14 files changed, 177 insertions, 26 deletions

diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index 6088408ef26c..64155e310a9f 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -1642,6 +1642,7 @@ config DMA_API_DEBUG
 
 menuconfig RUNTIME_TESTING_MENU
         bool "Runtime Testing"
+        def_bool y
 
 if RUNTIME_TESTING_MENU
 
diff --git a/lib/btree.c b/lib/btree.c
index f93a945274af..590facba2c50 100644
--- a/lib/btree.c
+++ b/lib/btree.c
@@ -3,7 +3,7 @@
  *
  * As should be obvious for Linux kernel code, license is GPLv2
  *
- * Copyright (c) 2007-2008 Joern Engel <joern@logfs.org>
+ * Copyright (c) 2007-2008 Joern Engel <joern@purestorage.com>
  * Bits and pieces stolen from Peter Zijlstra's code, which is
  * Copyright 2007, Red Hat Inc. Peter Zijlstra
  * GPLv2
@@ -76,6 +76,8 @@ struct btree_geo btree_geo128 = {
 };
 EXPORT_SYMBOL_GPL(btree_geo128);
 
+#define MAX_KEYLEN      (2 * LONG_PER_U64)
+
 static struct kmem_cache *btree_cachep;
 
 void *btree_alloc(gfp_t gfp_mask, void *pool_data)
@@ -313,7 +315,7 @@ void *btree_get_prev(struct btree_head *head, struct btree_geo *geo,
 {
         int i, height;
         unsigned long *node, *oldnode;
-        unsigned long *retry_key = NULL, key[geo->keylen];
+        unsigned long *retry_key = NULL, key[MAX_KEYLEN];
 
         if (keyzero(geo, __key))
                 return NULL;
@@ -639,8 +641,8 @@ EXPORT_SYMBOL_GPL(btree_remove);
 int btree_merge(struct btree_head *target, struct btree_head *victim,
                 struct btree_geo *geo, gfp_t gfp)
 {
-        unsigned long key[geo->keylen];
-        unsigned long dup[geo->keylen];
+        unsigned long key[MAX_KEYLEN];
+        unsigned long dup[MAX_KEYLEN];
         void *val;
         int err;
 
diff --git a/lib/bug.c b/lib/bug.c
index c1b0fad31b10..1077366f496b 100644
--- a/lib/bug.c
+++ b/lib/bug.c
@@ -150,6 +150,8 @@ enum bug_trap_type report_bug(unsigned long bugaddr, struct pt_regs *regs)
                 return BUG_TRAP_TYPE_NONE;
 
         bug = find_bug(bugaddr);
+        if (!bug)
+                return BUG_TRAP_TYPE_NONE;
 
         file = NULL;
         line = 0;
@@ -191,7 +193,7 @@ enum bug_trap_type report_bug(unsigned long bugaddr, struct pt_regs *regs)
         if (file)
                 pr_crit("kernel BUG at %s:%u!\n", file, line);
         else
-                pr_crit("Kernel BUG at %p [verbose debug info unavailable]\n",
+                pr_crit("Kernel BUG at %pB [verbose debug info unavailable]\n",
                         (void *)bugaddr);
 
         return BUG_TRAP_TYPE_BUG;
diff --git a/lib/dma-debug.c b/lib/dma-debug.c
index 1b34d210452c..7f5cdc1e6b29 100644
--- a/lib/dma-debug.c
+++ b/lib/dma-debug.c
@@ -1491,12 +1491,12 @@ void debug_dma_alloc_coherent(struct device *dev, size_t size,
         if (unlikely(virt == NULL))
                 return;
 
-        entry = dma_entry_alloc();
-        if (!entry)
+        /* handle vmalloc and linear addresses */
+        if (!is_vmalloc_addr(virt) && !virt_addr_valid(virt))
                 return;
 
-        /* handle vmalloc and linear addresses */
-        if (!is_vmalloc_addr(virt) && !virt_to_page(virt))
+        entry = dma_entry_alloc();
+        if (!entry)
                 return;
 
         entry->type      = dma_debug_coherent;
@@ -1528,7 +1528,7 @@ void debug_dma_free_coherent(struct device *dev, size_t size,
         };
 
