Commit Graph

950367 Commits

Author SHA1 Message Date
Linus Torvalds
16bf121b2d A few MIPS fixes:
- fallthrough fallout fix
 - BMIPS fixes
 - MSA fix to avoid leaking MSA register contents
 - Loongson perf and cpu feature fix
 - SNI interrupt fix
 -----BEGIN PGP SIGNATURE-----
 
 iQJOBAABCAA4FiEEbt46xwy6kEcDOXoUeZbBVTGwZHAFAl9SMkAaHHRzYm9nZW5k
 QGFscGhhLmZyYW5rZW4uZGUACgkQeZbBVTGwZHA/Lw/8Cp19eTYF0ps60u9i2Gen
 5e2yY7TlO1gBerdyA4iX/Jd8wKYu0cCBreHAF9JzdFi1z9s7arguB6DWUOYwa/W/
 t0q86CW+EddfwJzjdY+H7cnNQWhaLGeKGXUzevI7v2kd3LAAyPvm7vUeR1zYxVol
 IJ3XyLGo+NN3xLecc2sSDVAWQR+wfy+1pARbVimkh4wlJjZcrvWgl8+jYv15p8u5
 DPywG+wgkRJNWV1hX54qh9bxNOtLajFhAsWIluwAVf/mmQCguY0Gd8bcBDYFqyFt
 HZPuH5Rhmnm8/alqetzcXCFN8Y9IwzjOlOemwENCs1/0O49mdCF08uOd7wp9Sek2
 aXlksJBtNB7jVzYZAiwnQcm/L84gXaxkdMjf47jTzTFkMBn+3/lbcGfKDptDc7U0
 sNQmOU1y9y69UP2G7cSGH5cOco7LMReTTDB+35X/wWMnthKh5iw5R2nK0vJzCpWS
 Vq2PD8vIsO+58rlHFwOv6zZmGOQlCb93Nuzk7zx7GQMAEN05Av9nVC91n47MH352
 VVwTv2dsBgNBDyhukz7YFpZLF11K9hYz5+661q0SGmRyKe5a4OD8lVV1kqQ6e8hp
 dlmcgT/B93cEvs9qnx5E13UO5UyPYn9Trbl2qppMvL9zXyc/jdDnoMfH48LK22YP
 hUbnUmjJAD55PLFJ+dl/EXM=
 =HWpo
 -----END PGP SIGNATURE-----

Merge tag 'mips_fixes_5.9_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux

Pull MIPS fixes from Thomas Bogendoerfer:
 "A few MIPS fixes:

   - fallthrough fallout fix

   - BMIPS fixes

   - MSA fix to avoid leaking MSA register contents

   - Loongson perf and cpu feature fix

   - SNI interrupt fix"

* tag 'mips_fixes_5.9_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux:
  MIPS: SNI: Fix SCSI interrupt
  MIPS: add missing MSACSR and upper MSA initialization
  MIPS: perf: Fix wrong check condition of Loongson event IDs
  mips/oprofile: Fix fallthrough placement
  MIPS: Loongson64: Remove unnecessary inclusion of boot_param.h
  MIPS: BMIPS: Also call bmips_cpu_setup() for secondary cores
  MIPS: mm: BMIPS5000 has inclusive physical caches
  MIPS: Loongson64: Do not override watch and ejtag feature
2020-09-04 13:37:19 -07:00
Linus Torvalds
41bef91c8a Kbuild fixes for v5.9 (2nd)
- fix documents
 
  - fix warning in 'make localmodconfig'
 -----BEGIN PGP SIGNATURE-----
 
 iQJJBAABCgAzFiEEbmPs18K1szRHjPqEPYsBB53g2wYFAl9SMBsVHG1hc2FoaXJv
 eUBrZXJuZWwub3JnAAoJED2LAQed4NsGsQgQAK7+5/7hZD7ZhBwLOKEJEsJgu+fO
 ZDn5sZiAf+HIeAFZ8tcVmCceqCti1mRxcnwiEpN6iBmXF/BZY5PkAw9pXcK30PgG
 kquYqlQlDRw4OSRBm+ZCAF2FyT5l3ScWoDzwTcYpUU8bgRM/CKSWn9XJS+/Hk/Mo
 93EeodOKfz0S2Nq2yrRjzvOTIrYJKc93BGy0pt007MExBuw0vMLTHDotEGriXZ+x
 cETMx9+OGJhTP+2QBSL3q2lrMc0syupjC0Mx8i1GdrWmWn5pP9x43cwxgzMYPCcQ
 DO0v0V0j5xq/0QPpRDs7ZcgUoGAUlXYDOohA6diDB/OysQ30TDohSoCh9hCHQvX7
 Use98oBvce541uTTlhAtj9tKCy+fmLV1kIryh7ruojTPtHmY/9UXs02qK0EIj3za
 qCXe/eFawRIqZUprO5KkIYSNzVSFYDnD4qC42/MQr64JbC1eIBZNZyH0XJXlj650
 pHkOkQuvgAXjB3pA9OyccT16A0+agHgeRv05j2c5qoqdLUZtu4yupOddH/v9WeIC
 HntC8TYnOD63uj131NgqIjOHCncblkt16MZpPVsOLRFVHVjm/80uAvVZL8PzJ4jr
 Fr4OovyvH/sjw29r+a8Xlg3/pm9eH0TgftRP8x23lPdewRzJXR/8WDsEsHcdVK5h
 Q+gOeiSno9TxGiTh
 =utGD
 -----END PGP SIGNATURE-----

Merge tag 'kbuild-fixes-v5.9-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild

Pull Kbuild fixes from Masahiro Yamada:

 - fix documents

 - fix warning in 'make localmodconfig'

* tag 'kbuild-fixes-v5.9-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild:
  kconfig: remove redundant assignment prompt = prompt
  kbuild: Documentation: clean up makefiles.rst
  kconfig: streamline_config.pl: check defined(ENV variable) before using it
  Documentation/llvm: Improve formatting of commands, variables, and arguments
2020-09-04 13:34:52 -07:00
Linus Torvalds
f162626a03 Power management fixes for 5.9-rc4
- Fix reference counting of operating performance points (OPP)
    tables (Viresh Kumar).
 
  - Address intel_pstate driver interface issues, mostly related
    to switching operation modes and handling CPU offline and
    online and system-wide suspend/resume with hardware-managed
    P-states (HWP) enabled (Rafael Wysocki).
 
  - Fix the maximum frequency computation in the intel_pstate driver
    with turbo P-states disabled by the platform firmware and HWP
    enabled (Francisco Jerez).
 -----BEGIN PGP SIGNATURE-----
 
 iQJGBAABCAAwFiEE4fcc61cGeeHD/fCwgsRv/nhiVHEFAl9Sb3YSHHJqd0Byand5
 c29ja2kubmV0AAoJEILEb/54YlRxI3YP/iPLm1zudatHLFr44A5cPNyKd0VI4Wh7
 7wTLZNFuHs69ivRjC77BJGULDoDJopas6GArkWdh0G+nqQo8SM18RinxA+13DEl5
 7tIrkIWv0gJW/7jZp5mpqjkKNOQ+zH0aw5zaHfiQKVrb6lZJdULbWTpAmr5miCim
 qbs4Umvo/4Nshxj46N6CT82kSbElwCCAfFcXheYaplirfZmluuH9+Zd/rKQCoyCv
 zXP+T/YV+U2siCOyjaSToDvnoep2qNwl4ZSRPKYCvqKr1B9u+Rp4psdjMuUixnum
 Qs+57EudxLyHfaXhMR/ua/XhKf2ZUFZT7ClJeKCR5nzl7bzp6oy+TaljZVsvG0b1
 pPiGZKs9JRXovweriWkhUtHaEpND/AMwqnYH3ZBbc1eL65EM0ljWIINDN0oWD9Xa
 5a8Z1nsaD66VnHfWaOlKMQhBH7YLxACUqRo/+D2hgx+cHxUP5CqfgpUsV3Cb7c1J
 GsmvMJwQ6/wmfCShRJniqBhoUecBCL+U7Tw1c4suDyMz8iVEMh9C5pZNsd0nWt5r
 I7O+s/HPRDW/01Wew3cM2h0ib+y0pQIx+jaktrECXutgejv47oH01CAZrm2j5Ie7
 Bqb+GOmJKdPInXrdgz59mCSic1rO8rb49dRvCxCMx/jsnwcwG1x+o86fuLgZUzKA
 R7JJd7VQg2wP
 =gsKc
 -----END PGP SIGNATURE-----

Merge tag 'pm-5.9-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

Pull power management fixes from Rafael Wysocki:
 "These fix reference counting in the operating performance points (OPP)
  framework and address a few intel_pstate driver issues, mostly related
  to switching driver operation modes and similar with hardware-managed
  P-states (HWP) enabled.

