Commit Graph

8 Commits

Author SHA1 Message Date
4b6d521246 Merge tag 'v4.19.325-cip128' of https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip into android13-4.19-kona
version 4.19.325-cip128

* tag 'v4.19.325-cip128' of https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip:
  CIP: Bump version suffix to -cip128 after merge from cip/linux-4.19.y-st tree
  Update localversion-st, tree is up-to-date with 5.10.248.
  NFSv4: ensure the open stateid seqid doesn't go backwards
  libceph: make calc_target() set t->paused, not just clear it
  crypto: af_alg - zero initialize memory allocated via sock_kmalloc
  jbd2: fix the inconsistency between checksum and data in memory for journal sb
  f2fs: fix to detect recoverable inode during dryrun of find_fsync_dnodes()
  NFS: add barriers when testing for NFS_FSDATA_BLOCKED
  NFS: unlink/rmdir shouldn't call d_delete() twice on ENOENT
  efi/cper: Fix cper_bits_to_str buffer handling and return value
  iommu/omap: fix device leaks on probe_device()
  crypto: seqiv - Do not use req->iv after crypto_aead_encrypt
  f2fs: fix return value of f2fs_recover_fsync_data()
  ext4: improve integrity checking in __mb_check_buddy by enhancing order-0 validation
  ext4: remove unused return value of __mb_check_buddy
  clk: renesas: r9a06g032: Fix memory leak in error path
  nbd: defer config put in recv_work
  jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted
  scsi: sg: Fix occasional bogus elapsed time that exceeds timeout
  powercap: fix sscanf() error return value handling
  powercap: fix race condition in register_control_type()
  arp: do not assume dev_hard_header() does not change skb->head
  net: usb: pegasus: fix memory leak in update_eth_regs_async()
  HID: quirks: work around VID/PID conflict for appledisplay
  netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates
  net: sock: fix hardened usercopy panic in sock_recv_errqueue
  inet: ping: Fix icmp out counting
  netfilter: nf_conncount: update last_gc only when GC has been performed
  ARM: dts: imx6q-ba16: fix RTC interrupt level
  scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset
  alpha: don't reference obsolete termio struct for TC* constants
  ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels
  ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all()
  ext4: introduce ITAIL helper
  libceph: make free_choose_arg_map() resilient to partial allocation
  libceph: replace overzealous BUG_ON in osdmap_apply_incremental()
  wifi: avoid kernel-infoleak from struct iw_point
  drm/pl111: Fix error handling in pl111_amba_probe
  net: 3com: 3c59x: fix possible null dereference in vortex_probe1()
  atm: Fix dma_free_coherent() size
  Revert "iommu/amd: Skip enabling command/event buffers for kdump"
  pwm: stm32: Always program polarity
  bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()
  scsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress
  scsi: iscsi: Move pool freeing
  wifi: mac80211: Discard Beacon frames to non-broadcast address
  media: samsung: exynos4-is: fix potential ABBA deadlock on init
  media: vpif_capture: fix section mismatch
  media: renesas: rcar_drif: fix device node reference leak in rcar_drif_bond_enabled
  SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf
  NFSD: Clear SECLABEL in the suppattr_exclcreat bitmap
  usb: ohci-nxp: fix device leak on probe failure
  usb: ohci-nxp: Use helper function devm_clk_get_enabled()
  f2fs: fix to avoid updating zero-sized extent in extent cache
  ext4: fix string copying in parse_apply_sb_mount_options()
  ALSA: wavefront: Fix integer overflow in sample size validation
  ALSA: wavefront: Clear substream pointers on close
  usb: gadget: udc: fix use-after-free in usb_gadget_state_work
  HID: core: Harden s32ton() against conversion to 0 bits
