4.4.2-stable review
Subsystems (2)
Greg Kroah-Hartman
maintainercover 4.4.2-stable review
This is the start of the stable review cycle for the 4.4.2 release. There are 117 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Tue Feb 16 22:21:22 UTC 2016. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.2-rc1.gz
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.4.2-rc1
Junil Lee <[email protected]>
zsmalloc: fix migrate_zspage-zs_free race condition
Jerome Marchand <[email protected]>
zram: don't call idr_remove() from zram_remove()
Kyeongdon Kim <[email protected]>
zram: try vmalloc() after kmalloc()
Sergey Senozhatsky <[email protected]>
zram/zcomp: use GFP_NOIO to allocate streams
Larry Finger <[email protected]>
rtlwifi: rtl8821ae: Fix 5G failure when EEPROM is incorrectly encoded
Larry Finger <[email protected]>
rtlwifi: rtl8821ae: Fix errors in parameter initialization
Boris BREZILLON <[email protected]>
crypto: marvell/cesa - fix test in mv_cesa_dev_dma_init()
Cyrille Pitchen <[email protected]>
crypto: atmel-sha - remove calls of clk_prepare() from atomic contexts
Cyrille Pitchen <[email protected]>
crypto: atmel-sha - fix atmel_sha_remove()
Herbert Xu <[email protected]>
crypto: algif_skcipher - Do not set MAY_BACKLOG on the async path
Herbert Xu <[email protected]>
crypto: algif_skcipher - Do not dereference ctx without socket lock
Herbert Xu <[email protected]>
crypto: algif_skcipher - Do not assume that req is unchanged
Mathias Krause <[email protected]>
crypto: user - lock crypto_alg_list on alg dump
Ryan Ware <[email protected]>
EVM: Use crypto_memneq() for digest comparisons
Wang, Rui Y <[email protected]>
crypto: algif_hash - wait for crypto_ahash_init() to complete
Herbert Xu <[email protected]>
crypto: shash - Fix has_key setting
Eli Cooper <[email protected]>
crypto: chacha20-ssse3 - Align stack pointer to 64 bytes
Horia Geant? <[email protected]>
crypto: caam - make write transactions bufferable on PPC platforms
Herbert Xu <[email protected]>
crypto: algif_skcipher - sendmsg SG marking is off by one
Herbert Xu <[email protected]>
crypto: algif_skcipher - Load TX SG list after waiting
Jean Delvare <[email protected]>
crypto: crc32c - Fix crc32c soft dependency
Herbert Xu <[email protected]>
crypto: algif_skcipher - Fix race condition in skcipher_check_key
Herbert Xu <[email protected]>
crypto: algif_hash - Fix race condition in hash_check_key
Herbert Xu <[email protected]>
crypto: af_alg - Forbid bind(2) when nokey child sockets are present
Herbert Xu <[email protected]>
crypto: algif_skcipher - Remove custom release parent function
Herbert Xu <[email protected]>
crypto: algif_hash - Remove custom release parent function
Herbert Xu <[email protected]>
crypto: af_alg - Allow af_af_alg_release_parent to be called on nokey path
Alexandra Yates <[email protected]>
ahci: Intel DNV device IDs SATA
Tejun Heo <[email protected]>
libata: disable forced PORTS_IMPL for >= AHCI 1.3
Herbert Xu <[email protected]>
crypto: algif_skcipher - Add key check exception for cipher_null
Herbert Xu <[email protected]>
crypto: skcipher - Add crypto_skcipher_has_setkey
Herbert Xu <[email protected]>
crypto: algif_hash - Require setkey before accept(2)
Herbert Xu <[email protected]>
crypto: hash - Add crypto_ahash_has_setkey
Herbert Xu <[email protected]>
crypto: algif_skcipher - Add nokey compatibility path
Herbert Xu <[email protected]>
crypto: af_alg - Add nokey compatibility path
Herbert Xu <[email protected]>
crypto: af_alg - Fix socket double-free when accept fails
Herbert Xu <[email protected]>
crypto: af_alg - Disallow bind/setkey/... after accept(2)
Herbert Xu <[email protected]>
crypto: algif_skcipher - Require setkey before accept(2)
Raghavendra K T <[email protected]>
sched: Fix crash in sched_init_numa()
Theodore Ts'o <[email protected]>
ext4 crypto: add missing locking for keyring_key access
Will Deacon <[email protected]>
iommu/io-pgtable-arm: Ensure we free the final level on teardown
Peter Hurley <[email protected]>
tty: Fix unsafe ldisc reference via ioctl(TIOCGETD)
Peter Hurley <[email protected]>
tty: Retry failed reopen if tty teardown in-progress
Peter Hurley <[email protected]>
tty: Wait interruptibly for tty lock on reopen
Peter Hurley <[email protected]>
n_tty: Fix unsafe reference to "other" ldisc
Lu Baolu <[email protected]>
usb: xhci: apply XHCI_PME_STUCK_QUIRK to Intel Broxton-M platforms
Lu Baolu <[email protected]>
usb: xhci: handle both SSIC ports in PME stuck quirk
Srinivas Kandagatla <[email protected]>
usb: phy: msm: fix error handling in probe.
Lu Baolu <[email protected]>
usb: cdc-acm: send zero packet for intel 7260 modem
Lu Baolu <[email protected]>
usb: cdc-acm: handle unlinked urb in acm read callback
John Ernberg <[email protected]>
USB: option: fix Cinterion AHxx enumeration
Daniele Palmas <[email protected]>
USB: serial: option: Adding support for Telit LE922
Peter Dedecker <[email protected]>
USB: cp210x: add ID for IAI USB to RS485 adaptor
Greg Kroah-Hartman <[email protected]>
USB: serial: ftdi_sio: add support for Yaesu SCU-18 cable
Du, Changbin <[email protected]>
usb: hub: do not clear BOS field during reset device
Johan Hovold <[email protected]>
USB: visor: fix null-deref at probe
Vladis Dronov <[email protected]>
USB: serial: visor: fix crash on detecting device without write_urbs
Bard Liao <[email protected]>
ASoC: rt5645: fix the shift bit of IN1 boost
Mauro Carvalho Chehab <[email protected]>
saa7134-alsa: Only frees registered sound cards
Takashi Iwai <[email protected]>
ALSA: dummy: Implement timer backend switching more safely
Takashi Iwai <[email protected]>
ALSA: hda - Fix bad dereference of jack object
Takashi Iwai <[email protected]>
ALSA: hda - Fix speaker output from VAIO AiO machines
Takashi Iwai <[email protected]>
Revert "ALSA: hda - Fix noise on Gigabyte Z170X mobo"
David Henningsson <[email protected]>
ALSA: hda - Fix static checker warning in patch_hdmi.c
Takashi Iwai <[email protected]>
ALSA: hda - Add fixup for Mac Mini 7,1 model
Takashi Iwai <[email protected]>
ALSA: timer: Fix race between stop and interrupt
Takashi Iwai <[email protected]>
ALSA: timer: Fix wrong instance passed to slave callbacks
Takashi Iwai <[email protected]>
ALSA: timer: Fix race at concurrent reads
Takashi Iwai <[email protected]>
ALSA: timer: Fix link corruption due to double start or stop
Takashi Iwai <[email protected]>
ALSA: timer: Fix leftover link at closing
Takashi Iwai <[email protected]>
ALSA: timer: Code cleanup
Takashi Iwai <[email protected]>
ALSA: seq: Fix lockdep warnings due to double mutex locks
Takashi Iwai <[email protected]>
ALSA: seq: Fix race at closing in virmidi driver
Takashi Iwai <[email protected]>
ALSA: seq: Fix yet another races among ALSA timer accesses
Vinod Koul <[email protected]>
ASoC: dpcm: fix the BE state on hw_free
Takashi Iwai <[email protected]>
ALSA: pcm: Fix potential deadlock in OSS emulation
Kailang Yang <[email protected]>
ALSA: hda/realtek - Support Dell headset mode for ALC225
Kailang Yang <[email protected]>
ALSA: hda/realtek - Support headset mode for ALC225
Kailang Yang <[email protected]>
ALSA: hda/realtek - New codec support of ALC225
Takashi Iwai <[email protected]>
ALSA: rawmidi: Fix race at copying & updating the position
Takashi Iwai <[email protected]>
ALSA: rawmidi: Remove kernel WARNING for NULL user-space buffer check
Takashi Iwai <[email protected]>
ALSA: rawmidi: Make snd_rawmidi_transmit() race-free
Takashi Iwai <[email protected]>
ALSA: seq: Degrade the error message for too many opens
Takashi Iwai <[email protected]>
ALSA: seq: Fix incorrect sanity check at snd_seq_oss_synth_cleanup()
Takashi Iwai <[email protected]>
ALSA: dummy: Disable switching timer backend via sysfs
Takashi Iwai <[email protected]>
ALSA: compress: Disable GET_CODEC_CAPS ioctl for some architectures
Libin Yang <[email protected]>
ALSA: hda - disable dynamic clock gating on Broxton before reset
Takashi Iwai <[email protected]>
ALSA: Add missing dependency on CONFIG_SND_TIMER
Lucas Tanure <[email protected]>
ALSA: bebob: Use a signed return type for get_formation_index
Andrey Konovalov <[email protected]>
ALSA: usb-audio: avoid freeing umidi object twice
Jurgen Kramer <[email protected]>
ALSA: usb-audio: Add native DSD support for PS Audio NuWave DAC
Jurgen Kramer <[email protected]>
ALSA: usb-audio: Fix OPPO HA-1 vendor ID
Lev Lybin <[email protected]>
ALSA: usb-audio: Add quirk for Microsoft LifeCam HD-6000
Guillaume Fougnies <[email protected]>
ALSA: usb-audio: Fix TEAC UD-501/UD-503/NT-503 usb delay
Thomas Gleixner <[email protected]>
hrtimer: Handle remaining time proper for TIME_LOW_RES
Dan Williams <[email protected]>
md/raid: only permit hot-add of compatible integrity profiles
Javier Martinez Canillas <[email protected]>
media: i2c: Don't export ir-kbd-i2c module alias
Helge Deller <[email protected]>
parisc: Fix __ARCH_SI_PREAMBLE_SIZE
Helge Deller <[email protected]>
parisc: Protect huge page pte changes with spinlocks
Tejun Heo <[email protected]>
printk: do cond_resched() between lines while outputting to consoles
Steven Rostedt <[email protected]>
tracing/stacktrace: Show entire trace if passed in function not found
Steven Rostedt (Red Hat) <[email protected]>
tracing: Fix stacktrace skip depth in trace_buffer_unlock_commit_regs()
Christoph Biedl <[email protected]>
PCI: Fix minimum allocation address overwrite
Grygorii Strashko <[email protected]>
PCI: host: Mark PCIe/PCI (MSI) IRQ cascade handlers as IRQF_NO_THREAD
Brian Norris <[email protected]>
mtd: nand: assign reasonable default name for NAND drivers
Uri Mashiach <[email protected]>
wlcore/wl12xx: spi: fix NULL pointer dereference (Oops)
Uri Mashiach <[email protected]>
wlcore/wl12xx: spi: fix oops on firmware load
xuejiufei <[email protected]>
ocfs2/dlm: clear refmap bit of recovery lock while doing local recovery cleanup
xuejiufei <[email protected]>
ocfs2/dlm: ignore cleaning the migration mle that is inuse
Takashi Iwai <[email protected]>
ALSA: hda - Implement loopback control switch for Realtek and other codecs
Ming Lei <[email protected]>
block: fix bio splitting on max sectors
Martin Wilck <[email protected]>
base/platform: Fix platform drivers with no probe callback
Ioan-Adrian Ratiu <[email protected]>
HID: usbhid: fix recursive deadlock
Tariq Saeed <[email protected]>
ocfs2: NFS hangs in __ocfs2_cluster_lock due to race with ocfs2_unblock_lock
Keith Busch <[email protected]>
block: split bios to max possible length
Trond Myklebust <[email protected]>
NFSv4.1/pnfs: Fixup an lo->plh_block_lgets imbalance in layoutreturn
LABBE Corentin <[email protected]>
crypto: sun4i-ss - add missing statesize
-------------
Diffstat:
Makefile | 4 +- arch/parisc/include/asm/hugetlb.h | 20 +- arch/parisc/include/uapi/asm/siginfo.h | 4 + arch/parisc/mm/hugetlbpage.c | 60 ++++- arch/x86/crypto/chacha20-ssse3-x86_64.S | 6 +- block/blk-merge.c | 31 ++- crypto/af_alg.c | 55 ++++- crypto/ahash.c | 5 +- crypto/algif_hash.c | 169 +++++++++++++- crypto/algif_skcipher.c | 252 ++++++++++++++++----- crypto/crc32c_generic.c | 1 - crypto/crypto_user.c | 6 +- crypto/shash.c | 5 +- crypto/skcipher.c | 2 + drivers/ata/ahci.c | 20 ++ drivers/ata/libahci.c | 4 +- drivers/base/platform.c | 13 +- drivers/block/zram/zcomp.c | 4 +- drivers/block/zram/zcomp_lz4.c | 23 +- drivers/block/zram/zcomp_lzo.c | 23 +- drivers/block/zram/zram_drv.c | 7 +- drivers/crypto/atmel-sha.c | 23 +- drivers/crypto/caam/ctrl.c | 4 +- drivers/crypto/marvell/cesa.c | 2 +- drivers/crypto/sunxi-ss/sun4i-ss-core.c | 2 + drivers/hid/usbhid/hid-core.c | 4 +- drivers/iommu/io-pgtable-arm.c | 11 +- drivers/md/md.c | 28 ++- drivers/md/md.h | 2 +- drivers/md/multipath.c | 6 +- drivers/md/raid1.c | 6 +- drivers/md/raid10.c | 6 +- drivers/media/i2c/ir-kbd-i2c.c | 1 - drivers/media/pci/saa7134/saa7134-alsa.c | 5 +- drivers/mtd/nand/nand_base.c | 3 + drivers/net/wireless/realtek/rtlwifi/regd.c | 2 +- .../net/wireless/realtek/rtlwifi/rtl8821ae/sw.c | 9 +- drivers/net/wireless/ti/wlcore/io.h | 10 +- drivers/net/wireless/ti/wlcore/spi.c | 10 +- drivers/pci/bus.c | 6 +- drivers/pci/host/pci-dra7xx.c | 3 +- drivers/pci/host/pci-exynos.c | 3 +- drivers/pci/host/pci-imx6.c | 3 +- drivers/pci/host/pci-tegra.c | 2 +- drivers/pci/host/pcie-rcar.c | 6 +- drivers/pci/host/pcie-spear13xx.c | 3 +- drivers/pci/host/pcie-xilinx.c | 3 +- drivers/tty/n_tty.c | 7 +- drivers/tty/tty_io.c | 44 +++- drivers/tty/tty_mutex.c | 8 + drivers/usb/class/cdc-acm.c | 9 +- drivers/usb/class/cdc-acm.h | 1 + drivers/usb/core/hub.c | 8 +- drivers/usb/host/xhci-pci.c | 52 +++-- drivers/usb/phy/phy-msm-usb.c | 37 +-- drivers/usb/serial/cp210x.c | 1 + drivers/usb/serial/ftdi_sio.c | 1 + drivers/usb/serial/ftdi_sio_ids.h | 1 + drivers/usb/serial/option.c | 18 +- drivers/usb/serial/visor.c | 11 +- fs/ext4/crypto_key.c | 4 + fs/nfs/nfs4proc.c | 1 - fs/ocfs2/dlm/dlmmaster.c | 26 ++- fs/ocfs2/dlm/dlmrecovery.c | 2 + fs/ocfs2/dlmglue.c | 6 + include/crypto/hash.h | 6 + include/crypto/if_alg.h | 11 +- include/crypto/skcipher.h | 7 + include/linux/console.h | 1 + include/linux/hrtimer.h | 34 ++- include/linux/tty.h | 1 + include/sound/rawmidi.h | 4 + kernel/panic.c | 3 +- kernel/printk/printk.c | 35 ++- kernel/sched/core.c | 2 +- kernel/time/hrtimer.c | 55 +++-- kernel/time/timer_list.c | 2 +- kernel/trace/trace.c | 2 +- kernel/trace/trace_stack.c | 7 + lib/libcrc32c.c | 1 + mm/zsmalloc.c | 14 +- security/integrity/evm/evm_main.c | 3 +- sound/core/compress_offload.c | 11 + sound/core/oss/pcm_oss.c | 21 +- sound/core/rawmidi.c | 134 +++++++---- sound/core/seq/oss/seq_oss_init.c | 2 +- sound/core/seq/oss/seq_oss_synth.c | 2 +- sound/core/seq/seq_clientmgr.c | 3 + sound/core/seq/seq_ports.c | 233 ++++++++++--------- sound/core/seq/seq_timer.c | 87 +++++-- sound/core/seq/seq_virmidi.c | 23 +- sound/core/timer.c | 98 ++++---- sound/drivers/dummy.c | 35 +-- sound/firewire/bebob/bebob_stream.c | 14 +- sound/isa/Kconfig | 4 + sound/pci/Kconfig | 3 + sound/pci/hda/hda_generic.c | 91 ++++++-- sound/pci/hda/hda_intel.c | 13 ++ sound/pci/hda/hda_jack.c | 2 +- sound/pci/hda/hda_jack.h | 2 +- sound/pci/hda/patch_ca0132.c | 5 +- sound/pci/hda/patch_cirrus.c | 27 +++ sound/pci/hda/patch_hdmi.c | 5 +- sound/pci/hda/patch_realtek.c | 85 ++++++- sound/pci/hda/patch_sigmatel.c | 6 +- sound/soc/codecs/rt5645.c | 2 +- sound/soc/soc-pcm.c | 3 +- sound/sparc/Kconfig | 1 + sound/usb/midi.c | 1 - sound/usb/quirks.c | 18 +- 110 files changed, 1667 insertions(+), 566 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/117 crypto: sun4i-ss - add missing statesize
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: LABBE Corentin <[email protected]>
commit 4f9ea86604e3ba64edd2817795798168fbb3c1a6 upstream.
sun4i-ss implementaton of md5/sha1 is via ahash algorithms. Commit 8996eafdcbad ("crypto: ahash - ensure statesize is non-zero") made impossible to load them without giving statesize. This patch specifiy statesize for sha1 and md5.
--- drivers/crypto/sunxi-ss/sun4i-ss-core.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/crypto/sunxi-ss/sun4i-ss-core.c +2 -0
@@ -39,6 +39,7 @@ static struct sun4i_ss_alg_template ss_a .import = sun4i_hash_import_md5, .halg = { .digestsize = MD5_DIGEST_SIZE, + .statesize = sizeof(struct md5_state), .base = { .cra_name = "md5", .cra_driver_name = "md5-sun4i-ss",
@@ -66,6 +67,7 @@ static struct sun4i_ss_alg_template ss_a .import = sun4i_hash_import_sha1, .halg = { .digestsize = SHA1_DIGEST_SIZE, + .statesize = sizeof(struct sha1_state), .base = { .cra_name = "sha1", .cra_driver_name = "sha1-sun4i-ss",
Greg Kroah-Hartman
maintainerPATCH 2/117 NFSv4.1/pnfs: Fixup an lo->plh_block_lgets imbalance in layoutreturn
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
commit 1a093ceb053832c25b92f3cf26b957543c7baf9b upstream.
Since commit 2d8ae84fbc32, nothing is bumping lo->plh_block_lgets in the layoutreturn path, so it should not be touched in nfs4_layoutreturn_release either.
--- fs/nfs/nfs4proc.c | 1 - 1 file changed, 1 deletion(-)
fs/nfs/nfs4proc.c +0 -1
@@ -8054,7 +8054,6 @@ static void nfs4_layoutreturn_release(vopnfs_set_layout_stateid (lo, &lrp->res.stateid, true);pnfs_mark_matching_lsegs_invalid (lo, &freeme, &lrp->args.range);pnfs_clear_layoutreturn_waitbit (lo); - lo->plh_block_lgets--;spin_unlock (&lo->plh_inode->i_lock);pnfs_free_lseg_list (&freeme);pnfs_put_layout_hdr (lrp->args.layout);
Greg Kroah-Hartman
maintainerPATCH 3/117 block: split bios to max possible length
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keith Busch <[email protected]>
commit e36f6204288088fda50d1c84830340ccb70f85ff upstream.
This splits bio in the middle of a vector to form the largest possible bio at the h/w's desired alignment, and guarantees the bio being split will have some data.
The criteria for splitting is changed from the max sectors to the h/w's optimal sector alignment if it is provided. For h/w that advertise their block storage's underlying chunk size, it's a big performance win to not submit commands that cross them. If sector alignment is not provided, this patch uses the max sectors as before.
This addresses the performance issue commit d380561113 attempted to fix, but was reverted due to splitting logic error.
--- block/blk-merge.c | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-)
block/blk-merge.c +16 -3
@@ -81,9 +81,6 @@ static struct bio *blk_bio_segment_splitstruct bio *new =NULL ;bio_for_each_segment (bv, bio, iter) { -if (sectors + (bv.bv_len >>9 ) >queue_max_sectors (q)) - goto split; -/* * If the queue doesn't support SG gaps and adding this * offset would create a gap, disallow it.
@@ -91,6 +88,22 @@ static struct bio *blk_bio_segment_splitif (bvprvp &&bvec_gap_to_prev (q, bvprvp, bv.bv_offset)) goto split; +if (sectors + (bv.bv_len >>9 ) > +blk_max_size_offset (q, bio->bi_iter.bi_sector)) { +/* +* Consider this a new segment if we're splitting in +* the middle of this vector. +*/ +if (nsegs <queue_max_segments (q) && + sectors <blk_max_size_offset (q, + bio->bi_iter.bi_sector)) { + nsegs++; + sectors =blk_max_size_offset (q, + bio->bi_iter.bi_sector); + } + goto split; + } +if (bvprvp &&blk_queue_cluster (q)) {if (seg_size + bv.bv_len >queue_max_segment_size (q)) goto new_segment;
Greg Kroah-Hartman
maintainerPATCH 4/117 ocfs2: NFS hangs in __ocfs2_cluster_lock due to race with ocfs2_unblock_lock
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tariq Saeed <[email protected]>
commit b1b1e15ef6b80facf76d6757649dfd7295eda29f upstream.
NFS on a 2 node ocfs2 cluster each node exporting dir. The lock causing the hang is the global bit map inode lock. Node 1 is master, has the lock granted in PR mode; Node 2 is in the converting list (PR -> EX). There are no holders of the lock on the master node so it should downconvert to NL and grant EX to node 2 but that does not happen. BLOCKED + QUEUED in lock res are set and it is on osb blocked list. Threads are waiting in __ocfs2_cluster_lock on BLOCKED. One thread wants EX, rest want PR. So it is as though the downconvert thread needs to be kicked to complete the conv.
The hang is caused by an EX req coming into __ocfs2_cluster_lock on the heels of a PR req after it sets BUSY (drops l_lock, releasing EX thread), forcing the incoming EX to wait on BUSY without doing anything. PR has called ocfs2_dlm_lock, which sets the node 1 lock from NL -> PR, queues ast.
At this time, upconvert (PR ->EX) arrives from node 2, finds conflict with node 1 lock in PR, so the lock res is put on dlm thread's dirty listt.
After ret from ocf2_dlm_lock, PR thread now waits behind EX on BUSY till awoken by ast.
Now it is dlm_thread that serially runs dlm_shuffle_lists, ast, bast, in that order. dlm_shuffle_lists ques a bast on behalf of node 2 (which will be run by dlm_thread right after the ast). ast does its part, sets UPCONVERT_FINISHING, clears BUSY and wakes its waiters. Next, dlm_thread runs bast. It sets BLOCKED and kicks dc thread. dc thread runs ocfs2_unblock_lock, but since UPCONVERT_FINISHING set, skips doing anything and reques.
Inside of __ocfs2_cluster_lock, since EX has been waiting on BUSY ahead of PR, it wakes up first, finds BLOCKED set and skips doing anything but clearing UPCONVERT_FINISHING (which was actually "meant" for the PR thread), and this time waits on BLOCKED. Next, the PR thread comes out of wait but since UPCONVERT_FINISHING is not set, it skips updating the l_ro_holders and goes straight to wait on BLOCKED. So there, we have a hang! Threads in __ocfs2_cluster_lock wait on BLOCKED, lock res in osb blocked list. Only when dc thread is awoken, it will run ocfs2_unblock_lock and things will unhang.
One way to fix this is to wake the dc thread on the flag after clearing UPCONVERT_FINISHING
Orabug: 20933419
--- fs/ocfs2/dlmglue.c | 6 ++++++ 1 file changed, 6 insertions(+)
fs/ocfs2/dlmglue.c +6 -0
@@ -1390,6 +1390,7 @@ static int __ocfs2_cluster_lock(struct ounsigned int gen;int noqueue_attempted =0 ;int dlm_locked =0 ; +int kick_dc =0 ;if (!(lockres->l_flags &OCFS2_LOCK_INITIALIZED )) {mlog_errno (-EINVAL );
@@ -1524,7 +1525,12 @@ update_holders: unlock:lockres_clear_flags (lockres,OCFS2_LOCK_UPCONVERT_FINISHING ); +/* ocfs2_unblock_lock reques on seeing OCFS2_LOCK_UPCONVERT_FINISHING */ + kick_dc = (lockres->l_flags &OCFS2_LOCK_BLOCKED ); +spin_unlock_irqrestore (&lockres->l_lock, flags); +if (kick_dc) +ocfs2_wake_downconvert_thread (osb); out:/* * This is helping work around a lock inversion between the page lock
Greg Kroah-Hartman
maintainerPATCH 5/117 HID: usbhid: fix recursive deadlock
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ioan-Adrian Ratiu <[email protected]>
commit e470127e9606b1fa151c4184243e61296d1e0c0f upstream.
The critical section protected by usbhid->lock in hid_ctrl() is too big and because of this it causes a recursive deadlock. "Too big" means the case statement and the call to hid_input_report() do not need to be protected by the spinlock (no URB operations are done inside them).
The deadlock happens because in certain rare cases drivers try to grab the lock while handling the ctrl irq which grabs the lock before them as described above. For example newer wacom tablets like 056a:033c try to reschedule proximity reads from wacom_intuos_schedule_prox_event() calling hid_hw_request() -> usbhid_request() -> usbhid_submit_report() which tries to grab the usbhid lock already held by hid_ctrl().
There are two ways to get out of this deadlock:
1. Make the drivers work "around" the ctrl critical region, in the wacom case for ex. by delaying the scheduling of the proximity read request itself to a workqueue.
2. Shrink the critical region so the usbhid lock protects only the instructions which modify usbhid state, calling hid_input_report() with the spinlock unlocked, allowing the device driver to grab the lock first, finish and then grab the lock afterwards in hid_ctrl().
This patch implements the 2nd solution.
--- drivers/hid/usbhid/hid-core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/hid/usbhid/hid-core.c +2 -2
@@ -477,8 +477,6 @@ static void hid_ctrl(struct urb *urb)struct usbhid_device *usbhid = hid->driver_data;int unplug =0 , status = urb->status; -spin_lock (&usbhid->lock); -switch (status) {case 0 :/* success */ if (usbhid->ctrl[usbhid->ctrltail].dir ==USB_DIR_IN )
@@ -498,6 +496,8 @@ static void hid_ctrl(struct urb *urb)hid_warn (urb->dev,"ctrl urb status %d received\n" , status); } +spin_lock (&usbhid->lock); +if (unplug) { usbhid->ctrltail = usbhid->ctrlhead; }else {
Greg Kroah-Hartman
maintainerPATCH 6/117 base/platform: Fix platform drivers with no probe callback
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Wilck <[email protected]>
commit 25cad69f21f5532d99e2ee73c8ab6512bcab614c upstream.
Since b8b2c7d845d5, platform_drv_probe() is called for all platform devices. If drv->probe is NULL, and dev_pm_domain_attach() fails, platform_drv_probe() will return the error code from dev_pm_domain_attach().
This causes real_probe() to enter the "probe_failed" path and set dev->driver to NULL. Before b8b2c7d845d5, real_probe() would assume success if both dev->bus->probe and drv->probe were missing. As a result, a device and driver could be "bound" together just by matching their names; this doesn't work any more after b8b2c7d845d5.
This may cause problems later for certain usage of platform_driver_register() and platform_device_register_simple(). I observed a panic while loading the tpm_tis driver with parameter "force=1" (i.e. registering tpm_tis as a platform driver), because tpm_tis_init's assumption that the device returned by platform_device_register_simple() was bound didn't hold any more (tpmm_chip_alloc() dereferences chip->pdev->driver, causing panic).
This patch restores the previous (4.3.0 and earlier) behavior of platform_drv_probe() in the case when the associated platform driver has no "probe" function.
--- drivers/base/platform.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
drivers/base/platform.c +9 -4
@@ -513,10 +513,15 @@ static int platform_drv_probe(struct devreturn ret; ret =dev_pm_domain_attach (_dev, true); -if (ret != -EPROBE_DEFER && drv->probe) { - ret = drv->probe (dev); -if (ret) -dev_pm_domain_detach (_dev, true); +if (ret != -EPROBE_DEFER ) { +if (drv->probe) { + ret = drv->probe (dev); +if (ret) +dev_pm_domain_detach (_dev, true); + }else { +/* don't fail if just dev_pm_domain_attach failed */ + ret =0 ; + } }if (drv->prevent_deferred_probe && ret == -EPROBE_DEFER ) {
Greg Kroah-Hartman
maintainerPATCH 7/117 block: fix bio splitting on max sectors
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Lei <[email protected]>
commit d0e5fbb01a67e400e82fefe4896ea40c6447ab98 upstream.
After commit e36f62042880(block: split bios to maxpossible length), bio can be splitted in the middle of a vector entry, then it is easy to split out one bio which size isn't aligned with block size, especially when the block size is bigger than 512.
This patch fixes the issue by making the max io size aligned to logical block size.
--- block/blk-merge.c | 26 +++++++++++++++++++------- 1 file changed, 19 insertions(+), 7 deletions(-)
block/blk-merge.c +19 -7
@@ -68,6 +68,18 @@ static struct bio *blk_bio_write_same_spreturn bio_split (bio, q->limits.max_write_same_sectors,GFP_NOIO , bs); } +static inline unsigned get_max_io_size (struct request_queue *q, +struct bio *bio) +{ +unsigned sectors =blk_max_size_offset (q, bio->bi_iter.bi_sector); +unsigned mask =queue_logical_block_size (q) -1 ; + +/* aligned to logical block size */ + sectors &= ~(mask >>9 ); + +return sectors; +} + static struct bio *blk_bio_segment_split(struct request_queue *q, struct bio *bio, struct bio_set *bs,
@@ -79,6 +91,7 @@ static struct bio *blk_bio_segment_splitunsigned front_seg_size = bio->bi_seg_front_size;bool do_split = true;struct bio *new =NULL ; +const unsigned max_sectors =get_max_io_size (q, bio);bio_for_each_segment (bv, bio, iter) {/*
@@ -88,20 +101,19 @@ static struct bio *blk_bio_segment_splitif (bvprvp &&bvec_gap_to_prev (q, bvprvp, bv.bv_offset)) goto split; -if (sectors + (bv.bv_len >>9 ) > -blk_max_size_offset (q, bio->bi_iter.bi_sector)) { +if (sectors + (bv.bv_len >>9 ) > max_sectors) {/* * Consider this a new segment if we're splitting in * the middle of this vector. */ if (nsegs <queue_max_segments (q) && - sectors <blk_max_size_offset (q, - bio->bi_iter.bi_sector)) { + sectors < max_sectors) { nsegs++; - sectors =blk_max_size_offset (q, - bio->bi_iter.bi_sector); + sectors = max_sectors; } - goto split; +if (sectors) + goto split; +/* Make this single bvec as the 1st segment */ }if (bvprvp &&blk_queue_cluster (q)) {
Greg Kroah-Hartman
maintainerPATCH 8/117 ALSA: hda - Implement loopback control switch for Realtek and other codecs
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit e7fdd52779a6c2b49d457f452296a77c8cffef6a upstream.
Many codecs, typically found on Realtek codecs, have the analog loopback path merged to the secondary input of the middle of the output paths. Currently, we don't offer the dynamic switching in such configuration but let each loopback path mute by itself.
This should work well in theory, but in reality, we often see that such a dead loopback path causes some background noises even if all the elements get muted. Such a problem has been fixed by adding the quirk accordingly to disable aamix, and it's the right fix, per se. The only problem is that it's not so trivial to achieve it; user needs to pass a hint string via patch module option or sysfs.
This patch gives a bit improvement on the situation: it adds "Loopback Mixing" control element for such codecs like other codecs (e.g. IDT or VIA codecs) with the individual loopback paths. User can turn on/off the loopback path simply via a mixer app.
For keeping the compatibility, the loopback is still enabled on these codecs. But user can try to turn it off if experiencing a suspicious background or click noise on the fly, then build a static fixup later once after the problem is addressed.
Other than the addition of the loopback enable/disablement control, there should be no changes.
--- sound/pci/hda/hda_generic.c | 87 ++++++++++++++++++++++++++++++++++---------- 1 file changed, 68 insertions(+), 19 deletions(-)
sound/pci/hda/hda_generic.c +68 -19
@@ -771,9 +771,6 @@ static void activate_amp(struct hda_codeunsigned int caps;unsigned int mask, val; -if (!enable &&is_active_nid (codec, nid, dir, idx_to_check)) -return ; - caps =query_amp_caps (codec, nid, dir); val =get_amp_val_to_activate (codec, nid, dir, caps, enable); mask =get_amp_mask_to_modify (codec, nid, dir, idx_to_check, caps);
@@ -784,12 +781,22 @@ static void activate_amp(struct hda_codeupdate_amp (codec, nid, dir, idx, mask, val); } +static void check_and_activate_amp (struct hda_codec *codec,hda_nid_t nid, +int dir,int idx,int idx_to_check, +bool enable) +{ +/* check whether the given amp is still used by others */ +if (!enable &&is_active_nid (codec, nid, dir, idx_to_check)) +return ; +activate_amp (codec, nid, dir, idx, idx_to_check, enable); +} +static void activate_amp_out (struct hda_codec *codec,struct nid_path *path,int i,bool enable) {hda_nid_t nid = path->path[i];init_amp (codec, nid,HDA_OUTPUT ,0 ); -activate_amp (codec, nid,HDA_OUTPUT ,0 ,0 , enable); +check_and_activate_amp (codec, nid,HDA_OUTPUT ,0 ,0 , enable); } static void activate_amp_in(struct hda_codec *codec, struct nid_path *path,
@@ -817,9 +824,16 @@ static void activate_amp_in(struct hda_c* when aa-mixer is available, we need to enable the path as well */ for (n =0 ; n < nums; n++) { -if (n != idx && (!add_aamix || conn[n] != spec->mixer_merge_nid)) -continue ; -activate_amp (codec, nid,HDA_INPUT , n, idx, enable); +if (n != idx) { +if (conn[n] != spec->mixer_merge_nid) +continue ; +/* when aamix is disabled, force to off */ +if (!add_aamix) { +activate_amp (codec, nid,HDA_INPUT , n, n, false); +continue ; + } + } +check_and_activate_amp (codec, nid,HDA_INPUT , n, idx, enable); } }
@@ -1580,6 +1594,12 @@ static bool map_singles(struct hda_codecreturn found; } +static inline bool has_aamix_out_paths (struct hda_gen_spec *spec) +{ +return spec->aamix_out_paths[0 ] || spec->aamix_out_paths[1 ] || + spec->aamix_out_paths[2 ]; +} +/* create a new path including aamix if available, and return its index */ static int check_aamix_out_path (struct hda_codec *codec,int path_idx) {
@@ -2422,25 +2442,51 @@ static void update_aamix_paths(struct hd } } +/* re-initialize the output paths; only called from loopback_mixing_put() */ +static void update_output_paths (struct hda_codec *codec,int num_outs, +const int *paths) +{ +struct hda_gen_spec *spec = codec->spec; +struct nid_path *path; +int i; + +for (i =0 ; i < num_outs; i++) { + path =snd_hda_get_path_from_idx (codec, paths[i]); +if (path) +snd_hda_activate_path (codec, path, path->active, + spec->aamix_mode); + } +} +static int loopback_mixing_put (struct snd_kcontrol *kcontrol,struct snd_ctl_elem_value *ucontrol) {struct hda_codec *codec =snd_kcontrol_chip (kcontrol);struct hda_gen_spec *spec = codec->spec; +const struct auto_pin_cfg *cfg = &spec->autocfg;unsigned int val = ucontrol->value.enumerated.item[0 ];if (val == spec->aamix_mode)return 0 ; spec->aamix_mode = val; -update_aamix_paths (codec, val, spec->out_paths[0 ], - spec->aamix_out_paths[0 ], - spec->autocfg.line_out_type); -update_aamix_paths (codec, val, spec->hp_paths[0 ], - spec->aamix_out_paths[1 ], -AUTO_PIN_HP_OUT ); -update_aamix_paths (codec, val, spec->speaker_paths[0 ], - spec->aamix_out_paths[2 ], -AUTO_PIN_SPEAKER_OUT ); +if (has_aamix_out_paths (spec)) { +update_aamix_paths (codec, val, spec->out_paths[0 ], + spec->aamix_out_paths[0 ], + cfg->line_out_type); +update_aamix_paths (codec, val, spec->hp_paths[0 ], + spec->aamix_out_paths[1 ], +AUTO_PIN_HP_OUT ); +update_aamix_paths (codec, val, spec->speaker_paths[0 ], + spec->aamix_out_paths[2 ], +AUTO_PIN_SPEAKER_OUT ); + }else { +update_output_paths (codec, cfg->line_outs, spec->out_paths); +if (cfg->line_out_type !=AUTO_PIN_HP_OUT ) +update_output_paths (codec, cfg->hp_outs, spec->hp_paths); +if (cfg->line_out_type !=AUTO_PIN_SPEAKER_OUT ) +update_output_paths (codec, cfg->speaker_outs, + spec->speaker_paths); + }return 1 ; }
@@ -2458,12 +2504,13 @@ static int create_loopback_mixing_ctl(stif (!spec->mixer_nid)return 0 ; -if (!(spec->aamix_out_paths[0 ] || spec->aamix_out_paths[1 ] || - spec->aamix_out_paths[2 ])) -return 0 ;if (!snd_hda_gen_add_kctl (spec,NULL , &loopback_mixing_enum))return -ENOMEM ; spec->have_aamix_ctl =1 ; +/* if no explicit aamix path is present (e.g. for Realtek codecs), +* enable aamix as default -- just for compatibility +*/ + spec->aamix_mode = !has_aamix_out_paths (spec);return 0 ; }
@@ -5664,6 +5711,8 @@ static void init_aamix_paths(struct hda_if (!spec->have_aamix_ctl)return ; +if (!has_aamix_out_paths (spec)) +return ;update_aamix_paths (codec, spec->aamix_mode, spec->out_paths[0 ], spec->aamix_out_paths[0 ], spec->autocfg.line_out_type);
Greg Kroah-Hartman
maintainerPATCH 9/117 ocfs2/dlm: ignore cleaning the migration mle that is inuse
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: xuejiufei <[email protected]>
commit bef5502de074b6f6fa647b94b73155d675694420 upstream.
