xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
978,316 Commits 2 Branches 0 Tags
fbdf9cd38a0801c687ff60b74384e778d43eef6d
Commit Graph

978316 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Minchan Kim
fbdf9cd38a FROMLIST: mm: page_alloc: dump migrate-failed pages only at -EBUSY 
alloc_contig_dump_pages() aims for helping debugging page migration
failure by elevated page refcount compared to expected_count.  (for the
detail, please look at migrate_page_move_mapping)

However, -ENOMEM is just the case that system is under memory pressure
state, not relevant with page refcount at all.  Thus, the dumping page
list is not helpful for the debugging point of view.

Link: https://lkml.kernel.org/r/YKa2Wyo9xqIErpfa@google.com
Signed-off-by: Minchan Kim <minchan@kernel.org>
Reviewed-by: David Hildenbrand <david@redhat.com>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: John Dias <joaodias@google.com>
Cc: Michal Hocko <mhocko@suse.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Bug: 188908895
Link: https://lore.kernel.org/mm-commits/20210525000343.YBEWQU38O%25akpm@linux-foundation.org/T/#u
Signed-off-by: Minchan Kim <minchan@google.com>
Change-Id: Ia077e0d88375d2b59fa5f2a8a530257c6558e8d5
 2021-05-26 18:31:23 +00:00
Liujie Xie
8c944335a3 ANDROID: Fix access invalid addr because it is not initialized 
The addr is not initialized, we may access a random value.

Fixes: dc5241048f ("ANDROID: vendor_hooks: Add hooks for reducing virtual address fragmentation")
Bug: 187259935
Signed-off-by: Liujie Xie <xieliujie@oppo.com>
Change-Id: I770bf5e69e6fcd4e1ccd3987b4891156892de758
 2021-05-26 18:00:01 +00:00
Alexander Potapenko
5a18a6da18 UPSTREAM: kasan: slab: always reset the tag in get_freepointer_safe() 
With CONFIG_DEBUG_PAGEALLOC enabled, the kernel should also untag the
object pointer, as done in get_freepointer().

Failing to do so reportedly leads to SLUB freelist corruptions that
manifest as boot-time crashes.

Link: https://lkml.kernel.org/r/20210514072228.534418-1-glider@google.com
Signed-off-by: Alexander Potapenko <glider@google.com>
Cc: Marco Elver <elver@google.com>
Cc: Vincenzo Frascino <vincenzo.frascino@arm.com>
Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
Cc: Andrey Konovalov <andreyknvl@gmail.com>
Cc: Elliot Berman <eberman@codeaurora.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Bug: 181230759
Test: run on QEMU with CONFIG_DEBUG_PAGEALLOC
(cherry picked from commit f70b00496f2a0669fdb19a783e613bdbdedcf901)
Signed-off-by: Alexander Potapenko <glider@google.com>
Change-Id: Ifb512c0241465d8035d55a161bcc304d5b2287d5
 2021-05-26 13:10:43 +02:00
Shaleen Agrawal
df15808ad3 ANDROID: abi_gki_aarch64_qcom: Add topology update symbols 
Add topology_update_done and
__tracepoint_android_vh_update_topology_flags_workfn to QCOM
symbol list which allows modules to get insights into topology update
statuses.

Leaf changes summary: 3 artifacts changed (1 filtered out)
Changed leaf types summary: 0 (1 filtered out) leaf type changed
Removed/Changed/Added functions summary: 0 Removed, 0 Changed, 1 Added
function
Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 2 Added
variables

1 Added function:
[A] 'function int __traceiter_android_vh_update_topology_flags_workfn(void*, void*)'

2 Added variables:
[A] 'tracepoint __tracepoint_android_vh_update_topology_flags_workfn'
[A] 'bool topology_update_done'

Bug: 189256326
Change-Id: Idb9eaed3c34b1d8b2ff3e9ad5c0866fc3857d6b9
Signed-off-by: Shaleen Agrawal <shalagra@codeaurora.org>
 2021-05-25 22:09:01 -07:00
Akilesh Kailash
9d80dbe0a3 ANDROID: dm-user: Fail the IO if there is no daemon 
IO processing is done by the daemon when bio requests
are queued in dm-user. If there is no daemon, then
IO's will be hung indefinitely; This can lead
to sysrq kernel panic when llkd daemon detects
IO's hung in uninterruptible state.

Terminate the bio reqests as an IO error if there
is no daemon to process. We already track if
there are any user-space threads processing
IO's per dm-user targer. If there is no daemon,
queue the IO requests to a delayed work queue.
If the daemon does not show up within that time frame,
worker thread will fail the IO with an IO error.

Bug: 188362117
Test: 1: Kill the daemon when IO to dm-user is in-flight
         Verify IO failure and no IO hang.
2: Verify daemon picks up IO's queued for cancelling.
3: Full and incremental OTA.
4: Terminate snapuserd daemon during post-install phase of OTA
5: Add user-space unit test to test (1)

Signed-off-by: Akilesh Kailash <akailash@google.com>
Change-Id: I9351e8f664edc67d75c4ea10a065928ef85e5490
 2021-05-25 23:58:09 +00:00
Chun-Hung Wu
78a9cd650a ANDROID: add initial symbol list for mtk 
1. Generated with:
  ./extract_symbols --whitelist abi_gki_aarch64_mtk --skip-module-grouping target_ko_path/
2. update mtk entry in build.config.gki.aarch64
Leaf changes summary: 233 artifacts changed
Changed leaf types summary: 0 leaf type changed
Removed/Changed/Added functions summary: 0 Removed, 0 Changed, 207 Added functions
Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 26 Added variables

Leaf changes summary: 233 artifacts changed
Changed leaf types summary: 0 leaf type changed
Removed/Changed/Added functions summary: 0 Removed, 0 Changed, 207 Added functions
Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 26 Added variables

