3.4.5-stable review
Subsystems (109)
Greg KH
maintainercover 3.4.5-stable review
This is the start of the stable review cycle for the 3.4.5 release. There are 187 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat Jul 14 19:15:16 UTC 2012. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v3.0/stable-review/patch-3.4.5-rc1.gz
and the diffstat can be found below.
thanks,
greg k-h
-------------
Documentation/device-mapper/verity.txt | 131 +++++++------------- Documentation/stable_kernel_rules.txt | 6 + Makefile | 4 +- arch/arm/mach-dove/include/mach/bridge-regs.h | 1 + arch/arm/mach-dove/include/mach/dove.h | 1 + arch/arm/mach-kirkwood/include/mach/bridge-regs.h | 1 + arch/arm/mach-kirkwood/include/mach/kirkwood.h | 1 + arch/arm/mach-mv78xx0/include/mach/bridge-regs.h | 1 + arch/arm/mach-mv78xx0/include/mach/mv78xx0.h | 2 + arch/arm/mach-orion5x/include/mach/bridge-regs.h | 2 +- arch/arm/mach-orion5x/include/mach/orion5x.h | 1 + arch/arm/mach-tegra/reset.c | 2 +- arch/arm/mm/mmu.c | 74 +++++++++++ arch/arm/plat-orion/common.c | 2 +- arch/arm/plat-samsung/include/plat/map-s3c.h | 2 +- .../arm/plat-samsung/include/plat/watchdog-reset.h | 2 +- arch/powerpc/include/asm/hw_irq.h | 11 +- arch/powerpc/kernel/irq.c | 50 +++++++- arch/powerpc/kvm/book3s_hv_rmhandlers.S | 2 +- arch/powerpc/mm/numa.c | 2 +- arch/powerpc/platforms/cell/pervasive.c | 11 +- arch/powerpc/platforms/pseries/iommu.c | 4 +- arch/powerpc/platforms/pseries/processor_idle.c | 17 +-- arch/powerpc/xmon/xmon.c | 2 +- arch/x86/ia32/ia32_signal.c | 2 +- arch/x86/include/asm/cpufeature.h | 2 +- arch/x86/include/asm/pgtable-3level.h | 54 ++++++++ arch/x86/kernel/acpi/boot.c | 27 ++-- arch/x86/kernel/cpu/scattered.c | 2 +- arch/x86/kernel/reboot.c | 8 ++ drivers/acpi/acpi_pad.c | 7 +- drivers/acpi/acpica/hwsleep.c | 22 ---- drivers/acpi/apei/apei-base.c | 17 ++- drivers/acpi/apei/apei-internal.h | 9 ++ drivers/acpi/apei/ghes.c | 6 +- drivers/acpi/sleep.c | 4 +- drivers/acpi/sysfs.c | 4 +- drivers/acpi/video.c | 2 + drivers/base/power/main.c | 6 +- drivers/block/umem.c | 40 ++++++ drivers/block/xen-blkback/common.h | 2 + drivers/clk/clk.c | 27 ++-- drivers/dma/pl330.c | 2 +- drivers/gpio/gpio-wm8994.c | 5 +- drivers/gpu/drm/drm_edid.c | 2 +- drivers/gpu/drm/i915/i915_irq.c | 57 +++++---- drivers/gpu/drm/i915/i915_suspend.c | 5 +- drivers/gpu/drm/nouveau/nouveau_fbcon.c | 2 +- drivers/gpu/drm/radeon/radeon_gart.c | 13 +- drivers/gpu/drm/radeon/si.c | 4 +- drivers/hid/hid-multitouch.c | 58 +++++++-- drivers/hwmon/applesmc.c | 4 +- drivers/hwmon/coretemp.c | 4 +- drivers/hwspinlock/hwspinlock_core.c | 4 +- drivers/iommu/amd_iommu.c | 9 ++ drivers/iommu/amd_iommu_init.c | 4 +- drivers/iommu/tegra-smmu.c | 4 +- drivers/md/persistent-data/dm-space-map-checker.c | 54 ++++---- drivers/md/persistent-data/dm-space-map-disk.c | 11 +- .../md/persistent-data/dm-transaction-manager.c | 11 +- drivers/md/raid10.c | 12 +- drivers/md/raid5.c | 14 ++- drivers/media/dvb/siano/smsusb.c | 2 + drivers/media/video/gspca/gspca.c | 4 +- drivers/mtd/nand/cafe_nand.c | 2 +- drivers/net/bonding/bond_main.c | 9 +- drivers/net/can/c_can/c_can.c | 4 +- drivers/net/can/flexcan.c | 4 +- drivers/net/dummy.c | 4 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x.h | 15 --- drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 35 ++++-- drivers/net/ethernet/broadcom/tg3.c | 3 +- drivers/net/ethernet/emulex/benet/be_main.c | 5 +- drivers/net/ethernet/intel/e1000e/defines.h | 1 + drivers/net/ethernet/intel/e1000e/ethtool.c | 6 +- drivers/net/ethernet/intel/e1000e/mac.c | 2 +- drivers/net/ethernet/intel/e1000e/netdev.c | 79 +++--------- drivers/net/ethernet/intel/e1000e/phy.c | 8 +- drivers/net/ethernet/intel/igbvf/ethtool.c | 29 +++-- drivers/net/ethernet/intel/ixgbe/ixgbe.h | 4 +- drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c | 2 +- drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 14 ++- drivers/net/ethernet/marvell/sky2.c | 10 +- drivers/net/ethernet/nxp/lpc_eth.c | 11 +- drivers/net/ethernet/realtek/r8169.c | 3 + drivers/net/ethernet/sun/niu.c | 12 +- drivers/net/macvtap.c | 25 +++- drivers/net/usb/ipheth.c | 5 + drivers/net/usb/qmi_wwan.c | 109 +++++++++------- drivers/net/wireless/ath/ath.h | 1 + drivers/net/wireless/ath/ath9k/ath9k.h | 1 + drivers/net/wireless/ath/ath9k/htc_drv_main.c | 5 +- drivers/net/wireless/ath/ath9k/hw.c | 16 ++- drivers/net/wireless/ath/ath9k/main.c | 18 +-- drivers/net/wireless/ath/ath9k/recv.c | 7 +- drivers/net/wireless/ath/ath9k/xmit.c | 31 +++-- drivers/net/wireless/ath/key.c | 4 + drivers/net/wireless/ipw2x00/ipw.h | 23 ++++ drivers/net/wireless/ipw2x00/ipw2100.c | 4 + drivers/net/wireless/ipw2x00/ipw2200.c | 4 + drivers/net/wireless/iwlwifi/iwl-mac80211.c | 12 ++ drivers/net/wireless/iwlwifi/iwl-trans-pcie.c | 6 + drivers/net/wireless/mwifiex/11n_rxreorder.c | 5 +- drivers/net/wireless/mwifiex/11n_rxreorder.h | 7 ++ drivers/net/wireless/mwifiex/cfg80211.c | 21 ++-- drivers/net/wireless/mwifiex/wmm.c | 3 + drivers/net/wireless/rtl818x/rtl8187/leds.c | 2 +- drivers/net/wireless/rtlwifi/rtl8192cu/sw.c | 3 + drivers/net/xen-netfront.c | 8 +- drivers/oprofile/oprofile_perf.c | 2 +- drivers/pci/pci-driver.c | 12 ++ drivers/pci/pci.c | 5 - drivers/pci/quirks.c | 26 ---- drivers/remoteproc/Kconfig | 2 + drivers/rpmsg/virtio_rpmsg_bus.c | 55 +++++++- drivers/rtc/rtc-ab8500.c | 2 +- drivers/rtc/rtc-mxc.c | 5 +- drivers/rtc/rtc-spear.c | 2 +- drivers/scsi/aic94xx/aic94xx_task.c | 2 +- drivers/scsi/libsas/sas_ata.c | 12 +- drivers/scsi/sd.c | 2 + drivers/staging/iio/adc/ad7606_core.c | 1 + drivers/staging/rtl8712/usb_intf.c | 2 + drivers/target/tcm_fc/tfc_sess.c | 3 +- drivers/usb/class/cdc-wdm.c | 2 + drivers/usb/core/hub.c | 18 +-- drivers/usb/host/xhci-hub.c | 44 ++++++- drivers/usb/host/xhci-ring.c | 11 ++ drivers/usb/host/xhci.h | 6 +- drivers/usb/serial/cp210x.c | 11 ++ drivers/usb/serial/metro-usb.c | 8 -- drivers/usb/serial/option.c | 34 +++++ drivers/usb/storage/scsiglue.c | 6 + drivers/usb/storage/unusual_devs.h | 7 -- drivers/video/omap2/dss/apply.c | 2 +- drivers/video/omap2/dss/dispc.c | 5 +- drivers/video/omap2/dss/dss.h | 3 +- fs/btrfs/tree-log.c | 6 + fs/cifs/connect.c | 41 +++--- fs/ecryptfs/kthread.c | 2 +- fs/ecryptfs/miscdev.c | 48 ++++--- fs/exec.c | 2 +- fs/lockd/clntlock.c | 13 +- fs/lockd/svc.c | 38 +++--- fs/nfs/callback.c | 16 ++- fs/nfs/idmap.c | 13 +- fs/nfsd/nfsctl.c | 12 +- fs/nfsd/nfssvc.c | 29 ++++- fs/nilfs2/gcinode.c | 2 + fs/nilfs2/segment.c | 2 + fs/ocfs2/file.c | 6 +- fs/open.c | 6 +- fs/ramfs/file-nommu.c | 1 + fs/splice.c | 35 +++--- fs/udf/super.c | 102 +++++++++------ include/asm-generic/pgtable.h | 32 ++++- include/linux/aio.h | 1 + include/linux/lockd/bind.h | 4 +- include/linux/memblock.h | 4 +- include/linux/mm_types.h | 10 ++ include/linux/mmzone.h | 2 +- include/linux/pci.h | 2 - include/linux/rpmsg.h | 6 + include/linux/skbuff.h | 7 +- include/linux/splice.h | 8 +- include/linux/sunrpc/svc.h | 1 + include/net/cipso_ipv4.h | 29 ++++- include/net/inetpeer.h | 5 +- include/net/sch_generic.h | 7 +- include/scsi/libsas.h | 6 +- include/scsi/scsi_cmnd.h | 8 +- include/scsi/scsi_device.h | 1 + kernel/exit.c | 1 + kernel/relay.c | 5 +- kernel/trace/trace.c | 8 +- lib/dynamic_queue_limits.c | 18 +-- mm/compaction.c | 5 +- mm/madvise.c | 16 ++- mm/memblock.c | 123 +++++++++++------- mm/nobootmem.c | 38 +++--- mm/shmem.c | 3 +- mm/vmscan.c | 7 +- net/batman-adv/routing.c | 2 + net/batman-adv/translation-table.c | 8 +- net/bridge/br_if.c | 1 + net/bridge/br_netlink.c | 2 +- net/bridge/br_private.h | 1 + net/can/raw.c | 3 - net/core/dev.c | 23 +--- net/core/drop_monitor.c | 102 +++++---------- net/core/neighbour.c | 14 +-- net/core/netpoll.c | 11 +- net/core/skbuff.c | 3 +- net/core/sock.c | 7 +- net/ipv4/inetpeer.c | 16 ++- net/ipv6/ip6_fib.c | 2 +- net/ipv6/route.c | 41 ++++-- net/iucv/af_iucv.c | 1 - net/l2tp/l2tp_eth.c | 2 + net/l2tp/l2tp_ip.c | 9 +- net/mac80211/mlme.c | 24 ++-- net/mac80211/rx.c | 5 +- net/nfc/nci/ntf.c | 10 +- net/nfc/rawsock.c | 5 +- net/sunrpc/rpcb_clnt.c | 12 +- net/sunrpc/svc.c | 23 ++-- net/wireless/reg.c | 2 +- sound/pci/hda/hda_codec.c | 2 + sound/pci/hda/patch_realtek.c | 1 + sound/pci/hda/patch_sigmatel.c | 4 +- sound/soc/codecs/tlv320aic3x.c | 4 +- sound/soc/codecs/tlv320aic3x.h | 1 + sound/soc/codecs/wm2200.c | 1 + tools/hv/hv_kvp_daemon.c | 10 +- 214 files changed, 1802 insertions(+), 1011 deletions(-) create mode 100644 drivers/net/wireless/ipw2x00/ipw.h
Greg Kroah-Hartman
maintainerPATCH 1/187 Tools: hv: verify origin of netlink connector message
From: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Olaf Hering <[email protected]>
commit bcc2c9c3fff859e0eb019fe6fec26f9b8eba795c upstream.
The SuSE security team suggested to use recvfrom instead of recv to be certain that the connector message is originated from kernel.
CVE-2012-2669
--- tools/hv/hv_kvp_daemon.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
tools/hv/hv_kvp_daemon.c +7 -3
@@ -701,14 +701,18 @@ int main(void) pfd.fd = fd;while (1 ) { +struct sockaddr *addr_p = (struct sockaddr *) &addr; +socklen_t addr_l =sizeof (addr); pfd.events =POLLIN ; pfd.revents =0 ;poll (&pfd,1 ,-1 ); - len =recv (fd, kvp_recv_buffer,sizeof (kvp_recv_buffer),0 ); + len =recvfrom (fd, kvp_recv_buffer,sizeof (kvp_recv_buffer),0 , + addr_p, &addr_l); -if (len <0 ) { -syslog (LOG_ERR ,"recv failed; error:%d" , len); +if (len <0 || addr.nl_pid) { +syslog (LOG_ERR ,"recvfrom failed; pid:%u error:%d %s" , + addr.nl_pid, errno,strerror (errno));close (fd);return -1 ; }
Greg Kroah-Hartman
maintainerPATCH 2/187 ARM: tegra: make tegra_cpu_reset_handler_enable() __init
From: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Warren <[email protected]>
commit 6355f25ed965421725d92cf719fc63008690ca1c upstream.
This solves a section mismatch warning. I hadn't noticed this before, because my compiler was inlining tegra_cpu_reset_handler_enable() inside tegra_cpu_reset_handler_init(), which is already __init, but I switched compilers and it stopped doing that.
--- arch/arm/mach-tegra/reset.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/mach-tegra/reset.c +1 -1
@@ -33,7 +33,7 @@static bool is_enabled; -static void tegra_cpu_reset_handler_enable (void ) +static void __init tegra_cpu_reset_handler_enable (void ) {void __iomem *iram_base =IO_ADDRESS (TEGRA_IRAM_RESET_BASE ); void __iomem *evp_cpu_reset =
Greg Kroah-Hartman
maintainerPATCH 3/187 ALSA: hda - Add Realtek ALC280 codec support
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Henningsson <[email protected]>
commit befae82e2906cb7155020876a531b0b8c6c8d8c8 upstream.
This chip looks very similar to ALC269 and ALC27* variants. The bug reporter has verified that sound was working after this patch had been applied.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -6976,6 +6976,7 @@ static const struct hda_codec_preset snd { .id = 0x10ec0272, .name = "ALC272", .patch = patch_alc662 }, { .id = 0x10ec0275, .name = "ALC275", .patch = patch_alc269 }, { .id = 0x10ec0276, .name = "ALC276", .patch = patch_alc269 }, + { .id = 0x10ec0280, .name = "ALC280", .patch = patch_alc269 }, { .id = 0x10ec0861, .rev = 0x100340, .name = "ALC660", .patch = patch_alc861 }, { .id = 0x10ec0660, .name = "ALC660-VD", .patch = patch_alc861vd },
Greg Kroah-Hartman
maintainerPATCH 4/187 ALSA: hda - Fix memory leaks at module unload
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 59cad16bc6deb85bd2a464da92bbaae289f0286f upstream.
Some caches aren't released properly at module unloading time.
--- sound/pci/hda/hda_codec.c | 2 ++ 1 file changed, 2 insertions(+)
sound/pci/hda/hda_codec.c +2 -0
@@ -1192,6 +1192,7 @@ static void snd_hda_codec_free(struct hd {if (!codec)return ; +snd_hda_jack_tbl_clear (codec);restore_init_pincfgs (codec);#ifdef CONFIG_SND_HDA_POWER_SAVE cancel_delayed_work (&codec->power_work);
@@ -1200,6 +1201,7 @@ static void snd_hda_codec_free(struct hdlist_del (&codec->list);snd_array_free (&codec->mixers);snd_array_free (&codec->nids); +snd_array_free (&codec->cvt_setups);snd_array_free (&codec->conn_lists);snd_array_free (&codec->spdif_out); codec->bus->caddr_tbl[codec->addr] =NULL ;
Greg Kroah-Hartman
maintainerPATCH 5/187 ALSA: hda - Fix power-map regression for HP dv6 & co
In reply to Greg KHFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 6e1c39c6b00d9141a82c231ba7c5e5b1716974b2 upstream.
The recent fix for power-map controls (commit b0791dda813) caused regressions on some other HP laptops. They have fixed pins but these pins are exposed as jack-detectable. Thus the driver tries to control the power-map dynamically per jack detection where it never gets on.
This patch corrects the condition check for fixed pins so that the power-map is set always for these pins.
NOTE: this is no simple backport from 3.5 kernel. Since 3.5 kernel had significant code change in the relevant part, I fixed this differently.
--- sound/pci/hda/patch_sigmatel.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/pci/hda/patch_sigmatel.c +2 -2
@@ -4388,7 +4388,7 @@ static int stac92xx_init(struct hda_code AC_PINCTL_IN_EN);for (i =0 ; i < spec->num_pwrs; i++) {hda_nid_t nid = spec->pwr_nids[i]; -int pinctl, def_conf; +unsigned int pinctl, def_conf;/* power on when no jack detection is available */ /* or when the VREF is used for controlling LED */
@@ -4415,7 +4415,7 @@ static int stac92xx_init(struct hda_code def_conf =get_defcfg_connect (def_conf);/* skip any ports that don't have jacks since presence * detection is useless */ -if (def_conf !=AC_JACK_PORT_NONE && +if (def_conf !=AC_JACK_PORT_COMPLEX || !is_jack_detectable (codec, nid)) {stac_toggle_power_map (codec, nid,1 );continue ;
Greg Kroah-Hartman
maintainerPATCH 6/187 powerpc/ftrace: Do not trace restore_interrupts()
From: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt <[email protected]>
commit 2d773aa4810d4a612d1c879faacc38594cc3f841 upstream.
As I was adding code that affects all archs, I started testing function tracer against PPC64 and found that it currently locks up with 3.4 kernel. I figured it was due to tracing a function that shouldn't be, so I went through the following process to bisect to find the culprit:
cat /debug/tracing/available_filter_functions > t num=wc -l t
sed -ne "1,${num}p" t > t1
let num=num+1
sed -ne "${num},$p" t > t2
cat t1 > /debug/tracing/set_ftrace_filter echo function /debug/tracing/current_tracer <failed? bisect t1, if not bisect t2>
It finally came down to this function: restore_interrupts()
I'm not sure why this locks up the system. It just seems to prevent scheduling from occurring. Interrupts seem to still work, as I can ping the box. But all user processes freeze.
When restore_interrupts() is not traced, function tracing works fine.
--- arch/powerpc/kernel/irq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/kernel/irq.c +1 -1
@@ -277,7 +277,7 @@ EXPORT_SYMBOL(arch_local_irq_restore);* NOTE: This is called with interrupts hard disabled but not marked * as such in paca->irq_happened, so we need to resync this. */ -void restore_interrupts (void ) +void notrace restore_interrupts(void) {if (irqs_disabled ()) { local_paca->irq_happened |=PACA_IRQ_HARD_DIS ;
Greg Kroah-Hartman
maintainerPATCH 7/187 powerpc: Fix uninitialised error in numa.c
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Neuling <[email protected]>
commit 82b2521d257b5c0efd51821cf5fa306e53bbb6ba upstream.
chroma_defconfig currently gives me this with gcc 4.6:
arch/powerpc/mm/numa.c:638:13: error: 'dm' may be used uninitialized in this function [-Werror=uninitialized]
It's a bogus warning/error since of_get_drconf_memory() only writes it anyway.
--- arch/powerpc/mm/numa.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/mm/numa.c +1 -1
@@ -635,7 +635,7 @@ static inline int __init read_usm_ranges*/ static void __init parse_drconf_memory (struct device_node *memory) { -const u32 *dm, *usm; +const u32 *uninitialized_var (dm ), *usm;unsigned int n, rc, ranges, is_kexec_kdump =0 ;unsigned long lmb_size, base, size, sz;int nid;
Greg Kroah-Hartman
maintainerPATCH 8/187 powerpc/pseries: Fix software invalidate TCE
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Neuling <[email protected]>
commit bc6dc752f35488160ffac07ae91bed1bddaea32a upstream.
The following added support for powernv but broke pseries/BML:
1f1616e powerpc/powernv: Add TCE SW invalidation support
TCE_PCI_SW_INVAL was split into FREE and CREATE flags but the tests in the pseries code were not updated to reflect this.
--- arch/powerpc/platforms/pseries/iommu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/powerpc/platforms/pseries/iommu.c +2 -2
@@ -106,7 +106,7 @@ static int tce_build_pSeries(struct iomm tcep++; } -if (tbl->it_type ==TCE_PCI_SWINV_CREATE ) +if (tbl->it_type &TCE_PCI_SWINV_CREATE )tce_invalidate_pSeries_sw (tbl, tces, tcep -1 );return 0 ; }
@@ -121,7 +121,7 @@ static void tce_free_pSeries(struct iommwhile (npages--) *(tcep++) =0 ; -if (tbl->it_type ==TCE_PCI_SWINV_FREE ) +if (tbl->it_type &TCE_PCI_SWINV_FREE )tce_invalidate_pSeries_sw (tbl, tces, tcep -1 ); }
Greg Kroah-Hartman
maintainerPATCH 9/187 powerpc: check_and_cede_processor() never cedes
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anton Blanchard <[email protected]>
commit 0b17ba7258db83cd02da560884e053b85de371f2 upstream.
Commit f948501b36c6 ("Make hard_irq_disable() actually hard-disable interrupts") caused check_and_cede_processor to stop working. ->irq_happened will never be zero right after a hard_irq_disable so the compiler removes the call to cede_processor completely.
The bug was introduced back in the lazy interrupt handling rework of 3.4 but was hidden until recently because hard_irq_disable did nothing.
This issue will eventually appear in 3.4 stable since the hard_irq_disable fix is marked stable, so mark this one for stable too.
--- arch/powerpc/include/asm/hw_irq.h | 5 +++++ arch/powerpc/platforms/pseries/processor_idle.c | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-)
arch/powerpc/include/asm/hw_irq.h +5 -0
@@ -102,6 +102,11 @@ static inline void hard_irq_disable(void/* include/linux/interrupt.h needs hard_irq_disable to be a macro */ #define hard_irq_disable hard_irq_disable +static inline bool lazy_irq_pending (void ) +{ +return !!(get_paca ()->irq_happened & ~PACA_IRQ_HARD_DIS ); +} +/* * This is called by asynchronous interrupts to conditionally * re-enable hard interrupts when soft-disabled after having
arch/powerpc/platforms/pseries/processor_idle.c +1 -1
@@ -106,7 +106,7 @@ static void check_and_cede_processor(voi* we first hard disable then check. */ hard_irq_disable (); -if (get_paca ()->irq_happened ==0 ) +if (!lazy_irq_pending ())cede_processor (); }
Greg Kroah-Hartman
maintainerPATCH 10/187 ARM: SAMSUNG: Fix for S3C2412 EBI memory mapping
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jose Miguel Goncalves <[email protected]>
commit 3dca938656c7b0ff6b0717a5dde0f5f45e592be5 upstream.
While upgrading the kernel on a S3C2412 based board I've noted that it was impossible to boot the board with a 2.6.32 or upper kernel. I've tracked down the problem to the EBI virtual memory mapping that is in conflict with the IO mapping definition in arch/arm/mach-s3c24xx/s3c2412.c.
--- arch/arm/plat-samsung/include/plat/map-s3c.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/plat-samsung/include/plat/map-s3c.h +1 -1
@@ -22,7 +22,7 @@#define S3C24XX_VA_WATCHDOG S3C_VA_WATCHDOG#define S3C2412_VA_SSMC S3C_ADDR_CPU(0x00000000) -#define S3C2412_VA_EBI S3C_ADDR_CPU(0x00010000) +#define S3C2412_VA_EBI S3C_ADDR_CPU(0x00100000)#define S3C2410_PA_UART (0x50000000)#define S3C24XX_PA_UART S3C2410_PA_UART
Greg Kroah-Hartman
maintainerPATCH 11/187 ARM: SAMSUNG: Should check for IS_ERR(clk) instead of NULL
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonghwan Choi <[email protected]>
commit a5d8f4765f0e92ef027492a8cb979c5b8d45f2c3 upstream.
On the error condition clk_get() returns ERR_PTR().
--- arch/arm/plat-samsung/include/plat/watchdog-reset.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/plat-samsung/include/plat/watchdog-reset.h +1 -1
@@ -25,7 +25,7 @@ static inline void arch_wdt_reset(void)__raw_writel (0 ,S3C2410_WTCON );/* disable watchdog, to be safe */ -if (s3c2410_wdtclk) +if (!IS_ERR (s3c2410_wdtclk))clk_enable (s3c2410_wdtclk);/* put initial values into count and data */
Greg Kroah-Hartman
maintainerPATCH 12/187 ARM: 7438/1: fill possible PMD empty section gaps
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolas Pitre <[email protected]>
commit 19b52abe3c5d759661500a1dc810924369b2ad46 upstream.
On ARM with the 2-level page table format, a PMD entry is represented by two consecutive section entries covering 2MB of virtual space.
However, static mappings always were allowed to use separate 1MB section entries. This means in practice that a static mapping may create half populated PMDs via create_mapping().
Since commit 0536bdf33f (ARM: move iotable mappings within the vmalloc region) those static mappings are located in the vmalloc area. We must ensure no such half populated PMDs are accessible once vmalloc() or ioremap() start looking at the vmalloc area for nearby free virtual address ranges, or various things leading to a kernel crash will happen.
--- arch/arm/mm/mmu.c | 74 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 74 insertions(+)
arch/arm/mm/mmu.c +74 -0
@@ -783,6 +783,79 @@ void __init iotable_init(struct map_desc } } +#ifndef CONFIG_ARM_LPAE + +/* +* The Linux PMD is made of two consecutive section entries covering 2MB +* (see definition in include/asm/pgtable-2level.h). However a call to +* create_mapping() may optimize static mappings by using individual +* 1MB section mappings. This leaves the actual PMD potentially half +* initialized if the top or bottom section entry isn't used, leaving it +* open to problems if a subsequent ioremap() or vmalloc() tries to use +* the virtual space left free by that unused section entry. +* +* Let's avoid the issue by inserting dummy vm entries covering the unused +* PMD halves once the static mappings are in place. +*/ + +static void __init pmd_empty_section_gap (unsigned long addr) +{ +struct vm_struct *vm; + + vm = early_alloc_aligned(sizeof(*vm), __alignof__(*vm)); + vm->addr = (void *)addr; + vm->size =SECTION_SIZE ; + vm->flags =VM_IOREMAP |VM_ARM_STATIC_MAPPING ; + vm->caller = pmd_empty_section_gap; +vm_area_add_early (vm); +} + +static void __init fill_pmd_gaps (void ) +{ +struct vm_struct *vm; +unsigned long addr, next =0 ; +pmd_t *pmd; + +/* we're still single threaded hence no lock needed here */ +for (vm = vmlist; vm; vm = vm->next) { +if (!(vm->flags &VM_ARM_STATIC_MAPPING )) +continue ; + addr = (unsigned long )vm->addr; +if (addr < next) +continue ; + +/* +* Check if this vm starts on an odd section boundary. +* If so and the first section entry for this PMD is free +* then we block the corresponding virtual address. +*/ +if ((addr & ~PMD_MASK ) ==SECTION_SIZE ) { + pmd =pmd_off_k (addr); +if (pmd_none (*pmd)) +pmd_empty_section_gap (addr &PMD_MASK ); + } + +/* +* Then check if this vm ends on an odd section boundary. +* If so and the second section entry for this PMD is empty +* then we block the corresponding virtual address. +*/ + addr += vm->size; +if ((addr & ~PMD_MASK ) ==SECTION_SIZE ) { + pmd =pmd_off_k (addr) +1 ; +if (pmd_none (*pmd)) +pmd_empty_section_gap (addr); + } + +/* no need to look at any vm entry until we hit the next PMD */ + next = (addr +PMD_SIZE -1 ) &PMD_MASK ; + } +} + +#else +#define fill_pmd_gaps () do { } while (0) +#endif +static void *__initdata vmalloc_min = (void *)(VMALLOC_END - (240 <<20 ) -VMALLOC_OFFSET );
@@ -1064,6 +1137,7 @@ static void __init devicemaps_init(struc*/ if (mdesc->map_io) mdesc->map_io (); +fill_pmd_gaps ();/* * Finally flush the caches and tlb to ensure that we're in a
Greg Kroah-Hartman
maintainerPATCH 13/187 powerpc/kvm: sldi should be sld
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Neuling <[email protected]>
commit 2f584a146a2965b82fce89b8d2f95dc5cfe468d0 upstream.
Since we are taking a registers, this should never have been an sldi. Talking to paulus offline, this is the correct fix.
Was introduced by:
commit 19ccb76a1938ab364a412253daec64613acbf3df
Author: Paul Mackerras <[email protected]>
Date: Sat Jul 23 17:42:46 2011 +1000
Talking to paulus, this shouldn't be a literal.
--- arch/powerpc/kvm/book3s_hv_rmhandlers.S | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/kvm/book3s_hv_rmhandlers.S +1 -1
@@ -776,7 +776,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_201) lwz r3,VCORE_NAPPING_THREADS(r5) lwz r4,VCPU_PTID(r9) li r0,1 - sldi r0,r0,r4 + sld r0,r0,r4 andc. r3,r3,r0 /* no sense IPI'ing ourselves */ beq 43f mulli r4,r4,PACA_SIZE /* get paca for thread 0 */
Greg Kroah-Hartman
maintainerPATCH 14/187 powerpc/xmon: Use cpumask iterator to avoid warning
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anton Blanchard <[email protected]>
commit bc1d7702910c7c7e88eb60b58429dbfe293683ce upstream.
We have a bug report where the kernel hits a warning in the cpumask code:
WARNING: at include/linux/cpumask.h:107
Which is:
WARN_ON_ONCE(cpu >= nr_cpumask_bits);
The backtrace is:
cpu_cmd
cmds
xmon_core
xmon
die
xmon is iterating through 0 to NR_CPUS. I'm not sure why we are still open coding this but iterating above nr_cpu_ids is definitely a bug.
This patch iterates through all possible cpus, in case we issue a system reset and CPUs in an offline state call in.
Perhaps the old code was trying to handle CPUs that were in the partition but were never started (eg kexec into a kernel with an nr_cpus= boot option). They are going to die way before we get into xmon since we haven't set any kernel state up for them.
--- arch/powerpc/xmon/xmon.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/xmon/xmon.c +1 -1
@@ -971,7 +971,7 @@ static int cpu_cmd(void)/* print cpus waiting or in xmon */ printf ("cpus stopped:" ); count =0 ; -for (cpu =0 ; cpu <NR_CPUS ; ++cpu) { +for_each_possible_cpu (cpu) {if (cpumask_test_cpu (cpu, &cpus_in_xmon)) {if (count ==0 )printf (" %x" , cpu);
Greg Kroah-Hartman
maintainerPATCH 15/187 media: smsusb: add autodetection support for USB ID 2040:f5a0
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Krufky <[email protected]>
commit 3e1141e2ce5667301a74ca2ef396d9bd5e995f7f upstream.
--- drivers/media/dvb/siano/smsusb.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/media/dvb/siano/smsusb.c +2 -0
@@ -544,6 +544,8 @@ static const struct usb_device_id smsusb .driver_info = SMS1XXX_BOARD_HAUPPAUGE_WINDHAM }, { USB_DEVICE(0x2040, 0xc0a0), .driver_info = SMS1XXX_BOARD_HAUPPAUGE_WINDHAM }, + { USB_DEVICE(0x2040, 0xf5a0), + .driver_info = SMS1XXX_BOARD_HAUPPAUGE_WINDHAM }, { }/* Terminating entry */ };
Greg Kroah-Hartman
maintainerPATCH 16/187 bql: Fix POSDIFF() to integer overflow aware.
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hiroaki SHIMODA <[email protected]>
[ Upstream commit 0cfd32b736ae0c36b42697584811042726c07cba ]
POSDIFF() fails to take into account integer overflow case.
--- lib/dynamic_queue_limits.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
lib/dynamic_queue_limits.c +1 -1
@@ -10,7 +10,7 @@#include <linux/jiffies.h> #include <linux/dynamic_queue_limits.h> -#define POSDIFF (A ,B ) ((A) > (B) ? (A) - (B) : 0) +#define POSDIFF (A ,B ) ((int)((A) - (B)) > 0 ? (A) - (B) : 0)/* Records completed count and recalculates the queue limit */ void dql_completed (struct dql *dql,unsigned int count)
Greg Kroah-Hartman
maintainerPATCH 17/187 bql: Avoid unneeded limit decrement.
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hiroaki SHIMODA <[email protected]>
[ Upstream commit 25426b794efdc70dde7fd3134dc56fac3e7d562d ]
When below pattern is observed,
TIME
dql_queued() dql_completed() |
a) initial state |
|
b) X bytes queued V
c) Y bytes queued
d) X bytes completed
e) Z bytes queued
f) Y bytes completed
a) dql->limit has already some value and there is no in-flight packet.
b) X bytes queued.
c) Y bytes queued and excess limit.
d) X bytes completed and dql->prev_ovlimit is set and also dql->prev_num_queued is set Y.
e) Z bytes queued.
f) Y bytes completed. inprogress and prev_inprogress are true.
At f), according to the comment, all_prev_completed becomes true and limit should be increased. But POSDIFF() ignores (completed == dql->prev_num_queued) case, so limit is decreased.
--- lib/dynamic_queue_limits.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
lib/dynamic_queue_limits.c +4 -2
@@ -11,12 +11,14 @@#include <linux/dynamic_queue_limits.h> #define POSDIFF (A ,B ) ((int)((A) - (B)) > 0 ? (A) - (B) : 0) +#define AFTER_EQ (A ,B ) ((int)((A) - (B)) >= 0)/* Records completed count and recalculates the queue limit */ void dql_completed (struct dql *dql,unsigned int count) {unsigned int inprogress, prev_inprogress, limit; -unsigned int ovlimit, all_prev_completed, completed; +unsigned int ovlimit, completed; +bool all_prev_completed;/* Can't complete more than what's in queue */ BUG_ON (count > dql->num_queued - dql->num_completed);
@@ -26,7 +28,7 @@ void dql_completed(struct dql *dql, unsi ovlimit =POSDIFF (dql->num_queued - dql->num_completed, limit); inprogress = dql->num_queued - completed; prev_inprogress = dql->prev_num_queued - dql->num_completed; - all_prev_completed =POSDIFF (completed, dql->prev_num_queued); + all_prev_completed =AFTER_EQ (completed, dql->prev_num_queued);if ((ovlimit && !inprogress) || (dql->prev_ovlimit && all_prev_completed)) {
Greg Kroah-Hartman
maintainerPATCH 18/187 bql: Avoid possible inconsistent calculation.
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hiroaki SHIMODA <[email protected]>
[ Upstream commit 914bec1011a25f65cdc94988a6f974bfb9a3c10d ]
dql->num_queued could change while processing dql_completed(). To provide consistent calculation, added an on stack variable.
--- lib/dynamic_queue_limits.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
lib/dynamic_queue_limits.c +7 -5
@@ -17,16 +17,18 @@void dql_completed (struct dql *dql,unsigned int count) {unsigned int inprogress, prev_inprogress, limit; -unsigned int ovlimit, completed; +unsigned int ovlimit, completed, num_queued;bool all_prev_completed; + num_queued =ACCESS_ONCE (dql->num_queued); +/* Can't complete more than what's in queue */ -BUG_ON (count > dql->num_queued - dql->num_completed); +BUG_ON (count > num_queued - dql->num_completed); completed = dql->num_completed + count; limit = dql->limit; - ovlimit =POSDIFF (dql->num_queued - dql->num_completed, limit); - inprogress = dql->num_queued - completed; + ovlimit =POSDIFF (num_queued - dql->num_completed, limit); + inprogress = num_queued - completed; prev_inprogress = dql->prev_num_queued - dql->num_completed; all_prev_completed =AFTER_EQ (completed, dql->prev_num_queued);
@@ -106,7 +108,7 @@ void dql_completed(struct dql *dql, unsi dql->prev_ovlimit = ovlimit; dql->prev_last_obj_cnt = dql->last_obj_cnt; dql->num_completed = completed; - dql->prev_num_queued = dql->num_queued; + dql->prev_num_queued = num_queued; }EXPORT_SYMBOL (dql_completed);
Greg Kroah-Hartman
maintainerPATCH 19/187 net: sock: validate data_len before allocating skb in sock_alloc_send_pskb()
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Wang <[email protected]>
[ Upstream commit cc9b17ad29ecaa20bfe426a8d4dbfb94b13ff1cc ]
We need to validate the number of pages consumed by data_len, otherwise frags array could be overflowed by userspace. So this patch validate data_len and return -EMSGSIZE when data_len may occupies more frags than MAX_SKB_FRAGS.
--- net/core/sock.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
net/core/sock.c +5 -2
@@ -1600,6 +1600,11 @@ struct sk_buff *sock_alloc_send_pskb(strgfp_t gfp_mask;long timeo;int err; +int npages = (data_len + (PAGE_SIZE -1 )) >>PAGE_SHIFT ; + + err = -EMSGSIZE ; +if (npages >MAX_SKB_FRAGS ) + goto failure; gfp_mask = sk->sk_allocation;if (gfp_mask & __GFP_WAIT)
@@ -1618,14 +1623,12 @@ struct sk_buff *sock_alloc_send_pskb(strif (atomic_read (&sk->sk_wmem_alloc) < sk->sk_sndbuf) { skb =alloc_skb (header_len, gfp_mask);if (skb) { -int npages;int i;/* No pages, we're done... */ if (!data_len)break ; - npages = (data_len + (PAGE_SIZE -1 )) >>PAGE_SHIFT ; skb->truesize += data_len;skb_shinfo (skb)->nr_frags = npages;for (i =0 ; i < npages; i++) {
Greg Kroah-Hartman
maintainerPATCH 20/187 cipso: handle CIPSO options correctly when NetLabel is disabled
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Moore <[email protected]>
[ Upstream commit 20e2a86485967c385d7c7befc1646e4d1d39362e ]
When NetLabel is not enabled, e.g. CONFIG_NETLABEL=n, and the system receives a CIPSO tagged packet it is dropped (cipso_v4_validate() returns non-zero). In most cases this is the correct and desired behavior, however, in the case where we are simply forwarding the traffic, e.g. acting as a network bridge, this becomes a problem.
This patch fixes the forwarding problem by providing the basic CIPSO validation code directly in ip_options_compile() without the need for the NetLabel or CIPSO code. The new validation code can not perform any of the CIPSO option label/value verification that cipso_v4_validate() does, but it can verify the basic CIPSO option format.
The behavior when NetLabel is enabled is unchanged.
--- include/net/cipso_ipv4.h | 29 ++++++++++++++++++++++++++++- 1 file changed, 28 insertions(+), 1 deletion(-)
include/net/cipso_ipv4.h +28 -1
@@ -42,6 +42,7 @@#include <net/netlabel.h> #include <net/request_sock.h> #include <linux/atomic.h> +#include <asm/unaligned.h> /* known doi values */ #define CIPSO_V4_DOI_UNKNOWN 0x00000000
@@ -285,7 +286,33 @@ static inline int cipso_v4_skbuff_getattstatic inline int cipso_v4_validate (const struct sk_buff *skb,unsigned char **option) { -return -ENOSYS ; +unsigned char *opt = *option; +unsigned char err_offset =0 ; +u8 opt_len = opt[1 ]; +u8 opt_iter; + +if (opt_len <8 ) { + err_offset =1 ; + goto out; + } + +if (get_unaligned_be32 (&opt[2 ]) ==0 ) { + err_offset =2 ; + goto out; + } + +for (opt_iter =6 ; opt_iter < opt_len;) { +if (opt[opt_iter +1 ] > (opt_len - opt_iter)) { + err_offset = opt_iter +1 ; + goto out; + } + opt_iter += opt[opt_iter +1 ]; + } + +out: + *option = opt + err_offset; +return err_offset; + }#endif /* CONFIG_NETLABEL */
Greg Kroah-Hartman
maintainerPATCH 21/187 r8169: call netif_napi_del at errpaths and at driver unload
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Devendra Naga <[email protected]>
[ Upstream commit ad1be8d345416a794dea39761a374032aa471a76 ]
when register_netdev fails, the init'ed NAPIs by netif_napi_add must be deleted with netif_napi_del, and also when driver unloads, it should delete the NAPI before unregistering netdevice using unregister_netdev.
--- drivers/net/ethernet/realtek/r8169.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/realtek/r8169.c +3 -0
@@ -5966,6 +5966,8 @@ static void __devexit rtl_remove_one(strcancel_work_sync (&tp->wk.work); +netif_napi_del (&tp->napi); +unregister_netdev (dev);rtl_release_firmware (tp);
@@ -6288,6 +6290,7 @@ out:return rc; err_out_msi_4: +netif_napi_del (&tp->napi);rtl_disable_msi (pdev, tp);iounmap (ioaddr); err_out_free_res_3:
Greg Kroah-Hartman
maintainerPATCH 22/187 drop_monitor: dont sleep in atomic context
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit bec4596b4e6770c7037f21f6bd27567b152dc0d6 ]
drop_monitor calls several sleeping functions while in atomic context.
BUG: sleeping function called from invalid context at mm/slub.c:943 in_atomic(): 1, irqs_disabled(): 0, pid: 2103, name: kworker/0:2 Pid: 2103, comm: kworker/0:2 Not tainted 3.5.0-rc1+ #55 Call Trace: [<ffffffff810697ca>] __might_sleep+0xca/0xf0 [<ffffffff811345a3>] kmem_cache_alloc_node+0x1b3/0x1c0 [<ffffffff8105578c>] ? queue_delayed_work_on+0x11c/0x130 [<ffffffff815343fb>] __alloc_skb+0x4b/0x230 [<ffffffffa00b0360>] ? reset_per_cpu_data+0x160/0x160 [drop_monitor] [<ffffffffa00b022f>] reset_per_cpu_data+0x2f/0x160 [drop_monitor] [<ffffffffa00b03ab>] send_dm_alert+0x4b/0xb0 [drop_monitor] [<ffffffff810568e0>] process_one_work+0x130/0x4c0 [<ffffffff81058249>] worker_thread+0x159/0x360 [<ffffffff810580f0>] ? manage_workers.isra.27+0x240/0x240 [<ffffffff8105d403>] kthread+0x93/0xa0 [<ffffffff816be6d4>] kernel_thread_helper+0x4/0x10 [<ffffffff8105d370>] ? kthread_freezable_should_stop+0x80/0x80 [<ffffffff816be6d0>] ? gs_change+0xb/0xb
Rework the logic to call the sleeping functions in right context.
Use standard timer/workqueue api to let system chose any cpu to perform the allocation and netlink send.
Also avoid a loop if reset_per_cpu_data() cannot allocate memory :
use mod_timer() to wait 1/10 second before next try.
--- net/core/drop_monitor.c | 102 +++++++++++++++--------------------------------- 1 file changed, 33 insertions(+), 69 deletions(-)
net/core/drop_monitor.c +33 -69
@@ -33,9 +33,6 @@#define TRACE_ON 1#define TRACE_OFF 0 -static void send_dm_alert (struct work_struct *unused); - -/* * Globals, our netlink socket pointer * and the work handle that will send up
@@ -45,11 +42,10 @@ static int trace_state = TRACE_OFF;static DEFINE_MUTEX (trace_state_mutex);struct per_cpu_dm_data { -struct work_struct dm_alert_work; -struct sk_buff __rcu *skb; -atomic_t dm_hit_count; -struct timer_list send_timer; -int cpu; +spinlock_t lock; +struct sk_buff *skb; +struct work_struct dm_alert_work; +struct timer_list send_timer; };struct dm_hw_stat_delta {
@@ -75,13 +71,13 @@ static int dm_delay = 1;static unsigned long dm_hw_check_delta =2 *HZ ;static LIST_HEAD (hw_stats_list); -static void reset_per_cpu_data (struct per_cpu_dm_data *data) +static struct sk_buff *reset_per_cpu_data (struct per_cpu_dm_data *data) {size_t al;struct net_dm_alert_msg *msg;struct nlattr *nla;struct sk_buff *skb; -struct sk_buff *oskb =rcu_dereference_protected (data->skb,1 ); +unsigned long flags; al =sizeof (struct net_dm_alert_msg ); al += dm_hit_limit *sizeof (struct net_dm_drop_point );
@@ -96,65 +92,40 @@ static void reset_per_cpu_data(struct pe sizeof(struct net_dm_alert_msg)); msg =nla_data (nla);memset (msg,0 , al); - }else -schedule_work_on (data->cpu, &data->dm_alert_work); - -/* -* Don't need to lock this, since we are guaranteed to only -* run this on a single cpu at a time. -* Note also that we only update data->skb if the old and new skb -* pointers don't match. This ensures that we don't continually call -* synchornize_rcu if we repeatedly fail to alloc a new netlink message. -*/ -if (skb != oskb) { -rcu_assign_pointer (data->skb, skb); - -synchronize_rcu (); - -atomic_set (&data->dm_hit_count, dm_hit_limit); + }else { +mod_timer (&data->send_timer, jiffies +HZ /10 ); } +spin_lock_irqsave (&data->lock, flags); +swap (data->skb, skb); +spin_unlock_irqrestore (&data->lock, flags); + +return skb; } -static void send_dm_alert (struct work_struct *unused) +static void send_dm_alert (struct work_struct *work) {struct sk_buff *skb; -struct per_cpu_dm_data *data = &get_cpu_var (dm_cpu_data); +struct per_cpu_dm_data *data; -WARN_ON_ONCE (data->cpu !=smp_processor_id ()); + data = container_of(work, struct per_cpu_dm_data, dm_alert_work); -/* -* Grab the skb we're about to send -*/ - skb =rcu_dereference_protected (data->skb,1 ); + skb =reset_per_cpu_data (data); -/* -* Replace it with a new one -*/ -reset_per_cpu_data (data); - -/* -* Ship it! -*/ if (skb)genlmsg_multicast (skb,0 ,NET_DM_GRP_ALERT ,GFP_KERNEL ); - -put_cpu_var (dm_cpu_data); }/* * This is the timer function to delay the sending of an alert * in the event that more drops will arrive during the -* hysteresis period. Note that it operates under the timer interrupt -* so we don't need to disable preemption here +* hysteresis period. */ -static void sched_send_work (unsigned long unused) +static void sched_send_work (unsigned long _data) { -struct per_cpu_dm_data *data = &get_cpu_var (dm_cpu_data); +struct per_cpu_dm_data *data = (struct per_cpu_dm_data *)_data; -schedule_work_on (smp_processor_id (), &data->dm_alert_work); - -put_cpu_var (dm_cpu_data); +schedule_work (&data->dm_alert_work); }static void trace_drop_common (struct sk_buff *skb,void *location)
@@ -164,33 +135,28 @@ static void trace_drop_common(struct sk_struct nlattr *nla;int i;struct sk_buff *dskb; -struct per_cpu_dm_data *data = &get_cpu_var (dm_cpu_data); - +struct per_cpu_dm_data *data; +unsigned long flags; -rcu_read_lock (); - dskb =rcu_dereference (data->skb); +local_irq_save (flags); + data = &__get_cpu_var (dm_cpu_data); +spin_lock (&data->lock); + dskb = data->skb;if (!dskb) goto out; -if (!atomic_add_unless (&data->dm_hit_count,-1 ,0 )) { -/* -* we're already at zero, discard this hit -*/ - goto out; - } - nlh = (struct nlmsghdr *)dskb->data; nla =genlmsg_data (nlmsg_data (nlh)); msg =nla_data (nla);for (i =0 ; i < msg->entries; i++) {if (!memcmp (&location, msg->points[i].pc,sizeof (void *))) { msg->points[i].count++; -atomic_inc (&data->dm_hit_count); goto out; } } - +if (msg->entries == dm_hit_limit) + goto out;/* * We need to create a new entry */
@@ -202,13 +168,11 @@ static void trace_drop_common(struct sk_if (!timer_pending (&data->send_timer)) { data->send_timer.expires = jiffies + dm_delay *HZ ; -add_timer_on (&data->send_timer,smp_processor_id ()); +add_timer (&data->send_timer); } out: -rcu_read_unlock (); -put_cpu_var (dm_cpu_data); -return ; +spin_unlock_irqrestore (&data->lock, flags); }static void trace_kfree_skb_hit (void *ignore,struct sk_buff *skb,void *location)
@@ -406,11 +370,11 @@ static int __init init_net_drop_monitor(for_each_present_cpu (cpu) { data = &per_cpu (dm_cpu_data, cpu); - data->cpu = cpu;INIT_WORK (&data->dm_alert_work, send_dm_alert);init_timer (&data->send_timer); - data->send_timer.data = cpu; + data->send_timer.data = (unsigned long )data; data->send_timer.function = sched_send_work; +spin_lock_init (&data->lock);reset_per_cpu_data (data); }
Greg Kroah-Hartman
maintainerPATCH 23/187 inetpeer: fix a race in inetpeer_gc_worker()
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 55432d2b543a4b6dfae54f5c432a566877a85d90 ]
commit 5faa5df1fa2024 (inetpeer: Invalidate the inetpeer tree along with the routing cache) added a race :
Before freeing an inetpeer, we must respect a RCU grace period, and make sure no user will attempt to increase refcnt.
inetpeer_invalidate_tree() waits for a RCU grace period before inserting inetpeer tree into gc_list and waking the worker. At that time, no concurrent lookup can find a inetpeer in this tree.
