1. 01 Aug, 2020 2 commits
  2. 31 Jul, 2020 13 commits
    • Linus Torvalds's avatar
      Merge branch 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux · 7dc6fd0f
      Linus Torvalds authored
      Pull i2c fixes from Wolfram Sang:
       "Some I2C core improvements to prevent NULL pointer usage and a
        MAINTAINERS update"
      
      * 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
        i2c: slave: add sanity check when unregistering
        i2c: slave: improve sanity check when registering
        MAINTAINERS: Update GENI I2C maintainers list
        i2c: also convert placeholder function to return errno
      7dc6fd0f
    • Linus Torvalds's avatar
      Merge tag 'powerpc-5.8-8' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux · deacdb3e
      Linus Torvalds authored
      Pull powerpc fix from Michael Ellerman:
       "Fix a bug introduced by the changes we made to lockless page table
        walking this cycle.
      
        When using the hash MMU, and perf with callchain recording, we can
        deadlock if the PMI interrupts a hash fault, and the callchain
        recording then takes a hash fault on the same page.
      
        Thanks to Nicholas Piggin, Aneesh Kumar K.V, Anton Blanchard, and
        Athira Rajeev"
      
      * tag 'powerpc-5.8-8' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
        powerpc/64s/hash: Fix hash_preload running with interrupts enabled
      deacdb3e
    • Linus Torvalds's avatar
      Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux · 14aab7ee
      Linus Torvalds authored
      Pull arm64 fixes from Will Deacon:
       "The main one is to fix the build after Willy's per-cpu entropy changes
        this week. Although that was already resolved elsewhere, the arm64 fix
        here is useful cleanup anyway.
      
        Other than that, we've got a fix for building with Clang's integrated
        assembler and a fix to make our IPv4 checksumming robust against
        invalid header lengths (this only seems to be triggerable by injected
        errors).
      
         - Fix build breakage due to circular headers
      
         - Fix build regression when using Clang's integrated assembler
      
         - Fix IPv4 header checksum code to deal with invalid length field
      
         - Fix broken path for Arm PMU entry in MAINTAINERS"
      
      * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
        MAINTAINERS: Include drivers subdirs for ARM PMU PROFILING AND DEBUGGING entry
        arm64: csum: Fix handling of bad packets
        arm64: Drop unnecessary include from asm/smp.h
        arm64/alternatives: move length validation inside the subsection
      14aab7ee
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm · c1954ca6
      Linus Torvalds authored
      Pull ARM fixes from Russell King:
      
       - avoid invoking overflow handler for uaccess watchpoints
      
       - fix incorrect clock_gettime64 availability
      
       - fix EFI crash in create_mapping_late()
      
      * tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm:
        ARM: 8988/1: mmu: fix crash in EFI calls due to p4d typo in create_mapping_late()
        ARM: 8987/1: VDSO: Fix incorrect clock_gettime64
        ARM: 8986/1: hw_breakpoint: Don't invoke overflow handler on uaccess watchpoints
      c1954ca6
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma · ae2911de
      Linus Torvalds authored
      Pull rdma fixes from Jason Gunthorpe:
       "Two more merge window regressions, a corruption bug in hfi1 and a few
        other small fixes.
      
         - Missing user input validation regression in ucma
      
         - Disallowing a previously allowed user combination regression in
           mlx5
      
         - ODP prefetch memory leaking triggerable by userspace
      
         - Memory corruption in hf1 due to faulty ring buffer logic
      
         - Missed mutex initialization crash in mlx5
      
         - Two small defects with RDMA DIM"
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:
        RDMA/core: Free DIM memory in error unwind
        RDMA/core: Stop DIM before destroying CQ
        RDMA/mlx5: Initialize QP mutex for the debug kernels
        IB/rdmavt: Fix RQ counting issues causing use of an invalid RWQE
        RDMA/mlx5: Allow providing extra scatter CQE QP flag
        RDMA/mlx5: Fix prefetch memory leak if get_prefetchable_mr fails
        RDMA/cm: Add min length checks to user structure copies
      ae2911de
    • Linus Torvalds's avatar
      Merge tag 'sound-5.8' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound · 78431ab7
      Linus Torvalds authored
      Pull sound fixes from Takashi Iwai:
       "A few wrap-up small fixes for the usual HD-audio and USB-audio stuff:
      
