4.4.7-stable review
Greg Kroah-Hartman
maintainercover 4.4.7-stable review
This is the start of the stable review cycle for the 4.4.7 release. There are 210 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Tue Apr 12 18:34:54 UTC 2016. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.7-rc1.gz
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.4.7-rc1
Andi Kleen <[email protected]>
perf/x86/intel: Fix PEBS data source interpretation on Nehalem/Westmere
Jiri Olsa <[email protected]>
perf/x86/intel: Use PAGE_SIZE for PEBS buffer size on Core2
Kan Liang <[email protected]>
perf/x86/intel: Fix PEBS warning by only restoring active PMU in pmi
Stephane Eranian <[email protected]>
perf/x86/pebs: Add workaround for broken OVFL status on HSW+
Thomas Gleixner <[email protected]>
sched/cputime: Fix steal time accounting vs. CPU hotplug
Hannes Reinecke <[email protected]>
scsi_common: do not clobber fixed sense information
Lukas Wunner <[email protected]>
PM / sleep: Clear pm_suspend_global_flags upon hibernate
Len Brown <[email protected]>
intel_idle: prevent SKL-H boot failure when C8+C9+C10 enabled
Aaro Koskinen <[email protected]>
mtd: onenand: fix deadlock in onenand_block_markbad
Vlastimil Babka <[email protected]>
mm/page_alloc: prevent merging between isolated and other pageblocks
Joseph Qi <[email protected]>
ocfs2/dlm: fix BUG in dlm_move_lockres_to_recovery_list
Joseph Qi <[email protected]>
ocfs2/dlm: fix race between convert and recovery
Vladis Dronov <[email protected]>
Input: ati_remote2 - fix crashes on detecting device with invalid descriptor
Oliver Neukum <[email protected]>
Input: ims-pcu - sanity check against missing interfaces
Benjamin Tissoires <[email protected]>
Input: synaptics - handle spurious release of trackstick buttons, again
Tejun Heo <[email protected]>
writeback, cgroup: fix use of the wrong bdi_writeback which mismatches the inode
Tejun Heo <[email protected]>
writeback, cgroup: fix premature wb_put() in locked_inode_to_wb_and_lock_list()
Lukas Wunner <[email protected]>
ACPI / PM: Runtime resume devices when waking from hibernate
Ludovic Desroches <[email protected]>
ARM: dts: at91: sama5d4 Xplained: don't disable hsmci regulator
Ludovic Desroches <[email protected]>
ARM: dts: at91: sama5d3 Xplained: don't disable hsmci regulator
J. Bruce Fields <[email protected]>
nfsd: fix deadlock secinfo+readdir compound
J. Bruce Fields <[email protected]>
nfsd4: fix bad bounds checking
Jenny Derzhavetz <[email protected]>
iser-target: Rework connection termination
Jenny Derzhavetz <[email protected]>
iser-target: Separate flows for np listeners and connections cma events
Jenny Derzhavetz <[email protected]>
iser-target: Add new state ISER_CONN_BOUND to isert_conn
Jenny Derzhavetz <[email protected]>
iser-target: Fix identification of login rx descriptor type
Himanshu Madhani <[email protected]>
target: Fix target_release_cmd_kref shutdown comp leak
Eric Anholt <[email protected]>
clk: bcm2835: Fix setting of PLL divider clock rates
Alexander Kochetkov <[email protected]>
clk: rockchip: add hclk_cpubus to the list of rk3188 critical clocks
Heiko Stuebner <[email protected]>
clk: rockchip: rk3368: fix hdmi_cec gate-register
Heiko Stuebner <[email protected]>
clk: rockchip: rk3368: fix parents of video encoder/decoder
Heiko Stuebner <[email protected]>
clk: rockchip: rk3368: fix cpuclk core dividers
Heiko Stuebner <[email protected]>
clk: rockchip: rk3368: fix cpuclk mux bit of big cpu-cluster
Adrian Hunter <[email protected]>
mmc: sdhci: Fix override of timeout clk wrt max_busy_timeout
Russell King <[email protected]>
mmc: sdhci: fix data timeout (part 2)
Russell King <[email protected]>
mmc: sdhci: fix data timeout (part 1)
Magnus Damm <[email protected]>
mmc: mmc_spi: Add Card Detect comments and fix CD GPIO case
Shawn Lin <[email protected]>
mmc: block: fix ABI regression of mmc_blk_ioctl
John Dahlstrom <[email protected]>
ideapad-laptop: Add ideapad Y700 (15) to the no_hw_rfkill DMI list
Guenter Roeck <[email protected]>
MAINTAINERS: Update mailing list and web page for hwmon subsystem
Jiri Kosina <[email protected]>
kbuild/mkspec: fix grub2 installkernel issue
Jan Beulich <[email protected]>
scripts/kconfig: allow building with make 3.80 again
Julia Lawall <[email protected]>
scripts/coccinelle: modernize &
Peter Zijlstra <[email protected]>
bitops: Do not default to __clear_bit() for __clear_bit_unlock()
Steven Rostedt (Red Hat) <[email protected]>
tracing: Fix trace_printk() to print when not using bprintk()
Steven Rostedt (Red Hat) <[email protected]>
tracing: Fix crash from reading trace_pipe with sendfile
Steven Rostedt (Red Hat) <[email protected]>
tracing: Have preempt(irqs)off trace preempt disabled functions
Alex Estrin <[email protected]>
IB/ipoib: fix for rare multicast join race condition
Ken Wang <[email protected]>
drm/amdgpu: include the right version of gmc header files for iceland
Alex Deucher <[email protected]>
drm/amdgpu: disable runtime pm on PX laptops without dGPU power control
Mario Kleiner <[email protected]>
drm/radeon: Don't drop DP 2.7 Ghz link setup on some cards.
Alex Deucher <[email protected]>
drm/radeon: disable runtime pm on PX laptops without dGPU power control
Matti Gottlieb <[email protected]>
iwlwifi: mvm: Fix paging memory leak
Gabriel Krisman Bertazi <[email protected]>
ipr: Fix regression when loading firmware
Insu Yun <[email protected]>
ipr: Fix out-of-bounds null overwrite
Aurelien Jacquiot <[email protected]>
rapidio/rionet: fix deadlock on SMP
Jann Horn <[email protected]>
fs/coredump: prevent fsuid=0 dumps into user-controlled directories
Jan Kiszka <[email protected]>
scripts/gdb: account for changes in module data structure
Seth Forshee <[email protected]>
fuse: Add reference counting for fuse_io_priv
Robert Doebbelin <[email protected]>
fuse: do not use iocb after it may have been freed
Ming Lei <[email protected]>
md: multipath: don't hardcopy bio in .make_request path
NeilBrown <[email protected]>
md/raid5: preserve STRIPE_PREREAD_ACTIVE in break_stripe_batch_list
Shaohua Li <[email protected]>
raid10: include bio_end_io_list in nr_queued to prevent freeze_array hang
Shaohua Li <[email protected]>
RAID5: revert e9e4c377e2f563 to fix a livelock
Shaohua Li <[email protected]>
RAID5: check_reshape() shouldn't call mddev_suspend
Jes Sorensen <[email protected]>
md/raid5: Compare apples to apples (or sectors to sectors)
Nate Dailey <[email protected]>
raid1: include bio_end_io_list in nr_queued to prevent freeze_array hang
Mateusz Guzik <[email protected]>
xfs: fix two memory leaks in xfs_attr_list.c error paths
Nikolay Borisov <[email protected]>
quota: Fix possible GPF due to uninitialised pointers
Vineet Gupta <[email protected]>
ARC: bitops: Remove non relevant comments
Lada Trimasova <[email protected]>
ARC: [BE] readl()/writel() to work in Big Endian CPU configuration
Max Filippov <[email protected]>
xtensa: clear all DBREAKC registers on start
Max Filippov <[email protected]>
xtensa: fix preemption in {clear,copy}_user_highpage
Max Filippov <[email protected]>
xtensa: ISS: don't hang if stdin EOF is reached
Rabin Vincent <[email protected]>
splice: handle zero nr_pages in splice_to_pipe()
Dmitry V. Levin <[email protected]>
vfs: show_vfsstat: do not ignore errors from show_devname method
Vinayak Menon <[email protected]>
of: alloc anywhere from memblock if range not specified
Dmitri Epshtein <[email protected]>
net: mvneta: enable change MAC address when interface is up
Tejun Heo <[email protected]>
cgroup: ignore css_sets associated with dead cgroups during migration
Johan Hedberg <[email protected]>
Bluetooth: Fix potential buffer overflow with Add Advertising
Dmitry Tunin <[email protected]>
Bluetooth: Add new AR3012 ID 0489:e095
Michael S. Tsirkin <[email protected]>
watchdog: rc32434_wdt: fix ioctl error handling
Joshua Hunt <[email protected]>
watchdog: don't run proc_watchdog_update if new value is same as old
Luis R. Rodriguez <[email protected]>
ia64: define ioremap_uc()
Johannes Weiner <[email protected]>
mm: memcontrol: reclaim and OOM kill when shrinking memory.max below usage
Johannes Weiner <[email protected]>
mm: memcontrol: reclaim when shrinking memory.high below usage
Eric Wheeler <[email protected]>
bcache: fix cache_set_flush() NULL pointer dereference on OOM
Eric Wheeler <[email protected]>
bcache: fix race of writeback thread starting before complete initialization
Eric Wheeler <[email protected]>
bcache: cleaned up error handling around register_cache()
Bart Van Assche <[email protected]>
IB/srpt: Simplify srpt_handle_tsk_mgmt()
Bart Van Assche <[email protected]>
brd: Fix discard request processing
OGAWA Hirofumi <[email protected]>
jbd2: fix FS corruption possibility in jbd2_journal_destroy() on umount path
Kamal Mostafa <[email protected]>
tools/hv: Use include/uapi with __EXPORTED_HEADERS__
Takashi Iwai <[email protected]>
ALSA: hda - Fix unconditional GPIO toggle via automute
Hui Wang <[email protected]>
ALSA: hda - fix the mic mute button and led problem for a Lenovo AIO
Takashi Iwai <[email protected]>
ALSA: hda - Don't handle ELD notify from invalid port
Vittorio Gambaletta (VittGam) <[email protected]>
ALSA: intel8x0: Add clock quirk entry for AD1981B on IBM ThinkPad X41.
Takashi Iwai <[email protected]>
ALSA: pcm: Avoid "BUG:" string for warnings again
Takashi Iwai <[email protected]>
ALSA: hda - Apply reboot D3 fix for CX20724 codec, too
Asai Thambi SP <[email protected]>
mtip32xx: Cleanup queued requests after surprise removal
Asai Thambi SP <[email protected]>
mtip32xx: Implement timeout handler
Asai Thambi SP <[email protected]>
mtip32xx: Handle FTL rebuild failure state during device initialization
Asai Thambi SP <[email protected]>
mtip32xx: Handle safe removal during IO
Asai Thambi SP <[email protected]>
mtip32xx: Fix for rmmod crash when drive is in FTL rebuild
Asai Thambi SP <[email protected]>
mtip32xx: Print exact time when an internal command is interrupted
Asai Thambi SP <[email protected]>
mtip32xx: Remove unwanted code from taskfile error handler
Asai Thambi SP <[email protected]>
mtip32xx: Fix broken service thread handling
Asai Thambi SP <[email protected]>
mtip32xx: Avoid issuing standby immediate cmd during FTL rebuild
Tiffany Lin <[email protected]>
media: v4l2-compat-ioctl32: fix missing length copy in put_v4l2_buffer32
Philipp Zabel <[email protected]>
coda: fix first encoded frame payload
Hans de Goede <[email protected]>
bttv: Width must be a multiple of 16 when capturing planar formats
Hans Verkuil <[email protected]>
adv7511: TX_EDID_PRESENT is still 1 after a disconnect
Hans de Goede <[email protected]>
saa7134: Fix bytesperline not being set correctly for planar formats
Sebastian Frias <[email protected]>
8250: use callbacks to access UART_DLL/UART_DLM
Peter Hurley <[email protected]>
net: irda: Fix use-after-free in irtty_open()
Peter Hurley <[email protected]>
tty: Fix GPF in flush_to_ldisc(), part 2
H Hartley Sweeten <[email protected]>
staging: comedi: ni_mio_common: fix the ni_write[blw]() functions
Vladimir Zapolskiy <[email protected]>
staging: android: ion_test: fix check of platform_device_register_simple() error code
Spencer E. Olson <[email protected]>
staging: comedi: ni_tiocmd: change mistaken use of start_src for start_arg
Benjamin Tissoires <[email protected]>
HID: fix hid_ignore_special_drivers module parameter
Benjamin Tissoires <[email protected]>
HID: multitouch: force retrieving of Win8 signature blob
Dmitry Torokhov <[email protected]>
HID: i2c-hid: fix OOB write in i2c_hid_set_or_send_report()
Grazvydas Ignotas <[email protected]>
HID: logitech: fix Dual Action gamepad support
Jarkko Sakkinen <[email protected]>
tpm: fix the cleanup of struct tpm_chip
Harald Hoyer <[email protected]>
tpm_eventlog.c: fix binary_bios_measurements
Jarkko Sakkinen <[email protected]>
tpm_crb: tpm2_shutdown() must be called before tpm_chip_unregister()
Jarkko Sakkinen <[email protected]>
tpm: fix the rollback in tpm_chip_register()
Alexander Usyskin <[email protected]>
mei: bus: check if the device is enabled before data transfer
David Howells <[email protected]>
X.509: Fix leap year handling again
Boris BREZILLON <[email protected]>
crypto: marvell/cesa - forward devm_ioremap_resource() error code
Vladimir Zapolskiy <[email protected]>
crypto: ux500 - fix checks of error code returned by devm_ioremap_resource()
Vladimir Zapolskiy <[email protected]>
crypto: atmel - fix checks of error code returned by devm_ioremap_resource()
Dan Carpenter <[email protected]>
crypto: keywrap - memzero the correct memory
Tom Lendacky <[email protected]>
crypto: ccp - memset request context to zero during import
Tom Lendacky <[email protected]>
crypto: ccp - Don't assume export/import areas are aligned
Tom Lendacky <[email protected]>
crypto: ccp - Limit the amount of information exported
Tom Lendacky <[email protected]>
crypto: ccp - Add hash state import and export support
Dmitry Tunin <[email protected]>
Bluetooth: btusb: Add a new AR3012 ID 13d3:3472
Dmitry Tunin <[email protected]>
Bluetooth: btusb: Add a new AR3012 ID 04ca:3014
Dmitry Tunin <[email protected]>
Bluetooth: btusb: Add new AR3012 ID 13d3:3395
Vladis Dronov <[email protected]>
ALSA: usb-audio: Fix double-free in error paths after snd_usb_add_audio_stream() call
Takashi Iwai <[email protected]>
ALSA: usb-audio: Minor code cleanup in create_fixed_stream_quirk()
Victor Clément <[email protected]>
ALSA: usb-audio: add Microsoft HD-5001 to quirks
Takashi Iwai <[email protected]>
ALSA: usb-audio: Add sanity checks for endpoint accesses
Takashi Iwai <[email protected]>
ALSA: usb-audio: Fix NULL dereference in create_fixed_stream_quirk()
Josh Boyer <[email protected]>
Input: powermate - fix oops with malicious USB descriptors
Hans de Goede <[email protected]>
pwc: Add USB id for Philips Spc880nc webcam
Bjørn Mork <[email protected]>
USB: option: add "D-Link DWM-221 B1" device id
Josh Boyer <[email protected]>
USB: serial: ftdi_sio: Add support for ICP DAS I-756xU devices
Martyn Welch <[email protected]>
USB: serial: cp210x: Adding GE Healthcare Device ID
Oliver Neukum <[email protected]>
USB: cypress_m8: add endpoint sanity check
Oliver Neukum <[email protected]>
USB: digi_acceleport: do sanity checking for the number of ports
Oliver Neukum <[email protected]>
USB: mct_u232: add sanity checking in probe
Oliver Neukum <[email protected]>
USB: usb_driver_claim_interface: add sanity checking
Josh Boyer <[email protected]>
USB: iowarrior: fix oops with malicious USB descriptors
Oliver Neukum <[email protected]>
USB: cdc-acm: more sanity checking
Hans de Goede <[email protected]>
USB: uas: Reduce can_queue to MAX_CMNDS
Oliver Neukum <[email protected]>
usb: hub: fix a typo in hub_port_init() leading to wrong logic
Oliver Neukum <[email protected]>
usb: retry reset if a device times out
Bryn M. Reeves <[email protected]>
dm: fix rq_end_stats() NULL pointer in dm_requeue_original_request()
Joe Thornber <[email protected]>
dm cache: make sure every metadata function checks fail_io
Joe Thornber <[email protected]>
dm thin metadata: don't issue prefetches if a transaction abort has failed
Mike Snitzer <[email protected]>
dm: fix excessive dm-mq context switching
DingXiang <[email protected]>
dm snapshot: disallow the COW and origin devices from being identical
Jerry Hoemann <[email protected]>
libnvdimm: Fix security issue with DSM IOCTL.
Alan <[email protected]>
aic7xxx: Fix queue depth handling
Maurizio Lombardi <[email protected]>
be2iscsi: set the boot_kset pointer to NULL in case of failure
Vitaly Kuznetsov <[email protected]>
scsi: storvsc: fix SRB_STATUS_ABORTED handling
Martin K. Petersen <[email protected]>
sd: Fix discard granularity when LBPRZ=1
Raghava Aditya Renukunta <[email protected]>
aacraid: Set correct msix count for EEH recovery
Raghava Aditya Renukunta <[email protected]>
aacraid: Fix memory leak in aac_fib_map_free
Raghava Aditya Renukunta <[email protected]>
aacraid: Fix RRQ overload
Douglas Gilbert <[email protected]>
sg: fix dxferp in from_to case
Nadav Amit <[email protected]>
x86/mm: TLB_REMOTE_SEND_IPI should count pages
Andy Lutomirski <[email protected]>
x86/iopl: Fix iopl capability check on Xen PV
Andy Lutomirski <[email protected]>
x86/iopl/64: Properly context-switch IOPL on Xen PV
Dave Jones <[email protected]>
x86/apic: Fix suspicious RCU usage in smp_trace_call_function_interrupt()
Thomas Gleixner <[email protected]>
x86/irq: Cure live lock in fixup_irqs()
Lorenzo Pieralisi <[email protected]>
PCI: ACPI: IA64: fix IO port generic range check
Bjorn Helgaas <[email protected]>
PCI: Disable IO/MEM decoding for devices with non-compliant BARs
Phil Elwell <[email protected]>
pinctrl-bcm2835: Fix cut-and-paste error in "pull" parsing
Sebastian Ott <[email protected]>
s390/pci: enforce fmb page boundary rule
Heiko Carstens <[email protected]>
s390/cpumf: add missing lpp magic initialization
Martin Schwidefsky <[email protected]>
s390: fix floating pointer register corruption (again)
Dan Carpenter <[email protected]>
EDAC, amd64_edac: Shift wrapping issue in f1x_get_norm_dct_addr()
Tony Luck <[email protected]>
EDAC/sb_edac: Fix computation of channel address
David Hildenbrand <[email protected]>
sched/preempt, sh: kmap_coherent relies on disabled preemption
Chris Friesen <[email protected]>
sched/cputime: Fix steal_account_process_tick() to always return jiffies
Zhang Rui <[email protected]>
Thermal: Ignore invalid trip points
Jiri Olsa <[email protected]>
perf tools: Fix python extension build
Wang Nan <[email protected]>
perf tools: Fix checking asprintf return value
Andi Kleen <[email protected]>
perf tools: Dont stop PMU parsing on alias parse error
Alexander Shishkin <[email protected]>
perf/core: Fix perf_sched_count derailment
Paolo Bonzini <[email protected]>
KVM: VMX: fix nested vpid for old KVM guests
Paolo Bonzini <[email protected]>
KVM: VMX: avoid guest hang on invalid invvpid instruction
Paolo Bonzini <[email protected]>
KVM: VMX: avoid guest hang on invalid invept instruction
Paolo Bonzini <[email protected]>
KVM: fix spin_lock_init order on x86
Radim Krčmář <[email protected]>
KVM: i8254: change PIT discard tick policy
Paolo Bonzini <[email protected]>
KVM: x86: fix missed hardware breakpoints
Bjorn Helgaas <[email protected]>
x86/PCI: Mark Broadwell-EP Home Agent & PCU as having non-compliant BARs
Stephane Eranian <[email protected]>
perf/x86/intel: Add definition for PT PMI bit
Andy Lutomirski <[email protected]>
x86/entry/compat: Keep TS_COMPAT set during signal delivery
Borislav Petkov <[email protected]>
x86/microcode: Untangle from BLK_DEV_INITRD
Borislav Petkov <[email protected]>
x86/microcode/intel: Make early loader look for builtin microcode too
Chris Paterson <[email protected]>
mmc: sh_mmcif: Correct TX DMA channel allocation
Arnd Bergmann <[email protected]>
mmc: sh_mmcif: rework dma channel handling
Arnd Bergmann <[email protected]>
ASoC: samsung: pass DMA channels as pointers
Thierry Reding <[email protected]>
regulator: core: Fix nested locking of supplies
Arnd Bergmann <[email protected]>
regulator: core: avoid unused variable warning
Christian Borntraeger <[email protected]>
s390/cpumf: Fix lpp detection
-------------
Diffstat:
MAINTAINERS | 96 ++++---- Makefile | 4 +- arch/arc/include/asm/bitops.h | 15 -- arch/arc/include/asm/io.h | 18 +- arch/arm/boot/dts/at91-sama5d3_xplained.dts | 1 + arch/arm/boot/dts/at91-sama5d4_xplained.dts | 1 + arch/arm/mach-s3c64xx/dev-audio.c | 41 ++-- arch/arm/mach-s3c64xx/include/mach/dma.h | 52 ++--- arch/arm/plat-samsung/devs.c | 11 +- arch/ia64/include/asm/io.h | 1 + arch/s390/include/asm/pci.h | 2 +- arch/s390/kernel/entry.S | 106 +-------- arch/s390/kernel/head64.S | 2 +- arch/s390/kernel/setup.c | 1 + arch/s390/pci/pci.c | 5 +- arch/sh/mm/kmap.c | 2 + arch/um/drivers/mconsole_kern.c | 2 +- arch/x86/Kconfig | 27 +-- arch/x86/entry/common.c | 23 +- arch/x86/include/asm/apic.h | 2 +- arch/x86/include/asm/hw_irq.h | 1 + arch/x86/include/asm/microcode.h | 26 +++ arch/x86/include/asm/perf_event.h | 1 + arch/x86/include/asm/xen/hypervisor.h | 2 + arch/x86/kernel/apic/vector.c | 88 +++++-- arch/x86/kernel/cpu/microcode/intel.c | 38 +-- arch/x86/kernel/cpu/perf_event.c | 13 ++ arch/x86/kernel/cpu/perf_event.h | 3 + arch/x86/kernel/cpu/perf_event_intel.c | 27 ++- arch/x86/kernel/cpu/perf_event_intel_ds.c | 24 +- arch/x86/kernel/cpu/perf_event_knc.c | 4 +- arch/x86/kernel/ioport.c | 12 +- arch/x86/kernel/process_64.c | 12 + arch/x86/kvm/i8254.c | 12 +- arch/x86/kvm/vmx.c | 16 +- arch/x86/kvm/x86.c | 1 + arch/x86/mm/tlb.c | 12 +- arch/x86/pci/fixup.c | 7 + arch/x86/xen/enlighten.c | 2 +- arch/xtensa/kernel/head.S | 2 +- arch/xtensa/mm/cache.c | 8 +- arch/xtensa/platforms/iss/console.c | 10 +- block/blk-core.c | 2 +- crypto/asymmetric_keys/x509_cert_parser.c | 8 +- crypto/keywrap.c | 4 +- drivers/acpi/resource.c | 14 +- drivers/acpi/sleep.c | 1 + drivers/block/brd.c | 2 +- drivers/block/mtip32xx/mtip32xx.c | 267 +++++++++++++++++----- drivers/block/mtip32xx/mtip32xx.h | 11 +- drivers/bluetooth/ath3k.c | 8 + drivers/bluetooth/btusb.c | 4 + drivers/char/tpm/tpm-chip.c | 14 +- drivers/char/tpm/tpm_crb.c | 4 +- drivers/char/tpm/tpm_eventlog.c | 14 +- drivers/clk/bcm/clk-bcm2835.c | 12 +- drivers/clk/rockchip/clk-rk3188.c | 1 + drivers/clk/rockchip/clk-rk3368.c | 48 ++-- drivers/crypto/atmel-aes.c | 4 +- drivers/crypto/atmel-sha.c | 4 +- drivers/crypto/atmel-tdes.c | 4 +- drivers/crypto/ccp/ccp-crypto-aes-cmac.c | 36 +++ drivers/crypto/ccp/ccp-crypto-sha.c | 40 ++++ drivers/crypto/ccp/ccp-crypto.h | 22 ++ drivers/crypto/marvell/cesa.c | 2 +- drivers/crypto/ux500/cryp/cryp_core.c | 4 +- drivers/crypto/ux500/hash/hash_core.c | 4 +- drivers/edac/amd64_edac.c | 2 +- drivers/edac/sb_edac.c | 26 +-- drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c | 8 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 8 +- drivers/gpu/drm/amd/amdgpu/sdma_v2_4.c | 4 +- drivers/gpu/drm/radeon/atombios_encoders.c | 6 +- drivers/gpu/drm/radeon/radeon_atpx_handler.c | 8 +- drivers/gpu/drm/radeon/radeon_device.c | 8 +- drivers/hid/hid-core.c | 8 +- drivers/hid/hid-multitouch.c | 5 + drivers/hid/i2c-hid/i2c-hid.c | 16 +- drivers/idle/intel_idle.c | 108 +++++++-- drivers/infiniband/ulp/ipoib/ipoib_multicast.c | 24 +- drivers/infiniband/ulp/isert/ib_isert.c | 122 +++++----- drivers/infiniband/ulp/isert/ib_isert.h | 2 +- drivers/infiniband/ulp/srpt/ib_srpt.c | 59 +---- drivers/input/misc/ati_remote2.c | 36 ++- drivers/input/misc/ims-pcu.c | 4 + drivers/input/misc/powermate.c | 3 + drivers/input/mouse/synaptics.c | 5 +- drivers/md/bcache/super.c | 46 ++-- drivers/md/dm-cache-metadata.c | 98 ++++---- drivers/md/dm-cache-metadata.h | 4 +- drivers/md/dm-cache-target.c | 12 +- drivers/md/dm-snap.c | 9 + drivers/md/dm-table.c | 36 ++- drivers/md/dm-thin-metadata.c | 5 +- drivers/md/dm.c | 15 +- drivers/md/multipath.c | 4 +- drivers/md/raid1.c | 7 +- drivers/md/raid10.c | 7 +- drivers/md/raid5.c | 51 +++-- drivers/md/raid5.h | 4 +- drivers/media/i2c/adv7511.c | 21 +- drivers/media/pci/bt8xx/bttv-driver.c | 26 ++- drivers/media/pci/saa7134/saa7134-video.c | 18 +- drivers/media/platform/coda/coda-bit.c | 2 +- drivers/media/usb/pwc/pwc-if.c | 6 + drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 21 +- drivers/misc/mei/bus.c | 9 + drivers/mmc/card/block.c | 24 +- drivers/mmc/host/mmc_spi.c | 6 + drivers/mmc/host/sdhci.c | 23 +- drivers/mmc/host/sh_mmcif.c | 84 +++---- drivers/mtd/onenand/onenand_base.c | 3 +- drivers/net/ethernet/marvell/mvneta.c | 2 +- drivers/net/irda/irtty-sir.c | 10 - drivers/net/rionet.c | 4 +- drivers/net/wireless/iwlwifi/mvm/fw.c | 4 +- drivers/net/wireless/iwlwifi/mvm/mvm.h | 3 + drivers/net/wireless/iwlwifi/mvm/ops.c | 2 + drivers/nvdimm/bus.c | 8 +- drivers/of/of_reserved_mem.c | 4 +- drivers/pci/probe.c | 14 ++ drivers/pinctrl/bcm/pinctrl-bcm2835.c | 2 +- drivers/platform/x86/ideapad-laptop.c | 14 ++ drivers/regulator/core.c | 22 +- drivers/scsi/aacraid/aacraid.h | 2 + drivers/scsi/aacraid/commsup.c | 37 ++- drivers/scsi/aacraid/linit.c | 12 +- drivers/scsi/aacraid/src.c | 30 +-- drivers/scsi/aic7xxx/aic7xxx_osm.c | 1 + drivers/scsi/be2iscsi/be_main.c | 1 + drivers/scsi/ipr.c | 10 +- drivers/scsi/scsi_common.c | 12 +- drivers/scsi/sd.c | 2 +- drivers/scsi/sg.c | 3 +- drivers/scsi/storvsc_drv.c | 5 +- drivers/staging/android/ion/ion_test.c | 4 +- drivers/staging/comedi/drivers/ni_mio_common.c | 12 +- drivers/staging/comedi/drivers/ni_tiocmd.c | 2 +- drivers/target/target_core_transport.c | 2 - drivers/thermal/thermal_core.c | 13 +- drivers/tty/serial/8250/8250_port.c | 18 +- drivers/usb/class/cdc-acm.c | 3 + drivers/usb/core/driver.c | 6 +- drivers/usb/core/hub.c | 16 +- drivers/usb/misc/iowarrior.c | 6 + drivers/usb/serial/cp210x.c | 1 + drivers/usb/serial/cypress_m8.c | 11 +- drivers/usb/serial/digi_acceleport.c | 19 ++ drivers/usb/serial/ftdi_sio.c | 4 + drivers/usb/serial/ftdi_sio_ids.h | 8 + drivers/usb/serial/mct_u232.c | 9 +- drivers/usb/serial/option.c | 2 + drivers/usb/storage/uas.c | 2 +- drivers/watchdog/rc32434_wdt.c | 2 +- fs/coredump.c | 30 ++- fs/fhandle.c | 2 +- fs/fs-writeback.c | 37 +-- fs/fuse/cuse.c | 4 +- fs/fuse/file.c | 33 ++- fs/fuse/fuse_i.h | 9 + fs/jbd2/journal.c | 17 +- fs/nfsd/nfs4proc.c | 1 + fs/nfsd/nfs4xdr.c | 13 +- fs/ocfs2/dlm/dlmconvert.c | 24 +- fs/ocfs2/dlm/dlmrecovery.c | 1 - fs/open.c | 6 +- fs/proc_namespace.c | 2 + fs/quota/dquot.c | 3 +- fs/splice.c | 3 + fs/xfs/xfs_attr_list.c | 19 +- include/asm-generic/bitops/lock.h | 14 +- include/linux/cgroup-defs.h | 3 + include/linux/device-mapper.h | 2 + include/linux/fs.h | 2 +- include/linux/kernel.h | 6 +- include/linux/pci.h | 1 + include/linux/platform_data/asoc-s3c.h | 4 + include/linux/thermal.h | 2 + include/linux/tty.h | 2 +- kernel/cgroup.c | 20 +- kernel/events/core.c | 7 +- kernel/power/hibernate.c | 1 + kernel/sched/core.c | 1 + kernel/sched/cputime.c | 14 +- kernel/sched/sched.h | 13 ++ kernel/sysctl_binary.c | 2 +- kernel/trace/trace.c | 5 +- kernel/trace/trace_irqsoff.c | 8 +- kernel/trace/trace_printk.c | 3 + kernel/watchdog.c | 9 +- mm/memcontrol.c | 44 +++- mm/page_alloc.c | 46 ++-- net/bluetooth/mgmt.c | 4 + scripts/coccinelle/iterators/use_after_iter.cocci | 2 +- scripts/gdb/linux/modules.py | 5 +- scripts/gdb/linux/symbols.py | 2 +- scripts/kconfig/Makefile | 4 +- scripts/package/mkspec | 8 +- sound/core/pcm_lib.c | 2 +- sound/pci/hda/patch_cirrus.c | 8 +- sound/pci/hda/patch_conexant.c | 7 +- sound/pci/hda/patch_hdmi.c | 4 + sound/pci/hda/patch_realtek.c | 1 + sound/pci/intel8x0.c | 1 + sound/soc/samsung/ac97.c | 26 +-- sound/soc/samsung/dma.h | 2 +- sound/soc/samsung/dmaengine.c | 4 +- sound/soc/samsung/i2s.c | 26 +-- sound/soc/samsung/pcm.c | 20 +- sound/soc/samsung/s3c2412-i2s.c | 4 +- sound/soc/samsung/s3c24xx-i2s.c | 4 +- sound/soc/samsung/spdif.c | 10 +- sound/usb/clock.c | 2 + sound/usb/endpoint.c | 3 + sound/usb/mixer_quirks.c | 4 + sound/usb/pcm.c | 2 + sound/usb/quirks.c | 27 ++- sound/usb/stream.c | 6 +- tools/hv/Makefile | 2 + tools/perf/util/parse-events.c | 6 +- tools/perf/util/pmu.c | 15 +- tools/perf/util/setup.py | 4 + virt/kvm/kvm_main.c | 21 +- 223 files changed, 2112 insertions(+), 1151 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/210 s390/cpumf: Fix lpp detection
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Borntraeger <[email protected]>
commit 7a76aa95f6f6682db5629449d763251d1c9f8c4e upstream.
we have to check bit 40 of the facility list before issuing LPP and not bit 48. Otherwise a guest running on a system with "The decimal-floating-point zoned-conversion facility" and without the "The set-program-parameters facility" might crash on an lpp instruction.
--- arch/s390/kernel/head64.S | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/s390/kernel/head64.S +1 -1
@@ -16,7 +16,7 @@ __HEAD ENTRY(startup_continue) - tm __LC_STFL_FAC_LIST+6,0x80 # LPP available ? + tm __LC_STFL_FAC_LIST+5,0x80 # LPP available ? jz 0f xc __LC_LPP+1(7,0),__LC_LPP+1 # clear lpp and current_pid mvi __LC_LPP,0x80 # and set LPP_MAGIC
Greg Kroah-Hartman
maintainerPATCH 2/210 regulator: core: avoid unused variable warning
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
commit fa731ac7ea04a7d3a5c6d2f568132478c02a83b3 upstream.
The second argument of the mutex_lock_nested() helper is only evaluated if CONFIG_DEBUG_LOCK_ALLOC is set. Otherwise we get this build warning for the new regulator_lock_supply function:
drivers/regulator/core.c: In function 'regulator_lock_supply':drivers/regulator/core.c:142:6: warning: unused variable 'i' [-Wunused-variable]
To avoid the warning, this restructures the code to make it both simpler and to move the 'i++' outside of the mutex_lock_nested call, where it is now always used and the variable is not flagged as unused.
We had some discussion about changing mutex_lock_nested to an inline function, which would make the code do the right thing here, but in the end decided against it, in order to guarantee that mutex_lock_nested() does not introduced overhead without CONFIG_DEBUG_LOCK_ALLOC.
--- drivers/regulator/core.c | 14 +++----------- 1 file changed, 3 insertions(+), 11 deletions(-)
drivers/regulator/core.c +3 -11
@@ -138,18 +138,10 @@ static bool have_full_constraints(void)*/ static void regulator_lock_supply (struct regulator_dev *rdev) { -struct regulator *supply; -int i =0 ; +int i; -while (1 ) { -mutex_lock_nested (&rdev->mutex, i++); - supply = rdev->supply; - -if (!rdev->supply) -return ; - - rdev = supply->rdev; - } +for (i =0 ; rdev->supply; rdev = rdev->supply->rdev, i++) +mutex_lock_nested (&rdev->mutex, i); }/**
Greg Kroah-Hartman
maintainerPATCH 3/210 regulator: core: Fix nested locking of supplies
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thierry Reding <[email protected]>
commit 70a7fb80e85ae7f78f8e90cec3fbd862ea6a4d4b upstream.
Commit fa731ac7ea04 ("regulator: core: avoid unused variable warning") introduced a subtle change in how supplies are locked. Where previously code was always locking the regulator of the current iteration, the new implementation only locks the regulator if it has a supply. For any given power tree that means that the root will never get locked.
On the other hand the regulator_unlock_supply() will still release all the locks, which in turn causes the lock debugging code to warn about a mutex being unlocked which wasn't locked.
--- drivers/regulator/core.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
drivers/regulator/core.c +9 -1
@@ -132,6 +132,14 @@ static bool have_full_constraints(void)return has_full_constraints ||of_have_populated_dt (); } +static inline struct regulator_dev *rdev_get_supply (struct regulator_dev *rdev) +{ +if (rdev && rdev->supply) +return rdev->supply->rdev; + +return NULL ; +} +/** * regulator_lock_supply - lock a regulator and its supplies * @rdev: regulator source
@@ -140,7 +148,7 @@ static void regulator_lock_supply(struct {int i; -for (i =0 ; rdev->supply; rdev = rdev->supply->rdev, i++) +for (i =0 ; rdev->supply; rdev =rdev_get_supply (rdev), i++)mutex_lock_nested (&rdev->mutex, i); }
Greg Kroah-Hartman
maintainerPATCH 4/210 ASoC: samsung: pass DMA channels as pointers
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
commit b9a1a743818ea3265abf98f9431623afa8c50c86 upstream.
ARM64 allmodconfig produces a bunch of warnings when building the samsung ASoC code:
sound/soc/samsung/dmaengine.c: In function 'samsung_asoc_init_dma_data':sound/soc/samsung/dmaengine.c:53:32: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
playback_data->filter_data = (void *)playback->channel;sound/soc/samsung/dmaengine.c:60:31: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
capture_data->filter_data = (void *)capture->channel;
We could easily shut up the warning by adding an intermediate cast, but there is a bigger underlying problem: The use of IORESOURCE_DMA to pass data from platform code to device drivers is dubious to start with, as what we really want is a pointer that can be passed into a filter function.
Note that on s3c64xx, the pl08x DMA data is already a pointer, but gets cast to resource_size_t so we can pass it as a resource, and it then gets converted back to a pointer. In contrast, the data we pass for s3c24xx is an index into a device specific table, and we artificially convert that into a pointer for the filter function.
--- arch/arm/mach-s3c64xx/dev-audio.c | 41 +++++++++++++----------- arch/arm/mach-s3c64xx/include/mach/dma.h | 52 +++++++++++++++---------------- arch/arm/plat-samsung/devs.c | 11 ++++-- include/linux/platform_data/asoc-s3c.h | 4 ++ sound/soc/samsung/ac97.c | 26 ++------------- sound/soc/samsung/dma.h | 2 - sound/soc/samsung/dmaengine.c | 4 +- sound/soc/samsung/i2s.c | 26 ++------------- sound/soc/samsung/pcm.c | 20 ++--------- sound/soc/samsung/s3c2412-i2s.c | 4 +- sound/soc/samsung/s3c24xx-i2s.c | 4 +- sound/soc/samsung/spdif.c | 10 +---- 12 files changed, 84 insertions(+), 120 deletions(-)
arch/arm/mach-s3c64xx/dev-audio.c +23 -18
@@ -54,12 +54,12 @@ static int s3c64xx_i2s_cfg_gpio(struct pstatic struct resource s3c64xx_iis0_resource[] = { [0 ] =DEFINE_RES_MEM (S3C64XX_PA_IIS0 ,SZ_256 ), - [1 ] =DEFINE_RES_DMA (DMACH_I2S0_OUT ), - [2 ] =DEFINE_RES_DMA (DMACH_I2S0_IN ), }; -static struct s3c_audio_pdata i2sv3_pdata = { +static struct s3c_audio_pdata i2s0_pdata = { .cfg_gpio = s3c64xx_i2s_cfg_gpio, + .dma_playback =DMACH_I2S0_OUT , + .dma_capture =DMACH_I2S0_IN , };struct platform_device s3c64xx_device_iis0 = {
@@ -68,15 +68,19 @@ struct platform_device s3c64xx_device_ii .num_resources = ARRAY_SIZE(s3c64xx_iis0_resource), .resource = s3c64xx_iis0_resource, .dev = { - .platform_data = &i2sv3_pdata, + .platform_data = &i2s0_pdata, }, };EXPORT_SYMBOL (s3c64xx_device_iis0);static struct resource s3c64xx_iis1_resource[] = { [0 ] =DEFINE_RES_MEM (S3C64XX_PA_IIS1 ,SZ_256 ), - [1 ] =DEFINE_RES_DMA (DMACH_I2S1_OUT ), - [2 ] =DEFINE_RES_DMA (DMACH_I2S1_IN ), +}; + +static struct s3c_audio_pdata i2s1_pdata = { + .cfg_gpio = s3c64xx_i2s_cfg_gpio, + .dma_playback =DMACH_I2S1_OUT , + .dma_capture =DMACH_I2S1_IN , };struct platform_device s3c64xx_device_iis1 = {
@@ -85,19 +89,19 @@ struct platform_device s3c64xx_device_ii .num_resources = ARRAY_SIZE(s3c64xx_iis1_resource), .resource = s3c64xx_iis1_resource, .dev = { - .platform_data = &i2sv3_pdata, + .platform_data = &i2s1_pdata, }, };EXPORT_SYMBOL (s3c64xx_device_iis1);static struct resource s3c64xx_iisv4_resource[] = { [0 ] =DEFINE_RES_MEM (S3C64XX_PA_IISV4 ,SZ_256 ), - [1 ] =DEFINE_RES_DMA (DMACH_HSI_I2SV40_TX ), - [2 ] =DEFINE_RES_DMA (DMACH_HSI_I2SV40_RX ), };static struct s3c_audio_pdata i2sv4_pdata = { .cfg_gpio = s3c64xx_i2s_cfg_gpio, + .dma_playback =DMACH_HSI_I2SV40_TX , + .dma_capture =DMACH_HSI_I2SV40_RX , .type = { .i2s = { .quirks =QUIRK_PRI_6CHAN ,
@@ -142,12 +146,12 @@ static int s3c64xx_pcm_cfg_gpio(struct pstatic struct resource s3c64xx_pcm0_resource[] = { [0 ] =DEFINE_RES_MEM (S3C64XX_PA_PCM0 ,SZ_256 ), - [1 ] =DEFINE_RES_DMA (DMACH_PCM0_TX ), - [2 ] =DEFINE_RES_DMA (DMACH_PCM0_RX ), };static struct s3c_audio_pdata s3c_pcm0_pdata = { .cfg_gpio = s3c64xx_pcm_cfg_gpio, + .dma_capture =DMACH_PCM0_RX , + .dma_playback =DMACH_PCM0_TX , };struct platform_device s3c64xx_device_pcm0 = {
@@ -163,12 +167,12 @@ EXPORT_SYMBOL(s3c64xx_device_pcm0);static struct resource s3c64xx_pcm1_resource[] = { [0 ] =DEFINE_RES_MEM (S3C64XX_PA_PCM1 ,SZ_256 ), - [1 ] =DEFINE_RES_DMA (DMACH_PCM1_TX ), - [2 ] =DEFINE_RES_DMA (DMACH_PCM1_RX ), };static struct s3c_audio_pdata s3c_pcm1_pdata = { .cfg_gpio = s3c64xx_pcm_cfg_gpio, + .dma_playback =DMACH_PCM1_TX , + .dma_capture =DMACH_PCM1_RX , };struct platform_device s3c64xx_device_pcm1 = {
@@ -196,13 +200,14 @@ static int s3c64xx_ac97_cfg_gpe(struct pstatic struct resource s3c64xx_ac97_resource[] = { [0 ] =DEFINE_RES_MEM (S3C64XX_PA_AC97 ,SZ_256 ), - [1 ] =DEFINE_RES_DMA (DMACH_AC97_PCMOUT ), - [2 ] =DEFINE_RES_DMA (DMACH_AC97_PCMIN ), - [3 ] =DEFINE_RES_DMA (DMACH_AC97_MICIN ), - [4 ] =DEFINE_RES_IRQ (IRQ_AC97 ), + [1 ] =DEFINE_RES_IRQ (IRQ_AC97 ), }; -static struct s3c_audio_pdata s3c_ac97_pdata; +static struct s3c_audio_pdata s3c_ac97_pdata = { + .dma_playback =DMACH_AC97_PCMOUT , + .dma_capture =DMACH_AC97_PCMIN , + .dma_capture_mic =DMACH_AC97_MICIN , +};static u64 s3c64xx_ac97_dmamask =DMA_BIT_MASK (32 );
arch/arm/mach-s3c64xx/include/mach/dma.h +26 -26
64 lines not on this page · raw message
arch/arm/plat-samsung/devs.c +8 -3
@@ -65,6 +65,7 @@#include <linux/platform_data/usb-ohci-s3c2410.h> #include <plat/usb-phy.h> #include <plat/regs-spi.h> +#include <linux/platform_data/asoc-s3c.h> #include <linux/platform_data/spi-s3c64xx.h> static u64 samsung_device_dma_mask =DMA_BIT_MASK (32 );
@@ -74,9 +75,12 @@ static u64 samsung_device_dma_mask = DMAstatic struct resource s3c_ac97_resource[] = { [0 ] =DEFINE_RES_MEM (S3C2440_PA_AC97 ,S3C2440_SZ_AC97 ), [1 ] =DEFINE_RES_IRQ (IRQ_S3C244X_AC97 ), - [2 ] =DEFINE_RES_DMA_NAMED (DMACH_PCM_OUT ,"PCM out" ), - [3 ] =DEFINE_RES_DMA_NAMED (DMACH_PCM_IN ,"PCM in" ), - [4 ] =DEFINE_RES_DMA_NAMED (DMACH_MIC_IN ,"Mic in" ), +}; + +static struct s3c_audio_pdata s3c_ac97_pdata = { + .dma_playback = (void *)DMACH_PCM_OUT , + .dma_capture = (void *)DMACH_PCM_IN , + .dma_capture_mic = (void *)DMACH_MIC_IN , };struct platform_device s3c_device_ac97 = {
@@ -87,6 +91,7 @@ struct platform_device s3c_device_ac97 = .dev = { .dma_mask = &samsung_device_dma_mask, .coherent_dma_mask = DMA_BIT_MASK(32), + .platform_data = &s3c_ac97_pdata, } };#endif /* CONFIG_CPU_S3C2440 */
include/linux/platform_data/asoc-s3c.h +4 -0
@@ -39,6 +39,10 @@ struct samsung_i2s {*/ struct s3c_audio_pdata {int (*cfg_gpio)(struct platform_device *); +void *dma_playback; +void *dma_capture; +void *dma_play_sec; +void *dma_capture_mic;union {struct samsung_i2s i2s; } type;
sound/soc/samsung/ac97.c +4 -22
@@ -324,7 +324,7 @@ static const struct snd_soc_component_drstatic int s3c_ac97_probe (struct platform_device *pdev) { -struct resource *mem_res, *dmatx_res, *dmarx_res, *dmamic_res, *irq_res; +struct resource *mem_res, *irq_res;struct s3c_audio_pdata *ac97_pdata;int ret;
@@ -335,24 +335,6 @@ static int s3c_ac97_probe(struct platfor }/* Check for availability of necessary resource */ - dmatx_res =platform_get_resource (pdev,IORESOURCE_DMA ,0 ); -if (!dmatx_res) { -dev_err (&pdev->dev,"Unable to get AC97-TX dma resource\n" ); -return -ENXIO ; - } - - dmarx_res =platform_get_resource (pdev,IORESOURCE_DMA ,1 ); -if (!dmarx_res) { -dev_err (&pdev->dev,"Unable to get AC97-RX dma resource\n" ); -return -ENXIO ; - } - - dmamic_res =platform_get_resource (pdev,IORESOURCE_DMA ,2 ); -if (!dmamic_res) { -dev_err (&pdev->dev,"Unable to get AC97-MIC dma resource\n" ); -return -ENXIO ; - } - irq_res =platform_get_resource (pdev,IORESOURCE_IRQ ,0 );if (!irq_res) {dev_err (&pdev->dev,"AC97 IRQ not provided!\n" );
@@ -364,11 +346,11 @@ static int s3c_ac97_probe(struct platforif (IS_ERR (s3c_ac97.regs))return PTR_ERR (s3c_ac97.regs); - s3c_ac97_pcm_out.channel = dmatx_res->start; + s3c_ac97_pcm_out.slave = ac97_pdata->dma_playback; s3c_ac97_pcm_out.dma_addr = mem_res->start +S3C_AC97_PCM_DATA ; - s3c_ac97_pcm_in.channel = dmarx_res->start; + s3c_ac97_pcm_in.slave = ac97_pdata->dma_capture; s3c_ac97_pcm_in.dma_addr = mem_res->start +S3C_AC97_PCM_DATA ; - s3c_ac97_mic_in.channel = dmamic_res->start; + s3c_ac97_mic_in.slave = ac97_pdata->dma_capture_mic; s3c_ac97_mic_in.dma_addr = mem_res->start +S3C_AC97_MIC_DATA ;init_completion (&s3c_ac97.done);
sound/soc/samsung/dma.h +1 -1
@@ -15,7 +15,7 @@#include <sound/dmaengine_pcm.h> struct s3c_dma_params { -int channel;/* Channel ID */ +void *slave;/* Channel ID */ dma_addr_t dma_addr;int dma_size;/* Size of the DMA transfer */ char *ch_name;
sound/soc/samsung/dmaengine.c +2 -2
@@ -50,14 +50,14 @@ void samsung_asoc_init_dma_data(struct sif (playback) { playback_data = &playback->dma_data; - playback_data->filter_data = (void *)playback->channel; + playback_data->filter_data = playback->slave; playback_data->chan_name = playback->ch_name; playback_data->addr = playback->dma_addr; playback_data->addr_width = playback->dma_size; }if (capture) { capture_data = &capture->dma_data; - capture_data->filter_data = (void *)capture->channel; + capture_data->filter_data = capture->slave; capture_data->chan_name = capture->ch_name; capture_data->addr = capture->dma_addr; capture_data->addr_width = capture->dma_size;
sound/soc/samsung/i2s.c +5 -21
@@ -1260,27 +1260,14 @@ static int samsung_i2s_probe(struct plat pri_dai->lock = &pri_dai->spinlock;if (!np) { - res =platform_get_resource (pdev,IORESOURCE_DMA ,0 ); -if (!res) { -dev_err (&pdev->dev, -"Unable to get I2S-TX dma resource\n" ); -return -ENXIO ; - } - pri_dai->dma_playback.channel = res->start; - - res =platform_get_resource (pdev,IORESOURCE_DMA ,1 ); -if (!res) { -dev_err (&pdev->dev, -"Unable to get I2S-RX dma resource\n" ); -return -ENXIO ; - } - pri_dai->dma_capture.channel = res->start; -if (i2s_pdata ==NULL ) {dev_err (&pdev->dev,"Can't work without s3c_audio_pdata\n" );return -EINVAL ; } + pri_dai->dma_playback.slave = i2s_pdata->dma_playback; + pri_dai->dma_capture.slave = i2s_pdata->dma_capture; +if (&i2s_pdata->type) i2s_cfg = &i2s_pdata->type.i2s;
@@ -1341,11 +1328,8 @@ static int samsung_i2s_probe(struct plat sec_dai->dma_playback.dma_addr = regs_base +I2STXDS ; sec_dai->dma_playback.ch_name ="tx-sec" ; -if (!np) { - res =platform_get_resource (pdev,IORESOURCE_DMA ,2 ); -if (res) - sec_dai->dma_playback.channel = res->start; - } +if (!np) + sec_dai->dma_playback.slave = i2s_pdata->dma_play_sec; sec_dai->dma_playback.dma_size =4 ; sec_dai->addr = pri_dai->addr;
sound/soc/samsung/pcm.c +5 -15
@@ -486,7 +486,7 @@ static const struct snd_soc_component_drstatic int s3c_pcm_dev_probe (struct platform_device *pdev) {struct s3c_pcm_info *pcm; -struct resource *mem_res, *dmatx_res, *dmarx_res; +struct resource *mem_res;struct s3c_audio_pdata *pcm_pdata;int ret;
@@ -499,18 +499,6 @@ static int s3c_pcm_dev_probe(struct plat pcm_pdata = pdev->dev.platform_data;/* Check for availability of necessary resource */ - dmatx_res =platform_get_resource (pdev,IORESOURCE_DMA ,0 ); -if (!dmatx_res) { -dev_err (&pdev->dev,"Unable to get PCM-TX dma resource\n" ); -return -ENXIO ; - } - - dmarx_res =platform_get_resource (pdev,IORESOURCE_DMA ,1 ); -if (!dmarx_res) { -dev_err (&pdev->dev,"Unable to get PCM-RX dma resource\n" ); -return -ENXIO ; - } - mem_res =platform_get_resource (pdev,IORESOURCE_MEM ,0 );if (!mem_res) {dev_err (&pdev->dev,"Unable to get register resource\n" );
@@ -568,8 +556,10 @@ static int s3c_pcm_dev_probe(struct plat s3c_pcm_stereo_out[pdev->id].dma_addr = mem_res->start +S3C_PCM_TXFIFO ; - s3c_pcm_stereo_in[pdev->id].channel = dmarx_res->start; - s3c_pcm_stereo_out[pdev->id].channel = dmatx_res->start; +if (pcm_pdata) { + s3c_pcm_stereo_in[pdev->id].slave = pcm_pdata->dma_capture; + s3c_pcm_stereo_out[pdev->id].slave = pcm_pdata->dma_playback; + } pcm->dma_capture = &s3c_pcm_stereo_in[pdev->id]; pcm->dma_playback = &s3c_pcm_stereo_out[pdev->id];
sound/soc/samsung/s3c2412-i2s.c +2 -2
@@ -34,13 +34,13 @@#include "s3c2412-i2s.h" static struct s3c_dma_params s3c2412_i2s_pcm_stereo_out = { - .channel =DMACH_I2S_OUT , + .slave = (void *)(uintptr_t )DMACH_I2S_OUT , .ch_name ="tx" , .dma_size =4 , };static struct s3c_dma_params s3c2412_i2s_pcm_stereo_in = { - .channel =DMACH_I2S_IN , + .slave = (void *)(uintptr_t )DMACH_I2S_IN , .ch_name ="rx" , .dma_size =4 , };
sound/soc/samsung/s3c24xx-i2s.c +2 -2
@@ -32,13 +32,13 @@#include "s3c24xx-i2s.h" static struct s3c_dma_params s3c24xx_i2s_pcm_stereo_out = { - .channel =DMACH_I2S_OUT , + .slave = (void *)(uintptr_t )DMACH_I2S_OUT , .ch_name ="tx" , .dma_size =2 , };static struct s3c_dma_params s3c24xx_i2s_pcm_stereo_in = { - .channel =DMACH_I2S_IN , + .slave = (void *)(uintptr_t )DMACH_I2S_IN , .ch_name ="rx" , .dma_size =2 , };
sound/soc/samsung/spdif.c +2 -8
@@ -359,7 +359,7 @@ static const struct snd_soc_component_drstatic int spdif_probe (struct platform_device *pdev) {struct s3c_audio_pdata *spdif_pdata; -struct resource *mem_res, *dma_res; +struct resource *mem_res;struct samsung_spdif_info *spdif;int ret;
@@ -367,12 +367,6 @@ static int spdif_probe(struct platform_ddev_dbg (&pdev->dev,"Entered %s\n" , __func__); - dma_res =platform_get_resource (pdev,IORESOURCE_DMA ,0 ); -if (!dma_res) { -dev_err (&pdev->dev,"Unable to get dma resource.\n" ); -return -ENXIO ; - } - mem_res =platform_get_resource (pdev,IORESOURCE_MEM ,0 );if (!mem_res) {dev_err (&pdev->dev,"Unable to get register resource.\n" );
@@ -432,7 +426,7 @@ static int spdif_probe(struct platform_d spdif_stereo_out.dma_size =2 ; spdif_stereo_out.dma_addr = mem_res->start +DATA_OUTBUF ; - spdif_stereo_out.channel = dma_res->start; + spdif_stereo_out.slave = spdif_pdata ? spdif_pdata->dma_playback :NULL ; spdif->dma_playback = &spdif_stereo_out;
Greg Kroah-Hartman
maintainerPATCH 5/210 mmc: sh_mmcif: rework dma channel handling
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
commit 27cbd7e815a8e223ff7c4fe56daca724101288ac upstream.
