Commit graph

1015345 commits

Author SHA1 Message Date
Tao Chiu
d4060d2be1 nvme-pci: fix controller reset hang when racing with nvme_timeout
reset_work() in nvme-pci may hang forever in the following scenario:
1) A reset caused by a command timeout occurs due to a controller being
   temporarily irresponsive.
2) nvme_reset_work() restarts admin queue at nvme_alloc_admin_tags(). At
   the same time, a user-submitted admin command is queued and waiting
   for completion. Then, reset_work() changes its state to CONNECTING,
   and submits an identify command.
3) However, the controller does still not respond to any command,
   causing a timeout being fired at the user-submitted command.
   Unfortunately, nvme_timeout() does not see the completion on cq, and
   any timeout that takes place under CONNECTING state causes a
   controller shutdown.
4) Normally, the identify command in reset_work() would be canceled with
   SC_HOST_ABORTED by nvme_dev_disable(), then reset_work can tear down
   the controller accordingly. But the controller happens to return
   online and respond the identify command before nvme_dev_disable()
   should have been reaped it off.
5) reset_work() continues to setup_io_queues() as it observes no error
   in init_identify(). However, the admin queue has already been
   quiesced in dev_disable(). Thus, any following commands would be
   blocked forever in blk_execute_rq().

This can be fixed by restricting usercmd commands when controller is not
in a LIVE state in nvme_queue_rq(), as what has been done previously in
fabrics.

```
nvme_reset_work():                     |
    nvme_alloc_admin_tags()            |
                                       | nvme_submit_user_cmd():
    nvme_init_identify():              |     ...
        __nvme_submit_sync_cmd():      |
            ...                        |     ...
---------------------------------------> nvme_timeout():
(Controller starts reponding commands) |     nvme_dev_disable(, true):
    nvme_setup_io_queues():            |
        __nvme_submit_sync_cmd():      |
            (hung in blk_execute_rq    |
             since run_hw_queue sees   |
             queue quiesced)           |

```

Signed-off-by: Tao Chiu <taochiu@synology.com>
Signed-off-by: Cody Wong <codywong@synology.com>
Reviewed-by: Leon Chien <leonchien@synology.com>
Reviewed-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Christoph Hellwig <hch@lst.de>
2021-05-04 09:35:50 +02:00
Tao Chiu
a97157440e nvme: move the fabrics queue ready check routines to core
queue_rq() in pci only checks if the dispatched queue (nvmeq) is ready,
e.g. not being suspended. Since nvme_alloc_admin_tags() in reset flow
restarts the admin queue, users are able to submit admin commands to a
controller before reset_work() completes. Commands submitted under this
condition may interfere with commands that performs identify, IO queue
setup in reset_work(), and may result in a hang described in the
following patch.

As seen in the fabrics, user commands are prevented from being executed
under inproper controller states. We may reuse this logic to maintain a
clear admin queue during reset_work().

Signed-off-by: Tao Chiu <taochiu@synology.com>
Signed-off-by: Cody Wong <codywong@synology.com>
Reviewed-by: Leon Chien <leonchien@synology.com>
Reviewed-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Christoph Hellwig <hch@lst.de>
2021-05-04 09:35:49 +02:00
Kanchan Joshi
51ad06cd69 nvme: avoid memset for passthrough requests
nvme_clear_nvme_request() clears the nvme_command, which is unncessary
for passthrough requests as nvme_command is overwritten immediately.
Move clearing part from this helper to the caller, so that double memset
for passthrough requests is avoided.

Signed-off-by: Kanchan Joshi <joshi.k@samsung.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
2021-05-04 09:35:49 +02:00
Kanchan Joshi
4c74d1f803 nvme: add nvme_get_ns helper
Add a helper to avoid opencoding ns->kref increment.
Decrement is already done via nvme_put_ns helper.

Signed-off-by: Kanchan Joshi <joshi.k@samsung.com>
Reviewed-by: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
2021-05-04 09:35:48 +02:00
Minwoo Im
48145b6256 nvme: fix controller ioctl through ns_head
In multipath case, we should consider namespace attachment with
controllers in a subsystem when we find out the live controller for the
namespace.  This patch manually reverted the commit 3557a44097
("nvme: don't bother to look up a namespace for controller ioctls") with
few more updates to nvme_ns_head_chr_ioctl which has been newly updated.

Fixes: 3557a44097 ("nvme: don't bother to look up a namespace for
controller ioctls")
Cc: Christoph Hellwig <hch@lst.de>
Signed-off-by: Minwoo Im <minwoo.im.dev@gmail.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
2021-05-04 09:35:47 +02:00
David S. Miller
1682d8df20 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf
Daniel Borkmann says:

====================
pull-request: bpf 2021-05-04

The following pull-request contains BPF updates for your *net* tree.

We've added 5 non-merge commits during the last 4 day(s) which contain
a total of 6 files changed, 52 insertions(+), 30 deletions(-).

The main changes are:

1) Fix libbpf overflow when processing BPF ring buffer in case of extreme
   application behavior, from Brendan Jackman.

2) Fix potential data leakage of uninitialized BPF stack under speculative
   execution, from Daniel Borkmann.

3) Fix off-by-one when validating xsk pool chunks, from Xuan Zhuo.