--- include/net/inetpeer.h | 5 ++++- net/ipv4/inetpeer.c | 16 ++++++++++++---- 2 files changed, 16 insertions(+), 5 deletions(-)
include/net/inetpeer.h +4 -1
@@ -40,7 +40,10 @@ struct inet_peer {u32 pmtu_orig;u32 pmtu_learned;struct inetpeer_addr_base redirect_learned; -struct list_head gc_list; +union { +struct list_head gc_list; +struct rcu_head gc_rcu; + };/* * Once inet_peer is queued for deletion (refcnt == -1), following fields * are not available: rid, ip_id_count, tcp_ts, tcp_ts_stamp
net/ipv4/inetpeer.c +12 -4
@@ -560,6 +560,17 @@ bool inet_peer_xrlim_allow(struct inet_p }EXPORT_SYMBOL (inet_peer_xrlim_allow); +static void inetpeer_inval_rcu (struct rcu_head *head) +{ + struct inet_peer *p = container_of(head, struct inet_peer, gc_rcu); + +spin_lock_bh (&gc_lock); +list_add_tail (&p->gc_list, &gc_list); +spin_unlock_bh (&gc_lock); + +schedule_delayed_work (&gc_work, gc_delay); +} +void inetpeer_invalidate_tree (int family) {struct inet_peer *old, *new, *prev;
@@ -576,10 +587,7 @@ void inetpeer_invalidate_tree(int family prev =cmpxchg (&base->root, old, new);if (prev == old) { base->total =0 ; -spin_lock (&gc_lock); -list_add_tail (&prev->gc_list, &gc_list); -spin_unlock (&gc_lock); -schedule_delayed_work (&gc_work, gc_delay); +call_rcu (&prev->gc_rcu, inetpeer_inval_rcu); } out:
Greg Kroah-Hartman
maintainerPATCH 24/187 net: l2tp_eth: fix kernel panic on rmmod l2tp_eth
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit a06998b88b1651c5f71c0e35f528bf2057188ead ]
We must prevent module unloading if some devices are still attached to l2tp_eth driver.
--- net/l2tp/l2tp_eth.c | 2 ++ 1 file changed, 2 insertions(+)
net/l2tp/l2tp_eth.c +2 -0
@@ -167,6 +167,7 @@ static void l2tp_eth_delete(struct l2tp_if (dev) {unregister_netdev (dev); spriv->dev =NULL ; +module_put (THIS_MODULE ); } } }
@@ -254,6 +255,7 @@ static int l2tp_eth_create(struct net *nif (rc <0 ) goto out_del_dev; +__module_get (THIS_MODULE );/* Must be done after register_netdev() */ strlcpy (session->ifname, dev->name,IFNAMSIZ );
Greg Kroah-Hartman
maintainerPATCH 25/187 l2tp: fix a race in l2tp_ip_sendmsg()
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 4399a4df98a63e30fd16e9d0cecc46ea92269e8f ]
Commit 081b1b1bb27f (l2tp: fix l2tp_ip_sendmsg() route handling) added a race, in case IP route cache is disabled.
In this case, we should not do the dst_release(&rt->dst), since it'll free the dst immediately, instead of waiting a RCU grace period.
--- net/l2tp/l2tp_ip.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
net/l2tp/l2tp_ip.c +6 -3
@@ -516,10 +516,12 @@ static int l2tp_ip_sendmsg(struct kiocb sk->sk_bound_dev_if);if (IS_ERR (rt)) goto no_route; -if (connected) +if (connected) {sk_setup_caps (sk, &rt->dst); -else -dst_release (&rt->dst);/* safe since we hold rcu_read_lock */ + }else { +skb_dst_set (skb, &rt->dst); + goto xmit; + } }/* We dont need to clone dst here, it is guaranteed to not disappear.
@@ -527,6 +529,7 @@ static int l2tp_ip_sendmsg(struct kiocb*/ skb_dst_set_noref (skb, &rt->dst); +xmit:/* Queue the packet to IP for output */ rc =ip_queue_xmit (skb, &inet->cork.fl);rcu_read_unlock ();
Greg Kroah-Hartman
maintainerPATCH 26/187 lpc_eth: add missing ndo_change_mtu()
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit e30478598a8476d02e3b00caa89ce1a3b1dad54b ]
lpc_eth does a copy of transmitted skbs to DMA area, without checking skb lengths, so can trigger buffer overflows :
memcpy(pldat->tx_buff_v + txidx * ENET_MAXF_SIZE, skb->data, len);
One way to get bigger skbs is to allow MTU changes above the 1500 limit.
Calling eth_change_mtu() in ndo_change_mtu() makes sure this cannot happen.
--- drivers/net/ethernet/nxp/lpc_eth.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/nxp/lpc_eth.c +1 -0
@@ -1310,6 +1310,7 @@ static const struct net_device_ops lpc_n .ndo_set_rx_mode = lpc_eth_set_multicast_list, .ndo_do_ioctl = lpc_eth_ioctl, .ndo_set_mac_address = lpc_set_mac_address, + .ndo_change_mtu = eth_change_mtu, };static int lpc_eth_drv_probe (struct platform_device *pdev)
Greg Kroah-Hartman
maintainerPATCH 27/187 lpc_eth: fix tx completion
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 3f16da51b0e533871d22a29682f3c3969d4f7e22 ]
__lpc_handle_xmit() has two bugs :
1) It can leak skbs in case TXSTATUS_ERROR is set
2) It can wake up txqueue while no slot was freed.
--- drivers/net/ethernet/nxp/lpc_eth.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/net/ethernet/nxp/lpc_eth.c +5 -5
@@ -936,16 +936,16 @@ static void __lpc_handle_xmit(struct net/* Update stats */ ndev->stats.tx_packets++; ndev->stats.tx_bytes += skb->len; - -/* Free buffer */ -dev_kfree_skb_irq (skb); } +dev_kfree_skb_irq (skb); txcidx =readl (LPC_ENET_TXCONSUMEINDEX (pldat->net_base)); } -if (netif_queue_stopped (ndev)) -netif_wake_queue (ndev); +if (pldat->num_used_tx_buffs <=ENET_TX_DESC /2 ) { +if (netif_queue_stopped (ndev)) +netif_wake_queue (ndev); + } }static int __lpc_handle_recv (struct net_device *ndev,int budget)
Greg Kroah-Hartman
maintainerPATCH 28/187 net: neighbour: fix neigh_dump_info()
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 4bd6683bd400c8b1d2ad544bb155d86a5d10f91c ]
Denys found out "ip neigh" output was truncated to about 54 neighbours.
--- net/core/neighbour.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-)
net/core/neighbour.c +6 -8
@@ -2214,9 +2214,7 @@ static int neigh_dump_table(struct neighrcu_read_lock_bh (); nht =rcu_dereference_bh (tbl->nht); -for (h =0 ; h < (1 << nht->hash_shift); h++) { -if (h < s_h) -continue ; +for (h = s_h; h < (1 << nht->hash_shift); h++) {if (h > s_h) s_idx =0 ; for (n = rcu_dereference_bh(nht->hash_buckets[h]), idx = 0;
@@ -2255,9 +2253,7 @@ static int pneigh_dump_table(struct neigread_lock_bh (&tbl->lock); -for (h =0 ; h <=PNEIGH_HASHMASK ; h++) { -if (h < s_h) -continue ; +for (h = s_h; h <=PNEIGH_HASHMASK ; h++) {if (h > s_h) s_idx =0 ;for (n = tbl->phash_buckets[h], idx =0 ; n; n = n->next) {
@@ -2292,7 +2288,7 @@ static int neigh_dump_info(struct sk_bufstruct neigh_table *tbl;int t, family, s_t;int proxy =0 ; -int err =0 ; +int err;read_lock (&neigh_tbl_lock); family = ((struct rtgenmsg *)nlmsg_data (cb->nlh))->rtgen_family;
@@ -2306,7 +2302,7 @@ static int neigh_dump_info(struct sk_buf s_t = cb->args[0 ]; -for (tbl = neigh_tables, t =0 ; tbl && (err >=0 ); +for (tbl = neigh_tables, t =0 ; tbl; tbl = tbl->next, t++) {if (t < s_t || (family && tbl->family != family))continue ;
@@ -2317,6 +2313,8 @@ static int neigh_dump_info(struct sk_buf err =pneigh_dump_table (tbl, skb, cb); else err =neigh_dump_table (tbl, skb, cb); +if (err <0 ) +break ; }read_unlock (&neigh_tbl_lock);
Greg Kroah-Hartman
maintainerPATCH 29/187 ipv6: fib: Restore NTF_ROUTER exception in fib6_age()
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Graf <[email protected]>
[ Upstream commit 8bd74516b1bd9308c17f67583134d93f777203ca ]
Commit 5339ab8b1dd82 (ipv6: fib: Convert fib6_age() to dst_neigh_lookup().) seems to have mistakenly inverted the exception for cached NTF_ROUTER routes.
--- net/ipv6/ip6_fib.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv6/ip6_fib.c +1 -1
@@ -1560,7 +1560,7 @@ static int fib6_age(struct rt6_info *rt, neigh_flags = neigh->flags;neigh_release (neigh); } -if (neigh_flags &NTF_ROUTER ) { +if (!(neigh_flags &NTF_ROUTER )) {RT6_TRACE ("purging route %p via non-router but gateway\n" , rt);return -1 ;
Greg Kroah-Hartman
maintainerPATCH 30/187 ipv6: Move ipv6 proc file registration to end of init order
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Graf <[email protected]>
[ Upstream commit d189634ecab947c10f6f832258b103d0bbfe73cc ]
/proc/net/ipv6_route reflects the contents of fib_table_hash. The proc handler is installed in ip6_route_net_init() whereas fib_table_hash is allocated in fib6_net_init() _after_ the proc handler has been installed.
This opens up a short time frame to access fib_table_hash with its pants down.
Move the registration of the proc files to a later point in the init order to avoid the race.
Tested :-)
--- net/ipv6/route.c | 41 +++++++++++++++++++++++++++++++---------- 1 file changed, 31 insertions(+), 10 deletions(-)
net/ipv6/route.c +31 -10
@@ -2953,10 +2953,6 @@ static int __net_init ip6_route_net_init net->ipv6.sysctl.ip6_rt_mtu_expires =10 *60 *HZ ; net->ipv6.sysctl.ip6_rt_min_advmss =IPV6_MIN_MTU -20 -40 ; -#ifdef CONFIG_PROC_FS -proc_net_fops_create (net,"ipv6_route" ,0 , &ipv6_route_proc_fops); -proc_net_fops_create (net,"rt6_stats" ,S_IRUGO , &rt6_stats_seq_fops); -#endif net->ipv6.ip6_rt_gc_expire =30 *HZ ; ret =0 ;
@@ -2977,10 +2973,6 @@ out_ip6_dst_ops: static void __net_exit ip6_route_net_exit(struct net *net) { -#ifdef CONFIG_PROC_FS -proc_net_remove (net,"ipv6_route" ); -proc_net_remove (net,"rt6_stats" ); -#endif kfree (net->ipv6.ip6_null_entry);#ifdef CONFIG_IPV6_MULTIPLE_TABLES kfree (net->ipv6.ip6_prohibit_entry);
@@ -2989,11 +2981,33 @@ static void __net_exit ip6_route_net_exidst_entries_destroy (&net->ipv6.ip6_dst_ops); } +static int __net_init ip6_route_net_init_late (struct net *net) +{ +#ifdef CONFIG_PROC_FS +proc_net_fops_create (net,"ipv6_route" ,0 , &ipv6_route_proc_fops); +proc_net_fops_create (net,"rt6_stats" ,S_IRUGO , &rt6_stats_seq_fops); +#endif +return 0 ; +} + +static void __net_exit ip6_route_net_exit_late(struct net *net) +{ +#ifdef CONFIG_PROC_FS +proc_net_remove (net,"ipv6_route" ); +proc_net_remove (net,"rt6_stats" ); +#endif +} +static struct pernet_operations ip6_route_net_ops = { .init = ip6_route_net_init, .exit = ip6_route_net_exit, }; +static struct pernet_operations ip6_route_net_late_ops = { + .init = ip6_route_net_init_late, + .exit = ip6_route_net_exit_late, +}; +static struct notifier_block ip6_route_dev_notifier = { .notifier_call = ip6_route_dev_notify, .priority =0 ,
@@ -3043,19 +3057,25 @@ int __init ip6_route_init(void)if (ret) goto xfrm6_init; + ret =register_pernet_subsys (&ip6_route_net_late_ops); +if (ret) + goto fib6_rules_init; + ret = -ENOBUFS ;if (__rtnl_register (PF_INET6 ,RTM_NEWROUTE , inet6_rtm_newroute,NULL ,NULL ) ||__rtnl_register (PF_INET6 ,RTM_DELROUTE , inet6_rtm_delroute,NULL ,NULL ) ||__rtnl_register (PF_INET6 ,RTM_GETROUTE , inet6_rtm_getroute,NULL ,NULL )) - goto fib6_rules_init; + goto out_register_late_subsys; ret =register_netdevice_notifier (&ip6_route_dev_notifier);if (ret) - goto fib6_rules_init; + goto out_register_late_subsys; out:return ret; +out_register_late_subsys: +unregister_pernet_subsys (&ip6_route_net_late_ops); fib6_rules_init:fib6_rules_cleanup (); xfrm6_init:
@@ -3074,6 +3094,7 @@ out_kmem_cache:void ip6_route_cleanup (void ) {unregister_netdevice_notifier (&ip6_route_dev_notifier); +unregister_pernet_subsys (&ip6_route_net_late_ops);fib6_rules_cleanup ();xfrm6_fini ();fib6_gc_cleanup ();
Greg Kroah-Hartman
maintainerPATCH 31/187 sky2: fix checksum bit management on some chips
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: stephen hemminger <[email protected]>
[ Upstream commit 5ff0feac88ced864f44adb145142269196fa79d9 ]
The newer flavors of Yukon II use a different method for receive checksum offload. This is indicated in the driver by the SKY2_HW_NEW_LE flag. On these newer chips, the BMU_ENA_RX_CHKSUM should not be set.
The driver would get incorrectly toggle the bit, enabling the old checksum logic on these chips and cause a BUG_ON() assertion. If receive checksum was toggled via ethtool.
--- drivers/net/ethernet/marvell/sky2.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/net/ethernet/marvell/sky2.c +6 -4
@@ -4381,10 +4381,12 @@ static int sky2_set_features(struct net_struct sky2_port *sky2 =netdev_priv (dev);netdev_features_t changed = dev->features ^ features; -if (changed &NETIF_F_RXCSUM ) { -bool on = features &NETIF_F_RXCSUM ; -sky2_write32 (sky2->hw,Q_ADDR (rxqaddr[sky2->port],Q_CSR ), - on ?BMU_ENA_RX_CHKSUM :BMU_DIS_RX_CHKSUM ); +if ((changed &NETIF_F_RXCSUM ) && + !(sky2->hw->flags &SKY2_HW_NEW_LE )) { +sky2_write32 (sky2->hw, +Q_ADDR (rxqaddr[sky2->port],Q_CSR ), + (features &NETIF_F_RXCSUM ) + ?BMU_ENA_RX_CHKSUM :BMU_DIS_RX_CHKSUM ); }if (changed &NETIF_F_RXHASH )
Greg Kroah-Hartman
maintainer=?y?q?=5B=20063/187=5D=20ath9k=3A=20fix=20invalid=20pointer=20access=20in=20the=20tx=20path?=
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <[email protected]>
commit 80b08a8d8829a58b5db14b1417151094cc28face upstream.
After setup_frame_info has been called, only info->control.rates is still valid, other control fields have been overwritten by the ath_frame_info data. Move the access to info->control.vif for checking short preamble to setup_frame_info before it gets overwritten.
This regression was introduced in commit d47a61aa
"ath9k: Fix multi-VIF BSS handling"
--- drivers/net/wireless/ath/ath9k/ath9k.h | 1 + drivers/net/wireless/ath/ath9k/xmit.c | 29 +++++++++++++++++------------ 2 files changed, 18 insertions(+), 12 deletions(-)
drivers/net/wireless/ath/ath9k/ath9k.h +1 -0
@@ -213,6 +213,7 @@ struct ath_frame_info {enum ath9k_key_type keytype;u8 keyix;u8 retries; +u8 rtscts_rate; };struct ath_buf_state {
drivers/net/wireless/ath/ath9k/xmit.c +17 -12
@@ -938,6 +938,7 @@ static void ath_buf_set_rate(struct ath_struct ieee80211_tx_rate *rates;const struct ieee80211_rate *rate;struct ieee80211_hdr *hdr; +struct ath_frame_info *fi =get_frame_info (bf->bf_mpdu);int i;u8 rix =0 ;
@@ -948,18 +949,7 @@ static void ath_buf_set_rate(struct ath_/* set dur_update_en for l-sig computation except for PS-Poll frames */ info->dur_update = !ieee80211_is_pspoll (hdr->frame_control); - -/* -* We check if Short Preamble is needed for the CTS rate by -* checking the BSS's global flag. -* But for the rate series, IEEE80211_TX_RC_USE_SHORT_PREAMBLE is used. -*/ - rate =ieee80211_get_rts_cts_rate (sc->hw, tx_info); - info->rtscts_rate = rate->hw_value; - -if (tx_info->control.vif && - tx_info->control.vif->bss_conf.use_short_preamble) - info->rtscts_rate |= rate->hw_value_short; + info->rtscts_rate = fi->rtscts_rate;for (i =0 ; i <4 ; i++) {bool is_40, is_sgi, is_sp;
@@ -1776,10 +1766,22 @@ static void setup_frame_info(struct ieeestruct ieee80211_sta *sta = tx_info->control.sta;struct ieee80211_key_conf *hw_key = tx_info->control.hw_key;struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; +const struct ieee80211_rate *rate;struct ath_frame_info *fi =get_frame_info (skb);struct ath_node *an =NULL ;enum ath9k_key_type keytype; +bool short_preamble = false; + +/* +* We check if Short Preamble is needed for the CTS rate by +* checking the BSS's global flag. +* But for the rate series, IEEE80211_TX_RC_USE_SHORT_PREAMBLE is used. +*/ +if (tx_info->control.vif && + tx_info->control.vif->bss_conf.use_short_preamble) + short_preamble = true; + rate =ieee80211_get_rts_cts_rate (hw, tx_info); keytype =ath9k_cmn_get_hw_crypto_keytype (skb);if (sta)
@@ -1794,6 +1796,9 @@ static void setup_frame_info(struct ieee fi->keyix =ATH9K_TXKEYIX_INVALID ; fi->keytype = keytype; fi->framelen = framelen; + fi->rtscts_rate = rate->hw_value; +if (short_preamble) + fi->rtscts_rate |= rate->hw_value_short; }u8 ath_txchainmask_reduction (struct ath_softc *sc,u8 chainmask,u32 rate)
Greg Kroah-Hartman
maintainerPATCH 32/187 Revert "niu: Add support for byte queue limits."
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: "David S. Miller" <[email protected]>
[ Upstream commit 6a2b28ef036ab5c66fdc606fe97d9e5cb34ea409 ]
This reverts commit efa230f2c68abab817f13473077f8d0cc74f43f3.
BQL doesn't work with how this driver currently only takes TX interrupts every 1/4 of the TX ring. That behavior needs to be fixed, but that's a larger non-trivial task and for now we have to revert BQL support as this makes the device currently completely unusable.
--- drivers/net/ethernet/sun/niu.c | 12 +----------- 1 file changed, 1 insertion(+), 11 deletions(-)
drivers/net/ethernet/sun/niu.c +1 -11
@@ -3598,7 +3598,6 @@ static int release_tx_packet(struct niustatic void niu_tx_work (struct niu *np,struct tx_ring_info *rp) {struct netdev_queue *txq; -unsigned int tx_bytes;u16 pkt_cnt, tmp;int cons, index;u64 cs;
@@ -3621,18 +3620,12 @@ static void niu_tx_work(struct niu *np,netif_printk (np, tx_done,KERN_DEBUG , np->dev,"%s() pkt_cnt[%u] cons[%d]\n" , __func__, pkt_cnt, cons); - tx_bytes =0 ; - tmp = pkt_cnt; -while (tmp--) { - tx_bytes += rp->tx_buffs[cons].skb->len; +while (pkt_cnt--) cons =release_tx_packet (np, rp, cons); - } rp->cons = cons;smp_mb (); -netdev_tx_completed_queue (txq, pkt_cnt, tx_bytes); - out:if (unlikely (netif_tx_queue_stopped (txq) && (niu_tx_avail (rp) >NIU_TX_WAKEUP_THRESH (rp)))) {
@@ -4333,7 +4326,6 @@ static void niu_free_channels(struct niustruct tx_ring_info *rp = &np->tx_rings[i];niu_free_tx_ring_info (np, rp); -netdev_tx_reset_queue (netdev_get_tx_queue (np->dev, i)); }kfree (np->tx_rings); np->tx_rings =NULL ;
@@ -6739,8 +6731,6 @@ static netdev_tx_t niu_start_xmit(struct prod =NEXT_TX (rp, prod); } -netdev_tx_sent_queue (txq, skb->len); -if (prod < rp->prod) rp->wrap_bit ^=TX_RING_KICK_WRAP ; rp->prod = prod;
Greg Kroah-Hartman
maintainerPATCH 33/187 be2net: fix a race in be_xmit()
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit cd8f76c0a0c6fce0b2cf23c9bd0123f91453f46d ]
As soon as hardware is notified of a transmit, we no longer can assume skb can be dereferenced, as TX completion might have freed the packet.
--- drivers/net/ethernet/emulex/benet/be_main.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/net/ethernet/emulex/benet/be_main.c +3 -2
@@ -731,6 +731,8 @@ static netdev_tx_t be_xmit(struct sk_buf copied =make_tx_wrbs (adapter, txq, skb, wrb_cnt, dummy_wrb);if (copied) { +int gso_segs =skb_shinfo (skb)->gso_segs; +/* record the sent skb in the sent_skb table */ BUG_ON (txo->sent_skb_list[start]); txo->sent_skb_list[start] = skb;
@@ -748,8 +750,7 @@ static netdev_tx_t be_xmit(struct sk_bufbe_txq_notify (adapter, txq->id, wrb_cnt); -be_tx_stats_update (txo, wrb_cnt, copied, -skb_shinfo (skb)->gso_segs, stopped); +be_tx_stats_update (txo, wrb_cnt, copied, gso_segs, stopped); }else { txq->head = start;dev_kfree_skb_any (skb);
Greg Kroah-Hartman
maintainerPATCH 34/187 dummy: fix rcu_sched self-detected stalls
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 16b0dc29c1af9df341428f4c49ada4f626258082 ]
Trying to "modprobe dummy numdummies=30000" triggers :
INFO: rcu_sched self-detected stall on CPU { 8} (t=60000 jiffies)After this splat, RTNL is locked and reboot is needed.
We must call cond_resched() to avoid this, even holding RTNL.
--- drivers/net/dummy.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/dummy.c +3 -1
@@ -187,8 +187,10 @@ static int __init dummy_init_module(voidrtnl_lock (); err =__rtnl_link_register (&dummy_link_ops); -for (i =0 ; i < numdummies && !err; i++) +for (i =0 ; i < numdummies && !err; i++) { err =dummy_init_one (); +cond_resched (); + }if (err <0 )__rtnl_link_unregister (&dummy_link_ops);rtnl_unlock ();
Greg Kroah-Hartman
maintainerPATCH 35/187 bonding: Fix corrupted queue_mapping
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 5ee31c6898ea5537fcea160999d60dc63bc0c305 ]
In the transmit path of the bonding driver, skb->cb is used to stash the skb->queue_mapping so that the bonding device can set its own queue mapping. This value becomes corrupted since the skb->cb is also used in __dev_xmit_skb.
When transmitting through bonding driver, bond_select_queue is called from dev_queue_xmit. In bond_select_queue the original skb->queue_mapping is copied into skb->cb (via bond_queue_mapping) and skb->queue_mapping is overwritten with the bond driver queue.
Subsequently in dev_queue_xmit, __dev_xmit_skb is called which writes the packet length into skb->cb, thereby overwriting the stashed queue mappping. In bond_dev_queue_xmit (called from hard_start_xmit), the queue mapping for the skb is set to the stashed value which is now the skb length and hence is an invalid queue for the slave device.
If we want to save skb->queue_mapping into skb->cb[], best place is to add a field in struct qdisc_skb_cb, to make sure it wont conflict with other layers (eg : Qdiscc, Infiniband...)
This patchs also makes sure (struct qdisc_skb_cb)->data is aligned on 8 bytes :
netem qdisc for example assumes it can store an u64 in it, without misalignment penalty.
Note : we only have 20 bytes left in (struct qdisc_skb_cb)->data[]. The largest user is CHOKe and it fills it.
Based on a previous patch from Tom Herbert.
--- drivers/net/bonding/bond_main.c | 9 +++++---- include/net/sch_generic.h | 7 +++++-- 2 files changed, 10 insertions(+), 6 deletions(-)
drivers/net/bonding/bond_main.c +5 -4
@@ -76,6 +76,7 @@#include <net/route.h> #include <net/net_namespace.h> #include <net/netns/generic.h> +#include <net/pkt_sched.h> #include "bonding.h" #include "bond_3ad.h" #include "bond_alb.h"
@@ -381,8 +382,6 @@ struct vlan_entry *bond_next_vlan(structreturn next; } -#define bond_queue_mapping (skb) (*(u16 *)((skb)->cb)) -/** * bond_dev_queue_xmit - Prepare skb for xmit. *
@@ -395,7 +394,9 @@ int bond_dev_queue_xmit(struct bonding * { skb->dev = slave_dev; - skb->queue_mapping =bond_queue_mapping (skb); +BUILD_BUG_ON (sizeof (skb->queue_mapping) != +sizeof (qdisc_skb_cb (skb)->bond_queue_mapping)); + skb->queue_mapping =qdisc_skb_cb (skb)->bond_queue_mapping;if (unlikely (netpoll_tx_running (slave_dev)))bond_netpoll_send_skb (bond_get_slave_by_dev (bond, slave_dev), skb);
@@ -4162,7 +4163,7 @@ static u16 bond_select_queue(struct net_/* * Save the original txq to restore before passing to the driver */ -bond_queue_mapping (skb) = skb->queue_mapping; +qdisc_skb_cb (skb)->bond_queue_mapping = skb->queue_mapping;if (unlikely (txq >= dev->real_num_tx_queues)) { do {
include/net/sch_generic.h +5 -2
@@ -220,13 +220,16 @@ struct tcf_proto {struct qdisc_skb_cb {unsigned int pkt_len; -unsigned char data[24 ]; +u16 bond_queue_mapping; +u16 _pad; +unsigned char data[20 ]; };static inline void qdisc_cb_private_validate (const struct sk_buff *skb,int sz) {struct qdisc_skb_cb *qcb; -BUILD_BUG_ON (sizeof (skb->cb) <sizeof (unsigned int ) + sz); + +BUILD_BUG_ON (sizeof (skb->cb) < offsetof(struct qdisc_skb_cb , data) + sz);BUILD_BUG_ON (sizeof (qcb->data) < sz); }
Greg Kroah-Hartman
maintainerPATCH 36/187 netpoll: fix netpoll_send_udp() bugs
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 954fba0274058d27c7c07b5ea07c41b3b7477894 ]
Bogdan Hamciuc diagnosed and fixed following bug in netpoll_send_udp() :
"skb->len += len;" instead of "skb_put(skb, len);"
Meaning that _if_ a network driver needs to call skb_realloc_headroom(), only packet headers would be copied, leaving garbage in the payload.
However the skb_realloc_headroom() must be avoided as much as possible since it requires memory and netpoll tries hard to work even if memory is exhausted (using a pool of preallocated skbs)
It appears netpoll_send_udp() reserved 16 bytes for the ethernet header, which happens to work for typicall drivers but not all.
Right thing is to use LL_RESERVED_SPACE(dev)
(And also add dev->needed_tailroom of tailroom)
This patch combines both fixes.
Many thanks to Bogdan for raising this issue.
--- net/core/netpoll.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
net/core/netpoll.c +6 -5
@@ -362,22 +362,23 @@ EXPORT_SYMBOL(netpoll_send_skb_on_dev);void netpoll_send_udp (struct netpoll *np,const char *msg,int len) { -int total_len, eth_len, ip_len, udp_len; +int total_len, ip_len, udp_len;struct sk_buff *skb;struct udphdr *udph;struct iphdr *iph;struct ethhdr *eth; udp_len = len +sizeof (*udph); - ip_len = eth_len = udp_len +sizeof (*iph); - total_len = eth_len +ETH_HLEN +NET_IP_ALIGN ; + ip_len = udp_len +sizeof (*iph); + total_len = ip_len +LL_RESERVED_SPACE (np->dev); - skb =find_skb (np, total_len, total_len - len); + skb =find_skb (np, total_len + np->dev->needed_tailroom, + total_len - len);if (!skb)return ;skb_copy_to_linear_data (skb, msg, len); - skb->len += len; +skb_put (skb, len);skb_push (skb,sizeof (*udph));skb_reset_transport_header (skb);
Greg Kroah-Hartman
maintainerPATCH 37/187 bnx2x: fix checksum validation
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit d6cb3e41386f20fb0777d0b59a2def82c65d37f7 ]
bnx2x driver incorrectly sets ip_summed to CHECKSUM_UNNECESSARY on encapsulated segments. TCP stack happily accepts frames with bad checksums, if they are inside a GRE or IPIP encapsulation.
Our understanding is that if no IP or L4 csum validation was done by the hardware, we should leave ip_summed as is (CHECKSUM_NONE), since hardware doesn't provide CHECKSUM_COMPLETE support in its cqe.
Then, if IP/L4 checksumming was done by the hardware, set CHECKSUM_UNNECESSARY if no error was flagged.
Patch based on findings and analysis from Robert Evans
--- drivers/net/ethernet/broadcom/bnx2x/bnx2x.h | 15 ------------- drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 27 ++++++++++++++++++------ 2 files changed, 21 insertions(+), 21 deletions(-)
drivers/net/ethernet/broadcom/bnx2x/bnx2x.h +0 -15
@@ -744,21 +744,6 @@ struct bnx2x_fastpath {#define ETH_RX_ERROR_FALGS ETH_FAST_PATH_RX_CQE_PHY_DECODE_ERR_FLG -#define BNX2X_IP_CSUM_ERR (cqe) \ - (!((cqe)->fast_path_cqe.status_flags & \ - ETH_FAST_PATH_RX_CQE_IP_XSUM_NO_VALIDATION_FLG) && \ - ((cqe)->fast_path_cqe.type_error_flags & \ - ETH_FAST_PATH_RX_CQE_IP_BAD_XSUM_FLG)) - -#define BNX2X_L4_CSUM_ERR (cqe) \ - (!((cqe)->fast_path_cqe.status_flags & \ - ETH_FAST_PATH_RX_CQE_L4_XSUM_NO_VALIDATION_FLG) && \ - ((cqe)->fast_path_cqe.type_error_flags & \ - ETH_FAST_PATH_RX_CQE_L4_BAD_XSUM_FLG)) - -#define BNX2X_RX_CSUM_OK (cqe) \ - (!(BNX2X_L4_CSUM_ERR(cqe) || BNX2X_IP_CSUM_ERR(cqe))) -#define BNX2X_PRS_FLAG_OVERETH_IPV4 (flags) \ (((le16_to_cpu(flags) & \ PARSING_FLAGS_OVER_ETHERNET_PROTOCOL) >> \
drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +21 -6
@@ -568,6 +568,25 @@ drop: fp->eth_q_stats.rx_skb_alloc_failed++; } +static void bnx2x_csum_validate (struct sk_buff *skb,union eth_rx_cqe *cqe, +struct bnx2x_fastpath *fp) +{ +/* Do nothing if no IP/L4 csum validation was done */ + +if (cqe->fast_path_cqe.status_flags & + (ETH_FAST_PATH_RX_CQE_IP_XSUM_NO_VALIDATION_FLG | +ETH_FAST_PATH_RX_CQE_L4_XSUM_NO_VALIDATION_FLG )) +return ; + +/* If both IP/L4 validation were done, check if an error was found. */ + +if (cqe->fast_path_cqe.type_error_flags & + (ETH_FAST_PATH_RX_CQE_IP_BAD_XSUM_FLG | +ETH_FAST_PATH_RX_CQE_L4_BAD_XSUM_FLG )) + fp->eth_q_stats.hw_csum_err++; +else + skb->ip_summed =CHECKSUM_UNNECESSARY ; +}int bnx2x_rx_int (struct bnx2x_fastpath *fp,int budget) {
@@ -757,13 +776,9 @@ reuse_rx:skb_checksum_none_assert (skb); -if (bp->dev->features &NETIF_F_RXCSUM ) { +if (bp->dev->features &NETIF_F_RXCSUM ) +bnx2x_csum_validate (skb, cqe, fp); -if (likely (BNX2X_RX_CSUM_OK (cqe))) - skb->ip_summed =CHECKSUM_UNNECESSARY ; -else - fp->eth_q_stats.hw_csum_err++; - }skb_record_rx_queue (skb, fp->rx_queue);
Greg Kroah-Hartman
maintainerPATCH 38/187 bnx2x: fix panic when TX ring is full
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit bc14786a100cc6a81cd060e8031ec481241b418c ]
There is a off by one error in the minimal number of BD in bnx2x_start_xmit() and bnx2x_tx_int() before stopping/resuming tx queue.
A full size GSO packet, with data included in skb->head really needs (MAX_SKB_FRAGS + 4) BDs, because of bnx2x_tx_split()
This error triggers if BQL is disabled and heavy TCP transmit traffic occurs.
bnx2x_tx_split() definitely can be called, remove a wrong comment.
--- drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-)
drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +3 -5
@@ -191,7 +191,7 @@ int bnx2x_tx_int(struct bnx2x *bp, strucif ((netif_tx_queue_stopped (txq)) && (bp->state ==BNX2X_STATE_OPEN ) && - (bnx2x_tx_avail (bp, txdata) >=MAX_SKB_FRAGS +3 )) + (bnx2x_tx_avail (bp, txdata) >=MAX_SKB_FRAGS +4 ))netif_tx_wake_queue (txq);__netif_tx_unlock (txq);
@@ -2349,8 +2349,6 @@ int bnx2x_poll(struct napi_struct *napi,/* we split the first BD into headers and data BDs * to ease the pain of our fellow microcode engineers * we use one mapping for both BDs -* So far this has only been observed to happen -* in Other Operating Systems(TM) */ static noinline u16 bnx2x_tx_split(struct bnx2x *bp, struct bnx2x_fp_txdata *txdata,
@@ -3002,7 +3000,7 @@ netdev_tx_t bnx2x_start_xmit(struct sk_b txdata->tx_bd_prod += nbd; -if (unlikely (bnx2x_tx_avail (bp, txdata) <MAX_SKB_FRAGS +3 )) { +if (unlikely (bnx2x_tx_avail (bp, txdata) <MAX_SKB_FRAGS +4 )) {netif_tx_stop_queue (txq);/* paired memory barrier is in bnx2x_tx_int(), we have to keep
@@ -3011,7 +3009,7 @@ netdev_tx_t bnx2x_start_xmit(struct sk_bsmp_mb (); fp->eth_q_stats.driver_xoff++; -if (bnx2x_tx_avail (bp, txdata) >=MAX_SKB_FRAGS +3 ) +if (bnx2x_tx_avail (bp, txdata) >=MAX_SKB_FRAGS +4 )netif_tx_wake_queue (txq); } txdata->tx_pkt++;
Greg Kroah-Hartman
maintainerPATCH 39/187 net: remove skb_orphan_try()
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 62b1a8ab9b3660bb820d8dfe23148ed6cda38574 ]
Orphaning skb in dev_hard_start_xmit() makes bonding behavior unfriendly for applications sending big UDP bursts : Once packets pass the bonding device and come to real device, they might hit a full qdisc and be dropped. Without orphaning, the sender is automatically throttled because sk->sk_wmemalloc reaches sk->sk_sndbuf (assuming sk_sndbuf is not too big)
We could try to defer the orphaning adding another test in dev_hard_start_xmit(), but all this seems of little gain, now that BQL tends to make packets more likely to be parked in Qdisc queues instead of NIC TX ring, in cases where performance matters.
Reverts commits :fc6055a5ba31 net: Introduce skb_orphan_try() 87fd308cfc6b net: skb_tx_hash() fix relative to skb_orphan_try() and removes SKBTX_DRV_NEEDS_SK_REF flag
--- include/linux/skbuff.h | 7 ++----- net/can/raw.c | 3 --- net/core/dev.c | 23 +---------------------- net/iucv/af_iucv.c | 1 - 4 files changed, 3 insertions(+), 31 deletions(-)
include/linux/skbuff.h +2 -5
@@ -225,14 +225,11 @@ enum {/* device driver is going to provide hardware time stamp */ SKBTX_IN_PROGRESS =1 <<2 , -/* ensure the originating sk reference is available on driver level */ -SKBTX_DRV_NEEDS_SK_REF =1 <<3 , -/* device driver supports TX zero-copy buffers */ -SKBTX_DEV_ZEROCOPY =1 <<4 , +SKBTX_DEV_ZEROCOPY =1 <<3 ,/* generate wifi status information (where possible) */ - SKBTX_WIFI_STATUS = 1 << 5, + SKBTX_WIFI_STATUS = 1 << 4, };/*
net/can/raw.c +0 -3
@@ -681,9 +681,6 @@ static int raw_sendmsg(struct kiocb *iocif (err <0 ) goto free_skb; -/* to be able to check the received tx sock reference in raw_rcv() */ -skb_shinfo (skb)->tx_flags |=SKBTX_DRV_NEEDS_SK_REF ; - skb->dev = dev; skb->sk = sk;
net/core/dev.c +1 -22
@@ -2091,25 +2091,6 @@ static int dev_gso_segment(struct sk_bufreturn 0 ; } -/* -* Try to orphan skb early, right before transmission by the device. -* We cannot orphan skb if tx timestamp is requested or the sk-reference -* is needed on driver level for other reasons, e.g. see net/can/raw.c -*/ -static inline void skb_orphan_try (struct sk_buff *skb) -{ -struct sock *sk = skb->sk; - -if (sk && !skb_shinfo (skb)->tx_flags) { -/* skb_tx_hash() wont be able to get sk. -* We copy sk_hash into skb->rxhash -*/ -if (!skb->rxhash) - skb->rxhash = sk->sk_hash; -skb_orphan (skb); - } -} -static bool can_checksum_protocol (netdev_features_t features,__be16 protocol) { return ((features & NETIF_F_GEN_CSUM) ||
@@ -2195,8 +2176,6 @@ int dev_hard_start_xmit(struct sk_buff *if (!list_empty (&ptype_all))dev_queue_xmit_nit (skb, dev); -skb_orphan_try (skb); - features =netif_skb_features (skb); if (vlan_tx_tag_present(skb) &&
@@ -2306,7 +2285,7 @@ u16 __skb_tx_hash(const struct net_devicif (skb->sk && skb->sk->sk_hash) hash = skb->sk->sk_hash;else - hash = (__force u16 ) skb->protocol ^ skb->rxhash; + hash = (__force u16 ) skb->protocol; hash =jhash_1word (hash, hashrnd);return (u16) (((u64 ) hash * qcount) >>32 ) + qoffset;
net/iucv/af_iucv.c +0 -1
@@ -372,7 +372,6 @@ static int afiucv_hs_send(struct iucv_meskb_trim (skb, skb->dev->mtu); } skb->protocol =ETH_P_AF_IUCV ; -skb_shinfo (skb)->tx_flags |=SKBTX_DRV_NEEDS_SK_REF ; nskb =skb_clone (skb,GFP_ATOMIC );if (!nskb)return -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 40/187 bridge: Assign rtnl_link_ops to bridge devices created via ioctl (v2)
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: stephen hemminger <[email protected]>
[ Upstream commit 149ddd83a92b02c658d6c61f3276eb6500d585e8 ]
This ensures that bridges created with brctl(8) or ioctl(2) directly also carry IFLA_LINKINFO when dumped over netlink. This also allows to create a bridge with ioctl(2) and delete it with RTM_DELLINK.
--- net/bridge/br_if.c | 1 + net/bridge/br_netlink.c | 2 +- net/bridge/br_private.h | 1 + 3 files changed, 3 insertions(+), 1 deletion(-)
net/bridge/br_if.c +1 -0
@@ -240,6 +240,7 @@ int br_add_bridge(struct net *net, constreturn -ENOMEM ;dev_net_set (dev, net); + dev->rtnl_link_ops = &br_link_ops; res =register_netdev (dev);if (res)
net/bridge/br_netlink.c +1 -1
@@ -211,7 +211,7 @@ static int br_validate(struct nlattr *tbreturn 0 ; } -static struct rtnl_link_ops br_link_ops__read_mostly = { +struct rtnl_link_ops br_link_ops__read_mostly = { .kind ="bridge" , .priv_size =sizeof (struct net_bridge ), .setup = br_dev_setup,
net/bridge/br_private.h +1 -0
@@ -538,6 +538,7 @@ extern int (*br_fdb_test_addr_hook)(stru#endif /* br_netlink.c */ +extern struct rtnl_link_ops br_link_ops;extern int br_netlink_init (void );extern void br_netlink_fini (void );extern void br_ifinfo_notify (int event,struct net_bridge_port *port);
Greg Kroah-Hartman
maintainerPATCH 41/187 xen/netfront: teardown the device before unregistering it.
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Campbell <[email protected]>
[ Upstream commit 6bc96d047fe32d76ef79f3195c52a542edf7c705 ]
Fixes:
[ 15.470311] WARNING: at /local/scratch/ianc/devel/kernels/linux/fs/sysfs/file.c:498 sysfs_attr_ns+0x95/0xa0() [ 15.470326] sysfs: kobject eth0 without dirent [ 15.470333] Modules linked in: [ 15.470342] Pid: 12, comm: xenwatch Not tainted 3.4.0-x86_32p-xenU #93 and [ 9.150554] BUG: unable to handle kernel paging request at 2b359000 [ 9.150577] IP: [<c1279561>] linkwatch_do_dev+0x81/0xc0 [ 9.150592] *pdpt = 000000002c3c9027 *pde = 0000000000000000 [ 9.150604] Oops: 0002 [#1] SMP [ 9.150613] Modules linked in:
This is http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=675190
--- drivers/net/xen-netfront.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/net/xen-netfront.c +4 -4
@@ -1935,14 +1935,14 @@ static int __devexit xennet_remove(strucdev_dbg (&dev->dev,"%s\n" , dev->nodename); -unregister_netdev (info->netdev); -xennet_disconnect_backend (info); -del_timer_sync (&info->rx_refill_timer); -xennet_sysfs_delif (info->netdev); +unregister_netdev (info->netdev); + +del_timer_sync (&info->rx_refill_timer); +free_percpu (info->stats);free_netdev (info->netdev);
Greg Kroah-Hartman
maintainerPATCH 42/187 mm: fix slab->page _count corruption when using slub
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pravin B Shelar <[email protected]>
commit abca7c4965845924f65d40e0aa1092bdd895e314 upstream.
On arches that do not support this_cpu_cmpxchg_double() slab_lock is used to do atomic cmpxchg() on double word which contains page->_count. The page count can be changed from get_page() or put_page() without taking slab_lock. That corrupts page counter.
Fix it by moving page->_count out of cmpxchg_double data. So that slub does no change it while updating slub meta-data in struct page.
--- include/linux/mm_types.h | 10 ++++++++++ 1 file changed, 10 insertions(+)
include/linux/mm_types.h +10 -0
@@ -56,8 +56,18 @@ struct page { };union { +#if defined(CONFIG_HAVE_CMPXCHG_DOUBLE ) && \ + defined(CONFIG_HAVE_ALIGNED_STRUCT_PAGE )/* Used for cmpxchg_double in slub */ unsigned long counters; +#else +/* +* Keep _count separate from slub cmpxchg_double data. +* As the rest of the double word is protected by +* slab_lock but _count is not. +*/ +unsigned counters; +#endif struct {
Greg Kroah-Hartman
maintainerPATCH 43/187 powerpc: More fixes for lazy IRQ vs. idle
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Herrenschmidt <[email protected]>
commit be2cf20a5ad31ebb13562c1c866ecc626fbd721e upstream.
Looks like we still have issues with pSeries and Cell idle code vs. the lazy irq state. In fact, the reset fixes that went upstream are exposing the problem more by causing BUG_ON() to trigger (which this patch turns into a WARN_ON instead).
We need to be careful when using a variant of low power state that has the side effect of turning interrupts back on, to properly set all the SW & lazy state to look as if everything is enabled before we enter the low power state with MSR:EE off as we will return with MSR:EE on. If not, we have a discrepancy of state which can cause things to go very wrong later on.
This patch moves the logic into a helper and uses it from the pseries and cell idle code. The power4/970 idle code already got things right (in assembly even !) so I'm not touching it. The power7 "bare metal" idle code is subtly different and correct. Remains PA6T and some hypervisor based Cell platforms which have questionable code in there, but they are mostly dead platforms so I'll fix them when I manage to get final answers from the respective maintainers about how the low power state actually works on them.
--- arch/powerpc/include/asm/hw_irq.h | 2 + arch/powerpc/kernel/irq.c | 46 ++++++++++++++++++++++++ arch/powerpc/platforms/cell/pervasive.c | 11 +++-- arch/powerpc/platforms/pseries/processor_idle.c | 17 +++++--- 4 files changed, 64 insertions(+), 12 deletions(-)
arch/powerpc/include/asm/hw_irq.h +2 -0
@@ -124,6 +124,8 @@ static inline bool arch_irq_disabled_reg return !regs->softe; } +extern bool prep_irq_for_idle (void ); +#else /* CONFIG_PPC64 */ #define SET_MSR_EE (x) mtmsr(x)
arch/powerpc/kernel/irq.c +46 -0
52 lines not on this page · raw message
arch/powerpc/platforms/cell/pervasive.c +6 -5
@@ -42,11 +42,9 @@ static void cbe_power_save(void) {unsigned long ctrl, thread_switch_control; -/* -* We need to hard disable interrupts, the local_irq_enable() done by -* our caller upon return will hard re-enable. -*/ -hard_irq_disable (); +/* Ensure our interrupt state is properly tracked */ +if (!prep_irq_for_idle ()) +return ; ctrl =mfspr (SPRN_CTRLF );
@@ -81,6 +79,9 @@ static void cbe_power_save(void)*/ ctrl &= ~(CTRL_RUNLATCH |CTRL_TE );mtspr (SPRN_CTRLT , ctrl); + +/* Re-enable interrupts in MSR */ +__hard_irq_enable (); }static int cbe_system_reset_exception (struct pt_regs *regs)
arch/powerpc/platforms/pseries/processor_idle.c +10 -7
@@ -99,15 +99,18 @@ out:static void check_and_cede_processor (void ) {/* -* Interrupts are soft-disabled at this point, -* but not hard disabled. So an interrupt might have -* occurred before entering NAP, and would be potentially -* lost (edge events, decrementer events, etc...) unless -* we first hard disable then check. +* Ensure our interrupt state is properly tracked, +* also checks if no interrupt has occurred while we +* were soft-disabled */ -hard_irq_disable (); -if (!lazy_irq_pending ()) +if (prep_irq_for_idle ()) {cede_processor (); +#ifdef CONFIG_TRACE_IRQFLAGS +/* Ensure that H_CEDE returns with IRQs on */ +if (WARN_ON (!(mfmsr () &MSR_EE ))) +__hard_irq_enable (); +#endif + } } static int dedicated_cede_loop(struct cpuidle_device *dev,
Greg Kroah-Hartman
maintainerPATCH 44/187 powerpc: Fix build of some debug irq code
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Herrenschmidt <[email protected]>
commit 21b2de341270bd7bb7a811027ffe63276d9b3b75 upstream.
