1. 21 Dec, 2018 4 commits
    • Mike Snitzer's avatar
      dm thin: send event about thin-pool state change _after_ making it · cd5d8a92
      Mike Snitzer authored
      commit f6c36758
      Sending a DM event before a thin-pool state change is about to happen is
      a bug.  It wasn't realized until it became clear that userspace response
      to the event raced with the actual state change that the event was
      meant to notify about.
      Fix this by first updating internal thin-pool state to reflect what the
      DM event is being issued about.  This fixes a long-standing racey/buggy
      userspace device-mapper-test-suite 'resize_io' test that would get an
      event but not find the state it was looking for -- so it would just go
      on to hang because no other events caused the test to reevaluate the
      thin-pool's state.
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarMike Snitzer <snitzer@redhat.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    • Alek Du's avatar
      mmc: sdhci: fix the timeout check window for clock and reset · 38ef9c5a
      Alek Du authored
      commit b704441e upstream.
      We observed some premature timeouts on a virtualization platform, the log
      is like this:
      case 1:
      [159525.255629] mmc1: Internal clock never stabilised.
      [159525.255818] mmc1: sdhci: ============ SDHCI REGISTER DUMP ===========
      [159525.256049] mmc1: sdhci: Sys addr:  0x00000000 | Version:  0x00001002
      [159525.257205] mmc1: sdhci: Wake-up:   0x00000000 | Clock:    0x0000fa03
      From the clock control register dump, we are pretty sure the clock was
      case 2:
      [  914.550127] mmc1: Reset 0x2 never completed.
      [  914.550321] mmc1: sdhci: ============ SDHCI REGISTER DUMP ===========
      [  914.550608] mmc1: sdhci: Sys addr:  0x00000010 | Version:  0x00001002
      After checking the sdhci code, we found the timeout check actually has a
      little window that the CPU can be scheduled out and when it comes back,
      the original time set or check is not valid.
      Fixes: 5a436cc0
       ("mmc: sdhci: Optimize delay loops")
      Cc: stable@vger.kernel.org      # v4.12+
      Signed-off-by: default avatarAlek Du <alek.du@intel.com>
      Acked-by: default avatarAdrian Hunter <adrian.hunter@intel.com>
      Signed-off-by: default avatarUlf Hansson <ulf.hansson@linaro.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    • Aaro Koskinen's avatar
      MMC: OMAP: fix broken MMC on OMAP15XX/OMAP5910/OMAP310 · 30d358d8
      Aaro Koskinen authored
      commit e8cde625 upstream.
      Since v2.6.22 or so there has been reports [1] about OMAP MMC being
      broken on OMAP15XX based hardware (OMAP5910 and OMAP310). The breakage
      seems to have been caused by commit 46a6730e ("mmc-omap: Fix
      omap to use MMC_POWER_ON") that changed clock enabling to be done
      on MMC_POWER_ON. This can happen multiple times in a row, and on 15XX
      the hardware doesn't seem to like it and the MMC just stops responding.
      Fix by memorizing the power mode and do the init only when necessary.
      Before the patch (on Palm TE):
      	mmc0: new SD card at address b368
      	mmcblk0: mmc0:b368 SDC   977 MiB
      	mmci-omap mmci-omap.0: command timeout (CMD18)
      	mmci-omap mmci-omap.0: command timeout (CMD13)
      	mmci-omap mmci-omap.0: command timeout (CMD13)
      	mmci-omap mmci-omap.0: command timeout (CMD12) [x 6]
      	mmci-omap mmci-omap.0: command timeout (CMD13) [x 6]
      	mmcblk0: error -110 requesting status
      	mmci-omap mmci-omap.0: command timeout (CMD8)
      	mmci-omap mmci-omap.0: command timeout (CMD18)
      	mmci-omap mmci-omap.0: command timeout (CMD13)
      	mmci-omap mmci-omap.0: command timeout (CMD13)
      	mmci-omap mmci-omap.0: command timeout (CMD12) [x 6]
      	mmci-omap mmci-omap.0: command timeout (CMD13) [x 6]
      	mmcblk0: error -110 requesting status
      	mmcblk0: recovery failed!
      	print_req_error: I/O error, dev mmcblk0, sector 0
      	Buffer I/O error on dev mmcblk0, logical block 0, async page read
      	 mmcblk0: unable to read partition table
      After the patch:
      	mmc0: new SD card at address b368
      	mmcblk0: mmc0:b368 SDC   977 MiB
      	 mmcblk0: p1
      The patch is based on a fix and analysis done by Ladislav Michl.
      Tested on OMAP15XX/OMAP310 (Palm TE), OMAP1710 (Nokia 770)
      and OMAP2420 (Nokia N810).
      [1] https://marc.info/?t=123175197000003&r=1&w=2
      Fixes: 46a6730e
       ("mmc-omap: Fix omap to use MMC_POWER_ON")
      Reported-by: default avatarLadislav Michl <ladis@linux-mips.org>
      Reported-by: default avatarAndrzej Zaborowski <balrogg@gmail.com>
      Tested-by: default avatarLadislav Michl <ladis@linux-mips.org>
      Acked-by: default avatarTony Lindgren <tony@atomide.com>
      Signed-off-by: default avatarAaro Koskinen <aaro.koskinen@iki.fi>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarUlf Hansson <ulf.hansson@linaro.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    • Chen-Yu Tsai's avatar
      pinctrl: sunxi: a83t: Fix IRQ offset typo for PH11 · 7ff0bcb2
      Chen-Yu Tsai authored
      commit 478b6767 upstream.
      Pin PH11 is used on various A83T board to detect a change in the OTG
      port's ID pin, as in when an OTG host cable is plugged in.
      The incorrect offset meant the gpiochip/irqchip was activating the wrong
      pin for interrupts.
      Fixes: 4730f33f
       ("pinctrl: sunxi: add allwinner A83T PIO controller support")
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarChen-Yu Tsai <wens@csie.org>
      Acked-by: Maxime Ripard's avatarMaxime Ripard <maxime.ripard@bootlin.com>
      Signed-off-by: default avatarLinus Walleij <linus.walleij@linaro.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
  2. 17 Dec, 2018 34 commits
    • Piotr Stankiewicz's avatar
      IB/hfi1: Fix an out-of-bounds access in get_hw_stats · 01a16601
      Piotr Stankiewicz authored
      commit 36d84219 upstream.
