4.5.2-stable review
Subsystems (4)
Greg Kroah-Hartman
maintainercover 4.5.2-stable review
This is the start of the stable review cycle for the 4.5.2 release. There are 124 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed Apr 20 02:25:31 UTC 2016. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.5.2-rc1.gz
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.5.2-rc1
Liviu Dudau <[email protected]>
staging: android: ion: Set the length of the DMA sg entries in buffer
Alan Stern <[email protected]>
HID: usbhid: fix inconsistent reset/resume/reset-resume behavior
Benjamin Tissoires <[email protected]>
HID: wacom: fix Bamboo ONE oops
Kailang Yang <[email protected]>
ALSA: usb-audio: Skip volume controls triggers hangup on Dell USB Dock
Dennis Kadioglu <[email protected]>
ALSA: usb-audio: Add a quirk for Plantronics BT300
Takashi Iwai <[email protected]>
ALSA: usb-audio: Add a sample rate quirk for Phoenix Audio TMX320
Sven Eckelmann <[email protected]>
ALSA: hda/realtek - Enable the ALC292 dock fixup on the Thinkpad T460s
Hyungwon Hwang <[email protected]>
ALSA: hda - Fix regression of monitor_present flag in eld proc file
Adrian Hunter <[email protected]>
mmc: sdhci-pci: Add support and PCI IDs for more Broxton host controllers
Adrian Hunter <[email protected]>
mmc: sdhci: Fix regression setting power on Trats2 board
Yang Shi <[email protected]>
arm64: replace read_lock to rcu lock in call_step_hook
Filipe Manana <[email protected]>
Btrfs: fix file/data loss caused by fsync after rename and new inode
Joerg Roedel <[email protected]>
iommu: Don't overwrite domain pointer when there is no default_domain
Theodore Ts'o <[email protected]>
ext4: ignore quota mount options if the quota feature is enabled
Theodore Ts'o <[email protected]>
ext4: add lockdep annotations for i_data_sem
Filipe Manana <[email protected]>
btrfs: fix crash/invalid memory access on fsync when using overlayfs
Miklos Szeredi <[email protected]>
ext4: use file_dentry()
Miklos Szeredi <[email protected]>
ext4: use dget_parent() in ext4_file_open()
Theodore Ts'o <[email protected]>
ext4 crypto: use dget_parent() in ext4_d_revalidate()
Miklos Szeredi <[email protected]>
nfs: use file_dentry()
Miklos Szeredi <[email protected]>
fs: add file_dentry()
Martin K. Petersen <[email protected]>
sd: Fix excessive capacity printing on devices with blocks bigger than 512 bytes
Irina Tirdea <[email protected]>
iio: gyro: bmg160: fix endianness when reading axes
Irina Tirdea <[email protected]>
iio: gyro: bmg160: fix buffer read values
Irina Tirdea <[email protected]>
iio: accel: bmc150: fix endianness when reading axes
Arnd Bergmann <[email protected]>
iio: st_magn: always define ST_MAGN_TRIGGER_SET_STATE
Irina Tirdea <[email protected]>
iio: fix config watermark initial value
Nicolas Pitre <[email protected]>
ARM: 8550/1: protect idiv patching against undefined gcc behavior
Hannes Reinecke <[email protected]>
scsi: Do not attach VPD to devices that don't support it
Yoshihiro Shimoda <[email protected]>
usb: renesas_usbhs: fix to avoid using a disabled ep in usbhsg_queue_done()
Yoshihiro Shimoda <[email protected]>
usb: renesas_usbhs: disable TX IRQ before starting TX DMAC transfer
Yoshihiro Shimoda <[email protected]>
usb: renesas_usbhs: avoid NULL pointer derefernce in usbhsf_pkt_handler()
Yong Li <[email protected]>
gpio: pca953x: Use correct u16 value for register word write
Michal Kazior <[email protected]>
mac80211: fix txq queue related crashes
Michal Kazior <[email protected]>
mac80211: fix unnecessary frame drops in mesh fwding
Sara Sharon <[email protected]>
mac80211: fix ibss scan parameters
Arnd Bergmann <[email protected]>
mac80211: avoid excessive stack usage in sta_info
Johannes Berg <[email protected]>
mac80211: properly deal with station hashtable insert errors
Michael S. Tsirkin <[email protected]>
virtio: virtio 1.0 cs04 spec compliance for reset
David Disseldorp <[email protected]>
rbd: use GFP_NOIO consistently for request allocations
Manuel Lauss <[email protected]>
pcmcia: db1xxx_ss: fix last irq_to_gpio user
Laurent Pinchart <[email protected]>
v4l: vsp1: Set the SRU CTRL0 register when starting the stream
Philipp Zabel <[email protected]>
coda: fix error path in case of missing pdata on non-DT platform
Mauro Carvalho Chehab <[email protected]>
au0828: Fix dev_state handling
Shuah Khan <[email protected]>
au0828: fix au0828_v4l2_close() dev_state race condition
Robert Jarzmik <[email protected]>
gpio: pxa: fix legacy non pinctrl aware builds
Vladimir Zapolskiy <[email protected]>
pinctrl: freescale: imx: fix bogus check of of_iomap() return value
Linus Walleij <[email protected]>
pinctrl: nomadik: fix pull debug print inversion
Hans de Goede <[email protected]>
pinctrl: sunxi: Fix A33 external interrupts not working
Wolfram Sang <[email protected]>
pinctrl: sh-pfc: only use dummy states for non-DT platforms
Govindraj Raja <[email protected]>
pinctrl: pistachio: fix mfio84-89 function description and pinmux.
Paul Burton <[email protected]>
MIPS: Fix MSA ld unaligned failure cases
Paolo Bonzini <[email protected]>
KVM: x86: reduce default value of halt_poll_ns parameter
Yuki Shibuya <[email protected]>
KVM: x86: Inject pending interrupt even if pending nmi exist
Hans de Goede <[email protected]>
USB: uas: Add a new NO_REPORT_LUNS quirk
Hans de Goede <[email protected]>
USB: uas: Limit qdepth at the scsi-host level
Roopa Prabhu <[email protected]>
mpls: find_outdev: check for err ptr in addition to NULL check
Jakub Sitnicki <[email protected]>
ipv6: Count in extension headers in skb->network_header
Thadeu Lima de Souza Cascardo <[email protected]>
ip6_tunnel: set rtnl_link_ops before calling register_netdevice
Haishuang Yan <[email protected]>
ipv6: l2tp: fix a potential issue in l2tp_ip6_recv
Haishuang Yan <[email protected]>
ipv4: l2tp: fix a potential issue in l2tp_ip_recv
Jason Wang <[email protected]>
tuntap: restore default qdisc
Daniel Borkmann <[email protected]>
tun, bpf: fix suspicious RCU usage in tun_{attach, detach}_filter
Nicolas Dichtel <[email protected]>
rtnl: fix msg size calculation in if_nlmsg_size()
Haishuang Yan <[email protected]>
bridge: Allow set bridge ageing time when switchdev disabled
Eric Dumazet <[email protected]>
ipv6: udp: fix UDP_MIB_IGNOREDMULTI updates
Bjørn Mork <[email protected]>
qmi_wwan: add "D-Link DWM-221 B1" device id
[email protected] <[email protected]>
xfrm: Fix crash observed during device unregistration and decryption
Guillaume Nault <[email protected]>
ppp: take reference on channels netns
Lance Richardson <[email protected]>
ipv4: initialize flowi4_flags before calling fib_lookup()
Paolo Abeni <[email protected]>
ipv4: fix broadcast packets reception
Eric Dumazet <[email protected]>
bonding: fix bond_get_stats()
Eric Dumazet <[email protected]>
net: bcmgenet: fix dma api length mismatch
Manish Chopra <[email protected]>
qlge: Fix receive packets drop.
Eric Dumazet <[email protected]>
tcp/dccp: remove obsolete WARN_ON() in icmp handlers
Guillaume Nault <[email protected]>
ppp: ensure file->private_data can't be overridden
Gregory CLEMENT <[email protected]>
net: mvneta: Fix spinlock usage
Arnd Bergmann <[email protected]>
ath9k: fix buffer overrun for ar9287
Arnd Bergmann <[email protected]>
farsync: fix off-by-one bug in fst_add_one
Arnd Bergmann <[email protected]>
mlx4: add missing braces in verify_qp_parameters
Arnaldo Carvalho de Melo <[email protected]>
net: Fix use after free in the recvmmsg exit path
David S. Miller <[email protected]>
ipv4: Don't do expensive useless work during inetdev destroy.
Stephen Hemminger <[email protected]>
bridge: allow zero ageing time
Ido Schimmel <[email protected]>
rocker: set FDB cleanup timer according to lowest ageing time
Ido Schimmel <[email protected]>
mlxsw: spectrum: Check requested ageing time is valid
Willem de Bruijn <[email protected]>
macvtap: always pass ethernet header in linear
Rajesh Borundia <[email protected]>
qlcnic: Fix mailbox completion handling during spurious interrupt
Rajesh Borundia <[email protected]>
qlcnic: Remove unnecessary usage of atomic_t
Sergei Shtylyov <[email protected]>
sh_eth: advance 'rxdesc' later in sh_eth_ring_format()
Sergei Shtylyov <[email protected]>
sh_eth: fix NULL pointer dereference in sh_eth_ring_format()
Neil Armstrong <[email protected]>
net: dsa: Fix cleanup resources upon module removal
Alexei Starovoitov <[email protected]>
bpf: avoid copying junk bytes in bpf_get_current_comm()
Willem de Bruijn <[email protected]>
packet: validate variable length ll headers
Willem de Bruijn <[email protected]>
ax25: add link layer header validation function
Willem de Bruijn <[email protected]>
net: validate variable length ll headers
Boris Ostrovsky <[email protected]>
xen/events: Mask a moving irq
Alex Deucher <[email protected]>
drm/amdgpu/gmc: use proper register for vram type on Fiji
Alex Deucher <[email protected]>
drm/amdgpu/gmc: move vram type fetching into sw_init
Rex Zhu <[email protected]>
drm/amd/powerplay: fix segment fault issue in multi-display case.
Alex Deucher <[email protected]>
drm/radeon: add a dpm quirk for all R7 370 parts
Alex Deucher <[email protected]>
drm/radeon: add another R7 370 quirk
Alex Deucher <[email protected]>
drm/radeon: add a dpm quirk for sapphire Dual-X R7 370 2G D5
Daniel Vetter <[email protected]>
drm/udl: Use unlocked gem unreferencing
Rob Clark <[email protected]>
drm/dp: move hw_mutex up the call stack
James Morse <[email protected]>
arm64: opcodes.h: Add arm big-endian config options before including arm header
Paolo Bonzini <[email protected]>
compiler-gcc: disable -ftracer for __noclone functions
Oliver O'Halloran <[email protected]>
powerpc/process: Fix altivec SPR not being saved
Dan Williams <[email protected]>
libnvdimm, pfn: fix uuid validation
Dan Williams <[email protected]>
libnvdimm: fix smart data retrieval
Gerald Schaefer <[email protected]>
s390/mm: handle PTE-mapped tail pages in fast gup
Sebastian Siewior <[email protected]>
powerpc/mm: Fixup preempt underflow with huge pages
Xishi Qiu <[email protected]>
mm: fix invalid node in alloc_migrate_target()
Hui Wang <[email protected]>
ALSA: hda - fix front mic problem for a HP desktop
Bobi Mihalca <[email protected]>
ALSA: hda - Apply fix for white noise on Asus N550JV, too
Bobi Mihalca <[email protected]>
ALSA: hda - Fix white noise on Asus N750JV headphone
Bobi Mihalca <[email protected]>
ALSA: hda - Asus N750JV external subwoofer fixup
Takashi Iwai <[email protected]>
ALSA: timer: Use mod_timer() for rearming the system timer
Helge Deller <[email protected]>
parisc: Unbreak handling exceptions from kernel modules
Helge Deller <[email protected]>
parisc: Fix kernel crash with reversed copy_from_user()
Helge Deller <[email protected]>
parisc: Avoid function pointers for kernel exception routines
Helge Deller <[email protected]>
parisc: Fix and enable seccomp filter support
Helge Deller <[email protected]>
parisc: Fix SIGSYS signals in compat case
Nicolai Stange <[email protected]>
PKCS#7: pkcs7_validate_trust(): initialize the _trusted output argument
Guenter Roeck <[email protected]>
hwmon: (max1111) Return -ENODEV from max1111_read_channel if not instantiated
-------------
Diffstat:
.../bindings/pinctrl/img,pistachio-pinctrl.txt | 12 +- Documentation/kernel-parameters.txt | 2 + Makefile | 4 +- arch/arm/kernel/setup.c | 2 + arch/arm64/include/asm/opcodes.h | 4 + arch/arm64/kernel/debug-monitors.c | 21 ++-- arch/mips/alchemy/devboards/db1000.c | 18 ++- arch/mips/alchemy/devboards/db1550.c | 4 +- arch/mips/kernel/unaligned.c | 51 ++++---- arch/parisc/Kconfig | 1 + arch/parisc/include/asm/compat.h | 7 ++ arch/parisc/include/asm/syscall.h | 13 ++ arch/parisc/include/asm/uaccess.h | 1 + arch/parisc/kernel/asm-offsets.c | 1 + arch/parisc/kernel/parisc_ksyms.c | 10 +- arch/parisc/kernel/ptrace.c | 9 +- arch/parisc/kernel/signal32.c | 5 + arch/parisc/kernel/syscall.S | 2 + arch/parisc/kernel/traps.c | 3 + arch/parisc/lib/fixup.S | 6 + arch/parisc/mm/fault.c | 1 + arch/powerpc/kernel/process.c | 2 +- arch/powerpc/mm/hugetlbpage.c | 4 +- arch/s390/mm/gup.c | 8 +- arch/x86/include/asm/kvm_host.h | 2 +- arch/x86/kvm/x86.c | 20 +-- crypto/asymmetric_keys/pkcs7_trust.c | 2 + drivers/block/rbd.c | 6 +- drivers/gpio/gpio-pca953x.c | 3 +- drivers/gpio/gpio-pxa.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c | 13 +- drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c | 16 +-- drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c | 23 ++-- drivers/gpu/drm/drm_dp_helper.c | 27 ++-- drivers/gpu/drm/radeon/si_dpm.c | 6 + drivers/gpu/drm/udl/udl_fb.c | 2 +- drivers/gpu/drm/udl/udl_gem.c | 2 +- drivers/hid/usbhid/hid-core.c | 73 +++++------ drivers/hid/wacom_wac.c | 11 ++ drivers/hwmon/max1111.c | 6 + drivers/iio/accel/bmc150-accel-core.c | 7 +- drivers/iio/gyro/bmg160_core.c | 9 +- drivers/iio/industrialio-buffer.c | 1 + drivers/iio/magnetometer/st_magn.h | 1 + drivers/iommu/iommu.c | 3 +- drivers/media/platform/coda/coda-common.c | 10 +- drivers/media/platform/vsp1/vsp1_sru.c | 1 + drivers/media/usb/au0828/au0828-core.c | 2 +- drivers/media/usb/au0828/au0828-input.c | 4 +- drivers/media/usb/au0828/au0828-video.c | 63 +++++----- drivers/media/usb/au0828/au0828.h | 9 +- drivers/mmc/host/sdhci-pci-core.c | 25 ++++ drivers/mmc/host/sdhci-pci.h | 3 + drivers/mmc/host/sdhci-pxav3.c | 22 ++++ drivers/mmc/host/sdhci.c | 39 ++++-- drivers/mmc/host/sdhci.h | 4 + drivers/net/bonding/bond_main.c | 65 +++++----- drivers/net/ethernet/broadcom/genet/bcmgenet.c | 4 +- drivers/net/ethernet/marvell/mvneta.c | 11 +- .../net/ethernet/mellanox/mlx4/resource_tracker.c | 3 +- drivers/net/ethernet/mellanox/mlxsw/spectrum.h | 2 + .../ethernet/mellanox/mlxsw/spectrum_switchdev.c | 9 +- drivers/net/ethernet/qlogic/qlcnic/qlcnic.h | 3 +- .../net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c | 24 ++-- .../net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c | 3 +- drivers/net/ethernet/qlogic/qlge/qlge_main.c | 11 ++ drivers/net/ethernet/renesas/sh_eth.c | 10 +- drivers/net/ethernet/rocker/rocker.c | 10 +- drivers/net/macvtap.c | 9 +- drivers/net/ppp/ppp_generic.c | 35 +++--- drivers/net/tun.c | 12 +- drivers/net/usb/qmi_wwan.c | 1 + drivers/net/wan/farsync.c | 2 +- drivers/net/wireless/ath/ath9k/eeprom.c | 7 +- drivers/nvdimm/bus.c | 2 +- drivers/nvdimm/pfn_devs.c | 2 +- drivers/pcmcia/db1xxx_ss.c | 11 +- drivers/pinctrl/freescale/pinctrl-imx.c | 17 ++- drivers/pinctrl/nomadik/pinctrl-nomadik.c | 2 +- drivers/pinctrl/pinctrl-pistachio.c | 24 ++-- drivers/pinctrl/sh-pfc/core.c | 4 +- drivers/pinctrl/sunxi/pinctrl-sun8i-a33.c | 1 + drivers/pinctrl/sunxi/pinctrl-sunxi.c | 17 +-- drivers/pinctrl/sunxi/pinctrl-sunxi.h | 21 ++-- drivers/scsi/scsi.c | 3 +- drivers/scsi/sd.c | 47 ++----- drivers/scsi/sd.h | 7 +- drivers/staging/android/ion/ion.c | 4 +- drivers/usb/renesas_usbhs/fifo.c | 4 +- drivers/usb/renesas_usbhs/mod_gadget.c | 6 +- drivers/usb/storage/uas.c | 21 +++- drivers/usb/storage/unusual_uas.h | 7 ++ drivers/usb/storage/usb.c | 5 +- drivers/virtio/virtio_pci_modern.c | 11 +- drivers/xen/events/events_base.c | 28 ++++- fs/btrfs/file.c | 2 +- fs/btrfs/tree-log.c | 137 +++++++++++++++++++++ fs/dcache.c | 5 +- fs/ext4/crypto.c | 12 +- fs/ext4/ext4.h | 23 ++++ fs/ext4/file.c | 12 +- fs/ext4/move_extent.c | 11 +- fs/ext4/super.c | 47 +++++-- fs/nfs/dir.c | 6 +- fs/nfs/inode.c | 2 +- fs/nfs/nfs4file.c | 4 +- fs/overlayfs/super.c | 33 +++++ include/linux/compiler-gcc.h | 2 +- include/linux/dcache.h | 10 ++ include/linux/filter.h | 4 + include/linux/fs.h | 10 ++ include/linux/if_bridge.h | 4 - include/linux/netdevice.h | 22 +++- include/linux/usb_usual.h | 2 + include/net/bonding.h | 1 + include/scsi/scsi_device.h | 25 ++++ kernel/bpf/helpers.c | 2 +- mm/page_isolation.c | 8 +- net/ax25/ax25_ip.c | 15 +++ net/bridge/br_stp.c | 13 +- net/core/filter.c | 33 +++-- net/core/rtnetlink.c | 1 + net/dccp/ipv4.c | 2 - net/dsa/dsa.c | 16 +-- net/ipv4/devinet.c | 4 + net/ipv4/fib_frontend.c | 20 +-- net/ipv4/netfilter/nf_nat_masquerade_ipv4.c | 12 +- net/ipv4/tcp_ipv4.c | 2 - net/ipv4/udp.c | 12 +- net/ipv6/ip6_output.c | 8 +- net/ipv6/ip6_tunnel.c | 2 +- net/ipv6/udp.c | 4 +- net/l2tp/l2tp_ip.c | 8 +- net/l2tp/l2tp_ip6.c | 8 +- net/mac80211/ibss.c | 22 ++-- net/mac80211/iface.c | 3 + net/mac80211/rx.c | 5 +- net/mac80211/sta_info.c | 37 ++++-- net/mpls/af_mpls.c | 3 + net/packet/af_packet.c | 37 +++--- net/socket.c | 38 +++--- net/xfrm/xfrm_input.c | 3 + sound/core/timer.c | 4 +- sound/pci/hda/patch_hdmi.c | 2 + sound/pci/hda/patch_realtek.c | 29 ++++- sound/usb/mixer_maps.c | 14 +++ sound/usb/quirks.c | 2 + 147 files changed, 1260 insertions(+), 558 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/124 hwmon: (max1111) Return -ENODEV from max1111_read_channel if not instantiated
4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <[email protected]>
commit 3c2e2266a5bd2d1cef258e6e54dca1d99946379f upstream.
arm:pxa_defconfig can result in the following crash if the max1111 driver is not instantiated.
Unhandled fault: page domain fault (0x01b) at 0x00000000 pgd = c0004000
[00000000] *pgd=00000000
Internal error: : 1b [#1] PREEMPT ARM Modules linked in: CPU: 0 PID: 300 Comm: kworker/0:1 Not tainted 4.5.0-01301-g1701f680407c #10 Hardware name: SHARP Akita Workqueue: events sharpsl_charge_toggle task: c390a000 ti: c391e000 task.ti: c391e000 PC is at max1111_read_channel+0x20/0x30 LR is at sharpsl_pm_pxa_read_max1111+0x2c/0x3c pc : [<c03aaab0>] lr : [<c0024b50>] psr: 20000013 ... [<c03aaab0>] (max1111_read_channel) from [<c0024b50>] (sharpsl_pm_pxa_read_max1111+0x2c/0x3c) [<c0024b50>] (sharpsl_pm_pxa_read_max1111) from [<c00262e0>] (spitzpm_read_devdata+0x5c/0xc4) [<c00262e0>] (spitzpm_read_devdata) from [<c0024094>] (sharpsl_check_battery_temp+0x78/0x110) [<c0024094>] (sharpsl_check_battery_temp) from [<c0024f9c>] (sharpsl_charge_toggle+0x48/0x110) [<c0024f9c>] (sharpsl_charge_toggle) from [<c004429c>] (process_one_work+0x14c/0x48c)
[<c004429c>] (process_one_work) from [<c0044618>] (worker_thread+0x3c/0x5d4) [<c0044618>] (worker_thread) from [<c004a238>] (kthread+0xd0/0xec) [<c004a238>] (kthread) from [<c000a670>] (ret_from_fork+0x14/0x24)
This can occur because the SPI controller driver (SPI_PXA2XX) is built as module and thus not necessarily loaded. While building SPI_PXA2XX into the kernel would make the problem disappear, it appears prudent to ensure that the driver is instantiated before accessing its data structures.
--- drivers/hwmon/max1111.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/hwmon/max1111.c +6 -0
@@ -85,6 +85,9 @@ static struct max1111_data *the_max1111;int max1111_read_channel (int channel) { +if (!the_max1111 || !the_max1111->spi) +return -ENODEV ; +return max1111_read (&the_max1111->spi->dev, channel); }EXPORT_SYMBOL (max1111_read_channel);
@@ -258,6 +261,9 @@ static int max1111_remove(struct spi_dev {struct max1111_data *data =spi_get_drvdata (spi); +#ifdef CONFIG_SHARPSL_PM + the_max1111 =NULL ; +#endif hwmon_device_unregister (data->hwmon_dev);sysfs_remove_group (&spi->dev.kobj, &max1110_attr_group);sysfs_remove_group (&spi->dev.kobj, &max1111_attr_group);
Greg Kroah-Hartman
maintainerPATCH 2/124 PKCS#7: pkcs7_validate_trust(): initialize the _trusted output argument
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolai Stange <[email protected]>
commit e54358915d0a00399c11c2c23ae1be674cba188a upstream.
Despite what the DocBook comment to pkcs7_validate_trust() says, the *_trusted argument is never set to false.
pkcs7_validate_trust() only positively sets *_trusted upon encountering a trusted PKCS#7 SignedInfo block.
This is quite unfortunate since its callers, system_verify_data() for example, depend on pkcs7_validate_trust() clearing *_trusted on non-trust.
Indeed, UBSAN splats when attempting to load the uninitialized local variable 'trusted' from system_verify_data() in pkcs7_validate_trust():
UBSAN: Undefined behaviour in crypto/asymmetric_keys/pkcs7_trust.c:194:14
load of value 82 is not a valid value for type '_Bool'
[...]
Call Trace:
[<ffffffff818c4d35>] dump_stack+0xbc/0x117
[<ffffffff818c4c79>] ? _atomic_dec_and_lock+0x169/0x169
[<ffffffff8194113b>] ubsan_epilogue+0xd/0x4e
[<ffffffff819419fa>] __ubsan_handle_load_invalid_value+0x111/0x158
[<ffffffff819418e9>] ? val_to_string.constprop.12+0xcf/0xcf
[<ffffffff818334a4>] ? x509_request_asymmetric_key+0x114/0x370
[<ffffffff814b83f0>] ? kfree+0x220/0x370
[<ffffffff818312c2>] ? public_key_verify_signature_2+0x32/0x50
[<ffffffff81835e04>] pkcs7_validate_trust+0x524/0x5f0
[<ffffffff813c391a>] system_verify_data+0xca/0x170
[<ffffffff813c3850>] ? top_trace_array+0x9b/0x9b
[<ffffffff81510b29>] ? __vfs_read+0x279/0x3d0
[<ffffffff8129372f>] mod_verify_sig+0x1ff/0x290
[...]The implication is that pkcs7_validate_trust() effectively grants trust when it really shouldn't have.
Fix this by explicitly setting *_trusted to false at the very beginning of pkcs7_validate_trust().
--- crypto/asymmetric_keys/pkcs7_trust.c | 2 ++ 1 file changed, 2 insertions(+)
crypto/asymmetric_keys/pkcs7_trust.c +2 -0
@@ -178,6 +178,8 @@ int pkcs7_validate_trust(struct pkcs7_meint cached_ret = -ENOKEY ;int ret; + *_trusted = false; +for (p = pkcs7->certs; p; p = p->next) p->seen = false;
Greg Kroah-Hartman
maintainerPATCH 3/124 parisc: Fix SIGSYS signals in compat case
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Helge Deller <[email protected]>
commit 4f4acc9472e54ce702f1d85fc9e6d57767dec91f upstream.
--- arch/parisc/include/asm/compat.h | 7 +++++++ arch/parisc/kernel/signal32.c | 5 +++++ 2 files changed, 12 insertions(+)
arch/parisc/include/asm/compat.h +7 -0
@@ -183,6 +183,13 @@ typedef struct compat_siginfo {int _band;/* POLL_IN, POLL_OUT, POLL_MSG */ int _fd; } _sigpoll; + +/* SIGSYS */ +struct { +compat_uptr_t _call_addr;/* calling user insn */ +int _syscall;/* triggering system call number */ +compat_uint_t _arch;/* AUDIT_ARCH_* of syscall */ + } _sigsys; } _sifields; } compat_siginfo_t;
arch/parisc/kernel/signal32.c +5 -0
@@ -371,6 +371,11 @@ copy_siginfo_to_user32 (compat_siginfo_t val = (compat_int_t )from->si_int; err |=__put_user (val, &to->si_int);break ; +case __SI_SYS >>16 : + err |=__put_user (ptr_to_compat (from->si_call_addr), &to->si_call_addr); + err |=__put_user (from->si_syscall, &to->si_syscall); + err |=__put_user (from->si_arch, &to->si_arch); +break ; } }return err;
Greg Kroah-Hartman
maintainerPATCH 4/124 parisc: Fix and enable seccomp filter support
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Helge Deller <[email protected]>
commit 910cd32e552ea09caa89cdbe328e468979b030dd upstream.
The seccomp filter support requires careful handling of task registers. This includes reloading of the return value (%r28) and proper syscall exit if secure_computing() returned -1.
Additionally we need to sign-extend the syscall number from signed 32bit to signed 64bit in do_syscall_trace_enter() since the ptrace interface only allows storing 32bit values in compat mode.
--- arch/parisc/Kconfig | 1 + arch/parisc/include/asm/syscall.h | 13 +++++++++++++ arch/parisc/kernel/ptrace.c | 9 +++++++-- arch/parisc/kernel/syscall.S | 2 ++ 4 files changed, 23 insertions(+), 2 deletions(-)
arch/parisc/Kconfig +1 -0
@@ -29,6 +29,7 @@ config PARISC select TTY # Needed for pdc_cons.c select HAVE_DEBUG_STACKOVERFLOW select HAVE_ARCH_AUDITSYSCALL + select HAVE_ARCH_SECCOMP_FILTER select ARCH_NO_COHERENT_DMA_MMAP help
arch/parisc/include/asm/syscall.h +13 -0
@@ -39,6 +39,19 @@ static inline void syscall_get_arguments } } +static inline void syscall_set_return_value (struct task_struct *task, +struct pt_regs *regs, +int error,long val) +{ + regs->gr[28 ] = error ? error : val; +} + +static inline void syscall_rollback (struct task_struct *task, +struct pt_regs *regs) +{ +/* do nothing */ +} +static inline int syscall_get_arch (void ) {int arch =AUDIT_ARCH_PARISC ;
arch/parisc/kernel/ptrace.c +7 -2
@@ -270,7 +270,8 @@ long compat_arch_ptrace(struct task_strulong do_syscall_trace_enter (struct pt_regs *regs) {/* Do the secure computing check first. */ -secure_computing_strict (regs->gr[20 ]); +if (secure_computing () ==-1 ) +return -1 ;if (test_thread_flag (TIF_SYSCALL_TRACE ) &&tracehook_report_syscall_entry (regs)) {
@@ -296,7 +297,11 @@ long do_syscall_trace_enter(struct pt_re regs->gr[23] & 0xffffffff); out: -return regs->gr[20 ]; +/* +* Sign extend the syscall number to 64bit since it may have been +* modified by a compat ptrace call +*/ +return (int ) ((u32 ) regs->gr[20 ]); }void do_syscall_trace_exit (struct pt_regs *regs)
arch/parisc/kernel/syscall.S +2 -0
@@ -329,6 +329,7 @@ tracesys_next: ldo -THREAD_SZ_ALGN-FRAME_SIZE(%r30),%r1 /* get task ptr */ LDREG TI_TASK(%r1), %r1 + LDREG TASK_PT_GR28(%r1), %r28 /* Restore return value */ LDREG TASK_PT_GR26(%r1), %r26 /* Restore the users args */ LDREG TASK_PT_GR25(%r1), %r25 LDREG TASK_PT_GR24(%r1), %r24
@@ -342,6 +343,7 @@ tracesys_next: stw %r21, -56(%r30) /* 6th argument */ #endif + cmpib,COND(=),n -1,%r20,tracesys_exit /* seccomp may have returned -1 */ comiclr,>>= __NR_Linux_syscalls, %r20, %r0 b,n .Ltracesys_nosys
Greg Kroah-Hartman
maintainerPATCH 5/124 parisc: Avoid function pointers for kernel exception routines
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Helge Deller <[email protected]>
commit e3893027a300927049efc1572f852201eb785142 upstream.
We want to avoid the kernel module loader to create function pointers for the kernel fixup routines of get_user() and put_user(). Changing the external reference from function type to int type fixes this.
This unbreaks exception handling for get_user() and put_user() when called from a kernel module.
--- arch/parisc/kernel/parisc_ksyms.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
arch/parisc/kernel/parisc_ksyms.c +5 -5
@@ -47,11 +47,11 @@ EXPORT_SYMBOL(__cmpxchg_u64);EXPORT_SYMBOL (lclear_user);EXPORT_SYMBOL (lstrnlen_user); -/* Global fixups */ -extern void fixup_get_user_skip_1 (void ); -extern void fixup_get_user_skip_2 (void ); -extern void fixup_put_user_skip_1 (void ); -extern void fixup_put_user_skip_2 (void ); +/* Global fixups - defined as int to avoid creation of function pointers */ +extern int fixup_get_user_skip_1; +extern int fixup_get_user_skip_2; +extern int fixup_put_user_skip_1; +extern int fixup_put_user_skip_2;EXPORT_SYMBOL (fixup_get_user_skip_1);EXPORT_SYMBOL (fixup_get_user_skip_2);EXPORT_SYMBOL (fixup_put_user_skip_1);
Greg Kroah-Hartman
maintainerPATCH 6/124 parisc: Fix kernel crash with reversed copy_from_user()
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Helge Deller <[email protected]>
commit ef72f3110d8b19f4c098a0bff7ed7d11945e70c6 upstream.
The kernel module testcase (lib/test_user_copy.c) exhibited a kernel crash on parisc if the parameters for copy_from_user were reversed ("illegal reversed copy_to_user" testcase).
Fix this potential crash by checking the fault handler if the faulting address is in the exception table.
--- arch/parisc/kernel/traps.c | 3 +++ 1 file changed, 3 insertions(+)
arch/parisc/kernel/traps.c +3 -0
@@ -798,6 +798,9 @@ void notrace handle_interruption(int codif (fault_space ==0 && !faulthandler_disabled ()) { +/* Clean up and return if in exception table. */ +if (fixup_exception (regs)) +return ;pdc_chassis_send_status (PDC_CHASSIS_DIRECT_PANIC );parisc_terminate ("Kernel Fault" , regs, code, fault_address); }
Greg Kroah-Hartman
maintainerPATCH 7/124 parisc: Unbreak handling exceptions from kernel modules
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Helge Deller <[email protected]>
commit 2ef4dfd9d9f288943e249b78365a69e3ea3ec072 upstream.
Handling exceptions from modules never worked on parisc. It was just masked by the fact that exceptions from modules don't happen during normal use.
When a module triggers an exception in get_user() we need to load the main kernel dp value before accessing the exception_data structure, and afterwards restore the original dp value of the module on exit.
--- arch/parisc/include/asm/uaccess.h | 1 + arch/parisc/kernel/asm-offsets.c | 1 + arch/parisc/lib/fixup.S | 6 ++++++ arch/parisc/mm/fault.c | 1 + 4 files changed, 9 insertions(+)
arch/parisc/include/asm/uaccess.h +1 -0
@@ -76,6 +76,7 @@ struct exception_table_entry {*/ struct exception_data {unsigned long fault_ip; +unsigned long fault_gp;unsigned long fault_space;unsigned long fault_addr; };
arch/parisc/kernel/asm-offsets.c +1 -0
@@ -299,6 +299,7 @@ int main(void)#endif BLANK ();DEFINE (EXCDATA_IP , offsetof(struct exception_data , fault_ip)); +DEFINE (EXCDATA_GP , offsetof(struct exception_data , fault_gp));DEFINE (EXCDATA_SPACE , offsetof(struct exception_data , fault_space));DEFINE (EXCDATA_ADDR , offsetof(struct exception_data , fault_addr));BLANK ();
arch/parisc/lib/fixup.S +6 -0
@@ -26,6 +26,7 @@ #ifdef CONFIG_SMP .macro get_fault_ip t1 t2 + loadgp addil LT%__per_cpu_offset,%r27 LDREG RT%__per_cpu_offset(%r1),\t1 /* t2 = smp_processor_id() */
@@ -40,14 +41,19 @@ LDREG RT%exception_data(%r1),\t1 /* t1 = this_cpu_ptr(&exception_data) */ add,l \t1,\t2,\t1 + /* %r27 = t1->fault_gp - restore gp */ + LDREG EXCDATA_GP(\t1), %r27 /* t1 = t1->fault_ip */ LDREG EXCDATA_IP(\t1), \t1 .endm #else .macro get_fault_ip t1 t2 + loadgp /* t1 = this_cpu_ptr(&exception_data) */ addil LT%exception_data,%r27 LDREG RT%exception_data(%r1),\t2 + /* %r27 = t2->fault_gp - restore gp */ + LDREG EXCDATA_GP(\t2), %r27 /* t1 = t2->fault_ip */ LDREG EXCDATA_IP(\t2), \t1 .endm
arch/parisc/mm/fault.c +1 -0
@@ -151,6 +151,7 @@ int fixup_exception(struct pt_regs *regsstruct exception_data *d; d =this_cpu_ptr (&exception_data); d->fault_ip = regs->iaoq[0 ]; + d->fault_gp = regs->gr[27 ]; d->fault_space = regs->isr; d->fault_addr = regs->ior;
Greg Kroah-Hartman
maintainerPATCH 8/124 ALSA: timer: Use mod_timer() for rearming the system timer
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 4a07083ed613644c96c34a7dd2853dc5d7c70902 upstream.
ALSA system timer backend stops the timer via del_timer() without sync and leaves del_timer_sync() at the close instead. This is because of the restriction by the design of ALSA timer: namely, the stop callback may be called from the timer handler, and calling the sync shall lead to a hangup. However, this also triggers a kernel BUG() when the timer is rearmed immediately after stopping without sync:
kernel BUG at kernel/time/timer.c:966!
Call Trace: <IRQ> [<ffffffff8239c94e>] snd_timer_s_start+0x13e/0x1a0 [<ffffffff8239e1f4>] snd_timer_interrupt+0x504/0xec0 [<ffffffff8122fca0>] ? debug_check_no_locks_freed+0x290/0x290 [<ffffffff8239ec64>] snd_timer_s_function+0xb4/0x120 [<ffffffff81296b72>] call_timer_fn+0x162/0x520 [<ffffffff81296add>] ? call_timer_fn+0xcd/0x520 [<ffffffff8239ebb0>] ? snd_timer_interrupt+0xec0/0xec0 ....
It's the place where add_timer() checks the pending timer. It's clear that this may happen after the immediate restart without sync in our cases.
So, the workaround here is just to use mod_timer() instead of add_timer(). This looks like a band-aid fix, but it's a right move, as snd_timer_interrupt() takes care of the continuous rearm of timer.
--- sound/core/timer.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/core/timer.c +2 -2
@@ -1041,8 +1041,8 @@ static int snd_timer_s_start(struct snd_ njiff += timer->sticks - priv->correction; priv->correction =0 ; } - priv->last_expires = priv->tlist.expires = njiff; -add_timer (&priv->tlist); + priv->last_expires = njiff; +mod_timer (&priv->tlist, njiff);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 9/124 ALSA: hda - Asus N750JV external subwoofer fixup
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bobi Mihalca <[email protected]>
commit 70cf2cbd685e218c3ffd105d9fb6cf0f8d767481 upstream.
ASUS N750JV needs the same fixup as N550 for enabling its subwoofer.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=115181
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -6670,6 +6670,7 @@ static const struct snd_pci_quirk alc662SND_PCI_QUIRK (0x103c ,0x1632 ,"HP RP5800" ,ALC662_FIXUP_HP_RP5800 ),SND_PCI_QUIRK (0x1043 ,0x11cd ,"Asus N550" ,ALC662_FIXUP_BASS_1A ),SND_PCI_QUIRK (0x1043 ,0x13df ,"Asus N550JX" ,ALC662_FIXUP_BASS_1A ), +SND_PCI_QUIRK (0x1043 ,0x129d ,"Asus N750" ,ALC662_FIXUP_BASS_1A ),SND_PCI_QUIRK (0x1043 ,0x1477 ,"ASUS N56VZ" ,ALC662_FIXUP_BASS_MODE4_CHMAP ),SND_PCI_QUIRK (0x1043 ,0x15a7 ,"ASUS UX51VZH" ,ALC662_FIXUP_BASS_16 ), SND_PCI_QUIRK(0x1043, 0x1b73, "ASUS N55SF", ALC662_FIXUP_BASS_16),
Greg Kroah-Hartman
maintainerPATCH 10/124 ALSA: hda - Fix white noise on Asus N750JV headphone
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bobi Mihalca <[email protected]>
commit 9d4dc5840f93bcb002fa311693349deae7702bc5 upstream.