         /* handle vmalloc and linear addresses */
-        if (!is_vmalloc_addr(virt) && !virt_to_page(virt))
+        if (!is_vmalloc_addr(virt) && !virt_addr_valid(virt))
                 return;
 
         if (is_vmalloc_addr(virt))
diff --git a/lib/dma-direct.c b/lib/dma-direct.c
index 40b1f92f2214..c9e8e21cb334 100644
--- a/lib/dma-direct.c
+++ b/lib/dma-direct.c
@@ -84,6 +84,10 @@ again:
         return page_address(page);
 }
 
+/*
+ * NOTE: this function must never look at the dma_addr argument, because we want
+ * to be able to use it as a helper for iommu implementations as well.
+ */
 void dma_direct_free(struct device *dev, size_t size, void *cpu_addr,
                 dma_addr_t dma_addr, unsigned long attrs)
 {
@@ -152,5 +156,6 @@ const struct dma_map_ops dma_direct_ops = {
         .map_sg                 = dma_direct_map_sg,
         .dma_supported          = dma_direct_supported,
         .mapping_error          = dma_direct_mapping_error,
+        .is_phys                = 1,
 };
 EXPORT_SYMBOL(dma_direct_ops);
diff --git a/lib/idr.c b/lib/idr.c
index c98d77fcf393..823b813f08f8 100644
--- a/lib/idr.c
+++ b/lib/idr.c
@@ -36,8 +36,8 @@ int idr_alloc_u32(struct idr *idr, void *ptr, u32 *nextid,
 {
         struct radix_tree_iter iter;
         void __rcu **slot;
-        int base = idr->idr_base;
-        int id = *nextid;
+        unsigned int base = idr->idr_base;
+        unsigned int id = *nextid;
 
         if (WARN_ON_ONCE(radix_tree_is_internal_node(ptr)))
                 return -EINVAL;
@@ -204,10 +204,11 @@ int idr_for_each(const struct idr *idr,
 
         radix_tree_for_each_slot(slot, &idr->idr_rt, &iter, 0) {
                 int ret;
+                unsigned long id = iter.index + base;
 
-                if (WARN_ON_ONCE(iter.index > INT_MAX))
+                if (WARN_ON_ONCE(id > INT_MAX))
                         break;
-                ret = fn(iter.index + base, rcu_dereference_raw(*slot), data);
+                ret = fn(id, rcu_dereference_raw(*slot), data);
                 if (ret)
                         return ret;
         }
@@ -230,8 +231,8 @@ void *idr_get_next(struct idr *idr, int *nextid)
 {
         struct radix_tree_iter iter;
         void __rcu **slot;
-        int base = idr->idr_base;
-        int id = *nextid;
+        unsigned long base = idr->idr_base;
+        unsigned long id = *nextid;
 
         id = (id < base) ? 0 : id - base;
         slot = radix_tree_iter_find(&idr->idr_rt, &iter, id);
@@ -431,7 +432,6 @@ int ida_get_new_above(struct ida *ida, int start, int *id)
                         bitmap = this_cpu_xchg(ida_bitmap, NULL);
                         if (!bitmap)
                                 return -EAGAIN;
-                        memset(bitmap, 0, sizeof(*bitmap));
                         bitmap->bitmap[0] = tmp >> RADIX_TREE_EXCEPTIONAL_SHIFT;
                         rcu_assign_pointer(*slot, bitmap);
                 }
@@ -464,7 +464,6 @@ int ida_get_new_above(struct ida *ida, int start, int *id)
                         bitmap = this_cpu_xchg(ida_bitmap, NULL);
                         if (!bitmap)
                                 return -EAGAIN;
-                        memset(bitmap, 0, sizeof(*bitmap));
                         __set_bit(bit, bitmap->bitmap);
                         radix_tree_iter_replace(root, &iter, slot, bitmap);
                 }
diff --git a/lib/ioremap.c b/lib/ioremap.c
index b808a390e4c3..54e5bbaa3200 100644
--- a/lib/ioremap.c
+++ b/lib/ioremap.c
@@ -91,7 +91,8 @@ static inline int ioremap_pmd_range(pud_t *pud, unsigned long addr,
 
