1. 19 Mar, 2021 6 commits
    • Linus Torvalds's avatar
      Merge tag 'sound-5.12-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound · 769e155c
      Linus Torvalds authored
      Pull sound fixes from Takashi Iwai:
       "The majority of changes are various ASoC device/platform-specific
        small fixes (including a removal of stale file) while the only common
        change is a clk management fix in ASoC simple-card driver.
      
        The rest are the usual HD-audio quirks"
      
      * tag 'sound-5.12-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (44 commits)
        ALSA: usb-audio: Fix unintentional sign extension issue
        ALSA: hda/realtek: fix mute/micmute LEDs for HP 850 G8
        ASoC: dt-bindings: fsl_spdif: Add compatible string for new platforms
        ASoC: rt711: add snd_soc_component remove callback
        ASoC: rt5659: Update MCLK rate in set_sysclk()
        ASoC: simple-card-utils: Do not handle device clock
        ALSA: hda/realtek: fix mute/micmute LEDs for HP 440 G8
        ALSA: hda/realtek: fix mute/micmute LEDs for HP 840 G8
        ALSA: hda/realtek: apply pin quirk for XiaomiNotebook Pro
        ALSA: hda/realtek: Apply headset-mic quirks for Xiaomi Redmibook Air
        ASoC: mediatek: mt8192: fix tdm out data is valid on rising edge
        ALSA: dice: fix null pointer dereference when node is disconnected
        ALSA: hda: generic: Fix the micmute led init state
        ASoC: qcom: lpass-cpu: Fix lpass dai ids parse
        spi: cadence: set cqspi to the driver_data field of struct device
        ASoC: SOF: intel: fix wrong poll bits in dsp power down
        ASoC: codecs: wcd934x: add a sanity check in set channel map
        ASoC: qcom: sdm845: Fix array out of range on rx slim channels
        ASoC: qcom: sdm845: Fix array out of bounds access
        ASoC: remove remnants of sirf prima/atlas audio codec
        ...
      769e155c
    • Linus Torvalds's avatar
      Merge tag 'drm-fixes-2021-03-19' of git://anongit.freedesktop.org/drm/drm · 8b12a62a
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "Regular fixes pull, pretty small set of fixes, a couple of i915 and
        amdgpu, one ttm, one nouveau and one omap. Probably smaller than usual
        for this time, so we'll see if something pops up next week or if this
        will continue to stay small.
      
        Summary:
      
        ttm:
         - Make ttm_bo_unpin() not wraparound on too many unpins
      
        omap:
         - Fix coccicheck warning in omap
      
        amdgpu:
         - DCN 3.0 gamma fixes
         - DCN 2.1 corrupt screen fix
      
        i915:
         - Workaround async flip + VT-d frame corruption on HSW/BDW
         - Fix NMI watchdog crash due to uninitialized OA buffer use on gen12+
      
        nouveau:
         - workaround oops with bo syncing"
      
      * tag 'drm-fixes-2021-03-19' of git://anongit.freedesktop.org/drm/drm:
        nouveau: Skip unvailable ttm page entries
        drm/amd/display: Remove MPC gamut remap logic for DCN30
        drm/amd/display: Correct algorithm for reversed gamma
        drm/omap: dsi: fix unsigned expression compared with zero
        i915/perf: Start hrtimer only if sampling the OA buffer
        drm/i915: Workaround async flip + VT-d corruption on HSW/BDW
        drm/amd/display: Copy over soc values before bounding box creation
        drm/ttm: make ttm_bo_unpin more defensive
      8b12a62a
    • Tobias Klausmann's avatar
      nouveau: Skip unvailable ttm page entries · e94c55b8
      Tobias Klausmann authored
      Starting with commit f295c8cf
      ("drm/nouveau: fix dma syncing warning with debugging on.")
      the following oops occures:
      
         BUG: kernel NULL pointer dereference, address: 0000000000000000
         #PF: supervisor read access in kernel mode
         #PF: error_code(0x0000) - not-present page
         PGD 0 P4D 0
         Oops: 0000 [#1] PREEMPT SMP PTI
         CPU: 6 PID: 1013 Comm: Xorg.bin Tainted: G E     5.11.0-desktop-rc0+ #2
         Hardware name: Acer Aspire VN7-593G/Pluto_KLS, BIOS V1.11 08/01/2018
         RIP: 0010:nouveau_bo_sync_for_device+0x40/0xb0 [nouveau]
         Call Trace:
          nouveau_bo_validate+0x5d/0x80 [nouveau]
          nouveau_gem_ioctl_pushbuf+0x662/0x1120 [nouveau]
          ? nouveau_gem_ioctl_new+0xf0/0xf0 [nouveau]
          drm_ioctl_kernel+0xa6/0xf0 [drm]
          drm_ioctl+0x1f4/0x3a0 [drm]
          ? nouveau_gem_ioctl_new+0xf0/0xf0 [nouveau]
          nouveau_drm_ioctl+0x50/0xa0 [nouveau]
          __x64_sys_ioctl+0x7e/0xb0
          do_syscall_64+0x33/0x80
          entry_SYSCALL_64_after_hwframe+0x44/0xae
         ---[ end trace ccfb1e7f4064374f ]---
         RIP: 0010:nouveau_bo_sync_for_device+0x40/0xb0 [nouveau]
      