For reducing the noise from the headphone output on ASUS N750JV, call the existing fixup, alc_fixup_auto_mute_via_amp(), additionally.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=115181
--- sound/pci/hda/patch_realtek.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
sound/pci/hda/patch_realtek.c +8 -1
@@ -6406,6 +6406,7 @@ enum {ALC668_FIXUP_AUTO_MUTE ,ALC668_FIXUP_DELL_DISABLE_AAMIX ,ALC668_FIXUP_DELL_XPS13 , + ALC662_FIXUP_ASUS_Nx50, }; static const struct hda_fixup alc662_fixups[] = {
@@ -6646,6 +6647,12 @@ static const struct hda_fixup alc662_fix .type = HDA_FIXUP_FUNC, .v.func = alc_fixup_bass_chmap, }, + [ALC662_FIXUP_ASUS_Nx50] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc_fixup_auto_mute_via_amp, + .chained = true, + .chain_id =ALC662_FIXUP_BASS_1A + }, };static const struct snd_pci_quirk alc662_fixup_tbl[] = {
@@ -6670,7 +6677,7 @@ static const struct snd_pci_quirk alc662SND_PCI_QUIRK (0x103c ,0x1632 ,"HP RP5800" ,ALC662_FIXUP_HP_RP5800 ),SND_PCI_QUIRK (0x1043 ,0x11cd ,"Asus N550" ,ALC662_FIXUP_BASS_1A ),SND_PCI_QUIRK (0x1043 ,0x13df ,"Asus N550JX" ,ALC662_FIXUP_BASS_1A ), -SND_PCI_QUIRK (0x1043 ,0x129d ,"Asus N750" ,ALC662_FIXUP_BASS_1A ), +SND_PCI_QUIRK (0x1043 ,0x129d ,"Asus N750" , ALC662_FIXUP_ASUS_Nx50),SND_PCI_QUIRK (0x1043 ,0x1477 ,"ASUS N56VZ" ,ALC662_FIXUP_BASS_MODE4_CHMAP ),SND_PCI_QUIRK (0x1043 ,0x15a7 ,"ASUS UX51VZH" ,ALC662_FIXUP_BASS_16 ), SND_PCI_QUIRK(0x1043, 0x1b73, "ASUS N55SF", ALC662_FIXUP_BASS_16),
Greg Kroah-Hartman
maintainerPATCH 11/124 ALSA: hda - Apply fix for white noise on Asus N550JV, too
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bobi Mihalca <[email protected]>
commit 83a9efb5b8170b7cffef4f62656656e1d8ad2ccd upstream.
Apply the new fixup that is used for ASUS N750JV to another similar model, N500JV, too, for reducing the headphone noise.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=115181
--- sound/pci/hda/patch_realtek.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/pci/hda/patch_realtek.c +1 -1
@@ -6675,7 +6675,7 @@ static const struct snd_pci_quirk alc662SND_PCI_QUIRK (0x1028 ,0x0698 ,"Dell" ,ALC668_FIXUP_DELL_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1028 ,0x069f ,"Dell" ,ALC668_FIXUP_DELL_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x103c ,0x1632 ,"HP RP5800" ,ALC662_FIXUP_HP_RP5800 ), -SND_PCI_QUIRK (0x1043 ,0x11cd ,"Asus N550" ,ALC662_FIXUP_BASS_1A ), +SND_PCI_QUIRK (0x1043 ,0x11cd ,"Asus N550" , ALC662_FIXUP_ASUS_Nx50),SND_PCI_QUIRK (0x1043 ,0x13df ,"Asus N550JX" ,ALC662_FIXUP_BASS_1A ),SND_PCI_QUIRK (0x1043 ,0x129d ,"Asus N750" , ALC662_FIXUP_ASUS_Nx50), SND_PCI_QUIRK(0x1043, 0x1477, "ASUS N56VZ", ALC662_FIXUP_BASS_MODE4_CHMAP),
Greg Kroah-Hartman
maintainerPATCH 12/124 ALSA: hda - fix front mic problem for a HP desktop
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hui Wang <[email protected]>
commit e549d190f7b5f94e9ab36bd965028112914d010d upstream.
The front mic jack (pink color) can't detect any plug or unplug. After applying this fix, both detecting function and recording function work well.
--- sound/pci/hda/patch_realtek.c | 9 +++++++++ 1 file changed, 9 insertions(+)
sound/pci/hda/patch_realtek.c +9 -0
@@ -4759,6 +4759,7 @@ enum {ALC255_FIXUP_DELL_SPK_NOISE ,ALC225_FIXUP_DELL1_MIC_NO_PRESENCE ,ALC280_FIXUP_HP_HEADSET_MIC , + ALC221_FIXUP_HP_FRONT_MIC, }; static const struct hda_fixup alc269_fixups[] = {
@@ -5401,6 +5402,13 @@ static const struct hda_fixup alc269_fix .chained = true, .chain_id = ALC269_FIXUP_HEADSET_MIC, }, + [ALC221_FIXUP_HP_FRONT_MIC] = { + .type = HDA_FIXUP_PINS, + .v.pins = (const struct hda_pintbl []) { + {0x19 ,0x02a19020 },/* Front Mic */ + { } + }, + }, };static const struct snd_pci_quirk alc269_fixup_tbl[] = {
@@ -5506,6 +5514,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x103c ,0x2336 ,"HP" ,ALC269_FIXUP_HP_MUTE_LED_MIC1 ),SND_PCI_QUIRK (0x103c ,0x2337 ,"HP" ,ALC269_FIXUP_HP_MUTE_LED_MIC1 ),SND_PCI_QUIRK (0x103c ,0x221c ,"HP EliteBook 755 G2" ,ALC280_FIXUP_HP_HEADSET_MIC ), +SND_PCI_QUIRK (0x103c ,0x8256 ,"HP" ,ALC221_FIXUP_HP_FRONT_MIC ),SND_PCI_QUIRK (0x1043 ,0x103f ,"ASUS TX300" ,ALC282_FIXUP_ASUS_TX300 ),SND_PCI_QUIRK (0x1043 ,0x106d ,"Asus K53BE" ,ALC269_FIXUP_LIMIT_INT_MIC_BOOST ), SND_PCI_QUIRK(0x1043, 0x115d, "Asus 1015E", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
Greg Kroah-Hartman
maintainerPATCH 13/124 mm: fix invalid node in alloc_migrate_target()
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xishi Qiu <[email protected]>
commit 6f25a14a7053b69917e2ebea0d31dd444cd31fd5 upstream.
It is incorrect to use next_node to find a target node, it will return MAX_NUMNODES or invalid node. This will lead to crash in buddy system allocation.
--- mm/page_isolation.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
mm/page_isolation.c +4 -4
@@ -289,11 +289,11 @@ struct page *alloc_migrate_target(struct* now as a simple work-around, we use the next node for destination. */ if (PageHuge (page)) { -nodemask_t src =nodemask_of_node (page_to_nid (page)); -nodemask_t dst; -nodes_complement (dst, src); +int node =next_online_node (page_to_nid (page)); +if (node ==MAX_NUMNODES ) + node = first_online_node;return alloc_huge_page_node (page_hstate (compound_head (page)), -next_node (page_to_nid (page), dst)); + node); }if (PageHighMem (page))
Greg Kroah-Hartman
maintainerPATCH 14/124 powerpc/mm: Fixup preempt underflow with huge pages
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Siewior <[email protected]>
commit 08a5bb2921e490939f78f38fd0d02858bb709942 upstream.
hugepd_free() used __get_cpu_var() once. Nothing ensured that the code accessing the variable did not migrate from one CPU to another and soon this was noticed by Tiejun Chen in 94b09d755462 ("powerpc/hugetlb:
Replace __get_cpu_var with get_cpu_var"). So we had it fixed.
Christoph Lameter was doing his __get_cpu_var() replaces and forgot PowerPC. Then he noticed this and sent his fixed up batch again which got applied as 69111bac42f5 ("powerpc: Replace __get_cpu_var uses").
The careful reader will noticed one little detail: get_cpu_var() got replaced with this_cpu_ptr(). So now we have a put_cpu_var() which does a preempt_enable() and nothing that does preempt_disable() so we underflow the preempt counter.
--- arch/powerpc/mm/hugetlbpage.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/powerpc/mm/hugetlbpage.c +2 -2
@@ -414,13 +414,13 @@ static void hugepd_free(struct mmu_gathe {struct hugepd_freelist **batchp; - batchp =this_cpu_ptr (&hugepd_freelist_cur); + batchp = &get_cpu_var (hugepd_freelist_cur);if (atomic_read (&tlb->mm->mm_users) <2 ||cpumask_equal (mm_cpumask (tlb->mm),cpumask_of (smp_processor_id ()))) {kmem_cache_free (hugepte_cache, hugepte); -put_cpu_var (hugepd_freelist_cur); +put_cpu_var (hugepd_freelist_cur);return ; }
Greg Kroah-Hartman
maintainerPATCH 15/124 s390/mm: handle PTE-mapped tail pages in fast gup
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gerald Schaefer <[email protected]>
commit fc897c95e91451271cd707ee0f71022b9b201ce9 upstream.
With the THP refcounting rework it is possible to see THP compound tail pages mapped with PTEs during a THP split. This needs to be considered when using page_cache_get_speculative(), which will always fail on tail pages because ->_count is always zero. commit 7aef4172 "mm: handle PTE-mapped tail pages in gerneric fast gup implementaiton" fixed it for the generic fast gup code by using compound_head(page) instead of page, but not for s390.
This patch is a 1:1 adaption of commit 7aef4172 for the s390 fast gup code. Without this fix, gup will fall back to the slow path or fail in the unlikely scenario that we hit a THP under splitting in-between the page table split and the compound page split.
--- arch/s390/mm/gup.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
arch/s390/mm/gup.c +5 -3
@@ -20,9 +20,9 @@static inline int gup_pte_range (pmd_t *pmdp,pmd_t pmd,unsigned long addr,unsigned long end,int write,struct page **pages,int *nr) { +struct page *head, *page;unsigned long mask;pte_t *ptep, pte; -struct page *page; mask = (write ? _PAGE_PROTECT :0 ) | _PAGE_INVALID | _PAGE_SPECIAL;
@@ -37,12 +37,14 @@ static inline int gup_pte_range(pmd_t *preturn 0 ;VM_BUG_ON (!pfn_valid (pte_pfn (pte))); page =pte_page (pte); -if (!page_cache_get_speculative (page)) + head =compound_head (page); +if (!page_cache_get_speculative (head))return 0 ;if (unlikely (pte_val (pte) !=pte_val (*ptep))) { -put_page (page); +put_page (head);return 0 ; } +VM_BUG_ON_PAGE (compound_head (page) != head, page); pages[*nr] = page; (*nr)++;
Greg Kroah-Hartman
maintainerPATCH 16/124 libnvdimm: fix smart data retrieval
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Williams <[email protected]>
commit 211291126698c8f047617565b2e2e7f822f86354 upstream.
It appears that smart data retrieval has been broken the since the initial implementation. Fix the payload size to be 128-bytes per the specification.
--- drivers/nvdimm/bus.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/nvdimm/bus.c +1 -1
@@ -335,7 +335,7 @@ static const struct nd_cmd_desc __nd_cmd [ND_CMD_IMPLEMENTED] = { }, [ND_CMD_SMART] = { .out_num = 2, - .out_sizes = { 4, 8, }, + .out_sizes = { 4, 128, }, }, [ND_CMD_SMART_THRESHOLD] = { .out_num = 2,
Greg Kroah-Hartman
maintainerPATCH 17/124 libnvdimm, pfn: fix uuid validation
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Williams <[email protected]>
commit e5670563f588ed1c0603819350c0f02cec23f5c5 upstream.
If we detect a namespace has a stale info block in the init path, we should overwrite with the latest configuration. In fact, we already return -ENODEV when the parent uuid is invalid, the same should be done for the 'self' uuid. Otherwise we can get into a condition where userspace is unable to reconfigure the pfn-device without directly / manually invalidating the info block.
--- drivers/nvdimm/pfn_devs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/nvdimm/pfn_devs.c +1 -1
@@ -315,7 +315,7 @@ int nd_pfn_validate(struct nd_pfn *nd_pf }else {/* from init we validate */ if (memcmp (nd_pfn->uuid, pfn_sb->uuid,16 ) !=0 ) -return -EINVAL ; +return -ENODEV ; }if (nd_pfn->align >nvdimm_namespace_capacity (ndns)) {
Greg Kroah-Hartman
maintainerPATCH 18/124 powerpc/process: Fix altivec SPR not being saved
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver O'Halloran <[email protected]>
commit 01d7c2a2de47890934faba91a71d183795e4348d upstream.
In save_sprs() in process.c contains the following test:
if (cpu_has_feature(cpu_has_feature(CPU_FTR_ALTIVEC))) t->vrsave = mfspr(SPRN_VRSAVE);
CPU feature with the mask 0x1 is CPU_FTR_COHERENT_ICACHE so the test is equivilent to:
if (cpu_has_feature(CPU_FTR_ALTIVEC) && cpu_has_feature(CPU_FTR_COHERENT_ICACHE))
On CPUs without support for both (i.e G5) this results in vrsave not being saved between context switches. The vector register save/restore code doesn't use VRSAVE to determine which registers to save/restore, but the value of VRSAVE is used to determine if altivec is being used in several code paths.
--- arch/powerpc/kernel/process.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/kernel/process.c +1 -1
@@ -854,7 +854,7 @@ void restore_tm_state(struct pt_regs *restatic inline void save_sprs (struct thread_struct *t) {#ifdef CONFIG_ALTIVEC -if (cpu_has_feature (cpu_has_feature (CPU_FTR_ALTIVEC ))) +if (cpu_has_feature (CPU_FTR_ALTIVEC )) t->vrsave =mfspr (SPRN_VRSAVE );#endif #ifdef CONFIG_PPC_BOOK3S_64
Greg Kroah-Hartman
maintainerPATCH 19/124 compiler-gcc: disable -ftracer for __noclone functions
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Bonzini <[email protected]>
commit 95272c29378ee7dc15f43fa2758cb28a5913a06d upstream.
-ftracer can duplicate asm blocks causing compilation to fail in noclone functions. For example, KVM declares a global variable in an asm like
asm("2: ... \n
.pushsection data \n
.global vmx_return \n
vmx_return: .long 2b");
and -ftracer causes a double declaration.
--- include/linux/compiler-gcc.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/compiler-gcc.h +1 -1
@@ -199,7 +199,7 @@#define unreachable () __builtin_unreachable()/* Mark a function definition as prohibited from being cloned. */ -#define __noclone __attribute__((__noclone__)) +#define __noclone __attribute__((__noclone__, __optimize__("no-tracer")))#endif /* GCC_VERSION >= 40500 */
Greg Kroah-Hartman
maintainerPATCH 20/124 arm64: opcodes.h: Add arm big-endian config options before including arm header
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Morse <[email protected]>
commit a6002ec5a8c68e69706b2efd6db6d682d0ab672c upstream.
arm and arm64 use different config options to specify big endian. This needs taking into account when including code/headers between the two architectures.
A case in point is PAN, which uses the __instr_arm() macro to output instructions. The macro comes from opcodes.h, which lives under arch/arm. On a big-endian build the mismatched config options mean the instruction isn't byte swapped correctly, resulting in undefined instruction exceptions during boot:
| alternatives: patching kernel code | kdevtmpfs[87]: undefined instruction: pc=ffffffc0004505b4 | kdevtmpfs[87]: undefined instruction: pc=ffffffc00076231c | kdevtmpfs[87]: undefined instruction: pc=ffffffc00076231c | kdevtmpfs[87]: undefined instruction: pc=ffffffc00076231c | kdevtmpfs[87]: undefined instruction: pc=ffffffc00076231c | kdevtmpfs[87]: undefined instruction: pc=ffffffc00076231c | kdevtmpfs[87]: undefined instruction: pc=ffffffc00076231c | kdevtmpfs[87]: undefined instruction: pc=ffffffc00076231c | kdevtmpfs[87]: undefined instruction: pc=ffffffc00076231c | kdevtmpfs[87]: undefined instruction: pc=ffffffc00076231c | Internal error: Oops - undefined instruction: 0 [#1] SMP | Modules linked in: | CPU: 0 PID: 87 Comm: kdevtmpfs Not tainted 4.1.16+ #5 | Hardware name: Hisilicon PhosphorHi1382 EVB (DT) | task: ffffffc336591700 ti: ffffffc3365a4000 task.ti: ffffffc3365a4000 | PC is at dump_instr+0x68/0x100 | LR is at do_undefinstr+0x1d4/0x2a4 | pc : [<ffffffc00076231c>] lr : [<ffffffc0000811d4>] pstate: 604001c5 | sp : ffffffc3365a6450
--- arch/arm64/include/asm/opcodes.h | 4 ++++ 1 file changed, 4 insertions(+)
arch/arm64/include/asm/opcodes.h +4 -0
@@ -1 +1,5 @@ +#ifdef CONFIG_CPU_BIG_ENDIAN +#define CONFIG_CPU_ENDIAN_BE8 CONFIG_CPU_BIG_ENDIAN +#endif +#include <../../arm/include/asm/opcodes.h>
Greg Kroah-Hartman
maintainerPATCH 22/124 drm/udl: Use unlocked gem unreferencing
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Vetter <[email protected]>
commit 72b9ff0612ad8fc969b910cd00ac16b57a1a9ba4 upstream.
For drm_gem_object_unreference callers are required to hold dev->struct_mutex, which these paths don't. Enforcing this requirement has become a bit more strict with
commit ef4c6270bf2867e2f8032e9614d1a8cfc6c71663
Author: Daniel Vetter <[email protected]> Date: Thu Oct 15 09:36:25 2015 +0200
drm/gem: Check locking in drm_gem_object_unreference
--- drivers/gpu/drm/udl/udl_fb.c | 2 +- drivers/gpu/drm/udl/udl_gem.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/udl/udl_fb.c +1 -1
@@ -538,7 +538,7 @@ static int udlfb_create(struct drm_fb_he out_destroy_fbi:drm_fb_helper_release_fbi (helper); out_gfree: -drm_gem_object_unreference (&ufbdev->ufb.obj->base); +drm_gem_object_unreference_unlocked (&ufbdev->ufb.obj->base); out:return ret; }
drivers/gpu/drm/udl/udl_gem.c +1 -1
@@ -52,7 +52,7 @@ udl_gem_create(struct drm_file *file,return ret; } -drm_gem_object_unreference (&obj->base); +drm_gem_object_unreference_unlocked (&obj->base); *handle_p = handle;return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 23/124 drm/radeon: add a dpm quirk for sapphire Dual-X R7 370 2G D5
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit f971f2263deaa4a441e377b385c11aee0f3b3f9a upstream.
bug:
https://bugs.freedesktop.org/show_bug.cgi?id=94692
--- drivers/gpu/drm/radeon/si_dpm.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/radeon/si_dpm.c +1 -0
@@ -2926,6 +2926,7 @@ static struct si_dpm_quirk si_dpm_quirk_/* PITCAIRN - https://bugs.freedesktop.org/show_bug.cgi?id=76490 */ { PCI_VENDOR_ID_ATI, 0x6810, 0x1462, 0x3036, 0, 120000 }, { PCI_VENDOR_ID_ATI, 0x6811, 0x174b, 0xe271, 0, 120000 }, + { PCI_VENDOR_ID_ATI, 0x6811, 0x174b, 0x2015, 0, 120000 }, { PCI_VENDOR_ID_ATI, 0x6810, 0x174b, 0xe271, 85000, 90000 }, { PCI_VENDOR_ID_ATI, 0x6811, 0x1462, 0x2015, 0, 120000 }, { PCI_VENDOR_ID_ATI, 0x6811, 0x1043, 0x2015, 0, 120000 },
Greg Kroah-Hartman
maintainerPATCH 24/124 drm/radeon: add another R7 370 quirk
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit a64663d9870364bd2a2df62bf0d3a9fbe5ea62a8 upstream.
bug:
https://bugzilla.kernel.org/show_bug.cgi?id=115291
--- drivers/gpu/drm/radeon/si_dpm.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/radeon/si_dpm.c +1 -0
@@ -2930,6 +2930,7 @@ static struct si_dpm_quirk si_dpm_quirk_ { PCI_VENDOR_ID_ATI, 0x6810, 0x174b, 0xe271, 85000, 90000 }, { PCI_VENDOR_ID_ATI, 0x6811, 0x1462, 0x2015, 0, 120000 }, { PCI_VENDOR_ID_ATI, 0x6811, 0x1043, 0x2015, 0, 120000 }, + { PCI_VENDOR_ID_ATI, 0x6811, 0x148c, 0x2015, 0, 120000 }, { 0, 0, 0, 0 }, };
Greg Kroah-Hartman
maintainerPATCH 25/124 drm/radeon: add a dpm quirk for all R7 370 parts
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit 0e5585dc870af947fab2af96a88c2d8b4270247c upstream.
Higher mclk values are not stable due to a bug somewhere. Limit them for now.
--- drivers/gpu/drm/radeon/si_dpm.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/gpu/drm/radeon/si_dpm.c +4 -0
@@ -3010,6 +3010,10 @@ static void si_apply_state_adjust_rules( } ++p; } +/* limit mclk on all R7 370 parts for stability */ +if (rdev->pdev->device ==0x6811 && + rdev->pdev->revision ==0x81 ) + max_mclk =120000 ;if (rps->vce_active) { rps->evclk = rdev->pm.dpm.vce_states[rdev->pm.dpm.vce_level].evclk;
Greg Kroah-Hartman
maintainerPATCH 26/124 drm/amd/powerplay: fix segment fault issue in multi-display case.
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rex Zhu <[email protected]>
commit f9e9c08e20d71cabef7d5c2a7eb75e1d953dad16 upstream.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c +8 -5
@@ -816,10 +816,13 @@ static int amdgpu_cgs_get_active_displaystruct drm_device *ddev = adev->ddev;struct drm_crtc *crtc;uint32_t line_time_us, vblank_lines; +struct cgs_mode_info *mode_info;if (info ==NULL )return -EINVAL ; + mode_info = info->mode_info; +if (adev->mode_info.num_crtc && adev->mode_info.mode_config_initialized) {list_for_each_entry (crtc, &ddev->mode_config.crtc_list, head) {
@@ -828,7 +831,7 @@ static int amdgpu_cgs_get_active_display info->active_display_mask |= (1 << amdgpu_crtc->crtc_id); info->display_count++; } -if (info->mode_info !=NULL && +if (mode_info !=NULL && crtc->enabled && amdgpu_crtc->enabled && amdgpu_crtc->hw_mode.clock) { line_time_us = (amdgpu_crtc->hw_mode.crtc_htotal * 1000) /
@@ -836,10 +839,10 @@ static int amdgpu_cgs_get_active_display vblank_lines = amdgpu_crtc->hw_mode.crtc_vblank_end - amdgpu_crtc->hw_mode.crtc_vdisplay + (amdgpu_crtc->v_border *2 ); - info->mode_info->vblank_time_us = vblank_lines * line_time_us; - info->mode_info->refresh_rate =drm_mode_vrefresh (&amdgpu_crtc->hw_mode); - info->mode_info->ref_clock = adev->clock.spll.reference_freq; - info->mode_info++; + mode_info->vblank_time_us = vblank_lines * line_time_us; + mode_info->refresh_rate =drm_mode_vrefresh (&amdgpu_crtc->hw_mode); + mode_info->ref_clock = adev->clock.spll.reference_freq; + mode_info =NULL ; } } }
Greg Kroah-Hartman
maintainerPATCH 27/124 drm/amdgpu/gmc: move vram type fetching into sw_init
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit d1518a1db31a25682ea09c4b135fa72d9883be42 upstream.
early_init gets called before atom asic init so on non-posted cards, the vram type is not initialized.
--- drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c | 16 ++++++++-------- drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c | 16 ++++++++-------- 2 files changed, 16 insertions(+), 16 deletions(-)
drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c +8 -8
@@ -902,14 +902,6 @@ static int gmc_v7_0_early_init(void *hangmc_v7_0_set_gart_funcs (adev);gmc_v7_0_set_irq_funcs (adev); -if (adev->flags &AMD_IS_APU ) { - adev->mc.vram_type =AMDGPU_VRAM_TYPE_UNKNOWN ; - }else { -u32 tmp =RREG32 (mmMC_SEQ_MISC0); - tmp &=MC_SEQ_MISC0__MT__MASK ; - adev->mc.vram_type =gmc_v7_0_convert_vram_type (tmp); - } -return 0 ; }
@@ -930,6 +922,14 @@ static int gmc_v7_0_sw_init(void *handleif (r)return r; +if (adev->flags &AMD_IS_APU ) { + adev->mc.vram_type =AMDGPU_VRAM_TYPE_UNKNOWN ; + }else { +u32 tmp =RREG32 (mmMC_SEQ_MISC0); + tmp &=MC_SEQ_MISC0__MT__MASK ; + adev->mc.vram_type =gmc_v7_0_convert_vram_type (tmp); + } + r =amdgpu_irq_add_id (adev,146 , &adev->mc.vm_fault);if (r)return r;
drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c +8 -8
@@ -856,14 +856,6 @@ static int gmc_v8_0_early_init(void *hangmc_v8_0_set_gart_funcs (adev);gmc_v8_0_set_irq_funcs (adev); -if (adev->flags &AMD_IS_APU ) { - adev->mc.vram_type =AMDGPU_VRAM_TYPE_UNKNOWN ; - }else { -u32 tmp =RREG32 (mmMC_SEQ_MISC0); - tmp &=MC_SEQ_MISC0__MT__MASK ; - adev->mc.vram_type =gmc_v8_0_convert_vram_type (tmp); - } -return 0 ; }
@@ -884,6 +876,14 @@ static int gmc_v8_0_sw_init(void *handleif (r)return r; +if (adev->flags &AMD_IS_APU ) { + adev->mc.vram_type =AMDGPU_VRAM_TYPE_UNKNOWN ; + }else { +u32 tmp =RREG32 (mmMC_SEQ_MISC0); + tmp &=MC_SEQ_MISC0__MT__MASK ; + adev->mc.vram_type =gmc_v8_0_convert_vram_type (tmp); + } + r =amdgpu_irq_add_id (adev,146 , &adev->mc.vm_fault);if (r)return r;
Greg Kroah-Hartman
maintainerPATCH 28/124 drm/amdgpu/gmc: use proper register for vram type on Fiji
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit b634de4f446c062a0c95ec4d150b4cf7c85e3526 upstream.
The offset changed on Fiji.
--- drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c +8 -1
@@ -866,6 +866,8 @@ static int gmc_v8_0_late_init(void *handreturn amdgpu_irq_get (adev, &adev->mc.vm_fault,0 ); } +#define mmMC_SEQ_MISC0_FIJI 0xA71 +static int gmc_v8_0_sw_init (void *handle) {int r;
@@ -879,7 +881,12 @@ static int gmc_v8_0_sw_init(void *handleif (adev->flags &AMD_IS_APU ) { adev->mc.vram_type =AMDGPU_VRAM_TYPE_UNKNOWN ; }else { -u32 tmp =RREG32 (mmMC_SEQ_MISC0); +u32 tmp; + +if (adev->asic_type ==CHIP_FIJI ) + tmp =RREG32 (mmMC_SEQ_MISC0_FIJI); +else + tmp =RREG32 (mmMC_SEQ_MISC0); tmp &=MC_SEQ_MISC0__MT__MASK ; adev->mc.vram_type =gmc_v8_0_convert_vram_type (tmp); }
Greg Kroah-Hartman
maintainerPATCH 29/124 xen/events: Mask a moving irq
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boris Ostrovsky <[email protected]>
commit ff1e22e7a638a0782f54f81a6c9cb139aca2da35 upstream.
Moving an unmasked irq may result in irq handler being invoked on both source and target CPUs.
With 2-level this can happen as follows:
On source CPU:
evtchn_2l_handle_events() ->
generic_handle_irq() ->
handle_edge_irq() ->
eoi_pirq():
irq_move_irq(data);
/***** WE ARE HERE *****/
if (VALID_EVTCHN(evtchn))
clear_evtchn(evtchn);If at this moment target processor is handling an unrelated event in evtchn_2l_handle_events()'s loop it may pick up our event since target's cpu_evtchn_mask claims that this event belongs to it *and* the event is unmasked and still pending. At the same time, source CPU will continue executing its own handle_edge_irq().
With FIFO interrupt the scenario is similar: irq_move_irq() may result in a EVTCHNOP_unmask hypercall which, in turn, may make the event pending on the target CPU.
We can avoid this situation by moving and clearing the event while keeping event masked.
--- drivers/xen/events/events_base.c | 28 ++++++++++++++++++++++++---- 1 file changed, 24 insertions(+), 4 deletions(-)
drivers/xen/events/events_base.c +24 -4
@@ -484,9 +484,19 @@ static void eoi_pirq(struct irq_data *dastruct physdev_eoi eoi = { .irq =pirq_from_irq (data->irq) };int rc =0 ; -irq_move_irq (data); +if (!VALID_EVTCHN (evtchn)) +return ; -if (VALID_EVTCHN (evtchn)) +if (unlikely (irqd_is_setaffinity_pending (data))) { +int masked =test_and_set_mask (evtchn); + +clear_evtchn (evtchn); + +irq_move_masked_irq (data); + +if (!masked) +unmask_evtchn (evtchn); + }else clear_evtchn (evtchn);if (pirq_needs_eoi (data->irq)) {
@@ -1357,9 +1367,19 @@ static void ack_dynirq(struct irq_data * {int evtchn =evtchn_from_irq (data->irq); -irq_move_irq (data); +if (!VALID_EVTCHN (evtchn)) +return ; -if (VALID_EVTCHN (evtchn)) +if (unlikely (irqd_is_setaffinity_pending (data))) { +int masked =test_and_set_mask (evtchn); + +clear_evtchn (evtchn); + +irq_move_masked_irq (data); + +if (!masked) +unmask_evtchn (evtchn); + }else clear_evtchn (evtchn); }
Greg Kroah-Hartman
maintainerPATCH 30/124 net: validate variable length ll headers
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Willem de Bruijn <[email protected]>
[ Upstream commit 2793a23aacbd754dbbb5cb75093deb7e4103bace ]
Netdevice parameter hard_header_len is variously interpreted both as an upper and lower bound on link layer header length. The field is used as upper bound when reserving room at allocation, as lower bound when validating user input in PF_PACKET.
Clarify the definition to be maximum header length. For validation of untrusted headers, add an optional validate member to header_ops.
Allow bypassing of validation by passing CAP_SYS_RAWIO, for instance for deliberate testing of corrupt input. In this case, pad trailing bytes, as some device drivers expect completely initialized headers.
See also http://comments.gmane.org/gmane.linux.network/401064
--- include/linux/netdevice.h | 22 ++++++++++++++++++++-- 1 file changed, 20 insertions(+), 2 deletions(-)
include/linux/netdevice.h +20 -2
@@ -267,6 +267,7 @@ struct header_ops {void (*cache_update)(struct hh_cache *hh,const struct net_device *dev,const unsigned char *haddr); +bool (*validate)(const char *ll_header,unsigned int len); };/* These flag bits are private to the generic network queueing
@@ -1420,8 +1421,7 @@ enum netdev_priv_flags {* @dma: DMA channel * @mtu: Interface MTU value * @type: Interface hardware type -* @hard_header_len: Hardware header length, which means that this is the -* minimum size of a packet. +* @hard_header_len: Maximum hardware header length. * * @needed_headroom: Extra headroom the hardware may need, but not in all * cases can this be guaranteed
@@ -2627,6 +2627,24 @@ static inline int dev_parse_header(constreturn dev->header_ops->parse (skb, haddr); } +/* ll_header must have at least hard_header_len allocated */ +static inline bool dev_validate_header (const struct net_device *dev, +char *ll_header,int len) +{ +if (likely (len >= dev->hard_header_len)) +return true; + +if (capable (CAP_SYS_RAWIO )) { +memset (ll_header + len,0 , dev->hard_header_len - len); +return true; + } + +if (dev->header_ops && dev->header_ops->validate) +return dev->header_ops->validate (ll_header, len); + +return false; +} +typedef int gifconf_func_t (struct net_device * dev,char __user * bufptr,int len);int register_gifconf (unsigned int family,gifconf_func_t *gifconf);static inline int unregister_gifconf (unsigned int family)
Greg Kroah-Hartman
maintainerPATCH 31/124 ax25: add link layer header validation function
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Willem de Bruijn <[email protected]>
[ Upstream commit ea47781c26510e5d97f80f9aceafe9065bd5e3aa ]
As variable length protocol, AX25 fails link layer header validation tests based on a minimum length. header_ops.validate allows protocols to validate headers that are shorter than hard_header_len. Implement this callback for AX25.
See also http://comments.gmane.org/gmane.linux.network/401064
--- net/ax25/ax25_ip.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
net/ax25/ax25_ip.c +15 -0
@@ -228,8 +228,23 @@ netdev_tx_t ax25_ip_xmit(struct sk_buff }#endif +static bool ax25_validate_header (const char *header,unsigned int len) +{ +ax25_digi digi; + +if (!len) +return false; + +if (header[0 ]) +return true; + +return ax25_addr_parse (header +1 , len -1 ,NULL ,NULL , &digi,NULL , +NULL ); +} +const struct header_ops ax25_header_ops = { .create = ax25_hard_header, + .validate = ax25_validate_header, };EXPORT_SYMBOL (ax25_header_ops);
Greg Kroah-Hartman
maintainerPATCH 32/124 packet: validate variable length ll headers
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Willem de Bruijn <[email protected]>
[ Upstream commit 9ed988cd591500c040b2a6257bc68543e08ceeef ]
Replace link layer header validation check ll_header_truncate with more generic dev_validate_header.
Validation based on hard_header_len incorrectly drops valid packets in variable length protocols, such as AX25. dev_validate_header calls header_ops.validate for such protocols to ensure correctness below hard_header_len.
See also http://comments.gmane.org/gmane.linux.network/401064
Fixes 9c7077622dd9 ("packet: make packet_snd fail on len smaller than l2 header")
--- net/packet/af_packet.c | 37 ++++++++++++++++--------------------- 1 file changed, 16 insertions(+), 21 deletions(-)
net/packet/af_packet.c +16 -21
@@ -1916,6 +1916,10 @@ retry: goto retry; } +if (!dev_validate_header (dev, skb->data, len)) { + err = -EINVAL ; + goto out_unlock; + }if (len > (dev->mtu + dev->hard_header_len + extra_len) && !packet_extra_vlan_len_allowed (dev, skb)) { err = -EMSGSIZE ;
@@ -2326,18 +2330,6 @@ static void tpacket_destruct_skb(structsock_wfree (skb); } -static bool ll_header_truncated (const struct net_device *dev,int len) -{ -/* net device doesn't like empty head */ -if (unlikely (len < dev->hard_header_len)) { -net_warn_ratelimited ("%s: packet size is too short (%d < %d)\n" , - current->comm, len, dev->hard_header_len); -return true; - } - -return false; -} -static void tpacket_set_protocol (const struct net_device *dev,struct sk_buff *skb) {
@@ -2420,19 +2412,19 @@ static int tpacket_fill_skb(struct packeif (unlikely (err <0 ))return -EINVAL ; }else if (dev->hard_header_len) { -if (ll_header_truncated (dev, tp_len)) -return -EINVAL ; +int hdrlen =min_t (int, dev->hard_header_len, tp_len);skb_push (skb, dev->hard_header_len); - err =skb_store_bits (skb,0 , data, - dev->hard_header_len); + err =skb_store_bits (skb,0 , data, hdrlen);if (unlikely (err))return err; +if (!dev_validate_header (dev, skb->data, hdrlen)) +return -EINVAL ;if (!skb->protocol)tpacket_set_protocol (dev, skb); - data += dev->hard_header_len; - to_write -= dev->hard_header_len; + data += hdrlen; + to_write -= hdrlen; } offset =offset_in_page (data);
@@ -2763,9 +2755,6 @@ static int packet_snd(struct socket *soc offset =dev_hard_header (skb, dev,ntohs (proto), addr,NULL , len);if (unlikely (offset <0 )) goto out_free; - }else { -if (ll_header_truncated (dev, len)) - goto out_free; }/* Returns -EFAULT on error */
@@ -2773,6 +2762,12 @@ static int packet_snd(struct socket *socif (err) goto out_free; +if (sock->type ==SOCK_RAW && + !dev_validate_header (dev, skb->data, len)) { + err = -EINVAL ; + goto out_free; + } +sock_tx_timestamp (sk, &skb_shinfo (skb)->tx_flags); if (!gso_type && (len > dev->mtu + reserve + extra_len) &&
Greg Kroah-Hartman
maintainerPATCH 33/124 bpf: avoid copying junk bytes in bpf_get_current_comm()
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexei Starovoitov <[email protected]>
[ Upstream commit cdc4e47da8f4c32eeb6b2061a8a834f4362a12b7 ]
Lots of places in the kernel use memcpy(buf, comm, TASK_COMM_LEN); but the result is typically passed to print("%s", buf) and extra bytes after zero don't cause any harm.
In bpf the result of bpf_get_current_comm() is used as the part of map key and was causing spurious hash map mismatches.
Use strlcpy() to guarantee zero-terminated string.
bpf verifier checks that output buffer is zero-initialized, so even for short task names the output buffer don't have junk bytes. Note it's not a security concern, since kprobe+bpf is root only.
--- kernel/bpf/helpers.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/bpf/helpers.c +1 -1
@@ -166,7 +166,7 @@ static u64 bpf_get_current_comm(u64 r1,if (!task)return -EINVAL ; -memcpy (buf, task->comm,min_t (size_t, size,sizeof (task->comm))); +strlcpy (buf, task->comm,min_t (size_t, size,sizeof (task->comm)));return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 34/124 net: dsa: Fix cleanup resources upon module removal
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Neil Armstrong <[email protected]>
[ Upstream commit 04761890a7cec6a1ff9aafd909004da4fe8059db ]
The initial commit badly merged into the dsa_resume method instead of the dsa_remove_dst method.
As consequence, the dst->master_netdev->dsa_ptr is not set to NULL on removal and re-bind of the dsa device fails with error -17.
--- net/dsa/dsa.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
net/dsa/dsa.c +8 -8
@@ -935,6 +935,14 @@ static void dsa_remove_dst(struct dsa_sw {int i; + dst->master_netdev->dsa_ptr =NULL ; + +/* If we used a tagging format that doesn't have an ethertype +* field, make sure that all packets from this point get sent +* without the tag and go through the regular receive path. +*/ +wmb (); +for (i =0 ; i < dst->pd->nr_chips; i++) {struct dsa_switch *ds = dst->ds[i];
@@ -988,14 +996,6 @@ static int dsa_suspend(struct device *d)struct dsa_switch_tree *dst =platform_get_drvdata (pdev);int i, ret =0 ; - dst->master_netdev->dsa_ptr =NULL ; - -/* If we used a tagging format that doesn't have an ethertype -* field, make sure that all packets from this point get sent -* without the tag and go through the regular receive path. -*/ -wmb (); -for (i =0 ; i < dst->pd->nr_chips; i++) {struct dsa_switch *ds = dst->ds[i];
Greg Kroah-Hartman
maintainerPATCH 35/124 sh_eth: fix NULL pointer dereference in sh_eth_ring_format()
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergei Shtylyov <[email protected]>
[ Upstream commit c1b7fca65070bfadca94dd53a4e6b71cd4f69715 ]
In a low memory situation, if netdev_alloc_skb() fails on a first RX ring loop iteration in sh_eth_ring_format(), 'rxdesc' is still NULL. Avoid kernel oops by adding the 'rxdesc' check after the loop.
--- drivers/net/ethernet/renesas/sh_eth.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/renesas/sh_eth.c +2 -1
@@ -1163,7 +1163,8 @@ static void sh_eth_ring_format(struct ne mdp->dirty_rx = (u32) (i - mdp->num_rx_ring);/* Mark the last entry as wrapping the ring. */ - rxdesc->status |=cpu_to_le32 (RD_RDLE ); +if (rxdesc) + rxdesc->status |=cpu_to_le32 (RD_RDLE );memset (mdp->tx_ring,0 , tx_ringsize);
Greg Kroah-Hartman
maintainerPATCH 36/124 sh_eth: advance rxdesc later in sh_eth_ring_format()
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergei Shtylyov <[email protected]>
[ Upstream commit d0ba913488dc8c55d1880f5ed34f096dc45fb05d ]
Iff dma_map_single() fails, 'rxdesc' should point to the last filled RX descriptor, so that it can be marked as the last one, however the driver would have already advanced it by that time. In order to fix that, only fill an RX descriptor once all the data for it is ready.