4) Fix snprintf BPF selftest with a pid filter to avoid racing its output
   test buffer, from Florent Revest.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2021-05-03 18:40:17 -07:00
Nicholas Piggin
8abddd968a powerpc/64s/radix: Enable huge vmalloc mappings
This reduces TLB misses by nearly 30x on a `git diff` workload on a
2-node POWER9 (59,800 -> 2,100) and reduces CPU cycles by 0.54%, due
to vfs hashes being allocated with 2MB pages.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Acked-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20210503091755.613393-1-npiggin@gmail.com
2021-05-04 11:06:45 +10:00
Geert Uytterhoeven
970aa72c4d dt-bindings: display: renesas,du: Add missing power-domains property
"make dtbs_check" complains:

    arch/arm/boot/dts/r8a7779-marzen.dt.yaml: display@fff80000: 'power-domains' does not match any of the regexes: 'pinctrl-[0-9]+'
    arch/arm64/boot/dts/renesas/r8a77970-v3msk.dt.yaml: display@feb00000: 'power-domains' does not match any of the regexes: 'pinctrl-[0-9]+'
    arch/arm64/boot/dts/renesas/r8a77970-eagle.dt.yaml: display@feb00000: 'power-domains' does not match any of the regexes: 'pinctrl-[0-9]+'
    arch/arm64/boot/dts/renesas/r8a77980-condor.dt.yaml: display@feb00000: 'power-domains' does not match any of the regexes: 'pinctrl-[0-9]+'
    arch/arm64/boot/dts/renesas/r8a77980-v3hsk.dt.yaml: display@feb00000: 'power-domains' does not match any of the regexes: 'pinctrl-[0-9]+'

Fix this by documenting the power-domains property.

Fixes: 99d66127fa ("dt-bindings: display: renesas,du: Convert binding to YAML")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Link: https://lore.kernel.org/r/600d42256515f180bc84b72e8bdb5c5d9126ab62.1619700459.git.geert+renesas@glider.be
Signed-off-by: Rob Herring <robh@kernel.org>
2021-05-03 18:55:32 -05:00
Bhaskar Chowdhury
7fc4607899 Enlisted oprofile version line removed
Enlisted oprofile version line removed.

Signed-off-by: Bhaskar Chowdhury <unixbhaskar@gmail.com>
Link: https://lore.kernel.org/r/35c4436f0f1b3072d3016148ce1461905b6f782b.1619181632.git.unixbhaskar@gmail.com
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
2021-05-03 17:23:06 -06:00
Bhaskar Chowdhury
8e9fa2f211 oprofiled version output line removed from the list
Oprofiled version output line removed from the list.

Signed-off-by: Bhaskar Chowdhury <unixbhaskar@gmail.com>
Link: https://lore.kernel.org/r/8d1928ff2fea29d67143d235839a5e845e4402c9.1619181632.git.unixbhaskar@gmail.com
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
2021-05-03 17:23:06 -06:00
Bhaskar Chowdhury
f5169f713e Removed the oprofiled version option
Removed the oprofiled version option

Signed-off-by: Bhaskar Chowdhury <unixbhaskar@gmail.com>
Link: https://lore.kernel.org/r/c98fa38b74bdd8ab16d35862895dac5f5a535f94.1619181632.git.unixbhaskar@gmail.com
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
2021-05-03 17:23:06 -06:00
Thorsten Leemhuis
0043f0b27a docs: reporting-issues.rst: CC subsystem and maintainers on regressions
When reporting a regression, users ideally should CC the subsystem and
its maintainers, as that will ensure they get aware of the regression
quickly. And if the culprit is known, they should also CC everyone who
signed if off; the text mentioned the latter in once place already, but
forgot to do so in two other areas where it's relevant.

While fixing this also remind readers to check the mailing list archives
for issues that need to be reported to a bug tracker, as someone might
have reported it by mail only.

All of this got triggered by a recent report where these changes would
have made a difference.

Signed-off-by: Thorsten Leemhuis <linux@leemhuis.info>
Link: https://lore.kernel.org/lkml/dff6badf-58f5-98c8-871c-94d901ac6919@leemhuis.info/
Link: https://lore.kernel.org/lkml/CAJZ5v0hX2StQVttAciHYH-urUH+Hi92z9z2ZbcNgQPt0E2Jpwg@mail.gmail.com/
Link: https://lore.kernel.org/r/dd13f10c30e79e550215e53a8103406daec4e593.1618482489.git.linux@leemhuis.info
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
2021-05-03 17:23:06 -06:00
Anatoly Pugachev
2fa4928aed docs: correct URL to bios and kernel developer's guide
correct URL to bios and kernel developer's guide on amd.com site

Signed-off-by: Anatoly Pugachev <matorola@gmail.com>
Link: https://lore.kernel.org/r/20210428104851.GA10572@u164.east.ru
[jc: fixed resulting sphinx warning]
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
2021-05-03 17:22:44 -06:00
Steven Rostedt (VMware)
c7ceee6958 ktest: Add KTEST section to MAINTAINERS file
As I wanted to add John Hawley as a co-maintainer for ktest, I found that
there never was a KTEST section in the MAINTAINERS file. Add one!

Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
2021-05-03 18:57:03 -04:00
John 'Warthog9' Hawley (VMware)
6a0f365295 ktest: Re-arrange the code blocks for better discoverability
Perl, as with most scripting languages, is fairly flexible in how /
where you can define things, and it will (for the most part) do what you
would expect it to do.  This however can lead to situations, like with
ktest, where things get muddled over time.

This pushes the variable definitions back up to the top, followed by
functions, with the main script executables down at the bottom, INSTEAD
of being somewhat mish-mashed together in certain places.  This mostly
has the advantage of making it more obvious where things are initially
defined, what functions are there, and ACTUALLY where the main script
starts executing, and should make this a little more approachable.