      The underlying problem is not introduced by the commit, yet it uncovered the
      underlying issue. The cited commit relies on valid pages. This is not given for
      due to some bugs. For now, just warn and work around the issue by just ignoring
      the bad ttm objects.
      Below is some debug info gathered while debugging this issue:
      
      nouveau 0000:01:00.0: DRM: ttm_dma->num_pages: 2048
      nouveau 0000:01:00.0: DRM: ttm_dma->pages is NULL
      nouveau 0000:01:00.0: DRM: ttm_dma: 00000000e96058e7
      nouveau 0000:01:00.0: DRM: ttm_dma->page_flags:
      nouveau 0000:01:00.0: DRM: ttm_dma:   Populated: 1
      nouveau 0000:01:00.0: DRM: ttm_dma:   No Retry: 0
      nouveau 0000:01:00.0: DRM: ttm_dma:   SG: 256
      nouveau 0000:01:00.0: DRM: ttm_dma:   Zero Alloc: 0
      nouveau 0000:01:00.0: DRM: ttm_dma:   Swapped: 0
      Signed-off-by: default avatarTobias Klausmann <tobias.klausmann@freenet.de>
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20210313222159.3346-1-tobias.klausmann@freenet.de
      e94c55b8
    • Dave Airlie's avatar
      Merge tag 'drm-intel-fixes-2021-03-18' of... · 0677170b
      Dave Airlie authored
      Merge tag 'drm-intel-fixes-2021-03-18' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes
      
      drm/i915 fixes for v5.12-rc4:
      - Workaround async flip + VT-d frame corruption on HSW/BDW
      - Fix NMI watchdog crash due to uninitialized OA buffer use on gen12+
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      From: Jani Nikula <jani.nikula@intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/87blbg8y5t.fsf@intel.com
      0677170b
    • Dave Airlie's avatar
      Merge tag 'amd-drm-fixes-5.12-2021-03-18' of... · a97fdabc
      Dave Airlie authored
      Merge tag 'amd-drm-fixes-5.12-2021-03-18' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes
      
      amdgpu:
      - DCN 3.0 gamma fixes
      - DCN 2.1 corrupt screen fix
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      From: Alex Deucher <alexander.deucher@amd.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20210318042858.3810-1-alexander.deucher@amd.com
      a97fdabc
    • Dave Airlie's avatar
      Merge tag 'drm-misc-fixes-2021-03-18' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes · db3f0d8e
      Dave Airlie authored
      drm-misc-fixes for v5.12-rc4:
      - Make ttm_bo_unpin() not wraparound on too many unpins.
      - Fix coccicheck warning in omap.
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      
      From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/a0e13bbb-6ba6-ff24-4db8-0e02e605de18@linux.intel.com
      db3f0d8e
  2. 18 Mar, 2021 9 commits
  3. 17 Mar, 2021 7 commits
  4. 16 Mar, 2021 18 commits
    • Paul Cercueil's avatar
      MIPS: vmlinux.lds.S: Fix appended dtb not properly aligned · 3f6c515d
      Paul Cercueil authored
      Commit 6654111c ("MIPS: vmlinux.lds.S: align raw appended dtb to 8
      bytes") changed the alignment from STRUCT_ALIGNMENT bytes to 8 bytes.
      
      The commit's message makes it sound like it was actually done on
      purpose, but this is not the case. The commit was written when raw
      appended dtb were not aligned at all. The STRUCT_ALIGN() was added a few
      days before, in commit 7a05293a ("MIPS: boot/compressed: Copy DTB to
      aligned address"). The true purpose of the commit was not to align
      specifically to 8 bytes, but to make sure that the generated vmlinux'
      size was properly padded to the alignment required for DTBs.
      
      While the switch to 8-byte alignment worked for vmlinux-appended dtb
      blobs, it broke vmlinuz-appended dtb blobs, as the decompress routine
      moves the blob to a STRUCT_ALIGNMENT aligned address.
      
      Fix this by changing the raw appended dtb blob alignment from 8 bytes
      back to STRUCT_ALIGNMENT bytes in vmlinux.lds.S.
      