  Specifics:

   - Fix reference counting of operating performance points (OPP) tables
     (Viresh Kumar).

   - Address intel_pstate driver interface issues, mostly related to
     switching operation modes and handling CPU offline and online and
     system-wide suspend/resume with hardware-managed P-states (HWP)
     enabled (Rafael Wysocki).

   - Fix the maximum frequency computation in the intel_pstate driver
     with turbo P-states disabled by the platform firmware and HWP
     enabled (Francisco Jerez)"

* tag 'pm-5.9-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  cpufreq: intel_pstate: Fix intel_pstate_get_hwp_max() for turbo disabled
  cpufreq: intel_pstate: Free memory only when turning off
  cpufreq: intel_pstate: Add ->offline and ->online callbacks
  cpufreq: intel_pstate: Tweak the EPP sysfs interface
  cpufreq: intel_pstate: Update cached EPP in the active mode
  cpufreq: intel_pstate: Refuse to turn off with HWP enabled
  opp: Don't drop reference for an OPP table that was never parsed
2020-09-04 13:27:24 -07:00
Linus Torvalds
d824e0809c libata-5.9-2020-09-04
-----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAl9SXCYQHGF4Ym9lQGtl
 cm5lbC5kawAKCRD301j7KXHgplweD/sELNKLOyRZZSM3COm+gpYP8UJQtsN8b3bQ
 tKGn0kShYNlXiB0umm5NXBLfIsv64J33H3tWpou6PiaQAJceBlbms8gv+qbPahi0
 52isVTzXX4jcBMhCRfW3rJ04zKRsv20bMp0sMva6kpEbBgqaiUo9hM+rhFfRj/wW
 hLpCGabyIE79p9dCOAzVxfSEyLTuN8QY5kznTze0clKu4q7b7BdXr/2AyXyQIUFj
 EYW0WTeIVpa9JcC1qosHf82aUL4Fo49xJ2YA/dncCYNVsjKcXxg90qWqS9XvU6hy
 oE6pJdin+bx9hSvDJpgqsLaLB+ATDdnqz1QBFkXnuhvOVdUkgocLYnRhaOxGAJvr
 Af4icx+UlbpUgXqNHdhzW1rkh/4tjICuRVmxslr2Sq/0kFeR9CZVo+8uRzaPXv0l
 IzZjhxKO04nR31T7WUv8YFpv5pSSBepom30utpj6YWpnp/Bh/UgeuhbBCx8R8r6j
 drHKzIclYICHYd84MOvFgLelhpPR3A/mHyVwgZdvQLl3OCGDnaQYD3dYPxRcDiek
 9eEFxsWpgV4/48sswSITM37aBC0hfz9JcHR9thfcs3vCTe84kLDwMhx3RzU+mXvJ
 9s7oijuSuTK5nzRqXHoYOzSrOskRUuc09V3wWoSNIRHtLmaOw5+78H8QlobDy05E
 l6I9OYJWKg==
 =/NYf
 -----END PGP SIGNATURE-----

Merge tag 'libata-5.9-2020-09-04' of git://git.kernel.dk/linux-block

Pull libata fixes from Jens Axboe:

 - improve Sandisks ATA_HORKAGE on NCQ (Tejun)

 - link printk cleanup (Xu)

* tag 'libata-5.9-2020-09-04' of git://git.kernel.dk/linux-block:
  libata: implement ATA_HORKAGE_MAX_TRIM_128M and apply to Sandisks
  ata: ahci: use ata_link_info() instead of ata_link_printk()
2020-09-04 13:19:19 -07:00
Linus Torvalds
8075fc3b11 block-5.9-2020-09-04
-----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAl9SWMMQHGF4Ym9lQGtl
 cm5lbC5kawAKCRD301j7KXHgphIcD/488Q7rXb2eABp1fGs4gu+VFOCLogeHL8xh
 5xHNiOPnZG2SGr8DQJY/7EX2kE65rbZi8/g+2N6anovI2nduRu0tzSra7fRgzbys
 ZQC1CUel0MbCd7e8OaEfg108PSHNxBf1PqDcE7zCeyZ0DIs3s4vK/bQtmzzxZHgU
 wNw4OIP9gOdqgjowb6GGHo9SLN4GT8rZ0jZVPLa7GwFsvxCTwv/7lHO8rqeSeuCu
 5H6i3M/rSbtTXPLHf4Fy97x9WmBmdgu4epTXiwbOxaagpx3lm/7n1P3CpavR+Gcq
 O5VGIIzazxPwnZl9y/6rZFLGYqcj38RxUvC8KtK6tDXxEu/BDJa1d6hXI03SyXAO
 ZAiEpQTKOkJE3R8ewUDrXLvl3p6FvwZVZ5SIFwUb+0JFrVQYwrgfoRJtzb5SIUan
 T9/bSYge7lFRI92FZRIqhvk8rsEBRdu7N/rQCyGf6GuZ0vRXWRAqN7T02iDn3czX
 pdGAepU5ymw8CwyUiNNnkY0DUaQLBIO9tCA9epxLwdroQ95vJtMPRBX1STQ65GVk
 XvMFAJqDAehQ/nP5xO60cWGZHyL7L/ccpofZlA/ytgAIZRa85GvhrdVy7yc6DKto
 wu6h2tkX9+ldoUjVbn/60T+Ft3QUTlfAuDfherkNoFNB/G5i1pzOHbwvL7B3czr3
 ZMjoNiOIqA==
 =8fvz
 -----END PGP SIGNATURE-----

Merge tag 'block-5.9-2020-09-04' of git://git.kernel.dk/linux-block

Pull block fixes from Jens Axboe:
 "A bit larger than usual this week, mostly due to the NVMe fixes
  arriving late for -rc3 and hence didn't make last weeks pull request.

   - NVMe:
        - instance leak and io boundary fixes from Keith
        - fc locking fix from Christophe
        - various tcp/rdma reset during traffic fixes from Sagi
        - pci use-after-free fix from Tong
        - tcp target null deref fix from Ziye

   - Locking fix for partition removal (Christoph)

   - Ensure bdi->io_pages is always set (me)

   - Fixup for hd struct reference (Ming)

   - Fix for zero length bvecs (Ming)

   - Two small blk-iocost fixes (Tejun)"

* tag 'block-5.9-2020-09-04' of git://git.kernel.dk/linux-block:
  block: allow for_each_bvec to support zero len bvec
  blk-stat: make q->stats->lock irqsafe
  blk-iocost: ioc_pd_free() shouldn't assume irq disabled
  block: fix locking in bdev_del_partition
  block: release disk reference in hd_struct_free_work
  block: ensure bdi->io_pages is always initialized
  nvme-pci: cancel nvme device request before disabling
  nvme: only use power of two io boundaries
  nvme: fix controller instance leak
  nvmet-fc: Fix a missed _irqsave version of spin_lock in 'nvmet_fc_fod_op_done()'
  nvme: Fix NULL dereference for pci nvme controllers
  nvme-rdma: fix reset hang if controller died in the middle of a reset
  nvme-rdma: fix timeout handler
  nvme-rdma: serialize controller teardown sequences
  nvme-tcp: fix reset hang if controller died in the middle of a reset
  nvme-tcp: fix timeout handler
  nvme-tcp: serialize controller teardown sequences
  nvme: have nvme_wait_freeze_timeout return if it timed out
  nvme-fabrics: don't check state NVME_CTRL_NEW for request acceptance
  nvmet-tcp: Fix NULL dereference when a connect data comes in h2cdata pdu
2020-09-04 13:04:51 -07:00
Linus Torvalds
d849ca483d io_uring-5.9-2020-09-04
-----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAl9SWN8QHGF4Ym9lQGtl
 cm5lbC5kawAKCRD301j7KXHgpvtbD/4yI5dkopv6E2RHVuupFWmGlGoxLhPecnAZ
 UHbKU+LA/tzWWMA7gZuwzzDEK1QWT/KmctpGTI22SXUKQCtjGzO/qnRMfyJ34TdQ
 l4leYdw/QzUOHZG7dKVYUACHiaSxzQSallNuX1I9eM084KSXH3DgUkrwMLoew/8n
 WJHKN+oRhcppnLVDekaLXbZEI9idTnY+gs/Dg8TNsxNSeO6y51OOlKltaNfL+npQ
 dwlgMoolBYWHFozqgVyzIV7sU7fQ9QGppwBIfqBb1jEe9JU2ZymtlcDgfxUVpKcg
 W8/PCoVT60AGiMdjV0EBoQO09r+nvwAcRQUSlWJU7Dn/pcZmFoaJkyse+SnD0Dac
 cLTKhnhgMJSI4Zt3yQidFSNhz0Ouw15J8k7OTftn81zhtkHzPBgGnA7R6b7UUQsZ
 5lJvlZh5aFPNBFp9A0do5+f5/lUMhHkxDpFVmZo+ywPtoNHJeDL2+jzzFawJ8kqv
 IoFvVL8hl4DzqN+vShsJ40jH93+oITF/Jlq6kY8ILKtu42i5qAxpP0wUwycrN6Pz
 /YNTKPveCoPU7zaFDvMfbc7U56Ke6ma+lmtTn6q6JOWFvUAYh7SUY4JGzEMpxfxK
 QVyFMwXnCKhB66ZypJIFdbT4zqkTXmhxvu/Oz5txDv/uoytqT1o+zLHb3USi4Lw8
 89NyvBc0aQ==
 =NLOn
 -----END PGP SIGNATURE-----

