Commit graph

997838 commits

Author SHA1 Message Date
Matthew Wilcox (Oracle)
df59d0a461 XArray: Add xa_limit_16b
A 16-bit limit is a more common limit than I had realised.  Make it
generally available.

Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
2021-03-30 13:42:33 -04:00
Matthew Wilcox (Oracle)
3012110d71 XArray: Fix splitting to non-zero orders
Splitting an order-4 entry into order-2 entries would leave the array
containing pointers to 000040008000c000 instead of 000044448888cccc.
This is a one-character fix, but enhance the test suite to check this
case.

Reported-by: Zi Yan <ziy@nvidia.com>
Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
2021-03-30 13:42:33 -04:00
Matthew Wilcox (Oracle)
12efebab09 XArray: Fix split documentation
I wrote the documentation backwards; the new order of the entry is stored
in the xas and the caller passes the old entry.

Reported-by: Zi Yan <ziy@nvidia.com>
Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
2021-03-30 13:42:33 -04:00
Thierry Reding
a31500fe70 drm/tegra: dc: Restore coupling of display controllers
Coupling of display controllers used to rely on runtime PM to take the
companion controller out of reset. Commit fd67e9c6ed ("drm/tegra: Do
not implement runtime PM") accidentally broke this when runtime PM was
removed.

Restore this functionality by reusing the hierarchical host1x client
suspend/resume infrastructure that's similar to runtime PM and which
perfectly fits this use-case.

Fixes: fd67e9c6ed ("drm/tegra: Do not implement runtime PM")
Reported-by: Dmitry Osipenko <digetx@gmail.com>
Reported-by: Paul Fertser <fercerpav@gmail.com>
Tested-by: Dmitry Osipenko <digetx@gmail.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
2021-03-30 19:40:43 +02:00
Mikko Perttunen
a24f98176d gpu: host1x: Use different lock classes for each client
To avoid false lockdep warnings, give each client lock a different
lock class, passed from the initialization site by macro.

Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
2021-03-30 19:37:20 +02:00
Dmitry Osipenko
f8fb97c915 drm/tegra: dc: Don't set PLL clock to 0Hz
RGB output doesn't allow to change parent clock rate of the display and
PCLK rate is set to 0Hz in this case. The tegra_dc_commit_state() shall
not set the display clock to 0Hz since this change propagates to the
parent clock. The DISP clock is defined as a NODIV clock by the tegra-clk
driver and all NODIV clocks use the CLK_SET_RATE_PARENT flag.

This bug stayed unnoticed because by default PLLP is used as the parent
clock for the display controller and PLLP silently skips the erroneous 0Hz
rate changes because it always has active child clocks that don't permit
rate changes. The PLLP isn't acceptable for some devices that we want to
upstream (like Samsung Galaxy Tab and ASUS TF700T) due to a display panel
clock rate requirements that can't be fulfilled by using PLLP and then the
bug pops up in this case since parent clock is set to 0Hz, killing the
display output.

Don't touch DC clock if pclk=0 in order to fix the problem.

Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
2021-03-30 19:37:20 +02:00
Sean Christopherson
33a3164161 KVM: x86/mmu: Don't allow TDP MMU to yield when recovering NX pages
Prevent the TDP MMU from yielding when zapping a gfn range during NX
page recovery.  If a flush is pending from a previous invocation of the
zapping helper, either in the TDP MMU or the legacy MMU, but the TDP MMU
has not accumulated a flush for the current invocation, then yielding
will release mmu_lock with stale TLB entries.

That being said, this isn't technically a bug fix in the current code, as
the TDP MMU will never yield in this case.  tdp_mmu_iter_cond_resched()
will yield if and only if it has made forward progress, as defined by the
current gfn vs. the last yielded (or starting) gfn.  Because zapping a
single shadow page is guaranteed to (a) find that page and (b) step
sideways at the level of the shadow page, the TDP iter will break its loop
before getting a chance to yield.

But that is all very, very subtle, and will break at the slightest sneeze,
e.g. zapping while holding mmu_lock for read would break as the TDP MMU
wouldn't be guaranteed to see the present shadow page, and thus could step
sideways at a lower level.

Cc: Ben Gardon <bgardon@google.com>
Signed-off-by: Sean Christopherson <seanjc@google.com>
Message-Id: <20210325200119.1359384-4-seanjc@google.com>
[Add lockdep assertion. - Paolo]
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-03-30 13:19:56 -04:00
Sean Christopherson
048f49809c KVM: x86/mmu: Ensure TLBs are flushed for TDP MMU during NX zapping
Honor the "flush needed" return from kvm_tdp_mmu_zap_gfn_range(), which
does the flush itself if and only if it yields (which it will never do in
this particular scenario), and otherwise expects the caller to do the
flush.  If pages are zapped from the TDP MMU but not the legacy MMU, then
no flush will occur.

Fixes: 29cf0f5007 ("kvm: x86/mmu: NX largepage recovery for TDP MMU")
Cc: stable@vger.kernel.org
Cc: Ben Gardon <bgardon@google.com>
Signed-off-by: Sean Christopherson <seanjc@google.com>
Message-Id: <20210325200119.1359384-3-seanjc@google.com>
Reviewed-by: Ben Gardon <bgardon@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-03-30 13:19:55 -04:00
Sean Christopherson
a835429cda KVM: x86/mmu: Ensure TLBs are flushed when yielding during GFN range zap
When flushing a range of GFNs across multiple roots, ensure any pending
flush from a previous root is honored before yielding while walking the
tables of the current root.

Note, kvm_tdp_mmu_zap_gfn_range() now intentionally overwrites its local
"flush" with the result to avoid redundant flushes.  zap_gfn_range()
preserves and return the incoming "flush", unless of course the flush was
performed prior to yielding and no new flush was triggered.

Fixes: 1af4a96025 ("KVM: x86/mmu: Yield in TDU MMU iter even if no SPTES changed")
Cc: stable@vger.kernel.org
Reviewed-by: Ben Gardon <bgardon@google.com>
Signed-off-by: Sean Christopherson <seanjc@google.com>
Message-Id: <20210325200119.1359384-2-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-03-30 13:19:55 -04:00
Siddharth Chandrasekaran
6fb3084ab5 KVM: make: Fix out-of-source module builds
Building kvm module out-of-source with,

    make -C $SRC O=$BIN M=arch/x86/kvm

fails to find "irq.h" as the include dir passed to cflags-y does not
prefix the source dir. Fix this by prefixing $(srctree) to the include
dir path.

Signed-off-by: Siddharth Chandrasekaran <sidcha@amazon.de>
Message-Id: <20210324124347.18336-1-sidcha@amazon.de>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-03-30 13:07:10 -04:00
Vitaly Kuznetsov
f982fb62a3 selftests: kvm: make hardware_disable_test less verbose
hardware_disable_test produces 512 snippets like
...
 main: [511] waiting semaphore
 run_test: [511] start vcpus
 run_test: [511] all threads launched
 main: [511] waiting 368us
 main: [511] killing child

and this doesn't have much value, let's print this info with pr_debug().

Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Message-Id: <20210323104331.1354800-1-vkuznets@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-03-30 13:07:10 -04:00
Vitaly Kuznetsov
1973cadd4c KVM: x86/vPMU: Forbid writing to MSR_F15H_PERF MSRs when guest doesn't have X86_FEATURE_PERFCTR_CORE
MSR_F15H_PERF_CTL0-5, MSR_F15H_PERF_CTR0-5 MSRs are only available when
X86_FEATURE_PERFCTR_CORE CPUID bit was exposed to the guest. KVM, however,
allows these MSRs unconditionally because kvm_pmu_is_valid_msr() ->
amd_msr_idx_to_pmc() check always passes and because kvm_pmu_set_msr() ->
amd_pmu_set_msr() doesn't fail.

In case of a counter (CTRn), no big harm is done as we only increase
internal PMC's value but in case of an eventsel (CTLn), we go deep into
perf internals with a non-existing counter.