We have found that migration source will trigger a BUG that the refcount of mle is already zero before put when the target is down during migration. The situation is as follows:
dlm_migrate_lockres
dlm_add_migration_mle
dlm_mark_lockres_migrating
dlm_get_mle_inuse
<<<<<< Now the refcount of the mle is 2. dlm_send_one_lockres and wait for the target to become the new master.
<<<<<< o2hb detect the target down and clean the migration mle. Now the refcount is 1.
dlm_migrate_lockres woken, and put the mle twice when found the target goes down which trigger the BUG with the following message:
"ERROR: bad mle: ".
--- fs/ocfs2/dlm/dlmmaster.c | 26 +++++++++++++++----------- 1 file changed, 15 insertions(+), 11 deletions(-)
fs/ocfs2/dlm/dlmmaster.c +15 -11
@@ -2519,6 +2519,11 @@ static int dlm_migrate_lockres(struct dlspin_lock (&dlm->master_lock); ret =dlm_add_migration_mle (dlm, res, mle, &oldmle, name, namelen, target, dlm->node_num); +/* get an extra reference on the mle. +* otherwise the assert_master from the new +* master will destroy this. +*/ +dlm_get_mle_inuse (mle);spin_unlock (&dlm->master_lock);spin_unlock (&dlm->spinlock);
@@ -2554,6 +2559,7 @@ fail:if (mle_added) {dlm_mle_detach_hb_events (dlm, mle);dlm_put_mle (mle); +dlm_put_mle_inuse (mle); }else if (mle) {kmem_cache_free (dlm_mle_cache, mle); mle =NULL ;
@@ -2571,17 +2577,6 @@ fail:* ensure that all assert_master work is flushed. */ flush_workqueue (dlm->dlm_worker); -/* get an extra reference on the mle. -* otherwise the assert_master from the new -* master will destroy this. -* also, make sure that all callers of dlm_get_mle -* take both dlm->spinlock and dlm->master_lock */ -spin_lock (&dlm->spinlock); -spin_lock (&dlm->master_lock); -dlm_get_mle_inuse (mle); -spin_unlock (&dlm->master_lock); -spin_unlock (&dlm->spinlock); -/* notify new node and send all lock state */ /* call send_one_lockres with migration flag. * this serves as notice to the target node that a
@@ -3312,6 +3307,15 @@ top: mle->new_master != dead_node)continue ; +if (mle->new_master == dead_node && mle->inuse) { +mlog (ML_NOTICE ,"%s: target %u died during " +"migration from %u, the MLE is " +"still keep used, ignore it!\n" , + dlm->name, dead_node, + mle->master); +continue ; + } +/* If we have reached this point, this mle needs to be * removed from the list and freed. */ dlm_clean_migration_mle (dlm, mle);
Greg Kroah-Hartman
maintainerPATCH 10/117 ocfs2/dlm: clear refmap bit of recovery lock while doing local recovery cleanup
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: xuejiufei <[email protected]>
commit c95a51807b730e4681e2ecbdfd669ca52601959e upstream.
When recovery master down, dlm_do_local_recovery_cleanup() only remove the $RECOVERY lock owned by dead node, but do not clear the refmap bit. Which will make umount thread falling in dead loop migrating $RECOVERY to the dead node.
--- fs/ocfs2/dlm/dlmrecovery.c | 2 ++ 1 file changed, 2 insertions(+)
fs/ocfs2/dlm/dlmrecovery.c +2 -0
@@ -2360,6 +2360,8 @@ static void dlm_do_local_recovery_cleanubreak ; } } +dlm_lockres_clear_refmap_bit (dlm, res, + dead_node);spin_unlock (&res->spinlock);continue ; }
Greg Kroah-Hartman
maintainerPATCH 11/117 wlcore/wl12xx: spi: fix oops on firmware load
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uri Mashiach <[email protected]>
commit 9b2761cb72dc41e1948c8a5512b4efd384eda130 upstream.
The maximum chunks used by the function is (SPI_AGGR_BUFFER_SIZE / WSPI_MAX_CHUNK_SIZE + 1).
The original commands array had space for (SPI_AGGR_BUFFER_SIZE / WSPI_MAX_CHUNK_SIZE) commands. When the last chunk is used (len > 4 * WSPI_MAX_CHUNK_SIZE), the last command is stored outside the bounds of the commands array.
Oops 5 (page fault) is generated during current wl1271 firmware load attempt:
root@debian-armhf:~# ifconfig wlan0 up [ 294.312399] Unable to handle kernel paging request at virtual address 00203fc4 [ 294.320173] pgd = de528000 [ 294.323028] [00203fc4] *pgd=00000000 [ 294.326916] Internal error: Oops: 5 [#1] SMP ARM [ 294.331789] Modules linked in: bnep rfcomm bluetooth ipv6 arc4 wl12xx wlcore mac80211 musb_dsps cfg80211 musb_hdrc usbcore usb_common wlcore_spi omap_rng rng_core musb_am335x omap_wdt cpufreq_dt thermal_sys hwmon [ 294.351838] CPU: 0 PID: 1827 Comm: ifconfig Not tainted 4.2.0-00002-g3e9ad27-dirty #78 [ 294.360154] Hardware name: Generic AM33XX (Flattened Device Tree) [ 294.366557] task: dc9d6d40 ti: de550000 task.ti: de550000 [ 294.372236] PC is at __spi_validate+0xa8/0x2ac [ 294.376902] LR is at __spi_sync+0x78/0x210 [ 294.381200] pc : [<c049c760>] lr : [<c049ebe0>] psr: 60000013 [ 294.381200] sp : de551998 ip : de5519d8 fp : 00200000 [ 294.393242] r10: de551c8c r9 : de5519d8 r8 : de3a9000 [ 294.398730] r7 : de3a9258 r6 : de3a9400 r5 : de551a48 r4 : 00203fbc [ 294.405577] r3 : 00000000 r2 : 00000000 r1 : 00000000 r0 : de3a9000 [ 294.412420] Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user [ 294.419918] Control: 10c5387d Table: 9e528019 DAC: 00000015 [ 294.425954] Process ifconfig (pid: 1827, stack limit = 0xde550218) [ 294.432437] Stack: (0xde551998 to 0xde552000)
...
[ 294.883613] [<c049c760>] (__spi_validate) from [<c049ebe0>] (__spi_sync+0x78/0x210) [ 294.891670] [<c049ebe0>] (__spi_sync) from [<bf036598>] (wl12xx_spi_raw_write+0xfc/0x148 [wlcore_spi]) [ 294.901661] [<bf036598>] (wl12xx_spi_raw_write [wlcore_spi]) from [<bf21c694>] (wlcore_boot_upload_firmware+0x1ec/0x458 [wlcore]) [ 294.914038] [<bf21c694>] (wlcore_boot_upload_firmware [wlcore]) from [<bf24532c>] (wl12xx_boot+0xc10/0xfac [wl12xx]) [ 294.925161] [<bf24532c>] (wl12xx_boot [wl12xx]) from [<bf20d5cc>] (wl1271_op_add_interface+0x5b0/0x910 [wlcore]) [ 294.936364] [<bf20d5cc>] (wl1271_op_add_interface [wlcore]) from [<bf15c4ac>] (ieee80211_do_open+0x44c/0xf7c [mac80211]) [ 294.947963] [<bf15c4ac>] (ieee80211_do_open [mac80211]) from [<c0537978>] (__dev_open+0xa8/0x110) [ 294.957307] [<c0537978>] (__dev_open) from [<c0537bf8>] (__dev_change_flags+0x88/0x148) [ 294.965713] [<c0537bf8>] (__dev_change_flags) from [<c0537cd0>] (dev_change_flags+0x18/0x48) [ 294.974576] [<c0537cd0>] (dev_change_flags) from [<c05a55a0>] (devinet_ioctl+0x6b4/0x7d0) [ 294.983191] [<c05a55a0>] (devinet_ioctl) from [<c0517040>] (sock_ioctl+0x1e4/0x2bc) [ 294.991244] [<c0517040>] (sock_ioctl) from [<c017d378>] (do_vfs_ioctl+0x420/0x6b0) [ 294.999208] [<c017d378>] (do_vfs_ioctl) from [<c017d674>] (SyS_ioctl+0x6c/0x7c) [ 295.006880] [<c017d674>] (SyS_ioctl) from [<c000f4c0>] (ret_fast_syscall+0x0/0x54) [ 295.014835] Code: e1550004 e2444034 0a00007d e5953018 (e5942008) [ 295.021544] ---[ end trace 66ed188198f4e24e ]---
--- drivers/net/wireless/ti/wlcore/spi.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/net/wireless/ti/wlcore/spi.c +7 -3
@@ -73,7 +73,10 @@*/ #define SPI_AGGR_BUFFER_SIZE (4 * PAGE_SIZE) -#define WSPI_MAX_NUM_OF_CHUNKS (SPI_AGGR_BUFFER_SIZE / WSPI_MAX_CHUNK_SIZE) +/* Maximum number of SPI write chunks */ +#define WSPI_MAX_NUM_OF_CHUNKS \ + ((SPI_AGGR_BUFFER_SIZE / WSPI_MAX_CHUNK_SIZE) + 1) +struct wl12xx_spi_glue {struct device *dev;
@@ -268,9 +271,10 @@ static int __must_check wl12xx_spi_raw_w void *buf, size_t len, bool fixed) {struct wl12xx_spi_glue *glue =dev_get_drvdata (child->parent); -struct spi_transfer t[2 * (WSPI_MAX_NUM_OF_CHUNKS +1 )]; +/* SPI write buffers - 2 for each chunk */ +struct spi_transfer t[2 *WSPI_MAX_NUM_OF_CHUNKS ];struct spi_message m; -u32 commands[WSPI_MAX_NUM_OF_CHUNKS ]; +u32 commands[WSPI_MAX_NUM_OF_CHUNKS ];/* 1 command per chunk */ u32 *cmd;u32 chunk_len;int i;
Greg Kroah-Hartman
maintainerPATCH 12/117 wlcore/wl12xx: spi: fix NULL pointer dereference (Oops)
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uri Mashiach <[email protected]>
commit e47301b06d5a65678690f04c2248fd181db1e59a upstream.
Fix the below Oops when trying to modprobe wlcore_spi. The oops occurs because the wl1271_power_{off,on}() function doesn't check the power() function pointer.
[ 23.401447] Unable to handle kernel NULL pointer dereference at virtual address 00000000 [ 23.409954] pgd = c0004000 [ 23.412922] [00000000] *pgd=00000000 [ 23.416693] Internal error: Oops: 80000007 [#1] SMP ARM [ 23.422168] Modules linked in: wl12xx wlcore mac80211 cfg80211
musb_dsps musb_hdrc usbcore usb_common snd_soc_simple_card evdev joydev omap_rng wlcore_spi snd_soc_tlv320aic23_i2c rng_core snd_soc_tlv320aic23 c_can_platform c_can can_dev snd_soc_davinci_mcasp snd_soc_edma snd_soc_omap omap_wdt musb_am335x cpufreq_dt thermal_sys hwmon
[ 23.453253] CPU: 0 PID: 36 Comm: kworker/0:2 Not tainted 4.2.0-00002-g951efee-dirty #233 [ 23.461720] Hardware name: Generic AM33XX (Flattened Device Tree) [ 23.468123] Workqueue: events request_firmware_work_func [ 23.473690] task: de32efc0 ti: de4ee000 task.ti: de4ee000 [ 23.479341] PC is at 0x0 [ 23.482112] LR is at wl12xx_set_power_on+0x28/0x124 [wlcore] [ 23.488074] pc : [<00000000>] lr : [<bf2581f0>] psr: 60000013 [ 23.488074] sp : de4efe50 ip : 00000002 fp : 00000000 [ 23.500162] r10: de7cdd00 r9 : dc848800 r8 : bf27af00 [ 23.505663] r7 : bf27a1a8 r6 : dcbd8a80 r5 : dce0e2e0 r4 : dce0d2e0 [ 23.512536] r3 : 00000000 r2 : 00000000 r1 : 00000001 r0 : dc848810 [ 23.519412] Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment kernel [ 23.527109] Control: 10c5387d Table: 9cb78019 DAC: 00000015 [ 23.533160] Process kworker/0:2 (pid: 36, stack limit = 0xde4ee218) [ 23.539760] Stack: (0xde4efe50 to 0xde4f0000)
[...]
[ 23.665030] [<bf2581f0>] (wl12xx_set_power_on [wlcore]) from [<bf25f7ac>] (wlcore_nvs_cb+0x118/0xa4c [wlcore]) [ 23.675604] [<bf25f7ac>] (wlcore_nvs_cb [wlcore]) from [<c04387ec>] (request_firmware_work_func+0x30/0x58) [ 23.685784] [<c04387ec>] (request_firmware_work_func) from [<c0058e2c>] (process_one_work+0x1b4/0x4b4) [ 23.695591] [<c0058e2c>] (process_one_work) from [<c0059168>] (worker_thread+0x3c/0x4a4) [ 23.704124] [<c0059168>] (worker_thread) from [<c005ee68>] (kthread+0xd4/0xf0) [ 23.711747] [<c005ee68>] (kthread) from [<c000f598>] (ret_from_fork+0x14/0x3c) [ 23.719357] Code: bad PC value [ 23.722760] ---[ end trace 981be8510db9b3a9 ]---
Prevent oops by validationg power() pointer value before calling the function.
--- drivers/net/wireless/ti/wlcore/io.h | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/net/wireless/ti/wlcore/io.h +7 -3
@@ -207,19 +207,23 @@ static inline int __must_check wlcore_wrstatic inline void wl1271_power_off (struct wl1271 *wl) { -int ret; +int ret =0 ;if (!test_bit (WL1271_FLAG_GPIO_POWER , &wl->flags))return ; - ret = wl->if_ops->power (wl->dev, false); +if (wl->if_ops->power) + ret = wl->if_ops->power (wl->dev, false);if (!ret)clear_bit (WL1271_FLAG_GPIO_POWER , &wl->flags); }static inline int wl1271_power_on (struct wl1271 *wl) { -int ret = wl->if_ops->power (wl->dev, true); +int ret =0 ; + +if (wl->if_ops->power) + ret = wl->if_ops->power (wl->dev, true);if (ret ==0 )set_bit (WL1271_FLAG_GPIO_POWER , &wl->flags);
Greg Kroah-Hartman
maintainerPATCH 13/117 mtd: nand: assign reasonable default name for NAND drivers
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Norris <[email protected]>
commit f7a8e38f07a17be90758559fe66fe7337096053f upstream.
Commits such as commit 853f1c58c4b2 ("mtd: nand: omap2: show parent device structure in sysfs") attempt to rely on the core MTD code to set the MTD name based on the parent device. However, nand_base tries to set a different default name according to the flash name (e.g., extracted from the ONFI parameter page), which means NAND drivers will never make use of the MTD defaults. This is not the intention of commit 853f1c58c4b2.
This results in problems when trying to use the cmdline partition parser, since the MTD name is different than expected. Let's fix this by providing a default NAND name, where possible.
Note that this is not really a great default name in the long run, since this means that if there are multiple MTDs attached to the same controller device, they will have the same name. But that is an existing issue and requires future work on a better controller vs. flash chip abstraction to fix properly.
--- drivers/mtd/nand/nand_base.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/mtd/nand/nand_base.c +3 -0
@@ -3995,6 +3995,9 @@ int nand_scan_ident(struct mtd_info *mtdreturn ret; } +if (!mtd->name && mtd->dev.parent) + mtd->name =dev_name (mtd->dev.parent); +/* Set the default functions */ nand_set_defaults (chip, chip->options &NAND_BUSWIDTH_16 );
Greg Kroah-Hartman
maintainerPATCH 15/117 PCI: Fix minimum allocation address overwrite
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Biedl <[email protected]>
commit 3460baa620685c20f5ee19afb6d99d26150c382c upstream.
Commit 36e097a8a297 ("PCI: Split out bridge window override of minimum allocation address") claimed to do no functional changes but unfortunately
did: The "min" variable is altered. At least the AVM A1 PCMCIA adapter was no longer detected, breaking ISDN operation.
Use a local copy of "min" to restore the previous behaviour.
--- drivers/pci/bus.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/pci/bus.c +4 -2
@@ -140,6 +140,8 @@ static int pci_bus_alloc_from_region(str type_mask |=IORESOURCE_TYPE_BITS ;pci_bus_for_each_resource (bus, r, i) { +resource_size_t min_used = min; +if (!r)continue ;
@@ -163,12 +165,12 @@ static int pci_bus_alloc_from_region(str* overrides "min". */ if (avail.start) - min = avail.start; + min_used = avail.start; max = avail.end;/* Ok, try it out.. */ - ret =allocate_resource (r, res, size, min, max, + ret =allocate_resource (r, res, size, min_used, max, align, alignf, alignf_data);if (ret ==0 )return 0 ;
Greg Kroah-Hartman
maintainerPATCH 16/117 tracing: Fix stacktrace skip depth in trace_buffer_unlock_commit_regs()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt (Red Hat) <[email protected]>
commit 7717c6be699975f6733d278b13b7c4295d73caf6 upstream.
While cleaning the stacktrace code I unintentially changed the skip depth of trace_buffer_unlock_commit_regs() from 0 to 6. kprobes uses this function, and with skipping 6 call backs, it can easily produce no stack.
Here's how I tested it:
# echo 'p:ext4_sync_fs ext4_sync_fs ' > /sys/kernel/debug/tracing/kprobe_events
# echo 1 > /sys/kernel/debug/tracing/events/kprobes/enable
# cat /sys/kernel/debug/trace
sync-2394 [005] 502.457060: ext4_sync_fs: (ffffffff81317650)
sync-2394 [005] 502.457063: kernel_stack: <stack trace>
sync-2394 [005] 502.457086: ext4_sync_fs: (ffffffff81317650)
sync-2394 [005] 502.457087: kernel_stack: <stack trace>
sync-2394 [005] 502.457091: ext4_sync_fs: (ffffffff81317650)After putting back the skip stack to zero, we have:
sync-2270 [000] 748.052693: ext4_sync_fs: (ffffffff81317650)
sync-2270 [000] 748.052695: kernel_stack: <stack trace>
=> iterate_supers (ffffffff8126412e)
=> sys_sync (ffffffff8129c4b6)
=> entry_SYSCALL_64_fastpath (ffffffff8181f0b2)
sync-2270 [000] 748.053017: ext4_sync_fs: (ffffffff81317650)
sync-2270 [000] 748.053019: kernel_stack: <stack trace>
=> iterate_supers (ffffffff8126412e)
=> sys_sync (ffffffff8129c4b6)
=> entry_SYSCALL_64_fastpath (ffffffff8181f0b2)
sync-2270 [000] 748.053381: ext4_sync_fs: (ffffffff81317650)
sync-2270 [000] 748.053383: kernel_stack: <stack trace> => iterate_supers (ffffffff8126412e)
=> sys_sync (ffffffff8129c4b6)
=> entry_SYSCALL_64_fastpath (ffffffff8181f0b2)
--- kernel/trace/trace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/trace/trace.c +1 -1
@@ -1751,7 +1751,7 @@ void trace_buffer_unlock_commit_regs(str {__buffer_unlock_commit (buffer, event); -ftrace_trace_stack (tr, buffer, flags,6 , pc, regs); +ftrace_trace_stack (tr, buffer, flags,0 , pc, regs);ftrace_trace_userstack (buffer, flags, pc); }EXPORT_SYMBOL_GPL (trace_buffer_unlock_commit_regs);
Greg Kroah-Hartman
maintainerPATCH 17/117 tracing/stacktrace: Show entire trace if passed in function not found
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt <[email protected]>
commit 6ccd83714a009ee301b50c15f6c3a5dc1f30164c upstream.
When a max stack trace is discovered, the stack dump is saved. In order to not record the overhead of the stack tracer, the ip of the traced function is looked for within the dump. The trace is started from the location of that function. But if for some reason the ip is not found, the entire stack trace is then truncated. That's not very useful. Instead, print everything if the ip of the traced function is not found within the trace.
This issue showed up on s390.
--- kernel/trace/trace_stack.c | 7 +++++++ 1 file changed, 7 insertions(+)
kernel/trace/trace_stack.c +7 -0
@@ -126,6 +126,13 @@ check_stack(unsigned long ip, unsigned l }/* +* Some archs may not have the passed in ip in the dump. +* If that happens, we need to show everything. +*/ +if (i == stack_trace_max.nr_entries) + i =0 ; + +/* * Now find where in the stack these are. */ x =0 ;
Greg Kroah-Hartman
maintainerPATCH 18/117 printk: do cond_resched() between lines while outputting to consoles
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <[email protected]>
commit 8d91f8b15361dfb438ab6eb3b319e2ded43458ff upstream.
@console_may_schedule tracks whether console_sem was acquired through lock or trylock. If the former, we're inside a sleepable context and console_conditional_schedule() performs cond_resched(). This allows console drivers which use console_lock for synchronization to yield while performing time-consuming operations such as scrolling.
However, the actual console outputting is performed while holding irq-safe logbuf_lock, so console_unlock() clears @console_may_schedule before starting outputting lines. Also, only a few drivers call console_conditional_schedule() to begin with. This means that when a lot of lines need to be output by console_unlock(), for example on a console registration, the task doing console_unlock() may not yield for a long time on a non-preemptible kernel.
If this happens with a slow console devices, for example a serial console, the outputting task may occupy the cpu for a very long time. Long enough to trigger softlockup and/or RCU stall warnings, which in turn pile more messages, sometimes enough to trigger the next cycle of warnings incapacitating the system.
Fix it by making console_unlock() insert cond_resched() between lines if @console_may_schedule.
--- include/linux/console.h | 1 + kernel/panic.c | 3 +-- kernel/printk/printk.c | 35 ++++++++++++++++++++++++++++++++++- 3 files changed, 36 insertions(+), 3 deletions(-)
include/linux/console.h +1 -0
@@ -150,6 +150,7 @@ extern int console_trylock(void);extern void console_unlock (void );extern void console_conditional_schedule (void );extern void console_unblank (void ); +extern void console_flush_on_panic (void );extern struct tty_driver *console_device (int *);extern void console_stop (struct console *);extern void console_start (struct console *);
kernel/panic.c +1 -2
@@ -157,8 +157,7 @@ void panic(const char *fmt, ...)* panic() is not being callled from OOPS. */ debug_locks_off (); -console_trylock (); -console_unlock (); +console_flush_on_panic ();if (!panic_blink) panic_blink = no_blink;
kernel/printk/printk.c +34 -1
@@ -2233,13 +2233,24 @@ void console_unlock(void)static u64 seen_seq;unsigned long flags;bool wake_klogd = false; -bool retry; +bool do_cond_resched, retry;if (console_suspended) {up_console_sem ();return ; } +/* +* Console drivers are called under logbuf_lock, so +* @console_may_schedule should be cleared before; however, we may +* end up dumping a lot of lines, for example, if called from +* console registration path, and should invoke cond_resched() +* between lines if allowable. Not doing so can cause a very long +* scheduling stall on a slow console leading to RCU stall and +* softlockup warnings which exacerbate the issue with more +* messages practically incapacitating the system. +*/ + do_cond_resched = console_may_schedule; console_may_schedule =0 ;/* flush buffered message fragment immediately to console */
@@ -2311,6 +2322,9 @@ skip:call_console_drivers (level, ext_text, ext_len, text, len);start_critical_timings ();local_irq_restore (flags); + +if (do_cond_resched) +cond_resched (); } console_locked =0 ;
@@ -2378,6 +2392,25 @@ void console_unblank(void)console_unlock (); } +/** +* console_flush_on_panic - flush console content on panic +* +* Immediately output all pending messages no matter what. +*/ +void console_flush_on_panic (void ) +{ +/* +* If someone else is holding the console lock, trylock will fail +* and may_schedule may be set. Ignore and proceed to unlock so +* that messages are flushed out. As this can be called from any +* context and we don't want to get preempted while flushing, +* ensure may_schedule is cleared. +*/ +console_trylock (); + console_may_schedule =0 ; +console_unlock (); +} +/* * Return the console tty driver structure and its associated index */
Greg Kroah-Hartman
maintainerPATCH 19/117 parisc: Protect huge page pte changes with spinlocks
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Helge Deller <[email protected]>
commit b0e551313ebde17764f3a5ed273df524d1e7e690 upstream.
PA-RISC doesn't have atomic instructions to modify page table entries, so it takes spinlock in the TLB handler and modifies the page table entry non-atomically. If you modify the page table entry without the spinlock, you may race with TLB handler on another CPU and your modification may be lost. Protect against that with usage of purge_tlb_start() and purge_tlb_end() which handles the TLB spinlock.
--- arch/parisc/include/asm/hugetlb.h | 20 ++---------- arch/parisc/mm/hugetlbpage.c | 60 ++++++++++++++++++++++++++++++-------- 2 files changed, 52 insertions(+), 28 deletions(-)
arch/parisc/include/asm/hugetlb.h +4 -16
@@ -54,24 +54,12 @@ static inline pte_t huge_pte_wrprotect(preturn pte_wrprotect (pte); } -static inline void huge_ptep_set_wrprotect (struct mm_struct *mm, -unsigned long addr,pte_t *ptep) -{ -pte_t old_pte = *ptep; -set_huge_pte_at (mm, addr, ptep,pte_wrprotect (old_pte)); -} +void huge_ptep_set_wrprotect (struct mm_struct *mm, +unsigned long addr,pte_t *ptep); -static inline int huge_ptep_set_access_flags (struct vm_area_struct *vma, +int huge_ptep_set_access_flags (struct vm_area_struct *vma,unsigned long addr,pte_t *ptep, -pte_t pte,int dirty) -{ -int changed = !pte_same (*ptep, pte); -if (changed) { -set_huge_pte_at (vma->vm_mm, addr, ptep, pte); -flush_tlb_page (vma, addr); - } -return changed; -} +pte_t pte,int dirty);static inline pte_t huge_ptep_get (pte_t *ptep) {
arch/parisc/mm/hugetlbpage.c +48 -12
95 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 20/117 parisc: Fix __ARCH_SI_PREAMBLE_SIZE
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Helge Deller <[email protected]>
commit e60fc5aa608eb38b47ba4ee058f306f739eb70a0 upstream.
On a 64bit kernel build the compiler aligns the _sifields union in the struct siginfo_t on a 64bit address. The __ARCH_SI_PREAMBLE_SIZE define compensates for this alignment and thus fixes the wait testcase of the strace package.
The symptoms of a wrong __ARCH_SI_PREAMBLE_SIZE value is that _sigchld.si_stime variable is missed to be copied and thus after a copy_siginfo() will have uninitialized values.
--- arch/parisc/include/uapi/asm/siginfo.h | 4 ++++ 1 file changed, 4 insertions(+)
arch/parisc/include/uapi/asm/siginfo.h +4 -0
@@ -1,6 +1,10 @@#ifndef _PARISC_SIGINFO_H#define _PARISC_SIGINFO_H +#if defined(__LP64__) +#define __ARCH_SI_PREAMBLE_SIZE (4 * sizeof(int)) +#endif +#include <asm-generic/siginfo.h> #undef NSIGTRAP
Greg Kroah-Hartman
maintainerPATCH 21/117 media: i2c: Dont export ir-kbd-i2c module alias
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Javier Martinez Canillas <[email protected]>
commit 329d88da4df9a96da43018aceabd3a06e6a7e7ae upstream.
This is a partial revert of commit ed8d1cf07cb16d ("[media] Export I2C module alias information in missing drivers") that exported the module aliases for the I2C drivers that were missing to make autoload to work.
But there is a bug report [0] that auto load of the ir-kbd-i2c driver cause the Hauppauge HD-PVR driver to not behave correctly.
This is a hdpvr latent bug that was just exposed by ir-kbd-i2c module autoloading working and will also happen if the I2C driver is built-in or a user calls modprobe to load the module and register the driver.
But there is a regression experimented by users so until the real bug is fixed, let's not export the module alias for the ir-kbd-i2c driver even when this just masks the actual issue.
[0]: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=810726
--- drivers/media/i2c/ir-kbd-i2c.c | 1 - 1 file changed, 1 deletion(-)
drivers/media/i2c/ir-kbd-i2c.c +0 -1
@@ -478,7 +478,6 @@ static const struct i2c_device_id ir_kbd { "ir_rx_z8f0811_hdpvr", 0 }, { } }; -MODULE_DEVICE_TABLE(i2c, ir_kbd_id); static struct i2c_driver ir_kbd_driver = { .driver = {
Greg Kroah-Hartman
maintainerPATCH 22/117 md/raid: only permit hot-add of compatible integrity profiles
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Williams <[email protected]>
commit 1501efadc524a0c99494b576923091589a52d2a4 upstream.
It is not safe for an integrity profile to be changed while i/o is in-flight in the queue. Prevent adding new disks or otherwise online spares to an array if the device has an incompatible integrity profile.
The original change to the blk_integrity_unregister implementation in md, commmit c7bfced9a671 "md: suspend i/o during runtime blk_integrity_unregister" introduced an immediate hang regression.
This policy of disallowing changes the integrity profile once one has been established is shared with DM.
Here is an abbreviated log from a test run that:
1/ Creates a degraded raid1 with an integrity-enabled device (pmem0s) [ 59.076127]
2/ Tries to add an integrity-disabled device (pmem1m) [ 90.489209]
3/ Retries with an integrity-enabled device (pmem1s) [ 205.671277]
[ 59.076127] md/raid1:md0: active with 1 out of 2 mirrors [ 59.078302] md: data integrity enabled on md0 [..] [ 90.489209] md0: incompatible integrity profile for pmem1m [..] [ 205.671277] md: super_written gets error=-5 [ 205.677386] md/raid1:md0: Disk failure on pmem1m, disabling device. [ 205.677386] md/raid1:md0: Operation continuing on 1 devices. [ 205.683037] RAID1 conf printout: [ 205.684699] --- wd:1 rd:2 [ 205.685972] disk 0, wo:0, o:1, dev:pmem0s [ 205.687562] disk 1, wo:1, o:1, dev:pmem1s [ 205.691717] md: recovery of RAID array md0
--- drivers/md/md.c | 28 ++++++++++++++++------------ drivers/md/md.h | 2 +- drivers/md/multipath.c | 6 +++--- drivers/md/raid1.c | 6 +++--- drivers/md/raid10.c | 6 +++--- 5 files changed, 26 insertions(+), 22 deletions(-)
drivers/md/md.c +16 -12
@@ -2017,28 +2017,32 @@ int md_integrity_register(struct mddev * }EXPORT_SYMBOL (md_integrity_register); -/* Disable data integrity if non-capable/non-matching disk is being added */ -void md_integrity_add_rdev (struct md_rdev *rdev,struct mddev *mddev) +/* +* Attempt to add an rdev, but only if it is consistent with the current +* integrity profile +*/ +int md_integrity_add_rdev (struct md_rdev *rdev,struct mddev *mddev) {struct blk_integrity *bi_rdev;struct blk_integrity *bi_mddev; +char name[BDEVNAME_SIZE ];if (!mddev->gendisk) -return ; +return 0 ; bi_rdev =bdev_get_integrity (rdev->bdev); bi_mddev =blk_get_integrity (mddev->gendisk);if (!bi_mddev)/* nothing to do */ -return ; -if (rdev->raid_disk <0 )/* skip spares */ -return ; -if (bi_rdev &&blk_integrity_compare (mddev->gendisk, - rdev->bdev->bd_disk) >=0 ) -return ; -WARN_ON_ONCE (!mddev->suspended); -printk (KERN_NOTICE "disabling data integrity on %s\n" ,mdname (mddev)); -blk_integrity_unregister (mddev->gendisk); +return 0 ; + +if (blk_integrity_compare (mddev->gendisk, rdev->bdev->bd_disk) !=0 ) { +printk (KERN_NOTICE "%s: incompatible integrity profile for %s\n" , +mdname (mddev),bdevname (rdev->bdev, name)); +return -ENXIO ; + } + +return 0 ; }EXPORT_SYMBOL (md_integrity_add_rdev);
drivers/md/md.h +1 -1
@@ -657,7 +657,7 @@ extern void md_wait_for_blocked_rdev(strextern void md_set_array_sectors (struct mddev *mddev,sector_t array_sectors);extern int md_check_no_bitmap (struct mddev *mddev);extern int md_integrity_register (struct mddev *mddev); -extern void md_integrity_add_rdev (struct md_rdev *rdev,struct mddev *mddev); +extern int md_integrity_add_rdev (struct md_rdev *rdev,struct mddev *mddev);extern int strict_strtoul_scaled (const char *cp,unsigned long *res,int scale);extern void mddev_init (struct mddev *mddev);
drivers/md/multipath.c +3 -3
@@ -257,6 +257,9 @@ static int multipath_add_disk(struct mdddisk_stack_limits (mddev->gendisk, rdev->bdev, rdev->data_offset <<9 ); + err =md_integrity_add_rdev (rdev, mddev); +if (err) +break ;spin_lock_irq (&conf->device_lock); mddev->degraded--; rdev->raid_disk = path;
@@ -264,9 +267,6 @@ static int multipath_add_disk(struct mddspin_unlock_irq (&conf->device_lock);rcu_assign_pointer (p->rdev, rdev); err =0 ; -mddev_suspend (mddev); -md_integrity_add_rdev (rdev, mddev); -mddev_resume (mddev);break ; }
drivers/md/raid1.c +3 -3
@@ -1589,6 +1589,9 @@ static int raid1_add_disk(struct mddev *if (mddev->recovery_disabled == conf->recovery_disabled)return -EBUSY ; +if (md_integrity_add_rdev (rdev, mddev)) +return -ENXIO ; +if (rdev->raid_disk >=0 ) first = last = rdev->raid_disk;
@@ -1632,9 +1635,6 @@ static int raid1_add_disk(struct mddev *break ; } } -mddev_suspend (mddev); -md_integrity_add_rdev (rdev, mddev); -mddev_resume (mddev);if (mddev->queue &&blk_queue_discard (bdev_get_queue (rdev->bdev)))queue_flag_set_unlocked (QUEUE_FLAG_DISCARD , mddev->queue);print_conf (conf);
drivers/md/raid10.c +3 -3
@@ -1698,6 +1698,9 @@ static int raid10_add_disk(struct mddevif (rdev->saved_raid_disk <0 && !_enough (conf,1 ,-1 ))return -EINVAL ; +if (md_integrity_add_rdev (rdev, mddev)) +return -ENXIO ; +if (rdev->raid_disk >=0 ) first = last = rdev->raid_disk;
@@ -1739,9 +1742,6 @@ static int raid10_add_disk(struct mddevrcu_assign_pointer (p->rdev, rdev);break ; } -mddev_suspend (mddev); -md_integrity_add_rdev (rdev, mddev); -mddev_resume (mddev);if (mddev->queue &&blk_queue_discard (bdev_get_queue (rdev->bdev)))queue_flag_set_unlocked (QUEUE_FLAG_DISCARD , mddev->queue);
Greg Kroah-Hartman
maintainerPATCH 23/117 hrtimer: Handle remaining time proper for TIME_LOW_RES
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <[email protected]>
commit 203cbf77de59fc8f13502dcfd11350c6d4a5c95f upstream.
If CONFIG_TIME_LOW_RES is enabled we add a jiffie to the relative timeout to prevent short sleeps, but we do not account for that in interfaces which retrieve the remaining time.
Helge observed that timerfd can return a remaining time larger than the relative timeout. That's not expected and breaks userland test programs.
Store the information that the timer was armed relative and provide functions to adjust the remaining time. To avoid bloating the hrtimer struct make state a u8, which as a bonus results in better code on x86 at least.
--- include/linux/hrtimer.h | 34 ++++++++++++++++++++++++++--- kernel/time/hrtimer.c | 55 +++++++++++++++++++++++++++++++---------------- kernel/time/timer_list.c | 2 - 3 files changed, 69 insertions(+), 22 deletions(-)
include/linux/hrtimer.h +31 -3
@@ -87,7 +87,8 @@ enum hrtimer_restart {* @function: timer expiry callback function * @base: pointer to the timer base (per cpu and per clock) * @state: state information (See bit values above) -* @start_pid: timer statistics field to store the pid of the task which +* @is_rel: Set if the timer was armed relative +* @start_pid: timer statistics field to store the pid of the task which * started the timer * @start_site: timer statistics field to store the site where the timer * was started
@@ -101,7 +102,8 @@ struct hrtimer {ktime_t _softexpires;enum hrtimer_restart (*function)(struct hrtimer *);struct hrtimer_clock_base *base; -unsigned long state; +u8 state; +u8 is_rel;#ifdef CONFIG_TIMER_STATS int start_pid;void *start_site;
@@ -321,6 +323,27 @@ static inline void clock_was_set_delayed#endif +static inline ktime_t +__hrtimer_expires_remaining_adjusted (const struct hrtimer *timer,ktime_t now) +{ +ktime_t rem =ktime_sub (timer->node.expires, now); + +/* +* Adjust relative timers for the extra we added in +* hrtimer_start_range_ns() to prevent short timeouts. +*/ +if (IS_ENABLED (CONFIG_TIME_LOW_RES ) && timer->is_rel) + rem.tv64 -= hrtimer_resolution; +return rem; +} + +static inline ktime_t +hrtimer_expires_remaining_adjusted (const struct hrtimer *timer) +{ +return __hrtimer_expires_remaining_adjusted (timer, + timer->base->get_time ()); +} +extern void clock_was_set (void );#ifdef CONFIG_TIMERFD extern void timerfd_clock_was_set (void );
@@ -390,7 +413,12 @@ static inline void hrtimer_restart(struc }/* Query timers: */ -extern ktime_t hrtimer_get_remaining (const struct hrtimer *timer); +extern ktime_t __hrtimer_get_remaining (const struct hrtimer *timer,bool adjust); + +static inline ktime_t hrtimer_get_remaining (const struct hrtimer *timer) +{ +return __hrtimer_get_remaining (timer, false); +}extern u64 hrtimer_get_next_event (void );
kernel/time/hrtimer.c +37 -18
104 lines not on this page · raw message
kernel/time/timer_list.c +1 -1
@@ -69,7 +69,7 @@ print_timer(struct seq_file *m, struct hprint_name_offset (m, taddr);SEQ_printf (m,", " );print_name_offset (m, timer->function); -SEQ_printf (m,", S:%02lx" , timer->state); +SEQ_printf (m,", S:%02x" , timer->state);#ifdef CONFIG_TIMER_STATS SEQ_printf (m,", " );print_name_offset (m, timer->start_site);
Greg Kroah-Hartman
maintainerPATCH 23/117 hrtimer: Handle remaining time proper for TIME_LOW_RES
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <[email protected]>
commit 203cbf77de59fc8f13502dcfd11350c6d4a5c95f upstream.
