This is the 4.9.258 stable release

-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmA0/D0ACgkQONu9yGCS
 aT4YVRAAnUz584VShUJYJONEbbp/HToHlU1eamwhVOeYykveR01UZcN4TQccU71R
 80zc9fg3YG0QJMLwGMjPXP1E9Xd0THn3Igcles1qTaWx06JeuyPQqNK0JV1e1ruL
 qD1kAr5ON4BiQpOEo+u+t/dvyFJgRppPs+ud+Q81skySUpElMRQg7Am5FDkFVVg2
 Pun1f4+6c6in3M8Gu+3WaZzPkrXoR8Bg8FnvzY4OMFxO1kElIj4FbXCTUFg6tUVp
 uTUI4RJH2GAN7NUru0lI45VIOkcmE8M7TFr/i/v0rXhTCVQPGtgYw1hCokGwKCiM
 yfLDR6cry/hFw0aE3CgVqW8p4iJKkoKl/8hjCmqh5n56dR0Cf75CtS+pE55z1lfF
 DAUk044+e+QVqumw4Ky9guakhrgn6cepy6xU29t1Agb6OwCBwUatWV+NJ3AYM/f+
 7eE+0m+WR+ehgtDPNL6nsHlGfFrARw6lpYg8Cy7q18zZl2v4GxauuLfnVW0pgCnj
 yvl0Xs/dwlVay8QVWf9RlENmDV9dWGJzM/4e9FCPqgu+RzF2pfDdN+2RZ8ExF78n
 h456Vx2iM6eWEwz396JjrHgM9NUb4TVlKfZWg5naI3mmTUeAV0JZy5/m/ZIIiiT1
 lUjOmIr3XCloaLPxJDhnap8nEHWXPeuzri4O/25ZX69nmmekBKs=
 =ebCa
 -----END PGP SIGNATURE-----

Merge 4.9.258 into android-4.9-q

Changes in 4.9.258
	mm: memcontrol: fix NULL pointer crash in test_clear_page_writeback()
	fgraph: Initialize tracing_graph_pause at task creation
	remoteproc: qcom_q6v5_mss: Validate MBA firmware size before load
	af_key: relax availability checks for skb size calculation
	iwlwifi: mvm: take mutex for calling iwl_mvm_get_sync_time()
	iwlwifi: pcie: add a NULL check in iwl_pcie_txq_unmap
	iwlwifi: mvm: guard against device removal in reprobe
	SUNRPC: Move simple_get_bytes and simple_get_netobj into private header
	SUNRPC: Handle 0 length opaque XDR object data properly
	lib/string: Add strscpy_pad() function
	include/trace/events/writeback.h: fix -Wstringop-truncation warnings
	memcg: fix a crash in wb_workfn when a device disappears
	futex: Ensure the correct return value from futex_lock_pi()
	futex: Change locking rules
	futex: Cure exit race
	squashfs: add more sanity checks in id lookup
	squashfs: add more sanity checks in inode lookup
	squashfs: add more sanity checks in xattr id lookup
	tracing: Do not count ftrace events in top level enable output
	tracing: Check length before giving out the filter buffer
	ovl: skip getxattr of security labels
	ARM: dts: lpc32xx: Revert set default clock rate of HCLK PLL
	memblock: do not start bottom-up allocations with kernel_end
	bpf: Check for integer overflow when using roundup_pow_of_two()
	netfilter: xt_recent: Fix attempt to update deleted entry
	xen/netback: avoid race in xenvif_rx_ring_slots_available()
	netfilter: conntrack: skip identical origin tuple in same zone only
	h8300: fix PREEMPTION build, TI_PRE_COUNT undefined
	usb: dwc3: ulpi: fix checkpatch warning
	usb: dwc3: ulpi: Replace CPU-based busyloop with Protocol-based one
	net/vmw_vsock: improve locking in vsock_connect_timeout()
	net: watchdog: hold device global xmit lock during tx disable
	vsock/virtio: update credit only if socket is not closed
	vsock: fix locking in vsock_shutdown()
	x86/build: Disable CET instrumentation in the kernel for 32-bit too
	trace: Use -mcount-record for dynamic ftrace
	tracing: Fix SKIP_STACK_VALIDATION=1 build due to bad merge with -mrecord-mcount
	tracing: Avoid calling cc-option -mrecord-mcount for every Makefile
	Xen/x86: don't bail early from clear_foreign_p2m_mapping()
	Xen/x86: also check kernel mapping in set_foreign_p2m_mapping()
	Xen/gntdev: correct dev_bus_addr handling in gntdev_map_grant_pages()
	Xen/gntdev: correct error checking in gntdev_map_grant_pages()
	xen/arm: don't ignore return errors from set_phys_to_machine
	xen-blkback: don't "handle" error by BUG()
	xen-netback: don't "handle" error by BUG()
	xen-scsiback: don't "handle" error by BUG()
	xen-blkback: fix error handling in xen_blkbk_map()
	scsi: qla2xxx: Fix crash during driver load on big endian machines
	kvm: check tlbs_dirty directly
	Linux 4.9.258

