Re: [PATCH 17/22] arm64: dts: qcom: sm8150: Add apss_shared and apps_rsc nodes

2019-08-14 Thread Stephen Boyd
Quoting Vinod Koul (2019-08-14 05:50:07) > Add apss_shared and apps_rsc node including the rpmhcc child node > > Signed-off-by: Vinod Koul > --- Can't this be squashed with the original dtsi file? > arch/arm64/boot/dts/qcom/sm8150.dtsi | 30 > 1 file changed, 30 in

Re: [PATCH v3 hmm 04/11] misc/sgi-gru: use mmu_notifier_get/put for struct gru_mm_struct

2019-08-14 Thread Dimitri Sivanich
On Wed, Aug 14, 2019 at 03:58:34PM +, Jason Gunthorpe wrote: > On Thu, Aug 08, 2019 at 12:25:56PM +0200, Christoph Hellwig wrote: > > Looks good, > > > > Reviewed-by: Christoph Hellwig > > Dimitri, are you OK with this patch? > I think this looks OK. Reviewed-by: Dimitri Sivanich

[PATCH 4.19 70/91] HID: sony: Fix race condition between rumble and device remove.

2019-08-14 Thread Greg Kroah-Hartman
From: Roderick Colenbrander commit e0f6974a54d3f7f1b5fdf5a593bd43ce9206ec04 upstream. Valve reported a kernel crash on Ubuntu 18.04 when disconnecting a DS4 gamepad while rumble is enabled. This issue is reproducible with a frequency of 1 in 3 times in the game Borderlands 2 when using an automa

[PATCH 4.19 69/91] s390/dma: provide proper ARCH_ZONE_DMA_BITS value

2019-08-14 Thread Greg Kroah-Hartman
[ Upstream commit 1a2dcff881059dedc14fafc8a442664c8dbd60f1 ] On s390 ZONE_DMA is up to 2G, i.e. ARCH_ZONE_DMA_BITS should be 31 bits. The current value is 24 and makes __dma_direct_alloc_pages() take a wrong turn first (but __dma_direct_alloc_pages() recovers then). Let's correct ARCH_ZONE_DMA_BI

[PATCH 4.19 71/91] x86/purgatory: Do not use __builtin_memcpy and __builtin_memset

2019-08-14 Thread Greg Kroah-Hartman
From: Nick Desaulniers commit 4ce97317f41d38584fb93578e922fcd19e535f5b upstream. Implementing memcpy and memset in terms of __builtin_memcpy and __builtin_memset is problematic. GCC at -O2 will replace calls to the builtins with calls to memcpy and memset (but will generate an inline implementa

[PATCH 4.14 01/69] iio: adc: max9611: Fix misuse of GENMASK macro

2019-08-14 Thread Greg Kroah-Hartman
From: Joe Perches commit ae8cc91a7d85e018c0c267f580820b2bb558cd48 upstream. Arguments are supposed to be ordered high then low. Signed-off-by: Joe Perches Fixes: 69780a3bbc0b ("iio: adc: Add Maxim max9611 ADC driver") Cc: Signed-off-by: Jonathan Cameron Signed-off-by: Greg Kroah-Hartman --

[PATCH 4.14 02/69] crypto: ccp - Fix oops by properly managing allocated structures

2019-08-14 Thread Greg Kroah-Hartman
From: Gary R Hook commit 25e44338321af545ab34243a6081c3f0fc6107d0 upstream. A plaintext or ciphertext length of 0 is allowed in AES, in which case no encryption occurs. Ensure that we don't clean up data structures that were never allocated. Fixes: 36cf515b9bbe2 ("crypto: ccp - Enable support f

[PATCH 4.19 62/91] ARM: dts: bcm: bcm47094: add missing #cells for mdio-bus-mux

2019-08-14 Thread Greg Kroah-Hartman
[ Upstream commit 3a9d2569e45cb02769cda26fee4a02126867c934 ] The mdio-bus-mux has no #address-cells/#size-cells property, which causes a few dtc warnings: arch/arm/boot/dts/bcm47094-linksys-panamera.dts:129.4-18: Warning (reg_format): /mdio-bus-mux/mdio@200:reg: property has invalid length (4 by

[PATCH 4.19 67/91] tty/ldsem, locking/rwsem: Add missing ACQUIRE to read_failed sleep loop

2019-08-14 Thread Greg Kroah-Hartman
[ Upstream commit 952041a8639a7a3a73a2b6573cb8aa8518bc39f8 ] While reviewing rwsem down_slowpath, Will noticed ldsem had a copy of a bug we just found for rwsem. X = 0; CPU0 CPU1 rwsem_down_read() for (;;) { set_current_state(TASK_UNINTERRUPTIBLE);

[PATCH 4.19 68/91] perf/core: Fix creating kernel counters for PMUs that override event->cpu

2019-08-14 Thread Greg Kroah-Hartman
[ Upstream commit 4ce54af8b33d3e21ca935fc1b89b58cbba956051 ] Some hardware PMU drivers will override perf_event.cpu inside their event_init callback. This causes a lockdep splat when initialized through the kernel API: WARNING: CPU: 0 PID: 250 at kernel/events/core.c:2917 ctx_sched_out+0x78/0x20

Re: [5.3.0-rc4-next][bisected 882632][qla2xxx] WARNING: CPU: 10 PID: 425 at drivers/scsi/qla2xxx/qla_isr.c:2784 qla2x00_status_entry.isra

2019-08-14 Thread Abdul Haleem
On Wed, 2019-08-14 at 10:05 -0700, Bart Van Assche wrote: > On 8/14/19 9:52 AM, Abdul Haleem wrote: > > Greeting's > > > > Today's linux-next kernel (5.3.0-rc4-next-20190813) booted with warning on > > my powerpc power 8 lpar > > > > The WARN_ON_ONCE() was introduced by commit 88263208 (scsi: q

[PATCH 4.19 73/91] can: peak_usb: pcan_usb_pro: Fix info-leaks to USB devices

2019-08-14 Thread Greg Kroah-Hartman
From: Tomas Bortoli commit ead16e53c2f0ed946d82d4037c630e2f60f4ab69 upstream. Uninitialized Kernel memory can leak to USB devices. Fix by using kzalloc() instead of kmalloc() on the affected buffers. Signed-off-by: Tomas Bortoli Reported-by: syzbot+d6a5a1a3657b596ef...@syzkaller.appspotmail.c