Signed-off-by: John 'Warthog9' Hawley (VMware) <warthog9@eaglescrag.net>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
2021-05-03 18:57:03 -04:00
John 'Warthog9' Hawley (VMware)
c043ccbfc6 ktest: Further consistency cleanups
This cleans up some additional whitespace pieces that to be more
consistent, as well as moving a curly brace around, and some 'or'
statements to match the rest of the file (usually or goes at the
end of the line vs. at the beginning)

Signed-off-by: John 'Warthog9' Hawley (VMware) <warthog9@eaglescrag.net>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
2021-05-03 18:57:03 -04:00
John 'Warthog9' Hawley (VMware)
12d4cddda2 ktest: Fixing indentation to match expected pattern
This is a followup to "ktest: Adding editor hints to improve
consistency" to actually adjust the existing indentation to match
the, now, expected pattern (first column 4 spaces, 2nd tab, 3rd
tab + 4 spaces, etc).  This should, at least help, keep things
consistent going forward now.

Signed-off-by: John 'Warthog9' Hawley (VMware) <warthog9@eaglescrag.net>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
2021-05-03 18:57:03 -04:00
John 'Warthog9' Hawley (VMware)
becdd17b5a ktest: Adding editor hints to improve consistency
Emacs and Vi(m) have different styles of dealing with perl syntax
which can lead to slightly inconsistent indentation, and makes the
code slightly harder to read.  Emacs assumes a more perl recommended
standard of 4 spaces (1 column) or tab (two column) indentation.

Vi(m) tends to favor just normal spaces or tabs depending on what
was being used.

This gives the basic hinting to Emacs and Vim to do what is
expected to be basically consistent.

Emacs:
	- Explicitly flip into perl mode, cperl would require
	  more adjustments

Vi(m):
	- Set softtabs=4 which will flip it over to doing
	  indentation the way you would expect from Emacs

Signed-off-by: John 'Warthog9' Hawley (VMware) <warthog9@eaglescrag.net>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
2021-05-03 18:57:03 -04:00
John 'Warthog9' Hawley (VMware)
2676eb4bfc ktest: Add example config for using VMware VMs
This duplicates the KVM/Qemu config with specific notes for how
to use it with VMware VMs on Workstation, Player, or Fusion.
The main thing to be aware of is how the serial port is exposed
which is a unix pipe, and will need something like ncat to get
into ktest's monitoring

Signed-off-by: John 'Warthog9' Hawley (VMware) <warthog9@eaglescrag.net>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
2021-05-03 18:57:02 -04:00
John 'Warthog9' Hawley (VMware)
da2e56634b ktest: Minor cleanup with uninitialized variable $build_options
Signed-off-by: John 'Warthog9' Hawley (VMware) <warthog9@eaglescrag.net>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
2021-05-03 18:57:02 -04:00
Yanteng Si
0ca0d55526 docs/core-api: Consistent code style
all `example` in this file should be replaced with ``example``.

Signed-off-by: Yanteng Si <siyanteng@loongson.cn>
Acked-by: Matthias Maennich <maennich@google.com>
Link: https://lore.kernel.org/r/20210428100720.1076276-1-siyanteng@loongson.cn
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
2021-05-03 16:52:50 -06:00
Wu XiangCheng
bd8ede4847 docs/zh_CN: Adjust order and content of zh_CN/index.rst
Adjust order and content of zh_CN/index.rst to make it clear,
complete introductions and TODOLists.

Signed-off-by: Wu XiangCheng <bobwxc@email.cn>
Link: https://lore.kernel.org/r/20210430122234.GA655@bobwxc.top
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
2021-05-03 16:51:40 -06:00
Randy Dunlap
eef8abdaed Documentation: input: joydev file corrections
Fix typos, grammar, punctuation in
Documentation/input/joydev/*.rst files.

Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Link: https://lore.kernel.org/r/20210429063137.20232-1-rdunlap@infradead.org
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
2021-05-03 16:51:10 -06:00
Xuan Zhuo
ac31565c21 xsk: Fix for xp_aligned_validate_desc() when len == chunk_size
When desc->len is equal to chunk_size, it is legal. But when the
xp_aligned_validate_desc() got chunk_end from desc->addr + desc->len
pointing to the next chunk during the check, it caused the check to
fail.

This problem was first introduced in bbff2f321a ("xsk: new descriptor
addressing scheme"). Later in 2b43470add ("xsk: Introduce AF_XDP buffer
allocation API") this piece of code was moved into the new function called
xp_aligned_validate_desc(). This function was then moved into xsk_queue.h
via 26062b185e ("xsk: Explicitly inline functions and move definitions").

Fixes: bbff2f321a ("xsk: new descriptor addressing scheme")
Signed-off-by: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Magnus Karlsson <magnus.karlsson@intel.com>
Link: https://lore.kernel.org/bpf/20210428094424.54435-1-xuanzhuo@linux.alibaba.com
2021-05-04 00:28:06 +02:00
Florian Westphal
43016d02cf netfilter: arptables: use pernet ops struct during unregister
Like with iptables and ebtables, hook unregistration has to use the
pernet ops struct, not the template.