Merge tag 'io_uring-5.9-2020-09-04' of git://git.kernel.dk/linux-block

Pull io_uring fixes from Jens Axboe:

 - EAGAIN with O_NONBLOCK retry fix

 - Two small fixes for registered files (Jiufei)

* tag 'io_uring-5.9-2020-09-04' of git://git.kernel.dk/linux-block:
  io_uring: no read/write-retry on -EAGAIN error and O_NONBLOCK marked file
  io_uring: set table->files[i] to NULL when io_sqe_file_register failed
  io_uring: fix removing the wrong file in __io_sqe_files_update()
2020-09-04 12:55:22 -07:00
Linus Torvalds
2fb547911c - Fix bogus thermal shutdowns for omap4430 where bogus values
resulting from an incorrect ADC conversion are too high and fire an
   emergency shutdown (Tony Lindgren)
 
 - Don't suppress negative temp for qcom spmi as they are valid and
   userspace needs them (Veera Vegivada)
 
 - Fix use-after-free in thermal_zone_device_unregister reported by
   Kasan (Dmitry Osipenko)
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCAAdFiEEGn3N4YVz0WNVyHskqDIjiipP6E8FAl9SDqQACgkQqDIjiipP
 6E9/qwf/WybOihgjeQUv3a9f4k6SeJphoDZRNATJtyU1e+fgJXUxjFqma6t4CYJv
 uphZ1SppY9rnx1nWzhANSQjKun5KLwIskcNTCaGN4adRJ1cNdY63PdSX9BTJr9+H
 w5H0AGWMErAOdmCPCro4pnZ3l3FPKXcoNvqDAjF1kZ97v5tMGzdInflOJl1ztUZA
 scAnY7j0TyNsoRy2TV0oxQtSN9cDhgph1zJF1RcVzlU1uD897Htet1RF/PrHDvBW
 NYVcWDTfiWmvf9Zewy2+cfApK9QGqBRhnwt4Z8PlTUcqrOgqAiNnOAnov+Topg/y
 XNQzWwXFUip6bk5pTXPF8gSI0glkJg==
 =LDGk
 -----END PGP SIGNATURE-----

Merge tag 'thermal-v5.9-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/thermal/linux

Pull thermal fixes from Daniel Lezcano:

 - Fix bogus thermal shutdowns for omap4430 where bogus values resulting
   from an incorrect ADC conversion are too high and fire an emergency
   shutdown (Tony Lindgren)

 - Don't suppress negative temp for qcom spmi as they are valid and
   userspace needs them (Veera Vegivada)

 - Fix use-after-free in thermal_zone_device_unregister reported by
   Kasan (Dmitry Osipenko)

* tag 'thermal-v5.9-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/thermal/linux:
  thermal: core: Fix use-after-free in thermal_zone_device_unregister()
  thermal: qcom-spmi-temp-alarm: Don't suppress negative temp
  thermal: ti-soc-thermal: Fix bogus thermal shutdowns for omap4430
2020-09-04 12:49:03 -07:00
Jordan Crouse
f6828e0c40 drm/msm: Disable the RPTR shadow
Disable the RPTR shadow across all targets. It will be selectively
re-enabled later for targets that need it.

Cc: stable@vger.kernel.org
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@chromium.org>
2020-09-04 12:14:15 -07:00
Jordan Crouse
7b3f3948c8 drm/msm: Disable preemption on all 5xx targets
Temporarily disable preemption on a5xx targets pending some improvements
to protect the RPTR shadow from being corrupted.

Cc: stable@vger.kernel.org
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@chromium.org>
2020-09-04 12:14:15 -07:00
Jordan Crouse
604234f336 drm/msm: Enable expanded apriv support for a650
a650 supports expanded apriv support that allows us to map critical buffers
(ringbuffer and memstore) as as privileged to protect them from corruption.

Cc: stable@vger.kernel.org
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@chromium.org>
2020-09-04 12:14:07 -07:00
Jordan Crouse
34221545d2 drm/msm: Split the a5xx preemption record
The main a5xx preemption record can be marked as privileged to
protect it from user access but the counters storage needs to be
remain unprivileged. Split the buffers and mark the critical memory
as privileged.

Cc: stable@vger.kernel.org
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@chromium.org>
2020-09-04 12:12:56 -07:00
Linus Torvalds
e2dacf6cd1 dmaengine fixes for v5.9-rc4
Core:
  - drop ACPI CSRT table reference after using it
  - fix of_dma_router_xlate() error handling
 
 Drivers: Off fixes in:
  - idxd
  - at_hdmac
  - pl330
  - dw-edma
  - jz478
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEE+vs47OPLdNbVcHzyfBQHDyUjg0cFAl9SFUQACgkQfBQHDyUj
 g0cSKxAApV4hJzU1hK1vZR3SeAN1T5n7Z6OowMR/gBqt6wjffJvh8FMUf3onOEDq
 jjLDA106JAXKGnIvd0ZJ0B7U0F6sfC9uKjz8LTxoF+XK89HxTQL5REFpR7BG2oFs
 sqoxrhgYxOqQ5czo0xSXk/psJmtJF8/KAfrXXxixe1CjIX6FeVP765w7DYl1CPT+
 VQt0LGrtHCMwpSJJW3PJFCfwj6/LWhyBIZSEoE9c+U8LqdHt0T6NKvPtj7Q7XAnx
 8L5YL+H68ZPmplZqUAtp9E2Ob5QxYNCxnbBrAk2izkALNpaN1WEJt/MVjNVXtn8l
 xKivCRxjti41piyubEAvaqUnEmbf1INE/t64N8+iKcGfZqcLWPsNTYJI0eGNBjna
 3uh4NxBNMOMjWU4lCp/1P5cnplB6sTc0Svepoft6ohCLiTkBR7P6HJ4R3HpalJTu
 O5WpFoDQAqnnV9DAyR5XyJe65tioEqkttYiDPWSlgevJBLC5PA0kB9Ug7Fvi6E6J
 OcPFTYSh0FdAf4Nq49FfV/4IqXLqL1jz9z5uehZL7g22y9h9FZ9Mxw0y+30c6VEA
 akFWnMkTElOAU4F8MJ95+c0n8gXNPUhyPk3eIE2mq9hWFZiVWL+0SKyRZGWO2nWN
 BB//CG8tMP6ryy/W/RuLe8pHuRiy/ZilqdNJ8eFSIv0CyOshTJc=
 =DUvT
 -----END PGP SIGNATURE-----

Merge tag 'dmaengine-fix-5.9-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine

Pull dmaengine fixes from Vinod Koul:
 "A couple of core fixes and odd driver fixes for dmaengine subsystem:

  Core:
   - drop ACPI CSRT table reference after using it
   - fix of_dma_router_xlate() error handling

  Drivers fixes in idxd, at_hdmac, pl330, dw-edma and jz478"