[PATCH 4.19 72/91] ALSA: usb-audio: fix a memory leak bug

2019-08-14 Thread Greg Kroah-Hartman
From: Wenwen Wang commit a67060201b746a308b1674f66bf289c9faef6d09 upstream. In snd_usb_get_audioformat_uac3(), a structure for channel maps 'chmap' is allocated through kzalloc() before the execution goto 'found_clock'. However, this structure is not deallocated if the memory allocation for 'pd'

[PATCH 4.19 79/91] ALSA: hda - Dont override global PCM hw info flag

2019-08-14 Thread Greg Kroah-Hartman
From: Takashi Iwai commit c1c6c877b0c79fd7e05c931435aa42211eaeebaf upstream. The commit bfcba288b97f ("ALSA - hda: Add support for link audio time reporting") introduced the conditional PCM hw info setup, but it overwrites the global azx_pcm_hw object. This will cause a problem if any other HD-

Re: [PATCH 2/2] clk: qcom: clk-rpmh: Add support for SM8150

2019-08-14 Thread Stephen Boyd
Quoting Vinod Koul (2019-08-14 05:29:58) > Add support for rpmh clocks found in SM8150 > > Signed-off-by: Vinod Koul > --- Patch looks OK, but can you convert this driver to use the new parent style and then update the binding to handle it? We can fix the other platforms and dts files that use t

[PATCH 4.19 78/91] ALSA: hiface: fix multiple memory leak bugs

2019-08-14 Thread Greg Kroah-Hartman
From: Wenwen Wang commit 3d92aa45fbfd7319e3a19f4ec59fd32b3862b723 upstream. In hiface_pcm_init(), 'rt' is firstly allocated through kzalloc(). Later on, hiface_pcm_init_urb() is invoked to initialize 'rt->out_urbs[i]'. In hiface_pcm_init_urb(), 'rt->out_urbs[i].buffer' is allocated through kzall

[PATCH 4.19 81/91] mac80211: dont WARN on short WMM parameters from AP

2019-08-14 Thread Greg Kroah-Hartman
From: Brian Norris commit 05aaa5c97dce4c10a9e7eae2f1569a684e0c5ced upstream. In a very similar spirit to commit c470bdc1aaf3 ("mac80211: don't WARN on bad WMM parameters from buggy APs"), an AP may not transmit a fully-formed WMM IE. For example, it may miss or repeat an Access Category. The abo

[PATCH 4.19 84/91] smb3: send CAP_DFS capability during session setup

2019-08-14 Thread Greg Kroah-Hartman
From: Steve French commit 8d33096a460d5b9bd13300f01615df5bb454db10 upstream. We had a report of a server which did not do a DFS referral because the session setup Capabilities field was set to 0 (unlike negotiate protocol where we set CAP_DFS). Better to send it session setup in the capabilitie

[PATCH 4.19 82/91] dax: dax_layout_busy_page() should not unmap cow pages

2019-08-14 Thread Greg Kroah-Hartman
From: Vivek Goyal commit d75996dd022b6d83bd14af59b2775b1aa639e4b9 upstream. Vivek: "As of now dax_layout_busy_page() calls unmap_mapping_range() with last argument as 1, which says even unmap cow pages. I am wondering who needs to get rid of cow pages as well. I noticed one

[PATCH 4.19 88/91] iwlwifi: dont unmap as page memory that was mapped as single

2019-08-14 Thread Greg Kroah-Hartman
From: Emmanuel Grumbach commit 87e7e25aee6b59fef740856f4e86d4b60496c9e1 upstream. In order to remember how to unmap a memory (as single or as page), we maintain a bit per Transmit Buffer (TBs) in the meta data (structure iwl_cmd_meta). We maintain a bitmap: 1 bit per TB. If the TB is set, we wil

[PATCH 4.19 37/91] netfilter: nft_hash: fix symhash with modulus one

2019-08-14 Thread Greg Kroah-Hartman
[ Upstream commit 28b1d6ef53e3303b90ca8924bb78f31fa527cafb ] The rule below doesn't work as the kernel raises -ERANGE. nft add rule netdev nftlb lb01 ip daddr set \ symhash mod 1 map { 0 : 192.168.0.10 } fwd to "eth0" This patch allows to use the symhash modulus with one element, in the

[PATCH 4.19 42/91] drm/amd/display: Only enable audio if speaker allocation exists

2019-08-14 Thread Greg Kroah-Hartman
[ Upstream commit 6ac25e6d5b2fbf251e9fa2f4131d42c815b43867 ] [Why] In dm_helpers_parse_edid_caps, there is a corner case where no speakers can be allocated even though the audio mode count is greater than 0. Enabling audio when no speaker allocations exists can cause issues in the video stream.

[PATCH 4.19 40/91] drm/amd/display: use encoders engine id to find matched free audio device

2019-08-14 Thread Greg Kroah-Hartman
[ Upstream commit 74eda776d7a4e69ec7aa1ce30a87636f14220fbb ] [Why] On some platforms, the encoder id 3 is not populated. So the encoders are not stored in right order as index (id: 0, 1, 2, 4, 5) at pool. This would cause encoders id 4 & id 5 to fail when finding corresponding audio device, defaul

[PATCH 4.19 55/91] ALSA: compress: Be more restrictive about when a drain is allowed

2019-08-14 Thread Greg Kroah-Hartman
[ Upstream commit 3b8179944cb0dd53e5223996966746cdc8a60657 ] Draining makes little sense in the situation of hardware overrun, as the hardware will have consumed all its available samples. Additionally, draining whilst the stream is paused would presumably get stuck as no data is being consumed on

Re: [PATCH 13/22] arm64: dts: qcom: pm8150l: Add pon and adc nodes

2019-08-14 Thread Stephen Boyd
Quoting Vinod Koul (2019-08-14 05:50:03) > Add the pon and adc nodes found in pm8150l PMIC. > > Signed-off-by: Vinod Koul > --- > arch/arm64/boot/dts/qcom/pm8150l.dtsi | 33 +++ > 1 file changed, 33 insertions(+) Wow it's all the same! :)

