3.10.56-stable review
Subsystems (2)
Greg Kroah-Hartman
maintainercover 3.10.56-stable review
This is the start of the stable review cycle for the 3.10.56 release. There are 143 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun Oct 5 21:32:57 UTC 2014. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v3.0/stable-review/patch-3.10.56-rc1.gz
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 3.10.56-rc1
Oleg Nesterov <[email protected]>
vm_is_stack: use for_each_thread() rather then buggy while_each_thread()
Oleg Nesterov <[email protected]>
oom_kill: add rcu_read_lock() into find_lock_task_mm()
Oleg Nesterov <[email protected]>
oom_kill: has_intersects_mems_allowed() needs rcu_read_lock()
Oleg Nesterov <[email protected]>
oom_kill: change oom_kill.c to use for_each_thread()
Oleg Nesterov <[email protected]>
introduce for_each_thread() to replace the buggy while_each_thread()
Oleg Nesterov <[email protected]>
kernel/fork.c:copy_process(): unify CLONE_THREAD-or-thread_group_leader code
Soren Brinkmann <[email protected]>
arm: multi_v7_defconfig: Enable Zynq UART driver
Jan Kara <[email protected]>
ext2: Fix fs corruption in ext2_get_xip_mem()
Heikki Krogerus <[email protected]>
serial: 8250_dma: check the result of TX buffer mapping
Will Deacon <[email protected]>
ARM: 7748/1: oabi: handle faults when loading swi instruction from userspace
Florian Westphal <[email protected]>
netfilter: nf_conntrack: avoid large timeout for mid-stream pickup
Rafael J. Wysocki <[email protected]>
PM / sleep: Use valid_state() for platform-dependent sleep states only
Rafael J. Wysocki <[email protected]>
PM / sleep: Add state field to pm_states[] entries
Julian Anastasov <[email protected]>
ipvs: fix ipv6 hook registration for local replies
Alex Gartrell <[email protected]>
ipvs: Maintain all DSCP and ECN bits for ipv6 tun forwarding
Julian Anastasov <[email protected]>
ipvs: avoid netns exit crash on ip_vs_conn_drop_conntrack
NeilBrown <[email protected]>
md/raid1: fix_read_error should act on all non-faulty devices.
Hans Verkuil <[email protected]>
media: cx18: fix kernel oops with tda8290 tuner
Anton Altaparmakov <[email protected]>
Fix nasty 32-bit overflow bug in buffer i/o code.
Jiri Olsa <[email protected]>
perf kmem: Make it work again on non NUMA machines
Cong Wang <[email protected]>
perf: Fix a race condition in perf_remove_from_context()
Richard Larocque <[email protected]>
alarmtimer: Lock k_itimer during timer callback
Richard Larocque <[email protected]>
alarmtimer: Do not signal SIGEV_NONE timers
John David Anglin <[email protected]>
parisc: Only use -mfast-indirect-calls option for 32-bit kernel builds
Anton Blanchard <[email protected]>
powerpc/perf: Fix ABIv2 kernel backtraces
Wanpeng Li <[email protected]>
sched: Fix unreleased llc_shared_mask bit during CPU hotplug
Joseph Qi <[email protected]>
ocfs2/dlm: do not get resource spinlock if lockres is new
Andreas Rohner <[email protected]>
nilfs2: fix data loss with mmap()
Andrey Vagin <[email protected]>
fs/notify: don't show f_handle if exportfs_encode_inode_fh failed
Andrey Vagin <[email protected]>
fsnotify/fdinfo: use named constants instead of hardcoded values
Rasmus Villemoes <[email protected]>
kcmp: fix standard comparison bug
Johannes Berg <[email protected]>
Revert "mac80211: disable uAPSD if all ACs are under ACM"
Felipe Balbi <[email protected]>
usb: dwc3: core: fix ordering for PHY suspend
Felipe Balbi <[email protected]>
usb: dwc3: core: fix order of PM runtime calls
Felipe Balbi <[email protected]>
usb: host: xhci: fix compliance mode workaround
Jens Axboe <[email protected]>
genhd: fix leftover might_sleep() in blk_free_devt()
J. Bruce Fields <[email protected]>
lockd: fix rpcbind crash on lockd startup failure
Larry Finger <[email protected]>
rtlwifi: rtl8192cu: Add new ID
Tejun Heo <[email protected]>
percpu: perform tlb flush after pcpu_map_pages() failure
Tejun Heo <[email protected]>
percpu: fix pcpu_alloc_pages() failure path
Honggang Li <[email protected]>
percpu: free percpu allocation info for uniprocessor system
James Ralston <[email protected]>
ata_piix: Add Device IDs for Intel 9 Series PCH
Hans de Goede <[email protected]>
Input: i8042 - add nomux quirk for Avatar AVIU-145A6
Hans de Goede <[email protected]>
Input: i8042 - add Fujitsu U574 to no_timeout dmi table
Dmitry Torokhov <[email protected]>
Input: atkbd - do not try 'deactivate' keyboard on any LG laptops
Hans de Goede <[email protected]>
Input: elantech - fix detection of touchpad on ASUS s301l
Dmitry Torokhov <[email protected]>
Input: synaptics - add support for ForcePads
John Sung <[email protected]>
Input: serport - add compat handling for SPIOCSTYPE ioctl
Mikulas Patocka <[email protected]>
dm crypt: fix access beyond the end of allocated space
Keith Busch <[email protected]>
block: Fix dev_t minor allocation lifetime
Tejun Heo <[email protected]>
workqueue: apply __WQ_ORDERED to create_singlethread_workqueue()
Emmanuel Grumbach <[email protected]>
Revert "iwlwifi: dvm: don't enable CTS to self"
Mike Christie <[email protected]>
SCSI: libiscsi: fix potential buffer overrun in __iscsi_conn_send_pdu
Dan Carpenter <[email protected]>
NFC: microread: Potential overflows in microread_target_discovered()
Nicholas Bellinger <[email protected]>
iscsi-target: Fix memory corruption in iscsit_logout_post_handler_diffcid
Joern Engel <[email protected]>
iscsi-target: avoid NULL pointer in iscsi_copy_param_list failure
Sagi Grimberg <[email protected]>
Target/iser: Don't put isert_conn inside disconnected handler
Sagi Grimberg <[email protected]>
Target/iser: Get isert_conn reference once got to connected_handler
Johannes Pointner <[email protected]>
iio:inkern: fix overwritten -EPROBE_DEFER in of_iio_channel_get_by_name
Denis CIOCCA <[email protected]>
iio:magnetometer: bugfix magnetometers gain values
Srinivas Pandruvada <[email protected]>
iio: adc: ad_sigma_delta: Fix indio_dev->trig assignment
Srinivas Pandruvada <[email protected]>
iio: st_sensors: Fix indio_dev->trig assignment
Srinivas Pandruvada <[email protected]>
iio: meter: ade7758: Fix indio_dev->trig assignment
Srinivas Pandruvada <[email protected]>
iio: inv_mpu6050: Fix indio_dev->trig assignment
Srinivas Pandruvada <[email protected]>
iio: gyro: itg3200: Fix indio_dev->trig assignment
Srinivas Pandruvada <[email protected]>
iio:trigger: modify return value for iio_trigger_get
Pavel Shilovsky <[email protected]>
CIFS: Fix SMB2 readdir error handling
Pavel Shilovsky <[email protected]>
CIFS: Fix directory rename error
Peter Ujfalusi <[email protected]>
ASoC: davinci-mcasp: Correct rx format unit configuration
Miklos Szeredi <[email protected]>
shmem: fix nlink for rename overwrite directory
Dave Young <[email protected]>
x86 early_ioremap: Increase FIX_BTMAPS_SLOTS to 8
Marcelo Tosatti <[email protected]>
KVM: x86: handle idiv overflow at kvm_write_tsc
Mark Brown <[email protected]>
regmap: Fix handling of volatile registers for format_write() chips
Bob Moore <[email protected]>
ACPICA: Update to GPIO region handler interface.
Markos Chandras <[email protected]>
MIPS: mcount: Adjust stack pointer for static trace in MIPS32
Aurelien Jarno <[email protected]>
MIPS: ZBOOT: add missing <linux/string.h> include
Robin Murphy <[email protected]>
ARM: 8165/1: alignment: don't break misaligned NEON load/store
Dave Martin <[email protected]>
ARM: 7897/1: kexec: Use the right ISA for relocate_new_kernel
Sudeep Holla <[email protected]>
ARM: 8133/1: use irq_set_affinity with force=false when migrating irqs
Mark Rutland <[email protected]>
ARM: 8128/1: abort: don't clear the exclusive monitors
Trond Myklebust <[email protected]>
NFSv4: Fix another bug in the close/open_downgrade code
Steve Dickson <[email protected]>
NFSv4: nfs4_state_manager() vs. nfs_server_remove_lists()
Shen Guang <[email protected]>
usb:hub set hub->change_bits when over-current happens
Felipe Balbi <[email protected]>
usb: dwc3: omap: fix ordering for runtime pm calls
Alan Stern <[email protected]>
USB: EHCI: unlink QHs even after the controller has stopped
Mark <[email protected]>
USB: storage: Add quirks for Entrega/Xircom USB to SCSI converters
Mark <[email protected]>
USB: storage: Add quirk for Ariston Technologies iConnect USB to SCSI adapter
Mark <[email protected]>
USB: storage: Add quirk for Adaptec USBConnect 2000 USB-to-SCSI Adapter
Mark <[email protected]>
storage: Add single-LUN quirk for Jaz USB Adapter
Joe Lawrence <[email protected]>
usb: hub: take hub->hdev reference when processing from eventlist
Mathias Nyman <[email protected]>
xhci: fix oops when xhci resumes from hibernate with hw lpm capable devices
Mathias Nyman <[email protected]>
xhci: Fix null pointer dereference if xhci initialization fails
Johan Hovold <[email protected]>
USB: zte_ev: fix removed PIDs
Johan Hovold <[email protected]>
USB: ftdi_sio: add support for NOVITUS Bono E thermal printer
Bjørn Mork <[email protected]>
USB: sierra: add 1199:68AA device ID
Bjørn Mork <[email protected]>
USB: sierra: avoid CDC class functions on "68A3" devices
Johan Hovold <[email protected]>
USB: zte_ev: remove duplicate Qualcom PID
Johan Hovold <[email protected]>
USB: zte_ev: remove duplicate Gobi PID
Johan Hovold <[email protected]>
Revert "USB: option,zte_ev: move most ZTE CDMA devices to zte_ev"
Brennan Ashton <[email protected]>
USB: option: add VIA Telecom CDS7 chipset device id
Johan Hovold <[email protected]>
USB: option: reduce interrupt-urb logging verbosity
Johan Hovold <[email protected]>
USB: serial: fix potential heap buffer overflow
Stephen Hemminger <[email protected]>
USB: sisusb: add device id for Magic Control USB video
Johan Hovold <[email protected]>
USB: serial: fix potential stack buffer overflow
Greg KH <[email protected]>
USB: serial: pl2303: add device id for ztek device
Max Filippov <[email protected]>
xtensa: fix a6 and a7 handling in fast_syscall_xtensa
Max Filippov <[email protected]>
xtensa: fix TLBTEMP_BASE_2 region handling in fast_second_level_miss
Max Filippov <[email protected]>
xtensa: fix access to THREAD_RA/THREAD_SP/THREAD_DS
Alan Douglas <[email protected]>
xtensa: fix address checks in dma_{alloc,free}_coherent
Max Filippov <[email protected]>
xtensa: replace IOCTL code definitions with constants
Alex Deucher <[email protected]>
drm/radeon: add connector quirk for fujitsu board
Thomas Hellstrom <[email protected]>
drm/vmwgfx: Fix a potential infinite spin waiting for fifo idle
Y.C. Chen <[email protected]>
drm/ast: AST2000 cannot be detected correctly
Ville Syrjälä <[email protected]>
drm/i915: Wait for vblank before enabling the TV encoder
Mathias Krause <[email protected]>
drm/i915: Remove bogus __init annotation from DMI callbacks
Benjamin Tissoires <[email protected]>
HID: logitech-dj: prevent false errors to be shown
Jiri Kosina <[email protected]>
HID: magicmouse: sanity check report size in raw_event() callback
Jiri Kosina <[email protected]>
HID: picolcd: sanity check report size in raw_event() callback
Toshiaki Makita <[email protected]>
cfq-iosched: Fix wrong children_weight calculation
Clemens Ladisch <[email protected]>
ALSA: pcm: fix fifo_size frame calculation
Takashi Iwai <[email protected]>
ALSA: hda - Fix invalid pin powermap without jack detection
Takashi Iwai <[email protected]>
ALSA: hda - Fix COEF setups for ALC1150 codec
Clemens Ladisch <[email protected]>
ALSA: core: fix buffer overflow in snd_info_get_line()
Will Deacon <[email protected]>
arm64: ptrace: fix compat hardware watchpoint reporting
Josef Bacik <[email protected]>
trace: Fix epoll hang when we race with new entries
Simon Lindgren <[email protected]>
i2c: at91: Fix a race condition during signal handling in at91_do_twi_xfer.
Marek Roszko <[email protected]>
i2c: at91: add bound checking on SMBus block length bytes
Will Deacon <[email protected]>
arm64: flush TLS registers during exec
Anton Blanchard <[email protected]>
ibmveth: Fix endian issues with rx_no_buffer statistic
Murali Karicheri <[email protected]>
ahci: add pcid for Marvel 0x9182 controller
James Ralston <[email protected]>
ahci: Add Device IDs for Intel 9 Series PCH
Arjun Sreedharan <[email protected]>
pata_scc: propagate return value of scc_wait_after_reset
Jiri Kosina <[email protected]>
drm/i915: read HEAD register back in init_ring_common() to enforce ordering
Alex Deucher <[email protected]>
drm/radeon: load the lm63 driver for an lm64 thermal chip.
Tetsuo Handa <[email protected]>
drm/ttm: Choose a pool to shrink correctly in ttm_dma_pool_shrink_scan().
Tetsuo Handa <[email protected]>
drm/ttm: Fix possible division by 0 in ttm_dma_pool_shrink_scan().
Guido Martínez <[email protected]>
drm/tilcdc: fix double kfree
Guido Martínez <[email protected]>
drm/tilcdc: fix release order on exit
Guido Martínez <[email protected]>
drm/tilcdc: panel: fix leak when unloading the module
Guido Martínez <[email protected]>
drm/tilcdc: tfp410: fix dangling sysfs connector node
Guido Martínez <[email protected]>
drm/tilcdc: slave: fix dangling sysfs connector node
Guido Martínez <[email protected]>
drm/tilcdc: panel: fix dangling sysfs connector node
Ronald Wahl <[email protected]>
carl9170: fix sending URBs with wrong type when using full-speed
-------------
Diffstat:
Makefile | 4 +- arch/arm/configs/multi_v7_defconfig | 2 + arch/arm/kernel/entry-common.S | 42 ++++++++----- arch/arm/kernel/irq.c | 2 +- arch/arm/kernel/machine_kexec.c | 17 +++--- arch/arm/kernel/relocate_kernel.S | 8 ++- arch/arm/mm/abort-ev6.S | 6 -- arch/arm/mm/abort-ev7.S | 6 -- arch/arm/mm/alignment.c | 3 + arch/arm64/include/asm/hw_breakpoint.h | 1 - arch/arm64/kernel/process.c | 18 ++++++ arch/arm64/kernel/ptrace.c | 3 +- arch/arm64/kernel/sys_compat.c | 6 ++ arch/mips/boot/compressed/decompress.c | 1 + arch/mips/kernel/mcount.S | 12 ++++ arch/parisc/Makefile | 7 ++- arch/powerpc/include/asm/ptrace.h | 7 +++ arch/powerpc/perf/callchain.c | 2 +- arch/x86/include/asm/fixmap.h | 6 +- arch/x86/kernel/smpboot.c | 3 + arch/x86/kvm/x86.c | 23 +++++++- arch/xtensa/include/asm/pgtable.h | 7 ++- arch/xtensa/include/asm/uaccess.h | 5 ++ arch/xtensa/include/uapi/asm/ioctls.h | 19 +++--- arch/xtensa/kernel/entry.S | 26 +++++---- arch/xtensa/kernel/pci-dma.c | 12 ++-- block/cfq-iosched.c | 11 +++- block/genhd.c | 26 +++++---- block/partition-generic.c | 2 +- drivers/acpi/acpica/aclocal.h | 1 + drivers/acpi/acpica/acobject.h | 1 + drivers/acpi/acpica/dsfield.c | 2 + drivers/acpi/acpica/evregion.c | 47 ++++++++++----- drivers/acpi/acpica/exfield.c | 67 +++++++++++++++++++++ drivers/acpi/acpica/exprep.c | 2 + drivers/ata/ahci.c | 10 ++++ drivers/ata/ata_piix.c | 8 +++ drivers/ata/pata_scc.c | 15 +++-- drivers/base/regmap/regmap.c | 2 +- drivers/gpu/drm/ast/ast_main.c | 2 +- drivers/gpu/drm/i915/intel_bios.c | 2 +- drivers/gpu/drm/i915/intel_crt.c | 2 +- drivers/gpu/drm/i915/intel_lvds.c | 2 +- drivers/gpu/drm/i915/intel_ringbuffer.c | 3 + drivers/gpu/drm/i915/intel_tv.c | 4 ++ drivers/gpu/drm/radeon/radeon_atombios.c | 11 +++- drivers/gpu/drm/tilcdc/tilcdc_drv.c | 7 ++- drivers/gpu/drm/tilcdc/tilcdc_panel.c | 5 +- drivers/gpu/drm/tilcdc/tilcdc_slave.c | 1 + drivers/gpu/drm/tilcdc/tilcdc_tfp410.c | 1 + drivers/gpu/drm/ttm/ttm_page_alloc_dma.c | 9 ++- drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c | 3 +- drivers/hid/hid-logitech-dj.c | 43 ++++++++------ drivers/hid/hid-logitech-dj.h | 1 + drivers/hid/hid-magicmouse.c | 10 ++++ drivers/hid/hid-picolcd_core.c | 6 ++ drivers/i2c/busses/i2c-at91.c | 32 ++++++++-- drivers/iio/adc/ad_sigma_delta.c | 2 +- drivers/iio/common/st_sensors/st_sensors_trigger.c | 2 +- drivers/iio/gyro/itg3200_buffer.c | 2 +- drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c | 2 +- drivers/iio/inkern.c | 2 +- drivers/iio/magnetometer/st_magn_core.c | 52 ++++++++++------- drivers/infiniband/ulp/isert/ib_isert.c | 7 ++- drivers/input/keyboard/atkbd.c | 8 --- drivers/input/mouse/elantech.c | 7 +++ drivers/input/mouse/synaptics.c | 68 +++++++++++++++++----- drivers/input/mouse/synaptics.h | 11 ++++ drivers/input/serio/i8042-x86ia64io.h | 15 +++++ drivers/input/serio/serport.c | 45 +++++++++++--- drivers/md/dm-crypt.c | 20 +++++-- drivers/md/raid1.c | 4 +- drivers/media/pci/cx18/cx18-driver.c | 1 + drivers/net/ethernet/ibm/ibmveth.c | 18 ++++-- drivers/net/wireless/ath/carl9170/carl9170.h | 1 + drivers/net/wireless/ath/carl9170/usb.c | 31 ++++++++-- drivers/net/wireless/iwlwifi/dvm/rxon.c | 12 ++++ drivers/net/wireless/rtlwifi/rtl8192cu/sw.c | 1 + drivers/nfc/microread/microread.c | 16 +++-- drivers/scsi/libiscsi.c | 10 ++++ drivers/staging/iio/meter/ade7758_trigger.c | 2 +- drivers/target/iscsi/iscsi_target.c | 4 +- drivers/target/iscsi/iscsi_target_parameters.c | 2 +- drivers/tty/serial/8250/8250_dma.c | 17 ++++-- drivers/usb/core/hub.c | 7 ++- drivers/usb/dwc3/core.c | 13 +++-- drivers/usb/dwc3/dwc3-omap.c | 2 +- drivers/usb/host/ehci-hcd.c | 2 - drivers/usb/host/xhci-hub.c | 8 ++- drivers/usb/host/xhci-mem.c | 2 +- drivers/usb/host/xhci.c | 12 +++- drivers/usb/misc/sisusbvga/sisusb.c | 1 + drivers/usb/serial/ftdi_sio.c | 1 + drivers/usb/serial/ftdi_sio_ids.h | 6 ++ drivers/usb/serial/option.c | 31 +++++++++- drivers/usb/serial/pl2303.c | 1 + drivers/usb/serial/pl2303.h | 1 + drivers/usb/serial/sierra.c | 9 ++- drivers/usb/serial/usb-serial.c | 37 ++++++++---- drivers/usb/serial/zte_ev.c | 24 ++------ drivers/usb/storage/unusual_devs.h | 38 ++++++++++++ fs/buffer.c | 6 +- fs/cifs/cifsglob.h | 2 + fs/cifs/file.c | 2 +- fs/cifs/inode.c | 5 +- fs/cifs/readdir.c | 2 +- fs/cifs/smb1ops.c | 7 +++ fs/cifs/smb2maperror.c | 2 +- fs/cifs/smb2ops.c | 8 +++ fs/cifs/smb2pdu.c | 9 ++- fs/ext2/inode.c | 2 + fs/ext2/xip.c | 1 + fs/lockd/svc.c | 4 +- fs/nfs/nfs4client.c | 38 ++++++------ fs/nfs/nfs4proc.c | 30 +++++----- fs/nilfs2/inode.c | 7 ++- fs/notify/fdinfo.c | 4 +- fs/ocfs2/dlm/dlmmaster.c | 18 +++--- include/linux/iio/trigger.h | 4 +- include/linux/init_task.h | 2 + include/linux/sched.h | 12 ++++ include/linux/workqueue.h | 2 +- kernel/events/core.c | 10 ++++ kernel/exit.c | 1 + kernel/fork.c | 22 ++++--- kernel/kcmp.c | 7 ++- kernel/power/main.c | 21 +++---- kernel/power/power.h | 9 ++- kernel/power/suspend.c | 66 ++++++++++----------- kernel/power/suspend_test.c | 24 ++++---- kernel/time/alarmtimer.c | 16 +++-- kernel/trace/ring_buffer.c | 16 ++++- mm/oom_kill.c | 51 +++++++++------- mm/percpu-vm.c | 22 +++++-- mm/percpu.c | 2 + mm/shmem.c | 4 +- mm/util.c | 9 +-- net/mac80211/mlme.c | 3 +- net/netfilter/ipvs/ip_vs_conn.c | 1 - net/netfilter/ipvs/ip_vs_core.c | 2 +- net/netfilter/ipvs/ip_vs_xmit.c | 2 +- net/netfilter/nf_conntrack_proto_tcp.c | 6 ++ sound/core/info.c | 4 +- sound/core/pcm_lib.c | 8 ++- sound/pci/hda/patch_realtek.c | 2 + sound/pci/hda/patch_sigmatel.c | 17 ++++-- sound/soc/davinci/davinci-mcasp.c | 11 +++- tools/perf/builtin-kmem.c | 2 +- 148 files changed, 1168 insertions(+), 480 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/143 carl9170: fix sending URBs with wrong type when using full-speed
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ronald Wahl <[email protected]>
commit 671796dd96b6cd85b75fba9d3007bcf7e5f7c309 upstream.
The driver assumes that endpoint 4 is always an interrupt endpoint. Unfortunately the type differs between high-speed and full-speed configurations while in the former case it is indeed an interrupt endpoint this is not true for the latter case - here it is a bulk endpoint. When sending URBs with the wrong type the kernel will generate a warning message including backtrace. In this specific case there will be a huge amount of warnings which can bring the system to freeze.
To fix this we are now sending URBs to endpoint 4 using the type found in the endpoint descriptor.
A side note: The carl9170 firmware currently specifies endpoint 4 as interrupt endpoint even in the full-speed configuration but this has no relevance because before this firmware is loaded the endpoint type is as described above and after the firmware is running the stick is not reenumerated and so the old descriptor is used.
--- drivers/net/wireless/ath/carl9170/carl9170.h | 1 drivers/net/wireless/ath/carl9170/usb.c | 31 +++++++++++++++++++++++---- 2 files changed, 28 insertions(+), 4 deletions(-)
drivers/net/wireless/ath/carl9170/carl9170.h +1 -0
@@ -253,6 +253,7 @@ struct ar9170 {atomic_t rx_work_urbs;atomic_t rx_pool_urbs;kernel_ulong_t features; +bool usb_ep_cmd_is_bulk;/* firmware settings */ struct completion fw_load_wait;
drivers/net/wireless/ath/carl9170/usb.c +27 -4
@@ -621,9 +621,16 @@ int __carl9170_exec_cmd(struct ar9170 *a goto err_free; } -usb_fill_int_urb (urb, ar->udev,usb_sndintpipe (ar->udev, -AR9170_USB_EP_CMD ), cmd, cmd->hdr.len +4 , - carl9170_usb_cmd_complete, ar,1 ); +if (ar->usb_ep_cmd_is_bulk) +usb_fill_bulk_urb (urb, ar->udev, +usb_sndbulkpipe (ar->udev,AR9170_USB_EP_CMD ), + cmd, cmd->hdr.len +4 , + carl9170_usb_cmd_complete, ar); +else +usb_fill_int_urb (urb, ar->udev, +usb_sndintpipe (ar->udev,AR9170_USB_EP_CMD ), + cmd, cmd->hdr.len +4 , + carl9170_usb_cmd_complete, ar,1 );if (free_buf) urb->transfer_flags |=URB_FREE_BUFFER ;
@@ -1032,9 +1039,10 @@ static void carl9170_usb_firmware_step2(static int carl9170_usb_probe (struct usb_interface *intf,const struct usb_device_id *id) { +struct usb_endpoint_descriptor *ep;struct ar9170 *ar;struct usb_device *udev; -int err; +int i, err; err =usb_reset_device (interface_to_usbdev (intf));if (err)
@@ -1050,6 +1058,21 @@ static int carl9170_usb_probe(struct usb ar->intf = intf; ar->features = id->driver_info; +/* We need to remember the type of endpoint 4 because it differs +* between high- and full-speed configuration. The high-speed +* configuration specifies it as interrupt and the full-speed +* configuration as bulk endpoint. This information is required +* later when sending urbs to that endpoint. +*/ +for (i =0 ; i < intf->cur_altsetting->desc.bNumEndpoints; ++i) { + ep = &intf->cur_altsetting->endpoint[i].desc; + +if (usb_endpoint_num (ep) ==AR9170_USB_EP_CMD && +usb_endpoint_dir_out (ep) && +usb_endpoint_type (ep) ==USB_ENDPOINT_XFER_BULK ) + ar->usb_ep_cmd_is_bulk = true; + } +usb_set_intfdata (intf, ar);SET_IEEE80211_DEV (ar->hw, &intf->dev);
Greg Kroah-Hartman
maintainerPATCH 8/143 drm/ttm: Fix possible division by 0 in ttm_dma_pool_shrink_scan().
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <[email protected]>
commit 11e504cc705e8ccb06ac93a276e11b5e8fee4d40 upstream.
list_empty(&_manager->pools) being false before taking _manager->lock does not guarantee that _manager->npools != 0 after taking _manager->lock because _manager->npools is updated under _manager->lock.
--- drivers/gpu/drm/ttm/ttm_page_alloc_dma.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/ttm/ttm_page_alloc_dma.c +3 -0
@@ -1016,6 +1016,8 @@ static int ttm_dma_pool_mm_shrink(structreturn 0 ;mutex_lock (&_manager->lock); +if (!_manager->npools) + goto out; pool_offset = pool_offset % _manager->npools;list_for_each_entry (p, &_manager->pools, pools) {unsigned nr_free;
@@ -1033,6 +1035,7 @@ static int ttm_dma_pool_mm_shrink(struct p->pool->dev_name, p->pool->name, current->pid, nr_free, shrink_pages); } +out:mutex_unlock (&_manager->lock);/* return estimated number of unused pages in pool */ return ttm_dma_pool_get_num_unused_pages ();
Greg Kroah-Hartman
maintainerPATCH 9/143 drm/ttm: Choose a pool to shrink correctly in ttm_dma_pool_shrink_scan().
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <[email protected]>
commit 46c2df68f03a236b30808bba361f10900c88d95e upstream.
We can use "unsigned int" instead of "atomic_t" by updating start_pool variable under _manager->lock. This patch will make it possible to avoid skipping when choosing a pool to shrink in round-robin style, after next patch changes mutex_lock(_manager->lock) to !mutex_trylock(_manager->lork).
--- drivers/gpu/drm/ttm/ttm_page_alloc_dma.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/ttm/ttm_page_alloc_dma.c +3 -3
@@ -1006,9 +1006,9 @@ EXPORT_SYMBOL_GPL(ttm_dma_unpopulate);static int ttm_dma_pool_mm_shrink (struct shrinker *shrink,struct shrink_control *sc) { -static atomic_t start_pool =ATOMIC_INIT (0 ); +static unsigned start_pool;unsigned idx =0 ; -unsigned pool_offset =atomic_add_return (1 , &start_pool); +unsigned pool_offset;unsigned shrink_pages = sc->nr_to_scan;struct device_pools *p;
@@ -1018,7 +1018,7 @@ static int ttm_dma_pool_mm_shrink(structmutex_lock (&_manager->lock);if (!_manager->npools) goto out; - pool_offset = pool_offset % _manager->npools; + pool_offset = ++start_pool % _manager->npools;list_for_each_entry (p, &_manager->pools, pools) {unsigned nr_free;
Greg Kroah-Hartman
maintainerPATCH 10/143 drm/radeon: load the lm63 driver for an lm64 thermal chip.
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit 5dc355325b648dc9b4cf3bea4d968de46fd59215 upstream.
Looks like the lm63 driver supports the lm64 as well.
--- drivers/gpu/drm/radeon/radeon_atombios.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/radeon/radeon_atombios.c +2 -2
@@ -1908,7 +1908,7 @@ static const char *thermal_controller_na"adm1032" ,"adm1030" ,"max6649" , -"lm64" , +"lm63" ,/* lm64 */ "f75375" , "asc7xxx", };
@@ -1919,7 +1919,7 @@ static const char *pp_lib_thermal_contro"adm1032" ,"adm1030" ,"max6649" , -"lm64" , +"lm63" ,/* lm64 */ "f75375" ,"RV6xx" , "RV770",
Greg Kroah-Hartman
maintainerPATCH 11/143 drm/i915: read HEAD register back in init_ring_common() to enforce ordering
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Kosina <[email protected]>
commit ece4a17d237a79f63fbfaf3f724a12b6d500555c upstream.
Withtout this, ring initialization fails reliabily during resume with
[drm:init_ring_common] *ERROR* render ring initialization failed ctl 0001f001 head ffffff8804 tail 00000000 start 000e4000
This is not a complete fix, but it is verified to make the ring initialization failures during resume much less likely.
We were not able to root-cause this bug (likely HW-specific to Gen4 chips) yet. This is therefore used as a ducttape before problem is fully understood and proper fix created, so that people don't suffer from completely unusable systems in the meantime.
The discussion and debugging is happening at
https://bugs.freedesktop.org/show_bug.cgi?id=76554
--- drivers/gpu/drm/i915/intel_ringbuffer.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/i915/intel_ringbuffer.c +3 -0
@@ -396,6 +396,9 @@ static int init_ring_common(struct intel } } +/* Enforce ordering by reading HEAD register back */ +I915_READ_HEAD (ring); +/* Initialize the ring. This must happen _after_ we've cleared the ring * registers with the above sequence (the readback of the HEAD registers * also enforces ordering), otherwise the hw might lose the new ring
Greg Kroah-Hartman
maintainerPATCH 12/143 pata_scc: propagate return value of scc_wait_after_reset
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arjun Sreedharan <[email protected]>
commit 4dc7c76cd500fa78c64adfda4b070b870a2b993c upstream.
scc_bus_softreset not necessarily should return zero. Propagate the error code.
--- drivers/ata/pata_scc.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-)
drivers/ata/pata_scc.c +7 -8
@@ -586,7 +586,7 @@ static int scc_wait_after_reset(struct a* Note: Original code is ata_bus_softreset(). */ -static unsigned int scc_bus_softreset (struct ata_port *ap,unsigned int devmask, +static int scc_bus_softreset (struct ata_port *ap,unsigned int devmask,unsigned long deadline) {struct ata_ioports *ioaddr = &ap->ioaddr;
@@ -600,9 +600,7 @@ static unsigned int scc_bus_softreset(studelay (20 );out_be32 (ioaddr->ctl_addr, ap->ctl); -scc_wait_after_reset (&ap->link, devmask, deadline); - -return 0 ; +return scc_wait_after_reset (&ap->link, devmask, deadline); }/**
@@ -619,7 +617,8 @@ static int scc_softreset(struct ata_link {struct ata_port *ap = link->ap;unsigned int slave_possible = ap->flags &ATA_FLAG_SLAVE_POSS ; -unsigned int devmask =0 , err_mask; +unsigned int devmask =0 ; +int rc;u8 err;DPRINTK ("ENTER\n" );
@@ -635,9 +634,9 @@ static int scc_softreset(struct ata_link/* issue bus reset */ DPRINTK ("about to softreset, devmask=%x\n" , devmask); - err_mask =scc_bus_softreset (ap, devmask, deadline); -if (err_mask) { -ata_port_err (ap,"SRST failed (err_mask=0x%x)\n" , err_mask); + rc =scc_bus_softreset (ap, devmask, deadline); +if (rc) { +ata_port_err (ap,"SRST failed (err_mask=0x%x)\n" , rc);return -EIO ; }
Greg Kroah-Hartman
maintainerPATCH 13/143 ahci: Add Device IDs for Intel 9 Series PCH
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Ralston <[email protected]>
commit 1b071a0947dbce5c184c12262e02540fbc493457 upstream.
This patch adds the AHCI mode SATA Device IDs for the Intel 9 Series PCH.
--- drivers/ata/ahci.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/ata/ahci.c +8 -0
@@ -304,6 +304,14 @@ static const struct pci_device_id ahci_p { PCI_VDEVICE(INTEL, 0x9c85), board_ahci }, /* Wildcat Point-LP RAID */ { PCI_VDEVICE(INTEL, 0x9c87), board_ahci }, /* Wildcat Point-LP RAID */ { PCI_VDEVICE(INTEL, 0x9c8f), board_ahci }, /* Wildcat Point-LP RAID */ + { PCI_VDEVICE(INTEL, 0x8c82), board_ahci }, /* 9 Series AHCI */ + { PCI_VDEVICE(INTEL, 0x8c83), board_ahci }, /* 9 Series AHCI */ + { PCI_VDEVICE(INTEL, 0x8c84), board_ahci }, /* 9 Series RAID */ + { PCI_VDEVICE(INTEL, 0x8c85), board_ahci }, /* 9 Series RAID */ + { PCI_VDEVICE(INTEL, 0x8c86), board_ahci }, /* 9 Series RAID */ + { PCI_VDEVICE(INTEL, 0x8c87), board_ahci }, /* 9 Series RAID */ + { PCI_VDEVICE(INTEL, 0x8c8e), board_ahci }, /* 9 Series RAID */ + { PCI_VDEVICE(INTEL, 0x8c8f), board_ahci }, /* 9 Series RAID *//* JMicron 360/1/3/5/6, match class to avoid IDE function */ { PCI_VENDOR_ID_JMICRON, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
Greg Kroah-Hartman
maintainerPATCH 14/143 ahci: add pcid for Marvel 0x9182 controller
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Murali Karicheri <[email protected]>
commit c5edfff9db6f4d2c35c802acb4abe0df178becee upstream.