* tag 'dmaengine-fix-5.9-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine:
  dmaengine: ti: k3-udma: Update rchan_oes_offset for am654 SYSFW ABI 3.0
  drivers/dma/dma-jz4780: Fix race condition between probe and irq handler
  dmaengine: dw-edma: Fix scatter-gather address calculation
  dmaengine: ti: k3-udma: Fix the TR initialization for prep_slave_sg
  dmaengine: pl330: Fix burst length if burst size is smaller than bus width
  dmaengine: at_hdmac: add missing kfree() call in at_dma_xlate()
  dmaengine: at_hdmac: add missing put_device() call in at_dma_xlate()
  dmaengine: at_hdmac: check return value of of_find_device_by_node() in at_dma_xlate()
  dmaengine: of-dma: Fix of_dma_router_xlate's of_dma_xlate handling
  dmaengine: idxd: reset states after device disable or reset
  dmaengine: acpi: Put the CSRT table after using it
2020-09-04 12:12:39 -07:00
Linus Torvalds
86edf52e7c sound fixes for 5.9-rc4
A collection of small changes, nothing intrusive:
 
 * Remaining tasklet API conversions, now all sound stuff have been
   converted
 * A few HD-audio and USB-audio quirks and minor fixes
 * FireWire Tascam and Digi00xx fixes
 * Drop of kernel WARNING from PCM OSS for syzkaller
 -----BEGIN PGP SIGNATURE-----
 
 iQJCBAABCAAsFiEEIXTw5fNLNI7mMiVaLtJE4w1nLE8FAl9R8ckOHHRpd2FpQHN1
 c2UuZGUACgkQLtJE4w1nLE+Dtg//ShtXFp622T5NiMvDF5sG8AlbvGLf1dUdja62
 6sF2kba9vhncI9ejjGSJBCdfun3dtNkjsffacKOzTbnSHbwsBjU7J68zP1dru+d2
 88WXb4h8iAxAPcPHSgblpdi+ifeKGEYsAr7tbVa5KIpFKDxW7qLw5ntXu0G0vuW3
 +ao/p3TB/LT5I42bu0UmXsfuO7dVoyyzOSDdlse0mFNNeNSLVslAkaqqYSosmp1/
 I2gPyP814OwqrPITGvlnDWLfCnuTVDQodtAYb6sADPpplBTGu4uVfJUD+w6xVNDX
 2byY6Q2TYYolrBUSvsPxUSXAfogvGQFppOnpbxnZftIrDoFC8WN048vWEfYZ2CWn
 bVDQmErqAk8+l3r8kllW6IXhJxF2CMivv92Ht+8VA4sw29RVGtUXw6Gm7aJvoqP3
 zewF7RZh6vNJVsjAv4KEpYTyNLQi9eYCygeB9INA7dWBZeyaolchX1Ptrd4fhyo7
 ko20Fbu+vuk18B9zNE5yIpBKNpqDVNyTCnZSU9kzCicVZ/OD15fw/sUXUVo3wx5X
 ZRLBdJrccXni+LlbYHT6tJPtnQtBHITffN2/zvGPPXlViLexz88jtqWaTayy4J1u
 L63BIA3L8IfAW1ln22CfNlKbwN+Ku1uJwJnPHiUPDABXH6Uk2oeCxI5BRLzyTieB
 oe1jrcs=
 =CwOB
 -----END PGP SIGNATURE-----

Merge tag 'sound-5.9-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound

Pull sound fixes from Takashi Iwai:
 "A collection of small changes, nothing intrusive:

   - remaining tasklet API conversions, now all sound stuff have been
     converted

   - a few HD-audio and USB-audio quirks and minor fixes

   - FireWire Tascam and Digi00xx fixes

   - drop a kernel WARNING from PCM OSS for syzkaller"

* tag 'sound-5.9-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (29 commits)
  ALSA: hda/realtek - Improved routing for Thinkpad X1 7th/8th Gen
  ALSA: hda: use consistent HDAudio spelling in comments/docs
  ALSA: hda: add dev_dbg log when driver is not selected
  ALSA: hda: fix a runtime pm issue in SOF when integrated GPU is disabled
  ALSA: hda: hdmi - add Rocketlake support
  ALSA: ua101: convert tasklets to use new tasklet_setup() API
  ALSA: usb-audio: convert tasklets to use new tasklet_setup() API
  ASoC: txx9: convert tasklets to use new tasklet_setup() API
  ASoC: siu: convert tasklets to use new tasklet_setup() API
  ASoC: fsl_esai: convert tasklets to use new tasklet_setup() API
  ALSA: hdsp: convert tasklets to use new tasklet_setup() API
  ALSA: riptide: convert tasklets to use new tasklet_setup() API
  ALSA: pci/asihpi: convert tasklets to use new tasklet_setup() API
  ALSA: firewire: convert tasklets to use new tasklet_setup() API
  ALSA: core: convert tasklets to use new tasklet_setup() API
  ALSA: pcm: oss: Remove superfluous WARN_ON() for mulaw sanity check
  ALSA: hda - Fix silent audio output and corrupted input on MSI X570-A PRO
  ALSA: hda/hdmi: always check pin power status in i915 pin fixup
  ALSA: hda/realtek: Add quirk for Samsung Galaxy Book Ion NT950XCJ-X716A
  ALSA: usb-audio: Add basic capture support for Pioneer DJ DJM-250MK2
  ...
2020-09-04 12:05:25 -07:00
Linus Torvalds
cf85f5de83 drm fixes for 5.9-rc4
amdgpu:
 - Fix for 32bit systems
 - SW CTF fix
 - Update for Sienna Cichlid
 - CIK bug fixes
 
 radeon:
 - PLL fix
 
 i915:
 - Clang build warning fix
 - HDCP fixes
 
 nouveau:
 - display fixes
 -----BEGIN PGP SIGNATURE-----
 
 iQIcBAABAgAGBQJfUbg9AAoJEAx081l5xIa+O/cP/RHOAmBdFwPJSkzj93hy3LGZ
 uOCbB7gIhnVl9DObPQncKe8ZYd6XmMhCeFmOTcAXJEdcJkm4cDCe+xrM8Jcvr7pZ
 gHesqBchXmlTsunK44bP+ljh6y8J0wv06KRDpxhJv78lk0k3jg39ivT+5znvR1NU
 Wl5R4mkoPZknS92hGV/saH+5wbgsGJCtsOed2/sTE2mfL72Nw5Ym4ZEFGiaxSpUC
 wS83iV0sgOFLjj2jhpkXA3YJ+rTWx1Gg9VqD0Zn5lUVTPCrnevVItztXjQ7FtAC6
 ADziGhIxFkyHnZBQNTmItzNSPTsWDwX60Kk9obU44s/0QOWmf5znNocsVk/Lhv6N
 qREzQVqPjUFmFgWSBQ2bFlXdnrUhb2LHngnyScdk2QTGjfIaSXOUE5KV14LkS/C8
 vKtKlIrGsQSC02eWhNqih0NIO4EFsyNtx/Mw7FlID7D9rZeUCgFpuaknlS14aNDR
 a7luJeNBhwnmpgi8ejWTAhTwMXgSa9Vx33El26bUH6jCDVYk94+4S5Z6AUkco1pZ
 egP/8k49OH4pfPxv/M9ZiPdEM4DFWTsp/hWLKonZdaQ0pciTi/GC1Ett4MRa+j+V
 Mofv7pT42ZoAui2VcKXkQzZpgFff5Ca+PYjGE8O+FbH+pr+zJzUGNhJ/00Or1L11
 tT1BQ3ae++9lyqAX7Re2
 =eBDY
 -----END PGP SIGNATURE-----

Merge tag 'drm-fixes-2020-09-04' of git://anongit.freedesktop.org/drm/drm

Pull drm fixes from Dave Airlie:
 "Not much going on this week, nouveau has a display hw bug workaround,
  amdgpu has some PM fixes and CIK regression fixes, one single radeon
  PLL fix, and a couple of i915 display fixes.

  amdgpu:
   - Fix for 32bit systems
   - SW CTF fix
   - Update for Sienna Cichlid
   - CIK bug fixes

  radeon:
   - PLL fix

  i915:
   - Clang build warning fix
   - HDCP fixes

  nouveau:
   - display fixes"

* tag 'drm-fixes-2020-09-04' of git://anongit.freedesktop.org/drm/drm:
  drm/nouveau/kms/nv50-gp1xx: add WAR for EVO push buffer HW bug
  drm/nouveau/kms/nv50-gp1xx: disable notifies again after core update
  drm/nouveau/kms/nv50-: add some whitespace before debug message
  drm/nouveau/kms/gv100-: Include correct push header in crcc37d.c
  drm/radeon: Prefer lower feedback dividers
  drm/amdgpu: Fix bug in reporting voltage for CIK
  drm/amdgpu: Specify get_argument function for ci_smu_funcs
  drm/amd/pm: enable MP0 DPM for sienna_cichlid
  drm/amd/pm: avoid false alarm due to confusing softwareshutdowntemp setting
  drm/amd/pm: fix is_dpm_running() run error on 32bit system
  drm/i915: Clear the repeater bit on HDCP disable
  drm/i915: Fix sha_text population code
  drm/i915/display: Ensure that ret is always initialized in icl_combo_phy_verify_state
2020-09-04 11:59:44 -07:00
Or Cohen
acf69c9462 net/packet: fix overflow in tpacket_rcv
Using tp_reserve to calculate netoff can overflow as
tp_reserve is unsigned int and netoff is unsigned short.