         - A regression fix for S3 suspend on old Intel platforms
      
         - A fix for possible Oops in ASoC HD-audio binding
      
         - Trivial quirks for various devices"
      
      * tag 'sound-5.8' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
        ALSA: hda/realtek - Fixed HP right speaker no sound
        ALSA: hda: fix NULL pointer dereference during suspend
        ALSA: hda/hdmi: Fix keep_power assignment for non-component devices
        ALSA: hda: Workaround for spurious wakeups on some Intel platforms
        ALSA: hda/realtek: Fix add a "ultra_low_power" function for intel reference board (alc256)
        ALSA: hda/realtek: typo_fix: enable headset mic of ASUS ROG Zephyrus G14(GA401) series with ALC289
        ALSA: hda/realtek: enable headset mic of ASUS ROG Zephyrus G15(GA502) series with ALC289
        ALSA: usb-audio: Add implicit feedback quirk for SSL2
      78431ab7
    • Ben Hutchings's avatar
      libtraceevent: Fix build with binutils 2.35 · 39efdd94
      Ben Hutchings authored
      In binutils 2.35, 'nm -D' changed to show symbol versions along with
      symbol names, with the usual @@ separator.  When generating
      libtraceevent-dynamic-list we need just the names, so strip off the
      version suffix if present.
      Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
      Tested-by: default avatarSalvatore Bonaccorso <carnil@debian.org>
      Reviewed-by: default avatarSteven Rostedt <rostedt@goodmis.org>
      Cc: linux-trace-devel@vger.kernel.org
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      39efdd94
    • Wei Li's avatar
      perf tools: Fix record failure when mixed with ARM SPE event · bd3c628f
      Wei Li authored
      When recording with cache-misses and arm_spe_x event, I found that it
      will just fail without showing any error info if i put cache-misses
      after 'arm_spe_x' event.
      
        [root@localhost 0620]# perf record -e cache-misses \
      				-e arm_spe_0/ts_enable=1,pct_enable=1,pa_enable=1,load_filter=1,jitter=1,store_filter=1,min_latency=0/ sleep 1
        [ perf record: Woken up 1 times to write data ]
        [ perf record: Captured and wrote 0.067 MB perf.data ]
        [root@localhost 0620]#
        [root@localhost 0620]# perf record -e arm_spe_0/ts_enable=1,pct_enable=1,pa_enable=1,load_filter=1,jitter=1,store_filter=1,min_latency=0/ \
      				     -e  cache-misses sleep 1
        [root@localhost 0620]#
      
      The current code can only work if the only event to be traced is an
      'arm_spe_x', or if it is the last event to be specified. Otherwise the
      last event type will be checked against all the arm_spe_pmus[i]->types,
      none will match and an out of bound 'i' index will be used in
      arm_spe_recording_init().
      
      We don't support concurrent multiple arm_spe_x events currently, that
      is checked in arm_spe_recording_options(), and it will show the relevant
      info. So add the check and record of the first found 'arm_spe_pmu' to
      fix this issue here.
      