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I5302387bd8a7d3610002bf86bc9612261f687217
This commit is contained in:
Greg Kroah-Hartman 2021-02-23 14:46:12 +01:00
commit b16bd72cbd
54 changed files with 680 additions and 308 deletions

View file

@ -1,6 +1,6 @@
VERSION = 4
PATCHLEVEL = 9
SUBLEVEL = 257
SUBLEVEL = 258
EXTRAVERSION =
NAME = Roaring Lionus
@ -829,6 +829,13 @@ ifdef CONFIG_FUNCTION_TRACER
ifndef CC_FLAGS_FTRACE
CC_FLAGS_FTRACE := -pg
endif
ifdef CONFIG_FTRACE_MCOUNT_RECORD
# gcc 5 supports generating the mcount tables directly
ifeq ($(call cc-option-yn,-mrecord-mcount),y)
CC_FLAGS_FTRACE += -mrecord-mcount
export CC_USING_RECORD_MCOUNT := 1
endif
endif
export CC_FLAGS_FTRACE
ifdef CONFIG_HAVE_FENTRY
CC_USING_FENTRY := $(call cc-option, -mfentry -DCC_USING_FENTRY)

View file

@ -323,9 +323,6 @@
clocks = <&xtal_32k>, <&xtal>;
clock-names = "xtal_32k", "xtal";
assigned-clocks = <&clk LPC32XX_CLK_HCLK_PLL>;
assigned-clock-rates = <208000000>;
};
};

View file

@ -93,8 +93,10 @@ int set_foreign_p2m_mapping(struct gnttab_map_grant_ref *map_ops,
for (i = 0; i < count; i++) {
if (map_ops[i].status)
continue;
set_phys_to_machine(map_ops[i].host_addr >> XEN_PAGE_SHIFT,
map_ops[i].dev_bus_addr >> XEN_PAGE_SHIFT);
if (unlikely(!set_phys_to_machine(map_ops[i].host_addr >> XEN_PAGE_SHIFT,
map_ops[i].dev_bus_addr >> XEN_PAGE_SHIFT))) {
return -ENOMEM;
}
}
return 0;

View file

@ -62,6 +62,9 @@ int main(void)
OFFSET(TI_FLAGS, thread_info, flags);
OFFSET(TI_CPU, thread_info, cpu);
OFFSET(TI_PRE, thread_info, preempt_count);
#ifdef CONFIG_PREEMPTION
DEFINE(TI_PRE_COUNT, offsetof(struct thread_info, preempt_count));
#endif
return 0;
}