--- drivers/net/ethernet/renesas/sh_eth.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/net/ethernet/renesas/sh_eth.c +4 -3
@@ -1136,11 +1136,8 @@ static void sh_eth_ring_format(struct nebreak ;sh_eth_set_receive_align (skb); -/* RX descriptor */ - rxdesc = &mdp->rx_ring[i];/* The size of the buffer is a multiple of 32 bytes. */ buf_len =ALIGN (mdp->rx_buf_sz,32 ); - rxdesc->len =cpu_to_le32 (buf_len <<16 ); dma_addr =dma_map_single (&ndev->dev, skb->data, buf_len,DMA_FROM_DEVICE );if (dma_mapping_error (&ndev->dev, dma_addr)) {
@@ -1148,6 +1145,10 @@ static void sh_eth_ring_format(struct nebreak ; } mdp->rx_skbuff[i] = skb; + +/* RX descriptor */ + rxdesc = &mdp->rx_ring[i]; + rxdesc->len =cpu_to_le32 (buf_len <<16 ); rxdesc->addr =cpu_to_le32 (dma_addr); rxdesc->status =cpu_to_le32 (RD_RACT |RD_RFP );
Greg Kroah-Hartman
maintainerPATCH 37/124 qlcnic: Remove unnecessary usage of atomic_t
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rajesh Borundia <[email protected]>
[ Upstream commit 5bf93251cee1fb66141d1d2eaff86e04a9397bdf ]
o atomic_t usage is incorrect as we are not implementing any atomicity.
--- drivers/net/ethernet/qlogic/qlcnic/qlcnic.h | 2 +- drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c | 9 ++++----- 2 files changed, 5 insertions(+), 6 deletions(-)
drivers/net/ethernet/qlogic/qlcnic/qlcnic.h +1 -1
@@ -1099,7 +1099,7 @@ struct qlcnic_mailbox {unsigned long status;spinlock_t queue_lock;/* Mailbox queue lock */ spinlock_t aen_lock;/* Mailbox response/AEN lock */ -atomic_t rsp_status; +u32 rsp_status;u32 num_cmds; };
drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c +4 -5
@@ -491,7 +491,7 @@ irqreturn_t qlcnic_83xx_clear_legacy_intstatic inline void qlcnic_83xx_notify_mbx_response (struct qlcnic_mailbox *mbx) { -atomic_set (&mbx->rsp_status,QLC_83XX_MBX_RESPONSE_ARRIVED ); + mbx->rsp_status =QLC_83XX_MBX_RESPONSE_ARRIVED ;complete (&mbx->completion); }
@@ -510,7 +510,7 @@ static void qlcnic_83xx_poll_process_aenif (event &QLCNIC_MBX_ASYNC_EVENT ) {__qlcnic_83xx_process_aen (adapter); }else { -if (atomic_read (&mbx->rsp_status) != rsp_status) +if (mbx->rsp_status != rsp_status)qlcnic_83xx_notify_mbx_response (mbx); } out:
@@ -1023,7 +1023,7 @@ static void qlcnic_83xx_process_aen(struif (event &QLCNIC_MBX_ASYNC_EVENT ) {__qlcnic_83xx_process_aen (adapter); }else { -if (atomic_read (&mbx->rsp_status) != rsp_status) +if (mbx->rsp_status != rsp_status)qlcnic_83xx_notify_mbx_response (mbx); } }
@@ -4050,7 +4050,6 @@ static void qlcnic_83xx_mailbox_worker(sstruct qlcnic_adapter *adapter = mbx->adapter;const struct qlcnic_mbx_ops *mbx_ops = mbx->ops;struct device *dev = &adapter->pdev->dev; -atomic_t *rsp_status = &mbx->rsp_status;struct list_head *head = &mbx->cmd_q;struct qlcnic_hardware_context *ahw;struct qlcnic_cmd_args *cmd =NULL ;
@@ -4063,7 +4062,7 @@ static void qlcnic_83xx_mailbox_worker(sreturn ; } -atomic_set (rsp_status,QLC_83XX_MBX_RESPONSE_WAIT ); + mbx->rsp_status =QLC_83XX_MBX_RESPONSE_WAIT ;spin_lock (&mbx->queue_lock);
Greg Kroah-Hartman
maintainerPATCH 38/124 qlcnic: Fix mailbox completion handling during spurious interrupt
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rajesh Borundia <[email protected]>
[ Upstream commit 819bfe764dceec2f6b4551768453f374b4c60443 ]
o While the driver is in the middle of a MB completion processing and it receives a spurious MB interrupt, it is mistaken as a good MB completion interrupt leading to premature completion of the next MB request. Fix the driver to guard against this by checking the current state of MB processing and ignore the spurious interrupt. Also added a stats counter to record this condition.
--- drivers/net/ethernet/qlogic/qlcnic/qlcnic.h | 1 + drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c | 15 +++++++++++---- drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c | 3 ++- 3 files changed, 14 insertions(+), 5 deletions(-)
drivers/net/ethernet/qlogic/qlcnic/qlcnic.h +1 -0
@@ -566,6 +566,7 @@ struct qlcnic_adapter_stats {u64 tx_dma_map_error;u64 spurious_intr;u64 mac_filter_limit_overrun; +u64 mbx_spurious_intr; };/*
drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c +11 -4
@@ -2338,9 +2338,9 @@ static void qlcnic_83xx_handle_link_aen(static irqreturn_t qlcnic_83xx_handle_aen (int irq,void *data) { +u32 mask, resp, event, rsp_status =QLC_83XX_MBX_RESPONSE_ARRIVED ;struct qlcnic_adapter *adapter = data;struct qlcnic_mailbox *mbx; -u32 mask, resp, event;unsigned long flags; mbx = adapter->ahw->mailbox;
@@ -2350,10 +2350,14 @@ static irqreturn_t qlcnic_83xx_handle_ae goto out; event =readl (QLCNIC_MBX_FW (adapter->ahw,0 )); -if (event &QLCNIC_MBX_ASYNC_EVENT ) +if (event &QLCNIC_MBX_ASYNC_EVENT ) {__qlcnic_83xx_process_aen (adapter); -else -qlcnic_83xx_notify_mbx_response (mbx); + }else { +if (mbx->rsp_status != rsp_status) +qlcnic_83xx_notify_mbx_response (mbx); +else + adapter->stats.mbx_spurious_intr++; + } out: mask =QLCRDX (adapter->ahw,QLCNIC_DEF_INT_MASK );
@@ -4053,6 +4057,7 @@ static void qlcnic_83xx_mailbox_worker(sstruct list_head *head = &mbx->cmd_q;struct qlcnic_hardware_context *ahw;struct qlcnic_cmd_args *cmd =NULL ; +unsigned long flags; ahw = adapter->ahw;
@@ -4062,7 +4067,9 @@ static void qlcnic_83xx_mailbox_worker(sreturn ; } +spin_lock_irqsave (&mbx->aen_lock, flags); mbx->rsp_status =QLC_83XX_MBX_RESPONSE_WAIT ; +spin_unlock_irqrestore (&mbx->aen_lock, flags);spin_lock (&mbx->queue_lock);
drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c +2 -1
@@ -59,7 +59,8 @@ static const struct qlcnic_stats qlcnic_ QLC_OFF(stats.mac_filter_limit_overrun)}, {"spurious intr" ,QLC_SIZEOF (stats.spurious_intr), QLC_OFF(stats.spurious_intr)}, - + {"mbx spurious intr", QLC_SIZEOF(stats.mbx_spurious_intr), + QLC_OFF(stats.mbx_spurious_intr)}, }; static const char qlcnic_device_gstrings_stats[][ETH_GSTRING_LEN] = {
Greg Kroah-Hartman
maintainerPATCH 39/124 macvtap: always pass ethernet header in linear
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Willem de Bruijn <[email protected]>
[ Upstream commit 8e2ad4113ce4671686740f808ff2795395c39eef ]
The stack expects link layer headers in the skb linear section. Macvtap can create skbs with llheader in frags in edge cases:
when (IFF_VNET_HDR is off or vnet_hdr.hdr_len < ETH_HLEN) and prepad + len > PAGE_SIZE and vnet_hdr.flags has no or bad csum.
Add checks to ensure linear is always at least ETH_HLEN. At this point, len is already ensured to be >= ETH_HLEN.
For backwards compatiblity, rounds up short vnet_hdr.hdr_len. This differs from tap and packet, which return an error.
Fixes b9fb9ee07e67 ("macvtap: add GSO/csum offload support")
--- drivers/net/macvtap.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/net/macvtap.c +6 -3
@@ -760,6 +760,8 @@ static ssize_t macvtap_get_user(struct m macvtap16_to_cpu(q, vnet_hdr.hdr_len) : GOODCOPY_LEN;if (copylen > good_linear) copylen = good_linear; +else if (copylen <ETH_HLEN ) + copylen =ETH_HLEN ; linear = copylen; i = *from;iov_iter_advance (&i, copylen);
@@ -769,10 +771,11 @@ static ssize_t macvtap_get_user(struct mif (!zerocopy) { copylen = len; -if (macvtap16_to_cpu (q, vnet_hdr.hdr_len) > good_linear) + linear =macvtap16_to_cpu (q, vnet_hdr.hdr_len); +if (linear > good_linear) linear = good_linear; -else - linear =macvtap16_to_cpu (q, vnet_hdr.hdr_len); +else if (linear <ETH_HLEN ) + linear =ETH_HLEN ; } skb = macvtap_alloc_skb(&q->sk, MACVTAP_RESERVE, copylen,
Greg Kroah-Hartman
maintainerPATCH 40/124 mlxsw: spectrum: Check requested ageing time is valid
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit 869f63a4d28144c03c8f4a4c0d1e8f31f8c11a10 ]
Commit c62987bbd8a1 ("bridge: push bridge setting ageing_time down to switchdev") added a check for minimum and maximum ageing time, but this breaks existing behaviour where one can set ageing time to 0 for a non-learning bridge.
Push this check down to the driver and allow the check in the bridge layer to be removed. Currently ageing time 0 is refused by the driver, but we can later add support for this functionality.
--- drivers/net/ethernet/mellanox/mlxsw/spectrum.h | 2 ++ drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c | 9 +++++++-- 2 files changed, 9 insertions(+), 2 deletions(-)
drivers/net/ethernet/mellanox/mlxsw/spectrum.h +2 -0
@@ -118,6 +118,8 @@ struct mlxsw_sp {#define MLXSW_SP_DEFAULT_LEARNING_INTERVAL 100unsigned int interval;/* ms */ } fdb_notify; +#define MLXSW_SP_MIN_AGEING_TIME 10 +#define MLXSW_SP_MAX_AGEING_TIME 1000000#define MLXSW_SP_DEFAULT_AGEING_TIME 300u32 ageing_time;struct mlxsw_sp_upper master_bridge;
drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c +7 -2
@@ -311,8 +311,13 @@ static int mlxsw_sp_port_attr_br_ageing_unsigned long ageing_jiffies =clock_t_to_jiffies (ageing_clock_t);u32 ageing_time =jiffies_to_msecs (ageing_jiffies) /1000 ; -if (switchdev_trans_ph_prepare (trans)) -return 0 ; +if (switchdev_trans_ph_prepare (trans)) { +if (ageing_time <MLXSW_SP_MIN_AGEING_TIME || + ageing_time >MLXSW_SP_MAX_AGEING_TIME ) +return -ERANGE ; +else +return 0 ; + }return mlxsw_sp_ageing_set (mlxsw_sp, ageing_time); }
Greg Kroah-Hartman
maintainerPATCH 41/124 rocker: set FDB cleanup timer according to lowest ageing time
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit 88de1cd457e5cb664d6d437e2ea4750d089165f5 ]
In rocker, ageing time is a per-port attribute, so the next time the FDB cleanup timer fires should be set according to the lowest ageing time.
This will later allow us to delete the BR_MIN_AGEING_TIME macro, which was added to guarantee minimum ageing time in the bridge layer, thereby breaking existing behavior.
--- drivers/net/ethernet/rocker/rocker.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
drivers/net/ethernet/rocker/rocker.c +9 -1
@@ -239,6 +239,7 @@ struct rocker {struct {u64 id; } hw; +unsigned long ageing_time;spinlock_t cmd_ring_lock;/* for cmd ring accesses */ struct rocker_dma_ring_info cmd_ring;struct rocker_dma_ring_info event_ring;
@@ -3704,7 +3705,7 @@ static void rocker_fdb_cleanup(unsignedstruct rocker_port *rocker_port;struct rocker_fdb_tbl_entry *entry;struct hlist_node *tmp; -unsigned long next_timer = jiffies +BR_MIN_AGEING_TIME ; +unsigned long next_timer = jiffies + rocker->ageing_time;unsigned long expires;unsigned long lock_flags; int flags = ROCKER_OP_FLAG_NOWAIT | ROCKER_OP_FLAG_REMOVE |
@@ -4367,8 +4368,12 @@ static int rocker_port_bridge_ageing_tim struct switchdev_trans *trans, u32 ageing_time) { +struct rocker *rocker = rocker_port->rocker; +if (!switchdev_trans_ph_prepare (trans)) { rocker_port->ageing_time =clock_t_to_jiffies (ageing_time); +if (rocker_port->ageing_time < rocker->ageing_time) + rocker->ageing_time = rocker_port->ageing_time;mod_timer (&rocker_port->rocker->fdb_cleanup_timer, jiffies); }
@@ -5206,10 +5211,13 @@ static int rocker_probe(struct pci_dev * goto err_init_tbls; } + rocker->ageing_time =BR_DEFAULT_AGEING_TIME ;setup_timer (&rocker->fdb_cleanup_timer, rocker_fdb_cleanup, (unsigned long ) rocker);mod_timer (&rocker->fdb_cleanup_timer, jiffies); + rocker->ageing_time =BR_DEFAULT_AGEING_TIME ; + err =rocker_probe_ports (rocker);if (err) {dev_err (&pdev->dev,"failed to probe ports\n" );
Greg Kroah-Hartman
maintainerPATCH 42/124 bridge: allow zero ageing time
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Hemminger <[email protected]>
[ Upstream commit 4c656c13b254d598e83e586b7b4d36a2043dad85 ]
This fixes a regression in the bridge ageing time caused by:
commit c62987bbd8a1 ("bridge: push bridge setting ageing_time down to switchdev")
There are users of Linux bridge which use the feature that if ageing time is set to 0 it causes entries to never expire. See:
https://www.linuxfoundation.org/collaborate/workgroups/networking/bridge
For a pure software bridge, it is unnecessary for the code to have arbitrary restrictions on what values are allowable.
--- include/linux/if_bridge.h | 4 ---- net/bridge/br_stp.c | 11 ++++++++--- 2 files changed, 8 insertions(+), 7 deletions(-)
include/linux/if_bridge.h +0 -4
@@ -46,10 +46,6 @@ struct br_ip_list {#define BR_LEARNING_SYNC BIT(9)#define BR_PROXYARP_WIFI BIT(10) -/* values as per ieee8021QBridgeFdbAgingTime */ -#define BR_MIN_AGEING_TIME (10 * HZ) -#define BR_MAX_AGEING_TIME (1000000 * HZ) -#define BR_DEFAULT_AGEING_TIME (300 * HZ)extern void brioctl_set (int (*ioctl_hook)(struct net *,unsigned int ,void __user *));
net/bridge/br_stp.c +8 -3
@@ -568,6 +568,14 @@ int br_set_max_age(struct net_bridge *br } +/* Set time interval that dynamic forwarding entries live +* For pure software bridge, allow values outside the 802.1 +* standard specification for special cases: +* 0 - entry never ages (all permanant) +* 1 - entry disappears (no persistance) +* +* Offloaded switch entries maybe more restrictive +*/ int br_set_ageing_time (struct net_bridge *br,u32 ageing_time) {struct switchdev_attr attr = {
@@ -579,9 +587,6 @@ int br_set_ageing_time(struct net_bridgeunsigned long t =clock_t_to_jiffies (ageing_time);int err; -if (t <BR_MIN_AGEING_TIME || t >BR_MAX_AGEING_TIME ) -return -ERANGE ; - err =switchdev_port_attr_set (br->dev, &attr);if (err)return err;
Greg Kroah-Hartman
maintainerPATCH 43/124 ipv4: Dont do expensive useless work during inetdev destroy.
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: "David S. Miller" <[email protected]>
[ Upstream commit fbd40ea0180a2d328c5adc61414dc8bab9335ce2 ]
When an inetdev is destroyed, every address assigned to the interface is removed. And in this scenerio we do two pointless things which can be very expensive if the number of assigned interfaces is large:
1) Address promotion. We are deleting all addresses, so there is no point in doing this.
2) A full nf conntrack table purge for every address. We only need to do this once, as is already caught by the existing masq_dev_notifier so masq_inet_event() can skip this.
--- net/ipv4/devinet.c | 4 ++++ net/ipv4/fib_frontend.c | 4 ++++ net/ipv4/netfilter/nf_nat_masquerade_ipv4.c | 12 ++++++++++-- 3 files changed, 18 insertions(+), 2 deletions(-)
net/ipv4/devinet.c +4 -0
@@ -334,6 +334,9 @@ static void __inet_del_ifa(struct in_devASSERT_RTNL (); +if (in_dev->dead) + goto no_promotions; +/* 1. Deleting primary ifaddr forces deletion all secondaries * unless alias promotion is set **/
@@ -380,6 +383,7 @@ static void __inet_del_ifa(struct in_devfib_del_ifaddr (ifa, ifa1); } +no_promotions:/* 2. Unlink it */ *ifap = ifa1->ifa_next;
net/ipv4/fib_frontend.c +4 -0
@@ -922,6 +922,9 @@ void fib_del_ifaddr(struct in_ifaddr *if subnet =1 ; } +if (in_dev->dead) + goto no_promotions; +/* Deletion is more complicated than add. * We should take care of not to delete too much :-) *
@@ -997,6 +1000,7 @@ void fib_del_ifaddr(struct in_ifaddr *if } } +no_promotions:if (!(ok &BRD_OK ))fib_magic (RTM_DELROUTE ,RTN_BROADCAST , ifa->ifa_broadcast,32 , prim);if (subnet && ifa->ifa_prefixlen <31 ) {
net/ipv4/netfilter/nf_nat_masquerade_ipv4.c +10 -2
@@ -108,10 +108,18 @@ static int masq_inet_event(struct notifiunsigned long event, void *ptr) { - struct net_device *dev = ((struct in_ifaddr *)ptr)->ifa_dev->dev; + struct in_device *idev = ((struct in_ifaddr *)ptr)->ifa_dev;struct netdev_notifier_info info; -netdev_notifier_info_init (&info, dev); +/* The masq_dev_notifier will catch the case of the device going +* down. So if the inetdev is dead and being destroyed we have +* no work to do. Otherwise this is an individual address removal +* and we have to perform the flush. +*/ +if (idev->dead) +return NOTIFY_DONE ; + +netdev_notifier_info_init (&info, idev->dev);return masq_device_event (this, event, &info); }
Greg Kroah-Hartman
maintainerPATCH 44/124 net: Fix use after free in the recvmmsg exit path
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <[email protected]>
[ Upstream commit 34b88a68f26a75e4fded796f1a49c40f82234b7d ]
The syzkaller fuzzer hit the following use-after-free:
Call Trace: [<ffffffff8175ea0e>] __asan_report_load8_noabort+0x3e/0x40 mm/kasan/report.c:295 [<ffffffff851cc31a>] __sys_recvmmsg+0x6fa/0x7f0 net/socket.c:2261 [< inline >] SYSC_recvmmsg net/socket.c:2281 [<ffffffff851cc57f>] SyS_recvmmsg+0x16f/0x180 net/socket.c:2270 [<ffffffff86332bb6>] entry_SYSCALL_64_fastpath+0x16/0x7a arch/x86/entry/entry_64.S:185
And, as Dmitry rightly assessed, that is because we can drop the reference and then touch it when the underlying recvmsg calls return some packets and then hit an error, which will make recvmmsg to set sock->sk->sk_err, oops, fix it.
http://lkml.kernel.org/r/[email protected]
--- net/socket.c | 38 +++++++++++++++++++------------------- 1 file changed, 19 insertions(+), 19 deletions(-)
net/socket.c +19 -19
@@ -2240,31 +2240,31 @@ int __sys_recvmmsg(int fd, struct mmsghdcond_resched (); } -out_put: -fput_light (sock->file, fput_needed); -if (err ==0 ) -return datagrams; + goto out_put; + +if (datagrams ==0 ) { + datagrams = err; + goto out_put; + } -if (datagrams !=0 ) { +/* +* We may return less entries than requested (vlen) if the +* sock is non block and there aren't enough datagrams... +*/ +if (err != -EAGAIN ) {/* -* We may return less entries than requested (vlen) if the -* sock is non block and there aren't enough datagrams... +* ... or if recvmsg returns an error after we +* received some datagrams, where we record the +* error to return on the next call or if the +* app asks about it using getsockopt(SO_ERROR). */ -if (err != -EAGAIN ) { -/* -* ... or if recvmsg returns an error after we -* received some datagrams, where we record the -* error to return on the next call or if the -* app asks about it using getsockopt(SO_ERROR). -*/ - sock->sk->sk_err = -err; - } - -return datagrams; + sock->sk->sk_err = -err; } +out_put: +fput_light (sock->file, fput_needed); -return err; +return datagrams; } SYSCALL_DEFINE5(recvmmsg, int, fd, struct mmsghdr __user *, mmsg,
Greg Kroah-Hartman
maintainerPATCH 45/124 mlx4: add missing braces in verify_qp_parameters
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit baefd7015cdb304ce6c94f9679d0486c71954766 ]
The implementation of QP paravirtualization back in linux-3.7 included some code that looks very dubious, and gcc-6 has grown smart enough to warn about it:
drivers/net/ethernet/mellanox/mlx4/resource_tracker.c: In function 'verify_qp_parameters':drivers/net/ethernet/mellanox/mlx4/resource_tracker.c:3154:5: error: statement is indented as if it were guarded by... [-Werror=misleading-indentation]
if (optpar & MLX4_QP_OPTPAR_ALT_ADDR_PATH) {
^~
drivers/net/ethernet/mellanox/mlx4/resource_tracker.c:3144:4: note: ...this 'if' clause, but it is not
if (slave != mlx4_master_func_num(dev))Quoted 1 line
Quoted 1 line
From looking at the context, I'm reasonably sure that the indentation
is correct but that it should have contained curly braces from the start, as the update_gid() function in the same patch correctly does.
--- drivers/net/ethernet/mellanox/mlx4/resource_tracker.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx4/resource_tracker.c +2 -1
@@ -3141,7 +3141,7 @@ static int verify_qp_parameters(struct mcase QP_TRANS_RTS2RTS :case QP_TRANS_SQD2SQD :case QP_TRANS_SQD2RTS : -if (slave !=mlx4_master_func_num (dev)) +if (slave !=mlx4_master_func_num (dev)) {if (optpar &MLX4_QP_OPTPAR_PRIMARY_ADDR_PATH ) { port = (qp_ctx->pri_path.sched_queue >>6 &1 ) +1 ;if (dev->caps.port_mask[port] !=MLX4_PORT_TYPE_IB )
@@ -3160,6 +3160,7 @@ static int verify_qp_parameters(struct mif (qp_ctx->alt_path.mgid_index >= num_gids)return -EINVAL ; } + }break ;default :break ;
Greg Kroah-Hartman
maintainerPATCH 46/124 farsync: fix off-by-one bug in fst_add_one
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit e725a66c0202b5f36c2f9d59d26a65c53bbf21f7 ]
gcc-6 finds an out of bounds access in the fst_add_one function when calculating the end of the mmio area:
drivers/net/wan/farsync.c: In function 'fst_add_one':drivers/net/wan/farsync.c:418:53: error: index 2 denotes an offset greater than size of 'u8[2][8192] {aka unsigned char[2][8192]}' [-Werror=array-bounds]
#define BUF_OFFSET(X) (BFM_BASE + offsetof(struct buf_window, X))
^
include/linux/compiler-gcc.h:158:21: note: in definition of macro '__compiler_offsetof'
__builtin_offsetof(a, b)
^
drivers/net/wan/farsync.c:418:37: note: in expansion of macro 'offsetof'
#define BUF_OFFSET(X) (BFM_BASE + offsetof(struct buf_window, X))
^~~~~~~~drivers/net/wan/farsync.c:2519:36: note: in expansion of macro 'BUF_OFFSET'
+ BUF_OFFSET ( txBuffer[i][NUM_TX_BUFFER][0]); ^~~~~~~~~~
The warning is correct, but not critical because this appears to be a write-only variable that is set by each WAN driver but never accessed afterwards.
I'm taking the minimal fix here, using the correct pointer by pointing 'mem_end' to the last byte inside of the register area as all other WAN drivers do, rather than the first byte outside of it. An alternative would be to just remove the mem_end member entirely.
--- drivers/net/wan/farsync.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wan/farsync.c +1 -1
@@ -2516,7 +2516,7 @@ fst_add_one(struct pci_dev *pdev, const dev->mem_start = card->phys_mem +BUF_OFFSET ( txBuffer[i][0 ][0 ]); dev->mem_end = card->phys_mem - +BUF_OFFSET ( txBuffer[i][NUM_TX_BUFFER ][0 ]); + +BUF_OFFSET ( txBuffer[i][NUM_TX_BUFFER -1 ][LEN_RX_BUFFER -1 ]); dev->base_addr = card->pci_conf; dev->irq = card->irq;
Greg Kroah-Hartman
maintainerPATCH 47/124 ath9k: fix buffer overrun for ar9287
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 83d6f1f15f8cce844b0a131cbc63e444620e48b5 ]
Code that was added back in 2.6.38 has an obvious overflow when accessing a static array, and at the time it was added only a code comment was put in front of it as a reminder to have it reviewed properly.
This has not happened, but gcc-6 now points to the specific overflow:
drivers/net/wireless/ath/ath9k/eeprom.c: In function 'ath9k_hw_get_gain_boundaries_pdadcs':drivers/net/wireless/ath/ath9k/eeprom.c:483:44: error: array subscript is above array bounds [-Werror=array-bounds]
maxPwrT4[i] = data_9287[idxL].pwrPdg[i][4];
~~~~~~~~~~~~~~~~~~~~~~~~~^~~It turns out that the correct array length exists in the local 'intercepts' variable of this function, so we can just use that instead of hardcoding '4', so this patch changes all three instances to use that variable. The other two instances were already correct, but it's more consistent this way.
--- drivers/net/wireless/ath/ath9k/eeprom.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
drivers/net/wireless/ath/ath9k/eeprom.c +3 -4
@@ -477,10 +477,9 @@ void ath9k_hw_get_gain_boundaries_pdadcsif (match) {if (AR_SREV_9287 (ah)) { -/* FIXME: array overrun? */ for (i =0 ; i < numXpdGains; i++) { minPwrT4[i] = data_9287[idxL].pwrPdg[i][0 ]; - maxPwrT4[i] = data_9287[idxL].pwrPdg[i][4 ]; + maxPwrT4[i] = data_9287[idxL].pwrPdg[i][intercepts -1 ]; ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i], data_9287[idxL].pwrPdg[i], data_9287[idxL].vpdPdg[i],
@@ -490,7 +489,7 @@ void ath9k_hw_get_gain_boundaries_pdadcs }else if (eeprom_4k) {for (i =0 ; i < numXpdGains; i++) { minPwrT4[i] = data_4k[idxL].pwrPdg[i][0 ]; - maxPwrT4[i] = data_4k[idxL].pwrPdg[i][4 ]; + maxPwrT4[i] = data_4k[idxL].pwrPdg[i][intercepts -1 ]; ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i], data_4k[idxL].pwrPdg[i], data_4k[idxL].vpdPdg[i],
@@ -500,7 +499,7 @@ void ath9k_hw_get_gain_boundaries_pdadcs }else {for (i =0 ; i < numXpdGains; i++) { minPwrT4[i] = data_def[idxL].pwrPdg[i][0 ]; - maxPwrT4[i] = data_def[idxL].pwrPdg[i][4 ]; + maxPwrT4[i] = data_def[idxL].pwrPdg[i][intercepts -1 ]; ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i], data_def[idxL].pwrPdg[i], data_def[idxL].vpdPdg[i],
Greg Kroah-Hartman
maintainerPATCH 48/124 net: mvneta: Fix spinlock usage
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gregory CLEMENT <[email protected]>
[ Upstream commit 1c2722a975fdb8c90bc6ba8570b7fb62db4e2e9c ]
In the previous patch, the spinlock was not initialized. While it didn't cause any trouble yet it could be a problem to use it uninitialized.
The most annoying part was the critical section protected by the spinlock in mvneta_stop(). Some of the functions could sleep as pointed when activated CONFIG_DEBUG_ATOMIC_SLEEP. Actually, in mvneta_stop() we only need to protect the is_stopped flagged, indeed the code of the notifier for CPU online is protected by the same spinlock, so when we get the lock, the notifer work is done.
--- drivers/net/ethernet/marvell/mvneta.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
drivers/net/ethernet/marvell/mvneta.c +6 -5
@@ -3070,17 +3070,17 @@ static int mvneta_stop(struct net_devicestruct mvneta_port *pp =netdev_priv (dev);/* Inform that we are stopping so we don't want to setup the -* driver for new CPUs in the notifiers +* driver for new CPUs in the notifiers. The code of the +* notifier for CPU online is protected by the same spinlock, +* so when we get the lock, the notifer work is done. */ spin_lock (&pp->lock); pp->is_stopped = true; +spin_unlock (&pp->lock); +mvneta_stop_dev (pp);mvneta_mdio_remove (pp);unregister_cpu_notifier (&pp->cpu_notifier); -/* Now that the notifier are unregistered, we can release le -* lock -*/ -spin_unlock (&pp->lock);on_each_cpu (mvneta_percpu_disable, pp, true);free_percpu_irq (dev->irq, pp->ports);mvneta_cleanup_rxqs (pp);
@@ -3612,6 +3612,7 @@ static int mvneta_probe(struct platform_ dev->ethtool_ops = &mvneta_eth_tool_ops; pp =netdev_priv (dev); +spin_lock_init (&pp->lock); pp->phy_node = phy_node; pp->phy_interface = phy_mode;
Greg Kroah-Hartman
maintainerPATCH 49/124 ppp: ensure file->private_data cant be overridden
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guillaume Nault <[email protected]>
[ Upstream commit e8e56ffd9d2973398b60ece1f1bebb8d67b4d032 ]
Locking ppp_mutex must be done before dereferencing file->private_data, otherwise it could be modified before ppp_unattached_ioctl() takes the lock. This could lead ppp_unattached_ioctl() to override ->private_data, thus leaking reference to the ppp_file previously pointed to.
v2: lock all ppp_ioctl() instead of just checking private_data in
ppp_unattached_ioctl(), to avoid ambiguous behaviour.
--- drivers/net/ppp/ppp_generic.c | 31 +++++++++++++++++-------------- 1 file changed, 17 insertions(+), 14 deletions(-)
drivers/net/ppp/ppp_generic.c +17 -14
@@ -575,7 +575,7 @@ static int get_filter(void __user *arg,static long ppp_ioctl (struct file *file,unsigned int cmd,unsigned long arg) { -struct ppp_file *pf = file->private_data; +struct ppp_file *pf;struct ppp *ppp;int err = -EFAULT , val, val2, i;struct ppp_idle idle;
@@ -585,9 +585,14 @@ static long ppp_ioctl(struct file *file,void __user *argp = (void __user *)arg;int __user *p = argp; -if (!pf) -return ppp_unattached_ioctl (current->nsproxy->net_ns, - pf, file, cmd, arg); +mutex_lock (&ppp_mutex); + + pf = file->private_data; +if (!pf) { + err =ppp_unattached_ioctl (current->nsproxy->net_ns, + pf, file, cmd, arg); + goto out; + }if (cmd ==PPPIOCDETACH ) {/*
@@ -602,7 +607,6 @@ static long ppp_ioctl(struct file *file,* this fd and reopening /dev/ppp. */ err = -EINVAL ; -mutex_lock (&ppp_mutex);if (pf->kind ==INTERFACE ) { ppp =PF_TO_PPP (pf);rtnl_lock ();
@@ -616,15 +620,13 @@ static long ppp_ioctl(struct file *file, }else pr_warn ("PPPIOCDETACH file->f_count=%ld\n" ,atomic_long_read (&file->f_count)); -mutex_unlock (&ppp_mutex); -return err; + goto out; }if (pf->kind ==CHANNEL ) {struct channel *pch;struct ppp_channel *chan; -mutex_lock (&ppp_mutex); pch =PF_TO_CHANNEL (pf);switch (cmd) {
@@ -646,17 +648,16 @@ static long ppp_ioctl(struct file *file, err = chan->ops->ioctl (chan, cmd, arg);up_read (&pch->chan_sem); } -mutex_unlock (&ppp_mutex); -return err; + goto out; }if (pf->kind !=INTERFACE ) {/* can't happen */ pr_err ("PPP: not interface or channel??\n" ); -return -EINVAL ; + err = -EINVAL ; + goto out; } -mutex_lock (&ppp_mutex); ppp =PF_TO_PPP (pf);switch (cmd) {case PPPIOCSMRU :
@@ -831,7 +832,10 @@ static long ppp_ioctl(struct file *file,default : err = -ENOTTY ; } + +out:mutex_unlock (&ppp_mutex); +return err; }
@@ -844,7 +848,6 @@ static int ppp_unattached_ioctl(struct nstruct ppp_net *pn;int __user *p = (int __user *)arg; -mutex_lock (&ppp_mutex);switch (cmd) {case PPPIOCNEWUNIT :/* Create a new ppp unit */
@@ -894,7 +897,7 @@ static int ppp_unattached_ioctl(struct ndefault : err = -ENOTTY ; } -mutex_unlock (&ppp_mutex); +return err; }
Greg Kroah-Hartman
maintainerPATCH 50/124 tcp/dccp: remove obsolete WARN_ON() in icmp handlers
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit e316ea62e3203d524ff0239a40c56d3a39ad1b5c ]
Now SYN_RECV request sockets are installed in ehash table, an ICMP handler can find a request socket while another cpu handles an incoming packet transforming this SYN_RECV request socket into an ESTABLISHED socket.
We need to remove the now obsolete WARN_ON(req->sk), since req->sk is set when a new child is created and added into listener accept queue.
If this race happens, the ICMP will do nothing special.
--- net/dccp/ipv4.c | 2 -- net/ipv4/tcp_ipv4.c | 2 -- 2 files changed, 4 deletions(-)
net/dccp/ipv4.c +0 -2
@@ -204,8 +204,6 @@ void dccp_req_err(struct sock *sk, u64 s* ICMPs are not backlogged, hence we cannot get an established * socket here. */ -WARN_ON (req->sk); -if (!between48 (seq,dccp_rsk (req)->dreq_iss,dccp_rsk (req)->dreq_gss)) {NET_INC_STATS_BH (net,LINUX_MIB_OUTOFWINDOWICMPS ); }else {
net/ipv4/tcp_ipv4.c +0 -2
@@ -319,8 +319,6 @@ void tcp_req_err(struct sock *sk, u32 se/* ICMPs are not backlogged, hence we cannot get * an established socket here. */ -WARN_ON (req->sk); -if (seq !=tcp_rsk (req)->snt_isn) {NET_INC_STATS_BH (net,LINUX_MIB_OUTOFWINDOWICMPS ); }else if (abort) {
Greg Kroah-Hartman
maintainerPATCH 51/124 qlge: Fix receive packets drop.
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manish Chopra <[email protected]>
[ Upstream commit 2c9a266afefe137bff06bbe0fc48b4d3b3cb348c ]
When running small packets [length < 256 bytes] traffic, packets were being dropped due to invalid data in those packets which were delivered by the driver upto the stack. Using pci_dma_sync_single_for_cpu ensures copying latest and updated data into skb from the receive buffer.
--- drivers/net/ethernet/qlogic/qlge/qlge_main.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/net/ethernet/qlogic/qlge/qlge_main.c +11 -0
@@ -1648,7 +1648,18 @@ static void ql_process_mac_rx_skb(structreturn ; }skb_reserve (new_skb,NET_IP_ALIGN ); + +pci_dma_sync_single_for_cpu (qdev->pdev, +dma_unmap_addr (sbq_desc, mapaddr), +dma_unmap_len (sbq_desc, maplen), +PCI_DMA_FROMDEVICE ); +memcpy (skb_put (new_skb, length), skb->data, length); + +pci_dma_sync_single_for_device (qdev->pdev, +dma_unmap_addr (sbq_desc, mapaddr), +dma_unmap_len (sbq_desc, maplen), +PCI_DMA_FROMDEVICE ); skb = new_skb;/* Frame error, so drop the packet. */
Greg Kroah-Hartman
maintainerPATCH 52/124 net: bcmgenet: fix dma api length mismatch
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit eee577232203842b4dcadb7ab477a298479633ed ]
When un-mapping skb->data in __bcmgenet_tx_reclaim(), we must use the length that was used in original dma_map_single(), instead of skb->len that might be bigger (includes the frags)
We simply can store skb_len into tx_cb_ptr->dma_len and use it at unmap time.
--- drivers/net/ethernet/broadcom/genet/bcmgenet.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/broadcom/genet/bcmgenet.c +2 -2
@@ -1197,7 +1197,7 @@ static unsigned int __bcmgenet_tx_reclai dev->stats.tx_bytes += tx_cb_ptr->skb->len;dma_unmap_single (&dev->dev,dma_unmap_addr (tx_cb_ptr, dma_addr), - tx_cb_ptr->skb->len, +dma_unmap_len (tx_cb_ptr, dma_len),DMA_TO_DEVICE );bcmgenet_free_cb (tx_cb_ptr); }else if (dma_unmap_addr (tx_cb_ptr, dma_addr)) {
@@ -1308,7 +1308,7 @@ static int bcmgenet_xmit_single(struct n }dma_unmap_addr_set (tx_cb_ptr, dma_addr, mapping); -dma_unmap_len_set (tx_cb_ptr, dma_len, skb->len); +dma_unmap_len_set (tx_cb_ptr, dma_len, skb_len); length_status = (skb_len <<DMA_BUFLENGTH_SHIFT ) | dma_desc_flags | (priv->hw_params->qtag_mask <<DMA_TX_QTAG_SHIFT ) |DMA_TX_APPEND_CRC ;
Greg Kroah-Hartman
maintainerPATCH 53/124 bonding: fix bond_get_stats()
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit fe30937b65354c7fec244caebbdaae68e28ca797 ]
bond_get_stats() can be called from rtnetlink (with RTNL held) or from /proc/net/dev seq handler (with RCU held)
The logic added in commit 5f0c5f73e5ef ("bonding: make global bonding stats more reliable") kind of assumed only one cpu could run there.
If multiple threads are reading /proc/net/dev, stats can be really messed up after a while.
A second problem is that some fields are 32bit, so we need to properly handle the wrap around problem.
Given that RTNL is not always held, we need to use bond_for_each_slave_rcu().
