_ROOT
	iio: buffer: Fix demux update
	iio: adc: rockchip_saradc: fix missing clk_disable_unprepare() on error in rockchip_saradc_resume
	iio: imu: st_lsm6dsx: fix edge-trigger interrupts
	iio:light:rpr0521: Fix timestamp alignment and prevent data leak.
	iio:light:st_uvis25: Fix timestamp alignment and prevent data leak.
	iio:magnetometer:mag3110: Fix alignment and data leak issues.
	iio:pressure:mpl3115: Force alignment of buffer
	iio:imu:bmi160: Fix too large a buffer.
	iio:imu:bmi160: Fix alignment and data leak issues
	iio:adc:ti-ads124s08: Fix buffer being too long.
	iio:adc:ti-ads124s08: Fix alignment and data leak issues.
	md/cluster: block reshape with remote resync job
	md/cluster: fix deadlock when node is doing resync job
	pinctrl: sunxi: Always call chained_irq_{enter, exit} in sunxi_pinctrl_irq_handler
	clk: ingenic: Fix divider calculation with div tables
	clk: mvebu: a3700: fix the XTAL MODE pin to MPP1_9
	clk: tegra: Do not return 0 on failure
	counter: microchip-tcb-capture: Fix CMR value check
	device-dax/core: Fix memory leak when rmmod dax.ko
	dma-buf/dma-resv: Respect num_fences when initializing the shared fence list.
	driver: core: Fix list corruption after device_del()
	xen-blkback: set ring->xenblkd to NULL after kthread_stop()
	xen/xenbus: Allow watches discard events before queueing
	xen/xenbus: Add 'will_handle' callback support in xenbus_watch_path()
	xen/xenbus/xen_bus_type: Support will_handle watch callback
	xen/xenbus: Count pending messages for each watch
	xenbus/xenbus_backend: Disallow pending watch messages
	memory: jz4780_nemc: Fix an error pointer vs NULL check in probe()
	memory: renesas-rpc-if: Fix a node reference leak in rpcif_probe()
	memory: renesas-rpc-if: Return correct value to the caller of rpcif_manual_xfer()
	memory: renesas-rpc-if: Fix unbalanced pm_runtime_enable in rpcif_{enable,disable}_rpm
	libnvdimm/namespace: Fix reaping of invalidated block-window-namespace labels
	platform/x86: intel-vbtn: Allow switch events on Acer Switch Alpha 12
	tracing: Disable ftrace selftests when any tracer is running
	mt76: add back the SUPPORTS_REORDERING_BUFFER flag
	of: fix linker-section match-table corruption
	PCI: Fix pci_slot_release() NULL pointer dereference
	regulator: axp20x: Fix DLDO2 voltage control register mask for AXP22x
	remoteproc: sysmon: Ensure remote notification ordering
	thermal/drivers/cpufreq_cooling: Update cpufreq_state only if state has changed
	rtc: ep93xx: Fix NULL pointer dereference in ep93xx_rtc_read_time
	Revert: "ring-buffer: Remove HAVE_64BIT_ALIGNED_ACCESS"
	null_blk: Fix zone size initialization
	null_blk: Fail zone append to conventional zones
	drm/edid: fix objtool warning in drm_cvt_modes()
	x86/CPU/AMD: Save AMD NodeId as cpu_die_id
	Linux 5.10.4

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I25209e79d8b9faf5382087955a29b7404bdefe38
2020-12-30 12:47:03 +01:00
Greg Kroah-Hartman
b1313fe517 Linux 5.10.4
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Link: https://lore.kernel.org/r/20201229103832.108495696@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:54:29 +01:00
Yazen Ghannam
700d098ace x86/CPU/AMD: Save AMD NodeId as cpu_die_id
[ Upstream commit 028c221ed1 ]

AMD systems provide a "NodeId" value that represents a global ID
indicating to which "Node" a logical CPU belongs. The "Node" is a
physical structure equivalent to a Die, and it should not be confused
with logical structures like NUMA nodes. Logical nodes can be adjusted
based on firmware or other settings whereas the physical nodes/dies are
fixed based on hardware topology.

The NodeId value can be used when a physical ID is needed by software.

Save the AMD NodeId to struct cpuinfo_x86.cpu_die_id. Use the value
from CPUID or MSR as appropriate. Default to phys_proc_id otherwise.
Do so for both AMD and Hygon systems.

Drop the node_id parameter from cacheinfo_*_init_llc_id() as it is no
longer needed.

Update the x86 topology documentation.

Suggested-by: Borislav Petkov <bp@alien8.de>
Signed-off-by: Yazen Ghannam <yazen.ghannam@amd.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Link: https://lkml.kernel.org/r/20201109210659.754018-2-Yazen.Ghannam@amd.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-12-30 11:54:29 +01:00
Linus Torvalds
bb25fd4926 drm/edid: fix objtool warning in drm_cvt_modes()
commit d652d5f1ee upstream.

Commit 991fcb77f4 ("drm/edid: Fix uninitialized variable in
drm_cvt_modes()") just replaced one warning with another.

The original warning about a possibly uninitialized variable was due to
the compiler not being smart enough to see that the case statement
actually enumerated all possible cases.  And the initial fix was just to
add a "default" case that had a single "unreachable()", just to tell the
compiler that that situation cannot happen.

However, that doesn't actually fix the fundamental reason for the
problem: the compiler still doesn't see that the existing case
statements enumerate all possibilities, so the compiler will still
generate code to jump to that unreachable case statement.  It just won't
complain about an uninitialized variable any more.

So now the compiler generates code to our inline asm marker that we told
it would not fall through, and end end result is basically random.  We
have created a bridge to nowhere.

And then, depending on the random details of just exactly what the
compiler ends up doing, 'objtool' might end up complaining about the
conditional branches (for conditions that cannot happen, and that thus
will never be taken - but if the compiler was not smart enough to figure
that out, we can't expect objtool to do so) going off in the weeds.

So depending on how the compiler has laid out the result, you might see
something like this:

    drivers/gpu/drm/drm_edid.o: warning: objtool: do_cvt_mode() falls through to next function drm_mode_detailed.isra.0()

and now you have a truly inscrutable warning that makes no sense at all
unless you start looking at whatever random code the compiler happened
to generate for our bare "unreachable()" statement.

IOW, don't use "unreachable()" unless you have an _active_ operation
that generates code that actually makes it obvious that something is not
reachable (ie an UD instruction or similar).

Solve the "compiler isn't smart enough" problem by just marking one of
the cases as "default", so that even when the compiler doesn't otherwise
see that we've enumerated all cases, the compiler will feel happy and
safe about there always being a valid case that initializes the 'width'
variable.

This also generates better code, since now the compiler doesn't generate
comparisons for five different possibilities (the four real ones and the
one that can't happen), but just for the three real ones and "the rest"
(which is that last one).

A smart enough compiler that sees that we cover all the cases won't care.

Cc: Lyude Paul <lyude@redhat.com>
Cc: Ilia Mirkin <imirkin@alum.mit.edu>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:54:29 +01:00
Damien Le Moal
c13edadf10 null_blk: Fail zone append to conventional zones
commit 2e896d8951 upstream.

Conventional zones do not have a write pointer and so cannot accept zone
append writes. Make sure to fail any zone append write command issued to
a conventional zone.

Reported-by: Naohiro Aota <naohiro.aota@wdc.com>
Fixes: e0489ed5da ("null_blk: Support REQ_OP_ZONE_APPEND")
Cc: stable@vger.kernel.org
Signed-off-by: Damien Le Moal <damien.lemoal@wdc.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:54:29 +01:00
Damien Le Moal
92ee9b9fa8 null_blk: Fix zone size initialization
commit 0ebcdd702f upstream.

