Linux 4.4.230
Greg Kroah-Hartman
maintainerI'm announcing the release of the 4.4.230 kernel.
All users of the 4.4 kernel series must upgrade.
The updated 4.4.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.4.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2 - arch/mips/kernel/traps.c | 1 crypto/af_alg.c | 26 ++++++++----------- crypto/algif_aead.c | 9 ++---- crypto/algif_hash.c | 9 ++---- crypto/algif_skcipher.c | 9 ++---- drivers/block/virtio_blk.c | 1 drivers/edac/amd64_edac.c | 2 + drivers/hwmon/acpi_power_meter.c | 4 ++- drivers/hwmon/max6697.c | 7 +++-- drivers/i2c/algos/i2c-algo-pca.c | 3 +- drivers/usb/misc/usbtest.c | 1 fs/btrfs/inode.c | 36 +++++++++++++++++++-------- fs/cifs/connect.c | 3 ++ fs/cifs/inode.c | 10 ++++++- include/crypto/if_alg.h | 4 +-- include/linux/sched/sysctl.h | 1 kernel/debug/debug_core.c | 4 +++ kernel/sched/core.c | 5 ++- kernel/sched/rt.c | 1 kernel/sysctl.c | 2 - mm/slub.c | 3 +- mm/swap_state.c | 3 +- net/netfilter/nf_conntrack_h323_main.c | 1 sound/usb/card.h | 4 --- sound/usb/endpoint.c | 43 +++------------------------------ sound/usb/endpoint.h | 1 sound/usb/pcm.c | 2 - 28 files changed, 94 insertions(+), 103 deletions(-)
Anand Jain (1):
btrfs: cow_file_range() num_bytes and disk_num_bytes are same
Borislav Petkov (1):
EDAC/amd64: Read back the scrub rate PCI register on F15h
Chris Packham (1):
i2c: algo-pca: Add 0x78 as SCL stuck low status for PCA9665
Chu Lin (1):
hwmon: (max6697) Make sure the OVERT mask is set correctly
Douglas Anderson (1):
kgdb: Avoid suspicious RCU usage warning
Filipe Manana (1):
btrfs: fix data block group relocation failure due to concurrent scrub
Greg Kroah-Hartman (2):
Revert "ALSA: usb-audio: Improve frames size computation" Linux 4.4.230
Hauke Mehrtens (1):
MIPS: Add missing EHB in mtc0 -> mfc0 sequence for DSPen
Herbert Xu (1):
crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock()
Hou Tao (1):
virtio-blk: free vblk-vqs in error path of virtblk_probe()
Hugh Dickins (1):
mm: fix swap cache node allocation mask
Misono Tomohiro (1):
hwmon: (acpi_power_meter) Fix potential memory leak in acpi_power_meter_add()
Paul Aurich (2):
SMB3: Honor 'seal' flag for multiuser mounts
SMB3: Honor persistent/resilient handle flags for multiuser mounts
Qian Cai (1):
mm/slub: fix stack overruns with SLUB_STATS
Shile Zhang (1):
sched/rt: Show the 'sched_rr_timeslice' SCHED_RR timeslice tuning knob in milliseconds
Vasily Averin (1):
netfilter: nf_conntrack_h323: lost .data_len definition for Q.931/ipv6
Zhang Xiaoxu (1):
cifs: Fix the target file was deleted when rename failed.