When compiling the sh_mmcif driver for ARM64, we currently get a harmless build warning:
../drivers/mmc/host/sh_mmcif.c: In function 'sh_mmcif_request_dma_one':../drivers/mmc/host/sh_mmcif.c:417:4: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
(void *)pdata->slave_id_tx :
^
../drivers/mmc/host/sh_mmcif.c:418:4: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
(void *)pdata->slave_id_rx;This could be worked around by adding another cast to uintptr_t, but I decided to simplify the code a little more to avoid that. This splits out the platform data using code into a separate function and builds that only for CONFIG_SUPERH. This part still has a typecast but does not need a second one. The SH platform code could be further modified to pass a pointer directly as we do on other architectures when we have a filter function.
The normal case is simplified further and now just calls dma_request_slave_channel() directly without going through the compat handling.
--- drivers/mmc/host/sh_mmcif.c | 84 +++++++++++++++++++------------------------- 1 file changed, 38 insertions(+), 46 deletions(-)
drivers/mmc/host/sh_mmcif.c +38 -46
@@ -397,38 +397,26 @@ static void sh_mmcif_start_dma_tx(struct }static struct dma_chan * -sh_mmcif_request_dma_one (struct sh_mmcif_host *host, -struct sh_mmcif_plat_data *pdata, -enum dma_transfer_direction direction) +sh_mmcif_request_dma_pdata (struct sh_mmcif_host *host,uintptr_t slave_id) { -struct dma_slave_config cfg = {0 , }; -struct dma_chan *chan; -void *slave_data =NULL ; -struct resource *res; -struct device *dev =sh_mmcif_host_to_dev (host);dma_cap_mask_t mask; -int ret;dma_cap_zero (mask);dma_cap_set (DMA_SLAVE , mask); +if (slave_id <=0 ) +return NULL ; -if (pdata) - slave_data = direction ==DMA_MEM_TO_DEV ? - (void *)pdata->slave_id_tx : - (void *)pdata->slave_id_rx; - - chan =dma_request_slave_channel_compat (mask, shdma_chan_filter, - slave_data, dev, - direction ==DMA_MEM_TO_DEV ?"tx" :"rx" ); - -dev_dbg (dev,"%s: %s: got channel %p\n" , __func__, - direction ==DMA_MEM_TO_DEV ?"TX" :"RX" , chan); +return dma_request_channel (mask, shdma_chan_filter, (void *)slave_id); +} -if (!chan) -return NULL ; +static int sh_mmcif_dma_slave_config (struct sh_mmcif_host *host, +struct dma_chan *chan, +enum dma_transfer_direction direction) +{ +struct resource *res; +struct dma_slave_config cfg = {0 , }; res =platform_get_resource (host->pd,IORESOURCE_MEM ,0 ); - cfg.direction = direction;if (direction ==DMA_DEV_TO_MEM ) {
@@ -439,38 +427,42 @@ sh_mmcif_request_dma_one(struct sh_mmcif cfg.dst_addr_width =DMA_SLAVE_BUSWIDTH_4_BYTES ; } - ret =dmaengine_slave_config (chan, &cfg); -if (ret <0 ) { -dma_release_channel (chan); -return NULL ; - } - -return chan; +return dmaengine_slave_config (chan, &cfg); } -static void sh_mmcif_request_dma (struct sh_mmcif_host *host, -struct sh_mmcif_plat_data *pdata) +static void sh_mmcif_request_dma (struct sh_mmcif_host *host) {struct device *dev =sh_mmcif_host_to_dev (host); host->dma_active = false; -if (pdata) { -if (pdata->slave_id_tx <=0 || pdata->slave_id_rx <=0 ) -return ; - }else if (!dev->of_node) { -return ; +/* We can only either use DMA for both Tx and Rx or not use it at all */ +if (IS_ENABLED (CONFIG_SUPERH ) && dev->platform_data) { +struct sh_mmcif_plat_data *pdata = dev->platform_data; + + host->chan_tx =sh_mmcif_request_dma_pdata (host, + pdata->slave_id_tx); + host->chan_rx =sh_mmcif_request_dma_pdata (host, + pdata->slave_id_rx); + }else { + host->chan_tx =dma_request_slave_channel (dev,"tx" ); + host->chan_tx =dma_request_slave_channel (dev,"rx" ); } +dev_dbg (dev,"%s: got channel TX %p RX %p\n" , __func__, host->chan_tx, + host->chan_rx); -/* We can only either use DMA for both Tx and Rx or not use it at all */ - host->chan_tx =sh_mmcif_request_dma_one (host, pdata,DMA_MEM_TO_DEV ); -if (!host->chan_tx) -return ; +if (!host->chan_tx || !host->chan_rx || +sh_mmcif_dma_slave_config (host, host->chan_tx,DMA_MEM_TO_DEV ) || +sh_mmcif_dma_slave_config (host, host->chan_rx,DMA_DEV_TO_MEM )) + goto error; - host->chan_rx =sh_mmcif_request_dma_one (host, pdata,DMA_DEV_TO_MEM ); -if (!host->chan_rx) { +return ; + +error: +if (host->chan_tx)dma_release_channel (host->chan_tx); - host->chan_tx =NULL ; - } +if (host->chan_rx) +dma_release_channel (host->chan_rx); + host->chan_tx = host->chan_rx =NULL ; }static void sh_mmcif_release_dma (struct sh_mmcif_host *host)
@@ -1102,7 +1094,7 @@ static void sh_mmcif_set_ios(struct mmc_if (ios->power_mode ==MMC_POWER_UP ) {if (!host->card_present) {/* See if we also get DMA */ -sh_mmcif_request_dma (host, dev->platform_data); +sh_mmcif_request_dma (host); host->card_present = true; }sh_mmcif_set_power (host, ios);
Greg Kroah-Hartman
maintainerPATCH 6/210 mmc: sh_mmcif: Correct TX DMA channel allocation
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Paterson <[email protected]>
commit a32ef81c9889c9554a3c4b465c4ee7b2d26c6b10 upstream.
Commit 27cbd7e815a8 ("mmc: sh_mmcif: rework dma channel handling") introduced a typo causing the TX DMA channel allocation to be overwritten by the requested RX DMA channel.
--- drivers/mmc/host/sh_mmcif.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mmc/host/sh_mmcif.c +1 -1
@@ -445,7 +445,7 @@ static void sh_mmcif_request_dma(struct pdata->slave_id_rx); }else { host->chan_tx =dma_request_slave_channel (dev,"tx" ); - host->chan_tx =dma_request_slave_channel (dev,"rx" ); + host->chan_rx =dma_request_slave_channel (dev,"rx" ); }dev_dbg (dev,"%s: got channel TX %p RX %p\n" , __func__, host->chan_tx, host->chan_rx);
Greg Kroah-Hartman
maintainerPATCH 7/210 x86/microcode/intel: Make early loader look for builtin microcode too
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Borislav Petkov <[email protected]>
commit 264285ac01673e70557c43ecee338ce97c4c0672 upstream.
Set the initrd @start depending on the presence of an initrd. Otherwise, builtin microcode loading doesn't work as the start is wrong and we're using it to compute offset to the microcode blobs.
--- arch/x86/kernel/cpu/microcode/intel.c | 24 ++++++++++++++++-------- 1 file changed, 16 insertions(+), 8 deletions(-)
arch/x86/kernel/cpu/microcode/intel.c +16 -8
@@ -555,10 +555,14 @@ scan_microcode(struct mc_saved_data *mc_ cd.data =NULL ; cd.size =0 ; - cd =find_cpio_data (p, (void *)start, size, &offset); -if (!cd.data) { +/* try built-in microcode if no initrd */ +if (!size) {if (!load_builtin_intel_microcode (&cd))return UCODE_ERROR ; + }else { + cd =find_cpio_data (p, (void *)start, size, &offset); +if (!cd.data) +return UCODE_ERROR ; } return get_matching_model_microcode(0, start, cd.data, cd.size,
@@ -732,16 +736,20 @@ void __init load_ucode_intel_bsp(void)struct boot_params *p; p = (struct boot_params *)__pa_nodebug (&boot_params); - start = p->hdr.ramdisk_image; size = p->hdr.ramdisk_size; -_load_ucode_intel_bsp ( - (struct mc_saved_data *)__pa_nodebug (&mc_saved_data), - (unsigned long *)__pa_nodebug (&mc_saved_in_initrd), - start, size); +/* +* Set start only if we have an initrd image. We cannot use initrd_start +* because it is not set that early yet. +*/ + start = (size ? p->hdr.ramdisk_image :0 ); + +_load_ucode_intel_bsp ((struct mc_saved_data *)__pa_nodebug (&mc_saved_data), + (unsigned long *)__pa_nodebug (&mc_saved_in_initrd), + start, size);#else - start = boot_params.hdr.ramdisk_image +PAGE_OFFSET ; size = boot_params.hdr.ramdisk_size; + start = (size ? boot_params.hdr.ramdisk_image +PAGE_OFFSET :0 );_load_ucode_intel_bsp (&mc_saved_data, mc_saved_in_initrd, start, size);#endif
Greg Kroah-Hartman
maintainerPATCH 8/210 x86/microcode: Untangle from BLK_DEV_INITRD
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Borislav Petkov <[email protected]>
commit 5f9c01aa7c49a2d74474d6d879a797b8badf29e6 upstream.
Thomas Voegtle reported that doing oldconfig with a .config which has CONFIG_MICROCODE enabled but BLK_DEV_INITRD disabled prevents the microcode loading mechanism from being built.
So untangle it from the BLK_DEV_INITRD dependency so that oldconfig doesn't turn it off and add an explanatory text to its Kconfig help what the supported methods for supplying microcode are.
--- arch/x86/Kconfig | 23 ++++++++++++----------- arch/x86/include/asm/microcode.h | 26 ++++++++++++++++++++++++++ arch/x86/kernel/cpu/microcode/intel.c | 14 ++++---------- 3 files changed, 42 insertions(+), 21 deletions(-)
arch/x86/Kconfig +12 -11
@@ -1126,22 +1126,23 @@ config MICROCODE bool "CPU microcode loading support" default y depends on CPU_SUP_AMD || CPU_SUP_INTEL - depends on BLK_DEV_INITRD select FW_LOADER ---help--- - If you say Y here, you will be able to update the microcode on - certain Intel and AMD processors. The Intel support is for the - IA32 family, e.g. Pentium Pro, Pentium II, Pentium III, Pentium 4, - Xeon etc. The AMD support is for families 0x10 and later. You will - obviously need the actual microcode binary data itself which is not - shipped with the Linux kernel. + Intel and AMD processors. The Intel support is for the IA32 family, + e.g. Pentium Pro, Pentium II, Pentium III, Pentium 4, Xeon etc. The + AMD support is for families 0x10 and later. You will obviously need + the actual microcode binary data itself which is not shipped with + the Linux kernel. - This option selects the general module only, you need to select - at least one vendor specific module as well. + The preferred method to load microcode from a detached initrd is described + in Documentation/x86/early-microcode.txt. For that you need to enable + CONFIG_BLK_DEV_INITRD in order for the loader to be able to scan the + initrd for microcode blobs. - To compile this driver as a module, choose M here: the module - will be called microcode. + In addition, you can build-in the microcode into the kernel. For that you + need to enable FIRMWARE_IN_KERNEL and add the vendor-supplied microcode + to the CONFIG_EXTRA_FIRMWARE config option. config MICROCODE_INTEL bool "Intel microcode loading support"
arch/x86/include/asm/microcode.h +26 -0
@@ -2,6 +2,7 @@#define _ASM_X86_MICROCODE_H#include <linux/earlycpio.h> +#include <linux/initrd.h> #define native_rdmsr (msr, val1, val2) \ do { \
@@ -168,4 +169,29 @@ static inline void reload_early_microcodstatic inline bool get_builtin_firmware (struct cpio_data *cd,const char *name) {return false; }#endif + +static inline unsigned long get_initrd_start (void ) +{ +#ifdef CONFIG_BLK_DEV_INITRD +return initrd_start; +#else +return 0 ; +#endif +} + +static inline unsigned long get_initrd_start_addr (void ) +{ +#ifdef CONFIG_BLK_DEV_INITRD +#ifdef CONFIG_X86_32 +unsigned long *initrd_start_p = (unsigned long *)__pa_nodebug (&initrd_start); + +return (unsigned long )__pa_nodebug (*initrd_start_p); +#else +return get_initrd_start (); +#endif +#else /* CONFIG_BLK_DEV_INITRD */ +return 0 ; +#endif +} +#endif /* _ASM_X86_MICROCODE_H */
arch/x86/kernel/cpu/microcode/intel.c +4 -10
@@ -698,7 +698,7 @@ int __init save_microcode_in_initrd_inteif (count ==0 )return ret; -copy_initrd_ptrs (mc_saved, mc_saved_in_initrd, initrd_start, count); +copy_initrd_ptrs (mc_saved, mc_saved_in_initrd,get_initrd_start (), count); ret =save_microcode (&mc_saved_data, mc_saved, count);if (ret)pr_err ("Cannot save microcode patches from initrd.\n" );
@@ -760,20 +760,14 @@ void load_ucode_intel_ap(void)struct mc_saved_data *mc_saved_data_p;struct ucode_cpu_info uci;unsigned long *mc_saved_in_initrd_p; -unsigned long initrd_start_addr;enum ucode_state ret;#ifdef CONFIG_X86_32 -unsigned long *initrd_start_p; - mc_saved_in_initrd_p = - (unsigned long *)__pa_nodebug (mc_saved_in_initrd); + mc_saved_in_initrd_p = (unsigned long *)__pa_nodebug (mc_saved_in_initrd); mc_saved_data_p = (struct mc_saved_data *)__pa_nodebug (&mc_saved_data); - initrd_start_p = (unsigned long *)__pa_nodebug (&initrd_start); - initrd_start_addr = (unsigned long )__pa_nodebug (*initrd_start_p);#else - mc_saved_data_p = &mc_saved_data; mc_saved_in_initrd_p = mc_saved_in_initrd; - initrd_start_addr = initrd_start; + mc_saved_data_p = &mc_saved_data;#endif /*
@@ -785,7 +779,7 @@ void load_ucode_intel_ap(void)collect_cpu_info_early (&uci); ret =load_microcode (mc_saved_data_p, mc_saved_in_initrd_p, - initrd_start_addr, &uci); +get_initrd_start_addr (), &uci);if (ret !=UCODE_OK )return ;
Greg Kroah-Hartman
maintainerPATCH 9/210 x86/entry/compat: Keep TS_COMPAT set during signal delivery
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Lutomirski <[email protected]>
commit 4e79e182b419172e35936a47f098509092d69817 upstream.
Signal delivery needs to know the sign of an interrupted syscall's return value in order to detect -ERESTART variants. Normally this works independently of bitness because syscalls internally return long. Under ptrace, however, this can break, and syscall_get_error is supposed to sign-extend regs->ax if needed.
We were clearing TS_COMPAT too early, though, and this prevented sign extension, which subtly broke syscall restart under ptrace.
--- arch/x86/entry/common.c | 23 +++++++++++++---------- 1 file changed, 13 insertions(+), 10 deletions(-)
arch/x86/entry/common.c +13 -10
@@ -268,6 +268,7 @@ static void exit_to_usermode_loop(struct/* Called with IRQs disabled. */ __visible inline void prepare_exit_to_usermode(struct pt_regs *regs) { +struct thread_info *ti =pt_regs_to_thread_info (regs);u32 cached_flags;if (IS_ENABLED (CONFIG_PROVE_LOCKING ) &&WARN_ON (!irqs_disabled ()))
@@ -275,12 +276,22 @@ __visible inline void prepare_exit_to_uslockdep_sys_exit (); - cached_flags = -READ_ONCE (pt_regs_to_thread_info (regs)->flags); + cached_flags =READ_ONCE (ti->flags);if (unlikely (cached_flags &EXIT_TO_USERMODE_LOOP_FLAGS ))exit_to_usermode_loop (regs, cached_flags); +#ifdef CONFIG_COMPAT +/* +* Compat syscalls set TS_COMPAT. Make sure we clear it before +* returning to user mode. We need to clear it *after* signal +* handling, because syscall restart has a fixup for compat +* syscalls. The fixup is exercised by the ptrace_syscall_32 +* selftest. +*/ + ti->status &= ~TS_COMPAT ; +#endif +user_enter (); }
@@ -332,14 +343,6 @@ __visible inline void syscall_return_sloif (unlikely (cached_flags &SYSCALL_EXIT_WORK_FLAGS ))syscall_slow_exit_work (regs, cached_flags); -#ifdef CONFIG_COMPAT -/* -* Compat syscalls set TS_COMPAT. Make sure we clear it before -* returning to user mode. -*/ - ti->status &= ~TS_COMPAT ; -#endif -local_irq_disable ();prepare_exit_to_usermode (regs); }
Greg Kroah-Hartman
maintainerPATCH 10/210 perf/x86/intel: Add definition for PT PMI bit
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephane Eranian <[email protected]>
commit 5690ae28e472d25e330ad0c637a5cea3fc39fb32 upstream.
This patch adds a definition for GLOBAL_OVFL_STATUS bit 55 which is used with the Processor Trace (PT) feature.
--- arch/x86/include/asm/perf_event.h | 1 + 1 file changed, 1 insertion(+)
arch/x86/include/asm/perf_event.h +1 -0
@@ -165,6 +165,7 @@ struct x86_pmu_capability {#define GLOBAL_STATUS_ASIF BIT_ULL(60)#define GLOBAL_STATUS_COUNTERS_FROZEN BIT_ULL(59)#define GLOBAL_STATUS_LBRS_FROZEN BIT_ULL(58) +#define GLOBAL_STATUS_TRACE_TOPAPMI BIT_ULL(55)/* * IBS cpuid feature detection
Greg Kroah-Hartman
maintainerPATCH 11/210 x86/PCI: Mark Broadwell-EP Home Agent & PCU as having non-compliant BARs
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bjorn Helgaas <[email protected]>
commit b894157145e4ac7598d7062bc93320898a5e059e upstream.
The Home Agent and PCU PCI devices in Broadwell-EP have a non-BAR register where a BAR should be. We don't know what the side effects of sizing the "BAR" would be, and we don't know what address space the "BAR" might appear to describe.
Mark these devices as having non-compliant BARs so the PCI core doesn't touch them.
--- arch/x86/pci/fixup.c | 7 +++++++ 1 file changed, 7 insertions(+)
arch/x86/pci/fixup.c +7 -0
@@ -540,3 +540,10 @@ static void twinhead_reserve_killing_zon } }DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0x27B9 , twinhead_reserve_killing_zone); + +static void pci_bdwep_bar (struct pci_dev *dev) +{ + dev->non_compliant_bars =1 ; +} +DECLARE_PCI_FIXUP_EARLY (PCI_VENDOR_ID_INTEL ,0x6fa0 , pci_bdwep_bar); +DECLARE_PCI_FIXUP_EARLY (PCI_VENDOR_ID_INTEL ,0x6fc0 , pci_bdwep_bar);
Greg Kroah-Hartman
maintainerPATCH 12/210 KVM: x86: fix missed hardware breakpoints
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Bonzini <[email protected]>
commit 4e422bdd2f849d98fffccbc3295c2f0996097fb3 upstream.
Sometimes when setting a breakpoint a process doesn't stop on it. This is because the debug registers are not loaded correctly on VCPU load.
The following simple reproducer from Oleg Nesterov tries using debug registers in both the host and the guest, for example by running "./bp 0 1" on the host and "./bp 14 15" under QEMU.
#include <unistd.h>
#include <signal.h>
#include <stdlib.h>
#include <stdio.h>
#include <sys/wait.h>
#include <sys/ptrace.h>
#include <sys/user.h>
#include <asm/debugreg.h>
#include <assert.h>
#define offsetof(TYPE, MEMBER) ((size_t) &((TYPE *)0)->MEMBER)
unsigned long encode_dr7(int drnum, int enable, unsigned int type, unsigned int len)
{
unsigned long dr7;
dr7 = ((len | type) & 0xf)
<< (DR_CONTROL_SHIFT + drnum * DR_CONTROL_SIZE);
if (enable)
dr7 |= (DR_GLOBAL_ENABLE << (drnum * DR_ENABLE_SIZE));
return dr7;
}
int write_dr(int pid, int dr, unsigned long val)
{
return ptrace(PTRACE_POKEUSER, pid,
offsetof (struct user, u_debugreg[dr]),
val);
}
void set_bp(pid_t pid, void *addr)
{
unsigned long dr7;
assert(write_dr(pid, 0, (long)addr) == 0);
dr7 = encode_dr7(0, 1, DR_RW_EXECUTE, DR_LEN_1);
assert(write_dr(pid, 7, dr7) == 0);
}
void *get_rip(int pid)
{
return (void*)ptrace(PTRACE_PEEKUSER, pid,
offsetof(struct user, regs.rip), 0);
}
void test(int nr)
{
void *bp_addr = &&label + nr, *bp_hit;
int pid;
printf("test bp %d\n", nr);
assert(nr < 16); // see 16 asm nops below
pid = fork();
if (!pid) {
assert(ptrace(PTRACE_TRACEME, 0,0,0) == 0);
kill(getpid(), SIGSTOP);
for (;;) {
label: asm (
"nop; nop; nop; nop;"
"nop; nop; nop; nop;"
"nop; nop; nop; nop;"
"nop; nop; nop; nop;"
);
}
}
assert(pid == wait(NULL));
set_bp(pid, bp_addr);
for (;;) {
assert(ptrace(PTRACE_CONT, pid, 0, 0) == 0);
assert(pid == wait(NULL));
bp_hit = get_rip(pid);
if (bp_hit != bp_addr)
fprintf(stderr, "ERR!! hit wrong bp %ld != %d\n",
bp_hit - &&label, nr);
}
}
int main(int argc, const char *argv[])
{
while (--argc) {
int nr = atoi(*++argv);
if (!fork())
test(nr);
}
while (wait(NULL) > 0)
;
return 0;
}--- arch/x86/kvm/x86.c | 1 + 1 file changed, 1 insertion(+)
arch/x86/kvm/x86.c +1 -0
@@ -2736,6 +2736,7 @@ void kvm_arch_vcpu_load(struct kvm_vcpu }kvm_make_request (KVM_REQ_STEAL_UPDATE , vcpu); + vcpu->arch.switch_db_regs |=KVM_DEBUGREG_RELOAD ; }void kvm_arch_vcpu_put (struct kvm_vcpu *vcpu)
Greg Kroah-Hartman
maintainerPATCH 14/210 KVM: fix spin_lock_init order on x86
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Bonzini <[email protected]>
commit e9ad4ec8379ad1ba6f68b8ca1c26b50b5ae0a327 upstream.
Moving the initialization earlier is needed in 4.6 because kvm_arch_init_vm is now using mmu_lock, causing lockdep to complain:
[ 284.440294] INFO: trying to register non-static key. [ 284.445259] the code is fine but needs lockdep annotation. [ 284.450736] turning off the locking correctness validator. ... [ 284.528318] [<ffffffff810aecc3>] lock_acquire+0xd3/0x240 [ 284.533733] [<ffffffffa0305aa0>] ? kvm_page_track_register_notifier+0x20/0x60 [kvm] [ 284.541467] [<ffffffff81715581>] _raw_spin_lock+0x41/0x80 [ 284.546960] [<ffffffffa0305aa0>] ? kvm_page_track_register_notifier+0x20/0x60 [kvm] [ 284.554707] [<ffffffffa0305aa0>] kvm_page_track_register_notifier+0x20/0x60 [kvm] [ 284.562281] [<ffffffffa02ece70>] kvm_mmu_init_vm+0x20/0x30 [kvm] [ 284.568381] [<ffffffffa02dbf7a>] kvm_arch_init_vm+0x1ea/0x200 [kvm] [ 284.574740] [<ffffffffa02bff3f>] kvm_dev_ioctl+0xbf/0x4d0 [kvm]
However, it also helps fixing a preexisting problem, which is why this patch is also good for stable kernels: kvm_create_vm was incrementing current->mm->mm_count but not decrementing it at the out_err label (in case kvm_init_mmu_notifier failed). The new initialization order makes it possible to add the required mmdrop without adding a new error label.
--- virt/kvm/kvm_main.c | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-)
virt/kvm/kvm_main.c +11 -10
@@ -547,6 +547,16 @@ static struct kvm *kvm_create_vm(unsigneif (!kvm)return ERR_PTR (-ENOMEM ); +spin_lock_init (&kvm->mmu_lock); +atomic_inc (¤t->mm->mm_count); + kvm->mm = current->mm; +kvm_eventfd_init (kvm); +mutex_init (&kvm->lock); +mutex_init (&kvm->irq_lock); +mutex_init (&kvm->slots_lock); +atomic_set (&kvm->users_count,1 ); +INIT_LIST_HEAD (&kvm->devices); + r =kvm_arch_init_vm (kvm, type);if (r) goto out_err_no_disable;
@@ -579,16 +589,6 @@ static struct kvm *kvm_create_vm(unsigne goto out_err; } -spin_lock_init (&kvm->mmu_lock); - kvm->mm = current->mm; -atomic_inc (&kvm->mm->mm_count); -kvm_eventfd_init (kvm); -mutex_init (&kvm->lock); -mutex_init (&kvm->irq_lock); -mutex_init (&kvm->slots_lock); -atomic_set (&kvm->users_count,1 ); -INIT_LIST_HEAD (&kvm->devices); - r =kvm_init_mmu_notifier (kvm);if (r) goto out_err;
@@ -613,6 +613,7 @@ out_err_no_disable:for (i =0 ; i <KVM_ADDRESS_SPACE_NUM ; i++)kvm_free_memslots (kvm, kvm->memslots[i]);kvm_arch_free_vm (kvm); +mmdrop (current->mm);return ERR_PTR (r); }
Greg Kroah-Hartman
maintainerPATCH 15/210 KVM: VMX: avoid guest hang on invalid invept instruction
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Bonzini <[email protected]>
commit 2849eb4f99d54925c543db12917127f88b3c38ff upstream.
A guest executing an invalid invept instruction would hang because the instruction pointer was not updated.
--- arch/x86/kvm/vmx.c | 1 + 1 file changed, 1 insertion(+)
arch/x86/kvm/vmx.c +1 -0
@@ -7340,6 +7340,7 @@ static int handle_invept(struct kvm_vcpuif (!(types & (1UL << type))) {nested_vmx_failValid (vcpu,VMXERR_INVALID_OPERAND_TO_INVEPT_INVVPID ); +skip_emulated_instruction (vcpu);return 1 ; }
Greg Kroah-Hartman
maintainerPATCH 16/210 KVM: VMX: avoid guest hang on invalid invvpid instruction
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Bonzini <[email protected]>
commit f6870ee9e53430f2a318ccf0dd5e66bb46194e43 upstream.
A guest executing an invalid invvpid instruction would hang because the instruction pointer was not updated.
--- arch/x86/kvm/vmx.c | 1 + 1 file changed, 1 insertion(+)
arch/x86/kvm/vmx.c +1 -0
@@ -7399,6 +7399,7 @@ static int handle_invvpid(struct kvm_vcpif (!(types & (1UL << type))) {nested_vmx_failValid (vcpu,VMXERR_INVALID_OPERAND_TO_INVEPT_INVVPID ); +skip_emulated_instruction (vcpu);return 1 ; }
Greg Kroah-Hartman
maintainerPATCH 17/210 KVM: VMX: fix nested vpid for old KVM guests
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Bonzini <[email protected]>
commit ef697a712a6165aea7779c295604b099e8bfae2e upstream.
Old KVM guests invoke single-context invvpid without actually checking whether it is supported. This was fixed by commit 518c8ae ("KVM: VMX:
Make sure single type invvpid is supported before issuing invvpid instruction", 2010-08-01) and the patch after, but pre-2.6.36 kernels lack it including RHEL 6.
--- arch/x86/kvm/vmx.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-)
arch/x86/kvm/vmx.c +13 -1
@@ -2637,8 +2637,15 @@ static void nested_vmx_setup_ctls_msrs(s }else vmx->nested.nested_vmx_ept_caps =0 ; +/* +* Old versions of KVM use the single-context version without +* checking for support, so declare that it is supported even +* though it is treated as global context. The alternative is +* not failing the single-context invvpid, and it is worse. +*/ if (enable_vpid) vmx->nested.nested_vmx_vpid_caps =VMX_VPID_INVVPID_BIT | +VMX_VPID_EXTENT_SINGLE_CONTEXT_BIT |VMX_VPID_EXTENT_GLOBAL_CONTEXT_BIT ;else vmx->nested.nested_vmx_vpid_caps =0 ;
@@ -7416,12 +7423,17 @@ static int handle_invvpid(struct kvm_vcp }switch (type) { +case VMX_VPID_EXTENT_SINGLE_CONTEXT : +/* +* Old versions of KVM use the single-context version so we +* have to support it; just treat it the same as all-context. +*/ case VMX_VPID_EXTENT_ALL_CONTEXT :__vmx_flush_tlb (vcpu,to_vmx (vcpu)->nested.vpid02);nested_vmx_succeed (vcpu);break ;default : -/* Trap single context invalidation invvpid calls */ +/* Trap individual address invalidation invvpid calls */ BUG_ON (1 );break ; }
Greg Kroah-Hartman
maintainerPATCH 18/210 perf/core: Fix perf_sched_count derailment
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Shishkin <[email protected]>
commit 927a5570855836e5d5859a80ce7e91e963545e8f upstream.
The error path in perf_event_open() is such that asking for a sampling event on a PMU that doesn't generate interrupts will end up in dropping the perf_sched_count even though it hasn't been incremented for this event yet.
Given a sufficient amount of these calls, we'll end up disabling scheduler's jump label even though we'd still have active events in the system, thereby facilitating the arrival of the infernal regions upon us.
I'm fixing this by moving account_event() inside perf_event_alloc().
--- kernel/events/core.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
kernel/events/core.c +3 -4
@@ -7979,6 +7979,9 @@ perf_event_alloc(struct perf_event_attr } } +/* symmetric to unaccount_event() in _free_event() */ +account_event (event); +return event; err_per_task:
@@ -8342,8 +8345,6 @@ SYSCALL_DEFINE5(perf_event_open, } } -account_event (event); -/* * Special case software events and allow them to be part of * any hardware group.
@@ -8626,8 +8627,6 @@ perf_event_create_kernel_counter(struct/* Mark owner so we could distinguish it from user events. */ event->owner =EVENT_OWNER_KERNEL ; -account_event (event); - ctx =find_get_context (event->pmu, task, event);if (IS_ERR (ctx)) { err =PTR_ERR (ctx);
Greg Kroah-Hartman
maintainerPATCH 19/210 perf tools: Dont stop PMU parsing on alias parse error
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andi Kleen <[email protected]>
commit 940db6dcd3f4659303fdf6befe7416adc4d24118 upstream.
When an error happens during alias parsing currently the complete parsing of all attributes of the PMU is stopped. This is breaks old perf on a newer kernel that may have not-yet-know alias attributes (such as .scale or .per-pkg).
Continue when some attribute is unparseable.
This is IMHO a stable candidate and should be backported to older versions to avoid problems with newer kernels.
v2: Print warnings when something goes wrong.
v3: Change warning to debug output
--- tools/perf/util/pmu.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-)
tools/perf/util/pmu.c +8 -7
@@ -283,13 +283,12 @@ static int pmu_aliases_parse(char *dir, {struct dirent *evt_ent;DIR *event_dir; -int ret =0 ; event_dir =opendir (dir);if (!event_dir)return -EINVAL ; -while (!ret && (evt_ent =readdir (event_dir))) { +while ((evt_ent =readdir (event_dir))) {char path[PATH_MAX ];char *name = evt_ent->d_name;FILE *file;
@@ -305,17 +304,19 @@ static int pmu_aliases_parse(char *dir,snprintf (path,PATH_MAX ,"%s/%s" , dir, name); - ret = -EINVAL ; file =fopen (path,"r" ); -if (!file) -break ; +if (!file) { +pr_debug ("Cannot open %s\n" , path); +continue ; + } - ret =perf_pmu__new_alias (head, dir, name, file); +if (perf_pmu__new_alias (head, dir, name, file) <0 ) +pr_debug ("Cannot set up %s\n" , name);fclose (file); }closedir (event_dir); -return ret; +return 0 ; }/*
Greg Kroah-Hartman
maintainerPATCH 20/210 perf tools: Fix checking asprintf return value
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Nan <[email protected]>
commit 26dee028d365fbc0e3326606a8520260b4462381 upstream.
According to man pages, asprintf returns -1 when failure. This patch fixes two incorrect return value checker.
--- tools/perf/util/parse-events.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
tools/perf/util/parse-events.c +3 -3
@@ -2101,11 +2101,11 @@ char *parse_events_formats_error_string(/* valid terms */ if (additional_terms) { -if (!asprintf (&str,"valid terms: %s,%s" , - additional_terms, static_terms)) +if (asprintf (&str,"valid terms: %s,%s" , + additional_terms, static_terms) <0 ) goto fail; }else { -if (!asprintf (&str,"valid terms: %s" , static_terms)) +if (asprintf (&str,"valid terms: %s" , static_terms) <0 ) goto fail; }return str;
Greg Kroah-Hartman
maintainerPATCH 21/210 perf tools: Fix python extension build
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Olsa <[email protected]>
commit 67d5268908283c187e0a460048a423256c2fb288 upstream.
The util/python-ext-sources file contains source files required to build the python extension relative to $(srctree)/tools/perf,
Such a file path $(FILE).c is handed over to the python extension build system, which builds the final object in the $(PYTHON_EXTBUILD)/tmp/$(FILE).o path.
After the build is done all files from $(PYTHON_EXTBUILD)lib/ are carried as the result binaries.
Above system fails when we add source file relative to ../lib, which we do for:
../lib/bitmap.c
../lib/find_bit.c
../lib/hweight.c
../lib/rbtree.c
All above objects will be built like:
$(PYTHON_EXTBUILD)/tmp/../lib/bitmap.c $(PYTHON_EXTBUILD)/tmp/../lib/find_bit.c $(PYTHON_EXTBUILD)/tmp/../lib/hweight.c $(PYTHON_EXTBUILD)/tmp/../lib/rbtree.c
which accidentally happens to be final library path:
$(PYTHON_EXTBUILD)/lib/
Changing setup.py to pass full paths of source files to Extension build class and thus keep all built objects under $(PYTHON_EXTBUILD)tmp directory.
--- tools/perf/util/setup.py | 4 ++++ 1 file changed, 4 insertions(+)
tools/perf/util/setup.py +4 -0
@@ -22,6 +22,7 @@ cflags = getenv('CFLAGS', '').split() # switch off several checks (need to be at the end of cflags list) cflags += ['-fno-strict-aliasing', '-Wno-write-strings', '-Wno-unused-parameter' ] +src_perf = getenv('srctree') + '/tools/perf' build_lib = getenv('PYTHON_EXTBUILD_LIB') build_tmp = getenv('PYTHON_EXTBUILD_TMP') libtraceevent = getenv('LIBTRACEEVENT')
@@ -30,6 +31,9 @@ libapikfs = getenv('LIBAPI') ext_sources = [f.strip() for f in file('util/python-ext-sources') if len(f.strip()) > 0 and f[0] != '#'] +# use full paths with source files +ext_sources = map(lambda x: '%s/%s' % (src_perf, x) , ext_sources) + perf = Extension('perf', sources = ext_sources, include_dirs = ['util/include'],
Greg Kroah-Hartman
maintainerPATCH 22/210 Thermal: Ignore invalid trip points
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Rui <[email protected]>
commit 81ad4276b505e987dd8ebbdf63605f92cd172b52 upstream.
In some cases, platform thermal driver may report invalid trip points, thermal core should not take any action for these trip points.
This fixed a regression that bogus trip point starts to screw up thermal control on some Lenovo laptops, after
commit bb431ba26c5cd0a17c941ca6c3a195a3a6d5d461
Author: Zhang Rui <[email protected]> Date: Fri Oct 30 16:31:47 2015 +0800
Thermal: initialize thermal zone device correctly
After thermal zone device registered, as we have not read any temperature before, thus tz->temperature should not be 0, which actually means 0C, and thermal trend is not available. In this case, we need specially handling for the first thermal_zone_device_update().
Both thermal core framework and step_wise governor is enhanced to handle this. And since the step_wise governor is the only one that uses trends, so it's the only thermal governor that needs to be updated.
--- drivers/thermal/thermal_core.c | 13 ++++++++++++- include/linux/thermal.h | 2 ++ 2 files changed, 14 insertions(+), 1 deletion(-)
drivers/thermal/thermal_core.c +12 -1
@@ -454,6 +454,10 @@ static void handle_thermal_trip(struct t {enum thermal_trip_type type; +/* Ignore disabled trip points */ +if (test_bit (trip, &tz->trips_disabled)) +return ; + tz->ops->get_trip_type (tz, trip, &type);if (type ==THERMAL_TRIP_CRITICAL || type ==THERMAL_TRIP_HOT )
@@ -1796,6 +1800,7 @@ struct thermal_zone_device *thermal_zone {struct thermal_zone_device *tz;enum thermal_trip_type trip_type; +int trip_temp;int result;int count;int passive =0 ;
@@ -1867,9 +1872,15 @@ struct thermal_zone_device *thermal_zone goto unregister;for (count =0 ; count < trips; count++) { - tz->ops->get_trip_type (tz, count, &trip_type); +if (tz->ops->get_trip_type (tz, count, &trip_type)) +set_bit (count, &tz->trips_disabled);if (trip_type ==THERMAL_TRIP_PASSIVE ) passive =1 ; +if (tz->ops->get_trip_temp (tz, count, &trip_temp)) +set_bit (count, &tz->trips_disabled); +/* Check for bogus trip points */ +if (trip_temp ==0 ) +set_bit (count, &tz->trips_disabled); }if (!passive) {
include/linux/thermal.h +2 -0
@@ -156,6 +156,7 @@ struct thermal_attr {* @trip_hyst_attrs: attributes for trip points for sysfs: trip hysteresis * @devdata: private pointer for device private data * @trips: number of trip points the thermal zone supports +* @trips_disabled; bitmap for disabled trips * @passive_delay: number of milliseconds to wait between polls when * performing passive cooling. * @polling_delay: number of milliseconds to wait between polls when
@@ -191,6 +192,7 @@ struct thermal_zone_device {struct thermal_attr *trip_hyst_attrs;void *devdata;int trips; +unsigned long trips_disabled;/* bitmap for disabled trips */ int passive_delay;int polling_delay;int temperature;
Greg Kroah-Hartman
maintainerPATCH 23/210 sched/cputime: Fix steal_account_process_tick() to always return jiffies
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Friesen <[email protected]>
commit f9c904b7613b8b4c85b10cd6b33ad41b2843fa9d upstream.
The callers of steal_account_process_tick() expect it to return whether a jiffy should be considered stolen or not.
Currently the return value of steal_account_process_tick() is in units of cputime, which vary between either jiffies or nsecs depending on CONFIG_VIRT_CPU_ACCOUNTING_GEN.
If cputime has nsecs granularity and there is a tiny amount of stolen time (a few nsecs, say) then we will consider the entire tick stolen and will not account the tick on user/system/idle, causing /proc/stats to show invalid data.
The fix is to change steal_account_process_tick() to accumulate the stolen time and only account it once it's worth a jiffy.
(Thanks to Frederic Weisbecker for suggestions to fix a bug in my first version of the patch.)
--- kernel/sched/cputime.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
kernel/sched/cputime.c +7 -7
@@ -259,21 +259,21 @@ static __always_inline bool steal_accoun#ifdef CONFIG_PARAVIRT if (static_key_false (¶virt_steal_enabled)) {u64 steal; -cputime_t steal_ct; +unsigned long steal_jiffies; steal =paravirt_steal_clock (smp_processor_id ()); steal -=this_rq ()->prev_steal_time;/* -* cputime_t may be less precise than nsecs (eg: if it's -* based on jiffies). Lets cast the result to cputime +* steal is in nsecs but our caller is expecting steal +* time in jiffies. Lets cast the result to jiffies * granularity and account the rest on the next rounds. */ - steal_ct =nsecs_to_cputime (steal); -this_rq ()->prev_steal_time +=cputime_to_nsecs (steal_ct); + steal_jiffies =nsecs_to_jiffies (steal); +this_rq ()->prev_steal_time +=jiffies_to_nsecs (steal_jiffies); -account_steal_time (steal_ct); -return steal_ct; +account_steal_time (jiffies_to_cputime (steal_jiffies)); +return steal_jiffies; }#endif return false;
Greg Kroah-Hartman
maintainerPATCH 24/210 sched/preempt, sh: kmap_coherent relies on disabled preemption
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Hildenbrand <[email protected]>
commit b15d53d009558d14c4f394a6d1fa2039c7f45c43 upstream.
kmap_coherent needs disabled preemption to not schedule in the critical section, just like kmap_coherent on mips and kmap_atomic in general.