207 Added functions:

  [A] 'function int __iio_device_register(iio_dev*, module*)'
  [A] 'function int __kfifo_to_user(__kfifo*, void*, unsigned long int, unsigned int*)'
  [A] 'function int __trace_puts(unsigned long int, const char*, int)'
  [A] 'function int __traceiter_android_rvh_find_busiest_group(void*, sched_group*, rq*, int*)'
  [A] 'function int __traceiter_android_rvh_finish_prio_fork(void*, task_struct*)'
  [A] 'function int __traceiter_android_rvh_prepare_prio_fork(void*, task_struct*)'
  [A] 'function int __traceiter_android_rvh_rtmutex_prepare_setprio(void*, task_struct*, task_struct*)'
  [A] 'function int __traceiter_android_rvh_set_user_nice(void*, task_struct*, long int*, bool*)'
  [A] 'function int __traceiter_android_rvh_setscheduler(void*, task_struct*)'
  [A] 'function int __traceiter_android_vh_alter_futex_plist_add(void*, plist_node*, plist_head*, bool*)'
  [A] 'function int __traceiter_android_vh_alter_rwsem_list_add(void*, rwsem_waiter*, rw_semaphore*, bool*)'
  [A] 'function int __traceiter_android_vh_cgroup_set_task(void*, int, task_struct*)'
  [A] 'function int __traceiter_android_vh_em_cpu_energy(void*, em_perf_domain*, unsigned long int, unsigned long int, unsigned long int*)'
  [A] 'function int __traceiter_android_vh_rwsem_init(void*, rw_semaphore*)'
  [A] 'function int __traceiter_android_vh_rwsem_wake(void*, rw_semaphore*)'
  [A] 'function int __traceiter_android_vh_rwsem_write_finished(void*, rw_semaphore*)'
  [A] 'function int __traceiter_android_vh_set_wake_flags(void*, int*, unsigned int*)'
  [A] 'function int __traceiter_android_vh_syscall_prctl_finished(void*, int, task_struct*)'
  [A] 'function int __v4l2_ctrl_s_ctrl(v4l2_ctrl*, s32)'
  [A] 'function int _raw_read_trylock(rwlock_t*)'
  [A] 'function void alarm_start(alarm*, ktime_t)'
  [A] 'function int bitmap_find_free_region(unsigned long int*, unsigned int, int)'
  [A] 'function void bitmap_free(const unsigned long int*)'
  [A] 'function unsigned long int* bitmap_zalloc(unsigned int, gfp_t)'
  [A] 'function void cfg80211_cac_event(net_device*, const cfg80211_chan_def*, nl80211_radar_event, gfp_t)'
  [A] 'function unsigned int cfg80211_classify8021d(sk_buff*, cfg80211_qos_map*)'
  [A] 'function void cfg80211_radar_event(wiphy*, cfg80211_chan_def*, gfp_t)'
  [A] 'function clk* clk_register_composite(device*, const char*, const char* const*, int, clk_hw*, const clk_ops*, clk_hw*, const clk_ops*, clk_hw*, const clk_ops*, unsigned long int)'
  [A] 'function clk* clk_register_divider_table(device*, const char*, const char*, unsigned long int, void*, u8, u8, u8, const clk_div_table*, spinlock_t*)'
  [A] 'function void cpu_hotplug_disable()'
  [A] 'function void cpu_hotplug_enable()'
  [A] 'function void cpufreq_unregister_governor(cpufreq_governor*)'
  [A] 'function void cpuidle_driver_state_disabled(cpuidle_driver*, int, bool)'
  [A] 'function cpuidle_driver* cpuidle_get_driver()'
  [A] 'function void cpuidle_pause_and_lock()'
  [A] 'function void cpuidle_resume_and_unlock()'
  [A] 'function int dapm_clock_event(snd_soc_dapm_widget*, snd_kcontrol*, int)'
  [A] 'function unsigned int dapm_kcontrol_get_value(const snd_kcontrol*)'
  [A] 'function int debug_locks_off()'
  [A] 'function void debugfs_create_devm_seqfile(device*, const char*, dentry*, int (seq_file*, void*)*)'
  [A] 'function dev_pm_opp* dev_pm_opp_find_freq_ceil_by_volt(device*, unsigned long int)'
  [A] 'function int dev_pm_opp_of_add_table_indexed(device*, int)'
  [A] 'function devfreq* devfreq_get_devfreq_by_phandle(device*, const char*, int)'
  [A] 'function unsigned int device_get_child_node_count(device*)'
  [A] 'function void device_link_remove(void*, device*)'
  [A] 'function int device_rename(device*, const char*)'
  [A] 'function void device_set_of_node_from_dev(device*, const device*)'
  [A] 'function void devm_devfreq_remove_device(device*, devfreq*)'
  [A] 'function pwm_device* devm_fwnode_pwm_get(device*, fwnode_handle*, const char*)'
  [A] 'function void devm_gpiod_put(device*, gpio_desc*)'
  [A] 'function void devm_led_classdev_unregister(device*, led_classdev*)'
  [A] 'function phy* devm_of_phy_get_by_index(device*, device_node*, int)'
  [A] 'function power_supply* devm_power_supply_get_by_phandle(device*, const char*)'
  [A] 'function void devm_regulator_unregister_notifier(regulator*, notifier_block*)'
  [A] 'function int drm_atomic_helper_legacy_gamma_set(drm_crtc*, u16*, u16*, u16*, uint32_t, drm_modeset_acquire_ctx*)'
  [A] 'function int drm_atomic_helper_resume(drm_device*, drm_atomic_state*)'
  [A] 'function drm_atomic_state* drm_atomic_helper_suspend(drm_device*)'
  [A] 'function void drm_calc_timestamping_constants(drm_crtc*, const drm_display_mode*)'
  [A] 'function int drm_gem_dumb_destroy(drm_file*, drm_device*, uint32_t)'
  [A] 'function em_perf_domain* em_cpu_get(int)'
  [A] 'function int em_dev_register_perf_domain(device*, unsigned int, em_data_callback*, cpumask_t*, bool)'
  [A] 'function int eth_header(sk_buff*, net_device*, unsigned short int, void*, void*, unsigned int)'
  [A] 'function int eth_header_cache(const neighbour*, hh_cache*, __be16)'
  [A] 'function void eth_header_cache_update(hh_cache*, const net_device*, const unsigned char*)'
  [A] 'function int eth_header_parse(const sk_buff*, unsigned char*)'
  [A] 'function pid* find_pid_ns(int, pid_namespace*)'
  [A] 'function int follow_pfn(vm_area_struct*, unsigned long int, unsigned long int*)'
  [A] 'function void for_each_kernel_tracepoint(void (tracepoint*, void*)*, void*)'
  [A] 'function int freq_qos_add_notifier(freq_constraints*, freq_qos_req_type, notifier_block*)'
  [A] 'function int get_kernel_pages(const kvec*, int, int, page**)'
  [A] 'function void iio_buffer_init(iio_buffer*)'
  [A] 'function void iio_buffer_put(iio_buffer*)'
  [A] 'function iio_channel* iio_channel_get(device*, const char*)'
  [A] 'function void iio_channel_release(iio_channel*)'
  [A] 'function void iio_device_attach_buffer(iio_dev*, iio_buffer*)'
  [A] 'function int iio_get_channel_type(iio_channel*, iio_chan_type*)'
  [A] 'function s64 iio_get_time_ns(const iio_dev*)'
  [A] 'function int iio_push_to_buffers(iio_dev*, void*)'
  [A] 'function int iio_read_channel_attribute(iio_channel*, int*, int*, iio_chan_info_enum)'
  [A] 'function int iio_read_channel_raw(iio_channel*, int*)'
  [A] 'function int kernfs_path_from_node(kernfs_node*, kernfs_node*, char*, size_t)'
  [A] 'function kobject* kset_find_obj(kset*, const char*)'
  [A] 'function int led_get_flash_fault(led_classdev_flash*, u32*)'
  [A] 'function int led_set_brightness_sync(led_classdev*, led_brightness)'
  [A] 'function int led_set_flash_brightness(led_classdev_flash*, u32)'
  [A] 'function int led_set_flash_timeout(led_classdev_flash*, u32)'
  [A] 'function void led_sysfs_disable(led_classdev*)'
  [A] 'function void led_sysfs_enable(led_classdev*)'
  [A] 'function void led_trigger_remove(led_classdev*)'
  [A] 'function int led_update_brightness(led_classdev*)'
  [A] 'function int led_update_flash_brightness(led_classdev_flash*)'
  [A] 'function ssize_t mipi_dsi_generic_write(mipi_dsi_device*, void*, size_t)'
  [A] 'function int mod_timer_pending(timer_list*, unsigned long int)'
  [A] 'function int mutex_lock_killable(mutex*)'
  [A] 'function int n_tty_ioctl_helper(tty_struct*, file*, unsigned int, unsigned long int)'
  [A] 'function void* netdev_alloc_frag(unsigned int)'
  [A] 'function int nf_register_net_hooks(net*, const nf_hook_ops*, unsigned int)'
  [A] 'function void nf_unregister_net_hooks(net*, const nf_hook_ops*, unsigned int)'
  [A] 'function nvmem_device* nvmem_device_get(device*, const char*)'
  [A] 'function dma_chan* of_dma_xlate_by_chan_id(of_phandle_args*, of_dma*)'
  [A] 'function backlight_device* of_find_backlight_by_node(device_node*)'
  [A] 'function int of_genpd_add_device(of_phandle_args*, device*)'
  [A] 'function int of_irq_to_resource_table(device_node*, resource*, int)'
  [A] 'function int of_remove_property(device_node*, property*)'
  [A] 'function int param_get_bool(char*, const kernel_param*)'
  [A] 'function int param_get_charp(char*, const kernel_param*)'
  [A] 'function int param_get_ulong(char*, const kernel_param*)'
  [A] 'function int param_set_charp(const char*, const kernel_param*)'
  [A] 'function int param_set_ulong(const char*, const kernel_param*)'
  [A] 'function phy* phy_get(device*, const char*)'
  [A] 'function void phy_put(device*, phy*)'
  [A] 'function int pinconf_generic_parse_dt_config(device_node*, pinctrl_dev*, unsigned long int**, unsigned int*)'
  [A] 'function int pinctrl_gpio_direction_input(unsigned int)'
  [A] 'function int pinctrl_gpio_direction_output(unsigned int)'
  [A] 'function int pinctrl_utils_add_map_configs(pinctrl_dev*, pinctrl_map**, unsigned int*, unsigned int*, const char*, unsigned long int*, unsigned int, pinctrl_map_type)'
  [A] 'function int pinctrl_utils_reserve_map(pinctrl_dev*, pinctrl_map**, unsigned int*, unsigned int*, unsigned int)'
  [A] 'function void platform_unregister_drivers(platform_driver* const*, unsigned int)'
  [A] 'function int pm_genpd_add_device(generic_pm_domain*, device*)'
  [A] 'function int pm_genpd_remove_device(device*)'
  [A] 'function bool pm_suspend_default_s2idle()'
  [A] 'function void rcu_idle_enter()'
  [A] 'function void rcu_idle_exit()'
  [A] 'function device* rdev_get_dev(regulator_dev*)'
  [A] 'function int regulator_list_voltage(regulator*, unsigned int)'
  [A] 'function int regulator_map_voltage_iterate(regulator_dev*, int, int)'
  [A] 'function int regulator_map_voltage_linear_range(regulator_dev*, int, int)'
  [A] 'function int regulator_set_voltage_time(regulator*, int, int)'
  [A] 'function int regulator_set_voltage_time_sel(regulator_dev*, unsigned int, unsigned int)'
  [A] 'function int regulator_sync_voltage(regulator*)'
  [A] 'function int remove_proc_subtree(const char*, proc_dir_entry*)'
  [A] 'function int reset_controller_register(reset_controller_dev*)'
  [A] 'function rpmsg_endpoint* rpmsg_create_ept(rpmsg_device*, rpmsg_rx_cb_t, void*, rpmsg_channel_info)'
  [A] 'function void rpmsg_destroy_ept(rpmsg_endpoint*)'
  [A] 'function rtc_time rtc_ktime_to_tm(ktime_t)'
  [A] 'function int rtc_nvmem_register(rtc_device*, nvmem_config*)'
  [A] 'function ktime_t rtc_tm_to_ktime(rtc_time)'
  [A] 'function unsigned long int schedutil_cpu_util(int, unsigned long int, unsigned long int, schedutil_type, task_struct*)'
  [A] 'function int sdio_claim_irq(sdio_func*, sdio_irq_handler_t*)'
  [A] 'function u8 sdio_readb(sdio_func*, unsigned int, int*)'
  [A] 'function u32 sdio_readl(sdio_func*, unsigned int, int*)'
  [A] 'function int sdio_release_irq(sdio_func*)'
  [A] 'function void sdio_writeb(sdio_func*, u8, unsigned int, int*)'
  [A] 'function void sdio_writel(sdio_func*, u32, unsigned int, int*)'
  [A] 'function int send_sig(int, task_struct*, int)'
  [A] 'function int seq_open_private(file*, const seq_operations*, int)'
  [A] 'function void serial8250_do_set_termios(uart_port*, ktermios*, ktermios*)'
  [A] 'function void serial8250_do_shutdown(uart_port*)'
  [A] 'function int serial8250_do_startup(uart_port*)'
  [A] 'function uart_8250_port* serial8250_get_port(int)'
  [A] 'function int serial8250_register_8250_port(uart_8250_port*)'
  [A] 'function void serial8250_resume_port(int)'
  [A] 'function void serial8250_rpm_get(uart_8250_port*)'
  [A] 'function void serial8250_rpm_put(uart_8250_port*)'
  [A] 'function void serial8250_suspend_port(int)'
  [A] 'function void serial8250_unregister_port(int)'
  [A] 'function void* skb_pull_rcsum(sk_buff*, unsigned int)'
  [A] 'function void snd_pcm_lib_preallocate_pages_for_all(snd_pcm*, int, void*, size_t, size_t)'
  [A] 'function int snd_soc_poweroff(device*)'
  [A] 'function int snd_soc_resume(device*)'
  [A] 'function void suspend_set_ops(const platform_suspend_ops*)'
  [A] 'function regmap* syscon_regmap_lookup_by_compatible(const char*)'
  [A] 'function void syscore_resume()'
  [A] 'function int syscore_suspend()'
  [A] 'function void tty_driver_flush_buffer(tty_struct*)'
  [A] 'function int tty_register_ldisc(int, tty_ldisc_ops*)'
  [A] 'function int tty_unregister_ldisc(int)'
  [A] 'function void* typec_mux_get_drvdata(typec_mux*)'
  [A] 'function typec_mux* typec_mux_register(device*, const typec_mux_desc*)'
  [A] 'function void typec_mux_unregister(typec_mux*)'
  [A] 'function int typec_partner_set_identity(typec_partner*)'
  [A] 'function int typec_set_orientation(typec_port*, typec_orientation)'
  [A] 'function void typec_set_vconn_role(typec_port*, typec_role)'
  [A] 'function unsigned int uart_get_divisor(uart_port*, unsigned int)'
  [A] 'function void ufshcd_delay_us(unsigned long int, unsigned long int)'
  [A] 'function int ufshcd_hba_enable(ufs_hba*)'
  [A] 'function int ufshcd_link_recovery(ufs_hba*)'
  [A] 'function int ufshcd_make_hba_operational(ufs_hba*)'
  [A] 'function void unpin_user_pages(page**, unsigned long int)'
  [A] 'function usb_hcd* usb_create_shared_hcd(const hc_driver*, device*, const char*, usb_hcd*)'
  [A] 'function int usb_gadget_map_request(usb_gadget*, usb_request*, int)'
  [A] 'function void usb_gadget_unmap_request(usb_gadget*, usb_request*, int)'
  [A] 'function v4l2_async_subdev* v4l2_async_notifier_add_fwnode_subdev(v4l2_async_notifier*, fwnode_handle*, unsigned int)'
  [A] 'function void v4l2_async_notifier_init(v4l2_async_notifier*)'
  [A] 'function int v4l2_async_notifier_register(v4l2_device*, v4l2_async_notifier*)'
  [A] 'function void v4l2_async_notifier_unregister(v4l2_async_notifier*)'
  [A] 'function int v4l2_async_register_subdev(v4l2_subdev*)'
  [A] 'function void v4l2_async_unregister_subdev(v4l2_subdev*)'
  [A] 'function int v4l2_ctrl_subscribe_event(v4l2_fh*, const v4l2_event_subscription*)'
  [A] 'function int v4l2_fh_is_singular(v4l2_fh*)'
  [A] 'function void v4l2_m2m_buf_remove_by_buf(v4l2_m2m_queue_ctx*, vb2_v4l2_buffer*)'
  [A] 'function int v4l2_m2m_ioctl_create_bufs(file*, void*, v4l2_create_buffers*)'
  [A] 'function int v4l2_m2m_ioctl_expbuf(file*, void*, v4l2_exportbuffer*)'
  [A] 'function int v4l2_m2m_ioctl_prepare_buf(file*, void*, v4l2_buffer*)'
  [A] 'function int v4l2_m2m_ioctl_qbuf(file*, void*, v4l2_buffer*)'
  [A] 'function void v4l2_m2m_resume(v4l2_m2m_dev*)'
  [A] 'function void v4l2_m2m_suspend(v4l2_m2m_dev*)'
  [A] 'function int v4l2_src_change_event_subscribe(v4l2_fh*, const v4l2_event_subscription*)'
  [A] 'function int vsprintf(char*, const char*, va_list)'
  [A] 'function long int work_on_cpu(int, long int (void*)*, void*)'
  [A] 'function int xhci_check_bandwidth(usb_hcd*, usb_device*)'
  [A] 'function int xhci_drop_endpoint(usb_hcd*, usb_device*, usb_host_endpoint*)'
  [A] 'function void xhci_reset_bandwidth(usb_hcd*, usb_device*)'
  [A] 'function int zlib_deflate(z_streamp, int)'
  [A] 'function int zlib_deflateEnd(z_streamp)'
  [A] 'function int zlib_deflateInit2(z_streamp, int, int, int, int, int)'
  [A] 'function int zlib_deflateReset(z_streamp)'
  [A] 'function int zlib_deflate_workspacesize(int, int)'