--- drivers/net/bonding/bond_main.c | 63 +++++++++++++++++++++------------------- include/net/bonding.h | 1 2 files changed, 35 insertions(+), 29 deletions(-)
drivers/net/bonding/bond_main.c +34 -29
@@ -3308,6 +3308,30 @@ static int bond_close(struct net_devicereturn 0 ; } +/* fold stats, assuming all rtnl_link_stats64 fields are u64, but +* that some drivers can provide 32bit values only. +*/ +static void bond_fold_stats (struct rtnl_link_stats64 *_res, +const struct rtnl_link_stats64 *_new, +const struct rtnl_link_stats64 *_old) +{ +const u64 *new = (const u64 *)_new; +const u64 *old = (const u64 *)_old; +u64 *res = (u64 *)_res; +int i; + +for (i =0 ; i <sizeof (*_res) /sizeof (u64); i++) { +u64 nv = new[i]; +u64 ov = old[i]; + +/* detects if this particular field is 32bit only */ +if (((nv | ov) >>32 ) ==0 ) + res[i] += (u32 )nv - (u32 )ov; +else + res[i] += nv - ov; + } +} +static struct rtnl_link_stats64 *bond_get_stats (struct net_device *bond_dev,struct rtnl_link_stats64 *stats) {
@@ -3316,43 +3340,23 @@ static struct rtnl_link_stats64 *bond_gestruct list_head *iter;struct slave *slave; +spin_lock (&bond->stats_lock);memcpy (stats, &bond->bond_stats,sizeof (*stats)); -bond_for_each_slave (bond, slave, iter) { -const struct rtnl_link_stats64 *sstats = +rcu_read_lock (); +bond_for_each_slave_rcu (bond, slave, iter) { +const struct rtnl_link_stats64 *new =dev_get_stats (slave->dev, &temp); -struct rtnl_link_stats64 *pstats = &slave->slave_stats; - stats->rx_packets += sstats->rx_packets - pstats->rx_packets; - stats->rx_bytes += sstats->rx_bytes - pstats->rx_bytes; - stats->rx_errors += sstats->rx_errors - pstats->rx_errors; - stats->rx_dropped += sstats->rx_dropped - pstats->rx_dropped; - - stats->tx_packets += sstats->tx_packets - pstats->tx_packets;; - stats->tx_bytes += sstats->tx_bytes - pstats->tx_bytes; - stats->tx_errors += sstats->tx_errors - pstats->tx_errors; - stats->tx_dropped += sstats->tx_dropped - pstats->tx_dropped; - - stats->multicast += sstats->multicast - pstats->multicast; - stats->collisions += sstats->collisions - pstats->collisions; - - stats->rx_length_errors += sstats->rx_length_errors - pstats->rx_length_errors; - stats->rx_over_errors += sstats->rx_over_errors - pstats->rx_over_errors; - stats->rx_crc_errors += sstats->rx_crc_errors - pstats->rx_crc_errors; - stats->rx_frame_errors += sstats->rx_frame_errors - pstats->rx_frame_errors; - stats->rx_fifo_errors += sstats->rx_fifo_errors - pstats->rx_fifo_errors; - stats->rx_missed_errors += sstats->rx_missed_errors - pstats->rx_missed_errors; - - stats->tx_aborted_errors += sstats->tx_aborted_errors - pstats->tx_aborted_errors; - stats->tx_carrier_errors += sstats->tx_carrier_errors - pstats->tx_carrier_errors; - stats->tx_fifo_errors += sstats->tx_fifo_errors - pstats->tx_fifo_errors; - stats->tx_heartbeat_errors += sstats->tx_heartbeat_errors - pstats->tx_heartbeat_errors; - stats->tx_window_errors += sstats->tx_window_errors - pstats->tx_window_errors; +bond_fold_stats (stats, new, &slave->slave_stats);/* save off the slave stats for the next run */ -memcpy (pstats, sstats,sizeof (*sstats)); +memcpy (&slave->slave_stats, new,sizeof (*new)); } +rcu_read_unlock (); +memcpy (&bond->bond_stats, stats,sizeof (*stats)); +spin_unlock (&bond->stats_lock);return stats; }
@@ -4166,6 +4170,7 @@ void bond_setup(struct net_device *bond_struct bonding *bond =netdev_priv (bond_dev);spin_lock_init (&bond->mode_lock); +spin_lock_init (&bond->stats_lock); bond->params = bonding_defaults;/* Initialize pointers */
include/net/bonding.h +1 -0
@@ -215,6 +215,7 @@ struct bonding {* ALB mode (6) - to sync the use and modifications of its hash table */ spinlock_t mode_lock; +spinlock_t stats_lock;u8 send_peer_notif;u8 igmp_retrans;#ifdef CONFIG_PROC_FS
Greg Kroah-Hartman
maintainerPATCH 54/124 ipv4: fix broadcast packets reception
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <[email protected]>
[ Upstream commit ad0ea1989cc4d5905941d0a9e62c63ad6d859cef ]
Currently, ingress ipv4 broadcast datagrams are dropped since, in udp_v4_early_demux(), ip_check_mc_rcu() is invoked even on bcast packets.
This patch addresses the issue, invoking ip_check_mc_rcu() only for mcast packets.
--- net/ipv4/udp.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
net/ipv4/udp.c +8 -4
@@ -2082,10 +2082,14 @@ void udp_v4_early_demux(struct sk_buff *if (!in_dev)return ; - ours =ip_check_mc_rcu (in_dev, iph->daddr, iph->saddr, - iph->protocol); -if (!ours) -return ; +/* we are supposed to accept bcast packets */ +if (skb->pkt_type ==PACKET_MULTICAST ) { + ours =ip_check_mc_rcu (in_dev, iph->daddr, iph->saddr, + iph->protocol); +if (!ours) +return ; + } + sk =__udp4_lib_mcast_demux_lookup (net, uh->dest, iph->daddr, uh->source, iph->saddr, dif); }else if (skb->pkt_type ==PACKET_HOST ) {
Greg Kroah-Hartman
maintainerPATCH 55/124 ipv4: initialize flowi4_flags before calling fib_lookup()
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lance Richardson <[email protected]>
[ Upstream commit 4cfc86f3dae6ca38ed49cdd78f458a03d4d87992 ]
Field fl4.flowi4_flags is not initialized in fib_compute_spec_dst() before calling fib_lookup(), which means fib_table_lookup() is using non-deterministic data at this line:
if (!(flp->flowi4_flags & FLOWI_FLAG_SKIP_NH_OIF)) {Fix by initializing the entire fl4 structure, which will prevent similar issues as fields are added in the future by ensuring that all fields are initialized to zero unless explicitly initialized to another value.
--- net/ipv4/fib_frontend.c | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-)
net/ipv4/fib_frontend.c +7 -9
@@ -280,7 +280,6 @@ __be32 fib_compute_spec_dst(struct sk_bustruct in_device *in_dev;struct fib_result res;struct rtable *rt; -struct flowi4 fl4;struct net *net;int scope;
@@ -296,14 +295,13 @@ __be32 fib_compute_spec_dst(struct sk_bu scope =RT_SCOPE_UNIVERSE ;if (!ipv4_is_zeronet (ip_hdr (skb)->saddr)) { - fl4.flowi4_oif =0 ; - fl4.flowi4_iif =LOOPBACK_IFINDEX ; - fl4.daddr =ip_hdr (skb)->saddr; - fl4.saddr =0 ; - fl4.flowi4_tos =RT_TOS (ip_hdr (skb)->tos); - fl4.flowi4_scope = scope; - fl4.flowi4_mark =IN_DEV_SRC_VMARK (in_dev) ? skb->mark :0 ; - fl4.flowi4_tun_key.tun_id =0 ; +struct flowi4 fl4 = { + .flowi4_iif =LOOPBACK_IFINDEX , + .daddr =ip_hdr (skb)->saddr, + .flowi4_tos =RT_TOS (ip_hdr (skb)->tos), + .flowi4_scope = scope, + .flowi4_mark =IN_DEV_SRC_VMARK (in_dev) ? skb->mark :0 , + };if (!fib_lookup (net, &fl4, &res,0 ))return FIB_RES_PREFSRC (net, res); }else {
Greg Kroah-Hartman
maintainerPATCH 56/124 ppp: take reference on channels netns
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guillaume Nault <[email protected]>
[ Upstream commit 1f461dcdd296eecedaffffc6bae2bfa90bd7eb89 ]
Let channels hold a reference on their network namespace. Some channel types, like ppp_async and ppp_synctty, can have their userspace controller running in a different namespace. Therefore they can't rely on them to preclude their netns from being removed from under them.
==================================================================
BUG: KASAN: use-after-free in ppp_unregister_channel+0x372/0x3a0 at addr ffff880064e217e0 Read of size 8 by task syz-executor/11581 =============================================================================
BUG net_namespace (Not tainted): kasan: bad access detected
-----------------------------------------------------------------------------
Disabling lock debugging due to kernel taint
INFO: Allocated in copy_net_ns+0x6b/0x1a0 age=92569 cpu=3 pid=6906
[< none >] ___slab_alloc+0x4c7/0x500 kernel/mm/slub.c:2440 [< none >] __slab_alloc+0x4c/0x90 kernel/mm/slub.c:2469 [< inline >] slab_alloc_node kernel/mm/slub.c:2532 [< inline >] slab_alloc kernel/mm/slub.c:2574 [< none >] kmem_cache_alloc+0x23a/0x2b0 kernel/mm/slub.c:2579 [< inline >] kmem_cache_zalloc kernel/include/linux/slab.h:597 [< inline >] net_alloc kernel/net/core/net_namespace.c:325 [< none >] copy_net_ns+0x6b/0x1a0 kernel/net/core/net_namespace.c:360 [< none >] create_new_namespaces+0x2f6/0x610 kernel/kernel/nsproxy.c:95 [< none >] copy_namespaces+0x297/0x320 kernel/kernel/nsproxy.c:150 [< none >] copy_process.part.35+0x1bf4/0x5760 kernel/kernel/fork.c:1451 [< inline >] copy_process kernel/kernel/fork.c:1274 [< none >] _do_fork+0x1bc/0xcb0 kernel/kernel/fork.c:1723 [< inline >] SYSC_clone kernel/kernel/fork.c:1832 [< none >] SyS_clone+0x37/0x50 kernel/kernel/fork.c:1826 [< none >] entry_SYSCALL_64_fastpath+0x16/0x7a kernel/arch/x86/entry/entry_64.S:185
INFO: Freed in net_drop_ns+0x67/0x80 age=575 cpu=2 pid=2631
[< none >] __slab_free+0x1fc/0x320 kernel/mm/slub.c:2650 [< inline >] slab_free kernel/mm/slub.c:2805 [< none >] kmem_cache_free+0x2a0/0x330 kernel/mm/slub.c:2814 [< inline >] net_free kernel/net/core/net_namespace.c:341 [< none >] net_drop_ns+0x67/0x80 kernel/net/core/net_namespace.c:348 [< none >] cleanup_net+0x4e5/0x600 kernel/net/core/net_namespace.c:448 [< none >] process_one_work+0x794/0x1440 kernel/kernel/workqueue.c:2036 [< none >] worker_thread+0xdb/0xfc0 kernel/kernel/workqueue.c:2170 [< none >] kthread+0x23f/0x2d0 kernel/drivers/block/aoe/aoecmd.c:1303 [< none >] ret_from_fork+0x3f/0x70 kernel/arch/x86/entry/entry_64.S:468
INFO: Slab 0xffffea0001938800 objects=3 used=0 fp=0xffff880064e20000 flags=0x5fffc0000004080
INFO: Object 0xffff880064e20000 @offset=0 fp=0xffff880064e24200
CPU: 1 PID: 11581 Comm: syz-executor Tainted: G B 4.4.0+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.8.2-0-g33fbe13 by qemu-project.org 04/01/2014
00000000ffffffff ffff8800662c7790 ffffffff8292049d ffff88003e36a300 ffff880064e20000 ffff880064e20000 ffff8800662c77c0 ffffffff816f2054 ffff88003e36a300 ffffea0001938800 ffff880064e20000 0000000000000000
Call Trace:
[< inline >] __dump_stack kernel/lib/dump_stack.c:15
[<ffffffff8292049d>] dump_stack+0x6f/0xa2 kernel/lib/dump_stack.c:50
[<ffffffff816f2054>] print_trailer+0xf4/0x150 kernel/mm/slub.c:654
[<ffffffff816f875f>] object_err+0x2f/0x40 kernel/mm/slub.c:661
[< inline >] print_address_description kernel/mm/kasan/report.c:138
[<ffffffff816fb0c5>] kasan_report_error+0x215/0x530 kernel/mm/kasan/report.c:236
[< inline >] kasan_report kernel/mm/kasan/report.c:259
[<ffffffff816fb4de>] __asan_report_load8_noabort+0x3e/0x40 kernel/mm/kasan/report.c:280
[< inline >] ? ppp_pernet kernel/include/linux/compiler.h:218
[<ffffffff83ad71b2>] ? ppp_unregister_channel+0x372/0x3a0 kernel/drivers/net/ppp/ppp_generic.c:2392
[< inline >] ppp_pernet kernel/include/linux/compiler.h:218
[<ffffffff83ad71b2>] ppp_unregister_channel+0x372/0x3a0 kernel/drivers/net/ppp/ppp_generic.c:2392
[< inline >] ? ppp_pernet kernel/drivers/net/ppp/ppp_generic.c:293
[<ffffffff83ad6f26>] ? ppp_unregister_channel+0xe6/0x3a0 kernel/drivers/net/ppp/ppp_generic.c:2392
[<ffffffff83ae18f3>] ppp_asynctty_close+0xa3/0x130 kernel/drivers/net/ppp/ppp_async.c:241
[<ffffffff83ae1850>] ? async_lcp_peek+0x5b0/0x5b0 kernel/drivers/net/ppp/ppp_async.c:1000
[<ffffffff82c33239>] tty_ldisc_close.isra.1+0x99/0xe0 kernel/drivers/tty/tty_ldisc.c:478
[<ffffffff82c332c0>] tty_ldisc_kill+0x40/0x170 kernel/drivers/tty/tty_ldisc.c:744
[<ffffffff82c34943>] tty_ldisc_release+0x1b3/0x260 kernel/drivers/tty/tty_ldisc.c:772
[<ffffffff82c1ef21>] tty_release+0xac1/0x13e0 kernel/drivers/tty/tty_io.c:1901
[<ffffffff82c1e460>] ? release_tty+0x320/0x320 kernel/drivers/tty/tty_io.c:1688
[<ffffffff8174de36>] __fput+0x236/0x780 kernel/fs/file_table.c:208
[<ffffffff8174e405>] ____fput+0x15/0x20 kernel/fs/file_table.c:244
[<ffffffff813595ab>] task_work_run+0x16b/0x200 kernel/kernel/task_work.c:115
[< inline >] exit_task_work kernel/include/linux/task_work.h:21
[<ffffffff81307105>] do_exit+0x8b5/0x2c60 kernel/kernel/exit.c:750
[<ffffffff813fdd20>] ? debug_check_no_locks_freed+0x290/0x290 kernel/kernel/locking/lockdep.c:4123
[<ffffffff81306850>] ? mm_update_next_owner+0x6f0/0x6f0 kernel/kernel/exit.c:357
[<ffffffff813215e6>] ? __dequeue_signal+0x136/0x470 kernel/kernel/signal.c:550
[<ffffffff8132067b>] ? recalc_sigpending_tsk+0x13b/0x180 kernel/kernel/signal.c:145
[<ffffffff81309628>] do_group_exit+0x108/0x330 kernel/kernel/exit.c:880
[<ffffffff8132b9d4>] get_signal+0x5e4/0x14f0 kernel/kernel/signal.c:2307
[< inline >] ? kretprobe_table_lock kernel/kernel/kprobes.c:1113
[<ffffffff8151d355>] ? kprobe_flush_task+0xb5/0x450 kernel/kernel/kprobes.c:1158
[<ffffffff8115f7d3>] do_signal+0x83/0x1c90 kernel/arch/x86/kernel/signal.c:712
[<ffffffff8151d2a0>] ? recycle_rp_inst+0x310/0x310 kernel/include/linux/list.h:655
[<ffffffff8115f750>] ? setup_sigcontext+0x780/0x780 kernel/arch/x86/kernel/signal.c:165
[<ffffffff81380864>] ? finish_task_switch+0x424/0x5f0 kernel/kernel/sched/core.c:2692
[< inline >] ? finish_lock_switch kernel/kernel/sched/sched.h:1099
[<ffffffff81380560>] ? finish_task_switch+0x120/0x5f0 kernel/kernel/sched/core.c:2678
[< inline >] ? context_switch kernel/kernel/sched/core.c:2807
[<ffffffff85d794e9>] ? __schedule+0x919/0x1bd0 kernel/kernel/sched/core.c:3283
[<ffffffff81003901>] exit_to_usermode_loop+0xf1/0x1a0 kernel/arch/x86/entry/common.c:247
[< inline >] prepare_exit_to_usermode kernel/arch/x86/entry/common.c:282
[<ffffffff810062ef>] syscall_return_slowpath+0x19f/0x210 kernel/arch/x86/entry/common.c:344
[<ffffffff85d88022>] int_ret_from_sys_call+0x25/0x9f kernel/arch/x86/entry/entry_64.S:281
Memory state around the buggy address:
ffff880064e21680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff880064e21700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff880064e21780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff880064e21800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff880064e21880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================--- drivers/net/ppp/ppp_generic.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/ppp/ppp_generic.c +3 -1
@@ -2307,7 +2307,7 @@ int ppp_register_net_channel(struct net pch->ppp =NULL ; pch->chan = chan; - pch->chan_net = net; + pch->chan_net =get_net (net); chan->ppp = pch;init_ppp_file (&pch->file,CHANNEL ); pch->file.hdrlen = chan->hdrlen;
@@ -2404,6 +2404,8 @@ ppp_unregister_channel(struct ppp_channespin_lock_bh (&pn->all_channels_lock);list_del (&pch->list);spin_unlock_bh (&pn->all_channels_lock); +put_net (pch->chan_net); + pch->chan_net =NULL ; pch->file.dead =1 ;wake_up_interruptible (&pch->file.rwait);
Greg Kroah-Hartman
maintainerPATCH 57/124 xfrm: Fix crash observed during device unregistration and decryption
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: "[email protected]" <[email protected]>
[ Upstream commit 071d36bf21bcc837be00cea55bcef8d129e7f609 ]
A crash is observed when a decrypted packet is processed in receive path. get_rps_cpus() tries to dereference the skb->dev fields but it appears that the device is freed from the poison pattern.
[<ffffffc000af58ec>] get_rps_cpu+0x94/0x2f0 [<ffffffc000af5f94>] netif_rx_internal+0x140/0x1cc [<ffffffc000af6094>] netif_rx+0x74/0x94 [<ffffffc000bc0b6c>] xfrm_input+0x754/0x7d0 [<ffffffc000bc0bf8>] xfrm_input_resume+0x10/0x1c [<ffffffc000ba6eb8>] esp_input_done+0x20/0x30 [<ffffffc0000b64c8>] process_one_work+0x244/0x3fc [<ffffffc0000b7324>] worker_thread+0x2f8/0x418 [<ffffffc0000bb40c>] kthread+0xe0/0xec
-013|get_rps_cpu(
| dev = 0xFFFFFFC08B688000,
| skb = 0xFFFFFFC0C76AAC00 -> (
| dev = 0xFFFFFFC08B688000 -> (
| name =
"......................................................
| name_hlist = (next = 0xAAAAAAAAAAAAAAAA, pprev =0xAAAAAAAAAAA
Following are the sequence of events observed -
- Encrypted packet in receive path from netdevice is queued
- Encrypted packet queued for decryption (asynchronous)
- Netdevice brought down and freed
- Packet is decrypted and returned through callback in esp_input_done
- Packet is queued again for process in network stack using netif_rx
Since the device appears to have been freed, the dereference of skb->dev in get_rps_cpus() leads to an unhandled page fault exception.
Fix this by holding on to device reference when queueing packets asynchronously and releasing the reference on call back return.
v2: Make the change generic to xfrm as mentioned by Steffen and update the title to xfrm
--- net/xfrm/xfrm_input.c | 3 +++ 1 file changed, 3 insertions(+)
net/xfrm/xfrm_input.c +3 -0
@@ -292,12 +292,15 @@ int xfrm_input(struct sk_buff *skb, intXFRM_SKB_CB (skb)->seq.input.hi = seq_hi;skb_dst_force (skb); +dev_hold (skb->dev); nexthdr = x->type->input (x, skb);if (nexthdr == -EINPROGRESS )return 0 ; resume: +dev_put (skb->dev); +spin_lock (&x->lock);if (nexthdr <=0 ) {if (nexthdr == -EBADMSG ) {
Greg Kroah-Hartman
maintainerPATCH 59/124 ipv6: udp: fix UDP_MIB_IGNOREDMULTI updates
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 2d4212261fdf13e29728ddb5ea9d60c342cc92b5 ]
IPv6 counters updates use a different macro than IPv4.
--- net/ipv6/udp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/ipv6/udp.c +2 -2
@@ -883,8 +883,8 @@ start_lookup:flush_stack (stack, count, skb, count -1 ); }else {if (!inner_flushed) -UDP_INC_STATS_BH (net,UDP_MIB_IGNOREDMULTI , - proto ==IPPROTO_UDPLITE ); +UDP6_INC_STATS_BH (net,UDP_MIB_IGNOREDMULTI , + proto ==IPPROTO_UDPLITE );consume_skb (skb); }return 0 ;
Greg Kroah-Hartman
maintainerPATCH 60/124 bridge: Allow set bridge ageing time when switchdev disabled
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haishuang Yan <[email protected]>
[ Upstream commit 5e263f712691615fb802f06c98d7638c378f5d11 ]
When NET_SWITCHDEV=n, switchdev_port_attr_set will return -EOPNOTSUPP, we should ignore this error code and continue to set the ageing time.
--- net/bridge/br_stp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/bridge/br_stp.c +1 -1
@@ -588,7 +588,7 @@ int br_set_ageing_time(struct net_bridgeint err; err =switchdev_port_attr_set (br->dev, &attr); -if (err) +if (err && err != -EOPNOTSUPP )return err; br->ageing_time = t;
Greg Kroah-Hartman
maintainerPATCH 61/124 rtnl: fix msg size calculation in if_nlmsg_size()
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolas Dichtel <[email protected]>
[ Upstream commit c57c7a95da842807b475b823ed2e5435c42cb3b0 ]
Size of the attribute IFLA_PHYS_PORT_NAME was missing.
--- net/core/rtnetlink.c | 1 + 1 file changed, 1 insertion(+)
net/core/rtnetlink.c +1 -0
@@ -905,6 +905,7 @@ static noinline size_t if_nlmsg_size(con +rtnl_link_get_af_size (dev, ext_filter_mask)/* IFLA_AF_SPEC */ +nla_total_size (MAX_PHYS_ITEM_ID_LEN )/* IFLA_PHYS_PORT_ID */ +nla_total_size (MAX_PHYS_ITEM_ID_LEN )/* IFLA_PHYS_SWITCH_ID */ + +nla_total_size (IFNAMSIZ )/* IFLA_PHYS_PORT_NAME */ +nla_total_size (1 );/* IFLA_PROTO_DOWN */ }
Greg Kroah-Hartman
maintainerPATCH 62/124 tun, bpf: fix suspicious RCU usage in tun_{attach, detach}_filter
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <[email protected]>
[ Upstream commit 5a5abb1fa3b05dd6aa821525832644c1e7d2905f ]
Sasha Levin reported a suspicious rcu_dereference_protected() warning found while fuzzing with trinity that is similar to this one:
[ 52.765684] net/core/filter.c:2262 suspicious rcu_dereference_protected() usage!
[ 52.765688] other info that might help us debug this:
[ 52.765695] rcu_scheduler_active = 1, debug_locks = 1
[ 52.765701] 1 lock held by a.out/1525:
[ 52.765704] #0: (rtnl_mutex){+.+.+.}, at: [<ffffffff816a64b7>] rtnl_lock+0x17/0x20
[ 52.765721] stack backtrace:
[ 52.765728] CPU: 1 PID: 1525 Comm: a.out Not tainted 4.5.0+ #264
[...]
[ 52.765768] Call Trace:
[ 52.765775] [<ffffffff813e488d>] dump_stack+0x85/0xc8
[ 52.765784] [<ffffffff810f2fa5>] lockdep_rcu_suspicious+0xd5/0x110
[ 52.765792] [<ffffffff816afdc2>] sk_detach_filter+0x82/0x90
[ 52.765801] [<ffffffffa0883425>] tun_detach_filter+0x35/0x90 [tun]
[ 52.765810] [<ffffffffa0884ed4>] __tun_chr_ioctl+0x354/0x1130 [tun]
[ 52.765818] [<ffffffff8136fed0>] ? selinux_file_ioctl+0x130/0x210
[ 52.765827] [<ffffffffa0885ce3>] tun_chr_ioctl+0x13/0x20 [tun]
[ 52.765834] [<ffffffff81260ea6>] do_vfs_ioctl+0x96/0x690
[ 52.765843] [<ffffffff81364af3>] ? security_file_ioctl+0x43/0x60
[ 52.765850] [<ffffffff81261519>] SyS_ioctl+0x79/0x90
[ 52.765858] [<ffffffff81003ba2>] do_syscall_64+0x62/0x140
[ 52.765866] [<ffffffff817d563f>] entry_SYSCALL64_slow_path+0x25/0x25Same can be triggered with PROVE_RCU (+ PROVE_RCU_REPEATEDLY) enabled from tun_attach_filter() when user space calls ioctl(tun_fd, TUN{ATTACH, DETACH}FILTER, ...) for adding/removing a BPF filter on tap devices.
Since the fix in f91ff5b9ff52 ("net: sk_{detach|attach}_filter() rcu fixes") sk_attach_filter()/sk_detach_filter() now dereferences the filter with rcu_dereference_protected(), checking whether socket lock is held in control path.
Since its introduction in 994051625981 ("tun: socket filter support"), tap filters are managed under RTNL lock from __tun_chr_ioctl(). Thus the sock_owned_by_user(sk) doesn't apply in this specific case and therefore triggers the false positive.
Extend the BPF API with __sk_attach_filter()/__sk_detach_filter() pair that is used by tap filters and pass in lockdep_rtnl_is_held() for the rcu_dereference_protected() checks instead.
--- drivers/net/tun.c | 8 +++++--- include/linux/filter.h | 4 ++++ net/core/filter.c | 33 +++++++++++++++++++++------------ 3 files changed, 30 insertions(+), 15 deletions(-)
drivers/net/tun.c +5 -3
@@ -621,7 +621,8 @@ static int tun_attach(struct tun_struct/* Re-attach the filter to persist device */ if (!skip_filter && (tun->filter_attached == true)) { - err =sk_attach_filter (&tun->fprog, tfile->socket.sk); + err =__sk_attach_filter (&tun->fprog, tfile->socket.sk, +lockdep_rtnl_is_held ());if (!err) goto out; }
@@ -1807,7 +1808,7 @@ static void tun_detach_filter(struct tunfor (i =0 ; i < n; i++) { tfile =rtnl_dereference (tun->tfiles[i]); -sk_detach_filter (tfile->socket.sk); +__sk_detach_filter (tfile->socket.sk,lockdep_rtnl_is_held ()); } tun->filter_attached = false;
@@ -1820,7 +1821,8 @@ static int tun_attach_filter(struct tun_for (i =0 ; i < tun->numqueues; i++) { tfile =rtnl_dereference (tun->tfiles[i]); - ret =sk_attach_filter (&tun->fprog, tfile->socket.sk); + ret =__sk_attach_filter (&tun->fprog, tfile->socket.sk, +lockdep_rtnl_is_held ());if (ret) {tun_detach_filter (tun, i);return ret;
include/linux/filter.h +4 -0
@@ -465,10 +465,14 @@ int bpf_prog_create_from_user(struct bpfvoid bpf_prog_destroy (struct bpf_prog *fp);int sk_attach_filter (struct sock_fprog *fprog,struct sock *sk); +int __sk_attach_filter (struct sock_fprog *fprog,struct sock *sk, +bool locked);int sk_attach_bpf (u32 ufd,struct sock *sk);int sk_reuseport_attach_filter (struct sock_fprog *fprog,struct sock *sk);int sk_reuseport_attach_bpf (u32 ufd,struct sock *sk);int sk_detach_filter (struct sock *sk); +int __sk_detach_filter (struct sock *sk,bool locked); +int sk_get_filter (struct sock *sk,struct sock_filter __user *filter,unsigned int len);
net/core/filter.c +21 -12
@@ -1147,7 +1147,8 @@ void bpf_prog_destroy(struct bpf_prog *f }EXPORT_SYMBOL_GPL (bpf_prog_destroy); -static int __sk_attach_prog (struct bpf_prog *prog,struct sock *sk) +static int __sk_attach_prog (struct bpf_prog *prog,struct sock *sk, +bool locked) {struct sk_filter *fp, *old_fp;
@@ -1163,10 +1164,8 @@ static int __sk_attach_prog(struct bpf_preturn -ENOMEM ; } - old_fp =rcu_dereference_protected (sk->sk_filter, -sock_owned_by_user (sk)); + old_fp =rcu_dereference_protected (sk->sk_filter, locked);rcu_assign_pointer (sk->sk_filter, fp); -if (old_fp)sk_filter_uncharge (sk, old_fp);
@@ -1245,7 +1244,8 @@ struct bpf_prog *__get_filter(struct soc* occurs or there is insufficient memory for the filter a negative * errno code is returned. On success the return is zero. */ -int sk_attach_filter (struct sock_fprog *fprog,struct sock *sk) +int __sk_attach_filter (struct sock_fprog *fprog,struct sock *sk, +bool locked) {struct bpf_prog *prog =__get_filter (fprog, sk);int err;
@@ -1253,7 +1253,7 @@ int sk_attach_filter(struct sock_fprog *if (IS_ERR (prog))return PTR_ERR (prog); - err =__sk_attach_prog (prog, sk); + err =__sk_attach_prog (prog, sk, locked);if (err <0 ) {__bpf_prog_release (prog);return err;
@@ -1261,7 +1261,12 @@ int sk_attach_filter(struct sock_fprog *return 0 ; } -EXPORT_SYMBOL_GPL (sk_attach_filter); +EXPORT_SYMBOL_GPL (__sk_attach_filter); + +int sk_attach_filter (struct sock_fprog *fprog,struct sock *sk) +{ +return __sk_attach_filter (fprog, sk,sock_owned_by_user (sk)); +}int sk_reuseport_attach_filter (struct sock_fprog *fprog,struct sock *sk) {
@@ -1307,7 +1312,7 @@ int sk_attach_bpf(u32 ufd, struct sock *if (IS_ERR (prog))return PTR_ERR (prog); - err =__sk_attach_prog (prog, sk); + err =__sk_attach_prog (prog, sk,sock_owned_by_user (sk));if (err <0 ) {bpf_prog_put (prog);return err;
@@ -2105,7 +2110,7 @@ static int __init register_sk_filter_ops }late_initcall (register_sk_filter_ops); -int sk_detach_filter (struct sock *sk) +int __sk_detach_filter (struct sock *sk,bool locked) {int ret = -ENOENT ;struct sk_filter *filter;
@@ -2113,8 +2118,7 @@ int sk_detach_filter(struct sock *sk)if (sock_flag (sk,SOCK_FILTER_LOCKED ))return -EPERM ; - filter =rcu_dereference_protected (sk->sk_filter, -sock_owned_by_user (sk)); + filter =rcu_dereference_protected (sk->sk_filter, locked);if (filter) {RCU_INIT_POINTER (sk->sk_filter,NULL );sk_filter_uncharge (sk, filter);
@@ -2123,7 +2127,12 @@ int sk_detach_filter(struct sock *sk)return ret; } -EXPORT_SYMBOL_GPL (sk_detach_filter); +EXPORT_SYMBOL_GPL (__sk_detach_filter); + +int sk_detach_filter (struct sock *sk) +{ +return __sk_detach_filter (sk,sock_owned_by_user (sk)); +}int sk_get_filter (struct sock *sk,struct sock_filter __user *ubuf,unsigned int len)
Greg Kroah-Hartman
maintainerPATCH 63/124 tuntap: restore default qdisc
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Wang <[email protected]>
[ Upstream commit 016adb7260f481168c03e09f785184d6d5278894 ]
After commit f84bb1eac027 ("net: fix IFF_NO_QUEUE for drivers using alloc_netdev"), default qdisc was changed to noqueue because tuntap does not set tx_queue_len during .setup(). This patch restores default qdisc by setting tx_queue_len in tun_setup().
--- drivers/net/tun.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/tun.c +2 -2
@@ -1001,7 +1001,6 @@ static void tun_net_init(struct net_devi/* Zero header length */ dev->type =ARPHRD_NONE ; dev->flags =IFF_POINTOPOINT |IFF_NOARP |IFF_MULTICAST ; - dev->tx_queue_len =TUN_READQ_SIZE ;/* We prefer our own queue length */ break ;case IFF_TAP :
@@ -1013,7 +1012,6 @@ static void tun_net_init(struct net_devieth_hw_addr_random (dev); - dev->tx_queue_len =TUN_READQ_SIZE ;/* We prefer our own queue length */ break ; } }
@@ -1467,6 +1465,8 @@ static void tun_setup(struct net_device dev->ethtool_ops = &tun_ethtool_ops; dev->destructor = tun_free_netdev; +/* We prefer our own queue length */ + dev->tx_queue_len =TUN_READQ_SIZE ; }/* Trivial set of netlink ops to allow deleting tun or tap
Greg Kroah-Hartman
maintainerPATCH 64/124 ipv4: l2tp: fix a potential issue in l2tp_ip_recv
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haishuang Yan <[email protected]>
[ Upstream commit 5745b8232e942abd5e16e85fa9b27cc21324acf0 ]
pskb_may_pull() can change skb->data, so we have to load ptr/optr at the right place.
--- net/l2tp/l2tp_ip.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
net/l2tp/l2tp_ip.c +5 -3
@@ -123,12 +123,11 @@ static int l2tp_ip_recv(struct sk_buff *struct l2tp_tunnel *tunnel =NULL ;int length; -/* Point to L2TP header */ - optr = ptr = skb->data; -if (!pskb_may_pull (skb,4 )) goto discard; +/* Point to L2TP header */ + optr = ptr = skb->data; session_id =ntohl (*((__be32 *) ptr)); ptr +=4 ;
@@ -156,6 +155,9 @@ static int l2tp_ip_recv(struct sk_buff *if (!pskb_may_pull (skb, length)) goto discard; +/* Point to L2TP header */ + optr = ptr = skb->data; + ptr +=4 ;pr_debug ("%s: ip recv\n" , tunnel->name);print_hex_dump_bytes ("" ,DUMP_PREFIX_OFFSET , ptr, length); }
Greg Kroah-Hartman
maintainerPATCH 65/124 ipv6: l2tp: fix a potential issue in l2tp_ip6_recv
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haishuang Yan <[email protected]>
[ Upstream commit be447f305494e019dfc37ea4cdf3b0e4200b4eba ]
pskb_may_pull() can change skb->data, so we have to load ptr/optr at the right place.
--- net/l2tp/l2tp_ip6.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
net/l2tp/l2tp_ip6.c +5 -3
@@ -135,12 +135,11 @@ static int l2tp_ip6_recv(struct sk_buffstruct l2tp_tunnel *tunnel =NULL ;int length; -/* Point to L2TP header */ - optr = ptr = skb->data; -if (!pskb_may_pull (skb,4 )) goto discard; +/* Point to L2TP header */ + optr = ptr = skb->data; session_id =ntohl (*((__be32 *) ptr)); ptr +=4 ;
@@ -168,6 +167,9 @@ static int l2tp_ip6_recv(struct sk_buffif (!pskb_may_pull (skb, length)) goto discard; +/* Point to L2TP header */ + optr = ptr = skb->data; + ptr +=4 ;pr_debug ("%s: ip recv\n" , tunnel->name);print_hex_dump_bytes ("" ,DUMP_PREFIX_OFFSET , ptr, length); }
Greg Kroah-Hartman
maintainerPATCH 66/124 ip6_tunnel: set rtnl_link_ops before calling register_netdevice
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thadeu Lima de Souza Cascardo <[email protected]>
[ Upstream commit b6ee376cb0b7fb4e7e07d6cd248bd40436fb9ba6 ]
When creating an ip6tnl tunnel with ip tunnel, rtnl_link_ops is not set before ip6_tnl_create2 is called. When register_netdevice is called, there is no linkinfo attribute in the NEWLINK message because of that.
Setting rtnl_link_ops before calling register_netdevice fixes that.
--- net/ipv6/ip6_tunnel.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv6/ip6_tunnel.c +1 -1
@@ -343,12 +343,12 @@ static int ip6_tnl_create2(struct net_de t =netdev_priv (dev); + dev->rtnl_link_ops = &ip6_link_ops; err =register_netdevice (dev);if (err <0 ) goto out;strcpy (t->parms.name, dev->name); - dev->rtnl_link_ops = &ip6_link_ops;dev_hold (dev);ip6_tnl_link (ip6n, t);
Greg Kroah-Hartman
maintainerPATCH 67/124 ipv6: Count in extension headers in skb->network_header
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Sitnicki <[email protected]>
[ Upstream commit 3ba3458fb9c050718b95275a3310b74415e767e2 ]
When sending a UDPv6 message longer than MTU, account for the length of fragmentable IPv6 extension headers in skb->network_header offset. Same as we do in alloc_new_skb path in __ip6_append_data().
This ensures that later on __ip6_make_skb() will make space in headroom for fragmentable extension headers:
/* move skb->data to ip header from ext header */ if (skb->data < skb_network_header(skb)) __skb_pull(skb, skb_network_offset(skb));
Prevents a splat due to skb_under_panic:
skbuff: skb_under_panic: text:ffffffff8143397b len:2126 put:14 \
head:ffff880005bacf50 data:ffff880005bacf4a tail:0x48 end:0xc0 dev:lo
------------[ cut here ]------------ kernel BUG at net/core/skbuff.c:104! invalid opcode: 0000 [#1] KASAN CPU: 0 PID: 160 Comm: reproducer Not tainted 4.6.0-rc2 #65 [...] Call Trace: [<ffffffff813eb7b9>] skb_push+0x79/0x80 [<ffffffff8143397b>] eth_header+0x2b/0x100 [<ffffffff8141e0d0>] neigh_resolve_output+0x210/0x310 [<ffffffff814eab77>] ip6_finish_output2+0x4a7/0x7c0 [<ffffffff814efe3a>] ip6_output+0x16a/0x280 [<ffffffff815440c1>] ip6_local_out+0xb1/0xf0 [<ffffffff814f1115>] ip6_send_skb+0x45/0xd0 [<ffffffff81518836>] udp_v6_send_skb+0x246/0x5d0 [<ffffffff8151985e>] udpv6_sendmsg+0xa6e/0x1090
[...]
--- net/ipv6/ip6_output.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
net/ipv6/ip6_output.c +4 -4
@@ -1091,8 +1091,8 @@ static inline int ip6_ufo_append_data(stint getfrag (void *from,char *to,int offset,int len,int odd,struct sk_buff *skb), void *from, int length, int hh_len, int fragheaderlen, - int transhdrlen, int mtu, unsigned int flags, - const struct flowi6 *fl6) + int exthdrlen, int transhdrlen, int mtu, + unsigned int flags, const struct flowi6 *fl6) { struct sk_buff *skb;
@@ -1117,7 +1117,7 @@ static inline int ip6_ufo_append_data(stskb_put (skb, fragheaderlen + transhdrlen);/* initialize network header pointer */ -skb_reset_network_header (skb); +skb_set_network_header (skb, exthdrlen);/* initialize protocol header pointer */ skb->transport_header = skb->network_header + fragheaderlen;
@@ -1359,7 +1359,7 @@ emsgsize: (rt->dst.dev->features & NETIF_F_UFO) && (sk->sk_type == SOCK_DGRAM) && !udp_get_no_check6_tx(sk)) { err =ip6_ufo_append_data (sk, queue, getfrag, from, length, - hh_len, fragheaderlen, + hh_len, fragheaderlen, exthdrlen, transhdrlen, mtu, flags, fl6);if (err) goto error;
Greg Kroah-Hartman
maintainerPATCH 68/124 mpls: find_outdev: check for err ptr in addition to NULL check
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roopa Prabhu <[email protected]>
[ Upstream commit 94a57f1f8a9de90ab4b0f8748361ff8be706c80c ]
find_outdev calls inet{,6}_fib_lookup_dev() or dev_get_by_index() to find the output device. In case of an error, inet{,6}_fib_lookup_dev() returns error pointer and dev_get_by_index() returns NULL. But the function only checks for NULL and thus can end up calling dev_put on an ERR_PTR. This patch adds an additional check for err ptr after the NULL check.