[PATCH 4.19 36/91] netfilter: conntrack: always store window size un-scaled

2019-08-14 Thread Greg Kroah-Hartman
[ Upstream commit 959b69ef57db00cb33e9c4777400ae7183ebddd3 ] Jakub Jankowski reported following oddity: After 3 way handshake completes, timeout of new connection is set to max_retrans (300s) instead of established (5 days). shortened excerpt from pcap provided: 25.070622 IP (flags [DF], proto T

[PATCH 4.19 60/91] nvme: fix multipath crash when ANA is deactivated

2019-08-14 Thread Greg Kroah-Hartman
[ Upstream commit 66b20ac0a1a10769d059d6903202f53494e3d902 ] Fix a crash with multipath activated. It happends when ANA log page is larger than MDTS and because of that ANA is disabled. The driver then tries to access unallocated buffer when connecting to a nvme target. The signature is as follows

[PATCH 4.19 51/91] s390/qdio: add sanity checks to the fast-requeue path

2019-08-14 Thread Greg Kroah-Hartman
[ Upstream commit a6ec414a4dd529eeac5c3ea51c661daba3397108 ] If the device driver were to send out a full queue's worth of SBALs, current code would end up discovering the last of those SBALs as PRIMED and erroneously skip the SIGA-w. This immediately stalls the queue. Add a check to not attempt

[PATCH 4.19 61/91] ARM: davinci: fix sleep.S build error on ARMv4

2019-08-14 Thread Greg Kroah-Hartman
[ Upstream commit d64b212ea960db4276a1d8372bd98cb861dfcbb0 ] When building a multiplatform kernel that includes armv4 support, the default target CPU does not support the blx instruction, which leads to a build failure: arch/arm/mach-davinci/sleep.S: Assembler messages: arch/arm/mach-davinci/slee

[PATCH 4.19 38/91] scripts/sphinx-pre-install: fix script for RHEL/CentOS

2019-08-14 Thread Greg Kroah-Hartman
[ Upstream commit b308467c916aa7acc5069802ab76a9f657434701 ] There's a missing parenthesis at the script, with causes it to fail to detect non-Fedora releases (e. g. RHEL/CentOS). Tested with Centos 7.6.1810. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin --- scripts/sphinx-p

[PATCH 4.19 53/91] ALSA: compress: Prevent bypasses of set_params

2019-08-14 Thread Greg Kroah-Hartman
[ Upstream commit 26c3f1542f5064310ad26794c09321780d00c57d ] Currently, whilst in SNDRV_PCM_STATE_OPEN it is possible to call snd_compr_stop, snd_compr_drain and snd_compr_partial_drain, which allow a transition to SNDRV_PCM_STATE_SETUP. The stream should only be able to move to the setup state on

[PATCH 4.19 59/91] ACPI/IORT: Fix off-by-one check in iort_dev_find_its_id()

2019-08-14 Thread Greg Kroah-Hartman
[ Upstream commit 5a46d3f71d5e5a9f82eabc682f996f1281705ac7 ] Static analysis identified that index comparison against ITS entries in iort_dev_find_its_id() is off by one. Update the comparison condition and clarify the resulting error message. Fixes: 4bf2efd26d76 ("ACPI: Add new IORT functions t

[PATCH 4.19 49/91] drm: silence variable conn set but not used

2019-08-14 Thread Greg Kroah-Hartman
[ Upstream commit bbb6fc43f131f77fcb7ae8081f6d7c51396a2120 ] The "struct drm_connector" iteration cursor from "for_each_new_connector_in_state" is never used in atomic_remove_fb() which generates a compilation warning, drivers/gpu/drm/drm_framebuffer.c: In function 'atomic_remove_fb': drivers/gpu

Re: [PATCH v8 15/27] mm: Handle shadow stack page fault

2019-08-14 Thread Yu-cheng Yu
On Wed, 2019-08-14 at 09:48 -0700, Dave Hansen wrote: > On 8/14/19 9:27 AM, Yu-cheng Yu wrote: > > On Tue, 2019-08-13 at 15:55 -0700, Andy Lutomirski wrote: > > > On Tue, Aug 13, 2019 at 2:02 PM Yu-cheng Yu wrote: > > > > When a task does fork(), its shadow stack (SHSTK) must be duplicated > > > >

Re: [PATCH 12/22] arm64: dts: qcom: pm8150l: Add Base DTS file

2019-08-14 Thread Stephen Boyd
Quoting Vinod Koul (2019-08-14 05:50:02) > PMIC pm8150l is a slave pmic and this adds base DTS file for pm8150l > > Signed-off-by: Vinod Koul > --- > arch/arm64/boot/dts/qcom/pm8150l.dtsi | 22 ++ > 1 file changed, 22 insertions(+) > create mode 100644 arch/arm64/boot/dts/qc

[PATCH 4.19 07/91] crypto: ccp - Ignore tag length when decrypting GCM ciphertext

2019-08-14 Thread Greg Kroah-Hartman
From: Gary R Hook commit e2664ecbb2f26225ac6646876f2899558ffb2604 upstream. AES GCM input buffers for decryption contain AAD+CTEXT+TAG. Only decrypt the ciphertext, and use the tag for comparison. Fixes: 36cf515b9bbe2 ("crypto: ccp - Enable support for AES GCM on v5 CCPs") Cc: Signed-off-by: G

[PATCH 4.19 52/91] ALSA: compress: Fix regression on compressed capture streams

2019-08-14 Thread Greg Kroah-Hartman
[ Upstream commit 4475f8c4ab7b248991a60d9c02808dbb813d6be8 ] A previous fix to the stop handling on compressed capture streams causes some knock on issues. The previous fix updated snd_compr_drain_notify to set the state back to PREPARED for capture streams. This causes some issues however as the