      When running with KASAN, the following trace is produced:
      [   62.535888]
      [   62.544930] BUG: KASAN: slab-out-of-bounds in
      gut_hw_stats+0x122/0x230 [hfi1]
      [   62.553856] Write of size 8 at addr ffff88080e8d6330 by task
      [   62.565333] CPU: 0 PID: 14 Comm: kworker/0:1 Not tainted
      4.19.0-test-build-kasan+ #8
      [   62.575087] Hardware name: Intel Corporation S2600KPR/S2600KPR, BIOS
      SE5C610.86B.01.01.0019.101220160604 10/12/2016
      [   62.587951] Workqueue: events work_for_cpu_fn
      [   62.594050] Call Trace:
      [   62.598023]  dump_stack+0xc6/0x14c
      [   62.603089]  ? dump_stack_print_info.cold.1+0x2f/0x2f
      [   62.610041]  ? kmsg_dump_rewind_nolock+0x59/0x59
      [   62.616615]  ? get_hw_stats+0x122/0x230 [hfi1]
      [   62.622985]  print_address_description+0x6c/0x23c
      [   62.629744]  ? get_hw_stats+0x122/0x230 [hfi1]
      [   62.636108]  kasan_report.cold.6+0x241/0x308
      [   62.642365]  get_hw_stats+0x122/0x230 [hfi1]
      [   62.648703]  ? hfi1_alloc_rn+0x40/0x40 [hfi1]
      [   62.655088]  ? __kmalloc+0x110/0x240
      [   62.660695]  ? hfi1_alloc_rn+0x40/0x40 [hfi1]
      [   62.667142]  setup_hw_stats+0xd8/0x430 [ib_core]
      [   62.673972]  ? show_hfi+0x50/0x50 [hfi1]
      [   62.680026]  ib_device_register_sysfs+0x165/0x180 [ib_core]
      [   62.687995]  ib_register_device+0x5a2/0xa10 [ib_core]
      [   62.695340]  ? show_hfi+0x50/0x50 [hfi1]
      [   62.701421]  ? ib_unregister_device+0x2e0/0x2e0 [ib_core]
      [   62.709222]  ? __vmalloc_node_range+0x2d0/0x380
      [   62.716131]  ? rvt_driver_mr_init+0x11f/0x2d0 [rdmavt]
      [   62.723735]  ? vmalloc_node+0x5c/0x70
      [   62.729697]  ? rvt_driver_mr_init+0x11f/0x2d0 [rdmavt]
      [   62.737347]  ? rvt_driver_mr_init+0x1f5/0x2d0 [rdmavt]
      [   62.744998]  ? __rvt_alloc_mr+0x110/0x110 [rdmavt]
      [   62.752315]  ? rvt_rc_error+0x140/0x140 [rdmavt]
      [   62.759434]  ? rvt_vma_open+0x30/0x30 [rdmavt]
      [   62.766364]  ? mutex_unlock+0x1d/0x40
      [   62.772445]  ? kmem_cache_create_usercopy+0x15d/0x230
      [   62.780115]  rvt_register_device+0x1f6/0x360 [rdmavt]
      [   62.787823]  ? rvt_get_port_immutable+0x180/0x180 [rdmavt]
      [   62.796058]  ? __get_txreq+0x400/0x400 [hfi1]
      [   62.802969]  ? memcpy+0x34/0x50
      [   62.808611]  hfi1_register_ib_device+0xde6/0xeb0 [hfi1]
      [   62.816601]  ? hfi1_get_npkeys+0x10/0x10 [hfi1]
      [   62.823760]  ? hfi1_init+0x89f/0x9a0 [hfi1]
      [   62.830469]  ? hfi1_setup_eagerbufs+0xad0/0xad0 [hfi1]
      [   62.838204]  ? pcie_capability_clear_and_set_word+0xcd/0xe0
      [   62.846429]  ? pcie_capability_read_word+0xd0/0xd0
      [   62.853791]  ? hfi1_pcie_init+0x187/0x4b0 [hfi1]
      [   62.860958]  init_one+0x67f/0xae0 [hfi1]
      [   62.867301]  ? hfi1_init+0x9a0/0x9a0 [hfi1]
      [   62.873876]  ? wait_woken+0x130/0x130
      [   62.879860]  ? read_word_at_a_time+0xe/0x20
      [   62.886329]  ? strscpy+0x14b/0x280
      [   62.891998]  ? hfi1_init+0x9a0/0x9a0 [hfi1]
      [   62.898405]  local_pci_probe+0x70/0xd0
      [   62.904295]  ? pci_device_shutdown+0x90/0x90
      [   62.910833]  work_for_cpu_fn+0x29/0x40
      [   62.916750]  process_one_work+0x584/0x960
      [   62.922974]  ? rcu_work_rcufn+0x40/0x40
      [   62.928991]  ? __schedule+0x396/0xdc0
      [   62.934806]  ? __sched_text_start+0x8/0x8
      [   62.941020]  ? pick_next_task_fair+0x68b/0xc60
      [   62.947674]  ? run_rebalance_domains+0x260/0x260
      [   62.954471]  ? __list_add_valid+0x29/0xa0
      [   62.960607]  ? move_linked_works+0x1c7/0x230
      [   62.967077]  ?
      [   62.976248]  ? mutex_lock+0xa6/0x100
      [   62.982029]  ? __mutex_lock_slowpath+0x10/0x10
      [   62.988795]  ? __switch_to+0x37a/0x710
      [   62.994731]  worker_thread+0x62e/0x9d0
      [   63.000602]  ? max_active_store+0xf0/0xf0
      [   63.006828]  ? __switch_to_asm+0x40/0x70
      [   63.012932]  ? __switch_to_asm+0x34/0x70
      [   63.019013]  ? __switch_to_asm+0x40/0x70
      [   63.025042]  ? __switch_to_asm+0x34/0x70
      [   63.031030]  ? __switch_to_asm+0x40/0x70
      [   63.037006]  ? __schedule+0x396/0xdc0
      [   63.042660]  ? kmem_cache_alloc_trace+0xf3/0x1f0
      [   63.049323]  ? kthread+0x59/0x1d0
      [   63.054594]  ? ret_from_fork+0x35/0x40
      [   63.060257]  ? __sched_text_start+0x8/0x8
      [   63.066212]  ? schedule+0xcf/0x250
      [   63.071529]  ? __wake_up_common+0x110/0x350
      [   63.077794]  ? __schedule+0xdc0/0xdc0
      [   63.083348]  ? wait_woken+0x130/0x130
      [   63.088963]  ? finish_task_switch+0x1f1/0x520
      [   63.095258]  ? kasan_unpoison_shadow+0x30/0x40
      [   63.101792]  ? __init_waitqueue_head+0xa0/0xd0
      [   63.108183]  ? replenish_dl_entity.cold.60+0x18/0x18
      [   63.115151]  ? _raw_spin_lock_irqsave+0x25/0x50
      [   63.121754]  ? max_active_store+0xf0/0xf0
      [   63.127753]  kthread+0x1ae/0x1d0
      [   63.132894]  ? kthread_bind+0x30/0x30
      [   63.138422]  ret_from_fork+0x35/0x40
      [   63.146973] Allocated by task 14:
      [   63.152077]  kasan_kmalloc+0xbf/0xe0
      [   63.157471]  __kmalloc+0x110/0x240
      [   63.162804]  init_cntrs+0x34d/0xdf0 [hfi1]
      [   63.168883]  hfi1_init_dd+0x29a3/0x2f90 [hfi1]
      [   63.175244]  init_one+0x551/0xae0 [hfi1]
      [   63.181065]  local_pci_probe+0x70/0xd0
      [   63.186759]  work_for_cpu_fn+0x29/0x40
      [   63.192310]  process_one_work+0x584/0x960
      [   63.198163]  worker_thread+0x62e/0x9d0
      [   63.203843]  kthread+0x1ae/0x1d0
      [   63.208874]  ret_from_fork+0x35/0x40
      [   63.217203] Freed by task 1:
      [   63.221844]  __kasan_slab_free+0x12e/0x180
      [   63.227844]  kfree+0x92/0x1a0
      [   63.232570]  single_release+0x3a/0x60
      [   63.238024]  __fput+0x1d9/0x480
      [   63.242911]  task_work_run+0x139/0x190
      [   63.248440]  exit_to_usermode_loop+0x191/0x1a0
      [   63.254814]  do_syscall_64+0x301/0x330