For a null_blk device with zoned mode enabled is currently initialized
with a number of zones equal to the device capacity divided by the zone
size, without considering if the device capacity is a multiple of the
zone size. If the zone size is not a divisor of the capacity, the zones
end up not covering the entire capacity, potentially resulting is out
of bounds accesses to the zone array.

Fix this by adding one last smaller zone with a size equal to the
remainder of the disk capacity divided by the zone size if the capacity
is not a multiple of the zone size. For such smaller last zone, the zone
capacity is also checked so that it does not exceed the smaller zone
size.

Reported-by: Naohiro Aota <naohiro.aota@wdc.com>
Fixes: ca4b2a0119 ("null_blk: add zone support")
Cc: stable@vger.kernel.org
Signed-off-by: Damien Le Moal <damien.lemoal@wdc.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:54:29 +01:00
Steven Rostedt (VMware)
2bbb320656 Revert: "ring-buffer: Remove HAVE_64BIT_ALIGNED_ACCESS"
commit adab66b71a upstream.

It was believed that metag was the only architecture that required the ring
buffer to keep 8 byte words aligned on 8 byte architectures, and with its
removal, it was assumed that the ring buffer code did not need to handle
this case. It appears that sparc64 also requires this.

The following was reported on a sparc64 boot up:

   kernel: futex hash table entries: 65536 (order: 9, 4194304 bytes, linear)
   kernel: Running postponed tracer tests:
   kernel: Testing tracer function:
   kernel: Kernel unaligned access at TPC[552a20] trace_function+0x40/0x140
   kernel: Kernel unaligned access at TPC[552a24] trace_function+0x44/0x140
   kernel: Kernel unaligned access at TPC[552a20] trace_function+0x40/0x140
   kernel: Kernel unaligned access at TPC[552a24] trace_function+0x44/0x140
   kernel: Kernel unaligned access at TPC[552a20] trace_function+0x40/0x140
   kernel: PASSED

Need to put back the 64BIT aligned code for the ring buffer.

Link: https://lore.kernel.org/r/CADxRZqzXQRYgKc=y-KV=S_yHL+Y8Ay2mh5ezeZUnpRvg+syWKw@mail.gmail.com

Cc: stable@vger.kernel.org
Fixes: 86b3de60a0 ("ring-buffer: Remove HAVE_64BIT_ALIGNED_ACCESS")
Reported-by: Anatoly Pugachev <matorola@gmail.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:54:29 +01:00
Nikita Shubin
783c5d48b2 rtc: ep93xx: Fix NULL pointer dereference in ep93xx_rtc_read_time
commit 00c33482bb upstream.

Mismatch in probe platform_set_drvdata set's and method's that call
dev_get_platdata will result in "Unable to handle kernel NULL pointer
dereference", let's use according method for getting driver data after
platform_set_drvdata.

8<--- cut here ---
Unable to handle kernel NULL pointer dereference at virtual address 00000000
pgd = (ptrval)
[00000000] *pgd=00000000
Internal error: Oops: 5 [#1] ARM
Modules linked in:
CPU: 0 PID: 1 Comm: swapper Not tainted 5.9.10-00003-g723e101e0037-dirty #4
Hardware name: Technologic Systems TS-72xx SBC
PC is at ep93xx_rtc_read_time+0xc/0x2c
LR is at __rtc_read_time+0x4c/0x8c
[...]
[<c02b01c8>] (ep93xx_rtc_read_time) from [<c02ac38c>] (__rtc_read_time+0x4c/0x8c)
[<c02ac38c>] (__rtc_read_time) from [<c02ac3f8>] (rtc_read_time+0x2c/0x4c)
[<c02ac3f8>] (rtc_read_time) from [<c02acc54>] (__rtc_read_alarm+0x28/0x358)
[<c02acc54>] (__rtc_read_alarm) from [<c02abd80>] (__rtc_register_device+0x124/0x2ec)
[<c02abd80>] (__rtc_register_device) from [<c02b028c>] (ep93xx_rtc_probe+0xa4/0xac)
[<c02b028c>] (ep93xx_rtc_probe) from [<c026424c>] (platform_drv_probe+0x24/0x5c)
[<c026424c>] (platform_drv_probe) from [<c0262918>] (really_probe+0x218/0x374)
[<c0262918>] (really_probe) from [<c0262da0>] (device_driver_attach+0x44/0x60)
[<c0262da0>] (device_driver_attach) from [<c0262e70>] (__driver_attach+0xb4/0xc0)
[<c0262e70>] (__driver_attach) from [<c0260d44>] (bus_for_each_dev+0x68/0xac)
[<c0260d44>] (bus_for_each_dev) from [<c026223c>] (driver_attach+0x18/0x24)
[<c026223c>] (driver_attach) from [<c0261dd8>] (bus_add_driver+0x150/0x1b4)
[<c0261dd8>] (bus_add_driver) from [<c026342c>] (driver_register+0xb0/0xf4)
[<c026342c>] (driver_register) from [<c0264210>] (__platform_driver_register+0x30/0x48)
[<c0264210>] (__platform_driver_register) from [<c04cb9ac>] (ep93xx_rtc_driver_init+0x10/0x1c)
[<c04cb9ac>] (ep93xx_rtc_driver_init) from [<c000973c>] (do_one_initcall+0x7c/0x1c0)
[<c000973c>] (do_one_initcall) from [<c04b9ecc>] (kernel_init_freeable+0x168/0x1ac)
[<c04b9ecc>] (kernel_init_freeable) from [<c03b2228>] (kernel_init+0x8/0xf4)
[<c03b2228>] (kernel_init) from [<c00082c0>] (ret_from_fork+0x14/0x34)
Exception stack(0xc441dfb0 to 0xc441dff8)
dfa0:                                     00000000 00000000 00000000 00000000
dfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
dfe0: 00000000 00000000 00000000 00000000 00000013 00000000
Code: e12fff1e e92d4010 e590303c e1a02001 (e5933000)
---[ end trace c914d6030eaa95c8 ]---

Fixes: b809d192eb ("rtc: ep93xx: stop setting platform_data")
Signed-off-by: Nikita Shubin <nikita.shubin@maquefel.me>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20201201095507.10317-1-nikita.shubin@maquefel.me
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:54:29 +01:00
Zhuguangqing
b98ce1a172 thermal/drivers/cpufreq_cooling: Update cpufreq_state only if state has changed
commit 236761f19a upstream.

If state has not changed successfully and we updated cpufreq_state,
next time when the new state is equal to cpufreq_state (not changed
successfully last time), we will return directly and miss a
freq_qos_update_request() that should have been.

Fixes: 5130802ddb ("thermal: cpu_cooling: Switch to QoS requests for freq limits")
Cc: v5.4+ <stable@vger.kernel.org> # v5.4+
Signed-off-by: Zhuguangqing <zhuguangqing@xiaomi.com>
Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20201106092243.15574-1-zhuguangqing83@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:54:29 +01:00
Bjorn Andersson
450fc74de1 remoteproc: sysmon: Ensure remote notification ordering
commit 138a6428ba upstream.

The reliance on the remoteproc's state for determining when to send
sysmon notifications to a remote processor is racy with regard to
concurrent remoteproc operations.

Further more the advertisement of the state of other remote processor to
a newly started remote processor might not only send the wrong state,
but might result in a stream of state changes that are out of order.