[PATCH 4.19 31/91] can: rcar_canfd: fix possible IRQ storm on high load

2019-08-14 Thread Greg Kroah-Hartman
From: Nikita Yushchenko commit d4b890aec4bea7334ca2ca56fd3b12fb48a00cd1 upstream. We have observed rcar_canfd driver entering IRQ storm under high load, with following scenario: - rcar_canfd_global_interrupt() in entered due to Rx available, - napi_schedule_prep() is called, and sets NAPIF_STATE

[PATCH 4.19 25/91] usb: host: xhci-rcar: Fix timeout in xhci_suspend()

2019-08-14 Thread Greg Kroah-Hartman
From: Yoshihiro Shimoda commit 783bda5e41acc71f98336e1a402c180f9748e5dc upstream. When a USB device is connected to the host controller and the system enters suspend, the following error happens in xhci_suspend(): xhci-hcd ee00.usb: WARN: xHC CMD_RUN timeout Since the firmware/inte

[PATCH 4.19 27/91] usb: typec: tcpm: free log buf memory when remove debug file

2019-08-14 Thread Greg Kroah-Hartman
From: Li Jun commit fd5da3e2cc61b4a7c877172fdc9348c82cf6ccfc upstream. The logbuffer memory should be freed when remove debug file. Cc: sta...@vger.kernel.org # v4.15+ Fixes: 4b4e02c83167 ("typec: tcpm: Move out of staging") Signed-off-by: Li Jun Reviewed-by: Guenter Roeck Link: https://lore.

[PATCH 4.19 32/91] can: peak_usb: fix potential double kfree_skb()

2019-08-14 Thread Greg Kroah-Hartman
From: Stephane Grosjean commit fee6a8923ae0d318a7f7950c6c6c28a96cea099b upstream. When closing the CAN device while tx skbs are inflight, echo skb could be released twice. By calling close_candev() before unlinking all pending tx urbs, then the internal echo_skb[] array is fully and correctly cl

[PATCH 4.19 11/91] mmc: cavium: Set the correct dma max segment size for mmc_host

2019-08-14 Thread Greg Kroah-Hartman
From: Kevin Hao commit fa25eba6993b3750f417baabba169afaba076178 upstream. We have set the mmc_host.max_seg_size to 8M, but the dma max segment size of PCI device is set to 64K by default in function pci_device_add(). The mmc_host.max_seg_size is used to set the max segment size of the blk queue.

[PATCH 4.19 02/91] iio: adc: max9611: Fix misuse of GENMASK macro

2019-08-14 Thread Greg Kroah-Hartman
From: Joe Perches commit ae8cc91a7d85e018c0c267f580820b2bb558cd48 upstream. Arguments are supposed to be ordered high then low. Signed-off-by: Joe Perches Fixes: 69780a3bbc0b ("iio: adc: Add Maxim max9611 ADC driver") Cc: Signed-off-by: Jonathan Cameron Signed-off-by: Greg Kroah-Hartman --

[PATCH 4.19 46/91] mac80211: dont warn about CW params when not using them

2019-08-14 Thread Greg Kroah-Hartman
[ Upstream commit d2b3fe42bc629c2d4002f652b3abdfb2e72991c7 ] ieee80211_set_wmm_default() normally sets up the initial CW min/max for each queue, except that it skips doing this if the driver doesn't support ->conf_tx. We still end up calling drv_conf_tx() in some cases (e.g., ieee80211_reconfig())

[PATCH 4.19 22/91] perf record: Fix module size on s390

2019-08-14 Thread Greg Kroah-Hartman
From: Thomas Richter commit 12a6d2940b5f02b4b9f71ce098e3bb02bc24a9ea upstream. On s390 the modules loaded in memory have the text segment located after the GOT and Relocation table. This can be seen with this output: [root@m35lp76 perf]# fgrep qeth /proc/modules qeth 151552 1 qeth_l2, Live

[PATCH 4.19 18/91] x86/mm: Sync also unmappings in vmalloc_sync_all()

2019-08-14 Thread Greg Kroah-Hartman
From: Joerg Roedel commit 8e998fc24de47c55b47a887f6c95ab91acd4a720 upstream. With huge-page ioremap areas the unmappings also need to be synced between all page-tables. Otherwise it can cause data corruption when a region is unmapped and later re-used. Make the vmalloc_sync_one() function ready

[PATCH 4.19 13/91] loop: set PF_MEMALLOC_NOIO for the worker thread

2019-08-14 Thread Greg Kroah-Hartman
From: Mikulas Patocka commit d0a255e795ab976481565f6ac178314b34fbf891 upstream. A deadlock with this stacktrace was observed. The loop thread does a GFP_KERNEL allocation, it calls into dm-bufio shrinker and the shrinker depends on I/O completion in the dm-bufio subsystem. In order to fix the

[PATCH 4.19 23/91] x86/purgatory: Use CFLAGS_REMOVE rather than reset KBUILD_CFLAGS

2019-08-14 Thread Greg Kroah-Hartman
From: Nick Desaulniers commit b059f801a937d164e03b33c1848bb3dca67c0b04 upstream. KBUILD_CFLAGS is very carefully built up in the top level Makefile, particularly when cross compiling or using different build tools. Resetting KBUILD_CFLAGS via := assignment is an antipattern. The comment above t

[PATCH 4.19 14/91] Input: usbtouchscreen - initialize PM mutex before using it

2019-08-14 Thread Greg Kroah-Hartman
From: Oliver Neukum commit b55d996f057bf2e7ba9422a80b5e17e99860cb0b upstream. Mutexes shall be initialized before they are used. Fixes: 12e510dbc57b2 ("Input: usbtouchscreen - fix deadlock in autosuspend") Reported-by: syzbot+199ea16c7f26418b4...@syzkaller.appspotmail.com Signed-off-by: Oliver

[PATCH 4.19 21/91] perf db-export: Fix thread__exec_comm()

2019-08-14 Thread Greg Kroah-Hartman
From: Adrian Hunter commit 3de7ae0b2a1d86dbb23d0cb135150534fdb2e836 upstream. Threads synthesized from /proc have comms with a start time of zero, and not marked as "exec". Currently, there can be 2 such comms. The first is created by processing a synthesized fork event and is set to the parent'

[PATCH 4.19 17/91] x86/mm: Check for pfn instead of page in vmalloc_sync_one()