There was a typo, checking for CONFIG_TRACE_IRQFLAG instead of CONFIG_TRACE_IRQFLAGS causing some useful debug code to not be built
This in turns causes a build error on BookE 64-bit due to incorrect semicolons at the end of a couple of macros, so let's fix that too
--- arch/powerpc/include/asm/hw_irq.h | 4 ++-- arch/powerpc/kernel/irq.c | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-)
arch/powerpc/include/asm/hw_irq.h +2 -2
@@ -85,8 +85,8 @@ static inline bool arch_irqs_disabled(vo }#ifdef CONFIG_PPC_BOOK3E -#define __hard_irq_enable () asm volatile("wrteei 1" : : : "memory"); -#define __hard_irq_disable () asm volatile("wrteei 0" : : : "memory"); +#define __hard_irq_enable () asm volatile("wrteei 1" : : : "memory") +#define __hard_irq_disable () asm volatile("wrteei 0" : : : "memory")#else #define __hard_irq_enable () __mtmsrd(local_paca->kernel_msr | MSR_EE, 1)#define __hard_irq_disable () __mtmsrd(local_paca->kernel_msr, 1)
arch/powerpc/kernel/irq.c +1 -1
@@ -229,7 +229,7 @@ notrace void arch_local_irq_restore(unsi*/ if (unlikely (irq_happened !=PACA_IRQ_HARD_DIS ))__hard_irq_disable (); -#ifdef CONFIG_TRACE_IRQFLAG +#ifdef CONFIG_TRACE_IRQFLAGS else {/* * We should already be hard disabled here. We had bugs
Greg Kroah-Hartman
maintainerPATCH 45/187 NFC: Return from rawsock_release when sk is NULL
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
commit 03e934f620101ca2cfc9383bd76172dd3e1f8567 upstream.
Sasha Levin reported following panic :
[ 2136.383310] BUG: unable to handle kernel NULL pointer dereference at 00000000000003b0 [ 2136.384022] IP: [<ffffffff8114e400>] __lock_acquire+0xc0/0x4b0 [ 2136.384022] PGD 131c4067 PUD 11c0c067 PMD 0 [ 2136.388106] Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC [ 2136.388106] CPU 1 [ 2136.388106] Pid: 24855, comm: trinity-child1 Tainted: G W 3.5.0-rc2-sasha-00015-g7b268f7 #374 [ 2136.388106] RIP: 0010:[<ffffffff8114e400>] [<ffffffff8114e400>] __lock_acquire+0xc0/0x4b0 [ 2136.388106] RSP: 0018:ffff8800130b3ca8 EFLAGS: 00010046 [ 2136.388106] RAX: 0000000000000086 RBX: ffff88001186b000 RCX: 0000000000000000 [ 2136.388106] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 2136.388106] RBP: ffff8800130b3d08 R08: 0000000000000001 R09: 0000000000000000 [ 2136.388106] R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000002 [ 2136.388106] R13: 00000000000003b0 R14: 0000000000000000 R15: 0000000000000000 [ 2136.388106] FS: 00007fa5b1bd4700(0000) GS:ffff88001b800000(0000) knlGS:0000000000000000 [ 2136.388106] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2136.388106] CR2: 00000000000003b0 CR3: 0000000011d1f000 CR4: 00000000000406e0 [ 2136.388106] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 2136.388106] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 2136.388106] Process trinity-child1 (pid: 24855, threadinfo ffff8800130b2000, task ffff88001186b000) [ 2136.388106] Stack: [ 2136.388106] ffff8800130b3cd8 ffffffff81121785 ffffffff81236774 000080d000000001 [ 2136.388106] ffff88001b9d6c00 00000000001d6c00 ffffffff130b3d08 ffff88001186b000 [ 2136.388106] 0000000000000000 0000000000000002 0000000000000000 0000000000000000 [ 2136.388106] Call Trace: [ 2136.388106] [<ffffffff81121785>] ? sched_clock_local+0x25/0x90 [ 2136.388106] [<ffffffff81236774>] ? get_empty_filp+0x74/0x220 [ 2136.388106] [<ffffffff8114e97a>] lock_acquire+0x18a/0x1e0 [ 2136.388106] [<ffffffff836b37df>] ? rawsock_release+0x4f/0xa0 [ 2136.388106] [<ffffffff837c0ef0>] _raw_write_lock_bh+0x40/0x80 [ 2136.388106] [<ffffffff836b37df>] ? rawsock_release+0x4f/0xa0 [ 2136.388106] [<ffffffff836b37df>] rawsock_release+0x4f/0xa0 [ 2136.388106] [<ffffffff8321cfe8>] sock_release+0x18/0x70 [ 2136.388106] [<ffffffff8321d069>] sock_close+0x29/0x30 [ 2136.388106] [<ffffffff81236bca>] __fput+0x11a/0x2c0 [ 2136.388106] [<ffffffff81236d85>] fput+0x15/0x20 [ 2136.388106] [<ffffffff8321de34>] sys_accept4+0x1b4/0x200 [ 2136.388106] [<ffffffff837c165c>] ? _raw_spin_unlock_irq+0x4c/0x80 [ 2136.388106] [<ffffffff837c1669>] ? _raw_spin_unlock_irq+0x59/0x80 [ 2136.388106] [<ffffffff837c2565>] ? sysret_check+0x22/0x5d [ 2136.388106] [<ffffffff8321de8b>] sys_accept+0xb/0x10 [ 2136.388106] [<ffffffff837c2539>] system_call_fastpath+0x16/0x1b [ 2136.388106] Code: ec 04 00 0f 85 ea 03 00 00 be d5 0b 00 00 48 c7 c7 8a c1 40 84 e8 b1 a5 f8 ff 31 c0 e9 d4 03 00 00 66 2e 0f 1f 84 00 00 00 00 00 <49> 81 7d 00 60 73 5e 85 b8 01 00 00 00 44 0f 44 e0 83 fe 01 77 [ 2136.388106] RIP [<ffffffff8114e400>] __lock_acquire+0xc0/0x4b0 [ 2136.388106] RSP <ffff8800130b3ca8> [ 2136.388106] CR2: 00000000000003b0 [ 2136.388106] ---[ end trace 6d450e935ee18982 ]--- [ 2136.388106] Kernel panic - not syncing: Fatal exception in interrupt
rawsock_release() should test if sock->sk is NULL before calling sock_orphan()/sock_put()
--- net/nfc/rawsock.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
net/nfc/rawsock.c +4 -1
@@ -54,7 +54,10 @@ static int rawsock_release(struct socket {struct sock *sk = sock->sk; -pr_debug ("sock=%p\n" , sock); +pr_debug ("sock=%p sk=%p\n" , sock, sk); + +if (!sk) +return 0 ;sock_orphan (sk);sock_put (sk);
Greg Kroah-Hartman
maintainerPATCH 46/187 NFC: Prevent multiple buffer overflows in NCI
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Rosenberg <[email protected]>
commit 67de956ff5dc1d4f321e16cfbd63f5be3b691b43 upstream.
Fix multiple remotely-exploitable stack-based buffer overflows due to the NCI code pulling length fields directly from incoming frames and copying too much data into statically-sized arrays.
--- net/nfc/nci/ntf.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
net/nfc/nci/ntf.c +5 -5
@@ -106,7 +106,7 @@ static __u8 *nci_extract_rf_params_nfca_ nfca_poll->sens_res =__le16_to_cpu (*((__u16 *)data)); data +=2 ; - nfca_poll->nfcid1_len = *data++; + nfca_poll->nfcid1_len =min_t (__u8, *data++,NFC_NFCID1_MAXSIZE );pr_debug ("sens_res 0x%x, nfcid1_len %d\n" , nfca_poll->sens_res, nfca_poll->nfcid1_len);
@@ -130,7 +130,7 @@ static __u8 *nci_extract_rf_params_nfcb_struct rf_tech_specific_params_nfcb_poll *nfcb_poll, __u8 *data) { - nfcb_poll->sensb_res_len = *data++; + nfcb_poll->sensb_res_len = min_t(__u8, *data++, NFC_SENSB_RES_MAXSIZE);pr_debug ("sensb_res_len %d\n" , nfcb_poll->sensb_res_len);
@@ -145,7 +145,7 @@ static __u8 *nci_extract_rf_params_nfcf_ __u8 *data) { nfcf_poll->bit_rate = *data++; - nfcf_poll->sensf_res_len = *data++; + nfcf_poll->sensf_res_len =min_t (__u8, *data++,NFC_SENSF_RES_MAXSIZE );pr_debug ("bit_rate %d, sensf_res_len %d\n" , nfcf_poll->bit_rate, nfcf_poll->sensf_res_len);
@@ -331,7 +331,7 @@ static int nci_extract_activation_paramsswitch (ntf->activation_rf_tech_and_mode) {case NCI_NFC_A_PASSIVE_POLL_MODE : nfca_poll = &ntf->activation_params.nfca_poll_iso_dep; - nfca_poll->rats_res_len = *data++; + nfca_poll->rats_res_len =min_t (__u8, *data++,20 );pr_debug ("rats_res_len %d\n" , nfca_poll->rats_res_len);if (nfca_poll->rats_res_len >0 ) { memcpy(nfca_poll->rats_res,
@@ -341,7 +341,7 @@ static int nci_extract_activation_paramscase NCI_NFC_B_PASSIVE_POLL_MODE : nfcb_poll = &ntf->activation_params.nfcb_poll_iso_dep; - nfcb_poll->attrib_res_len = *data++; + nfcb_poll->attrib_res_len =min_t (__u8, *data++,50 );pr_debug ("attrib_res_len %d\n" , nfcb_poll->attrib_res_len);if (nfcb_poll->attrib_res_len >0 ) { memcpy(nfcb_poll->attrib_res,
Greg Kroah-Hartman
maintainerPATCH 47/187 hwmon: (applesmc) Limit key length in warning messages
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Henrik Rydberg <[email protected]>
commit ac852edb47b15900886ba2564eeeb13b3b526e3e upstream.
Key lookups may call read_smc() with a fixed-length key string, and if the lookup fails, trailing stack content may appear in the kernel log. Fixed with this patch.
--- drivers/hwmon/applesmc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/hwmon/applesmc.c +2 -2
@@ -215,7 +215,7 @@ static int read_smc(u8 cmd, const char *int i;if (send_command (cmd) ||send_argument (key)) { -pr_warn ("%s: read arg fail\n" , key); +pr_warn ("%.4s: read arg fail\n" , key);return -EIO ; }
@@ -223,7 +223,7 @@ static int read_smc(u8 cmd, const char *for (i =0 ; i < len; i++) {if (__wait_status (0x05 )) { -pr_warn ("%s: read data fail\n" , key); +pr_warn ("%.4s: read data fail\n" , key);return -EIO ; } buffer[i] =inb (APPLESMC_DATA_PORT );
Greg Kroah-Hartman
maintainerPATCH 48/187 staging: r8712u: Add new USB IDs
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lubomir Schmidt <[email protected]>
commit 3026b0e942c65c65c8fc80d391d004228b52b916 upstream.
There are two new devices for this driver.
--- drivers/staging/rtl8712/usb_intf.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/staging/rtl8712/usb_intf.c +2 -0
@@ -102,6 +102,8 @@ static struct usb_device_id rtl871x_usb_/* - */ {USB_DEVICE(0x20F4, 0x646B)}, {USB_DEVICE(0x083A, 0xC512)}, + {USB_DEVICE(0x25D4, 0x4CA1)}, + {USB_DEVICE(0x25D4, 0x4CAB)},/* RTL8191SU */ /* Realtek */
Greg Kroah-Hartman
maintainerPATCH 49/187 nilfs2: ensure proper cache clearing for gc-inodes
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryusuke Konishi <[email protected]>
commit fbb24a3a915f105016f1c828476be11aceac8504 upstream.
A gc-inode is a pseudo inode used to buffer the blocks to be moved by garbage collection.
Block caches of gc-inodes must be cleared every time a garbage collection function (nilfs_clean_segments) completes. Otherwise, stale blocks buffered in the caches may be wrongly reused in successive calls of the GC function.
For user files, this is not a problem because their gc-inodes are distinguished by a checkpoint number as well as an inode number. They never buffer different blocks if either an inode number, a checkpoint number, or a block offset differs.
However, gc-inodes of sufile, cpfile and DAT file can store different data for the same block offset. Thus, the nilfs_clean_segments function can move incorrect block for these meta-data files if an old block is cached. I found this is really causing meta-data corruption in nilfs.
This fixes the issue by ensuring cache clear of gc-inodes and resolves reported GC problems including checkpoint file corruption, b-tree corruption, and the following warning during GC.
nilfs_palloc_freev: entry number 307234 already freed.
...
--- fs/nilfs2/gcinode.c | 2 ++ fs/nilfs2/segment.c | 2 ++ 2 files changed, 4 insertions(+)
fs/nilfs2/gcinode.c +2 -0
@@ -191,6 +191,8 @@ void nilfs_remove_all_gcinodes(struct thwhile (!list_empty (head)) { ii = list_first_entry(head, struct nilfs_inode_info, i_dirty);list_del_init (&ii->i_dirty); +truncate_inode_pages (&ii->vfs_inode.i_data,0 ); +nilfs_btnode_cache_clear (&ii->i_btnode_cache);iput (&ii->vfs_inode); } }
fs/nilfs2/segment.c +2 -0
@@ -2309,6 +2309,8 @@ nilfs_remove_written_gcinodes(struct theif (!test_bit (NILFS_I_UPDATED , &ii->i_state))continue ;list_del_init (&ii->i_dirty); +truncate_inode_pages (&ii->vfs_inode.i_data,0 ); +nilfs_btnode_cache_clear (&ii->i_btnode_cache);iput (&ii->vfs_inode); } }
Greg Kroah-Hartman
maintainerPATCH 50/187 udf: Use ret instead of abusing i in udf_load_logicalvol()
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
commit cb14d340ef1737c24125dd663eff77734a482d47 upstream.
--- fs/udf/super.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
fs/udf/super.c +2 -4
@@ -1233,11 +1233,9 @@ static int udf_load_logicalvol(struct suBUG_ON (ident !=TAG_IDENT_LVD ); lvd = (struct logicalVolDesc *)bh->b_data; - i =udf_sb_alloc_partition_maps (sb,le32_to_cpu (lvd->numPartitionMaps)); -if (i !=0 ) { - ret = i; + ret =udf_sb_alloc_partition_maps (sb,le32_to_cpu (lvd->numPartitionMaps)); +if (ret) goto out_bh; - } for (i = 0, offset = 0; i < sbi->s_partitions && offset < le32_to_cpu(lvd->mapTableLength);
Greg Kroah-Hartman
maintainer=?y?q?=5B=20107/187=5D=20USB=3A=20qmi=5Fwwan=3A=20Add=20ZTE=20=28Vodafone=29=20K3520-Z?=
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Andrew Bird (Sphere Systems)" <[email protected]>
commit f7142e6c226076fd40c2ebaad9fb0c9a631b790e upstream.
--- drivers/net/usb/qmi_wwan.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
drivers/net/usb/qmi_wwan.c +18 -0
@@ -356,6 +356,15 @@ static const struct driver_info qmi_wwan };/* ZTE suck at making USB descriptors */ +static const struct driver_info qmi_wwan_force_int1 = { + .description ="Qualcomm WWAN/QMI device" , + .flags =FLAG_WWAN , + .bind = qmi_wwan_bind_shared, + .unbind = qmi_wwan_unbind_shared, + .manage_power = qmi_wwan_manage_power, + .data =BIT (1 ),/* interface whitelist bitmap */ +}; +static const struct driver_info qmi_wwan_force_int4 = { .description ="Qualcomm WWAN/QMI device" , .flags =FLAG_WWAN ,
@@ -430,6 +439,15 @@ static const struct usb_device_id produc .bInterfaceProtocol = 0xff, .driver_info = (unsigned long)&qmi_wwan_force_int4, }, + {/* ZTE (Vodafone) K3520-Z */ + .match_flags = USB_DEVICE_ID_MATCH_DEVICE | USB_DEVICE_ID_MATCH_INT_INFO, + .idVendor = 0x19d2, + .idProduct = 0x0055, + .bInterfaceClass = 0xff, + .bInterfaceSubClass = 0xff, + .bInterfaceProtocol = 0xff, + .driver_info = (unsigned long)&qmi_wwan_force_int1, + }, { /* ZTE (Vodafone) K3565-Z */ .match_flags = USB_DEVICE_ID_MATCH_DEVICE | USB_DEVICE_ID_MATCH_INT_INFO, .idVendor = 0x19d2,
Greg Kroah-Hartman
maintainer=?y?q?=5B=20106/187=5D=20USB=3A=20qmi=5Fwwan=3A=20Make=20forced=20int=204=20whitelist=20generic?=
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Andrew Bird (Sphere Systems)" <[email protected]>
commit 00001880cd8faaa349fe2ebb158f7e0cd8026048 upstream.
Change the forced interface 4 whitelist to use the generic shared binder instead of the Gobi specific one. Certain ZTE devices (K3520-Z & K3765-Z) don't work with the Gobi version, but function quite happily with the generic. This has been tested with the following devices:
K3520-Z
K3565-Z
K3765-Z
K4505-Z
It hasn't been tested with the ZTE MF820D, which is the only other device that uses this whitelist at present. Although Bjorn doesn't expect any problems, any testing with that device would be appreciated.
--- drivers/net/usb/qmi_wwan.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/usb/qmi_wwan.c +2 -2
@@ -357,9 +357,9 @@ static const struct driver_info qmi_wwan/* ZTE suck at making USB descriptors */ static const struct driver_info qmi_wwan_force_int4 = { - .description ="Qualcomm Gobi wwan/QMI device" , + .description ="Qualcomm WWAN/QMI device" , .flags =FLAG_WWAN , - .bind = qmi_wwan_bind_gobi, + .bind = qmi_wwan_bind_shared, .unbind = qmi_wwan_unbind_shared, .manage_power = qmi_wwan_manage_power, .data =BIT (4 ),/* interface whitelist bitmap */
Greg Kroah-Hartman
maintainer=?y?q?=5B=20109/187=5D=20net=3A=20qmi=5Fwwan=3A=20fix=20Oops=20while=20disconnecting?=
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <[email protected]>
commit d9b8706843a501034d09bea63ca6723a2ed02b11 upstream.
usbnet_disconnect() will set intfdata to NULL before calling the minidriver unbind function. The cdc_wdm subdriver cannot know that it is disconnecting until the qmi_wwan unbind function has called its disconnect function. This means that we must be able to support the cdc_wdm subdriver operating normally while usbnet_disconnect() is running, and in particular that intfdata may be NULL.
The only place this matters is in qmi_wwan_cdc_wdm_manage_power which is called from cdc_wdm. Simply testing for NULL intfdata there is sufficient to allow it to continue working at all times.
Fixes this Oops where a cdc-wdm device was closed while the USB device was disconnecting, causing wdm_release to call qmi_wwan_cdc_wdm_manage_power after intfdata was set to NULL by usbnet_disconnect:
[41819.087460] BUG: unable to handle kernel NULL pointer dereference at 00000080 [41819.087815] IP: [<f8640458>] qmi_wwan_manage_power+0x68/0x90 [qmi_wwan] [41819.088028] *pdpt = 000000000314f001 *pde = 0000000000000000 [41819.088028] Oops: 0002 [#1] SMP [41819.088028] Modules linked in: qmi_wwan option usb_wwan usbserial usbnet
cdc_wdm nls_iso8859_1 nls_cp437 vfat fat usb_storage bnep rfcomm bluetooth parport_pc ppdev binfmt_misc iptable_nat nf_nat nf_conntrack_ipv4 nf_conntrack nf_defrag_ipv4 iptable_mangle iptable_filter ip_tables x_tables dm_crypt uvcvideo snd_hda_codec_realtek snd_hda_intel videobuf2_core snd_hda_codec joydev videodev videobuf2_vmalloc hid_multitouch snd_hwdep arc4 videobuf2_memops snd_pcm snd_seq_midi snd_rawmidi snd_seq_midi_event ath9k mac80211 snd_seq ath9k_common ath9k_hw ath snd_timer snd_seq_device sparse_keymap dm_multipath scsi_dh coretemp mac_hid snd soundcore cfg80211 snd_page_alloc psmouse serio_raw microcode lp parport dm_mirror dm_region_hash dm_log usbhid hid i915 drm_kms_helper drm r8169 i2c_algo_bit wmi video [last unloaded: qmi_wwan]
[41819.088028] [41819.088028] Pid: 23292, comm: qmicli Not tainted 3.4.0-5-generic #11-Ubuntu GIGABYTE T1005/T1005 [41819.088028] EIP: 0060:[<f8640458>] EFLAGS: 00010246 CPU: 1 [41819.088028] EIP is at qmi_wwan_manage_power+0x68/0x90 [qmi_wwan] [41819.088028] EAX: 00000000 EBX: 00000000 ECX: 000000c3 EDX: 00000000 [41819.088028] ESI: c3b27658 EDI: 00000000 EBP: c298bea4 ESP: c298be98 [41819.088028] DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068 [41819.088028] CR0: 8005003b CR2: 00000080 CR3: 3605e000 CR4: 000007f0 [41819.088028] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000 [41819.088028] DR6: ffff0ff0 DR7: 00000400 [41819.088028] Process qmicli (pid: 23292, ti=c298a000 task=f343b280 task.ti=c298a000) [41819.088028] Stack: [41819.088028] 00000000 c3b27658 e2a80d00 c298beb0 f864051a c3b27600 c298bec0 f9027099 [41819.088028] c2fd6000 00000008 c298bef0 c1147f96 00000001 00000000 00000000 f4e54790 [41819.088028] ecf43a00 ecf43a00 c2fd6008 c2fd6000 ebbd7600 ffffffb9 c298bf08 c1144474 [41819.088028] Call Trace: [41819.088028] [<f864051a>] qmi_wwan_cdc_wdm_manage_power+0x1a/0x20 [qmi_wwan] [41819.088028] [<f9027099>] wdm_release+0x69/0x70 [cdc_wdm] [41819.088028] [<c1147f96>] fput+0xe6/0x210 [41819.088028] [<c1144474>] filp_close+0x54/0x80 [41819.088028] [<c1046a65>] put_files_struct+0x75/0xc0 [41819.088028] [<c1046b56>] exit_files+0x46/0x60 [41819.088028] [<c1046f81>] do_exit+0x141/0x780 [41819.088028] [<c107248f>] ? wake_up_state+0xf/0x20 [41819.088028] [<c1053f48>] ? signal_wake_up+0x28/0x40 [41819.088028] [<c1054f3b>] ? zap_other_threads+0x6b/0x80 [41819.088028] [<c1047864>] do_group_exit+0x34/0xa0 [41819.088028] [<c10478e8>] sys_exit_group+0x18/0x20 [41819.088028] [<c15bb7df>] sysenter_do_call+0x12/0x28 [41819.088028] Code: 04 83 e7 01 c1 e7 03 0f b6 42 18 83 e0 f7 09 f8 88 42 18 8b 43 04 e8 48 9a dd c8 89 f0 8b 5d f4 8b 75 f8 8b 7d fc 89 ec 5d c3 90 <f0> ff 88 80 00 00 00 0f 94 c0 84 c0 75 b7 31 f6 8b 5d f4 89 f0 [41819.088028] EIP: [<f8640458>] qmi_wwan_manage_power+0x68/0x90 [qmi_wwan] SS:ESP 0068:c298be98 [41819.088028] CR2: 0000000000000080 [41819.149492] ---[ end trace 0944479ff8257f55 ]---
--- drivers/net/usb/qmi_wwan.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/usb/qmi_wwan.c +4 -0
@@ -197,6 +197,10 @@ err:static int qmi_wwan_cdc_wdm_manage_power (struct usb_interface *intf,int on) {struct usbnet *dev =usb_get_intfdata (intf); + +/* can be called while disconnecting */ +if (!dev) +return 0 ;return qmi_wwan_manage_power (dev, on); }
Greg Kroah-Hartman
maintainerPATCH 51/187 udf: Avoid run away loop when partition table length is corrupted
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
commit adee11b2085bee90bd8f4f52123ffb07882d6256 upstream.
Check provided length of partition table so that (possibly maliciously) corrupted partition table cannot cause accessing data beyond current buffer.
--- fs/udf/super.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
fs/udf/super.c +9 -1
@@ -1225,6 +1225,7 @@ static int udf_load_logicalvol(struct sustruct genericPartitionMap *gpm;uint16_t ident;struct buffer_head *bh; +unsigned int table_len;int ret =0 ; bh =udf_read_tagged (sb, block, block, &ident);
@@ -1232,13 +1233,20 @@ static int udf_load_logicalvol(struct sureturn 1 ;BUG_ON (ident !=TAG_IDENT_LVD ); lvd = (struct logicalVolDesc *)bh->b_data; + table_len =le32_to_cpu (lvd->mapTableLength); +if (sizeof (*lvd) + table_len > sb->s_blocksize) { +udf_err (sb,"error loading logical volume descriptor: " +"Partition table too long (%u > %lu)\n" , table_len, + sb->s_blocksize -sizeof (*lvd)); + goto out_bh; + } ret =udf_sb_alloc_partition_maps (sb,le32_to_cpu (lvd->numPartitionMaps));if (ret) goto out_bh;for (i =0 , offset =0 ; - i < sbi->s_partitions && offset <le32_to_cpu (lvd->mapTableLength); + i < sbi->s_partitions && offset < table_len; i++, offset += gpm->partitionMapLength) {struct udf_part_map *map = &sbi->s_partmaps[i]; gpm = (struct genericPartitionMap *)
Greg Kroah-Hartman
maintainerPATCH 52/187 udf: Fortify loading of sparing table
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
commit 1df2ae31c724e57be9d7ac00d78db8a5dabdd050 upstream.
Add sanity checks when loading sparing table from disk to avoid accessing unallocated memory or writing to it.
--- fs/udf/super.c | 86 +++++++++++++++++++++++++++++++++++---------------------- 1 file changed, 53 insertions(+), 33 deletions(-)
fs/udf/super.c +53 -33
@@ -56,6 +56,7 @@#include <linux/seq_file.h> #include <linux/bitmap.h> #include <linux/crc-itu-t.h> +#include <linux/log2.h> #include <asm/byteorder.h> #include "udf_sb.h"
@@ -1215,11 +1216,59 @@ out_bh:return ret; } +static int udf_load_sparable_map (struct super_block *sb, +struct udf_part_map *map, +struct sparablePartitionMap *spm) +{ +uint32_t loc; +uint16_t ident; +struct sparingTable *st; +struct udf_sparing_data *sdata = &map->s_type_specific.s_sparing; +int i; +struct buffer_head *bh; + + map->s_partition_type =UDF_SPARABLE_MAP15 ; + sdata->s_packet_len =le16_to_cpu (spm->packetLength); +if (!is_power_of_2 (sdata->s_packet_len)) { +udf_err (sb,"error loading logical volume descriptor: " +"Invalid packet length %u\n" , + (unsigned )sdata->s_packet_len); +return -EIO ; + } +if (spm->numSparingTables >4 ) { +udf_err (sb,"error loading logical volume descriptor: " +"Too many sparing tables (%d)\n" , + (int )spm->numSparingTables); +return -EIO ; + } + +for (i =0 ; i < spm->numSparingTables; i++) { + loc =le32_to_cpu (spm->locSparingTable[i]); + bh =udf_read_tagged (sb, loc, loc, &ident); +if (!bh) +continue ; + + st = (struct sparingTable *)bh->b_data; +if (ident !=0 || +strncmp (st->sparingIdent.ident,UDF_ID_SPARING , +strlen (UDF_ID_SPARING )) || +sizeof (*st) +le16_to_cpu (st->reallocationTableLen) > + sb->s_blocksize) { +brelse (bh); +continue ; + } + + sdata->s_spar_map[i] = bh; + } + map->s_partition_func = udf_get_pblock_spar15; +return 0 ; +} +static int udf_load_logicalvol (struct super_block *sb,sector_t block,struct kernel_lb_addr *fileset) {struct logicalVolDesc *lvd; -int i, j, offset; +int i, offset;uint8_t type;struct udf_sb_info *sbi =UDF_SB (sb);struct genericPartitionMap *gpm;
@@ -1281,38 +1330,9 @@ static int udf_load_logicalvol(struct su }else if (!strncmp (upm2->partIdent.ident,UDF_ID_SPARABLE ,strlen (UDF_ID_SPARABLE ))) { -uint32_t loc; -struct sparingTable *st; -struct sparablePartitionMap *spm = - (struct sparablePartitionMap *)gpm; - - map->s_partition_type =UDF_SPARABLE_MAP15 ; - map->s_type_specific.s_sparing.s_packet_len = -le16_to_cpu (spm->packetLength); -for (j =0 ; j < spm->numSparingTables; j++) { -struct buffer_head *bh2; - - loc =le32_to_cpu ( - spm->locSparingTable[j]); - bh2 =udf_read_tagged (sb, loc, loc, - &ident); - map->s_type_specific.s_sparing. - s_spar_map[j] = bh2; - -if (bh2 ==NULL ) -continue ; - - st = (struct sparingTable *)bh2->b_data; -if (ident !=0 ||strncmp ( - st->sparingIdent.ident, -UDF_ID_SPARING , -strlen (UDF_ID_SPARING ))) { -brelse (bh2); - map->s_type_specific.s_sparing. - s_spar_map[j] =NULL ; - } - } - map->s_partition_func = udf_get_pblock_spar15; +if (udf_load_sparable_map (sb, map, + (struct sparablePartitionMap *)gpm) <0 ) + goto out_bh; }else if (!strncmp (upm2->partIdent.ident,UDF_ID_METADATA ,strlen (UDF_ID_METADATA ))) {
Greg Kroah-Hartman
maintainerPATCH 53/187 iommu/amd: Fix missing iommu_shutdown initialization in passthrough mode
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuah Khan <[email protected]>
commit f2f12b6fc032c7b1419fd6db84e2868b5f05a878 upstream.
The iommu_shutdown callback is not initialized when the AMD IOMMU driver runs in passthrough mode. Fix that by moving the callback initialization before the check for passthrough mode.
--- drivers/iommu/amd_iommu_init.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/iommu/amd_iommu_init.c +2 -2
@@ -1641,6 +1641,8 @@ static int __init amd_iommu_init(void)amd_iommu_init_api (); + x86_platform.iommu_shutdown = disable_iommus; +if (iommu_pass_through) goto out;
@@ -1649,8 +1651,6 @@ static int __init amd_iommu_init(void)else printk (KERN_INFO "AMD-Vi: Lazy IO/TLB flushing enabled\n" ); - x86_platform.iommu_shutdown = disable_iommus; - out:return ret;
Greg Kroah-Hartman
maintainerPATCH 54/187 iommu/amd: Initialize dma_ops for hotplug and sriov devices
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joerg Roedel <[email protected]>
commit ac1534a55d1e87d59a21c09c570605933b551480 upstream.
When a device is added to the system at runtime the AMD IOMMU driver initializes the necessary data structures to handle translation for it. But it forgets to change the per-device dma_ops to point to the AMD IOMMU driver. So mapping actually never happens and all DMA accesses end in an IO_PAGE_FAULT. Fix this.
--- drivers/iommu/amd_iommu.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/iommu/amd_iommu.c +9 -0
@@ -83,6 +83,8 @@ static struct iommu_ops amd_iommu_ops;static ATOMIC_NOTIFIER_HEAD (ppr_notifier);int amd_iommu_max_glx_val =-1 ; +static struct dma_map_ops amd_iommu_dma_ops; +/* * general struct to manage commands send to an IOMMU */
@@ -2267,6 +2269,13 @@ static int device_change_notifier(structlist_add_tail (&dma_domain->list, &iommu_pd_list);spin_unlock_irqrestore (&iommu_pd_list_lock, flags); + dev_data =get_dev_data (dev); + +if (!dev_data->passthrough) + dev->archdata.dma_ops = &amd_iommu_dma_ops; +else + dev->archdata.dma_ops = &nommu_dma_ops; +break ;case BUS_NOTIFY_DEL_DEVICE :
Greg Kroah-Hartman
maintainerPATCH 55/187 iommu/tegra: smmu: Fix unsleepable memory allocation
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hiroshi DOYU <[email protected]>
commit 8f53dc724a83a0082184fa27df80c25c7df47340 upstream.
allo_pdir() is called in smmu_iommu_domain_init() with spin_lock held. memory allocations in it have to be atomic/unsleepable.
--- drivers/iommu/tegra-smmu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/iommu/tegra-smmu.c +2 -2
@@ -550,13 +550,13 @@ static int alloc_pdir(struct smmu_as *asreturn 0 ; as->pte_count =devm_kzalloc (smmu->dev, -sizeof (as->pte_count[0 ]) *SMMU_PDIR_COUNT ,GFP_KERNEL ); +sizeof (as->pte_count[0 ]) *SMMU_PDIR_COUNT ,GFP_ATOMIC );if (!as->pte_count) {dev_err (smmu->dev,"failed to allocate smmu_device PTE cunters\n" );return -ENOMEM ; } - as->pdir_page =alloc_page (GFP_KERNEL | __GFP_DMA); + as->pdir_page =alloc_page (GFP_ATOMIC | __GFP_DMA);if (!as->pdir_page) {dev_err (smmu->dev,"failed to allocate smmu_device page directory\n" );
Greg Kroah-Hartman
maintainer=?y?q?=5B=20119/187=5D=20vfs=3A=20make=20O=5FPATH=20file=20descriptors=20usable=20for=20fchdir=28=29?=
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Torvalds <[email protected]>
commit 332a2e1244bd08b9e3ecd378028513396a004a24 upstream.
We already use them for openat() and friends, but fchdir() also wants to be able to use O_PATH file descriptors. This should make it comparable to the O_SEARCH of Solaris. In particular, O_PATH allows you to access (not-quite-open) a directory you don't have read persmission to, only execute permission.
Noticed during development of multithread support for ksh93.
--- fs/open.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
fs/open.c +3 -3
@@ -396,10 +396,10 @@ SYSCALL_DEFINE1(fchdir, unsigned int, fd {struct file *file;struct inode *inode; -int error; +int error, fput_needed; error = -EBADF ; - file =fget (fd); + file =fget_raw_light (fd, &fput_needed);if (!file) goto out;
@@ -413,7 +413,7 @@ SYSCALL_DEFINE1(fchdir, unsigned int, fdif (!error)set_fs_pwd (current->fs, &file->f_path); out_putf: -fput (file); +fput_light (file, fput_needed); out:return error; }
Greg Kroah-Hartman
maintainerPATCH 56/187 rpmsg: avoid premature deallocation of endpoints
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ohad Ben-Cohen <[email protected]>
commit 5a081caa0414b9bbb82c17ffab9d6fe66edbb72f upstream.
When an inbound message arrives, the rpmsg core looks up its associated endpoint and invokes the registered callback.
If a message arrives while its endpoint is being removed (because the rpmsg driver was removed, or a recovery of a remote processor has kicked in) we must ensure atomicity, i.e.:
- Either the ept is removed before it is found
or
- The ept is found but will not be freed until the callback returns
This is achieved by maintaining a per-ept reference count, which, when drops to zero, will trigger deallocation of the ept.
With this in hand, it is now forbidden to directly deallocate epts once they have been added to the endpoints idr.
--- drivers/rpmsg/virtio_rpmsg_bus.c | 36 ++++++++++++++++++++++++++++++++++-- include/linux/rpmsg.h | 3 +++ 2 files changed, 37 insertions(+), 2 deletions(-)
drivers/rpmsg/virtio_rpmsg_bus.c +34 -2
@@ -188,6 +188,26 @@ static int rpmsg_uevent(struct device *d rpdev->id.name); } +/** +* __ept_release() - deallocate an rpmsg endpoint +* @kref: the ept's reference count +* +* This function deallocates an ept, and is invoked when its @kref refcount +* drops to zero. +* +* Never invoke this function directly! +*/ +static void __ept_release (struct kref *kref) +{ + struct rpmsg_endpoint *ept = container_of(kref, struct rpmsg_endpoint, + refcount); +/* +* At this point no one holds a reference to ept anymore, +* so we can directly free it +*/ +kfree (ept); +} +/* for more info, see below documentation of rpmsg_create_ept() */ static struct rpmsg_endpoint *__rpmsg_create_ept(struct virtproc_info *vrp, struct rpmsg_channel *rpdev, rpmsg_rx_cb_t cb,
@@ -206,6 +226,8 @@ static struct rpmsg_endpoint *__rpmsg_crreturn NULL ; } +kref_init (&ept->refcount); + ept->rpdev = rpdev; ept->cb = cb; ept->priv = priv;
@@ -238,7 +260,7 @@ rem_idr:idr_remove (&vrp->endpoints, request); free_ept:mutex_unlock (&vrp->endpoints_lock); -kfree (ept); +kref_put (&ept->refcount, __ept_release);return NULL ; }
@@ -306,7 +328,7 @@ __rpmsg_destroy_ept(struct virtproc_infoidr_remove (&vrp->endpoints, ept->addr);mutex_unlock (&vrp->endpoints_lock); -kfree (ept); +kref_put (&ept->refcount, __ept_release); }/**
@@ -790,7 +812,13 @@ static void rpmsg_recv_done(struct virtq/* use the dst addr to fetch the callback of the appropriate user */ mutex_lock (&vrp->endpoints_lock); + ept =idr_find (&vrp->endpoints, msg->dst); + +/* let's make sure no one deallocates ept while we use it */ +if (ept) +kref_get (&ept->refcount); +mutex_unlock (&vrp->endpoints_lock);if (ept && ept->cb)
@@ -798,6 +826,10 @@ static void rpmsg_recv_done(struct virtqelse dev_warn (dev,"msg received with no recepient\n" ); +/* farewell, ept, we don't need you anymore */ +if (ept) +kref_put (&ept->refcount, __ept_release); +/* publish the real size of the buffer */ sg_init_one (&sg, msg,RPMSG_BUF_SIZE );
include/linux/rpmsg.h +3 -0
@@ -38,6 +38,7 @@#include <linux/types.h> #include <linux/device.h> #include <linux/mod_devicetable.h> +#include <linux/kref.h> /* The feature bitmap for virtio rpmsg */ #define VIRTIO_RPMSG_F_NS 0/* RP supports name service notifications */
@@ -120,6 +121,7 @@ typedef void (*rpmsg_rx_cb_t)(struct rpm/** * struct rpmsg_endpoint - binds a local rpmsg address to its user * @rpdev: rpmsg channel device +* @refcount: when this drops to zero, the ept is deallocated * @cb: rx callback handler * @addr: local rpmsg address * @priv: private data for the driver's use
@@ -140,6 +142,7 @@ typedef void (*rpmsg_rx_cb_t)(struct rpm*/ struct rpmsg_endpoint {struct rpmsg_channel *rpdev; +struct kref refcount;rpmsg_rx_cb_t cb;u32 addr;void *priv;
Greg Kroah-Hartman
maintainerPATCH 57/187 rpmsg: make sure inflight messages dont invoke just-removed callbacks
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ohad Ben-Cohen <[email protected]>
commit 15fd943af50dbc5f7f4de33835795c72595f7bf4 upstream.
When inbound messages arrive, rpmsg core looks up their associated endpoint (by destination address) and then invokes their callback.
We've made sure that endpoints will never be de-allocated after they were found by rpmsg core, but we also need to protect against the (rare) scenario where the rpmsg driver was just removed, and its callback function isn't available anymore.
This is achieved by introducing a callback mutex, which must be taken before the callback is invoked, and, obviously, before it is removed.
--- drivers/rpmsg/virtio_rpmsg_bus.c | 25 +++++++++++++++++++------ include/linux/rpmsg.h | 3 +++ 2 files changed, 22 insertions(+), 6 deletions(-)
drivers/rpmsg/virtio_rpmsg_bus.c +19 -6
@@ -227,6 +227,7 @@ static struct rpmsg_endpoint *__rpmsg_cr }kref_init (&ept->refcount); +mutex_init (&ept->cb_lock); ept->rpdev = rpdev; ept->cb = cb;
@@ -324,10 +325,16 @@ EXPORT_SYMBOL(rpmsg_create_ept);static void __rpmsg_destroy_ept (struct virtproc_info *vrp,struct rpmsg_endpoint *ept) { +/* make sure new inbound messages can't find this ept anymore */ mutex_lock (&vrp->endpoints_lock);idr_remove (&vrp->endpoints, ept->addr);mutex_unlock (&vrp->endpoints_lock); +/* make sure in-flight inbound messages won't invoke cb anymore */ +mutex_lock (&ept->cb_lock); + ept->cb =NULL ; +mutex_unlock (&ept->cb_lock); +kref_put (&ept->refcount, __ept_release); }
@@ -821,14 +828,20 @@ static void rpmsg_recv_done(struct virtqmutex_unlock (&vrp->endpoints_lock); -if (ept && ept->cb) - ept->cb (ept->rpdev, msg->data, msg->len, ept->priv, msg->src); -else -dev_warn (dev,"msg received with no recepient\n" ); +if (ept) { +/* make sure ept->cb doesn't go away while we use it */ +mutex_lock (&ept->cb_lock); -/* farewell, ept, we don't need you anymore */ -if (ept) +if (ept->cb) + ept->cb (ept->rpdev, msg->data, msg->len, ept->priv, + msg->src); + +mutex_unlock (&ept->cb_lock); + +/* farewell, ept, we don't need you anymore */ kref_put (&ept->refcount, __ept_release); + }else +dev_warn (dev,"msg received with no recepient\n" );/* publish the real size of the buffer */ sg_init_one (&sg, msg,RPMSG_BUF_SIZE );
include/linux/rpmsg.h +3 -0
@@ -39,6 +39,7 @@#include <linux/device.h> #include <linux/mod_devicetable.h> #include <linux/kref.h> +#include <linux/mutex.h> /* The feature bitmap for virtio rpmsg */ #define VIRTIO_RPMSG_F_NS 0/* RP supports name service notifications */
@@ -123,6 +124,7 @@ typedef void (*rpmsg_rx_cb_t)(struct rpm* @rpdev: rpmsg channel device * @refcount: when this drops to zero, the ept is deallocated * @cb: rx callback handler +* @cb_lock: must be taken before accessing/changing @cb * @addr: local rpmsg address * @priv: private data for the driver's use *
@@ -144,6 +146,7 @@ struct rpmsg_endpoint {struct rpmsg_channel *rpdev;struct kref refcount;rpmsg_rx_cb_t cb; +struct mutex cb_lock;u32 addr;void *priv; };
Greg Kroah-Hartman
maintainerPATCH 58/187 cifs: fix parsing of password mount option
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Suresh Jayaraman <[email protected]>
commit e73f843a3235a19de38359c91586e9eadef12238 upstream.
The double delimiter check that allows a comma in the password parsing code is unconditional. We set "tmp_end" to the end of the string and we continue to check for double delimiter. In the case where the password doesn't contain a comma we end up setting tmp_end to NULL and eventually setting "options" to "end". This results in the premature termination of the options string and hence the values of UNCip and UNC are being set to NULL. This results in mount failure with "Connecting to DFS root not implemented yet" error.
This error is usually not noticable as we have password as the last option in the superblock mountdata. But when we call expand_dfs_referral() from cifs_mount() and try to compose mount options for the submount, the resulting mountdata will be of the form
",ver=1,user=foo,pass=bar,ip=x.x.x.x,unc=\\server\share"
and hence results in the above error. This bug has been seen with older NAS servers running Samba 3.0.24.
Fix this by moving the double delimiter check inside the conditional loop.
Changes since -v1
- removed the wrong strlen() micro optimization.
--- fs/cifs/connect.c | 32 +++++++++++++++++--------------- 1 file changed, 17 insertions(+), 15 deletions(-)
fs/cifs/connect.c +17 -15
@@ -1585,24 +1585,26 @@ cifs_parse_mount_options(const char *mou* If yes, we have encountered a double deliminator * reset the NULL character to the deliminator */ -if (tmp_end < end && tmp_end[1 ] == delim) +if (tmp_end < end && tmp_end[1 ] == delim) { tmp_end[0 ] = delim; -/* Keep iterating until we get to a single deliminator -* OR the end -*/ -while ((tmp_end =strchr (tmp_end, delim)) !=NULL && - (tmp_end[1 ] == delim)) { - tmp_end = (char *) &tmp_end[2 ]; - } +/* Keep iterating until we get to a single +* deliminator OR the end +*/ +while ((tmp_end =strchr (tmp_end, delim)) + !=NULL && (tmp_end[1 ] == delim)) { + tmp_end = (char *) &tmp_end[2 ]; + } -/* Reset var options to point to next element */ -if (tmp_end) { - tmp_end[0 ] ='\0' ; - options = (char *) &tmp_end[1 ]; - }else -/* Reached the end of the mount option string */ - options = end; +/* Reset var options to point to next element */ +if (tmp_end) { + tmp_end[0 ] ='\0' ; + options = (char *) &tmp_end[1 ]; + }else +/* Reached the end of the mount option +* string */ + options = end; + }/* Now build new password string */ temp_len =strlen (value);
Greg Kroah-Hartman
maintainerPATCH 60/187 ath9k: Fix a WARNING on suspend/resume with IBSS
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mohammed Shafi Shajakhan <[email protected]>
commit 2031b4c2b4904f7448ab9e4bc6b9bf16e32709f5 upstream.
this patch is dependent on the patch "cfg80211: fix interface combinations"
In ath9k currently we have ADHOC interface as a single incompatible interface. when drv_add_interface is called during resume we got to consider number of vifs already present in addition to checking the drivers 'opmode' information about ADHOC. we incorrectly assume an ADHOC interface is already present. Then we may miss some driver specific data for the ADHOC interface after resume.
The above mentioned checks can be removed from the driver, as the patch 'cfg80211: fix interface combinations' ensures that if an interface type is not advertised by the driver in any of the interface combinations(via ieee80211_iface_combination) then it shall be treated as a single incompatible interface. Fixes the following warning on suspend/resume with ibss interface.
ath: phy0: Cannot create ADHOC interface when other
interfaces already exist.
WARNING: at net/mac80211/driver-ops.h:12
ieee80211_reconfig+0x1882/0x1ca0 [mac80211]()
Hardware name: 2842RK1
wlan2: Failed check-sdata-in-driver check, flags: 0x0
Call Trace:
[<c01361b2>] warn_slowpath_common+0x72/0xa0
[<f8aaa7c2>] ? ieee80211_reconfig+0x1882/0x1ca0
[mac80211]
[<f8aaa7c2>] ? ieee80211_reconfig+0x1882/0x1ca0
[mac80211]
[<c0136283>] warn_slowpath_fmt+0x33/0x40
[<f8aaa7c2>] ieee80211_reconfig+0x1882/0x1ca0 [mac80211]
[<c06c1d1a>] ? mutex_lock_nested+0x23a/0x2f0
[<f8a95097>] ieee80211_resume+0x27/0x70 [mac80211]
[<fd177edf>] wiphy_resume+0x8f/0xa0 [cfg80211]--- drivers/net/wireless/ath/ath9k/main.c | 9 --------- 1 file changed, 9 deletions(-)
drivers/net/wireless/ath/ath9k/main.c +0 -9
@@ -1419,15 +1419,6 @@ static int ath9k_add_interface(struct ie } } -if ((ah->opmode ==NL80211_IFTYPE_ADHOC ) || - ((vif->type ==NL80211_IFTYPE_ADHOC ) && - sc->nvifs >0 )) { -ath_err (common,"Cannot create ADHOC interface when other" -" interfaces already exist.\n" ); - ret = -EINVAL ; - goto out; - } -ath_dbg (common,CONFIG ,"Attach a VIF of type: %d\n" , vif->type); sc->nvifs++;
Greg Kroah-Hartman
maintainerPATCH 61/187 ath9k: Fix softlockup in AR9485
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mohammed Shafi Shajakhan <[email protected]>
commit bcb7ad7bcbef030e6ba71ede1f9866368aca7c99 upstream.
steps to recreate:
load latest ath9k driver with AR9485
stop the network-manager and wpa_supplicant
bring the interface up
Call Trace: [<ffffffffa0517490>] ? ath_hw_check+0xe0/0xe0 [ath9k] [<ffffffff812cd1e8>] __const_udelay+0x28/0x30 [<ffffffffa03bae7a>] ar9003_get_pll_sqsum_dvc+0x4a/0x80 [ath9k_hw] [<ffffffffa05174eb>] ath_hw_pll_work+0x5b/0xe0 [ath9k] [<ffffffff810744fe>] process_one_work+0x11e/0x470 [<ffffffff8107530f>] worker_thread+0x15f/0x360 [<ffffffff810751b0>] ? manage_workers+0x230/0x230 [<ffffffff81079af3>] kthread+0x93/0xa0 [<ffffffff815fd3a4>] kernel_thread_helper+0x4/0x10 [<ffffffff81079a60>] ? kthread_freezable_should_stop+0x70/0x70 [<ffffffff815fd3a0>] ? gs_change+0x13/0x13
ensure that the PLL-WAR for AR9485/AR9340 is executed only if the STA is associated (or) IBSS/AP mode had started beaconing. Ideally this WAR is needed to recover from some rare beacon stuck during stress testing. Before the STA is associated/IBSS had started beaconing, PLL4(0x1618c) always seem to have zero even though we had configured PLL3(0x16188) to query about PLL's locking status. When we keep on polling infinitely PLL4's 8th bit(ie check for PLL locking measurements is done), machine hangs due to softlockup.
fixes https://bugzilla.redhat.com/show_bug.cgi?id=811142
--- drivers/net/wireless/ath/ath9k/main.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/net/wireless/ath/ath9k/main.c +9 -0
@@ -960,6 +960,15 @@ void ath_hw_pll_work(struct work_struct hw_pll_work.work);u32 pll_sqsum; +/* +* ensure that the PLL WAR is executed only +* after the STA is associated (or) if the +* beaconing had started in interfaces that +* uses beacons. +*/ +if (!(sc->sc_flags &SC_OP_BEACONS )) +return ; +if (AR_SREV_9485 (sc->sc_ah)) {ath9k_ps_wakeup (sc);
Greg Kroah-Hartman
maintainerPATCH 62/187 ath9k: fix a tx rate duration calculation bug
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <[email protected]>
commit 76591bea9714a58d8924154068c78d702eb2cb17 upstream.