      Fixes: 6654111c ("MIPS: vmlinux.lds.S: align raw appended dtb to 8 bytes")
      Cc: Bjørn Mork <bjorn@mork.no>
      Signed-off-by: default avatarPaul Cercueil <paul@crapouillou.net>
      Signed-off-by: default avatarThomas Bogendoerfer <tsbogend@alpha.franken.de>
      3f6c515d
    • Filipe Manana's avatar
      btrfs: always pin deleted leaves when there are active tree mod log users · 485df755
      Filipe Manana authored
      When freeing a tree block we may end up adding its extent back to the
      free space cache/tree, as long as there are no more references for it,
      it was created in the current transaction and writeback for it never
      happened. This is generally fine, however when we have tree mod log
      operations it can result in inconsistent versions of a btree after
      unwinding extent buffers with the recorded tree mod log operations.
      
      This is because:
      
      * We only log operations for nodes (adding and removing key/pointers),
        for leaves we don't do anything;
      
      * This means that we can log a MOD_LOG_KEY_REMOVE_WHILE_FREEING operation
        for a node that points to a leaf that was deleted;
      
      * Before we apply the logged operation to unwind a node, we can have
        that leaf's extent allocated again, either as a node or as a leaf, and
        possibly for another btree. This is possible if the leaf was created in
        the current transaction and writeback for it never started, in which
        case btrfs_free_tree_block() returns its extent back to the free space
        cache/tree;
      
      * Then, before applying the tree mod log operation, some task allocates
        the metadata extent just freed before, and uses it either as a leaf or
        as a node for some btree (can be the same or another one, it does not
        matter);
      
      * After applying the MOD_LOG_KEY_REMOVE_WHILE_FREEING operation we now
        get the target node with an item pointing to the metadata extent that
        now has content different from what it had before the leaf was deleted.
        It might now belong to a different btree and be a node and not a leaf
        anymore.
      
        As a consequence, the results of searches after the unwinding can be
        unpredictable and produce unexpected results.
      
      So make sure we pin extent buffers corresponding to leaves when there
      are tree mod log users.
      
      CC: stable@vger.kernel.org # 4.14+
      Signed-off-by: default avatarFilipe Manana <fdmanana@suse.com>
      Signed-off-by: default avatarDavid Sterba <dsterba@suse.com>
      485df755
    • Filipe Manana's avatar
      btrfs: fix race when cloning extent buffer during rewind of an old root · dbcc7d57
      Filipe Manana authored
      While resolving backreferences, as part of a logical ino ioctl call or
      fiemap, we can end up hitting a BUG_ON() when replaying tree mod log
      operations of a root, triggering a stack trace like the following:
      
