summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2019-11-18x86: Remove unused asm/rio.hThomas Gleixner
The removed calgary IOMMU driver was the only user of this header file. Reported-by: Jon Mason <jdmason@kudzu.us> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Cc: Christoph Hellwig <hch@lst.de>
2019-11-18NFSv4.2 fix memory leak in nfs42_ssc_openOlga Kornievskaia
Static analysis with Coverity detected a memory leak Reported-by: Colin King <colin.king@canonical.com> Fixes: ec4b09250898 ("NFS: inter ssc open") Signed-off-by: Olga Kornievskaia <kolga@netapp.com> Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
2019-11-18NFSv4.2 fix kfree in __nfs42_copy_file_rangeOlga Kornievskaia
This is triggering problems with static analysis with Coverity Reported-by: Colin King <colin.king@netapp.com> Signed-off-by: Olga Kornievskaia <kolga@netapp.com> Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
2019-11-18NFS: remove duplicated include from nfs4file.cYueHaibing
Remove duplicated include. Signed-off-by: YueHaibing <yuehaibing@huawei.com> Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
2019-11-18NFSv4: Make _nfs42_proc_copy_notify() staticYueHaibing
Fix sparse warning: fs/nfs/nfs42proc.c:527:5: warning: symbol '_nfs42_proc_copy_notify' was not declared. Should it be static? Reported-by: Hulk Robot <hulkci@huawei.com> Signed-off-by: YueHaibing <yuehaibing@huawei.com> Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
2019-11-18NFS: Fallocate should use the nfs4_fattr_bitmapAnna Schumaker
Changing a sparse file could have an effect not only on the file size, but also on the number of blocks used by the file in the underlying filesystem. The server's cache_consistency_bitmap doesn't update the SPACE_USED attribute, so let's switch to the nfs4_fattr_bitmap to catch this update whenever we do an ALLOCATE or DEALLOCATE. This patch fixes xfstests generic/568, which tests that fallocating an unaligned range allocates all blocks touched by that range. Without this patch, `stat` reports 0 bytes used immediately after the fallocate. Adding a `sleep 5` to the test also catches the update, but it's better to do so when we know something has changed. Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com> Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
2019-11-18NFS: Return -ETXTBSY when attempting to write to a swapfileAnna Schumaker
My understanding is that -EBUSY refers to the underlying device, and that -ETXTBSY is used when attempting to access a file in use by the kernel (like a swapfile). Changing this return code helps us pass xfstests generic/569 Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com> Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
2019-11-18usb: chipidea: imx: pinctrl for HSIC is optionalPeter Chen
For imx chipidea controllers, if they use mxs PHY, they need pinctrl for HSIC. Otherwise, it doesn't need pinctrl and usbmisc control. Like imx7d and imx8mm. Reported-by: André Draszik <git@andred.net> Signed-off-by: Peter Chen <peter.chen@nxp.com>
2019-11-18fs: nfs: sysfs: Remove NULL check before kfreeSaurav Girepunje
Remove NULL check before kfree, NULL check is taken care on kfree. Signed-off-by: Saurav Girepunje <saurav.girepunje@gmail.com> Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
2019-11-18NFS: remove unneeded semicolonYueHaibing
remove unneeded semicolon. Signed-off-by: YueHaibing <yuehaibing@huawei.com> Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
2019-11-18NFSv4: add declaration of current_stateidBen Dooks
The current_stateid is exported from nfs4state.c but not declared in any of the headers. Add to nfs4_fs.h to remove the following warning: fs/nfs/nfs4state.c:80:20: warning: symbol 'current_stateid' was not declared. Should it be static? Signed-off-by: Ben Dooks <ben.dooks@codethink.co.uk> Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
2019-11-18HID: rmi: Check that the RMI_STARTED bit is set before unregistering the RMI ↵Andrew Duggan