Zqiang (1):
usb: usbtest: fix missing kfree(dev->buf) in usbtest_disconnect
Greg Kroah-Hartman
maintainerMakefile +1 -1
@@ -1,6 +1,6 @@ VERSION = 4 PATCHLEVEL = 4 -SUBLEVEL = 229 +SUBLEVEL = 230 EXTRAVERSION = NAME = Blurry Fish Butt
arch/mips/kernel/traps.c +1 -0
@@ -2080,6 +2080,7 @@ static void configure_status(void)change_c0_status (ST0_CU |ST0_MX |ST0_RE |ST0_FR |ST0_BEV |ST0_TS |ST0_KX |ST0_SX |ST0_UX , status_set); +back_to_back_c0_hazard (); }/* configure HWRENA register */
crypto/af_alg.c +11 -15
@@ -130,21 +130,15 @@ EXPORT_SYMBOL_GPL(af_alg_release);void af_alg_release_parent (struct sock *sk) {struct alg_sock *ask =alg_sk (sk); -unsigned int nokey = ask->nokey_refcnt; -bool last = nokey && !ask->refcnt; +unsigned int nokey =atomic_read (&ask->nokey_refcnt); sk = ask->parent; ask =alg_sk (sk); -local_bh_disable (); -bh_lock_sock (sk); - ask->nokey_refcnt -= nokey; -if (!last) - last = !--ask->refcnt; -bh_unlock_sock (sk); -local_bh_enable (); +if (nokey) +atomic_dec (&ask->nokey_refcnt); -if (last) +if (atomic_dec_and_test (&ask->refcnt))sock_put (sk); }EXPORT_SYMBOL_GPL (af_alg_release_parent);
@@ -189,7 +183,7 @@ static int alg_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) err = -EBUSY ;lock_sock (sk); -if (ask->refcnt | ask->nokey_refcnt) +if (atomic_read (&ask->refcnt)) goto unlock;swap (ask->type, type);
@@ -238,7 +232,7 @@ static int alg_setsockopt(struct socket *sock, int level, int optname,int err = -EBUSY ;lock_sock (sk); -if (ask->refcnt) +if (atomic_read (&ask->refcnt) !=atomic_read (&ask->nokey_refcnt)) goto unlock; type = ask->type;
@@ -305,12 +299,14 @@ int af_alg_accept(struct sock *sk, struct socket *newsock) sk2->sk_family =PF_ALG ; -if (nokey || !ask->refcnt++) +if (atomic_inc_return_relaxed (&ask->refcnt) ==1 )sock_hold (sk); - ask->nokey_refcnt += nokey; +if (nokey) { +atomic_inc (&ask->nokey_refcnt); +atomic_set (&alg_sk (sk2)->nokey_refcnt,1 ); + }alg_sk (sk2)->parent = sk;alg_sk (sk2)->type = type; -alg_sk (sk2)->nokey_refcnt = nokey; newsock->ops = type->ops; newsock->state =SS_CONNECTED ;
crypto/algif_aead.c +3 -6
@@ -528,7 +528,7 @@ static int aead_check_key(struct socket *sock)struct alg_sock *ask =alg_sk (sk);lock_sock (sk); -if (ask->refcnt) +if (!atomic_read (&ask->nokey_refcnt)) goto unlock_child; psk = ask->parent;
@@ -540,11 +540,8 @@ static int aead_check_key(struct socket *sock)if (!tfm->has_key) goto unlock; -if (!pask->refcnt++) -sock_hold (psk); - - ask->refcnt =1 ; -sock_put (psk); +atomic_dec (&pask->nokey_refcnt); +atomic_set (&ask->nokey_refcnt,0 ); err =0 ;
crypto/algif_hash.c +3 -6
@@ -252,7 +252,7 @@ static int hash_check_key(struct socket *sock)struct alg_sock *ask =alg_sk (sk);lock_sock (sk); -if (ask->refcnt) +if (!atomic_read (&ask->nokey_refcnt)) goto unlock_child; psk = ask->parent;
@@ -264,11 +264,8 @@ static int hash_check_key(struct socket *sock)if (!tfm->has_key) goto unlock; -if (!pask->refcnt++) -sock_hold (psk); - - ask->refcnt =1 ; -sock_put (psk); +atomic_dec (&pask->nokey_refcnt); +atomic_set (&ask->nokey_refcnt,0 ); err =0 ;