The rate pointer variable for a rate series is used in a loop before it is initialized. This went unnoticed because it was used earlier for the RTS/CTS rate. This bug can lead to the wrong PHY type being passed to the duration calculation function.
--- drivers/net/wireless/ath/ath9k/xmit.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/ath/ath9k/xmit.c +1 -1
@@ -1001,13 +1001,13 @@ static void ath_buf_set_rate(struct ath_ }/* legacy rates */ + rate = &sc->sbands[tx_info->band].bitrates[rates[i].idx];if ((tx_info->band ==IEEE80211_BAND_2GHZ ) && !(rate->flags &IEEE80211_RATE_ERP_G )) phy =WLAN_RC_PHY_CCK ;else phy =WLAN_RC_PHY_OFDM ; - rate = &sc->sbands[tx_info->band].bitrates[rates[i].idx]; info->rates[i].Rate = rate->hw_value;if (rate->hw_value_short) {if (rates[i].flags &IEEE80211_TX_RC_USE_SHORT_PREAMBLE )
Greg Kroah-Hartman
maintainer=?y?q?=5B=20151/187=5D=20USB=3A=20option=3A=20add=20ZTE=20MF60?=
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <[email protected]>
commit 8e16e33c168a6efd0c9f7fa9dd4c1e1db9a74553 upstream.
Switches into a composite device by ejecting the initial driver CD. The four interfaces are: QCDM, AT, QMI/wwan and mass storage. Let this driver manage the two serial interfaces:
T: Bus=02 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 28 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=19d2 ProdID=1402 Rev= 0.00 S: Manufacturer=ZTE,Incorporated S: Product=ZTE WCDMA Technologies MSM S: SerialNumber=xxxxx C:* #Ifs= 4 Cfg#= 1 Atr=c0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan E: Ad=83(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms I:* If#= 3 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/usb/serial/option.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/usb/serial/option.c +6 -0
@@ -554,6 +554,10 @@ static const struct option_blacklist_inf .reserved = BIT(1), }; +static const struct option_blacklist_info net_intf2_blacklist = { + .reserved =BIT (2 ), +}; +static const struct option_blacklist_info net_intf3_blacklist = { .reserved =BIT (3 ), };
@@ -1099,6 +1103,8 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1298, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1299, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1300, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1402, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&net_intf2_blacklist }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2002, 0xff, 0xff, 0xff), .driver_info = (kernel_ulong_t)&zte_k3765_z_blacklist }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2003, 0xff, 0xff, 0xff) },
Greg Kroah-Hartman
maintainer=?y?q?=5B=20150/187=5D=20USB=3A=20cdc-wdm=3A=20fix=20lockup=20on=20error=20in=20wdm=5Fread?=
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <[email protected]>
commit b086b6b10d9f182cd8d2f0dcfd7fd11edba93fc9 upstream.
Clear the WDM_READ flag on empty reads to avoid running forever in an infinite tight loop, causing lockups:
Jul 1 21:58:11 nemi kernel: [ 3658.898647] qmi_wwan 2-1:1.2: Unexpected error -71 Jul 1 21:58:36 nemi kernel: [ 3684.072021] BUG: soft lockup - CPU#0 stuck for 23s! [qmi.pl:12235] Jul 1 21:58:36 nemi kernel: [ 3684.072212] CPU 0 Jul 1 21:58:36 nemi kernel: [ 3684.072355] Jul 1 21:58:36 nemi kernel: [ 3684.072367] Pid: 12235, comm: qmi.pl Tainted: P O 3.5.0-rc2+ #13 LENOVO 2776LEG/2776LEG Jul 1 21:58:36 nemi kernel: [ 3684.072383] RIP: 0010:[<ffffffffa0635008>] [<ffffffffa0635008>] spin_unlock_irq+0x8/0xc [cdc_wdm] Jul 1 21:58:36 nemi kernel: [ 3684.072388] RSP: 0018:ffff88022dca1e70 EFLAGS: 00000282 Jul 1 21:58:36 nemi kernel: [ 3684.072393] RAX: ffff88022fc3f650 RBX: ffffffff811c56f7 RCX: 00000001000ce8c1 Jul 1 21:58:36 nemi kernel: [ 3684.072398] RDX: 0000000000000010 RSI: 000000000267d810 RDI: ffff88022fc3f650 Jul 1 21:58:36 nemi kernel: [ 3684.072403] RBP: ffff88022dca1eb0 R08: ffffffffa063578e R09: 0000000000000000 Jul 1 21:58:36 nemi kernel: [ 3684.072407] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000002 Jul 1 21:58:36 nemi kernel: [ 3684.072412] R13: 0000000000000246 R14: ffffffff00000002 R15: ffff8802281d8c88 Jul 1 21:58:36 nemi kernel: [ 3684.072418] FS: 00007f666a260700(0000) GS:ffff88023bc00000(0000) knlGS:0000000000000000 Jul 1 21:58:36 nemi kernel: [ 3684.072423] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Jul 1 21:58:36 nemi kernel: [ 3684.072428] CR2: 000000000270d9d8 CR3: 000000022e865000 CR4: 00000000000007f0 Jul 1 21:58:36 nemi kernel: [ 3684.072433] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 Jul 1 21:58:36 nemi kernel: [ 3684.072438] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Jul 1 21:58:36 nemi kernel: [ 3684.072444] Process qmi.pl (pid: 12235, threadinfo ffff88022dca0000, task ffff88022ff76380) Jul 1 21:58:36 nemi kernel: [ 3684.072448] Stack: Jul 1 21:58:36 nemi kernel: [ 3684.072458] ffffffffa063592e 0000000100020000 ffff88022fc3f650 ffff88022fc3f6a8 Jul 1 21:58:36 nemi kernel: [ 3684.072466] 0000000000000200 0000000100000000 000000000267d810 0000000000000000 Jul 1 21:58:36 nemi kernel: [ 3684.072475] 0000000000000000 ffff880212cfb6d0 0000000000000200 ffff880212cfb6c0 Jul 1 21:58:36 nemi kernel: [ 3684.072479] Call Trace: Jul 1 21:58:36 nemi kernel: [ 3684.072489] [<ffffffffa063592e>] ? wdm_read+0x1a0/0x263 [cdc_wdm] Jul 1 21:58:36 nemi kernel: [ 3684.072500] [<ffffffff8110adb7>] ? vfs_read+0xa1/0xfb Jul 1 21:58:36 nemi kernel: [ 3684.072509] [<ffffffff81040589>] ? alarm_setitimer+0x35/0x64 Jul 1 21:58:36 nemi kernel: [ 3684.072517] [<ffffffff8110aec7>] ? sys_read+0x45/0x6e Jul 1 21:58:36 nemi kernel: [ 3684.072525] [<ffffffff813725f9>] ? system_call_fastpath+0x16/0x1b Jul 1 21:58:36 nemi kernel: [ 3684.072557] Code: <66> 66 90 c3 83 ff ed 89 f8 74 16 7f 06 83 ff a1 75 0a c3 83 ff f4
The WDM_READ flag is normally cleared by wdm_int_callback before resubmitting the read urb, and set by wdm_in_callback when this urb returns with data or an error. But a crashing device may cause both a read error and cancelling all urbs. Make sure that the flag is cleared by wdm_read if the buffer is empty.
We don't clear the flag on errors, as there may be pending data in the buffer which should be processed. The flag will instead be cleared on the next wdm_read call.
--- drivers/usb/class/cdc-wdm.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/class/cdc-wdm.c +2 -0
@@ -497,6 +497,8 @@ retry: goto retry; }if (!desc->reslength) {/* zero length read */ +dev_dbg (&desc->intf->dev,"%s: zero length - clearing WDM_READ\n" , __func__); +clear_bit (WDM_READ , &desc->flags);spin_unlock_irq (&desc->iuspin); goto retry; }
Greg Kroah-Hartman
maintainerPATCH 64/187 ath9k_hw: avoid possible infinite loop in ar9003_get_pll_sqsum_dvc
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mohammed Shafi Shajakhan <[email protected]>
commit f18e3c6b67f448ec47b3a5b242789bd3d5644879 upstream.
"ath9k: Fix softlockup in AR9485" with commit id 64bc1239c790e051ff677e023435d770d2ffa174 fixed the reported issue, yet its better to avoid the possible infinite loop in ar9003_get_pll_sqsum_dvc by having a timeout as suggested by ath9k maintainers.
http://www.spinics.net/lists/linux-wireless/msg92126.html.
Based on my testing PLL's locking measurement is done in ~200us (2 iterations).
Greg Kroah-Hartman
maintainerPATCH 65/187 ath9k_htc: configure bssid on ASSOC/IBSS change
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rajkumar Manoharan <[email protected]>
commit 931cb03afed7b541392295f3afc4638da32f08a0 upstream.
After the change "mac80211: remove spurious BSSID change flag", BSS_CHANGED_BSSID will not be passed on association or IBSS status changes. So it could be better to program bssid on ASSOC or IBSS change notification. Not doing so, is affecting the packet transmission.
--- drivers/net/wireless/ath/ath9k/htc_drv_main.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/net/wireless/ath/ath9k/htc_drv_main.c +2 -3
@@ -1496,6 +1496,7 @@ static void ath9k_htc_bss_info_changed(s priv->num_sta_assoc_vif++ : priv->num_sta_assoc_vif--;if (priv->ah->opmode ==NL80211_IFTYPE_STATION ) { +ath9k_htc_choose_set_bssid (priv);if (bss_conf->assoc && (priv->num_sta_assoc_vif ==1 ))ath9k_htc_start_ani (priv);else if (priv->num_sta_assoc_vif ==0 )
@@ -1503,13 +1504,11 @@ static void ath9k_htc_bss_info_changed(s } } -if (changed &BSS_CHANGED_BSSID ) { +if (changed &BSS_CHANGED_IBSS ) {if (priv->ah->opmode ==NL80211_IFTYPE_ADHOC ) { common->curaid = bss_conf->aid;memcpy (common->curbssid, bss_conf->bssid,ETH_ALEN );ath9k_htc_set_bssid (priv); - }else if (priv->ah->opmode ==NL80211_IFTYPE_STATION ) { -ath9k_htc_choose_set_bssid (priv); } }
Greg Kroah-Hartman
maintainerPATCH 66/187 ath9k: fix dynamic WEP related regression
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <[email protected]>
commit bed3d9c0b71f9afbfec905cb6db3b9f16be29d4d upstream.
commit 7a532fe7131216a02c81a6c1b1f8632da1195a58ath9k_hw: fix interpretation of the rx KeyMiss flag
This commit used the rx key miss indication to detect packets that were passed from the hardware without being decrypted, however it seems that this bit is not only undefined in the static WEP case, but also for dynamically allocated WEP keys. This caused a regression when using WEP-LEAP.
This patch fixes the regression by keeping track of which key indexes refer to CCMP keys and only using the key miss indication for those.
--- drivers/net/wireless/ath/ath.h | 1 + drivers/net/wireless/ath/ath9k/recv.c | 3 ++- drivers/net/wireless/ath/key.c | 4 ++++ 3 files changed, 7 insertions(+), 1 deletion(-)
drivers/net/wireless/ath/ath.h +1 -0
@@ -143,6 +143,7 @@ struct ath_common {u32 keymax;DECLARE_BITMAP (keymap,ATH_KEYMAX );DECLARE_BITMAP (tkip_keymap,ATH_KEYMAX ); +DECLARE_BITMAP (ccmp_keymap,ATH_KEYMAX );enum ath_crypt_caps crypt_caps;unsigned int clockrate;
drivers/net/wireless/ath/ath9k/recv.c +2 -1
@@ -821,7 +821,8 @@ static bool ath9k_rx_accept(struct ath_c* descriptor does contain a valid key index. This has been observed * mostly with CCMP encryption. */ -if (rx_stats->rs_keyix ==ATH9K_RXKEYIX_INVALID ) +if (rx_stats->rs_keyix ==ATH9K_RXKEYIX_INVALID || + !test_bit (rx_stats->rs_keyix, common->ccmp_keymap)) rx_stats->rs_status &= ~ATH9K_RXERR_KEYMISS ;if (!rx_stats->rs_datalen)
drivers/net/wireless/ath/key.c +4 -0
@@ -556,6 +556,9 @@ int ath_key_config(struct ath_common *coreturn -EIO ;set_bit (idx, common->keymap); +if (key->cipher ==WLAN_CIPHER_SUITE_CCMP ) +set_bit (idx, common->ccmp_keymap); +if (key->cipher ==WLAN_CIPHER_SUITE_TKIP ) {set_bit (idx +64 , common->keymap);set_bit (idx, common->tkip_keymap);
@@ -582,6 +585,7 @@ void ath_key_delete(struct ath_common *creturn ;clear_bit (key->hw_key_idx, common->keymap); +clear_bit (key->hw_key_idx, common->ccmp_keymap);if (key->cipher !=WLAN_CIPHER_SUITE_TKIP )return ;
Greg Kroah-Hartman
maintainerPATCH 67/187 ath9k: enable serialize_regmode for non-PCIE AR9287
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Panayiotis Karabassis <[email protected]>
commit 7508b657967cf664b5aa0f6367d05016e7e3bc2a upstream.
https://bugzilla.kernel.org/show_bug.cgi?id=42903
Based on the work of <[email protected]>
--- drivers/net/wireless/ath/ath9k/hw.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/ath/ath9k/hw.c +1 -1
@@ -558,7 +558,7 @@ static int __ath9k_hw_init(struct ath_hwif (NR_CPUS >1 && ah->config.serialize_regmode ==SER_REG_MODE_AUTO ) {if (ah->hw_version.macVersion ==AR_SREV_VERSION_5416_PCI || - ((AR_SREV_9160 (ah) ||AR_SREV_9280 (ah)) && + ((AR_SREV_9160 (ah) ||AR_SREV_9280 (ah) ||AR_SREV_9287 (ah)) && !ah->is_pciexpress)) { ah->config.serialize_regmode =SER_REG_MODE_ON ;
Greg Kroah-Hartman
maintainerPATCH 68/187 ASoC: wm2200: Add missing BCLK rate
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Brown <[email protected]>
commit b0dfa4541e48ac4cc5f017285432c89923ad0f58 upstream.
Without this very high BCLKs will be configured incorrectly.
--- sound/soc/codecs/wm2200.c | 1 + 1 file changed, 1 insertion(+)
sound/soc/codecs/wm2200.c +1 -0
@@ -1491,6 +1491,7 @@ static int wm2200_bclk_rates_dat[WM2200_static int wm2200_bclk_rates_cd[WM2200_NUM_BCLK_RATES ] = {5644800 , +3763200 ,2882400 ,1881600 ,1411200 ,
Greg Kroah-Hartman
maintainerPATCH 69/187 ASoC: tlv320aic3x: Fix codec pll configure bug
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Hebbar, Gururaja" <[email protected]>
commit c9fe573a6584034670c1a55ee8162d623519cbbf upstream.
In sound/soc/codecs/tlv320aic3x.c
data = snd_soc_read(codec, AIC3X_PLL_PROGA_REG);
snd_soc_write(codec, AIC3X_PLL_PROGA_REG,
data | (pll_p << PLLP_SHIFT));In the above code, pll-p value is OR'ed with previous value without clearing it. Bug is not seen if pll-p value doesn't change across Sampling frequency.
However on some platforms (like AM335x EVM-SK), pll-p may have different values across different sampling frequencies. In such case, above code configures the pll with a wrong value.
Because of this bug, when a audio stream is played with pll value different from previous stream, audio is heard as differently(like its stretched).
--- sound/soc/codecs/tlv320aic3x.c | 4 +--- sound/soc/codecs/tlv320aic3x.h | 1 + 2 files changed, 2 insertions(+), 3 deletions(-)
sound/soc/codecs/tlv320aic3x.c +1 -3
@@ -936,9 +936,7 @@ static int aic3x_hw_params(struct snd_pc } found: - data =snd_soc_read (codec,AIC3X_PLL_PROGA_REG ); -snd_soc_write (codec,AIC3X_PLL_PROGA_REG , - data | (pll_p <<PLLP_SHIFT )); +snd_soc_update_bits (codec,AIC3X_PLL_PROGA_REG ,PLLP_MASK , pll_p);snd_soc_write (codec,AIC3X_OVRF_STATUS_AND_PLLR_REG , pll_r <<PLLR_SHIFT );snd_soc_write (codec,AIC3X_PLL_PROGB_REG , pll_j <<PLLJ_SHIFT );
sound/soc/codecs/tlv320aic3x.h +1 -0
@@ -166,6 +166,7 @@/* PLL registers bitfields */ #define PLLP_SHIFT 0 +#define PLLP_MASK 7#define PLLQ_SHIFT 3#define PLLR_SHIFT 0#define PLLJ_SHIFT 2
Greg Kroah-Hartman
maintainerPATCH 70/187 Btrfs: run delayed directory updates during log replay
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mason <[email protected]>
commit b6305567e7d31b0bec1b8cb9ec0cadd7f7086f5f upstream.
While we are resolving directory modifications in the tree log, we are triggering delayed metadata updates to the filesystem btrees.
This commit forces the delayed updates to run so the replay code can find any modifications done. It stops us from crashing because the directory deleltion replay expects items to be removed immediately from the tree.
--- fs/btrfs/tree-log.c | 6 ++++++ 1 file changed, 6 insertions(+)
fs/btrfs/tree-log.c +6 -0
@@ -690,6 +690,8 @@ static noinline int drop_one_dir_item(stkfree (name);iput (inode); + +btrfs_run_delayed_items (trans, root);return ret; }
@@ -895,6 +897,7 @@ again: ret =btrfs_unlink_inode (trans, root, dir, inode, victim_name, victim_name_len); +btrfs_run_delayed_items (trans, root); }kfree (victim_name); ptr = (unsigned long )(victim_ref +1 ) + victim_name_len;
@@ -1475,6 +1478,9 @@ again: ret =btrfs_unlink_inode (trans, root, dir, inode, name, name_len);BUG_ON (ret); + +btrfs_run_delayed_items (trans, root); +kfree (name);iput (inode);
Greg Kroah-Hartman
maintainerPATCH 71/187 drm/edid: dont return stack garbage from supports_rb
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Vetter <[email protected]>
commit b196a4980ff7bb54db478e2a408dc8b12be15304 upstream.
We need to initialize this to false, because the is_rb callback only ever sets it to true.
Noticed while reading through the code.
--- drivers/gpu/drm/drm_edid.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/drm_edid.c +1 -1
@@ -574,7 +574,7 @@ static bool drm_monitor_supports_rb(struct edid *edid) {if (edid->revision >=4 ) { -bool ret; +bool ret = false;drm_for_each_detailed_block ((u8 *)edid, is_rb, &ret);return ret; }
Greg Kroah-Hartman
maintainerPATCH 72/187 drm/nouveau/fbcon: using nv_two_heads is not a good idea
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Skeggs <[email protected]>
commit 9bd0c15fcfb42f6245447c53347d65ad9e72080b upstream.
nv_two_heads() was never meant to be used outside of pre-nv50 code. The code checks for >= NV_10 for 2 CRTCs, then downgrades a few specific chipsets to 1 CRTC based on (pci_device & 0x0ff0).
The breakage example seen is on GTX 560Ti, with a pciid of 0x1200, which gets detected as an NV20 (0x020x) with 1 CRTC by nv_two_heads(), causing memory corruption because there's actually 2 CRTCs..
This switches fbcon to use the CRTC count directly from the mode_config structure, which will also fix the same issue on Kepler boards which have 4 CRTCs.
--- drivers/gpu/drm/nouveau/nouveau_fbcon.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/nouveau/nouveau_fbcon.c +1 -1
@@ -497,7 +497,7 @@ int nouveau_fbcon_init(struct drm_device nfbdev->helper.funcs = &nouveau_fbcon_helper_funcs; ret =drm_fb_helper_init (dev, &nfbdev->helper, -nv_two_heads (dev) ?2 :1 ,4 ); + dev->mode_config.num_crtc,4 );if (ret) {kfree (nfbdev);return ret;
Greg Kroah-Hartman
maintainerPATCH 73/187 drm/i915: Fix eDP blank screen after S3 resume on HP desktops
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 6db65cbb941f9d433659bdad02b307f6d94465df upstream.
This patch fixes the problem on some HP desktop machines with eDP which give blank screens after S3 resume.
It turned out that BLC_PWM_CPU_CTL must be written after BLC_PWM_CPU_CTL2. Otherwise it doesn't take effect on these SNB machines.
Tested with 3.5-rc3 kernel.
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=49233
--- drivers/gpu/drm/i915/i915_suspend.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/gpu/drm/i915/i915_suspend.c +4 -1
@@ -740,8 +740,11 @@ static void i915_restore_display(structif (HAS_PCH_SPLIT (dev)) {I915_WRITE (BLC_PWM_PCH_CTL1 , dev_priv->saveBLC_PWM_CTL);I915_WRITE (BLC_PWM_PCH_CTL2 , dev_priv->saveBLC_PWM_CTL2); -I915_WRITE (BLC_PWM_CPU_CTL , dev_priv->saveBLC_CPU_PWM_CTL); +/* NOTE: BLC_PWM_CPU_CTL must be written after BLC_PWM_CPU_CTL2; +* otherwise we get blank eDP screen after S3 on some machines +*/ I915_WRITE (BLC_PWM_CPU_CTL2 , dev_priv->saveBLC_CPU_PWM_CTL2); +I915_WRITE (BLC_PWM_CPU_CTL , dev_priv->saveBLC_CPU_PWM_CTL);I915_WRITE (PCH_PP_ON_DELAYS , dev_priv->savePP_ON_DELAYS);I915_WRITE (PCH_PP_OFF_DELAYS , dev_priv->savePP_OFF_DELAYS);I915_WRITE (PCH_PP_DIVISOR , dev_priv->savePP_DIVISOR);
Greg Kroah-Hartman
maintainerPATCH 74/187 drm/radeon: fix VM page table setup on SI
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit c21b328ea8c7c71cd2daf50557db440bbaa7ef55 upstream.
Cayman and trinity allow for variable sized VM page tables, but SI requires that all page tables be the same size. The current code assumes variablely sized VM page tables so SI may end up with part of each page table overlapping with other memory which could end up being interpreted by the VM hw as garbage.
Change the code to better accomodate SI. Allocate enough space for at least 2 full page tables and always set last_pfn to max_pfn on SI so each VM is backed by a full page table. This limits us to only 2 VMs active at any given time on SI. This will be rectified and the code can be reunified once we move to two level page tables.
--- drivers/gpu/drm/radeon/radeon_gart.c | 13 +++++++++++-- drivers/gpu/drm/radeon/si.c | 4 ++-- 2 files changed, 13 insertions(+), 4 deletions(-)
drivers/gpu/drm/radeon/radeon_gart.c +11 -2
@@ -289,8 +289,9 @@ int radeon_vm_manager_init(struct radeon rdev->vm_manager.enabled = false;/* mark first vm as always in use, it's the system one */ +/* allocate enough for 2 full VM pts */ r =radeon_sa_bo_manager_init (rdev, &rdev->vm_manager.sa_manager, - rdev->vm_manager.max_pfn *8 , + rdev->vm_manager.max_pfn *8 *2 ,RADEON_GEM_DOMAIN_VRAM );if (r) { dev_err(rdev->dev, "failed to allocate vm bo (%dKB)\n",
@@ -635,7 +636,15 @@ int radeon_vm_init(struct radeon_devicemutex_init (&vm->mutex);INIT_LIST_HEAD (&vm->list);INIT_LIST_HEAD (&vm->va); - vm->last_pfn =0 ; +/* SI requires equal sized PTs for all VMs, so always set +* last_pfn to max_pfn. cayman allows variable sized +* pts so we can grow then as needed. Once we switch +* to two level pts we can unify this again. +*/ +if (rdev->family >=CHIP_TAHITI ) + vm->last_pfn = rdev->vm_manager.max_pfn; +else + vm->last_pfn =0 ;/* map the ib pool buffer at 0 in virtual address space, set * read only */
drivers/gpu/drm/radeon/si.c +2 -2
@@ -2527,12 +2527,12 @@ int si_pcie_gart_enable(struct radeon_deWREG32 (0x15DC ,0 );/* empty context1-15 */ -/* FIXME start with 1G, once using 2 level pt switch to full +/* FIXME start with 4G, once using 2 level pt switch to full * vm size space */ /* set vm size, must be a multiple of 4 */ WREG32 (VM_CONTEXT1_PAGE_TABLE_START_ADDR ,0 ); -WREG32 (VM_CONTEXT1_PAGE_TABLE_END_ADDR , (1 <<30 ) /RADEON_GPU_PAGE_SIZE ); +WREG32 (VM_CONTEXT1_PAGE_TABLE_END_ADDR , rdev->vm_manager.max_pfn);for (i =1 ; i <16 ; i++) {if (i <8 ) WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR + (i << 2),
Greg Kroah-Hartman
maintainerPATCH 75/187 ACPI video: Still use ACPI backlight control if _DOS doesnt exist
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Rui <[email protected]>
commit b03738430c7537d5f87948e0b35d8aaf2688c6b4 upstream.
This fixes a regression in 3.4-rc1 caused by commit ea9f8856bd6d4ed45885b06a338f7362cd6c60e5 (ACPI video: Harden video bus adding.)
Some platforms don't have _DOS control method, but the ACPI backlight still works.
We should not invoke _DOS for these platforms.
https://bugzilla.kernel.org/show_bug.cgi?id=43168
--- drivers/acpi/video.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/acpi/video.c +2 -0
@@ -558,6 +558,8 @@ acpi_video_bus_DOS(struct acpi_video_busunion acpi_object arg0 = {ACPI_TYPE_INTEGER };struct acpi_object_list args = {1 , &arg0 }; +if (!video->cap._DOS) +return 0 ;if (bios_flag <0 || bios_flag >3 || lcd_flag <0 || lcd_flag >1 )return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 76/187 acpi_pad: fix power_saving thread deadlock
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stuart Hayes <[email protected]>
commit 5f1601261050251a5ca293378b492a69d590dacb upstream.
The acpi_pad driver can get stuck in destroy_power_saving_task() waiting for kthread_stop() to stop a power_saving thread. The problem is that the isolated_cpus_lock mutex is owned when destroy_power_saving_task() calls kthread_stop(), which waits for a power_saving thread to end, and the power_saving thread tries to acquire the isolated_cpus_lock when it calls round_robin_cpu(). This patch fixes the issue by making round_robin_cpu() use its own mutex.
https://bugzilla.kernel.org/show_bug.cgi?id=42981
--- drivers/acpi/acpi_pad.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/acpi/acpi_pad.c +4 -3
@@ -36,6 +36,7 @@#define ACPI_PROCESSOR_AGGREGATOR_DEVICE_NAME "Processor Aggregator"#define ACPI_PROCESSOR_AGGREGATOR_NOTIFY 0x80static DEFINE_MUTEX (isolated_cpus_lock); +static DEFINE_MUTEX (round_robin_lock);static unsigned long power_saving_mwait_eax;
@@ -107,7 +108,7 @@ static void round_robin_cpu(unsigned intif (!alloc_cpumask_var (&tmp,GFP_KERNEL ))return ; -mutex_lock (&isolated_cpus_lock); +mutex_lock (&round_robin_lock);cpumask_clear (tmp);for_each_cpu (cpu, pad_busy_cpus)cpumask_or (tmp, tmp,topology_thread_cpumask (cpu));
@@ -116,7 +117,7 @@ static void round_robin_cpu(unsigned intif (cpumask_empty (tmp))cpumask_andnot (tmp, cpu_online_mask, pad_busy_cpus);if (cpumask_empty (tmp)) { -mutex_unlock (&isolated_cpus_lock); +mutex_unlock (&round_robin_lock);return ; }for_each_cpu (cpu, tmp) {
@@ -131,7 +132,7 @@ static void round_robin_cpu(unsigned int tsk_in_cpu[tsk_index] = preferred_cpu;cpumask_set_cpu (preferred_cpu, pad_busy_cpus); cpu_weight[preferred_cpu]++; -mutex_unlock (&isolated_cpus_lock); +mutex_unlock (&round_robin_lock);set_cpus_allowed_ptr (current,cpumask_of (preferred_cpu)); }
Greg Kroah-Hartman
maintainerPATCH 77/187 ACPI, APEI, Avoid too much error reporting in runtime
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huang Ying <[email protected]>
commit 34ddeb035d704eafdcdb3cbc781894300136c3c4 upstream.
This patch fixed the following bug.
https://bugzilla.kernel.org/show_bug.cgi?id=43282
This is caused by a firmware bug checking (checking generic address register provided by firmware) in runtime. The checking should be done in address mapping time instead of runtime to avoid too much error reporting in runtime.
--- drivers/acpi/apei/apei-base.c | 17 +++++++++++++++-- drivers/acpi/apei/apei-internal.h | 9 +++++++++ drivers/acpi/apei/ghes.c | 6 +++--- 3 files changed, 27 insertions(+), 5 deletions(-)
drivers/acpi/apei/apei-base.c +15 -2
@@ -243,7 +243,7 @@ static int pre_map_gar_callback(struct au8 ins = entry->instruction;if (ctx->ins_table[ins].flags &APEI_EXEC_INS_ACCESS_REGISTER ) -return acpi_os_map_generic_address (&entry->register_region); +return apei_map_generic_address (&entry->register_region);return 0 ; }
@@ -276,7 +276,7 @@ static int post_unmap_gar_callback(strucu8 ins = entry->instruction;if (ctx->ins_table[ins].flags &APEI_EXEC_INS_ACCESS_REGISTER ) -acpi_os_unmap_generic_address (&entry->register_region); +apei_unmap_generic_address (&entry->register_region);return 0 ; }
@@ -606,6 +606,19 @@ static int apei_check_gar(struct acpi_gereturn 0 ; } +int apei_map_generic_address (struct acpi_generic_address *reg) +{ +int rc; +u32 access_bit_width; +u64 address; + + rc =apei_check_gar (reg, &address, &access_bit_width); +if (rc) +return rc; +return acpi_os_map_generic_address (reg); +} +EXPORT_SYMBOL_GPL (apei_map_generic_address); +/* read GAR in interrupt (including NMI) or process context */ int apei_read (u64 *val,struct acpi_generic_address *reg) {
drivers/acpi/apei/apei-internal.h +9 -0
@@ -7,6 +7,8 @@#define APEI_INTERNAL_H #include <linux/cper.h> +#include <linux/acpi.h> +#include <linux/acpi_io.h> struct apei_exec_context ;
@@ -68,6 +70,13 @@ static inline int apei_exec_run_optional/* IP has been set in instruction function */ #define APEI_EXEC_SET_IP 1 +int apei_map_generic_address (struct acpi_generic_address *reg); + +static inline void apei_unmap_generic_address (struct acpi_generic_address *reg) +{ +acpi_os_unmap_generic_address (reg); +} +int apei_read (u64 *val,struct acpi_generic_address *reg);int apei_write (u64 val,struct acpi_generic_address *reg);
drivers/acpi/apei/ghes.c +3 -3
@@ -301,7 +301,7 @@ static struct ghes *ghes_new(struct acpiif (!ghes)return ERR_PTR (-ENOMEM ); ghes->generic = generic; - rc =acpi_os_map_generic_address (&generic->error_status_address); + rc =apei_map_generic_address (&generic->error_status_address);if (rc) goto err_free; error_block_length = generic->error_block_length;
@@ -321,7 +321,7 @@ static struct ghes *ghes_new(struct acpireturn ghes; err_unmap: -acpi_os_unmap_generic_address (&generic->error_status_address); +apei_unmap_generic_address (&generic->error_status_address); err_free:kfree (ghes);return ERR_PTR (rc);
@@ -330,7 +330,7 @@ err_free:static void ghes_fini (struct ghes *ghes) {kfree (ghes->estatus); -acpi_os_unmap_generic_address (&ghes->generic->error_status_address); +apei_unmap_generic_address (&ghes->generic->error_status_address); }enum {
Greg Kroah-Hartman
maintainerPATCH 78/187 ACPI: Make acpi_skip_timer_override cover all source_irq==0 cases
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Feng Tang <[email protected]>
commit ae10ccdc3093486f8c2369d227583f9d79f628e5 upstream.
Currently when acpi_skip_timer_override is set, it only cover the (source_irq == 0 && global_irq == 2) cases. While there is also platform which need use this option and its global_irq is not 2. This patch will extend acpi_skip_timer_override to cover all timer overriding cases as long as the source irq is 0.
This is the first part of a fix to kernel bug bugzilla 40002:
"IRQ 0 assigned to VGA"
https://bugzilla.kernel.org/show_bug.cgi?id=40002
--- arch/x86/kernel/acpi/boot.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
arch/x86/kernel/acpi/boot.c +8 -6
@@ -422,12 +422,14 @@ acpi_parse_int_src_ovr(struct acpi_subtareturn 0 ; } -if (intsrc->source_irq ==0 && intsrc->global_irq ==2 ) { +if (intsrc->source_irq ==0 ) {if (acpi_skip_timer_override) { -printk (PREFIX "BIOS IRQ0 pin2 override ignored.\n" ); +printk (PREFIX "BIOS IRQ0 override ignored.\n" );return 0 ; } -if (acpi_fix_pin2_polarity && (intsrc->inti_flags &ACPI_MADT_POLARITY_MASK )) { + +if ((intsrc->global_irq ==2 ) && acpi_fix_pin2_polarity + && (intsrc->inti_flags &ACPI_MADT_POLARITY_MASK )) { intsrc->inti_flags &= ~ACPI_MADT_POLARITY_MASK ;printk (PREFIX "BIOS IRQ0 pin2 override: forcing polarity to high active.\n" ); }
@@ -1334,7 +1336,7 @@ static int __init dmi_disable_acpi(const }/* -* Force ignoring BIOS IRQ0 pin2 override +* Force ignoring BIOS IRQ0 override */ static int __init dmi_ignore_irq0_timer_override (const struct dmi_system_id *d) {
@@ -1344,7 +1346,7 @@ static int __init dmi_ignore_irq0_timer_*/ if (!acpi_skip_timer_override) {WARN (1 ,KERN_ERR "ati_ixp4x0 quirk not complete.\n" ); -pr_notice ("%s detected: Ignoring BIOS IRQ0 pin2 override\n" , +pr_notice ("%s detected: Ignoring BIOS IRQ0 override\n" , d->ident); acpi_skip_timer_override =1 ; }
@@ -1438,7 +1440,7 @@ static struct dmi_system_id __initdata a* is enabled. This input is incorrectly designated the * ISA IRQ 0 via an interrupt source override even though * it is wired to the output of the master 8259A and INTIN0 -* is not connected at all. Force ignoring BIOS IRQ0 pin2 +* is not connected at all. Force ignoring BIOS IRQ0 * override in that cases. */ {
Greg Kroah-Hartman
maintainerPATCH 79/187 ACPI: Remove one board specific WARN when ignoring timer overriding
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Feng Tang <[email protected]>
commit 7f68b4c2e158019c2ec494b5cfbd9c83b4e5b253 upstream.
Current WARN msg is only for the ati_ixp4x0 board, while this function is used by mulitple platforms. So this one board specific warning is not appropriate any more.
--- arch/x86/kernel/acpi/boot.c | 5 ----- 1 file changed, 5 deletions(-)
arch/x86/kernel/acpi/boot.c +0 -5
@@ -1340,12 +1340,7 @@ static int __init dmi_disable_acpi(const*/ static int __init dmi_ignore_irq0_timer_override (const struct dmi_system_id *d) { -/* -* The ati_ixp4x0_rev() early PCI quirk should have set -* the acpi_skip_timer_override flag already: -*/ if (!acpi_skip_timer_override) { -WARN (1 ,KERN_ERR "ati_ixp4x0 quirk not complete.\n" );pr_notice ("%s detected: Ignoring BIOS IRQ0 override\n" , d->ident); acpi_skip_timer_override =1 ;
Greg Kroah-Hartman
maintainer=?y?q?=5B=20183/187=5D=20drivers/rtc/rtc-mxc=2Ec=3A=20fix=20irq=20enabled=20interrupts=20warning?=
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: =?UTF-8?q?Beno=C3=AEt=20Th=C3=A9baudeau?=
commit b59f6d1febd6cbe9fae4589bf72da0ed32bc69e0 upstream.
Fixes
WARNING: at irq/handle.c:146 handle_irq_event_percpu+0x19c/0x1b8() irq 25 handler mxc_rtc_interrupt+0x0/0xac enabled interrupts Modules linked in: (unwind_backtrace+0x0/0xf0) from (warn_slowpath_common+0x4c/0x64) (warn_slowpath_common+0x4c/0x64) from (warn_slowpath_fmt+0x30/0x40) (warn_slowpath_fmt+0x30/0x40) from (handle_irq_event_percpu+0x19c/0x1b8) (handle_irq_event_percpu+0x19c/0x1b8) from (handle_irq_event+0x28/0x38) (handle_irq_event+0x28/0x38) from (handle_level_irq+0x80/0xc4) (handle_level_irq+0x80/0xc4) from (generic_handle_irq+0x24/0x38) (generic_handle_irq+0x24/0x38) from (handle_IRQ+0x30/0x84) (handle_IRQ+0x30/0x84) from (avic_handle_irq+0x2c/0x4c) (avic_handle_irq+0x2c/0x4c) from (__irq_svc+0x40/0x60) Exception stack(0xc050bf60 to 0xc050bfa8) bf60: 00000001 00000000 003c4208 c0018e20 c050a000 c050a000 c054a4c8 c050a000 bf80: c05157a8 4117b363 80503bb4 00000000 01000000 c050bfa8 c0018e2c c000e808 bfa0: 60000013 ffffffff (__irq_svc+0x40/0x60) from (default_idle+0x1c/0x30) (default_idle+0x1c/0x30) from (cpu_idle+0x68/0xa8) (cpu_idle+0x68/0xa8) from (start_kernel+0x22c/0x26c)
--- drivers/rtc/rtc-mxc.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/rtc/rtc-mxc.c +3 -2
@@ -202,10 +202,11 @@ static irqreturn_t mxc_rtc_interrupt(intstruct platform_device *pdev = dev_id;struct rtc_plat_data *pdata =platform_get_drvdata (pdev);void __iomem *ioaddr = pdata->ioaddr; +unsigned long flags;u32 status;u32 events =0 ; -spin_lock_irq (&pdata->rtc->irq_lock); +spin_lock_irqsave (&pdata->rtc->irq_lock, flags); status =readw (ioaddr +RTC_RTCISR ) &readw (ioaddr +RTC_RTCIENR );/* clear interrupt sources */ writew (status, ioaddr +RTC_RTCISR );
@@ -224,7 +225,7 @@ static irqreturn_t mxc_rtc_interrupt(int events |= (RTC_PF |RTC_IRQF );rtc_update_irq (pdata->rtc,1 , events); -spin_unlock_irq (&pdata->rtc->irq_lock); +spin_unlock_irqrestore (&pdata->rtc->irq_lock, flags);return IRQ_HANDLED ; }
Greg Kroah-Hartman
maintainerPATCH 80/187 ACPI: Add a quirk for "AMILO PRO V2030" to ignore the timer overriding
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Feng Tang <[email protected]>
commit f6b54f083cc66cf9b11d2120d8df3c2ad4e0836d upstream.
This is the 2nd part of fix for kernel bugzilla 40002:
"IRQ 0 assigned to VGA"
https://bugzilla.kernel.org/show_bug.cgi?id=40002
The root cause is the buggy FW, whose ACPI tables assign the GSI 16 to 2 irqs 0 and 16(VGA), and the VGA is the right owner of GSI 16. So add a quirk to ignore the irq0 overriding GSI 16 for the FUJITSU SIEMENS AMILO PRO V2030 platform will solve this issue.
--- arch/x86/kernel/acpi/boot.c | 8 ++++++++ 1 file changed, 8 insertions(+)
arch/x86/kernel/acpi/boot.c +8 -0
@@ -1470,6 +1470,14 @@ static struct dmi_system_id __initdata a DMI_MATCH(DMI_PRODUCT_NAME, "HP Compaq 6715b"), }, }, + { + .callback = dmi_ignore_irq0_timer_override, + .ident = "FUJITSU SIEMENS", + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"), + DMI_MATCH(DMI_PRODUCT_NAME, "AMILO PRO V2030"), + }, + }, {} };
Greg Kroah-Hartman
maintainerPATCH 81/187 ACPI, x86: fix Dell M6600 ACPI reboot regression via DMI
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Rui <[email protected]>
commit 76eb9a30db4bc8fd172f9155247264b5f2686d7b upstream.
Dell Precision M6600 is known to require PCI reboot, so add it to the reboot blacklist in pci_reboot_dmi_table[].
https://bugzilla.kernel.org/show_bug.cgi?id=42749
--- arch/x86/kernel/reboot.c | 8 ++++++++ 1 file changed, 8 insertions(+)
arch/x86/kernel/reboot.c +8 -0
@@ -471,6 +471,14 @@ static struct dmi_system_id __initdata p DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex 990"), }, }, + { /* Handle problems with rebooting on the Precision M6600. */ + .callback = set_pci_reboot, + .ident = "Dell OptiPlex 990", + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), + DMI_MATCH(DMI_PRODUCT_NAME, "Precision M6600"), + }, + }, { } };
Greg Kroah-Hartman
maintainerPATCH 82/187 ACPI sysfs.c strlen fix
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Vasilyev <[email protected]>
commit 9f132652d94c96476b0b0a8caf0c10e96ab10fa8 upstream.
Current code is ignoring the last character of "enable" and "disable" in comparisons.
https://bugzilla.kernel.org/show_bug.cgi?id=33732
--- drivers/acpi/sysfs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/acpi/sysfs.c +2 -2
@@ -173,7 +173,7 @@ static int param_set_trace_state(const c {int result =0 ; -if (!strncmp (val,"enable" ,strlen ("enable" ) -1 )) { +if (!strncmp (val,"enable" ,strlen ("enable" ))) { result =acpi_debug_trace (trace_method_name, trace_debug_level, trace_debug_layer,0 );if (result)
@@ -181,7 +181,7 @@ static int param_set_trace_state(const c goto exit; } -if (!strncmp (val,"disable" ,strlen ("disable" ) -1 )) { +if (!strncmp (val,"disable" ,strlen ("disable" ))) {int name =0 ; result =acpi_debug_trace ((char *)&name, trace_debug_level, trace_debug_layer,0 );
Greg Kroah-Hartman
maintainerPATCH 83/187 ARM: Orion: Fix Virtual/Physical mixup with watchdog
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Lunn <[email protected]>
commit 0fa1f0609a0c1fe8b2be3c0089a2cb48f7fda521 upstream.
The orion watchdog is expecting to be passed the physcial address of the hardware, and will ioremap() it to give a virtual address it will use as the base address for the hardware. However, when creating the platform resource record, a virtual address was being used.
Add the necassary #define's so we can pass the physical address as expected.
Tested on Kirkwood and Orion5x.
--- arch/arm/mach-kirkwood/include/mach/bridge-regs.h | 1 + arch/arm/mach-kirkwood/include/mach/kirkwood.h | 1 + arch/arm/mach-orion5x/include/mach/bridge-regs.h | 2 +- arch/arm/mach-orion5x/include/mach/orion5x.h | 1 + arch/arm/plat-orion/common.c | 2 +- 5 files changed, 5 insertions(+), 2 deletions(-)
arch/arm/mach-kirkwood/include/mach/bridge-regs.h +1 -0
@@ -38,6 +38,7 @@#define IRQ_MASK_HIGH_OFF 0x0014#define TIMER_VIRT_BASE (BRIDGE_VIRT_BASE | 0x0300) +#define TIMER_PHYS_BASE (BRIDGE_PHYS_BASE | 0x0300)#define L2_CONFIG_REG (BRIDGE_VIRT_BASE | 0x0128)#define L2_WRITETHROUGH 0x00000010
arch/arm/mach-kirkwood/include/mach/kirkwood.h +1 -0
@@ -80,6 +80,7 @@#define UART1_VIRT_BASE (DEV_BUS_VIRT_BASE | 0x2100)#define BRIDGE_VIRT_BASE (KIRKWOOD_REGS_VIRT_BASE | 0x20000) +#define BRIDGE_PHYS_BASE (KIRKWOOD_REGS_PHYS_BASE | 0x20000)#define CRYPTO_PHYS_BASE (KIRKWOOD_REGS_PHYS_BASE | 0x30000)
arch/arm/mach-orion5x/include/mach/bridge-regs.h +1 -1
@@ -35,5 +35,5 @@#define MAIN_IRQ_MASK (ORION5X_BRIDGE_VIRT_BASE | 0x204)#define TIMER_VIRT_BASE (ORION5X_BRIDGE_VIRT_BASE | 0x300) - +#define TIMER_PHYS_BASE (ORION5X_BRIDGE_PHYS_BASE | 0x300)#endif
arch/arm/mach-orion5x/include/mach/orion5x.h +1 -0
@@ -82,6 +82,7 @@#define UART1_VIRT_BASE (ORION5X_DEV_BUS_VIRT_BASE | 0x2100)#define ORION5X_BRIDGE_VIRT_BASE (ORION5X_REGS_VIRT_BASE | 0x20000) +#define ORION5X_BRIDGE_PHYS_BASE (ORION5X_REGS_PHYS_BASE | 0x20000)#define ORION5X_PCI_VIRT_BASE (ORION5X_REGS_VIRT_BASE | 0x30000)
arch/arm/plat-orion/common.c +1 -1
@@ -570,7 +570,7 @@ void __init orion_spi_1_init(unsigned lostatic struct orion_wdt_platform_data orion_wdt_data;static struct resource orion_wdt_resource = -DEFINE_RES_MEM (TIMER_VIRT_BASE ,0x28 ); +DEFINE_RES_MEM (TIMER_PHYS_BASE ,0x28 );static struct platform_device orion_wdt_device = { .name ="orion_wdt" ,
Greg Kroah-Hartman
maintainerPATCH 84/187 ARM: Orion: Fix WDT compile for Dove and MV78xx0
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Lunn <[email protected]>
commit 1e0c1ce00d83834d03f4d8d039734ca4703298df upstream.
Commit 0fa1f0609a0c1fe8b2be3c0089a2cb48f7fda521 (ARM: Orion: Fix Virtual/Physical mixup with watchdog) broke the Dove & MV78xx0 build. Although these two SoC don't use the watchdog, the shared platform code still needs to build. Add the necessary defines.