26 Added variables:

  [A] 'tracepoint __tracepoint_android_rvh_find_busiest_group'
  [A] 'tracepoint __tracepoint_android_rvh_finish_prio_fork'
  [A] 'tracepoint __tracepoint_android_rvh_prepare_prio_fork'
  [A] 'tracepoint __tracepoint_android_rvh_rtmutex_prepare_setprio'
  [A] 'tracepoint __tracepoint_android_rvh_set_user_nice'
  [A] 'tracepoint __tracepoint_android_rvh_setscheduler'
  [A] 'tracepoint __tracepoint_android_vh_alter_futex_plist_add'
  [A] 'tracepoint __tracepoint_android_vh_alter_rwsem_list_add'
  [A] 'tracepoint __tracepoint_android_vh_cgroup_set_task'
  [A] 'tracepoint __tracepoint_android_vh_em_cpu_energy'
  [A] 'tracepoint __tracepoint_android_vh_rwsem_init'
  [A] 'tracepoint __tracepoint_android_vh_rwsem_wake'
  [A] 'tracepoint __tracepoint_android_vh_rwsem_write_finished'
  [A] 'tracepoint __tracepoint_android_vh_set_wake_flags'
  [A] 'tracepoint __tracepoint_android_vh_syscall_prctl_finished'
  [A] 'const clk_ops clk_divider_ops'
  [A] 'const clk_ops clk_gate_ops'
  [A] 'const clk_ops clk_mux_ops'
  [A] 'rwlock_t dev_base_lock'
  [A] 'const font_desc font_vga_8x16'
  [A] 'const char hex_asc[17]'
  [A] 'neigh_table nd_tbl'
  [A] 'workqueue_struct* pm_wq'
  [A] 'bus_type spi_bus_type'
  [A] 'workqueue_struct* system_freezable_power_efficient_wq'
  [A] 'const vb2_mem_ops vb2_dma_contig_memops'

Bug: 149040612
Change-Id: I1af3902f42555ea002f3c6cb9979bc231b51e427
Signed-off-by: Chun-Hung Wu <chun-hung.wu@mediatek.com>
 2021-05-25 19:45:10 +00:00
Suren Baghdasaryan
4b280e66ee ANDROID: fix a warning due to type mismatch in pr_warn 
For pr_warn format string to correctly reflect the types of the arguments.

Fixes: 0249af9c0e ("ANDROID: mm: page_alloc: skip dump pages for freeable page")
Bug: 188908895
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
Change-Id: Id218aafa9fa4148f036f35ca190cf65bfee2160e
 2021-05-25 17:46:02 +00:00
Will Deacon
2f056f11e8 ANDROID: sched: fix race with CPU hot-unplug when overriding affinity 
Migrating a task to a CPU which is concurrently being taken offline can
cause the migration to fail silently, with the task left running on the
old CPU. This is usually not the end of the world, but when forcefully
migrating a 32-bit task during execve() from a 64-bit task, it is
imperative that we do not attempt to return to userspace on a
64-bit-only CPU.

Take the CPU hotplug lock for read while forcefully migrating a 32-bit
task on execve() so that the migration cannot fail.

Bug: 187917024
Change-Id: I6eaf2a564fe3ad73c03f0a6029aade09c707330f
Signed-off-by: Will Deacon <willdeacon@google.com>
 2021-05-25 17:43:02 +00:00
Guangming Cao
b6cab5d17d ANDROID: GKI: Enable CONFIG_IOMMU_IO_PGTABLE_ARMV7S 
To enable IOMMU driver, we need to enable CONFIG_IOMMU_IO_PGTABLE_ARMV7S
as build-in by default value in gki_defconfig.

Bug: 189076024

Change-Id: Ia9a87682c2c56338f57703a4bc01793fbe1a3496
Signed-off-by: Guangming Cao <Guangming.Cao@mediatek.com>
 2021-05-25 10:03:28 +00:00
Pavankumar Kondeti
5212e0235f ANDROID: abi_gki_aarch64_qcom: Add kthread cgroup migration rvh symbol 
Add __tracepoint_android_rvh_cgroup_force_kthread_migration to QCOM
symbol list which allows vendor modules to relax the kthread
cgroup migration restrictions.

Bug: 184594949
Change-Id: Ibf11d767a82366f7999af08423866ddc6db7fcf6
Signed-off-by: Pavankumar Kondeti <quic_pkondeti@quicinc.com>
 2021-05-25 09:57:27 +00:00
Ronak Vijay Raheja
80fef39de7 ANDROID: usb: gadget: Resolve NULL pointer dereference in composite_disconnect 
There is a race possibility in android_disconnect and
configfs_composite_unbind while using cdev leading to a NULL pointer
dereference in composite_disconnect. Combine android_disconnect with
configfs_composite_disconnect and remove the android_disconnect function.
configfs_composite_disconnect already has a gi->spinlock in place to
prevent the race condition.

Bug: 177038050
Change-Id: Idfdebaf69f3aa68d90b55bffd7c2e04410c5a47f
Signed-off-by: Ronak Vijay Raheja <rraheja@codeaurora.org>
Signed-off-by: Jack Pham <jackp@codeaurora.org>
Signed-off-by: Macpaul Lin <macpaul.lin@mediatek.com>
Signed-off-by: Eddie Hung <eddie.hung@mediatek.com>
 2021-05-25 08:13:49 +00:00
Jihan Cha
2ea27b7efa ANDROID: GKI: Kconfig.gki: enable CONFIG_HMM_MIRROR with HIDDEN GPU 
Add "select HMM_MIRROR" in GKI_HIDDEN_GPU_CONFIGS for enabling HMM_MIRROR

Bug: 188491116
Signed-off-by: Jihan Cha <jihan.cha@samsung.com>
Change-Id: I780f24bad7d2fd9646f127422878e802fe088c51
 2021-05-25 17:53:54 +09:00
Minchan Kim
3a71ca1496 ANDROID: mm: page_pinner: skip marking failure on freeable pages 
Sometime, pages are temporarily pinnned during migration and the migration
fails. However, putback_movable_pages will end up freeing them if their
page refcount are 1. Thus, it doesn't need to mark them as failure, which
just consumes page_pinner logbuffer to lose old history.

Bug: 188908895
Signed-off-by: Minchan Kim <minchan@google.com>
Change-Id: I8564b72b212a5095cfe3ba6bf5622a9b62f5b455
 2021-05-24 23:45:11 +00:00
Minchan Kim
0249af9c0e ANDROID: mm: page_alloc: skip dump pages for freeable page 
We have seen following dumps from alloc_contig_dump_pages.