2019-08-14 Thread Greg Kroah-Hartman
From: Joerg Roedel commit 51b75b5b563a2637f9d8dc5bd02a31b2ff9e5ea0 upstream. Do not require a struct page for the mapped memory location because it might not exist. This can happen when an ioremapped region is mapped with 2MB pages. Fixes: 5d72b4fba40ef ('x86, mm: support huge I/O mapping capab

[PATCH 5.2 122/144] can: peak_usb: pcan_usb_fd: Fix info-leaks to USB devices

2019-08-14 Thread Greg Kroah-Hartman
From: Tomas Bortoli commit 30a8beeb3042f49d0537b7050fd21b490166a3d9 upstream. Uninitialized Kernel memory can leak to USB devices. Fix by using kzalloc() instead of kmalloc() on the affected buffers. Signed-off-by: Tomas Bortoli Reported-by: syzbot+513e4d0985298538b...@syzkaller.appspotmail.c

[PATCH 4.19 03/91] staging: gasket: apex: fix copy-paste typo

2019-08-14 Thread Greg Kroah-Hartman
From: Ivan Bornyakov commit 5bb9979246729562a09fcdbb101c83127989 upstream. In sysfs_show() case-branches ATTR_KERNEL_HIB_PAGE_TABLE_SIZE and ATTR_KERNEL_HIB_SIMPLE_PAGE_TABLE_SIZE do the same. It looks like copy-paste mistake. Signed-off-by: Ivan Bornyakov Cc: stable Link: https://lore.ke

Re: [PATCH v3 1/2] rcu/tree: Add basic support for kfree_rcu batching

2019-08-14 Thread Joel Fernandes
On Wed, Aug 14, 2019 at 10:38:17AM -0400, Joel Fernandes wrote: > On Tue, Aug 13, 2019 at 12:07:38PM -0700, Paul E. McKenney wrote: [snip] > > > - * Queue an RCU callback for lazy invocation after a grace period. > > > - * This will likely be later named something like "call_rcu_lazy()", > > > - *

[PATCH 5.2 143/144] iwlwifi: mvm: dont send GEO_TX_POWER_LIMIT on version < 41

2019-08-14 Thread Greg Kroah-Hartman
From: Luca Coelho commit 39bd984c203e86f3109b49c2a2e20677c4d3ab65 upstream. Firmware versions before 41 don't support the GEO_TX_POWER_LIMIT command, and sending it to the firmware will cause a firmware crash. We allow this via debugfs, so we need to return an error value in case it's not suppor

Re: [PATCH 11/22] arm64: dts: qcom: pm8150b: Add gpio node

2019-08-14 Thread Stephen Boyd
Quoting Vinod Koul (2019-08-14 05:50:01) > Add the gpio node found in pm8150b PMIC. > > Signed-off-by: Vinod Koul > --- > arch/arm64/boot/dts/qcom/pm8150b.dtsi | 19 +++ > 1 file changed, 19 insertions(+) Squash it?

[PATCH 5.2 117/144] gen_compile_commands: lower the entry count threshold

2019-08-14 Thread Greg Kroah-Hartman
[ Upstream commit cb36955a5569f1ff17a42ae93264ef391c013a97 ] Running gen_compile_commands.py after building the kernel with allnoconfig gave this: $ ./scripts/gen_compile_commands.py WARNING: Found 449 entries. Have you compiled the kernel? Signed-off-by: Masahiro Yamada Signed-off-by: Sasha Le

[PATCH 5.2 118/144] HID: sony: Fix race condition between rumble and device remove.

2019-08-14 Thread Greg Kroah-Hartman
From: Roderick Colenbrander commit e0f6974a54d3f7f1b5fdf5a593bd43ce9206ec04 upstream. Valve reported a kernel crash on Ubuntu 18.04 when disconnecting a DS4 gamepad while rumble is enabled. This issue is reproducible with a frequency of 1 in 3 times in the game Borderlands 2 when using an automa

[PATCH 5.2 119/144] ALSA: usb-audio: fix a memory leak bug

2019-08-14 Thread Greg Kroah-Hartman
From: Wenwen Wang commit a67060201b746a308b1674f66bf289c9faef6d09 upstream. In snd_usb_get_audioformat_uac3(), a structure for channel maps 'chmap' is allocated through kzalloc() before the execution goto 'found_clock'. However, this structure is not deallocated if the memory allocation for 'pd'

[PATCH 5.2 134/144] NFSv4: Fix delegation state recovery

2019-08-14 Thread Greg Kroah-Hartman
From: Trond Myklebust commit 5eb8d18ca0e001c6055da2b7f30d8f6dca23a44f upstream. Once we clear the NFS_DELEGATED_STATE flag, we're telling nfs_delegation_claim_opens() that we're done recovering all open state for that stateid, so we really need to ensure that we test for all open modes that are

Re: [PATCH v13 00/18] kunit: introduce KUnit, the Linux kernel unit testing framework

2019-08-14 Thread Stephen Boyd
Quoting Brendan Higgins (2019-08-14 03:03:47) > On Tue, Aug 13, 2019 at 10:52 PM Brendan Higgins > wrote: > > > > ## TL;DR > > > > This revision addresses comments from Stephen and Bjorn Helgaas. Most > > changes are pretty minor stuff that doesn't affect the API in anyway. > > One significant cha

[PATCH 5.2 136/144] NFSv4: Fix an Oops in nfs4_do_setattr

2019-08-14 Thread Greg Kroah-Hartman
From: Trond Myklebust commit 09a54f0ebfe263bc27c90bbd80187b9a93283887 upstream. If the user specifies an open mode of 3, then we don't have a NFSv4 state attached to the context, and so we Oops when we try to dereference it. Reported-by: Olga Kornievskaia Fixes: 29b59f9416937 ("NFSv4: change n

[PATCH 5.2 137/144] KVM: Fix leak vCPUs VMCS value into other pCPU

2019-08-14 Thread Greg Kroah-Hartman
From: Wanpeng Li commit 17e433b54393a6269acbcb792da97791fe1592d8 upstream. After commit d73eb57b80b (KVM: Boost vCPUs that are delivering interrupts), a five years old bug is exposed. Running ebizzy benchmark in three 80 vCPUs VMs on one 80 pCPUs Skylake server, a lot of rcu_sched stall warning