                 if (ioremap_pmd_enabled() &&
                     ((next - addr) == PMD_SIZE) &&
-                    IS_ALIGNED(phys_addr + addr, PMD_SIZE)) {
+                    IS_ALIGNED(phys_addr + addr, PMD_SIZE) &&
+                    pmd_free_pte_page(pmd)) {
                         if (pmd_set_huge(pmd, phys_addr + addr, prot))
                                 continue;
                 }
@@ -117,7 +118,8 @@ static inline int ioremap_pud_range(p4d_t *p4d, unsigned long addr,
 
                 if (ioremap_pud_enabled() &&
                     ((next - addr) == PUD_SIZE) &&
-                    IS_ALIGNED(phys_addr + addr, PUD_SIZE)) {
+                    IS_ALIGNED(phys_addr + addr, PUD_SIZE) &&
+                    pud_free_pmd_page(pud)) {
                         if (pud_set_huge(pud, phys_addr + addr, prot))
                                 continue;
                 }
diff --git a/lib/percpu-refcount.c b/lib/percpu-refcount.c
index 30e7dd88148b..9f96fa7bc000 100644
--- a/lib/percpu-refcount.c
+++ b/lib/percpu-refcount.c
@@ -322,6 +322,8 @@ EXPORT_SYMBOL_GPL(percpu_ref_switch_to_percpu);
  * This function normally doesn't block and can be called from any context
  * but it may block if @confirm_kill is specified and @ref is in the
  * process of switching to atomic mode by percpu_ref_switch_to_atomic().
+ *
+ * There are no implied RCU grace periods between kill and release.
  */
 void percpu_ref_kill_and_confirm(struct percpu_ref *ref,
                                  percpu_ref_func_t *confirm_kill)
diff --git a/lib/radix-tree.c b/lib/radix-tree.c
index 0a7ae3288a24..8e00138d593f 100644
--- a/lib/radix-tree.c
+++ b/lib/radix-tree.c
@@ -2125,7 +2125,7 @@ int ida_pre_get(struct ida *ida, gfp_t gfp)
                 preempt_enable();
 
         if (!this_cpu_read(ida_bitmap)) {
-                struct ida_bitmap *bitmap = kmalloc(sizeof(*bitmap), gfp);
+                struct ida_bitmap *bitmap = kzalloc(sizeof(*bitmap), gfp);
                 if (!bitmap)
                         return 0;
                 if (this_cpu_cmpxchg(ida_bitmap, NULL, bitmap))
diff --git a/lib/rhashtable.c b/lib/rhashtable.c
index 3825c30aaa36..47de025b6245 100644
--- a/lib/rhashtable.c
+++ b/lib/rhashtable.c
@@ -506,8 +506,10 @@ static void *rhashtable_lookup_one(struct rhashtable *ht,
                 if (!key ||
                     (ht->p.obj_cmpfn ?
                      ht->p.obj_cmpfn(&arg, rht_obj(ht, head)) :
-                     rhashtable_compare(&arg, rht_obj(ht, head))))
+                     rhashtable_compare(&arg, rht_obj(ht, head)))) {
+                        pprev = &head->next;
                         continue;
+                }
 
                 if (!ht->rhlist)
                         return rht_obj(ht, head);
diff --git a/lib/test_bpf.c b/lib/test_bpf.c
index b4e22345963f..3e9335493fe4 100644
--- a/lib/test_bpf.c
+++ b/lib/test_bpf.c
@@ -24,10 +24,11 @@
 #include <linux/if_vlan.h>
 #include <linux/random.h>
 #include <linux/highmem.h>
+#include <linux/sched.h>
 
