[PATCH 4.18 095/158] wlcore: Set rx_status boottime_ns field on rx

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Loic Poulain 

[ Upstream commit 37a634f60fd6dfbda2c312657eec7ef0750546e7 ]

When receiving a beacon or probe response, we should update the
boottime_ns field which is the timestamp the frame was received at.
(cf mac80211.h)

This fixes a scanning issue with Android since it relies on this
timestamp to determine when the AP has been seen for the last time
(via the nl80211 BSS_LAST_SEEN_BOOTTIME parameter).

Signed-off-by: Loic Poulain 
Signed-off-by: Kalle Valo 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/net/wireless/ti/wlcore/rx.c |8 ++--
 1 file changed, 6 insertions(+), 2 deletions(-)

--- a/drivers/net/wireless/ti/wlcore/rx.c
+++ b/drivers/net/wireless/ti/wlcore/rx.c
@@ -59,7 +59,7 @@ static u32 wlcore_rx_get_align_buf_size(
 static void wl1271_rx_status(struct wl1271 *wl,
 struct wl1271_rx_descriptor *desc,
 struct ieee80211_rx_status *status,
-u8 beacon)
+u8 beacon, u8 probe_rsp)
 {
memset(status, 0, sizeof(struct ieee80211_rx_status));
 
@@ -106,6 +106,9 @@ static void wl1271_rx_status(struct wl12
}
}
 
+   if (beacon || probe_rsp)
+   status->boottime_ns = ktime_get_boot_ns();
+
if (beacon)
wlcore_set_pending_regdomain_ch(wl, (u16)desc->channel,
status->band);
@@ -191,7 +194,8 @@ static int wl1271_rx_handle_data(struct
if (ieee80211_is_data_present(hdr->frame_control))
is_data = 1;
 
-   wl1271_rx_status(wl, desc, IEEE80211_SKB_RXCB(skb), beacon);
+   wl1271_rx_status(wl, desc, IEEE80211_SKB_RXCB(skb), beacon,
+ieee80211_is_probe_resp(hdr->frame_control));
wlcore_hw_set_rx_csum(wl, desc, skb);
 
seq_num = (le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_SEQ) >> 4;

[PATCH 4.18 097/158] mtd: rawnand: make subop helpers return unsigned values

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Miquel Raynal 

[ Upstream commit 760c435e0f85ed19e48a90d746ce1de2cd02def7 ]

A report from Colin Ian King pointed a CoverityScan issue where error
values on these helpers where not checked in the drivers. These
helpers can error out only in case of a software bug in driver code,
not because of a runtime/hardware error. Hence, let's WARN_ON() in this
case and return 0 which is harmless anyway.

Fixes: 8878b126df76 ("mtd: nand: add ->exec_op() implementation")
Signed-off-by: Miquel Raynal 
Reviewed-by: Boris Brezillon 
Signed-off-by: Miquel Raynal 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/mtd/nand/raw/nand_base.c |   44 +++
 include/linux/mtd/rawnand.h  |   16 +++---
 2 files changed, 30 insertions(+), 30 deletions(-)

--- a/drivers/mtd/nand/raw/nand_base.c
+++ b/drivers/mtd/nand/raw/nand_base.c
@@ -2668,8 +2668,8 @@ static bool nand_subop_instr_is_valid(co
return subop && instr_idx < subop->ninstrs;
 }
 
-static int nand_subop_get_start_off(const struct nand_subop *subop,
-   unsigned int instr_idx)
+static unsigned int nand_subop_get_start_off(const struct nand_subop *subop,
+unsigned int instr_idx)
 {
if (instr_idx)
return 0;
@@ -2688,12 +2688,12 @@ static int nand_subop_get_start_off(cons
  *
  * Given an address instruction, returns the offset of the first cycle to 
issue.
  */
-int nand_subop_get_addr_start_off(const struct nand_subop *subop,
- unsigned int instr_idx)
+unsigned int nand_subop_get_addr_start_off(const struct nand_subop *subop,
+  unsigned int instr_idx)
 {
-   if (!nand_subop_instr_is_valid(subop, instr_idx) ||
-   subop->instrs[instr_idx].type != NAND_OP_ADDR_INSTR)
-   return -EINVAL;
+   if (WARN_ON(!nand_subop_instr_is_valid(subop, instr_idx) ||
+   subop->instrs[instr_idx].type != NAND_OP_ADDR_INSTR))
+   return 0;
 
return nand_subop_get_start_off(subop, instr_idx);
 }
@@ -2710,14 +2710,14 @@ EXPORT_SYMBOL_GPL(nand_subop_get_addr_st
  *
  * Given an address instruction, returns the number of address cycle to issue.
  */
-int nand_subop_get_num_addr_cyc(const struct nand_subop *subop,
-   unsigned int instr_idx)
+unsigned int nand_subop_get_num_addr_cyc(const struct nand_subop *subop,
+unsigned int instr_idx)
 {
int start_off, end_off;
 
-   if (!nand_subop_instr_is_valid(subop, instr_idx) ||
-   subop->instrs[instr_idx].type != NAND_OP_ADDR_INSTR)
-   return -EINVAL;
+   if (WARN_ON(!nand_subop_instr_is_valid(subop, instr_idx) ||
+   subop->instrs[instr_idx].type != NAND_OP_ADDR_INSTR))
+   return 0;
 
start_off = nand_subop_get_addr_start_off(subop, instr_idx);
 
@@ -2742,12 +2742,12 @@ EXPORT_SYMBOL_GPL(nand_subop_get_num_add
  *
  * Given a data instruction, returns the offset to start from.
  */
-int nand_subop_get_data_start_off(const struct nand_subop *subop,
- unsigned int instr_idx)
+unsigned int nand_subop_get_data_start_off(const struct nand_subop *subop,
+  unsigned int instr_idx)
 {
-   if (!nand_subop_instr_is_valid(subop, instr_idx) ||
-   !nand_instr_is_data(>instrs[instr_idx]))
-   return -EINVAL;
+   if (WARN_ON(!nand_subop_instr_is_valid(subop, instr_idx) ||
+   !nand_instr_is_data(>instrs[instr_idx])))
+   return 0;
 
return nand_subop_get_start_off(subop, instr_idx);
 }
@@ -2764,14 +2764,14 @@ EXPORT_SYMBOL_GPL(nand_subop_get_data_st
  *
  * Returns the length of the chunk of data to send/receive.
  */
-int nand_subop_get_data_len(const struct nand_subop *subop,
-   unsigned int instr_idx)
+unsigned int nand_subop_get_data_len(const struct nand_subop *subop,
+unsigned int instr_idx)
 {
int start_off = 0, end_off;
 
-   if (!nand_subop_instr_is_valid(subop, instr_idx) ||
-   !nand_instr_is_data(>instrs[instr_idx]))
-   return -EINVAL;
+   if (WARN_ON(!nand_subop_instr_is_valid(subop, instr_idx) ||
+   !nand_instr_is_data(>instrs[instr_idx])))
+   return 0;
 
start_off = nand_subop_get_data_start_off(subop, instr_idx);
 
--- a/include/linux/mtd/rawnand.h
+++ b/include/linux/mtd/rawnand.h
@@ -986,14 +986,14 @@ struct nand_subop {
unsigned int last_instr_end_off;
 };
 
-int nand_subop_get_addr_start_off(const struct nand_subop *subop,
- unsigned int op_id);
-int nand_subop_get_num_addr_cyc(const 

[PATCH 4.18 102/158] nfs: Referrals not inheriting proto setting from parent

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Calum Mackay 

[ Upstream commit 23a88ade7131aa259c532ab17685c76de562242b ]

Commit 530ea4219231 ("nfs: Referrals should use the same proto setting
as their parent") encloses the fix with #ifdef CONFIG_SUNRPC_XPRT_RDMA.

CONFIG_SUNRPC_XPRT_RDMA is a tristate option, so it should be tested
with #if IS_ENABLED().

Fixes: 530ea4219231 ("nfs: Referrals should use the same proto setting as their 
parent")
Reported-by: Helen Chao 
Tested-by: Helen Chao 
Reviewed-by: Chuck Lever 
Reviewed-by: Bill Baker 
Signed-off-by: Calum Mackay 
Signed-off-by: Anna Schumaker 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 fs/nfs/nfs4client.c |6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/fs/nfs/nfs4client.c
+++ b/fs/nfs/nfs4client.c
@@ -1127,7 +1127,7 @@ struct nfs_server *nfs4_create_referral_
nfs_server_copy_userdata(server, parent_server);
 
/* Get a client representation */
-#ifdef CONFIG_SUNRPC_XPRT_RDMA
+#if IS_ENABLED(CONFIG_SUNRPC_XPRT_RDMA)
rpc_set_port(data->addr, NFS_RDMA_PORT);
error = nfs4_set_client(server, data->hostname,
data->addr,
@@ -1139,7 +1139,7 @@ struct nfs_server *nfs4_create_referral_
parent_client->cl_net);
if (!error)
goto init_server;
-#endif /* CONFIG_SUNRPC_XPRT_RDMA */
+#endif /* IS_ENABLED(CONFIG_SUNRPC_XPRT_RDMA) */
 
rpc_set_port(data->addr, NFS_PORT);
error = nfs4_set_client(server, data->hostname,
@@ -1153,7 +1153,7 @@ struct nfs_server *nfs4_create_referral_
if (error < 0)
goto error;
 
-#ifdef CONFIG_SUNRPC_XPRT_RDMA
+#if IS_ENABLED(CONFIG_SUNRPC_XPRT_RDMA)
 init_server:
 #endif
error = nfs_init_server_rpcclient(server, 
parent_server->client->cl_timeout, data->authflavor);

[PATCH 4.18 101/158] ata: libahci: Correct setting of DEVSLP register

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Srinivas Pandruvada 

[ Upstream commit 2dbb3ec29a6c069035857a2fc4c24e80e5dfe3cc ]

We have seen that on some platforms, SATA device never show any DEVSLP
residency. This prevent power gating of SATA IP, which prevent system
to transition to low power mode in systems with SLP_S0 aka modern
standby systems. The PHY logic is off only in DEVSLP not in slumber.
Reference:
https://www.intel.com/content/dam/www/public/us/en/documents/datasheets
/332995-skylake-i-o-platform-datasheet-volume-1.pdf
Section 28.7.6.1

Here driver is trying to do read-modify-write the devslp register. But
not resetting the bits for which this driver will modify values (DITO,
MDAT and DETO). So simply reset those bits before updating to new values.

Signed-off-by: Srinivas Pandruvada 
Reviewed-by: Rafael J. Wysocki 
Reviewed-by: Hans de Goede 
Signed-off-by: Tejun Heo 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/ata/libahci.c |2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/ata/libahci.c
+++ b/drivers/ata/libahci.c
@@ -2164,6 +2164,8 @@ static void ahci_set_aggressive_devslp(s
deto = 20;
}
 
+   /* Make dito, mdat, deto bits to 0s */
+   devslp &= ~GENMASK_ULL(24, 2);
devslp |= ((dito << PORT_DEVSLP_DITO_OFFSET) |
   (mdat << PORT_DEVSLP_MDAT_OFFSET) |
   (deto << PORT_DEVSLP_DETO_OFFSET) |

[PATCH 4.18 098/158] scsi: tcmu: do not set max_blocks if data_bitmap has been setup

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Mike Christie 

[ Upstream commit c97840c84f5a4362a596a2751e9245a979377a16 ]

This patch prevents a bug where data_bitmap is allocated in
tcmu_configure_device, userspace changes the max_blocks setting, the device
is mapped to a LUN, then we try to access the data_bitmap based on the new
max_blocks limit which may now be out of range.

To prevent this, we just check if data_bitmap has been setup. If it has
then we fail the max_blocks update operation.

Signed-off-by: Mike Christie 
Reviewed-by: Xiubo Li 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/target/target_core_user.c |   73 --
 1 file changed, 40 insertions(+), 33 deletions(-)

--- a/drivers/target/target_core_user.c
+++ b/drivers/target/target_core_user.c
@@ -1745,9 +1745,11 @@ static int tcmu_configure_device(struct
 
info = >uio_info;
 
+   mutex_lock(>cmdr_lock);
udev->data_bitmap = kcalloc(BITS_TO_LONGS(udev->max_blocks),
sizeof(unsigned long),
GFP_KERNEL);
+   mutex_unlock(>cmdr_lock);
if (!udev->data_bitmap) {
ret = -ENOMEM;
goto err_bitmap_alloc;
@@ -1957,7 +1959,7 @@ static match_table_t tokens = {
{Opt_hw_block_size, "hw_block_size=%u"},
{Opt_hw_max_sectors, "hw_max_sectors=%u"},
{Opt_nl_reply_supported, "nl_reply_supported=%d"},
-   {Opt_max_data_area_mb, "max_data_area_mb=%u"},
+   {Opt_max_data_area_mb, "max_data_area_mb=%d"},
{Opt_err, NULL}
 };
 
@@ -1985,13 +1987,48 @@ static int tcmu_set_dev_attrib(substring
return 0;
 }
 
+static int tcmu_set_max_blocks_param(struct tcmu_dev *udev, substring_t *arg)
+{
+   int val, ret;
+
+   ret = match_int(arg, );
+   if (ret < 0) {
+   pr_err("match_int() failed for max_data_area_mb=. Error %d.\n",
+  ret);
+   return ret;
+   }
+
+   if (val <= 0) {
+   pr_err("Invalid max_data_area %d.\n", val);
+   return -EINVAL;
+   }
+
+   mutex_lock(>cmdr_lock);
+   if (udev->data_bitmap) {
+   pr_err("Cannot set max_data_area_mb after it has been 
enabled.\n");
+   ret = -EINVAL;
+   goto unlock;
+   }
+
+   udev->max_blocks = TCMU_MBS_TO_BLOCKS(val);
+   if (udev->max_blocks > tcmu_global_max_blocks) {
+   pr_err("%d is too large. Adjusting max_data_area_mb to global 
limit of %u\n",
+  val, TCMU_BLOCKS_TO_MBS(tcmu_global_max_blocks));
+   udev->max_blocks = tcmu_global_max_blocks;
+   }
+
+unlock:
+   mutex_unlock(>cmdr_lock);
+   return ret;
+}
+
 static ssize_t tcmu_set_configfs_dev_params(struct se_device *dev,
const char *page, ssize_t count)
 {
struct tcmu_dev *udev = TCMU_DEV(dev);
char *orig, *ptr, *opts, *arg_p;
substring_t args[MAX_OPT_ARGS];
-   int ret = 0, token, tmpval;
+   int ret = 0, token;
 
opts = kstrdup(page, GFP_KERNEL);
if (!opts)
@@ -2044,37 +2081,7 @@ static ssize_t tcmu_set_configfs_dev_par
pr_err("kstrtoint() failed for 
nl_reply_supported=\n");
break;
case Opt_max_data_area_mb:
-   if (dev->export_count) {
-   pr_err("Unable to set max_data_area_mb while 
exports exist\n");
-   ret = -EINVAL;
-   break;
-   }
-
-   arg_p = match_strdup([0]);
-   if (!arg_p) {
-   ret = -ENOMEM;
-   break;
-   }
-   ret = kstrtoint(arg_p, 0, );
-   kfree(arg_p);
-   if (ret < 0) {
-   pr_err("kstrtoint() failed for 
max_data_area_mb=\n");
-   break;
-   }
-
-   if (tmpval <= 0) {
-   pr_err("Invalid max_data_area %d\n", tmpval);
-   ret = -EINVAL;
-   break;
-   }
-
-   udev->max_blocks = TCMU_MBS_TO_BLOCKS(tmpval);
-   if (udev->max_blocks > tcmu_global_max_blocks) {
-   pr_err("%d is too large. Adjusting 
max_data_area_mb to global limit of %u\n",
-  tmpval,
-  
TCMU_BLOCKS_TO_MBS(tcmu_global_max_blocks));
-   udev->max_blocks = tcmu_global_max_blocks;
-   }
+   ret = 

[PATCH 4.18 095/158] wlcore: Set rx_status boottime_ns field on rx

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Loic Poulain 

[ Upstream commit 37a634f60fd6dfbda2c312657eec7ef0750546e7 ]

When receiving a beacon or probe response, we should update the
boottime_ns field which is the timestamp the frame was received at.
(cf mac80211.h)

This fixes a scanning issue with Android since it relies on this
timestamp to determine when the AP has been seen for the last time
(via the nl80211 BSS_LAST_SEEN_BOOTTIME parameter).

Signed-off-by: Loic Poulain 
Signed-off-by: Kalle Valo 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/net/wireless/ti/wlcore/rx.c |8 ++--
 1 file changed, 6 insertions(+), 2 deletions(-)

--- a/drivers/net/wireless/ti/wlcore/rx.c
+++ b/drivers/net/wireless/ti/wlcore/rx.c
@@ -59,7 +59,7 @@ static u32 wlcore_rx_get_align_buf_size(
 static void wl1271_rx_status(struct wl1271 *wl,
 struct wl1271_rx_descriptor *desc,
 struct ieee80211_rx_status *status,
-u8 beacon)
+u8 beacon, u8 probe_rsp)
 {
memset(status, 0, sizeof(struct ieee80211_rx_status));
 
@@ -106,6 +106,9 @@ static void wl1271_rx_status(struct wl12
}
}
 
+   if (beacon || probe_rsp)
+   status->boottime_ns = ktime_get_boot_ns();
+
if (beacon)
wlcore_set_pending_regdomain_ch(wl, (u16)desc->channel,
status->band);
@@ -191,7 +194,8 @@ static int wl1271_rx_handle_data(struct
if (ieee80211_is_data_present(hdr->frame_control))
is_data = 1;
 
-   wl1271_rx_status(wl, desc, IEEE80211_SKB_RXCB(skb), beacon);
+   wl1271_rx_status(wl, desc, IEEE80211_SKB_RXCB(skb), beacon,
+ieee80211_is_probe_resp(hdr->frame_control));
wlcore_hw_set_rx_csum(wl, desc, skb);
 
seq_num = (le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_SEQ) >> 4;

[PATCH 4.18 097/158] mtd: rawnand: make subop helpers return unsigned values

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Miquel Raynal 

[ Upstream commit 760c435e0f85ed19e48a90d746ce1de2cd02def7 ]

A report from Colin Ian King pointed a CoverityScan issue where error
values on these helpers where not checked in the drivers. These
helpers can error out only in case of a software bug in driver code,
not because of a runtime/hardware error. Hence, let's WARN_ON() in this
case and return 0 which is harmless anyway.

Fixes: 8878b126df76 ("mtd: nand: add ->exec_op() implementation")
Signed-off-by: Miquel Raynal 
Reviewed-by: Boris Brezillon 
Signed-off-by: Miquel Raynal 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/mtd/nand/raw/nand_base.c |   44 +++
 include/linux/mtd/rawnand.h  |   16 +++---
 2 files changed, 30 insertions(+), 30 deletions(-)

--- a/drivers/mtd/nand/raw/nand_base.c
+++ b/drivers/mtd/nand/raw/nand_base.c
@@ -2668,8 +2668,8 @@ static bool nand_subop_instr_is_valid(co
return subop && instr_idx < subop->ninstrs;
 }
 
-static int nand_subop_get_start_off(const struct nand_subop *subop,
-   unsigned int instr_idx)
+static unsigned int nand_subop_get_start_off(const struct nand_subop *subop,
+unsigned int instr_idx)
 {
if (instr_idx)
return 0;
@@ -2688,12 +2688,12 @@ static int nand_subop_get_start_off(cons
  *
  * Given an address instruction, returns the offset of the first cycle to 
issue.
  */
-int nand_subop_get_addr_start_off(const struct nand_subop *subop,
- unsigned int instr_idx)
+unsigned int nand_subop_get_addr_start_off(const struct nand_subop *subop,
+  unsigned int instr_idx)
 {
-   if (!nand_subop_instr_is_valid(subop, instr_idx) ||
-   subop->instrs[instr_idx].type != NAND_OP_ADDR_INSTR)
-   return -EINVAL;
+   if (WARN_ON(!nand_subop_instr_is_valid(subop, instr_idx) ||
+   subop->instrs[instr_idx].type != NAND_OP_ADDR_INSTR))
+   return 0;
 
return nand_subop_get_start_off(subop, instr_idx);
 }
@@ -2710,14 +2710,14 @@ EXPORT_SYMBOL_GPL(nand_subop_get_addr_st
  *
  * Given an address instruction, returns the number of address cycle to issue.
  */
-int nand_subop_get_num_addr_cyc(const struct nand_subop *subop,
-   unsigned int instr_idx)
+unsigned int nand_subop_get_num_addr_cyc(const struct nand_subop *subop,
+unsigned int instr_idx)
 {
int start_off, end_off;
 
-   if (!nand_subop_instr_is_valid(subop, instr_idx) ||
-   subop->instrs[instr_idx].type != NAND_OP_ADDR_INSTR)
-   return -EINVAL;
+   if (WARN_ON(!nand_subop_instr_is_valid(subop, instr_idx) ||
+   subop->instrs[instr_idx].type != NAND_OP_ADDR_INSTR))
+   return 0;
 
start_off = nand_subop_get_addr_start_off(subop, instr_idx);
 
@@ -2742,12 +2742,12 @@ EXPORT_SYMBOL_GPL(nand_subop_get_num_add
  *
  * Given a data instruction, returns the offset to start from.
  */
-int nand_subop_get_data_start_off(const struct nand_subop *subop,
- unsigned int instr_idx)
+unsigned int nand_subop_get_data_start_off(const struct nand_subop *subop,
+  unsigned int instr_idx)
 {
-   if (!nand_subop_instr_is_valid(subop, instr_idx) ||
-   !nand_instr_is_data(>instrs[instr_idx]))
-   return -EINVAL;
+   if (WARN_ON(!nand_subop_instr_is_valid(subop, instr_idx) ||
+   !nand_instr_is_data(>instrs[instr_idx])))
+   return 0;
 
return nand_subop_get_start_off(subop, instr_idx);
 }
@@ -2764,14 +2764,14 @@ EXPORT_SYMBOL_GPL(nand_subop_get_data_st
  *
  * Returns the length of the chunk of data to send/receive.
  */
-int nand_subop_get_data_len(const struct nand_subop *subop,
-   unsigned int instr_idx)
+unsigned int nand_subop_get_data_len(const struct nand_subop *subop,
+unsigned int instr_idx)
 {
int start_off = 0, end_off;
 
-   if (!nand_subop_instr_is_valid(subop, instr_idx) ||
-   !nand_instr_is_data(>instrs[instr_idx]))
-   return -EINVAL;
+   if (WARN_ON(!nand_subop_instr_is_valid(subop, instr_idx) ||
+   !nand_instr_is_data(>instrs[instr_idx])))
+   return 0;
 
start_off = nand_subop_get_data_start_off(subop, instr_idx);
 
--- a/include/linux/mtd/rawnand.h
+++ b/include/linux/mtd/rawnand.h
@@ -986,14 +986,14 @@ struct nand_subop {
unsigned int last_instr_end_off;
 };
 
-int nand_subop_get_addr_start_off(const struct nand_subop *subop,
- unsigned int op_id);
-int nand_subop_get_num_addr_cyc(const 

[PATCH 4.18 102/158] nfs: Referrals not inheriting proto setting from parent

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Calum Mackay 

[ Upstream commit 23a88ade7131aa259c532ab17685c76de562242b ]

Commit 530ea4219231 ("nfs: Referrals should use the same proto setting
as their parent") encloses the fix with #ifdef CONFIG_SUNRPC_XPRT_RDMA.

CONFIG_SUNRPC_XPRT_RDMA is a tristate option, so it should be tested
with #if IS_ENABLED().

Fixes: 530ea4219231 ("nfs: Referrals should use the same proto setting as their 
parent")
Reported-by: Helen Chao 
Tested-by: Helen Chao 
Reviewed-by: Chuck Lever 
Reviewed-by: Bill Baker 
Signed-off-by: Calum Mackay 
Signed-off-by: Anna Schumaker 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 fs/nfs/nfs4client.c |6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/fs/nfs/nfs4client.c
+++ b/fs/nfs/nfs4client.c
@@ -1127,7 +1127,7 @@ struct nfs_server *nfs4_create_referral_
nfs_server_copy_userdata(server, parent_server);
 
/* Get a client representation */
-#ifdef CONFIG_SUNRPC_XPRT_RDMA
+#if IS_ENABLED(CONFIG_SUNRPC_XPRT_RDMA)
rpc_set_port(data->addr, NFS_RDMA_PORT);
error = nfs4_set_client(server, data->hostname,
data->addr,
@@ -1139,7 +1139,7 @@ struct nfs_server *nfs4_create_referral_
parent_client->cl_net);
if (!error)
goto init_server;
-#endif /* CONFIG_SUNRPC_XPRT_RDMA */
+#endif /* IS_ENABLED(CONFIG_SUNRPC_XPRT_RDMA) */
 
rpc_set_port(data->addr, NFS_PORT);
error = nfs4_set_client(server, data->hostname,
@@ -1153,7 +1153,7 @@ struct nfs_server *nfs4_create_referral_
if (error < 0)
goto error;
 
-#ifdef CONFIG_SUNRPC_XPRT_RDMA
+#if IS_ENABLED(CONFIG_SUNRPC_XPRT_RDMA)
 init_server:
 #endif
error = nfs_init_server_rpcclient(server, 
parent_server->client->cl_timeout, data->authflavor);

[PATCH 4.18 100/158] ata: libahci: Allow reconfigure of DEVSLP register

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Srinivas Pandruvada 

[ Upstream commit 11c291461b6ea8d1195a96d6bba6673a94aacebc ]

There are two modes in which DEVSLP can be entered. The OS initiated or
hardware autonomous.

In hardware autonomous mode, BIOS configures the AHCI controller and the
device to enable DEVSLP. But they may not be ideal for all cases. So in
this case, OS should be able to reconfigure DEVSLP register.

Currently if the DEVSLP is already enabled, we can't set again as it will
simply return. There are some systems where the firmware is setting high
DITO by default, in this case we can't modify here to correct settings.
With the default in several seconds, we are not able to transition to
DEVSLP.

This change will allow reconfiguration of devslp register if DITO is
different.

Signed-off-by: Srinivas Pandruvada 
Reviewed-by: Hans de Goede 
Signed-off-by: Tejun Heo 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/ata/libahci.c |   18 ++
 1 file changed, 10 insertions(+), 8 deletions(-)

--- a/drivers/ata/libahci.c
+++ b/drivers/ata/libahci.c
@@ -2107,7 +2107,7 @@ static void ahci_set_aggressive_devslp(s
struct ahci_host_priv *hpriv = ap->host->private_data;
void __iomem *port_mmio = ahci_port_base(ap);
struct ata_device *dev = ap->link.device;
-   u32 devslp, dm, dito, mdat, deto;
+   u32 devslp, dm, dito, mdat, deto, dito_conf;
int rc;
unsigned int err_mask;
 
@@ -2131,8 +2131,15 @@ static void ahci_set_aggressive_devslp(s
return;
}
 
-   /* device sleep was already enabled */
-   if (devslp & PORT_DEVSLP_ADSE)
+   dm = (devslp & PORT_DEVSLP_DM_MASK) >> PORT_DEVSLP_DM_OFFSET;
+   dito = devslp_idle_timeout / (dm + 1);
+   if (dito > 0x3ff)
+   dito = 0x3ff;
+
+   dito_conf = (devslp >> PORT_DEVSLP_DITO_OFFSET) & 0x3FF;
+
+   /* device sleep was already enabled and same dito */
+   if ((devslp & PORT_DEVSLP_ADSE) && (dito_conf == dito))
return;
 
/* set DITO, MDAT, DETO and enable DevSlp, need to stop engine first */
@@ -2140,11 +2147,6 @@ static void ahci_set_aggressive_devslp(s
if (rc)
return;
 
-   dm = (devslp & PORT_DEVSLP_DM_MASK) >> PORT_DEVSLP_DM_OFFSET;
-   dito = devslp_idle_timeout / (dm + 1);
-   if (dito > 0x3ff)
-   dito = 0x3ff;
-
/* Use the nominal value 10 ms if the read MDAT is zero,
 * the nominal value of DETO is 20 ms.
 */

[PATCH 4.18 099/158] MIPS: Fix ISA virt/bus conversion for non-zero PHYS_OFFSET

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Paul Burton 

[ Upstream commit 0494d7ffdcebc6935410ea0719b24ab626675351 ]

isa_virt_to_bus() & isa_bus_to_virt() claim to treat ISA bus addresses
as being identical to physical addresses, but they fail to do so in the
presence of a non-zero PHYS_OFFSET.

Correct this by having them use virt_to_phys() & phys_to_virt(), which
consolidates the calculations to one place & ensures that ISA bus
addresses do indeed match physical addresses.

Signed-off-by: Paul Burton 
Patchwork: https://patchwork.linux-mips.org/patch/20047/
Cc: James Hogan 
Cc: Ralf Baechle 
Cc: linux-m...@linux-mips.org
Cc: Vladimir Kondratiev 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 arch/mips/include/asm/io.h |8 
 1 file changed, 4 insertions(+), 4 deletions(-)

--- a/arch/mips/include/asm/io.h
+++ b/arch/mips/include/asm/io.h
@@ -141,14 +141,14 @@ static inline void * phys_to_virt(unsign
 /*
  * ISA I/O bus memory addresses are 1:1 with the physical address.
  */
-static inline unsigned long isa_virt_to_bus(volatile void * address)
+static inline unsigned long isa_virt_to_bus(volatile void *address)
 {
-   return (unsigned long)address - PAGE_OFFSET;
+   return virt_to_phys(address);
 }
 
-static inline void * isa_bus_to_virt(unsigned long address)
+static inline void *isa_bus_to_virt(unsigned long address)
 {
-   return (void *)(address + PAGE_OFFSET);
+   return phys_to_virt(address);
 }
 
 #define isa_page_to_bus page_to_phys

[PATCH 4.18 075/158] iwlwifi: pcie: dont access periphery registers when not available

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Emmanuel Grumbach 

[ Upstream commit f98ad635c097c29339b7a7d6947173000485893d ]

The periphery can't be accessed before we set the
INIT_DONE bit which initializes the device.

A previous patch added a reconfiguration of the MSI-X
tables upon resume, but at that point in the flow,
INIT_DONE wasn't set. Since the reconfiguration of the
MSI-X tables require periphery access, it failed.

The difference between WoWLAN and without WoWLAN is that
in WoWLAN, iwl_trans_pcie_d3_suspend clears the INIT_DONE
without clearing the STATUS_DEVICE_ENABLED bit in the
software status. Because of that, the resume code thinks
that the device is enabled, but the INIT_DONE bit has been
cleared.

To fix this, don't reconfigure the MSI-X tables in case
WoWLAN is enabled. It will be done in
iwl_trans_pcie_d3_resume anyway.

Fixes: 52848a79b9d2 ("iwlwifi: pcie: reconfigure MSI-X HW on resume")
Signed-off-by: Emmanuel Grumbach 
Signed-off-by: Luca Coelho 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/net/wireless/intel/iwlwifi/pcie/drv.c   |4 
 drivers/net/wireless/intel/iwlwifi/pcie/trans.c |   24 
 2 files changed, 16 insertions(+), 12 deletions(-)

--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
@@ -1003,6 +1003,10 @@ static int iwl_pci_resume(struct device
if (!trans->op_mode)
return 0;
 
+   /* In WOWLAN, let iwl_trans_pcie_d3_resume do the rest of the work */
+   if (test_bit(STATUS_DEVICE_ENABLED, >status))
+   return 0;
+
/* reconfigure the MSI-X mapping to get the correct IRQ for rfkill */
iwl_pcie_conf_msix_hw(trans_pcie);
 
--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
@@ -1539,18 +1539,6 @@ static int iwl_trans_pcie_d3_resume(stru
 
iwl_pcie_enable_rx_wake(trans, true);
 
-   /*
-* Reconfigure IVAR table in case of MSIX or reset ict table in
-* MSI mode since HW reset erased it.
-* Also enables interrupts - none will happen as
-* the device doesn't know we're waking it up, only when
-* the opmode actually tells it after this call.
-*/
-   iwl_pcie_conf_msix_hw(trans_pcie);
-   if (!trans_pcie->msix_enabled)
-   iwl_pcie_reset_ict(trans);
-   iwl_enable_interrupts(trans);
-
iwl_set_bit(trans, CSR_GP_CNTRL,
BIT(trans->cfg->csr->flag_mac_access_req));
iwl_set_bit(trans, CSR_GP_CNTRL,
@@ -1568,6 +1556,18 @@ static int iwl_trans_pcie_d3_resume(stru
return ret;
}
 
+   /*
+* Reconfigure IVAR table in case of MSIX or reset ict table in
+* MSI mode since HW reset erased it.
+* Also enables interrupts - none will happen as
+* the device doesn't know we're waking it up, only when
+* the opmode actually tells it after this call.
+*/
+   iwl_pcie_conf_msix_hw(trans_pcie);
+   if (!trans_pcie->msix_enabled)
+   iwl_pcie_reset_ict(trans);
+   iwl_enable_interrupts(trans);
+
iwl_pcie_set_pwr(trans, false);
 
if (!reset) {

[PATCH 4.18 096/158] rpmsg: core: add support to power domains for devices

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Srinivas Kandagatla 

[ Upstream commit fe782affd0f440a4e60e2cc81b8f2eccb2923113 ]

Some of the rpmsg devices need to switch on power domains to communicate
with remote processor. For example on Qualcomm DB820c platform LPASS
power domain needs to switched on for any kind of audio services.
This patch adds the missing power domain support in rpmsg core.

Without this patch attempting to play audio via QDSP on DB820c would
reboot the system.

