1. 27 Oct, 2017 1 commit
  2. 26 Oct, 2017 9 commits
  3. 25 Oct, 2017 5 commits
    • Michael J. Ruhl's avatar
      RDMA/netlink: OOPs in rdma_nl_rcv_msg() from misinterpreted flag · b4d91aeb
      Michael J. Ruhl authored
      rdma_nl_rcv_msg() checks to see if it should use the .dump() callback
      or the .doit() callback.  The check is done with this check:
      
      if (flags & NLM_F_DUMP) ...
      
      The NLM_F_DUMP flag is two bits (NLM_F_ROOT | NLM_F_MATCH).
      
      When an RDMA_NL_LS message (response) is received, the bit used for
      indicating an error is the same bit as NLM_F_ROOT.
      
      NLM_F_ROOT == (0x100) == RDMA_NL_LS_F_ERR.
      
      ibacm sends a response with the RDMA_NL_LS_F_ERR bit set if an error
      occurs in the service.  The current code then misinterprets the
      NLM_F_DUMP bit and trys to call the .dump() callback.
      
      If the .dump() callback for the specified request is not available
      (which is true for the RDMA_NL_LS messages) the following Oops occurs:
      
      [ 4555.960256] BUG: unable to handle kernel NULL pointer dereference at
         (null)
      [ 4555.969046] IP:           (null)
      [ 4555.972664] PGD 10543f1067 P4D 10543f1067 PUD 1033f93067 PMD 0
      [ 4555.979287] Oops: 0010 [#1] SMP
      [ 4555.982809] Modules linked in: rpcrdma ib_isert iscsi_target_mod
      target_core_mod ib_iser libiscsi scsi_transport_iscsi ib_ipoib rdma_ucm ib_ucm
      ib_uverbs ib_umad rdma_cm ib_cm iw_cm dm_mirror dm_region_hash dm_log dm_mod
      dax sb_edac x86_pkg_temp_thermal intel_powerclamp coretemp kvm irqbypass
      crct10dif_pclmul crc32_pclmul ghash_clmulni_intel pcbc aesni_intel crypto_simd
      glue_helper cryptd hfi1 rdmavt iTCO_wdt iTCO_vendor_support ib_core mei_me
      lpc_ich pcspkr mei ioatdma sg shpchp i2c_i801 mfd_core wmi ipmi_si ipmi_devintf
      ipmi_msghandler acpi_power_meter acpi_pad nfsd auth_rpcgss nfs_acl lockd grace
      sunrpc ip_tables ext4 mbcache jbd2 sd_mod mgag200 drm_kms_helper syscopyarea
      sysfillrect sysimgblt fb_sys_fops ttm igb ahci crc32c_intel ptp libahci
      pps_core drm dca libata i2c_algo_bit i2c_core
      [ 4556.061190] CPU: 54 PID: 9841 Comm: ibacm Tainted: G          I
      4.14.0-rc2+ #6
      [ 4556.069667] Hardware name: Intel Corporation S2600WT2/S2600WT2, BIOS
      SE5C610.86B.01.01.0008.021120151325 02/11/2015
      [ 4556.081339] task: ffff880855f42d00 task.stack: ffffc900246b4000
      [ 4556.087967] RIP: 0010:          (null)
      [ 4556.092166] RSP: 0018:ffffc900246b7bc8 EFLAGS: 00010246
      [ 4556.098018] RAX: ffffffff81dbe9e0 RBX: ffff881058bb1000 RCX:
      0000000000000000
      [ 4556.105997] RDX: 0000000000001100 RSI: ffff881058bb1320 RDI:
      ffff881056362000
      [ 4556.113984] RBP: ffffc900246b7bf8 R08: 0000000000000ec0 R09:
      0000000000001100
      [ 4556.121971] R10: ffff8810573a5000 R11: 0000000000000000 R12:
      ffff881056362000
      [ 4556.129957] R13: 0000000000000ec0 R14: ffff881058bb1320 R15:
      0000000000000ec0
      [ 4556.137945] FS:  00007fe0ba5a38c0(0000) GS:ffff88105f080000(0000)
      knlGS:0000000000000000
      [ 4556.147000] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [ 4556.153433] CR2: 0000000000000000 CR3: 0000001056f5d003 CR4:
      00000000001606e0
      [ 4556.161419] Call Trace:
      [ 4556.164167]  ? netlink_dump+0x12c/0x290
      [ 4556.168468]  __netlink_dump_start+0x186/0x1f0
      [ 4556.173357]  rdma_nl_rcv_msg+0x193/0x1b0 [ib_core]
      [ 4556.178724]  rdma_nl_rcv+0xdc/0x130 [ib_core]
      [ 4556.183604]  netlink_unicast+0x181/0x240
      [ 4556.187998]  netlink_sendmsg+0x2c2/0x3b0
      [ 4556.192392]  sock_sendmsg+0x38/0x50
      [ 4556.196299]  SYSC_sendto+0x102/0x190
      [ 4556.200308]  ? __audit_syscall_entry+0xaf/0x100
      [ 4556.205387]  ? syscall_trace_enter+0x1d0/0x2b0
      [ 4556.210366]  ? __audit_syscall_exit+0x209/0x290
      [ 4556.215442]  SyS_sendto+0xe/0x10
      [ 4556.219060]  do_syscall_64+0x67/0x1b0
      [ 4556.223165]  entry_SYSCALL64_slow_path+0x25/0x25
      [ 4556.228328] RIP: 0033:0x7fe0b9db2a63
      [ 4556.232333] RSP: 002b:00007ffc55edc260 EFLAGS: 00000293 ORIG_RAX:
      000000000000002c
      [ 4556.240808] RAX: ffffffffffffffda RBX: 0000000000000010 RCX:
      00007fe0b9db2a63
      [ 4556.248796] RDX: 0000000000000010 RSI: 00007ffc55edc280 RDI:
      000000000000000d
      [ 4556.256782] RBP: 00007ffc55edc670 R08: 00007ffc55edc270 R09:
      000000000000000c
      [ 4556.265321] R10: 0000000000000000 R11: 0000000000000293 R12:
      00007ffc55edc280
      [ 4556.273846] R13: 000000000260b400 R14: 000000000000000d R15:
      0000000000000001
      [ 4556.282368] Code:  Bad RIP value.
      [ 4556.286629] RIP:           (null) RSP: ffffc900246b7bc8
      [ 4556.293013] CR2: 0000000000000000
      [ 4556.297292] ---[ end trace 8d67abcfd10ec209 ]---
      [ 4556.305465] Kernel panic - not syncing: Fatal exception
      [ 4556.313786] Kernel Offset: disabled
      [ 4556.321563] ---[ end Kernel panic - not syncing: Fatal exception
      [ 4556.328960] ------------[ cut here ]------------
      