  ipv4: Fix uninit-value access in __ip_make_skb()
  ipv6: Fix potential uninit-value access in __ip6_make_skb()
  virtio_console: fix order of fields cols and rows
  drm/nouveau/dispnv50: Don't call drm_atomic_get_crtc_state() in prepare_fb
  net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write
  net: usb: sr9700: fix incorrect command used to write single register
  fjes: Add missing iounmap in fjes_hw_init()
  e1000: fix OOB in e1000_tbi_should_accept()
  RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly
  media: i2c: adv7842: Remove redundant cancel_delayed_work in probe
  media: i2c: ADV7604: Remove redundant cancel_delayed_work in probe
  media: TDA1997x: Remove redundant cancel_delayed_work in probe
  media: msp3400: Avoid possible out-of-bounds array accesses in msp3400c_thread()
  media: cec: Fix debugfs leak on bus_register() failure
  fbdev: tcx.c fix mem_map to correct smem_start offset
  fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing
  fbdev: gbefb: fix to use physical address instead of dma address
  media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status()
  parisc: entry: set W bit for !compat tasks in syscall_restore_rfi()
  parisc: entry.S: fix space adjustment on interruption for 64-bit userspace
  media: rc: st_rc: Fix reset control resource leak
  PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths
  iommu/exynos: fix device leak on of_xlate()
  ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer alignment.
  ASoC: qcom: q6adm: the the copp device only during last instance
  ASoC: qcom: q6asm-dai: perform correct state check before closing
  selftests/ftrace: traceonoff_triggers: strip off names
  RDMA/bnxt_re: fix dma_free_coherent() pointer
  net: rose: fix invalid array index in rose_kill_by_device()
  ipv4: Fix reference count leak when using error routes with nexthop objects
  ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr()
  net: bridge: Describe @tunnel_hash member in net_bridge_vlan_group struct
  net: dsa: b53: skip multicast entries for fdb_dump()
  firewire: nosy: Fix dma_free_coherent() size
  firewire: nosy: switch from 'pci_' to 'dma_' API
  genalloc.h: fix htmldocs warning
  net: usb: rtl8150: fix memory leak on usb_submit_urb() failure
  team: fix check for port enabled in team_queue_override_port_prio_changed()
  platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic
  platform/x86: msi-laptop: add missing sysfs_remove_group()
  ip6_gre: make ip6gre_header() robust
  i40e: fix scheduling in set_rx_mode
  hwmon: (w83l786ng) Convert macros to functions to avoid TOCTOU
  hwmon: (w83791d) Convert macros to functions to avoid TOCTOU
  rpmsg: glink: fix rpmsg device leak
  amba: tegra-ahb: Fix device leak on SMMU enable
  nfsd: Mark variable __maybe_unused to avoid W=1 build break
  PM: runtime: Do not clear needs_force_resume with enabled runtime PM
  tracing: Do not register unsupported perf events
  KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer
  KVM: x86: Explicitly set new periodic hrtimer expiration in apic_timer_fn()
  KVM: x86: WARN if hrtimer callback for periodic APIC timer fires with period=0
  libceph: make decode_pool() more resilient against corrupted osdmaps
  parisc: Do not reprogram affinitiy on ASP chip
  ocfs2: fix kernel BUG in ocfs2_find_victim_chain
  tools/testing/nvdimm: Use per-DIMM device handle
  f2fs: invalidate dentry cache on failed whiteout creation
  scsi: target: Reset t_task_cdb pointer in error case
  NFSD: use correct reservation type in nfsd4_scsi_fence_client
  scsi: aic94xx: fix use-after-free in device removal path
  cpufreq: nforce2: fix reference count leak in nforce2
  char: applicom: fix NULL pointer dereference in ac_ioctl