        ------------[ cut here ]------------
        kernel BUG at fs/btrfs/ctree.c:1210!
        invalid opcode: 0000 [#1] SMP KASAN PTI
        CPU: 1 PID: 19054 Comm: crawl_335 Tainted: G        W         5.11.0-2d11c0084b02-misc-next+ #89
        Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
        RIP: 0010:__tree_mod_log_rewind+0x3b1/0x3c0
        Code: 05 48 8d 74 10 (...)
        RSP: 0018:ffffc90001eb70b8 EFLAGS: 00010297
        RAX: 0000000000000000 RBX: ffff88812344e400 RCX: ffffffffb28933b6
        RDX: 0000000000000007 RSI: dffffc0000000000 RDI: ffff88812344e42c
        RBP: ffffc90001eb7108 R08: 1ffff11020b60a20 R09: ffffed1020b60a20
        R10: ffff888105b050f9 R11: ffffed1020b60a1f R12: 00000000000000ee
        R13: ffff8880195520c0 R14: ffff8881bc958500 R15: ffff88812344e42c
        FS:  00007fd1955e8700(0000) GS:ffff8881f5600000(0000) knlGS:0000000000000000
        CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
        CR2: 00007efdb7928718 CR3: 000000010103a006 CR4: 0000000000170ee0
        Call Trace:
         btrfs_search_old_slot+0x265/0x10d0
         ? lock_acquired+0xbb/0x600
         ? btrfs_search_slot+0x1090/0x1090
         ? free_extent_buffer.part.61+0xd7/0x140
         ? free_extent_buffer+0x13/0x20
         resolve_indirect_refs+0x3e9/0xfc0
         ? lock_downgrade+0x3d0/0x3d0
         ? __kasan_check_read+0x11/0x20
         ? add_prelim_ref.part.11+0x150/0x150
         ? lock_downgrade+0x3d0/0x3d0
         ? __kasan_check_read+0x11/0x20
         ? lock_acquired+0xbb/0x600
         ? __kasan_check_write+0x14/0x20
         ? do_raw_spin_unlock+0xa8/0x140
         ? rb_insert_color+0x30/0x360
         ? prelim_ref_insert+0x12d/0x430
         find_parent_nodes+0x5c3/0x1830
         ? resolve_indirect_refs+0xfc0/0xfc0
         ? lock_release+0xc8/0x620
         ? fs_reclaim_acquire+0x67/0xf0
         ? lock_acquire+0xc7/0x510
         ? lock_downgrade+0x3d0/0x3d0
         ? lockdep_hardirqs_on_prepare+0x160/0x210
         ? lock_release+0xc8/0x620
         ? fs_reclaim_acquire+0x67/0xf0
         ? lock_acquire+0xc7/0x510
         ? poison_range+0x38/0x40
         ? unpoison_range+0x14/0x40
         ? trace_hardirqs_on+0x55/0x120
         btrfs_find_all_roots_safe+0x142/0x1e0
         ? find_parent_nodes+0x1830/0x1830
         ? btrfs_inode_flags_to_xflags+0x50/0x50
         iterate_extent_inodes+0x20e/0x580
         ? tree_backref_for_extent+0x230/0x230
         ? lock_downgrade+0x3d0/0x3d0
         ? read_extent_buffer+0xdd/0x110
         ? lock_downgrade+0x3d0/0x3d0
         ? __kasan_check_read+0x11/0x20
         ? lock_acquired+0xbb/0x600
         ? __kasan_check_write+0x14/0x20
         ? _raw_spin_unlock+0x22/0x30
         ? __kasan_check_write+0x14/0x20
         iterate_inodes_from_logical+0x129/0x170
         ? iterate_inodes_from_logical+0x129/0x170
         ? btrfs_inode_flags_to_xflags+0x50/0x50
         ? iterate_extent_inodes+0x580/0x580
         ? __vmalloc_node+0x92/0xb0
         ? init_data_container+0x34/0xb0
         ? init_data_container+0x34/0xb0
         ? kvmalloc_node+0x60/0x80
         btrfs_ioctl_logical_to_ino+0x158/0x230
         btrfs_ioctl+0x205e/0x4040
         ? __might_sleep+0x71/0xe0
         ? btrfs_ioctl_get_supported_features+0x30/0x30
         ? getrusage+0x4b6/0x9c0
         ? __kasan_check_read+0x11/0x20
         ? lock_release+0xc8/0x620
         ? __might_fault+0x64/0xd0
         ? lock_acquire+0xc7/0x510
         ? lock_downgrade+0x3d0/0x3d0
         ? lockdep_hardirqs_on_prepare+0x210/0x210
         ? lockdep_hardirqs_on_prepare+0x210/0x210
         ? __kasan_check_read+0x11/0x20
         ? do_vfs_ioctl+0xfc/0x9d0
         ? ioctl_file_clone+0xe0/0xe0
         ? lock_downgrade+0x3d0/0x3d0
         ? lockdep_hardirqs_on_prepare+0x210/0x210
         ? __kasan_check_read+0x11/0x20
         ? lock_release+0xc8/0x620
         ? __task_pid_nr_ns+0xd3/0x250
         ? lock_acquire+0xc7/0x510
         ? __fget_files+0x160/0x230
         ? __fget_light+0xf2/0x110
         __x64_sys_ioctl+0xc3/0x100
         do_syscall_64+0x37/0x80
         entry_SYSCALL_64_after_hwframe+0x44/0xa9
        RIP: 0033:0x7fd1976e2427
        Code: 00 00 90 48 8b 05 (...)
        RSP: 002b:00007fd1955e5cf8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
        RAX: ffffffffffffffda RBX: 00007fd1955e5f40 RCX: 00007fd1976e2427
        RDX: 00007fd1955e5f48 RSI: 00000000c038943b RDI: 0000000000000004
        RBP: 0000000001000000 R08: 0000000000000000 R09: 00007fd1955e6120
        R10: 0000557835366b00 R11: 0000000000000246 R12: 0000000000000004
        R13: 00007fd1955e5f48 R14: 00007fd1955e5f40 R15: 00007fd1955e5ef8
        Modules linked in:
        ---[ end trace ec8931a1c36e57be ]---
      
        (gdb) l *(__tree_mod_log_rewind+0x3b1)
        0xffffffff81893521 is in __tree_mod_log_rewind (fs/btrfs/ctree.c:1210).
        1205                     * the modification. as we're going backwards, we do the
        1206                     * opposite of each operation here.
        1207                     */
        1208                    switch (tm->op) {
        1209                    case MOD_LOG_KEY_REMOVE_WHILE_FREEING:
        1210                            BUG_ON(tm->slot < n);
        1211                            fallthrough;
        1212                    case MOD_LOG_KEY_REMOVE_WHILE_MOVING:
        1213                    case MOD_LOG_KEY_REMOVE:
        1214                            btrfs_set_node_key(eb, &tm->key, tm->slot);
      
      Here's what happens to hit that BUG_ON():
      
      1) We have one tree mod log user (through fiemap or the logical ino ioctl),
         with a sequence number of 1, so we have fs_info->tree_mod_seq == 1;
      
      2) Another task is at ctree.c:balance_level() and we have eb X currently as
         the root of the tree, and we promote its single child, eb Y, as the new
         root.
      