[PATCH 5.2 135/144] NFSv4: Check the return value of update_open_stateid()

2019-08-14 Thread Greg Kroah-Hartman
From: Trond Myklebust commit e3c8dc761ead061da2220ee8f8132f729ac3ddfe upstream. Ensure that we always check the return value of update_open_stateid() so that we can retry if the update of local state failed. This fixes infinite looping on state recovery. Fixes: e23008ec81ef3 ("NFSv4 reduce attr

[PATCH 5.2 127/144] ALSA: hiface: fix multiple memory leak bugs

2019-08-14 Thread Greg Kroah-Hartman
From: Wenwen Wang commit 3d92aa45fbfd7319e3a19f4ec59fd32b3862b723 upstream. In hiface_pcm_init(), 'rt' is firstly allocated through kzalloc(). Later on, hiface_pcm_init_urb() is invoked to initialize 'rt->out_urbs[i]'. In hiface_pcm_init_urb(), 'rt->out_urbs[i].buffer' is allocated through kzall

[PATCH 5.2 126/144] ALSA: firewire: fix a memory leak bug

2019-08-14 Thread Greg Kroah-Hartman
From: Wenwen Wang commit 1be3c1fae6c1e1f5bb982b255d2034034454527a upstream. In iso_packets_buffer_init(), 'b->packets' is allocated through kmalloc_array(). Then, the aligned packet size is checked. If it is larger than PAGE_SIZE, -EINVAL will be returned to indicate the error. However, the allo

[PATCH 5.2 085/144] iommu/vt-d: Check if domain->pgd was allocated

2019-08-14 Thread Greg Kroah-Hartman
[ Upstream commit 3ee9eca760e7d0b68c55813243de66bbb499dc3b ] There is a couple of places where on domain_init() failure domain_exit() is called. While currently domain_init() can fail only if alloc_pgtable_page() has failed. Make domain_exit() check if domain->pgd present, before calling domain_u

[PATCH 5.2 094/144] ALSA: compress: Dont allow paritial drain operations on capture streams

2019-08-14 Thread Greg Kroah-Hartman
[ Upstream commit a70ab8a8645083f3700814e757f2940a88b7ef88 ] Partial drain and next track are intended for gapless playback and don't really have an obvious interpretation for a capture stream, so makes sense to not allow those operations on capture streams. Signed-off-by: Charles Keepax Acked-b

[PATCH 5.2 092/144] ALSA: compress: Fix regression on compressed capture streams

2019-08-14 Thread Greg Kroah-Hartman
[ Upstream commit 4475f8c4ab7b248991a60d9c02808dbb813d6be8 ] A previous fix to the stop handling on compressed capture streams causes some knock on issues. The previous fix updated snd_compr_drain_notify to set the state back to PREPARED for capture streams. This causes some issues however as the

[PATCH 5.2 093/144] ALSA: compress: Prevent bypasses of set_params

2019-08-14 Thread Greg Kroah-Hartman
[ Upstream commit 26c3f1542f5064310ad26794c09321780d00c57d ] Currently, whilst in SNDRV_PCM_STATE_OPEN it is possible to call snd_compr_stop, snd_compr_drain and snd_compr_partial_drain, which allow a transition to SNDRV_PCM_STATE_SETUP. The stream should only be able to move to the setup state on

[PATCH 5.2 090/144] cpufreq/pasemi: fix use-after-free in pas_cpufreq_cpu_init()

2019-08-14 Thread Greg Kroah-Hartman
[ Upstream commit e0a12445d1cb186d875410d093a00d215bec6a89 ] The cpu variable is still being used in the of_get_property() call after the of_node_put() call, which may result in use-after-free. Fixes: a9acc26b75f6 ("cpufreq/pasemi: fix possible object reference leak") Signed-off-by: Wen Yang Ack

[PATCH 5.2 089/144] arm64: dts: imx8mq: fix SAI compatible

2019-08-14 Thread Greg Kroah-Hartman
[ Upstream commit 8d0148473dece51675d11dd59b8db5fe4b5d2e7e ] The i.MX8M SAI block is not compatible with the i.MX6SX one, as the register layout has changed due to two version registers being added at the beginning of the address map. Remove the bogus compatible. Fixes: 8c61538dc945 ("arm64: dts:

[PATCH 5.2 087/144] drm: silence variable conn set but not used

2019-08-14 Thread Greg Kroah-Hartman
[ Upstream commit bbb6fc43f131f77fcb7ae8081f6d7c51396a2120 ] The "struct drm_connector" iteration cursor from "for_each_new_connector_in_state" is never used in atomic_remove_fb() which generates a compilation warning, drivers/gpu/drm/drm_framebuffer.c: In function 'atomic_remove_fb': drivers/gpu

[PATCH 5.2 103/144] nvme: ignore subnqn for ADATA SX6000LNP

2019-08-14 Thread Greg Kroah-Hartman
[ Upstream commit 08b903b5fd0c49e5f224a9bf085b6329ec3c55c0 ] The ADATA SX6000LNP NVMe SSDs have the same subnqn and, due to this, a system with more than one of these SSDs will only have one usable. [ 0.942706] nvme nvme1: ignoring ctrl due to duplicate subnqn (nqn.2018-05.com.example:nvme:nvm-s

Re: [PATCH] MAINTAINERS: net_failover: Fix typo in a filepath

2019-08-14 Thread David Miller
From: Denis Efremov Date: Tue, 13 Aug 2019 09:05:30 +0300 > Replace "driver" with "drivers" in the filepath to net_failover.c > > Cc: Sridhar Samudrala > Cc: David S. Miller > Cc: net...@vger.kernel.org > Fixes: cfc80d9a1163 ("net: Introduce net_failover driver") > Signed-off-by: Denis Efremov

[PATCH 5.2 105/144] ARM: davinci: fix sleep.S build error on ARMv4

2019-08-14 Thread Greg Kroah-Hartman
[ Upstream commit d64b212ea960db4276a1d8372bd98cb861dfcbb0 ] When building a multiplatform kernel that includes armv4 support, the default target CPU does not support the blx instruction, which leads to a build failure: arch/arm/mach-davinci/sleep.S: Assembler messages: arch/arm/mach-davinci/slee