Signed-off-by: Srinivas Kandagatla 
Signed-off-by: Bjorn Andersson 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/rpmsg/rpmsg_core.c |7 +++
 1 file changed, 7 insertions(+)

--- a/drivers/rpmsg/rpmsg_core.c
+++ b/drivers/rpmsg/rpmsg_core.c
@@ -15,6 +15,7 @@
 #include 
 #include 
 #include 
+#include 
 #include 
 
 #include "rpmsg_internal.h"
@@ -449,6 +450,10 @@ static int rpmsg_dev_probe(struct device
struct rpmsg_endpoint *ept = NULL;
int err;
 
+   err = dev_pm_domain_attach(dev, true);
+   if (err)
+   goto out;
+
if (rpdrv->callback) {
strncpy(chinfo.name, rpdev->id.name, RPMSG_NAME_SIZE);
chinfo.src = rpdev->src;
@@ -490,6 +495,8 @@ static int rpmsg_dev_remove(struct devic
 
rpdrv->remove(rpdev);
 
+   dev_pm_domain_detach(dev, true);
+
if (rpdev->ept)
rpmsg_destroy_ept(rpdev->ept);
 

[PATCH 4.18 099/158] MIPS: Fix ISA virt/bus conversion for non-zero PHYS_OFFSET

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Paul Burton 

[ Upstream commit 0494d7ffdcebc6935410ea0719b24ab626675351 ]

isa_virt_to_bus() & isa_bus_to_virt() claim to treat ISA bus addresses
as being identical to physical addresses, but they fail to do so in the
presence of a non-zero PHYS_OFFSET.

Correct this by having them use virt_to_phys() & phys_to_virt(), which
consolidates the calculations to one place & ensures that ISA bus
addresses do indeed match physical addresses.

Signed-off-by: Paul Burton 
Patchwork: https://patchwork.linux-mips.org/patch/20047/
Cc: James Hogan 
Cc: Ralf Baechle 
Cc: linux-m...@linux-mips.org
Cc: Vladimir Kondratiev 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 arch/mips/include/asm/io.h |8 
 1 file changed, 4 insertions(+), 4 deletions(-)

--- a/arch/mips/include/asm/io.h
+++ b/arch/mips/include/asm/io.h
@@ -141,14 +141,14 @@ static inline void * phys_to_virt(unsign
 /*
  * ISA I/O bus memory addresses are 1:1 with the physical address.
  */
-static inline unsigned long isa_virt_to_bus(volatile void * address)
+static inline unsigned long isa_virt_to_bus(volatile void *address)
 {
-   return (unsigned long)address - PAGE_OFFSET;
+   return virt_to_phys(address);
 }
 
-static inline void * isa_bus_to_virt(unsigned long address)
+static inline void *isa_bus_to_virt(unsigned long address)
 {
-   return (void *)(address + PAGE_OFFSET);
+   return phys_to_virt(address);
 }
 
 #define isa_page_to_bus page_to_phys

[PATCH 4.18 100/158] ata: libahci: Allow reconfigure of DEVSLP register

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Srinivas Pandruvada 

[ Upstream commit 11c291461b6ea8d1195a96d6bba6673a94aacebc ]

There are two modes in which DEVSLP can be entered. The OS initiated or
hardware autonomous.

In hardware autonomous mode, BIOS configures the AHCI controller and the
device to enable DEVSLP. But they may not be ideal for all cases. So in
this case, OS should be able to reconfigure DEVSLP register.

Currently if the DEVSLP is already enabled, we can't set again as it will
simply return. There are some systems where the firmware is setting high
DITO by default, in this case we can't modify here to correct settings.
With the default in several seconds, we are not able to transition to
DEVSLP.

This change will allow reconfiguration of devslp register if DITO is
different.

Signed-off-by: Srinivas Pandruvada 
Reviewed-by: Hans de Goede 
Signed-off-by: Tejun Heo 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/ata/libahci.c |   18 ++
 1 file changed, 10 insertions(+), 8 deletions(-)

--- a/drivers/ata/libahci.c
+++ b/drivers/ata/libahci.c
@@ -2107,7 +2107,7 @@ static void ahci_set_aggressive_devslp(s
struct ahci_host_priv *hpriv = ap->host->private_data;
void __iomem *port_mmio = ahci_port_base(ap);
struct ata_device *dev = ap->link.device;
-   u32 devslp, dm, dito, mdat, deto;
+   u32 devslp, dm, dito, mdat, deto, dito_conf;
int rc;
unsigned int err_mask;
 
@@ -2131,8 +2131,15 @@ static void ahci_set_aggressive_devslp(s
return;
}
 
-   /* device sleep was already enabled */
-   if (devslp & PORT_DEVSLP_ADSE)
+   dm = (devslp & PORT_DEVSLP_DM_MASK) >> PORT_DEVSLP_DM_OFFSET;
+   dito = devslp_idle_timeout / (dm + 1);
+   if (dito > 0x3ff)
+   dito = 0x3ff;
+
+   dito_conf = (devslp >> PORT_DEVSLP_DITO_OFFSET) & 0x3FF;
+
+   /* device sleep was already enabled and same dito */
+   if ((devslp & PORT_DEVSLP_ADSE) && (dito_conf == dito))
return;
 
/* set DITO, MDAT, DETO and enable DevSlp, need to stop engine first */
@@ -2140,11 +2147,6 @@ static void ahci_set_aggressive_devslp(s
if (rc)
return;
 
-   dm = (devslp & PORT_DEVSLP_DM_MASK) >> PORT_DEVSLP_DM_OFFSET;
-   dito = devslp_idle_timeout / (dm + 1);
-   if (dito > 0x3ff)
-   dito = 0x3ff;
-
/* Use the nominal value 10 ms if the read MDAT is zero,
 * the nominal value of DETO is 20 ms.
 */

[PATCH 4.18 075/158] iwlwifi: pcie: dont access periphery registers when not available

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Emmanuel Grumbach 

[ Upstream commit f98ad635c097c29339b7a7d6947173000485893d ]

The periphery can't be accessed before we set the
INIT_DONE bit which initializes the device.

A previous patch added a reconfiguration of the MSI-X
tables upon resume, but at that point in the flow,
INIT_DONE wasn't set. Since the reconfiguration of the
MSI-X tables require periphery access, it failed.

The difference between WoWLAN and without WoWLAN is that
in WoWLAN, iwl_trans_pcie_d3_suspend clears the INIT_DONE
without clearing the STATUS_DEVICE_ENABLED bit in the
software status. Because of that, the resume code thinks
that the device is enabled, but the INIT_DONE bit has been
cleared.

To fix this, don't reconfigure the MSI-X tables in case
WoWLAN is enabled. It will be done in
iwl_trans_pcie_d3_resume anyway.

Fixes: 52848a79b9d2 ("iwlwifi: pcie: reconfigure MSI-X HW on resume")
Signed-off-by: Emmanuel Grumbach 
Signed-off-by: Luca Coelho 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/net/wireless/intel/iwlwifi/pcie/drv.c   |4 
 drivers/net/wireless/intel/iwlwifi/pcie/trans.c |   24 
 2 files changed, 16 insertions(+), 12 deletions(-)

--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
@@ -1003,6 +1003,10 @@ static int iwl_pci_resume(struct device
if (!trans->op_mode)
return 0;
 
+   /* In WOWLAN, let iwl_trans_pcie_d3_resume do the rest of the work */
+   if (test_bit(STATUS_DEVICE_ENABLED, >status))
+   return 0;
+
/* reconfigure the MSI-X mapping to get the correct IRQ for rfkill */
iwl_pcie_conf_msix_hw(trans_pcie);
 
--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
@@ -1539,18 +1539,6 @@ static int iwl_trans_pcie_d3_resume(stru
 
iwl_pcie_enable_rx_wake(trans, true);
 
-   /*
-* Reconfigure IVAR table in case of MSIX or reset ict table in
-* MSI mode since HW reset erased it.
-* Also enables interrupts - none will happen as
-* the device doesn't know we're waking it up, only when
-* the opmode actually tells it after this call.
-*/
-   iwl_pcie_conf_msix_hw(trans_pcie);
-   if (!trans_pcie->msix_enabled)
-   iwl_pcie_reset_ict(trans);
-   iwl_enable_interrupts(trans);
-
iwl_set_bit(trans, CSR_GP_CNTRL,
BIT(trans->cfg->csr->flag_mac_access_req));
iwl_set_bit(trans, CSR_GP_CNTRL,
@@ -1568,6 +1556,18 @@ static int iwl_trans_pcie_d3_resume(stru
return ret;
}
 
+   /*
+* Reconfigure IVAR table in case of MSIX or reset ict table in
+* MSI mode since HW reset erased it.
+* Also enables interrupts - none will happen as
+* the device doesn't know we're waking it up, only when
+* the opmode actually tells it after this call.
+*/
+   iwl_pcie_conf_msix_hw(trans_pcie);
+   if (!trans_pcie->msix_enabled)
+   iwl_pcie_reset_ict(trans);
+   iwl_enable_interrupts(trans);
+
iwl_pcie_set_pwr(trans, false);
 
if (!reset) {

[PATCH 4.18 096/158] rpmsg: core: add support to power domains for devices

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Srinivas Kandagatla 

[ Upstream commit fe782affd0f440a4e60e2cc81b8f2eccb2923113 ]

Some of the rpmsg devices need to switch on power domains to communicate
with remote processor. For example on Qualcomm DB820c platform LPASS
power domain needs to switched on for any kind of audio services.
This patch adds the missing power domain support in rpmsg core.

Without this patch attempting to play audio via QDSP on DB820c would
reboot the system.

Signed-off-by: Srinivas Kandagatla 
Signed-off-by: Bjorn Andersson 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/rpmsg/rpmsg_core.c |7 +++
 1 file changed, 7 insertions(+)

--- a/drivers/rpmsg/rpmsg_core.c
+++ b/drivers/rpmsg/rpmsg_core.c
@@ -15,6 +15,7 @@
 #include 
 #include 
 #include 
+#include 
 #include 
 
 #include "rpmsg_internal.h"
@@ -449,6 +450,10 @@ static int rpmsg_dev_probe(struct device
struct rpmsg_endpoint *ept = NULL;
int err;
 
+   err = dev_pm_domain_attach(dev, true);
+   if (err)
+   goto out;
+
if (rpdrv->callback) {
strncpy(chinfo.name, rpdev->id.name, RPMSG_NAME_SIZE);
chinfo.src = rpdev->src;
@@ -490,6 +495,8 @@ static int rpmsg_dev_remove(struct devic
 
rpdrv->remove(rpdev);
 
+   dev_pm_domain_detach(dev, true);
+
if (rpdev->ept)
rpmsg_destroy_ept(rpdev->ept);
 

Re: [PATCH 16/18] LSM: Allow arbitrary LSM ordering

[Mickaël Salaün]

On 9/18/18 00:36, John Johansen wrote:
> On 09/17/2018 02:57 PM, Casey Schaufler wrote:
>> On 9/17/2018 12:55 PM, John Johansen wrote:
>>> On 09/17/2018 12:23 PM, Casey Schaufler wrote:
 On 9/17/2018 11:14 AM, Kees Cook wrote:
>> Keep security=$lsm with the existing exclusive behavior.
>> Add lsm=$lsm1,...,$lsmN which requires a full list of modules
>>
>> If you want to be fancy (I don't!) you could add
>>
>> lsm.add=$lsm1,...,$lsmN which adds the modules to the stack
>> lsm.delete=$lsm1,...,$lsmN which deletes modules from the stack
> We've got two issues: ordering and enablement. It's been strongly
> suggested that we should move away from per-LSM enable/disable flags
> (to which I agree).
 I also agree. There are way too many ways to turn off some LSMs.

>>> I wont disagree, but its largely because we didn't have this discussion
>>> when we should have.
>>
>> True that.
>>
>>
> If ordering should be separate from enablement (to
> avoid the "booted kernel with new LSM built in, but my lsm="..." line
> didn't include it so it's disabled case), then I think we need to
> split the logic (otherwise we just reinvented "security=" with similar
> problems).
 We could reduce the problem by declaring that LSM ordering is
 not something you can specify on the boot line. I can see value
 in specifying it when you build the kernel, but your circumstances
 would have to be pretty strange to change it at boot time.

>>> if there is LSM ordering the getting
>>>
>>>   lsm=B,A,C
>>>
>>> is not the behavior I would expect from specifying
>>>
>>>   lsm=A,B,C
>>
>> Right. You'd expect that they'd be used in the order specified.
>>
> 
> and yet you argue for something different ;)
> 
> Should "lsm=" allow arbitrary ordering? (I think yes.)
 I say no. Assume you can specify it at build time. When would
 you want to change the order? Why would you?

>>> because maybe you care about the denial message from one LSM more than
>>> you do from another. Since stacking is bail on first fail the order
>>> could be important from an auditing POV
>>
>> I understand that a distribution would want to specify the order
>> for support purposes and that a developer would want to specify
>> the order to ensure reproducible behavior. But they are going to
>> be controlling their kernel builds. I'm not suggesting that the
>> order shouldn't be capable of build time specification. What I
>> don't see is a reason to rearrange it at boot time.
>>
> 
> Because not all users have the same priority as the distro. It can
> also aid in debugging and testing of LSMs in a stacked situation.
> 
>>> Auditing is why apparmor's internal stacking is not bail on first
>>> fail.
>>
>> Within a security module I get that. But we've already got the
>> priority wrong for audit in general, because you only get to the
>> LSM if the traditional code approves. Every guidance I ever got
> 
> true
> 
>> said you should do the MAC checks first, because you're much more
>> concerned about getting audit records about MAC failures than DAC.
>>
> 
> yep, wouldn't that be nice to have
> 
> Should "lsm=" imply implicit enable/disable? (I think no: unlisted
> LSMs are implicitly auto-appended to the explicit list)
 If you want to add something that isn't there instead of making
 it explicit you want "lsm.enable=" not "lsm=".

> So then we could have "lsm.enable=..." and "lsm.disable=...".
>
> If builtin list was:
> capability,yama,loadpin,integrity,{selinux,smack,tomoyo,apparmor}
> then:
>
> lsm.disable=loadpin lsm=smack
 Methinks this should be lsm.disable=loadpin lsm.enable=smack

>>> that would only work if order is not important
>>
>> It works unless you want to change the order at boot, and
>> I still don't see a use case for that.
> 
> see above
> 
>>
> becomes
>
> capability,smack,yama,integrity
>
> and
>
> CONFIG_SECURITY_LOADPIN_DEFAULT_ENABLED=n
> selinux.enable=0 lsm.add=loadpin lsm.disable=smack,tomoyo 
> lsm=integrity
 Do you mean
selinux.enable=0 lsm.enable=loadpin lsm.disable=smack,tomoyo 
 lsm.enable=integrity
selinux.enable=0 lsm.enable=loadpin,integrity lsm.disable=smack,tomoyo
selinux.enable=0 lsm.enable=loadpin lsm.enable=integrity 
 lsm.disable=smack lsm.disable=tomoyo

> becomes
>
> capability,integrity,yama,loadpin,apparmor
>
>
> If "lsm=" _does_ imply enablement, then how does it interact with
> per-LSM disabling? i.e. what does "apparmor.enabled=0
> lsm=yama,apparmor" mean? If it means "turn on apparmor" how do I turn
> on a CONFIG-default-off LSM without specifying all the other LSMs too?
 There should either be one option "lsm=", which is an explicit list or
 two, "lsm.enable=" and "lsm.disable", which modify the built in default.

>>> maybe but 

[PATCH 4.18 090/158] macintosh/via-pmu: Add missing mmio accessors

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Finn Thain 

[ Upstream commit 576d5290d678a651b9f36050fc1717e0573aca13 ]

Add missing in_8() accessors to init_pmu() and pmu_sr_intr().

This fixes several sparse warnings:
drivers/macintosh/via-pmu.c:536:29: warning: dereference of noderef expression
drivers/macintosh/via-pmu.c:537:33: warning: dereference of noderef expression
drivers/macintosh/via-pmu.c:1455:17: warning: dereference of noderef expression
drivers/macintosh/via-pmu.c:1456:69: warning: dereference of noderef expression

Tested-by: Stan Johnson 
Signed-off-by: Finn Thain 
Reviewed-by: Geert Uytterhoeven 
Signed-off-by: Michael Ellerman 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/macintosh/via-pmu.c |9 +
 1 file changed, 5 insertions(+), 4 deletions(-)

--- a/drivers/macintosh/via-pmu.c
+++ b/drivers/macintosh/via-pmu.c
@@ -534,8 +534,9 @@ init_pmu(void)
int timeout;
struct adb_request req;
 
-   out_8([B], via[B] | TREQ);  /* negate TREQ */
-   out_8([DIRB], (via[DIRB] | TREQ) & ~TACK);  /* TACK in, TREQ out */
+   /* Negate TREQ. Set TACK to input and TREQ to output. */
+   out_8([B], in_8([B]) | TREQ);
+   out_8([DIRB], (in_8([DIRB]) | TREQ) & ~TACK);
 
pmu_request(, NULL, 2, PMU_SET_INTR_MASK, pmu_intr_mask);
timeout =  10;
@@ -1418,8 +1419,8 @@ pmu_sr_intr(void)
struct adb_request *req;
int bite = 0;
 
-   if (via[B] & TREQ) {
-   printk(KERN_ERR "PMU: spurious SR intr (%x)\n", via[B]);
+   if (in_8([B]) & TREQ) {
+   printk(KERN_ERR "PMU: spurious SR intr (%x)\n", in_8([B]));
out_8([IFR], SR_INT);
return NULL;
}

[PATCH 4.18 035/158] cpu/hotplug: Adjust misplaced smb() in cpuhp_thread_fun()

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Neeraj Upadhyay 

commit f8b7530aa0a1def79c93101216b5b17cf408a70a upstream.

The smp_mb() in cpuhp_thread_fun() is misplaced. It needs to be after the
load of st->should_run to prevent reordering of the later load/stores
w.r.t. the load of st->should_run.

Fixes: 4dddfb5faa61 ("smp/hotplug: Rewrite AP state machine core")
Signed-off-by: Neeraj Upadhyay 
Signed-off-by: Thomas Gleixner 
Acked-by: Peter Zijlstra (Intel) 
Cc: j...@joshtriplett.org
Cc: pet...@infradead.org
Cc: jiangshan...@gmail.com
Cc: dzic...@redhat.com
Cc: brendan.jack...@arm.com
Cc: ma...@debian.org
Cc: mo...@codeaurora.org
Cc: sram...@codeaurora.org
Cc: linux-arm-...@vger.kernel.org
Cc: sta...@vger.kernel.org
Link: 
https://lkml.kernel.org/r/1536126727-11629-1-git-send-email-neer...@codeaurora.org
Signed-off-by: Greg Kroah-Hartman 

---
 kernel/cpu.c |6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -608,15 +608,15 @@ static void cpuhp_thread_fun(unsigned in
bool bringup = st->bringup;
enum cpuhp_state state;
 
+   if (WARN_ON_ONCE(!st->should_run))
+   return;
+
/*
 * ACQUIRE for the cpuhp_should_run() load of ->should_run. Ensures
 * that if we see ->should_run we also see the rest of the state.
 */
smp_mb();
 
-   if (WARN_ON_ONCE(!st->should_run))
-   return;
-
cpuhp_lock_acquire(bringup);
 
if (st->single) {

[PATCH 4.18 074/158] uio: fix possible circular locking dependency

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Xiubo Li 

[ Upstream commit b34e9a15b37b8ddbf06a4da142b0c39c74211eb4 ]

The call trace:
XXX/1910 is trying to acquire lock:
 (>mmap_sem){++}, at: [] might_fault+0x57/0xb0

but task is already holding lock:
 (>info_lock){+.+...}, at: [] uio_write+0x46/0x130 [uio]

which lock already depends on the new lock.

the existing dependency chain (in reverse order) is:

-> #1 (>info_lock){+.+...}:
   [] lock_acquire+0x99/0x1e0
   [] mutex_lock_nested+0x93/0x410
   [] uio_mmap+0x2d/0x170 [uio]
   [] mmap_region+0x428/0x650
   [] do_mmap+0x3b8/0x4e0
   [] vm_mmap_pgoff+0xd3/0x120
   [] SyS_mmap_pgoff+0x1f1/0x270
   [] SyS_mmap+0x22/0x30
   [] system_call_fastpath+0x1c/0x21

-> #0 (>mmap_sem){++}:
   [] __lock_acquire+0xdac/0x15f0
   [] lock_acquire+0x99/0x1e0
   [] might_fault+0x84/0xb0
   [] uio_write+0xb4/0x130 [uio]
   [] vfs_write+0xc3/0x1f0
   [] SyS_write+0x8a/0x100
   [] system_call_fastpath+0x1c/0x21

other info that might help us debug this:
 Possible unsafe locking scenario:
   CPU0CPU1
   
  lock(>info_lock);
   lock(>mmap_sem);
   lock(>info_lock);
  lock(>mmap_sem);

 *** DEADLOCK ***
1 lock held by XXX/1910:
 #0:  (>info_lock){+.+...}, at: [] uio_write+0x46/0x130 
[uio]

stack backtrace:
CPU: 0 PID: 1910 Comm: XXX Kdump: loaded Not tainted #1
Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference 
Platform, BIOS 6.00 05/19/2017
Call Trace:
 [] dump_stack+0x19/0x1b
 [] print_circular_bug+0x1f9/0x207
 [] check_prevs_add+0x957/0x960
 [] __lock_acquire+0xdac/0x15f0
 [] ? mark_held_locks+0xb9/0x140
 [] lock_acquire+0x99/0x1e0
 [] ? might_fault+0x57/0xb0
 [] might_fault+0x84/0xb0
 [] ? might_fault+0x57/0xb0
 [] uio_write+0xb4/0x130 [uio]
 [] vfs_write+0xc3/0x1f0
 [] ? fget_light+0xfc/0x510
 [] SyS_write+0x8a/0x100
 [] system_call_fastpath+0x1c/0x21

Signed-off-by: Xiubo Li 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/uio/uio.c |   16 ++--
 1 file changed, 6 insertions(+), 10 deletions(-)

--- a/drivers/uio/uio.c
+++ b/drivers/uio/uio.c
@@ -622,6 +622,12 @@ static ssize_t uio_write(struct file *fi
ssize_t retval;
s32 irq_on;
 
+   if (count != sizeof(s32))
+   return -EINVAL;
+
+   if (copy_from_user(_on, buf, count))
+   return -EFAULT;
+
mutex_lock(>info_lock);
if (!idev->info) {
retval = -EINVAL;
@@ -633,21 +639,11 @@ static ssize_t uio_write(struct file *fi
goto out;
}
 
-   if (count != sizeof(s32)) {
-   retval = -EINVAL;
-   goto out;
-   }
-
if (!idev->info->irqcontrol) {
retval = -ENOSYS;
goto out;
}
 
-   if (copy_from_user(_on, buf, count)) {
-   retval = -EFAULT;
-   goto out;
-   }
-
retval = idev->info->irqcontrol(idev->info, irq_on);
 
 out:

[PATCH 4.18 087/158] perf c2c report: Fix crash for empty browser

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Jiri Olsa 

[ Upstream commit 73978332572ccf5e364c31e9a70ba953f8202b46 ]

'perf c2c' scans read/write accesses and tries to find false sharing
cases, so when the events it wants were not asked for or ended up not
taking place, we get no histograms.

So do not try to display entry details if there's not any. Currently
this ends up in crash:

  $ perf c2c report # then press 'd'
  perf: Segmentation fault
  $

Committer testing:

Before:

Record a perf.data file without events of interest to 'perf c2c report',
then call it and press 'd':

  # perf record sleep 1
  [ perf record: Woken up 1 times to write data ]
  [ perf record: Captured and wrote 0.001 MB perf.data (6 samples) ]
  # perf c2c report
  perf: Segmentation fault
   backtrace 
  perf[0x5b1d2a]
  /lib64/libc.so.6(+0x346df)[0x7fcb566e36df]
  perf[0x46fcae]
  perf[0x4a9f1e]
  perf[0x4aa220]
  perf(main+0x301)[0x42c561]
  /lib64/libc.so.6(__libc_start_main+0xe9)[0x7fcb566cff29]
  perf(_start+0x29)[0x42c999]
  #

After the patch the segfault doesn't take place, a follow up patch to
tell the user why nothing changes when 'd' is pressed would be good.

Reported-by: ro...@autistici.org
Signed-off-by: Jiri Olsa 
Tested-by: Arnaldo Carvalho de Melo 
Cc: Alexander Shishkin 
Cc: David Ahern 
Cc: Don Zickus 
Cc: Joe Mario 
Cc: Namhyung Kim 
Cc: Peter Zijlstra 
Fixes: f1c5fd4d0bb9 ("perf c2c report: Add TUI cacheline browser")
Link: http://lkml.kernel.org/r/20180724062008.26126-1-jo...@kernel.org
Signed-off-by: Arnaldo Carvalho de Melo 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 tools/perf/builtin-c2c.c |3 +++
 1 file changed, 3 insertions(+)

--- a/tools/perf/builtin-c2c.c
+++ b/tools/perf/builtin-c2c.c
@@ -2349,6 +2349,9 @@ static int perf_c2c__browse_cacheline(st
" s Toggle full length of symbol and source line columns \n"
" q Return back to cacheline list \n";
 
+   if (!he)
+   return 0;
+
/* Display compact version first. */
c2c.symbol_full = false;
 

[PATCH RESEND] mm: don't raise MEMCG_OOM event due to failed high-order allocation

[Roman Gushchin]

The memcg OOM killer is never invoked due to a failed high-order
allocation, however the MEMCG_OOM event can be raised.

As shown below, it can happen under conditions, which are very
far from a real OOM: e.g. there is plenty of clean pagecache
and low memory pressure.

There is no sense in raising an OOM event in such a case,
as it might confuse a user and lead to wrong and excessive actions.

Let's look at the charging path in try_caharge(). If the memory usage
is about memory.max, which is absolutely natural for most memory cgroups,
we try to reclaim some pages. Even if we were able to reclaim
enough memory for the allocation, the following check can fail due to
a race with another concurrent allocation:

if (mem_cgroup_margin(mem_over_limit) >= nr_pages)
goto retry;

For regular pages the following condition will save us from triggering
the OOM:

   if (nr_reclaimed && nr_pages <= (1 << PAGE_ALLOC_COSTLY_ORDER))
   goto retry;

But for high-order allocation this condition will intentionally fail.
The reason behind is that we'll likely fall to regular pages anyway,
so it's ok and even preferred to return ENOMEM.

In this case the idea of raising MEMCG_OOM looks dubious.

Fix this by moving MEMCG_OOM raising to mem_cgroup_oom() after
allocation order check, so that the event won't be raised for high
order allocations. This change doesn't affect regular pages allocation
and charging.

Signed-off-by: Roman Gushchin 
Acked-by: David Rientjes 
Cc: Johannes Weiner 
Cc: Michal Hocko 
Cc: Vladimir Davydov 
---
 mm/memcontrol.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index fcec9b39e2a3..103ca3c31c04 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -1669,6 +1669,8 @@ static enum oom_status mem_cgroup_oom(struct mem_cgroup 
*memcg, gfp_t mask, int
if (order > PAGE_ALLOC_COSTLY_ORDER)
return OOM_SKIPPED;
 
+   memcg_memory_event(memcg, MEMCG_OOM);
+
/*
 * We are in the middle of the charge context here, so we
 * don't want to block when potentially sitting on a callstack
@@ -2250,8 +2252,6 @@ static int try_charge(struct mem_cgroup *memcg, gfp_t 
gfp_mask,
if (fatal_signal_pending(current))
goto force;
 
-   memcg_memory_event(mem_over_limit, MEMCG_OOM);
-
/*
 * keep retrying as long as the memcg oom killer is able to make
 * a forward progress or bypass the charge if the oom killer
-- 
2.17.1

[PATCH 4.18 044/158] tc-testing: remove duplicate spaces in connmark match patterns

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Vlad Buslov 

[ Upstream commit 757a9a39d483ae415a712388c33d4042a98b751f ]

Match patterns for some connmark tests contain duplicate whitespace that is
not present in actual tc output. This causes tests to fail because they
can't match required action, even when it was successfully created.

Fixes: 1dad0f97 ("tc-testing: add connmark action tests")
Signed-off-by: Vlad Buslov 
Acked-by: Jamal Hadi Salim 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 tools/testing/selftests/tc-testing/tc-tests/actions/connmark.json |   24 
+-
 1 file changed, 12 insertions(+), 12 deletions(-)

--- a/tools/testing/selftests/tc-testing/tc-tests/actions/connmark.json
+++ b/tools/testing/selftests/tc-testing/tc-tests/actions/connmark.json
@@ -17,7 +17,7 @@
 "cmdUnderTest": "$TC actions add action connmark",
 "expExitCode": "0",
 "verifyCmd": "$TC actions list action connmark",
-"matchPattern": "action order [0-9]+:  connmark zone 0 pipe",
+"matchPattern": "action order [0-9]+: connmark zone 0 pipe",
 "matchCount": "1",
 "teardown": [
 "$TC actions flush action connmark"
@@ -41,7 +41,7 @@
 "cmdUnderTest": "$TC actions add action connmark pass index 1",
 "expExitCode": "0",
 "verifyCmd": "$TC actions get action connmark index 1",
-"matchPattern": "action order [0-9]+:  connmark zone 0 pass.*index 1 
ref",
+"matchPattern": "action order [0-9]+: connmark zone 0 pass.*index 1 
ref",
 "matchCount": "1",
 "teardown": [
 "$TC actions flush action connmark"
@@ -65,7 +65,7 @@
 "cmdUnderTest": "$TC actions add action connmark drop index 100",
 "expExitCode": "0",
 "verifyCmd": "$TC actions get action connmark index 100",
-"matchPattern": "action order [0-9]+:  connmark zone 0 drop.*index 100 
ref",
+"matchPattern": "action order [0-9]+: connmark zone 0 drop.*index 100 
ref",
 "matchCount": "1",
 "teardown": [
 "$TC actions flush action connmark"
@@ -89,7 +89,7 @@
 "cmdUnderTest": "$TC actions add action connmark pipe index 455",
 "expExitCode": "0",
 "verifyCmd": "$TC actions get action connmark index 455",
-"matchPattern": "action order [0-9]+:  connmark zone 0 pipe.*index 455 
ref",
+"matchPattern": "action order [0-9]+: connmark zone 0 pipe.*index 455 
ref",
 "matchCount": "1",
 "teardown": [
 "$TC actions flush action connmark"
@@ -113,7 +113,7 @@
 "cmdUnderTest": "$TC actions add action connmark reclassify index 7",
 "expExitCode": "0",
 "verifyCmd": "$TC actions list action connmark",
-"matchPattern": "action order [0-9]+:  connmark zone 0 
reclassify.*index 7 ref",
+"matchPattern": "action order [0-9]+: connmark zone 0 
reclassify.*index 7 ref",
 "matchCount": "1",
 "teardown": [
 "$TC actions flush action connmark"
@@ -137,7 +137,7 @@
 "cmdUnderTest": "$TC actions add action connmark continue index 17",
 "expExitCode": "0",
 "verifyCmd": "$TC actions list action connmark",
-"matchPattern": "action order [0-9]+:  connmark zone 0 continue.*index 
17 ref",
+"matchPattern": "action order [0-9]+: connmark zone 0 continue.*index 
17 ref",
 "matchCount": "1",
 "teardown": [
 "$TC actions flush action connmark"
@@ -161,7 +161,7 @@
 "cmdUnderTest": "$TC actions add action connmark jump 10 index 17",
 "expExitCode": "0",
 "verifyCmd": "$TC actions list action connmark",
-"matchPattern": "action order [0-9]+:  connmark zone 0 jump 10.*index 
17 ref",
+"matchPattern": "action order [0-9]+: connmark zone 0 jump 10.*index 
17 ref",
 "matchCount": "1",
 "teardown": [
 "$TC actions flush action connmark"
@@ -185,7 +185,7 @@
 "cmdUnderTest": "$TC actions add action connmark zone 100 pipe index 
1",
 "expExitCode": "0",
 "verifyCmd": "$TC actions get action connmark index 1",
-"matchPattern": "action order [0-9]+:  connmark zone 100 pipe.*index 1 
ref",
+"matchPattern": "action order [0-9]+: connmark zone 100 pipe.*index 1 
ref",
 "matchCount": "1",
 "teardown": [
 "$TC actions flush action connmark"
@@ -209,7 +209,7 @@
 "cmdUnderTest": "$TC actions add action connmark zone 65536 reclassify 
index 21",
 "expExitCode": "255",
 "verifyCmd": "$TC actions get action connmark index 1",
-"matchPattern": "action order [0-9]+:  connmark zone 65536 
reclassify.*index 21 ref",
+"matchPattern": "action order [0-9]+: connmark zone 65536 
reclassify.*index 21 ref",
 "matchCount": "0",
 "teardown": [
   

[PATCH 4.18 092/158] ath9k: report tx status on EOSP

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Felix Fietkau 

[ Upstream commit 36e14a787dd0b459760de3622e9709edb745a6af ]

Fixes missed indications of end of U-APSD service period to mac80211

Signed-off-by: Felix Fietkau 
Signed-off-by: Kalle Valo 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/net/wireless/ath/ath9k/xmit.c |3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -86,7 +86,8 @@ static void ath_tx_status(struct ieee802
struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
struct ieee80211_sta *sta = info->status.status_driver_data[0];
 
-   if (info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS) {
+   if (info->flags & (IEEE80211_TX_CTL_REQ_TX_STATUS |
+  IEEE80211_TX_STATUS_EOSP)) {
ieee80211_tx_status(hw, skb);
return;
}

[PATCH 4.18 089/158] powerpc/pseries: fix EEH recovery of some IOV devices

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Sam Bobroff 

[ Upstream commit b87b9cf4935325c98522823caeddd333022a1c62 ]

EEH recovery currently fails on pSeries for some IOV capable PCI
devices, if CONFIG_PCI_IOV is on and the hypervisor doesn't provide
certain device tree properties for the device. (Found on an IOV
capable device using the ipr driver.)

Recovery fails in pci_enable_resources() at the check on r->parent,
because r->flags is set and r->parent is not.  This state is due to
sriov_init() setting the start, end and flags members of the IOV BARs
but the parent not being set later in
pseries_pci_fixup_iov_resources(), because the
"ibm,open-sriov-vf-bar-info" property is missing.

Correct this by zeroing the resource flags for IOV BARs when they
can't be configured (this is the same method used by sriov_init() and
__pci_read_base()).

VFs cleared this way can't be enabled later, because that requires
another device tree property, "ibm,number-of-configurable-vfs" as well
as support for the RTAS function "ibm_map_pes". These are all part of
hypervisor support for IOV and it seems unlikely that a hypervisor
would ever partially, but not fully, support it. (None are currently
provided by QEMU/KVM.)