This may lead to macoff receving a smaller value then
sizeof(struct virtio_net_hdr), and if po->has_vnet_hdr
is set, an out-of-bounds write will occur when
calling virtio_net_hdr_from_skb.

The bug is fixed by converting netoff to unsigned int
and checking if it exceeds USHRT_MAX.

This addresses CVE-2020-14386

Fixes: 8913336a7e ("packet: add PACKET_RESERVE sockopt")
Signed-off-by: Or Cohen <orcohen@paloaltonetworks.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2020-09-04 11:56:02 -07:00
Linus Torvalds
b25d1dc947 Merge branch 'simplify-do_wp_page'
Merge emailed patches from Peter Xu:
 "This is a small series that I picked up from Linus's suggestion to
  simplify cow handling (and also make it more strict) by checking
  against page refcounts rather than mapcounts.

  This makes uffd-wp work again (verified by running upmapsort)"

Note: this is horrendously bad timing, and making this kind of
fundamental vm change after -rc3 is not at all how things should work.
The saving grace is that it really is a a nice simplification:

 8 files changed, 29 insertions(+), 120 deletions(-)

The reason for the bad timing is that it turns out that commit
17839856fd ("gup: document and work around 'COW can break either way'
issue" broke not just UFFD functionality (as Peter noticed), but Mikulas
Patocka also reports that it caused issues for strace when running in a
DAX environment with ext4 on a persistent memory setup.

And we can't just revert that commit without re-introducing the original
issue that is a potential security hole, so making COW stricter (and in
the process much simpler) is a step to then undoing the forced COW that
broke other uses.

Link: https://lore.kernel.org/lkml/alpine.LRH.2.02.2009031328040.6929@file01.intranet.prod.int.rdu2.redhat.com/

* emailed patches from Peter Xu <peterx@redhat.com>:
  mm: Add PGREUSE counter
  mm/gup: Remove enfornced COW mechanism
  mm/ksm: Remove reuse_ksm_page()
  mm: do_wp_page() simplification
2020-09-04 09:31:54 -07:00
Rafael J. Wysocki
f7ce2c3afc Merge branch 'pm-cpufreq'
* pm-cpufreq:
  cpufreq: intel_pstate: Fix intel_pstate_get_hwp_max() for turbo disabled
  cpufreq: intel_pstate: Free memory only when turning off
  cpufreq: intel_pstate: Add ->offline and ->online callbacks
  cpufreq: intel_pstate: Tweak the EPP sysfs interface
  cpufreq: intel_pstate: Update cached EPP in the active mode
  cpufreq: intel_pstate: Refuse to turn off with HWP enabled
2020-09-04 18:31:25 +02:00
Peter Xu
798a6b87ec mm: Add PGREUSE counter
This accounts for wp_page_reuse() case, where we reused a page for COW.

Signed-off-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2020-09-04 09:25:20 -07:00
Peter Xu
a308c71bf1 mm/gup: Remove enfornced COW mechanism
With the more strict (but greatly simplified) page reuse logic in
do_wp_page(), we can safely go back to the world where cow is not
enforced with writes.

This essentially reverts commit 17839856fd ("gup: document and work
around 'COW can break either way' issue").  There are some context
differences due to some changes later on around it:

  2170ecfa76 ("drm/i915: convert get_user_pages() --> pin_user_pages()", 2020-06-03)
  376a34efa4 ("mm/gup: refactor and de-duplicate gup_fast() code", 2020-06-03)

Some lines moved back and forth with those, but this revert patch should
have striped out and covered all the enforced cow bits anyways.

Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2020-09-04 09:25:20 -07:00
Peter Xu
1a0cf26323 mm/ksm: Remove reuse_ksm_page()
Remove the function as the last reference has gone away with the do_wp_page()
changes.

Signed-off-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2020-09-04 09:25:20 -07:00
Linus Torvalds
09854ba94c mm: do_wp_page() simplification
How about we just make sure we're the only possible valid user fo the
page before we bother to reuse it?

Simplify, simplify, simplify.

And get rid of the nasty serialization on the page lock at the same time.

[peterx: add subject prefix]

Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2020-09-04 09:25:20 -07:00
Saravana Kannan
6b57b15abe driver core: Fix device_pm_lock() locking for device links
This commit fixes two issues:

1. The lockdep warning reported by Dong Aisheng <dongas86@gmail.com> [1].

It is a warning about a cycle (dpm_list_mtx --> kn->active#3 --> fw_lock)
that was introduced when device-link devices were added to expose device
link information in sysfs.

The patch that "introduced" this cycle can't be reverted because it's fixes
a real SRCU issue and also ensures that the device-link device is deleted
as soon as the device-link is deleted. This is important to avoid sysfs
name collisions if the device-link is create again immediately (this can
happen a lot with deferred probing).

2. Inconsistency in grabbing device_pm_lock() during device link deletion

Some device link deletion code paths grab device_pm_lock(), while others
don't.  The device_pm_lock() is grabbed during device_link_add() because it
checks if the supplier is in the dpm_list and also reorders the dpm_list.
However, when a device link is deleted, it does not do either of those and
therefore device_pm_lock() is not necessary. Dropping the device_pm_lock()
in all the device link deletion paths removes the inconsistency in locking.

Thanks to Stephen Boyd for helping me understand the lockdep splat.

Fixes: 843e600b8a ("driver core: Fix sleeping in invalid context during device link deletion")
[1] - https://lore.kernel.org/lkml/CAA+hA=S4eAreb7vo69LAXSk2t5=DEKNxHaiY1wSpk4xTp9urLg@mail.gmail.com/
Reported-by: Dong Aisheng <dongas86@gmail.com>
Signed-off-by: Saravana Kannan <saravanak@google.com>
Tested-by: Peng Fan <peng.fan@nxp.com>
Link: https://lore.kernel.org/r/20200901184445.1736658-1-saravanak@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-04 18:21:35 +02:00
Leon Romanovsky
cfc905f158 gcov: Disable gcov build with GCC 10
GCOV built with GCC 10 doesn't initialize n_function variable.  This
produces different kernel panics as was seen by Colin in Ubuntu and me
in FC 32.

As a workaround, let's disable GCOV build for broken GCC 10 version.

Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1891288
Link: https://lore.kernel.org/lkml/20200827133932.3338519-1-leon@kernel.org
Link: https://lore.kernel.org/lkml/CAHk-=whbijeSdSvx-Xcr0DPMj0BiwhJ+uiNnDSVZcr_h_kg7UA@mail.gmail.com/
Cc: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2020-09-04 09:19:49 -07:00
Barret Rhoden
7b81ce7cdc init: fix error check in clean_path()
init_stat() returns 0 on success, same as vfs_lstat().  When it replaced
vfs_lstat(), the '!' was dropped.

Fixes: 716308a533 ("init: add an init_stat helper")
Signed-off-by: Barret Rhoden <brho@google.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2020-09-04 09:16:58 -07:00
Krzysztof Kozlowski
51de18bff2 MAINTAINERS: Add the security document to SECURITY CONTACT
When changing the document related to kernel security workflow, notify
the security mailing list as its concerned by this.

Cc: <security@kernel.org>
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Link: https://lore.kernel.org/r/20200827182029.3458-1-krzk@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-04 18:15:44 +02:00
Michał Mirosław
693a8e9365 driver code: print symbolic error code
dev_err_probe() prepends the message with an error code. Let's make it
more readable by translating the code to a more recognisable symbol.

Fixes: a787e5400a ("driver core: add device probe log helper")
Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
Link: https://lore.kernel.org/r/ea3f973e4708919573026fdce52c264db147626d.1598630856.git.mirq-linux@rere.qmqm.pl
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-04 18:14:52 +02:00
Vladis Dronov
e3b9fc7eec debugfs: Fix module state check condition
The '#ifdef MODULE' check in the original commit does not work as intended.
The code under the check is not built at all if CONFIG_DEBUG_FS=y. Fix this
by using a correct check.