Address this by introducing state tracking within the sysmon instances
themselves and extend the locking to ensure that the notifications are
consistent with this state.

Fixes: 1f36ab3f6e ("remoteproc: sysmon: Inform current rproc about all active rprocs")
Fixes: 1877f54f75 ("remoteproc: sysmon: Add notifications for events")
Fixes: 1fb82ee806 ("remoteproc: qcom: Introduce sysmon")
Cc: stable@vger.kernel.org
Reviewed-by: Rishabh Bhatnagar <rishabhb@codeaurora.org>
Link: https://lore.kernel.org/r/20201122054135.802935-2-bjorn.andersson@linaro.org
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:54:28 +01:00
DingHua Ma
3f4b60a70c regulator: axp20x: Fix DLDO2 voltage control register mask for AXP22x
commit 291de1d102 upstream.

When I use the axp20x chip to power my SDIO device on the 5.4 kernel,
the output voltage of DLDO2 is wrong. After comparing the register
manual and source code of the chip, I found that the mask bit of the
driver register of the port was wrong. I fixed this error by modifying
the mask register of the source code. This error seems to be a copy
error of the macro when writing the code. Now the voltage output of
the DLDO2 port of axp20x is correct. My development environment is
Allwinner A40I of arm architecture, and the kernel version is 5.4.

Signed-off-by: DingHua Ma <dinghua.ma.sz@gmail.com>
Reviewed-by: Chen-Yu Tsai <wens@csie.org>
Cc: <stable@vger.kernel.org>
Fixes: db4a555f7c ("regulator: axp20x: use defines for masks")
Link: https://lore.kernel.org/r/20201201001000.22302-1-dinghua.ma.sz@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:54:28 +01:00
Jubin Zhong
39a6f4bef6 PCI: Fix pci_slot_release() NULL pointer dereference
commit 4684709bf8 upstream.

If kobject_init_and_add() fails, pci_slot_release() is called to delete
slot->list from parent->slots.  But slot->list hasn't been initialized
yet, so we dereference a NULL pointer:

  Unable to handle kernel NULL pointer dereference at virtual address
00000000
  ...
  CPU: 10 PID: 1 Comm: swapper/0 Not tainted 4.4.240 #197
  task: ffffeb398a45ef10 task.stack: ffffeb398a470000
  PC is at __list_del_entry_valid+0x5c/0xb0
  LR is at pci_slot_release+0x84/0xe4
  ...
  __list_del_entry_valid+0x5c/0xb0
  pci_slot_release+0x84/0xe4
  kobject_put+0x184/0x1c4
  pci_create_slot+0x17c/0x1b4
  __pci_hp_initialize+0x68/0xa4
  pciehp_probe+0x1a4/0x2fc
  pcie_port_probe_service+0x58/0x84
  driver_probe_device+0x320/0x470

Initialize slot->list before calling kobject_init_and_add() to avoid this.

Fixes: 8a94644b44 ("PCI: Fix pci_create_slot() reference count leak")
Link: https://lore.kernel.org/r/1606876422-117457-1-git-send-email-zhongjubin@huawei.com
Signed-off-by: Jubin Zhong <zhongjubin@huawei.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org	# v5.9+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:54:28 +01:00
Johan Hovold
94bc6f5e2c of: fix linker-section match-table corruption
commit 5812b32e01 upstream.

Specify type alignment when declaring linker-section match-table entries
to prevent gcc from increasing alignment and corrupting the various
tables with padding (e.g. timers, irqchips, clocks, reserved memory).

This is specifically needed on x86 where gcc (typically) aligns larger
objects like struct of_device_id with static extent on 32-byte
boundaries which at best prevents matching on anything but the first
entry. Specifying alignment when declaring variables suppresses this
optimisation.

Here's a 64-bit example where all entries are corrupt as 16 bytes of
padding has been inserted before the first entry:

	ffffffff8266b4b0 D __clk_of_table
	ffffffff8266b4c0 d __of_table_fixed_factor_clk
	ffffffff8266b5a0 d __of_table_fixed_clk
	ffffffff8266b680 d __clk_of_table_sentinel

And here's a 32-bit example where the 8-byte-aligned table happens to be
placed on a 32-byte boundary so that all but the first entry are corrupt
due to the 28 bytes of padding inserted between entries:

	812b3ec0 D __irqchip_of_table
	812b3ec0 d __of_table_irqchip1
	812b3fa0 d __of_table_irqchip2
	812b4080 d __of_table_irqchip3
	812b4160 d irqchip_of_match_end

Verified on x86 using gcc-9.3 and gcc-4.9 (which uses 64-byte
alignment), and on arm using gcc-7.2.

Note that there are no in-tree users of these tables on x86 currently
(even if they are included in the image).

Fixes: 54196ccbe0 ("of: consolidate linker section OF match table declarations")
Fixes: f6e916b820 ("irqchip: add basic infrastructure")
Cc: stable <stable@vger.kernel.org>     # 3.9
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20201123102319.8090-2-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:54:28 +01:00
Felix Fietkau
680e7b2a0e mt76: add back the SUPPORTS_REORDERING_BUFFER flag
commit ed89b89330 upstream.

It was accidentally dropped while adding multiple wiphy support
Fixes fast-rx support and avoids handling reordering in both mac80211
and the driver

Cc: stable@vger.kernel.org
Fixes: c89d362541 ("mt76: add function for allocating an extra wiphy")
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:54:28 +01:00
Masami Hiramatsu
f2d7cffc20 tracing: Disable ftrace selftests when any tracer is running
commit 60efe21e59 upstream.

Disable ftrace selftests when any tracer (kernel command line options
like ftrace=, trace_events=, kprobe_events=, and boot-time tracing)
starts running because selftest can disturb it.

Currently ftrace= and trace_events= are checked, but kprobe_events
has a different flag, and boot-time tracing didn't checked. This unifies
the disabled flag and all of those boot-time tracing features sets
the flag.

This also fixes warnings on kprobe-event selftest
(CONFIG_FTRACE_STARTUP_TEST=y and CONFIG_KPROBE_EVENTS=y) with boot-time
tracing (ftrace.event.kprobes.EVENT.probes) like below;