  usb: renesas_usbhs: Fix a resource leak in usbhs_pipe_malloc()
  media: pvrusb2: Fix incorrect variable used in trace message
  media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg()
  usb: usb-storage: Maintain minimal modifications to the bcdDevice range.
  media: v4l2-mem2mem: Fix outdated documentation
  jbd2: use a weaker annotation in journal handling
  ext4: fix incorrect group number assertion in mb_check_buddy
  ext4: xattr: fix null pointer deref in ext4_raw_inode()
  ktest.pl: Fix uninitialized var in config-bisect.pl
  floppy: fix for PAGE_SIZE != 4KB
  usb: usb-storage: No additional quirks need to be added to the EL-R12 optical drive.
  usb: xhci: limit run_graceperiod for only usb 3.0 devices
  usb: typec: ucsi: Handle incorrect num_connectors capability
  via_wdt: fix critical boot hang due to unnamed resource allocation
  scsi: qla2xxx: Use reinit_completion on mbx_intr_comp
  powerpc/addnote: Fix overflow on 32-bit builds
  clk: mvebu: cp110 add CLK_IGNORE_UNUSED to pcie_x10, pcie_x11 & pcie_x4
  ipmi: Fix __scan_channels() failing to rescan channels
  ipmi: Fix the race between __scan_channels() and deliver_response()
  ALSA: usb-mixer: us16x08: validate meter packet indices
  ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path
  ALSA: vxpocket: Fix resource leak in vxpocket_probe error path
  spi: fsl-cpm: Check length parity before switching to 16 bit mode
  Input: ti_am335x_tsc - fix off-by-one error in wire_order validation
  MIPS: Fix a reference leak bug in ip22_check_gio()
  hwmon: (ibmpex) fix use-after-free in high/low store
  net/mlx5: fw_tracer, Handle escaped percent properly
  net/mlx5: fw_tracer, Validate format string parameters
  net/mlx5: fw_tracer, Add support for unrecognized string
  nfc: pn533: Fix error code in pn533_acr122_poweron_rdr()
  caif: fix integer underflow in cffrml_receive()
  ipvs: fix ipv4 null-ptr-deref in route error path
  netfilter: nf_conncount: fix leaked ct in error paths
  broadcom: b44: prevent uninitialized value usage
  net: openvswitch: fix middle attribute validation in push_nsh() action
  mlxsw: spectrum_router: Fix neighbour use-after-free
  ipvlan: Ignore PACKET_LOOPBACK in handle_mode_l2()
  netrom: Fix memory leak in nr_sendmsg()
  btrfs: scrub: always update btrfs_scrub_progress::last_physical
  hfsplus: fix volume corruption issue for generic/073
  hfsplus: Verify inode mode when loading from disk
  hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create
  hfsplus: fix volume corruption issue for generic/070
  cpufreq: s5pv210: fix refcount leak
  ACPI: property: Use ACPI functions in acpi_graph_get_next_endpoint() only
  ACPICA: Avoid walking the Namespace if start_node is NULL
  netfilter: nft_connlimit: memleak if nf_ct_netns_get() fails
  netfilter: nf_conncount: garbage collection is not skipped when jiffies wrap around
  NFS: Fix missing unlock in nfs_unlink()
  ALSA: dice: fix buffer overflow in detect_stream_formats()
  usb: phy: Initialize struct usb_phy list_head
  ocfs2: fix memory leak in ocfs2_merge_rec_left()
  efi/cper: Adjust infopfx size to accept an extra space
  efi/cper: Add a new helper function to print bitmasks
  dm log-writes: Add missing set_freezable() for freezable kthread
  dm-raid: fix possible NULL dereference with undefined raid type
  ARM: 9464/1: fix input-only operand modification in load_unaligned_zeropad()
  ALSA: uapi: Fix typo in asound.h comment
  fs/nls: Fix inconsistency between utf8_to_utf32() and utf32_to_utf8()
  NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid
  fs/nls: Fix utf16 to utf8 conversion
  NFS: don't unhash dentry during unlink/rename
  NFS: Label the dentry with a verifier in nfs_rmdir() and nfs_unlink()
  fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe()
  pinctrl: single: Fix incorrect type for error return variable