crypto/algif_skcipher.c +3 -6
@@ -774,7 +774,7 @@ static int skcipher_check_key(struct socket *sock)struct alg_sock *ask =alg_sk (sk);lock_sock (sk); -if (ask->refcnt) +if (!atomic_read (&ask->nokey_refcnt)) goto unlock_child; psk = ask->parent;
@@ -786,11 +786,8 @@ static int skcipher_check_key(struct socket *sock)if (!tfm->has_key) goto unlock; -if (!pask->refcnt++) -sock_hold (psk); - - ask->refcnt =1 ; -sock_put (psk); +atomic_dec (&pask->nokey_refcnt); +atomic_set (&ask->nokey_refcnt,0 ); err =0 ;
drivers/block/virtio_blk.c +1 -0
@@ -757,6 +757,7 @@ out_put_disk:put_disk (vblk->disk); out_free_vq: vdev->config->del_vqs (vdev); +kfree (vblk->vqs); out_free_vblk:kfree (vblk); out_free_index:
drivers/edac/amd64_edac.c +2 -0
@@ -248,6 +248,8 @@ static int get_scrub_rate(struct mem_ctl_info *mci)if (pvt->model ==0x60 )amd64_read_pci_cfg (pvt->F2,F15H_M60H_SCRCTRL , &scrubval); +else +amd64_read_pci_cfg (pvt->F3,SCRCTRL , &scrubval); }else amd64_read_pci_cfg (pvt->F3,SCRCTRL , &scrubval);
drivers/hwmon/acpi_power_meter.c +3 -1
@@ -895,7 +895,7 @@ static int acpi_power_meter_add(struct acpi_device *device) res =setup_attrs (resource);if (res) - goto exit_free; + goto exit_free_capability; resource->hwmon_dev =hwmon_device_register (&device->dev);if (IS_ERR (resource->hwmon_dev)) {
@@ -908,6 +908,8 @@ static int acpi_power_meter_add(struct acpi_device *device) exit_remove:remove_attrs (resource); +exit_free_capability: +free_capabilities (resource); exit_free:kfree (resource); exit:
drivers/hwmon/max6697.c +4 -3
@@ -46,8 +46,9 @@ static const u8 MAX6697_REG_CRIT[] = {* Map device tree / platform data register bit map to chip bit map. * Applies to alert register and over-temperature register. */ -#define MAX6697_MAP_BITS (reg) ((((reg) & 0x7e) >> 1) | \ +#define MAX6697_ALERT_MAP_BITS (reg) ((((reg) & 0x7e) >> 1) | \ (((reg) & 0x01) << 6) | ((reg) & 0x80)) +#define MAX6697_OVERT_MAP_BITS (reg) (((reg) >> 1) | (((reg) & 0x01) << 7))#define MAX6697_REG_STAT (n) (0x44 + (n))
@@ -586,12 +587,12 @@ static int max6697_init_chip(struct max6697_data *data,return ret; ret =i2c_smbus_write_byte_data (client,MAX6697_REG_ALERT_MASK , -MAX6697_MAP_BITS (pdata->alert_mask)); +MAX6697_ALERT_MAP_BITS (pdata->alert_mask));if (ret <0 )return ret; ret =i2c_smbus_write_byte_data (client,MAX6697_REG_OVERT_MASK , -MAX6697_MAP_BITS (pdata->over_temperature_mask)); +MAX6697_OVERT_MAP_BITS (pdata->over_temperature_mask));if (ret <0 )return ret;
drivers/i2c/algos/i2c-algo-pca.c +2 -1
@@ -326,7 +326,8 @@ static int pca_xfer(struct i2c_adapter *i2c_adap,DEB2 ("BUS ERROR - SDA Stuck low\n" );pca_reset (adap); goto out; -case 0x90 :/* Bus error - SCL stuck low */ +case 0x78 :/* Bus error - SCL stuck low (PCA9665) */ +case 0x90 :/* Bus error - SCL stuck low (PCA9564) */ DEB2 ("BUS ERROR - SCL Stuck low\n" );pca_reset (adap); goto out;
drivers/usb/misc/usbtest.c +1 -0