--- arch/arm/mach-dove/include/mach/bridge-regs.h | 1 + arch/arm/mach-dove/include/mach/dove.h | 1 + arch/arm/mach-mv78xx0/include/mach/bridge-regs.h | 1 + arch/arm/mach-mv78xx0/include/mach/mv78xx0.h | 2 ++ 4 files changed, 5 insertions(+)
arch/arm/mach-dove/include/mach/bridge-regs.h +1 -0
@@ -50,5 +50,6 @@#define POWER_MANAGEMENT (BRIDGE_VIRT_BASE | 0x011c)#define TIMER_VIRT_BASE (BRIDGE_VIRT_BASE | 0x0300) +#define TIMER_PHYS_BASE (BRIDGE_PHYS_BASE | 0x0300)#endif
arch/arm/mach-dove/include/mach/dove.h +1 -0
@@ -78,6 +78,7 @@/* North-South Bridge */ #define BRIDGE_VIRT_BASE (DOVE_SB_REGS_VIRT_BASE | 0x20000) +#define BRIDGE_PHYS_BASE (DOVE_SB_REGS_PHYS_BASE | 0x20000)/* Cryptographic Engine */ #define DOVE_CRYPT_PHYS_BASE (DOVE_SB_REGS_PHYS_BASE | 0x30000)
arch/arm/mach-mv78xx0/include/mach/bridge-regs.h +1 -0
@@ -31,5 +31,6 @@#define IRQ_MASK_HIGH_OFF 0x0014#define TIMER_VIRT_BASE (BRIDGE_VIRT_BASE | 0x0300) +#define TIMER_PHYS_BASE (BRIDGE_PHYS_BASE | 0x0300)#endif
arch/arm/mach-mv78xx0/include/mach/mv78xx0.h +2 -0
@@ -42,6 +42,7 @@#define MV78XX0_CORE0_REGS_PHYS_BASE 0xf1020000#define MV78XX0_CORE1_REGS_PHYS_BASE 0xf1024000#define MV78XX0_CORE_REGS_VIRT_BASE 0xfe400000 +#define MV78XX0_CORE_REGS_PHYS_BASE 0xfe400000#define MV78XX0_CORE_REGS_SIZE SZ_16K#define MV78XX0_PCIE_IO_PHYS_BASE (i) (0xf0800000 + ((i) << 20))
@@ -59,6 +60,7 @@* Core-specific peripheral registers. */ #define BRIDGE_VIRT_BASE (MV78XX0_CORE_REGS_VIRT_BASE) +#define BRIDGE_PHYS_BASE (MV78XX0_CORE_REGS_PHYS_BASE)/* * Register Map
Greg Kroah-Hartman
maintainerPATCH 85/187 xen/blkback: Copy id field when doing BLKIF_DISCARD.
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Rzeszutek Wilk <[email protected]>
commit 8c9ce606a60e4a0cb447bdc082ce383b96b227b4 upstream.
We weren't copying the id field so when we sent the response back to the frontend (especially with a 64-bit host and 32-bit guest), we ended up using a random value. This lead to the frontend crashing as it would try to pass to __blk_end_request_all a NULL 'struct request' (b/c it would use the 'id' to find the proper 'struct request' in its shadow array) and end up crashing:
BUG: unable to handle kernel NULL pointer dereference at 000000e4 IP: [<c0646d4c>] __blk_end_request_all+0xc/0x40
.. snip..
EIP is at __blk_end_request_all+0xc/0x40
.. snip..
[<ed95db72>] blkif_interrupt+0x172/0x330 [xen_blkfront]
This fixes the bug by passing in the proper id for the response.
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=824641
--- drivers/block/xen-blkback/common.h | 2 ++ 1 file changed, 2 insertions(+)
drivers/block/xen-blkback/common.h +2 -0
@@ -257,6 +257,7 @@ static inline void blkif_get_x86_32_req(break ;case BLKIF_OP_DISCARD : dst->u.discard.flag = src->u.discard.flag; + dst->u.discard.id = src->u.discard.id; dst->u.discard.sector_number = src->u.discard.sector_number; dst->u.discard.nr_sectors = src->u.discard.nr_sectors;break ;
@@ -287,6 +288,7 @@ static inline void blkif_get_x86_64_req(break ;case BLKIF_OP_DISCARD : dst->u.discard.flag = src->u.discard.flag; + dst->u.discard.id = src->u.discard.id; dst->u.discard.sector_number = src->u.discard.sector_number; dst->u.discard.nr_sectors = src->u.discard.nr_sectors;break ;
Greg Kroah-Hartman
maintainerPATCH 86/187 umem: fix up unplugging
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tao Guo <[email protected]>
commit 32587371ad3db2f9d335de10dbd8cffd4fff5669 upstream.
Fix a regression introduced by 7eaceaccab5f40 ("block: remove per-queue plugging"). In that patch, Jens removed the whole mm_unplug_device() function, which used to be the trigger to make umem start to work.
We need to implement unplugging to make umem start to work, or I/O will never be triggered.
--- drivers/block/umem.c | 40 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 40 insertions(+)
drivers/block/umem.c +40 -0
@@ -513,6 +513,44 @@ static void process_page(unsigned long d } } +struct mm_plug_cb { +struct blk_plug_cb cb; +struct cardinfo *card; +}; + +static void mm_unplug (struct blk_plug_cb *cb) +{ + struct mm_plug_cb *mmcb = container_of(cb, struct mm_plug_cb, cb); + +spin_lock_irq (&mmcb->card->lock); +activate (mmcb->card); +spin_unlock_irq (&mmcb->card->lock); +kfree (mmcb); +} + +static int mm_check_plugged (struct cardinfo *card) +{ +struct blk_plug *plug = current->plug; +struct mm_plug_cb *mmcb; + +if (!plug) +return 0 ; + +list_for_each_entry (mmcb, &plug->cb_list, cb.list) { +if (mmcb->cb.callback == mm_unplug && mmcb->card == card) +return 1 ; + } +/* Not currently on the callback list */ + mmcb =kmalloc (sizeof (*mmcb),GFP_ATOMIC ); +if (!mmcb) +return 0 ; + + mmcb->card = card; + mmcb->cb.callback = mm_unplug; +list_add (&mmcb->cb.list, &plug->cb_list); +return 1 ; +} +static void mm_make_request (struct request_queue *q,struct bio *bio) {struct cardinfo *card = q->queuedata;
@@ -523,6 +561,8 @@ static void mm_make_request(struct reque *card->biotail = bio; bio->bi_next =NULL ; card->biotail = &bio->bi_next; +if (bio->bi_rw &REQ_SYNC || !mm_check_plugged (card)) +activate (card);spin_unlock_irq (&card->lock);return ;
Greg Kroah-Hartman
maintainerPATCH 87/187 stable: Allow merging of backports for serious user-visible performance issues
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mel Gorman <[email protected]>
commit eb3979f64d25120d60b9e761a4c58f70b1a02f86 upstream.
Distribution kernel maintainers routinely backport fixes for users that were deemed important but not "something critical" as defined by the rules. To users of these kernels they are very serious and failing to fix them reduces the value of -stable.
The problem is that the patches fixing these issues are often subtle and prone to regressions in other ways and need greater care and attention. To combat this, these "serious" backports should have a higher barrier to entry.
This patch relaxes the rules to allow a distribution maintainer to merge to -stable a backported patch or small series that fixes a "serious" user-visible performance issue. They should include additional information on the user-visible bug affected and a link to the bugzilla entry if available. The same rules about the patch being already in mainline still apply.
--- Documentation/stable_kernel_rules.txt | 6 ++++++ 1 file changed, 6 insertions(+)
Documentation/stable_kernel_rules.txt +6 -0
@@ -12,6 +12,12 @@ Rules on what kind of patches are accept marked CONFIG_BROKEN), an oops, a hang, data corruption, a real security issue, or some "oh, that's not good" issue. In short, something critical. + - Serious issues as reported by a user of a distribution kernel may also + be considered if they fix a notable performance or interactivity issue. + As these fixes are not as obvious and have a higher risk of a subtle + regression they should only be submitted by a distribution kernel + maintainer and include an addendum linking to a bugzilla entry if it + exists and additional information on the user-visible impact. - New device IDs and quirks are also accepted. - No "theoretical race condition" issues, unless an explanation of how the race can be exploited is also provided.
Greg Kroah-Hartman
maintainerPATCH 88/187 mm: correctly synchronize rss-counters at exit/exec
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Khlebnikov <[email protected]>
commit 4fe7efdbdfb1c7e7a7f31decfd831c0f31d37091 upstream.
do_exit() and exec_mmap() call sync_mm_rss() before mm_release() does put_user(clear_child_tid) which can update task->rss_stat and thus make mm->rss_stat inconsistent. This triggers the "BUG:" printk in check_mm().
Let's fix this bug in the safest way, and optimize/cleanup this later.
--- fs/exec.c | 2 +- kernel/exit.c | 1 + 2 files changed, 2 insertions(+), 1 deletion(-)
fs/exec.c +1 -1
@@ -823,10 +823,10 @@ static int exec_mmap(struct mm_struct *m/* Notify parent that we're no longer interested in the old VM */ tsk = current; old_mm = current->mm; -sync_mm_rss (old_mm);mm_release (tsk, old_mm);if (old_mm) { +sync_mm_rss (old_mm);/* * Make sure that if there is a core dump in progress * for the old mm, we get out and die instead of going
kernel/exit.c +1 -0
@@ -643,6 +643,7 @@ static void exit_mm(struct task_struct *mm_release (tsk, mm);if (!mm)return ; +sync_mm_rss (mm);/* * Serialize with any possible pending coredump. * We must hold mmap_sem around checking core_state
Greg Kroah-Hartman
maintainerPATCH 89/187 PM / Sleep: Prevent waiting forever on asynchronous suspend after abort
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mandeep Singh Baines <[email protected]>
commit 1f758b23177d588a71b96ad02990e715949bb82f upstream.
__device_suspend() must always send a completion. Otherwise, parent devices will wait forever.
Commit 1e2ef05b, "PM: Limit race conditions between runtime PM and system sleep (v2)", introduced a regression by short-circuiting the complete_all() for certain error cases.
This patch fixes the bug by always signalling a completion.
Addresses http://crosbug.com/31972
Tested by injecting an abort.
--- drivers/base/power/main.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/base/power/main.c +4 -2
@@ -1021,7 +1021,7 @@ static int __device_suspend(struct devicdpm_wait_for_children (dev, async);if (async_error) -return 0 ; + goto Complete;pm_runtime_get_noresume (dev);if (pm_runtime_barrier (dev) &&device_may_wakeup (dev))
@@ -1030,7 +1030,7 @@ static int __device_suspend(struct devicif (pm_wakeup_pending ()) {pm_runtime_put_sync (dev); async_error = -EBUSY ; -return 0 ; + goto Complete; }device_lock (dev);
@@ -1087,6 +1087,8 @@ static int __device_suspend(struct devic }device_unlock (dev); + + Complete:complete_all (&dev->power.completion);if (error) {
Greg Kroah-Hartman
maintainerPATCH 90/187 dmaengine: pl330: dont complete descriptor for cyclic dma
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tushar Behera <[email protected]>
commit 30c1dc0ff30b5552e8af555265dbeac5637cbb48 upstream.
Commit eab215855803 ("dmaengine: pl330: dont complete descriptor for cyclic dma") wrongly completes descriptor for cyclic dma, hence following BUG_ON is still hit with cyclic DMA operations.
kernel BUG at drivers/dma/dmaengine.h:53!
--- drivers/dma/pl330.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/dma/pl330.c +1 -1
@@ -2322,7 +2322,7 @@ static void pl330_tasklet(unsigned long/* Pick up ripe tomatoes */ list_for_each_entry_safe (desc, _dt, &pch->work_list, node)if (desc->status ==DONE ) { -if (pch->cyclic) +if (!pch->cyclic)dma_cookie_complete (&desc->txd);list_move_tail (&desc->node, &list); }
Greg Kroah-Hartman
maintainerPATCH 91/187 NFS: Force the legacy idmapper to be single threaded
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryan Schumaker <[email protected]>
commit b1027439dff844675f6c0df97a1b1d190791a699 upstream.
It was initially coded under the assumption that there would only be one request at a time, so use a lock to enforce this requirement..
--- fs/nfs/idmap.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
fs/nfs/idmap.c +8 -5
@@ -57,6 +57,11 @@ unsigned int nfs_idmap_cache_timeout = 6static const struct cred *id_resolver_cache;static struct key_type key_type_id_resolver_legacy; +struct idmap { +struct rpc_pipe *idmap_pipe; +struct key_construction *idmap_key_cons; +struct mutex idmap_mutex; +};/** * nfs_fattr_init_names - initialise the nfs_fattr owner_name/group_name fields
@@ -310,9 +315,11 @@ static ssize_t nfs_idmap_get_key(const c name, namelen, type, data, data_size, NULL);if (ret <0 ) { +mutex_lock (&idmap->idmap_mutex); ret =nfs_idmap_request_key (&key_type_id_resolver_legacy, name, namelen, type, data, data_size, idmap); +mutex_unlock (&idmap->idmap_mutex); }return ret; }
@@ -354,11 +361,6 @@ static int nfs_idmap_lookup_id(const cha/* idmap classic begins here */ module_param (nfs_idmap_cache_timeout, int,0644 ); -struct idmap { -struct rpc_pipe *idmap_pipe; -struct key_construction *idmap_key_cons; -}; -enum { Opt_find_uid, Opt_find_gid, Opt_find_user, Opt_find_group, Opt_find_err };
@@ -469,6 +471,7 @@ nfs_idmap_new(struct nfs_client *clp)return error; } idmap->idmap_pipe = pipe; +mutex_init (&idmap->idmap_mutex); clp->cl_idmap = idmap;return 0 ;
Greg Kroah-Hartman
maintainerPATCH 92/187 clk: Allow late cache allocation for clk->parents
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rajendra Nayak <[email protected]>
commit 7975059db572eb47f0fb272a62afeae272a4b209 upstream.
Parent clocks for muxes are cached in clk->parents to avoid frequent lookups, however the cache allocation happens only during clock registeration and later clk_set_parent() assumes a cache space available and allocated.
This is not entirely true for platforms which do early clock registerations wherein the cache allocation using kzalloc could fail during clock registeration.
Allow cache allocation to happen later as part of clk_set_parent() to help such cases and avoid crashes assuming a cache being available.
While here also replace existing kmalloc() with kzalloc() in the file.
--- drivers/clk/clk.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-)
drivers/clk/clk.c +10 -5
@@ -997,7 +997,7 @@ static struct clk *__clk_init_parent(strif (!clk->parents) clk->parents = -kmalloc ((sizeof (struct clk *) * clk->num_parents), +kzalloc ((sizeof (struct clk *) * clk->num_parents),GFP_KERNEL );if (!clk->parents)
@@ -1063,9 +1063,13 @@ static int __clk_set_parent(struct clk * old_parent = clk->parent;/* find index of new parent clock using cached parent ptrs */ -for (i =0 ; i < clk->num_parents; i++) -if (clk->parents[i] == parent) -break ; +if (clk->parents) +for (i =0 ; i < clk->num_parents; i++) +if (clk->parents[i] == parent) +break ; +else + clk->parents =kzalloc ((sizeof (struct clk *) * clk->num_parents), +GFP_KERNEL );/* * find index of new parent clock using string name comparison
@@ -1074,7 +1078,8 @@ static int __clk_set_parent(struct clk *if (i == clk->num_parents)for (i =0 ; i < clk->num_parents; i++)if (!strcmp (clk->parent_names[i], parent->name)) { - clk->parents[i] =__clk_lookup (parent->name); +if (clk->parents) + clk->parents[i] =__clk_lookup (parent->name);break ; }
Greg Kroah-Hartman
maintainerPATCH 93/187 clk: fix parent validation in __clk_set_parent()
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rajendra Nayak <[email protected]>
commit 863b13271f1608ab3af6f7a371047d9a66693e38 upstream.
The below commit introduced a bug in __clk_set_parent() which could cause it to *skip* the parent validation which makes sure the parent passed to the api is a valid one.
commit 7975059db572eb47f0fb272a62afeae272a4b209
Author: Rajendra Nayak <[email protected]>
Date: Wed Jun 6 14:41:31 2012 +0530
clk: Allow late cache allocation for clk->parentsThis was identified by the following compiler warning..
drivers/clk/clk.c: In function '__clk_set_parent':
drivers/clk/clk.c:1083:5: warning: 'i' may be used uninitialized in this function [-Wuninitialized]
.. as reported by Marc Kleine-Budde.
There were various options discussed on how to fix this, one being initing 'i' to clk->num_parents, but the below approach was found to be more appropriate as it also makes the 'parent validation' code simpler to read.
--- drivers/clk/clk.c | 28 +++++++++++++--------------- 1 file changed, 13 insertions(+), 15 deletions(-)
drivers/clk/clk.c +13 -15
@@ -1062,26 +1062,24 @@ static int __clk_set_parent(struct clk * old_parent = clk->parent; -/* find index of new parent clock using cached parent ptrs */ -if (clk->parents) -for (i =0 ; i < clk->num_parents; i++) -if (clk->parents[i] == parent) -break ; -else +if (!clk->parents) clk->parents =kzalloc ((sizeof (struct clk *) * clk->num_parents),GFP_KERNEL );/* -* find index of new parent clock using string name comparison -* also try to cache the parent to avoid future calls to __clk_lookup +* find index of new parent clock using cached parent ptrs, +* or if not yet cached, use string name comparison and cache +* them now to avoid future calls to __clk_lookup. */ -if (i == clk->num_parents) -for (i =0 ; i < clk->num_parents; i++) -if (!strcmp (clk->parent_names[i], parent->name)) { -if (clk->parents) - clk->parents[i] =__clk_lookup (parent->name); -break ; - } +for (i =0 ; i < clk->num_parents; i++) { +if (clk->parents && clk->parents[i] == parent) +break ; +else if (!strcmp (clk->parent_names[i], parent->name)) { +if (clk->parents) + clk->parents[i] =__clk_lookup (parent->name); +break ; + } + }if (i == clk->num_parents) { pr_debug("%s: clock %s is not a possible parent of clock %s\n",
Greg Kroah-Hartman
maintainerPATCH 94/187 gpiolib: wm8994: Pay attention to the value set when enabling as output
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Brown <[email protected]>
commit 8cd578b6e28693f357867a77598a88ef3deb6b39 upstream.
Not paying attention to the value being set is a bad thing because it means that we'll not set the hardware up to reflect what was requested. Not setting the hardware up to reflect what was requested means that the caller won't get the results they wanted.
--- drivers/gpio/gpio-wm8994.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/gpio/gpio-wm8994.c +4 -1
@@ -89,8 +89,11 @@ static int wm8994_gpio_direction_out(strstruct wm8994_gpio *wm8994_gpio =to_wm8994_gpio (chip);struct wm8994 *wm8994 = wm8994_gpio->wm8994; +if (value) + value =WM8994_GPN_LVL ; +return wm8994_set_bits (wm8994,WM8994_GPIO_1 + offset, -WM8994_GPN_DIR ,0 ); +WM8994_GPN_DIR |WM8994_GPN_LVL , value); }static void wm8994_gpio_set (struct gpio_chip *chip,unsigned offset,int value)
Greg Kroah-Hartman
maintainerPATCH 95/187 USB: option: add id for Cellient MEN-200
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Shmygov <[email protected]>
commit 1e2c4e59d2b8797973471b4a287a43eac12a0f40 upstream.
Add vendor and product ID to option.c driver for Cellient MEN-200 EVDO Rev.B 450MHz data module.
http://cellient.com
--- drivers/usb/serial/option.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/usb/serial/option.c +5 -0
@@ -497,6 +497,10 @@ static void option_instat_callback(struc/* MediaTek products */ #define MEDIATEK_VENDOR_ID 0x0e8d +/* Cellient products */ +#define CELLIENT_VENDOR_ID 0x2692 +#define CELLIENT_PRODUCT_MEN200 0x9005 +/* some devices interfaces need special handling due to a number of reasons */ enum option_blacklist_reason {OPTION_BLACKLIST_NONE =0 ,
@@ -1233,6 +1237,7 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, 0x00a1, 0xff, 0x02, 0x01) }, { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, 0x00a2, 0xff, 0x00, 0x00) }, { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, 0x00a2, 0xff, 0x02, 0x01) }, /* MediaTek MT6276M modem & app port */ + { USB_DEVICE(CELLIENT_VENDOR_ID, CELLIENT_PRODUCT_MEN200) }, { } /* Terminating entry */ };MODULE_DEVICE_TABLE (usb, option_ids);
Greg Kroah-Hartman
maintainerPATCH 96/187 USB: option: Add USB ID for Novatel Ovation MC551
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Forest Bond <[email protected]>
commit 065b07e7a14676f4138ce4619d229c0be5a74230 upstream.
This device is also known as the Verizon USB551L.
--- drivers/usb/serial/option.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/serial/option.c +3 -0
@@ -236,6 +236,7 @@ static void option_instat_callback(struc#define NOVATELWIRELESS_PRODUCT_G1 0xA001#define NOVATELWIRELESS_PRODUCT_G1_M 0xA002#define NOVATELWIRELESS_PRODUCT_G2 0xA010 +#define NOVATELWIRELESS_PRODUCT_MC551 0xB001/* AMOI PRODUCTS */ #define AMOI_VENDOR_ID 0x1614
@@ -738,6 +739,8 @@ static const struct usb_device_id option { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_G1) }, { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_G1_M) }, { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_G2) }, +/* Novatel Ovation MC551 a.k.a. Verizon USB551L */ + { USB_DEVICE_AND_INTERFACE_INFO(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_MC551, 0xff, 0xff, 0xff) }, { USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_H01) }, { USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_H01A) },
Greg Kroah-Hartman
maintainerPATCH 97/187 USB: CP210x Add 10 Device IDs
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Craig Shelley <[email protected]>
commit 3fcc8f96829776cf181918461923d1e3bbb831a2 upstream.
This patch adds 10 device IDs for CP210x based devices from the following manufacturers:
Timewave
Clipsal
Festo
Link Instruments
--- drivers/usb/serial/cp210x.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/usb/serial/cp210x.c +11 -0
@@ -93,6 +93,7 @@ static const struct usb_device_id id_tab { USB_DEVICE(0x10C4, 0x814B) }, /* West Mountain Radio RIGtalk */ { USB_DEVICE(0x10C4, 0x8156) }, /* B&G H3000 link cable */ { USB_DEVICE(0x10C4, 0x815E) }, /* Helicomm IP-Link 1220-DVM */ + { USB_DEVICE(0x10C4, 0x815F) }, /* Timewave HamLinkUSB */ { USB_DEVICE(0x10C4, 0x818B) }, /* AVIT Research USB to TTL */ { USB_DEVICE(0x10C4, 0x819F) }, /* MJS USB Toslink Switcher */ { USB_DEVICE(0x10C4, 0x81A6) }, /* ThinkOptics WavIt */
@@ -134,7 +135,13 @@ static const struct usb_device_id id_tab { USB_DEVICE(0x10CE, 0xEA6A) }, /* Silicon Labs MobiData GPRS USB Modem 100EU */ { USB_DEVICE(0x13AD, 0x9999) }, /* Baltech card reader */ { USB_DEVICE(0x1555, 0x0004) }, /* Owen AC4 USB-RS485 Converter */ + { USB_DEVICE(0x166A, 0x0201) }, /* Clipsal 5500PACA C-Bus Pascal Automation Controller */ + { USB_DEVICE(0x166A, 0x0301) }, /* Clipsal 5800PC C-Bus Wireless PC Interface */ { USB_DEVICE(0x166A, 0x0303) }, /* Clipsal 5500PCU C-Bus USB interface */ + { USB_DEVICE(0x166A, 0x0304) }, /* Clipsal 5000CT2 C-Bus Black and White Touchscreen */ + { USB_DEVICE(0x166A, 0x0305) }, /* Clipsal C-5000CT2 C-Bus Spectrum Colour Touchscreen */ + { USB_DEVICE(0x166A, 0x0401) }, /* Clipsal L51xx C-Bus Architectural Dimmer */ + { USB_DEVICE(0x166A, 0x0101) }, /* Clipsal 5560884 C-Bus Multi-room Audio Matrix Switcher */ { USB_DEVICE(0x16D6, 0x0001) }, /* Jablotron serial interface */ { USB_DEVICE(0x16DC, 0x0010) }, /* W-IE-NE-R Plein & Baus GmbH PL512 Power Supply */ { USB_DEVICE(0x16DC, 0x0011) }, /* W-IE-NE-R Plein & Baus GmbH RCM Remote Control for MARATON Power Supply */
@@ -146,7 +153,11 @@ static const struct usb_device_id id_tab { USB_DEVICE(0x1843, 0x0200) }, /* Vaisala USB Instrument Cable */ { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */ { USB_DEVICE(0x1BE3, 0x07A6) }, /* WAGO 750-923 USB Service Cable */ + { USB_DEVICE(0x1E29, 0x0102) }, /* Festo CPX-USB */ + { USB_DEVICE(0x1E29, 0x0501) }, /* Festo CMSP */ { USB_DEVICE(0x3195, 0xF190) }, /* Link Instruments MSO-19 */ + { USB_DEVICE(0x3195, 0xF280) }, /* Link Instruments MSO-28 */ + { USB_DEVICE(0x3195, 0xF281) }, /* Link Instruments MSO-28 */ { USB_DEVICE(0x413C, 0x9500) }, /* DW700 GPS USB interface */ { } /* Terminating Entry */ };
Greg Kroah-Hartman
maintainerPATCH 98/187 SCSI & usb-storage: add try_rc_10_first flag
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <[email protected]>
commit 6a0bdffa0073857870a4ed1b4489762146359eb4 upstream.
Several bug reports have been received recently for USB mass-storage devices that don't handle READ CAPACITY(16) commands properly. They report bogus sizes, in some cases becoming unusable as a result.
The bugs were triggered by commit 09b6b51b0b6c1b9bb61815baf205e4d74c89ff04 (SCSI & usb-storage: add flags for VPD pages and REPORT LUNS), which caused usb-storage to stop overriding the SCSI level reported by devices. By default, the sd driver will try READ CAPACITY(16) first for any device whose level is above SCSI_SPC_2.
It seems likely that any device large enough to require the use of READ CAPACITY(16) (i.e., 2 TB or more) would be able to handle READ CAPACITY(10) commands properly. Indeed, I don't know of any devices that don't handle READ CAPACITY(10) properly.
Therefore this patch (as1559) adds a new flag telling the sd driver to try READ CAPACITY(10) before READ CAPACITY(16), and sets this flag for every USB mass-storage device. If a device really is larger than 2 TB, sd will fall back to READ CAPACITY(16) just as it used to.
This fixes Bugzilla #43391.
--- drivers/scsi/sd.c | 2 ++ drivers/usb/storage/scsiglue.c | 6 ++++++ include/scsi/scsi_device.h | 1 + 3 files changed, 9 insertions(+)
drivers/scsi/sd.c +2 -0
@@ -1898,6 +1898,8 @@ static int sd_try_rc16_first(struct scsi {if (sdp->host->max_cmd_len <16 )return 0 ; +if (sdp->try_rc_10_first) +return 0 ;if (sdp->scsi_level >SCSI_SPC_2 )return 1 ;if (scsi_device_protection (sdp))
drivers/usb/storage/scsiglue.c +6 -0
@@ -202,6 +202,12 @@ static int slave_configure(struct scsi_dif (us->fflags &US_FL_NO_READ_CAPACITY_16 ) sdev->no_read_capacity_16 =1 ; +/* +* Many devices do not respond properly to READ_CAPACITY_16. +* Tell the SCSI layer to try READ_CAPACITY_10 first. +*/ + sdev->try_rc_10_first =1 ; +/* assume SPC3 or latter devices support sense size > 18 */ if (sdev->scsi_level >SCSI_SPC_2 ) us->fflags |=US_FL_SANE_SENSE ;
include/scsi/scsi_device.h +1 -0
@@ -151,6 +151,7 @@ struct scsi_device {SD_LAST_BUGGY_SECTORS */ unsigned no_read_disc_info:1; /* Avoid READ_DISC_INFO cmds */ unsigned no_read_capacity_16:1; /* Avoid READ_CAPACITY_16 cmds */ + unsigned try_rc_10_first:1; /* Try READ_CAPACACITY_10 first */ unsigned is_visible:1; /* is the device visible in sysfs */DECLARE_BITMAP (supported_events,SDEV_EVT_MAXBITS );/* supported events */
Greg Kroah-Hartman
maintainerPATCH 99/187 usb-storage: revert commit afff07e61a52 (Add 090c:1000 to unusal-devs)
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <[email protected]>
commit 0070513b5e005161a7a7fd9a3f48f982b41eb094 upstream.
This patch (as1560) reverts commit afff07e61a5243e14ee3f0a272a0380cd744a8a3 (usb-storage: Add 090c:1000 to unusal-devs). It is no longer needed, because usb-storage now tells the sd driver to try READ CAPACITY(10) before READ CAPACITY(16) for every USB mass-storage device.
--- drivers/usb/storage/unusual_devs.h | 7 ------- 1 file changed, 7 deletions(-)
drivers/usb/storage/unusual_devs.h +0 -7
@@ -1107,13 +1107,6 @@ UNUSUAL_DEV( 0x090a, 0x1200, 0x0000, 0x9 USB_SC_RBC, USB_PR_BULK, NULL, 0 ), -/* Feiya QDI U2 DISK, reported by Hans de Goede <[email protected]> */ -UNUSUAL_DEV (0x090c ,0x1000 ,0x0000 ,0xffff , -"Feiya" , -"QDI U2 DISK" , -USB_SC_DEVICE ,USB_PR_DEVICE ,NULL , -US_FL_NO_READ_CAPACITY_16 ), -/* aeb */ UNUSUAL_DEV( 0x090c, 0x1132, 0x0000, 0xffff, "Feiya",
Greg Kroah-Hartman
maintainerPATCH 100/187 cfg80211: fix potential deadlock in regulatory
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eliad Peller <[email protected]>
commit fe20b39ec32e975f1054c0b7866c873a954adf05 upstream.
reg_timeout_work() calls restore_regulatory_settings() which takes cfg80211_mutex.
reg_set_request_processed() already holds cfg80211_mutex before calling cancel_delayed_work_sync(reg_timeout), so it might deadlock.
Call the async cancel_delayed_work instead, in order to avoid the potential deadlock.
This is the relevant lockdep warning:
cfg80211: Calling CRDA for country: XX
======================================================
[ INFO: possible circular locking dependency detected ]
3.4.0-rc5-wl+ #26 Not tainted
-------------------------------------------------------
kworker/0:2/1391 is trying to acquire lock:
(cfg80211_mutex){+.+.+.}, at: [<bf28ae00>] restore_regulatory_settings+0x34/0x418 [cfg80211]
but task is already holding lock:
((reg_timeout).work){+.+...}, at: [<c0059e94>] process_one_work+0x1f0/0x480
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 ((reg_timeout).work){+.+...}:
[<c008fd44>] validate_chain+0xb94/0x10f0
[<c0090b68>] __lock_acquire+0x8c8/0x9b0
[<c0090d40>] lock_acquire+0xf0/0x114
[<c005b600>] wait_on_work+0x4c/0x154
[<c005c000>] __cancel_work_timer+0xd4/0x11c
[<c005c064>] cancel_delayed_work_sync+0x1c/0x20
[<bf28b274>] reg_set_request_processed+0x50/0x78 [cfg80211]
[<bf28bd84>] set_regdom+0x550/0x600 [cfg80211]
[<bf294cd8>] nl80211_set_reg+0x218/0x258 [cfg80211]
[<c03c7738>] genl_rcv_msg+0x1a8/0x1e8
[<c03c6a00>] netlink_rcv_skb+0x5c/0xc0
[<c03c7584>] genl_rcv+0x28/0x34
[<c03c6720>] netlink_unicast+0x15c/0x228
[<c03c6c7c>] netlink_sendmsg+0x218/0x298
[<c03933c8>] sock_sendmsg+0xa4/0xc0
[<c039406c>] __sys_sendmsg+0x1e4/0x268
[<c0394228>] sys_sendmsg+0x4c/0x70
[<c0013840>] ret_fast_syscall+0x0/0x3c-> #1 (reg_mutex){+.+.+.}:
[<c008fd44>] validate_chain+0xb94/0x10f0
[<c0090b68>] __lock_acquire+0x8c8/0x9b0
[<c0090d40>] lock_acquire+0xf0/0x114
[<c04734dc>] mutex_lock_nested+0x48/0x320
[<bf28b2cc>] reg_todo+0x30/0x538 [cfg80211]
[<c0059f44>] process_one_work+0x2a0/0x480
[<c005a4b4>] worker_thread+0x1bc/0x2bc
[<c0061148>] kthread+0x98/0xa4
[<c0014af4>] kernel_thread_exit+0x0/0x8-> #0 (cfg80211_mutex){+.+.+.}:
[<c008ed58>] print_circular_bug+0x68/0x2cc
[<c008fb28>] validate_chain+0x978/0x10f0
[<c0090b68>] __lock_acquire+0x8c8/0x9b0
[<c0090d40>] lock_acquire+0xf0/0x114
[<c04734dc>] mutex_lock_nested+0x48/0x320
[<bf28ae00>] restore_regulatory_settings+0x34/0x418 [cfg80211]
[<bf28b200>] reg_timeout_work+0x1c/0x20 [cfg80211]
[<c0059f44>] process_one_work+0x2a0/0x480
[<c005a4b4>] worker_thread+0x1bc/0x2bc
[<c0061148>] kthread+0x98/0xa4
[<c0014af4>] kernel_thread_exit+0x0/0x8other info that might help us debug this:
Chain exists of: cfg80211_mutex --> reg_mutex --> (reg_timeout).work Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock((reg_timeout).work);
lock(reg_mutex);
lock((reg_timeout).work); lock(cfg80211_mutex);
*** DEADLOCK ***
2 locks held by kworker/0:2/1391:
#0: (events){.+.+.+}, at: [<c0059e94>] process_one_work+0x1f0/0x480 #1: ((reg_timeout).work){+.+...}, at: [<c0059e94>] process_one_work+0x1f0/0x480
stack backtrace: [<c001b928>] (unwind_backtrace+0x0/0x12c) from [<c0471d3c>] (dump_stack+0x20/0x24) [<c0471d3c>] (dump_stack+0x20/0x24) from [<c008ef70>] (print_circular_bug+0x280/0x2cc) [<c008ef70>] (print_circular_bug+0x280/0x2cc) from [<c008fb28>] (validate_chain+0x978/0x10f0) [<c008fb28>] (validate_chain+0x978/0x10f0) from [<c0090b68>] (__lock_acquire+0x8c8/0x9b0) [<c0090b68>] (__lock_acquire+0x8c8/0x9b0) from [<c0090d40>] (lock_acquire+0xf0/0x114) [<c0090d40>] (lock_acquire+0xf0/0x114) from [<c04734dc>] (mutex_lock_nested+0x48/0x320) [<c04734dc>] (mutex_lock_nested+0x48/0x320) from [<bf28ae00>] (restore_regulatory_settings+0x34/0x418 [cfg80211]) [<bf28ae00>] (restore_regulatory_settings+0x34/0x418 [cfg80211]) from [<bf28b200>] (reg_timeout_work+0x1c/0x20 [cfg80211]) [<bf28b200>] (reg_timeout_work+0x1c/0x20 [cfg80211]) from [<c0059f44>] (process_one_work+0x2a0/0x480) [<c0059f44>] (process_one_work+0x2a0/0x480) from [<c005a4b4>] (worker_thread+0x1bc/0x2bc) [<c005a4b4>] (worker_thread+0x1bc/0x2bc) from [<c0061148>] (kthread+0x98/0xa4) [<c0061148>] (kthread+0x98/0xa4) from [<c0014af4>] (kernel_thread_exit+0x0/0x8) cfg80211: Calling CRDA to update world regulatory domain cfg80211: World regulatory domain updated: cfg80211: (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp) cfg80211: (2402000 KHz - 2472000 KHz @ 40000 KHz), (300 mBi, 2000 mBm) cfg80211: (2457000 KHz - 2482000 KHz @ 20000 KHz), (300 mBi, 2000 mBm) cfg80211: (2474000 KHz - 2494000 KHz @ 20000 KHz), (300 mBi, 2000 mBm) cfg80211: (5170000 KHz - 5250000 KHz @ 40000 KHz), (300 mBi, 2000 mBm) cfg80211: (5735000 KHz - 5835000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
--- net/wireless/reg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/wireless/reg.c +1 -1
@@ -1389,7 +1389,7 @@ static void reg_set_request_processed(vospin_unlock (®_requests_lock);if (last_request->initiator ==NL80211_REGDOM_SET_BY_USER ) -cancel_delayed_work_sync (®_timeout); +cancel_delayed_work (®_timeout);if (need_more_processing)schedule_work (®_work);
Greg Kroah-Hartman
maintainerPATCH 101/187 batman-adv: fix skb->data assignment
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Antonio Quartulli <[email protected]>
commit 2c995ff892313009e336ecc8ec3411022f5b1c39 upstream.
skb_linearize(skb) possibly rearranges the skb internal data and then changes the skb->data pointer value. For this reason any other pointer in the code that was assigned skb->data before invoking skb_linearise(skb) must be re-assigned.
In the current tt_query message handling code this is not done and therefore, in case of skb linearization, the pointer used to handle the packet header ends up in pointing to free'd memory.
This bug was introduced by a73105b8d4c765d9ebfb664d0a66802127d8e4c7 (batman-adv: improved client announcement mechanism)
--- net/batman-adv/routing.c | 2 ++ 1 file changed, 2 insertions(+)
net/batman-adv/routing.c +2 -0
@@ -618,6 +618,8 @@ int recv_tt_query(struct sk_buff *skb, s* changes */ if (skb_linearize (skb) <0 ) goto out; +/* skb_linearize() possibly changed skb->data */ + tt_query = (struct tt_query_packet *)skb->data; tt_len = tt_query->tt_data *sizeof (struct tt_change );
Greg Kroah-Hartman
maintainerPATCH 102/187 batman-adv: only drop packets of known wifi clients
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Lindner <[email protected]>
commit 5870adc68fc39d81089f1e80efdf64b97e5c37a1 upstream.
bug introduced with 59b699cdee039d75915c354da06937102d1f9a84
If the source or destination mac address of an ethernet packet could not be found in the translation table the packet was dropped if AP isolation was turned on. This behavior would make it impossible to send broadcast packets over the mesh as the broadcast address will never enter the translation table.
--- net/batman-adv/translation-table.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
net/batman-adv/translation-table.c +4 -4
@@ -1803,10 +1803,10 @@ bool is_ap_isolated(struct bat_priv *bat {struct tt_local_entry *tt_local_entry =NULL ;struct tt_global_entry *tt_global_entry =NULL ; -bool ret = true; +bool ret = false;if (!atomic_read (&bat_priv->ap_isolation)) -return false; + goto out; tt_local_entry =tt_local_hash_find (bat_priv, dst);if (!tt_local_entry)
@@ -1816,10 +1816,10 @@ bool is_ap_isolated(struct bat_priv *batif (!tt_global_entry) goto out; -if (_is_ap_isolated (tt_local_entry, tt_global_entry)) +if (!_is_ap_isolated (tt_local_entry, tt_global_entry)) goto out; - ret = false; + ret = true; out:if (tt_global_entry)
Greg Kroah-Hartman
maintainerPATCH 103/187 ixgbe: Do not pad FCoE frames as this can cause issues with FCoE DDP
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Duyck <[email protected]>
commit 57efd44c8cad440fb00ef8078cb018ab2f221373 upstream.
FCoE target mode was experiencing issues due to the fact that we were sending up data frames that were padded to 60 bytes after the DDP logic had already stripped the frame down to 52 or 56 depending on the use of VLANs. This was resulting in the FCoE DDP logic having issues since it thought the frame still had data in it due to the padding.
To resolve this, adding code so that we do not pad FCoE frames prior to handling them to the stack.
--- drivers/net/ethernet/intel/ixgbe/ixgbe.h | 4 ++-- drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c | 2 +- drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 14 ++++++++++---- 3 files changed, 13 insertions(+), 7 deletions(-)
drivers/net/ethernet/intel/ixgbe/ixgbe.h +2 -2
@@ -189,7 +189,7 @@ enum ixgbe_ring_state_t { __IXGBE_HANG_CHECK_ARMED, __IXGBE_RX_RSC_ENABLED, __IXGBE_RX_CSUM_UDP_ZERO_ERR, - __IXGBE_RX_FCOE_BUFSZ, + __IXGBE_RX_FCOE, };#define check_for_tx_hang (ring) \
@@ -283,7 +283,7 @@ struct ixgbe_ring_feature {#if defined(IXGBE_FCOE ) && (PAGE_SIZE <8192 )static inline unsigned int ixgbe_rx_pg_order (struct ixgbe_ring *ring) { -return test_bit (__IXGBE_RX_FCOE_BUFSZ, &ring->state) ?1 :0 ; +return test_bit (__IXGBE_RX_FCOE, &ring->state) ?1 :0 ; }#else #define ixgbe_rx_pg_order (_ring) 0
drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c +1 -1
@@ -628,7 +628,7 @@ static int ixgbe_alloc_q_vector(struct i f = &adapter->ring_feature[RING_F_FCOE ];if ((rxr_idx >= f->mask) && (rxr_idx < f->mask + f->indices)) - set_bit(__IXGBE_RX_FCOE_BUFSZ, &ring->state); + set_bit(__IXGBE_RX_FCOE, &ring->state); }#endif /* IXGBE_FCOE */
drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +10 -4
@@ -1036,17 +1036,17 @@ static inline void ixgbe_rx_hash(struct#ifdef IXGBE_FCOE /** * ixgbe_rx_is_fcoe - check the rx desc for incoming pkt type -* @adapter: address of board private structure +* @ring: structure containing ring specific data * @rx_desc: advanced rx descriptor * * Returns : true if it is FCoE pkt */ -static inline bool ixgbe_rx_is_fcoe (struct ixgbe_adapter *adapter, +static inline bool ixgbe_rx_is_fcoe (struct ixgbe_ring *ring,union ixgbe_adv_rx_desc *rx_desc) {__le16 pkt_info = rx_desc->wb.lower.lo_dword.hs_rss.pkt_info; -return (adapter->flags &IXGBE_FLAG_FCOE_ENABLED ) && +return test_bit (__IXGBE_RX_FCOE, &ring->state) && ((pkt_info &cpu_to_le16 (IXGBE_RXDADV_PKTTYPE_ETQF_MASK )) == (cpu_to_le16 (IXGBE_ETQF_FILTER_FCOE <<IXGBE_RXDADV_PKTTYPE_ETQF_SHIFT )));
@@ -1519,6 +1519,12 @@ static bool ixgbe_cleanup_headers(struct skb->truesize -=ixgbe_rx_bufsz (rx_ring); } +#ifdef IXGBE_FCOE +/* do not attempt to pad FCoE Frames as this will disrupt DDP */ +if (ixgbe_rx_is_fcoe (rx_ring, rx_desc)) +return false; + +#endif /* if skb_pad returns an error the skb was freed */ if (unlikely (skb->len <60 )) {int pad_len =60 - skb->len;
@@ -1745,7 +1751,7 @@ static bool ixgbe_clean_rx_irq(struct ix#ifdef IXGBE_FCOE /* if ddp, not passing to ULD unless for FCP_RSP or error */ -if (ixgbe_rx_is_fcoe (adapter, rx_desc)) { +if (ixgbe_rx_is_fcoe (rx_ring, rx_desc)) { ddp_bytes =ixgbe_fcoe_ddp (adapter, rx_desc, skb);if (!ddp_bytes) {dev_kfree_skb_any (skb);
Greg Kroah-Hartman
maintainerPATCH 104/187 can: c_can: precedence error in c_can_chip_config()
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
commit d9cb9bd63eb27ac19f26a8547128c053f43a5da8 upstream.
(CAN_CTRLMODE_LISTENONLY & CAN_CTRLMODE_LOOPBACK) is (0x02 & 0x01) which is zero so the condition is never true. The intent here was to test that both flags were set.
--- drivers/net/can/c_can/c_can.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/can/c_can/c_can.c +2 -2
@@ -590,8 +590,8 @@ static void c_can_chip_config(struct net priv->write_reg (priv, &priv->regs->control,CONTROL_ENABLE_AR ); -if (priv->can.ctrlmode & (CAN_CTRLMODE_LISTENONLY & -CAN_CTRLMODE_LOOPBACK )) { +if ((priv->can.ctrlmode &CAN_CTRLMODE_LISTENONLY ) && + (priv->can.ctrlmode &CAN_CTRLMODE_LOOPBACK )) {/* loopback + silent mode : useful for hot self-test */ priv->write_reg (priv, &priv->regs->control,CONTROL_EIE |CONTROL_SIE |CONTROL_IE |CONTROL_TEST );
Greg Kroah-Hartman
maintainerPATCH 105/187 can: flexcan: use be32_to_cpup to handle the value of dt entry
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hui Wang <[email protected]>
commit 85f2f834e85517307f13e30e630a5fc86f757cb5 upstream.
The freescale arm i.MX series platform can support this driver, and usually the arm cpu works in the little endian mode by default, while device tree entry value is stored in big endian format, we should use be32_to_cpup() to handle them, after modification, it can work well both on the le cpu and be cpu.
--- drivers/net/can/flexcan.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/can/flexcan.c +2 -2
@@ -933,12 +933,12 @@ static int __devinit flexcan_probe(strucu32 clock_freq =0 ;if (pdev->dev.of_node) { -const u32 *clock_freq_p; +const __be32 *clock_freq_p; clock_freq_p =of_get_property (pdev->dev.of_node,"clock-frequency" ,NULL );if (clock_freq_p) - clock_freq = *clock_freq_p; + clock_freq =be32_to_cpup (clock_freq_p); }if (!clock_freq) {
Greg Kroah-Hartman
maintainerPATCH 110/187 oprofile: perf: use NR_CPUS instead or nr_cpumask_bits for static array
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Will Deacon <[email protected]>
commit e734568b675c985db2026848fefaac01c22977a5 upstream.
The OProfile perf backend uses a static array to keep track of the perf events on the system. When compiling with CONFIG_CPUMASK_OFFSTACK=y && SMP, nr_cpumask_bits is not a compile-time constant and the build will fail with:
oprofile_perf.c:28: error: variably modified 'perf_events' at file scope
This patch uses NR_CPUs instead of nr_cpumask_bits for the array initialisation. If this causes space problems in the future, we can always move to dynamic allocation for the events array.
--- drivers/oprofile/oprofile_perf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/oprofile/oprofile_perf.c +1 -1
@@ -25,7 +25,7 @@ static int oprofile_perf_enabled;static DEFINE_MUTEX (oprofile_perf_mutex);static struct op_counter_config *counter_config; -static struct perf_event **perf_events[nr_cpumask_bits]; +static struct perf_event **perf_events[NR_CPUS ];static int num_counters;/*
Greg Kroah-Hartman
maintainerPATCH 111/187 x86, compat: Use test_thread_flag(TIF_IA32) in compat signal delivery
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Suresh Siddha <[email protected]>
commit 0b91f45b23cb73ce11acdc3cf4c6efd4441e3b3e upstream.
Signal delivery compat path may not have the 'TS_COMPAT' flag (that flag indicates how we entered the kernel). So use test_thread_flag(TIF_IA32) instead of is_ia32_task(): one of the functions of TIF_IA32 is just what kind of signal frame we want.
--- arch/x86/ia32/ia32_signal.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/ia32/ia32_signal.c +1 -1
@@ -38,7 +38,7 @@int copy_siginfo_to_user32 (compat_siginfo_t __user *to,siginfo_t *from) {int err =0 ; -bool ia32 =is_ia32_task (); +bool ia32 =test_thread_flag (TIF_IA32 );if (!access_ok (VERIFY_WRITE , to,sizeof (compat_siginfo_t)))return -EFAULT ;
Greg Kroah-Hartman
maintainerPATCH 112/187 x86, cpufeature: Rename X86_FEATURE_DTS to X86_FEATURE_DTHERM
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: "H. Peter Anvin" <[email protected]>
commit 4ad33411308596f2f918603509729922a1ec4411 upstream.
It makes sense to label "Digital Thermal Sensor" as "DTS", but unfortunately the string "dts" was already used for "Debug Store", and /proc/cpuinfo is a user space ABI.
Therefore, rename this to "dtherm".
