1. 03 Aug, 2019 16 commits
  2. 02 Aug, 2019 8 commits
    • Linus Torvalds's avatar
      Merge tag 'gfs2-v5.3-rc2.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2 · 97b00aff
      Linus Torvalds authored
      Pull gfs2 fix from Andreas Gruenbacher:
       "Fix gfs2 cluster coherency bug"
      
      * tag 'gfs2-v5.3-rc2.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2:
        gfs2: Inode dirtying fix
      97b00aff
    • Linus Torvalds's avatar
      Merge tag 'pm-5.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm · 755f1fed
      Linus Torvalds authored
      Pull power management fix from Rafael Wysocki:
       "Fix recent regression affecting ACPI device power management"
      
      * tag 'pm-5.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
        ACPI: PM: Fix regression in acpi_device_set_power()
      755f1fed
    • Linus Torvalds's avatar
      Merge tag 'sound-5.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound · 75cdf416
      Linus Torvalds authored
      Pull sound fixes from Takashi Iwai:
      
       - A further fix for syzcaller issues with USB-audio, addressing NULL
         dereference that was introduced by the recent fix
      
       - Avoid a long delay at boot with HD-audio when i915 module was built
         but not installed, found on some Debian systems
      
       - A fix of small race window at PCM draining
      
      * tag 'sound-5.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
        ALSA: usb-audio: Fix gpf in snd_usb_pipe_sanity_check
        ALSA: pcm: fix lost wakeup event scenarios in snd_pcm_drain
        ALSA: hda: Fix 1-minute detection delay when i915 module is not available
      75cdf416
    • Linus Torvalds's avatar
      Merge tag 'drm-fixes-2019-08-02' of git://anongit.freedesktop.org/drm/drm · f26dbb23
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "Thanks to Daniel for handling the email the last couple of weeks, flus
        and break-ins combined to derail me. Surprised nothing materialised
        today to take me out again.
      
        Just more amdgpu navi fixes, msm fixes and a single nouveau regression
        fix:
      
        amdgpu:
         - navi10 temperature and pstate fixes
         - vcn dynamic power management fix
         - CS ioctl error handling fix
         - debugfs info leak fix
         - amdkfd VegaM fix
      
        msm:
         - dma sync call fix
         - mdp5 dsi command mode fix
         - fall-through fixes
         - disabled GPU fix
      
        nouveau:
         - regression fix for displayport MST support"
      
      * tag 'drm-fixes-2019-08-02' of git://anongit.freedesktop.org/drm/drm:
        drm/nouveau: Only release VCPI slots on mode changes
        drm: msm: Fix add_gpu_components
        drm/msm: Annotate intentional switch statement fall throughs
        drm/msm: add support for per-CRTC max_vblank_count on mdp5
        drm/msm: Use the correct dma_sync calls in msm_gem
        drm/amd/powerplay: correct UVD/VCE/VCN power status retrieval
        drm/amd/powerplay: correct Navi10 VCN powergate control (v2)
        drm/amd/powerplay: support VCN powergate status retrieval for SW SMU
        drm/amd/powerplay: support VCN powergate status retrieval on Raven
        drm/amd/powerplay: add new sensor type for VCN powergate status
        drm/amdgpu: fix a potential information leaking bug
        drm/amdgpu: fix error handling in amdgpu_cs_process_fence_dep
        drm/amd/powerplay: enable SW SMU reset functionality
        drm/amd/powerplay: fix null pointer dereference around dpm state relates
        drm/amdgpu/powerplay: use proper revision id for navi
        drm/amd/powerplay: fix temperature granularity error in smu11
        drm/amd/powerplay: add callback function of get_thermal_temperature_range
        drm/amdkfd: Fix byte align on VegaM
      f26dbb23
    • Linus Torvalds's avatar
      Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux · 42d21900
      Linus Torvalds authored
      Pull clk fixes from Stephen Boyd:
       "A few fixes for code that came in during the merge window or that
        started getting exercised differently this time around:
      
         - Select regmap MMIO kconfig in spreadtrum driver to avoid compile
           errors
      
         - Complete kerneldoc on devm_clk_bulk_get_optional()
      