Note, kvm_get_msr_common() just returns '0' when these MSRs don't exist
and this also seems to contradict architectural behavior which is #GP
(I did check one old Opteron host) but changing this status quo is a bit
scarier.

Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Message-Id: <20210323084515.1346540-1-vkuznets@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-03-30 13:07:10 -04:00
Dongli Zhang
ecaf088f53 KVM: x86: remove unused declaration of kvm_write_tsc()
kvm_write_tsc() was renamed and made static since commit 0c899c25d7
("KVM: x86: do not attempt TSC synchronization on guest writes"). Remove
its unused declaration.

Signed-off-by: Dongli Zhang <dongli.zhang@oracle.com>
Message-Id: <20210326070334.12310-1-dongli.zhang@oracle.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-03-30 13:07:09 -04:00
Haiwei Li
d632826f26 KVM: clean up the unused argument
kvm_msr_ignored_check function never uses vcpu argument. Clean up the
function and invokers.

Signed-off-by: Haiwei Li <lihaiwei@tencent.com>
Message-Id: <20210313051032.4171-1-lihaiwei.kernel@gmail.com>
Reviewed-by: Keqian Zhu <zhukeqian1@huawei.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-03-30 13:07:09 -04:00
Stefan Raspl
75f94ecbd0 tools/kvm_stat: Add restart delay
If this service is enabled and the system rebooted, Systemd's initial
attempt to start this unit file may fail in case the kvm module is not
loaded. Since we did not specify a delay for the retries, Systemd
restarts with a minimum delay a number of times before giving up and
disabling the service. Which means a subsequent kvm module load will
have kvm running without monitoring.
Adding a delay to fix this.

Signed-off-by: Stefan Raspl <raspl@linux.ibm.com>
Message-Id: <20210325122949.1433271-1-raspl@linux.ibm.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-03-30 13:07:09 -04:00
Paolo Bonzini
41793e7f27 KVM/arm64 fixes for 5.12, take #3
- Fix GICv3 MMIO compatibility probing
 - Prevent guests from using the ARMv8.4 self-hosted tracing extension
 -----BEGIN PGP SIGNATURE-----
 
 iQJDBAABCgAtFiEEn9UcU+C1Yxj9lZw9I9DQutE9ekMFAmBcdKAPHG1hekBrZXJu
 ZWwub3JnAAoJECPQ0LrRPXpDdVQQAK4aAp1YARbireJu9Ef/PPG8pdd8upq5M8lF
 qvXgOz1hdd6Y3wg5a52dnWuc6iVjqbCeJ9r984ig8b2VOnqwur6RAWYHohZauo3z
 UKiM4jvOJYzcE/0MmOrkh3PnrCq8LeP4vE5HKy2FvnyKq60O3DuFjaeLtfW5/zYN
 c0BHNuZQdVlKCV8+oLs1/qpyEsby6DbcJYw0UBCHaY8n9PAuKc5cR204tNUxPv5G
 r/4GbT+1etWJtAYmI6tlCec+R3QNKW9BsHAj9GbzWbkzgs2EvsG2pD18hnDCadnf
 /+9EQ7FRWa/g9AxhbfWFwMh1B2/5aYVB3t9AoJk+ObvBFHdxcNdwkIaTB2HGR/VT
 OL8s1Q+Yj5nX4bSY7awcOa3vjLvBXX3W3TbB8jdMIV3yVRHNWYZkFGeuvb4qQ0xN
 QufWBw8IsEUtOnB3038SuJLhJBNfBnvQcsRNQpT7FstA9l5NRVxFGNxEjYTJmWYh
 0nrtmnEuXyvPtLk3c8dSMKCOGXyUgriZyHeql5qqHAno+mG9dB3VvCkd0oSxr6vA
 bWuIEyH/9f9Aj0VX1JOKUo+Bnx7bbzKVyfrQhFM2CkMJX/fkAHci2Xj0cncamNaq
 M8P+Y33QE18Ifcvkmp1t+WPx+KHTY8GUPuwtS8Awmt3jTKhFYVzp3Kc0O2PTssyU
 qbMcRaZd
 =SE7S
 -----END PGP SIGNATURE-----

Merge tag 'kvmarm-fixes-5.12-3' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD

KVM/arm64 fixes for 5.12, take #3

- Fix GICv3 MMIO compatibility probing
- Prevent guests from using the ARMv8.4 self-hosted tracing extension
2021-03-30 13:06:42 -04:00
Linus Torvalds
17860ccabf VFIO fixes for v5.12-rc6
- Fix pfnmap batch carryover (Daniel Jordan)
 
  - Fix nvlink Kconfig dependency (Jason Gunthorpe)
 -----BEGIN PGP SIGNATURE-----
 
 iQJPBAABCAA5FiEEQvbATlQL0amee4qQI5ubbjuwiyIFAmBjUtobHGFsZXgud2ls
 bGlhbXNvbkByZWRoYXQuY29tAAoJECObm247sIsiL1wP/ixbIvAu4U4kLnYIt0YN
 2Kb8V92yqe7SzBAp3xDDrq8LiHFwEePEbzFxQZioG/40QaqNUx+VmkjkHeVkNOCa
 a+bspmKg6PZuLHDvZO1/SbyeWibk+cRDK2nMWfP5LMrLyMucnd1QjdGACigDSZ/w
 plV84Z1i5WS/43gh3HxKe6TRdXWnHyEabePCnzxD7vkbnmqJySz008+LxG3g/lWL
 HroRAeRtuGQISVm+bJWNEywAk0KdDtZTuIc2EYW+0Hw4GiyfHSNicNIzV4Cg3Adv
 DpVn/WYpaMt12of7va3wHDkX1S29lm645OBvER4nOyzMsenmCdG59C9vddHb25Ni
 y1YqsbvIfPKyr/HNV/mdYy+DStE+Y1COMVljRwugSPdJO/Jl6Oi4c0z5FY6m9B1x
 62CmWTiiMRAA+TWHGu/O0XBcbf0tlsNIiTz5KMJ/HzqBa7TIjbGu1YWeAjKv/QuK
 TVyVZ+nuJbnnNGtwtDHGHWpDyaCdtwZIrbJar+dU9G4bj0Md8MmfIhELnEr8jeNY
 usZ2Ma5VyYKm6libgCQDuyATedyoHcAdRF/hxL3dJBP4csJiPCCCAhvCMrledNUD
 LPWQiUH3dJWqDHiVhikN8xTnroqofXg4csm7Gunv6+D7D3WaBzwjWzpFRxfkXVKB
 Ftv1qVODJ5OCEWfyIPAb08tA
 =JG2W
 -----END PGP SIGNATURE-----

Merge tag 'vfio-v5.12-rc6' of git://github.com/awilliam/linux-vfio

Pull VFIO fixes from Alex Williamson:

 - Fix pfnmap batch carryover (Daniel Jordan)

 - Fix nvlink Kconfig dependency (Jason Gunthorpe)

* tag 'vfio-v5.12-rc6' of git://github.com/awilliam/linux-vfio:
  vfio/nvlink: Add missing SPAPR_TCE_IOMMU depends
  vfio/type1: Empty batch for pfnmap pages
2021-03-30 09:49:36 -07:00
Ilya Lipnitskiy
e720e7d0e9 mm: fix race by making init_zero_pfn() early_initcall
There are code paths that rely on zero_pfn to be fully initialized
before core_initcall.  For example, wq_sysfs_init() is a core_initcall
function that eventually results in a call to kernel_execve, which
causes a page fault with a subsequent mmput.  If zero_pfn is not
initialized by then it may not get cleaned up properly and result in an
error:

  BUG: Bad rss-counter state mm:(ptrval) type:MM_ANONPAGES val:1

Here is an analysis of the race as seen on a MIPS device. On this
particular MT7621 device (Ubiquiti ER-X), zero_pfn is PFN 0 until
initialized, at which point it becomes PFN 5120:

  1. wq_sysfs_init calls into kobject_uevent_env at core_initcall:
       kobject_uevent_env+0x7e4/0x7ec
       kset_register+0x68/0x88
       bus_register+0xdc/0x34c
       subsys_virtual_register+0x34/0x78
       wq_sysfs_init+0x1c/0x4c
       do_one_initcall+0x50/0x1a8
       kernel_init_freeable+0x230/0x2c8
       kernel_init+0x10/0x100
       ret_from_kernel_thread+0x14/0x1c

  2. kobject_uevent_env() calls call_usermodehelper_exec() which executes
     kernel_execve asynchronously.