Keystone K2E EVM uses Marvel 0x9182 controller. This requires support for the ID in the ahci driver.
--- drivers/ata/ahci.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/ata/ahci.c +2 -0
@@ -449,6 +449,8 @@ static const struct pci_device_id ahci_p { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x917a), .driver_data = board_ahci_yes_fbs }, /* 88se9172 */ { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x9172), + .driver_data = board_ahci_yes_fbs }, /* 88se9182 */ + { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x9182), .driver_data = board_ahci_yes_fbs }, /* 88se9172 */ { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x9192), .driver_data = board_ahci_yes_fbs }, /* 88se9172 on some Gigabyte */
Greg Kroah-Hartman
maintainerPATCH 15/143 ibmveth: Fix endian issues with rx_no_buffer statistic
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anton Blanchard <[email protected]>
commit cbd5228199d8be45d895d9d0cc2b8ce53835fc21 upstream.
Hidden away in the last 8 bytes of the buffer_list page is a solitary statistic. It needs to be byte swapped or else ethtool -S will produce numbers that terrify the user.
Since we do this in multiple places, create a helper function with a comment explaining what is going on.
--- drivers/net/ethernet/ibm/ibmveth.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-)
drivers/net/ethernet/ibm/ibmveth.c +14 -4
@@ -293,6 +293,18 @@ failure:atomic_add (buffers_added, &(pool->available)); } +/* +* The final 8 bytes of the buffer list is a counter of frames dropped +* because there was not a buffer in the buffer list capable of holding +* the frame. +*/ +static void ibmveth_update_rx_no_buffer (struct ibmveth_adapter *adapter) +{ +__be64 *p = adapter->buffer_list_addr +4096 -8 ; + + adapter->rx_no_buffer =be64_to_cpup (p); +} +/* replenish routine */ static void ibmveth_replenish_task (struct ibmveth_adapter *adapter) {
@@ -308,8 +320,7 @@ static void ibmveth_replenish_task(strucibmveth_replenish_buffer_pool (adapter, pool); } - adapter->rx_no_buffer = *(u64 *)(((char *)adapter->buffer_list_addr) + -4096 -8 ); +ibmveth_update_rx_no_buffer (adapter); }/* empty and free ana buffer pool - also used to do cleanup in error paths */
@@ -689,8 +700,7 @@ static int ibmveth_close(struct net_devifree_irq (netdev->irq, netdev); - adapter->rx_no_buffer = *(u64 *)(((char *)adapter->buffer_list_addr) + -4096 -8 ); +ibmveth_update_rx_no_buffer (adapter);ibmveth_cleanup (adapter);
Greg Kroah-Hartman
maintainerPATCH 16/143 arm64: flush TLS registers during exec
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Will Deacon <[email protected]>
commit eb35bdd7bca29a13c8ecd44e6fd747a84ce675db upstream.
Nathan reports that we leak TLS information from the parent context during an exec, as we don't clear the TLS registers when flushing the thread state.
This patch updates the flushing code so that we:
(1) Unconditionally zero the tpidr_el0 register (since this is fully context switched for native tasks and zeroed for compat tasks)
(2) Zero the tp_value state in thread_info before clearing the tpidrr0_el0 register for compat tasks (since this is only writable by the set_tls compat syscall and therefore not fully switched).
A missing compiler barrier is also added to the compat set_tls syscall.
--- arch/arm64/kernel/process.c | 18 ++++++++++++++++++ arch/arm64/kernel/sys_compat.c | 6 ++++++ 2 files changed, 24 insertions(+)
arch/arm64/kernel/process.c +18 -0
@@ -172,9 +172,27 @@ void exit_thread(void) { } +static void tls_thread_flush (void ) +{ + asm ("msr tpidr_el0, xzr" ); + +if (is_compat_task ()) { + current->thread.tp_value =0 ; + +/* +* We need to ensure ordering between the shadow state and the +* hardware state, so that we don't corrupt the hardware state +* with a stale shadow state during context switch. +*/ +barrier (); + asm ("msr tpidrro_el0, xzr" ); + } +} +void flush_thread (void ) {fpsimd_flush_thread (); +tls_thread_flush ();flush_ptrace_hw_breakpoint (current); }
arch/arm64/kernel/sys_compat.c +6 -0
@@ -79,6 +79,12 @@ long compat_arm_syscall(struct pt_regs *case __ARM_NR_compat_set_tls: current->thread.tp_value = regs->regs[0 ]; + +/* +* Protect against register corruption from context switch. +* See comment in tls_thread_flush. +*/ +barrier (); asm ("msr tpidrro_el0, %0" : :"r" (regs->regs[0 ]));return 0 ;
Greg Kroah-Hartman
maintainerPATCH 17/143 i2c: at91: add bound checking on SMBus block length bytes
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Roszko <[email protected]>
commit 75b81f339c6af43f6f4a1b3eabe0603321dade65 upstream.
The driver was not bound checking the received length byte to ensure it was within the the buffer size that is allocated for SMBus blocks. This resulted in buffer overflows whenever an invalid length byte was received.
It also failed to ensure the length byte was not zero. If it received zero, it would end up in an infinite loop as the at91_twi_read_next_byte function returned immediately without allowing RHR to be read to clear the RXRDY interrupt.
Tested agaisnt a SMBus compliant battery.
--- drivers/i2c/busses/i2c-at91.c | 28 ++++++++++++++++++++++++---- 1 file changed, 24 insertions(+), 4 deletions(-)
drivers/i2c/busses/i2c-at91.c +24 -4
@@ -102,6 +102,7 @@ struct at91_twi_dev {unsigned twi_cwgr_reg;struct at91_twi_pdata *pdata;bool use_dma; +bool recv_len_abort;struct at91_twi_dma dma; };
@@ -268,12 +269,24 @@ static void at91_twi_read_next_byte(stru *dev->buf =at91_twi_read (dev,AT91_TWI_RHR ) &0xff ; --dev->buf_len; +/* return if aborting, we only needed to read RHR to clear RXRDY*/ +if (dev->recv_len_abort) +return ; +/* handle I2C_SMBUS_BLOCK_DATA */ if (unlikely (dev->msg->flags &I2C_M_RECV_LEN )) { - dev->msg->flags &= ~I2C_M_RECV_LEN ; - dev->buf_len += *dev->buf; - dev->msg->len = dev->buf_len +1 ; -dev_dbg (dev->dev,"received block length %d\n" , dev->buf_len); +/* ensure length byte is a valid value */ +if (*dev->buf <=I2C_SMBUS_BLOCK_MAX && *dev->buf >0 ) { + dev->msg->flags &= ~I2C_M_RECV_LEN ; + dev->buf_len += *dev->buf; + dev->msg->len = dev->buf_len +1 ; +dev_dbg (dev->dev,"received block length %d\n" , + dev->buf_len); + }else { +/* abort and send the stop by reading one more byte */ + dev->recv_len_abort = true; + dev->buf_len =1 ; + } }/* send stop if second but last byte has been read */
@@ -445,6 +458,12 @@ static int at91_do_twi_transfer(struct a ret = -EIO ; goto error; } +if (dev->recv_len_abort) { +dev_err (dev->dev,"invalid smbus block length recvd\n" ); + ret = -EPROTO ; + goto error; + } +dev_dbg (dev->dev,"transfer complete\n" );return 0 ;
@@ -501,6 +520,7 @@ static int at91_twi_xfer(struct i2c_adap dev->buf_len = m_start->len; dev->buf = m_start->buf; dev->msg = m_start; + dev->recv_len_abort = false; ret =at91_do_twi_transfer (dev);
Greg Kroah-Hartman
maintainerPATCH 18/143 i2c: at91: Fix a race condition during signal handling in at91_do_twi_xfer.
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Simon Lindgren <[email protected]>
commit 6721f28a26efd6368497abbdef5dcfc59608d899 upstream.
There is a race condition in at91_do_twi_xfer when signals arrive. If a signal is recieved while waiting for a transfer to complete wait_for_completion_interruptible_timeout() will return -ERESTARTSYS. This is not handled correctly resulting in interrupts still being enabled and a transfer being in flight when we return.
Symptoms include a range of oopses and bus lockups. Oopses can happen when the transfer completes because the interrupt handler will corrupt the stack. If a new transfer is started before the interrupt fires the controller will start a new transfer in the middle of the old one, resulting in confused slaves and a locked bus.
To avoid this, use wait_for_completion_io_timeout instead so that we don't have to deal with gracefully shutting down the transfer and disabling the interrupts.
--- drivers/i2c/busses/i2c-at91.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/i2c/busses/i2c-at91.c +2 -2
@@ -435,8 +435,8 @@ static int at91_do_twi_transfer(struct a } } - ret =wait_for_completion_interruptible_timeout (&dev->cmd_complete, - dev->adapter.timeout); + ret =wait_for_completion_io_timeout (&dev->cmd_complete, + dev->adapter.timeout);if (ret ==0 ) {dev_err (dev->dev,"controller timed out\n" );at91_init_twi_bus (dev);
Greg Kroah-Hartman
maintainerPATCH 19/143 trace: Fix epoll hang when we race with new entries
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <[email protected]>
commit 4ce97dbf50245227add17c83d87dc838e7ca79d0 upstream.
Epoll on trace_pipe can sometimes hang in a weird case. If the ring buffer is empty when we set waiters_pending but an event shows up exactly at that moment we can miss being woken up by the ring buffers irq work. Since ring_buffer_empty() is inherently racey we will sometimes think that the buffer is not empty. So we don't get woken up and we don't think there are any events even though there were some ready when we added the watch, which makes us hang. This patch fixes this by making sure that we are actually on the wait list before we set waiters_pending, and add a memory barrier to make sure ring_buffer_empty() is going to be correct.
--- kernel/trace/ring_buffer.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-)
kernel/trace/ring_buffer.c +15 -1
@@ -626,8 +626,22 @@ int ring_buffer_poll_wait(struct ring_bu work = &cpu_buffer->irq_work; } - work->waiters_pending = true;poll_wait (filp, &work->waiters, poll_table); + work->waiters_pending = true; +/* +* There's a tight race between setting the waiters_pending and +* checking if the ring buffer is empty. Once the waiters_pending bit +* is set, the next event will wake the task up, but we can get stuck +* if there's only a single event in. +* +* FIXME: Ideally, we need a memory barrier on the writer side as well, +* but adding a memory barrier to all events will cause too much of a +* performance hit in the fast path. We only need a memory barrier when +* the buffer goes from empty to having content. But as this race is +* extremely small, and it's not a problem if another event comes in, we +* will fix it later. +*/ +smp_mb ();if ((cpu ==RING_BUFFER_ALL_CPUS && !ring_buffer_empty (buffer)) || (cpu !=RING_BUFFER_ALL_CPUS && !ring_buffer_empty_cpu (buffer, cpu)))
Greg Kroah-Hartman
maintainerPATCH 20/143 arm64: ptrace: fix compat hardware watchpoint reporting
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Will Deacon <[email protected]>
commit 27d7ff273c2aad37b28f6ff0cab2cfa35b51e648 upstream.
I'm not sure what I was on when I wrote this, but when iterating over the hardware watchpoint array (hbp_watch_array), our index is off by ARM_MAX_BRP, so we walk off the end of our thread_struct...
... except, a dodgy condition in the loop means that it never executes at all (bp cannot be NULL).
This patch fixes the code so that we remove the bp check and use the correct index for accessing the watchpoint structures.
--- arch/arm64/include/asm/hw_breakpoint.h | 1 - arch/arm64/kernel/ptrace.c | 3 ++- 2 files changed, 2 insertions(+), 2 deletions(-)
arch/arm64/include/asm/hw_breakpoint.h +0 -1
@@ -79,7 +79,6 @@ static inline void decode_ctrl_reg(u32 r*/ #define ARM_MAX_BRP 16#define ARM_MAX_WRP 16 -#define ARM_MAX_HBP_SLOTS (ARM_MAX_BRP + ARM_MAX_WRP)/* Virtual debug register bases. */ #define AARCH64_DBG_REG_BVR 0
arch/arm64/kernel/ptrace.c +2 -1
@@ -103,7 +103,8 @@ static void ptrace_hbptriggered(struct pbreak ; } } -for (i =ARM_MAX_BRP ; i <ARM_MAX_HBP_SLOTS && !bp; ++i) { + +for (i =0 ; i <ARM_MAX_WRP ; ++i) {if (current->thread.debug.hbp_watch[i] == bp) { info.si_errno = -((i <<1 ) +1 );break ;
Greg Kroah-Hartman
maintainerPATCH 21/143 ALSA: core: fix buffer overflow in snd_info_get_line()
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Clemens Ladisch <[email protected]>
commit ddc64b278a4dda052390b3de1b551e59acdff105 upstream.
snd_info_get_line() documents that its last parameter must be one less than the buffer size, but this API design guarantees that (literally) every caller gets it wrong.
Just change this parameter to have its obvious meaning.
--- sound/core/info.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/core/info.c +2 -2
@@ -679,7 +679,7 @@ int snd_info_card_free(struct snd_card ** snd_info_get_line - read one line from the procfs buffer * @buffer: the procfs buffer * @line: the buffer to store -* @len: the max. buffer size - 1 +* @len: the max. buffer size * * Reads one line from the buffer and stores the string. *
@@ -699,7 +699,7 @@ int snd_info_get_line(struct snd_info_bu buffer->stop =1 ;if (c =='\n' )break ; -if (len) { +if (len >1 ) { len--; *line++ = c; }
Greg Kroah-Hartman
maintainerPATCH 22/143 ALSA: hda - Fix COEF setups for ALC1150 codec
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit acf08081adb5e8fe0519eb97bb49797ef52614d6 upstream.
ALC1150 codec seems to need the COEF- and PLL-setups just like its compatible ALC882 codec. Some machines (e.g. SunMicro X10SAT) show the problem like too low output volumes unless the COEF setup is applied.
--- sound/pci/hda/patch_realtek.c | 2 ++ 1 file changed, 2 insertions(+)
sound/pci/hda/patch_realtek.c +2 -0
@@ -318,6 +318,7 @@ static void alc_auto_init_amp(struct hdacase 0x10ec0885 :case 0x10ec0887 :/*case 0x10ec0889:*/ /* this causes an SPDIF problem */ +case 0x10ec0900 :alc889_coef_init (codec);break ;case 0x10ec0888 :
@@ -2252,6 +2253,7 @@ static int patch_alc882(struct hda_codecswitch (codec->vendor_id) {case 0x10ec0882 :case 0x10ec0885 : +case 0x10ec0900 :break ;default :/* ALC883 and variants */
Greg Kroah-Hartman
maintainerPATCH 23/143 ALSA: hda - Fix invalid pin powermap without jack detection
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 7a9744cb455e6faa287e148394b4b422a6f3c5c4 upstream.
When a driver is set up without the jack detection explicitly (either by passing a model option or via a specific fixup), the pin powermap of IDT/STAC codecs is set up wrongly, resulting in the silence output. It's because of a logic failure in stac_init_power_map(). It tries to avoid creating a callback for the pins that have other auto-hp and auto-mic callbacks, but the check is done in a wrong way at a wrong time. The stac_init_power_map() should be called after creating other jack detection ctls, and the jack callback should be created only for jack-detectable widgets.
This patch fixes the check in stac_init_power_map() and its callee at the right place, after snd_hda_gen_build_controls().
--- sound/pci/hda/patch_sigmatel.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-)
sound/pci/hda/patch_sigmatel.c +12 -5
@@ -539,8 +539,8 @@ static void stac_init_power_map(struct hif (snd_hda_jack_tbl_get (codec, nid))continue ;if (def_conf ==AC_JACK_PORT_COMPLEX && - !(spec->vref_mute_led_nid == nid || -is_jack_detectable (codec, nid))) { + spec->vref_mute_led_nid != nid && +is_jack_detectable (codec, nid)) {snd_hda_jack_detect_enable_callback (codec, nid,STAC_PWR_EVENT , jack_update_power);
@@ -3647,11 +3647,18 @@ static int stac_parse_auto_config(structreturn err; } -stac_init_power_map (codec); -return 0 ; } +static int stac_build_controls (struct hda_codec *codec) +{ +int err =snd_hda_gen_build_controls (codec); + +if (err <0 ) +return err; +stac_init_power_map (codec); +return 0 ; +}static int stac_init (struct hda_codec *codec) {
@@ -3794,7 +3801,7 @@ static void stac_set_power_state(struct#endif /* CONFIG_PM */ static const struct hda_codec_ops stac_patch_ops = { - .build_controls = snd_hda_gen_build_controls, + .build_controls = stac_build_controls, .build_pcms = snd_hda_gen_build_pcms, .init = stac_init, .free = stac_free,
Greg Kroah-Hartman
maintainerPATCH 24/143 ALSA: pcm: fix fifo_size frame calculation
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Clemens Ladisch <[email protected]>
commit a9960e6a293e6fc3ed414643bb4e4106272e4d0a upstream.
The calculated frame size was wrong because snd_pcm_format_physical_width() actually returns the number of bits, not bytes.
Use snd_pcm_format_size() instead, which not only returns bytes, but also simplifies the calculation.
--- sound/core/pcm_lib.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
sound/core/pcm_lib.c +5 -3
@@ -1782,14 +1782,16 @@ static int snd_pcm_lib_ioctl_fifo_size(s {struct snd_pcm_hw_params *params = arg;snd_pcm_format_t format; -int channels, width; +int channels; +ssize_t frame_size; params->fifo_size = substream->runtime->hw.fifo_size;if (!(substream->runtime->hw.info &SNDRV_PCM_INFO_FIFO_IN_FRAMES )) { format =params_format (params); channels =params_channels (params); - width =snd_pcm_format_physical_width (format); - params->fifo_size /= width * channels; + frame_size =snd_pcm_format_size (format, channels); +if (frame_size >0 ) + params->fifo_size /= (unsigned )frame_size; }return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 25/143 cfq-iosched: Fix wrong children_weight calculation
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Toshiaki Makita <[email protected]>
commit e15693ef18e13e3e6bffe891fe140f18b8ff6d07 upstream.
cfq_group_service_tree_add() is applying new_weight at the beginning of the function via cfq_update_group_weight().
This actually allows weight to change between adding it to and subtracting it from children_weight, and triggers WARN_ON_ONCE() in cfq_group_service_tree_del(), or even causes oops by divide error during vfr calculation in cfq_group_service_tree_add().
The detailed scenario is as follows:
1. Create blkio cgroups X and Y as a child of X.
Set X's weight to 500 and perform some I/O to apply new_weight. This X's I/O completes before starting Y's I/O.
2. Y starts I/O and cfq_group_service_tree_add() is called with Y.
3. cfq_group_service_tree_add() walks up the tree during children_weight calculation and adds parent X's weight (500) to children_weight of root. children_weight becomes 500.
4. Set X's weight to 1000.
5. X starts I/O and cfq_group_service_tree_add() is called with X.
6. cfq_group_service_tree_add() applies its new_weight (1000).
7. I/O of Y completes and cfq_group_service_tree_del() is called with Y.
8. I/O of X completes and cfq_group_service_tree_del() is called with X.
9. cfq_group_service_tree_del() subtracts X's weight (1000) from children_weight of root. children_weight becomes -500.
This triggers WARN_ON_ONCE().
10. Set X's weight to 500.
11. X starts I/O and cfq_group_service_tree_add() is called with X.
12. cfq_group_service_tree_add() applies its new_weight (500) and adds it to children_weight of root. children_weight becomes 0. Calcularion of vfr triggers oops by divide error.
weight should be updated right before adding it to children_weight.
--- block/cfq-iosched.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
block/cfq-iosched.c +8 -3
@@ -1275,12 +1275,16 @@ __cfq_group_service_tree_add(struct cfq_static void cfq_update_group_weight (struct cfq_group *cfqg) { -BUG_ON (!RB_EMPTY_NODE (&cfqg->rb_node)); -if (cfqg->new_weight) { cfqg->weight = cfqg->new_weight; cfqg->new_weight =0 ; } +} + +static void +cfq_update_group_leaf_weight (struct cfq_group *cfqg) +{ +BUG_ON (!RB_EMPTY_NODE (&cfqg->rb_node));if (cfqg->new_leaf_weight) { cfqg->leaf_weight = cfqg->new_leaf_weight;
@@ -1299,7 +1303,7 @@ cfq_group_service_tree_add(struct cfq_rb/* add to the service tree */ BUG_ON (!RB_EMPTY_NODE (&cfqg->rb_node)); -cfq_update_group_weight (cfqg); +cfq_update_group_leaf_weight (cfqg);__cfq_group_service_tree_add (st, cfqg);/*
@@ -1323,6 +1327,7 @@ cfq_group_service_tree_add(struct cfq_rb*/ while ((parent =cfqg_parent (pos))) {if (propagate) { +cfq_update_group_weight (pos); propagate = !parent->nr_active++; parent->children_weight += pos->weight; }
Greg Kroah-Hartman
maintainerPATCH 26/143 HID: picolcd: sanity check report size in raw_event() callback
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Kosina <[email protected]>
commit 844817e47eef14141cf59b8d5ac08dd11c0a9189 upstream.
The report passed to us from transport driver could potentially be arbitrarily large, therefore we better sanity-check it so that raw_data that we hold in picolcd_pending structure are always kept within proper bounds.
--- drivers/hid/hid-picolcd_core.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/hid/hid-picolcd_core.c +6 -0
@@ -350,6 +350,12 @@ static int picolcd_raw_event(struct hid_if (!data)return 1 ; +if (size >64 ) { +hid_warn (hdev,"invalid size value (%d) for picolcd raw event\n" , + size); +return 0 ; + } +if (report->id ==REPORT_KEY_STATE ) {if (data->input_keys) ret =picolcd_raw_keypad (data, report, raw_data+1 , size-1 );
Greg Kroah-Hartman
maintainerPATCH 27/143 HID: magicmouse: sanity check report size in raw_event() callback
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Kosina <[email protected]>
commit c54def7bd64d7c0b6993336abcffb8444795bf38 upstream.
The report passed to us from transport driver could potentially be arbitrarily large, therefore we better sanity-check it so that magicmouse_emit_touch() gets only valid values of raw_id.
--- drivers/hid/hid-magicmouse.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/hid/hid-magicmouse.c +10 -0
@@ -290,6 +290,11 @@ static int magicmouse_raw_event(struct hif (size <4 || ((size -4 ) %9 ) !=0 )return 0 ; npoints = (size -4 ) /9 ; +if (npoints >15 ) { +hid_warn (hdev,"invalid size value (%d) for TRACKPAD_REPORT_ID\n" , + size); +return 0 ; + } msc->ntouches =0 ;for (ii =0 ; ii < npoints; ii++)magicmouse_emit_touch (msc, ii, data + ii *9 +4 );
@@ -307,6 +312,11 @@ static int magicmouse_raw_event(struct hif (size <6 || ((size -6 ) %8 ) !=0 )return 0 ; npoints = (size -6 ) /8 ; +if (npoints >15 ) { +hid_warn (hdev,"invalid size value (%d) for MOUSE_REPORT_ID\n" , + size); +return 0 ; + } msc->ntouches =0 ;for (ii =0 ; ii < npoints; ii++)magicmouse_emit_touch (msc, ii, data + ii *8 +6 );
Greg Kroah-Hartman
maintainerPATCH 28/143 HID: logitech-dj: prevent false errors to be shown
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Tissoires <[email protected]>
commit 5abfe85c1d4694d5d4bbd13ecc166262b937adf0 upstream.
Commit "HID: logitech: perform bounds checking on device_id early enough" unfortunately leaks some errors to dmesg which are not real ones:
- if the report is not a DJ one, then there is not point in checking the device_id
- the receiver (index 0) can also receive some notifications which can be safely ignored given the current implementation
Move out the test regarding the report_id and also discards printing errors when the receiver got notified.
--- drivers/hid/hid-logitech-dj.c | 43 ++++++++++++++++++++++++------------------ drivers/hid/hid-logitech-dj.h | 1 2 files changed, 26 insertions(+), 18 deletions(-)
drivers/hid/hid-logitech-dj.c +25 -18
@@ -679,7 +679,6 @@ static int logi_dj_raw_event(struct hid_struct dj_receiver_dev *djrcv_dev =hid_get_drvdata (hdev);struct dj_report *dj_report = (struct dj_report *) data;unsigned long flags; -bool report_processed = false;dbg_hid ("%s, size:%d\n" , __func__, size);
@@ -706,34 +705,42 @@ static int logi_dj_raw_event(struct hid_* device (via hid_input_report() ) and return 1 so hid-core does not do * anything else with it. */ + +/* case 1) */ +if (data[0 ] !=REPORT_ID_DJ_SHORT ) +return false; +if ((dj_report->device_index <DJ_DEVICE_INDEX_MIN ) || (dj_report->device_index >DJ_DEVICE_INDEX_MAX )) { -dev_err (&hdev->dev,"%s: invalid device index:%d\n" , +/* +* Device index is wrong, bail out. +* This driver can ignore safely the receiver notifications, +* so ignore those reports too. +*/ +if (dj_report->device_index !=DJ_RECEIVER_INDEX ) +dev_err (&hdev->dev,"%s: invalid device index:%d\n" , __func__, dj_report->device_index);return false; }spin_lock_irqsave (&djrcv_dev->lock, flags); -if (dj_report->report_id ==REPORT_ID_DJ_SHORT ) { -switch (dj_report->report_type) { -case REPORT_TYPE_NOTIF_DEVICE_PAIRED : -case REPORT_TYPE_NOTIF_DEVICE_UNPAIRED : -logi_dj_recv_queue_notification (djrcv_dev, dj_report); -break ; -case REPORT_TYPE_NOTIF_CONNECTION_STATUS : -if (dj_report->report_params[CONNECTION_STATUS_PARAM_STATUS ] == -STATUS_LINKLOSS ) { -logi_dj_recv_forward_null_report (djrcv_dev, dj_report); - } -break ; -default : -logi_dj_recv_forward_report (djrcv_dev, dj_report); +switch (dj_report->report_type) { +case REPORT_TYPE_NOTIF_DEVICE_PAIRED : +case REPORT_TYPE_NOTIF_DEVICE_UNPAIRED : +logi_dj_recv_queue_notification (djrcv_dev, dj_report); +break ; +case REPORT_TYPE_NOTIF_CONNECTION_STATUS : +if (dj_report->report_params[CONNECTION_STATUS_PARAM_STATUS ] == +STATUS_LINKLOSS ) { +logi_dj_recv_forward_null_report (djrcv_dev, dj_report); } - report_processed = true; +break ; +default : +logi_dj_recv_forward_report (djrcv_dev, dj_report); }spin_unlock_irqrestore (&djrcv_dev->lock, flags); -return report_processed; +return true; } static int logi_dj_probe(struct hid_device *hdev,
drivers/hid/hid-logitech-dj.h +1 -0
@@ -27,6 +27,7 @@#define DJ_MAX_PAIRED_DEVICES 6#define DJ_MAX_NUMBER_NOTIFICATIONS 8 +#define DJ_RECEIVER_INDEX 0#define DJ_DEVICE_INDEX_MIN 1#define DJ_DEVICE_INDEX_MAX 6
Greg Kroah-Hartman
maintainerPATCH 29/143 drm/i915: Remove bogus __init annotation from DMI callbacks
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Krause <[email protected]>
commit bbe1c2740d3a25aa1dbe5d842d2ff09cddcdde0a upstream.
The __init annotations for the DMI callback functions are wrong as this code can be called even after the module has been initialized, e.g. like this:
# echo 1 > /sys/bus/pci/devices/0000:00:02.0/remove # modprobe i915 # echo 1 > /sys/bus/pci/rescan
The first command will remove the PCI device from the kernel's device list so the second command won't see it right away. But as it registers a PCI driver it'll see it on the third command. If the system happens to match one of the DMI table entries we'll try to call a function in long released memory and generate an Oops, at best.
Fix this by removing the bogus annotation.
Modpost should have caught that one but it ignores section reference mismatches from the .rodata section. :/
--- drivers/gpu/drm/i915/intel_bios.c | 2 +- drivers/gpu/drm/i915/intel_crt.c | 2 +- drivers/gpu/drm/i915/intel_lvds.c | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/i915/intel_bios.c +1 -1
@@ -657,7 +657,7 @@ init_vbt_defaults(struct drm_i915_privatDRM_DEBUG_KMS ("Set default to SSC at %dMHz\n" , dev_priv->lvds_ssc_freq); } -static int __init intel_no_opregion_vbt_callback (const struct dmi_system_id *id) +static int intel_no_opregion_vbt_callback (const struct dmi_system_id *id) { DRM_DEBUG_KMS("Falling back to manually reading VBT from " "VBIOS ROM for %s\n",
drivers/gpu/drm/i915/intel_crt.c +1 -1
@@ -702,7 +702,7 @@ static const struct drm_encoder_funcs in .destroy = intel_encoder_destroy, }; -static int __init intel_no_crt_dmi_callback (const struct dmi_system_id *id) +static int intel_no_crt_dmi_callback (const struct dmi_system_id *id) {DRM_INFO ("Skipping CRT initialization for %s\n" , id->ident);return 1 ;
drivers/gpu/drm/i915/intel_lvds.c +1 -1
@@ -694,7 +694,7 @@ static const struct drm_encoder_funcs in .destroy = intel_encoder_destroy, }; -static int __init intel_no_lvds_dmi_callback (const struct dmi_system_id *id) +static int intel_no_lvds_dmi_callback (const struct dmi_system_id *id) {DRM_INFO ("Skipping LVDS initialization for %s\n" , id->ident);return 1 ;
Greg Kroah-Hartman
maintainerPATCH 31/143 drm/ast: AST2000 cannot be detected correctly
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Y.C. Chen" <[email protected]>
commit 83502a5d34386f7c6973bc70e1c423f55f5a2e3a upstream.
Type error and cause AST2000 cannot be detected correctly
--- drivers/gpu/drm/ast/ast_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/ast/ast_main.c +1 -1
@@ -100,7 +100,7 @@ static int ast_detect_chip(struct drm_de } ast->vga2_clone = false; }else { - ast->chip =2000 ; + ast->chip =AST2000 ;DRM_INFO ("AST 2000 detected\n" ); } }
Greg Kroah-Hartman
maintainerPATCH 32/143 drm/vmwgfx: Fix a potential infinite spin waiting for fifo idle
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Hellstrom <[email protected]>
commit f01ea0c3d9db536c64d47922716d8b3b8f21d850 upstream.
The code waiting for fifo idle was incorrect and could possibly spin forever under certain circumstances.
--- drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c +2 -1
@@ -163,8 +163,9 @@ void vmw_fifo_release(struct vmw_privatemutex_lock (&dev_priv->hw_mutex); +vmw_write (dev_priv,SVGA_REG_SYNC ,SVGA_SYNC_GENERIC );while (vmw_read (dev_priv,SVGA_REG_BUSY ) !=0 ) -vmw_write (dev_priv,SVGA_REG_SYNC ,SVGA_SYNC_GENERIC ); + ; dev_priv->last_read_seqno =ioread32 (fifo_mem +SVGA_FIFO_FENCE );
Greg Kroah-Hartman
maintainerPATCH 33/143 drm/radeon: add connector quirk for fujitsu board
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit 1952f24d0fa6292d65f886887af87ba8ac79b3ba upstream.
Vbios connector table lists non-existent VGA port.
Bug:
https://bugs.freedesktop.org/show_bug.cgi?id=83184
--- drivers/gpu/drm/radeon/radeon_atombios.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/gpu/drm/radeon/radeon_atombios.c +7 -0
@@ -463,6 +463,13 @@ static bool radeon_atom_apply_quirks(str } } +/* Fujitsu D3003-S2 board lists DVI-I as DVI-I and VGA */ +if ((dev->pdev->device ==0x9805 ) && + (dev->pdev->subsystem_vendor ==0x1734 ) && + (dev->pdev->subsystem_device ==0x11bd )) { +if (*connector_type ==DRM_MODE_CONNECTOR_VGA ) +return false; + }return true; }
Greg Kroah-Hartman
maintainerPATCH 34/143 xtensa: replace IOCTL code definitions with constants
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Filippov <[email protected]>
commit f61bf8e7d19e0a3456a7a9ed97c399e4353698dc upstream.
This fixes userspace code that builds on other architectures but fails on xtensa due to references to structures that other architectures don't refer to. E.g. this fixes the following issue with python-2.7.8:
python-2.7.8/Modules/termios.c:861:25: error: invalid application
of 'sizeof' to incomplete type 'struct serial_multiport_struct' {"TIOCSERGETMULTI", TIOCSERGETMULTI},
python-2.7.8/Modules/termios.c:870:25: error: invalid application
of 'sizeof' to incomplete type 'struct serial_multiport_struct' {"TIOCSERSETMULTI", TIOCSERSETMULTI},
python-2.7.8/Modules/termios.c:900:24: error: invalid application
of 'sizeof' to incomplete type 'struct tty_struct' {"TIOCTTYGSTRUCT", TIOCTTYGSTRUCT},
--- arch/xtensa/include/uapi/asm/ioctls.h | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-)
arch/xtensa/include/uapi/asm/ioctls.h +10 -9
@@ -28,17 +28,17 @@#define TCSETSW 0x5403#define TCSETSF 0x5404 -#define TCGETA _IOR('t', 23, struct termio) -#define TCSETA _IOW('t', 24, struct termio) -#define TCSETAW _IOW('t', 25, struct termio) -#define TCSETAF _IOW('t', 28, struct termio) +#define TCGETA 0x80127417/* _IOR('t', 23, struct termio) */ +#define TCSETA 0x40127418/* _IOW('t', 24, struct termio) */ +#define TCSETAW 0x40127419/* _IOW('t', 25, struct termio) */ +#define TCSETAF 0x4012741C/* _IOW('t', 28, struct termio) */ #define TCSBRK _IO('t', 29)#define TCXONC _IO('t', 30)#define TCFLSH _IO('t', 31) -#define TIOCSWINSZ _IOW('t', 103, struct winsize) -#define TIOCGWINSZ _IOR('t', 104, struct winsize) +#define TIOCSWINSZ 0x40087467/* _IOW('t', 103, struct winsize) */ +#define TIOCGWINSZ 0x80087468/* _IOR('t', 104, struct winsize) */ #define TIOCSTART _IO('t', 110)/* start output, like ^Q */ #define TIOCSTOP _IO('t', 111)/* stop output, like ^S */ #define TIOCOUTQ _IOR('t', 115, int)/* output queue size */
@@ -88,7 +88,6 @@#define TIOCSETD _IOW('T', 35, int)#define TIOCGETD _IOR('T', 36, int)#define TCSBRKP _IOW('T', 37, int)/* Needed for POSIX tcsendbreak()*/ -#define TIOCTTYGSTRUCT _IOR('T', 38, struct tty_struct)/* For debugging only*/ #define TIOCSBRK _IO('T', 39)/* BSD compatibility */ #define TIOCCBRK _IO('T', 40)/* BSD compatibility */ #define TIOCGSID _IOR('T', 41, pid_t)/* Return the session ID of FD*/
@@ -114,8 +113,10 @@#define TIOCSERGETLSR _IOR('T', 89, unsigned int)/* Get line status reg. */ /* ioctl (fd, TIOCSERGETLSR, &result) where result may be as below */ # define TIOCSER_TEMT 0x01/* Transmitter physically empty */ -#define TIOCSERGETMULTI _IOR('T', 90, struct serial_multiport_struct)/* Get multiport config */ -#define TIOCSERSETMULTI _IOW('T', 91, struct serial_multiport_struct)/* Set multiport config */ +#define TIOCSERGETMULTI 0x80a8545a/* Get multiport config */ +/* _IOR('T', 90, struct serial_multiport_struct) */ +#define TIOCSERSETMULTI 0x40a8545b/* Set multiport config */ +/* _IOW('T', 91, struct serial_multiport_struct) */ #define TIOCMIWAIT _IO('T', 92)/* wait for a change on serial input line(s) */ #define TIOCGICOUNT 0x545D/* read serial port inline interrupt counts */
Greg Kroah-Hartman
maintainerPATCH 35/143 xtensa: fix address checks in dma_{alloc,free}_coherent
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Douglas <[email protected]>
commit 1ca49463c44c970b1ab1d71b0f268bfdf8427a7e upstream.