If CONFIG_TIME_LOW_RES is enabled we add a jiffie to the relative timeout to prevent short sleeps, but we do not account for that in interfaces which retrieve the remaining time.
Helge observed that timerfd can return a remaining time larger than the relative timeout. That's not expected and breaks userland test programs.
Store the information that the timer was armed relative and provide functions to adjust the remaining time. To avoid bloating the hrtimer struct make state a u8, which as a bonus results in better code on x86 at least.
--- include/linux/hrtimer.h | 34 ++++++++++++++++++++++++++--- kernel/time/hrtimer.c | 55 +++++++++++++++++++++++++++++++---------------- kernel/time/timer_list.c | 2 - 3 files changed, 69 insertions(+), 22 deletions(-)
include/linux/hrtimer.h +31 -3
@@ -87,7 +87,8 @@ enum hrtimer_restart {* @function: timer expiry callback function * @base: pointer to the timer base (per cpu and per clock) * @state: state information (See bit values above) -* @start_pid: timer statistics field to store the pid of the task which +* @is_rel: Set if the timer was armed relative +* @start_pid: timer statistics field to store the pid of the task which * started the timer * @start_site: timer statistics field to store the site where the timer * was started
@@ -101,7 +102,8 @@ struct hrtimer {ktime_t _softexpires;enum hrtimer_restart (*function)(struct hrtimer *);struct hrtimer_clock_base *base; -unsigned long state; +u8 state; +u8 is_rel;#ifdef CONFIG_TIMER_STATS int start_pid;void *start_site;
@@ -321,6 +323,27 @@ static inline void clock_was_set_delayed#endif +static inline ktime_t +__hrtimer_expires_remaining_adjusted (const struct hrtimer *timer,ktime_t now) +{ +ktime_t rem =ktime_sub (timer->node.expires, now); + +/* +* Adjust relative timers for the extra we added in +* hrtimer_start_range_ns() to prevent short timeouts. +*/ +if (IS_ENABLED (CONFIG_TIME_LOW_RES ) && timer->is_rel) + rem.tv64 -= hrtimer_resolution; +return rem; +} + +static inline ktime_t +hrtimer_expires_remaining_adjusted (const struct hrtimer *timer) +{ +return __hrtimer_expires_remaining_adjusted (timer, + timer->base->get_time ()); +} +extern void clock_was_set (void );#ifdef CONFIG_TIMERFD extern void timerfd_clock_was_set (void );
@@ -390,7 +413,12 @@ static inline void hrtimer_restart(struc }/* Query timers: */ -extern ktime_t hrtimer_get_remaining (const struct hrtimer *timer); +extern ktime_t __hrtimer_get_remaining (const struct hrtimer *timer,bool adjust); + +static inline ktime_t hrtimer_get_remaining (const struct hrtimer *timer) +{ +return __hrtimer_get_remaining (timer, false); +}extern u64 hrtimer_get_next_event (void );
kernel/time/hrtimer.c +37 -18
104 lines not on this page · raw message
kernel/time/timer_list.c +1 -1
@@ -69,7 +69,7 @@ print_timer(struct seq_file *m, struct hprint_name_offset (m, taddr);SEQ_printf (m,", " );print_name_offset (m, timer->function); -SEQ_printf (m,", S:%02lx" , timer->state); +SEQ_printf (m,", S:%02x" , timer->state);#ifdef CONFIG_TIMER_STATS SEQ_printf (m,", " );print_name_offset (m, timer->start_site);
Greg Kroah-Hartman
maintainerPATCH 24/117 ALSA: usb-audio: Fix TEAC UD-501/UD-503/NT-503 usb delay
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guillaume Fougnies <[email protected]>
commit 5a4ff9ec8d6edd2ab1cfe8ce6a080d6e57cbea9a upstream.
TEAC UD-501/UD-503/NT-503 fail to switch properly between different rate/format. Similar to 'Playback Design', this patch corrects the invalid clock source error for TEAC products and avoids complete freeze of the usb interface of 503 series.
--- sound/usb/quirks.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-)
sound/usb/quirks.c +13 -1
@@ -1205,8 +1205,12 @@ void snd_usb_set_interface_quirk(struct* "Playback Design" products need a 50ms delay after setting the * USB interface. */ -if (le16_to_cpu (dev->descriptor.idVendor) ==0x23ba ) +switch (le16_to_cpu (dev->descriptor.idVendor)) { +case 0x23ba :/* Playback Design */ +case 0x0644 :/* TEAC Corp. */ mdelay (50 ); +break ; + } } void snd_usb_ctl_msg_quirk(struct usb_device *dev, unsigned int pipe,
@@ -1221,6 +1225,14 @@ void snd_usb_ctl_msg_quirk(struct usb_de (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS)mdelay (20 ); +/* +* "TEAC Corp." products need a 20ms delay after each +* class compliant request +*/ +if ((le16_to_cpu (dev->descriptor.idVendor) ==0x0644 ) && + (requesttype &USB_TYPE_MASK ) ==USB_TYPE_CLASS ) +mdelay (20 ); +/* Marantz/Denon devices with USB DAC functionality need a delay * after each class compliant request */
Greg Kroah-Hartman
maintainerPATCH 25/117 ALSA: usb-audio: Add quirk for Microsoft LifeCam HD-6000
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lev Lybin <[email protected]>
commit 1b3c993a699bed282e47c3f7c49d539c331dae04 upstream.
Microsoft LifeCam HD-6000 (045e:076f) requires the similar quirk for avoiding the stall due to the invalid sample rate reads.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=111491
--- sound/usb/quirks.c | 1 + 1 file changed, 1 insertion(+)
sound/usb/quirks.c +1 -0
@@ -1121,6 +1121,7 @@ bool snd_usb_get_sample_rate_quirk(strucswitch (chip->usb_id) {case USB_ID (0x045E ,0x075D ):/* MS Lifecam Cinema */ case USB_ID (0x045E ,0x076D ):/* MS Lifecam HD-5000 */ +case USB_ID (0x045E ,0x076F ):/* MS Lifecam HD-6000 */ case USB_ID (0x045E ,0x0772 ):/* MS Lifecam Studio */ case USB_ID (0x045E ,0x0779 ):/* MS Lifecam HD-3000 */ case USB_ID (0x04D8 ,0xFEEA ):/* Benchmark DAC1 Pre */
Greg Kroah-Hartman
maintainerPATCH 26/117 ALSA: usb-audio: Fix OPPO HA-1 vendor ID
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jurgen Kramer <[email protected]>
commit 5327d6ba975042fd3da50ac6e94d1e9551ebeaec upstream.
In my patch adding native DSD support for the Oppo HA-1, the wrong vendor ID got through. This patch fixes the vendor ID and aligns the comment.
--- sound/usb/quirks.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/usb/quirks.c +1 -1
@@ -1282,7 +1282,7 @@ u64 snd_usb_interface_dsd_format_quirks(case USB_ID (0x20b1 ,0x3008 ):/* iFi Audio micro/nano iDSD */ case USB_ID (0x20b1 ,0x2008 ):/* Matrix Audio X-Sabre */ case USB_ID (0x20b1 ,0x300a ):/* Matrix Audio Mini-i Pro */ -case USB_ID (0x22d8 ,0x0416 ):/* OPPO HA-1*/ +case USB_ID (0x22d9 ,0x0416 ):/* OPPO HA-1 */ if (fp->altsetting ==2 )return SNDRV_PCM_FMTBIT_DSD_U32_BE ;break ;
Greg Kroah-Hartman
maintainerPATCH 27/117 ALSA: usb-audio: Add native DSD support for PS Audio NuWave DAC
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jurgen Kramer <[email protected]>
commit ad678b4ccd41aa51cf5f142c0e8cffe9d61fc2bf upstream.
This patch adds native DSD support for the PS Audio NuWave DAC.
--- sound/usb/quirks.c | 1 + 1 file changed, 1 insertion(+)
sound/usb/quirks.c +1 -0
@@ -1291,6 +1291,7 @@ u64 snd_usb_interface_dsd_format_quirks(case USB_ID (0x20b1 ,0x2009 ):/* DIYINHK DSD DXD 384kHz USB to I2S/DSD */ case USB_ID (0x20b1 ,0x2023 ):/* JLsounds I2SoverUSB */ case USB_ID (0x20b1 ,0x3023 ):/* Aune X1S 32BIT/384 DSD DAC */ +case USB_ID (0x2616 ,0x0106 ):/* PS Audio NuWave DAC */ if (fp->altsetting ==3 )return SNDRV_PCM_FMTBIT_DSD_U32_BE ;break ;
Greg Kroah-Hartman
maintainerPATCH 28/117 ALSA: usb-audio: avoid freeing umidi object twice
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrey Konovalov <[email protected]>
commit 07d86ca93db7e5cdf4743564d98292042ec21af7 upstream.
The 'umidi' object will be free'd on the error path by snd_usbmidi_free() when tearing down the rawmidi interface. So we shouldn't try to free it in snd_usbmidi_create() after having registered the rawmidi interface.
Found by KASAN.
--- sound/usb/midi.c | 1 - 1 file changed, 1 deletion(-)
sound/usb/midi.c +0 -1
@@ -2454,7 +2454,6 @@ int snd_usbmidi_create(struct snd_card *else err =snd_usbmidi_create_endpoints (umidi, endpoints);if (err <0 ) { -snd_usbmidi_free (umidi);return err; }
Greg Kroah-Hartman
maintainerPATCH 29/117 ALSA: bebob: Use a signed return type for get_formation_index
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lucas Tanure <[email protected]>
commit 07905298e4d5777eb58516cdc242f7ac1ca387a2 upstream.
The return type "unsigned int" was used by the get_formation_index function
despite of the aspect that it will eventually return a negative error code.
So, change to signed int and get index by reference in the parameters.
Done with the help of Coccinelle.
[Fix the missing braces suggested by Julia Lawall -- tiwai]
--- sound/firewire/bebob/bebob_stream.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-)
sound/firewire/bebob/bebob_stream.c +9 -5
@@ -47,14 +47,16 @@ static const unsigned int bridgeco_freq_ [6] = 0x07, }; -static unsigned int -get_formation_index (unsigned int rate) +static int +get_formation_index (unsigned int rate,unsigned int *index) {unsigned int i;for (i =0 ; i <ARRAY_SIZE (snd_bebob_rate_table); i++) { -if (snd_bebob_rate_table[i] == rate) -return i; +if (snd_bebob_rate_table[i] == rate) { + *index = i; +return 0 ; + } }return -EINVAL ; }
@@ -425,7 +427,9 @@ make_both_connections(struct snd_bebob * goto end;/* confirm params for both streams */ - index =get_formation_index (rate); + err =get_formation_index (rate, &index); +if (err <0 ) + goto end; pcm_channels = bebob->tx_stream_formations[index].pcm; midi_channels = bebob->tx_stream_formations[index].midi; err = amdtp_am824_set_parameters(&bebob->tx_stream, rate,
Greg Kroah-Hartman
maintainerPATCH 30/117 ALSA: Add missing dependency on CONFIG_SND_TIMER
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 61595dca742a9ba9a4c998b9af1f468adc816275 upstream.
Since the build of PCM timer may be disabled via Kconfig now, each driver that provides a timer interface needs to set CONFIG_SND_TIMER explicitly. Otherwise it may get a build error due to missing symbol.
--- sound/isa/Kconfig | 4 ++++ sound/pci/Kconfig | 3 +++ sound/sparc/Kconfig | 1 + 3 files changed, 8 insertions(+)
sound/isa/Kconfig +4 -0
@@ -3,6 +3,7 @@ config SND_WSS_LIB tristate select SND_PCM + select SND_TIMER config SND_SB_COMMON tristate
@@ -42,6 +43,7 @@ config SND_AD1816A select SND_OPL3_LIB select SND_MPU401_UART select SND_PCM + select SND_TIMER help Say Y here to include support for Analog Devices SoundPort AD1816A or compatible sound chips.
@@ -209,6 +211,7 @@ config SND_GUSCLASSIC tristate "Gravis UltraSound Classic" select SND_RAWMIDI select SND_PCM + select SND_TIMER help Say Y here to include support for Gravis UltraSound Classic soundcards.
@@ -221,6 +224,7 @@ config SND_GUSEXTREME select SND_OPL3_LIB select SND_MPU401_UART select SND_PCM + select SND_TIMER help Say Y here to include support for Gravis UltraSound Extreme soundcards.
sound/pci/Kconfig +3 -0
@@ -155,6 +155,7 @@ config SND_AZT3328 select SND_PCM select SND_RAWMIDI select SND_AC97_CODEC + select SND_TIMER depends on ZONE_DMA help Say Y here to include support for Aztech AZF3328 (PCI168)
@@ -463,6 +464,7 @@ config SND_EMU10K1 select SND_HWDEP select SND_RAWMIDI select SND_AC97_CODEC + select SND_TIMER depends on ZONE_DMA help Say Y to include support for Sound Blaster PCI 512, Live!,
@@ -889,6 +891,7 @@ config SND_YMFPCI select SND_OPL3_LIB select SND_MPU401_UART select SND_AC97_CODEC + select SND_TIMER help Say Y here to include support for Yamaha PCI audio chips - YMF724, YMF724F, YMF740, YMF740C, YMF744, YMF754.
sound/sparc/Kconfig +1 -0
@@ -22,6 +22,7 @@ config SND_SUN_AMD7930 config SND_SUN_CS4231 tristate "Sun CS4231" select SND_PCM + select SND_TIMER help Say Y here to include support for CS4231 sound device on Sun.
Greg Kroah-Hartman
maintainerPATCH 31/117 ALSA: hda - disable dynamic clock gating on Broxton before reset
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Libin Yang <[email protected]>
commit 6639484ddaf6707b41082c9fa9ca9af342df6402 upstream.
On Broxton, to make sure the reset controller works properly, MISCBDCGE bit (bit 6) in CGCTL (0x48) of PCI configuration space need be cleared before reset and set back to 1 after reset. Otherwise, it may prevent the CORB/RIRB logic from being reset.
--- sound/pci/hda/hda_intel.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
sound/pci/hda/hda_intel.c +13 -0
@@ -90,6 +90,8 @@ enum {#define NVIDIA_HDA_ENABLE_COHBIT 0x01/* Defines for Intel SCH HDA snoop control */ +#define INTEL_HDA_CGCTL 0x48 +#define INTEL_HDA_CGCTL_MISCBDCGE (0x1 << 6)#define INTEL_SCH_HDA_DEVC 0x78#define INTEL_SCH_HDA_DEVC_NOSNOOP (0x1<<11)
@@ -528,10 +530,21 @@ static void hda_intel_init_chip(struct a {struct hdac_bus *bus =azx_bus (chip);struct pci_dev *pci = chip->pci; +u32 val;if (chip->driver_caps &AZX_DCAPS_I915_POWERWELL )snd_hdac_set_codec_wakeup (bus, true); +if (IS_BROXTON (pci)) { +pci_read_config_dword (pci,INTEL_HDA_CGCTL , &val); + val = val & ~INTEL_HDA_CGCTL_MISCBDCGE ; +pci_write_config_dword (pci,INTEL_HDA_CGCTL , val); + }azx_init_chip (chip, full_reset); +if (IS_BROXTON (pci)) { +pci_read_config_dword (pci,INTEL_HDA_CGCTL , &val); + val = val |INTEL_HDA_CGCTL_MISCBDCGE ; +pci_write_config_dword (pci,INTEL_HDA_CGCTL , val); + }if (chip->driver_caps &AZX_DCAPS_I915_POWERWELL )snd_hdac_set_codec_wakeup (bus, false);
Greg Kroah-Hartman
maintainerPATCH 32/117 ALSA: compress: Disable GET_CODEC_CAPS ioctl for some architectures
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 462b3f161beb62eeb290f4ec52f5ead29a2f8ac7 upstream.
Some architectures like PowerPC can handle the maximum struct size in an ioctl only up to 13 bits, and struct snd_compr_codec_caps used by SNDRV_COMPRESS_GET_CODEC_CAPS ioctl overflows this limit. This problem was revealed recently by a powerpc change, as it's now treated as a fatal build error.
This patch is a stop-gap for that: for architectures with less than 14 bit ioctl struct size, get rid of the handling of the relevant ioctl. We should provide an alternative equivalent ioctl code later, but for now just paper over it. Luckily, the compress API hasn't been used on such architectures, so the impact must be effectively zero.
--- sound/core/compress_offload.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
sound/core/compress_offload.c +11 -0
@@ -44,6 +44,13 @@#include <sound/compress_offload.h> #include <sound/compress_driver.h> +/* struct snd_compr_codec_caps overflows the ioctl bit size for some +* architectures, so we need to disable the relevant ioctls. +*/ +#if _IOC_SIZEBITS <14 +#define COMPR_CODEC_CAPS_OVERFLOW +#endif +/* TODO: * - add substream support for multiple devices in case of * SND_DYNAMIC_MINORS is not used
@@ -438,6 +445,7 @@ out:return retval; } +#ifndef COMPR_CODEC_CAPS_OVERFLOW static int snd_compr_get_codec_caps (struct snd_compr_stream *stream,unsigned long arg) {
@@ -461,6 +469,7 @@ out:kfree (caps);return retval; } +#endif /* !COMPR_CODEC_CAPS_OVERFLOW */ /* revisit this with snd_pcm_preallocate_xxx */ static int snd_compr_allocate_buffer(struct snd_compr_stream *stream,
@@ -799,9 +808,11 @@ static long snd_compr_ioctl(struct filecase _IOC_NR (SNDRV_COMPRESS_GET_CAPS ): retval =snd_compr_get_caps (stream, arg);break ; +#ifndef COMPR_CODEC_CAPS_OVERFLOW case _IOC_NR (SNDRV_COMPRESS_GET_CODEC_CAPS ): retval =snd_compr_get_codec_caps (stream, arg);break ; +#endif case _IOC_NR (SNDRV_COMPRESS_SET_PARAMS ): retval =snd_compr_set_params (stream, arg);break ;
Greg Kroah-Hartman
maintainerPATCH 33/117 ALSA: dummy: Disable switching timer backend via sysfs
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 7ee96216c31aabe1eb42fb91ff50dae9fcd014b2 upstream.
ALSA dummy driver can switch the timer backend between system timer and hrtimer via its hrtimer module option. This can be also switched dynamically via sysfs, but it may lead to a memory corruption when switching is done while a PCM stream is running; the stream instance for the newly switched timer method tries to access the memory that was allocated by another timer method although the sizes differ.
As the simplest fix, this patch just disables the switch via sysfs by dropping the writable bit.
--- sound/drivers/dummy.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/drivers/dummy.c +1 -1
@@ -87,7 +87,7 @@ MODULE_PARM_DESC(pcm_substreams, "PCM sumodule_param (fake_buffer, bool,0444 );MODULE_PARM_DESC (fake_buffer,"Fake buffer allocations." );#ifdef CONFIG_HIGH_RES_TIMERS -module_param (hrtimer, bool,0644 ); +module_param (hrtimer, bool,0444 );MODULE_PARM_DESC (hrtimer,"Use hrtimer as the timer source." );#endif
Greg Kroah-Hartman
maintainerPATCH 34/117 ALSA: seq: Fix incorrect sanity check at snd_seq_oss_synth_cleanup()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 599151336638d57b98d92338aa59c048e3a3e97d upstream.
ALSA sequencer OSS emulation code has a sanity check for currently opened devices, but there is a thinko there, eventually it spews warnings and skips the operation wrongly like:
WARNING: CPU: 1 PID: 7573 at sound/core/seq/oss/seq_oss_synth.c:311
Fix this off-by-one error.
--- sound/core/seq/oss/seq_oss_synth.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/core/seq/oss/seq_oss_synth.c +1 -1
@@ -308,7 +308,7 @@ snd_seq_oss_synth_cleanup(struct seq_ossstruct seq_oss_synth *rec;struct seq_oss_synthinfo *info; -if (snd_BUG_ON (dp->max_synthdev >=SNDRV_SEQ_OSS_MAX_SYNTH_DEVS )) +if (snd_BUG_ON (dp->max_synthdev >SNDRV_SEQ_OSS_MAX_SYNTH_DEVS ))return ;for (i =0 ; i < dp->max_synthdev; i++) { info = &dp->synths[i];
Greg Kroah-Hartman
maintainerPATCH 35/117 ALSA: seq: Degrade the error message for too many opens
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit da10816e3d923565b470fec78a674baba794ed33 upstream.
ALSA OSS sequencer spews a kernel error message ("ALSA: seq_oss: too many applications") when user-space tries to open more than the limit. This means that it can easily fill the log buffer.
Since it's merely a normal error, it's safe to suppress it via pr_debug() instead.
--- sound/core/seq/oss/seq_oss_init.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/core/seq/oss/seq_oss_init.c +1 -1
@@ -202,7 +202,7 @@ snd_seq_oss_open(struct file *file, int dp->index = i;if (i >=SNDRV_SEQ_OSS_MAX_CLIENTS ) { -pr_err ("ALSA: seq_oss: too many applications\n" ); +pr_debug ("ALSA: seq_oss: too many applications\n" ); rc = -ENOMEM ; goto _error; }
Greg Kroah-Hartman
maintainerPATCH 36/117 ALSA: rawmidi: Make snd_rawmidi_transmit() race-free
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 06ab30034ed9c200a570ab13c017bde248ddb2a6 upstream.
A kernel WARNING in snd_rawmidi_transmit_ack() is triggered by syzkaller fuzzer:
WARNING: CPU: 1 PID: 20739 at sound/core/rawmidi.c:1136 Call Trace: [< inline >] __dump_stack lib/dump_stack.c:15 [<ffffffff82999e2d>] dump_stack+0x6f/0xa2 lib/dump_stack.c:50 [<ffffffff81352089>] warn_slowpath_common+0xd9/0x140 kernel/panic.c:482 [<ffffffff813522b9>] warn_slowpath_null+0x29/0x30 kernel/panic.c:515 [<ffffffff84f80bd5>] snd_rawmidi_transmit_ack+0x275/0x400 sound/core/rawmidi.c:1136 [<ffffffff84fdb3c1>] snd_virmidi_output_trigger+0x4b1/0x5a0 sound/core/seq/seq_virmidi.c:163 [< inline >] snd_rawmidi_output_trigger sound/core/rawmidi.c:150 [<ffffffff84f87ed9>] snd_rawmidi_kernel_write1+0x549/0x780 sound/core/rawmidi.c:1223 [<ffffffff84f89fd3>] snd_rawmidi_write+0x543/0xb30 sound/core/rawmidi.c:1273 [<ffffffff817b0323>] __vfs_write+0x113/0x480 fs/read_write.c:528 [<ffffffff817b1db7>] vfs_write+0x167/0x4a0 fs/read_write.c:577 [< inline >] SYSC_write fs/read_write.c:624 [<ffffffff817b50a1>] SyS_write+0x111/0x220 fs/read_write.c:616 [<ffffffff86336c36>] entry_SYSCALL_64_fastpath+0x16/0x7a arch/x86/entry/entry_64.S:185
Also a similar warning is found but in another path:
Call Trace: [< inline >] __dump_stack lib/dump_stack.c:15 [<ffffffff82be2c0d>] dump_stack+0x6f/0xa2 lib/dump_stack.c:50 [<ffffffff81355139>] warn_slowpath_common+0xd9/0x140 kernel/panic.c:482 [<ffffffff81355369>] warn_slowpath_null+0x29/0x30 kernel/panic.c:515 [<ffffffff8527e69a>] rawmidi_transmit_ack+0x24a/0x3b0 sound/core/rawmidi.c:1133 [<ffffffff8527e851>] snd_rawmidi_transmit_ack+0x51/0x80 sound/core/rawmidi.c:1163 [<ffffffff852d9046>] snd_virmidi_output_trigger+0x2b6/0x570 sound/core/seq/seq_virmidi.c:185 [< inline >] snd_rawmidi_output_trigger sound/core/rawmidi.c:150 [<ffffffff85285a0b>] snd_rawmidi_kernel_write1+0x4bb/0x760 sound/core/rawmidi.c:1252 [<ffffffff85287b73>] snd_rawmidi_write+0x543/0xb30 sound/core/rawmidi.c:1302 [<ffffffff817ba5f3>] __vfs_write+0x113/0x480 fs/read_write.c:528 [<ffffffff817bc087>] vfs_write+0x167/0x4a0 fs/read_write.c:577 [< inline >] SYSC_write fs/read_write.c:624 [<ffffffff817bf371>] SyS_write+0x111/0x220 fs/read_write.c:616 [<ffffffff86660276>] entry_SYSCALL_64_fastpath+0x16/0x7a arch/x86/entry/entry_64.S:185
In the former case, the reason is that virmidi has an open code calling snd_rawmidi_transmit_ack() with the value calculated outside
the spinlock. We may use snd_rawmidi_transmit() in a loop just for
consuming the input data, but even there, there is a race between snd_rawmidi_transmit_peek() and snd_rawmidi_tranmit_ack().
Similarly in the latter case, it calls snd_rawmidi_transmit_peek() and snd_rawmidi_tranmit_ack() separately without protection, so they are racy as well.
The patch tries to address these issues by the following ways:
- Introduce the unlocked versions of snd_rawmidi_transmit_peek() and snd_rawmidi_transmit_ack() to be called inside the explicit lock.
- Rewrite snd_rawmidi_transmit() to be race-free (the former case).
- Make the split calls (the latter case) protected in the rawmidi spin lock.
--- include/sound/rawmidi.h | 4 + sound/core/rawmidi.c | 98 +++++++++++++++++++++++++++++++------------ sound/core/seq/seq_virmidi.c | 17 +++++-- 3 files changed, 88 insertions(+), 31 deletions(-)
include/sound/rawmidi.h +4 -0
@@ -167,6 +167,10 @@ int snd_rawmidi_transmit_peek(struct sndint snd_rawmidi_transmit_ack (struct snd_rawmidi_substream *substream,int count);int snd_rawmidi_transmit (struct snd_rawmidi_substream *substream,unsigned char *buffer,int count); +int __snd_rawmidi_transmit_peek (struct snd_rawmidi_substream *substream, +unsigned char *buffer,int count); +int __snd_rawmidi_transmit_ack (struct snd_rawmidi_substream *substream, +int count);/* main midi functions */
sound/core/rawmidi.c +72 -26
155 lines not on this page · raw message
sound/core/seq/seq_virmidi.c +12 -5
@@ -155,21 +155,26 @@ static void snd_virmidi_output_trigger(sstruct snd_virmidi *vmidi = substream->runtime->private_data;int count, res;unsigned char buf[32 ], *pbuf; +unsigned long flags;if (up) { vmidi->trigger =1 ;if (vmidi->seq_mode ==SNDRV_VIRMIDI_SEQ_DISPATCH && !(vmidi->rdev->flags &SNDRV_VIRMIDI_SUBSCRIBE )) { -snd_rawmidi_transmit_ack (substream, substream->runtime->buffer_size - substream->runtime->avail); -return ;/* ignored */ +while (snd_rawmidi_transmit (substream, buf, +sizeof (buf)) >0 ) { +/* ignored */ + } +return ; }if (vmidi->event.type !=SNDRV_SEQ_EVENT_NONE ) {if (snd_seq_kernel_client_dispatch (vmidi->client, &vmidi->event,in_atomic (),0 ) <0 )return ; vmidi->event.type =SNDRV_SEQ_EVENT_NONE ; } +spin_lock_irqsave (&substream->runtime->lock, flags);while (1 ) { - count =snd_rawmidi_transmit_peek (substream, buf,sizeof (buf)); + count =__snd_rawmidi_transmit_peek (substream, buf,sizeof (buf));if (count <=0 )break ; pbuf = buf;
@@ -179,16 +184,18 @@ static void snd_virmidi_output_trigger(ssnd_midi_event_reset_encode (vmidi->parser);continue ; } -snd_rawmidi_transmit_ack (substream, res); +__snd_rawmidi_transmit_ack (substream, res); pbuf += res; count -= res;if (vmidi->event.type !=SNDRV_SEQ_EVENT_NONE ) {if (snd_seq_kernel_client_dispatch (vmidi->client, &vmidi->event,in_atomic (),0 ) <0 ) -return ; + goto out; vmidi->event.type =SNDRV_SEQ_EVENT_NONE ; } } } + out: +spin_unlock_irqrestore (&substream->runtime->lock, flags); }else { vmidi->trigger =0 ; }
Greg Kroah-Hartman
maintainerPATCH 37/117 ALSA: rawmidi: Remove kernel WARNING for NULL user-space buffer check
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit cc85f7a634cfaf9f0713c6aa06d08817424db37a upstream.
NULL user-space buffer can be passed even in a normal path, thus it's not good to spew a kernel warning with stack trace at each time. Just drop snd_BUG_ON() macro usage there.
--- sound/core/rawmidi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/core/rawmidi.c +1 -1
@@ -1224,7 +1224,7 @@ static long snd_rawmidi_kernel_write1(stlong count1, result;struct snd_rawmidi_runtime *runtime = substream->runtime; -if (snd_BUG_ON (!kernelbuf && !userbuf)) +if (!kernelbuf && !userbuf)return -EINVAL ;if (snd_BUG_ON (!runtime->buffer))return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 38/117 ALSA: rawmidi: Fix race at copying & updating the position
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 81f577542af15640cbcb6ef68baa4caa610cbbfc upstream.
The rawmidi read and write functions manage runtime stream status such as runtime->appl_ptr and runtime->avail. These point where to copy the new data and how many bytes have been copied (or to be read). The problem is that rawmidi read/write call copy_from_user() or copy_to_user(), and the runtime spinlock is temporarily unlocked and relocked while copying user-space. Since the current code advances and updates the runtime status after the spin unlock/relock, the copy and the update may be asynchronous, and eventually runtime->avail might go to a negative value when many concurrent accesses are done. This may lead to memory corruption in the end.
For fixing this race, in this patch, the status update code is performed in the same lock before the temporary unlock. Also, the spinlock is now taken more widely in snd_rawmidi_kernel_read1() for protecting more properly during the whole operation.
--- sound/core/rawmidi.c | 34 ++++++++++++++++++++++------------ 1 file changed, 22 insertions(+), 12 deletions(-)
sound/core/rawmidi.c +22 -12
@@ -942,31 +942,36 @@ static long snd_rawmidi_kernel_read1(strunsigned long flags;long result =0 , count1;struct snd_rawmidi_runtime *runtime = substream->runtime; +unsigned long appl_ptr; +spin_lock_irqsave (&runtime->lock, flags);while (count >0 && runtime->avail) { count1 = runtime->buffer_size - runtime->appl_ptr;if (count1 > count) count1 = count; -spin_lock_irqsave (&runtime->lock, flags);if (count1 > (int )runtime->avail) count1 = runtime->avail; + +/* update runtime->appl_ptr before unlocking for userbuf */ + appl_ptr = runtime->appl_ptr; + runtime->appl_ptr += count1; + runtime->appl_ptr %= runtime->buffer_size; + runtime->avail -= count1; +if (kernelbuf) -memcpy (kernelbuf + result, runtime->buffer + runtime->appl_ptr, count1); +memcpy (kernelbuf + result, runtime->buffer + appl_ptr, count1);if (userbuf) {spin_unlock_irqrestore (&runtime->lock, flags);if (copy_to_user (userbuf + result, - runtime->buffer + runtime->appl_ptr, count1)) { + runtime->buffer + appl_ptr, count1)) {return result >0 ? result : -EFAULT ; }spin_lock_irqsave (&runtime->lock, flags); } - runtime->appl_ptr += count1; - runtime->appl_ptr %= runtime->buffer_size; - runtime->avail -= count1; -spin_unlock_irqrestore (&runtime->lock, flags); result += count1; count -= count1; } +spin_unlock_irqrestore (&runtime->lock, flags);return result; }
@@ -1223,6 +1228,7 @@ static long snd_rawmidi_kernel_write1(stunsigned long flags;long count1, result;struct snd_rawmidi_runtime *runtime = substream->runtime; +unsigned long appl_ptr;if (!kernelbuf && !userbuf)return -EINVAL ;
@@ -1243,12 +1249,19 @@ static long snd_rawmidi_kernel_write1(st count1 = count;if (count1 > (long )runtime->avail) count1 = runtime->avail; + +/* update runtime->appl_ptr before unlocking for userbuf */ + appl_ptr = runtime->appl_ptr; + runtime->appl_ptr += count1; + runtime->appl_ptr %= runtime->buffer_size; + runtime->avail -= count1; +if (kernelbuf) -memcpy (runtime->buffer + runtime->appl_ptr, +memcpy (runtime->buffer + appl_ptr, kernelbuf + result, count1);else if (userbuf) {spin_unlock_irqrestore (&runtime->lock, flags); -if (copy_from_user (runtime->buffer + runtime->appl_ptr, +if (copy_from_user (runtime->buffer + appl_ptr, userbuf + result, count1)) {spin_lock_irqsave (&runtime->lock, flags); result = result >0 ? result : -EFAULT ;
@@ -1256,9 +1269,6 @@ static long snd_rawmidi_kernel_write1(st }spin_lock_irqsave (&runtime->lock, flags); } - runtime->appl_ptr += count1; - runtime->appl_ptr %= runtime->buffer_size; - runtime->avail -= count1; result += count1; count -= count1; }
Greg Kroah-Hartman
maintainerPATCH 39/117 ALSA: hda/realtek - New codec support of ALC225
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kailang Yang <[email protected]>
commit 4231430da9607fb2eb7ea92f3b93ceef3bc2ed93 upstream.
Add new support for ALC225, yet another variant of ALC298 codec.
--- sound/pci/hda/patch_realtek.c | 8 ++++++++ 1 file changed, 8 insertions(+)
sound/pci/hda/patch_realtek.c +8 -0
@@ -327,6 +327,7 @@ static void alc_fill_eapd_coef(struct hdcase 0x10ec0292 :alc_update_coef_idx (codec,0x4 ,1 <<15 ,0 );break ; +case 0x10ec0225 :case 0x10ec0233 :case 0x10ec0255 :case 0x10ec0256 :
@@ -900,6 +901,7 @@ static struct alc_codec_rename_pci_table { 0x10ec0899, 0x1028, 0, "ALC3861" }, { 0x10ec0298, 0x1028, 0, "ALC3266" }, { 0x10ec0256, 0x1028, 0, "ALC3246" }, + { 0x10ec0225, 0x1028, 0, "ALC3253" }, { 0x10ec0670, 0x1025, 0, "ALC669X" }, { 0x10ec0676, 0x1025, 0, "ALC679X" }, { 0x10ec0282, 0x1043, 0, "ALC3229" },
@@ -2651,6 +2653,7 @@ enum {ALC269_TYPE_ALC298 ,ALC269_TYPE_ALC255 ,ALC269_TYPE_ALC256 , + ALC269_TYPE_ALC225, };/*
@@ -2680,6 +2683,7 @@ static int alc269_parse_auto_config(strucase ALC269_TYPE_ALC298 :case ALC269_TYPE_ALC255 :case ALC269_TYPE_ALC256 : +case ALC269_TYPE_ALC225 : ssids = alc269_ssids;break ;default :
@@ -5906,6 +5910,9 @@ static int patch_alc269(struct hda_codec spec->gen.mixer_nid =0 ;/* ALC256 does not have any loopback mixer path */ alc_update_coef_idx (codec,0x36 ,1 <<13 ,1 <<5 );/* Switch pcbeep path to Line in path*/ break ; +case 0x10ec0225 : + spec->codec_variant =ALC269_TYPE_ALC225 ; +break ; }if (snd_hda_codec_read (codec,0x51 ,0 ,AC_VERB_PARAMETERS ,0 ) ==0x10ec5505 ) {
@@ -6796,6 +6803,7 @@ static int patch_alc680(struct hda_codec*/ static const struct hda_device_id snd_hda_id_realtek[] = {HDA_CODEC_ENTRY (0x10ec0221 ,"ALC221" , patch_alc269), +HDA_CODEC_ENTRY (0x10ec0225 ,"ALC225" , patch_alc269),HDA_CODEC_ENTRY (0x10ec0231 ,"ALC231" , patch_alc269),HDA_CODEC_ENTRY (0x10ec0233 ,"ALC233" , patch_alc269),HDA_CODEC_ENTRY (0x10ec0235 ,"ALC233" , patch_alc269),
Greg Kroah-Hartman
maintainerPATCH 40/117 ALSA: hda/realtek - Support headset mode for ALC225
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kailang Yang <[email protected]>
commit 4cc9b9d627af2c443cf98e651e3738d84f991cec upstream.
Support headset mode for ALC225 platforms.