05-20 20:04:41.847  1000   503   503 W page    : 00000000691ab336 refcount:1 mapcount:0 mapping:0000000000000000 index:0x72aa2d7 pfn:0x9e912e
05-20 20:04:41.847  1000   503   503 W anon flags: 0x8000000000080004(uptodate|swapbacked)
05-20 20:04:41.847  1000   503   503 W raw     : 8000000000080004 ffffffff25844b48 ffffffff25844bc8 ffffff89824e46c1
05-20 20:04:41.847  1000   503   503 W raw     : 00000000072aa2d7 0000000000000000 00000001ffffffff 0000000000000000
05-20 20:04:41.847  1000   503   503 W         : page dumped because: migration failure
05-20 20:04:41.847  1000   503   503 F         : page_pinner info is not present (never set?)
05-20 20:04:41.847  1000   503   503 W page    : 0000000099d95f64 refcount:1 mapcount:0 mapping:0000000000000000 index:0x72aa2d6 pfn:0x9e912d
05-20 20:04:41.847  1000   503   503 W anon flags: 0x8000000000080004(uptodate|swapbacked)
05-20 20:04:41.847  1000   503   503 W raw     : 8000000000080004 ffffffff25844b08 ffffffff25844b88 ffffff89824e46c1
05-20 20:04:41.847  1000   503   503 W raw     : 00000000072aa2d6 0000000000000000 00000001ffffffff 0000000000000000
05-20 20:04:41.847  1000   503   503 W         : page dumped because: migration failure
05-20 20:04:41.847  1000   503   503 F         : page_pinner info is not present (never set?)
05-20 20:04:41.847  1000   503   503 W page    : 000000009af39924 refcount:1 mapcount:0 mapping:0000000000000000 index:0x72aa2d5 pfn:0x9e912c
05-20 20:04:41.847  1000   503   503 W anon flags: 0x8000000000080004(uptodate|swapbacked)
05-20 20:04:41.847  1000   503   503 W raw     : 8000000000080004 ffffffff25844ac8 ffffffff25844b48 ffffff89824e46c1
05-20 20:04:41.847  1000   503   503 W raw     : 00000000072aa2d5 0000000000000000 00000001ffffffff 0000000000000000
05-20 20:04:41.847  1000   503   503 W         : page dumped because: migration failure
..
..

It means those pages would be temporarily pinnned during migration so the migration
failed but putback_movable_pages will end up freeing them since their page refcount
are 1 now. Thus, it doesn't deserve to dump them for the debugging aid.

Bug: 188908895
Signed-off-by: Minchan Kim <minchan@google.com>
Change-Id: I24092f0e53a3154443b9d6786413c4714ae853e8
 2021-05-24 23:44:42 +00:00
Prakash Gupta
72488b3be4 ANDROID: mm, oom: add vendor hook to prevent oom panic 
In some cases we would like to bypass oom panic and give the system more
time to cleanup memory. Add vendor hook to allow skipping the oom panic.

Bug: 186875166
Change-Id: I64e74b2c013d6f18d74504777c6559d9ae07e008
Signed-off-by: Prakash Gupta <guptap@codeaurora.org>
 2021-05-24 23:21:17 +05:30
Martin Liu
83aa0320cf FROMLIST: kthread: Fix kthread_mod_delayed_work vs kthread_cancel_delayed_work_sync race 
We encountered a system hang issue while doing the tests. The callstack
is as following

	schedule+0x80/0x100
	schedule_timeout+0x48/0x138
	wait_for_common+0xa4/0x134
	wait_for_completion+0x1c/0x2c
	kthread_flush_work+0x114/0x1cc
	kthread_cancel_work_sync.llvm.16514401384283632983+0xe8/0x144
	kthread_cancel_delayed_work_sync+0x18/0x2c
	xxxx_pm_notify+0xb0/0xd8
	blocking_notifier_call_chain_robust+0x80/0x194
	pm_notifier_call_chain_robust+0x28/0x4c
	suspend_prepare+0x40/0x260
	enter_state+0x80/0x3f4
	pm_suspend+0x60/0xdc
	state_store+0x108/0x144
	kobj_attr_store+0x38/0x88
	sysfs_kf_write+0x64/0xc0
	kernfs_fop_write_iter+0x108/0x1d0
	vfs_write+0x2f4/0x368
	ksys_write+0x7c/0xec

When we started investigating, we found race between
kthread_mod_delayed_work vs kthread_cancel_delayed_work_sync. The race's
result could be simply reproduced as a kthread_mod_delayed_work with
a following kthread_flush_work call.

Thing is we release kthread_mod_delayed_work kspin_lock in
__kthread_cancel_work so it opens a race window for
kthread_cancel_delayed_work_sync to change the canceling count used to
prevent dwork from being requeued before calling kthread_flush_work.
However, we don't check the canceling count after returning from
__kthread_cancel_work and then insert the dwork to the worker. It
results the following kthread_flush_work inserts flush work to dwork's
tail which is at worker's dealyed_work_list. Therefore, flush work will
never get moved to the worker's work_list to be executed. Finally,
kthread_cancel_delayed_work_sync will NOT be able to get completed and
wait forever. The code sequence diagram is as following

Thread A                Thread B
kthread_mod_delayed_work
  spin_lock
   __kthread_cancel_work
    canceling = 1
    spin_unlock
                        kthread_cancel_delayed_work_sync
                          spin_lock
                            kthread_cancel_work
                          canceling = 2
                          spin_unlock
    del_timer_sync
    spin_lock
    canceling = 1 // canceling count gets update in ThreadB before
  queue_delayed_work // dwork is put into the woker’s dealyed_work_list
                        without checking the canceling count
 spin_unlock
                          kthread_flush_work
                            spin_lock
                            Insert flush work // at the tail of the
			                         dwork which is at
						 the worker’s
						 dealyed_work_list
                            spin_unlock
                            wait_for_completion // Thread B stuck here as
			                           flush work will never
						   get executed

The canceling count could change in __kthread_cancel_work as the spinlock
get released and regained in between, let's check the count again before
we queue the delayed work to avoid the race.

Bug: 185578292
Link: https://lore.kernel.org/lkml/20210513065458.941403-1-liumartin@google.com
Fixes: 37be45d49d ("kthread: allow to cancel kthread work")
Tested-by: David Chao <davidchao@google.com>
Signed-off-by: Martin Liu <liumartin@google.com>
Reviewed-by: Petr Mladek <pmladek@suse.com>
Change-Id: I7bf68c66cc80cf7aa27a4712238444281826234b
 2021-05-24 17:29:02 +00:00
Kyle Tso
3b14b6a653 FROMGIT: usb: typec: tcpm: Respond Not_Supported if no snk_vdo 
If snk_vdo is not populated from fwnode, it implies the port does not
support responding to SVDM commands. Not_Supported Message shall be sent
if the contract is in PD3. And for PD2, the port shall ignore the
commands.

Fixes: 193a68011f ("staging: typec: tcpm: Respond to Discover Identity commands")
Cc: stable <stable@vger.kernel.org>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Signed-off-by: Kyle Tso <kyletso@google.com>
Link: https://lore.kernel.org/r/20210523015855.1785484-3-kyletso@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit a20dcf53ea9836387b229c4878f9559cf1b55b71
 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-linus)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: If2cdde576ae108d675820c22b9db6cfab087ce00
 2021-05-24 15:18:20 +02:00
Kyle Tso
5b94901e9e FROMGIT: usb: typec: tcpm: Properly interrupt VDM AMS 
When a VDM AMS is interrupted by Messages other than VDM, the AMS needs
to be finished properly. Also start a VDM AMS if receiving SVDM Commands
from the port partner to complement the functionality of tcpm_vdm_ams().

Fixes: 0908c5aca31e ("usb: typec: tcpm: AMS and Collision Avoidance")
Cc: stable <stable@vger.kernel.org>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Signed-off-by: Kyle Tso <kyletso@google.com>
Link: https://lore.kernel.org/r/20210523015855.1785484-2-kyletso@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit a20dcf53ea9836387b229c4878f9559cf1b55b71
 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-linus)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I081fffec4939119b3008126e0e628e0265d59c14
 2021-05-24 15:18:20 +02:00
Andy Shevchenko
d79aca773d FROMGIT: usb: typec: tcpm: Use LE to CPU conversion when accessing msg->header 
Sparse is not happy about strict type handling:
  .../typec/tcpm/tcpm.c:2720:27: warning: restricted __le16 degrades to integer
  .../typec/tcpm/tcpm.c:2814:32: warning: restricted __le16 degrades to integer

Fix this by converting LE to CPU before use.

Fixes: ae8a2ca8a2 ("usb: typec: Group all TCPCI/TCPM code together")
Fixes: 64f7c494a3 ("typec: tcpm: Add support for sink PPS related messages")
Cc: stable <stable@vger.kernel.org>
Cc: Adam Thomson <Adam.Thomson.Opensource@diasemi.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Adam Thomson <Adam.Thomson.Opensource@diasemi.com>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20210519100358.64018-1-andriy.shevchenko@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit c58bbe3477f75deb7883983e6cf428404a107555
 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-linus)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I5b48ec712d6c7839e29ab03f0535a73d467df9e6
 2021-05-24 15:18:04 +02:00
Greg Kroah-Hartman
855f802610 Merge 5.10.39 into android12-5.10 
Changes in 5.10.39
	x86/msr: Fix wr/rdmsr_safe_regs_on_cpu() prototypes
	drm/i915/display: fix compiler warning about array overrun
	airo: work around stack usage warning
	kgdb: fix gcc-11 warning on indentation
	usb: sl811-hcd: improve misleading indentation
	cxgb4: Fix the -Wmisleading-indentation warning
	isdn: capi: fix mismatched prototypes
	virtio_net: Do not pull payload in skb->head
	PCI: thunder: Fix compile testing
	dmaengine: dw-edma: Fix crash on loading/unloading driver
	ARM: 9066/1: ftrace: pause/unpause function graph tracer in cpu_suspend()
	ACPI / hotplug / PCI: Fix reference count leak in enable_slot()
	PCI: tegra: Fix runtime PM imbalance in pex_ep_event_pex_rst_deassert()
	Input: elants_i2c - do not bind to i2c-hid compatible ACPI instantiated devices
	Input: silead - add workaround for x86 BIOS-es which bring the chip up in a stuck state
	NFS: NFS_INO_REVAL_PAGECACHE should mark the change attribute invalid
	um: Mark all kernel symbols as local
	um: Disable CONFIG_GCOV with MODULES
	ARM: 9075/1: kernel: Fix interrupted SMC calls
	platform/chrome: cros_ec_typec: Add DP mode check
	riscv: Use $(LD) instead of $(CC) to link vDSO
	scripts/recordmcount.pl: Fix RISC-V regex for clang
	riscv: Workaround mcount name prior to clang-13
	scsi: lpfc: Fix illegal memory access on Abort IOCBs
	ceph: fix fscache invalidation
	ceph: don't clobber i_snap_caps on non-I_NEW inode
	ceph: don't allow access to MDS-private inodes
	scsi: target: tcmu: Return from tcmu_handle_completions() if cmd_id not found
	amdgpu/pm: Prevent force of DCEFCLK on NAVI10 and SIENNA_CICHLID
	bridge: Fix possible races between assigning rx_handler_data and setting IFF_BRIDGE_PORT bit
	net: hsr: check skb can contain struct hsr_ethhdr in fill_frame_info
	nvmet: remove unsupported command noise
	drm/amd/display: Fix two cursor duplication when using overlay
	gpiolib: acpi: Add quirk to ignore EC wakeups on Dell Venue 10 Pro 5055
	net:CXGB4: fix leak if sk_buff is not used
	ALSA: hda: generic: change the DAC ctl name for LO+SPK or LO+HP
	block: reexpand iov_iter after read/write
	lib: stackdepot: turn depot_lock spinlock to raw_spinlock
	net: stmmac: Do not enable RX FIFO overflow interrupts
	ip6_gre: proper dev_{hold|put} in ndo_[un]init methods
	sit: proper dev_{hold|put} in ndo_[un]init methods
	ip6_tunnel: sit: proper dev_{hold|put} in ndo_[un]init methods
	ipv6: remove extra dev_hold() for fallback tunnels
	tweewide: Fix most Shebang lines
	scripts: switch explicitly to Python 3
	Linux 5.10.39

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I8406e9c091597f1b08395c84e3728d640d91cbb9
 2021-05-22 15:34:48 +02:00
Claire Chang
762674c166 UPSTREAM: swiotlb: Fix the type of index 
[ Upstream commit 95b079d8215b83b37fa59341fda92fcb9392f14a ]

Fix the type of index from unsigned int to int since find_slots() might
return -1.