      [   63.260283]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
      [   63.270199] The buggy address belongs to the object at
       which belongs to the cache kmalloc-4096 of size 4096
      [   63.287247] The buggy address is located 3632 bytes inside of
       4096-byte region [ffff88080e8d5500, ffff88080e8d6500)
      [   63.303564] The buggy address belongs to the page:
      [   63.310447] page:ffffea00203a3400 count:1 mapcount:0
      mapping:ffff88081380e840 index:0x0 compound_mapcount: 0
      [   63.323102] flags: 0x2fffff80008100(slab|head)
      [   63.329775] raw: 002fffff80008100 0000000000000000 0000000100000001
      [   63.340175] raw: 0000000000000000 0000000000070007 00000001ffffffff
      [   63.350564] page dumped because: kasan: bad access detected
      [   63.361974] Memory state around the buggy address:
      [   63.369137]  ffff88080e8d6200: 00 00 00 00 00 00 00 00 00 00 00 00 00
      00 00 00
      [   63.379082]  ffff88080e8d6280: 00 00 00 00 00 00 00 00 00 00 00 00 00
      00 00 00
      [   63.389032] >ffff88080e8d6300: 00 00 00 00 00 00 fc fc fc fc fc fc fc
      fc fc fc
      [   63.398944]                                      ^
      [   63.406141]  ffff88080e8d6380: fc fc fc fc fc fc fc fc fc fc fc fc fc
      fc fc fc
      [   63.416109]  ffff88080e8d6400: fc fc fc fc fc fc fc fc fc fc fc fc fc
      fc fc fc
      [   63.426099]
      The trace happens because get_hw_stats() assumes there is room in the
      memory allocated in init_cntrs() to accommodate the driver counters.
      Unfortunately, that routine only allocated space for the device
      Fix by insuring the allocation has room for the additional driver
      Cc: <Stable@vger.kernel.org> # v4.14+
      Fixes: b7481944
       ("IB/hfi1: Show statistics counters under IB stats interface")
      Reviewed-by: default avatarMike Marciniczyn <mike.marciniszyn@intel.com>
      Reviewed-by: default avatarMike Ruhl <michael.j.ruhl@intel.com>
      Signed-off-by: default avatarPiotr Stankiewicz <piotr.stankiewicz@intel.com>
      Signed-off-by: default avatarDennis Dalessandro <dennis.dalessandro@intel.com>
      Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    • Guenter Roeck's avatar
      staging: speakup: Replace strncpy with memcpy · 16906e5a
      Guenter Roeck authored
      commit fd29edc7
      gcc 8.1.0 generates the following warnings.
      drivers/staging/speakup/kobjects.c: In function 'punc_store':
      drivers/staging/speakup/kobjects.c:522:2: warning:
      	'strncpy' output truncated before terminating nul
      	copying as many bytes from a string as its length
      drivers/staging/speakup/kobjects.c:504:6: note: length computed here
      drivers/staging/speakup/kobjects.c: In function 'synth_store':
      drivers/staging/speakup/kobjects.c:391:2: warning:
      	'strncpy' output truncated before terminating nul
      	copying as many bytes from a string as its length
      drivers/staging/speakup/kobjects.c:388:8: note: length computed here
      Using strncpy() is indeed less than perfect since the length of data to
      be copied has already been determined with strlen(). Replace strncpy()
      with memcpy() to address the warning and optimize the code a little.
      Signed-off-by: default avatarGuenter Roeck <linux@roeck-us.net>
      Reviewed-by: default avatarSamuel Thibault <samuel.thibault@ens-lyon.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    • Lorenzo Pieralisi's avatar
      ACPI/IORT: Fix iort_get_platform_device_domain() uninitialized pointer value · 8e3f3c06
      Lorenzo Pieralisi authored
      [ Upstream commit ea2412dc ]
      Running the Clang static analyzer on IORT code detected the following
      Logic error: Branch condition evaluates to a garbage value
      If the named component associated with a given device has no IORT
      mappings, iort_get_platform_device_domain() exits its MSI mapping loop
      with msi_parent pointer containing garbage, which can lead to erroneous
      code path execution.
      Initialize the msi_parent pointer, fixing the bug.
      Fixes: d4f54a18
       ("ACPI: platform: setup MSI domain for ACPI based
      platform device")
      Reported-by: default avatarPatrick Bellasi <patrick.bellasi@arm.com>
      Reviewed-by: default avatarHanjun Guo <hanjun.guo@linaro.org>
      Acked-by: default avatarWill Deacon <will.deacon@arm.com>
      Cc: Sudeep Holla <sudeep.holla@arm.com>
      Cc: "Rafael J. Wysocki" <rjw@rjwysocki.net>
      Signed-off-by: default avatarLorenzo Pieralisi <lorenzo.pieralisi@arm.com>
      Signed-off-by: default avatarCatalin Marinas <catalin.marinas@arm.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
    • Sagi Grimberg's avatar
      nvme: flush namespace scanning work just before removing namespaces · 9407fd14
      Sagi Grimberg authored
      [ Upstream commit f6c8e432
      nvme_stop_ctrl can be called also for reset flow and there is no need to
      flush the scan_work as namespaces are not being removed. This can cause
      deadlock in rdma, fc and loop drivers since nvme_stop_ctrl barriers
      before controller teardown (and specifically I/O cancellation of the
      scan_work itself) takes place, but the scan_work will be blocked anyways
      so there is no need to flush it.
      Instead, move scan_work flush to nvme_remove_namespaces() where it really
      needs to flush.
      Reported-by: default avatarMing Lei <ming.lei@redhat.com>
      Signed-off-by: default avatarSagi Grimberg <sagi@grimberg.me>
      Reviewed-by: default avatarKeith Busch <keith.busch@intel.com>
      Reviewed by: James Smart <jsmart2021@gmail.com>
      Tested-by: default avatarEwan D. Milne <emilne@redhat.com>
      Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
    • Igor Druzhinin's avatar
      Revert "xen/balloon: Mark unallocated host memory as UNUSABLE" · b9c242b4
      Igor Druzhinin authored
      [ Upstream commit 12366410 ]
      This reverts commit b3cf8528.