View file

@ -61,6 +61,9 @@ endif
KBUILD_CFLAGS += -mno-sse -mno-mmx -mno-sse2 -mno-3dnow
KBUILD_CFLAGS += $(call cc-option,-mno-avx,)
# Intel CET isn't enabled in the kernel
KBUILD_CFLAGS += $(call cc-option,-fcf-protection=none)
ifeq ($(CONFIG_X86_32),y)
BITS := 32
UTS_MACHINE := i386
@ -139,9 +142,6 @@ else
KBUILD_CFLAGS += -mno-red-zone
KBUILD_CFLAGS += -mcmodel=kernel
# Intel CET isn't enabled in the kernel
KBUILD_CFLAGS += $(call cc-option,-fcf-protection=none)
# -funit-at-a-time shrinks the kernel .text considerably
# unfortunately it makes reading oopses harder.
KBUILD_CFLAGS += $(call cc-option,-funit-at-a-time)

View file

@ -725,7 +725,8 @@ int set_foreign_p2m_mapping(struct gnttab_map_grant_ref *map_ops,
unsigned long mfn, pfn;
/* Do not add to override if the map failed. */
if (map_ops[i].status)
if (map_ops[i].status != GNTST_okay ||
(kmap_ops && kmap_ops[i].status != GNTST_okay))
continue;
if (map_ops[i].flags & GNTMAP_contains_pte) {
@ -763,17 +764,15 @@ int clear_foreign_p2m_mapping(struct gnttab_unmap_grant_ref *unmap_ops,
unsigned long mfn = __pfn_to_mfn(page_to_pfn(pages[i]));
unsigned long pfn = page_to_pfn(pages[i]);
if (mfn == INVALID_P2M_ENTRY || !(mfn & FOREIGN_FRAME_BIT)) {
if (mfn != INVALID_P2M_ENTRY && (mfn & FOREIGN_FRAME_BIT))
set_phys_to_machine(pfn, INVALID_P2M_ENTRY);
else
ret = -EINVAL;
goto out;
}
set_phys_to_machine(pfn, INVALID_P2M_ENTRY);
}
if (kunmap_ops)
ret = HYPERVISOR_grant_table_op(GNTTABOP_unmap_grant_ref,
kunmap_ops, count);
out:
kunmap_ops, count) ?: ret;
return ret;
}
EXPORT_SYMBOL_GPL(clear_foreign_p2m_mapping);

View file

@ -843,8 +843,11 @@ again:
pages[i]->page = persistent_gnt->page;
pages[i]->persistent_gnt = persistent_gnt;
} else {
if (get_free_page(ring, &pages[i]->page))
goto out_of_memory;
if (get_free_page(ring, &pages[i]->page)) {
put_free_pages(ring, pages_to_gnt, segs_to_map);
ret = -ENOMEM;
goto out;
}
addr = vaddr(pages[i]->page);
pages_to_gnt[segs_to_map] = pages[i]->page;
pages[i]->persistent_gnt = NULL;
@ -860,10 +863,8 @@ again:
break;
}
if (segs_to_map) {
if (segs_to_map)
ret = gnttab_map_refs(map, NULL, pages_to_gnt, segs_to_map);
BUG_ON(ret);
}
/*
* Now swizzle the MFN in our domain with the MFN from the other domain
@ -878,7 +879,7 @@ again:
pr_debug("invalid buffer -- could not remap it\n");
put_free_pages(ring, &pages[seg_idx]->page, 1);
pages[seg_idx]->handle = BLKBACK_INVALID_HANDLE;
ret |= 1;
ret |= !ret;
goto next;
}
pages[seg_idx]->handle = map[new_map_idx].handle;
@ -930,17 +931,18 @@ next:
}
segs_to_map = 0;
last_map = map_until;
if (map_until != num)
if (!ret && map_until != num)
goto again;
return ret;
out_of_memory:
pr_alert("%s: out of memory\n", __func__);
put_free_pages(ring, pages_to_gnt, segs_to_map);
for (i = last_map; i < num; i++)
out:
for (i = last_map; i < num; i++) {
/* Don't zap current batch's valid persistent grants. */
if(i >= last_map + segs_to_map)
pages[i]->persistent_gnt = NULL;
pages[i]->handle = BLKBACK_INVALID_HANDLE;
return -ENOMEM;
}
return ret;
}
static int xen_blkbk_map_seg(struct pending_req *pending_req)