--- arch/sh/mm/kmap.c | 2 ++ 1 file changed, 2 insertions(+)
arch/sh/mm/kmap.c +2 -0
@@ -36,6 +36,7 @@ void *kmap_coherent(struct page *page, uBUG_ON (!test_bit (PG_dcache_clean, &page->flags)); +preempt_disable ();pagefault_disable (); idx = FIX_CMAP_END -
@@ -64,4 +65,5 @@ void kunmap_coherent(void *kvaddr) }pagefault_enable (); +preempt_enable (); }
Greg Kroah-Hartman
maintainerPATCH 25/210 EDAC/sb_edac: Fix computation of channel address
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Luck <[email protected]>
commit eb1af3b71f9d83e45f2fd2fd649356e98e1c582c upstream.
Large memory Haswell-EX systems with multiple DIMMs per channel were sometimes reporting the wrong DIMM.
Found three problems:
1) Debug printouts for socket and channel interleave were not interpreting
the register fields correctly. The socket interleave field is a 2^X
value (0=1, 1=2, 2=4, 3=8). The channel interleave is X+1 (0=1, 1=2,
2=3. 3=4).2) Actual use of the socket interleave value didn't interpret as 2^X
3) Conversion of address to channel address was complicated, and wrong.
--- drivers/edac/sb_edac.c | 26 ++++++++++---------------- 1 file changed, 10 insertions(+), 16 deletions(-)
drivers/edac/sb_edac.c +10 -16
@@ -1117,8 +1117,8 @@ static void get_memory_layout(const stru edac_dbg(0, "TAD#%d: up to %u.%03u GB (0x%016Lx), socket interleave %d, memory interleave %d, TGT: %d, %d, %d, %d, reg=0x%08x\n", n_tads, gb, (mb*1000)/1024, ((u64)tmp_mb) << 20L, - (u32)TAD_SOCK(reg), - (u32)TAD_CH(reg), + (u32)(1 << TAD_SOCK(reg)), + (u32)TAD_CH(reg) + 1, (u32)TAD_TGT0(reg), (u32)TAD_TGT1(reg), (u32)TAD_TGT2(reg),
@@ -1396,7 +1396,7 @@ static int get_memory_error_data(struct } ch_way =TAD_CH (reg) +1 ; - sck_way =TAD_SOCK (reg) +1 ; + sck_way =1 <<TAD_SOCK (reg);if (ch_way ==3 ) idx = addr >>6 ;
@@ -1453,7 +1453,7 @@ static int get_memory_error_data(struct n_tads, addr, limit, - (u32 )TAD_SOCK (reg), + sck_way, ch_way, offset, idx,
@@ -1468,18 +1468,12 @@ static int get_memory_error_data(struct offset, addr);return -EINVAL ; } - addr -= offset; -/* Store the low bits [0:6] of the addr */ - ch_addr = addr &0x7f ; -/* Remove socket wayness and remove 6 bits */ - addr >>=6 ; - addr =div_u64 (addr, sck_xch); -#if 0 -/* Divide by channel way */ - addr = addr / ch_way; -#endif -/* Recover the last 6 bits */ - ch_addr |= addr <<6 ; + + ch_addr = addr - offset; + ch_addr >>= (6 + shiftup); + ch_addr /= ch_way * sck_way; + ch_addr <<= (6 + shiftup); + ch_addr |= addr & ((1 << (6 + shiftup)) -1 );/* * Step 3) Decode rank
Greg Kroah-Hartman
maintainerPATCH 26/210 EDAC, amd64_edac: Shift wrapping issue in f1x_get_norm_dct_addr()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
commit 6f3508f61c814ee852c199988a62bd954c50dfc1 upstream.
dct_sel_base_off is declared as a u64 but we're only using the lower 32 bits because of a shift wrapping bug. This can possibly truncate the upper 16 bits of DctSelBaseOffset[47:26], causing us to misdecode the CS row.
--- drivers/edac/amd64_edac.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/edac/amd64_edac.c +1 -1
@@ -1452,7 +1452,7 @@ static u64 f1x_get_norm_dct_addr(structu64 chan_off;u64 dram_base =get_dram_base (pvt, range);u64 hole_off =f10_dhar_offset (pvt); -u64 dct_sel_base_off = (pvt->dct_sel_hi &0xFFFFFC00 ) <<16 ; +u64 dct_sel_base_off = (u64)(pvt->dct_sel_hi &0xFFFFFC00 ) <<16 ;if (hi_rng) {/*
Greg Kroah-Hartman
maintainerPATCH 27/210 s390: fix floating pointer register corruption (again)
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Schwidefsky <[email protected]>
commit e370e4769463a65dcf8806fa26d2874e0542ac41 upstream.
There is a tricky interaction between the machine check handler and the critical sections of load_fpu_regs and save_fpu_regs functions. If the machine check interrupts one of the two functions the critical section cleanup will complete the function before the machine check handler s390_do_machine_check is called. Trouble is that the machine check handler needs to validate the floating point registers *before* and not *after* the completion of load_fpu_regs/save_fpu_regs.
The simplest solution is to rewind the PSW to the start of the load_fpu_regs/save_fpu_regs and retry the function after the return from the machine check handler.
--- arch/s390/kernel/entry.S | 106 ----------------------------------------------- 1 file changed, 2 insertions(+), 104 deletions(-)
arch/s390/kernel/entry.S +2 -104
@@ -1197,114 +1197,12 @@ cleanup_critical: .quad .Lpsw_idle_lpsw .Lcleanup_save_fpu_regs: - TSTMSK __LC_CPU_FLAGS,_CIF_FPU - bor %r14 - clg %r9,BASED(.Lcleanup_save_fpu_regs_done) - jhe 5f - clg %r9,BASED(.Lcleanup_save_fpu_regs_fp) - jhe 4f - clg %r9,BASED(.Lcleanup_save_fpu_regs_vx_high) - jhe 3f - clg %r9,BASED(.Lcleanup_save_fpu_regs_vx_low) - jhe 2f - clg %r9,BASED(.Lcleanup_save_fpu_fpc_end) - jhe 1f - lg %r2,__LC_CURRENT - aghi %r2,__TASK_thread -0: # Store floating-point controls - stfpc __THREAD_FPU_fpc(%r2) -1: # Load register save area and check if VX is active - lg %r3,__THREAD_FPU_regs(%r2) - TSTMSK __LC_MACHINE_FLAGS,MACHINE_FLAG_VX - jz 4f # no VX -> store FP regs -2: # Store vector registers (V0-V15) - VSTM %v0,%v15,0,%r3 # vstm 0,15,0(3) -3: # Store vector registers (V16-V31) - VSTM %v16,%v31,256,%r3 # vstm 16,31,256(3) - j 5f # -> done, set CIF_FPU flag -4: # Store floating-point registers - std 0,0(%r3) - std 1,8(%r3) - std 2,16(%r3) - std 3,24(%r3) - std 4,32(%r3) - std 5,40(%r3) - std 6,48(%r3) - std 7,56(%r3) - std 8,64(%r3) - std 9,72(%r3) - std 10,80(%r3) - std 11,88(%r3) - std 12,96(%r3) - std 13,104(%r3) - std 14,112(%r3) - std 15,120(%r3) -5: # Set CIF_FPU flag - oi __LC_CPU_FLAGS+7,_CIF_FPU - lg %r9,48(%r11) # return from save_fpu_regs + larl %r9,save_fpu_regs br %r14 -.Lcleanup_save_fpu_fpc_end: - .quad .Lsave_fpu_regs_fpc_end -.Lcleanup_save_fpu_regs_vx_low: - .quad .Lsave_fpu_regs_vx_low -.Lcleanup_save_fpu_regs_vx_high: - .quad .Lsave_fpu_regs_vx_high -.Lcleanup_save_fpu_regs_fp: - .quad .Lsave_fpu_regs_fp -.Lcleanup_save_fpu_regs_done: - .quad .Lsave_fpu_regs_done .Lcleanup_load_fpu_regs: - TSTMSK __LC_CPU_FLAGS,_CIF_FPU - bnor %r14 - clg %r9,BASED(.Lcleanup_load_fpu_regs_done) - jhe 1f - clg %r9,BASED(.Lcleanup_load_fpu_regs_fp) - jhe 2f - clg %r9,BASED(.Lcleanup_load_fpu_regs_vx_high) - jhe 3f - clg %r9,BASED(.Lcleanup_load_fpu_regs_vx) - jhe 4f - lg %r4,__LC_CURRENT - aghi %r4,__TASK_thread - lfpc __THREAD_FPU_fpc(%r4) - TSTMSK __LC_MACHINE_FLAGS,MACHINE_FLAG_VX - lg %r4,__THREAD_FPU_regs(%r4) # %r4 <- reg save area - jz 2f # -> no VX, load FP regs -4: # Load V0 ..V15 registers - VLM %v0,%v15,0,%r4 -3: # Load V16..V31 registers - VLM %v16,%v31,256,%r4 - j 1f -2: # Load floating-point registers - ld 0,0(%r4) - ld 1,8(%r4) - ld 2,16(%r4) - ld 3,24(%r4) - ld 4,32(%r4) - ld 5,40(%r4) - ld 6,48(%r4) - ld 7,56(%r4) - ld 8,64(%r4) - ld 9,72(%r4) - ld 10,80(%r4) - ld 11,88(%r4) - ld 12,96(%r4) - ld 13,104(%r4) - ld 14,112(%r4) - ld 15,120(%r4) -1: # Clear CIF_FPU bit - ni __LC_CPU_FLAGS+7,255-_CIF_FPU - lg %r9,48(%r11) # return from load_fpu_regs + larl %r9,load_fpu_regs br %r14 -.Lcleanup_load_fpu_regs_vx: - .quad .Lload_fpu_regs_vx -.Lcleanup_load_fpu_regs_vx_high: - .quad .Lload_fpu_regs_vx_high -.Lcleanup_load_fpu_regs_fp: - .quad .Lload_fpu_regs_fp -.Lcleanup_load_fpu_regs_done: - .quad .Lload_fpu_regs_done /* * Integer constants
Greg Kroah-Hartman
maintainerPATCH 28/210 s390/cpumf: add missing lpp magic initialization
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <[email protected]>
commit 8f100bb1ff27873dd71f636da670e503b9ade3c6 upstream.
Add the missing lpp magic initialization for cpu 0. Without this all samples on cpu 0 do not have the most significant bit set in the program parameter field, which we use to distinguish between guest and host samples if the pid is also 0.
We did initialize the lpp magic in the absolute zero lowcore but forgot that when switching to the allocated lowcore on cpu 0 only.
--- arch/s390/kernel/setup.c | 1 + 1 file changed, 1 insertion(+)
arch/s390/kernel/setup.c +1 -0
@@ -329,6 +329,7 @@ static void __init setup_lowcore(void) +PAGE_SIZE -STACK_FRAME_OVERHEAD -sizeof (struct pt_regs ); lc->current_task = (unsigned long ) init_thread_union.thread_info.task; lc->thread_info = (unsigned long ) &init_thread_union; + lc->lpp =LPP_MAGIC ; lc->machine_flags = S390_lowcore.machine_flags; lc->stfl_fac_list = S390_lowcore.stfl_fac_list; memcpy(lc->stfle_fac_list, S390_lowcore.stfle_fac_list,
Greg Kroah-Hartman
maintainerPATCH 29/210 s390/pci: enforce fmb page boundary rule
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Ott <[email protected]>
commit 80c544ded25ac14d7cc3e555abb8ed2c2da99b84 upstream.
The function measurement block must not cross a page boundary. Ensure that by raising the alignment requirement to the smallest power of 2 larger than the size of the fmb.
--- arch/s390/include/asm/pci.h | 2 +- arch/s390/pci/pci.c | 5 ++++- 2 files changed, 5 insertions(+), 2 deletions(-)
arch/s390/include/asm/pci.h +1 -1
@@ -45,7 +45,7 @@ struct zpci_fmb {u64 rpcit_ops;u64 dma_rbytes;u64 dma_wbytes; -} __packed__aligned(16) ; +} __packed__aligned(64) ;enum zpci_state {ZPCI_FN_STATE_RESERVED ,
arch/s390/pci/pci.c +4 -1
@@ -871,8 +871,11 @@ static inline int barsize(u8 size)static int zpci_mem_init (void ) { +BUILD_BUG_ON (!is_power_of_2 (__alignof__(struct zpci_fmb )) || + __alignof__(struct zpci_fmb ) <sizeof (struct zpci_fmb )); + zdev_fmb_cache =kmem_cache_create ("PCI_FMB_cache" ,sizeof (struct zpci_fmb ), -16 ,0 ,NULL ); + __alignof__(struct zpci_fmb ),0 ,NULL );if (!zdev_fmb_cache) goto error_zdev;
Greg Kroah-Hartman
maintainerPATCH 30/210 pinctrl-bcm2835: Fix cut-and-paste error in "pull" parsing
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Phil Elwell <[email protected]>
commit 2c7e3306d23864d49f686f22e56e180ff0fffb7f upstream.
The DT bindings for pinctrl-bcm2835 allow both the function and pull to contain either one entry or one per pin. However, an error in the DT parsing can cause failures if the number of pulls differs from the number of functions.
--- drivers/pinctrl/bcm/pinctrl-bcm2835.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pinctrl/bcm/pinctrl-bcm2835.c +1 -1
@@ -779,7 +779,7 @@ static int bcm2835_pctl_dt_node_to_map(s }if (num_pulls) { err =of_property_read_u32_index (np,"brcm,pull" , - (num_funcs >1 ) ? i :0 , &pull); + (num_pulls >1 ) ? i :0 , &pull);if (err) goto out; err = bcm2835_pctl_dt_node_to_map_pull(pc, np, pin,
Greg Kroah-Hartman
maintainerPATCH 31/210 PCI: Disable IO/MEM decoding for devices with non-compliant BARs
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bjorn Helgaas <[email protected]>
commit b84106b4e2290c081cdab521fa832596cdfea246 upstream.
The PCI config header (first 64 bytes of each device's config space) is defined by the PCI spec so generic software can identify the device and manage its usage of I/O, memory, and IRQ resources.
Some non-spec-compliant devices put registers other than BARs where the BARs should be. When the PCI core sizes these "BARs", the reads and writes it does may have unwanted side effects, and the "BAR" may appear to describe non-sensical address space.
Add a flag bit to mark non-compliant devices so we don't touch their BARs. Turn off IO/MEM decoding to prevent the devices from consuming address space, since we can't read the BARs to find out what that address space would be.
--- drivers/pci/probe.c | 14 ++++++++++++++ include/linux/pci.h | 1 + 2 files changed, 15 insertions(+)
drivers/pci/probe.c +14 -0
@@ -179,6 +179,9 @@ int __pci_read_base(struct pci_dev *dev,u16 orig_cmd;struct pci_bus_region region, inverted_region; +if (dev->non_compliant_bars) +return 0 ; + mask = type ?PCI_ROM_ADDRESS_MASK : ~0 ;/* No printks while decoding is disabled! */
@@ -1174,6 +1177,7 @@ void pci_msi_setup_pci_dev(struct pci_deint pci_setup_device (struct pci_dev *dev) {u32 class; +u16 cmd;u8 hdr_type;int pos =0 ;struct pci_bus_region region;
@@ -1219,6 +1223,16 @@ int pci_setup_device(struct pci_dev *dev/* device class may be changed after fixup */ class = dev->class >>8 ; +if (dev->non_compliant_bars) { +pci_read_config_word (dev,PCI_COMMAND , &cmd); +if (cmd & (PCI_COMMAND_IO |PCI_COMMAND_MEMORY )) { +dev_info (&dev->dev,"device has non-compliant BARs; disabling IO/MEM decoding\n" ); + cmd &= ~PCI_COMMAND_IO ; + cmd &= ~PCI_COMMAND_MEMORY ; +pci_write_config_word (dev,PCI_COMMAND , cmd); + } + } +switch (dev->hdr_type) {/* header type */ case PCI_HEADER_TYPE_NORMAL :/* standard header */ if (class ==PCI_CLASS_BRIDGE_PCI )
include/linux/pci.h +1 -0
@@ -359,6 +359,7 @@ struct pci_dev { unsigned int io_window_1k:1; /* Intel P2P bridge 1K I/O windows */ unsigned int irq_managed:1; unsigned int has_secondary_link:1; + unsigned int non_compliant_bars:1; /* broken BARs; ignore them */pci_dev_flags_t dev_flags;atomic_t enable_cnt;/* pci_enable_device has been called */
Greg Kroah-Hartman
maintainerPATCH 32/210 PCI: ACPI: IA64: fix IO port generic range check
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Pieralisi <[email protected]>
commit 4a2e7aab4ffce1e0e79b303dc2f9a03aa9f3a332 upstream.
The [0 - 64k] ACPI PCI IO port resource boundary check in:
acpi_dev_ioresource_flags()
is currently applied blindly in the ACPI resource parsing to all architectures, but only x86 suffers from that IO space limitation.
On arches (ie IA64 and ARM64) where IO space is memory mapped, the PCI root bridges IO resource windows are firstly initialized from the _CRS (in acpi_decode_space()) and contain the CPU physical address at which a root bridge decodes IO space in the CPU physical address space with the offset value representing the offset required to translate the PCI bus address into the CPU physical address.
The IO resource windows are then parsed and updated in arch code before creating and enumerating PCI buses (eg IA64 add_io_space()) to map in an arch specific way the obtained CPU physical address range to a slice of virtual address space reserved to map PCI IO space, ending up with PCI bridges resource windows containing IO resources like the following on a working IA64 configuration:
PCI host bridge to bus 0000:00pci_bus 0000:00: root bus resource [io 0x1000000-0x100ffff window] (bus address [0x0000-0xffff])pci_bus 0000:00: root bus resource [mem 0x000a0000-0x000fffff window] pci_bus 0000:00: root bus resource [mem 0x80000000-0x8fffffff window] pci_bus 0000:00: root bus resource [mem 0x80004000000-0x800ffffffff window] pci_bus 0000:00: root bus resource [bus 00]
This implies that the [0 - 64K] check in acpi_dev_ioresource_flags() leaves platforms with memory mapped IO space (ie IA64) broken (ie kernel can't claim IO resources since the host bridge IO resource is disabled and discarded by ACPI core code, see log on IA64 with missing root bridge IO resource, silently filtered by current [0 - 64k] check in acpi_dev_ioresource_flags()):
PCI host bridge to bus 0000:00pci_bus 0000:00: root bus resource [mem 0x000a0000-0x000fffff window] pci_bus 0000:00: root bus resource [mem 0x80000000-0x8fffffff window] pci_bus 0000:00: root bus resource [mem 0x80004000000-0x800ffffffff window] pci_bus 0000:00: root bus resource [bus 00]
[...]
pci 0000:00:03.0: [1002:515e] type 00 class 0x030000
pci 0000:00:03.0: reg 0x10: [mem 0x80000000-0x87ffffff pref] pci 0000:00:03.0: reg 0x14: [io 0x1000-0x10ff]
pci 0000:00:03.0: reg 0x18: [mem 0x88020000-0x8802ffff]
pci 0000:00:03.0: reg 0x30: [mem 0x88000000-0x8801ffff pref] pci 0000:00:03.0: supports D1 D2
pci 0000:00:03.0: can't claim BAR 1 [io 0x1000-0x10ff]: no compatible bridge window
For this reason, the IO port resources boundaries check in generic ACPI parsing code should be guarded with a CONFIG_X86 guard so that more arches (ie ARM64) can benefit from the generic ACPI resources parsing interface without incurring in unexpected resource filtering, fixing at the same time current breakage on IA64.
This patch factors out IO ports boundary [0 - 64k] check in generic ACPI code and makes the IO space check X86 specific to make sure that IO space resources are usable on other arches too.
--- drivers/acpi/resource.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-)
drivers/acpi/resource.c +13 -1
@@ -26,8 +26,20 @@#ifdef CONFIG_X86 #define valid_IRQ (i) (((i) != 0) && ((i) != 2)) +static inline bool acpi_iospace_resource_valid (struct resource *res) +{ +/* On X86 IO space is limited to the [0 - 64K] IO port range */ +return res->end <0x10003 ; +}#else #define valid_IRQ (i) (true) +/* +* ACPI IO descriptors on arches other than X86 contain MMIO CPU physical +* addresses mapping IO space in CPU physical address space, IO space +* resources can be placed anywhere in the 64-bit physical address space. +*/ +static inline bool +acpi_iospace_resource_valid (struct resource *res) {return true; }#endif static bool acpi_dev_resource_len_valid (u64 start,u64 end,u64 len,bool io)
@@ -126,7 +138,7 @@ static void acpi_dev_ioresource_flags(stif (!acpi_dev_resource_len_valid (res->start, res->end, len, true)) res->flags |=IORESOURCE_DISABLED |IORESOURCE_UNSET ; -if (res->end >=0x10003 ) +if (!acpi_iospace_resource_valid (res)) res->flags |=IORESOURCE_DISABLED |IORESOURCE_UNSET ;if (io_decode ==ACPI_DECODE_16 )
Greg Kroah-Hartman
maintainerPATCH 33/210 x86/irq: Cure live lock in fixup_irqs()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <[email protected]>
commit 551adc60573cb68e3d55cacca9ba1b7437313df7 upstream.
Harry reported, that he's able to trigger a system freeze with cpu hot unplug. The freeze turned out to be a live lock caused by recent changes in irq_force_complete_move().
When fixup_irqs() and from there irq_force_complete_move() is called on the dying cpu, then all other cpus are in stop machine an wait for the dying cpu to complete the teardown. If there is a move of an interrupt pending then irq_force_complete_move() sends the cleanup IPI to the cpus in the old_domain mask and waits for them to clear the mask. That's obviously impossible as those cpus are firmly stuck in stop machine with interrupts disabled.
I should have known that, but I completely overlooked it being concentrated on the locking issues around the vectors. And the existance of the call to __irq_complete_move() in the code, which actually sends the cleanup IPI made it reasonable to wait for that cleanup to complete. That call was bogus even before the recent changes as it was just a pointless distraction.
We have to look at two cases:
1) The move_in_progress flag of the interrupt is set
This means the ioapic has been updated with the new vector, but it has not fired yet. In theory there is a race:
set_ioapic(new_vector) <-- Interrupt is raised before update is effective,
i.e. it's raised on the old vector.
So if the target cpu cannot handle that interrupt before the old vector is cleaned up, we get a spurious interrupt and in the worst case the ioapic irq line becomes stale, but my experiments so far have only resulted in spurious interrupts.
But in case of cpu hotplug this should be a non issue because if the affinity update happens right before all cpus rendevouz in stop machine, there is no way that the interrupt can be blocked on the target cpu because all cpus loops first with interrupts enabled in stop machine, so the old vector is not yet cleaned up when the interrupt fires.
So the only way to run into this issue is if the delivery of the interrupt on the apic/system bus would be delayed beyond the point where the target cpu disables interrupts in stop machine. I doubt that it can happen, but at least there is a theroretical chance. Virtualization might be able to expose this, but AFAICT the IOAPIC emulation is not as stupid as the real hardware.
I've spent quite some time over the weekend to enforce that situation, though I was not able to trigger the delayed case.
2) The move_in_progress flag is not set and the old_domain cpu mask is not empty.
That means, that an interrupt was delivered after the change and the cleanup IPI has been sent to the cpus in old_domain, but not all CPUs have responded to it yet.
In both cases we can assume that the next interrupt will arrive on the new vector, so we can cleanup the old vectors on the cpus in the old_domain cpu mask.
--- arch/x86/include/asm/hw_irq.h | 1 arch/x86/kernel/apic/vector.c | 88 +++++++++++++++++++++++++++++++++--------- 2 files changed, 71 insertions(+), 18 deletions(-)
arch/x86/include/asm/hw_irq.h +1 -0
@@ -136,6 +136,7 @@ struct irq_alloc_info {struct irq_cfg {unsigned int dest_apicid;u8 vector; +u8 old_vector; };extern struct irq_cfg *irq_cfg (unsigned int irq);
arch/x86/kernel/apic/vector.c +70 -18
122 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 34/210 x86/apic: Fix suspicious RCU usage in smp_trace_call_function_interrupt()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Jones <[email protected]>
commit 7834c10313fb823e538f2772be78edcdeed2e6e3 upstream.
Since 4.4, I've been able to trigger this occasionally:
===============================
[ INFO: suspicious RCU usage. ]
4.5.0-rc7-think+ #3 Not tainted
-------------------------------./arch/x86/include/asm/msr-trace.h:47 suspicious rcu_dereference_check() usage!
other info that might help us debug this:
RCU used illegally from idle CPU!rcu_scheduler_active = 1, debug_locks = 1
RCU used illegally from extended quiescent state!
no locks held by swapper/3/0.
stack backtrace: CPU: 3 PID: 0 Comm: swapper/3 Not tainted 4.5.0-rc7-think+ #3 ffffffff92f821e0 1f3e5c340597d7fc ffff880468e07f10 ffffffff92560c2a ffff880462145280 0000000000000001 ffff880468e07f40 ffffffff921376a6 ffffffff93665ea0 0000cc7c876d28da 0000000000000005 ffffffff9383dd60 Call Trace: <IRQ> [<ffffffff92560c2a>] dump_stack+0x67/0x9d [<ffffffff921376a6>] lockdep_rcu_suspicious+0xe6/0x100 [<ffffffff925ae7a7>] do_trace_write_msr+0x127/0x1a0 [<ffffffff92061c83>] native_apic_msr_eoi_write+0x23/0x30 [<ffffffff92054408>] smp_trace_call_function_interrupt+0x38/0x360 [<ffffffff92d1ca60>] trace_call_function_interrupt+0x90/0xa0 <EOI> [<ffffffff92ac5124>] ? cpuidle_enter_state+0x1b4/0x520
Move the entering_irq() call before ack_APIC_irq(), because entering_irq() tells the RCU susbstems to end the extended quiescent state, so that the following trace call in ack_APIC_irq() works correctly.
--- arch/x86/include/asm/apic.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/include/asm/apic.h +1 -1
@@ -638,8 +638,8 @@ static inline void entering_irq(void)static inline void entering_ack_irq (void ) { -ack_APIC_irq ();entering_irq (); +ack_APIC_irq (); }static inline void ipi_entering_ack_irq (void )
Greg Kroah-Hartman
maintainerPATCH 35/210 x86/iopl/64: Properly context-switch IOPL on Xen PV
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Lutomirski <[email protected]>
commit b7a584598aea7ca73140cb87b40319944dd3393f upstream.
On Xen PV, regs->flags doesn't reliably reflect IOPL and the exit-to-userspace code doesn't change IOPL. We need to context switch it manually.
I'm doing this without going through paravirt because this is specific to Xen PV. After the dust settles, we can merge this with the 32-bit code, tidy up the iopl syscall implementation, and remove the set_iopl pvop entirely.
Fixes XSA-171.
--- arch/x86/include/asm/xen/hypervisor.h | 2 ++ arch/x86/kernel/process_64.c | 12 ++++++++++++ arch/x86/xen/enlighten.c | 2 +- 3 files changed, 15 insertions(+), 1 deletion(-)
arch/x86/include/asm/xen/hypervisor.h +2 -0
@@ -62,4 +62,6 @@ void xen_arch_register_cpu(int num);void xen_arch_unregister_cpu (int num);#endif +extern void xen_set_iopl_mask (unsigned mask); +#endif /* _ASM_X86_XEN_HYPERVISOR_H */
arch/x86/kernel/process_64.c +12 -0
@@ -48,6 +48,7 @@#include <asm/syscalls.h> #include <asm/debugreg.h> #include <asm/switch_to.h> +#include <asm/xen/hypervisor.h> asmlinkage extern void ret_from_fork(void);
@@ -411,6 +412,17 @@ __switch_to(struct task_struct *prev_p, task_thread_info(prev_p)->flags & _TIF_WORK_CTXSW_PREV))__switch_to_xtra (prev_p, next_p, tss); +#ifdef CONFIG_XEN +/* +* On Xen PV, IOPL bits in pt_regs->flags have no effect, and +* current_pt_regs()->flags may not match the current task's +* intended IOPL. We need to switch it manually. +*/ +if (unlikely (static_cpu_has (X86_FEATURE_XENPV ) && + prev->iopl != next->iopl)) +xen_set_iopl_mask (next->iopl); +#endif +if (static_cpu_has_bug (X86_BUG_SYSRET_SS_ATTRS )) {/* * AMD CPUs have a misfeature: SYSRET sets the SS selector but
arch/x86/xen/enlighten.c +1 -1
@@ -961,7 +961,7 @@ static void xen_load_sp0(struct tss_stru tss->x86_tss.sp0 = thread->sp0; } -static void xen_set_iopl_mask (unsigned mask) +void xen_set_iopl_mask (unsigned mask) {struct physdev_set_iopl set_iopl;
Greg Kroah-Hartman
maintainerPATCH 36/210 x86/iopl: Fix iopl capability check on Xen PV
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Lutomirski <[email protected]>
commit c29016cf41fe9fa994a5ecca607cf5f1cd98801e upstream.
iopl(3) is supposed to work if iopl is already 3, even if unprivileged. This didn't work right on Xen PV. Fix it.
--- arch/x86/kernel/ioport.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
arch/x86/kernel/ioport.c +9 -3
@@ -96,9 +96,14 @@ asmlinkage long sys_ioperm(unsigned long SYSCALL_DEFINE1(iopl, unsigned int, level) {struct pt_regs *regs =current_pt_regs (); -unsigned int old = (regs->flags >>12 ) &3 ;struct thread_struct *t = ¤t->thread; +/* +* Careful: the IOPL bits in regs->flags are undefined under Xen PV +* and changing them has no effect. +*/ +unsigned int old = t->iopl >>X86_EFLAGS_IOPL_BIT ; +if (level >3 )return -EINVAL ;/* Trying to gain more privileges? */
@@ -106,8 +111,9 @@ SYSCALL_DEFINE1(iopl, unsigned int, leveif (!capable (CAP_SYS_RAWIO ))return -EPERM ; } - regs->flags = (regs->flags & ~X86_EFLAGS_IOPL ) | (level <<12 ); - t->iopl = level <<12 ; + regs->flags = (regs->flags & ~X86_EFLAGS_IOPL ) | + (level <<X86_EFLAGS_IOPL_BIT ); + t->iopl = level <<X86_EFLAGS_IOPL_BIT ;set_iopl_mask (t->iopl);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 37/210 x86/mm: TLB_REMOTE_SEND_IPI should count pages
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nadav Amit <[email protected]>
commit 18c98243ddf05a1827ad2c359c5ac051101e7ff7 upstream.
TLB_REMOTE_SEND_IPI was recently introduced, but it counts bytes instead of pages. In addition, it does not report correctly the case in which flush_tlb_page flushes a page. Fix it to be consistent with other TLB counters.
--- arch/x86/mm/tlb.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
arch/x86/mm/tlb.c +9 -3
@@ -106,8 +106,6 @@ static void flush_tlb_func(void *info)if (f->flush_mm !=this_cpu_read (cpu_tlbstate.active_mm))return ; -if (!f->flush_end) - f->flush_end = f->flush_start +PAGE_SIZE ;count_vm_tlb_event (NR_TLB_REMOTE_FLUSH_RECEIVED );if (this_cpu_read (cpu_tlbstate.state) ==TLBSTATE_OK ) {
@@ -135,12 +133,20 @@ void native_flush_tlb_others(const struc unsigned long end) {struct flush_tlb_info info; + +if (end ==0 ) + end = start +PAGE_SIZE ; info.flush_mm = mm; info.flush_start = start; info.flush_end = end;count_vm_tlb_event (NR_TLB_REMOTE_FLUSH ); -trace_tlb_flush (TLB_REMOTE_SEND_IPI , end - start); +if (end ==TLB_FLUSH_ALL ) +trace_tlb_flush (TLB_REMOTE_SEND_IPI ,TLB_FLUSH_ALL ); +else +trace_tlb_flush (TLB_REMOTE_SEND_IPI , + (end - start) >>PAGE_SHIFT ); +if (is_uv_system ()) {unsigned int cpu;
Greg Kroah-Hartman
maintainerPATCH 38/210 sg: fix dxferp in from_to case
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Douglas Gilbert <[email protected]>
commit 5ecee0a3ee8d74b6950cb41e8989b0c2174568d4 upstream.
One of the strange things that the original sg driver did was let the user provide both a data-out buffer (it followed the sg_header+cdb) _and_ specify a reply length greater than zero. What happened was that the user data-out buffer was copied into some kernel buffers and then the mid level was told a read type operation would take place with the data from the device overwriting the same kernel buffers. The user would then read those kernel buffers back into the user space.
Quoted 1 line
Quoted 1 line
From what I can tell, the above action was broken by commit
fad7f01e61bf
("sg: set dxferp to NULL for READ with the older SG interface") in 2008 and syzkaller found that out recently.
Make sure that a user space pointer is passed through when data follows the sg_header structure and command. Fix the abnormal case when a non-zero reply_len is also given.
--- drivers/scsi/sg.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/scsi/sg.c +2 -1
@@ -652,7 +652,8 @@ sg_write(struct file *filp, const char _else hp->dxfer_direction = (mxsize >0 ) ?SG_DXFER_FROM_DEV :SG_DXFER_NONE ; hp->dxfer_len = mxsize; -if (hp->dxfer_direction ==SG_DXFER_TO_DEV ) +if ((hp->dxfer_direction ==SG_DXFER_TO_DEV ) || + (hp->dxfer_direction ==SG_DXFER_TO_FROM_DEV )) hp->dxferp = (char __user *)buf + cmd_size;else hp->dxferp =NULL ;
Greg Kroah-Hartman
maintainerPATCH 39/210 aacraid: Fix RRQ overload
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Raghava Aditya Renukunta <[email protected]>
commit 3f4ce057d51a9c0ed9b01ba693df685d230ffcae upstream.
The driver utilizes an array of atomic variables to keep track of IO submissions to each vector. To submit an IO multiple threads iterate through the array to find a vector which has empty slots to send an IO. The reading and updating of the variable is not atomic, causing race conditions when a thread uses a full vector to submit an IO.
Fixed by mapping each FIB to a vector, the submission path then uses said vector to submit IO thereby removing the possibly of a race condition.The vector assignment is started from 1 since vector 0 is reserved for the use of AIF management FIBS.If the number of MSIx vectors is 1 (MSI or INTx mode) then all the fibs are allocated to vector 0.
--- drivers/scsi/aacraid/aacraid.h | 2 ++ drivers/scsi/aacraid/commsup.c | 28 ++++++++++++++++++++++++++++ drivers/scsi/aacraid/src.c | 30 +++++++----------------------- 3 files changed, 37 insertions(+), 23 deletions(-)
drivers/scsi/aacraid/aacraid.h +2 -0
@@ -944,6 +944,7 @@ struct fib {*/ struct list_head fiblink;void *data; +u32 vector_no;struct hw_fib *hw_fib_va;/* Actual shared object */ dma_addr_t hw_fib_pa;/* physical address of hw_fib*/ };
@@ -2113,6 +2114,7 @@ static inline unsigned int cap_to_cyls(sint aac_acquire_irq (struct aac_dev *dev);void aac_free_irq (struct aac_dev *dev);const char *aac_driverinfo (struct Scsi_Host *); +void aac_fib_vector_assign (struct aac_dev *dev);struct fib *aac_fib_alloc (struct aac_dev *dev);int aac_fib_setup (struct aac_dev *dev);void aac_fib_map_free (struct aac_dev *dev);
drivers/scsi/aacraid/commsup.c +28 -0
@@ -90,6 +90,28 @@ void aac_fib_map_free(struct aac_dev *de dev->hw_fib_pa =0 ; } +void aac_fib_vector_assign (struct aac_dev *dev) +{ +u32 i =0 ; +u32 vector =1 ; +struct fib *fibptr =NULL ; + +for (i =0 , fibptr = &dev->fibs[i]; + i < (dev->scsi_host_ptr->can_queue +AAC_NUM_MGT_FIB ); + i++, fibptr++) { +if ((dev->max_msix ==1 ) || + (i > ((dev->scsi_host_ptr->can_queue +AAC_NUM_MGT_FIB -1 ) + - dev->vector_cap))) { + fibptr->vector_no =0 ; + }else { + fibptr->vector_no = vector; + vector++; +if (vector == dev->max_msix) + vector =1 ; + } + } +} +/** * aac_fib_setup - setup the fibs * @dev: Adapter to set up
@@ -151,6 +173,12 @@ int aac_fib_setup(struct aac_dev * dev) hw_fib_pa = hw_fib_pa + dev->max_fib_size +sizeof (struct aac_fib_xporthdr ); } + +/* +*Assign vector numbers to fibs +*/ +aac_fib_vector_assign (dev); +/* * Add the fib chain to the free list */
drivers/scsi/aacraid/src.c +7 -23
@@ -156,8 +156,8 @@ static irqreturn_t aac_src_intr_message(break ;if (dev->msi_enabled && dev->max_msix >1 )atomic_dec (&dev->rrq_outstanding[vector_no]); -aac_intr_normal (dev, handle-1 ,0 , isFastResponse,NULL ); dev->host_rrq[index++] =0 ; +aac_intr_normal (dev, handle-1 ,0 , isFastResponse,NULL );if (index == (vector_no +1 ) * dev->vector_cap) index = vector_no * dev->vector_cap; dev->host_rrq_idx[vector_no] = index;
@@ -452,36 +452,20 @@ static int aac_src_deliver_message(struc#endif u16 hdr_size =le16_to_cpu (fib->hw_fib_va->header.Size); +u16 vector_no;atomic_inc (&q->numpending);if (dev->msi_enabled && fib->hw_fib_va->header.Command != AifRequest && dev->max_msix >1 ) { -u_int16_t vector_no, first_choice =0xffff ; - - vector_no = dev->fibs_pushed_no % dev->max_msix; -do { - vector_no +=1 ; -if (vector_no == dev->max_msix) - vector_no =1 ; -if (atomic_read (&dev->rrq_outstanding[vector_no]) < - dev->vector_cap) -break ; -if (0xffff == first_choice) - first_choice = vector_no; -else if (vector_no == first_choice) -break ; - }while (1 ); -if (vector_no == first_choice) - vector_no =0 ; -atomic_inc (&dev->rrq_outstanding[vector_no]); -if (dev->fibs_pushed_no ==0xffffffff ) - dev->fibs_pushed_no =0 ; -else - dev->fibs_pushed_no++; + vector_no = fib->vector_no; fib->hw_fib_va->header.Handle += (vector_no <<16 ); + }else { + vector_no =0 ; } +atomic_inc (&dev->rrq_outstanding[vector_no]); +if (dev->comm_interface ==AAC_COMM_MESSAGE_TYPE2 ) {/* Calculate the amount to the fibsize bits */ fibsize = (hdr_size +127 ) /128 -1 ;
Greg Kroah-Hartman
maintainerPATCH 40/210 aacraid: Fix memory leak in aac_fib_map_free
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Raghava Aditya Renukunta <[email protected]>
commit f88fa79a61726ce9434df9b4aede36961f709f17 upstream.
aac_fib_map_free() calls pci_free_consistent() without checking that dev->hw_fib_va is not NULL and dev->max_fib_size is not zero.If they are indeed NULL/0, this will result in a hang as pci_free_consistent() will attempt to invalidate cache for the entire 64-bit address space (which would take a very long time).
Fixed by adding a check to make sure that dev->hw_fib_va and dev->max_fib_size are not NULL and 0 respectively.
--- drivers/scsi/aacraid/commsup.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/scsi/aacraid/commsup.c +6 -3
@@ -83,9 +83,12 @@ static int fib_map_alloc(struct aac_devvoid aac_fib_map_free (struct aac_dev *dev) { -pci_free_consistent (dev->pdev, - dev->max_fib_size * (dev->scsi_host_ptr->can_queue +AAC_NUM_MGT_FIB ), - dev->hw_fib_va, dev->hw_fib_pa); +if (dev->hw_fib_va && dev->max_fib_size) { +pci_free_consistent (dev->pdev, + (dev->max_fib_size * + (dev->scsi_host_ptr->can_queue +AAC_NUM_MGT_FIB )), + dev->hw_fib_va, dev->hw_fib_pa); + } dev->hw_fib_va =NULL ; dev->hw_fib_pa =0 ; }
Greg Kroah-Hartman
maintainerPATCH 41/210 aacraid: Set correct msix count for EEH recovery
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Raghava Aditya Renukunta <[email protected]>
commit ecc479e00db8eb110b200afe1effcb3df20ca7ae upstream.
During EEH recovery number of online CPU's might change thereby changing the number of MSIx vectors. Since each fib is allocated to a vector, changes in the number of vectors causes fib to be sent thru invalid vectors.In addition the correct number of MSIx vectors is not updated in the INIT struct sent to the controller, when it is reinitialized.
Fixed by reassigning vectors to fibs based on the updated number of MSIx vectors and updating the INIT structure before sending to controller.
--- drivers/scsi/aacraid/linit.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
drivers/scsi/aacraid/linit.c +11 -1
@@ -1404,8 +1404,18 @@ static int aac_acquire_resources(structaac_adapter_enable_int (dev); -if (!dev->sync_mode) +/*max msix may change after EEH +* Re-assign vectors to fibs +*/ +aac_fib_vector_assign (dev); + +if (!dev->sync_mode) { +/* After EEH recovery or suspend resume, max_msix count +* may change, therfore updating in init as well. +*/ aac_adapter_start (dev); + dev->init->Sa_MSIXVectors =cpu_to_le32 (dev->max_msix); + }return 0 ; error_iounmap:
Greg Kroah-Hartman
maintainerPATCH 42/210 sd: Fix discard granularity when LBPRZ=1
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin K. Petersen <[email protected]>
commit 6540a65da90c09590897310e31993b1f6e28485a upstream.
Commit 397737223c59 ("sd: Make discard granularity match logical block size when LBPRZ=1") accidentally set the granularity to one byte instead of one logical block on devices that provide deterministic zeroes after UNMAP.
--- drivers/scsi/sd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/sd.c +1 -1
@@ -648,7 +648,7 @@ static void sd_config_discard(struct scs*/ if (sdkp->lbprz) { q->limits.discard_alignment =0 ; - q->limits.discard_granularity =1 ; + q->limits.discard_granularity = logical_block_size; }else { q->limits.discard_alignment = sdkp->unmap_alignment * logical_block_size;
Greg Kroah-Hartman
maintainerPATCH 43/210 scsi: storvsc: fix SRB_STATUS_ABORTED handling
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vitaly Kuznetsov <[email protected]>
commit ff06c5ffbcb4ffa542fb80c897be977956fafecc upstream.
Commit 3209f9d780d1 ("scsi: storvsc: Fix a bug in the handling of SRB status flags") filtered SRB_STATUS_AUTOSENSE_VALID out effectively making the (SRB_STATUS_ABORTED | SRB_STATUS_AUTOSENSE_VALID) case a dead code. The logic from this branch (e.g. storvsc_device_scan() call) is still required, fix the check.
--- drivers/scsi/storvsc_drv.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/scsi/storvsc_drv.c +3 -2
@@ -889,8 +889,9 @@ static void storvsc_handle_error(struct do_work = true; process_err_fn = storvsc_remove_lun;break ; -case (SRB_STATUS_ABORTED |SRB_STATUS_AUTOSENSE_VALID ): -if ((asc ==0x2a ) && (ascq ==0x9 )) { +case SRB_STATUS_ABORTED : +if (vm_srb->srb_status &SRB_STATUS_AUTOSENSE_VALID && + (asc ==0x2a ) && (ascq ==0x9 )) { do_work = true; process_err_fn = storvsc_device_scan;/*
Greg Kroah-Hartman
maintainerPATCH 44/210 be2iscsi: set the boot_kset pointer to NULL in case of failure
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maurizio Lombardi <[email protected]>
commit 84bd64993f916bcf86270c67686ecf4cea7b8933 upstream.
In beiscsi_setup_boot_info(), the boot_kset pointer should be set to NULL in case of failure otherwise an invalid pointer dereference may occur later.
--- drivers/scsi/be2iscsi/be_main.c | 1 + 1 file changed, 1 insertion(+)
drivers/scsi/be2iscsi/be_main.c +1 -0
@@ -4470,6 +4470,7 @@ put_shost:scsi_host_put (phba->shost); free_kset:iscsi_boot_destroy_kset (phba->boot_kset); + phba->boot_kset =NULL ;return -ENOMEM ; }
Greg Kroah-Hartman
maintainerPATCH 45/210 aic7xxx: Fix queue depth handling
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan <[email protected]>
commit 5a51a7abca133860a6f4429655a9eda3c4afde32 upstream.
We were setting the queue depth correctly, then setting it back to two. If you hit this as a bisection point then please send me an email as it would imply we've been hiding other bugs with this one.
--- drivers/scsi/aic7xxx/aic7xxx_osm.c | 1 + 1 file changed, 1 insertion(+)
drivers/scsi/aic7xxx/aic7xxx_osm.c +1 -0
@@ -1336,6 +1336,7 @@ ahc_platform_set_tags(struct ahc_softc *case AHC_DEV_Q_TAGGED :scsi_change_queue_depth (sdev, dev->openings + dev->active); +break ;default :/* * We allow the OS to queue 2 untagged transactions to
Greg Kroah-Hartman
maintainerPATCH 46/210 libnvdimm: Fix security issue with DSM IOCTL.
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerry Hoemann <[email protected]>
commit 07accfa9d1a8bac8262f6d24a94a54d2d1f35149 upstream.
Code attempts to prevent certain IOCTL DSM from being called when device is opened read only. This security feature can be trivially overcome by changing the size portion of the ioctl_command which isn't used.
Check only the _IOC_NR (i.e. the command).
--- drivers/nvdimm/bus.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/nvdimm/bus.c +4 -4
@@ -513,10 +513,10 @@ static int __nd_ioctl(struct nvdimm_bus/* fail write commands (when read-only) */ if (read_only) -switch (ioctl_cmd) { -case ND_IOCTL_VENDOR : -case ND_IOCTL_SET_CONFIG_DATA : -case ND_IOCTL_ARS_START : +switch (cmd) { +case ND_CMD_VENDOR : +case ND_CMD_SET_CONFIG_DATA : +case ND_CMD_ARS_START :dev_dbg (&nvdimm_bus->dev,"'%s' command while read-only.\n" , nvdimm ?nvdimm_cmd_name (cmd) :nvdimm_bus_cmd_name (cmd));
Greg Kroah-Hartman
maintainerPATCH 47/210 dm snapshot: disallow the COW and origin devices from being identical
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: DingXiang <[email protected]>
commit 4df2bf466a9c9c92f40d27c4aa9120f4e8227bfc upstream.