         Then, at ctree.c:balance_level(), we call:
      
            tree_mod_log_insert_root(eb X, eb Y, 1);
      
      3) At tree_mod_log_insert_root() we create tree mod log elements for each
         slot of eb X, of operation type MOD_LOG_KEY_REMOVE_WHILE_FREEING each
         with a ->logical pointing to ebX->start. These are placed in an array
         named tm_list.
         Lets assume there are N elements (N pointers in eb X);
      
      4) Then, still at tree_mod_log_insert_root(), we create a tree mod log
         element of operation type MOD_LOG_ROOT_REPLACE, ->logical set to
         ebY->start, ->old_root.logical set to ebX->start, ->old_root.level set
         to the level of eb X and ->generation set to the generation of eb X;
      
      5) Then tree_mod_log_insert_root() calls tree_mod_log_free_eb() with
         tm_list as argument. After that, tree_mod_log_free_eb() calls
         __tree_mod_log_insert() for each member of tm_list in reverse order,
         from highest slot in eb X, slot N - 1, to slot 0 of eb X;
      
      6) __tree_mod_log_insert() sets the sequence number of each given tree mod
         log operation - it increments fs_info->tree_mod_seq and sets
         fs_info->tree_mod_seq as the sequence number of the given tree mod log
         operation.
      
         This means that for the tm_list created at tree_mod_log_insert_root(),
         the element corresponding to slot 0 of eb X has the highest sequence
         number (1 + N), and the element corresponding to the last slot has the
         lowest sequence number (2);
      
      7) Then, after inserting tm_list's elements into the tree mod log rbtree,
         the MOD_LOG_ROOT_REPLACE element is inserted, which gets the highest
         sequence number, which is N + 2;
      
      8) Back to ctree.c:balance_level(), we free eb X by calling
         btrfs_free_tree_block() on it. Because eb X was created in the current
         transaction, has no other references and writeback did not happen for
         it, we add it back to the free space cache/tree;
      
      9) Later some other task T allocates the metadata extent from eb X, since
         it is marked as free space in the space cache/tree, and uses it as a
         node for some other btree;
      
      10) The tree mod log user task calls btrfs_search_old_slot(), which calls
          get_old_root(), and finally that calls __tree_mod_log_oldest_root()
          with time_seq == 1 and eb_root == eb Y;
      
      11) First iteration of the while loop finds the tree mod log element with
          sequence number N + 2, for the logical address of eb Y and of type
          MOD_LOG_ROOT_REPLACE;
      
      12) Because the operation type is MOD_LOG_ROOT_REPLACE, we don't break out
          of the loop, and set root_logical to point to tm->old_root.logical
          which corresponds to the logical address of eb X;
      
      13) On the next iteration of the while loop, the call to
          tree_mod_log_search_oldest() returns the smallest tree mod log element
          for the logical address of eb X, which has a sequence number of 2, an
          operation type of MOD_LOG_KEY_REMOVE_WHILE_FREEING and corresponds to
          the old slot N - 1 of eb X (eb X had N items in it before being freed);
      
      14) We then break out of the while loop and return the tree mod log operation
          of type MOD_LOG_ROOT_REPLACE (eb Y), and not the one for slot N - 1 of
          eb X, to get_old_root();
      
      15) At get_old_root(), we process the MOD_LOG_ROOT_REPLACE operation
          and set "logical" to the logical address of eb X, which was the old
          root. We then call tree_mod_log_search() passing it the logical
          address of eb X and time_seq == 1;
      
      16) Then before calling tree_mod_log_search(), task T adds a key to eb X,
          which results in adding a tree mod log operation of type
          MOD_LOG_KEY_ADD to the tree mod log - this is done at
          ctree.c:insert_ptr() - but after adding the tree mod log operation
          and before updating the number of items in eb X from 0 to 1...
      
      17) The task at get_old_root() calls tree_mod_log_search() and gets the
          tree mod log operation of type MOD_LOG_KEY_ADD just added by task T.
          Then it enters the following if branch:
      
          if (old_root && tm && tm->op != MOD_LOG_KEY_REMOVE_WHILE_FREEING) {
             (...)
          } (...)
      