      Fixes: ffd3d18c ("perf tools: Add ARM Statistical Profiling Extensions (SPE) support")
      Signed-off-by: default avatarWei Li <liwei391@huawei.com>
      Reviewed-by: default avatarMathieu Poirier <mathieu.poirier@linaro.org>
      Tested-by-by: default avatarLeo Yan <leo.yan@linaro.org>
      Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
      Cc: Hanjun Guo <guohanjun@huawei.com>
      Cc: Jiri Olsa <jolsa@redhat.com>
      Cc: Kim Phillips <kim.phillips@arm.com>
      Cc: Mark Rutland <mark.rutland@arm.com>
      Cc: Mike Leach <mike.leach@linaro.org>
      Cc: Namhyung Kim <namhyung@kernel.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Suzuki Poulouse <suzuki.poulose@arm.com>
      Cc: linux-arm-kernel@lists.infradead.org
      Link: http://lore.kernel.org/lkml/20200724071111.35593-2-liwei391@huawei.comSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      bd3c628f
    • Thomas Richter's avatar
      perf tests: Fix test 68 zstd compression for s390 · 463538a3
      Thomas Richter authored
      Commit 5aa98879 ("s390/cpum_sf: prohibit callchain data collection")
      prohibits call graph sampling for hardware events on s390. The
      information recorded is out of context and does not match.
      
      On s390 this commit now breaks test case 68 Zstd perf.data
      compression/decompression.
      
      Therefore omit call graph sampling on s390 in this test.
      
      Output before:
        [root@t35lp46 perf]# ./perf test -Fv 68
        68: Zstd perf.data compression/decompression              :
        --- start ---
        Collecting compressed record file:
        Error:
        cycles: PMU Hardware doesn't support sampling/overflow-interrupts.
                                      Try 'perf stat'
        ---- end ----
        Zstd perf.data compression/decompression: FAILED!
        [root@t35lp46 perf]#
      
      Output after:
      [root@t35lp46 perf]# ./perf test -Fv 68
        68: Zstd perf.data compression/decompression              :
        --- start ---
        Collecting compressed record file:
        500+0 records in
        500+0 records out
        256000 bytes (256 kB, 250 KiB) copied, 0.00615638 s, 41.6 MB/s
        [ perf record: Woken up 1 times to write data ]
        [ perf record: Captured and wrote 0.004 MB /tmp/perf.data.X3M,
                              compressed (original 0.002 MB, ratio is 3.609) ]
        Checking compressed events stats:
        # compressed : Zstd, level = 1, ratio = 4
              COMPRESSED events:          1
        2ELIFREPh---- end ----
        Zstd perf.data compression/decompression: Ok
        [root@t35lp46 perf]#
      Signed-off-by: default avatarThomas Richter <tmricht@linux.ibm.com>
      Reviewed-by: default avatarSumanth Korikkar <sumanthk@linux.ibm.com>
      Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
      Cc: Sven Schnelle <svens@linux.ibm.com>
      Cc: Vasily Gorbik <gor@linux.ibm.com>
      Link: http://lore.kernel.org/lkml/20200729135314.91281-1-tmricht@linux.ibm.comSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      463538a3
    • Philippe Duplessis-Guindon's avatar
      tools lib traceevent: Fix memory leak in process_dynamic_array_len · e24c6447
      Philippe Duplessis-Guindon authored
      I compiled with AddressSanitizer and I had these memory leaks while I
      was using the tep_parse_format function:
      