  3. Memory allocations in kernel_execve cause a page fault, bumping the
     MM reference counter:
       add_mm_counter_fast+0xb4/0xc0
       handle_mm_fault+0x6e4/0xea0
       __get_user_pages.part.78+0x190/0x37c
       __get_user_pages_remote+0x128/0x360
       get_arg_page+0x34/0xa0
       copy_string_kernel+0x194/0x2a4
       kernel_execve+0x11c/0x298
       call_usermodehelper_exec_async+0x114/0x194

  4. In case zero_pfn has not been initialized yet, zap_pte_range does
     not decrement the MM_ANONPAGES RSS counter and the BUG message is
     triggered shortly afterwards when __mmdrop checks the ref counters:
       __mmdrop+0x98/0x1d0
       free_bprm+0x44/0x118
       kernel_execve+0x160/0x1d8
       call_usermodehelper_exec_async+0x114/0x194
       ret_from_kernel_thread+0x14/0x1c

To avoid races such as described above, initialize init_zero_pfn at
early_initcall level.  Depending on the architecture, ZERO_PAGE is
either constant or gets initialized even earlier, at paging_init, so
there is no issue with initializing zero_pfn earlier.

Link: https://lkml.kernel.org/r/CALCv0x2YqOXEAy2Q=hafjhHCtTHVodChv1qpM=niAXOpqEbt7w@mail.gmail.com
Signed-off-by: Ilya Lipnitskiy <ilya.lipnitskiy@gmail.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: stable@vger.kernel.org
Tested-by: 周琰杰 (Zhou Yanjie) <zhouyanjie@wanyeetech.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2021-03-30 09:46:12 -07:00
Linus Torvalds
2bb25b3a74 - fixed compile error with option MIPS_ELF_APPENDED_DTB
-----BEGIN PGP SIGNATURE-----
 
 iQJOBAABCAA4FiEEbt46xwy6kEcDOXoUeZbBVTGwZHAFAmBjIDYaHHRzYm9nZW5k
 QGFscGhhLmZyYW5rZW4uZGUACgkQeZbBVTGwZHCSWA/+IRo6hEG3apdw1bVuR50Q
 5xOhPcMnm4fItk0N3HI5hkl/8mee2oy+6AnLCKKbhSJhtcf99HfWwJlfwlQrQQDu
 fnt0xTR31QvUJHKUZ4YYxrqOHDVN9JKoHCVmLzdrFDR1ixZA/Aa11n9wRj6Vpyqj
 OTS3CZaGnQj7YW575WySMzIxIpKl6gesbDjlL/Q3PG8/C5M0RPSFtlAsuIJWzdgv
 iBQGAJEo3oWfffn9Xbq3pho5U6DTaWjNWNs9oLfU7nVGE+OYIXDVz7pq6JtLr7dU
 EuZqxJV/km3QvNDierLLLA4WXBJuN9MI+HUhzd1J+YcWiAXXbu6NTSxr0VAGVIfs
 f5GaRIU6T6lnWTWhRpX/68gZ8Z58q1sr00xOqPvP2B6hH2NtDts4c+Da1CzB33VW
 vTe/ucn0/VwNNc5aaLLqwtsBdzfNA81TM6vQZbcXwBAC/rRqpv8PbFiAU1d4q2pA
 lFL9MOoT4sJmnxKeCdCa0vN+iyJfxCtdANahksp8BBYhn/g5uMQfM1b9dI/ctF4k
 3PAwjzwK7gwN4rnvHrWxF7Y8KuY9cclZB8U+KHSno9+NWN1FcgPaNlRR+NAd8seg
 EWGQcWj5xfTdD4PxzjyuqnxNCdmDnL+IUNspMIRlywv83+zBVtsqkJujKQVDT4Dl
 GuL/CnhQEnVcYZD+ISZmx8w=
 =fsy2
 -----END PGP SIGNATURE-----

Merge tag 'mips-fixes_5.12_3' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux

Pull MIPS fix from Thomas Bogendoerfer:

 - Fix compile error with option MIPS_ELF_APPENDED_DTB

* tag 'mips-fixes_5.12_3' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux:
  MIPS: kernel: setup.c: fix compilation error
2021-03-30 08:57:50 -07:00
Linus Torvalds
a080642d2f xen: branch for v5.12-rc6
-----BEGIN PGP SIGNATURE-----
 
 iHUEABYIAB0WIQRTLbB6QfY48x44uB6AXGG7T9hjvgUCYGMTVwAKCRCAXGG7T9hj
 vmytAQDc9YQ0mKZVslydrdqnJ2Qx8y5mlMvfPzCWDeyEFS+XrwEAntIECOB7L6ap
 W0JqqlfpOLRM4sE81X7ZkvJ357OFmAg=
 =may6
 -----END PGP SIGNATURE-----

Merge tag 'for-linus-5.12b-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip

Pull xen fix from Juergen Gross:
 "One Xen related security fix (XSA-371)"

* tag 'for-linus-5.12b-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
  xen-blkback: don't leak persistent grants from xen_blkbk_map()
2021-03-30 08:55:47 -07:00
Steven Rostedt (VMware)
59300b36f8 ftrace: Check if pages were allocated before calling free_pages()
It is possible that on error pg->size can be zero when getting its order,
which would return a -1 value. It is dangerous to pass in an order of -1
to free_pages(). Check if order is greater than or equal to zero before
calling free_pages().

Link: https://lore.kernel.org/lkml/20210330093916.432697c7@gandalf.local.home/

Reported-by: Abaci Robot <abaci@linux.alibaba.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
2021-03-30 09:58:38 -04:00
Mauri Sandberg
9ae31e2ab2 MIPS: kernel: setup.c: fix compilation error
With ath79_defconfig enabling CONFIG_MIPS_ELF_APPENDED_DTB gives a
compilation error. This patch fixes it.

Build log:
...
  CC      kernel/locking/percpu-rwsem.o
../arch/mips/kernel/setup.c:46:39: error: conflicting types for
'__appended_dtb'
 const char __section(".appended_dtb") __appended_dtb[0x100000];
                                       ^~~~~~~~~~~~~~
In file included from ../arch/mips/kernel/setup.c:34:
../arch/mips/include/asm/bootinfo.h:118:13: note: previous declaration
of '__appended_dtb' was here
 extern char __appended_dtb[];
             ^~~~~~~~~~~~~~
  CC      fs/attr.o
make[4]: *** [../scripts/Makefile.build:271: arch/mips/kernel/setup.o]
 Error 1
...

Root cause seems to be:
Fixes: b83ba0b9df ("MIPS: of: Introduce helper function to get DTB")

Signed-off-by: Mauri Sandberg <sandberg@mailfence.com>
Reviewed-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Cc: trivial@kernel.org
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
2021-03-30 14:51:23 +02:00
Jeremy Szu
417eadfdd9 ALSA: hda/realtek: fix mute/micmute LEDs for HP 640 G8
The HP EliteBook 640 G8 Notebook PC is using ALC236 codec which is
using 0x02 to control mute LED and 0x01 to control micmute LED.
Therefore, add a quirk to make it works.

Signed-off-by: Jeremy Szu <jeremy.szu@canonical.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210330114428.40490-1-jeremy.szu@canonical.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2021-03-30 13:49:41 +02:00
Takashi Iwai
66affb7bb0 ALSA: hda: Add missing sanity checks in PM prepare/complete callbacks
The recently added PM prepare and complete callbacks don't have the
sanity check whether the card instance has been properly initialized,
which may potentially lead to Oops.

