summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2019-10-25io_uring: used cached copies of sq->dropped and cq->overflowJens Axboe
We currently use the ring values directly, but that can lead to issues if the application is malicious and changes these values on our behalf. Created in-kernel cached versions of them, and just overwrite the user side when we update them. This is similar to how we treat the sq/cq ring tail/head updates. Reported-by: Pavel Begunkov <asml.silence@gmail.com> Reviewed-by: Pavel Begunkov <asml.silence@gmail.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2019-10-25ARM: dts: stm32: relax qspi pins slew-rate for stm32mp157Patrice Chotard
Relax qspi pins slew-rate to minimize peak currents. Fixes: 844030057339 ("ARM: dts: stm32: add flash nor support on stm32mp157c eval board") Link: https://lore.kernel.org/r/20191025130122.11407-1-alexandre.torgue@st.com Signed-off-by: Patrice Chotard <patrice.chotard@st.com> Signed-off-by: Alexandre Torgue <alexandre.torgue@st.com> Signed-off-by: Olof Johansson <olof@lixom.net>
2019-10-25io_uring: Fix race for sqes with userspacePavel Begunkov
io_ring_submit() finalises with 1. io_commit_sqring(), which releases sqes to the userspace 2. Then calls to io_queue_link_head(), accessing released head's sqe Reorder them. Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2019-10-25io_uring: Fix broken links with offloadingPavel Begunkov
io_sq_thread() processes sqes by 8 without considering links. As a result, links will be randomely subdivided. The easiest way to fix it is to call io_get_sqring() inside io_submit_sqes() as do io_ring_submit(). Downsides: 1. This removes optimisation of not grabbing mm_struct for fixed files 2. It submitting all sqes in one go, without finer-grained sheduling with cq processing. Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2019-10-25io_uring: Fix corrupted user_dataPavel Begunkov
There is a bug, where failed linked requests are returned not with specified @user_data, but with garbage from a kernel stack. The reason is that io_fail_links() uses req->user_data, which is uninitialised when called from io_queue_sqe() on fail path. Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2019-10-25xen: issue deprecation warning for 32-bit pv guestJuergen Gross
Support for the kernel as Xen 32-bit PV guest will soon be removed. Issue a warning when booted as such. Signed-off-by: Juergen Gross <jgross@suse.com> Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
2019-10-25Merge tag 'irqchip-fixes-5.4-2' of ↵Thomas Gleixner
git://git.kernel.org/pub/scm/linux/kernel/git/maz/arm-platforms into irq/urgent Pull the second lot of irqchip updates for 5.4 from Marc Zyngier: - Sifive PLIC: force driver to skip non-relevant contexts - GICv4: Don't send VMOVP commands to ITSs that don't have this vPE mapped
2019-10-25irqchip/sifive-plic: Skip contexts except supervisor in plic_init()Alan Mikhak
Modify plic_init() to skip .dts interrupt contexts other than supervisor external interrupt. The .dts entry for plic may specify multiple interrupt contexts. For example, it may assign two entries IRQ_M_EXT and IRQ_S_EXT, in that order, to the same interrupt controller. This patch modifies plic_init() to skip the IRQ_M_EXT context since IRQ_S_EXT is currently the only supported context. If IRQ_M_EXT is not skipped, plic_init() will report "handler already present for context" when it comes across the IRQ_S_EXT context in the next iteration of its loop. Without this patch, .dts would have to be edited to replace the value of IRQ_M_EXT with -1 for it to be skipped. Signed-off-by: Alan Mikhak <alan.mikhak@sifive.com> Signed-off-by: Marc Zyngier <maz@kernel.org> Reviewed-by: Christoph Hellwig <hch@lst.de> Acked-by: Paul Walmsley <paul.walmsley@sifive.com> # arch/riscv Link: https://lkml.kernel.org/r/1571933503-21504-1-git-send-email-alan.mikhak@sifive.com
2019-10-25Merge tag 'drm-fixes-5.4-2019-10-23' of ↵Dave Airlie