View file

@ -518,7 +518,10 @@ static ssize_t iwl_dbgfs_os_device_timediff_read(struct file *file,
const size_t bufsz = sizeof(buf);
int pos = 0;
mutex_lock(&mvm->mutex);
iwl_mvm_get_sync_time(mvm, &curr_gp2, &curr_os);
mutex_unlock(&mvm->mutex);
do_div(curr_os, NSEC_PER_USEC);
diff = curr_os - curr_gp2;
pos += scnprintf(buf + pos, bufsz - pos, "diff=%lld\n", diff);

View file

@ -1104,6 +1104,7 @@ static void iwl_mvm_reprobe_wk(struct work_struct *wk)
reprobe = container_of(wk, struct iwl_mvm_reprobe, work);
if (device_reprobe(reprobe->dev))
dev_err(reprobe->dev, "reprobe failed!\n");
put_device(reprobe->dev);
kfree(reprobe);
module_put(THIS_MODULE);
}
@ -1202,7 +1203,7 @@ void iwl_mvm_nic_restart(struct iwl_mvm *mvm, bool fw_error)
module_put(THIS_MODULE);
return;
}
reprobe->dev = mvm->trans->dev;
reprobe->dev = get_device(mvm->trans->dev);
INIT_WORK(&reprobe->work, iwl_mvm_reprobe_wk);
schedule_work(&reprobe->work);
} else if (mvm->cur_ucode == IWL_UCODE_REGULAR) {

View file

@ -676,6 +676,11 @@ static void iwl_pcie_txq_unmap(struct iwl_trans *trans, int txq_id)
struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
struct iwl_txq *txq = &trans_pcie->txq[txq_id];
if (!txq) {
IWL_ERR(trans, "Trying to free a queue that wasn't allocated?\n");
return;
}
spin_lock_bh(&txq->lock);
while (txq->write_ptr != txq->read_ptr) {
IWL_DEBUG_TX_REPLY(trans, "Q %d Free %d\n",

View file

@ -1328,13 +1328,11 @@ int xenvif_tx_action(struct xenvif_queue *queue, int budget)
return 0;
gnttab_batch_copy(queue->tx_copy_ops, nr_cops);
if (nr_mops != 0) {
if (nr_mops != 0)
ret = gnttab_map_refs(queue->tx_map_ops,
NULL,
queue->pages_to_map,
nr_mops);
BUG_ON(ret);
}
work_done = xenvif_tx_submit(queue);

View file

@ -38,10 +38,15 @@ static bool xenvif_rx_ring_slots_available(struct xenvif_queue *queue)
RING_IDX prod, cons;
struct sk_buff *skb;
int needed;
unsigned long flags;
spin_lock_irqsave(&queue->rx_queue.lock, flags);
skb = skb_peek(&queue->rx_queue);
if (!skb)
if (!skb) {
spin_unlock_irqrestore(&queue->rx_queue.lock, flags);
return false;
}
needed = DIV_ROUND_UP(skb->len, XEN_PAGE_SIZE);
if (skb_is_gso(skb))
@ -49,6 +54,8 @@ static bool xenvif_rx_ring_slots_available(struct xenvif_queue *queue)
if (skb->sw_hash)
needed++;
spin_unlock_irqrestore(&queue->rx_queue.lock, flags);
do {
prod = queue->rx.sring->req_prod;
cons = queue->rx.req_cons;

View file

@ -193,6 +193,12 @@ static int q6v5_load(struct rproc *rproc, const struct firmware *fw)
{
struct q6v5 *qproc = rproc->priv;
/* MBA is restricted to a maximum size of 1M */
if (fw->size > qproc->mba_size || fw->size > SZ_1M) {
dev_err(qproc->dev, "MBA firmware load failed\n");
return -EINVAL;
}
memcpy(qproc->mba_region, fw->data, fw->size);
return 0;