Before: Trying to add an mpls route with no oif from user, no available path to 10.1.1.8 and no default route:
$ip -f mpls route add 100 as 200 via inet 10.1.1.8
[ 822.337195] BUG: unable to handle kernel NULL pointer dereference at 00000000000003a3 [ 822.340033] IP: [<ffffffff8148781e>] mpls_nh_assign_dev+0x10b/0x182 [ 822.340033] PGD 1db38067 PUD 1de9e067 PMD 0 [ 822.340033] Oops: 0000 [#1] SMP [ 822.340033] Modules linked in: [ 822.340033] CPU: 0 PID: 11148 Comm: ip Not tainted 4.5.0-rc7+ #54 [ 822.340033] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.7.5.1-0-g8936dbb-20141113_115728-nilsson.home.kraxel.org 04/01/2014 [ 822.340033] task: ffff88001db82580 ti: ffff88001dad4000 task.ti: ffff88001dad4000 [ 822.340033] RIP: 0010:[<ffffffff8148781e>] [<ffffffff8148781e>] mpls_nh_assign_dev+0x10b/0x182 [ 822.340033] RSP: 0018:ffff88001dad7a88 EFLAGS: 00010282 [ 822.340033] RAX: ffffffffffffff9b RBX: ffffffffffffff9b RCX: 0000000000000002 [ 822.340033] RDX: 00000000ffffff9b RSI: 0000000000000008 RDI: 0000000000000000 [ 822.340033] RBP: ffff88001ddc9ea0 R08: ffff88001e9f1768 R09: 0000000000000000 [ 822.340033] R10: ffff88001d9c1100 R11: ffff88001e3c89f0 R12: ffffffff8187e0c0 [ 822.340033] R13: ffffffff8187e0c0 R14: ffff88001ddc9e80 R15: 0000000000000004 [ 822.340033] FS: 00007ff9ed798700(0000) GS:ffff88001fc00000(0000) knlGS:0000000000000000 [ 822.340033] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 822.340033] CR2: 00000000000003a3 CR3: 000000001de89000 CR4: 00000000000006f0 [ 822.340033] Stack: [ 822.340033] 0000000000000000 0000000100000000 0000000000000000 0000000000000000 [ 822.340033] 0000000000000000 0801010a00000000 0000000000000000 0000000000000000 [ 822.340033] 0000000000000004 ffffffff8148749b ffffffff8187e0c0 000000000000001c [ 822.340033] Call Trace: [ 822.340033] [<ffffffff8148749b>] ? mpls_rt_alloc+0x2b/0x3e [ 822.340033] [<ffffffff81488e66>] ? mpls_rtm_newroute+0x358/0x3e2 [ 822.340033] [<ffffffff810e7bbc>] ? get_page+0x5/0xa [ 822.340033] [<ffffffff813b7d94>] ? rtnetlink_rcv_msg+0x17e/0x191 [ 822.340033] [<ffffffff8111794e>] ? __kmalloc_track_caller+0x8c/0x9e [ 822.340033] [<ffffffff813c9393>] ? rht_key_hashfn.isra.20.constprop.57+0x14/0x1f [ 822.340033] [<ffffffff813b7c16>] ? __rtnl_unlock+0xc/0xc [ 822.340033] [<ffffffff813cb794>] ? netlink_rcv_skb+0x36/0x82 [ 822.340033] [<ffffffff813b4507>] ? rtnetlink_rcv+0x1f/0x28 [ 822.340033] [<ffffffff813cb2b1>] ? netlink_unicast+0x106/0x189 [ 822.340033] [<ffffffff813cb5b3>] ? netlink_sendmsg+0x27f/0x2c8 [ 822.340033] [<ffffffff81392ede>] ? sock_sendmsg_nosec+0x10/0x1b [ 822.340033] [<ffffffff81393df1>] ? ___sys_sendmsg+0x182/0x1e3 [ 822.340033] [<ffffffff810e4f35>] ? __alloc_pages_nodemask+0x11c/0x1e4 [ 822.340033] [<ffffffff8110619c>] ? PageAnon+0x5/0xd [ 822.340033] [<ffffffff811062fe>] ? __page_set_anon_rmap+0x45/0x52 [ 822.340033] [<ffffffff810e7bbc>] ? get_page+0x5/0xa [ 822.340033] [<ffffffff810e85ab>] ? __lru_cache_add+0x1a/0x3a [ 822.340033] [<ffffffff81087ea9>] ? current_kernel_time64+0x9/0x30 [ 822.340033] [<ffffffff813940c4>] ? __sys_sendmsg+0x3c/0x5a [ 822.340033] [<ffffffff8148f597>] ? entry_SYSCALL_64_fastpath+0x12/0x6a [ 822.340033] Code: 83 08 04 00 00 65 ff 00 48 8b 3c 24 e8 40 7c f2 ff eb 13 48 c7 c3 9f ff ff ff eb 0f 89 ce e8 f1 ae f1 ff 48 89 c3 48 85 db 74 15 <48> 8b 83 08 04 00 00 65 ff 08 48 81 fb 00 f0 ff ff 76 0d eb 07 [ 822.340033] RIP [<ffffffff8148781e>] mpls_nh_assign_dev+0x10b/0x182 [ 822.340033] RSP <ffff88001dad7a88> [ 822.340033] CR2: 00000000000003a3 [ 822.435363] ---[ end trace 98cc65e6f6b8bf11 ]---
After patch:
$ip -f mpls route add 100 as 200 via inet 10.1.1.8 RTNETLINK answers: Network is unreachable
--- net/mpls/af_mpls.c | 3 +++ 1 file changed, 3 insertions(+)
net/mpls/af_mpls.c +3 -0
@@ -543,6 +543,9 @@ static struct net_device *find_outdev(stif (!dev)return ERR_PTR (-ENODEV ); +if (IS_ERR (dev)) +return dev; +/* The caller is holding rtnl anyways, so release the dev reference */ dev_put (dev);
Greg Kroah-Hartman
maintainerPATCH 69/124 USB: uas: Limit qdepth at the scsi-host level
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
commit 198de51dbc3454d95b015ca0a055b673f85f01bb upstream.
Commit 64d513ac31bd ("scsi: use host wide tags by default") causes the SCSI core to queue more commands then we can handle on devices with multiple LUNs, limit the queue depth at the scsi-host level instead of per slave to fix this.
--- drivers/usb/storage/uas.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/usb/storage/uas.c +6 -1
@@ -800,7 +800,6 @@ static int uas_slave_configure(struct scif (devinfo->flags &US_FL_BROKEN_FUA ) sdev->broken_fua =1 ; -scsi_change_queue_depth (sdev, devinfo->qdepth -2 );return 0 ; }
@@ -932,6 +931,12 @@ static int uas_probe(struct usb_interfacif (result) goto set_alt0; +/* +* 1 tag is reserved for untagged commands + +* 1 tag to avoid off by one errors in some bridge firmwares +*/ + shost->can_queue = devinfo->qdepth -2 ; +usb_set_intfdata (intf, shost); result =scsi_add_host (shost, &intf->dev);if (result)
Greg Kroah-Hartman
maintainerPATCH 70/124 USB: uas: Add a new NO_REPORT_LUNS quirk
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
commit 1363074667a6b7d0507527742ccd7bbed5e3ceaa upstream.
Add a new NO_REPORT_LUNS quirk and set it for Seagate drives with an usb-id of: 0bc2:331a, as these will fail to respond to a REPORT_LUNS command.
--- Documentation/kernel-parameters.txt | 2 ++ drivers/usb/storage/uas.c | 14 +++++++++++++- drivers/usb/storage/unusual_uas.h | 7 +++++++ drivers/usb/storage/usb.c | 5 ++++- include/linux/usb_usual.h | 2 ++ 5 files changed, 28 insertions(+), 2 deletions(-)
Documentation/kernel-parameters.txt +2 -0
@@ -4016,6 +4016,8 @@ bytes respectively. Such letter suffixes sector if the number is odd); i = IGNORE_DEVICE (don't bind to this device); + j = NO_REPORT_LUNS (don't use report luns + command, uas only); l = NOT_LOCKABLE (don't try to lock and unlock ejectable media); m = MAX_SECTORS_64 (don't transfer more
drivers/usb/storage/uas.c +13 -1
@@ -2,7 +2,7 @@* USB Attached SCSI * Note that this is not the same as the USB Mass Storage driver * -* Copyright Hans de Goede <[email protected]> for Red Hat, Inc. 2013 - 2014 +* Copyright Hans de Goede <[email protected]> for Red Hat, Inc. 2013 - 2016 * Copyright Matthew Wilcox for Intel Corp, 2010 * Copyright Sarah Sharp for Intel Corp, 2010 *
@@ -757,6 +757,17 @@ static int uas_eh_bus_reset_handler(strureturn SUCCESS ; } +static int uas_target_alloc (struct scsi_target *starget) +{ +struct uas_dev_info *devinfo = (struct uas_dev_info *) +dev_to_shost (starget->dev.parent)->hostdata; + +if (devinfo->flags &US_FL_NO_REPORT_LUNS ) + starget->no_report_luns =1 ; + +return 0 ; +} +static int uas_slave_alloc (struct scsi_device *sdev) { struct uas_dev_info *devinfo =
@@ -807,6 +818,7 @@ static struct scsi_host_template uas_hos .module = THIS_MODULE, .name = "uas", .queuecommand = uas_queuecommand, + .target_alloc = uas_target_alloc, .slave_alloc = uas_slave_alloc, .slave_configure = uas_slave_configure, .eh_abort_handler = uas_eh_abort_handler,
drivers/usb/storage/unusual_uas.h +7 -0
@@ -64,6 +64,13 @@ UNUSUAL_DEV(0x0bc2, 0x3312, 0x0000, 0x99 USB_SC_DEVICE, USB_PR_DEVICE, NULL, US_FL_NO_ATA_1X), +/* Reported-by: David Webb <[email protected]> */ +UNUSUAL_DEV (0x0bc2 ,0x331a ,0x0000 ,0x9999 , +"Seagate" , +"Expansion Desk" , +USB_SC_DEVICE ,USB_PR_DEVICE ,NULL , +US_FL_NO_REPORT_LUNS ), +/* Reported-by: Hans de Goede <[email protected]> */ UNUSUAL_DEV(0x0bc2, 0x3320, 0x0000, 0x9999, "Seagate",
drivers/usb/storage/usb.c +4 -1
@@ -482,7 +482,7 @@ void usb_stor_adjust_quirks(struct usb_dUS_FL_NO_READ_DISC_INFO |US_FL_NO_READ_CAPACITY_16 |US_FL_INITIAL_READ10 |US_FL_WRITE_CACHE |US_FL_NO_ATA_1X |US_FL_NO_REPORT_OPCODES | - US_FL_MAX_SECTORS_240); + US_FL_MAX_SECTORS_240 | US_FL_NO_REPORT_LUNS); p = quirks;while (*p) {
@@ -532,6 +532,9 @@ void usb_stor_adjust_quirks(struct usb_dcase 'i' : f |=US_FL_IGNORE_DEVICE ;break ; +case 'j' : + f |=US_FL_NO_REPORT_LUNS ; +break ;case 'l' : f |=US_FL_NOT_LOCKABLE ;break ;
include/linux/usb_usual.h +2 -0
@@ -79,6 +79,8 @@/* Cannot handle MI_REPORT_SUPPORTED_OPERATION_CODES */ \US_FLAG (MAX_SECTORS_240 ,0x08000000 ) \ /* Sets max_sectors to 240 */ \ +US_FLAG (NO_REPORT_LUNS ,0x10000000 ) \ + /* Cannot handle REPORT_LUNS */ \#define US_FLAG (name, value) US_FL_##name = value ,enum {US_DO_ALL_FLAGS };
Greg Kroah-Hartman
maintainerPATCH 71/124 KVM: x86: Inject pending interrupt even if pending nmi exist
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuki Shibuya <[email protected]>
commit 321c5658c5e9192dea0d58ab67cf1791e45b2b26 upstream.
Non maskable interrupts (NMI) are preferred to interrupts in current implementation. If a NMI is pending and NMI is blocked by the result of nmi_allowed(), pending interrupt is not injected and enable_irq_window() is not executed, even if interrupts injection is allowed.
In old kernel (e.g. 2.6.32), schedule() is often called in NMI context. In this case, interrupts are needed to execute iret that intends end of NMI. The flag of blocking new NMI is not cleared until the guest execute the iret, and interrupts are blocked by pending NMI. Due to this, iret can't be invoked in the guest, and the guest is starved until block is cleared by some events (e.g. canceling injection).
This patch injects pending interrupts, when it's allowed, even if NMI is blocked. And, If an interrupts is pending after executing inject_pending_event(), enable_irq_window() is executed regardless of NMI pending counter.
--- arch/x86/kvm/x86.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-)
arch/x86/kvm/x86.c +10 -10
@@ -6074,12 +6074,10 @@ static int inject_pending_event(struct k }/* try to inject new event if pending */ -if (vcpu->arch.nmi_pending) { -if (kvm_x86_ops->nmi_allowed (vcpu)) { - --vcpu->arch.nmi_pending; - vcpu->arch.nmi_injected = true; - kvm_x86_ops->set_nmi (vcpu); - } +if (vcpu->arch.nmi_pending && kvm_x86_ops->nmi_allowed (vcpu)) { + --vcpu->arch.nmi_pending; + vcpu->arch.nmi_injected = true; + kvm_x86_ops->set_nmi (vcpu); }else if (kvm_cpu_has_injectable_intr (vcpu)) {/* * Because interrupts can be injected asynchronously, we are
@@ -6548,10 +6546,12 @@ static int vcpu_enter_guest(struct kvm_vif (inject_pending_event (vcpu, req_int_win) !=0 ) req_immediate_exit = true;/* enable NMI/IRQ window open exits if needed */ -else if (vcpu->arch.nmi_pending) - kvm_x86_ops->enable_nmi_window (vcpu); -else if (kvm_cpu_has_injectable_intr (vcpu) || req_int_win) - kvm_x86_ops->enable_irq_window (vcpu); +else { +if (vcpu->arch.nmi_pending) + kvm_x86_ops->enable_nmi_window (vcpu); +if (kvm_cpu_has_injectable_intr (vcpu) || req_int_win) + kvm_x86_ops->enable_irq_window (vcpu); + }if (kvm_lapic_enabled (vcpu)) {update_cr8_intercept (vcpu);
Greg Kroah-Hartman
maintainerPATCH 72/124 KVM: x86: reduce default value of halt_poll_ns parameter
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Bonzini <[email protected]>
commit 14ebda3394fd3e5388747e742e510b0802a65d24 upstream.
Windows lets applications choose the frequency of the timer tick, and in Windows 10 the maximum rate was changed from 1024 Hz to 2048 Hz. Unfortunately, because of the way the Windows API works, most applications who need a higher rate than the default 64 Hz will just do
timeGetDevCaps(&tc, sizeof(tc)); timeBeginPeriod(tc.wPeriodMin);
and pick the maximum rate. This causes very high CPU usage when playing media or games on Windows 10, even if the guest does not actually use the CPU very much, because the frequent timer tick causes halt_poll_ns to kick in.
There is no really good solution, especially because Microsoft could sooner or later bump the limit to 4096 Hz, but for now the best we can do is lower a bit the upper limit for halt_poll_ns. :-(
--- arch/x86/include/asm/kvm_host.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/include/asm/kvm_host.h +1 -1
@@ -42,7 +42,7 @@#define KVM_PIO_PAGE_OFFSET 1#define KVM_COALESCED_MMIO_PAGE_OFFSET 2 -#define KVM_HALT_POLL_NS_DEFAULT 500000 +#define KVM_HALT_POLL_NS_DEFAULT 400000#define KVM_IRQCHIP_NUM_PINS KVM_IOAPIC_NUM_PINS
Greg Kroah-Hartman
maintainerPATCH 73/124 MIPS: Fix MSA ld unaligned failure cases
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Burton <[email protected]>
commit fa8ff601d72bad3078ddf5ef17a5547700d06908 upstream.
Copying the content of an MSA vector from user memory may involve TLB faults & mapping in pages. This will fail when preemption is disabled due to an inability to acquire mmap_sem from do_page_fault, which meant such vector loads to unmapped pages would always fail to be emulated. Fix this by disabling preemption later only around the updating of vector register state.
This change does however introduce a race between performing the load into thread context & the thread being preempted, saving its current live context & clobbering the loaded value. This should be a rare occureence, so optimise for the fast path by simply repeating the load if we are preempted.
Additionally if the copy failed then the failure path was taken with preemption left disabled, leading to the kernel typically encountering further issues around sleeping whilst atomic. The change to where preemption is disabled avoids this issue.
Patchwork: https://patchwork.linux-mips.org/patch/12345/
--- arch/mips/kernel/unaligned.c | 53 +++++++++++++++++++++++++------------------ 1 file changed, 31 insertions(+), 22 deletions(-)
arch/mips/kernel/unaligned.c +31 -22
@@ -885,7 +885,7 @@ static void emulate_load_store_insn(stru {union mips_instruction insn;unsigned long value; -unsigned int res; +unsigned int res, preempted;unsigned long origpc;unsigned long orig31;void __user *fault_addr =NULL ;
@@ -1226,27 +1226,36 @@ static void emulate_load_store_insn(struif (!access_ok (VERIFY_READ , addr,sizeof (*fpr))) goto sigbus; -/* -* Disable preemption to avoid a race between copying -* state from userland, migrating to another CPU and -* updating the hardware vector register below. -*/ -preempt_disable (); - - res =__copy_from_user_inatomic (fpr, addr, -sizeof (*fpr)); -if (res) - goto fault; - -/* -* Update the hardware register if it is in use by the -* task in this quantum, in order to avoid having to -* save & restore the whole vector context. -*/ -if (test_thread_flag (TIF_USEDMSA )) -write_msa_wr (wd, fpr, df); - -preempt_enable (); +do { +/* +* If we have live MSA context keep track of +* whether we get preempted in order to avoid +* the register context we load being clobbered +* by the live context as it's saved during +* preemption. If we don't have live context +* then it can't be saved to clobber the value +* we load. +*/ + preempted =test_thread_flag (TIF_USEDMSA ); + + res =__copy_from_user_inatomic (fpr, addr, +sizeof (*fpr)); +if (res) + goto fault; + +/* +* Update the hardware register if it is in use +* by the task in this quantum, in order to +* avoid having to save & restore the whole +* vector context. +*/ +preempt_disable (); +if (test_thread_flag (TIF_USEDMSA )) { +write_msa_wr (wd, fpr, df); + preempted =0 ; + } +preempt_enable (); + }while (preempted);break ;case msa_st_op:
Greg Kroah-Hartman
maintainerPATCH 74/124 pinctrl: pistachio: fix mfio84-89 function description and pinmux.
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Govindraj Raja <[email protected]>
commit e9adb336d0bf391be23e820975ca5cd12c31d781 upstream.
mfio 84 to 89 are described wrongly, fix it to describe the right pin and add them to right pin-mux group.
The correct order is:
pll1_lock => mips_pll -- MFIO_83 pll2_lock => audio_pll -- MFIO_84 pll3_lock => rpu_v_pll -- MFIO_85 pll4_lock => rpu_l_pll -- MFIO_86 pll5_lock => sys_pll -- MFIO_87 pll6_lock => wifi_pll -- MFIO_88 pll7_lock => bt_pll -- MFIO_89
--- Documentation/devicetree/bindings/pinctrl/img,pistachio-pinctrl.txt | 12 ++--- drivers/pinctrl/pinctrl-pistachio.c | 24 +++++----- 2 files changed, 18 insertions(+), 18 deletions(-)
Documentation/devicetree/bindings/pinctrl/img,pistachio-pinctrl.txt +6 -6
@@ -134,12 +134,12 @@ mfio80 ddr_debug, mips_trace_data, mips mfio81 dreq0, mips_trace_data, eth_debug mfio82 dreq1, mips_trace_data, eth_debug mfio83 mips_pll_lock, mips_trace_data, usb_debug -mfio84 sys_pll_lock, mips_trace_data, usb_debug -mfio85 wifi_pll_lock, mips_trace_data, sdhost_debug -mfio86 bt_pll_lock, mips_trace_data, sdhost_debug -mfio87 rpu_v_pll_lock, dreq2, socif_debug -mfio88 rpu_l_pll_lock, dreq3, socif_debug -mfio89 audio_pll_lock, dreq4, dreq5 +mfio84 audio_pll_lock, mips_trace_data, usb_debug +mfio85 rpu_v_pll_lock, mips_trace_data, sdhost_debug +mfio86 rpu_l_pll_lock, mips_trace_data, sdhost_debug +mfio87 sys_pll_lock, dreq2, socif_debug +mfio88 wifi_pll_lock, dreq3, socif_debug +mfio89 bt_pll_lock, dreq4, dreq5 tck trstn tdi
drivers/pinctrl/pinctrl-pistachio.c +12 -12
@@ -469,27 +469,27 @@ static const char * const pistachio_mips "mfio83", }; -static const char *const pistachio_sys_pll_lock_groups[] = { +static const char *const pistachio_audio_pll_lock_groups[] = {"mfio84" , }; -static const char *const pistachio_wifi_pll_lock_groups[] = { +static const char *const pistachio_rpu_v_pll_lock_groups[] = {"mfio85" , }; -static const char *const pistachio_bt_pll_lock_groups[] = { +static const char *const pistachio_rpu_l_pll_lock_groups[] = {"mfio86" , }; -static const char *const pistachio_rpu_v_pll_lock_groups[] = { +static const char *const pistachio_sys_pll_lock_groups[] = {"mfio87" , }; -static const char *const pistachio_rpu_l_pll_lock_groups[] = { +static const char *const pistachio_wifi_pll_lock_groups[] = {"mfio88" , }; -static const char *const pistachio_audio_pll_lock_groups[] = { +static const char *const pistachio_bt_pll_lock_groups[] = {"mfio89" , };
@@ -559,12 +559,12 @@ enum pistachio_mux_option {PISTACHIO_FUNCTION_DREQ4 ,PISTACHIO_FUNCTION_DREQ5 ,PISTACHIO_FUNCTION_MIPS_PLL_LOCK , +PISTACHIO_FUNCTION_AUDIO_PLL_LOCK , +PISTACHIO_FUNCTION_RPU_V_PLL_LOCK , +PISTACHIO_FUNCTION_RPU_L_PLL_LOCK ,PISTACHIO_FUNCTION_SYS_PLL_LOCK ,PISTACHIO_FUNCTION_WIFI_PLL_LOCK ,PISTACHIO_FUNCTION_BT_PLL_LOCK , -PISTACHIO_FUNCTION_RPU_V_PLL_LOCK , -PISTACHIO_FUNCTION_RPU_L_PLL_LOCK , -PISTACHIO_FUNCTION_AUDIO_PLL_LOCK ,PISTACHIO_FUNCTION_DEBUG_RAW_CCA_IND ,PISTACHIO_FUNCTION_DEBUG_ED_SEC20_CCA_IND , PISTACHIO_FUNCTION_DEBUG_ED_SEC40_CCA_IND,
@@ -620,12 +620,12 @@ static const struct pistachio_function pFUNCTION (dreq4),FUNCTION (dreq5),FUNCTION (mips_pll_lock), +FUNCTION (audio_pll_lock), +FUNCTION (rpu_v_pll_lock), +FUNCTION (rpu_l_pll_lock),FUNCTION (sys_pll_lock),FUNCTION (wifi_pll_lock),FUNCTION (bt_pll_lock), -FUNCTION (rpu_v_pll_lock), -FUNCTION (rpu_l_pll_lock), -FUNCTION (audio_pll_lock),FUNCTION (debug_raw_cca_ind),FUNCTION (debug_ed_sec20_cca_ind), FUNCTION(debug_ed_sec40_cca_ind),
Greg Kroah-Hartman
maintainerPATCH 75/124 pinctrl: sh-pfc: only use dummy states for non-DT platforms
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wolfram Sang <[email protected]>
commit 0129801be4b87226bf502f18f5a9eabd356d1058 upstream.
If pinctrl_provide_dummies() is used unconditionally, then the dummy state will be used even on DT platforms when the "init" state was intentionally left out. Instead of "default", the dummy "init" state will then be used during probe. Thus, when probing an I2C controller on cold boot, communication triggered by bus notifiers broke because the pins were not initialized.
Do it like OMAP2: use the dummy state only for non-DT platforms.
--- drivers/pinctrl/sh-pfc/core.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/pinctrl/sh-pfc/core.c +3 -1
@@ -545,7 +545,9 @@ static int sh_pfc_probe(struct platform_return ret; } -pinctrl_provide_dummies (); +/* Enable dummy states for those platforms without pinctrl support */ +if (!of_have_populated_dt ()) +pinctrl_provide_dummies (); ret =sh_pfc_init_ranges (pfc);if (ret <0 )
Greg Kroah-Hartman
maintainerPATCH 76/124 pinctrl: sunxi: Fix A33 external interrupts not working
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
commit 5e7515ba78fff2f5407eaa2f97c1d5c07801ac3d upstream.
pinctrl-sun8i-a33.c (and the dts) declare only 2 interrupt banks, where as the closely related a23 has 3 banks. This matches with the datasheet for the A33 where only interrupt banks B and G are specified where as the A23 has banks A, B and G.
However the A33 being the A23 derative it is means that the interrupt configure/status io-addresses for the 2 banks it has are not changed from the A23, iow they have the same address as if bank A was still present. Where as the sunxi pinctrl currently tries to use the A23 bank A addresses for bank B, since the pinctrl code does not know about the removed bank A.
Add a irq_bank_base parameter and use this where appropriate to take the missing bank A into account.
This fixes external interrupts not working on the A33 (tested with an i2c touchscreen controller which uses an external interrupt).
--- drivers/pinctrl/sunxi/pinctrl-sun8i-a33.c | 1 + drivers/pinctrl/sunxi/pinctrl-sunxi.c | 17 ++++++++++------- drivers/pinctrl/sunxi/pinctrl-sunxi.h | 21 +++++++++++---------- 3 files changed, 22 insertions(+), 17 deletions(-)
drivers/pinctrl/sunxi/pinctrl-sun8i-a33.c +1 -0
@@ -485,6 +485,7 @@ static const struct sunxi_pinctrl_desc s .pins = sun8i_a33_pins, .npins = ARRAY_SIZE(sun8i_a33_pins), .irq_banks = 2, + .irq_bank_base = 1, };static int sun8i_a33_pinctrl_probe (struct platform_device *pdev)
drivers/pinctrl/sunxi/pinctrl-sunxi.c +10 -7
@@ -578,7 +578,7 @@ static void sunxi_pinctrl_irq_release_restatic int sunxi_pinctrl_irq_set_type (struct irq_data *d,unsigned int type) {struct sunxi_pinctrl *pctl =irq_data_get_irq_chip_data (d); -u32 reg =sunxi_irq_cfg_reg (d->hwirq); +u32 reg =sunxi_irq_cfg_reg (d->hwirq, pctl->desc->irq_bank_base);u8 index =sunxi_irq_cfg_offset (d->hwirq);unsigned long flags;u32 regval;
@@ -625,7 +625,8 @@ static int sunxi_pinctrl_irq_set_type(ststatic void sunxi_pinctrl_irq_ack (struct irq_data *d) {struct sunxi_pinctrl *pctl =irq_data_get_irq_chip_data (d); -u32 status_reg =sunxi_irq_status_reg (d->hwirq); +u32 status_reg =sunxi_irq_status_reg (d->hwirq, + pctl->desc->irq_bank_base);u8 status_idx =sunxi_irq_status_offset (d->hwirq);/* Clear the IRQ */
@@ -635,7 +636,7 @@ static void sunxi_pinctrl_irq_ack(structstatic void sunxi_pinctrl_irq_mask (struct irq_data *d) {struct sunxi_pinctrl *pctl =irq_data_get_irq_chip_data (d); -u32 reg =sunxi_irq_ctrl_reg (d->hwirq); +u32 reg =sunxi_irq_ctrl_reg (d->hwirq, pctl->desc->irq_bank_base);u8 idx =sunxi_irq_ctrl_offset (d->hwirq);unsigned long flags;u32 val;
@@ -652,7 +653,7 @@ static void sunxi_pinctrl_irq_mask(strucstatic void sunxi_pinctrl_irq_unmask (struct irq_data *d) {struct sunxi_pinctrl *pctl =irq_data_get_irq_chip_data (d); -u32 reg =sunxi_irq_ctrl_reg (d->hwirq); +u32 reg =sunxi_irq_ctrl_reg (d->hwirq, pctl->desc->irq_bank_base);u8 idx =sunxi_irq_ctrl_offset (d->hwirq);unsigned long flags;u32 val;
@@ -744,7 +745,7 @@ static void sunxi_pinctrl_irq_handler(stif (bank == pctl->desc->irq_banks)return ; - reg =sunxi_irq_status_reg_from_bank (bank); + reg =sunxi_irq_status_reg_from_bank (bank, pctl->desc->irq_bank_base); val =readl (pctl->membase + reg);if (val) {
@@ -1023,9 +1024,11 @@ int sunxi_pinctrl_init(struct platform_dfor (i =0 ; i < pctl->desc->irq_banks; i++) {/* Mask and clear all IRQs before registering a handler */ -writel (0 , pctl->membase +sunxi_irq_ctrl_reg_from_bank (i)); +writel (0 , pctl->membase +sunxi_irq_ctrl_reg_from_bank (i, + pctl->desc->irq_bank_base));writel (0xffffffff , - pctl->membase +sunxi_irq_status_reg_from_bank (i)); + pctl->membase +sunxi_irq_status_reg_from_bank (i, + pctl->desc->irq_bank_base)); irq_set_chained_handler_and_data(pctl->irq[i], sunxi_pinctrl_irq_handler,
drivers/pinctrl/sunxi/pinctrl-sunxi.h +11 -10
@@ -97,6 +97,7 @@ struct sunxi_pinctrl_desc {int npins;unsigned pin_base;unsigned irq_banks; +unsigned irq_bank_base;bool irq_read_needs_mux; };
@@ -233,12 +234,12 @@ static inline u32 sunxi_pull_offset(u16return pin_num *PULL_PINS_BITS ; } -static inline u32 sunxi_irq_cfg_reg (u16 irq) +static inline u32 sunxi_irq_cfg_reg (u16 irq,unsigned bank_base) {u8 bank = irq /IRQ_PER_BANK ;u8 reg = (irq %IRQ_PER_BANK ) /IRQ_CFG_IRQ_PER_REG *0x04 ; -return IRQ_CFG_REG + bank *IRQ_MEM_SIZE + reg; +return IRQ_CFG_REG + (bank_base + bank) *IRQ_MEM_SIZE + reg; }static inline u32 sunxi_irq_cfg_offset (u16 irq)
@@ -247,16 +248,16 @@ static inline u32 sunxi_irq_cfg_offset(ureturn irq_num *IRQ_CFG_IRQ_BITS ; } -static inline u32 sunxi_irq_ctrl_reg_from_bank (u8 bank) +static inline u32 sunxi_irq_ctrl_reg_from_bank (u8 bank,unsigned bank_base) { -return IRQ_CTRL_REG + bank *IRQ_MEM_SIZE ; +return IRQ_CTRL_REG + (bank_base + bank) *IRQ_MEM_SIZE ; } -static inline u32 sunxi_irq_ctrl_reg (u16 irq) +static inline u32 sunxi_irq_ctrl_reg (u16 irq,unsigned bank_base) {u8 bank = irq /IRQ_PER_BANK ; -return sunxi_irq_ctrl_reg_from_bank (bank); +return sunxi_irq_ctrl_reg_from_bank (bank, bank_base); }static inline u32 sunxi_irq_ctrl_offset (u16 irq)
@@ -265,16 +266,16 @@ static inline u32 sunxi_irq_ctrl_offset(return irq_num *IRQ_CTRL_IRQ_BITS ; } -static inline u32 sunxi_irq_status_reg_from_bank (u8 bank) +static inline u32 sunxi_irq_status_reg_from_bank (u8 bank,unsigned bank_base) { -return IRQ_STATUS_REG + bank *IRQ_MEM_SIZE ; +return IRQ_STATUS_REG + (bank_base + bank) *IRQ_MEM_SIZE ; } -static inline u32 sunxi_irq_status_reg (u16 irq) +static inline u32 sunxi_irq_status_reg (u16 irq,unsigned bank_base) {u8 bank = irq /IRQ_PER_BANK ; -return sunxi_irq_status_reg_from_bank (bank); +return sunxi_irq_status_reg_from_bank (bank, bank_base); }static inline u32 sunxi_irq_status_offset (u16 irq)
Greg Kroah-Hartman
maintainerPATCH 77/124 pinctrl: nomadik: fix pull debug print inversion
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Walleij <[email protected]>
commit 6ee334559324a55725e22463de633b99ad99fcad upstream.
Pull up was reported as pull down and vice versa. Fix this.
--- drivers/pinctrl/nomadik/pinctrl-nomadik.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pinctrl/nomadik/pinctrl-nomadik.c +1 -1
@@ -990,7 +990,7 @@ static void nmk_gpio_dbg_show_one(structint val;if (pull) - pullidx = data_out ?1 :2 ; + pullidx = data_out ?2 :1 ; seq_printf(s, " gpio-%-3d (%-20.20s) in %s %s", gpio,
Greg Kroah-Hartman
maintainerPATCH 78/124 pinctrl: freescale: imx: fix bogus check of of_iomap() return value
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Zapolskiy <[email protected]>
commit 9a4f424531dabd877259ae0071b8bcc4dede9eb5 upstream.
On error path of_iomap() returns NULL, hence IS_ERR() check is invalid and may cause a NULL pointer dereference, the change fixes this problem.
While we are here invert a device node check to simplify the code.
--- drivers/pinctrl/freescale/pinctrl-imx.c | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-)
drivers/pinctrl/freescale/pinctrl-imx.c +8 -9
@@ -726,19 +726,18 @@ int imx_pinctrl_probe(struct platform_deif (of_property_read_bool (dev_np,"fsl,input-sel" )) { np =of_parse_phandle (dev_np,"fsl,input-sel" ,0 ); -if (np) { - ipctl->input_sel_base =of_iomap (np,0 ); -if (IS_ERR (ipctl->input_sel_base)) { -of_node_put (np); -dev_err (&pdev->dev, -"iomuxc input select base address not found\n" ); -return PTR_ERR (ipctl->input_sel_base); - } - }else { +if (!np) {dev_err (&pdev->dev,"iomuxc fsl,input-sel property not found\n" );return -EINVAL ; } + + ipctl->input_sel_base =of_iomap (np,0 );of_node_put (np); +if (!ipctl->input_sel_base) { +dev_err (&pdev->dev, +"iomuxc input select base address not found\n" ); +return -ENOMEM ; + } } imx_pinctrl_desc.name =dev_name (&pdev->dev);
Greg Kroah-Hartman
maintainerPATCH 79/124 gpio: pxa: fix legacy non pinctrl aware builds
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robert Jarzmik <[email protected]>
commit c4e5ffb6f224c1a4a9eaad82b19645ec22d1b24f upstream.
In legacy pxa builds, ie. non device-tree and platform-data only builds, pinctrl is not yet available. As a consequence, the pinctrl gpio direction change function is a stub, returning always success.
In the current state, the gpio driver direction function believes the pinctrl direction change was successful, and exits without actually changing the gpio direction.
This patch changes the logic :
- if the pinctrl direction function fails, gpio direction will report that failure
- if the pinctrl direction function succeeds, gpio direction is changed by the gpio driver anyway.
This is sub optimal in the pinctrl aware case, as the gpio direction will be changed twice: once by pinctrl function and another time by the gpio direction function.
Yet it should be acceptable in this form, as this is functional for all pxa platforms (device-tree and platform-data), and moreover changing a gpio direction is very very seldom, usually in machine initialization, seldom in drivers probe, and an exception for ac97 reset bug.
--- drivers/gpio/gpio-pxa.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpio/gpio-pxa.c +2 -2
@@ -283,8 +283,8 @@ static int pxa_gpio_direction_output(strwritel_relaxed (mask, base + (value ?GPSR_OFFSET :GPCR_OFFSET )); ret =pinctrl_gpio_direction_output (chip->base + offset); -if (!ret) -return 0 ; +if (ret) +return ret;spin_lock_irqsave (&gpio_lock, flags);
Greg Kroah-Hartman
maintainerPATCH 80/124 au0828: fix au0828_v4l2_close() dev_state race condition
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuah Khan <[email protected]>
commit ed940cd27416f9887864b95e1f8f8845aa9d6391 upstream.
au0828_v4l2_close() check for dev_state == DEV_DISCONNECTED will fail to detect the device disconnected state correctly, if au0828_v4l2_open() runs to set the DEV_INITIALIZED bit. A loop test of bind/unbind found this bug by increasing the likelihood of au0828_v4l2_open() occurring while unbind is in progress. When au0828_v4l2_close() fails to detect that the device is in disconnect state, it attempts to power down the device and fails with the following general protection fault:
[ 260.992962] Call Trace: [ 260.993008] [<ffffffffa0f80f0f>] ? xc5000_sleep+0x8f/0xd0 [xc5000] [ 260.993095] [<ffffffffa0f6803c>] ? fe_standby+0x3c/0x50 [tuner] [ 260.993186] [<ffffffffa0ef541c>] au0828_v4l2_close+0x53c/0x620 [au0828] [ 260.993298] [<ffffffffa0d08ec0>] v4l2_release+0xf0/0x210 [videodev] [ 260.993382] [<ffffffff81570f9c>] __fput+0x1fc/0x6c0 [ 260.993449] [<ffffffff815714ce>] ____fput+0xe/0x10 [ 260.993519] [<ffffffff8116eb83>] task_work_run+0x133/0x1f0 [ 260.993602] [<ffffffff810035d0>] exit_to_usermode_loop+0x140/0x170 [ 260.993681] [<ffffffff810061ca>] syscall_return_slowpath+0x16a/0x1a0 [ 260.993754] [<ffffffff82835fb3>] entry_SYSCALL_64_fastpath+0xa6/0xa8
--- drivers/media/usb/au0828/au0828-video.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/usb/au0828/au0828-video.c +1 -1
@@ -1063,7 +1063,7 @@ static int au0828_v4l2_close(struct filedel_timer_sync (&dev->vbi_timeout); } -if (dev->dev_state ==DEV_DISCONNECTED ) +if (dev->dev_state &DEV_DISCONNECTED ) goto end;if (dev->users ==1 ) {
Greg Kroah-Hartman
maintainerPATCH 81/124 au0828: Fix dev_state handling
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mauro Carvalho Chehab <[email protected]>
commit e8e3039f5b941f7825d335f8ca11c12a8104db11 upstream.
The au0828 dev_state is actually a bit mask. It should not be checking with "==" but, instead, with a logic and. There are some places where it was doing it wrong.
Fix that by replacing the dev_state set/clear/test with the bitops.
As reviewed by Shuah:
"Looks good. Tested running bind/unbind au0828 loop for 1000 times. Didn't see any problems and the v4l2_querycap() problem has been fixed with this patch.
After the above test, ran bind/unbind snd_usb_audio 1000 times. Didn't see any problems. Generated media graph and the graph looks good."
--- drivers/media/usb/au0828/au0828-core.c | 2 - drivers/media/usb/au0828/au0828-input.c | 4 +- drivers/media/usb/au0828/au0828-video.c | 63 +++++++++++++++----------------- drivers/media/usb/au0828/au0828.h | 9 ++-- 4 files changed, 39 insertions(+), 39 deletions(-)
drivers/media/usb/au0828/au0828-core.c +1 -1
@@ -192,7 +192,7 @@ static void au0828_usb_disconnect(structSet the status so poll routines can check and avoid access after disconnect. */ - dev->dev_state =DEV_DISCONNECTED ; +set_bit (DEV_DISCONNECTED , &dev->dev_state);au0828_rc_unregister (dev);/* Digital TV */
drivers/media/usb/au0828/au0828-input.c +2 -2
@@ -130,7 +130,7 @@ static int au0828_get_key_au8522(structbool first = true;/* do nothing if device is disconnected */ -if (ir->dev->dev_state ==DEV_DISCONNECTED ) +if (test_bit (DEV_DISCONNECTED , &ir->dev->dev_state))return 0 ;/* Check IR int */
@@ -260,7 +260,7 @@ static void au0828_rc_stop(struct rc_devcancel_delayed_work_sync (&ir->work);/* do nothing if device is disconnected */ -if (ir->dev->dev_state !=DEV_DISCONNECTED ) { +if (!test_bit (DEV_DISCONNECTED , &ir->dev->dev_state)) {/* Disable IR */ au8522_rc_clear (ir,0xe0 ,1 <<4 ); }
drivers/media/usb/au0828/au0828-video.c +31 -32
231 lines not on this page · raw message
drivers/media/usb/au0828/au0828.h +5 -4
@@ -21,6 +21,7 @@#define pr_fmt (fmt) KBUILD_MODNAME ": " fmt +#include <linux/bitops.h> #include <linux/usb.h> #include <linux/i2c.h> #include <linux/i2c-algo-bit.h>
@@ -122,9 +123,9 @@ enum au0828_stream_state {/* device state */ enum au0828_dev_state { -DEV_INITIALIZED =0x01 , -DEV_DISCONNECTED =0x02 , -DEV_MISCONFIGURED =0x04 +DEV_INITIALIZED =0 , +DEV_DISCONNECTED =1 , +DEV_MISCONFIGURED =2 };struct au0828_dev ;
@@ -248,7 +249,7 @@ struct au0828_dev {int input_type;int std_set_in_tuner_core;unsigned int ctrl_input; -enum au0828_dev_state dev_state; +long unsigned int dev_state;/* defined at enum au0828_dev_state */ ;enum au0828_stream_state stream_state;wait_queue_head_t open;
Greg Kroah-Hartman
maintainerPATCH 82/124 coda: fix error path in case of missing pdata on non-DT platform
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Philipp Zabel <[email protected]>
commit bc717d5e92c8c079280eb4acbe335c6f25041aa2 upstream.