git://people.freedesktop.org/~agd5f/linux into drm-fixes drm-fixes-5.4-2019-10-23: amdgpu: - Fix suspend/resume issue related to multi-media engines - Fix memory leak in user ptr code related to hmm conversion - Fix possible VM faults when allocating page table memory - Fix error handling in bo list ioctl Signed-off-by: Dave Airlie <airlied@redhat.com> From: Alex Deucher <alexdeucher@gmail.com> Link: https://patchwork.freedesktop.org/patch/msgid/20191024031809.3155-1-alexander.deucher@amd.com
2019-10-25Merge tag 'drm-misc-fixes-2019-10-23' of ↵Dave Airlie
git://anongit.freedesktop.org/drm/drm-misc into drm-fixes Two fixes for komeda, one for typos and one to prevent an hardware issue when flushing inactive pipes Signed-off-by: Dave Airlie <airlied@redhat.com> From: Maxime Ripard <mripard@kernel.org> Link: https://patchwork.freedesktop.org/patch/msgid/20191023112643.evpp6f23mpjwdsn4@gilmour
2019-10-24staging: exfat: Update MAINTAINERS fileValdis Kletnieks
Add a L: tag so get_maintainers.pl output includes the linux-fsdevel list Signed-off-by: Valdis Kletnieks <Valdis.Kletnieks@vt.edu> Link: https://lore.kernel.org/r/20191023055353.695275-1-Valdis.Kletnieks@vt.edu Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-24staging: wilc1000: handle mgmt frames for both interfaces during concurrent modeAjay Singh
During concurrent mode(AP/STA + P2P), pass the mgmt frames received from firmware to appropriate interface. Iterate the complete interface list to pass frames on the interface which has registered to receive mgmt frame. Added extra time for 'remain_on_ch' timer to ensure that timeout for uncanceled remain_on_channel is not triggered & 'p2p_listen_state' is not cleared before passing the mgmt frames to p2p interface. Signed-off-by: Ajay Singh <ajay.kathat@microchip.com> Link: https://lore.kernel.org/r/20191018124511.22751-1-ajay.kathat@microchip.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-24staging: wilc1000: potential corruption in wilc_parse_join_bss_param()Dan Carpenter
The "rates_len" value needs to be capped so that the memcpy() doesn't copy beyond the end of the array. Fixes: c5c77ba18ea6 ("staging: wilc1000: Add SDIO/SPI 802.11 driver") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Reviewed-by: Adham Abozaeid <adham.abozaeid@microchip.com> Link: https://lore.kernel.org/r/20191017091832.GB31278@mwanda Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-24staging: wilc1000: store bss object and use cfg80211_connect_bss()Adham Abozaeid
In a fast disconnect/connect sequence, cfg80211_connect_result() can fail to find the bss object which the driver is connecting to. Detailed sequence of events: * Driver is connected in STA mode * Disconnect request arrives from user space. Driver disconnects and calls cfg80211_disconnected() which adds new event to the cfg80211_wq worker thread * Connect request arrives from user space. cfg80211_connect() stores ssid/ssid_len and calls rdev_connect() * __cfg80211_disconnected() runs in worker thread and zero wdev->ssid_len * Connect succeeds. Driver calls cfg80211_connect_result() which fails to find the bss because wdev->ssid_len is zero To overcome this, upon connect request, store the bss object in the driver and upon connect completion pass it to kernel using cfg80211_connect_bss(). Ref: bcdd49b074d0 ("store bss object and use cfg80211_connect_bss()") Signed-off-by: Adham Abozaeid <adham.abozaeid@microchip.com> Link: https://lore.kernel.org/r/20191017165105.27429-1-adham.abozaeid@microchip.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-24staging: rtl8188eu: remove code valid only for 5 GHzMichael Straube
Remove code valid only for 5 GHz, according to the TODO. - find and remove remaining code valid only for 5 GHz. Most of the obvious ones have been removed, but things like channel > 14 still exist. Signed-off-by: Michael Straube <straube.linux@gmail.com> Link: https://lore.kernel.org/r/20191024155918.13399-1-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-24staging: fbtft: Fix duplicate arguments to bitwise ANDJamal Shareef
Fix duplicated arguments to bitwise & operator. Issue detected by coccinelle. Signed-off-by: Jamal Shareef <jamal.k.shareef@gmail.com> Link: https://lore.kernel.org/r/20191023215105.18049-1-jamal.k.shareef@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-24staging: gasket: Fix lines ending with a '('CristianeNaves