          Direct leak of 28 byte(s) in 4 object(s) allocated from:
              #0 0x7fb07db49ffe in __interceptor_realloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dffe)
              #1 0x7fb07a724228 in extend_token /home/pduplessis/repo/linux/tools/lib/traceevent/event-parse.c:985
              #2 0x7fb07a724c21 in __read_token /home/pduplessis/repo/linux/tools/lib/traceevent/event-parse.c:1140
              #3 0x7fb07a724f78 in read_token /home/pduplessis/repo/linux/tools/lib/traceevent/event-parse.c:1206
              #4 0x7fb07a725191 in __read_expect_type /home/pduplessis/repo/linux/tools/lib/traceevent/event-parse.c:1291
              #5 0x7fb07a7251df in read_expect_type /home/pduplessis/repo/linux/tools/lib/traceevent/event-parse.c:1299
              #6 0x7fb07a72e6c8 in process_dynamic_array_len /home/pduplessis/repo/linux/tools/lib/traceevent/event-parse.c:2849
              #7 0x7fb07a7304b8 in process_function /home/pduplessis/repo/linux/tools/lib/traceevent/event-parse.c:3161
              #8 0x7fb07a730900 in process_arg_token /home/pduplessis/repo/linux/tools/lib/traceevent/event-parse.c:3207
              #9 0x7fb07a727c0b in process_arg /home/pduplessis/repo/linux/tools/lib/traceevent/event-parse.c:1786
              #10 0x7fb07a731080 in event_read_print_args /home/pduplessis/repo/linux/tools/lib/traceevent/event-parse.c:3285
              #11 0x7fb07a731722 in event_read_print /home/pduplessis/repo/linux/tools/lib/traceevent/event-parse.c:3369
              #12 0x7fb07a740054 in __tep_parse_format /home/pduplessis/repo/linux/tools/lib/traceevent/event-parse.c:6335
              #13 0x7fb07a74047a in __parse_event /home/pduplessis/repo/linux/tools/lib/traceevent/event-parse.c:6389
              #14 0x7fb07a740536 in tep_parse_format /home/pduplessis/repo/linux/tools/lib/traceevent/event-parse.c:6431
              #15 0x7fb07a785acf in parse_event ../../../src/fs-src/fs.c:251
              #16 0x7fb07a785ccd in parse_systems ../../../src/fs-src/fs.c:284
              #17 0x7fb07a786fb3 in read_metadata ../../../src/fs-src/fs.c:593
              #18 0x7fb07a78760e in ftrace_fs_source_init ../../../src/fs-src/fs.c:727
              #19 0x7fb07d90c19c in add_component_with_init_method_data ../../../../src/lib/graph/graph.c:1048
              #20 0x7fb07d90c87b in add_source_component_with_initialize_method_data ../../../../src/lib/graph/graph.c:1127
              #21 0x7fb07d90c92a in bt_graph_add_source_component ../../../../src/lib/graph/graph.c:1152
              #22 0x55db11aa632e in cmd_run_ctx_create_components_from_config_components ../../../src/cli/babeltrace2.c:2252
              #23 0x55db11aa6fda in cmd_run_ctx_create_components ../../../src/cli/babeltrace2.c:2347
              #24 0x55db11aa780c in cmd_run ../../../src/cli/babeltrace2.c:2461
              #25 0x55db11aa8a7d in main ../../../src/cli/babeltrace2.c:2673
              #26 0x7fb07d5460b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
      
      The token variable in the process_dynamic_array_len function is
      allocated in the read_expect_type function, but is not freed before
      calling the read_token function.
      
      Free the token variable before calling read_token in order to plug the
      leak.
      Signed-off-by: default avatarPhilippe Duplessis-Guindon <pduplessis@efficios.com>
      Reviewed-by: default avatarSteven Rostedt (VMware) <rostedt@goodmis.org>
      Link: https://lore.kernel.org/linux-trace-devel/20200730150236.5392-1-pduplessis@efficios.comSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      e24c6447
    • Linus Torvalds's avatar
      Merge tag 'drm-fixes-2020-07-31' of git://anongit.freedesktop.org/drm/drm · d8b9faec
      Linus Torvalds authored
      Pull more drm fixes from Dave Airlie:
       "As mentioned previously this contains the nouveau regression fix.
      
        amdgpu had three fixes outstanding as well, one revert, an info leak
        and use after free. The use after free is a bit trickier than I'd
        like, and I've personally gone over it to confirm I'm happy that it is
        doing what it says.
      
        nouveau:
         - final modifiers regression fix
      
        amdgpu:
         - Revert a fix which caused other regressions
         - Fix potential kernel info leak
         - Fix a use-after-free bug that was uncovered by another change in 5.7"
      