  pinctrl: single: Fix PIN_CONFIG_BIAS_DISABLE handling
  perf tools: Fix split kallsyms DSO counting
  net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop
  mtd: lpddr_cmds: fix signed shifts in lpddr_cmds
  netfilter: nft_connlimit: update the count if add was skipped
  netfilter: nf_conncount: rework API to use sk_buff directly
  netfilter: nf_conncount: reduce unnecessary GC
  netfilter: nft_connlimit: move stateful fields out of expression data
  regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex
  virtio: fix virtqueue_set_affinity() docs
  ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4
  backlight: lp855x: Fix lp855x.h kernel-doc warnings
  staging: fbtft: core: fix potential memory leak in fbtft_probe_common()
  usb: dwc2: fix hang during shutdown if set as peripheral
  usb: dwc2: disable platform lowlevel hw resources during shutdown
  usb: chaoskey: fix locking for O_NONBLOCK
  wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb()
  powerpc/64s/ptdump: Fix kernel_hash_pagetable dump for ISA v3.00 HPTE format
  NFSD/blocklayout: Fix minlength check in proc_layoutget
  scsi: sim710: Fix resource leak by adding missing ioport_unmap() calls
  ACPI: property: Fix fwnode refcount leak in acpi_fwnode_graph_parse_endpoint()
  ocfs2: relax BUG() to ocfs2_error() in __ocfs2_move_extent()
  nbd: defer config unlock in nbd_genl_connect
  wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper()
  macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse
  scsi: stex: Fix reboot_notifier leak in probe error path
  perf/x86/intel: Correct large PEBS flag check
  ext4: correct the checking of quota files before moving extents
  ext4: minor defrag code improvements
  mfd: da9055: Fix missing regmap_del_irq_chip() in error path
  scsi: target: Do not write NUL characters into ASCII configfs output
  power: supply: apm_power: only unset own apm_get_power_status
  power: supply: wm831x: Check wm831x_set_bits() return value
  kmsan: introduce __no_sanitize_memory and __no_kmsan_checks
  compiler-gcc.h: Define __SANITIZE_ADDRESS__ under hwaddress sanitizer
  s390/smp: Fix fallback CPU detection
  crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id
  inet: Avoid ehash lookup race in inet_ehash_insert()
  rculist: Add hlist_nulls_replace_rcu() and hlist_nulls_replace_init_rcu()
  irqchip/qcom-irq-combiner: Fix section mismatch
  USB: Fix descriptor count when handling invalid MBIM extended descriptor
  drm/vgem-fence: Fix potential deadlock on release
  smack: fix bug: unprivileged task can create labels
  staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing
  comedi: multiq3: sanitize config options in multiq3_attach()
  comedi: c6xdigio: Fix invalid PNP driver unregistration
  platform/x86: acer-wmi: Ignore backlight event
  bfs: Reconstruct file type when loading from disk
  spi: imx: keep dma request disabled before dma transfer setup
  spi: xilinx: increase number of retries before declaring stall
  USB: serial: kobil_sct: fix TIOCMBIS and TIOCMBIC
  USB: serial: belkin_sa: fix TIOCMBIS and TIOCMBIC
  serial: add support of CPCI cards
  USB: serial: ftdi_sio: match on interface number for jtag
  USB: serial: option: move Telit 0x10c7 composition in the right place
  USB: serial: option: add Telit Cinterion FE910C04 new compositions
  USB: serial: option: add Foxconn T99W760
  ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock()
  locking/spinlock/debug: Fix data-race in do_raw_write_lock
  ext4: refresh inline data size before write operations
  xfrm: flush all states in xfrm_state_fini
  xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added
  Revert "xfrm: destroy xfrm_state synchronously on net exit path"
  xfrm: delete x->tunnel as we delete x