Fixes: 26a7e094783d ("swiotlb: refactor swiotlb_tbl_map_single")
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Claire Chang <tientzu@chromium.org>
Signed-off-by: Konrad Rzeszutek Wilk <konrad@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit a01572e21f)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I352263b74ff89334c1e3fd6f1b70e1c08b7f2b47
 2021-05-22 11:05:15 +00:00
Elliot Berman
26a8c2ab13 ANDROID: Don't add image to all target with KBUILD_MIXED_TREE 
When KBUILD_MIXED_TREE is set, vmlinux and related images come from an
out-of-tree location and vmlinux shouldn't be compiled. arch/arm64 and
arch/x86 add the default Images to all target, so remove that default
behavior when KBUILD_MIXED_TREE is set.

This when an out-of-tree module, e.g. virtual-device, runs "make all"
instead of "make modules".

Bug: 178469391
Change-Id: I8c43d5d66a8bf6ed27f91df7e173399d4f4a23c0
Signed-off-by: Elliot Berman <quic_eberman@quicinc.com>
 2021-05-22 09:43:36 +00:00
Greg Kroah-Hartman
b561d56bcd Linux 5.10.39 
Link: https://lore.kernel.org/r/20210520092053.559923764@linuxfoundation.org
Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Fox Chen <foxhlchen@gmail.com>
Link: https://lore.kernel.org/r/20210520152240.517446848@linuxfoundation.org
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Jason Self <jason@bluehome.net>
Tested-by: Florian Fainelli <f.fainelli@gmail.com>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Fox Chen <foxhlchen@gmail.com>
Tested-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2021-05-22 11:40:55 +02:00
Andy Shevchenko
090466aeb6 scripts: switch explicitly to Python 3 
commit 51839e29cb5954470ea4db7236ef8c3d77a6e0bb upstream.

Some distributions are about to switch to Python 3 support only.
This means that /usr/bin/python, which is Python 2, is not available
anymore. Hence, switch scripts to use Python 3 explicitly.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2021-05-22 11:40:55 +02:00
Finn Behrens
6ae514b8a8 tweewide: Fix most Shebang lines 
commit c25ce589dca10d64dde139ae093abc258a32869c upstream.

Change every shebang which does not need an argument to use /usr/bin/env.
This is needed as not every distro has everything under /usr/bin,
sometimes not even bash.

Signed-off-by: Finn Behrens <me@kloenk.de>
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2021-05-22 11:40:55 +02:00
Eric Dumazet
ccecbcc9c5 ipv6: remove extra dev_hold() for fallback tunnels 
commit 0d7a7b2014b1a499a0fe24c9f3063d7856b5aaaf upstream.

My previous commits added a dev_hold() in tunnels ndo_init(),
but forgot to remove it from special functions setting up fallback tunnels.

Fallback tunnels do call their respective ndo_init()

This leads to various reports like :

unregister_netdevice: waiting for ip6gre0 to become free. Usage count = 2

Fixes: 48bb5697269a ("ip6_tunnel: sit: proper dev_{hold|put} in ndo_[un]init methods")
Fixes: 6289a98f0817 ("sit: proper dev_{hold|put} in ndo_[un]init methods")
Fixes: 40cb881b5aaa ("ip6_vti: proper dev_{hold|put} in ndo_[un]init methods")
Fixes: 7f700334be9a ("ip6_gre: proper dev_{hold|put} in ndo_[un]init methods")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2021-05-22 11:40:55 +02:00
Eric Dumazet
019c426b53 ip6_tunnel: sit: proper dev_{hold|put} in ndo_[un]init methods 
commit 48bb5697269a7cbe5194dbb044dc38c517e34c58 upstream.

Same reasons than for the previous commits :
6289a98f0817 ("sit: proper dev_{hold|put} in ndo_[un]init methods")
40cb881b5aaa ("ip6_vti: proper dev_{hold|put} in ndo_[un]init methods")
7f700334be9a ("ip6_gre: proper dev_{hold|put} in ndo_[un]init methods")

After adopting CONFIG_PCPU_DEV_REFCNT=n option, syzbot was able to trigger
a warning [1]

Issue here is that:

- all dev_put() should be paired with a corresponding prior dev_hold().

- A driver doing a dev_put() in its ndo_uninit() MUST also
  do a dev_hold() in its ndo_init(), only when ndo_init()
  is returning 0.

Otherwise, register_netdevice() would call ndo_uninit()
in its error path and release a refcount too soon.

[1]
WARNING: CPU: 1 PID: 21059 at lib/refcount.c:31 refcount_warn_saturate+0xbf/0x1e0 lib/refcount.c:31
Modules linked in:
CPU: 1 PID: 21059 Comm: syz-executor.4 Not tainted 5.12.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:refcount_warn_saturate+0xbf/0x1e0 lib/refcount.c:31
Code: 1d 6a 5a e8 09 31 ff 89 de e8 8d 1a ab fd 84 db 75 e0 e8 d4 13 ab fd 48 c7 c7 a0 e1 c1 89 c6 05 4a 5a e8 09 01 e8 2e 36 fb 04 <0f> 0b eb c4 e8 b8 13 ab fd 0f b6 1d 39 5a e8 09 31 ff 89 de e8 58
RSP: 0018:ffffc900025aefe8 EFLAGS: 00010282
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000040000 RSI: ffffffff815c51f5 RDI: fffff520004b5def
RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffff815bdf8e R11: 0000000000000000 R12: ffff888023488568
R13: ffff8880254e9000 R14: 00000000dfd82cfd R15: ffff88802ee2d7c0
FS:  00007f13bc590700(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f0943e74000 CR3: 0000000025273000 CR4: 00000000001506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 __refcount_dec include/linux/refcount.h:344 [inline]
 refcount_dec include/linux/refcount.h:359 [inline]
 dev_put include/linux/netdevice.h:4135 [inline]
 ip6_tnl_dev_uninit+0x370/0x3d0 net/ipv6/ip6_tunnel.c:387
 register_netdevice+0xadf/0x1500 net/core/dev.c:10308
 ip6_tnl_create2+0x1b5/0x400 net/ipv6/ip6_tunnel.c:263
 ip6_tnl_newlink+0x312/0x580 net/ipv6/ip6_tunnel.c:2052
 __rtnl_newlink+0x1062/0x1710 net/core/rtnetlink.c:3443
 rtnl_newlink+0x64/0xa0 net/core/rtnetlink.c:3491
 rtnetlink_rcv_msg+0x44e/0xad0 net/core/rtnetlink.c:5553
 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2502
 netlink_unicast_kernel net/netlink/af_netlink.c:1312 [inline]
 netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1338
 netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1927
 sock_sendmsg_nosec net/socket.c:654 [inline]
 sock_sendmsg+0xcf/0x120 net/socket.c:674
 ____sys_sendmsg+0x6e8/0x810 net/socket.c:2350
 ___sys_sendmsg+0xf3/0x170 net/socket.c:2404
 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2433
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Fixes: 919067cc845f ("net: add CONFIG_PCPU_DEV_REFCNT")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2021-05-22 11:40:55 +02:00
Eric Dumazet
3c24dbd358 sit: proper dev_{hold|put} in ndo_[un]init methods 
commit 6289a98f0817a4a457750d6345e754838eae9439 upstream.

After adopting CONFIG_PCPU_DEV_REFCNT=n option, syzbot was able to trigger
a warning [1]

Issue here is that:

- all dev_put() should be paired with a corresponding prior dev_hold().

- A driver doing a dev_put() in its ndo_uninit() MUST also
  do a dev_hold() in its ndo_init(), only when ndo_init()
  is returning 0.

Otherwise, register_netdevice() would call ndo_uninit()
in its error path and release a refcount too soon.

Fixes: 919067cc845f ("net: add CONFIG_PCPU_DEV_REFCNT")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2021-05-22 11:40:55 +02:00
Eric Dumazet
b18b1548cb ip6_gre: proper dev_{hold|put} in ndo_[un]init methods 
commit 7f700334be9aeb91d5d86ef9ad2d901b9b453e9b upstream.

After adopting CONFIG_PCPU_DEV_REFCNT=n option, syzbot was able to trigger
a warning [1]

Issue here is that:

- all dev_put() should be paired with a corresponding dev_hold(),
  and vice versa.

- A driver doing a dev_put() in its ndo_uninit() MUST also
  do a dev_hold() in its ndo_init(), only when ndo_init()
  is returning 0.