      * tag 'drm-fixes-2020-07-31' of git://anongit.freedesktop.org/drm/drm:
        drm/nouveau: Accept 'legacy' format modifiers
        Revert "drm/amdgpu: Fix NULL dereference in dpm sysfs handlers"
        drm/amd/display: Clear dm_state for fast updates
        drm/amdgpu: Prevent kernel-infoleak in amdgpu_info_ioctl()
      d8b9faec
    • Dave Airlie's avatar
      Merge tag 'amd-drm-fixes-5.8-2020-07-30' of... · 887c909d
      Dave Airlie authored
      Merge tag 'amd-drm-fixes-5.8-2020-07-30' of git://people.freedesktop.org/~agd5f/linux into drm-fixes
      
      amd-drm-fixes-5.8-2020-07-30:
      
      amdgpu:
      - Revert a fix which caused other regressions
      - Fix potential kernel info leak
      - Fix a use-after-free bug that was uncovered by another change in 5.7
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      From: Alex Deucher <alexdeucher@gmail.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20200730154338.244104-1-alexander.deucher@amd.com
      887c909d
    • James Jones's avatar
      drm/nouveau: Accept 'legacy' format modifiers · faa0fcf9
      James Jones authored
      Accept the DRM_FORMAT_MOD_NVIDIA_16BX2_BLOCK()
      family of modifiers to handle broken userspace
      Xorg modesetting and Mesa drivers. Existing Mesa
      drivers are still aware of only these older
      format modifiers which do not differentiate
      between different variations of the block linear
      layout. When the format modifier support flag was
      flipped in the nouveau kernel driver, the X.org
      modesetting driver began attempting to use its
      format modifier-enabled framebuffer path. Because
      the set of format modifiers advertised by the
      kernel prior to this change do not intersect with
      the set of format modifiers advertised by Mesa,
      allocating GBM buffers using format modifiers
      fails and the modesetting driver falls back to
      non-modifier allocation. However, it still later
      queries the modifier of the GBM buffer when
      creating its DRM-KMS framebuffer object, receives
      the old-format modifier from Mesa, and attempts
      to create a framebuffer with it. Since the kernel
      is still not aware of these formats, this fails.
      
      Userspace should not be attempting to query format
      modifiers of GBM buffers allocated with a non-
      format-modifier-aware allocation path, but to
      avoid breaking existing userspace behavior, this
      change accepts the old-style format modifiers when
      creating framebuffers and applying them to planes
      by translating them to the equivalent new-style
      modifier. To accomplish this, some layout
      parameters must be assumed to match properties of
      the device targeted by the relevant ioctls. To
      avoid perpetuating misuse of the old-style
      modifiers, this change does not advertise support
      for them. Doing so would imply compatibility
      between devices with incompatible memory layouts.
      
      Tested with Xorg 1.20 modesetting driver,
      weston@c46c70dac84a4b3030cd05b380f9f410536690fc,
      gnome & KDE wayland desktops from Ubuntu 18.04,
      and sway 1.5
      Reported-by: default avatarKirill A. Shutemov <kirill@shutemov.name>
      Fixes: fa4f4c21 ("drm/nouveau/kms: Support NVIDIA format modifiers")
      Link: https://lkml.org/lkml/2020/6/30/1251Signed-off-by: default avatarJames Jones <jajones@nvidia.com>
      Acked-by: default avatarBen Skeggs <bskeggs@redhat.com>
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      faa0fcf9
  3. 30 Jul, 2020 20 commits
  4. 29 Jul, 2020 5 commits
    • Robert Hancock's avatar
      PCI/ASPM: Disable ASPM on ASMedia ASM1083/1085 PCIe-to-PCI bridge · b361663c
      Robert Hancock authored
      Recently ASPM handling was changed to allow ASPM on PCIe-to-PCI/PCI-X
      bridges.  Unfortunately the ASMedia ASM1083/1085 PCIe to PCI bridge device
      doesn't seem to function properly with ASPM enabled.  On an Asus PRIME
      H270-PRO motherboard, it causes errors like these:
      
        pcieport 0000:00:1c.0: AER: PCIe Bus Error: severity=Corrected, type=Data Link Layer, (Transmitter ID)
        pcieport 0000:00:1c.0: AER:   device [8086:a292] error status/mask=00003000/00002000
        pcieport 0000:00:1c.0: AER:    [12] Timeout
        pcieport 0000:00:1c.0: AER: Corrected error received: 0000:00:1c.0
        pcieport 0000:00:1c.0: AER: can't find device of ID00e0
      