      That commit unintentionally broke Xen balloon memory hotplug with
      "hotplug_unpopulated" set to 1. As long as "System RAM" resource
      got assigned under a new "Unusable memory" resource in IO/Mem tree
      any attempt to online this memory would fail due to general kernel
      restrictions on having "System RAM" resources as 1st level only.
      The original issue that commit has tried to workaround fa564ad9
      ("x86/PCI: Enable a 64bit BAR on AMD Family 15h (Models 00-1f, 30-3f,
      60-7f)") also got amended by the following 03a55173
       ("x86/PCI: Move
      and shrink AMD 64-bit window to avoid conflict") which made the
      original fix to Xen ballooning unnecessary.
      Signed-off-by: default avatarIgor Druzhinin <igor.druzhinin@citrix.com>
      Reviewed-by: default avatarBoris Ostrovsky <boris.ostrovsky@oracle.com>
      Signed-off-by: default avatarJuergen Gross <jgross@suse.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
    • Srikanth Boddepalli's avatar
      xen: xlate_mmu: add missing header to fix 'W=1' warning · f02e0d5f
      Srikanth Boddepalli authored
      [ Upstream commit 72791ac8
      Add a missing header otherwise compiler warns about missed prototype:
      drivers/xen/xlate_mmu.c:183:5: warning: no previous prototype for 'xen_xlate_unmap_gfn_range?' [-Wmissing-prototypes]
        int xen_xlate_unmap_gfn_range(struct vm_area_struct *vma,
      Signed-off-by: default avatarSrikanth Boddepalli <boddepalli.srikanth@gmail.com>
      Reviewed-by: default avatarBoris Ostrovsky <boris.ostrovsky@oracle.com>
      Reviewed-by: default avatarJoey Pabalinas <joeypabalinas@gmail.com>
      Signed-off-by: default avatarJuergen Gross <jgross@suse.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
    • Y.C. Chen's avatar
      drm/ast: fixed reading monitor EDID not stable issue · 6ee9b4de
      Y.C. Chen authored
      [ Upstream commit 30062562
      v1: over-sample data to increase the stability with some specific monitors
      v2: refine to avoid infinite loop
      v3: remove un-necessary "volatile" declaration
      [airlied: fix two checkpatch warnings]
      Signed-off-by: default avatarY.C. Chen <yc_chen@aspeedtech.com>
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/1542858988-1127-1-git-send-email-yc_chen@aspeedtech.com
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
    • shaoyunl's avatar
      drm/amdgpu: Add delay after enable RLC ucode · cc92ade5
      shaoyunl authored
      [ Upstream commit ad97d9de
      Driver shouldn't try to access any GFX registers until RLC is idle.
      During the test, it took 12 seconds for RLC to clear the BUSY bit
      in RLC_GPM_STAT register which is un-acceptable for driver.
      As per RLC engineer, it would take RLC Ucode less than 10,000 GFXCLK
      cycles to finish its critical section. In a lowest 300M enginer clock
      setting(default from vbios), 50 us delay is enough.
      This commit fix the hang when RLC introduce the work around for XGMI
      which requires more cycles to setup more registers than normal
      Signed-off-by: default avatarshaoyunl <shaoyun.liu@amd.com>
      Acked-by: default avatarFelix Kuehling <Felix.Kuehling@amd.com>
      Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
    • Pan Bian's avatar
      net: hisilicon: remove unexpected free_netdev · 8a69edb8
      Pan Bian authored
      [ Upstream commit c7589401
      The net device ndev is freed via free_netdev when failing to register
      the device. The control flow then jumps to the error handling code
      block. ndev is used and freed again. Resulting in a use-after-free bug.
      Signed-off-by: default avatarPan Bian <bianpan2016@163.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
    • Josh Elsasser's avatar
      ixgbe: recognize 1000BaseLX SFP modules as 1Gbps · 689dee4b
      Josh Elsasser authored
      [ Upstream commit a8bf879a ]
      Add the two 1000BaseLX enum values to the X550's check for 1Gbps modules,
      allowing the core driver code to establish a link over this SFP type.
      This is done by the out-of-tree driver but the fix wasn't in mainline.
      Fixes: e23f3336 ("ixgbe: Fix 1G and 10G link stability for X550EM_x SFP+”)
      Fixes: 6a14ee0c
       ("ixgbe: Add X550 support function pointers")
      Signed-off-by: default avatarJosh Elsasser <jelsasser@appneta.com>
      Tested-by: default avatarAndrew Bowers <andrewx.bowers@intel.com>
      Signed-off-by: default avatarJeff Kirsher <jeffrey.t.kirsher@intel.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
    • Yunjian Wang's avatar
      igb: fix uninitialized variables · 9966f78a
      Yunjian Wang authored
      [ Upstream commit e4c39f79
      This patch fixes the variable 'phy_word' may be used uninitialized.
      Signed-off-by: default avatarYunjian Wang <wangyunjian@huawei.com>
      Tested-by: default avatarAaron Brown <aaron.f.brown@intel.com>
      Signed-off-by: default avatarJeff Kirsher <jeffrey.t.kirsher@intel.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
    • Marek Szyprowski's avatar
      usb: gadget: u_ether: fix unsafe list iteration · b641ee14
      Marek Szyprowski authored
      [ Upstream commit c9287fa6 ]
      list_for_each_entry_safe() is not safe for deleting entries from the
      list if the spin lock, which protects it, is released and reacquired during
      the list iteration. Fix this issue by replacing this construction with
      a simple check if list is empty and removing the first entry in each
      iteration. This is almost equivalent to a revert of the commit mentioned in
      the Fixes: tag.
      This patch fixes following issue:
      Unable to handle kernel NULL pointer dereference at virtual address 00000104
      pgd = (ptrval)
      [00000104] *pgd=00000000
      Internal error: Oops: 817 [#1] PREEMPT SMP ARM
      Modules linked in:
      CPU: 1 PID: 84 Comm: kworker/1:1 Not tainted 4.20.0-rc2-next-20181114-00009-g8266b35ec404 #1061
      Hardware name: SAMSUNG EXYNOS (Flattened Device Tree)
      Workqueue: events eth_work
      PC is at rx_fill+0x60/0xac
      LR is at _raw_spin_lock_irqsave+0x50/0x5c
      pc : [<c065fee0>]    lr : [<c0a056b8>]    psr: 80000093
      sp : ee7fbee8  ip : 00000100  fp : 00000000
      r10: 006000c0  r9 : c10b0ab0  r8 : ee7eb5c0
      r7 : ee7eb614  r6 : ee7eb5ec  r5 : 000000dc  r4 : ee12ac00
      r3 : ee12ac24  r2 : 00000200  r1 : 60000013  r0 : ee7eb5ec
      Flags: Nzcv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment none
      Control: 10c5387d  Table: 6d5dc04a  DAC: 00000051
      Process kworker/1:1 (pid: 84, stack limit = 0x(ptrval))
      Stack: (0xee7fbee8 to 0xee7fc000)
      [<c065fee0>] (rx_fill) from [<c0143b7c>] (process_one_work+0x200/0x738)
      [<c0143b7c>] (process_one_work) from [<c0144118>] (worker_thread+0x2c/0x4c8)
      [<c0144118>] (worker_thread) from [<c014a8a4>] (kthread+0x128/0x164)
      [<c014a8a4>] (kthread) from [<c01010b4>] (ret_from_fork+0x14/0x20)
      Exception stack(0xee7fbfb0 to 0xee7fbff8)
      ---[ end trace 64480bc835eba7d6 ]---
      Fixes: fea14e68
       ("usb: gadget: u_ether: use better list accessors")
      Signed-off-by: default avatarMarek Szyprowski <m.szyprowski@samsung.com>
      Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
    • Lorenzo Bianconi's avatar
      net: thunderx: fix NULL pointer dereference in nic_remove · ff791c9e
      Lorenzo Bianconi authored
      [ Upstream commit 24a6d2dd ]
      Fix a possible NULL pointer dereference in nic_remove routine
      removing the nicpf module if nic_probe fails.