Signed-off-by: Sam Bobroff 
Reviewed-by: Bryant G. Ly 
Signed-off-by: Michael Ellerman 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 arch/powerpc/platforms/pseries/setup.c |   25 +
 1 file changed, 17 insertions(+), 8 deletions(-)

--- a/arch/powerpc/platforms/pseries/setup.c
+++ b/arch/powerpc/platforms/pseries/setup.c
@@ -647,6 +647,15 @@ void of_pci_parse_iov_addrs(struct pci_d
}
 }
 
+static void pseries_disable_sriov_resources(struct pci_dev *pdev)
+{
+   int i;
+
+   pci_warn(pdev, "No hypervisor support for SR-IOV on this device, IOV 
BARs disabled.\n");
+   for (i = 0; i < PCI_SRIOV_NUM_BARS; i++)
+   pdev->resource[i + PCI_IOV_RESOURCES].flags = 0;
+}
+
 static void pseries_pci_fixup_resources(struct pci_dev *pdev)
 {
const int *indexes;
@@ -654,10 +663,10 @@ static void pseries_pci_fixup_resources(
 
/*Firmware must support open sriov otherwise dont configure*/
indexes = of_get_property(dn, "ibm,open-sriov-vf-bar-info", NULL);
-   if (!indexes)
-   return;
-   /* Assign the addresses from device tree*/
-   of_pci_set_vf_bar_size(pdev, indexes);
+   if (indexes)
+   of_pci_set_vf_bar_size(pdev, indexes);
+   else
+   pseries_disable_sriov_resources(pdev);
 }
 
 static void pseries_pci_fixup_iov_resources(struct pci_dev *pdev)
@@ -669,10 +678,10 @@ static void pseries_pci_fixup_iov_resour
return;
/*Firmware must support open sriov otherwise dont configure*/
indexes = of_get_property(dn, "ibm,open-sriov-vf-bar-info", NULL);
-   if (!indexes)
-   return;
-   /* Assign the addresses from device tree*/
-   of_pci_parse_iov_addrs(pdev, indexes);
+   if (indexes)
+   of_pci_parse_iov_addrs(pdev, indexes);
+   else
+   pseries_disable_sriov_resources(pdev);
 }
 
 static resource_size_t pseries_pci_iov_resource_alignment(struct pci_dev *pdev,

[PATCH 4.18 088/158] perf evlist: Fix error out while applying initial delay and LBR

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Kan Liang 

[ Upstream commit 95035c5e167ae6e740b1ddd30210ae0eaf39a5db ]

'perf record' will error out if both --delay and LBR are applied.

For example:

  # perf record -D 1000 -a -e cycles -j any -- sleep 2
  Error:
  dummy:HG: PMU Hardware doesn't support sampling/overflow-interrupts.
  Try 'perf stat'
  #

A dummy event is added implicitly for initial delay, which has the same
configurations as real sampling events. The dummy event is a software
event. If LBR is configured, perf must error out.

The dummy event will only be used to track PERF_RECORD_MMAP while perf
waits for the initial delay to enable the real events. The BRANCH_STACK
bit can be safely cleared for the dummy event.

After applying the patch:

  # perf record -D 1000 -a -e cycles -j any -- sleep 2
  [ perf record: Woken up 1 times to write data ]
  [ perf record: Captured and wrote 1.054 MB perf.data (828 samples) ]
  #

Reported-by: Sunil K Pandey 
Signed-off-by: Kan Liang 
Acked-by: Jiri Olsa 
Tested-by: Arnaldo Carvalho de Melo 
Cc: Andi Kleen 
Cc: Namhyung Kim 
Cc: Peter Zijlstra 
Link: 
http://lkml.kernel.org/r/1531145722-16404-1-git-send-email-kan.li...@linux.intel.com
Signed-off-by: Arnaldo Carvalho de Melo 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 tools/perf/util/evsel.c |   14 ++
 1 file changed, 14 insertions(+)

--- a/tools/perf/util/evsel.c
+++ b/tools/perf/util/evsel.c
@@ -848,6 +848,12 @@ static void apply_config_terms(struct pe
}
 }
 
+static bool is_dummy_event(struct perf_evsel *evsel)
+{
+   return (evsel->attr.type == PERF_TYPE_SOFTWARE) &&
+  (evsel->attr.config == PERF_COUNT_SW_DUMMY);
+}
+
 /*
  * The enable_on_exec/disabled value strategy:
  *
@@ -1086,6 +1092,14 @@ void perf_evsel__config(struct perf_evse
else
perf_evsel__reset_sample_bit(evsel, PERIOD);
}
+
+   /*
+* For initial_delay, a dummy event is added implicitly.
+* The software event will trigger -EOPNOTSUPP error out,
+* if BRANCH_STACK bit is set.
+*/
+   if (opts->initial_delay && is_dummy_event(evsel))
+   perf_evsel__reset_sample_bit(evsel, BRANCH_STACK);
 }
 
 static int perf_evsel__alloc_fd(struct perf_evsel *evsel, int ncpus, int 
nthreads)

[PATCH 4.18 085/158] device-dax: avoid hang on error before devm_memremap_pages()

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Stefan Hajnoczi 

[ Upstream commit b7751410c180a05fdc21268f8661b1480169b0df ]

dax_pmem_percpu_exit() waits for dax_pmem_percpu_release() to invoke the
dax_pmem->cmp completion.  Unfortunately this approach to cleaning up
the percpu_ref only works after devm_memremap_pages() was successful.

If devm_add_action_or_reset() or devm_memremap_pages() fails,
dax_pmem_percpu_release() is not invoked.  Therefore
dax_pmem_percpu_exit() hangs waiting for the completion:

  rc = devm_add_action_or_reset(dev, dax_pmem_percpu_exit,
_pmem->ref);
  if (rc)
return rc;

  dax_pmem->pgmap.ref = _pmem->ref;
  addr = devm_memremap_pages(dev, _pmem->pgmap);

Avoid the hang by calling percpu_ref_exit() in the error paths instead
of going through dax_pmem_percpu_exit().

Signed-off-by: Stefan Hajnoczi 
Signed-off-by: Dave Jiang 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/dax/pmem.c |   12 
 1 file changed, 8 insertions(+), 4 deletions(-)

--- a/drivers/dax/pmem.c
+++ b/drivers/dax/pmem.c
@@ -105,15 +105,19 @@ static int dax_pmem_probe(struct device
if (rc)
return rc;
 
-   rc = devm_add_action_or_reset(dev, dax_pmem_percpu_exit,
-   _pmem->ref);
-   if (rc)
+   rc = devm_add_action(dev, dax_pmem_percpu_exit, _pmem->ref);
+   if (rc) {
+   percpu_ref_exit(_pmem->ref);
return rc;
+   }
 
dax_pmem->pgmap.ref = _pmem->ref;
addr = devm_memremap_pages(dev, _pmem->pgmap);
-   if (IS_ERR(addr))
+   if (IS_ERR(addr)) {
+   devm_remove_action(dev, dax_pmem_percpu_exit, _pmem->ref);
+   percpu_ref_exit(_pmem->ref);
return PTR_ERR(addr);
+   }
 
rc = devm_add_action_or_reset(dev, dax_pmem_percpu_kill,
_pmem->ref);

[PATCH 4.18 083/158] ASoC: soc-pcm: Use delay set in component pointer function

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Akshu Agrawal 

[ Upstream commit 9fb4c2bf130b922c77c16a8368732699799c40de ]

Take into account the base delay set in pointer callback.

There are cases where a pointer function populates
runtime->delay, such as:
./sound/pci/hda/hda_controller.c
./sound/soc/intel/atom/sst-mfld-platform-pcm.c

This delay was getting lost and was overwritten by delays
from codec or cpu dai delay function if exposed.

Now,
Total delay = base delay + cpu_dai delay + codec_dai delay

Signed-off-by: Akshu Agrawal 
Reviewed-by: Takashi Iwai 
Signed-off-by: Mark Brown 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 sound/soc/soc-pcm.c |5 +
 1 file changed, 5 insertions(+)

--- a/sound/soc/soc-pcm.c
+++ b/sound/soc/soc-pcm.c
@@ -1165,6 +1165,9 @@ static snd_pcm_uframes_t soc_pcm_pointer
snd_pcm_sframes_t codec_delay = 0;
int i;
 
+   /* clearing the previous total delay */
+   runtime->delay = 0;
+
for_each_rtdcom(rtd, rtdcom) {
component = rtdcom->component;
 
@@ -1176,6 +1179,8 @@ static snd_pcm_uframes_t soc_pcm_pointer
offset = component->driver->ops->pointer(substream);
break;
}
+   /* base delay if assigned in pointer callback */
+   delay = runtime->delay;
 
if (cpu_dai->driver->ops->delay)
delay += cpu_dai->driver->ops->delay(substream, cpu_dai);

Re: [PATCH 16/18] LSM: Allow arbitrary LSM ordering

[Mickaël Salaün]

On 9/18/18 00:36, John Johansen wrote:
> On 09/17/2018 02:57 PM, Casey Schaufler wrote:
>> On 9/17/2018 12:55 PM, John Johansen wrote:
>>> On 09/17/2018 12:23 PM, Casey Schaufler wrote:
 On 9/17/2018 11:14 AM, Kees Cook wrote:
>> Keep security=$lsm with the existing exclusive behavior.
>> Add lsm=$lsm1,...,$lsmN which requires a full list of modules
>>
>> If you want to be fancy (I don't!) you could add
>>
>> lsm.add=$lsm1,...,$lsmN which adds the modules to the stack
>> lsm.delete=$lsm1,...,$lsmN which deletes modules from the stack
> We've got two issues: ordering and enablement. It's been strongly
> suggested that we should move away from per-LSM enable/disable flags
> (to which I agree).
 I also agree. There are way too many ways to turn off some LSMs.

>>> I wont disagree, but its largely because we didn't have this discussion
>>> when we should have.
>>
>> True that.
>>
>>
> If ordering should be separate from enablement (to
> avoid the "booted kernel with new LSM built in, but my lsm="..." line
> didn't include it so it's disabled case), then I think we need to
> split the logic (otherwise we just reinvented "security=" with similar
> problems).
 We could reduce the problem by declaring that LSM ordering is
 not something you can specify on the boot line. I can see value
 in specifying it when you build the kernel, but your circumstances
 would have to be pretty strange to change it at boot time.

>>> if there is LSM ordering the getting
>>>
>>>   lsm=B,A,C
>>>
>>> is not the behavior I would expect from specifying
>>>
>>>   lsm=A,B,C
>>
>> Right. You'd expect that they'd be used in the order specified.
>>
> 
> and yet you argue for something different ;)
> 
> Should "lsm=" allow arbitrary ordering? (I think yes.)
 I say no. Assume you can specify it at build time. When would
 you want to change the order? Why would you?

>>> because maybe you care about the denial message from one LSM more than
>>> you do from another. Since stacking is bail on first fail the order
>>> could be important from an auditing POV
>>
>> I understand that a distribution would want to specify the order
>> for support purposes and that a developer would want to specify
>> the order to ensure reproducible behavior. But they are going to
>> be controlling their kernel builds. I'm not suggesting that the
>> order shouldn't be capable of build time specification. What I
>> don't see is a reason to rearrange it at boot time.
>>
> 
> Because not all users have the same priority as the distro. It can
> also aid in debugging and testing of LSMs in a stacked situation.
> 
>>> Auditing is why apparmor's internal stacking is not bail on first
>>> fail.
>>
>> Within a security module I get that. But we've already got the
>> priority wrong for audit in general, because you only get to the
>> LSM if the traditional code approves. Every guidance I ever got
> 
> true
> 
>> said you should do the MAC checks first, because you're much more
>> concerned about getting audit records about MAC failures than DAC.
>>
> 
> yep, wouldn't that be nice to have
> 
> Should "lsm=" imply implicit enable/disable? (I think no: unlisted
> LSMs are implicitly auto-appended to the explicit list)
 If you want to add something that isn't there instead of making
 it explicit you want "lsm.enable=" not "lsm=".

> So then we could have "lsm.enable=..." and "lsm.disable=...".
>
> If builtin list was:
> capability,yama,loadpin,integrity,{selinux,smack,tomoyo,apparmor}
> then:
>
> lsm.disable=loadpin lsm=smack
 Methinks this should be lsm.disable=loadpin lsm.enable=smack

>>> that would only work if order is not important
>>
>> It works unless you want to change the order at boot, and
>> I still don't see a use case for that.
> 
> see above
> 
>>
> becomes
>
> capability,smack,yama,integrity
>
> and
>
> CONFIG_SECURITY_LOADPIN_DEFAULT_ENABLED=n
> selinux.enable=0 lsm.add=loadpin lsm.disable=smack,tomoyo 
> lsm=integrity
 Do you mean
selinux.enable=0 lsm.enable=loadpin lsm.disable=smack,tomoyo 
 lsm.enable=integrity
selinux.enable=0 lsm.enable=loadpin,integrity lsm.disable=smack,tomoyo
selinux.enable=0 lsm.enable=loadpin lsm.enable=integrity 
 lsm.disable=smack lsm.disable=tomoyo

> becomes
>
> capability,integrity,yama,loadpin,apparmor
>
>
> If "lsm=" _does_ imply enablement, then how does it interact with
> per-LSM disabling? i.e. what does "apparmor.enabled=0
> lsm=yama,apparmor" mean? If it means "turn on apparmor" how do I turn
> on a CONFIG-default-off LSM without specifying all the other LSMs too?
 There should either be one option "lsm=", which is an explicit list or
 two, "lsm.enable=" and "lsm.disable", which modify the built in default.

>>> maybe but 

[PATCH 4.18 090/158] macintosh/via-pmu: Add missing mmio accessors

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Finn Thain 

[ Upstream commit 576d5290d678a651b9f36050fc1717e0573aca13 ]

Add missing in_8() accessors to init_pmu() and pmu_sr_intr().

This fixes several sparse warnings:
drivers/macintosh/via-pmu.c:536:29: warning: dereference of noderef expression
drivers/macintosh/via-pmu.c:537:33: warning: dereference of noderef expression
drivers/macintosh/via-pmu.c:1455:17: warning: dereference of noderef expression
drivers/macintosh/via-pmu.c:1456:69: warning: dereference of noderef expression

Tested-by: Stan Johnson 
Signed-off-by: Finn Thain 
Reviewed-by: Geert Uytterhoeven 
Signed-off-by: Michael Ellerman 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/macintosh/via-pmu.c |9 +
 1 file changed, 5 insertions(+), 4 deletions(-)

--- a/drivers/macintosh/via-pmu.c
+++ b/drivers/macintosh/via-pmu.c
@@ -534,8 +534,9 @@ init_pmu(void)
int timeout;
struct adb_request req;
 
-   out_8([B], via[B] | TREQ);  /* negate TREQ */
-   out_8([DIRB], (via[DIRB] | TREQ) & ~TACK);  /* TACK in, TREQ out */
+   /* Negate TREQ. Set TACK to input and TREQ to output. */
+   out_8([B], in_8([B]) | TREQ);
+   out_8([DIRB], (in_8([DIRB]) | TREQ) & ~TACK);
 
pmu_request(, NULL, 2, PMU_SET_INTR_MASK, pmu_intr_mask);
timeout =  10;
@@ -1418,8 +1419,8 @@ pmu_sr_intr(void)
struct adb_request *req;
int bite = 0;
 
-   if (via[B] & TREQ) {
-   printk(KERN_ERR "PMU: spurious SR intr (%x)\n", via[B]);
+   if (in_8([B]) & TREQ) {
+   printk(KERN_ERR "PMU: spurious SR intr (%x)\n", in_8([B]));
out_8([IFR], SR_INT);
return NULL;
}

[PATCH 4.18 035/158] cpu/hotplug: Adjust misplaced smb() in cpuhp_thread_fun()

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Neeraj Upadhyay 

commit f8b7530aa0a1def79c93101216b5b17cf408a70a upstream.

The smp_mb() in cpuhp_thread_fun() is misplaced. It needs to be after the
load of st->should_run to prevent reordering of the later load/stores
w.r.t. the load of st->should_run.

Fixes: 4dddfb5faa61 ("smp/hotplug: Rewrite AP state machine core")
Signed-off-by: Neeraj Upadhyay 
Signed-off-by: Thomas Gleixner 
Acked-by: Peter Zijlstra (Intel) 
Cc: j...@joshtriplett.org
Cc: pet...@infradead.org
Cc: jiangshan...@gmail.com
Cc: dzic...@redhat.com
Cc: brendan.jack...@arm.com
Cc: ma...@debian.org
Cc: mo...@codeaurora.org
Cc: sram...@codeaurora.org
Cc: linux-arm-...@vger.kernel.org
Cc: sta...@vger.kernel.org
Link: 
https://lkml.kernel.org/r/1536126727-11629-1-git-send-email-neer...@codeaurora.org
Signed-off-by: Greg Kroah-Hartman 

---
 kernel/cpu.c |6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -608,15 +608,15 @@ static void cpuhp_thread_fun(unsigned in
bool bringup = st->bringup;
enum cpuhp_state state;
 
+   if (WARN_ON_ONCE(!st->should_run))
+   return;
+
/*
 * ACQUIRE for the cpuhp_should_run() load of ->should_run. Ensures
 * that if we see ->should_run we also see the rest of the state.
 */
smp_mb();
 
-   if (WARN_ON_ONCE(!st->should_run))
-   return;
-
cpuhp_lock_acquire(bringup);
 
if (st->single) {

[PATCH 4.18 074/158] uio: fix possible circular locking dependency

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Xiubo Li 

[ Upstream commit b34e9a15b37b8ddbf06a4da142b0c39c74211eb4 ]

The call trace:
XXX/1910 is trying to acquire lock:
 (>mmap_sem){++}, at: [] might_fault+0x57/0xb0

but task is already holding lock:
 (>info_lock){+.+...}, at: [] uio_write+0x46/0x130 [uio]

which lock already depends on the new lock.

the existing dependency chain (in reverse order) is:

-> #1 (>info_lock){+.+...}:
   [] lock_acquire+0x99/0x1e0
   [] mutex_lock_nested+0x93/0x410
   [] uio_mmap+0x2d/0x170 [uio]
   [] mmap_region+0x428/0x650
   [] do_mmap+0x3b8/0x4e0
   [] vm_mmap_pgoff+0xd3/0x120
   [] SyS_mmap_pgoff+0x1f1/0x270
   [] SyS_mmap+0x22/0x30
   [] system_call_fastpath+0x1c/0x21

-> #0 (>mmap_sem){++}:
   [] __lock_acquire+0xdac/0x15f0
   [] lock_acquire+0x99/0x1e0
   [] might_fault+0x84/0xb0
   [] uio_write+0xb4/0x130 [uio]
   [] vfs_write+0xc3/0x1f0
   [] SyS_write+0x8a/0x100
   [] system_call_fastpath+0x1c/0x21

other info that might help us debug this:
 Possible unsafe locking scenario:
   CPU0CPU1
   
  lock(>info_lock);
   lock(>mmap_sem);
   lock(>info_lock);
  lock(>mmap_sem);

 *** DEADLOCK ***
1 lock held by XXX/1910:
 #0:  (>info_lock){+.+...}, at: [] uio_write+0x46/0x130 
[uio]

stack backtrace:
CPU: 0 PID: 1910 Comm: XXX Kdump: loaded Not tainted #1
Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference 
Platform, BIOS 6.00 05/19/2017
Call Trace:
 [] dump_stack+0x19/0x1b
 [] print_circular_bug+0x1f9/0x207
 [] check_prevs_add+0x957/0x960
 [] __lock_acquire+0xdac/0x15f0
 [] ? mark_held_locks+0xb9/0x140
 [] lock_acquire+0x99/0x1e0
 [] ? might_fault+0x57/0xb0
 [] might_fault+0x84/0xb0
 [] ? might_fault+0x57/0xb0
 [] uio_write+0xb4/0x130 [uio]
 [] vfs_write+0xc3/0x1f0
 [] ? fget_light+0xfc/0x510
 [] SyS_write+0x8a/0x100
 [] system_call_fastpath+0x1c/0x21

Signed-off-by: Xiubo Li 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/uio/uio.c |   16 ++--
 1 file changed, 6 insertions(+), 10 deletions(-)

--- a/drivers/uio/uio.c
+++ b/drivers/uio/uio.c
@@ -622,6 +622,12 @@ static ssize_t uio_write(struct file *fi
ssize_t retval;
s32 irq_on;
 
+   if (count != sizeof(s32))
+   return -EINVAL;
+
+   if (copy_from_user(_on, buf, count))
+   return -EFAULT;
+
mutex_lock(>info_lock);
if (!idev->info) {
retval = -EINVAL;
@@ -633,21 +639,11 @@ static ssize_t uio_write(struct file *fi
goto out;
}
 
-   if (count != sizeof(s32)) {
-   retval = -EINVAL;
-   goto out;
-   }
-
if (!idev->info->irqcontrol) {
retval = -ENOSYS;
goto out;
}
 
-   if (copy_from_user(_on, buf, count)) {
-   retval = -EFAULT;
-   goto out;
-   }
-
retval = idev->info->irqcontrol(idev->info, irq_on);
 
 out:

[PATCH 4.18 087/158] perf c2c report: Fix crash for empty browser

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Jiri Olsa 

[ Upstream commit 73978332572ccf5e364c31e9a70ba953f8202b46 ]

'perf c2c' scans read/write accesses and tries to find false sharing
cases, so when the events it wants were not asked for or ended up not
taking place, we get no histograms.

So do not try to display entry details if there's not any. Currently
this ends up in crash:

  $ perf c2c report # then press 'd'
  perf: Segmentation fault
  $

Committer testing:

Before:

Record a perf.data file without events of interest to 'perf c2c report',
then call it and press 'd':

  # perf record sleep 1
  [ perf record: Woken up 1 times to write data ]
  [ perf record: Captured and wrote 0.001 MB perf.data (6 samples) ]
  # perf c2c report
  perf: Segmentation fault
   backtrace 
  perf[0x5b1d2a]
  /lib64/libc.so.6(+0x346df)[0x7fcb566e36df]
  perf[0x46fcae]
  perf[0x4a9f1e]
  perf[0x4aa220]
  perf(main+0x301)[0x42c561]
  /lib64/libc.so.6(__libc_start_main+0xe9)[0x7fcb566cff29]
  perf(_start+0x29)[0x42c999]
  #

After the patch the segfault doesn't take place, a follow up patch to
tell the user why nothing changes when 'd' is pressed would be good.

Reported-by: ro...@autistici.org
Signed-off-by: Jiri Olsa 
Tested-by: Arnaldo Carvalho de Melo 
Cc: Alexander Shishkin 
Cc: David Ahern 
Cc: Don Zickus 
Cc: Joe Mario 
Cc: Namhyung Kim 
Cc: Peter Zijlstra 
Fixes: f1c5fd4d0bb9 ("perf c2c report: Add TUI cacheline browser")
Link: http://lkml.kernel.org/r/20180724062008.26126-1-jo...@kernel.org
Signed-off-by: Arnaldo Carvalho de Melo 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 tools/perf/builtin-c2c.c |3 +++
 1 file changed, 3 insertions(+)

--- a/tools/perf/builtin-c2c.c
+++ b/tools/perf/builtin-c2c.c
@@ -2349,6 +2349,9 @@ static int perf_c2c__browse_cacheline(st
" s Toggle full length of symbol and source line columns \n"
" q Return back to cacheline list \n";
 
+   if (!he)
+   return 0;
+
/* Display compact version first. */
c2c.symbol_full = false;
 

[PATCH RESEND] mm: don't raise MEMCG_OOM event due to failed high-order allocation

[Roman Gushchin]

The memcg OOM killer is never invoked due to a failed high-order
allocation, however the MEMCG_OOM event can be raised.

As shown below, it can happen under conditions, which are very
far from a real OOM: e.g. there is plenty of clean pagecache
and low memory pressure.

There is no sense in raising an OOM event in such a case,
as it might confuse a user and lead to wrong and excessive actions.

Let's look at the charging path in try_caharge(). If the memory usage
is about memory.max, which is absolutely natural for most memory cgroups,
we try to reclaim some pages. Even if we were able to reclaim
enough memory for the allocation, the following check can fail due to
a race with another concurrent allocation:

if (mem_cgroup_margin(mem_over_limit) >= nr_pages)
goto retry;

For regular pages the following condition will save us from triggering
the OOM:

   if (nr_reclaimed && nr_pages <= (1 << PAGE_ALLOC_COSTLY_ORDER))
   goto retry;

But for high-order allocation this condition will intentionally fail.
The reason behind is that we'll likely fall to regular pages anyway,
so it's ok and even preferred to return ENOMEM.

In this case the idea of raising MEMCG_OOM looks dubious.

Fix this by moving MEMCG_OOM raising to mem_cgroup_oom() after
allocation order check, so that the event won't be raised for high
order allocations. This change doesn't affect regular pages allocation
and charging.

Signed-off-by: Roman Gushchin 
Acked-by: David Rientjes 
Cc: Johannes Weiner 
Cc: Michal Hocko 
Cc: Vladimir Davydov 
---
 mm/memcontrol.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index fcec9b39e2a3..103ca3c31c04 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -1669,6 +1669,8 @@ static enum oom_status mem_cgroup_oom(struct mem_cgroup 
*memcg, gfp_t mask, int
if (order > PAGE_ALLOC_COSTLY_ORDER)
return OOM_SKIPPED;
 
+   memcg_memory_event(memcg, MEMCG_OOM);
+
/*
 * We are in the middle of the charge context here, so we
 * don't want to block when potentially sitting on a callstack
@@ -2250,8 +2252,6 @@ static int try_charge(struct mem_cgroup *memcg, gfp_t 
gfp_mask,
if (fatal_signal_pending(current))
goto force;
 
-   memcg_memory_event(mem_over_limit, MEMCG_OOM);
-
/*
 * keep retrying as long as the memcg oom killer is able to make
 * a forward progress or bypass the charge if the oom killer
-- 
2.17.1

[PATCH 4.18 044/158] tc-testing: remove duplicate spaces in connmark match patterns

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Vlad Buslov 

[ Upstream commit 757a9a39d483ae415a712388c33d4042a98b751f ]

Match patterns for some connmark tests contain duplicate whitespace that is
not present in actual tc output. This causes tests to fail because they
can't match required action, even when it was successfully created.

Fixes: 1dad0f97 ("tc-testing: add connmark action tests")
Signed-off-by: Vlad Buslov 
Acked-by: Jamal Hadi Salim 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 tools/testing/selftests/tc-testing/tc-tests/actions/connmark.json |   24 
+-
 1 file changed, 12 insertions(+), 12 deletions(-)

--- a/tools/testing/selftests/tc-testing/tc-tests/actions/connmark.json
+++ b/tools/testing/selftests/tc-testing/tc-tests/actions/connmark.json
@@ -17,7 +17,7 @@
 "cmdUnderTest": "$TC actions add action connmark",
 "expExitCode": "0",
 "verifyCmd": "$TC actions list action connmark",
-"matchPattern": "action order [0-9]+:  connmark zone 0 pipe",
+"matchPattern": "action order [0-9]+: connmark zone 0 pipe",
 "matchCount": "1",
 "teardown": [
 "$TC actions flush action connmark"
@@ -41,7 +41,7 @@
 "cmdUnderTest": "$TC actions add action connmark pass index 1",
 "expExitCode": "0",
 "verifyCmd": "$TC actions get action connmark index 1",
-"matchPattern": "action order [0-9]+:  connmark zone 0 pass.*index 1 
ref",
+"matchPattern": "action order [0-9]+: connmark zone 0 pass.*index 1 
ref",
 "matchCount": "1",
 "teardown": [
 "$TC actions flush action connmark"
@@ -65,7 +65,7 @@
 "cmdUnderTest": "$TC actions add action connmark drop index 100",
 "expExitCode": "0",
 "verifyCmd": "$TC actions get action connmark index 100",
-"matchPattern": "action order [0-9]+:  connmark zone 0 drop.*index 100 
ref",
+"matchPattern": "action order [0-9]+: connmark zone 0 drop.*index 100 
ref",
 "matchCount": "1",
 "teardown": [
 "$TC actions flush action connmark"
@@ -89,7 +89,7 @@
 "cmdUnderTest": "$TC actions add action connmark pipe index 455",
 "expExitCode": "0",
 "verifyCmd": "$TC actions get action connmark index 455",
-"matchPattern": "action order [0-9]+:  connmark zone 0 pipe.*index 455 
ref",
+"matchPattern": "action order [0-9]+: connmark zone 0 pipe.*index 455 
ref",
 "matchCount": "1",
 "teardown": [
 "$TC actions flush action connmark"
@@ -113,7 +113,7 @@
 "cmdUnderTest": "$TC actions add action connmark reclassify index 7",
 "expExitCode": "0",
 "verifyCmd": "$TC actions list action connmark",
-"matchPattern": "action order [0-9]+:  connmark zone 0 
reclassify.*index 7 ref",
+"matchPattern": "action order [0-9]+: connmark zone 0 
reclassify.*index 7 ref",
 "matchCount": "1",
 "teardown": [
 "$TC actions flush action connmark"
@@ -137,7 +137,7 @@
 "cmdUnderTest": "$TC actions add action connmark continue index 17",
 "expExitCode": "0",
 "verifyCmd": "$TC actions list action connmark",
-"matchPattern": "action order [0-9]+:  connmark zone 0 continue.*index 
17 ref",
+"matchPattern": "action order [0-9]+: connmark zone 0 continue.*index 
17 ref",
 "matchCount": "1",
 "teardown": [
 "$TC actions flush action connmark"
@@ -161,7 +161,7 @@
 "cmdUnderTest": "$TC actions add action connmark jump 10 index 17",
 "expExitCode": "0",
 "verifyCmd": "$TC actions list action connmark",
-"matchPattern": "action order [0-9]+:  connmark zone 0 jump 10.*index 
17 ref",
+"matchPattern": "action order [0-9]+: connmark zone 0 jump 10.*index 
17 ref",
 "matchCount": "1",
 "teardown": [
 "$TC actions flush action connmark"
@@ -185,7 +185,7 @@
 "cmdUnderTest": "$TC actions add action connmark zone 100 pipe index 
1",
 "expExitCode": "0",
 "verifyCmd": "$TC actions get action connmark index 1",
-"matchPattern": "action order [0-9]+:  connmark zone 100 pipe.*index 1 
ref",
+"matchPattern": "action order [0-9]+: connmark zone 100 pipe.*index 1 
ref",
 "matchCount": "1",
 "teardown": [
 "$TC actions flush action connmark"
@@ -209,7 +209,7 @@
 "cmdUnderTest": "$TC actions add action connmark zone 65536 reclassify 
index 21",
 "expExitCode": "255",
 "verifyCmd": "$TC actions get action connmark index 1",
-"matchPattern": "action order [0-9]+:  connmark zone 65536 
reclassify.*index 21 ref",
+"matchPattern": "action order [0-9]+: connmark zone 65536 
reclassify.*index 21 ref",
 "matchCount": "0",
 "teardown": [
   

[PATCH 4.18 092/158] ath9k: report tx status on EOSP

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Felix Fietkau 

[ Upstream commit 36e14a787dd0b459760de3622e9709edb745a6af ]

Fixes missed indications of end of U-APSD service period to mac80211

Signed-off-by: Felix Fietkau 
Signed-off-by: Kalle Valo 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/net/wireless/ath/ath9k/xmit.c |3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -86,7 +86,8 @@ static void ath_tx_status(struct ieee802
struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
struct ieee80211_sta *sta = info->status.status_driver_data[0];
 
-   if (info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS) {
+   if (info->flags & (IEEE80211_TX_CTL_REQ_TX_STATUS |
+  IEEE80211_TX_STATUS_EOSP)) {
ieee80211_tx_status(hw, skb);
return;
}

[PATCH 4.18 089/158] powerpc/pseries: fix EEH recovery of some IOV devices

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Sam Bobroff 

[ Upstream commit b87b9cf4935325c98522823caeddd333022a1c62 ]

EEH recovery currently fails on pSeries for some IOV capable PCI
devices, if CONFIG_PCI_IOV is on and the hypervisor doesn't provide
certain device tree properties for the device. (Found on an IOV
capable device using the ipr driver.)

Recovery fails in pci_enable_resources() at the check on r->parent,
because r->flags is set and r->parent is not.  This state is due to
sriov_init() setting the start, end and flags members of the IOV BARs
but the parent not being set later in
pseries_pci_fixup_iov_resources(), because the
"ibm,open-sriov-vf-bar-info" property is missing.

Correct this by zeroing the resource flags for IOV BARs when they
can't be configured (this is the same method used by sriov_init() and
__pci_read_base()).

VFs cleared this way can't be enabled later, because that requires
another device tree property, "ibm,number-of-configurable-vfs" as well
as support for the RTAS function "ibm_map_pes". These are all part of
hypervisor support for IOV and it seems unlikely that a hypervisor
would ever partially, but not fully, support it. (None are currently
provided by QEMU/KVM.)

Signed-off-by: Sam Bobroff 
Reviewed-by: Bryant G. Ly 
Signed-off-by: Michael Ellerman 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 arch/powerpc/platforms/pseries/setup.c |   25 +
 1 file changed, 17 insertions(+), 8 deletions(-)

--- a/arch/powerpc/platforms/pseries/setup.c
+++ b/arch/powerpc/platforms/pseries/setup.c
@@ -647,6 +647,15 @@ void of_pci_parse_iov_addrs(struct pci_d
}
 }
 
+static void pseries_disable_sriov_resources(struct pci_dev *pdev)
+{
+   int i;
+
+   pci_warn(pdev, "No hypervisor support for SR-IOV on this device, IOV 
BARs disabled.\n");
+   for (i = 0; i < PCI_SRIOV_NUM_BARS; i++)
+   pdev->resource[i + PCI_IOV_RESOURCES].flags = 0;
+}
+
 static void pseries_pci_fixup_resources(struct pci_dev *pdev)
 {
const int *indexes;
@@ -654,10 +663,10 @@ static void pseries_pci_fixup_resources(
 
/*Firmware must support open sriov otherwise dont configure*/
indexes = of_get_property(dn, "ibm,open-sriov-vf-bar-info", NULL);
-   if (!indexes)
-   return;
-   /* Assign the addresses from device tree*/
-   of_pci_set_vf_bar_size(pdev, indexes);
+   if (indexes)
+   of_pci_set_vf_bar_size(pdev, indexes);
+   else
+   pseries_disable_sriov_resources(pdev);
 }
 
 static void pseries_pci_fixup_iov_resources(struct pci_dev *pdev)
@@ -669,10 +678,10 @@ static void pseries_pci_fixup_iov_resour
return;
/*Firmware must support open sriov otherwise dont configure*/
indexes = of_get_property(dn, "ibm,open-sriov-vf-bar-info", NULL);
-   if (!indexes)
-   return;
-   /* Assign the addresses from device tree*/
-   of_pci_parse_iov_addrs(pdev, indexes);
+   if (indexes)
+   of_pci_parse_iov_addrs(pdev, indexes);
+   else
+   pseries_disable_sriov_resources(pdev);
 }
 
 static resource_size_t pseries_pci_iov_resource_alignment(struct pci_dev *pdev,

[PATCH 4.18 088/158] perf evlist: Fix error out while applying initial delay and LBR

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Kan Liang 

[ Upstream commit 95035c5e167ae6e740b1ddd30210ae0eaf39a5db ]

'perf record' will error out if both --delay and LBR are applied.