Otherwise loading a "snapshot" table using the same device for the origin and COW devices, e.g.:
echo "0 20971520 snapshot 253:3 253:3 P 8" | dmsetup create snap
will trigger:
BUG: unable to handle kernel NULL pointer dereference at 0000000000000098 [ 1958.979934] IP: [<ffffffffa040efba>] dm_exception_store_set_chunk_size+0x7a/0x110 [dm_snapshot] [ 1958.989655] PGD 0 [ 1958.991903] Oops: 0000 [#1] SMP ... [ 1959.059647] CPU: 9 PID: 3556 Comm: dmsetup Tainted: G IO 4.5.0-rc5.snitm+ #150 ... [ 1959.083517] task: ffff8800b9660c80 ti: ffff88032a954000 task.ti: ffff88032a954000 [ 1959.091865] RIP: 0010:[<ffffffffa040efba>] [<ffffffffa040efba>] dm_exception_store_set_chunk_size+0x7a/0x110 [dm_snapshot] [ 1959.104295] RSP: 0018:ffff88032a957b30 EFLAGS: 00010246 [ 1959.110219] RAX: 0000000000000000 RBX: 0000000000000008 RCX: 0000000000000001 [ 1959.118180] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff880329334a00 [ 1959.126141] RBP: ffff88032a957b50 R08: 0000000000000000 R09: 0000000000000001 [ 1959.134102] R10: 000000000000000a R11: f000000000000000 R12: ffff880330884d80 [ 1959.142061] R13: 0000000000000008 R14: ffffc90001c13088 R15: ffff880330884d80 [ 1959.150021] FS: 00007f8926ba3840(0000) GS:ffff880333440000(0000) knlGS:0000000000000000 [ 1959.159047] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1959.165456] CR2: 0000000000000098 CR3: 000000032f48b000 CR4: 00000000000006e0 [ 1959.173415] Stack: [ 1959.175656] ffffc90001c13040 ffff880329334a00 ffff880330884ed0 ffff88032a957bdc [ 1959.183946] ffff88032a957bb8 ffffffffa040f225 ffff880329334a30 ffff880300000000 [ 1959.192233] ffffffffa04133e0 ffff880329334b30 0000000830884d58 00000000569c58cf [ 1959.200521] Call Trace: [ 1959.203248] [<ffffffffa040f225>] dm_exception_store_create+0x1d5/0x240 [dm_snapshot] [ 1959.211986] [<ffffffffa040d310>] snapshot_ctr+0x140/0x630 [dm_snapshot] [ 1959.219469] [<ffffffffa0005c44>] ? dm_split_args+0x64/0x150 [dm_mod] [ 1959.226656] [<ffffffffa0005ea7>] dm_table_add_target+0x177/0x440 [dm_mod] [ 1959.234328] [<ffffffffa0009203>] table_load+0x143/0x370 [dm_mod] [ 1959.241129] [<ffffffffa00090c0>] ? retrieve_status+0x1b0/0x1b0 [dm_mod] [ 1959.248607] [<ffffffffa0009e35>] ctl_ioctl+0x255/0x4d0 [dm_mod] [ 1959.255307] [<ffffffff813304e2>] ? memzero_explicit+0x12/0x20 [ 1959.261816] [<ffffffffa000a0c3>] dm_ctl_ioctl+0x13/0x20 [dm_mod] [ 1959.268615] [<ffffffff81215eb6>] do_vfs_ioctl+0xa6/0x5c0 [ 1959.274637] [<ffffffff81120d2f>] ? __audit_syscall_entry+0xaf/0x100 [ 1959.281726] [<ffffffff81003176>] ? do_audit_syscall_entry+0x66/0x70 [ 1959.288814] [<ffffffff81216449>] SyS_ioctl+0x79/0x90 [ 1959.294450] [<ffffffff8167e4ae>] entry_SYSCALL_64_fastpath+0x12/0x71 ... [ 1959.323277] RIP [<ffffffffa040efba>] dm_exception_store_set_chunk_size+0x7a/0x110 [dm_snapshot] [ 1959.333090] RSP <ffff88032a957b30> [ 1959.336978] CR2: 0000000000000098 [ 1959.344121] ---[ end trace b049991ccad1169e ]---
--- drivers/md/dm-snap.c | 9 +++++++++ drivers/md/dm-table.c | 36 ++++++++++++++++++++++++------------ include/linux/device-mapper.h | 2 ++ 3 files changed, 35 insertions(+), 12 deletions(-)
drivers/md/dm-snap.c +9 -0
@@ -1106,6 +1106,7 @@ static int snapshot_ctr(struct dm_targetint i;int r = -EINVAL ;char *origin_path, *cow_path; +dev_t origin_dev, cow_dev;unsigned args_used, num_flush_bios =1 ;fmode_t origin_mode =FMODE_READ ;
@@ -1136,11 +1137,19 @@ static int snapshot_ctr(struct dm_target ti->error ="Cannot get origin device" ; goto bad_origin; } + origin_dev = s->origin->bdev->bd_dev; cow_path = argv[0 ]; argv++; argc--; + cow_dev =dm_get_dev_t (cow_path); +if (cow_dev && cow_dev == origin_dev) { + ti->error ="COW device cannot be the same as origin device" ; + r = -EINVAL ; + goto bad_cow; + } + r =dm_get_device (ti, cow_path,dm_table_get_mode (ti->table), &s->cow);if (r) { ti->error ="Cannot get COW device" ;
drivers/md/dm-table.c +24 -12
@@ -365,6 +365,26 @@ static int upgrade_mode(struct dm_dev_in }/* +* Convert the path to a device +*/ +dev_t dm_get_dev_t (const char *path) +{ +dev_t uninitialized_var (dev ); +struct block_device *bdev; + + bdev =lookup_bdev (path); +if (IS_ERR (bdev)) + dev =name_to_dev_t (path); +else { + dev = bdev->bd_dev; +bdput (bdev); + } + +return dev; +} +EXPORT_SYMBOL_GPL (dm_get_dev_t); + +/* * Add a device to the list, or just increment the usage count if * it's already present. */
@@ -372,23 +392,15 @@ int dm_get_device(struct dm_target *ti, struct dm_dev **result) {int r; -dev_t uninitialized_var (dev ); +dev_t dev;struct dm_dev_internal *dd;struct dm_table *t = ti->table; -struct block_device *bdev;BUG_ON (!t); -/* convert the path to a device */ - bdev =lookup_bdev (path); -if (IS_ERR (bdev)) { - dev =name_to_dev_t (path); -if (!dev) -return -ENODEV ; - }else { - dev = bdev->bd_dev; -bdput (bdev); - } + dev =dm_get_dev_t (path); +if (!dev) +return -ENODEV ; dd =find_device (&t->devices, dev);if (!dd) {
include/linux/device-mapper.h +2 -0
@@ -124,6 +124,8 @@ struct dm_dev {char name[16 ]; }; +dev_t dm_get_dev_t (const char *path); +/* * Constructors should call these functions to ensure destination devices * are opened/closed correctly.
Greg Kroah-Hartman
maintainerPATCH 48/210 dm: fix excessive dm-mq context switching
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Snitzer <[email protected]>
commit 6acfe68bac7e6f16dc312157b1fa6e2368985013 upstream.
Request-based DM's blk-mq support (dm-mq) was reported to be 50% slower than if an underlying null_blk device were used directly. One of the reasons for this drop in performance is that blk_insert_clone_request() was calling blk_mq_insert_request() with @async=true. This forced the use of kblockd_schedule_delayed_work_on() to run the blk-mq hw queues which ushered in ping-ponging between process context (fio in this case) and kblockd's kworker to submit the cloned request. The ftrace function_graph tracer showed:
kworker-2013 => fio-12190
fio-12190 => kworker-2013
...
kworker-2013 => fio-12190
fio-12190 => kworker-2013
...
Fixing blk_insert_clone_request()'s blk_mq_insert_request() call to _not_ use kblockd to submit the cloned requests isn't enough to eliminate the observed context switches.
In addition to this dm-mq specific blk-core fix, there are 2 DM core fixes to dm-mq that (when paired with the blk-core fix) completely eliminate the observed context switching:
1) don't blk_mq_run_hw_queues in blk-mq request completion
Motivated by desire to reduce overhead of dm-mq, punting to kblockd just increases context switches.
In my testing against a really fast null_blk device there was no benefit to running blk_mq_run_hw_queues() on completion (and no other blk-mq driver does this). So hopefully this change doesn't induce the need for yet another revert like commit 621739b00e16ca2d !
2) use blk_mq_complete_request() in dm_complete_request()
blk_complete_request() doesn't offer the traditional q->mq_ops vs .request_fn branching pattern that other historic block interfaces do (e.g. blk_get_request). Using blk_mq_complete_request() for blk-mq requests is important for performance. It should be noted that, like blk_complete_request(), blk_mq_complete_request() doesn't natively handle partial completions -- but the request-based DM-multipath target does provide the required partial completion support by dm.c:end_clone_bio() triggering requeueing of the request via dm-mpath.c:multipath_end_io()'s return of DM_ENDIO_REQUEUE.
dm-mq fix #2 is _much_ more important than #1 for eliminating the context switches.
Before: cpu : usr=15.10%, sys=59.39%, ctx=7905181, majf=0, minf=475 After: cpu : usr=20.60%, sys=79.35%, ctx=2008, majf=0, minf=472
With these changes multithreaded async read IOPs improved from ~950K to ~1350K for this dm-mq stacked on null_blk test-case. The raw read IOPs of the underlying null_blk device for the same workload is ~1950K.
--- block/blk-core.c | 2 +- drivers/md/dm.c | 13 ++++++------- 2 files changed, 7 insertions(+), 8 deletions(-)
block/blk-core.c +1 -1
@@ -2189,7 +2189,7 @@ int blk_insert_cloned_request(struct reqif (q->mq_ops) {if (blk_queue_io_stat (q))blk_account_io_start (rq, true); -blk_mq_insert_request (rq, false, true, true); +blk_mq_insert_request (rq, false, true, false);return 0 ; }
drivers/md/dm.c +6 -7
@@ -1109,12 +1109,8 @@ static void rq_completed(struct mapped_d* back into ->request_fn() could deadlock attempting to grab the * queue lock again. */ -if (run_queue) { -if (md->queue->mq_ops) -blk_mq_run_hw_queues (md->queue, true); -else -blk_run_queue_async (md->queue); - } +if (!md->queue->mq_ops && run_queue) +blk_run_queue_async (md->queue);/* * dm_put() must be at the end of this function. See the comment above
@@ -1336,7 +1332,10 @@ static void dm_complete_request(struct rstruct dm_rq_target_io *tio =tio_from_request (rq); tio->error = error; -blk_complete_request (rq); +if (!rq->q->mq_ops) +blk_complete_request (rq); +else +blk_mq_complete_request (rq, error); }/*
Greg Kroah-Hartman
maintainerPATCH 49/210 dm thin metadata: dont issue prefetches if a transaction abort has failed
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Thornber <[email protected]>
commit 2eae9e4489b4cf83213fa3bd508b5afca3f01780 upstream.
If a transaction abort has failed then we can no longer use the metadata device. Typically this happens if the superblock is unreadable.
This fix addresses a crash seen during metadata device failure testing.
--- drivers/md/dm-thin-metadata.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/md/dm-thin-metadata.c +4 -1
@@ -1943,5 +1943,8 @@ bool dm_pool_metadata_needs_check(structvoid dm_pool_issue_prefetches (struct dm_pool_metadata *pmd) { -dm_tm_issue_prefetches (pmd->tm); +down_read (&pmd->root_lock); +if (!pmd->fail_io) +dm_tm_issue_prefetches (pmd->tm); +up_read (&pmd->root_lock); }
Greg Kroah-Hartman
maintainerPATCH 50/210 dm cache: make sure every metadata function checks fail_io
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Thornber <[email protected]>
commit d14fcf3dd79c0b8a8d0ba469c44a6b04f3a1403b upstream.
Otherwise operations may be attempted that will only ever go on to crash (since the metadata device is either missing or unreliable if 'fail_io' is set).
--- drivers/md/dm-cache-metadata.c | 98 ++++++++++++++++++++++++----------------- drivers/md/dm-cache-metadata.h | 4 - drivers/md/dm-cache-target.c | 12 ++++- 3 files changed, 71 insertions(+), 43 deletions(-)
drivers/md/dm-cache-metadata.c +59 -39
@@ -867,19 +867,40 @@ static int blocks_are_unmapped_or_clean(return 0 ; } -#define WRITE_LOCK (cmd) \ - if (cmd->fail_io || dm_bm_is_read_only(cmd->bm)) \ +#define WRITE_LOCK (cmd) \ + down_write(&cmd->root_lock); \ + if (cmd->fail_io || dm_bm_is_read_only(cmd->bm)) { \ + up_write(&cmd->root_lock); \ return -EINVAL; \ - down_write(&cmd->root_lock) + }#define WRITE_LOCK_VOID (cmd) \ - if (cmd->fail_io || dm_bm_is_read_only(cmd->bm)) \ + down_write(&cmd->root_lock); \ + if (cmd->fail_io || dm_bm_is_read_only(cmd->bm)) { \ + up_write(&cmd->root_lock); \ return; \ - down_write(&cmd->root_lock) + }#define WRITE_UNLOCK (cmd) \ up_write(&cmd->root_lock) +#define READ_LOCK (cmd) \ + down_read(&cmd->root_lock); \ + if (cmd->fail_io || dm_bm_is_read_only(cmd->bm)) { \ + up_read(&cmd->root_lock); \ + return -EINVAL; \ + } + +#define READ_LOCK_VOID (cmd) \ + down_read(&cmd->root_lock); \ + if (cmd->fail_io || dm_bm_is_read_only(cmd->bm)) { \ + up_read(&cmd->root_lock); \ + return; \ + } + +#define READ_UNLOCK (cmd) \ + up_read(&cmd->root_lock) +int dm_cache_resize (struct dm_cache_metadata *cmd,dm_cblock_t new_cache_size) {int r;
@@ -1015,22 +1036,20 @@ int dm_cache_load_discards(struct dm_cac {int r; -down_read (&cmd->root_lock); +READ_LOCK (cmd); r =__load_discards (cmd, fn, context); -up_read (&cmd->root_lock); +READ_UNLOCK (cmd);return r; } -dm_cblock_t dm_cache_size (struct dm_cache_metadata *cmd) +int dm_cache_size (struct dm_cache_metadata *cmd,dm_cblock_t *result) { -dm_cblock_t r; +READ_LOCK (cmd); + *result = cmd->cache_blocks; +READ_UNLOCK (cmd); -down_read (&cmd->root_lock); - r = cmd->cache_blocks; -up_read (&cmd->root_lock); - -return r; +return 0 ; }static int __remove (struct dm_cache_metadata *cmd,dm_cblock_t cblock)
@@ -1188,9 +1207,9 @@ int dm_cache_load_mappings(struct dm_cac {int r; -down_read (&cmd->root_lock); +READ_LOCK (cmd); r =__load_mappings (cmd, policy, fn, context); -up_read (&cmd->root_lock); +READ_UNLOCK (cmd);return r; }
@@ -1215,18 +1234,18 @@ static int __dump_mappings(struct dm_cacvoid dm_cache_dump (struct dm_cache_metadata *cmd) { -down_read (&cmd->root_lock); +READ_LOCK_VOID (cmd);__dump_mappings (cmd); -up_read (&cmd->root_lock); +READ_UNLOCK (cmd); }int dm_cache_changed_this_transaction (struct dm_cache_metadata *cmd) {int r; -down_read (&cmd->root_lock); +READ_LOCK (cmd); r = cmd->changed; -up_read (&cmd->root_lock); +READ_UNLOCK (cmd);return r; }
@@ -1276,9 +1295,9 @@ int dm_cache_set_dirty(struct dm_cache_mvoid dm_cache_metadata_get_stats (struct dm_cache_metadata *cmd,struct dm_cache_statistics *stats) { -down_read (&cmd->root_lock); +READ_LOCK_VOID (cmd); *stats = cmd->stats; -up_read (&cmd->root_lock); +READ_UNLOCK (cmd); } void dm_cache_metadata_set_stats(struct dm_cache_metadata *cmd,
@@ -1312,9 +1331,9 @@ int dm_cache_get_free_metadata_block_cou {int r = -EINVAL ; -down_read (&cmd->root_lock); +READ_LOCK (cmd); r =dm_sm_get_nr_free (cmd->metadata_sm, result); -up_read (&cmd->root_lock); +READ_UNLOCK (cmd);return r; }
@@ -1324,9 +1343,9 @@ int dm_cache_get_metadata_dev_size(struc {int r = -EINVAL ; -down_read (&cmd->root_lock); +READ_LOCK (cmd); r =dm_sm_get_nr_blocks (cmd->metadata_sm, result); -up_read (&cmd->root_lock); +READ_UNLOCK (cmd);return r; }
@@ -1417,7 +1436,13 @@ int dm_cache_write_hints(struct dm_cacheint dm_cache_metadata_all_clean (struct dm_cache_metadata *cmd,bool *result) { -return blocks_are_unmapped_or_clean (cmd,0 , cmd->cache_blocks, result); +int r; + +READ_LOCK (cmd); + r =blocks_are_unmapped_or_clean (cmd,0 , cmd->cache_blocks, result); +READ_UNLOCK (cmd); + +return r; }void dm_cache_metadata_set_read_only (struct dm_cache_metadata *cmd)
@@ -1440,10 +1465,7 @@ int dm_cache_metadata_set_needs_check(ststruct dm_block *sblock;struct cache_disk_superblock *disk_super; -/* -* We ignore fail_io for this function. -*/ -down_write (&cmd->root_lock); +WRITE_LOCK (cmd);set_bit (NEEDS_CHECK , &cmd->flags); r =superblock_lock (cmd, &sblock);
@@ -1458,19 +1480,17 @@ int dm_cache_metadata_set_needs_check(stdm_bm_unlock (sblock); out: -up_write (&cmd->root_lock); +WRITE_UNLOCK (cmd);return r; } -bool dm_cache_metadata_needs_check (struct dm_cache_metadata *cmd) +int dm_cache_metadata_needs_check (struct dm_cache_metadata *cmd,bool *result) { -bool needs_check; +READ_LOCK (cmd); + *result = !!test_bit (NEEDS_CHECK , &cmd->flags); +READ_UNLOCK (cmd); -down_read (&cmd->root_lock); - needs_check = !!test_bit (NEEDS_CHECK , &cmd->flags); -up_read (&cmd->root_lock); - -return needs_check; +return 0 ; }int dm_cache_metadata_abort (struct dm_cache_metadata *cmd)
drivers/md/dm-cache-metadata.h +2 -2
@@ -66,7 +66,7 @@ void dm_cache_metadata_close(struct dm_c* origin blocks to map to. */ int dm_cache_resize (struct dm_cache_metadata *cmd,dm_cblock_t new_cache_size); -dm_cblock_t dm_cache_size (struct dm_cache_metadata *cmd); +int dm_cache_size (struct dm_cache_metadata *cmd,dm_cblock_t *result); int dm_cache_discard_bitset_resize(struct dm_cache_metadata *cmd, sector_t discard_block_size,
@@ -137,7 +137,7 @@ int dm_cache_write_hints(struct dm_cache*/ int dm_cache_metadata_all_clean (struct dm_cache_metadata *cmd,bool *result); -bool dm_cache_metadata_needs_check (struct dm_cache_metadata *cmd); +int dm_cache_metadata_needs_check (struct dm_cache_metadata *cmd,bool *result);int dm_cache_metadata_set_needs_check (struct dm_cache_metadata *cmd);void dm_cache_metadata_set_read_only (struct dm_cache_metadata *cmd);void dm_cache_metadata_set_read_write (struct dm_cache_metadata *cmd);
drivers/md/dm-cache-target.c +10 -2
@@ -987,9 +987,14 @@ static void notify_mode_switch(struct castatic void set_cache_mode (struct cache *cache,enum cache_metadata_mode new_mode) { -bool needs_check =dm_cache_metadata_needs_check (cache->cmd); +bool needs_check;enum cache_metadata_mode old_mode =get_cache_mode (cache); +if (dm_cache_metadata_needs_check (cache->cmd, &needs_check)) { +DMERR ("unable to read needs_check flag, setting failure mode" ); + new_mode =CM_FAIL ; + } +if (new_mode ==CM_WRITE && needs_check) {DMERR ("%s: unable to switch cache to write mode until repaired." ,cache_device_name (cache));
@@ -3513,6 +3518,7 @@ static void cache_status(struct dm_targechar buf[BDEVNAME_SIZE ];struct cache *cache = ti->private;dm_cblock_t residency; +bool needs_check;switch (type) {case STATUSTYPE_INFO :
@@ -3586,7 +3592,9 @@ static void cache_status(struct dm_targeelse DMEMIT ("rw " ); -if (dm_cache_metadata_needs_check (cache->cmd)) + r =dm_cache_metadata_needs_check (cache->cmd, &needs_check); + +if (r || needs_check)DMEMIT ("needs_check " );else DMEMIT ("- " );
Greg Kroah-Hartman
maintainerPATCH 51/210 dm: fix rq_end_stats() NULL pointer in dm_requeue_original_request()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryn M. Reeves <[email protected]>
commit 98dbc9c6c61698792e3a66f32f3bf066201d42d7 upstream.
An "old" (.request_fn) DM 'struct request' stores a pointer to the associated 'struct dm_rq_target_io' in rq->special.
dm_requeue_original_request(), previously named dm_requeue_unmapped_original_request(), called dm_unprep_request() to reset rq->special to NULL. But rq_end_stats() would go on to hit a NULL pointer deference because its call to tio_from_request() returned NULL.
Fix this by calling rq_end_stats() _before_ dm_unprep_request()
--- drivers/md/dm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/md/dm.c +1 -1
@@ -1210,9 +1210,9 @@ static void dm_requeue_original_request( {int rw =rq_data_dir (rq); +rq_end_stats (md, rq);dm_unprep_request (rq); -rq_end_stats (md, rq);if (!rq->q->mq_ops)old_requeue_request (rq);else {
Greg Kroah-Hartman
maintainerPATCH 52/210 usb: retry reset if a device times out
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <[email protected]>
commit 264904ccc33c604d4b3141bbd33808152dfac45b upstream.
Some devices I got show an inability to operate right after power on if they are already connected. They are beyond recovery if the descriptors are requested multiple times. So in case of a timeout we rather bail early and reset again. But it must be done only on the first loop lest we get into a reset/time out spiral that can be overcome with a retry.
This patch is a rework of a patch that fell through the cracks.
http://www.spinics.net/lists/linux-usb/msg103263.html
--- drivers/usb/core/hub.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/usb/core/hub.c +7 -1
@@ -4426,7 +4426,13 @@ hub_port_init(struct usb_hub *hub, struc r = -EPROTO ;break ; } -if (r ==0 ) +/* +* Some devices time out if they are powered on +* when already connected. They need a second +* reset. But only on the first attempt, +* lest we get into a time out/reset loop +*/ +if (r ==0 || (r == -ETIMEDOUT && j ==0 ))break ; } udev->descriptor.bMaxPacketSize0 =
Greg Kroah-Hartman
maintainerPATCH 53/210 usb: hub: fix a typo in hub_port_init() leading to wrong logic
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <[email protected]>
commit 0d5ce778c43bf888328231bcdce05d5c860655aa upstream.
A typo of j for i led to a logic bug. To rule out future confusion, the variable names are made meaningful.
--- drivers/usb/core/hub.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/usb/core/hub.c +5 -5
@@ -4277,7 +4277,7 @@ hub_port_init(struct usb_hub *hub, struc {struct usb_device *hdev = hub->hdev;struct usb_hcd *hcd =bus_to_hcd (hdev->bus); -int i, j, retval; +int retries, operations, retval, i;unsigned delay =HUB_SHORT_RESET_TIME ;enum usb_device_speed oldspeed = udev->speed;const char *speed;
@@ -4379,7 +4379,7 @@ hub_port_init(struct usb_hub *hub, struc* first 8 bytes of the device descriptor to get the ep0 maxpacket * value. */ -for (i =0 ; i <GET_DESCRIPTOR_TRIES ; (++i,msleep (100 ))) { +for (retries =0 ; retries <GET_DESCRIPTOR_TRIES ; (++retries,msleep (100 ))) {bool did_new_scheme = false;if (use_new_scheme (udev, retry_counter)) {
@@ -4406,7 +4406,7 @@ hub_port_init(struct usb_hub *hub, struc* 255 is for WUSB devices, we actually need to use * 512 (WUSB1.0[4.8.1]). */ -for (j =0 ; j <3 ; ++j) { +for (operations =0 ; operations <3 ; ++operations) { buf->bMaxPacketSize0 =0 ; r = usb_control_msg(udev, usb_rcvaddr0pipe(), USB_REQ_GET_DESCRIPTOR, USB_DIR_IN,
@@ -4432,7 +4432,7 @@ hub_port_init(struct usb_hub *hub, struc* reset. But only on the first attempt, * lest we get into a time out/reset loop */ -if (r ==0 || (r == -ETIMEDOUT && j ==0 )) +if (r ==0 || (r == -ETIMEDOUT && retries ==0 ))break ; } udev->descriptor.bMaxPacketSize0 =
@@ -4464,7 +4464,7 @@ hub_port_init(struct usb_hub *hub, struc* authorization will assign the final address. */ if (udev->wusb ==0 ) { -for (j =0 ; j <SET_ADDRESS_TRIES ; ++j) { +for (operations =0 ; operations <SET_ADDRESS_TRIES ; ++operations) { retval =hub_set_address (udev, devnum);if (retval >=0 )break ;
Greg Kroah-Hartman
maintainerPATCH 54/210 USB: uas: Reduce can_queue to MAX_CMNDS
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
commit 55ff8cfbc4e12a7d2187df523938cc671fbebdd1 upstream.
The uas driver can never queue more then MAX_CMNDS (- 1) tags and tags are shared between luns, so there is no need to claim that we can_queue some random large number.
Not claiming that we can_queue 65536 commands, fixes the uas driver failing to initialize while allocating the tag map with a "Page allocation failure (order 7)" error on systems which have been running for a while and thus have fragmented memory.
--- drivers/usb/storage/uas.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/storage/uas.c +1 -1
@@ -812,7 +812,7 @@ static struct scsi_host_template uas_hos .slave_configure = uas_slave_configure, .eh_abort_handler = uas_eh_abort_handler, .eh_bus_reset_handler = uas_eh_bus_reset_handler, - .can_queue = 65536, /* Is there a limit on the _host_ ? */ + .can_queue = MAX_CMNDS, .this_id = -1, .sg_tablesize = SG_NONE, .skip_settle_delay = 1,
Greg Kroah-Hartman
maintainerPATCH 55/210 USB: cdc-acm: more sanity checking
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <[email protected]>
commit 8835ba4a39cf53f705417b3b3a94eb067673f2c9 upstream.
An attack has become available which pretends to be a quirky device circumventing normal sanity checks and crashes the kernel by an insufficient number of interfaces. This patch adds a check to the code path for quirky devices.
--- drivers/usb/class/cdc-acm.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/class/cdc-acm.c +3 -0
@@ -1114,6 +1114,9 @@ static int acm_probe(struct usb_interfacif (quirks ==NO_UNION_NORMAL ) { data_interface =usb_ifnum_to_if (usb_dev,1 ); control_interface =usb_ifnum_to_if (usb_dev,0 ); +/* we would crash */ +if (!data_interface || !control_interface) +return -ENODEV ; goto skip_normal_probe; }
Greg Kroah-Hartman
maintainerPATCH 56/210 USB: iowarrior: fix oops with malicious USB descriptors
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Boyer <[email protected]>
commit 4ec0ef3a82125efc36173062a50624550a900ae0 upstream.
The iowarrior driver expects at least one valid endpoint. If given malicious descriptors that specify 0 for the number of endpoints, it will crash in the probe function. Ensure there is at least one endpoint on the interface before using it.
The full report of this issue can be found here:
http://seclists.org/bugtraq/2016/Mar/87
--- drivers/usb/misc/iowarrior.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/usb/misc/iowarrior.c +6 -0
@@ -787,6 +787,12 @@ static int iowarrior_probe(struct usb_in iface_desc = interface->cur_altsetting; dev->product_id =le16_to_cpu (udev->descriptor.idProduct); +if (iface_desc->desc.bNumEndpoints <1 ) { +dev_err (&interface->dev,"Invalid number of endpoints\n" ); + retval = -EINVAL ; + goto error; + } +/* set up the endpoint information */ for (i =0 ; i < iface_desc->desc.bNumEndpoints; ++i) { endpoint = &iface_desc->endpoint[i].desc;
Greg Kroah-Hartman
maintainerPATCH 57/210 USB: usb_driver_claim_interface: add sanity checking
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <[email protected]>
commit 0b818e3956fc1ad976bee791eadcbb3b5fec5bfd upstream.
Attacks that trick drivers into passing a NULL pointer to usb_driver_claim_interface() using forged descriptors are known. This thwarts them by sanity checking.
--- drivers/usb/core/driver.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/usb/core/driver.c +5 -1
@@ -502,11 +502,15 @@ static int usb_unbind_interface(struct dint usb_driver_claim_interface (struct usb_driver *driver,struct usb_interface *iface,void *priv) { -struct device *dev = &iface->dev; +struct device *dev;struct usb_device *udev;int retval =0 ;int lpm_disable_error; +if (!iface) +return -ENODEV ; + + dev = &iface->dev;if (dev->driver)return -EBUSY ;
Greg Kroah-Hartman
maintainerPATCH 58/210 USB: mct_u232: add sanity checking in probe
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <[email protected]>
commit 4e9a0b05257f29cf4b75f3209243ed71614d062e upstream.
An attack using the lack of sanity checking in probe is known. This patch checks for the existence of a second port.
CVE-2016-3136
--- drivers/usb/serial/mct_u232.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/usb/serial/mct_u232.c +8 -1
@@ -376,14 +376,21 @@ static void mct_u232_msr_to_state(structstatic int mct_u232_port_probe (struct usb_serial_port *port) { +struct usb_serial *serial = port->serial;struct mct_u232_private *priv; +/* check first to simplify error handling */ +if (!serial->port[1 ] || !serial->port[1 ]->interrupt_in_urb) { +dev_err (&port->dev,"expected endpoint missing\n" ); +return -ENODEV ; + } + priv =kzalloc (sizeof (*priv),GFP_KERNEL );if (!priv)return -ENOMEM ;/* Use second interrupt-in endpoint for reading. */ - priv->read_urb = port->serial->port[1 ]->interrupt_in_urb; + priv->read_urb = serial->port[1 ]->interrupt_in_urb; priv->read_urb->context = port;spin_lock_init (&priv->lock);
Greg Kroah-Hartman
maintainerPATCH 59/210 USB: digi_acceleport: do sanity checking for the number of ports
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <[email protected]>
commit 5a07975ad0a36708c6b0a5b9fea1ff811d0b0c1f upstream.
The driver can be crashed with devices that expose crafted descriptors with too few endpoints.
See: http://seclists.org/bugtraq/2016/Mar/61
--- drivers/usb/serial/digi_acceleport.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+)
drivers/usb/serial/digi_acceleport.c +19 -0
@@ -1251,8 +1251,27 @@ static int digi_port_init(struct usb_serstatic int digi_startup (struct usb_serial *serial) { +struct device *dev = &serial->interface->dev;struct digi_serial *serial_priv;int ret; +int i; + +/* check whether the device has the expected number of endpoints */ +if (serial->num_port_pointers < serial->type->num_ports +1 ) { +dev_err (dev,"OOB endpoints missing\n" ); +return -ENODEV ; + } + +for (i =0 ; i < serial->type->num_ports +1 ; i++) { +if (!serial->port[i]->read_urb) { +dev_err (dev,"bulk-in endpoint missing\n" ); +return -ENODEV ; + } +if (!serial->port[i]->write_urb) { +dev_err (dev,"bulk-out endpoint missing\n" ); +return -ENODEV ; + } + } serial_priv =kzalloc (sizeof (*serial_priv),GFP_KERNEL );if (!serial_priv)
Greg Kroah-Hartman
maintainerPATCH 60/210 USB: cypress_m8: add endpoint sanity check
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <[email protected]>
commit c55aee1bf0e6b6feec8b2927b43f7a09a6d5f754 upstream.
An attack using missing endpoints exists.
CVE-2016-3137
--- drivers/usb/serial/cypress_m8.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-)
drivers/usb/serial/cypress_m8.c +5 -6
@@ -447,6 +447,11 @@ static int cypress_generic_port_probe(ststruct usb_serial *serial = port->serial;struct cypress_private *priv; +if (!port->interrupt_out_urb || !port->interrupt_in_urb) { +dev_err (&port->dev,"required endpoint is missing\n" ); +return -ENODEV ; + } + priv =kzalloc (sizeof (struct cypress_private ),GFP_KERNEL );if (!priv)return -ENOMEM ;
@@ -606,12 +611,6 @@ static int cypress_open(struct tty_struccypress_set_termios (tty, port, &priv->tmp_termios);/* setup the port and start reading from the device */ -if (!port->interrupt_in_urb) { -dev_err (&port->dev,"%s - interrupt_in_urb is empty!\n" , - __func__); -return -1 ; - } - usb_fill_int_urb(port->interrupt_in_urb, serial->dev, usb_rcvintpipe(serial->dev, port->interrupt_in_endpointAddress), port->interrupt_in_urb->transfer_buffer,
Greg Kroah-Hartman
maintainerPATCH 61/210 USB: serial: cp210x: Adding GE Healthcare Device ID
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martyn Welch <[email protected]>
commit cddc9434e3dcc37a85c4412fb8e277d3a582e456 upstream.
The CP2105 is used in the GE Healthcare Remote Alarm Box, with the Manufacturer ID of 0x1901 and Product ID of 0x0194.
--- drivers/usb/serial/cp210x.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/serial/cp210x.c +1 -0
@@ -164,6 +164,7 @@ static const struct usb_device_id id_tab { USB_DEVICE(0x18EF, 0xE025) }, /* ELV Marble Sound Board 1 */ { USB_DEVICE(0x1901, 0x0190) }, /* GE B850 CP2105 Recorder interface */ { USB_DEVICE(0x1901, 0x0193) }, /* GE B650 CP2104 PMC interface */ + { USB_DEVICE(0x1901, 0x0194) }, /* GE Healthcare Remote Alarm Box */ { USB_DEVICE(0x19CF, 0x3000) }, /* Parrot NMEA GPS Flight Recorder */ { USB_DEVICE(0x1ADB, 0x0001) }, /* Schweitzer Engineering C662 Cable */ { USB_DEVICE(0x1B1C, 0x1C00) }, /* Corsair USB Dongle */
Greg Kroah-Hartman
maintainerPATCH 62/210 USB: serial: ftdi_sio: Add support for ICP DAS I-756xU devices
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Boyer <[email protected]>
commit ea6db90e750328068837bed34cb1302b7a177339 upstream.
A Fedora user reports that the ftdi_sio driver works properly for the ICP DAS I-7561U device. Further, the user manual for these devices instructs users to load the driver and add the ids using the sysfs interface.
Add support for these in the driver directly so that the devices work out of the box instead of needing manual configuration.
--- drivers/usb/serial/ftdi_sio.c | 4 ++++ drivers/usb/serial/ftdi_sio_ids.h | 8 ++++++++ 2 files changed, 12 insertions(+)
drivers/usb/serial/ftdi_sio.c +4 -0
@@ -1004,6 +1004,10 @@ static const struct usb_device_id id_tab { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_DISPLAY_PID) }, { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_LITE_PID) }, { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_ANALOG_PID) }, +/* ICP DAS I-756xU devices */ + { USB_DEVICE(ICPDAS_VID, ICPDAS_I7560U_PID) }, + { USB_DEVICE(ICPDAS_VID, ICPDAS_I7561U_PID) }, + { USB_DEVICE(ICPDAS_VID, ICPDAS_I7563U_PID) }, { } /* Terminating entry */ };
drivers/usb/serial/ftdi_sio_ids.h +8 -0
@@ -872,6 +872,14 @@#define NOVITUS_BONO_E_PID 0x6010/* +* ICPDAS I-756*U devices +*/ +#define ICPDAS_VID 0x1b5c +#define ICPDAS_I7560U_PID 0x0103 +#define ICPDAS_I7561U_PID 0x0104 +#define ICPDAS_I7563U_PID 0x0105 + +/* * RT Systems programming cables for various ham radios */ #define RTSYSTEMS_VID 0x2100/* Vendor ID */
Greg Kroah-Hartman
maintainerPATCH 64/210 pwc: Add USB id for Philips Spc880nc webcam
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
commit 7445e45d19a09e5269dc85f17f9635be29d2f76c upstream.
SPC 880NC PC camera discussions:
http://www.pclinuxos.com/forum/index.php/topic,135688.0.html
--- drivers/media/usb/pwc/pwc-if.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/media/usb/pwc/pwc-if.c +6 -0
@@ -91,6 +91,7 @@ static const struct usb_device_id pwc_de { USB_DEVICE(0x0471, 0x0312) }, { USB_DEVICE(0x0471, 0x0313) }, /* the 'new' 720K */ { USB_DEVICE(0x0471, 0x0329) }, /* Philips SPC 900NC PC Camera */ + { USB_DEVICE(0x0471, 0x032C) }, /* Philips SPC 880NC PC Camera */ { USB_DEVICE(0x069A, 0x0001) }, /* Askey */ { USB_DEVICE(0x046D, 0x08B0) }, /* Logitech QuickCam Pro 3000 */ { USB_DEVICE(0x046D, 0x08B1) }, /* Logitech QuickCam Notebook Pro */
@@ -811,6 +812,11 @@ static int usb_pwc_probe(struct usb_inte name ="Philips SPC 900NC webcam" ; type_id =740 ;break ; +case 0x032C : +PWC_INFO ("Philips SPC 880NC USB webcam detected.\n" ); + name ="Philips SPC 880NC webcam" ; + type_id =740 ; +break ;default :return -ENODEV ;break ;
Greg Kroah-Hartman
maintainerPATCH 65/210 Input: powermate - fix oops with malicious USB descriptors
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Boyer <[email protected]>
commit 9c6ba456711687b794dcf285856fc14e2c76074f upstream.
The powermate driver expects at least one valid USB endpoint in its probe function. If given malicious descriptors that specify 0 for the number of endpoints, it will crash. Validate the number of endpoints on the interface before using them.
The full report for this issue can be found here:
http://seclists.org/bugtraq/2016/Mar/85
--- drivers/input/misc/powermate.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/input/misc/powermate.c +3 -0
@@ -307,6 +307,9 @@ static int powermate_probe(struct usb_inint error = -ENOMEM ; interface = intf->cur_altsetting; +if (interface->desc.bNumEndpoints <1 ) +return -EINVAL ; + endpoint = &interface->endpoint[0 ].desc;if (!usb_endpoint_is_int_in (endpoint))return -EIO ;
Greg Kroah-Hartman
maintainerPATCH 66/210 ALSA: usb-audio: Fix NULL dereference in create_fixed_stream_quirk()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 0f886ca12765d20124bd06291c82951fd49a33be upstream.
create_fixed_stream_quirk() may cause a NULL-pointer dereference by accessing the non-existing endpoint when a USB device with a malformed USB descriptor is used.
This patch avoids it simply by adding a sanity check of bNumEndpoints before the accesses.
Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=971125
--- sound/usb/quirks.c | 6 ++++++ 1 file changed, 6 insertions(+)
sound/usb/quirks.c +6 -0
@@ -180,6 +180,12 @@ static int create_fixed_stream_quirk(str } alts = &iface->altsetting[fp->altset_idx]; altsd =get_iface_desc (alts); +if (altsd->bNumEndpoints <1 ) { +kfree (fp); +kfree (rate_table); +return -EINVAL ; + } + fp->protocol = altsd->bInterfaceProtocol;if (fp->datainterval ==0 )
Greg Kroah-Hartman
maintainerPATCH 67/210 ALSA: usb-audio: Add sanity checks for endpoint accesses
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 447d6275f0c21f6cc97a88b3a0c601436a4cdf2a upstream.
Add some sanity check codes before actually accessing the endpoint via get_endpoint() in order to avoid the invalid access through a malformed USB descriptor. Mostly just checking bNumEndpoints, but in one place (snd_microii_spdif_default_get()), the validity of iface and altsetting index is checked as well.
Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=971125
--- sound/usb/clock.c | 2 ++ sound/usb/endpoint.c | 3 +++ sound/usb/mixer_quirks.c | 4 ++++ sound/usb/pcm.c | 2 ++ 4 files changed, 11 insertions(+)
sound/usb/clock.c +2 -0
@@ -285,6 +285,8 @@ static int set_sample_rate_v1(struct sndunsigned char data[3 ];int err, crate; +if (get_iface_desc (alts)->bNumEndpoints <1 ) +return -EINVAL ; ep =get_endpoint (alts,0 )->bEndpointAddress;/* if endpoint doesn't have sampling rate control, bail out */
sound/usb/endpoint.c +3 -0
@@ -438,6 +438,9 @@ exit_clear:* * New endpoints will be added to chip->ep_list and must be freed by * calling snd_usb_endpoint_free(). +* +* For SND_USB_ENDPOINT_TYPE_SYNC, the caller needs to guarantee that +* bNumEndpoints > 1 beforehand. */ struct snd_usb_endpoint *snd_usb_add_endpoint(struct snd_usb_audio *chip, struct usb_host_interface *alts,
sound/usb/mixer_quirks.c +4 -0
@@ -1519,7 +1519,11 @@ static int snd_microii_spdif_default_get/* use known values for that card: interface#1 altsetting#1 */ iface =usb_ifnum_to_if (chip->dev,1 ); +if (!iface || iface->num_altsetting <2 ) +return -EINVAL ; alts = &iface->altsetting[1 ]; +if (get_iface_desc (alts)->bNumEndpoints <1 ) +return -EINVAL ; ep =get_endpoint (alts,0 )->bEndpointAddress; err = snd_usb_ctl_msg(chip->dev,
sound/usb/pcm.c +2 -0
@@ -159,6 +159,8 @@ static int init_pitch_v1(struct snd_usb_unsigned char data[1 ];int err; +if (get_iface_desc (alts)->bNumEndpoints <1 ) +return -EINVAL ; ep =get_endpoint (alts,0 )->bEndpointAddress; data[0 ] =1 ;
Greg Kroah-Hartman
maintainerPATCH 69/210 ALSA: usb-audio: Minor code cleanup in create_fixed_stream_quirk()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 902eb7fd1e4af3ac69b9b30f8373f118c92b9729 upstream.
Just a minor code cleanup: unify the error paths.
--- sound/usb/quirks.c | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-)
sound/usb/quirks.c +11 -11
@@ -167,23 +167,18 @@ static int create_fixed_stream_quirk(str stream = (fp->endpoint &USB_DIR_IN ) ?SNDRV_PCM_STREAM_CAPTURE :SNDRV_PCM_STREAM_PLAYBACK ; err =snd_usb_add_audio_stream (chip, stream, fp); -if (err <0 ) { -kfree (fp); -kfree (rate_table); -return err; - } +if (err <0 ) + goto error;if (fp->iface !=get_iface_desc (&iface->altsetting[0 ])->bInterfaceNumber || fp->altset_idx >= iface->num_altsetting) { -kfree (fp); -kfree (rate_table); -return -EINVAL ; + err = -EINVAL ; + goto error; } alts = &iface->altsetting[fp->altset_idx]; altsd =get_iface_desc (alts);if (altsd->bNumEndpoints <1 ) { -kfree (fp); -kfree (rate_table); -return -EINVAL ; + err = -EINVAL ; + goto error; } fp->protocol = altsd->bInterfaceProtocol;
@@ -196,6 +191,11 @@ static int create_fixed_stream_quirk(strsnd_usb_init_pitch (chip, fp->iface, alts, fp);snd_usb_init_sample_rate (chip, fp->iface, alts, fp, fp->rate_max);return 0 ; + + error: +kfree (fp); +kfree (rate_table); +return err; } static int create_auto_pcm_quirk(struct snd_usb_audio *chip,
Greg Kroah-Hartman
maintainerPATCH 70/210 ALSA: usb-audio: Fix double-free in error paths after snd_usb_add_audio_stream() call
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladis Dronov <[email protected]>
commit 836b34a935abc91e13e63053d0a83b24dfb5ea78 upstream.
create_fixed_stream_quirk(), snd_usb_parse_audio_interface() and create_uaxx_quirk() functions allocate the audioformat object by themselves and free it upon error before returning. However, once the object is linked to a stream, it's freed again in snd_usb_audio_pcm_free(), thus it'll be double-freed, eventually resulting in a memory corruption.
This patch fixes these failures in the error paths by unlinking the audioformat object before freeing it.
Based on a patch by Takashi Iwai <[email protected]>
[Note for stable backports:
this patch requires the commit 902eb7fd1e4a ('ALSA: usb-audio: Minor code cleanup in create_fixed_stream_quirk()')]
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1283358
--- sound/usb/quirks.c | 4 ++++ sound/usb/stream.c | 6 +++++- 2 files changed, 9 insertions(+), 1 deletion(-)
sound/usb/quirks.c +4 -0
@@ -150,6 +150,7 @@ static int create_fixed_stream_quirk(strusb_audio_err (chip,"cannot memdup\n" );return -ENOMEM ; } +INIT_LIST_HEAD (&fp->list);if (fp->nr_rates >MAX_NR_RATES ) {kfree (fp);return -EINVAL ;
@@ -193,6 +194,7 @@ static int create_fixed_stream_quirk(strreturn 0 ; error: +list_del (&fp->list);/* unlink for avoiding double-free */ kfree (fp);kfree (rate_table);return err;
@@ -468,6 +470,7 @@ static int create_uaxx_quirk(struct snd_ fp->ep_attr =get_endpoint (alts,0 )->bmAttributes; fp->datainterval =0 ; fp->maxpacksize =le16_to_cpu (get_endpoint (alts,0 )->wMaxPacketSize); +INIT_LIST_HEAD (&fp->list);switch (fp->maxpacksize) {case 0x120 :
@@ -491,6 +494,7 @@ static int create_uaxx_quirk(struct snd_ ? SNDRV_PCM_STREAM_CAPTURE : SNDRV_PCM_STREAM_PLAYBACK; err =snd_usb_add_audio_stream (chip, stream, fp);if (err <0 ) { +list_del (&fp->list);/* unlink for avoiding double-free */ kfree (fp);return err; }
sound/usb/stream.c +5 -1
@@ -316,7 +316,9 @@ static struct snd_pcm_chmap_elem *conver/* * add this endpoint to the chip instance. * if a stream with the same endpoint already exists, append to it. -* if not, create a new pcm stream. +* if not, create a new pcm stream. note, fp is added to the substream +* fmt_list and will be freed on the chip instance release. do not free +* fp or do remove it from the substream fmt_list to avoid double-free. */ int snd_usb_add_audio_stream(struct snd_usb_audio *chip, int stream,
@@ -677,6 +679,7 @@ int snd_usb_parse_audio_interface(struct * (fp->maxpacksize &0x7ff ); fp->attributes =parse_uac_endpoint_attributes (chip, alts, protocol, iface_no); fp->clock = clock; +INIT_LIST_HEAD (&fp->list);/* some quirks for attributes here */
@@ -725,6 +728,7 @@ int snd_usb_parse_audio_interface(structdev_dbg (&dev->dev,"%u:%d: add audio endpoint %#x\n" , iface_no, altno, fp->endpoint); err =snd_usb_add_audio_stream (chip, stream, fp);if (err <0 ) { +list_del (&fp->list);/* unlink for avoiding double-free */ kfree (fp->rate_table);kfree (fp->chmap);kfree (fp);
Greg Kroah-Hartman
maintainerPATCH 71/210 Bluetooth: btusb: Add new AR3012 ID 13d3:3395
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Tunin <[email protected]>
commit 609574eb46335cfac1421a07c0505627cbbab1f0 upstream.
T: Bus=03 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#= 3 Spd=12 MxCh= 0
D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=13d3 ProdID=3395 Rev=00.01
C: #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
I: If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
I: If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
--- drivers/bluetooth/ath3k.c | 2 ++ drivers/bluetooth/btusb.c | 1 + 2 files changed, 3 insertions(+)
drivers/bluetooth/ath3k.c +2 -0
@@ -113,6 +113,7 @@ static const struct usb_device_id ath3k_ { USB_DEVICE(0x13d3, 0x3362) }, { USB_DEVICE(0x13d3, 0x3375) }, { USB_DEVICE(0x13d3, 0x3393) }, + { USB_DEVICE(0x13d3, 0x3395) }, { USB_DEVICE(0x13d3, 0x3402) }, { USB_DEVICE(0x13d3, 0x3408) }, { USB_DEVICE(0x13d3, 0x3423) },
@@ -175,6 +176,7 @@ static const struct usb_device_id ath3k_ { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x13d3, 0x3395), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 },
drivers/bluetooth/btusb.c +1 -0
@@ -227,6 +227,7 @@ static const struct usb_device_id blackl { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x13d3, 0x3395), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 },
Greg Kroah-Hartman
maintainerPATCH 72/210 Bluetooth: btusb: Add a new AR3012 ID 04ca:3014
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Tunin <[email protected]>
commit 81d90442eac779938217c3444b240aa51fd3db47 upstream.