 Conflicts:
	drivers/rpmsg/qcom_glink_native.c
	drivers/usb/host/xhci-hub.c
	fs/f2fs/file.c
	fs/f2fs/super.c

Change-Id: I9e00c074af0214588acc89a73fcfc928d1724b7a
2026-02-06 18:23:19 +02:00
431773cf42 locking/spinlock/debug: Fix data-race in do_raw_write_lock
commit c14ecb555c3ee80eeb030a4e46d00e679537f03a upstream.

KCSAN reports:

BUG: KCSAN: data-race in do_raw_write_lock / do_raw_write_lock

write (marked) to 0xffff800009cf504c of 4 bytes by task 1102 on cpu 1:
 do_raw_write_lock+0x120/0x204
 _raw_write_lock_irq
 do_exit
 call_usermodehelper_exec_async
 ret_from_fork

read to 0xffff800009cf504c of 4 bytes by task 1103 on cpu 0:
 do_raw_write_lock+0x88/0x204
 _raw_write_lock_irq
 do_exit
 call_usermodehelper_exec_async
 ret_from_fork

value changed: 0xffffffff -> 0x00000001

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 1103 Comm: kworker/u4:1 6.1.111

Commit 1a365e822372 ("locking/spinlock/debug: Fix various data races") has
adressed most of these races, but seems to be not consistent/not complete.

>From do_raw_write_lock() only debug_write_lock_after() part has been
converted to WRITE_ONCE(), but not debug_write_lock_before() part.
Do it now.

Fixes: 1a365e822372 ("locking/spinlock/debug: Fix various data races")
Reported-by: Adrian Freihofer <adrian.freihofer@siemens.com>
Signed-off-by: Alexander Sverdlin <alexander.sverdlin@siemens.com>
Signed-off-by: Boqun Feng <boqun.feng@gmail.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Paul E. McKenney <paulmck@kernel.org>
Acked-by: Waiman Long <longman@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ulrich Hecht <uli@kernel.org>
2026-01-26 16:51:54 +08:00
9459964334 Merge android-4.19-q.95 (138a4a6) into msm-4.19
* refs/heads/tmp-138a4a6:
  Linux 4.19.95
  usb: missing parentheses in USE_NEW_SCHEME
  USB: serial: option: add Telit ME910G1 0x110a composition
  USB: core: fix check for duplicate endpoints
  usb: dwc3: gadget: Fix request complete check
  net: sch_prio: When ungrafting, replace with FIFO
  mlxsw: spectrum_qdisc: Ignore grafting of invisible FIFO
  vlan: vlan_changelink() should propagate errors
  vlan: fix memory leak in vlan_dev_set_egress_priority
  vxlan: fix tos value before xmit
  tcp: fix "old stuff" D-SACK causing SACK to be treated as D-SACK
  sctp: free cmd->obj.chunk for the unprocessed SCTP_CMD_REPLY
  sch_cake: avoid possible divide by zero in cake_enqueue()
  pkt_sched: fq: do not accept silly TCA_FQ_QUANTUM
  net: usb: lan78xx: fix possible skb leak
  net: stmmac: dwmac-sunxi: Allow all RGMII modes
  net: stmmac: dwmac-sun8i: Allow all RGMII modes
  net: dsa: mv88e6xxx: Preserve priority when setting CPU port.
  macvlan: do not assume mac_header is set in macvlan_broadcast()
  gtp: fix bad unlock balance in gtp_encap_enable_socket
  PCI/switchtec: Read all 64 bits of part_event_bitmap
  ARM: dts: imx6ul: use nvmem-cells for cpu speed grading
  cpufreq: imx6q: read OCOTP through nvmem for imx6ul/imx6ull
  powerpc/spinlocks: Include correct header for static key
  powerpc/vcpu: Assume dedicated processors as non-preempt
  hv_netvsc: Fix unwanted rx_table reset
  llc2: Fix return statement of llc_stat_ev_rx_null_dsap_xid_c (and _test_c)