For example:

  # perf record -D 1000 -a -e cycles -j any -- sleep 2
  Error:
  dummy:HG: PMU Hardware doesn't support sampling/overflow-interrupts.
  Try 'perf stat'
  #

A dummy event is added implicitly for initial delay, which has the same
configurations as real sampling events. The dummy event is a software
event. If LBR is configured, perf must error out.

The dummy event will only be used to track PERF_RECORD_MMAP while perf
waits for the initial delay to enable the real events. The BRANCH_STACK
bit can be safely cleared for the dummy event.

After applying the patch:

  # perf record -D 1000 -a -e cycles -j any -- sleep 2
  [ perf record: Woken up 1 times to write data ]
  [ perf record: Captured and wrote 1.054 MB perf.data (828 samples) ]
  #

Reported-by: Sunil K Pandey 
Signed-off-by: Kan Liang 
Acked-by: Jiri Olsa 
Tested-by: Arnaldo Carvalho de Melo 
Cc: Andi Kleen 
Cc: Namhyung Kim 
Cc: Peter Zijlstra 
Link: 
http://lkml.kernel.org/r/1531145722-16404-1-git-send-email-kan.li...@linux.intel.com
Signed-off-by: Arnaldo Carvalho de Melo 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 tools/perf/util/evsel.c |   14 ++
 1 file changed, 14 insertions(+)

--- a/tools/perf/util/evsel.c
+++ b/tools/perf/util/evsel.c
@@ -848,6 +848,12 @@ static void apply_config_terms(struct pe
}
 }
 
+static bool is_dummy_event(struct perf_evsel *evsel)
+{
+   return (evsel->attr.type == PERF_TYPE_SOFTWARE) &&
+  (evsel->attr.config == PERF_COUNT_SW_DUMMY);
+}
+
 /*
  * The enable_on_exec/disabled value strategy:
  *
@@ -1086,6 +1092,14 @@ void perf_evsel__config(struct perf_evse
else
perf_evsel__reset_sample_bit(evsel, PERIOD);
}
+
+   /*
+* For initial_delay, a dummy event is added implicitly.
+* The software event will trigger -EOPNOTSUPP error out,
+* if BRANCH_STACK bit is set.
+*/
+   if (opts->initial_delay && is_dummy_event(evsel))
+   perf_evsel__reset_sample_bit(evsel, BRANCH_STACK);
 }
 
 static int perf_evsel__alloc_fd(struct perf_evsel *evsel, int ncpus, int 
nthreads)

[PATCH 4.18 085/158] device-dax: avoid hang on error before devm_memremap_pages()

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Stefan Hajnoczi 

[ Upstream commit b7751410c180a05fdc21268f8661b1480169b0df ]

dax_pmem_percpu_exit() waits for dax_pmem_percpu_release() to invoke the
dax_pmem->cmp completion.  Unfortunately this approach to cleaning up
the percpu_ref only works after devm_memremap_pages() was successful.

If devm_add_action_or_reset() or devm_memremap_pages() fails,
dax_pmem_percpu_release() is not invoked.  Therefore
dax_pmem_percpu_exit() hangs waiting for the completion:

  rc = devm_add_action_or_reset(dev, dax_pmem_percpu_exit,
_pmem->ref);
  if (rc)
return rc;

  dax_pmem->pgmap.ref = _pmem->ref;
  addr = devm_memremap_pages(dev, _pmem->pgmap);

Avoid the hang by calling percpu_ref_exit() in the error paths instead
of going through dax_pmem_percpu_exit().

Signed-off-by: Stefan Hajnoczi 
Signed-off-by: Dave Jiang 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/dax/pmem.c |   12 
 1 file changed, 8 insertions(+), 4 deletions(-)

--- a/drivers/dax/pmem.c
+++ b/drivers/dax/pmem.c
@@ -105,15 +105,19 @@ static int dax_pmem_probe(struct device
if (rc)
return rc;
 
-   rc = devm_add_action_or_reset(dev, dax_pmem_percpu_exit,
-   _pmem->ref);
-   if (rc)
+   rc = devm_add_action(dev, dax_pmem_percpu_exit, _pmem->ref);
+   if (rc) {
+   percpu_ref_exit(_pmem->ref);
return rc;
+   }
 
dax_pmem->pgmap.ref = _pmem->ref;
addr = devm_memremap_pages(dev, _pmem->pgmap);
-   if (IS_ERR(addr))
+   if (IS_ERR(addr)) {
+   devm_remove_action(dev, dax_pmem_percpu_exit, _pmem->ref);
+   percpu_ref_exit(_pmem->ref);
return PTR_ERR(addr);
+   }
 
rc = devm_add_action_or_reset(dev, dax_pmem_percpu_kill,
_pmem->ref);

[PATCH 4.18 083/158] ASoC: soc-pcm: Use delay set in component pointer function

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Akshu Agrawal 

[ Upstream commit 9fb4c2bf130b922c77c16a8368732699799c40de ]

Take into account the base delay set in pointer callback.

There are cases where a pointer function populates
runtime->delay, such as:
./sound/pci/hda/hda_controller.c
./sound/soc/intel/atom/sst-mfld-platform-pcm.c

This delay was getting lost and was overwritten by delays
from codec or cpu dai delay function if exposed.

Now,
Total delay = base delay + cpu_dai delay + codec_dai delay

Signed-off-by: Akshu Agrawal 
Reviewed-by: Takashi Iwai 
Signed-off-by: Mark Brown 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 sound/soc/soc-pcm.c |5 +
 1 file changed, 5 insertions(+)

--- a/sound/soc/soc-pcm.c
+++ b/sound/soc/soc-pcm.c
@@ -1165,6 +1165,9 @@ static snd_pcm_uframes_t soc_pcm_pointer
snd_pcm_sframes_t codec_delay = 0;
int i;
 
+   /* clearing the previous total delay */
+   runtime->delay = 0;
+
for_each_rtdcom(rtd, rtdcom) {
component = rtdcom->component;
 
@@ -1176,6 +1179,8 @@ static snd_pcm_uframes_t soc_pcm_pointer
offset = component->driver->ops->pointer(substream);
break;
}
+   /* base delay if assigned in pointer callback */
+   delay = runtime->delay;
 
if (cpu_dai->driver->ops->delay)
delay += cpu_dai->driver->ops->delay(substream, cpu_dai);

[PATCH 4.18 086/158] NFSv4.0 fix client reference leak in callback

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Olga Kornievskaia 

[ Upstream commit 32cd3ee511f4e07ca25d71163b50e704808d22f4 ]

If there is an error during processing of a callback message, it leads
to refrence leak on the client structure and eventually an unclean
superblock.

Signed-off-by: Olga Kornievskaia 
Signed-off-by: Anna Schumaker 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 fs/nfs/callback_xdr.c |   11 ---
 1 file changed, 8 insertions(+), 3 deletions(-)

--- a/fs/nfs/callback_xdr.c
+++ b/fs/nfs/callback_xdr.c
@@ -883,16 +883,21 @@ static __be32 nfs4_callback_compound(str
 
if (hdr_arg.minorversion == 0) {
cps.clp = nfs4_find_client_ident(SVC_NET(rqstp), 
hdr_arg.cb_ident);
-   if (!cps.clp || !check_gss_callback_principal(cps.clp, rqstp))
+   if (!cps.clp || !check_gss_callback_principal(cps.clp, rqstp)) {
+   if (cps.clp)
+   nfs_put_client(cps.clp);
goto out_invalidcred;
+   }
}
 
cps.minorversion = hdr_arg.minorversion;
hdr_res.taglen = hdr_arg.taglen;
hdr_res.tag = hdr_arg.tag;
-   if (encode_compound_hdr_res(_out, _res) != 0)
+   if (encode_compound_hdr_res(_out, _res) != 0) {
+   if (cps.clp)
+   nfs_put_client(cps.clp);
return rpc_system_err;
-
+   }
while (status == 0 && nops != hdr_arg.nops) {
status = process_op(nops, rqstp, _in,
rqstp->rq_argp, _out, rqstp->rq_resp,

[PATCH 4.18 082/158] f2fs: fix to detect looped node chain correctly

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Chao Yu 

[ Upstream commit 82902c06bd17dbf6e8184299842ca5c68880970f ]

Below dmesg was printed when testing generic/388 of fstest:

F2FS-fs (zram1): find_fsync_dnodes: detect looped node chain, blkaddr:526615, 
next:526616
F2FS-fs (zram1): Cannot recover all fsync data errno=-22
F2FS-fs (zram1): Mounted with checkpoint version = 22300d0e
F2FS-fs (zram1): find_fsync_dnodes: detect looped node chain, blkaddr:526615, 
next:526616
F2FS-fs (zram1): Cannot recover all fsync data errno=-22

The reason is that we initialize free_blocks with free blocks of
filesystem, so if filesystem is full, free_blocks can be zero,
below condition will be true, so that, it will fail recovery.

if (++loop_cnt >= free_blocks ||
blkaddr == next_blkaddr_of_node(page))

To fix this issue, initialize free_blocks with correct value which
includes over-privision blocks.

Signed-off-by: Chao Yu 
Signed-off-by: Jaegeuk Kim 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 fs/f2fs/recovery.c |4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/fs/f2fs/recovery.c
+++ b/fs/f2fs/recovery.c
@@ -241,8 +241,8 @@ static int find_fsync_dnodes(struct f2fs
struct page *page = NULL;
block_t blkaddr;
unsigned int loop_cnt = 0;
-   unsigned int free_blocks = sbi->user_block_count -
-   valid_user_blocks(sbi);
+   unsigned int free_blocks = MAIN_SEGS(sbi) * sbi->blocks_per_seg -
+   valid_user_blocks(sbi);
int err = 0;
 
/* get node pages in the current segment */

[PATCH 4.18 086/158] NFSv4.0 fix client reference leak in callback

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Olga Kornievskaia 

[ Upstream commit 32cd3ee511f4e07ca25d71163b50e704808d22f4 ]

If there is an error during processing of a callback message, it leads
to refrence leak on the client structure and eventually an unclean
superblock.

Signed-off-by: Olga Kornievskaia 
Signed-off-by: Anna Schumaker 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 fs/nfs/callback_xdr.c |   11 ---
 1 file changed, 8 insertions(+), 3 deletions(-)

--- a/fs/nfs/callback_xdr.c
+++ b/fs/nfs/callback_xdr.c
@@ -883,16 +883,21 @@ static __be32 nfs4_callback_compound(str
 
if (hdr_arg.minorversion == 0) {
cps.clp = nfs4_find_client_ident(SVC_NET(rqstp), 
hdr_arg.cb_ident);
-   if (!cps.clp || !check_gss_callback_principal(cps.clp, rqstp))
+   if (!cps.clp || !check_gss_callback_principal(cps.clp, rqstp)) {
+   if (cps.clp)
+   nfs_put_client(cps.clp);
goto out_invalidcred;
+   }
}
 
cps.minorversion = hdr_arg.minorversion;
hdr_res.taglen = hdr_arg.taglen;
hdr_res.tag = hdr_arg.tag;
-   if (encode_compound_hdr_res(_out, _res) != 0)
+   if (encode_compound_hdr_res(_out, _res) != 0) {
+   if (cps.clp)
+   nfs_put_client(cps.clp);
return rpc_system_err;
-
+   }
while (status == 0 && nops != hdr_arg.nops) {
status = process_op(nops, rqstp, _in,
rqstp->rq_argp, _out, rqstp->rq_resp,

[PATCH 4.18 082/158] f2fs: fix to detect looped node chain correctly

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Chao Yu 

[ Upstream commit 82902c06bd17dbf6e8184299842ca5c68880970f ]

Below dmesg was printed when testing generic/388 of fstest:

F2FS-fs (zram1): find_fsync_dnodes: detect looped node chain, blkaddr:526615, 
next:526616
F2FS-fs (zram1): Cannot recover all fsync data errno=-22
F2FS-fs (zram1): Mounted with checkpoint version = 22300d0e
F2FS-fs (zram1): find_fsync_dnodes: detect looped node chain, blkaddr:526615, 
next:526616
F2FS-fs (zram1): Cannot recover all fsync data errno=-22

The reason is that we initialize free_blocks with free blocks of
filesystem, so if filesystem is full, free_blocks can be zero,
below condition will be true, so that, it will fail recovery.

if (++loop_cnt >= free_blocks ||
blkaddr == next_blkaddr_of_node(page))

To fix this issue, initialize free_blocks with correct value which
includes over-privision blocks.

Signed-off-by: Chao Yu 
Signed-off-by: Jaegeuk Kim 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 fs/f2fs/recovery.c |4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/fs/f2fs/recovery.c
+++ b/fs/f2fs/recovery.c
@@ -241,8 +241,8 @@ static int find_fsync_dnodes(struct f2fs
struct page *page = NULL;
block_t blkaddr;
unsigned int loop_cnt = 0;
-   unsigned int free_blocks = sbi->user_block_count -
-   valid_user_blocks(sbi);
+   unsigned int free_blocks = MAIN_SEGS(sbi) * sbi->blocks_per_seg -
+   valid_user_blocks(sbi);
int err = 0;
 
/* get node pages in the current segment */

[PATCH 4.18 093/158] ath9k_hw: fix channel maximum power level test

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Felix Fietkau 

[ Upstream commit 461d8a6bb9879b0e619752d040292e67aa06f1d2 ]

The tx power applied by set_txpower is limited by the CTL (conformance
test limit) entries in the EEPROM. These can change based on the user
configured regulatory domain.
Depending on the EEPROM data this can cause the tx power to become too
limited, if the original regdomain CTLs impose lower limits than the CTLs
of the user configured regdomain.

To fix this issue, set the initial channel limits without any CTL
restrictions and only apply the CTL at run time when setting the channel
and the real tx power.

Signed-off-by: Felix Fietkau 
Signed-off-by: Kalle Valo 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/net/wireless/ath/ath9k/hw.c |7 +--
 1 file changed, 5 insertions(+), 2 deletions(-)

--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -2942,16 +2942,19 @@ void ath9k_hw_apply_txpower(struct ath_h
struct ath_regulatory *reg = ath9k_hw_regulatory(ah);
struct ieee80211_channel *channel;
int chan_pwr, new_pwr;
+   u16 ctl = NO_CTL;
 
if (!chan)
return;
 
+   if (!test)
+   ctl = ath9k_regd_get_ctl(reg, chan);
+
channel = chan->chan;
chan_pwr = min_t(int, channel->max_power * 2, MAX_RATE_POWER);
new_pwr = min_t(int, chan_pwr, reg->power_limit);
 
-   ah->eep_ops->set_txpower(ah, chan,
-ath9k_regd_get_ctl(reg, chan),
+   ah->eep_ops->set_txpower(ah, chan, ctl,
 get_antenna_gain(ah, chan), new_pwr, test);
 }
 

[PATCH 4.18 094/158] ath10k: prevent active scans on potential unusable channels

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Sven Eckelmann 

[ Upstream commit 3f259111583801013cb605bb4414aa529adccf1c ]

The QCA4019 hw1.0 firmware 10.4-3.2.1-00050 and 10.4-3.5.3-00053 (and most
likely all other) seem to ignore the WMI_CHAN_FLAG_DFS flag during the
scan. This results in transmission (probe requests) on channels which are
not "available" for transmissions.

Since the firmware is closed source and nothing can be done from our side
to fix the problem in it, the driver has to work around this problem. The
WMI_CHAN_FLAG_PASSIVE seems to be interpreted by the firmware to not
scan actively on a channel unless an AP was detected on it. Simple probe
requests will then be transmitted by the STA on the channel.

ath10k must therefore also use this flag when it queues a radar channel for
scanning. This should reduce the chance of an active scan when the channel
might be "unusable" for transmissions.

Fixes: e8a50f8ba44b ("ath10k: introduce DFS implementation")
Signed-off-by: Sven Eckelmann 
Signed-off-by: Kalle Valo 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/net/wireless/ath/ath10k/mac.c |7 +++
 1 file changed, 7 insertions(+)

--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -3085,6 +3085,13 @@ static int ath10k_update_channel_list(st
passive = channel->flags & IEEE80211_CHAN_NO_IR;
ch->passive = passive;
 
+   /* the firmware is ignoring the "radar" flag of the
+* channel and is scanning actively using Probe Requests
+* on "Radar detection"/DFS channels which are not
+* marked as "available"
+*/
+   ch->passive |= ch->chan_radar;
+
ch->freq = channel->center_freq;
ch->band_center_freq1 = channel->center_freq;
ch->min_power = 0;

[PATCH 4.18 091/158] perf build: Fix installation directory for eBPF

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Thomas Richter 

[ Upstream commit 83868bf71d2eb7700b37f1ea188007f0125e4ee4 ]

The perf tool build and install is controlled via a Makefile. The
'install' rule creates directories and copies files. Among them are
header files installed in /usr/lib/include/perf/bpf/.

However all listed examples are installing its header files in

  /usr/lib//...[/include]/header.h

and not in

  /usr/lib/include//.../header.h.

Background information:

Building the Fedora 28 glibc RPM on s390x and s390 fails on s390 (gcc
-m31) as gcc is not able to find header-files like stdbool.h.

In the glibc.spec file, you can see that glibc is configured with
"--with-headers". In this case, first -nostdinc is added to the CFLAGS
and then further include paths are added via -isystem.  One of those
paths should contain header files like stdbool.h.

In order to get this path, gcc is invoked with:

- on Fedora 28 (with 4.18 kernel):

  $ gcc -print-file-name=include
  /usr/lib/gcc/s390x-redhat-linux/8/include
  $ gcc -m31 -print-file-name=include
  /usr/lib/gcc/s390x-redhat-linux/8/../../../../lib/include
  => If perf is installed, this is: /usr/lib/include
  On my machine this directory is only containing the directory "perf".
  If perf is not installed gcc returns: 
/usr/lib/gcc/s390x-redhat-linux/8/include

- on Ubuntu 18.04 (with 4.15 kernel):

  $ gcc  -print-file-name=include
  /usr/lib/gcc/s390x-linux-gnu/7/include
  $ gcc -m31 -print-file-name=include
  /usr/lib/gcc/s390x-linux-gnu/7/include
  => gcc returns the correct path even if perf is installed.

In each case, the introduction of the subdirectory /usr/lib/include
leads to the regression that one can not build the glibc RPM for s390
anymore as gcc can not find headers like stdbool.h.

To remedy this install bpf.h to /usr/lib/perf/include/bpf/bpf.h

Output before using the command 'perf test -Fv 40':

  echo '...[bpf-program-source]...' | /usr/bin/clang ... \
   -I/root/lib/include/perf/bpf ...
   
...
  [root@p23lp27 perf]# perf test -F 40
  40: BPF filter:
  40.1: Basic BPF filtering : Ok
  40.2: BPF pinning : Ok
  40.3: BPF prologue generation : Ok
  40.4: BPF relocation checker  : Ok
  [root@p23lp27 perf]#

Output after using command 'perf test -Fv 40':

  echo '...[bpf-program-source]...' | /usr/bin/clang ... \
 -I/root/lib/perf/include/bpf ...
 
...
  [root@p23lp27 perf]# perf test -F 40
  40: BPF filter:
  40.1: Basic BPF filtering : Ok
  40.2: BPF pinning : Ok
  40.3: BPF prologue generation : Ok
  40.4: BPF relocation checker  : Ok
  [root@p23lp27 perf]#

Committer testing:

While the above 'perf test -F 40' (or 'perf test bpf') will allow us
to see that the correct path is now added via -I, to actually test this
we better try to use a bpf script that includes files in the changed
directory.

We have the files that now reside in /root/lib/perf/examples/bpf/ to do
just that:

  # tail -8 /root/lib/perf/examples/bpf/5sec.c
  #include 

  int probe(hrtimer_nanosleep, rqtp->tv_sec)(void *ctx, int err, long sec)
  {
  return sec == 5;
  }

  license(GPL);
  # perf trace -e *sleep -e /root/lib/perf/examples/bpf/5sec.c sleep 4
   0.333 (4000.086 ms): sleep/9248 nanosleep(rqtp: 0x7ffc155f3300) = 0
  # perf trace -e *sleep -e /root/lib/perf/examples/bpf/5sec.c sleep 5
   0.287 ( ): sleep/9659 nanosleep(rqtp: 0x7ffeafe38200) ...
   0.290 ( ): perf_bpf_probe:hrtimer_nanosleep:(9911efe0) 
tv_sec=5
   0.287 (5000.059 ms): sleep/9659  ... [continued]: nanosleep()) = 0
  # perf trace -e *sleep -e /root/lib/perf/examples/bpf/5sec.c sleep 6
   0.247 (5999.951 ms): sleep/10068 nanosleep(rqtp: 0x7fff2086d900) = 0
  # perf trace -e *sleep -e /root/lib/perf/examples/bpf/5sec.c sleep 5.987
   0.293 ( ): sleep/10489 nanosleep(rqtp: 0x7ffdd4fc10e0) ...
   0.296 ( ): perf_bpf_probe:hrtimer_nanosleep:(9911efe0) 
tv_sec=5
   0.293 (5986.912 ms): sleep/10489  ... [continued]: nanosleep()) = 0
  #

Suggested-by: Stefan Liebler 
Suggested-by: Arnaldo Carvalho de Melo 
Signed-off-by: Thomas Richter 
Reviewed-by: Hendrik Brueckner 
Tested-by: Arnaldo Carvalho de Melo 
Cc: Heiko Carstens 
Cc: Martin Schwidefsky 
Fixes: 1b16fffa389d ("perf llvm-utils: Add bpf include path to clang command 
line")
Link: http://lkml.kernel.org/r/20180731073254.91090-1-tmri...@linux.ibm.com
Signed-off-by: Arnaldo Carvalho de Melo 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg 

[PATCH 4.18 093/158] ath9k_hw: fix channel maximum power level test

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Felix Fietkau 

[ Upstream commit 461d8a6bb9879b0e619752d040292e67aa06f1d2 ]

The tx power applied by set_txpower is limited by the CTL (conformance
test limit) entries in the EEPROM. These can change based on the user
configured regulatory domain.
Depending on the EEPROM data this can cause the tx power to become too
limited, if the original regdomain CTLs impose lower limits than the CTLs
of the user configured regdomain.

To fix this issue, set the initial channel limits without any CTL
restrictions and only apply the CTL at run time when setting the channel
and the real tx power.

Signed-off-by: Felix Fietkau 
Signed-off-by: Kalle Valo 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/net/wireless/ath/ath9k/hw.c |7 +--
 1 file changed, 5 insertions(+), 2 deletions(-)

--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -2942,16 +2942,19 @@ void ath9k_hw_apply_txpower(struct ath_h
struct ath_regulatory *reg = ath9k_hw_regulatory(ah);
struct ieee80211_channel *channel;
int chan_pwr, new_pwr;
+   u16 ctl = NO_CTL;
 
if (!chan)
return;
 
+   if (!test)
+   ctl = ath9k_regd_get_ctl(reg, chan);
+
channel = chan->chan;
chan_pwr = min_t(int, channel->max_power * 2, MAX_RATE_POWER);
new_pwr = min_t(int, chan_pwr, reg->power_limit);
 
-   ah->eep_ops->set_txpower(ah, chan,
-ath9k_regd_get_ctl(reg, chan),
+   ah->eep_ops->set_txpower(ah, chan, ctl,
 get_antenna_gain(ah, chan), new_pwr, test);
 }
 

[PATCH 4.18 094/158] ath10k: prevent active scans on potential unusable channels

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Sven Eckelmann 

[ Upstream commit 3f259111583801013cb605bb4414aa529adccf1c ]

The QCA4019 hw1.0 firmware 10.4-3.2.1-00050 and 10.4-3.5.3-00053 (and most
likely all other) seem to ignore the WMI_CHAN_FLAG_DFS flag during the
scan. This results in transmission (probe requests) on channels which are
not "available" for transmissions.

Since the firmware is closed source and nothing can be done from our side
to fix the problem in it, the driver has to work around this problem. The
WMI_CHAN_FLAG_PASSIVE seems to be interpreted by the firmware to not
scan actively on a channel unless an AP was detected on it. Simple probe
requests will then be transmitted by the STA on the channel.

ath10k must therefore also use this flag when it queues a radar channel for
scanning. This should reduce the chance of an active scan when the channel
might be "unusable" for transmissions.

Fixes: e8a50f8ba44b ("ath10k: introduce DFS implementation")
Signed-off-by: Sven Eckelmann 
Signed-off-by: Kalle Valo 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/net/wireless/ath/ath10k/mac.c |7 +++
 1 file changed, 7 insertions(+)

--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -3085,6 +3085,13 @@ static int ath10k_update_channel_list(st
passive = channel->flags & IEEE80211_CHAN_NO_IR;
ch->passive = passive;
 
+   /* the firmware is ignoring the "radar" flag of the
+* channel and is scanning actively using Probe Requests
+* on "Radar detection"/DFS channels which are not
+* marked as "available"
+*/
+   ch->passive |= ch->chan_radar;
+
ch->freq = channel->center_freq;
ch->band_center_freq1 = channel->center_freq;
ch->min_power = 0;

[PATCH 4.18 091/158] perf build: Fix installation directory for eBPF

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Thomas Richter 

[ Upstream commit 83868bf71d2eb7700b37f1ea188007f0125e4ee4 ]

The perf tool build and install is controlled via a Makefile. The
'install' rule creates directories and copies files. Among them are
header files installed in /usr/lib/include/perf/bpf/.

However all listed examples are installing its header files in

  /usr/lib//...[/include]/header.h

and not in

  /usr/lib/include//.../header.h.

Background information:

Building the Fedora 28 glibc RPM on s390x and s390 fails on s390 (gcc
-m31) as gcc is not able to find header-files like stdbool.h.

In the glibc.spec file, you can see that glibc is configured with
"--with-headers". In this case, first -nostdinc is added to the CFLAGS
and then further include paths are added via -isystem.  One of those
paths should contain header files like stdbool.h.

In order to get this path, gcc is invoked with:

- on Fedora 28 (with 4.18 kernel):

  $ gcc -print-file-name=include
  /usr/lib/gcc/s390x-redhat-linux/8/include
  $ gcc -m31 -print-file-name=include
  /usr/lib/gcc/s390x-redhat-linux/8/../../../../lib/include
  => If perf is installed, this is: /usr/lib/include
  On my machine this directory is only containing the directory "perf".
  If perf is not installed gcc returns: 
/usr/lib/gcc/s390x-redhat-linux/8/include

- on Ubuntu 18.04 (with 4.15 kernel):

  $ gcc  -print-file-name=include
  /usr/lib/gcc/s390x-linux-gnu/7/include
  $ gcc -m31 -print-file-name=include
  /usr/lib/gcc/s390x-linux-gnu/7/include
  => gcc returns the correct path even if perf is installed.

In each case, the introduction of the subdirectory /usr/lib/include
leads to the regression that one can not build the glibc RPM for s390
anymore as gcc can not find headers like stdbool.h.

To remedy this install bpf.h to /usr/lib/perf/include/bpf/bpf.h

Output before using the command 'perf test -Fv 40':

  echo '...[bpf-program-source]...' | /usr/bin/clang ... \
   -I/root/lib/include/perf/bpf ...
   
...
  [root@p23lp27 perf]# perf test -F 40
  40: BPF filter:
  40.1: Basic BPF filtering : Ok
  40.2: BPF pinning : Ok
  40.3: BPF prologue generation : Ok
  40.4: BPF relocation checker  : Ok
  [root@p23lp27 perf]#

Output after using command 'perf test -Fv 40':

  echo '...[bpf-program-source]...' | /usr/bin/clang ... \
 -I/root/lib/perf/include/bpf ...
 
...
  [root@p23lp27 perf]# perf test -F 40
  40: BPF filter:
  40.1: Basic BPF filtering : Ok
  40.2: BPF pinning : Ok
  40.3: BPF prologue generation : Ok
  40.4: BPF relocation checker  : Ok
  [root@p23lp27 perf]#

Committer testing:

While the above 'perf test -F 40' (or 'perf test bpf') will allow us
to see that the correct path is now added via -I, to actually test this
we better try to use a bpf script that includes files in the changed
directory.

We have the files that now reside in /root/lib/perf/examples/bpf/ to do
just that:

  # tail -8 /root/lib/perf/examples/bpf/5sec.c
  #include 

  int probe(hrtimer_nanosleep, rqtp->tv_sec)(void *ctx, int err, long sec)
  {
  return sec == 5;
  }

  license(GPL);
  # perf trace -e *sleep -e /root/lib/perf/examples/bpf/5sec.c sleep 4
   0.333 (4000.086 ms): sleep/9248 nanosleep(rqtp: 0x7ffc155f3300) = 0
  # perf trace -e *sleep -e /root/lib/perf/examples/bpf/5sec.c sleep 5
   0.287 ( ): sleep/9659 nanosleep(rqtp: 0x7ffeafe38200) ...
   0.290 ( ): perf_bpf_probe:hrtimer_nanosleep:(9911efe0) 
tv_sec=5
   0.287 (5000.059 ms): sleep/9659  ... [continued]: nanosleep()) = 0
  # perf trace -e *sleep -e /root/lib/perf/examples/bpf/5sec.c sleep 6
   0.247 (5999.951 ms): sleep/10068 nanosleep(rqtp: 0x7fff2086d900) = 0
  # perf trace -e *sleep -e /root/lib/perf/examples/bpf/5sec.c sleep 5.987
   0.293 ( ): sleep/10489 nanosleep(rqtp: 0x7ffdd4fc10e0) ...
   0.296 ( ): perf_bpf_probe:hrtimer_nanosleep:(9911efe0) 
tv_sec=5
   0.293 (5986.912 ms): sleep/10489  ... [continued]: nanosleep()) = 0
  #

Suggested-by: Stefan Liebler 
Suggested-by: Arnaldo Carvalho de Melo 
Signed-off-by: Thomas Richter 
Reviewed-by: Hendrik Brueckner 
Tested-by: Arnaldo Carvalho de Melo 
Cc: Heiko Carstens 
Cc: Martin Schwidefsky 
Fixes: 1b16fffa389d ("perf llvm-utils: Add bpf include path to clang command 
line")
Link: http://lkml.kernel.org/r/20180731073254.91090-1-tmri...@linux.ibm.com
Signed-off-by: Arnaldo Carvalho de Melo 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg 

[PATCH 4.18 043/158] tc-testing: flush gact actions on test teardown

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Vlad Buslov 

[ Upstream commit 0c62f8a820b7fdeacf5ad9f9e24b53043d372c97 ]

Test 6fb4 creates one mirred and one pipe action, but only flushes mirred
on teardown. Leaking pipe action causes failures in other tests.

Add additional teardown command to also flush gact actions.

Signed-off-by: Vlad Buslov 
Acked-by: Jamal Hadi Salim 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 tools/testing/selftests/tc-testing/tc-tests/actions/mirred.json |3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/tools/testing/selftests/tc-testing/tc-tests/actions/mirred.json
+++ b/tools/testing/selftests/tc-testing/tc-tests/actions/mirred.json
@@ -44,7 +44,8 @@
 "matchPattern": "action order [0-9]*: mirred \\(Egress Redirect to 
device lo\\).*index 2 ref",
 "matchCount": "1",
 "teardown": [
-"$TC actions flush action mirred"
+"$TC actions flush action mirred",
+"$TC actions flush action gact"
 ]
 },
 {

[PATCH 4.18 041/158] switchtec: Fix Spectre v1 vulnerability

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Gustavo A. R. Silva 

commit 46feb6b495f7628a6dbf36c4e6d80faf378372d4 upstream.

p.port can is indirectly controlled by user-space, hence leading to
a potential exploitation of the Spectre variant 1 vulnerability.

This issue was detected with the help of Smatch:

  drivers/pci/switch/switchtec.c:912 ioctl_port_to_pff() warn: potential 
spectre issue 'pcfg->dsp_pff_inst_id' [r]

Fix this by sanitizing p.port before using it to index
pcfg->dsp_pff_inst_id

Notice that given that speculation windows are large, the policy is to kill
the speculation on the first load and not worry if it can be completed with
a dependent load/store [1].

[1] https://marc.info/?l=linux-kernel=152449131114778=2

Signed-off-by: Gustavo A. R. Silva 
Signed-off-by: Bjorn Helgaas 
Acked-by: Logan Gunthorpe 
Cc: sta...@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/pci/switch/switchtec.c |4 
 1 file changed, 4 insertions(+)

--- a/drivers/pci/switch/switchtec.c
+++ b/drivers/pci/switch/switchtec.c
@@ -14,6 +14,8 @@
 #include 
 #include 
 
+#include 
+
 MODULE_DESCRIPTION("Microsemi Switchtec(tm) PCIe Management Driver");
 MODULE_VERSION("0.1");
 MODULE_LICENSE("GPL");
@@ -909,6 +911,8 @@ static int ioctl_port_to_pff(struct swit
default:
if (p.port > ARRAY_SIZE(pcfg->dsp_pff_inst_id))
return -EINVAL;
+   p.port = array_index_nospec(p.port,
+   ARRAY_SIZE(pcfg->dsp_pff_inst_id) + 1);
p.pff = ioread32(>dsp_pff_inst_id[p.port - 1]);
break;
}

[PATCH 4.18 039/158] x86/process: Dont mix user/kernel regs in 64bit __show_regs()

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Jann Horn 

commit 9fe6299dde587788f245e9f7a5a1b296fad4e8c7 upstream.

When the kernel.print-fatal-signals sysctl has been enabled, a simple
userspace crash will cause the kernel to write a crash dump that contains,
among other things, the kernel gsbase into dmesg.