If we bail out this early, v4l2_device_register() has not been called yet, so no need to call v4l2_device_unregister().
--- drivers/media/platform/coda/coda-common.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
drivers/media/platform/coda/coda-common.c +4 -6
@@ -2118,14 +2118,12 @@ static int coda_probe(struct platform_de pdev_id = of_id ? of_id->data :platform_get_device_id (pdev); -if (of_id) { +if (of_id) dev->devtype = of_id->data; - }else if (pdev_id) { +else if (pdev_id) dev->devtype = &coda_devdata[pdev_id->driver_data]; - }else { - ret = -EINVAL ; - goto err_v4l2_register; - } +else +return -EINVAL ;spin_lock_init (&dev->irqlock);INIT_LIST_HEAD (&dev->instances);
Greg Kroah-Hartman
maintainerPATCH 83/124 v4l: vsp1: Set the SRU CTRL0 register when starting the stream
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laurent Pinchart <[email protected]>
commit f6acfcdc5b8cdc9ddd53a459361820b9efe958c4 upstream.
Commit 58f896d859ce ("[media] v4l: vsp1: sru: Make the intensity controllable during streaming") refactored the stream start code and removed the SRU CTRL0 register write by mistake. Add it back.
--- drivers/media/platform/vsp1/vsp1_sru.c | 1 + 1 file changed, 1 insertion(+)
drivers/media/platform/vsp1/vsp1_sru.c +1 -0
@@ -154,6 +154,7 @@ static int sru_s_stream(struct v4l2_subdmutex_lock (sru->ctrls.lock); ctrl0 |=vsp1_sru_read (sru,VI6_SRU_CTRL0 ) & (VI6_SRU_CTRL0_PARAM0_MASK |VI6_SRU_CTRL0_PARAM1_MASK ); +vsp1_sru_write (sru,VI6_SRU_CTRL0 , ctrl0);mutex_unlock (sru->ctrls.lock);vsp1_sru_write (sru,VI6_SRU_CTRL1 ,VI6_SRU_CTRL1_PARAM5 );
Greg Kroah-Hartman
maintainerPATCH 84/124 pcmcia: db1xxx_ss: fix last irq_to_gpio user
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manuel Lauss <[email protected]>
commit e34b6fcf9b09ec9d93503edd5f81489791ffd602 upstream.
remove the usage of removed irq_to_gpio() function. On pre-DB1200 boards, pass the actual carddetect GPIO number instead of the IRQ, because we need the gpio to actually test card status (inserted or not) and can get the irq number with gpio_to_irq() instead.
Tested on DB1300 and DB1500, this patch fixes PCMCIA on the DB1500, which used irq_to_gpio().
Patchwork: https://patchwork.linux-mips.org/patch/12747/
--- arch/mips/alchemy/devboards/db1000.c | 18 ++++++++---------- arch/mips/alchemy/devboards/db1550.c | 4 ++-- drivers/pcmcia/db1xxx_ss.c | 11 +++++++++-- 3 files changed, 19 insertions(+), 14 deletions(-)
arch/mips/alchemy/devboards/db1000.c +8 -10
@@ -503,15 +503,15 @@ int __init db1000_dev_setup(void)if (board ==BCSR_WHOAMI_DB1500 ) { c0 =AU1500_GPIO2_INT ; c1 =AU1500_GPIO5_INT ; - d0 =AU1500_GPIO0_INT ; - d1 =AU1500_GPIO3_INT ; + d0 =0 ;/* GPIO number, NOT irq! */ + d1 =3 ;/* GPIO number, NOT irq! */ s0 =AU1500_GPIO1_INT ; s1 =AU1500_GPIO4_INT ; }else if (board ==BCSR_WHOAMI_DB1100 ) { c0 =AU1100_GPIO2_INT ; c1 =AU1100_GPIO5_INT ; - d0 =AU1100_GPIO0_INT ; - d1 =AU1100_GPIO3_INT ; + d0 =0 ;/* GPIO number, NOT irq! */ + d1 =3 ;/* GPIO number, NOT irq! */ s0 =AU1100_GPIO1_INT ; s1 =AU1100_GPIO4_INT ;
@@ -545,15 +545,15 @@ int __init db1000_dev_setup(void) }else if (board ==BCSR_WHOAMI_DB1000 ) { c0 =AU1000_GPIO2_INT ; c1 =AU1000_GPIO5_INT ; - d0 =AU1000_GPIO0_INT ; - d1 =AU1000_GPIO3_INT ; + d0 =0 ;/* GPIO number, NOT irq! */ + d1 =3 ;/* GPIO number, NOT irq! */ s0 =AU1000_GPIO1_INT ; s1 =AU1000_GPIO4_INT ;platform_add_devices (db1000_devs,ARRAY_SIZE (db1000_devs)); }else if ((board ==BCSR_WHOAMI_PB1500 ) || (board ==BCSR_WHOAMI_PB1500R2 )) { c0 =AU1500_GPIO203_INT ; - d0 =AU1500_GPIO201_INT ; + d0 =1 ;/* GPIO number, NOT irq! */ s0 =AU1500_GPIO202_INT ; twosocks =0 ; flashsize =64 ;
@@ -566,7 +566,7 @@ int __init db1000_dev_setup(void)*/ }else if (board ==BCSR_WHOAMI_PB1100 ) { c0 =AU1100_GPIO11_INT ; - d0 =AU1100_GPIO9_INT ; + d0 =9 ;/* GPIO number, NOT irq! */ s0 =AU1100_GPIO10_INT ; twosocks =0 ; flashsize =64 ;
@@ -583,7 +583,6 @@ int __init db1000_dev_setup(void) }else return 0 ;/* unknown board, no further dev setup to do */ -irq_set_irq_type (d0,IRQ_TYPE_EDGE_BOTH );irq_set_irq_type (c0,IRQ_TYPE_LEVEL_LOW );irq_set_irq_type (s0,IRQ_TYPE_LEVEL_LOW );
@@ -597,7 +596,6 @@ int __init db1000_dev_setup(void) c0, d0, /*s0*/0, 0, 0);if (twosocks) { -irq_set_irq_type (d1,IRQ_TYPE_EDGE_BOTH );irq_set_irq_type (c1,IRQ_TYPE_LEVEL_LOW );irq_set_irq_type (s1,IRQ_TYPE_LEVEL_LOW );
arch/mips/alchemy/devboards/db1550.c +2 -2
@@ -514,7 +514,7 @@ static void __init db1550_devices(void)AU1000_PCMCIA_MEM_PHYS_ADDR +0x000400000 -1 ,AU1000_PCMCIA_IO_PHYS_ADDR ,AU1000_PCMCIA_IO_PHYS_ADDR +0x000010000 -1 , -AU1550_GPIO3_INT ,AU1550_GPIO0_INT , +AU1550_GPIO3_INT ,0 , /*AU1550_GPIO21_INT*/0, 0, 0); db1x_register_pcmcia_socket(
@@ -524,7 +524,7 @@ static void __init db1550_devices(void)AU1000_PCMCIA_MEM_PHYS_ADDR +0x004400000 -1 ,AU1000_PCMCIA_IO_PHYS_ADDR +0x004000000 ,AU1000_PCMCIA_IO_PHYS_ADDR +0x004010000 -1 , -AU1550_GPIO5_INT ,AU1550_GPIO1_INT , +AU1550_GPIO5_INT ,1 , /*AU1550_GPIO22_INT*/0, 0, 1);platform_device_register (&db1550_nand_dev);
drivers/pcmcia/db1xxx_ss.c +9 -2
@@ -56,6 +56,7 @@ struct db1x_pcmcia_sock {int stschg_irq;/* card-status-change irq */ int card_irq;/* card irq */ int eject_irq;/* db1200/pb1200 have these */ +int insert_gpio;/* db1000 carddetect gpio */ #define BOARD_TYPE_DEFAULT 0/* most boards */ #define BOARD_TYPE_DB1200 1/* IRQs aren't gpios */
@@ -83,7 +84,7 @@ static int db1200_card_inserted(struct d/* carddetect gpio: low-active */ static int db1000_card_inserted (struct db1x_pcmcia_sock *sock) { -return !gpio_get_value (irq_to_gpio (sock->insert_irq)); +return !gpio_get_value (sock->insert_gpio); }static int db1x_card_inserted (struct db1x_pcmcia_sock *sock)
@@ -457,9 +458,15 @@ static int db1x_pcmcia_socket_probe(stru r =platform_get_resource_byname (pdev,IORESOURCE_IRQ ,"card" ); sock->card_irq = r ? r->start :0 ; -/* insert: irq which triggers on card insertion/ejection */ +/* insert: irq which triggers on card insertion/ejection +* BIG FAT NOTE: on DB1000/1100/1500/1550 we pass a GPIO here! +*/ r =platform_get_resource_byname (pdev,IORESOURCE_IRQ ,"insert" ); sock->insert_irq = r ? r->start :-1 ; +if (sock->board_type ==BOARD_TYPE_DEFAULT ) { + sock->insert_gpio = r ? r->start :-1 ; + sock->insert_irq = r ?gpio_to_irq (r->start) :-1 ; + }/* stschg: irq which trigger on card status change (optional) */ r =platform_get_resource_byname (pdev,IORESOURCE_IRQ ,"stschg" );
Greg Kroah-Hartman
maintainerPATCH 85/124 rbd: use GFP_NOIO consistently for request allocations
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Disseldorp <[email protected]>
commit 2224d879c7c0f85c14183ef82eb48bd875ceb599 upstream.
As of 5a60e87603c4c533492c515b7f62578189b03c9c, RBD object request allocations are made via rbd_obj_request_create() with GFP_NOIO. However, subsequent OSD request allocations in rbd_osd_req_create*() use GFP_ATOMIC.
With heavy page cache usage (e.g. OSDs running on same host as krbd client), rbd_osd_req_create() order-1 GFP_ATOMIC allocations have been observed to fail, where direct reclaim would have allowed GFP_NOIO allocations to succeed.
--- drivers/block/rbd.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/block/rbd.c +3 -3
@@ -1955,7 +1955,7 @@ static struct ceph_osd_request *rbd_osd_ osdc = &rbd_dev->rbd_client->client->osdc; osd_req =ceph_osdc_alloc_request (osdc, snapc, num_ops, false, -GFP_ATOMIC ); +GFP_NOIO );if (!osd_req)return NULL ;/* ENOMEM */
@@ -2004,7 +2004,7 @@ rbd_osd_req_create_copyup(struct rbd_obj rbd_dev = img_request->rbd_dev; osdc = &rbd_dev->rbd_client->client->osdc; osd_req =ceph_osdc_alloc_request (osdc, snapc, num_osd_ops, - false,GFP_ATOMIC ); + false,GFP_NOIO );if (!osd_req)return NULL ;/* ENOMEM */
@@ -2506,7 +2506,7 @@ static int rbd_img_request_fill(struct rbio_chain_clone_range (&bio_list, &bio_offset, clone_size, -GFP_ATOMIC ); +GFP_NOIO );if (!obj_request->bio_list) goto out_unwind; }else if (type ==OBJ_REQUEST_PAGES ) {
Greg Kroah-Hartman
maintainerPATCH 86/124 virtio: virtio 1.0 cs04 spec compliance for reset
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael S. Tsirkin <[email protected]>
commit 05dbcb430795b2e1fb1d5c757f8619d3dbed0a1c upstream.
The spec says: after writing 0 to device_status, the driver MUST wait for a read of device_status to return 0 before reinitializing the device.
--- drivers/virtio/virtio_pci_modern.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
drivers/virtio/virtio_pci_modern.c +8 -3
@@ -17,6 +17,7 @@* */ +#include <linux/delay.h> #define VIRTIO_PCI_NO_LEGACY #include "virtio_pci_common.h"
@@ -271,9 +272,13 @@ static void vp_reset(struct virtio_devicstruct virtio_pci_device *vp_dev =to_vp_device (vdev);/* 0 status means a reset. */ vp_iowrite8 (0 , &vp_dev->common->device_status); -/* Flush out the status write, and flush in device writes, -* including MSI-X interrupts, if any. */ -vp_ioread8 (&vp_dev->common->device_status); +/* After writing 0 to device_status, the driver MUST wait for a read of +* device_status to return 0 before reinitializing the device. +* This will flush out the status write, and flush in device writes, +* including MSI-X interrupts, if any. +*/ +while (vp_ioread8 (&vp_dev->common->device_status)) +msleep (1 );/* Flush pending VQ/configuration callbacks. */ vp_synchronize_vectors (vdev); }
Greg Kroah-Hartman
maintainerPATCH 87/124 mac80211: properly deal with station hashtable insert errors
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
commit 62b14b241ca6f790a17ccd9dd9f62ce1b006d406 upstream.
The original hand-implemented hash-table in mac80211 couldn't result in insertion errors, and while converting to rhashtable I evidently forgot to check the errors.
This surfaced now only because Ben is adding many identical keys and that resulted in hidden insertion errors.
--- net/mac80211/sta_info.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
net/mac80211/sta_info.c +8 -5
@@ -257,11 +257,11 @@ void sta_info_free(struct ieee80211_loca }/* Caller must hold local->sta_mtx */ -static void sta_info_hash_add (struct ieee80211_local *local, -struct sta_info *sta) +static int sta_info_hash_add (struct ieee80211_local *local, +struct sta_info *sta) { -rhashtable_insert_fast (&local->sta_hash, &sta->hash_node, - sta_rht_params); +return rhashtable_insert_fast (&local->sta_hash, &sta->hash_node, + sta_rht_params); }static void sta_deliver_ps_frames (struct work_struct *wk)
@@ -517,7 +517,9 @@ static int sta_info_insert_finish(structset_sta_flag (sta,WLAN_STA_BLOCK_BA );/* make the station visible */ -sta_info_hash_add (local, sta); + err =sta_info_hash_add (local, sta); +if (err) + goto out_drop_sta;list_add_tail_rcu (&sta->list, &local->sta_list);
@@ -552,6 +554,7 @@ static int sta_info_insert_finish(struct out_remove:sta_info_hash_del (local, sta);list_del_rcu (&sta->list); + out_drop_sta: local->num_sta--;synchronize_net ();__cleanup_single_sta (sta);
Greg Kroah-Hartman
maintainerPATCH 88/124 mac80211: avoid excessive stack usage in sta_info
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
commit 0ef049dc1167fe834d0ad5d63f89eddc5c70f6e4 upstream.
When CONFIG_OPTIMIZE_INLINING is set, the sta_info_insert_finish function consumes more stack than normally, exceeding the 1024 byte limit on ARM:
net/mac80211/sta_info.c: In function 'sta_info_insert_finish':net/mac80211/sta_info.c:561:1: error: the frame size of 1080 bytes is larger than 1024 bytes [-Werror=frame-larger-than=]
It turns out that there are two functions that put a 'struct station_info' on the stack: __sta_info_destroy_part2 and sta_info_insert_finish, and this structure alone requires up to 792 bytes.
Hoping that both are called rarely enough, this replaces the on-stack structure with a dynamic allocation, which unfortunately requires some suboptimal error handling for out-of-memory.
The __sta_info_destroy_part2 function is actually affected by the stack usage twice because it calls cfg80211_del_sta_sinfo(), which has another instance of struct station_info on its stack.
--- net/mac80211/sta_info.c | 24 ++++++++++++++++-------- 1 file changed, 16 insertions(+), 8 deletions(-)
net/mac80211/sta_info.c +16 -8
@@ -498,11 +498,17 @@ static int sta_info_insert_finish(struct {struct ieee80211_local *local = sta->local;struct ieee80211_sub_if_data *sdata = sta->sdata; -struct station_info sinfo; +struct station_info *sinfo;int err =0 ;lockdep_assert_held (&local->sta_mtx); + sinfo =kzalloc (sizeof (struct station_info ),GFP_KERNEL ); +if (!sinfo) { + err = -ENOMEM ; + goto out_err; + } +/* check if STA exists already */ if (sta_info_get_bss (sdata, sta->sta.addr)) { err = -EEXIST ;
@@ -536,10 +542,9 @@ static int sta_info_insert_finish(structieee80211_sta_debugfs_add (sta);rate_control_add_sta_debugfs (sta); -memset (&sinfo,0 ,sizeof (sinfo)); - sinfo.filled =0 ; - sinfo.generation = local->sta_generation; -cfg80211_new_sta (sdata->dev, sta->sta.addr, &sinfo,GFP_KERNEL ); + sinfo->generation = local->sta_generation; +cfg80211_new_sta (sdata->dev, sta->sta.addr, sinfo,GFP_KERNEL ); +kfree (sinfo);sta_dbg (sdata,"Inserted STA %pM\n" , sta->sta.addr);
@@ -901,7 +906,7 @@ static void __sta_info_destroy_part2(str {struct ieee80211_local *local = sta->local;struct ieee80211_sub_if_data *sdata = sta->sdata; -struct station_info sinfo = {}; +struct station_info *sinfo;int ret;/*
@@ -939,8 +944,11 @@ static void __sta_info_destroy_part2(strsta_dbg (sdata,"Removed STA %pM\n" , sta->sta.addr); -sta_set_sinfo (sta, &sinfo); -cfg80211_del_sta_sinfo (sdata->dev, sta->sta.addr, &sinfo,GFP_KERNEL ); + sinfo =kzalloc (sizeof (*sinfo),GFP_KERNEL ); +if (sinfo) +sta_set_sinfo (sta, sinfo); +cfg80211_del_sta_sinfo (sdata->dev, sta->sta.addr, sinfo,GFP_KERNEL ); +kfree (sinfo);rate_control_remove_sta_debugfs (sta);ieee80211_sta_debugfs_remove (sta);
Greg Kroah-Hartman
maintainerPATCH 89/124 mac80211: fix ibss scan parameters
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sara Sharon <[email protected]>
commit d321cd014e51baab475efbdec468255b9e0ec822 upstream.
When joining IBSS a full scan should be initiated in order to search for existing cell, unless the fixed_channel parameter was set. A default channel to create the IBSS on if no cell was found is provided as well.
However - a scan is initiated only on the default channel provided regardless of whether ifibss->fixed_channel is set or not, with the obvious result of the cell not joining existing IBSS cell that is on another channel.
--- net/mac80211/ibss.c | 22 +++++++++++++++------- 1 file changed, 15 insertions(+), 7 deletions(-)
net/mac80211/ibss.c +15 -7
@@ -7,6 +7,7 @@* Copyright 2007, Michael Wu <[email protected]> * Copyright 2009, Johannes Berg <[email protected]> * Copyright 2013-2014 Intel Mobile Communications GmbH +* Copyright(c) 2016 Intel Deutschland GmbH * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 as
@@ -1485,14 +1486,21 @@ static void ieee80211_sta_find_ibss(strusdata_info (sdata,"Trigger new scan to find an IBSS to join\n" ); - num =ieee80211_ibss_setup_scan_channels (local->hw.wiphy, - &ifibss->chandef, - channels, -ARRAY_SIZE (channels)); scan_width =cfg80211_chandef_to_scan_width (&ifibss->chandef); -ieee80211_request_ibss_scan (sdata, ifibss->ssid, - ifibss->ssid_len, channels, num, - scan_width); + +if (ifibss->fixed_channel) { + num =ieee80211_ibss_setup_scan_channels (local->hw.wiphy, + &ifibss->chandef, + channels, +ARRAY_SIZE (channels)); +ieee80211_request_ibss_scan (sdata, ifibss->ssid, + ifibss->ssid_len, channels, + num, scan_width); + }else { +ieee80211_request_ibss_scan (sdata, ifibss->ssid, + ifibss->ssid_len,NULL , +0 , scan_width); + } }else {int interval =IEEE80211_SCAN_INTERVAL ;
Greg Kroah-Hartman
maintainerPATCH 90/124 mac80211: fix unnecessary frame drops in mesh fwding
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Kazior <[email protected]>
commit cf44012810ccdd8fd947518e965cb04b7b8498be upstream.
The ieee80211_queue_stopped() expects hw queue number but it was given raw WMM AC number instead.
This could cause frame drops and problems with
traffic in some cases - most notably if driver
doesn't map AC numbers to queue numbers 1:1 and
uses ieee80211_stop_queues() andieee80211_wake_queue() only without ever callingieee80211_wake_queues().
On ath10k it was possible to hit this problem in
the following case:
1. wlan0 uses queue 0
(ath10k maps queues per vif)
2. offchannel uses queue 15
3. queues 1-14 are unused
4. ieee80211_stop_queues()
5. ieee80211_wake_queue(q=0)
6. ieee80211_wake_queue(q=15)
(other queues are not woken up because both
driver and mac80211 know other queues are
unused)
7. ieee80211_rx_h_mesh_fwding()
8. ieee80211_select_queue_80211() returns 2
9. ieee80211_queue_stopped(q=2) returns true
10. frame is dropped (oops!)
--- net/mac80211/rx.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
net/mac80211/rx.c +3 -2
@@ -2249,7 +2249,7 @@ ieee80211_rx_h_mesh_fwding(struct ieee80struct ieee80211_local *local = rx->local;struct ieee80211_sub_if_data *sdata = rx->sdata;struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh; -u16 q, hdrlen; +u16 ac, q, hdrlen; hdr = (struct ieee80211_hdr *) skb->data; hdrlen =ieee80211_hdrlen (hdr->frame_control);
@@ -2318,7 +2318,8 @@ ieee80211_rx_h_mesh_fwding(struct ieee80 ether_addr_equal(sdata->vif.addr, hdr->addr3))return RX_CONTINUE ; - q =ieee80211_select_queue_80211 (sdata, skb, hdr); + ac =ieee80211_select_queue_80211 (sdata, skb, hdr); + q = sdata->vif.hw_queue[ac];if (ieee80211_queue_stopped (&local->hw, q)) {IEEE80211_IFSTA_MESH_CTR_INC (ifmsh, dropped_frames_congestion);return RX_DROP_MONITOR ;
Greg Kroah-Hartman
maintainerPATCH 91/124 mac80211: fix txq queue related crashes
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Kazior <[email protected]>
commit 2a58d42c1e018ad514d4e23fd33fb2ded95d3ee6 upstream.
The driver can access the queue simultanously
while mac80211 tears down the interface. Without
spinlock protection this could lead to corruptingsk_buff_head and subsequently to an invalid
pointer dereference.
--- net/mac80211/iface.c | 3 +++ 1 file changed, 3 insertions(+)
net/mac80211/iface.c +3 -0
@@ -977,7 +977,10 @@ static void ieee80211_do_stop(struct ieeif (sdata->vif.txq) {struct txq_info *txqi =to_txq_info (sdata->vif.txq); +spin_lock_bh (&txqi->queue.lock);ieee80211_purge_tx_queue (&local->hw, &txqi->queue); +spin_unlock_bh (&txqi->queue.lock); +atomic_set (&sdata->txqs_len[txqi->txq.ac],0 ); }
Greg Kroah-Hartman
maintainerPATCH 92/124 gpio: pca953x: Use correct u16 value for register word write
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yong Li <[email protected]>
commit 9b8e3ec34318663affced3c14d960e78d760dd9a upstream.
The current implementation only uses the first byte in val, the second byte is always 0. Change it to use cpu_to_le16 to write the two bytes into the register
--- drivers/gpio/gpio-pca953x.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpio/gpio-pca953x.c +2 -1
@@ -18,6 +18,7 @@#include <linux/i2c.h> #include <linux/platform_data/pca953x.h> #include <linux/slab.h> +#include <asm/unaligned.h> #include <linux/of_platform.h> #include <linux/acpi.h>
@@ -159,7 +160,7 @@ static int pca953x_write_regs(struct pcaswitch (chip->chip_type) {case PCA953X_TYPE : ret =i2c_smbus_write_word_data (chip->client, - reg <<1 , (u16) *val); + reg <<1 ,cpu_to_le16 (get_unaligned ((u16 *)val)));break ;case PCA957X_TYPE : ret = i2c_smbus_write_byte_data(chip->client, reg << 1,
Greg Kroah-Hartman
maintainerPATCH 93/124 usb: renesas_usbhs: avoid NULL pointer derefernce in usbhsf_pkt_handler()
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yoshihiro Shimoda <[email protected]>
commit 894f2fc44f2f3f48c36c973b1123f6ab298be160 upstream.
When unexpected situation happened (e.g. tx/rx irq happened while DMAC is used), the usbhsf_pkt_handler() was possible to cause NULL pointer dereference like the followings:
Unable to handle kernel NULL pointer dereference at virtual address 00000000 pgd = c0004000 [00000000] *pgd=00000000 Internal error: Oops: 80000007 [#1] SMP ARM Modules linked in: usb_f_acm u_serial g_serial libcomposite CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.5.0-rc6-00842-gac57066-dirty #63 Hardware name: Generic R8A7790 (Flattened Device Tree) task: c0729c00 ti: c0724000 task.ti: c0724000 PC is at 0x0 LR is at usbhsf_pkt_handler+0xac/0x118 pc : [<00000000>] lr : [<c03257e0>] psr: 60000193
sp : c0725db8 ip : 00000000 fp : c0725df4
r10: 00000001 r9 : 00000193 r8 : ef3ccab4
r7 : ef3cca10 r6 : eea4586c r5 : 00000000 r4 : ef19ceb4 r3 : 00000000 r2 : 0000009c r1 : c0725dc4 r0 : ef19ceb4
This patch adds a condition to avoid the dereference.
--- drivers/usb/renesas_usbhs/fifo.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/usb/renesas_usbhs/fifo.c +2 -1
@@ -190,7 +190,8 @@ static int usbhsf_pkt_handler(struct usb goto __usbhs_pkt_handler_end; } - ret =func (pkt, &is_done); +if (likely (func)) + ret =func (pkt, &is_done);if (is_done)__usbhsf_pkt_del (pkt);
Greg Kroah-Hartman
maintainerPATCH 94/124 usb: renesas_usbhs: disable TX IRQ before starting TX DMAC transfer
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yoshihiro Shimoda <[email protected]>
commit 6490865c67825277b29638e839850882600b48ec upstream.
This patch adds a code to surely disable TX IRQ of the pipe before starting TX DMAC transfer. Otherwise, a lot of unnecessary TX IRQs may happen in rare cases when DMAC is used.
--- drivers/usb/renesas_usbhs/fifo.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/renesas_usbhs/fifo.c +1 -0
@@ -890,6 +890,7 @@ static int usbhsf_dma_prepare_push(struc pkt->trans = len; +usbhsf_tx_irq_ctrl (pipe,0 );INIT_WORK (&pkt->work, xfer_work);schedule_work (&pkt->work);
Greg Kroah-Hartman
maintainerPATCH 95/124 usb: renesas_usbhs: fix to avoid using a disabled ep in usbhsg_queue_done()
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yoshihiro Shimoda <[email protected]>
commit 4fccb0767fdbdb781a9c5b5c15ee7b219443c89d upstream.
This patch fixes an issue that usbhsg_queue_done() may cause kernel panic when dma callback is running and usb_ep_disable() is called by interrupt handler. (Especially, we can reproduce this issue using g_audio with usb-dmac driver.)
For example of a flow:
usbhsf_dma_complete (on tasklet)
--> usbhsf_pkt_handler (on tasklet)
--> usbhsg_queue_done (on tasklet)
*** interrupt happened and usb_ep_disable() is called *** --> usbhsg_queue_pop (on tasklet)
Then, oops happened.
--- drivers/usb/renesas_usbhs/mod_gadget.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/usb/renesas_usbhs/mod_gadget.c +5 -1
@@ -158,10 +158,14 @@ static void usbhsg_queue_done(struct usbstruct usbhs_pipe *pipe = pkt->pipe;struct usbhsg_uep *uep =usbhsg_pipe_to_uep (pipe);struct usbhsg_request *ureq =usbhsg_pkt_to_ureq (pkt); +unsigned long flags; ureq->req.actual = pkt->actual; -usbhsg_queue_pop (uep, ureq,0 ); +usbhs_lock (priv, flags); +if (uep) +__usbhsg_queue_pop (uep, ureq,0 ); +usbhs_unlock (priv, flags); } static void usbhsg_queue_push(struct usbhsg_uep *uep,
Greg Kroah-Hartman
maintainerPATCH 96/124 scsi: Do not attach VPD to devices that dont support it
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hannes Reinecke <[email protected]>
commit 5ddfe0858ea7848c5d4efe3f4319e7543522e0ee upstream.
The patch "scsi: rescan VPD attributes" introduced a regression in which devices that don't support VPD were being scanned for VPD attributes anyway. This could cause issues for some devices and should be avoided so the check for scsi_level has been moved out of scsi_add_lun and into scsi_attach_vpd so that all callers will not scan VPD for devices that don't support it.
[mkp: Merge fix]
--- drivers/scsi/scsi.c | 3 ++- drivers/scsi/sd.c | 19 +------------------ include/scsi/scsi_device.h | 25 +++++++++++++++++++++++++ 3 files changed, 28 insertions(+), 19 deletions(-)
drivers/scsi/scsi.c +2 -1
@@ -784,8 +784,9 @@ void scsi_attach_vpd(struct scsi_deviceint pg83_supported =0 ;unsigned char __rcu *vpd_buf, *orig_vpd_buf =NULL ; -if (sdev->skip_vpd_pages) +if (!scsi_device_supports_vpd (sdev))return ; + retry_pg0: vpd_buf =kmalloc (vpd_len,GFP_KERNEL );if (!vpd_buf)
drivers/scsi/sd.c +1 -18
@@ -2795,23 +2795,6 @@ static void sd_read_write_same(struct sc sdkp->ws10 =1 ; } -static int sd_try_extended_inquiry (struct scsi_device *sdp) -{ -/* Attempt VPD inquiry if the device blacklist explicitly calls -* for it. -*/ -if (sdp->try_vpd_pages) -return 1 ; -/* -* Although VPD inquiries can go to SCSI-2 type devices, -* some USB ones crash on receiving them, and the pages -* we currently ask for are for SPC-3 and beyond -*/ -if (sdp->scsi_level >SCSI_SPC_2 && !sdp->skip_vpd_pages) -return 1 ; -return 0 ; -} -static inline u32 logical_to_sectors (struct scsi_device *sdev,u32 blocks) {return blocks << (ilog2 (sdev->sector_size) -9 );
@@ -2856,7 +2839,7 @@ static int sd_revalidate_disk(struct genif (sdkp->media_present) {sd_read_capacity (sdkp, buffer); -if (sd_try_extended_inquiry (sdp)) { +if (scsi_device_supports_vpd (sdp)) {sd_read_block_provisioning (sdkp);sd_read_block_limits (sdkp);sd_read_block_characteristics (sdkp);
include/scsi/scsi_device.h +25 -0
@@ -513,6 +513,31 @@ static inline int scsi_device_tpgs(strucreturn sdev->inquiry ? (sdev->inquiry[5 ] >>4 ) &0x3 :0 ; } +/** +* scsi_device_supports_vpd - test if a device supports VPD pages +* @sdev: the &struct scsi_device to test +* +* If the 'try_vpd_pages' flag is set it takes precedence. +* Otherwise we will assume VPD pages are supported if the +* SCSI level is at least SPC-3 and 'skip_vpd_pages' is not set. +*/ +static inline int scsi_device_supports_vpd (struct scsi_device *sdev) +{ +/* Attempt VPD inquiry if the device blacklist explicitly calls +* for it. +*/ +if (sdev->try_vpd_pages) +return 1 ; +/* +* Although VPD inquiries can go to SCSI-2 type devices, +* some USB ones crash on receiving them, and the pages +* we currently ask for are for SPC-3 and beyond +*/ +if (sdev->scsi_level >SCSI_SPC_2 && !sdev->skip_vpd_pages) +return 1 ; +return 0 ; +} +#define MODULE_ALIAS_SCSI_DEVICE (type) \ MODULE_ALIAS("scsi:t-" __stringify(type) "*")#define SCSI_DEVICE_MODALIAS_FMT "scsi:t-0x%02x"
Greg Kroah-Hartman
maintainerPATCH 97/124 ARM: 8550/1: protect idiv patching against undefined gcc behavior
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolas Pitre <[email protected]>
commit 208fae5c3b9431013ad7bcea07cbcee114e7d163 upstream.
It was reported that a kernel with CONFIG_ARM_PATCH_IDIV=y stopped booting when compiled with the upcoming gcc 6. Turns out that turning a function address into a writable array is undefined and gcc 6 decided it was OK to omit the store to the first word of the function while still preserving the store to the second word.
Even though gcc 6 is now fixed to behave more coherently, it is a mystery that gcc 4 and gcc 5 actually produce wanted code in the kernel. And in fact the reduced test case to illustrate the issue does indeed break with gcc < 6 as well.
In any case, let's guard the kernel against undefined compiler behavior by hiding the nature of the array location as suggested by gcc developers.
Reference: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=70128
--- arch/arm/kernel/setup.c | 2 ++ 1 file changed, 2 insertions(+)
arch/arm/kernel/setup.c +2 -0
@@ -430,11 +430,13 @@ static void __init patch_aeabi_idiv(voidpr_info ("CPU: div instructions available: patching division code\n" ); fn_addr = ((uintptr_t )&__aeabi_uidiv) & ~1 ; + asm ("" :"+g" (fn_addr)); ((u32 *)fn_addr)[0 ] =udiv_instruction (); ((u32 *)fn_addr)[1 ] =bx_lr_instruction ();flush_icache_range (fn_addr, fn_addr +8 ); fn_addr = ((uintptr_t )&__aeabi_idiv) & ~1 ; + asm ("" :"+g" (fn_addr)); ((u32 *)fn_addr)[0 ] =sdiv_instruction (); ((u32 *)fn_addr)[1 ] =bx_lr_instruction ();flush_icache_range (fn_addr, fn_addr +8 );
Greg Kroah-Hartman
maintainerPATCH 98/124 iio: fix config watermark initial value
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Irina Tirdea <[email protected]>
commit 1bef2c1d4e4fd92bdf8219b13ba97ba861618254 upstream.
config structure is set to 0 when updating the buffers, so by default config->watermark will be 0. When computing the minimum between config->watermark and the buffer->watermark or insert_buffer-watermark, this will always be 0 regardless of the value set by the user for the buffer.
Set as initial value for config->watermark the maximum allowed value so that the minimum value will always be set from one of the buffers.
attached buffers")
--- drivers/iio/industrialio-buffer.c | 1 + 1 file changed, 1 insertion(+)
drivers/iio/industrialio-buffer.c +1 -0
@@ -645,6 +645,7 @@ static int iio_verify_update(struct iio_unsigned int modes;memset (config,0 ,sizeof (*config)); + config->watermark = ~0 ;/* * If there is just one buffer and we are removing it there is nothing
Greg Kroah-Hartman
maintainerPATCH 99/124 iio: st_magn: always define ST_MAGN_TRIGGER_SET_STATE
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
commit 9b090a98e95c2530ef0ce474e3b6218621b8ae25 upstream.
When CONFIG_IIO_TRIGGER is enabled but CONFIG_IIO_BUFFER is not, we get a build error in the st_magn driver:
drivers/iio/magnetometer/st_magn_core.c:573:23: error: 'ST_MAGN_TRIGGER_SET_STATE' undeclared here (not in a function)
.set_trigger_state = ST_MAGN_TRIGGER_SET_STATE,
^~~~~~~~~~~~~~~~~~~~~~~~~
Apparently, this ST_MAGN_TRIGGER_SET_STATE macro was meant to be set to NULL when the definition is not available because st_magn_buffer.c is not compiled, but the alternative definition was not included in the original patch. This adds it.
--- drivers/iio/magnetometer/st_magn.h | 1 + 1 file changed, 1 insertion(+)
drivers/iio/magnetometer/st_magn.h +1 -0
@@ -44,6 +44,7 @@ static inline int st_magn_allocate_ring(static inline void st_magn_deallocate_ring (struct iio_dev *indio_dev) { } +#define ST_MAGN_TRIGGER_SET_STATE NULL#endif /* CONFIG_IIO_BUFFER */ #endif /* ST_MAGN_H */
Greg Kroah-Hartman
maintainerPATCH 100/124 iio: accel: bmc150: fix endianness when reading axes
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Irina Tirdea <[email protected]>
commit 2215f31dc6f88634c1916362e922b1ecdce0a6b3 upstream.
For big endian platforms, reading the axes will return invalid values.
The device stores each axis value in a 16 bit little endian register. The driver uses regmap_read_bulk to get the axis value, resulting in a 16 bit little endian value. This needs to be converted to cpu endianness to work on big endian platforms.
Fix endianness for big endian platforms by converting the values for the axes read from little endian to cpu.
This is also partially fixed in commit b6fb9b6d6552 ("iio:
accel: bmc150: optimize transfers in trigger handler").
--- drivers/iio/accel/bmc150-accel-core.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/iio/accel/bmc150-accel-core.c +4 -3
@@ -547,7 +547,7 @@ static int bmc150_accel_get_axis(struct {int ret;int axis = chan->scan_index; -unsigned int raw_val; +__le16 raw_val;mutex_lock (&data->mutex); ret =bmc150_accel_set_power_state (data, true);
@@ -557,14 +557,14 @@ static int bmc150_accel_get_axis(struct } ret =regmap_bulk_read (data->regmap,BMC150_ACCEL_AXIS_TO_REG (axis), - &raw_val,2 ); + &raw_val,sizeof (raw_val));if (ret <0 ) {dev_err (data->dev,"Error reading axis %d\n" , axis);bmc150_accel_set_power_state (data, false);mutex_unlock (&data->mutex);return ret; } - *val =sign_extend32 (raw_val >> chan->scan_type.shift, + *val =sign_extend32 (le16_to_cpu (raw_val) >> chan->scan_type.shift, chan->scan_type.realbits -1 ); ret =bmc150_accel_set_power_state (data, false);mutex_unlock (&data->mutex);
@@ -988,6 +988,7 @@ static const struct iio_event_spec bmc15 .realbits = (bits), \ .storagebits = 16, \ .shift = 16 - (bits), \ + .endianness = IIO_LE, \ }, \ .event_spec = &bmc150_accel_event, \ .num_event_specs = 1 \
Greg Kroah-Hartman
maintainerPATCH 101/124 iio: gyro: bmg160: fix buffer read values
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Irina Tirdea <[email protected]>
commit b475c59b113db1e66eb9527ffdec3c5241c847e5 upstream.
When reading gyroscope axes using iio buffers, the values returned are always 0. In the interrupt handler, the return value of the read operation is returned to the user instead of the value read. Return the value read to the user.
This is also fixed in commit 82d8e5da1a33 ("iio:
accel: bmg160: optimize transfers in trigger handler").
--- drivers/iio/gyro/bmg160_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/gyro/bmg160_core.c +1 -1
@@ -780,7 +780,7 @@ static irqreturn_t bmg160_trigger_handlemutex_unlock (&data->mutex); goto err; } - data->buffer[i++] = ret; + data->buffer[i++] = val; }mutex_unlock (&data->mutex);
Greg Kroah-Hartman
maintainerPATCH 102/124 iio: gyro: bmg160: fix endianness when reading axes
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Irina Tirdea <[email protected]>
commit 95e7ff034175db7d8aefabe7716c4d42bea24fde upstream.