This triggered following splat:
  hook not found, pf 3 num 0
  WARNING: CPU: 0 PID: 224 at net/netfilter/core.c:480 __nf_unregister_net_hook+0x1eb/0x610 net/netfilter/core.c:480
[..]
 nf_unregister_net_hook net/netfilter/core.c:502 [inline]
 nf_unregister_net_hooks+0x117/0x160 net/netfilter/core.c:576
 arpt_unregister_table_pre_exit+0x67/0x80 net/ipv4/netfilter/arp_tables.c:1565

Fixes: f9006acc8d ("netfilter: arp_tables: pass table pointer via nf_hook_ops")
Reported-by: syzbot+dcccba8a1e41a38cb9df@syzkaller.appspotmail.com
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2021-05-03 23:04:01 +02:00
Pablo Neira Ayuso
c7d13358b6 netfilter: xt_SECMARK: add new revision to fix structure layout
This extension breaks when trying to delete rules, add a new revision to
fix this.

Fixes: 5e6874cdb8 ("[SECMARK]: Add xtables SECMARK target")
Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2021-05-03 23:02:44 +02:00
Linus Torvalds
5e321ded30 parisc architecture updates for kernel 5.13:
- switch to generic syscall header scripts
 - minor typo fix in setup.c
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYIAB0WIQS86RI+GtKfB8BJu973ErUQojoPXwUCYJBZdwAKCRD3ErUQojoP
 X42ZAP0RETPk+DcndaIUBZb/rFpAITRENq+Ix1UPzaKWUBuziwD/U/W+zT0NCz2v
 /7RO7ZmSR35HZjTVHaxJAmkLDmA8Egg=
 =W82a
 -----END PGP SIGNATURE-----

Merge tag 'for-5.13/parisc' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux

Pull parisc architecture updates from Helge Deller:

 - switch to generic syscall header scripts

 - minor typo fix in setup.c

* tag 'for-5.13/parisc' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux:
  parisc: Fix typo in setup.c
  parisc: syscalls: switch to generic syscallhdr.sh
  parisc: syscalls: switch to generic syscalltbl.sh
2021-05-03 13:47:17 -07:00
Daniele Palmas
bd1af6b5ff Documentation: ABI: sysfs-class-net-qmi: document pass-through file
Add documentation for /sys/class/net/<iface>/qmi/pass_through

Signed-off-by: Daniele Palmas <dnlplm@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2021-05-03 13:40:17 -07:00
Xie He
d362fd0be4 Revert "drivers/net/wan/hdlc_fr: Fix a double free in pvc_xmit"
This reverts commit 1b479fb801
("drivers/net/wan/hdlc_fr: Fix a double free in pvc_xmit").

1. This commit is incorrect. "__skb_pad" will NOT free the skb on
failure when its "free_on_error" parameter is "false".

2. This commit claims to fix my commit. But it didn't CC me??

Fixes: 1b479fb801 ("drivers/net/wan/hdlc_fr: Fix a double free in pvc_xmit")
Cc: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
Signed-off-by: Xie He <xie.he.0141@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2021-05-03 13:37:58 -07:00
David S. Miller
d89ecd154c Merge branch 'sctp-race-fix'
Xin Long says:

====================
sctp: fix the race condition in sctp_destroy_sock in a proper way

The original fix introduced a dead lock, and has to be removed in
Patch 1/2, and we will get a proper way to fix it in Patch 2/2.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2021-05-03 13:36:21 -07:00
Xin Long
34e5b01186 sctp: delay auto_asconf init until binding the first addr
As Or Cohen described:

  If sctp_destroy_sock is called without sock_net(sk)->sctp.addr_wq_lock
  held and sp->do_auto_asconf is true, then an element is removed
  from the auto_asconf_splist without any proper locking.

  This can happen in the following functions:
  1. In sctp_accept, if sctp_sock_migrate fails.
  2. In inet_create or inet6_create, if there is a bpf program
     attached to BPF_CGROUP_INET_SOCK_CREATE which denies
     creation of the sctp socket.

This patch is to fix it by moving the auto_asconf init out of
sctp_init_sock(), by which inet_create()/inet6_create() won't
need to operate it in sctp_destroy_sock() when calling
sk_common_release().

It also makes more sense to do auto_asconf init while binding the
first addr, as auto_asconf actually requires an ANY addr bind,
see it in sctp_addr_wq_timeout_handler().

This addresses CVE-2021-23133.

Fixes: 6102365876 ("bpf: Add new cgroup attach type to enable sock modifications")
Reported-by: Or Cohen <orcohen@paloaltonetworks.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2021-05-03 13:36:21 -07:00
Xin Long
01bfe5e8e4 Revert "net/sctp: fix race condition in sctp_destroy_sock"
This reverts commit b166a20b07.

This one has to be reverted as it introduced a dead lock, as
syzbot reported:

       CPU0                    CPU1
       ----                    ----
  lock(&net->sctp.addr_wq_lock);
                               lock(slock-AF_INET6);
                               lock(&net->sctp.addr_wq_lock);
  lock(slock-AF_INET6);

CPU0 is the thread of sctp_addr_wq_timeout_handler(), and CPU1
is that of sctp_close().

The original issue this commit fixed will be fixed in the next
patch.