      The issue can be triggered with the following reproducer:
      $rmmod nicvf
      $rmmod nicpf
      [  521.412008] Unable to handle kernel access to user memory outside uaccess routines at virtual address 0000000000000014
      [  521.422777] Mem abort info:
      [  521.425561]   ESR = 0x96000004
      [  521.428624]   Exception class = DABT (current EL), IL = 32 bits
      [  521.434535]   SET = 0, FnV = 0
      [  521.437579]   EA = 0, S1PTW = 0
      [  521.440730] Data abort info:
      [  521.443603]   ISV = 0, ISS = 0x00000004
      [  521.447431]   CM = 0, WnR = 0
      [  521.450417] user pgtable: 4k pages, 48-bit VAs, pgdp = 0000000072a3da42
      [  521.457022] [0000000000000014] pgd=0000000000000000
      [  521.461916] Internal error: Oops: 96000004 [#1] SMP
      [  521.511801] Hardware name: GIGABYTE H270-T70/MT70-HD0, BIOS T49 02/02/2018
      [  521.518664] pstate: 80400005 (Nzcv daif +PAN -UAO)
      [  521.523451] pc : nic_remove+0x24/0x88 [nicpf]
      [  521.527808] lr : pci_device_remove+0x48/0xd8
      [  521.532066] sp : ffff000013433cc0
      [  521.535370] x29: ffff000013433cc0 x28: ffff810f6ac50000
      [  521.540672] x27: 0000000000000000 x26: 0000000000000000
      [  521.545974] x25: 0000000056000000 x24: 0000000000000015
      [  521.551274] x23: ffff8007ff89a110 x22: ffff000001667070
      [  521.556576] x21: ffff8007ffb170b0 x20: ffff8007ffb17000
      [  521.561877] x19: 0000000000000000 x18: 0000000000000025
      [  521.567178] x17: 0000000000000000 x16: 000000000000010ffc33ff98 x8 : 0000000000000000
      [  521.593683] x7 : 0000000000000000 x6 : 0000000000000001
      [  521.598983] x5 : 0000000000000002 x4 : 0000000000000003
      [  521.604284] x3 : ffff8007ffb17184 x2 : ffff8007ffb17184
      [  521.609585] x1 : ffff000001662118 x0 : ffff000008557be0
      [  521.614887] Process rmmod (pid: 1897, stack limit = 0x00000000859535c3)
      [  521.621490] Call trace:
      [  521.623928]  nic_remove+0x24/0x88 [nicpf]
      [  521.627927]  pci_device_remove+0x48/0xd8
      [  521.631847]  device_release_driver_internal+0x1b0/0x248
      [  521.637062]  driver_detach+0x50/0xc0
      [  521.640628]  bus_remove_driver+0x60/0x100
      [  521.644627]  driver_unregister+0x34/0x60
      [  521.648538]  pci_unregister_driver+0x24/0xd8
      [  521.652798]  nic_cleanup_module+0x14/0x111c [nicpf]
      [  521.657672]  __arm64_sys_delete_module+0x150/0x218
      [  521.662460]  el0_svc_handler+0x94/0x110
      [  521.666287]  el0_svc+0x8/0xc
      [  521.669160] Code: aa1e03e0 9102c295 d503201f f9404eb3 (b9401660)
      Fixes: 4863dea3
       ("net: Adding support for Cavium ThunderX network controller")
      Signed-off-by: default avatarLorenzo Bianconi <lorenzo.bianconi@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
    • Artemy Kovalyov's avatar
      IB/mlx5: Fix page fault handling for MW · 8f859b27
      Artemy Kovalyov authored
      [ Upstream commit 75b7b86b ]
      Memory windows are implemented with an indirect MKey, when a page fault
      event comes for a MW Mkey we need to find the MR at the end of the list of
      the indirect MKeys by iterating on all items from the first to the last.
      The offset calculated during this process has to be zeroed after the first
      iteration or the next iteration will start from a wrong address, resulting
      incorrect ODP faulting behavior.
      Fixes: db570d7d
       ("IB/mlx5: Add ODP support to MW")
      Signed-off-by: default avatarArtemy Kovalyov <artemyko@mellanox.com>
      Signed-off-by: default avatarMoni Shoua <monis@mellanox.com>
      Signed-off-by: default avatarLeon Romanovsky <leonro@mellanox.com>
      Signed-off-by: default avatarJason Gunthorpe <jgg@mellanox.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
    • Christian Hewitt's avatar
      drm/meson: add support for 1080p25 mode · f47b8824
      Christian Hewitt authored
      [ Upstream commit 31e1ab49 ]
      This essential mode for PAL users is missing, so add it.
      Fixes: 335e3713
       ("drm/meson: Add support for HDMI venc modes and settings")
      Signed-off-by: default avatarChristian Hewitt <christianshewitt@gmail.com>
      Acked-by: Neil Armstrong's avatarNeil Armstrong <narmstrong@baylibre.com>
      Signed-off-by: Neil Armstrong's avatarNeil Armstrong <narmstrong@baylibre.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/1542793169-13008-1-git-send-email-christianshewitt@gmail.com
      Signed-off-by: default avatarSean Paul <seanpaul@chromium.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
    • Aaro Koskinen's avatar
      USB: omap_udc: fix rejection of out transfers when DMA is used · ca993dea
      Aaro Koskinen authored
      [ Upstream commit 069caf59 ]
      Commit 387f869d ("usb: gadget: u_ether: conditionally align
      transfer size") started aligning transfer size only if requested,
      breaking omap_udc DMA mode. Set quirk_ep_out_aligned_size to restore
      the old behaviour.
      Fixes: 387f869d
       ("usb: gadget: u_ether: conditionally align transfer size")
      Signed-off-by: default avatarAaro Koskinen <aaro.koskinen@iki.fi>
      Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
    • Aaro Koskinen's avatar
      USB: omap_udc: fix USB gadget functionality on Palm Tungsten E · 72c982a3
      Aaro Koskinen authored
      [ Upstream commit 2c2322fb
      On Palm TE nothing happens when you try to use gadget drivers and plug
      the USB cable. Fix by adding the board to the vbus sense quirk list.