      Special case RDMA_NL_LS response messages to call the appropriate
      callback.
      
      Additionally, make sure that the .dump() callback is not NULL
      before calling it.
      
      Fixes: 647c75ac ("RDMA/netlink: Convert LS to doit callback")
      Reviewed-by: default avatarMike Marciniszyn <mike.marciniszyn@intel.com>
      Reviewed-by: default avatarKaike Wan <kaike.wan@intel.com>
      Reviewed-by: default avatarAlex Estrin <alex.estrin@intel.com>
      Signed-off-by: default avatarMichael J. Ruhl <michael.j.ruhl@intel.com>
      Reviewed-by: default avatarShiraz Saleem <shiraz.saleem@intel.com>
      Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
      b4d91aeb
    • Mark Brown's avatar
      Merge remote-tracking branches 'spi/fix/armada', 'spi/fix/idr',... · 7555aa76
      Mark Brown authored
      Merge remote-tracking branches 'spi/fix/armada', 'spi/fix/idr', 'spi/fix/qspi', 'spi/fix/stm32' and 'spi/fix/uapi' into spi-linus
      7555aa76
    • Jeff Layton's avatar
      ceph: unlock dangling spinlock in try_flush_caps() · 6c2838fb
      Jeff Layton authored
      sparse warns:
      
        fs/ceph/caps.c:2042:9: warning: context imbalance in 'try_flush_caps' - wrong count at exit
      
      We need to exit this function with the lock unlocked, but a couple of
      cases leave it locked.
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarJeff Layton <jlayton@redhat.com>
      Reviewed-by: default avatar"Yan, Zheng" <zyan@redhat.com>
      Reviewed-by: default avatarIlya Dryomov <idryomov@gmail.com>
      Signed-off-by: default avatarIlya Dryomov <idryomov@gmail.com>
      6c2838fb
    • Linus Torvalds's avatar
      Merge tag 'nfs-for-4.14-4' of git://git.linux-nfs.org/projects/trondmy/linux-nfs · f3415787
      Linus Torvalds authored
      Pull NFS client bugfixes from Trond Myklebust:
      