[PATCH 5.2 110/144] test_firmware: fix a memory leak bug

2019-08-14 Thread Greg Kroah-Hartman
[ Upstream commit d4fddac5a51c378c5d3e68658816c37132611e1f ] In test_firmware_init(), the buffer pointed to by the global pointer 'test_fw_config' is allocated through kzalloc(). Then, the buffer is initialized in __test_firmware_config_init(). In the case that the initialization fails, the follow

[PATCH 5.2 106/144] ARM: dts: bcm: bcm47094: add missing #cells for mdio-bus-mux

2019-08-14 Thread Greg Kroah-Hartman
[ Upstream commit 3a9d2569e45cb02769cda26fee4a02126867c934 ] The mdio-bus-mux has no #address-cells/#size-cells property, which causes a few dtc warnings: arch/arm/boot/dts/bcm47094-linksys-panamera.dts:129.4-18: Warning (reg_format): /mdio-bus-mux/mdio@200:reg: property has invalid length (4 by

[PATCH 5.2 086/144] drm/msm/dpu: Correct dpu encoder spinlock initialization

2019-08-14 Thread Greg Kroah-Hartman
[ Upstream commit 2e7b801eadbf327bf61041c943e5c44a5de4b0e5 ] dpu encoder spinlock should be initialized during dpu encoder init instead of dpu encoder setup which is part of modeset init. Signed-off-by: Shubhashree Dhar [seanpaul resolved conflict in old init removal and revised the commit messa

Re: [PATCH 09/22] arm64: dts: qcom: pm8150b: Add Base DTS file

2019-08-14 Thread Stephen Boyd
Quoting Vinod Koul (2019-08-14 05:49:59) > diff --git a/arch/arm64/boot/dts/qcom/pm8150b.dtsi > b/arch/arm64/boot/dts/qcom/pm8150b.dtsi > new file mode 100644 > index ..c0a678b0f159 > --- /dev/null > +++ b/arch/arm64/boot/dts/qcom/pm8150b.dtsi > @@ -0,0 +1,22 @@ > +// SPDX-License-Iden

[PATCH 5.2 096/144] perf script: Fix off by one in brstackinsn IPC computation

2019-08-14 Thread Greg Kroah-Hartman
[ Upstream commit dde4e732a5b02fa5599c2c0e6c48a0c11789afc4 ] When we hit the end of a program block, need to count the last instruction too for the IPC computation. This caused large errors for small blocks. % perf script -b ls / > /dev/null Before: % perf script -F +brstackinsn --xed ...

[PATCH 5.2 055/144] netfilter: conntrack: always store window size un-scaled

2019-08-14 Thread Greg Kroah-Hartman
[ Upstream commit 959b69ef57db00cb33e9c4777400ae7183ebddd3 ] Jakub Jankowski reported following oddity: After 3 way handshake completes, timeout of new connection is set to max_retrans (300s) instead of established (5 days). shortened excerpt from pcap provided: 25.070622 IP (flags [DF], proto T

[PATCH 5.2 061/144] rq-qos: set ourself TASK_UNINTERRUPTIBLE after we schedule

2019-08-14 Thread Greg Kroah-Hartman
[ Upstream commit d14a9b389a86a5154b704bc88ce8dd37c701456a ] In case we get a spurious wakeup we need to make sure to re-set ourselves to TASK_UNINTERRUPTIBLE so we don't busy wait. Reviewed-by: Oleg Nesterov Signed-off-by: Josef Bacik Signed-off-by: Jens Axboe Signed-off-by: Sasha Levin ---

[PATCH 5.2 062/144] rq-qos: use a mb for got_token

2019-08-14 Thread Greg Kroah-Hartman
[ Upstream commit ac38297f7038cd5b80d66f8809c7bbf5b70031f3 ] Oleg noticed that our checking of data.got_token is unsafe in the cleanup case, and should really use a memory barrier. Use a wmb on the write side, and a rmb() on the read side. We don't need one in the main loop since we're saved by

[PATCH 5.2 084/144] arm64: entry: SP Alignment Fault doesnt write to FAR_EL1

2019-08-14 Thread Greg Kroah-Hartman
[ Upstream commit 40ca0ce56d4bb889dc43b455c55398468115569a ] Comparing the arm-arm's pseudocode for AArch64.PCAlignmentFault() with AArch64.SPAlignmentFault() shows that SP faults don't copy the faulty-SP to FAR_EL1, but this is where we read from, and the address we provide to user-space with th

[PATCH 5.2 060/144] rq-qos: dont reset has_sleepers on spurious wakeups

2019-08-14 Thread Greg Kroah-Hartman
[ Upstream commit 64e7ea875ef63b2801be7954cf7257d1bfccc266 ] If we raced with somebody else getting an inflight counter we could fail to get an inflight counter with no sleepers on the list, and thus need to go to sleep. In this case has_sleepers should be true because we are now relying on the w

[PATCH 5.2 078/144] allocate_flower_entry: should check for null deref

2019-08-14 Thread Greg Kroah-Hartman
[ Upstream commit bb1320834b8a80c6ac2697ab418d066981ea08ba ] allocate_flower_entry does not check for allocation success, but tries to deref the result. I only moved the spin_lock under null check, because the caller is checking allocation's status at line 652. Signed-off-by: Navid Emamdoost Si

[PATCH 5.2 079/144] hwmon: (occ) Fix division by zero issue

2019-08-14 Thread Greg Kroah-Hartman
[ Upstream commit 211186cae14de09573b062e478eb9fe215aed8d9 ] The code in occ_get_powr_avg() invokes div64_u64() without checking the divisor. In case the divisor is zero, kernel gets an "Division by zero in kernel" error. Check the divisor and make it return 0 if the divisor is 0. Fixes: c10e753

