Commit graph

888235 commits

Author SHA1 Message Date
Linus Torvalds
b1d198c08c sound fixes for 5.5-rc6
A few piled ASoC fixes and usual HD-audio and USB-audio fixups.
 Some of them are for ASoC core, but rather about error-handling.
 -----BEGIN PGP SIGNATURE-----
 
 iQJCBAABCAAsFiEEIXTw5fNLNI7mMiVaLtJE4w1nLE8FAl4YWVcOHHRpd2FpQHN1
 c2UuZGUACgkQLtJE4w1nLE+D1RAAgAvg1Zm2u2qv3D0qNt6eip88yFvXy+ZkgZF+
 nBy/cVCqRDm+VLwEK3hQe4G/jk+h39PTxS1Pa3PMWwu++MvwuIHLH5ekv77o51pT
 SW1DhIPzrE8vv3iN7r9/xLjFxeJcM6yn297aMI362MXhb42wLTddiQPooqUmCcqr
 XOZvNVjJq35jyJVojaViuabxO+4K6zlgrjvNw5HLpUb4c82mKX/fsoeS7INOJd0q
 JDJHVI77GUNSJN/4ub0WD72i4v39QWDtWJWhn3yagmYGTW9RVwCVRGstDOLehDv0
 dletpXPL+cza1P7aqD12ZSY2fWM6AivEjW+kaNmq1ag8MRRNC2SgsQEecSmQJcIZ
 IHF/n4S1LJw0V/Pnn+M+UUPZmzTV7LEIKQJ2FXQ6OmnUJLPyE3FZQDG+DVtlaKTg
 5Q6lPaIcmZpVJdpd38K1vlogcwQJ8euLKtwmMvuLzrwc+oycp5o1Vha3VuxyhIlk
 WS563iJOQ2HHuturqdLR6qhNetmGwZ5FhGJgyFIN3yXQxD8mBBxPuoGTzgCUu0oH
 u0dJU+dyd/lMa+CUQuB0CftvWwbqDf6QF607RCuiIaArQO+LAi8rllwxPkVkXwWl
 iuEBCCp16A7hajthZpUhTjS8EIFSs/CgmYYspA77kDl9WUUpnvxqaNFYDtb6DveI
 95QOWes=
 =/0Br
 -----END PGP SIGNATURE-----

Merge tag 'sound-5.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound

Pull sound fixes from Takashi Iwai:
 "A few piled ASoC fixes and usual HD-audio and USB-audio fixups. Some
  of them are for ASoC core error-handling"

* tag 'sound-5.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
  ALSA: hda: enable regmap internal locking
  ALSA: hda/realtek - Add quirk for the bass speaker on Lenovo Yoga X1 7th gen
  ALSA: hda/realtek - Set EAPD control to default for ALC222
  ALSA: usb-audio: Apply the sample rate quirk for Bose Companion 5
  ALSA: hda/realtek - Add new codec supported for ALCS1200A
  ASoC: Intel: boards: Fix compile-testing RT1011/RT5682
  ASoC: SOF: imx8: Fix dsp_box offset
  ASoC: topology: Prevent use-after-free in snd_soc_get_pcm_runtime()
  ASoC: fsl_audmix: add missed pm_runtime_disable
  ASoC: stm32: spdifrx: fix input pin state management
  ASoC: stm32: spdifrx: fix race condition in irq handler
  ASoC: stm32: spdifrx: fix inconsistent lock state
  ASoC: core: Fix access to uninitialized list heads
  ASoC: soc-core: Set dpcm_playback / dpcm_capture
  ASoC: SOF: imx8: fix memory allocation failure check on priv->pd_dev
  ASoC: SOF: Intel: hda: hda-dai: fix oops on hda_link .hw_free
  ASoC: SOF: fix fault at driver unload after failed probe
2020-01-10 11:52:36 -08:00
Linus Torvalds
658e1af5ee - Fix backward compatibility with old DTBs on QCOM tsens (Amit Kucheria)
-----BEGIN PGP SIGNATURE-----
 
 iHUEABYIAB0WIQRuKdf4M92Gi9vqihve5qtOL396pgUCXhQyogAKCRDe5qtOL396
 puHcAQC2B5eXcxXeEEdIDsK6xMJMIkikyTUTiBeBPVesOd3QQQD/XuD65VfOLCbO
 ZLEzpsEyX9zY194Ga8u0ovyRovjW6gw=
 =Xoh0
 -----END PGP SIGNATURE-----

Merge tag 'thermal-v5.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/thermal/linux

Pull thermal fix from Daniel Lezcano:
 "Fix backward compatibility with old DTBs on QCOM tsens (Amit
  Kucheria)"

* tag 'thermal-v5.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/thermal/linux:
  drivers: thermal: tsens: Work with old DTBs
2020-01-10 11:48:37 -08:00
Linus Torvalds
c23e744b59 Power management fixes for 5.5-rc6
Prevent the cpufreq-dt driver from probing Tegra20/30 (Dmitry Osipenko)
 and prevent the Intel RAPL power capping driver from crashing during
 CPU initialization due to a NULL pointer dereference if the processor
 model in use is not known to it (Harry Pan).
 -----BEGIN PGP SIGNATURE-----
 
 iQJGBAABCAAwFiEE4fcc61cGeeHD/fCwgsRv/nhiVHEFAl4YTSYSHHJqd0Byand5
 c29ja2kubmV0AAoJEILEb/54YlRxq24P/jp+USaA5yvzfKxg1WSdJZ3rdmferh/9
 VHHm8Utz7UHAOouDEWdsNQ2zKYkCm9sPBQT/xedqHpuAeaQfSS55xK6DJrKiwImQ
 CITuiiTGGQDtNz+wJY943CsRxM2Q79KUhZqHKOJIqvlmI6tm3knLvEA0ZdCc+kDv
 +nyS0saIq8LAJ+/eEH77fGrgzjWwf2VlO3UIX1mZqPIF4Mpf/JjSCtrRYypDn7VK
 qcuMLL23YlLjVciY6n/THhgbK/Rf9EhZTg/0h63pRCnJCYLFxgKYgHZTUdSkRYUO
 mdQmXft08hSiXk91sRxSBzDGVd8FyzO5KvIhjgoNLew6DTxMSLLCAlzA3d4FFNB/
 LP1O8An+jx6GUgEjA6zm4uYClArGHC794GvLtWUQCtWme/PPhJXLNBd31fT63jDz
 nr2SBnXSM22Usb5fZYRbEKvIxG1bRDorw5NO7hrxHZoyT8Ha7Dar4kPA21roF+NG
 dFw3pl3uDMkcB17GmjwY1qcYirF2aF7tKgha46kWYUZ5vCcwJQLs7lmuOTNmawRv
 E9s+3bCNNzh03G9sUayFfS8Fqhs10Qob2lXCTbnCIeN0eynXdfaSqEFiQ1PsCgPk
 mexEQDZDnSwvYz4be28nXVrqU3CAUt6/3ICa/kDa8mMDmKA0ctOVpat2svI0GKjq
 D/aD1hvL3dha
 =ukHp
 -----END PGP SIGNATURE-----

Merge tag 'pm-5.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

Pull power management fixes from Rafael Wysocki:
 "Prevent the cpufreq-dt driver from probing Tegra20/30 (Dmitry
  Osipenko) and prevent the Intel RAPL power capping driver from
  crashing during CPU initialization due to a NULL pointer dereference
  if the processor model in use is not known to it (Harry Pan)"

* tag 'pm-5.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  powercap: intel_rapl: add NULL pointer check to rapl_mmio_cpu_online()
  cpufreq: dt-platdev: Blacklist NVIDIA Tegra20 and Tegra30 SoCs
2020-01-10 11:46:59 -08:00
Rafael J. Wysocki
10674d97c4 Merge branch 'powercap'
* powercap:
  powercap: intel_rapl: add NULL pointer check to rapl_mmio_cpu_online()
2020-01-10 10:58:45 +01:00
Linus Torvalds
bef1d88263 pstore fix for rare error path
- Fix label allocation lifetime/visibility to avoid further mistakes
 -----BEGIN PGP SIGNATURE-----
 Comment: Kees Cook <kees@outflux.net>
 
 iQJKBAABCgA0FiEEpcP2jyKd1g9yPm4TiXL039xtwCYFAl4YAM8WHGtlZXNjb29r
 QGNocm9taXVtLm9yZwAKCRCJcvTf3G3AJl9mD/9il1pBZmLTQFVzfLeVnDemQ1t1
 zhPywuR/FzE6KXX4kqaRJZ2ttLsHFaGqttbegQ5Jh8g5SdHZgMWRIz9y9Mb/re4g
 5ny19VH4dvJHY6CYQxl3SlL+uSx29dNQOC4XGRtVwLrs6XeCIoWhXw1KI6ahiuVW
 AK1lelPlLIdVOLrvDn3qHy6iQBXgEA0PSosxUEjxC43ekoIRwKwsMKCeT3awHrOY
 uTamIU8vXwqCl+eFsgoQBoq8dgBvNI121DbKB2rToC2Pb3cE84Ez2Ul7hrqDQqzo
 0wLPYJhvzMDqCaRwc5a42PqYFmRxSZrNHVbAnA9n/gEFPluJTklsq8fOEkXYml16
 BKiC96PcKYfJZdEePbNx3tQVtXYj/mlncLKb8FxIlybyC+P92XGlHWDkrXyva8uY
 6XyTyGpkEN1zwZnA+R6otvaOX8+I5XuX4vsRRlTaDd+1Y6SY7HxvMjxFuTko0yfY
 y/X0rfrhzvtrXUCoC+bkaA73EwaSXpie+8goFWQz9Erjpl7o0lH4lCIqm7J0hynM
 0kmlusSEfqNQ8HBnbP25BVjW4Ws/ASrr5yGDNTigsaYeCdHkwYy+Ses50I9gMWuB
 oNz7jUblC0rPlO1geBQTFpec2u+9sS7Y+xhYhh+h8GLwCX09zOB8gUTE+GBgVhsY
 ptjh+yD7ybBiXrX8jQ==
 =biFc
 -----END PGP SIGNATURE-----