@@ -2703,6 +2703,7 @@ static void usbtest_disconnect(struct usb_interface *intf)usb_set_intfdata (intf,NULL );dev_dbg (&intf->dev,"disconnect\n" ); +kfree (dev->buf);kfree (dev); }
fs/btrfs/inode.c +26 -10
@@ -926,7 +926,7 @@ static noinline int cow_file_range(struct inode *inode,u64 alloc_hint =0 ;u64 num_bytes;unsigned long ram_size; -u64 disk_num_bytes; +u64 min_alloc_size;u64 cur_alloc_size;u64 blocksize = root->sectorsize;struct btrfs_key ins;
@@ -942,7 +942,6 @@ static noinline int cow_file_range(struct inode *inode, num_bytes =ALIGN (end - start +1 , blocksize); num_bytes =max (blocksize, num_bytes); - disk_num_bytes = num_bytes;/* if this is a small write inside eof, kick off defrag */ if (num_bytes < 64 * 1024 &&
@@ -969,18 +968,33 @@ static noinline int cow_file_range(struct inode *inode, } } -BUG_ON (disk_num_bytes > -btrfs_super_total_bytes (root->fs_info->super_copy)); +BUG_ON (num_bytes >btrfs_super_total_bytes (root->fs_info->super_copy)); alloc_hint =get_extent_allocation_hint (inode, start, num_bytes);btrfs_drop_extent_cache (inode, start, start + num_bytes -1 ,0 ); -while (disk_num_bytes >0 ) { +/* +* Relocation relies on the relocated extents to have exactly the same +* size as the original extents. Normally writeback for relocation data +* extents follows a NOCOW path because relocation preallocates the +* extents. However, due to an operation such as scrub turning a block +* group to RO mode, it may fallback to COW mode, so we must make sure +* an extent allocated during COW has exactly the requested size and can +* not be split into smaller extents, otherwise relocation breaks and +* fails during the stage where it updates the bytenr of file extent +* items. +*/ +if (root->root_key.objectid ==BTRFS_DATA_RELOC_TREE_OBJECTID ) + min_alloc_size = num_bytes; +else + min_alloc_size = root->sectorsize; + +while (num_bytes >0 ) {unsigned long op; - cur_alloc_size = disk_num_bytes; + cur_alloc_size = num_bytes; ret =btrfs_reserve_extent (root, cur_alloc_size, - root->sectorsize,0 , alloc_hint, + min_alloc_size,0 , alloc_hint, &ins,1 ,1 );if (ret <0 ) goto out_unlock;
@@ -1033,7 +1047,7 @@ static noinline int cow_file_range(struct inode *inode, goto out_drop_extent_cache; } -if (disk_num_bytes < cur_alloc_size) +if (num_bytes < cur_alloc_size)break ;/* we're not doing compressed IO, don't unlock the first
@@ -1050,8 +1064,10 @@ static noinline int cow_file_range(struct inode *inode, start + ram_size -1 , locked_page,EXTENT_LOCKED |EXTENT_DELALLOC , op); - disk_num_bytes -= cur_alloc_size; - num_bytes -= cur_alloc_size; +if (num_bytes < cur_alloc_size) + num_bytes =0 ; +else + num_bytes -= cur_alloc_size; alloc_hint = ins.objectid + ins.offset; start += cur_alloc_size; }
fs/cifs/connect.c +3 -0