T: Bus=01 Lev=01 Prnt=01 Port=04 Cnt=03 Dev#= 5 Spd=12 MxCh= 0
D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=04ca ProdID=3014 Rev=00.02
C: #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
I: If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
I: If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
--- drivers/bluetooth/ath3k.c | 2 ++ drivers/bluetooth/btusb.c | 1 + 2 files changed, 3 insertions(+)
drivers/bluetooth/ath3k.c +2 -0
@@ -92,6 +92,7 @@ static const struct usb_device_id ath3k_ { USB_DEVICE(0x04CA, 0x300d) }, { USB_DEVICE(0x04CA, 0x300f) }, { USB_DEVICE(0x04CA, 0x3010) }, + { USB_DEVICE(0x04CA, 0x3014) }, { USB_DEVICE(0x0930, 0x0219) }, { USB_DEVICE(0x0930, 0x021c) }, { USB_DEVICE(0x0930, 0x0220) },
@@ -155,6 +156,7 @@ static const struct usb_device_id ath3k_ { USB_DEVICE(0x04ca, 0x300d), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x04ca, 0x3014), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0930, 0x021c), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 },
drivers/bluetooth/btusb.c +1 -0
@@ -206,6 +206,7 @@ static const struct usb_device_id blackl { USB_DEVICE(0x04ca, 0x300d), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x04ca, 0x3014), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0930, 0x021c), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 },
Greg Kroah-Hartman
maintainerPATCH 73/210 Bluetooth: btusb: Add a new AR3012 ID 13d3:3472
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Tunin <[email protected]>
commit 75c6aca4765dbe3d0c1507ab5052f2e373dc2331 upstream.
T: Bus=01 Lev=01 Prnt=01 Port=04 Cnt=01 Dev#= 4 Spd=12 MxCh= 0
D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=13d3 ProdID=3472 Rev=00.01
C: #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
I: If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
I: If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
--- drivers/bluetooth/ath3k.c | 2 ++ drivers/bluetooth/btusb.c | 1 + 2 files changed, 3 insertions(+)
drivers/bluetooth/ath3k.c +2 -0
@@ -119,6 +119,7 @@ static const struct usb_device_id ath3k_ { USB_DEVICE(0x13d3, 0x3408) }, { USB_DEVICE(0x13d3, 0x3423) }, { USB_DEVICE(0x13d3, 0x3432) }, + { USB_DEVICE(0x13d3, 0x3472) }, { USB_DEVICE(0x13d3, 0x3474) },/* Atheros AR5BBU12 with sflash firmware */
@@ -183,6 +184,7 @@ static const struct usb_device_id ath3k_ { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x13d3, 0x3472), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 },/* Atheros AR5BBU22 with sflash firmware */
drivers/bluetooth/btusb.c +1 -0
@@ -233,6 +233,7 @@ static const struct usb_device_id blackl { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x13d3, 0x3472), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 },/* Atheros AR5BBU12 with sflash firmware */
Greg Kroah-Hartman
maintainerPATCH 74/210 crypto: ccp - Add hash state import and export support
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tom Lendacky <[email protected]>
commit 952bce9792e6bf36fda09c2e5718abb5d9327369 upstream.
Commit 8996eafdcbad ("crypto: ahash - ensure statesize is non-zero") added a check to prevent ahash algorithms from successfully registering if the import and export functions were not implemented. This prevents an oops in the hash_accept function of algif_hash. This commit causes the ccp-crypto module SHA support and AES CMAC support from successfully registering and causing the ccp-crypto module load to fail because the ahash import and export functions are not implemented.
Update the CCP Crypto API support to provide import and export support for ahash algorithms.
--- drivers/crypto/ccp/ccp-crypto-aes-cmac.c | 23 +++++++++++++++++++++++ drivers/crypto/ccp/ccp-crypto-sha.c | 23 +++++++++++++++++++++++ 2 files changed, 46 insertions(+)
drivers/crypto/ccp/ccp-crypto-aes-cmac.c +23 -0
@@ -220,6 +220,26 @@ static int ccp_aes_cmac_digest(struct ahreturn ccp_aes_cmac_finup (req); } +static int ccp_aes_cmac_export (struct ahash_request *req,void *out) +{ +struct ccp_aes_cmac_req_ctx *rctx =ahash_request_ctx (req); +struct ccp_aes_cmac_req_ctx *state = out; + + *state = *rctx; + +return 0 ; +} + +static int ccp_aes_cmac_import (struct ahash_request *req,const void *in) +{ +struct ccp_aes_cmac_req_ctx *rctx =ahash_request_ctx (req); +const struct ccp_aes_cmac_req_ctx *state = in; + + *rctx = *state; + +return 0 ; +} +static int ccp_aes_cmac_setkey (struct crypto_ahash *tfm,const u8 *key,unsigned int key_len) {
@@ -352,10 +372,13 @@ int ccp_register_aes_cmac_algs(struct li alg->final = ccp_aes_cmac_final; alg->finup = ccp_aes_cmac_finup; alg->digest = ccp_aes_cmac_digest; + alg->export = ccp_aes_cmac_export; + alg->import = ccp_aes_cmac_import; alg->setkey = ccp_aes_cmac_setkey; halg = &alg->halg; halg->digestsize =AES_BLOCK_SIZE ; + halg->statesize =sizeof (struct ccp_aes_cmac_req_ctx ); base = &halg->base;snprintf (base->cra_name,CRYPTO_MAX_ALG_NAME ,"cmac(aes)" );
drivers/crypto/ccp/ccp-crypto-sha.c +23 -0
@@ -207,6 +207,26 @@ static int ccp_sha_digest(struct ahash_rreturn ccp_sha_finup (req); } +static int ccp_sha_export (struct ahash_request *req,void *out) +{ +struct ccp_sha_req_ctx *rctx =ahash_request_ctx (req); +struct ccp_sha_req_ctx *state = out; + + *state = *rctx; + +return 0 ; +} + +static int ccp_sha_import (struct ahash_request *req,const void *in) +{ +struct ccp_sha_req_ctx *rctx =ahash_request_ctx (req); +const struct ccp_sha_req_ctx *state = in; + + *rctx = *state; + +return 0 ; +} +static int ccp_sha_setkey (struct crypto_ahash *tfm,const u8 *key,unsigned int key_len) {
@@ -403,9 +423,12 @@ static int ccp_register_sha_alg(struct l alg->final = ccp_sha_final; alg->finup = ccp_sha_finup; alg->digest = ccp_sha_digest; + alg->export = ccp_sha_export; + alg->import = ccp_sha_import; halg = &alg->halg; halg->digestsize = def->digest_size; + halg->statesize =sizeof (struct ccp_sha_req_ctx ); base = &halg->base;snprintf (base->cra_name,CRYPTO_MAX_ALG_NAME ,"%s" , def->name);
Greg Kroah-Hartman
maintainerPATCH 75/210 crypto: ccp - Limit the amount of information exported
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tom Lendacky <[email protected]>
commit d1662165ae612ec8b5f94a6b07e65ea58b6dce34 upstream.
Since the exported information can be exposed to user-space, instead of exporting the entire request context only export the minimum information needed.
--- drivers/crypto/ccp/ccp-crypto-aes-cmac.c | 16 +++++++++++----- drivers/crypto/ccp/ccp-crypto-sha.c | 20 +++++++++++++++----- drivers/crypto/ccp/ccp-crypto.h | 22 ++++++++++++++++++++++ 3 files changed, 48 insertions(+), 10 deletions(-)
drivers/crypto/ccp/ccp-crypto-aes-cmac.c +11 -5
@@ -223,9 +223,12 @@ static int ccp_aes_cmac_digest(struct ahstatic int ccp_aes_cmac_export (struct ahash_request *req,void *out) {struct ccp_aes_cmac_req_ctx *rctx =ahash_request_ctx (req); -struct ccp_aes_cmac_req_ctx *state = out; +struct ccp_aes_cmac_exp_ctx *state = out; - *state = *rctx; + state->null_msg = rctx->null_msg; +memcpy (state->iv, rctx->iv,sizeof (state->iv)); + state->buf_count = rctx->buf_count; +memcpy (state->buf, rctx->buf,sizeof (state->buf));return 0 ; }
@@ -233,9 +236,12 @@ static int ccp_aes_cmac_export(struct ahstatic int ccp_aes_cmac_import (struct ahash_request *req,const void *in) {struct ccp_aes_cmac_req_ctx *rctx =ahash_request_ctx (req); -const struct ccp_aes_cmac_req_ctx *state = in; +const struct ccp_aes_cmac_exp_ctx *state = in; - *rctx = *state; + rctx->null_msg = state->null_msg; +memcpy (rctx->iv, state->iv,sizeof (rctx->iv)); + rctx->buf_count = state->buf_count; +memcpy (rctx->buf, state->buf,sizeof (rctx->buf));return 0 ; }
@@ -378,7 +384,7 @@ int ccp_register_aes_cmac_algs(struct li halg = &alg->halg; halg->digestsize =AES_BLOCK_SIZE ; - halg->statesize =sizeof (struct ccp_aes_cmac_req_ctx ); + halg->statesize =sizeof (struct ccp_aes_cmac_exp_ctx ); base = &halg->base;snprintf (base->cra_name,CRYPTO_MAX_ALG_NAME ,"cmac(aes)" );
drivers/crypto/ccp/ccp-crypto-sha.c +15 -5
@@ -210,9 +210,14 @@ static int ccp_sha_digest(struct ahash_rstatic int ccp_sha_export (struct ahash_request *req,void *out) {struct ccp_sha_req_ctx *rctx =ahash_request_ctx (req); -struct ccp_sha_req_ctx *state = out; +struct ccp_sha_exp_ctx *state = out; - *state = *rctx; + state->type = rctx->type; + state->msg_bits = rctx->msg_bits; + state->first = rctx->first; +memcpy (state->ctx, rctx->ctx,sizeof (state->ctx)); + state->buf_count = rctx->buf_count; +memcpy (state->buf, rctx->buf,sizeof (state->buf));return 0 ; }
@@ -220,9 +225,14 @@ static int ccp_sha_export(struct ahash_rstatic int ccp_sha_import (struct ahash_request *req,const void *in) {struct ccp_sha_req_ctx *rctx =ahash_request_ctx (req); -const struct ccp_sha_req_ctx *state = in; +const struct ccp_sha_exp_ctx *state = in; - *rctx = *state; + rctx->type = state->type; + rctx->msg_bits = state->msg_bits; + rctx->first = state->first; +memcpy (rctx->ctx, state->ctx,sizeof (rctx->ctx)); + rctx->buf_count = state->buf_count; +memcpy (rctx->buf, state->buf,sizeof (rctx->buf));return 0 ; }
@@ -428,7 +438,7 @@ static int ccp_register_sha_alg(struct l halg = &alg->halg; halg->digestsize = def->digest_size; - halg->statesize =sizeof (struct ccp_sha_req_ctx ); + halg->statesize =sizeof (struct ccp_sha_exp_ctx ); base = &halg->base;snprintf (base->cra_name,CRYPTO_MAX_ALG_NAME ,"%s" , def->name);
drivers/crypto/ccp/ccp-crypto.h +22 -0
@@ -129,6 +129,15 @@ struct ccp_aes_cmac_req_ctx {struct ccp_cmd cmd; }; +struct ccp_aes_cmac_exp_ctx { +unsigned int null_msg; + +u8 iv[AES_BLOCK_SIZE ]; + +unsigned int buf_count; +u8 buf[AES_BLOCK_SIZE ]; +}; +/***** SHA related defines *****/ #define MAX_SHA_CONTEXT_SIZE SHA256_DIGEST_SIZE#define MAX_SHA_BLOCK_SIZE SHA256_BLOCK_SIZE
@@ -171,6 +180,19 @@ struct ccp_sha_req_ctx {struct ccp_cmd cmd; }; +struct ccp_sha_exp_ctx { +enum ccp_sha_type type; + +u64 msg_bits; + +unsigned int first; + +u8 ctx[MAX_SHA_CONTEXT_SIZE ]; + +unsigned int buf_count; +u8 buf[MAX_SHA_BLOCK_SIZE ]; +}; +/***** Common Context Structure *****/ struct ccp_ctx {int (*complete)(struct crypto_async_request *req,int ret);
Greg Kroah-Hartman
maintainerPATCH 76/210 crypto: ccp - Dont assume export/import areas are aligned
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tom Lendacky <[email protected]>
commit b31dde2a5cb1bf764282abf934266b7193c2bc7c upstream.
Use a local variable for the exported and imported state so that alignment is not an issue. On export, set a local variable from the request context and then memcpy the contents of the local variable to the export memory area. On import, memcpy the import memory area into a local variable and then use the local variable to set the request context.
--- drivers/crypto/ccp/ccp-crypto-aes-cmac.c | 26 ++++++++++++++--------- drivers/crypto/ccp/ccp-crypto-sha.c | 34 ++++++++++++++++++------------- 2 files changed, 36 insertions(+), 24 deletions(-)
drivers/crypto/ccp/ccp-crypto-aes-cmac.c +16 -10
@@ -223,12 +223,15 @@ static int ccp_aes_cmac_digest(struct ahstatic int ccp_aes_cmac_export (struct ahash_request *req,void *out) {struct ccp_aes_cmac_req_ctx *rctx =ahash_request_ctx (req); -struct ccp_aes_cmac_exp_ctx *state = out; +struct ccp_aes_cmac_exp_ctx state; - state->null_msg = rctx->null_msg; -memcpy (state->iv, rctx->iv,sizeof (state->iv)); - state->buf_count = rctx->buf_count; -memcpy (state->buf, rctx->buf,sizeof (state->buf)); + state.null_msg = rctx->null_msg; +memcpy (state.iv, rctx->iv,sizeof (state.iv)); + state.buf_count = rctx->buf_count; +memcpy (state.buf, rctx->buf,sizeof (state.buf)); + +/* 'out' may not be aligned so memcpy from local variable */ +memcpy (out, &state,sizeof (state));return 0 ; }
@@ -236,12 +239,15 @@ static int ccp_aes_cmac_export(struct ahstatic int ccp_aes_cmac_import (struct ahash_request *req,const void *in) {struct ccp_aes_cmac_req_ctx *rctx =ahash_request_ctx (req); -const struct ccp_aes_cmac_exp_ctx *state = in; +struct ccp_aes_cmac_exp_ctx state; + +/* 'in' may not be aligned so memcpy to local variable */ +memcpy (&state, in,sizeof (state)); - rctx->null_msg = state->null_msg; -memcpy (rctx->iv, state->iv,sizeof (rctx->iv)); - rctx->buf_count = state->buf_count; -memcpy (rctx->buf, state->buf,sizeof (rctx->buf)); + rctx->null_msg = state.null_msg; +memcpy (rctx->iv, state.iv,sizeof (rctx->iv)); + rctx->buf_count = state.buf_count; +memcpy (rctx->buf, state.buf,sizeof (rctx->buf));return 0 ; }
drivers/crypto/ccp/ccp-crypto-sha.c +20 -14
@@ -210,14 +210,17 @@ static int ccp_sha_digest(struct ahash_rstatic int ccp_sha_export (struct ahash_request *req,void *out) {struct ccp_sha_req_ctx *rctx =ahash_request_ctx (req); -struct ccp_sha_exp_ctx *state = out; +struct ccp_sha_exp_ctx state; - state->type = rctx->type; - state->msg_bits = rctx->msg_bits; - state->first = rctx->first; -memcpy (state->ctx, rctx->ctx,sizeof (state->ctx)); - state->buf_count = rctx->buf_count; -memcpy (state->buf, rctx->buf,sizeof (state->buf)); + state.type = rctx->type; + state.msg_bits = rctx->msg_bits; + state.first = rctx->first; +memcpy (state.ctx, rctx->ctx,sizeof (state.ctx)); + state.buf_count = rctx->buf_count; +memcpy (state.buf, rctx->buf,sizeof (state.buf)); + +/* 'out' may not be aligned so memcpy from local variable */ +memcpy (out, &state,sizeof (state));return 0 ; }
@@ -225,14 +228,17 @@ static int ccp_sha_export(struct ahash_rstatic int ccp_sha_import (struct ahash_request *req,const void *in) {struct ccp_sha_req_ctx *rctx =ahash_request_ctx (req); -const struct ccp_sha_exp_ctx *state = in; +struct ccp_sha_exp_ctx state; + +/* 'in' may not be aligned so memcpy to local variable */ +memcpy (&state, in,sizeof (state)); - rctx->type = state->type; - rctx->msg_bits = state->msg_bits; - rctx->first = state->first; -memcpy (rctx->ctx, state->ctx,sizeof (rctx->ctx)); - rctx->buf_count = state->buf_count; -memcpy (rctx->buf, state->buf,sizeof (rctx->buf)); + rctx->type = state.type; + rctx->msg_bits = state.msg_bits; + rctx->first = state.first; +memcpy (rctx->ctx, state.ctx,sizeof (rctx->ctx)); + rctx->buf_count = state.buf_count; +memcpy (rctx->buf, state.buf,sizeof (rctx->buf));return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 77/210 crypto: ccp - memset request context to zero during import
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tom Lendacky <[email protected]>
commit ce0ae266feaf35930394bd770c69778e4ef03ba9 upstream.
Since a crypto_ahash_import() can be called against a request context that has not had a crypto_ahash_init() performed, the request context needs to be cleared to insure there is no random data present. If not, the random data can result in a kernel oops during crypto_ahash_update().
--- drivers/crypto/ccp/ccp-crypto-aes-cmac.c | 1 + drivers/crypto/ccp/ccp-crypto-sha.c | 1 + 2 files changed, 2 insertions(+)
drivers/crypto/ccp/ccp-crypto-aes-cmac.c +1 -0
@@ -244,6 +244,7 @@ static int ccp_aes_cmac_import(struct ah/* 'in' may not be aligned so memcpy to local variable */ memcpy (&state, in,sizeof (state)); +memset (rctx,0 ,sizeof (*rctx)); rctx->null_msg = state.null_msg;memcpy (rctx->iv, state.iv,sizeof (rctx->iv)); rctx->buf_count = state.buf_count;
drivers/crypto/ccp/ccp-crypto-sha.c +1 -0
@@ -233,6 +233,7 @@ static int ccp_sha_import(struct ahash_r/* 'in' may not be aligned so memcpy to local variable */ memcpy (&state, in,sizeof (state)); +memset (rctx,0 ,sizeof (*rctx)); rctx->type = state.type; rctx->msg_bits = state.msg_bits; rctx->first = state.first;
Greg Kroah-Hartman
maintainerPATCH 78/210 crypto: keywrap - memzero the correct memory
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
commit 2b8b28fd232233c22fb61009dd8b0587390d2875 upstream.
We're clearing the wrong memory. The memory corruption is likely harmless because we weren't going to use that stack memory again but not zeroing is a potential information leak.
--- crypto/keywrap.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
crypto/keywrap.c +2 -2
@@ -212,7 +212,7 @@ static int crypto_kw_decrypt(struct blkc SEMIBSIZE)) ret = -EBADMSG ; -memzero_explicit (&block,sizeof (struct crypto_kw_block )); +memzero_explicit (block,sizeof (struct crypto_kw_block ));return ret; }
@@ -297,7 +297,7 @@ static int crypto_kw_encrypt(struct blkc/* establish the IV for the caller to pick up */ memcpy (desc->info, block->A,SEMIBSIZE ); -memzero_explicit (&block,sizeof (struct crypto_kw_block )); +memzero_explicit (block,sizeof (struct crypto_kw_block ));return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 79/210 crypto: atmel - fix checks of error code returned by devm_ioremap_resource()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Zapolskiy <[email protected]>
commit 9b52d55f4f0e2bb9a34abbcf99e05e17f1b3b281 upstream.
The change fixes potential oops while accessing iomem on invalid address, if devm_ioremap_resource() fails due to some reason.
The devm_ioremap_resource() function returns ERR_PTR() and never returns NULL, which makes useless a following check for NULL.
--- drivers/crypto/atmel-aes.c | 4 ++-- drivers/crypto/atmel-sha.c | 4 ++-- drivers/crypto/atmel-tdes.c | 4 ++-- 3 files changed, 6 insertions(+), 6 deletions(-)
drivers/crypto/atmel-aes.c +2 -2
@@ -1396,9 +1396,9 @@ static int atmel_aes_probe(struct platfo } aes_dd->io_base =devm_ioremap_resource (&pdev->dev, aes_res); -if (!aes_dd->io_base) { +if (IS_ERR (aes_dd->io_base)) {dev_err (dev,"can't ioremap\n" ); - err = -ENOMEM ; + err =PTR_ERR (aes_dd->io_base); goto res_err; }
drivers/crypto/atmel-sha.c +2 -2
@@ -1405,9 +1405,9 @@ static int atmel_sha_probe(struct platfo } sha_dd->io_base =devm_ioremap_resource (&pdev->dev, sha_res); -if (!sha_dd->io_base) { +if (IS_ERR (sha_dd->io_base)) {dev_err (dev,"can't ioremap\n" ); - err = -ENOMEM ; + err =PTR_ERR (sha_dd->io_base); goto res_err; }
drivers/crypto/atmel-tdes.c +2 -2
@@ -1417,9 +1417,9 @@ static int atmel_tdes_probe(struct platf } tdes_dd->io_base =devm_ioremap_resource (&pdev->dev, tdes_res); -if (!tdes_dd->io_base) { +if (IS_ERR (tdes_dd->io_base)) {dev_err (dev,"can't ioremap\n" ); - err = -ENOMEM ; + err =PTR_ERR (tdes_dd->io_base); goto res_err; }
Greg Kroah-Hartman
maintainerPATCH 80/210 crypto: ux500 - fix checks of error code returned by devm_ioremap_resource()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Zapolskiy <[email protected]>
commit b62917a2622ebcb03a500ef20da47be80d8c8951 upstream.
The change fixes potential oops while accessing iomem on invalid address, if devm_ioremap_resource() fails due to some reason.
The devm_ioremap_resource() function returns ERR_PTR() and never returns NULL, which makes useless a following check for NULL.
--- drivers/crypto/ux500/cryp/cryp_core.c | 4 ++-- drivers/crypto/ux500/hash/hash_core.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-)
drivers/crypto/ux500/cryp/cryp_core.c +2 -2
@@ -1440,9 +1440,9 @@ static int ux500_cryp_probe(struct platf device_data->phybase = res->start; device_data->base =devm_ioremap_resource (dev, res); -if (!device_data->base) { +if (IS_ERR (device_data->base)) {dev_err (dev,"[%s]: ioremap failed!" , __func__); - ret = -ENOMEM ; + ret =PTR_ERR (device_data->base); goto out; }
drivers/crypto/ux500/hash/hash_core.c +2 -2
@@ -1675,9 +1675,9 @@ static int ux500_hash_probe(struct platf device_data->phybase = res->start; device_data->base =devm_ioremap_resource (dev, res); -if (!device_data->base) { +if (IS_ERR (device_data->base)) {dev_err (dev,"%s: ioremap() failed!\n" , __func__); - ret = -ENOMEM ; + ret =PTR_ERR (device_data->base); goto out; }spin_lock_init (&device_data->ctx_lock);
Greg Kroah-Hartman
maintainerPATCH 81/210 crypto: marvell/cesa - forward devm_ioremap_resource() error code
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boris BREZILLON <[email protected]>
commit dfe97ad30e8c038261663a18b9e04b8b5bc07bea upstream.
Forward devm_ioremap_resource() error code instead of returning -ENOMEM.
--- drivers/crypto/marvell/cesa.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/crypto/marvell/cesa.c +1 -1
@@ -420,7 +420,7 @@ static int mv_cesa_probe(struct platform res =platform_get_resource_byname (pdev,IORESOURCE_MEM ,"regs" ); cesa->regs =devm_ioremap_resource (dev, res);if (IS_ERR (cesa->regs)) -return -ENOMEM ; +return PTR_ERR (cesa->regs); ret =mv_cesa_dev_dma_init (cesa);if (ret)
Greg Kroah-Hartman
maintainerPATCH 82/210 X.509: Fix leap year handling again
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <[email protected]>
commit ac4cbedfdf55455b4c447f17f0fa027dbf02b2a6 upstream.
There are still a couple of minor issues in the X.509 leap year handling:
(1) To avoid doing a modulus-by-400 in addition to a modulus-by-100 when determining whether the year is a leap year or not, I divided the year by 100 after doing the modulus-by-100, thereby letting the compiler do one instruction for both, and then did a modulus-by-4.
Unfortunately, I then passed the now-modified year value to mktime64() to construct a time value.
Since this isn't a fast path and since mktime64() does a bunch of divisions, just condense down to "% 400". It's also easier to read.
(2) The default month length for any February where the year doesn't divide by four exactly is obtained from the month_length[] array where the value is 29, not 28.
This is fixed by altering the table.
--- crypto/asymmetric_keys/x509_cert_parser.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
crypto/asymmetric_keys/x509_cert_parser.c +4 -4
@@ -494,7 +494,7 @@ int x509_decode_time(time64_t *_t, sizeunsigned char tag, const unsigned char *value, size_t vlen) { - static const unsigned char month_lengths[] = { 31, 29, 31, 30, 31, 30, + static const unsigned char month_lengths[] = { 31, 28, 31, 30, 31, 30,31 ,31 ,30 ,31 ,30 ,31 };const unsigned char *p = value;unsigned year, mon, day, hour, min, sec, mon_len;
@@ -540,9 +540,9 @@ int x509_decode_time(time64_t *_t, sizeif (year %4 ==0 ) { mon_len =29 ;if (year %100 ==0 ) { - year /=100 ; -if (year %4 !=0 ) - mon_len =28 ; + mon_len =28 ; +if (year %400 ==0 ) + mon_len =29 ; } } }
Greg Kroah-Hartman
maintainerPATCH 83/210 mei: bus: check if the device is enabled before data transfer
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Usyskin <[email protected]>
commit 15c13dfcad883a1e76b714480fb27be96247fd82 upstream.
The bus data transfer interface was missing the check if the device is in enabled state, this may lead to stack corruption during link reset.
--- drivers/misc/mei/bus.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/misc/mei/bus.c +9 -0
@@ -53,6 +53,11 @@ ssize_t __mei_cl_send(struct mei_cl *cl, bus = cl->dev;mutex_lock (&bus->device_lock); +if (bus->dev_state !=MEI_DEV_ENABLED ) { + rets = -ENODEV ; + goto out; + } +if (!mei_cl_is_connected (cl)) { rets = -ENODEV ; goto out;
@@ -109,6 +114,10 @@ ssize_t __mei_cl_recv(struct mei_cl *cl, bus = cl->dev;mutex_lock (&bus->device_lock); +if (bus->dev_state !=MEI_DEV_ENABLED ) { + rets = -ENODEV ; + goto out; + } cb =mei_cl_read_cb (cl,NULL );if (cb)
Greg Kroah-Hartman
maintainerPATCH 84/210 tpm: fix the rollback in tpm_chip_register()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jarkko Sakkinen <[email protected]>
commit 72c91ce8523ae5828fe5e4417ae0aaab53707a08 upstream.
Fixed the rollback and gave more self-documenting names for the functions.
--- drivers/char/tpm/tpm-chip.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/char/tpm/tpm-chip.c +5 -5
@@ -140,7 +140,7 @@ struct tpm_chip *tpmm_chip_alloc(struct }EXPORT_SYMBOL_GPL (tpmm_chip_alloc); -static int tpm_dev_add_device (struct tpm_chip *chip) +static int tpm_add_char_device (struct tpm_chip *chip) {int rc;
@@ -151,7 +151,6 @@ static int tpm_dev_add_device(struct tpm chip->devname,MAJOR (chip->dev.devt), MINOR(chip->dev.devt), rc); -device_unregister (&chip->dev);return rc; }
@@ -162,13 +161,14 @@ static int tpm_dev_add_device(struct tpm chip->devname,MAJOR (chip->dev.devt), MINOR(chip->dev.devt), rc); +cdev_del (&chip->cdev);return rc; }return rc; } -static void tpm_dev_del_device (struct tpm_chip *chip) +static void tpm_del_char_device (struct tpm_chip *chip) {cdev_del (&chip->cdev);device_unregister (&chip->dev);
@@ -222,7 +222,7 @@ int tpm_chip_register(struct tpm_chip *ctpm_add_ppi (chip); - rc =tpm_dev_add_device (chip); + rc =tpm_add_char_device (chip);if (rc) goto out_err;
@@ -274,6 +274,6 @@ void tpm_chip_unregister(struct tpm_chipsysfs_remove_link (&chip->pdev->kobj,"ppi" );tpm1_chip_unregister (chip); -tpm_dev_del_device (chip); +tpm_del_char_device (chip); }EXPORT_SYMBOL_GPL (tpm_chip_unregister);
Greg Kroah-Hartman
maintainerPATCH 85/210 tpm_crb: tpm2_shutdown() must be called before tpm_chip_unregister()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jarkko Sakkinen <[email protected]>
commit 99cda8cb4639de81cde785b5bab9bc52e916e594 upstream.
Wrong call order.
--- drivers/char/tpm/tpm_crb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/char/tpm/tpm_crb.c +2 -2
@@ -310,11 +310,11 @@ static int crb_acpi_remove(struct acpi_dstruct device *dev = &device->dev;struct tpm_chip *chip =dev_get_drvdata (dev); -tpm_chip_unregister (chip); -if (chip->flags &TPM_CHIP_FLAG_TPM2 )tpm2_shutdown (chip,TPM2_SU_CLEAR ); +tpm_chip_unregister (chip); +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 86/210 tpm_eventlog.c: fix binary_bios_measurements
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harald Hoyer <[email protected]>
commit 186d124f07da193a8f47e491af85cb695d415f2f upstream.
The commit 0cc698af36ff ("vTPM: support little endian guests") copied the event, but without the event data, did an endian conversion on the size and tried to output the event data from the copied version, which has only have one byte of the data, resulting in garbage event data.
[[email protected]: fixed minor coding style issues and
renamed the local variable tempPtr as temp_ptr now that there is an excuse to do this.]
--- drivers/char/tpm/tpm_eventlog.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
drivers/char/tpm/tpm_eventlog.c +10 -4
@@ -232,7 +232,7 @@ static int tpm_binary_bios_measurements_ {struct tcpa_event *event = v;struct tcpa_event temp_event; -char *tempPtr; +char *temp_ptr;int i;memcpy (&temp_event, event,sizeof (struct tcpa_event ));
@@ -242,10 +242,16 @@ static int tpm_binary_bios_measurements_ temp_event.event_type =do_endian_conversion (event->event_type); temp_event.event_size =do_endian_conversion (event->event_size); - tempPtr = (char *)&temp_event; + temp_ptr = (char *) &temp_event; -for (i =0 ; i <sizeof (struct tcpa_event ) + temp_event.event_size; i++) -seq_putc (m, tempPtr[i]); +for (i =0 ; i < (sizeof (struct tcpa_event ) -1 ) ; i++) +seq_putc (m, temp_ptr[i]); + + temp_ptr = (char *) v; + +for (i = (sizeof (struct tcpa_event ) -1 ); + i < (sizeof (struct tcpa_event ) + temp_event.event_size); i++) +seq_putc (m, temp_ptr[i]);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 87/210 tpm: fix the cleanup of struct tpm_chip
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jarkko Sakkinen <[email protected]>
commit 8e0ee3c9faed7ca68807ea45141775856c438ac0 upstream.
If the initialization fails before tpm_chip_register(), put_device() will be not called, which causes release callback not to be called. This patch fixes the issue by adding put_device() to devres list of the parent device.
--- drivers/char/tpm/tpm-chip.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/char/tpm/tpm-chip.c +3 -1
@@ -136,6 +136,8 @@ struct tpm_chip *tpmm_chip_alloc(struct chip->cdev.owner = chip->pdev->driver->owner; chip->cdev.kobj.parent = &chip->dev.kobj; +devm_add_action (dev, (void (*)(void *)) put_device, &chip->dev); +return chip; }EXPORT_SYMBOL_GPL (tpmm_chip_alloc);
@@ -171,7 +173,7 @@ static int tpm_add_char_device(struct tpstatic void tpm_del_char_device (struct tpm_chip *chip) {cdev_del (&chip->cdev); -device_unregister (&chip->dev); +device_del (&chip->dev); }static int tpm1_chip_register (struct tpm_chip *chip)
Greg Kroah-Hartman
maintainerPATCH 88/210 HID: logitech: fix Dual Action gamepad support
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Grazvydas Ignotas <[email protected]>
commit 5d74325a2201376a95520a4a38a1ce2c65761c49 upstream.
The patch that added Logitech Dual Action gamepad support forgot to update the special driver list for the device. This caused the logitech driver not to probe unless kernel module load order was favorable. Update the special driver list to fix it. Thanks to Simon Wood for the idea.
--- drivers/hid/hid-core.c | 1 + 1 file changed, 1 insertion(+)
drivers/hid/hid-core.c +1 -0
@@ -1897,6 +1897,7 @@ static const struct hid_device_id hid_ha { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_ELITE_KBD) }, { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_CORDLESS_DESKTOP_LX500) }, { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_EXTREME_3D) }, + { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_DUAL_ACTION) }, { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_WHEEL) }, { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_RUMBLEPAD_CORD) }, { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_RUMBLEPAD) },
Greg Kroah-Hartman
maintainerPATCH 89/210 HID: i2c-hid: fix OOB write in i2c_hid_set_or_send_report()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <[email protected]>
commit 3b654288b196ceaa156029d9457ccbded0489b98 upstream.
Even though hid_hw_* checks that passed in data_len is less than HID_MAX_BUFFER_SIZE it is not enough, as i2c-hid does not necessarily allocate buffers of HID_MAX_BUFFER_SIZE but rather checks all device reports and select largest size. In-kernel users normally just send as much data as report needs, so there is no problem, but hidraw users can do whatever they please:
BUG: KASAN: slab-out-of-bounds in memcpy+0x34/0x54 at addr ffffffc07135ea80 Write of size 4101 by task syz-executor/8747 CPU: 2 PID: 8747 Comm: syz-executor Tainted: G BU 3.18.0 #37 Hardware name: Google Tegra210 Smaug Rev 1,3+ (DT) Call trace: [<ffffffc00020ebcc>] dump_backtrace+0x0/0x258 arch/arm64/kernel/traps.c:83 [<ffffffc00020ee40>] show_stack+0x1c/0x2c arch/arm64/kernel/traps.c:172 [< inline >] __dump_stack lib/dump_stack.c:15 [<ffffffc001958114>] dump_stack+0x90/0x140 lib/dump_stack.c:50 [< inline >] print_error_description mm/kasan/report.c:97 [< inline >] kasan_report_error mm/kasan/report.c:278 [<ffffffc0004597dc>] kasan_report+0x268/0x530 mm/kasan/report.c:305 [<ffffffc0004592e8>] __asan_storeN+0x20/0x150 mm/kasan/kasan.c:718 [<ffffffc0004594e0>] memcpy+0x30/0x54 mm/kasan/kasan.c:299 [<ffffffc001306354>] __i2c_hid_command+0x2b0/0x7b4 drivers/hid/i2c-hid/i2c-hid.c:178 [< inline >] i2c_hid_set_or_send_report drivers/hid/i2c-hid/i2c-hid.c:321 [<ffffffc0013079a0>] i2c_hid_output_raw_report.isra.2+0x3d4/0x4b8 drivers/hid/i2c-hid/i2c-hid.c:589 [<ffffffc001307ad8>] i2c_hid_output_report+0x54/0x68 drivers/hid/i2c-hid/i2c-hid.c:602 [< inline >] hid_hw_output_report include/linux/hid.h:1039 [<ffffffc0012cc7a0>] hidraw_send_report+0x400/0x414 drivers/hid/hidraw.c:154 [<ffffffc0012cc7f4>] hidraw_write+0x40/0x64 drivers/hid/hidraw.c:177 [<ffffffc0004681dc>] vfs_write+0x1d4/0x3cc fs/read_write.c:534 [< inline >] SYSC_pwrite64 fs/read_write.c:627 [<ffffffc000468984>] SyS_pwrite64+0xec/0x144 fs/read_write.c:614
Object at ffffffc07135ea80, in cache kmalloc-512
Object allocated with size 268 bytes.
Let's check data length against the buffer size before attempting to copy data over.
--- drivers/hid/i2c-hid/i2c-hid.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-)
drivers/hid/i2c-hid/i2c-hid.c +10 -6
@@ -282,17 +282,21 @@ static int i2c_hid_set_or_send_report(stu16 dataRegister =le16_to_cpu (ihid->hdesc.wDataRegister);u16 outputRegister =le16_to_cpu (ihid->hdesc.wOutputRegister);u16 maxOutputLength =le16_to_cpu (ihid->hdesc.wMaxOutputLength); +u16 size; +int args_len; +int index =0 ; + +i2c_hid_dbg (ihid,"%s\n" , __func__); + +if (data_len > ihid->bufsize) +return -EINVAL ; -/* hid_hw_* already checked that data_len < HID_MAX_BUFFER_SIZE */ -u16 size =2 /* size */ + + size =2 /* size */ + (reportID ?1 :0 )/* reportID */ + data_len/* buf */ ; -int args_len = (reportID >=0x0F ?1 :0 )/* optional third byte */ + + args_len = (reportID >=0x0F ?1 :0 )/* optional third byte */ +2 /* dataRegister */ + size/* args */ ; -int index =0 ; - -i2c_hid_dbg (ihid,"%s\n" , __func__);if (!use_data && maxOutputLength ==0 )return -ENOSYS ;
Greg Kroah-Hartman
maintainerPATCH 90/210 HID: multitouch: force retrieving of Win8 signature blob
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Tissoires <[email protected]>
commit 45c5c6828214605eaefa6755c47bd1a2c7eb203e upstream.
The Synaptics 0x11e5 over I2C found in the Asus T100-CHI requires to fetch the signature blob to actually start sending events.
With this patch, we should be close enough to the Windows driver which checks the content of the blob at plugin to validate or not the touchscreen.
--- drivers/hid/hid-multitouch.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/hid/hid-multitouch.c +5 -0
@@ -396,6 +396,11 @@ static void mt_feature_mapping(struct hi td->is_buttonpad = true;break ; +case 0xff0000c5 : +/* Retrieve the Win8 blob once to enable some devices */ +if (usage->usage_index ==0 ) +mt_get_feature (hdev, field->report); +break ; } }
Greg Kroah-Hartman
maintainerPATCH 91/210 HID: fix hid_ignore_special_drivers module parameter
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Tissoires <[email protected]>
commit 4392bf333388cabdad5afe5b1500002d7b9c318e upstream.
hid_ignore_special_drivers works fine until hid_scan_report autodetects and reassign devices (for hid-multitouch, hid-microsoft and hid-rmi).
Simplify the handling of the parameter: if it is there, use hid-generic, no matter what, and if not, scan the device or rely on the hid_have_special_driver table.
This was detected while trying to disable hid-multitouch on a Surface Pro cover which prevented to use the keyboard.
--- drivers/hid/hid-core.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/hid/hid-core.c +4 -3
@@ -2616,9 +2616,10 @@ int hid_add_device(struct hid_device *hd/* * Scan generic devices for group information */ -if (hid_ignore_special_drivers || - (!hdev->group && - !hid_match_id (hdev, hid_have_special_driver))) { +if (hid_ignore_special_drivers) { + hdev->group =HID_GROUP_GENERIC ; + }else if (!hdev->group && + !hid_match_id (hdev, hid_have_special_driver)) { ret =hid_scan_report (hdev);if (ret)hid_warn (hdev,"bad device descriptor (%d)\n" , ret);
Greg Kroah-Hartman
maintainerPATCH 92/210 staging: comedi: ni_tiocmd: change mistaken use of start_src for start_arg
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Spencer E. Olson <[email protected]>
commit 1fd24a4702d2af0ea4d5845126cf57d4d1796216 upstream.
This fixes a bug in function ni_tio_input_inttrig(). The trigger number should be compared to cmd->start_arg, not cmd->start_src.
--- drivers/staging/comedi/drivers/ni_tiocmd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/comedi/drivers/ni_tiocmd.c +1 -1
@@ -92,7 +92,7 @@ static int ni_tio_input_inttrig(struct cunsigned long flags;int ret =0 ; -if (trig_num != cmd->start_src) +if (trig_num != cmd->start_arg)return -EINVAL ;spin_lock_irqsave (&counter->lock, flags);
Greg Kroah-Hartman
maintainerPATCH 93/210 staging: android: ion_test: fix check of platform_device_register_simple() error code
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Zapolskiy <[email protected]>
commit ccbc2a9e7878ff09bcaed4893c2a2d3adbb797e2 upstream.
On error platform_device_register_simple() returns ERR_PTR() value, check for NULL always fails. The change corrects the check itself and propagates the returned error upwards.
--- drivers/staging/android/ion/ion_test.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/staging/android/ion/ion_test.c +2 -2
@@ -285,8 +285,8 @@ static int __init ion_test_init(void) { ion_test_pdev =platform_device_register_simple ("ion-test" ,-1 ,NULL ,0 ); -if (!ion_test_pdev) -return -ENODEV ; +if (IS_ERR (ion_test_pdev)) +return PTR_ERR (ion_test_pdev);return platform_driver_probe (&ion_test_platform_driver, ion_test_probe); }
Greg Kroah-Hartman
maintainerPATCH 94/210 staging: comedi: ni_mio_common: fix the ni_write[blw]() functions
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: H Hartley Sweeten <[email protected]>
commit bd3a3cd6c27b117fb9a43a38c8072c95332beecc upstream.
Memory mapped io (dev->mmio) should not also be writing to the ioport (dev->iobase) registers. Add the missing 'else' to these functions.
--- drivers/staging/comedi/drivers/ni_mio_common.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/staging/comedi/drivers/ni_mio_common.c +6 -6
@@ -246,24 +246,24 @@ static void ni_writel(struct comedi_devi {if (dev->mmio)writel (data, dev->mmio + reg); - -outl (data, dev->iobase + reg); +else +outl (data, dev->iobase + reg); }static void ni_writew (struct comedi_device *dev,uint16_t data,int reg) {if (dev->mmio)writew (data, dev->mmio + reg); - -outw (data, dev->iobase + reg); +else +outw (data, dev->iobase + reg); }static void ni_writeb (struct comedi_device *dev,uint8_t data,int reg) {if (dev->mmio)writeb (data, dev->mmio + reg); - -outb (data, dev->iobase + reg); +else +outb (data, dev->iobase + reg); }static uint32_t ni_readl (struct comedi_device *dev,int reg)
Greg Kroah-Hartman
maintainerPATCH 95/210 tty: Fix GPF in flush_to_ldisc(), part 2
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Hurley <[email protected]>
commit f33798deecbd59a2955f40ac0ae2bc7dff54c069 upstream.
commit 9ce119f318ba ("tty: Fix GPF in flush_to_ldisc()") fixed a GPF caused by a line discipline which does not define a receive_buf() method.
However, the vt driver (and speakup driver also) pushes selection data directly to the line discipline receive_buf() method via tty_ldisc_receive_buf(). Fix the same problem in tty_ldisc_receive_buf().
--- include/linux/tty.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/tty.h +1 -1
@@ -594,7 +594,7 @@ static inline int tty_ldisc_receive_buf( count = ld->ops->receive_buf2 (ld->tty, p, f, count); else { count =min_t (int, count, ld->tty->receive_room); -if (count) +if (count && ld->ops->receive_buf) ld->ops->receive_buf (ld->tty, p, f, count); }return count;
Greg Kroah-Hartman
maintainerPATCH 96/210 net: irda: Fix use-after-free in irtty_open()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Hurley <[email protected]>
commit 401879c57f01cbf2da204ad2e8db910525c6dbea upstream.
The N_IRDA line discipline may access the previous line discipline's closed and already-fre private data on open [1].
The tty->disc_data field _never_ refers to valid data on entry to the line discipline's open() method. Rather, the ldisc is expected to initialize that field for its own use for the lifetime of the instance (ie. from open() to close() only).
[1]
==================================================================
BUG: KASAN: use-after-free in irtty_open+0x422/0x550 at addr ffff8800331dd068
Read of size 4 by task a.out/13960
=============================================================================
BUG kmalloc-512 (Tainted: G B ): kasan: bad access detected
-----------------------------------------------------------------------------
...
Call Trace:
[<ffffffff815fa2ae>] __asan_report_load4_noabort+0x3e/0x40 mm/kasan/report.c:279
[<ffffffff836938a2>] irtty_open+0x422/0x550 drivers/net/irda/irtty-sir.c:436
[<ffffffff829f1b80>] tty_ldisc_open.isra.2+0x60/0xa0 drivers/tty/tty_ldisc.c:447
[<ffffffff829f21c0>] tty_set_ldisc+0x1a0/0x940 drivers/tty/tty_ldisc.c:567
[< inline >] tiocsetd drivers/tty/tty_io.c:2650
[<ffffffff829da49e>] tty_ioctl+0xace/0x1fd0 drivers/tty/tty_io.c:2883
[< inline >] vfs_ioctl fs/ioctl.c:43
[<ffffffff816708ac>] do_vfs_ioctl+0x57c/0xe60 fs/ioctl.c:607
[< inline >] SYSC_ioctl fs/ioctl.c:622
[<ffffffff81671204>] SyS_ioctl+0x74/0x80 fs/ioctl.c:613
[<ffffffff852a7876>] entry_SYSCALL_64_fastpath+0x16/0x7a--- drivers/net/irda/irtty-sir.c | 10 ---------- 1 file changed, 10 deletions(-)
drivers/net/irda/irtty-sir.c +0 -10
@@ -430,16 +430,6 @@ static int irtty_open(struct tty_struct/* Module stuff handled via irda_ldisc.owner - Jean II */ -/* First make sure we're not already connected. */ -if (tty->disc_data !=NULL ) { - priv = tty->disc_data; -if (priv && priv->magic ==IRTTY_MAGIC ) { - ret = -EEXIST ; - goto out; - } - tty->disc_data =NULL ;/* ### */ - } -/* stop the underlying driver */ irtty_stop_receiver (tty, TRUE);if (tty->ops->stop)
Greg Kroah-Hartman
maintainerPATCH 97/210 8250: use callbacks to access UART_DLL/UART_DLM
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Frias <[email protected]>
commit 0b41ce991052022c030fd868e03877700220b090 upstream.
Some UART HW has a single register combining UART_DLL/UART_DLM (this was probably forgotten in the change that introduced the callbacks, commit b32b19b8ffc05cbd3bf91c65e205f6a912ca15d9)
--- drivers/tty/serial/8250/8250_port.c | 18 ++++++------------ 1 file changed, 6 insertions(+), 12 deletions(-)
drivers/tty/serial/8250/8250_port.c +6 -12
@@ -713,22 +713,16 @@ static int size_fifo(struct uart_8250_po*/ static unsigned int autoconfig_read_divisor_id (struct uart_8250_port *p) { -unsigned char old_dll, old_dlm, old_lcr; -unsigned int id; +unsigned char old_lcr; +unsigned int id, old_dl; old_lcr =serial_in (p,UART_LCR );serial_out (p,UART_LCR ,UART_LCR_CONF_MODE_A ); + old_dl =serial_dl_read (p); +serial_dl_write (p,0 ); + id =serial_dl_read (p); +serial_dl_write (p, old_dl); - old_dll =serial_in (p,UART_DLL ); - old_dlm =serial_in (p,UART_DLM ); - -serial_out (p,UART_DLL ,0 ); -serial_out (p,UART_DLM ,0 ); - - id =serial_in (p,UART_DLL ) |serial_in (p,UART_DLM ) <<8 ; - -serial_out (p,UART_DLL , old_dll); -serial_out (p,UART_DLM , old_dlm);serial_out (p,UART_LCR , old_lcr);return id;
Greg Kroah-Hartman
maintainerPATCH 98/210 saa7134: Fix bytesperline not being set correctly for planar formats
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
commit 3e71da19f9dc22e39a755d6ae9678661abb66adc upstream.
bytesperline should be the bytesperline for the first plane for planar formats, not that of all planes combined.
This fixes a crash in xawtv caused by the wrong bpl.