As suggested by Andy, limit output to pt_regs, FS_BASE and KERNEL_GS_BASE
in this case.

This also moves the bitness-specific logic from show_regs() into
process_{32,64}.c.

Fixes: 45807a1df9f5 ("vdso: print fatal signals")
Signed-off-by: Jann Horn 
Signed-off-by: Thomas Gleixner 
Cc: "H. Peter Anvin" 
Cc: Andy Lutomirski 
Cc: Borislav Petkov 
Cc: Greg Kroah-Hartman 
Cc: sta...@vger.kernel.org
Link: https://lkml.kernel.org/r/20180831194151.123586-1-ja...@google.com
Signed-off-by: Greg Kroah-Hartman 

---
 arch/x86/include/asm/kdebug.h |   12 +++-
 arch/x86/kernel/dumpstack.c   |   11 +++
 arch/x86/kernel/process_32.c  |4 ++--
 arch/x86/kernel/process_64.c  |   12 ++--
 4 files changed, 26 insertions(+), 13 deletions(-)

--- a/arch/x86/include/asm/kdebug.h
+++ b/arch/x86/include/asm/kdebug.h
@@ -22,10 +22,20 @@ enum die_val {
DIE_NMIUNKNOWN,
 };
 
+enum show_regs_mode {
+   SHOW_REGS_SHORT,
+   /*
+* For when userspace crashed, but we don't think it's our fault, and
+* therefore don't print kernel registers.
+*/
+   SHOW_REGS_USER,
+   SHOW_REGS_ALL
+};
+
 extern void die(const char *, struct pt_regs *,long);
 extern int __must_check __die(const char *, struct pt_regs *, long);
 extern void show_stack_regs(struct pt_regs *regs);
-extern void __show_regs(struct pt_regs *regs, int all);
+extern void __show_regs(struct pt_regs *regs, enum show_regs_mode);
 extern void show_iret_regs(struct pt_regs *regs);
 extern unsigned long oops_begin(void);
 extern void oops_end(unsigned long, struct pt_regs *, int signr);
--- a/arch/x86/kernel/dumpstack.c
+++ b/arch/x86/kernel/dumpstack.c
@@ -155,7 +155,7 @@ static void show_regs_if_on_stack(struct
 * they can be printed in the right context.
 */
if (!partial && on_stack(info, regs, sizeof(*regs))) {
-   __show_regs(regs, 0);
+   __show_regs(regs, SHOW_REGS_SHORT);
 
} else if (partial && on_stack(info, (void *)regs + IRET_FRAME_OFFSET,
   IRET_FRAME_SIZE)) {
@@ -353,7 +353,7 @@ void oops_end(unsigned long flags, struc
oops_exit();
 
/* Executive summary in case the oops scrolled away */
-   __show_regs(_summary_regs, true);
+   __show_regs(_summary_regs, SHOW_REGS_ALL);
 
if (!signr)
return;
@@ -416,14 +416,9 @@ void die(const char *str, struct pt_regs
 
 void show_regs(struct pt_regs *regs)
 {
-   bool all = true;
-
show_regs_print_info(KERN_DEFAULT);
 
-   if (IS_ENABLED(CONFIG_X86_32))
-   all = !user_mode(regs);
-
-   __show_regs(regs, all);
+   __show_regs(regs, user_mode(regs) ? SHOW_REGS_USER : SHOW_REGS_ALL);
 
/*
 * When in-kernel, we also print out the stack at the time of the 
fault..
--- a/arch/x86/kernel/process_32.c
+++ b/arch/x86/kernel/process_32.c
@@ -59,7 +59,7 @@
 #include 
 #include 
 
-void __show_regs(struct pt_regs *regs, int all)
+void __show_regs(struct pt_regs *regs, enum show_regs_mode mode)
 {
unsigned long cr0 = 0L, cr2 = 0L, cr3 = 0L, cr4 = 0L;
unsigned long d0, d1, d2, d3, d6, d7;
@@ -85,7 +85,7 @@ void __show_regs(struct pt_regs *regs, i
printk(KERN_DEFAULT "DS: %04x ES: %04x FS: %04x GS: %04x SS: %04x 
EFLAGS: %08lx\n",
   (u16)regs->ds, (u16)regs->es, (u16)regs->fs, gs, ss, 
regs->flags);
 
-   if (!all)
+   if (mode != SHOW_REGS_ALL)
return;
 
cr0 = read_cr0();
--- a/arch/x86/kernel/process_64.c
+++ b/arch/x86/kernel/process_64.c
@@ -62,7 +62,7 @@
 __visible DEFINE_PER_CPU(unsigned long, rsp_scratch);
 
 /* Prints also some state that isn't saved in the pt_regs */
-void __show_regs(struct pt_regs *regs, int all)
+void __show_regs(struct pt_regs *regs, enum show_regs_mode mode)
 {
unsigned long cr0 = 0L, cr2 = 0L, cr3 = 0L, cr4 = 0L, fs, gs, shadowgs;
unsigned long d0, d1, d2, d3, d6, d7;
@@ -87,9 +87,17 @@ void __show_regs(struct pt_regs *regs, i
printk(KERN_DEFAULT "R13: %016lx R14: %016lx R15: %016lx\n",
   regs->r13, regs->r14, regs->r15);
 
-   if (!all)
+   if (mode == SHOW_REGS_SHORT)
return;
 
+   if (mode == SHOW_REGS_USER) {
+   rdmsrl(MSR_FS_BASE, fs);
+   rdmsrl(MSR_KERNEL_GS_BASE, shadowgs);
+   printk(KERN_DEFAULT "FS:  %016lx GS:  %016lx\n",
+  fs, shadowgs);
+   return;
+   }
+
asm("movl %%ds,%0" : "=r" (ds));
asm("movl %%cs,%0" : "=r" (cs));
asm("movl %%es,%0" : "=r" 

[PATCH 4.18 042/158] ARC: [plat-axs*]: Enable SWAP

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Alexey Brodkin 

commit c83532fb0fe053d2e43e9387354cb1b52ba26427 upstream.

SWAP support on ARC was fixed earlier by
commit 6e3761145a9b ("ARC: Fix CONFIG_SWAP")
so now we may safely enable it on platforms that
have external media like USB and SD-card.

Note: it was already allowed for HSDK

Signed-off-by: Alexey Brodkin 
Cc: sta...@vger.kernel.org # 6e3761145a9b: ARC: Fix CONFIG_SWAP
Signed-off-by: Vineet Gupta 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/arc/configs/axs101_defconfig |1 -
 arch/arc/configs/axs103_defconfig |1 -
 arch/arc/configs/axs103_smp_defconfig |1 -
 3 files changed, 3 deletions(-)

--- a/arch/arc/configs/axs101_defconfig
+++ b/arch/arc/configs/axs101_defconfig
@@ -1,5 +1,4 @@
 CONFIG_DEFAULT_HOSTNAME="ARCLinux"
-# CONFIG_SWAP is not set
 CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
 # CONFIG_CROSS_MEMORY_ATTACH is not set
--- a/arch/arc/configs/axs103_defconfig
+++ b/arch/arc/configs/axs103_defconfig
@@ -1,5 +1,4 @@
 CONFIG_DEFAULT_HOSTNAME="ARCLinux"
-# CONFIG_SWAP is not set
 CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
 # CONFIG_CROSS_MEMORY_ATTACH is not set
--- a/arch/arc/configs/axs103_smp_defconfig
+++ b/arch/arc/configs/axs103_smp_defconfig
@@ -1,5 +1,4 @@
 CONFIG_DEFAULT_HOSTNAME="ARCLinux"
-# CONFIG_SWAP is not set
 CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
 # CONFIG_CROSS_MEMORY_ATTACH is not set

[PATCH 4.18 040/158] x86/apic/vector: Make error return value negative

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Thomas Gleixner 

commit 47b7360ce563e18c524ce92b55fb4da72b3b3578 upstream.

activate_managed() returns EINVAL instead of -EINVAL in case of
error. While this is unlikely to happen, the positive return value would
cause further malfunction at the call site.

Fixes: 2db1f959d9dc ("x86/vector: Handle managed interrupts proper")
Signed-off-by: Thomas Gleixner 
Cc: sta...@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman 

---
 arch/x86/kernel/apic/vector.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/x86/kernel/apic/vector.c
+++ b/arch/x86/kernel/apic/vector.c
@@ -422,7 +422,7 @@ static int activate_managed(struct irq_d
if (WARN_ON_ONCE(cpumask_empty(vector_searchmask))) {
/* Something in the core code broke! Survive gracefully */
pr_err("Managed startup for irq %u, but no CPU\n", irqd->irq);
-   return EINVAL;
+   return -EINVAL;
}
 
ret = assign_managed_vector(irqd, vector_searchmask);

[PATCH 4.18 041/158] switchtec: Fix Spectre v1 vulnerability

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Gustavo A. R. Silva 

commit 46feb6b495f7628a6dbf36c4e6d80faf378372d4 upstream.

p.port can is indirectly controlled by user-space, hence leading to
a potential exploitation of the Spectre variant 1 vulnerability.

This issue was detected with the help of Smatch:

  drivers/pci/switch/switchtec.c:912 ioctl_port_to_pff() warn: potential 
spectre issue 'pcfg->dsp_pff_inst_id' [r]

Fix this by sanitizing p.port before using it to index
pcfg->dsp_pff_inst_id

Notice that given that speculation windows are large, the policy is to kill
the speculation on the first load and not worry if it can be completed with
a dependent load/store [1].

[1] https://marc.info/?l=linux-kernel=152449131114778=2

Signed-off-by: Gustavo A. R. Silva 
Signed-off-by: Bjorn Helgaas 
Acked-by: Logan Gunthorpe 
Cc: sta...@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/pci/switch/switchtec.c |4 
 1 file changed, 4 insertions(+)

--- a/drivers/pci/switch/switchtec.c
+++ b/drivers/pci/switch/switchtec.c
@@ -14,6 +14,8 @@
 #include 
 #include 
 
+#include 
+
 MODULE_DESCRIPTION("Microsemi Switchtec(tm) PCIe Management Driver");
 MODULE_VERSION("0.1");
 MODULE_LICENSE("GPL");
@@ -909,6 +911,8 @@ static int ioctl_port_to_pff(struct swit
default:
if (p.port > ARRAY_SIZE(pcfg->dsp_pff_inst_id))
return -EINVAL;
+   p.port = array_index_nospec(p.port,
+   ARRAY_SIZE(pcfg->dsp_pff_inst_id) + 1);
p.pff = ioread32(>dsp_pff_inst_id[p.port - 1]);
break;
}

[PATCH 4.18 039/158] x86/process: Dont mix user/kernel regs in 64bit __show_regs()

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Jann Horn 

commit 9fe6299dde587788f245e9f7a5a1b296fad4e8c7 upstream.

When the kernel.print-fatal-signals sysctl has been enabled, a simple
userspace crash will cause the kernel to write a crash dump that contains,
among other things, the kernel gsbase into dmesg.

As suggested by Andy, limit output to pt_regs, FS_BASE and KERNEL_GS_BASE
in this case.

This also moves the bitness-specific logic from show_regs() into
process_{32,64}.c.

Fixes: 45807a1df9f5 ("vdso: print fatal signals")
Signed-off-by: Jann Horn 
Signed-off-by: Thomas Gleixner 
Cc: "H. Peter Anvin" 
Cc: Andy Lutomirski 
Cc: Borislav Petkov 
Cc: Greg Kroah-Hartman 
Cc: sta...@vger.kernel.org
Link: https://lkml.kernel.org/r/20180831194151.123586-1-ja...@google.com
Signed-off-by: Greg Kroah-Hartman 

---
 arch/x86/include/asm/kdebug.h |   12 +++-
 arch/x86/kernel/dumpstack.c   |   11 +++
 arch/x86/kernel/process_32.c  |4 ++--
 arch/x86/kernel/process_64.c  |   12 ++--
 4 files changed, 26 insertions(+), 13 deletions(-)

--- a/arch/x86/include/asm/kdebug.h
+++ b/arch/x86/include/asm/kdebug.h
@@ -22,10 +22,20 @@ enum die_val {
DIE_NMIUNKNOWN,
 };
 
+enum show_regs_mode {
+   SHOW_REGS_SHORT,
+   /*
+* For when userspace crashed, but we don't think it's our fault, and
+* therefore don't print kernel registers.
+*/
+   SHOW_REGS_USER,
+   SHOW_REGS_ALL
+};
+
 extern void die(const char *, struct pt_regs *,long);
 extern int __must_check __die(const char *, struct pt_regs *, long);
 extern void show_stack_regs(struct pt_regs *regs);
-extern void __show_regs(struct pt_regs *regs, int all);
+extern void __show_regs(struct pt_regs *regs, enum show_regs_mode);
 extern void show_iret_regs(struct pt_regs *regs);
 extern unsigned long oops_begin(void);
 extern void oops_end(unsigned long, struct pt_regs *, int signr);
--- a/arch/x86/kernel/dumpstack.c
+++ b/arch/x86/kernel/dumpstack.c
@@ -155,7 +155,7 @@ static void show_regs_if_on_stack(struct
 * they can be printed in the right context.
 */
if (!partial && on_stack(info, regs, sizeof(*regs))) {
-   __show_regs(regs, 0);
+   __show_regs(regs, SHOW_REGS_SHORT);
 
} else if (partial && on_stack(info, (void *)regs + IRET_FRAME_OFFSET,
   IRET_FRAME_SIZE)) {
@@ -353,7 +353,7 @@ void oops_end(unsigned long flags, struc
oops_exit();
 
/* Executive summary in case the oops scrolled away */
-   __show_regs(_summary_regs, true);
+   __show_regs(_summary_regs, SHOW_REGS_ALL);
 
if (!signr)
return;
@@ -416,14 +416,9 @@ void die(const char *str, struct pt_regs
 
 void show_regs(struct pt_regs *regs)
 {
-   bool all = true;
-
show_regs_print_info(KERN_DEFAULT);
 
-   if (IS_ENABLED(CONFIG_X86_32))
-   all = !user_mode(regs);
-
-   __show_regs(regs, all);
+   __show_regs(regs, user_mode(regs) ? SHOW_REGS_USER : SHOW_REGS_ALL);
 
/*
 * When in-kernel, we also print out the stack at the time of the 
fault..
--- a/arch/x86/kernel/process_32.c
+++ b/arch/x86/kernel/process_32.c
@@ -59,7 +59,7 @@
 #include 
 #include 
 
-void __show_regs(struct pt_regs *regs, int all)
+void __show_regs(struct pt_regs *regs, enum show_regs_mode mode)
 {
unsigned long cr0 = 0L, cr2 = 0L, cr3 = 0L, cr4 = 0L;
unsigned long d0, d1, d2, d3, d6, d7;
@@ -85,7 +85,7 @@ void __show_regs(struct pt_regs *regs, i
printk(KERN_DEFAULT "DS: %04x ES: %04x FS: %04x GS: %04x SS: %04x 
EFLAGS: %08lx\n",
   (u16)regs->ds, (u16)regs->es, (u16)regs->fs, gs, ss, 
regs->flags);
 
-   if (!all)
+   if (mode != SHOW_REGS_ALL)
return;
 
cr0 = read_cr0();
--- a/arch/x86/kernel/process_64.c
+++ b/arch/x86/kernel/process_64.c
@@ -62,7 +62,7 @@
 __visible DEFINE_PER_CPU(unsigned long, rsp_scratch);
 
 /* Prints also some state that isn't saved in the pt_regs */
-void __show_regs(struct pt_regs *regs, int all)
+void __show_regs(struct pt_regs *regs, enum show_regs_mode mode)
 {
unsigned long cr0 = 0L, cr2 = 0L, cr3 = 0L, cr4 = 0L, fs, gs, shadowgs;
unsigned long d0, d1, d2, d3, d6, d7;
@@ -87,9 +87,17 @@ void __show_regs(struct pt_regs *regs, i
printk(KERN_DEFAULT "R13: %016lx R14: %016lx R15: %016lx\n",
   regs->r13, regs->r14, regs->r15);
 
-   if (!all)
+   if (mode == SHOW_REGS_SHORT)
return;
 
+   if (mode == SHOW_REGS_USER) {
+   rdmsrl(MSR_FS_BASE, fs);
+   rdmsrl(MSR_KERNEL_GS_BASE, shadowgs);
+   printk(KERN_DEFAULT "FS:  %016lx GS:  %016lx\n",
+  fs, shadowgs);
+   return;
+   }
+
asm("movl %%ds,%0" : "=r" (ds));
asm("movl %%cs,%0" : "=r" (cs));
asm("movl %%es,%0" : "=r" 

[PATCH 4.18 042/158] ARC: [plat-axs*]: Enable SWAP

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Alexey Brodkin 

commit c83532fb0fe053d2e43e9387354cb1b52ba26427 upstream.

SWAP support on ARC was fixed earlier by
commit 6e3761145a9b ("ARC: Fix CONFIG_SWAP")
so now we may safely enable it on platforms that
have external media like USB and SD-card.

Note: it was already allowed for HSDK

Signed-off-by: Alexey Brodkin 
Cc: sta...@vger.kernel.org # 6e3761145a9b: ARC: Fix CONFIG_SWAP
Signed-off-by: Vineet Gupta 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/arc/configs/axs101_defconfig |1 -
 arch/arc/configs/axs103_defconfig |1 -
 arch/arc/configs/axs103_smp_defconfig |1 -
 3 files changed, 3 deletions(-)

--- a/arch/arc/configs/axs101_defconfig
+++ b/arch/arc/configs/axs101_defconfig
@@ -1,5 +1,4 @@
 CONFIG_DEFAULT_HOSTNAME="ARCLinux"
-# CONFIG_SWAP is not set
 CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
 # CONFIG_CROSS_MEMORY_ATTACH is not set
--- a/arch/arc/configs/axs103_defconfig
+++ b/arch/arc/configs/axs103_defconfig
@@ -1,5 +1,4 @@
 CONFIG_DEFAULT_HOSTNAME="ARCLinux"
-# CONFIG_SWAP is not set
 CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
 # CONFIG_CROSS_MEMORY_ATTACH is not set
--- a/arch/arc/configs/axs103_smp_defconfig
+++ b/arch/arc/configs/axs103_smp_defconfig
@@ -1,5 +1,4 @@
 CONFIG_DEFAULT_HOSTNAME="ARCLinux"
-# CONFIG_SWAP is not set
 CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
 # CONFIG_CROSS_MEMORY_ATTACH is not set

[PATCH 4.18 040/158] x86/apic/vector: Make error return value negative

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Thomas Gleixner 

commit 47b7360ce563e18c524ce92b55fb4da72b3b3578 upstream.

activate_managed() returns EINVAL instead of -EINVAL in case of
error. While this is unlikely to happen, the positive return value would
cause further malfunction at the call site.

Fixes: 2db1f959d9dc ("x86/vector: Handle managed interrupts proper")
Signed-off-by: Thomas Gleixner 
Cc: sta...@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman 

---
 arch/x86/kernel/apic/vector.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/x86/kernel/apic/vector.c
+++ b/arch/x86/kernel/apic/vector.c
@@ -422,7 +422,7 @@ static int activate_managed(struct irq_d
if (WARN_ON_ONCE(cpumask_empty(vector_searchmask))) {
/* Something in the core code broke! Survive gracefully */
pr_err("Managed startup for irq %u, but no CPU\n", irqd->irq);
-   return EINVAL;
+   return -EINVAL;
}
 
ret = assign_managed_vector(irqd, vector_searchmask);

[PATCH 4.18 043/158] tc-testing: flush gact actions on test teardown

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Vlad Buslov 

[ Upstream commit 0c62f8a820b7fdeacf5ad9f9e24b53043d372c97 ]

Test 6fb4 creates one mirred and one pipe action, but only flushes mirred
on teardown. Leaking pipe action causes failures in other tests.

Add additional teardown command to also flush gact actions.

Signed-off-by: Vlad Buslov 
Acked-by: Jamal Hadi Salim 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 tools/testing/selftests/tc-testing/tc-tests/actions/mirred.json |3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/tools/testing/selftests/tc-testing/tc-tests/actions/mirred.json
+++ b/tools/testing/selftests/tc-testing/tc-tests/actions/mirred.json
@@ -44,7 +44,8 @@
 "matchPattern": "action order [0-9]*: mirred \\(Egress Redirect to 
device lo\\).*index 2 ref",
 "matchCount": "1",
 "teardown": [
-"$TC actions flush action mirred"
+"$TC actions flush action mirred",
+"$TC actions flush action gact"
 ]
 },
 {

[PATCH 4.18 071/158] firmware: vpd: Fix section enabled flag on vpd_section_destroy

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Anton Vasilyev 

[ Upstream commit 45ca3f76de0507ecf143f770570af2942f263812 ]

static struct ro_vpd and rw_vpd are initialized by vpd_sections_init()
in vpd_probe() based on header's ro and rw sizes.
In vpd_remove() vpd_section_destroy() performs deinitialization based
on enabled flag, which is set to true by vpd_sections_init().
This leads to call of vpd_section_destroy() on already destroyed section
for probe-release-probe-release sequence if first probe performs
ro_vpd initialization and second probe does not initialize it.

The patch adds changing enabled flag on vpd_section_destroy and adds
cleanup on the error path of vpd_sections_init.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Anton Vasilyev 
Reviewed-by: Guenter Roeck 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/firmware/google/vpd.c |5 -
 1 file changed, 4 insertions(+), 1 deletion(-)

--- a/drivers/firmware/google/vpd.c
+++ b/drivers/firmware/google/vpd.c
@@ -246,6 +246,7 @@ static int vpd_section_destroy(struct vp
sysfs_remove_bin_file(vpd_kobj, >bin_attr);
kfree(sec->raw_name);
memunmap(sec->baseaddr);
+   sec->enabled = false;
}
 
return 0;
@@ -279,8 +280,10 @@ static int vpd_sections_init(phys_addr_t
ret = vpd_section_init("rw", _vpd,
   physaddr + sizeof(struct vpd_cbmem) +
   header.ro_size, header.rw_size);
-   if (ret)
+   if (ret) {
+   vpd_section_destroy(_vpd);
return ret;
+   }
}
 
return 0;

[PATCH 4.18 071/158] firmware: vpd: Fix section enabled flag on vpd_section_destroy

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Anton Vasilyev 

[ Upstream commit 45ca3f76de0507ecf143f770570af2942f263812 ]

static struct ro_vpd and rw_vpd are initialized by vpd_sections_init()
in vpd_probe() based on header's ro and rw sizes.
In vpd_remove() vpd_section_destroy() performs deinitialization based
on enabled flag, which is set to true by vpd_sections_init().
This leads to call of vpd_section_destroy() on already destroyed section
for probe-release-probe-release sequence if first probe performs
ro_vpd initialization and second probe does not initialize it.

The patch adds changing enabled flag on vpd_section_destroy and adds
cleanup on the error path of vpd_sections_init.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Anton Vasilyev 
Reviewed-by: Guenter Roeck 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/firmware/google/vpd.c |5 -
 1 file changed, 4 insertions(+), 1 deletion(-)

--- a/drivers/firmware/google/vpd.c
+++ b/drivers/firmware/google/vpd.c
@@ -246,6 +246,7 @@ static int vpd_section_destroy(struct vp
sysfs_remove_bin_file(vpd_kobj, >bin_attr);
kfree(sec->raw_name);
memunmap(sec->baseaddr);
+   sec->enabled = false;
}
 
return 0;
@@ -279,8 +280,10 @@ static int vpd_sections_init(phys_addr_t
ret = vpd_section_init("rw", _vpd,
   physaddr + sizeof(struct vpd_cbmem) +
   header.ro_size, header.rw_size);
-   if (ret)
+   if (ret) {
+   vpd_section_destroy(_vpd);
return ret;
+   }
}
 
return 0;

[PATCH 4.18 053/158] powerpc/4xx: Fix error return path in ppc4xx_msi_probe()

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Guenter Roeck 

[ Upstream commit 6e0495c2e8ac39b1aad0a4588fe64413ce9028c0 ]

An arbitrary error in ppc4xx_msi_probe() quite likely results in a
crash similar to the following, seen after dma_alloc_coherent()
returned an error.

  Unable to handle kernel paging request for data at address 0x
  Faulting instruction address: 0xc001bff0
  Oops: Kernel access of bad area, sig: 11 [#1]
  BE Canyonlands
  Modules linked in:
  CPU: 0 PID: 1 Comm: swapper Tainted: GW
  4.18.0-rc6-00010-gff33d1030a6c #1
  NIP:  c001bff0 LR: c001c418 CTR: c01faa7c
  REGS: cf82db40 TRAP: 0300   Tainted: GW
  (4.18.0-rc6-00010-gff33d1030a6c)
  MSR:  00029000   CR: 28002024  XER: 
  DEAR:  ESR: 
  GPR00: c001c418 cf82dbf0 cf828000 cf8de400   00c4 00c4
  GPR08: c0481ea4   00c4 22002024  c00025e8 
  GPR16:       c0492380 004a
  GPR24: 00029000 000c  cf8de410 c0494d60 c0494d60 cf8bebc0 0001
  NIP [c001bff0] ppc4xx_of_msi_remove+0x48/0xa0
  LR [c001c418] ppc4xx_msi_probe+0x294/0x3b8
  Call Trace:
  [cf82dbf0] [00029000] 0x29000 (unreliable)
  [cf82dc10] [c001c418] ppc4xx_msi_probe+0x294/0x3b8
  [cf82dc70] [c0209fbc] platform_drv_probe+0x40/0x9c
  [cf82dc90] [c0208240] driver_probe_device+0x2a8/0x350
  [cf82dcc0] [c0206204] bus_for_each_drv+0x60/0xac
  [cf82dcf0] [c0207e88] __device_attach+0xe8/0x160
  [cf82dd20] [c02071e0] bus_probe_device+0xa0/0xbc
  [cf82dd40] [c02050c8] device_add+0x404/0x5c4
  [cf82dd90] [c0288978] of_platform_device_create_pdata+0x88/0xd8
  [cf82ddb0] [c0288b70] of_platform_bus_create+0x134/0x220
  [cf82de10] [c0288bcc] of_platform_bus_create+0x190/0x220
  [cf82de70] [c0288cf4] of_platform_bus_probe+0x98/0xec
  [cf82de90] [c0449650] 
__machine_initcall_canyonlands_ppc460ex_device_probe+0x38/0x54
  [cf82dea0] [c0002404] do_one_initcall+0x40/0x188
  [cf82df00] [c043daec] kernel_init_freeable+0x130/0x1d0
  [cf82df30] [c0002600] kernel_init+0x18/0x104
  [cf82df40] [c000c23c] ret_from_kernel_thread+0x14/0x1c
  Instruction dump:
  90010024 813d0024 2f89 83c30058 41bd0014 4838 813d0024 7f89f800
  409d002c 813e000c 57ea103a 3bff0001 <7c69502e> 2f83 419effe0 4803b26d
  ---[ end trace 8cf551077ecfc42a ]---

Fix it up. Specifically,

- Return valid error codes from ppc4xx_setup_pcieh_hw(), have it clean
  up after itself, and only access hardware after all possible error
  conditions have been handled.
- Use devm_kzalloc() instead of kzalloc() in ppc4xx_msi_probe()

Signed-off-by: Guenter Roeck 
Reviewed-by: Christoph Hellwig 
Signed-off-by: Michael Ellerman 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 arch/powerpc/platforms/4xx/msi.c |   51 ++-
 1 file changed, 30 insertions(+), 21 deletions(-)

--- a/arch/powerpc/platforms/4xx/msi.c
+++ b/arch/powerpc/platforms/4xx/msi.c
@@ -146,13 +146,19 @@ static int ppc4xx_setup_pcieh_hw(struct
const u32 *sdr_addr;
dma_addr_t msi_phys;
void *msi_virt;
+   int err;
 
sdr_addr = of_get_property(dev->dev.of_node, "sdr-base", NULL);
if (!sdr_addr)
-   return -1;
+   return -EINVAL;
 
-   mtdcri(SDR0, *sdr_addr, upper_32_bits(res.start));  /*HIGH addr */
-   mtdcri(SDR0, *sdr_addr + 1, lower_32_bits(res.start));  /* Low addr */
+   msi_data = of_get_property(dev->dev.of_node, "msi-data", NULL);
+   if (!msi_data)
+   return -EINVAL;
+
+   msi_mask = of_get_property(dev->dev.of_node, "msi-mask", NULL);
+   if (!msi_mask)
+   return -EINVAL;
 
msi->msi_dev = of_find_node_by_name(NULL, "ppc4xx-msi");
if (!msi->msi_dev)
@@ -160,30 +166,30 @@ static int ppc4xx_setup_pcieh_hw(struct
 
msi->msi_regs = of_iomap(msi->msi_dev, 0);
if (!msi->msi_regs) {
-   dev_err(>dev, "of_iomap problem failed\n");
-   return -ENOMEM;
+   dev_err(>dev, "of_iomap failed\n");
+   err = -ENOMEM;
+   goto node_put;
}
dev_dbg(>dev, "PCIE-MSI: msi register mapped 0x%x 0x%x\n",
(u32) (msi->msi_regs + PEIH_TERMADH), (u32) (msi->msi_regs));
 
msi_virt = dma_alloc_coherent(>dev, 64, _phys, GFP_KERNEL);
-   if (!msi_virt)
-   return -ENOMEM;
+   if (!msi_virt) {
+   err = -ENOMEM;
+   goto iounmap;
+   }
msi->msi_addr_hi = upper_32_bits(msi_phys);
msi->msi_addr_lo = lower_32_bits(msi_phys & 0x);
dev_dbg(>dev, "PCIE-MSI: msi address high 0x%x, low 0x%x\n",
msi->msi_addr_hi, msi->msi_addr_lo);
 
+   mtdcri(SDR0, *sdr_addr, upper_32_bits(res.start));  /*HIGH addr */
+   mtdcri(SDR0, *sdr_addr + 1, lower_32_bits(res.start));  /* Low 

[PATCH 4.18 070/158] uio: potential double frees if __uio_register_device() fails

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Dan Carpenter 

[ Upstream commit f019f07ecf6a6b8bd6d7853bce70925d90af02d1 ]

The uio_unregister_device() function assumes that if "info->uio_dev" is
non-NULL that means "info" is fully allocated.  Setting info->uio_de
has to be the last thing in the function.

In the current code, if request_threaded_irq() fails then we return with
info->uio_dev set to non-NULL but info is not fully allocated and it can
lead to double frees.

Fixes: beafc54c4e2f ("UIO: Add the User IO core code")
Signed-off-by: Dan Carpenter 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/uio/uio.c |3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

--- a/drivers/uio/uio.c
+++ b/drivers/uio/uio.c
@@ -955,8 +955,6 @@ int __uio_register_device(struct module
if (ret)
goto err_uio_dev_add_attributes;
 
-   info->uio_dev = idev;
-
if (info->irq && (info->irq != UIO_IRQ_CUSTOM)) {
/*
 * Note that we deliberately don't use devm_request_irq
@@ -972,6 +970,7 @@ int __uio_register_device(struct module
goto err_request_irq;
}
 
+   info->uio_dev = idev;
return 0;
 
 err_request_irq:

[PATCH 4.18 064/158] scsi: target: fix __transport_register_session locking

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Mike Christie 

[ Upstream commit 6a64f6e1591322beb8ce16e952a53582caf2a15c ]

When __transport_register_session is called from transport_register_session
irqs will already have been disabled, so we do not want the unlock irq call
to enable them until the higher level has done the final
spin_unlock_irqrestore/ spin_unlock_irq.

This has __transport_register_session use the save/restore call.

Signed-off-by: Mike Christie 
Reviewed-by: Bart Van Assche 
Reviewed-by: Christoph Hellwig 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/target/target_core_transport.c |5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -316,6 +316,7 @@ void __transport_register_session(
 {
const struct target_core_fabric_ops *tfo = se_tpg->se_tpg_tfo;
unsigned char buf[PR_REG_ISID_LEN];
+   unsigned long flags;
 
se_sess->se_tpg = se_tpg;
se_sess->fabric_sess_ptr = fabric_sess_ptr;
@@ -352,7 +353,7 @@ void __transport_register_session(
se_sess->sess_bin_isid = get_unaligned_be64([0]);
}
 
-   spin_lock_irq(_nacl->nacl_sess_lock);
+   spin_lock_irqsave(_nacl->nacl_sess_lock, flags);
/*
 * The se_nacl->nacl_sess pointer will be set to the
 * last active I_T Nexus for each struct se_node_acl.
@@ -361,7 +362,7 @@ void __transport_register_session(
 
list_add_tail(_sess->sess_acl_list,
  _nacl->acl_sess_list);
-   spin_unlock_irq(_nacl->nacl_sess_lock);
+   spin_unlock_irqrestore(_nacl->nacl_sess_lock, flags);
}
list_add_tail(_sess->sess_list, _tpg->tpg_sess_list);
 

[PATCH 4.14 123/126] tun: fix use after free for ptr_ring

[Greg Kroah-Hartman]

4.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Jason Wang 

commit b196d88aba8ac72b775137854121097f4c4c6862 upstream.

We used to initialize ptr_ring during TUNSETIFF, this is because its
size depends on the tx_queue_len of netdevice. And we try to clean it
up when socket were detached from netdevice. A race were spotted when
trying to do uninit during a read which will lead a use after free for
pointer ring. Solving this by always initialize a zero size ptr_ring
in open() and do resizing during TUNSETIFF, and then we can safely do
cleanup during close(). With this, there's no need for the workaround
that was introduced by commit 4df0bfc79904 ("tun: fix a memory leak
for tfile->tx_array").

Backport Note :-
Comparison with the upstream patch:
[1] A "semantic revert" of the changes made in
4df0bfc799("tun: fix a memory leak for tfile->tx_array").
4df0bfc799 was applied upstream, and then skb array was changed
to use ptr_ring. The upstream patch then removes the changes introduced
by 4df0bfc799. This backport does the same; "revert" the changes
made by 4df0bfc799.
[2] xdp_rxq_info_unreg() being called in relevant locations
As xdp_rxq_info related patches are not present in 4.14, these
changes are not needed in the backport.
[3] An instance of ptr_ring_init needs to be replaced by skb_array_init
Inside tun_attach()
[4] ptr_ring_cleanup needs to be replaced by skb_array_cleanup
Inside tun_chr_close()

Note that the backport for 7063efd33b ("tuntap: fix use after free during 
release")
needs to be applied on top of this patch.