@@ -4203,9 +4203,12 @@ cifs_construct_tcon(struct cifs_sb_info *cifs_sb, kuid_t fsuid) vol_info->retry = master_tcon->retry; vol_info->nocase = master_tcon->nocase; vol_info->local_lease = master_tcon->local_lease; + vol_info->resilient = master_tcon->use_resilient; + vol_info->persistent = master_tcon->use_persistent; vol_info->no_linux_ext = !master_tcon->unix_ext; vol_info->sectype = master_tcon->ses->sectype; vol_info->sign = master_tcon->ses->sign; + vol_info->seal = master_tcon->seal; rc =cifs_set_vol_auth (vol_info, master_tcon->ses);if (rc) {
fs/cifs/inode.c +8 -2
@@ -1737,6 +1737,7 @@ cifs_rename2(struct inode *source_dir, struct dentry *source_dentry,FILE_UNIX_BASIC_INFO *info_buf_target;unsigned int xid;int rc, tmprc; +bool new_target =d_really_is_negative (target_dentry);if (flags & ~RENAME_NOREPLACE )return -EINVAL ;
@@ -1813,8 +1814,13 @@ cifs_rename2(struct inode *source_dir, struct dentry *source_dentry,*/ unlink_target: -/* Try unlinking the target dentry if it's not negative */ -if (d_really_is_positive (target_dentry) && (rc == -EACCES || rc == -EEXIST )) { +/* +* If the target dentry was created during the rename, try +* unlinking it if it's not negative +*/ +if (new_target && +d_really_is_positive (target_dentry) && + (rc == -EACCES || rc == -EEXIST )) {if (d_is_dir (target_dentry)) tmprc =cifs_rmdir (target_dir, target_dentry);else
include/crypto/if_alg.h +2 -2
@@ -30,8 +30,8 @@ struct alg_sock {struct sock *parent; -unsigned int refcnt; -unsigned int nokey_refcnt; +atomic_t refcnt; +atomic_t nokey_refcnt;const struct af_alg_type *type;void *private;
include/linux/sched/sysctl.h +1 -0
@@ -81,6 +81,7 @@ extern unsigned int sysctl_sched_cfs_bandwidth_slice;extern unsigned int sysctl_sched_autogroup_enabled;#endif +extern int sysctl_sched_rr_timeslice;extern int sched_rr_timeslice; extern int sched_rr_handler(struct ctl_table *table, int write,
kernel/debug/debug_core.c +4 -0
@@ -488,6 +488,7 @@ static int kgdb_cpu_enter(struct kgdb_state *ks, struct pt_regs *regs, arch_kgdb_ops.disable_hw_break (regs); acquirelock: +rcu_read_lock ();/* * Interrupts will be restored by the 'trap return' code, except when * single stepping.
@@ -542,6 +543,7 @@ return_normal:atomic_dec (&slaves_in_kgdb);dbg_touch_watchdogs ();local_irq_restore (flags); +rcu_read_unlock ();return 0 ; }cpu_relax ();
@@ -560,6 +562,7 @@ return_normal:raw_spin_unlock (&dbg_master_lock);dbg_touch_watchdogs ();local_irq_restore (flags); +rcu_read_unlock (); goto acquirelock; }
@@ -677,6 +680,7 @@ kgdb_restore:raw_spin_unlock (&dbg_master_lock);dbg_touch_watchdogs ();local_irq_restore (flags); +rcu_read_unlock ();return kgdb_info[cpu].ret_state; }
kernel/sched/core.c +3 -2
@@ -8266,8 +8266,9 @@ int sched_rr_handler(struct ctl_table *table, int write,/* make sure that internally we keep jiffies */ /* also, writing zero resets timeslice to default */ if (!ret && write) { - sched_rr_timeslice = sched_rr_timeslice <=0 ? -RR_TIMESLICE :msecs_to_jiffies (sched_rr_timeslice); + sched_rr_timeslice = + sysctl_sched_rr_timeslice <=0 ?RR_TIMESLICE : +msecs_to_jiffies (sysctl_sched_rr_timeslice); }mutex_unlock (&mutex);return ret;
kernel/sched/rt.c +1 -0