transport device In the event that the RMI device is unreachable, the calls to rmi_set_mode() or rmi_set_page() will fail before registering the RMI transport device. When the device is removed, rmi_remove() will call rmi_unregister_transport_device() which will attempt to access the rmi_dev pointer which was not set. This patch adds a check of the RMI_STARTED bit before calling rmi_unregister_transport_device(). The RMI_STARTED bit is only set after rmi_register_transport_device() completes successfully. The kernel oops was reported in this message: https://www.spinics.net/lists/linux-input/msg58433.html [jkosina@suse.cz: reworded changelog as agreed with Andrew] Signed-off-by: Andrew Duggan <aduggan@synaptics.com> Reported-by: Federico Cerutti <federico@ceres-c.it> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2019-11-18m68k/atari: Convert Falcon IDE drivers to platform driversMichael Schmitz
Autoloading of Falcon IDE driver modules requires converting these drivers to platform drivers. Add platform device for Falcon IDE interface in Atari platform setup code. Use this in the pata_falcon driver in place of the simple platform device set up on the fly. Convert falconide driver to use the same platform device that is used by pata_falcon also. (With the introduction of a platform device for the Atari Falcon IDE interface, the old Falcon IDE driver no longer loads (resource already claimed by the platform device)). Tested (as built-in driver) on my Atari Falcon. Signed-off-by: Michael Schmitz <schmitzmic@gmail.com> Acked-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com> Link: https://lore.kernel.org/r/1573008449-8226-1-git-send-email-schmitzmic@gmail.com Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
2019-11-18HID: quirks: remove hid-led devices from hid_have_special_driverHeiner Kallweit
Since e04a0442d33b ("HID: core: remove the absolute need of hid_have_special_driver[]") it's no longer needed to list these LED devices in hid_have_special_driver[]. This allows libraries needing access to the hidraw device to work properly. Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com> Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
2019-11-18mmc: core: Fix size overflow for mmc partitionsBradley Bolen
With large eMMC cards, it is possible to create general purpose partitions that are bigger than 4GB. The size member of the mmc_part struct is only an unsigned int which overflows for gp partitions larger than 4GB. Change this to a u64 to handle the overflow. Signed-off-by: Bradley Bolen <bradleybolen@gmail.com> Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2019-11-18mmc: tmio: Add MMC_CAP_ERASE to allow erase/discard/trim requestsEugeniu Rosca
Isolated initially to renesas_sdhi_internal_dmac [1], Ulf suggested adding MMC_CAP_ERASE to the TMIO mmc core: On Fri, Nov 15, 2019 at 10:27:25AM +0100, Ulf Hansson wrote: -- snip -- This test and due to the discussions with Wolfram and you in this thread, I would actually suggest that you enable MMC_CAP_ERASE for all tmio variants, rather than just for this particular one. In other words, set the cap in tmio_mmc_host_probe() should be fine, as it seems none of the tmio variants supports HW busy detection at this point. -- snip -- Testing on R-Car H3ULCB-KF doesn't reveal any issues (v5.4-rc7): root@rcar-gen3:~# lsblk NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT mmcblk0 179:0 0 59.2G 0 disk <--- eMMC mmcblk0boot0 179:8 0 4M 1 disk mmcblk0boot1 179:16 0 4M 1 disk mmcblk1 179:24 0 30G 0 disk <--- SD card root@rcar-gen3:~# time blkdiscard /dev/mmcblk0 real 0m8.659s user 0m0.001s sys 0m1.920s root@rcar-gen3:~# time blkdiscard /dev/mmcblk1 real 0m1.176s user 0m0.001s sys 0m0.124s [1] https://lore.kernel.org/linux-renesas-soc/20191112134808.23546-1-erosca@de.adit-jv.com/ Cc: Wolfram Sang <wsa+renesas@sang-engineering.com> Cc: Masahiro Yamada <yamada.masahiro@socionext.com> Cc: Andrew Gabbasov <andrew_gabbasov@mentor.com> Originally-by: Harish Jenny K N <harish_kandiga@mentor.com> Suggested-by: Ulf Hansson <ulf.hansson@linaro.org> Signed-off-by: Eugeniu Rosca <erosca@de.adit-jv.com> Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2019-11-18x86: Fix typos in commentsCao jin