--- sound/pci/hda/patch_realtek.c | 57 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 57 insertions(+)
sound/pci/hda/patch_realtek.c +57 -0
@@ -3662,6 +3662,16 @@ static void alc_headset_mode_unplugged(s WRITE_COEF(0xb7, 0x802b), {} }; +static struct coef_fw coef0225[] = { +UPDATE_COEF (0x4a ,1 <<8 ,0 ), +UPDATE_COEFEX (0x57 ,0x05 ,1 <<14 ,0 ), +UPDATE_COEF (0x63 ,3 <<14 ,3 <<14 ), +UPDATE_COEF (0x4a ,3 <<4 ,2 <<4 ), +UPDATE_COEF (0x4a ,3 <<10 ,3 <<10 ), +UPDATE_COEF (0x45 ,0x3f <<10 ,0x34 <<10 ), +UPDATE_COEF (0x4a ,3 <<10 ,0 ), + {} + };switch (codec->core.vendor_id) {case 0x10ec0255 :
@@ -3686,6 +3696,9 @@ static void alc_headset_mode_unplugged(scase 0x10ec0668 :alc_process_coef_fw (codec, coef0668);break ; +case 0x10ec0225 : +alc_process_coef_fw (codec, coef0225); +break ; }codec_dbg (codec,"Headset jack set to unplugged mode.\n" ); }
@@ -3731,6 +3744,13 @@ static void alc_headset_mode_mic_in(stru UPDATE_COEF(0xc3, 0, 1<<12), {} }; +static struct coef_fw coef0225[] = { +UPDATE_COEFEX (0x57 ,0x05 ,1 <<14 ,1 <<14 ), +UPDATE_COEF (0x4a ,3 <<4 ,2 <<4 ), +UPDATE_COEF (0x63 ,3 <<14 ,0 ), + {} + }; +switch (codec->core.vendor_id) {case 0x10ec0255 :
@@ -3776,6 +3796,12 @@ static void alc_headset_mode_mic_in(strualc_process_coef_fw (codec, coef0688);snd_hda_set_pin_ctl_cache (codec, mic_pin,PIN_VREF50 );break ; +case 0x10ec0225 : +alc_update_coef_idx (codec,0x45 ,0x3f <<10 ,0x31 <<10 ); +snd_hda_set_pin_ctl_cache (codec, hp_pin,0 ); +alc_process_coef_fw (codec, coef0225); +snd_hda_set_pin_ctl_cache (codec, mic_pin,PIN_VREF50 ); +break ; }codec_dbg (codec,"Headset jack set to mic-in mode.\n" ); }
@@ -3888,6 +3914,13 @@ static void alc_headset_mode_ctia(struct WRITE_COEF(0xc3, 0x0000), {} }; +static struct coef_fw coef0225[] = { +UPDATE_COEF (0x45 ,0x3f <<10 ,0x35 <<10 ), +UPDATE_COEF (0x49 ,1 <<8 ,1 <<8 ), +UPDATE_COEF (0x4a ,7 <<6 ,7 <<6 ), +UPDATE_COEF (0x4a ,3 <<4 ,3 <<4 ), + {} + };switch (codec->core.vendor_id) {case 0x10ec0255 :
@@ -3916,6 +3949,9 @@ static void alc_headset_mode_ctia(structcase 0x10ec0668 :alc_process_coef_fw (codec, coef0688);break ; +case 0x10ec0225 : +alc_process_coef_fw (codec, coef0225); +break ; }codec_dbg (codec,"Headset jack set to iPhone-style headset mode.\n" ); }
@@ -3959,6 +3995,13 @@ static void alc_headset_mode_omtp(struct WRITE_COEF(0xc3, 0x0000), {} }; +static struct coef_fw coef0225[] = { +UPDATE_COEF (0x45 ,0x3f <<10 ,0x39 <<10 ), +UPDATE_COEF (0x49 ,1 <<8 ,1 <<8 ), +UPDATE_COEF (0x4a ,7 <<6 ,7 <<6 ), +UPDATE_COEF (0x4a ,3 <<4 ,3 <<4 ), + {} + };switch (codec->core.vendor_id) {case 0x10ec0255 :
@@ -3987,6 +4030,9 @@ static void alc_headset_mode_omtp(structcase 0x10ec0668 :alc_process_coef_fw (codec, coef0688);break ; +case 0x10ec0225 : +alc_process_coef_fw (codec, coef0225); +break ; }codec_dbg (codec,"Headset jack set to Nokia-style headset mode.\n" ); }
@@ -4018,6 +4064,11 @@ static void alc_determine_headset_type(s WRITE_COEF(0xc3, 0x0c00), {} }; +static struct coef_fw coef0225[] = { +UPDATE_COEF (0x45 ,0x3f <<10 ,0x34 <<10 ), +UPDATE_COEF (0x49 ,1 <<8 ,1 <<8 ), + {} + };switch (codec->core.vendor_id) {case 0x10ec0255 :
@@ -4062,6 +4113,12 @@ static void alc_determine_headset_type(s val =alc_read_coef_idx (codec,0xbe ); is_ctia = (val &0x1c02 ) ==0x1c02 ;break ; +case 0x10ec0225 : +alc_process_coef_fw (codec, coef0225); +msleep (800 ); + val =alc_read_coef_idx (codec,0x46 ); + is_ctia = (val &0x00f0 ) ==0x00f0 ; +break ; } codec_dbg(codec, "Headset jack detected iPhone-style headset: %s\n",
Greg Kroah-Hartman
maintainerPATCH 41/117 ALSA: hda/realtek - Support Dell headset mode for ALC225
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kailang Yang <[email protected]>
commit cfc5a845e62853edd36e564c23c64588f4adcae6 upstream.
Dell create new platform with ALC298 codec.
This patch will enable headset mode for ALC225/ALC3253 platform.
--- sound/pci/hda/patch_realtek.c | 9 +++++++++ 1 file changed, 9 insertions(+)
sound/pci/hda/patch_realtek.c +9 -0
@@ -5621,6 +5621,9 @@ static const struct hda_model_fixup alc2 {.id = ALC292_FIXUP_TPT440, .name = "tpt440"}, {} }; +#define ALC225_STANDARD_PINS \ + {0x12, 0xb7a60130}, \ + {0x21, 0x04211020}#define ALC256_STANDARD_PINS \ {0x12, 0x90a60140}, \
@@ -5642,6 +5645,12 @@ static const struct hda_model_fixup alc2 {0x21, 0x03211020}static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = { +SND_HDA_PIN_QUIRK (0x10ec0225 ,0x1028 ,"Dell" ,ALC269_FIXUP_DELL1_MIC_NO_PRESENCE , +ALC225_STANDARD_PINS , + {0x14, 0x901701a0}), +SND_HDA_PIN_QUIRK (0x10ec0225 ,0x1028 ,"Dell" ,ALC269_FIXUP_DELL1_MIC_NO_PRESENCE , +ALC225_STANDARD_PINS , + {0x14, 0x901701b0}),SND_HDA_PIN_QUIRK (0x10ec0255 ,0x1028 ,"Dell" ,ALC255_FIXUP_DELL2_MIC_NO_PRESENCE , {0x14, 0x90170110}, {0x21, 0x02211020}),
Greg Kroah-Hartman
maintainerPATCH 42/117 ALSA: pcm: Fix potential deadlock in OSS emulation
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit b248371628aad599a48540962f6b85a21a8a0c3f upstream.
There are potential deadlocks in PCM OSS emulation code while accessing read/write and mmap concurrently. This comes from the infamous mmap_sem usage in copy_from/to_user(). Namely,
snd_pcm_oss_write() ->
&runtime->oss.params_lock ->
copy_to_user() ->
&mm->mmap_sem
mmap() ->
&mm->mmap_sem ->
snd_pcm_oss_mmap() ->
&runtime->oss.params_lockSince we can't avoid taking params_lock from mmap code path, use trylock variant and aborts with -EAGAIN as a workaround of this AB/BA deadlock.
--- sound/core/oss/pcm_oss.c | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-)
sound/core/oss/pcm_oss.c +15 -6
@@ -834,7 +834,8 @@ static int choose_rate(struct snd_pcm_sureturn snd_pcm_hw_param_near (substream, params,SNDRV_PCM_HW_PARAM_RATE , best_rate,NULL ); } -static int snd_pcm_oss_change_params (struct snd_pcm_substream *substream) +static int snd_pcm_oss_change_params (struct snd_pcm_substream *substream, +bool trylock) {struct snd_pcm_runtime *runtime = substream->runtime;struct snd_pcm_hw_params *params, *sparams;
@@ -848,7 +849,10 @@ static int snd_pcm_oss_change_params(strstruct snd_mask sformat_mask;struct snd_mask mask; -if (mutex_lock_interruptible (&runtime->oss.params_lock)) +if (trylock) { +if (!(mutex_trylock (&runtime->oss.params_lock))) +return -EAGAIN ; + }else if (mutex_lock_interruptible (&runtime->oss.params_lock))return -EINTR ; sw_params =kmalloc (sizeof (*sw_params),GFP_KERNEL ); params =kmalloc (sizeof (*params),GFP_KERNEL );
@@ -1092,7 +1096,7 @@ static int snd_pcm_oss_get_active_substrif (asubstream ==NULL ) asubstream = substream;if (substream->runtime->oss.params) { - err =snd_pcm_oss_change_params (substream); + err =snd_pcm_oss_change_params (substream, false);if (err <0 )return err; }
@@ -1132,7 +1136,7 @@ static int snd_pcm_oss_make_ready(structreturn 0 ; runtime = substream->runtime;if (runtime->oss.params) { - err =snd_pcm_oss_change_params (substream); + err =snd_pcm_oss_change_params (substream, false);if (err <0 )return err; }
@@ -2163,7 +2167,7 @@ static int snd_pcm_oss_get_space(struct runtime = substream->runtime;if (runtime->oss.params && - (err =snd_pcm_oss_change_params (substream)) <0 ) + (err =snd_pcm_oss_change_params (substream, false)) <0 )return err; info.fragsize = runtime->oss.period_bytes;
@@ -2800,7 +2804,12 @@ static int snd_pcm_oss_mmap(struct filereturn -EIO ;if (runtime->oss.params) { -if ((err =snd_pcm_oss_change_params (substream)) <0 ) +/* use mutex_trylock() for params_lock for avoiding a deadlock +* between mmap_sem and params_lock taken by +* copy_from/to_user() in snd_pcm_oss_write/read() +*/ + err =snd_pcm_oss_change_params (substream, true); +if (err <0 )return err; }#ifdef CONFIG_SND_PCM_OSS_PLUGINS
Greg Kroah-Hartman
maintainerPATCH 43/117 ASoC: dpcm: fix the BE state on hw_free
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vinod Koul <[email protected]>
commit 5e82d2be6ee53275c72e964507518d7964c82753 upstream.
While performing hw_free, DPCM checks the BE state but leaves out the suspend state. The suspend state needs to be checked as well, as we might be suspended and then usermode closes rather than resuming the audio stream.
This was found by a stress testing of system with playback in loop and killed after few seconds running in background and second script running suspend-resume test in loop
--- sound/soc/soc-pcm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
sound/soc/soc-pcm.c +2 -1
@@ -1743,7 +1743,8 @@ int dpcm_be_dai_hw_free(struct snd_soc_p (be->dpcm[stream].state !=SND_SOC_DPCM_STATE_PREPARE ) && (be->dpcm[stream].state !=SND_SOC_DPCM_STATE_HW_FREE ) && (be->dpcm[stream].state !=SND_SOC_DPCM_STATE_PAUSED ) && - (be->dpcm[stream].state != SND_SOC_DPCM_STATE_STOP)) + (be->dpcm[stream].state !=SND_SOC_DPCM_STATE_STOP ) && + (be->dpcm[stream].state != SND_SOC_DPCM_STATE_SUSPEND)) continue; dev_dbg(be->dev, "ASoC: hw_free BE %s\n",
Greg Kroah-Hartman
maintainerPATCH 44/117 ALSA: seq: Fix yet another races among ALSA timer accesses
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 2cdc7b636d55cbcf42e1e6c8accd85e62d3e9ae8 upstream.
ALSA sequencer may open/close and control ALSA timer instance dynamically either via sequencer events or direct ioctls. These are done mostly asynchronously, and it may call still some timer action like snd_timer_start() while another is calling snd_timer_close(). Since the instance gets removed by snd_timer_close(), it may lead to a use-after-free.
This patch tries to address such a race by protecting each snd_timer_*() call via the existing spinlock and also by avoiding the access to timer during close call.
--- sound/core/seq/seq_timer.c | 87 ++++++++++++++++++++++++++++++++++----------- 1 file changed, 67 insertions(+), 20 deletions(-)
sound/core/seq/seq_timer.c +67 -20
@@ -90,6 +90,9 @@ void snd_seq_timer_delete(struct snd_seqvoid snd_seq_timer_defaults (struct snd_seq_timer * tmr) { +unsigned long flags; + +spin_lock_irqsave (&tmr->lock, flags);/* setup defaults */ tmr->ppq =96 ;/* 96 PPQ */ tmr->tempo =500000 ;/* 120 BPM */
@@ -105,21 +108,25 @@ void snd_seq_timer_defaults(struct snd_s tmr->preferred_resolution = seq_default_timer_resolution; tmr->skew = tmr->skew_base =SKEW_BASE ; +spin_unlock_irqrestore (&tmr->lock, flags); } -void snd_seq_timer_reset (struct snd_seq_timer * tmr) +static void seq_timer_reset (struct snd_seq_timer *tmr) { -unsigned long flags; - -spin_lock_irqsave (&tmr->lock, flags); -/* reset time & songposition */ tmr->cur_time.tv_sec =0 ; tmr->cur_time.tv_nsec =0 ; tmr->tick.cur_tick =0 ; tmr->tick.fraction =0 ; +} + +void snd_seq_timer_reset (struct snd_seq_timer *tmr) +{ +unsigned long flags; +spin_lock_irqsave (&tmr->lock, flags); +seq_timer_reset (tmr);spin_unlock_irqrestore (&tmr->lock, flags); }
@@ -138,8 +145,11 @@ static void snd_seq_timer_interrupt(stru tmr = q->timer;if (tmr ==NULL )return ; -if (!tmr->running) +spin_lock_irqsave (&tmr->lock, flags); +if (!tmr->running) { +spin_unlock_irqrestore (&tmr->lock, flags);return ; + } resolution *= ticks;if (tmr->skew != tmr->skew_base) {
@@ -148,8 +158,6 @@ static void snd_seq_timer_interrupt(stru (((resolution &0xffff ) * tmr->skew) >>16 ); } -spin_lock_irqsave (&tmr->lock, flags); -/* update timer */ snd_seq_inc_time_nsec (&tmr->cur_time, resolution);
@@ -296,26 +304,30 @@ int snd_seq_timer_open(struct snd_seq_qu t->callback = snd_seq_timer_interrupt; t->callback_data = q; t->flags |=SNDRV_TIMER_IFLG_AUTO ; +spin_lock_irq (&tmr->lock); tmr->timeri = t; +spin_unlock_irq (&tmr->lock);return 0 ; }int snd_seq_timer_close (struct snd_seq_queue *q) {struct snd_seq_timer *tmr; +struct snd_timer_instance *t; tmr = q->timer;if (snd_BUG_ON (!tmr))return -EINVAL ; -if (tmr->timeri) { -snd_timer_stop (tmr->timeri); -snd_timer_close (tmr->timeri); - tmr->timeri =NULL ; - } +spin_lock_irq (&tmr->lock); + t = tmr->timeri; + tmr->timeri =NULL ; +spin_unlock_irq (&tmr->lock); +if (t) +snd_timer_close (t);return 0 ; } -int snd_seq_timer_stop (struct snd_seq_timer * tmr) +static int seq_timer_stop (struct snd_seq_timer *tmr) {if (! tmr->timeri)return -EINVAL ;
@@ -326,6 +338,17 @@ int snd_seq_timer_stop(struct snd_seq_tireturn 0 ; } +int snd_seq_timer_stop (struct snd_seq_timer *tmr) +{ +unsigned long flags; +int err; + +spin_lock_irqsave (&tmr->lock, flags); + err =seq_timer_stop (tmr); +spin_unlock_irqrestore (&tmr->lock, flags); +return err; +} +static int initialize_timer (struct snd_seq_timer *tmr) {struct snd_timer *t;
@@ -358,13 +381,13 @@ static int initialize_timer(struct snd_sreturn 0 ; } -int snd_seq_timer_start (struct snd_seq_timer * tmr) +static int seq_timer_start (struct snd_seq_timer *tmr) {if (! tmr->timeri)return -EINVAL ;if (tmr->running) -snd_seq_timer_stop (tmr); -snd_seq_timer_reset (tmr); +seq_timer_stop (tmr); +seq_timer_reset (tmr);if (initialize_timer (tmr) <0 )return -EINVAL ;snd_timer_start (tmr->timeri, tmr->ticks);
@@ -373,14 +396,25 @@ int snd_seq_timer_start(struct snd_seq_treturn 0 ; } -int snd_seq_timer_continue (struct snd_seq_timer * tmr) +int snd_seq_timer_start (struct snd_seq_timer *tmr) +{ +unsigned long flags; +int err; + +spin_lock_irqsave (&tmr->lock, flags); + err =seq_timer_start (tmr); +spin_unlock_irqrestore (&tmr->lock, flags); +return err; +} + +static int seq_timer_continue (struct snd_seq_timer *tmr) {if (! tmr->timeri)return -EINVAL ;if (tmr->running)return -EBUSY ;if (! tmr->initialized) { -snd_seq_timer_reset (tmr); +seq_timer_reset (tmr);if (initialize_timer (tmr) <0 )return -EINVAL ; }
@@ -390,11 +424,24 @@ int snd_seq_timer_continue(struct snd_sereturn 0 ; } +int snd_seq_timer_continue (struct snd_seq_timer *tmr) +{ +unsigned long flags; +int err; + +spin_lock_irqsave (&tmr->lock, flags); + err =seq_timer_continue (tmr); +spin_unlock_irqrestore (&tmr->lock, flags); +return err; +} +/* return current 'real' time. use timeofday() to get better granularity. */ snd_seq_real_time_t snd_seq_timer_get_cur_time (struct snd_seq_timer *tmr) {snd_seq_real_time_t cur_time; +unsigned long flags; +spin_lock_irqsave (&tmr->lock, flags); cur_time = tmr->cur_time;if (tmr->running) {struct timeval tm;
@@ -410,7 +457,7 @@ snd_seq_real_time_t snd_seq_timer_get_cu }snd_seq_sanity_real_time (&cur_time); } - +spin_unlock_irqrestore (&tmr->lock, flags);return cur_time; }
Greg Kroah-Hartman
maintainerPATCH 45/117 ALSA: seq: Fix race at closing in virmidi driver
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 2d1b5c08366acd46c35a2e9aba5d650cb5bf5c19 upstream.
The virmidi driver has an open race at closing its assigned rawmidi device, and this may lead to use-after-free in snd_seq_deliver_single_event().
Plug the hole by properly protecting the linked list deletion and calling in the right order in snd_virmidi_input_close().
--- sound/core/seq/seq_virmidi.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
sound/core/seq/seq_virmidi.c +5 -1
@@ -261,9 +261,13 @@ static int snd_virmidi_output_open(struc*/ static int snd_virmidi_input_close (struct snd_rawmidi_substream *substream) { +struct snd_virmidi_dev *rdev = substream->rmidi->private_data;struct snd_virmidi *vmidi = substream->runtime->private_data; -snd_midi_event_free (vmidi->parser); + +write_lock_irq (&rdev->filelist_lock);list_del (&vmidi->list); +write_unlock_irq (&rdev->filelist_lock); +snd_midi_event_free (vmidi->parser); substream->runtime->private_data =NULL ;kfree (vmidi);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 46/117 ALSA: seq: Fix lockdep warnings due to double mutex locks
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 7f0973e973cd74aa40747c9d38844560cd184ee8 upstream.
The port subscription code uses double mutex locks for source and destination ports, and this may become racy once when wrongly set up. It leads to lockdep warning splat, typically triggered by fuzzer like syzkaller, although the actual deadlock hasn't been seen, so far.
This patch simplifies the handling by reducing to two single locks, so that no lockdep warning will be trigger any longer.
By splitting to two actions, a still-in-progress element shall be added in one list while handling another. For ignoring this element, a new check is added in deliver_to_subscribers().
Along with it, the code to add/remove the subscribers list element was cleaned up and refactored.
--- sound/core/seq/seq_clientmgr.c | 3 sound/core/seq/seq_ports.c | 235 ++++++++++++++++++++++------------------- 2 files changed, 134 insertions(+), 104 deletions(-)
sound/core/seq/seq_clientmgr.c +3 -0
@@ -678,6 +678,9 @@ static int deliver_to_subscribers(structelse down_read (&grp->list_mutex);list_for_each_entry (subs, &grp->list_head, src_list) { +/* both ports ready? */ +if (atomic_read (&subs->ref_count) !=2 ) +continue ; event->dest = subs->info.dest;if (subs->info.flags &SNDRV_SEQ_PORT_SUBS_TIMESTAMP )/* convert time according to flag with subscription */
sound/core/seq/seq_ports.c +131 -104
320 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 47/117 ALSA: timer: Code cleanup
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit c3b1681375dc6e71d89a3ae00cc3ce9e775a8917 upstream.
This is a minor code cleanup without any functional changes:
- Kill keep_flag argument from _snd_timer_stop(), as all callers pass only it false.
- Remove redundant NULL check in _snd_timer_stop().
--- sound/core/timer.c | 28 +++++++++++----------------- 1 file changed, 11 insertions(+), 17 deletions(-)
sound/core/timer.c +11 -17
@@ -305,8 +305,7 @@ int snd_timer_open(struct snd_timer_instreturn 0 ; } -static int _snd_timer_stop (struct snd_timer_instance *timeri, -int keep_flag,int event); +static int _snd_timer_stop (struct snd_timer_instance *timeri,int event);/* * close a timer instance
@@ -348,7 +347,7 @@ int snd_timer_close(struct snd_timer_insspin_unlock_irq (&timer->lock);mutex_lock (®ister_mutex);list_del (&timeri->open_list); -if (timer &&list_empty (&timer->open_list_head) && +if (list_empty (&timer->open_list_head) && timer->hw.close) timer->hw.close (timer);/* remove slave links */
@@ -493,8 +492,7 @@ int snd_timer_start(struct snd_timer_insreturn result; } -static int _snd_timer_stop (struct snd_timer_instance * timeri, -int keep_flag,int event) +static int _snd_timer_stop (struct snd_timer_instance *timeri,int event) {struct snd_timer *timer;unsigned long flags;
@@ -503,13 +501,11 @@ static int _snd_timer_stop(struct snd_tireturn -ENXIO ;if (timeri->flags &SNDRV_TIMER_IFLG_SLAVE ) { -if (!keep_flag) { -spin_lock_irqsave (&slave_active_lock, flags); - timeri->flags &= ~SNDRV_TIMER_IFLG_RUNNING ; -list_del_init (&timeri->ack_list); -list_del_init (&timeri->active_list); -spin_unlock_irqrestore (&slave_active_lock, flags); - } +spin_lock_irqsave (&slave_active_lock, flags); + timeri->flags &= ~SNDRV_TIMER_IFLG_RUNNING ; +list_del_init (&timeri->ack_list); +list_del_init (&timeri->active_list); +spin_unlock_irqrestore (&slave_active_lock, flags); goto __end; } timer = timeri->timer;
@@ -534,9 +530,7 @@ static int _snd_timer_stop(struct snd_ti } } } -if (!keep_flag) - timeri->flags &= - ~(SNDRV_TIMER_IFLG_RUNNING |SNDRV_TIMER_IFLG_START ); + timeri->flags &= ~(SNDRV_TIMER_IFLG_RUNNING |SNDRV_TIMER_IFLG_START );spin_unlock_irqrestore (&timer->lock, flags); __end:if (event !=SNDRV_TIMER_EVENT_RESOLUTION )
@@ -555,7 +549,7 @@ int snd_timer_stop(struct snd_timer_instunsigned long flags;int err; - err =_snd_timer_stop (timeri,0 ,SNDRV_TIMER_EVENT_STOP ); + err =_snd_timer_stop (timeri,SNDRV_TIMER_EVENT_STOP );if (err <0 )return err; timer = timeri->timer;
@@ -601,7 +595,7 @@ int snd_timer_continue(struct snd_timer_*/ int snd_timer_pause (struct snd_timer_instance * timeri) { -return _snd_timer_stop (timeri,0 ,SNDRV_TIMER_EVENT_PAUSE ); +return _snd_timer_stop (timeri,SNDRV_TIMER_EVENT_PAUSE ); }/*
Greg Kroah-Hartman
maintainerPATCH 48/117 ALSA: timer: Fix leftover link at closing
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 094fd3be87b0f102589e2d5c3fa5d06b7e20496d upstream.
In ALSA timer core, the active timer instance is managed in active_list linked list. Each element is added / removed dynamically at timer start, stop and in timer interrupt. The problem is that snd_timer_interrupt() has a thinko and leaves the element in active_list when it's the last opened element. This eventually leads to list corruption or use-after-free error.
This hasn't been revealed because we used to delete the list forcibly in snd_timer_stop() in the past. However, the recent fix avoids the double-stop behavior (in commit [f784beb75ce8: ALSA: timer: Fix link corruption due to double start or stop]), and this leak hits reality.
This patch fixes the link management in snd_timer_interrupt(). Now it simply unlinks no matter which stream is.
--- sound/core/timer.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/core/timer.c +2 -2
@@ -718,8 +718,8 @@ void snd_timer_interrupt(struct snd_time ti->cticks = ti->ticks; }else { ti->flags &= ~SNDRV_TIMER_IFLG_RUNNING ; -if (--timer->running) -list_del_init (&ti->active_list); + --timer->running; +list_del_init (&ti->active_list); }if ((timer->hw.flags &SNDRV_TIMER_HW_TASKLET ) || (ti->flags &SNDRV_TIMER_IFLG_FAST ))
Greg Kroah-Hartman
maintainerPATCH 49/117 ALSA: timer: Fix link corruption due to double start or stop
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit f784beb75ce82f4136f8a0960d3ee872f7109e09 upstream.
Although ALSA timer code got hardening for races, it still causes use-after-free error. This is however rather a corrupted linked list, not actually the concurrent accesses. Namely, when timer start is triggered twice, list_add_tail() is called twice, too. This ends up with the link corruption and triggers KASAN error.
The simplest fix would be replacing list_add_tail() with list_move_tail(), but fundamentally it's the problem that we don't check the double start/stop correctly. So, the right fix here is to add the proper checks to snd_timer_start() and snd_timer_stop() (and their variants).
--- sound/core/timer.c | 30 ++++++++++++++++++++++++++++-- 1 file changed, 28 insertions(+), 2 deletions(-)
sound/core/timer.c +28 -2
@@ -451,6 +451,10 @@ static int snd_timer_start_slave(structunsigned long flags;spin_lock_irqsave (&slave_active_lock, flags); +if (timeri->flags &SNDRV_TIMER_IFLG_RUNNING ) { +spin_unlock_irqrestore (&slave_active_lock, flags); +return -EBUSY ; + } timeri->flags |=SNDRV_TIMER_IFLG_RUNNING ;if (timeri->master && timeri->timer) {spin_lock (&timeri->timer->lock);
@@ -475,7 +479,8 @@ int snd_timer_start(struct snd_timer_insreturn -EINVAL ;if (timeri->flags &SNDRV_TIMER_IFLG_SLAVE ) { result =snd_timer_start_slave (timeri); -snd_timer_notify1 (timeri,SNDRV_TIMER_EVENT_START ); +if (result >=0 ) +snd_timer_notify1 (timeri,SNDRV_TIMER_EVENT_START );return result; } timer = timeri->timer;
@@ -484,11 +489,18 @@ int snd_timer_start(struct snd_timer_insif (timer->card && timer->card->shutdown)return -ENODEV ;spin_lock_irqsave (&timer->lock, flags); +if (timeri->flags & (SNDRV_TIMER_IFLG_RUNNING | +SNDRV_TIMER_IFLG_START )) { + result = -EBUSY ; + goto unlock; + } timeri->ticks = timeri->cticks = ticks; timeri->pticks =0 ; result =snd_timer_start1 (timer, timeri, ticks); + unlock:spin_unlock_irqrestore (&timer->lock, flags); -snd_timer_notify1 (timeri,SNDRV_TIMER_EVENT_START ); +if (result >=0 ) +snd_timer_notify1 (timeri,SNDRV_TIMER_EVENT_START );return result; }
@@ -502,6 +514,10 @@ static int _snd_timer_stop(struct snd_tiif (timeri->flags &SNDRV_TIMER_IFLG_SLAVE ) {spin_lock_irqsave (&slave_active_lock, flags); +if (!(timeri->flags &SNDRV_TIMER_IFLG_RUNNING )) { +spin_unlock_irqrestore (&slave_active_lock, flags); +return -EBUSY ; + } timeri->flags &= ~SNDRV_TIMER_IFLG_RUNNING ;list_del_init (&timeri->ack_list);list_del_init (&timeri->active_list);
@@ -512,6 +528,11 @@ static int _snd_timer_stop(struct snd_tiif (!timer)return -EINVAL ;spin_lock_irqsave (&timer->lock, flags); +if (!(timeri->flags & (SNDRV_TIMER_IFLG_RUNNING | +SNDRV_TIMER_IFLG_START ))) { +spin_unlock_irqrestore (&timer->lock, flags); +return -EBUSY ; + }list_del_init (&timeri->ack_list);list_del_init (&timeri->active_list);if (timer->card && timer->card->shutdown) {
@@ -581,10 +602,15 @@ int snd_timer_continue(struct snd_timer_if (timer->card && timer->card->shutdown)return -ENODEV ;spin_lock_irqsave (&timer->lock, flags); +if (timeri->flags &SNDRV_TIMER_IFLG_RUNNING ) { + result = -EBUSY ; + goto unlock; + }if (!timeri->cticks) timeri->cticks =1 ; timeri->pticks =0 ; result =snd_timer_start1 (timer, timeri, timer->sticks); + unlock:spin_unlock_irqrestore (&timer->lock, flags);snd_timer_notify1 (timeri,SNDRV_TIMER_EVENT_CONTINUE );return result;
Greg Kroah-Hartman
maintainerPATCH 50/117 ALSA: timer: Fix race at concurrent reads
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 4dff5c7b7093b19c19d3a100f8a3ad87cb7cd9e7 upstream.
snd_timer_user_read() has a potential race among parallel reads, as qhead and qused are updated outside the critical section due to copy_to_user() calls. Move them into the critical section, and also sanitize the relevant code a bit.
--- sound/core/timer.c | 34 +++++++++++++++------------------- 1 file changed, 15 insertions(+), 19 deletions(-)
sound/core/timer.c +15 -19
@@ -1920,6 +1920,7 @@ static ssize_t snd_timer_user_read(struc {struct snd_timer_user *tu;long result =0 , unit; +int qhead;int err =0 ; tu = file->private_data;
@@ -1931,7 +1932,7 @@ static ssize_t snd_timer_user_read(strucif ((file->f_flags &O_NONBLOCK ) !=0 || result >0 ) { err = -EAGAIN ; -break ; + goto _error; }set_current_state (TASK_INTERRUPTIBLE );
@@ -1946,42 +1947,37 @@ static ssize_t snd_timer_user_read(strucif (tu->disconnected) { err = -ENODEV ; -break ; + goto _error; }if (signal_pending (current)) { err = -ERESTARTSYS ; -break ; + goto _error; } } + qhead = tu->qhead++; + tu->qhead %= tu->queue_size;spin_unlock_irq (&tu->qlock); -if (err <0 ) - goto _error;if (tu->tread) { -if (copy_to_user (buffer, &tu->tqueue[tu->qhead++], -sizeof (struct snd_timer_tread ))) { +if (copy_to_user (buffer, &tu->tqueue[qhead], +sizeof (struct snd_timer_tread ))) err = -EFAULT ; - goto _error; - } }else { -if (copy_to_user (buffer, &tu->queue[tu->qhead++], -sizeof (struct snd_timer_read ))) { +if (copy_to_user (buffer, &tu->queue[qhead], +sizeof (struct snd_timer_read ))) err = -EFAULT ; - goto _error; - } } - tu->qhead %= tu->queue_size; - - result += unit; - buffer += unit; -spin_lock_irq (&tu->qlock); tu->qused--; +if (err <0 ) + goto _error; + result += unit; + buffer += unit; } -spin_unlock_irq (&tu->qlock); _error: +spin_unlock_irq (&tu->qlock);return result >0 ? result : err; }
Greg Kroah-Hartman
maintainerPATCH 51/117 ALSA: timer: Fix wrong instance passed to slave callbacks
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 117159f0b9d392fb433a7871426fad50317f06f7 upstream.
In snd_timer_notify1(), the wrong timer instance was passed for slave ccallback function. This leads to the access to the wrong data when an incompatible master is handled (e.g. the master is the sequencer timer and the slave is a user timer), as spotted by syzkaller fuzzer.
This patch fixes that wrong assignment.
--- sound/core/timer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/core/timer.c +1 -1
@@ -422,7 +422,7 @@ static void snd_timer_notify1(struct sndspin_lock_irqsave (&timer->lock, flags);list_for_each_entry (ts, &ti->slave_active_head, active_list)if (ts->ccallback) - ts->ccallback (ti, event +100 , &tstamp, resolution); + ts->ccallback (ts, event +100 , &tstamp, resolution);spin_unlock_irqrestore (&timer->lock, flags); }
Greg Kroah-Hartman
maintainerPATCH 52/117 ALSA: timer: Fix race between stop and interrupt
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit ed8b1d6d2c741ab26d60d499d7fbb7ac801f0f51 upstream.
A slave timer element also unlinks at snd_timer_stop() but it takes only slave_active_lock. When a slave is assigned to a master, however, this may become a race against the master's interrupt handling, eventually resulting in a list corruption. The actual bug could be seen with a syzkaller fuzzer test case in BugLink below.
As a fix, we need to take timeri->timer->lock when timer isn't NULL, i.e. assigned to a master, while the assignment to a master itself is protected by slave_active_lock.
--- sound/core/timer.c | 4 ++++ 1 file changed, 4 insertions(+)
sound/core/timer.c +4 -0
@@ -518,9 +518,13 @@ static int _snd_timer_stop(struct snd_tispin_unlock_irqrestore (&slave_active_lock, flags);return -EBUSY ; } +if (timeri->timer) +spin_lock (&timeri->timer->lock); timeri->flags &= ~SNDRV_TIMER_IFLG_RUNNING ;list_del_init (&timeri->ack_list);list_del_init (&timeri->active_list); +if (timeri->timer) +spin_unlock (&timeri->timer->lock);spin_unlock_irqrestore (&slave_active_lock, flags); goto __end; }
Greg Kroah-Hartman
maintainerPATCH 53/117 ALSA: hda - Add fixup for Mac Mini 7,1 model
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 2154cc0e2d4ae15132d005d17e473327c70c9a06 upstream.
Mac Mini 7,1 model with CS4208 codec reports the headphone jack detection wrongly in an inverted way. Moreover, the advertised pins for the audio input and SPDIF output have actually no jack detection.
This patch addresses these issues. The inv_jack_detect flag is set for fixing the headphone jack detection, and the pin configs for audio input and SPDIF output are marked as non-detectable.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=105161
--- sound/pci/hda/patch_cirrus.c | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+)
sound/pci/hda/patch_cirrus.c +27 -0
@@ -614,6 +614,7 @@ enum {CS4208_MAC_AUTO ,CS4208_MBA6 ,CS4208_MBP11 , +CS4208_MACMINI , CS4208_GPIO0, };
@@ -621,6 +622,7 @@ static const struct hda_model_fixup cs42 { .id = CS4208_GPIO0, .name = "gpio0" }, { .id = CS4208_MBA6, .name = "mba6" }, { .id = CS4208_MBP11, .name = "mbp11" }, + { .id = CS4208_MACMINI, .name = "macmini" }, {} };
@@ -632,6 +634,7 @@ static const struct snd_pci_quirk cs4208/* codec SSID matching */ static const struct snd_pci_quirk cs4208_mac_fixup_tbl[] = {SND_PCI_QUIRK (0x106b ,0x5e00 ,"MacBookPro 11,2" ,CS4208_MBP11 ), +SND_PCI_QUIRK (0x106b ,0x6c00 ,"MacMini 7,1" ,CS4208_MACMINI ),SND_PCI_QUIRK (0x106b ,0x7100 ,"MacBookAir 6,1" ,CS4208_MBA6 ),SND_PCI_QUIRK (0x106b ,0x7200 ,"MacBookAir 6,2" ,CS4208_MBA6 ),SND_PCI_QUIRK (0x106b ,0x7b00 ,"MacBookPro 12,1" ,CS4208_MBP11 ),
@@ -666,6 +669,24 @@ static void cs4208_fixup_mac(struct hda_snd_hda_apply_fixup (codec, action); } +/* MacMini 7,1 has the inverted jack detection */ +static void cs4208_fixup_macmini (struct hda_codec *codec, +const struct hda_fixup *fix,int action) +{ +static const struct hda_pintbl pincfgs[] = { + {0x18 ,0x00ab9150 },/* mic (audio-in) jack: disable detect */ + {0x21 ,0x004be140 },/* SPDIF: disable detect */ + { } + }; + +if (action ==HDA_FIXUP_ACT_PRE_PROBE ) { +/* HP pin (0x10) has an inverted detection */ + codec->inv_jack_detect =1 ; +/* disable the bogus Mic and SPDIF jack detections */ +snd_hda_apply_pincfgs (codec, pincfgs); + } +} +static int cs4208_spdif_sw_put (struct snd_kcontrol *kcontrol,struct snd_ctl_elem_value *ucontrol) {
@@ -709,6 +730,12 @@ static const struct hda_fixup cs4208_fix .chained = true, .chain_id = CS4208_GPIO0, }, + [CS4208_MACMINI] = { + .type = HDA_FIXUP_FUNC, + .v.func = cs4208_fixup_macmini, + .chained = true, + .chain_id = CS4208_GPIO0, + }, [CS4208_GPIO0] = { .type = HDA_FIXUP_FUNC, .v.func = cs4208_fixup_gpio0,
Greg Kroah-Hartman
maintainerPATCH 54/117 ALSA: hda - Fix static checker warning in patch_hdmi.c
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Henningsson <[email protected]>
commit 360a8245680053619205a3ae10e6bfe624a5da1d upstream.
The static checker warning is:
sound/pci/hda/patch_hdmi.c:460 hdmi_eld_ctl_get() error: __memcpy() 'eld->eld_buffer' too small (256 vs 512)
I have a hard time figuring out if this can ever cause an information leak (I don't think so), but nonetheless it does not hurt to increase the robustness of the code.