          Calls read_tree_block() for eb X, which gets a reference on eb X but
          does not lock it - task T has it locked.
          Then it clones eb X while it has nritems set to 0 in its header, before
          task T sets nritems to 1 in eb X's header. From hereupon we use the
          clone of eb X which no other task has access to;
      
      18) Then we call __tree_mod_log_rewind(), passing it the MOD_LOG_KEY_ADD
          mod log operation we just got from tree_mod_log_search() in the
          previous step and the cloned version of eb X;
      
      19) At __tree_mod_log_rewind(), we set the local variable "n" to the number
          of items set in eb X's clone, which is 0. Then we enter the while loop,
          and in its first iteration we process the MOD_LOG_KEY_ADD operation,
          which just decrements "n" from 0 to (u32)-1, since "n" is declared with
          a type of u32. At the end of this iteration we call rb_next() to find the
          next tree mod log operation for eb X, that gives us the mod log operation
          of type MOD_LOG_KEY_REMOVE_WHILE_FREEING, for slot 0, with a sequence
          number of N + 1 (steps 3 to 6);
      
      20) Then we go back to the top of the while loop and trigger the following
          BUG_ON():
      
              (...)
              switch (tm->op) {
              case MOD_LOG_KEY_REMOVE_WHILE_FREEING:
                       BUG_ON(tm->slot < n);
                       fallthrough;
              (...)
      
          Because "n" has a value of (u32)-1 (4294967295) and tm->slot is 0.
      
      Fix this by taking a read lock on the extent buffer before cloning it at
      ctree.c:get_old_root(). This should be done regardless of the extent
      buffer having been freed and reused, as a concurrent task might be
      modifying it (while holding a write lock on it).
      Reported-by: default avatarZygo Blaxell <ce3g8jdj@umail.furryterror.org>
      Link: https://lore.kernel.org/linux-btrfs/20210227155037.GN28049@hungrycats.org/
      Fixes: 834328a8 ("Btrfs: tree mod log's old roots could still be part of the tree")
      CC: stable@vger.kernel.org # 4.4+
      Signed-off-by: default avatarFilipe Manana <fdmanana@suse.com>
      Signed-off-by: default avatarDavid Sterba <dsterba@suse.com>
      dbcc7d57
    • David Sterba's avatar
      btrfs: fix slab cache flags for free space tree bitmap · 34e49994
      David Sterba authored
      The free space tree bitmap slab cache is created with SLAB_RED_ZONE but
      that's a debugging flag and not always enabled. Also the other slabs are
      created with at least SLAB_MEM_SPREAD that we want as well to average
      the memory placement cost.
      Reported-by: default avatarVlastimil Babka <vbabka@suse.cz>
      Fixes: 3acd4850 ("btrfs: fix allocation of free space cache v1 bitmap pages")
      CC: stable@vger.kernel.org # 5.4+
      Signed-off-by: default avatarDavid Sterba <dsterba@suse.com>
      34e49994
    • Mark Brown's avatar
      Merge series "Do not handle MCLK device clock in simple-card-utils" from... · f9dc51cc
      Mark Brown authored
      Merge series "Do not handle MCLK device clock in simple-card-utils" from Sameer Pujar <spujar@nvidia.com>:
      
      With commit 1e30f642 ("ASoC: simple-card-utils: Fix device module clock")
      simple-card-utils can control MCLK clock for rate updates or enable/disable.
      But this is breaking some platforms where it is expected that codec drivers
      would actually handle the MCLK clock. One such example is following platform.
        - "arch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28-var3-ads2.dts"
      
      In above case codec, wm8904, is using internal PLL and configures sysclk
      based on fixed MCLK input. In such cases it is expected that, required PLL
      output or sysclk, is just passed via set_sysclk() callback and card driver
      need not actually update MCLK rate. Instead, codec can take ownership of
      this clock and do the necessary configuration.
      
      So the original commit is reverted and codec driver for rt5659 is updated
      to fix my board which has this codec.
      
      Sameer Pujar (2):
        ASoC: simple-card-utils: Do not handle device clock
        ASoC: rt5659: Update MCLK rate in set_sysclk()
      
       sound/soc/codecs/rt5659.c             |  5 +++++
       sound/soc/generic/simple-card-utils.c | 13 +++++++------
       2 files changed, 12 insertions(+), 6 deletions(-)
      
      --
      2.7.4
      f9dc51cc
    • Linus Torvalds's avatar
      Merge tag 'fuse-fixes-5.12-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse · 1df27313
      Linus Torvalds authored
      Pull fuse fixes from Miklos Szeredi:
       "Fix a deadlock and a couple of other bugs"
      
      * tag 'fuse-fixes-5.12-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse:
        fuse: 32-bit user space ioctl compat for fuse device
        virtiofs: Fail dax mount if device does not support it
        fuse: fix live lock in fuse_iget()
      1df27313
    • Linus Torvalds's avatar
      Merge tag 'nfsd-5.12-2' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux · 4108e101
      Linus Torvalds authored
      Pull nfsd fixes from Chuck Lever:
       "Miscellaneous NFSD fixes for v5.12-rc"
      