BIOSen -> BIOSes; paing -> paging. Append to 640 its proper unit "Kb". encomapssing -> encompassing. [ bp: Merge into a single patch, fix one more typo, massage. ] Signed-off-by: Cao jin <caoj.fnst@cn.fujitsu.com> Signed-off-by: Borislav Petkov <bp@suse.de> Cc: "H. Peter Anvin" <hpa@zytor.com> Cc: Baoquan He <bhe@redhat.com> Cc: Dave Young <dyoung@redhat.com> Cc: David Howells <dhowells@redhat.com> Cc: Ingo Molnar <mingo@redhat.com> Cc: Juergen Gross <jgross@suse.com> Cc: Robert Richter <rrichter@marvell.com> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Thomas Lendacky <Thomas.Lendacky@amd.com> Cc: x86-ml <x86@kernel.org> Link: https://lkml.kernel.org/r/20191118070012.27850-1-caoj.fnst@cn.fujitsu.com
2019-11-18HID: Improve Windows Precision Touchpad detection.Blaž Hrastnik
Per Microsoft spec, usage 0xC5 (page 0xFF) returns a blob containing data used to verify the touchpad as a Windows Precision Touchpad. 0x85, REPORTID_PTPHQA, // REPORT_ID (PTPHQA) 0x09, 0xC5, // USAGE (Vendor Usage 0xC5) 0x15, 0x00, // LOGICAL_MINIMUM (0) 0x26, 0xff, 0x00, // LOGICAL_MAXIMUM (0xff) 0x75, 0x08, // REPORT_SIZE (8) 0x96, 0x00, 0x01, // REPORT_COUNT (0x100 (256)) 0xb1, 0x02, // FEATURE (Data,Var,Abs) However, some devices, namely Microsoft's Surface line of products instead implement a "segmented device certification report" (usage 0xC6) which returns the same report, but in smaller chunks. 0x06, 0x00, 0xff, // USAGE_PAGE (Vendor Defined) 0x85, REPORTID_PTPHQA, // REPORT_ID (PTPHQA) 0x09, 0xC6, // USAGE (Vendor usage for segment #) 0x25, 0x08, // LOGICAL_MAXIMUM (8) 0x75, 0x08, // REPORT_SIZE (8) 0x95, 0x01, // REPORT_COUNT (1) 0xb1, 0x02, // FEATURE (Data,Var,Abs) 0x09, 0xC7, // USAGE (Vendor Usage) 0x26, 0xff, 0x00, // LOGICAL_MAXIMUM (0xff) 0x95, 0x20, // REPORT_COUNT (32) 0xb1, 0x02, // FEATURE (Data,Var,Abs) By expanding Win8 touchpad detection to also look for the segmented report, all Surface touchpads are now properly recognized by hid-multitouch. Signed-off-by: Blaž Hrastnik <blaz@mxxn.io> Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
2019-11-18usb: chipidea: imx: refine the error handling for hsicPeter Chen
- -EPROBE_DEFER is an error, but without need show error message - If pintrol is not existed, as pintrol is NULL Signed-off-by: Peter Chen <peter.chen@nxp.com>
2019-11-18usb: chipidea: imx: change hsic power regulator as optionalPeter Chen
Not every platform needs this regulator. Signed-off-by: Peter Chen <peter.chen@nxp.com>
2019-11-18usb: chipidea: imx: check data->usbmisc_data against NULL before accessLi Jun
As usbmisc_data is optional, so add the check before access its member, this fix below static checker warning: drivers/usb/chipidea/ci_hdrc_imx.c:438 ci_hdrc_imx_probe() warn: 'data->usbmisc_data' can also be NULL which is introduced by Patch 15b80f7c3a7f: "usb: chipidea: imx: enable vbus and id wakeup only for OTG events" Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Li Jun <jun.li@nxp.com> Signed-off-by: Peter Chen <peter.chen@nxp.com>
2019-11-18usb: chipidea: core: change vbus-regulator as optionalPeter Chen
Vbus regualtor is an optional regulator, for platforms, which doesn't have this regulator, it will get a dummy regulator and show warning message. Signed-off-by: Peter Chen <peter.chen@nxp.com>
2019-11-18usb: chipidea: imx: enable vbus and id wakeup only for OTG eventsLi Jun
If ID or VBUS is from external block, don't enable its wakeup because it isn't used at all. Signed-off-by: Li Jun <jun.li@nxp.com> Signed-off-by: Peter Chen <peter.chen@nxp.com>
2019-11-18usb: chipidea: udc: protect usb interrupt enableJun Li