--- sound/pci/hda/patch_hdmi.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
sound/pci/hda/patch_hdmi.c +2 -1
@@ -438,7 +438,8 @@ static int hdmi_eld_ctl_get(struct snd_k eld = &per_pin->sink_eld;mutex_lock (&per_pin->lock); -if (eld->eld_size >ARRAY_SIZE (ucontrol->value.bytes.data)) { +if (eld->eld_size >ARRAY_SIZE (ucontrol->value.bytes.data) || + eld->eld_size >ELD_MAX_SIZE ) {mutex_unlock (&per_pin->lock);snd_BUG ();return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 55/117 Revert "ALSA: hda - Fix noise on Gigabyte Z170X mobo"
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 6c361d10e0eb859233c71954abcd20d2d8700587 upstream.
This reverts commit 0c25ad80408e95e0a4fbaf0056950206e95f726f.
The original commit disabled the aamixer path due to the noise problem, but it turned out that some mobo with the same PCI SSID doesn't suffer from the issue, and the disabled function (analog loopback) is still demanded by users.
Since the recent commit [e7fdd52779a6: ALSA: hda - Implement loopback control switch for Realtek and other codecs], we have the dynamic mixer switch to enable/disable the aamix path, and we don't have to disable the path statically any longer. So, let's revert the disablement, so that only the user suffering from the noise problem can turn off the aamix on the fly.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=108301
--- sound/pci/hda/patch_realtek.c | 8 -------- 1 file changed, 8 deletions(-)
sound/pci/hda/patch_realtek.c +0 -8
@@ -1787,7 +1787,6 @@ enum {ALC882_FIXUP_NO_PRIMARY_HP ,ALC887_FIXUP_ASUS_BASS , ALC887_FIXUP_BASS_CHMAP, - ALC882_FIXUP_DISABLE_AAMIX, }; static void alc889_fixup_coef(struct hda_codec *codec,
@@ -1949,8 +1948,6 @@ static void alc882_fixup_no_primary_hp(sstatic void alc_fixup_bass_chmap (struct hda_codec *codec,const struct hda_fixup *fix,int action); -static void alc_fixup_disable_aamix (struct hda_codec *codec, -const struct hda_fixup *fix,int action);static const struct hda_fixup alc882_fixups[] = { [ALC882_FIXUP_ABIT_AW9D_MAX ] = {
@@ -2188,10 +2185,6 @@ static const struct hda_fixup alc882_fix .type = HDA_FIXUP_FUNC, .v.func = alc_fixup_bass_chmap, }, - [ALC882_FIXUP_DISABLE_AAMIX] = { - .type = HDA_FIXUP_FUNC, - .v.func = alc_fixup_disable_aamix, - }, }; static const struct snd_pci_quirk alc882_fixup_tbl[] = {
@@ -2259,7 +2252,6 @@ static const struct snd_pci_quirk alc882SND_PCI_QUIRK (0x1462 ,0x7350 ,"MSI-7350" ,ALC889_FIXUP_CD ),SND_PCI_QUIRK_VENDOR (0x1462 ,"MSI" ,ALC882_FIXUP_GPIO3 ),SND_PCI_QUIRK (0x1458 ,0xa002 ,"Gigabyte EP45-DS3/Z87X-UD3H" ,ALC889_FIXUP_FRONT_HP_NO_PRESENCE ), -SND_PCI_QUIRK (0x1458 ,0xa182 ,"Gigabyte Z170X-UD3" ,ALC882_FIXUP_DISABLE_AAMIX ),SND_PCI_QUIRK (0x147b ,0x107a ,"Abit AW9D-MAX" ,ALC882_FIXUP_ABIT_AW9D_MAX ),SND_PCI_QUIRK_VENDOR (0x1558 ,"Clevo laptop" ,ALC882_FIXUP_EAPD ), SND_PCI_QUIRK(0x161f, 0x2054, "Medion laptop", ALC883_FIXUP_EAPD),
Greg Kroah-Hartman
maintainerPATCH 56/117 ALSA: hda - Fix speaker output from VAIO AiO machines
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit c44d9b1181cf34e0860c72cc8a00e0c47417aac0 upstream.
Some Sony VAIO AiO models (VGC-JS4EF and VGC-JS25G, both with PCI SSID 104d:9044) need the same quirk to make the speaker working properly.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=112031
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -2223,6 +2223,7 @@ static const struct snd_pci_quirk alc882SND_PCI_QUIRK (0x104d ,0x9047 ,"Sony Vaio TT" ,ALC889_FIXUP_VAIO_TT ),SND_PCI_QUIRK (0x104d ,0x905a ,"Sony Vaio Z" ,ALC882_FIXUP_NO_PRIMARY_HP ),SND_PCI_QUIRK (0x104d ,0x9043 ,"Sony Vaio VGC-LN51JGB" ,ALC882_FIXUP_NO_PRIMARY_HP ), +SND_PCI_QUIRK (0x104d ,0x9044 ,"Sony VAIO AiO" ,ALC882_FIXUP_NO_PRIMARY_HP ),/* All Apple entries are in codec SSIDs */ SND_PCI_QUIRK(0x106b, 0x00a0, "MacBookPro 3,1", ALC889_FIXUP_MBP_VREF),
Greg Kroah-Hartman
maintainerPATCH 57/117 ALSA: hda - Fix bad dereference of jack object
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 2ebab40eb74a0225d5dfba72bfae317dd948fa2d upstream.
The hda_jack_tbl entries are managed by snd_array for allowing multiple jacks. It's good per se, but the problem is that struct hda_jack_callback keeps the hda_jack_tbl pointer. Since snd_array doesn't preserve each pointer at resizing the array, we can't keep the original pointer but have to deduce the pointer at each time via snd_array_entry() instead. Actually, this resulted in the deference to the wrong pointer on codecs that have many pins such as CS4208.
This patch replaces the pointer to the NID value as the search key. As an unexpected good side effect, this even simplifies the code, as only NID is needed in most cases.
--- sound/pci/hda/hda_generic.c | 4 ++-- sound/pci/hda/hda_jack.c | 2 +- sound/pci/hda/hda_jack.h | 2 +- sound/pci/hda/patch_ca0132.c | 5 ++++- sound/pci/hda/patch_hdmi.c | 2 +- sound/pci/hda/patch_realtek.c | 2 +- sound/pci/hda/patch_sigmatel.c | 6 +++--- 7 files changed, 13 insertions(+), 10 deletions(-)
sound/pci/hda/hda_generic.c +2 -2
@@ -4045,9 +4045,9 @@ static void pin_power_callback(struct hd struct hda_jack_callback *jack, bool on) { -if (jack && jack->tbl->nid) +if (jack && jack->nid)sync_power_state_change (codec, -set_pin_power_jack (codec, jack->tbl->nid, on)); +set_pin_power_jack (codec, jack->nid, on)); }/* callback only doing power up -- called at first */
sound/pci/hda/hda_jack.c +1 -1
@@ -259,7 +259,7 @@ snd_hda_jack_detect_enable_callback(struif (!callback)return ERR_PTR (-ENOMEM ); callback->func = func; - callback->tbl = jack; + callback->nid = jack->nid; callback->next = jack->callback; jack->callback = callback; }
sound/pci/hda/hda_jack.h +1 -1
@@ -21,7 +21,7 @@ struct hda_jack_callback;typedef void (*hda_jack_callback_fn ) (struct hda_codec *,struct hda_jack_callback *);struct hda_jack_callback { -struct hda_jack_tbl *tbl; +hda_nid_t nid;hda_jack_callback_fn func;unsigned int private_data;/* arbitrary data */ struct hda_jack_callback *next;
sound/pci/hda/patch_ca0132.c +4 -1
@@ -4427,13 +4427,16 @@ static void ca0132_process_dsp_response(static void hp_callback (struct hda_codec *codec,struct hda_jack_callback *cb) {struct ca0132_spec *spec = codec->spec; +struct hda_jack_tbl *tbl;/* Delay enabling the HP amp, to let the mic-detection * state machine run. */ cancel_delayed_work_sync (&spec->unsol_hp_work);schedule_delayed_work (&spec->unsol_hp_work,msecs_to_jiffies (500 )); - cb->tbl->block_report =1 ; + tbl =snd_hda_jack_tbl_get (codec, cb->nid); +if (tbl) + tbl->block_report =1 ; }static void amic_callback (struct hda_codec *codec,struct hda_jack_callback *cb)
sound/pci/hda/patch_hdmi.c +1 -1
@@ -1184,7 +1184,7 @@ static void check_presence_and_report(ststatic void jack_callback (struct hda_codec *codec,struct hda_jack_callback *jack) { -check_presence_and_report (codec, jack->tbl->nid); +check_presence_and_report (codec, jack->nid); }static void hdmi_intrinsic_event (struct hda_codec *codec,unsigned int res)
sound/pci/hda/patch_realtek.c +1 -1
@@ -282,7 +282,7 @@ static void alc_update_knob_master(struc uctl =kzalloc (sizeof (*uctl),GFP_KERNEL );if (!uctl)return ; - val =snd_hda_codec_read (codec, jack->tbl->nid,0 , + val =snd_hda_codec_read (codec, jack->nid,0 ,AC_VERB_GET_VOLUME_KNOB_CONTROL ,0 ); val &=HDA_AMP_VOLMASK ; uctl->value.integer.value[0 ] = val;
sound/pci/hda/patch_sigmatel.c +3 -3
@@ -493,9 +493,9 @@ static void jack_update_power(struct hdaif (!spec->num_pwrs)return ; -if (jack && jack->tbl->nid) { -stac_toggle_power_map (codec, jack->tbl->nid, -snd_hda_jack_detect (codec, jack->tbl->nid), +if (jack && jack->nid) { +stac_toggle_power_map (codec, jack->nid, +snd_hda_jack_detect (codec, jack->nid), true);return ; }
Greg Kroah-Hartman
maintainerPATCH 58/117 ALSA: dummy: Implement timer backend switching more safely
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit ddce57a6f0a2d8d1bfacfa77f06043bc760403c2 upstream.
Currently the selected timer backend is referred at any moment from the running PCM callbacks. When the backend is switched, it's possible to lead to inconsistency from the running backend. This was pointed by syzkaller fuzzer, and the commit [7ee96216c31a: ALSA:
dummy: Disable switching timer backend via sysfs] disabled the dynamic switching for avoiding the crash.
This patch improves the handling of timer backend switching. It keeps the reference to the selected backend during the whole operation of an opened stream so that it won't be changed by other streams.
Together with this change, the hrtimer parameter is reenabled as writable now.
NOTE: this patch also turned out to fix the still remaining race. Namely, ops was still replaced dynamically at dummy_pcm_open:
static int dummy_pcm_open(struct snd_pcm_substream *substream)
{
....
dummy->timer_ops = &dummy_systimer_ops;
if (hrtimer)
dummy->timer_ops = &dummy_hrtimer_ops;Since dummy->timer_ops is common among all streams, and when the replacement happens during accesses of other streams, it may lead to a crash. This was actually triggered by syzkaller fuzzer and KASAN.
This patch rewrites the code not to use the ops shared by all streams any longer, too.
--- sound/drivers/dummy.c | 37 +++++++++++++++++++------------------ 1 file changed, 19 insertions(+), 18 deletions(-)
sound/drivers/dummy.c +19 -18
@@ -87,7 +87,7 @@ MODULE_PARM_DESC(pcm_substreams, "PCM sumodule_param (fake_buffer, bool,0444 );MODULE_PARM_DESC (fake_buffer,"Fake buffer allocations." );#ifdef CONFIG_HIGH_RES_TIMERS -module_param (hrtimer, bool,0444 ); +module_param (hrtimer, bool,0644 );MODULE_PARM_DESC (hrtimer,"Use hrtimer as the timer source." );#endif
@@ -109,6 +109,9 @@ struct dummy_timer_ops {snd_pcm_uframes_t (*pointer)(struct snd_pcm_substream *); }; +#define get_dummy_ops (substream) \ + (*(const struct dummy_timer_ops **)(substream)->runtime->private_data) +struct dummy_model {const char *name;int (*playback_constraints)(struct snd_pcm_runtime *runtime);
@@ -137,7 +140,6 @@ struct snd_dummy {int iobox;struct snd_kcontrol *cd_volume_ctl;struct snd_kcontrol *cd_switch_ctl; -const struct dummy_timer_ops *timer_ops; };/*
@@ -231,6 +233,8 @@ static struct dummy_model *dummy_models[*/ struct dummy_systimer_pcm { +/* ops must be the first item */ +const struct dummy_timer_ops *timer_ops;spinlock_t lock;struct timer_list timer;unsigned long base_time;
@@ -366,6 +370,8 @@ static struct dummy_timer_ops dummy_syst*/ struct dummy_hrtimer_pcm { +/* ops must be the first item */ +const struct dummy_timer_ops *timer_ops;ktime_t base_time;ktime_t period_time;atomic_t running;
@@ -492,31 +498,25 @@ static struct dummy_timer_ops dummy_hrtistatic int dummy_pcm_trigger (struct snd_pcm_substream *substream,int cmd) { -struct snd_dummy *dummy =snd_pcm_substream_chip (substream); -switch (cmd) {case SNDRV_PCM_TRIGGER_START :case SNDRV_PCM_TRIGGER_RESUME : -return dummy->timer_ops->start (substream); +return get_dummy_ops (substream)->start (substream);case SNDRV_PCM_TRIGGER_STOP :case SNDRV_PCM_TRIGGER_SUSPEND : -return dummy->timer_ops->stop (substream); +return get_dummy_ops (substream)->stop (substream); }return -EINVAL ; }static int dummy_pcm_prepare (struct snd_pcm_substream *substream) { -struct snd_dummy *dummy =snd_pcm_substream_chip (substream); - -return dummy->timer_ops->prepare (substream); +return get_dummy_ops (substream)->prepare (substream); }static snd_pcm_uframes_t dummy_pcm_pointer (struct snd_pcm_substream *substream) { -struct snd_dummy *dummy =snd_pcm_substream_chip (substream); - -return dummy->timer_ops->pointer (substream); +return get_dummy_ops (substream)->pointer (substream); }static struct snd_pcm_hardware dummy_pcm_hardware = {
@@ -562,17 +562,19 @@ static int dummy_pcm_open(struct snd_pcmstruct snd_dummy *dummy =snd_pcm_substream_chip (substream);struct dummy_model *model = dummy->model;struct snd_pcm_runtime *runtime = substream->runtime; +const struct dummy_timer_ops *ops;int err; - dummy->timer_ops = &dummy_systimer_ops; + ops = &dummy_systimer_ops;#ifdef CONFIG_HIGH_RES_TIMERS if (hrtimer) - dummy->timer_ops = &dummy_hrtimer_ops; + ops = &dummy_hrtimer_ops;#endif - err = dummy->timer_ops->create (substream); + err = ops->create (substream);if (err <0 )return err; +get_dummy_ops (substream) = ops; runtime->hw = dummy->pcm_hw;if (substream->pcm->device &1 ) {
@@ -594,7 +596,7 @@ static int dummy_pcm_open(struct snd_pcm err = model->capture_constraints (substream->runtime); }if (err <0 ) { - dummy->timer_ops->free (substream); +get_dummy_ops (substream)->free (substream);return err; }return 0 ;
@@ -602,8 +604,7 @@ static int dummy_pcm_open(struct snd_pcmstatic int dummy_pcm_close (struct snd_pcm_substream *substream) { -struct snd_dummy *dummy =snd_pcm_substream_chip (substream); - dummy->timer_ops->free (substream); +get_dummy_ops (substream)->free (substream);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 59/117 saa7134-alsa: Only frees registered sound cards
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mauro Carvalho Chehab <[email protected]>
commit ac75fe5d8fe4a0bf063be18fb29684405279e79e upstream.
That prevents this bug:
[ 2382.269496] BUG: unable to handle kernel NULL pointer dereference at 0000000000000540 [ 2382.270013] IP: [<ffffffffa01fe616>] snd_card_free+0x36/0x70 [snd] [ 2382.270013] PGD 0 [ 2382.270013] Oops: 0002 [#1] SMP [ 2382.270013] Modules linked in: saa7134_alsa(-) tda1004x saa7134_dvb videobuf2_dvb dvb_core tda827x tda8290 tuner saa7134 tveeprom videobuf2_dma_sg videobuf2_memops videobuf2_v4l2 videobuf2_core v4l2_common videodev media auth_rpcgss nfsv4 dns_resolver nfs lockd grace sunrpc tun bridge stp llc ebtables ip6table_filter ip6_tables nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack it87 hwmon_vid snd_hda_codec_idt snd_hda_codec_generic iTCO_wdt iTCO_vendor_support snd_hda_intel snd_hda_codec snd_hwdep snd_hda_core snd_seq pcspkr i2c_i801 snd_seq_device snd_pcm snd_timer lpc_ich snd mfd_core soundcore binfmt_misc i915 video i2c_algo_bit drm_kms_helper drm r8169 ata_generic serio_raw pata_acpi mii i2c_core [last unloaded: videobuf2_memops] [ 2382.270013] CPU: 0 PID: 4899 Comm: rmmod Not tainted 4.5.0-rc1+ #4 [ 2382.270013] Hardware name: PCCHIPS P17G/P17G, BIOS 080012 05/14/2008 [ 2382.270013] task: ffff880039c38000 ti: ffff88003c764000 task.ti: ffff88003c764000 [ 2382.270013] RIP: 0010:[<ffffffffa01fe616>] [<ffffffffa01fe616>] snd_card_free+0x36/0x70 [snd] [ 2382.270013] RSP: 0018:ffff88003c767ea0 EFLAGS: 00010286 [ 2382.270013] RAX: ffff88003c767eb8 RBX: 0000000000000000 RCX: 0000000000006260 [ 2382.270013] RDX: ffffffffa020a060 RSI: ffffffffa0206de1 RDI: ffff88003c767eb0 [ 2382.270013] RBP: ffff88003c767ed8 R08: 0000000000019960 R09: ffffffff811a5412 [ 2382.270013] R10: ffffea0000d7c200 R11: 0000000000000000 R12: ffff88003c767ea8 [ 2382.270013] R13: 00007ffe760617f7 R14: 0000000000000000 R15: 0000557625d7f1e0 [ 2382.270013] FS: 00007f80bb1c0700(0000) GS:ffff88003f400000(0000) knlGS:0000000000000000 [ 2382.270013] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b [ 2382.270013] CR2: 0000000000000540 CR3: 000000003c00f000 CR4: 00000000000006f0 [ 2382.270013] Stack: [ 2382.270013] 000000003c767ed8 ffffffff00000000 ffff880000000000 ffff88003c767eb8 [ 2382.270013] ffff88003c767eb8 ffffffffa049a890 00007ffe76060060 ffff88003c767ef0 [ 2382.270013] ffffffffa049889d ffffffffa049a500 ffff88003c767f48 ffffffff8111079c [ 2382.270013] Call Trace: [ 2382.270013] [<ffffffffa049889d>] saa7134_alsa_exit+0x1d/0x780 [saa7134_alsa] [ 2382.270013] [<ffffffff8111079c>] SyS_delete_module+0x19c/0x1f0 [ 2382.270013] [<ffffffff8170fc2e>] entry_SYSCALL_64_fastpath+0x12/0x71 [ 2382.270013] Code: 20 a0 48 c7 c6 e1 6d 20 a0 48 89 e5 41 54 53 4c 8d 65 d0 48 89 fb 48 83 ec 28 c7 45 d0 00 00 00 00 49 8d 7c 24 08 e8 7a 55 ed e0 <4c> 89 a3 40 05 00 00 48 89 df e8 eb fd ff ff 85 c0 75 1a 48 8d [ 2382.270013] RIP [<ffffffffa01fe616>] snd_card_free+0x36/0x70 [snd] [ 2382.270013] RSP <ffff88003c767ea0> [ 2382.270013] CR2: 0000000000000540
--- drivers/media/pci/saa7134/saa7134-alsa.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/media/pci/saa7134/saa7134-alsa.c +4 -1
@@ -1211,6 +1211,8 @@ static int alsa_device_init(struct saa71static int alsa_device_exit (struct saa7134_dev *dev) { +if (!snd_saa7134_cards[dev->nr]) +return 1 ;snd_card_free (snd_saa7134_cards[dev->nr]); snd_saa7134_cards[dev->nr] =NULL ;
@@ -1260,7 +1262,8 @@ static void saa7134_alsa_exit(void)int idx;for (idx =0 ; idx <SNDRV_CARDS ; idx++) { -snd_card_free (snd_saa7134_cards[idx]); +if (snd_saa7134_cards[idx]) +snd_card_free (snd_saa7134_cards[idx]); } saa7134_dmasound_init =NULL ;
Greg Kroah-Hartman
maintainerPATCH 60/117 ASoC: rt5645: fix the shift bit of IN1 boost
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bard Liao <[email protected]>
commit b28785fa9cede0d4f47310ca0dd2a4e1d50478b5 upstream.
The shift bit of IN1 boost gain control is 12.
--- sound/soc/codecs/rt5645.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/codecs/rt5645.c +1 -1
@@ -621,7 +621,7 @@ static const struct snd_kcontrol_new rt5/* IN1/IN2 Control */ SOC_SINGLE_TLV ("IN1 Boost" ,RT5645_IN1_CTRL1 , -RT5645_BST_SFT1 ,8 ,0 , bst_tlv), +RT5645_BST_SFT1 ,12 ,0 , bst_tlv),SOC_SINGLE_TLV ("IN2 Boost" ,RT5645_IN2_CTRL , RT5645_BST_SFT2, 8, 0, bst_tlv),
Greg Kroah-Hartman
maintainerPATCH 61/117 USB: serial: visor: fix crash on detecting device without write_urbs
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladis Dronov <[email protected]>
commit cb3232138e37129e88240a98a1d2aba2187ff57c upstream.
The visor driver crashes in clie_5_attach() when a specially crafted USB device without bulk-out endpoint is detected. This fix adds a check that the device has proper configuration expected by the driver.
--- drivers/usb/serial/visor.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/usb/serial/visor.c +4 -2
@@ -597,8 +597,10 @@ static int clie_5_attach(struct usb_seri*/ /* some sanity check */ -if (serial->num_ports <2 ) -return -1 ; +if (serial->num_bulk_out <2 ) { +dev_err (&serial->interface->dev,"missing bulk out endpoints\n" ); +return -ENODEV ; + }/* port 0 now uses the modified endpoint Address */ port = serial->port[0 ];
Greg Kroah-Hartman
maintainerPATCH 62/117 USB: visor: fix null-deref at probe
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit cac9b50b0d75a1d50d6c056ff65c005f3224c8e0 upstream.
Fix null-pointer dereference at probe should a (malicious) Treo device lack the expected endpoints.
Specifically, the Treo port-setup hack was dereferencing the bulk-in and interrupt-in urbs without first making sure they had been allocated by core.
--- drivers/usb/serial/visor.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/usb/serial/visor.c +5 -0
@@ -544,6 +544,11 @@ static int treo_attach(struct usb_serial (serial->num_interrupt_in == 0))return 0 ; +if (serial->num_bulk_in <2 || serial->num_interrupt_in <2 ) { +dev_err (&serial->interface->dev,"missing endpoints\n" ); +return -ENODEV ; + } +/* * It appears that Treos and Kyoceras want to use the * 1st bulk in endpoint to communicate with the 2nd bulk out endpoint,
Greg Kroah-Hartman
maintainerPATCH 63/117 usb: hub: do not clear BOS field during reset device
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Du, Changbin <[email protected]>
commit d8f00cd685f5c8e0def8593e520a7fef12c22407 upstream.
In function usb_reset_and_verify_device, the old BOS descriptor may still be used before allocating a new one. (usb_unlocked_disable_lpm function uses it under the situation that it fails to disable lpm.) So we cannot set the udev->bos to NULL before that, just keep what it was. It will be overwrite when allocating a new one.
Crash log:
BUG: unable to handle kernel NULL pointer dereference at 0000000000000010 IP: [<ffffffff8171f98d>] usb_enable_link_state+0x2d/0x2f0 Call Trace: [<ffffffff8171ed5b>] ? usb_set_lpm_timeout+0x12b/0x140 [<ffffffff8171fcd1>] usb_enable_lpm+0x81/0xa0 [<ffffffff8171fdd8>] usb_disable_lpm+0xa8/0xc0 [<ffffffff8171fe1c>] usb_unlocked_disable_lpm+0x2c/0x50 [<ffffffff81723933>] usb_reset_and_verify_device+0xc3/0x710 [<ffffffff8172c4ed>] ? usb_sg_wait+0x13d/0x190 [<ffffffff81724743>] usb_reset_device+0x133/0x280 [<ffffffff8179ccd1>] usb_stor_port_reset+0x61/0x70 [<ffffffff8179cd68>] usb_stor_invoke_transport+0x88/0x520
--- drivers/usb/core/hub.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/usb/core/hub.c +5 -3
@@ -5386,7 +5386,6 @@ static int usb_reset_and_verify_device(s } bos = udev->bos; - udev->bos =NULL ;for (i =0 ; i <SET_CONFIG_TRIES ; ++i) {
@@ -5479,8 +5478,11 @@ done:usb_set_usb2_hardware_lpm (udev,1 );usb_unlocked_enable_lpm (udev);usb_enable_ltm (udev); -usb_release_bos_descriptor (udev); - udev->bos = bos; +/* release the new BOS descriptor allocated by hub_port_init() */ +if (udev->bos != bos) { +usb_release_bos_descriptor (udev); + udev->bos = bos; + }return 0 ; re_enumerate:
Greg Kroah-Hartman
maintainerPATCH 64/117 USB: serial: ftdi_sio: add support for Yaesu SCU-18 cable
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
commit e03cdf22a2727c60307be6a729233edab3bfda9c upstream.
Harald Linden reports that the ftdi_sio driver works properly for the Yaesu SCU-18 cable if the device ids are added to the driver. So let's add them.
--- drivers/usb/serial/ftdi_sio.c | 1 + drivers/usb/serial/ftdi_sio_ids.h | 1 + 2 files changed, 2 insertions(+)
drivers/usb/serial/ftdi_sio.c +1 -0
@@ -824,6 +824,7 @@ static const struct usb_device_id id_tab { USB_DEVICE(FTDI_VID, FTDI_TURTELIZER_PID), .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, { USB_DEVICE(RATOC_VENDOR_ID, RATOC_PRODUCT_ID_USB60F) }, + { USB_DEVICE(RATOC_VENDOR_ID, RATOC_PRODUCT_ID_SCU18) }, { USB_DEVICE(FTDI_VID, FTDI_REU_TINY_PID) },/* Papouch devices based on FTDI chip */
drivers/usb/serial/ftdi_sio_ids.h +1 -0
@@ -615,6 +615,7 @@*/ #define RATOC_VENDOR_ID 0x0584#define RATOC_PRODUCT_ID_USB60F 0xb020 +#define RATOC_PRODUCT_ID_SCU18 0xb03a/* * Infineon Technologies
Greg Kroah-Hartman
maintainerPATCH 65/117 USB: cp210x: add ID for IAI USB to RS485 adaptor
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Dedecker <[email protected]>
commit f487c54ddd544e1c9172cd510954f697b77b76e3 upstream.
Added the USB serial console device ID for IAI Corp. RCB-CV-USB USB to RS485 adaptor.
--- drivers/usb/serial/cp210x.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/serial/cp210x.c +1 -0
@@ -98,6 +98,7 @@ static const struct usb_device_id id_tab { USB_DEVICE(0x10C4, 0x81AC) }, /* MSD Dash Hawk */ { USB_DEVICE(0x10C4, 0x81AD) }, /* INSYS USB Modem */ { USB_DEVICE(0x10C4, 0x81C8) }, /* Lipowsky Industrie Elektronik GmbH, Baby-JTAG */ + { USB_DEVICE(0x10C4, 0x81D7) }, /* IAI Corp. RCB-CV-USB USB to RS485 Adaptor */ { USB_DEVICE(0x10C4, 0x81E2) }, /* Lipowsky Industrie Elektronik GmbH, Baby-LIN */ { USB_DEVICE(0x10C4, 0x81E7) }, /* Aerocomm Radio */ { USB_DEVICE(0x10C4, 0x81E8) }, /* Zephyr Bioharness */
Greg Kroah-Hartman
maintainerPATCH 66/117 USB: serial: option: Adding support for Telit LE922
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniele Palmas <[email protected]>
commit ff4e2494dc17b173468e1713fdf6237fd8578bc7 upstream.
This patch adds support for two PIDs of LE922.
--- drivers/usb/serial/option.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
drivers/usb/serial/option.c +16 -0
@@ -268,6 +268,8 @@ static void option_instat_callback(struc#define TELIT_PRODUCT_CC864_SINGLE 0x1006#define TELIT_PRODUCT_DE910_DUAL 0x1010#define TELIT_PRODUCT_UE910_V2 0x1012 +#define TELIT_PRODUCT_LE922_USBCFG0 0x1042 +#define TELIT_PRODUCT_LE922_USBCFG3 0x1043#define TELIT_PRODUCT_LE920 0x1200#define TELIT_PRODUCT_LE910 0x1201
@@ -615,6 +617,16 @@ static const struct option_blacklist_inf .reserved = BIT(1) | BIT(5), }; +static const struct option_blacklist_info telit_le922_blacklist_usbcfg0 = { + .sendsetup =BIT (2 ), + .reserved =BIT (0 ) |BIT (1 ) |BIT (3 ), +}; + +static const struct option_blacklist_info telit_le922_blacklist_usbcfg3 = { + .sendsetup =BIT (0 ), + .reserved =BIT (1 ) |BIT (2 ) |BIT (3 ), +}; +static const struct usb_device_id option_ids[] = { {USB_DEVICE (OPTION_VENDOR_ID ,OPTION_PRODUCT_COLT ) }, {USB_DEVICE (OPTION_VENDOR_ID ,OPTION_PRODUCT_RICOLA ) },
@@ -1160,6 +1172,10 @@ static const struct usb_device_id option { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_CC864_SINGLE) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_DE910_DUAL) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UE910_V2) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG0), + .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg0 }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG3), + .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910), .driver_info = (kernel_ulong_t)&telit_le910_blacklist }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920),
Greg Kroah-Hartman
maintainerPATCH 67/117 USB: option: fix Cinterion AHxx enumeration
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Ernberg <[email protected]>
commit 4152b387da81617c80cb2946b2d56e3958906b3e upstream.
In certain kernel configurations where the cdc_ether and option drivers are compiled as modules there can occur a race condition in enumeration. This causes the option driver to enumerate the ethernet(wwan) interface as usb-serial interfaces.
usb-devices output for the modem:
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 5 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=1e2d ProdID=0055 Rev=00.00 S: Manufacturer=Cinterion S: Product=AHx C: #Ifs= 6 Cfg#= 1 Atr=e0 MxPwr=10mA I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option I: If#= 4 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether I: If#= 5 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether
--- drivers/usb/serial/option.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/serial/option.c +1 -1
@@ -1695,7 +1695,7 @@ static const struct usb_device_id option { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_EU3_P) }, { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PH8), .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, - { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX) }, + { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX, 0xff) }, { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PLXX), .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) },
Greg Kroah-Hartman
maintainerPATCH 68/117 usb: cdc-acm: handle unlinked urb in acm read callback
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lu Baolu <[email protected]>
commit 19454462acb1bdef80542061bdc9b410e4ed1ff6 upstream.
In current acm driver, the bulk-in callback function ignores the URBs unlinked in usb core.
This causes unexpected data loss in some cases. For example, runtime suspend entry will unlinked all urbs and set urb->status to -ENOENT even those urbs might have data not processed yet. Hence, data loss occurs.
This patch lets bulk-in callback function handle unlinked urbs to avoid data loss.
--- drivers/usb/class/cdc-acm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/usb/class/cdc-acm.c +2 -1
@@ -428,7 +428,8 @@ static void acm_read_bulk_callback(strucset_bit (rb->index, &acm->read_urbs_free);dev_dbg (&acm->data->dev,"%s - non-zero urb status: %d\n" , __func__, status); -return ; +if ((status != -ENOENT ) || (urb->actual_length ==0 )) +return ; }usb_mark_last_busy (acm->dev);
Greg Kroah-Hartman
maintainerPATCH 69/117 usb: cdc-acm: send zero packet for intel 7260 modem
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lu Baolu <[email protected]>
commit ffdb1e369a73b380fce95b05f8498d92c43842b4 upstream.
For Intel 7260 modem, it is needed for host side to send zero packet if the BULK OUT size is equal to USB endpoint max packet length. Otherwise, modem side may still wait for more data and cannot give response to host side.
--- drivers/usb/class/cdc-acm.c | 6 ++++++ drivers/usb/class/cdc-acm.h | 1 + 2 files changed, 7 insertions(+)
drivers/usb/class/cdc-acm.c +6 -0
@@ -1405,6 +1405,8 @@ made_compressed_probe:usb_sndbulkpipe (usb_dev, epwrite->bEndpointAddress), NULL, acm->writesize, acm_write_bulk, snd); snd->urb->transfer_flags |=URB_NO_TRANSFER_DMA_MAP ; +if (quirks &SEND_ZERO_PACKET ) + snd->urb->transfer_flags |=URB_ZERO_PACKET ; snd->instance = acm; }
@@ -1862,6 +1864,10 @@ static const struct usb_device_id acm_id { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM, USB_CDC_ACM_PROTO_AT_CDMA) }, + { USB_DEVICE(0x1519, 0x0452), /* Intel 7260 modem */ + .driver_info = SEND_ZERO_PACKET, + }, + { } };
drivers/usb/class/cdc-acm.h +1 -0
@@ -134,3 +134,4 @@ struct acm {#define IGNORE_DEVICE BIT(5)#define QUIRK_CONTROL_LINE_STATE BIT(6)#define CLEAR_HALT_CONDITIONS BIT(7) +#define SEND_ZERO_PACKET BIT(8)
Greg Kroah-Hartman
maintainerPATCH 70/117 usb: phy: msm: fix error handling in probe.
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Kandagatla <[email protected]>
commit a38a08dfaaab978dced63aa9cad45f0f62e23a66 upstream.
This driver registers for extcon events as part of its probe, but never unregisters them in case of error in the probe path.
There were multiple issues noticed due to this missing error handling. One of them is random crashes if the regulators are not ready yet by the time probe is invoked.
Ivan's previous attempt [1] to fix this issue, did not really address all the failure cases like regualtor/get_irq failures.
[1] https://lkml.org/lkml/2015/9/7/62
Without this patch the kernel would carsh with log:
...
Unable to handle kernel paging request at virtual address 17d78410 pgd = ffffffc001a5c000 [17d78410] *pgd=00000000b6806003, *pud=00000000b6806003, *pmd=0000000000000000 Internal error: Oops: 96000005 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 6 Comm: kworker/u8:0 Not tainted 4.4.0+ #48 Hardware name: Qualcomm Technologies, Inc. APQ 8016 SBC (DT) Workqueue: deferwq deferred_probe_work_func task: ffffffc03686e900 ti: ffffffc0368b0000 task.ti: ffffffc0368b0000 PC is at raw_notifier_chain_register+0x1c/0x44 LR is at extcon_register_notifier+0x88/0xc8 pc : [<ffffffc0000da43c>] lr : [<ffffffc000606298>] pstate: 80000085
sp : ffffffc0368b3a70
x29: ffffffc0368b3a70 x28: ffffffc03680c310
x27: ffffffc035518000 x26: ffffffc035518000
x25: ffffffc03bfa20e0 x24: ffffffc035580a18
x23: 0000000000000000 x22: ffffffc035518458
x21: ffffffc0355e9a60 x20: ffffffc035518000
x19: 0000000000000000 x18: 0000000000000028
x17: 0000000000000003 x16: ffffffc0018153c8
x15: 0000000000000001 x14: ffffffc03686f0f8
x13: ffffffc03686f0f8 x12: 0000000000000003
x11: 0000000000000001 x10: 0000000000000001
x9 : ffffffc03686f0f8 x8 : 0000e3872014c1a1
x7 : 0000000000000028 x6 : 0000000000000000
x5 : 0000000000000001 x4 : 0000000000000000
x3 : 00000000354fb170 x2 : 0000000017d78400
x1 : ffffffc0355e9a60 x0 : ffffffc0354fb268
--- drivers/usb/phy/phy-msm-usb.c | 37 ++++++++++++++++++++++++------------- 1 file changed, 24 insertions(+), 13 deletions(-)
drivers/usb/phy/phy-msm-usb.c +24 -13
@@ -1599,6 +1599,8 @@ static int msm_otg_read_dt(struct platfo &motg->id.nb);if (ret <0 ) {dev_err (&pdev->dev,"register ID notifier failed\n" ); +extcon_unregister_notifier (motg->vbus.extcon, +EXTCON_USB , &motg->vbus.nb);return ret; }
@@ -1660,15 +1662,6 @@ static int msm_otg_probe(struct platformif (!motg)return -ENOMEM ; - pdata =dev_get_platdata (&pdev->dev); -if (!pdata) { -if (!np) -return -ENXIO ; - ret =msm_otg_read_dt (pdev, motg); -if (ret) -return ret; - } - motg->phy.otg =devm_kzalloc (&pdev->dev,sizeof (struct usb_otg ),GFP_KERNEL );if (!motg->phy.otg)
@@ -1710,6 +1703,15 @@ static int msm_otg_probe(struct platformif (!motg->regs)return -ENOMEM ; + pdata =dev_get_platdata (&pdev->dev); +if (!pdata) { +if (!np) +return -ENXIO ; + ret =msm_otg_read_dt (pdev, motg); +if (ret) +return ret; + } +/* * NOTE: The PHYs can be multiplexed between the chipidea controller * and the dwc3 controller, using a single bit. It is important that
@@ -1717,8 +1719,10 @@ static int msm_otg_probe(struct platform*/ if (motg->phy_number) { phy_select =devm_ioremap_nocache (&pdev->dev,USB2_PHY_SEL ,4 ); -if (!phy_select) -return -ENOMEM ; +if (!phy_select) { + ret = -ENOMEM ; + goto unregister_extcon; + }/* Enable second PHY with the OTG port */ writel (0x1 , phy_select); }
@@ -1728,7 +1732,8 @@ static int msm_otg_probe(struct platform motg->irq =platform_get_irq (pdev,0 );if (motg->irq <0 ) {dev_err (&pdev->dev,"platform_get_irq failed\n" ); -return motg->irq; + ret = motg->irq; + goto unregister_extcon; } regs[0 ].supply ="vddcx" ;
@@ -1737,7 +1742,7 @@ static int msm_otg_probe(struct platform ret =devm_regulator_bulk_get (motg->phy.dev,ARRAY_SIZE (regs), regs);if (ret) -return ret; + goto unregister_extcon; motg->vddcx = regs[0 ].consumer; motg->v3p3 = regs[1 ].consumer;
@@ -1834,6 +1839,12 @@ disable_clks:clk_disable_unprepare (motg->clk);if (!IS_ERR (motg->core_clk))clk_disable_unprepare (motg->core_clk); +unregister_extcon: +extcon_unregister_notifier (motg->id.extcon, +EXTCON_USB_HOST , &motg->id.nb); +extcon_unregister_notifier (motg->vbus.extcon, +EXTCON_USB , &motg->vbus.nb); +return ret; }
Greg Kroah-Hartman
maintainerPATCH 71/117 usb: xhci: handle both SSIC ports in PME stuck quirk
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lu Baolu <[email protected]>
commit fa89537783cb442263fa5a14df6c7693eaf32f11 upstream.