         - Register an essential clk earlier on mediatek mt8183 SoCs so the
           clocksource driver can use it
      
         - Fix divisor math in the at91 driver
      
         - Plug a race in Renesas reset control logic"
      
      * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux:
        clk: renesas: cpg-mssr: Fix reset control race condition
        clk: sprd: Select REGMAP_MMIO to avoid compile errors
        clk: mediatek: mt8183: Register 13MHz clock earlier for clocksource
        clk: Add missing documentation of devm_clk_bulk_get_optional() argument
        clk: at91: generated: Truncate divisor to GENERATED_MAX_DIV + 1
      42d21900
    • Linus Torvalds's avatar
      Merge tag 'arm-swiotlb-5.3' of git://git.infradead.org/users/hch/dma-mapping · 234172f6
      Linus Torvalds authored
      Pull arm swiotlb support from Christoph Hellwig:
       "This fixes a cascade of regressions that originally started with the
        addition of the ia64 port, but only got fatal once we removed most
        uses of block layer bounce buffering in Linux 4.18.
      
        The reason is that while the original i386/PAE code that was the first
        architecture that supported > 4GB of memory without an iommu decided
        to leave bounce buffering to the subsystems, which in those days just
        mean block and networking as no one else consumed arbitrary userspace
        memory.
      
        Later with ia64, x86_64 and other ports we assumed that either an
        iommu or something that fakes it up ("software IOTLB" in beautiful
        Intel speak) is present and that subsystems can rely on that for
        dealing with addressing limitations in devices. Except that the ARM
        LPAE scheme that added larger physical address to 32-bit ARM did not
        follow that scheme and thus only worked by chance and only for block
        and networking I/O directly to highmem.
      
        Long story, short fix - add swiotlb support to arm when build for LPAE
        platforms, which actuallys turns out to be pretty trivial with the
        modern dma-direct / swiotlb code to fix the Linux 4.18-ish regression"
      
      * tag 'arm-swiotlb-5.3' of git://git.infradead.org/users/hch/dma-mapping:
        arm: use swiotlb for bounce buffering on LPAE configs
        dma-mapping: check pfn validity in dma_common_{mmap,get_sgtable}
      234172f6
    • Linus Torvalds's avatar
      Merge tag 'dma-mapping-5.3-3' of git://git.infradead.org/users/hch/dma-mapping · 35fca9f8
      Linus Torvalds authored
      Pull dma-mapping regression fixes from Christoph Hellwig:
       "Two related regression fixes for changes from this merge window to fix
        alignment issues introduced in the CMA allocation rework (Nicolin
        Chen)"
      
      * tag 'dma-mapping-5.3-3' of git://git.infradead.org/users/hch/dma-mapping:
        dma-contiguous: page-align the size in dma_free_contiguous()
        dma-contiguous: do not overwrite align in dma_alloc_contiguous()
      35fca9f8
    • Dave Airlie's avatar
      Merge tag 'msm-fixes-2019_08_01' of https://gitlab.freedesktop.org/drm/msm into drm-fixes · f8981e03
      Dave Airlie authored
      - Fix the dma_sync calls applied last week (Rob)
      - Fix mdp5 dsi command mode (Brian)
      - Squash fall through warnings (Jordan)
      - Don't add disabled gpu nodes to the of device list (Jeffrey)
      
      Cc: Jeffrey Hugo <jeffrey.l.hugo@gmail.com>
      Cc: Jordan Crouse <jcrouse@codeaurora.org>
      Cc: Brian Masney <masneyb@onstation.org>
      Cc: Rob Clark <robdclark@chromium.org>
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      
      # gpg: Signature made Fri 02 Aug 2019 05:54:27 AM AEST
      # gpg:                using RSA key 96F70DFDA84A070A
      # gpg: Can't check signature: public key not found
      From: Sean Paul <sean@poorly.run>
      Link: https://patchwork.freedesktop.org/patch/msgid/20190801200439.GV104440@art_vandelay
      f8981e03
  3. 01 Aug, 2019 8 commits
  4. 31 Jul, 2019 8 commits
    • Rob Clark's avatar
      drm/msm: Use the correct dma_sync calls in msm_gem · 3de433c5
      Rob Clark authored
      [subject was: drm/msm: shake fist angrily at dma-mapping]
      
      So, using dma_sync_* for our cache needs works out w/ dma iommu ops, but
      it falls appart with dma direct ops.  The problem is that, depending on
      display generation, we can have either set of dma ops (mdp4 and dpu have
      iommu wired to mdss node, which maps to toplevel drm device, but mdp5
      has iommu wired up to the mdp sub-node within mdss).
      