For big endian platforms, reading the axes will return invalid values.
The device stores each axis value in a 16 bit little endian register. The driver uses regmap_read_bulk to get the axis value, resulting in a 16 bit little endian value. This needs to be converted to cpu endianness to work on big endian platforms.
Fix endianness for big endian platforms by converting the values for the axes read from little endian to cpu.
This is also partially fixed in commit 82d8e5da1a33 ("iio:
accel: bmg160: optimize transfers in trigger handler").
--- drivers/iio/gyro/bmg160_core.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/iio/gyro/bmg160_core.c +4 -3
@@ -452,7 +452,7 @@ static int bmg160_get_temp(struct bmg160static int bmg160_get_axis (struct bmg160_data *data,int axis,int *val) {int ret; -unsigned int raw_val; +__le16 raw_val;mutex_lock (&data->mutex); ret =bmg160_set_power_state (data, true);
@@ -462,7 +462,7 @@ static int bmg160_get_axis(struct bmg160 } ret =regmap_bulk_read (data->regmap,BMG160_AXIS_TO_REG (axis), &raw_val, -2 ); +sizeof (raw_val));if (ret <0 ) {dev_err (data->dev,"Error reading axis %d\n" , axis);bmg160_set_power_state (data, false);
@@ -470,7 +470,7 @@ static int bmg160_get_axis(struct bmg160return ret; } - *val =sign_extend32 (raw_val,15 ); + *val =sign_extend32 (le16_to_cpu (raw_val),15 ); ret =bmg160_set_power_state (data, false);mutex_unlock (&data->mutex);if (ret <0 )
@@ -733,6 +733,7 @@ static const struct iio_event_spec bmg16 .sign = 's', \ .realbits = 16, \ .storagebits = 16, \ + .endianness = IIO_LE, \ }, \ .event_spec = &bmg160_event, \ .num_event_specs = 1 \
Greg Kroah-Hartman
maintainerPATCH 103/124 sd: Fix excessive capacity printing on devices with blocks bigger than 512 bytes
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin K. Petersen <[email protected]>
commit f08bb1e0dbdd0297258d0b8cd4dbfcc057e57b2a upstream.
During revalidate we check whether device capacity has changed before we decide whether to output disk information or not.
The check for old capacity failed to take into account that we scaled sdkp->capacity based on the reported logical block size. And therefore the capacity test would always fail for devices with sectors bigger than 512 bytes and we would print several copies of the same discovery information.
Avoid scaling sdkp->capacity and instead adjust the value on the fly when setting the block device capacity and generating fake C/H/S geometry.
--- drivers/scsi/sd.c | 28 ++++++++-------------------- drivers/scsi/sd.h | 7 ++++++- 2 files changed, 14 insertions(+), 21 deletions(-)
drivers/scsi/sd.c +8 -20
@@ -1275,18 +1275,19 @@ static int sd_getgeo(struct block_devicestruct scsi_disk *sdkp =scsi_disk (bdev->bd_disk);struct scsi_device *sdp = sdkp->device;struct Scsi_Host *host = sdp->host; +sector_t capacity =logical_to_sectors (sdp, sdkp->capacity);int diskinfo[4 ];/* default to most commonly used values */ - diskinfo[0 ] =0x40 ;/* 1 << 6 */ - diskinfo[1 ] =0x20 ;/* 1 << 5 */ - diskinfo[2 ] = sdkp->capacity >>11 ; - + diskinfo[0 ] =0x40 ;/* 1 << 6 */ + diskinfo[1 ] =0x20 ;/* 1 << 5 */ + diskinfo[2 ] = capacity >>11 ; +/* override with calculated, extended default, or driver values */ if (host->hostt->bios_param) - host->hostt->bios_param (sdp, bdev, sdkp->capacity, diskinfo); + host->hostt->bios_param (sdp, bdev, capacity, diskinfo);else -scsicam_bios_param (bdev, sdkp->capacity, diskinfo); +scsicam_bios_param (bdev, capacity, diskinfo); geo->heads = diskinfo[0 ]; geo->sectors = diskinfo[1 ];
@@ -2337,14 +2338,6 @@ got_data:if (sdkp->capacity >0xffffffff ) sdp->use_16_for_rw =1 ; -/* Rescale capacity to 512-byte units */ -if (sector_size ==4096 ) - sdkp->capacity <<=3 ; -else if (sector_size ==2048 ) - sdkp->capacity <<=2 ; -else if (sector_size ==1024 ) - sdkp->capacity <<=1 ; -blk_queue_physical_block_size (sdp->request_queue, sdkp->physical_block_size); sdkp->device->sector_size = sector_size;
@@ -2795,11 +2788,6 @@ static void sd_read_write_same(struct sc sdkp->ws10 =1 ; } -static inline u32 logical_to_sectors (struct scsi_device *sdev,u32 blocks) -{ -return blocks << (ilog2 (sdev->sector_size) -9 ); -} -/** * sd_revalidate_disk - called the first time a new disk is seen, * performs disk spin up, read_capacity, etc.
@@ -2883,7 +2871,7 @@ static int sd_revalidate_disk(struct gen/* Combine with controller limits */ q->limits.max_sectors =min (rw_max,queue_max_hw_sectors (q)); -set_capacity (disk, sdkp->capacity); +set_capacity (disk,logical_to_sectors (sdp, sdkp->capacity));sd_config_write_same (sdkp);kfree (buffer);
drivers/scsi/sd.h +6 -1
@@ -65,7 +65,7 @@ struct scsi_disk {struct device dev;struct gendisk *disk;atomic_t openers; -sector_t capacity;/* size in 512-byte sectors */ +sector_t capacity;/* size in logical blocks */ u32 max_xfer_blocks;u32 opt_xfer_blocks;u32 max_ws_blocks;
@@ -146,6 +146,11 @@ static inline int scsi_medium_access_comreturn 0 ; } +static inline sector_t logical_to_sectors (struct scsi_device *sdev,sector_t blocks) +{ +return blocks << (ilog2 (sdev->sector_size) -9 ); +} +/* * A DIF-capable target device can be formatted with different * protection schemes. Currently 0 through 3 are defined:
Greg Kroah-Hartman
maintainerPATCH 104/124 fs: add file_dentry()
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miklos Szeredi <[email protected]>
commit d101a125954eae1d397adda94ca6319485a50493 upstream.
This series fixes bugs in nfs and ext4 due to 4bacc9c9234c ("overlayfs:
Make f_path always point to the overlay and f_inode to the underlay").
Regular files opened on overlayfs will result in the file being opened on the underlying filesystem, while f_path points to the overlayfs mount/dentry.
This confuses filesystems which get the dentry from struct file and assume it's theirs.
Add a new helper, file_dentry() [*], to get the filesystem's own dentry from the file. This checks file->f_path.dentry->d_flags against DCACHE_OP_REAL, and returns file->f_path.dentry if DCACHE_OP_REAL is not set (this is the common, non-overlayfs case).
In the uncommon case it will call into overlayfs's ->d_real() to get the underlying dentry, matching file_inode(file).
The reason we need to check against the inode is that if the file is copied up while being open, d_real() would return the upper dentry, while the open file comes from the lower dentry.
[*] If possible, it's better simply to use file_inode() instead.
--- fs/dcache.c | 5 ++++- fs/overlayfs/super.c | 33 +++++++++++++++++++++++++++++++++ include/linux/dcache.h | 10 ++++++++++ include/linux/fs.h | 10 ++++++++++ 4 files changed, 57 insertions(+), 1 deletion(-)
fs/dcache.c +4 -1
@@ -1667,7 +1667,8 @@ void d_set_d_op(struct dentry *dentry, cDCACHE_OP_REVALIDATE |DCACHE_OP_WEAK_REVALIDATE |DCACHE_OP_DELETE | - DCACHE_OP_SELECT_INODE)); +DCACHE_OP_SELECT_INODE | + DCACHE_OP_REAL)); dentry->d_op = op;if (!op)return ;
@@ -1685,6 +1686,8 @@ void d_set_d_op(struct dentry *dentry, c dentry->d_flags |=DCACHE_OP_PRUNE ;if (op->d_select_inode) dentry->d_flags |=DCACHE_OP_SELECT_INODE ; +if (op->d_real) + dentry->d_flags |=DCACHE_OP_REAL ; }EXPORT_SYMBOL (d_set_d_op);
fs/overlayfs/super.c +33 -0
@@ -295,6 +295,37 @@ static void ovl_dentry_release(struct de } } +static struct dentry *ovl_d_real (struct dentry *dentry,struct inode *inode) +{ +struct dentry *real; + +if (d_is_dir (dentry)) { +if (!inode || inode ==d_inode (dentry)) +return dentry; + goto bug; + } + + real =ovl_dentry_upper (dentry); +if (real && (!inode || inode ==d_inode (real))) +return real; + + real =ovl_dentry_lower (dentry); +if (!real) + goto bug; + +if (!inode || inode ==d_inode (real)) +return real; + +/* Handle recursion */ +if (real->d_flags &DCACHE_OP_REAL ) +return real->d_op->d_real (real, inode); + +bug: +WARN (1 ,"ovl_d_real(%pd4, %s:%lu\n): real dentry not found\n" , dentry, + inode ? inode->i_sb->s_id :"NULL" , inode ? inode->i_ino :0 ); +return dentry; +} +static int ovl_dentry_revalidate (struct dentry *dentry,unsigned int flags) {struct ovl_entry *oe = dentry->d_fsdata;
@@ -339,11 +370,13 @@ static int ovl_dentry_weak_revalidate(ststatic const struct dentry_operations ovl_dentry_operations = { .d_release = ovl_dentry_release, .d_select_inode = ovl_d_select_inode, + .d_real = ovl_d_real, };static const struct dentry_operations ovl_reval_dentry_operations = { .d_release = ovl_dentry_release, .d_select_inode = ovl_d_select_inode, + .d_real = ovl_d_real, .d_revalidate = ovl_dentry_revalidate, .d_weak_revalidate = ovl_dentry_weak_revalidate, };
include/linux/dcache.h +10 -0
@@ -161,6 +161,7 @@ struct dentry_operations {struct vfsmount *(*d_automount)(struct path *);int (*d_manage)(struct dentry *,bool );struct inode *(*d_select_inode)(struct dentry *,unsigned ); +struct dentry *(*d_real)(struct dentry *,struct inode *); }____cacheline_aligned ;/*
@@ -227,6 +228,7 @@ struct dentry_operations {#define DCACHE_MAY_FREE 0x00800000#define DCACHE_FALLTHRU 0x01000000/* Fall through to lower layer */ #define DCACHE_OP_SELECT_INODE 0x02000000/* Unioned entry: dcache op selects inode */ +#define DCACHE_OP_REAL 0x08000000extern seqlock_t rename_lock;
@@ -582,4 +584,12 @@ static inline struct dentry *d_backing_d return upper; } +static inline struct dentry *d_real (struct dentry *dentry) +{ +if (unlikely (dentry->d_flags &DCACHE_OP_REAL )) +return dentry->d_op->d_real (dentry,NULL ); +else +return dentry; +} +#endif /* __LINUX_DCACHE_H */
include/linux/fs.h +10 -0
@@ -1234,6 +1234,16 @@ static inline struct inode *file_inode(creturn f->f_inode; } +static inline struct dentry *file_dentry (const struct file *file) +{ +struct dentry *dentry = file->f_path.dentry; + +if (unlikely (dentry->d_flags &DCACHE_OP_REAL )) +return dentry->d_op->d_real (dentry,file_inode (file)); +else +return dentry; +} +static inline int locks_lock_file_wait (struct file *filp,struct file_lock *fl) {return locks_lock_inode_wait (file_inode (filp), fl);
Greg Kroah-Hartman
maintainerPATCH 105/124 nfs: use file_dentry()
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miklos Szeredi <[email protected]>
commit be62a1a8fd116f5cd9e53726601f970e16e17558 upstream.
NFS may be used as lower layer of overlayfs and accessing f_path.dentry can lead to a crash.
Fix by replacing direct access of file->f_path.dentry with the file_dentry() accessor, which will always return a native object.
--- fs/nfs/dir.c | 6 +++--- fs/nfs/inode.c | 2 +- fs/nfs/nfs4file.c | 4 ++-- 3 files changed, 6 insertions(+), 6 deletions(-)
fs/nfs/dir.c +3 -3
@@ -377,7 +377,7 @@ int nfs_readdir_xdr_filler(struct page * again: timestamp = jiffies; gencount =nfs_inc_attr_generation_counter (); - error =NFS_PROTO (inode)->readdir (file->f_path.dentry, cred, entry->cookie, pages, + error =NFS_PROTO (inode)->readdir (file_dentry (file), cred, entry->cookie, pages,NFS_SERVER (inode)->dtsize, desc->plus);if (error <0 ) {/* We requested READDIRPLUS, but the server doesn't grok it */
@@ -560,7 +560,7 @@ int nfs_readdir_page_filler(nfs_readdir_ count++;if (desc->plus !=0 ) -nfs_prime_dcache (desc->file->f_path.dentry, entry); +nfs_prime_dcache (file_dentry (desc->file), entry); status =nfs_readdir_add_to_array (entry, page);if (status !=0 )
@@ -864,7 +864,7 @@ static bool nfs_dir_mapping_need_revalid*/ static int nfs_readdir (struct file *file,struct dir_context *ctx) { -struct dentry *dentry = file->f_path.dentry; +struct dentry *dentry =file_dentry (file);struct inode *inode =d_inode (dentry);nfs_readdir_descriptor_t my_desc, *desc = &my_desc;
fs/nfs/inode.c +1 -1
@@ -940,7 +940,7 @@ int nfs_open(struct inode *inode, struct {struct nfs_open_context *ctx; - ctx =alloc_nfs_open_context (filp->f_path.dentry, filp->f_mode); + ctx =alloc_nfs_open_context (file_dentry (filp), filp->f_mode);if (IS_ERR (ctx))return PTR_ERR (ctx);nfs_file_set_open_context (filp, ctx);
fs/nfs/nfs4file.c +2 -2
@@ -26,7 +26,7 @@ static int nfs4_file_open(struct inode *inode, struct file *filp) { struct nfs_open_context *ctx; -struct dentry *dentry = filp->f_path.dentry; +struct dentry *dentry =file_dentry (filp);struct dentry *parent =NULL ;struct inode *dir;unsigned openflags = filp->f_flags;
@@ -57,7 +57,7 @@ nfs4_file_open(struct inode *inode, stru parent =dget_parent (dentry); dir =d_inode (parent); - ctx =alloc_nfs_open_context (filp->f_path.dentry, filp->f_mode); + ctx =alloc_nfs_open_context (file_dentry (filp), filp->f_mode); err =PTR_ERR (ctx);if (IS_ERR (ctx)) goto out;
Greg Kroah-Hartman
maintainerPATCH 106/124 ext4 crypto: use dget_parent() in ext4_d_revalidate()
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Theodore Ts'o <[email protected]>
commit 3d43bcfef5f0548845a425365011c499875491b0 upstream.
This avoids potential problems caused by a race where the inode gets renamed out from its parent directory and the parent directory is deleted while ext4_d_revalidate() is running.
--- fs/ext4/crypto.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
fs/ext4/crypto.c +8 -4
@@ -475,13 +475,16 @@ uint32_t ext4_validate_encryption_key_si*/ static int ext4_d_revalidate (struct dentry *dentry,unsigned int flags) { -struct inode *dir =d_inode (dentry->d_parent); -struct ext4_crypt_info *ci =EXT4_I (dir)->i_crypt_info; +struct dentry *dir; +struct ext4_crypt_info *ci;int dir_has_key, cached_with_key; -if (!ext4_encrypted_inode (dir)) + dir =dget_parent (dentry); +if (!ext4_encrypted_inode (d_inode (dir))) { +dput (dir);return 0 ; - + } + ci =EXT4_I (d_inode (dir))->i_crypt_info; if (ci && ci->ci_keyring_key && (ci->ci_keyring_key->flags & ((1 << KEY_FLAG_INVALIDATED) | (1 << KEY_FLAG_REVOKED) |
@@ -491,6 +494,7 @@ static int ext4_d_revalidate(struct dent/* this should eventually be an flag in d_flags */ cached_with_key = dentry->d_fsdata !=NULL ; dir_has_key = (ci !=NULL ); +dput (dir);/* * If the dentry was cached without the key, and it is a
Greg Kroah-Hartman
maintainerPATCH 107/124 ext4: use dget_parent() in ext4_file_open()
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miklos Szeredi <[email protected]>
commit 9dd78d8c9a7bd4bc341f5864db32d4331b8eae4c upstream.
In f_op->open() lock on parent is not held, so there's no guarantee that parent dentry won't go away at any time.
Even after this patch there's no guarantee that 'dir' will stay the parent of 'inode', but at least it won't be freed while being used.
--- fs/ext4/file.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
fs/ext4/file.c +8 -4
@@ -335,7 +335,7 @@ static int ext4_file_open(struct inode *struct super_block *sb = inode->i_sb;struct ext4_sb_info *sbi =EXT4_SB (inode->i_sb);struct vfsmount *mnt = filp->f_path.mnt; -struct inode *dir = filp->f_path.dentry->d_parent->d_inode; +struct dentry *dir;struct path path;char buf[64 ], *cp;int ret;
@@ -379,14 +379,18 @@ static int ext4_file_open(struct inode *if (ext4_encryption_info (inode) ==NULL )return -ENOKEY ; } -if (ext4_encrypted_inode (dir) && - !ext4_is_child_context_consistent_with_parent (dir, inode)) { + + dir =dget_parent (filp->f_path.dentry); +if (ext4_encrypted_inode (d_inode (dir)) && + !ext4_is_child_context_consistent_with_parent (d_inode (dir), inode)) {ext4_warning (inode->i_sb,"Inconsistent encryption contexts: %lu/%lu\n" , - (unsigned long ) dir->i_ino, + (unsigned long )d_inode (dir)->i_ino, (unsigned long ) inode->i_ino); +dput (dir);return -EPERM ; } +dput (dir);/* * Set up the jbd2_inode if we are opening the inode for * writing and the journal is present
Greg Kroah-Hartman
maintainerPATCH 108/124 ext4: use file_dentry()
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miklos Szeredi <[email protected]>
commit c0a37d48788475d0a2cf4fbfaa28559a9de612fc upstream.
EXT4 may be used as lower layer of overlayfs and accessing f_path.dentry can lead to a crash.
Fix by replacing direct access of file->f_path.dentry with the file_dentry() accessor, which will always return a native object.
--- fs/ext4/file.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ext4/file.c +1 -1
@@ -380,7 +380,7 @@ static int ext4_file_open(struct inode *return -ENOKEY ; } - dir =dget_parent (filp->f_path.dentry); + dir =dget_parent (file_dentry (filp));if (ext4_encrypted_inode (d_inode (dir)) && !ext4_is_child_context_consistent_with_parent (d_inode (dir), inode)) { ext4_warning(inode->i_sb,
Greg Kroah-Hartman
maintainerPATCH 109/124 btrfs: fix crash/invalid memory access on fsync when using overlayfs
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
commit de17e793b104d690e1d007dfc5cb6b4f649598ca upstream.
If the lower or upper directory of an overlayfs mount belong to a btrfs file system and we fsync the file through the overlayfs' merged directory we ended up accessing an inode that didn't belong to btrfs as if it were a btrfs inode at btrfs_sync_file() resulting in a crash like the following:
[ 7782.588845] BUG: unable to handle kernel NULL pointer dereference at 0000000000000544 [ 7782.590624] IP: [<ffffffffa030b7ab>] btrfs_sync_file+0x11b/0x3e9 [btrfs] [ 7782.591931] PGD 4d954067 PUD 1e878067 PMD 0 [ 7782.592016] Oops: 0002 [#6] PREEMPT SMP DEBUG_PAGEALLOC [ 7782.592016] Modules linked in: btrfs overlay ppdev crc32c_generic evdev xor raid6_pq psmouse pcspkr sg serio_raw acpi_cpufreq parport_pc parport tpm_tis i2c_piix4 tpm i2c_core processor button loop autofs4 ext4 crc16 mbcache jbd2 sr_mod cdrom sd_mod ata_generic virtio_scsi ata_piix virtio_pci libata virtio_ring virtio scsi_mod e1000 floppy [last unloaded: btrfs] [ 7782.592016] CPU: 10 PID: 16437 Comm: xfs_io Tainted: G D 4.5.0-rc6-btrfs-next-26+ #1 [ 7782.592016] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS by qemu-project.org 04/01/2014 [ 7782.592016] task: ffff88001b8d40c0 ti: ffff880137488000 task.ti: ffff880137488000 [ 7782.592016] RIP: 0010:[<ffffffffa030b7ab>] [<ffffffffa030b7ab>] btrfs_sync_file+0x11b/0x3e9 [btrfs] [ 7782.592016] RSP: 0018:ffff88013748be40 EFLAGS: 00010286 [ 7782.592016] RAX: 0000000080000000 RBX: ffff880133b30c88 RCX: 0000000000000001 [ 7782.592016] RDX: 0000000000000001 RSI: ffffffff8148fec0 RDI: 00000000ffffffff [ 7782.592016] RBP: ffff88013748bec0 R08: 0000000000000001 R09: 0000000000000000 [ 7782.624248] R10: ffff88013748be40 R11: 0000000000000246 R12: 0000000000000000 [ 7782.624248] R13: 0000000000000000 R14: 00000000009305a0 R15: ffff880015e3be40 [ 7782.624248] FS: 00007fa83b9cb700(0000) GS:ffff88023ed40000(0000) knlGS:0000000000000000 [ 7782.624248] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 7782.624248] CR2: 0000000000000544 CR3: 00000001fa652000 CR4: 00000000000006e0 [ 7782.624248] Stack: [ 7782.624248] ffffffff8108b5cc ffff88013748bec0 0000000000000246 ffff8800b005ded0 [ 7782.624248] ffff880133b30d60 8000000000000000 7fffffffffffffff 0000000000000246 [ 7782.624248] 0000000000000246 ffffffff81074f9b ffffffff8104357c ffff880015e3be40 [ 7782.624248] Call Trace: [ 7782.624248] [<ffffffff8108b5cc>] ? arch_local_irq_save+0x9/0xc [ 7782.624248] [<ffffffff81074f9b>] ? ___might_sleep+0xce/0x217 [ 7782.624248] [<ffffffff8104357c>] ? __do_page_fault+0x3c0/0x43a [ 7782.624248] [<ffffffff811a2351>] vfs_fsync_range+0x8c/0x9e [ 7782.624248] [<ffffffff811a237f>] vfs_fsync+0x1c/0x1e [ 7782.624248] [<ffffffff811a24d6>] do_fsync+0x31/0x4a [ 7782.624248] [<ffffffff811a2700>] SyS_fsync+0x10/0x14 [ 7782.624248] [<ffffffff81493617>] entry_SYSCALL_64_fastpath+0x12/0x6b [ 7782.624248] Code: 85 c0 0f 85 e2 02 00 00 48 8b 45 b0 31 f6 4c 29 e8 48 ff c0 48 89 45 a8 48 8d 83 d8 00 00 00 48 89 c7 48 89 45 a0 e8 fc 43 18 e1 <f0> 41 ff 84 24 44 05 00 00 48 8b 83 58 ff ff ff 48 c1 e8 07 83 [ 7782.624248] RIP [<ffffffffa030b7ab>] btrfs_sync_file+0x11b/0x3e9 [btrfs] [ 7782.624248] RSP <ffff88013748be40> [ 7782.624248] CR2: 0000000000000544 [ 7782.661994] ---[ end trace 721e14960eb939bc ]---
This started happening since commit 4bacc9c9234 (overlayfs: Make f_path always point to the overlay and f_inode to the underlay) and even though after this change we could still access the btrfs inode through struct file->f_mapping->host or struct file->f_inode, we would end up resulting in more similar issues later on at check_parent_dirs_for_sync() because the dentry we got (from struct file->f_path.dentry) was from overlayfs and not from btrfs, that is, we had no way of getting the dentry that belonged to btrfs (we always got the dentry that belonged to overlayfs).
The new patch from Miklos Szeredi, titled "vfs: add file_dentry()" and recently submitted to linux-fsdevel, adds a file_dentry() API that allows us to get the btrfs dentry from the input file and therefore being able to fsync when the upper and lower directories belong to btrfs filesystems.
This issue has been reported several times by users in the mailing list and bugzilla. A test case for xfstests is being submitted as well.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=101951
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=109791
--- fs/btrfs/file.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/btrfs/file.c +1 -1
@@ -1883,7 +1883,7 @@ static int start_ordered_ops(struct inod*/ int btrfs_sync_file (struct file *file,loff_t start,loff_t end,int datasync) { -struct dentry *dentry = file->f_path.dentry; +struct dentry *dentry =file_dentry (file);struct inode *inode =d_inode (dentry);struct btrfs_root *root =BTRFS_I (inode)->root;struct btrfs_trans_handle *trans;
Greg Kroah-Hartman
maintainerPATCH 110/124 ext4: add lockdep annotations for i_data_sem
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Theodore Ts'o <[email protected]>
commit daf647d2dd58cec59570d7698a45b98e580f2076 upstream.
With the internal Quota feature, mke2fs creates empty quota inodes and quota usage tracking is enabled as soon as the file system is mounted. Since quotacheck is no longer preallocating all of the blocks in the quota inode that are likely needed to be written to, we are now seeing a lockdep false positive caused by needing to allocate a quota block from inside ext4_map_blocks(), while holding i_data_sem for a data inode. This results in this complaint:
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&ei->i_data_sem);
lock(&s->s_dquot.dqio_mutex);
lock(&ei->i_data_sem); lock(&s->s_dquot.dqio_mutex);
Google-Bug-Id: 27907753
--- fs/ext4/ext4.h | 23 +++++++++++++++++++++++ fs/ext4/move_extent.c | 11 +++++++++-- fs/ext4/super.c | 25 +++++++++++++++++++++++-- 3 files changed, 55 insertions(+), 4 deletions(-)
fs/ext4/ext4.h +23 -0
@@ -900,6 +900,29 @@ do { \#include "extents_status.h" /* +* Lock subclasses for i_data_sem in the ext4_inode_info structure. +* +* These are needed to avoid lockdep false positives when we need to +* allocate blocks to the quota inode during ext4_map_blocks(), while +* holding i_data_sem for a normal (non-quota) inode. Since we don't +* do quota tracking for the quota inode, this avoids deadlock (as +* well as infinite recursion, since it isn't turtles all the way +* down...) +* +* I_DATA_SEM_NORMAL - Used for most inodes +* I_DATA_SEM_OTHER - Used by move_inode.c for the second normal inode +* where the second inode has larger inode number +* than the first +* I_DATA_SEM_QUOTA - Used for quota inodes only +*/ +enum { +I_DATA_SEM_NORMAL =0 , +I_DATA_SEM_OTHER , +I_DATA_SEM_QUOTA , +}; + + +/* * fourth extended file system inode data in memory */ struct ext4_inode_info {
fs/ext4/move_extent.c +9 -2
@@ -60,10 +60,10 @@ ext4_double_down_write_data_sem(struct i {if (first < second) {down_write (&EXT4_I (first)->i_data_sem); -down_write_nested (&EXT4_I (second)->i_data_sem,SINGLE_DEPTH_NESTING ); +down_write_nested (&EXT4_I (second)->i_data_sem,I_DATA_SEM_OTHER ); }else {down_write (&EXT4_I (second)->i_data_sem); -down_write_nested (&EXT4_I (first)->i_data_sem,SINGLE_DEPTH_NESTING ); +down_write_nested (&EXT4_I (first)->i_data_sem,I_DATA_SEM_OTHER ); } }
@@ -483,6 +483,13 @@ mext_check_arguments(struct inode *orig_ orig_inode->i_ino, donor_inode->i_ino);return -EBUSY ; } + +if (IS_NOQUOTA (orig_inode) ||IS_NOQUOTA (donor_inode)) { +ext4_debug ("ext4 move extent: The argument files should " +"not be quota files [ino:orig %lu, donor %lu]\n" , + orig_inode->i_ino, donor_inode->i_ino); +return -EBUSY ; + }/* Ext4 move extent supports only extent based file */ if (!(ext4_test_inode_flag (orig_inode,EXT4_INODE_EXTENTS ))) {
fs/ext4/super.c +23 -2
@@ -5021,6 +5021,20 @@ static int ext4_quota_on_mount(struct su EXT4_SB(sb)->s_jquota_fmt, type); } +static void lockdep_set_quota_inode (struct inode *inode,int subclass) +{ +struct ext4_inode_info *ei =EXT4_I (inode); + +/* The first argument of lockdep_set_subclass has to be +* *exactly* the same as the argument to init_rwsem() --- in +* this case, in init_once() --- or lockdep gets unhappy +* because the name of the lock is set using the +* stringification of the argument to init_rwsem(). +*/ + (void ) ei;/* shut up clang warning if !CONFIG_LOCKDEP */ +lockdep_set_subclass (&ei->i_data_sem, subclass); +} +/* * Standard function to be called on quota_on */
@@ -5060,8 +5074,12 @@ static int ext4_quota_on(struct super_blif (err)return err; } - -return dquot_quota_on (sb, type, format_id, path); +lockdep_set_quota_inode (path->dentry->d_inode,I_DATA_SEM_QUOTA ); + err =dquot_quota_on (sb, type, format_id, path); +if (err) +lockdep_set_quota_inode (path->dentry->d_inode, +I_DATA_SEM_NORMAL ); +return err; } static int ext4_quota_enable(struct super_block *sb, int type, int format_id,
@@ -5088,8 +5106,11 @@ static int ext4_quota_enable(struct supe/* Don't account quota for quota files to avoid recursion */ qf_inode->i_flags |=S_NOQUOTA ; +lockdep_set_quota_inode (qf_inode,I_DATA_SEM_QUOTA ); err =dquot_enable (qf_inode, type, format_id, flags);iput (qf_inode); +if (err) +lockdep_set_quota_inode (qf_inode,I_DATA_SEM_NORMAL );return err; }
Greg Kroah-Hartman
maintainerPATCH 111/124 ext4: ignore quota mount options if the quota feature is enabled
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Theodore Ts'o <[email protected]>
commit c325a67c72903e1cc30e990a15ce745bda0dbfde upstream.
Previously, ext4 would fail the mount if the file system had the quota feature enabled and quota mount options (used for the older quota setups) were present. This broke xfstests, since xfs silently ignores the usrquote and grpquota mount options if they are specified. This commit changes things so that we are consistent with xfs; having the mount options specified is harmless, so no sense break users by forbidding them.
--- fs/ext4/super.c | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-)
fs/ext4/super.c +11 -11
@@ -1324,9 +1324,9 @@ static int set_qf_name(struct super_blocreturn -1 ; }if (ext4_has_feature_quota (sb)) { -ext4_msg (sb,KERN_ERR ,"Cannot set journaled quota options " -"when QUOTA feature is enabled" ); -return -1 ; +ext4_msg (sb,KERN_INFO ,"Journaled quota options " +"ignored when QUOTA feature is enabled" ); +return 1 ; } qname =match_strdup (args);if (!qname) {
@@ -1689,10 +1689,10 @@ static int handle_mount_opt(struct super return -1; }if (ext4_has_feature_quota (sb)) { -ext4_msg (sb,KERN_ERR , -"Cannot set journaled quota options " +ext4_msg (sb,KERN_INFO , +"Quota format mount options ignored " "when QUOTA feature is enabled" ); -return -1 ; +return 1 ; } sbi->s_jquota_fmt = m->mount_opt;#endif
@@ -1753,11 +1753,11 @@ static int parse_options(char *options,#ifdef CONFIG_QUOTA if (ext4_has_feature_quota (sb) && (test_opt (sb,USRQUOTA ) ||test_opt (sb,GRPQUOTA ))) { -ext4_msg (sb,KERN_ERR ,"Cannot set quota options when QUOTA " -"feature is enabled" ); -return 0 ; - } -if (sbi->s_qf_names[USRQUOTA ] || sbi->s_qf_names[GRPQUOTA ]) { +ext4_msg (sb,KERN_INFO ,"Quota feature enabled, usrquota and grpquota " +"mount options ignored." ); +clear_opt (sb,USRQUOTA ); +clear_opt (sb,GRPQUOTA ); + }else if (sbi->s_qf_names[USRQUOTA ] || sbi->s_qf_names[GRPQUOTA ]) {if (test_opt (sb,USRQUOTA ) && sbi->s_qf_names[USRQUOTA ])clear_opt (sb,USRQUOTA );
Greg Kroah-Hartman
maintainerPATCH 112/124 iommu: Dont overwrite domain pointer when there is no default_domain
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joerg Roedel <[email protected]>
commit eebb8034a5be8c2177cbf07ca2ecd2ff8a058958 upstream.
IOMMU drivers that do not support default domains, but make use of the the group->domain pointer can get that pointer overwritten with NULL on device add/remove.
Make sure this can't happen by only overwriting the domain pointer when it is NULL.
--- drivers/iommu/iommu.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/iommu/iommu.c +2 -1
@@ -848,7 +848,8 @@ struct iommu_group *iommu_group_get_for_if (!group->default_domain) { group->default_domain =__iommu_domain_alloc (dev->bus,IOMMU_DOMAIN_DMA ); - group->domain = group->default_domain; +if (!group->domain) + group->domain = group->default_domain; } ret =iommu_group_add_device (group, dev);
Greg Kroah-Hartman
maintainerPATCH 113/124 Btrfs: fix file/data loss caused by fsync after rename and new inode
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
commit 56f23fdbb600e6087db7b009775b95ce07cc3195 upstream.
If we rename an inode A (be it a file or a directory), create a new inode B with the old name of inode A and under the same parent directory, fsync inode B and then power fail, at log tree replay time we end up removing inode A completely. If inode A is a directory then all its files are gone too.
Example scenarios where this happens:
This is reproducible with the following steps, taken from a couple of test cases written for fstests which are going to be submitted upstream soon:
# Scenario 1
mkfs.btrfs -f /dev/sdc
mount /dev/sdc /mnt
mkdir -p /mnt/a/x
echo "hello" > /mnt/a/x/foo
echo "world" > /mnt/a/x/bar
sync
mv /mnt/a/x /mnt/a/y
mkdir /mnt/a/x
xfs_io -c fsync /mnt/a/x
<power failure happens>
The next time the fs is mounted, log tree replay happens and the directory "y" does not exist nor do the files "foo" and "bar" exist anywhere (neither in "y" nor in "x", nor the root nor anywhere).
# Scenario 2
mkfs.btrfs -f /dev/sdc
mount /dev/sdc /mnt
mkdir /mnt/a
echo "hello" > /mnt/a/foo
sync
mv /mnt/a/foo /mnt/a/bar
echo "world" > /mnt/a/foo
xfs_io -c fsync /mnt/a/foo
<power failure happens>
The next time the fs is mounted, log tree replay happens and the file "bar" does not exists anymore. A file with the name "foo" exists and it matches the second file we created.
Another related problem that does not involve file/data loss is when a new inode is created with the name of a deleted snapshot and we fsync it:
mkfs.btrfs -f /dev/sdc
mount /dev/sdc /mnt
mkdir /mnt/testdir
btrfs subvolume snapshot /mnt /mnt/testdir/snap
btrfs subvolume delete /mnt/testdir/snap
rmdir /mnt/testdir
mkdir /mnt/testdir
xfs_io -c fsync /mnt/testdir # or fsync some file inside /mnt/testdir <power failure>
The next time the fs is mounted the log replay procedure fails because it attempts to delete the snapshot entry (which has dir item key type of BTRFS_ROOT_ITEM_KEY) as if it were a regular (non-root) entry, resulting in the following error that causes mount to fail:
[52174.510532] BTRFS info (device dm-0): failed to delete reference to snap, inode 257 parent 257 [52174.512570] ------------[ cut here ]------------ [52174.513278] WARNING: CPU: 12 PID: 28024 at fs/btrfs/inode.c:3986 __btrfs_unlink_inode+0x178/0x351 [btrfs]() [52174.514681] BTRFS: Transaction aborted (error -2) [52174.515630] Modules linked in: btrfs dm_flakey dm_mod overlay crc32c_generic ppdev xor raid6_pq acpi_cpufreq parport_pc tpm_tis sg parport tpm evdev i2c_piix4 proc [52174.521568] CPU: 12 PID: 28024 Comm: mount Tainted: G W 4.5.0-rc6-btrfs-next-27+ #1 [52174.522805] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS by qemu-project.org 04/01/2014 [52174.524053] 0000000000000000 ffff8801df2a7710 ffffffff81264e93 ffff8801df2a7758 [52174.524053] 0000000000000009 ffff8801df2a7748 ffffffff81051618 ffffffffa03591cd [52174.524053] 00000000fffffffe ffff88015e6e5000 ffff88016dbc3c88 ffff88016dbc3c88 [52174.524053] Call Trace: [52174.524053] [<ffffffff81264e93>] dump_stack+0x67/0x90 [52174.524053] [<ffffffff81051618>] warn_slowpath_common+0x99/0xb2 [52174.524053] [<ffffffffa03591cd>] ? __btrfs_unlink_inode+0x178/0x351 [btrfs] [52174.524053] [<ffffffff81051679>] warn_slowpath_fmt+0x48/0x50 [52174.524053] [<ffffffffa03591cd>] __btrfs_unlink_inode+0x178/0x351 [btrfs] [52174.524053] [<ffffffff8118f5e9>] ? iput+0xb0/0x284 [52174.524053] [<ffffffffa0359fe8>] btrfs_unlink_inode+0x1c/0x3d [btrfs] [52174.524053] [<ffffffffa038631e>] check_item_in_log+0x1fe/0x29b [btrfs] [52174.524053] [<ffffffffa0386522>] replay_dir_deletes+0x167/0x1cf [btrfs] [52174.524053] [<ffffffffa038739e>] fixup_inode_link_count+0x289/0x2aa [btrfs] [52174.524053] [<ffffffffa038748a>] fixup_inode_link_counts+0xcb/0x105 [btrfs] [52174.524053] [<ffffffffa038a5ec>] btrfs_recover_log_trees+0x258/0x32c [btrfs] [52174.524053] [<ffffffffa03885b2>] ? replay_one_extent+0x511/0x511 [btrfs] [52174.524053] [<ffffffffa034f288>] open_ctree+0x1dd4/0x21b9 [btrfs] [52174.524053] [<ffffffffa032b753>] btrfs_mount+0x97e/0xaed [btrfs] [52174.524053] [<ffffffff8108e1b7>] ? trace_hardirqs_on+0xd/0xf [52174.524053] [<ffffffff8117bafa>] mount_fs+0x67/0x131 [52174.524053] [<ffffffff81193003>] vfs_kern_mount+0x6c/0xde [52174.524053] [<ffffffffa032af81>] btrfs_mount+0x1ac/0xaed [btrfs] [52174.524053] [<ffffffff8108e1b7>] ? trace_hardirqs_on+0xd/0xf [52174.524053] [<ffffffff8108c262>] ? lockdep_init_map+0xb9/0x1b3 [52174.524053] [<ffffffff8117bafa>] mount_fs+0x67/0x131 [52174.524053] [<ffffffff81193003>] vfs_kern_mount+0x6c/0xde [52174.524053] [<ffffffff8119590f>] do_mount+0x8a6/0x9e8 [52174.524053] [<ffffffff811358dd>] ? strndup_user+0x3f/0x59 [52174.524053] [<ffffffff81195c65>] SyS_mount+0x77/0x9f [52174.524053] [<ffffffff814935d7>] entry_SYSCALL_64_fastpath+0x12/0x6b [52174.561288] ---[ end trace 6b53049efb1a3ea6 ]---
Fix this by forcing a transaction commit when such cases happen. This means we check in the commit root of the subvolume tree if there was any other inode with the same reference when the inode we are fsync'ing is a new inode (created in the current transaction).