Fix lines ending with a '('. Issue found by checkpatch. Signed-off-by: CristianeNaves <cristianenavescardoso09@gmail.com> Link: https://lore.kernel.org/r/20191024134623.GA4506@cristiane-Inspiron-5420 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-24staging: sm750fb: align arguments with open parenthesis in file sm750_cursor.hGabriela Bittencourt
Cleans up checks of "Alignment should match open parenthesis" in file sm750_cursor.h Signed-off-by: Gabriela Bittencourt <gabrielabittencourt00@gmail.com> Link: https://lore.kernel.org/r/20191024163822.7157-4-gabrielabittencourt00@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-24staging: sm750fb: align arguments with open parenthesis in file sm750_accel.hGabriela Bittencourt
Cleans up checks of "Alignment should match open parenthesis" in file sm750_accel.h Signed-off-by: Gabriela Bittencourt <gabrielabittencourt00@gmail.com> Link: https://lore.kernel.org/r/20191024163822.7157-3-gabrielabittencourt00@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-24staging: sm750fb: align arguments with open parenthesis in ddk750_sii164.cGabriela Bittencourt
Cleans up checks of "Alignment should match open parenthesis" in file ddk750_sii164.c Signed-off-by: Gabriela Bittencourt <gabrielabittencourt00@gmail.com> Link: https://lore.kernel.org/r/20191024163822.7157-2-gabrielabittencourt00@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-24staging: sm750fb: format description of parameters in accel.hGabriela Bittencourt
Formatting comments in file drivers/staging/sm750fb/sm750_accel.h. Signed-off-by: Gabriela Bittencourt <gabrielabittencourt00@gmail.com> Link: https://lore.kernel.org/r/20191023163016.30217-3-gabrielabittencourt00@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-24staging: sm750fb: format description of parameters in accel.cGabriela Bittencourt
Formatting comments in file drivers/staging/sm750fb/sm750_accel.c. Signed-off-by: Gabriela Bittencourt <gabrielabittencourt00@gmail.com> Link: https://lore.kernel.org/r/20191023163016.30217-2-gabrielabittencourt00@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-24staging: vc04_services: fix warnings of Block comments use of *Jules Irenge
Fix warnings of Block comments use * on subsequent lines. Issue detected by checkpatch tool. Signed-off-by: Jules Irenge <jbi.octave@gmail.com> Link: https://lore.kernel.org/r/20191017173837.27336-1-jbi.octave@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-24staging: vc04_services: fix warnings of scpace required between operatorJules Irenge
Fix warnings of space required between operator and variables. Issue detected by checkpatch tool Signed-off-by: Jules Irenge <jbi.octave@gmail.com> Link: https://lore.kernel.org/r/20191017163126.23992-1-jbi.octave@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-24staging: vc04_services: fix check warnings of line over 80 charactersJules Irenge
Fix warnings of line over 80 characters. Issue detected by checkepatch tool. Signed-off-by: Jules Irenge <jbi.octave@gmail.com> Link: https://lore.kernel.org/r/20191017150044.17746-1-jbi.octave@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-24Staging: Netlogic: Fix spelling mistakeEvan Chime
Change "standred" on line 3 to "standard" Signed-off-by: Evan Chime <chime.evan.dri.devel@gmail.com> Link: https://lore.kernel.org/r/20191018175759.GA8294@ik-ubuntu Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-24Staging: Netlogic: Fix grammatical errorEvan Chime
Change "in to" in "Changing comments in to linux standred format" on line 3 to "into" Signed-off-by: Evan Chime <chime.evan.dri.devel@gmail.com> Link: https://lore.kernel.org/r/20191018175725.GA8274@ik-ubuntu Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-24staging: uwb: fix coccinelle warnings of comparison to boolJules Irenge