      Fixes this splat on mdp5 devices:
      
         Unable to handle kernel paging request at virtual address ffffffff80000000
         Mem abort info:
           ESR = 0x96000144
           Exception class = DABT (current EL), IL = 32 bits
           SET = 0, FnV = 0
           EA = 0, S1PTW = 0
         Data abort info:
           ISV = 0, ISS = 0x00000144
           CM = 1, WnR = 1
         swapper pgtable: 4k pages, 48-bit VAs, pgdp=00000000810e4000
         [ffffffff80000000] pgd=0000000000000000
         Internal error: Oops: 96000144 [#1] SMP
         Modules linked in: btqcomsmd btqca bluetooth cfg80211 ecdh_generic ecc rfkill libarc4 panel_simple msm wcnss_ctrl qrtr_smd drm_kms_helper venus_enc venus_dec videobuf2_dma_sg videobuf2_memops drm venus_core ipv6 qrtr qcom_wcnss_pil v4l2_mem2mem qcom_sysmon videobuf2_v4l2 qmi_helpers videobuf2_common crct10dif_ce mdt_loader qcom_common videodev qcom_glink_smem remoteproc bmc150_accel_i2c bmc150_magn_i2c bmc150_accel_core bmc150_magn snd_soc_lpass_apq8016 snd_soc_msm8916_analog mms114 mc nf_defrag_ipv6 snd_soc_lpass_cpu snd_soc_apq8016_sbc industrialio_triggered_buffer kfifo_buf snd_soc_lpass_platform snd_soc_msm8916_digital drm_panel_orientation_quirks
         CPU: 2 PID: 33 Comm: kworker/2:1 Not tainted 5.3.0-rc2 #1
         Hardware name: Samsung Galaxy A5U (EUR) (DT)
         Workqueue: events deferred_probe_work_func
         pstate: 80000005 (Nzcv daif -PAN -UAO)
         pc : __clean_dcache_area_poc+0x20/0x38
         lr : arch_sync_dma_for_device+0x28/0x30
         sp : ffff0000115736a0
         x29: ffff0000115736a0 x28: 0000000000000001
         x27: ffff800074830800 x26: ffff000011478000
         x25: 0000000000000000 x24: 0000000000000001
         x23: ffff000011478a98 x22: ffff800009fd1c10
         x21: 0000000000000001 x20: ffff800075ad0a00
         x19: 0000000000000000 x18: ffff0000112b2000
         x17: 0000000000000000 x16: 0000000000000000
         x15: 00000000fffffff0 x14: ffff000011455d70
         x13: 0000000000000000 x12: 0000000000000028
         x11: 0000000000000001 x10: ffff00001106c000
         x9 : ffff7e0001d6b380 x8 : 0000000000001000
         x7 : ffff7e0001d6b380 x6 : ffff7e0001d6b382
         x5 : 0000000000000000 x4 : 0000000000001000
         x3 : 000000000000003f x2 : 0000000000000040
         x1 : ffffffff80001000 x0 : ffffffff80000000
         Call trace:
          __clean_dcache_area_poc+0x20/0x38
          dma_direct_sync_sg_for_device+0xb8/0xe8
          get_pages+0x22c/0x250 [msm]
          msm_gem_get_and_pin_iova+0xdc/0x168 [msm]
          ...
      
      Fixes the combination of two patches:
      
      Fixes: 0036bc73 (drm/msm: stop abusing dma_map/unmap for cache)
      Fixes: 449fa54d (dma-direct: correct the physical addr in dma_direct_sync_sg_for_cpu/device)
      Tested-by: default avatarStephan Gerhold <stephan@gerhold.net>
      Signed-off-by: default avatarRob Clark <robdclark@chromium.org>
      [seanpaul changed subject to something more desriptive]
      Signed-off-by: default avatarSean Paul <seanpaul@chromium.org>
      Link: https://patchwork.freedesktop.org/patch/msgid/20190730214633.17820-1-robdclark@gmail.com
      3de433c5
    • Linus Torvalds's avatar
      Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs · 5c620753
      Linus Torvalds authored
      Pull mount_capable() fix from Al Viro.
      
      * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
        Unbreak mount_capable()
      5c620753
    • Vladis Dronov's avatar
      Bluetooth: hci_uart: check for missing tty operations · b36a1552
      Vladis Dronov authored
      Certain ttys operations (pty_unix98_ops) lack tiocmget() and tiocmset()
      functions which are called by the certain HCI UART protocols (hci_ath,
      hci_bcm, hci_intel, hci_mrvl, hci_qca) via hci_uart_set_flow_control()
      or directly. This leads to an execution at NULL and can be triggered by
      an unprivileged user. Fix this by adding a helper function and a check
      for the missing tty operations in the protocols code.
      
      This fixes CVE-2019-10207. The Fixes: lines list commits where calls to
      tiocm[gs]et() or hci_uart_set_flow_control() were added to the HCI UART
      protocols.
      
      Link: https://syzkaller.appspot.com/bug?id=1b42faa2848963564a5b1b7f8c837ea7b55ffa50
      Reported-by: syzbot+79337b501d6aa974d0f6@syzkaller.appspotmail.com
      Cc: stable@vger.kernel.org # v2.6.36+
      Fixes: b3190df6 ("Bluetooth: Support for Atheros AR300x serial chip")
      Fixes: 118612fb ("Bluetooth: hci_bcm: Add suspend/resume PM functions")
      Fixes: ff289559 ("Bluetooth: hci_intel: Add Intel baudrate configuration support")
      Fixes: 162f812f ("Bluetooth: hci_uart: Add Marvell support")
      Fixes: fa9ad876 ("Bluetooth: hci_qca: Add support for Qualcomm Bluetooth chip wcn3990")
      Signed-off-by: default avatarVladis Dronov <vdronov@redhat.com>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      Reviewed-by: default avatarYu-Chen, Cho <acho@suse.com>
      Tested-by: default avatarYu-Chen, Cho <acho@suse.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      b36a1552
    • Laura Abbott's avatar
      mm: slub: Fix slab walking for init_on_free · 1b7e816f
      Laura Abbott authored
      To properly clear the slab on free with slab_want_init_on_free, we walk
      the list of free objects using get_freepointer/set_freepointer.
      
      The value we get from get_freepointer may not be valid.  This isn't an
      issue since an actual value will get written later but this means
      there's a chance of triggering a bug if we use this value with
      set_freepointer:
      
        kernel BUG at mm/slub.c:306!
        invalid opcode: 0000 [#1] PREEMPT PTI
        CPU: 0 PID: 0 Comm: swapper Not tainted 5.2.0-05754-g6471384a #4
        RIP: 0010:kfree+0x58a/0x5c0
        Code: 48 83 05 78 37 51 02 01 0f 0b 48 83 05 7e 37 51 02 01 48 83 05 7e 37 51 02 01 48 83 05 7e 37 51 02 01 48 83 05 d6 37 51 02 01 <0f> 0b 48 83 05 d4 37 51 02 01 48 83 05 d4 37 51 02 01 48 83 05 d4
        RSP: 0000:ffffffff82603d90 EFLAGS: 00010002
        RAX: ffff8c3976c04320 RBX: ffff8c3976c04300 RCX: 0000000000000000
        RDX: ffff8c3976c04300 RSI: 0000000000000000 RDI: ffff8c3976c04320
        RBP: ffffffff82603db8 R08: 0000000000000000 R09: 0000000000000000
        R10: ffff8c3976c04320 R11: ffffffff8289e1e0 R12: ffffd52cc8db0100
        R13: ffff8c3976c01a00 R14: ffffffff810f10d4 R15: ffff8c3976c04300
        FS:  0000000000000000(0000) GS:ffffffff8266b000(0000) knlGS:0000000000000000
        CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
        CR2: ffff8c397ffff000 CR3: 0000000125020000 CR4: 00000000000406b0
        Call Trace:
         apply_wqattrs_prepare+0x154/0x280
         apply_workqueue_attrs_locked+0x4e/0xe0
         apply_workqueue_attrs+0x36/0x60
         alloc_workqueue+0x25a/0x6d0
         workqueue_init_early+0x246/0x348
         start_kernel+0x3c7/0x7ec
         x86_64_start_reservations+0x40/0x49
         x86_64_start_kernel+0xda/0xe4
         secondary_startup_64+0xb6/0xc0
        Modules linked in:
        ---[ end trace f67eb9af4d8d492b ]---
      