Merge tag 'pstore-v5.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux

Pull pstore fix from Kees Cook:
 "Cengiz Can forwarded a Coverity report about more problems with a rare
  pstore initialization error path, so the allocation lifetime was
  rearranged to avoid needing to share the kfree() responsibilities
  between caller and callee"

* tag 'pstore-v5.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
  pstore/ram: Regularize prz label allocation lifetime
2020-01-09 21:42:05 -08:00
Linus Torvalds
6d25ef7735 drm fixes for 5.5-rc6
core:
 - mst Fix NO_STOP_BIT bit offset (Wayne)
 
 fb_helper:
 - fb_helper: Fix bits_per_pixel param set behavior to round up (Geert)
 
 sun4i:
 - Fix RGB_DIV clock min divider on old hardware (Chen-Yu)
 
 amdgpu:
 - Stability fix for raven
 - Reduce pixel encoding to if max clock is exceeded on HDMI
   to allow additional high res modes
 - enable DRIVER_SYNCOBJ_TIMELINE for amdgpu
 
 i915:
 - Fix GitLab issue #446 causing GPU hangs: Do not restore invalid RS state
 - Fix GitLab issue #846: Restore coarse power gating that was disabled
   by initial RC66 context corruption security fixes.
 - Revert f6ec948309 ("drm/i915: extend audio CDCLK>=2*BCLK constraint to more platforms")
   to avoid screen flicker
 - Fix to fill in unitialized uabi_instance in virtual engine uAPI
 - Add two missing W/As for ICL and EHL
 -----BEGIN PGP SIGNATURE-----
 
 iQIcBAABAgAGBQJeF/BHAAoJEAx081l5xIa+ZXIP/1QnW01qbYbhjtZng73taeAF
 Fj8WbSsek8NZqkXMFt/BbPhTnC1udTjb60MYp0drW0XZAEyOuU9lPzgDzhq7ktj3
 0ZUhhArnyZAcBHMLstWSlj8m4xNRJIrQkP758nMg5/iUvPL8WEAG2LFhuxxqYK65
 3gCUtxXDoQbmy2F5V/LsCUGC50EiL21rdV0OYhYtevA+dwJwI/p1aCmnFFBCXf+l
 mDolL5F1Kt3PIRPaP5AREqaIBRqUqqs8RL3fA1z60qTLtq7uYlFkAzXNboJrOsWF
 3UG/0EX24xkO98BxEERSNJ04ZFqgf13ut92tWhWKQwvAKn1CGY2iO9oO8OIhWJBY
 F1AV7cRpAwA1wHzbyxk80sMveyd0yuM3VzSLk/iCg6meM1qvfpkaGqAl7i10QJkf
 1eqkDVRlpWzQ9b+0+zM/5/uFO4+dQpHxgw7hyxtL1IPulKNo2RI04If3plXgv+2l
 1iOqDMpit2z8wc/x9CQUaV6BUrdZKSHU1KhRjZlX2qw2KL15UBfozCDdT1+wJ55Q
 XW+UE8+ZbbyfLqi3Y35vTM+mVOL5uUAj+1N0Zo/JjcDiVTBjHhDk4GGPog0e4bG5
 CczqetOIozY7NhACJw5YenNEchDl/3BURRnVMwCaCro38FN8h40psQmcoeXoH3K/
 bJR15rRdoJr/QL1rTNzz
 =YPe6
 -----END PGP SIGNATURE-----

Merge tag 'drm-fixes-2020-01-10' of git://anongit.freedesktop.org/drm/drm

Pull drm fixes from Dave Airlie:
 "Pre-LCA pull request I'm not sure how things will look next week,
  myself and Daniel are at LCA and I'm speaking quite late, so if I get
  my talk finished I'll probably process fixes.

  This week has a bunch of i915 fixes, some amdgpu fixes, one sun4i, one
  core MST, and one core fb_helper fix. More details below:

  core:
   - mst Fix NO_STOP_BIT bit offset (Wayne)

  fb_helper:
   - fb_helper: Fix bits_per_pixel param set behavior to round up
     (Geert)

  sun4i:
   - Fix RGB_DIV clock min divider on old hardware (Chen-Yu)

  amdgpu:
   - Stability fix for raven
   - Reduce pixel encoding to if max clock is exceeded on HDMI to allow
     additional high res modes
   - enable DRIVER_SYNCOBJ_TIMELINE for amdgpu

  i915:
   - Fix GitLab issue #446 causing GPU hangs: Do not restore invalid RS
     state
   - Fix GitLab issue #846: Restore coarse power gating that was
     disabled by initial RC66 context corruption security fixes.
   - Revert f6ec948309 ("drm/i915: extend audio CDCLK>=2*BCLK
     constraint to more platforms") to avoid screen flicker
   - Fix to fill in unitialized uabi_instance in virtual engine uAPI
   - Add two missing W/As for ICL and EHL"

* tag 'drm-fixes-2020-01-10' of git://anongit.freedesktop.org/drm/drm:
  drm/amdgpu: add DRIVER_SYNCOBJ_TIMELINE to amdgpu
  drm/amd/display: Reduce HDMI pixel encoding if max clock is exceeded
  Revert "drm/amdgpu: Set no-retry as default."
  drm/fb-helper: Round up bits_per_pixel if possible
  drm/sun4i: tcon: Set RGB DCLK min. divider based on hardware model
  drm/i915/dp: Disable Port sync mode correctly on teardown
  drm/i915: Add Wa_1407352427:icl,ehl
  drm/i915: Add Wa_1408615072 and Wa_1407596294 to icl,ehl
  drm/i915/gt: Restore coarse power gating
  drm/i915/gt: Do not restore invalid RS state
  drm/i915: Limit audio CDCLK>=2*BCLK constraint back to GLK only
  drm/i915/gt: Mark up virtual engine uabi_instance
  drm/dp_mst: correct the shifting in DP_REMOTE_I2C_READ
2020-01-09 21:37:39 -08:00
Linus Torvalds
5e7c1b75bd First RDMA subsystem updates for 5.5-rc
Five small driver fixes:
 
 - Fix error flow with MR allocation in bnxt_re
 
 - An errata work around for bnxt_re
 
 - Misuse of the workqueue API in hfi1
 
 - Protocol error in hfi1
 
 - Regression in 5.5 related to the mmap rework with i40iw
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEfB7FMLh+8QxL+6i3OG33FX4gmxoFAl4X2boACgkQOG33FX4g
 mxo+iBAAjsaSLD56q9ilUOfrO20/SIFmKL2aG8TkVAbejRIAoPK5d2nqX5pLq1hU
 ezX8SpNkjmwChtfy0BTrJvgEsfZ/qQwee3NOdnFzs0KSccYTy4jDfBfjxSQbO4jH
 aUzznyYuuTPPbf1JgYJcVRVFtgfMKHe7/cC/e+dhoaGkXPYIuFyib0gchQGZOInj
 iVEfZmSp92TrCDXYgGDXA3hqQh9K/MabdXObF8+yXlkVsceKlI9p8prpnCg72+8W
 zQSAdGM1BOttHW8pZZSzWrRMHITwpZ8cQ/+SRu7lZDsZ4zUTY9R/CednwWDxSPOf
 PD1PzRnG/dBVA6E01joiLDTsJack67ExOee0UkqwLvX0kufTIWX1aXOlOE5liafz
 6+3cm+NQg9K4/cjxK+U1LxRE0UhY9fnCsnI9UL/sRtaXAGBG+MSH39icwBJ45jOL
 gaoh1KAbydYviZEMM2MplM8rl3zu3ee3j1PSOE5vY78VKDu3OJpDfrSoisXrSmZ+
 Qptn/FfHOurmnuFABoO4GT1UrsfUFeEDJuJubpCKnpW9JTVR2LpfLicvb5E+XJ3N
 B7l6QqvY7ec6s209sU5CVqyfGhRnE6M0pnpSogrq/hiZSYzg9e49XL53M15bljpT
 /zcCXz1EqoTWF8VDuuIhymm0YZb2c42uAxD4JMwVnbfUycTfWFs=
 =c38z
 -----END PGP SIGNATURE-----

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma

Pull rdma fixes from Jason Gunthorpe:
 "First RDMA subsystem updates for 5.5-rc. A very small set of fixes,
  most people seem to still be recovering from December!