We hit the problem with below sequence: - ci_udc_vbus_session() update vbus_active flag and ci->driver is valid, - before calling the ci_hdrc_gadget_connect(), usb_gadget_udc_stop() is called by application remove gadget driver, - ci_udc_vbus_session() will contine do ci_hdrc_gadget_connect() as gadget_ready is 1, so udc interrupt is enabled, but ci->driver is NULL. - USB connection irq generated but ci->driver is NULL. As udc irq only should be enabled when gadget driver is binded, so add spinlock to protect the usb irq enable for vbus session handling. Signed-off-by: Jun Li <jun.li@nxp.com> Signed-off-by: Peter Chen <peter.chen@nxp.com>
2019-11-18usb: chipidea: udc: add new API ci_hdrc_gadget_connectPeter Chen
This API is used enable device function, it is called at below situations: - VBUS is connected during boots up - Hot plug occurs during runtime Signed-off-by: Peter Chen <peter.chen@nxp.com> Signed-off-by: Jun Li <jun.li@nxp.com>
2019-11-18selftests/clone3: skip if clone3() is ENOSYSChristian Brauner
If the clone3() syscall is not implemented we should skip the tests. Fixes: 41585bbeeef9 ("selftests: add tests for clone3() with *set_tid") Fixes: 17a810699c18 ("selftests: add tests for clone3()") Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2019-11-18selftests/clone3: check that all pids are released on error pathsAndrei Vagin
This is a regression test case for an issue when pids have not been released on error paths. Signed-off-by: Andrei Vagin <avagin@gmail.com> Link: https://lore.kernel.org/r/20191118064750.408003-3-avagin@gmail.com Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2019-11-18selftests/clone3: report a correct number of failsAndrei Vagin
In clone3_set_tid, a few test cases are running in a child process. And right now, if one of these test cases fails, the whole test will exit with the success status. Fixes: 41585bbeeef9 ("selftests: add tests for clone3() with *set_tid") Signed-off-by: Andrei Vagin <avagin@gmail.com> Link: https://lore.kernel.org/r/20191118064750.408003-2-avagin@gmail.com Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2019-11-18selftests/clone3: flush stdout and stderr before clone3() and _exit()Andrei Vagin
Buffers have to be flushed before clone3() to avoid double messages in the log. Fixes: 41585bbeeef9 ("selftests: add tests for clone3() with *set_tid") Signed-off-by: Andrei Vagin <avagin@gmail.com> Link: https://lore.kernel.org/r/20191118064750.408003-1-avagin@gmail.com Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2019-11-18Merge tag 'usb-for-v5.5' of ↵Greg Kroah-Hartman
git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-next Felipe writes: USB: changes for v5.5 We have TI's glue layer for the Cadence USB3 controller going upstream. Tegra's XUDC driver is also going upstream with this pull request. Apart from these two big features, we have a bunch of patches switching over to devm_platform_ioremap_resource() in order to simplify code a little; and a non-critical fix for DWC3 usage via kexec. * tag 'usb-for-v5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb: (44 commits) usb: dwc3: of-simple: add a shutdown usb: cdns3: Add TI specific wrapper driver dt-bindings: usb: Add binding for the TI wrapper for Cadence USB3 controller usb: mtu3: fix race condition about delayed_status usb: gadget: Add UDC driver for tegra XUSB device mode controller usb: dwc3: debug: Remove newline printout usb: dwc2: use a longer core rest timeout in dwc2_core_reset() usb: gadget: udc: lpc32xx: Use devm_platform_ioremap_resource() in lpc32xx_udc_probe() USB: gadget: udc: clean up an indentation issue usb: gadget: Quieten gadget config message phy: renesas: rcar-gen3-usb2: Use platform_get_irq_optional() for optional irq usb: gadget: Remove set but not used variable 'opts' in msg_do_config usb: gadget: Remove set but not used variable 'opts' in acm_ms_do_config usb: mtu3: add a new function to do status stage usb: gadget: configfs: fix concurrent issue between composite APIs usb: gadget: f_tcm: Provide support to get alternate setting in tcm function usb: gadget: Correct NULL pointer checking in fsl gadget usb: fsl: Remove unused variable USB: dummy-hcd: use usb_urb_dir_in instead of usb_pipein USB: dummy-hcd: increase max number of devices to 32 ...