Commit abce329c27b3 ("xhci: Workaround to get D3 working in Intel xHCI") adds a workaround for a limitation of PME storm caused by SSIC port in some Intel SoCs. This commit only handled one SSIC port, while there are actually two SSIC ports in the chips. This patch handles both SSIC ports. Without this fix, users still see PME storm.
--- drivers/usb/host/xhci-pci.c | 48 ++++++++++++++++++++++++++------------------ 1 file changed, 29 insertions(+), 19 deletions(-)
drivers/usb/host/xhci-pci.c +29 -19
@@ -28,7 +28,9 @@#include "xhci.h" #include "xhci-trace.h" -#define PORT2_SSIC_CONFIG_REG2 0x883c +#define SSIC_PORT_NUM 2 +#define SSIC_PORT_CFG2 0x880c +#define SSIC_PORT_CFG2_OFFSET 0x30#define PROG_DONE (1 << 30)#define SSIC_PORT_UNUSED (1 << 31)
@@ -322,28 +324,36 @@ static void xhci_pme_quirk(struct usb_hcstruct pci_dev *pdev =to_pci_dev (hcd->self.controller);u32 val;void __iomem *reg; +int i;if (pdev->vendor ==PCI_VENDOR_ID_INTEL && pdev->device ==PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI ) { - reg = (void __iomem *) xhci->cap_regs +PORT2_SSIC_CONFIG_REG2 ; - -/* Notify SSIC that SSIC profile programming is not done */ - val =readl (reg) & ~PROG_DONE ; -writel (val, reg); - -/* Mark SSIC port as unused(suspend) or used(resume) */ - val =readl (reg); -if (suspend) - val |=SSIC_PORT_UNUSED ; -else - val &= ~SSIC_PORT_UNUSED ; -writel (val, reg); - -/* Notify SSIC that SSIC profile programming is done */ - val =readl (reg) |PROG_DONE ; -writel (val, reg); -readl (reg); +for (i =0 ; i <SSIC_PORT_NUM ; i++) { + reg = (void __iomem *) xhci->cap_regs + +SSIC_PORT_CFG2 + + i *SSIC_PORT_CFG2_OFFSET ; + +/* +* Notify SSIC that SSIC profile programming +* is not done. +*/ + val =readl (reg) & ~PROG_DONE ; +writel (val, reg); + +/* Mark SSIC port as unused(suspend) or used(resume) */ + val =readl (reg); +if (suspend) + val |=SSIC_PORT_UNUSED ; +else + val &= ~SSIC_PORT_UNUSED ; +writel (val, reg); + +/* Notify SSIC that SSIC profile programming is done */ + val =readl (reg) |PROG_DONE ; +writel (val, reg); +readl (reg); + } } reg = (void __iomem *) xhci->cap_regs +0x80a4 ;
Greg Kroah-Hartman
maintainerPATCH 72/117 usb: xhci: apply XHCI_PME_STUCK_QUIRK to Intel Broxton-M platforms
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lu Baolu <[email protected]>
commit ccc04afb72cddbdf7c0e1c17e92886405a71b754 upstream.
Intel Broxton M was verifed to require XHCI_PME_STUCK_QUIRK quirk as well.
--- drivers/usb/host/xhci-pci.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/host/xhci-pci.c +3 -1
@@ -47,6 +47,7 @@#define PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI 0x22b5#define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_XHCI 0xa12f#define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI 0x9d2f +#define PCI_DEVICE_ID_INTEL_BROXTON_M_XHCI 0x0aa8static const char hcd_name[] ="xhci_hcd" ;
@@ -154,7 +155,8 @@ static void xhci_pci_quirks(struct devicif (pdev->vendor ==PCI_VENDOR_ID_INTEL && (pdev->device ==PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI || pdev->device ==PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_XHCI || - pdev->device ==PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI )) { + pdev->device ==PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI || + pdev->device ==PCI_DEVICE_ID_INTEL_BROXTON_M_XHCI )) { xhci->quirks |=XHCI_PME_STUCK_QUIRK ; } if (pdev->vendor == PCI_VENDOR_ID_ETRON &&
Greg Kroah-Hartman
maintainerPATCH 73/117 n_tty: Fix unsafe reference to "other" ldisc
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Hurley <[email protected]>
commit 6d27a63caad3f13e96cf065d2d96828c2006be6b upstream.
Although n_tty_check_unthrottle() has a valid ldisc reference (since the tty core gets the ldisc ref in tty_read() before calling the line discipline read() method), it does not have a valid ldisc reference to the "other" pty of a pty pair. Since getting an ldisc reference for tty->link essentially open-codes tty_wakeup(), just replace with the equivalent tty_wakeup().
--- drivers/tty/n_tty.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-)
drivers/tty/n_tty.c +2 -5
@@ -258,16 +258,13 @@ static void n_tty_check_throttle(structstatic void n_tty_check_unthrottle (struct tty_struct *tty) { -if (tty->driver->type ==TTY_DRIVER_TYPE_PTY && - tty->link->ldisc->ops->write_wakeup == n_tty_write_wakeup) { +if (tty->driver->type ==TTY_DRIVER_TYPE_PTY ) {if (chars_in_buffer (tty) >TTY_THRESHOLD_UNTHROTTLE )return ;if (!tty->count)return ;n_tty_kick_worker (tty); -n_tty_write_wakeup (tty->link); -if (waitqueue_active (&tty->link->write_wait)) -wake_up_interruptible_poll (&tty->link->write_wait,POLLOUT ); +tty_wakeup (tty->link);return ; }
Greg Kroah-Hartman
maintainerPATCH 74/117 tty: Wait interruptibly for tty lock on reopen
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Hurley <[email protected]>
commit 0bfd464d3fdd5bb322f9cace4cc47f1796545cf7 upstream.
Allow a signal to interrupt the wait for a tty reopen; eg., if the tty has starting final close and is waiting for the device to drain.
--- drivers/tty/tty_io.c | 8 +++++++- drivers/tty/tty_mutex.c | 8 ++++++++ include/linux/tty.h | 1 + 3 files changed, 16 insertions(+), 1 deletion(-)
drivers/tty/tty_io.c +7 -1
@@ -2069,7 +2069,12 @@ retry_open:if (tty) {mutex_unlock (&tty_mutex); -tty_lock (tty); + retval =tty_lock_interruptible (tty); +if (retval) { +if (retval == -EINTR ) + retval = -ERESTARTSYS ; + goto err_unref; + }/* safe to drop the kref from tty_driver_lookup_tty() */ tty_kref_put (tty); retval =tty_reopen (tty);
@@ -2156,6 +2161,7 @@ retry_open:return 0 ; err_unlock:mutex_unlock (&tty_mutex); +err_unref:/* after locks to avoid deadlock */ if (!IS_ERR_OR_NULL (driver))tty_driver_kref_put (driver);
drivers/tty/tty_mutex.c +8 -0
@@ -22,6 +22,14 @@ void __lockfunc tty_lock(struct tty_stru }EXPORT_SYMBOL (tty_lock); +int tty_lock_interruptible (struct tty_struct *tty) +{ +if (WARN (tty->magic !=TTY_MAGIC ,"L Bad %p\n" , tty)) +return -EIO ; +tty_kref_get (tty); +return mutex_lock_interruptible (&tty->legacy_mutex); +} + void __lockfunc tty_unlock(struct tty_struct *tty) {if (tty->magic !=TTY_MAGIC ) {
include/linux/tty.h +1 -0
@@ -654,6 +654,7 @@ extern long vt_compat_ioctl(struct tty_s/* tty_mutex.c */ /* functions for preparation of BKL removal */ extern void __lockfunc tty_lock(struct tty_struct *tty); +extern int tty_lock_interruptible (struct tty_struct *tty); extern void __lockfunc tty_unlock(struct tty_struct *tty); extern void __lockfunc tty_lock_slave(struct tty_struct *tty); extern void __lockfunc tty_unlock_slave(struct tty_struct *tty);
Greg Kroah-Hartman
maintainerPATCH 75/117 tty: Retry failed reopen if tty teardown in-progress
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Hurley <[email protected]>
commit 7f22f6c935cda600660e623a411fe380015d28d9 upstream.
A small window exists where a tty reopen will observe the tty just prior to imminent teardown (tty->count == 0); in this case, open() returns EIO to userspace.
Instead, retry the open after checking for signals and yielding; this interruptible retry loop allows teardown to commence and initialize a new tty on retry. Never retry the BSD master pty reopen; there is no guarantee the pty pair teardown is imminent since the slave file descriptors may remain open indefinitely.
--- drivers/tty/tty_io.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
drivers/tty/tty_io.c +8 -4
@@ -1462,13 +1462,13 @@ static int tty_reopen(struct tty_struct {struct tty_driver *driver = tty->driver; -if (!tty->count) -return -EIO ; -if (driver->type ==TTY_DRIVER_TYPE_PTY && driver->subtype ==PTY_TYPE_MASTER )return -EIO ; +if (!tty->count) +return -EAGAIN ; +if (test_bit (TTY_EXCLUSIVE , &tty->flags) && !capable (CAP_SYS_ADMIN ))return -EBUSY ;
@@ -2092,7 +2092,11 @@ retry_open:if (IS_ERR (tty)) { retval =PTR_ERR (tty); - goto err_file; +if (retval != -EAGAIN ||signal_pending (current)) + goto err_file; +tty_free_file (filp); +schedule (); + goto retry_open; }tty_add_file (tty, filp);
Greg Kroah-Hartman
maintainerPATCH 76/117 tty: Fix unsafe ldisc reference via ioctl(TIOCGETD)
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Hurley <[email protected]>
commit 5c17c861a357e9458001f021a7afa7aab9937439 upstream.
ioctl(TIOCGETD) retrieves the line discipline id directly from the ldisc because the line discipline id (c_line) in termios is untrustworthy; userspace may have set termios via ioctl(TCSETS*) without actually changing the line discipline via ioctl(TIOCSETD).
However, directly accessing the current ldisc via tty->ldisc is unsafe; the ldisc ptr dereferenced may be stale if the line discipline is changing via ioctl(TIOCSETD) or hangup.
Wait for the line discipline reference (just like read() or write()) to retrieve the "current" line discipline id.
--- drivers/tty/tty_io.c | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-)
drivers/tty/tty_io.c +23 -1
@@ -2663,6 +2663,28 @@ static int tiocsetd(struct tty_struct *t }/** +* tiocgetd - get line discipline +* @tty: tty device +* @p: pointer to user data +* +* Retrieves the line discipline id directly from the ldisc. +* +* Locking: waits for ldisc reference (in case the line discipline +* is changing or the tty is being hungup) +*/ + +static int tiocgetd (struct tty_struct *tty,int __user *p) +{ +struct tty_ldisc *ld; +int ret; + + ld =tty_ldisc_ref_wait (tty); + ret =put_user (ld->ops->num, p); +tty_ldisc_deref (ld); +return ret; +} + +/** * send_break - performed time break * @tty: device to break on * @duration: timeout in mS
@@ -2888,7 +2910,7 @@ long tty_ioctl(struct file *file, unsigncase TIOCGSID :return tiocgsid (tty, real_tty, p);case TIOCGETD : -return put_user (tty->ldisc->ops->num, (int __user *)p); +return tiocgetd (tty, p);case TIOCSETD :return tiocsetd (tty, p);case TIOCVHANGUP :
Greg Kroah-Hartman
maintainerPATCH 77/117 iommu/io-pgtable-arm: Ensure we free the final level on teardown
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Will Deacon <[email protected]>
commit 12c2ab09571e8aae3a87da2a4a452632a5fac1e5 upstream.
When tearing down page tables, we return early for the final level since we know that we won't have any table pointers to follow. Unfortunately, this also means that we forget to free the final level, so we end up leaking memory.
Fix the issue by always freeing the current level, but just don't bother to iterate over the ptes if we're at the final level.
--- drivers/iommu/io-pgtable-arm.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
drivers/iommu/io-pgtable-arm.c +6 -5
@@ -405,17 +405,18 @@ static void __arm_lpae_free_pgtable(struarm_lpae_iopte *start, *end;unsigned long table_size; -/* Only leaf entries at the last level */ -if (lvl ==ARM_LPAE_MAX_LEVELS -1 ) -return ; -if (lvl ==ARM_LPAE_START_LVL (data)) table_size = data->pgd_size;else table_size =1UL << data->pg_shift; start = ptep; - end = (void *)ptep + table_size; + +/* Only leaf entries at the last level */ +if (lvl ==ARM_LPAE_MAX_LEVELS -1 ) + end = ptep; +else + end = (void *)ptep + table_size;while (ptep != end) {arm_lpae_iopte pte = *ptep++;
Greg Kroah-Hartman
maintainerPATCH 78/117 ext4 crypto: add missing locking for keyring_key access
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Theodore Ts'o <[email protected]>
commit db7730e3091a52c2fcd8fcc952b964d88998e675 upstream.
--- fs/ext4/crypto_key.c | 4 ++++ 1 file changed, 4 insertions(+)
fs/ext4/crypto_key.c +4 -0
@@ -213,9 +213,11 @@ retry: res = -ENOKEY ; goto out; } +down_read (&keyring_key->sem); ukp =user_key_payload (keyring_key);if (ukp->datalen !=sizeof (struct ext4_encryption_key )) { res = -EINVAL ; +up_read (&keyring_key->sem); goto out; } master_key = (struct ext4_encryption_key *)ukp->data;
@@ -226,10 +228,12 @@ retry:"ext4: key size incorrect: %d\n" , master_key->size); res = -ENOKEY ; +up_read (&keyring_key->sem); goto out; } res =ext4_derive_key_aes (ctx.nonce, master_key->raw, raw_key); +up_read (&keyring_key->sem);if (res) goto out; got_key:
Greg Kroah-Hartman
maintainerPATCH 79/117 sched: Fix crash in sched_init_numa()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Raghavendra K T <[email protected]>
commit 9c03ee147193645be4c186d3688232fa438c57c7 upstream.
The following PowerPC commit:
c118baf80256 ("arch/powerpc/mm/numa.c: do not allocate bootmem memory for non existing nodes")
avoids allocating bootmem memory for non existent nodes.
But when DEBUG_PER_CPU_MAPS=y is enabled, my powerNV system failed to boot because in sched_init_numa(), cpumask_or() operation was done on unallocated nodes.
Fix that by making cpumask_or() operation only on existing nodes.
[ Tested with and w/o DEBUG_PER_CPU_MAPS=y on x86 and PowerPC. ]
--- kernel/sched/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/sched/core.c +1 -1
@@ -6738,7 +6738,7 @@ static void sched_init_numa(void) sched_domains_numa_masks[i][j] = mask; -for (k =0 ; k < nr_node_ids; k++) { +for_each_node (k) {if (node_distance (j, k) > sched_domains_numa_distance[i])continue ;
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to [email protected]. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"[email protected]"> [email protected] </a>
Greg Kroah-Hartman
maintainerPATCH 80/117 crypto: algif_skcipher - Require setkey before accept(2)
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
commit dd504589577d8e8e70f51f997ad487a4cb6c026f upstream.
Some cipher implementations will crash if you try to use them without calling setkey first. This patch adds a check so that the accept(2) call will fail with -ENOKEY if setkey hasn't been done on the socket yet.
--- crypto/algif_skcipher.c | 48 +++++++++++++++++++++++++++++++++++++++++------- 1 file changed, 41 insertions(+), 7 deletions(-)
crypto/algif_skcipher.c +41 -7
@@ -31,6 +31,11 @@ struct skcipher_sg_list {struct scatterlist sg[0 ]; }; +struct skcipher_tfm { +struct crypto_skcipher *skcipher; +bool has_key; +}; +struct skcipher_ctx {struct list_head tsgl;struct af_alg_sgl rsgl;
@@ -750,17 +755,41 @@ static struct proto_ops algif_skcipher_ostatic void *skcipher_bind (const char *name,u32 type,u32 mask) { -return crypto_alloc_skcipher (name, type, mask); +struct skcipher_tfm *tfm; +struct crypto_skcipher *skcipher; + + tfm =kzalloc (sizeof (*tfm),GFP_KERNEL ); +if (!tfm) +return ERR_PTR (-ENOMEM ); + + skcipher =crypto_alloc_skcipher (name, type, mask); +if (IS_ERR (skcipher)) { +kfree (tfm); +return ERR_CAST (skcipher); + } + + tfm->skcipher = skcipher; + +return tfm; }static void skcipher_release (void *private) { -crypto_free_skcipher (private); +struct skcipher_tfm *tfm = private; + +crypto_free_skcipher (tfm->skcipher); +kfree (tfm); }static int skcipher_setkey (void *private,const u8 *key,unsigned int keylen) { -return crypto_skcipher_setkey (private, key, keylen); +struct skcipher_tfm *tfm = private; +int err; + + err =crypto_skcipher_setkey (tfm->skcipher, key, keylen); + tfm->has_key = !err; + +return err; }static void skcipher_wait (struct sock *sk)
@@ -792,20 +821,25 @@ static int skcipher_accept_parent(void * {struct skcipher_ctx *ctx;struct alg_sock *ask =alg_sk (sk); -unsigned int len =sizeof (*ctx) +crypto_skcipher_reqsize (private); +struct skcipher_tfm *tfm = private; +struct crypto_skcipher *skcipher = tfm->skcipher; +unsigned int len =sizeof (*ctx) +crypto_skcipher_reqsize (skcipher); + +if (!tfm->has_key) +return -ENOKEY ; ctx =sock_kmalloc (sk, len,GFP_KERNEL );if (!ctx)return -ENOMEM ; - ctx->iv =sock_kmalloc (sk,crypto_skcipher_ivsize (private), + ctx->iv =sock_kmalloc (sk,crypto_skcipher_ivsize (skcipher),GFP_KERNEL );if (!ctx->iv) {sock_kfree_s (sk, ctx, len);return -ENOMEM ; } -memset (ctx->iv,0 ,crypto_skcipher_ivsize (private)); +memset (ctx->iv,0 ,crypto_skcipher_ivsize (skcipher));INIT_LIST_HEAD (&ctx->tsgl); ctx->len = len;
@@ -818,7 +852,7 @@ static int skcipher_accept_parent(void * ask->private = ctx; -skcipher_request_set_tfm (&ctx->req, private); +skcipher_request_set_tfm (&ctx->req, skcipher);skcipher_request_set_callback (&ctx->req,CRYPTO_TFM_REQ_MAY_BACKLOG , af_alg_complete, &ctx->completion);
Greg Kroah-Hartman
maintainerPATCH 81/117 crypto: af_alg - Disallow bind/setkey/... after accept(2)
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
commit c840ac6af3f8713a71b4d2363419145760bd6044 upstream.
Each af_alg parent socket obtained by socket(2) corresponds to a tfm object once bind(2) has succeeded. An accept(2) call on that parent socket creates a context which then uses the tfm object.
Therefore as long as any child sockets created by accept(2) exist the parent socket must not be modified or freed.
This patch guarantees this by using locks and a reference count on the parent socket. Any attempt to modify the parent socket will fail with EBUSY.
--- crypto/af_alg.c | 35 ++++++++++++++++++++++++++++++++--- include/crypto/if_alg.h | 8 +++----- 2 files changed, 35 insertions(+), 8 deletions(-)
crypto/af_alg.c +32 -3
@@ -125,6 +125,23 @@ int af_alg_release(struct socket *sock) }EXPORT_SYMBOL_GPL (af_alg_release); +void af_alg_release_parent (struct sock *sk) +{ +struct alg_sock *ask =alg_sk (sk); +bool last; + + sk = ask->parent; + ask =alg_sk (sk); + +lock_sock (sk); + last = !--ask->refcnt; +release_sock (sk); + +if (last) +sock_put (sk); +} +EXPORT_SYMBOL_GPL (af_alg_release_parent); +static int alg_bind (struct socket *sock,struct sockaddr *uaddr,int addr_len) {const u32 forbidden =CRYPTO_ALG_INTERNAL ;
@@ -133,6 +150,7 @@ static int alg_bind(struct socket *sock,struct sockaddr_alg *sa = (void *)uaddr;const struct af_alg_type *type;void *private; +int err;if (sock->state ==SS_CONNECTED )return -EINVAL ;
@@ -160,16 +178,22 @@ static int alg_bind(struct socket *sock,return PTR_ERR (private); } + err = -EBUSY ;lock_sock (sk); +if (ask->refcnt) + goto unlock;swap (ask->type, type);swap (ask->private, private); + err =0 ; + +unlock:release_sock (sk);alg_do_release (type, private); -return 0 ; +return err; } static int alg_setkey(struct sock *sk, char __user *ukey,
@@ -202,11 +226,15 @@ static int alg_setsockopt(struct socketstruct sock *sk = sock->sk;struct alg_sock *ask =alg_sk (sk);const struct af_alg_type *type; -int err = -ENOPROTOOPT ; +int err = -EBUSY ;lock_sock (sk); +if (ask->refcnt) + goto unlock; + type = ask->type; + err = -ENOPROTOOPT ;if (level !=SOL_ALG || !type) goto unlock;
@@ -264,7 +292,8 @@ int af_alg_accept(struct sock *sk, struc sk2->sk_family =PF_ALG ; -sock_hold (sk); +if (!ask->refcnt++) +sock_hold (sk);alg_sk (sk2)->parent = sk;alg_sk (sk2)->type = type;
include/crypto/if_alg.h +3 -5
@@ -30,6 +30,8 @@ struct alg_sock {struct sock *parent; +unsigned int refcnt; +const struct af_alg_type *type;void *private; };
@@ -67,6 +69,7 @@ int af_alg_register_type(const struct afint af_alg_unregister_type (const struct af_alg_type *type);int af_alg_release (struct socket *sock); +void af_alg_release_parent (struct sock *sk);int af_alg_accept (struct sock *sk,struct socket *newsock);int af_alg_make_sg (struct af_alg_sgl *sgl,struct iov_iter *iter,int len);
@@ -83,11 +86,6 @@ static inline struct alg_sock *alg_sk(streturn (struct alg_sock *)sk; } -static inline void af_alg_release_parent (struct sock *sk) -{ -sock_put (alg_sk (sk)->parent); -} -static inline void af_alg_init_completion (struct af_alg_completion *completion) {init_completion (&completion->completion);
Greg Kroah-Hartman
maintainerPATCH 82/117 crypto: af_alg - Fix socket double-free when accept fails
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
commit a383292c86663bbc31ac62cc0c04fc77504636a6 upstream.
When we fail an accept(2) call we will end up freeing the socket twice, once due to the direct sk_free call and once again through newsock.
This patch fixes this by removing the sk_free call.
--- crypto/af_alg.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
crypto/af_alg.c +1 -3
@@ -285,10 +285,8 @@ int af_alg_accept(struct sock *sk, strucsecurity_sk_clone (sk, sk2); err = type->accept (ask->private, sk2); -if (err) { -sk_free (sk2); +if (err) goto unlock; - } sk2->sk_family =PF_ALG ;
Greg Kroah-Hartman
maintainerPATCH 83/117 crypto: af_alg - Add nokey compatibility path
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
commit 37766586c965d63758ad542325a96d5384f4a8c9 upstream.
This patch adds a compatibility path to support old applications that do acept(2) before setkey.
--- crypto/af_alg.c | 13 ++++++++++++- include/crypto/if_alg.h | 2 ++ 2 files changed, 14 insertions(+), 1 deletion(-)
crypto/af_alg.c +12 -1
@@ -76,6 +76,8 @@ int af_alg_register_type(const struct af goto unlock; type->ops->owner =THIS_MODULE ; +if (type->ops_nokey) + type->ops_nokey->owner =THIS_MODULE ; node->type = type;list_add (&node->list, &alg_types); err =0 ;
@@ -267,6 +269,7 @@ int af_alg_accept(struct sock *sk, strucconst struct af_alg_type *type;struct sock *sk2;int err; +bool nokey;lock_sock (sk); type = ask->type;
@@ -285,12 +288,17 @@ int af_alg_accept(struct sock *sk, strucsecurity_sk_clone (sk, sk2); err = type->accept (ask->private, sk2); + + nokey = err == -ENOKEY ; +if (nokey && type->accept_nokey) + err = type->accept_nokey (ask->private, sk2); +if (err) goto unlock; sk2->sk_family =PF_ALG ; -if (!ask->refcnt++) +if (nokey || !ask->refcnt++)sock_hold (sk);alg_sk (sk2)->parent = sk;alg_sk (sk2)->type = type;
@@ -298,6 +306,9 @@ int af_alg_accept(struct sock *sk, struc newsock->ops = type->ops; newsock->state =SS_CONNECTED ; +if (nokey) + newsock->ops = type->ops_nokey; + err =0 ; unlock:
include/crypto/if_alg.h +2 -0
@@ -52,9 +52,11 @@ struct af_alg_type {void (*release)(void *private);int (*setkey)(void *private,const u8 *key,unsigned int keylen);int (*accept)(void *private,struct sock *sk); +int (*accept_nokey)(void *private,struct sock *sk);int (*setauthsize)(void *private,unsigned int authsize);struct proto_ops *ops; +struct proto_ops *ops_nokey;struct module *owner;char name[14 ]; };
Greg Kroah-Hartman
maintainerPATCH 84/117 crypto: algif_skcipher - Add nokey compatibility path
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
commit a0fa2d037129a9849918a92d91b79ed6c7bd2818 upstream.
This patch adds a compatibility path to support old applications that do acept(2) before setkey.
--- crypto/algif_skcipher.c | 149 ++++++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 144 insertions(+), 5 deletions(-)
crypto/algif_skcipher.c +144 -5
@@ -753,6 +753,99 @@ static struct proto_ops algif_skcipher_o .poll = skcipher_poll, }; +static int skcipher_check_key (struct socket *sock) +{ +int err; +struct sock *psk; +struct alg_sock *pask; +struct skcipher_tfm *tfm; +struct sock *sk = sock->sk; +struct alg_sock *ask =alg_sk (sk); + +if (ask->refcnt) +return 0 ; + + psk = ask->parent; + pask =alg_sk (ask->parent); + tfm = pask->private; + + err = -ENOKEY ; +lock_sock (psk); +if (!tfm->has_key) + goto unlock; + +if (!pask->refcnt++) +sock_hold (psk); + + ask->refcnt =1 ; +sock_put (psk); + + err =0 ; + +unlock: +release_sock (psk); + +return err; +} + +static int skcipher_sendmsg_nokey (struct socket *sock,struct msghdr *msg, +size_t size) +{ +int err; + + err =skcipher_check_key (sock); +if (err) +return err; + +return skcipher_sendmsg (sock, msg, size); +} + +static ssize_t skcipher_sendpage_nokey (struct socket *sock,struct page *page, +int offset,size_t size,int flags) +{ +int err; + + err =skcipher_check_key (sock); +if (err) +return err; + +return skcipher_sendpage (sock, page, offset, size, flags); +} + +static int skcipher_recvmsg_nokey (struct socket *sock,struct msghdr *msg, +size_t ignored,int flags) +{ +int err; + + err =skcipher_check_key (sock); +if (err) +return err; + +return skcipher_recvmsg (sock, msg, ignored, flags); +} + +static struct proto_ops algif_skcipher_ops_nokey = { + .family =PF_ALG , + + .connect = sock_no_connect, + .socketpair = sock_no_socketpair, + .getname = sock_no_getname, + .ioctl = sock_no_ioctl, + .listen = sock_no_listen, + .shutdown = sock_no_shutdown, + .getsockopt = sock_no_getsockopt, + .mmap = sock_no_mmap, + .bind = sock_no_bind, + .accept = sock_no_accept, + .setsockopt = sock_no_setsockopt, + + .release = af_alg_release, + .sendmsg = skcipher_sendmsg_nokey, + .sendpage = skcipher_sendpage_nokey, + .recvmsg = skcipher_recvmsg_nokey, + .poll = skcipher_poll, +}; +static void *skcipher_bind (const char *name,u32 type,u32 mask) {struct skcipher_tfm *tfm;
@@ -802,7 +895,7 @@ static void skcipher_wait(struct sock *smsleep (100 ); } -static void skcipher_sock_destruct (struct sock *sk) +static void skcipher_sock_destruct_common (struct sock *sk) {struct alg_sock *ask =alg_sk (sk);struct skcipher_ctx *ctx = ask->private;
@@ -814,10 +907,33 @@ static void skcipher_sock_destruct(strucskcipher_free_sgl (sk);sock_kzfree_s (sk, ctx->iv,crypto_skcipher_ivsize (tfm));sock_kfree_s (sk, ctx, ctx->len); +} + +static void skcipher_sock_destruct (struct sock *sk) +{ +skcipher_sock_destruct_common (sk);af_alg_release_parent (sk); } -static int skcipher_accept_parent (void *private,struct sock *sk) +static void skcipher_release_parent_nokey (struct sock *sk) +{ +struct alg_sock *ask =alg_sk (sk); + +if (!ask->refcnt) { +sock_put (ask->parent); +return ; + } + +af_alg_release_parent (sk); +} + +static void skcipher_sock_destruct_nokey (struct sock *sk) +{ +skcipher_sock_destruct_common (sk); +skcipher_release_parent_nokey (sk); +} + +static int skcipher_accept_parent_common (void *private,struct sock *sk) {struct skcipher_ctx *ctx;struct alg_sock *ask =alg_sk (sk);
@@ -825,9 +941,6 @@ static int skcipher_accept_parent(void *struct crypto_skcipher *skcipher = tfm->skcipher;unsigned int len =sizeof (*ctx) +crypto_skcipher_reqsize (skcipher); -if (!tfm->has_key) -return -ENOKEY ; - ctx =sock_kmalloc (sk, len,GFP_KERNEL );if (!ctx)return -ENOMEM ;
@@ -861,12 +974,38 @@ static int skcipher_accept_parent(void *return 0 ; } +static int skcipher_accept_parent (void *private,struct sock *sk) +{ +struct skcipher_tfm *tfm = private; + +if (!tfm->has_key) +return -ENOKEY ; + +return skcipher_accept_parent_common (private, sk); +} + +static int skcipher_accept_parent_nokey (void *private,struct sock *sk) +{ +int err; + + err =skcipher_accept_parent_common (private, sk); +if (err) + goto out; + + sk->sk_destruct = skcipher_sock_destruct_nokey; + +out: +return err; +} +static const struct af_alg_type algif_type_skcipher = { .bind = skcipher_bind, .release = skcipher_release, .setkey = skcipher_setkey, .accept = skcipher_accept_parent, + .accept_nokey = skcipher_accept_parent_nokey, .ops = &algif_skcipher_ops, + .ops_nokey = &algif_skcipher_ops_nokey, .name ="skcipher" , .owner =THIS_MODULE };
Greg Kroah-Hartman
maintainerPATCH 85/117 crypto: hash - Add crypto_ahash_has_setkey
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
commit a5596d6332787fd383b3b5427b41f94254430827 upstream.
This patch adds a way for ahash users to determine whether a key is required by a crypto_ahash transform.
--- crypto/ahash.c | 5 ++++- crypto/shash.c | 4 +++- include/crypto/hash.h | 6 ++++++ 3 files changed, 13 insertions(+), 2 deletions(-)
crypto/ahash.c +4 -1
@@ -451,6 +451,7 @@ static int crypto_ahash_init_tfm(structstruct ahash_alg *alg =crypto_ahash_alg (hash); hash->setkey = ahash_nosetkey; + hash->has_setkey = false; hash->export = ahash_no_export; hash->import = ahash_no_import;
@@ -463,8 +464,10 @@ static int crypto_ahash_init_tfm(struct hash->finup = alg->finup ?: ahash_def_finup; hash->digest = alg->digest; -if (alg->setkey) +if (alg->setkey) { hash->setkey = alg->setkey; + hash->has_setkey = true; + }if (alg->export) hash->export = alg->export;if (alg->import)
crypto/shash.c +3 -1
@@ -355,8 +355,10 @@ int crypto_init_shash_ops_async(struct c crt->finup = shash_async_finup; crt->digest = shash_async_digest; -if (alg->setkey) +if (alg->setkey) { crt->setkey = shash_async_setkey; + crt->has_setkey = true; + }if (alg->export) crt->export = shash_async_export;if (alg->import)
include/crypto/hash.h +6 -0
@@ -204,6 +204,7 @@ struct crypto_ahash { unsigned int keylen);unsigned int reqsize; +bool has_setkey;struct crypto_tfm base; };
@@ -375,6 +376,11 @@ static inline void *ahash_request_ctx(stint crypto_ahash_setkey (struct crypto_ahash *tfm,const u8 *key,unsigned int keylen); +static inline bool crypto_ahash_has_setkey (struct crypto_ahash *tfm) +{ +return tfm->has_setkey; +} +/** * crypto_ahash_finup() - update and finalize message digest * @req: reference to the ahash_request handle that holds all information
Greg Kroah-Hartman
maintainerPATCH 86/117 crypto: algif_hash - Require setkey before accept(2)
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
commit 6de62f15b581f920ade22d758f4c338311c2f0d4 upstream.
Hash implementations that require a key may crash if you use them without setting a key. This patch adds the necessary checks so that if you do attempt to use them without a key that we return -ENOKEY instead of proceeding.
This patch also adds a compatibility path to support old applications that do acept(2) before setkey.
--- crypto/algif_hash.c | 201 +++++++++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 193 insertions(+), 8 deletions(-)
crypto/algif_hash.c +193 -8
@@ -34,6 +34,11 @@ struct hash_ctx {struct ahash_request req; }; +struct algif_hash_tfm { +struct crypto_ahash *hash; +bool has_key; +}; +static int hash_sendmsg (struct socket *sock,struct msghdr *msg,size_t ignored) {
@@ -235,22 +240,151 @@ static struct proto_ops algif_hash_ops = .accept = hash_accept, }; +static int hash_check_key (struct socket *sock) +{ +int err; +struct sock *psk; +struct alg_sock *pask; +struct algif_hash_tfm *tfm; +struct sock *sk = sock->sk; +struct alg_sock *ask =alg_sk (sk); + +if (ask->refcnt) +return 0 ; + + psk = ask->parent; + pask =alg_sk (ask->parent); + tfm = pask->private; + + err = -ENOKEY ; +lock_sock (psk); +if (!tfm->has_key) + goto unlock; + +if (!pask->refcnt++) +sock_hold (psk); + + ask->refcnt =1 ; +sock_put (psk); + + err =0 ; + +unlock: +release_sock (psk); + +return err; +} + +static int hash_sendmsg_nokey (struct socket *sock,struct msghdr *msg, +size_t size) +{ +int err; + + err =hash_check_key (sock); +if (err) +return err; + +return hash_sendmsg (sock, msg, size); +} + +static ssize_t hash_sendpage_nokey (struct socket *sock,struct page *page, +int offset,size_t size,int flags) +{ +int err; + + err =hash_check_key (sock); +if (err) +return err; + +return hash_sendpage (sock, page, offset, size, flags); +} + +static int hash_recvmsg_nokey (struct socket *sock,struct msghdr *msg, +size_t ignored,int flags) +{ +int err; + + err =hash_check_key (sock); +if (err) +return err; + +return hash_recvmsg (sock, msg, ignored, flags); +} + +static int hash_accept_nokey (struct socket *sock,struct socket *newsock, +int flags) +{ +int err; + + err =hash_check_key (sock); +if (err) +return err; + +return hash_accept (sock, newsock, flags); +} + +static struct proto_ops algif_hash_ops_nokey = { + .family =PF_ALG , + + .connect = sock_no_connect, + .socketpair = sock_no_socketpair, + .getname = sock_no_getname, + .ioctl = sock_no_ioctl, + .listen = sock_no_listen, + .shutdown = sock_no_shutdown, + .getsockopt = sock_no_getsockopt, + .mmap = sock_no_mmap, + .bind = sock_no_bind, + .setsockopt = sock_no_setsockopt, + .poll = sock_no_poll, + + .release = af_alg_release, + .sendmsg = hash_sendmsg_nokey, + .sendpage = hash_sendpage_nokey, + .recvmsg = hash_recvmsg_nokey, + .accept = hash_accept_nokey, +}; +static void *hash_bind (const char *name,u32 type,u32 mask) { -return crypto_alloc_ahash (name, type, mask); +struct algif_hash_tfm *tfm; +struct crypto_ahash *hash; + + tfm =kzalloc (sizeof (*tfm),GFP_KERNEL ); +if (!tfm) +return ERR_PTR (-ENOMEM ); + + hash =crypto_alloc_ahash (name, type, mask); +if (IS_ERR (hash)) { +kfree (tfm); +return ERR_CAST (hash); + } + + tfm->hash = hash; + +return tfm; }static void hash_release (void *private) { -crypto_free_ahash (private); +struct algif_hash_tfm *tfm = private; + +crypto_free_ahash (tfm->hash); +kfree (tfm); }static int hash_setkey (void *private,const u8 *key,unsigned int keylen) { -return crypto_ahash_setkey (private, key, keylen); +struct algif_hash_tfm *tfm = private; +int err; + + err =crypto_ahash_setkey (tfm->hash, key, keylen); + tfm->has_key = !err; + +return err; } -static void hash_sock_destruct (struct sock *sk) +static void hash_sock_destruct_common (struct sock *sk) {struct alg_sock *ask =alg_sk (sk);struct hash_ctx *ctx = ask->private;
@@ -258,15 +392,40 @@ static void hash_sock_destruct(struct sosock_kzfree_s (sk, ctx->result,crypto_ahash_digestsize (crypto_ahash_reqtfm (&ctx->req)));sock_kfree_s (sk, ctx, ctx->len); +} + +static void hash_sock_destruct (struct sock *sk) +{ +hash_sock_destruct_common (sk);af_alg_release_parent (sk); } -static int hash_accept_parent (void *private,struct sock *sk) +static void hash_release_parent_nokey (struct sock *sk) +{ +struct alg_sock *ask =alg_sk (sk); + +if (!ask->refcnt) { +sock_put (ask->parent); +return ; + } + +af_alg_release_parent (sk); +} + +static void hash_sock_destruct_nokey (struct sock *sk) +{ +hash_sock_destruct_common (sk); +hash_release_parent_nokey (sk); +} + +static int hash_accept_parent_common (void *private,struct sock *sk) {struct hash_ctx *ctx;struct alg_sock *ask =alg_sk (sk); -unsigned len =sizeof (*ctx) +crypto_ahash_reqsize (private); -unsigned ds =crypto_ahash_digestsize (private); +struct algif_hash_tfm *tfm = private; +struct crypto_ahash *hash = tfm->hash; +unsigned len =sizeof (*ctx) +crypto_ahash_reqsize (hash); +unsigned ds =crypto_ahash_digestsize (hash); ctx =sock_kmalloc (sk, len,GFP_KERNEL );if (!ctx)
@@ -286,7 +445,7 @@ static int hash_accept_parent(void *priv ask->private = ctx; -ahash_request_set_tfm (&ctx->req, private); +ahash_request_set_tfm (&ctx->req, hash);ahash_request_set_callback (&ctx->req,CRYPTO_TFM_REQ_MAY_BACKLOG , af_alg_complete, &ctx->completion);
@@ -295,12 +454,38 @@ static int hash_accept_parent(void *privreturn 0 ; } +static int hash_accept_parent (void *private,struct sock *sk) +{ +struct algif_hash_tfm *tfm = private; + +if (!tfm->has_key &&crypto_ahash_has_setkey (tfm->hash)) +return -ENOKEY ; + +return hash_accept_parent_common (private, sk); +} + +static int hash_accept_parent_nokey (void *private,struct sock *sk) +{ +int err; + + err =hash_accept_parent_common (private, sk); +if (err) + goto out; + + sk->sk_destruct = hash_sock_destruct_nokey; + +out: +return err; +} +static const struct af_alg_type algif_type_hash = { .bind = hash_bind, .release = hash_release, .setkey = hash_setkey, .accept = hash_accept_parent, + .accept_nokey = hash_accept_parent_nokey, .ops = &algif_hash_ops, + .ops_nokey = &algif_hash_ops_nokey, .name ="hash" , .owner =THIS_MODULE };
Greg Kroah-Hartman
maintainerPATCH 87/117 crypto: skcipher - Add crypto_skcipher_has_setkey
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
commit a1383cd86a062fc798899ab20f0ec2116cce39cb upstream.