  Five small driver fixes:

   - Fix error flow with MR allocation in bnxt_re

   - An errata work around for bnxt_re

   - Misuse of the workqueue API in hfi1

   - Protocol error in hfi1

   - Regression in 5.5 related to the mmap rework with i40iw"

* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:
  i40iw: Remove setting of VMA private data and use rdma_user_mmap_io
  IB/hfi1: Adjust flow PSN with the correct resync_psn
  IB/hfi1: Don't cancel unused work item
  RDMA/bnxt_re: Fix Send Work Entry state check while polling completions
  RDMA/bnxt_re: Avoid freeing MR resources if dereg fails
2020-01-09 21:03:54 -08:00
Dave Airlie
023b3b0e13 Merge tag 'drm-intel-fixes-2020-01-09-1' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes
- Fix GitLab issue #446 causing GPU hangs: Do not restore invalid RS state
- Fix GitLab issue #846: Restore coarse power gating that was disabled
  by initial RC66 context corruption security fixes.
- Revert f6ec948309 ("drm/i915: extend audio CDCLK>=2*BCLK constraint to more platforms")
  to avoid screen flicker
- Fix to fill in unitialized uabi_instance in virtual engine uAPI
- Add two missing W/As for ICL and EHL

Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20200109133458.GA15558@jlahtine-desk.ger.corp.intel.com
2020-01-10 11:43:02 +10:00
Linus Torvalds
4a3033ef6e GPIO fixes for the v5.5 kernel cycle:
- Select GPIOLIB_IRQCHIP on the max77620 GPIO expander
 - Fix context restore in the Zynq driver
 - Create a new ACPI quirk handler for disabling wakeups on
   problematic hardware.
 - Fix a coding style issue on the mockup device.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEElDRnuGcz/wPCXQWMQRCzN7AZXXMFAl4XoYIACgkQQRCzN7AZ
 XXM7IA//WDmeJw/8yfr5SmbTE6xCLAVR86KEksepNiQkTzgI1FivZ6RNIxxTdHKe
 tcFc3HPyGO6T6Fs7sdUpdQI2RY7JAF4Egr6HItzv/SkYrdsvaQdVr6pRVb0az0Ad
 EymV+Kq2skLsAg4D5nBDYDjUAlLdE/61f/OgaKfJvLAk9hE4lA0Lg19An1BEzfeZ
 oSn26hCfmffRfTW9KCD3xie8j2zzpOR6Nw3LrDmqNF2gk9NiZkU3qIdcqkHUm0TL
 CXRVZjz36pXAwnLn7DUrgEf283lJ4awOM0zZS+YfVJ7v0rcPdvzgwPBNzu85Uvxx
 VrgR1UdEZFx0tW020HUS8dRdBhw6ttopwB6eqSU2r9KX47dhf7w7wV8KaJkG/cUN
 bp9R9TCGH5mFCQMR8owOFqwvjw9uNmcZ4oVpgIXHJ2cMENBRp7WCrV/4y/o8m4sU
 GTAJx/AYoUxro68trPWMLcQkA+qV7qESScxG0DsRZ5kflIbV1mS8n5K+yc0KwgXf
 +a39wSQxTTXT1bW+qy8jSGFr8+hbvQ/plTRnNa+aIlx89yYfY4WrMgcp0GwUGSc7
 GkEw58w7wrqgTRy2oF3IFnagX3x8rmUmeZU7Yjkhl4xjbX5Le/6awDX0HlRnVSg9
 tN8dVbQkzuB8KU6ewQjn2cuFhEN+Xoc5NPO9fQyli2MdlKUcHDI=
 =IbMi
 -----END PGP SIGNATURE-----

Merge tag 'gpio-v5.5-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio

Pull GPIO fixes from Linus Walleij:
 "Here is a host of GPIO fixes for the v5.5 series. The ACPI fix is
  especially important, see summary below and in the commit for details:

   - Select GPIOLIB_IRQCHIP on the max77620 GPIO expander

   - Fix context restore in the Zynq driver

   - Create a new ACPI quirk handler for disabling wakeups on
     problematic hardware.

   - Fix a coding style issue on the mockup device"

* tag 'gpio-v5.5-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio:
  gpiolib: acpi: Add honor_wakeup module-option + quirk mechanism
  gpiolib: acpi: Turn dmi_system_id table into a generic quirk table
  gpio: zynq: Fix for bug in zynq_gpio_restore_context API
  gpio: max77620: Add missing dependency on GPIOLIB_IRQCHIP
  gpio: mockup: fix coding style
2020-01-09 15:43:35 -08:00
Linus Torvalds
a6a55b52a1 Pin control fixes for the v5.5 kernel cycle:
- Fix erroneous shift in the Meson driver
 
 - Make Lochnagar select the GPIOLIB Kconfig symbol
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEElDRnuGcz/wPCXQWMQRCzN7AZXXMFAl4Xn0cACgkQQRCzN7AZ
 XXNaGxAAq0eXTVJmO7Q3fuP/68xPDZz/wHjMmQOaAkKS7elltAS1DHGFsQuzqRzF
 YGEPC1OFJ1J0aWnlpN7xTeKEZloZl6f5CV9RiD1T6so+gz2Dx0sCmQbSdebKtO9H
 0ycKpwnZvKe7V1MpeK8d/4iMcNvOW2l9OsdQl9GfOYEp/HdGjZsIpY1lfzfRKqmC
 tQyjmtcNe+xWlkA2Bktx3PzDam+qh03aAUyJA+xEDGJY+JrNvK3OPEdU76fN9b14
 QLM9bCgIA16CsbRhkyGr9skuaPU10PHYYcEj3/uzn51yKCEnM7wLtoXVkJpSuNfM
 +5n9Hee53Bcn25UOKGSTyq5ZT9Gi7l4ISIm4MbbLOSPIlKP91ISExN7Um9+cMxS1
 dSyKhHrKqxao6WDf8eKIa1txNOu8/HhU5V1562sMDQwjNk+LdDEhXB+QEUcAjeOW
 MmvRb3/2PZMVVvf7wV7asnVxw/iOtuqfJfA4gHi+yUZ1rrLgNiXJqtvCa7FUT9UP
 BaF9VY84U6xsymQTxMiur9kMn7RyXNcQk6oKLoFo2jC9bafK2qIf7dGgJdEifrr8
 F06vSqiMmDxYzXPDB4RLC0zbhwGTwSvDiLACBUeb2PvkMvGyeZ0cVIaAsuSDHxaC
 D5J2/dz46loW97oMq9HF+5cReXbZlvDNj6klOC97KHioLlAdJtA=
 =OF8o
 -----END PGP SIGNATURE-----

Merge tag 'pinctrl-v5.5-4' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl

Pull pin control fixes from Linus Walleij:
 "Two fixes for pin control, not much to say about it, it's just regular
  driver fixes:

   - Fix erroneous shift in the Meson driver

   - Make Lochnagar select the GPIOLIB Kconfig symbol"

* tag 'pinctrl-v5.5-4' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:
  pinctrl: meson: Fix wrong shift value when get drive-strength
  pinctrl: lochnagar: select GPIOLIB
2020-01-09 15:41:54 -08:00
Linus Torvalds
b5b3159cff Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
Pull input fixes from Dmitry Torokhov:
 "Just a few small fixups here"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: imx_sc_key - only take the valid data from SCU firmware as key state
  Input: add safety guards to input_set_keycode()
  Input: input_event - fix struct padding on sparc64
  Input: uinput - always report EPOLLOUT
2020-01-09 15:37:40 -08:00
Linus Torvalds
e69ec487b2 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid
Pull HID fixes from Jiri Kosina:

 - fix for OOB in hiddev, from Dmitry Torokhov

 - _poll API fixes for hidraw, from Marcel Holtmann

 - functional fix for Steam driver, from Rodrigo Rivas Costa

 - a few new device IDs / device-specific quirks and other assorted
   smaller fixes

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid:
  HID: steam: Fix input device disappearing
  HID: intel-ish-hid: ipc: Add Tiger Lake PCI device ID
  drivers/hid/hid-multitouch.c: fix a possible null pointer access.
  HID: wacom: Recognize new MobileStudio Pro PID
  HID: intel-ish-hid: ipc: add CMP device id
  HID: hiddev: fix mess in hiddev_open()
  HID: hid-input: clear unmapped usages
  HID: Add quirk for incorrect input length on Lenovo Y720
  HID: asus: Ignore Asus vendor-page usage-code 0xff events
  HID: ite: Add USB id match for Acer SW5-012 keyboard dock
  HID: Add quirk for Xin-Mo Dual Controller
  HID: Fix slab-out-of-bounds read in hid_field_extract
  HID: multitouch: Add LG MELF0410 I2C touchscreen support
  HID: uhid: Fix returning EPOLLOUT from uhid_char_poll
  HID: hidraw: Fix returning EPOLLOUT from hidraw_poll
2020-01-09 10:51:22 -08:00
Linus Torvalds
a5f48c7878 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Pull networking fixes from David Miller:

 1) Missing netns pointer init in arp_tables, from Florian Westphal.