2019-11-17riscv: provide a flat image loaderChristoph Hellwig
This allows just loading the kernel at a pre-set address without qemu going bonkers trying to map the ELF file. Contains a contribution from Aurabindo Jayamohanan to reuse the PAGE_OFFSET definition. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Anup Patel <anup@brainfault.org> [paul.walmsley@sifive.com: fixed checkpatch issue; minor commit message fix] Signed-off-by: Paul Walmsley <paul.walmsley@sifive.com>
2019-11-17riscv: add nommu supportChristoph Hellwig
The kernel runs in M-mode without using page tables, and thus can't run bare metal without help from additional firmware. Most of the patch is just stubbing out code not needed without page tables, but there is an interesting detail in the signals implementation: - The normal RISC-V syscall ABI only implements rt_sigreturn as VDSO entry point, but the ELF VDSO is not supported for nommu Linux. We instead copy the code to call the syscall onto the stack. In addition to enabling the nommu code a new defconfig for a small kernel image that can run in nommu mode on qemu is also provided, to run a kernel in qemu you can use the following command line: qemu-system-riscv64 -smp 2 -m 64 -machine virt -nographic \ -kernel arch/riscv/boot/loader \ -drive file=rootfs.ext2,format=raw,id=hd0 \ -device virtio-blk-device,drive=hd0 Contains contributions from Damien Le Moal <Damien.LeMoal@wdc.com>. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Anup Patel <anup@brainfault.org> [paul.walmsley@sifive.com: updated to apply; add CONFIG_MMU guards around PCI_IOBASE definition to fix build issues; fixed checkpatch issues; move the PCI_IO_* and VMEMMAP address space macros along with the others; resolve sparse warning] Signed-off-by: Paul Walmsley <paul.walmsley@sifive.com>
2019-11-17riscv: clear the instruction cache and all registers when bootingChristoph Hellwig
When we get booted we want a clear slate without any leaks from previous supervisors or the firmware. Flush the instruction cache and then clear all registers to known good values. This is really important for the upcoming nommu support that runs on M-mode, but can't really harm when running in S-mode either. Vaguely based on the concepts from opensbi. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Anup Patel <anup@brainfault.org> Signed-off-by: Paul Walmsley <paul.walmsley@sifive.com>
2019-11-17riscv: read the hart ID from mhartid on bootDamien Le Moal
When in M-Mode, we can use the mhartid CSR to get the ID of the running HART. Doing so, direct M-Mode boot without firmware is possible. Signed-off-by: Damien Le Moal <damien.lemoal@wdc.com> Reviewed-by: Anup Patel <anup@brainfault.org> Reviewed-by: Atish Patra <atish.patra@wdc.com> Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Paul Walmsley <paul.walmsley@sifive.com>
2019-11-17riscv: provide native clint access for M-modeChristoph Hellwig
RISC-V has the concept of a cpu level interrupt controller. The interface for it is split between a standardized part that is exposed as bits in the mstatus/sstatus register and the mie/mip/sie/sip CRS. But the bit to actually trigger IPIs is not standardized and just mentioned as implementable using MMIO. Add support for IPIs using MMIO using the SiFive clint layout (which is also shared by Ariane, Kendryte and the Qemu virt platform). Additionally the MMIO block also supports the time value and timer compare registers, so they are also set up using the same OF node. Support for other layouts should also be relatively easy to add in the future. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Anup Patel <anup@brainfault.org> [paul.walmsley@sifive.com: update include guard format; fix checkpatch issues; minor commit message cleanup] Signed-off-by: Paul Walmsley <paul.walmsley@sifive.com>