      In addition to flooding the kernel log, this also causes the machine to
      wake up immediately after suspend is initiated.
      
      The device advertises ASPM L0s and L1 support in the Link Capabilities
      register, but the ASMedia web page for ASM1083 [1] claims "No PCIe ASPM
      support".
      
      Windows 10 (build 2004) enables L0s, but it also logs correctable PCIe
      errors.
      
      Add a quirk to disable ASPM for this device.
      
      [1] https://www.asmedia.com.tw/eng/e_show_products.php?cate_index=169&item=114
      
      [bhelgaas: commit log]
      Fixes: 66ff14e5 ("PCI/ASPM: Allow ASPM on links to PCIe-to-PCI/PCI-X Bridges")
      Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=208667
      Link: https://lore.kernel.org/r/20200722021803.17958-1-hancockrwd@gmail.comSigned-off-by: default avatarRobert Hancock <hancockrwd@gmail.com>
      Signed-off-by: default avatarBjorn Helgaas <bhelgaas@google.com>
      b361663c
    • Linus Torvalds's avatar
      Merge tag 'audit-pr-20200729' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit · d3590ebf
      Linus Torvalds authored
      Pull audit fixes from Paul Moore:
       "One small audit fix that you can hopefully merge before v5.8 is
        released. Unfortunately it is a revert of a patch that went in during
        the v5.7 window and we just recently started to see some bug reports
        relating to that commit.
      
        We are working on a proper fix, but I'm not yet clear on when that
        will be ready and we need to fix the v5.7 kernels anyway, so in the
        interest of time a revert seemed like the best solution right now"
      
      * tag 'audit-pr-20200729' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit:
        revert: 1320a405 ("audit: trigger accompanying records when no rules present")
      d3590ebf
    • Linus Torvalds's avatar
      Merge tag '9p-for-5.8-2' of git://github.com/martinetd/linux into master · 21391520
      Linus Torvalds authored
      Pull 9p fixes from Dominique Martinet:
       "A couple of syzcaller fixes for 5.8
      
        The first one in particular has been quite noisy ("broke" in -rc5) so
        this would be worth landing even this late even if users likely won't
        see a difference"
      
      * tag '9p-for-5.8-2' of git://github.com/martinetd/linux:
        9p/trans_fd: Fix concurrency del of req_list in p9_fd_cancelled/p9_read_work
        net/9p: validate fds in p9_fd_open
      21391520
    • Mike Marciniszyn's avatar
      IB/rdmavt: Fix RQ counting issues causing use of an invalid RWQE · 54a485e9
      Mike Marciniszyn authored
      The lookaside count is improperly initialized to the size of the
      Receive Queue with the additional +1.  In the traces below, the
      RQ size is 384, so the count was set to 385.
      
      The lookaside count is then rarely refreshed.  Note the high and
      incorrect count in the trace below:
      
      rvt_get_rwqe: [hfi1_0] wqe ffffc900078e9008 wr_id 55c7206d75a0 qpn c
      	qpt 2 pid 3018 num_sge 1 head 1 tail 0, count 385
      rvt_get_rwqe: (hfi1_rc_rcv+0x4eb/0x1480 [hfi1] <- rvt_get_rwqe) ret=0x1
      
      The head,tail indicate there is only one RWQE posted although the count
      says 385 and we correctly return the element 0.
      