Otherwise, register_netdevice() would call ndo_uninit()
in its error path and release a refcount too soon.

ip6_gre for example (among others problematic drivers)
has to use dev_hold() in ip6gre_tunnel_init_common()
instead of from ip6gre_newlink_common(), covering
both ip6gre_tunnel_init() and ip6gre_tap_init()/

Note that ip6gre_tunnel_init_common() is not called from
ip6erspan_tap_init() thus we also need to add a dev_hold() there,
as ip6erspan_tunnel_uninit() does call dev_put()

[1]
refcount_t: decrement hit 0; leaking memory.
WARNING: CPU: 0 PID: 8422 at lib/refcount.c:31 refcount_warn_saturate+0xbf/0x1e0 lib/refcount.c:31
Modules linked in:
CPU: 1 PID: 8422 Comm: syz-executor854 Not tainted 5.12.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:refcount_warn_saturate+0xbf/0x1e0 lib/refcount.c:31
Code: 1d 6a 5a e8 09 31 ff 89 de e8 8d 1a ab fd 84 db 75 e0 e8 d4 13 ab fd 48 c7 c7 a0 e1 c1 89 c6 05 4a 5a e8 09 01 e8 2e 36 fb 04 <0f> 0b eb c4 e8 b8 13 ab fd 0f b6 1d 39 5a e8 09 31 ff 89 de e8 58
RSP: 0018:ffffc900018befd0 EFLAGS: 00010282
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff88801ef19c40 RSI: ffffffff815c51f5 RDI: fffff52000317dec
RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffff815bdf8e R11: 0000000000000000 R12: ffff888018cf4568
R13: ffff888018cf4c00 R14: ffff8880228f2000 R15: ffffffff8d659b80
FS:  00000000014eb300(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055d7bf2b3138 CR3: 0000000014933000 CR4: 00000000001506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 __refcount_dec include/linux/refcount.h:344 [inline]
 refcount_dec include/linux/refcount.h:359 [inline]
 dev_put include/linux/netdevice.h:4135 [inline]
 ip6gre_tunnel_uninit+0x3d7/0x440 net/ipv6/ip6_gre.c:420
 register_netdevice+0xadf/0x1500 net/core/dev.c:10308
 ip6gre_newlink_common.constprop.0+0x158/0x410 net/ipv6/ip6_gre.c:1984
 ip6gre_newlink+0x275/0x7a0 net/ipv6/ip6_gre.c:2017
 __rtnl_newlink+0x1062/0x1710 net/core/rtnetlink.c:3443
 rtnl_newlink+0x64/0xa0 net/core/rtnetlink.c:3491
 rtnetlink_rcv_msg+0x44e/0xad0 net/core/rtnetlink.c:5553
 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2502
 netlink_unicast_kernel net/netlink/af_netlink.c:1312 [inline]
 netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1338
 netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1927
 sock_sendmsg_nosec net/socket.c:654 [inline]
 sock_sendmsg+0xcf/0x120 net/socket.c:674
 ____sys_sendmsg+0x6e8/0x810 net/socket.c:2350
 ___sys_sendmsg+0xf3/0x170 net/socket.c:2404
 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2433
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46

Fixes: 919067cc845f ("net: add CONFIG_PCPU_DEV_REFCNT")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2021-05-22 11:40:55 +02:00
Yannick Vignon
0473032821 net: stmmac: Do not enable RX FIFO overflow interrupts 
[ Upstream commit 8a7cb245cf28cb3e541e0d6c8624b95d079e155b ]

The RX FIFO overflows when the system is not able to process all received
packets and they start accumulating (first in the DMA queue in memory,
then in the FIFO). An interrupt is then raised for each overflowing packet
and handled in stmmac_interrupt(). This is counter-productive, since it
brings the system (or more likely, one CPU core) to its knees to process
the FIFO overflow interrupts.

stmmac_interrupt() handles overflow interrupts by writing the rx tail ptr
into the corresponding hardware register (according to the MAC spec, this
has the effect of restarting the MAC DMA). However, without freeing any rx
descriptors, the DMA stops right away, and another overflow interrupt is
raised as the FIFO overflows again. Since the DMA is already restarted at
the end of stmmac_rx_refill() after freeing descriptors, disabling FIFO
overflow interrupts and the corresponding handling code has no side effect,
and eliminates the interrupt storm when the RX FIFO overflows.

Signed-off-by: Yannick Vignon <yannick.vignon@nxp.com>
Link: https://lore.kernel.org/r/20210506143312.20784-1-yannick.vignon@oss.nxp.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2021-05-22 11:40:55 +02:00
Zqiang
1fb05a3f1f lib: stackdepot: turn depot_lock spinlock to raw_spinlock 
[ Upstream commit 78564b9434878d686c5f88c4488b20cccbcc42bc ]

In RT system, the spin_lock will be replaced by sleepable rt_mutex lock,
in __call_rcu(), disable interrupts before calling
kasan_record_aux_stack(), will trigger this calltrace:

  BUG: sleeping function called from invalid context at kernel/locking/rtmutex.c:951
  in_atomic(): 0, irqs_disabled(): 1, non_block: 0, pid: 19, name: pgdatinit0
  Call Trace:
    ___might_sleep.cold+0x1b2/0x1f1
    rt_spin_lock+0x3b/0xb0
    stack_depot_save+0x1b9/0x440
    kasan_save_stack+0x32/0x40
    kasan_record_aux_stack+0xa5/0xb0
    __call_rcu+0x117/0x880
    __exit_signal+0xafb/0x1180
    release_task+0x1d6/0x480
    exit_notify+0x303/0x750
    do_exit+0x678/0xcf0
    kthread+0x364/0x4f0
    ret_from_fork+0x22/0x30

Replace spinlock with raw_spinlock.

Link: https://lkml.kernel.org/r/20210329084009.27013-1-qiang.zhang@windriver.com
Signed-off-by: Zqiang <qiang.zhang@windriver.com>
Reported-by: Andrew Halaney <ahalaney@redhat.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Gustavo A. R. Silva <gustavoars@kernel.org>
Cc: Vijayanand Jitta <vjitta@codeaurora.org>
Cc: Vinayak Menon <vinmenon@codeaurora.org>
Cc: Yogesh Lal <ylal@codeaurora.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2021-05-22 11:40:55 +02:00
yangerkun
7da9368f91 block: reexpand iov_iter after read/write 
[ Upstream commit cf7b39a0cbf6bf57aa07a008d46cf695add05b4c ]

We get a bug:

BUG: KASAN: slab-out-of-bounds in iov_iter_revert+0x11c/0x404
lib/iov_iter.c:1139
Read of size 8 at addr ffff0000d3fb11f8 by task

CPU: 0 PID: 12582 Comm: syz-executor.2 Not tainted
5.10.0-00843-g352c8610ccd2 #2
Hardware name: linux,dummy-virt (DT)
Call trace:
 dump_backtrace+0x0/0x2d0 arch/arm64/kernel/stacktrace.c:132
 show_stack+0x28/0x34 arch/arm64/kernel/stacktrace.c:196
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x110/0x164 lib/dump_stack.c:118
 print_address_description+0x78/0x5c8 mm/kasan/report.c:385
 __kasan_report mm/kasan/report.c:545 [inline]
 kasan_report+0x148/0x1e4 mm/kasan/report.c:562
 check_memory_region_inline mm/kasan/generic.c:183 [inline]
 __asan_load8+0xb4/0xbc mm/kasan/generic.c:252
 iov_iter_revert+0x11c/0x404 lib/iov_iter.c:1139
 io_read fs/io_uring.c:3421 [inline]
 io_issue_sqe+0x2344/0x2d64 fs/io_uring.c:5943
 __io_queue_sqe+0x19c/0x520 fs/io_uring.c:6260
 io_queue_sqe+0x2a4/0x590 fs/io_uring.c:6326
 io_submit_sqe fs/io_uring.c:6395 [inline]
 io_submit_sqes+0x4c0/0xa04 fs/io_uring.c:6624
 __do_sys_io_uring_enter fs/io_uring.c:9013 [inline]
 __se_sys_io_uring_enter fs/io_uring.c:8960 [inline]
 __arm64_sys_io_uring_enter+0x190/0x708 fs/io_uring.c:8960
 __invoke_syscall arch/arm64/kernel/syscall.c:36 [inline]
 invoke_syscall arch/arm64/kernel/syscall.c:48 [inline]
 el0_svc_common arch/arm64/kernel/syscall.c:158 [inline]
 do_el0_svc+0x120/0x290 arch/arm64/kernel/syscall.c:227
 el0_svc+0x1c/0x28 arch/arm64/kernel/entry-common.c:367
 el0_sync_handler+0x98/0x170 arch/arm64/kernel/entry-common.c:383
 el0_sync+0x140/0x180 arch/arm64/kernel/entry.S:670

Allocated by task 12570:
 stack_trace_save+0x80/0xb8 kernel/stacktrace.c:121
 kasan_save_stack mm/kasan/common.c:48 [inline]
 kasan_set_track mm/kasan/common.c:56 [inline]
 __kasan_kmalloc+0xdc/0x120 mm/kasan/common.c:461
 kasan_kmalloc+0xc/0x14 mm/kasan/common.c:475
 __kmalloc+0x23c/0x334 mm/slub.c:3970
 kmalloc include/linux/slab.h:557 [inline]
 __io_alloc_async_data+0x68/0x9c fs/io_uring.c:3210
 io_setup_async_rw fs/io_uring.c:3229 [inline]
 io_read fs/io_uring.c:3436 [inline]
 io_issue_sqe+0x2954/0x2d64 fs/io_uring.c:5943
 __io_queue_sqe+0x19c/0x520 fs/io_uring.c:6260
 io_queue_sqe+0x2a4/0x590 fs/io_uring.c:6326
 io_submit_sqe fs/io_uring.c:6395 [inline]
 io_submit_sqes+0x4c0/0xa04 fs/io_uring.c:6624
 __do_sys_io_uring_enter fs/io_uring.c:9013 [inline]
 __se_sys_io_uring_enter fs/io_uring.c:8960 [inline]
 __arm64_sys_io_uring_enter+0x190/0x708 fs/io_uring.c:8960
 __invoke_syscall arch/arm64/kernel/syscall.c:36 [inline]
 invoke_syscall arch/arm64/kernel/syscall.c:48 [inline]
 el0_svc_common arch/arm64/kernel/syscall.c:158 [inline]
 do_el0_svc+0x120/0x290 arch/arm64/kernel/syscall.c:227
 el0_svc+0x1c/0x28 arch/arm64/kernel/entry-common.c:367
 el0_sync_handler+0x98/0x170 arch/arm64/kernel/entry-common.c:383
 el0_sync+0x140/0x180 arch/arm64/kernel/entry.S:670

Freed by task 12570:
 stack_trace_save+0x80/0xb8 kernel/stacktrace.c:121
 kasan_save_stack mm/kasan/common.c:48 [inline]
 kasan_set_track+0x38/0x6c mm/kasan/common.c:56
 kasan_set_free_info+0x20/0x40 mm/kasan/generic.c:355
 __kasan_slab_free+0x124/0x150 mm/kasan/common.c:422
 kasan_slab_free+0x10/0x1c mm/kasan/common.c:431
 slab_free_hook mm/slub.c:1544 [inline]
 slab_free_freelist_hook mm/slub.c:1577 [inline]
 slab_free mm/slub.c:3142 [inline]
 kfree+0x104/0x38c mm/slub.c:4124
 io_dismantle_req fs/io_uring.c:1855 [inline]
 __io_free_req+0x70/0x254 fs/io_uring.c:1867
 io_put_req_find_next fs/io_uring.c:2173 [inline]
 __io_queue_sqe+0x1fc/0x520 fs/io_uring.c:6279
 __io_req_task_submit+0x154/0x21c fs/io_uring.c:2051
 io_req_task_submit+0x2c/0x44 fs/io_uring.c:2063
 task_work_run+0xdc/0x128 kernel/task_work.c:151
 get_signal+0x6f8/0x980 kernel/signal.c:2562
 do_signal+0x108/0x3a4 arch/arm64/kernel/signal.c:658
 do_notify_resume+0xbc/0x25c arch/arm64/kernel/signal.c:722
 work_pending+0xc/0x180

blkdev_read_iter can truncate iov_iter's count since the count + pos may
exceed the size of the blkdev. This will confuse io_read that we have
consume the iovec. And once we do the iov_iter_revert in io_read, we
will trigger the slab-out-of-bounds. Fix it by reexpand the count with
size has been truncated.

blkdev_write_iter can trigger the problem too.