This patch adds the azx_is_pm_ready() call in each place
appropriately like other PM callbacks.

Fixes: f5dac54d9d ("ALSA: hda: Separate runtime and system suspend")
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210329113059.25035-2-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2021-03-30 13:16:42 +02:00
Takashi Iwai
c8f79808cd ALSA: hda: Re-add dropped snd_poewr_change_state() calls
The card power state change via snd_power_change_state() at the system
suspend/resume seems dropped mistakenly during the PM code rewrite.
The card power state doesn't play much role nowadays but it's still
referred in a few places such as the HDMI codec driver.

This patch restores them, but in a more appropriate place now in the
prepare and complete callbacks.

Fixes: f5dac54d9d ("ALSA: hda: Separate runtime and system suspend")
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210329113059.25035-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2021-03-30 13:16:22 +02:00
Gulam Mohamed
9e67600ed6 scsi: iscsi: Fix race condition between login and sync thread
A kernel panic was observed due to a timing issue between the sync thread
and the initiator processing a login response from the target. The session
reopen can be invoked both from the session sync thread when iscsid
restarts and from iscsid through the error handler. Before the initiator
receives the response to a login, another reopen request can be sent from
the error handler/sync session. When the initial login response is
subsequently processed, the connection has been closed and the socket has
been released.

To fix this a new connection state, ISCSI_CONN_BOUND, is added:

 - Set the connection state value to ISCSI_CONN_DOWN upon
   iscsi_if_ep_disconnect() and iscsi_if_stop_conn()

 - Set the connection state to the newly created value ISCSI_CONN_BOUND
   after bind connection (transport->bind_conn())

 - In iscsi_set_param(), return -ENOTCONN if the connection state is not
   either ISCSI_CONN_BOUND or ISCSI_CONN_UP

Link: https://lore.kernel.org/r/20210325093248.284678-1-gulam.mohamed@oracle.com
Reviewed-by: Mike Christie <michael.christie@oracle.com>
Signed-off-by: Gulam Mohamed <gulam.mohamed@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

index 91074fd97f64..f4bf62b007a0 100644
2021-03-29 21:17:45 -04:00
Linus Walleij
ba845907b2 intel-pinctrl for v5.12-3
* Check if device is present, which is not the case in Xen
 
 The following is an automated git shortlog grouped by driver:
 
 intel:
  -  check REVID register value for device presence
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEqaflIX74DDDzMJJtb7wzTHR8rCgFAmBh6fAACgkQb7wzTHR8
 rCimjg//d49PcsoA9JDX1LCBDohjTyfrNn9TkN8nevF604AlKyuHCIr/oXm5wapy
 C3CeDd3PTD+2ciqApCZod5QXesdDZX9GkFRIVtJ3nO2+MpzPckWCU1UHstvwnDcr
 ZkSl7XS1LQAxzHNOHR2Bk3krk5bvWpKBPjYAtcmlXo48T2qKTK/pcG3GdnzpI6KX
 9HDigNIIS6SNyCV6WbF2g6J2TbncDNuqSKBIjXiFF79YVT1g042Bek5tv7rRVhoV
 jAFKEpNaL1b+O1c+WlKXZweZv1w3Qoi36LFAxFXawSIaTmDWFRTLXVkPmyaxl9k3
 378uPnlKyvWbw9ZfCttDOup5zjFM7ocQy3exLYJhZLSwBYoqiXze/H/EiQYSEagR
 ZLNwLvD680+Gfw3DhizoxJv6NqS6Zydhfhfsh+88VKTYZ3Rba47B/ofYTaNd8VxQ
 NYj998YgAILgL4oiJ4is47THM0f9qczTxsRRnE4YnDmK9ty4E1yHidgZC+JeoFv8
 Hr+XES5gNwQ88svrSOrQMkRi6KQQ7jKaKfcbDqgqq6zO1O7DYfT8RGOcUaInaCje
 U75suuYoN9+YVrdVA6LntMV5uI/Y0gUSUQ8rpSOY3Dmtnmgz+0B0e+1/JScm0KYF
 6umagarrHf1HYSbW4FxavNfgDYaLadJzCKv95DiO3mYr3ygppXU=
 =s7pI
 -----END PGP SIGNATURE-----

Merge tag 'intel-pinctrl-v5.12-3' of gitolite.kernel.org:pub/scm/linux/kernel/git/pinctrl/intel into fixes

intel-pinctrl for v5.12-3

* Check if device is present, which is not the case in Xen

The following is an automated git shortlog grouped by driver:

intel:
 -  check REVID register value for device presence
2021-03-30 00:46:49 +02:00
Jason Gunthorpe
e0146a108c vfio/nvlink: Add missing SPAPR_TCE_IOMMU depends
Compiling the nvlink stuff relies on the SPAPR_TCE_IOMMU otherwise there
are compile errors:

 drivers/vfio/pci/vfio_pci_nvlink2.c:101:10: error: implicit declaration of function 'mm_iommu_put' [-Werror,-Wimplicit-function-declaration]
                            ret = mm_iommu_put(data->mm, data->mem);

As PPC only defines these functions when the config is set.

Previously this wasn't a problem by chance as SPAPR_TCE_IOMMU was the only
IOMMU that could have satisfied IOMMU_API on POWERNV.

Fixes: 179209fa12 ("vfio: IOMMU_API should be selected")
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Message-Id: <0-v1-83dba9768fc3+419-vfio_nvlink2_kconfig_jgg@nvidia.com>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
2021-03-29 14:48:00 -06:00
Linus Torvalds
1e43c377a7 Xtensa fixes for v5.12:
- fix build with separate exception vectors when they are placed too far
   from the rest of the kernel;
 - fix uaccess-related livelock in do_page_fault.
 -----BEGIN PGP SIGNATURE-----
 
 iQJHBAABCgAxFiEEK2eFS5jlMn3N6xfYUfnMkfg/oEQFAmBiHDkTHGpjbXZia2Jj
 QGdtYWlsLmNvbQAKCRBR+cyR+D+gRJ6iD/9xqCAbd5L2rXia9MmwXtFe03JBP/0R
 VtYy3SVYzaR3fW5TWjDUekqkPjkyfEa1wZf0kFaNWs9TYZhVKv7wbtnD8D2n+RaJ
 QfwXZSIhcOZiLufXm6/ig960/nFTe2h3rX3/Mu/ngAGGTRdKYIdJHERsk4qvdUsf
 WeV9zBYkicdA+zkzzyEy02kgW8AgiGGfnYdNNXT92be1bDV751VWr5O/3qBGAsek
 CMkH6t7xXIiAU4kOfrnS7nXmWhgFP1Kos+miW4CJVKN4Cq5ek7cIuShyyQMtF8Zz
 Mz8Q4h6jFcgqWd0FN9CNNKXh/we2hJTV+ZuCq3ew6CGpz7RghrAyYebnNZ2kKGyA
 Go/7yy7D5Pm/V/bqSIe1KIipONl22yJmwEWxJoXxGx9Tn2mAIZCPb2VbCOMOZ9C6
 qONdnWwCYp7GFdrbgbfdS3bL3BUQd/tHpDrc6Erc1YhAATlfI/L1qUfow85I/6O0
 EHrWDR4BTAsbxrE1t6IGXE0GoCdr/x5WbA8o+8Qg5D5rIF0TX15rEDEjpNEEIbSm
 XThK6Dvw+y5Z37tdEecQPYG18idkQGTb1a7jtwINvpbi+RVmm7pYFrDQ4v8OToWk
 QqCyBR+0MgqcbPzpbY2TXBg3q02W3JKKzXrHeaYTCEmSI6k5na+sBmo0QyQ0zRaS
 Ax/o9BPwZKFzfQ==
 =nxqa
 -----END PGP SIGNATURE-----

Merge tag 'xtensa-20210329' of git://github.com/jcmvbkbc/linux-xtensa

Pull xtensa fixes from Max Filippov:

 - fix build with separate exception vectors when they are placed too
   far from the rest of the kernel

 - fix uaccess-related livelock in do_page_fault.