      Signed-off-by: default avatarAaro Koskinen <aaro.koskinen@iki.fi>
      Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
    • Aaro Koskinen's avatar
      USB: omap_udc: fix omap_udc_start() on 15xx machines · e68f6cb9
      Aaro Koskinen authored
      [ Upstream commit 6ca6695f
      On OMAP 15xx machines there are no transceivers, and omap_udc_start()
      always fails as it forgot to adjust the default return value.
      Signed-off-by: default avatarAaro Koskinen <aaro.koskinen@iki.fi>
      Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
    • Aaro Koskinen's avatar
      USB: omap_udc: fix crashes on probe error and module removal · 09eb2b90
      Aaro Koskinen authored
      [ Upstream commit 99f70036
      We currently crash if usb_add_gadget_udc_release() fails, since the
      udc->done is not initialized until in the remove function.
      Furthermore, on module removal the udc data is accessed although
      the release function is already triggered by usb_del_gadget_udc()
      early in the function.
      Fix by rewriting the release and remove functions, basically moving
      all the cleanup into the release function, and doing the completion
      only in the module removal case.
      The patch fixes omap_udc module probe with a failing gadged, and also
      allows the removal of omap_udc. Tested by running "modprobe omap_udc;
      modprobe -r omap_udc" in a loop.
      Signed-off-by: default avatarAaro Koskinen <aaro.koskinen@iki.fi>
      Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
    • Aaro Koskinen's avatar
      USB: omap_udc: use devm_request_irq() · 11f8633c
      Aaro Koskinen authored
      [ Upstream commit 286afdde
      The current code fails to release the third irq on the error path
      (observed by reading the code), and we get also multiple WARNs with
      failing gadget drivers due to duplicate IRQ releases. Fix by using
      Signed-off-by: default avatarAaro Koskinen <aaro.koskinen@iki.fi>
      Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
    • Kamal Heib's avatar
      RDMA/rdmavt: Fix rvt_create_ah function signature · a625d3e3
      Kamal Heib authored
      [ Upstream commit 4f32fb92 ]
      rdmavt uses a crazy system that looses the type checking when assinging
      functions to struct ib_device function pointers. Because of this the
      signature to this function was not changed when the below commit revised
      Fix the signature so we are not calling a function pointer with a
      mismatched signature.
      Fixes: 477864c8
       ("IB/core: Let create_ah return extended response to user")
      Signed-off-by: default avatarKamal Heib <kamalheib1@gmail.com>
      Reviewed-by: default avatarDennis Dalessandro <dennis.dalessandro@intel.com>
      Signed-off-by: default avatarJason Gunthorpe <jgg@mellanox.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
    • Majd Dibbiny's avatar
      RDMA/mlx5: Fix fence type for IB_WR_LOCAL_INV WR · 9692eefb
      Majd Dibbiny authored
      [ Upstream commit 074fca3a ]
      Currently, for IB_WR_LOCAL_INV WR, when the next fence is None, the
      current fence will be SMALL instead of Normal Fence.
      Without this patch krping doesn't work on CX-5 devices and throws
      following error:
      The error messages are from CX5 driver are: (from server side)
      [ 710.434014] mlx5_0:dump_cqe:278:(pid 2712): dump error cqe
      [ 710.434016] 00000000 00000000 00000000 00000000
      [ 710.434016] 00000000 00000000 00000000 00000000
      [ 710.434017] 00000000 00000000 00000000 00000000
      [ 710.434018] 00000000 93003204 100000b8 000524d2
      [ 710.434019] krping: cq completion failed with wr_id 0 status 4 opcode 128 vender_err 32
      Fixed the logic to set the correct fence type.
      Fixes: 6e8484c5
       ("RDMA/mlx5: set UMR wqe fence according to HCA cap")
      Signed-off-by: default avatarMajd Dibbiny <majd@mellanox.com>
      Signed-off-by: default avatarLeon Romanovsky <leonro@mellanox.com>
      Signed-off-by: default avatarJason Gunthorpe <jgg@mellanox.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
    • Trent Piepho's avatar
      PCI: imx6: Fix link training status detection in link up check · 7d14117b
      Trent Piepho authored
      [ Upstream commit 68bc10bf ]
      This bug was introduced in the interaction for two commits on either
      branch of the merge commit 562df5c8 ("Merge branch
      'pci/host-designware' into next").
      Commit 4d107d3b ("PCI: imx6: Move link up check into
      imx6_pcie_wait_for_link()"), changed imx6_pcie_wait_for_link() to poll
      the link status register directly, checking for link up and not
      training, and made imx6_pcie_link_up() only check the link up bit (once,
      not a polling loop).
      While commit 886bc5ce ("PCI: designware: Add generic
      dw_pcie_wait_for_link()"), replaced the loop in
      imx6_pcie_wait_for_link() with a call to a new dwc core function, which
      polled imx6_pcie_link_up(), which still checked both link up and not
      training in a loop.
      When these two commits were merged, the version of
      imx6_pcie_wait_for_link() from 886bc5ce was kept, which eliminated
      the link training check placed there by 4d107d3b. However, the
      version of imx6_pcie_link_up() from 4d107d3b was kept, which
      eliminated the link training check that had been there and was moved to
      The result was the link training check got lost for the imx6 driver.
      Eliminate imx6_pcie_link_up() so that the default handler,
      dw_pcie_link_up(), is used instead. The default handler has the correct
      code, which checks for link up and also that it still is not training,
      fixing the regression.
      Fixes: 562df5c8
       ("Merge branch 'pci/host-designware' into next")
      Signed-off-by: default avatarTrent Piepho <tpiepho@impinj.com>
      [lorenzo.pieralisi@arm.com: rewrote the commit log]
      Signed-off-by: default avatarLorenzo Pieralisi <lorenzo.pieralisi@arm.com>
      Reviewed-by: default avatarLucas Stach <l.stach@pengutronix.de>
      Cc: Bjorn Helgaas <bhelgaas@google.com>
      Cc: Joao Pinto <Joao.Pinto@synopsys.com>
      Cc: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
      Cc: Richard Zhu <hongxing.zhu@nxp.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
    • Huacai Chen's avatar
      hwmon: (w83795) temp4_type has writable permission · ca0bcef7
      Huacai Chen authored
      [ Upstream commit 09aaf681
      Both datasheet and comments of store_temp_mode() tell us that temp1~4_type
      is writable, so fix it.
      Signed-off-by: default avatarYao Wang <wangyao@lemote.com>
      Signed-off-by: default avatarHuacai Chen <chenhc@lemote.com>
      Fixes: 39deb699
       (" hwmon: (w83795) Simplify temperature sensor type handling")
      Signed-off-by: default avatarGuenter Roeck <linux@roeck-us.net>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
    • Hans de Goede's avatar
      iio/hid-sensors: Fix IIO_CHAN_INFO_RAW returning wrong values for signed numbers · aa17c9c0
      Hans de Goede authored
      [ Upstream commit 0145b505
      Before this commit sensor_hub_input_attr_get_raw_value() failed to take
      the signedness of 16 and 8 bit values into account, returning e.g.