View file

@ -878,7 +878,8 @@ qla27xx_template_checksum(void *p, ulong size)
static inline int
qla27xx_verify_template_checksum(struct qla27xx_fwdt_template *tmp)
{
return qla27xx_template_checksum(tmp, tmp->template_size) == 0;
return qla27xx_template_checksum(tmp,
le32_to_cpu(tmp->template_size)) == 0;
}
static inline int
@ -894,7 +895,7 @@ qla27xx_execute_fwdt_template(struct scsi_qla_host *vha)
ulong len;
if (qla27xx_fwdt_template_valid(tmp)) {
len = tmp->template_size;
len = le32_to_cpu(tmp->template_size);
tmp = memcpy(vha->hw->fw_dump, tmp, len);
ql27xx_edit_template(vha, tmp);
qla27xx_walk_template(vha, tmp, tmp, &len);
@ -910,7 +911,7 @@ qla27xx_fwdt_calculate_dump_size(struct scsi_qla_host *vha)
ulong len = 0;
if (qla27xx_fwdt_template_valid(tmp)) {
len = tmp->template_size;
len = le32_to_cpu(tmp->template_size);
qla27xx_walk_template(vha, tmp, NULL, &len);
}
@ -922,7 +923,7 @@ qla27xx_fwdt_template_size(void *p)
{
struct qla27xx_fwdt_template *tmp = p;
return tmp->template_size;
return le32_to_cpu(tmp->template_size);
}
ulong

View file

@ -13,7 +13,7 @@
struct __packed qla27xx_fwdt_template {
uint32_t template_type;
uint32_t entry_offset;
uint32_t template_size;
__le32 template_size;
uint32_t reserved_1;
uint32_t entry_count;

View file

@ -10,6 +10,8 @@
* published by the Free Software Foundation.
*/
#include <linux/delay.h>
#include <linux/time64.h>
#include <linux/ulpi/regs.h>
#include "core.h"
@ -20,12 +22,22 @@
DWC3_GUSB2PHYACC_ADDR(ULPI_ACCESS_EXTENDED) | \
DWC3_GUSB2PHYACC_EXTEND_ADDR(a) : DWC3_GUSB2PHYACC_ADDR(a))
static int dwc3_ulpi_busyloop(struct dwc3 *dwc)
#define DWC3_ULPI_BASE_DELAY DIV_ROUND_UP(NSEC_PER_SEC, 60000000L)
static int dwc3_ulpi_busyloop(struct dwc3 *dwc, u8 addr, bool read)
{
unsigned count = 1000;
unsigned long ns = 5L * DWC3_ULPI_BASE_DELAY;
unsigned int count = 1000;
u32 reg;
if (addr >= ULPI_EXT_VENDOR_SPECIFIC)
ns += DWC3_ULPI_BASE_DELAY;
if (read)
ns += DWC3_ULPI_BASE_DELAY;
while (count--) {
ndelay(ns);
reg = dwc3_readl(dwc->regs, DWC3_GUSB2PHYACC(0));
if (!(reg & DWC3_GUSB2PHYACC_BUSY))
return 0;
@ -44,7 +56,7 @@ static int dwc3_ulpi_read(struct device *dev, u8 addr)
reg = DWC3_GUSB2PHYACC_NEWREGREQ | DWC3_ULPI_ADDR(addr);
dwc3_writel(dwc->regs, DWC3_GUSB2PHYACC(0), reg);
ret = dwc3_ulpi_busyloop(dwc);
ret = dwc3_ulpi_busyloop(dwc, addr, true);
if (ret)
return ret;
@ -62,7 +74,7 @@ static int dwc3_ulpi_write(struct device *dev, u8 addr, u8 val)
reg |= DWC3_GUSB2PHYACC_WRITE | val;
dwc3_writel(dwc->regs, DWC3_GUSB2PHYACC(0), reg);
return dwc3_ulpi_busyloop(dwc);
return dwc3_ulpi_busyloop(dwc, addr, false);
}
static const struct ulpi_ops dwc3_ulpi_ops = {