 2) Fix normal tcp SACK being treated as D-SACK, from Pengcheng Yang.

 3) Fix divide by zero in sch_cake, from Wen Yang.

 4) Len passed to skb_put_padto() is wrong in qrtr code, from Carl
    Huang.

 5) cmd->obj.chunk is leaked in sctp code error paths, from Xin Long.

 6) cgroup bpf programs can be released out of order, fix from Roman
    Gushchin.

 7) Make sure stmmac debugfs entry name is changed when device name
    changes, from Jiping Ma.

 8) Fix memory leak in vlan_dev_set_egress_priority(), from Eric
    Dumazet.

 9) SKB leak in lan78xx usb driver, also from Eric Dumazet.

10) Ridiculous TCA_FQ_QUANTUM values configured can cause loops in fq
    packet scheduler, reject them. From Eric Dumazet.

* git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (69 commits)
  tipc: fix wrong connect() return code
  tipc: fix link overflow issue at socket shutdown
  netfilter: ipset: avoid null deref when IPSET_ATTR_LINENO is present
  netfilter: conntrack: dccp, sctp: handle null timeout argument
  atm: eni: fix uninitialized variable warning
  macvlan: do not assume mac_header is set in macvlan_broadcast()
  net: sch_prio: When ungrafting, replace with FIFO
  mlxsw: spectrum_qdisc: Ignore grafting of invisible FIFO
  MAINTAINERS: Remove myself as co-maintainer for qcom-ethqos
  gtp: fix bad unlock balance in gtp_encap_enable_socket
  pkt_sched: fq: do not accept silly TCA_FQ_QUANTUM
  tipc: remove meaningless assignment in Makefile
  tipc: do not add socket.o to tipc-y twice
  net: stmmac: dwmac-sun8i: Allow all RGMII modes
  net: stmmac: dwmac-sunxi: Allow all RGMII modes
  net: usb: lan78xx: fix possible skb leak
  net: stmmac: Fixed link does not need MDIO Bus
  vlan: vlan_changelink() should propagate errors
  vlan: fix memory leak in vlan_dev_set_egress_priority
  stmmac: debugfs entry name is not be changed when udev rename device name.
  ...
2020-01-09 10:34:07 -08:00
Rodrigo Rivas Costa
20eee6e5af HID: steam: Fix input device disappearing
The `connected` value for wired devices was not properly initialized,
it must be set to `true` upon creation, because wired devices do not
generate connection events.

When a raw client (the Steam Client) uses the device, the input device
is destroyed. Then, when the raw client finishes, it must be recreated.
But since the `connected` variable was false this never happended.

Signed-off-by: Rodrigo Rivas Costa <rodrigorivascosta@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2020-01-09 10:57:41 +01:00
Dave Airlie
ac0c9d3f8a Merge tag 'amd-drm-fixes-5.5-2020-01-08' of git://people.freedesktop.org/~agd5f/linux into drm-fixes
amd-drm-fixes-5.5-2020-01-08:

amdgpu:
- Stability fix for raven
- Reduce pixel encoding to if max clock is exceeded on HDMI
  to allow additional high res modes

UAPI:
- enable DRIVER_SYNCOBJ_TIMELINE for amdgpu

Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Alex Deucher <alexdeucher@gmail.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20200108213649.5485-1-alexander.deucher@amd.com
2020-01-09 12:32:06 +10:00
Dave Airlie
2c3addd839 -mst: Fix NO_STOP_BIT bit offset (Wayne)
-sun4i: Fix RGB_DIV clock min divider on old hardware (Chen-Yu)
 -fb_helper: Fix bits_per_pixel param set behavior to round up (Geert)
 
 Cc: Wayne Lin <Wayne.Lin@amd.com>
 Cc: Chen-Yu Tsai <wens@csie.org>
 Cc: Geert Uytterhoeven <geert+renesas@glider.be>
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEHF6rntfJ3enn8gh8cywAJXLcr3kFAl4WQl4ACgkQcywAJXLc
 r3kQYwf7Bb+9TIlGf2WTWHbkoPdCN3qgu5XHWGbMv4OjcBVMeBE1+Lx4X5ihwFkC
 DuRKvlnW9gfMJg9l+i1PdYuBMFUlcGg3pBmdBEdz0eIZfP0ZL3J9J/s6oZSwuz4v
 TDWQEXKD+9MRmR3MtW+C8qIf6EevWHaVZpvvKhmVjf9Sredm2gEQwkBpUXSGGJ/w
 FBhvC4zL/iLQOp3wX0sjdnfBc6uXM7JB+mHMXTcAJ3eey9HGAQXQvbWROaTCKuGq
 L5hdz4RMiJ8+gTO9tZ6dzlfzZdY/wTQgwdVw3yVeGfeeC32VOjsUGWI5Jpb/SA03
 gcHwNt/tMXZ8c0TCq5QNGAoTWUcrrg==
 =4GUy
 -----END PGP SIGNATURE-----

Merge tag 'drm-misc-fixes-2020-01-08' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes

mst: Fix NO_STOP_BIT bit offset (Wayne)
sun4i: Fix RGB_DIV clock min divider on old hardware (Chen-Yu)
fb_helper: Fix bits_per_pixel param set behavior to round up (Geert)

Cc: Wayne Lin <Wayne.Lin@amd.com>
Cc: Chen-Yu Tsai <wens@csie.org>
Cc: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Sean Paul <sean@poorly.run>
Link: https://patchwork.freedesktop.org/patch/msgid/20200108205949.GA233273@art_vandelay
2020-01-09 12:24:03 +10:00
Kees Cook
e163fdb3f7 pstore/ram: Regularize prz label allocation lifetime
In my attempt to fix a memory leak, I introduced a double-free in the
pstore error path. Instead of trying to manage the allocation lifetime
between persistent_ram_new() and its callers, adjust the logic so
persistent_ram_new() always takes a kstrdup() copy, and leaves the
caller's allocation lifetime up to the caller. Therefore callers are
_always_ responsible for freeing their label. Before, it only needed
freeing when the prz itself failed to allocate, and not in any of the
other prz failure cases, which callers would have no visibility into,
which is the root design problem that lead to both the leak and now
double-free bugs.

Reported-by: Cengiz Can <cengiz@kernel.wtf>
Link: https://lore.kernel.org/lkml/d4ec59002ede4aaf9928c7f7526da87c@kernel.wtf
Fixes: 8df955a32a ("pstore/ram: Fix error-path memory leak in persistent_ram_new() callers")
Cc: stable@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
2020-01-08 17:05:45 -08:00
Tuong Lien
9546a0b7ce tipc: fix wrong connect() return code
The current 'tipc_wait_for_connect()' function does a wait-loop for the
condition 'sk->sk_state != TIPC_CONNECTING' to conclude if the socket
connecting has done. However, when the condition is met, it returns '0'
even in the case the connecting is actually failed, the socket state is
set to 'TIPC_DISCONNECTING' (e.g. when the server socket has closed..).
This results in a wrong return code for the 'connect()' call from user,
making it believe that the connection is established and go ahead with
building, sending a message, etc. but finally failed e.g. '-EPIPE'.

This commit fixes the issue by changing the wait condition to the
'tipc_sk_connected(sk)', so the function will return '0' only when the
connection is really established. Otherwise, either the socket 'sk_err'
if any or '-ETIMEDOUT'/'-EINTR' will be returned correspondingly.

Acked-by: Ying Xue <ying.xue@windriver.com>
Acked-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: Tuong Lien <tuong.t.lien@dektech.com.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-01-08 15:57:35 -08:00
Tuong Lien
49afb806cb tipc: fix link overflow issue at socket shutdown
When a socket is suddenly shutdown or released, it will reject all the
unreceived messages in its receive queue. This applies to a connected
socket too, whereas there is only one 'FIN' message required to be sent
back to its peer in this case.

In case there are many messages in the queue and/or some connections
with such messages are shutdown at the same time, the link layer will
easily get overflowed at the 'TIPC_SYSTEM_IMPORTANCE' backlog level
because of the message rejections. As a result, the link will be taken
down. Moreover, immediately when the link is re-established, the socket
layer can continue to reject the messages and the same issue happens...

The commit refactors the '__tipc_shutdown()' function to only send one
'FIN' in the situation mentioned above. For the connectionless case, it
is unavoidable but usually there is no rejections for such socket
messages because they are 'dest-droppable' by default.