       - Fix a list corruption in xprt_release()
      
       - Fix a workqueue lockdep warning due to unsafe use of
         cancel_work_sync()
      
      * tag 'nfs-for-4.14-4' of git://git.linux-nfs.org/projects/trondmy/linux-nfs:
        SUNRPC: Destroy transport from the system workqueue
        SUNRPC: fix a list corruption issue in xprt_release()
      f3415787
    • Josef Bacik's avatar
      nbd: handle interrupted sendmsg with a sndtimeo set · 32e67a3a
      Josef Bacik authored
      If you do not set sk_sndtimeo you will get -ERESTARTSYS if there is a
      pending signal when you enter sendmsg, which we handle properly.
      However if you set a timeout for your commands we'll set sk_sndtimeo to
      that timeout, which means that sendmsg will start returning -EINTR
      instead of -ERESTARTSYS.  Fix this by checking either cases and doing
      the correct thing.
      
      Cc: stable@vger.kernel.org
      Fixes: dc88e34d ("nbd: set sk->sk_sndtimeo for our sockets")
      Reported-and-tested-by: default avatarDaniel Xu <dlxu@fb.com>
      Signed-off-by: default avatarJosef Bacik <jbacik@fb.com>
      Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
      32e67a3a
  4. 24 Oct, 2017 5 commits
  5. 23 Oct, 2017 12 commits
    • Linus Torvalds's avatar
      Merge tag 'platform-drivers-x86-v4.14-3' of git://git.infradead.org/linux-platform-drivers-x86 · 6cff0a11
      Linus Torvalds authored
      Pull x86 platform driver fixes from Darren Hart:
       "Use a spin_lock instead of mutex in atomic context. The devm_ fix is a
        dependency. Summary:
      
        intel_pmc_ipc:
         - Use spin_lock to protect GCR updates
         - Use devm_* calls in driver probe function"
      
      * tag 'platform-drivers-x86-v4.14-3' of git://git.infradead.org/linux-platform-drivers-x86:
        platform/x86: intel_pmc_ipc: Use spin_lock to protect GCR updates
        platform/x86: intel_pmc_ipc: Use devm_* calls in driver probe function
      6cff0a11
    • Kuppuswamy Sathyanarayanan's avatar
      platform/x86: intel_pmc_ipc: Use spin_lock to protect GCR updates · 6687aeb9
      Kuppuswamy Sathyanarayanan authored
      Currently, update_no_reboot_bit() function implemented in this driver
      uses mutex_lock() to protect its register updates. But this function is
      called with in atomic context in iTCO_wdt_start() and iTCO_wdt_stop()
      functions in iTCO_wdt.c driver, which in turn causes "sleeping into
      atomic context" issue. This patch fixes this issue by replacing the
      mutex_lock() with spin_lock() to protect the GCR read/write/update APIs.
      
      Fixes: 9d855d46 ("platform/x86: intel_pmc_ipc: Fix iTCO_wdt GCS memory mapping failure")
      Signed-off-by: default avatarKuppuswamy Sathyanarayanan <sathyanarayanan.kupuswamy@linux.intel.com>
      Signed-off-by: default avatarAndy Shevchenko <andriy.shevchenko@linux.intel.com>
      6687aeb9
    • Kuppuswamy Sathyanarayanan's avatar
      platform/x86: intel_pmc_ipc: Use devm_* calls in driver probe function · 83beee5c
      Kuppuswamy Sathyanarayanan authored
      This patch cleans up unnecessary free/alloc calls in ipc_plat_probe(),
      ipc_pci_probe() and ipc_plat_get_res() functions by using devm_*
      calls.
      
      This patch also adds proper error handling for failure cases in
      ipc_pci_probe() function.
      Signed-off-by: default avatarKuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
      [andy: fixed style issues, missed devm_free_irq(), removed unnecessary log message]
      Signed-off-by: default avatarAndy Shevchenko <andriy.shevchenko@linux.intel.com>
      83beee5c
    • Linus Torvalds's avatar
      Merge branch 'for-4.14-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq · 06987dad
      Linus Torvalds authored
      Pull workqueue fix from Tejun Heo:
       "This is a fix for an old bug in workqueue. Workqueue used a mutex to
        arbitrate who gets to be the manager of a pool. When the manager role
        gets released, the mutex gets unlocked while holding the pool's
        irqsafe spinlock. This can lead to deadlocks as mutex's internal
        spinlock isn't irqsafe. This got discovered by recent fixes to mutex
        lockdep annotations.
      