[   59.803496] trace_kprobe: Testing kprobe tracing:
[   59.804258] ------------[ cut here ]------------
[   59.805682] WARNING: CPU: 3 PID: 1 at kernel/trace/trace_kprobe.c:1987 kprobe_trace_self_tests_ib
[   59.806944] Modules linked in:
[   59.807335] CPU: 3 PID: 1 Comm: swapper/0 Not tainted 5.10.0-rc7+ #172
[   59.808029] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1 04/01/204
[   59.808999] RIP: 0010:kprobe_trace_self_tests_init+0x5f/0x42b
[   59.809696] Code: e8 03 00 00 48 c7 c7 30 8e 07 82 e8 6d 3c 46 ff 48 c7 c6 00 b2 1a 81 48 c7 c7 7
[   59.812439] RSP: 0018:ffffc90000013e78 EFLAGS: 00010282
[   59.813038] RAX: 00000000ffffffef RBX: 0000000000000000 RCX: 0000000000049443
[   59.813780] RDX: 0000000000049403 RSI: 0000000000049403 RDI: 000000000002deb0
[   59.814589] RBP: ffffc90000013e90 R08: 0000000000000001 R09: 0000000000000001
[   59.815349] R10: 0000000000000001 R11: 0000000000000000 R12: 00000000ffffffef
[   59.816138] R13: ffff888004613d80 R14: ffffffff82696940 R15: ffff888004429138
[   59.816877] FS:  0000000000000000(0000) GS:ffff88807dcc0000(0000) knlGS:0000000000000000
[   59.817772] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   59.818395] CR2: 0000000001a8dd38 CR3: 0000000002222000 CR4: 00000000000006a0
[   59.819144] Call Trace:
[   59.819469]  ? init_kprobe_trace+0x6b/0x6b
[   59.819948]  do_one_initcall+0x5f/0x300
[   59.820392]  ? rcu_read_lock_sched_held+0x4f/0x80
[   59.820916]  kernel_init_freeable+0x22a/0x271
[   59.821416]  ? rest_init+0x241/0x241
[   59.821841]  kernel_init+0xe/0x10f
[   59.822251]  ret_from_fork+0x22/0x30
[   59.822683] irq event stamp: 16403349
[   59.823121] hardirqs last  enabled at (16403359): [<ffffffff810db81e>] console_unlock+0x48e/0x580
[   59.824074] hardirqs last disabled at (16403368): [<ffffffff810db786>] console_unlock+0x3f6/0x580
[   59.825036] softirqs last  enabled at (16403200): [<ffffffff81c0033a>] __do_softirq+0x33a/0x484
[   59.825982] softirqs last disabled at (16403087): [<ffffffff81a00f02>] asm_call_irq_on_stack+0x10
[   59.827034] ---[ end trace 200c544775cdfeb3 ]---
[   59.827635] trace_kprobe: error on probing function entry.

Link: https://lkml.kernel.org/r/160741764955.3448999.3347769358299456915.stgit@devnote2

Fixes: 4d655281eb ("tracing/boot Add kprobe event support")
Cc: Ingo Molnar <mingo@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:54:28 +01:00
Carlos Garnacho
054c923fd3 platform/x86: intel-vbtn: Allow switch events on Acer Switch Alpha 12
commit fe60009903 upstream.

This 2-in-1 model (Product name: Switch SA5-271) features a SW_TABLET_MODE
that works as it would be expected, both when detaching the keyboard and
when folding it behind the tablet body.

It used to work until the introduction of the allow list at
commit 8169bd3e6e ("platform/x86: intel-vbtn: Switch to an allow-list
for SW_TABLET_MODE reporting"). Add this model to it, so that the Virtual
Buttons device announces the EV_SW features again.

Fixes: 8169bd3e6e ("platform/x86: intel-vbtn: Switch to an allow-list for SW_TABLET_MODE reporting")
Cc: stable@vger.kernel.org
Signed-off-by: Carlos Garnacho <carlosg@gnome.org>
Link: https://lore.kernel.org/r/20201201135727.212917-1-carlosg@gnome.org
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:54:28 +01:00
Dan Williams
16ecf8cecd libnvdimm/namespace: Fix reaping of invalidated block-window-namespace labels
commit 2dd2a1740e upstream.

A recent change to ndctl to attempt to reconfigure namespaces in place
uncovered a label accounting problem in block-window-type namespaces.
The ndctl "create.sh" test is able to trigger this signature:

 WARNING: CPU: 34 PID: 9167 at drivers/nvdimm/label.c:1100 __blk_label_update+0x9a3/0xbc0 [libnvdimm]
 [..]
 RIP: 0010:__blk_label_update+0x9a3/0xbc0 [libnvdimm]
 [..]
 Call Trace:
  uuid_store+0x21b/0x2f0 [libnvdimm]
  kernfs_fop_write+0xcf/0x1c0
  vfs_write+0xcc/0x380
  ksys_write+0x68/0xe0

When allocated capacity for a namespace is renamed (new UUID) the labels
with the old UUID need to be deleted. The ndctl behavior to always
destroy namespaces on reconfiguration hid this problem.

The immediate impact of this bug is limited since block-window-type
namespaces only seem to exist in the specification and not in any
shipping products. However, the label handling code is being reused for
other technologies like CXL region labels, so there is a benefit to
making sure both vertical labels sets (block-window) and horizontal
label sets (pmem) have a functional reference implementation in
libnvdimm.

Fixes: c4703ce11c ("libnvdimm/namespace: Fix label tracking error")
Cc: <stable@vger.kernel.org>
Cc: Vishal Verma <vishal.l.verma@intel.com>
Cc: Dave Jiang <dave.jiang@intel.com>
Cc: Ira Weiny <ira.weiny@intel.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:54:27 +01:00
Lad Prabhakar
ea43135a3c memory: renesas-rpc-if: Fix unbalanced pm_runtime_enable in rpcif_{enable,disable}_rpm
commit 61a6d854b9 upstream.

rpcif_enable_rpm calls pm_runtime_enable, so rpcif_disable_rpm needs to
call pm_runtime_disable and not pm_runtime_put_sync.

Fixes: ca7d8b980b ("memory: add Renesas RPC-IF driver")
Reported-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Reviewed-by: Sergei Shtylyov <sergei.shtylyov@gmail.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20201126191146.8753-3-prabhakar.mahadev-lad.rj@bp.renesas.com
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:54:27 +01:00
Lad Prabhakar
4f826e66b0 memory: renesas-rpc-if: Return correct value to the caller of rpcif_manual_xfer()
commit a0453f4ed0 upstream.

In the error path of rpcif_manual_xfer() the value of ret is overwritten
by value returned by reset_control_reset() function and thus returning
incorrect value to the caller.

This patch makes sure the correct value is returned to the caller of
rpcif_manual_xfer() by dropping the overwrite of ret in error path.
Also now we ignore the value returned by reset_control_reset() in the
error path and instead print a error message when it fails.

Fixes: ca7d8b980b ("memory: add Renesas RPC-IF driver")
Reported-by: Pavel Machek <pavel@denx.de>
Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Reviewed-by: Sergei Shtylyov <sergei.shtylyov@gmail.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Pavel Machek (CIP) <pavel@denx.de>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20201126191146.8753-2-prabhakar.mahadev-lad.rj@bp.renesas.com
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:54:27 +01:00
Lad Prabhakar
7397049404 memory: renesas-rpc-if: Fix a node reference leak in rpcif_probe()
commit 4e6b86b409 upstream.

Release the node reference by calling of_node_put(flash) in the probe.

Fixes: ca7d8b980b ("memory: add Renesas RPC-IF driver")
Reported-by: Pavel Machek <pavel@denx.de>
Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Reviewed-by: Sergei Shtylyov <sergei.shtylyov@gmail.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Pavel Machek (CIP) <pavel@denx.de>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20201126191146.8753-4-prabhakar.mahadev-lad.rj@bp.renesas.com
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:54:27 +01:00
Dan Carpenter
e6fc90d170 memory: jz4780_nemc: Fix an error pointer vs NULL check in probe()
commit 96999c797e upstream.

The devm_ioremap() function returns NULL on error, it doesn't return
error pointers.  This bug could lead to an Oops during probe.

Fixes: f046e4a3f0 ("memory: jz4780_nemc: Only request IO memory the driver will use")
Cc: <stable@vger.kernel.org>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Paul Cercueil <paul@crapouillou.net>
Link: https://lore.kernel.org/r/20200803143607.GC346925@mwanda
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:54:27 +01:00
SeongJae Park
c88347ae93 xenbus/xenbus_backend: Disallow pending watch messages
commit 9996bd4947 upstream.

'xenbus_backend' watches 'state' of devices, which is writable by
guests.  Hence, if guests intensively updates it, dom0 will have lots of
pending events that exhausting memory of dom0.  In other words, guests
can trigger dom0 memory pressure.  This is known as XSA-349.  However,
the watch callback of it, 'frontend_changed()', reads only 'state', so
doesn't need to have the pending events.