This conflict went into mainline via the hwmon tree without any x86 maintainer ack, and without any kind of hint in the subject.
a4659053 x86/hwmon: fix initialization of coretemp
--- arch/x86/include/asm/cpufeature.h | 2 +- arch/x86/kernel/cpu/scattered.c | 2 +- drivers/hwmon/coretemp.c | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-)
arch/x86/include/asm/cpufeature.h +1 -1
@@ -176,7 +176,7 @@#define X86_FEATURE_XSAVEOPT (7*32+ 4)/* Optimized Xsave */ #define X86_FEATURE_PLN (7*32+ 5)/* Intel Power Limit Notification */ #define X86_FEATURE_PTS (7*32+ 6)/* Intel Package Thermal Status */ -#define X86_FEATURE_DTS (7*32+ 7)/* Digital Thermal Sensor */ +#define X86_FEATURE_DTHERM (7*32+ 7)/* Digital Thermal Sensor */ #define X86_FEATURE_HW_PSTATE (7*32+ 8)/* AMD HW-PState */ /* Virtualization flags: Linux defined, word 8 */
arch/x86/kernel/cpu/scattered.c +1 -1
@@ -31,7 +31,7 @@ void __cpuinit init_scattered_cpuid_featconst struct cpuid_bit *cb;static const struct cpuid_bit __cpuinitconst cpuid_bits[] = { - {X86_FEATURE_DTS ,CR_EAX ,0 ,0x00000006 ,0 }, + {X86_FEATURE_DTHERM ,CR_EAX ,0 ,0x00000006 ,0 }, {X86_FEATURE_IDA ,CR_EAX ,1 ,0x00000006 ,0 }, {X86_FEATURE_ARAT ,CR_EAX ,2 ,0x00000006 ,0 }, {X86_FEATURE_PLN ,CR_EAX ,4 ,0x00000006 ,0 },
drivers/hwmon/coretemp.c +2 -2
@@ -664,7 +664,7 @@ static void __cpuinit get_core_online(un* sensors. We check this bit only, all the early CPUs * without thermal sensors will be filtered out. */ -if (!cpu_has (c,X86_FEATURE_DTS )) +if (!cpu_has (c,X86_FEATURE_DTHERM ))return ;if (!pdev) {
@@ -765,7 +765,7 @@ static struct notifier_block coretemp_cp };static const struct x86_cpu_id coretemp_ids[] = { - {X86_VENDOR_INTEL ,X86_FAMILY_ANY ,X86_MODEL_ANY ,X86_FEATURE_DTS }, + {X86_VENDOR_INTEL ,X86_FAMILY_ANY ,X86_MODEL_ANY ,X86_FEATURE_DTHERM }, {} };MODULE_DEVICE_TABLE (x86cpu, coretemp_ids);
Greg Kroah-Hartman
maintainerPATCH 113/187 igbvf: fix divide by zero
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mitch A Williams <[email protected]>
commit 0e90b49ca4b891f085b57559a3071a4feefb496c upstream.
Using ethtool -C ethX rx-usecs 0 crashes with a divide by zero. Refactor this function to fix this issue and make it more clear what the intent of each conditional is. Add comment regarding using a setting of zero.
--- drivers/net/ethernet/intel/igbvf/ethtool.c | 29 ++++++++++++++++++----------- 1 file changed, 18 insertions(+), 11 deletions(-)
drivers/net/ethernet/intel/igbvf/ethtool.c +18 -11
@@ -357,21 +357,28 @@ static int igbvf_set_coalesce(struct netstruct igbvf_adapter *adapter =netdev_priv (netdev);struct e1000_hw *hw = &adapter->hw; -if ((ec->rx_coalesce_usecs >IGBVF_MAX_ITR_USECS ) || - ((ec->rx_coalesce_usecs >3 ) && - (ec->rx_coalesce_usecs <IGBVF_MIN_ITR_USECS )) || - (ec->rx_coalesce_usecs ==2 )) -return -EINVAL ; - -/* convert to rate of irq's per second */ -if (ec->rx_coalesce_usecs && ec->rx_coalesce_usecs <=3 ) { +if ((ec->rx_coalesce_usecs >=IGBVF_MIN_ITR_USECS ) && + (ec->rx_coalesce_usecs <=IGBVF_MAX_ITR_USECS )) { + adapter->current_itr = ec->rx_coalesce_usecs <<2 ; + adapter->requested_itr =1000000000 / + (adapter->current_itr *256 ); + }else if ((ec->rx_coalesce_usecs ==3 ) || + (ec->rx_coalesce_usecs ==2 )) { adapter->current_itr =IGBVF_START_ITR ; adapter->requested_itr = ec->rx_coalesce_usecs; - }else { - adapter->current_itr = ec->rx_coalesce_usecs <<2 ; + }else if (ec->rx_coalesce_usecs ==0 ) { +/* +* The user's desire is to turn off interrupt throttling +* altogether, but due to HW limitations, we can't do that. +* Instead we set a very small value in EITR, which would +* allow ~967k interrupts per second, but allow the adapter's +* internal clocking to still function properly. +*/ + adapter->current_itr =4 ; adapter->requested_itr =1000000000 / (adapter->current_itr *256 ); - } + }else +return -EINVAL ;writel (adapter->current_itr, hw->hw_addr + adapter->rx_ring->itr_register);
Greg Kroah-Hartman
maintainerPATCH 114/187 rtlwifi: rtl8192cu: New USB IDs
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Larry Finger <[email protected]>
commit f63d7dabd5da9ef41f28f6d69b29bc084db0ca5a upstream.
The latest Realtek driver for the RTL8188CU and RTL8192CU chips adds three new USB IDs.
--- drivers/net/wireless/rtlwifi/rtl8192cu/sw.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/wireless/rtlwifi/rtl8192cu/sw.c +3 -0
@@ -301,9 +301,11 @@ static struct usb_device_id rtl8192c_usb {RTL_USB_DEVICE(0x07b8, 0x8188, rtl92cu_hal_cfg)}, /*Abocom - Abocom*/ {RTL_USB_DEVICE(0x07b8, 0x8189, rtl92cu_hal_cfg)}, /*Funai - Abocom*/ {RTL_USB_DEVICE(0x0846, 0x9041, rtl92cu_hal_cfg)}, /*NetGear WNA1000M*/ + {RTL_USB_DEVICE(0x0bda, 0x5088, rtl92cu_hal_cfg)}, /*Thinkware-CC&C*/ {RTL_USB_DEVICE(0x0df6, 0x0052, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/ {RTL_USB_DEVICE(0x0df6, 0x005c, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/ {RTL_USB_DEVICE(0x0eb0, 0x9071, rtl92cu_hal_cfg)}, /*NO Brand - Etop*/ + {RTL_USB_DEVICE(0x4856, 0x0091, rtl92cu_hal_cfg)}, /*NetweeN - Feixun*//* HP - Lite-On ,8188CUS Slim Combo */ {RTL_USB_DEVICE(0x103c, 0x1629, rtl92cu_hal_cfg)}, {RTL_USB_DEVICE(0x13d3, 0x3357, rtl92cu_hal_cfg)}, /* AzureWave */
@@ -345,6 +347,7 @@ static struct usb_device_id rtl8192c_usb {RTL_USB_DEVICE(0x07b8, 0x8178, rtl92cu_hal_cfg)}, /*Funai -Abocom*/ {RTL_USB_DEVICE(0x0846, 0x9021, rtl92cu_hal_cfg)}, /*Netgear-Sercomm*/ {RTL_USB_DEVICE(0x0b05, 0x17ab, rtl92cu_hal_cfg)}, /*ASUS-Edimax*/ + {RTL_USB_DEVICE(0x0bda, 0x8186, rtl92cu_hal_cfg)}, /*Realtek 92CE-VAU*/ {RTL_USB_DEVICE(0x0df6, 0x0061, rtl92cu_hal_cfg)}, /*Sitecom-Edimax*/ {RTL_USB_DEVICE(0x0e66, 0x0019, rtl92cu_hal_cfg)}, /*Hawking-Edimax*/ {RTL_USB_DEVICE(0x2001, 0x3307, rtl92cu_hal_cfg)}, /*D-Link-Cameo*/
Greg Kroah-Hartman
maintainerPATCH 115/187 mac80211: clear ifmgd->bssid only after building DELBA
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eliad Peller <[email protected]>
commit 88a9e31c506c00c8b7a2f1611406d0e38dcb33b3 upstream.
ieee80211_set_disassoc() clears ifmgd->bssid before building DELBA frames, resulting in frames with invalid bssid ("00:00:00:00:00:00").
Fix it by clearing ifmgd->bssid only after building all the needed frames.
After this change, we no longer need to save the bssid (before clearing it), so remove the local array.
--- net/mac80211/mlme.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-)
net/mac80211/mlme.c +6 -7
@@ -1375,7 +1375,6 @@ static void ieee80211_set_disassoc(strucstruct ieee80211_local *local = sdata->local;struct sta_info *sta;u32 changed =0 ; -u8 bssid[ETH_ALEN ];ASSERT_MGD_MTX (ifmgd);
@@ -1385,10 +1384,7 @@ static void ieee80211_set_disassoc(strucif (WARN_ON (!ifmgd->associated))return ; -memcpy (bssid, ifmgd->associated->bssid,ETH_ALEN ); - ifmgd->associated =NULL ; -memset (ifmgd->bssid,0 ,ETH_ALEN );/* * we need to commit the associated = NULL change because the
@@ -1408,7 +1404,7 @@ static void ieee80211_set_disassoc(strucnetif_carrier_off (sdata->dev);mutex_lock (&local->sta_mtx); - sta =sta_info_get (sdata, bssid); + sta =sta_info_get (sdata, ifmgd->bssid);if (sta) {set_sta_flag (sta,WLAN_STA_BLOCK_BA );ieee80211_sta_tear_down_BA_sessions (sta, tx);
@@ -1417,13 +1413,16 @@ static void ieee80211_set_disassoc(struc/* deauthenticate/disassociate now */ if (tx || frame_buf) -ieee80211_send_deauth_disassoc (sdata, bssid, stype, reason, - tx, frame_buf); +ieee80211_send_deauth_disassoc (sdata, ifmgd->bssid, stype, + reason, tx, frame_buf);/* flush out frame */ if (tx)drv_flush (local, false); +/* clear bssid only after building the needed mgmt frames */ +memset (ifmgd->bssid,0 ,ETH_ALEN ); +/* remove AP and TDLS peers */ sta_info_flush (local, sdata);
Greg Kroah-Hartman
maintainerPATCH 116/187 mac80211: correct behaviour on unrecognised action frames
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
commit 4b5ebccc40843104d980f0714bc86bfcd5568941 upstream.
When receiving an "individually addressed" action frame, the receiver is required to return it to the sender. mac80211 gets this wrong as it also returns group addressed (mcast) frames to the sender. Fix this and update the reference to the new 802.11 standards version since things were shuffled around significantly.
--- net/mac80211/rx.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
net/mac80211/rx.c +4 -1
@@ -2459,7 +2459,7 @@ ieee80211_rx_h_action_return(struct ieee* frames that we didn't handle, including returning unknown * ones. For all other modes we will return them to the sender, * setting the 0x80 bit in the action category, as required by -* 802.11-2007 7.3.1.11. +* 802.11-2012 9.24.4. * Newer versions of hostapd shall also use the management frame * registration mechanisms, but older ones still use cooked * monitor interfaces so push all frames there.
@@ -2469,6 +2469,9 @@ ieee80211_rx_h_action_return(struct ieee sdata->vif.type == NL80211_IFTYPE_AP_VLAN))return RX_DROP_MONITOR ; +if (is_multicast_ether_addr (mgmt->da)) +return RX_DROP_MONITOR ; +/* do not return rejected action frames */ if (mgmt->u.action.category &0x80 )return RX_DROP_UNUSABLE ;
Greg Kroah-Hartman
maintainerPATCH 117/187 mwifiex: fix 11n rx packet drop issue
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stone Piao <[email protected]>
commit 925839243dc9aa4ef25305f5afd10ed18258a4ac upstream.
Currently we check the sequence number of last packet received against start_win. If a sequence hole is detected, start_win is updated to next sequence number.
Since the rx sequence number is initialized to 0, a corner case exists when BA setup happens immediately after association. As 0 is a valid sequence number, start_win gets increased to 1 incorrectly. This causes the first packet with sequence number 0 being dropped.
Initialize rx sequence number as 0xffff and skip adjusting start_win if the sequence number remains 0xffff. The sequence number will be updated once the first packet is received.
--- drivers/net/wireless/mwifiex/11n_rxreorder.c | 5 +++-- drivers/net/wireless/mwifiex/11n_rxreorder.h | 7 +++++++ drivers/net/wireless/mwifiex/wmm.c | 2 ++ 3 files changed, 12 insertions(+), 2 deletions(-)
drivers/net/wireless/mwifiex/11n_rxreorder.c +3 -2
@@ -256,7 +256,8 @@ mwifiex_11n_create_rx_reorder_tbl(structelse last_seq = priv->rx_seq[tid]; -if (last_seq >= new_node->start_win) +if (last_seq !=MWIFIEX_DEF_11N_RX_SEQ_NUM && + last_seq >= new_node->start_win) new_node->start_win = last_seq +1 ; new_node->win_size = win_size;
@@ -596,5 +597,5 @@ void mwifiex_11n_cleanup_reorder_tbl(strspin_unlock_irqrestore (&priv->rx_reorder_tbl_lock, flags);INIT_LIST_HEAD (&priv->rx_reorder_tbl_ptr); -memset (priv->rx_seq,0 ,sizeof (priv->rx_seq)); +mwifiex_reset_11n_rx_seq_num (priv); }
drivers/net/wireless/mwifiex/11n_rxreorder.h +7 -0
@@ -37,6 +37,13 @@#define ADDBA_RSP_STATUS_ACCEPT 0 +#define MWIFIEX_DEF_11N_RX_SEQ_NUM 0xffff + +static inline void mwifiex_reset_11n_rx_seq_num (struct mwifiex_private *priv) +{ +memset (priv->rx_seq,0xff ,sizeof (priv->rx_seq)); +} + int mwifiex_11n_rx_reorder_pkt(struct mwifiex_private *, u16 seqNum, u16 tid, u8 *ta,
drivers/net/wireless/mwifiex/wmm.c +2 -0
@@ -404,6 +404,8 @@ mwifiex_wmm_init(struct mwifiex_adapter priv->add_ba_param.tx_win_size =MWIFIEX_AMPDU_DEF_TXWINSIZE ; priv->add_ba_param.rx_win_size =MWIFIEX_AMPDU_DEF_RXWINSIZE ; +mwifiex_reset_11n_rx_seq_num (priv); +atomic_set (&priv->wmm.tx_pkts_queued,0 );atomic_set (&priv->wmm.highest_queued_prio,HIGH_PRIO_TID ); }
Greg Kroah-Hartman
maintainerPATCH 118/187 mwifiex: fix WPS eapol handshake failure
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stone Piao <[email protected]>
commit f03ba7e9a24e5e9efaad56bd1713b994ea556b16 upstream.
After association, STA will go through eapol handshake with WPS enabled AP. It's observed that WPS handshake fails with some 11n AP. The reason for the failure is that the eapol packet is sent via 11n frame aggregation.
The eapol packet should be sent directly without 11n aggregation.
This patch fixes the problem by adding WPS session control while dequeuing Tx packets for transmission.
--- drivers/net/wireless/mwifiex/wmm.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/mwifiex/wmm.c +1 -0
@@ -1211,6 +1211,7 @@ mwifiex_dequeue_tx_packet(struct mwifiexif (!ptr->is_11n_enabled ||mwifiex_is_ba_stream_setup (priv, ptr, tid) || + priv->wps.session_enable || ((priv->sec_info.wpa_enabled || priv->sec_info.wpa2_enabled) && !priv->wpa_is_gtk_set)) {
Greg Kroah-Hartman
maintainerPATCH 120/187 mtd: cafe_nand: fix an & vs | mistake
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
commit 48f8b641297df49021093763a3271119a84990a2 upstream.
The intent here was clearly to set result to true if the 0x40000000 flag was set. But instead there was a | vs & typo and we always set result to true.
Artem: check the spec at wiki.laptop.org/images/5/5c/88ALP01_Datasheet_July_2007.pdf and this fix looks correct.
--- drivers/mtd/nand/cafe_nand.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mtd/nand/cafe_nand.c +1 -1
@@ -102,7 +102,7 @@ static const char *part_probes[] = { "cmstatic int cafe_device_ready (struct mtd_info *mtd) {struct cafe_priv *cafe = mtd->priv; -int result = !!(cafe_readl (cafe,NAND_STATUS ) |0x40000000 ); +int result = !!(cafe_readl (cafe,NAND_STATUS ) &0x40000000 );uint32_t irqs =cafe_readl (cafe,NAND_IRQ );cafe_writel (cafe, irqs,NAND_IRQ );
Greg Kroah-Hartman
maintainerPATCH 121/187 aio: make kiocb->private NUll in init_sync_kiocb()
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junxiao Bi <[email protected]>
commit 2dfd06036ba7ae8e7be2daf5a2fff1dac42390bf upstream.
Ocfs2 uses kiocb.*private as a flag of unsigned long size. In commit a11f7e6 ocfs2: serialize unaligned aio, the unaligned io flag is involved in it to serialize the unaligned aio. As *private is not initialized in init_sync_kiocb() of do_sync_write(), this unaligned io flag may be unexpectly set in an aligned dio. And this will cause OCFS2_I(inode)->ip_unaligned_aio decreased to -1 in ocfs2_dio_end_io(), thus the following unaligned dio will hang forever at ocfs2_aiodio_wait() in ocfs2_file_aio_write().
--- include/linux/aio.h | 1 + 1 file changed, 1 insertion(+)
include/linux/aio.h +1 -0
@@ -140,6 +140,7 @@ struct kiocb { (x)->ki_dtor =NULL ; \ (x)->ki_obj.tsk = tsk; \ (x)->ki_user_data =0 ; \ + (x)->private =NULL ; \ } while (0)#define AIO_RING_MAGIC 0xa10a10a1
Greg Kroah-Hartman
maintainerPATCH 122/187 ocfs2: clear unaligned io flag when dio fails
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junxiao Bi <[email protected]>
commit 3e5d3c35a68c9a933bdbdd8685bd1a205b57e806 upstream.
The unaligned io flag is set in the kiocb when an unaligned dio is issued, it should be cleared even when the dio fails, or it may affect the following io which are using the same kiocb.
--- fs/ocfs2/file.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/ocfs2/file.c +3 -1
@@ -2422,8 +2422,10 @@ out_dio: unaligned_dio =0 ; } -if (unaligned_dio) +if (unaligned_dio) { +ocfs2_iocb_clear_unaligned_aio (iocb);atomic_dec (&OCFS2_I (inode)->ip_unaligned_aio); + } out:if (rw_level !=-1 )
Greg Kroah-Hartman
maintainerPATCH 123/187 iwlwifi: fix activating inactive stations
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
commit eac9ac6d1f5d0e9d33e4ded682187b630e7606cd upstream.
When authentication/association timed out, the driver would complain bitterly, printing the message
ACTIVATE a non DRIVER active station id ... addr ...
The cause turns out to be that when the AP station is added but we don't associate, the IWL_STA_UCODE_INPROGRESS is set but never cleared. This then causes iwl_restore_stations() to attempt to resend it because it uses the flag internally and uploads even if it didn't set it itself.
To fix this issue and not upload the station again when it has already been removed by mac80211, clear the flag after adding it in case we add it only for association.
--- drivers/net/wireless/iwlwifi/iwl-mac80211.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/net/wireless/iwlwifi/iwl-mac80211.c +12 -0
@@ -788,6 +788,18 @@ static int iwlagn_mac_sta_state(struct iswitch (op) {case ADD : ret =iwlagn_mac_sta_add (hw, vif, sta); +if (ret) +break ; +/* +* Clear the in-progress flag, the AP station entry was added +* but we'll initialize LQ only when we've associated (which +* would also clear the in-progress flag). This is necessary +* in case we never initialize LQ because association fails. +*/ +spin_lock_bh (&priv->sta_lock); + priv->stations[iwl_sta_id (sta)].used &= + ~IWL_STA_UCODE_INPROGRESS ; +spin_unlock_bh (&priv->sta_lock);break ;case REMOVE : ret =iwlagn_mac_sta_remove (hw, vif, sta);
Greg Kroah-Hartman
maintainerPATCH 124/187 tcm_fc: Resolve suspicious RCU usage warnings
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rustad <[email protected]>
commit 863555be0c81558b1af277addcf68acb8f778860 upstream.
Use rcu_dereference_protected to tell rcu that the ft_lport_lock is held during ft_lport_create. This resolved "suspicious RCU usage" warnings when debugging options are turned on.
--- drivers/target/tcm_fc/tfc_sess.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/target/tcm_fc/tfc_sess.c +2 -1
@@ -58,7 +58,8 @@ static struct ft_tport *ft_tport_create(struct ft_tport *tport;int i; - tport =rcu_dereference (lport->prov[FC_TYPE_FCP ]); + tport =rcu_dereference_protected (lport->prov[FC_TYPE_FCP ], +lockdep_is_held (&ft_lport_lock));if (tport && tport->tpg)return tport;
Greg Kroah-Hartman
maintainerPATCH 125/187 e1000e: remove use of IP payload checksum
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bruce Allan <[email protected]>
commit 2e1706f234f86ff71056ef69683d734fbf7e9e40 upstream.
Currently only used when packet split mode is enabled with jumbo frames, IP payload checksum (for fragmented UDP packets) is mutually exclusive with receive hashing offload since the hardware uses the same space in the receive descriptor for the hardware-provided packet checksum and the RSS hash, respectively. Users currently must disable jumbos when receive hashing offload is enabled, or vice versa, because of this incompatibility. Since testing has shown that IP payload checksum does not provide any real benefit, just remove it so that there is no longer a choice between jumbos or receive hashing offload but not both as done in other Intel GbE drivers (e.g. e1000, igb).
Also, add a missing check for IP checksum error reported by the hardware; let the stack verify the checksum when this happens.
--- drivers/net/ethernet/intel/e1000e/defines.h | 1 drivers/net/ethernet/intel/e1000e/netdev.c | 75 +++++----------------------- 2 files changed, 15 insertions(+), 61 deletions(-)
drivers/net/ethernet/intel/e1000e/defines.h +1 -0
@@ -101,6 +101,7 @@#define E1000_RXD_ERR_SEQ 0x04/* Sequence Error */ #define E1000_RXD_ERR_CXE 0x10/* Carrier Extension Error */ #define E1000_RXD_ERR_TCPE 0x20/* TCP/UDP Checksum Error */ +#define E1000_RXD_ERR_IPE 0x40/* IP Checksum Error */ #define E1000_RXD_ERR_RXE 0x80/* Rx Data Error */ #define E1000_RXD_SPC_VLAN_MASK 0x0FFF/* VLAN ID is in lower 12 bits */
drivers/net/ethernet/intel/e1000e/netdev.c +14 -61
131 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 126/187 remoteproc/omap: fix randconfig unmet direct dependencies
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ohad Ben-Cohen <[email protected]>
commit d50394266b340d930a7458fa669d36e99670f200 upstream.
OMAP_REMOTEPROC selects REMOTEPROC and RPMSG, both of which depend on EXPERIMENTAL, so let's have OMAP_REMOTEPROC depend on EXPERIMENTAL too, in order to avoid the below randconfig warnings.
warning: (OMAP_REMOTEPROC) selects REMOTEPROC which has unmet direct dependencies (EXPERIMENTAL)
warning: (OMAP_REMOTEPROC) selects RPMSG which has unmet direct dependencies (EXPERIMENTAL)
--- drivers/remoteproc/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/remoteproc/Kconfig +1 -0
@@ -7,6 +7,7 @@ config REMOTEPROC config OMAP_REMOTEPROC tristate "OMAP remoteproc support" + depends on EXPERIMENTAL depends on ARCH_OMAP4 depends on OMAP_IOMMU select REMOTEPROC
Greg Kroah-Hartman
maintainerPATCH 127/187 remoteproc: fix missing CONFIG_FW_LOADER configurations
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ohad Ben-Cohen <[email protected]>
commit e121aefa7d9f10eee5cf26ed47129237a05d940b upstream.
Remoteproc requires user space firmware loading support, so let's select FW_LOADER explicitly to avoid painful misconfigurations (which only show up in runtime).
--- drivers/remoteproc/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/remoteproc/Kconfig +1 -0
@@ -4,6 +4,7 @@ menu "Remoteproc drivers (EXPERIMENTAL)" config REMOTEPROC tristate depends on EXPERIMENTAL + select FW_CONFIG config OMAP_REMOTEPROC tristate "OMAP remoteproc support"
Greg Kroah-Hartman
maintainerPATCH 128/187 hwspinlock/core: use global ID to register hwspinlocks on multiple devices
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shinya Kuribayashi <[email protected]>
commit 476a7eeb60e70ddab138e7cb4bc44ef5ac20782e upstream.
Commit 300bab9770 (hwspinlock/core: register a bank of hwspinlocks in a single API call, 2011-09-06) introduced 'hwspin_lock_register_single()' to register numerous (a bank of) hwspinlock instances in a single API, 'hwspin_lock_register()'.
At which time, 'hwspin_lock_register()' accidentally passes 'local IDs' to 'hwspin_lock_register_single()', despite that ..._single() requires 'global IDs' to register hwspinlocks.
We have to convert into global IDs by supplying the missing 'base_id'.
--- drivers/hwspinlock/hwspinlock_core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/hwspinlock/hwspinlock_core.c +2 -2
@@ -345,7 +345,7 @@ int hwspin_lock_register(struct hwspinlospin_lock_init (&hwlock->lock); hwlock->bank = bank; - ret =hwspin_lock_register_single (hwlock, i); + ret =hwspin_lock_register_single (hwlock, base_id + i);if (ret) goto reg_failed; }
@@ -354,7 +354,7 @@ int hwspin_lock_register(struct hwspinlo reg_failed:while (--i >=0 ) -hwspin_lock_unregister_single (i); +hwspin_lock_unregister_single (base_id + i);return ret; }EXPORT_SYMBOL_GPL (hwspin_lock_register);
Greg Kroah-Hartman
maintainerPATCH 129/187 md/raid10: Dont try to recovery unmatched (and unused) chunks.
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <[email protected]>
commit fc448a18ae6219af9a73257b1fbcd009efab4a81 upstream.
If a RAID10 has an odd number of chunks - as might happen when there are an odd number of devices - the last chunk has no pair and so is not mirrored. We don't store data there, but when recovering the last device in an array we retry to recover that last chunk from a non-existent location. This results in an error, and the recovery aborts.
When we get to that last chunk we should just stop - there is nothing more to do anyway.
This bug has been present since the introduction of RAID10, so the patch is appropriate for any -stable kernel.
--- drivers/md/raid10.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/md/raid10.c +6 -0
@@ -2772,6 +2772,12 @@ static sector_t sync_request(struct mdde/* want to reconstruct this device */ rb2 = r10_bio; sect =raid10_find_virt (conf, sector_nr, i); +if (sect >= mddev->resync_max_sectors) { +/* last stripe is not complete - don't +* try to recover this sector. +*/ +continue ; + }/* Unless we are doing a full sync, or a replacement * we only need to recover the block if it is set in * the bitmap
Greg Kroah-Hartman
maintainerPATCH 130/187 md/raid10: fix failure when trying to repair a read error.
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <[email protected]>
commit 055d3747dbf00ce85c6872ecca4d466638e80c22 upstream.
commit 58c54fcca3bac5bf9290cfed31c76e4c4bfbabaf
md/raid10: handle further errors during fix_read_error better.
in 3.1 added "r10_sync_page_io" which takes an IO size in sectors. But we were passing the IO size in bytes!!!
This resulting in bio_add_page failing, and empty request being sent down, and a consequent BUG_ON in scsi_lib.
[fix missing space in error message at same time]
This fix is suitable for 3.1.y and later.
--- drivers/md/raid10.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/md/raid10.c +3 -3
@@ -2209,7 +2209,7 @@ static void fix_read_error(struct r10conif (r10_sync_page_io (rdev, r10_bio->devs[sl].addr + sect, - s<<9 , conf->tmppage,WRITE ) + s, conf->tmppage,WRITE ) ==0 ) {/* Well, this device is dead */ printk(KERN_NOTICE
@@ -2246,7 +2246,7 @@ static void fix_read_error(struct r10conswitch (r10_sync_page_io (rdev, r10_bio->devs[sl].addr + sect, - s<<9 , conf->tmppage, + s, conf->tmppage,READ )) {case 0 :/* Well, this device is dead */
@@ -2407,7 +2407,7 @@ read_more: slot = r10_bio->read_slot; printk_ratelimited( KERN_ERR - "md/raid10:%s: %s: redirecting" + "md/raid10:%s: %s: redirecting " "sector %llu to another mirror\n", mdname(mddev), bdevname(rdev->bdev, b),
Greg Kroah-Hartman
maintainerPATCH 131/187 md/raid5: In ops_run_io, inc nr_pending before calling md_wait_for_blocked_rdev
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: majianpeng <[email protected]>
commit 1850753d2e6d9ca7856581ca5d3cf09521e6a5d7 upstream.
In ops_run_io(), the call to md_wait_for_blocked_rdev will decrement nr_pending so we lose the reference we hold on the rdev. So atomic_inc it first to maintain the reference.
This bug was introduced by commit 73e92e51b7969ef5477d
md/raid5. Don't write to known bad block on doubtful devices.
which appeared in 3.0, so patch is suitable for stable kernels since then.
--- drivers/md/raid5.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/md/raid5.c +6 -0
@@ -583,6 +583,12 @@ static void ops_run_io(struct stripe_hea* a chance*/ md_check_recovery (conf->mddev); } +/* +* Because md_wait_for_blocked_rdev +* will dec nr_pending, we must +* increment it first. +*/ +atomic_inc (&rdev->nr_pending);md_wait_for_blocked_rdev (rdev, conf->mddev); }else {/* Acknowledged bad block - skip the write */
Greg Kroah-Hartman
maintainerPATCH 132/187 dm: verity fix documentation
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Milan Broz <[email protected]>
commit 18068bdd5f59229623b2fa518a6389e346642b0d upstream.
Veritysetup is now part of cryptsetup package.
Remove on-disk header description (which is not parsed in kernel) and point users to cryptsetup where it the format is documented. Mention units for block size paramaters.
Fix target line specification and dmsetup parameters.
--- Documentation/device-mapper/verity.txt | 133 +++++++++++---------------------- 1 file changed, 47 insertions(+), 86 deletions(-)
Documentation/device-mapper/verity.txt +47 -86
@@ -7,39 +7,39 @@ This target is read-only. Construction Parameters ======================= - <version> <dev> <hash_dev> <hash_start> + <version> <dev> <hash_dev> <data_block_size> <hash_block_size> <num_data_blocks> <hash_start_block> <algorithm> <digest> <salt> <version> - This is the version number of the on-disk format. + This is the type of the on-disk hash format. 0 is the original format used in the Chromium OS. - The salt is appended when hashing, digests are stored continuously and - the rest of the block is padded with zeros. + The salt is appended when hashing, digests are stored continuously and + the rest of the block is padded with zeros. 1 is the current format that should be used for new devices. - The salt is prepended when hashing and each digest is - padded with zeros to the power of two. + The salt is prepended when hashing and each digest is + padded with zeros to the power of two. <dev> - This is the device containing the data the integrity of which needs to be + This is the device containing data, the integrity of which needs to be checked. It may be specified as a path, like /dev/sdaX, or a device number, <major>:<minor>. <hash_dev> - This is the device that that supplies the hash tree data. It may be + This is the device that supplies the hash tree data. It may be specified similarly to the device path and may be the same device. If the - same device is used, the hash_start should be outside of the dm-verity - configured device size. + same device is used, the hash_start should be outside the configured + dm-verity device. <data_block_size> - The block size on a data device. Each block corresponds to one digest on - the hash device. + The block size on a data device in bytes. + Each block corresponds to one digest on the hash device. <hash_block_size> - The size of a hash block. + The size of a hash block in bytes. <num_data_blocks> The number of data blocks on the data device. Additional blocks are
@@ -65,7 +65,7 @@ Construction Parameters Theory of operation =================== -dm-verity is meant to be setup as part of a verified boot path. This +dm-verity is meant to be set up as part of a verified boot path. This may be anything ranging from a boot using tboot or trustedgrub to just booting from a known-good device (like a USB drive or CD).
@@ -73,20 +73,20 @@ When a dm-verity device is configured, i has been authenticated in some way (cryptographic signatures, etc). After instantiation, all hashes will be verified on-demand during disk access. If they cannot be verified up to the root node of the -tree, the root hash, then the I/O will fail. This should identify +tree, the root hash, then the I/O will fail. This should detect tampering with any data on the device and the hash data. Cryptographic hashes are used to assert the integrity of the device on a -per-block basis. This allows for a lightweight hash computation on first read -into the page cache. Block hashes are stored linearly-aligned to the nearest -block the size of a page. +per-block basis. This allows for a lightweight hash computation on first read +into the page cache. Block hashes are stored linearly, aligned to the nearest +block size. Hash Tree --------- Each node in the tree is a cryptographic hash. If it is a leaf node, the hash -is of some block data on disk. If it is an intermediary node, then the hash is -of a number of child nodes. +of some data block on disk is calculated. If it is an intermediary node, +the hash of a number of child nodes is calculated. Each entry in the tree is a collection of neighboring nodes that fit in one block. The number is determined based on block_size and the size of the
@@ -110,63 +110,23 @@ alg = sha256, num_blocks = 32768, block_ On-disk format ============== -Below is the recommended on-disk format. The verity kernel code does not -read the on-disk header. It only reads the hash blocks which directly -follow the header. It is expected that a user-space tool will verify the -integrity of the verity_header and then call dmsetup with the correct -parameters. Alternatively, the header can be omitted and the dmsetup -parameters can be passed via the kernel command-line in a rooted chain -of trust where the command-line is verified. - -The on-disk format is especially useful in cases where the hash blocks -are on a separate partition. The magic number allows easy identification -of the partition contents. Alternatively, the hash blocks can be stored -in the same partition as the data to be verified. In such a configuration -the filesystem on the partition would be sized a little smaller than -the full-partition, leaving room for the hash blocks. - -struct superblock { - uint8_t signature[8] - "verity\0\0"; - - uint8_t version; - 1 - current format - - uint8_t data_block_bits; - log2(data block size) - - uint8_t hash_block_bits; - log2(hash block size) - - uint8_t pad1[1]; - zero padding - - uint16_t salt_size; - big-endian salt size - - uint8_t pad2[2]; - zero padding - - uint32_t data_blocks_hi; - big-endian high 32 bits of the 64-bit number of data blocks - - uint32_t data_blocks_lo; - big-endian low 32 bits of the 64-bit number of data blocks - - uint8_t algorithm[16]; - cryptographic algorithm - - uint8_t salt[384]; - salt (the salt size is specified above) - - uint8_t pad3[88]; - zero padding to 512-byte boundary -} +The verity kernel code does not read the verity metadata on-disk header. +It only reads the hash blocks which directly follow the header. +It is expected that a user-space tool will verify the integrity of the +verity header. + +Alternatively, the header can be omitted and the dmsetup parameters can +be passed via the kernel command-line in a rooted chain of trust where +the command-line is verified. Directly following the header (and with sector number padded to the next hash block boundary) are the hash blocks which are stored a depth at a time (starting from the root), sorted in order of increasing index. +The full specification of kernel parameters and on-disk metadata format +is available at the cryptsetup project's wiki page + http://code.google.com/p/cryptsetup/wiki/DMVerity + Status ====== V (for Valid) is returned if every check performed so far was valid.
@@ -174,21 +134,22 @@ If any check failed, C (for Corruption) Example ======= - -Setup a device: - dmsetup create vroot --table \ - "0 2097152 "\ - "verity 1 /dev/sda1 /dev/sda2 4096 4096 2097152 1 "\ +Set up a device: + # dmsetup create vroot --readonly --table \ + "0 2097152 verity 1 /dev/sda1 /dev/sda2 4096 4096 262144 1 sha256 "\ "4392712ba01368efdf14b05c76f9e4df0d53664630b5d48632ed17a137f39076 "\ "1234000000000000000000000000000000000000000000000000000000000000" A command line tool veritysetup is available to compute or verify -the hash tree or activate the kernel driver. This is available from -the LVM2 upstream repository and may be supplied as a package called -device-mapper-verity-tools: - git://sources.redhat.com/git/lvm2 - http://sourceware.org/git/?p=lvm2.git - http://sourceware.org/cgi-bin/cvsweb.cgi/LVM2/verity?cvsroot=lvm2 - -veritysetup -a vroot /dev/sda1 /dev/sda2 \ - 4392712ba01368efdf14b05c76f9e4df0d53664630b5d48632ed17a137f39076 +the hash tree or activate the kernel device. This is available from +the cryptsetup upstream repository http://code.google.com/p/cryptsetup/ +(as a libcryptsetup extension). + +Create hash on the device: + # veritysetup format /dev/sda1 /dev/sda2 + ... + Root hash: 4392712ba01368efdf14b05c76f9e4df0d53664630b5d48632ed17a137f39076 + +Activate the device: + # veritysetup create vroot /dev/sda1 /dev/sda2 \ + 4392712ba01368efdf14b05c76f9e4df0d53664630b5d48632ed17a137f39076
Greg Kroah-Hartman
maintainer=?y?q?=5B=20108/187=5D=20net=3A=20qmi=5Fwwan=3A=20fix=20Gobi=20device=20probing?=
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <[email protected]>
commit b9f90eb2740203ff2592efe640409ad48335d1c2 upstream.
Ignoring interfaces with additional descriptors is not a reliable method for locating the correct interface on Gobi devices. There is at least one device where this method fails:
https://bbs.archlinux.org/viewtopic.php?id=143506
The result is that the AT command port (interface #2) is hidden from qcserial, preventing traditional serial modem usage:
[ 15.562552] qmi_wwan 4-1.6:1.0: cdc-wdm0: USB WDM device [ 15.562691] qmi_wwan 4-1.6:1.0: wwan0: register 'qmi_wwan' at usb-0000:00:1d.0-1.6, Qualcomm Gobi wwan/QMI device, 1e:df:3c:3a:4e:3b [ 15.563383] qmi_wwan: probe of 4-1.6:1.1 failed with error -22 [ 15.564189] qmi_wwan 4-1.6:1.2: cdc-wdm1: USB WDM device [ 15.564302] qmi_wwan 4-1.6:1.2: wwan1: register 'qmi_wwan' at usb-0000:00:1d.0-1.6, Qualcomm Gobi wwan/QMI device, 1e:df:3c:3a:4e:3b [ 15.564328] qmi_wwan: probe of 4-1.6:1.3 failed with error -22 [ 15.569376] qcserial 4-1.6:1.1: Qualcomm USB modem converter detected [ 15.569440] usb 4-1.6: Qualcomm USB modem converter now attached to ttyUSB0 [ 15.570372] qcserial 4-1.6:1.3: Qualcomm USB modem converter detected [ 15.570430] usb 4-1.6: Qualcomm USB modem converter now attached to ttyUSB1
Use static interface numbers taken from the interface map in qcserial for all Gobi devices instead:
Gobi 1K USB layout:
0: serial port (doesn't respond)
1: serial port (doesn't respond)
2: AT-capable modem port
3: QMI/net
Gobi 2K+ USB layout:
0: QMI/net
1: DM/DIAG (use libqcdm from ModemManager for communication) 2: AT-capable modem port
3: NMEA
This should be more reliable over all, and will also prevent the noisy "probe failed" messages. The whitelisting logic is expected to be replaced by direct interface number matching in 3.6.
--- drivers/net/usb/qmi_wwan.c | 83 +++++++++++++++++++++------------------------ 1 file changed, 40 insertions(+), 43 deletions(-)
drivers/net/usb/qmi_wwan.c +40 -43
@@ -257,29 +257,6 @@ err:return rv; } -/* Gobi devices uses identical class/protocol codes for all interfaces regardless -* of function. Some of these are CDC ACM like and have the exact same endpoints -* we are looking for. This leaves two possible strategies for identifying the -* correct interface: -* a) hardcoding interface number, or -* b) use the fact that the wwan interface is the only one lacking additional -* (CDC functional) descriptors -* -* Let's see if we can get away with the generic b) solution. -*/ -static int qmi_wwan_bind_gobi (struct usbnet *dev,struct usb_interface *intf) -{ -int rv = -EINVAL ; - -/* ignore any interface with additional descriptors */ -if (intf->cur_altsetting->extralen) - goto err; - - rv =qmi_wwan_bind_shared (dev, intf); -err: -return rv; -} -static void qmi_wwan_unbind_shared (struct usbnet *dev,struct usb_interface *intf) {struct usb_driver *subdriver = (void *)dev->data[0 ];
@@ -347,15 +324,15 @@ static const struct driver_info qmi_wwan .manage_power = qmi_wwan_manage_power, }; -static const struct driver_info qmi_wwan_gobi = { - .description ="Qualcomm Gobi wwan/QMI device" , +static const struct driver_info qmi_wwan_force_int0 = { + .description ="Qualcomm WWAN/QMI device" , .flags =FLAG_WWAN , - .bind = qmi_wwan_bind_gobi, + .bind = qmi_wwan_bind_shared, .unbind = qmi_wwan_unbind_shared, .manage_power = qmi_wwan_manage_power, + .data =BIT (0 ),/* interface whitelist bitmap */ }; -/* ZTE suck at making USB descriptors */ static const struct driver_info qmi_wwan_force_int1 = { .description ="Qualcomm WWAN/QMI device" , .flags =FLAG_WWAN ,
@@ -365,6 +342,15 @@ static const struct driver_info qmi_wwan .data = BIT(1), /* interface whitelist bitmap */ }; +static const struct driver_info qmi_wwan_force_int3 = { + .description ="Qualcomm WWAN/QMI device" , + .flags =FLAG_WWAN , + .bind = qmi_wwan_bind_shared, + .unbind = qmi_wwan_unbind_shared, + .manage_power = qmi_wwan_manage_power, + .data =BIT (3 ),/* interface whitelist bitmap */ +}; +static const struct driver_info qmi_wwan_force_int4 = { .description ="Qualcomm WWAN/QMI device" , .flags =FLAG_WWAN ,
@@ -390,16 +376,23 @@ static const struct driver_info qmi_wwanstatic const struct driver_info qmi_wwan_sierra = { .description ="Sierra Wireless wwan/QMI device" , .flags =FLAG_WWAN , - .bind = qmi_wwan_bind_gobi, + .bind = qmi_wwan_bind_shared, .unbind = qmi_wwan_unbind_shared, .manage_power = qmi_wwan_manage_power, .data =BIT (8 ) |BIT (19 ),/* interface whitelist bitmap */ };#define HUAWEI_VENDOR_ID 0x12D1 + +/* Gobi 1000 QMI/wwan interface number is 3 according to qcserial */ +#define QMI_GOBI1K_DEVICE (vend, prod) \ + USB_DEVICE(vend, prod), \ + .driver_info = (unsigned long)&qmi_wwan_force_int3 + +/* Gobi 2000 and Gobi 3000 QMI/wwan interface number is 0 according to qcserial */ #define QMI_GOBI_DEVICE (vend, prod) \ USB_DEVICE(vend, prod), \ - .driver_info = (unsigned long)&qmi_wwan_gobi + .driver_info = (unsigned long)&qmi_wwan_force_int0static const struct usb_device_id products[] = { {/* Huawei E392, E398 and possibly others sharing both device id and more... */
@@ -493,20 +486,24 @@ static const struct usb_device_id produc .bInterfaceProtocol = 0xff, .driver_info = (unsigned long)&qmi_wwan_sierra, }, - {QMI_GOBI_DEVICE(0x05c6, 0x9212)}, /* Acer Gobi Modem Device */ - {QMI_GOBI_DEVICE(0x03f0, 0x1f1d)}, /* HP un2400 Gobi Modem Device */ - {QMI_GOBI_DEVICE(0x03f0, 0x371d)}, /* HP un2430 Mobile Broadband Module */ - {QMI_GOBI_DEVICE(0x04da, 0x250d)}, /* Panasonic Gobi Modem device */ - {QMI_GOBI_DEVICE(0x413c, 0x8172)}, /* Dell Gobi Modem device */ - {QMI_GOBI_DEVICE(0x1410, 0xa001)}, /* Novatel Gobi Modem device */ - {QMI_GOBI_DEVICE(0x0b05, 0x1776)}, /* Asus Gobi Modem device */ - {QMI_GOBI_DEVICE(0x19d2, 0xfff3)}, /* ONDA Gobi Modem device */ - {QMI_GOBI_DEVICE(0x05c6, 0x9001)}, /* Generic Gobi Modem device */ - {QMI_GOBI_DEVICE(0x05c6, 0x9002)}, /* Generic Gobi Modem device */ - {QMI_GOBI_DEVICE(0x05c6, 0x9202)}, /* Generic Gobi Modem device */ - {QMI_GOBI_DEVICE(0x05c6, 0x9203)}, /* Generic Gobi Modem device */ - {QMI_GOBI_DEVICE(0x05c6, 0x9222)}, /* Generic Gobi Modem device */ - {QMI_GOBI_DEVICE(0x05c6, 0x9009)}, /* Generic Gobi Modem device */ + +/* Gobi 1000 devices */ + {QMI_GOBI1K_DEVICE(0x05c6, 0x9212)}, /* Acer Gobi Modem Device */ + {QMI_GOBI1K_DEVICE(0x03f0, 0x1f1d)}, /* HP un2400 Gobi Modem Device */ + {QMI_GOBI1K_DEVICE(0x03f0, 0x371d)}, /* HP un2430 Mobile Broadband Module */ + {QMI_GOBI1K_DEVICE(0x04da, 0x250d)}, /* Panasonic Gobi Modem device */ + {QMI_GOBI1K_DEVICE(0x413c, 0x8172)}, /* Dell Gobi Modem device */ + {QMI_GOBI1K_DEVICE(0x1410, 0xa001)}, /* Novatel Gobi Modem device */ + {QMI_GOBI1K_DEVICE(0x0b05, 0x1776)}, /* Asus Gobi Modem device */ + {QMI_GOBI1K_DEVICE(0x19d2, 0xfff3)}, /* ONDA Gobi Modem device */ + {QMI_GOBI1K_DEVICE(0x05c6, 0x9001)}, /* Generic Gobi Modem device */ + {QMI_GOBI1K_DEVICE(0x05c6, 0x9002)}, /* Generic Gobi Modem device */ + {QMI_GOBI1K_DEVICE(0x05c6, 0x9202)}, /* Generic Gobi Modem device */ + {QMI_GOBI1K_DEVICE(0x05c6, 0x9203)}, /* Generic Gobi Modem device */ + {QMI_GOBI1K_DEVICE(0x05c6, 0x9222)}, /* Generic Gobi Modem device */ + {QMI_GOBI1K_DEVICE(0x05c6, 0x9009)}, /* Generic Gobi Modem device */ + +/* Gobi 2000 and 3000 devices */ {QMI_GOBI_DEVICE(0x413c, 0x8186)}, /* Dell Gobi 2000 Modem device (N0218, VU936) */ {QMI_GOBI_DEVICE(0x05c6, 0x920b)}, /* Generic Gobi 2000 Modem device */ {QMI_GOBI_DEVICE(0x05c6, 0x9225)}, /* Sony Gobi 2000 Modem device (N0279, VU730) */
Greg Kroah-Hartman
maintainerPATCH 133/187 dm persistent data: fix shadow_info_leak on dm_tm_destroy
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Snitzer <[email protected]>
commit 25d7cd6faa7ae6ed2565617c3ee2500ccb8a9f7f upstream.
Cleanup the shadow table before destroying the transaction manager.
Reference: leak was identified with kmemleak when running test_discard_random_sectors in the thinp-test-suite.
--- drivers/md/persistent-data/dm-transaction-manager.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/md/persistent-data/dm-transaction-manager.c +3 -0
@@ -138,6 +138,9 @@ EXPORT_SYMBOL_GPL(dm_tm_create_non_blockvoid dm_tm_destroy (struct dm_transaction_manager *tm) { +if (!tm->is_clone) +wipe_shadow_table (tm); +kfree (tm); }EXPORT_SYMBOL_GPL (dm_tm_destroy);
Greg Kroah-Hartman
maintainerPATCH 134/187 dm persistent data: handle space map checker creation failure
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Snitzer <[email protected]>
commit 62662303e7f590fdfbb0070ab820a0ad4267c119 upstream.
If CONFIG_DM_DEBUG_SPACE_MAPS is enabled and dm_sm_checker_create() fails, dm_tm_create_internal() would still return success even though it cleaned up all resources it was supposed to have created. This will lead to a kernel crash:
general protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC ... RIP: 0010:[<ffffffff81593659>] [<ffffffff81593659>] dm_bufio_get_block_size+0x9/0x20 Call Trace: [<ffffffff81599bae>] dm_bm_block_size+0xe/0x10 [<ffffffff8159b8b8>] sm_ll_init+0x78/0xd0 [<ffffffff8159c1a6>] sm_ll_new_disk+0x16/0xa0 [<ffffffff8159c98e>] dm_sm_disk_create+0xfe/0x160 [<ffffffff815abf6e>] dm_pool_metadata_open+0x16e/0x6a0 [<ffffffff815aa010>] pool_ctr+0x3f0/0x900 [<ffffffff8158d565>] dm_table_add_target+0x195/0x450 [<ffffffff815904c4>] table_load+0xe4/0x330 [<ffffffff815917ea>] ctl_ioctl+0x15a/0x2c0 [<ffffffff81591963>] dm_ctl_ioctl+0x13/0x20 [<ffffffff8116a4f8>] do_vfs_ioctl+0x98/0x560 [<ffffffff8116aa51>] sys_ioctl+0x91/0xa0 [<ffffffff81869f52>] system_call_fastpath+0x16/0x1b
Fix the space map checker code to return an appropriate ERR_PTR and have dm_sm_disk_create() and dm_tm_create_internal() check for it with IS_ERR.