  parisc: Fix compiler warnings in debug_core.c
  block: fix memleak when __blk_rq_map_user_iov() is failed
  s390/dasd: fix memleak in path handling error case
  s390/dasd/cio: Interpret ccw_device_get_mdc return value correctly
  drm/exynos: gsc: add missed component_del
  s390/purgatory: do not build purgatory with kcov, kasan and friends
  net: stmmac: Always arm TX Timer at end of transmission start
  net: stmmac: RX buffer size must be 16 byte aligned
  net: stmmac: xgmac: Clear previous RX buffer size
  net: stmmac: Do not accept invalid MTU values
  fs: avoid softlockups in s_inodes iterators
  perf/x86/intel: Fix PT PMI handling
  kconfig: don't crash on NULL expressions in expr_eq()
  iommu/iova: Init the struct iova to fix the possible memleak
  regulator: rn5t618: fix module aliases
  ASoC: wm8962: fix lambda value
  rfkill: Fix incorrect check to avoid NULL pointer dereference
  parisc: add missing __init annotation
  net: usb: lan78xx: Fix error message format specifier
  cxgb4: Fix kernel panic while accessing sge_info
  bnx2x: Fix logic to get total no. of PFs per engine
  bnx2x: Do not handle requests from VFs after parity
  bpf: Clear skb->tstamp in bpf_redirect when necessary
  btrfs: Fix error messages in qgroup_rescan_init
  powerpc: Ensure that swiotlb buffer is allocated from low memory
  samples: bpf: fix syscall_tp due to unused syscall
  samples: bpf: Replace symbol compare of trace_event
  ARM: dts: am437x-gp/epos-evm: fix panel compatible
  spi: spi-ti-qspi: Fix a bug when accessing non default CS
  bpf, mips: Limit to 33 tail calls
  bnxt_en: Return error if FW returns more data than dump length
  ARM: dts: bcm283x: Fix critical trip point
  ASoC: topology: Check return value for soc_tplg_pcm_create()
  spi: spi-cavium-thunderx: Add missing pci_release_regions()
  ARM: dts: Cygnus: Fix MDIO node address/size cells
  selftests/ftrace: Fix multiple kprobe testcase
  ARM: dts: BCM5301X: Fix MDIO node address/size cells
  netfilter: nf_tables: validate NFT_DATA_VALUE after nft_data_init()
  netfilter: nf_tables: validate NFT_SET_ELEM_INTERVAL_END
  netfilter: nft_set_rbtree: bogus lookup/get on consecutive elements in named sets
  netfilter: uapi: Avoid undefined left-shift in xt_sctp.h
  ARM: vexpress: Set-up shared OPP table instead of individual for each CPU
  ARM: dts: imx6ul: imx6ul-14x14-evk.dtsi: Fix SPI NOR probing
  efi/gop: Fix memory leak in __gop_query32/64()
  efi/gop: Return EFI_SUCCESS if a usable GOP was found
  efi/gop: Return EFI_NOT_FOUND if there are no usable GOPs
  ASoC: Intel: bytcr_rt5640: Update quirk for Teclast X89
  x86/efi: Update e820 with reserved EFI boot services data to fix kexec breakage
  libtraceevent: Fix lib installation with O=
  mwifiex: Fix heap overflow in mmwifiex_process_tdls_action_frame()
  netfilter: ctnetlink: netns exit must wait for callbacks
  locking/spinlock/debug: Fix various data races
  ASoC: max98090: fix possible race conditions
  regulator: fix use after free issue
  bpf: Fix passing modified ctx to ld/abs/ind instruction
  USB: dummy-hcd: increase max number of devices to 32
  USB: dummy-hcd: use usb_urb_dir_in instead of usb_pipein