* tag 'xtensa-20210329' of git://github.com/jcmvbkbc/linux-xtensa:
  xtensa: fix uaccess-related livelock in do_page_fault
  xtensa: move coprocessor_flush to the .text section
2021-03-29 11:37:43 -07:00
Max Filippov
7b9acbb6aa xtensa: fix uaccess-related livelock in do_page_fault
If a uaccess (e.g. get_user()) triggers a fault and there's a
fault signal pending, the handler will return to the uaccess without
having performed a uaccess fault fixup, and so the CPU will immediately
execute the uaccess instruction again, whereupon it will livelock
bouncing between that instruction and the fault handler.

https://lore.kernel.org/lkml/20210121123140.GD48431@C02TD0UTHF1T.local/

Cc: stable@vger.kernel.org
Reported-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
2021-03-29 11:25:11 -07:00
Nirmoy Das
5e61b84f9d drm/amdgpu: fix offset calculation in amdgpu_vm_bo_clear_mappings()
Offset calculation wasn't correct as start addresses are in pfn
not in bytes.

CC: stable@vger.kernel.org
Signed-off-by: Nirmoy Das <nirmoy.das@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2021-03-29 14:05:49 -04:00
Evan Quan
acc7baafeb drm/amd/pm: no need to force MCLK to highest when no display connected
Correct the check for vblank short.

Signed-off-by: Evan Quan <evan.quan@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Tested-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
2021-03-29 14:05:20 -04:00
Adrian Hunter
9dfacc54a8 PM: runtime: Fix race getting/putting suppliers at probe
pm_runtime_put_suppliers() must not decrement rpm_active unless the
consumer is suspended. That is because, otherwise, it could suspend
suppliers for an active consumer.

That can happen as follows:

 static int driver_probe_device(struct device_driver *drv, struct device *dev)
 {
	int ret = 0;

	if (!device_is_registered(dev))
		return -ENODEV;

	dev->can_match = true;
	pr_debug("bus: '%s': %s: matched device %s with driver %s\n",
		 drv->bus->name, __func__, dev_name(dev), drv->name);

	pm_runtime_get_suppliers(dev);
	if (dev->parent)
		pm_runtime_get_sync(dev->parent);

 At this point, dev can runtime suspend so rpm_put_suppliers() can run,
 rpm_active becomes 1 (the lowest value).

	pm_runtime_barrier(dev);
	if (initcall_debug)
		ret = really_probe_debug(dev, drv);
	else
		ret = really_probe(dev, drv);

 Probe callback can have runtime resumed dev, and then runtime put
 so dev is awaiting autosuspend, but rpm_active is 2.

	pm_request_idle(dev);

	if (dev->parent)
		pm_runtime_put(dev->parent);

	pm_runtime_put_suppliers(dev);

 Now pm_runtime_put_suppliers() will put the supplier
 i.e. rpm_active 2 -> 1, but consumer can still be active.

	return ret;
 }

Fix by checking the runtime status. For any status other than
RPM_SUSPENDED, rpm_active can be considered to be "owned" by
rpm_[get/put]_suppliers() and pm_runtime_put_suppliers() need do nothing.

Reported-by: Asutosh Das <asutoshd@codeaurora.org>
Fixes: 4c06c4e6cf ("driver core: Fix possible supplier PM-usage counter imbalance")
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Cc: 5.1+ <stable@vger.kernel.org> # 5.1+
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2021-03-29 19:27:09 +02:00
Adrian Hunter
c0c33442f7 PM: runtime: Fix ordering in pm_runtime_get_suppliers()
rpm_active indicates how many times the supplier usage_count has been
incremented. Consequently it must be updated after pm_runtime_get_sync() of
the supplier, not before.

Fixes: 4c06c4e6cf ("driver core: Fix possible supplier PM-usage counter imbalance")
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Cc: 5.1+ <stable@vger.kernel.org> # 5.1+
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2021-03-29 19:27:09 +02:00
Rafael J. Wysocki
1a1c130ab7 ACPI: tables: x86: Reserve memory occupied by ACPI tables
The following problem has been reported by George Kennedy:

 Since commit 7fef431be9 ("mm/page_alloc: place pages to tail
 in __free_pages_core()") the following use after free occurs
 intermittently when ACPI tables are accessed.

 BUG: KASAN: use-after-free in ibft_init+0x134/0xc49
 Read of size 4 at addr ffff8880be453004 by task swapper/0/1
 CPU: 3 PID: 1 Comm: swapper/0 Not tainted 5.12.0-rc1-7a7fd0d #1
 Call Trace:
  dump_stack+0xf6/0x158
  print_address_description.constprop.9+0x41/0x60
  kasan_report.cold.14+0x7b/0xd4
  __asan_report_load_n_noabort+0xf/0x20
  ibft_init+0x134/0xc49
  do_one_initcall+0xc4/0x3e0
  kernel_init_freeable+0x5af/0x66b
  kernel_init+0x16/0x1d0
  ret_from_fork+0x22/0x30

 ACPI tables mapped via kmap() do not have their mapped pages
 reserved and the pages can be "stolen" by the buddy allocator.

Apparently, on the affected system, the ACPI table in question is
not located in "reserved" memory, like ACPI NVS or ACPI Data, that
will not be used by the buddy allocator, so the memory occupied by
that table has to be explicitly reserved to prevent the buddy
allocator from using it.

In order to address this problem, rearrange the initialization of the
ACPI tables on x86 to locate the initial tables earlier and reserve
the memory occupied by them.

The other architectures using ACPI should not be affected by this
change.

Link: https://lore.kernel.org/linux-acpi/1614802160-29362-1-git-send-email-george.kennedy@oracle.com/
Reported-by: George Kennedy <george.kennedy@oracle.com>
Tested-by: George Kennedy <george.kennedy@oracle.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reviewed-by: Mike Rapoport <rppt@linux.ibm.com>
Cc: 5.10+ <stable@vger.kernel.org> # 5.10+
2021-03-29 19:26:04 +02:00
Pavel Begunkov
51520426f4 io_uring: handle setup-failed ctx in kill_timeouts
general protection fault, probably for non-canonical address
	0xdffffc0000000018: 0000 [#1] KASAN: null-ptr-deref
	in range [0x00000000000000c0-0x00000000000000c7]
RIP: 0010:io_commit_cqring+0x37f/0xc10 fs/io_uring.c:1318
Call Trace:
 io_kill_timeouts+0x2b5/0x320 fs/io_uring.c:8606
 io_ring_ctx_wait_and_kill+0x1da/0x400 fs/io_uring.c:8629
 io_uring_create fs/io_uring.c:9572 [inline]
 io_uring_setup+0x10da/0x2ae0 fs/io_uring.c:9599
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xae

It can get into wait_and_kill() before setting up ctx->rings, and hence
io_commit_cqring() fails. Mimic poll cancel and do it only when we
completed events, there can't be any requests if it failed before
initialising rings.

Fixes: 80c4cbdb5e ("io_uring: do post-completion chore on t-out cancel")
Reported-by: syzbot+0e905eb8228070c457a0@syzkaller.appspotmail.com
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/660261a48f0e7abf260c8e43c87edab3c16736fa.1617014345.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2021-03-29 06:48:26 -06:00
Ikjoon Jang
625bd5a616 ALSA: usb-audio: Apply sample rate quirk to Logitech Connect
Logitech ConferenceCam Connect is a compound USB device with UVC and
UAC. Not 100% reproducible but sometimes it keeps responding STALL to
every control transfer once it receives get_freq request.