      * tag 'nfsd-5.12-2' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux:
        svcrdma: Revert "svcrdma: Reduce Receive doorbell rate"
        NFSD: fix error handling in NFSv4.0 callbacks
        NFSD: fix dest to src mount in inter-server COPY
        Revert "nfsd4: a client's own opens needn't prevent delegations"
        Revert "nfsd4: remove check_conflicting_opens warning"
        rpc: fix NULL dereference on kmalloc failure
        sunrpc: fix refcount leak for rpc auth modules
        NFSD: Repair misuse of sv_lock in 5.10.16-rt30.
        nfsd: don't abort copies early
        fs: nfsd: fix kconfig dependency warning for NFSD_V4
        svcrdma: disable timeouts on rdma backchannel
        nfsd: Don't keep looking up unhashed files in the nfsd file cache
      4108e101
    • Daniel Jordan's avatar
      vfio/type1: fix vaddr_get_pfns() return in vfio_pin_page_external() · 4ab4fcfc
      Daniel Jordan authored
      vaddr_get_pfns() now returns the positive number of pfns successfully
      gotten instead of zero.  vfio_pin_page_external() might return 1 to
      vfio_iommu_type1_pin_pages(), which will treat it as an error, if
      vaddr_get_pfns() is successful but vfio_pin_page_external() doesn't
      reach vfio_lock_acct().
      
      Fix it up in vfio_pin_page_external().  Found by inspection.
      
      Fixes: be16c1fd ("vfio/type1: Change success value of vaddr_get_pfn()")
      Signed-off-by: default avatarDaniel Jordan <daniel.m.jordan@oracle.com>
      Message-Id: <20210308172452.38864-1-daniel.m.jordan@oracle.com>
      Signed-off-by: default avatarAlex Williamson <alex.williamson@redhat.com>
      4ab4fcfc
    • Jason Gunthorpe's avatar
      vfio: Depend on MMU · b2b12db5
      Jason Gunthorpe authored
      VFIO_IOMMU_TYPE1 does not compile with !MMU:
      
      ../drivers/vfio/vfio_iommu_type1.c: In function 'follow_fault_pfn':
      ../drivers/vfio/vfio_iommu_type1.c:536:22: error: implicit declaration of function 'pte_write'; did you mean 'vfs_write'? [-Werror=implicit-function-declaration]
      
      So require it.
      Suggested-by: default avatarCornelia Huck <cohuck@redhat.com>
      Signed-off-by: default avatarJason Gunthorpe <jgg@nvidia.com>
      Message-Id: <0-v1-02cb5500df6e+78-vfio_no_mmu_jgg@nvidia.com>
      Signed-off-by: default avatarAlex Williamson <alex.williamson@redhat.com>
      b2b12db5
    • Jason Gunthorpe's avatar
      ARM: amba: Allow some ARM_AMBA users to compile with COMPILE_TEST · 3b49dfb0
      Jason Gunthorpe authored
      CONFIG_VFIO_AMBA has a light use of AMBA, adding some inline fallbacks
      when AMBA is disabled will allow it to be compiled under COMPILE_TEST and
      make VFIO easier to maintain.
      Signed-off-by: default avatarJason Gunthorpe <jgg@nvidia.com>
      Message-Id: <3-v1-df057e0f92c3+91-vfio_arm_compile_test_jgg@nvidia.com>
      Reviewed-by: default avatarEric Auger <eric.auger@redhat.com>
      Signed-off-by: default avatarAlex Williamson <alex.williamson@redhat.com>
      3b49dfb0
    • Jason Gunthorpe's avatar
      vfio-platform: Add COMPILE_TEST to VFIO_PLATFORM · d3d72a6d
      Jason Gunthorpe authored
      x86 can build platform bus code too, so vfio-platform and all the platform
      reset implementations compile successfully on x86.
      Signed-off-by: default avatarJason Gunthorpe <jgg@nvidia.com>
      Message-Id: <2-v1-df057e0f92c3+91-vfio_arm_compile_test_jgg@nvidia.com>
      Signed-off-by: default avatarAlex Williamson <alex.williamson@redhat.com>
      d3d72a6d
    • Jason Gunthorpe's avatar
      vfio: IOMMU_API should be selected · 179209fa
      Jason Gunthorpe authored
      As IOMMU_API is a kconfig without a description (eg does not show in the
      menu) the correct operator is select not 'depends on'. Using 'depends on'
      for this kind of symbol means VFIO is not selectable unless some other
      random kconfig has already enabled IOMMU_API for it.
      