Reported-by: syzbot+e8b902c3c3fadf0a9...@syzkaller.appspotmail.com
Cc: Eric Dumazet 
Cc: Cong Wang 
Cc: Michael S. Tsirkin 
Fixes: 1576d9860599 ("tun: switch to use skb array for tx")
Signed-off-by: Jason Wang 
Acked-by: Michael S. Tsirkin 
Signed-off-by: David S. Miller 
Signed-off-by: Zubin Mithra 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/net/tun.c |   21 +++--
 1 file changed, 7 insertions(+), 14 deletions(-)

--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -534,14 +534,6 @@ static void tun_queue_purge(struct tun_f
skb_queue_purge(>sk.sk_error_queue);
 }
 
-static void tun_cleanup_tx_array(struct tun_file *tfile)
-{
-   if (tfile->tx_array.ring.queue) {
-   skb_array_cleanup(>tx_array);
-   memset(>tx_array, 0, sizeof(tfile->tx_array));
-   }
-}
-
 static void __tun_detach(struct tun_file *tfile, bool clean)
 {
struct tun_file *ntfile;
@@ -583,7 +575,6 @@ static void __tun_detach(struct tun_file
tun->dev->reg_state == NETREG_REGISTERED)
unregister_netdevice(tun->dev);
}
-   tun_cleanup_tx_array(tfile);
sock_put(>sk);
}
 }
@@ -623,13 +614,11 @@ static void tun_detach_all(struct net_de
/* Drop read queue */
tun_queue_purge(tfile);
sock_put(>sk);
-   tun_cleanup_tx_array(tfile);
}
list_for_each_entry_safe(tfile, tmp, >disabled, next) {
tun_enable_queue(tfile);
tun_queue_purge(tfile);
sock_put(>sk);
-   tun_cleanup_tx_array(tfile);
}
BUG_ON(tun->numdisabled != 0);
 
@@ -675,7 +664,7 @@ static int tun_attach(struct tun_struct
}
 
if (!tfile->detached &&
-   skb_array_init(>tx_array, dev->tx_queue_len, GFP_KERNEL)) {
+   skb_array_resize(>tx_array, dev->tx_queue_len, GFP_KERNEL)) {
err = -ENOMEM;
goto out;
}
@@ -2624,6 +2613,11 @@ static int tun_chr_open(struct inode *in
_proto, 0);
if (!tfile)
return -ENOMEM;
+   if (skb_array_init(>tx_array, 0, GFP_KERNEL)) {
+   sk_free(>sk);
+   return -ENOMEM;
+   }
+
RCU_INIT_POINTER(tfile->tun, NULL);
tfile->flags = 0;
tfile->ifindex = 0;
@@ -2644,8 +2638,6 @@ static int tun_chr_open(struct inode *in
 
sock_set_flag(>sk, SOCK_ZEROCOPY);
 
-   memset(>tx_array, 0, sizeof(tfile->tx_array));
-
return 0;
 }
 
@@ -2654,6 +2646,7 @@ static int tun_chr_close(struct inode *i
struct tun_file *tfile = file->private_data;
 
tun_detach(tfile, true);
+   skb_array_cleanup(>tx_array);
 
return 0;
 }

[PATCH 4.14 120/126] ip: process in-order fragments efficiently

[Greg Kroah-Hartman]

4.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Peter Oskolkov 

This patch changes the runtime behavior of IP defrag queue:
incoming in-order fragments are added to the end of the current
list/"run" of in-order fragments at the tail.

On some workloads, UDP stream performance is substantially improved:

RX: ./udp_stream -F 10 -T 2 -l 60
TX: ./udp_stream -c -H  -F 10 -T 5 -l 60

with this patchset applied on a 10Gbps receiver:

  throughput=9524.18
  throughput_units=Mbit/s

upstream (net-next):

  throughput=4608.93
  throughput_units=Mbit/s

Reported-by: Willem de Bruijn 
Signed-off-by: Peter Oskolkov 
Cc: Eric Dumazet 
Cc: Florian Westphal 
Signed-off-by: David S. Miller 
(cherry picked from commit a4fd284a1f8fd4b6c59aa59db2185b1e17c5c11c)
Signed-off-by: Greg Kroah-Hartman 
---
 net/ipv4/inet_fragment.c |2 
 net/ipv4/ip_fragment.c   |  110 +--
 2 files changed, 70 insertions(+), 42 deletions(-)

--- a/net/ipv4/inet_fragment.c
+++ b/net/ipv4/inet_fragment.c
@@ -145,7 +145,7 @@ void inet_frag_destroy(struct inet_frag_
fp = xp;
} while (fp);
} else {
-   sum_truesize = skb_rbtree_purge(>rb_fragments);
+   sum_truesize = inet_frag_rbtree_purge(>rb_fragments);
}
sum = sum_truesize + f->qsize;
 
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -126,8 +126,8 @@ static u8 ip4_frag_ecn(u8 tos)
 
 static struct inet_frags ip4_frags;
 
-static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev,
-struct net_device *dev);
+static int ip_frag_reasm(struct ipq *qp, struct sk_buff *skb,
+struct sk_buff *prev_tail, struct net_device *dev);
 
 
 static void ip4_frag_init(struct inet_frag_queue *q, const void *a)
@@ -219,7 +219,12 @@ static void ip_expire(struct timer_list
head = skb_rb_first(>q.rb_fragments);
if (!head)
goto out;
-   rb_erase(>rbnode, >q.rb_fragments);
+   if (FRAG_CB(head)->next_frag)
+   rb_replace_node(>rbnode,
+   _CB(head)->next_frag->rbnode,
+   >q.rb_fragments);
+   else
+   rb_erase(>rbnode, >q.rb_fragments);
memset(>rbnode, 0, sizeof(head->rbnode));
barrier();
}
@@ -320,7 +325,7 @@ static int ip_frag_reinit(struct ipq *qp
return -ETIMEDOUT;
}
 
-   sum_truesize = skb_rbtree_purge(>q.rb_fragments);
+   sum_truesize = inet_frag_rbtree_purge(>q.rb_fragments);
sub_frag_mem_limit(qp->q.net, sum_truesize);
 
qp->q.flags = 0;
@@ -329,6 +334,7 @@ static int ip_frag_reinit(struct ipq *qp
qp->q.fragments = NULL;
qp->q.rb_fragments = RB_ROOT;
qp->q.fragments_tail = NULL;
+   qp->q.last_run_head = NULL;
qp->iif = 0;
qp->ecn = 0;
 
@@ -340,7 +346,7 @@ static int ip_frag_queue(struct ipq *qp,
 {
struct net *net = container_of(qp->q.net, struct net, ipv4.frags);
struct rb_node **rbn, *parent;
-   struct sk_buff *skb1;
+   struct sk_buff *skb1, *prev_tail;
struct net_device *dev;
unsigned int fragsize;
int flags, offset;
@@ -418,38 +424,41 @@ static int ip_frag_queue(struct ipq *qp,
 */
 
/* Find out where to put this fragment.  */
-   skb1 = qp->q.fragments_tail;
-   if (!skb1) {
-   /* This is the first fragment we've received. */
-   rb_link_node(>rbnode, NULL, >q.rb_fragments.rb_node);
-   qp->q.fragments_tail = skb;
-   } else if ((skb1->ip_defrag_offset + skb1->len) < end) {
-   /* This is the common/special case: skb goes to the end. */
+   prev_tail = qp->q.fragments_tail;
+   if (!prev_tail)
+   ip4_frag_create_run(>q, skb);  /* First fragment. */
+   else if (prev_tail->ip_defrag_offset + prev_tail->len < end) {
+   /* This is the common case: skb goes to the end. */
/* Detect and discard overlaps. */
-   if (offset < (skb1->ip_defrag_offset + skb1->len))
+   if (offset < prev_tail->ip_defrag_offset + prev_tail->len)
goto discard_qp;
-   /* Insert after skb1. */
-   rb_link_node(>rbnode, >rbnode, 
>rbnode.rb_right);
-   qp->q.fragments_tail = skb;
+   if (offset == prev_tail->ip_defrag_offset + prev_tail->len)
+   ip4_frag_append_to_last_run(>q, skb);
+   else
+   ip4_frag_create_run(>q, skb);
} else {
-   /* Binary search. Note that skb can become the first fragment, 
but
-* not the last (covered above). */
+   /* Binary search. Note that skb can become 

[PATCH 4.18 054/158] selftests/bpf: fix a typo in map in map test

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Roman Gushchin 

[ Upstream commit 0069fb854364da79fd99236ea620affc8e1152d5 ]

Commit fbeb1603bf4e ("bpf: verifier: MOV64 don't mark dst reg unbounded")
revealed a typo in commit fb30d4b71214 ("bpf: Add tests for map-in-map"):
BPF_MOV64_REG(BPF_REG_0, 0) was used instead of
BPF_MOV64_IMM(BPF_REG_0, 0).

I've noticed the problem by running bpf kselftests.

Fixes: fb30d4b71214 ("bpf: Add tests for map-in-map")
Signed-off-by: Roman Gushchin 
Cc: Martin KaFai Lau 
Cc: Arthur Fabre 
Cc: Daniel Borkmann 
Cc: Alexei Starovoitov 
Acked-by: Martin KaFai Lau 
Signed-off-by: Daniel Borkmann 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 tools/testing/selftests/bpf/test_verifier.c |6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/tools/testing/selftests/bpf/test_verifier.c
+++ b/tools/testing/selftests/bpf/test_verifier.c
@@ -6997,7 +6997,7 @@ static struct bpf_test tests[] = {
BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 BPF_FUNC_map_lookup_elem),
-   BPF_MOV64_REG(BPF_REG_0, 0),
+   BPF_MOV64_IMM(BPF_REG_0, 0),
BPF_EXIT_INSN(),
},
.fixup_map_in_map = { 3 },
@@ -7020,7 +7020,7 @@ static struct bpf_test tests[] = {
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 BPF_FUNC_map_lookup_elem),
-   BPF_MOV64_REG(BPF_REG_0, 0),
+   BPF_MOV64_IMM(BPF_REG_0, 0),
BPF_EXIT_INSN(),
},
.fixup_map_in_map = { 3 },
@@ -7042,7 +7042,7 @@ static struct bpf_test tests[] = {
BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 BPF_FUNC_map_lookup_elem),
-   BPF_MOV64_REG(BPF_REG_0, 0),
+   BPF_MOV64_IMM(BPF_REG_0, 0),
BPF_EXIT_INSN(),
},
.fixup_map_in_map = { 3 },

[PATCH 4.18 055/158] media: davinci: vpif_display: Mix memory leak on probe error path

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Anton Vasilyev 

[ Upstream commit 61e641f36ed81ae473177c085f0bfd83ad3b55ed ]

If vpif_probe() fails on v4l2_device_register() then memory allocated
at initialize_vpif() for global vpif_obj.dev[i] become unreleased.

The patch adds deallocation of vpif_obj.dev[i] on the error path and
removes duplicated check on platform_data presence.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Anton Vasilyev 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/media/platform/davinci/vpif_display.c |   24 
 1 file changed, 16 insertions(+), 8 deletions(-)

--- a/drivers/media/platform/davinci/vpif_display.c
+++ b/drivers/media/platform/davinci/vpif_display.c
@@ -1114,6 +1114,14 @@ vpif_init_free_channel_objects:
return err;
 }
 
+static void free_vpif_objs(void)
+{
+   int i;
+
+   for (i = 0; i < VPIF_DISPLAY_MAX_DEVICES; i++)
+   kfree(vpif_obj.dev[i]);
+}
+
 static int vpif_async_bound(struct v4l2_async_notifier *notifier,
struct v4l2_subdev *subdev,
struct v4l2_async_subdev *asd)
@@ -1255,11 +1263,6 @@ static __init int vpif_probe(struct plat
return -EINVAL;
}
 
-   if (!pdev->dev.platform_data) {
-   dev_warn(>dev, "Missing platform data.  Giving up.\n");
-   return -EINVAL;
-   }
-
vpif_dev = >dev;
err = initialize_vpif();
 
@@ -1271,7 +1274,7 @@ static __init int vpif_probe(struct plat
err = v4l2_device_register(vpif_dev, _obj.v4l2_dev);
if (err) {
v4l2_err(vpif_dev->driver, "Error registering v4l2 device\n");
-   return err;
+   goto vpif_free;
}
 
while ((res = platform_get_resource(pdev, IORESOURCE_IRQ, res_idx))) {
@@ -1314,7 +1317,10 @@ static __init int vpif_probe(struct plat
if (vpif_obj.sd[i])
vpif_obj.sd[i]->grp_id = 1 << i;
}
-   vpif_probe_complete();
+   err = vpif_probe_complete();
+   if (err) {
+   goto probe_subdev_out;
+   }
} else {
vpif_obj.notifier.subdevs = vpif_obj.config->asd;
vpif_obj.notifier.num_subdevs = vpif_obj.config->asd_sizes[0];
@@ -1334,6 +1340,8 @@ probe_subdev_out:
kfree(vpif_obj.sd);
 vpif_unregister:
v4l2_device_unregister(_obj.v4l2_dev);
+vpif_free:
+   free_vpif_objs();
 
return err;
 }
@@ -1355,8 +1363,8 @@ static int vpif_remove(struct platform_d
ch = vpif_obj.dev[i];
/* Unregister video device */
video_unregister_device(>video_dev);
-   kfree(vpif_obj.dev[i]);
}
+   free_vpif_objs();
 
return 0;
 }

[PATCH 4.18 065/158] md/raid5: fix data corruption of replacements after originals dropped

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: BingJing Chang 

[ Upstream commit d63e2fc804c46e50eee825c5d3a7228e07048b47 ]

During raid5 replacement, the stripes can be marked with R5_NeedReplace
flag. Data can be read from being-replaced devices and written to
replacing spares without reading all other devices. (It's 'replace'
mode. s.replacing = 1) If a being-replaced device is dropped, the
replacement progress will be interrupted and resumed with pure recovery
mode. However, existing stripes before being interrupted cannot read
from the dropped device anymore. It prints lots of WARN_ON messages.
And it results in data corruption because existing stripes write
problematic data into its replacement device and update the progress.

\# Erase disks (1MB + 2GB)
dd if=/dev/zero of=/dev/sda bs=1MB count=2049
dd if=/dev/zero of=/dev/sdb bs=1MB count=2049
dd if=/dev/zero of=/dev/sdc bs=1MB count=2049
dd if=/dev/zero of=/dev/sdd bs=1MB count=2049
mdadm -C /dev/md0 -amd -R -l5 -n3 -x0 /dev/sd[abc] -z 2097152
\# Ensure array stores non-zero data
dd if=/root/data_4GB.iso of=/dev/md0 bs=1MB
\# Start replacement
mdadm /dev/md0 -a /dev/sdd
mdadm /dev/md0 --replace /dev/sda

Then, Hot-plug out /dev/sda during recovery, and wait for recovery done.
echo check > /sys/block/md0/md/sync_action
cat /sys/block/md0/md/mismatch_cnt # it will be greater than 0.

Soon after you hot-plug out /dev/sda, you will see many WARN_ON
messages. The replacement recovery will be interrupted shortly. After
the recovery finishes, it will result in data corruption.

Actually, it's just an unhandled case of replacement. In commit
 (md/raid5: fix interaction of 'replace' and 'recovery'.),
if a NeedReplace device is not UPTODATE then that is an error, the
commit just simply print WARN_ON but also mark these corrupted stripes
with R5_WantReplace. (it means it's ready for writes.)

To fix this case, we can leverage 'sync and replace' mode mentioned in
commit <9a3e1101b827> (md/raid5: detect and handle replacements during
recovery.). We can add logics to detect and use 'sync and replace' mode
for these stripes.

Reported-by: Alex Chen 
Reviewed-by: Alex Wu 
Reviewed-by: Chung-Chiang Cheng 
Signed-off-by: BingJing Chang 
Signed-off-by: Shaohua Li 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/md/raid5.c |6 ++
 1 file changed, 6 insertions(+)

--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -4521,6 +4521,12 @@ static void analyse_stripe(struct stripe
s->failed++;
if (rdev && !test_bit(Faulty, >flags))
do_recovery = 1;
+   else if (!rdev) {
+   rdev = rcu_dereference(
+   conf->disks[i].replacement);
+   if (rdev && !test_bit(Faulty, >flags))
+   do_recovery = 1;
+   }
}
 
if (test_bit(R5_InJournal, >flags))

[PATCH 4.18 066/158] timers: Clear timer_base::must_forward_clk with timer_base::lock held

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Gaurav Kohli 

[ Upstream commit 363e934d8811d799c88faffc5bfca782fd728334 ]

timer_base::must_forward_clock is indicating that the base clock might be
stale due to a long idle sleep.

The forwarding of the base clock takes place in the timer softirq or when a
timer is enqueued to a base which is idle. If the enqueue of timer to an
idle base happens from a remote CPU, then the following race can happen:

  CPU0  CPU1
  run_timer_softirq mod_timer

base = lock_timer_base(timer);
  base->must_forward_clk = false
if (base->must_forward_clk)
forward(base); -> skipped

enqueue_timer(base, timer, idx);
-> idx is calculated high due to
   stale base
unlock_timer_base(timer);
  base = lock_timer_base(timer);
  forward(base);

The root cause is that timer_base::must_forward_clk is cleared outside the
timer_base::lock held region, so the remote queuing CPU observes it as
cleared, but the base clock is still stale. This can cause large
granularity values for timers, i.e. the accuracy of the expiry time
suffers.

Prevent this by clearing the flag with timer_base::lock held, so that the
forwarding takes place before the cleared flag is observable by a remote
CPU.

Signed-off-by: Gaurav Kohli 
Signed-off-by: Thomas Gleixner 
Cc: john.stu...@linaro.org
Cc: sb...@kernel.org
Cc: linux-arm-...@vger.kernel.org
Link: 
https://lkml.kernel.org/r/1533199863-22748-1-git-send-email-gko...@codeaurora.org
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 kernel/time/timer.c |   29 -
 1 file changed, 16 insertions(+), 13 deletions(-)

--- a/kernel/time/timer.c
+++ b/kernel/time/timer.c
@@ -1657,6 +1657,22 @@ static inline void __run_timers(struct t
 
raw_spin_lock_irq(>lock);
 
+   /*
+* timer_base::must_forward_clk must be cleared before running
+* timers so that any timer functions that call mod_timer() will
+* not try to forward the base. Idle tracking / clock forwarding
+* logic is only used with BASE_STD timers.
+*
+* The must_forward_clk flag is cleared unconditionally also for
+* the deferrable base. The deferrable base is not affected by idle
+* tracking and never forwarded, so clearing the flag is a NOOP.
+*
+* The fact that the deferrable base is never forwarded can cause
+* large variations in granularity for deferrable timers, but they
+* can be deferred for long periods due to idle anyway.
+*/
+   base->must_forward_clk = false;
+
while (time_after_eq(jiffies, base->clk)) {
 
levels = collect_expired_timers(base, heads);
@@ -1676,19 +1692,6 @@ static __latent_entropy void run_timer_s
 {
struct timer_base *base = this_cpu_ptr(_bases[BASE_STD]);
 
-   /*
-* must_forward_clk must be cleared before running timers so that any
-* timer functions that call mod_timer will not try to forward the
-* base. idle trcking / clock forwarding logic is only used with
-* BASE_STD timers.
-*
-* The deferrable base does not do idle tracking at all, so we do
-* not forward it. This can result in very large variations in
-* granularity for deferrable timers, but they can be deferred for
-* long periods due to idle.
-*/
-   base->must_forward_clk = false;
-
__run_timers(base);
if (IS_ENABLED(CONFIG_NO_HZ_COMMON))
__run_timers(this_cpu_ptr(_bases[BASE_DEF]));

[PATCH 4.18 053/158] powerpc/4xx: Fix error return path in ppc4xx_msi_probe()

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Guenter Roeck 

[ Upstream commit 6e0495c2e8ac39b1aad0a4588fe64413ce9028c0 ]

An arbitrary error in ppc4xx_msi_probe() quite likely results in a
crash similar to the following, seen after dma_alloc_coherent()
returned an error.

  Unable to handle kernel paging request for data at address 0x
  Faulting instruction address: 0xc001bff0
  Oops: Kernel access of bad area, sig: 11 [#1]
  BE Canyonlands
  Modules linked in:
  CPU: 0 PID: 1 Comm: swapper Tainted: GW
  4.18.0-rc6-00010-gff33d1030a6c #1
  NIP:  c001bff0 LR: c001c418 CTR: c01faa7c
  REGS: cf82db40 TRAP: 0300   Tainted: GW
  (4.18.0-rc6-00010-gff33d1030a6c)
  MSR:  00029000   CR: 28002024  XER: 
  DEAR:  ESR: 
  GPR00: c001c418 cf82dbf0 cf828000 cf8de400   00c4 00c4
  GPR08: c0481ea4   00c4 22002024  c00025e8 
  GPR16:       c0492380 004a
  GPR24: 00029000 000c  cf8de410 c0494d60 c0494d60 cf8bebc0 0001
  NIP [c001bff0] ppc4xx_of_msi_remove+0x48/0xa0
  LR [c001c418] ppc4xx_msi_probe+0x294/0x3b8
  Call Trace:
  [cf82dbf0] [00029000] 0x29000 (unreliable)
  [cf82dc10] [c001c418] ppc4xx_msi_probe+0x294/0x3b8
  [cf82dc70] [c0209fbc] platform_drv_probe+0x40/0x9c
  [cf82dc90] [c0208240] driver_probe_device+0x2a8/0x350
  [cf82dcc0] [c0206204] bus_for_each_drv+0x60/0xac
  [cf82dcf0] [c0207e88] __device_attach+0xe8/0x160
  [cf82dd20] [c02071e0] bus_probe_device+0xa0/0xbc
  [cf82dd40] [c02050c8] device_add+0x404/0x5c4
  [cf82dd90] [c0288978] of_platform_device_create_pdata+0x88/0xd8
  [cf82ddb0] [c0288b70] of_platform_bus_create+0x134/0x220
  [cf82de10] [c0288bcc] of_platform_bus_create+0x190/0x220
  [cf82de70] [c0288cf4] of_platform_bus_probe+0x98/0xec
  [cf82de90] [c0449650] 
__machine_initcall_canyonlands_ppc460ex_device_probe+0x38/0x54
  [cf82dea0] [c0002404] do_one_initcall+0x40/0x188
  [cf82df00] [c043daec] kernel_init_freeable+0x130/0x1d0
  [cf82df30] [c0002600] kernel_init+0x18/0x104
  [cf82df40] [c000c23c] ret_from_kernel_thread+0x14/0x1c
  Instruction dump:
  90010024 813d0024 2f89 83c30058 41bd0014 4838 813d0024 7f89f800
  409d002c 813e000c 57ea103a 3bff0001 <7c69502e> 2f83 419effe0 4803b26d
  ---[ end trace 8cf551077ecfc42a ]---

Fix it up. Specifically,

- Return valid error codes from ppc4xx_setup_pcieh_hw(), have it clean
  up after itself, and only access hardware after all possible error
  conditions have been handled.
- Use devm_kzalloc() instead of kzalloc() in ppc4xx_msi_probe()

Signed-off-by: Guenter Roeck 
Reviewed-by: Christoph Hellwig 
Signed-off-by: Michael Ellerman 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 arch/powerpc/platforms/4xx/msi.c |   51 ++-
 1 file changed, 30 insertions(+), 21 deletions(-)

--- a/arch/powerpc/platforms/4xx/msi.c
+++ b/arch/powerpc/platforms/4xx/msi.c
@@ -146,13 +146,19 @@ static int ppc4xx_setup_pcieh_hw(struct
const u32 *sdr_addr;
dma_addr_t msi_phys;
void *msi_virt;
+   int err;
 
sdr_addr = of_get_property(dev->dev.of_node, "sdr-base", NULL);
if (!sdr_addr)
-   return -1;
+   return -EINVAL;
 
-   mtdcri(SDR0, *sdr_addr, upper_32_bits(res.start));  /*HIGH addr */
-   mtdcri(SDR0, *sdr_addr + 1, lower_32_bits(res.start));  /* Low addr */
+   msi_data = of_get_property(dev->dev.of_node, "msi-data", NULL);
+   if (!msi_data)
+   return -EINVAL;
+
+   msi_mask = of_get_property(dev->dev.of_node, "msi-mask", NULL);
+   if (!msi_mask)
+   return -EINVAL;
 
msi->msi_dev = of_find_node_by_name(NULL, "ppc4xx-msi");
if (!msi->msi_dev)
@@ -160,30 +166,30 @@ static int ppc4xx_setup_pcieh_hw(struct
 
msi->msi_regs = of_iomap(msi->msi_dev, 0);
if (!msi->msi_regs) {
-   dev_err(>dev, "of_iomap problem failed\n");
-   return -ENOMEM;
+   dev_err(>dev, "of_iomap failed\n");
+   err = -ENOMEM;
+   goto node_put;
}
dev_dbg(>dev, "PCIE-MSI: msi register mapped 0x%x 0x%x\n",
(u32) (msi->msi_regs + PEIH_TERMADH), (u32) (msi->msi_regs));
 
msi_virt = dma_alloc_coherent(>dev, 64, _phys, GFP_KERNEL);
-   if (!msi_virt)
-   return -ENOMEM;
+   if (!msi_virt) {
+   err = -ENOMEM;
+   goto iounmap;
+   }
msi->msi_addr_hi = upper_32_bits(msi_phys);
msi->msi_addr_lo = lower_32_bits(msi_phys & 0x);
dev_dbg(>dev, "PCIE-MSI: msi address high 0x%x, low 0x%x\n",
msi->msi_addr_hi, msi->msi_addr_lo);
 
+   mtdcri(SDR0, *sdr_addr, upper_32_bits(res.start));  /*HIGH addr */
+   mtdcri(SDR0, *sdr_addr + 1, lower_32_bits(res.start));  /* Low 

[PATCH 4.18 070/158] uio: potential double frees if __uio_register_device() fails

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Dan Carpenter 

[ Upstream commit f019f07ecf6a6b8bd6d7853bce70925d90af02d1 ]

The uio_unregister_device() function assumes that if "info->uio_dev" is
non-NULL that means "info" is fully allocated.  Setting info->uio_de
has to be the last thing in the function.

In the current code, if request_threaded_irq() fails then we return with
info->uio_dev set to non-NULL but info is not fully allocated and it can
lead to double frees.

Fixes: beafc54c4e2f ("UIO: Add the User IO core code")
Signed-off-by: Dan Carpenter 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/uio/uio.c |3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

--- a/drivers/uio/uio.c
+++ b/drivers/uio/uio.c
@@ -955,8 +955,6 @@ int __uio_register_device(struct module
if (ret)
goto err_uio_dev_add_attributes;
 
-   info->uio_dev = idev;
-
if (info->irq && (info->irq != UIO_IRQ_CUSTOM)) {
/*
 * Note that we deliberately don't use devm_request_irq
@@ -972,6 +970,7 @@ int __uio_register_device(struct module
goto err_request_irq;
}
 
+   info->uio_dev = idev;
return 0;
 
 err_request_irq:

[PATCH 4.18 064/158] scsi: target: fix __transport_register_session locking

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Mike Christie 

[ Upstream commit 6a64f6e1591322beb8ce16e952a53582caf2a15c ]

When __transport_register_session is called from transport_register_session
irqs will already have been disabled, so we do not want the unlock irq call
to enable them until the higher level has done the final
spin_unlock_irqrestore/ spin_unlock_irq.

This has __transport_register_session use the save/restore call.

Signed-off-by: Mike Christie 
Reviewed-by: Bart Van Assche 
Reviewed-by: Christoph Hellwig 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/target/target_core_transport.c |5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -316,6 +316,7 @@ void __transport_register_session(
 {
const struct target_core_fabric_ops *tfo = se_tpg->se_tpg_tfo;
unsigned char buf[PR_REG_ISID_LEN];
+   unsigned long flags;
 
se_sess->se_tpg = se_tpg;
se_sess->fabric_sess_ptr = fabric_sess_ptr;
@@ -352,7 +353,7 @@ void __transport_register_session(
se_sess->sess_bin_isid = get_unaligned_be64([0]);
}
 
-   spin_lock_irq(_nacl->nacl_sess_lock);
+   spin_lock_irqsave(_nacl->nacl_sess_lock, flags);
/*
 * The se_nacl->nacl_sess pointer will be set to the
 * last active I_T Nexus for each struct se_node_acl.
@@ -361,7 +362,7 @@ void __transport_register_session(
 
list_add_tail(_sess->sess_acl_list,
  _nacl->acl_sess_list);
-   spin_unlock_irq(_nacl->nacl_sess_lock);
+   spin_unlock_irqrestore(_nacl->nacl_sess_lock, flags);
}
list_add_tail(_sess->sess_list, _tpg->tpg_sess_list);
 

[PATCH 4.14 123/126] tun: fix use after free for ptr_ring

[Greg Kroah-Hartman]

4.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Jason Wang 

commit b196d88aba8ac72b775137854121097f4c4c6862 upstream.

We used to initialize ptr_ring during TUNSETIFF, this is because its
size depends on the tx_queue_len of netdevice. And we try to clean it
up when socket were detached from netdevice. A race were spotted when
trying to do uninit during a read which will lead a use after free for
pointer ring. Solving this by always initialize a zero size ptr_ring
in open() and do resizing during TUNSETIFF, and then we can safely do
cleanup during close(). With this, there's no need for the workaround
that was introduced by commit 4df0bfc79904 ("tun: fix a memory leak
for tfile->tx_array").

Backport Note :-
Comparison with the upstream patch:
[1] A "semantic revert" of the changes made in
4df0bfc799("tun: fix a memory leak for tfile->tx_array").
4df0bfc799 was applied upstream, and then skb array was changed
to use ptr_ring. The upstream patch then removes the changes introduced
by 4df0bfc799. This backport does the same; "revert" the changes
made by 4df0bfc799.
[2] xdp_rxq_info_unreg() being called in relevant locations
As xdp_rxq_info related patches are not present in 4.14, these
changes are not needed in the backport.
[3] An instance of ptr_ring_init needs to be replaced by skb_array_init
Inside tun_attach()
[4] ptr_ring_cleanup needs to be replaced by skb_array_cleanup
Inside tun_chr_close()

Note that the backport for 7063efd33b ("tuntap: fix use after free during 
release")
needs to be applied on top of this patch.

Reported-by: syzbot+e8b902c3c3fadf0a9...@syzkaller.appspotmail.com
Cc: Eric Dumazet 
Cc: Cong Wang 
Cc: Michael S. Tsirkin 
Fixes: 1576d9860599 ("tun: switch to use skb array for tx")
Signed-off-by: Jason Wang 
Acked-by: Michael S. Tsirkin 
Signed-off-by: David S. Miller 
Signed-off-by: Zubin Mithra 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/net/tun.c |   21 +++--
 1 file changed, 7 insertions(+), 14 deletions(-)

--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -534,14 +534,6 @@ static void tun_queue_purge(struct tun_f
skb_queue_purge(>sk.sk_error_queue);
 }
 
-static void tun_cleanup_tx_array(struct tun_file *tfile)
-{
-   if (tfile->tx_array.ring.queue) {
-   skb_array_cleanup(>tx_array);
-   memset(>tx_array, 0, sizeof(tfile->tx_array));
-   }
-}
-
 static void __tun_detach(struct tun_file *tfile, bool clean)
 {
struct tun_file *ntfile;
@@ -583,7 +575,6 @@ static void __tun_detach(struct tun_file
tun->dev->reg_state == NETREG_REGISTERED)
unregister_netdevice(tun->dev);
}
-   tun_cleanup_tx_array(tfile);
sock_put(>sk);
}
 }
@@ -623,13 +614,11 @@ static void tun_detach_all(struct net_de
/* Drop read queue */
tun_queue_purge(tfile);
sock_put(>sk);
-   tun_cleanup_tx_array(tfile);
}
list_for_each_entry_safe(tfile, tmp, >disabled, next) {
tun_enable_queue(tfile);
tun_queue_purge(tfile);
sock_put(>sk);
-   tun_cleanup_tx_array(tfile);
}
BUG_ON(tun->numdisabled != 0);
 
@@ -675,7 +664,7 @@ static int tun_attach(struct tun_struct
}
 
if (!tfile->detached &&
-   skb_array_init(>tx_array, dev->tx_queue_len, GFP_KERNEL)) {
+   skb_array_resize(>tx_array, dev->tx_queue_len, GFP_KERNEL)) {
err = -ENOMEM;
goto out;
}
@@ -2624,6 +2613,11 @@ static int tun_chr_open(struct inode *in
_proto, 0);
if (!tfile)
return -ENOMEM;
+   if (skb_array_init(>tx_array, 0, GFP_KERNEL)) {
+   sk_free(>sk);
+   return -ENOMEM;
+   }
+
RCU_INIT_POINTER(tfile->tun, NULL);
tfile->flags = 0;
tfile->ifindex = 0;
@@ -2644,8 +2638,6 @@ static int tun_chr_open(struct inode *in
 
sock_set_flag(>sk, SOCK_ZEROCOPY);
 
-   memset(>tx_array, 0, sizeof(tfile->tx_array));
-
return 0;
 }
 
@@ -2654,6 +2646,7 @@ static int tun_chr_close(struct inode *i
struct tun_file *tfile = file->private_data;
 
tun_detach(tfile, true);
+   skb_array_cleanup(>tx_array);
 
return 0;
 }

[PATCH 4.14 120/126] ip: process in-order fragments efficiently

[Greg Kroah-Hartman]

4.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Peter Oskolkov 

This patch changes the runtime behavior of IP defrag queue:
incoming in-order fragments are added to the end of the current
list/"run" of in-order fragments at the tail.