      65436 instead of -100 for the z-axis reading of an accelerometer.
      This commit adds a new is_signed parameter to the function and makes all
      callers pass the appropriate value for this.
      While at it, this commit also fixes up some neighboring lines where
      statements were needlessly split over 2 lines to improve readability.
      Signed-off-by: default avatarHans de Goede <hdegoede@redhat.com>
      Acked-by: default avatarSrinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
      Acked-by: default avatarBenjamin Tissoires <benjamin.tissoires@redhat.com>
      Cc: <Stable@vger.kernel.org>
      Signed-off-by: default avatarJonathan Cameron <Jonathan.Cameron@huawei.com>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
    • Nicolin Chen's avatar
      hwmon: (ina2xx) Fix current value calculation · fd2c1ba1
      Nicolin Chen authored
      [ Upstream commit 38cd989e ]
      The current register (04h) has a sign bit at MSB. The comments
      for this calculation also mention that it's a signed register.
      However, the regval is unsigned type so result of calculation
      turns out to be an incorrect value when current is negative.
      This patch simply fixes this by adding a casting to s16.
      Fixes: 5d389b12
       ("hwmon: (ina2xx) Make calibration register value fixed")
      Signed-off-by: default avatarNicolin Chen <nicoleotsuka@gmail.com>
      Signed-off-by: default avatarGuenter Roeck <linux@roeck-us.net>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
    • Nicolin Chen's avatar
      hwmon (ina2xx) Fix NULL id pointer in probe() · de2324a0
      Nicolin Chen authored
      [ Upstream commit 70df9ebb ]
      When using DT configurations, the id pointer might turn out to
      be NULL. Then the driver encounters NULL pointer access:
        Unable to handle kernel read from unreadable memory at vaddr 00000018
        PC is at ina2xx_probe+0x114/0x200
        LR is at ina2xx_probe+0x10c/0x200
        Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b
      The reason is that i2c core returns the id pointer by matching
      id_table with client->name, while the client->name is actually
      using the name from the first string in the DT compatible list,
      not the best one. So i2c core would fail to match the id_table
      if the best matched compatible string isn't the first one, and
      then would return a NULL id pointer.
      This probably should be fixed in i2c core. But it doesn't hurt
      to make the driver robust. So this patch fixes it by using the
      "chip" that's added to unify both DT and non-DT configurations.
      Additionally, since id pointer could be null, so as id->name:
        ina2xx 10-0047: power monitor (null) (Rshunt = 1000 uOhm)
        ina2xx 10-0048: power monitor (null) (Rshunt = 10000 uOhm)
      So this patch also fixes NULL name pointer, using client->name
      to play safe and to align with hwmon->name.
      Fixes: bd0ddd4d
       ("hwmon: (ina2xx) Add OF device ID table")
      Signed-off-by: default avatarNicolin Chen <nicoleotsuka@gmail.com>
      Signed-off-by: default avatarGuenter Roeck <linux@roeck-us.net>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
    • Christophe JAILLET's avatar
      staging: rtl8723bs: Fix the return value in case of error in 'rtw_wx_read32()' · f55ad8d2
      Christophe JAILLET authored
      [ Upstream commit c3e43d8b ]
      We return 0 unconditionally in 'rtw_wx_read32()'.
      However, 'ret' is set to some error codes in several error handling paths.
      Return 'ret' instead to propagate the error code.
      Fixes: 554c0a3a
       ("staging: Add rtl8723bs sdio wifi driver")
      Signed-off-by: default avatarChristophe JAILLET <christophe.jaillet@wanadoo.fr>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
    • Jason Wang's avatar
      virtio-net: keep vnet header zeroed after processing XDP · 520e8609
      Jason Wang authored
      [ Upstream commit 436c9453 ]
      We copy vnet header unconditionally in page_to_skb() this is wrong
      since XDP may modify the packet data. So let's keep a zeroed vnet
      header for not confusing the conversion between vnet header and skb
      In the future, we should able to detect whether or not the packet was
      modified and keep using the vnet header when packet was not touched.
      Fixes: f600b690
       ("virtio_net: Add XDP support")
      Reported-by: default avatarPavel Popa <pashinho1990@gmail.com>
      Signed-off-by: default avatarJason Wang <jasowang@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    • Nicolas Dichtel's avatar
      tun: forbid iface creation with rtnl ops · 1d2cda4e
      Nicolas Dichtel authored
      [ Upstream commit 35b827b6 ]
      It's not supported right now (the goal of the initial patch was to support
      'ip link del' only).
      Before the patch:
      $ ip link add foo type tun
      [  239.632660] BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
      [  239.636410] RIP: 0010:register_netdevice+0x8e/0x3a0
      This panic occurs because dev->netdev_ops is not set by tun_setup(). But to
      have something usable, it will require more than just setting
      Fixes: f019a7a5
       ("tun: Implement ip link del tunXXX")
      CC: Eric W. Biederman <ebiederm@xmission.com>
      Signed-off-by: default avatarNicolas Dichtel <nicolas.dichtel@6wind.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    • Heiner Kallweit's avatar
      net: phy: don't allow __set_phy_supported to add unsupported modes · e44c8cbd
      Heiner Kallweit authored
      [ Upstream commit d2a36971 ]
      Currently __set_phy_supported allows to add modes w/o checking whether
      the PHY supports them. This is wrong, it should never add modes but
      only remove modes we don't want to support.
      The commit marked as fixed didn't do anything wrong, it just copied
      existing functionality to the helper which is being fixed now.
      Fixes: f3a6bd39
       ("phylib: Add phy_set_max_speed helper")
      Signed-off-by: default avatarHeiner Kallweit <hkallweit1@gmail.com>
      Reviewed-by: default avatarAndrew Lunn <andrew@lunn.ch>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    • Eran Ben Elisha's avatar
      net/mlx4_en: Change min MTU size to ETH_MIN_MTU · 583e170c
      Eran Ben Elisha authored
      [ Upstream commit 24be19e4 ]
      NIC driver minimal MTU size shall be set to ETH_MIN_MTU, as defined in
      the RFC791 and in the network stack. Remove old mlx4_en only define for
      it, which was set to wrong value.
      Fixes: b80f71f5
       ("ethernet/mellanox: use core min/max MTU checking")
      Signed-off-by: default avatarEran Ben Elisha <eranbe@mellanox.com>
      Signed-off-by: default avatarTariq Toukan <tariqt@mellanox.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    • Tarick Bedeir's avatar
      net/mlx4_core: Correctly set PFC param if global pause is turned off. · 76f67ede
      Tarick Bedeir authored
      [ Upstream commit bd5122cd ]
      rx_ppp and tx_ppp can be set between 0 and 255, so don't clamp to 1.