--- drivers/md/persistent-data/dm-space-map-checker.c | 24 ++++++++++---------- drivers/md/persistent-data/dm-space-map-disk.c | 11 ++++++++- drivers/md/persistent-data/dm-transaction-manager.c | 8 +++++- 3 files changed, 28 insertions(+), 15 deletions(-)
drivers/md/persistent-data/dm-space-map-checker.c +12 -12
@@ -343,25 +343,25 @@ struct dm_space_map *dm_sm_checker_creatint r;struct sm_checker *smc; -if (!sm) -return NULL ; +if (IS_ERR_OR_NULL (sm)) +return ERR_PTR (-EINVAL ); smc =kmalloc (sizeof (*smc),GFP_KERNEL );if (!smc) -return NULL ; +return ERR_PTR (-ENOMEM );memcpy (&smc->sm, &ops_,sizeof (smc->sm)); r =ca_create (&smc->old_counts, sm);if (r) {kfree (smc); -return NULL ; +return ERR_PTR (r); } r =ca_create (&smc->counts, sm);if (r) {ca_destroy (&smc->old_counts);kfree (smc); -return NULL ; +return ERR_PTR (r); } smc->real_sm = sm;
@@ -371,7 +371,7 @@ struct dm_space_map *dm_sm_checker_creatca_destroy (&smc->counts);ca_destroy (&smc->old_counts);kfree (smc); -return NULL ; +return ERR_PTR (r); } r =ca_commit (&smc->old_counts, &smc->counts);
@@ -379,7 +379,7 @@ struct dm_space_map *dm_sm_checker_creatca_destroy (&smc->counts);ca_destroy (&smc->old_counts);kfree (smc); -return NULL ; +return ERR_PTR (r); }return &smc->sm;
@@ -391,25 +391,25 @@ struct dm_space_map *dm_sm_checker_creatint r;struct sm_checker *smc; -if (!sm) -return NULL ; +if (IS_ERR_OR_NULL (sm)) +return ERR_PTR (-EINVAL ); smc =kmalloc (sizeof (*smc),GFP_KERNEL );if (!smc) -return NULL ; +return ERR_PTR (-ENOMEM );memcpy (&smc->sm, &ops_,sizeof (smc->sm)); r =ca_create (&smc->old_counts, sm);if (r) {kfree (smc); -return NULL ; +return ERR_PTR (r); } r =ca_create (&smc->counts, sm);if (r) {ca_destroy (&smc->old_counts);kfree (smc); -return NULL ; +return ERR_PTR (r); } smc->real_sm = sm;
drivers/md/persistent-data/dm-space-map-disk.c +10 -1
@@ -290,7 +290,16 @@ struct dm_space_map *dm_sm_disk_create(s dm_block_t nr_blocks) {struct dm_space_map *sm =dm_sm_disk_create_real (tm, nr_blocks); -return dm_sm_checker_create_fresh (sm); +struct dm_space_map *smc; + +if (IS_ERR_OR_NULL (sm)) +return sm; + + smc =dm_sm_checker_create_fresh (sm); +if (IS_ERR (smc)) +dm_sm_destroy (sm); + +return smc; }EXPORT_SYMBOL_GPL (dm_sm_disk_create);
drivers/md/persistent-data/dm-transaction-manager.c +6 -2
@@ -345,8 +345,10 @@ static int dm_tm_create_internal(struct } *sm =dm_sm_checker_create (inner); -if (!*sm) +if (IS_ERR (*sm)) { + r =PTR_ERR (*sm); goto bad2; + } }else { r = dm_bm_write_lock(dm_tm_get_bm(*tm), sb_location,
@@ -365,8 +367,10 @@ static int dm_tm_create_internal(struct } *sm =dm_sm_checker_create (inner); -if (!*sm) +if (IS_ERR (*sm)) { + r =PTR_ERR (*sm); goto bad2; + } }return 0 ;
Greg Kroah-Hartman
maintainerPATCH 135/187 dm persistent data: fix allocation failure in space map checker init
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Snitzer <[email protected]>
commit b0239faaf87c38bb419c9264bf20817438ddc3a9 upstream.
If CONFIG_DM_DEBUG_SPACE_MAPS is enabled and memory is fragmented and a sufficiently-large metadata device is used in a thin pool then the space map checker will fail to allocate the memory it requires.
Switch from kmalloc to vmalloc to allow larger virtually contiguous allocations for the space map checker's internal count arrays.
--- drivers/md/persistent-data/dm-space-map-checker.c | 30 +++++++++++++--------- 1 file changed, 19 insertions(+), 11 deletions(-)
drivers/md/persistent-data/dm-space-map-checker.c +19 -11
@@ -8,6 +8,7 @@#include <linux/device-mapper.h> #include <linux/export.h> +#include <linux/vmalloc.h> #ifdef CONFIG_DM_DEBUG_SPACE_MAPS
@@ -89,13 +90,23 @@ static int ca_create(struct count_array ca->nr = nr_blocks; ca->nr_free = nr_blocks; - ca->counts =kzalloc (sizeof (*ca->counts) * nr_blocks,GFP_KERNEL ); -if (!ca->counts) -return -ENOMEM ; + +if (!nr_blocks) + ca->counts =NULL ; +else { + ca->counts =vzalloc (sizeof (*ca->counts) * nr_blocks); +if (!ca->counts) +return -ENOMEM ; + }return 0 ; } +static void ca_destroy (struct count_array *ca) +{ +vfree (ca->counts); +} +static int ca_load (struct count_array *ca,struct dm_space_map *sm) {int r;
@@ -126,12 +137,14 @@ static int ca_load(struct count_array *cstatic int ca_extend (struct count_array *ca,dm_block_t extra_blocks) {dm_block_t nr_blocks = ca->nr + extra_blocks; -uint32_t *counts =kzalloc (sizeof (*counts) * nr_blocks,GFP_KERNEL ); +uint32_t *counts =vzalloc (sizeof (*counts) * nr_blocks);if (!counts)return -ENOMEM ; -memcpy (counts, ca->counts,sizeof (*counts) * ca->nr); -kfree (ca->counts); +if (ca->counts) { +memcpy (counts, ca->counts,sizeof (*counts) * ca->nr); +ca_destroy (ca); + } ca->nr = nr_blocks; ca->nr_free += extra_blocks; ca->counts = counts;
@@ -151,11 +164,6 @@ static int ca_commit(struct count_arrayreturn 0 ; } -static void ca_destroy (struct count_array *ca) -{ -kfree (ca->counts); -} -/*----------------------------------------------------------------*/ struct sm_checker {
Greg Kroah-Hartman
maintainerPATCH 136/187 eCryptfs: Gracefully refuse miscdev file ops on inherited/passed files
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tyler Hicks <[email protected]>
commit 8dc6780587c99286c0d3de747a2946a76989414a upstream.
File operations on /dev/ecryptfs would BUG() when the operations were performed by processes other than the process that originally opened the file. This could happen with open files inherited after fork() or file descriptors passed through IPC mechanisms. Rather than calling BUG(), an error code can be safely returned in most situations.
In ecryptfs_miscdev_release(), eCryptfs still needs to handle the release even if the last file reference is being held by a process that didn't originally open the file. ecryptfs_find_daemon_by_euid() will not be successful, so a pointer to the daemon is stored in the file's private_data. The private_data pointer is initialized when the miscdev file is opened and only used when the file is released.
https://launchpad.net/bugs/994247
--- fs/ecryptfs/miscdev.c | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-)
fs/ecryptfs/miscdev.c +16 -7
@@ -49,7 +49,10 @@ ecryptfs_miscdev_poll(struct file *file,mutex_lock (&ecryptfs_daemon_hash_mux);/* TODO: Just use file->private_data? */ rc =ecryptfs_find_daemon_by_euid (&daemon, euid,current_user_ns ()); -BUG_ON (rc || !daemon); +if (rc || !daemon) { +mutex_unlock (&ecryptfs_daemon_hash_mux); +return -EINVAL ; + }mutex_lock (&daemon->mux);mutex_unlock (&ecryptfs_daemon_hash_mux);if (daemon->flags &ECRYPTFS_DAEMON_ZOMBIE ) {
@@ -122,6 +125,7 @@ ecryptfs_miscdev_open(struct inode *inod goto out_unlock_daemon; } daemon->flags |=ECRYPTFS_DAEMON_MISCDEV_OPEN ; + file->private_data = daemon;atomic_inc (&ecryptfs_num_miscdev_opens); out_unlock_daemon:mutex_unlock (&daemon->mux);
@@ -152,9 +156,9 @@ ecryptfs_miscdev_release(struct inode *imutex_lock (&ecryptfs_daemon_hash_mux); rc =ecryptfs_find_daemon_by_euid (&daemon, euid,current_user_ns ()); -BUG_ON (rc || !daemon); +if (rc || !daemon) + daemon = file->private_data;mutex_lock (&daemon->mux); -BUG_ON (daemon->pid !=task_pid (current));BUG_ON (!(daemon->flags &ECRYPTFS_DAEMON_MISCDEV_OPEN )); daemon->flags &= ~ECRYPTFS_DAEMON_MISCDEV_OPEN ;atomic_dec (&ecryptfs_num_miscdev_opens);
@@ -269,8 +273,16 @@ ecryptfs_miscdev_read(struct file *file,mutex_lock (&ecryptfs_daemon_hash_mux);/* TODO: Just use file->private_data? */ rc =ecryptfs_find_daemon_by_euid (&daemon, euid,current_user_ns ()); -BUG_ON (rc || !daemon); +if (rc || !daemon) { +mutex_unlock (&ecryptfs_daemon_hash_mux); +return -EINVAL ; + }mutex_lock (&daemon->mux); +if (task_pid (current) != daemon->pid) { +mutex_unlock (&daemon->mux); +mutex_unlock (&ecryptfs_daemon_hash_mux); +return -EPERM ; + }if (daemon->flags &ECRYPTFS_DAEMON_ZOMBIE ) { rc =0 ;mutex_unlock (&ecryptfs_daemon_hash_mux);
@@ -307,9 +319,6 @@ check_list:* message from the queue; try again */ goto check_list; } -BUG_ON (euid != daemon->euid); -BUG_ON (current_user_ns () != daemon->user_ns); -BUG_ON (task_pid (current) != daemon->pid); msg_ctx =list_first_entry (&daemon->msg_ctx_out_queue, struct ecryptfs_msg_ctx, daemon_out_list);BUG_ON (!msg_ctx);
Greg Kroah-Hartman
maintainerPATCH 137/187 eCryptfs: Fix lockdep warning in miscdev operations
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tyler Hicks <[email protected]>
commit 60d65f1f07a7d81d3eb3b91fc13fca80f2fdbb12 upstream.
Don't grab the daemon mutex while holding the message context mutex. Addresses this lockdep warning:
ecryptfsd/2141 is trying to acquire lock:
(&ecryptfs_msg_ctx_arr[i].mux){+.+.+.}, at: [<ffffffffa029c213>] ecryptfs_miscdev_read+0x143/0x470 [ecryptfs]
but task is already holding lock:
(&(*daemon)->mux){+.+...}, at: [<ffffffffa029c2ec>] ecryptfs_miscdev_read+0x21c/0x470 [ecryptfs]
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (&(*daemon)->mux){+.+...}:
[<ffffffff810a3b8d>] lock_acquire+0x9d/0x220
[<ffffffff8151c6da>] __mutex_lock_common+0x5a/0x4b0
[<ffffffff8151cc64>] mutex_lock_nested+0x44/0x50
[<ffffffffa029c5d7>] ecryptfs_send_miscdev+0x97/0x120 [ecryptfs]
[<ffffffffa029b744>] ecryptfs_send_message+0x134/0x1e0 [ecryptfs]
[<ffffffffa029a24e>] ecryptfs_generate_key_packet_set+0x2fe/0xa80 [ecryptfs]
[<ffffffffa02960f8>] ecryptfs_write_metadata+0x108/0x250 [ecryptfs]
[<ffffffffa0290f80>] ecryptfs_create+0x130/0x250 [ecryptfs]
[<ffffffff811963a4>] vfs_create+0xb4/0x120
[<ffffffff81197865>] do_last+0x8c5/0xa10
[<ffffffff811998f9>] path_openat+0xd9/0x460
[<ffffffff81199da2>] do_filp_open+0x42/0xa0
[<ffffffff81187998>] do_sys_open+0xf8/0x1d0
[<ffffffff81187a91>] sys_open+0x21/0x30
[<ffffffff81527d69>] system_call_fastpath+0x16/0x1b-> #0 (&ecryptfs_msg_ctx_arr[i].mux){+.+.+.}:
[<ffffffff810a3418>] __lock_acquire+0x1bf8/0x1c50
[<ffffffff810a3b8d>] lock_acquire+0x9d/0x220
[<ffffffff8151c6da>] __mutex_lock_common+0x5a/0x4b0
[<ffffffff8151cc64>] mutex_lock_nested+0x44/0x50
[<ffffffffa029c213>] ecryptfs_miscdev_read+0x143/0x470 [ecryptfs]
[<ffffffff811887d3>] vfs_read+0xb3/0x180
[<ffffffff811888ed>] sys_read+0x4d/0x90
[<ffffffff81527d69>] system_call_fastpath+0x16/0x1b--- fs/ecryptfs/miscdev.c | 25 +++++++++++++------------ 1 file changed, 13 insertions(+), 12 deletions(-)
fs/ecryptfs/miscdev.c +13 -12
@@ -195,31 +195,32 @@ int ecryptfs_send_miscdev(char *data, si struct ecryptfs_msg_ctx *msg_ctx, u8 msg_type, u16 msg_flags, struct ecryptfs_daemon *daemon) { - int rc = 0; + struct ecryptfs_message *msg; -mutex_lock (&msg_ctx->mux); - msg_ctx->msg =kmalloc ((sizeof (*msg_ctx->msg) + data_size), -GFP_KERNEL ); -if (!msg_ctx->msg) { - rc = -ENOMEM ; + msg =kmalloc ((sizeof (*msg) + data_size),GFP_KERNEL ); +if (!msg) {printk (KERN_ERR "%s: Out of memory whilst attempting " "to kmalloc(%zd, GFP_KERNEL)\n" , __func__, - (sizeof (*msg_ctx->msg) + data_size)); - goto out_unlock; + (sizeof (*msg) + data_size)); +return -ENOMEM ; } + +mutex_lock (&msg_ctx->mux); + msg_ctx->msg = msg; msg_ctx->msg->index = msg_ctx->index; msg_ctx->msg->data_len = data_size; msg_ctx->type = msg_type;memcpy (msg_ctx->msg->data, data, data_size); msg_ctx->msg_size = (sizeof (*msg_ctx->msg) + data_size); -mutex_lock (&daemon->mux);list_add_tail (&msg_ctx->daemon_out_list, &daemon->msg_ctx_out_queue); +mutex_unlock (&msg_ctx->mux); + +mutex_lock (&daemon->mux); daemon->num_queued_msg_ctx++;wake_up_interruptible (&daemon->wait);mutex_unlock (&daemon->mux); -out_unlock: -mutex_unlock (&msg_ctx->mux); -return rc; + +return 0 ; }/*
Greg Kroah-Hartman
maintainerPATCH 138/187 eCryptfs: Properly check for O_RDONLY flag before doing privileged open
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tyler Hicks <[email protected]>
commit 9fe79d7600497ed8a95c3981cbe5b73ab98222f0 upstream.
If the first attempt at opening the lower file read/write fails, eCryptfs will retry using a privileged kthread. However, the privileged retry should not happen if the lower file's inode is read-only because a read/write open will still be unsuccessful.
The check for determining if the open should be retried was intended to be based on the access mode of the lower file's open flags being O_RDONLY, but the check was incorrectly performed. This would cause the open to be retried by the privileged kthread, resulting in a second failed open of the lower file. This patch corrects the check to determine if the open request should be handled by the privileged kthread.
--- fs/ecryptfs/kthread.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ecryptfs/kthread.c +1 -1
@@ -149,7 +149,7 @@ int ecryptfs_privileged_open(struct file (*lower_file) =dentry_open (lower_dentry, lower_mnt, flags, cred);if (!IS_ERR (*lower_file)) goto out; -if (flags &O_RDONLY ) { +if ((flags &O_ACCMODE ) ==O_RDONLY ) { rc =PTR_ERR ((*lower_file)); goto out; }
Greg Kroah-Hartman
maintainerPATCH 139/187 mm/memblock: cleanup on duplicate VA/PA conversion
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gavin Shan <[email protected]>
commit 4e2f07750d9a94e8f23e86408df5ab95be88bf11 upstream.
The overall memblock has been organized into the memory regions and reserved regions. Initially, the memory regions and reserved regions are stored in the predetermined arrays of "struct memblock _region". It's possible for the arrays to be enlarged when we have newly added regions for them, but no enough space there. Under the situation, We will created double-sized array to meet the requirement. However, the original implementation converted the VA (Virtual Address) of the newly allocated array of regions to PA (Physical Address), then translate back when we allocates the new array from slab. That's actually unnecessary.
The patch removes the duplicate VA/PA conversion.
--- mm/memblock.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
mm/memblock.c +3 -2
@@ -212,14 +212,15 @@ static int __init_memblock memblock_doubif (use_slab) { new_array =kmalloc (new_size,GFP_KERNEL ); addr = new_array ?__pa (new_array) :0 ; - }else + }else { addr =memblock_find_in_range (0 ,MEMBLOCK_ALLOC_ACCESSIBLE , new_size,sizeof (phys_addr_t)); + new_array = addr ?__va (addr) :0 ; + }if (!addr) {pr_err ("memblock: Failed to double %s array from %ld to %ld entries !\n" ,memblock_type_name (type), type->max, type->max *2 );return -1 ; } - new_array =__va (addr);memblock_dbg ("memblock: %s array is doubled to %ld at [%#010llx-%#010llx]" ,memblock_type_name (type), type->max *2 , (u64 )addr, (u64 )addr + new_size -1 );
Greg Kroah-Hartman
maintainerPATCH 140/187 mm/memblock: fix memory leak on extending regions
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gavin Shan <[email protected]>
commit 181eb39425f2b9275afcb015eaa547d11f71a02f upstream.
The overall memblock has been organized into the memory regions and reserved regions. Initially, the memory regions and reserved regions are stored in the predetermined arrays of "struct memblock _region". It's possible for the arrays to be enlarged when we have newly added regions, but no free space left there. The policy here is to create double-sized array either by slab allocator or memblock allocator. Unfortunately, we didn't free the old array, which might be allocated through slab allocator before. That would cause memory leak.
The patch introduces 2 variables to trace where (slab or memblock) the memory and reserved regions come from. The memory for the memory or reserved regions will be deallocated by kfree() if that was allocated by slab allocator. Thus to fix the memory leak issue.
--- mm/memblock.c | 37 ++++++++++++++++++++++++------------- 1 file changed, 24 insertions(+), 13 deletions(-)
mm/memblock.c +24 -13
@@ -37,6 +37,8 @@ struct memblock memblock __initdata_memb int memblock_debug __initdata_memblock; static int memblock_can_resize __initdata_memblock; +static int memblock_memory_in_slab __initdata_memblock = 0; +static int memblock_reserved_in_slab __initdata_memblock = 0;/* inline so we don't get a warning when pr_debug is compiled out */ static inline const char *memblock_type_name (struct memblock_type *type)
@@ -187,6 +189,7 @@ static int __init_memblock memblock_doubstruct memblock_region *new_array, *old_array;phys_addr_t old_size, new_size, addr;int use_slab =slab_is_available (); +int *in_slab;/* We don't allow resizing until we know about the reserved regions * of memory that aren't suitable for allocation
@@ -198,6 +201,12 @@ static int __init_memblock memblock_doub old_size = type->max *sizeof (struct memblock_region ); new_size = old_size <<1 ; +/* Retrieve the slab flag */ +if (type == &memblock.memory) + in_slab = &memblock_memory_in_slab; +else + in_slab = &memblock_reserved_in_slab; +/* Try to find some space for it. * * WARNING: We assume that either slab_is_available() and we use it or
@@ -235,22 +244,24 @@ static int __init_memblock memblock_doub type->regions = new_array; type->max <<=1 ; -/* If we use SLAB that's it, we are done */ -if (use_slab) -return 0 ; - -/* Add the new reserved region now. Should not fail ! */ -BUG_ON (memblock_reserve (addr, new_size)); - -/* If the array wasn't our static init one, then free it. We only do -* that before SLAB is available as later on, we don't know whether -* to use kfree or free_bootmem_pages(). Shouldn't be a big deal -* anyways +/* Free old array. We needn't free it if the array is the +* static one */ -if (old_array != memblock_memory_init_regions && - old_array != memblock_reserved_init_regions) +if (*in_slab) +kfree (old_array); +else if (old_array != memblock_memory_init_regions && + old_array != memblock_reserved_init_regions)memblock_free (__pa (old_array), old_size); +/* Reserve the new array if that comes from the memblock. +* Otherwise, we needn't do it +*/ +if (!use_slab) +BUG_ON (memblock_reserve (addr, new_size)); + +/* Update slab flag */ + *in_slab = use_slab; +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 141/187 mm/memblock: fix overlapping allocation when doubling reserved array
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Pearson <[email protected]>
commit 48c3b583bbddad2220ca4c22319ca5d1f78b2090 upstream.
__alloc_memory_core_early() asks memblock for a range of memory then try to reserve it. If the reserved region array lacks space for the new range, memblock_double_array() is called to allocate more space for the array. If memblock is used to allocate memory for the new array it can end up using a range that overlaps with the range originally allocated in __alloc_memory_core_early(), leading to possible data corruption.
With this patch memblock_double_array() now calls memblock_find_in_range() with a narrowed candidate range (in cases where the reserved.regions array is being doubled) so any memory allocated will not overlap with the original range that was being reserved. The range is narrowed by passing in the starting address and size of the previously allocated range. Then the range above the ending address is searched and if a candidate is not found, the range below the starting address is searched.
--- mm/memblock.c | 36 ++++++++++++++++++++++++++++++++---- 1 file changed, 32 insertions(+), 4 deletions(-)
mm/memblock.c +32 -4
@@ -184,7 +184,24 @@ static void __init_memblock memblock_rem } } -static int __init_memblock memblock_double_array(struct memblock_type *type) +/** +* memblock_double_array - double the size of the memblock regions array +* @type: memblock type of the regions array being doubled +* @new_area_start: starting address of memory range to avoid overlap with +* @new_area_size: size of memory range to avoid overlap with +* +* Double the size of the @type regions array. If memblock is being used to +* allocate memory for a new reserved regions array and there is a previously +* allocated memory range [@new_area_start,@new_area_start+@new_area_size] +* waiting to be reserved, ensure the memory used by the new array does +* not overlap. +* +* RETURNS: +* 0 on success, -1 on failure. +*/ +static int __init_memblock memblock_double_array(struct memblock_type *type, +phys_addr_t new_area_start, +phys_addr_t new_area_size) {struct memblock_region *new_array, *old_array;phys_addr_t old_size, new_size, addr;
@@ -222,7 +239,18 @@ static int __init_memblock memblock_doub new_array =kmalloc (new_size,GFP_KERNEL ); addr = new_array ?__pa (new_array) :0 ; }else { - addr =memblock_find_in_range (0 ,MEMBLOCK_ALLOC_ACCESSIBLE , new_size,sizeof (phys_addr_t)); +/* only exclude range when trying to double reserved.regions */ +if (type != &memblock.reserved) + new_area_start = new_area_size =0 ; + + addr =memblock_find_in_range (new_area_start + new_area_size, + memblock.current_limit, + new_size,sizeof (phys_addr_t)); +if (!addr && new_area_size) + addr =memblock_find_in_range (0 , +min (new_area_start, memblock.current_limit), + new_size,sizeof (phys_addr_t)); + new_array = addr ?__va (addr) :0 ; }if (!addr) {
@@ -399,7 +427,7 @@ repeat:*/ if (!insert) {while (type->cnt + nr_new > type->max) -if (memblock_double_array (type) <0 ) +if (memblock_double_array (type, obase, size) <0 )return -ENOMEM ; insert = true; goto repeat;
@@ -450,7 +478,7 @@ static int __init_memblock memblock_isol/* we'll create at most two more regions */ while (type->cnt +2 > type->max) -if (memblock_double_array (type) <0 ) +if (memblock_double_array (type, base, size) <0 )return -ENOMEM ;for (i =0 ; i < type->cnt; i++) {
Greg Kroah-Hartman
maintainerPATCH 142/187 OMAPDSS: use DSI_FIFO_BUG workaround only for manual update displays
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomi Valkeinen <[email protected]>
commit 3568f2a46f2a73bab18c914df06afd98a97e0e0e upstream.
There is a problem related to DSS FIFO thresholds and power management on OMAP3. It seems that when the full PM hits in, we get underflows. The core reason is unknown, but after experiments it looks like only particular FIFO thresholds work correctly.
This bug is related to an earlier patch, which added special FIFO threshold configuration for OMAP3, because DSI command mode output didn't work with the normal threshold configuration.
However, as the above work-around worked fine for other output types also, we currently always configure thresholds in this special way on OMAP3. In theory there should be negligible difference with this special way and the standard way. The first paragraph explains what happens in practice.
This patch changes the driver to use the special threshold configuration only when the output is a manual update display on OMAP3. This does include RFBI displays also, and although it hasn't been tested (no boards using RFBI) I suspect the similar behaviour is present there also, as the DISPC side should work similarly for DSI command mode and RFBI.
--- drivers/video/omap2/dss/apply.c | 2 +- drivers/video/omap2/dss/dispc.c | 5 +++-- drivers/video/omap2/dss/dss.h | 3 ++- 3 files changed, 6 insertions(+), 4 deletions(-)
drivers/video/omap2/dss/apply.c +1 -1
@@ -927,7 +927,7 @@ static void dss_ovl_setup_fifo(struct om dssdev = ovl->manager->device;dispc_ovl_compute_fifo_thresholds (ovl->id, &fifo_low, &fifo_high, - use_fifo_merge); + use_fifo_merge,ovl_manual_update (ovl));dss_apply_ovl_fifo_thresholds (ovl, fifo_low, fifo_high); }
drivers/video/omap2/dss/dispc.c +3 -2
@@ -1063,7 +1063,8 @@ void dispc_enable_fifomerge(bool enable) }void dispc_ovl_compute_fifo_thresholds (enum omap_plane plane, -u32 *fifo_low,u32 *fifo_high,bool use_fifomerge) +u32 *fifo_low,u32 *fifo_high,bool use_fifomerge, +bool manual_update) {/* * All sizes are in bytes. Both the buffer and burst are made of
@@ -1091,7 +1092,7 @@ void dispc_ovl_compute_fifo_thresholds(e* combined fifo size */ -if (dss_has_feature (FEAT_OMAP3_DSI_FIFO_BUG )) { +if (manual_update &&dss_has_feature (FEAT_OMAP3_DSI_FIFO_BUG )) { *fifo_low = ovl_fifo_size - burst_size *2 ; *fifo_high = total_fifo_size - burst_size; }else {
drivers/video/omap2/dss/dss.h +2 -1
@@ -424,7 +424,8 @@ int dispc_calc_clock_rates(unsigned longvoid dispc_ovl_set_fifo_threshold (enum omap_plane plane,u32 low,u32 high);void dispc_ovl_compute_fifo_thresholds (enum omap_plane plane, -u32 *fifo_low,u32 *fifo_high,bool use_fifomerge); +u32 *fifo_low,u32 *fifo_high,bool use_fifomerge, +bool manual_update);int dispc_ovl_setup (enum omap_plane plane,struct omap_overlay_info *oi,bool ilace,bool replication);int dispc_ovl_enable (enum omap_plane plane,bool enable);
Greg Kroah-Hartman
maintainerPATCH 143/187 e1000e: test for valid check_reset_block function pointer
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bruce Allan <[email protected]>
commit 470a54207ccf7045a59df727573bd9d148988582 upstream.
commit 44abd5c12767a8c567dc4e45fd9aec3b13ca85e0 introduced NULL pointer dereferences when attempting to access the check_reset_block function pointer on 8257x and 80003es2lan non-copper devices.
This fix should be applied back through 3.4.
--- drivers/net/ethernet/intel/e1000e/ethtool.c | 6 ++++-- drivers/net/ethernet/intel/e1000e/mac.c | 2 +- drivers/net/ethernet/intel/e1000e/netdev.c | 4 ++-- drivers/net/ethernet/intel/e1000e/phy.c | 8 +++++--- 4 files changed, 12 insertions(+), 8 deletions(-)
drivers/net/ethernet/intel/e1000e/ethtool.c +4 -2
@@ -258,7 +258,8 @@ static int e1000_set_settings(struct net* When SoL/IDER sessions are active, autoneg/speed/duplex * cannot be changed */ -if (hw->phy.ops.check_reset_block (hw)) { +if (hw->phy.ops.check_reset_block && + hw->phy.ops.check_reset_block (hw)) {e_err ("Cannot change link characteristics when SoL/IDER is " "active.\n" );return -EINVAL ;
@@ -1604,7 +1605,8 @@ static int e1000_loopback_test(struct e1* PHY loopback cannot be performed if SoL/IDER * sessions are active */ -if (hw->phy.ops.check_reset_block (hw)) { +if (hw->phy.ops.check_reset_block && + hw->phy.ops.check_reset_block (hw)) {e_err ("Cannot do PHY loopback test when SoL/IDER is active.\n" ); *data =0 ; goto out;
drivers/net/ethernet/intel/e1000e/mac.c +1 -1
@@ -709,7 +709,7 @@ s32 e1000e_setup_link_generic(struct e10* In the case of the phy reset being blocked, we already have a link. * We do not need to set it up again. */ -if (hw->phy.ops.check_reset_block (hw)) +if (hw->phy.ops.check_reset_block && hw->phy.ops.check_reset_block (hw))return 0 ;/*
drivers/net/ethernet/intel/e1000e/netdev.c +2 -2
@@ -6209,7 +6209,7 @@ static int __devinit e1000_probe(struct adapter->hw.phy.ms_type = e1000_ms_hw_default; } -if (hw->phy.ops.check_reset_block (hw)) +if (hw->phy.ops.check_reset_block && hw->phy.ops.check_reset_block (hw))e_info ("PHY reset is blocked due to SOL/IDER session.\n" );/* Set initial default active device features */
@@ -6376,7 +6376,7 @@ err_register:if (!(adapter->flags &FLAG_HAS_AMT ))e1000e_release_hw_control (adapter); err_eeprom: -if (!hw->phy.ops.check_reset_block (hw)) +if (hw->phy.ops.check_reset_block && !hw->phy.ops.check_reset_block (hw))e1000_phy_hw_reset (&adapter->hw); err_hw_init:kfree (adapter->tx_ring);
drivers/net/ethernet/intel/e1000e/phy.c +5 -3
@@ -2121,9 +2121,11 @@ s32 e1000e_phy_hw_reset_generic(struct es32 ret_val;u32 ctrl; - ret_val = phy->ops.check_reset_block (hw); -if (ret_val) -return 0 ; +if (phy->ops.check_reset_block) { + ret_val = phy->ops.check_reset_block (hw); +if (ret_val) +return 0 ; + } ret_val = phy->ops.acquire (hw);if (ret_val)
Greg Kroah-Hartman
maintainerPATCH 144/187 HID: hid-multitouch: fix wrong protocol detection
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Tissoires <[email protected]>
commit 3ac36d15557d1bedfb1151d9911b9587b2d40759 upstream.
The previous implementation introduced a randomness in the splitting of the different touches reported by the device. This version is more robust as we don't rely on hi->input->absbit, but on our own structure.
This also prepares hid-multitouch to better support Win8 devices.
[Jiri Kosina <[email protected]>: fix build]
--- drivers/hid/hid-multitouch.c | 58 ++++++++++++++++++++++++++++++++++--------- 1 file changed, 46 insertions(+), 12 deletions(-)
drivers/hid/hid-multitouch.c +46 -12
@@ -70,9 +70,16 @@ struct mt_class {bool is_indirect;/* true for touchpads */ }; +struct mt_fields { +unsigned usages[HID_MAX_FIELDS ]; +unsigned int length; +}; +struct mt_device {struct mt_slot curdata;/* placeholder of incoming data */ struct mt_class mtclass;/* our mt device class */ +struct mt_fields *fields;/* temporary placeholder for storing the +multitouch fields */ unsigned last_field_index;/* last field index of the report */ unsigned last_slot_field;/* the last field of a slot */ __s8 inputmode;/* InputMode HID feature, -1 if non-existent */
@@ -275,11 +282,15 @@ static void set_abs(struct input_dev *ininput_set_abs_params (input, code, fmin, fmax, fuzz,0 ); } -static void set_last_slot_field (struct hid_usage *usage,struct mt_device *td, +static void mt_store_field (struct hid_usage *usage,struct mt_device *td,struct hid_input *hi) { -if (!test_bit (usage->hid, hi->input->absbit)) - td->last_slot_field = usage->hid; +struct mt_fields *f = td->fields; + +if (f->length >=HID_MAX_FIELDS ) +return ; + + f->usages[f->length++] = usage->hid; } static int mt_input_mapping(struct hid_device *hdev, struct hid_input *hi,
@@ -330,7 +341,7 @@ static int mt_input_mapping(struct hid_d cls->sn_move);/* touchscreen emulation */ set_abs (hi->input,ABS_X , field, cls->sn_move); -set_last_slot_field (usage, td, hi); +mt_store_field (usage, td, hi); td->last_field_index = field->index;return 1 ;case HID_GD_Y :
@@ -340,7 +351,7 @@ static int mt_input_mapping(struct hid_d cls->sn_move);/* touchscreen emulation */ set_abs (hi->input,ABS_Y , field, cls->sn_move); -set_last_slot_field (usage, td, hi); +mt_store_field (usage, td, hi); td->last_field_index = field->index;return 1 ; }
@@ -349,24 +360,24 @@ static int mt_input_mapping(struct hid_dcase HID_UP_DIGITIZER :switch (usage->hid) {case HID_DG_INRANGE : -set_last_slot_field (usage, td, hi); +mt_store_field (usage, td, hi); td->last_field_index = field->index;return 1 ;case HID_DG_CONFIDENCE : -set_last_slot_field (usage, td, hi); +mt_store_field (usage, td, hi); td->last_field_index = field->index;return 1 ;case HID_DG_TIPSWITCH :hid_map_usage (hi, usage, bit, max,EV_KEY ,BTN_TOUCH );input_set_capability (hi->input,EV_KEY ,BTN_TOUCH ); -set_last_slot_field (usage, td, hi); +mt_store_field (usage, td, hi); td->last_field_index = field->index;return 1 ;case HID_DG_CONTACTID :if (!td->maxcontacts) td->maxcontacts =MT_DEFAULT_MAXCONTACT ;input_mt_init_slots (hi->input, td->maxcontacts); - td->last_slot_field = usage->hid; +mt_store_field (usage, td, hi); td->last_field_index = field->index; td->touches_by_report++;return 1 ;
@@ -375,7 +386,7 @@ static int mt_input_mapping(struct hid_d EV_ABS, ABS_MT_TOUCH_MAJOR);set_abs (hi->input,ABS_MT_TOUCH_MAJOR , field, cls->sn_width); -set_last_slot_field (usage, td, hi); +mt_store_field (usage, td, hi); td->last_field_index = field->index;return 1 ;case HID_DG_HEIGHT :
@@ -385,7 +396,7 @@ static int mt_input_mapping(struct hid_d cls->sn_height);input_set_abs_params (hi->input,ABS_MT_ORIENTATION ,0 ,1 ,0 ,0 ); -set_last_slot_field (usage, td, hi); +mt_store_field (usage, td, hi); td->last_field_index = field->index;return 1 ;case HID_DG_TIPPRESSURE :
@@ -396,7 +407,7 @@ static int mt_input_mapping(struct hid_d/* touchscreen emulation */ set_abs (hi->input,ABS_PRESSURE , field, cls->sn_pressure); -set_last_slot_field (usage, td, hi); +mt_store_field (usage, td, hi); td->last_field_index = field->index;return 1 ;case HID_DG_CONTACTCOUNT :
@@ -635,6 +646,16 @@ static void mt_set_maxcontacts(struct hi } } +static void mt_post_parse (struct mt_device *td) +{ +struct mt_fields *f = td->fields; + +if (td->touches_by_report >0 ) { +int field_count_per_touch = f->length / td->touches_by_report; + td->last_slot_field = f->usages[field_count_per_touch -1 ]; + } +} +static int mt_probe (struct hid_device *hdev,const struct hid_device_id *id) {int ret, i;
@@ -666,6 +687,13 @@ static int mt_probe(struct hid_device *h td->maxcontact_report_id =-1 ;hid_set_drvdata (hdev, td); + td->fields =kzalloc (sizeof (struct mt_fields ),GFP_KERNEL ); +if (!td->fields) { +dev_err (&hdev->dev,"cannot allocate multitouch fields data\n" ); + ret = -ENOMEM ; + goto fail; + } + ret =hid_parse (hdev);if (ret !=0 ) goto fail;
@@ -674,6 +702,8 @@ static int mt_probe(struct hid_device *hif (ret) goto fail; +mt_post_parse (td); +if (!id && td->touches_by_report ==1 ) {/* the device has been sent by hid-generic */ mtclass = &td->mtclass;
@@ -697,9 +727,13 @@ static int mt_probe(struct hid_device *hmt_set_maxcontacts (hdev);mt_set_input_mode (hdev); +kfree (td->fields); + td->fields =NULL ; +return 0 ; fail: +kfree (td->fields);kfree (td);return ret; }
Greg Kroah-Hartman
maintainerPATCH 145/187 ACPI / PM: Make acpi_pm_device_sleep_state() follow the specification
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Rafael J. Wysocki" <[email protected]>
commit dbe9a2edd17d843d80faf2b99f20a691c1853418 upstream.
The comparison between the system sleep state being entered and the lowest system sleep state the given device may wake up from in acpi_pm_device_sleep_state() is reversed, because the specification (ACPI 5.0) says that for wakeup to work:
"The sleeping state being entered must be less than or equal to the
power state declared in element 1 of the _PRW object."
In other words, the state returned by _PRW is the deepest (lowest-power) system sleep state the device is capable of waking up the system from.
Moreover, acpi_pm_device_sleep_state() also should check if the wakeup capability is supported through ACPI, because in principle it may be done via native PCIe PME, for example, in which case _SxW should not be evaluated.
--- drivers/acpi/sleep.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/acpi/sleep.c +2 -2
@@ -732,8 +732,8 @@ int acpi_pm_device_sleep_state(struct de* can wake the system. _S0W may be valid, too. */ if (acpi_target_sleep_state ==ACPI_STATE_S0 || - (device_may_wakeup (dev) && - adev->wakeup.sleep_state <= acpi_target_sleep_state)) { + (device_may_wakeup (dev) && adev->wakeup.flags.valid && + adev->wakeup.sleep_state >= acpi_target_sleep_state)) {acpi_status status; acpi_method[3 ] ='W' ;
Greg Kroah-Hartman
maintainerPATCH 146/187 SCSI: Fix NULL dereferences in scsi_cmd_to_driver
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rustad <[email protected]>
commit 222a806af830fda34ad1f6bc991cd226916de060 upstream.
Avoid crashing if the private_data pointer happens to be NULL. This has been seen sometimes when a host reset happens, notably when there are many LUNs:
host3: Assigned Port ID 0c1601
scsi host3: libfc: Host reset succeeded on port (0c1601)
BUG: unable to handle kernel NULL pointer dereference at 0000000000000350 IP: [<ffffffff81352bb8>] scsi_send_eh_cmnd+0x58/0x3a0 <snip> Process scsi_eh_3 (pid: 4144, threadinfo ffff88030920c000, task ffff880326b160c0) Stack: 000000010372e6ba 0000000000000282 000027100920dca0 ffffffffa0038ee0 0000000000000000 0000000000030003 ffff88030920dc80 ffff88030920dc80 00000002000e0000 0000000a00004000 ffff8803242f7760 ffff88031326ed80 Call Trace: [<ffffffff8105b590>] ? lock_timer_base+0x70/0x70 [<ffffffff81352fbe>] scsi_eh_tur+0x3e/0xc0 [<ffffffff81353a36>] scsi_eh_test_devices+0x76/0x170 [<ffffffff81354125>] scsi_eh_host_reset+0x85/0x160 [<ffffffff81354291>] scsi_eh_ready_devs+0x91/0x110 [<ffffffff813543fd>] scsi_unjam_host+0xed/0x1f0 [<ffffffff813546a8>] scsi_error_handler+0x1a8/0x200 [<ffffffff81354500>] ? scsi_unjam_host+0x1f0/0x1f0 [<ffffffff8106ec3e>] kthread+0x9e/0xb0 [<ffffffff81509264>] kernel_thread_helper+0x4/0x10 [<ffffffff8106eba0>] ? kthread_freezable_should_stop+0x70/0x70 [<ffffffff81509260>] ? gs_change+0x13/0x13 Code: 25 28 00 00 00 48 89 45 c8 31 c0 48 8b 87 80 00 00 00 48 8d b5 60 ff ff ff 89 d1 48 89 fb 41 89 d6 4c 89 fa 48 8b 80 b8 00 00 00 <48> 8b 80 50 03 00 00 48 8b 00 48 89 85 38 ff ff ff 48 8b 07 4c RIP [<ffffffff81352bb8>] scsi_send_eh_cmnd+0x58/0x3a0 RSP <ffff88030920dc50>
CR2: 0000000000000350
--- include/scsi/scsi_cmnd.h | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
include/scsi/scsi_cmnd.h +7 -1
@@ -134,10 +134,16 @@ struct scsi_cmnd {static inline struct scsi_driver *scsi_cmd_to_driver (struct scsi_cmnd *cmd) { +struct scsi_driver **sdp; +if (!cmd->request->rq_disk)return NULL ; -return *(struct scsi_driver **)cmd->request->rq_disk->private_data; + sdp = (struct scsi_driver **)cmd->request->rq_disk->private_data; +if (!sdp) +return NULL ; + +return *sdp; }extern struct scsi_cmnd *scsi_get_command (struct scsi_device *,gfp_t );
Greg Kroah-Hartman
maintainerPATCH 147/187 SCSI: libsas: fix taskfile corruption in sas_ata_qc_fill_rtf
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Williams <[email protected]>
commit 6ef1b512f4e6f936d89aa20be3d97a7ec7c290ac upstream.
fill_result_tf() grabs the taskfile flags from the originating qc which sas_ata_qc_fill_rtf() promptly overwrites. The presence of an ata_taskfile in the sata_device makes it tempting to just copy the full contents in sas_ata_qc_fill_rtf(). However, libata really only wants the fis contents and expects the other portions of the taskfile to not be touched by ->qc_fill_rtf. To that end store a fis buffer in the sata_device and use ata_tf_from_fis() like every other ->qc_fill_rtf() implementation.
--- drivers/scsi/aic94xx/aic94xx_task.c | 2 +- drivers/scsi/libsas/sas_ata.c | 12 ++++++------ include/scsi/libsas.h | 6 ++++-- 3 files changed, 11 insertions(+), 9 deletions(-)
drivers/scsi/aic94xx/aic94xx_task.c +1 -1
@@ -201,7 +201,7 @@ static void asd_get_response_tasklet(strif (SAS_STATUS_BUF_SIZE >=sizeof (*resp)) { resp->frame_len =le16_to_cpu (*(__le16 *)(r+6 )); -memcpy (&resp->ending_fis[0 ], r+16 ,24 ); +memcpy (&resp->ending_fis[0 ], r+16 ,ATA_RESP_FIS_SIZE ); ts->buf_valid_size =sizeof (*resp); } }
drivers/scsi/libsas/sas_ata.c +6 -6
@@ -139,12 +139,12 @@ static void sas_ata_task_done(struct sasif (stat->stat ==SAS_PROTO_RESPONSE || stat->stat ==SAM_STAT_GOOD || ((stat->stat ==SAM_STAT_CHECK_CONDITION && dev->sata_dev.command_set ==ATAPI_COMMAND_SET ))) { -ata_tf_from_fis (resp->ending_fis, &dev->sata_dev.tf); +memcpy (dev->sata_dev.fis, resp->ending_fis,ATA_RESP_FIS_SIZE );if (!link->sactive) { - qc->err_mask |=ac_err_mask (dev->sata_dev.tf.command); + qc->err_mask |=ac_err_mask (dev->sata_dev.fis[2 ]); }else { - link->eh_info.err_mask |=ac_err_mask (dev->sata_dev.tf.command); + link->eh_info.err_mask |=ac_err_mask (dev->sata_dev.fis[2 ]);if (unlikely (link->eh_info.err_mask)) qc->flags |=ATA_QCFLAG_FAILED ; }
@@ -161,8 +161,8 @@ static void sas_ata_task_done(struct sas qc->flags |=ATA_QCFLAG_FAILED ; } - dev->sata_dev.tf.feature =0x04 ;/* status err */ - dev->sata_dev.tf.command =ATA_ERR ; + dev->sata_dev.fis[3 ] =0x04 ;/* status err */ + dev->sata_dev.fis[2 ] =ATA_ERR ; } }
@@ -269,7 +269,7 @@ static bool sas_ata_qc_fill_rtf(struct a {struct domain_device *dev = qc->ap->private_data; -memcpy (&qc->result_tf, &dev->sata_dev.tf,sizeof (qc->result_tf)); +ata_tf_from_fis (dev->sata_dev.fis, &qc->result_tf);return true; }
include/scsi/libsas.h +4 -2
@@ -163,6 +163,8 @@ enum ata_command_set { ATAPI_COMMAND_SET = 1, }; +#define ATA_RESP_FIS_SIZE 24 +struct sata_device {enum ata_command_set command_set;struct smp_resp rps_resp;/* report_phy_sata_resp */
@@ -171,7 +173,7 @@ struct sata_device {struct ata_port *ap;struct ata_host ata_host; -struct ata_taskfile tf; +u8 fis[ATA_RESP_FIS_SIZE ]; };enum {
@@ -537,7 +539,7 @@ enum exec_status {*/ struct ata_task_resp {u16 frame_len; -u8 ending_fis[24 ];/* dev to host or data-in */ +u8 ending_fis[ATA_RESP_FIS_SIZE ];/* dev to host or data-in */ };#define SAS_STATUS_BUF_SIZE 96
Greg Kroah-Hartman
maintainerPATCH 148/187 ACPI / PM: Leave Bus Master Arbitration enabled for suspend/resume
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonathan Nieder <[email protected]>
commit dc332fdf9f373a87b1e2f423b5b004b2a3c37e1a upstream.
This is an old suspend/resume lockup fix:
commit 2780cc4660e1
Author: Len Brown <[email protected]>
Date: Thu Dec 23 13:43:30 2004 -0500
[ACPI] Fix suspend/resume lockup issue by leaving Bus Master Arbitration enabled. The ACPI spec mandates it be disabled only for C3.
http://bugzilla.kernel.org/show_bug.cgi?id=3599
The bug snuck back in in commit 2feec47d4c5f (ACPICA: ACPI 5: Support for new FADT SleepStatus, SleepControl registers, 2012-02-14), presumably by copy/pasting a copy of the code without that fix for the legacy case.
On affected machines, after that commit, the machine locks up hard on resume from suspend. The same fix as seven years ago still works.
Addresses <https://bugzilla.kernel.org/show_bug.cgi?id=43641>.
--- drivers/acpi/acpica/hwsleep.c | 22 ---------------------- 1 file changed, 22 deletions(-)
drivers/acpi/acpica/hwsleep.c +0 -22
@@ -95,18 +95,6 @@ acpi_status acpi_hw_legacy_sleep(u8 sleereturn_ACPI_STATUS (status); } -if (sleep_state !=ACPI_STATE_S5 ) { -/* -* Disable BM arbitration. This feature is contained within an -* optional register (PM2 Control), so ignore a BAD_ADDRESS -* exception. -*/ - status =acpi_write_bit_register (ACPI_BITREG_ARB_DISABLE ,1 ); -if (ACPI_FAILURE (status) && (status !=AE_BAD_ADDRESS )) { -return_ACPI_STATUS (status); - } - } -/* * 1) Disable/Clear all GPEs * 2) Enable all wakeup GPEs
@@ -364,16 +352,6 @@ acpi_status acpi_hw_legacy_wake(u8 sleep [ACPI_EVENT_POWER_BUTTON ]. status_register_id, ACPI_CLEAR_STATUS); -/* -* Enable BM arbitration. This feature is contained within an -* optional register (PM2 Control), so ignore a BAD_ADDRESS -* exception. -*/ - status =acpi_write_bit_register (ACPI_BITREG_ARB_DISABLE ,0 ); -if (ACPI_FAILURE (status) && (status !=AE_BAD_ADDRESS )) { -return_ACPI_STATUS (status); - } -acpi_hw_execute_sleep_method (METHOD_PATHNAME__SST ,ACPI_SST_WORKING );return_ACPI_STATUS (status); }
Greg Kroah-Hartman
maintainerPATCH 149/187 USB: metro-usb: fix tty_flip_buffer_push use
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit b7d28e32c93801d60c1a7a817f774a02b7bdde43 upstream.