      Fix this by ensuring the value we set with set_freepointer is either NULL
      or another value in the chain.
      Reported-by: default avatarkernel test robot <rong.a.chen@intel.com>
      Signed-off-by: default avatarLaura Abbott <labbott@redhat.com>
      Fixes: 6471384a ("mm: security: introduce init_on_alloc=1 and init_on_free=1 boot options")
      Reviewed-by: default avatarKees Cook <keescook@chromium.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      1b7e816f
    • Linus Torvalds's avatar
      Merge tag 'trace-v5.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace · d2eee9fc
      Linus Torvalds authored
      Pull tracing fixes from Steven Rostedt:
       "Two minor fixes:
      
         - Fix trace event header include guards, as several did not match the
           #define to the #ifdef
      
         - Remove a redundant test to ftrace_graph_notrace_addr() that was
           accidentally added"
      
      * tag 'trace-v5.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
        fgraph: Remove redundant ftrace_graph_notrace_addr() test
        tracing: Fix header include guards in trace event headers
      d2eee9fc
    • Linus Torvalds's avatar
      Merge tag 'for-linus-5.3-2' of git://github.com/cminyard/linux-ipmi · 52fde434
      Linus Torvalds authored
      Pull IPMI fix from Corey Minyard:
       "One necessary fix for an uninitialized variable in the new IPMB driver.
      
        Nothing else has come in besides things that need to wait until later"
      
      * tag 'for-linus-5.3-2' of git://github.com/cminyard/linux-ipmi:
        Fix uninitialized variable in ipmb_dev_int.c
      52fde434
    • Andreas Gruenbacher's avatar
      gfs2: Inode dirtying fix · 706cb549
      Andreas Gruenbacher authored
      With the recent iomap write page reclaim deadlock fix, it turns out that the
      GLF_DIRTY flag isn't always set when it needs to be anymore: previously, this
      happened as a side effect of always adding the inode buffer head to the current
      transaction with gfs2_trans_add_meta, but this isn't happening consistently
      anymore.  Fix by removing an additional unnecessary gfs2_trans_add_meta call
      and by setting the GLF_DIRTY flag in gfs2_iomap_end.
      
      (The GLF_DIRTY flag causes inode_go_sync to flush the transaction log when
      syncing out the glock of that inode.  When the flag isn't set, inode_go_sync
      will skip inodes, including ones with an i_state of I_DIRTY_PAGES, which will
      lead to cluster incoherency.)
      
      In addition, in gfs2_iomap_page_done, if the metadata has changed, mark the
      inode as I_DIRTY_DATASYNC to have the inode added to the current transaction:
      we don't expect metadata to change here, but let's err on the safe side.
      
      Fixes: d0a22a4b ("gfs2: Fix iomap write page reclaim deadlock");
      Signed-off-by: default avatarAndreas Gruenbacher <agruenba@redhat.com>
      706cb549
    • Al Viro's avatar
      Unbreak mount_capable() · c2c44ec2
      Al Viro authored
      In "consolidate the capability checks in sget_{fc,userns}())" the
      wrong argument had been passed to mount_capable() by sget_fc().
      That mistake had been further obscured later, when switching
      mount_capable() to fs_context has moved the calculation of
      bogus argument from sget_fc() to mount_capable() itself.  It
      should've been fc->user_ns all along.
      Screwed-up-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      Reported-by: default avatarChristian Brauner <christian@brauner.io>
      Tested-by: default avatarChristian Brauner <christian@brauner.io>
      Reviewed-by: default avatarDavid Howells <dhowells@redhat.com>
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      c2c44ec2