This patch adds 046d:0x084c to a snd_usb_get_sample_rate_quirk list.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=203419
Signed-off-by: Ikjoon Jang <ikjn@chromium.org>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210324105153.2322881-1-ikjn@chromium.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2021-03-29 13:22:24 +02:00
Tian Tao
6161a435c1 drm/exynos/decon5433: Remove the unused include statements
This driver doesn't reference of_gpio.h, so drop it.

Signed-off-by: Tian Tao <tiantao6@hisilicon.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>
2021-03-29 19:53:23 +09:00
Pavel Begunkov
5a978dcfc0 io_uring: always go for cancellation spin on exec
Always try to do cancellation in __io_uring_task_cancel() at least once,
so it actually goes and cleans its sqpoll tasks (i.e. via
io_sqpoll_cancel_sync()), otherwise sqpoll task may submit new requests
after cancellation and it's racy for many reasons.

Fixes: 521d6a737a ("io_uring: cancel sqpoll via task_work")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/0a21bd6d794bb1629bc906dd57a57b2c2985a8ac.1616839147.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2021-03-28 18:11:53 -06:00
Linus Torvalds
a5e13c6df0 Linux 5.12-rc5 2021-03-28 15:48:16 -07:00
Linus Torvalds
f9e2bb42cf Some more perf tools fixes for v5.12:
- Avoid write of uninitialized memory when generating PERF_RECORD_MMAP* records.
 
 - Fix 'perf top' BPF support related crash with perf_event_paranoid=3 + kptr_restrict.
 
 - Validate raw event with sysfs exported format bits.
 
 - Fix waipid on SIGCHLD delivery bugs in 'perf daemon'.
 
 - Change to use bash for daemon test on Debian, where the default is dash and
   thus fails for use of bashisms in this test.
 
 - Fix memory leak in vDSO found using ASAN.
 
 - Remove now useless (due to the fact taht BPF now supports static vars)
   failing sub test "BPF relocation checker".
 
 - Fix auxtrace queue conflict.
 
 - Sync linux/kvm.h with the kernel sources.
 
 Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYIAB0WIQR2GiIUctdOfX2qHhGyPKLppCJ+JwUCYGDHswAKCRCyPKLppCJ+
 J765AQDJNsaxs3RximgY503X6pguLSrMY/uBq9XB2uYCeM3xRgEA1h4nIFCOE06V
 s/kOphsfgbUu2UTD1rtCM2olZRzS1AU=
 =kpj/
 -----END PGP SIGNATURE-----

Merge tag 'perf-tools-fixes-for-v5.12-2020-03-28' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux

Pull perf tooling fixes from Arnaldo Carvalho de Melo:

 - Avoid write of uninitialized memory when generating PERF_RECORD_MMAP*
   records.

 - Fix 'perf top' BPF support related crash with perf_event_paranoid=3 +
   kptr_restrict.

 - Validate raw event with sysfs exported format bits.

 - Fix waipid on SIGCHLD delivery bugs in 'perf daemon'.

 - Change to use bash for daemon test on Debian, where the default is
   dash and thus fails for use of bashisms in this test.

 - Fix memory leak in vDSO found using ASAN.

 - Remove now useless (due to the fact that BPF now supports static
   vars) failing sub test "BPF relocation checker".

 - Fix auxtrace queue conflict.

 - Sync linux/kvm.h with the kernel sources.

* tag 'perf-tools-fixes-for-v5.12-2020-03-28' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux:
  perf test: Change to use bash for daemon test
  perf record: Fix memory leak in vDSO found using ASAN
  perf test: Remove now useless failing sub test "BPF relocation checker"
  perf daemon: Return from kill functions
  perf daemon: Force waipid for all session on SIGCHLD delivery
  perf top: Fix BPF support related crash with perf_event_paranoid=3 + kptr_restrict
  perf pmu: Validate raw event with sysfs exported format bits
  perf synthetic events: Avoid write of uninitialized memory when generating PERF_RECORD_MMAP* records
  tools headers UAPI: Sync linux/kvm.h with the kernel sources
  perf synthetic-events: Fix uninitialized 'kernel_thread' variable
  perf auxtrace: Fix auxtrace queue conflict
2021-03-28 13:22:54 -07:00
Linus Torvalds
3fef15f872 A fix for auxdisplay:
- Remove in_interrupt() usage (Sebastian Andrzej Siewior)
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEPjU5OPd5QIZ9jqqOGXyLc2htIW0FAmBgsz4ACgkQGXyLc2ht
 IW3BJQ//VWasG/juyQD9CHgZCJoXYBlRzv5JUp6Fo+JWwf8JUpnsZdGaf4mBQgoC
 60NIo/8S2luuA/bAlwFeNDo9g7SZeFS4mLJnZmT0zNyPKnnmhpUGLo+HwKzOwaC6
 8e2Vf/PVvAmF4WhsG8bpnAUhgD4GxFzWdWYyGzdGdDVP+y7i7LciG+WHrgr6Kk8R
 71I3Ie/u9aTRAsDRIieAmXHFxckAjgvekphbjRRg/lUdDhIzk6Lf+Uj28TRhuubK
 VellOw4GtTE0foa5Gw7UELs5TBJyOPMVfgk9VER1xvjMj8I4g26BiFm4lBZTJcgy
 Ewc3yMCPDRd3aB2gS84bVG+7nov+iXy4bA0L7+BAVCSnj8cqDl7XD3EnLJjWmqTE
 38/4NRKLsuz2uX+VvKVFL9cx86OpHk0rwOybB+sLw4qzI/ABRipN/mJ8hut9i32j
 MOLgVYCsj28r7ZS4aijtpL3AV+UOBy9LGF6BT4Y5ztIQf8Es93EYr177jhgPimZT
 2O2a+qhyUw3zu7sa5g9qqRrGFb93wHfj6WFHWuxMDHKG0OcZuES2QBg3445C281k
 kY4iTZT7BDUoPZb21RZIG3ssi0KMeVL+EivIYpu1bNbwNH1vsvol8lr60befqVSu
 vbfRw661nU093bDVPsLoWjnvNW/Hx9XaXYJgfWzee5MgWCt+vRM=
 =SQ/B
 -----END PGP SIGNATURE-----

Merge tag 'auxdisplay-for-linus-v5.12-rc6' of git://github.com/ojeda/linux

Pull auxdisplay fix from Miguel Ojeda:
 "Remove in_interrupt() usage (Sebastian Andrzej Siewior)"

* tag 'auxdisplay-for-linus-v5.12-rc6' of git://github.com/ojeda/linux:
  auxdisplay: Remove in_interrupt() usage.
2021-03-28 13:20:38 -07:00
Linus Torvalds
36a14638f7 Two fixes:
- Fix build failure on Ubuntu with new GCC packages that turn on -fcf-protection
 
  - Fix SME memory encryption PTE encoding bug - AFAICT the code worked on
    4K page sizes (level 1) but had the wrong shift at higher page level orders
    (level 2 and higher).
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmBgXdERHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1gJWxAAgAOWwGY3yq3kUEtIExosXZPlHCFjal3N
 UXoVpQde4aBeZ9A4flMjkSZmTF5PVEN2npMz8ltnxU8NUJg4QR68UYiIE8BReARg
 +JuyNXGdAu1XyT+dWdTFqL9xgA9t8dG13o4WbBqGDZagnLNuvjYhzJtsgw9FbNWZ
 a1abBbcxpoZvSyQBHyqtuwoiWeeeFJiQZ02wZwxtonYHWVbBXEN5WhFL9Tc2kDJc
 /Ic09O+FDhpe3I/PvCiMrkpVJuBnaDdve5zDPDzR+FRMeAj4AhNLIJiMFj17bJWD
 eR6vCDoFz3EsbSdJz0XvHIZOSZnaiiC0ybTEv5nJTiRgDk+s6JDXWwDcJG+3yKJR
 Fm5TLlnaU++E9lYLpyCbgrWkrv0F2u3GmnieFnOOyzRv8NlkZqrThApf3xGsavy+
 qJZnXe5ftWp+mmIDw4DZDBVsJ8rBIflvURQxfG3SHkUc0iVsyUCrAK2eKYewk/dN
 eC6FVPkCdx4Ys50wb+OR9Enhq3yKFyRuZ2zIeguUX30sqoapJL85M1vglS5DFoX/
 pHcigRzBzFQOZhOh8Kq3VREOx0F+ioUfcZzmYdzjWSfXfpvqWFcLAIFgOv1hDfms
 XQ60X/voG0tWd0ODKXqyx6oa0rqamigPjLJp/gtDKpQHORFaabvnTJTLwN6n8N1Q
 syTWRiHMhi0=
 =tM9n
 -----END PGP SIGNATURE-----