Virtual address is translated to the XCHAL_KSEG_CACHED region in the dma_free_coherent, but is checked to be in the 0...XCHAL_KSEG_SIZE range.
Change check for end of the range from 'addr >= X' to 'addr > X - 1' to handle the case of X == 0.
Replace 'if (C) BUG();' construct with 'BUG_ON(C);'.
--- arch/xtensa/kernel/pci-dma.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
arch/xtensa/kernel/pci-dma.c +6 -6
@@ -49,9 +49,8 @@ dma_alloc_coherent(struct device *dev,si/* We currently don't support coherent memory outside KSEG */ -if (ret <XCHAL_KSEG_CACHED_VADDR - || ret >=XCHAL_KSEG_CACHED_VADDR +XCHAL_KSEG_SIZE ) -BUG (); +BUG_ON (ret <XCHAL_KSEG_CACHED_VADDR || + ret >XCHAL_KSEG_CACHED_VADDR +XCHAL_KSEG_SIZE -1 );if (ret !=0 ) {
@@ -68,10 +67,11 @@ EXPORT_SYMBOL(dma_alloc_coherent);void dma_free_coherent (struct device *hwdev,size_t size,void *vaddr,dma_addr_t dma_handle) { -long addr=(long )vaddr+XCHAL_KSEG_CACHED_VADDR -XCHAL_KSEG_BYPASS_VADDR ; +unsigned long addr = (unsigned long )vaddr + +XCHAL_KSEG_CACHED_VADDR -XCHAL_KSEG_BYPASS_VADDR ; -if (addr <0 || addr >=XCHAL_KSEG_SIZE ) -BUG (); +BUG_ON (addr <XCHAL_KSEG_CACHED_VADDR || + addr >XCHAL_KSEG_CACHED_VADDR +XCHAL_KSEG_SIZE -1 );free_pages (addr,get_order (size)); }
Greg Kroah-Hartman
maintainerPATCH 36/143 xtensa: fix access to THREAD_RA/THREAD_SP/THREAD_DS
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Filippov <[email protected]>
commit 52247123749cc3cbc30168b33ad8c69515c96d23 upstream.
With SMP and a lot of debug options enabled task_struct::thread gets out of reach of s32i/l32i instructions with base pointing at task_struct, breaking build with the following messages:
arch/xtensa/kernel/entry.S: Assembler messages:
arch/xtensa/kernel/entry.S:1002: Error: operand 3 of 'l32i.n' has invalid value '1048' arch/xtensa/kernel/entry.S:1831: Error: operand 3 of 's32i.n' has invalid value '1040' arch/xtensa/kernel/entry.S:1832: Error: operand 3 of 's32i.n' has invalid value '1044'
Change base to point to task_struct::thread in such cases. Don't use a10 in _switch_to to save/restore prev pointer as a2 is not clobbered.
--- arch/xtensa/include/asm/uaccess.h | 5 +++++ arch/xtensa/kernel/entry.S | 12 ++++++++---- 2 files changed, 13 insertions(+), 4 deletions(-)
arch/xtensa/include/asm/uaccess.h +5 -0
@@ -52,7 +52,12 @@*/ .macro get_fs ad, sp GET_CURRENT(\ad,\sp) +#if THREAD_CURRENT_DS >1020 + addi \ad, \ad, TASK_THREAD + l32i \ad, \ad, THREAD_CURRENT_DS - TASK_THREAD +#else l32i \ad, \ad, THREAD_CURRENT_DS +#endif .endm/*
arch/xtensa/kernel/entry.S +8 -4
@@ -1961,7 +1961,6 @@ ENTRY(_switch_to) entry a1, 16 - mov a10, a2 # preserve 'prev' (a2) mov a11, a3 # and 'next' (a3) l32i a4, a2, TASK_THREAD_INFO
@@ -1969,8 +1968,14 @@ ENTRY(_switch_to) save_xtregs_user a4 a6 a8 a9 a12 a13 THREAD_XTREGS_USER - s32i a0, a10, THREAD_RA # save return address - s32i a1, a10, THREAD_SP # save stack pointer +#if THREAD_RA > 1020 || THREAD_SP > 1020 + addi a10, a2, TASK_THREAD + s32i a0, a10, THREAD_RA - TASK_THREAD # save return address + s32i a1, a10, THREAD_SP - TASK_THREAD # save stack pointer +#else + s32i a0, a2, THREAD_RA # save return address + s32i a1, a2, THREAD_SP # save stack pointer +#endif /* Disable ints while we manipulate the stack pointer. */
@@ -2011,7 +2016,6 @@ ENTRY(_switch_to) load_xtregs_user a5 a6 a8 a9 a12 a13 THREAD_XTREGS_USER wsr a14, ps - mov a2, a10 # return 'prev' rsync retw
Greg Kroah-Hartman
maintainerPATCH 37/143 xtensa: fix TLBTEMP_BASE_2 region handling in fast_second_level_miss
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Filippov <[email protected]>
commit 7128039fe2dd3d59da9e4ffa036f3aaa3ba87b9f upstream.
Current definition of TLBTEMP_BASE_2 is always 32K above the TLBTEMP_BASE_1, whereas fast_second_level_miss handler for the TLBTEMP region analyzes virtual address bit (PAGE_SHIFT + DCACHE_ALIAS_ORDER) to determine TLBTEMP region where the fault happened. The size of the TLBTEMP region is also checked incorrectly: not 64K, but twice data cache way size (whicht may as well be less than the instruction cache way size).
Fix TLBTEMP_BASE_2 to be TLBTEMP_BASE_1 + data cache way size. Provide TLBTEMP_SIZE that is a greater of doubled data cache way size or the instruction cache way size, and use it to determine if the second level TLB miss occured in the TLBTEMP region.
Practical occurence of page faults in the TLBTEMP area is extremely rare, this code can be tested by deletion of all w[di]tlb instructions in the tlbtemp_mapping region.
--- arch/xtensa/include/asm/pgtable.h | 7 ++++++- arch/xtensa/kernel/entry.S | 2 +- 2 files changed, 7 insertions(+), 2 deletions(-)
arch/xtensa/include/asm/pgtable.h +6 -1
@@ -68,7 +68,12 @@#define VMALLOC_START 0xC0000000#define VMALLOC_END 0xC7FEFFFF#define TLBTEMP_BASE_1 0xC7FF0000 -#define TLBTEMP_BASE_2 0xC7FF8000 +#define TLBTEMP_BASE_2 (TLBTEMP_BASE_1 + DCACHE_WAY_SIZE) +#if 2 *DCACHE_WAY_SIZE >ICACHE_WAY_SIZE +#define TLBTEMP_SIZE (2 * DCACHE_WAY_SIZE) +#else +#define TLBTEMP_SIZE ICACHE_WAY_SIZE +#endif /* * Xtensa Linux config PTE layout (when present):
arch/xtensa/kernel/entry.S +1 -1
@@ -1703,7 +1703,7 @@ ENTRY(fast_second_level_miss) rsr a0, excvaddr bltu a0, a3, 2f - addi a1, a0, -(2 << (DCACHE_ALIAS_ORDER + PAGE_SHIFT)) + addi a1, a0, -TLBTEMP_SIZE bgeu a1, a3, 2f /* Check if we have to restore an ITLB mapping. */
Greg Kroah-Hartman
maintainerPATCH 38/143 xtensa: fix a6 and a7 handling in fast_syscall_xtensa
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Filippov <[email protected]>
commit d1b6ba82a50cecf94be540a3a153aa89d97511a0 upstream.
Remove restoring a6 on some return paths and instead modify and restore it in a single place, using symbolic name.
Correctly restore a7 from PT_AREG7 in case of illegal a6 value.
--- arch/xtensa/kernel/entry.S | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-)
arch/xtensa/kernel/entry.S +5 -7
@@ -1121,9 +1121,8 @@ ENTRY(fast_syscall_xtensa) movi a7, 4 # sizeof(unsigned int) access_ok a3, a7, a0, a2, .Leac # a0: scratch reg, a2: sp - addi a6, a6, -1 # assuming SYS_XTENSA_ATOMIC_SET = 1 - _bgeui a6, SYS_XTENSA_COUNT - 1, .Lill - _bnei a6, SYS_XTENSA_ATOMIC_CMP_SWP - 1, .Lnswp + _bgeui a6, SYS_XTENSA_COUNT, .Lill + _bnei a6, SYS_XTENSA_ATOMIC_CMP_SWP, .Lnswp /* Fall through for ATOMIC_CMP_SWP. */
@@ -1135,27 +1134,26 @@ TRY s32i a5, a3, 0 # different, modify l32i a7, a2, PT_AREG7 # restore a7 l32i a0, a2, PT_AREG0 # restore a0 movi a2, 1 # and return 1 - addi a6, a6, 1 # restore a6 (really necessary?) rfe 1: l32i a7, a2, PT_AREG7 # restore a7 l32i a0, a2, PT_AREG0 # restore a0 movi a2, 0 # return 0 (note that we cannot set - addi a6, a6, 1 # restore a6 (really necessary?) rfe .Lnswp: /* Atomic set, add, and exg_add. */ TRY l32i a7, a3, 0 # orig + addi a6, a6, -SYS_XTENSA_ATOMIC_SET add a0, a4, a7 # + arg moveqz a0, a4, a6 # set + addi a6, a6, SYS_XTENSA_ATOMIC_SET TRY s32i a0, a3, 0 # write new value mov a0, a2 mov a2, a7 l32i a7, a0, PT_AREG7 # restore a7 l32i a0, a0, PT_AREG0 # restore a0 - addi a6, a6, 1 # restore a6 (really necessary?) rfe CATCH
@@ -1164,7 +1162,7 @@ CATCH movi a2, -EFAULT rfe -.Lill: l32i a7, a2, PT_AREG0 # restore a7 +.Lill: l32i a7, a2, PT_AREG7 # restore a7 l32i a0, a2, PT_AREG0 # restore a0 movi a2, -EINVAL rfe
Greg Kroah-Hartman
maintainerPATCH 39/143 USB: serial: pl2303: add device id for ztek device
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg KH <[email protected]>
commit 91fcb1ce420e0a5f8d92d556d7008a78bc6ce1eb upstream.
This adds a new device id to the pl2303 driver for the ZTEK device.
--- drivers/usb/serial/pl2303.c | 1 + drivers/usb/serial/pl2303.h | 1 + 2 files changed, 2 insertions(+)
drivers/usb/serial/pl2303.c +1 -0
@@ -47,6 +47,7 @@ static const struct usb_device_id id_tab { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_GPRS) }, { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_HCR331) }, { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_MOTOROLA) }, + { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_ZTEK) }, { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID) }, { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID_RSAQ5) }, { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID) },
drivers/usb/serial/pl2303.h +1 -0
@@ -22,6 +22,7 @@#define PL2303_PRODUCT_ID_GPRS 0x0609#define PL2303_PRODUCT_ID_HCR331 0x331a#define PL2303_PRODUCT_ID_MOTOROLA 0x0307 +#define PL2303_PRODUCT_ID_ZTEK 0xe1f1#define ATEN_VENDOR_ID 0x0557#define ATEN_VENDOR_ID2 0x0547
Greg Kroah-Hartman
maintainerPATCH 40/143 USB: serial: fix potential stack buffer overflow
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit d979e9f9ecab04c1ecca741370e30a8a498893f5 upstream.
Make sure to verify the maximum number of endpoints per type to avoid writing beyond the end of a stack-allocated array.
The current usb-serial implementation is limited to eight ports per interface but failed to verify that the number of endpoints of a certain type reported by a device did not exceed this limit.
--- drivers/usb/serial/usb-serial.c | 32 ++++++++++++++++++++++---------- 1 file changed, 22 insertions(+), 10 deletions(-)
drivers/usb/serial/usb-serial.c +22 -10
@@ -778,29 +778,39 @@ static int usb_serial_probe(struct usb_iif (usb_endpoint_is_bulk_in (endpoint)) {/* we found a bulk in endpoint */ dev_dbg (ddev,"found bulk in on endpoint %d\n" , i); - bulk_in_endpoint[num_bulk_in] = endpoint; - ++num_bulk_in; +if (num_bulk_in <MAX_NUM_PORTS ) { + bulk_in_endpoint[num_bulk_in] = endpoint; + ++num_bulk_in; + } }if (usb_endpoint_is_bulk_out (endpoint)) {/* we found a bulk out endpoint */ dev_dbg (ddev,"found bulk out on endpoint %d\n" , i); - bulk_out_endpoint[num_bulk_out] = endpoint; - ++num_bulk_out; +if (num_bulk_out <MAX_NUM_PORTS ) { + bulk_out_endpoint[num_bulk_out] = endpoint; + ++num_bulk_out; + } }if (usb_endpoint_is_int_in (endpoint)) {/* we found a interrupt in endpoint */ dev_dbg (ddev,"found interrupt in on endpoint %d\n" , i); - interrupt_in_endpoint[num_interrupt_in] = endpoint; - ++num_interrupt_in; +if (num_interrupt_in <MAX_NUM_PORTS ) { + interrupt_in_endpoint[num_interrupt_in] = + endpoint; + ++num_interrupt_in; + } }if (usb_endpoint_is_int_out (endpoint)) {/* we found an interrupt out endpoint */ dev_dbg (ddev,"found interrupt out on endpoint %d\n" , i); - interrupt_out_endpoint[num_interrupt_out] = endpoint; - ++num_interrupt_out; +if (num_interrupt_out <MAX_NUM_PORTS ) { + interrupt_out_endpoint[num_interrupt_out] = + endpoint; + ++num_interrupt_out; + } } }
@@ -823,8 +833,10 @@ static int usb_serial_probe(struct usb_iif (usb_endpoint_is_int_in (endpoint)) {/* we found a interrupt in endpoint */ dev_dbg (ddev,"found interrupt in for Prolific device on separate interface\n" ); - interrupt_in_endpoint[num_interrupt_in] = endpoint; - ++num_interrupt_in; +if (num_interrupt_in <MAX_NUM_PORTS ) { + interrupt_in_endpoint[num_interrupt_in] = endpoint; + ++num_interrupt_in; + } } } }
Greg Kroah-Hartman
maintainerPATCH 41/143 USB: sisusb: add device id for Magic Control USB video
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Hemminger <[email protected]>
commit 5b6b80aeb21091ed3030b9b6aae597d81326f1aa upstream.
I have a j5 create (JUA210) USB 2 video device and adding it device id to SIS USB video gets it to work.
--- drivers/usb/misc/sisusbvga/sisusb.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/misc/sisusbvga/sisusb.c +1 -0
@@ -3248,6 +3248,7 @@ static const struct usb_device_id sisusb { USB_DEVICE(0x0711, 0x0918) }, { USB_DEVICE(0x0711, 0x0920) }, { USB_DEVICE(0x0711, 0x0950) }, + { USB_DEVICE(0x0711, 0x5200) }, { USB_DEVICE(0x182d, 0x021c) }, { USB_DEVICE(0x182d, 0x0269) }, { }
Greg Kroah-Hartman
maintainerPATCH 42/143 USB: serial: fix potential heap buffer overflow
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 5654699fb38512bdbfc0f892ce54fce75bdc2bab upstream.
Make sure to verify the number of ports requested by subdriver to avoid writing beyond the end of fixed-size array in interface data.
The current usb-serial implementation is limited to eight ports per interface but failed to verify that the number of ports requested by a subdriver (which could have been determined from device descriptors) did not exceed this limit.
--- drivers/usb/serial/usb-serial.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/usb/serial/usb-serial.c +5 -0
@@ -876,6 +876,11 @@ static int usb_serial_probe(struct usb_i num_ports = type->num_ports; } +if (num_ports >MAX_NUM_PORTS ) { +dev_warn (ddev,"too many ports requested: %d\n" , num_ports); + num_ports =MAX_NUM_PORTS ; + } + serial->num_ports = num_ports; serial->num_bulk_in = num_bulk_in; serial->num_bulk_out = num_bulk_out;
Greg Kroah-Hartman
maintainerPATCH 43/143 USB: option: reduce interrupt-urb logging verbosity
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit f0e4cba2534cd88476dff920727c81350130f3c5 upstream.
Do not log normal interrupt-urb shutdowns as errors.
The option driver has always been logging any nonzero interrupt-urb status as an error, including when the urb is killed during normal operation.
Commit 9096f1fbba91 ("USB: usb_wwan: fix potential NULL-deref at resume") moved the interrupt urb submission from port probe and release to open and close, thus potentially increasing the number of these false-positive error messages dramatically.
--- drivers/usb/serial/option.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/serial/option.c +2 -0
@@ -1917,6 +1917,8 @@ static void option_instat_callback(strucdev_dbg (dev,"%s: type %x req %x\n" , __func__, req_pkt->bRequestType, req_pkt->bRequest); } + }else if (status == -ENOENT || status == -ESHUTDOWN ) { +dev_dbg (dev,"%s: urb stopped: %d\n" , __func__, status); }else dev_err (dev,"%s: error %d\n" , __func__, status);
Greg Kroah-Hartman
maintainerPATCH 44/143 USB: option: add VIA Telecom CDS7 chipset device id
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brennan Ashton <[email protected]>
commit d77302739d900bbca5e901a3b7ac48c907ee6c93 upstream.
This VIA Telecom baseband processor is used is used by by u-blox in both the FW2770 and FW2760 products and may be used in others as well.
This patch has been tested on both of these modem versions.
--- drivers/usb/serial/option.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/usb/serial/option.c +5 -0
@@ -494,6 +494,10 @@ static void option_instat_callback(struc#define INOVIA_VENDOR_ID 0x20a6#define INOVIA_SEW858 0x1105 +/* VIA Telecom */ +#define VIATELECOM_VENDOR_ID 0x15eb +#define VIATELECOM_PRODUCT_CDS7 0x0001 +/* some devices interfaces need special handling due to a number of reasons */ enum option_blacklist_reason {OPTION_BLACKLIST_NONE =0 ,
@@ -1724,6 +1728,7 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */ { USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) }, + { USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) }, { } /* Terminating entry */ };MODULE_DEVICE_TABLE (usb, option_ids);
Greg Kroah-Hartman
maintainerPATCH 45/143 Revert "USB: option,zte_ev: move most ZTE CDMA devices to zte_ev"
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 63a901c06e3c2c45bd601916fe04e870e9ccae1e upstream.
This reverts commit 73228a0538a7 ("USB: option,zte_ev: move most ZTE CDMA devices to zte_ev").
Move the IDs of the devices that were previously driven by the option driver back to that driver.
As several users have reported, the zte_ev driver is causing random disconnects as well as reconnect failures.
A closer analysis of the zte_ev setup code reveals that it consists of standard CDC requests (SET/GET_LINE_CODING and SET_CONTROL_LINE_STATE) but unfortunately fails to get some of those right. In particular, as reported by Liu Lei, it fails to lower DTR/RTS on close. It also appears that the control requests lack the interface argument.
Note that the zte_ev driver is based on code (once) distributed by ZTE that still appears to originally have been reverse-engineered and bolted onto the generic driver.
Since line control is already handled properly by the option driver, and the SET/GET_LINE_CODING requests appears to be redundant (amounts to a SET 9600 8N1), this is a first step in ultimately removing the redundant zte_ev driver.
Note that AC2726 had already been moved back to option, and that some IDs were in the device table of both drivers prior to the commit being reverted.
--- drivers/usb/serial/option.c | 24 +++++++++++++++++++++--- drivers/usb/serial/zte_ev.c | 18 ------------------ 2 files changed, 21 insertions(+), 21 deletions(-)
drivers/usb/serial/option.c +21 -3
@@ -275,8 +275,12 @@ static void option_instat_callback(struc#define ZTE_PRODUCT_MF622 0x0001#define ZTE_PRODUCT_MF628 0x0015#define ZTE_PRODUCT_MF626 0x0031 -#define ZTE_PRODUCT_MC2718 0xffe8#define ZTE_PRODUCT_AC2726 0xfff1 +#define ZTE_PRODUCT_CDMA_TECH 0xfffe +#define ZTE_PRODUCT_AC8710T 0xffff +#define ZTE_PRODUCT_MC2718 0xffe8 +#define ZTE_PRODUCT_AD3812 0xffeb +#define ZTE_PRODUCT_MC2716 0xffed#define BENQ_VENDOR_ID 0x04a5#define BENQ_PRODUCT_H10 0x4068
@@ -531,10 +535,18 @@ static const struct option_blacklist_inf .reserved = BIT(4), }; +static const struct option_blacklist_info zte_ad3812_z_blacklist = { + .sendsetup =BIT (0 ) |BIT (1 ) |BIT (2 ), +}; +static const struct option_blacklist_info zte_mc2718_z_blacklist = { .sendsetup =BIT (1 ) |BIT (2 ) |BIT (3 ) |BIT (4 ), }; +static const struct option_blacklist_info zte_mc2716_z_blacklist = { + .sendsetup =BIT (1 ) |BIT (2 ) |BIT (3 ), +}; +static const struct option_blacklist_info huawei_cdc12_blacklist = { .reserved =BIT (1 ) |BIT (2 ), };
@@ -1074,6 +1086,7 @@ static const struct usb_device_id option { USB_DEVICE_INTERFACE_CLASS(BANDRICH_VENDOR_ID, BANDRICH_PRODUCT_1012, 0xff) }, { USB_DEVICE(KYOCERA_VENDOR_ID, KYOCERA_PRODUCT_KPC650) }, { USB_DEVICE(KYOCERA_VENDOR_ID, KYOCERA_PRODUCT_KPC680) }, + { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6000)}, /* ZTE AC8700 */ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x0023)}, /* ONYX 3G device */ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 */
@@ -1548,13 +1561,18 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff93, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff94, 0xff, 0xff, 0xff) }, -/* NOTE: most ZTE CDMA devices should be driven by zte_ev, not option */ + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_CDMA_TECH, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC2726, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC8710T, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MC2718, 0xff, 0xff, 0xff), .driver_info = (kernel_ulong_t)&zte_mc2718_z_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AD3812, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&zte_ad3812_z_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MC2716, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&zte_mc2716_z_blacklist }, { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x02, 0x01) }, { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x02, 0x05) }, { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x86, 0x10) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC2726, 0xff, 0xff, 0xff) }, { USB_DEVICE(BENQ_VENDOR_ID, BENQ_PRODUCT_H10) }, { USB_DEVICE(DLINK_VENDOR_ID, DLINK_PRODUCT_DWM_652) },
drivers/usb/serial/zte_ev.c +0 -18
@@ -273,27 +273,9 @@ static void zte_ev_usb_serial_close(stru }static const struct usb_device_id id_table[] = { -/* AC8710, AC8710T */ - {USB_DEVICE_AND_INTERFACE_INFO (0x19d2 ,0xffff ,0xff ,0xff ,0xff ) }, -/* AC8700 */ - {USB_DEVICE_AND_INTERFACE_INFO (0x19d2 ,0xfffe ,0xff ,0xff ,0xff ) },/* MG880 */ {USB_DEVICE (0x19d2 ,0xfffd ) }, - {USB_DEVICE (0x19d2 ,0xfffc ) }, - {USB_DEVICE (0x19d2 ,0xfffb ) }, -/* AC8710_V3 */ - {USB_DEVICE (0x19d2 ,0xfff6 ) }, - {USB_DEVICE (0x19d2 ,0xfff7 ) }, - {USB_DEVICE (0x19d2 ,0xfff8 ) }, - {USB_DEVICE (0x19d2 ,0xfff9 ) }, - {USB_DEVICE (0x19d2 ,0xffee ) }, -/* AC2716, MC2716 */ - {USB_DEVICE_AND_INTERFACE_INFO (0x19d2 ,0xffed ,0xff ,0xff ,0xff ) }, -/* AD3812 */ - {USB_DEVICE_AND_INTERFACE_INFO (0x19d2 ,0xffeb ,0xff ,0xff ,0xff ) }, - {USB_DEVICE (0x19d2 ,0xffec ) }, {USB_DEVICE (0x05C6 ,0x3197 ) }, - {USB_DEVICE (0x05C6 ,0x6000 ) }, {USB_DEVICE (0x05C6 ,0x9008 ) }, { }, };
Greg Kroah-Hartman
maintainerPATCH 46/143 USB: zte_ev: remove duplicate Gobi PID
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 95be5739588c56a9327e477aa0ba3c81c5cf8631 upstream.
Remove dublicate Gobi PID 0x9008 which is already handled by the qcserial driver since commit f05932c0caf4 ("USB: qcserial: Add extra device IDs").
--- drivers/usb/serial/zte_ev.c | 1 - 1 file changed, 1 deletion(-)
drivers/usb/serial/zte_ev.c +0 -1
@@ -276,7 +276,6 @@ static const struct usb_device_id id_tab/* MG880 */ { USB_DEVICE(0x19d2, 0xfffd) }, { USB_DEVICE(0x05C6, 0x3197) }, - { USB_DEVICE(0x05C6, 0x9008) }, { }, };MODULE_DEVICE_TABLE (usb, id_table);
Greg Kroah-Hartman
maintainerPATCH 47/143 USB: zte_ev: remove duplicate Qualcom PID
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 754eb21c0bbbbc4b8830a9a864b286323b84225f upstream.
Remove dublicate Qualcom PID 0x3197 which is already handled by the moto-modem driver since commit 6986a978eec7 ("USB: add new moto_modem driver for some Morotola phones").
--- drivers/usb/serial/zte_ev.c | 1 - 1 file changed, 1 deletion(-)
drivers/usb/serial/zte_ev.c +0 -1
@@ -275,7 +275,6 @@ static void zte_ev_usb_serial_close(strustatic const struct usb_device_id id_table[] = {/* MG880 */ {USB_DEVICE (0x19d2 ,0xfffd ) }, - {USB_DEVICE (0x05C6 ,0x3197 ) }, { }, };MODULE_DEVICE_TABLE (usb, id_table);
Greg Kroah-Hartman
maintainerPATCH 50/143 USB: ftdi_sio: add support for NOVITUS Bono E thermal printer
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit ee444609dbae8afee420c3243ce4c5f442efb622 upstream.
Add device id for NOVITUS Bono E thermal printer.
--- drivers/usb/serial/ftdi_sio.c | 1 + drivers/usb/serial/ftdi_sio_ids.h | 6 ++++++ 2 files changed, 7 insertions(+)
drivers/usb/serial/ftdi_sio.c +1 -0
@@ -744,6 +744,7 @@ static struct usb_device_id id_table_com { USB_DEVICE(FTDI_VID, FTDI_NDI_AURORA_SCU_PID), .driver_info = (kernel_ulong_t)&ftdi_NDI_device_quirk }, { USB_DEVICE(TELLDUS_VID, TELLDUS_TELLSTICK_PID) }, + { USB_DEVICE(NOVITUS_VID, NOVITUS_BONO_E_PID) }, { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_S03_PID) }, { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_59_PID) }, { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_57A_PID) },
drivers/usb/serial/ftdi_sio_ids.h +6 -0
@@ -837,6 +837,12 @@#define TELLDUS_TELLSTICK_PID 0x0C30/* RF control dongle 433 MHz using FT232RL */ /* +* NOVITUS printers +*/ +#define NOVITUS_VID 0x1a28 +#define NOVITUS_BONO_E_PID 0x6010 + +/* * RT Systems programming cables for various ham radios */ #define RTSYSTEMS_VID 0x2100/* Vendor ID */
Greg Kroah-Hartman
maintainerPATCH 51/143 USB: zte_ev: fix removed PIDs
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 3096691011d01cef56b243a5e65431405c07d574 upstream.
Add back some PIDs that were mistakingly remove when reverting commit 73228a0538a7 ("USB: option,zte_ev: move most ZTE CDMA devices to zte_ev"), which apparently did more than its commit message claimed in that it not only moved some PIDs from option to zte_ev but also added some new ones.
devices to zte_ev"")
--- drivers/usb/serial/zte_ev.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/usb/serial/zte_ev.c +8 -0
@@ -273,6 +273,14 @@ static void zte_ev_usb_serial_close(stru }static const struct usb_device_id id_table[] = { + {USB_DEVICE (0x19d2 ,0xffec ) }, + {USB_DEVICE (0x19d2 ,0xffee ) }, + {USB_DEVICE (0x19d2 ,0xfff6 ) }, + {USB_DEVICE (0x19d2 ,0xfff7 ) }, + {USB_DEVICE (0x19d2 ,0xfff8 ) }, + {USB_DEVICE (0x19d2 ,0xfff9 ) }, + {USB_DEVICE (0x19d2 ,0xfffb ) }, + {USB_DEVICE (0x19d2 ,0xfffc ) },/* MG880 */ {USB_DEVICE (0x19d2 ,0xfffd ) }, { },
Greg Kroah-Hartman
maintainerPATCH 52/143 xhci: Fix null pointer dereference if xhci initialization fails
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <[email protected]>
commit c207e7c50f31113c24a9f536fcab1e8a256985d7 upstream.
If xhci initialization fails before the roothub bandwidth domains (xhci->rh_bw[i]) are allocated it will oops when trying to access rh_bw members in xhci_mem_cleanup().
--- drivers/usb/host/xhci-mem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/host/xhci-mem.c +1 -1
@@ -1795,7 +1795,7 @@ void xhci_mem_cleanup(struct xhci_hcd *x } num_ports =HCS_MAX_PORTS (xhci->hcs_params1); -for (i =0 ; i < num_ports; i++) { +for (i =0 ; i < num_ports && xhci->rh_bw; i++) {struct xhci_interval_bw_table *bwt = &xhci->rh_bw[i].bw_table;for (j =0 ; j <XHCI_MAX_INTERVAL ; j++) {struct list_head *ep = &bwt->interval_bw[j].endpoints;
Greg Kroah-Hartman
maintainerPATCH 53/143 xhci: fix oops when xhci resumes from hibernate with hw lpm capable devices
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <[email protected]>
commit 96044694b8511bc2b04df0776b4ba295cfe005c0 upstream.
Resuming from hibernate (S4) will restart and re-initialize xHC.
The device contexts are freed and will be re-allocated later during device reset.
Usb core will disable link pm in device resume before device reset, which will try to change the max exit latency, accessing the device contexts before they are re-allocated.
There is no need to zero (disable) the max exit latency when disabling hw lpm for a freshly re-initialized xHC. So check that device context exists before doing anything. The max exit latency will be set again after device reset when usb core enables the link pm.
--- drivers/usb/host/xhci.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
drivers/usb/host/xhci.c +10 -2
@@ -4407,13 +4407,21 @@ static int xhci_change_max_exit_latency(int ret;spin_lock_irqsave (&xhci->lock, flags); -if (max_exit_latency == xhci->devs[udev->slot_id]->current_mel) { + + virt_dev = xhci->devs[udev->slot_id]; + +/* +* virt_dev might not exists yet if xHC resumed from hibernate (S4) and +* xHC was re-initialized. Exit latency will be set later after +* hub_port_finish_reset() is done and xhci->devs[] are re-allocated +*/ + +if (!virt_dev || max_exit_latency == virt_dev->current_mel) {spin_unlock_irqrestore (&xhci->lock, flags);return 0 ; }/* Attempt to issue an Evaluate Context command to change the MEL. */ - virt_dev = xhci->devs[udev->slot_id]; command = xhci->lpm_command;xhci_slot_copy (xhci, command->in_ctx, virt_dev->out_ctx);spin_unlock_irqrestore (&xhci->lock, flags);
Greg Kroah-Hartman
maintainerPATCH 54/143 usb: hub: take hub->hdev reference when processing from eventlist
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Lawrence <[email protected]>
commit c605f3cdff53a743f6d875b76956b239deca1272 upstream.
During surprise device hotplug removal tests, it was observed that hub_events may try to call usb_lock_device on a device that has already been freed. Protect the usb_device by taking out a reference (under the hub_event_lock) when hub_events pulls it off the list, returning the reference after hub_events is finished using it.
--- drivers/usb/core/hub.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/core/hub.c +3 -1
@@ -4702,9 +4702,10 @@ static void hub_events(void) hub = list_entry(tmp, struct usb_hub, event_list);kref_get (&hub->kref); + hdev = hub->hdev; +usb_get_dev (hdev);spin_unlock_irq (&hub_event_lock); - hdev = hub->hdev; hub_dev = hub->intfdev; intf =to_usb_interface (hub_dev); dev_dbg(hub_dev, "state %d ports %d chg %04x evt %04x\n",
@@ -4919,6 +4920,7 @@ static void hub_events(void)usb_autopm_put_interface (intf); loop_disconnected:usb_unlock_device (hdev); +usb_put_dev (hdev);kref_put (&hub->kref, hub_release); }/* end while (1) */
Greg Kroah-Hartman
maintainerPATCH 55/143 storage: Add single-LUN quirk for Jaz USB Adapter
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark <[email protected]>
commit c66f1c62e85927357e7b3f4c701614dcb5c498a2 upstream.
The Iomega Jaz USB Adapter is a SCSI-USB converter cable. The hardware seems to be identical to e.g. the Microtech XpressSCSI, using a Shuttle/ SCM chip set. However its firmware restricts it to only work with Jaz drives.
On connecting the cable a message like this appears four times in the log:
reset full speed USB device number 4 using uhci_hcd
That's non-fatal but the US_FL_SINGLE_LUN quirk fixes it.
--- drivers/usb/storage/unusual_devs.h | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/usb/storage/unusual_devs.h +6 -0
@@ -741,6 +741,12 @@ UNUSUAL_DEV( 0x059b, 0x0001, 0x0100, 0x USB_SC_DEVICE, USB_PR_DEVICE, NULL, US_FL_SINGLE_LUN ), +UNUSUAL_DEV (0x059b ,0x0040 ,0x0100 ,0x0100 , +"Iomega" , +"Jaz USB Adapter" , +USB_SC_DEVICE ,USB_PR_DEVICE ,NULL , +US_FL_SINGLE_LUN ), +/* Reported by <[email protected]> */ UNUSUAL_DEV( 0x059f, 0x0643, 0x0000, 0x0000, "LaCie",
Greg Kroah-Hartman
maintainerPATCH 56/143 USB: storage: Add quirk for Adaptec USBConnect 2000 USB-to-SCSI Adapter
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark <[email protected]>
commit 67d365a57a51fb9dece6a5ceb504aa381cae1e5b upstream.
The Adaptec USBConnect 2000 is another SCSI-USB converter which uses Shuttle Technology/SCM Microsystems chips. The US_FL_SCM_MULT_TARG quirk is required to use SCSI devices with ID other than 0.