Reported-by: syzbot+959223586843e69a2674@syzkaller.appspotmail.com
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2021-05-03 13:36:21 -07:00
Phillip Potter
2e9f60932a net: hsr: check skb can contain struct hsr_ethhdr in fill_frame_info
Check at start of fill_frame_info that the MAC header in the supplied
skb is large enough to fit a struct hsr_ethhdr, as otherwise this is
not a valid HSR frame. If it is too small, return an error which will
then cause the callers to clean up the skb. Fixes a KMSAN-found
uninit-value bug reported by syzbot at:
https://syzkaller.appspot.com/bug?id=f7e9b601f1414f814f7602a82b6619a8d80bce3f

Reported-by: syzbot+e267bed19bfc5478fb33@syzkaller.appspotmail.com
Signed-off-by: Phillip Potter <phil@philpotter.co.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
2021-05-03 13:33:54 -07:00
Xin Long
f282df0391 sctp: fix a SCTP_MIB_CURRESTAB leak in sctp_sf_do_dupcook_b
Normally SCTP_MIB_CURRESTAB is always incremented once asoc enter into
ESTABLISHED from the state < ESTABLISHED and decremented when the asoc
is being deleted.

However, in sctp_sf_do_dupcook_b(), the asoc's state can be changed to
ESTABLISHED from the state >= ESTABLISHED where it shouldn't increment
SCTP_MIB_CURRESTAB. Otherwise, one asoc may increment MIB_CURRESTAB
multiple times but only decrement once at the end.

I was able to reproduce it by using scapy to do the 4-way shakehands,
after that I replayed the COOKIE-ECHO chunk with 'peer_vtag' field
changed to different values, and SCTP_MIB_CURRESTAB was incremented
multiple times and never went back to 0 even when the asoc was freed.

This patch is to fix it by only incrementing SCTP_MIB_CURRESTAB when
the state < ESTABLISHED in sctp_sf_do_dupcook_b().

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Reported-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2021-05-03 13:32:12 -07:00
David S. Miller
a52445ae5a Merge branch 'sctp-bad-revert'
Xin Long says:

====================
sctp: fix the incorrect revert

commit 35b4f24415 ("sctp: do asoc update earlier in
sctp_sf_do_dupcook_a") only keeps the SHUTDOWN and
COOKIE-ACK with the same asoc, not transport.

So instead of revert commit 145cb2f717 ("sctp: Fix bundling
of SHUTDOWN with COOKIE-ACK"), we should revert 12dfd78e3a
("sctp: Fix SHUTDOWN CTSN Ack in the peer restart case").
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2021-05-03 13:30:04 -07:00
Xin Long
7aa4e54739 Revert "sctp: Fix SHUTDOWN CTSN Ack in the peer restart case"
This reverts commit 12dfd78e3a.

This can be reverted as shutdown and cookie_ack chunk are using the
same asoc since commit 35b4f24415 ("sctp: do asoc update earlier
in sctp_sf_do_dupcook_a").

Reported-by: Jere Leppänen <jere.leppanen@nokia.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2021-05-03 13:30:04 -07:00
Xin Long
22008f560b Revert "Revert "sctp: Fix bundling of SHUTDOWN with COOKIE-ACK""
This reverts commit 7e9269a5ac.

As Jere notice, commit 35b4f24415 ("sctp: do asoc update earlier
in sctp_sf_do_dupcook_a") only keeps the SHUTDOWN and COOKIE-ACK
with the same asoc, not transport. So we have to bring this patch
back.

Reported-by: Jere Leppänen <jere.leppanen@nokia.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2021-05-03 13:30:04 -07:00
Lv Yunlong
643001b47a ethernet:enic: Fix a use after free bug in enic_hard_start_xmit
In enic_hard_start_xmit, it calls enic_queue_wq_skb(). Inside
enic_queue_wq_skb, if some error happens, the skb will be freed
by dev_kfree_skb(skb). But the freed skb is still used in
skb_tx_timestamp(skb).

My patch makes enic_queue_wq_skb() return error and goto spin_unlock()
incase of error. The solution is provided by Govind.
See https://lkml.org/lkml/2021/4/30/961.

Fixes: fb7516d424 ("enic: add sw timestamp support")
Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
Acked-by: Govindarajulu Varadarajan <gvaradar@cisco.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2021-05-03 13:23:00 -07:00
Geert Uytterhoeven
7935bb56e2 dt-bindings: media: renesas,vin: Make resets optional on R-Car Gen1
The "resets" property is not present on R-Car Gen1 SoCs.
Supporting it would require migrating from renesas,cpg-clocks to
renesas,cpg-mssr.

Fixes: 905fc6b1bf ("dt-bindings: rcar-vin: Convert bindings to json-schema")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
Link: https://lore.kernel.org/r/217c8197efaee7d803b22d433abb0ea8e33b84c6.1619700314.git.geert+renesas@glider.be
Signed-off-by: Rob Herring <robh@kernel.org>
2021-05-03 15:02:43 -05:00
Geert Uytterhoeven
62b3b3660a dt-bindings: PCI: rcar-pci-host: Document missing R-Car H1 support
scripts/checkpatch.pl -f drivers/pci/controller/pcie-rcar-host.c:

    WARNING: DT compatible string "renesas,pcie-r8a7779" appears un-documented -- check ./Documentation/devicetree/bindings/
    #853: FILE: drivers/pci/controller/pcie-rcar-host.c:853:
    +	{ .compatible = "renesas,pcie-r8a7779",

Re-add the compatible value for R-Car H1, which was lost during the
json-schema conversion.  Make the "resets" property optional on R-Car
H1, as it is not present yet on R-Car Gen1 SoCs.