Merge tag 'x86-urgent-2021-03-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull x86 fixes from Ingo Molnar:
 "Two fixes:

   - Fix build failure on Ubuntu with new GCC packages that turn
     on -fcf-protection

   - Fix SME memory encryption PTE encoding bug - AFAICT the code
     worked on 4K page sizes (level 1) but had the wrong shift at
     higher page level orders (level 2 and higher)"

* tag 'x86-urgent-2021-03-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/build: Turn off -fcf-protection for realmode targets
  x86/mem_encrypt: Correct physical address calculation in __set_clr_pte_enc()
2021-03-28 12:19:16 -07:00
Linus Torvalds
47fbbc94da Fix the non-debug mutex_lock_io_nested() method to map to mutex_lock_io() instead of mutex_lock().
Right now nothing uses this API explicitly, but this is an accident waiting to happen.
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmBgWhwRHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1gNOg/+PRiR4Zs/Wmt9r6iFG5xFCQ+xuUzsmcLO
 XEwQiUsLGn2yRuLn4wY8+1F4fZpQhcX38jsuMpaY43NMMoFLEKMd2D7yJ24/y5zf
 66U2xg7+KMxTKjhx1D75Ln9HpvnS6aB7s5HAKTWO7i9dK9CVmYrO4rMDCK1msIMp
 vETjCiKEN7s4BwW/j31L+2gegYXBsxyS14xUT9jX+6lL4yNlRXPKz/adkirQ9BJP
 TXY/4K4qhrGjFgpLHQB8haD7P6NN1OaQLX16P+eV//LxQWz49Z8uf60nZKcmDxdk
 rbRZD6VD0LqwsKnQW/bnC3Cug59T+Ybz4mgLrf3YsocDbafb3sQYhWTp4+5nlBls
 cY6Wq4OrqPli6auFZyK/Ih9hPfI3AFcY/+ieFqenumrl6SPUQTlvX4MfL/oVxszD
 aEX5tbWBlCf0fKlr3kcjAaOhjAOZ5SazCJ5y2gY/r7skKDFmuU4eIBzCb+AttpRT
 pX/aeXVZdeBUMdMM8W0XfVvscxDkFlO/cEw8hpTFqmYmfwy5CGQDxRvVSrbKEZcg
 KKvPUgrotTGOktTKO9tdiX29Su/SSQERC8x3dPV0VohxiRhwILK7/mn8RZJpfkS6
 fDFEa22C3z2Xdq3w2c4OweCjT8Kb5Q2udg9EmDru7wrwANlSQRFAJYDtu2TbV5/3
 IZ62AGNczXs=
 =NgW4
 -----END PGP SIGNATURE-----

Merge tag 'locking-urgent-2021-03-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull locking fix from Ingo Molnar:
 "Fix the non-debug mutex_lock_io_nested() method to map to
  mutex_lock_io() instead of mutex_lock().

  Right now nothing uses this API explicitly, but this is an
  accident waiting to happen"

* tag 'locking-urgent-2021-03-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  locking/mutex: Fix non debug version of mutex_lock_io_nested()
2021-03-28 12:12:22 -07:00
Linus Torvalds
81b1d39fd3 5 cifs/smb3 fixes, 2 for stable, includes an important fix for encryption and an ACL fix, as well as a fix for possible reflink data corruption
-----BEGIN PGP SIGNATURE-----
 
 iQGzBAABCgAdFiEE6fsu8pdIjtWE/DpLiiy9cAdyT1EFAmBfx9sACgkQiiy9cAdy
 T1F/igv8DsHxOJLw9kc5pBrbmUEgsUpQbdRMESqEROyqKte80jga2P3wsvJQYqQY
 JwHPxh477eiRSpSkEWSFDMmELsVtoQIYv3aqgPe79668eCd97mHRM2ItSV++5x9M
 iJ0N8GuiVARSyKmndrZ9gvbPoJb4TKkPX6X44pDSgAkgskvTTFKTywZaY5IEiqKe
 9zBWghZbNnWhtYG+2On2M2tzy8/Fo8aveLxhFhJstZ0IP6Px+Rg9GMdzRAfDJqK+
 QQMwcqmRKjVo4/Z6yji/s9OI1+eQyIAKLa6cyB0Yd+AqnvDYv1dagkRAjRCHl/Ri
 28loxGatXeXjXJGYU58EjNkKdoBUh09idJJolcMGwPSteL2j1DQDV9utbZLhAWPq
 yNugiIkzbQj3Z55UQ3n3u79pztK31GZ2TOcwJbIqQs3tctJ5aqUIWjQibLVpaNBR
 7C5Yug9aC5gpr3LPIUD3AGZIUAenCzsVN5Y9br4SPx0/zHmbynyyF27w14shX8O/
 3uQr6xhl
 =NxLV
 -----END PGP SIGNATURE-----

Merge tag '5.12-rc4-smb3' of git://git.samba.org/sfrench/cifs-2.6

Pull cifs fixes from Steve French:
 "Five cifs/smb3 fixes, two for stable.

  Includes an important fix for encryption and an ACL fix, as well as a
  fix for possible reflink data corruption"

* tag '5.12-rc4-smb3' of git://git.samba.org/sfrench/cifs-2.6:
  smb3: fix cached file size problems in duplicate extents (reflink)
  cifs: Silently ignore unknown oplock break handle
  cifs: revalidate mapping when we open files for SMB1 POSIX
  cifs: Fix chmod with modefromsid when an older ACE already exists.
  cifs: Adjust key sizes and key generation routines for AES256 encryption
2021-03-28 12:06:21 -07:00
Linus Torvalds
b44d1ddcf8 io_uring-5.12-2021-03-27
-----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmBf1KAQHGF4Ym9lQGtl
 cm5lbC5kawAKCRD301j7KXHgpjVSD/0f1HdekXnIE6aSRQ7YEV8ux2t5wUeDyP8U
 cdcZ8fBW9PvKZLdODSI4sw8UYV5OYEBcfImFe3nRVHR+RIVQo72UTYvuHqeUYNct
 w3drgF2GEMIxJFZR6zf9LDrQVduPqXvbEJLui6TN+eX/5E99ZlUWMLwkX1k+vDju
 QfaGZjz2736GTn1MPc7jdyZKoK7eCi5xtNFPash5wGck7aYl5TGXnG/8bRYsv2Tw
 eCYKbvv4x0s8OFcYVQMooDfbIMCyyfTwt6YatFHQEtM/RM+M66gndvv3jfkeJQju
 hz0I8qOJ8X5lf0VucncWs5J8b9Whr5YZV+k9461xalBbV9ed2vzIIikP8DpCxtYz
 yKbsdDm0+3hwfuZOz+d7ooEXKsphJ1PnSsEeuNZXtKDXVtphksUbbq4H2NLINcsQ
 m6dwaRPSEA0EymngGY2e+8+CU0euiE4mqoMpw4D9m9Irs+BAaWYGk9xCWr0BGem0
 auZOMqvV2xktdBlGx1BJCLts1sHHxy8IM3u0852R/1AfcKOkXwNVPt62I8e9ceIA
 wc731aWHwJfS25m430xFDPJKJpUZoZgste4qwVym70CmRziuamgYyIfrfRg1ZjsD
 ZBa9Z4hPiT4e0eDqlYjcMpl9FORgYQXVXy5ofd/eZg5xkU8X+i6TVZkaQNkZyqV/
 4ogBZYUolg==
 =mwLC
 -----END PGP SIGNATURE-----

Merge tag 'io_uring-5.12-2021-03-27' of git://git.kernel.dk/linux-block

Pull io_uring fixes from Jens Axboe:

 - Use thread info versions of flag testing, as discussed last week.