@@ -9,6 +9,7 @@#include <linux/irq_work.h> int sched_rr_timeslice =RR_TIMESLICE ; +int sysctl_sched_rr_timeslice = (MSEC_PER_SEC /HZ ) *RR_TIMESLICE ;static int do_sched_rt_period_timer (struct rt_bandwidth *rt_b,int overrun);
kernel/sysctl.c +1 -1
@@ -412,7 +412,7 @@ static struct ctl_table kern_table[] = { }, { .procname = "sched_rr_timeslice_ms", - .data = &sched_rr_timeslice, + .data = &sysctl_sched_rr_timeslice, .maxlen = sizeof(int), .mode = 0644, .proc_handler = sched_rr_handler,
mm/slub.c +2 -1
@@ -5305,7 +5305,8 @@ static void memcg_propagate_slab_attrs(struct kmem_cache *s)*/ if (buffer) buf = buffer; -else if (root_cache->max_attr_size <ARRAY_SIZE (mbuf)) +else if (root_cache->max_attr_size <ARRAY_SIZE (mbuf) && + !IS_ENABLED (CONFIG_SLUB_STATS )) buf = mbuf;else { buffer = (char *)get_zeroed_page (GFP_KERNEL );
mm/swap_state.c +2 -1
@@ -19,6 +19,7 @@#include <linux/migrate.h> #include <asm/pgtable.h> +#include "internal.h" /* * swapper_space is a fiction, retained to simplify the path through
@@ -319,7 +320,7 @@ struct page *__read_swap_cache_async(swp_entry_t entry, gfp_t gfp_mask,/* * call radix_tree_preload() while we can wait. */ - err =radix_tree_maybe_preload (gfp_mask &GFP_KERNEL ); + err =radix_tree_maybe_preload (gfp_mask &GFP_RECLAIM_MASK );if (err)break ;
net/netfilter/nf_conntrack_h323_main.c +1 -0
@@ -1225,6 +1225,7 @@ static struct nf_conntrack_helper nf_conntrack_helper_q931[] __read_mostly = { { .name = "Q.931", .me = THIS_MODULE, + .data_len = sizeof(struct nf_ct_h323_master), .tuple.src.l3num = AF_INET6, .tuple.src.u.tcp.port = cpu_to_be16(Q931_PORT), .tuple.dst.protonum = IPPROTO_TCP,
sound/usb/card.h +0 -4
@@ -80,10 +80,6 @@ struct snd_usb_endpoint {dma_addr_t sync_dma;/* DMA address of syncbuf */ unsigned int pipe;/* the data i/o pipe */ -unsigned int framesize[2 ];/* small/large frame sizes in samples */ -unsigned int sample_rem;/* remainder from division fs/fps */ -unsigned int sample_accum;/* sample accumulator */ -unsigned int fps;/* frames per second */ unsigned int freqn;/* nominal sampling rate in fs/fps in Q16.16 format */ unsigned int freqm;/* momentary sampling rate in fs/fps in Q16.16 format */ int freqshift;/* how much to shift the feedback value to get Q16.16 */
sound/usb/endpoint.c +5 -38
78 lines not on this page · raw message
sound/usb/endpoint.h +0 -1
@@ -27,7 +27,6 @@ void snd_usb_endpoint_release(struct snd_usb_endpoint *ep);void snd_usb_endpoint_free (struct snd_usb_endpoint *ep);int snd_usb_endpoint_implicit_feedback_sink (struct snd_usb_endpoint *ep); -int snd_usb_endpoint_slave_next_packet_size (struct snd_usb_endpoint *ep);int snd_usb_endpoint_next_packet_size (struct snd_usb_endpoint *ep); void snd_usb_handle_sync_urb(struct snd_usb_endpoint *ep,
sound/usb/pcm.c +0 -2
@@ -1473,8 +1473,6 @@ static void prepare_playback_urb(struct snd_usb_substream *subs,for (i =0 ; i < ctx->packets; i++) {if (ctx->packet_size[i]) counts = ctx->packet_size[i]; -else if (ep->sync_master) - counts =snd_usb_endpoint_slave_next_packet_size (ep);else counts =snd_usb_endpoint_next_packet_size (ep);