In addition, the new code makes the other socket states clear
(e.g.'TIPC_LISTEN') and treats as a separate case to avoid misbehaving.

Acked-by: Ying Xue <ying.xue@windriver.com>
Acked-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: Tuong Lien <tuong.t.lien@dektech.com.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-01-08 15:57:07 -08:00
David S. Miller
b73a65610b Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf
Pablo Neira Ayuso says:

====================
Netfilter fixes for net

The following patchset contains Netfilter fixes for net:

1) Missing netns context in arp_tables, from Florian Westphal.

2) Underflow in flowtable reference counter, from wenxu.

3) Fix incorrect ethernet destination address in flowtable offload,
   from wenxu.

4) Check for status of neighbour entry, from wenxu.

5) Fix NAT port mangling, from wenxu.

6) Unbind callbacks from destroy path to cleanup hardware properly
   on flowtable removal.

7) Fix missing casting statistics timestamp, add nf_flowtable_time_stamp
   and use it.

8) NULL pointer exception when timeout argument is null in conntrack
   dccp and sctp protocol helpers, from Florian Westphal.

9) Possible nul-dereference in ipset with IPSET_ATTR_LINENO, also from
   Florian.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2020-01-08 15:22:41 -08:00
Florian Westphal
22dad713b8 netfilter: ipset: avoid null deref when IPSET_ATTR_LINENO is present
The set uadt functions assume lineno is never NULL, but it is in
case of ip_set_utest().

syzkaller managed to generate a netlink message that calls this with
LINENO attr present:

general protection fault: 0000 [#1] PREEMPT SMP KASAN
RIP: 0010:hash_mac4_uadt+0x1bc/0x470 net/netfilter/ipset/ip_set_hash_mac.c:104
Call Trace:
 ip_set_utest+0x55b/0x890 net/netfilter/ipset/ip_set_core.c:1867
 nfnetlink_rcv_msg+0xcf2/0xfb0 net/netfilter/nfnetlink.c:229
 netlink_rcv_skb+0x177/0x450 net/netlink/af_netlink.c:2477
 nfnetlink_rcv+0x1ba/0x460 net/netfilter/nfnetlink.c:563

pass a dummy lineno storage, its easier than patching all set
implementations.

This seems to be a day-0 bug.

Cc: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Reported-by: syzbot+34bd2369d38707f3f4a7@syzkaller.appspotmail.com
Fixes: a7b4f989a6 ("netfilter: ipset: IP set core support")
Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2020-01-08 23:31:46 +01:00
Florian Westphal
1d9a7acd3d netfilter: conntrack: dccp, sctp: handle null timeout argument
The timeout pointer can be NULL which means we should modify the
per-nets timeout instead.

All do this, except sctp and dccp which instead give:

general protection fault: 0000 [#1] PREEMPT SMP KASAN
net/netfilter/nf_conntrack_proto_dccp.c:682
 ctnl_timeout_parse_policy+0x150/0x1d0 net/netfilter/nfnetlink_cttimeout.c:67
 cttimeout_default_set+0x150/0x1c0 net/netfilter/nfnetlink_cttimeout.c:368
 nfnetlink_rcv_msg+0xcf2/0xfb0 net/netfilter/nfnetlink.c:229
 netlink_rcv_skb+0x177/0x450 net/netlink/af_netlink.c:2477

Reported-by: syzbot+46a4ad33f345d1dd346e@syzkaller.appspotmail.com
Fixes: c779e84960 ("netfilter: conntrack: remove get_timeout() indirection")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2020-01-08 23:31:22 +01:00
Arnd Bergmann
30780d086a atm: eni: fix uninitialized variable warning
With -O3, gcc has found an actual unintialized variable stored
into an mmio register in two instances:

drivers/atm/eni.c: In function 'discard':
drivers/atm/eni.c:465:13: error: 'dma[1]' is used uninitialized in this function [-Werror=uninitialized]
   writel(dma[i*2+1],eni_dev->rx_dma+dma_wr*8+4);
             ^
drivers/atm/eni.c:465:13: error: 'dma[3]' is used uninitialized in this function [-Werror=uninitialized]

Change the code to always write zeroes instead.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-01-08 13:11:00 -08:00
Eric Dumazet
96cc4b6958 macvlan: do not assume mac_header is set in macvlan_broadcast()
Use of eth_hdr() in tx path is error prone.

Many drivers call skb_reset_mac_header() before using it,
but others do not.

Commit 6d1ccff627 ("net: reset mac header in dev_start_xmit()")
attempted to fix this generically, but commit d346a3fae3
("packet: introduce PACKET_QDISC_BYPASS socket option") brought
back the macvlan bug.

Lets add a new helper, so that tx paths no longer have
to call skb_reset_mac_header() only to get a pointer
to skb->data.

Hopefully we will be able to revert 6d1ccff627
("net: reset mac header in dev_start_xmit()") and save few cycles
in transmit fast path.

BUG: KASAN: use-after-free in __get_unaligned_cpu32 include/linux/unaligned/packed_struct.h:19 [inline]
BUG: KASAN: use-after-free in mc_hash drivers/net/macvlan.c:251 [inline]
BUG: KASAN: use-after-free in macvlan_broadcast+0x547/0x620 drivers/net/macvlan.c:277
Read of size 4 at addr ffff8880a4932401 by task syz-executor947/9579

CPU: 0 PID: 9579 Comm: syz-executor947 Not tainted 5.5.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x197/0x210 lib/dump_stack.c:118
 print_address_description.constprop.0.cold+0xd4/0x30b mm/kasan/report.c:374
 __kasan_report.cold+0x1b/0x41 mm/kasan/report.c:506
 kasan_report+0x12/0x20 mm/kasan/common.c:639
 __asan_report_load_n_noabort+0xf/0x20 mm/kasan/generic_report.c:145
 __get_unaligned_cpu32 include/linux/unaligned/packed_struct.h:19 [inline]
 mc_hash drivers/net/macvlan.c:251 [inline]
 macvlan_broadcast+0x547/0x620 drivers/net/macvlan.c:277
 macvlan_queue_xmit drivers/net/macvlan.c:520 [inline]
 macvlan_start_xmit+0x402/0x77f drivers/net/macvlan.c:559
 __netdev_start_xmit include/linux/netdevice.h:4447 [inline]
 netdev_start_xmit include/linux/netdevice.h:4461 [inline]
 dev_direct_xmit+0x419/0x630 net/core/dev.c:4079
 packet_direct_xmit+0x1a9/0x250 net/packet/af_packet.c:240
 packet_snd net/packet/af_packet.c:2966 [inline]
 packet_sendmsg+0x260d/0x6220 net/packet/af_packet.c:2991
 sock_sendmsg_nosec net/socket.c:639 [inline]
 sock_sendmsg+0xd7/0x130 net/socket.c:659
 __sys_sendto+0x262/0x380 net/socket.c:1985
 __do_sys_sendto net/socket.c:1997 [inline]
 __se_sys_sendto net/socket.c:1993 [inline]
 __x64_sys_sendto+0xe1/0x1a0 net/socket.c:1993
 do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x442639
Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 5b 10 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffc13549e08 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000442639
RDX: 000000000000000e RSI: 0000000020000080 RDI: 0000000000000003
RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000403bb0 R14: 0000000000000000 R15: 0000000000000000

Allocated by task 9389:
 save_stack+0x23/0x90 mm/kasan/common.c:72
 set_track mm/kasan/common.c:80 [inline]
 __kasan_kmalloc mm/kasan/common.c:513 [inline]
 __kasan_kmalloc.constprop.0+0xcf/0xe0 mm/kasan/common.c:486
 kasan_kmalloc+0x9/0x10 mm/kasan/common.c:527
 __do_kmalloc mm/slab.c:3656 [inline]
 __kmalloc+0x163/0x770 mm/slab.c:3665
 kmalloc include/linux/slab.h:561 [inline]
 tomoyo_realpath_from_path+0xc5/0x660 security/tomoyo/realpath.c:252
 tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
 tomoyo_path_perm+0x230/0x430 security/tomoyo/file.c:822
 tomoyo_inode_getattr+0x1d/0x30 security/tomoyo/tomoyo.c:129
 security_inode_getattr+0xf2/0x150 security/security.c:1222
 vfs_getattr+0x25/0x70 fs/stat.c:115
 vfs_statx_fd+0x71/0xc0 fs/stat.c:145
 vfs_fstat include/linux/fs.h:3265 [inline]
 __do_sys_newfstat+0x9b/0x120 fs/stat.c:378
 __se_sys_newfstat fs/stat.c:375 [inline]
 __x64_sys_newfstat+0x54/0x80 fs/stat.c:375
 do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