Fix warnings of comparision to bool. Issue detected by coccinelle tool. Signed-off-by: Jules Irenge <jbi.octave@gmail.com> Acked-by: Julia Lawall <julia.lawall@lip6.fr> Link: https://lore.kernel.org/r/20191022185328.9387-1-jbi.octave@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-24staging: most: Change bool init to true/falseJamal Shareef
Bool initializations should use true and false. Bool tests don't need comparisons. Based on contributions from Joe Perches, Rusty Russell and Bruce W Allan. The semantic patch that makes this report is available in scripts/coccinelle/misc/boolinit.cocci. More information about semantic patching is available at http://coccinelle.lip6.fr/ Signed-off-by: Jamal Shareef <jamal.k.shareef@gmail.com> Link: https://lore.kernel.org/r/20191024223937.2800-1-jamal.k.shareef@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-24staging: comedi: remove unused variable 'route_table_size'YueHaibing
drivers/staging/comedi/drivers/ni_routes.c:52:21: warning: route_table_size defined but not used [-Wunused-const-variable=] It is never used since introduction. Signed-off-by: YueHaibing <yuehaibing@huawei.com> Reviewed-by: Ian Abbott <abbotti@mev.co.uk> Link: https://lore.kernel.org/r/20191023075206.33088-1-yuehaibing@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-24staging: exfat: Clean up return code - FFS_MEMORYERRValdis Kletnieks
Convert FFS_MEMORYERR to -ENOMEM Signed-off-by: Valdis Kletnieks <Valdis.Kletnieks@vt.edu> Link: https://lore.kernel.org/r/20191024155327.1095907-9-Valdis.Kletnieks@vt.edu Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-24staging: exfat: Clean up return codes - FFS_INVALIDPATHValdis Kletnieks
Convert FFS_INVALIDPATH to -EINVAL Signed-off-by: Valdis Kletnieks <Valdis.Kletnieks@vt.edu> Link: https://lore.kernel.org/r/20191024155327.1095907-8-Valdis.Kletnieks@vt.edu Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-24staging: exfat: Clean up return codes - FFS_FILEEXISTValdis Kletnieks
Convert FFS_FILEEXIST to -EEXIST Signed-off-by: Valdis Kletnieks <Valdis.Kletnieks@vt.edu> Link: https://lore.kernel.org/r/20191024155327.1095907-7-Valdis.Kletnieks@vt.edu Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-24staging: exfat: Clean up return codes - FFS_NAMETOOLONGValdis Kletnieks
Convert FFS_NOTNAMETOOLONG to -ENAMETOOLONG Signed-off-by: Valdis Kletnieks <Valdis.Kletnieks@vt.edu> Link: https://lore.kernel.org/r/20191024155327.1095907-6-Valdis.Kletnieks@vt.edu Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-24staging: exfat: Clean up return codes - FFS_PERMISSIONERRValdis Kletnieks
Convert FFS_PERMISSIONERR to -EPERM Signed-off-by: Valdis Kletnieks <Valdis.Kletnieks@vt.edu> Link: https://lore.kernel.org/r/20191024155327.1095907-5-Valdis.Kletnieks@vt.edu Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-24staging: exfat: Clean up return codes - FFS_DIRBUSYValdis Kletnieks
Convert FFS_DIRBUSY to -EBUSY Signed-off-by: Valdis Kletnieks <Valdis.Kletnieks@vt.edu> Link: https://lore.kernel.org/r/20191024155327.1095907-4-Valdis.Kletnieks@vt.edu Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-24staging: exfat: Clean up return codes - FFS_NOTFOUNDValdis Kletnieks
Convert FFS_NOTFOUND to -ENOENT Signed-off-by: Valdis Kletnieks <Valdis.Kletnieks@vt.edu> Link: https://lore.kernel.org/r/20191024155327.1095907-3-Valdis.Kletnieks@vt.edu Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-24staging: exfat: Clean up return codes - FFS_FULLValdis Kletnieks
Start cleaning up the odd scheme of return codes, starting with FFS_FULL Signed-off-by: Valdis Kletnieks <Valdis.Kletnieks@vt.edu> Link: https://lore.kernel.org/r/20191024155327.1095907-2-Valdis.Kletnieks@vt.edu Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-24staging: rtl8723bs: reduce stack usage of cfg80211_rtw_scanSudip Mukherjee
The build of xtensa allmodconfig gives warning of: In function 'cfg80211_rtw_scan': warning: the frame size of 1040 bytes is larger than 1024 bytes Allocate memory for ssid dynamically to reduce the stack usage, as an added benifit we can remove the memset by using kzalloc while allocating memory. Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com> Link: https://lore.kernel.org/r/20191018101854.31876-1-sudipm.mukherjee@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-24staging: rtl8723bs: reduce stack usage of rtw_cfg80211_unlink_bssSudip Mukherjee