      Fixes: 6e8814ce
       ("net/mlx4_en: Fix mixed PFC and Global pause user control requests")
      Signed-off-by: default avatarTarick Bedeir <tarick@google.com>
      Reviewed-by: default avatarEran Ben Elisha <eranbe@mellanox.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    • Su Yanjun's avatar
      net: 8139cp: fix a BUG triggered by changing mtu with network traffic · 4c65c73c
      Su Yanjun authored
      [ Upstream commit a5d4a892 ]
      When changing mtu many times with traffic, a bug is triggered:
      [ 1035.684037] kernel BUG at lib/dynamic_queue_limits.c:26!
      [ 1035.684042] invalid opcode: 0000 [#1] SMP
      [ 1035.684049] Modules linked in: loop binfmt_misc 8139cp(OE) macsec
      tcp_diag udp_diag inet_diag unix_diag af_packet_diag netlink_diag tcp_lp
      fuse uinput xt_CHECKSUM iptable_mangle ipt_MASQUERADE
      nf_nat_masquerade_ipv4 iptable_nat nf_nat_ipv4 nf_nat nf_conntrack_ipv4
      nf_defrag_ipv4 xt_conntrack nf_conntrack ipt_REJECT nf_reject_ipv4 tun
      bridge stp llc ebtable_filter ebtables ip6table_filter devlink
      ip6_tables iptable_filter sunrpc snd_hda_codec_generic snd_hda_intel
      snd_hda_codec snd_hda_core snd_hwdep ppdev snd_seq iosf_mbi crc32_pclmul
      parport_pc snd_seq_device ghash_clmulni_intel parport snd_pcm
      aesni_intel joydev lrw snd_timer virtio_balloon sg gf128mul glue_helper
      ablk_helper cryptd snd soundcore i2c_piix4 pcspkr ip_tables xfs
      libcrc32c sr_mod sd_mod cdrom crc_t10dif crct10dif_generic ata_generic
      [ 1035.684102]  pata_acpi virtio_console qxl drm_kms_helper syscopyarea
      sysfillrect sysimgblt floppy fb_sys_fops crct10dif_pclmul
      crct10dif_common ttm crc32c_intel serio_raw ata_piix drm libata 8139too
      virtio_pci drm_panel_orientation_quirks virtio_ring virtio mii dm_mirror
      dm_region_hash dm_log dm_mod [last unloaded: 8139cp]
      [ 1035.684132] CPU: 9 PID: 25140 Comm: if-mtu-change Kdump: loaded
      Tainted: G           OE  ------------ T 3.10.0-957.el7.x86_64 #1
      [ 1035.684134] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
      [ 1035.684136] task: ffff8f59b1f5a080 ti: ffff8f5a2e32c000 task.ti:
      [ 1035.684149] RIP: 0010:[<ffffffffba3a40d0>]  [<ffffffffba3a40d0>]
      [ 1035.684162] RSP: 0000:ffff8f5a75483e50  EFLAGS: 00010093
      [ 1035.684162] RAX: 00000000000000c2 RBX: ffff8f5a6f91c000 RCX:
      [ 1035.684162] RDX: 0000000000000000 RSI: 0000000000000184 RDI:
      [ 1035.684162] RBP: ffff8f5a75483ea8 R08: 00000000000000c2 R09:
      [ 1035.684162] R10: 00000000000616ef R11: ffff8f5a75483b56 R12:
      [ 1035.684162] R13: 0000000000000001 R14: 0000000000000000 R15:
      [ 1035.684162] FS:  00007fa8434de740(0000) GS:ffff8f5a75480000(0000)
      [ 1035.684162] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [ 1035.684162] CR2: 00000000004305d0 CR3: 000000024eb66000 CR4:
      [ 1035.684162] Call Trace:
      [ 1035.684162]  <IRQ>
      [ 1035.684162]  [<ffffffffc08cbaf8>] ? cp_interrupt+0x478/0x580 [8139cp]
      [ 1035.684162]  [<ffffffffba14a294>]
      [ 1035.684162]  [<ffffffffba14a442>] handle_irq_event_percpu+0x32/0x80
      [ 1035.684162]  [<ffffffffba14a4cc>] handle_irq_event+0x3c/0x60
      [ 1035.684162]  [<ffffffffba14db29>] handle_fasteoi_irq+0x59/0x110
      [ 1035.684162]  [<ffffffffba02e554>] handle_irq+0xe4/0x1a0
      [ 1035.684162]  [<ffffffffba7795dd>] do_IRQ+0x4d/0xf0
      [ 1035.684162]  [<ffffffffba76b362>] common_interrupt+0x162/0x162
      [ 1035.684162]  <EOI>
      [ 1035.684162]  [<ffffffffba0c2ae4>] ? __wake_up_bit+0x24/0x70
      [ 1035.684162]  [<ffffffffba1e46f5>] ? do_set_pte+0xd5/0x120
      [ 1035.684162]  [<ffffffffba1b64fb>] unlock_page+0x2b/0x30
      [ 1035.684162]  [<ffffffffba1e4879>] do_read_fault.isra.61+0x139/0x1b0
      [ 1035.684162]  [<ffffffffba1e9134>] handle_pte_fault+0x2f4/0xd10
      [ 1035.684162]  [<ffffffffba1ebc6d>] handle_mm_fault+0x39d/0x9b0
      [ 1035.684162]  [<ffffffffba76f5e3>] __do_page_fault+0x203/0x500
      [ 1035.684162]  [<ffffffffba76f9c6>] trace_do_page_fault+0x56/0x150
      [ 1035.684162]  [<ffffffffba76ef42>] do_async_page_fault+0x22/0xf0
      [ 1035.684162]  [<ffffffffba76b788>] async_page_fault+0x28/0x30
      [ 1035.684162] Code: 54 c7 47 54 ff ff ff ff 44 0f 49 ce 48 8b 35 48 2f
      9c 00 48 89 77 58 e9 fe fe ff ff 0f 1f 80 00 00 00 00 41 89 d1 e9 ef fe
      ff ff <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 55 8d 42 ff 48
      [ 1035.684162] RIP  [<ffffffffba3a40d0>] dql_completed+0x180/0x190
      [ 1035.684162]  RSP <ffff8f5a75483e50>
      It's not the same as in 7fe0ee09
       patch described.
      As 8139cp uses shared irq mode, other device irq will trigger
      cp_interrupt to execute.
       -> cp_close
       -> cp_open
      In cp_close routine  just before free_irq(), some interrupt may occur.
      In my environment, cp_interrupt exectutes and IntrStatus is 0x4,
      exactly TxOk. That will cause cp_tx to wake device queue.
      As device queue is started, cp_start_xmit and cp_open will run at same
      time which will cause kernel BUG.
      For example:
      [#] for tx descriptor
      At start:
      After cp_init_hw->cp_start_hw->netdev_reset_queue:
      When 8139cp starts to work then cp_tx will check
      num_queued mismatchs the complete_bytes.
      The patch will check IntrMask before check IntrStatus in cp_interrupt.
      When 8139cp interrupt is disabled, just return.
      Signed-off-by: default avatarSu Yanjun <suyj.fnst@cn.fujitsu.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
  3. 13 Dec, 2018 2 commits