Conflicts:
	kernel/locking/spinlock_debug.c

1683149 ("usb: dwc3: gadget: Fix logical condition") was reverted
on importing android-4.19-q.90 into msm-4.19 as this change
prevented the adbd userspace daemon from ever receiving packets
from the kernel USB driver. android-4.19-q.95 introduced new
change ceaeb21b ("usb: dwc3: gadget: Fix request complete check")
that fixed the regression, hence it is safe to restore the revert.
It is done in this merge.

Change-Id: I5f839319ad7746728a98c01f8b5c3dab9c9f368a
Signed-off-by: Ivaylo Georgiev <irgeorgiev@codeaurora.org>
2020-02-03 21:43:57 -08:00
c7673f0160 locking/spinlock/debug: Fix various data races
[ Upstream commit 1a365e822372ba24c9da0822bc583894f6f3d821 ]

This fixes various data races in spinlock_debug. By testing with KCSAN,
it is observable that the console gets spammed with data races reports,
suggesting these are extremely frequent.

Example data race report:

  read to 0xffff8ab24f403c48 of 4 bytes by task 221 on cpu 2:
   debug_spin_lock_before kernel/locking/spinlock_debug.c:85 [inline]
   do_raw_spin_lock+0x9b/0x210 kernel/locking/spinlock_debug.c:112
   __raw_spin_lock include/linux/spinlock_api_smp.h:143 [inline]
   _raw_spin_lock+0x39/0x40 kernel/locking/spinlock.c:151
   spin_lock include/linux/spinlock.h:338 [inline]
   get_partial_node.isra.0.part.0+0x32/0x2f0 mm/slub.c:1873
   get_partial_node mm/slub.c:1870 [inline]
  <snip>

  write to 0xffff8ab24f403c48 of 4 bytes by task 167 on cpu 3:
   debug_spin_unlock kernel/locking/spinlock_debug.c:103 [inline]
   do_raw_spin_unlock+0xc9/0x1a0 kernel/locking/spinlock_debug.c:138
   __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:159 [inline]
   _raw_spin_unlock_irqrestore+0x2d/0x50 kernel/locking/spinlock.c:191
   spin_unlock_irqrestore include/linux/spinlock.h:393 [inline]
   free_debug_processing+0x1b3/0x210 mm/slub.c:1214
   __slab_free+0x292/0x400 mm/slub.c:2864
  <snip>

As a side-effect, with KCSAN, this eventually locks up the console, most
likely due to deadlock, e.g. .. -> printk lock -> spinlock_debug ->
KCSAN detects data race -> kcsan_print_report() -> printk lock ->
deadlock.

This fix will 1) avoid the data races, and 2) allow using lock debugging
together with KCSAN.

Reported-by: Qian Cai <cai@lca.pw>
Signed-off-by: Marco Elver <elver@google.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Paul E. McKenney <paulmck@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Will Deacon <will.deacon@arm.com>
Link: https://lkml.kernel.org/r/20191120155715.28089-1-elver@google.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-01-12 12:17:05 +01:00
4fa2ab20f5 lib: spinlock: Trigger a watchdog bite on spin_dump for rwlock
Currently dump_stack is printed once a spin_bug is detected for rwlock.
So provide an options to trigger a panic or watchdog bite for debugging
rwlock magic corruptions and lockups.

Change-Id: I20807e8eceb8b81635e58701d1f9f9bd36ab5877
Signed-off-by: Prasad Sodagudi <psodagud@codeaurora.org>
Signed-off-by: Venkata Narendra Kumar Gutta <vnkgutta@codeaurora.org>
2018-09-21 18:10:31 -07:00
e0965e6590 lib: spinlock: Cause a watchdog bite on spin_dump
Currently we cause a BUG_ON once a spin_bug is detected, but
that causes a whole lot of processing and the other CPUs would
have proceeded to perform other actions and the state of the
system is moved by the time we can analyze it.
Provide an option to trigger  a watchdog bite instead so that we
can get the traces as close to the issue as possible.

Change-Id:Ic8d692ebd02c6940a3b4e5798463744db20b0026
Signed-off-by: Rohit Vaswani <rvaswani@codeaurora.org>
Signed-off-by: Rishabh Bhatnagar <rishabhb@codeaurora.org>
2018-08-13 11:48:30 -07:00
bc88c10d7e locking/spinlock/debug: Remove spinlock lockup detection code
The current spinlock lockup detection code can sometimes produce false
positives because of the unfairness of the locking algorithm itself.

So the lockup detection code is now removed. Instead, we are relying
on the NMI watchdog to detect potential lockup. We won't have lockup
detection if the watchdog isn't running.

The commented-out read-write lock lockup detection code are also
removed.

Signed-off-by: Waiman Long <longman@redhat.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Sasha Levin <sasha.levin@oracle.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/1486583208-11038-1-git-send-email-longman@redhat.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2017-02-10 09:09:49 +01:00
60fc28746a locking: Move the spinlock code to kernel/locking/
Suggested-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Peter Zijlstra <peterz@infradead.org>
Link: http://lkml.kernel.org/n/tip-b81ol0z3mon45m51o131yc9j@git.kernel.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2013-11-06 07:55:21 +01:00