2019-11-17Linux 5.4-rc8v5.4-rc8Linus Torvalds
2019-11-17ubi: Fix producing anchor PEBsSascha Hauer
When a new fastmap is about to be written UBI must make sure it has a free block for a fastmap anchor available. For this ubi_update_fastmap() calls ubi_ensure_anchor_pebs(). This stopped working with 2e8f08deabbc ("ubi: Fix races around ubi_refill_pools()"), with this commit the wear leveling code is blocked and can no longer produce free PEBs. UBI then more often than not falls back to write the new fastmap anchor to the same block it was already on which means the same erase block gets erased during each fastmap write and wears out quite fast. As the locking prevents us from producing the anchor PEB when we actually need it, this patch changes the strategy for creating the anchor PEB. We no longer create it on demand right before we want to write a fastmap, but instead we create an anchor PEB right after we have written a fastmap. This gives us enough time to produce a new anchor PEB before it is needed. To make sure we have an anchor PEB for the very first fastmap write we call ubi_ensure_anchor_pebs() during initialisation as well. Fixes: 2e8f08deabbc ("ubi: Fix races around ubi_refill_pools()") Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de> Signed-off-by: Richard Weinberger <richard@nod.at>
2019-11-17rtc: tps65910: allow using RTC without alarm interruptAndrey Skvortsov
If tps65910 INT1 pin (IRQ output) is not wired to any IRQ controller, then it can't be used as system wakeup/alarm source, but it is still possible to read/write time from/to RTC. Signed-off-by: Andrey Skvortsov <andrej.skvortzov@gmail.com> Link: https://lore.kernel.org/r/20191116203748.27166-1-andrej.skvortzov@gmail.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2019-11-17ubifs: ubifs_tnc_start_commit: Fix OOB in layout_in_gapsZhihao Cheng
Running stress-test test_2 in mtd-utils on ubi device, sometimes we can get following oops message: BUG: unable to handle page fault for address: ffffffff00000140 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 280a067 P4D 280a067 PUD 0 Oops: 0000 [#1] SMP CPU: 0 PID: 60 Comm: kworker/u16:1 Kdump: loaded Not tainted 5.2.0 #13 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0 -0-ga698c8995f-prebuilt.qemu.org 04/01/2014 Workqueue: writeback wb_workfn (flush-ubifs_0_0) RIP: 0010:rb_next_postorder+0x2e/0xb0 Code: 80 db 03 01 48 85 ff 0f 84 97 00 00 00 48 8b 17 48 83 05 bc 80 db 03 01 48 83 e2 fc 0f 84 82 00 00 00 48 83 05 b2 80 db 03 01 <48> 3b 7a 10 48 89 d0 74 02 f3 c3 48 8b 52 08 48 83 05 a3 80 db 03 RSP: 0018:ffffc90000887758 EFLAGS: 00010202 RAX: ffff888129ae4700 RBX: ffff888138b08400 RCX: 0000000080800001 RDX: ffffffff00000130 RSI: 0000000080800024 RDI: ffff888138b08400 RBP: ffff888138b08400 R08: ffffea0004a6b920 R09: 0000000000000000 R10: ffffc90000887740 R11: 0000000000000001 R12: ffff888128d48000 R13: 0000000000000800 R14: 000000000000011e R15: 00000000000007c8 FS: 0000000000000000(0000) GS:ffff88813ba00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffff00000140 CR3: 000000013789d000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: destroy_old_idx+0x5d/0xa0 [ubifs] ubifs_tnc_start_commit+0x4fe/0x1380 [ubifs] do_commit+0x3eb/0x830 [ubifs] ubifs_run_commit+0xdc/0x1c0 [ubifs] Above Oops are due to the slab-out-of-bounds happened in do-while of function layout_in_gaps indirectly called by ubifs_tnc_start_commit. In function layout_in_gaps, there is a do-while loop placing index nodes into the gaps created by obsolete index nodes in non-empty index LEBs until rest index nodes can totally be placed into pre-allocated empty LEBs. @c->gap_lebs points to a memory area(integer array) which records LEB numbers used by 'in-the-gaps' method. Whenever a fitable index LEB is found, corresponding lnum will be incrementally written into the memory area pointed by @c->gap_lebs. The size ((@c->lst.idx_lebs + 1) * sizeof(int)) of memory area is allocated before do-while loop and can not be changed in the loop. But @c->lst.idx_lebs could be increased by function ubifs_change_lp (called by layout_leb_in_gaps->ubifs_find_dirty_idx_leb->get_idx_gc_leb) during the loop. So, sometimes oob happens when number of cycles in do-while loop exceeds the original value of @c->lst.idx_lebs. See detail in https://bugzilla.kernel.org/show_bug.cgi?id=204229. This patch fixes oob in layout_in_gaps. Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com> Signed-off-by: Richard Weinberger <richard@nod.at>
2019-11-17ubifs: do_kill_orphans: Fix a memory leak bugZhihao Cheng
If there are more than one valid snod on the sleb->nodes list, do_kill_orphans will malloc ino more than once without releasing previous ino's memory. Finally, it will trigger memory leak. Fixes: ee1438ce5dc4 ("ubifs: Check link count of inodes when...") Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com> Signed-off-by: zhangyi (F) <yi.zhang@huawei.com> Signed-off-by: Richard Weinberger <richard@nod.at>
2019-11-17Revert "ubifs: Fix memory leak bug in alloc_ubifs_info() error path"Richard Weinberger
This reverts commit 9163e0184bd7d5f779934d34581843f699ad2ffd. At the point when ubifs_fill_super() runs, we have already a reference to the super block. So upon deactivate_locked_super() c will get free()'ed via ->kill_sb(). Cc: Wenwen Wang <wenwen@cs.uga.edu> Fixes: 9163e0184bd7 ("ubifs: Fix memory leak bug in alloc_ubifs_info() error path") Reported-by: https://twitter.com/grsecurity/status/1180609139359277056 Signed-off-by: Richard Weinberger <richard@nod.at> Tested-by: Romain Izard <romain.izard.pro@gmail.com> Signed-off-by: Richard Weinberger <richard@nod.at>
2019-11-17ubifs: Fix type of sup->hash_algoBen Dooks (Codethink)
The sup->hash_algo is a __le16, and whilst 0xffff is the same in __le16 and u16, it would be better to use cpu_to_le16() anyway (which should deal with constants) and silence the following sparse warning: fs/ubifs/sb.c:187:32: warning: incorrect type in assignment (different base types) fs/ubifs/sb.c:187:32: expected restricted __le16 [usertype] hash_algo fs/ubifs/sb.c:187:32: got int Signed-off-by: Ben Dooks <ben.dooks@codethink.co.uk> Signed-off-by: Richard Weinberger <richard@nod.at>
2019-11-17ubifs: Fixed missed le64_to_cpu() in journalBen Dooks (Codethink)
In the ubifs_jnl_write_inode() functon, it calls ubifs_iget() with xent->inum. The xent->inum is __le64, but the ubifs_iget() takes native cpu endian. I think that this should be changed to passing le64_to_cpu(xent->inum) to fix the following sparse warning: fs/ubifs/journal.c:902:58: warning: incorrect type in argument 2 (different base types) fs/ubifs/journal.c:902:58: expected unsigned long inum fs/ubifs/journal.c:902:58: got restricted __le64 [usertype] inum Fixes: 7959cf3a7506 ("ubifs: journal: Handle xattrs like files") Signed-off-by: Ben Dooks <ben.dooks@codethink.co.uk> Signed-off-by: Richard Weinberger <richard@nod.at>