I don't have a USBConnect 2000, but based on the other entries for Shuttle/ SCM-based converters this patch is very likely correct. I used 0x0000 and 0x9999 for bcdDeviceMin and bcdDeviceMax because I'm not sure which bcdDevice value the product uses.
--- drivers/usb/storage/unusual_devs.h | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/usb/storage/unusual_devs.h +6 -0
@@ -101,6 +101,12 @@ UNUSUAL_DEV( 0x03f0, 0x4002, 0x0001, 0x "PhotoSmart R707", USB_SC_DEVICE, USB_PR_DEVICE, NULL, US_FL_FIX_CAPACITY), +UNUSUAL_DEV (0x03f3 ,0x0001 ,0x0000 ,0x9999 , +"Adaptec" , +"USBConnect 2000" , +USB_SC_DEVICE ,USB_PR_DEVICE , usb_stor_euscsi_init, + US_FL_SCM_MULT_TARG ), +/* Reported by Sebastian Kapfer <[email protected]> * and Olaf Hering <[email protected]> (different bcd's, same vendor/product) * for USB floppies that need the SINGLE_LUN enforcement.
Greg Kroah-Hartman
maintainerPATCH 57/143 USB: storage: Add quirk for Ariston Technologies iConnect USB to SCSI adapter
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark <[email protected]>
commit b6a3ed677991558ce09046397a7c4d70530d15b3 upstream.
Hi,
The Ariston Technologies iConnect 025 and iConnect 050 (also known as e.g. iSCSI-50) are SCSI-USB converters which use Shuttle Technology/SCM Microsystems chips. Only the connectors differ; both have the same USB ID. The US_FL_SCM_MULT_TARG quirk is required to use SCSI devices with ID other than 0.
I don't have one of these, but based on the other entries for Shuttle/ SCM-based converters this patch is very likely correct. I used 0x0000 and 0x9999 for bcdDeviceMin and bcdDeviceMax because I'm not sure which bcdDevice value the products use.
--- drivers/usb/storage/unusual_devs.h | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/usb/storage/unusual_devs.h +6 -0
@@ -1979,6 +1979,12 @@ UNUSUAL_DEV( 0x177f, 0x0400, 0x0000, 0x USB_SC_DEVICE, USB_PR_DEVICE, NULL, US_FL_BULK_IGNORE_TAG | US_FL_MAX_SECTORS_64 ), +UNUSUAL_DEV (0x1822 ,0x0001 ,0x0000 ,0x9999 , +"Ariston Technologies" , +"iConnect USB to SCSI adapter" , +USB_SC_DEVICE ,USB_PR_DEVICE , usb_stor_euscsi_init, + US_FL_SCM_MULT_TARG ), +/* Reported by Hans de Goede <[email protected]> * These Appotech controllers are found in Picture Frames, they provide a * (buggy) emulation of a cdrom drive which contains the windows software
Greg Kroah-Hartman
maintainerPATCH 58/143 USB: storage: Add quirks for Entrega/Xircom USB to SCSI converters
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark <[email protected]>
commit c80b4495c61636edc58fe1ce300f09f24db28e10 upstream.
This patch adds quirks for Entrega Technologies (later Xircom PortGear) USB- SCSI converters. They use Shuttle Technology EUSB-01/EUSB-S1 chips. The US_FL_SCM_MULT_TARG quirk is needed to allow multiple devices on the SCSI chain to be accessed. Without it only the (single) device with SCSI ID 0 can be used.
The standalone converter sold by Entrega had model number U1-SC25. Xircom acquired Entrega and re-branded the product line PortGear. The PortGear USB to SCSI Converter (model PGSCSI) is internally identical to the Entrega product, but later models may use a different USB ID. The Entrega-branded units have USB ID 1645:0007, as does my Xircom PGSCSI, but the Windows and Macintosh drivers also support 085A:0028.
Entrega also sold the "Mac USB Dock", which provides two USB ports, a Mac (8-pin mini-DIN) serial port and a SCSI port. It appears to the computer as a four-port hub, USB-serial, and USB-SCSI converters. The USB-SCSI part may have initially used the same ID as the standalone U1-SC25 (1645:0007), but later production used 085A:0026.
My Xircom PortGear PGSCSI has bcdDevice=0x0100. Units with bcdDevice=0x0133 probably also exist.
This patch adds quirks for 1645:0007, 085A:0026 and 085A:0028. The Windows driver INF file also mentions 085A:0032 "PortStation SCSI Module", but I couldn't find any mention of that actually existing in the wild; perhaps it was cancelled before release?
--- drivers/usb/storage/unusual_devs.h | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+)
drivers/usb/storage/unusual_devs.h +20 -0
@@ -1125,6 +1125,18 @@ UNUSUAL_DEV( 0x0851, 0x1543, 0x0200, 0x USB_SC_DEVICE, USB_PR_DEVICE, NULL, US_FL_NOT_LOCKABLE), +UNUSUAL_DEV (0x085a ,0x0026 ,0x0100 ,0x0133 , +"Xircom" , +"PortGear USB-SCSI (Mac USB Dock)" , +USB_SC_DEVICE ,USB_PR_DEVICE , usb_stor_euscsi_init, +US_FL_SCM_MULT_TARG ), + +UNUSUAL_DEV (0x085a ,0x0028 ,0x0100 ,0x0133 , +"Xircom" , +"PortGear USB to SCSI Converter" , +USB_SC_DEVICE ,USB_PR_DEVICE , usb_stor_euscsi_init, +US_FL_SCM_MULT_TARG ), +/* Submitted by Jan De Luyck <[email protected]> */ UNUSUAL_DEV( 0x08bd, 0x1100, 0x0000, 0x0000, "CITIZEN",
@@ -1957,6 +1969,14 @@ UNUSUAL_DEV( 0x152d, 0x2329, 0x0100, 0x USB_SC_DEVICE, USB_PR_DEVICE, NULL, US_FL_IGNORE_RESIDUE | US_FL_SANE_SENSE ), +/* Entrega Technologies U1-SC25 (later Xircom PortGear PGSCSI) +* and Mac USB Dock USB-SCSI */ +UNUSUAL_DEV (0x1645 ,0x0007 ,0x0100 ,0x0133 , +"Entrega Technologies" , +"USB to SCSI Converter" , +USB_SC_DEVICE ,USB_PR_DEVICE , usb_stor_euscsi_init, +US_FL_SCM_MULT_TARG ), +/* Reported by Robert Schedel <[email protected]> * Note: this is a 'super top' device like the above 14cd/6600 device */ UNUSUAL_DEV( 0x1652, 0x6600, 0x0201, 0x0201,
Greg Kroah-Hartman
maintainerPATCH 59/143 USB: EHCI: unlink QHs even after the controller has stopped
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <[email protected]>
commit 7312b5ddd47fee2356baa78c5516ef8e04eed452 upstream.
Old code in ehci-hcd tries to expedite disabling endpoints after the controller has stopped, by destroying the endpoint's associated QH without first unlinking the QH. This was necessary back when the driver wasn't so careful about keeping track of the controller's state.
But now we are careful about it, and the driver knows that when the controller isn't running, no unlinking delay is needed. Furthermore, skipping the unlink step will trigger a BUG() in qh_destroy() when the preceding QH is released, because the link pointer will be non-NULL.
Removing the lines that skip the unlinking step and go directly to QH_STATE_IDLE fixes the problem.
--- drivers/usb/host/ehci-hcd.c | 2 -- 1 file changed, 2 deletions(-)
drivers/usb/host/ehci-hcd.c +0 -2
@@ -972,8 +972,6 @@ rescan: } qh->exception =1 ; -if (ehci->rh_state <EHCI_RH_RUNNING ) - qh->qh_state =QH_STATE_IDLE ;switch (qh->qh_state) {case QH_STATE_LINKED :case QH_STATE_COMPLETING :
Greg Kroah-Hartman
maintainerPATCH 60/143 usb: dwc3: omap: fix ordering for runtime pm calls
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felipe Balbi <[email protected]>
commit 81a60b7f5c143ab3cdcd9943c9b4b7c63c32fc31 upstream.
we don't to gate clocks until our children are
done with their remove path.
--- drivers/usb/dwc3/dwc3-omap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/dwc3/dwc3-omap.c +1 -1
@@ -395,9 +395,9 @@ static int dwc3_omap_remove(struct platfstruct dwc3_omap *omap =platform_get_drvdata (pdev);dwc3_omap_disable_irqs (omap); +device_for_each_child (&pdev->dev,NULL , dwc3_omap_remove_core);pm_runtime_put_sync (&pdev->dev);pm_runtime_disable (&pdev->dev); -device_for_each_child (&pdev->dev,NULL , dwc3_omap_remove_core);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 61/143 usb:hub set hub->change_bits when over-current happens
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shen Guang <[email protected]>
commit 08d1dec6f4054e3613f32051d9b149d4203ce0d2 upstream.
When we are doing compliance test with xHCI, we found that if we enable CONFIG_USB_SUSPEND and plug in a bad device which causes over-current condition to the root port, software will not be noticed. The reason is that current code don't set hub->change_bits in hub_activate() when over-current happens, and then hub_events() will not check the port status because it thinks nothing changed. If CONFIG_USB_SUSPEND is disabled, the interrupt pipe of the hub will report the change and set hub->event_bits, and then hub_events() will check what events happened.In this case over-current can be detected.
--- drivers/usb/core/hub.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/usb/core/hub.c +2 -1
@@ -1165,7 +1165,8 @@ static void hub_activate(struct usb_hub/* Tell khubd to disconnect the device or * check for a new connection */ -if (udev || (portstatus &USB_PORT_STAT_CONNECTION )) +if (udev || (portstatus &USB_PORT_STAT_CONNECTION ) || + (portstatus &USB_PORT_STAT_OVERCURRENT ))set_bit (port1, hub->change_bits); }else if (portstatus &USB_PORT_STAT_ENABLE ) {
Greg Kroah-Hartman
maintainerPATCH 62/143 NFSv4: nfs4_state_manager() vs. nfs_server_remove_lists()
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steve Dickson <[email protected]>
commit 080af20cc945d110f9912d01cf6b66f94a375b8d upstream.
There is a race between nfs4_state_manager() and nfs_server_remove_lists() that happens during a nfsv3 mount.
The v3 mount notices there is already a supper block so nfs_server_remove_lists() called which uses the nfs_client_lock spin lock to synchronize access to the client list.
At the same time nfs4_state_manager() is running through the client list looking for work to do, using the same lock. When nfs4_state_manager() wins the race to the list, a v3 client pointer is found and not ignored properly which causes the panic.
Moving some protocol checks before the state checking avoids the panic.
--- fs/nfs/nfs4client.c | 38 ++++++++++++++++++++------------------ 1 file changed, 20 insertions(+), 18 deletions(-)
fs/nfs/nfs4client.c +20 -18
@@ -311,6 +311,16 @@ int nfs40_walk_client_list(struct nfs_clspin_lock (&nn->nfs_client_lock);list_for_each_entry (pos, &nn->nfs_client_list, cl_share_link) { + +if (pos->rpc_ops != new->rpc_ops) +continue ; + +if (pos->cl_proto != new->cl_proto) +continue ; + +if (pos->cl_minorversion != new->cl_minorversion) +continue ; +/* If "pos" isn't marked ready, we can't trust the * remaining fields in "pos" */ if (pos->cl_cons_state >NFS_CS_READY ) {
@@ -330,15 +340,6 @@ int nfs40_walk_client_list(struct nfs_clif (pos->cl_cons_state !=NFS_CS_READY )continue ; -if (pos->rpc_ops != new->rpc_ops) -continue ; - -if (pos->cl_proto != new->cl_proto) -continue ; - -if (pos->cl_minorversion != new->cl_minorversion) -continue ; -if (pos->cl_clientid != new->cl_clientid)continue ;
@@ -444,6 +445,16 @@ int nfs41_walk_client_list(struct nfs_clspin_lock (&nn->nfs_client_lock);list_for_each_entry (pos, &nn->nfs_client_list, cl_share_link) { + +if (pos->rpc_ops != new->rpc_ops) +continue ; + +if (pos->cl_proto != new->cl_proto) +continue ; + +if (pos->cl_minorversion != new->cl_minorversion) +continue ; +/* If "pos" isn't marked ready, we can't trust the * remaining fields in "pos", especially the client * ID and serverowner fields. Wait for CREATE_SESSION
@@ -469,15 +480,6 @@ int nfs41_walk_client_list(struct nfs_clif (pos->cl_cons_state !=NFS_CS_READY )continue ; -if (pos->rpc_ops != new->rpc_ops) -continue ; - -if (pos->cl_proto != new->cl_proto) -continue ; - -if (pos->cl_minorversion != new->cl_minorversion) -continue ; -if (!nfs4_match_clientids (pos, new))continue ;
Greg Kroah-Hartman
maintainerPATCH 63/143 NFSv4: Fix another bug in the close/open_downgrade code
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
commit cd9288ffaea4359d5cfe2b8d264911506aed26a4 upstream.
James Drew reports another bug whereby the NFS client is now sending an OPEN_DOWNGRADE in a situation where it should really have sent a
CLOSE: the client is opening the file for O_RDWR, but then trying to do a downgrade to O_RDONLY, which is not allowed by the NFSv4 spec.
--- fs/nfs/nfs4proc.c | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-)
fs/nfs/nfs4proc.c +15 -15
@@ -2299,23 +2299,23 @@ static void nfs4_close_prepare(struct rp is_rdwr =test_bit (NFS_O_RDWR_STATE , &state->flags); is_rdonly =test_bit (NFS_O_RDONLY_STATE , &state->flags); is_wronly =test_bit (NFS_O_WRONLY_STATE , &state->flags); -/* Calculate the current open share mode */ - calldata->arg.fmode =0 ; -if (is_rdonly || is_rdwr) - calldata->arg.fmode |=FMODE_READ ; -if (is_wronly || is_rdwr) - calldata->arg.fmode |=FMODE_WRITE ;/* Calculate the change in open mode */ + calldata->arg.fmode =0 ;if (state->n_rdwr ==0 ) { -if (state->n_rdonly ==0 ) { - call_close |= is_rdonly || is_rdwr; - calldata->arg.fmode &= ~FMODE_READ ; - } -if (state->n_wronly ==0 ) { - call_close |= is_wronly || is_rdwr; - calldata->arg.fmode &= ~FMODE_WRITE ; - } - } +if (state->n_rdonly ==0 ) + call_close |= is_rdonly; +else if (is_rdonly) + calldata->arg.fmode |=FMODE_READ ; +if (state->n_wronly ==0 ) + call_close |= is_wronly; +else if (is_wronly) + calldata->arg.fmode |=FMODE_WRITE ; + }else if (is_rdwr) + calldata->arg.fmode |=FMODE_READ |FMODE_WRITE ; + +if (calldata->arg.fmode ==0 ) + call_close |= is_rdwr; +if (!nfs4_valid_open_stateid (state)) call_close =0 ;spin_unlock (&state->owner->so_lock);
Greg Kroah-Hartman
maintainerPATCH 64/143 ARM: 8128/1: abort: dont clear the exclusive monitors
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <[email protected]>
commit 85868313177700d20644263a782351262d2aff84 upstream.
The ARMv6 and ARMv7 early abort handlers clear the exclusive monitors upon entry to the kernel, but this is redundant:
- We clear the monitors on every exception return since commit 200b812d0084 ("Clear the exclusive monitor when returning from an exception"), so this is not necessary to ensure the monitors are cleared before returning from a fault handler.
- Any dummy STREX will target a temporary scratch area in memory, and may succeed or fail without corrupting useful data. Its status value will not be used.
- Any other STREX in the kernel must be preceded by an LDREX, which will initialise the monitors consistently and will not depend on the earlier state of the monitors.
Therefore we have no reason to care about the initial state of the exclusive monitors when a data abort is taken, and clearing the monitors prior to exception return (as we already do) is sufficient.
This patch removes the redundant clearing of the exclusive monitors from the early abort handlers.
--- arch/arm/mm/abort-ev6.S | 6 ------ arch/arm/mm/abort-ev7.S | 6 ------ 2 files changed, 12 deletions(-)
arch/arm/mm/abort-ev6.S +0 -6
@@ -17,12 +17,6 @@ */ .align 5 ENTRY(v6_early_abort) -#ifdef CONFIG_CPU_V6 - sub r1, sp, #4 @ Get unused stack location - strex r0, r1, [r1] @ Clear the exclusive monitor -#elif defined(CONFIG_CPU_32v6K) - clrex -#endif mrc p15, 0, r1, c5, c0, 0 @ get FSR mrc p15, 0, r0, c6, c0, 0 @ get FAR /*
arch/arm/mm/abort-ev7.S +0 -6
@@ -13,12 +13,6 @@ */ .align 5 ENTRY(v7_early_abort) - /* - * The effect of data aborts on on the exclusive access monitor are - * UNPREDICTABLE. Do a CLREX to clear the state - */ - clrex - mrc p15, 0, r1, c5, c0, 0 @ get FSR mrc p15, 0, r0, c6, c0, 0 @ get FAR
Greg Kroah-Hartman
maintainerPATCH 65/143 ARM: 8133/1: use irq_set_affinity with force=false when migrating irqs
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudeep Holla <[email protected]>
commit a040803a9d6b8c1876d3487a5cb69602ebcbb82c upstream.
Since commit 1dbfa187dad ("ARM: irq migration: force migration off CPU going down") the ARM interrupt migration code on cpu offline calls irqchip.irq_set_affinity() with the argument force=true. At the point of this change the argument had no effect because it was not used by any interrupt chip driver and there was no semantics defined.
This changed with commit 01f8fa4f01d8 ("genirq: Allow forcing cpu affinity of interrupts") which made the force argument useful to route interrupts to not yet online cpus without checking the target cpu against the cpu online mask. The following commit ffde1de64012 ("irqchip: gic: Support forced affinity setting") implemented this for the GIC interrupt controller.
As a consequence the ARM cpu offline irq migration fails if CPU0 is offlined, because CPU0 is still set in the affinity mask and the validataion against cpu online mask is skipped to the force argument being true. The following first_cpu(mask) selection always selects CPU0 as the target.
Solve the issue by calling irq_set_affinity() with force=false from the CPU offline irq migration code so the GIC driver validates the affinity mask against CPU online mask and therefore removes CPU0 from the possible target candidates.
Tested on TC2 hotpluging CPU0 in and out. Without this patch the system locks up as the IRQs are not migrated away from CPU0.
--- arch/arm/kernel/irq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/kernel/irq.c +1 -1
@@ -163,7 +163,7 @@ static bool migrate_one_irq(struct irq_d c =irq_data_get_irq_chip (d);if (!c->irq_set_affinity)pr_debug ("IRQ%u: unable to set affinity\n" , d->irq); -else if (c->irq_set_affinity (d, affinity, true) ==IRQ_SET_MASK_OK && ret) +else if (c->irq_set_affinity (d, affinity, false) ==IRQ_SET_MASK_OK && ret)cpumask_copy (d->affinity, affinity);return ret;
Greg Kroah-Hartman
maintainerPATCH 66/143 ARM: 7897/1: kexec: Use the right ISA for relocate_new_kernel
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Martin <[email protected]>
commit e2ccba49085ab5d71b092de2a5176eb9b19cc876 upstream.
Copying a function with memcpy() and then trying to execute the result isn't trivially portable to Thumb.
This patch modifies the kexec soft restart code to copy its assembler trampoline relocate_new_kernel() using fncpy() instead, so that relocate_new_kernel can be in the same ISA as the rest of the kernel without problems.
--- arch/arm/kernel/machine_kexec.c | 17 ++++++++++------- arch/arm/kernel/relocate_kernel.S | 8 ++++++-- 2 files changed, 16 insertions(+), 9 deletions(-)
arch/arm/kernel/machine_kexec.c +10 -7
@@ -14,10 +14,11 @@#include <asm/pgalloc.h> #include <asm/mmu_context.h> #include <asm/cacheflush.h> +#include <asm/fncpy.h> #include <asm/mach-types.h> #include <asm/system_misc.h> -extern const unsigned char relocate_new_kernel[]; +extern void relocate_new_kernel (void );extern const unsigned int relocate_new_kernel_size;extern unsigned long kexec_start_address;
@@ -133,6 +134,8 @@ void machine_kexec(struct kimage *image) {unsigned long page_list;unsigned long reboot_code_buffer_phys; +unsigned long reboot_entry = (unsigned long )relocate_new_kernel; +unsigned long reboot_entry_phys;void *reboot_code_buffer;if (num_online_cpus () >1 ) {
@@ -156,18 +159,18 @@ void machine_kexec(struct kimage *image)/* copy our kernel relocation code to the control code page */ -memcpy (reboot_code_buffer, - relocate_new_kernel, relocate_new_kernel_size); + reboot_entry =fncpy (reboot_code_buffer, + reboot_entry, + relocate_new_kernel_size); + reboot_entry_phys = (unsigned long )reboot_entry + + (reboot_code_buffer_phys - (unsigned long )reboot_code_buffer); - -flush_icache_range ((unsigned long ) reboot_code_buffer, - (unsigned long ) reboot_code_buffer +KEXEC_CONTROL_PAGE_SIZE );printk (KERN_INFO "Bye!\n" );if (kexec_reinit)kexec_reinit (); -soft_restart (reboot_code_buffer_phys); +soft_restart (reboot_entry_phys); }void arch_crash_save_vmcoreinfo (void )
arch/arm/kernel/relocate_kernel.S +6 -2
@@ -2,10 +2,12 @@ * relocate_kernel.S - put the kernel image in place to boot */ +#include <linux/linkage.h> #include <asm/kexec.h> - .globl relocate_new_kernel -relocate_new_kernel: + .align 3 /* not needed for this code, but keeps fncpy() happy */ + +ENTRY(relocate_new_kernel) ldr r0,kexec_indirection_page ldr r1,kexec_start_address
@@ -79,6 +81,8 @@ kexec_mach_type: kexec_boot_atags: .long 0x0 +ENDPROC(relocate_new_kernel) + relocate_new_kernel_end: .globl relocate_new_kernel_size
Greg Kroah-Hartman
maintainerPATCH 67/143 ARM: 8165/1: alignment: dont break misaligned NEON load/store
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robin Murphy <[email protected]>
commit 5ca918e5e3f9df4634077c06585c42bc6a8d699a upstream.
The alignment fixup incorrectly decodes faulting ARM VLDn/VSTn instructions (where the optional alignment hint is given but incorrect) as LDR/STR, leading to register corruption. Detect these and correctly treat them as unhandled, so that userspace gets the fault it expects.
--- arch/arm/mm/alignment.c | 3 +++ 1 file changed, 3 insertions(+)
arch/arm/mm/alignment.c +3 -0
@@ -39,6 +39,7 @@* This code is not portable to processors with late data abort handling. */ #define CODING_BITS (i) (i & 0x0e000000) +#define COND_BITS (i) (i & 0xf0000000)#define LDST_I_BIT (i) (i & (1 << 26))/* Immediate constant */ #define LDST_P_BIT (i) (i & (1 << 24))/* Preindex */
@@ -812,6 +813,8 @@ do_alignment(unsigned long addr, unsignebreak ;case 0x04000000 :/* ldr or str immediate */ +if (COND_BITS (instr) ==0xf0000000 )/* NEON VLDn, VSTn */ + goto bad; offset.un =OFFSET_BITS (instr); handler = do_alignment_ldrstr;break ;
Greg Kroah-Hartman
maintainerPATCH 68/143 MIPS: ZBOOT: add missing <linux/string.h> include
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aurelien Jarno <[email protected]>
commit 29593fd5a8149462ed6fad0d522234facdaee6c8 upstream.
Commit dc4d7b37 (MIPS: ZBOOT: gather string functions into string.c) moved the string related functions into a separate file, which might cause the following build error, depending on the configuration:
| CC arch/mips/boot/compressed/decompress.o | In file included from linux/arch/mips/boot/compressed/../../../../lib/decompress_unxz.c:234:0, | from linux/arch/mips/boot/compressed/decompress.c:67: | linux/arch/mips/boot/compressed/../../../../lib/xz/xz_dec_stream.c: In function 'fill_temp': | linux/arch/mips/boot/compressed/../../../../lib/xz/xz_dec_stream.c:162:2: error: implicit declaration of function 'memcpy' [-Werror=implicit-function-declaration] | cc1: some warnings being treated as errors | linux/scripts/Makefile.build:308: recipe for target 'arch/mips/boot/compressed/decompress.o' failed | make[6]: *** [arch/mips/boot/compressed/decompress.o] Error 1 | linux/arch/mips/Makefile:308: recipe for target 'vmlinuz' failed
It does not fail with the standard configuration, as when CONFIG_DYNAMIC_DEBUG is not enabled <linux/string.h> gets included in include/linux/dynamic_debug.h. There might be other ways for it to get indirectly included.
We can't add the include directly in xz_dec_stream.c as some architectures might want to use a different version for the boot/ directory (see for example arch/x86/boot/string.h).
Patchwork: https://patchwork.linux-mips.org/patch/7420/
--- arch/mips/boot/compressed/decompress.c | 1 + 1 file changed, 1 insertion(+)
arch/mips/boot/compressed/decompress.c +1 -0
@@ -13,6 +13,7 @@#include <linux/types.h> #include <linux/kernel.h> +#include <linux/string.h> #include <asm/addrspace.h>
Greg Kroah-Hartman
maintainerPATCH 69/143 MIPS: mcount: Adjust stack pointer for static trace in MIPS32
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Markos Chandras <[email protected]>
commit 8a574cfa2652545eb95595d38ac2a0bb501af0ae upstream.
Every mcount() call in the MIPS 32-bit kernel is done as follows:
[...]
move at, ra
jal _mcount
addiu sp, sp, -8
[...]
but upon returning from the mcount() function, the stack pointer is not adjusted properly. This is explained in details in 58b69401c797 (MIPS: Function tracer: Fix broken function tracing).
Commit ad8c396936e3 ("MIPS: Unbreak function tracer for 64-bit kernel.) fixed the stack manipulation for 64-bit but it didn't fix it completely for MIPS32.
Patchwork: https://patchwork.linux-mips.org/patch/7792/
--- arch/mips/kernel/mcount.S | 12 ++++++++++++ 1 file changed, 12 insertions(+)
arch/mips/kernel/mcount.S +12 -0
@@ -123,7 +123,11 @@ NESTED(_mcount, PT_SIZE, ra) nop #endif b ftrace_stub +#ifdef CONFIG_32BIT + addiu sp, sp, 8 +#else nop +#endif static_trace: MCOUNT_SAVE_REGS
@@ -133,6 +137,9 @@ static_trace: move a1, AT /* arg2: parent's return address */ MCOUNT_RESTORE_REGS +#ifdef CONFIG_32BIT + addiu sp, sp, 8 +#endif .globl ftrace_stub ftrace_stub: RETURN_BACK
@@ -181,6 +188,11 @@ NESTED(ftrace_graph_caller, PT_SIZE, ra) jal prepare_ftrace_return nop MCOUNT_RESTORE_REGS +#ifndef CONFIG_DYNAMIC_FTRACE +#ifdef CONFIG_32BIT + addiu sp, sp, 8 +#endif +#endif RETURN_BACK END(ftrace_graph_caller)
Greg Kroah-Hartman
maintainerPATCH 70/143 ACPICA: Update to GPIO region handler interface.
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bob Moore <[email protected]>
commit 75ec6e55f1384548311a13ce4fcb39c516053314 upstream.
Changes to correct several GPIO issues:
1) The update_rule in a GPIO field definition is now ignored; a read-modify-write operation is never performed for GPIO fields. (Internally, this means that the field assembly/disassembly code is completely bypassed for GPIO.)
2) The Address parameter passed to a GPIO region handler is now the bit offset of the field from a previous Connection() operator. Thus, it becomes a "Pin Number Index" into the Connection() resource descriptor.
3) The bit_width parameter passed to a GPIO region handler is now the exact bit width of the GPIO field. Thus, it can be interpreted as "number of pins".
Overall, we can now say that the region handler interface to GPIO handlers is a raw "bit/pin" addressed interface, not a byte-addressed interface like the system_memory handler interface.
--- drivers/acpi/acpica/aclocal.h | 1 drivers/acpi/acpica/acobject.h | 1 drivers/acpi/acpica/dsfield.c | 2 + drivers/acpi/acpica/evregion.c | 47 ++++++++++++++++++---------- drivers/acpi/acpica/exfield.c | 67 +++++++++++++++++++++++++++++++++++++++++ drivers/acpi/acpica/exprep.c | 2 + 6 files changed, 104 insertions(+), 16 deletions(-)
drivers/acpi/acpica/aclocal.h +1 -0
@@ -254,6 +254,7 @@ struct acpi_create_field_info {u32 field_bit_position;u32 field_bit_length;u16 resource_length; +u16 pin_number_index;u8 field_flags;u8 attribute;u8 field_type;
drivers/acpi/acpica/acobject.h +1 -0
@@ -263,6 +263,7 @@ struct acpi_object_region_field { ACPI_OBJECT_COMMON_HEADER ACPI_COMMON_FIELD_INFO u16 resource_length;union acpi_operand_object *region_obj;/* Containing op_region object */ u8 *resource_buffer;/* resource_template for serial regions/fields */ +u16 pin_number_index;/* Index relative to previous Connection/Template */ };struct acpi_object_bank_field {
drivers/acpi/acpica/dsfield.c +2 -0
@@ -360,6 +360,7 @@ acpi_ds_get_field_names(struct acpi_crea*/ info->resource_buffer =NULL ; info->connection_node =NULL ; + info->pin_number_index =0 ;/* * A Connection() is either an actual resource descriptor (buffer)
@@ -437,6 +438,7 @@ acpi_ds_get_field_names(struct acpi_crea } info->field_bit_position += info->field_bit_length; + info->pin_number_index++;/* Index relative to previous Connection() */ break ;default :
drivers/acpi/acpica/evregion.c +31 -16
79 lines not on this page · raw message
drivers/acpi/acpica/exfield.c +67 -0
79 lines not on this page · raw message
drivers/acpi/acpica/exprep.c +2 -0
@@ -479,6 +479,8 @@ acpi_status acpi_ex_prep_field_value(str obj_desc->field.resource_length = info->resource_length; } + obj_desc->field.pin_number_index = info->pin_number_index; +/* Allow full data read from EC address space */ if ((obj_desc->field.region_obj->region.space_id ==
Greg Kroah-Hartman
maintainerPATCH 71/143 regmap: Fix handling of volatile registers for format_write() chips
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Brown <[email protected]>
commit 5844a8b9d98ec11ce1d77610daacf3f0a0e14715 upstream.
A previous over-zealous factorisation of code means that we only treat registers as volatile if they are readable. For most devices this is fine since normally most registers can be read and volatility implies readability but for format_write() devices where there is no readback from the hardware and we use volatility to mean simply uncacheability this means that we end up treating all registers as cacheble.
A bigger refactoring of the code to clarify this is in order but as a fix make a minimal change and only check readability when checking volatility if there is no format_write() operation defined for the device.
--- drivers/base/regmap/regmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/base/regmap/regmap.c +1 -1
@@ -114,7 +114,7 @@ bool regmap_readable(struct regmap *map,bool regmap_volatile (struct regmap *map,unsigned int reg) { -if (!regmap_readable (map, reg)) +if (!map->format.format_write && !regmap_readable (map, reg))return false;if (map->volatile_reg)
Greg Kroah-Hartman
maintainerPATCH 72/143 KVM: x86: handle idiv overflow at kvm_write_tsc
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marcelo Tosatti <[email protected]>
commit 8915aa27d5efbb9185357175b0acf884325565f9 upstream.
Its possible that idivl overflows (due to large delta stored in usdiff, valid scenario).
Create an exception handler to catch the overflow exception (division by zero is protected by vcpu->arch.virtual_tsc_khz check), and interpret it accordingly (delta is larger than USEC_PER_SEC).
Fixes https://bugzilla.redhat.com/show_bug.cgi?id=969644
--- arch/x86/kvm/x86.c | 23 ++++++++++++++++++++--- 1 file changed, 20 insertions(+), 3 deletions(-)
arch/x86/kvm/x86.c +20 -3
@@ -1196,20 +1196,37 @@ void kvm_write_tsc(struct kvm_vcpu *vcpu elapsed = ns - kvm->arch.last_tsc_nsec;if (vcpu->arch.virtual_tsc_khz) { +int faulted =0 ; +/* n.b - signed multiplication and division required */ usdiff = data - kvm->arch.last_tsc_write;#ifdef CONFIG_X86_64 usdiff = (usdiff *1000 ) / vcpu->arch.virtual_tsc_khz;#else /* do_div() only does unsigned */ - asm("idivl %2; xor %%edx, %%edx" - :"=A" (usdiff) - :"A" (usdiff *1000 ),"rm" (vcpu->arch.virtual_tsc_khz)); + asm("1: idivl %[divisor]\n" + "2: xor %%edx, %%edx\n" + " movl $0, %[faulted]\n" + "3:\n" + ".section .fixup,\"ax\"\n" + "4: movl $1, %[faulted]\n" + " jmp 3b\n" + ".previous\n" + + _ASM_EXTABLE(1b, 4b) + + : "=A"(usdiff), [faulted] "=r" (faulted) + : "A"(usdiff * 1000), [divisor] "rm"(vcpu->arch.virtual_tsc_khz)); + #endif do_div(elapsed,1000 ); usdiff -= elapsed;if (usdiff <0 ) usdiff = -usdiff; + +/* idivl overflow => difference is larger than USEC_PER_SEC */ +if (faulted) + usdiff = USEC_PER_SEC; }else usdiff =USEC_PER_SEC ;/* disable TSC match window below */
Greg Kroah-Hartman
maintainerPATCH 73/143 x86 early_ioremap: Increase FIX_BTMAPS_SLOTS to 8
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Young <[email protected]>
commit 3eddc69ffeba092d288c386646bfa5ec0fce25fd upstream.
3.16 kernel boot fail with earlyprintk=efi, it keeps scrolling at the bottom line of screen.
Bisected, the first bad commit is below:
commit 86dfc6f339886559d80ee0d4bd20fe5ee90450f0
Author: Lv Zheng <[email protected]> Date: Fri Apr 4 12:38:57 2014 +0800
ACPICA: Tables: Fix table checksums verification before installation.