      Fixes: cba3345c ("vfio: VFIO core")
      Signed-off-by: default avatarJason Gunthorpe <jgg@nvidia.com>
      Message-Id: <1-v1-df057e0f92c3+91-vfio_arm_compile_test_jgg@nvidia.com>
      Reviewed-by: default avatarEric Auger <eric.auger@redhat.com>
      Signed-off-by: default avatarAlex Williamson <alex.williamson@redhat.com>
      179209fa
    • Steve Sistare's avatar
      vfio/type1: fix unmap all on ILP32 · 7dc4b2fd
      Steve Sistare authored
      Some ILP32 architectures support mapping a 32-bit vaddr within a 64-bit
      iova space.  The unmap-all code uses 32-bit SIZE_MAX as an upper bound on
      the extent of the mappings within iova space, so mappings above 4G cannot
      be found and unmapped.  Use U64_MAX instead, and use u64 for size variables.
      This also fixes a static analysis bug found by the kernel test robot running
      smatch for ILP32.
      
      Fixes: 0f53afa1 ("vfio/type1: unmap cleanup")
      Fixes: c1965099 ("vfio/type1: implement unmap all")
      Reported-by: default avatarkernel test robot <lkp@intel.com>
      Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Signed-off-by: default avatarSteve Sistare <steven.sistare@oracle.com>
      Message-Id: <1614281102-230747-1-git-send-email-steven.sistare@oracle.com>
      Link: https://lore.kernel.org/linux-mm/20210222141043.GW2222@kadamReviewed-by: default avatarCornelia Huck <cohuck@redhat.com>
      Signed-off-by: default avatarAlex Williamson <alex.williamson@redhat.com>
      7dc4b2fd
    • Alessio Balsini's avatar
      fuse: 32-bit user space ioctl compat for fuse device · f8425c93
      Alessio Balsini authored
      With a 64-bit kernel build the FUSE device cannot handle ioctl requests
      coming from 32-bit user space.  This is due to the ioctl command
      translation that generates different command identifiers that thus cannot
      be used for direct comparisons without proper manipulation.
      
      Explicitly extract type and number from the ioctl command to enable 32-bit
      user space compatibility on 64-bit kernel builds.
      Signed-off-by: default avatarAlessio Balsini <balsini@android.com>
      Signed-off-by: default avatarMiklos Szeredi <mszeredi@redhat.com>
      f8425c93
    • Jeremy Szu's avatar
      ALSA: hda/realtek: fix mute/micmute LEDs for HP 850 G8 · 53b861be
      Jeremy Szu authored
      The HP EliteBook 850 G8 Notebook PC is using ALC285 codec which is
      using 0x04 to control mute LED and 0x01 to control micmute LED.
      Therefore, add a quirk to make it works.
      Signed-off-by: default avatarJeremy Szu <jeremy.szu@canonical.com>
      Cc: <stable@vger.kernel.org>
      Link: https://lore.kernel.org/r/20210316094236.89028-1-jeremy.szu@canonical.comSigned-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      53b861be
    • Shengjiu Wang's avatar
      ASoC: dt-bindings: fsl_spdif: Add compatible string for new platforms · 9deef665
      Shengjiu Wang authored
      Add compatible string for new added platforms which support spdif module.
      They are i.MX8QXP, i.MX8MM, i.MX8MN, i.MX8MQ.
      Signed-off-by: default avatarShengjiu Wang <shengjiu.wang@nxp.com>
      Link: https://lore.kernel.org/r/1615884053-4264-1-git-send-email-shengjiu.wang@nxp.comSigned-off-by: default avatarMark Brown <broonie@kernel.org>
      9deef665
    • Bard Liao's avatar
      ASoC: rt711: add snd_soc_component remove callback · 899b1254
      Bard Liao authored
      We do some IO operations in the snd_soc_component_set_jack callback
      function and snd_soc_component_set_jack() will be called when soc
      component is removed. However, we should not access SoundWire registers
      when the bus is suspended.
      So set regcache_cache_only(regmap, true) to avoid accessing in the
      soc component removal process.
      Signed-off-by: default avatarBard Liao <yung-chuan.liao@linux.intel.com>
      Reviewed-by: default avatarKai Vehmanen <kai.vehmanen@linux.intel.com>
      Reviewed-by: default avatarRander Wang <rander.wang@intel.com>
      Link: https://lore.kernel.org/r/20210316005254.29699-1-yung-chuan.liao@linux.intel.comSigned-off-by: default avatarMark Brown <broonie@kernel.org>
      899b1254
    • Sameer Pujar's avatar
      ASoC: rt5659: Update MCLK rate in set_sysclk() · dbf54a95
      Sameer Pujar authored
      Simple-card/audio-graph-card drivers do not handle MCLK clock when it
      is specified in the codec device node. The expectation here is that,
      the codec should actually own up the MCLK clock and do necessary setup
      in the driver.
      Suggested-by: default avatarMark Brown <broonie@kernel.org>
      Suggested-by: default avatarMichael Walle <michael@walle.cc>
      Signed-off-by: default avatarSameer Pujar <spujar@nvidia.com>
      Link: https://lore.kernel.org/r/1615829492-8972-3-git-send-email-spujar@nvidia.comSigned-off-by: default avatarMark Brown <broonie@kernel.org>
      dbf54a95