--- drivers/media/pci/saa7134/saa7134-video.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-)
drivers/media/pci/saa7134/saa7134-video.c +12 -6
@@ -1219,10 +1219,13 @@ static int saa7134_g_fmt_vid_cap(struct f->fmt.pix.height = dev->height; f->fmt.pix.field = dev->field; f->fmt.pix.pixelformat = dev->fmt->fourcc; - f->fmt.pix.bytesperline = - (f->fmt.pix.width * dev->fmt->depth) >>3 ; +if (dev->fmt->planar) + f->fmt.pix.bytesperline = f->fmt.pix.width; +else + f->fmt.pix.bytesperline = + (f->fmt.pix.width * dev->fmt->depth) /8 ; f->fmt.pix.sizeimage = - f->fmt.pix.height * f->fmt.pix.bytesperline; + (f->fmt.pix.height * f->fmt.pix.width * dev->fmt->depth) /8 ; f->fmt.pix.colorspace =V4L2_COLORSPACE_SMPTE170M ;return 0 ; }
@@ -1298,10 +1301,13 @@ static int saa7134_try_fmt_vid_cap(strucif (f->fmt.pix.height > maxh) f->fmt.pix.height = maxh; f->fmt.pix.width &= ~0x03 ; - f->fmt.pix.bytesperline = - (f->fmt.pix.width * fmt->depth) >>3 ; +if (fmt->planar) + f->fmt.pix.bytesperline = f->fmt.pix.width; +else + f->fmt.pix.bytesperline = + (f->fmt.pix.width * fmt->depth) /8 ; f->fmt.pix.sizeimage = - f->fmt.pix.height * f->fmt.pix.bytesperline; + (f->fmt.pix.height * f->fmt.pix.width * fmt->depth) /8 ; f->fmt.pix.colorspace =V4L2_COLORSPACE_SMPTE170M ;return 0 ;
Greg Kroah-Hartman
maintainerPATCH 99/210 adv7511: TX_EDID_PRESENT is still 1 after a disconnect
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Verkuil <[email protected]>
commit b339a72e04a62f0b1882c43492fc712f1176b3e6 upstream.
The V4L2_CID_TX_EDID_PRESENT control reports if an EDID is present. The adv7511 however still reported the EDID present after disconnecting the HDMI cable. Fix the logic regarding this control. And when the EDID is disconnected also call ADV7511_EDID_DETECT to notify the bridge driver. This was also missing.
--- drivers/media/i2c/adv7511.c | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-)
drivers/media/i2c/adv7511.c +15 -6
@@ -1161,12 +1161,23 @@ static void adv7511_dbg_dump_edid(int lv } } +static void adv7511_notify_no_edid (struct v4l2_subdev *sd) +{ +struct adv7511_state *state =get_adv7511_state (sd); +struct adv7511_edid_detect ed; + +/* We failed to read the EDID, so send an event for this. */ + ed.present = false; + ed.segment =adv7511_rd (sd,0xc4 ); +v4l2_subdev_notify (sd,ADV7511_EDID_DETECT , (void *)&ed); +v4l2_ctrl_s_ctrl (state->have_edid0_ctrl,0x0 ); +} +static void adv7511_edid_handler (struct work_struct *work) {struct delayed_work *dwork =to_delayed_work (work); struct adv7511_state *state = container_of(dwork, struct adv7511_state, edid_handler);struct v4l2_subdev *sd = &state->sd; -struct adv7511_edid_detect ed;v4l2_dbg (1 , debug, sd,"%s:\n" , __func__);
@@ -1191,9 +1202,7 @@ static void adv7511_edid_handler(struct }/* We failed to read the EDID, so send an event for this. */ - ed.present = false; - ed.segment =adv7511_rd (sd,0xc4 ); -v4l2_subdev_notify (sd,ADV7511_EDID_DETECT , (void *)&ed); +adv7511_notify_no_edid (sd);v4l2_dbg (1 , debug, sd,"%s: no edid found\n" , __func__); }
@@ -1264,7 +1273,6 @@ static void adv7511_check_monitor_presen/* update read only ctrls */ v4l2_ctrl_s_ctrl (state->hotplug_ctrl,adv7511_have_hotplug (sd) ?0x1 :0x0 );v4l2_ctrl_s_ctrl (state->rx_sense_ctrl,adv7511_have_rx_sense (sd) ?0x1 :0x0 ); -v4l2_ctrl_s_ctrl (state->have_edid0_ctrl, state->edid.segments ?0x1 :0x0 );if ((status &MASK_ADV7511_HPD_DETECT ) && ((status &MASK_ADV7511_MSEN_DETECT ) || state->edid.segments)) {v4l2_dbg (1 , debug, sd,"%s: hotplug and (rx-sense or edid)\n" , __func__);
@@ -1294,6 +1302,7 @@ static void adv7511_check_monitor_presen }adv7511_s_power (sd, false);memset (&state->edid,0 ,sizeof (struct adv7511_state_edid )); +adv7511_notify_no_edid (sd); } }
@@ -1370,6 +1379,7 @@ static bool adv7511_check_edid_status(st }/* one more segment read ok */ state->edid.segments = segment +1 ; +v4l2_ctrl_s_ctrl (state->have_edid0_ctrl,0x1 );if (((state->edid.data[0x7e ] >>1 ) +1 ) > state->edid.segments) {/* Request next EDID segment */ v4l2_dbg (1 , debug, sd,"%s: request segment %d\n" , __func__, state->edid.segments);
@@ -1389,7 +1399,6 @@ static bool adv7511_check_edid_status(st ed.present = true; ed.segment =0 ; state->edid_detect_counter++; -v4l2_ctrl_s_ctrl (state->have_edid0_ctrl, state->edid.segments ?0x1 :0x0 );v4l2_subdev_notify (sd,ADV7511_EDID_DETECT , (void *)&ed);return ed.present; }
Greg Kroah-Hartman
maintainerPATCH 100/210 bttv: Width must be a multiple of 16 when capturing planar formats
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
commit 5c915c68763889f0183a1cc61c84bb228b60124a upstream.
On my bttv card "Hauppauge WinTV [card=10]" capturing in YV12 fmt at max size results in a solid green rectangle being captured (all colors 0 in YUV).
This turns out to be caused by max-width (924) not being a multiple of 16.
We've likely never hit this problem before since normally xawtv / tvtime, etc. will prefer packed pixel formats. But when using a video card which is using xf86-video-modesetting + glamor, only planar XVideo fmts are available, and xawtv will chose a matching capture format to avoid needing to do conversion, triggering the solid green window problem.
--- drivers/media/pci/bt8xx/bttv-driver.c | 26 ++++++++++++++++++++------ 1 file changed, 20 insertions(+), 6 deletions(-)
drivers/media/pci/bt8xx/bttv-driver.c +20 -6
@@ -2334,6 +2334,19 @@ static int bttv_g_fmt_vid_overlay(structreturn 0 ; } +static void bttv_get_width_mask_vid_cap (const struct bttv_format *fmt, +unsigned int *width_mask, +unsigned int *width_bias) +{ +if (fmt->flags &FORMAT_FLAGS_PLANAR ) { + *width_mask = ~15 ;/* width must be a multiple of 16 pixels */ + *width_bias =8 ;/* nearest */ + }else { + *width_mask = ~3 ;/* width must be a multiple of 4 pixels */ + *width_bias =2 ;/* nearest */ + } +} +static int bttv_try_fmt_vid_cap (struct file *file,void *priv,struct v4l2_format *f) {
@@ -2343,6 +2356,7 @@ static int bttv_try_fmt_vid_cap(struct fenum v4l2_field field;__s32 width, height;__s32 height2; +unsigned int width_mask, width_bias;int rc; fmt =format_by_fourcc (f->fmt.pix.pixelformat);
@@ -2375,9 +2389,9 @@ static int bttv_try_fmt_vid_cap(struct f width = f->fmt.pix.width; height = f->fmt.pix.height; +bttv_get_width_mask_vid_cap (fmt, &width_mask, &width_bias); rc =limit_scaled_size_lock (fh, &width, &height, field, -/* width_mask: 4 pixels */ ~3 , -/* width_bias: nearest */ 2 , + width_mask, width_bias,/* adjust_size */ 1 ,/* adjust_crop */ 0 );if (0 != rc)
@@ -2410,6 +2424,7 @@ static int bttv_s_fmt_vid_cap(struct filstruct bttv_fh *fh = priv;struct bttv *btv = fh->btv;__s32 width, height; +unsigned int width_mask, width_bias;enum v4l2_field field; retval =bttv_switch_type (fh, f->type);
@@ -2424,9 +2439,10 @@ static int bttv_s_fmt_vid_cap(struct fil height = f->fmt.pix.height; field = f->fmt.pix.field; + fmt =format_by_fourcc (f->fmt.pix.pixelformat); +bttv_get_width_mask_vid_cap (fmt, &width_mask, &width_bias); retval =limit_scaled_size_lock (fh, &width, &height, f->fmt.pix.field, -/* width_mask: 4 pixels */ ~3 , -/* width_bias: nearest */ 2 , + width_mask, width_bias,/* adjust_size */ 1 ,/* adjust_crop */ 1 );if (0 != retval)
@@ -2434,8 +2450,6 @@ static int bttv_s_fmt_vid_cap(struct fil f->fmt.pix.field = field; - fmt =format_by_fourcc (f->fmt.pix.pixelformat); -/* update our state informations */ fh->fmt = fmt; fh->cap.field = f->fmt.pix.field;
Greg Kroah-Hartman
maintainerPATCH 101/210 coda: fix first encoded frame payload
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Philipp Zabel <[email protected]>
commit 74dc385cb450089b28c28be2c8a0baca296b95f9 upstream.
During the recent vb2_buffer restructuring, the calculation of the buffer payload reported to userspace was accidentally broken for the first encoded frame, counting only the length of the headers. This patch re-adds the length of the actual frame data.
--- drivers/media/platform/coda/coda-bit.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/platform/coda/coda-bit.c +1 -1
@@ -1342,7 +1342,7 @@ static void coda_finish_encode(struct co/* Calculate bytesused field */ if (dst_buf->sequence ==0 ) { -vb2_set_plane_payload (&dst_buf->vb2_buf,0 , +vb2_set_plane_payload (&dst_buf->vb2_buf,0 , wr_ptr - start_ptr + ctx->vpu_header_size[0 ] + ctx->vpu_header_size[1 ] + ctx->vpu_header_size[2 ]);
Greg Kroah-Hartman
maintainerPATCH 102/210 media: v4l2-compat-ioctl32: fix missing length copy in put_v4l2_buffer32
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tiffany Lin <[email protected]>
commit 7df5ab8774aa383c6d2bff00688d004585d96dfd upstream.
In v4l2-compliance utility, test QUERYBUF required correct length value to go through each planar to check planar's length in multi-planar buffer type
--- drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 21 ++++++++------------- 1 file changed, 8 insertions(+), 13 deletions(-)
drivers/media/v4l2-core/v4l2-compat-ioctl32.c +8 -13
@@ -415,7 +415,8 @@ static int get_v4l2_buffer32(struct v4l2get_user (kp->index, &up->index) ||get_user (kp->type, &up->type) ||get_user (kp->flags, &up->flags) || - get_user(kp->memory, &up->memory)) +get_user (kp->memory, &up->memory) || + get_user(kp->length, &up->length)) return -EFAULT;if (V4L2_TYPE_IS_OUTPUT (kp->type))
@@ -427,9 +428,6 @@ static int get_v4l2_buffer32(struct v4l2return -EFAULT ;if (V4L2_TYPE_IS_MULTIPLANAR (kp->type)) { -if (get_user (kp->length, &up->length)) -return -EFAULT ; - num_planes = kp->length;if (num_planes ==0 ) { kp->m.planes =NULL ;
@@ -462,16 +460,14 @@ static int get_v4l2_buffer32(struct v4l2 }else {switch (kp->memory) {case V4L2_MEMORY_MMAP : -if (get_user (kp->length, &up->length) || -get_user (kp->m.offset, &up->m.offset)) +if (get_user (kp->m.offset, &up->m.offset))return -EFAULT ;break ;case V4L2_MEMORY_USERPTR : {compat_long_t tmp; -if (get_user (kp->length, &up->length) || -get_user (tmp, &up->m.userptr)) +if (get_user (tmp, &up->m.userptr))return -EFAULT ; kp->m.userptr = (unsigned long )compat_ptr (tmp);
@@ -513,7 +509,8 @@ static int put_v4l2_buffer32(struct v4l2copy_to_user (&up->timecode, &kp->timecode,sizeof (struct v4l2_timecode )) ||put_user (kp->sequence, &up->sequence) ||put_user (kp->reserved2, &up->reserved2) || - put_user(kp->reserved, &up->reserved)) +put_user (kp->reserved, &up->reserved) || + put_user(kp->length, &up->length)) return -EFAULT;if (V4L2_TYPE_IS_MULTIPLANAR (kp->type)) {
@@ -536,13 +533,11 @@ static int put_v4l2_buffer32(struct v4l2 }else {switch (kp->memory) {case V4L2_MEMORY_MMAP : -if (put_user (kp->length, &up->length) || -put_user (kp->m.offset, &up->m.offset)) +if (put_user (kp->m.offset, &up->m.offset))return -EFAULT ;break ;case V4L2_MEMORY_USERPTR : -if (put_user (kp->length, &up->length) || -put_user (kp->m.userptr, &up->m.userptr)) +if (put_user (kp->m.userptr, &up->m.userptr))return -EFAULT ;break ;case V4L2_MEMORY_OVERLAY :
Greg Kroah-Hartman
maintainerPATCH 103/210 mtip32xx: Avoid issuing standby immediate cmd during FTL rebuild
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Asai Thambi SP <[email protected]>
commit d8a18d2d8f5de55666c6011ed175939d22c8e3d8 upstream.
Prevent standby immediate command from being issued in remove, suspend and shutdown paths, while drive is in FTL rebuild process.
--- drivers/block/mtip32xx/mtip32xx.c | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-)
drivers/block/mtip32xx/mtip32xx.c +12 -8
@@ -3270,20 +3270,25 @@ out1:return rv; } -static void mtip_standby_drive (struct driver_data *dd) +static int mtip_standby_drive (struct driver_data *dd) { -if (dd->sr) -return ; +int rv =0 ; +if (dd->sr || !dd->port) +return -ENODEV ;/* * Send standby immediate (E0h) to the drive so that it * saves its state. */ if (!test_bit (MTIP_PF_REBUILD_BIT , &dd->port->flags) && - !test_bit (MTIP_DDF_SEC_LOCK_BIT , &dd->dd_flag)) -if (mtip_standby_immediate (dd->port)) + !test_bit (MTIP_DDF_REBUILD_FAILED_BIT , &dd->dd_flag) && + !test_bit (MTIP_DDF_SEC_LOCK_BIT , &dd->dd_flag)) { + rv =mtip_standby_immediate (dd->port); +if (rv)dev_warn (&dd->pdev->dev,"STANDBY IMMEDIATE failed\n" ); + } +return rv; }/*
@@ -3341,8 +3346,7 @@ static int mtip_hw_shutdown(struct drive* Send standby immediate (E0h) to the drive so that it * saves its state. */ -if (!dd->sr && dd->port) -mtip_standby_immediate (dd->port); +mtip_standby_drive (dd);return 0 ; }
@@ -3365,7 +3369,7 @@ static int mtip_hw_suspend(struct driver* Send standby immediate (E0h) to the drive * so that it saves its state. */ -if (mtip_standby_immediate (dd->port) !=0 ) { +if (mtip_standby_drive (dd) !=0 ) {dev_err (&dd->pdev->dev,"Failed standby-immediate command\n" );return -EFAULT ;
Greg Kroah-Hartman
maintainerPATCH 104/210 mtip32xx: Fix broken service thread handling
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Asai Thambi SP <[email protected]>
commit cfc05bd31384c4898bf2437a4de5557f3cf9803a upstream.
Service thread does not detect the need for taskfile error hanlding. Fixed the flag condition to process taskfile error.
--- drivers/block/mtip32xx/mtip32xx.c | 6 +++--- drivers/block/mtip32xx/mtip32xx.h | 5 +++++ 2 files changed, 8 insertions(+), 3 deletions(-)
drivers/block/mtip32xx/mtip32xx.c +3 -3
@@ -2924,9 +2924,7 @@ static int mtip_service_thread(void *dat* is in progress nor error handling is active */ wait_event_interruptible (port->svc_wait, (port->flags) && - !(port->flags &MTIP_PF_PAUSE_IO )); - -set_bit (MTIP_PF_SVC_THD_ACTIVE_BIT , &port->flags); + (port->flags &MTIP_PF_SVC_THD_WORK ));if (kthread_should_stop () ||test_bit (MTIP_PF_SVC_THD_STOP_BIT , &port->flags))
@@ -2936,6 +2934,8 @@ static int mtip_service_thread(void *dat &dd->dd_flag))) goto st_out; +set_bit (MTIP_PF_SVC_THD_ACTIVE_BIT , &port->flags); + restart_eh:/* Demux bits: start with error handling */ if (test_bit (MTIP_PF_EH_ACTIVE_BIT , &port->flags)) {
drivers/block/mtip32xx/mtip32xx.h +5 -0
@@ -144,6 +144,11 @@ enum {MTIP_PF_REBUILD_BIT =6 ,MTIP_PF_SVC_THD_STOP_BIT =8 , +MTIP_PF_SVC_THD_WORK = ((1 <<MTIP_PF_EH_ACTIVE_BIT ) | + (1 <<MTIP_PF_ISSUE_CMDS_BIT ) | + (1 <<MTIP_PF_REBUILD_BIT ) | + (1 <<MTIP_PF_SVC_THD_STOP_BIT )), +/* below are bit numbers in 'dd_flag' defined in driver_data */ MTIP_DDF_SEC_LOCK_BIT =0 , MTIP_DDF_REMOVE_PENDING_BIT = 1,
Greg Kroah-Hartman
maintainerPATCH 105/210 mtip32xx: Remove unwanted code from taskfile error handler
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Asai Thambi SP <[email protected]>
commit e35b94738a2f7caa12017f69ef385cb6b8028965 upstream.
Remove setting and clearing MTIP_PF_EH_ACTIVE_BIT flag in mtip_handle_tfe() as they are redundant. Also avoid waking up service thread from mtip_handle_tfe() because it is already woken up in case of taskfile error.
--- drivers/block/mtip32xx/mtip32xx.c | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-)
drivers/block/mtip32xx/mtip32xx.c +1 -8
@@ -618,8 +618,6 @@ static void mtip_handle_tfe(struct drive port = dd->port; -set_bit (MTIP_PF_EH_ACTIVE_BIT , &port->flags); -if (test_bit (MTIP_PF_IC_ACTIVE_BIT , &port->flags)) { cmd =mtip_cmd_from_tag (dd,MTIP_TAG_INTERNAL );dbg_printk (MTIP_DRV_NAME " TFE for the internal command\n" );
@@ -628,7 +626,7 @@ static void mtip_handle_tfe(struct drive cmd->comp_func (port,MTIP_TAG_INTERNAL , cmd,PORT_IRQ_TF_ERR ); } - goto handle_tfe_exit; +return ; }/* clear the tag accumulator */
@@ -771,11 +769,6 @@ static void mtip_handle_tfe(struct drive } }print_tags (dd,"reissued (TFE)" , tagaccum, cmd_cnt); - -handle_tfe_exit: -/* clear eh_active */ -clear_bit (MTIP_PF_EH_ACTIVE_BIT , &port->flags); -wake_up_interruptible (&port->svc_wait); }/*
Greg Kroah-Hartman
maintainerPATCH 106/210 mtip32xx: Print exact time when an internal command is interrupted
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Asai Thambi SP <[email protected]>
commit 5b7e0a8ac85e2dfd83830dc9e0b3554d153a37e3 upstream.
Print exact time when an internal command is interrupted.
--- drivers/block/mtip32xx/mtip32xx.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/block/mtip32xx/mtip32xx.c +6 -2
@@ -1092,6 +1092,7 @@ static int mtip_exec_internal_command(ststruct mtip_cmd *int_cmd;struct driver_data *dd = port->dd;int rv =0 ; +unsigned long start;/* Make sure the buffer is 8 byte aligned. This is asic specific. */ if (buffer &0x00000007 ) {
@@ -1155,6 +1156,8 @@ static int mtip_exec_internal_command(st/* Populate the command header */ int_cmd->command_header->byte_count =0 ; + start = jiffies; +/* Issue the command to the hardware */ mtip_issue_non_ncq_command (port,MTIP_TAG_INTERNAL );
@@ -1165,8 +1168,9 @@ static int mtip_exec_internal_command(st msecs_to_jiffies(timeout))) <= 0) {if (rv == -ERESTARTSYS ) {/* interrupted */ dev_err (&dd->pdev->dev, -"Internal command [%02X] was interrupted after %lu ms\n" , - fis->command, timeout); +"Internal command [%02X] was interrupted after %u ms\n" , + fis->command, +jiffies_to_msecs (jiffies - start)); rv = -EINTR ; goto exec_ic_exit; }else if (rv ==0 )/* timeout */
Greg Kroah-Hartman
maintainerPATCH 107/210 mtip32xx: Fix for rmmod crash when drive is in FTL rebuild
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Asai Thambi SP <[email protected]>
commit 59cf70e236c96594d9f1e065755d8fce9df5356b upstream.
When FTL rebuild is in progress, alloc_disk() initializes the disk but device node will be created by add_disk() only after successful completion of FTL rebuild. So, skip deletion of device node in removal path when FTL rebuild is in progress.
--- drivers/block/mtip32xx/mtip32xx.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
drivers/block/mtip32xx/mtip32xx.c +7 -7
@@ -2975,10 +2975,8 @@ restart_eh: }if (test_bit (MTIP_PF_REBUILD_BIT , &port->flags)) { -if (mtip_ftl_rebuild_poll (dd) <0 ) -set_bit (MTIP_DDF_REBUILD_FAILED_BIT , - &dd->dd_flag); -clear_bit (MTIP_PF_REBUILD_BIT , &port->flags); +if (mtip_ftl_rebuild_poll (dd) ==0 ) +clear_bit (MTIP_PF_REBUILD_BIT , &port->flags); } }
@@ -3858,7 +3856,6 @@ static int mtip_block_initialize(structmtip_hw_debugfs_init (dd); -skip_create_disk:memset (&dd->tags,0 ,sizeof (dd->tags)); dd->tags.ops = &mtip_mq_ops; dd->tags.nr_hw_queues =1 ;
@@ -3888,6 +3885,7 @@ skip_create_disk: dd->disk->queue = dd->queue; dd->queue->queuedata = dd; +skip_create_disk:/* Initialize the protocol layer. */ wait_for_rebuild =mtip_hw_get_identify (dd);if (wait_for_rebuild <0 ) {
@@ -4048,7 +4046,8 @@ static int mtip_block_remove(struct driv dd->bdev =NULL ; }if (dd->disk) { -del_gendisk (dd->disk); +if (test_bit (MTIP_DDF_INIT_DONE_BIT , &dd->dd_flag)) +del_gendisk (dd->disk);if (dd->disk->queue) {blk_cleanup_queue (dd->queue);blk_mq_free_tag_set (&dd->tags);
@@ -4089,7 +4088,8 @@ static int mtip_block_shutdown(struct drdev_info (&dd->pdev->dev,"Shutting down %s ...\n" , dd->disk->disk_name); -del_gendisk (dd->disk); +if (test_bit (MTIP_DDF_INIT_DONE_BIT , &dd->dd_flag)) +del_gendisk (dd->disk);if (dd->disk->queue) {blk_cleanup_queue (dd->queue);blk_mq_free_tag_set (&dd->tags);
Greg Kroah-Hartman
maintainerPATCH 108/210 mtip32xx: Handle safe removal during IO
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Asai Thambi SP <[email protected]>
commit 51c6570eb922146470c2fe660c34585414679bd6 upstream.
Flush inflight IOs using fsync_bdev() when the device is safely removed. Also, block further IOs in device open function.
--- drivers/block/mtip32xx/mtip32xx.c | 34 ++++++++++++++++++++++++++++++++-- drivers/block/mtip32xx/mtip32xx.h | 1 + 2 files changed, 33 insertions(+), 2 deletions(-)
drivers/block/mtip32xx/mtip32xx.c +32 -2
@@ -3602,6 +3602,28 @@ static int mtip_block_getgeo(struct blocreturn 0 ; } +static int mtip_block_open (struct block_device *dev,fmode_t mode) +{ +struct driver_data *dd; + +if (dev && dev->bd_disk) { + dd = (struct driver_data *) dev->bd_disk->private_data; + +if (dd) { +if (test_bit (MTIP_DDF_REMOVAL_BIT , + &dd->dd_flag)) { +return -ENODEV ; + } +return 0 ; + } + } +return -ENODEV ; +} + +void mtip_block_release (struct gendisk *disk,fmode_t mode) +{ +} +/* * Block device operation function. *
@@ -3609,6 +3631,8 @@ static int mtip_block_getgeo(struct bloc* layer. */ static const struct block_device_operations mtip_block_ops = { + .open = mtip_block_open, + .release = mtip_block_release, .ioctl = mtip_block_ioctl, #ifdef CONFIG_COMPAT .compat_ioctl = mtip_block_compat_ioctl,
@@ -4434,7 +4458,7 @@ static void mtip_pci_remove(struct pci_dstruct driver_data *dd =pci_get_drvdata (pdev);unsigned long flags, to; -set_bit (MTIP_DDF_REMOVE_PENDING_BIT , &dd->dd_flag); +set_bit (MTIP_DDF_REMOVAL_BIT , &dd->dd_flag);spin_lock_irqsave (&dev_lock, flags);list_del_init (&dd->online_list);
@@ -4451,12 +4475,18 @@ static void mtip_pci_remove(struct pci_d }while (atomic_read (&dd->irq_workers_active) !=0 &&time_before (jiffies, to)); +fsync_bdev (dd->bdev); +if (atomic_read (&dd->irq_workers_active) !=0 ) {dev_warn (&dd->pdev->dev,"Completion workers still active!\n" ); } -blk_mq_stop_hw_queues (dd->queue); +if (dd->sr) +blk_mq_stop_hw_queues (dd->queue); + +set_bit (MTIP_DDF_REMOVE_PENDING_BIT , &dd->dd_flag); +/* Clean up the block layer. */ mtip_block_remove (dd);
drivers/block/mtip32xx/mtip32xx.h +1 -0
@@ -158,6 +158,7 @@ enum {MTIP_DDF_RESUME_BIT =6 ,MTIP_DDF_INIT_DONE_BIT =7 ,MTIP_DDF_REBUILD_FAILED_BIT =8 , +MTIP_DDF_REMOVAL_BIT =9 , MTIP_DDF_STOP_IO = ((1 << MTIP_DDF_REMOVE_PENDING_BIT) | (1 << MTIP_DDF_SEC_LOCK_BIT) |
Greg Kroah-Hartman
maintainerPATCH 109/210 mtip32xx: Handle FTL rebuild failure state during device initialization
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Asai Thambi SP <[email protected]>
commit aae4a033868c496adae86fc6f9c3e0c405bbf360 upstream.
Allow device initialization to finish gracefully when it is in FTL rebuild failure state. Also, recover device out of this state after successfully secure erasing it.
--- drivers/block/mtip32xx/mtip32xx.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
drivers/block/mtip32xx/mtip32xx.c +6 -5
@@ -699,7 +699,7 @@ static void mtip_handle_tfe(struct drive fail_reason ="thermal shutdown" ; }if (buf[288 ] ==0xBF ) { -set_bit (MTIP_DDF_SEC_LOCK_BIT , &dd->dd_flag); +set_bit (MTIP_DDF_REBUILD_FAILED_BIT , &dd->dd_flag);dev_info (&dd->pdev->dev,"Drive indicates rebuild has failed. Secure erase required.\n" ); fail_all_ncq_cmds =1 ;
@@ -1000,6 +1000,7 @@ static bool mtip_pause_ncq(struct mtip_p (fis->features == 0x27 || fis->features == 0x72 || fis->features == 0x62 || fis->features == 0x26))) {clear_bit (MTIP_DDF_SEC_LOCK_BIT , &port->dd->dd_flag); +clear_bit (MTIP_DDF_REBUILD_FAILED_BIT , &port->dd->dd_flag);/* Com reset after secure erase or lowlevel format */ mtip_restart_port (port);clear_bit (MTIP_PF_SE_ACTIVE_BIT , &port->flags);
@@ -1166,6 +1167,7 @@ static int mtip_exec_internal_command(stif ((rv =wait_for_completion_interruptible_timeout ( &wait,msecs_to_jiffies (timeout))) <=0 ) { +if (rv == -ERESTARTSYS ) {/* interrupted */ dev_err(&dd->pdev->dev, "Internal command [%02X] was interrupted after %u ms\n",
@@ -3091,7 +3093,7 @@ static int mtip_hw_get_identify(struct dif (buf[288 ] ==0xBF ) {dev_info (&dd->pdev->dev,"Drive indicates rebuild has failed.\n" ); -/* TODO */ +set_bit (MTIP_DDF_REBUILD_FAILED_BIT , &dd->dd_flag); } }
@@ -3694,10 +3696,9 @@ static int mtip_submit_request(struct bl rq_data_dir(rq))) {return -ENODATA ; } -if (unlikely (test_bit (MTIP_DDF_SEC_LOCK_BIT , &dd->dd_flag))) +if (unlikely (test_bit (MTIP_DDF_SEC_LOCK_BIT , &dd->dd_flag) || +test_bit (MTIP_DDF_REBUILD_FAILED_BIT , &dd->dd_flag)))return -ENODATA ; -if (test_bit (MTIP_DDF_REBUILD_FAILED_BIT , &dd->dd_flag)) -return -ENXIO ; }if (rq->cmd_flags &REQ_DISCARD ) {
Greg Kroah-Hartman
maintainerPATCH 110/210 mtip32xx: Implement timeout handler
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Asai Thambi SP <[email protected]>
commit abb0ccd185c9e31847709b86192e6c815d1f57ad upstream.
Added timeout handler. Replaced blk_mq_end_request() with blk_mq_complete_request() to avoid double completion of a request.
--- drivers/block/mtip32xx/mtip32xx.c | 95 ++++++++++++++++++++++++++++++++++---- drivers/block/mtip32xx/mtip32xx.h | 7 ++ 2 files changed, 92 insertions(+), 10 deletions(-)
drivers/block/mtip32xx/mtip32xx.c +87 -8
@@ -233,15 +233,9 @@ static void mtip_async_complete(struct m "Command tag %d failed due to TFE\n", tag); } -/* Unmap the DMA scatter list entries */ -dma_unmap_sg (&dd->pdev->dev, cmd->sg, cmd->scatter_ents, cmd->direction); - rq =mtip_rq_from_tag (dd, tag); -if (unlikely (cmd->unaligned)) -up (&port->cmd_slot_unal); - -blk_mq_end_request (rq, status ? -EIO :0 ); +blk_mq_complete_request (rq, status); }/*
@@ -2896,6 +2890,42 @@ static int mtip_ftl_rebuild_poll(structreturn -EFAULT ; } +static void mtip_softirq_done_fn (struct request *rq) +{ +struct mtip_cmd *cmd =blk_mq_rq_to_pdu (rq); +struct driver_data *dd = rq->q->queuedata; + +/* Unmap the DMA scatter list entries */ +dma_unmap_sg (&dd->pdev->dev, cmd->sg, cmd->scatter_ents, + cmd->direction); + +if (unlikely (cmd->unaligned)) +up (&dd->port->cmd_slot_unal); + +blk_mq_end_request (rq, rq->errors); +} + +static void mtip_abort_cmd (struct request *req,void *data, +bool reserved) +{ +struct driver_data *dd = data; + +dbg_printk (MTIP_DRV_NAME " Aborting request, tag = %d\n" , req->tag); + +clear_bit (req->tag, dd->port->cmds_to_issue); + req->errors = -EIO ; +mtip_softirq_done_fn (req); +} + +static void mtip_queue_cmd (struct request *req,void *data, +bool reserved) +{ +struct driver_data *dd = data; + +set_bit (req->tag, dd->port->cmds_to_issue); +blk_abort_request (req); +} +/* * service thread to issue queued commands *
@@ -2908,7 +2938,7 @@ static int mtip_ftl_rebuild_poll(structstatic int mtip_service_thread (void *data) {struct driver_data *dd = (struct driver_data *)data; -unsigned long slot, slot_start, slot_wrap; +unsigned long slot, slot_start, slot_wrap, to;unsigned int num_cmd_slots = dd->slot_groups *32 ;struct mtip_port *port = dd->port;
@@ -2945,6 +2975,32 @@ restart_eh:if (test_bit (MTIP_PF_EH_ACTIVE_BIT , &port->flags)) goto restart_eh; +if (test_bit (MTIP_PF_TO_ACTIVE_BIT , &port->flags)) { + to = jiffies +msecs_to_jiffies (5000 ); + +do { +mdelay (100 ); + }while (atomic_read (&dd->irq_workers_active) !=0 && +time_before (jiffies, to)); + +if (atomic_read (&dd->irq_workers_active) !=0 ) +dev_warn (&dd->pdev->dev, +"Completion workers still active!" ); + +spin_lock (dd->queue->queue_lock); +blk_mq_all_tag_busy_iter (*dd->tags.tags, + mtip_queue_cmd, dd); +spin_unlock (dd->queue->queue_lock); + +set_bit (MTIP_PF_ISSUE_CMDS_BIT , &dd->port->flags); + +if (mtip_device_reset (dd)) +blk_mq_all_tag_busy_iter (*dd->tags.tags, + mtip_abort_cmd, dd); + +clear_bit (MTIP_PF_TO_ACTIVE_BIT , &dd->port->flags); + } +if (test_bit (MTIP_PF_ISSUE_CMDS_BIT , &port->flags)) { slot =1 ;/* used to restrict the loop to one iteration */
@@ -3810,11 +3866,33 @@ static int mtip_init_cmd(void *data, strreturn 0 ; } +static enum blk_eh_timer_return mtip_cmd_timeout (struct request *req, +bool reserved) +{ +struct driver_data *dd = req->q->queuedata; +int ret =BLK_EH_RESET_TIMER ; + +if (reserved) + goto exit_handler; + +if (test_bit (req->tag, dd->port->cmds_to_issue)) + goto exit_handler; + +if (test_and_set_bit (MTIP_PF_TO_ACTIVE_BIT , &dd->port->flags)) + goto exit_handler; + +wake_up_interruptible (&dd->port->svc_wait); +exit_handler: +return ret; +} +static struct blk_mq_ops mtip_mq_ops = { .queue_rq = mtip_queue_rq, .map_queue = blk_mq_map_queue, .init_request = mtip_init_cmd, .exit_request = mtip_free_cmd, + .complete = mtip_softirq_done_fn, + .timeout = mtip_cmd_timeout, };/*
@@ -3890,6 +3968,7 @@ static int mtip_block_initialize(struct dd->tags.numa_node = dd->numa_node; dd->tags.flags =BLK_MQ_F_SHOULD_MERGE ; dd->tags.driver_data = dd; + dd->tags.timeout =MTIP_NCQ_CMD_TIMEOUT_MS ; rv =blk_mq_alloc_tag_set (&dd->tags);if (rv) {
drivers/block/mtip32xx/mtip32xx.h +5 -2
@@ -134,10 +134,12 @@ enum {MTIP_PF_EH_ACTIVE_BIT =1 ,/* error handling */ MTIP_PF_SE_ACTIVE_BIT =2 ,/* secure erase */ MTIP_PF_DM_ACTIVE_BIT =3 ,/* download microcde */ +MTIP_PF_TO_ACTIVE_BIT =9 ,/* timeout handling */ MTIP_PF_PAUSE_IO = ((1 <<MTIP_PF_IC_ACTIVE_BIT ) | (1 <<MTIP_PF_EH_ACTIVE_BIT ) | (1 <<MTIP_PF_SE_ACTIVE_BIT ) | - (1 <<MTIP_PF_DM_ACTIVE_BIT )), + (1 <<MTIP_PF_DM_ACTIVE_BIT ) | + (1 <<MTIP_PF_TO_ACTIVE_BIT )),MTIP_PF_SVC_THD_ACTIVE_BIT =4 , MTIP_PF_ISSUE_CMDS_BIT = 5,
@@ -147,7 +149,8 @@ enum {MTIP_PF_SVC_THD_WORK = ((1 <<MTIP_PF_EH_ACTIVE_BIT ) | (1 <<MTIP_PF_ISSUE_CMDS_BIT ) | (1 <<MTIP_PF_REBUILD_BIT ) | - (1 <<MTIP_PF_SVC_THD_STOP_BIT )), + (1 <<MTIP_PF_SVC_THD_STOP_BIT ) | + (1 <<MTIP_PF_TO_ACTIVE_BIT )),/* below are bit numbers in 'dd_flag' defined in driver_data */ MTIP_DDF_SEC_LOCK_BIT = 0,
Greg Kroah-Hartman
maintainerPATCH 111/210 mtip32xx: Cleanup queued requests after surprise removal
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Asai Thambi SP <[email protected]>
commit 008e56d200225321371748d95908e6222436f06d upstream.
Fail all pending requests after surprise removal of a drive.
--- drivers/block/mtip32xx/mtip32xx.c | 78 +++++++++++++++++++++++++++++--------- 1 file changed, 60 insertions(+), 18 deletions(-)
drivers/block/mtip32xx/mtip32xx.c +60 -18
@@ -173,7 +173,13 @@ static struct mtip_cmd *mtip_get_int_com {struct request *rq; +if (mtip_check_surprise_removal (dd->pdev)) +return NULL ; + rq =blk_mq_alloc_request (dd->queue,0 , __GFP_RECLAIM, true); +if (IS_ERR (rq)) +return NULL ; +return blk_mq_rq_to_pdu (rq); }
@@ -575,6 +581,8 @@ static void mtip_completion(struct mtip_dev_warn (&port->dd->pdev->dev,"Internal command %d completed with TFE\n" , tag); + command->comp_func =NULL ; + command->comp_data =NULL ;complete (waiting); }
@@ -1009,12 +1017,14 @@ static bool mtip_pause_ncq(struct mtip_p* * @port Pointer to port data structure * @timeout Max duration to wait (ms) +* @atomic gfp_t flag to indicate blockable context or not * * return value * 0 Success * -EBUSY Commands still active */ -static int mtip_quiesce_io (struct mtip_port *port,unsigned long timeout) +static int mtip_quiesce_io (struct mtip_port *port,unsigned long timeout, +gfp_t atomic) {unsigned long to;unsigned int n;
@@ -1025,16 +1035,21 @@ static int mtip_quiesce_io(struct mtip_p to = jiffies +msecs_to_jiffies (timeout); do { if (test_bit(MTIP_PF_SVC_THD_ACTIVE_BIT, &port->flags) && - test_bit(MTIP_PF_ISSUE_CMDS_BIT, &port->flags)) { + test_bit(MTIP_PF_ISSUE_CMDS_BIT, &port->flags) && + atomic == GFP_KERNEL) { msleep(20); continue; /* svc thd is actively issuing commands */ } - msleep(100); + if (atomic == GFP_KERNEL) + msleep(100); + else { + cpu_relax(); + udelay(100); + } + if (mtip_check_surprise_removal(port->dd->pdev)) goto err_fault; - if (test_bit(MTIP_DDF_REMOVE_PENDING_BIT, &port->dd->dd_flag)) - goto err_fault; /* * Ignore s_active bit 0 of array element 0.
@@ -1096,6 +1111,10 @@ static int mtip_exec_internal_command(st } int_cmd =mtip_get_int_command (dd); +if (!int_cmd) { +dbg_printk (MTIP_DRV_NAME "Unable to allocate tag for PIO cmd\n" ); +return -EFAULT ; + }set_bit (MTIP_PF_IC_ACTIVE_BIT , &port->flags);
@@ -1108,7 +1127,7 @@ static int mtip_exec_internal_command(stif (fis->command !=ATA_CMD_STANDBYNOW1 ) {/* wait for io to complete if non atomic */ if (mtip_quiesce_io (port, -MTIP_QUIESCE_IO_TIMEOUT_MS ) <0 ) { +MTIP_QUIESCE_IO_TIMEOUT_MS , atomic) <0 ) {dev_warn (&dd->pdev->dev,"Failed to quiesce IO\n" );mtip_put_int_command (dd, int_cmd);
@@ -3354,10 +3373,6 @@ static int mtip_standby_drive(struct dri*/ static int mtip_hw_exit (struct driver_data *dd) { -/* -* Send standby immediate (E0h) to the drive so that it -* saves its state. -*/ if (!dd->sr) {/* de-initialize the port. */ mtip_deinit_port (dd->port);
@@ -3974,7 +3989,7 @@ static int mtip_block_initialize(structif (rv) {dev_err (&dd->pdev->dev,"Unable to allocate request queue\n" ); - goto block_queue_alloc_init_error; + goto block_queue_alloc_tag_error; }/* Allocate the request queue. */
@@ -4086,8 +4101,9 @@ kthread_run_error: read_capacity_error: init_hw_cmds_error:blk_cleanup_queue (dd->queue); -blk_mq_free_tag_set (&dd->tags); block_queue_alloc_init_error: +blk_mq_free_tag_set (&dd->tags); +block_queue_alloc_tag_error:mtip_hw_debugfs_exit (dd); disk_index_error:spin_lock (&rssd_index_lock);
@@ -4104,6 +4120,22 @@ protocol_init_error:return rv; } +static void mtip_no_dev_cleanup (struct request *rq,void *data,bool reserv) +{ +struct driver_data *dd = (struct driver_data *)data; +struct mtip_cmd *cmd; + +if (likely (!reserv)) +blk_mq_complete_request (rq, -ENODEV ); +else if (test_bit (MTIP_PF_IC_ACTIVE_BIT , &dd->port->flags)) { + + cmd =mtip_cmd_from_tag (dd,MTIP_TAG_INTERNAL ); +if (cmd->comp_func) + cmd->comp_func (dd->port,MTIP_TAG_INTERNAL , + cmd, -ENODEV ); + } +} +/* * Block layer deinitialization function. *
@@ -4135,12 +4167,23 @@ static int mtip_block_remove(struct driv } } -if (!dd->sr) -mtip_standby_drive (dd); +if (!dd->sr) { +/* +* Explicitly wait here for IOs to quiesce, +* as mtip_standby_drive usually won't wait for IOs. +*/ +if (!mtip_quiesce_io (dd->port,MTIP_QUIESCE_IO_TIMEOUT_MS , +GFP_KERNEL )) +mtip_standby_drive (dd); + }else dev_info (&dd->pdev->dev,"device %s surprise removal\n" , dd->disk->disk_name); +blk_mq_freeze_queue_start (dd->queue); +blk_mq_stop_hw_queues (dd->queue); +blk_mq_all_tag_busy_iter (dd->tags.tags[0 ], mtip_no_dev_cleanup, dd); +/* * Delete our gendisk structure. This also removes the device * from /dev
@@ -4555,16 +4598,15 @@ static void mtip_pci_remove(struct pci_d }while (atomic_read (&dd->irq_workers_active) !=0 &&time_before (jiffies, to)); -fsync_bdev (dd->bdev); +if (!dd->sr) +fsync_bdev (dd->bdev);if (atomic_read (&dd->irq_workers_active) !=0 ) {dev_warn (&dd->pdev->dev,"Completion workers still active!\n" ); } -if (dd->sr) -blk_mq_stop_hw_queues (dd->queue); - +blk_set_queue_dying (dd->queue);set_bit (MTIP_DDF_REMOVE_PENDING_BIT , &dd->dd_flag);/* Clean up the block layer. */
Greg Kroah-Hartman
maintainerPATCH 112/210 ALSA: hda - Apply reboot D3 fix for CX20724 codec, too
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 56dc66ff1c6d71f9a38c4a7c000b72b921fe4c89 upstream.
Just like CX20722, CX7024 codec also requires the power down at reboot in order to reduce the noise at reboot/shutdown.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=113511
--- sound/pci/hda/patch_conexant.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
sound/pci/hda/patch_conexant.c +6 -1
@@ -204,8 +204,13 @@ static void cx_auto_reboot_notify(struct {struct conexant_spec *spec = codec->spec; -if (codec->core.vendor_id !=0x14f150f2 ) +switch (codec->core.vendor_id) { +case 0x14f150f2 :/* CX20722 */ +case 0x14f150f4 :/* CX20724 */ +break ; +default :return ; + }/* Turn the CX20722 codec into D3 to avoid spurious noises from the internal speaker during (and after) reboot */
Greg Kroah-Hartman
maintainerPATCH 113/210 ALSA: pcm: Avoid "BUG:" string for warnings again
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 0ab1ace856205d10cbc1924b2d931c01ffd216a6 upstream.
The commit [d507941beb1e: ALSA: pcm: Correct PCM BUG error message] made the warning prefix back to "BUG:" due to its previous wrong prefix. But a kernel message containing "BUG:" seems taken as an Oops message wrongly by some brain-dead daemons, and it annoys users in the end. Instead of teaching daemons, change the string again to a more reasonable one.
--- sound/core/pcm_lib.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/core/pcm_lib.c +1 -1
@@ -322,7 +322,7 @@ static int snd_pcm_update_hw_ptr0(structchar name[16 ];snd_pcm_debug_name (substream, name,sizeof (name));pcm_err (substream->pcm, -"BUG: %s, pos = %ld, buffer size = %ld, period size = %ld\n" , +"invalid position: %s, pos = %ld, buffer size = %ld, period size = %ld\n" , name, pos, runtime->buffer_size, runtime->period_size); }
Greg Kroah-Hartman
maintainerPATCH 114/210 ALSA: intel8x0: Add clock quirk entry for AD1981B on IBM ThinkPad X41.
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vittorio Gambaletta (VittGam) <[email protected]>
commit 4061db03dd71d195b9973ee466f6ed32f6a3fc16 upstream.
The clock measurement on the AC'97 audio card found in the IBM ThinkPad X41 will often fail, so add a quirk entry to fix it.
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=441087
--- sound/pci/intel8x0.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/intel8x0.c +1 -0
@@ -2879,6 +2879,7 @@ static void intel8x0_measure_ac97_clock(static struct snd_pci_quirk intel8x0_clock_list[] = {SND_PCI_QUIRK (0x0e11 ,0x008a ,"AD1885" ,41000 ), +SND_PCI_QUIRK (0x1014 ,0x0581 ,"AD1981B" ,48000 ),SND_PCI_QUIRK (0x1028 ,0x00be ,"AD1885" ,44100 ),SND_PCI_QUIRK (0x1028 ,0x0177 ,"AD1980" ,48000 ),SND_PCI_QUIRK (0x1028 ,0x01ad ,"AD1981B" ,48000 ),
Greg Kroah-Hartman
maintainerPATCH 115/210 ALSA: hda - Dont handle ELD notify from invalid port
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 4f8e4f3537cafc4de128e6bfdf83baa78bc60eb1 upstream.
The current Intel HDMI codec driver supports only three fixed ports from port B to port D. However, i915 driver may assign a DP on other ports, e.g. port A, when no eDP is used. This incompatibility is caught later at pin_nid_to_pin_index() and results in a warning message like "HDMI: pin nid 4 not registered" at each time.
This patch filters out such invalid events beforehand, so that the kernel won't be too grumbling.
--- sound/pci/hda/patch_hdmi.c | 4 ++++ 1 file changed, 4 insertions(+)
sound/pci/hda/patch_hdmi.c +4 -0
@@ -2353,6 +2353,10 @@ static void intel_pin_eld_notify(void *astruct hda_codec *codec = audio_ptr;int pin_nid = port +0x04 ; +/* we assume only from port-B to port-D */ +if (port <1 || port >3 ) +return ; +/* skip notification during system suspend (but not in runtime PM); * the state will be updated at resume */
Greg Kroah-Hartman
maintainerPATCH 116/210 ALSA: hda - fix the mic mute button and led problem for a Lenovo AIO
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hui Wang <[email protected]>
commit 6ef2f68fa38bf415830f67903d87180d933e0f47 upstream.
This Lenovo ThinkCentre AIO also uses Line2 as mic mute button and uses GPIO2 to control the mic mute led, so applying this quirk can make both the button and led work.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -5529,6 +5529,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x17aa ,0x2226 ,"ThinkPad X250" ,ALC292_FIXUP_TPT440_DOCK ),SND_PCI_QUIRK (0x17aa ,0x2233 ,"Thinkpad" ,ALC293_FIXUP_LENOVO_SPK_NOISE ),SND_PCI_QUIRK (0x17aa ,0x30bb ,"ThinkCentre AIO" ,ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY ), +SND_PCI_QUIRK (0x17aa ,0x30e2 ,"ThinkCentre AIO" ,ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY ),SND_PCI_QUIRK (0x17aa ,0x3902 ,"Lenovo E50-80" ,ALC269_FIXUP_DMIC_THINKPAD_ACPI ),SND_PCI_QUIRK (0x17aa ,0x3977 ,"IdeaPad S210" ,ALC283_FIXUP_INT_MIC ), SND_PCI_QUIRK(0x17aa, 0x3978, "IdeaPad Y410P", ALC269_FIXUP_NO_SHUTUP),
Greg Kroah-Hartman
maintainerPATCH 117/210 ALSA: hda - Fix unconditional GPIO toggle via automute
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 1f7c6658962fa1260c1658d681bd6bb0c746b99a upstream.