Fixes: 275678e7a9 ("debugfs: Check module state before warning in {full/open}_proxy_open()")
Signed-off-by: Vladis Dronov <vdronov@redhat.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200811150129.53343-1-vdronov@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-04 18:12:52 +02:00
Tetsuo Handa
bd018a6a75 video: fbdev: fix OOB read in vga_8planes_imageblit()
syzbot is reporting OOB read at vga_8planes_imageblit() [1], for
"cdat[y] >> 4" can become a negative value due to "const char *cdat".

[1] https://syzkaller.appspot.com/bug?id=0d7a0da1557dcd1989e00cb3692b26d4173b4132

Reported-by: syzbot <syzbot+69fbd3e01470f169c8c4@syzkaller.appspotmail.com>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/90b55ec3-d5b0-3307-9f7c-7ff5c5fd6ad3@i-love.sakura.ne.jp
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-04 17:27:10 +02:00
Jim Cromie
42f07816ac dyndbg: fix problem parsing format="foo bar"
commit 14775b0496 ("dyndbg: accept query terms like file=bar and
module=foo") added the combined keyword=value parsing poorly; revert
most of it, keeping the keyword & arg change.

Instead, fix the tokenizer for the new input, by terminating the
keyword (an unquoted word) on '=' as well as space, thus letting the
tokenizer work on the quoted argument, like it would have previously.

Also add a few debug-prints to show more parsing context, into
tokenizer and parse-query, and use "keyword, value" in others.

Fixes: 14775b0496 ("dyndbg: accept query terms like file=bar and module=foo")
Signed-off-by: Jim Cromie <jim.cromie@gmail.com>
Link: https://lore.kernel.org/r/20200831182210.850852-4-jim.cromie@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-04 17:21:56 +02:00
Jim Cromie
a2d375eda7 dyndbg: refine export, rename to dynamic_debug_exec_queries()
commit 4c0d77828d ("dyndbg: export ddebug_exec_queries") had a few
problems:
 - broken non DYNAMIC_DEBUG_CORE configs, sparse warning
 - the exported function modifies query string, breaks on RO strings.
 - func name follows internal convention, shouldn't be exposed as is.

1st is fixed in header with ifdefd function prototype or stub defn.
Also remove an obsolete HAVE-symbol ifdef-comment, and add others.

Fix others by wrapping existing internal function with a new one,
named in accordance with module-prefix naming convention, before
export hits v5.9.0.  In new function, copy query string to a local
buffer, so users can pass hard-coded/RO queries, and internal function
can be used unchanged.

Fixes: 4c0d77828d ("dyndbg: export ddebug_exec_queries")
Signed-off-by: Jim Cromie <jim.cromie@gmail.com>
Link: https://lore.kernel.org/r/20200831182210.850852-3-jim.cromie@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-04 17:21:56 +02:00
Jim Cromie
b52a95eac1 dyndbg: give %3u width in pr-format, cosmetic only
Specify the print-width so log entries line up nicely.

no functional changes.

Signed-off-by: Jim Cromie <jim.cromie@gmail.com>
Link: https://lore.kernel.org/r/20200831182210.850852-2-jim.cromie@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-04 17:21:56 +02:00
Zeng Tao
a18cd6c9b6 usb: core: fix slab-out-of-bounds Read in read_descriptors
The USB device descriptor may get changed between two consecutive
enumerations on the same device for some reason, such as DFU or
malicius device.
In that case, we may access the changing descriptor if we don't take
the device lock here.

The issue is reported:
https://syzkaller.appspot.com/bug?id=901a0d9e6519ef8dc7acab25344bd287dd3c7be9

Cc: stable <stable@vger.kernel.org>
Cc: Alan Stern <stern@rowland.harvard.edu>
Reported-by: syzbot+256e56ddde8b8957eabd@syzkaller.appspotmail.com
Fixes: 217a9081d8 ("USB: add all configs to the "descriptors" attribute")
Signed-off-by: Zeng Tao <prime.zeng@hisilicon.com>
Link: https://lore.kernel.org/r/1599201467-11000-1-git-send-email-prime.zeng@hisilicon.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-04 16:41:22 +02:00
Amjad Ouled-Ameur
a6498d5182 Revert "usb: dwc3: meson-g12a: fix shared reset control use"
This reverts commit 7a410953d1.

This commit breaks USB on meson-gxl-s905x-libretech-cc. Reverting
the change solves the issue.

In fact, according to the reset framework code, consumers must not use
reset_control_(de)assert() on shared reset lines when reset_control_reset
has been used, and vice-versa.

Moreover, with this commit, usb is not guaranted to be reset since the
reset is likely to be initially deasserted.

Reverting the commit will bring back the suspend warning mentioned in the
commit description. Nevertheless, a warning is much less critical than
breaking dwc3-meson-g12a USB completely. We will address the warning
issue in another way as a 2nd step.

Fixes: 7a410953d1 ("usb: dwc3: meson-g12a: fix shared reset control use")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Amjad Ouled-Ameur <aouledameur@baylibre.com>
Reported-by: Jerome Brunet <jbrunet@baylibre.com>
Acked-by: Neil Armstrong <narmstrong@baylibre.com>
Acked-by: Philipp Zabel <p.zabel@pengutronix.de>
Link: https://lore.kernel.org/r/20200827144810.26657-1-aouledameur@baylibre.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-04 16:41:22 +02:00
Heikki Krogerus
1f3546ff3f usb: typec: ucsi: acpi: Check the _DEP dependencies
Failing probe with -EPROBE_DEFER until all dependencies
listed in the _DEP (Operation Region Dependencies) object
have been met.

This will fix an issue where on some platforms UCSI ACPI
driver fails to probe because the address space handler for
the operation region that the UCSI ACPI interface uses has
not been loaded yet.

Fixes: 8243edf441 ("usb: typec: ucsi: Add ACPI driver")
Cc: stable@vger.kernel.org
Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://lore.kernel.org/r/20200904110918.51546-1-heikki.krogerus@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-04 16:41:22 +02:00
Madhusudanarao Amara
290a405ce3 usb: typec: intel_pmc_mux: Un-register the USB role switch
Added missing code for un-register USB role switch in the remove and
error path.

Cc: Stable <stable@vger.kernel.org> # v5.8
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Fixes: 6701adfa96 ("usb: typec: driver for Intel PMC mux control")
Signed-off-by: Madhusudanarao Amara <madhusudanarao.amara@intel.com>
Link: https://lore.kernel.org/r/20200825183811.7262-1-madhusudanarao.amara@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-04 16:41:22 +02:00
Mathias Nyman
cfd54fa83a usb: Fix out of sync data toggle if a configured device is reconfigured
Userspace drivers that use a SetConfiguration() request to "lightweight"
reset an already configured usb device might cause data toggles to get out
of sync between the device and host, and the device becomes unusable.

The xHCI host requires endpoints to be dropped and added back to reset the
toggle. If USB core notices the new configuration is the same as the
current active configuration it will avoid these extra steps by calling
usb_reset_configuration() instead of usb_set_configuration().

A SetConfiguration() request will reset the device side data toggles.
Make sure usb_reset_configuration() function also drops and adds back the
endpoints to ensure data toggles are in sync.

To avoid code duplication split the current usb_disable_device() function
and reuse the endpoint specific part.

Cc: stable <stable@vger.kernel.org>
Tested-by: Martin Thierer <mthierer@gmail.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20200901082528.12557-1-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-04 16:41:22 +02:00
Thomas Gleixner
4facb95b7a x86/entry: Unbreak 32bit fast syscall
Andy reported that the syscall treacing for 32bit fast syscall fails:

# ./tools/testing/selftests/x86/ptrace_syscall_32
...
[RUN] SYSEMU
[FAIL] Initial args are wrong (nr=224, args=10 11 12 13 14 4289172732)
...
[RUN] SYSCALL
[FAIL] Initial args are wrong (nr=29, args=0 0 0 0 0 4289172732)
 
The eason is that the conversion to generic entry code moved the retrieval
of the sixth argument (EBP) after the point where the syscall entry work
runs, i.e. ptrace, seccomp, audit...

Unbreak it by providing a split up version of syscall_enter_from_user_mode().