Signed-off-by: yangerkun <yangerkun@huawei.com>
Acked-by: Pavel Begunkov <asml.silencec@gmail.com>
Link: https://lore.kernel.org/r/20210401071807.3328235-1-yangerkun@huawei.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2021-05-22 11:40:55 +02:00
Hui Wang
87f627a028 ALSA: hda: generic: change the DAC ctl name for LO+SPK or LO+HP 
[ Upstream commit f48652bbe3ae62ba2835a396b7e01f063e51c4cd ]

Without this change, the DAC ctl's name could be changed only when
the machine has both Speaker and Headphone, but we met some machines
which only has Lineout and Headhpone, and the Lineout and Headphone
share the Audio Mixer0 and DAC0, the ctl's name is set to "Front".

On most of machines, the "Front" is used for Speaker only or Lineout
only, but on this machine it is shared by Lineout and Headphone,
This introduces an issue in the pipewire and pulseaudio, suppose users
want the Headphone to be on and the Speaker/Lineout to be off, they
could turn off the "Front", this works on most of the machines, but on
this machine, the "Front" couldn't be turned off otherwise the
headphone will be off too. Here we do some change to let the ctl's
name change to "Headphone+LO" on this machine, and pipewire and
pulseaudio already could handle "Headphone+LO" and "Speaker+LO".
(https://gitlab.freedesktop.org/pipewire/pipewire/-/issues/747)

BugLink: http://bugs.launchpad.net/bugs/804178
Signed-off-by: Hui Wang <hui.wang@canonical.com>
Link: https://lore.kernel.org/r/20210504073917.22406-1-hui.wang@canonical.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2021-05-22 11:40:54 +02:00
Íñigo Huguet
027926f4ff net:CXGB4: fix leak if sk_buff is not used 
[ Upstream commit 52bfcdd87e83d9e69d22da5f26b1512ffc81deed ]

An sk_buff is allocated to send a flow control message, but it's not
sent in all cases: in case the state is not appropiate to send it or if
it can't be enqueued.

In the first of these 2 cases, the sk_buff was discarded but not freed,
producing a memory leak.

Signed-off-by: Íñigo Huguet <ihuguet@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2021-05-22 11:40:54 +02:00
Hans de Goede
9284b702c8 gpiolib: acpi: Add quirk to ignore EC wakeups on Dell Venue 10 Pro 5055 
[ Upstream commit da91ece226729c76f60708efc275ebd4716ad089 ]

Like some other Bay and Cherry Trail SoC based devices the Dell Venue
10 Pro 5055 has an embedded-controller which uses ACPI GPIO events to
report events instead of using the standard ACPI EC interface for this.

The EC interrupt is only used to report battery-level changes and
it keeps doing this while the system is suspended, causing the system
to not stay suspended.

Add an ignore-wake quirk for the GPIO pin used by the EC to fix the
spurious wakeups from suspend.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Acked-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2021-05-22 11:40:54 +02:00
Rodrigo Siqueira
1ce34fb34b drm/amd/display: Fix two cursor duplication when using overlay 
[ Upstream commit 16e9b3e58bc3fce7391539e0eb3fd167cbf9951f ]

Our driver supports overlay planes, and as expected, some userspace
compositor takes advantage of these features. If the userspace is not
enabling the cursor, they can use multiple planes as they please.
Nevertheless, we start to have constraints when userspace tries to
enable hardware cursor with various planes. Basically, we cannot draw
the cursor at the same size and position on two separated pipes since it
uses extra bandwidth and DML only run with one cursor.

For those reasons, when we enable hardware cursor and multiple planes,
our driver should accept variations like the ones described below:

  +-------------+   +--------------+
  | +---------+ |   |              |
  | |Primary  | |   | Primary      |
  | |         | |   | Overlay      |
  | +---------+ |   |              |
  |Overlay      |   |              |
  +-------------+   +--------------+

In this scenario, we can have the desktop UI in the overlay and some
other framebuffer attached to the primary plane (e.g., video). However,
userspace needs to obey some rules and avoid scenarios like the ones
described below (when enabling hw cursor):

                                      +--------+
                                      |Overlay |
 +-------------+    +-----+-------+ +-|        |--+
 | +--------+  | +--------+       | | +--------+  |
 | |Overlay |  | |Overlay |       | |             |
 | |        |  | |        |       | |             |
 | +--------+  | +--------+       | |             |
 | Primary     |    | Primary     | | Primary     |
 +-------------+    +-------------+ +-------------+

 +-------------+   +-------------+
 |     +--------+  |  Primary    |
 |     |Overlay |  |             |
 |     |        |  |             |
 |     +--------+  | +--------+  |
 | Primary     |   | |Overlay |  |
 +-------------+   +-|        |--+
                     +--------+

If the userspace violates some of the above scenarios, our driver needs
to reject the commit; otherwise, we can have unexpected behavior. Since
we don't have a proper driver validation for the above case, we can see
some problems like a duplicate cursor in applications that use multiple
planes. This commit fixes the cursor issue and others by adding adequate
verification for multiple planes.

Change since V1 (Harry and Sean):
- Remove cursor verification from the equation.

Cc: Louis Li <Ching-shih.Li@amd.com>
Cc: Nicholas Kazlauskas <Nicholas.Kazlauskas@amd.com>
Cc: Harry Wentland <Harry.Wentland@amd.com>
Cc: Hersen Wu <hersenxs.wu@amd.com>
Cc: Sean Paul <seanpaul@chromium.org>
Signed-off-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
Reviewed-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2021-05-22 11:40:54 +02:00
Keith Busch
3851a86c3d nvmet: remove unsupported command noise 
[ Upstream commit 4a20342572f66c5b20a1ee680f5ac0a13703748f ]

Nothing can stop a host from submitting invalid commands. The target
just needs to respond with an appropriate status, but that's not a
target error. Demote invalid command messages to the debug level so
these events don't spam the kernel logs.

Reported-by: Yi Zhang <yi.zhang@redhat.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Reviewed-by: Klaus Jensen <k.jensen@samsung.com>
Reviewed-by: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2021-05-22 11:40:54 +02:00
Phillip Potter
86587f35cb net: hsr: check skb can contain struct hsr_ethhdr in fill_frame_info 
[ Upstream commit 2e9f60932a2c19e8a11b4a69d419f107024b05a0 ]

Check at start of fill_frame_info that the MAC header in the supplied
skb is large enough to fit a struct hsr_ethhdr, as otherwise this is
not a valid HSR frame. If it is too small, return an error which will
then cause the callers to clean up the skb. Fixes a KMSAN-found
uninit-value bug reported by syzbot at:
https://syzkaller.appspot.com/bug?id=f7e9b601f1414f814f7602a82b6619a8d80bce3f

Reported-by: syzbot+e267bed19bfc5478fb33@syzkaller.appspotmail.com
Signed-off-by: Phillip Potter <phil@philpotter.co.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2021-05-22 11:40:54 +02:00
Zhang Zhengming
82646b1844 bridge: Fix possible races between assigning rx_handler_data and setting IFF_BRIDGE_PORT bit 
[ Upstream commit 59259ff7a81b9eb6213891c6451221e567f8f22f ]

There is a crash in the function br_get_link_af_size_filtered,
as the port_exists(dev) is true and the rx_handler_data of dev is NULL.
But the rx_handler_data of dev is correct saved in vmcore.

The oops looks something like:
 ...
 pc : br_get_link_af_size_filtered+0x28/0x1c8 [bridge]
 ...
 Call trace:
  br_get_link_af_size_filtered+0x28/0x1c8 [bridge]
  if_nlmsg_size+0x180/0x1b0
  rtnl_calcit.isra.12+0xf8/0x148
  rtnetlink_rcv_msg+0x334/0x370
  netlink_rcv_skb+0x64/0x130
  rtnetlink_rcv+0x28/0x38
  netlink_unicast+0x1f0/0x250
  netlink_sendmsg+0x310/0x378
  sock_sendmsg+0x4c/0x70
  __sys_sendto+0x120/0x150
  __arm64_sys_sendto+0x30/0x40
  el0_svc_common+0x78/0x130
  el0_svc_handler+0x38/0x78
  el0_svc+0x8/0xc

In br_add_if(), we found there is no guarantee that
assigning rx_handler_data to dev->rx_handler_data
will before setting the IFF_BRIDGE_PORT bit of priv_flags.
So there is a possible data competition:

CPU 0:                                                        CPU 1:
(RCU read lock)                                               (RTNL lock)
rtnl_calcit()                                                 br_add_slave()
  if_nlmsg_size()                                               br_add_if()
    br_get_link_af_size_filtered()                              -> netdev_rx_handler_register
                                                                    ...
                                                                    // The order is not guaranteed
      ...                                                           -> dev->priv_flags |= IFF_BRIDGE_PORT;
      // The IFF_BRIDGE_PORT bit of priv_flags has been set
      -> if (br_port_exists(dev)) {
        // The dev->rx_handler_data has NOT been assigned
        -> p = br_port_get_rcu(dev);
        ....
                                                                    -> rcu_assign_pointer(dev->rx_handler_data, rx_handler_data);
                                                                     ...