This patch adds a way for skcipher users to determine whether a key is required by a transform.
--- crypto/skcipher.c | 2 ++ include/crypto/skcipher.h | 7 +++++++ 2 files changed, 9 insertions(+)
crypto/skcipher.c +2 -0
@@ -118,6 +118,7 @@ static int crypto_init_skcipher_ops_blkc skcipher->decrypt = skcipher_decrypt_blkcipher; skcipher->ivsize =crypto_blkcipher_ivsize (blkcipher); + skcipher->has_setkey = calg->cra_blkcipher.max_keysize;return 0 ; }
@@ -210,6 +211,7 @@ static int crypto_init_skcipher_ops_ablk skcipher->ivsize =crypto_ablkcipher_ivsize (ablkcipher); skcipher->reqsize =crypto_ablkcipher_reqsize (ablkcipher) +sizeof (struct ablkcipher_request ); + skcipher->has_setkey = calg->cra_ablkcipher.max_keysize;return 0 ; }
include/crypto/skcipher.h +7 -0
@@ -61,6 +61,8 @@ struct crypto_skcipher {unsigned int ivsize;unsigned int reqsize; +bool has_setkey; +struct crypto_tfm base; };
@@ -305,6 +307,11 @@ static inline int crypto_skcipher_setkeyreturn tfm->setkey (tfm, key, keylen); } +static inline bool crypto_skcipher_has_setkey (struct crypto_skcipher *tfm) +{ +return tfm->has_setkey; +} +/** * crypto_skcipher_reqtfm() - obtain cipher handle from request * @req: skcipher_request out of which the cipher handle is to be obtained
Greg Kroah-Hartman
maintainerPATCH 88/117 crypto: algif_skcipher - Add key check exception for cipher_null
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
commit 6e8d8ecf438792ecf7a3207488fb4eebc4edb040 upstream.
This patch adds an exception to the key check so that cipher_null users may continue to use algif_skcipher without setting a key.
--- crypto/algif_skcipher.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
crypto/algif_skcipher.c +1 -1
@@ -978,7 +978,7 @@ static int skcipher_accept_parent(void * {struct skcipher_tfm *tfm = private; -if (!tfm->has_key) +if (!tfm->has_key &&crypto_skcipher_has_setkey (tfm->skcipher))return -ENOKEY ;return skcipher_accept_parent_common (private, sk);
Greg Kroah-Hartman
maintainerPATCH 89/117 libata: disable forced PORTS_IMPL for >= AHCI 1.3
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <[email protected]>
commit 566d1827df2ef0cbe921d3d6946ac3007b1a6938 upstream.
Some early controllers incorrectly reported zero ports in PORTS_IMPL register and the ahci driver fabricates PORTS_IMPL from the number of ports in those cases. This hasn't mattered but with the new nvme controllers there are cases where zero PORTS_IMPL is valid and should be honored.
Disable the workaround for >= AHCI 1.3.
--- drivers/ata/libahci.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/ata/libahci.c +2 -2
@@ -495,8 +495,8 @@ void ahci_save_initial_config(struct dev } } -/* fabricate port_map from cap.nr_ports */ -if (!port_map) { +/* fabricate port_map from cap.nr_ports for < AHCI 1.3 */ +if (!port_map && vers <0x10300 ) { port_map = (1 <<ahci_nr_ports (cap)) -1 ;dev_warn (dev,"forcing PORTS_IMPL to 0x%x\n" , port_map);
Greg Kroah-Hartman
maintainerPATCH 90/117 ahci: Intel DNV device IDs SATA
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandra Yates <[email protected]>
commit 342decff2b846b46fa61eb5ee40986fab79a9a32 upstream.
Adding Intel codename DNV platform device IDs for SATA.
--- drivers/ata/ahci.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+)
drivers/ata/ahci.c +20 -0
@@ -264,6 +264,26 @@ static const struct pci_device_id ahci_p { PCI_VDEVICE(INTEL, 0x3b2b), board_ahci }, /* PCH RAID */ { PCI_VDEVICE(INTEL, 0x3b2c), board_ahci }, /* PCH RAID */ { PCI_VDEVICE(INTEL, 0x3b2f), board_ahci }, /* PCH AHCI */ + { PCI_VDEVICE(INTEL, 0x19b0), board_ahci }, /* DNV AHCI */ + { PCI_VDEVICE(INTEL, 0x19b1), board_ahci }, /* DNV AHCI */ + { PCI_VDEVICE(INTEL, 0x19b2), board_ahci }, /* DNV AHCI */ + { PCI_VDEVICE(INTEL, 0x19b3), board_ahci }, /* DNV AHCI */ + { PCI_VDEVICE(INTEL, 0x19b4), board_ahci }, /* DNV AHCI */ + { PCI_VDEVICE(INTEL, 0x19b5), board_ahci }, /* DNV AHCI */ + { PCI_VDEVICE(INTEL, 0x19b6), board_ahci }, /* DNV AHCI */ + { PCI_VDEVICE(INTEL, 0x19b7), board_ahci }, /* DNV AHCI */ + { PCI_VDEVICE(INTEL, 0x19bE), board_ahci }, /* DNV AHCI */ + { PCI_VDEVICE(INTEL, 0x19bF), board_ahci }, /* DNV AHCI */ + { PCI_VDEVICE(INTEL, 0x19c0), board_ahci }, /* DNV AHCI */ + { PCI_VDEVICE(INTEL, 0x19c1), board_ahci }, /* DNV AHCI */ + { PCI_VDEVICE(INTEL, 0x19c2), board_ahci }, /* DNV AHCI */ + { PCI_VDEVICE(INTEL, 0x19c3), board_ahci }, /* DNV AHCI */ + { PCI_VDEVICE(INTEL, 0x19c4), board_ahci }, /* DNV AHCI */ + { PCI_VDEVICE(INTEL, 0x19c5), board_ahci }, /* DNV AHCI */ + { PCI_VDEVICE(INTEL, 0x19c6), board_ahci }, /* DNV AHCI */ + { PCI_VDEVICE(INTEL, 0x19c7), board_ahci }, /* DNV AHCI */ + { PCI_VDEVICE(INTEL, 0x19cE), board_ahci }, /* DNV AHCI */ + { PCI_VDEVICE(INTEL, 0x19cF), board_ahci }, /* DNV AHCI */ { PCI_VDEVICE(INTEL, 0x1c02), board_ahci }, /* CPT AHCI */ { PCI_VDEVICE(INTEL, 0x1c03), board_ahci }, /* CPT AHCI */ { PCI_VDEVICE(INTEL, 0x1c04), board_ahci }, /* CPT RAID */
Greg Kroah-Hartman
maintainerPATCH 91/117 crypto: af_alg - Allow af_af_alg_release_parent to be called on nokey path
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
commit 6a935170a980024dd29199e9dbb5c4da4767a1b9 upstream.
This patch allows af_alg_release_parent to be called even for nokey sockets.
--- crypto/af_alg.c | 9 ++++++++- include/crypto/if_alg.h | 1 + 2 files changed, 9 insertions(+), 1 deletion(-)
crypto/af_alg.c +8 -1
@@ -133,6 +133,12 @@ void af_alg_release_parent(struct sock *bool last; sk = ask->parent; + +if (ask->nokey_refcnt && !ask->refcnt) { +sock_put (sk); +return ; + } + ask =alg_sk (sk);lock_sock (sk);
@@ -268,8 +274,8 @@ int af_alg_accept(struct sock *sk, strucstruct alg_sock *ask =alg_sk (sk);const struct af_alg_type *type;struct sock *sk2; +unsigned int nokey;int err; -bool nokey;lock_sock (sk); type = ask->type;
@@ -302,6 +308,7 @@ int af_alg_accept(struct sock *sk, strucsock_hold (sk);alg_sk (sk2)->parent = sk;alg_sk (sk2)->type = type; +alg_sk (sk2)->nokey_refcnt = nokey; newsock->ops = type->ops; newsock->state =SS_CONNECTED ;
include/crypto/if_alg.h +1 -0
@@ -31,6 +31,7 @@ struct alg_sock {struct sock *parent;unsigned int refcnt; +unsigned int nokey_refcnt;const struct af_alg_type *type;void *private;
Greg Kroah-Hartman
maintainerPATCH 92/117 crypto: algif_hash - Remove custom release parent function
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
commit f1d84af1835846a5a2b827382c5848faf2bb0e75 upstream.
This patch removes the custom release parent function as the generic af_alg_release_parent now works for nokey sockets too.
--- crypto/algif_hash.c | 43 +++---------------------------------------- 1 file changed, 3 insertions(+), 40 deletions(-)
crypto/algif_hash.c +3 -40
@@ -384,7 +384,7 @@ static int hash_setkey(void *private, coreturn err; } -static void hash_sock_destruct_common (struct sock *sk) +static void hash_sock_destruct (struct sock *sk) {struct alg_sock *ask =alg_sk (sk);struct hash_ctx *ctx = ask->private;
@@ -392,33 +392,10 @@ static void hash_sock_destruct_common(stsock_kzfree_s (sk, ctx->result,crypto_ahash_digestsize (crypto_ahash_reqtfm (&ctx->req)));sock_kfree_s (sk, ctx, ctx->len); -} - -static void hash_sock_destruct (struct sock *sk) -{ -hash_sock_destruct_common (sk); -af_alg_release_parent (sk); -} - -static void hash_release_parent_nokey (struct sock *sk) -{ -struct alg_sock *ask =alg_sk (sk); - -if (!ask->refcnt) { -sock_put (ask->parent); -return ; - } -af_alg_release_parent (sk); } -static void hash_sock_destruct_nokey (struct sock *sk) -{ -hash_sock_destruct_common (sk); -hash_release_parent_nokey (sk); -} - -static int hash_accept_parent_common (void *private,struct sock *sk) +static int hash_accept_parent_nokey (void *private,struct sock *sk) {struct hash_ctx *ctx;struct alg_sock *ask =alg_sk (sk);
@@ -461,21 +438,7 @@ static int hash_accept_parent(void *privif (!tfm->has_key &&crypto_ahash_has_setkey (tfm->hash))return -ENOKEY ; -return hash_accept_parent_common (private, sk); -} - -static int hash_accept_parent_nokey (void *private,struct sock *sk) -{ -int err; - - err =hash_accept_parent_common (private, sk); -if (err) - goto out; - - sk->sk_destruct = hash_sock_destruct_nokey; - -out: -return err; +return hash_accept_parent_nokey (private, sk); }static const struct af_alg_type algif_type_hash = {
Greg Kroah-Hartman
maintainerPATCH 93/117 crypto: algif_skcipher - Remove custom release parent function
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
commit d7b65aee1e7b4c87922b0232eaba56a8a143a4a0 upstream.
This patch removes the custom release parent function as the generic af_alg_release_parent now works for nokey sockets too.
--- crypto/algif_skcipher.c | 43 +++---------------------------------------- 1 file changed, 3 insertions(+), 40 deletions(-)
crypto/algif_skcipher.c +3 -40
@@ -895,7 +895,7 @@ static void skcipher_wait(struct sock *smsleep (100 ); } -static void skcipher_sock_destruct_common (struct sock *sk) +static void skcipher_sock_destruct (struct sock *sk) {struct alg_sock *ask =alg_sk (sk);struct skcipher_ctx *ctx = ask->private;
@@ -907,33 +907,10 @@ static void skcipher_sock_destruct_commoskcipher_free_sgl (sk);sock_kzfree_s (sk, ctx->iv,crypto_skcipher_ivsize (tfm));sock_kfree_s (sk, ctx, ctx->len); -} - -static void skcipher_sock_destruct (struct sock *sk) -{ -skcipher_sock_destruct_common (sk); -af_alg_release_parent (sk); -} - -static void skcipher_release_parent_nokey (struct sock *sk) -{ -struct alg_sock *ask =alg_sk (sk); - -if (!ask->refcnt) { -sock_put (ask->parent); -return ; - } -af_alg_release_parent (sk); } -static void skcipher_sock_destruct_nokey (struct sock *sk) -{ -skcipher_sock_destruct_common (sk); -skcipher_release_parent_nokey (sk); -} - -static int skcipher_accept_parent_common (void *private,struct sock *sk) +static int skcipher_accept_parent_nokey (void *private,struct sock *sk) {struct skcipher_ctx *ctx;struct alg_sock *ask =alg_sk (sk);
@@ -981,21 +958,7 @@ static int skcipher_accept_parent(void *if (!tfm->has_key &&crypto_skcipher_has_setkey (tfm->skcipher))return -ENOKEY ; -return skcipher_accept_parent_common (private, sk); -} - -static int skcipher_accept_parent_nokey (void *private,struct sock *sk) -{ -int err; - - err =skcipher_accept_parent_common (private, sk); -if (err) - goto out; - - sk->sk_destruct = skcipher_sock_destruct_nokey; - -out: -return err; +return skcipher_accept_parent_nokey (private, sk); }static const struct af_alg_type algif_type_skcipher = {
Greg Kroah-Hartman
maintainerPATCH 94/117 crypto: af_alg - Forbid bind(2) when nokey child sockets are present
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
commit a6a48c565f6f112c6983e2a02b1602189ed6e26e upstream.
This patch forbids the calling of bind(2) when there are child sockets created by accept(2) in existence, even if they are created on the nokey path.
This is needed as those child sockets have references to the tfm object which bind(2) will destroy.
--- crypto/af_alg.c | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-)
crypto/af_alg.c +7 -9
@@ -130,19 +130,16 @@ EXPORT_SYMBOL_GPL(af_alg_release);void af_alg_release_parent (struct sock *sk) {struct alg_sock *ask =alg_sk (sk); -bool last; +unsigned int nokey = ask->nokey_refcnt; +bool last = nokey && !ask->refcnt; sk = ask->parent; - -if (ask->nokey_refcnt && !ask->refcnt) { -sock_put (sk); -return ; - } - ask =alg_sk (sk);lock_sock (sk); - last = !--ask->refcnt; + ask->nokey_refcnt -= nokey; +if (!last) + last = !--ask->refcnt;release_sock (sk);if (last)
@@ -188,7 +185,7 @@ static int alg_bind(struct socket *sock, err = -EBUSY ;lock_sock (sk); -if (ask->refcnt) +if (ask->refcnt | ask->nokey_refcnt) goto unlock;swap (ask->type, type);
@@ -306,6 +303,7 @@ int af_alg_accept(struct sock *sk, strucif (nokey || !ask->refcnt++)sock_hold (sk); + ask->nokey_refcnt += nokey;alg_sk (sk2)->parent = sk;alg_sk (sk2)->type = type;alg_sk (sk2)->nokey_refcnt = nokey;
Greg Kroah-Hartman
maintainerPATCH 95/117 crypto: algif_hash - Fix race condition in hash_check_key
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
commit ad46d7e33219218605ea619e32553daf4f346b9f upstream.
We need to lock the child socket in hash_check_key as otherwise two simultaneous calls can cause the parent socket to be freed.
--- crypto/algif_hash.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
crypto/algif_hash.c +6 -3
@@ -242,22 +242,23 @@ static struct proto_ops algif_hash_ops =static int hash_check_key (struct socket *sock) { -int err; +int err =0 ;struct sock *psk;struct alg_sock *pask;struct algif_hash_tfm *tfm;struct sock *sk = sock->sk;struct alg_sock *ask =alg_sk (sk); +lock_sock (sk);if (ask->refcnt) -return 0 ; + goto unlock_child; psk = ask->parent; pask =alg_sk (ask->parent); tfm = pask->private; err = -ENOKEY ; -lock_sock (psk); +lock_sock_nested (psk,SINGLE_DEPTH_NESTING );if (!tfm->has_key) goto unlock;
@@ -271,6 +272,8 @@ static int hash_check_key(struct socket unlock:release_sock (psk); +unlock_child: +release_sock (sk);return err; }
Greg Kroah-Hartman
maintainerPATCH 96/117 crypto: algif_skcipher - Fix race condition in skcipher_check_key
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
commit 1822793a523e5d5730b19cc21160ff1717421bc8 upstream.
We need to lock the child socket in skcipher_check_key as otherwise two simultaneous calls can cause the parent socket to be freed.
--- crypto/algif_skcipher.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
crypto/algif_skcipher.c +6 -3
@@ -755,22 +755,23 @@ static struct proto_ops algif_skcipher_ostatic int skcipher_check_key (struct socket *sock) { -int err; +int err =0 ;struct sock *psk;struct alg_sock *pask;struct skcipher_tfm *tfm;struct sock *sk = sock->sk;struct alg_sock *ask =alg_sk (sk); +lock_sock (sk);if (ask->refcnt) -return 0 ; + goto unlock_child; psk = ask->parent; pask =alg_sk (ask->parent); tfm = pask->private; err = -ENOKEY ; -lock_sock (psk); +lock_sock_nested (psk,SINGLE_DEPTH_NESTING );if (!tfm->has_key) goto unlock;
@@ -784,6 +785,8 @@ static int skcipher_check_key(struct soc unlock:release_sock (psk); +unlock_child: +release_sock (sk);return err; }
Greg Kroah-Hartman
maintainerPATCH 97/117 crypto: crc32c - Fix crc32c soft dependency
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jean Delvare <[email protected]>
commit fd7f6727102a1ccf6b4c1dfcc631f9b546526b26 upstream.
I don't think it makes sense for a module to have a soft dependency on itself. This seems quite cyclic by nature and I can't see what purpose it could serve.
OTOH libcrc32c calls crypto_alloc_shash("crc32c", 0, 0) so it pretty much assumes that some incarnation of the "crc32c" hash algorithm has been loaded. Therefore it makes sense to have the soft dependency there (as crc-t10dif does.)
--- crypto/crc32c_generic.c | 1 - lib/libcrc32c.c | 1 + 2 files changed, 1 insertion(+), 1 deletion(-)
crypto/crc32c_generic.c +0 -1
@@ -172,4 +172,3 @@ MODULE_DESCRIPTION("CRC32c (Castagnoli)MODULE_LICENSE ("GPL" );MODULE_ALIAS_CRYPTO ("crc32c" );MODULE_ALIAS_CRYPTO ("crc32c-generic" ); -MODULE_SOFTDEP ("pre: crc32c" );
lib/libcrc32c.c +1 -0
@@ -74,3 +74,4 @@ module_exit(libcrc32c_mod_fini);MODULE_AUTHOR ("Clay Haapala <[email protected]>" );MODULE_DESCRIPTION ("CRC32c (Castagnoli) calculations" );MODULE_LICENSE ("GPL" ); +MODULE_SOFTDEP ("pre: crc32c" );
Greg Kroah-Hartman
maintainerPATCH 98/117 crypto: algif_skcipher - Load TX SG list after waiting
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
commit 4f0414e54e4d1893c6f08260693f8ef84c929293 upstream.
We need to load the TX SG list in sendmsg(2) after waiting for incoming data, not before.
--- crypto/algif_skcipher.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
crypto/algif_skcipher.c +7 -7
@@ -647,13 +647,6 @@ static int skcipher_recvmsg_sync(structlock_sock (sk);while (msg_data_left (msg)) { - sgl =list_first_entry (&ctx->tsgl, - struct skcipher_sg_list, list); - sg = sgl->sg; - -while (!sg->length) - sg++; -if (!ctx->used) { err =skcipher_wait_for_data (sk, flags);if (err)
@@ -674,6 +667,13 @@ static int skcipher_recvmsg_sync(structif (!used) goto free; + sgl =list_first_entry (&ctx->tsgl, + struct skcipher_sg_list, list); + sg = sgl->sg; + +while (!sg->length) + sg++; +skcipher_request_set_crypt (&ctx->req, sg, ctx->rsgl.sg, used, ctx->iv);
Greg Kroah-Hartman
maintainerPATCH 99/117 crypto: algif_skcipher - sendmsg SG marking is off by one
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
commit 202736d99b7f29279db9da61587f11a08a04a9c6 upstream.
We mark the end of the SG list in sendmsg and sendpage and unmark it on the next send call. Unfortunately the unmarking in sendmsg is off-by-one, leading to an SG list that is too short.
--- crypto/algif_skcipher.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
crypto/algif_skcipher.c +2 -1
@@ -392,7 +392,8 @@ static int skcipher_sendmsg(struct socke sgl = list_entry(ctx->tsgl.prev, struct skcipher_sg_list, list); sg = sgl->sg; -sg_unmark_end (sg + sgl->cur); +if (sgl->cur) +sg_unmark_end (sg + sgl->cur -1 ); do { i = sgl->cur; plen = min_t(int, len, PAGE_SIZE);
Greg Kroah-Hartman
maintainerPATCH 100/117 crypto: caam - make write transactions bufferable on PPC platforms
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Horia Geant? <[email protected]>
commit e7a7104e432c0db8469ca3568daf4f1d1afe3e73 upstream.
Previous change (see "Fixes" tag) to the MCFGR register clears AWCACHE[0] ("bufferable" AXI3 attribute) (which is "1" at POR).
This makes all writes non-bufferable, causing a ~ 5% performance drop for PPC-based platforms.
Rework previous change such that MCFGR[AWCACHE]=4'b0011 (bufferable + cacheable) for all platforms.
Note: For ARM-based platforms, AWCACHE[0] is ignored by the interconnect IP.
--- drivers/crypto/caam/ctrl.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/crypto/caam/ctrl.c +2 -2
@@ -534,8 +534,8 @@ static int caam_probe(struct platform_de* long pointers in master configuration register */ clrsetbits_32 (&ctrl->mcr,MCFGR_AWCACHE_MASK ,MCFGR_AWCACHE_CACH | -MCFGR_WDENABLE | (sizeof (dma_addr_t) ==sizeof (u64) ? -MCFGR_LONG_PTR :0 )); +MCFGR_AWCACHE_BUFF |MCFGR_WDENABLE | + (sizeof (dma_addr_t) ==sizeof (u64) ?MCFGR_LONG_PTR :0 ));/* * Read the Compile Time paramters and SCFGR to determine
Greg Kroah-Hartman
maintainerPATCH 101/117 crypto: chacha20-ssse3 - Align stack pointer to 64 bytes
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eli Cooper <[email protected]>
commit cbe09bd51bf23b42c3a94c5fb6815e1397c5fc3f upstream.
This aligns the stack pointer in chacha20_4block_xor_ssse3 to 64 bytes. Fixes general protection faults and potential kernel panics.
--- arch/x86/crypto/chacha20-ssse3-x86_64.S | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
arch/x86/crypto/chacha20-ssse3-x86_64.S +4 -2
@@ -157,7 +157,9 @@ ENTRY(chacha20_4block_xor_ssse3) # done with the slightly better performing SSSE3 byte shuffling, # 7/12-bit word rotation uses traditional shift+OR. - sub $0x40,%rsp + mov %rsp,%r11 + sub $0x80,%rsp + and $~63,%rsp # x0..15[0-3] = s0..3[0..3] movq 0x00(%rdi),%xmm1
@@ -620,6 +622,6 @@ ENTRY(chacha20_4block_xor_ssse3) pxor %xmm1,%xmm15 movdqu %xmm15,0xf0(%rsi) - add $0x40,%rsp + mov %r11,%rsp ret ENDPROC(chacha20_4block_xor_ssse3)
Greg Kroah-Hartman
maintainerPATCH 102/117 crypto: shash - Fix has_key setting
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
commit 00420a65fa2beb3206090ead86942484df2275f3 upstream.
The has_key logic is wrong for shash algorithms as they always have a setkey function. So we should instead be testing against shash_no_setkey.
--- crypto/shash.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
crypto/shash.c +3 -4
@@ -354,11 +354,10 @@ int crypto_init_shash_ops_async(struct c crt->final = shash_async_final; crt->finup = shash_async_finup; crt->digest = shash_async_digest; + crt->setkey = shash_async_setkey; + + crt->has_setkey = alg->setkey != shash_no_setkey; -if (alg->setkey) { - crt->setkey = shash_async_setkey; - crt->has_setkey = true; - }if (alg->export) crt->export = shash_async_export;if (alg->import)
Greg Kroah-Hartman
maintainerPATCH 103/117 crypto: algif_hash - wait for crypto_ahash_init() to complete
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang, Rui Y <[email protected]>
commit fe09786178f9df713a4b2dd6b93c0a722346bf5e upstream.
hash_sendmsg/sendpage() need to wait for the completion of crypto_ahash_init() otherwise it can cause panic.
--- crypto/algif_hash.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
crypto/algif_hash.c +3 -1
@@ -54,7 +54,8 @@ static int hash_sendmsg(struct socket *slock_sock (sk);if (!ctx->more) { - err =crypto_ahash_init (&ctx->req); + err =af_alg_wait_for_completion (crypto_ahash_init (&ctx->req), + &ctx->completion);if (err) goto unlock; }
@@ -125,6 +126,7 @@ static ssize_t hash_sendpage(struct sock }else {if (!ctx->more) { err =crypto_ahash_init (&ctx->req); + err =af_alg_wait_for_completion (err, &ctx->completion);if (err) goto unlock; }
Greg Kroah-Hartman
maintainerPATCH 104/117 EVM: Use crypto_memneq() for digest comparisons
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryan Ware <[email protected]>
commit 613317bd212c585c20796c10afe5daaa95d4b0a1 upstream.
This patch fixes vulnerability CVE-2016-2085. The problem exists because the vm_verify_hmac() function includes a use of memcmp(). Unfortunately, this allows timing side channel attacks; specifically a MAC forgery complexity drop from 2^128 to 2^12. This patch changes the memcmp() to the cryptographically safe crypto_memneq().
--- security/integrity/evm/evm_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
security/integrity/evm/evm_main.c +2 -1
@@ -23,6 +23,7 @@#include <linux/integrity.h> #include <linux/evm.h> #include <crypto/hash.h> +#include <crypto/algapi.h> #include "evm.h" int evm_initialized;
@@ -148,7 +149,7 @@ static enum integrity_status evm_verify_ xattr_value_len, calc.digest);if (rc)break ; - rc =memcmp (xattr_data->digest, calc.digest, + rc =crypto_memneq (xattr_data->digest, calc.digest,sizeof (calc.digest));if (rc) rc = -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 105/117 crypto: user - lock crypto_alg_list on alg dump
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Krause <[email protected]>
commit 63e41ebc6630f39422d87f8a4bade1e793f37a01 upstream.
We miss to take the crypto_alg_sem semaphore when traversing the crypto_alg_list for CRYPTO_MSG_GETALG dumps. This allows a race with crypto_unregister_alg() removing algorithms from the list while we're still traversing it, thereby leading to a use-after-free as show below:
[ 3482.071639] general protection fault: 0000 [#1] SMP [ 3482.075639] Modules linked in: aes_x86_64 glue_helper lrw ablk_helper cryptd gf128mul ipv6 pcspkr serio_raw virtio_net microcode virtio_pci virtio_ring virtio sr_mod cdrom [last unloaded: aesni_intel] [ 3482.075639] CPU: 1 PID: 11065 Comm: crconf Not tainted 4.3.4-grsec+ #126 [ 3482.075639] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140531_083030-gandalf 04/01/2014 [ 3482.075639] task: ffff88001cd41a40 ti: ffff88001cd422c8 task.ti: ffff88001cd422c8 [ 3482.075639] RIP: 0010:[<ffffffff93722bd3>] [<ffffffff93722bd3>] strncpy+0x13/0x30 [ 3482.075639] RSP: 0018:ffff88001f713b60 EFLAGS: 00010202 [ 3482.075639] RAX: ffff88001f6c4430 RBX: ffff88001f6c43a0 RCX: ffff88001f6c4430 [ 3482.075639] RDX: 0000000000000040 RSI: fefefefefefeff16 RDI: ffff88001f6c4430 [ 3482.075639] RBP: ffff88001f713b60 R08: ffff88001f6c4470 R09: ffff88001f6c4480 [ 3482.075639] R10: 0000000000000002 R11: 0000000000000246 R12: ffff88001ce2aa28 [ 3482.075639] R13: ffff880000093700 R14: ffff88001f5e4bf8 R15: 0000000000003b20 [ 3482.075639] FS: 0000033826fa2700(0000) GS:ffff88001e900000(0000) knlGS:0000000000000000 [ 3482.075639] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 3482.075639] CR2: ffffffffff600400 CR3: 00000000139ec000 CR4: 00000000001606f0 [ 3482.075639] Stack: [ 3482.075639] ffff88001f713bd8 ffffffff936ccd00 ffff88001e5c4200 ffff880000093700 [ 3482.075639] ffff88001f713bd0 ffffffff938ef4bf 0000000000000000 0000000000003b20 [ 3482.075639] ffff88001f5e4bf8 ffff88001f5e4848 0000000000000000 0000000000003b20 [ 3482.075639] Call Trace: [ 3482.075639] [<ffffffff936ccd00>] crypto_report_alg+0xc0/0x3e0 [ 3482.075639] [<ffffffff938ef4bf>] ? __alloc_skb+0x16f/0x300 [ 3482.075639] [<ffffffff936cd08a>] crypto_dump_report+0x6a/0x90 [ 3482.075639] [<ffffffff93935707>] netlink_dump+0x147/0x2e0 [ 3482.075639] [<ffffffff93935f99>] __netlink_dump_start+0x159/0x190 [ 3482.075639] [<ffffffff936ccb13>] crypto_user_rcv_msg+0xc3/0x130 [ 3482.075639] [<ffffffff936cd020>] ? crypto_report_alg+0x3e0/0x3e0 [ 3482.075639] [<ffffffff936cc4b0>] ? alg_test_crc32c+0x120/0x120 [ 3482.075639] [<ffffffff93933145>] ? __netlink_lookup+0xd5/0x120 [ 3482.075639] [<ffffffff936cca50>] ? crypto_add_alg+0x1d0/0x1d0 [ 3482.075639] [<ffffffff93938141>] netlink_rcv_skb+0xe1/0x130 [ 3482.075639] [<ffffffff936cc4f8>] crypto_netlink_rcv+0x28/0x40 [ 3482.075639] [<ffffffff939375a8>] netlink_unicast+0x108/0x180 [ 3482.075639] [<ffffffff93937c21>] netlink_sendmsg+0x541/0x770 [ 3482.075639] [<ffffffff938e31e1>] sock_sendmsg+0x21/0x40 [ 3482.075639] [<ffffffff938e4763>] SyS_sendto+0xf3/0x130 [ 3482.075639] [<ffffffff93444203>] ? bad_area_nosemaphore+0x13/0x20 [ 3482.075639] [<ffffffff93444470>] ? __do_page_fault+0x80/0x3a0 [ 3482.075639] [<ffffffff939d80cb>] entry_SYSCALL_64_fastpath+0x12/0x6e [ 3482.075639] Code: 88 4a ff 75 ed 5d 48 0f ba 2c 24 3f c3 66 66 2e 0f 1f 84 00 00 00 00 00 55 48 85 d2 48 89 f8 48 89 f9 4c 8d 04 17 48 89 e5 74 15 <0f> b6 16 80 fa 01 88 11 48 83 de ff 48 83 c1 01 4c 39 c1 75 eb [ 3482.075639] RIP [<ffffffff93722bd3>] strncpy+0x13/0x30
To trigger the race run the following loops simultaneously for a while:
$ while : ; do modprobe aesni-intel; rmmod aesni-intel; done $ while : ; do crconf show all > /dev/null; done
Fix the race by taking the crypto_alg_sem read lock, thereby preventing crypto_unregister_alg() from modifying the algorithm list during the dump.
This bug has been detected by the PaX memory sanitize feature.
--- crypto/crypto_user.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
crypto/crypto_user.c +5 -1
@@ -499,6 +499,7 @@ static int crypto_user_rcv_msg(struct skif (link->dump ==NULL )return -EINVAL ; +down_read (&crypto_alg_sem);list_for_each_entry (alg, &crypto_alg_list, cra_list) dump_alloc +=CRYPTO_REPORT_MAXSIZE ;
@@ -508,8 +509,11 @@ static int crypto_user_rcv_msg(struct sk .done = link->done, .min_dump_alloc = dump_alloc, }; -return netlink_dump_start (crypto_nlsk, skb, nlh, &c); + err =netlink_dump_start (crypto_nlsk, skb, nlh, &c); } +up_read (&crypto_alg_sem); + +return err; } err = nlmsg_parse(nlh, crypto_msg_min[type], attrs, CRYPTOCFGA_MAX,
Greg Kroah-Hartman
maintainerPATCH 106/117 crypto: algif_skcipher - Do not assume that req is unchanged
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
commit ec69bbfb9902c32a5c1492f2b1b8ad032a66d724 upstream.
The async path in algif_skcipher assumes that the crypto completion function will be called with the original request. This is not necessarily the case. In fact there is no need for this anyway since we already embed information into the request with struct skcipher_async_req.
This patch adds a pointer to that struct and then passes it as the data to the callback function.
--- crypto/algif_skcipher.c | 60 ++++++++++++++++++++++-------------------------- 1 file changed, 28 insertions(+), 32 deletions(-)
crypto/algif_skcipher.c +28 -32
@@ -65,18 +65,10 @@ struct skcipher_async_req {struct skcipher_async_rsgl first_sgl;struct list_head list;struct scatterlist *tsg; -char iv[]; +atomic_t *inflight; +struct skcipher_request req; }; -#define GET_SREQ (areq, ctx) (struct skcipher_async_req *)((char *)areq + \ - crypto_skcipher_reqsize(crypto_skcipher_reqtfm(&ctx->req))) - -#define GET_REQ_SIZE (ctx) \ - crypto_skcipher_reqsize(crypto_skcipher_reqtfm(&ctx->req)) - -#define GET_IV_SIZE (ctx) \ - crypto_skcipher_ivsize(crypto_skcipher_reqtfm(&ctx->req)) -#define MAX_SGL_ENTS ((4096 - sizeof(struct skcipher_sg_list)) / \ sizeof(struct scatterlist) - 1)
@@ -102,15 +94,12 @@ static void skcipher_free_async_sgls(strstatic void skcipher_async_cb (struct crypto_async_request *req,int err) { -struct sock *sk = req->data; -struct alg_sock *ask =alg_sk (sk); -struct skcipher_ctx *ctx = ask->private; -struct skcipher_async_req *sreq =GET_SREQ (req, ctx); +struct skcipher_async_req *sreq = req->data;struct kiocb *iocb = sreq->iocb; -atomic_dec (&ctx->inflight); +atomic_dec (sreq->inflight);skcipher_free_async_sgls (sreq); -kfree (req); +kzfree (sreq); iocb->ki_complete (iocb, err, err); }
@@ -509,37 +498,42 @@ static int skcipher_recvmsg_async(struct {struct sock *sk = sock->sk;struct alg_sock *ask =alg_sk (sk); +struct sock *psk = ask->parent; +struct alg_sock *pask =alg_sk (psk);struct skcipher_ctx *ctx = ask->private; +struct skcipher_tfm *skc = pask->private; +struct crypto_skcipher *tfm = skc->skcipher;struct skcipher_sg_list *sgl;struct scatterlist *sg;struct skcipher_async_req *sreq;struct skcipher_request *req;struct skcipher_async_rsgl *last_rsgl =NULL ;unsigned int txbufs =0 , len =0 , tx_nents =skcipher_all_sg_nents (ctx); -unsigned int reqlen =sizeof (struct skcipher_async_req ) + -GET_REQ_SIZE (ctx) +GET_IV_SIZE (ctx); +unsigned int reqsize =crypto_skcipher_reqsize (tfm); +unsigned int ivsize =crypto_skcipher_ivsize (tfm);int err = -ENOMEM ;bool mark = false; +char *iv; -lock_sock (sk); - req =kmalloc (reqlen,GFP_KERNEL ); -if (unlikely (!req)) - goto unlock; + sreq =kzalloc (sizeof (*sreq) + reqsize + ivsize,GFP_KERNEL ); +if (unlikely (!sreq)) + goto out; - sreq =GET_SREQ (req, ctx); + req = &sreq->req; + iv = (char *)(req +1 ) + reqsize; sreq->iocb = msg->msg_iocb; -memset (&sreq->first_sgl,'\0' ,sizeof (struct skcipher_async_rsgl ));INIT_LIST_HEAD (&sreq->list); + sreq->inflight = &ctx->inflight; + +lock_sock (sk); sreq->tsg =kcalloc (tx_nents,sizeof (*sg),GFP_KERNEL ); -if (unlikely (!sreq->tsg)) { -kfree (req); +if (unlikely (!sreq->tsg)) goto unlock; - }sg_init_table (sreq->tsg, tx_nents); -memcpy (sreq->iv, ctx->iv,GET_IV_SIZE (ctx)); -skcipher_request_set_tfm (req,crypto_skcipher_reqtfm (&ctx->req)); +memcpy (iv, ctx->iv, ivsize); +skcipher_request_set_tfm (req, tfm);skcipher_request_set_callback (req,CRYPTO_TFM_REQ_MAY_BACKLOG , - skcipher_async_cb, sk); + skcipher_async_cb, sreq);while (iov_iter_count (&msg->msg_iter)) {struct skcipher_async_rsgl *rsgl;
@@ -615,20 +609,22 @@ static int skcipher_recvmsg_async(structsg_mark_end (sreq->tsg + txbufs -1 );skcipher_request_set_crypt (req, sreq->tsg, sreq->first_sgl.sgl.sg, - len, sreq->iv); + len, iv); err = ctx->enc ?crypto_skcipher_encrypt (req) :crypto_skcipher_decrypt (req);if (err == -EINPROGRESS ) {atomic_inc (&ctx->inflight); err = -EIOCBQUEUED ; + sreq =NULL ; goto unlock; } free:skcipher_free_async_sgls (sreq); -kfree (req); unlock:skcipher_wmem_wakeup (sk);release_sock (sk); +kzfree (sreq); +out:return err; }
Greg Kroah-Hartman
maintainerPATCH 107/117 crypto: algif_skcipher - Do not dereference ctx without socket lock
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
commit 6454c2b83f719057069777132b13949e4c6b6350 upstream.