      The next call to rvt_get_rwqe with the decremented count:
      
      rvt_get_rwqe: [hfi1_0] wqe ffffc900078e9058 wr_id 0 qpn c
      	qpt 2 pid 3018 num_sge 0 head 1 tail 1, count 384
      rvt_get_rwqe: (hfi1_rc_rcv+0x4eb/0x1480 [hfi1] <- rvt_get_rwqe) ret=0x1
      
      Note that the RQ is empty (head == tail) yet we return the RWQE at tail 1,
      which is not valid because of the bogus high count.
      
      Best case, the RWQE has never been posted and the rc logic sees an RWQE
      that is too small (all zeros) and puts the QP into an error state.
      
      In the worst case, a server slow at posting receive buffers might fool
      rvt_get_rwqe() into fetching an old RWQE and corrupt memory.
      
      Fix by deleting the faulty initialization code and creating an
      inline to fetch the posted count and convert all callers to use
      new inline.
      
      Fixes: f592ae3c ("IB/rdmavt: Fracture single lock used for posting and processing RWQEs")
      Link: https://lore.kernel.org/r/20200728183848.22226.29132.stgit@awfm-01.aw.intel.comReported-by: default avatarZhaojuan Guo <zguo@redhat.com>
      Cc: <stable@vger.kernel.org> # 5.4.x
      Reviewed-by: default avatarKaike Wan <kaike.wan@intel.com>
      Signed-off-by: default avatarMike Marciniszyn <mike.marciniszyn@intel.com>
      Tested-by: default avatarHonggang Li <honli@redhat.com>
      Signed-off-by: default avatarJason Gunthorpe <jgg@nvidia.com>
      54a485e9
    • Linus Torvalds's avatar
      Merge tag 'drm-fixes-2020-07-29' of git://anongit.freedesktop.org/drm/drm into master · c2f3850d
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "The nouveau fixes missed the last pull by a few hours, and we had a
        few arm driver/panel/bridge fixes come in.
      
        This is possibly a bit more than I'm comfortable sending at this
        stage, but I've looked at each patch, the core + nouveau patches fix
        regressions, and the arm related ones are all around screens turning
        on and working, and are mostly trivial patches, the line count is
        mostly in comments.
      
        core:
         - fix possible use-after-free
      
        drm_fb_helper:
         - regression fix to use memcpy_io on bochs' sparc64
      
        nouveau:
         - format modifiers fixes
         - HDA regression fix
         - turing modesetting race fix
      
        of:
         - fix a double free
      
        dbi:
         - fix SPI Type 1 transfer
      
        mcde:
         - fix screen stability crash
      
        panel:
         - panel: fix display noise on auo,kd101n80-45na
         - panel: delay HPD checks for boe_nv133fhm_n61
      
        bridge:
         - bridge: drop connector check in nwl-dsi bridge
         - bridge: set proper bridge type for adv7511"
      
      * tag 'drm-fixes-2020-07-29' of git://anongit.freedesktop.org/drm/drm:
        drm: hold gem reference until object is no longer accessed
        drm/dbi: Fix SPI Type 1 (9-bit) transfer
        drm/drm_fb_helper: fix fbdev with sparc64
        drm/mcde: Fix stability issue
        drm/bridge: nwl-dsi: Drop DRM_BRIDGE_ATTACH_NO_CONNECTOR check.
        drm/panel: Fix auo, kd101n80-45na horizontal noise on edges of panel
        drm: panel: simple: Delay HPD checking on boe_nv133fhm_n61 for 15 ms
        drm/bridge/adv7511: set the bridge type properly
        drm: of: Fix double-free bug
        drm/nouveau/fbcon: zero-initialise the mode_cmd2 structure
        drm/nouveau/fbcon: fix module unload when fbcon init has failed for some reason
        drm/nouveau/kms/tu102: wait for core update to complete when assigning windows
        drm/nouveau/kms/gf100: use correct format modifiers
        drm/nouveau/disp/gm200-: fix regression from HDA SOR selection changes
      c2f3850d