To avoid the problem, this commit disallows pending watch messages for
'xenbus_backend' using the 'will_handle()' watch callback.

This is part of XSA-349

Cc: stable@vger.kernel.org
Signed-off-by: SeongJae Park <sjpark@amazon.de>
Reported-by: Michael Kurth <mku@amazon.de>
Reported-by: Pawel Wieczorkiewicz <wipawel@amazon.de>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:54:27 +01:00
SeongJae Park
1a72241aab xen/xenbus: Count pending messages for each watch
commit 3dc86ca6b4 upstream.

This commit adds a counter of pending messages for each watch in the
struct.  It is used to skip unnecessary pending messages lookup in
'unregister_xenbus_watch()'.  It could also be used in 'will_handle'
callback.

This is part of XSA-349

Cc: stable@vger.kernel.org
Signed-off-by: SeongJae Park <sjpark@amazon.de>
Reported-by: Michael Kurth <mku@amazon.de>
Reported-by: Pawel Wieczorkiewicz <wipawel@amazon.de>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:54:27 +01:00
SeongJae Park
6835334e15 xen/xenbus/xen_bus_type: Support will_handle watch callback
commit be987200fb upstream.

This commit adds support of the 'will_handle' watch callback for
'xen_bus_type' users.

This is part of XSA-349

Cc: stable@vger.kernel.org
Signed-off-by: SeongJae Park <sjpark@amazon.de>
Reported-by: Michael Kurth <mku@amazon.de>
Reported-by: Pawel Wieczorkiewicz <wipawel@amazon.de>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:54:27 +01:00
SeongJae Park
9ae6d2f4ca xen/xenbus: Add 'will_handle' callback support in xenbus_watch_path()
commit 2e85d32b1c upstream.

Some code does not directly make 'xenbus_watch' object and call
'register_xenbus_watch()' but use 'xenbus_watch_path()' instead.  This
commit adds support of 'will_handle' callback in the
'xenbus_watch_path()' and it's wrapper, 'xenbus_watch_pathfmt()'.

This is part of XSA-349

Cc: stable@vger.kernel.org
Signed-off-by: SeongJae Park <sjpark@amazon.de>
Reported-by: Michael Kurth <mku@amazon.de>
Reported-by: Pawel Wieczorkiewicz <wipawel@amazon.de>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:54:26 +01:00
SeongJae Park
b4898bdd20 xen/xenbus: Allow watches discard events before queueing
commit fed1755b11 upstream.

If handling logics of watch events are slower than the events enqueue
logic and the events can be created from the guests, the guests could
trigger memory pressure by intensively inducing the events, because it
will create a huge number of pending events that exhausting the memory.

Fortunately, some watch events could be ignored, depending on its
handler callback.  For example, if the callback has interest in only one
single path, the watch wouldn't want multiple pending events.  Or, some
watches could ignore events to same path.

To let such watches to volutarily help avoiding the memory pressure
situation, this commit introduces new watch callback, 'will_handle'.  If
it is not NULL, it will be called for each new event just before
enqueuing it.  Then, if the callback returns false, the event will be
discarded.  No watch is using the callback for now, though.

This is part of XSA-349

Cc: stable@vger.kernel.org
Signed-off-by: SeongJae Park <sjpark@amazon.de>
Reported-by: Michael Kurth <mku@amazon.de>
Reported-by: Pawel Wieczorkiewicz <wipawel@amazon.de>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:54:26 +01:00
Pawel Wieczorkiewicz
aadd67750f xen-blkback: set ring->xenblkd to NULL after kthread_stop()
commit 1c728719a4 upstream.

When xen_blkif_disconnect() is called, the kernel thread behind the
block interface is stopped by calling kthread_stop(ring->xenblkd).
The ring->xenblkd thread pointer being non-NULL determines if the
thread has been already stopped.
Normally, the thread's function xen_blkif_schedule() sets the
ring->xenblkd to NULL, when the thread's main loop ends.

However, when the thread has not been started yet (i.e.
wake_up_process() has not been called on it), the xen_blkif_schedule()
function would not be called yet.

In such case the kthread_stop() call returns -EINTR and the
ring->xenblkd remains dangling.
When this happens, any consecutive call to xen_blkif_disconnect (for
example in frontend_changed() callback) leads to a kernel crash in
kthread_stop() (e.g. NULL pointer dereference in exit_creds()).

This is XSA-350.

Cc: <stable@vger.kernel.org> # 4.12
Fixes: a24fa22ce2 ("xen/blkback: don't use xen_blkif_get() in xen-blkback kthread")
Reported-by: Olivier Benjamin <oliben@amazon.com>
Reported-by: Pawel Wieczorkiewicz <wipawel@amazon.de>
Signed-off-by: Pawel Wieczorkiewicz <wipawel@amazon.de>
Reviewed-by: Julien Grall <jgrall@amazon.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:54:26 +01:00
Takashi Iwai
c26062328e driver: core: Fix list corruption after device_del()
commit 66482f6407 upstream.

The device_links_purge() function (called from device_del()) tries to
remove the links.needs_suppliers list entry, but it's using
list_del(), hence it doesn't initialize after the removal.  This is OK
for normal cases where device_del() is called via device_destroy().
However, it's not guaranteed that the device object will be really
deleted soon after device_del().  In a minor case like HD-audio codec
reconfiguration that re-initializes the device after device_del(), it
may lead to a crash by the corrupted list entry.

As a simple fix, replace list_del() with list_del_init() in order to
make the list intact after the device_del() call.

Fixes: e2ae9bcc4a ("driver core: Add support for linking devices during device addition")
Cc: <stable@vger.kernel.org>
Reviewed-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://lore.kernel.org/r/20201208190326.27531-1-tiwai@suse.de
Cc: Saravana Kannan <saravanak@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:54:26 +01:00
Maarten Lankhorst
0c500d6a5c dma-buf/dma-resv: Respect num_fences when initializing the shared fence list.
commit bf8975837d upstream.

We hardcode the maximum number of shared fences to 4, instead of
respecting num_fences. Use a minimum of 4, but more if num_fences
is higher.

This seems to have been an oversight when first implementing the
api.

Fixes: 04a5faa8cb ("reservation: update api and add some helpers")
Cc: <stable@vger.kernel.org> # v3.17+
Reported-by: Niranjana Vishwanathapura <niranjana.vishwanathapura@intel.com>
Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Reviewed-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20201124115707.406917-1-maarten.lankhorst@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:54:26 +01:00
Wang Hai
224adad2c9 device-dax/core: Fix memory leak when rmmod dax.ko
commit 1aa5743125 upstream.

When I repeatedly modprobe and rmmod dax.ko, kmemleak report a
memory leak as follows:

unreferenced object 0xffff9a5588c05088 (size 8):
  comm "modprobe", pid 261, jiffies 4294693644 (age 42.063s)
...
  backtrace:
    [<00000000e007ced0>] kstrdup+0x35/0x70
    [<000000002ae73897>] kstrdup_const+0x3d/0x50
    [<000000002b00c9c3>] kvasprintf_const+0xbc/0xf0
    [<000000008023282f>] kobject_set_name_vargs+0x3b/0xd0
    [<00000000d2cbaa4e>] kobject_set_name+0x62/0x90
    [<00000000202e7a22>] bus_register+0x7f/0x2b0
    [<000000000b77792c>] 0xffffffffc02840f7
    [<000000002d5be5ac>] 0xffffffffc02840b4
    [<00000000dcafb7cd>] do_one_initcall+0x58/0x240
    [<00000000049fe480>] do_init_module+0x56/0x1e2
    [<0000000022671491>] load_module+0x2517/0x2840
    [<000000001a2201cb>] __do_sys_finit_module+0x9c/0xe0
    [<000000003eb304e7>] do_syscall_64+0x33/0x40
    [<0000000051c5fd06>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

When rmmod dax is executed, dax_bus_exit() is missing. This patch
can fix this bug.