 - The series enabling PF_IO_WORKER to just take signals, instead of
   needing to special case that they do not in a bunch of places. Ends
   up being pretty trivial to do, and then we can revert all the special
   casing we're currently doing.

 - Kill dead pointer assignment

 - Fix hashed part of async work queue trace

 - Fix sign extension issue for IORING_OP_PROVIDE_BUFFERS

 - Fix a link completion ordering regression in this merge window

 - Cancellation fixes

* tag 'io_uring-5.12-2021-03-27' of git://git.kernel.dk/linux-block:
  io_uring: remove unsued assignment to pointer io
  io_uring: don't cancel extra on files match
  io_uring: don't cancel-track common timeouts
  io_uring: do post-completion chore on t-out cancel
  io_uring: fix timeout cancel return code
  Revert "signal: don't allow STOP on PF_IO_WORKER threads"
  Revert "kernel: freezer should treat PF_IO_WORKER like PF_KTHREAD for freezing"
  Revert "kernel: treat PF_IO_WORKER like PF_KTHREAD for ptrace/signals"
  Revert "signal: don't allow sending any signals to PF_IO_WORKER threads"
  kernel: stop masking signals in create_io_thread()
  io_uring: handle signals for IO threads like a normal thread
  kernel: don't call do_exit() for PF_IO_WORKER threads
  io_uring: maintain CQE order of a failed link
  io-wq: fix race around pending work on teardown
  io_uring: do ctx sqd ejection in a clear context
  io_uring: fix provide_buffers sign extension
  io_uring: don't skip file_end_write() on reissue
  io_uring: correct io_queue_async_work() traces
  io_uring: don't use {test,clear}_tsk_thread_flag() for current
2021-03-28 11:42:05 -07:00
Linus Torvalds
abed516ecd block-5.12-2021-03-27
-----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmBf1YoQHGF4Ym9lQGtl
 cm5lbC5kawAKCRD301j7KXHgprivEADZx//LFwziicjD3Nd5XcLfMeE1su6+CULD
 SkGh8MALlB3/smeYa+gG5tb5U8l+7Xk62pDWXsRZj+Ckw/FDGql4qve6uSDqAIBz
 6W6PKjHLY81E8nVe/WHcvhQrxE8E9yZg/Hrg4FWLpcLbmJTt709Cm+FciHP8BAsR
 iv3gkBreMRrt9Xlfimn4XCsGaqbXg2Xx8AhaJBshhhjIXvirvB8ctNZvguNX4KFl
 ob+KTO1p26mTFxHLiaJt1fNJzj21XdMrT27FMPqylBF5s1Xr4U9plZHgTX6KMx3o
 BZx1QFTGiskgdKhR01AgzM4ASIWZAUDfpRgABfyWdqHTwqeJyHbcJ+emRpiGCyER
 Og3ar2m75WUA8+Pfgl9TusnNTCiRVYBAcMZGpGEbGKZt+cyCq2Ed161e2I7NPOxR
 c60/j4KHq3uBXh1FhNRX1Y9ZUiK031RqGhBCABeM0bnxImyEo96L3VXJ72RZOvjZ
 1lo9U35q7B6AaFlAesYH4/WaPIExy3RObVHUVtXokzcm4RFh9eycuxPdGc+HDZ04
 h8t6KaAKTtBadIIMWvz34SNykqM4Q0xcHrt8Wz+1C3FZfgc7rkQpVBZLjhk5fx8h
 33KeuMrATAFGvv9d0tbARbIXqXaFGwcc7Z0sSfVnzRfFM/aPa5xnIfGmbxoT5gH8
 v/6ySA3EWA==
 =ZaB3
 -----END PGP SIGNATURE-----

Merge tag 'block-5.12-2021-03-27' of git://git.kernel.dk/linux-block

Pull block fixes from Jens Axboe:

 - Fix regression from this merge window with the xarray partition
   change, which allowed partition counts that overflow the u8 that
   holds the partition number (Ming)

 - Fix zone append warning (Johannes)

 - Segmentation count fix for multipage bvecs (David)

 - Partition scan fix (Chris)

* tag 'block-5.12-2021-03-27' of git://git.kernel.dk/linux-block:
  block: don't create too many partitions
  block: support zone append bvecs
  block: recalculate segment count for multi-segment discards correctly
  block: clear GD_NEED_PART_SCAN later in bdev_disk_changed
2021-03-28 11:37:42 -07:00
Linus Torvalds
e8cfe8fa22 SCSI fixes on 20210327
Seven fixes, all in drivers (qla2xxx, mkt3sas, qedi, target,
 ibmvscsi).  The most serious are the target pscsi oom and the qla2xxx
 revert which can otherwise cause a use after free.
 
 Signed-off-by: James E.J. Bottomley <jejb@linux.ibm.com>
 -----BEGIN PGP SIGNATURE-----
 
 iJwEABMIAEQWIQTnYEDbdso9F2cI+arnQslM7pishQUCYF/V2yYcamFtZXMuYm90
 dG9tbGV5QGhhbnNlbnBhcnRuZXJzaGlwLmNvbQAKCRDnQslM7pisha+AAQCSO7Wv
 Wshi7H9N8SQUJO9EcmkrSApGDtjHUfZYlnse0AD/UhbpCSzSEPzI23lfduMB3QTa
 o5wmwHEIG8ULneB57vE=
 =f44O
 -----END PGP SIGNATURE-----

Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi

Pull SCSI fixes from James Bottomley:
 "Seven fixes, all in drivers (qla2xxx, mkt3sas, qedi, target,
  ibmvscsi).

  The most serious are the target pscsi oom and the qla2xxx revert which
  can otherwise cause a use after free"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  scsi: target: pscsi: Clean up after failure in pscsi_map_sg()
  scsi: target: pscsi: Avoid OOM in pscsi_map_sg()
  scsi: mpt3sas: Fix error return code of mpt3sas_base_attach()
  scsi: qedi: Fix error return code of qedi_alloc_global_queues()
  scsi: Revert "qla2xxx: Make sure that aborted commands are freed"
  scsi: ibmvfc: Make ibmvfc_wait_for_ops() MQ aware
  scsi: ibmvfc: Fix potential race in ibmvfc_wait_for_ops()
2021-03-28 11:34:47 -07:00
Matthew Rosato
84d572e634 MAINTAINERS: add backups for s390 vfio drivers
Add a backup for s390 vfio-pci, an additional backup for vfio-ccw
and replace the backup for vfio-ap as Pierre is focusing on other
areas.

Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com>
Acked-by: Eric Farman <farman@linux.ibm.com>
Acked-by: Halil Pasic <pasic@linux.ibm.com>
Acked-by: Pierre Morel <pmorel@linux.ibm.com>
Acked-by: Jason J. Herne <jjherne@linux.ibm.com>
Link: https://lore.kernel.org/r/1616679712-7139-1-git-send-email-mjrosato@linux.ibm.com
Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
2021-03-28 20:20:33 +02:00
Pavel Skripkin
211b4d42b7 tty: fix memory leak in vc_deallocate
syzbot reported memory leak in tty/vt.
The problem was in VT_DISALLOCATE ioctl cmd.
After allocating unimap with PIO_UNIMAP it wasn't
freed via VT_DISALLOCATE, but vc_cons[currcons].d was
zeroed.

Reported-by: syzbot+bcc922b19ccc64240b42@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210327214443.21548-1-paskripkin@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-03-28 14:16:47 +02:00