Freed by task 9389:
 save_stack+0x23/0x90 mm/kasan/common.c:72
 set_track mm/kasan/common.c:80 [inline]
 kasan_set_free_info mm/kasan/common.c:335 [inline]
 __kasan_slab_free+0x102/0x150 mm/kasan/common.c:474
 kasan_slab_free+0xe/0x10 mm/kasan/common.c:483
 __cache_free mm/slab.c:3426 [inline]
 kfree+0x10a/0x2c0 mm/slab.c:3757
 tomoyo_realpath_from_path+0x1a7/0x660 security/tomoyo/realpath.c:289
 tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
 tomoyo_path_perm+0x230/0x430 security/tomoyo/file.c:822
 tomoyo_inode_getattr+0x1d/0x30 security/tomoyo/tomoyo.c:129
 security_inode_getattr+0xf2/0x150 security/security.c:1222
 vfs_getattr+0x25/0x70 fs/stat.c:115
 vfs_statx_fd+0x71/0xc0 fs/stat.c:145
 vfs_fstat include/linux/fs.h:3265 [inline]
 __do_sys_newfstat+0x9b/0x120 fs/stat.c:378
 __se_sys_newfstat fs/stat.c:375 [inline]
 __x64_sys_newfstat+0x54/0x80 fs/stat.c:375
 do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

The buggy address belongs to the object at ffff8880a4932000
 which belongs to the cache kmalloc-4k of size 4096
The buggy address is located 1025 bytes inside of
 4096-byte region [ffff8880a4932000, ffff8880a4933000)
The buggy address belongs to the page:
page:ffffea0002924c80 refcount:1 mapcount:0 mapping:ffff8880aa402000 index:0x0 compound_mapcount: 0
raw: 00fffe0000010200 ffffea0002846208 ffffea00028f3888 ffff8880aa402000
raw: 0000000000000000 ffff8880a4932000 0000000100000001 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8880a4932300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8880a4932380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8880a4932400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                   ^
 ffff8880a4932480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8880a4932500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb

Fixes: b863ceb7dd ("[NET]: Add macvlan driver")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-01-08 12:52:33 -08:00
David S. Miller
2f806c2a16 Merge branch 'net-ungraft-prio'
Petr Machata says:

====================
When ungrafting from PRIO, replace child with FIFO

When a child Qdisc is removed from one of the PRIO Qdisc's bands, it is
replaced unconditionally by a NOOP qdisc. As a result, any traffic hitting
that band gets dropped. That is incorrect--no Qdisc was explicitly added
when PRIO was created, and after removal, none should have to be added
either.

In patch #2, this problem is fixed for PRIO by first attempting to create a
default Qdisc and only falling back to noop when that fails. This pattern
of attempting to create an invisible FIFO, using NOOP only as a fallback,
is also seen in some other Qdiscs.

The only driver currently offloading PRIO (and thus presumably the only one
impacted by this) is mlxsw. Therefore patch #1 extends mlxsw to handle the
replacement by an invisible FIFO gracefully.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2020-01-08 12:45:53 -08:00
Petr Machata
240ce7f642 net: sch_prio: When ungrafting, replace with FIFO
When a child Qdisc is removed from one of the PRIO Qdisc's bands, it is
replaced unconditionally by a NOOP qdisc. As a result, any traffic hitting
that band gets dropped. That is incorrect--no Qdisc was explicitly added
when PRIO was created, and after removal, none should have to be added
either.

Fix PRIO by first attempting to create a default Qdisc and only falling
back to noop when that fails. This pattern of attempting to create an
invisible FIFO, using NOOP only as a fallback, is also seen in other
Qdiscs.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Petr Machata <petrm@mellanox.com>
Acked-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-01-08 12:45:53 -08:00
Petr Machata
3971a535b8 mlxsw: spectrum_qdisc: Ignore grafting of invisible FIFO
The following patch will change PRIO to replace a removed Qdisc with an
invisible FIFO, instead of NOOP. mlxsw will see this replacement due to the
graft message that is generated. But because FIFO does not issue its own
REPLACE message, when the graft operation takes place, the Qdisc that mlxsw
tracks under the indicated band is still the old one. The child
handle (0:0) therefore does not match, and mlxsw rejects the graft
operation, which leads to an extack message:

    Warning: Offloading graft operation failed.

Fix by ignoring the invisible children in the PRIO graft handler. The
DESTROY message of the removed Qdisc is going to follow shortly and handle
the removal.

Fixes: 32dc5efc6c ("mlxsw: spectrum: qdiscs: prio: Handle graft command")
Signed-off-by: Petr Machata <petrm@mellanox.com>
Acked-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-01-08 12:45:52 -08:00
Niklas Cassel
cb6f74a1ea MAINTAINERS: Remove myself as co-maintainer for qcom-ethqos
As I am no longer with Linaro, I no longer have access to documentation
for this IP. The Linaro email will start bouncing soon.

Vinod is fully capable to maintain this driver by himself, therefore
remove myself as co-maintainer for qcom-ethqos.

Signed-off-by: Niklas Cassel <niklas.cassel@wdc.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-01-08 12:44:21 -08:00
Eric Dumazet
90d72256ad gtp: fix bad unlock balance in gtp_encap_enable_socket
WARNING: bad unlock balance detected!
5.5.0-rc5-syzkaller #0 Not tainted
-------------------------------------
syz-executor921/9688 is trying to release lock (sk_lock-AF_INET6) at:
[<ffffffff84bf8506>] gtp_encap_enable_socket+0x146/0x400 drivers/net/gtp.c:830
but there are no more locks to release!

other info that might help us debug this:
2 locks held by syz-executor921/9688:
 #0: ffffffff8a4d8840 (rtnl_mutex){+.+.}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
 #0: ffffffff8a4d8840 (rtnl_mutex){+.+.}, at: rtnetlink_rcv_msg+0x405/0xaf0 net/core/rtnetlink.c:5421
 #1: ffff88809304b560 (slock-AF_INET6){+...}, at: spin_lock_bh include/linux/spinlock.h:343 [inline]
 #1: ffff88809304b560 (slock-AF_INET6){+...}, at: release_sock+0x20/0x1c0 net/core/sock.c:2951

stack backtrace:
CPU: 0 PID: 9688 Comm: syz-executor921 Not tainted 5.5.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x197/0x210 lib/dump_stack.c:118
 print_unlock_imbalance_bug kernel/locking/lockdep.c:4008 [inline]
 print_unlock_imbalance_bug.cold+0x114/0x123 kernel/locking/lockdep.c:3984
 __lock_release kernel/locking/lockdep.c:4242 [inline]
 lock_release+0x5f2/0x960 kernel/locking/lockdep.c:4503
 sock_release_ownership include/net/sock.h:1496 [inline]
 release_sock+0x17c/0x1c0 net/core/sock.c:2961
 gtp_encap_enable_socket+0x146/0x400 drivers/net/gtp.c:830
 gtp_encap_enable drivers/net/gtp.c:852 [inline]
 gtp_newlink+0x9fc/0xc60 drivers/net/gtp.c:666
 __rtnl_newlink+0x109e/0x1790 net/core/rtnetlink.c:3305
 rtnl_newlink+0x69/0xa0 net/core/rtnetlink.c:3363
 rtnetlink_rcv_msg+0x45e/0xaf0 net/core/rtnetlink.c:5424
 netlink_rcv_skb+0x177/0x450 net/netlink/af_netlink.c:2477
 rtnetlink_rcv+0x1d/0x30 net/core/rtnetlink.c:5442
 netlink_unicast_kernel net/netlink/af_netlink.c:1302 [inline]
 netlink_unicast+0x58c/0x7d0 net/netlink/af_netlink.c:1328
 netlink_sendmsg+0x91c/0xea0 net/netlink/af_netlink.c:1917
 sock_sendmsg_nosec net/socket.c:639 [inline]
 sock_sendmsg+0xd7/0x130 net/socket.c:659
 ____sys_sendmsg+0x753/0x880 net/socket.c:2330
 ___sys_sendmsg+0x100/0x170 net/socket.c:2384
 __sys_sendmsg+0x105/0x1d0 net/socket.c:2417
 __do_sys_sendmsg net/socket.c:2426 [inline]
 __se_sys_sendmsg net/socket.c:2424 [inline]
 __x64_sys_sendmsg+0x78/0xb0 net/socket.c:2424
 do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x445d49
Code: e8 bc b7 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b 12 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f8019074db8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00000000006dac38 RCX: 0000000000445d49
RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000003
RBP: 00000000006dac30 R08: 0000000000000004 R09: 0000000000000000
R10: 0000000000000008 R11: 0000000000000246 R12: 00000000006dac3c
R13: 00007ffea687f6bf R14: 00007f80190759c0 R15: 20c49ba5e353f7cf

Fixes: e198987e7d ("gtp: fix suspicious RCU usage")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Cc: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-01-08 12:42:49 -08:00
Eric Dumazet
d9e15a2733 pkt_sched: fq: do not accept silly TCA_FQ_QUANTUM
As diagnosed by Florian :

If TCA_FQ_QUANTUM is set to 0x80000000, fq_deueue()
can loop forever in :

if (f->credit <= 0) {
  f->credit += q->quantum;
  goto begin;
}

... because f->credit is either 0 or -2147483648.