Fixes: 9567da0b40 ("device-dax: Introduce bus + driver model")
Cc: <stable@vger.kernel.org>
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wang Hai <wanghai38@huawei.com>
Link: https://lore.kernel.org/r/20201201135929.66530-1-wanghai38@huawei.com
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:54:26 +01:00
William Breathitt Gray
1e75951e9b counter: microchip-tcb-capture: Fix CMR value check
commit 3418bd7cfc upstream.

The ATMEL_TC_ETRGEDG_* defines are not masks but rather possible values
for CMR. This patch fixes the action_get() callback to properly check
for these values rather than mask them.

Fixes: 106b104137 ("counter: Add microchip TCB capture counter")
Signed-off-by: William Breathitt Gray <vilhelm.gray@gmail.com>
Acked-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Acked-by: Kamel Bouhara <kamel.bouhara@bootlin.com>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201114232805.253108-1-vilhelm.gray@gmail.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:54:26 +01:00
Nicolin Chen
b11905a3b9 clk: tegra: Do not return 0 on failure
commit 6160aca443 upstream.

Return values from read_dt_param() will be either TRUE (1) or
FALSE (0), while dfll_fetch_pwm_params() returns 0 on success
or an ERR code on failure.

So this patch fixes the bug of returning 0 on failure.

Fixes: 36541f0499 ("clk: tegra: dfll: support PWM regulator control")
Cc: <stable@vger.kernel.org>
Signed-off-by: Nicolin Chen <nicoleotsuka@gmail.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:54:26 +01:00
Terry Zhou
db003855f7 clk: mvebu: a3700: fix the XTAL MODE pin to MPP1_9
commit 6f37689cf6 upstream.

There is an error in the current code that the XTAL MODE
pin was set to NB MPP1_31 which should be NB MPP1_9.
The latch register of NB MPP1_9 has different offset of 0x8.

Signed-off-by: Terry Zhou <bjzhou@marvell.com>
[pali: Fix pin name in commit message]
Signed-off-by: Pali Rohár <pali@kernel.org>
Fixes: 7ea8250406 ("clk: mvebu: Add the xtal clock for Armada 3700 SoC")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20201106100039.11385-1-pali@kernel.org
Reviewed-by: Marek Behún <kabel@kernel.org>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:54:26 +01:00
Paul Cercueil
070e386727 clk: ingenic: Fix divider calculation with div tables
commit 11a163f2c7 upstream.

The previous code assumed that a higher hardware value always resulted
in a bigger divider, which is correct for the regular clocks, but is
an invalid assumption when a divider table is provided for the clock.

Perfect example of this is the PLL0_HALF clock, which applies a /2
divider with the hardware value 0, and a /1 divider otherwise.

Fixes: a9fa2893fc ("clk: ingenic: Add support for divider tables")
Cc: <stable@vger.kernel.org> # 5.2
Signed-off-by: Paul Cercueil <paul@crapouillou.net>
Link: https://lore.kernel.org/r/20201212135733.38050-1-paul@crapouillou.net
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:54:25 +01:00
Yangtao Li
dcea0b3835 pinctrl: sunxi: Always call chained_irq_{enter, exit} in sunxi_pinctrl_irq_handler
commit a1158e36f8 upstream.

It is found on many allwinner soc that there is a low probability that
the interrupt status cannot be read in sunxi_pinctrl_irq_handler. This
will cause the interrupt status of a gpio bank to always be active on
gic, preventing gic from responding to other spi interrupts correctly.

So we should call the chained_irq_* each time enter sunxi_pinctrl_irq_handler().

Signed-off-by: Yangtao Li <frank@allwinnertech.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/85263ce8b058e80cea25c6ad6383eb256ce96cc8.1604988979.git.frank@allwinnertech.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:54:25 +01:00
Zhao Heming
d27d1942e1 md/cluster: fix deadlock when node is doing resync job
commit bca5b06580 upstream.

md-cluster uses MD_CLUSTER_SEND_LOCK to make node can exclusively send msg.
During sending msg, node can concurrently receive msg from another node.
When node does resync job, grab token_lockres:EX may trigger a deadlock:
```
nodeA                       nodeB
--------------------     --------------------
a.
send METADATA_UPDATED
held token_lockres:EX
                         b.
                         md_do_sync
                          resync_info_update
                            send RESYNCING
                             + set MD_CLUSTER_SEND_LOCK
                             + wait for holding token_lockres:EX

                         c.
                         mdadm /dev/md0 --remove /dev/sdg
                          + held reconfig_mutex
                          + send REMOVE
                             + wait_event(MD_CLUSTER_SEND_LOCK)

                         d.
                         recv_daemon //METADATA_UPDATED from A
                          process_metadata_update
                           + (mddev_trylock(mddev) ||
                              MD_CLUSTER_HOLDING_MUTEX_FOR_RECVD)
                             //this time, both return false forever
```
Explaination:
a. A send METADATA_UPDATED
   This will block another node to send msg

b. B does sync jobs, which will send RESYNCING at intervals.
   This will be block for holding token_lockres:EX lock.

c. B do "mdadm --remove", which will send REMOVE.
   This will be blocked by step <b>: MD_CLUSTER_SEND_LOCK is 1.

d. B recv METADATA_UPDATED msg, which send from A in step <a>.
   This will be blocked by step <c>: holding mddev lock, it makes
   wait_event can't hold mddev lock. (btw,
   MD_CLUSTER_HOLDING_MUTEX_FOR_RECVD keep ZERO in this scenario.)

There is a similar deadlock in commit 0ba959774e
("md-cluster: use sync way to handle METADATA_UPDATED msg")
In that commit, step c is "update sb". This patch step c is
"mdadm --remove".

For fixing this issue, we can refer the solution of function:
metadata_update_start. Which does the same grab lock_token action.
lock_comm can use the same steps to avoid deadlock. By moving
MD_CLUSTER_HOLDING_MUTEX_FOR_RECVD from lock_token to lock_comm.
It enlarge a little bit window of MD_CLUSTER_HOLDING_MUTEX_FOR_RECVD,
but it is safe & can break deadlock.