        The fix is a bit invasive for rc6 but if anything were wrong with the
        fix it would likely have already blown up in -next, and we want the
        fix in -stable anyway"
      
      * 'for-4.14-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq:
        workqueue: replace pool->manager_arb mutex with a flag
      06987dad
    • Linus Torvalds's avatar
      Merge tag 'pinctrl-v4.14-4' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl · 2f1b11c5
      Linus Torvalds authored
      Pull pin control fixes from Linus Walleij:
       "Two last minute fixes for pin controllers, both regressions in
        specific drivers:
      
         - Fix a touchpad pin control issue on the AMD affecting Asus laptops
      
         - Fix an interrupt handling regression on the MCP23s08"
      
      * tag 'pinctrl-v4.14-4' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:
        pinctrl: mcp23s08: fix interrupt handling regression
        pinctrl/amd: fix masking of GPIO interrupts
      2f1b11c5
    • Linus Torvalds's avatar
      Merge tag 'regulator-fix-v4.14-rc5' of... · 468b0e0c
      Linus Torvalds authored
      Merge tag 'regulator-fix-v4.14-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator
      
      Pull regulator fixes from Mark Brown:
       "A couple of small driver specific bug fixes that have been collected
        since the merge window"
      
      * tag 'regulator-fix-v4.14-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:
        regulator: rn5t618: Do not index regulator_desc arrays by id
        regulator: axp20x: Fix poly-phase bit offset for AXP803 DCDC5/6
      468b0e0c
    • Sagi Grimberg's avatar
      nvme-rdma: fix possible hang when issuing commands during ctrl removal · 7db81446
      Sagi Grimberg authored
      nvme_rdma_queue_is_ready() fails requests in case a queue is not
      LIVE. If the controller is in RECONNECTING state, we might be in
      this state for a long time (until we successfully reconnect) and
      we are better off with failing the request fast. Otherwise, we
      fail with BLK_STS_RESOURCE to have the block layer try again
      soon.
      
      In case we are removing the controller when the admin queue
      is not LIVE, we will terminate the request with BLK_STS_RESOURCE
      but it happens before we call blk_mq_start_request() so the
      request timeout never expires, and the queue will never get
      back to LIVE (because we are removing the controller). This
      causes the removal operation to block infinitly [1].
      
      Thus, if we are removing (state DELETING), and the queue is
      not LIVE, we need to fail the request permanently as there is
      no chance for it to ever complete successfully.
      
      [1]
      --
      sysrq: SysRq : Show Blocked State
        task                        PC stack   pid father
      kworker/u66:2   D    0   440      2 0x80000000
      Workqueue: nvme-wq nvme_rdma_del_ctrl_work [nvme_rdma]
      Call Trace:
       __schedule+0x3e9/0xb00
       schedule+0x40/0x90
       schedule_timeout+0x221/0x580
       io_schedule_timeout+0x1e/0x50
       wait_for_completion_io_timeout+0x118/0x180
       blk_execute_rq+0x86/0xc0
       __nvme_submit_sync_cmd+0x89/0xf0
       nvmf_reg_write32+0x4b/0x90 [nvme_fabrics]
       nvme_shutdown_ctrl+0x41/0xe0
       nvme_rdma_shutdown_ctrl+0xca/0xd0 [nvme_rdma]
       nvme_rdma_remove_ctrl+0x2b/0x40 [nvme_rdma]
       nvme_rdma_del_ctrl_work+0x25/0x30 [nvme_rdma]
       process_one_work+0x1fd/0x630
       worker_thread+0x1db/0x3b0
       kthread+0x11e/0x150
       ret_from_fork+0x27/0x40
      01              D    0  2868   2862 0x00000000
      Call Trace:
       __schedule+0x3e9/0xb00
       schedule+0x40/0x90
       schedule_timeout+0x260/0x580
       wait_for_completion+0x108/0x170
       flush_work+0x1e0/0x270
       nvme_rdma_del_ctrl+0x5a/0x80 [nvme_rdma]
       nvme_sysfs_delete+0x2a/0x40
       dev_attr_store+0x18/0x30
       sysfs_kf_write+0x45/0x60
       kernfs_fop_write+0x124/0x1c0
       __vfs_write+0x28/0x150
       vfs_write+0xc7/0x1b0
       SyS_write+0x49/0xa0
       entry_SYSCALL_64_fastpath+0x18/0xad
      --
      Reported-by: default avatarBart Van Assche <bart.vanassche@wdc.com>
      Signed-off-by: default avatarSagi Grimberg <sagi@grimberg.me>
      Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
      7db81446
    • Linus Torvalds's avatar
      Linux 4.14-rc6 · bb176f67
      Linus Torvalds authored
      bb176f67
    • Linus Torvalds's avatar
      Merge tag 'staging-4.14-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging · dd9d064e
      Linus Torvalds authored
      Pull staging and IIO fixes from Greg KH:
       "Here are a small number of patches to resolve some reported IIO and a
        staging driver problem. Nothing major here, full details are in the
        shortlog below.
      