The build of xtensa allmodconfig gives warning of: In function 'rtw_cfg80211_unlink_bss': warning: the frame size of 1136 bytes is larger than 1024 bytes Instead of having 'select_network' structure as a variable use it as a pointer. Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com> Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com> Link: https://lore.kernel.org/r/20191018104837.23246-1-sudipm.mukherjee@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-24staging: rtl8723bs: removed unwanted if..else conditionAliasgar Surti
There is use of if..elseif..else condition which has same logic in all three blocks. Removed if..else block and placed log message instead that. Signed-off-by: Aliasgar Surti <aliasgar.surti500@gmail.com> Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com> Link: https://lore.kernel.org/r/1571321906-15074-1-git-send-email-aliasgar.surti500@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-24staging: rtl8188eu: make efuse_power_switch() function staticAlexandru Ardelean
The `rtl8188eu` driver is built as a kmod in order to avoid symbol conflicts (at link-time) with other Realtek drivers. Internally, we use this driver as builtin [vs kmod], and we've identified the `efuse_power_switch()` symbol to be conflicting at link-time with the one from the `rtlwifi` driver. An alternative solution would have been to rename the function, but it doesn't look like it's being used outside of this driver, so just make it static. Signed-off-by: Alexandru Ardelean <alexandru.ardelean@analog.com> Link: https://lore.kernel.org/r/20191016065834.12186-1-alexandru.ardelean@analog.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-24staging: mt7621-dma: use devm_platform_ioremap_resource() to simplify codeYueHaibing
Use devm_platform_ioremap_resource() to simplify the code a bit. This is detected by coccinelle. Signed-off-by: YueHaibing <yuehaibing@huawei.com> Link: https://lore.kernel.org/r/20191016085833.26376-1-yuehaibing@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-24staging: netlogic: use devm_platform_ioremap_resource() to simplify codeYueHaibing
Use devm_platform_ioremap_resource() to simplify the code a bit. This is detected by coccinelle. Signed-off-by: YueHaibing <yuehaibing@huawei.com> Link: https://lore.kernel.org/r/20191016090136.20620-1-yuehaibing@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-24staging: ralink-gdma: use devm_platform_ioremap_resource() to simplify codeYueHaibing
Use devm_platform_ioremap_resource() to simplify the code a bit. This is detected by coccinelle. Signed-off-by: YueHaibing <yuehaibing@huawei.com> Link: https://lore.kernel.org/r/20191016090305.23392-1-yuehaibing@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-24cifs: Fix cifsInodeInfo lock_sem deadlock when reconnect occursDave Wysochanski
There's a deadlock that is possible and can easily be seen with a test where multiple readers open/read/close of the same file and a disruption occurs causing reconnect. The deadlock is due a reader thread inside cifs_strict_readv calling down_read and obtaining lock_sem, and then after reconnect inside cifs_reopen_file calling down_read a second time. If in between the two down_read calls, a down_write comes from another process, deadlock occurs. CPU0 CPU1 ---- ---- cifs_strict_readv() down_read(&cifsi->lock_sem); _cifsFileInfo_put OR cifs_new_fileinfo down_write(&cifsi->lock_sem); cifs_reopen_file() down_read(&cifsi->lock_sem); Fix the above by changing all down_write(lock_sem) calls to down_write_trylock(lock_sem)/msleep() loop, which in turn makes the second down_read call benign since it will never block behind the writer while holding lock_sem. Signed-off-by: Dave Wysochanski <dwysocha@redhat.com> Suggested-by: Ronnie Sahlberg <lsahlber@redhat.com> Reviewed--by: Ronnie Sahlberg <lsahlber@redhat.com> Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com>
2019-10-24CIFS: Fix use after free of file info structuresPavel Shilovsky