On some workloads, UDP stream performance is substantially improved:

RX: ./udp_stream -F 10 -T 2 -l 60
TX: ./udp_stream -c -H  -F 10 -T 5 -l 60

with this patchset applied on a 10Gbps receiver:

  throughput=9524.18
  throughput_units=Mbit/s

upstream (net-next):

  throughput=4608.93
  throughput_units=Mbit/s

Reported-by: Willem de Bruijn 
Signed-off-by: Peter Oskolkov 
Cc: Eric Dumazet 
Cc: Florian Westphal 
Signed-off-by: David S. Miller 
(cherry picked from commit a4fd284a1f8fd4b6c59aa59db2185b1e17c5c11c)
Signed-off-by: Greg Kroah-Hartman 
---
 net/ipv4/inet_fragment.c |2 
 net/ipv4/ip_fragment.c   |  110 +--
 2 files changed, 70 insertions(+), 42 deletions(-)

--- a/net/ipv4/inet_fragment.c
+++ b/net/ipv4/inet_fragment.c
@@ -145,7 +145,7 @@ void inet_frag_destroy(struct inet_frag_
fp = xp;
} while (fp);
} else {
-   sum_truesize = skb_rbtree_purge(>rb_fragments);
+   sum_truesize = inet_frag_rbtree_purge(>rb_fragments);
}
sum = sum_truesize + f->qsize;
 
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -126,8 +126,8 @@ static u8 ip4_frag_ecn(u8 tos)
 
 static struct inet_frags ip4_frags;
 
-static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev,
-struct net_device *dev);
+static int ip_frag_reasm(struct ipq *qp, struct sk_buff *skb,
+struct sk_buff *prev_tail, struct net_device *dev);
 
 
 static void ip4_frag_init(struct inet_frag_queue *q, const void *a)
@@ -219,7 +219,12 @@ static void ip_expire(struct timer_list
head = skb_rb_first(>q.rb_fragments);
if (!head)
goto out;
-   rb_erase(>rbnode, >q.rb_fragments);
+   if (FRAG_CB(head)->next_frag)
+   rb_replace_node(>rbnode,
+   _CB(head)->next_frag->rbnode,
+   >q.rb_fragments);
+   else
+   rb_erase(>rbnode, >q.rb_fragments);
memset(>rbnode, 0, sizeof(head->rbnode));
barrier();
}
@@ -320,7 +325,7 @@ static int ip_frag_reinit(struct ipq *qp
return -ETIMEDOUT;
}
 
-   sum_truesize = skb_rbtree_purge(>q.rb_fragments);
+   sum_truesize = inet_frag_rbtree_purge(>q.rb_fragments);
sub_frag_mem_limit(qp->q.net, sum_truesize);
 
qp->q.flags = 0;
@@ -329,6 +334,7 @@ static int ip_frag_reinit(struct ipq *qp
qp->q.fragments = NULL;
qp->q.rb_fragments = RB_ROOT;
qp->q.fragments_tail = NULL;
+   qp->q.last_run_head = NULL;
qp->iif = 0;
qp->ecn = 0;
 
@@ -340,7 +346,7 @@ static int ip_frag_queue(struct ipq *qp,
 {
struct net *net = container_of(qp->q.net, struct net, ipv4.frags);
struct rb_node **rbn, *parent;
-   struct sk_buff *skb1;
+   struct sk_buff *skb1, *prev_tail;
struct net_device *dev;
unsigned int fragsize;
int flags, offset;
@@ -418,38 +424,41 @@ static int ip_frag_queue(struct ipq *qp,
 */
 
/* Find out where to put this fragment.  */
-   skb1 = qp->q.fragments_tail;
-   if (!skb1) {
-   /* This is the first fragment we've received. */
-   rb_link_node(>rbnode, NULL, >q.rb_fragments.rb_node);
-   qp->q.fragments_tail = skb;
-   } else if ((skb1->ip_defrag_offset + skb1->len) < end) {
-   /* This is the common/special case: skb goes to the end. */
+   prev_tail = qp->q.fragments_tail;
+   if (!prev_tail)
+   ip4_frag_create_run(>q, skb);  /* First fragment. */
+   else if (prev_tail->ip_defrag_offset + prev_tail->len < end) {
+   /* This is the common case: skb goes to the end. */
/* Detect and discard overlaps. */
-   if (offset < (skb1->ip_defrag_offset + skb1->len))
+   if (offset < prev_tail->ip_defrag_offset + prev_tail->len)
goto discard_qp;
-   /* Insert after skb1. */
-   rb_link_node(>rbnode, >rbnode, 
>rbnode.rb_right);
-   qp->q.fragments_tail = skb;
+   if (offset == prev_tail->ip_defrag_offset + prev_tail->len)
+   ip4_frag_append_to_last_run(>q, skb);
+   else
+   ip4_frag_create_run(>q, skb);
} else {
-   /* Binary search. Note that skb can become the first fragment, 
but
-* not the last (covered above). */
+   /* Binary search. Note that skb can become 

[PATCH 4.18 054/158] selftests/bpf: fix a typo in map in map test

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Roman Gushchin 

[ Upstream commit 0069fb854364da79fd99236ea620affc8e1152d5 ]

Commit fbeb1603bf4e ("bpf: verifier: MOV64 don't mark dst reg unbounded")
revealed a typo in commit fb30d4b71214 ("bpf: Add tests for map-in-map"):
BPF_MOV64_REG(BPF_REG_0, 0) was used instead of
BPF_MOV64_IMM(BPF_REG_0, 0).

I've noticed the problem by running bpf kselftests.

Fixes: fb30d4b71214 ("bpf: Add tests for map-in-map")
Signed-off-by: Roman Gushchin 
Cc: Martin KaFai Lau 
Cc: Arthur Fabre 
Cc: Daniel Borkmann 
Cc: Alexei Starovoitov 
Acked-by: Martin KaFai Lau 
Signed-off-by: Daniel Borkmann 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 tools/testing/selftests/bpf/test_verifier.c |6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/tools/testing/selftests/bpf/test_verifier.c
+++ b/tools/testing/selftests/bpf/test_verifier.c
@@ -6997,7 +6997,7 @@ static struct bpf_test tests[] = {
BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 BPF_FUNC_map_lookup_elem),
-   BPF_MOV64_REG(BPF_REG_0, 0),
+   BPF_MOV64_IMM(BPF_REG_0, 0),
BPF_EXIT_INSN(),
},
.fixup_map_in_map = { 3 },
@@ -7020,7 +7020,7 @@ static struct bpf_test tests[] = {
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 BPF_FUNC_map_lookup_elem),
-   BPF_MOV64_REG(BPF_REG_0, 0),
+   BPF_MOV64_IMM(BPF_REG_0, 0),
BPF_EXIT_INSN(),
},
.fixup_map_in_map = { 3 },
@@ -7042,7 +7042,7 @@ static struct bpf_test tests[] = {
BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 BPF_FUNC_map_lookup_elem),
-   BPF_MOV64_REG(BPF_REG_0, 0),
+   BPF_MOV64_IMM(BPF_REG_0, 0),
BPF_EXIT_INSN(),
},
.fixup_map_in_map = { 3 },

[PATCH 4.18 055/158] media: davinci: vpif_display: Mix memory leak on probe error path

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Anton Vasilyev 

[ Upstream commit 61e641f36ed81ae473177c085f0bfd83ad3b55ed ]

If vpif_probe() fails on v4l2_device_register() then memory allocated
at initialize_vpif() for global vpif_obj.dev[i] become unreleased.

The patch adds deallocation of vpif_obj.dev[i] on the error path and
removes duplicated check on platform_data presence.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Anton Vasilyev 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/media/platform/davinci/vpif_display.c |   24 
 1 file changed, 16 insertions(+), 8 deletions(-)

--- a/drivers/media/platform/davinci/vpif_display.c
+++ b/drivers/media/platform/davinci/vpif_display.c
@@ -1114,6 +1114,14 @@ vpif_init_free_channel_objects:
return err;
 }
 
+static void free_vpif_objs(void)
+{
+   int i;
+
+   for (i = 0; i < VPIF_DISPLAY_MAX_DEVICES; i++)
+   kfree(vpif_obj.dev[i]);
+}
+
 static int vpif_async_bound(struct v4l2_async_notifier *notifier,
struct v4l2_subdev *subdev,
struct v4l2_async_subdev *asd)
@@ -1255,11 +1263,6 @@ static __init int vpif_probe(struct plat
return -EINVAL;
}
 
-   if (!pdev->dev.platform_data) {
-   dev_warn(>dev, "Missing platform data.  Giving up.\n");
-   return -EINVAL;
-   }
-
vpif_dev = >dev;
err = initialize_vpif();
 
@@ -1271,7 +1274,7 @@ static __init int vpif_probe(struct plat
err = v4l2_device_register(vpif_dev, _obj.v4l2_dev);
if (err) {
v4l2_err(vpif_dev->driver, "Error registering v4l2 device\n");
-   return err;
+   goto vpif_free;
}
 
while ((res = platform_get_resource(pdev, IORESOURCE_IRQ, res_idx))) {
@@ -1314,7 +1317,10 @@ static __init int vpif_probe(struct plat
if (vpif_obj.sd[i])
vpif_obj.sd[i]->grp_id = 1 << i;
}
-   vpif_probe_complete();
+   err = vpif_probe_complete();
+   if (err) {
+   goto probe_subdev_out;
+   }
} else {
vpif_obj.notifier.subdevs = vpif_obj.config->asd;
vpif_obj.notifier.num_subdevs = vpif_obj.config->asd_sizes[0];
@@ -1334,6 +1340,8 @@ probe_subdev_out:
kfree(vpif_obj.sd);
 vpif_unregister:
v4l2_device_unregister(_obj.v4l2_dev);
+vpif_free:
+   free_vpif_objs();
 
return err;
 }
@@ -1355,8 +1363,8 @@ static int vpif_remove(struct platform_d
ch = vpif_obj.dev[i];
/* Unregister video device */
video_unregister_device(>video_dev);
-   kfree(vpif_obj.dev[i]);
}
+   free_vpif_objs();
 
return 0;
 }

[PATCH 4.18 065/158] md/raid5: fix data corruption of replacements after originals dropped

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: BingJing Chang 

[ Upstream commit d63e2fc804c46e50eee825c5d3a7228e07048b47 ]

During raid5 replacement, the stripes can be marked with R5_NeedReplace
flag. Data can be read from being-replaced devices and written to
replacing spares without reading all other devices. (It's 'replace'
mode. s.replacing = 1) If a being-replaced device is dropped, the
replacement progress will be interrupted and resumed with pure recovery
mode. However, existing stripes before being interrupted cannot read
from the dropped device anymore. It prints lots of WARN_ON messages.
And it results in data corruption because existing stripes write
problematic data into its replacement device and update the progress.

\# Erase disks (1MB + 2GB)
dd if=/dev/zero of=/dev/sda bs=1MB count=2049
dd if=/dev/zero of=/dev/sdb bs=1MB count=2049
dd if=/dev/zero of=/dev/sdc bs=1MB count=2049
dd if=/dev/zero of=/dev/sdd bs=1MB count=2049
mdadm -C /dev/md0 -amd -R -l5 -n3 -x0 /dev/sd[abc] -z 2097152
\# Ensure array stores non-zero data
dd if=/root/data_4GB.iso of=/dev/md0 bs=1MB
\# Start replacement
mdadm /dev/md0 -a /dev/sdd
mdadm /dev/md0 --replace /dev/sda

Then, Hot-plug out /dev/sda during recovery, and wait for recovery done.
echo check > /sys/block/md0/md/sync_action
cat /sys/block/md0/md/mismatch_cnt # it will be greater than 0.

Soon after you hot-plug out /dev/sda, you will see many WARN_ON
messages. The replacement recovery will be interrupted shortly. After
the recovery finishes, it will result in data corruption.

Actually, it's just an unhandled case of replacement. In commit
 (md/raid5: fix interaction of 'replace' and 'recovery'.),
if a NeedReplace device is not UPTODATE then that is an error, the
commit just simply print WARN_ON but also mark these corrupted stripes
with R5_WantReplace. (it means it's ready for writes.)

To fix this case, we can leverage 'sync and replace' mode mentioned in
commit <9a3e1101b827> (md/raid5: detect and handle replacements during
recovery.). We can add logics to detect and use 'sync and replace' mode
for these stripes.

Reported-by: Alex Chen 
Reviewed-by: Alex Wu 
Reviewed-by: Chung-Chiang Cheng 
Signed-off-by: BingJing Chang 
Signed-off-by: Shaohua Li 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/md/raid5.c |6 ++
 1 file changed, 6 insertions(+)

--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -4521,6 +4521,12 @@ static void analyse_stripe(struct stripe
s->failed++;
if (rdev && !test_bit(Faulty, >flags))
do_recovery = 1;
+   else if (!rdev) {
+   rdev = rcu_dereference(
+   conf->disks[i].replacement);
+   if (rdev && !test_bit(Faulty, >flags))
+   do_recovery = 1;
+   }
}
 
if (test_bit(R5_InJournal, >flags))

[PATCH 4.18 066/158] timers: Clear timer_base::must_forward_clk with timer_base::lock held

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Gaurav Kohli 

[ Upstream commit 363e934d8811d799c88faffc5bfca782fd728334 ]

timer_base::must_forward_clock is indicating that the base clock might be
stale due to a long idle sleep.

The forwarding of the base clock takes place in the timer softirq or when a
timer is enqueued to a base which is idle. If the enqueue of timer to an
idle base happens from a remote CPU, then the following race can happen:

  CPU0  CPU1
  run_timer_softirq mod_timer

base = lock_timer_base(timer);
  base->must_forward_clk = false
if (base->must_forward_clk)
forward(base); -> skipped

enqueue_timer(base, timer, idx);
-> idx is calculated high due to
   stale base
unlock_timer_base(timer);
  base = lock_timer_base(timer);
  forward(base);

The root cause is that timer_base::must_forward_clk is cleared outside the
timer_base::lock held region, so the remote queuing CPU observes it as
cleared, but the base clock is still stale. This can cause large
granularity values for timers, i.e. the accuracy of the expiry time
suffers.

Prevent this by clearing the flag with timer_base::lock held, so that the
forwarding takes place before the cleared flag is observable by a remote
CPU.

Signed-off-by: Gaurav Kohli 
Signed-off-by: Thomas Gleixner 
Cc: john.stu...@linaro.org
Cc: sb...@kernel.org
Cc: linux-arm-...@vger.kernel.org
Link: 
https://lkml.kernel.org/r/1533199863-22748-1-git-send-email-gko...@codeaurora.org
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 kernel/time/timer.c |   29 -
 1 file changed, 16 insertions(+), 13 deletions(-)

--- a/kernel/time/timer.c
+++ b/kernel/time/timer.c
@@ -1657,6 +1657,22 @@ static inline void __run_timers(struct t
 
raw_spin_lock_irq(>lock);
 
+   /*
+* timer_base::must_forward_clk must be cleared before running
+* timers so that any timer functions that call mod_timer() will
+* not try to forward the base. Idle tracking / clock forwarding
+* logic is only used with BASE_STD timers.
+*
+* The must_forward_clk flag is cleared unconditionally also for
+* the deferrable base. The deferrable base is not affected by idle
+* tracking and never forwarded, so clearing the flag is a NOOP.
+*
+* The fact that the deferrable base is never forwarded can cause
+* large variations in granularity for deferrable timers, but they
+* can be deferred for long periods due to idle anyway.
+*/
+   base->must_forward_clk = false;
+
while (time_after_eq(jiffies, base->clk)) {
 
levels = collect_expired_timers(base, heads);
@@ -1676,19 +1692,6 @@ static __latent_entropy void run_timer_s
 {
struct timer_base *base = this_cpu_ptr(_bases[BASE_STD]);
 
-   /*
-* must_forward_clk must be cleared before running timers so that any
-* timer functions that call mod_timer will not try to forward the
-* base. idle trcking / clock forwarding logic is only used with
-* BASE_STD timers.
-*
-* The deferrable base does not do idle tracking at all, so we do
-* not forward it. This can result in very large variations in
-* granularity for deferrable timers, but they can be deferred for
-* long periods due to idle.
-*/
-   base->must_forward_clk = false;
-
__run_timers(base);
if (IS_ENABLED(CONFIG_NO_HZ_COMMON))
__run_timers(this_cpu_ptr(_bases[BASE_DEF]));

[PATCH 4.18 057/158] net: phy: Fix the register offsets in Broadcom iProc mdio mux driver

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Arun Parameswaran 

[ Upstream commit 77fefa93bfebe4df44f154f2aa5938e32630d0bf ]

Modify the register offsets in the Broadcom iProc mdio mux to start
from the top of the register address space.

Earlier, the base address pointed to the end of the block's register
space. The base address will now point to the start of the mdio's
address space. The offsets have been fixed to match this.

Signed-off-by: Arun Parameswaran 
Reviewed-by: Andrew Lunn 
Reviewed-by: Florian Fainelli 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/net/phy/mdio-mux-bcm-iproc.c |   20 +++-
 1 file changed, 15 insertions(+), 5 deletions(-)

--- a/drivers/net/phy/mdio-mux-bcm-iproc.c
+++ b/drivers/net/phy/mdio-mux-bcm-iproc.c
@@ -22,7 +22,7 @@
 #include 
 #include 
 
-#define MDIO_PARAM_OFFSET  0x00
+#define MDIO_PARAM_OFFSET  0x23c
 #define MDIO_PARAM_MIIM_CYCLE  29
 #define MDIO_PARAM_INTERNAL_SEL25
 #define MDIO_PARAM_BUS_ID  22
@@ -30,20 +30,22 @@
 #define MDIO_PARAM_PHY_ID  16
 #define MDIO_PARAM_PHY_DATA0
 
-#define MDIO_READ_OFFSET   0x04
+#define MDIO_READ_OFFSET   0x240
 #define MDIO_READ_DATA_MASK0x
-#define MDIO_ADDR_OFFSET   0x08
+#define MDIO_ADDR_OFFSET   0x244
 
-#define MDIO_CTRL_OFFSET   0x0C
+#define MDIO_CTRL_OFFSET   0x248
 #define MDIO_CTRL_WRITE_OP 0x1
 #define MDIO_CTRL_READ_OP  0x2
 
-#define MDIO_STAT_OFFSET   0x10
+#define MDIO_STAT_OFFSET   0x24c
 #define MDIO_STAT_DONE 1
 
 #define BUS_MAX_ADDR   32
 #define EXT_BUS_START_ADDR 16
 
+#define MDIO_REG_ADDR_SPACE_SIZE   0x250
+
 struct iproc_mdiomux_desc {
void *mux_handle;
void __iomem *base;
@@ -169,6 +171,14 @@ static int mdio_mux_iproc_probe(struct p
md->dev = >dev;
 
res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+   if (res->start & 0xfff) {
+   /* For backward compatibility in case the
+* base address is specified with an offset.
+*/
+   dev_info(>dev, "fix base address in dt-blob\n");
+   res->start &= ~0xfff;
+   res->end = res->start + MDIO_REG_ADDR_SPACE_SIZE - 1;
+   }
md->base = devm_ioremap_resource(>dev, res);
if (IS_ERR(md->base)) {
dev_err(>dev, "failed to ioremap register\n");

[PATCH 4.18 038/158] x86/microcode: Update the new microcode revision unconditionally

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Filippo Sironi 

commit 8da38ebaad23fe1b0c4a205438676f6356607cfc upstream.

Handle the case where microcode gets loaded on the BSP's hyperthread
sibling first and the boot_cpu_data's microcode revision doesn't get
updated because of early exit due to the siblings sharing a microcode
engine.

For that, simply write the updated revision on all CPUs unconditionally.

Signed-off-by: Filippo Sironi 
Signed-off-by: Borislav Petkov 
Signed-off-by: Thomas Gleixner 
Cc: pra...@redhat.com
Cc: sta...@vger.kernel.org
Link: 
http://lkml.kernel.org/r/1533050970-14385-1-git-send-email-sir...@amazon.de
Signed-off-by: Greg Kroah-Hartman 

---
 arch/x86/kernel/cpu/microcode/amd.c   |   22 +-
 arch/x86/kernel/cpu/microcode/intel.c |   13 -
 2 files changed, 21 insertions(+), 14 deletions(-)

--- a/arch/x86/kernel/cpu/microcode/amd.c
+++ b/arch/x86/kernel/cpu/microcode/amd.c
@@ -504,6 +504,7 @@ static enum ucode_state apply_microcode_
struct microcode_amd *mc_amd;
struct ucode_cpu_info *uci;
struct ucode_patch *p;
+   enum ucode_state ret;
u32 rev, dummy;
 
BUG_ON(raw_smp_processor_id() != cpu);
@@ -521,9 +522,8 @@ static enum ucode_state apply_microcode_
 
/* need to apply patch? */
if (rev >= mc_amd->hdr.patch_id) {
-   c->microcode = rev;
-   uci->cpu_sig.rev = rev;
-   return UCODE_OK;
+   ret = UCODE_OK;
+   goto out;
}
 
if (__apply_microcode_amd(mc_amd)) {
@@ -531,17 +531,21 @@ static enum ucode_state apply_microcode_
cpu, mc_amd->hdr.patch_id);
return UCODE_ERROR;
}
-   pr_info("CPU%d: new patch_level=0x%08x\n", cpu,
-   mc_amd->hdr.patch_id);
 
-   uci->cpu_sig.rev = mc_amd->hdr.patch_id;
-   c->microcode = mc_amd->hdr.patch_id;
+   rev = mc_amd->hdr.patch_id;
+   ret = UCODE_UPDATED;
+
+   pr_info("CPU%d: new patch_level=0x%08x\n", cpu, rev);
+
+out:
+   uci->cpu_sig.rev = rev;
+   c->microcode = rev;
 
/* Update boot_cpu_data's revision too, if we're on the BSP: */
if (c->cpu_index == boot_cpu_data.cpu_index)
-   boot_cpu_data.microcode = mc_amd->hdr.patch_id;
+   boot_cpu_data.microcode = rev;
 
-   return UCODE_UPDATED;
+   return ret;
 }
 
 static int install_equiv_cpu_table(const u8 *buf)
--- a/arch/x86/kernel/cpu/microcode/intel.c
+++ b/arch/x86/kernel/cpu/microcode/intel.c
@@ -795,6 +795,7 @@ static enum ucode_state apply_microcode_
struct ucode_cpu_info *uci = ucode_cpu_info + cpu;
struct cpuinfo_x86 *c = _data(cpu);
struct microcode_intel *mc;
+   enum ucode_state ret;
static int prev_rev;
u32 rev;
 
@@ -817,9 +818,8 @@ static enum ucode_state apply_microcode_
 */
rev = intel_get_microcode_revision();
if (rev >= mc->hdr.rev) {
-   uci->cpu_sig.rev = rev;
-   c->microcode = rev;
-   return UCODE_OK;
+   ret = UCODE_OK;
+   goto out;
}
 
/*
@@ -848,14 +848,17 @@ static enum ucode_state apply_microcode_
prev_rev = rev;
}
 
+   ret = UCODE_UPDATED;
+
+out:
uci->cpu_sig.rev = rev;
-   c->microcode = rev;
+   c->microcode = rev;
 
/* Update boot_cpu_data's revision too, if we're on the BSP: */
if (c->cpu_index == boot_cpu_data.cpu_index)
boot_cpu_data.microcode = rev;
 
-   return UCODE_UPDATED;
+   return ret;
 }
 
 static enum ucode_state generic_load_microcode(int cpu, void *data, size_t 
size,

[PATCH 4.18 069/158] misc: ti-st: Fix memory leak in the error path of probe()

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Anton Vasilyev 

[ Upstream commit 81ae962d7f180c0092859440c82996cccb254976 ]

Free resources instead of direct return of the error code if kim_probe
fails.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Anton Vasilyev 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/misc/ti-st/st_kim.c |4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/misc/ti-st/st_kim.c
+++ b/drivers/misc/ti-st/st_kim.c
@@ -756,14 +756,14 @@ static int kim_probe(struct platform_dev
err = gpio_request(kim_gdata->nshutdown, "kim");
if (unlikely(err)) {
pr_err(" gpio %d request failed ", kim_gdata->nshutdown);
-   return err;
+   goto err_sysfs_group;
}
 
/* Configure nShutdown GPIO as output=0 */
err = gpio_direction_output(kim_gdata->nshutdown, 0);
if (unlikely(err)) {
pr_err(" unable to configure gpio %d", kim_gdata->nshutdown);
-   return err;
+   goto err_sysfs_group;
}
/* get reference of pdev for request_firmware
 */

[PATCH 4.18 056/158] media: dw2102: Fix memleak on sequence of probes

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Anton Vasilyev 

[ Upstream commit 299c7007e93645067e1d2743f4e50156de78c4ff ]

Each call to dw2102_probe() allocates memory by kmemdup for structures
p1100, s660, p7500 and s421, but there is no their deallocation.
dvb_usb_device_init() copies the corresponding structure into
dvb_usb_device->props, so there is no use of original structure after
dvb_usb_device_init().

The patch moves structures from global scope to local and adds their
deallocation.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Anton Vasilyev 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/media/usb/dvb-usb/dw2102.c |   19 ++-
 1 file changed, 14 insertions(+), 5 deletions(-)

--- a/drivers/media/usb/dvb-usb/dw2102.c
+++ b/drivers/media/usb/dvb-usb/dw2102.c
@@ -2101,14 +2101,12 @@ static struct dvb_usb_device_properties
}
 };
 
-static struct dvb_usb_device_properties *p1100;
 static const struct dvb_usb_device_description d1100 = {
"Prof 1100 USB ",
{_table[PROF_1100], NULL},
{NULL},
 };
 
-static struct dvb_usb_device_properties *s660;
 static const struct dvb_usb_device_description d660 = {
"TeVii S660 USB",
{_table[TEVII_S660], NULL},
@@ -2127,14 +2125,12 @@ static const struct dvb_usb_device_descr
{NULL},
 };
 
-static struct dvb_usb_device_properties *p7500;
 static const struct dvb_usb_device_description d7500 = {
"Prof 7500 USB DVB-S2",
{_table[PROF_7500], NULL},
{NULL},
 };
 
-static struct dvb_usb_device_properties *s421;
 static const struct dvb_usb_device_description d421 = {
"TeVii S421 PCI",
{_table[TEVII_S421], NULL},
@@ -2334,6 +2330,11 @@ static int dw2102_probe(struct usb_inter
const struct usb_device_id *id)
 {
int retval = -ENOMEM;
+   struct dvb_usb_device_properties *p1100;
+   struct dvb_usb_device_properties *s660;
+   struct dvb_usb_device_properties *p7500;
+   struct dvb_usb_device_properties *s421;
+
p1100 = kmemdup(_properties,
sizeof(struct dvb_usb_device_properties), GFP_KERNEL);
if (!p1100)
@@ -2402,8 +2403,16 @@ static int dw2102_probe(struct usb_inter
0 == dvb_usb_device_init(intf, _properties,
 THIS_MODULE, NULL, adapter_nr) ||
0 == dvb_usb_device_init(intf, _s2_4600_properties,
-THIS_MODULE, NULL, adapter_nr))
+THIS_MODULE, NULL, adapter_nr)) {
+
+   /* clean up copied properties */
+   kfree(s421);
+   kfree(p7500);
+   kfree(s660);
+   kfree(p1100);
+
return 0;
+   }
 
retval = -ENODEV;
kfree(s421);

[PATCH 4.18 067/158] media: camss: csid: Configure data type and decode format properly

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Todor Tomov 

[ Upstream commit c628e78899ff8006b5f9d8206da54ed3bb994342 ]

The CSID decodes the input data stream. When the input comes from
the Test Generator the format of the stream is set on the source
media pad. When the input comes from the CSIPHY the format is the
one on the sink media pad. Use the proper format for each case.

Signed-off-by: Todor Tomov 
Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/media/platform/qcom/camss-8x16/camss-csid.c |   16 +++-
 1 file changed, 11 insertions(+), 5 deletions(-)

--- a/drivers/media/platform/qcom/camss-8x16/camss-csid.c
+++ b/drivers/media/platform/qcom/camss-8x16/camss-csid.c
@@ -392,9 +392,6 @@ static int csid_set_stream(struct v4l2_s
!media_entity_remote_pad(>pads[MSM_CSID_PAD_SINK]))
return -ENOLINK;
 
-   dt = csid_get_fmt_entry(csid->fmt[MSM_CSID_PAD_SRC].code)->
-   data_type;
-
if (tg->enabled) {
/* Config Test Generator */
struct v4l2_mbus_framefmt *f =
@@ -416,6 +413,9 @@ static int csid_set_stream(struct v4l2_s
writel_relaxed(val, csid->base +
   CAMSS_CSID_TG_DT_n_CGG_0(0));
 
+   dt = csid_get_fmt_entry(
+   csid->fmt[MSM_CSID_PAD_SRC].code)->data_type;
+
/* 5:0 data type */
val = dt;
writel_relaxed(val, csid->base +
@@ -425,6 +425,9 @@ static int csid_set_stream(struct v4l2_s
val = tg->payload_mode;
writel_relaxed(val, csid->base +
   CAMSS_CSID_TG_DT_n_CGG_2(0));
+
+   df = csid_get_fmt_entry(
+   
csid->fmt[MSM_CSID_PAD_SRC].code)->decode_format;
} else {
struct csid_phy_config *phy = >phy;
 
@@ -439,13 +442,16 @@ static int csid_set_stream(struct v4l2_s
 
writel_relaxed(val,
   csid->base + CAMSS_CSID_CORE_CTRL_1);
+
+   dt = csid_get_fmt_entry(
+   csid->fmt[MSM_CSID_PAD_SINK].code)->data_type;
+   df = csid_get_fmt_entry(
+   
csid->fmt[MSM_CSID_PAD_SINK].code)->decode_format;
}
 
/* Config LUT */
 
dt_shift = (cid % 4) * 8;
-   df = csid_get_fmt_entry(csid->fmt[MSM_CSID_PAD_SINK].code)->
-   decode_format;
 
val = readl_relaxed(csid->base + CAMSS_CSID_CID_LUT_VC_n(vc));
val &= ~(0xff << dt_shift);

[PATCH 4.18 057/158] net: phy: Fix the register offsets in Broadcom iProc mdio mux driver

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Arun Parameswaran 

[ Upstream commit 77fefa93bfebe4df44f154f2aa5938e32630d0bf ]

Modify the register offsets in the Broadcom iProc mdio mux to start
from the top of the register address space.

Earlier, the base address pointed to the end of the block's register
space. The base address will now point to the start of the mdio's
address space. The offsets have been fixed to match this.

Signed-off-by: Arun Parameswaran 
Reviewed-by: Andrew Lunn 
Reviewed-by: Florian Fainelli 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/net/phy/mdio-mux-bcm-iproc.c |   20 +++-
 1 file changed, 15 insertions(+), 5 deletions(-)

--- a/drivers/net/phy/mdio-mux-bcm-iproc.c
+++ b/drivers/net/phy/mdio-mux-bcm-iproc.c
@@ -22,7 +22,7 @@
 #include 
 #include 
 
-#define MDIO_PARAM_OFFSET  0x00
+#define MDIO_PARAM_OFFSET  0x23c
 #define MDIO_PARAM_MIIM_CYCLE  29
 #define MDIO_PARAM_INTERNAL_SEL25
 #define MDIO_PARAM_BUS_ID  22
@@ -30,20 +30,22 @@
 #define MDIO_PARAM_PHY_ID  16
 #define MDIO_PARAM_PHY_DATA0
 
-#define MDIO_READ_OFFSET   0x04
+#define MDIO_READ_OFFSET   0x240
 #define MDIO_READ_DATA_MASK0x
-#define MDIO_ADDR_OFFSET   0x08
+#define MDIO_ADDR_OFFSET   0x244
 
-#define MDIO_CTRL_OFFSET   0x0C
+#define MDIO_CTRL_OFFSET   0x248
 #define MDIO_CTRL_WRITE_OP 0x1
 #define MDIO_CTRL_READ_OP  0x2
 
-#define MDIO_STAT_OFFSET   0x10
+#define MDIO_STAT_OFFSET   0x24c
 #define MDIO_STAT_DONE 1
 
 #define BUS_MAX_ADDR   32
 #define EXT_BUS_START_ADDR 16
 
+#define MDIO_REG_ADDR_SPACE_SIZE   0x250
+
 struct iproc_mdiomux_desc {
void *mux_handle;
void __iomem *base;
@@ -169,6 +171,14 @@ static int mdio_mux_iproc_probe(struct p
md->dev = >dev;
 
res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+   if (res->start & 0xfff) {
+   /* For backward compatibility in case the
+* base address is specified with an offset.
+*/
+   dev_info(>dev, "fix base address in dt-blob\n");
+   res->start &= ~0xfff;
+   res->end = res->start + MDIO_REG_ADDR_SPACE_SIZE - 1;
+   }
md->base = devm_ioremap_resource(>dev, res);
if (IS_ERR(md->base)) {
dev_err(>dev, "failed to ioremap register\n");

[PATCH 4.18 038/158] x86/microcode: Update the new microcode revision unconditionally

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Filippo Sironi 

commit 8da38ebaad23fe1b0c4a205438676f6356607cfc upstream.

Handle the case where microcode gets loaded on the BSP's hyperthread
sibling first and the boot_cpu_data's microcode revision doesn't get
updated because of early exit due to the siblings sharing a microcode
engine.

For that, simply write the updated revision on all CPUs unconditionally.