 /* General test specific settings */
 #define MAX_SUBTESTS    3
-#define MAX_TESTRUNS    10000
+#define MAX_TESTRUNS    1000
 #define MAX_DATA        128
 #define MAX_INSNS       512
 #define MAX_K           0xffffFFFF
@@ -5466,7 +5467,7 @@ static struct bpf_test tests[] = {
         {
                 "BPF_MAXINSNS: Jump, gap, jump, ...",
                 { },
-#ifdef CONFIG_BPF_JIT_ALWAYS_ON
+#if defined(CONFIG_BPF_JIT_ALWAYS_ON) && defined(CONFIG_X86)
                 CLASSIC | FLAG_NO_DATA | FLAG_EXPECTED_FAIL,
 #else
                 CLASSIC | FLAG_NO_DATA,
@@ -6582,6 +6583,7 @@ static __init int test_bpf(void)
                 struct bpf_prog *fp;
                 int err;
 
+                cond_resched();
                 if (exclude_test(i))
                         continue;
 
diff --git a/lib/test_kmod.c b/lib/test_kmod.c
index e372b97eee13..0e5b7a61460b 100644
--- a/lib/test_kmod.c
+++ b/lib/test_kmod.c
@@ -1141,7 +1141,7 @@ static struct kmod_test_device *register_test_dev_kmod(void)
         mutex_lock(&reg_dev_mutex);
 
         /* int should suffice for number of devices, test for wrap */
-        if (unlikely(num_test_devs + 1) < 0) {
+        if (num_test_devs + 1 == INT_MAX) {
                 pr_err("reached limit of number of test devices\n");
                 goto out;
         }
diff --git a/lib/test_rhashtable.c b/lib/test_rhashtable.c
index 76d3667fdea2..f4000c137dbe 100644
--- a/lib/test_rhashtable.c
+++ b/lib/test_rhashtable.c
@@ -79,6 +79,21 @@ struct thread_data {
         struct test_obj *objs;
 };
 
+static u32 my_hashfn(const void *data, u32 len, u32 seed)
+{
+        const struct test_obj_rhl *obj = data;
+
+        return (obj->value.id % 10) << RHT_HASH_RESERVED_SPACE;
+}
+
+static int my_cmpfn(struct rhashtable_compare_arg *arg, const void *obj)
+{
+        const struct test_obj_rhl *test_obj = obj;
+        const struct test_obj_val *val = arg->key;
+
+        return test_obj->value.id - val->id;
+}
+
 static struct rhashtable_params test_rht_params = {
         .head_offset = offsetof(struct test_obj, node),
         .key_offset = offsetof(struct test_obj, value),
@@ -87,6 +102,17 @@ static struct rhashtable_params test_rht_params = {
         .nulls_base = (3U << RHT_BASE_SHIFT),
 };
 
+static struct rhashtable_params test_rht_params_dup = {
+        .head_offset = offsetof(struct test_obj_rhl, list_node),
+        .key_offset = offsetof(struct test_obj_rhl, value),
+        .key_len = sizeof(struct test_obj_val),
+        .hashfn = jhash,
+        .obj_hashfn = my_hashfn,
+        .obj_cmpfn = my_cmpfn,
+        .nelem_hint = 128,
+        .automatic_shrinking = false,
+};
+
 static struct semaphore prestart_sem;
 static struct semaphore startup_sem = __SEMAPHORE_INITIALIZER(startup_sem, 0);
 
@@ -465,6 +491,112 @@ static int __init test_rhashtable_max(struct test_obj *array,
         return err;
 }
 