Let's limit TCA_FQ_QUANTUM to no more than 1 << 20 :
This max value should limit risks of breaking user setups
while fixing this bug.

Fixes: afe4fd0624 ("pkt_sched: fq: Fair Queue packet scheduler")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Diagnosed-by: Florian Westphal <fw@strlen.de>
Reported-by: syzbot+dc9071cc5a85950bdfce@syzkaller.appspotmail.com
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-01-08 12:40:47 -08:00
Masahiro Yamada
b969fee12b tipc: remove meaningless assignment in Makefile
There is no module named tipc_diag.

The assignment to tipc_diag-y has no effect.

Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-01-08 12:38:54 -08:00
Masahiro Yamada
ea04b445a2 tipc: do not add socket.o to tipc-y twice
net/tipc/Makefile adds socket.o twice.

tipc-y	+= addr.o bcast.o bearer.o \
           core.o link.o discover.o msg.o  \
           name_distr.o  subscr.o monitor.o name_table.o net.o  \
           netlink.o netlink_compat.o node.o socket.o eth_media.o \
                                             ^^^^^^^^
           topsrv.o socket.o group.o trace.o
                    ^^^^^^^^

Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-01-08 12:38:54 -08:00
Chen-Yu Tsai
f1239d8aa8 net: stmmac: dwmac-sun8i: Allow all RGMII modes
Allow all the RGMII modes to be used. This would allow us to represent
the hardware better in the device tree with RGMII_ID where in most
cases the PHY's internal delay for both RX and TX are used.

Fixes: 9f93ac8d40 ("net-next: stmmac: Add dwmac-sun8i")
Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-01-08 12:31:25 -08:00
Chen-Yu Tsai
52cc73e540 net: stmmac: dwmac-sunxi: Allow all RGMII modes
Allow all the RGMII modes to be used. This would allow us to represent
the hardware better in the device tree with RGMII_ID where in most
cases the PHY's internal delay for both RX and TX are used.

Fixes: af0bd4e9ba ("net: stmmac: sunxi platform extensions for GMAC in Allwinner A20 SoC's")
Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-01-08 12:30:19 -08:00
Kai Vehmanen
8e85def572 ALSA: hda: enable regmap internal locking
This reverts commit 42ec336f1f ("ALSA: hda: Disable regmap
internal locking").

Without regmap locking, there is a race between snd_hda_codec_amp_init()
and PM callbacks issuing regcache_sync(). This was caught by
following kernel warning trace:

<4> [358.080081] WARNING: CPU: 2 PID: 4157 at drivers/base/regmap/regcache.c:498 regcache_cache_only+0xf5/0x130
[...]
<4> [358.080148] Call Trace:
<4> [358.080158]  snd_hda_codec_amp_init+0x4e/0x100 [snd_hda_codec]
<4> [358.080169]  snd_hda_codec_amp_init_stereo+0x40/0x80 [snd_hda_codec]

Suggested-by: Takashi Iwai <tiwai@suse.de>
BugLink: https://gitlab.freedesktop.org/drm/intel/issues/592
Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
Link: https://lore.kernel.org/r/20200108180856.5194-1-kai.vehmanen@linux.intel.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2020-01-08 20:10:08 +01:00
Linus Torvalds
b07f636fca tpmdd fixes for Linux v5.5-rc6 part 2
-----BEGIN PGP SIGNATURE-----
 
 iJYEABYIAD4WIQRE6pSOnaBC00OEHEIaerohdGur0gUCXhX/xyAcamFya2tvLnNh
 a2tpbmVuQGxpbnV4LmludGVsLmNvbQAKCRAaerohdGur0rWzAQCWBxqWAa9FCR+O
 UnoTOUKxAXKS2tZ9zaiIMPUkqHxvugEAjlMkcpMERDuHX40m1WyE6Q0mPaFXxLVp
 yc1Wc5dTNQw=
 =lKXu
 -----END PGP SIGNATURE-----

Merge tag 'tpmdd-next-20200108' of git://git.infradead.org/users/jjs/linux-tpmdd

Pull more tpmd fixes from Jarkko Sakkinen:
 "One critical regression fix (the faulty commit got merged in rc3, but
  also marked for stable)"

* tag 'tpmdd-next-20200108' of git://git.infradead.org/users/jjs/linux-tpmdd:
  tpm: Handle negative priv->response_len in tpm_common_read()
2020-01-08 09:26:33 -08:00
Tadeusz Struk
a430e67d9a tpm: Handle negative priv->response_len in tpm_common_read()
The priv->response_length can hold the size of an response or an negative
error code, and the tpm_common_read() needs to handle both cases correctly.
Changed the type of response_length to signed and accounted for negative
value in tpm_common_read().

Cc: stable@vger.kernel.org
Fixes: d23d124843 ("tpm: fix invalid locking in NONBLOCKING mode")
Reported-by: Laura Abbott <labbott@redhat.com>
Signed-off-by: Tadeusz Struk <tadeusz.struk@intel.com>
Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
2020-01-08 18:11:09 +02:00
Kailang Yang
54a6a7dc10 ALSA: hda/realtek - Add quirk for the bass speaker on Lenovo Yoga X1 7th gen
Add quirk to ALC285_FIXUP_SPEAKER2_TO_DAC1, which is the same fixup
applied for X1 Carbon 7th gen in commit d2cd795c4e ("ALSA: hda -
fixup for the bass speaker on Lenovo Carbon X1 7th gen").

Signed-off-by: Kailang Yang <kailang@realtek.com>
Reviewed-by: Jaroslav Kysela <perex@perex.cz>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2020-01-08 10:46:33 +01:00
Kailang Yang
9194a1ebbc ALSA: hda/realtek - Set EAPD control to default for ALC222
Set EAPD control to verb control.

Signed-off-by: Kailang Yang <kailang@realtek.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2020-01-08 09:48:36 +01:00
Eric Dumazet
47240ba0cd net: usb: lan78xx: fix possible skb leak
If skb_linearize() fails, we need to free the skb.

TSO makes skb bigger, and this bug might be the reason
Raspberry Pi 3B+ users had to disable TSO.

Fixes: 55d7de9de6 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: RENARD Pierre-Francois <pfrenard@gmail.com>
Cc: Stefan Wahren <stefan.wahren@i2se.com>
Cc: Woojung Huh <woojung.huh@microchip.com>
Cc: Microchip Linux Driver Support <UNGLinuxDriver@microchip.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-01-07 14:09:28 -08:00
Jose Abreu
da29f2d84b net: stmmac: Fixed link does not need MDIO Bus
When using fixed link we don't need the MDIO bus support.

Reported-by: Heiko Stuebner <heiko@sntech.de>
Reported-by: kernelci.org bot <bot@kernelci.org>
Fixes: d3e014ec7d ("net: stmmac: platform: Fix MDIO init for platforms without PHY")
Signed-off-by: Jose Abreu <Jose.Abreu@synopsys.com>
Acked-by: Sriram Dash <Sriram.dash@samsung.com>
Tested-by: Patrice Chotard <patrice.chotard@st.com>
Tested-by: Heiko Stuebner <heiko@sntech.de>
Acked-by: Neil Armstrong <narmstrong@baylibre.com>
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Tested-by: Florian Fainelli <f.fainelli@gmail> # Lamobo R1 (fixed-link + MDIO sub node for roboswitch).
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-01-07 13:40:29 -08:00
David S. Miller
b57e1fff7d Merge branch 'vlan-rtnetlink-newlink-fixes'
Eric Dumazet says:

====================
vlan: rtnetlink newlink fixes

First patch fixes a potential memory leak found by syzbot

Second patch makes vlan_changelink() aware of errors
and report them to user.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2020-01-07 13:35:14 -08:00
Eric Dumazet
eb8ef2a3c5 vlan: vlan_changelink() should propagate errors
Both vlan_dev_change_flags() and vlan_dev_set_egress_priority()
can return an error. vlan_changelink() should not ignore them.

Fixes: 07b5b17e15 ("[VLAN]: Use rtnl_link API")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-01-07 13:35:14 -08:00
Eric Dumazet
9bbd917e0b vlan: fix memory leak in vlan_dev_set_egress_priority
There are few cases where the ndo_uninit() handler might be not
called if an error happens while device is initialized.

Since vlan_newlink() calls vlan_changelink() before
trying to register the netdevice, we need to make sure
vlan_dev_uninit() has been called at least once,
or we might leak allocated memory.