View file

@ -293,36 +293,47 @@ static int map_grant_pages(struct grant_map *map)
* to the kernel linear addresses of the struct pages.
* These ptes are completely different from the user ptes dealt
* with find_grant_ptes.
* Note that GNTMAP_device_map isn't needed here: The
* dev_bus_addr output field gets consumed only from ->map_ops,
* and by not requesting it when mapping we also avoid needing
* to mirror dev_bus_addr into ->unmap_ops (and holding an extra
* reference to the page in the hypervisor).
*/
unsigned int flags = (map->flags & ~GNTMAP_device_map) |
GNTMAP_host_map;
for (i = 0; i < map->count; i++) {
unsigned long address = (unsigned long)
pfn_to_kaddr(page_to_pfn(map->pages[i]));
BUG_ON(PageHighMem(map->pages[i]));
gnttab_set_map_op(&map->kmap_ops[i], address,
map->flags | GNTMAP_host_map,
gnttab_set_map_op(&map->kmap_ops[i], address, flags,
map->grants[i].ref,
map->grants[i].domid);
gnttab_set_unmap_op(&map->kunmap_ops[i], address,
map->flags | GNTMAP_host_map, -1);
flags, -1);
}
}
pr_debug("map %d+%d\n", map->index, map->count);
err = gnttab_map_refs(map->map_ops, use_ptemod ? map->kmap_ops : NULL,
map->pages, map->count);
if (err)
return err;
for (i = 0; i < map->count; i++) {
if (map->map_ops[i].status) {
if (map->map_ops[i].status == GNTST_okay)
map->unmap_ops[i].handle = map->map_ops[i].handle;
else if (!err)
err = -EINVAL;
continue;
}
map->unmap_ops[i].handle = map->map_ops[i].handle;
if (use_ptemod)
map->kunmap_ops[i].handle = map->kmap_ops[i].handle;
if (map->flags & GNTMAP_device_map)
map->unmap_ops[i].dev_bus_addr = map->map_ops[i].dev_bus_addr;
if (use_ptemod) {
if (map->kmap_ops[i].status == GNTST_okay)
map->kunmap_ops[i].handle = map->kmap_ops[i].handle;
else if (!err)
err = -EINVAL;
}
}
return err;
}

View file

@ -423,12 +423,12 @@ static int scsiback_gnttab_data_map_batch(struct gnttab_map_grant_ref *map,
return 0;
err = gnttab_map_refs(map, NULL, pg, cnt);
BUG_ON(err);
for (i = 0; i < cnt; i++) {
if (unlikely(map[i].status != GNTST_okay)) {
pr_err("invalid buffer -- could not remap it\n");
map[i].handle = SCSIBACK_INVALID_HANDLE;
err = -ENOMEM;
if (!err)
err = -ENOMEM;
} else {
get_page(pg[i]);
}

View file

@ -1971,7 +1971,7 @@ void wb_workfn(struct work_struct *work)
struct bdi_writeback, dwork);
long pages_written;
set_worker_desc("flush-%s", dev_name(wb->bdi->dev));
set_worker_desc("flush-%s", bdi_dev_name(wb->bdi));
current->flags |= PF_SWAPWRITE;
if (likely(!current_is_workqueue_rescuer() ||

View file

@ -92,6 +92,14 @@ int ovl_copy_xattr(struct dentry *old, struct dentry *new)
if (ovl_is_private_xattr(name))
continue;
error = security_inode_copy_up_xattr(name);
if (error < 0 && error != -EOPNOTSUPP)
break;
if (error == 1) {
error = 0;
continue; /* Discard */
}
retry:
size = vfs_getxattr(old, name, value, value_size);
if (size == -ERANGE)
@ -115,13 +123,6 @@ retry:
goto retry;
}
error = security_inode_copy_up_xattr(name);
if (error < 0 && error != -EOPNOTSUPP)
break;
if (error == 1) {
error = 0;
continue; /* Discard */
}
error = vfs_setxattr(new, name, value, size, 0);
if (error)
break;

Some files were not shown because too many files have changed in this diff Show more