Fix it in br_get_link_af_size_filtered, using br_port_get_check_rcu() and checking the return value.

Signed-off-by: Zhang Zhengming <zhangzhengming@huawei.com>
Reviewed-by: Zhao Lei <zhaolei69@huawei.com>
Reviewed-by: Wang Xiaogang <wangxiaogang3@huawei.com>
Suggested-by: Nikolay Aleksandrov <nikolay@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2021-05-22 11:40:54 +02:00
Darren Powell
dcbc4e3380 amdgpu/pm: Prevent force of DCEFCLK on NAVI10 and SIENNA_CICHLID 
[ Upstream commit b117b3964f38a988cb79825950dbd607c02237f3 ]

Writing to dcefclk causes the gpu to become unresponsive, and requires a reboot.
Patch ignores a .force_clk_levels(SMU_DCEFCLK) call and issues an
info message.

Signed-off-by: Darren Powell <darren.powell@amd.com>
Reviewed-by: Kenneth Feng <kenneth.feng@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2021-05-22 11:40:54 +02:00
Bodo Stroesser
d47d0d1a1f scsi: target: tcmu: Return from tcmu_handle_completions() if cmd_id not found 
[ Upstream commit 9814b55cde0588b6d9bc496cee43f87316cbc6f1 ]

If tcmu_handle_completions() finds an invalid cmd_id while looping over cmd
responses from userspace it sets TCMU_DEV_BIT_BROKEN and breaks the
loop. This means that it does further handling for the tcmu device.

Skip that handling by replacing 'break' with 'return'.

Additionally change tcmu_handle_completions() from unsigned int to bool,
since the value used in return already is bool.

Link: https://lore.kernel.org/r/20210423150123.24468-1-bostroesser@gmail.com
Signed-off-by: Bodo Stroesser <bostroesser@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2021-05-22 11:40:54 +02:00
Jeff Layton
3611ce2f23 ceph: don't allow access to MDS-private inodes 
[ Upstream commit d4f6b31d721779d91b5e2f8072478af73b196c34 ]

The MDS reserves a set of inodes for its own usage, and these should
never be accessible to clients. Add a new helper to vet a proposed
inode number against that range, and complain loudly and refuse to
create or look it up if it's in it.

Also, ensure that the MDS doesn't try to delegate inodes that are in
that range or lower. Print a warning if it does, and don't save the
range in the xarray.

URL: https://tracker.ceph.com/issues/49922
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Reviewed-by: Xiubo Li <xiubli@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2021-05-22 11:40:54 +02:00
Jeff Layton
db275714dd ceph: don't clobber i_snap_caps on non-I_NEW inode 
[ Upstream commit d3c51ae1b8cce5bdaf91a1ce32b33cf5626075dc ]

We want the snapdir to mirror the non-snapped directory's attributes for
most things, but i_snap_caps represents the caps granted on the snapshot
directory by the MDS itself. A misbehaving MDS could issue different
caps for the snapdir and we lose them here.

Only reset i_snap_caps when the inode is I_NEW. Also, move the setting
of i_op and i_fop inside the if block since they should never change
anyway.

Reported-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2021-05-22 11:40:53 +02:00
Jeff Layton
2783c34d54 ceph: fix fscache invalidation 
[ Upstream commit 10a7052c7868bc7bc72d947f5aac6f768928db87 ]

Ensure that we invalidate the fscache whenever we invalidate the
pagecache.

Signed-off-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2021-05-22 11:40:53 +02:00
James Smart
f8adfb1d37 scsi: lpfc: Fix illegal memory access on Abort IOCBs 
[ Upstream commit e1364711359f3ced054bda9920477c8bf93b74c5 ]

In devloss timer handler and in backend calls to terminate remote port I/O,
there is logic to walk through all active IOCBs and validate them to
potentially trigger an abort request. This logic is causing illegal memory
accesses which leads to a crash. Abort IOCBs, which may be on the list, do
not have an associated lpfc_io_buf struct. The driver is trying to map an
lpfc_io_buf struct on the IOCB and which results in a bogus address thus
the issue.

Fix by skipping over ABORT IOCBs (CLOSE IOCBs are ABORTS that don't send
ABTS) in the IOCB scan logic.

Link: https://lore.kernel.org/r/20210421234433.102079-1-jsmart2021@gmail.com
Co-developed-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: James Smart <jsmart2021@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2021-05-22 11:40:53 +02:00
Nathan Chancellor
0195e2813a riscv: Workaround mcount name prior to clang-13 
[ Upstream commit 7ce04771503074a7de7f539cc43f5e1b385cb99b ]

Prior to clang 13.0.0, the RISC-V name for the mcount symbol was
"mcount", which differs from the GCC version of "_mcount", which results
in the following errors:

riscv64-linux-gnu-ld: init/main.o: in function `__traceiter_initcall_level':
main.c:(.text+0xe): undefined reference to `mcount'
riscv64-linux-gnu-ld: init/main.o: in function `__traceiter_initcall_start':
main.c:(.text+0x4e): undefined reference to `mcount'
riscv64-linux-gnu-ld: init/main.o: in function `__traceiter_initcall_finish':
main.c:(.text+0x92): undefined reference to `mcount'
riscv64-linux-gnu-ld: init/main.o: in function `.LBB32_28':
main.c:(.text+0x30c): undefined reference to `mcount'
riscv64-linux-gnu-ld: init/main.o: in function `free_initmem':
main.c:(.text+0x54c): undefined reference to `mcount'

This has been corrected in https://reviews.llvm.org/D98881 but the
minimum supported clang version is 10.0.1. To avoid build errors and to
gain a working function tracer, adjust the name of the mcount symbol for
older versions of clang in mount.S and recordmcount.pl.

Link: https://github.com/ClangBuiltLinux/linux/issues/1331
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2021-05-22 11:40:53 +02:00
Nathan Chancellor
52b7b9ad63 scripts/recordmcount.pl: Fix RISC-V regex for clang 
[ Upstream commit 2f095504f4b9cf75856d6a9cf90299cf75aa46c5 ]

Clang can generate R_RISCV_CALL_PLT relocations to _mcount:

$ llvm-objdump -dr build/riscv/init/main.o | rg mcount
                000000000000000e:  R_RISCV_CALL_PLT     _mcount
                000000000000004e:  R_RISCV_CALL_PLT     _mcount

After this, the __start_mcount_loc section is properly generated and
function tracing still works.

Link: https://github.com/ClangBuiltLinux/linux/issues/1331
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Reviewed-by: Fangrui Song <maskray@google.com>
Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2021-05-22 11:40:53 +02:00
Nathan Chancellor
b6b7f7ed7f riscv: Use $(LD) instead of $(CC) to link vDSO 
[ Upstream commit 7f3d349065d0c643f7f7013fbf9bc9f2c90b675f ]

Currently, the VDSO is being linked through $(CC). This does not match
how the rest of the kernel links objects, which is through the $(LD)
variable.

When linking with clang, there are a couple of warnings about flags that
will not be used during the link:

clang-12: warning: argument unused during compilation: '-no-pie' [-Wunused-command-line-argument]
clang-12: warning: argument unused during compilation: '-pg' [-Wunused-command-line-argument]

'-no-pie' was added in commit 85602bea29 ("RISC-V: build vdso-dummy.o
with -no-pie") to override '-pie' getting added to the ld command from
distribution versions of GCC that enable PIE by default. It is
technically no longer needed after commit c2c81bb2f6 ("RISC-V: Fix the
VDSO symbol generaton for binutils-2.35+"), which removed vdso-dummy.o
in favor of generating vdso-syms.S from vdso.so with $(NM) but this also
resolves the issue in case it ever comes back due to having full control
over the $(LD) command. '-pg' is for function tracing, it is not used
during linking as clang states.

These flags could be removed/filtered to fix the warnings but it is
easier to just match the rest of the kernel and use $(LD) directly for
linking. See commits

  fe00e50b2d ("ARM: 8858/1: vdso: use $(LD) instead of $(CC) to link VDSO")
  691efbedc6 ("arm64: vdso: use $(LD) instead of $(CC) to link VDSO")
  2ff906994b ("MIPS: VDSO: Use $(LD) instead of $(CC) to link VDSO")
  2b2a25845d ("s390/vdso: Use $(LD) instead of $(CC) to link vDSO")

for more information.

The flags are converted to linker flags and '--eh-frame-hdr' is added to
match what is added by GCC implicitly, which can be seen by adding '-v'
to GCC's invocation.

Additionally, since this area is being modified, use the $(OBJCOPY)
variable instead of an open coded $(CROSS_COMPILE)objcopy so that the
user's choice of objcopy binary is respected.

Link: https://github.com/ClangBuiltLinux/linux/issues/803
Link: https://github.com/ClangBuiltLinux/linux/issues/970
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Reviewed-by: Fangrui Song <maskray@google.com>
Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2021-05-22 11:40:53 +02:00
Prashant Malani
6a40e3f9a8 platform/chrome: cros_ec_typec: Add DP mode check 
[ Upstream commit c5bb32f57bf3a30ed03be51f7be0840325ba8b4a ]

There are certain transitional situations where the dp_mode field in the
PD_CONTROL response might not be populated with the right DP pin
assignment value yet. Add a check for that to avoid sending an invalid
value to the Type C mode switch.

Signed-off-by: Prashant Malani <pmalani@chromium.org>
Signed-off-by: Enric Balletbo i Serra <enric.balletbo@collabora.com>
Link: https://lore.kernel.org/r/20210421042108.2002-1-pmalani@chromium.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2021-05-22 11:40:53 +02:00
Manivannan Sadhasivam
b01b7999f4 ARM: 9075/1: kernel: Fix interrupted SMC calls 
[ Upstream commit 57ac51667d8cd62731223d687e5fe7b41c502f89 ]

On Qualcomm ARM32 platforms, the SMC call can return before it has
completed. If this occurs, the call can be restarted, but it requires
using the returned session ID value from the interrupted SMC call.

The ARM32 SMCC code already has the provision to add platform specific
quirks for things like this. So let's make use of it and add the
Qualcomm specific quirk (ARM_SMCCC_QUIRK_QCOM_A6) used by the QCOM_SCM
driver.

This change is similar to the below one added for ARM64 a while ago:
commit 82bcd08702 ("firmware: qcom: scm: Fix interrupted SCM calls")

Without this change, the Qualcomm ARM32 platforms like SDX55 will return
-EINVAL for SMC calls used for modem firmware loading and validation.

Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2021-05-22 11:40:53 +02:00