- syscall_enter_from_user_mode_prepare() establishes state and enables
  interrupts

- syscall_enter_from_user_mode_work() runs the entry work

Replace the call to syscall_enter_from_user_mode() in the 32bit fast
syscall C-entry with the split functions and stick the EBP retrieval
between them.

Fixes: 27d6b4d14f ("x86/entry: Use generic syscall entry function")
Reported-by: Andy Lutomirski <luto@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lore.kernel.org/r/87k0xdjbtt.fsf@nanos.tec.linutronix.de
2020-09-04 15:50:14 +02:00
Andy Lutomirski
d5c678aed5 x86/debug: Allow a single level of #DB recursion
Trying to clear DR7 around a #DB from usermode malfunctions if the tasks
schedules when delivering SIGTRAP.

Rather than trying to define a special no-recursion region, just allow a
single level of recursion.  The same mechanism is used for NMI, and it
hasn't caused any problems yet.

Fixes: 9f58fdde95 ("x86/db: Split out dr6/7 handling")
Reported-by: Kyle Huey <me@kylehuey.com>
Debugged-by: Josh Poimboeuf <jpoimboe@redhat.com>
Signed-off-by: Andy Lutomirski <luto@kernel.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Daniel Thompson <daniel.thompson@linaro.org>
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/8b9bd05f187231df008d48cf818a6a311cbd5c98.1597882384.git.luto@kernel.org
Link: https://lore.kernel.org/r/20200902133200.726584153@infradead.org
2020-09-04 15:09:29 +02:00
Peter Zijlstra
662a022189 x86/entry: Fix AC assertion
The WARN added in commit 3c73b81a91 ("x86/entry, selftests: Further
improve user entry sanity checks") unconditionally triggers on a IVB
machine because it does not support SMAP.

For !SMAP hardware the CLAC/STAC instructions are patched out and thus if
userspace sets AC, it is still have set after entry.

Fixes: 3c73b81a91 ("x86/entry, selftests: Further improve user entry sanity checks")
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Daniel Thompson <daniel.thompson@linaro.org>
Acked-by: Andy Lutomirski <luto@kernel.org>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20200902133200.666781610@infradead.org
2020-09-04 15:09:29 +02:00
Vamshi K Sthambamkadi
2356bb4b82 tracing/kprobes, x86/ptrace: Fix regs argument order for i386
On i386, the order of parameters passed on regs is eax,edx,and ecx
(as per regparm(3) calling conventions).

Change the mapping in regs_get_kernel_argument(), so that arg1=ax
arg2=dx, and arg3=cx.

Running the selftests testcase kprobes_args_use.tc shows the result
as passed.

Fixes: 3c88ee194c ("x86: ptrace: Add function argument access API")
Signed-off-by: Vamshi K Sthambamkadi <vamshi.k.sthambamkadi@gmail.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Acked-by: Masami Hiramatsu <mhiramat@kernel.org>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: <stable@vger.kernel.org>
Link: https://lkml.kernel.org/r/20200828113242.GA1424@cosmos
2020-09-04 14:40:42 +02:00
Greg Kroah-Hartman
b27eda5ce1 interconnect fixes for v5.9
This contains two fixes:
 - Fix the core to show correctly the bandwidth for disabled paths.
 - Fix a driver to make sure small values are not truncated.
 
 Signed-off-by: Georgi Djakov <georgi.djakov@linaro.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQIcBAABAgAGBQJfUiUEAAoJEIDQzArG2BZjjWAQAIFFjTruXia5MTuiUR5VPv2l
 yI9+5NrT8yagv0sc8KsdO4g5LAde/1RbqcSXTnnSlVb7ipnXMhGKYIYIaTCIDqhY
 oWSi+UjFk8lkPX0cFSojvmscYRvWw3LWQoC4wellcSOiHSJ4gpBYDVXavyG/B3W3
 jku30cGtUwQ/HtGPaXDeLgKvbkNjHW0oF3fKLkZoskYT+zNxYwL4Dwn380hZLdOw
 uLfCc2bIJPGd+USaNHpKnscZGP9HztV1vpxZeoxSnvl2Dhg08DZX8YfpRE7ulcPI
 cgmsu946eeXQ9wqA7lsVfJh4+EtY1uu8xQUlAdZlXCDiirk6gI4UQiPPHYAiF8tA
 oyTxflK/SzqaEuWmaAqDi8DeOozjSIoKieoTi+mOR/QNhl7nf6mXfvUXaEUYGH/V
 a3ocmrK9RfSGBxkWV6gVS34uV4tb39M5EYvfgYh07g1jR4aFCc9LozRiRCzDAJmF
 7ZBIjI7FhYROYXywIUGzujqNHE8I6BY+Cde/5BpLHWUPdUc+3r2cG0djox0dImO5
 keoGQNJLMFyugHLwSyqP4LdipzY+39S3OcSyX2/d+nh2oToh0EQY+6dUWms9NL4S
 WLAAbkPfjtrx87GWzWGCejxy6DcVyWCCQATgwD3510YdKQtKsD8io+CSM30hGvXO
 ywXiziupRdRddnSFLjNG
 =JjGY
 -----END PGP SIGNATURE-----

Merge tag 'icc-5.9-rc4' of https://git.linaro.org/people/georgi.djakov/linux into char-misc-linus

Georgi writes:

interconnect fixes for v5.9

This contains two fixes:
- Fix the core to show correctly the bandwidth for disabled paths.
- Fix a driver to make sure small values are not truncated.

Signed-off-by: Georgi Djakov <georgi.djakov@linaro.org>

* tag 'icc-5.9-rc4' of https://git.linaro.org/people/georgi.djakov/linux:
  interconnect: qcom: Fix small BW votes being truncated to zero
  interconnect: Show bandwidth for disabled paths as zero in debugfs
2020-09-04 13:52:03 +02:00
Gerd Hoffmann
fc7f148feb drm/virtio: drop virtio_gpu_output->enabled
Not needed, already tracked by drm_crtc_state->active.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/20200818072511.6745-3-kraxel@redhat.com
(cherry picked from commit 1174c8a0f3)
2020-09-04 13:11:32 +02:00
Greg Kroah-Hartman
e22a220515 phy: fixes for 5.9
*) platform_no_drv_owner.cocci and return value check qcom ipq806x-usb driver
 *) correcting register programming for ipq8074 phy
 *) disable PHY charger detect for omap-usb2-phy
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEE+vs47OPLdNbVcHzyfBQHDyUjg0cFAl9SE4EACgkQfBQHDyUj
 g0fVLw/9Hl1qw32LgWdWOdcJjL/FChyq7MvXqW+RW/j2c8zaGZCDYHeb4zwQMt7k
 JNawbARwyjbJPPiCpSL7gpyQ/kNHxmNmkoSPSTKkIwitpdh3x7cxGlxuWHkC6ECV
 uoJhRBO4yUkNZ1t9vrQ0XRbn49yUzP2ff+dpqAT2HU6E7CZGpJ8eV8er09gHyUp8
 tbFaSBJm8WhbUKdGQN4EyqembI6doIuW7QNaL+ByQqI6p+ReAFwl2rwMSsM8wz3c
 Z0UhzUfbLMaw69Q3ujle6I5Pn/Suixu4J8bffkdW8k7xze/1PtyzES/q85nMZsR5
 ZBgGd8cjRD6neBCFOgkhf/RUUhYczwaXIRYP57K/fC1nIot+8bmt4TRtz2Oh1s06
 o0iozvmkvKupXmEefMm5XE5efxJ8Kof1QDdff2mpE0UvB8KQzcQQN4C3Dk/TF8xt
 gkRnG4CcL7ISVwcBmykjZV/DLwJNLU34oVbeKiJ8UbNmPt18cmv6TRrM9AAgabKJ
 0jXm1GwwmWkE6E3C1/zBuDjxitamjCv+nBBFzXdkCJk0u6AZn6hnoi4xYyZSxVvc
 SumrTAk04zcUtAgGMUEn2iiBEqdtUlbRSPr94Q9WP9Lzr1A6wDFUr+Z6vq+gEcuw
 i6yYq4WWwyFYzry/S10eOUsCzAh4cmkXevEwE6XkCxLUxI37rYE=
 =+mvl
 -----END PGP SIGNATURE-----

Merge tag 'phy-fixes-5.9' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy into char-misc-linus

Vinod writes:

phy: fixes for 5.9

*) platform_no_drv_owner.cocci and return value check qcom ipq806x-usb driver
*) correcting register programming for ipq8074 phy
*) disable PHY charger detect for omap-usb2-phy