Fixes: 0d69ce3c2c ("dt-bindings: PCI: rcar-pci-host: Convert bindings to json-schema")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://lore.kernel.org/r/fb0bb969cd0e5872ab5eac70e070242c0d8a5b81.1619700202.git.geert+renesas@glider.be
Signed-off-by: Rob Herring <robh@kernel.org>
2021-05-03 15:00:59 -05:00
Linus Torvalds
cda689f870 arch/csky patches for 5.13-rc1
Just 1 feature and 3 fixups.
 -----BEGIN PGP SIGNATURE-----
 
 iQJGBAABCgAwFiEE2KAv+isbWR/viAKHAXH1GYaIxXsFAmCQHXUSHGd1b3JlbkBr
 ZXJuZWwub3JnAAoJEAFx9RmGiMV7QbEP/A5noQq5vO5DcIywFpyjw1Ca+kS8WVKq
 67cQMn+vlaD4RAllWkjPnatg0OkLqvpsp8pJytM4RmmCOuoaMtKQGXiCU01u1t3V
 3CZifEBTg0ZzlliSjsEzaA8RvleLURlkHEcswVILklMESajvqkpHsnTSbkoctrrr
 cD1A1Dwyas5oSrj5Qfdsz52u0jmeY+gmtK8NMQr3rbKBAHdu+D1NpeADnrD1uWs6
 Fcw7qZZ5AmOffQ73JgqPiJ0YWpiP6GBn7pTst8PHrBrG8CR3XYUV+OdbPkiTvznb
 GNYUJ7tum9b7JNEHW7w2EQO0Pz96bbSczddZPrNV06HtC67hKqjsPS2WTDCGF/f7
 wzSgaUyKoHA/F1FVbPJbP7NeGDsqAfwHdnkgR86MKYfP4jE6+zECFvbfxKrmw8Ob
 5Owp9TF3vS7hO5wJA550e79xKdw2fVuvJ5k+ZoKpgQYifRexxIRfXNLANxfCv1sx
 6hYt/NZWsRJSGcZ4cr1BQvp+pQq/zjsP9Z4x+2aKORG9tz2uSaf2T7XkQDkoJxln
 SxvDDYWDRi2khzZ4IGTiavTNC4C3WsBKvfKBYCGYKG1AH8uQQt+cK1+wBQaERmgG
 9AK4mkOWtlw6GPl+rKzum/15toCFZywU0idx19t/2pxWxTTmzAly/Z4xCQant6YY
 PZGmQYwAKKVV
 =jXN4
 -----END PGP SIGNATURE-----

Merge tag 'csky-for-linus-5.13-rc1' of git://github.com/c-sky/csky-linux

Pull arch/csky updates from Guo Ren:
 "Just cleanups"

* tag 'csky-for-linus-5.13-rc1' of git://github.com/c-sky/csky-linux:
  csky: uaccess.h: Coding convention with asm generic
  csky: fix syscache.c fallthrough warning
  csky: Fixup typos
  csky: Remove duplicate include in arch/csky/kernel/entry.S
2021-05-03 12:58:31 -07:00
Linus Torvalds
d835ff6c96 Nothing too exciting here, just some fixes.
This modifies MAINTAINER's file to remove Dan Murphy's email that is
 bouncing (and does it globally). I hope that does not conflict too badly.
 -----BEGIN PGP SIGNATURE-----
 
 iF0EABECAB0WIQRPfPO7r0eAhk010v0w5/Bqldv68gUCYI8hzwAKCRAw5/Bqldv6
 8ou+AKCujY+zj+9DYHXzdHgbS4RK9Y0gkgCgw/aMAou9/JopBqFNxAGeLkntR+U=
 =BM1B
 -----END PGP SIGNATURE-----

Merge tag 'leds-5.13-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/pavel/linux-leds

Pull LED updates from Pavel Machek:
 "Nothing too exciting here, just some fixes"

* tag 'leds-5.13-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/pavel/linux-leds:
  leds: pca9532: Assign gpio base dynamically
  leds: trigger: pattern: Switch to using the new API kobj_to_dev()
  leds: LEDS_BLINK_LGM should depend on X86
  leds: lgm: Fix spelling mistake "prepate" -> "prepare"
  MAINTAINERS: Remove Dan Murphy's bouncing email
  leds-lm3642: convert comma to semicolon
  leds: rt4505: Add support for Richtek RT4505 flash LED controller
  leds: rt4505: Add DT binding document for Richtek RT4505
  leds: Kconfig: LEDS_CLASS is usually selected.
  leds: lgm: Improve Kconfig help
  leds: lgm: fix gpiolib dependency
2021-05-03 12:23:03 -07:00
Linus Torvalds
a7efd197bc RTC for 5.13
Subsystem:
  - UIE emulation has been reworked to avoid calling drivers callbacks when it is
    known it will not work
 
 Drivers:
  - ab-eoz9: add alarm support
  - pcf8523: add alarm support
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEycoQi/giopmpPgB12wIijOdRNOUFAmCPH5wACgkQ2wIijOdR
 NOWAww//VddoUhaGKYO7AdJ94XHgAU+LDncp30QB7KRJaBY8Cj6J/SqFi30bC93b
 6Zp7Tbs2YFOCOTr3UPNvh9MxiwIWPLDXN6o8QzwoNpM8LfuODGaUe3QIu014ij96
 hBQK9vDb6RE7db5Slr1w1kpdvC22esTwPrsT4+vbMkCyvoC3IZZork5xlrG+bP/A
 0FCyCL6JW3pPfVptwOZ0lj5KbWU4SNdTztKtkm0T6tzCTSQWMrBSidENdWerPj68
 TP1vtCewC7rl5JZWvdL9ZBATcIsPcysav00dUY21LJKcXVYUNmhSjA1xvKj2mBxC
 liQCLR1ejWP72ED9MISzgu17LNcBTM6RMDlprRF02KUL3kOvi4h9iTEQt3ROWd9V
 yh7qjIfNrxPCXNmZkNjeQcOSF2T+uEv/thPi0DkVXgwfIxCgD6Uwx+NqiucUvnfl
 5bzdiDvaMTvGu23glGnEI80H1Y0Q8CoU0uKXPFzLCaH7cLZZNxk0SfXvD7/hFdR8
 zVh64Zyheszo91EcVVtHEQ4guiGYnvr+/LAU3/VFmdFT+ZSVbmwLn65bBQUdfLzT
 8l/18xMplYZtlBvhwu1KyHTWLeJGS39s7oYnbtyIGqKjknjIj+6hasuvcJWLd5Vi
 8Xubu8EU2Qf0lcDl22LEI0Ijpm4IZO7CJ36YakkilLjad12jAps=
 =twkQ
 -----END PGP SIGNATURE-----