Currently the code assumes that if a file info entry belongs to lists of open file handles of an inode and a tcon then it has non-zero reference. The recent changes broke that assumption when putting the last reference of the file info. There may be a situation when a file is being deleted but nothing prevents another thread to reference it again and start using it. This happens because we do not hold the inode list lock while checking the number of references of the file info structure. Fix this by doing the proper locking when doing the check. Fixes: 487317c99477d ("cifs: add spinlock for the openFileList to cifsInodeInfo") Fixes: cb248819d209d ("cifs: use cifsInodeInfo->open_file_lock while iterating to avoid a panic") Cc: Stable <stable@vger.kernel.org> Reviewed-by: Ronnie Sahlberg <lsahlber@redhat.com> Signed-off-by: Pavel Shilovsky <pshilov@microsoft.com> Signed-off-by: Steve French <stfrench@microsoft.com>
2019-10-24CIFS: Fix retry mid list corruption on reconnectsPavel Shilovsky
When the client hits reconnect it iterates over the mid pending queue marking entries for retry and moving them to a temporary list to issue callbacks later without holding GlobalMid_Lock. In the same time there is no guarantee that mids can't be removed from the temporary list or even freed completely by another thread. It may cause a temporary list corruption: [ 430.454897] list_del corruption. prev->next should be ffff98d3a8f316c0, but was 2e885cb266355469 [ 430.464668] ------------[ cut here ]------------ [ 430.466569] kernel BUG at lib/list_debug.c:51! [ 430.468476] invalid opcode: 0000 [#1] SMP PTI [ 430.470286] CPU: 0 PID: 13267 Comm: cifsd Kdump: loaded Not tainted 5.4.0-rc3+ #19 [ 430.473472] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 430.475872] RIP: 0010:__list_del_entry_valid.cold+0x31/0x55 ... [ 430.510426] Call Trace: [ 430.511500] cifs_reconnect+0x25e/0x610 [cifs] [ 430.513350] cifs_readv_from_socket+0x220/0x250 [cifs] [ 430.515464] cifs_read_from_socket+0x4a/0x70 [cifs] [ 430.517452] ? try_to_wake_up+0x212/0x650 [ 430.519122] ? cifs_small_buf_get+0x16/0x30 [cifs] [ 430.521086] ? allocate_buffers+0x66/0x120 [cifs] [ 430.523019] cifs_demultiplex_thread+0xdc/0xc30 [cifs] [ 430.525116] kthread+0xfb/0x130 [ 430.526421] ? cifs_handle_standard+0x190/0x190 [cifs] [ 430.528514] ? kthread_park+0x90/0x90 [ 430.530019] ret_from_fork+0x35/0x40 Fix this by obtaining extra references for mids being retried and marking them as MID_DELETED which indicates that such a mid has been dequeued from the pending list. Also move mid cleanup logic from DeleteMidQEntry to _cifs_mid_q_entry_release which is called when the last reference to a particular mid is put. This allows to avoid any use-after-free of response buffers. The patch needs to be backported to stable kernels. A stable tag is not mentioned below because the patch doesn't apply cleanly to any actively maintained stable kernel. Reviewed-by: Ronnie Sahlberg <lsahlber@redhat.com> Reviewed-and-tested-by: David Wysochanski <dwysocha@redhat.com> Signed-off-by: Pavel Shilovsky <pshilov@microsoft.com> Signed-off-by: Steve French <stfrench@microsoft.com>
2019-10-24Merge tag 'devicetree-fixes-for-5.4-2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull Devicetree fixes from Rob Herring: "A couple more DT fixes for 5.4: fix a ref count, memory leak, and Risc-V cpu schema warnings" * tag 'devicetree-fixes-for-5.4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: of: reserved_mem: add missing of_node_put() for proper ref-counting of: unittest: fix memory leak in unittest_data_add dt-bindings: riscv: Fix CPU schema errors
2019-10-24Merge tag 'acpi-5.4-rc5' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fix from Rafael Wysocki: "Fix locking issue in the error code path of a function that belongs to the sysfs interface exposed by the ACPI NFIT handling code (Dan Carpenter)" * tag 'acpi-5.4-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: NFIT: Fix unlock on error in scrub_show()
generated by cgit v1.2.3 (git 2.39.1) at 2025-07-28 22:47:02 +0000