* tag 'phy-fixes-5.9' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy:
  phy: omap-usb2-phy: disable PHY charger detect
  phy: qcom-qmp: Use correct values for ipq8074 PCIe Gen2 PHY init
  phy: qualcomm: fix return value check in qcom_ipq806x_usb_phy_probe()
  phy: qualcomm: fix platform_no_drv_owner.cocci warnings
2020-09-04 12:41:55 +02:00
Greg Kroah-Hartman
51fc07d9ff soundwire fixes for v5.8
This contains two fixes to sdw core for dangling pointer and a typo for
 INTSTAT register
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEE+vs47OPLdNbVcHzyfBQHDyUjg0cFAl9SB/oACgkQfBQHDyUj
 g0eayQ/8CpONQvFhkS0rzKSEmn1D8Hi/RBV687nCU5ZsIA/UEjArbS4Rb88gdrFk
 709oauyEw4XuYMqFXlEsEQ5ELbMuCi7LAEn57qrN8tZ5lsl5biw6A0iRAI2XJsdu
 BIwBL9HSicbf671NUShlKcfMN+IiHOePiEwmMo94vWEeTOC5cWd9R64QYZsrmk1h
 cHXtefXrKDcrX6nNwKZth9Q/r2ZAQfQLOMe85UzrwyRLLKMQCImAw6xcmYsjVGgR
 xTRtFcUtWYnB3jROtZ0l+l4kqHtFIxg98Jc/8vgc1dbasCa7xbBWQVrj1UW6N14r
 aTH2rFacJBNQ1NqIaNRtSU7h6XTYy6PBo9+LoUuIae4y5/d+sPSpsNAQVxYhz/qF
 wyWtkeO5rdiSePHnT4og0j2hOxHZt7+p3Xu8OH/1i7v1qNnsU/Fg2vX5mQs44BT7
 ixHy64Mvk3jHvZr2+QBwwn/mCoGwtEFAuj6RUw8NtXoeTRUo9BkkE0RwyFs7eFgS
 xQf00cvhuUsW4o9/D/G2hFain2TSV1SJX4MI1tHkSURoKod3PGMEDiTENWAFdut+
 i9qQhij5z6kfJUHcLq3Tont0NnN+twC0KCv15FQGIMhpwlfmzdegDtaYckXr+I+i
 +7JSx0NILy1NHBEWgWnCnMxEWvIpb0hYG9ZucaeUQfK1MxjoZVw=
 =JZwY
 -----END PGP SIGNATURE-----

Merge tag 'soundwire-5.9-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire into char-misc-linus

Vinod writes:

soundwire fixes for v5.8

This contains two fixes to sdw core for dangling pointer and a typo for
INTSTAT register

* tag 'soundwire-5.9-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire:
  soundwire: fix double free of dangling pointer
  soundwire: bus: fix typo in comment on INTSTAT registers
2020-09-04 12:41:08 +02:00
Chris Wilson
29aaebbca4 iommu/vt-d: Handle 36bit addressing for x86-32
Beware that the address size for x86-32 may exceed unsigned long.

[    0.368971] UBSAN: shift-out-of-bounds in drivers/iommu/intel/iommu.c:128:14
[    0.369055] shift exponent 36 is too large for 32-bit type 'long unsigned int'

If we don't handle the wide addresses, the pages are mismapped and the
device read/writes go astray, detected as DMAR faults and leading to
device failure. The behaviour changed (from working to broken) in commit
fa954e6831 ("iommu/vt-d: Delegate the dma domain to upper layer"), but
the error looks older.

Fixes: fa954e6831 ("iommu/vt-d: Delegate the dma domain to upper layer")
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Acked-by: Lu Baolu <baolu.lu@linux.intel.com>
Cc: James Sewart <jamessewart@arista.com>
Cc: Lu Baolu <baolu.lu@linux.intel.com>
Cc: Joerg Roedel <jroedel@suse.de>
Cc: <stable@vger.kernel.org> # v5.3+
Link: https://lore.kernel.org/r/20200822160209.28512-1-chris@chris-wilson.co.uk
Signed-off-by: Joerg Roedel <jroedel@suse.de>
2020-09-04 12:14:28 +02:00
Joerg Roedel
2822e58250 iommu/amd: Do not use IOMMUv2 functionality when SME is active
When memory encryption is active the device is likely not in a direct
mapped domain. Forbid using IOMMUv2 functionality for now until finer
grained checks for this have been implemented.

Signed-off-by: Joerg Roedel <jroedel@suse.de>
Link: https://lore.kernel.org/r/20200824105415.21000-3-joro@8bytes.org
Signed-off-by: Joerg Roedel <jroedel@suse.de>
2020-09-04 12:07:08 +02:00
Joerg Roedel
7cad554887 iommu/amd: Do not force direct mapping when SME is active
Do not force devices supporting IOMMUv2 to be direct mapped when memory
encryption is active. This might cause them to be unusable because their
DMA mask does not include the encryption bit.

Signed-off-by: Joerg Roedel <jroedel@suse.de>
Link: https://lore.kernel.org/r/20200824105415.21000-2-joro@8bytes.org
Signed-off-by: Joerg Roedel <jroedel@suse.de>
2020-09-04 12:07:08 +02:00
Alexandru Elisei
7b75cd5128 KVM: arm64: Update page shift if stage 2 block mapping not supported
Commit 196f878a7a (" KVM: arm/arm64: Signal SIGBUS when stage2 discovers
hwpoison memory") modifies user_mem_abort() to send a SIGBUS signal when
the fault IPA maps to a hwpoisoned page. Commit 1559b7583f ("KVM:
arm/arm64: Re-check VMA on detecting a poisoned page") changed
kvm_send_hwpoison_signal() to use the page shift instead of the VMA because
at that point the code had already released the mmap lock, which means
userspace could have modified the VMA.

If userspace uses hugetlbfs for the VM memory, user_mem_abort() tries to
map the guest fault IPA using block mappings in stage 2. That is not always
possible, if, for example, userspace uses dirty page logging for the VM.
Update the page shift appropriately in those cases when we downgrade the
stage 2 entry from a block mapping to a page.

Fixes: 1559b7583f ("KVM: arm/arm64: Re-check VMA on detecting a poisoned page")
Signed-off-by: Alexandru Elisei <alexandru.elisei@arm.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Reviewed-by: Gavin Shan <gshan@redhat.com>
Link: https://lore.kernel.org/r/20200901133357.52640-2-alexandru.elisei@arm.com
2020-09-04 10:53:48 +01:00
Marc Zyngier
376426b1a9 KVM: arm64: Fix address truncation in traces
Owing to their ARMv7 origins, the trace events are truncating most
address values to 32bits. That's not really helpful.

Expand the printing of such values to their full glory.

Signed-off-by: Marc Zyngier <maz@kernel.org>
2020-09-04 10:53:48 +01:00
Suravee Suthikulpanit
e52d58d54a iommu/amd: Use cmpxchg_double() when updating 128-bit IRTE
When using 128-bit interrupt-remapping table entry (IRTE) (a.k.a GA mode),
current driver disables interrupt remapping when it updates the IRTE
so that the upper and lower 64-bit values can be updated safely.

However, this creates a small window, where the interrupt could
arrive and result in IO_PAGE_FAULT (for interrupt) as shown below.

  IOMMU Driver            Device IRQ
  ============            ===========
  irte.RemapEn=0
       ...
   change IRTE            IRQ from device ==> IO_PAGE_FAULT !!
       ...
  irte.RemapEn=1

This scenario has been observed when changing irq affinity on a system
running I/O-intensive workload, in which the destination APIC ID
in the IRTE is updated.

Instead, use cmpxchg_double() to update the 128-bit IRTE at once without
disabling the interrupt remapping. However, this means several features,
which require GA (128-bit IRTE) support will also be affected if cmpxchg16b
is not supported (which is unprecedented for AMD processors w/ IOMMU).

Fixes: 880ac60e25 ("iommu/amd: Introduce interrupt remapping ops structure")
Reported-by: Sean Osborne <sean.m.osborne@oracle.com>
Signed-off-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
Tested-by: Erik Rockstrom <erik.rockstrom@oracle.com>
Reviewed-by: Joao Martins <joao.m.martins@oracle.com>
Link: https://lore.kernel.org/r/20200903093822.52012-3-suravee.suthikulpanit@amd.com
Signed-off-by: Joerg Roedel <jroedel@suse.de>
2020-09-04 11:53:18 +02:00