I did some debugging by enabling both serial and efi earlyprintk, below is some debug dmesg, seems early_ioremap fails in scroll up function due to no free slot, see below dmesg output:
WARNING: CPU: 0 PID: 0 at mm/early_ioremap.c:116 __early_ioremap+0x90/0x1c4()
__early_ioremap(ed00c800, 00000c80) not found slot
Modules linked in:
CPU: 0 PID: 0 Comm: swapper Not tainted 3.17.0-rc1+ #204
Hardware name: Hewlett-Packard HP Z420 Workstation/1589, BIOS J61 v03.15 05/09/2013
Call Trace:
dump_stack+0x4e/0x7a
warn_slowpath_common+0x75/0x8e
? __early_ioremap+0x90/0x1c4
warn_slowpath_fmt+0x47/0x49
__early_ioremap+0x90/0x1c4
? sprintf+0x46/0x48
early_ioremap+0x13/0x15
early_efi_map+0x24/0x26
early_efi_scroll_up+0x6d/0xc0
early_efi_write+0x1b0/0x214
call_console_drivers.constprop.21+0x73/0x7e
console_unlock+0x151/0x3b2
? vprintk_emit+0x49f/0x532
vprintk_emit+0x521/0x532
? console_unlock+0x383/0x3b2
printk+0x4f/0x51
acpi_os_vprintf+0x2b/0x2d
acpi_os_printf+0x43/0x45
acpi_info+0x5c/0x63
? __acpi_map_table+0x13/0x18
? acpi_os_map_iomem+0x21/0x147
acpi_tb_print_table_header+0x177/0x186
acpi_tb_install_table_with_override+0x4b/0x62
acpi_tb_install_standard_table+0xd9/0x215
? early_ioremap+0x13/0x15
? __acpi_map_table+0x13/0x18
acpi_tb_parse_root_table+0x16e/0x1b4
acpi_initialize_tables+0x57/0x59
acpi_table_init+0x50/0xce
acpi_boot_table_init+0x1e/0x85
setup_arch+0x9b7/0xcc4
start_kernel+0x94/0x42d
? early_idt_handlers+0x120/0x120
x86_64_start_reservations+0x2a/0x2c
x86_64_start_kernel+0xf3/0x100Quote reply from Lv.zheng about the early ioremap slot usage in this case:
"""
In early_efi_scroll_up(), 2 mapping entries will be used for the src/dst screen buffer.
In drivers/acpi/acpica/tbutils.c, we've improved the early table loading code in acpi_tb_parse_root_table(). We now need 2 mapping entries:
1. One mapping entry is used for RSDT table mapping. Each RSDT entry contains an address for another ACPI table.
2. For each entry in RSDP, we need another mapping entry to map the table to perform necessary check/override before installing it.
When acpi_tb_parse_root_table() prints something through EFI earlyprintk console, we'll have 4 mapping entries used. The current 4 slots setting of early_ioremap() seems to be too small for such a use case.
"""
Thus increase the slot to 8 in this patch to fix this issue. boot-time mappings become 512 page with this patch.
--- arch/x86/include/asm/fixmap.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/x86/include/asm/fixmap.h +3 -3
@@ -123,14 +123,14 @@ enum fixed_addresses { __end_of_permanent_fixed_addresses,/* -* 256 temporary boot-time mappings, used by early_ioremap(), +* 512 temporary boot-time mappings, used by early_ioremap(), * before ioremap() is functional. * -* If necessary we round it up to the next 256 pages boundary so +* If necessary we round it up to the next 512 pages boundary so * that we can have a single pgd entry and a single pte table: */ #define NR_FIX_BTMAPS 64 -#define FIX_BTMAPS_SLOTS 4 +#define FIX_BTMAPS_SLOTS 8#define TOTAL_FIX_BTMAPS (NR_FIX_BTMAPS * FIX_BTMAPS_SLOTS) FIX_BTMAP_END = (__end_of_permanent_fixed_addresses ^
Greg Kroah-Hartman
maintainerPATCH 74/143 shmem: fix nlink for rename overwrite directory
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miklos Szeredi <[email protected]>
commit b928095b0a7cff7fb9fcf4c706348ceb8ab2c295 upstream.
If overwriting an empty directory with rename, then need to drop the extra nlink.
Test prog:
#include <stdio.h>
#include <fcntl.h>
#include <err.h>
#include <sys/stat.h>
int main(void)
{
const char *test_dir1 = "test-dir1";
const char *test_dir2 = "test-dir2";
int res;
int fd;
struct stat statbuf;
res = mkdir(test_dir1, 0777);
if (res == -1)
err(1, "mkdir(\"%s\")", test_dir1);
res = mkdir(test_dir2, 0777);
if (res == -1)
err(1, "mkdir(\"%s\")", test_dir2);
fd = open(test_dir2, O_RDONLY);
if (fd == -1)
err(1, "open(\"%s\")", test_dir2);
res = rename(test_dir1, test_dir2);
if (res == -1)
err(1, "rename(\"%s\", \"%s\")", test_dir1, test_dir2);
res = fstat(fd, &statbuf);
if (res == -1)
err(1, "fstat(%i)", fd);
if (statbuf.st_nlink != 0) {
fprintf(stderr, "nlink is %lu, should be 0\n", statbuf.st_nlink);
return 1;
}
return 0;
}--- mm/shmem.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
mm/shmem.c +3 -1
@@ -2128,8 +2128,10 @@ static int shmem_rename(struct inode *olif (new_dentry->d_inode) { (void )shmem_unlink (new_dir, new_dentry); -if (they_are_dirs) +if (they_are_dirs) { +drop_nlink (new_dentry->d_inode);drop_nlink (old_dir); + } }else if (they_are_dirs) {drop_nlink (old_dir);inc_nlink (new_dir);
Greg Kroah-Hartman
maintainerPATCH 75/143 ASoC: davinci-mcasp: Correct rx format unit configuration
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <[email protected]>
commit fe0a29e163a5d045c73faab682a8dac71c2f8012 upstream.
In case of capture we should not use rotation. The reverse and mask is enough to get the data align correctly from the bus to MCU:
Format data from bus after reverse (XRBUF) S16_LE: |LSB|MSB|xxx|xxx| |xxx|xxx|MSB|LSB| S24_3LE: |LSB|DAT|MSB|xxx| |xxx|MSB|DAT|LSB| S24_LE: |LSB|DAT|MSB|xxx| |xxx|MSB|DAT|LSB| S32_LE: |LSB|DAT|DAT|MSB| |MSB|DAT|DAT|LSB|
With this patch all supported formats will work for playback and capture.
--- sound/soc/davinci/davinci-mcasp.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
sound/soc/davinci/davinci-mcasp.c +10 -1
@@ -632,8 +632,17 @@ static int davinci_config_channel_size(s {u32 fmt;u32 tx_rotate = (word_length /4 ) &0x7 ; -u32 rx_rotate = (32 - word_length) /4 ;u32 mask = (1ULL << word_length) -1 ; +/* +* For captured data we should not rotate, inversion and masking is +* enoguh to get the data to the right position: +* Format data from bus after reverse (XRBUF) +* S16_LE: |LSB|MSB|xxx|xxx| |xxx|xxx|MSB|LSB| +* S24_3LE: |LSB|DAT|MSB|xxx| |xxx|MSB|DAT|LSB| +* S24_LE: |LSB|DAT|MSB|xxx| |xxx|MSB|DAT|LSB| +* S32_LE: |LSB|DAT|DAT|MSB| |MSB|DAT|DAT|LSB| +*/ +u32 rx_rotate =0 ;/* * if s BCLK-to-LRCLK ratio has been configured via the set_clkdiv()
Greg Kroah-Hartman
maintainerPATCH 76/143 CIFS: Fix directory rename error
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Shilovsky <[email protected]>
commit a07d322059db66b84c9eb4f98959df468e88b34b upstream.
CIFS servers process nlink counts differently for files and directories. In cifs_rename() if we the request fails on the existing target, we try to remove it through cifs_unlink() but this is not what we want to do for directories. As the result the following sequence of commands
mkdir {1,2}; mv -T 1 2; rmdir {1,2}; mkdir {1,2}; echo foo > 2/bar
and XFS test generic/023 fail with -ENOENT error. That's why the second mkdir reuses the existing inode (target inode of the mv -T command) with S_DEAD flag.
Fix this by checking whether the target is directory or not and calling cifs_rmdir() rather than cifs_unlink() for directories.
--- fs/cifs/inode.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
fs/cifs/inode.c +4 -1
@@ -1640,7 +1640,10 @@ cifs_rename(struct inode *source_dir, st unlink_target:/* Try unlinking the target dentry if it's not negative */ if (target_dentry->d_inode && (rc == -EACCES || rc == -EEXIST )) { - tmprc =cifs_unlink (target_dir, target_dentry); +if (S_ISDIR (target_dentry->d_inode->i_mode)) + tmprc =cifs_rmdir (target_dir, target_dentry); +else + tmprc =cifs_unlink (target_dir, target_dentry);if (tmprc) goto cifs_rename_exit; rc = cifs_do_rename(xid, source_dentry, from_name,
Greg Kroah-Hartman
maintainerPATCH 77/143 CIFS: Fix SMB2 readdir error handling
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Shilovsky <[email protected]>
commit 52755808d4525f4d5b86d112d36ffc7a46f3fb48 upstream.
SMB2 servers indicates the end of a directory search with STATUS_NO_MORE_FILE error code that is not processed now. This causes generic/257 xfstest to fail. Fix this by triggering the end of search by this error code in SMB2_query_directory.
Also when negotiating CIFS protocol we tell the server to close the search automatically at the end and there is no need to do it itself. In the case of SMB2 protocol, we need to close it explicitly - separate close directory checks for different protocols.
--- fs/cifs/cifsglob.h | 2 ++ fs/cifs/file.c | 2 +- fs/cifs/readdir.c | 2 +- fs/cifs/smb1ops.c | 7 +++++++ fs/cifs/smb2maperror.c | 2 +- fs/cifs/smb2ops.c | 8 ++++++++ fs/cifs/smb2pdu.c | 9 ++++----- 7 files changed, 24 insertions(+), 8 deletions(-)
fs/cifs/cifsglob.h +2 -0
@@ -375,6 +375,8 @@ struct smb_version_operations { const char *, u32 *);int (*set_acl)(struct cifs_ntsd *,__u32 ,struct inode *,const char *,int ); +/* check if we need to issue closedir */ +bool (*dir_needs_close)(struct cifsFileInfo *); };struct smb_version_values {
fs/cifs/file.c +1 -1
@@ -735,7 +735,7 @@ int cifs_closedir(struct inode *inode, scifs_dbg (FYI ,"Freeing private data in close dir\n" );spin_lock (&cifs_file_list_lock); -if (!cfile->srch_inf.endOfSearch && !cfile->invalidHandle) { +if (server->ops->dir_needs_close (cfile)) { cfile->invalidHandle = true;spin_unlock (&cifs_file_list_lock);if (server->ops->close_dir)
fs/cifs/readdir.c +1 -1
@@ -582,7 +582,7 @@ find_cifs_entry(const unsigned int xid,/* close and restart search */ cifs_dbg (FYI ,"search backing up - close and restart search\n" );spin_lock (&cifs_file_list_lock); -if (!cfile->srch_inf.endOfSearch && !cfile->invalidHandle) { +if (server->ops->dir_needs_close (cfile)) { cfile->invalidHandle = true;spin_unlock (&cifs_file_list_lock);if (server->ops->close_dir)
fs/cifs/smb1ops.c +7 -0
@@ -885,6 +885,12 @@ cifs_mand_lock(const unsigned int xid, s (__u8)type, wait, 0); } +static bool +cifs_dir_needs_close (struct cifsFileInfo *cfile) +{ +return !cfile->srch_inf.endOfSearch && !cfile->invalidHandle; +} +struct smb_version_operations smb1_operations = { .send_cancel = send_nt_cancel, .compare_fids = cifs_compare_fids,
@@ -948,6 +954,7 @@ struct smb_version_operations smb1_opera .mand_lock = cifs_mand_lock, .mand_unlock_range = cifs_unlock_range, .push_mand_locks = cifs_push_mandatory_locks, + .dir_needs_close = cifs_dir_needs_close, #ifdef CONFIG_CIFS_XATTR .query_all_EAs = CIFSSMBQAllEAs, .set_EA = CIFSSMBSetEA,
fs/cifs/smb2maperror.c +1 -1
@@ -214,7 +214,7 @@ static const struct status_to_posix_erro {STATUS_BREAKPOINT, -EIO, "STATUS_BREAKPOINT"}, {STATUS_SINGLE_STEP, -EIO, "STATUS_SINGLE_STEP"}, {STATUS_BUFFER_OVERFLOW, -EIO, "STATUS_BUFFER_OVERFLOW"}, - {STATUS_NO_MORE_FILES, -EIO, "STATUS_NO_MORE_FILES"}, + {STATUS_NO_MORE_FILES, -ENODATA, "STATUS_NO_MORE_FILES"}, {STATUS_WAKE_SYSTEM_DEBUGGER, -EIO, "STATUS_WAKE_SYSTEM_DEBUGGER"}, {STATUS_HANDLES_CLOSED, -EIO, "STATUS_HANDLES_CLOSED"}, {STATUS_NO_INHERITANCE, -EIO, "STATUS_NO_INHERITANCE"},
fs/cifs/smb2ops.c +8 -0
@@ -554,6 +554,12 @@ smb2_new_lease_key(struct cifs_fid *fid)get_random_bytes (fid->lease_key,SMB2_LEASE_KEY_SIZE ); } +static bool +smb2_dir_needs_close (struct cifsFileInfo *cfile) +{ +return !cfile->invalidHandle; +} +struct smb_version_operations smb21_operations = { .compare_fids = smb2_compare_fids, .setup_request = smb2_setup_request,
@@ -618,6 +624,7 @@ struct smb_version_operations smb21_oper .set_lease_key = smb2_set_lease_key, .new_lease_key = smb2_new_lease_key, .calc_signature = smb2_calc_signature, + .dir_needs_close = smb2_dir_needs_close, };
@@ -685,6 +692,7 @@ struct smb_version_operations smb30_oper .set_lease_key = smb2_set_lease_key, .new_lease_key = smb2_new_lease_key, .calc_signature = smb3_calc_signature, + .dir_needs_close = smb2_dir_needs_close, };struct smb_version_values smb20_values = {
fs/cifs/smb2pdu.c +4 -5
@@ -1800,6 +1800,10 @@ SMB2_query_directory(const unsigned int rsp = (struct smb2_query_directory_rsp *)iov[0 ].iov_base;if (rc) { +if (rc == -ENODATA && rsp->hdr.Status ==STATUS_NO_MORE_FILES ) { + srch_inf->endOfSearch = true; + rc =0 ; + }cifs_stats_fail_inc (tcon,SMB2_QUERY_DIRECTORY_HE ); goto qdir_exit; }
@@ -1837,11 +1841,6 @@ SMB2_query_directory(const unsigned intelse cifs_dbg (VFS ,"illegal search buffer type\n" ); -if (rsp->hdr.Status ==STATUS_NO_MORE_FILES ) - srch_inf->endOfSearch =1 ; -else - srch_inf->endOfSearch =0 ; -return rc; qdir_exit:
Greg Kroah-Hartman
maintainerPATCH 78/143 iio:trigger: modify return value for iio_trigger_get
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Pandruvada <[email protected]>
commit f153566570fb9e32c2f59182883f4f66048788fb upstream.
Instead of a void function, return the trigger pointer.
Whilst not in of itself a fix, this makes the following set of 7 fixes cleaner than they would otherwise be.
--- include/linux/iio/trigger.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
include/linux/iio/trigger.h +3 -1
@@ -83,10 +83,12 @@ static inline void iio_trigger_put(strucput_device (&trig->dev); } -static inline void iio_trigger_get (struct iio_trigger *trig) +static inline struct iio_trigger *iio_trigger_get (struct iio_trigger *trig) {get_device (&trig->dev);__module_get (trig->ops->owner); + +return trig; }/**
Greg Kroah-Hartman
maintainerPATCH 79/143 iio: gyro: itg3200: Fix indio_dev->trig assignment
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Pandruvada <[email protected]>
commit 0b4dce2ee694a991ef38203ec5ff91a738518cb3 upstream.
This can result in wrong reference count for trigger device, call iio_trigger_get to increment reference.
Refer to http://www.spinics.net/lists/linux-iio/msg13669.html for discussion with Jonathan.
--- drivers/iio/gyro/itg3200_buffer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/gyro/itg3200_buffer.c +1 -1
@@ -135,7 +135,7 @@ int itg3200_probe_trigger(struct iio_dev goto error_free_irq;/* select default trigger */ - indio_dev->trig = st->trig; + indio_dev->trig =iio_trigger_get (st->trig);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 80/143 iio: inv_mpu6050: Fix indio_dev->trig assignment
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Pandruvada <[email protected]>
commit b07e3b3850b2e1f09c19f54d3ed7210d9f529e2c upstream.
This can result in wrong reference count for trigger device, call iio_trigger_get to increment reference.
Refer to http://www.spinics.net/lists/linux-iio/msg13669.html for discussion with Jonathan.
--- drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c +1 -1
@@ -135,7 +135,7 @@ int inv_mpu6050_probe_trigger(struct iio ret =iio_trigger_register (st->trig);if (ret) goto error_free_irq; - indio_dev->trig = st->trig; + indio_dev->trig =iio_trigger_get (st->trig);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 81/143 iio: meter: ade7758: Fix indio_dev->trig assignment
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Pandruvada <[email protected]>
commit 0495081179212b758775df752e657ea71dcae020 upstream.
This can result in wrong reference count for trigger device, call iio_trigger_get to increment reference.
Refer to http://www.spinics.net/lists/linux-iio/msg13669.html for discussion with Jonathan.
--- drivers/staging/iio/meter/ade7758_trigger.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/iio/meter/ade7758_trigger.c +1 -1
@@ -85,7 +85,7 @@ int ade7758_probe_trigger(struct iio_dev ret =iio_trigger_register (st->trig);/* select default trigger */ - indio_dev->trig = st->trig; + indio_dev->trig =iio_trigger_get (st->trig);if (ret) goto error_free_irq;
Greg Kroah-Hartman
maintainerPATCH 82/143 iio: st_sensors: Fix indio_dev->trig assignment
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Pandruvada <[email protected]>
commit f0e84acd7056e6d7ade551c6439531606ae30a46 upstream.
This can result in wrong reference count for trigger device, call iio_trigger_get to increment reference.
Refer to http://www.spinics.net/lists/linux-iio/msg13669.html for discussion with Jonathan.
--- drivers/iio/common/st_sensors/st_sensors_trigger.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/common/st_sensors/st_sensors_trigger.c +1 -1
@@ -49,7 +49,7 @@ int st_sensors_allocate_trigger(struct idev_err (&indio_dev->dev,"failed to register iio trigger.\n" ); goto iio_trigger_register_error; } - indio_dev->trig = sdata->trig; + indio_dev->trig =iio_trigger_get (sdata->trig);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 83/143 iio: adc: ad_sigma_delta: Fix indio_dev->trig assignment
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Pandruvada <[email protected]>
commit 9e5846be33277802c0c76e5c12825d0e4d27f639 upstream.
This can result in wrong reference count for trigger device, call iio_trigger_get to increment reference.
Refer to http://www.spinics.net/lists/linux-iio/msg13669.html for discussion with Jonathan.
--- drivers/iio/adc/ad_sigma_delta.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/adc/ad_sigma_delta.c +1 -1
@@ -477,7 +477,7 @@ static int ad_sd_probe_trigger(struct ii goto error_free_irq;/* select default trigger */ - indio_dev->trig = sigma_delta->trig; + indio_dev->trig =iio_trigger_get (sigma_delta->trig);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 84/143 iio:magnetometer: bugfix magnetometers gain values
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Denis CIOCCA <[email protected]>
commit a31d0928999fbf33b3a6042e8bcb7b7f7e07d094 upstream.
This patch fix gains values. The first driver was designed using engineering samples, in mass production the values are changed.
--- drivers/iio/magnetometer/st_magn_core.c | 52 ++++++++++++++++++-------------- 1 file changed, 30 insertions(+), 22 deletions(-)
drivers/iio/magnetometer/st_magn_core.c +30 -22
@@ -40,7 +40,8 @@#define ST_MAGN_FS_AVL_5600MG 5600#define ST_MAGN_FS_AVL_8000MG 8000#define ST_MAGN_FS_AVL_8100MG 8100 -#define ST_MAGN_FS_AVL_10000MG 10000 +#define ST_MAGN_FS_AVL_12000MG 12000 +#define ST_MAGN_FS_AVL_16000MG 16000/* CUSTOM VALUES FOR SENSOR 1 */ #define ST_MAGN_1_WAI_EXP 0x3c
@@ -67,20 +68,20 @@#define ST_MAGN_1_FS_AVL_4700_VAL 0x05#define ST_MAGN_1_FS_AVL_5600_VAL 0x06#define ST_MAGN_1_FS_AVL_8100_VAL 0x07 -#define ST_MAGN_1_FS_AVL_1300_GAIN_XY 1100 -#define ST_MAGN_1_FS_AVL_1900_GAIN_XY 855 -#define ST_MAGN_1_FS_AVL_2500_GAIN_XY 670 -#define ST_MAGN_1_FS_AVL_4000_GAIN_XY 450 -#define ST_MAGN_1_FS_AVL_4700_GAIN_XY 400 -#define ST_MAGN_1_FS_AVL_5600_GAIN_XY 330 -#define ST_MAGN_1_FS_AVL_8100_GAIN_XY 230 -#define ST_MAGN_1_FS_AVL_1300_GAIN_Z 980 -#define ST_MAGN_1_FS_AVL_1900_GAIN_Z 760 -#define ST_MAGN_1_FS_AVL_2500_GAIN_Z 600 -#define ST_MAGN_1_FS_AVL_4000_GAIN_Z 400 -#define ST_MAGN_1_FS_AVL_4700_GAIN_Z 355 -#define ST_MAGN_1_FS_AVL_5600_GAIN_Z 295 -#define ST_MAGN_1_FS_AVL_8100_GAIN_Z 205 +#define ST_MAGN_1_FS_AVL_1300_GAIN_XY 909 +#define ST_MAGN_1_FS_AVL_1900_GAIN_XY 1169 +#define ST_MAGN_1_FS_AVL_2500_GAIN_XY 1492 +#define ST_MAGN_1_FS_AVL_4000_GAIN_XY 2222 +#define ST_MAGN_1_FS_AVL_4700_GAIN_XY 2500 +#define ST_MAGN_1_FS_AVL_5600_GAIN_XY 3030 +#define ST_MAGN_1_FS_AVL_8100_GAIN_XY 4347 +#define ST_MAGN_1_FS_AVL_1300_GAIN_Z 1020 +#define ST_MAGN_1_FS_AVL_1900_GAIN_Z 1315 +#define ST_MAGN_1_FS_AVL_2500_GAIN_Z 1666 +#define ST_MAGN_1_FS_AVL_4000_GAIN_Z 2500 +#define ST_MAGN_1_FS_AVL_4700_GAIN_Z 2816 +#define ST_MAGN_1_FS_AVL_5600_GAIN_Z 3389 +#define ST_MAGN_1_FS_AVL_8100_GAIN_Z 4878#define ST_MAGN_1_MULTIREAD_BIT false/* CUSTOM VALUES FOR SENSOR 2 */
@@ -103,10 +104,12 @@#define ST_MAGN_2_FS_MASK 0x60#define ST_MAGN_2_FS_AVL_4000_VAL 0x00#define ST_MAGN_2_FS_AVL_8000_VAL 0x01 -#define ST_MAGN_2_FS_AVL_10000_VAL 0x02 -#define ST_MAGN_2_FS_AVL_4000_GAIN 430 -#define ST_MAGN_2_FS_AVL_8000_GAIN 230 -#define ST_MAGN_2_FS_AVL_10000_GAIN 230 +#define ST_MAGN_2_FS_AVL_12000_VAL 0x02 +#define ST_MAGN_2_FS_AVL_16000_VAL 0x03 +#define ST_MAGN_2_FS_AVL_4000_GAIN 146 +#define ST_MAGN_2_FS_AVL_8000_GAIN 292 +#define ST_MAGN_2_FS_AVL_12000_GAIN 438 +#define ST_MAGN_2_FS_AVL_16000_GAIN 584#define ST_MAGN_2_MULTIREAD_BIT false#define ST_MAGN_2_OUT_X_L_ADDR 0x28#define ST_MAGN_2_OUT_Y_L_ADDR 0x2a
@@ -252,9 +255,14 @@ static const struct st_sensors st_magn_s .gain = ST_MAGN_2_FS_AVL_8000_GAIN, }, [2] = { - .num = ST_MAGN_FS_AVL_10000MG, - .value = ST_MAGN_2_FS_AVL_10000_VAL, - .gain = ST_MAGN_2_FS_AVL_10000_GAIN, + .num = ST_MAGN_FS_AVL_12000MG, + .value = ST_MAGN_2_FS_AVL_12000_VAL, + .gain = ST_MAGN_2_FS_AVL_12000_GAIN, + }, + [3] = { + .num = ST_MAGN_FS_AVL_16000MG, + .value = ST_MAGN_2_FS_AVL_16000_VAL, + .gain = ST_MAGN_2_FS_AVL_16000_GAIN, }, }, },
Greg Kroah-Hartman
maintainerPATCH 85/143 iio:inkern: fix overwritten -EPROBE_DEFER in of_iio_channel_get_by_name
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Pointner <[email protected]>
commit 872687f626e033b4ddfaec1e410057cfc6636d77 upstream.
which improperly assumes that of_iio_channel_get_by_name must always return NULL and thus now hides -EPROBE_DEFER.
--- drivers/iio/inkern.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/inkern.c +1 -1
@@ -178,7 +178,7 @@ static struct iio_channel *of_iio_channe index =of_property_match_string (np,"io-channel-names" , name); chan =of_iio_channel_get (np, index); -if (!IS_ERR (chan)) +if (!IS_ERR (chan) ||PTR_ERR (chan) == -EPROBE_DEFER )break ;else if (name && index >=0 ) { pr_err("ERROR: could not get IIO channel %s:%s(%i)\n",
Greg Kroah-Hartman
maintainerPATCH 86/143 Target/iser: Get isert_conn reference once got to connected_handler
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sagi Grimberg <[email protected]>
commit c2f88b17a1d97ca4ecd96cc22333a7a4f1407d39 upstream.
In case the connection didn't reach connected state, disconnected handler will never be invoked thus the second kref_put on isert_conn will be missing.
--- drivers/infiniband/ulp/isert/ib_isert.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/infiniband/ulp/isert/ib_isert.c +3 -2
@@ -404,7 +404,6 @@ isert_connect_request(struct rdma_cm_idinit_completion (&isert_conn->conn_wait);init_completion (&isert_conn->conn_wait_comp_err);kref_init (&isert_conn->conn_kref); -kref_get (&isert_conn->conn_kref);mutex_init (&isert_conn->conn_mutex); cma_id->context = isert_conn;
@@ -530,7 +529,9 @@ isert_connect_release(struct isert_connstatic void isert_connected_handler (struct rdma_cm_id *cma_id) { -return ; +struct isert_conn *isert_conn = cma_id->context; + +kref_get (&isert_conn->conn_kref); } static void
Greg Kroah-Hartman
maintainerPATCH 87/143 Target/iser: Dont put isert_conn inside disconnected handler
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sagi Grimberg <[email protected]>
commit 0fc4ea701fcf5bc51ace4e288af5be741465f776 upstream.
disconnected_handler is invoked on several CM events (such as DISCONNECTED, DEVICE_REMOVAL, TIMEWAIT_EXIT...). Since multiple events can occur while before isert_free_conn is invoked, we might put all isert_conn references and free the connection too early.
--- drivers/infiniband/ulp/isert/ib_isert.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/ulp/isert/ib_isert.c +1 -1
@@ -583,7 +583,6 @@ isert_disconnect_work(struct work_struct wake_up:complete (&isert_conn->conn_wait); -isert_put_conn (isert_conn); } static void
@@ -2266,6 +2265,7 @@ static void isert_wait_conn(struct iscsiwait_for_completion (&isert_conn->conn_wait_comp_err);wait_for_completion (&isert_conn->conn_wait); +isert_put_conn (isert_conn); }static void isert_free_conn (struct iscsi_conn *conn)
Greg Kroah-Hartman
maintainerPATCH 88/143 iscsi-target: avoid NULL pointer in iscsi_copy_param_list failure
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joern Engel <[email protected]>
commit 8ae757d09c45102b347a1bc2867f54ffc1ab8fda upstream.
In iscsi_copy_param_list() a failed iscsi_param_list memory allocation currently invokes iscsi_release_param_list() to cleanup, and will promptly trigger a NULL pointer dereference.
Instead, go ahead and return for the first iscsi_copy_param_list() failure case.
Found by coverity.
--- drivers/target/iscsi/iscsi_target_parameters.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/target/iscsi/iscsi_target_parameters.c +1 -1
@@ -603,7 +603,7 @@ int iscsi_copy_param_list( param_list =kzalloc (sizeof (struct iscsi_param_list ),GFP_KERNEL );if (!param_list) {pr_err ("Unable to allocate memory for struct iscsi_param_list.\n" ); - goto err_out; +return -1 ; }INIT_LIST_HEAD (¶m_list->param_list);INIT_LIST_HEAD (¶m_list->extra_response_list);
Greg Kroah-Hartman
maintainerPATCH 89/143 iscsi-target: Fix memory corruption in iscsit_logout_post_handler_diffcid
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Bellinger <[email protected]>
commit b53b0d99d6fbf7d44330395349a895521cfdbc96 upstream.
This patch fixes a bug in iscsit_logout_post_handler_diffcid() where a pointer used as storage for list_for_each_entry() was incorrectly being used to determine if no matching entry had been found.
This patch changes iscsit_logout_post_handler_diffcid() to key off bool conn_found to determine if the function needs to exit early.
--- drivers/target/iscsi/iscsi_target.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/target/iscsi/iscsi_target.c +3 -1
@@ -4453,6 +4453,7 @@ static void iscsit_logout_post_handler_d {struct iscsi_conn *l_conn;struct iscsi_session *sess = conn->sess; +bool conn_found = false;if (!sess)return ;
@@ -4461,12 +4462,13 @@ static void iscsit_logout_post_handler_dlist_for_each_entry (l_conn, &sess->sess_conn_list, conn_list) {if (l_conn->cid == cid) {iscsit_inc_conn_usage_count (l_conn); + conn_found = true;break ; } }spin_unlock_bh (&sess->conn_lock); -if (!l_conn) +if (!conn_found)return ;if (l_conn->sock)
Greg Kroah-Hartman
maintainerPATCH 90/143 NFC: microread: Potential overflows in microread_target_discovered()
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
commit d07f1e8600ccb885c8f4143402b8912f7d827bcb upstream.
Smatch says that skb->data is untrusted so we need to check to make sure that the memcpy() doesn't overflow.
--- drivers/nfc/microread/microread.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-)
drivers/nfc/microread/microread.c +12 -4
@@ -501,9 +501,13 @@ static void microread_target_discovered( targets->sens_res =be16_to_cpu (*(u16 *)&skb->data[MICROREAD_EMCF_A_ATQA ]); targets->sel_res = skb->data[MICROREAD_EMCF_A_SAK ]; -memcpy (targets->nfcid1, &skb->data[MICROREAD_EMCF_A_UID ], - skb->data[MICROREAD_EMCF_A_LEN ]); targets->nfcid1_len = skb->data[MICROREAD_EMCF_A_LEN ]; +if (targets->nfcid1_len >sizeof (targets->nfcid1)) { + r = -EINVAL ; + goto exit_free; + } +memcpy (targets->nfcid1, &skb->data[MICROREAD_EMCF_A_UID ], + targets->nfcid1_len);break ;case MICROREAD_GATE_ID_MREAD_ISO_A_3 : targets->supported_protocols =
@@ -511,9 +515,13 @@ static void microread_target_discovered( targets->sens_res =be16_to_cpu (*(u16 *)&skb->data[MICROREAD_EMCF_A3_ATQA ]); targets->sel_res = skb->data[MICROREAD_EMCF_A3_SAK ]; -memcpy (targets->nfcid1, &skb->data[MICROREAD_EMCF_A3_UID ], - skb->data[MICROREAD_EMCF_A3_LEN ]); targets->nfcid1_len = skb->data[MICROREAD_EMCF_A3_LEN ]; +if (targets->nfcid1_len >sizeof (targets->nfcid1)) { + r = -EINVAL ; + goto exit_free; + } +memcpy (targets->nfcid1, &skb->data[MICROREAD_EMCF_A3_UID ], + targets->nfcid1_len);break ;case MICROREAD_GATE_ID_MREAD_ISO_B : targets->supported_protocols =NFC_PROTO_ISO14443_B_MASK ;
Greg Kroah-Hartman
maintainerPATCH 91/143 SCSI: libiscsi: fix potential buffer overrun in __iscsi_conn_send_pdu
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Christie <[email protected]>
commit db9bfd64b14a3a8f1868d2164518fdeab1b26ad1 upstream.
This patches fixes a potential buffer overrun in __iscsi_conn_send_pdu. This function is used by iscsi drivers and userspace to send iscsi PDUs/ commands. For login commands, we have a set buffer size. For all other commands we do not support data buffers.
This was reported by Dan Carpenter here:
http://www.spinics.net/lists/linux-scsi/msg66838.html
--- drivers/scsi/libiscsi.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/scsi/libiscsi.c +10 -0
@@ -717,11 +717,21 @@ __iscsi_conn_send_pdu(struct iscsi_connreturn NULL ; } +if (data_size >ISCSI_DEF_MAX_RECV_SEG_LEN ) { +iscsi_conn_printk (KERN_ERR , conn,"Invalid buffer len of %u for login task. Max len is %u\n" , data_size,ISCSI_DEF_MAX_RECV_SEG_LEN ); +return NULL ; + } + task = conn->login_task; }else {if (session->state !=ISCSI_STATE_LOGGED_IN )return NULL ; +if (data_size !=0 ) { +iscsi_conn_printk (KERN_ERR , conn,"Can not send data buffer of len %u for op 0x%x\n" , data_size, opcode); +return NULL ; + } +BUG_ON (conn->c_stage ==ISCSI_CONN_INITIAL_STAGE );BUG_ON (conn->c_stage ==ISCSI_CONN_STOPPED );
Greg Kroah-Hartman
maintainerPATCH 92/143 Revert "iwlwifi: dvm: dont enable CTS to self"
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emmanuel Grumbach <[email protected]>
commit f47f46d7b09cf1d09e4b44b6cc4dd7d68a08028c upstream.
This reverts commit 43d826ca5979927131685cc2092c7ce862cb91cd.
This commit caused packet loss.
--- drivers/net/wireless/iwlwifi/dvm/rxon.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/net/wireless/iwlwifi/dvm/rxon.c +12 -0
@@ -1072,6 +1072,13 @@ int iwlagn_commit_rxon(struct iwl_priv */* recalculate basic rates */ iwl_calc_basic_rates (priv, ctx); +/* +* force CTS-to-self frames protection if RTS-CTS is not preferred +* one aggregation protection method +*/ +if (!priv->hw_params.use_rts_for_aggregation) + ctx->staging.flags |=RXON_FLG_SELF_CTS_EN ; +if ((ctx->vif && ctx->vif->bss_conf.use_short_slot) || !(ctx->staging.flags &RXON_FLG_BAND_24G_MSK )) ctx->staging.flags |=RXON_FLG_SHORT_SLOT_MSK ;
@@ -1477,6 +1484,11 @@ void iwlagn_bss_info_changed(struct ieeeelse ctx->staging.flags &= ~RXON_FLG_TGG_PROTECT_MSK ; +if (bss_conf->use_cts_prot) + ctx->staging.flags |=RXON_FLG_SELF_CTS_EN ; +else + ctx->staging.flags &= ~RXON_FLG_SELF_CTS_EN ; +memcpy (ctx->staging.bssid_addr, bss_conf->bssid,ETH_ALEN ); if (vif->type == NL80211_IFTYPE_AP ||
Greg Kroah-Hartman
maintainerPATCH 93/143 workqueue: apply __WQ_ORDERED to create_singlethread_workqueue()
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <[email protected]>
commit e09c2c295468476a239d13324ce9042ec4de05eb upstream.
create_singlethread_workqueue() is a compat interface for single threaded workqueue which maps to ordered workqueue w/ rescuer in the current implementation. create_singlethread_workqueue() currently implemented by invoking alloc_workqueue() w/ appropriate parameters.