Test cases for fstests, covering all the scenarios given above, were submitted upstream for fstests:
* fstests: generic test for fsync after renaming directory
https://patchwork.kernel.org/patch/8694281/
* fstests: generic test for fsync after renaming file
https://patchwork.kernel.org/patch/8694301/
* fstests: add btrfs test for fsync after snapshot deletion
https://patchwork.kernel.org/patch/8670671/
--- fs/btrfs/tree-log.c | 137 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 137 insertions(+)
fs/btrfs/tree-log.c +137 -0
@@ -4414,6 +4414,127 @@ static int btrfs_log_trailing_hole(strucreturn ret; } +/* +* When we are logging a new inode X, check if it doesn't have a reference that +* matches the reference from some other inode Y created in a past transaction +* and that was renamed in the current transaction. If we don't do this, then at +* log replay time we can lose inode Y (and all its files if it's a directory): +* +* mkdir /mnt/x +* echo "hello world" > /mnt/x/foobar +* sync +* mv /mnt/x /mnt/y +* mkdir /mnt/x # or touch /mnt/x +* xfs_io -c fsync /mnt/x +* <power fail> +* mount fs, trigger log replay +* +* After the log replay procedure, we would lose the first directory and all its +* files (file foobar). +* For the case where inode Y is not a directory we simply end up losing it: +* +* echo "123" > /mnt/foo +* sync +* mv /mnt/foo /mnt/bar +* echo "abc" > /mnt/foo +* xfs_io -c fsync /mnt/foo +* <power fail> +* +* We also need this for cases where a snapshot entry is replaced by some other +* entry (file or directory) otherwise we end up with an unreplayable log due to +* attempts to delete the snapshot entry (entry of type BTRFS_ROOT_ITEM_KEY) as +* if it were a regular entry: +* +* mkdir /mnt/x +* btrfs subvolume snapshot /mnt /mnt/x/snap +* btrfs subvolume delete /mnt/x/snap +* rmdir /mnt/x +* mkdir /mnt/x +* fsync /mnt/x or fsync some new file inside it +* <power fail> +* +* The snapshot delete, rmdir of x, mkdir of a new x and the fsync all happen in +* the same transaction. +*/ +static int btrfs_check_ref_name_override (struct extent_buffer *eb, +const int slot, +const struct btrfs_key *key, +struct inode *inode) +{ +int ret; +struct btrfs_path *search_path; +char *name =NULL ; +u32 name_len =0 ; +u32 item_size =btrfs_item_size_nr (eb, slot); +u32 cur_offset =0 ; +unsigned long ptr =btrfs_item_ptr_offset (eb, slot); + + search_path =btrfs_alloc_path (); +if (!search_path) +return -ENOMEM ; + search_path->search_commit_root =1 ; + search_path->skip_locking =1 ; + +while (cur_offset < item_size) { +u64 parent; +u32 this_name_len; +u32 this_len; +unsigned long name_ptr; +struct btrfs_dir_item *di; + +if (key->type ==BTRFS_INODE_REF_KEY ) { +struct btrfs_inode_ref *iref; + + iref = (struct btrfs_inode_ref *)(ptr + cur_offset); + parent = key->offset; + this_name_len =btrfs_inode_ref_name_len (eb, iref); + name_ptr = (unsigned long )(iref +1 ); + this_len =sizeof (*iref) + this_name_len; + }else { +struct btrfs_inode_extref *extref; + + extref = (struct btrfs_inode_extref *)(ptr + + cur_offset); + parent =btrfs_inode_extref_parent (eb, extref); + this_name_len =btrfs_inode_extref_name_len (eb, extref); + name_ptr = (unsigned long )&extref->name; + this_len =sizeof (*extref) + this_name_len; + } + +if (this_name_len > name_len) { +char *new_name; + + new_name =krealloc (name, this_name_len,GFP_NOFS ); +if (!new_name) { + ret = -ENOMEM ; + goto out; + } + name_len = this_name_len; + name = new_name; + } + +read_extent_buffer (eb, name, name_ptr, this_name_len); + di =btrfs_lookup_dir_item (NULL ,BTRFS_I (inode)->root, + search_path, parent, + name, this_name_len,0 ); +if (di && !IS_ERR (di)) { + ret =1 ; + goto out; + }else if (IS_ERR (di)) { + ret =PTR_ERR (di); + goto out; + } +btrfs_release_path (search_path); + + cur_offset += this_len; + } + ret =0 ; +out: +btrfs_free_path (search_path); +kfree (name); +return ret; +} +/* log a single inode in the tree log. * At least one parent directory for this inode must exist in the tree * or be logged already.
@@ -4586,6 +4707,22 @@ again:if (min_key.type ==BTRFS_INODE_ITEM_KEY ) need_log_inode_item = false; +if ((min_key.type ==BTRFS_INODE_REF_KEY || + min_key.type ==BTRFS_INODE_EXTREF_KEY ) && +BTRFS_I (inode)->generation == trans->transid) { + ret =btrfs_check_ref_name_override (path->nodes[0 ], + path->slots[0 ], + &min_key, inode); +if (ret <0 ) { + err = ret; + goto out_unlock; + }else if (ret >0 ) { + err =1 ; +btrfs_set_log_full_commit (root->fs_info, trans); + goto out_unlock; + } + } +/* Skip xattrs, we log them later with btrfs_log_all_xattrs() */ if (min_key.type ==BTRFS_XATTR_ITEM_KEY ) {if (ins_nr ==0 )
Greg Kroah-Hartman
maintainerPATCH 114/124 arm64: replace read_lock to rcu lock in call_step_hook
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Shi <[email protected]>
commit cf0a25436f05753aca5151891aea4fd130556e2a upstream.
BUG: sleeping function called from invalid context at kernel/locking/rtmutex.c:917
in_atomic(): 1, irqs_disabled(): 128, pid: 383, name: sh Preemption disabled at:[<ffff800000124c18>] kgdb_cpu_enter+0x158/0x6b8
CPU: 3 PID: 383 Comm: sh Tainted: G W 4.1.13-rt13 #2 Hardware name: Freescale Layerscape 2085a RDB Board (DT) Call trace: [<ffff8000000885e8>] dump_backtrace+0x0/0x128 [<ffff800000088734>] show_stack+0x24/0x30 [<ffff80000079a7c4>] dump_stack+0x80/0xa0 [<ffff8000000bd324>] ___might_sleep+0x18c/0x1a0 [<ffff8000007a20ac>] __rt_spin_lock+0x2c/0x40 [<ffff8000007a2268>] rt_read_lock+0x40/0x58 [<ffff800000085328>] single_step_handler+0x38/0xd8 [<ffff800000082368>] do_debug_exception+0x58/0xb8 Exception stack(0xffff80834a1e7c80 to 0xffff80834a1e7da0)
7c80: ffffff9c ffffffff 92c23ba0 0000ffff 4a1e7e40 ffff8083 001bfcc4 ffff8000 7ca0: f2000400 00000000 00000000 00000000 4a1e7d80 ffff8083 0049501c ffff8000 7cc0: 00005402 00000000 00aaa210 ffff8000 4a1e7ea0 ffff8083 000833f4 ffff8000 7ce0: ffffff9c ffffffff 92c23ba0 0000ffff 4a1e7ea0 ffff8083 001bfcc0 ffff8000 7d00: 4a0fc400 ffff8083 00005402 00000000 4a1e7d40 ffff8083 00490324 ffff8000 7d20: ffffff9c 00000000 92c23ba0 0000ffff 000a0000 00000000 00000000 00000000 7d40: 00000008 00000000 00080000 00000000 92c23b8b 0000ffff 92c23b8e 0000ffff 7d60: 00000038 00000000 00001cb2 00000000 00000005 00000000 92d7b498 0000ffff 7d80: 01010101 01010101 92be9000 0000ffff 00000000 00000000 00000030 00000000 [<ffff8000000833f4>] el1_dbg+0x18/0x6c
This issue is similar with 62c6c61("arm64: replace read_lock to rcu lock in call_break_hook"), but comes to single_step_handler.
This also solves kgdbts boot test silent hang issue on 4.4 -rt kernel.
--- arch/arm64/kernel/debug-monitors.c | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-)
arch/arm64/kernel/debug-monitors.c +11 -10
@@ -186,20 +186,21 @@ static void clear_regs_spsr_ss(struct pt/* EL1 Single Step Handler hooks */ static LIST_HEAD (step_hook); -static DEFINE_RWLOCK (step_hook_lock); +static DEFINE_SPINLOCK (step_hook_lock);void register_step_hook (struct step_hook *hook) { -write_lock (&step_hook_lock); -list_add (&hook->node, &step_hook); -write_unlock (&step_hook_lock); +spin_lock (&step_hook_lock); +list_add_rcu (&hook->node, &step_hook); +spin_unlock (&step_hook_lock); }void unregister_step_hook (struct step_hook *hook) { -write_lock (&step_hook_lock); -list_del (&hook->node); -write_unlock (&step_hook_lock); +spin_lock (&step_hook_lock); +list_del_rcu (&hook->node); +spin_unlock (&step_hook_lock); +synchronize_rcu (); }/*
@@ -213,15 +214,15 @@ static int call_step_hook(struct pt_regsstruct step_hook *hook;int retval =DBG_HOOK_ERROR ; -read_lock (&step_hook_lock); +rcu_read_lock (); -list_for_each_entry (hook, &step_hook, node) { +list_for_each_entry_rcu (hook, &step_hook, node) { retval = hook->fn (regs, esr);if (retval ==DBG_HOOK_HANDLED )break ; } -read_unlock (&step_hook_lock); +rcu_read_unlock ();return retval; }
Greg Kroah-Hartman
maintainerPATCH 115/124 mmc: sdhci: Fix regression setting power on Trats2 board
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <[email protected]>
commit 1dceb0415aa0c6bc11dacdab47c9ef83a3604166 upstream.
Several commits relating to setting power have been introducing problems by putting driver-specific rules into generic SDHCI code.
Krzysztof Kozlowski reported that after commit 918f4cbd4340 ("mmc:
sdhci: restore behavior when setting VDD via external regulator") on Trats2 board there are warnings for invalid VDD value (2.8V):
[ 3.119656] ------------[ cut here ]------------ [ 3.119666] WARNING: CPU: 3 PID: 90 at ../drivers/mmc/host/sdhci.c:1234 sdhci_do_set_ios+0x4cc/0x5e0 [ 3.119669] mmc0: Invalid vdd 0x10 [ 3.119673] Modules linked in: [ 3.119679] CPU: 3 PID: 90 Comm: kworker/3:1 Tainted: G W 4.5.0-next-20160324 #23 [ 3.119681] Hardware name: SAMSUNG EXYNOS (Flattened Device Tree) [ 3.119690] Workqueue: events_freezable mmc_rescan [ 3.119708] [<c010e0ac>] (unwind_backtrace) from [<c010ae10>] (show_stack+0x10/0x14) [ 3.119719] [<c010ae10>] (show_stack) from [<c0323260>] (dump_stack+0x88/0x9c) [ 3.119728] [<c0323260>] (dump_stack) from [<c011b754>] (__warn+0xe8/0x100) [ 3.119734] [<c011b754>] (__warn) from [<c011b7a4>] (warn_slowpath_fmt+0x38/0x48) [ 3.119740] [<c011b7a4>] (warn_slowpath_fmt) from [<c0527d28>] (sdhci_do_set_ios+0x4cc/0x5e0) [ 3.119748] [<c0527d28>] (sdhci_do_set_ios) from [<c0528018>] (sdhci_runtime_resume_host+0x60/0x114) [ 3.119758] [<c0528018>] (sdhci_runtime_resume_host) from [<c0402570>] (__rpm_callback+0x2c/0x60) [ 3.119767] [<c0402570>] (__rpm_callback) from [<c04025c4>] (rpm_callback+0x20/0x80) [ 3.119773] [<c04025c4>] (rpm_callback) from [<c04034b8>] (rpm_resume+0x36c/0x558) [ 3.119780] [<c04034b8>] (rpm_resume) from [<c04036f0>] (__pm_runtime_resume+0x4c/0x64) [ 3.119788] [<c04036f0>] (__pm_runtime_resume) from [<c0512728>] (__mmc_claim_host+0x170/0x1b0) [ 3.119795] [<c0512728>] (__mmc_claim_host) from [<c0514e2c>] (mmc_rescan+0x54/0x348) [ 3.119807] [<c0514e2c>] (mmc_rescan) from [<c0130dac>] (process_one_work+0x120/0x3f4) [ 3.119815] [<c0130dac>] (process_one_work) from [<c01310b8>] (worker_thread+0x38/0x554) [ 3.119823] [<c01310b8>] (worker_thread) from [<c01365a4>] (kthread+0xdc/0xf4) [ 3.119831] [<c01365a4>] (kthread) from [<c0107878>] (ret_from_fork+0x14/0x3c) [ 3.119834] ---[ end trace a22d652aa3276886 ]---
Fix by adding a 'set_power' callback and restoring the default behaviour prior to commit 918f4cbd4340 ("mmc: sdhci: restore behavior when setting VDD via external regulator"). The desired behaviour of that commit is gotten by having sdhci-pxav3 provide its own set_power callback.
--- drivers/mmc/host/sdhci-pxav3.c | 22 ++++++++++++++++++++++ drivers/mmc/host/sdhci.c | 39 ++++++++++++++++++++++++++++++--------- drivers/mmc/host/sdhci.h | 4 ++++ 3 files changed, 56 insertions(+), 9 deletions(-)
drivers/mmc/host/sdhci-pxav3.c +22 -0
@@ -309,8 +309,30 @@ static void pxav3_set_uhs_signaling(stru __func__, uhs, ctrl_2); } +static void pxav3_set_power (struct sdhci_host *host,unsigned char mode, +unsigned short vdd) +{ +struct mmc_host *mmc = host->mmc; +u8 pwr = host->pwr; + +sdhci_set_power (host, mode, vdd); + +if (host->pwr == pwr) +return ; + +if (host->pwr ==0 ) + vdd =0 ; + +if (!IS_ERR (mmc->supply.vmmc)) { +spin_unlock_irq (&host->lock); +mmc_regulator_set_ocr (mmc, mmc->supply.vmmc, vdd); +spin_lock_irq (&host->lock); + } +} +static const struct sdhci_ops pxav3_sdhci_ops = { .set_clock = sdhci_set_clock, + .set_power = pxav3_set_power, .platform_send_init_74_clocks = pxav3_gen_init_74_clocks, .get_max_clock = sdhci_pltfm_clk_get_max_clock, .set_bus_width = sdhci_set_bus_width,
drivers/mmc/host/sdhci.c +30 -9
@@ -1250,10 +1250,24 @@ clock_set: }EXPORT_SYMBOL_GPL (sdhci_set_clock); -static void sdhci_set_power (struct sdhci_host *host,unsigned char mode, -unsigned short vdd) +static void sdhci_set_power_reg (struct sdhci_host *host,unsigned char mode, +unsigned short vdd) {struct mmc_host *mmc = host->mmc; + +spin_unlock_irq (&host->lock); +mmc_regulator_set_ocr (mmc, mmc->supply.vmmc, vdd); +spin_lock_irq (&host->lock); + +if (mode !=MMC_POWER_OFF ) +sdhci_writeb (host,SDHCI_POWER_ON ,SDHCI_POWER_CONTROL ); +else +sdhci_writeb (host,0 ,SDHCI_POWER_CONTROL ); +} + +void sdhci_set_power (struct sdhci_host *host,unsigned char mode, +unsigned short vdd) +{u8 pwr =0 ;if (mode !=MMC_POWER_OFF ) {
@@ -1285,7 +1299,6 @@ static void sdhci_set_power(struct sdhcisdhci_writeb (host,0 ,SDHCI_POWER_CONTROL );if (host->quirks2 &SDHCI_QUIRK2_CARD_ON_NEEDS_BUS_ON )sdhci_runtime_pm_bus_off (host); - vdd =0 ; }else {/* * Spec says that we should clear the power reg before setting
@@ -1316,12 +1329,20 @@ static void sdhci_set_power(struct sdhciif (host->quirks &SDHCI_QUIRK_DELAY_AFTER_POWER )mdelay (10 ); } +} +EXPORT_SYMBOL_GPL (sdhci_set_power); -if (!IS_ERR (mmc->supply.vmmc)) { -spin_unlock_irq (&host->lock); -mmc_regulator_set_ocr (mmc, mmc->supply.vmmc, vdd); -spin_lock_irq (&host->lock); - } +static void __sdhci_set_power (struct sdhci_host *host,unsigned char mode, +unsigned short vdd) +{ +struct mmc_host *mmc = host->mmc; + +if (host->ops->set_power) + host->ops->set_power (host, mode, vdd); +else if (!IS_ERR (mmc->supply.vmmc)) +sdhci_set_power_reg (host, mode, vdd); +else +sdhci_set_power (host, mode, vdd); }/*****************************************************************************\
@@ -1471,7 +1492,7 @@ static void sdhci_do_set_ios(struct sdhc } } -sdhci_set_power (host, ios->power_mode, ios->vdd); +__sdhci_set_power (host, ios->power_mode, ios->vdd);if (host->ops->platform_send_init_74_clocks) host->ops->platform_send_init_74_clocks (host, ios->power_mode);
drivers/mmc/host/sdhci.h +4 -0
@@ -529,6 +529,8 @@ struct sdhci_ops {#endif void (*set_clock)(struct sdhci_host *host,unsigned int clock); +void (*set_power)(struct sdhci_host *host,unsigned char mode, +unsigned short vdd);int (*enable_dma)(struct sdhci_host *host);unsigned int (*get_max_clock)(struct sdhci_host *host);
@@ -660,6 +662,8 @@ static inline bool sdhci_sdio_irq_enable }void sdhci_set_clock (struct sdhci_host *host,unsigned int clock); +void sdhci_set_power (struct sdhci_host *host,unsigned char mode, +unsigned short vdd);void sdhci_set_bus_width (struct sdhci_host *host,int width);void sdhci_reset (struct sdhci_host *host,u8 mask);void sdhci_set_uhs_signaling (struct sdhci_host *host,unsigned timing);
Greg Kroah-Hartman
maintainerPATCH 116/124 mmc: sdhci-pci: Add support and PCI IDs for more Broxton host controllers
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <[email protected]>
commit 01d6b2a40a0fa73c90e05b1033f181a51fec9292 upstream.
Add support and PCI IDs for more Broxton host controllers
Other BXT IDs were added in v4.4 so cc'ing stable. This patch is dependent on commit 163cbe31e516 ("mmc: sdhci-pci: Fix card detect race for Intel BXT/APL") but that is already in stable since v4.4.4.
--- drivers/mmc/host/sdhci-pci-core.c | 25 +++++++++++++++++++++++++ drivers/mmc/host/sdhci-pci.h | 3 +++ 2 files changed, 28 insertions(+)
drivers/mmc/host/sdhci-pci-core.c +25 -0
@@ -390,6 +390,7 @@ static int byt_sd_probe_slot(struct sdhc slot->cd_idx =0 ; slot->cd_override_level = true;if (slot->chip->pdev->device ==PCI_DEVICE_ID_INTEL_BXT_SD || + slot->chip->pdev->device ==PCI_DEVICE_ID_INTEL_BXTM_SD || slot->chip->pdev->device ==PCI_DEVICE_ID_INTEL_APL_SD ) slot->host->mmc_host_ops.get_cd = bxt_get_cd;
@@ -1169,6 +1170,30 @@ static const struct pci_device_id pci_id .subvendor = PCI_ANY_ID, .subdevice = PCI_ANY_ID, .driver_data = (kernel_ulong_t)&sdhci_intel_byt_sd, + }, + + { + .vendor = PCI_VENDOR_ID_INTEL, + .device = PCI_DEVICE_ID_INTEL_BXTM_EMMC, + .subvendor = PCI_ANY_ID, + .subdevice = PCI_ANY_ID, + .driver_data = (kernel_ulong_t)&sdhci_intel_byt_emmc, + }, + + { + .vendor = PCI_VENDOR_ID_INTEL, + .device = PCI_DEVICE_ID_INTEL_BXTM_SDIO, + .subvendor = PCI_ANY_ID, + .subdevice = PCI_ANY_ID, + .driver_data = (kernel_ulong_t)&sdhci_intel_byt_sdio, + }, + + { + .vendor = PCI_VENDOR_ID_INTEL, + .device = PCI_DEVICE_ID_INTEL_BXTM_SD, + .subvendor = PCI_ANY_ID, + .subdevice = PCI_ANY_ID, + .driver_data = (kernel_ulong_t)&sdhci_intel_byt_sd, }, {
drivers/mmc/host/sdhci-pci.h +3 -0
@@ -28,6 +28,9 @@#define PCI_DEVICE_ID_INTEL_BXT_SD 0x0aca#define PCI_DEVICE_ID_INTEL_BXT_EMMC 0x0acc#define PCI_DEVICE_ID_INTEL_BXT_SDIO 0x0ad0 +#define PCI_DEVICE_ID_INTEL_BXTM_SD 0x1aca +#define PCI_DEVICE_ID_INTEL_BXTM_EMMC 0x1acc +#define PCI_DEVICE_ID_INTEL_BXTM_SDIO 0x1ad0#define PCI_DEVICE_ID_INTEL_APL_SD 0x5aca#define PCI_DEVICE_ID_INTEL_APL_EMMC 0x5acc#define PCI_DEVICE_ID_INTEL_APL_SDIO 0x5ad0
Greg Kroah-Hartman
maintainerPATCH 117/124 ALSA: hda - Fix regression of monitor_present flag in eld proc file
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyungwon Hwang <[email protected]>
commit 023d8218ec0dfc30e11d4ec54f640e8f127d1fbe upstream.
The commit [bd48128539ab: ALSA: hda - Fix forgotten HDMI monitor_present update] covered the missing update of monitor_present flag, but this caused a regression for devices without the i915 eld notifier. Since the old code supposed that pin_eld->monitor_present was updated by the caller side, the hdmi_present_sense_via_verbs() doesn't update the temporary eld->monitor_present but only pin_eld->monitor_present, which is now overridden in update_eld().
The fix is to update pin_eld->monitor_present as well before calling update_eld().
Note that this may still leave monitor_present flag in an inconsistent state when the driver repolls, but this is at least the old behavior. More proper fix will follow in the later patch.
--- sound/pci/hda/patch_hdmi.c | 2 ++ 1 file changed, 2 insertions(+)
sound/pci/hda/patch_hdmi.c +2 -0
@@ -1623,6 +1623,8 @@ static bool hdmi_present_sense_via_verbsmutex_lock (&per_pin->lock); pin_eld->monitor_present = !!(present &AC_PINSENSE_PRESENCE ); + eld->monitor_present = pin_eld->monitor_present; +if (pin_eld->monitor_present) eld->eld_valid = !!(present &AC_PINSENSE_ELDV );else
Greg Kroah-Hartman
maintainerPATCH 118/124 ALSA: hda/realtek - Enable the ALC292 dock fixup on the Thinkpad T460s
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <[email protected]>
commit c636b95ec5980345674ad7960a3c67135a84b687 upstream.
The Lenovo Thinkpad T460s requires the alc_fixup_tpt440_dock as well in order to get working sound output on the docking stations headphone jack.
Patch tested on a Thinkpad T460s (20F9CT01WW) using a ThinkPad Ultradock on kernel 4.4.6.
--- sound/pci/hda/patch_realtek.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
sound/pci/hda/patch_realtek.c +9 -1
@@ -4760,6 +4760,7 @@ enum {ALC225_FIXUP_DELL1_MIC_NO_PRESENCE ,ALC280_FIXUP_HP_HEADSET_MIC ,ALC221_FIXUP_HP_FRONT_MIC , + ALC292_FIXUP_TPT460, }; static const struct hda_fixup alc269_fixups[] = {
@@ -5409,6 +5410,12 @@ static const struct hda_fixup alc269_fix { } }, }, + [ALC292_FIXUP_TPT460 ] = { + .type =HDA_FIXUP_FUNC , + .v.func = alc_fixup_tpt440_dock, + .chained = true, + .chain_id =ALC293_FIXUP_LENOVO_SPK_NOISE , + }, };static const struct snd_pci_quirk alc269_fixup_tbl[] = {
@@ -5563,7 +5570,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x17aa ,0x2218 ,"Thinkpad X1 Carbon 2nd" ,ALC292_FIXUP_TPT440_DOCK ),SND_PCI_QUIRK (0x17aa ,0x2223 ,"ThinkPad T550" ,ALC292_FIXUP_TPT440_DOCK ),SND_PCI_QUIRK (0x17aa ,0x2226 ,"ThinkPad X250" ,ALC292_FIXUP_TPT440_DOCK ), -SND_PCI_QUIRK (0x17aa ,0x2233 ,"Thinkpad" ,ALC293_FIXUP_LENOVO_SPK_NOISE ), +SND_PCI_QUIRK (0x17aa ,0x2233 ,"Thinkpad" ,ALC292_FIXUP_TPT460 ),SND_PCI_QUIRK (0x17aa ,0x30bb ,"ThinkCentre AIO" ,ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY ),SND_PCI_QUIRK (0x17aa ,0x30e2 ,"ThinkCentre AIO" ,ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY ), SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI),
@@ -5658,6 +5665,7 @@ static const struct hda_model_fixup alc2 {.id = ALC283_FIXUP_SENSE_COMBO_JACK, .name = "alc283-sense-combo"}, {.id = ALC292_FIXUP_TPT440_DOCK, .name = "tpt440-dock"}, {.id = ALC292_FIXUP_TPT440, .name = "tpt440"}, + {.id = ALC292_FIXUP_TPT460, .name = "tpt460"}, {} };#define ALC225_STANDARD_PINS \
Greg Kroah-Hartman
maintainerPATCH 119/124 ALSA: usb-audio: Add a sample rate quirk for Phoenix Audio TMX320
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit f03b24a851d32ca85dacab01785b24a7ee717d37 upstream.
Phoenix Audio TMX320 gives the similar error when the sample rate is asked:
usb 2-1.3: 2:1: cannot get freq at ep 0x85
usb 2-1.3: 1:1: cannot get freq at ep 0x2
....
Add the corresponding USB-device ID (1de7:0014) to snd_usb_get_sample_rate_quirk() list.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=110221
--- sound/usb/quirks.c | 1 + 1 file changed, 1 insertion(+)
sound/usb/quirks.c +1 -0
@@ -1138,6 +1138,7 @@ bool snd_usb_get_sample_rate_quirk(struccase USB_ID (0x047F ,0xAA05 ):/* Plantronics DA45 */ case USB_ID (0x04D8 ,0xFEEA ):/* Benchmark DAC1 Pre */ case USB_ID (0x074D ,0x3553 ):/* Outlaw RR2150 (Micronas UAC3553B) */ +case USB_ID (0x1de7 ,0x0014 ):/* Phoenix Audio TMX320 */ case USB_ID (0x21B4 ,0x0081 ):/* AudioQuest DragonFly */ return true; }
Greg Kroah-Hartman
maintainerPATCH 120/124 ALSA: usb-audio: Add a quirk for Plantronics BT300
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dennis Kadioglu <[email protected]>
commit b4203ff5464da00b7812e7b480192745b0d66bbf upstream.
Plantronics BT300 does not support reading the sample rate which leads to many lines of "cannot get freq at ep 0x1". This patch adds the USB ID of the BT300 to quirks.c and avoids those error messages.
--- sound/usb/quirks.c | 1 + 1 file changed, 1 insertion(+)
sound/usb/quirks.c +1 -0
@@ -1135,6 +1135,7 @@ bool snd_usb_get_sample_rate_quirk(struccase USB_ID (0x045E ,0x076F ):/* MS Lifecam HD-6000 */ case USB_ID (0x045E ,0x0772 ):/* MS Lifecam Studio */ case USB_ID (0x045E ,0x0779 ):/* MS Lifecam HD-3000 */ +case USB_ID (0x047F ,0x0415 ):/* Plantronics BT-300 */ case USB_ID (0x047F ,0xAA05 ):/* Plantronics DA45 */ case USB_ID (0x04D8 ,0xFEEA ):/* Benchmark DAC1 Pre */ case USB_ID (0x074D ,0x3553 ):/* Outlaw RR2150 (Micronas UAC3553B) */
Greg Kroah-Hartman
maintainerPATCH 121/124 ALSA: usb-audio: Skip volume controls triggers hangup on Dell USB Dock
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kailang Yang <[email protected]>
commit adcdd0d5a1cb779f6d455ae70882c19c527627a8 upstream.
This is Dell usb dock audio workaround. It was fixed the master volume keep lower.
[Some background: the patch essentially skips the controls of a couple
of FU volumes. Although the firmware exposes the dB and the value information via the usb descriptor, changing the values (we set the min volume as default) screws up the device. Although this has been fixed in the newer firmware, the devices are shipped with the old firmware, thus we need the workaround in the driver side. -- tiwai]
--- sound/usb/mixer_maps.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
sound/usb/mixer_maps.c +14 -0
@@ -349,6 +349,16 @@ static struct usbmix_name_map bose_compa };/* +* Dell usb dock with ALC4020 codec had a firmware problem where it got +* screwed up when zero volume is passed; just skip it as a workaround +*/ +static const struct usbmix_name_map dell_alc4020_map[] = { + {16 ,NULL }, + {19 ,NULL }, + {0 } +}; + +/* * Control map entries */
@@ -431,6 +441,10 @@ static struct usbmix_ctl_map usbmix_ctl_ .map = aureon_51_2_map, }, { + .id = USB_ID(0x0bda, 0x4014), + .map = dell_alc4020_map, + }, + { .id = USB_ID(0x0dba, 0x1000), .map = mbox1_map, },
Greg Kroah-Hartman
maintainerPATCH 122/124 HID: wacom: fix Bamboo ONE oops
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Tissoires <[email protected]>
commit 580549ef6b3e3fb3b958de490ca99f43a089a2cf upstream.
Looks like recent changes in the Wacom driver made the Bamboo ONE crashes. The tablet behaves as if it was a regular Bamboo device with pen, touch and pad, but there is no physical pad connected to it.
The weird part is that the pad is still sending events and given that there is no input node connected to it, we get anull pointer exception.
--- drivers/hid/wacom_wac.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/hid/wacom_wac.c +11 -0
@@ -2409,6 +2409,17 @@ void wacom_setup_device_quirks(struct wa }/* +* Hack for the Bamboo One: +* the device presents a PAD/Touch interface as most Bamboos and even +* sends ghosts PAD data on it. However, later, we must disable this +* ghost interface, and we can not detect it unless we set it here +* to WACOM_DEVICETYPE_PAD or WACOM_DEVICETYPE_TOUCH. +*/ +if (features->type ==BAMBOO_PEN && + features->pktlen ==WACOM_PKGLEN_BBTOUCH3 ) + features->device_type |=WACOM_DEVICETYPE_PAD ; + +/* * Raw Wacom-mode pen and touch events both come from interface * 0, whose HID descriptor has an application usage of 0xFF0D * (i.e., WACOM_VENDORDEFINED_PEN). We route pen packets back
Greg Kroah-Hartman
maintainerPATCH 123/124 HID: usbhid: fix inconsistent reset/resume/reset-resume behavior
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <[email protected]>
commit 972e6a993f278b416a8ee3ec65475724fc36feb2 upstream.
The usbhid driver has inconsistently duplicated code in its post-reset, resume, and reset-resume pathways.
reset-resume doesn't check HID_STARTED before trying to restart the I/O queues.
resume fails to clear the HID_SUSPENDED flag if HID_STARTED isn't set.
resume calls usbhid_restart_queues() with usbhid->lock held and the others call it without holding the lock.
The first item in particular causes a problem following a reset-resume if the driver hasn't started up its I/O. URB submission fails because usbhid->urbin is NULL, and this triggers an unending reset-retry loop.
This patch fixes the problem by creating a new subroutine, hid_restart_io(), to carry out all the common activities. It also adds some checks that were missing in the original code:
After a reset, there's no need to clear any halted endpoints.
After a resume, if a reset is pending there's no need to restart any I/O until the reset is finished.
After a resume, if the interrupt-IN endpoint is halted there's no need to submit the input URB until the halt has been cleared.
--- drivers/hid/usbhid/hid-core.c | 73 +++++++++++++++++++++--------------------- 1 file changed, 37 insertions(+), 36 deletions(-)
drivers/hid/usbhid/hid-core.c +37 -36
@@ -951,14 +951,6 @@ static int usbhid_output_report(struct hreturn ret; } -static void usbhid_restart_queues (struct usbhid_device *usbhid) -{ -if (usbhid->urbout && !test_bit (HID_OUT_RUNNING , &usbhid->iofl)) -usbhid_restart_out_queue (usbhid); -if (!test_bit (HID_CTRL_RUNNING , &usbhid->iofl)) -usbhid_restart_ctrl_queue (usbhid); -} -static void hid_free_buffers (struct usb_device *dev,struct hid_device *hid) {struct usbhid_device *usbhid = hid->driver_data;
@@ -1404,6 +1396,37 @@ static void hid_cease_io(struct usbhid_dusb_kill_urb (usbhid->urbout); } +static void hid_restart_io (struct hid_device *hid) +{ +struct usbhid_device *usbhid = hid->driver_data; +int clear_halt =test_bit (HID_CLEAR_HALT , &usbhid->iofl); +int reset_pending =test_bit (HID_RESET_PENDING , &usbhid->iofl); + +spin_lock_irq (&usbhid->lock); +clear_bit (HID_SUSPENDED , &usbhid->iofl); +usbhid_mark_busy (usbhid); + +if (clear_halt || reset_pending) +schedule_work (&usbhid->reset_work); + usbhid->retry_delay =0 ; +spin_unlock_irq (&usbhid->lock); + +if (reset_pending || !test_bit (HID_STARTED , &usbhid->iofl)) +return ; + +if (!clear_halt) { +if (hid_start_in (hid) <0 ) +hid_io_error (hid); + } + +spin_lock_irq (&usbhid->lock); +if (usbhid->urbout && !test_bit (HID_OUT_RUNNING , &usbhid->iofl)) +usbhid_restart_out_queue (usbhid); +if (!test_bit (HID_CTRL_RUNNING , &usbhid->iofl)) +usbhid_restart_ctrl_queue (usbhid); +spin_unlock_irq (&usbhid->lock); +} +/* Treat USB reset pretty much the same as suspend/resume */ static int hid_pre_reset (struct usb_interface *intf) {
@@ -1453,14 +1476,14 @@ static int hid_post_reset(struct usb_intreturn 1 ; } +/* No need to do another reset or clear a halted endpoint */ spin_lock_irq (&usbhid->lock);clear_bit (HID_RESET_PENDING , &usbhid->iofl); +clear_bit (HID_CLEAR_HALT , &usbhid->iofl);spin_unlock_irq (&usbhid->lock);hid_set_idle (dev, intf->cur_altsetting->desc.bInterfaceNumber,0 ,0 ); - status =hid_start_in (hid); -if (status <0 ) -hid_io_error (hid); -usbhid_restart_queues (usbhid); + +hid_restart_io (hid);return 0 ; }
@@ -1483,25 +1506,9 @@ void usbhid_put_power(struct hid_device#ifdef CONFIG_PM static int hid_resume_common (struct hid_device *hid,bool driver_suspended) { -struct usbhid_device *usbhid = hid->driver_data; -int status; - -spin_lock_irq (&usbhid->lock); -clear_bit (HID_SUSPENDED , &usbhid->iofl); -usbhid_mark_busy (usbhid); - -if (test_bit (HID_CLEAR_HALT , &usbhid->iofl) || -test_bit (HID_RESET_PENDING , &usbhid->iofl)) -schedule_work (&usbhid->reset_work); - usbhid->retry_delay =0 ; - -usbhid_restart_queues (usbhid); -spin_unlock_irq (&usbhid->lock); - - status =hid_start_in (hid); -if (status <0 ) -hid_io_error (hid); +int status =0 ; +hid_restart_io (hid);if (driver_suspended && hid->driver && hid->driver->resume) status = hid->driver->resume (hid);return status;
@@ -1570,12 +1577,8 @@ static int hid_suspend(struct usb_interfstatic int hid_resume (struct usb_interface *intf) {struct hid_device *hid =usb_get_intfdata (intf); -struct usbhid_device *usbhid = hid->driver_data;int status; -if (!test_bit (HID_STARTED , &usbhid->iofl)) -return 0 ; - status =hid_resume_common (hid, true);dev_dbg (&intf->dev,"resume status %d\n" , status);return 0 ;
@@ -1584,10 +1587,8 @@ static int hid_resume(struct usb_interfastatic int hid_reset_resume (struct usb_interface *intf) {struct hid_device *hid =usb_get_intfdata (intf); -struct usbhid_device *usbhid = hid->driver_data;int status; -clear_bit (HID_SUSPENDED , &usbhid->iofl); status =hid_post_reset (intf);if (status >=0 && hid->driver && hid->driver->reset_resume) {int ret = hid->driver->reset_resume (hid);
Greg Kroah-Hartman
maintainerPATCH 124/124 staging: android: ion: Set the length of the DMA sg entries in buffer
In reply to Greg Kroah-Hartman4.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liviu Dudau <[email protected]>
commit 70bc916b2c80913753fb188d4daee50a64d21ba0 upstream.
ion_buffer_create() will allocate a buffer and then create a DMA mapping for it, but it forgot to set the length of the page entries.
--- drivers/staging/android/ion/ion.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/staging/android/ion/ion.c +3 -1
@@ -251,8 +251,10 @@ static struct ion_buffer *ion_buffer_cre* memory coming from the heaps is ready for dma, ie if it has a * cached mapping that mapping has been invalidated */ -for_each_sg (buffer->sg_table->sgl, sg, buffer->sg_table->nents, i) +for_each_sg (buffer->sg_table->sgl, sg, buffer->sg_table->nents, i) {sg_dma_address (sg) =sg_phys (sg); +sg_dma_len (sg) = sg->length; + }mutex_lock (&dev->buffer_lock);ion_buffer_add (dev, buffer);mutex_unlock (&dev->buffer_lock);
Quoted 5 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.5.2 release. There are 124 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Quoted 7 lines
Responses should be made by Wed Apr 20 02:25:31 UTC 2016. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.5.2-rc1.gzand the diffstat can be found below.
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
Greg Kroah-Hartman
maintainerQuoted 9 lines · Shuah Khan
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.5.2 release. There are 124 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed Apr 20 02:25:31 UTC 2016. Anything received after that time might be too late.
Quoted 6 lines
Quoted 4 lines
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.5.2-rc1.gzand the diffstat can be found below.
Compiled and booted on my test system. No dmesg regressions.
Thanks for testing these and letting me know.
greg k-h
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.5.2 release. There are 124 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed Apr 20 02:25:31 UTC 2016. Anything received after that time might be too late.
Build results:
total: 147 pass: 147 fail: 0 Qemu test results: total: 104 pass: 104 fail: 0
Details are available at http://kerneltests.org/builders.
Guenter
Greg Kroah-Hartman
maintainerQuoted 6 lines · Guenter Roeck
Quoted 5 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.5.2 release. There are 124 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Quoted 7 lines
Quoted 3 lines
Responses should be made by Wed Apr 20 02:25:31 UTC 2016. Anything received after that time might be too late.
Build results:
total: 147 pass: 147 fail: 0 Qemu test results: total: 104 pass: 104 fail: 0
Thanks for testing all of these and letting me know.
greg k-h
A message that is not in the archive (sent off-list or not yet received): [email protected]
Greg Kroah-Hartman
maintainerQuoted 11 lines · kernelci.org bot
stable-queue boot: 25 boots: 0 failed, 25 passed (v4.5.1-124-ga7f91925a8c9)
Full Boot Summary: https://kernelci.org/boot/all/job/stable-queue/kernel/v4.5.1-124-ga7f91925a8c9/
Full Build Summary: https://kernelci.org/build/stable-queue/kernel/v4.5.1-124-ga7f91925a8c9/Tree: stable-queue
Branch: local/linux-4.5.y.queue
Git Describe: v4.5.1-124-ga7f91925a8c9
Git Commit:a7f91925a8c9fd192ccc6dfcb91d5468d318b264Git URL:git://server.roeck-us.net/git/linux-stable.git
Tested: 6 unique boards, 3 SoC families, 8 builds out of 141
Thanks for this, and the other testing reports.
greg k-h