+static unsigned int __init print_ht(struct rhltable *rhlt)
+{
+        struct rhashtable *ht;
+        const struct bucket_table *tbl;
+        char buff[512] = "";
+        unsigned int i, cnt = 0;
+
+        ht = &rhlt->ht;
+        tbl = rht_dereference(ht->tbl, ht);
+        for (i = 0; i < tbl->size; i++) {
+                struct rhash_head *pos, *next;
+                struct test_obj_rhl *p;
+
+                pos = rht_dereference(tbl->buckets[i], ht);
+                next = !rht_is_a_nulls(pos) ? rht_dereference(pos->next, ht) : NULL;
+
+                if (!rht_is_a_nulls(pos)) {
+                        sprintf(buff, "%s\nbucket[%d] -> ", buff, i);
+                }
+
+                while (!rht_is_a_nulls(pos)) {
+                        struct rhlist_head *list = container_of(pos, struct rhlist_head, rhead);
+                        sprintf(buff, "%s[[", buff);
+                        do {
+                                pos = &list->rhead;
+                                list = rht_dereference(list->next, ht);
+                                p = rht_obj(ht, pos);
+
+                                sprintf(buff, "%s val %d (tid=%d)%s", buff, p->value.id, p->value.tid,
+                                        list? ", " : " ");
+                                cnt++;
+                        } while (list);
+
+                        pos = next,
+                        next = !rht_is_a_nulls(pos) ?
+                                rht_dereference(pos->next, ht) : NULL;
+
+                        sprintf(buff, "%s]]%s", buff, !rht_is_a_nulls(pos) ? " -> " : "");
+                }
+        }
+        printk(KERN_ERR "\n---- ht: ----%s\n-------------\n", buff);
+
+        return cnt;
+}
+
+static int __init test_insert_dup(struct test_obj_rhl *rhl_test_objects,
+                                  int cnt, bool slow)
+{
+        struct rhltable rhlt;
+        unsigned int i, ret;
+        const char *key;
+        int err = 0;
+
+        err = rhltable_init(&rhlt, &test_rht_params_dup);
+        if (WARN_ON(err))
+                return err;
+
+        for (i = 0; i < cnt; i++) {
+                rhl_test_objects[i].value.tid = i;
+                key = rht_obj(&rhlt.ht, &rhl_test_objects[i].list_node.rhead);
+                key += test_rht_params_dup.key_offset;
+
+                if (slow) {
+                        err = PTR_ERR(rhashtable_insert_slow(&rhlt.ht, key,
+                                                             &rhl_test_objects[i].list_node.rhead));
+                        if (err == -EAGAIN)
+                                err = 0;
+                } else
+                        err = rhltable_insert(&rhlt,
+                                              &rhl_test_objects[i].list_node,
+                                              test_rht_params_dup);
+                if (WARN(err, "error %d on element %d/%d (%s)\n", err, i, cnt, slow? "slow" : "fast"))
+                        goto skip_print;
+        }
+
+        ret = print_ht(&rhlt);
+        WARN(ret != cnt, "missing rhltable elements (%d != %d, %s)\n", ret, cnt, slow? "slow" : "fast");
+
+skip_print:
+        rhltable_destroy(&rhlt);
+
+        return 0;
+}
+
+static int __init test_insert_duplicates_run(void)
+{
+        struct test_obj_rhl rhl_test_objects[3] = {};
+
+        pr_info("test inserting duplicates\n");
+
+        /* two different values that map to same bucket */
+        rhl_test_objects[0].value.id = 1;
+        rhl_test_objects[1].value.id = 21;
+
+        /* and another duplicate with same as [0] value
+         * which will be second on the bucket list */
+        rhl_test_objects[2].value.id = rhl_test_objects[0].value.id;
+
+        test_insert_dup(rhl_test_objects, 2, false);
+        test_insert_dup(rhl_test_objects, 3, false);
+        test_insert_dup(rhl_test_objects, 2, true);
+        test_insert_dup(rhl_test_objects, 3, true);
+
+        return 0;
+}
+
 static int thread_lookup_test(struct thread_data *tdata)
 {
         unsigned int entries = tdata->entries;
@@ -613,6 +745,8 @@ static int __init test_rht_init(void)
         do_div(total_time, runs);
         pr_info("Average test time: %llu\n", total_time);
 
+        test_insert_duplicates_run();
+
         if (!tcount)
                 return 0;
 
diff --git a/lib/vsprintf.c b/lib/vsprintf.c
index 77ee6ced11b1..d7a708f82559 100644
--- a/lib/vsprintf.c
+++ b/lib/vsprintf.c
@@ -1849,7 +1849,7 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr,
 {
         const int default_width = 2 * sizeof(void *);
 
-        if (!ptr && *fmt != 'K') {
+        if (!ptr && *fmt != 'K' && *fmt != 'x') {
                 /*
                  * Print (null) with the same width as a pointer so it makes
                  * tabular output look nice.