8719dceae2f9 ("workqueue: reject adjusting max_active or applying attrs to ordered workqueues") introduced __WQ_ORDERED to protect ordered workqueues against dynamic attribute changes which can break ordering guarantees but forgot to apply it to create_singlethread_workqueue(). This in itself is okay as nobody currently uses dynamic attribute change on workqueues created with create_singlethread_workqueue().
However, 4c16bd327c ("workqueue: implement NUMA affinity for unbound workqueues") broke singlethreaded guarantee for ordered workqueues through allocating a separate pool_workqueue on each NUMA node by default. A later change 8a2b75384444 ("workqueue: fix ordered workqueues in NUMA setups") fixed it by allocating only one global pool_workqueue if __WQ_ORDERED is set.
Combined, the __WQ_ORDERED omission in create_singlethread_workqueue() became critical breaking its single threadedness and ordering guarantee.
Let's make create_singlethread_workqueue() wrap alloc_ordered_workqueue() instead so that it inherits __WQ_ORDERED and can implicitly track future ordered_workqueue changes.
v2: I missed that __WQ_ORDERED now protects against pwq splitting
across NUMA nodes and incorrectly described the patch as a nice-to-have fix to protect against future dynamic attribute usages. Oleg pointed out that this is actually a critical breakage due to 8a2b75384444 ("workqueue: fix ordered workqueues in NUMA setups").
--- include/linux/workqueue.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/workqueue.h +1 -1
@@ -414,7 +414,7 @@ __alloc_workqueue_key(const char *fmt, u#define create_freezable_workqueue (name) \ alloc_workqueue((name), WQ_FREEZABLE | WQ_UNBOUND | WQ_MEM_RECLAIM, 1)#define create_singlethread_workqueue (name) \ - alloc_workqueue((name), WQ_UNBOUND | WQ_MEM_RECLAIM, 1) + alloc_ordered_workqueue("%s", WQ_MEM_RECLAIM, name)extern void destroy_workqueue (struct workqueue_struct *wq);
Greg Kroah-Hartman
maintainerPATCH 94/143 block: Fix dev_t minor allocation lifetime
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keith Busch <[email protected]>
commit 2da78092dda13f1efd26edbbf99a567776913750 upstream.
Releases the dev_t minor when all references are closed to prevent another device from acquiring the same major/minor.
Since the partition's release may be invoked from call_rcu's soft-irq context, the ext_dev_idr's mutex had to be replaced with a spinlock so as not so sleep.
--- block/genhd.c | 24 ++++++++++++++---------- block/partition-generic.c | 2 +- 2 files changed, 15 insertions(+), 11 deletions(-)
block/genhd.c +14 -10
@@ -28,10 +28,10 @@ struct kobject *block_depr;/* for extended dynamic devt allocation, currently only one major is used */ #define NR_EXT_DEVT (1 << MINORBITS) -/* For extended devt allocation. ext_devt_mutex prevents look up +/* For extended devt allocation. ext_devt_lock prevents look up * results from going away underneath its user. */ -static DEFINE_MUTEX (ext_devt_mutex); +static DEFINE_SPINLOCK (ext_devt_lock);static DEFINE_IDR (ext_devt_idr);static struct device_type disk_type;
@@ -420,9 +420,13 @@ int blk_alloc_devt(struct hd_struct *par }/* allocate ext devt */ -mutex_lock (&ext_devt_mutex); - idx =idr_alloc (&ext_devt_idr, part,0 ,NR_EXT_DEVT ,GFP_KERNEL ); -mutex_unlock (&ext_devt_mutex); +idr_preload (GFP_KERNEL ); + +spin_lock (&ext_devt_lock); + idx =idr_alloc (&ext_devt_idr, part,0 ,NR_EXT_DEVT ,GFP_NOWAIT ); +spin_unlock (&ext_devt_lock); + +idr_preload_end ();if (idx <0 )return idx == -ENOSPC ? -EBUSY : idx;
@@ -447,9 +451,9 @@ void blk_free_devt(dev_t devt)return ;if (MAJOR (devt) ==BLOCK_EXT_MAJOR ) { -mutex_lock (&ext_devt_mutex); +spin_lock (&ext_devt_lock);idr_remove (&ext_devt_idr,blk_mangle_minor (MINOR (devt))); -mutex_unlock (&ext_devt_mutex); +spin_unlock (&ext_devt_lock); } }
@@ -665,7 +669,6 @@ void del_gendisk(struct gendisk *disk)sysfs_remove_link (block_depr,dev_name (disk_to_dev (disk)));pm_runtime_set_memalloc_noio (disk_to_dev (disk), false);device_del (disk_to_dev (disk)); -blk_free_devt (disk_to_dev (disk)->devt); }EXPORT_SYMBOL (del_gendisk);
@@ -690,13 +693,13 @@ struct gendisk *get_gendisk(dev_t devt, }else {struct hd_struct *part; -mutex_lock (&ext_devt_mutex); +spin_lock (&ext_devt_lock); part =idr_find (&ext_devt_idr,blk_mangle_minor (MINOR (devt)));if (part &&get_disk (part_to_disk (part))) { *partno = part->partno; disk =part_to_disk (part); } -mutex_unlock (&ext_devt_mutex); +spin_unlock (&ext_devt_lock); }return disk;
@@ -1098,6 +1101,7 @@ static void disk_release(struct device * {struct gendisk *disk =dev_to_disk (dev); +blk_free_devt (dev->devt);disk_release_events (disk);kfree (disk->random);disk_replace_part_tbl (disk,NULL );
block/partition-generic.c +1 -1
@@ -211,6 +211,7 @@ static const struct attribute_group *parstatic void part_release (struct device *dev) {struct hd_struct *p =dev_to_part (dev); +blk_free_devt (dev->devt);free_part_stats (p);free_part_info (p);kfree (p);
@@ -253,7 +254,6 @@ void delete_partition(struct gendisk *dircu_assign_pointer (ptbl->last_lookup,NULL );kobject_put (part->holder_dir);device_del (part_to_dev (part)); -blk_free_devt (part_devt (part));hd_struct_put (part); }
Greg Kroah-Hartman
maintainerPATCH 95/143 dm crypt: fix access beyond the end of allocated space
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <[email protected]>
commit d49ec52ff6ddcda178fc2476a109cf1bd1fa19ed upstream.
The DM crypt target accesses memory beyond allocated space resulting in a crash on 32 bit x86 systems.
This bug is very old (it dates back to 2.6.25 commit 3a7f6c990ad04 "dm
crypt: use async crypto"). However, this bug was masked by the fact that kmalloc rounds the size up to the next power of two. This bug wasn't exposed until 3.17-rc1 commit 298a9fa08a ("dm crypt: use per-bio data"). By switching to using per-bio data there was no longer any padding beyond the end of a dm-crypt allocated memory block.
To minimize allocation overhead dm-crypt puts several structures into one block allocated with kmalloc. The block holds struct ablkcipher_request, cipher-specific scratch pad (crypto_ablkcipher_reqsize(any_tfm(cc))), struct dm_crypt_request and an initialization vector.
The variable dmreq_start is set to offset of struct dm_crypt_request within this memory block. dm-crypt allocates the block with this size:cc->dmreq_start + sizeof(struct dm_crypt_request) + cc->iv_size.
When accessing the initialization vector, dm-crypt uses the function iv_of_dmreq, which performs this calculation: ALIGN((unsigned long)(dmreq
+ 1), crypto_ablkcipher_alignmask(any_tfm(cc)) + 1).
dm-crypt allocated "cc->iv_size" bytes beyond the end of dm_crypt_request structure. However, when dm-crypt accesses the initialization vector, it takes a pointer to the end of dm_crypt_request, aligns it, and then uses it as the initialization vector. If the end of dm_crypt_request is not aligned on a crypto_ablkcipher_alignmask(any_tfm(cc)) boundary the alignment causes the initialization vector to point beyond the allocated space.
Fix this bug by calculating the variable iv_size_padding and adding it to the allocated size.
Also correct the alignment of dm_crypt_request. struct dm_crypt_request is specific to dm-crypt (it isn't used by the crypto subsystem at all), so it is aligned on __alignof__(struct dm_crypt_request).
Also align per_bio_data_size on ARCH_KMALLOC_MINALIGN, so that it is aligned as if the block was allocated with kmalloc.
--- drivers/md/dm-crypt.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-)
drivers/md/dm-crypt.c +16 -4
@@ -1506,6 +1506,7 @@ static int crypt_ctr(struct dm_target *tunsigned int key_size, opt_params;unsigned long long tmpll;int ret; +size_t iv_size_padding;struct dm_arg_set as;const char *opt_string;char dummy;
@@ -1542,12 +1543,23 @@ static int crypt_ctr(struct dm_target *t cc->dmreq_start =sizeof (struct ablkcipher_request ); cc->dmreq_start +=crypto_ablkcipher_reqsize (any_tfm (cc)); - cc->dmreq_start =ALIGN (cc->dmreq_start,crypto_tfm_ctx_alignment ()); - cc->dmreq_start +=crypto_ablkcipher_alignmask (any_tfm (cc)) & - ~(crypto_tfm_ctx_alignment () -1 ); + cc->dmreq_start =ALIGN (cc->dmreq_start, __alignof__(struct dm_crypt_request )); + +if (crypto_ablkcipher_alignmask (any_tfm (cc)) <CRYPTO_MINALIGN ) { +/* Allocate the padding exactly */ + iv_size_padding = -(cc->dmreq_start +sizeof (struct dm_crypt_request )) + &crypto_ablkcipher_alignmask (any_tfm (cc)); + }else { +/* +* If the cipher requires greater alignment than kmalloc +* alignment, we don't know the exact position of the +* initialization vector. We must assume worst case. +*/ + iv_size_padding =crypto_ablkcipher_alignmask (any_tfm (cc)); + } cc->req_pool =mempool_create_kmalloc_pool (MIN_IOS , cc->dmreq_start + -sizeof (struct dm_crypt_request ) + cc->iv_size); +sizeof (struct dm_crypt_request ) + iv_size_padding + cc->iv_size);if (!cc->req_pool) { ti->error ="Cannot allocate crypt request mempool" ; goto bad;
Greg Kroah-Hartman
maintainerPATCH 96/143 Input: serport - add compat handling for SPIOCSTYPE ioctl
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Sung <[email protected]>
commit a80d8b02751060a178bb1f7a6b7a93645a7a308b upstream.
When running a 32-bit inputattach utility in a 64-bit system, there will be error code "inputattach: can't set device type". This is caused by the serport device driver not supporting compat_ioctl, so that SPIOCSTYPE ioctl fails.
--- drivers/input/serio/serport.c | 45 +++++++++++++++++++++++++++++++++++------- 1 file changed, 38 insertions(+), 7 deletions(-)
drivers/input/serio/serport.c +38 -7
@@ -21,6 +21,7 @@#include <linux/init.h> #include <linux/serio.h> #include <linux/tty.h> +#include <linux/compat.h> MODULE_AUTHOR ("Vojtech Pavlik <[email protected]>" );MODULE_DESCRIPTION ("Input device TTY line discipline" );
@@ -196,28 +197,55 @@ static ssize_t serport_ldisc_read(structreturn 0 ; } +static void serport_set_type (struct tty_struct *tty,unsigned long type) +{ +struct serport *serport = tty->disc_data; + + serport->id.proto = type &0x000000ff ; + serport->id.id = (type &0x0000ff00 ) >>8 ; + serport->id.extra = (type &0x00ff0000 ) >>16 ; +} +/* * serport_ldisc_ioctl() allows to set the port protocol, and device ID */ -static int serport_ldisc_ioctl (struct tty_struct * tty,struct file * file,unsigned int cmd,unsigned long arg) +static int serport_ldisc_ioctl (struct tty_struct *tty,struct file *file, +unsigned int cmd,unsigned long arg) { -struct serport *serport = (struct serport *) tty->disc_data; -unsigned long type; -if (cmd ==SPIOCSTYPE ) { +unsigned long type; +if (get_user (type, (unsigned long __user *) arg))return -EFAULT ; - serport->id.proto = type &0x000000ff ; - serport->id.id = (type &0x0000ff00 ) >>8 ; - serport->id.extra = (type &0x00ff0000 ) >>16 ; +serport_set_type (tty, type); +return 0 ; + } + +return -EINVAL ; +} + +#ifdef CONFIG_COMPAT +#define COMPAT_SPIOCSTYPE _IOW('q', 0x01, compat_ulong_t) +static long serport_ldisc_compat_ioctl (struct tty_struct *tty, +struct file *file, +unsigned int cmd,unsigned long arg) +{ +if (cmd ==COMPAT_SPIOCSTYPE ) { +void __user *uarg =compat_ptr (arg); +compat_ulong_t compat_type; + +if (get_user (compat_type, (compat_ulong_t __user *)uarg)) +return -EFAULT ; +serport_set_type (tty, compat_type);return 0 ; }return -EINVAL ; } +#endif static void serport_ldisc_write_wakeup (struct tty_struct * tty) {
@@ -241,6 +269,9 @@ static struct tty_ldisc_ops serport_ldis .close = serport_ldisc_close, .read = serport_ldisc_read, .ioctl = serport_ldisc_ioctl, +#ifdef CONFIG_COMPAT + .compat_ioctl = serport_ldisc_compat_ioctl, +#endif .receive_buf = serport_ldisc_receive, .write_wakeup = serport_ldisc_write_wakeup };
Greg Kroah-Hartman
maintainerPATCH 97/143 Input: synaptics - add support for ForcePads
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <[email protected]>
commit 5715fc764f7753d464dbe094b5ef9cffa6e479a4 upstream.
ForcePads are found on HP EliteBook 1040 laptops. They lack any kind of physical buttons, instead they generate primary button click when user presses somewhat hard on the surface of the touchpad. Unfortunately they also report primary button click whenever there are 2 or more contacts on the pad, messing up all multi-finger gestures (2-finger scrolling, multi-finger tapping, etc). To cope with this behavior we introduce a delay (currently 50 msecs) in reporting primary press in case more contacts appear.
--- drivers/input/mouse/synaptics.c | 68 ++++++++++++++++++++++++++++++---------- drivers/input/mouse/synaptics.h | 11 ++++++ 2 files changed, 63 insertions(+), 16 deletions(-)
drivers/input/mouse/synaptics.c +52 -16
@@ -549,10 +549,61 @@ static int synaptics_parse_hw_state(cons ((buf[0 ] &0x04 ) >>1 ) | ((buf[3] & 0x04) >> 2)); +if ((SYN_CAP_ADV_GESTURE (priv->ext_cap_0c) || +SYN_CAP_IMAGE_SENSOR (priv->ext_cap_0c)) && + hw->w ==2 ) { +synaptics_parse_agm (buf, priv, hw); +return 1 ; + } + + hw->x = (((buf[3 ] &0x10 ) <<8 ) | + ((buf[1 ] &0x0f ) <<8 ) | + buf[4 ]); + hw->y = (((buf[3 ] &0x20 ) <<7 ) | + ((buf[1 ] &0xf0 ) <<4 ) | + buf[5 ]); + hw->z = buf[2 ]; + hw->left = (buf[0 ] &0x01 ) ?1 :0 ; hw->right = (buf[0 ] &0x02 ) ?1 :0 ; -if (SYN_CAP_CLICKPAD (priv->ext_cap_0c)) { +if (SYN_CAP_FORCEPAD (priv->ext_cap_0c)) { +/* +* ForcePads, like Clickpads, use middle button +* bits to report primary button clicks. +* Unfortunately they report primary button not +* only when user presses on the pad above certain +* threshold, but also when there are more than one +* finger on the touchpad, which interferes with +* out multi-finger gestures. +*/ +if (hw->z ==0 ) { +/* No contacts */ + priv->press = priv->report_press = false; + }else if (hw->w >=4 && ((buf[0 ] ^ buf[3 ]) &0x01 )) { +/* +* Single-finger touch with pressure above +* the threshold. If pressure stays long +* enough, we'll start reporting primary +* button. We rely on the device continuing +* sending data even if finger does not +* move. +*/ +if (!priv->press) { + priv->press_start = jiffies; + priv->press = true; + }else if (time_after (jiffies, + priv->press_start + +msecs_to_jiffies (50 ))) { + priv->report_press = true; + } + }else { + priv->press = false; + } + + hw->left = priv->report_press; + + }else if (SYN_CAP_CLICKPAD (priv->ext_cap_0c)) {/* * Clickpad's button is transmitted as middle button, * however, since it is primary button, we will report
@@ -571,21 +622,6 @@ static int synaptics_parse_hw_state(cons hw->down = ((buf[0 ] ^ buf[3 ]) &0x02 ) ?1 :0 ; } -if ((SYN_CAP_ADV_GESTURE (priv->ext_cap_0c) || -SYN_CAP_IMAGE_SENSOR (priv->ext_cap_0c)) && - hw->w ==2 ) { -synaptics_parse_agm (buf, priv, hw); -return 1 ; - } - - hw->x = (((buf[3 ] &0x10 ) <<8 ) | - ((buf[1 ] &0x0f ) <<8 ) | - buf[4 ]); - hw->y = (((buf[3 ] &0x20 ) <<7 ) | - ((buf[1 ] &0xf0 ) <<4 ) | - buf[5 ]); - hw->z = buf[2 ]; -if (SYN_CAP_MULTI_BUTTON_NO (priv->ext_cap) && ((buf[0 ] ^ buf[3 ]) &0x02 )) {switch (SYN_CAP_MULTI_BUTTON_NO (priv->ext_cap) & ~0x01 ) {
drivers/input/mouse/synaptics.h +11 -0
@@ -78,6 +78,11 @@* 2 0x08 image sensor image sensor tracks 5 fingers, but only * reports 2. * 2 0x20 report min query 0x0f gives min coord reported +* 2 0x80 forcepad forcepad is a variant of clickpad that +* does not have physical buttons but rather +* uses pressure above certain threshold to +* report primary clicks. Forcepads also have +* clickpad bit set. */ #define SYN_CAP_CLICKPAD (ex0c) ((ex0c) & 0x100000)/* 1-button ClickPad */ #define SYN_CAP_CLICKPAD2BTN (ex0c) ((ex0c) & 0x000100)/* 2-button ClickPad */
@@ -86,6 +91,7 @@#define SYN_CAP_ADV_GESTURE (ex0c) ((ex0c) & 0x080000)#define SYN_CAP_REDUCED_FILTERING (ex0c) ((ex0c) & 0x000400)#define SYN_CAP_IMAGE_SENSOR (ex0c) ((ex0c) & 0x000800) +#define SYN_CAP_FORCEPAD (ex0c) ((ex0c) & 0x008000)/* synaptics modes query bits */ #define SYN_MODE_ABSOLUTE (m) ((m) & (1 << 7))
@@ -177,6 +183,11 @@ struct synaptics_data {*/ struct synaptics_hw_state agm;bool agm_pending;/* new AGM packet received */ + +/* ForcePad handling */ +unsigned long press_start; +bool press; +bool report_press; };void synaptics_module_init (void );
Greg Kroah-Hartman
maintainerPATCH 99/143 Input: atkbd - do not try deactivate keyboard on any LG laptops
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <[email protected]>
commit c01206796139e2b1feb7539bc72174fef1c6dc6e upstream.
We are getting more and more reports about LG laptops not having functioning keyboard if we try to deactivate keyboard during probe. Given that having keyboard deactivated is merely "nice to have" instead of a hard requirement for probing, let's disable it on all LG boxes instead of trying to hunt down particular models.
This change is prompted by patches trying to add "LG Electronics"/"ROCKY" and "LG Electronics"/"LW60-F27B" to the DMI list.
https://bugzilla.kernel.org/show_bug.cgi?id=77051
--- drivers/input/keyboard/atkbd.c | 8 -------- 1 file changed, 8 deletions(-)
drivers/input/keyboard/atkbd.c +0 -8
@@ -1791,14 +1791,6 @@ static const struct dmi_system_id atkbd_ { .matches = { DMI_MATCH(DMI_SYS_VENDOR, "LG Electronics"), - DMI_MATCH(DMI_PRODUCT_NAME, "LW25-B7HV"), - }, - .callback = atkbd_deactivate_fixup, - }, - { - .matches = { - DMI_MATCH(DMI_SYS_VENDOR, "LG Electronics"), - DMI_MATCH(DMI_PRODUCT_NAME, "P1-J273B"), }, .callback = atkbd_deactivate_fixup, },
Greg Kroah-Hartman
maintainerPATCH 100/143 Input: i8042 - add Fujitsu U574 to no_timeout dmi table
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
commit cc18a69c92d0972bc2fc5a047ee3be1e8398171b upstream.
https://bugzilla.kernel.org/show_bug.cgi?id=69731
--- drivers/input/serio/i8042-x86ia64io.h | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/input/serio/i8042-x86ia64io.h +8 -0
@@ -601,6 +601,14 @@ static const struct dmi_system_id __init DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dv4 Notebook PC"), }, }, + { + /* Fujitsu U574 laptop */ + /* https://bugzilla.kernel.org/show_bug.cgi?id=69731 */ + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"), + DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK U574"), + }, + }, { } };
Greg Kroah-Hartman
maintainerPATCH 101/143 Input: i8042 - add nomux quirk for Avatar AVIU-145A6
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
commit d2682118f4bb3ceb835f91c1a694407a31bb7378 upstream.
The sys_vendor / product_name are somewhat generic unfortunately, so this may lead to some false positives. But nomux usually does no harm, where as not having it clearly is causing problems on the Avatar AVIU-145A6.
https://bugzilla.kernel.org/show_bug.cgi?id=77391
--- drivers/input/serio/i8042-x86ia64io.h | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/input/serio/i8042-x86ia64io.h +7 -0
@@ -458,6 +458,13 @@ static const struct dmi_system_id __init DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dv4 Notebook PC"), }, }, + { + /* Avatar AVIU-145A6 */ + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Intel"), + DMI_MATCH(DMI_PRODUCT_NAME, "IC4I"), + }, + }, { } };
Greg Kroah-Hartman
maintainerPATCH 102/143 ata_piix: Add Device IDs for Intel 9 Series PCH
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Ralston <[email protected]>
commit 6cad1376954e591c3c41500c4e586e183e7ffe6d upstream.
This patch adds the IDE mode SATA Device IDs for the Intel 9 Series PCH.
--- drivers/ata/ata_piix.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/ata/ata_piix.c +8 -0
@@ -340,6 +340,14 @@ static const struct pci_device_id piix_p { 0x8086, 0x0F21, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata_byt },/* SATA Controller IDE (Coleto Creek) */ { 0x8086, 0x23a6, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata }, +/* SATA Controller IDE (9 Series) */ + { 0x8086, 0x8c88, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata_snb }, +/* SATA Controller IDE (9 Series) */ + { 0x8086, 0x8c89, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata_snb }, +/* SATA Controller IDE (9 Series) */ + { 0x8086, 0x8c80, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_snb }, +/* SATA Controller IDE (9 Series) */ + { 0x8086, 0x8c81, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_snb }, { } /* terminate list */ };
Greg Kroah-Hartman
maintainerPATCH 103/143 percpu: free percpu allocation info for uniprocessor system
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Honggang Li <[email protected]>
commit 3189eddbcafcc4d827f7f19facbeddec4424eba8 upstream.
Currently, only SMP system free the percpu allocation info. Uniprocessor system should free it too. For example, one x86 UML virtual machine with 256MB memory, UML kernel wastes one page memory.
--- mm/percpu.c | 2 ++ 1 file changed, 2 insertions(+)
mm/percpu.c +2 -0
@@ -1910,6 +1910,8 @@ void __init setup_per_cpu_areas(void)if (pcpu_setup_first_chunk (ai, fc) <0 )panic ("Failed to initialize percpu areas." ); + + pcpu_free_alloc_info(ai); }#endif /* CONFIG_SMP */
Greg Kroah-Hartman
maintainerPATCH 104/143 percpu: fix pcpu_alloc_pages() failure path
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <[email protected]>
commit f0d279654dea22b7a6ad34b9334aee80cda62cde upstream.
When pcpu_alloc_pages() fails midway, pcpu_free_pages() is invoked to free what has already been allocated. The invocation is across the whole requested range and pcpu_free_pages() will try to free all non-NULL pages; unfortunately, this is incorrect as pcpu_get_pages_and_bitmap(), unlike what its comment suggests, doesn't clear the pages array and thus the array may have entries from the previous invocations making the partial failure path free incorrect pages.
Fix it by open-coding the partial freeing of the already allocated pages.
--- mm/percpu-vm.c | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-)
mm/percpu-vm.c +15 -6
@@ -108,7 +108,7 @@ static int pcpu_alloc_pages(struct pcpu_ int page_start, int page_end) {const gfp_t gfp =GFP_KERNEL | __GFP_HIGHMEM | __GFP_COLD; -unsigned int cpu; +unsigned int cpu, tcpu;int i;for_each_possible_cpu (cpu) {
@@ -116,14 +116,23 @@ static int pcpu_alloc_pages(struct pcpu_struct page **pagep = &pages[pcpu_page_idx (cpu, i)]; *pagep =alloc_pages_node (cpu_to_node (cpu), gfp,0 ); -if (!*pagep) { -pcpu_free_pages (chunk, pages, populated, - page_start, page_end); -return -ENOMEM ; - } +if (!*pagep) + goto err; } }return 0 ; + +err: +while (--i >= page_start) +__free_page (pages[pcpu_page_idx (cpu, i)]); + +for_each_possible_cpu (tcpu) { +if (tcpu == cpu) +break ; +for (i = page_start; i < page_end; i++) +__free_page (pages[pcpu_page_idx (tcpu, i)]); + } +return -ENOMEM ; }/**
Greg Kroah-Hartman
maintainerPATCH 105/143 percpu: perform tlb flush after pcpu_map_pages() failure
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <[email protected]>
commit 849f5169097e1ba35b90ac9df76b5bb6f9c0aabd upstream.
If pcpu_map_pages() fails midway, it unmaps the already mapped pages. Currently, it doesn't flush tlb after the partial unmapping. This may be okay in most cases as the established mapping hasn't been used at that point but it can go wrong and when it goes wrong it'd be extremely difficult to track down.
Flush tlb after the partial unmapping.
--- mm/percpu-vm.c | 1 + 1 file changed, 1 insertion(+)
mm/percpu-vm.c +1 -0
@@ -272,6 +272,7 @@ err:__pcpu_unmap_pages (pcpu_chunk_addr (chunk, tcpu, page_start), page_end - page_start); } +pcpu_post_unmap_tlb_flush (chunk, page_start, page_end);return err; }
Greg Kroah-Hartman
maintainerPATCH 106/143 rtlwifi: rtl8192cu: Add new ID
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Larry Finger <[email protected]>
commit c66517165610b911e4c6d268f28d8c640832dbd1 upstream.
The Sitecom WLA-2102 adapter uses this driver.
--- drivers/net/wireless/rtlwifi/rtl8192cu/sw.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/rtlwifi/rtl8192cu/sw.c +1 -0
@@ -316,6 +316,7 @@ static struct usb_device_id rtl8192c_usb {RTL_USB_DEVICE(0x0bda, 0x5088, rtl92cu_hal_cfg)}, /*Thinkware-CC&C*/ {RTL_USB_DEVICE(0x0df6, 0x0052, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/ {RTL_USB_DEVICE(0x0df6, 0x005c, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/ + {RTL_USB_DEVICE(0x0df6, 0x0070, rtl92cu_hal_cfg)}, /*Sitecom - 150N */ {RTL_USB_DEVICE(0x0df6, 0x0077, rtl92cu_hal_cfg)}, /*Sitecom-WLA2100V2*/ {RTL_USB_DEVICE(0x0eb0, 0x9071, rtl92cu_hal_cfg)}, /*NO Brand - Etop*/ {RTL_USB_DEVICE(0x4856, 0x0091, rtl92cu_hal_cfg)}, /*NetweeN - Feixun*/
Greg Kroah-Hartman
maintainerPATCH 107/143 lockd: fix rpcbind crash on lockd startup failure
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: "J. Bruce Fields" <[email protected]>
commit 7c17705e77b12b20fb8afb7c1b15dcdb126c0c12 upstream.
Nikita Yuschenko reported that booting a kernel with init=/bin/sh and then nfs mounting without portmap or rpcbind running using a busybox mount resulted in:
# mount -t nfs 10.30.130.21:/opt /mnt svc: failed to register lockdv1 RPC service (errno 111). lockd_up: makesock failed, error=-111 Unable to handle kernel paging request for data at address 0x00000030 Faulting instruction address: 0xc055e65c Oops: Kernel access of bad area, sig: 11 [#1] MPC85xx CDS Modules linked in: CPU: 0 PID: 1338 Comm: mount Not tainted 3.10.44.cge #117 task: cf29cea0 ti: cf35c000 task.ti: cf35c000 NIP: c055e65c LR: c0566490 CTR: c055e648 REGS: cf35dad0 TRAP: 0300 Not tainted (3.10.44.cge) MSR: 00029000 <CE,EE,ME> CR: 22442488 XER: 20000000 DEAR: 00000030, ESR: 00000000
GPR00: c05606f4 cf35db80 cf29cea0 cf0ded80 cf0dedb8 00000001 1dec3086 00000000
GPR08: 00000000 c07b1640 00000007 1dec3086 22442482 100b9758 00000000 10090ae8
GPR16: 00000000 000186a5 00000000 00000000 100c3018 bfa46edc 100b0000 bfa46ef0
GPR24: cf386ae0 c07834f0 00000000 c0565f88 00000001 cf0dedb8 00000000 cf0ded80
NIP [c055e65c] call_start+0x14/0x34
LR [c0566490] __rpc_execute+0x70/0x250
Call Trace: [cf35db80] [00000080] 0x80 (unreliable) [cf35dbb0] [c05606f4] rpc_run_task+0x9c/0xc4 [cf35dbc0] [c0560840] rpc_call_sync+0x50/0xb8 [cf35dbf0] [c056ee90] rpcb_register_call+0x54/0x84 [cf35dc10] [c056f24c] rpcb_register+0xf8/0x10c [cf35dc70] [c0569e18] svc_unregister.isra.23+0x100/0x108 [cf35dc90] [c0569e38] svc_rpcb_cleanup+0x18/0x30 [cf35dca0] [c0198c5c] lockd_up+0x1dc/0x2e0 [cf35dcd0] [c0195348] nlmclnt_init+0x2c/0xc8 [cf35dcf0] [c015bb5c] nfs_start_lockd+0x98/0xec [cf35dd20] [c015ce6c] nfs_create_server+0x1e8/0x3f4 [cf35dd90] [c0171590] nfs3_create_server+0x10/0x44 [cf35dda0] [c016528c] nfs_try_mount+0x158/0x1e4 [cf35de20] [c01670d0] nfs_fs_mount+0x434/0x8c8 [cf35de70] [c00cd3bc] mount_fs+0x20/0xbc [cf35de90] [c00e4f88] vfs_kern_mount+0x50/0x104 [cf35dec0] [c00e6e0c] do_mount+0x1d0/0x8e0 [cf35df10] [c00e75ac] SyS_mount+0x90/0xd0 [cf35df40] [c000ccf4] ret_from_syscall+0x0/0x3c
The addition of svc_shutdown_net() resulted in two calls to svc_rpcb_cleanup(); the second is no longer necessary and crashes when it calls rpcb_register_call with clnt=NULL.
--- fs/lockd/svc.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
fs/lockd/svc.c +1 -3
@@ -253,13 +253,11 @@ static int lockd_up_net(struct svc_serv error =make_socks (serv, net);if (error <0 ) - goto err_socks; + goto err_bind;set_grace_period (net);dprintk ("lockd_up_net: per-net data created; net=%p\n" , net);return 0 ; -err_socks: -svc_rpcb_cleanup (serv, net); err_bind: ln->nlmsvc_users--;return error;
Greg Kroah-Hartman
maintainerPATCH 108/143 genhd: fix leftover might_sleep() in blk_free_devt()
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Axboe <[email protected]>
commit 46f341ffcfb5d8530f7d1e60f3be06cce6661b62 upstream.
Commit 2da78092 changed the locking from a mutex to a spinlock, so we now longer sleep in this context. But there was a leftover might_sleep() in there, which now triggers since we do the final free from an RCU callback. Get rid of it.
--- block/genhd.c | 2 -- 1 file changed, 2 deletions(-)
block/genhd.c +0 -2
@@ -445,8 +445,6 @@ int blk_alloc_devt(struct hd_struct *par*/ void blk_free_devt (dev_t devt) { -might_sleep (); -if (devt ==MKDEV (0 ,0 ))return ;
Greg Kroah-Hartman
maintainerPATCH 109/143 usb: host: xhci: fix compliance mode workaround
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felipe Balbi <[email protected]>
commit 96908589a8b2584b1185f834d365f5cc360e8226 upstream.
Commit 71c731a (usb: host: xhci: Fix Compliance Mode on SN65LVP3502CP Hardware) implemented a workaround for a known issue with Texas Instruments' USB 3.0 redriver IC but it left a condition where any xHCI host would be taken out of reset if port was placed in compliance mode and there was no device connected to the port.
That condition would trigger a fake connection to a non-existent device so that usbcore would trigger a warm reset of the port, thus taking the link out of reset.
This has the side-effect of preventing any xHCI host connected to a Linux machine from starting and running the USB 3.0 Electrical Compliance Suite because the port will mysteriously taken out of compliance mode and, thus, xHCI won't step through the necessary compliance patterns for link validation.
This patch fixes the issue by just adding a missing check for XHCI_COMP_MODE_QUIRK inside xhci_hub_report_usb3_link_state() when PORT_CAS isn't set.
This patch should be backported to all kernels containing commit 71c731a.
--- drivers/usb/host/xhci-hub.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/usb/host/xhci-hub.c +5 -3
@@ -462,7 +462,8 @@ void xhci_test_and_clear_bit(struct xhci }/* Updates Link Status for super Speed port */ -static void xhci_hub_report_link_state (u32 *status,u32 status_reg) +static void xhci_hub_report_link_state (struct xhci_hcd *xhci, +u32 *status,u32 status_reg) {u32 pls = status_reg &PORT_PLS_MASK ;
@@ -501,7 +502,8 @@ static void xhci_hub_report_link_state(u* in which sometimes the port enters compliance mode * caused by a delay on the host-device negotiation. */ -if (pls ==USB_SS_PORT_LS_COMP_MOD ) +if ((xhci->quirks &XHCI_COMP_MODE_QUIRK ) && + (pls ==USB_SS_PORT_LS_COMP_MOD )) pls |=USB_PORT_STAT_CONNECTION ; }
@@ -686,7 +688,7 @@ int xhci_hub_control(struct usb_hcd *hcd }/* Update Port Link State for super speed ports*/ if (hcd->speed ==HCD_USB3 ) { -xhci_hub_report_link_state (&status, temp); +xhci_hub_report_link_state (xhci, &status, temp);/* * Verify if all USB3 Ports Have entered U0 already. * Delete Compliance Mode Timer if so.
Greg Kroah-Hartman
maintainerPATCH 110/143 usb: dwc3: core: fix order of PM runtime calls
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felipe Balbi <[email protected]>
commit fed33afce0eda44a46ae24d93aec1b5198c0bac4 upstream.
Currently, we disable pm_runtime before all register accesses are done, this is dangerous and might lead to abort exceptions due to the driver trying to access a register which is clocked by a clock which was long gated.