Repro steps (I only triggered 3 times with hundreds tests):

two nodes share 3 iSCSI luns: sdg/sdh/sdi. Each lun size is 1GB.
```
ssh root@node2 "mdadm -S --scan"
mdadm -S --scan
for i in {g,h,i};do dd if=/dev/zero of=/dev/sd$i oflag=direct bs=1M \
count=20; done

mdadm -C /dev/md0 -b clustered -e 1.2 -n 2 -l mirror /dev/sdg /dev/sdh \
 --bitmap-chunk=1M
ssh root@node2 "mdadm -A /dev/md0 /dev/sdg /dev/sdh"

sleep 5

mkfs.xfs /dev/md0
mdadm --manage --add /dev/md0 /dev/sdi
mdadm --wait /dev/md0
mdadm --grow --raid-devices=3 /dev/md0

mdadm /dev/md0 --fail /dev/sdg
mdadm /dev/md0 --remove /dev/sdg
mdadm --grow --raid-devices=2 /dev/md0
```

test script will hung when executing "mdadm --remove".

```
 # dump stacks by "echo t > /proc/sysrq-trigger"
md0_cluster_rec D    0  5329      2 0x80004000
Call Trace:
 __schedule+0x1f6/0x560
 ? _cond_resched+0x2d/0x40
 ? schedule+0x4a/0xb0
 ? process_metadata_update.isra.0+0xdb/0x140 [md_cluster]
 ? wait_woken+0x80/0x80
 ? process_recvd_msg+0x113/0x1d0 [md_cluster]
 ? recv_daemon+0x9e/0x120 [md_cluster]
 ? md_thread+0x94/0x160 [md_mod]
 ? wait_woken+0x80/0x80
 ? md_congested+0x30/0x30 [md_mod]
 ? kthread+0x115/0x140
 ? __kthread_bind_mask+0x60/0x60
 ? ret_from_fork+0x1f/0x40

mdadm           D    0  5423      1 0x00004004
Call Trace:
 __schedule+0x1f6/0x560
 ? __schedule+0x1fe/0x560
 ? schedule+0x4a/0xb0
 ? lock_comm.isra.0+0x7b/0xb0 [md_cluster]
 ? wait_woken+0x80/0x80
 ? remove_disk+0x4f/0x90 [md_cluster]
 ? hot_remove_disk+0xb1/0x1b0 [md_mod]
 ? md_ioctl+0x50c/0xba0 [md_mod]
 ? wait_woken+0x80/0x80
 ? blkdev_ioctl+0xa2/0x2a0
 ? block_ioctl+0x39/0x40
 ? ksys_ioctl+0x82/0xc0
 ? __x64_sys_ioctl+0x16/0x20
 ? do_syscall_64+0x5f/0x150
 ? entry_SYSCALL_64_after_hwframe+0x44/0xa9

md0_resync      D    0  5425      2 0x80004000
Call Trace:
 __schedule+0x1f6/0x560
 ? schedule+0x4a/0xb0
 ? dlm_lock_sync+0xa1/0xd0 [md_cluster]
 ? wait_woken+0x80/0x80
 ? lock_token+0x2d/0x90 [md_cluster]
 ? resync_info_update+0x95/0x100 [md_cluster]
 ? raid1_sync_request+0x7d3/0xa40 [raid1]
 ? md_do_sync.cold+0x737/0xc8f [md_mod]
 ? md_thread+0x94/0x160 [md_mod]
 ? md_congested+0x30/0x30 [md_mod]
 ? kthread+0x115/0x140
 ? __kthread_bind_mask+0x60/0x60
 ? ret_from_fork+0x1f/0x40
```

At last, thanks for Xiao's solution.

Cc: stable@vger.kernel.org
Signed-off-by: Zhao Heming <heming.zhao@suse.com>
Suggested-by: Xiao Ni <xni@redhat.com>
Reviewed-by: Xiao Ni <xni@redhat.com>
Signed-off-by: Song Liu <songliubraving@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:54:25 +01:00
Zhao Heming
3ace8d52ee md/cluster: block reshape with remote resync job
commit a8da01f79c upstream.

Reshape request should be blocked with ongoing resync job. In cluster
env, a node can start resync job even if the resync cmd isn't executed
on it, e.g., user executes "mdadm --grow" on node A, sometimes node B
will start resync job. However, current update_raid_disks() only check
local recovery status, which is incomplete. As a result, we see user will
execute "mdadm --grow" successfully on local, while the remote node deny
to do reshape job when it doing resync job. The inconsistent handling
cause array enter unexpected status. If user doesn't observe this issue
and continue executing mdadm cmd, the array doesn't work at last.

Fix this issue by blocking reshape request. When node executes "--grow"
and detects ongoing resync, it should stop and report error to user.

The following script reproduces the issue with ~100% probability.
(two nodes share 3 iSCSI luns: sdg/sdh/sdi. Each lun size is 1GB)
```
 # on node1, node2 is the remote node.
ssh root@node2 "mdadm -S --scan"
mdadm -S --scan
for i in {g,h,i};do dd if=/dev/zero of=/dev/sd$i oflag=direct bs=1M \
count=20; done

mdadm -C /dev/md0 -b clustered -e 1.2 -n 2 -l mirror /dev/sdg /dev/sdh
ssh root@node2 "mdadm -A /dev/md0 /dev/sdg /dev/sdh"

sleep 5

mdadm --manage --add /dev/md0 /dev/sdi
mdadm --wait /dev/md0
mdadm --grow --raid-devices=3 /dev/md0

mdadm /dev/md0 --fail /dev/sdg
mdadm /dev/md0 --remove /dev/sdg
mdadm --grow --raid-devices=2 /dev/md0
```

Cc: stable@vger.kernel.org
Signed-off-by: Zhao Heming <heming.zhao@suse.com>
Signed-off-by: Song Liu <songliubraving@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:54:25 +01:00
Jonathan Cameron
c1f4549a73 iio:adc:ti-ads124s08: Fix alignment and data leak issues.
commit 1e405bc251 upstream.

One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp() assumes the buffer used is aligned
to the size of the timestamp (8 bytes).  This is not guaranteed in
this driver which uses an array of smaller elements on the stack.
As Lars also noted this anti pattern can involve a leak of data to
userspace and that indeed can happen here.  We close both issues by
moving to a suitable structure in the iio_priv() data with alignment
explicitly requested.  This data is allocated with kzalloc() so no
data can leak apart from previous readings.

In this driver the timestamp can end up in various different locations
depending on what other channels are enabled.  As a result, we don't
use a structure to specify it's position as that would be misleading.

Fixes: e717f8c6df ("iio: adc: Add the TI ads124s08 ADC code")
Reported-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
Cc: Dan Murphy <dmurphy@ti.com>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200920112742.170751-9-jic23@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:54:25 +01:00
Jonathan Cameron
c834798d78 iio:adc:ti-ads124s08: Fix buffer being too long.
commit b0bd27f02d upstream.

The buffer is expressed as a u32 array, yet the extra space for
the s64 timestamp was expressed as sizeof(s64)/sizeof(u16).
This will result in 2 extra u32 elements.
Fix by dividing by sizeof(u32).

Fixes: e717f8c6df ("iio: adc: Add the TI ads124s08 ADC code")
Signed-off-by: Jonathan Cameron<Jonathan.Cameron@huawei.com>
Reviewed-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
Cc: Dan Murphy <dmurphy@ti.com>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200920112742.170751-8-jic23@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:54:25 +01:00
Jonathan Cameron
1d14e2f4ca iio:imu:bmi160: Fix alignment and data leak issues
commit 7b6b51234d upstream.

One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp assumes the buffer used is aligned
to the size of the timestamp (8 bytes).  This is not guaranteed in
this driver which uses an array of smaller elements on the stack.
As Lars also noted this anti pattern can involve a leak of data to
userspace and that indeed can happen here.  We close both issues by
moving to a suitable array in the iio_priv() data with alignment
explicitly requested.  This data is allocated with kzalloc() so no
data can leak apart from previous readings.

In this driver, depending on which channels are enabled, the timestamp
can be in a number of locations.  Hence we cannot use a structure
to specify the data layout without it being misleading.