Do not set low_latency flag at open as tty_flip_buffer_push must not be called in IRQ context with low_latency set.
--- drivers/usb/serial/metro-usb.c | 8 -------- 1 file changed, 8 deletions(-)
drivers/usb/serial/metro-usb.c +0 -8
@@ -171,14 +171,6 @@ static int metrousb_open(struct tty_stru metro_priv->throttled =0 ;spin_unlock_irqrestore (&metro_priv->lock, flags); -/* -* Force low_latency on so that our tty_push actually forces the data -* through, otherwise it is scheduled, and with high data rates (like -* with OHCI) data can get lost. -*/ -if (tty) - tty->low_latency =1 ; -/* Clear the urb pipe. */ usb_clear_halt (serial->dev, port->interrupt_in_urb->pipe);
Greg Kroah-Hartman
maintainerPATCH 152/187 USB: option: Add MEDIATEK product ids
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gaosen Zhang <[email protected]>
commit aacef9c561a693341566a6850c451ce3df68cb9a upstream.
--- drivers/usb/serial/option.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+)
drivers/usb/serial/option.c +20 -0
@@ -497,6 +497,15 @@ static void option_instat_callback(struc/* MediaTek products */ #define MEDIATEK_VENDOR_ID 0x0e8d +#define MEDIATEK_PRODUCT_DC_1COM 0x00a0 +#define MEDIATEK_PRODUCT_DC_4COM 0x00a5 +#define MEDIATEK_PRODUCT_DC_5COM 0x00a4 +#define MEDIATEK_PRODUCT_7208_1COM 0x7101 +#define MEDIATEK_PRODUCT_7208_2COM 0x7102 +#define MEDIATEK_PRODUCT_FP_1COM 0x0003 +#define MEDIATEK_PRODUCT_FP_2COM 0x0023 +#define MEDIATEK_PRODUCT_FPDC_1COM 0x0043 +#define MEDIATEK_PRODUCT_FPDC_2COM 0x0033/* Cellient products */ #define CELLIENT_VENDOR_ID 0x2692
@@ -1246,6 +1255,17 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, 0x00a1, 0xff, 0x02, 0x01) }, { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, 0x00a2, 0xff, 0x00, 0x00) }, { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, 0x00a2, 0xff, 0x02, 0x01) }, /* MediaTek MT6276M modem & app port */ + { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_DC_1COM, 0x0a, 0x00, 0x00) }, + { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_DC_5COM, 0xff, 0x02, 0x01) }, + { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_DC_5COM, 0xff, 0x00, 0x00) }, + { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_DC_4COM, 0xff, 0x02, 0x01) }, + { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_DC_4COM, 0xff, 0x00, 0x00) }, + { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_7208_1COM, 0x02, 0x00, 0x00) }, + { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_7208_2COM, 0x02, 0x02, 0x01) }, + { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_FP_1COM, 0x0a, 0x00, 0x00) }, + { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_FP_2COM, 0x0a, 0x00, 0x00) }, + { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_FPDC_1COM, 0x0a, 0x00, 0x00) }, + { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_FPDC_2COM, 0x0a, 0x00, 0x00) }, { USB_DEVICE(CELLIENT_VENDOR_ID, CELLIENT_PRODUCT_MEN200) }, { } /* Terminating entry */ };
Greg Kroah-Hartman
maintainerPATCH 153/187 usb: Add support for root hub port status CAS
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanislaw Ledwon <[email protected]>
commit 8bea2bd37df08aaa599aa361a9f8b836ba98e554 upstream.
The host controller port status register supports CAS (Cold Attach Status) bit. This bit could be set when USB3.0 device is connected when system is in Sx state. When the system wakes to S0 this port status with CAS bit is reported and this port can't be used by any device.
When CAS bit is set the port should be reset by warm reset. This was not supported by xhci driver.
The issue was found when pendrive was connected to suspended platform. The link state of "Compliance Mode" was reported together with CAS bit. This link state was also not supported by xhci and core/hub.c.
The CAS bit is defined only for xhci root hub port and it is not supported on regular hubs. The link status is used to force warm reset on port. Make the USB core issue a warm reset when port is in ether the 'inactive' or 'compliance mode'. Change the xHCI driver to report 'compliance mode' when the CAS is set. This force warm reset on the root hub port.
This patch should be backported to stable kernels as old as 3.2, that contain the commit 10d674a82e553cb8a1f41027bb3c3e309b3f6804 "USB: When hot reset for USB3 fails, try warm reset."
--- drivers/usb/core/hub.c | 18 ++++++++++-------- drivers/usb/host/xhci-hub.c | 44 ++++++++++++++++++++++++++++++++++++++------ drivers/usb/host/xhci.h | 6 +++++- 3 files changed, 53 insertions(+), 15 deletions(-)
drivers/usb/core/hub.c +10 -8
@@ -2102,12 +2102,16 @@ static unsigned hub_is_wusb(struct usb_hstatic int hub_port_reset (struct usb_hub *hub,int port1,struct usb_device *udev,unsigned int delay,bool warm); -/* Is a USB 3.0 port in the Inactive state? */ -static bool hub_port_inactive (struct usb_hub *hub,u16 portstatus) +/* Is a USB 3.0 port in the Inactive or Complinance Mode state? +* Port worm reset is required to recover +*/ +static bool hub_port_warm_reset_required (struct usb_hub *hub,u16 portstatus) {return hub_is_superspeed (hub->hdev) && - (portstatus &USB_PORT_STAT_LINK_STATE ) == -USB_SS_PORT_LS_SS_INACTIVE ; + (((portstatus &USB_PORT_STAT_LINK_STATE ) == +USB_SS_PORT_LS_SS_INACTIVE ) || + ((portstatus &USB_PORT_STAT_LINK_STATE ) == +USB_SS_PORT_LS_COMP_MOD )) ; } static int hub_port_wait_reset(struct usb_hub *hub, int port1,
@@ -2143,7 +2147,7 @@ static int hub_port_wait_reset(struct us* * See https://bugzilla.kernel.org/show_bug.cgi?id=41752 */ -if (hub_port_inactive (hub, portstatus)) { +if (hub_port_warm_reset_required (hub, portstatus)) {int ret;if ((portchange &USB_PORT_STAT_C_CONNECTION ))
@@ -3757,9 +3761,7 @@ static void hub_events(void)/* Warm reset a USB3 protocol port if it's in * SS.Inactive state. */ -if (hub_is_superspeed (hub->hdev) && - (portstatus &USB_PORT_STAT_LINK_STATE ) - ==USB_SS_PORT_LS_SS_INACTIVE ) { +if (hub_port_warm_reset_required (hub, portstatus)) {dev_dbg (hub_dev,"warm reset port %d\n" , i);hub_port_reset (hub, i,NULL ,HUB_BH_RESET_TIME , true);
drivers/usb/host/xhci-hub.c +38 -6
57 lines not on this page · raw message
drivers/usb/host/xhci.h +5 -1
@@ -341,7 +341,11 @@ struct xhci_op_regs {#define PORT_PLC (1 << 22)/* port configure error change - port failed to configure its link partner */ #define PORT_CEC (1 << 23) -/* bit 24 reserved */ +/* Cold Attach Status - xHC can set this bit to report device attached during +* Sx state. Warm port reset should be perfomed to clear this bit and move port +* to connected state. +*/ +#define PORT_CAS (1 << 24)/* wake on connect (enable) */ #define PORT_WKCONN_E (1 << 25)/* wake on disconnect (enable) */
Greg Kroah-Hartman
maintainerPATCH 154/187 xhci: Fix hang on back-to-back Set TR Deq Ptr commands.
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sarah Sharp <[email protected]>
commit 0d9f78a92ef5e97d9fe51d9215ebe22f6f0d289d upstream.
The Microsoft LifeChat 3000 USB headset was causing a very reproducible hang whenever it was plugged in. At first, I thought the host controller was producing bad transfer events, because the log was filled with errors like:
xhci_hcd 0000:00:14.0: ERROR Transfer event TRB DMA ptr not part of current TD
However, it turned out to be an xHCI driver bug in the ring expansion patches. The bug is triggered When there are two ring segments, and a TD that ends just before a link TRB, like so:
______________ _____________
| | ---> | setup TRB B | ______________ | _____________ | | | | data TRB B | ______________ | _____________ | setup TRB A | <-- deq | | data TRB B | ______________ | _____________ | data TRB A | | | | <-- enq, deq'' ______________ | _____________ | status TRB A | | | | ______________ | _____________ | link TRB |--------------- | link TRB | _____________ <--- deq' _____________
TD A (the first control transfer) stalls on the data phase. That halts the ring. The xHCI driver moves the hardware dequeue pointer to the first TRB after the stalled transfer, which happens to be the link TRB.
Once the Set TR dequeue pointer command completes, the function update_ring_for_set_deq_completion runs. That function is supposed to update the xHCI driver's dequeue pointer to match the internal hardware dequeue pointer. On the first call this would work fine, and the software dequeue pointer would move to deq'.
However, if the transfer immediately after that stalled (TD B in this case), another Set TR Dequeue command would be issued. That would move the hardware dequeue pointer to deq''. Once that command completed, update_ring_for_set_deq_completion would run again.
The original code would unconditionally increment the software dequeue pointer, which moved the pointer off the ring segment into la-la-land. The while loop would happy increment the dequeue pointer (possibly wrapping it) until it matched the hardware pointer value.
The while loop would also access all the memory in between the first ring segment and the second ring segment to determine if it was a link TRB. This could cause general protection faults, although it was unlikely because the ring segments came from a DMA pool, and would often have consecutive memory addresses.
If nothing in that space looked like a link TRB, the deq_seg pointer for the ring would remain on the first segment. Thus, the deq_seg and the software dequeue pointer would get out of sync.
When the next transfer event came in after the stalled transfer, the xHCI driver code would attempt to convert the software dequeue pointer into a DMA address in order to compare the DMA address for the completed transfer. Since the deq_seg and the dequeue pointer were out of sync, xhci_trb_virt_to_dma would return NULL.
The transfer event would get ignored, the transfer would eventually timeout, and we would mistakenly convert the finished transfer to no-op TRBs. Some kernel driver (maybe xHCI?) would then get stuck in an infinite loop in interrupt context, and the whole machine would hang.
This patch should be backported to kernels as old as 3.4, that contain the commit b008df60c6369ba0290fa7daa177375407a12e07 "xHCI: count free TRBs on transfer ring"
--- drivers/usb/host/xhci-ring.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/usb/host/xhci-ring.c +11 -0
@@ -885,6 +885,17 @@ static void update_ring_for_set_deq_comp num_trbs_free_temp = ep_ring->num_trbs_free; dequeue_temp = ep_ring->dequeue; +/* If we get two back-to-back stalls, and the first stalled transfer +* ends just before a link TRB, the dequeue pointer will be left on +* the link TRB by the code in the while loop. So we have to update +* the dequeue pointer one segment further, or we'll jump off +* the segment into la-la-land. +*/ +if (last_trb (xhci, ep_ring, ep_ring->deq_seg, ep_ring->dequeue)) { + ep_ring->deq_seg = ep_ring->deq_seg->next; + ep_ring->dequeue = ep_ring->deq_seg->trbs; + } +while (ep_ring->dequeue != dev->eps[ep_index].queued_deq_ptr) {/* We have more usable TRBs */ ep_ring->num_trbs_free++;
Greg Kroah-Hartman
maintainerPATCH 155/187 PCI: EHCI: fix crash during suspend on ASUS computers
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <[email protected]>
commit dbf0e4c7257f8d684ec1a3c919853464293de66e upstream.
Quite a few ASUS computers experience a nasty problem, related to the EHCI controllers, when going into system suspend. It was observed that the problem didn't occur if the controllers were not put into the D3 power state before starting the suspend, and commit 151b61284776be2d6f02d48c23c3625678960b97 (USB: EHCI: fix crash during suspend on ASUS computers) was created to do this.
It turned out this approach messed up other computers that didn't have the problem -- it prevented USB wakeup from working. Consequently commit c2fb8a3fa25513de8fedb38509b1f15a5bbee47b (USB: add NO_D3_DURING_SLEEP flag and revert 151b61284776be2) was merged; it reverted the earlier commit and added a whitelist of known good board names.
Now we know the actual cause of the problem. Thanks to AceLan Kao for tracking it down.
According to him, an engineer at ASUS explained that some of their BIOSes contain a bug that was added in an attempt to work around a problem in early versions of Windows. When the computer goes into S3 suspend, the BIOS tries to verify that the EHCI controllers were first quiesced by the OS. Nothing's wrong with this, but the BIOS does it by checking that the PCI COMMAND registers contain 0 without checking the controllers' power state. If the register isn't 0, the BIOS assumes the controller needs to be quiesced and tries to do so. This involves making various MMIO accesses to the controller, which don't work very well if the controller is already in D3. The end result is a system hang or memory corruption.
Since the value in the PCI COMMAND register doesn't matter once the controller has been suspended, and since the value will be restored anyway when the controller is resumed, we can work around the BIOS bug simply by setting the register to 0 during system suspend. This patch (as1590) does so and also reverts the second commit mentioned above, which is now unnecessary.
In theory we could do this for every PCI device. However to avoid introducing new problems, the patch restricts itself to EHCI host controllers.
Finally the affected systems can suspend with USB wakeup working properly.
Greg Kroah-Hartman
maintainerPATCH 156/187 ipheth: add support for iPad
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Davide Gerhard <[email protected]>
commit 6de0298ec9c1edaf330b71b57346241ece8f3346 upstream.
This adds support for the iPad to the ipheth driver. (product id = 0x129a)
--- drivers/net/usb/ipheth.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/usb/ipheth.c +5 -0
@@ -59,6 +59,7 @@#define USB_PRODUCT_IPHONE_3G 0x1292#define USB_PRODUCT_IPHONE_3GS 0x1294#define USB_PRODUCT_IPHONE_4 0x1297 +#define USB_PRODUCT_IPAD 0x129a#define USB_PRODUCT_IPHONE_4_VZW 0x129c#define USB_PRODUCT_IPHONE_4S 0x12a0
@@ -101,6 +102,10 @@ static struct usb_device_id ipheth_table IPHETH_USBINTF_CLASS, IPHETH_USBINTF_SUBCLASS, IPHETH_USBINTF_PROTO) }, { USB_DEVICE_AND_INTERFACE_INFO( +USB_VENDOR_APPLE ,USB_PRODUCT_IPAD , +IPHETH_USBINTF_CLASS ,IPHETH_USBINTF_SUBCLASS , + IPHETH_USBINTF_PROTO) }, + { USB_DEVICE_AND_INTERFACE_INFO(USB_VENDOR_APPLE ,USB_PRODUCT_IPHONE_4_VZW ,IPHETH_USBINTF_CLASS ,IPHETH_USBINTF_SUBCLASS , IPHETH_USBINTF_PROTO) },
Greg Kroah-Hartman
maintainerPATCH 157/187 Lockd: pass network namespace to creation and destruction routines
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanislav Kinsbursky <[email protected]>
upstream commit e3f70eadb7dddfb5a2bb9afff7abfc6ee17a29d0.
v2: dereference of most probably already released nlm_host removed in nlmclnt_done() and reclaimer().
These routines are called from locks reclaimer() kernel thread. This thread works in "init_net" network context and currently relays on persence on lockd thread and it's per-net resources. Thus lockd_up() and lockd_down() can't relay on current network context. So let's pass corrent one into them.
--- fs/lockd/clntlock.c | 13 ++++++++----- fs/lockd/svc.c | 7 +++---- fs/nfsd/nfssvc.c | 6 +++--- include/linux/lockd/bind.h | 4 ++-- 4 files changed, 16 insertions(+), 14 deletions(-)
fs/lockd/clntlock.c +8 -5
@@ -56,7 +56,7 @@ struct nlm_host *nlmclnt_init(const struu32 nlm_version = (nlm_init->nfs_version ==2 ) ?1 :4 ;int status; - status =lockd_up (); + status =lockd_up (nlm_init->net);if (status <0 )return ERR_PTR (status);
@@ -65,7 +65,7 @@ struct nlm_host *nlmclnt_init(const stru nlm_init->hostname, nlm_init->noresvport, nlm_init->net);if (host ==NULL ) { -lockd_down (); +lockd_down (nlm_init->net);return ERR_PTR (-ENOLCK ); }
@@ -80,8 +80,10 @@ EXPORT_SYMBOL_GPL(nlmclnt_init);*/ void nlmclnt_done (struct nlm_host *host) { +struct net *net = host->net; +nlmclnt_release_host (host); -lockd_down (); +lockd_down (net); }EXPORT_SYMBOL_GPL (nlmclnt_done);
@@ -220,11 +222,12 @@ reclaimer(void *ptr)struct nlm_wait *block;struct file_lock *fl, *next;u32 nsmstate; +struct net *net = host->net;allow_signal (SIGKILL );down_write (&host->h_rwsem); -lockd_up ();/* note: this cannot fail as lockd is already running */ +lockd_up (net);/* note: this cannot fail as lockd is already running */ dprintk ("lockd: reclaiming locks for host %s\n" , host->h_name);
@@ -275,6 +278,6 @@ restart:/* Release host handle after use */ nlmclnt_release_host (host); -lockd_down (); +lockd_down (net);return 0 ; }
fs/lockd/svc.c +3 -4
@@ -295,11 +295,10 @@ static void lockd_down_net(struct net *n/* * Bring up the lockd process if it's not already up. */ -int lockd_up (void ) +int lockd_up (struct net *net) {struct svc_serv *serv;int error =0 ; -struct net *net = current->nsproxy->net_ns;mutex_lock (&nlmsvc_mutex);/*
@@ -378,12 +377,12 @@ EXPORT_SYMBOL_GPL(lockd_up);* Decrement the user count and bring down lockd if we're the last. */ void -lockd_down (void ) +lockd_down (struct net *net) {mutex_lock (&nlmsvc_mutex);if (nlmsvc_users) {if (--nlmsvc_users) { -lockd_down_net (current->nsproxy->net_ns); +lockd_down_net (net); goto out; } }else {
fs/nfsd/nfssvc.c +3 -3
@@ -220,7 +220,7 @@ static int nfsd_startup(unsigned short p ret =nfsd_init_socks (port);if (ret) goto out_racache; - ret =lockd_up (); + ret =lockd_up (&init_net);if (ret) goto out_racache; ret =nfs4_state_start ();
@@ -229,7 +229,7 @@ static int nfsd_startup(unsigned short p nfsd_up = true;return 0 ; out_lockd: -lockd_down (); +lockd_down (&init_net); out_racache:nfsd_racache_shutdown ();return ret;
@@ -246,7 +246,7 @@ static void nfsd_shutdown(void)if (!nfsd_up)return ;nfs4_state_shutdown (); -lockd_down (); +lockd_down (&init_net);nfsd_racache_shutdown (); nfsd_up = false; }
include/linux/lockd/bind.h +2 -2
@@ -54,7 +54,7 @@ extern void nlmclnt_done(struct nlm_hostextern int nlmclnt_proc (struct nlm_host *host,int cmd,struct file_lock *fl); -extern int lockd_up (void ); -extern void lockd_down (void ); +extern int lockd_up (struct net *net); +extern void lockd_down (struct net *net);#endif /* LINUX_LOCKD_BIND_H */
Greg Kroah-Hartman
maintainerPATCH 158/187 SUNRPC: new svc_bind() routine introduced
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanislav Kinsbursky <[email protected]>
upstream commit 9793f7c88937e7ac07305ab1af1a519225836823.
This new routine is responsible for service registration in a specified network context.
The idea is to separate service creation from per-net operations.
Note also: since registering service with svc_bind() can fail, the service will be destroyed and during destruction it will try to unregister itself from rpcbind. In this case unregistration has to be skipped.
--- fs/lockd/svc.c | 6 ++++++ fs/nfs/callback.c | 8 ++++++++ fs/nfsd/nfssvc.c | 9 +++++++++ include/linux/sunrpc/svc.h | 1 + net/sunrpc/rpcb_clnt.c | 12 +++++++----- net/sunrpc/svc.c | 19 ++++++++++--------- 6 files changed, 41 insertions(+), 14 deletions(-)
fs/lockd/svc.c +6 -0
@@ -324,6 +324,12 @@ int lockd_up(struct net *net) goto out; } + error =svc_bind (serv, net); +if (error <0 ) { +printk (KERN_WARNING "lockd_up: bind service failed\n" ); + goto destroy_and_out; + } + error =make_socks (serv, net);if (error <0 ) goto destroy_and_out;
fs/nfs/callback.c +8 -0
@@ -17,6 +17,7 @@#include <linux/kthread.h> #include <linux/sunrpc/svcauth_gss.h> #include <linux/sunrpc/bc_xprt.h> +#include <linux/nsproxy.h> #include <net/inet_sock.h>
@@ -253,6 +254,7 @@ int nfs_callback_up(u32 minorversion, stchar svc_name[12 ];int ret =0 ;int minorversion_setup; +struct net *net = current->nsproxy->net_ns;mutex_lock (&nfs_callback_mutex);if (cb_info->users++ || cb_info->task !=NULL ) {
@@ -265,6 +267,12 @@ int nfs_callback_up(u32 minorversion, st goto out_err; } + ret =svc_bind (serv, net); +if (ret <0 ) { +printk (KERN_WARNING "NFS: bind callback service failed\n" ); + goto out_err; + } + minorversion_setup =nfs_minorversion_callback_svc_setup (minorversion, serv, xprt, &rqstp, &callback_svc);if (!minorversion_setup) {
fs/nfsd/nfssvc.c +9 -0
@@ -11,6 +11,7 @@#include <linux/module.h> #include <linux/fs_struct.h> #include <linux/swap.h> +#include <linux/nsproxy.h> #include <linux/sunrpc/stats.h> #include <linux/sunrpc/svcsock.h>
@@ -330,6 +331,8 @@ static int nfsd_get_default_max_blksize(int nfsd_create_serv (void ) { +int error; +WARN_ON (!mutex_is_locked (&nfsd_mutex));if (nfsd_serv) {svc_get (nfsd_serv);
@@ -343,6 +346,12 @@ int nfsd_create_serv(void)if (nfsd_serv ==NULL )return -ENOMEM ; + error =svc_bind (nfsd_serv, current->nsproxy->net_ns); +if (error <0 ) { +svc_destroy (nfsd_serv); +return error; + } +set_max_drc ();do_gettimeofday (&nfssvc_boot);/* record boot time */ return 0 ;
include/linux/sunrpc/svc.h +1 -0
@@ -416,6 +416,7 @@ struct svc_procedure {*/ int svc_rpcb_setup (struct svc_serv *serv,struct net *net);void svc_rpcb_cleanup (struct svc_serv *serv,struct net *net); +int svc_bind (struct svc_serv *serv,struct net *net);struct svc_serv *svc_create (struct svc_program *,unsigned int ,void (*shutdown)(struct svc_serv *,struct net *net)); struct svc_rqst *svc_prepare_thread(struct svc_serv *serv,
net/sunrpc/rpcb_clnt.c +7 -5
@@ -180,14 +180,16 @@ void rpcb_put_local(struct net *net)struct sunrpc_net *sn =net_generic (net, sunrpc_net_id);struct rpc_clnt *clnt = sn->rpcb_local_clnt;struct rpc_clnt *clnt4 = sn->rpcb_local_clnt4; -int shutdown; +int shutdown =0 ;spin_lock (&sn->rpcb_clnt_lock); -if (--sn->rpcb_users ==0 ) { - sn->rpcb_local_clnt =NULL ; - sn->rpcb_local_clnt4 =NULL ; +if (sn->rpcb_users) { +if (--sn->rpcb_users ==0 ) { + sn->rpcb_local_clnt =NULL ; + sn->rpcb_local_clnt4 =NULL ; + } + shutdown = !sn->rpcb_users; } - shutdown = !sn->rpcb_users;spin_unlock (&sn->rpcb_clnt_lock);if (shutdown) {
net/sunrpc/svc.c +10 -9
@@ -407,6 +407,14 @@ static int svc_uses_rpcbind(struct svc_sreturn 0 ; } +int svc_bind (struct svc_serv *serv,struct net *net) +{ +if (!svc_uses_rpcbind (serv)) +return 0 ; +return svc_rpcb_setup (serv, net); +} +EXPORT_SYMBOL_GPL (svc_bind); +/* * Create an RPC service */
@@ -471,15 +479,8 @@ __svc_create(struct svc_program *prog, uspin_lock_init (&pool->sp_lock); } -if (svc_uses_rpcbind (serv)) { -if (svc_rpcb_setup (serv, current->nsproxy->net_ns) <0 ) { -kfree (serv->sv_pools); -kfree (serv); -return NULL ; - } -if (!serv->sv_shutdown) - serv->sv_shutdown = svc_rpcb_cleanup; - } +if (svc_uses_rpcbind (serv) && (!serv->sv_shutdown)) + serv->sv_shutdown = svc_rpcb_cleanup;return serv; }
Greg Kroah-Hartman
maintainerPATCH 159/187 SUNRPC: move per-net operations from svc_destroy()
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanislav Kinsbursky <[email protected]>
upstream commit 786185b5f8abefa6a8a16695bb4a59c164d5a071.
The idea is to separate service destruction and per-net operations, because these are two different things and the mix looks ugly.
Notes:
1) For NFS server this patch looks ugly (sorry for that). But these place will be rewritten soon during NFSd containerization.
2) LockD per-net counter increase int lockd_up() was moved prior to make_socks() to make lockd_down_net() call safe in case of error.
--- fs/lockd/svc.c | 27 +++++++++++++++------------ fs/nfs/callback.c | 3 +++ fs/nfsd/nfsctl.c | 12 +++++++++--- fs/nfsd/nfssvc.c | 14 ++++++++++++++ net/sunrpc/svc.c | 4 ---- 5 files changed, 41 insertions(+), 19 deletions(-)
fs/lockd/svc.c +15 -12
@@ -257,7 +257,7 @@ static int lockd_up_net(struct net *net)struct svc_serv *serv = nlmsvc_rqst->rq_server;int error; -if (ln->nlmsvc_users) +if (ln->nlmsvc_users++)return 0 ; error =svc_rpcb_setup (serv, net);
@@ -272,6 +272,7 @@ static int lockd_up_net(struct net *net) err_socks:svc_rpcb_cleanup (serv, net); err_rpcb: + ln->nlmsvc_users--;return error; }
@@ -299,6 +300,7 @@ int lockd_up(struct net *net) {struct svc_serv *serv;int error =0 ; +struct lockd_net *ln =net_generic (net, lockd_net_id);mutex_lock (&nlmsvc_mutex);/*
@@ -330,9 +332,11 @@ int lockd_up(struct net *net) goto destroy_and_out; } + ln->nlmsvc_users++; + error =make_socks (serv, net);if (error <0 ) - goto destroy_and_out; + goto err_start;/* * Create the kernel thread and wait for it to start.
@@ -344,7 +348,7 @@ int lockd_up(struct net *net)printk (KERN_WARNING "lockd_up: svc_rqst allocation failed, error=%d\n" , error); - goto destroy_and_out; + goto err_start; }svc_sock_update_bufs (serv);
@@ -358,7 +362,7 @@ int lockd_up(struct net *net) nlmsvc_rqst =NULL ;printk (KERN_WARNING "lockd_up: kthread_run failed, error=%d\n" , error); - goto destroy_and_out; + goto err_start; }/*
@@ -368,14 +372,14 @@ int lockd_up(struct net *net) destroy_and_out:svc_destroy (serv); out: -if (!error) { -struct lockd_net *ln =net_generic (net, lockd_net_id); - - ln->nlmsvc_users++; +if (!error) nlmsvc_users++; - }mutex_unlock (&nlmsvc_mutex);return error; + +err_start: +lockd_down_net (net); + goto destroy_and_out; }EXPORT_SYMBOL_GPL (lockd_up);
@@ -386,11 +390,10 @@ void lockd_down(struct net *net) {mutex_lock (&nlmsvc_mutex); +lockd_down_net (net);if (nlmsvc_users) { -if (--nlmsvc_users) { -lockd_down_net (net); +if (--nlmsvc_users) goto out; - } }else {printk (KERN_ERR "lockd_down: no users! task=%p\n" , nlmsvc_task);
fs/nfs/callback.c +3 -0
@@ -314,6 +314,8 @@ out_err:dprintk ("NFS: Couldn't create callback socket or server thread; " "err = %d\n" , ret); cb_info->users--; +if (serv) +svc_shutdown_net (serv, net); goto out; }
@@ -328,6 +330,7 @@ void nfs_callback_down(int minorversion) cb_info->users--;if (cb_info->users ==0 && cb_info->task !=NULL ) {kthread_stop (cb_info->task); +svc_shutdown_net (cb_info->serv, current->nsproxy->net_ns);svc_exit_thread (cb_info->rqst); cb_info->serv =NULL ; cb_info->rqst =NULL ;
fs/nfsd/nfsctl.c +9 -3
@@ -651,6 +651,7 @@ static ssize_t __write_ports_addfd(char {char *mesg = buf;int fd, err; +struct net *net = &init_net; err =get_int (&mesg, &fd);if (err !=0 || fd <0 )
@@ -662,6 +663,8 @@ static ssize_t __write_ports_addfd(char err =svc_addsock (nfsd_serv, fd, buf,SIMPLE_TRANSACTION_LIMIT );if (err <0 ) { +if (nfsd_serv->sv_nrthreads ==1 ) +svc_shutdown_net (nfsd_serv, net);svc_destroy (nfsd_serv);return err; }
@@ -699,6 +702,7 @@ static ssize_t __write_ports_addxprt(chachar transport[16 ];struct svc_xprt *xprt;int port, err; +struct net *net = &init_net;if (sscanf (buf,"%15s %4u" , transport, &port) !=2 )return -EINVAL ;
@@ -710,12 +714,12 @@ static ssize_t __write_ports_addxprt(chaif (err !=0 )return err; - err =svc_create_xprt (nfsd_serv, transport, &init_net, + err =svc_create_xprt (nfsd_serv, transport, net,PF_INET , port,SVC_SOCK_ANONYMOUS );if (err <0 ) goto out_err; - err =svc_create_xprt (nfsd_serv, transport, &init_net, + err =svc_create_xprt (nfsd_serv, transport, net,PF_INET6 , port,SVC_SOCK_ANONYMOUS );if (err <0 && err != -EAFNOSUPPORT ) goto out_close;
@@ -724,12 +728,14 @@ static ssize_t __write_ports_addxprt(cha nfsd_serv->sv_nrthreads--;return 0 ; out_close: - xprt =svc_find_xprt (nfsd_serv, transport, &init_net,PF_INET , port); + xprt =svc_find_xprt (nfsd_serv, transport, net,PF_INET , port);if (xprt !=NULL ) {svc_close_xprt (xprt);svc_xprt_put (xprt); } out_err: +if (nfsd_serv->sv_nrthreads ==1 ) +svc_shutdown_net (nfsd_serv, net);svc_destroy (nfsd_serv);return err; }
fs/nfsd/nfssvc.c +14 -0
@@ -382,6 +382,7 @@ int nfsd_set_nrthreads(int n, int *nthreint i =0 ;int tot =0 ;int err =0 ; +struct net *net = &init_net;WARN_ON (!mutex_is_locked (&nfsd_mutex));
@@ -426,6 +427,9 @@ int nfsd_set_nrthreads(int n, int *nthreif (err)break ; } + +if (nfsd_serv->sv_nrthreads ==1 ) +svc_shutdown_net (nfsd_serv, net);svc_destroy (nfsd_serv);return err;
@@ -441,6 +445,7 @@ nfsd_svc(unsigned short port, int nrserv {int error;bool nfsd_up_before; +struct net *net = &init_net;mutex_lock (&nfsd_mutex);dprintk ("nfsd: creating service\n" );
@@ -473,6 +478,8 @@ out_shutdown:if (error <0 && !nfsd_up_before)nfsd_shutdown (); out_destroy: +if (nfsd_serv->sv_nrthreads ==1 ) +svc_shutdown_net (nfsd_serv, net);svc_destroy (nfsd_serv);/* Release server */ out:mutex_unlock (&nfsd_mutex);
@@ -556,6 +563,9 @@ nfsd(void *vrqstp) nfsdstats.th_cnt --; out: +if (rqstp->rq_server->sv_nrthreads ==1 ) +svc_shutdown_net (rqstp->rq_server, &init_net); +/* Release the thread */ svc_exit_thread (rqstp);
@@ -668,8 +678,12 @@ int nfsd_pool_stats_open(struct inode *iint nfsd_pool_stats_release (struct inode *inode,struct file *file) {int ret =seq_release (inode, file); +struct net *net = &init_net; +mutex_lock (&nfsd_mutex);/* this function really, really should have been called svc_put() */ +if (nfsd_serv->sv_nrthreads ==1 ) +svc_shutdown_net (nfsd_serv, net);svc_destroy (nfsd_serv);mutex_unlock (&nfsd_mutex);return ret;
net/sunrpc/svc.c +0 -4
@@ -537,8 +537,6 @@ EXPORT_SYMBOL_GPL(svc_shutdown_net);void svc_destroy (struct svc_serv *serv) { -struct net *net = current->nsproxy->net_ns; -dprintk ("svc: svc_destroy(%s, %d)\n" , serv->sv_program->pg_name, serv->sv_nrthreads);
@@ -553,8 +551,6 @@ svc_destroy(struct svc_serv *serv)del_timer_sync (&serv->sv_temptimer); -svc_shutdown_net (serv, net); -/* * The last user is gone and thus all sockets have to be destroyed to * the point. Check this.
Greg Kroah-Hartman
maintainerPATCH 160/187 NFS: hard-code init_net for NFS callback transports
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanislav Kinsbursky <[email protected]>
upstream commit 12918b10d59e975fd5241eef03ef9e6d5ea3dcfe.
In case of destroying mount namespace on child reaper exit, nsproxy is zeroed to the point already. So, dereferencing of it is invalid.
This patch hard-code "init_net" for all network namespace references for NFS callback services. This will be fixed with proper NFS callback containerization.
--- fs/nfs/callback.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-)
fs/nfs/callback.c +5 -6
@@ -17,7 +17,6 @@#include <linux/kthread.h> #include <linux/sunrpc/svcauth_gss.h> #include <linux/sunrpc/bc_xprt.h> -#include <linux/nsproxy.h> #include <net/inet_sock.h>
@@ -107,7 +106,7 @@ nfs4_callback_up(struct svc_serv *serv, {int ret; - ret =svc_create_xprt (serv,"tcp" , xprt->xprt_net,PF_INET , + ret =svc_create_xprt (serv,"tcp" , &init_net,PF_INET , nfs_callback_set_tcpport,SVC_SOCK_ANONYMOUS );if (ret <=0 ) goto out_err;
@@ -115,7 +114,7 @@ nfs4_callback_up(struct svc_serv *serv,dprintk ("NFS: Callback listener port = %u (af %u)\n" , nfs_callback_tcpport,PF_INET ); - ret =svc_create_xprt (serv,"tcp" , xprt->xprt_net,PF_INET6 , + ret =svc_create_xprt (serv,"tcp" , &init_net,PF_INET6 , nfs_callback_set_tcpport,SVC_SOCK_ANONYMOUS );if (ret >0 ) { nfs_callback_tcpport6 = ret;
@@ -184,7 +183,7 @@ nfs41_callback_up(struct svc_serv *serv,* fore channel connection. * Returns the input port (0) and sets the svc_serv bc_xprt on success */ - ret =svc_create_xprt (serv,"tcp-bc" , xprt->xprt_net,PF_INET ,0 , + ret =svc_create_xprt (serv,"tcp-bc" , &init_net,PF_INET ,0 ,SVC_SOCK_ANONYMOUS );if (ret <0 ) { rqstp =ERR_PTR (ret);
@@ -254,7 +253,7 @@ int nfs_callback_up(u32 minorversion, stchar svc_name[12 ];int ret =0 ;int minorversion_setup; -struct net *net = current->nsproxy->net_ns; +struct net *net = &init_net;mutex_lock (&nfs_callback_mutex);if (cb_info->users++ || cb_info->task !=NULL ) {
@@ -330,7 +329,7 @@ void nfs_callback_down(int minorversion) cb_info->users--;if (cb_info->users ==0 && cb_info->task !=NULL ) {kthread_stop (cb_info->task); -svc_shutdown_net (cb_info->serv, current->nsproxy->net_ns); +svc_shutdown_net (cb_info->serv, &init_net);svc_exit_thread (cb_info->rqst); cb_info->serv =NULL ; cb_info->rqst =NULL ;
Greg Kroah-Hartman
maintainerPATCH 161/187 mac80211: fix queues stuck issue with HT bandwidth change
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
No upstream commit, the buggy code was removed in 3.5 in commit 7213cf2cb0dfbb4d6b55a1da000d34338f76c0e3 and others.
Rajkumar changed code for handling channel switching in mac80211 to stop the queues in
commit 7cc44ed48d0ec0937c1f098642540b6c9ca38de5
Author: Rajkumar Manoharan <[email protected]>
Date: Fri Sep 16 15:32:34 2011 +0530
mac80211: Fix regression on queue stop during 2040 bss change
which went into 3.2. In the 3.4 cycle, Paul's change
commit 3117bbdb7899d43927c8ce4fe885ab7c1231c121
Author: Paul Stewart <[email protected]>
Date: Tue Mar 13 07:46:18 2012 -0700
mac80211: Don't let regulatory make us deaf
went in and changed the TX/RX enable logic, but now the conditions for stopping and restarting the queues were different so that now, if the AP changes between 20/40 MHz bandwidth, it can happen that we stop but never restart the queues. This breaks the connection and the module actually has to be reloaded to get it back to work.
Fix this by making sure the queues are always started when they were stopped.
--- net/mac80211/mlme.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
net/mac80211/mlme.c +6 -5
@@ -187,7 +187,7 @@ static u32 ieee80211_enable_ht(struct ieu32 changed =0 ;int hti_cfreq;u16 ht_opmode; -bool enable_ht = true; +bool enable_ht = true, queues_stopped = false;enum nl80211_channel_type prev_chantype;enum nl80211_channel_type rx_channel_type =NL80211_CHAN_NO_HT ;enum nl80211_channel_type tx_channel_type;
@@ -254,6 +254,7 @@ static u32 ieee80211_enable_ht(struct ie*/ ieee80211_stop_queues_by_reason (&sdata->local->hw,IEEE80211_QUEUE_STOP_REASON_CHTYPE_CHANGE ); + queues_stopped = true;/* flush out all packets */ synchronize_net ();
@@ -272,12 +273,12 @@ static u32 ieee80211_enable_ht(struct ieIEEE80211_RC_HT_CHANGED , tx_channel_type);rcu_read_unlock (); - -if (beacon_htcap_ie) -ieee80211_wake_queues_by_reason (&sdata->local->hw, -IEEE80211_QUEUE_STOP_REASON_CHTYPE_CHANGE ); } +if (queues_stopped) +ieee80211_wake_queues_by_reason (&sdata->local->hw, +IEEE80211_QUEUE_STOP_REASON_CHTYPE_CHANGE ); + ht_opmode =le16_to_cpu (hti->operation_mode);/* if bss configuration changed store the new one */
Greg Kroah-Hartman
maintainerPATCH 162/187 iwlwifi: remove log_event debugfs file debugging is disabled
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
commit 882b7b7d11d65e8eccce738f1ce97cdfdb998f9f upstream.
When debugging is disabled, the event log functions aren't functional in the way that the debugfs file expects. This leads to the debugfs access crashing. Since the event log functions aren't functional then, remove the debugfs file when CONFIG_IWLWIFI_DEBUG is not set.
--- drivers/net/wireless/iwlwifi/iwl-trans-pcie.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/net/wireless/iwlwifi/iwl-trans-pcie.c +6 -0
@@ -2000,6 +2000,7 @@ static ssize_t iwl_dbgfs_rx_queue_read(sreturn simple_read_from_buffer (user_buf, count, ppos, buf, pos); } +#ifdef CONFIG_IWLWIFI_DEBUG static ssize_t iwl_dbgfs_log_event_read (struct file *file,char __user *user_buf,size_t count,loff_t *ppos)
@@ -2037,6 +2038,7 @@ static ssize_t iwl_dbgfs_log_event_writereturn count; } +#endif static ssize_t iwl_dbgfs_interrupt_read(struct file *file, char __user *user_buf,
@@ -2164,7 +2166,9 @@ static ssize_t iwl_dbgfs_fh_reg_read(strreturn ret; } +#ifdef CONFIG_IWLWIFI_DEBUG DEBUGFS_READ_WRITE_FILE_OPS (log_event); +#endif DEBUGFS_READ_WRITE_FILE_OPS (interrupt);DEBUGFS_READ_FILE_OPS (fh_reg);DEBUGFS_READ_FILE_OPS (rx_queue);
@@ -2180,7 +2184,9 @@ static int iwl_trans_pcie_dbgfs_register {DEBUGFS_ADD_FILE (rx_queue, dir,S_IRUSR );DEBUGFS_ADD_FILE (tx_queue, dir,S_IRUSR ); +#ifdef CONFIG_IWLWIFI_DEBUG DEBUGFS_ADD_FILE (log_event, dir,S_IWUSR |S_IRUSR ); +#endif DEBUGFS_ADD_FILE (interrupt, dir,S_IWUSR |S_IRUSR );DEBUGFS_ADD_FILE (csr, dir,S_IWUSR );DEBUGFS_ADD_FILE (fh_reg, dir,S_IRUSR );
Greg Kroah-Hartman
maintainerPATCH 163/187 tracing: change CPU ring buffer state from tracing_cpumask
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vaibhav Nagarnaik <[email protected]>
commit 71babb2705e2203a64c27ede13ae3508a0d2c16c upstream.
According to Documentation/trace/ftrace.txt:
tracing_cpumask:
This is a mask that lets the user only trace on specified CPUS. The format is a hex string representing the CPUS.
The tracing_cpumask currently doesn't affect the tracing state of per-CPU ring buffers.
This patch enables/disables CPU recording as its corresponding bit in tracing_cpumask is set/unset.
Greg Kroah-Hartman
maintainerPATCH 164/187 mwifiex: fix wrong return values in add_virtual_intf() error cases
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bing Zhao <[email protected]>
commit 858faa57dd9e2b91f3f870fbb1185982e42f5a2b upstream
add_virtual_intf() needs to return an ERR_PTR(), instead of NULL, on errors, otherwise cfg80211 will crash.
--- drivers/net/wireless/mwifiex/cfg80211.c | 21 +++++++++------------ 1 file changed, 9 insertions(+), 12 deletions(-)
drivers/net/wireless/mwifiex/cfg80211.c +9 -12
@@ -1214,11 +1214,11 @@ struct net_device *mwifiex_add_virtual_ivoid *mdev_priv;if (!priv) -return NULL ; +return ERR_PTR (-EFAULT ); adapter = priv->adapter;if (!adapter) -return NULL ; +return ERR_PTR (-EFAULT );switch (type) {case NL80211_IFTYPE_UNSPECIFIED :
@@ -1227,7 +1227,7 @@ struct net_device *mwifiex_add_virtual_iif (priv->bss_mode) {wiphy_err (wiphy,"cannot create multiple" " station/adhoc interfaces\n" ); -return NULL ; +return ERR_PTR (-EINVAL ); }if (type ==NL80211_IFTYPE_UNSPECIFIED )
@@ -1244,14 +1244,15 @@ struct net_device *mwifiex_add_virtual_ibreak ;default :wiphy_err (wiphy,"type not supported\n" ); -return NULL ; +return ERR_PTR (-EINVAL ); } dev =alloc_netdev_mq (sizeof (struct mwifiex_private *), name, ether_setup,1 );if (!dev) {wiphy_err (wiphy,"no memory available for netdevice\n" ); - goto error; + priv->bss_mode =NL80211_IFTYPE_UNSPECIFIED ; +return ERR_PTR (-ENOMEM ); }dev_net_set (dev,wiphy_net (wiphy));
@@ -1276,7 +1277,9 @@ struct net_device *mwifiex_add_virtual_i/* Register network device */ if (register_netdevice (dev)) {wiphy_err (wiphy,"cannot register virtual network device\n" ); - goto error; +free_netdev (dev); + priv->bss_mode =NL80211_IFTYPE_UNSPECIFIED ; +return ERR_PTR (-EFAULT ); }sema_init (&priv->async_sem,1 );
@@ -1288,12 +1291,6 @@ struct net_device *mwifiex_add_virtual_imwifiex_dev_debugfs_init (priv);#endif return dev; -error: -if (dev && (dev->reg_state ==NETREG_UNREGISTERED )) -free_netdev (dev); - priv->bss_mode =NL80211_IFTYPE_UNSPECIFIED ; - -return NULL ; }EXPORT_SYMBOL_GPL (mwifiex_add_virtual_intf);
Greg Kroah-Hartman
maintainerPATCH 165/187 gspca-core: Fix buffers staying in queued state after a stream_off
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
commit af05ef01e9cde84620c6855a8d8ab9c8a1db9009 upstream.
[Backport to linux-stable by Antonio Ospite <[email protected]>]
This fixes a regression introduced by commit f7059ea and should be backported to all supported stable kernels which have this commit.
--- drivers/media/video/gspca/gspca.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/media/video/gspca/gspca.c +3 -1
@@ -1723,7 +1723,7 @@ static int vidioc_streamoff(struct file enum v4l2_buf_type buf_type) {struct gspca_dev *gspca_dev = priv; -int ret; +int i, ret;if (buf_type !=V4L2_BUF_TYPE_VIDEO_CAPTURE )return -EINVAL ;
@@ -1754,6 +1754,8 @@ static int vidioc_streamoff(struct filewake_up_interruptible (&gspca_dev->wq);/* empty the transfer queues */ +for (i =0 ; i < gspca_dev->nframes; i++) + gspca_dev->frame[i].v4l2_buf.flags &= ~BUF_ALL_FLAGS ;atomic_set (&gspca_dev->fr_q,0 );atomic_set (&gspca_dev->fr_i,0 ); gspca_dev->fr_o =0 ;
Greg Kroah-Hartman
maintainerPATCH 166/187 raid5: delayed stripe fix
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shaohua Li <[email protected]>
commit fab363b5ff502d1b39ddcfec04271f5858d9f26e upstream.
There isn't locking setting STRIPE_DELAYED and STRIPE_PREREAD_ACTIVE bits, but the two bits have relationship. A delayed stripe can be moved to hold list only when preread active stripe count is below IO_THRESHOLD. If a stripe has both the bits set, such stripe will be in delayed list and preread count not 0, which will make such stripe never leave delayed list.
--- drivers/md/raid5.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/md/raid5.c +3 -1
@@ -196,12 +196,14 @@ static void __release_stripe(struct r5coBUG_ON (!list_empty (&sh->lru));BUG_ON (atomic_read (&conf->active_stripes)==0 );if (test_bit (STRIPE_HANDLE , &sh->state)) { -if (test_bit (STRIPE_DELAYED , &sh->state)) +if (test_bit (STRIPE_DELAYED , &sh->state) && + !test_bit (STRIPE_PREREAD_ACTIVE , &sh->state))list_add_tail (&sh->lru, &conf->delayed_list);else if (test_bit (STRIPE_BIT_DELAY , &sh->state) && sh->bm_seq - conf->seq_write >0 )list_add_tail (&sh->lru, &conf->bitmap_list);else { +clear_bit (STRIPE_DELAYED , &sh->state);clear_bit (STRIPE_BIT_DELAY , &sh->state);list_add_tail (&sh->lru, &conf->handle_list); }
Greg Kroah-Hartman
maintainerPATCH 167/187 tg3: Apply short DMA frag workaround to 5906
In reply to Greg Kroah-HartmanFrom: Greg KH <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Carlson <[email protected]>
commit b7abee6ef888117f92db370620ebf116a38e3f4d upstream.
5906 devices also need the short DMA fragment workaround. This patch makes the necessary change.
--- drivers/net/ethernet/broadcom/tg3.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/broadcom/tg3.c +2 -1
@@ -14248,7 +14248,8 @@ static int __devinit tg3_get_invariants( } } - if (tg3_flag(tp, 5755_PLUS)) + if (tg3_flag(tp, 5755_PLUS) || +GET_ASIC_REV (tp->pci_chip_rev_id) ==ASIC_REV_5906 )tg3_flag_set (tp,SHORT_DMA_BUG );if (GET_ASIC_REV (tp->pci_chip_rev_id) ==ASIC_REV_5719 )