Fix that by moving pm_runtime_put_sync() and pm_runtime_disable() as the last thing we do before returning from our ->remove() method.
--- drivers/usb/dwc3/core.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/usb/dwc3/core.c +3 -3
@@ -606,9 +606,6 @@ static int dwc3_remove(struct platform_dusb_phy_set_suspend (dwc->usb2_phy,1 );usb_phy_set_suspend (dwc->usb3_phy,1 ); -pm_runtime_put (&pdev->dev); -pm_runtime_disable (&pdev->dev); -dwc3_debugfs_exit (dwc);switch (dwc->mode) {
@@ -631,6 +628,9 @@ static int dwc3_remove(struct platform_ddwc3_free_event_buffers (dwc);dwc3_core_exit (dwc); +pm_runtime_put_sync (&pdev->dev); +pm_runtime_disable (&pdev->dev); +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 111/143 usb: dwc3: core: fix ordering for PHY suspend
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felipe Balbi <[email protected]>
commit dc99f16f076559235c92d3eb66d03d1310faea08 upstream.
We can't suspend the PHYs before dwc3_core_exit_mode() has been called, that's because the host and/or device sides might still need to communicate with the far end link partner.
--- drivers/usb/dwc3/core.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/usb/dwc3/core.c +4 -3
@@ -603,9 +603,6 @@ static int dwc3_remove(struct platform_d {struct dwc3 *dwc =platform_get_drvdata (pdev); -usb_phy_set_suspend (dwc->usb2_phy,1 ); -usb_phy_set_suspend (dwc->usb3_phy,1 ); -dwc3_debugfs_exit (dwc);switch (dwc->mode) {
@@ -626,6 +623,10 @@ static int dwc3_remove(struct platform_ddwc3_event_buffers_cleanup (dwc);dwc3_free_event_buffers (dwc); + +usb_phy_set_suspend (dwc->usb2_phy,1 ); +usb_phy_set_suspend (dwc->usb3_phy,1 ); +dwc3_core_exit (dwc);pm_runtime_put_sync (&pdev->dev);
Greg Kroah-Hartman
maintainerPATCH 112/143 Revert "mac80211: disable uAPSD if all ACs are under ACM"
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
commit bb512ad0732232f1d2693bb68f31a76bed8f22ae upstream.
This reverts commit 24aa11ab8ae03292d38ec0dbd9bc2ac49fe8a6dd.
That commit was wrong since it uses data that hasn't even been set up yet, but might be a hold-over from a previous connection.
Additionally, it seems like a driver-specific workaround that shouldn't have been in mac80211 to start with.
--- net/mac80211/mlme.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
net/mac80211/mlme.c +1 -2
@@ -4395,8 +4395,7 @@ int ieee80211_mgd_assoc(struct ieee80211rcu_read_unlock ();if (bss->wmm_used && bss->uapsd_supported && - (sdata->local->hw.flags &IEEE80211_HW_SUPPORTS_UAPSD ) && - sdata->wmm_acm !=0xff ) { + (sdata->local->hw.flags &IEEE80211_HW_SUPPORTS_UAPSD )) { assoc_data->uapsd = true; ifmgd->flags |=IEEE80211_STA_UAPSD_ENABLED ; }else {
Greg Kroah-Hartman
maintainerPATCH 113/143 kcmp: fix standard comparison bug
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rasmus Villemoes <[email protected]>
commit acbbe6fbb240a927ee1f5994f04d31267d422215 upstream.
The C operator <= defines a perfectly fine total ordering on the set of values representable in a long. However, unlike its namesake in the integers, it is not translation invariant, meaning that we do not have "b <= c" iff "a+b <= a+c" for all a,b,c.
This means that it is always wrong to try to boil down the relationship between two longs to a question about the sign of their difference, because the resulting relation [a LEQ b iff a-b <= 0] is neither anti-symmetric or transitive. The former is due to -LONG_MIN==LONG_MIN (take any two a,b with a-b = LONG_MIN; then a LEQ b and b LEQ a, but a != b). The latter can either be seen observing that x LEQ x+1 for all x, implying x LEQ x+1 LEQ x+2 ... LEQ x-1 LEQ x; or more directly with the simple example a=LONG_MIN, b=0, c=1, for which a-b < 0, b-c < 0, but a-c > 0.
Note that it makes absolutely no difference that a transmogrying bijection has been applied before the comparison is done. In fact, had the obfuscation not been done, one could probably not observe the bug (assuming all values being compared always lie in one half of the address space, the mathematical value of a-b is always representable in a long). As it stands, one can easily obtain three file descriptors exhibiting the non-transitivity of kcmp().
Side note 1: I can't see that ensuring the MSB of the multiplier is set serves any purpose other than obfuscating the obfuscating code.
Side note 2:
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <fcntl.h>
#include <unistd.h>
#include <assert.h>
#include <sys/syscall.h>
enum kcmp_type {
KCMP_FILE,
KCMP_VM,
KCMP_FILES,
KCMP_FS,
KCMP_SIGHAND,
KCMP_IO,
KCMP_SYSVSEM,
KCMP_TYPES,
};pid_t pid;
int kcmp(pid_t pid1, pid_t pid2, int type,
unsigned long idx1, unsigned long idx2)
{
return syscall(SYS_kcmp, pid1, pid2, type, idx1, idx2);
}
int cmp_fd(int fd1, int fd2)
{
int c = kcmp(pid, pid, KCMP_FILE, fd1, fd2);
if (c < 0) {
perror("kcmp");
exit(1);
}
assert(0 <= c && c < 3);
return c;
}
int cmp_fdp(const void *a, const void *b)
{
static const int normalize[] = {0, -1, 1};
return normalize[cmp_fd(*(int*)a, *(int*)b)];
}
#define MAX 100 /* This is plenty; I've seen it trigger for MAX==3 */
int main(int argc, char *argv[])
{
int r, s, count = 0;
int REL[3] = {0,0,0};
int fd[MAX];
pid = getpid();
while (count < MAX) {
r = open("/dev/null", O_RDONLY);
if (r < 0)
break;
fd[count++] = r;
}
printf("opened %d file descriptors\n", count);
for (r = 0; r < count; ++r) {
for (s = r+1; s < count; ++s) {
REL[cmp_fd(fd[r], fd[s])]++;
}
}
printf("== %d\t< %d\t> %d\n", REL[0], REL[1], REL[2]);
qsort(fd, count, sizeof(fd[0]), cmp_fdp);
memset(REL, 0, sizeof(REL));
for (r = 0; r < count; ++r) {
for (s = r+1; s < count; ++s) {
REL[cmp_fd(fd[r], fd[s])]++;
}
}
printf("== %d\t< %d\t> %d\n", REL[0], REL[1], REL[2]);
return (REL[0] + REL[2] != 0);
}"Eric W. Biederman" <[email protected]>
--- kernel/kcmp.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
kernel/kcmp.c +4 -3
@@ -44,11 +44,12 @@ static long kptr_obfuscate(long v, int t*/ static int kcmp_ptr (void *v1,void *v2,enum kcmp_type type) { -long ret; +long t1, t2; - ret =kptr_obfuscate ((long )v1, type) -kptr_obfuscate ((long )v2, type); + t1 =kptr_obfuscate ((long )v1, type); + t2 =kptr_obfuscate ((long )v2, type); -return (ret <0 ) | ((ret >0 ) <<1 ); +return (t1 < t2) | ((t1 > t2) <<1 ); }/* The caller must have pinned the task */
Greg Kroah-Hartman
maintainerPATCH 114/143 fsnotify/fdinfo: use named constants instead of hardcoded values
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrey Vagin <[email protected]>
commit 1fc98d11cac6dd66342e5580cb2687e5b1e9a613 upstream.
MAX_HANDLE_SZ is equal to 128, but currently the size of pad is only 64 bytes, so exportfs_encode_inode_fh can return an error.
--- fs/notify/fdinfo.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/notify/fdinfo.c +2 -2
@@ -42,7 +42,7 @@ static int show_mark_fhandle(struct seq_ {struct {struct file_handle handle; -u8 pad[64 ]; +u8 pad[MAX_HANDLE_SZ ]; } f;int size, ret, i;
@@ -50,7 +50,7 @@ static int show_mark_fhandle(struct seq_ size = f.handle.handle_bytes >>2 ; ret =exportfs_encode_inode_fh (inode, (struct fid *)f.handle.f_handle, &size,0 ); -if ((ret ==255 ) || (ret == -ENOSPC )) { +if ((ret ==FILEID_INVALID ) || (ret == -ENOSPC )) {WARN_ONCE (1 ,"Can't encode file handler for inotify: %d\n" , ret);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 115/143 fs/notify: dont show f_handle if exportfs_encode_inode_fh failed
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrey Vagin <[email protected]>
commit 7e8824816bda16bb11ff5ff1e1212d642e57b0b3 upstream.
Currently we handle only ENOSPC. In case of other errors the file_handle variable isn't filled properly and we will show a part of stack.
--- fs/notify/fdinfo.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/notify/fdinfo.c +1 -1
@@ -50,7 +50,7 @@ static int show_mark_fhandle(struct seq_ size = f.handle.handle_bytes >>2 ; ret =exportfs_encode_inode_fh (inode, (struct fid *)f.handle.f_handle, &size,0 ); -if ((ret ==FILEID_INVALID ) || (ret == -ENOSPC )) { +if ((ret ==FILEID_INVALID ) || (ret <0 )) {WARN_ONCE (1 ,"Can't encode file handler for inotify: %d\n" , ret);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 116/143 nilfs2: fix data loss with mmap()
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Rohner <[email protected]>
commit 56d7acc792c0d98f38f22058671ee715ff197023 upstream.
This bug leads to reproducible silent data loss, despite the use of msync(), sync() and a clean unmount of the file system. It is easily reproducible with the following script:
----------------[BEGIN SCRIPT]-------------------- mkfs.nilfs2 -f /dev/sdb
mount /dev/sdb /mnt
dd if=/dev/zero bs=1M count=30 of=/mnt/testfile
umount /mnt mount /dev/sdb /mnt CHECKSUM_BEFORE="$(md5sum /mnt/testfile)"
/root/mmaptest/mmaptest /mnt/testfile 30 10 5
sync CHECKSUM_AFTER="$(md5sum /mnt/testfile)" umount /mnt mount /dev/sdb /mnt CHECKSUM_AFTER_REMOUNT="$(md5sum /mnt/testfile)" umount /mnt
echo "BEFORE MMAP:\t$CHECKSUM_BEFORE" echo "AFTER MMAP:\t$CHECKSUM_AFTER"
echo "AFTER REMOUNT:\t$CHECKSUM_AFTER_REMOUNT" ----------------[END SCRIPT]--------------------
The mmaptest tool looks something like this (very simplified, with error checking removed):
----------------[BEGIN mmaptest]-------------------- data = mmap(NULL, file_size - file_offset, PROT_READ | PROT_WRITE,
MAP_SHARED, fd, file_offset);
for (i = 0; i < write_count; ++i) {
memcpy(data + i * 4096, buf, sizeof(buf));
msync(data, file_size - file_offset, MS_SYNC))
}
----------------[END mmaptest]--------------------The output of the script looks something like this:
BEFORE MMAP: 281ed1d5ae50e8419f9b978aab16de83 /mnt/testfile AFTER MMAP: 6604a1c31f10780331a6850371b3a313 /mnt/testfile AFTER REMOUNT: 281ed1d5ae50e8419f9b978aab16de83 /mnt/testfile
So it is clear, that the changes done using mmap() do not survive a remount. This can be reproduced a 100% of the time. The problem was introduced in commit 136e8770cd5d ("nilfs2: fix issue of nilfs_set_page_dirty() for page at EOF boundary").
If the page was read with mpage_readpage() or mpage_readpages() for example, then it has no buffers attached to it. In that case page_has_buffers(page) in nilfs_set_page_dirty() will be false. Therefore nilfs_set_file_dirty() is never called and the pages are never collected and never written to disk.
This patch fixes the problem by also calling nilfs_set_file_dirty() if the page has no buffers attached to it.
--- fs/nilfs2/inode.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
fs/nilfs2/inode.c +6 -1
@@ -24,6 +24,7 @@#include <linux/buffer_head.h> #include <linux/gfp.h> #include <linux/mpage.h> +#include <linux/pagemap.h> #include <linux/writeback.h> #include <linux/aio.h> #include "nilfs.h"
@@ -219,10 +220,10 @@ static int nilfs_writepage(struct page *static int nilfs_set_page_dirty (struct page *page) { +struct inode *inode = page->mapping->host;int ret =__set_page_dirty_nobuffers (page);if (page_has_buffers (page)) { -struct inode *inode = page->mapping->host;unsigned nr_dirty =0 ;struct buffer_head *bh, *head;
@@ -245,6 +246,10 @@ static int nilfs_set_page_dirty(struct pif (nr_dirty)nilfs_set_file_dirty (inode, nr_dirty); + }else if (ret) { +unsigned nr_dirty =1 << (PAGE_CACHE_SHIFT - inode->i_blkbits); + +nilfs_set_file_dirty (inode, nr_dirty); }return ret; }
Greg Kroah-Hartman
maintainerPATCH 117/143 ocfs2/dlm: do not get resource spinlock if lockres is new
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joseph Qi <[email protected]>
commit 5760a97c7143c208fa3a8f8cad0ed7dd672ebd28 upstream.
There is a deadlock case which reported by Guozhonghua:
https://oss.oracle.com/pipermail/ocfs2-devel/2014-September/010079.html
This case is caused by &res->spinlock and &dlm->master_lock misordering in different threads.
It was introduced by commit 8d400b81cc83 ("ocfs2/dlm: Clean up refmap helpers"). Since lockres is new, it doesn't not require the &res->spinlock. So remove it.
--- fs/ocfs2/dlm/dlmmaster.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-)
fs/ocfs2/dlm/dlmmaster.c +10 -8
@@ -653,12 +653,9 @@ void dlm_lockres_clear_refmap_bit(structclear_bit (bit, res->refmap); } - -void dlm_lockres_grab_inflight_ref (struct dlm_ctxt *dlm, +static void __dlm_lockres_grab_inflight_ref (struct dlm_ctxt *dlm,struct dlm_lock_resource *res) { -assert_spin_locked (&res->spinlock); - res->inflight_locks++; mlog(0, "%s: res %.*s, inflight++: now %u, %ps()\n", dlm->name,
@@ -666,6 +663,13 @@ void dlm_lockres_grab_inflight_ref(struc __builtin_return_address(0)); } +void dlm_lockres_grab_inflight_ref (struct dlm_ctxt *dlm, +struct dlm_lock_resource *res) +{ +assert_spin_locked (&res->spinlock); +__dlm_lockres_grab_inflight_ref (dlm, res); +} +void dlm_lockres_drop_inflight_ref (struct dlm_ctxt *dlm,struct dlm_lock_resource *res) {
@@ -855,10 +859,8 @@ lookup:/* finally add the lockres to its hash bucket */ __dlm_insert_lockres (dlm, res); -/* Grab inflight ref to pin the resource */ -spin_lock (&res->spinlock); -dlm_lockres_grab_inflight_ref (dlm, res); -spin_unlock (&res->spinlock); +/* since this lockres is new it doesn't not require the spinlock */ +__dlm_lockres_grab_inflight_ref (dlm, res);/* get an extra ref on the mle in case this is a BLOCK * if so, the creator of the BLOCK may try to put the last
Greg Kroah-Hartman
maintainerPATCH 118/143 sched: Fix unreleased llc_shared_mask bit during CPU hotplug
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wanpeng Li <[email protected]>
commit 03bd4e1f7265548832a76e7919a81f3137c44fd1 upstream.
The following bug can be triggered by hot adding and removing a large number of xen domain0's vcpus repeatedly:
BUG: unable to handle kernel NULL pointer dereference at 0000000000000004 IP: [..] find_busiest_group PGD 5a9d5067 PUD 13067 PMD 0 Oops: 0000 [#3] SMP [...] Call Trace: load_balance ? _raw_spin_unlock_irqrestore idle_balance __schedule schedule schedule_timeout ? lock_timer_base schedule_timeout_uninterruptible msleep lock_device_hotplug_sysfs online_store dev_attr_store sysfs_write_file vfs_write SyS_write system_call_fastpath
Last level cache shared mask is built during CPU up and the build_sched_domain() routine takes advantage of it to setup the sched domain CPU topology.
However, llc_shared_mask is not released during CPU disable, which leads to an invalid sched domainCPU topology.
This patch fix it by releasing the llc_shared_mask correctly during CPU disable.
Yasuaki also reported that this can happen on real hardware:
https://lkml.org/lkml/2014/7/22/1018
His case is here:
== Here is an example on my system. My system has 4 sockets and each socket has 15 cores and HT is enabled. In this case, each core of sockes is numbered as follows: | CPU# Socket#0 | 0-14 , 60-74 Socket#1 | 15-29, 75-89 Socket#2 | 30-44, 90-104 Socket#3 | 45-59, 105-119 Then llc_shared_mask of CPU#30 has 0x3fff80000001fffc0000000. It means that last level cache of Socket#2 is shared with CPU#30-44 and 90-104. When hot-removing socket#2 and #3, each core of sockets is numbered as follows: | CPU# Socket#0 | 0-14 , 60-74 Socket#1 | 15-29, 75-89 But llc_shared_mask is not cleared. So llc_shared_mask of CPU#30 remains having 0x3fff80000001fffc0000000. After that, when hot-adding socket#2 and #3, each core of sockets is numbered as follows: | CPU# Socket#0 | 0-14 , 60-74 Socket#1 | 15-29, 75-89 Socket#2 | 30-59 Socket#3 | 90-119 Then llc_shared_mask of CPU#30 becomes 0x3fff8000fffffffc0000000. It means that last level cache of Socket#2 is shared with CPU#30-59 and 90-104. So the mask has the wrong value.
--- arch/x86/kernel/smpboot.c | 3 +++ 1 file changed, 3 insertions(+)
arch/x86/kernel/smpboot.c +3 -0
@@ -1284,6 +1284,9 @@ static void remove_siblinginfo(int cpu)for_each_cpu (sibling,cpu_sibling_mask (cpu))cpumask_clear_cpu (cpu,cpu_sibling_mask (sibling)); +for_each_cpu (sibling,cpu_llc_shared_mask (cpu)) +cpumask_clear_cpu (cpu,cpu_llc_shared_mask (sibling)); +cpumask_clear (cpu_llc_shared_mask (cpu));cpumask_clear (cpu_sibling_mask (cpu));cpumask_clear (cpu_core_mask (cpu)); c->phys_proc_id =0 ;
Greg Kroah-Hartman
maintainerPATCH 119/143 powerpc/perf: Fix ABIv2 kernel backtraces
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anton Blanchard <[email protected]>
commit 85101af13bb854a6572fa540df7c7201958624b9 upstream.
ABIv2 kernels are failing to backtrace through the kernel. An example:
39.30% readseek2_proce [kernel.kallsyms] [k] find_get_entry
|
--- find_get_entry
__GI___libc_readThe problem is in valid_next_sp() where we check that the new stack pointer is at least STACK_FRAME_OVERHEAD below the previous one.
ABIv1 has a minimum stack frame size of 112 bytes consisting of 48 bytes and 64 bytes of parameter save area. ABIv2 changes that to 32 bytes with no paramter save area.
STACK_FRAME_OVERHEAD is in theory the minimum stack frame size, but we over 240 uses of it, some of which assume that it includes space for the parameter area.
We need to work through all our stack defines and rationalise them but let's fix perf now by creating STACK_FRAME_MIN_SIZE and using in valid_next_sp(). This fixes the issue:
30.64% readseek2_proce [kernel.kallsyms] [k] find_get_entry
|
--- find_get_entry
pagecache_get_page
generic_file_read_iter
new_sync_read
vfs_read
sys_read
syscall_exit
__GI___libc_read--- arch/powerpc/include/asm/ptrace.h | 7 +++++++ arch/powerpc/perf/callchain.c | 2 +- 2 files changed, 8 insertions(+), 1 deletion(-)
arch/powerpc/include/asm/ptrace.h +7 -0
@@ -35,6 +35,12 @@ STACK_FRAME_OVERHEAD + 288)#define STACK_FRAME_MARKER 12 +#if defined(_CALL_ELF) && _CALL_ELF ==2 +#define STACK_FRAME_MIN_SIZE 32 +#else +#define STACK_FRAME_MIN_SIZE STACK_FRAME_OVERHEAD +#endif +/* Size of dummy stack frame allocated when calling signal handler. */ #define __SIGNAL_FRAMESIZE 128#define __SIGNAL_FRAMESIZE32 64
@@ -46,6 +52,7 @@#define STACK_FRAME_REGS_MARKER ASM_CONST(0x72656773)#define STACK_INT_FRAME_SIZE (sizeof(struct pt_regs) + STACK_FRAME_OVERHEAD)#define STACK_FRAME_MARKER 2 +#define STACK_FRAME_MIN_SIZE STACK_FRAME_OVERHEAD/* Size of stack frame allocated when calling signal handler. */ #define __SIGNAL_FRAMESIZE 64
arch/powerpc/perf/callchain.c +1 -1
@@ -35,7 +35,7 @@ static int valid_next_sp(unsigned long sreturn 0 ;/* must be 16-byte aligned */ if (!validate_sp (sp, current,STACK_FRAME_OVERHEAD ))return 0 ; -if (sp >= prev_sp +STACK_FRAME_OVERHEAD ) +if (sp >= prev_sp +STACK_FRAME_MIN_SIZE )return 1 ;/* * sp could decrease when we jump off an interrupt stack
Greg Kroah-Hartman
maintainerPATCH 120/143 parisc: Only use -mfast-indirect-calls option for 32-bit kernel builds
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: John David Anglin <[email protected]>
commit d26a7730b5874a5fa6779c62f4ad7c5065a94723 upstream.
In spite of what the GCC manual says, the -mfast-indirect-calls has never been supported in the 64-bit parisc compiler. Indirect calls have always been done using function descriptors irrespective of the -mfast-indirect-calls option.
Recently, it was noticed that a function descriptor was always requested when the -mfast-indirect-calls option was specified. This caused problems when the option was used in application code and doesn't make any sense because the whole point of the option is to avoid using a function descriptor for indirect calls.
Fixing this broke 64-bit kernel builds.
I will fix GCC but for now we need the attached change. This results in the same kernel code as before.
--- arch/parisc/Makefile | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
arch/parisc/Makefile +6 -1
@@ -46,7 +46,12 @@ cflags-y := -pipe # These flags should be implied by an hppa-linux configuration, but they # are not in gcc 3.2. -cflags-y += -mno-space-regs -mfast-indirect-calls +cflags-y += -mno-space-regs + +# -mfast-indirect-calls is only relevant for 32-bit kernels. +ifndef CONFIG_64BIT +cflags-y += -mfast-indirect-calls +endif # Currently we save and restore fpregs on all kernel entry/interruption paths. # If that gets optimized, we might need to disable the use of fpregs in the
Greg Kroah-Hartman
maintainerPATCH 121/143 alarmtimer: Do not signal SIGEV_NONE timers
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Larocque <[email protected]>
commit 265b81d23a46c39df0a735a3af4238954b41a4c2 upstream.
Avoids sending a signal to alarm timers created with sigev_notify set to SIGEV_NONE by checking for that special case in the timeout callback.
The regular posix timers avoid sending signals to SIGEV_NONE timers by not scheduling any callbacks for them in the first place. Although it would be possible to do something similar for alarm timers, it's simpler to handle this as a special case in the timeout.
Prior to this patch, the alarm timer would ignore the sigev_notify value and try to deliver signals to the process anyway. Even worse, the sanity check for the value of sigev_signo is skipped when SIGEV_NONE was specified, so the signal number could be bogus. If sigev_signo was an unitialized value (as it often would be if SIGEV_NONE is used), then it's hard to predict which signal will be sent.
--- kernel/time/alarmtimer.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
kernel/time/alarmtimer.c +4 -2
@@ -421,8 +421,10 @@ static enum alarmtimer_restart alarm_han { struct k_itimer *ptr = container_of(alarm, struct k_itimer, it.alarm.alarmtimer); -if (posix_timer_event (ptr,0 ) !=0 ) - ptr->it_overrun++; +if ((ptr->it_sigev_notify & ~SIGEV_THREAD_ID ) !=SIGEV_NONE ) { +if (posix_timer_event (ptr,0 ) !=0 ) + ptr->it_overrun++; + }/* Re-add periodic timers */ if (ptr->it.alarm.interval.tv64) {
Greg Kroah-Hartman
maintainerPATCH 122/143 alarmtimer: Lock k_itimer during timer callback
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Larocque <[email protected]>
commit 474e941bed9262f5fa2394f9a4a67e24499e5926 upstream.
Locks the k_itimer's it_lock member when handling the alarm timer's expiry callback.
The regular posix timers defined in posix-timers.c have this lock held during timout processing because their callbacks are routed through posix_timer_fn(). The alarm timers follow a different path, so they ought to grab the lock somewhere else.
--- kernel/time/alarmtimer.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
kernel/time/alarmtimer.c +8 -2
@@ -419,8 +419,12 @@ static enum alarmtimer_type clock2alarm(static enum alarmtimer_restart alarm_handle_timer (struct alarm *alarm,ktime_t now) { +unsigned long flags; struct k_itimer *ptr = container_of(alarm, struct k_itimer, it.alarm.alarmtimer); +enum alarmtimer_restart result =ALARMTIMER_NORESTART ; + +spin_lock_irqsave (&ptr->it_lock, flags);if ((ptr->it_sigev_notify & ~SIGEV_THREAD_ID ) !=SIGEV_NONE ) {if (posix_timer_event (ptr,0 ) !=0 ) ptr->it_overrun++;
@@ -430,9 +434,11 @@ static enum alarmtimer_restart alarm_hanif (ptr->it.alarm.interval.tv64) { ptr->it_overrun +=alarm_forward (alarm, now, ptr->it.alarm.interval); -return ALARMTIMER_RESTART ; + result =ALARMTIMER_RESTART ; } -return ALARMTIMER_NORESTART ; +spin_unlock_irqrestore (&ptr->it_lock, flags); + +return result; }/**
Greg Kroah-Hartman
maintainerPATCH 123/143 perf: Fix a race condition in perf_remove_from_context()
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cong Wang <[email protected]>
commit 3577af70a2ce4853d58e57d832e687d739281479 upstream.
We saw a kernel soft lockup in perf_remove_from_context(), it looks like the perf process, when exiting, could not go out of the retry loop. Meanwhile, the target process was forking a child. So either the target process should execute the smp function call to deactive the event (if it was running) or it should do a context switch which deactives the event.
It seems we optimize out a context switch in perf_event_context_sched_out(), and what's more important, we still test an obsolete task pointer when retrying, so no one actually would deactive that event in this situation. Fix it directly by reloading the task pointer in perf_remove_from_context().
This should cure the above soft lockup.
--- kernel/events/core.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
kernel/events/core.c +10 -0
@@ -1398,6 +1398,11 @@ retry:*/ if (ctx->is_active) {raw_spin_unlock_irq (&ctx->lock); +/* +* Reload the task pointer, it might have been changed by +* a concurrent perf_event_context_sched_out(). +*/ + task = ctx->task; goto retry; }
@@ -1829,6 +1834,11 @@ retry:*/ if (ctx->is_active) {raw_spin_unlock_irq (&ctx->lock); +/* +* Reload the task pointer, it might have been changed by +* a concurrent perf_event_context_sched_out(). +*/ + task = ctx->task; goto retry; }
Greg Kroah-Hartman
maintainerPATCH 124/143 perf kmem: Make it work again on non NUMA machines
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Olsa <[email protected]>
commit 4921e320244e099bdf237fd10428594ce5f5b87d upstream.
The commit '2814eb0 perf kmem: Remove die() calls' disabled 'perf kmem' command for machines without numa support. It made the command fail if '/sys/devices/system/node' dir wasn't found.
Skipping the numa based initialization in case the directory is not found and continue execution.
--- tools/perf/builtin-kmem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/builtin-kmem.c +1 -1
@@ -101,7 +101,7 @@ static int setup_cpunode_map(void) dir1 =opendir (PATH_SYS_NODE );if (!dir1) -return -1 ; +return 0 ;while ((dent1 =readdir (dir1)) !=NULL ) { if (dent1->d_type != DT_DIR ||
Greg Kroah-Hartman
maintainerPATCH 125/143 Fix nasty 32-bit overflow bug in buffer i/o code.
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anton Altaparmakov <[email protected]>
commit f2d5a94436cc7cc0221b9a81bba2276a25187dd3 upstream.
On 32-bit architectures, the legacy buffer_head functions are not always handling the sector number with the proper 64-bit types, and will thus fail on 4TB+ disks.
Any code that uses __getblk() (and thus bread(), breadahead(), sb_bread(), sb_breadahead(), sb_getblk()), and calls it using a 64-bit block on a 32-bit arch (where "long" is 32-bit) causes an inifinite loop in __getblk_slow() with an infinite stream of errors logged to dmesg like this:
__find_get_block_slow() failed. block=6740375944, b_blocknr=2445408648 b_state=0x00000020, b_size=512
device sda1 blocksize: 512
Note how in hex block is 0x191C1F988 and b_blocknr is 0x91C1F988 i.e. the top 32-bits are missing (in this case the 0x1 at the top).
This is because grow_dev_page() is broken and has a 32-bit overflow due to shifting the page index value (a pgoff_t - which is just 32 bits on 32-bit architectures) left-shifted as the block number. But the top bits to get lost as the pgoff_t is not type cast to sector_t / 64-bit before the shift.
This patch fixes this issue by type casting "index" to sector_t before doing the left shift.
Note this is not a theoretical bug but has been seen in the field on a 4TiB hard drive with logical sector size 512 bytes.
This patch has been verified to fix the infinite loop problem on 3.17-rc5 kernel using a 4TB disk image mounted using "-o loop". Without this patch doing a "find /nt" where /nt is an NTFS volume causes the inifinite loop 100% reproducibly whilst with the patch it works fine as expected.
--- fs/buffer.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
fs/buffer.c +4 -2
@@ -985,7 +985,8 @@ grow_dev_page(struct block_device *bdev, bh =page_buffers (page);if (bh->b_size == size) { end_block =init_page_buffers (page, bdev, - index << sizebits, size); + (sector_t )index << sizebits, + size); goto done; }if (!try_to_free_buffers (page))
@@ -1006,7 +1007,8 @@ grow_dev_page(struct block_device *bdev,*/ spin_lock (&inode->i_mapping->private_lock);link_dev_buffers (page, bh); - end_block =init_page_buffers (page, bdev, index << sizebits, size); + end_block =init_page_buffers (page, bdev, (sector_t )index << sizebits, + size);spin_unlock (&inode->i_mapping->private_lock); done: ret = (block < end_block) ?1 : -ENXIO ;
Greg Kroah-Hartman
maintainerPATCH 126/143 media: cx18: fix kernel oops with tda8290 tuner
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Verkuil <[email protected]>
commit 6a03dc92cc2edfa2257502557b9f714893987383 upstream.
This was caused by an uninitialized setup.config field.
Based on a suggestion from Devin Heitmueller.
Thanks-to: Devin Heitmueller <[email protected]>
--- drivers/media/pci/cx18/cx18-driver.c | 1 + 1 file changed, 1 insertion(+)
drivers/media/pci/cx18/cx18-driver.c +1 -0
@@ -1092,6 +1092,7 @@ static int cx18_probe(struct pci_dev *pc setup.addr =ADDR_UNSET ; setup.type = cx->options.tuner; setup.mode_mask =T_ANALOG_TV ;/* matches TV tuners */ + setup.config =NULL ;if (cx->options.radio >0 ) setup.mode_mask |=T_RADIO ; setup.tuner_callback = (setup.type == TUNER_XC2028) ?
Greg Kroah-Hartman
maintainerPATCH 127/143 md/raid1: fix_read_error should act on all non-faulty devices.
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <[email protected]>
commit b8cb6b4c121e1bf1963c16ed69e7adcb1bc301cd upstream.
If a devices is being recovered it is not InSync and is not Faulty.
If a read error is experienced on that device, fix_read_error() will be called, but it ignores non-InSync devices. So it will neither fix the error nor fail the device.
It is incorrect that fix_read_error() ignores non-InSync devices. It should only ignore Faulty devices. So fix it.
This became a bug when we allowed reading from a device that was being recovered. It is suitable for any subsequent -stable kernel.
--- drivers/md/raid1.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/md/raid1.c +2 -2
@@ -2051,7 +2051,7 @@ static void fix_read_error(struct r1conf d--; rdev = conf->mirrors[d].rdev;if (rdev && -test_bit (In_sync, &rdev->flags)) + !test_bit (Faulty, &rdev->flags))r1_sync_page_io (rdev, sect, s, conf->tmppage,WRITE ); }
@@ -2063,7 +2063,7 @@ static void fix_read_error(struct r1conf d--; rdev = conf->mirrors[d].rdev;if (rdev && -test_bit (In_sync, &rdev->flags)) { + !test_bit (Faulty, &rdev->flags)) {if (r1_sync_page_io (rdev, sect, s, conf->tmppage,READ )) {atomic_add (s, &rdev->corrected_errors);
Greg Kroah-Hartman
maintainerPATCH 128/143 ipvs: avoid netns exit crash on ip_vs_conn_drop_conntrack
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julian Anastasov <[email protected]>
commit 2627b7e15c5064ddd5e578e4efd948d48d531a3f upstream.
commit 8f4e0a18682d91 ("IPVS netns exit causes crash in conntrack") added second ip_vs_conn_drop_conntrack call instead of just adding the needed check. As result, the first call still can cause crash on netns exit. Remove it.
--- net/netfilter/ipvs/ip_vs_conn.c | 1 - 1 file changed, 1 deletion(-)
net/netfilter/ipvs/ip_vs_conn.c +0 -1
@@ -797,7 +797,6 @@ static void ip_vs_conn_expire(unsigned lip_vs_control_del (cp);if (cp->flags &IP_VS_CONN_F_NFCT ) { -ip_vs_conn_drop_conntrack (cp);/* Do not access conntracks during subsys cleanup * because nf_conntrack_find_get can not be used after * conntrack cleanup for the net.
Greg Kroah-Hartman
maintainerPATCH 129/143 ipvs: Maintain all DSCP and ECN bits for ipv6 tun forwarding
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Gartrell <[email protected]>
commit 76f084bc10004b3050b2cff9cfac29148f1f6088 upstream.
Previously, only the four high bits of the tclass were maintained in the ipv6 case. This matches the behavior of ipv4, though whether or not we should reflect ECN bits may be up for debate.
--- net/netfilter/ipvs/ip_vs_xmit.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/netfilter/ipvs/ip_vs_xmit.c +1 -1
@@ -967,8 +967,8 @@ ip_vs_tunnel_xmit_v6(struct sk_buff *skb iph->nexthdr =IPPROTO_IPV6 ; iph->payload_len = old_iph->payload_len;be16_add_cpu (&iph->payload_len,sizeof (*old_iph)); - iph->priority = old_iph->priority;memset (&iph->flow_lbl,0 ,sizeof (iph->flow_lbl)); +ipv6_change_dsfield (iph,0 ,ipv6_get_dsfield (old_iph)); iph->daddr = cp->daddr.in6; iph->saddr = saddr; iph->hop_limit = old_iph->hop_limit;
Greg Kroah-Hartman
maintainerPATCH 130/143 ipvs: fix ipv6 hook registration for local replies
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julian Anastasov <[email protected]>
commit eb90b0c734ad793d5f5bf230a9e9a4dcc48df8aa upstream.
commit fc604767613b6d2036cdc35b660bc39451040a47 ("ipvs: changes for local real server") from 2.6.37 introduced DNAT support to local real server but the IPv6 LOCAL_OUT handler ip_vs_local_reply6() is registered incorrectly as IPv4 hook causing any outgoing IPv4 traffic to be dropped depending on the IP header values.