Fixes: 77c4ad2d6a ("iio: imu: Add initial support for Bosch BMI160")
Reported-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
Cc: Daniel Baluta  <daniel.baluta@gmail.com>
Cc: Daniel Baluta <daniel.baluta@oss.nxp.com>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200920112742.170751-6-jic23@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:54:25 +01:00
Jonathan Cameron
f57464c403 iio:imu:bmi160: Fix too large a buffer.
commit dc7de42d6b upstream.

The comment implies this device has 3 sensor types, but it only
has an accelerometer and a gyroscope (both 3D).  As such the
buffer does not need to be as long as stated.

Note I've separated this from the following patch which fixes
the alignment for passing to iio_push_to_buffers_with_timestamp()
as they are different issues even if they affect the same line
of code.

Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
Cc: Daniel Baluta <daniel.baluta@oss.nxp.com>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200920112742.170751-5-jic23@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:54:25 +01:00
Jonathan Cameron
5550e16128 iio:pressure:mpl3115: Force alignment of buffer
commit 198cf32f05 upstream.

Whilst this is another case of the issue Lars reported with
an array of elements of smaller than 8 bytes being passed
to iio_push_to_buffers_with_timestamp(), the solution here is
a bit different from the other cases and relies on __aligned
working on the stack (true since 4.6?)

This one is unusual.  We have to do an explicit memset() each time
as we are reading 3 bytes into a potential 4 byte channel which
may sometimes be a 2 byte channel depending on what is enabled.
As such, moving the buffer to the heap in the iio_priv structure
doesn't save us much.  We can't use a nice explicit structure
on the stack either as the data channels have different storage
sizes and are all separately controlled.

Fixes: cc26ad455f ("iio: Add Freescale MPL3115A2 pressure / temperature sensor driver")
Reported-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Reviewed-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
Cc: Peter Meerwald <pmeerw@pmeerw.net>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200920112742.170751-7-jic23@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:54:24 +01:00
Jonathan Cameron
c02f8e0ef0 iio:magnetometer:mag3110: Fix alignment and data leak issues.
commit 89deb13342 upstream.

One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp() assumes the buffer used is aligned
to the size of the timestamp (8 bytes).  This is not guaranteed in
this driver which uses an array of smaller elements on the stack.
As Lars also noted this anti pattern can involve a leak of data to
userspace and that indeed can happen here.  We close both issues by
moving to a suitable structure in the iio_priv() data.
This data is allocated with kzalloc() so no data can leak apart from
previous readings.

The explicit alignment of ts is not necessary in this case but
does make the code slightly less fragile so I have included it.

Fixes: 39631b5f95 ("iio: Add Freescale mag3110 magnetometer driver")
Reported-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200920112742.170751-4-jic23@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:54:24 +01:00
Jonathan Cameron
2409bfd6e3 iio:light:st_uvis25: Fix timestamp alignment and prevent data leak.
commit d837a996f5 upstream.

One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp() assumes the buffer used is aligned
to the size of the timestamp (8 bytes).  This is not guaranteed in
this driver which uses an array of smaller elements on the stack.
As Lars also noted this anti pattern can involve a leak of data to
userspace and that indeed can happen here.  We close both issues by
moving to a suitable structure in the iio_priv()

This data is allocated with kzalloc() so no data can leak apart
from previous readings.

A local unsigned int variable is used for the regmap call so it
is clear there is no potential issue with writing into the padding
of the structure.

Fixes: 3025c8688c ("iio: light: add support for UVIS25 sensor")
Reported-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200920112742.170751-3-jic23@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:54:24 +01:00
Jonathan Cameron
45ebad3dc0 iio:light:rpr0521: Fix timestamp alignment and prevent data leak.
commit a61817216b upstream.

One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp() assumes the buffer used is aligned
to the size of the timestamp (8 bytes).  This is not guaranteed in
this driver which uses an array of smaller elements on the stack.
As Lars also noted this anti pattern can involve a leak of data to
userspace and that indeed can happen here.  We close both issues by
moving to a suitable structure in the iio_priv().
This data is allocated with kzalloc() so no data can leak apart
from previous readings and in this case the status byte from the device.

The forced alignment of ts is not necessary in this case but it
potentially makes the code less fragile.

>From personal communications with Mikko:

We could probably split the reading of the int register, but it
would mean a significant performance cost of 20 i2c clock cycles.

Fixes: e12ffd241c ("iio: light: rpr0521 triggered buffer")
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
Cc: Mikko Koivunen <mikko.koivunen@fi.rohmeurope.com>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200920112742.170751-2-jic23@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:54:24 +01:00
Lorenzo Bianconi
6e94b8314c iio: imu: st_lsm6dsx: fix edge-trigger interrupts
commit 3f9bce7a22 upstream.

If we are using edge IRQs, new samples can arrive while processing
current interrupt since there are no hw guarantees the irq line
stays "low" long enough to properly detect the new interrupt.
In this case the new sample will be missed.
Polling FIFO status register in st_lsm6dsx_handler_thread routine
allow us to read new samples even if the interrupt arrives while
processing previous data and the timeslot where the line is "low"
is too short to be properly detected.

Fixes: 89ca88a7cd ("iio: imu: st_lsm6dsx: support active-low interrupts")
Fixes: 290a6ce11d ("iio: imu: add support to lsm6dsx driver")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://lore.kernel.org/r/5e93cda7dc1e665f5685c53ad8e9ea71dbae782d.1605378871.git.lorenzo@kernel.org
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:54:24 +01:00
Qinglang Miao
160ec8afa7 iio: adc: rockchip_saradc: fix missing clk_disable_unprepare() on error in rockchip_saradc_resume
commit 560c6b914c upstream.

Fix the missing clk_disable_unprepare() of info->pclk
before return from rockchip_saradc_resume in the error
handling case when fails to prepare and enable info->clk.

Suggested-by: Robin Murphy <robin.murphy@arm.com>
Fixes: 44d6f2ef94 ("iio: adc: add driver for Rockchip saradc")
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201103120743.110662-1-miaoqinglang@huawei.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:54:24 +01:00
Nuno Sá
2adb3f8bcc iio: buffer: Fix demux update
commit 19ef7b70ca upstream.

When updating the buffer demux, we will skip a scan element from the
device in the case `in_ind != out_ind` and we enter the while loop.
in_ind should only be refreshed with `find_next_bit()` in the end of the
loop.

Note, to cause problems we need a situation where we are skippig over
an element (channel not enabled) that happens to not have the same size
as the next element.   Whilst this is a possible situation we haven't
actually identified any cases in mainline where it happens as most drivers
have consistent channel storage sizes with the exception of the timestamp
which is the last element and hence never skipped over.

Fixes: 5ada4ea9be ("staging:iio: add demux optionally to path from device to buffer")
Signed-off-by: Nuno Sá <nuno.sa@analog.com>
Link: https://lore.kernel.org/r/20201112144323.28887-1-nuno.sa@analog.com
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:54:24 +01:00
Aleksa Sarai
aa606ebab1 openat2: reject RESOLVE_BENEATH|RESOLVE_IN_ROOT
commit 398840f8bb upstream.

This was an oversight in the original implementation, as it makes no
sense to specify both scoping flags to the same openat2(2) invocation
(before this patch, the result of such an invocation was equivalent to
RESOLVE_IN_ROOT being ignored).

This is a userspace-visible ABI change, but the only user of openat2(2)
at the moment is LXC which doesn't specify both flags and so no
userspace programs will break as a result.

Fixes: fddb5d430a ("open: introduce openat2(2) syscall")
Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Cc: <stable@vger.kernel.org> # v5.6+
Link: https://lore.kernel.org/r/20201027235044.5240-2-cyphar@cyphar.com
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:54:24 +01:00