Merge tag 'rtc-5.13' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux

Pull RTC updates from Alexandre Belloni:
 "Mostly small fixes and two drivers gaining alarm support. Summary:

  Subsystem:

    - UIE emulation has been reworked to avoid calling driver callbacks
      when it is known it will not work

  Drivers:

   - ab-eoz9: add alarm support

   - pcf8523: add alarm support"

* tag 'rtc-5.13' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux: (27 commits)
  rtc: sysfs: check features instead of ops
  rtc: omap: use rtc_write to access OMAP_RTC_OSC_REG
  rtc: s5m: Remove reference to parent's device pdata
  rtc: ds1307: Fix wday settings for rx8130
  rtc: pcf8523: report oscillator failures
  rtc: pcf8523: add alarm support
  rtc: pcf8523: remove useless define
  rtc: rtc_update_irq_enable: rework UIE emulation
  rtc: ds1307: remove flags
  rtc: ds1307: replace HAS_ALARM by RTC_FEATURE_ALARM
  rtc: imx-sc: remove .read_alarm
  rtc: ds1511: remove unused function
  rtc: fsl-ftm-alarm: add MODULE_TABLE()
  rtc: rtc-spear: replace spin_lock_irqsave by spin_lock in hard IRQ
  dt-bindings: rtc: qcom-pm8xxx-rtc: Add qcom pm8xxx rtc bindings
  rtc: pm8xxx: Add RTC support for PMIC PMK8350
  rtc: ab-eoz9: make use of RTC_FEATURE_ALARM
  rtc: ab-eoz9: add alarm support
  rtc: ab-eoz9: set regmap max_register
  rtc: pcf85063: fallback to parent of_node
  ...
2021-05-03 12:15:21 -07:00
Jiapeng Chong
5cd1a85a6c of: overlay: Remove redundant assignment to ret
Variable ret is set to zero but this value is never read as it is
overwritten with a new value later on, hence it is a redundant
assignment and can be removed.

Cleans up the following clang-analyzer warning:

drivers/of/overlay.c:1197:2: warning: Value stored to 'ret' is never
read [clang-analyzer-deadcode.DeadStores].

drivers/of/overlay.c:1026:2: warning: Value stored to 'ret' is never
read [clang-analyzer-deadcode.DeadStores].

Reported-by: Abaci Robot <abaci@linux.alibaba.com>
Signed-off-by: Jiapeng Chong <jiapeng.chong@linux.alibaba.com>
Link: https://lore.kernel.org/r/1619347258-55002-1-git-send-email-jiapeng.chong@linux.alibaba.com
Signed-off-by: Rob Herring <robh@kernel.org>
2021-05-03 13:57:56 -05:00
Linus Torvalds
9b1f61d5d7 tracing updates for 5.13
New feature:
 
  The "func-no-repeats" option in tracefs/options directory. When set
  the function tracer will detect if the current function being traced
  is the same as the previous one, and instead of recording it, it will
  keep track of the number of times that the function is repeated in a row.
  And when another function is recorded, it will write a new event that
  shows the function that repeated, the number of times it repeated and
  the time stamp of when the last repeated function occurred.
 
 Enhancements:
 
  In order to implement the above "func-no-repeats" option, the ring
  buffer timestamp can now give the accurate timestamp of the event
  as it is being recorded, instead of having to record an absolute
  timestamp for all events. This helps the histogram code which no longer
  needs to waste ring buffer space.
 
  New validation logic to make sure all trace events that access
  dereferenced pointers do so in a safe way, and will warn otherwise.
 
 Fixes:
 
  No longer limit the PIDs of tasks that are recorded for "saved_cmdlines"
  to PID_MAX_DEFAULT (32768), as systemd now allows for a much larger
  range. This caused the mapping of PIDs to the task names to be dropped
  for all tasks with a PID greater than 32768.
 
  Change trace_clock_global() to never block. This caused a deadlock.
 
 Clean ups:
 
  Typos, prototype fixes, and removing of duplicate or unused code.
 
  Better management of ftrace_page allocations.
 -----BEGIN PGP SIGNATURE-----
 
 iIoEABYIADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCYI/1vBQccm9zdGVkdEBn
 b29kbWlzLm9yZwAKCRAp5XQQmuv6qiL0AP9EemIC5TDh2oihqLRNeUjdTu0ryEoM
 HRFqxozSF985twD/bfkt86KQC8rLHwxTbxQZ863bmdaC6cMGFhWiF+H/MAs=
 =psYt
 -----END PGP SIGNATURE-----

Merge tag 'trace-v5.13' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace

Pull tracing updates from Steven Rostedt:
 "New feature:

   - A new "func-no-repeats" option in tracefs/options directory.