2019-11-17ubifs: Force prandom result to __le32Ben Dooks (Codethink)
In set_dent_cookie() the result of prandom_u32() is assinged to an __le32 type. Make this a forced conversion to remove the following sparse warning: fs/ubifs/journal.c:506:30: warning: incorrect type in assignment (different base types) fs/ubifs/journal.c:506:30: expected restricted __le32 [usertype] cookie fs/ubifs/journal.c:506:30: got unsigned int Signed-off-by: Ben Dooks <ben.dooks@codethink.co.uk> Signed-off-by: Richard Weinberger <richard@nod.at>
2019-11-17ubifs: Remove obsolete TODO from dfs_file_write()Richard Weinberger
AFAICT this kind of problems are no longer possible since debugfs gained file removal protection via e9117a5a4bf6 ("debugfs: implement per-file removal protection"). Cc: Christoph Hellwig <hch@lst.de> Cc: Nicolai Stange <nicstange@gmail.com> Signed-off-by: Richard Weinberger <richard@nod.at>
2019-11-17ubi: Fix warning static is not at beginning of declarationRishi Gupta
Compiler generates following warning when kernel is built with W=1: drivers/mtd/ubi/ubi.h:971:1: warning: ‘static’ is not at beginning of declaration [-Wold-style-declaration] This commit fixes this by correctly ordering keywords. Signed-off-by: Rishi Gupta <gupt21@gmail.com> Signed-off-by: Richard Weinberger <richard@nod.at>
2019-11-17ubi: Print skip_check in ubi_dump_vol_info()Stefan Roese
It might be interesting, if "skip_check" is set or not, so lets print this flag in ubi_dump_vol_info() as well. Signed-off-by: Stefan Roese <sr@denx.de> Cc: Richard Weinberger <richard@nod.at> Cc: Boris Brezillon <boris.brezillon@collabora.com> Cc: Heiko Schocher <hs@denx.de> Signed-off-by: Richard Weinberger <richard@nod.at>
2019-11-17Merge tag 'iommu-fixes-v5.4-rc7' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu Pull iommu fixes from Joerg Roedel: - Fix for Intel IOMMU to correct invalidation commands when in SVA mode. - Update MAINTAINERS entry for Intel IOMMU * tag 'iommu-fixes-v5.4-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: iommu/vt-d: Fix QI_DEV_IOTLB_PFSID and QI_DEV_EIOTLB_PFSID macros MAINTAINERS: Update for INTEL IOMMU (VT-d) entry
2019-11-17net/mlx4_en: fix mlx4 ethtool -N insertionLuigi Rizzo
ethtool expects ETHTOOL_GRXCLSRLALL to set ethtool_rxnfc->data with the total number of entries in the rx classifier table. Surprisingly, mlx4 is missing this part (in principle ethtool could still move forward and try the insert). Tested: compiled and run command: phh13:~# ethtool -N eth1 flow-type udp4 queue 4 Added rule with ID 255 Signed-off-by: Luigi Rizzo <lrizzo@google.com> Reviewed-by: Tariq Toukan <tariqt@mellanox.com>
2019-11-17Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpfDavid S. Miller
Daniel Borkmann says: ==================== pull-request: bpf 2019-11-15 The following pull-request contains BPF updates for your *net* tree. We've added 1 non-merge commits during the last 9 day(s) which contain a total of 1 file changed, 3 insertions(+), 1 deletion(-). The main changes are: 1) Fix a missing unlock of bpf_devs_lock in bpf_offload_dev_create()'s error path, from Dan. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
generated by cgit (git 2.34.1) at 2025-10-01 01:10:07 +0000