BUG: memory leak
unreferenced object 0xffff888122a206c0 (size 32):
  comm "syz-executor511", pid 7124, jiffies 4294950399 (age 32.240s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 61 73 00 00 00 00 00 00 00 00  ......as........
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<000000000eb3bb85>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline]
    [<000000000eb3bb85>] slab_post_alloc_hook mm/slab.h:586 [inline]
    [<000000000eb3bb85>] slab_alloc mm/slab.c:3320 [inline]
    [<000000000eb3bb85>] kmem_cache_alloc_trace+0x145/0x2c0 mm/slab.c:3549
    [<000000007b99f620>] kmalloc include/linux/slab.h:556 [inline]
    [<000000007b99f620>] vlan_dev_set_egress_priority+0xcc/0x150 net/8021q/vlan_dev.c:194
    [<000000007b0cb745>] vlan_changelink+0xd6/0x140 net/8021q/vlan_netlink.c:126
    [<0000000065aba83a>] vlan_newlink+0x135/0x200 net/8021q/vlan_netlink.c:181
    [<00000000fb5dd7a2>] __rtnl_newlink+0x89a/0xb80 net/core/rtnetlink.c:3305
    [<00000000ae4273a1>] rtnl_newlink+0x4e/0x80 net/core/rtnetlink.c:3363
    [<00000000decab39f>] rtnetlink_rcv_msg+0x178/0x4b0 net/core/rtnetlink.c:5424
    [<00000000accba4ee>] netlink_rcv_skb+0x61/0x170 net/netlink/af_netlink.c:2477
    [<00000000319fe20f>] rtnetlink_rcv+0x1d/0x30 net/core/rtnetlink.c:5442
    [<00000000d51938dc>] netlink_unicast_kernel net/netlink/af_netlink.c:1302 [inline]
    [<00000000d51938dc>] netlink_unicast+0x223/0x310 net/netlink/af_netlink.c:1328
    [<00000000e539ac79>] netlink_sendmsg+0x2c0/0x570 net/netlink/af_netlink.c:1917
    [<000000006250c27e>] sock_sendmsg_nosec net/socket.c:639 [inline]
    [<000000006250c27e>] sock_sendmsg+0x54/0x70 net/socket.c:659
    [<00000000e2a156d1>] ____sys_sendmsg+0x2d0/0x300 net/socket.c:2330
    [<000000008c87466e>] ___sys_sendmsg+0x8a/0xd0 net/socket.c:2384
    [<00000000110e3054>] __sys_sendmsg+0x80/0xf0 net/socket.c:2417
    [<00000000d71077c8>] __do_sys_sendmsg net/socket.c:2426 [inline]
    [<00000000d71077c8>] __se_sys_sendmsg net/socket.c:2424 [inline]
    [<00000000d71077c8>] __x64_sys_sendmsg+0x23/0x30 net/socket.c:2424

Fixe: 07b5b17e15 ("[VLAN]: Use rtnl_link API")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-01-07 13:35:14 -08:00
David S. Miller
96b11e9358 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf
Daniel Borkmann says:

====================
pull-request: bpf 2020-01-07

The following pull-request contains BPF updates for your *net* tree.

We've added 2 non-merge commits during the last 1 day(s) which contain
a total of 2 files changed, 16 insertions(+), 4 deletions(-).

The main changes are:

1) Fix a use-after-free in cgroup BPF due to auto-detachment, from Roman Gushchin.

2) Fix skb out-of-bounds access in ld_abs/ind instruction, from Daniel Borkmann.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2020-01-07 13:31:23 -08:00
Jiping Ma
481a7d154c stmmac: debugfs entry name is not be changed when udev rename device name.
Add one notifier for udev changes net device name.
Fixes: b6601323ef9e ("net: stmmac: debugfs entry name is not be changed when udev rename")

Signed-off-by: Jiping Ma <jiping.ma2@windriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-01-07 13:26:16 -08:00
Shiraz Saleem
9554de394b i40iw: Remove setting of VMA private data and use rdma_user_mmap_io
vm_ops is now initialized in ib_uverbs_mmap() with the recent rdma mmap
API changes. Earlier it was done in rdma_umap_priv_init() which would not
be called unless a driver called rdma_user_mmap_io() in its mmap.

i40iw does not use the rdma_user_mmap_io API but sets the vma's
vm_private_data to a driver object. This now conflicts with the vm_op
rdma_umap_close as priv pointer points to the i40iw driver object instead
of the private data setup by core when rdma_user_mmap_io is called.  This
leads to a crash in rdma_umap_close with a mmap put being called when it
should not have.

Remove the redundant setting of the vma private_data in i40iw as it is not
used. Also move i40iw over to use the rdma_user_mmap_io API. This gives
the extra protection of having the mappings zapped when the context is
detsroyed.

  BUG: unable to handle page fault for address: 0000000100000001
  #PF: supervisor write access in kernel mode
  #PF: error_code(0x0002) - not-present page
  PGD 0 P4D 0
  Oops: 0002 [#1] SMP PTI
  CPU: 6 PID: 9528 Comm: rping Kdump: loaded Not tainted 5.5.0-rc4+ #117
  Hardware name: Gigabyte Technology Co., Ltd. To be filled by O.E.M./Q87M-D2H, BIOS F7 01/17/2014
  RIP: 0010:rdma_user_mmap_entry_put+0xa/0x30 [ib_core]
  RSP: 0018:ffffb340c04c7c38 EFLAGS: 00010202
  RAX: 00000000ffffffff RBX: ffff9308e7be2a00 RCX: 000000000000cec0
  RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000100000001
  RBP: ffff9308dc7641f0 R08: 0000000000000001 R09: 0000000000000000
  R10: 0000000000000001 R11: ffffffff8d4414d8 R12: ffff93075182c780
  R13: 0000000000000001 R14: ffff93075182d2a8 R15: ffff9308e2ddc840
  FS:  0000000000000000(0000) GS:ffff9308fdc00000(0000) knlGS:0000000000000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: 0000000100000001 CR3: 00000002e0412004 CR4: 00000000001606e0
  Call Trace:
   rdma_umap_close+0x40/0x90 [ib_uverbs]
   remove_vma+0x43/0x80
   exit_mmap+0xfd/0x1b0
   mmput+0x6e/0x130
   do_exit+0x290/0xcc0
   ? get_signal+0x152/0xc40
   do_group_exit+0x46/0xc0
   get_signal+0x1bd/0xc40
   ? prepare_to_wait_event+0x97/0x190
   do_signal+0x36/0x630
   ? remove_wait_queue+0x60/0x60
   ? __audit_syscall_exit+0x1d9/0x290
   ? rcu_read_lock_sched_held+0x52/0x90
   ? kfree+0x21c/0x2e0
   exit_to_usermode_loop+0x4f/0xc3
   do_syscall_64+0x1ed/0x270
   entry_SYSCALL_64_after_hwframe+0x49/0xbe
  RIP: 0033:0x7fae715a81fd
  Code: Bad RIP value.
  RSP: 002b:00007fae6e163cb0 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
  RAX: fffffffffffffe00 RBX: 00007fae6e163d30 RCX: 00007fae715a81fd
  RDX: 0000000000000010 RSI: 00007fae6e163cf0 RDI: 0000000000000003
  RBP: 00000000013413a0 R08: 00007fae68000000 R09: 0000000000000017
  R10: 0000000000000001 R11: 0000000000000293 R12: 00007fae680008c0
  R13: 00007fae6e163cf0 R14: 00007fae717c9804 R15: 00007fae6e163ed0
  CR2: 0000000100000001
  ---[ end trace b33d58d3a06782cb ]---
  RIP: 0010:rdma_user_mmap_entry_put+0xa/0x30 [ib_core]

Fixes: b86deba977 ("RDMA/core: Move core content from ib_uverbs to ib_core")
Link: https://lore.kernel.org/r/20200107162223.1745-1-shiraz.saleem@intel.com
Signed-off-by: Shiraz Saleem <shiraz.saleem@intel.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
2020-01-07 15:07:37 -04:00
Chunming Zhou
db4ff423cd drm/amdgpu: add DRIVER_SYNCOBJ_TIMELINE to amdgpu
Can expose it now that the khronos has exposed the
vlk extension.

Signed-off-by: Chunming Zhou <david1.zhou@amd.com>
Reviewed-by: Flora Cui <Flora.Cui@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
2020-01-07 11:33:32 -05:00
Thomas Anderson
840c90fce6 drm/amd/display: Reduce HDMI pixel encoding if max clock is exceeded
For high-res (8K) or HFR (4K120) displays, using uncompressed pixel
formats like YCbCr444 would exceed the bandwidth of HDMI 2.0, so the
"interesting" modes would be disabled, leaving only low-res or low
framerate modes.

This change lowers the pixel encoding to 4:2:2 or 4:2:0 if the max TMDS
clock is exceeded. Verified that 8K30 and 4K120 are now available and
working with a Samsung Q900R over an HDMI 2.0b link from a Radeon 5700.

Reviewed-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Thomas Anderson <thomasanderson@google.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2020-01-07 11:29:47 -05:00
Alex Deucher
7aec9ec1cf Revert "drm/amdgpu: Set no-retry as default."
This reverts commit 51bfac71ca.

This causes stability issues on some raven boards.  Revert
for now until a proper fix is completed.

Bug: https://gitlab.freedesktop.org/drm/amd/issues/934
Bug: https://bugzilla.kernel.org/show_bug.cgi?id=206017
Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
2020-01-07 11:27:03 -05:00