        All have been in linux-next with no reported issues"
      
      * tag 'staging-4.14-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
        staging: bcm2835-audio: Fix memory corruption
        iio: adc: at91-sama5d2_adc: fix probe error on missing trigger property
        iio: adc: dln2-adc: fix build error
        iio: dummy: events: Add missing break
        staging: iio: ade7759: fix signed extension bug on shift of a u8
        iio: pressure: zpa2326: Remove always-true check which confuses gcc
        iio: proximity: as3935: noise detection + threshold changes
      dd9d064e
    • Linus Torvalds's avatar
      Merge tag 'char-misc-4.14-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc · 17e7637f
      Linus Torvalds authored
      Pull char/misc driver fixes from Greg KH:
       "Here are four small fixes for 4.14-rc6.
      
        Three of them are binder driver fixes for reported issues, and the
        last one is a hyperv driver bugfix. Nothing major, but good fixes to
        get into 4.14-final.
      
        All of these have been in linux-next with no reported issues"
      
      * tag 'char-misc-4.14-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
        android: binder: Fix null ptr dereference in debug msg
        android: binder: Don't get mm from task
        vmbus: hvsock: add proper sync for vmbus_hvsock_device_unregister()
        binder: call poll_wait() unconditionally.
      17e7637f
    • Linus Torvalds's avatar
      Merge tag 'usb-4.14-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb · 58059921
      Linus Torvalds authored
      Pull USB/PHY fixes from Greg KH:
       "Here are a small number of USB and PHY driver fixes for 4.14-rc6
      
        There is the usual musb and xhci fixes in here, as well as some needed
        phy patches. Also is a nasty regression fix for usbfs that has started
        to hit a lot of people using virtual machines.
      
        All of these have been in linux-next with no reported problems"
      
      * tag 'usb-4.14-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (26 commits)
        usb: hub: Allow reset retry for USB2 devices on connect bounce
        USB: core: fix out-of-bounds access bug in usb_get_bos_descriptor()
        MAINTAINERS: fix git tree url for musb module
        usb: quirks: add quirk for WORLDE MINI MIDI keyboard
        usb: musb: sunxi: Explicitly release USB PHY on exit
        usb: musb: Check for host-mode using is_host_active() on reset interrupt
        usb: musb: musb_cppi41: Configure the number of channels for DA8xx
        usb: musb: musb_cppi41: Fix cppi41_set_dma_mode() for DA8xx
        usb: musb: musb_cppi41: Fix the address of teardown and autoreq registers
        USB: musb: fix late external abort on suspend
        USB: musb: fix session-bit runtime-PM quirk
        usb: cdc_acm: Add quirk for Elatec TWN3
        USB: devio: Revert "USB: devio: Don't corrupt user memory"
        usb: xhci: Handle error condition in xhci_stop_device()
        usb: xhci: Reset halted endpoint if trb is noop
        xhci: Cleanup current_cmd in xhci_cleanup_command_queue()
        xhci: Identify USB 3.1 capable hosts by their port protocol capability
        USB: serial: metro-usb: add MS7820 device id
        phy: rockchip-typec: Check for errors from tcphy_phy_init()
        phy: rockchip-typec: Don't set the aux voltage swing to 400 mV
        ...
      58059921
    • Mark Brown's avatar
      Merge remote-tracking branches 'regulator/fix/axp20x' and... · 2ab19d52
      Mark Brown authored
      Merge remote-tracking branches 'regulator/fix/axp20x' and 'regulator/fix/rn5t618' into regulator-linus
      2ab19d52
  6. 22 Oct, 2017 8 commits