Cirrus HD-audio driver may adjust GPIO pins for EAPD dynamically depending on the jack plug state. This works fine for the auto-mute
mode where the speaker gets muted upon the HP jack plug. OTOH, when
the auto-mute mode is off, this turns off the EAPD unexpectedly depending on the jack state, which results in the silent speaker output.
This patch fixes the silent speaker output issue by setting GPIO bits constantly when the auto-mute mode is off.
--- sound/pci/hda/patch_cirrus.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
sound/pci/hda/patch_cirrus.c +6 -2
@@ -174,8 +174,12 @@ static void cs_automute(struct hda_codecsnd_hda_gen_update_outputs (codec);if (spec->gpio_eapd_hp || spec->gpio_eapd_speaker) { - spec->gpio_data = spec->gen.hp_jack_present ? - spec->gpio_eapd_hp : spec->gpio_eapd_speaker; +if (spec->gen.automute_speaker) + spec->gpio_data = spec->gen.hp_jack_present ? + spec->gpio_eapd_hp : spec->gpio_eapd_speaker; +else + spec->gpio_data = + spec->gpio_eapd_hp | spec->gpio_eapd_speaker;snd_hda_codec_write (codec,0x01 ,0 ,AC_VERB_SET_GPIO_DATA , spec->gpio_data); }
Greg Kroah-Hartman
maintainerPATCH 118/210 tools/hv: Use include/uapi with __EXPORTED_HEADERS__
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kamal Mostafa <[email protected]>
commit 50fe6dd10069e7c062e27f29606f6e91ea979399 upstream.
Use the local uapi headers to keep in sync with "recently" added #define's (e.g. VSS_OP_REGISTER1).
--- tools/hv/Makefile | 2 ++ 1 file changed, 2 insertions(+)
tools/hv/Makefile +2 -0
@@ -5,6 +5,8 @@ PTHREAD_LIBS = -lpthread WARNINGS = -Wall -Wextra CFLAGS = $(WARNINGS) -g $(PTHREAD_LIBS) $(shell getconf LFS_CFLAGS) +CFLAGS += -D__EXPORTED_HEADERS__ -I../../include/uapi -I../../include + all: hv_kvp_daemon hv_vss_daemon hv_fcopy_daemon %: %.c $(CC) $(CFLAGS) -o $@ $^
Greg Kroah-Hartman
maintainerPATCH 119/210 jbd2: fix FS corruption possibility in jbd2_journal_destroy() on umount path
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: OGAWA Hirofumi <[email protected]>
commit c0a2ad9b50dd80eeccd73d9ff962234590d5ec93 upstream.
On umount path, jbd2_journal_destroy() writes latest transaction ID (->j_tail_sequence) to be used at next mount.
The bug is that ->j_tail_sequence is not holding latest transaction ID in some cases. So, at next mount, there is chance to conflict with remaining (not overwritten yet) transactions.
mount (id=10)
write transaction (id=11)
write transaction (id=12)
umount (id=10) <= the bug doesn't write latest ID
mount (id=10)
write transaction (id=11)
crash
mount
[recovery process]
transaction (id=11)
transaction (id=12) <= valid transaction ID, but old commit
must not replay
Like above, this bug become the cause of recovery failure, or FS corruption.
So why ->j_tail_sequence doesn't point latest ID?
Because if checkpoint transactions was reclaimed by memory pressure (i.e. bdev_try_to_free_page()), then ->j_tail_sequence is not updated. (And another case is, __jbd2_journal_clean_checkpoint_list() is called with empty transaction.)
So in above cases, ->j_tail_sequence is not pointing latest transaction ID at umount path. Plus, REQ_FLUSH for checkpoint is not done too.
So, to fix this problem with minimum changes, this patch updates ->j_tail_sequence, and issue REQ_FLUSH. (With more complex changes, some optimizations would be possible to avoid unnecessary REQ_FLUSH for example though.)
BTW,
journal->j_tail_sequence = ++journal->j_transaction_sequence;
Increment of ->j_transaction_sequence seems to be unnecessary, but ext3 does this.
--- fs/jbd2/journal.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-)
fs/jbd2/journal.c +12 -5
@@ -1408,11 +1408,12 @@ out:/** * jbd2_mark_journal_empty() - Mark on disk journal as empty. * @journal: The journal to update. +* @write_op: With which operation should we write the journal sb * * Update a journal's dynamic superblock fields to show that journal is empty. * Write updated superblock to disk waiting for IO to complete. */ -static void jbd2_mark_journal_empty (journal_t *journal) +static void jbd2_mark_journal_empty (journal_t *journal,int write_op) {journal_superblock_t *sb = journal->j_superblock;
@@ -1430,7 +1431,7 @@ static void jbd2_mark_journal_empty(jour sb->s_start =cpu_to_be32 (0 );read_unlock (&journal->j_state_lock); -jbd2_write_superblock (journal,WRITE_FUA ); +jbd2_write_superblock (journal, write_op);/* Log is no longer empty */ write_lock (&journal->j_state_lock);
@@ -1716,7 +1717,13 @@ int jbd2_journal_destroy(journal_t *jourif (journal->j_sb_buffer) {if (!is_journal_aborted (journal)) {mutex_lock (&journal->j_checkpoint_mutex); -jbd2_mark_journal_empty (journal); + +write_lock (&journal->j_state_lock); + journal->j_tail_sequence = + ++journal->j_transaction_sequence; +write_unlock (&journal->j_state_lock); + +jbd2_mark_journal_empty (journal,WRITE_FLUSH_FUA );mutex_unlock (&journal->j_checkpoint_mutex); }else err = -EIO ;
@@ -1975,7 +1982,7 @@ int jbd2_journal_flush(journal_t *journa* the magic code for a fully-recovered superblock. Any future * commits of data to the journal will restore the current * s_start value. */ -jbd2_mark_journal_empty (journal); +jbd2_mark_journal_empty (journal,WRITE_FUA );mutex_unlock (&journal->j_checkpoint_mutex);write_lock (&journal->j_state_lock);J_ASSERT (!journal->j_running_transaction);
@@ -2021,7 +2028,7 @@ int jbd2_journal_wipe(journal_t *journalif (write) {/* Lock to make assertions happy... */ mutex_lock (&journal->j_checkpoint_mutex); -jbd2_mark_journal_empty (journal); +jbd2_mark_journal_empty (journal,WRITE_FUA );mutex_unlock (&journal->j_checkpoint_mutex); }
Greg Kroah-Hartman
maintainerPATCH 120/210 brd: Fix discard request processing
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <[email protected]>
commit 5e4298be45e83ecdffaabb370eea9396889b07f1 upstream.
Avoid that discard requests with size => PAGE_SIZE fail with -EIO. Refuse discard requests if the discard size is not a multiple of the page size.
--- drivers/block/brd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/block/brd.c +1 -1
@@ -338,7 +338,7 @@ static blk_qc_t brd_make_request(structif (unlikely (bio->bi_rw &REQ_DISCARD )) {if (sector & ((PAGE_SIZE >>SECTOR_SHIFT ) -1 ) || - bio->bi_iter.bi_size &PAGE_MASK ) + bio->bi_iter.bi_size & ~PAGE_MASK ) goto io_error;discard_from_brd (brd, sector, bio->bi_iter.bi_size); goto out;
Greg Kroah-Hartman
maintainerPATCH 121/210 IB/srpt: Simplify srpt_handle_tsk_mgmt()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <[email protected]>
commit 51093254bf879bc9ce96590400a87897c7498463 upstream.
Let the target core check task existence instead of the SRP target driver. Additionally, let the target core check the validity of the task management request instead of the ib_srpt driver.
This patch fixes the following kernel crash:
BUG: unable to handle kernel NULL pointer dereference at 0000000000000001 IP: [<ffffffffa0565f37>] srpt_handle_new_iu+0x6d7/0x790 [ib_srpt] Oops: 0002 [#1] SMP Call Trace: [<ffffffffa05660ce>] srpt_process_completion+0xde/0x570 [ib_srpt] [<ffffffffa056669f>] srpt_compl_thread+0x13f/0x160 [ib_srpt] [<ffffffff8109726f>] kthread+0xcf/0xe0 [<ffffffff81613cfc>] ret_from_fork+0x7c/0xb0
--- drivers/infiniband/ulp/srpt/ib_srpt.c | 59 ---------------------------------- 1 file changed, 1 insertion(+), 58 deletions(-)
drivers/infiniband/ulp/srpt/ib_srpt.c +1 -58
@@ -1737,47 +1737,6 @@ send_sense:return -1 ; } -/** -* srpt_rx_mgmt_fn_tag() - Process a task management function by tag. -* @ch: RDMA channel of the task management request. -* @fn: Task management function to perform. -* @req_tag: Tag of the SRP task management request. -* @mgmt_ioctx: I/O context of the task management request. -* -* Returns zero if the target core will process the task management -* request asynchronously. -* -* Note: It is assumed that the initiator serializes tag-based task management -* requests. -*/ -static int srpt_rx_mgmt_fn_tag (struct srpt_send_ioctx *ioctx,u64 tag) -{ -struct srpt_device *sdev; -struct srpt_rdma_ch *ch; -struct srpt_send_ioctx *target; -int ret, i; - - ret = -EINVAL ; - ch = ioctx->ch; -BUG_ON (!ch); -BUG_ON (!ch->sport); - sdev = ch->sport->sdev; -BUG_ON (!sdev); -spin_lock_irq (&sdev->spinlock); -for (i =0 ; i < ch->rq_size; ++i) { - target = ch->ioctx_ring[i]; -if (target->cmd.se_lun == ioctx->cmd.se_lun && - target->cmd.tag == tag && -srpt_get_cmd_state (target) !=SRPT_STATE_DONE ) { - ret =0 ; -/* now let the target core abort &target->cmd; */ -break ; - } - } -spin_unlock_irq (&sdev->spinlock); -return ret; -} -static int srp_tmr_to_tcm (int fn) {switch (fn) {
@@ -1812,7 +1771,6 @@ static void srpt_handle_tsk_mgmt(structstruct se_cmd *cmd;struct se_session *sess = ch->sess;uint64_t unpacked_lun; -uint32_t tag =0 ;int tcm_tmr;int rc;
@@ -1828,25 +1786,10 @@ static void srpt_handle_tsk_mgmt(structsrpt_set_cmd_state (send_ioctx,SRPT_STATE_MGMT ); send_ioctx->cmd.tag = srp_tsk->tag; tcm_tmr =srp_tmr_to_tcm (srp_tsk->tsk_mgmt_func); -if (tcm_tmr <0 ) { - send_ioctx->cmd.se_tmr_req->response = -TMR_TASK_MGMT_FUNCTION_NOT_SUPPORTED ; - goto fail; - } unpacked_lun =srpt_unpack_lun ((uint8_t *)&srp_tsk->lun,sizeof (srp_tsk->lun)); - -if (srp_tsk->tsk_mgmt_func ==SRP_TSK_ABORT_TASK ) { - rc =srpt_rx_mgmt_fn_tag (send_ioctx, srp_tsk->task_tag); -if (rc <0 ) { - send_ioctx->cmd.se_tmr_req->response = -TMR_TASK_DOES_NOT_EXIST ; - goto fail; - } - tag = srp_tsk->task_tag; - } rc =target_submit_tmr (&send_ioctx->cmd, sess,NULL , unpacked_lun, - srp_tsk, tcm_tmr,GFP_KERNEL , tag, + srp_tsk, tcm_tmr,GFP_KERNEL , srp_tsk->task_tag,TARGET_SCF_ACK_KREF );if (rc !=0 ) { send_ioctx->cmd.se_tmr_req->response =TMR_FUNCTION_REJECTED ;
Greg Kroah-Hartman
maintainerPATCH 122/210 bcache: cleaned up error handling around register_cache()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Wheeler <[email protected]>
commit 9b299728ed777428b3908ac72ace5f8f84b97789 upstream.
Fix null pointer dereference by changing register_cache() to return an int instead of being void. This allows it to return -ENOMEM or -ENODEV and enables upper layers to handle the OOM case without NULL pointer issues.
See this thread:
http://thread.gmane.org/gmane.linux.kernel.bcache.devel/3521
Fixes this error:
gargamel:/sys/block/md5/bcache# echo /dev/sdh2 > /sys/fs/bcache/register
bcache: register_cache() error opening sdh2: cannot allocate memory
BUG: unable to handle kernel NULL pointer dereference at 00000000000009b8 IP: [<ffffffffc05a7e8d>] cache_set_flush+0x102/0x15c [bcache] PGD 120dff067 PUD 1119a3067 PMD 0 Oops: 0000 [#1] SMP Modules linked in: veth ip6table_filter ip6_tables (...) CPU: 4 PID: 3371 Comm: kworker/4:3 Not tainted 4.4.2-amd64-i915-volpreempt-20160213bc1 #3 Hardware name: System manufacturer System Product Name/P8H67-M PRO, BIOS 3904 04/27/2013 Workqueue: events cache_set_flush [bcache] task: ffff88020d5dc280 ti: ffff88020b6f8000 task.ti: ffff88020b6f8000 RIP: 0010:[<ffffffffc05a7e8d>] [<ffffffffc05a7e8d>] cache_set_flush+0x102/0x15c [bcache]
--- drivers/md/bcache/super.c | 34 ++++++++++++++++++++++------------ 1 file changed, 22 insertions(+), 12 deletions(-)
drivers/md/bcache/super.c +22 -12
@@ -1828,11 +1828,12 @@ static int cache_alloc(struct cache_sb *return 0 ; } -static void register_cache (struct cache_sb *sb,struct page *sb_page, +static int register_cache (struct cache_sb *sb,struct page *sb_page,struct block_device *bdev,struct cache *ca) {char name[BDEVNAME_SIZE ]; -const char *err ="cannot allocate memory" ; +const char *err =NULL ; +int ret =0 ;memcpy (&ca->sb, sb,sizeof (struct cache_sb )); ca->bdev = bdev;
@@ -1847,27 +1848,35 @@ static void register_cache(struct cache_if (blk_queue_discard (bdev_get_queue (ca->bdev))) ca->discard =CACHE_DISCARD (&ca->sb); -if (cache_alloc (sb, ca) !=0 ) + ret =cache_alloc (sb, ca); +if (ret !=0 ) goto err; - err ="error creating kobject" ; -if (kobject_add (&ca->kobj, &part_to_dev (bdev->bd_part)->kobj,"bcache" )) - goto err; +if (kobject_add (&ca->kobj, &part_to_dev (bdev->bd_part)->kobj,"bcache" )) { + err ="error calling kobject_add" ; + ret = -ENOMEM ; + goto out; + }mutex_lock (&bch_register_lock); err =register_cache_set (ca);mutex_unlock (&bch_register_lock); -if (err) - goto err; +if (err) { + ret = -ENODEV ; + goto out; + }pr_info ("registered cache device %s" ,bdevname (bdev, name)); + out:kobject_put (&ca->kobj); -return ; + err: -pr_notice ("error opening %s: %s" ,bdevname (bdev, name), err); - goto out; +if (err) +pr_notice ("error opening %s: %s" ,bdevname (bdev, name), err); + +return ret; }/* Global interfaces/init */
@@ -1965,7 +1974,8 @@ static ssize_t register_bcache(struct koif (!ca) goto err_close; -register_cache (sb, sb_page, bdev, ca); +if (register_cache (sb, sb_page, bdev, ca) !=0 ) + goto err_close; } out:if (sb_page)
Greg Kroah-Hartman
maintainerPATCH 123/210 bcache: fix race of writeback thread starting before complete initialization
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Wheeler <[email protected]>
commit 07cc6ef8edc47f8b4fc1e276d31127a0a5863d4d upstream.
The bch_writeback_thread might BUG_ON in read_dirty() if dc->sb==BDEV_STATE_DIRTY and bch_sectors_dirty_init has not yet completed its related initialization. This patch downs the dc->writeback_lock until after initialization is complete, thus preventing bch_writeback_thread from proceeding prematurely.
See this thread:
http://thread.gmane.org/gmane.linux.kernel.bcache.devel/3453
--- drivers/md/bcache/super.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/md/bcache/super.c +8 -1
@@ -1015,8 +1015,12 @@ int bch_cached_dev_attach(struct cached_*/ atomic_set (&dc->count,1 ); -if (bch_cached_dev_writeback_start (dc)) +/* Block writeback thread, but spawn it */ +down_write (&dc->writeback_lock); +if (bch_cached_dev_writeback_start (dc)) { +up_write (&dc->writeback_lock);return -ENOMEM ; + }if (BDEV_STATE (&dc->sb) ==BDEV_STATE_DIRTY ) {bch_sectors_dirty_init (dc);
@@ -1028,6 +1032,9 @@ int bch_cached_dev_attach(struct cached_bch_cached_dev_run (dc);bcache_device_link (&dc->disk, c,"bdev" ); +/* Allow the writeback thread to proceed */ +up_write (&dc->writeback_lock); +pr_info ("Caching %s as %s on set %pU" ,bdevname (dc->bdev, buf), dc->disk.disk->disk_name, dc->disk.c->sb.set_uuid);
Greg Kroah-Hartman
maintainerPATCH 124/210 bcache: fix cache_set_flush() NULL pointer dereference on OOM
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Wheeler <[email protected]>
commit f8b11260a445169989d01df75d35af0f56178f95 upstream.
When bch_cache_set_alloc() fails to kzalloc the cache_set, the asyncronous closure handling tries to dereference a cache_set that hadn't yet been allocated inside of cache_set_flush() which is called by __cache_set_unregister() during cleanup. This appears to happen only during an OOM condition on bcache_register.
--- drivers/md/bcache/super.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/md/bcache/super.c +3 -0
@@ -1373,6 +1373,9 @@ static void cache_set_flush(struct closustruct btree *b;unsigned i; +if (!c) +closure_return (cl); +bch_cache_accounting_destroy (&c->accounting);kobject_put (&c->internal);
Greg Kroah-Hartman
maintainerPATCH 125/210 mm: memcontrol: reclaim when shrinking memory.high below usage
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Weiner <[email protected]>
commit 588083bb37a3cea8533c392370a554417c8f29cb upstream.
When setting memory.high below usage, nothing happens until the next charge comes along, and then it will only reclaim its own charge and not the now potentially huge excess of the new memory.high. This can cause groups to stay in excess of their memory.high indefinitely.
To fix that, when shrinking memory.high, kick off a reclaim cycle that goes after the delta.
--- mm/memcontrol.c | 6 ++++++ 1 file changed, 6 insertions(+)
mm/memcontrol.c +6 -0
@@ -5121,6 +5121,7 @@ static ssize_t memory_high_write(struct char *buf, size_t nbytes, loff_t off) {struct mem_cgroup *memcg =mem_cgroup_from_css (of_css (of)); +unsigned long nr_pages;unsigned long high;int err;
@@ -5131,6 +5132,11 @@ static ssize_t memory_high_write(struct memcg->high = high; + nr_pages =page_counter_read (&memcg->memory); +if (nr_pages > high) +try_to_free_mem_cgroup_pages (memcg, nr_pages - high, +GFP_KERNEL , true); +memcg_wb_domain_size_changed (memcg);return nbytes; }
Greg Kroah-Hartman
maintainerPATCH 126/210 mm: memcontrol: reclaim and OOM kill when shrinking memory.max below usage
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Weiner <[email protected]>
commit b6e6edcfa40561e9c8abe5eecf1c96f8e5fd9c6f upstream.
Setting the original memory.limit_in_bytes hardlimit is subject to a race condition when the desired value is below the current usage. The code tries a few times to first reclaim and then see if the usage has dropped to where we would like it to be, but there is no locking, and the workload is free to continue making new charges up to the old limit. Thus, attempting to shrink a workload relies on pure luck and hope that the workload happens to cooperate.
To fix this in the cgroup2 memory.max knob, do it the other way round:
set the limit first, then try enforcement. And if reclaim is not able to succeed, trigger OOM kills in the group. Keep going until the new limit is met, we run out of OOM victims and there's only unreclaimable memory left, or the task writing to memory.max is killed. This allows users to shrink groups reliably, and the behavior is consistent with what happens when new charges are attempted in excess of memory.max.
--- mm/memcontrol.c | 38 ++++++++++++++++++++++++++++++++++---- 1 file changed, 34 insertions(+), 4 deletions(-)
mm/memcontrol.c +34 -4
@@ -1332,7 +1332,7 @@ static unsigned long mem_cgroup_get_limireturn limit; } -static void mem_cgroup_out_of_memory (struct mem_cgroup *memcg,gfp_t gfp_mask, +static bool mem_cgroup_out_of_memory (struct mem_cgroup *memcg,gfp_t gfp_mask,int order) {struct oom_control oc = {
@@ -1410,6 +1410,7 @@ static void mem_cgroup_out_of_memory(str } unlock:mutex_unlock (&oom_lock); +return chosen; }#if MAX_NUMNODES >1
@@ -5158,6 +5159,8 @@ static ssize_t memory_max_write(struct k char *buf, size_t nbytes, loff_t off) {struct mem_cgroup *memcg =mem_cgroup_from_css (of_css (of)); +unsigned int nr_reclaims =MEM_CGROUP_RECLAIM_RETRIES ; +bool drained = false;unsigned long max;int err;
@@ -5166,9 +5169,36 @@ static ssize_t memory_max_write(struct kif (err)return err; - err =mem_cgroup_resize_limit (memcg, max); -if (err) -return err; +xchg (&memcg->memory.limit, max); + +for (;;) { +unsigned long nr_pages =page_counter_read (&memcg->memory); + +if (nr_pages <= max) +break ; + +if (signal_pending (current)) { + err = -EINTR ; +break ; + } + +if (!drained) { +drain_all_stock (memcg); + drained = true; +continue ; + } + +if (nr_reclaims) { +if (!try_to_free_mem_cgroup_pages (memcg, nr_pages - max, +GFP_KERNEL , true)) + nr_reclaims--; +continue ; + } + +mem_cgroup_events (memcg,MEMCG_OOM ,1 ); +if (!mem_cgroup_out_of_memory (memcg,GFP_KERNEL ,0 )) +break ; + }memcg_wb_domain_size_changed (memcg);return nbytes;
Greg Kroah-Hartman
maintainerPATCH 127/210 ia64: define ioremap_uc()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luis R. Rodriguez <[email protected]>
commit b0f84ac352762ed02d7ea9f284942a8cab7f9077 upstream.
All architectures now need ioremap_uc(), ia64 seems defines this already through its ioremap_nocache() and it already ensures it *only* uses UC.
This is needed since v4.3 to complete an allyesconfig compile on ia64, there were others archs that needed this, and this one seems to have fallen through the cracks.
--- arch/ia64/include/asm/io.h | 1 + 1 file changed, 1 insertion(+)
arch/ia64/include/asm/io.h +1 -0
@@ -436,6 +436,7 @@ static inline void __iomem * ioremap_cacreturn ioremap (phys_addr, size); }#define ioremap_cache ioremap_cache +#define ioremap_uc ioremap_nocache/*
Greg Kroah-Hartman
maintainerPATCH 128/210 watchdog: dont run proc_watchdog_update if new value is same as old
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joshua Hunt <[email protected]>
commit a1ee1932aa6bea0bb074f5e3ced112664e4637ed upstream.
While working on a script to restore all sysctl params before a series of tests I found that writing any value into the /proc/sys/kernel/{nmi_watchdog,soft_watchdog,watchdog,watchdog_thresh} causes them to call proc_watchdog_update().
NMI watchdog: enabled on all CPUs, permanently consumes one hw-PMU counter. NMI watchdog: enabled on all CPUs, permanently consumes one hw-PMU counter. NMI watchdog: enabled on all CPUs, permanently consumes one hw-PMU counter. NMI watchdog: enabled on all CPUs, permanently consumes one hw-PMU counter.
There doesn't appear to be a reason for doing this work every time a write occurs, so only do it when the values change.
--- kernel/watchdog.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
kernel/watchdog.c +8 -1
@@ -907,6 +907,9 @@ static int proc_watchdog_common(int whic* both lockup detectors are disabled if proc_watchdog_update() * returns an error. */ +if (old == new) + goto out; + err =proc_watchdog_update (); } out:
@@ -951,7 +954,7 @@ int proc_soft_watchdog(struct ctl_tableint proc_watchdog_thresh (struct ctl_table *table,int write,void __user *buffer,size_t *lenp,loff_t *ppos) { -int err, old; +int err, old, new;get_online_cpus ();mutex_lock (&watchdog_proc_mutex);
@@ -971,6 +974,10 @@ int proc_watchdog_thresh(struct ctl_tabl/* * Update the sample period. Restore on failure. */ + new =ACCESS_ONCE (watchdog_thresh); +if (old == new) + goto out; +set_sample_period (); err =proc_watchdog_update ();if (err) {
Greg Kroah-Hartman
maintainerPATCH 129/210 watchdog: rc32434_wdt: fix ioctl error handling
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael S. Tsirkin <[email protected]>
commit 10e7ac22cdd4d211cef99afcb9371b70cb175be6 upstream.
Calling return copy_to_user(...) in an ioctl will not do the right thing if there's a pagefault: copy_to_user returns the number of bytes not copied in this case.
Fix up watchdog/rc32434_wdt to do
return copy_to_user(...)) ? -EFAULT : 0;
instead.
--- drivers/watchdog/rc32434_wdt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/watchdog/rc32434_wdt.c +1 -1
@@ -237,7 +237,7 @@ static long rc32434_wdt_ioctl(struct filreturn -EINVAL ;/* Fall through */ case WDIOC_GETTIMEOUT : -return copy_to_user (argp, &timeout,sizeof (int )); +return copy_to_user (argp, &timeout,sizeof (int )) ? -EFAULT :0 ;default :return -ENOTTY ; }
Greg Kroah-Hartman
maintainerPATCH 130/210 Bluetooth: Add new AR3012 ID 0489:e095
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Tunin <[email protected]>
commit 28c971d82fb58ef7cba22e5308be6d2d2590473d upstream.
T: Bus=01 Lev=01 Prnt=01 Port=04 Cnt=02 Dev#= 3 Spd=12 MxCh= 0
D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=0489 ProdID=e095 Rev=00.01
C: #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
I: If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
I: If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
This device requires ar3k/AthrBT_0x31010100.dfu and ar3k/ramps_0x31010100_40.dfu firmware files that are not in linux-firmware yet.
--- drivers/bluetooth/ath3k.c | 2 ++ drivers/bluetooth/btusb.c | 1 + 2 files changed, 3 insertions(+)
drivers/bluetooth/ath3k.c +2 -0
@@ -82,6 +82,7 @@ static const struct usb_device_id ath3k_ { USB_DEVICE(0x0489, 0xe05f) }, { USB_DEVICE(0x0489, 0xe076) }, { USB_DEVICE(0x0489, 0xe078) }, + { USB_DEVICE(0x0489, 0xe095) }, { USB_DEVICE(0x04c5, 0x1330) }, { USB_DEVICE(0x04CA, 0x3004) }, { USB_DEVICE(0x04CA, 0x3005) },
@@ -147,6 +148,7 @@ static const struct usb_device_id ath3k_ { USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0489, 0xe076), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0489, 0xe095), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
drivers/bluetooth/btusb.c +1 -0
@@ -196,6 +196,7 @@ static const struct usb_device_id blackl { USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0489, 0xe076), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0489, 0xe095), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
Greg Kroah-Hartman
maintainerPATCH 131/210 Bluetooth: Fix potential buffer overflow with Add Advertising
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hedberg <[email protected]>
commit 6a0e78072c2ae7b20b14e0249d8108441ea928d2 upstream.
The Add Advertising command handler does the appropriate checks for the AD and Scan Response data, however fails to take into account the general length of the mgmt command itself, which could lead to potential buffer overflows. This patch adds the necessary check that the mgmt command length is consistent with the given ad and scan_rsp lengths.
--- net/bluetooth/mgmt.c | 4 ++++ 1 file changed, 4 insertions(+)
net/bluetooth/mgmt.c +4 -0
@@ -7155,6 +7155,10 @@ static int add_advertising(struct sock *return mgmt_cmd_status (sk, hdev->id,MGMT_OP_ADD_ADVERTISING , status); +if (data_len !=sizeof (*cp) + cp->adv_data_len + cp->scan_rsp_len) +return mgmt_cmd_status (sk, hdev->id,MGMT_OP_ADD_ADVERTISING , +MGMT_STATUS_INVALID_PARAMS ); + flags =__le32_to_cpu (cp->flags); timeout =__le16_to_cpu (cp->timeout); duration =__le16_to_cpu (cp->duration);
Greg Kroah-Hartman
maintainerPATCH 132/210 cgroup: ignore css_sets associated with dead cgroups during migration
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <[email protected]>
commit 2b021cbf3cb6208f0d40fd2f1869f237934340ed upstream.
Before 2e91fa7f6d45 ("cgroup: keep zombies associated with their original cgroups"), all dead tasks were associated with init_css_set. If a zombie task is requested for migration, while migration prep operations would still be performed on init_css_set, the actual migration would ignore zombie tasks. As init_css_set is always valid, this worked fine.
However, after 2e91fa7f6d45, zombie tasks stay with the css_set it was associated with at the time of death. Let's say a task T associated with cgroup A on hierarchy H-1 and cgroup B on hiearchy H-2. After T becomes a zombie, it would still remain associated with A and B. If A only contains zombie tasks, it can be removed. On removal, A gets marked offline but stays pinned until all zombies are drained. At this point, if migration is initiated on T to a cgroup C on hierarchy H-2, migration path would try to prepare T's css_set for migration and trigger the following.
WARNING: CPU: 0 PID: 1576 at kernel/cgroup.c:474 cgroup_get+0x121/0x160() CPU: 0 PID: 1576 Comm: bash Not tainted 4.4.0-work+ #289 ... Call Trace: [<ffffffff8127e63c>] dump_stack+0x4e/0x82 [<ffffffff810445e8>] warn_slowpath_common+0x78/0xb0 [<ffffffff810446d5>] warn_slowpath_null+0x15/0x20 [<ffffffff810c33e1>] cgroup_get+0x121/0x160 [<ffffffff810c349b>] link_css_set+0x7b/0x90 [<ffffffff810c4fbc>] find_css_set+0x3bc/0x5e0 [<ffffffff810c5269>] cgroup_migrate_prepare_dst+0x89/0x1f0 [<ffffffff810c7547>] cgroup_attach_task+0x157/0x230 [<ffffffff810c7a17>] __cgroup_procs_write+0x2b7/0x470 [<ffffffff810c7bdc>] cgroup_tasks_write+0xc/0x10 [<ffffffff810c4790>] cgroup_file_write+0x30/0x1b0 [<ffffffff811c68fc>] kernfs_fop_write+0x13c/0x180 [<ffffffff81151673>] __vfs_write+0x23/0xe0 [<ffffffff81152494>] vfs_write+0xa4/0x1a0 [<ffffffff811532d4>] SyS_write+0x44/0xa0 [<ffffffff814af2d7>] entry_SYSCALL_64_fastpath+0x12/0x6f
It doesn't make sense to prepare migration for css_sets pointing to dead cgroups as they are guaranteed to contain only zombies which are ignored later during migration. This patch makes cgroup destruction path mark all affected css_sets as dead and updates the migration path to ignore them during preparation.
--- include/linux/cgroup-defs.h | 3 +++ kernel/cgroup.c | 20 ++++++++++++++++++-- 2 files changed, 21 insertions(+), 2 deletions(-)
include/linux/cgroup-defs.h +3 -0
@@ -216,6 +216,9 @@ struct css_set {/* all css_task_iters currently walking this cset */ struct list_head task_iters; +/* dead and being drained, ignore for migration */ +bool dead; +/* For RCU-protected deletion */ struct rcu_head rcu_head; };
kernel/cgroup.c +18 -2
@@ -2498,6 +2498,14 @@ static void cgroup_migrate_add_src(struclockdep_assert_held (&cgroup_mutex);lockdep_assert_held (&css_set_lock); +/* +* If ->dead, @src_set is associated with one or more dead cgroups +* and doesn't contain any migratable tasks. Ignore it early so +* that the rest of migration path doesn't get confused by it. +*/ +if (src_cset->dead) +return ; + src_cgrp =cset_cgroup_from_root (src_cset, dst_cgrp->root);if (!list_empty (&src_cset->mg_preload_node))
@@ -5131,6 +5139,7 @@ static int cgroup_destroy_locked(struct __releases(&cgroup_mutex) __acquires(&cgroup_mutex) {struct cgroup_subsys_state *css; +struct cgrp_cset_link *link;int ssid;lockdep_assert_held (&cgroup_mutex);
@@ -5151,11 +5160,18 @@ static int cgroup_destroy_locked(structreturn -EBUSY ;/* -* Mark @cgrp dead. This prevents further task migration and child -* creation by disabling cgroup_lock_live_group(). +* Mark @cgrp and the associated csets dead. The former prevents +* further task migration and child creation by disabling +* cgroup_lock_live_group(). The latter makes the csets ignored by +* the migration path. */ cgrp->self.flags &= ~CSS_ONLINE ; +spin_lock_bh (&css_set_lock); +list_for_each_entry (link, &cgrp->cset_links, cset_link) + link->cset->dead = true; +spin_unlock_bh (&css_set_lock); +/* initiate massacre of all css's */ for_each_css (css, ssid, cgrp)kill_css (css);
Greg Kroah-Hartman
maintainerPATCH 133/210 net: mvneta: enable change MAC address when interface is up
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitri Epshtein <[email protected]>
commit 928b6519afeb2a5e2dc61154380b545ed66c476a upstream.
Function eth_prepare_mac_addr_change() is called as part of MAC address change. This function check if interface is running. To enable change MAC address when interface is running:IFF_LIVE_ADDR_CHANGE flag must be set to dev->priv_flags field
network unit")
--- drivers/net/ethernet/marvell/mvneta.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/marvell/mvneta.c +1 -1
@@ -3404,7 +3404,7 @@ static int mvneta_probe(struct platform_ dev->features =NETIF_F_SG |NETIF_F_IP_CSUM |NETIF_F_TSO ; dev->hw_features |= dev->features; dev->vlan_features |= dev->features; - dev->priv_flags |=IFF_UNICAST_FLT ; + dev->priv_flags |=IFF_UNICAST_FLT |IFF_LIVE_ADDR_CHANGE ; dev->gso_max_segs =MVNETA_MAX_TSO_SEGS ; err =register_netdev (dev);
Greg Kroah-Hartman
maintainerPATCH 134/210 of: alloc anywhere from memblock if range not specified
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vinayak Menon <[email protected]>
commit e53b50c0cbe392c946807abf7d07615a3c588642 upstream.
early_init_dt_alloc_reserved_memory_arch passes end as 0 to __memblock_alloc_base, when limits are not specified. But __memblock_alloc_base takes end value of 0 as MEMBLOCK_ALLOC_ACCESSIBLE and limits the end to memblock.current_limit. This results in regions never being placed in HIGHMEM area, for e.g. CMA.
Let __memblock_alloc_base allocate from anywhere in memory if limits are not specified.
--- drivers/of/of_reserved_mem.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/of/of_reserved_mem.c +3 -1
@@ -32,11 +32,13 @@ int __init __weak early_init_dt_alloc_re phys_addr_t align, phys_addr_t start, phys_addr_t end, bool nomap, phys_addr_t *res_base) { + phys_addr_t base;/* * We use __memblock_alloc_base() because memblock_alloc_base() * panic()s on allocation failure. */ - phys_addr_t base = __memblock_alloc_base(size, align, end); + end = !end ?MEMBLOCK_ALLOC_ANYWHERE : end; + base =__memblock_alloc_base (size, align, end);if (!base)return -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 135/210 vfs: show_vfsstat: do not ignore errors from show_devname method
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry V. Levin <[email protected]>
commit 5f8d498d4364f544fee17125787a47553db02afa upstream.
Explicitly check show_devname method return code and bail out in case of an error. This fixes regression introduced by commit 9d4d65748a5c.
--- fs/proc_namespace.c | 2 ++ 1 file changed, 2 insertions(+)
fs/proc_namespace.c +2 -0
@@ -197,6 +197,8 @@ static int show_vfsstat(struct seq_fileif (sb->s_op->show_devname) {seq_puts (m,"device " ); err = sb->s_op->show_devname (m, mnt_path.dentry); +if (err) + goto out; }else {if (r->mnt_devname) {seq_puts (m,"device " );
Greg Kroah-Hartman
maintainerPATCH 136/210 splice: handle zero nr_pages in splice_to_pipe()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rabin Vincent <[email protected]>
commit d6785d9152147596f60234157da2b02540c3e60f upstream.
Running the following command:
busybox cat /sys/kernel/debug/tracing/trace_pipe > /dev/null
with any tracing enabled pretty very quickly leads to various NULL pointer dereferences and VM BUG_ON()s, such as these:
BUG: unable to handle kernel NULL pointer dereference at 0000000000000020 IP: [<ffffffff8119df6c>] generic_pipe_buf_release+0xc/0x40 Call Trace: [<ffffffff811c48a3>] splice_direct_to_actor+0x143/0x1e0 [<ffffffff811c42e0>] ? generic_pipe_buf_nosteal+0x10/0x10 [<ffffffff811c49cf>] do_splice_direct+0x8f/0xb0 [<ffffffff81196869>] do_sendfile+0x199/0x380 [<ffffffff81197600>] SyS_sendfile64+0x90/0xa0 [<ffffffff8192cbee>] entry_SYSCALL_64_fastpath+0x12/0x6d page dumped because: VM_BUG_ON_PAGE(atomic_read(&page->_count) == 0) kernel BUG at include/linux/mm.h:367! invalid opcode: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC RIP: [<ffffffff8119df9c>] generic_pipe_buf_release+0x3c/0x40 Call Trace: [<ffffffff811c48a3>] splice_direct_to_actor+0x143/0x1e0 [<ffffffff811c42e0>] ? generic_pipe_buf_nosteal+0x10/0x10 [<ffffffff811c49cf>] do_splice_direct+0x8f/0xb0 [<ffffffff81196869>] do_sendfile+0x199/0x380 [<ffffffff81197600>] SyS_sendfile64+0x90/0xa0 [<ffffffff8192cd1e>] tracesys_phase2+0x84/0x89
(busybox's cat uses sendfile(2), unlike the coreutils version)
This is because tracing_splice_read_pipe() can call splice_to_pipe() with spd->nr_pages == 0. spd_pages underflows in splice_to_pipe() and we fill the page pointers and the other fields of the pipe_buffers with garbage.
All other callers of splice_to_pipe() avoid calling it when nr_pages == 0, and we could make tracing_splice_read_pipe() do that too, but it seems reasonable to have splice_to_page() handle this condition gracefully.
--- fs/splice.c | 3 +++ 1 file changed, 3 insertions(+)
fs/splice.c +3 -0
@@ -185,6 +185,9 @@ ssize_t splice_to_pipe(struct pipe_inodeunsigned int spd_pages = spd->nr_pages;int ret, do_wakeup, page_nr; +if (!spd_pages) +return 0 ; + ret =0 ; do_wakeup =0 ; page_nr =0 ;
Greg Kroah-Hartman
maintainerPATCH 137/210 xtensa: ISS: dont hang if stdin EOF is reached
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Filippov <[email protected]>
commit 362014c8d9d51d504c167c44ac280169457732be upstream.
Simulator stdin may be connected to a file, when its end is reached kernel hangs in infinite loop inside rs_poll, because simc_poll always signals that descriptor 0 is readable and simc_read always returns 0. Check simc_read return value and exit loop if it's not positive. Also don't rewind polling timer if it's zero.
--- arch/xtensa/platforms/iss/console.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
arch/xtensa/platforms/iss/console.c +6 -4
@@ -100,21 +100,23 @@ static void rs_poll(unsigned long priv) {struct tty_port *port = (struct tty_port *)priv;int i =0 ; +int rd =1 ;unsigned char c;spin_lock (&timer_lock);while (simc_poll (0 )) { -simc_read (0 , &c,1 ); + rd =simc_read (0 , &c,1 ); +if (rd <=0 ) +break ;tty_insert_flip_char (port, c,TTY_NORMAL ); i++; }if (i)tty_flip_buffer_push (port); - - -mod_timer (&serial_timer, jiffies +SERIAL_TIMER_VALUE ); +if (rd) +mod_timer (&serial_timer, jiffies +SERIAL_TIMER_VALUE );spin_unlock (&timer_lock); }
Greg Kroah-Hartman
maintainerPATCH 138/210 xtensa: fix preemption in {clear,copy}_user_highpage
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Filippov <[email protected]>
commit a67cc9aa2dfc6e66addf240bbd79e16e01565e81 upstream.
Disabling pagefault makes little sense there, preemption disabling is what was meant.
--- arch/xtensa/mm/cache.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/xtensa/mm/cache.c +4 -4
@@ -97,11 +97,11 @@ void clear_user_highpage(struct page *paunsigned long paddr;void *kvaddr =coherent_kvaddr (page,TLBTEMP_BASE_1 , vaddr, &paddr); -pagefault_disable (); +preempt_disable ();kmap_invalidate_coherent (page, vaddr);set_bit (PG_arch_1, &page->flags);clear_page_alias (kvaddr, paddr); -pagefault_enable (); +preempt_enable (); } void copy_user_highpage(struct page *dst, struct page *src,
@@ -113,11 +113,11 @@ void copy_user_highpage(struct page *dstvoid *src_vaddr =coherent_kvaddr (src,TLBTEMP_BASE_2 , vaddr, &src_paddr); -pagefault_disable (); +preempt_disable ();kmap_invalidate_coherent (dst, vaddr);set_bit (PG_arch_1, &dst->flags);copy_page_alias (dst_vaddr, src_vaddr, dst_paddr, src_paddr); - pagefault_enable(); + preempt_enable(); }#endif /* DCACHE_WAY_SIZE > PAGE_SIZE */
Greg Kroah-Hartman
maintainerPATCH 139/210 xtensa: clear all DBREAKC registers on start
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Filippov <[email protected]>
commit 7de7ac785ae18a2cdc78d7560f48e3213d9ea0ab upstream.
There are XCHAL_NUM_DBREAK registers, clear them all.
This also fixes cryptic assembler error message with binutils 2.25 when XCHAL_NUM_DBREAK is 0:
as: out of memory allocating 18446744073709551575 bytes after a total of 495616 bytes
--- arch/xtensa/kernel/head.S | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/xtensa/kernel/head.S +1 -1
@@ -128,7 +128,7 @@ ENTRY(_startup) wsr a0, icountlevel .set _index, 0 - .rept XCHAL_NUM_DBREAK - 1 + .rept XCHAL_NUM_DBREAK wsr a0, SREG_DBREAKC + _index .set _index, _index + 1 .endr
Greg Kroah-Hartman
maintainerPATCH 140/210 ARC: [BE] readl()/writel() to work in Big Endian CPU configuration
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lada Trimasova <[email protected]>
commit f778cc65717687a3d3f26dd21bef62cd059f1b8b upstream.
read{l,w}() write{l,w}() primitives should use le{16,32}_to_cpu() and cpu_to_le{16,32}() respectively to ensure device registers are read correctly in Big Endian CPU configuration.
Per Arnd Bergmann
| Most drivers using readl() or readl_relaxed() expect those to perform byte | swaps on big-endian architectures, as the registers tend to be fixed endian
This was needed for getting UART to work correctly on a Big Endian ARC.
The ARC accessors originally were fine, and the bug got introduced inadventently by commit b8a033023994 ("ARCv2: barriers")
--- arch/arc/include/asm/io.h | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-)
arch/arc/include/asm/io.h +13 -5
@@ -129,15 +129,23 @@ static inline void __raw_writel(u32 w, v#define writel (v,c) ({ __iowmb(); writel_relaxed(v,c); })/* -* Relaxed API for drivers which can handle any ordering themselves +* Relaxed API for drivers which can handle barrier ordering themselves +* +* Also these are defined to perform little endian accesses. +* To provide the typical device register semantics of fixed endian, +* swap the byte order for Big Endian +* +* http://lkml.kernel.org/r/[email protected] */ #define readb_relaxed (c) __raw_readb(c) -#define readw_relaxed (c) __raw_readw(c) -#define readl_relaxed (c) __raw_readl(c) +#define readw_relaxed (c) ({ u16 __r = le16_to_cpu((__force __le16) \ + __raw_readw(c)); __r; }) +#define readl_relaxed (c) ({ u32 __r = le32_to_cpu((__force __le32) \ + __raw_readl(c)); __r; })#define writeb_relaxed (v,c) __raw_writeb(v,c) -#define writew_relaxed (v,c) __raw_writew(v,c) -#define writel_relaxed (v,c) __raw_writel(v,c) +#define writew_relaxed (v,c) __raw_writew((__force u16) cpu_to_le16(v),c) +#define writel_relaxed (v,c) __raw_writel((__force u32) cpu_to_le32(v),c)#include <asm-generic/io.h>
Greg Kroah-Hartman
maintainerPATCH 141/210 ARC: bitops: Remove non relevant comments
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vineet Gupta <[email protected]>
commit 2a41b6dc28dc71c1a3f1622612a26edc58f7561e upstream.
commit 80f420842ff42 removed the ARC bitops microoptimization but failed to prune the comments to same effect
--- arch/arc/include/asm/bitops.h | 15 --------------- 1 file changed, 15 deletions(-)
arch/arc/include/asm/bitops.h +0 -15
@@ -35,21 +35,6 @@ static inline void op##_bit(unsigned lon \ m += nr >>5 ; \ \ -/* \ -* ARC ISA micro-optimization: \ -* \ -* Instructions dealing with bitpos only consider lower 5 bits \ -* e.g (x << 33) is handled like (x << 1) by ASL instruction \ -* (mem pointer still needs adjustment to point to next word) \ -* \ -* Hence the masking to clamp @nr arg can be elided in general. \ -* \ -* However if @nr is a constant (above assumed in a register), \ -* and greater than 31, gcc can optimize away (x << 33) to 0, \ -* as overflow, given the 32-bit ISA. Thus masking needs to be \ -* done for const @nr, but no code is generated due to gcc \ -* const prop. \ -*/ \ nr &=0x1f ; \ \ __asm__ __volatile__( \
Greg Kroah-Hartman
maintainerPATCH 142/210 quota: Fix possible GPF due to uninitialised pointers
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikolay Borisov <[email protected]>
commit ab73ef46398e2c0159f3a71de834586422d2a44a upstream.
When dqget() in __dquot_initialize() fails e.g. due to IO error, __dquot_initialize() will pass an array of uninitialized pointers to dqput_all() and thus can lead to deference of random data. Fix the problem by properly initializing the array.
--- fs/quota/dquot.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
fs/quota/dquot.c +1 -2
@@ -1398,7 +1398,7 @@ static int dquot_active(const struct inostatic int __dquot_initialize (struct inode *inode,int type) {int cnt, init_needed =0 ; -struct dquot **dquots, *got[MAXQUOTAS ]; +struct dquot **dquots, *got[MAXQUOTAS ] = {};struct super_block *sb = inode->i_sb;qsize_t rsv;int ret =0 ;
@@ -1415,7 +1415,6 @@ static int __dquot_initialize(struct inoint rc;struct dquot *dquot; - got[cnt] =NULL ;if (type !=-1 && cnt != type)continue ;/*
Greg Kroah-Hartman
maintainerPATCH 143/210 xfs: fix two memory leaks in xfs_attr_list.c error paths
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mateusz Guzik <[email protected]>
commit 2e83b79b2d6c78bf1b4aa227938a214dcbddc83f upstream.
This plugs 2 trivial leaks in xfs_attr_shortform_list and xfs_attr3_leaf_list_int.
--- fs/xfs/xfs_attr_list.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-)
fs/xfs/xfs_attr_list.c +10 -9
@@ -202,8 +202,10 @@ xfs_attr_shortform_list(xfs_attr_list_co sbp->namelen, sbp->valuelen, &sbp->name[sbp->namelen]); -if (error) +if (error) { +kmem_free (sbuf);return error; + }if (context->seen_enough)break ; cursor->offset++;
@@ -454,14 +456,13 @@ xfs_attr3_leaf_list_int( args.rmtblkcnt =xfs_attr3_rmt_blocks ( args.dp->i_mount, valuelen); retval =xfs_attr_rmtval_get (&args); -if (retval) -return retval; - retval = context->put_listent (context, - entry->flags, - name_rmt->name, - (int )name_rmt->namelen, - valuelen, - args.value); +if (!retval) + retval = context->put_listent (context, + entry->flags, + name_rmt->name, + (int )name_rmt->namelen, + valuelen, + args.value);kmem_free (args.value); }else { retval = context->put_listent(context,
Greg Kroah-Hartman
maintainerPATCH 144/210 raid1: include bio_end_io_list in nr_queued to prevent freeze_array hang
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nate Dailey <[email protected]>
commit ccfc7bf1f09d6190ef86693ddc761d5fe3fa47cb upstream.