Chris tracked down the problem to CONFIG_IP_VS_IPV6=y
Bug report: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1349768
--- net/netfilter/ipvs/ip_vs_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/netfilter/ipvs/ip_vs_core.c +1 -1
@@ -1898,7 +1898,7 @@ static struct nf_hook_ops ip_vs_ops[] __ { .hook = ip_vs_local_reply6, .owner = THIS_MODULE, - .pf = NFPROTO_IPV4, + .pf = NFPROTO_IPV6, .hooknum = NF_INET_LOCAL_OUT, .priority = NF_IP6_PRI_NAT_DST + 1, },
Greg Kroah-Hartman
maintainerPATCH 131/143 PM / sleep: Add state field to pm_states[] entries
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Rafael J. Wysocki" <[email protected]>
commit 27ddcc6596e50cb8f03d2e83248897667811d8f6 upstream.
To allow sleep states corresponding to the "mem", "standby" and "freeze" lables to be different from the pm_states[] indexes of those strings, introduce struct pm_sleep_state, consisting of a string label and a state number, and turn pm_states[] into an array of objects of that type.
This modification should not lead to any functional changes.
--- kernel/power/main.c | 16 ++++++++-------- kernel/power/power.h | 7 ++++++- kernel/power/suspend.c | 12 ++++++------ kernel/power/suspend_test.c | 22 ++++++++++------------ 4 files changed, 30 insertions(+), 27 deletions(-)
kernel/power/main.c +8 -8
@@ -293,12 +293,12 @@ static ssize_t state_show(struct kobject {char *s = buf;#ifdef CONFIG_SUSPEND -int i; +suspend_state_t i; + +for (i =PM_SUSPEND_MIN ; i <PM_SUSPEND_MAX ; i++) +if (valid_state (i)) + s +=sprintf (s,"%s " , pm_states[i].label); -for (i =0 ; i <PM_SUSPEND_MAX ; i++) { -if (pm_states[i] &&valid_state (i)) - s +=sprintf (s,"%s " , pm_states[i]); - }#endif #ifdef CONFIG_HIBERNATION s +=sprintf (s,"%s\n" ,"disk" );
@@ -314,7 +314,7 @@ static suspend_state_t decode_state(cons {#ifdef CONFIG_SUSPEND suspend_state_t state =PM_SUSPEND_MIN ; -const char *const *s; +struct pm_sleep_state *s;#endif char *p;int len;
@@ -328,7 +328,7 @@ static suspend_state_t decode_state(cons#ifdef CONFIG_SUSPEND for (s = &pm_states[state]; state <PM_SUSPEND_MAX ; s++, state++) -if (*s && len ==strlen (*s) && !strncmp (buf, *s, len)) +if (len ==strlen (s->label) && !strncmp (buf, s->label, len))return state;#endif
@@ -446,7 +446,7 @@ static ssize_t autosleep_show(struct kob#ifdef CONFIG_SUSPEND if (state <PM_SUSPEND_MAX )return sprintf (buf,"%s\n" ,valid_state (state) ? - pm_states[state] :"error" ); + pm_states[state].label :"error" );#endif #ifdef CONFIG_HIBERNATION return sprintf (buf,"disk\n" );
kernel/power/power.h +6 -1
@@ -175,8 +175,13 @@ extern void swsusp_show_speed(struct tim unsigned int, char *);#ifdef CONFIG_SUSPEND +struct pm_sleep_state { +const char *label; +suspend_state_t state; +}; +/* kernel/power/suspend.c */ -extern const char *const pm_states[]; +extern struct pm_sleep_state pm_states[];extern bool valid_state (suspend_state_t state);extern int suspend_devices_and_enter (suspend_state_t state);
kernel/power/suspend.c +6 -6
@@ -29,10 +29,10 @@#include "power.h" -const char *const pm_states[PM_SUSPEND_MAX ] = { - [PM_SUSPEND_FREEZE ] ="freeze" , - [PM_SUSPEND_STANDBY ] ="standby" , - [PM_SUSPEND_MEM ] ="mem" , +struct pm_sleep_state pm_states[PM_SUSPEND_MAX ] = { + [PM_SUSPEND_FREEZE ] = {"freeze" ,PM_SUSPEND_FREEZE }, + [PM_SUSPEND_STANDBY ] = {"standby" ,PM_SUSPEND_STANDBY }, + [PM_SUSPEND_MEM ] = {"mem" ,PM_SUSPEND_MEM }, };static const struct platform_suspend_ops *suspend_ops;
@@ -337,7 +337,7 @@ static int enter_state(suspend_state_t ssys_sync ();printk ("done.\n" ); -pr_debug ("PM: Preparing system for %s sleep\n" , pm_states[state]); +pr_debug ("PM: Preparing system for %s sleep\n" , pm_states[state].label); error =suspend_prepare (state);if (error) goto Unlock;
@@ -345,7 +345,7 @@ static int enter_state(suspend_state_t sif (suspend_test (TEST_FREEZER )) goto Finish; -pr_debug ("PM: Entering %s sleep\n" , pm_states[state]); +pr_debug ("PM: Entering %s sleep\n" , pm_states[state].label);pm_restrict_gfp_mask (); error =suspend_devices_and_enter (state);pm_restore_gfp_mask ();
kernel/power/suspend_test.c +10 -12
@@ -92,13 +92,13 @@ static void __init test_wakealarm(struct }if (state ==PM_SUSPEND_MEM ) { -printk (info_test, pm_states[state]); +printk (info_test, pm_states[state].label); status =pm_suspend (state);if (status == -ENODEV ) state =PM_SUSPEND_STANDBY ; }if (state ==PM_SUSPEND_STANDBY ) { -printk (info_test, pm_states[state]); +printk (info_test, pm_states[state].label); status =pm_suspend (state); }if (status <0 )
@@ -136,18 +136,16 @@ static char warn_bad_state[] __initdatastatic int __init setup_test_suspend (char *value) { -unsigned i; +suspend_state_t i;/* "=mem" ==> "mem" */ value++; -for (i =0 ; i <PM_SUSPEND_MAX ; i++) { -if (!pm_states[i]) -continue ; -if (strcmp (pm_states[i], value) !=0 ) -continue ; - test_state = (__force suspend_state_t ) i; -return 0 ; - } +for (i =PM_SUSPEND_MIN ; i <PM_SUSPEND_MAX ; i++) +if (!strcmp (pm_states[i].label, value)) { + test_state = pm_states[i].state; +return 0 ; + } +printk (warn_bad_state, value);return 0 ; }
@@ -165,7 +163,7 @@ static int __init test_suspend(void)if (test_state ==PM_SUSPEND_ON ) goto done;if (!valid_state (test_state)) { -printk (warn_bad_state, pm_states[test_state]); +printk (warn_bad_state, pm_states[test_state].label); goto done; }
Greg Kroah-Hartman
maintainerPATCH 132/143 PM / sleep: Use valid_state() for platform-dependent sleep states only
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Rafael J. Wysocki" <[email protected]>
commit 43e8317b0bba1d6eb85f38a4a233d82d7c20d732 upstream.
Use the observation that, for platform-dependent sleep states (PM_SUSPEND_STANDBY, PM_SUSPEND_MEM), a given state is either always supported or always unsupported and store that information in pm_states[] instead of calling valid_state() every time we need to check it.
Also do not use valid_state() for PM_SUSPEND_FREEZE, which is always valid, and move the pm_test_level validity check for PM_SUSPEND_FREEZE directly into enter_state().
--- kernel/power/main.c | 9 +++--- kernel/power/power.h | 2 - kernel/power/suspend.c | 60 ++++++++++++++++++++++---------------------- kernel/power/suspend_test.c | 2 - 4 files changed, 36 insertions(+), 37 deletions(-)
kernel/power/main.c +5 -4
@@ -296,7 +296,7 @@ static ssize_t state_show(struct kobjectsuspend_state_t i;for (i =PM_SUSPEND_MIN ; i <PM_SUSPEND_MAX ; i++) -if (valid_state (i)) +if (pm_states[i].state) s +=sprintf (s,"%s " , pm_states[i].label);#endif
@@ -328,8 +328,9 @@ static suspend_state_t decode_state(cons#ifdef CONFIG_SUSPEND for (s = &pm_states[state]; state <PM_SUSPEND_MAX ; s++, state++) -if (len ==strlen (s->label) && !strncmp (buf, s->label, len)) -return state; +if (s->state && len ==strlen (s->label) + && !strncmp (buf, s->label, len)) +return s->state;#endif return PM_SUSPEND_ON ;
@@ -445,7 +446,7 @@ static ssize_t autosleep_show(struct kob#ifdef CONFIG_SUSPEND if (state <PM_SUSPEND_MAX ) -return sprintf (buf,"%s\n" ,valid_state (state) ? +return sprintf (buf,"%s\n" , pm_states[state].state ? pm_states[state].label :"error" );#endif #ifdef CONFIG_HIBERNATION
kernel/power/power.h +0 -2
@@ -183,14 +183,12 @@ struct pm_sleep_state {/* kernel/power/suspend.c */ extern struct pm_sleep_state pm_states[]; -extern bool valid_state (suspend_state_t state);extern int suspend_devices_and_enter (suspend_state_t state);#else /* !CONFIG_SUSPEND */ static inline int suspend_devices_and_enter (suspend_state_t state) {return -ENOSYS ; } -static inline bool valid_state (suspend_state_t state) {return false; }#endif /* !CONFIG_SUSPEND */ #ifdef CONFIG_PM_TEST_SUSPEND
kernel/power/suspend.c +30 -30
90 lines not on this page · raw message
kernel/power/suspend_test.c +1 -1
@@ -162,7 +162,7 @@ static int __init test_suspend(void)/* PM is initialized by now; is that state testable? */ if (test_state ==PM_SUSPEND_ON ) goto done; -if (!valid_state (test_state)) { +if (!pm_states[test_state].state) {printk (warn_bad_state, pm_states[test_state].label); goto done; }
Greg Kroah-Hartman
maintainerPATCH 133/143 netfilter: nf_conntrack: avoid large timeout for mid-stream pickup
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
commit 6547a221871f139cc56328a38105d47c14874cbe upstream.
When loose tracking is enabled (default), non-syn packets cause creation of new conntracks in established state with default timeout for established state (5 days). This causes the table to fill up with UNREPLIED when the 'new ack' packet happened to be the last-ack of a previous, already timed-out connection.
Consider:
A 192.168.x.52792 > 10.184.y.80: F, 426:426(0) ack 9237 win 255 B 10.184.y.80 > 192.168.x.52792: ., ack 427 win 123 <61 second pause>
C 10.184.y.80 > 192.168.x.52792: F, 9237:9237(0) ack 427 win 123 D 192.168.x.52792 > 10.184.y.80: ., ack 9238 win 255
B moves conntrack to CLOSE_WAIT and will kill it after 60 second timeout, C is ignored (FIN set), but last packet (D) causes new ct with 5-days timeout.
Use UNACK timeout (5 minutes) instead to get rid of these entries sooner when in ESTABLISHED state without having seen traffic in both directions.
--- net/netfilter/nf_conntrack_proto_tcp.c | 6 ++++++ 1 file changed, 6 insertions(+)
net/netfilter/nf_conntrack_proto_tcp.c +6 -0
@@ -1043,6 +1043,12 @@ static int tcp_packet(struct nf_conn *ctnf_ct_kill_acct (ct, ctinfo, skb);return NF_ACCEPT ; } +/* ESTABLISHED without SEEN_REPLY, i.e. mid-connection +* pickup with loose=1. Avoid large ESTABLISHED timeout. +*/ +if (new_state ==TCP_CONNTRACK_ESTABLISHED && + timeout > timeouts[TCP_CONNTRACK_UNACK ]) + timeout = timeouts[TCP_CONNTRACK_UNACK ]; }else if (!test_bit (IPS_ASSURED_BIT , &ct->status) && (old_state ==TCP_CONNTRACK_SYN_RECV || old_state == TCP_CONNTRACK_ESTABLISHED)
Greg Kroah-Hartman
maintainerPATCH 134/143 ARM: 7748/1: oabi: handle faults when loading swi instruction from userspace
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Will Deacon <[email protected]>
commit 1aa2b3b7a6c4f3dbd3671171113a20e6a6190e3b upstream.
Running an OABI_COMPAT kernel on an SMP platform can lead to fun and games with page aging.
If one CPU issues a swi instruction immediately before another CPU decides to mkold the page containing the swi instruction, then we will fault attempting to load the instruction during the vector_swi handler in order to retrieve its immediate field. Since this fault is not currently dealt with by our exception tables, this results in a panic:
Unable to handle kernel paging request at virtual address 4020841c pgd = c490c000 [4020841c] *pgd=84451831, *pte=bf05859d, *ppte=00000000 Internal error: Oops: 17 [#1] PREEMPT SMP ARM Modules linked in: hid_sony(O) CPU: 1 Tainted: G W O (3.4.0-perf-gf496dca-01162-gcbcc62b #1) PC is at vector_swi+0x28/0x88 LR is at 0x40208420
This patch wraps all of the swi instruction loads with the USER macro and provides a shared exception table entry which simply rewinds the saved user PC and returns from the system call (without setting tbl, so there's no worries with tracing or syscall restarting). Returning to userspace will re-enter the page fault handler, from where we will probably send SIGSEGV to the current task.
--- arch/arm/kernel/entry-common.S | 42 ++++++++++++++++++++++++++++------------- 1 file changed, 29 insertions(+), 13 deletions(-)
arch/arm/kernel/entry-common.S +29 -13
@@ -362,6 +362,16 @@ ENTRY(vector_swi) str r0, [sp, #S_OLD_R0] @ Save OLD_R0 zero_fp +#ifdef CONFIG_ALIGNMENT_TRAP + ldr ip, __cr_alignment + ldr ip, [ip] + mcr p15, 0, ip, c1, c0 @ update control register +#endif + + enable_irq + ct_user_exit + get_thread_info tsk + /* * Get the system call number. */
@@ -375,9 +385,9 @@ ENTRY(vector_swi) #ifdef CONFIG_ARM_THUMB tst r8, #PSR_T_BIT movne r10, #0 @ no thumb OABI emulation - ldreq r10, [lr, #-4] @ get SWI instruction + USER( ldreq r10, [lr, #-4] ) @ get SWI instruction #else - ldr r10, [lr, #-4] @ get SWI instruction + USER( ldr r10, [lr, #-4] ) @ get SWI instruction #endif #ifdef CONFIG_CPU_ENDIAN_BE8 rev r10, r10 @ little endian instruction
@@ -392,22 +402,13 @@ ENTRY(vector_swi) /* Legacy ABI only, possibly thumb mode. */ tst r8, #PSR_T_BIT @ this is SPSR from save_user_regs addne scno, r7, #__NR_SYSCALL_BASE @ put OS number in - ldreq scno, [lr, #-4] + USER( ldreq scno, [lr, #-4] ) #else /* Legacy ABI only. */ - ldr scno, [lr, #-4] @ get SWI instruction + USER( ldr scno, [lr, #-4] ) @ get SWI instruction #endif -#ifdef CONFIG_ALIGNMENT_TRAP - ldr ip, __cr_alignment - ldr ip, [ip] - mcr p15, 0, ip, c1, c0 @ update control register -#endif - enable_irq - ct_user_exit - - get_thread_info tsk adr tbl, sys_call_table @ load syscall table pointer #if defined(CONFIG_OABI_COMPAT)
@@ -442,6 +443,21 @@ local_restart: eor r0, scno, #__NR_SYSCALL_BASE @ put OS number back bcs arm_syscall b sys_ni_syscall @ not private func + +#if defined(CONFIG_OABI_COMPAT) || !defined(CONFIG_AEABI) + /* + * We failed to handle a fault trying to access the page + * containing the swi instruction, but we're not really in a + * position to return -EFAULT. Instead, return back to the + * instruction and re-enter the user fault handling path trying + * to page it in. This will likely result in sending SEGV to the + * current task. + */ +9001: + sub lr, lr, #4 + str lr, [sp, #S_PC] + b ret_fast_syscall +#endif ENDPROC(vector_swi) /*
Greg Kroah-Hartman
maintainerPATCH 135/143 serial: 8250_dma: check the result of TX buffer mapping
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heikki Krogerus <[email protected]>
commit d4089a332883ad969700aac5dd4dd5f1c4fee825 upstream.
Using dma_mapping_error() to make sure the mapping did not fail.
--- drivers/tty/serial/8250/8250_dma.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-)
drivers/tty/serial/8250/8250_dma.c +12 -5
@@ -192,21 +192,28 @@ int serial8250_request_dma(struct uart_8 dma->rx_buf =dma_alloc_coherent (dma->rxchan->device->dev, dma->rx_size, &dma->rx_addr,GFP_KERNEL ); -if (!dma->rx_buf) { -dma_release_channel (dma->rxchan); -dma_release_channel (dma->txchan); -return -ENOMEM ; - } +if (!dma->rx_buf) + goto err;/* TX buffer */ dma->tx_addr =dma_map_single (dma->txchan->device->dev, p->port.state->xmit.buf,UART_XMIT_SIZE ,DMA_TO_DEVICE ); +if (dma_mapping_error (dma->txchan->device->dev, dma->tx_addr)) { +dma_free_coherent (dma->rxchan->device->dev, dma->rx_size, + dma->rx_buf, dma->rx_addr); + goto err; + }dev_dbg_ratelimited (p->port.dev,"got both dma channels\n" );return 0 ; +err: +dma_release_channel (dma->rxchan); +dma_release_channel (dma->txchan); + +return -ENOMEM ; }EXPORT_SYMBOL_GPL (serial8250_request_dma);
Greg Kroah-Hartman
maintainerPATCH 136/143 ext2: Fix fs corruption in ext2_get_xip_mem()
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
commit 7ba3ec5749ddb61f79f7be17b5fd7720eebc52de upstream.
Commit 8e3dffc651cb "Ext2: mark inode dirty after the function dquot_free_block_nodirty is called" unveiled a bug in __ext2_get_block() called from ext2_get_xip_mem(). That function called ext2_get_block() mistakenly asking it to map 0 blocks while 1 was intended. Before the above mentioned commit things worked out fine by luck but after that commit we started returning that we allocated 0 blocks while we in fact allocated 1 block and thus allocation was looping until all blocks in the filesystem were exhausted.
Fix the problem by properly asking for one block and also add assertion in ext2_get_blocks() to catch similar problems.
--- fs/ext2/inode.c | 2 ++ fs/ext2/xip.c | 1 + 2 files changed, 3 insertions(+)
fs/ext2/inode.c +2 -0
@@ -632,6 +632,8 @@ static int ext2_get_blocks(struct inodeint count =0 ;ext2_fsblk_t first_block =0 ; +BUG_ON (maxblocks ==0 ); + depth =ext2_block_to_path (inode,iblock,offsets,&blocks_to_boundary);if (depth ==0 )
fs/ext2/xip.c +1 -0
@@ -35,6 +35,7 @@ __ext2_get_block(struct inode *inode, pgint rc;memset (&tmp,0 ,sizeof (struct buffer_head )); + tmp.b_size =1 << inode->i_blkbits; rc =ext2_get_block (inode, pgoff, &tmp, create); *result = tmp.b_blocknr;
Greg Kroah-Hartman
maintainerPATCH 137/143 arm: multi_v7_defconfig: Enable Zynq UART driver
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Soren Brinkmann <[email protected]>
commit 90de827b9c238f8d8209bc7adc70190575514315 upstream.
--- arch/arm/configs/multi_v7_defconfig | 2 ++ 1 file changed, 2 insertions(+)
arch/arm/configs/multi_v7_defconfig +2 -0
@@ -48,6 +48,8 @@ CONFIG_SERIAL_SIRFSOC=y CONFIG_SERIAL_SIRFSOC_CONSOLE=y CONFIG_SERIAL_VT8500=y CONFIG_SERIAL_VT8500_CONSOLE=y +CONFIG_SERIAL_XILINX_PS_UART=y +CONFIG_SERIAL_XILINX_PS_UART_CONSOLE=y CONFIG_IPMI_HANDLER=y CONFIG_IPMI_SI=y CONFIG_I2C=y
Greg Kroah-Hartman
maintainerPATCH 138/143 kernel/fork.c:copy_process(): unify CLONE_THREAD-or-thread_group_leader code
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleg Nesterov <[email protected]>
commit 80628ca06c5d42929de6bc22c0a41589a834d151 upstream.
Cleanup and preparation for the next changes.
Move the "if (clone_flags & CLONE_THREAD)" code down under "if (likely(p->pid))" and turn it into into the "else" branch. This makes the process/thread initialization more symmetrical and removes one check.
--- kernel/fork.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-)
kernel/fork.c +7 -8
@@ -1448,14 +1448,6 @@ static struct task_struct *copy_process( goto bad_fork_free_pid; } -if (clone_flags &CLONE_THREAD ) { - current->signal->nr_threads++; -atomic_inc (¤t->signal->live); -atomic_inc (¤t->signal->sigcnt); - p->group_leader = current->group_leader; -list_add_tail_rcu (&p->thread_group, &p->group_leader->thread_group); - } -if (likely (p->pid)) {ptrace_init_task (p, (clone_flags &CLONE_PTRACE ) || trace);
@@ -1472,6 +1464,13 @@ static struct task_struct *copy_process(list_add_tail (&p->sibling, &p->real_parent->children);list_add_tail_rcu (&p->tasks, &init_task.tasks);__this_cpu_inc (process_counts); + }else { + current->signal->nr_threads++; +atomic_inc (¤t->signal->live); +atomic_inc (¤t->signal->sigcnt); + p->group_leader = current->group_leader; +list_add_tail_rcu (&p->thread_group, + &p->group_leader->thread_group); }attach_pid (p,PIDTYPE_PID , pid); nr_threads++;
Greg Kroah-Hartman
maintainerPATCH 139/143 introduce for_each_thread() to replace the buggy while_each_thread()
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleg Nesterov <[email protected]>
commit 0c740d0afc3bff0a097ad03a1c8df92757516f5c upstream.
while_each_thread() and next_thread() should die, almost every lockless usage is wrong.
1. Unless g == current, the lockless while_each_thread() is not safe.
while_each_thread(g, t) can loop forever if g exits, next_thread() can't reach the unhashed thread in this case. Note that this can happen even if g is the group leader, it can exec.
2. Even if while_each_thread() itself was correct, people often use it wrongly.
It was never safe to just take rcu_read_lock() and loop unless you verify that pid_alive(g) == T, even the first next_thread() can point to the already freed/reused memory.
This patch adds signal_struct->thread_head and task->thread_node to create the normal rcu-safe list with the stable head. The new for_each_thread(g, t) helper is always safe under rcu_read_lock() as long as this task_struct can't go away.
Note: of course it is ugly to have both task_struct->thread_node and the old task_struct->thread_group, we will kill it later, after we change the users of while_each_thread() to use for_each_thread().
Perhaps we can kill it even before we convert all users, we can reimplement next_thread(t) using the new thread_head/thread_node. But we can't do this right now because this will lead to subtle behavioural changes. For example, do/while_each_thread() always sees at least one task, while for_each_thread() can do nothing if the whole thread group has died. Or thread_group_empty(), currently its semantics is not clear unless thread_group_leader(p) and we need to audit the callers before we can change it.
So this patch adds the new interface which has to coexist with the old one for some time, hopefully the next changes will be more or less straightforward and the old one will go away soon.
--- include/linux/init_task.h | 2 ++ include/linux/sched.h | 12 ++++++++++++ kernel/exit.c | 1 + kernel/fork.c | 7 +++++++ 4 files changed, 22 insertions(+)
include/linux/init_task.h +2 -0
@@ -40,6 +40,7 @@ extern struct fs_struct init_fs;#define INIT_SIGNALS (sig) { \ .nr_threads = 1, \ + .thread_head = LIST_HEAD_INIT(init_task.thread_node), \ .wait_chldexit = __WAIT_QUEUE_HEAD_INITIALIZER(sig.wait_chldexit),\ .shared_pending = { \ .list = LIST_HEAD_INIT(sig.shared_pending.list), \
@@ -213,6 +214,7 @@ extern struct task_group root_task_group [PIDTYPE_SID] = INIT_PID_LINK(PIDTYPE_SID), \ }, \ .thread_group =LIST_HEAD_INIT (tsk.thread_group), \ + .thread_node = LIST_HEAD_INIT(init_signals.thread_head), \ INIT_IDS \ INIT_PERF_EVENTS(tsk) \INIT_TRACE_IRQFLAGS \
include/linux/sched.h +12 -0
@@ -480,6 +480,7 @@ struct signal_struct {atomic_t sigcnt;atomic_t live;int nr_threads; +struct list_head thread_head;wait_queue_head_t wait_chldexit;/* for wait4() */
@@ -1160,6 +1161,7 @@ struct task_struct {/* PID/PID hash table linkage. */ struct pid_link pids[PIDTYPE_MAX ];struct list_head thread_group; +struct list_head thread_node;struct completion *vfork_done;/* for vfork() */ int __user *set_child_tid;/* CLONE_CHILD_SETTID */
@@ -2167,6 +2169,16 @@ extern bool current_is_single_threaded(v#define while_each_thread (g, t) \ while ((t = next_thread(t)) != g) +#define __for_each_thread (signal, t) \ + list_for_each_entry_rcu(t, &(signal)->thread_head, thread_node) + +#define for_each_thread (p, t) \ + __for_each_thread((p)->signal, t) + +/* Careful: this is a double loop, 'break' won't work as expected. */ +#define for_each_process_thread (p, t) \ + for_each_process(p) for_each_thread(p, t) +static inline int get_nr_threads (struct task_struct *tsk) {return tsk->signal->nr_threads;
kernel/exit.c +1 -0
@@ -74,6 +74,7 @@ static void __unhash_process(struct task__this_cpu_dec (process_counts); }list_del_rcu (&p->thread_group); +list_del_rcu (&p->thread_node); }/*
kernel/fork.c +7 -0
@@ -1045,6 +1045,11 @@ static int copy_signal(unsigned long clo sig->nr_threads =1 ;atomic_set (&sig->live,1 );atomic_set (&sig->sigcnt,1 ); + +/* list_add(thread_node, thread_head) without INIT_LIST_HEAD() */ + sig->thread_head = (struct list_head )LIST_HEAD_INIT (tsk->thread_node); + tsk->thread_node = (struct list_head )LIST_HEAD_INIT (sig->thread_head); +init_waitqueue_head (&sig->wait_chldexit); sig->curr_target = tsk;init_sigpending (&sig->shared_pending);
@@ -1471,6 +1476,8 @@ static struct task_struct *copy_process( p->group_leader = current->group_leader;list_add_tail_rcu (&p->thread_group, &p->group_leader->thread_group); +list_add_tail_rcu (&p->thread_node, + &p->signal->thread_head); }attach_pid (p,PIDTYPE_PID , pid); nr_threads++;
Greg Kroah-Hartman
maintainerPATCH 140/143 oom_kill: change oom_kill.c to use for_each_thread()
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleg Nesterov <[email protected]>
commit 1da4db0cd5c8a31d4468ec906b413e75e604b465 upstream.
Change oom_kill.c to use for_each_thread() rather than the racy while_each_thread() which can loop forever if we race with exit.
Note also that most users were buggy even if while_each_thread() was fine, the task can exit even _before_ rcu_read_lock().
Fortunately the new for_each_thread() only requires the stable task_struct, so this change fixes both problems.
--- mm/oom_kill.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-)
mm/oom_kill.c +10 -10
@@ -59,7 +59,7 @@ static bool has_intersects_mems_allowed( {struct task_struct *start = tsk; - do { +for_each_thread (start, tsk) {if (mask) {/* * If this is a mempolicy constrained oom, tsk's
@@ -77,7 +77,7 @@ static bool has_intersects_mems_allowed(if (cpuset_mems_allowed_intersects (current, tsk))return true; } - }while_each_thread (start, tsk); + }return false; }
@@ -97,14 +97,14 @@ static bool has_intersects_mems_allowed(*/ struct task_struct *find_lock_task_mm (struct task_struct *p) { -struct task_struct *t = p; +struct task_struct *t; - do { +for_each_thread (p, t) {task_lock (t);if (likely (t->mm))return t;task_unlock (t); - } while_each_thread(p, t); + }return NULL ; }
@@ -301,7 +301,7 @@ static struct task_struct *select_bad_prunsigned long chosen_points =0 ;rcu_read_lock (); - do_each_thread(g, p) { +for_each_process_thread (g, p) {unsigned int points; switch (oom_scan_process_thread(p, totalpages, nodemask,
@@ -323,7 +323,7 @@ static struct task_struct *select_bad_pr chosen = p; chosen_points = points; } - }while_each_thread (g, p); + }if (chosen)get_task_struct (chosen);rcu_read_unlock ();
@@ -406,7 +406,7 @@ void oom_kill_process(struct task_struct {struct task_struct *victim = p;struct task_struct *child; -struct task_struct *t = p; +struct task_struct *t;struct mm_struct *mm;unsigned int victim_points =0 ; static DEFINE_RATELIMIT_STATE(oom_rs, DEFAULT_RATELIMIT_INTERVAL,
@@ -437,7 +437,7 @@ void oom_kill_process(struct task_struct* still freeing memory. */ read_lock (&tasklist_lock); - do { +for_each_thread (p, t) {list_for_each_entry (child, &t->children, sibling) {unsigned int child_points;
@@ -455,7 +455,7 @@ void oom_kill_process(struct task_structget_task_struct (victim); } } - }while_each_thread (p, t); + }read_unlock (&tasklist_lock);rcu_read_lock ();
Greg Kroah-Hartman
maintainerPATCH 141/143 oom_kill: has_intersects_mems_allowed() needs rcu_read_lock()
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleg Nesterov <[email protected]>
commit ad96244179fbd55b40c00f10f399bc04739b8e1f upstream.
At least out_of_memory() calls has_intersects_mems_allowed() without even rcu_read_lock(), this is obviously buggy.
Add the necessary rcu_read_lock(). This means that we can not simply return from the loop, we need "bool ret" and "break".
While at it, swap the names of task_struct's (the argument and the local). This cleans up the code a little bit and avoids the unnecessary initialization.
--- mm/oom_kill.c | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-)
mm/oom_kill.c +11 -8
@@ -47,18 +47,20 @@ static DEFINE_SPINLOCK(zone_scan_lock);#ifdef CONFIG_NUMA /** * has_intersects_mems_allowed() - check task eligiblity for kill -* @tsk: task struct of which task to consider +* @start: task struct of which task to consider * @mask: nodemask passed to page allocator for mempolicy ooms * * Task eligibility is determined by whether or not a candidate task, @tsk, * shares the same mempolicy nodes as current if it is bound by such a policy * and whether or not it has the same set of allowed cpuset nodes. */ -static bool has_intersects_mems_allowed (struct task_struct *tsk, +static bool has_intersects_mems_allowed (struct task_struct *start,const nodemask_t *mask) { -struct task_struct *start = tsk; +struct task_struct *tsk; +bool ret = false; +rcu_read_lock ();for_each_thread (start, tsk) {if (mask) {/*
@@ -67,19 +69,20 @@ static bool has_intersects_mems_allowed(* mempolicy intersects current, otherwise it may be * needlessly killed. */ -if (mempolicy_nodemask_intersects (tsk, mask)) - return true; + ret = mempolicy_nodemask_intersects(tsk, mask); }else {/* * This is not a mempolicy constrained oom, so only * check the mems of tsk's cpuset. */ -if (cpuset_mems_allowed_intersects (current, tsk)) -return true; + ret =cpuset_mems_allowed_intersects (current, tsk); } +if (ret) +break ; } +rcu_read_unlock (); -return false; +return ret; }#else static bool has_intersects_mems_allowed(struct task_struct *tsk,
Greg Kroah-Hartman
maintainerPATCH 142/143 oom_kill: add rcu_read_lock() into find_lock_task_mm()
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleg Nesterov <[email protected]>
commit 4d4048be8a93769350efa31d2482a038b7de73d0 upstream.
find_lock_task_mm() expects it is called under rcu or tasklist lock, but it seems that at least oom_unkillable_task()->task_in_mem_cgroup() and mem_cgroup_out_of_memory()->oom_badness() can call it lockless.
Perhaps we could fix the callers, but this patch simply adds rcu lock into find_lock_task_mm(). This also allows to simplify a bit one of its callers, oom_kill_process().
--- mm/oom_kill.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
mm/oom_kill.c +8 -4
@@ -102,14 +102,19 @@ struct task_struct *find_lock_task_mm(st {struct task_struct *t; +rcu_read_lock (); +for_each_thread (p, t) {task_lock (t);if (likely (t->mm)) -return t; + goto found;task_unlock (t); } + t =NULL ; +found: +rcu_read_unlock (); -return NULL ; +return t; }/* return true if the task is not adequate as candidate victim task. */
@@ -461,10 +466,8 @@ void oom_kill_process(struct task_struct }read_unlock (&tasklist_lock); -rcu_read_lock (); p =find_lock_task_mm (victim);if (!p) { -rcu_read_unlock ();put_task_struct (victim);return ; }else if (victim != p) {
@@ -490,6 +493,7 @@ void oom_kill_process(struct task_struct* That thread will now get access to memory reserves since it has a * pending fatal signal. */ +rcu_read_lock ();for_each_process (p)if (p->mm == mm && !same_thread_group (p, victim) && !(p->flags &PF_KTHREAD )) {
Greg Kroah-Hartman
maintainerPATCH 143/143 vm_is_stack: use for_each_thread() rather then buggy while_each_thread()
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleg Nesterov <[email protected]>
commit 4449a51a7c281602d3a385044ab928322a122a02 upstream.
Aleksei hit the soft lockup during reading /proc/PID/smaps. David investigated the problem and suggested the right fix.
while_each_thread() is racy and should die, this patch updates vm_is_stack().
--- mm/util.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-)
mm/util.c +3 -6
@@ -272,17 +272,14 @@ pid_t vm_is_stack(struct task_struct *taif (in_group) {struct task_struct *t; -rcu_read_lock (); -if (!pid_alive (task)) - goto done; - t = task; - do { +rcu_read_lock (); +for_each_thread (task, t) {if (vm_is_stack_for_task (t, vma)) { ret = t->pid; goto done; } - } while_each_thread(task, t); + } done:rcu_read_unlock (); }
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 3.10.56 release. There are 143 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun Oct 5 21:32:57 UTC 2014. Anything received after that time might be too late.
Quoted 7 lines
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v3.0/stable-review/patch-3.10.56-rc1.gzand the diffstat can be found below.
thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
-- Shuah
Signature · 4 lines
Shuah Khan Sr. Linux Kernel Developer Samsung Research America (Silicon Valley) [email protected] | (970) 217-8978
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 3.10.56 release. There are 143 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun Oct 5 21:32:57 UTC 2014. Anything received after that time might be too late.
Build results:
total: 137 pass: 137 fail: 0
Qemu test results:
total: 25 pass: 25 fail: 0
Details are available at http://server.roeck-us.net:8010/builders.
Guenter