[PATCH 5.2 077/144] mac80211: dont warn about CW params when not using them

2019-08-14 Thread Greg Kroah-Hartman
[ Upstream commit d2b3fe42bc629c2d4002f652b3abdfb2e72991c7 ] ieee80211_set_wmm_default() normally sets up the initial CW min/max for each queue, except that it skips doing this if the driver doesn't support ->conf_tx. We still end up calling drv_conf_tx() in some cases (e.g., ieee80211_reconfig())

[PATCH 5.2 080/144] hwmon: (nct6775) Fix register address and added missed tolerance for nct6106

2019-08-14 Thread Greg Kroah-Hartman
[ Upstream commit f3d43e2e45fd9d44ba52d20debd12cd4ee9c89bf ] Fixed address of third NCT6106_REG_WEIGHT_DUTY_STEP, and added missed NCT6106_REG_TOLERANCE_H. Fixes: 6c009501ff200 ("hwmon: (nct6775) Add support for NCT6102D/6106D") Signed-off-by: Bjoern Gerhart Signed-off-by: Guenter Roeck Signed-

[PATCH 5.2 068/144] drm/amd/display: use encoders engine id to find matched free audio device

2019-08-14 Thread Greg Kroah-Hartman
[ Upstream commit 74eda776d7a4e69ec7aa1ce30a87636f14220fbb ] [Why] On some platforms, the encoder id 3 is not populated. So the encoders are not stored in right order as index (id: 0, 1, 2, 4, 5) at pool. This would cause encoders id 4 & id 5 to fail when finding corresponding audio device, defaul

[PATCH 5.2 069/144] drm/amd/display: put back front end initialization sequence

2019-08-14 Thread Greg Kroah-Hartman
[ Upstream commit feb7eb522e0a7a22c1e60d386bd3c3bfa1d5e4f7 ] [Why] Seamless boot optimization removed proper front end power off sequence. In driver disable enable case, this causes driver to power gate hubp and dpp while there is still memory fetching going on, this can cause invalid memory reque

[PATCH 5.2 027/144] x86/mm: Check for pfn instead of page in vmalloc_sync_one()

2019-08-14 Thread Greg Kroah-Hartman
From: Joerg Roedel commit 51b75b5b563a2637f9d8dc5bd02a31b2ff9e5ea0 upstream. Do not require a struct page for the mapped memory location because it might not exist. This can happen when an ioremapped region is mapped with 2MB pages. Fixes: 5d72b4fba40ef ('x86, mm: support huge I/O mapping capab

Re: [5.3.0-rc4-next][bisected 882632][qla2xxx] WARNING: CPU: 10 PID: 425 at drivers/scsi/qla2xxx/qla_isr.c:2784 qla2x00_status_entry.isra

2019-08-14 Thread Bart Van Assche
On 8/14/19 9:52 AM, Abdul Haleem wrote: > Greeting's > > Today's linux-next kernel (5.3.0-rc4-next-20190813) booted with warning on > my powerpc power 8 lpar > > The WARN_ON_ONCE() was introduced by commit 88263208 (scsi: qla2xxx: Complain > if sp->done() is not...) > > boot logs: > > WARNIN

[PATCH 5.2 074/144] iscsi_ibft: make ISCSI_IBFT dependson ACPI instead of ISCSI_IBFT_FIND

2019-08-14 Thread Greg Kroah-Hartman
[ Upstream commit 94bccc34071094c165c79b515d21b63c78f7e968 ] iscsi_ibft can use ACPI to find the iBFT entry during bootup, currently, ISCSI_IBFT depends on ISCSI_IBFT_FIND which is a X86 legacy way to find the iBFT by searching through the low memory. This patch changes the dependency so that othe

[PATCH 5.2 034/144] x86/purgatory: Do not use __builtin_memcpy and __builtin_memset

2019-08-14 Thread Greg Kroah-Hartman
From: Nick Desaulniers commit 4ce97317f41d38584fb93578e922fcd19e535f5b upstream. Implementing memcpy and memset in terms of __builtin_memcpy and __builtin_memset is problematic. GCC at -O2 will replace calls to the builtins with calls to memcpy and memset (but will generate an inline implementa

[PATCH 5.2 076/144] mac80211: fix possible memory leak in ieee80211_assign_beacon

2019-08-14 Thread Greg Kroah-Hartman
[ Upstream commit bcc27fab8cc673ddc95452674373cce618ccb3a3 ] Free new beacon_data in ieee80211_assign_beacon whenever ieee80211_assign_beacon fails Fixes: 8860020e0be1 ("cfg80211: restructure AP/GO mode API") Fixes: bc847970f432 ("mac80211: support FTM responder configuration/statistic") Signed-o

[PATCH 5.2 054/144] netfilter: nf_tables: fix module autoload for redir

2019-08-14 Thread Greg Kroah-Hartman
[ Upstream commit f41828ee10b36644bb2b2bfa9dd1d02f55aa0516 ] Fix expression for autoloading. Fixes: 5142967ab524 ("netfilter: nf_tables: fix module autoload with inet family") Signed-off-by: Christian Hesse Signed-off-by: Pablo Neira Ayuso Signed-off-by: Sasha Levin --- net/netfilter/nft_red

Re: Explicitly marking initializer overrides (was "Re: [PATCH] arm64/cache: silence -Woverride-init warnings")

2019-08-14 Thread Nathan Chancellor
On Fri, Aug 09, 2019 at 09:32:51AM +0100, Mark Rutland wrote: > On Thu, Aug 08, 2019 at 10:09:16AM -0700, Nathan Chancellor wrote: > > On Thu, Aug 08, 2019 at 11:38:08AM +0100, Mark Rutland wrote: > > > On Wed, Aug 07, 2019 at 11:29:16PM -0400, Qian Cai wrote: > > > > The commit 155433cb365e ("arm6

[PATCH 5.2 056/144] netfilter: nft_hash: fix symhash with modulus one

2019-08-14 Thread Greg Kroah-Hartman
[ Upstream commit 28b1d6ef53e3303b90ca8924bb78f31fa527cafb ] The rule below doesn't work as the kernel raises -ERANGE. nft add rule netdev nftlb lb01 ip daddr set \ symhash mod 1 map { 0 : 192.168.0.10 } fwd to "eth0" This patch allows to use the symhash modulus with one element, in the

<    1   2   3   4   5   6   7   8   9   10   >