If raid1d is handling a mix of read and write errors, handle_read_error's call to freeze_array can get stuck.
This can happen because, though the bio_end_io_list is initially drained, writes can be added to it via handle_write_finished as the retry_list is processed. These writes contribute to nr_pending but are not included in nr_queued.
If a later entry on the retry_list triggers a call to handle_read_error, freeze array hangs waiting for nr_pending == nr_queued+extra. The writes on the bio_end_io_list aren't included in nr_queued so the condition will never be satisfied.
To prevent the hang, include bio_end_io_list writes in nr_queued.
There's probably a better way to handle decrementing nr_queued, but this seemed like the safest way to avoid breaking surrounding code.
I'm happy to supply the script I used to repro this hang.
--- drivers/md/raid1.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/md/raid1.c +5 -2
@@ -2274,6 +2274,7 @@ static void handle_write_finished(structif (fail) {spin_lock_irq (&conf->device_lock);list_add (&r1_bio->retry_list, &conf->bio_end_io_list); + conf->nr_queued++;spin_unlock_irq (&conf->device_lock);md_wakeup_thread (conf->mddev->thread); }else {
@@ -2391,8 +2392,10 @@ static void raid1d(struct md_thread *thrLIST_HEAD (tmp);spin_lock_irqsave (&conf->device_lock, flags);if (!test_bit (MD_CHANGE_PENDING , &mddev->flags)) { -list_add (&tmp, &conf->bio_end_io_list); -list_del_init (&conf->bio_end_io_list); +while (!list_empty (&conf->bio_end_io_list)) { +list_move (conf->bio_end_io_list.prev, &tmp); + conf->nr_queued--; + } }spin_unlock_irqrestore (&conf->device_lock, flags);while (!list_empty (&tmp)) {
Greg Kroah-Hartman
maintainerPATCH 145/210 md/raid5: Compare apples to apples (or sectors to sectors)
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jes Sorensen <[email protected]>
commit e7597e69dec59b65c5525db1626b9d34afdfa678 upstream.
'max_discard_sectors' is in sectors, while 'stripe' is in bytes.
This fixes the problem where DISCARD would get disabled on some larger RAID5 configurations (6 or more drives in my testing), while it worked as expected with smaller configurations.
--- drivers/md/raid5.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/md/raid5.c +2 -2
@@ -7015,8 +7015,8 @@ static int run(struct mddev *mddev) }if (discard_supported && - mddev->queue->limits.max_discard_sectors >= stripe && - mddev->queue->limits.discard_granularity >= stripe) + mddev->queue->limits.max_discard_sectors >= (stripe >>9 ) && + mddev->queue->limits.discard_granularity >= stripe)queue_flag_set_unlocked (QUEUE_FLAG_DISCARD , mddev->queue);else
Greg Kroah-Hartman
maintainerPATCH 146/210 RAID5: check_reshape() shouldnt call mddev_suspend
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shaohua Li <[email protected]>
commit 27a353c026a879a1001e5eac4bda75b16262c44a upstream.
check_reshape() is called from raid5d thread. raid5d thread shouldn't call mddev_suspend(), because mddev_suspend() waits for all IO finish but IO is handled in raid5d thread, we could easily deadlock here.
This issue is introduced by
738a273 ("md/raid5: fix allocation of 'scribble' array.")
--- drivers/md/raid5.c | 18 ++++++++++++++++++ drivers/md/raid5.h | 2 ++ 2 files changed, 20 insertions(+)
drivers/md/raid5.c +18 -0
@@ -2091,6 +2091,14 @@ static int resize_chunks(struct r5conf *unsigned long cpu;int err =0 ; +/* +* Never shrink. And mddev_suspend() could deadlock if this is called +* from raid5d. In that case, scribble_disks and scribble_sectors +* should equal to new_disks and new_sectors +*/ +if (conf->scribble_disks >= new_disks && + conf->scribble_sectors >= new_sectors) +return 0 ;mddev_suspend (conf->mddev);get_online_cpus ();for_each_present_cpu (cpu) {
@@ -2112,6 +2120,10 @@ static int resize_chunks(struct r5conf * }put_online_cpus ();mddev_resume (conf->mddev); +if (!err) { + conf->scribble_disks = new_disks; + conf->scribble_sectors = new_sectors; + }return err; }
@@ -6414,6 +6426,12 @@ static int raid5_alloc_percpu(struct r5c }put_online_cpus (); +if (!err) { + conf->scribble_disks =max (conf->raid_disks, + conf->previous_raid_disks); + conf->scribble_sectors =max (conf->chunk_sectors, + conf->prev_chunk_sectors); + }return err; }
drivers/md/raid5.h +2 -0
@@ -510,6 +510,8 @@ struct r5conf {* conversions */ }__percpu *percpu; +int scribble_disks; +int scribble_sectors;#ifdef CONFIG_HOTPLUG_CPU struct notifier_block cpu_notify;#endif
Greg Kroah-Hartman
maintainerPATCH 147/210 RAID5: revert e9e4c377e2f563 to fix a livelock
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shaohua Li <[email protected]>
commit 6ab2a4b806ae21b6c3e47c5ff1285ec06d505325 upstream.
Revert commite9e4c377e2f563(md/raid5: per hash value and exclusive wait_for_stripe)
The problem is raid5_get_active_stripe waits on conf->wait_for_stripe[hash]. Assume hash is 0. My test release stripes in this order:
- release all stripes with hash 0
- raid5_get_active_stripe still sleeps since active_stripes > max_nr_stripes * 3 / 4
- release all stripes with hash other than 0. active_stripes becomes 0
- raid5_get_active_stripe still sleeps, since nobody wakes up wait_for_stripe[0]
The system live locks. The problem is active_stripes isn't a per-hash count. Revert the patch makes the live lock go away.
--- drivers/md/raid5.c | 27 ++++++++------------------- drivers/md/raid5.h | 2 +- 2 files changed, 9 insertions(+), 20 deletions(-)
drivers/md/raid5.c +8 -19
@@ -340,8 +340,7 @@ static void release_inactive_stripe_list int hash) {int size; -unsigned long do_wakeup =0 ; -int i =0 ; +bool do_wakeup = false;unsigned long flags;if (hash ==NR_STRIPE_HASH_LOCKS ) {
@@ -362,19 +361,15 @@ static void release_inactive_stripe_list !list_empty(list))atomic_dec (&conf->empty_inactive_list_nr);list_splice_tail_init (list, conf->inactive_list + hash); - do_wakeup |=1 << hash; + do_wakeup = true;spin_unlock_irqrestore (conf->hash_locks + hash, flags); } size--; hash--; } -for (i =0 ; i <NR_STRIPE_HASH_LOCKS ; i++) { -if (do_wakeup & (1 << i)) -wake_up (&conf->wait_for_stripe[i]); - } -if (do_wakeup) { +wake_up (&conf->wait_for_stripe);if (atomic_read (&conf->active_stripes) ==0 )wake_up (&conf->wait_for_quiescent);if (conf->retry_read_aligned)
@@ -687,15 +682,14 @@ raid5_get_active_stripe(struct r5conf *cif (!sh) {set_bit (R5_INACTIVE_BLOCKED , &conf->cache_state); -wait_event_exclusive_cmd ( - conf->wait_for_stripe[hash], +wait_event_lock_irq ( + conf->wait_for_stripe, !list_empty (conf->inactive_list + hash) && (atomic_read (&conf->active_stripes) < (conf->max_nr_stripes *3 /4 ) || !test_bit (R5_INACTIVE_BLOCKED , &conf->cache_state)), -spin_unlock_irq (conf->hash_locks + hash), -spin_lock_irq (conf->hash_locks + hash)); + *(conf->hash_locks + hash));clear_bit (R5_INACTIVE_BLOCKED , &conf->cache_state); }else {
@@ -720,9 +714,6 @@ raid5_get_active_stripe(struct r5conf *c } }while (sh ==NULL ); -if (!list_empty (conf->inactive_list + hash)) -wake_up (&conf->wait_for_stripe[hash]); -spin_unlock_irq (conf->hash_locks + hash);return sh; }
@@ -2204,7 +2195,7 @@ static int resize_stripes(struct r5conf cnt =0 ;list_for_each_entry (nsh, &newstripes, lru) {lock_device_hash_lock (conf, hash); -wait_event_exclusive_cmd (conf->wait_for_stripe[hash], +wait_event_cmd (conf->wait_for_stripe, !list_empty (conf->inactive_list + hash),unlock_device_hash_lock (conf, hash),lock_device_hash_lock (conf, hash));
@@ -6522,9 +6513,7 @@ static struct r5conf *setup_conf(structseqcount_init (&conf->gen_lock);mutex_init (&conf->cache_size_mutex);init_waitqueue_head (&conf->wait_for_quiescent); -for (i =0 ; i <NR_STRIPE_HASH_LOCKS ; i++) { -init_waitqueue_head (&conf->wait_for_stripe[i]); - } +init_waitqueue_head (&conf->wait_for_stripe);init_waitqueue_head (&conf->wait_for_overlap);INIT_LIST_HEAD (&conf->handle_list);INIT_LIST_HEAD (&conf->hold_list);
drivers/md/raid5.h +1 -1
@@ -524,7 +524,7 @@ struct r5conf {atomic_t empty_inactive_list_nr;struct llist_head released_stripes;wait_queue_head_t wait_for_quiescent; -wait_queue_head_t wait_for_stripe[NR_STRIPE_HASH_LOCKS ]; +wait_queue_head_t wait_for_stripe;wait_queue_head_t wait_for_overlap;unsigned long cache_state;#define R5_INACTIVE_BLOCKED 1/* release of inactive stripes blocked,
Greg Kroah-Hartman
maintainerPATCH 148/210 raid10: include bio_end_io_list in nr_queued to prevent freeze_array hang
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shaohua Li <[email protected]>
commit 23ddba80ebe836476bb2fa1f5ef305dd1c63dc0b upstream.
This is the raid10 counterpart of the bug fixed by Nate (raid1: include bio_end_io_list in nr_queued to prevent freeze_array hang)
--- drivers/md/raid10.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/md/raid10.c +5 -2
@@ -2664,6 +2664,7 @@ static void handle_write_completed(strucif (fail) {spin_lock_irq (&conf->device_lock);list_add (&r10_bio->retry_list, &conf->bio_end_io_list); + conf->nr_queued++;spin_unlock_irq (&conf->device_lock);md_wakeup_thread (conf->mddev->thread); }else {
@@ -2691,8 +2692,10 @@ static void raid10d(struct md_thread *thLIST_HEAD (tmp);spin_lock_irqsave (&conf->device_lock, flags);if (!test_bit (MD_CHANGE_PENDING , &mddev->flags)) { -list_add (&tmp, &conf->bio_end_io_list); -list_del_init (&conf->bio_end_io_list); +while (!list_empty (&conf->bio_end_io_list)) { +list_move (conf->bio_end_io_list.prev, &tmp); + conf->nr_queued--; + } }spin_unlock_irqrestore (&conf->device_lock, flags);while (!list_empty (&tmp)) {
Greg Kroah-Hartman
maintainerPATCH 149/210 md/raid5: preserve STRIPE_PREREAD_ACTIVE in break_stripe_batch_list
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <[email protected]>
commit 550da24f8d62fe81f3c13e3ec27602d6e44d43dc upstream.
break_stripe_batch_list breaks up a batch and copies some flags from the batch head to the members, preserving others.
It doesn't preserve or copy STRIPE_PREREAD_ACTIVE. This is not normally a problem as STRIPE_PREREAD_ACTIVE is cleared when a stripe_head is added to a batch, and is not set on stripe_heads already in a batch.
However there is no locking to ensure one thread doesn't set the flag after it has just been cleared in another. This does occasionally happen.
md/raid5 maintains a count of the number of stripe_heads with STRIPE_PREREAD_ACTIVE set: conf->preread_active_stripes. When break_stripe_batch_list clears STRIPE_PREREAD_ACTIVE inadvertently this could becomes incorrect and will never again return to zero.
md/raid5 delays the handling of some stripe_heads until preread_active_stripes becomes zero. So when the above mention race happens, those stripe_heads become blocked and never progress, resulting is write to the array handing.
So: change break_stripe_batch_list to preserve STRIPE_PREREAD_ACTIVE in the members of a batch.
URL: https://bugzilla.kernel.org/show_bug.cgi?id=108741
URL: https://bugzilla.redhat.com/show_bug.cgi?id=1258153
URL: http://thread.gmane.org/[email protected]
--- drivers/md/raid5.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/md/raid5.c +1 -1
@@ -4241,7 +4241,6 @@ static void break_stripe_batch_list(stru WARN_ON_ONCE(sh->state & ((1 << STRIPE_ACTIVE) | (1 << STRIPE_SYNCING) | (1 << STRIPE_REPLACED) | - (1 << STRIPE_PREREAD_ACTIVE) | (1 << STRIPE_DELAYED) | (1 << STRIPE_BIT_DELAY) | (1 << STRIPE_FULL_WRITE) |
@@ -4256,6 +4255,7 @@ static void break_stripe_batch_list(stru (1 << STRIPE_REPLACED)));set_mask_bits (&sh->state, ~(STRIPE_EXPAND_SYNC_FLAGS | + (1 <<STRIPE_PREREAD_ACTIVE ) | (1 <<STRIPE_DEGRADED )), head_sh->state & (1 <<STRIPE_INSYNC ));
Greg Kroah-Hartman
maintainerPATCH 150/210 md: multipath: dont hardcopy bio in .make_request path
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Lei <[email protected]>
commit fafcde3ac1a418688a734365203a12483b83907a upstream.
Inside multipath_make_request(), multipath maps the incoming bio into low level device's bio, but it is totally wrong to copy the bio into mapped bio via '*mapped_bio = *bio'. For example, .__bi_remaining is kept in the copy, especially if the incoming bio is chained to via bio splitting, so .bi_end_io can't be called for the mapped bio at all in the completing path in this kind of situation.
This patch fixes the issue by using clone style.
--- drivers/md/multipath.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/md/multipath.c +3 -1
@@ -129,7 +129,9 @@ static void multipath_make_request(struc } multipath = conf->multipaths + mp_bh->path; - mp_bh->bio = *bio; +bio_init (&mp_bh->bio); +__bio_clone_fast (&mp_bh->bio, bio); + mp_bh->bio.bi_iter.bi_sector += multipath->rdev->data_offset; mp_bh->bio.bi_bdev = multipath->rdev->bdev; mp_bh->bio.bi_rw |=REQ_FAILFAST_TRANSPORT ;
Greg Kroah-Hartman
maintainerPATCH 151/210 fuse: do not use iocb after it may have been freed
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robert Doebbelin <[email protected]>
commit 7cabc61e01a0a8b663bd2b4c982aa53048218734 upstream.
There's a race in fuse_direct_IO(), whereby is_sync_kiocb() is called on an iocb that could have been freed if async io has already completed. The fix in this case is simple and obvious: cache the result before starting io.
It was discovered by KASan:
kernel: ==================================================================
kernel: BUG: KASan: use after free in fuse_direct_IO+0xb1a/0xcc0 at addr ffff88036c414390
--- fs/fuse/file.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
fs/fuse/file.c +4 -3
@@ -2786,6 +2786,7 @@ fuse_direct_IO(struct kiocb *iocb, strucloff_t i_size;size_t count =iov_iter_count (iter);struct fuse_io_priv *io; +bool is_sync =is_sync_kiocb (iocb); pos = offset; inode = file->f_mapping->host;
@@ -2825,11 +2826,11 @@ fuse_direct_IO(struct kiocb *iocb, struc* to wait on real async I/O requests, so we must submit this request * synchronously. */ -if (!is_sync_kiocb (iocb) && (offset + count > i_size) && +if (!is_sync && (offset + count > i_size) &&iov_iter_rw (iter) ==WRITE ) io->async = false; -if (io->async &&is_sync_kiocb (iocb)) +if (io->async && is_sync) io->done = &wait;if (iov_iter_rw (iter) ==WRITE ) {
@@ -2843,7 +2844,7 @@ fuse_direct_IO(struct kiocb *iocb, strucfuse_aio_complete (io, ret <0 ? ret :0 ,-1 );/* we have a non-extending, async request, so return */ -if (!is_sync_kiocb (iocb)) +if (!is_sync)return -EIOCBQUEUED ;wait_for_completion (&wait);
Greg Kroah-Hartman
maintainerPATCH 152/210 fuse: Add reference counting for fuse_io_priv
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seth Forshee <[email protected]>
commit 744742d692e37ad5c20630e57d526c8f2e2fe3c9 upstream.
The 'reqs' member of fuse_io_priv serves two purposes. First is to track the number of oustanding async requests to the server and to signal that the io request is completed. The second is to be a reference count on the structure to know when it can be freed.
For sync io requests these purposes can be at odds. fuse_direct_IO() wants to block until the request is done, and since the signal is sent when 'reqs' reaches 0 it cannot keep a reference to the object. Yet it needs to use the object after the userspace server has completed processing requests. This leads to some handshaking and special casing that it needlessly complicated and responsible for at least one race condition.
It's much cleaner and safer to maintain a separate reference count for the object lifecycle and to let 'reqs' just be a count of outstanding requests to the userspace server. Then we can know for sure when it is safe to free the object without any handshaking or special cases.
The catch here is that most of the time these objects are stack allocated and should not be freed. Initializing these objects with a single reference that is never released prevents accidental attempts to free the objects.
--- fs/fuse/cuse.c | 4 ++-- fs/fuse/file.c | 28 +++++++++++++++++++++------- fs/fuse/fuse_i.h | 9 +++++++++ 3 files changed, 32 insertions(+), 9 deletions(-)
fs/fuse/cuse.c +2 -2
@@ -90,7 +90,7 @@ static struct list_head *cuse_conntbl_hestatic ssize_t cuse_read_iter (struct kiocb *kiocb,struct iov_iter *to) { -struct fuse_io_priv io = { .async =0 , .file = kiocb->ki_filp }; +struct fuse_io_priv io =FUSE_IO_PRIV_SYNC (kiocb->ki_filp);loff_t pos =0 ;return fuse_direct_io (&io, to, &pos,FUSE_DIO_CUSE );
@@ -98,7 +98,7 @@ static ssize_t cuse_read_iter(struct kiostatic ssize_t cuse_write_iter (struct kiocb *kiocb,struct iov_iter *from) { -struct fuse_io_priv io = { .async =0 , .file = kiocb->ki_filp }; +struct fuse_io_priv io =FUSE_IO_PRIV_SYNC (kiocb->ki_filp);loff_t pos =0 ;/* * No locking or generic_write_checks(), the server is
fs/fuse/file.c +21 -7
@@ -528,6 +528,11 @@ static void fuse_release_user_pages(stru } } +static void fuse_io_release (struct kref *kref) +{ +kfree (container_of(kref ,struct fuse_io_priv ,refcnt )); +} +static ssize_t fuse_get_res_by_io (struct fuse_io_priv *io) {if (io->err)
@@ -585,8 +590,9 @@ static void fuse_aio_complete(struct fus } io->iocb->ki_complete (io->iocb, res,0 ); -kfree (io); } + +kref_put (&io->refcnt, fuse_io_release); }static void fuse_aio_complete_req (struct fuse_conn *fc,struct fuse_req *req)
@@ -613,6 +619,7 @@ static size_t fuse_async_req_send(struct size_t num_bytes, struct fuse_io_priv *io) { spin_lock(&io->lock); +kref_get (&io->refcnt); io->size += num_bytes; io->reqs++;spin_unlock (&io->lock);
@@ -691,7 +698,7 @@ static void fuse_short_read(struct fuse_static int fuse_do_readpage (struct file *file,struct page *page) { -struct fuse_io_priv io = { .async =0 , .file = file }; +struct fuse_io_priv io =FUSE_IO_PRIV_SYNC (file);struct inode *inode = page->mapping->host;struct fuse_conn *fc =get_fuse_conn (inode);struct fuse_req *req;
@@ -984,7 +991,7 @@ static size_t fuse_send_write_pages(strusize_t res;unsigned offset;unsigned i; -struct fuse_io_priv io = { .async =0 , .file = file }; +struct fuse_io_priv io =FUSE_IO_PRIV_SYNC (file);for (i =0 ; i < req->num_pages; i++)fuse_wait_on_page_writeback (inode, req->pages[i]->index);
@@ -1398,7 +1405,7 @@ static ssize_t __fuse_direct_read(structstatic ssize_t fuse_direct_read_iter (struct kiocb *iocb,struct iov_iter *to) { -struct fuse_io_priv io = { .async =0 , .file = iocb->ki_filp }; +struct fuse_io_priv io =FUSE_IO_PRIV_SYNC (iocb->ki_filp);return __fuse_direct_read (&io, to, &iocb->ki_pos); }
@@ -1406,7 +1413,7 @@ static ssize_t fuse_direct_write_iter(st {struct file *file = iocb->ki_filp;struct inode *inode =file_inode (file); -struct fuse_io_priv io = { .async =0 , .file = file }; +struct fuse_io_priv io =FUSE_IO_PRIV_SYNC (file);ssize_t res;if (is_bad_inode (inode))
@@ -2807,6 +2814,7 @@ fuse_direct_IO(struct kiocb *iocb, strucif (!io)return -ENOMEM ;spin_lock_init (&io->lock); +kref_init (&io->refcnt); io->reqs =1 ; io->bytes =-1 ; io->size =0 ;
@@ -2830,8 +2838,14 @@ fuse_direct_IO(struct kiocb *iocb, struc iov_iter_rw(iter) == WRITE) io->async = false; -if (io->async && is_sync) +if (io->async && is_sync) { +/* +* Additional reference to keep io around after +* calling fuse_aio_complete() +*/ +kref_get (&io->refcnt); io->done = &wait; + }if (iov_iter_rw (iter) ==WRITE ) { ret =fuse_direct_io (io, iter, &pos,FUSE_DIO_WRITE );
@@ -2851,7 +2865,7 @@ fuse_direct_IO(struct kiocb *iocb, struc ret =fuse_get_res_by_io (io); } -kfree (io); +kref_put (&io->refcnt, fuse_io_release);if (iov_iter_rw (iter) ==WRITE ) {if (ret >0 )
fs/fuse/fuse_i.h +9 -0
@@ -22,6 +22,7 @@#include <linux/rbtree.h> #include <linux/poll.h> #include <linux/workqueue.h> +#include <linux/kref.h> /** Max number of pages that can be used in a single read request */ #define FUSE_MAX_PAGES_PER_REQ 32
@@ -243,6 +244,7 @@ struct fuse_args {/** The request IO state (for asynchronous processing) */ struct fuse_io_priv { +struct kref refcnt;int async;spinlock_t lock;unsigned reqs;
@@ -256,6 +258,13 @@ struct fuse_io_priv {struct completion *done; }; +#define FUSE_IO_PRIV_SYNC (f) \ +{ \ + .refcnt = { ATOMIC_INIT(1) }, \ + .async = 0, \ + .file = f, \ +} +/** * Request flags *
Greg Kroah-Hartman
maintainerPATCH 153/210 scripts/gdb: account for changes in module data structure
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kiszka <[email protected]>
commit ad4db3b24a93e52a92ad8f9b0273a9416f202c23 upstream.
Commit 7523e4dc5057 ("module: use a structure to encapsulate layout.") factored out the module_layout structure. Adjust the symbol loader and the lsmod command to this.
--- scripts/gdb/linux/modules.py | 5 +++-- scripts/gdb/linux/symbols.py | 2 +- 2 files changed, 4 insertions(+), 3 deletions(-)
scripts/gdb/linux/modules.py +3 -2
@@ -73,10 +73,11 @@ class LxLsmod(gdb.Command): " " if utils.get_long_type().sizeof == 8 else "")) for module in module_list(): + layout = module['core_layout'] gdb.write("{address} {name:<19} {size:>8} {ref}".format( - address=str(module['module_core']).split()[0], + address=str(layout['base']).split()[0], name=module['name'].string(), - size=str(module['core_size']), + size=str(layout['size']), ref=str(module['refcnt']['counter']))) source_list = module['source_list']
scripts/gdb/linux/symbols.py +1 -1
@@ -108,7 +108,7 @@ lx-symbols command.""" def load_module_symbols(self, module): module_name = module['name'].string() - module_addr = str(module['module_core']).split()[0] + module_addr = str(module['core_layout']['base']).split()[0] module_file = self._get_module_file(module_name) if not module_file and not self.module_files_updated:
Re: [PATCH 4.4 153/210] scripts/gdb: account for changes in module data structure
Quoted 11 lines · Greg Kroah-Hartman
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kiszka <[email protected]>
commit
ad4db3b24a93e52a92ad8f9b0273a9416f202c23upstream.Commit
7523e4dc5057("module: use a structure to encapsulate layout.") factored out themodule_layoutstructure. Adjust the symbol loader and the lsmod command to this.
Unless the referenced commit is also in the 4.4 queue (seems unlikely, though), this patch must not go to that stable branch as it only addresses a 4.5 change. So please drop.
Thanks,
Jan
Signature · 2 lines
Siemens AG, Corporate Technology, CT RDA ITP SES-DE Corporate Competence Center Embedded Linux
Greg Kroah-Hartman
maintainerRe: [PATCH 4.4 153/210] scripts/gdb: account for changes in module data structure
Quoted 9 lines · Jan Kiszka
Quoted 8 lines · Greg Kroah-Hartman
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kiszka <[email protected]>
commit
ad4db3b24a93e52a92ad8f9b0273a9416f202c23upstream.
Quoted 7 lines
Quoted 3 lines
Commit
7523e4dc5057("module: use a structure to encapsulate layout.") factored out themodule_layoutstructure. Adjust the symbol loader and the lsmod command to this.Unless the referenced commit is also in the 4.4 queue (seems unlikely, though), this patch must not go to that stable branch as it only addresses a 4.5 change. So please drop.
Odd, it was told to be backported to 4.4, I guess the authors messed up :(
Now dropped, thanks.
greg k-h
Greg Kroah-Hartman
maintainerPATCH 154/210 fs/coredump: prevent fsuid=0 dumps into user-controlled directories
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jann Horn <[email protected]>
commit 378c6520e7d29280f400ef2ceaf155c86f05a71a upstream.
This commit fixes the following security hole affecting systems where all of the following conditions are fulfilled:
- The fs.suid_dumpable sysctl is set to 2.
- The kernel.core_pattern sysctl's value starts with "/". (Systems where kernel.core_pattern starts with "|/" are not affected.)
- Unprivileged user namespace creation is permitted. (This is true on Linux >=3.8, but some distributions disallow it by default using a distro patch.)
Under these conditions, if a program executes under secure exec rules, causing it to run with the SUID_DUMP_ROOT flag, then unshares its user namespace, changes its root directory and crashes, the coredump will be written using fsuid=0 and a path derived from kernel.core_pattern - but this path is interpreted relative to the root directory of the process, allowing the attacker to control where a coredump will be written with root privileges.
To fix the security issue, always interpret core_pattern for dumps that are written under SUID_DUMP_ROOT relative to the root directory of init.
--- arch/um/drivers/mconsole_kern.c | 2 +- fs/coredump.c | 30 ++++++++++++++++++++++++++---- fs/fhandle.c | 2 +- fs/open.c | 6 ++---- include/linux/fs.h | 2 +- kernel/sysctl_binary.c | 2 +- 6 files changed, 32 insertions(+), 12 deletions(-)
arch/um/drivers/mconsole_kern.c +1 -1
@@ -133,7 +133,7 @@ void mconsole_proc(struct mc_request *re ptr +=strlen ("proc" ); ptr =skip_spaces (ptr); - file =file_open_root (mnt->mnt_root, mnt, ptr,O_RDONLY ); + file =file_open_root (mnt->mnt_root, mnt, ptr,O_RDONLY ,0 );if (IS_ERR (file)) {mconsole_reply (req,"Failed to open file" ,1 ,0 );printk (KERN_ERR "open /proc/%s: %ld\n" , ptr,PTR_ERR (file));
fs/coredump.c +26 -4
@@ -32,6 +32,9 @@#include <linux/pipe_fs_i.h> #include <linux/oom.h> #include <linux/compat.h> +#include <linux/sched.h> +#include <linux/fs.h> +#include <linux/path.h> #include <asm/uaccess.h> #include <asm/mmu_context.h>
@@ -627,6 +630,8 @@ void do_coredump(const siginfo_t *siginf } }else {struct inode *inode; +int open_flags =O_CREAT |O_RDWR |O_NOFOLLOW | +O_LARGEFILE |O_EXCL ;if (cprm.limit < binfmt->min_coredump) goto fail_unlock;
@@ -665,10 +670,27 @@ void do_coredump(const siginfo_t *siginf* what matters is that at least one of the two processes * writes its coredump successfully, not which one. */ - cprm.file =filp_open (cn.corename, -O_CREAT |2 |O_NOFOLLOW | -O_LARGEFILE |O_EXCL , -0600 ); +if (need_suid_safe) { +/* +* Using user namespaces, normal user tasks can change +* their current->fs->root to point to arbitrary +* directories. Since the intention of the "only dump +* with a fully qualified path" rule is to control where +* coredumps may be placed using root privileges, +* current->fs->root must not be used. Instead, use the +* root directory of init_task. +*/ +struct path root; + +task_lock (&init_task); +get_fs_root (init_task.fs, &root); +task_unlock (&init_task); + cprm.file =file_open_root (root.dentry, root.mnt, + cn.corename, open_flags,0600 ); +path_put (&root); + }else { + cprm.file =filp_open (cn.corename, open_flags,0600 ); + }if (IS_ERR (cprm.file)) goto fail_unlock;
fs/fhandle.c +1 -1
@@ -228,7 +228,7 @@ long do_handle_open(int mountdirfd,path_put (&path);return fd; } - file =file_open_root (path.dentry, path.mnt,"" , open_flag); + file =file_open_root (path.dentry, path.mnt,"" , open_flag,0 );if (IS_ERR (file)) {put_unused_fd (fd); retval =PTR_ERR (file);
fs/open.c +2 -4
@@ -995,14 +995,12 @@ struct file *filp_open(const char *filenEXPORT_SYMBOL (filp_open);struct file *file_open_root (struct dentry *dentry,struct vfsmount *mnt, -const char *filename,int flags) +const char *filename,int flags,umode_t mode) {struct open_flags op; -int err =build_open_flags (flags,0 , &op); +int err =build_open_flags (flags, mode, &op);if (err)return ERR_PTR (err); -if (flags &O_CREAT ) -return ERR_PTR (-EINVAL );return do_file_open_root (dentry, mnt, filename, &op); }EXPORT_SYMBOL (file_open_root);
include/linux/fs.h +1 -1
@@ -2217,7 +2217,7 @@ extern long do_sys_open(int dfd, const cextern struct file *file_open_name (struct filename *,int ,umode_t );extern struct file *filp_open (const char *,int ,umode_t );extern struct file *file_open_root (struct dentry *,struct vfsmount *, -const char *,int ); +const char *,int ,umode_t );extern struct file *dentry_open (const struct path *,int ,const struct cred *);extern int filp_close (struct file *,fl_owner_t id);
kernel/sysctl_binary.c +1 -1
@@ -1321,7 +1321,7 @@ static ssize_t binary_sysctl(const int * } mnt =task_active_pid_ns (current)->proc_mnt; - file =file_open_root (mnt->mnt_root, mnt, pathname, flags); + file =file_open_root (mnt->mnt_root, mnt, pathname, flags,0 ); result =PTR_ERR (file);if (IS_ERR (file)) goto out_putname;
Greg Kroah-Hartman
maintainerPATCH 155/210 rapidio/rionet: fix deadlock on SMP
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aurelien Jacquiot <[email protected]>
commit 36915976eca58f2eefa040ba8f9939672564df61 upstream.
Fix deadlocking during concurrent receive and transmit operations on SMP platforms caused by the use of incorrect lock: on transmit 'tx_lock' spinlock should be used instead of 'lock' which is used for receive operation.
This fix is applicable to kernel versions starting from v2.15.
--- drivers/net/rionet.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/rionet.c +2 -2
@@ -280,7 +280,7 @@ static void rionet_outb_msg_event(structstruct net_device *ndev = dev_id;struct rionet_private *rnet =netdev_priv (ndev); -spin_lock (&rnet->lock); +spin_lock (&rnet->tx_lock);if (netif_msg_intr (rnet)) printk(KERN_INFO
@@ -299,7 +299,7 @@ static void rionet_outb_msg_event(structif (rnet->tx_cnt <RIONET_TX_RING_SIZE )netif_wake_queue (ndev); -spin_unlock (&rnet->lock); +spin_unlock (&rnet->tx_lock); }static int rionet_open (struct net_device *ndev)
Greg Kroah-Hartman
maintainerPATCH 156/210 ipr: Fix out-of-bounds null overwrite
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Insu Yun <[email protected]>
commit d63c7dd5bcb9441af0526d370c43a65ca2c980d9 upstream.
Return value of snprintf is not bound by size value, 2nd argument.
(https://www.kernel.org/doc/htmldocs/kernel-api/API-snprintf.html).
Return value is number of printed chars, can be larger than 2nd argument. Therefore, it can write null byte out of bounds ofbuffer. Since snprintf puts null, it does not need to put additional null byte.
--- drivers/scsi/ipr.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/scsi/ipr.c +2 -3
@@ -4003,13 +4003,12 @@ static ssize_t ipr_store_update_fw(strucstruct ipr_sglist *sglist;char fname[100 ];char *src; -int len, result, dnld_size; +int result, dnld_size;if (!capable (CAP_SYS_ADMIN ))return -EACCES ; - len =snprintf (fname,99 ,"%s" , buf); - fname[len-1 ] ='\0' ; +snprintf (fname,sizeof (fname),"%s" , buf);if (request_firmware (&fw_entry, fname, &ioa_cfg->pdev->dev)) {dev_err (&ioa_cfg->pdev->dev,"Firmware file %s not found\n" , fname);
Greg Kroah-Hartman
maintainerPATCH 157/210 ipr: Fix regression when loading firmware
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gabriel Krisman Bertazi <[email protected]>
commit 21b81716c6bff24cda52dc75588455f879ddbfe9 upstream.
Commit d63c7dd5bcb9 ("ipr: Fix out-of-bounds null overwrite") removed the end of line handling when storing the update_fw sysfs attribute. This changed the userpace API because it started refusing writes terminated by a line feed, which broke the update tools we already have.
This patch re-adds that handling, so both a write terminated by a line feed or not can make it through with the update.
--- drivers/scsi/ipr.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/scsi/ipr.c +5 -0
@@ -4003,6 +4003,7 @@ static ssize_t ipr_store_update_fw(strucstruct ipr_sglist *sglist;char fname[100 ];char *src; +char *endline;int result, dnld_size;if (!capable (CAP_SYS_ADMIN ))
@@ -4010,6 +4011,10 @@ static ssize_t ipr_store_update_fw(strucsnprintf (fname,sizeof (fname),"%s" , buf); + endline =strchr (fname,'\n' ); +if (endline) + *endline ='\0' ; +if (request_firmware (&fw_entry, fname, &ioa_cfg->pdev->dev)) {dev_err (&ioa_cfg->pdev->dev,"Firmware file %s not found\n" , fname);return -EIO ;
Greg Kroah-Hartman
maintainerPATCH 158/210 iwlwifi: mvm: Fix paging memory leak
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matti Gottlieb <[email protected]>
commit 905e36ae172c83a30894a3adefab7d4f850fcf54 upstream.
If the opmode is stopped and started again we did not free the paging buffers. Fix that.
In addition when freeing the firmware's paging download buffer, set the pointer to NULL.
--- drivers/net/wireless/iwlwifi/mvm/fw.c | 4 +++- drivers/net/wireless/iwlwifi/mvm/mvm.h | 3 +++ drivers/net/wireless/iwlwifi/mvm/ops.c | 2 ++ 3 files changed, 8 insertions(+), 1 deletion(-)
drivers/net/wireless/iwlwifi/mvm/fw.c +3 -1
@@ -106,7 +106,7 @@ static int iwl_send_tx_ant_cfg(struct iw sizeof(tx_ant_cmd), &tx_ant_cmd); } -static void iwl_free_fw_paging (struct iwl_mvm *mvm) +void iwl_free_fw_paging (struct iwl_mvm *mvm) {int i;
@@ -126,6 +126,8 @@ static void iwl_free_fw_paging(struct iw get_order(mvm->fw_paging_db[i].fw_paging_size)); }kfree (mvm->trans->paging_download_buf); + mvm->trans->paging_download_buf =NULL ; +memset (mvm->fw_paging_db,0 ,sizeof (mvm->fw_paging_db)); }
drivers/net/wireless/iwlwifi/mvm/mvm.h +3 -0
@@ -1190,6 +1190,9 @@ void iwl_mvm_rx_umac_scan_complete_notifvoid iwl_mvm_rx_umac_scan_iter_complete_notif (struct iwl_mvm *mvm,struct iwl_rx_cmd_buffer *rxb); +/* Paging */ +void iwl_free_fw_paging (struct iwl_mvm *mvm); +/* MVM debugfs */ #ifdef CONFIG_IWLWIFI_DEBUGFS int iwl_mvm_dbgfs_register (struct iwl_mvm *mvm,struct dentry *dbgfs_dir);
drivers/net/wireless/iwlwifi/mvm/ops.c +2 -0
@@ -645,6 +645,8 @@ static void iwl_op_mode_mvm_stop(structfor (i =0 ; i <NVM_MAX_NUM_SECTIONS ; i++)kfree (mvm->nvm_sections[i].data); +iwl_free_fw_paging (mvm); +iwl_mvm_tof_clean (mvm);ieee80211_free_hw (mvm->hw);
Greg Kroah-Hartman
maintainerPATCH 160/210 drm/radeon: Dont drop DP 2.7 Ghz link setup on some cards.
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Kleiner <[email protected]>
commit 459ee1c3fd097ab56ababd8ff4bb7ef6a792de33 upstream.
As observed on Apple iMac10,1, DCE-3.2, RV-730, link rate of 2.7 Ghz is not selected, because the args.v1.ucConfig flag setting for 2.7 Ghz gets overwritten by a following assignment of the transmitter to use.
Move link rate setup a few lines down to fix this. In practice this didn't have any positive or negative effect on display setup on the tested iMac10,1 so i don't know if backporting to stable makes sense or not.
--- drivers/gpu/drm/radeon/atombios_encoders.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/gpu/drm/radeon/atombios_encoders.c +4 -2
@@ -892,8 +892,6 @@ atombios_dig_encoder_setup2(struct drm_eelse args.v1.ucLaneNum =4 ; -if (ENCODER_MODE_IS_DP (args.v1.ucEncoderMode) && (dp_clock ==270000 )) - args.v1.ucConfig |=ATOM_ENCODER_CONFIG_DPLINKRATE_2_70GHZ ;switch (radeon_encoder->encoder_id) {case ENCODER_OBJECT_ID_INTERNAL_UNIPHY : args.v1.ucConfig =ATOM_ENCODER_CONFIG_V2_TRANSMITTER1 ;
@@ -910,6 +908,10 @@ atombios_dig_encoder_setup2(struct drm_e args.v1.ucConfig |=ATOM_ENCODER_CONFIG_LINKB ; else args.v1.ucConfig |= ATOM_ENCODER_CONFIG_LINKA; + +if (ENCODER_MODE_IS_DP (args.v1.ucEncoderMode) && (dp_clock ==270000 )) + args.v1.ucConfig |=ATOM_ENCODER_CONFIG_DPLINKRATE_2_70GHZ ; +break ;case 2 :case 3 :
Greg Kroah-Hartman
maintainerPATCH 162/210 drm/amdgpu: include the right version of gmc header files for iceland
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ken Wang <[email protected]>
commit 16a8a49be1b878ef6dd5d1663d456e254e54ae3d upstream.
--- drivers/gpu/drm/amd/amdgpu/sdma_v2_4.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/sdma_v2_4.c +2 -2
@@ -32,8 +32,8 @@#include "oss/oss_2_4_d.h" #include "oss/oss_2_4_sh_mask.h" -#include "gmc/gmc_8_1_d.h" -#include "gmc/gmc_8_1_sh_mask.h" +#include "gmc/gmc_7_1_d.h" +#include "gmc/gmc_7_1_sh_mask.h" #include "gca/gfx_8_0_d.h" #include "gca/gfx_8_0_enum.h"
Greg Kroah-Hartman
maintainerPATCH 163/210 IB/ipoib: fix for rare multicast join race condition
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Estrin <[email protected]>
commit 08bc327629cbd63bb2f66677e4b33b643695097c upstream.
A narrow window for race condition still exist between multicast join thread and *dev_flush workers.
A kernel crash caused by prolong erratic link state changes was observed (most likely a faulty cabling):
[167275.656270] BUG: unable to handle kernel NULL pointer dereference at
0000000000000020
[167275.665973] IP: [<ffffffffa05f8f2e>] ipoib_mcast_join+0xae/0x1d0 [ib_ipoib]
[167275.674443] PGD 0
[167275.677373] Oops: 0000 [#1] SMP
...
[167275.977530] Call Trace:
[167275.982225] [<ffffffffa05f92f0>] ? ipoib_mcast_free+0x200/0x200 [ib_ipoib]
[167275.992024] [<ffffffffa05fa1b7>] ipoib_mcast_join_task+0x2a7/0x490
[ib_ipoib]
[167276.002149] [<ffffffff8109d5fb>] process_one_work+0x17b/0x470
[167276.010754] [<ffffffff8109e3cb>] worker_thread+0x11b/0x400
[167276.019088] [<ffffffff8109e2b0>] ? rescuer_thread+0x400/0x400
[167276.027737] [<ffffffff810a5aef>] kthread+0xcf/0xe0
Here was a hit spot:
ipoib_mcast_join() {
..............
rec.qkey = priv->broadcast->mcmember.qkey;
^^^^^^^.....
}
Proposed patch should prevent multicast join task to continue if link state change is detected.
Changes from v4:
- as suggested by Doug Ledford, optimized spinlock usage, i.e. ipoib_mcast_join() is called with lock held. Changes from v3:
- sync with priv->lock before flag check.
Chages from v2:
- Move check for OPER_UP flag state to mcast_join() to ensure no event worker is in progress.
- minor style fixes.
Changes from v1:
- No need to lock again if error detected.
--- drivers/infiniband/ulp/ipoib/ipoib_multicast.c | 24 +++++++++++++++++------- 1 file changed, 17 insertions(+), 7 deletions(-)
drivers/infiniband/ulp/ipoib/ipoib_multicast.c +17 -7
@@ -456,7 +456,10 @@ out_locked:return status; } -static void ipoib_mcast_join (struct net_device *dev,struct ipoib_mcast *mcast) +/* +* Caller must hold 'priv->lock' +*/ +static int ipoib_mcast_join (struct net_device *dev,struct ipoib_mcast *mcast) {struct ipoib_dev_priv *priv =netdev_priv (dev);struct ib_sa_multicast *multicast;
@@ -466,6 +469,10 @@ static void ipoib_mcast_join(struct net_ib_sa_comp_mask comp_mask;int ret =0 ; +if (!priv->broadcast || + !test_bit (IPOIB_FLAG_OPER_UP , &priv->flags)) +return -EINVAL ; +ipoib_dbg_mcast (priv,"joining MGID %pI6\n" , mcast->mcmember.mgid.raw); rec.mgid = mcast->mcmember.mgid;
@@ -525,20 +532,23 @@ static void ipoib_mcast_join(struct net_ rec.join_state =4 ;#endif } +spin_unlock_irq (&priv->lock); multicast =ib_sa_join_multicast (&ipoib_sa_client, priv->ca, priv->port, &rec, comp_mask,GFP_KERNEL , ipoib_mcast_join_complete, mcast); +spin_lock_irq (&priv->lock);if (IS_ERR (multicast)) { ret =PTR_ERR (multicast);ipoib_warn (priv,"ib_sa_join_multicast failed, status %d\n" , ret); -spin_lock_irq (&priv->lock);/* Requeue this join task with a backoff delay */ __ipoib_mcast_schedule_join_thread (priv, mcast,1 );clear_bit (IPOIB_MCAST_FLAG_BUSY , &mcast->flags);spin_unlock_irq (&priv->lock);complete (&mcast->done); +spin_lock_irq (&priv->lock); } +return 0 ; }void ipoib_mcast_join_task (struct work_struct *work)
@@ -620,9 +630,10 @@ void ipoib_mcast_join_task(struct work_s/* Found the next unjoined group */ init_completion (&mcast->done);set_bit (IPOIB_MCAST_FLAG_BUSY , &mcast->flags); -spin_unlock_irq (&priv->lock); -ipoib_mcast_join (dev, mcast); -spin_lock_irq (&priv->lock); +if (ipoib_mcast_join (dev, mcast)) { +spin_unlock_irq (&priv->lock); +return ; + } }else if (!delay_until ||time_before (mcast->delay_until, delay_until)) delay_until = mcast->delay_until;
@@ -641,10 +652,9 @@ out:if (mcast) {init_completion (&mcast->done);set_bit (IPOIB_MCAST_FLAG_BUSY , &mcast->flags); +ipoib_mcast_join (dev, mcast); }spin_unlock_irq (&priv->lock); -if (mcast) -ipoib_mcast_join (dev, mcast); }int ipoib_mcast_start_thread (struct net_device *dev)
Greg Kroah-Hartman
maintainerPATCH 164/210 tracing: Have preempt(irqs)off trace preempt disabled functions
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt (Red Hat) <[email protected]>
commit cb86e05390debcc084cfdb0a71ed4c5dbbec517d upstream.
Joel Fernandes reported that the function tracing of preempt disabled sections was not being reported when running either the preemptirqsoff or preemptoff tracers. This was due to the fact that the function tracer callback for those tracers checked if irqs were disabled before tracing. But this fails when we want to trace preempt off locations as well.
Joel explained that he wanted to see funcitons where interrupts are enabled but preemption was disabled. The expected output he wanted:
<...>-2265 1d.h1 3419us : preempt_count_sub <-irq_exit <...>-2265 1d..1 3419us : __do_softirq <-irq_exit <...>-2265 1d..1 3419us : msecs_to_jiffies <-__do_softirq <...>-2265 1d..1 3420us : irqtime_account_irq <-__do_softirq <...>-2265 1d..1 3420us : __local_bh_disable_ip <-__do_softirq <...>-2265 1..s1 3421us : run_timer_softirq <-__do_softirq <...>-2265 1..s1 3421us : hrtimer_run_pending <-run_timer_softirq <...>-2265 1..s1 3421us : _raw_spin_lock_irq <-run_timer_softirq <...>-2265 1d.s1 3422us : preempt_count_add <-_raw_spin_lock_irq <...>-2265 1d.s2 3422us : _raw_spin_unlock_irq <-run_timer_softirq <...>-2265 1..s2 3422us : preempt_count_sub <-_raw_spin_unlock_irq <...>-2265 1..s1 3423us : rcu_bh_qs <-__do_softirq <...>-2265 1d.s1 3423us : irqtime_account_irq <-__do_softirq <...>-2265 1d.s1 3423us : __local_bh_enable <-__do_softirq
There's a comment saying that the irq disabled check is because there's a possible race that tracing_cpu may be set when the function is executed. But I don't remember that race. For now, I added a check for preemption being enabled too to not record the function, as there would be no race if that was the case. I need to re-investigate this, as I'm now thinking that the tracing_cpu will always be correct. But no harm in keeping the check for now, except for the slight performance hit.
--- kernel/trace/trace_irqsoff.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
kernel/trace/trace_irqsoff.c +6 -2
@@ -109,8 +109,12 @@ static int func_prolog_dec(struct trace_return 0 ;local_save_flags (*flags); -/* slight chance to get a false positive on tracing_cpu */ -if (!irqs_disabled_flags (*flags)) +/* +* Slight chance to get a false positive on tracing_cpu, +* although I'm starting to think there isn't a chance. +* Leave this for now just to be paranoid. +*/ +if (!irqs_disabled_flags (*flags) && !preempt_count ())return 0 ; *data =per_cpu_ptr (tr->trace_buffer.data, cpu);