     When set the function tracer will detect if the current function
     being traced is the same as the previous one, and instead of
     recording it, it will keep track of the number of times that the
     function is repeated in a row. And when another function is
     recorded, it will write a new event that shows the function that
     repeated, the number of times it repeated and the time stamp of
     when the last repeated function occurred.

  Enhancements:

   - In order to implement the above "func-no-repeats" option, the ring
     buffer timestamp can now give the accurate timestamp of the event
     as it is being recorded, instead of having to record an absolute
     timestamp for all events. This helps the histogram code which no
     longer needs to waste ring buffer space.

   - New validation logic to make sure all trace events that access
     dereferenced pointers do so in a safe way, and will warn otherwise.

  Fixes:

   - No longer limit the PIDs of tasks that are recorded for
     "saved_cmdlines" to PID_MAX_DEFAULT (32768), as systemd now allows
     for a much larger range. This caused the mapping of PIDs to the
     task names to be dropped for all tasks with a PID greater than
     32768.

   - Change trace_clock_global() to never block. This caused a deadlock.

  Clean ups:

   - Typos, prototype fixes, and removing of duplicate or unused code.

   - Better management of ftrace_page allocations"

* tag 'trace-v5.13' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: (32 commits)
  tracing: Restructure trace_clock_global() to never block
  tracing: Map all PIDs to command lines
  ftrace: Reuse the output of the function tracer for func_repeats
  tracing: Add "func_no_repeats" option for function tracing
  tracing: Unify the logic for function tracing options
  tracing: Add method for recording "func_repeats" events
  tracing: Add "last_func_repeats" to struct trace_array
  tracing: Define new ftrace event "func_repeats"
  tracing: Define static void trace_print_time()
  ftrace: Simplify the calculation of page number for ftrace_page->records some more
  ftrace: Store the order of pages allocated in ftrace_page
  tracing: Remove unused argument from "ring_buffer_time_stamp()
  tracing: Remove duplicate struct declaration in trace_events.h
  tracing: Update create_system_filter() kernel-doc comment
  tracing: A minor cleanup for create_system_filter()
  kernel: trace: Mundane typo fixes in the file trace_events_filter.c
  tracing: Fix various typos in comments
  scripts/recordmcount.pl: Make vim and emacs indent the same
  scripts/recordmcount.pl: Make indent spacing consistent
  tracing: Add a verifier to check string pointers for trace events
  ...
2021-05-03 11:19:54 -07:00
Jim Quinlan
bb610757fc PCI: brcmstb: Use reset/rearm instead of deassert/assert
The Broadcom STB PCIe RC uses a reset control "rescal" for certain chips.
The "rescal" implements a "pulse reset" so using assert/deassert is wrong
for this device.  Instead, we use reset/rearm.  We need to use rearm so
that we can reset it after a suspend/resume cycle; w/o using "rearm", the
"rescal" device will only ever fire once.

Of course for suspend/resume to work we also need to put the reset/rearm
calls in the suspend and resume routines.

Fixes: 740d6c3708 ("PCI: brcmstb: Add control of rescal reset")
Link: https://lore.kernel.org/r/20210430152156.21162-4-jim2101024@gmail.com
Signed-off-by: Jim Quinlan <jim2101024@gmail.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Acked-by: Florian Fainelli <f.fainelli@gmail.com>
2021-05-03 13:16:28 -05:00
Jim Quinlan
e8d6f9e561 ata: ahci_brcm: Fix use of BCM7216 reset controller
This driver may use one of two resets controllers.  Keep them in separate
variables to keep things simple.  The reset controller "rescal" is shared
between the AHCI driver and the PCIe driver for the BrcmSTB 7216 chip.  Use
devm_reset_control_get_optional_shared() to handle this sharing.

[bhelgaas: add Jens' ack from v5 posting]
Fixes: 272ecd60a6 ("ata: ahci_brcm: BCM7216 reset is self de-asserting")
Fixes: c345ec6a50 ("ata: ahci_brcm: Support BCM7216 reset controller name")
Link: https://lore.kernel.org/r/20210430152156.21162-3-jim2101024@gmail.com
Signed-off-by: Jim Quinlan <jim2101024@gmail.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Acked-by: Jens Axboe <axboe@kernel.dk>
Acked-by: Florian Fainelli <f.fainelli@gmail.com>
2021-05-03 13:15:04 -05:00
Linus Torvalds
6f8ee8d36d Merge branch 'work.recursive_removal' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
Pull another simple_recursive_removal() update from Al Viro:
 "I missed one case when simple_recursive_removal() was introduced"

* 'work.recursive_removal' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  qib_fs: switch to simple_recursive_removal()
2021-05-03 11:09:36 -07:00
Jim Quinlan
48582b2e3b reset: add missing empty function reset_control_rearm()
All other functions are defined for when CONFIG_RESET_CONTROLLER
is not set.

Fixes: 557acb3d2c ("reset: make shared pulsed reset controls re-triggerable")
Link: https://lore.kernel.org/r/20210430152156.21162-2-jim2101024@gmail.com
Signed-off-by: Jim Quinlan <jim2101024@gmail.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org # v5.11+
2021-05-03 13:09:30 -05:00
Linus Torvalds
23806a3e96 Merge branch 'work.file' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
Pull receive_fd update from Al Viro:
 "Cleanup of receive_fd mess"

* 'work.file' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  fs: split receive_fd_replace from __receive_fd
2021-05-03 11:05:28 -07:00