Any access to non-constant bits of the private context must be done under the socket lock, in particular, this includes ctx->req.
This patch moves such accesses under the lock, and fetches the tfm from the parent socket which is guaranteed to be constant, rather than from ctx->req.
--- crypto/algif_skcipher.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
crypto/algif_skcipher.c +11 -4
@@ -295,8 +295,11 @@ static int skcipher_sendmsg(struct socke {struct sock *sk = sock->sk;struct alg_sock *ask =alg_sk (sk); +struct sock *psk = ask->parent; +struct alg_sock *pask =alg_sk (psk);struct skcipher_ctx *ctx = ask->private; -struct crypto_skcipher *tfm =crypto_skcipher_reqtfm (&ctx->req); +struct skcipher_tfm *skc = pask->private; +struct crypto_skcipher *tfm = skc->skcipher;unsigned ivsize =crypto_skcipher_ivsize (tfm);struct skcipher_sg_list *sgl;struct af_alg_control con = {};
@@ -508,7 +511,7 @@ static int skcipher_recvmsg_async(structstruct skcipher_async_req *sreq;struct skcipher_request *req;struct skcipher_async_rsgl *last_rsgl =NULL ; -unsigned int txbufs =0 , len =0 , tx_nents =skcipher_all_sg_nents (ctx); +unsigned int txbufs =0 , len =0 , tx_nents;unsigned int reqsize =crypto_skcipher_reqsize (tfm);unsigned int ivsize =crypto_skcipher_ivsize (tfm);int err = -ENOMEM ;
@@ -526,6 +529,7 @@ static int skcipher_recvmsg_async(struct sreq->inflight = &ctx->inflight;lock_sock (sk); + tx_nents =skcipher_all_sg_nents (ctx); sreq->tsg =kcalloc (tx_nents,sizeof (*sg),GFP_KERNEL );if (unlikely (!sreq->tsg)) goto unlock;
@@ -633,9 +637,12 @@ static int skcipher_recvmsg_sync(struct {struct sock *sk = sock->sk;struct alg_sock *ask =alg_sk (sk); +struct sock *psk = ask->parent; +struct alg_sock *pask =alg_sk (psk);struct skcipher_ctx *ctx = ask->private; -unsigned bs =crypto_skcipher_blocksize (crypto_skcipher_reqtfm ( - &ctx->req)); +struct skcipher_tfm *skc = pask->private; +struct crypto_skcipher *tfm = skc->skcipher; +unsigned bs =crypto_skcipher_blocksize (tfm);struct skcipher_sg_list *sgl;struct scatterlist *sg;int err = -EAGAIN ;
Greg Kroah-Hartman
maintainerPATCH 108/117 crypto: algif_skcipher - Do not set MAY_BACKLOG on the async path
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
commit dad41997063723eaf5f77bc2015606a5a9bce320 upstream.
The async path cannot use MAY_BACKLOG because it is not meant to block, which is what MAY_BACKLOG does. On the other hand, both the sync and async paths can make use of MAY_SLEEP.
--- crypto/algif_skcipher.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
crypto/algif_skcipher.c +3 -2
@@ -536,7 +536,7 @@ static int skcipher_recvmsg_async(structsg_init_table (sreq->tsg, tx_nents);memcpy (iv, ctx->iv, ivsize);skcipher_request_set_tfm (req, tfm); -skcipher_request_set_callback (req,CRYPTO_TFM_REQ_MAY_BACKLOG , +skcipher_request_set_callback (req,CRYPTO_TFM_REQ_MAY_SLEEP , skcipher_async_cb, sreq);while (iov_iter_count (&msg->msg_iter)) {
@@ -950,7 +950,8 @@ static int skcipher_accept_parent_nokey( ask->private = ctx;skcipher_request_set_tfm (&ctx->req, skcipher); -skcipher_request_set_callback (&ctx->req,CRYPTO_TFM_REQ_MAY_BACKLOG , +skcipher_request_set_callback (&ctx->req,CRYPTO_TFM_REQ_MAY_SLEEP | +CRYPTO_TFM_REQ_MAY_BACKLOG , af_alg_complete, &ctx->completion); sk->sk_destruct = skcipher_sock_destruct;
Greg Kroah-Hartman
maintainerPATCH 109/117 crypto: atmel-sha - fix atmel_sha_remove()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cyrille Pitchen <[email protected]>
commit d961436c11482e974b702c8324426208f00cd7c4 upstream.
Since atmel_sha_probe() uses devm_xxx functions to allocate resources, atmel_sha_remove() should no longer explicitly release them.
--- drivers/crypto/atmel-sha.c | 7 ------- 1 file changed, 7 deletions(-)
drivers/crypto/atmel-sha.c +0 -7
@@ -1484,13 +1484,6 @@ static int atmel_sha_remove(struct platfif (sha_dd->caps.has_dma)atmel_sha_dma_cleanup (sha_dd); -iounmap (sha_dd->io_base); - -clk_put (sha_dd->iclk); - -if (sha_dd->irq >=0 ) -free_irq (sha_dd->irq, sha_dd); -return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 110/117 crypto: atmel-sha - remove calls of clk_prepare() from atomic contexts
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cyrille Pitchen <[email protected]>
commit c033042aa8f69894df37dabcaa0231594834a4e4 upstream.
clk_prepare()/clk_unprepare() must not be called within atomic context.
This patch calls clk_prepare() once for all from atmel_sha_probe() and clk_unprepare() from atmel_sha_remove().
Then calls of clk_prepare_enable()/clk_disable_unprepare() were replaced by calls of clk_enable()/clk_disable().
--- drivers/crypto/atmel-sha.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-)
drivers/crypto/atmel-sha.c +13 -5
@@ -783,7 +783,7 @@ static void atmel_sha_finish_req(struct dd->flags &= ~(SHA_FLAGS_BUSY |SHA_FLAGS_FINAL |SHA_FLAGS_CPU |SHA_FLAGS_DMA_READY |SHA_FLAGS_OUTPUT_READY ); -clk_disable_unprepare (dd->iclk); +clk_disable (dd->iclk);if (req->base.complete) req->base.complete (&req->base, err);
@@ -796,7 +796,7 @@ static int atmel_sha_hw_init(struct atme {int err; - err =clk_prepare_enable (dd->iclk); + err =clk_enable (dd->iclk);if (err)return err;
@@ -823,7 +823,7 @@ static void atmel_sha_hw_version_init(stdev_info (dd->dev,"version: 0x%x\n" , dd->hw_version); -clk_disable_unprepare (dd->iclk); +clk_disable (dd->iclk); } static int atmel_sha_handle_queue(struct atmel_sha_dev *dd,
@@ -1411,6 +1411,10 @@ static int atmel_sha_probe(struct platfo goto res_err; } + err =clk_prepare (sha_dd->iclk); +if (err) + goto res_err; +atmel_sha_hw_version_init (sha_dd);atmel_sha_get_cap (sha_dd);
@@ -1422,12 +1426,12 @@ static int atmel_sha_probe(struct platfoif (IS_ERR (pdata)) {dev_err (&pdev->dev,"platform data not available\n" ); err =PTR_ERR (pdata); - goto res_err; + goto iclk_unprepare; } }if (!pdata->dma_slave) { err = -ENXIO ; - goto res_err; + goto iclk_unprepare; } err =atmel_sha_dma_init (sha_dd, pdata);if (err)
@@ -1458,6 +1462,8 @@ err_algs:if (sha_dd->caps.has_dma)atmel_sha_dma_cleanup (sha_dd); err_sha_dma: +iclk_unprepare: +clk_unprepare (sha_dd->iclk); res_err:tasklet_kill (&sha_dd->done_task); sha_dd_err:
@@ -1484,6 +1490,8 @@ static int atmel_sha_remove(struct platfif (sha_dd->caps.has_dma)atmel_sha_dma_cleanup (sha_dd); +clk_unprepare (sha_dd->iclk); +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 111/117 crypto: marvell/cesa - fix test in mv_cesa_dev_dma_init()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boris BREZILLON <[email protected]>
commit 8a3978ad55fb4c0564d285fb2f6cdee2313fce01 upstream.
We are checking twice if dma->cache_pool is not NULL but are never testing dma->padding_pool value.
--- drivers/crypto/marvell/cesa.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/crypto/marvell/cesa.c +1 -1
@@ -306,7 +306,7 @@ static int mv_cesa_dev_dma_init(struct mreturn -ENOMEM ; dma->padding_pool =dmam_pool_create ("cesa_padding" , dev,72 ,1 ,0 ); -if (!dma->cache_pool) +if (!dma->padding_pool)return -ENOMEM ; cesa->dma = dma;
Greg Kroah-Hartman
maintainerPATCH 112/117 rtlwifi: rtl8821ae: Fix errors in parameter initialization
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Larry Finger <[email protected]>
commit 78bae1de422a7f6f2b4b61f6a5c379e3d7f96f44 upstream.
This driver failed to copy parameters sw_crypto and disable_watchdog into the locations actually used by the driver. In addition, msi_support was initialized three times and one of them used the wrong variable. The initialization of parameter int_clear was moved so that it is near that of the rest of the parameters.
--- drivers/net/wireless/realtek/rtlwifi/rtl8821ae/sw.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/net/wireless/realtek/rtlwifi/rtl8821ae/sw.c +5 -4
@@ -95,8 +95,6 @@ int rtl8821ae_init_sw_vars(struct ieee80struct rtl_hal *rtlhal =rtl_hal (rtl_priv (hw));rtl8821ae_bt_reg_init (hw); - rtlpci->msi_support = rtlpriv->cfg->mod_params->msi_support; - rtlpci->int_clear = rtlpriv->cfg->mod_params->int_clear; rtlpriv->btcoexist.btc_ops =rtl_btc_get_ops_pointer (); rtlpriv->dm.dm_initialgain_enable =1 ;
@@ -168,12 +166,15 @@ int rtl8821ae_init_sw_vars(struct ieee80 rtlpriv->psc.swctrl_lps = rtlpriv->cfg->mod_params->swctrl_lps; rtlpriv->psc.fwctrl_lps = rtlpriv->cfg->mod_params->fwctrl_lps; rtlpci->msi_support = rtlpriv->cfg->mod_params->msi_support; - rtlpci->msi_support = rtlpriv->cfg->mod_params->int_clear; + rtlpci->int_clear = rtlpriv->cfg->mod_params->int_clear; + rtlpriv->cfg->mod_params->sw_crypto = + rtlpriv->cfg->mod_params->sw_crypto; + rtlpriv->cfg->mod_params->disable_watchdog = + rtlpriv->cfg->mod_params->disable_watchdog;if (rtlpriv->cfg->mod_params->disable_watchdog)pr_info ("watchdog disabled\n" ); rtlpriv->psc.reg_fwctrl_lps =3 ; rtlpriv->psc.reg_max_lps_awakeintvl =5 ; - rtlpci->msi_support = rtlpriv->cfg->mod_params->msi_support;/* for ASPM, you can close aspm through * set const_support_pciaspm = 0
Re: [PATCH 4.4 112/117] rtlwifi: rtl8821ae: Fix errors in parameter initialization
Quoted 24 lines · Greg Kroah-Hartman
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Larry Finger <[email protected]>
commit
78bae1de422a7f6f2b4b61f6a5c379e3d7f96f44upstream.This driver failed to copy parameters
sw_cryptoanddisable_watchdoginto the locations actually used by the driver. In addition,msi_supportwas initialized three times and one of them used the wrong variable. The initialization of parameterint_clearwas moved so that it is near that of the rest of the parameters.Signed-off-by Larry Finger <[email protected]>Signed-off-by Kalle Valo <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>---
drivers/net/wireless/realtek/rtlwifi/rtl8821ae/sw.c | 9 +++++----1 file changed, 5 insertions(+), 4 deletions(-)drivers/net/wireless/realtek/rtlwifi/rtl8821ae/sw.c +0
-0
[...]
drivers/net/wireless/realtek/rtlwifi/rtl8821ae/sw.c int rtl8821ae_init_sw_vars(struct ieee80 · line 173
Quoted 10 lines
drivers/net/wireless/realtek/rtlwifi/rtl8821ae/sw.c +5
-1@@ -168,12 +166,15 @@ int rtl8821ae_init_sw_vars(struct ieee80 rtlpriv->psc.swctrl_lps = rtlpriv->cfg->mod_params->swctrl_lps; rtlpriv->psc.fwctrl_lps = rtlpriv->cfg->mod_params->fwctrl_lps; rtlpci->msi_support = rtlpriv->cfg->mod_params->msi_support; - rtlpci->msi_support = rtlpriv->cfg->mod_params->int_clear; + rtlpci->int_clear = rtlpriv->cfg->mod_params->int_clear; + rtlpriv->cfg->mod_params->sw_crypto = + rtlpriv->cfg->mod_params->sw_crypto; + rtlpriv->cfg->mod_params->disable_watchdog = + rtlpriv->cfg->mod_params->disable_watchdog;
[...]
This is self-assignment. How is that going to help?
Ben.
Signature · 3 lines
Ben Hutchings
Life is what happens to you while you're busy making other plans.
- John LennonRe: [PATCH 4.4 112/117] rtlwifi: rtl8821ae: Fix errors in parameter initialization
Quoted 39 lines · Ben Hutchings
Quoted 24 lines · Greg Kroah-Hartman
4.4-stable review patch.��If anyone has any objections, please let me know.
------------------
From: Larry Finger <[email protected]>
commit
78bae1de422a7f6f2b4b61f6a5c379e3d7f96f44upstream.This driver failed to copy parameters
sw_cryptoanddisable_watchdoginto the locations actually used by the driver. In addition,msi_supportwas initialized three times and one of them used the wrong variable. The initialization of parameterint_clearwas moved so that it is near that of the rest of the parameters.Signed-off-by Larry Finger <[email protected]>Signed-off-by Kalle Valo <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>---
�drivers/net/wireless/realtek/rtlwifi/rtl8821ae/sw.c |����9 +++++---- �1 file changed, 5 insertions(+), 4 deletions(-)drivers/net/wireless/realtek/rtlwifi/rtl8821ae/sw.c +0
-0[...]
Quoted 10 lines
drivers/net/wireless/realtek/rtlwifi/rtl8821ae/sw.c +5
-1@@ -168,12 +166,15 @@ int rtl8821ae_init_sw_vars(struct ieee80 � rtlpriv->psc.swctrl_lps = rtlpriv->cfg->mod_params->swctrl_lps; � rtlpriv->psc.fwctrl_lps = rtlpriv->cfg->mod_params->fwctrl_lps; � rtlpci->msi_support = rtlpriv->cfg->mod_params->msi_support; - rtlpci->msi_support = rtlpriv->cfg->mod_params->int_clear; + rtlpci->int_clear = rtlpriv->cfg->mod_params->int_clear; + rtlpriv->cfg->mod_params->sw_crypto = + rtlpriv->cfg->mod_params->sw_crypto; + rtlpriv->cfg->mod_params->disable_watchdog = + rtlpriv->cfg->mod_params->disable_watchdog;[...]
Quoted 2 lines
This is self-assignment. �How is that going to help?
Yeah, I did asked that question on the original patchset[1] but never actually got any reply.
[1] https://marc.info/?l=linux-wireless&m=145437005409037&w=2
Cheers,
--
Lu�s
Quoted 6 lines
Ben.
Signature · 3 lines
Ben Hutchings Life is what happens to you while you're busy making other plans. - John Lennon
Re: [PATCH 4.4 112/117] rtlwifi: rtl8821ae: Fix errors in parameter initialization
Quoted 43 lines · Luis Henriques
Quoted 39 lines · Ben Hutchings
Quoted 24 lines · Greg Kroah-Hartman
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Larry Finger <[email protected]>
commit
78bae1de422a7f6f2b4b61f6a5c379e3d7f96f44upstream.This driver failed to copy parameters
sw_cryptoanddisable_watchdoginto the locations actually used by the driver. In addition,msi_supportwas initialized three times and one of them used the wrong variable. The initialization of parameterint_clearwas moved so that it is near that of the rest of the parameters.Signed-off-by Larry Finger <[email protected]>Signed-off-by Kalle Valo <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>--- drivers/net/wireless/realtek/rtlwifi/rtl8821ae/sw.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)drivers/net/wireless/realtek/rtlwifi/rtl8821ae/sw.c +0
-0[...]
Quoted 10 lines
drivers/net/wireless/realtek/rtlwifi/rtl8821ae/sw.c +5
-1@@ -168,12 +166,15 @@ int rtl8821ae_init_sw_vars(struct ieee80 rtlpriv->psc.swctrl_lps = rtlpriv->cfg->mod_params->swctrl_lps; rtlpriv->psc.fwctrl_lps = rtlpriv->cfg->mod_params->fwctrl_lps; rtlpci->msi_support = rtlpriv->cfg->mod_params->msi_support; - rtlpci->msi_support = rtlpriv->cfg->mod_params->int_clear; + rtlpci->int_clear = rtlpriv->cfg->mod_params->int_clear; + rtlpriv->cfg->mod_params->sw_crypto = + rtlpriv->cfg->mod_params->sw_crypto; + rtlpriv->cfg->mod_params->disable_watchdog = + rtlpriv->cfg->mod_params->disable_watchdog;[...]
Quoted 2 lines
This is self-assignment. How is that going to help?
Quoted 15 lines
Yeah, I did asked that question on the original patchset[1] but never actually got any reply.
[1] https://marc.info/?l=linux-wireless&m=145437005409037&w=2
Cheers,
--
Lu�sQuoted 6 lines
Ben.
--
Ben Hutchings
Life is what happens to you while you're busy making other plans.
- John Lennon
It is not going to help. I found some places in the drivers where the module parameters were not being transferred to their final locations. While fixing them, I add this atrocious code. It was a case of having a new hammer, and the whole world looked like a nail. As the original patches were being sent through stable, I did not send remedial patches immediately so as not to generate any confusion. I think these have now propagated through the system, and I will remove those self-assignment lines of code.
Larry
Greg Kroah-Hartman
maintainerPATCH 113/117 rtlwifi: rtl8821ae: Fix 5G failure when EEPROM is incorrectly encoded
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Larry Finger <[email protected]>
commit c72fc9093718a3f8597249863a1bac345ba00859 upstream.
Recently, it has been reported that D-Link DWA-582 cards, which use an RTL8812AE chip are not able to scan for 5G networks. The problems started with kernel 4.2, which is the first version that had commit d10101a60372 ("rtlwifi: rtl8821ae: Fix problem with regulatory information"). With this patch, the driver went from setting a default channel plan to using the value derived from EEPROM.
Bug reports at https://bugzilla.kernel.org/show_bug.cgi?id=111031 and
https://bugzilla.redhat.com/show_bug.cgi?id=1279653 are examples of this problem.
The problem was solved once I learned that the internal country code was resulting in a regulatory set with only 2.4 GHz channels. With the RTL8821AE chips available to me, the country code was such that both 2.4 and 5 GHz channels are allowed. The fix is to allow both bands even when the EEPROM is incorrectly encoded.
--- drivers/net/wireless/realtek/rtlwifi/regd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/realtek/rtlwifi/regd.c +1 -1
@@ -351,7 +351,6 @@ static const struct ieee80211_regdomaincase COUNTRY_CODE_SPAIN :case COUNTRY_CODE_FRANCE :case COUNTRY_CODE_ISRAEL : -case COUNTRY_CODE_WORLD_WIDE_13 :return &rtl_regdom_12_13;case COUNTRY_CODE_MKK :case COUNTRY_CODE_MKK1 :
@@ -360,6 +359,7 @@ static const struct ieee80211_regdomainreturn &rtl_regdom_14_60_64;case COUNTRY_CODE_GLOBAL_DOMAIN :return &rtl_regdom_14; +case COUNTRY_CODE_WORLD_WIDE_13 :case COUNTRY_CODE_WORLD_WIDE_13_5G_ALL :return &rtl_regdom_12_13_5g_all;default :
Greg Kroah-Hartman
maintainerPATCH 114/117 zram/zcomp: use GFP_NOIO to allocate streams
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergey Senozhatsky <[email protected]>
commit 3d5fe03a3ea013060ebba2a811aeb0f23f56aefa upstream.
We can end up allocating a new compression stream with GFP_KERNEL from within the IO path, which may result is nested (recursive) IO operations. That can introduce problems if the IO path in question is a reclaimer, holding some locks that will deadlock nested IOs.
Allocate streams and working memory using GFP_NOIO flag, forbidding recursive IO and FS operations.
An example:
inconsistent {IN-RECLAIM_FS-W} -> {RECLAIM_FS-ON-W} usage. git/20158 [HC0[0]:SC0[0]:HE1:SE1] takes:
(jbd2_handle){+.+.?.}, at: start_this_handle+0x4ca/0x555
{IN-RECLAIM_FS-W} state was registered at:
__lock_acquire+0x8da/0x117b
lock_acquire+0x10c/0x1a7
start_this_handle+0x52d/0x555
jbd2__journal_start+0xb4/0x237
__ext4_journal_start_sb+0x108/0x17e
ext4_dirty_inode+0x32/0x61
__mark_inode_dirty+0x16b/0x60c
iput+0x11e/0x274
__dentry_kill+0x148/0x1b8
shrink_dentry_list+0x274/0x44a
prune_dcache_sb+0x4a/0x55
super_cache_scan+0xfc/0x176
shrink_slab.part.14.constprop.25+0x2a2/0x4d3
shrink_zone+0x74/0x140
kswapd+0x6b7/0x930
kthread+0x107/0x10f
ret_from_fork+0x3f/0x70
irq event stamp: 138297
hardirqs last enabled at (138297): debug_check_no_locks_freed+0x113/0x12f
hardirqs last disabled at (138296): debug_check_no_locks_freed+0x33/0x12f
softirqs last enabled at (137818): __do_softirq+0x2d3/0x3e9
softirqs last disabled at (137813): irq_exit+0x41/0x95other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(jbd2_handle);
<Interrupt>
lock(jbd2_handle); *** DEADLOCK ***
5 locks held by git/20158:
#0: (sb_writers#7){.+.+.+}, at: [<ffffffff81155411>] mnt_want_write+0x24/0x4b
#1: (&type->i_mutex_dir_key#2/1){+.+.+.}, at: [<ffffffff81145087>] lock_rename+0xd9/0xe3
#2: (&sb->s_type->i_mutex_key#11){+.+.+.}, at: [<ffffffff8114f8e2>] lock_two_nondirectories+0x3f/0x6b
#3: (&sb->s_type->i_mutex_key#11/4){+.+.+.}, at: [<ffffffff8114f909>] lock_two_nondirectories+0x66/0x6b
#4: (jbd2_handle){+.+.?.}, at: [<ffffffff811e31db>] start_this_handle+0x4ca/0x555 stack backtrace:
CPU: 2 PID: 20158 Comm: git Not tainted 4.1.0-rc7-next-20150615-dbg-00016-g8bdf555-dirty #211
Call Trace:
dump_stack+0x4c/0x6e
mark_lock+0x384/0x56d
mark_held_locks+0x5f/0x76
lockdep_trace_alloc+0xb2/0xb5
kmem_cache_alloc_trace+0x32/0x1e2
zcomp_strm_alloc+0x25/0x73 [zram]
zcomp_strm_multi_find+0xe7/0x173 [zram]
zcomp_strm_find+0xc/0xe [zram]
zram_bvec_rw+0x2ca/0x7e0 [zram]
zram_make_request+0x1fa/0x301 [zram]
generic_make_request+0x9c/0xdb
submit_bio+0xf7/0x120
ext4_io_submit+0x2e/0x43
ext4_bio_write_page+0x1b7/0x300
mpage_submit_page+0x60/0x77
mpage_map_and_submit_buffers+0x10f/0x21d
ext4_writepages+0xc8c/0xe1b
do_writepages+0x23/0x2c
__filemap_fdatawrite_range+0x84/0x8b
filemap_flush+0x1c/0x1e
ext4_alloc_da_blocks+0xb8/0x117
ext4_rename+0x132/0x6dc
? mark_held_locks+0x5f/0x76
ext4_rename2+0x29/0x2b
vfs_rename+0x540/0x636
SyS_renameat2+0x359/0x44d
SyS_rename+0x1e/0x20
entry_SYSCALL_64_fastpath+0x12/0x6f--- drivers/block/zram/zcomp.c | 4 ++-- drivers/block/zram/zcomp_lz4.c | 2 +- drivers/block/zram/zcomp_lzo.c | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-)
drivers/block/zram/zcomp.c +2 -2
@@ -76,7 +76,7 @@ static void zcomp_strm_free(struct zcomp*/ static struct zcomp_strm *zcomp_strm_alloc (struct zcomp *comp) { -struct zcomp_strm *zstrm =kmalloc (sizeof (*zstrm),GFP_KERNEL ); +struct zcomp_strm *zstrm =kmalloc (sizeof (*zstrm),GFP_NOIO );if (!zstrm)return NULL ;
@@ -85,7 +85,7 @@ static struct zcomp_strm *zcomp_strm_all* allocate 2 pages. 1 for compressed data, plus 1 extra for the * case when compressed size is larger than the original one */ - zstrm->buffer = (void *)__get_free_pages (GFP_KERNEL | __GFP_ZERO,1 ); + zstrm->buffer = (void *)__get_free_pages (GFP_NOIO | __GFP_ZERO,1 );if (!zstrm->private || !zstrm->buffer) {zcomp_strm_free (comp, zstrm); zstrm =NULL ;
drivers/block/zram/zcomp_lz4.c +1 -1
@@ -15,7 +15,7 @@static void *zcomp_lz4_create (void ) { -return kzalloc (LZ4_MEM_COMPRESS ,GFP_KERNEL ); +return kzalloc (LZ4_MEM_COMPRESS ,GFP_NOIO ); }static void zcomp_lz4_destroy (void *private)
drivers/block/zram/zcomp_lzo.c +1 -1
@@ -15,7 +15,7 @@static void *lzo_create (void ) { -return kzalloc (LZO1X_MEM_COMPRESS ,GFP_KERNEL ); +return kzalloc (LZO1X_MEM_COMPRESS ,GFP_NOIO ); }static void lzo_destroy (void *private)
Greg Kroah-Hartman
maintainerPATCH 115/117 zram: try vmalloc() after kmalloc()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kyeongdon Kim <[email protected]>
commit d913897abace843bba20249f3190167f7895e9c3 upstream.
When we're using LZ4 multi compression streams for zram swap, we found out page allocation failure message in system running test. That was not only once, but a few(2 - 5 times per test). Also, some failure cases were continually occurring to try allocation order 3.
In order to make parallel compression private data, we should call kzalloc() with order 2/3 in runtime(lzo/lz4). But if there is no order 2/3 size memory to allocate in that time, page allocation fails. This patch makes to use vmalloc() as fallback of kmalloc(), this prevents page alloc failure warning.
After using this, we never found warning message in running test, also It could reduce process startup latency about 60-120ms in each case.
For reference a call trace :
Binder_1: page allocation failure: order:3, mode:0x10c0d0
CPU: 0 PID: 424 Comm: Binder_1 Tainted: GW 3.10.49-perf-g991d02b-dirty #20
Call trace:
dump_backtrace+0x0/0x270
show_stack+0x10/0x1c
dump_stack+0x1c/0x28
warn_alloc_failed+0xfc/0x11c
__alloc_pages_nodemask+0x724/0x7f0
__get_free_pages+0x14/0x5c
kmalloc_order_trace+0x38/0xd8
zcomp_lz4_create+0x2c/0x38
zcomp_strm_alloc+0x34/0x78
zcomp_strm_multi_find+0x124/0x1ec
zcomp_strm_find+0xc/0x18
zram_bvec_rw+0x2fc/0x780
zram_make_request+0x25c/0x2d4
generic_make_request+0x80/0xbc
submit_bio+0xa4/0x15c
__swap_writepage+0x218/0x230
swap_writepage+0x3c/0x4c
shrink_page_list+0x51c/0x8d0
shrink_inactive_list+0x3f8/0x60c
shrink_lruvec+0x33c/0x4cc
shrink_zone+0x3c/0x100
try_to_free_pages+0x2b8/0x54c
__alloc_pages_nodemask+0x514/0x7f0
__get_free_pages+0x14/0x5c
proc_info_read+0x50/0xe4
vfs_read+0xa0/0x12c
SyS_read+0x44/0x74
DMA: 3397*4kB (MC) 26*8kB (RC) 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB
0*512kB 0*1024kB 0*2048kB 0*4096kB = 13796kBSergey Senozhatsky <[email protected]>
--- drivers/block/zram/zcomp_lz4.c | 23 +++++++++++++++++++++-- drivers/block/zram/zcomp_lzo.c | 23 +++++++++++++++++++++-- 2 files changed, 42 insertions(+), 4 deletions(-)
drivers/block/zram/zcomp_lz4.c +21 -2
@@ -10,17 +10,36 @@#include <linux/kernel.h> #include <linux/slab.h> #include <linux/lz4.h> +#include <linux/vmalloc.h> +#include <linux/mm.h> #include "zcomp_lz4.h" static void *zcomp_lz4_create (void ) { -return kzalloc (LZ4_MEM_COMPRESS ,GFP_NOIO ); +void *ret; + +/* +* This function can be called in swapout/fs write path +* so we can't use GFP_FS|IO. And it assumes we already +* have at least one stream in zram initialization so we +* don't do best effort to allocate more stream in here. +* A default stream will work well without further multiple +* streams. That's why we use NORETRY | NOWARN. +*/ + ret =kzalloc (LZ4_MEM_COMPRESS ,GFP_NOIO | __GFP_NORETRY | + __GFP_NOWARN); +if (!ret) + ret =__vmalloc (LZ4_MEM_COMPRESS , +GFP_NOIO | __GFP_NORETRY | __GFP_NOWARN | + __GFP_ZERO | __GFP_HIGHMEM, +PAGE_KERNEL ); +return ret; }static void zcomp_lz4_destroy (void *private) { -kfree (private); +kvfree (private); } static int zcomp_lz4_compress(const unsigned char *src, unsigned char *dst,
drivers/block/zram/zcomp_lzo.c +21 -2
@@ -10,17 +10,36 @@#include <linux/kernel.h> #include <linux/slab.h> #include <linux/lzo.h> +#include <linux/vmalloc.h> +#include <linux/mm.h> #include "zcomp_lzo.h" static void *lzo_create (void ) { -return kzalloc (LZO1X_MEM_COMPRESS ,GFP_NOIO ); +void *ret; + +/* +* This function can be called in swapout/fs write path +* so we can't use GFP_FS|IO. And it assumes we already +* have at least one stream in zram initialization so we +* don't do best effort to allocate more stream in here. +* A default stream will work well without further multiple +* streams. That's why we use NORETRY | NOWARN. +*/ + ret =kzalloc (LZO1X_MEM_COMPRESS ,GFP_NOIO | __GFP_NORETRY | + __GFP_NOWARN); +if (!ret) + ret =__vmalloc (LZO1X_MEM_COMPRESS , +GFP_NOIO | __GFP_NORETRY | __GFP_NOWARN | + __GFP_ZERO | __GFP_HIGHMEM, +PAGE_KERNEL ); +return ret; }static void lzo_destroy (void *private) { -kfree (private); +kvfree (private); } static int lzo_compress(const unsigned char *src, unsigned char *dst,
Greg Kroah-Hartman
maintainerPATCH 116/117 zram: dont call idr_remove() from zram_remove()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerome Marchand <[email protected]>
commit 17ec4cd985780a7e30aa45bb8f272237c12502a4 upstream.
The use of idr_remove() is forbidden in the callback functions of idr_for_each(). It is therefore unsafe to call idr_remove in zram_remove().
This patch moves the call to idr_remove() from zram_remove() to hot_remove_store(). In the detroy_devices() path, idrs are removed by idr_destroy(). This solves an use-after-free detected by KASan.
--- drivers/block/zram/zram_drv.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/block/zram/zram_drv.c +4 -3
@@ -1325,7 +1325,6 @@ static int zram_remove(struct zram *zrampr_info ("Removed device: %s\n" , zram->disk->disk_name); -idr_remove (&zram_index_idr, zram->disk->first_minor);blk_cleanup_queue (zram->disk->queue);del_gendisk (zram->disk);put_disk (zram->disk);
@@ -1367,10 +1366,12 @@ static ssize_t hot_remove_store(struct cmutex_lock (&zram_index_mutex); zram =idr_find (&zram_index_idr, dev_id); -if (zram) +if (zram) { ret =zram_remove (zram); -else +idr_remove (&zram_index_idr, dev_id); + }else { ret = -ENODEV ; + }mutex_unlock (&zram_index_mutex);return ret ? ret : count;
Greg Kroah-Hartman
maintainerPATCH 117/117 zsmalloc: fix migrate_zspage-zs_free race condition
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junil Lee <[email protected]>
commit c102f07ca0b04f2cb49cfc161c83f6239d17f491 upstream.
record_obj() in migrate_zspage() does not preserve handle's HANDLE_PIN_BIT, set by find_aloced_obj()->trypin_tag(), and implicitly (accidentally) un-pins the handle, while migrate_zspage() still performs an explicit unpin_tag() on the that handle. This additional explicit unpin_tag() introduces a race condition with zs_free(), which can pin that handle by this time, so the handle becomes un-pinned.
Schematically, it goes like this:
CPU0 CPU1
migrate_zspage
find_alloced_obj
trypin_tag
set HANDLE_PIN_BIT zs_free()
pin_tag()
obj_malloc() -- new object, no tag
record_obj() -- remove HANDLE_PIN_BIT set HANDLE_PIN_BIT
unpin_tag() -- remove zs_free's HANDLE_PIN_BIT
The race condition may result in a NULL pointer dereference:
Unable to handle kernel NULL pointer dereference at virtual address 00000000
CPU: 0 PID: 19001 Comm: CookieMonsterCl Tainted:
PC is at get_zspage_mapping+0x0/0x24
LR is at obj_free.isra.22+0x64/0x128
Call trace:
get_zspage_mapping+0x0/0x24
zs_free+0x88/0x114
zram_free_page+0x64/0xcc
zram_slot_free_notify+0x90/0x108
swap_entry_free+0x278/0x294
free_swap_and_cache+0x38/0x11c
unmap_single_vma+0x480/0x5c8
unmap_vmas+0x44/0x60
exit_mmap+0x50/0x110
mmput+0x58/0xe0
do_exit+0x320/0x8dc
do_group_exit+0x44/0xa8
get_signal+0x538/0x580
do_signal+0x98/0x4b8
do_notify_resume+0x14/0x5cThis patch keeps the lock bit in migration path and update value atomically.
--- mm/zsmalloc.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-)
mm/zsmalloc.c +13 -1
@@ -309,7 +309,12 @@ static void free_handle(struct zs_pool *static void record_obj (unsigned long handle,unsigned long obj) { - *(unsigned long *)handle = obj; +/* +* lsb of @obj represents handle lock while other bits +* represent object value the handle is pointing so +* updating shouldn't do store tearing. +*/ +WRITE_ONCE (*(unsigned long *)handle, obj); }/* zpool driver */
@@ -1635,6 +1640,13 @@ static int migrate_zspage(struct zs_pool free_obj =obj_malloc (d_page, class, handle);zs_object_copy (free_obj, used_obj, class); index++; +/* +* record_obj updates handle's value to free_obj and it will +* invalidate lock bit(ie, HANDLE_PIN_BIT) of handle, which +* breaks synchronization using pin_tag(e,g, zs_free) so +* let's keep the lock bit. +*/ + free_obj |=BIT (HANDLE_PIN_BIT );record_obj (handle, free_obj);unpin_tag (handle);obj_free (pool, class, used_obj);
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.4.2 release. There are 117 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Tue Feb 16 22:21:22 UTC 2016. Anything received after that time might be too late.
Build results:
total: 145 pass: 145 fail: 0 Qemu test results: total: 96 pass: 96 fail: 0
Details are available at http://kerneltests.org/builders.
Guenter
Quoted 5 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.4.2 release. There are 117 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Quoted 7 lines
Responses should be made by Tue Feb 16 22:21:22 UTC 2016. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.2-rc1.gzand the diffstat can be found below.
Compiled and booted on my test system. No dmesg regressions,
thanks,
-- Shuah
Signature · 5 lines
Shuah Khan Sr. Linux Kernel Developer Open Source Innovation Group Samsung Research America (Silicon Valley) [email protected] | (970) 217-8978