Signed-off-by: Filippo Sironi 
Signed-off-by: Borislav Petkov 
Signed-off-by: Thomas Gleixner 
Cc: pra...@redhat.com
Cc: sta...@vger.kernel.org
Link: 
http://lkml.kernel.org/r/1533050970-14385-1-git-send-email-sir...@amazon.de
Signed-off-by: Greg Kroah-Hartman 

---
 arch/x86/kernel/cpu/microcode/amd.c   |   22 +-
 arch/x86/kernel/cpu/microcode/intel.c |   13 -
 2 files changed, 21 insertions(+), 14 deletions(-)

--- a/arch/x86/kernel/cpu/microcode/amd.c
+++ b/arch/x86/kernel/cpu/microcode/amd.c
@@ -504,6 +504,7 @@ static enum ucode_state apply_microcode_
struct microcode_amd *mc_amd;
struct ucode_cpu_info *uci;
struct ucode_patch *p;
+   enum ucode_state ret;
u32 rev, dummy;
 
BUG_ON(raw_smp_processor_id() != cpu);
@@ -521,9 +522,8 @@ static enum ucode_state apply_microcode_
 
/* need to apply patch? */
if (rev >= mc_amd->hdr.patch_id) {
-   c->microcode = rev;
-   uci->cpu_sig.rev = rev;
-   return UCODE_OK;
+   ret = UCODE_OK;
+   goto out;
}
 
if (__apply_microcode_amd(mc_amd)) {
@@ -531,17 +531,21 @@ static enum ucode_state apply_microcode_
cpu, mc_amd->hdr.patch_id);
return UCODE_ERROR;
}
-   pr_info("CPU%d: new patch_level=0x%08x\n", cpu,
-   mc_amd->hdr.patch_id);
 
-   uci->cpu_sig.rev = mc_amd->hdr.patch_id;
-   c->microcode = mc_amd->hdr.patch_id;
+   rev = mc_amd->hdr.patch_id;
+   ret = UCODE_UPDATED;
+
+   pr_info("CPU%d: new patch_level=0x%08x\n", cpu, rev);
+
+out:
+   uci->cpu_sig.rev = rev;
+   c->microcode = rev;
 
/* Update boot_cpu_data's revision too, if we're on the BSP: */
if (c->cpu_index == boot_cpu_data.cpu_index)
-   boot_cpu_data.microcode = mc_amd->hdr.patch_id;
+   boot_cpu_data.microcode = rev;
 
-   return UCODE_UPDATED;
+   return ret;
 }
 
 static int install_equiv_cpu_table(const u8 *buf)
--- a/arch/x86/kernel/cpu/microcode/intel.c
+++ b/arch/x86/kernel/cpu/microcode/intel.c
@@ -795,6 +795,7 @@ static enum ucode_state apply_microcode_
struct ucode_cpu_info *uci = ucode_cpu_info + cpu;
struct cpuinfo_x86 *c = _data(cpu);
struct microcode_intel *mc;
+   enum ucode_state ret;
static int prev_rev;
u32 rev;
 
@@ -817,9 +818,8 @@ static enum ucode_state apply_microcode_
 */
rev = intel_get_microcode_revision();
if (rev >= mc->hdr.rev) {
-   uci->cpu_sig.rev = rev;
-   c->microcode = rev;
-   return UCODE_OK;
+   ret = UCODE_OK;
+   goto out;
}
 
/*
@@ -848,14 +848,17 @@ static enum ucode_state apply_microcode_
prev_rev = rev;
}
 
+   ret = UCODE_UPDATED;
+
+out:
uci->cpu_sig.rev = rev;
-   c->microcode = rev;
+   c->microcode = rev;
 
/* Update boot_cpu_data's revision too, if we're on the BSP: */
if (c->cpu_index == boot_cpu_data.cpu_index)
boot_cpu_data.microcode = rev;
 
-   return UCODE_UPDATED;
+   return ret;
 }
 
 static enum ucode_state generic_load_microcode(int cpu, void *data, size_t 
size,

[PATCH 4.18 069/158] misc: ti-st: Fix memory leak in the error path of probe()

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Anton Vasilyev 

[ Upstream commit 81ae962d7f180c0092859440c82996cccb254976 ]

Free resources instead of direct return of the error code if kim_probe
fails.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Anton Vasilyev 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/misc/ti-st/st_kim.c |4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/misc/ti-st/st_kim.c
+++ b/drivers/misc/ti-st/st_kim.c
@@ -756,14 +756,14 @@ static int kim_probe(struct platform_dev
err = gpio_request(kim_gdata->nshutdown, "kim");
if (unlikely(err)) {
pr_err(" gpio %d request failed ", kim_gdata->nshutdown);
-   return err;
+   goto err_sysfs_group;
}
 
/* Configure nShutdown GPIO as output=0 */
err = gpio_direction_output(kim_gdata->nshutdown, 0);
if (unlikely(err)) {
pr_err(" unable to configure gpio %d", kim_gdata->nshutdown);
-   return err;
+   goto err_sysfs_group;
}
/* get reference of pdev for request_firmware
 */

[PATCH 4.18 056/158] media: dw2102: Fix memleak on sequence of probes

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Anton Vasilyev 

[ Upstream commit 299c7007e93645067e1d2743f4e50156de78c4ff ]

Each call to dw2102_probe() allocates memory by kmemdup for structures
p1100, s660, p7500 and s421, but there is no their deallocation.
dvb_usb_device_init() copies the corresponding structure into
dvb_usb_device->props, so there is no use of original structure after
dvb_usb_device_init().

The patch moves structures from global scope to local and adds their
deallocation.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Anton Vasilyev 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/media/usb/dvb-usb/dw2102.c |   19 ++-
 1 file changed, 14 insertions(+), 5 deletions(-)

--- a/drivers/media/usb/dvb-usb/dw2102.c
+++ b/drivers/media/usb/dvb-usb/dw2102.c
@@ -2101,14 +2101,12 @@ static struct dvb_usb_device_properties
}
 };
 
-static struct dvb_usb_device_properties *p1100;
 static const struct dvb_usb_device_description d1100 = {
"Prof 1100 USB ",
{_table[PROF_1100], NULL},
{NULL},
 };
 
-static struct dvb_usb_device_properties *s660;
 static const struct dvb_usb_device_description d660 = {
"TeVii S660 USB",
{_table[TEVII_S660], NULL},
@@ -2127,14 +2125,12 @@ static const struct dvb_usb_device_descr
{NULL},
 };
 
-static struct dvb_usb_device_properties *p7500;
 static const struct dvb_usb_device_description d7500 = {
"Prof 7500 USB DVB-S2",
{_table[PROF_7500], NULL},
{NULL},
 };
 
-static struct dvb_usb_device_properties *s421;
 static const struct dvb_usb_device_description d421 = {
"TeVii S421 PCI",
{_table[TEVII_S421], NULL},
@@ -2334,6 +2330,11 @@ static int dw2102_probe(struct usb_inter
const struct usb_device_id *id)
 {
int retval = -ENOMEM;
+   struct dvb_usb_device_properties *p1100;
+   struct dvb_usb_device_properties *s660;
+   struct dvb_usb_device_properties *p7500;
+   struct dvb_usb_device_properties *s421;
+
p1100 = kmemdup(_properties,
sizeof(struct dvb_usb_device_properties), GFP_KERNEL);
if (!p1100)
@@ -2402,8 +2403,16 @@ static int dw2102_probe(struct usb_inter
0 == dvb_usb_device_init(intf, _properties,
 THIS_MODULE, NULL, adapter_nr) ||
0 == dvb_usb_device_init(intf, _s2_4600_properties,
-THIS_MODULE, NULL, adapter_nr))
+THIS_MODULE, NULL, adapter_nr)) {
+
+   /* clean up copied properties */
+   kfree(s421);
+   kfree(p7500);
+   kfree(s660);
+   kfree(p1100);
+
return 0;
+   }
 
retval = -ENODEV;
kfree(s421);

[PATCH 4.18 067/158] media: camss: csid: Configure data type and decode format properly

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Todor Tomov 

[ Upstream commit c628e78899ff8006b5f9d8206da54ed3bb994342 ]

The CSID decodes the input data stream. When the input comes from
the Test Generator the format of the stream is set on the source
media pad. When the input comes from the CSIPHY the format is the
one on the sink media pad. Use the proper format for each case.

Signed-off-by: Todor Tomov 
Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/media/platform/qcom/camss-8x16/camss-csid.c |   16 +++-
 1 file changed, 11 insertions(+), 5 deletions(-)

--- a/drivers/media/platform/qcom/camss-8x16/camss-csid.c
+++ b/drivers/media/platform/qcom/camss-8x16/camss-csid.c
@@ -392,9 +392,6 @@ static int csid_set_stream(struct v4l2_s
!media_entity_remote_pad(>pads[MSM_CSID_PAD_SINK]))
return -ENOLINK;
 
-   dt = csid_get_fmt_entry(csid->fmt[MSM_CSID_PAD_SRC].code)->
-   data_type;
-
if (tg->enabled) {
/* Config Test Generator */
struct v4l2_mbus_framefmt *f =
@@ -416,6 +413,9 @@ static int csid_set_stream(struct v4l2_s
writel_relaxed(val, csid->base +
   CAMSS_CSID_TG_DT_n_CGG_0(0));
 
+   dt = csid_get_fmt_entry(
+   csid->fmt[MSM_CSID_PAD_SRC].code)->data_type;
+
/* 5:0 data type */
val = dt;
writel_relaxed(val, csid->base +
@@ -425,6 +425,9 @@ static int csid_set_stream(struct v4l2_s
val = tg->payload_mode;
writel_relaxed(val, csid->base +
   CAMSS_CSID_TG_DT_n_CGG_2(0));
+
+   df = csid_get_fmt_entry(
+   
csid->fmt[MSM_CSID_PAD_SRC].code)->decode_format;
} else {
struct csid_phy_config *phy = >phy;
 
@@ -439,13 +442,16 @@ static int csid_set_stream(struct v4l2_s
 
writel_relaxed(val,
   csid->base + CAMSS_CSID_CORE_CTRL_1);
+
+   dt = csid_get_fmt_entry(
+   csid->fmt[MSM_CSID_PAD_SINK].code)->data_type;
+   df = csid_get_fmt_entry(
+   
csid->fmt[MSM_CSID_PAD_SINK].code)->decode_format;
}
 
/* Config LUT */
 
dt_shift = (cid % 4) * 8;
-   df = csid_get_fmt_entry(csid->fmt[MSM_CSID_PAD_SINK].code)->
-   decode_format;
 
val = readl_relaxed(csid->base + CAMSS_CSID_CID_LUT_VC_n(vc));
val &= ~(0xff << dt_shift);

[PATCH 4.18 020/158] Btrfs: fix data corruption when deduplicating between different files

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Filipe Manana 

commit de02b9f6bb65a6a1848f346f7a3617b7a9b930c0 upstream.

If we deduplicate extents between two different files we can end up
corrupting data if the source range ends at the size of the source file,
the source file's size is not aligned to the filesystem's block size
and the destination range does not go past the size of the destination
file size.

Example:

  $ mkfs.btrfs -f /dev/sdb
  $ mount /dev/sdb /mnt

  $ xfs_io -f -c "pwrite -S 0x6b 0 2518890" /mnt/foo
  # The first byte with a value of 0xae starts at an offset (2518890)
  # which is not a multiple of the sector size.
  $ xfs_io -c "pwrite -S 0xae 2518890 102398" /mnt/foo

  # Confirm the file content is full of bytes with values 0x6b and 0xae.
  $ od -t x1 /mnt/foo
  000 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
  *
  11467540 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b ae ae ae ae ae ae
  11467560 ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae
  *
  11777540 ae ae ae ae ae ae ae ae
  11777550

  # Create a second file with a length not aligned to the sector size,
  # whose bytes all have the value 0x6b, so that its extent(s) can be
  # deduplicated with the first file.
  $ xfs_io -f -c "pwrite -S 0x6b 0 557771" /mnt/bar

  # Now deduplicate the entire second file into a range of the first file
  # that also has all bytes with the value 0x6b. The destination range's
  # end offset must not be aligned to the sector size and must be less
  # then the offset of the first byte with the value 0xae (byte at offset
  # 2518890).
  $ xfs_io -c "dedupe /mnt/bar 0 1957888 557771" /mnt/foo

  # The bytes in the range starting at offset 2515659 (end of the
  # deduplication range) and ending at offset 2519040 (start offset
  # rounded up to the block size) must all have the value 0xae (and not
  # replaced with 0x00 values). In other words, we should have exactly
  # the same data we had before we asked for deduplication.
  $ od -t x1 /mnt/foo
  000 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
  *
  11467540 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b ae ae ae ae ae ae
  11467560 ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae
  *
  11777540 ae ae ae ae ae ae ae ae
  11777550

  # Unmount the filesystem and mount it again. This guarantees any file
  # data in the page cache is dropped.
  $ umount /dev/sdb
  $ mount /dev/sdb /mnt

  $ od -t x1 /mnt/foo
  000 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
  *
  11461300 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 00 00 00 00 00
  11461320 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  *
  1147 ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae
  *
  11777540 ae ae ae ae ae ae ae ae
  11777550

  # The bytes in range 2515659 to 2519040 have a value of 0x00 and not a
  # value of 0xae, data corruption happened due to the deduplication
  # operation.

So fix this by rounding down, to the sector size, the length used for the
deduplication when the following conditions are met:

  1) Source file's range ends at its i_size;
  2) Source file's i_size is not aligned to the sector size;
  3) Destination range does not cross the i_size of the destination file.

Fixes: e1d227a42ea2 ("btrfs: Handle unaligned length in extent_same")
CC: sta...@vger.kernel.org # 4.2+
Signed-off-by: Filipe Manana 
Signed-off-by: David Sterba 
Signed-off-by: Greg Kroah-Hartman 

---
 fs/btrfs/ioctl.c |   19 +++
 1 file changed, 19 insertions(+)

--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -3463,6 +3463,25 @@ static int btrfs_extent_same_range(struc
 
same_lock_start = min_t(u64, loff, dst_loff);
same_lock_len = max_t(u64, loff, dst_loff) + len - 
same_lock_start;
+   } else {
+   /*
+* If the source and destination inodes are different, the
+* source's range end offset matches the source's i_size, that
+* i_size is not a multiple of the sector size, and the
+* destination range does not go past the destination's i_size,
+* we must round down the length to the nearest sector size
+* multiple. If we don't do this adjustment we end replacing
+* with zeroes the bytes in the range that starts at the
+* deduplication range's end offset and ends at the next sector
+* size multiple.
+*/
+   if (loff + olen == i_size_read(src) &&
+   dst_loff + len < i_size_read(dst)) {
+   const u64 sz = BTRFS_I(src)->root->fs_info->sectorsize;
+
+   len = round_down(i_size_read(src), sz) - loff;
+   olen = len;
+   }
}
 
 again:

[PATCH 4.18 063/158] scsi: lpfc: Fix driver crash when re-registering NVME rports.

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: James Smart 

[ Upstream commit 93a3922da428ec0752e8b2ab00c42dadbbf805a9 ]

During remote port loss fault testing, the driver crashed with the
following trace:

general protection fault:  [#1] SMP
RIP: ... lpfc_nvme_register_port+0x250/0x480 [lpfc]
Call Trace:
 lpfc_nlp_state_cleanup+0x1b3/0x7a0 [lpfc]
 lpfc_nlp_set_state+0xa6/0x1d0 [lpfc]
 lpfc_cmpl_prli_prli_issue+0x213/0x440
 lpfc_disc_state_machine+0x7e/0x1e0 [lpfc]
 lpfc_cmpl_els_prli+0x18a/0x200 [lpfc]
 lpfc_sli_sp_handle_rspiocb+0x3b5/0x6f0 [lpfc]
 lpfc_sli_handle_slow_ring_event_s4+0x161/0x240 [lpfc]
 lpfc_work_done+0x948/0x14c0 [lpfc]
 lpfc_do_work+0x16f/0x180 [lpfc]
 kthread+0xc9/0xe0
 ret_from_fork+0x55/0x80

After registering a new remoteport, the driver is pulling an ndlp pointer
from the lpfc rport associated with the private area of a newly registered
remoteport. The private area is uninitialized, so it's garbage.

Correct by pulling the the lpfc rport pointer from the entering ndlp point,
then ndlp value from at rport. Note the entering ndlp may be replacing by
the rport->ndlp due to an address change swap.

Signed-off-by: Dick Kennedy 
Signed-off-by: James Smart 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/scsi/lpfc/lpfc_nvme.c |   22 ++
 1 file changed, 14 insertions(+), 8 deletions(-)

--- a/drivers/scsi/lpfc/lpfc_nvme.c
+++ b/drivers/scsi/lpfc/lpfc_nvme.c
@@ -2687,7 +2687,7 @@ lpfc_nvme_register_port(struct lpfc_vpor
struct lpfc_nvme_rport *oldrport;
struct nvme_fc_remote_port *remote_port;
struct nvme_fc_port_info rpinfo;
-   struct lpfc_nodelist *prev_ndlp;
+   struct lpfc_nodelist *prev_ndlp = NULL;
 
lpfc_printf_vlog(ndlp->vport, KERN_INFO, LOG_NVME_DISC,
 "6006 Register NVME PORT. DID x%06x nlptype x%x\n",
@@ -2736,23 +2736,29 @@ lpfc_nvme_register_port(struct lpfc_vpor
spin_unlock_irq(>phba->hbalock);
rport = remote_port->private;
if (oldrport) {
+   /* New remoteport record does not guarantee valid
+* host private memory area.
+*/
+   prev_ndlp = oldrport->ndlp;
if (oldrport == remote_port->private) {
-   /* Same remoteport.  Just reuse. */
+   /* Same remoteport - ndlp should match.
+* Just reuse.
+*/
lpfc_printf_vlog(ndlp->vport, KERN_INFO,
 LOG_NVME_DISC,
 "6014 Rebinding lport to "
 "remoteport %p wwpn 0x%llx, "
-"Data: x%x x%x %p x%x x%06x\n",
+"Data: x%x x%x %p %p x%x 
x%06x\n",
 remote_port,
 remote_port->port_name,
 remote_port->port_id,
 remote_port->port_role,
+prev_ndlp,
 ndlp,
 ndlp->nlp_type,
 ndlp->nlp_DID);
return 0;
}
-   prev_ndlp = rport->ndlp;
 
/* Sever the ndlp<->rport association
 * before dropping the ndlp ref from
@@ -2786,13 +2792,13 @@ lpfc_nvme_register_port(struct lpfc_vpor
lpfc_printf_vlog(vport, KERN_INFO,
 LOG_NVME_DISC | LOG_NODE,
 "6022 Binding new rport to "
-"lport %p Remoteport %p  WWNN 0x%llx, "
+"lport %p Remoteport %p rport %p WWNN 0x%llx, "
 "Rport WWPN 0x%llx DID "
-"x%06x Role x%x, ndlp %p\n",
-lport, remote_port,
+"x%06x Role x%x, ndlp %p prev_ndlp %p\n",
+lport, remote_port, rport,
 rpinfo.node_name, rpinfo.port_name,
 rpinfo.port_id, rpinfo.port_role,
-ndlp);
+ndlp, prev_ndlp);
} else {
lpfc_printf_vlog(vport, KERN_ERR,
 LOG_NVME_DISC | LOG_NODE,

[PATCH 4.18 061/158] clk: scmi: Fix the rounding of clock rate

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Amit Daniel Kachhap 

[ Upstream commit 7a8655e19bdb3be43f6a3b4768c9b0928a2585fc ]

This fix rounds the clock rate properly by using quotient and not
remainder in the calculation. This issue was found while testing HDMI
in the Juno platform.

Fixes: 6d6a1d82eaef7 ("clk: add support for clocks provided by SCMI")
Acked-by: Sudeep Holla 
Signed-off-by: Amit Daniel Kachhap 
Signed-off-by: Stephen Boyd 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/clk/clk-scmi.c |5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

--- a/drivers/clk/clk-scmi.c
+++ b/drivers/clk/clk-scmi.c
@@ -38,7 +38,6 @@ static unsigned long scmi_clk_recalc_rat
 static long scmi_clk_round_rate(struct clk_hw *hw, unsigned long rate,
unsigned long *parent_rate)
 {
-   int step;
u64 fmin, fmax, ftmp;
struct scmi_clk *clk = to_scmi_clk(hw);
 
@@ -60,9 +59,9 @@ static long scmi_clk_round_rate(struct c
 
ftmp = rate - fmin;
ftmp += clk->info->range.step_size - 1; /* to round up */
-   step = do_div(ftmp, clk->info->range.step_size);
+   do_div(ftmp, clk->info->range.step_size);
 
-   return step * clk->info->range.step_size + fmin;
+   return ftmp * clk->info->range.step_size + fmin;
 }
 
 static int scmi_clk_set_rate(struct clk_hw *hw, unsigned long rate,

[PATCH 4.18 059/158] scsi: qla2xxx: Fix session state stuck in Get Port DB

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Quinn Tran 

[ Upstream commit 8fde6977ac478c00eeb2beccfdd4a6ad44219f6c ]

This patch sets discovery state back to GNL (Get Name List) when session is
stuck at GPDB (Get Port DataBase). This will allow state machine to retry
login and move session state ahead in discovery.

Signed-off-by: Quinn Tran 
Signed-off-by: Himanshu Madhani 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/scsi/qla2xxx/qla_init.c |9 ++---
 1 file changed, 6 insertions(+), 3 deletions(-)

--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -1074,9 +1074,12 @@ void qla24xx_handle_gpdb_event(scsi_qla_
case PDS_PLOGI_COMPLETE:
case PDS_PRLI_PENDING:
case PDS_PRLI2_PENDING:
-   ql_dbg(ql_dbg_disc, vha, 0x20d5, "%s %d %8phC relogin needed\n",
-   __func__, __LINE__, fcport->port_name);
-   set_bit(RELOGIN_NEEDED, >dpc_flags);
+   /* Set discovery state back to GNL to Relogin attempt */
+   if (qla_dual_mode_enabled(vha) ||
+   qla_ini_mode_enabled(vha)) {
+   fcport->disc_state = DSC_GNL;
+   set_bit(RELOGIN_NEEDED, >dpc_flags);
+   }
return;
case PDS_LOGO_PENDING:
case PDS_PORT_UNAVAILABLE:

[PATCH 4.18 060/158] scsi: qla2xxx: Silent erroneous message

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Quinn Tran 

[ Upstream commit 3f915271b12e11183c606bed1c3dfff0983662d3 ]

Driver uses shadow pointer instead of Mirror pointer for firmware dump
collection. Skip those entries for Mirror pointers for Request/Response
queue from firmware dump template reading.

Following messages are printed in log messages:

 qla27xx_fwdt_entry_t268: unknown buffer 4
 qla27xx_fwdt_entry_t268: unknown buffer 5

This patch fixes these error messages by adding skip_entry() to not read
them from template.

Signed-off-by: Quinn Tran 
Signed-off-by: Himanshu Madhani 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/scsi/qla2xxx/qla_tmpl.c |9 +
 1 file changed, 9 insertions(+)

--- a/drivers/scsi/qla2xxx/qla_tmpl.c
+++ b/drivers/scsi/qla2xxx/qla_tmpl.c
@@ -571,6 +571,15 @@ qla27xx_fwdt_entry_t268(struct scsi_qla_
}
break;
 
+   case T268_BUF_TYPE_REQ_MIRROR:
+   case T268_BUF_TYPE_RSP_MIRROR:
+   /*
+* Mirror pointers are not implemented in the
+* driver, instead shadow pointers are used by
+* the drier. Skip these entries.
+*/
+   qla27xx_skip_entry(ent, buf);
+   break;
default:
ql_dbg(ql_dbg_async, vha, 0xd02b,
"%s: unknown buffer %x\n", __func__, ent->t268.buf_type);

[PATCH 4.18 062/158] blk-mq: fix updating tags depth

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Ming Lei 

[ Upstream commit 75d6e175fc511e95ae3eb8f708680133bc211ed3 ]

The passed 'nr' from userspace represents the total depth, meantime
inside 'struct blk_mq_tags', 'nr_tags' stores the total tag depth,
and 'nr_reserved_tags' stores the reserved part.

There are two issues in blk_mq_tag_update_depth() now:

1) for growing tags, we should have used the passed 'nr', and keep the
number of reserved tags not changed.

2) the passed 'nr' should have been used for checking against
'tags->nr_tags', instead of number of the normal part.

This patch fixes the above two cases, and avoids kernel crash caused
by wrong resizing sbitmap queue.

Cc: "Ewan D. Milne" 
Cc: Christoph Hellwig 
Cc: Bart Van Assche 
Cc: Omar Sandoval 
Tested by: Marco Patalano 
Signed-off-by: Ming Lei 
Signed-off-by: Jens Axboe 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 block/blk-mq-tag.c |8 
 1 file changed, 4 insertions(+), 4 deletions(-)

--- a/block/blk-mq-tag.c
+++ b/block/blk-mq-tag.c
@@ -402,8 +402,6 @@ int blk_mq_tag_update_depth(struct blk_m
if (tdepth <= tags->nr_reserved_tags)
return -EINVAL;
 
-   tdepth -= tags->nr_reserved_tags;
-
/*
 * If we are allowed to grow beyond the original size, allocate
 * a new set of tags before freeing the old one.
@@ -423,7 +421,8 @@ int blk_mq_tag_update_depth(struct blk_m
if (tdepth > 16 * BLKDEV_MAX_RQ)
return -EINVAL;
 
-   new = blk_mq_alloc_rq_map(set, hctx->queue_num, tdepth, 0);
+   new = blk_mq_alloc_rq_map(set, hctx->queue_num, tdepth,
+   tags->nr_reserved_tags);
if (!new)
return -ENOMEM;
ret = blk_mq_alloc_rqs(set, new, hctx->queue_num, tdepth);
@@ -440,7 +439,8 @@ int blk_mq_tag_update_depth(struct blk_m
 * Don't need (or can't) update reserved tags here, they
 * remain static and should never need resizing.
 */
-   sbitmap_queue_resize(>bitmap_tags, tdepth);
+   sbitmap_queue_resize(>bitmap_tags,
+   tdepth - tags->nr_reserved_tags);
}
 
return 0;

[PATCH 4.18 002/158] i2c: i801: fix DNVs SMBCTRL register offset

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Felipe Balbi 

commit 851a15114895c5bce163a6f2d57e0aa4658a1be4 upstream.

DNV's iTCO is slightly different with SMBCTRL sitting at a different
offset when compared to all other devices. Let's fix so that we can
properly use iTCO watchdog.

Fixes: 84d7f2ebd70d ("i2c: i801: Add support for Intel DNV")
Cc:  # v4.4+
Signed-off-by: Felipe Balbi 
Reviewed-by: Jean Delvare 
Signed-off-by: Wolfram Sang 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/i2c/busses/i2c-i801.c |7 ++-
 1 file changed, 6 insertions(+), 1 deletion(-)

--- a/drivers/i2c/busses/i2c-i801.c
+++ b/drivers/i2c/busses/i2c-i801.c
@@ -139,6 +139,7 @@
 
 #define SBREG_BAR  0x10
 #define SBREG_SMBCTRL  0xc6000c
+#define SBREG_SMBCTRL_DNV  0xcf000c
 
 /* Host status bits for SMBPCISTS */
 #define SMBPCISTS_INTS BIT(3)
@@ -1396,7 +1397,11 @@ static void i801_add_tco(struct i801_pri
spin_unlock(_spinlock);
 
res = _res[ICH_RES_MEM_OFF];
-   res->start = (resource_size_t)base64_addr + SBREG_SMBCTRL;
+   if (pci_dev->device == PCI_DEVICE_ID_INTEL_DNV_SMBUS)
+   res->start = (resource_size_t)base64_addr + SBREG_SMBCTRL_DNV;
+   else
+   res->start = (resource_size_t)base64_addr + SBREG_SMBCTRL;
+
res->end = res->start + 3;
res->flags = IORESOURCE_MEM;
 

[PATCH 4.18 021/158] arm64: KVM: Only force FPEXC32_EL2.EN if trapping FPSIMD

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Marc Zyngier 

commit 7d14919c0d475a795c0127631ac8ecb2b0f31831 upstream.

If trapping FPSIMD in the context of an AArch32 guest, it is critical
to set FPEXC32_EL2.EN to 1 so that the trapping is taken to EL2 and
not EL1.

Conversely, it is just as critical *not* to set FPEXC32_EL2.EN to 1
if we're not going to trap FPSIMD, as we then corrupt the existing
VFP state.

Moving the call to __activate_traps_fpsimd32 to the point where we
know for sure that we are going to trap ensures that we don't set that
bit spuriously.

Fixes: e6b673b741ea ("KVM: arm64: Optimise FPSIMD handling to reduce guest/host 
thrashing")
Cc: sta...@vger.kernel.org # v4.18
Cc: Dave Martin 
Reported-by: Alexander Graf 
Tested-by: Alexander Graf 
Signed-off-by: Marc Zyngier 
Signed-off-by: Christoffer Dall 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/arm64/kvm/hyp/switch.c |9 ++---
 1 file changed, 6 insertions(+), 3 deletions(-)

--- a/arch/arm64/kvm/hyp/switch.c
+++ b/arch/arm64/kvm/hyp/switch.c
@@ -98,8 +98,10 @@ static void activate_traps_vhe(struct kv
val = read_sysreg(cpacr_el1);
val |= CPACR_EL1_TTA;
val &= ~CPACR_EL1_ZEN;
-   if (!update_fp_enabled(vcpu))
+   if (!update_fp_enabled(vcpu)) {
val &= ~CPACR_EL1_FPEN;
+   __activate_traps_fpsimd32(vcpu);
+   }
 
write_sysreg(val, cpacr_el1);
 
@@ -114,8 +116,10 @@ static void __hyp_text __activate_traps_
 
val = CPTR_EL2_DEFAULT;
val |= CPTR_EL2_TTA | CPTR_EL2_TZ;
-   if (!update_fp_enabled(vcpu))
+   if (!update_fp_enabled(vcpu)) {
val |= CPTR_EL2_TFP;
+   __activate_traps_fpsimd32(vcpu);
+   }
 
write_sysreg(val, cptr_el2);
 }
@@ -129,7 +133,6 @@ static void __hyp_text __activate_traps(
if (cpus_have_const_cap(ARM64_HAS_RAS_EXTN) && (hcr & HCR_VSE))
write_sysreg_s(vcpu->arch.vsesr_el2, SYS_VSESR_EL2);
 
-   __activate_traps_fpsimd32(vcpu);
if (has_vhe())
activate_traps_vhe(vcpu);
else

[PATCH 4.18 058/158] scsi: qla2xxx: Fix unintended Logout

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Quinn Tran 

[ Upstream commit cb97f2c2e8d9f8c71ddbf04ad57e163ee6d86474 ]

During normal IO, FW can return IO with 'port unavailble' status.  Driver
would send a LOGO to remote port for session resync.  On an off chance, a
PLOGI could arrive before sending the LOGO.  This patch will skip sendiing
LOGO if a PLOGI just came in.

Signed-off-by: Quinn Tran 
Signed-off-by: Himanshu Madhani 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/scsi/qla2xxx/qla_target.c |3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -982,8 +982,9 @@ void qlt_free_session_done(struct work_s
 
logo.id = sess->d_id;
logo.cmd_count = 0;
+   if (!own)
+   qlt_send_first_logo(vha, );
sess->send_els_logo = 0;
-   qlt_send_first_logo(vha, );
}
 
if (sess->logout_on_delete && sess->loop_id != FC_NO_LOOP_ID) {

[PATCH 4.18 020/158] Btrfs: fix data corruption when deduplicating between different files

[Greg Kroah-Hartman]

4.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Filipe Manana 

commit de02b9f6bb65a6a1848f346f7a3617b7a9b930c0 upstream.

If we deduplicate extents between two different files we can end up
corrupting data if the source range ends at the size of the source file,
the source file's size is not aligned to the filesystem's block size
and the destination range does not go past the size of the destination
file size.

Example:

  $ mkfs.btrfs -f /dev/sdb
  $ mount /dev/sdb /mnt

  $ xfs_io -f -c "pwrite -S 0x6b 0 2518890" /mnt/foo
  # The first byte with a value of 0xae starts at an offset (2518890)
  # which is not a multiple of the sector size.
  $ xfs_io -c "pwrite -S 0xae 2518890 102398" /mnt/foo

  # Confirm the file content is full of bytes with values 0x6b and 0xae.
  $ od -t x1 /mnt/foo
  000 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
  *
  11467540 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b ae ae ae ae ae ae
  11467560 ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae
  *
  11777540 ae ae ae ae ae ae ae ae
  11777550

  # Create a second file with a length not aligned to the sector size,
  # whose bytes all have the value 0x6b, so that its extent(s) can be
  # deduplicated with the first file.
  $ xfs_io -f -c "pwrite -S 0x6b 0 557771" /mnt/bar

  # Now deduplicate the entire second file into a range of the first file
  # that also has all bytes with the value 0x6b. The destination range's
  # end offset must not be aligned to the sector size and must be less
  # then the offset of the first byte with the value 0xae (byte at offset
  # 2518890).
  $ xfs_io -c "dedupe /mnt/bar 0 1957888 557771" /mnt/foo

  # The bytes in the range starting at offset 2515659 (end of the
  # deduplication range) and ending at offset 2519040 (start offset
  # rounded up to the block size) must all have the value 0xae (and not
  # replaced with 0x00 values). In other words, we should have exactly
  # the same data we had before we asked for deduplication.
  $ od -t x1 /mnt/foo
  000 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
  *
  11467540 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b ae ae ae ae ae ae
  11467560 ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae
  *
  11777540 ae ae ae ae ae ae ae ae
  11777550

  # Unmount the filesystem and mount it again. This guarantees any file
  # data in the page cache is dropped.
  $ umount /dev/sdb
  $ mount /dev/sdb /mnt

  $ od -t x1 /mnt/foo
  000 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
  *
  11461300 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 00 00 00 00 00
  11461320 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  *
  1147 ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae
  *
  11777540 ae ae ae ae ae ae ae ae
  11777550

  # The bytes in range 2515659 to 2519040 have a value of 0x00 and not a
  # value of 0xae, data corruption happened due to the deduplication
  # operation.

So fix this by rounding down, to the sector size, the length used for the
deduplication when the following conditions are met:

  1) Source file's range ends at its i_size;
  2) Source file's i_size is not aligned to the sector size;
  3) Destination range does not cross the i_size of the destination file.

Fixes: e1d227a42ea2 ("btrfs: Handle unaligned length in extent_same")
CC: sta...@vger.kernel.org # 4.2+
Signed-off-by: Filipe Manana 
Signed-off-by: David Sterba 
Signed-off-by: Greg Kroah-Hartman 

---
 fs/btrfs/ioctl.c |   19 +++
 1 file changed, 19 insertions(+)

--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -3463,6 +3463,25 @@ static int btrfs_extent_same_range(struc
 
same_lock_start = min_t(u64, loff, dst_loff);
same_lock_len = max_t(u64, loff, dst_loff) + len - 
same_lock_start;
+   } else {
+   /*
+* If the source and destination inodes are different, the
+* source's range end offset matches the source's i_size, that
+* i_size is not a multiple of the sector size, and the
+* destination range does not go past the destination's i_size,
+* we must round down the length to the nearest sector size
+* multiple. If we don't do this adjustment we end replacing
+* with zeroes the bytes in the range that starts at the
+* deduplication range's end offset and ends at the next sector
+* size multiple.
+*/
+   if (loff + olen == i_size_read(src) &&
+   dst_loff + len < i_size_read(dst)) {
+   const u64 sz = BTRFS_I(src)->root->fs_info->sectorsize;
+
+   len = round_down(i_size_read(src), sz) - loff;
+   olen = len;
+   }
}
 
 again: