4.9.1-stable review
Subsystems (2)
Greg Kroah-Hartman
maintainercover 4.9.1-stable review
This is the start of the stable review cycle for the 4.9.1 release. There are 83 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri Jan 6 20:04:25 UTC 2017. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.1-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.9.1-rc1
Adam Borowski <[email protected]>
x86/kbuild: enable modversions for symbols exported from asm
Adam Borowski <[email protected]>
builddeb: fix cross-building to arm64 producing host-arch debs
Eric Sandeen <[email protected]>
xfs: set AGI buffer type in xlog_recover_clear_agi_bucket
Eric Sandeen <[email protected]>
xfs: fix up xfs_swap_extent_forks inline extent handling
Julien Grall <[email protected]>
arm/xen: Use alloc_percpu rather than __alloc_percpu
Boris Ostrovsky <[email protected]>
xen/gntdev: Use VM_MIXEDMAP instead of VM_IO to avoid NUMA balancing
Jason Gunthorpe <[email protected]>
tpm xen: Remove bogus tpm_chip_unregister
Douglas Anderson <[email protected]>
kernel/debug/debug_core.c: more properly delay for secondary CPUs
Christian Lamparter <[email protected]>
watchdog: qcom: fix kernel panic due to external abort on non-linefetch
Alexander Usyskin <[email protected]>
watchdog: mei_wdt: request stop on reboot to prevent false positive event
Konstantin Khlebnikov <[email protected]>
kernel/watchdog: use nmi registers snapshot in hardlockup handler
Pavel Shilovsky <[email protected]>
CIFS: Fix a possible memory corruption in push locks
Pavel Shilovsky <[email protected]>
CIFS: Decrease verbosity of ioctl call
Pavel Shilovsky <[email protected]>
CIFS: Fix a possible double locking of mutex during reconnect
Pavel Shilovsky <[email protected]>
CIFS: Fix missing nls unload in smb2_reconnect()
Pavel Shilovsky <[email protected]>
CIFS: Fix a possible memory corruption during reconnect
Andy Lutomirski <[email protected]>
cifs: Fix smbencrypt() to stop pointing a scatterlist at the stack
Takashi Iwai <[email protected]>
ASoC: intel: Fix crash at suspend/resume without card registration
Benjamin Marzinski <[email protected]>
dm space map metadata: fix 'struct sm_metadata' leak on failed create
Heinz Mauelshagen <[email protected]>
dm raid: fix discard support regression
Bart Van Assche <[email protected]>
dm rq: fix a race condition in rq_completed()
Ondrej Kozina <[email protected]>
dm crypt: mark key as invalid until properly loaded
Wei Yongjun <[email protected]>
dm flakey: return -EINVAL on interval bounds error in flakey_ctr()
Bart Van Assche <[email protected]>
dm table: an 'all_blk_mq' table must be loaded for a blk-mq DM device
Mike Snitzer <[email protected]>
dm table: fix 'all_blk_mq' inconsistency when an empty table is loaded
Bart Van Assche <[email protected]>
blk-mq: Do not invoke .queue_rq() for a stopped queue
Viresh Kumar <[email protected]>
PM / OPP: Don't use OPP structure outside of rcu protected section
Stephen Boyd <[email protected]>
PM / OPP: Pass opp_table to dev_pm_opp_put_regulator()
Felipe Balbi <[email protected]>
usb: gadget: composite: always set ep->mult to a sensible value
Mel Gorman <[email protected]>
mm, page_alloc: keep pcp count and list contents in sync if struct page is corrupted
Shaohua Li <[email protected]>
mm/vmscan.c: set correct defer count for shrinker
Solganik Alexander <[email protected]>
nvmet: Fix possible infinite loop triggered on hot namespace removal
Omar Sandoval <[email protected]>
loop: return proper error from loop_queue_rq()
Jaegeuk Kim <[email protected]>
f2fs: fix to determine start_cp_addr by sbi->cur_cp_pack
Jaegeuk Kim <[email protected]>
f2fs: fix overflow due to condition check order
Nicolai Stange <[email protected]>
f2fs: set ->owner for debugfs status file's file_operations
Jaegeuk Kim <[email protected]>
Revert "f2fs: use percpu_counter for # of dirty pages in inode"
Sergey Karamov <[email protected]>
ext4: do not perform data journaling when data is encrypted
Dan Carpenter <[email protected]>
ext4: return -ENOMEM instead of success
Darrick J. Wong <[email protected]>
ext4: reject inodes with negative size
Theodore Ts'o <[email protected]>
ext4: add sanity checking to count_overhead()
Theodore Ts'o <[email protected]>
ext4: fix in-superblock mount options processing
Theodore Ts'o <[email protected]>
ext4: use more strict checks for inodes_per_block on mount
Chandan Rajendra <[email protected]>
ext4: fix stack memory corruption with 64k block size
Chandan Rajendra <[email protected]>
ext4: fix mballoc breakage with 64k block size
Theodore Ts'o <[email protected]>
ext4: don't lock buffer in ext4_commit_super if holding spinlock
Alex Porosanu <[email protected]>
crypto: caam - fix AEAD givenc descriptors
Eric W. Biederman <[email protected]>
ptrace: Don't allow accessing an undumpable mm
Eric W. Biederman <[email protected]>
ptrace: Capture the ptracer's creds not PT_PTRACE_CAP
Linus Torvalds <[email protected]>
vfs,mm: fix return value of read() at s_maxbytes
Eric W. Biederman <[email protected]>
mm: Add a user_ns owner to mm_struct and fix ptrace permission checks
NeilBrown <[email protected]>
block_dev: don't test bdev->bd_contains when it is not stable
Linus Torvalds <[email protected]>
splice: reinstate SIGPIPE/EPIPE handling
Aleksa Sarai <[email protected]>
fs: exec: apply CLOEXEC before changing dumpable task flags
Eric W. Biederman <[email protected]>
exec: Ensure mm->user_ns contains the execed files
Richard Watts <[email protected]>
clk: ti: omap36xx: Work around sprz319 advisory 2.1
Kai-Heng Feng <[email protected]>
ALSA: hda: when comparing pin configurations, ignore assoc in addition to seq
Takashi Iwai <[email protected]>
ALSA: hda - Gate the mic jack on HP Z1 Gen3 AiO
Hui Wang <[email protected]>
ALSA: hda - fix headset-mic problem on a Dell laptop
Hui Wang <[email protected]>
ALSA: hda - ignore the assoc and seq when comparing pin configurations
Sven Hahne <[email protected]>
ALSA: hda/ca0132 - Add quirk for Alienware 15 R2 2016
Jussi Laako <[email protected]>
ALSA: hiface: Fix M2Tech hiFace driver sampling rate change
Con Kolivas <[email protected]>
ALSA: usb-audio: Add QuickCam Communicate Deluxe/S7500 to volume_control_quirks
Krzysztof Opasiak <[email protected]>
usbip: vudc: fix: Clear already_seen flag also for ep0
Alan Stern <[email protected]>
USB: UHCI: report non-PME wakeup signalling for Intel hardware
Felipe Balbi <[email protected]>
usb: gadget: composite: correctly initialize ep->maxpacket
Peter Chen <[email protected]>
usb: gadget: f_uac2: fix error handling at afunc_bind
Rafał Miłecki <[email protected]>
usb: core: usbport: Use proper LED API to fix potential crash
Mathias Nyman <[email protected]>
usb: hub: Fix auto-remount of safely removed or ejected USB-3 devices
Felipe Balbi <[email protected]>
usb: dwc3: gadget: set PCM1 field of isochronous-first TRBs
Nathaniel Quillin <[email protected]>
USB: cdc-acm: add device id for GW Instek AFG-125
Johan Hovold <[email protected]>
USB: serial: kl5kusb105: fix open error path
Giuseppe Lippolis <[email protected]>
USB: serial: option: add dlink dwm-158
Daniele Palmas <[email protected]>
USB: serial: option: add support for Telit LE922A PIDs 0x1040, 0x1041
Filipe Manana <[email protected]>
Btrfs: fix qgroup rescan worker initialization
Filipe Manana <[email protected]>
Btrfs: fix emptiness check for dirtied extent buffers at check_leaf()
David Sterba <[email protected]>
btrfs: store and load values of stripes_min/stripes_max in balance status item
Filipe Manana <[email protected]>
Btrfs: fix relocation incorrectly dropping data references
Robbie Ko <[email protected]>
Btrfs: fix tree search logic when replaying directory entry deletes
Robbie Ko <[email protected]>
Btrfs: fix deadlock caused by fsync when logging directory entries
Liu Bo <[email protected]>
Btrfs: fix BUG_ON in btrfs_mark_buffer_dirty
Maxim Patlasov <[email protected]>
btrfs: limit async_work allocation and worker func duration
Michal Hocko <[email protected]>
hotplug: Make register and unregister notifier API symmetric
-------------
Diffstat:
Makefile | 4 +- arch/alpha/kernel/ptrace.c | 2 +- arch/arm/xen/enlighten.c | 3 +- arch/blackfin/kernel/ptrace.c | 4 +- arch/cris/arch-v32/kernel/ptrace.c | 2 +- arch/ia64/kernel/ptrace.c | 2 +- arch/mips/kernel/ptrace32.c | 4 +- arch/powerpc/kernel/ptrace32.c | 4 +- arch/x86/include/asm/asm-prototypes.h | 16 ++++ block/blk-mq.c | 6 +- drivers/base/power/opp/core.c | 38 ++++---- drivers/block/loop.c | 2 +- drivers/char/tpm/xen-tpmfront.c | 1 - drivers/clk/ti/clk-3xxx.c | 20 ++-- drivers/clk/ti/clock.h | 9 ++ drivers/clk/ti/dpll.c | 19 +++- drivers/clk/ti/dpll3xxx.c | 67 ++++++++++++++ drivers/cpufreq/cpufreq-dt.c | 12 ++- drivers/crypto/caam/caamalg.c | 4 +- drivers/md/dm-crypt.c | 7 +- drivers/md/dm-flakey.c | 2 + drivers/md/dm-raid.c | 9 +- drivers/md/dm-rq.c | 10 +- drivers/md/dm-table.c | 24 +++-- drivers/md/persistent-data/dm-space-map-metadata.c | 14 ++- drivers/nvme/target/configfs.c | 6 +- drivers/nvme/target/core.c | 14 +-- drivers/nvme/target/nvmet.h | 6 +- drivers/usb/class/cdc-acm.c | 1 + drivers/usb/core/hub.c | 101 ++++++++------------- drivers/usb/core/ledtrig-usbport.c | 7 +- drivers/usb/dwc3/gadget.c | 13 ++- drivers/usb/gadget/composite.c | 11 ++- drivers/usb/gadget/function/f_uac2.c | 14 +-- drivers/usb/gadget/function/uvc_video.c | 2 +- drivers/usb/host/uhci-pci.c | 4 + drivers/usb/serial/kl5kusb105.c | 33 +++++-- drivers/usb/serial/option.c | 7 ++ drivers/usb/usbip/vudc_transfer.c | 2 + drivers/watchdog/mei_wdt.c | 2 + drivers/watchdog/qcom-wdt.c | 2 +- drivers/xen/gntdev.c | 2 +- fs/block_dev.c | 2 +- fs/btrfs/async-thread.c | 14 +++ fs/btrfs/async-thread.h | 1 + fs/btrfs/ctree.h | 4 + fs/btrfs/delayed-inode.c | 6 +- fs/btrfs/disk-io.c | 23 ++++- fs/btrfs/qgroup.c | 5 +- fs/btrfs/relocation.c | 15 ++- fs/btrfs/tree-log.c | 7 +- fs/cifs/cifsglob.h | 4 + fs/cifs/cifsproto.h | 3 + fs/cifs/connect.c | 34 +++++-- fs/cifs/file.c | 8 +- fs/cifs/ioctl.c | 2 +- fs/cifs/smb2file.c | 2 +- fs/cifs/smb2pdu.c | 87 ++++++++++++------ fs/cifs/smb2pdu.h | 2 + fs/cifs/smb2proto.h | 1 + fs/cifs/smbencrypt.c | 40 ++------ fs/exec.c | 31 ++++++- fs/ext4/ext4_jbd2.h | 14 +-- fs/ext4/inline.c | 4 +- fs/ext4/inode.c | 6 ++ fs/ext4/mballoc.c | 4 +- fs/ext4/super.c | 74 +++++++++------ fs/f2fs/checkpoint.c | 8 +- fs/f2fs/debug.c | 1 + fs/f2fs/f2fs.h | 36 +++++--- fs/f2fs/file.c | 4 +- fs/f2fs/super.c | 7 +- fs/splice.c | 9 +- fs/xfs/xfs_bmap_util.c | 7 +- fs/xfs/xfs_log_recover.c | 1 + include/asm-generic/asm-prototypes.h | 7 ++ include/linux/capability.h | 2 + include/linux/cpu.h | 15 +-- include/linux/mm.h | 2 + include/linux/mm_types.h | 1 + include/linux/pm_opp.h | 11 ++- include/linux/ptrace.h | 4 +- include/linux/sched.h | 1 + kernel/capability.c | 36 +++++++- kernel/cpu.c | 2 +- kernel/debug/debug_core.c | 4 +- kernel/fork.c | 9 +- kernel/ptrace.c | 70 +++++++++----- kernel/watchdog.c | 1 - mm/filemap.c | 2 +- mm/init-mm.c | 2 + mm/memory.c | 2 +- mm/nommu.c | 2 +- mm/page_alloc.c | 12 ++- mm/vmscan.c | 14 ++- scripts/package/builddeb | 2 +- sound/pci/hda/hda_auto_parser.c | 4 +- sound/pci/hda/patch_ca0132.c | 1 + sound/pci/hda/patch_conexant.c | 17 ++++ sound/pci/hda/patch_realtek.c | 3 + sound/soc/intel/atom/sst-mfld-platform-pcm.c | 6 ++ sound/usb/hiface/pcm.c | 2 + sound/usb/mixer.c | 3 +- 103 files changed, 814 insertions(+), 401 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/83 hotplug: Make register and unregister notifier API symmetric
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Hocko <[email protected]>
commit 777c6e0daebb3fcefbbd6f620410a946b07ef6d0 upstream.
Yu Zhao has noticed that __unregister_cpu_notifier only unregisters its notifiers when HOTPLUG_CPU=y while the registration might succeed even when HOTPLUG_CPU=n if MODULE is enabled. This means that e.g. zswap might keep a stale notifier on the list on the manual clean up during the pool tear down and thus corrupt the list. Resulting in the following
[ 144.964346] BUG: unable to handle kernel paging request at ffff880658a2be78 [ 144.971337] IP: [<ffffffffa290b00b>] raw_notifier_chain_register+0x1b/0x40 <snipped> [ 145.122628] Call Trace: [ 145.125086] [<ffffffffa28e5cf8>] __register_cpu_notifier+0x18/0x20 [ 145.131350] [<ffffffffa2a5dd73>] zswap_pool_create+0x273/0x400 [ 145.137268] [<ffffffffa2a5e0fc>] __zswap_param_set+0x1fc/0x300 [ 145.143188] [<ffffffffa2944c1d>] ? trace_hardirqs_on+0xd/0x10 [ 145.149018] [<ffffffffa2908798>] ? kernel_param_lock+0x28/0x30 [ 145.154940] [<ffffffffa2a3e8cf>] ? __might_fault+0x4f/0xa0 [ 145.160511] [<ffffffffa2a5e237>] zswap_compressor_param_set+0x17/0x20 [ 145.167035] [<ffffffffa2908d3c>] param_attr_store+0x5c/0xb0 [ 145.172694] [<ffffffffa290848d>] module_attr_store+0x1d/0x30 [ 145.178443] [<ffffffffa2b2b41f>] sysfs_kf_write+0x4f/0x70 [ 145.183925] [<ffffffffa2b2a5b9>] kernfs_fop_write+0x149/0x180 [ 145.189761] [<ffffffffa2a99248>] __vfs_write+0x18/0x40 [ 145.194982] [<ffffffffa2a9a412>] vfs_write+0xb2/0x1a0 [ 145.200122] [<ffffffffa2a9a732>] SyS_write+0x52/0xa0 [ 145.205177] [<ffffffffa2ff4d97>] entry_SYSCALL_64_fastpath+0x12/0x17
This can be even triggered manually by changing /sys/module/zswap/parameters/compressor multiple times.
Fix this issue by making unregister APIs symmetric to the register so there are no surprises.
--- include/linux/cpu.h | 15 ++++----------- kernel/cpu.c | 2 +- 2 files changed, 5 insertions(+), 12 deletions(-)
include/linux/cpu.h +4 -11
@@ -93,22 +93,16 @@ extern bool cpuhp_tasks_frozen; { .notifier_call = fn, .priority = pri }; \ __register_cpu_notifier(&fn##_nb); \ } -#else /* #if defined(CONFIG_HOTPLUG_CPU) || !defined(MODULE) */ -#define cpu_notifier (fn, pri) do { (void)(fn); } while (0) -#define __cpu_notifier (fn, pri) do { (void)(fn); } while (0) -#endif /* #else #if defined(CONFIG_HOTPLUG_CPU) || !defined(MODULE) */ -#ifdef CONFIG_HOTPLUG_CPUextern int register_cpu_notifier (struct notifier_block *nb);extern int __register_cpu_notifier (struct notifier_block *nb);extern void unregister_cpu_notifier (struct notifier_block *nb);extern void __unregister_cpu_notifier (struct notifier_block *nb); -#else -#ifndef MODULE -extern int register_cpu_notifier(struct notifier_block *nb); -extern int __register_cpu_notifier(struct notifier_block *nb); -#else +#else /* #if defined(CONFIG_HOTPLUG_CPU) || !defined(MODULE) */ +#define cpu_notifier (fn, pri) do { (void)(fn); } while (0) +#define __cpu_notifier (fn, pri) do { (void)(fn); } while (0) +static inline int register_cpu_notifier (struct notifier_block *nb) {return 0 ;
@@ -118,7 +112,6 @@ static inline int __register_cpu_notifie {return 0 ; } -#endif static inline void unregister_cpu_notifier (struct notifier_block *nb) {
kernel/cpu.c +1 -1
@@ -659,7 +659,6 @@ void __init cpuhp_threads_init(void)kthread_unpark (this_cpu_read (cpuhp_state.thread)); } -#ifdef CONFIG_HOTPLUG_CPU EXPORT_SYMBOL (register_cpu_notifier);EXPORT_SYMBOL (__register_cpu_notifier);void unregister_cpu_notifier (struct notifier_block *nb)
@@ -676,6 +675,7 @@ void __unregister_cpu_notifier(struct no }EXPORT_SYMBOL (__unregister_cpu_notifier); +#ifdef CONFIG_HOTPLUG_CPU /** * clear_tasks_mm_cpumask - Safely clear tasks' mm_cpumask for a CPU * @cpu: a CPU id
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to [email protected]. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"[email protected]"> [email protected] </a>
Greg Kroah-Hartman
maintainerPATCH 2/83 btrfs: limit async_work allocation and worker func duration
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maxim Patlasov <[email protected]>
commit 2939e1a86f758b55cdba73e29397dd3d94df13bc upstream.
Problem statement: unprivileged user who has read-write access to more than one btrfs subvolume may easily consume all kernel memory (eventually triggering oom-killer).
Reproducer (./mkrmdir below essentially loops over mkdir/rmdir):
[root@kteam1 ~]# cat prep.sh
DEV=/dev/sdb
mkfs.btrfs -f $DEV
mount $DEV /mnt
for i in seq 1 16
do
mkdir /mnt/$i
btrfs subvolume create /mnt/SV_$i
ID=btrfs subvolume list /mnt |grep "SV_$i$" |cut -d ' ' -f 2 mount -t btrfs -o subvolid=$ID $DEV /mnt/$i
chmod a+rwx /mnt/$i
done
[root@kteam1 ~]# sh prep.sh
[maxim@kteam1 ~]$ for i in seq 1 16; do ./mkrmdir /mnt/$i 2000 2000 & done
[root@kteam1 ~]# for i in seq 1 4; do grep "kmalloc-128" /proc/slabinfo | grep -v dma; sleep 60; done
kmalloc-128 10144 10144 128 32 1 : tunables 0 0 0 : slabdata 317 317 0
kmalloc-128 9992352 9992352 128 32 1 : tunables 0 0 0 : slabdata 312261 312261 0 kmalloc-128 24226752 24226752 128 32 1 : tunables 0 0 0 : slabdata 757086 757086 0 kmalloc-128 42754240 42754240 128 32 1 : tunables 0 0 0 : slabdata 1336070 1336070 0
The huge numbers above come from insane number of async_work-s allocated and queued by btrfs_wq_run_delayed_node.
The problem is caused by btrfs_wq_run_delayed_node() queuing more and more works if the number of delayed items is above BTRFS_DELAYED_BACKGROUND. The worker func (btrfs_async_run_delayed_root) processes at least BTRFS_DELAYED_BATCH items (if they are present in the list). So, the machinery works as expected while the list is almost empty. As soon as it is getting bigger, worker func starts to process more than one item at a time, it takes longer, and the chances to have async_works queued more than needed is getting higher.
The problem above is worsened by another flaw of delayed-inode implementation:
if async_work was queued in a throttling branch (number of items >= BTRFS_DELAYED_WRITEBACK), corresponding worker func won't quit until the number of items < BTRFS_DELAYED_BACKGROUND / 2. So, it is possible that the func occupies CPU infinitely (up to 30sec in my experiments): while the func is trying to drain the list, the user activity may add more and more items to the list.
The patch fixes both problems in straightforward way: refuse queuing too many works in btrfs_wq_run_delayed_node and bail out of worker func if at least BTRFS_DELAYED_WRITEBACK items are processed.
Changed in v2: remove support of thresh == NO_THRESHOLD.
--- fs/btrfs/async-thread.c | 14 ++++++++++++++ fs/btrfs/async-thread.h | 1 + fs/btrfs/delayed-inode.c | 6 ++++-- 3 files changed, 19 insertions(+), 2 deletions(-)
fs/btrfs/async-thread.c +14 -0
@@ -86,6 +86,20 @@ btrfs_work_owner(struct btrfs_work *workreturn work->wq->fs_info; } +bool btrfs_workqueue_normal_congested (struct btrfs_workqueue *wq) +{ +/* +* We could compare wq->normal->pending with num_online_cpus() +* to support "thresh == NO_THRESHOLD" case, but it requires +* moving up atomic_inc/dec in thresh_queue/exec_hook. Let's +* postpone it until someone needs the support of that case. +*/ +if (wq->normal->thresh ==NO_THRESHOLD ) +return false; + +return atomic_read (&wq->normal->pending) > wq->normal->thresh *2 ; +} +BTRFS_WORK_HELPER (worker_helper);BTRFS_WORK_HELPER (delalloc_helper);BTRFS_WORK_HELPER (flush_delalloc_helper);
fs/btrfs/async-thread.h +1 -0
@@ -84,4 +84,5 @@ void btrfs_workqueue_set_max(struct btrfvoid btrfs_set_work_high_priority (struct btrfs_work *work);struct btrfs_fs_info *btrfs_work_owner (struct btrfs_work *work);struct btrfs_fs_info *btrfs_workqueue_owner (struct __btrfs_workqueue *wq); +bool btrfs_workqueue_normal_congested (struct btrfs_workqueue *wq);#endif
fs/btrfs/delayed-inode.c +4 -2
@@ -1353,7 +1353,8 @@ release_path: total_done++;btrfs_release_prepared_delayed_node (delayed_node); -if (async_work->nr ==0 || total_done < async_work->nr) +if ((async_work->nr ==0 && total_done <BTRFS_DELAYED_WRITEBACK ) || + total_done < async_work->nr) goto again; free_path:
@@ -1369,7 +1370,8 @@ static int btrfs_wq_run_delayed_node(str {struct btrfs_async_delayed_work *async_work; -if (atomic_read (&delayed_root->items) <BTRFS_DELAYED_BACKGROUND ) +if (atomic_read (&delayed_root->items) <BTRFS_DELAYED_BACKGROUND || +btrfs_workqueue_normal_congested (fs_info->delayed_workers))return 0 ; async_work =kmalloc (sizeof (*async_work),GFP_NOFS );
Greg Kroah-Hartman
maintainerPATCH 3/83 Btrfs: fix BUG_ON in btrfs_mark_buffer_dirty
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liu Bo <[email protected]>
commit ef85b25e982b5bba1530b936e283ef129f02ab9d upstream.
This can only happen with CONFIG_BTRFS_FS_CHECK_INTEGRITY=y.
Commit 1ba98d0 ("Btrfs: detect corruption when non-root leaf has zero item") assumes that a leaf is its root when leaf->bytenr == btrfs_root_bytenr(root), however, we should not use btrfs_root_bytenr(root) since it's mainly got updated during committing transaction. So the check can fail when doing COW on this leaf while it is a root.
This changes to use "if (leaf == btrfs_root_node(root))" instead, just like how we check whether leaf is a root in __btrfs_cow_block().
--- fs/btrfs/disk-io.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
fs/btrfs/disk-io.c +7 -3
@@ -572,13 +572,17 @@ static noinline int check_leaf(struct bt* open_ctree() some roots has not yet been set up. */ if (!IS_ERR_OR_NULL (check_root)) { +struct extent_buffer *eb; + + eb =btrfs_root_node (check_root);/* if leaf is the root, then it's fine */ -if (leaf->start != -btrfs_root_bytenr (&check_root->root_item)) { +if (leaf != eb) {CORRUPT ("non-root leaf's nritems is 0" , - leaf, root,0 ); + leaf, check_root,0 ); +free_extent_buffer (eb);return -EIO ; } +free_extent_buffer (eb); }return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 4/83 Btrfs: fix deadlock caused by fsync when logging directory entries
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robbie Ko <[email protected]>
commit ec125cfb7ae2157af3dd45dd8abe823e3e233eec upstream.
While logging new directory entries, at tree-log.c:log_new_dir_dentries(), after we call btrfs_search_forward() we get a leaf with a read lock on it, and without unlocking that leaf we can end up calling btrfs_iget() to get an inode pointer. The later (btrfs_iget()) can end up doing a read-only search on the same tree again, if the inode is not in memory already, which ends up causing a deadlock if some other task in the meanwhile started a write search on the tree and is attempting to write lock the same leaf that btrfs_search_forward() locked while holding write locks on upper levels of the tree blocking the read search from btrfs_iget(). In this scenario we get a deadlock.
So fix this by releasing the search path before calling btrfs_iget() at tree-log.c:log_new_dir_dentries().
Example trace of such deadlock:
[ 4077.478852] kworker/u24:10 D ffff88107fc90640 0 14431 2 0x00000000 [ 4077.486752] Workqueue: btrfs-endio-write btrfs_endio_write_helper [btrfs] [ 4077.494346] ffff880ffa56bad0 0000000000000046 0000000000009000 ffff880ffa56bfd8 [ 4077.502629] ffff880ffa56bfd8 ffff881016ce21c0 ffffffffa06ecb26 ffff88101a5d6138 [ 4077.510915] ffff880ebb5173b0 ffff880ffa56baf8 ffff880ebb517410 ffff881016ce21c0 [ 4077.519202] Call Trace: [ 4077.528752] [<ffffffffa06ed5ed>] ? btrfs_tree_lock+0xdd/0x2f0 [btrfs] [ 4077.536049] [<ffffffff81053680>] ? wake_up_atomic_t+0x30/0x30 [ 4077.542574] [<ffffffffa068cc1f>] ? btrfs_search_slot+0x79f/0xb10 [btrfs] [ 4077.550171] [<ffffffffa06a5073>] ? btrfs_lookup_file_extent+0x33/0x40 [btrfs] [ 4077.558252] [<ffffffffa06c600b>] ? __btrfs_drop_extents+0x13b/0xdf0 [btrfs] [ 4077.566140] [<ffffffffa06fc9e2>] ? add_delayed_data_ref+0xe2/0x150 [btrfs] [ 4077.573928] [<ffffffffa06fd629>] ? btrfs_add_delayed_data_ref+0x149/0x1d0 [btrfs] [ 4077.582399] [<ffffffffa06cf3c0>] ? __set_extent_bit+0x4c0/0x5c0 [btrfs] [ 4077.589896] [<ffffffffa06b4a64>] ? insert_reserved_file_extent.constprop.75+0xa4/0x320 [btrfs] [ 4077.599632] [<ffffffffa06b206d>] ? start_transaction+0x8d/0x470 [btrfs] [ 4077.607134] [<ffffffffa06bab57>] ? btrfs_finish_ordered_io+0x2e7/0x600 [btrfs] [ 4077.615329] [<ffffffff8104cbc2>] ? process_one_work+0x142/0x3d0 [ 4077.622043] [<ffffffff8104d729>] ? worker_thread+0x109/0x3b0 [ 4077.628459] [<ffffffff8104d620>] ? manage_workers.isra.26+0x270/0x270 [ 4077.635759] [<ffffffff81052b0f>] ? kthread+0xaf/0xc0 [ 4077.641404] [<ffffffff81052a60>] ? kthread_create_on_node+0x110/0x110 [ 4077.648696] [<ffffffff814a9ac8>] ? ret_from_fork+0x58/0x90 [ 4077.654926] [<ffffffff81052a60>] ? kthread_create_on_node+0x110/0x110
[ 4078.358087] kworker/u24:15 D ffff88107fcd0640 0 14436 2 0x00000000 [ 4078.365981] Workqueue: btrfs-endio-write btrfs_endio_write_helper [btrfs] [ 4078.373574] ffff880ffa57fad0 0000000000000046 0000000000009000 ffff880ffa57ffd8 [ 4078.381864] ffff880ffa57ffd8 ffff88103004d0a0 ffffffffa06ecb26 ffff88101a5d6138 [ 4078.390163] ffff880fbeffc298 ffff880ffa57faf8 ffff880fbeffc2f8 ffff88103004d0a0 [ 4078.398466] Call Trace: [ 4078.408019] [<ffffffffa06ed5ed>] ? btrfs_tree_lock+0xdd/0x2f0 [btrfs] [ 4078.415322] [<ffffffff81053680>] ? wake_up_atomic_t+0x30/0x30 [ 4078.421844] [<ffffffffa068cc1f>] ? btrfs_search_slot+0x79f/0xb10 [btrfs] [ 4078.429438] [<ffffffffa06a5073>] ? btrfs_lookup_file_extent+0x33/0x40 [btrfs] [ 4078.437518] [<ffffffffa06c600b>] ? __btrfs_drop_extents+0x13b/0xdf0 [btrfs] [ 4078.445404] [<ffffffffa06fc9e2>] ? add_delayed_data_ref+0xe2/0x150 [btrfs] [ 4078.453194] [<ffffffffa06fd629>] ? btrfs_add_delayed_data_ref+0x149/0x1d0 [btrfs] [ 4078.461663] [<ffffffffa06cf3c0>] ? __set_extent_bit+0x4c0/0x5c0 [btrfs] [ 4078.469161] [<ffffffffa06b4a64>] ? insert_reserved_file_extent.constprop.75+0xa4/0x320 [btrfs] [ 4078.478893] [<ffffffffa06b206d>] ? start_transaction+0x8d/0x470 [btrfs] [ 4078.486388] [<ffffffffa06bab57>] ? btrfs_finish_ordered_io+0x2e7/0x600 [btrfs] [ 4078.494561] [<ffffffff8104cbc2>] ? process_one_work+0x142/0x3d0 [ 4078.501278] [<ffffffff8104a507>] ? pwq_activate_delayed_work+0x27/0x40 [ 4078.508673] [<ffffffff8104d729>] ? worker_thread+0x109/0x3b0 [ 4078.515098] [<ffffffff8104d620>] ? manage_workers.isra.26+0x270/0x270 [ 4078.522396] [<ffffffff81052b0f>] ? kthread+0xaf/0xc0 [ 4078.528032] [<ffffffff81052a60>] ? kthread_create_on_node+0x110/0x110 [ 4078.535325] [<ffffffff814a9ac8>] ? ret_from_fork+0x58/0x90 [ 4078.541552] [<ffffffff81052a60>] ? kthread_create_on_node+0x110/0x110
[ 4079.355824] user-space-program D ffff88107fd30640 0 32020 1 0x00000000 [ 4079.363716] ffff880eae8eba10 0000000000000086 0000000000009000 ffff880eae8ebfd8 [ 4079.372003] ffff880eae8ebfd8 ffff881016c162c0 ffffffffa06ecb26 ffff88101a5d6138 [ 4079.380294] ffff880fbed4b4c8 ffff880eae8eba38 ffff880fbed4b528 ffff881016c162c0 [ 4079.388586] Call Trace: [ 4079.398134] [<ffffffffa06ed595>] ? btrfs_tree_lock+0x85/0x2f0 [btrfs] [ 4079.405431] [<ffffffff81053680>] ? wake_up_atomic_t+0x30/0x30 [ 4079.411955] [<ffffffffa06876fb>] ? btrfs_lock_root_node+0x2b/0x40 [btrfs] [ 4079.419644] [<ffffffffa068ce83>] ? btrfs_search_slot+0xa03/0xb10 [btrfs] [ 4079.427237] [<ffffffffa06aba52>] ? btrfs_buffer_uptodate+0x52/0x70 [btrfs] [ 4079.435041] [<ffffffffa0689b60>] ? generic_bin_search.constprop.38+0x80/0x190 [btrfs] [ 4079.443897] [<ffffffffa068ea44>] ? btrfs_insert_empty_items+0x74/0xd0 [btrfs] [ 4079.451975] [<ffffffffa072c443>] ? copy_items+0x128/0x850 [btrfs] [ 4079.458890] [<ffffffffa072da10>] ? btrfs_log_inode+0x629/0xbf3 [btrfs] [ 4079.466292] [<ffffffffa06f34a1>] ? btrfs_log_inode_parent+0xc61/0xf30 [btrfs] [ 4079.474373] [<ffffffffa06f45a9>] ? btrfs_log_dentry_safe+0x59/0x80 [btrfs] [ 4079.482161] [<ffffffffa06c298d>] ? btrfs_sync_file+0x20d/0x330 [btrfs] [ 4079.489558] [<ffffffff8112777c>] ? do_fsync+0x4c/0x80 [ 4079.495300] [<ffffffff81127a0a>] ? SyS_fdatasync+0xa/0x10 [ 4079.501422] [<ffffffff814a9b72>] ? system_call_fastpath+0x16/0x1b
[ 4079.508334] user-space-program D ffff88107fc30640 0 32021 1 0x00000004 [ 4079.516226] ffff880eae8efbf8 0000000000000086 0000000000009000 ffff880eae8effd8 [ 4079.524513] ffff880eae8effd8 ffff881030279610 ffffffffa06ecb26 ffff88101a5d6138 [ 4079.532802] ffff880ebb671d88 ffff880eae8efc20 ffff880ebb671de8 ffff881030279610 [ 4079.541092] Call Trace: [ 4079.550642] [<ffffffffa06ed595>] ? btrfs_tree_lock+0x85/0x2f0 [btrfs] [ 4079.557941] [<ffffffff81053680>] ? wake_up_atomic_t+0x30/0x30 [ 4079.564463] [<ffffffffa068cc1f>] ? btrfs_search_slot+0x79f/0xb10 [btrfs] [ 4079.572058] [<ffffffffa06bb7d8>] ? btrfs_truncate_inode_items+0x168/0xb90 [btrfs] [ 4079.580526] [<ffffffffa06b04be>] ? join_transaction.isra.15+0x1e/0x3a0 [btrfs] [ 4079.588701] [<ffffffffa06b206d>] ? start_transaction+0x8d/0x470 [btrfs] [ 4079.596196] [<ffffffffa0690ac6>] ? block_rsv_add_bytes+0x16/0x50 [btrfs] [ 4079.603789] [<ffffffffa06bc2e9>] ? btrfs_truncate+0xe9/0x2e0 [btrfs] [ 4079.610994] [<ffffffffa06bd00b>] ? btrfs_setattr+0x30b/0x410 [btrfs] [ 4079.618197] [<ffffffff81117c1c>] ? notify_change+0x1dc/0x680 [ 4079.624625] [<ffffffff8123c8a4>] ? aa_path_perm+0xd4/0x160 [ 4079.630854] [<ffffffff810f4fcb>] ? do_truncate+0x5b/0x90 [ 4079.636889] [<ffffffff810f59fa>] ? do_sys_ftruncate.constprop.15+0x10a/0x160 [ 4079.644869] [<ffffffff8110d87b>] ? SyS_fcntl+0x5b/0x570 [ 4079.650805] [<ffffffff814a9b72>] ? system_call_fastpath+0x16/0x1b
[ 4080.410607] user-space-program D ffff88107fc70640 0 32028 12639 0x00000004 [ 4080.418489] ffff880eaeccbbe0 0000000000000086 0000000000009000 ffff880eaeccbfd8 [ 4080.426778] ffff880eaeccbfd8 ffff880f317ef1e0 ffffffffa06ecb26 ffff88101a5d6138 [ 4080.435067] ffff880ef7e93928 ffff880f317ef1e0 ffff880eaeccbc08 ffff880f317ef1e0 [ 4080.443353] Call Trace: [ 4080.452920] [<ffffffffa06ed15d>] ? btrfs_tree_read_lock+0xdd/0x190 [btrfs] [ 4080.460703] [<ffffffff81053680>] ? wake_up_atomic_t+0x30/0x30 [ 4080.467225] [<ffffffffa06876bb>] ? btrfs_read_lock_root_node+0x2b/0x40 [btrfs] [ 4080.475400] [<ffffffffa068cc81>] ? btrfs_search_slot+0x801/0xb10 [btrfs] [ 4080.482994] [<ffffffffa06b2df0>] ? btrfs_clean_one_deleted_snapshot+0xe0/0xe0 [btrfs] [ 4080.491857] [<ffffffffa06a70a6>] ? btrfs_lookup_inode+0x26/0x90 [btrfs] [ 4080.499353] [<ffffffff810ec42f>] ? kmem_cache_alloc+0xaf/0xc0 [ 4080.505879] [<ffffffffa06bd905>] ? btrfs_iget+0xd5/0x5d0 [btrfs] [ 4080.512696] [<ffffffffa06caf04>] ? btrfs_get_token_64+0x104/0x120 [btrfs] [ 4080.520387] [<ffffffffa06f341f>] ? btrfs_log_inode_parent+0xbdf/0xf30 [btrfs] [ 4080.528469] [<ffffffffa06f45a9>] ? btrfs_log_dentry_safe+0x59/0x80 [btrfs] [ 4080.536258] [<ffffffffa06c298d>] ? btrfs_sync_file+0x20d/0x330 [btrfs] [ 4080.543657] [<ffffffff8112777c>] ? do_fsync+0x4c/0x80 [ 4080.549399] [<ffffffff81127a0a>] ? SyS_fdatasync+0xa/0x10 [ 4080.555534] [<ffffffff814a9b72>] ? system_call_fastpath+0x16/0x1b
--- fs/btrfs/tree-log.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/btrfs/tree-log.c +2 -2
@@ -5205,6 +5205,7 @@ process_leaf:if (di_key.type ==BTRFS_ROOT_ITEM_KEY )continue ; +btrfs_release_path (path); di_inode =btrfs_iget (root->fs_info->sb, &di_key, root,NULL );if (IS_ERR (di_inode)) {
@@ -5214,13 +5215,12 @@ process_leaf:if (btrfs_inode_in_log (di_inode, trans->transid)) {iput (di_inode); -continue ; +break ; } ctx->log_new_dentries = false;if (type ==BTRFS_FT_DIR || type ==BTRFS_FT_SYMLINK ) log_mode =LOG_INODE_ALL ; -btrfs_release_path (path); ret =btrfs_log_inode (trans, root, di_inode, log_mode,0 ,LLONG_MAX , ctx); if (!ret &&
Greg Kroah-Hartman
maintainerPATCH 5/83 Btrfs: fix tree search logic when replaying directory entry deletes
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robbie Ko <[email protected]>
commit 2a7bf53f577e49c43de4ffa7776056de26db65d9 upstream.
If a log tree has a layout like the following:
leaf N:
...
item 240 key (282 DIR_LOG_ITEM 0) itemoff 8189 itemsize 8
dir log end 1275809046
leaf N + 1:
item 0 key (282 DIR_LOG_ITEM 3936149215) itemoff 16275 itemsize 8
dir log end 18446744073709551615
...When we pass the value 1275809046 + 1 as the parameter start_ret to the function tree-log.c:find_dir_range() (done by replay_dir_deletes()), we end up with path->slots[0] having the value 239 (points to the last item of leaf N, item 240). Because the dir log item in that position has an offset value smaller than *start_ret (1275809046 + 1) we need to move on to the next leaf, however the logic for that is wrong since it compares the current slot to the number of items in the leaf, which is smaller and therefore we don't lookup for the next leaf but instead we set the slot to point to an item that does not exist, at slot 240, and we later operate on that slot which has unexpected content or in the worst case can result in an invalid memory access (accessing beyond the last page of leaf N's extent buffer).
So fix the logic that checks when we need to lookup at the next leaf by first incrementing the slot and only after to check if that slot is beyond the last item of the current leaf.
--- fs/btrfs/tree-log.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
fs/btrfs/tree-log.c +1 -2
@@ -1940,12 +1940,11 @@ static noinline int find_dir_range(struc next:/* check the next slot in the tree to see if it is a valid item */ nritems =btrfs_header_nritems (path->nodes[0 ]); + path->slots[0 ]++;if (path->slots[0 ] >= nritems) { ret =btrfs_next_leaf (root, path);if (ret) goto out; - }else { - path->slots[0 ]++; }btrfs_item_key_to_cpu (path->nodes[0 ], &key, path->slots[0 ]);
Greg Kroah-Hartman
maintainerPATCH 6/83 Btrfs: fix relocation incorrectly dropping data references
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
commit 054570a1dc94de20e7a612cddcc5a97db9c37b6f upstream.
During relocation of a data block group we create a relocation tree for each fs/subvol tree by making a snapshot of each tree using btrfs_copy_root() and the tree's commit root, and then setting the last snapshot field for the fs/subvol tree's root to the value of the current transaction id minus 1. However this can lead to relocation later dropping references that it did not create if we have qgroups enabled, leaving the filesystem in an inconsistent state that keeps aborting transactions.
Lets consider the following example to explain the problem, which requires qgroups to be enabled.
We are relocating data block group Y, we have a subvolume with id 258 that has a root at level 1, that subvolume is used to store directory entries for snapshots and we are currently at transaction 3404.
When committing transaction 3404, we have a pending snapshot and therefore we call btrfs_run_delayed_items() at transaction.c:create_pending_snapshot() in order to create its dentry at subvolume 258. This results in COWing leaf A from root 258 in order to add the dentry. Note that leaf A also contains file extent items referring to extents from some other block group X (we are currently relocating block group Y). Later on, still at create_pending_snapshot() we call qgroup_account_snapshot(), which switches the commit root for root 258 when it calls switch_commit_roots(), so now the COWed version of leaf A, lets call it leaf A', is accessible from the commit root of tree 258. At the end of qgroup_account_snapshot(), we call record_root_in_trans() with 258 as its argument, which results in btrfs_init_reloc_root() being called, which in turn calls relocation.c:create_reloc_root() in order to create a relocation tree associated to root 258, which results in assigning the value of 3403 (which is the current transaction id minus 1 = 3404 - 1) to the last_snapshot field of root 258. When creating the relocation tree root at ctree.c:btrfs_copy_root() we add a shared reference for leaf A', corresponding to the relocation tree's root, when we call btrfs_inc_ref() against the COWed root (a copy of the commit root from tree 258), which is at level 1. So at this point leaf A' has 2 references, one normal reference corresponding to root 258 and one shared reference corresponding to the root of the relocation tree.
Transaction 3404 finishes its commit and transaction 3405 is started by relocation when calling merge_reloc_root() for the relocation tree associated to root 258. In the meanwhile leaf A' is COWed again, in response to some filesystem operation, when we are still at transaction 3405. However when we COW leaf A', at ctree.c:update_ref_for_cow(), we call btrfs_block_can_be_shared() in order to figure out if other trees refer to the leaf and if any such trees exists, add a full back reference to leaf A' - but btrfs_block_can_be_shared() incorrectly returns false because the following condition is false:
btrfs_header_generation(buf) <= btrfs_root_last_snapshot(&root->root_item)
which evaluates to 3404 <= 3403. So after leaf A' is COWed, it stays with only one reference, corresponding to the shared reference we created when we called btrfs_copy_root() to create the relocation tree's root and btrfs_inc_ref() ends up not being called for leaf A' nor we end up setting the flag BTRFS_BLOCK_FLAG_FULL_BACKREF in leaf A'. This results in not adding shared references for the extents from block group X that leaf A' refers to with its file extent items.
Later, after merging the relocation root we do a call to to btrfs_drop_snapshot() in order to delete the relocation tree. This ends up calling do_walk_down() when path->slots[1] points to leaf A', which results in calling btrfs_lookup_extent_info() to get the number of references for leaf A', which is 1 at this time (only the shared reference exists) and this value is stored at wc->refs[0]. After this walk_up_proc() is called when wc->level is 0 and path->nodes[0] corresponds to leaf A'. Because the current level is 0 and wc->refs[0] is 1, it does call btrfs_dec_ref() against leaf A', which results in removing the single references that the extents from block group X have which are associated to root 258 - the expectation was to have each of these extents with 2 references - one reference for root 258 and one shared reference related to the root of the relocation tree, and so we would drop only the shared reference (because leaf A' was supposed to have the flag BTRFS_BLOCK_FLAG_FULL_BACKREF set).
This leaves the filesystem in an inconsistent state as we now have file extent items in a subvolume tree that point to extents from block group X without references in the extent tree. So later on when we try to decrement the references for these extents, for example due to a file unlink operation, truncate operation or overwriting ranges of a file, we fail because the expected references do not exist in the extent tree.
This leads to warnings and transaction aborts like the following:
[ 588.965795] ------------[ cut here ]------------ [ 588.965815] WARNING: CPU: 2 PID: 2479 at fs/btrfs/extent-tree.c:1625 lookup_inline_extent_backref+0x432/0x5b0 [btrfs] [ 588.965816] Modules linked in: af_packet iscsi_ibft iscsi_boot_sysfs xfs libcrc32c ppdev acpi_cpufreq button tpm_tis e1000 i2c_piix4 pcspkr parport_pc parport tpm qemu_fw_cfg joydev btrfs xor raid6_pq sr_mod cdrom ata_generic virtio_scsi ata_piix virtio_pci bochs_drm virtio_ring drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops virtio ttm serio_raw drm floppy sg [ 588.965831] CPU: 2 PID: 2479 Comm: kworker/u8:7 Not tainted 4.7.3-3-default-fdm+ #1 [ 588.965832] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.9.1-0-gb3ef39f-prebuilt.qemu-project.org 04/01/2014 [ 588.965844] Workqueue: btrfs-extent-refs btrfs_extent_refs_helper [btrfs] [ 588.965845] 0000000000000000 ffff8802263bfa28 ffffffff813af542 0000000000000000 [ 588.965847] 0000000000000000 ffff8802263bfa68 ffffffff81081e8b 0000065900000000 [ 588.965848] ffff8801db2af000 000000012bbe2000 0000000000000000 ffff880215703b48 [ 588.965849] Call Trace: [ 588.965852] [<ffffffff813af542>] dump_stack+0x63/0x81 [ 588.965854] [<ffffffff81081e8b>] __warn+0xcb/0xf0 [ 588.965855] [<ffffffff81081f7d>] warn_slowpath_null+0x1d/0x20 [ 588.965863] [<ffffffffa0175042>] lookup_inline_extent_backref+0x432/0x5b0 [btrfs] [ 588.965865] [<ffffffff81143220>] ? trace_clock_local+0x10/0x30 [ 588.965867] [<ffffffff8114c5df>] ? rb_reserve_next_event+0x6f/0x460 [ 588.965875] [<ffffffffa0175215>] insert_inline_extent_backref+0x55/0xd0 [btrfs] [ 588.965882] [<ffffffffa017531f>] __btrfs_inc_extent_ref.isra.55+0x8f/0x240 [btrfs] [ 588.965890] [<ffffffffa017acea>] __btrfs_run_delayed_refs+0x74a/0x1260 [btrfs] [ 588.965892] [<ffffffff810cb046>] ? cpuacct_charge+0x86/0xa0 [ 588.965900] [<ffffffffa017e74f>] btrfs_run_delayed_refs+0x9f/0x2c0 [btrfs] [ 588.965908] [<ffffffffa017ea04>] delayed_ref_async_start+0x94/0xb0 [btrfs] [ 588.965918] [<ffffffffa01c799a>] btrfs_scrubparity_helper+0xca/0x350 [btrfs] [ 588.965928] [<ffffffffa01c7c5e>] btrfs_extent_refs_helper+0xe/0x10 [btrfs] [ 588.965930] [<ffffffff8109b323>] process_one_work+0x1f3/0x4e0 [ 588.965931] [<ffffffff8109b658>] worker_thread+0x48/0x4e0 [ 588.965932] [<ffffffff8109b610>] ? process_one_work+0x4e0/0x4e0 [ 588.965934] [<ffffffff810a1659>] kthread+0xc9/0xe0 [ 588.965936] [<ffffffff816f2f1f>] ret_from_fork+0x1f/0x40 [ 588.965937] [<ffffffff810a1590>] ? kthread_worker_fn+0x170/0x170 [ 588.965938] ---[ end trace 34e5232c933a1749 ]--- [ 588.966187] ------------[ cut here ]------------ [ 588.966196] WARNING: CPU: 2 PID: 2479 at fs/btrfs/extent-tree.c:2966 btrfs_run_delayed_refs+0x28c/0x2c0 [btrfs] [ 588.966196] BTRFS: Transaction aborted (error -5) [ 588.966197] Modules linked in: af_packet iscsi_ibft iscsi_boot_sysfs xfs libcrc32c ppdev acpi_cpufreq button tpm_tis e1000 i2c_piix4 pcspkr parport_pc parport tpm qemu_fw_cfg joydev btrfs xor raid6_pq sr_mod cdrom ata_generic virtio_scsi ata_piix virtio_pci bochs_drm virtio_ring drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops virtio ttm serio_raw drm floppy sg [ 588.966206] CPU: 2 PID: 2479 Comm: kworker/u8:7 Tainted: G W 4.7.3-3-default-fdm+ #1 [ 588.966207] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.9.1-0-gb3ef39f-prebuilt.qemu-project.org 04/01/2014 [ 588.966217] Workqueue: btrfs-extent-refs btrfs_extent_refs_helper [btrfs] [ 588.966217] 0000000000000000 ffff8802263bfc98 ffffffff813af542 ffff8802263bfce8 [ 588.966219] 0000000000000000 ffff8802263bfcd8 ffffffff81081e8b 00000b96345ee000 [ 588.966220] ffffffffa021ae1c ffff880215703b48 00000000000005fe ffff8802345ee000 [ 588.966221] Call Trace: [ 588.966223] [<ffffffff813af542>] dump_stack+0x63/0x81 [ 588.966224] [<ffffffff81081e8b>] __warn+0xcb/0xf0 [ 588.966225] [<ffffffff81081eff>] warn_slowpath_fmt+0x4f/0x60 [ 588.966233] [<ffffffffa017e93c>] btrfs_run_delayed_refs+0x28c/0x2c0 [btrfs] [ 588.966241] [<ffffffffa017ea04>] delayed_ref_async_start+0x94/0xb0 [btrfs] [ 588.966250] [<ffffffffa01c799a>] btrfs_scrubparity_helper+0xca/0x350 [btrfs] [ 588.966259] [<ffffffffa01c7c5e>] btrfs_extent_refs_helper+0xe/0x10 [btrfs] [ 588.966260] [<ffffffff8109b323>] process_one_work+0x1f3/0x4e0 [ 588.966261] [<ffffffff8109b658>] worker_thread+0x48/0x4e0 [ 588.966263] [<ffffffff8109b610>] ? process_one_work+0x4e0/0x4e0 [ 588.966264] [<ffffffff810a1659>] kthread+0xc9/0xe0 [ 588.966265] [<ffffffff816f2f1f>] ret_from_fork+0x1f/0x40 [ 588.966267] [<ffffffff810a1590>] ? kthread_worker_fn+0x170/0x170 [ 588.966268] ---[ end trace 34e5232c933a174a ]--- [ 588.966269] BTRFS: error (device sda2) in btrfs_run_delayed_refs:2966: errno=-5 IO failure [ 588.966270] BTRFS info (device sda2): forced readonly
This was happening often on openSUSE and SLE systems using btrfs as the root filesystem (with its default layout where multiple subvolumes are used) where balance happens in the background triggered by a cron job and snapshots are automatically created before/after package installations, upgrades and removals. The issue could be triggered simply by running the following loop on the first system boot post installation:
while true; do
zypper -n in nfs-kernel-server
zypper -n rm nfs-kernel-server
done
(If we were fast enough and made that loop before the cron job triggered a balance operation and the balance finished)
So fix by setting the last_snapshot field of the root to the value of the generation of its commit root. Like this btrfs_block_can_be_shared() behaves correctly for the case where the relocation root is created during a transaction commit and for the case where it's created before a transaction commit.
--- fs/btrfs/relocation.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-)
fs/btrfs/relocation.c +12 -3
@@ -1395,14 +1395,23 @@ static struct btrfs_root *create_reloc_r root_key.offset = objectid;if (root->root_key.objectid == objectid) { +u64 commit_root_gen; +/* called by btrfs_init_reloc_root */ ret =btrfs_copy_root (trans, root, root->commit_root, &eb,BTRFS_TREE_RELOC_OBJECTID );BUG_ON (ret); - last_snap =btrfs_root_last_snapshot (&root->root_item); -btrfs_set_root_last_snapshot (&root->root_item, - trans->transid -1 ); +/* +* Set the last_snapshot field to the generation of the commit +* root - like this ctree.c:btrfs_block_can_be_shared() behaves +* correctly (returns true) when the relocation root is created +* either inside the critical section of a transaction commit +* (through transaction.c:qgroup_account_snapshot()) and when +* it's created before the transaction commit is started. +*/ + commit_root_gen =btrfs_header_generation (root->commit_root); +btrfs_set_root_last_snapshot (&root->root_item, commit_root_gen); }else {/* * called by btrfs_reloc_post_snapshot_hook.
Greg Kroah-Hartman
maintainerPATCH 7/83 btrfs: store and load values of stripes_min/stripes_max in balance status item
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Sterba <[email protected]>
commit ed0df618b1b06d7431ee4d985317fc5419a5d559 upstream.
The balance status item contains currently known filter values, but the stripes filter was unintentionally not among them. This would mean, that interrupted and automatically restarted balance does not apply the stripe filters.
--- fs/btrfs/ctree.h | 4 ++++ 1 file changed, 4 insertions(+)
fs/btrfs/ctree.h +4 -0
@@ -2210,6 +2210,8 @@ btrfs_disk_balance_args_to_cpu(struct bt cpu->target =le64_to_cpu (disk->target); cpu->flags =le64_to_cpu (disk->flags); cpu->limit =le64_to_cpu (disk->limit); + cpu->stripes_min =le32_to_cpu (disk->stripes_min); + cpu->stripes_max =le32_to_cpu (disk->stripes_max); } static inline void
@@ -2228,6 +2230,8 @@ btrfs_cpu_balance_args_to_disk(struct bt disk->target =cpu_to_le64 (cpu->target); disk->flags =cpu_to_le64 (cpu->flags); disk->limit =cpu_to_le64 (cpu->limit); + disk->stripes_min =cpu_to_le32 (cpu->stripes_min); + disk->stripes_max =cpu_to_le32 (cpu->stripes_max); }/* struct btrfs_super_block */
Greg Kroah-Hartman
maintainerPATCH 8/83 Btrfs: fix emptiness check for dirtied extent buffers at check_leaf()
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
commit f177d73949bf758542ca15a1c1945bd2e802cc65 upstream.
We can not simply use the owner field from an extent buffer's header to get the id of the respective tree when the extent buffer is from a relocation tree. When we create the root for a relocation tree we leave (on purpose) the owner field with the same value as the subvolume's tree root (we do this at ctree.c:btrfs_copy_root()). So we must ignore extent buffers from relocation trees, which have the BTRFS_HEADER_FLAG_RELOC flag set, because otherwise we will always consider the extent buffer as not being the root of the tree (the root of original subvolume tree is always different from the root of the respective relocation tree).
This lead to assertion failures when running with the integrity checker enabled (CONFIG_BTRFS_FS_CHECK_INTEGRITY=y) such as the following:
[ 643.393409] BTRFS critical (device sdg): corrupt leaf, non-root leaf's nritems is 0: block=38506496, root=260, slot=0 [ 643.397609] BTRFS info (device sdg): leaf 38506496 total ptrs 0 free space 3995 [ 643.407075] assertion failed: 0, file: fs/btrfs/disk-io.c, line: 4078 [ 643.408425] ------------[ cut here ]------------ [ 643.409112] kernel BUG at fs/btrfs/ctree.h:3419! [ 643.409773] invalid opcode: 0000 [#1] PREEMPT SMP [ 643.410447] Modules linked in: dm_flakey dm_mod crc32c_generic btrfs xor raid6_pq ppdev psmouse acpi_cpufreq parport_pc evdev parport tpm_tis tpm_tis_core pcspkr serio_raw i2c_piix4 sg tpm i2c_core button processor loop autofs4 ext4 crc16 jbd2 mbcache sr_mod cdrom sd_mod ata_generic virtio_scsi ata_piix libata virtio_pci virtio_ring scsi_mod virtio e1000 floppy [ 643.414356] CPU: 11 PID: 32726 Comm: btrfs Not tainted 4.8.0-rc8-btrfs-next-35+ #1 [ 643.414356] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.9.1-0-gb3ef39f-prebuilt.qemu-project.org 04/01/2014 [ 643.414356] task: ffff880145e95b00 task.stack: ffff88014826c000 [ 643.414356] RIP: 0010:[<ffffffffa0352759>] [<ffffffffa0352759>] assfail.constprop.41+0x1c/0x1e [btrfs] [ 643.414356] RSP: 0018:ffff88014826fa28 EFLAGS: 00010292 [ 643.414356] RAX: 0000000000000039 RBX: ffff88014e2d7c38 RCX: 0000000000000001 [ 643.414356] RDX: ffff88023f4d2f58 RSI: ffffffff81806c63 RDI: 00000000ffffffff [ 643.414356] RBP: ffff88014826fa28 R08: 0000000000000001 R09: 0000000000000000 [ 643.414356] R10: ffff88014826f918 R11: ffffffff82f3c5ed R12: ffff880172910000 [ 643.414356] R13: ffff880233992230 R14: ffff8801a68a3310 R15: fffffffffffffff8 [ 643.414356] FS: 00007f9ca305e8c0(0000) GS:ffff88023f4c0000(0000) knlGS:0000000000000000 [ 643.414356] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 643.414356] CR2: 00007f9ca3071000 CR3: 000000015d01b000 CR4: 00000000000006e0 [ 643.414356] Stack: [ 643.414356] ffff88014826fa50 ffffffffa02d655a 000000000000000a ffff88014e2d7c38 [ 643.414356] 0000000000000000 ffff88014826faa8 ffffffffa02b72f3 ffff88014826fab8 [ 643.414356] 00ffffffa03228e4 0000000000000000 0000000000000000 ffff8801bbd4e000 [ 643.414356] Call Trace: [ 643.414356] [<ffffffffa02d655a>] btrfs_mark_buffer_dirty+0xdf/0xe5 [btrfs] [ 643.414356] [<ffffffffa02b72f3>] btrfs_copy_root+0x18a/0x1d1 [btrfs] [ 643.414356] [<ffffffffa0322921>] create_reloc_root+0x72/0x1ba [btrfs] [ 643.414356] [<ffffffffa03267c2>] btrfs_init_reloc_root+0x7b/0xa7 [btrfs] [ 643.414356] [<ffffffffa02d9e44>] record_root_in_trans+0xdf/0xed [btrfs] [ 643.414356] [<ffffffffa02db04e>] btrfs_record_root_in_trans+0x50/0x6a [btrfs] [ 643.414356] [<ffffffffa030ad2b>] create_subvol+0x472/0x773 [btrfs] [ 643.414356] [<ffffffffa030b406>] btrfs_mksubvol+0x3da/0x463 [btrfs] [ 643.414356] [<ffffffffa030b406>] ? btrfs_mksubvol+0x3da/0x463 [btrfs] [ 643.414356] [<ffffffff810781ac>] ? preempt_count_add+0x65/0x68 [ 643.414356] [<ffffffff811a6e97>] ? __mnt_want_write+0x62/0x77 [ 643.414356] [<ffffffffa030b55d>] btrfs_ioctl_snap_create_transid+0xce/0x187 [btrfs] [ 643.414356] [<ffffffffa030b67d>] btrfs_ioctl_snap_create+0x67/0x81 [btrfs] [ 643.414356] [<ffffffffa030ecfd>] btrfs_ioctl+0x508/0x20dd [btrfs] [ 643.414356] [<ffffffff81293e39>] ? __this_cpu_preempt_check+0x13/0x15 [ 643.414356] [<ffffffff81155eca>] ? handle_mm_fault+0x976/0x9ab [ 643.414356] [<ffffffff81091300>] ? arch_local_irq_save+0x9/0xc [ 643.414356] [<ffffffff8119a2b0>] vfs_ioctl+0x18/0x34 [ 643.414356] [<ffffffff8119a8e8>] do_vfs_ioctl+0x581/0x600 [ 643.414356] [<ffffffff814b9552>] ? entry_SYSCALL_64_fastpath+0x5/0xa8 [ 643.414356] [<ffffffff81093fe9>] ? trace_hardirqs_on_caller+0x17b/0x197 [ 643.414356] [<ffffffff8119a9be>] SyS_ioctl+0x57/0x79 [ 643.414356] [<ffffffff814b9565>] entry_SYSCALL_64_fastpath+0x18/0xa8 [ 643.414356] [<ffffffff81091b08>] ? trace_hardirqs_off_caller+0x3f/0xaa [ 643.414356] Code: 89 83 88 00 00 00 31 c0 5b 41 5c 41 5d 5d c3 55 89 f1 48 c7 c2 98 bc 35 a0 48 89 fe 48 c7 c7 05 be 35 a0 48 89 e5 e8 13 46 dd e0 <0f> 0b 55 89 f1 48 c7 c2 9f d3 35 a0 48 89 fe 48 c7 c7 7a d5 35 [ 643.414356] RIP [<ffffffffa0352759>] assfail.constprop.41+0x1c/0x1e [btrfs] [ 643.414356] RSP <ffff88014826fa28> [ 643.468267] ---[ end trace 6a1b3fb1a9d7d6e3 ]---
This can be easily reproduced by running xfstests with the integrity checker enabled.
--- fs/btrfs/disk-io.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
fs/btrfs/disk-io.c +12 -1
@@ -559,7 +559,15 @@ static noinline int check_leaf(struct btu32 nritems =btrfs_header_nritems (leaf);int slot; -if (nritems ==0 ) { +/* +* Extent buffers from a relocation tree have a owner field that +* corresponds to the subvolume tree they are based on. So just from an +* extent buffer alone we can not find out what is the id of the +* corresponding subvolume tree, so we can not figure out if the extent +* buffer corresponds to the root of the relocation tree or not. So skip +* this check for relocation trees. +*/ +if (nritems ==0 && !btrfs_header_flag (leaf,BTRFS_HEADER_FLAG_RELOC )) {struct btrfs_root *check_root; key.objectid =btrfs_header_owner (leaf);
@@ -587,6 +595,9 @@ static noinline int check_leaf(struct btreturn 0 ; } +if (nritems ==0 ) +return 0 ; +/* Check the 0 item */ if (btrfs_item_offset_nr (leaf,0 ) +btrfs_item_size_nr (leaf,0 ) !=BTRFS_LEAF_DATA_SIZE (root)) {
Greg Kroah-Hartman
maintainerPATCH 9/83 Btrfs: fix qgroup rescan worker initialization
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
commit 8d9eddad19467b008e0c881bc3133d7da94b7ec1 upstream.
We were setting the qgroup_rescan_running flag to true only after the rescan worker started (which is a task run by a queue). So if a user space task starts a rescan and immediately after asks to wait for the rescan worker to finish, this second call might happen before the rescan worker task starts running, in which case the rescan wait ioctl returns immediatley, not waiting for the rescan worker to finish.
This was making the fstest btrfs/022 fail very often.
--- fs/btrfs/qgroup.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
fs/btrfs/qgroup.c +1 -4
@@ -2335,10 +2335,6 @@ static void btrfs_qgroup_rescan_worker(sint err = -ENOMEM ;int ret =0 ; -mutex_lock (&fs_info->qgroup_rescan_lock); - fs_info->qgroup_rescan_running = true; -mutex_unlock (&fs_info->qgroup_rescan_lock); - path =btrfs_alloc_path ();if (!path) goto out;
@@ -2449,6 +2445,7 @@ qgroup_rescan_init(struct btrfs_fs_info sizeof(fs_info->qgroup_rescan_progress)); fs_info->qgroup_rescan_progress.objectid = progress_objectid;init_completion (&fs_info->qgroup_rescan_completion); + fs_info->qgroup_rescan_running = true;spin_unlock (&fs_info->qgroup_lock);mutex_unlock (&fs_info->qgroup_rescan_lock);
Greg Kroah-Hartman
maintainerPATCH 10/83 USB: serial: option: add support for Telit LE922A PIDs 0x1040, 0x1041
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniele Palmas <[email protected]>
commit 5b09eff0c379002527ad72ea5ea38f25da8a8650 upstream.
This patch adds support for PIDs 0x1040, 0x1041 of Telit LE922A.
Since the interface positions are the same than the ones used for other Telit compositions, previous defined blacklists are used.
--- drivers/usb/serial/option.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/usb/serial/option.c +6 -0
@@ -268,6 +268,8 @@ static void option_instat_callback(struc#define TELIT_PRODUCT_CC864_SINGLE 0x1006#define TELIT_PRODUCT_DE910_DUAL 0x1010#define TELIT_PRODUCT_UE910_V2 0x1012 +#define TELIT_PRODUCT_LE922_USBCFG1 0x1040 +#define TELIT_PRODUCT_LE922_USBCFG2 0x1041#define TELIT_PRODUCT_LE922_USBCFG0 0x1042#define TELIT_PRODUCT_LE922_USBCFG3 0x1043#define TELIT_PRODUCT_LE922_USBCFG5 0x1045
@@ -1210,6 +1212,10 @@ static const struct usb_device_id option { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UE910_V2) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG0), .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg0 }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG1), + .driver_info = (kernel_ulong_t)&telit_le910_blacklist }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG2), + .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG3), .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG5, 0xff),
Greg Kroah-Hartman
maintainerPATCH 11/83 USB: serial: option: add dlink dwm-158
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Giuseppe Lippolis <[email protected]>
commit d8a12b7117b42fd708f1e908498350232bdbd5ff upstream.
Adding registration for 3G modem DWM-158 in usb-serial-option
--- drivers/usb/serial/option.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/serial/option.c +1 -0
@@ -1995,6 +1995,7 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d02, 0xff, 0x00, 0x00) }, { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x02, 0x01) }, { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x00, 0x00) }, + { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7d04, 0xff) }, /* D-Link DWM-158 */ { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e19, 0xff), /* D-Link DWM-221 B1 */ .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */
Greg Kroah-Hartman
maintainerPATCH 12/83 USB: serial: kl5kusb105: fix open error path
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 6774d5f53271d5f60464f824748995b71da401ab upstream.
Kill urbs and disable read before returning from open on failure to retrieve the line state.
--- drivers/usb/serial/kl5kusb105.c | 33 ++++++++++++++++++++++++--------- 1 file changed, 24 insertions(+), 9 deletions(-)
drivers/usb/serial/kl5kusb105.c +24 -9
@@ -296,7 +296,7 @@ static int klsi_105_open(struct tty_str rc =usb_serial_generic_open (tty, port);if (rc) { retval = rc; - goto exit; + goto err_free_cfg; } rc = usb_control_msg(port->serial->dev,
@@ -315,17 +315,32 @@ static int klsi_105_open(struct tty_strdev_dbg (&port->dev,"%s - enabled reading\n" , __func__); rc =klsi_105_get_line_state (port, &line_state); -if (rc >=0 ) { -spin_lock_irqsave (&priv->lock, flags); - priv->line_state = line_state; -spin_unlock_irqrestore (&priv->lock, flags); -dev_dbg (&port->dev,"%s - read line state 0x%lx\n" , __func__, line_state); - retval =0 ; - }else +if (rc <0 ) { retval = rc; + goto err_disable_read; + } + +spin_lock_irqsave (&priv->lock, flags); + priv->line_state = line_state; +spin_unlock_irqrestore (&priv->lock, flags); +dev_dbg (&port->dev,"%s - read line state 0x%lx\n" , __func__, + line_state); + +return 0 ; -exit: +err_disable_read: +usb_control_msg (port->serial->dev, +usb_sndctrlpipe (port->serial->dev,0 ), +KL5KUSB105A_SIO_CONFIGURE , +USB_TYPE_VENDOR |USB_DIR_OUT , +KL5KUSB105A_SIO_CONFIGURE_READ_OFF , +0 ,/* index */ +NULL ,0 , +KLSI_TIMEOUT ); +usb_serial_generic_close (port); +err_free_cfg:kfree (cfg); +return retval; }
Greg Kroah-Hartman
maintainerPATCH 13/83 USB: cdc-acm: add device id for GW Instek AFG-125
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathaniel Quillin <[email protected]>
commit 301216044e4c27d5a7323c1fa766266fad00db5e upstream.
Add device-id entry for GW Instek AFG-125, which has a byte swapped bInterfaceSubClass (0x20).
--- drivers/usb/class/cdc-acm.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/class/cdc-acm.c +1 -0
@@ -1719,6 +1719,7 @@ static const struct usb_device_id acm_id { USB_DEVICE(0x20df, 0x0001), /* Simtec Electronics Entropy Key */ .driver_info = QUIRK_CONTROL_LINE_STATE, }, { USB_DEVICE(0x2184, 0x001c) }, /* GW Instek AFG-2225 */ + { USB_DEVICE(0x2184, 0x0036) }, /* GW Instek AFG-125 */ { USB_DEVICE(0x22b8, 0x6425), /* Motorola MOTOMAGX phones */ },/* Motorola H24 HSPA module: */
Greg Kroah-Hartman
maintainerPATCH 14/83 usb: dwc3: gadget: set PCM1 field of isochronous-first TRBs
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felipe Balbi <[email protected]>
commit 6b9018d4c1e5c958625be94a160a5984351d4632 upstream.
In case of High-Speed, High-Bandwidth endpoints, we need to tell DWC3 that we have more than one packet per interval. We do that by setting PCM1 field of Isochronous-First TRB.
--- drivers/usb/dwc3/gadget.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
drivers/usb/dwc3/gadget.c +11 -2
@@ -771,6 +771,9 @@ static void dwc3_prepare_one_trb(struct unsigned length, unsigned chain, unsigned node) { struct dwc3_trb *trb; +struct dwc3 *dwc = dep->dwc; +struct usb_gadget *gadget = &dwc->gadget; +enum usb_device_speed speed = gadget->speed; dwc3_trace(trace_dwc3_gadget, "%s: req %p dma %08llx length %d%s", dep->name, req, (unsigned long long) dma,
@@ -798,10 +801,16 @@ static void dwc3_prepare_one_trb(structbreak ;case USB_ENDPOINT_XFER_ISOC : -if (!node) +if (!node) { trb->ctrl =DWC3_TRBCTL_ISOCHRONOUS_FIRST ; -else + +if (speed ==USB_SPEED_HIGH ) { +struct usb_ep *ep = &dep->endpoint; + trb->size |=DWC3_TRB_SIZE_PCM1 (ep->mult -1 ); + } + }else { trb->ctrl =DWC3_TRBCTL_ISOCHRONOUS ; + }/* always enable Interrupt on Missed ISOC */ trb->ctrl |=DWC3_TRB_CTRL_ISP_IMI ;
Greg Kroah-Hartman
maintainerPATCH 15/83 usb: hub: Fix auto-remount of safely removed or ejected USB-3 devices
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <[email protected]>
commit 37be66767e3cae4fd16e064d8bb7f9f72bf5c045 upstream.
USB-3 does not have any link state that will avoid negotiating a connection with a plugged-in cable but will signal the host when the cable is unplugged.
For USB-3 we used to first set the link to Disabled, then to RxDdetect to be able to detect cable connects or disconnects. But in RxDetect the connected device is detected again and eventually enabled.
Instead set the link into U3 and disable remote wakeups for the device. This is what Windows does, and what Alan Stern suggested.
--- drivers/usb/core/hub.c | 101 +++++++++++++++++-------------------------------- 1 file changed, 36 insertions(+), 65 deletions(-)
drivers/usb/core/hub.c +36 -65
@@ -101,6 +101,8 @@ EXPORT_SYMBOL_GPL(ehci_cf_port_reset_rwsstatic void hub_release (struct kref *kref);static int usb_reset_and_verify_device (struct usb_device *udev); +static void hub_usb3_port_prepare_disable (struct usb_hub *hub, +struct usb_port *port_dev);static inline char *portspeed (struct usb_hub *hub,int portstatus) {
@@ -899,82 +901,28 @@ static int hub_set_port_link_state(struc }/* -* If USB 3.0 ports are placed into the Disabled state, they will no longer -* detect any device connects or disconnects. This is generally not what the -* USB core wants, since it expects a disabled port to produce a port status -* change event when a new device connects. -* -* Instead, set the link state to Disabled, wait for the link to settle into -* that state, clear any change bits, and then put the port into the RxDetect -* state. +* USB-3 does not have a similar link state as USB-2 that will avoid negotiating +* a connection with a plugged-in cable but will signal the host when the cable +* is unplugged. Disable remote wake and set link state to U3 for USB-3 devices */ -static int hub_usb3_port_disable (struct usb_hub *hub,int port1) -{ -int ret; -int total_time; -u16 portchange, portstatus; - -if (!hub_is_superspeed (hub->hdev)) -return -EINVAL ; - - ret =hub_port_status (hub, port1, &portstatus, &portchange); -if (ret <0 ) -return ret; - -/* -* USB controller Advanced Micro Devices, Inc. [AMD] FCH USB XHCI -* Controller [1022:7814] will have spurious result making the following -* usb 3.0 device hotplugging route to the 2.0 root hub and recognized -* as high-speed device if we set the usb 3.0 port link state to -* Disabled. Since it's already in USB_SS_PORT_LS_RX_DETECT state, we -* check the state here to avoid the bug. -*/ -if ((portstatus &USB_PORT_STAT_LINK_STATE ) == -USB_SS_PORT_LS_RX_DETECT ) { -dev_dbg (&hub->ports[port1 -1 ]->dev, -"Not disabling port; link state is RxDetect\n" ); -return ret; - } - - ret =hub_set_port_link_state (hub, port1,USB_SS_PORT_LS_SS_DISABLED ); -if (ret) -return ret; - -/* Wait for the link to enter the disabled state. */ -for (total_time =0 ; ; total_time +=HUB_DEBOUNCE_STEP ) { - ret =hub_port_status (hub, port1, &portstatus, &portchange); -if (ret <0 ) -return ret; - -if ((portstatus &USB_PORT_STAT_LINK_STATE ) == -USB_SS_PORT_LS_SS_DISABLED ) -break ; -if (total_time >=HUB_DEBOUNCE_TIMEOUT ) -break ; -msleep (HUB_DEBOUNCE_STEP ); - } -if (total_time >=HUB_DEBOUNCE_TIMEOUT ) -dev_warn (&hub->ports[port1 -1 ]->dev, -"Could not disable after %d ms\n" , total_time); - -return hub_set_port_link_state (hub, port1,USB_SS_PORT_LS_RX_DETECT ); -} -static int hub_port_disable (struct usb_hub *hub,int port1,int set_state) {struct usb_port *port_dev = hub->ports[port1 -1 ];struct usb_device *hdev = hub->hdev;int ret =0 ; -if (port_dev->child && set_state) -usb_set_device_state (port_dev->child,USB_STATE_NOTATTACHED );if (!hub->error) { -if (hub_is_superspeed (hub->hdev)) - ret =hub_usb3_port_disable (hub, port1); -else +if (hub_is_superspeed (hub->hdev)) { +hub_usb3_port_prepare_disable (hub, port_dev); + ret =hub_set_port_link_state (hub, port_dev->portnum, +USB_SS_PORT_LS_U3 ); + }else { ret =usb_clear_port_feature (hdev, port1,USB_PORT_FEAT_ENABLE ); + } } +if (port_dev->child && set_state) +usb_set_device_state (port_dev->child,USB_STATE_NOTATTACHED );if (ret && ret != -ENODEV )dev_err (&port_dev->dev,"cannot disable (err = %d)\n" , ret);return ret;
@@ -4140,6 +4088,26 @@ void usb_unlocked_enable_lpm(struct usb_ }EXPORT_SYMBOL_GPL (usb_unlocked_enable_lpm); +/* usb3 devices use U3 for disabled, make sure remote wakeup is disabled */ +static void hub_usb3_port_prepare_disable (struct usb_hub *hub, +struct usb_port *port_dev) +{ +struct usb_device *udev = port_dev->child; +int ret; + +if (udev && udev->port_is_suspended && udev->do_remote_wakeup) { + ret =hub_set_port_link_state (hub, port_dev->portnum, +USB_SS_PORT_LS_U0 ); +if (!ret) { +msleep (USB_RESUME_TIMEOUT ); + ret =usb_disable_remote_wakeup (udev); + } +if (ret) +dev_warn (&udev->dev, +"Port disable: can't disable remote wake\n" ); + udev->do_remote_wakeup =0 ; + } +}#else /* CONFIG_PM */
@@ -4147,6 +4115,9 @@ EXPORT_SYMBOL_GPL(usb_unlocked_enable_lp#define hub_resume NULL#define hub_reset_resume NULL +static inline void hub_usb3_port_prepare_disable (struct usb_hub *hub, +struct usb_port *port_dev) { } +int usb_disable_lpm (struct usb_device *udev) {return 0 ;
Greg Kroah-Hartman
maintainerPATCH 17/83 usb: gadget: f_uac2: fix error handling at afunc_bind
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Chen <[email protected]>
commit f1d3861d63a5d79b8968a02eea1dcb01bb684e62 upstream.
The current error handling flow uses incorrect goto label, fix it
--- drivers/usb/gadget/function/f_uac2.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
drivers/usb/gadget/function/f_uac2.c +7 -7
@@ -1067,13 +1067,13 @@ afunc_bind(struct usb_configuration *cfg agdev->out_ep =usb_ep_autoconfig (gadget, &fs_epout_desc);if (!agdev->out_ep) {dev_err (dev,"%s:%d Error!\n" , __func__, __LINE__); - goto err; +return ret; } agdev->in_ep =usb_ep_autoconfig (gadget, &fs_epin_desc);if (!agdev->in_ep) {dev_err (dev,"%s:%d Error!\n" , __func__, __LINE__); - goto err; +return ret; } uac2->p_prm.uac2 = uac2;
@@ -1091,7 +1091,7 @@ afunc_bind(struct usb_configuration *cfg ret =usb_assign_descriptors (fn, fs_audio_desc, hs_audio_desc,NULL ,NULL );if (ret) - goto err; +return ret; prm = &agdev->uac2.c_prm; prm->max_psize = hs_epout_desc.wMaxPacketSize;
@@ -1106,19 +1106,19 @@ afunc_bind(struct usb_configuration *cfg prm->rbuf =kzalloc (prm->max_psize *USB_XFERS ,GFP_KERNEL );if (!prm->rbuf) { prm->max_psize =0 ; - goto err_free_descs; + goto err; } ret =alsa_uac2_init (agdev);if (ret) - goto err_free_descs; + goto err;return 0 ; -err_free_descs: -usb_free_all_descriptors (fn); err:kfree (agdev->uac2.p_prm.rbuf);kfree (agdev->uac2.c_prm.rbuf); +err_free_descs: +usb_free_all_descriptors (fn);return -EINVAL ; }
Greg Kroah-Hartman
maintainerPATCH 18/83 usb: gadget: composite: correctly initialize ep->maxpacket
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felipe Balbi <[email protected]>
commit e8f29bb719b47a234f33b0af62974d7a9521a52c upstream.
usb_endpoint_maxp() returns wMaxPacketSize in its raw form. Without taking into consideration that it also contains other bits reserved for isochronous endpoints.
This patch fixes one occasion where this is a problem by making sure that we initialize ep->maxpacket only with lower 10 bits of the value returned by usb_endpoint_maxp(). Note that seperate patches will be necessary to audit all call sites of usb_endpoint_maxp() and make sure that usb_endpoint_maxp() only returns lower 10 bits of wMaxPacketSize.
--- drivers/usb/gadget/composite.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/gadget/composite.c +1 -1
@@ -197,7 +197,7 @@ int config_ep_by_speed(struct usb_gadget ep_found:/* commit results */ - _ep->maxpacket =usb_endpoint_maxp (chosen_desc); + _ep->maxpacket =usb_endpoint_maxp (chosen_desc) &0x7ff ; _ep->desc = chosen_desc; _ep->comp_desc =NULL ; _ep->maxburst =0 ;
Greg Kroah-Hartman
maintainerPATCH 19/83 USB: UHCI: report non-PME wakeup signalling for Intel hardware
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <[email protected]>
commit ccdb6be9ec6580ef69f68949ebe26e0fb58a6fb0 upstream.
The UHCI controllers in Intel chipsets rely on a platform-specific non-PME mechanism for wakeup signalling. They can generate wakeup signals even though they don't support PME.
We need to let the USB core know this so that it will enable runtime suspend for UHCI controllers.
--- drivers/usb/host/uhci-pci.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/usb/host/uhci-pci.c +4 -0
@@ -129,6 +129,10 @@ static int uhci_pci_init(struct usb_hcdif (to_pci_dev (uhci_dev (uhci))->vendor ==PCI_VENDOR_ID_HP ) uhci->wait_for_hp =1 ; +/* Intel controllers use non-PME wakeup signalling */ +if (to_pci_dev (uhci_dev (uhci))->vendor ==PCI_VENDOR_ID_INTEL ) +device_set_run_wake (uhci_dev (uhci),1 ); +/* Set up pointers to PCI-specific functions */ uhci->reset_hc = uhci_pci_reset_hc; uhci->check_and_reset_hc = uhci_pci_check_and_reset_hc;
Greg Kroah-Hartman
maintainerPATCH 20/83 usbip: vudc: fix: Clear already_seen flag also for ep0
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Opasiak <[email protected]>
commit 3e448e13a662fb20145916636127995cbf37eb83 upstream.
ep_list inside gadget structure doesn't contain ep0. It is stored separately in ep0 field.
This causes an urb hang if gadget driver decides to delay setup handling. On host side this is visible as timeout error when setting configuration.
This bug can be reproduced using for example any gadget with mass storage function.
--- drivers/usb/usbip/vudc_transfer.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/usbip/vudc_transfer.c +2 -0
@@ -339,6 +339,8 @@ static void v_timer(unsigned long _vudc) total = timer->frame_limit; } +/* We have to clear ep0 flags separately as it's not on the list */ + udc->ep[0 ].already_seen =0 ;list_for_each_entry (_ep, &udc->gadget.ep_list, ep_list) { ep =to_vep (_ep); ep->already_seen =0 ;
Greg Kroah-Hartman
maintainerPATCH 21/83 ALSA: usb-audio: Add QuickCam Communicate Deluxe/S7500 to volume_control_quirks
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Con Kolivas <[email protected]>
commit 82ffb6fc637150b279f49e174166d2aa3853eaf4 upstream.
The Logitech QuickCam Communicate Deluxe/S7500 microphone fails with the following warning.
[ 6.778995] usb 2-1.2.2.2: Warning! Unlikely big volume range (=3072), cval->res is probably wrong. [ 6.778996] usb 2-1.2.2.2: [5] FU [Mic Capture Volume] ch = 1, val =
4608/7680/1
Adding it to the list of devices in volume_control_quirks makes it work properly, fixing related typo.
--- sound/usb/mixer.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
sound/usb/mixer.c +2 -1
@@ -932,9 +932,10 @@ static void volume_control_quirks(structcase USB_ID (0x046d ,0x0826 ):/* HD Webcam c525 */ case USB_ID (0x046d ,0x08ca ):/* Logitech Quickcam Fusion */ case USB_ID (0x046d ,0x0991 ): +case USB_ID (0x046d ,0x09a2 ):/* QuickCam Communicate Deluxe/S7500 */ /* Most audio usb devices lie about volume resolution. * Most Logitech webcams have res = 384. -* Proboly there is some logitech magic behind this number --fishor +* Probably there is some logitech magic behind this number --fishor */ if (!strcmp (kctl->id.name,"Mic Capture Volume" )) { usb_audio_info(chip,
Greg Kroah-Hartman
maintainerPATCH 22/83 ALSA: hiface: Fix M2Tech hiFace driver sampling rate change
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jussi Laako <[email protected]>
commit 995c6a7fd9b9212abdf01160f6ce3193176be503 upstream.
Sampling rate changes after first set one are not reflected to the hardware, while driver and ALSA think the rate has been changed.
Fix the problem by properly stopping the interface at the beginning of prepare call, allowing new rate to be set to the hardware. This keeps the hardware in sync with the driver.
--- sound/usb/hiface/pcm.c | 2 ++ 1 file changed, 2 insertions(+)
sound/usb/hiface/pcm.c +2 -0
@@ -445,6 +445,8 @@ static int hiface_pcm_prepare(struct sndmutex_lock (&rt->stream_mutex); +hiface_pcm_stream_stop (rt); + sub->dma_off =0 ; sub->period_off =0 ;
Greg Kroah-Hartman
maintainerPATCH 23/83 ALSA: hda/ca0132 - Add quirk for Alienware 15 R2 2016
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Hahne <[email protected]>
commit b5337cfe067e96b8a98699da90c7dcd2bec21133 upstream.
I'm using an Alienware 15 R2 and had to use the alienware quirks to get my headphone output working.
I fixed it by adding, SND_PCI_QUIRK(0x1028, 0x0708, "Alienware 15 R2 2016", QUIRK_ALIENWARE) to the patch.
--- sound/pci/hda/patch_ca0132.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_ca0132.c +1 -0
@@ -780,6 +780,7 @@ static const struct hda_pintbl alienwarestatic const struct snd_pci_quirk ca0132_quirks[] = {SND_PCI_QUIRK (0x1028 ,0x0685 ,"Alienware 15 2015" ,QUIRK_ALIENWARE ),SND_PCI_QUIRK (0x1028 ,0x0688 ,"Alienware 17 2015" ,QUIRK_ALIENWARE ), +SND_PCI_QUIRK (0x1028 ,0x0708 ,"Alienware 15 R2 2016" ,QUIRK_ALIENWARE ), {} };
Greg Kroah-Hartman
maintainerPATCH 24/83 ALSA: hda - ignore the assoc and seq when comparing pin configurations
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hui Wang <[email protected]>
commit 64047d7f4912de1769d1bf0d34c6322494b13779 upstream.
More and more pin configurations have been adding to the pin quirk table, lots of them are only different from assoc and seq, but they all apply to the same QUIRK_FIXUP, if we don't compare assoc and seq when matching pin configurations, it will greatly reduce the pin quirk table size.
We have tested this change on a couple of Dell laptops, it worked well.
--- sound/pci/hda/hda_auto_parser.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/pci/hda/hda_auto_parser.c +1 -1
@@ -901,7 +901,7 @@ static bool pin_config_match(struct hda_for (; t_pins->nid; t_pins++) {if (t_pins->nid == nid) { found =1 ; -if (t_pins->val == cfg) +if ((t_pins->val &0xfffffff0 ) == (cfg &0xfffffff0 ))break ;else if ((cfg &0xf0000000 ) ==0x40000000 && (t_pins->val &0xf0000000 ) ==0x40000000 )break ;
Greg Kroah-Hartman
maintainerPATCH 25/83 ALSA: hda - fix headset-mic problem on a Dell laptop
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hui Wang <[email protected]>
commit 989dbe4a30728c047316ab87e5fa8b609951ce7c upstream.
This group of new pins is not in the pin quirk table yet, adding them to the pin quirk table to fix the headset-mic problem.
--- sound/pci/hda/patch_realtek.c | 3 +++ 1 file changed, 3 insertions(+)
sound/pci/hda/patch_realtek.c +3 -0
@@ -5917,6 +5917,9 @@ static const struct snd_hda_pin_quirk al {0x12, 0x90a60180}, {0x14, 0x90170120}, {0x21, 0x02211030}), + SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, + {0x1b, 0x01011020}, + {0x21, 0x02211010}), SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, {0x12, 0x90a60160}, {0x14, 0x90170120},
Greg Kroah-Hartman
maintainerPATCH 26/83 ALSA: hda - Gate the mic jack on HP Z1 Gen3 AiO
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit f73cd43ac3b41c0f09a126387f302bbc0d9c726d upstream.
HP Z1 Gen3 AiO with Conexant codec doesn't give an unsolicited event to the headset mic pin upon the jack plugging, it reports only to the headphone pin. It results in the missing mic switching. Let's fix up by simply gating the jack event.
--- sound/pci/hda/patch_conexant.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+)
sound/pci/hda/patch_conexant.c +17 -0
@@ -262,6 +262,7 @@ enum {CXT_FIXUP_CAP_MIX_AMP_5047 ,CXT_FIXUP_MUTE_LED_EAPD ,CXT_FIXUP_HP_SPECTRE , + CXT_FIXUP_HP_GATE_MIC, };/* for hda_fixup_thinkpad_acpi() */
@@ -633,6 +634,17 @@ static void cxt_fixup_cap_mix_amp_5047(s (1 << AC_AMPCAP_MUTE_SHIFT)); } +static void cxt_fixup_hp_gate_mic_jack (struct hda_codec *codec, +const struct hda_fixup *fix, +int action) +{ +/* the mic pin (0x19) doesn't give an unsolicited event; +* probe the mic pin together with the headphone pin (0x16) +*/ +if (action ==HDA_FIXUP_ACT_PROBE ) +snd_hda_jack_set_gating_jack (codec,0x19 ,0x16 ); +} +/* ThinkPad X200 & co with cxt5051 */ static const struct hda_pintbl cxt_pincfg_lenovo_x200[] = { {0x16 ,0x042140ff },/* HP (seq# overridden) */
@@ -774,6 +786,10 @@ static const struct hda_fixup cxt_fixups { } } }, + [CXT_FIXUP_HP_GATE_MIC] = { + .type = HDA_FIXUP_FUNC, + .v.func = cxt_fixup_hp_gate_mic_jack, + }, };static const struct snd_pci_quirk cxt5045_fixups[] = {
@@ -824,6 +840,7 @@ static const struct snd_pci_quirk cxt506SND_PCI_QUIRK (0x1025 ,0x054c ,"Acer Aspire 3830TG" ,CXT_FIXUP_ASPIRE_DMIC ),SND_PCI_QUIRK (0x1025 ,0x054f ,"Acer Aspire 4830T" ,CXT_FIXUP_ASPIRE_DMIC ),SND_PCI_QUIRK (0x103c ,0x8174 ,"HP Spectre x360" ,CXT_FIXUP_HP_SPECTRE ), +SND_PCI_QUIRK (0x103c ,0x8115 ,"HP Z1 Gen3" ,CXT_FIXUP_HP_GATE_MIC ),SND_PCI_QUIRK (0x1043 ,0x138d ,"Asus" ,CXT_FIXUP_HEADPHONE_MIC_PIN ),SND_PCI_QUIRK (0x152d ,0x0833 ,"OLPC XO-1.5" ,CXT_FIXUP_OLPC_XO ), SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo T400", CXT_PINCFG_LENOVO_TP410),
Greg Kroah-Hartman
maintainerPATCH 27/83 ALSA: hda: when comparing pin configurations, ignore assoc in addition to seq
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kai-Heng Feng <[email protected]>
commit 5e0ad0d8747f3e4803a9c3d96d64dd7332506d3c upstream.
Commit [64047d7f4912 ALSA: hda - ignore the assoc and seq when comparing pin configurations] intented to ignore both seq and assoc at pin comparing, but it only ignored seq. So that commit may still fail to match pins on some machines.
Change the bitmask to also ignore assoc.
v2: Use macro to do bit masking.
Thanks to Hui Wang for the analysis.
--- sound/pci/hda/hda_auto_parser.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
sound/pci/hda/hda_auto_parser.c +3 -1
@@ -884,6 +884,8 @@ void snd_hda_apply_fixup(struct hda_code }EXPORT_SYMBOL_GPL (snd_hda_apply_fixup); +#define IGNORE_SEQ_ASSOC (~(AC_DEFCFG_SEQUENCE | AC_DEFCFG_DEF_ASSOC)) +static bool pin_config_match (struct hda_codec *codec,const struct hda_pintbl *pins) {
@@ -901,7 +903,7 @@ static bool pin_config_match(struct hda_for (; t_pins->nid; t_pins++) {if (t_pins->nid == nid) { found =1 ; -if ((t_pins->val &0xfffffff0 ) == (cfg &0xfffffff0 )) +if ((t_pins->val &IGNORE_SEQ_ASSOC ) == (cfg &IGNORE_SEQ_ASSOC ))break ;else if ((cfg &0xf0000000 ) ==0x40000000 && (t_pins->val &0xf0000000 ) ==0x40000000 )break ;
Greg Kroah-Hartman
maintainerPATCH 28/83 clk: ti: omap36xx: Work around sprz319 advisory 2.1
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Watts <[email protected]>
commit 035cd485a47dda64f25ccf8a90b11a07d0b7aa7a upstream.
The OMAP36xx DPLL5, driving EHCI USB, can be subject to a long-term frequency drift. The frequency drift magnitude depends on the VCO update rate, which is inversely proportional to the PLL divider. The kernel DPLL configuration code results in a high value for the divider, leading to a long term drift high enough to cause USB transmission errors. In the worst case the USB PHY's ULPI interface can stop responding, breaking USB operation completely. This manifests itself on the Beagleboard xM by the LAN9514 reporting 'Cannot enable port 2. Maybe the cable is bad?' in the kernel log.
Errata sprz319 advisory 2.1 documents PLL values that minimize the drift. Use them automatically when DPLL5 is used for USB operation, which we detect based on the requested clock rate. The clock framework will still compute the PLL parameters and resulting rate as usual, but the PLL M and N values will then be overridden. This can result in the effective clock rate being slightly different than the rate cached by the clock framework, but won't cause any adverse effect to USB operation.
--- drivers/clk/ti/clk-3xxx.c | 20 ++++++------- drivers/clk/ti/clock.h | 9 ++++++ drivers/clk/ti/dpll.c | 19 ++++++++++++- drivers/clk/ti/dpll3xxx.c | 67 ++++++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 104 insertions(+), 11 deletions(-)
drivers/clk/ti/clk-3xxx.c +10 -10
@@ -22,13 +22,6 @@#include "clock.h" -/* -* DPLL5_FREQ_FOR_USBHOST: USBHOST and USBTLL are the only clocks -* that are sourced by DPLL5, and both of these require this clock -* to be at 120 MHz for proper operation. -*/ -#define DPLL5_FREQ_FOR_USBHOST 120000000 -#define OMAP3430ES2_ST_DSS_IDLE_SHIFT 1#define OMAP3430ES2_ST_HSOTGUSB_IDLE_SHIFT 5#define OMAP3430ES2_ST_SSI_IDLE_SHIFT 8
@@ -546,14 +539,21 @@ void __init omap3_clk_lock_dpll5(void)struct clk *dpll5_clk;struct clk *dpll5_m2_clk; +/* +* Errata sprz319f advisory 2.1 documents a USB host clock drift issue +* that can be worked around using specially crafted dpll5 settings +* with a dpll5_m2 divider set to 8. Set the dpll5 rate to 8x the USB +* host clock rate, its .set_rate handler() will detect that frequency +* and use the errata settings. +*/ dpll5_clk =clk_get (NULL ,"dpll5_ck" ); -clk_set_rate (dpll5_clk,DPLL5_FREQ_FOR_USBHOST ); +clk_set_rate (dpll5_clk,OMAP3_DPLL5_FREQ_FOR_USBHOST *8 );clk_prepare_enable (dpll5_clk); -/* Program dpll5_m2_clk divider for no division */ +/* Program dpll5_m2_clk divider */ dpll5_m2_clk =clk_get (NULL ,"dpll5_m2_ck" );clk_prepare_enable (dpll5_m2_clk); -clk_set_rate (dpll5_m2_clk,DPLL5_FREQ_FOR_USBHOST ); +clk_set_rate (dpll5_m2_clk,OMAP3_DPLL5_FREQ_FOR_USBHOST );clk_disable_unprepare (dpll5_m2_clk);clk_disable_unprepare (dpll5_clk);
drivers/clk/ti/clock.h +9 -0
@@ -257,11 +257,20 @@ long omap2_dpll_round_rate(struct clk_hwunsigned long omap3_clkoutx2_recalc (struct clk_hw *hw,unsigned long parent_rate); +/* +* OMAP3_DPLL5_FREQ_FOR_USBHOST: USBHOST and USBTLL are the only clocks +* that are sourced by DPLL5, and both of these require this clock +* to be at 120 MHz for proper operation. +*/ +#define OMAP3_DPLL5_FREQ_FOR_USBHOST 120000000 +unsigned long omap3_dpll_recalc (struct clk_hw *hw,unsigned long parent_rate);int omap3_dpll4_set_rate (struct clk_hw *clk,unsigned long rate,unsigned long parent_rate);int omap3_dpll4_set_rate_and_parent (struct clk_hw *hw,unsigned long rate,unsigned long parent_rate,u8 index); +int omap3_dpll5_set_rate (struct clk_hw *hw,unsigned long rate, +unsigned long parent_rate);void omap3_clk_lock_dpll5 (void ); unsigned long omap4_dpll_regm4xen_recalc(struct clk_hw *hw,
drivers/clk/ti/dpll.c +18 -1
@@ -114,6 +114,18 @@ static const struct clk_ops omap3_dpll_c .round_rate = &omap2_dpll_round_rate, }; +static const struct clk_ops omap3_dpll5_ck_ops = { + .enable = &omap3_noncore_dpll_enable, + .disable = &omap3_noncore_dpll_disable, + .get_parent = &omap2_init_dpll_parent, + .recalc_rate = &omap3_dpll_recalc, + .set_rate = &omap3_dpll5_set_rate, + .set_parent = &omap3_noncore_dpll_set_parent, + .set_rate_and_parent = &omap3_noncore_dpll_set_rate_and_parent, + .determine_rate = &omap3_noncore_dpll_determine_rate, + .round_rate = &omap2_dpll_round_rate, +}; +static const struct clk_ops omap3_dpll_per_ck_ops = { .enable = &omap3_noncore_dpll_enable, .disable = &omap3_noncore_dpll_disable,
@@ -474,7 +486,12 @@ static void __init of_ti_omap3_dpll_setu .modes = (1 << DPLL_LOW_POWER_BYPASS) | (1 << DPLL_LOCKED), }; -of_ti_dpll_setup (node, &omap3_dpll_ck_ops, &dd); +if ((of_machine_is_compatible ("ti,omap3630" ) || +of_machine_is_compatible ("ti,omap36xx" )) && + !strcmp (node->name,"dpll5_ck" )) +of_ti_dpll_setup (node, &omap3_dpll5_ck_ops, &dd); +else +of_ti_dpll_setup (node, &omap3_dpll_ck_ops, &dd); }CLK_OF_DECLARE (ti_omap3_dpll_clock,"ti,omap3-dpll-clock" , of_ti_omap3_dpll_setup);
drivers/clk/ti/dpll3xxx.c +67 -0
70 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 29/83 exec: Ensure mm->user_ns contains the execed files
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric W. Biederman <[email protected]>
commit f84df2a6f268de584a201e8911384a2d244876e3 upstream.
When the user namespace support was merged the need to prevent ptrace from revealing the contents of an unreadable executable was overlooked.
Correct this oversight by ensuring that the executed file or files are in mm->user_ns, by adjusting mm->user_ns.
Use the new function privileged_wrt_inode_uidgid to see if the executable is a member of the user namespace, and as such if having CAP_SYS_PTRACE in the user namespace should allow tracing the executable. If not update mm->user_ns to the parent user namespace until an appropriate parent is found.
--- fs/exec.c | 19 +++++++++++++++++-- include/linux/capability.h | 1 + kernel/capability.c | 16 ++++++++++++++-- 3 files changed, 32 insertions(+), 4 deletions(-)
fs/exec.c +17 -2
@@ -1275,8 +1275,22 @@ EXPORT_SYMBOL(flush_old_exec);void would_dump (struct linux_binprm *bprm,struct file *file) { -if (inode_permission (file_inode (file),MAY_READ ) <0 ) +struct inode *inode =file_inode (file); +if (inode_permission (inode,MAY_READ ) <0 ) { +struct user_namespace *old, *user_ns; bprm->interp_flags |=BINPRM_FLAGS_ENFORCE_NONDUMP ; + +/* Ensure mm->user_ns contains the executable */ + user_ns = old = bprm->mm->user_ns; +while ((user_ns != &init_user_ns) && + !privileged_wrt_inode_uidgid (user_ns, inode)) + user_ns = user_ns->parent; + +if (old != user_ns) { + bprm->mm->user_ns =get_user_ns (user_ns); +put_user_ns (old); + } + } }EXPORT_SYMBOL (would_dump);
@@ -1306,7 +1320,6 @@ void setup_new_exec(struct linux_binprm !gid_eq(bprm->cred->gid, current_egid())) { current->pdeath_signal = 0; } else { -would_dump (bprm, bprm->file);if (bprm->interp_flags &BINPRM_FLAGS_ENFORCE_NONDUMP )set_dumpable (current->mm, suid_dumpable); }
@@ -1741,6 +1754,8 @@ static int do_execveat_common(int fd, stif (retval <0 ) goto out; +would_dump (bprm, bprm->file); + retval =exec_binprm (bprm);if (retval <0 ) goto out;
include/linux/capability.h +1 -0
@@ -240,6 +240,7 @@ static inline bool ns_capable_noaudit(st return true; }#endif /* CONFIG_MULTIUSER */ +extern bool privileged_wrt_inode_uidgid (struct user_namespace *ns,const struct inode *inode);extern bool capable_wrt_inode_uidgid (const struct inode *inode,int cap);extern bool file_ns_capable (const struct file *file,struct user_namespace *ns,int cap);
kernel/capability.c +14 -2
@@ -457,6 +457,19 @@ bool file_ns_capable(const struct file *EXPORT_SYMBOL (file_ns_capable);/** +* privileged_wrt_inode_uidgid - Do capabilities in the namespace work over the inode? +* @ns: The user namespace in question +* @inode: The inode in question +* +* Return true if the inode uid and gid are within the namespace. +*/ +bool privileged_wrt_inode_uidgid (struct user_namespace *ns,const struct inode *inode) +{ +return kuid_has_mapping (ns, inode->i_uid) && +kgid_has_mapping (ns, inode->i_gid); +} + +/** * capable_wrt_inode_uidgid - Check nsown_capable and uid and gid mapped * @inode: The inode in question * @cap: The capability in question
@@ -469,7 +482,6 @@ bool capable_wrt_inode_uidgid(const stru {struct user_namespace *ns =current_user_ns (); -return ns_capable (ns, cap) &&kuid_has_mapping (ns, inode->i_uid) && -kgid_has_mapping (ns, inode->i_gid); +return ns_capable (ns, cap) &&privileged_wrt_inode_uidgid (ns, inode); }EXPORT_SYMBOL (capable_wrt_inode_uidgid);
Greg Kroah-Hartman
maintainerPATCH 30/83 fs: exec: apply CLOEXEC before changing dumpable task flags
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksa Sarai <[email protected]>
commit 613cc2b6f272c1a8ad33aefa21cad77af23139f7 upstream.
If you have a process that has set itself to be non-dumpable, and it then undergoes exec(2), any CLOEXEC file descriptors it has open are "exposed" during a race window between the dumpable flags of the process being reset for exec(2) and CLOEXEC being applied to the file descriptors. This can be exploited by a process by attempting to access /proc/<pid>/fd/... during this window, without requiring CAP_SYS_PTRACE.
The race in question is after set_dumpable has been (for get_link, though the trace is basically the same for readlink):
[vfs]
-> proc_pid_link_inode_operations.get_link
-> proc_pid_get_link
-> proc_fd_access_allowed
-> ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS);Which will return 0, during the race window and CLOEXEC file descriptors will still be open during this window because do_close_on_exec has not been called yet. As a result, the ordering of these calls should be reversed to avoid this race window.
This is of particular concern to container runtimes, where joining a PID namespace with file descriptors referring to the host filesystem can result in security issues (since PRCTL_SET_DUMPABLE doesn't protect against access of CLOEXEC file descriptors -- file descriptors which may reference filesystem objects the container shouldn't have access to).
--- fs/exec.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
fs/exec.c +8 -2
@@ -19,7 +19,7 @@* current->executable is only used by the procfs. This allows a dispatch * table to check for several different types of binary formats. We keep * trying until we recognize the file or we run out of supported binary -* formats. +* formats. */ #include <linux/slab.h>
@@ -1266,6 +1266,13 @@ int flush_old_exec(struct linux_binprm *flush_thread (); current->personality &= ~bprm->per_clear; +/* +* We have to apply CLOEXEC before we change whether the process is +* dumpable (in setup_new_exec) to avoid a race with a process in userspace +* trying to access the should-be-closed file descriptors of a process +* undergoing exec(2). +*/ +do_close_on_exec (current->files);return 0 ; out:
@@ -1328,7 +1335,6 @@ void setup_new_exec(struct linux_binprmgroup */ current->self_exec_id++;flush_signal_handlers (current,0 ); -do_close_on_exec (current->files); }EXPORT_SYMBOL (setup_new_exec);
Greg Kroah-Hartman
maintainerPATCH 31/83 splice: reinstate SIGPIPE/EPIPE handling
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Torvalds <[email protected]>
commit 52bce91165e5f2db422b2b972e83d389e5e4725c upstream.
Commit 8924feff66f3 ("splice: lift pipe_lock out of splice_to_pipe()") caused a regression when there were no more readers left on a pipe that was being spliced into: rather than the expected SIGPIPE and -EPIPE return value, the writer would end up waiting forever for space to free up (which obviously was not going to happen with no readers around).
--- fs/splice.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
fs/splice.c +7 -2
@@ -1086,7 +1086,13 @@ EXPORT_SYMBOL(do_splice_direct);static int wait_for_space (struct pipe_inode_info *pipe,unsigned flags) { -while (pipe->nrbufs == pipe->buffers) { +for (;;) { +if (unlikely (!pipe->readers)) { +send_sig (SIGPIPE , current,0 ); +return -EPIPE ; + } +if (pipe->nrbufs != pipe->buffers) +return 0 ;if (flags &SPLICE_F_NONBLOCK )return -EAGAIN ;if (signal_pending (current))
@@ -1095,7 +1101,6 @@ static int wait_for_space(struct pipe_inpipe_wait (pipe); pipe->waiting_writers--; } -return 0 ; } static int splice_pipe_to_pipe(struct pipe_inode_info *ipipe,
Greg Kroah-Hartman
maintainerPATCH 32/83 block_dev: dont test bdev->bd_contains when it is not stable
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <[email protected]>
commit bcc7f5b4bee8e327689a4d994022765855c807ff upstream.
bdev->bd_contains is not stable before calling __blkdev_get(). When __blkdev_get() is called on a parition with ->bd_openers == 0 it sets
bdev->bd_contains = bdev;
which is not correct for a partition.
After a call to __blkdev_get() succeeds, ->bd_openers will be > 0 and then ->bd_contains is stable.
When FMODE_EXCL is used, blkdev_get() calls
bd_start_claiming() -> bd_prepare_to_claim() -> bd_may_claim()
This call happens before __blkdev_get() is called, so ->bd_contains is not stable. So bd_may_claim() cannot safely use ->bd_contains. It currently tries to use it, and this can lead to a BUG_ON().
This happens when a whole device is already open with a bd_holder (in use by dm in my particular example) and two threads race to open a partition of that device for the first time, one opening with O_EXCL and one without.
The thread that doesn't use O_EXCL gets through blkdev_get() to __blkdev_get(), gains the ->bd_mutex, and sets bdev->bd_contains = bdev;
Immediately thereafter the other thread, using FMODE_EXCL, calls bd_start_claiming() from blkdev_get(). This should fail because the whole device has a holder, but because bdev->bd_contains == bdev bd_may_claim() incorrectly reports success.
This thread continues and blocks on bd_mutex.
The first thread then sets bdev->bd_contains correctly and drops the mutex. The thread using FMODE_EXCL then continues and when it calls bd_may_claim() again in:
BUG_ON(!bd_may_claim(bdev, whole, holder));
The BUG_ON fires.
Fix this by removing the dependency on ->bd_contains in bd_may_claim(). As bd_may_claim() has direct access to the whole device, it can simply test if the target bdev is the whole device.
--- fs/block_dev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/block_dev.c +1 -1
@@ -832,7 +832,7 @@ static bool bd_may_claim(struct block_dereturn true;/* already a holder */ else if (bdev->bd_holder != NULL) return false; /* held by someone else */ - else if (bdev->bd_contains == bdev) + else if (whole == bdev) return true; /* is a whole device which isn't held */ else if (whole->bd_holder == bd_may_claim)
Greg Kroah-Hartman
maintainerPATCH 33/83 mm: Add a user_ns owner to mm_struct and fix ptrace permission checks
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric W. Biederman <[email protected]>
commit bfedb589252c01fa505ac9f6f2a3d5d68d707ef4 upstream.
During exec dumpable is cleared if the file that is being executed is not readable by the user executing the file. A bug in ptrace_may_access allows reading the file if the executable happens to enter into a subordinate user namespace (aka clone(CLONE_NEWUSER), unshare(CLONE_NEWUSER), or setns(fd, CLONE_NEWUSER).
This problem is fixed with only necessary userspace breakage by adding a user namespace owner to mm_struct, captured at the time of exec, so it is clear in which user namespace CAP_SYS_PTRACE must be present in to be able to safely give read permission to the executable.
The function ptrace_may_access is modified to verify that the ptracer has CAP_SYS_ADMIN in task->mm->user_ns instead of task->cred->user_ns. This ensures that if the task changes it's cred into a subordinate user namespace it does not become ptraceable.
The function ptrace_attach is modified to only set PT_PTRACE_CAP when CAP_SYS_PTRACE is held over task->mm->user_ns. The intent of PT_PTRACE_CAP is to be a flag to note that whatever permission changes the task might go through the tracer has sufficient permissions for it not to be an issue. task->cred->user_ns is always the same as or descendent of mm->user_ns. Which guarantees that having CAP_SYS_PTRACE over mm->user_ns is the worst case for the tasks credentials.
To prevent regressions mm->dumpable and mm->user_ns are not considered when a task has no mm. As simply failing ptrace_may_attach causes regressions in privileged applications attempting to read things such as /proc/<pid>/stat
--- include/linux/mm_types.h | 1 + kernel/fork.c | 9 ++++++--- kernel/ptrace.c | 26 +++++++++++--------------- mm/init-mm.c | 2 ++ 4 files changed, 20 insertions(+), 18 deletions(-)
include/linux/mm_types.h +1 -0
@@ -473,6 +473,7 @@ struct mm_struct {*/ struct task_struct __rcu *owner;#endif +struct user_namespace *user_ns;/* store ref to file /proc/<pid>/exe symlink points to */ struct file __rcu *exe_file;
kernel/fork.c +6 -3
@@ -745,7 +745,8 @@ static void mm_init_owner(struct mm_stru#endif } -static struct mm_struct *mm_init (struct mm_struct *mm,struct task_struct *p) +static struct mm_struct *mm_init (struct mm_struct *mm,struct task_struct *p, +struct user_namespace *user_ns) { mm->mmap =NULL ; mm->mm_rb =RB_ROOT ;
@@ -785,6 +786,7 @@ static struct mm_struct *mm_init(structif (init_new_context (p, mm)) goto fail_nocontext; + mm->user_ns =get_user_ns (user_ns);return mm; fail_nocontext:
@@ -830,7 +832,7 @@ struct mm_struct *mm_alloc(void)return NULL ;memset (mm,0 ,sizeof (*mm)); -return mm_init (mm, current); +return mm_init (mm, current,current_user_ns ()); }/*
@@ -845,6 +847,7 @@ void __mmdrop(struct mm_struct *mm)destroy_context (mm);mmu_notifier_mm_destroy (mm);check_mm (mm); +put_user_ns (mm->user_ns);free_mm (mm); }EXPORT_SYMBOL_GPL (__mmdrop);
@@ -1126,7 +1129,7 @@ static struct mm_struct *dup_mm(struct tmemcpy (mm, oldmm,sizeof (*mm)); -if (!mm_init (mm, tsk)) +if (!mm_init (mm, tsk, mm->user_ns)) goto fail_nomem; err =dup_mmap (mm, oldmm);
kernel/ptrace.c +11 -15
@@ -220,7 +220,7 @@ static int ptrace_has_cap(struct user_nastatic int __ptrace_may_access (struct task_struct *task,unsigned int mode) {const struct cred *cred =current_cred (), *tcred; -int dumpable =0 ; +struct mm_struct *mm;kuid_t caller_uid;kgid_t caller_gid;
@@ -271,16 +271,11 @@ static int __ptrace_may_access(struct tareturn -EPERM ; ok:rcu_read_unlock (); -smp_rmb (); -if (task->mm) - dumpable =get_dumpable (task->mm); -rcu_read_lock (); -if (dumpable !=SUID_DUMP_USER && - !ptrace_has_cap (__task_cred (task)->user_ns, mode)) { -rcu_read_unlock (); -return -EPERM ; - } -rcu_read_unlock (); + mm = task->mm; +if (mm && + ((get_dumpable (mm) !=SUID_DUMP_USER ) && + !ptrace_has_cap (mm->user_ns, mode))) +return -EPERM ;return security_ptrace_access_check (task, mode); }
@@ -331,6 +326,11 @@ static int ptrace_attach(struct task_strtask_lock (task); retval =__ptrace_may_access (task,PTRACE_MODE_ATTACH_REALCREDS ); +if (!retval) { +struct mm_struct *mm = task->mm; +if (mm &&ns_capable (mm->user_ns,CAP_SYS_PTRACE )) + flags |=PT_PTRACE_CAP ; + }task_unlock (task);if (retval) goto unlock_creds;
@@ -344,10 +344,6 @@ static int ptrace_attach(struct task_strif (seize) flags |=PT_SEIZED ; -rcu_read_lock (); -if (ns_capable (__task_cred (task)->user_ns,CAP_SYS_PTRACE )) - flags |=PT_PTRACE_CAP ; -rcu_read_unlock (); task->ptrace = flags;__ptrace_link (task, current);
mm/init-mm.c +2 -0
@@ -6,6 +6,7 @@#include <linux/cpumask.h> #include <linux/atomic.h> +#include <linux/user_namespace.h> #include <asm/pgtable.h> #include <asm/mmu.h>
@@ -21,5 +22,6 @@ struct mm_struct init_mm = { .mmap_sem = __RWSEM_INITIALIZER(init_mm.mmap_sem), .page_table_lock = __SPIN_LOCK_UNLOCKED(init_mm.page_table_lock), .mmlist = LIST_HEAD_INIT(init_mm.mmlist), + .user_ns = &init_user_ns, INIT_MM_CONTEXT(init_mm) };
Greg Kroah-Hartman
maintainerPATCH 34/83 vfs,mm: fix return value of read() at s_maxbytes
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Torvalds <[email protected]>
commit d05c5f7ba164aed3db02fb188c26d0dd94f5455b upstream.
We truncated the possible read iterator to s_maxbytes in commit c2a9737f45e2 ("vfs,mm: fix a dead loop in truncate_inode_pages_range()"), but our end condition handling was wrong: it's not an error to try to read at the end of the file.
Reading past the end should return EOF (0), not EINVAL.
See for example
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1649342
http://lists.gnu.org/archive/html/bug-coreutils/2016-12/msg00008.html
where a md5sum of a maximally sized file fails because the final read is exactly at s_maxbytes.
--- mm/filemap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
mm/filemap.c +1 -1
@@ -1686,7 +1686,7 @@ static ssize_t do_generic_file_read(struint error =0 ;if (unlikely (*ppos >= inode->i_sb->s_maxbytes)) -return -EINVAL ; +return 0 ;iov_iter_truncate (iter, inode->i_sb->s_maxbytes); index = *ppos >>PAGE_SHIFT ;
Greg Kroah-Hartman
maintainerPATCH 35/83 ptrace: Capture the ptracers creds not PT_PTRACE_CAP
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric W. Biederman <[email protected]>
commit 64b875f7ac8a5d60a4e191479299e931ee949b67 upstream.
When the flag PT_PTRACE_CAP was added the PTRACE_TRACEME path was overlooked. This can result in incorrect behavior when an application like strace traces an exec of a setuid executable.
Further PT_PTRACE_CAP does not have enough information for making good security decisions as it does not report which user namespace the capability is in. This has already allowed one mistake through insufficient granulariy.
I found this issue when I was testing another corner case of exec and discovered that I could not get strace to set PT_PTRACE_CAP even when running strace as root with a full set of caps.
This change fixes the above issue with strace allowing stracing as root a setuid executable without disabling setuid. More fundamentaly this change allows what is allowable at all times, by using the correct information in it's decision.
--- fs/exec.c | 2 +- include/linux/capability.h | 1 + include/linux/ptrace.h | 1 - include/linux/sched.h | 1 + kernel/capability.c | 20 ++++++++++++++++++++ kernel/ptrace.c | 12 +++++++----- 6 files changed, 30 insertions(+), 7 deletions(-)
fs/exec.c +1 -1
@@ -1425,7 +1425,7 @@ static void check_unsafe_exec(struct linunsigned n_fs;if (p->ptrace) { -if (p->ptrace &PT_PTRACE_CAP ) +if (ptracer_capable (p,current_user_ns ())) bprm->unsafe |=LSM_UNSAFE_PTRACE_CAP ;else bprm->unsafe |=LSM_UNSAFE_PTRACE ;
include/linux/capability.h +1 -0
@@ -243,6 +243,7 @@ static inline bool ns_capable_noaudit(stextern bool privileged_wrt_inode_uidgid (struct user_namespace *ns,const struct inode *inode);extern bool capable_wrt_inode_uidgid (const struct inode *inode,int cap);extern bool file_ns_capable (const struct file *file,struct user_namespace *ns,int cap); +extern bool ptracer_capable (struct task_struct *tsk,struct user_namespace *ns);/* audit system wants to get cap info from files as well */ extern int get_vfs_caps_from_disk (const struct dentry *dentry,struct cpu_vfs_cap_data *cpu_caps);
include/linux/ptrace.h +0 -1
@@ -19,7 +19,6 @@#define PT_SEIZED 0x00010000/* SEIZE used, enable new behavior */ #define PT_PTRACED 0x00000001#define PT_DTRACE 0x00000002/* delayed trace (used on m68k, i386) */ -#define PT_PTRACE_CAP 0x00000004/* ptracer can follow suid-exec */ #define PT_OPT_FLAG_SHIFT 3/* PT_TRACE_* event enable flags */
include/linux/sched.h +1 -0
@@ -1656,6 +1656,7 @@ struct task_struct {struct list_head cpu_timers[3 ];/* process credentials */ +const struct cred __rcu *ptracer_cred;/* Tracer's credentials at attach */ const struct cred __rcu *real_cred;/* objective and real subjective task * credentials (COW) */ const struct cred __rcu *cred;/* effective (overridable) subjective task
kernel/capability.c +20 -0
@@ -485,3 +485,23 @@ bool capable_wrt_inode_uidgid(const strureturn ns_capable (ns, cap) &&privileged_wrt_inode_uidgid (ns, inode); }EXPORT_SYMBOL (capable_wrt_inode_uidgid); + +/** +* ptracer_capable - Determine if the ptracer holds CAP_SYS_PTRACE in the namespace +* @tsk: The task that may be ptraced +* @ns: The user namespace to search for CAP_SYS_PTRACE in +* +* Return true if the task that is ptracing the current task had CAP_SYS_PTRACE +* in the specified user namespace. +*/ +bool ptracer_capable (struct task_struct *tsk,struct user_namespace *ns) +{ +int ret =0 ;/* An absent tracer adds no restrictions */ +const struct cred *cred; +rcu_read_lock (); + cred =rcu_dereference (tsk->ptracer_cred); +if (cred) + ret =security_capable_noaudit (cred, ns,CAP_SYS_PTRACE ); +rcu_read_unlock (); +return (ret ==0 ); +}
kernel/ptrace.c +7 -5
@@ -39,6 +39,9 @@ void __ptrace_link(struct task_struct *cBUG_ON (!list_empty (&child->ptrace_entry));list_add (&child->ptrace_entry, &new_parent->ptraced); child->parent = new_parent; +rcu_read_lock (); + child->ptracer_cred =get_cred (__task_cred (new_parent)); +rcu_read_unlock (); }/**
@@ -71,12 +74,16 @@ void __ptrace_link(struct task_struct *c*/ void __ptrace_unlink (struct task_struct *child) { +const struct cred *old_cred;BUG_ON (!child->ptrace);clear_tsk_thread_flag (child,TIF_SYSCALL_TRACE ); child->parent = child->real_parent;list_del_init (&child->ptrace_entry); + old_cred = child->ptracer_cred; + child->ptracer_cred =NULL ; +put_cred (old_cred);spin_lock (&child->sighand->siglock); child->ptrace =0 ;
@@ -326,11 +333,6 @@ static int ptrace_attach(struct task_strtask_lock (task); retval =__ptrace_may_access (task,PTRACE_MODE_ATTACH_REALCREDS ); -if (!retval) { -struct mm_struct *mm = task->mm; -if (mm &&ns_capable (mm->user_ns,CAP_SYS_PTRACE )) - flags |=PT_PTRACE_CAP ; - }task_unlock (task);if (retval) goto unlock_creds;
Greg Kroah-Hartman
maintainerPATCH 36/83 ptrace: Dont allow accessing an undumpable mm
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric W. Biederman <[email protected]>
commit 84d77d3f06e7e8dea057d10e8ec77ad71f721be3 upstream.
It is the reasonable expectation that if an executable file is not readable there will be no way for a user without special privileges to read the file. This is enforced in ptrace_attach but if ptrace is already attached before exec there is no enforcement for read-only executables.
As the only way to read such an mm is through access_process_vm spin a variant called ptrace_access_vm that will fail if the target process is not being ptraced by the current process, or the current process did not have sufficient privileges when ptracing began to read the target processes mm.
In the ptrace implementations replace access_process_vm by ptrace_access_vm. There remain several ptrace sites that still use access_process_vm as they are reading the target executables instructions (for kernel consumption) or register stacks. As such it does not appear necessary to add a permission check to those calls.
This bug has always existed in Linux.
--- arch/alpha/kernel/ptrace.c | 2 - arch/blackfin/kernel/ptrace.c | 4 +-- arch/cris/arch-v32/kernel/ptrace.c | 2 - arch/ia64/kernel/ptrace.c | 2 - arch/mips/kernel/ptrace32.c | 4 +-- arch/powerpc/kernel/ptrace32.c | 4 +-- include/linux/mm.h | 2 + include/linux/ptrace.h | 3 ++ kernel/ptrace.c | 42 +++++++++++++++++++++++++++++++------ mm/memory.c | 2 - mm/nommu.c | 2 - 11 files changed, 52 insertions(+), 17 deletions(-)
arch/alpha/kernel/ptrace.c +1 -1
@@ -283,7 +283,7 @@ long arch_ptrace(struct task_struct *chi/* When I and D space are separate, these will need to be fixed. */ case PTRACE_PEEKTEXT :/* read word at location addr. */ case PTRACE_PEEKDATA : - copied =access_process_vm (child, addr, &tmp,sizeof (tmp), + copied =ptrace_access_vm (child, addr, &tmp,sizeof (tmp),FOLL_FORCE ); ret = -EIO ;if (copied !=sizeof (tmp))
arch/blackfin/kernel/ptrace.c +2 -2
@@ -270,7 +270,7 @@ long arch_ptrace(struct task_struct *chiswitch (bfin_mem_access_type (addr, to_copy)) {case BFIN_MEM_ACCESS_CORE :case BFIN_MEM_ACCESS_CORE_ONLY : - copied =access_process_vm (child, addr, &tmp, + copied =ptrace_access_vm (child, addr, &tmp, to_copy,FOLL_FORCE );if (copied)break ;
@@ -323,7 +323,7 @@ long arch_ptrace(struct task_struct *chiswitch (bfin_mem_access_type (addr, to_copy)) {case BFIN_MEM_ACCESS_CORE :case BFIN_MEM_ACCESS_CORE_ONLY : - copied =access_process_vm (child, addr, &data, + copied =ptrace_access_vm (child, addr, &data, to_copy,FOLL_FORCE |FOLL_WRITE );break ;
arch/cris/arch-v32/kernel/ptrace.c +1 -1
@@ -147,7 +147,7 @@ long arch_ptrace(struct task_struct *chi/* The trampoline page is globally mapped, no page table to traverse.*/ tmp = *(unsigned long *)addr; }else { - copied =access_process_vm (child, addr, &tmp,sizeof (tmp),FOLL_FORCE ); + copied =ptrace_access_vm (child, addr, &tmp,sizeof (tmp),FOLL_FORCE );if (copied !=sizeof (tmp))break ;
arch/ia64/kernel/ptrace.c +1 -1
@@ -1159,7 +1159,7 @@ arch_ptrace (struct task_struct *child,case PTRACE_PEEKTEXT :case PTRACE_PEEKDATA :/* read word at location addr */ -if (access_process_vm (child, addr, &data,sizeof (data), +if (ptrace_access_vm (child, addr, &data,sizeof (data),FOLL_FORCE ) !=sizeof (data))return -EIO ;
arch/mips/kernel/ptrace32.c +2 -2
@@ -69,7 +69,7 @@ long compat_arch_ptrace(struct task_struif (get_user (addrOthers, (u32 __user *__user *) (unsigned long ) addr) !=0 )break ; - copied =access_process_vm (child, (u64 )addrOthers, &tmp, + copied =ptrace_access_vm (child, (u64 )addrOthers, &tmp,sizeof (tmp),FOLL_FORCE );if (copied !=sizeof (tmp))break ;
@@ -178,7 +178,7 @@ long compat_arch_ptrace(struct task_struif (get_user (addrOthers, (u32 __user *__user *) (unsigned long ) addr) !=0 )break ; ret =0 ; -if (access_process_vm (child, (u64 )addrOthers, &data, +if (ptrace_access_vm (child, (u64 )addrOthers, &data,sizeof (data),FOLL_FORCE |FOLL_WRITE ) ==sizeof (data))break ;
arch/powerpc/kernel/ptrace32.c +2 -2
@@ -73,7 +73,7 @@ long compat_arch_ptrace(struct task_struif (get_user (addrOthers, (u32 __user *__user *)addr) !=0 )break ; - copied =access_process_vm (child, (u64 )addrOthers, &tmp, + copied =ptrace_access_vm (child, (u64 )addrOthers, &tmp,sizeof (tmp),FOLL_FORCE );if (copied !=sizeof (tmp))break ;
@@ -178,7 +178,7 @@ long compat_arch_ptrace(struct task_struif (get_user (addrOthers, (u32 __user *__user *)addr) !=0 )break ; ret =0 ; -if (access_process_vm (child, (u64 )addrOthers, &tmp, +if (ptrace_access_vm (child, (u64 )addrOthers, &tmp,sizeof (tmp),FOLL_FORCE |FOLL_WRITE ) ==sizeof (tmp))break ;
include/linux/mm.h +2 -0
@@ -1270,6 +1270,8 @@ extern int access_process_vm(struct task unsigned int gup_flags);extern int access_remote_vm (struct mm_struct *mm,unsigned long addr,void *buf,int len,unsigned int gup_flags); +extern int __access_remote_vm (struct task_struct *tsk,struct mm_struct *mm, +unsigned long addr,void *buf,int len,unsigned int gup_flags); long get_user_pages_remote(struct task_struct *tsk, struct mm_struct *mm, unsigned long start, unsigned long nr_pages,
include/linux/ptrace.h +3 -0
@@ -8,6 +8,9 @@#include <linux/pid_namespace.h> /* For task_active_pid_ns. */ #include <uapi/linux/ptrace.h> +extern int ptrace_access_vm (struct task_struct *tsk,unsigned long addr, +void *buf,int len,unsigned int gup_flags); +/* * Ptrace flags *
kernel/ptrace.c +36 -6
84 lines not on this page · raw message
mm/memory.c +1 -1
@@ -3868,7 +3868,7 @@ EXPORT_SYMBOL_GPL(generic_access_phys);* Access another process' address space as given in mm. If non-NULL, use the * given task for page fault accounting. */ -static int __access_remote_vm (struct task_struct *tsk,struct mm_struct *mm, +int __access_remote_vm (struct task_struct *tsk,struct mm_struct *mm,unsigned long addr,void *buf,int len,unsigned int gup_flags) {struct vm_area_struct *vma;
mm/nommu.c +1 -1
@@ -1808,7 +1808,7 @@ void filemap_map_pages(struct fault_env }EXPORT_SYMBOL (filemap_map_pages); -static int __access_remote_vm (struct task_struct *tsk,struct mm_struct *mm, +int __access_remote_vm (struct task_struct *tsk,struct mm_struct *mm,unsigned long addr,void *buf,int len,unsigned int gup_flags) {struct vm_area_struct *vma;
Greg Kroah-Hartman
maintainerPATCH 38/83 ext4: dont lock buffer in ext4_commit_super if holding spinlock
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Theodore Ts'o <[email protected]>
commit 1566a48aaa10c6bb29b9a69dd8279f9a4fc41e35 upstream.
If there is an error reported in mballoc via ext4_grp_locked_error(), the code is holding a spinlock, so ext4_commit_super() must not try to lock the buffer head, or else it will trigger a BUG:
BUG: sleeping function called from invalid context at ./include/linux/buffer_head.h:358
in_atomic(): 1, irqs_disabled(): 0, pid: 993, name: mount
CPU: 0 PID: 993 Comm: mount Not tainted 4.9.0-rc1-clouder1 #62
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.8.1-0-g4adadbd-20150316_085822-nilsson.home.kraxel.org 04/01/2014
ffff880006423548 ffffffff81318c89 ffffffff819ecdd0 0000000000000166
ffff880006423558 ffffffff810810b0 ffff880006423580 ffffffff81081153
ffff880006e5a1a0 ffff88000690e400 0000000000000000 ffff8800064235c0
Call Trace:
[<ffffffff81318c89>] dump_stack+0x67/0x9e
[<ffffffff810810b0>] ___might_sleep+0xf0/0x140
[<ffffffff81081153>] __might_sleep+0x53/0xb0
[<ffffffff8126c1dc>] ext4_commit_super+0x19c/0x290
[<ffffffff8126e61a>] __ext4_grp_locked_error+0x14a/0x230
[<ffffffff81081153>] ? __might_sleep+0x53/0xb0
[<ffffffff812822be>] ext4_mb_generate_buddy+0x1de/0x320Since ext4_grp_locked_error() calls ext4_commit_super with sync == 0 (and it is the only caller which does so), avoid locking and unlocking the buffer in this case.
This can result in races with ext4_commit_super() if there are other problems (which is what commit 4743f83990614 was trying to address), but a Warning is better than BUG.
--- fs/ext4/super.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
fs/ext4/super.c +3 -2
@@ -4550,7 +4550,8 @@ static int ext4_commit_super(struct supe &EXT4_SB(sb)->s_freeinodes_counter));BUFFER_TRACE (sbh,"marking dirty" );ext4_superblock_csum_set (sb); -lock_buffer (sbh); +if (sync) +lock_buffer (sbh);if (buffer_write_io_error (sbh)) {/* * Oh, dear. A previous attempt to write the
@@ -4566,8 +4567,8 @@ static int ext4_commit_super(struct supeset_buffer_uptodate (sbh); }mark_buffer_dirty (sbh); -unlock_buffer (sbh);if (sync) { +unlock_buffer (sbh); error =__sync_dirty_buffer (sbh,test_opt (sb,BARRIER ) ?WRITE_FUA :WRITE_SYNC );if (error)
Greg Kroah-Hartman
maintainerPATCH 39/83 ext4: fix mballoc breakage with 64k block size
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chandan Rajendra <[email protected]>
commit 69e43e8cc971a79dd1ee5d4343d8e63f82725123 upstream.
'border' variable is set to a value of 2 times the block size of the underlying filesystem. With 64k block size, the resulting value won't fit into a 16-bit variable. Hence this commit changes the data type of 'border' to 'unsigned int'.
--- fs/ext4/mballoc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ext4/mballoc.c +1 -1
@@ -669,7 +669,7 @@ static void ext4_mb_mark_free_simple(strext4_grpblk_t min;ext4_grpblk_t max;ext4_grpblk_t chunk; -unsigned short border; +unsigned int border;BUG_ON (len >EXT4_CLUSTERS_PER_GROUP (sb));
Greg Kroah-Hartman
maintainerPATCH 40/83 ext4: fix stack memory corruption with 64k block size
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chandan Rajendra <[email protected]>
commit 30a9d7afe70ed6bd9191d3000e2ef1a34fb58493 upstream.
The number of 'counters' elements needed in 'struct sg' is super_block->s_blocksize_bits + 2. Presently we have 16 'counters' elements in the array. This is insufficient for block sizes >= 32k. In such cases the memcpy operation performed in ext4_mb_seq_groups_show() would cause stack memory corruption.
--- fs/ext4/mballoc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ext4/mballoc.c +1 -1
@@ -2287,7 +2287,7 @@ static int ext4_mb_seq_groups_show(strucstruct ext4_group_info *grinfo;struct sg {struct ext4_group_info info; -ext4_grpblk_t counters[16 ]; +ext4_grpblk_t counters[EXT4_MAX_BLOCK_LOG_SIZE +2 ]; } sg; group--;
Greg Kroah-Hartman
maintainerPATCH 41/83 ext4: use more strict checks for inodes_per_block on mount
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Theodore Ts'o <[email protected]>
commit cd6bb35bf7f6d7d922509bf50265383a0ceabe96 upstream.
Centralize the checks for inodes_per_block and be more strict to make sure the inodes_per_block_group can't end up being zero.
--- fs/ext4/super.c | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-)
fs/ext4/super.c +6 -9
@@ -3660,12 +3660,16 @@ static int ext4_fill_super(struct super_ sbi->s_blocks_per_group =le32_to_cpu (es->s_blocks_per_group); sbi->s_inodes_per_group =le32_to_cpu (es->s_inodes_per_group); -if (EXT4_INODE_SIZE (sb) ==0 ||EXT4_INODES_PER_GROUP (sb) ==0 ) - goto cantfind_ext4; sbi->s_inodes_per_block = blocksize /EXT4_INODE_SIZE (sb);if (sbi->s_inodes_per_block ==0 ) goto cantfind_ext4; +if (sbi->s_inodes_per_group < sbi->s_inodes_per_block || + sbi->s_inodes_per_group > blocksize *8 ) { +ext4_msg (sb,KERN_ERR ,"invalid inodes per group: %lu\n" , + sbi->s_blocks_per_group); + goto failed_mount; + } sbi->s_itb_per_group = sbi->s_inodes_per_group / sbi->s_inodes_per_block; sbi->s_desc_per_block = blocksize /EXT4_DESC_SIZE (sb);
@@ -3748,13 +3752,6 @@ static int ext4_fill_super(struct super_ } sbi->s_cluster_ratio = clustersize / blocksize; -if (sbi->s_inodes_per_group > blocksize *8 ) { -ext4_msg (sb,KERN_ERR , -"#inodes per group too big: %lu" , - sbi->s_inodes_per_group); - goto failed_mount; - } -/* Do we have standard group size of clustersize * 8 blocks ? */ if (sbi->s_blocks_per_group == clustersize <<3 )set_opt2 (sb,STD_GROUP_SIZE );
Greg Kroah-Hartman
maintainerPATCH 42/83 ext4: fix in-superblock mount options processing
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Theodore Ts'o <[email protected]>
commit 5aee0f8a3f42c94c5012f1673420aee96315925a upstream.
Fix a large number of problems with how we handle mount options in the superblock. For one, if the string in the superblock is long enough that it is not null terminated, we could run off the end of the string and try to interpret superblocks fields as characters. It's unlikely this will cause a security problem, but it could result in an invalid parse. Also, parse_options is destructive to the string, so in some cases if there is a comma-separated string, it would be modified in the superblock. (Fortunately it only happens on file systems with a 1k block size.)
--- fs/ext4/super.c | 38 +++++++++++++++++++++++--------------- 1 file changed, 23 insertions(+), 15 deletions(-)
fs/ext4/super.c +23 -15
@@ -3301,7 +3301,7 @@ static int ext4_fill_super(struct super_char *orig_data =kstrdup (data,GFP_KERNEL );struct buffer_head *bh;struct ext4_super_block *es =NULL ; -struct ext4_sb_info *sbi; +struct ext4_sb_info *sbi =kzalloc (sizeof (*sbi),GFP_KERNEL );ext4_fsblk_t block;ext4_fsblk_t sb_block =get_sb_block (&data);ext4_fsblk_t logical_sb_block;
@@ -3320,16 +3320,14 @@ static int ext4_fill_super(struct super_unsigned int journal_ioprio =DEFAULT_JOURNAL_IOPRIO ;ext4_group_t first_not_zeroed; - sbi =kzalloc (sizeof (*sbi),GFP_KERNEL ); -if (!sbi) - goto out_free_orig; +if ((data && !orig_data) || !sbi) + goto out_free_base; sbi->s_blockgroup_lock =kzalloc (sizeof (struct blockgroup_lock ),GFP_KERNEL ); -if (!sbi->s_blockgroup_lock) { -kfree (sbi); - goto out_free_orig; - } +if (!sbi->s_blockgroup_lock) + goto out_free_base; + sb->s_fs_info = sbi; sbi->s_sb = sb; sbi->s_inode_readahead_blks =EXT4_DEF_INODE_READAHEAD_BLKS ;
@@ -3475,11 +3473,19 @@ static int ext4_fill_super(struct super_*/ sbi->s_li_wait_mult =EXT4_DEF_LI_WAIT_MULT ; -if (!parse_options ((char *) sbi->s_es->s_mount_opts, sb, - &journal_devnum, &journal_ioprio,0 )) { -ext4_msg (sb,KERN_WARNING , -"failed to parse options in superblock: %s" , - sbi->s_es->s_mount_opts); +if (sbi->s_es->s_mount_opts[0 ]) { +char *s_mount_opts =kstrndup (sbi->s_es->s_mount_opts, +sizeof (sbi->s_es->s_mount_opts), +GFP_KERNEL ); +if (!s_mount_opts) + goto failed_mount; +if (!parse_options (s_mount_opts, sb, &journal_devnum, + &journal_ioprio,0 )) { +ext4_msg (sb,KERN_WARNING , +"failed to parse options in superblock: %s" , + s_mount_opts); + } +kfree (s_mount_opts); } sbi->s_def_mount_opt = sbi->s_mount_opt; if (!parse_options((char *) data, sb, &journal_devnum,
@@ -4157,7 +4163,9 @@ no_journal:if (___ratelimit (&ext4_mount_msg_ratelimit,"EXT4-fs mount" ))ext4_msg (sb,KERN_INFO ,"mounted filesystem with%s. " -"Opts: %s%s%s" , descr, sbi->s_es->s_mount_opts, +"Opts: %.*s%s%s" , descr, + (int )sizeof (sbi->s_es->s_mount_opts), + sbi->s_es->s_mount_opts, *sbi->s_es->s_mount_opts ?"; " :"" , orig_data);if (es->s_error_count)
@@ -4236,8 +4244,8 @@ failed_mount: out_fail: sb->s_fs_info =NULL ;kfree (sbi->s_blockgroup_lock); +out_free_base:kfree (sbi); -out_free_orig:kfree (orig_data);return err ? err : ret; }
Greg Kroah-Hartman
maintainerPATCH 43/83 ext4: add sanity checking to count_overhead()
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Theodore Ts'o <[email protected]>
commit c48ae41bafe31e9a66d8be2ced4e42a6b57fa814 upstream.
The commit "ext4: sanity check the block and cluster size at mount time" should prevent any problems, but in case the superblock is modified while the file system is mounted, add an extra safety check to make sure we won't overrun the allocated buffer.
--- fs/ext4/super.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
fs/ext4/super.c +8 -3
@@ -3193,10 +3193,15 @@ static int count_overhead(struct super_bext4_set_bit (s++, buf); count++; } -for (j =ext4_bg_num_gdb (sb, grp); j >0 ; j--) { -ext4_set_bit (EXT4_B2C (sbi, s++), buf); - count++; + j =ext4_bg_num_gdb (sb, grp); +if (s + j >EXT4_BLOCKS_PER_GROUP (sb)) { +ext4_error (sb,"Invalid number of block group " +"descriptor blocks: %d" , j); + j =EXT4_BLOCKS_PER_GROUP (sb) - s; } + count += j; +for (; j >0 ; j--) +ext4_set_bit (EXT4_B2C (sbi, s++), buf); }if (!count)return 0 ;
Greg Kroah-Hartman
maintainerPATCH 44/83 ext4: reject inodes with negative size
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <[email protected]>
commit 7e6e1ef48fc02f3ac5d0edecbb0c6087cd758d58 upstream.
Don't load an inode with a negative size; this causes integer overflow problems in the VFS.
[ Added EXT4_ERROR_INODE() to mark file system as corrupted. -TYT]
--- fs/ext4/inode.c | 6 ++++++ 1 file changed, 6 insertions(+)
fs/ext4/inode.c +6 -0
@@ -4434,6 +4434,7 @@ struct inode *ext4_iget(struct super_blostruct inode *inode;journal_t *journal =EXT4_SB (sb)->s_journal;long ret; +loff_t size;int block;uid_t i_uid;gid_t i_gid;
@@ -4534,6 +4535,11 @@ struct inode *ext4_iget(struct super_blo ei->i_file_acl |= ((__u64 )le16_to_cpu (raw_inode->i_file_acl_high)) <<32 ; inode->i_size =ext4_isize (raw_inode); +if ((size =i_size_read (inode)) <0 ) { +EXT4_ERROR_INODE (inode,"bad i_size value: %lld" , size); + ret = -EFSCORRUPTED ; + goto bad_inode; + } ei->i_disksize = inode->i_size;#ifdef CONFIG_QUOTA ei->i_reserved_quota =0 ;
Greg Kroah-Hartman
maintainerPATCH 45/83 ext4: return -ENOMEM instead of success
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
commit 578620f451f836389424833f1454eeeb2ffc9e9f upstream.
We should set the error code if kzalloc() fails.
--- fs/ext4/inline.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/ext4/inline.c +3 -1
@@ -336,8 +336,10 @@ static int ext4_update_inline_data(handl len -=EXT4_MIN_INLINE_DATA_SIZE ; value =kzalloc (len,GFP_NOFS ); -if (!value) +if (!value) { + error = -ENOMEM ; goto out; + } error =ext4_xattr_ibody_get (inode, i.name_index, i.name, value, len);
Greg Kroah-Hartman
maintainerPATCH 46/83 ext4: do not perform data journaling when data is encrypted
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergey Karamov <[email protected]>
commit 73b92a2a5e97d17cc4d5c4fe9d724d3273fb6fd2 upstream.
Currently data journalling is incompatible with encryption: enabling both at the same time has never been supported by design, and would result in unpredictable behavior. However, users are not precluded from turning on both features simultaneously. This change programmatically replaces data journaling for encrypted regular files with ordered data journaling mode.
Background:
Journaling encrypted data has not been supported because it operates on buffer heads of the page in the page cache. Namely, when the commit happens, which could be up to five seconds after caching, the commit thread uses the buffer heads attached to the page to copy the contents of the page to the journal. With encryption, it would have been required to keep the bounce buffer with ciphertext for up to the aforementioned five seconds, since the page cache can only hold plaintext and could not be used for journaling. Alternatively, it would be required to setup the journal to initiate a callback at the commit time to perform deferred encryption - in this case, not only would the data have to be written twice, but it would also have to be encrypted twice. This level of complexity was not justified for a mode that in practice is very rarely used because of the overhead from the data journalling.
Solution:
If data=journaled has been set as a mount option for a filesystem, or if journaling is enabled on a regular file, do not perform journaling if the file is also encrypted, instead fall back to the data=ordered mode for the file.
Rationale:
The intent is to allow seamless and proper filesystem operation when journaling and encryption have both been enabled, and have these two conflicting features gracefully resolved by the filesystem.
--- fs/ext4/ext4_jbd2.h | 14 ++++++++------ fs/ext4/super.c | 5 +++++ 2 files changed, 13 insertions(+), 6 deletions(-)
fs/ext4/ext4_jbd2.h +8 -6
@@ -414,17 +414,19 @@ static inline int ext4_inode_journal_modreturn EXT4_INODE_WRITEBACK_DATA_MODE ;/* writeback */ /* We do not support data journalling with delayed allocation */ if (!S_ISREG (inode->i_mode) || -test_opt (inode->i_sb,DATA_FLAGS ) ==EXT4_MOUNT_JOURNAL_DATA ) -return EXT4_INODE_JOURNAL_DATA_MODE ;/* journal data */ -if (ext4_test_inode_flag (inode,EXT4_INODE_JOURNAL_DATA ) && - !test_opt (inode->i_sb,DELALLOC )) +test_opt (inode->i_sb,DATA_FLAGS ) ==EXT4_MOUNT_JOURNAL_DATA || + (ext4_test_inode_flag (inode,EXT4_INODE_JOURNAL_DATA ) && + !test_opt (inode->i_sb,DELALLOC ))) { +/* We do not support data journalling for encrypted data */ +if (S_ISREG (inode->i_mode) &&ext4_encrypted_inode (inode)) +return EXT4_INODE_ORDERED_DATA_MODE ;/* ordered */ return EXT4_INODE_JOURNAL_DATA_MODE ;/* journal data */ + }if (test_opt (inode->i_sb,DATA_FLAGS ) ==EXT4_MOUNT_ORDERED_DATA )return EXT4_INODE_ORDERED_DATA_MODE ;/* ordered */ if (test_opt (inode->i_sb,DATA_FLAGS ) ==EXT4_MOUNT_WRITEBACK_DATA )return EXT4_INODE_WRITEBACK_DATA_MODE ;/* writeback */ -else -BUG (); +BUG (); }static inline int ext4_should_journal_data (struct inode *inode)
fs/ext4/super.c +5 -0
@@ -3516,6 +3516,11 @@ static int ext4_fill_super(struct super_ "both data=journal and dax"); goto failed_mount; } +if (ext4_has_feature_encrypt (sb)) { +ext4_msg (sb,KERN_WARNING , +"encrypted files will use data=ordered " +"instead of data journaling mode" ); + }if (test_opt (sb,DELALLOC ))clear_opt (sb,DELALLOC ); }else {
Greg Kroah-Hartman
maintainerPATCH 47/83 Revert "f2fs: use percpu_counter for # of dirty pages in inode"
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jaegeuk Kim <[email protected]>
commit 204706c7accfabb67b97eef9f9a28361b6201199 upstream.
This reverts commit 1beba1b3a953107c3ff5448ab4e4297db4619c76.
The perpcu_counter doesn't provide atomicity in single core and consume more DRAM. That incurs fs_mark test failure due to ENOMEM.
--- fs/f2fs/f2fs.h | 10 +++++----- fs/f2fs/file.c | 2 +- fs/f2fs/super.c | 7 +------ 3 files changed, 7 insertions(+), 12 deletions(-)
fs/f2fs/f2fs.h +5 -5
@@ -428,7 +428,7 @@ struct f2fs_inode_info {/* Use below internally in f2fs*/ unsigned long flags;/* use to pass per-file flags */ struct rw_semaphore i_sem;/* protect fi info */ -struct percpu_counter dirty_pages;/* # of dirty pages */ +atomic_t dirty_pages;/* # of dirty pages */ f2fs_hash_t chash;/* hash value of given file name */ unsigned int clevel;/* maximum level of given file name */ nid_t i_xattr_nid;/* node id that contains xattrs */
@@ -1242,7 +1242,7 @@ static inline void inc_page_count(structstatic inline void inode_inc_dirty_pages (struct inode *inode) { -percpu_counter_inc (&F2FS_I (inode)->dirty_pages); +atomic_inc (&F2FS_I (inode)->dirty_pages);inc_page_count (F2FS_I_SB (inode),S_ISDIR (inode->i_mode) ?F2FS_DIRTY_DENTS :F2FS_DIRTY_DATA ); }
@@ -1258,7 +1258,7 @@ static inline void inode_dec_dirty_pages !S_ISLNK(inode->i_mode))return ; -percpu_counter_dec (&F2FS_I (inode)->dirty_pages); +atomic_dec (&F2FS_I (inode)->dirty_pages);dec_page_count (F2FS_I_SB (inode),S_ISDIR (inode->i_mode) ?F2FS_DIRTY_DENTS :F2FS_DIRTY_DATA ); }
@@ -1268,9 +1268,9 @@ static inline s64 get_pages(struct f2fs_return percpu_counter_sum_positive (&sbi->nr_pages[count_type]); } -static inline s64 get_dirty_pages (struct inode *inode) +static inline int get_dirty_pages (struct inode *inode) { -return percpu_counter_sum_positive (&F2FS_I (inode)->dirty_pages); +return atomic_read (&F2FS_I (inode)->dirty_pages); }static inline int get_blocktype_secs (struct f2fs_sb_info *sbi,int block_type)
fs/f2fs/file.c +1 -1
@@ -1526,7 +1526,7 @@ static int f2fs_ioc_start_atomic_write(s goto out;f2fs_msg (F2FS_I_SB (inode)->sb,KERN_WARNING , -"Unexpected flush for atomic writes: ino=%lu, npages=%lld" , +"Unexpected flush for atomic writes: ino=%lu, npages=%u" , inode->i_ino,get_dirty_pages (inode)); ret =filemap_write_and_wait_range (inode->i_mapping,0 ,LLONG_MAX );if (ret)
fs/f2fs/super.c +1 -6
@@ -558,13 +558,9 @@ static struct inode *f2fs_alloc_inode(stinit_once ((void *) fi); -if (percpu_counter_init (&fi->dirty_pages,0 ,GFP_NOFS )) { -kmem_cache_free (f2fs_inode_cachep, fi); -return NULL ; - } -/* Initialize f2fs-specific inode info */ fi->vfs_inode.i_version =1 ; +atomic_set (&fi->dirty_pages,0 ); fi->i_current_depth =1 ; fi->i_advise =0 ;init_rwsem (&fi->i_sem);
@@ -687,7 +683,6 @@ static void f2fs_i_callback(struct rcu_hstatic void f2fs_destroy_inode (struct inode *inode) { -percpu_counter_destroy (&F2FS_I (inode)->dirty_pages);call_rcu (&inode->i_rcu, f2fs_i_callback); }
Greg Kroah-Hartman
maintainerPATCH 48/83 f2fs: set ->owner for debugfs status files file_operations
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolai Stange <[email protected]>
commit 05e6ea2685c964db1e675a24a4f4e2adc22d2388 upstream.
The struct file_operations instance serving the f2fs/status debugfs file lacks an initialization of its ->owner.
This means that although that file might have been opened, the f2fs module can still get removed. Any further operation on that opened file, releasing included, will cause accesses to unmapped memory.
Indeed, Mike Marshall reported the following:
BUG: unable to handle kernel paging request at ffffffffa0307430 IP: [<ffffffff8132a224>] full_proxy_release+0x24/0x90 <...> Call Trace: [] __fput+0xdf/0x1d0 [] ____fput+0xe/0x10 [] task_work_run+0x8e/0xc0 [] do_exit+0x2ae/0xae0 [] ? __audit_syscall_entry+0xae/0x100 [] ? syscall_trace_enter+0x1ca/0x310 [] do_group_exit+0x44/0xc0 [] SyS_exit_group+0x14/0x20 [] do_syscall_64+0x61/0x150 [] entry_SYSCALL64_slow_path+0x25/0x25 <...> ---[ end trace f22ae883fa3ea6b8 ]--- Fixing recursive fault but reboot is needed!
Fix this by initializing the f2fs/status file_operations' ->owner with THIS_MODULE.
This will allow debugfs to grab a reference to the f2fs module upon any open on that file, thus preventing it from getting removed.
--- fs/f2fs/debug.c | 1 + 1 file changed, 1 insertion(+)
fs/f2fs/debug.c +1 -0
@@ -373,6 +373,7 @@ static int stat_open(struct inode *inode }static const struct file_operations stat_fops = { + .owner =THIS_MODULE , .open = stat_open, .read = seq_read, .llseek = seq_lseek,
Greg Kroah-Hartman
maintainerPATCH 49/83 f2fs: fix overflow due to condition check order
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jaegeuk Kim <[email protected]>
commit e87f7329bbd6760c2acc4f1eb423362b08851a71 upstream.
In the last ilen case, i was already increased, resulting in accessing out- of-boundary entry of do_replace and blkaddr.
Fix to check ilen first to exit the loop.
--- fs/f2fs/file.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/f2fs/file.c +1 -1
@@ -967,7 +967,7 @@ static int __clone_blkaddrs(struct inode new_size = (dst + i) <<PAGE_SHIFT ;if (dst_inode->i_size < new_size)f2fs_i_size_write (dst_inode, new_size); - }while ((do_replace[i] || blkaddr[i] ==NULL_ADDR ) && --ilen); + }while (--ilen && (do_replace[i] || blkaddr[i] ==NULL_ADDR ));f2fs_put_dnode (&dn); }else {
Greg Kroah-Hartman
maintainerPATCH 50/83 f2fs: fix to determine start_cp_addr by sbi->cur_cp_pack
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jaegeuk Kim <[email protected]>
commit 8508e44ae98622f841f5ef29d0bf3d5db4e0c1cc upstream.
We don't guarantee cp_addr is fixed by cp_version. This is to sync with f2fs-tools.
--- fs/f2fs/checkpoint.c | 8 +++++++- fs/f2fs/f2fs.h | 26 ++++++++++++++++---------- 2 files changed, 23 insertions(+), 11 deletions(-)
fs/f2fs/checkpoint.c +7 -1
@@ -772,6 +772,11 @@ int get_valid_checkpoint(struct f2fs_sb_if (sanity_check_ckpt (sbi)) goto fail_no_cp; +if (cur_page == cp1) + sbi->cur_cp_pack =1 ; +else + sbi->cur_cp_pack =2 ; +if (cp_blks <=1 ) goto done;
@@ -1123,7 +1128,7 @@ static int do_checkpoint(struct f2fs_sb_ le32_to_cpu(ckpt->checksum_offset))) =cpu_to_le32 (crc32); - start_blk =__start_cp_addr (sbi); + start_blk =__start_cp_next_addr (sbi);/* need to wait for end_io results */ wait_on_all_pages_writeback (sbi);
@@ -1187,6 +1192,7 @@ static int do_checkpoint(struct f2fs_sb_clear_prefree_segments (sbi, cpc);clear_sbi_flag (sbi,SBI_IS_DIRTY );clear_sbi_flag (sbi,SBI_NEED_CP ); +__set_cp_next_pack (sbi);/* * redirty superblock if metadata like node page or inode cache is
fs/f2fs/f2fs.h +16 -10
@@ -764,6 +764,7 @@ struct f2fs_sb_info {/* for checkpoint */ struct f2fs_checkpoint *ckpt;/* raw checkpoint pointer */ +int cur_cp_pack;/* remain current cp pack */ spinlock_t cp_lock;/* for flag in ckpt */ struct inode *meta_inode;/* cache meta blocks */ struct mutex cp_mutex;/* checkpoint procedure lock */
@@ -1329,22 +1330,27 @@ static inline void *__bitmap_ptr(structstatic inline block_t __start_cp_addr (struct f2fs_sb_info *sbi) { -block_t start_addr; -struct f2fs_checkpoint *ckpt =F2FS_CKPT (sbi); -unsigned long long ckpt_version =cur_cp_version (ckpt); - - start_addr =le32_to_cpu (F2FS_RAW_SUPER (sbi)->cp_blkaddr); +block_t start_addr =le32_to_cpu (F2FS_RAW_SUPER (sbi)->cp_blkaddr); -/* -* odd numbered checkpoint should at cp segment 0 -* and even segment must be at cp segment 1 -*/ -if (!(ckpt_version &1 )) +if (sbi->cur_cp_pack ==2 ) start_addr += sbi->blocks_per_seg; +return start_addr; +} +static inline block_t __start_cp_next_addr (struct f2fs_sb_info *sbi) +{ +block_t start_addr =le32_to_cpu (F2FS_RAW_SUPER (sbi)->cp_blkaddr); + +if (sbi->cur_cp_pack ==1 ) + start_addr += sbi->blocks_per_seg;return start_addr; } +static inline void __set_cp_next_pack (struct f2fs_sb_info *sbi) +{ + sbi->cur_cp_pack = (sbi->cur_cp_pack ==1 ) ?2 :1 ; +} +static inline block_t __start_sum_addr (struct f2fs_sb_info *sbi) {return le32_to_cpu (F2FS_CKPT (sbi)->cp_pack_start_sum);
Greg Kroah-Hartman
maintainerPATCH 51/83 loop: return proper error from loop_queue_rq()
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Omar Sandoval <[email protected]>
commit b4a567e8114327518c09f5632339a5954ab975a3 upstream.
->queue_rq() should return one of the BLK_MQ_RQ_QUEUE_* constants, not an errno.
--- drivers/block/loop.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/block/loop.c +1 -1
@@ -1646,7 +1646,7 @@ static int loop_queue_rq(struct blk_mq_hblk_mq_start_request (bd->rq);if (lo->lo_state != Lo_bound) -return -EIO ; +return BLK_MQ_RQ_QUEUE_ERROR ;switch (req_op (cmd->rq)) {case REQ_OP_FLUSH :
Greg Kroah-Hartman
maintainerPATCH 52/83 nvmet: Fix possible infinite loop triggered on hot namespace removal
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Solganik Alexander <[email protected]>
commit e4fcf07cca6a3b6c4be00df16f08be894325eaa3 upstream.
When removing a namespace we delete it from the subsystem namespaces list with list_del_init which allows us to know if it is enabled or not.
The problem is that list_del_init initialize the list next and does not respect the RCU list-traversal we do on the IO path for locating a namespace. Instead we need to use list_del_rcu which is allowed to run concurrently with the _rcu list-traversal primitives (keeps list next intact) and guarantees concurrent nvmet_find_naespace forward progress.
By changing that, we cannot rely on ns->dev_link for knowing if the namspace is enabled, so add enabled indicator entry to nvmet_ns for that.
--- drivers/nvme/target/configfs.c | 6 +++--- drivers/nvme/target/core.c | 14 ++++++++------ drivers/nvme/target/nvmet.h | 6 +----- 3 files changed, 12 insertions(+), 14 deletions(-)
drivers/nvme/target/configfs.c +3 -3
@@ -271,7 +271,7 @@ static ssize_t nvmet_ns_device_path_stormutex_lock (&subsys->lock); ret = -EBUSY ; -if (nvmet_ns_enabled (ns)) +if (ns->enabled) goto out_unlock;kfree (ns->device_path);
@@ -307,7 +307,7 @@ static ssize_t nvmet_ns_device_nguid_stoint ret =0 ;mutex_lock (&subsys->lock); -if (nvmet_ns_enabled (ns)) { +if (ns->enabled) { ret = -EBUSY ; goto out_unlock; }
@@ -339,7 +339,7 @@ CONFIGFS_ATTR(nvmet_ns_, device_nguid);static ssize_t nvmet_ns_enable_show (struct config_item *item,char *page) { -return sprintf (page,"%d\n" ,nvmet_ns_enabled (to_nvmet_ns (item))); +return sprintf (page,"%d\n" ,to_nvmet_ns (item)->enabled); } static ssize_t nvmet_ns_enable_store(struct config_item *item,
drivers/nvme/target/core.c +8 -6
@@ -264,7 +264,7 @@ int nvmet_ns_enable(struct nvmet_ns *ns)int ret =0 ;mutex_lock (&subsys->lock); -if (!list_empty (&ns->dev_link)) +if (ns->enabled) goto out_unlock; ns->bdev = blkdev_get_by_path(ns->device_path, FMODE_READ | FMODE_WRITE,
@@ -309,6 +309,7 @@ int nvmet_ns_enable(struct nvmet_ns *ns)list_for_each_entry (ctrl, &subsys->ctrls, subsys_entry)nvmet_add_async_event (ctrl,NVME_AER_TYPE_NOTICE ,0 ,0 ); + ns->enabled = true; ret =0 ; out_unlock:mutex_unlock (&subsys->lock);
@@ -325,11 +326,11 @@ void nvmet_ns_disable(struct nvmet_ns *nstruct nvmet_ctrl *ctrl;mutex_lock (&subsys->lock); -if (list_empty (&ns->dev_link)) { -mutex_unlock (&subsys->lock); -return ; - } -list_del_init (&ns->dev_link); +if (!ns->enabled) + goto out_unlock; + + ns->enabled = false; +list_del_rcu (&ns->dev_link);mutex_unlock (&subsys->lock);/*
@@ -351,6 +352,7 @@ void nvmet_ns_disable(struct nvmet_ns *nif (ns->bdev)blkdev_put (ns->bdev,FMODE_WRITE |FMODE_READ ); +out_unlock:mutex_unlock (&subsys->lock); }
drivers/nvme/target/nvmet.h +1 -5
@@ -47,6 +47,7 @@ struct nvmet_ns {loff_t size;u8 nguid[16 ]; +bool enabled;struct nvmet_subsys *subsys;const char *device_path;
@@ -61,11 +62,6 @@ static inline struct nvmet_ns *to_nvmet_ return container_of(to_config_group(item), struct nvmet_ns, group); } -static inline bool nvmet_ns_enabled (struct nvmet_ns *ns) -{ -return !list_empty_careful (&ns->dev_link); -} -struct nvmet_cq {u16 qid;u16 size;
Greg Kroah-Hartman
maintainerPATCH 53/83 mm/vmscan.c: set correct defer count for shrinker
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shaohua Li <[email protected]>
commit 5f33a0803bbd781de916f5c7448cbbbbc763d911 upstream.
Our system uses significantly more slab memory with memcg enabled with the latest kernel. With 3.10 kernel, slab uses 2G memory, while with 4.6 kernel, 6G memory is used. The shrinker has problem. Let's see we have two memcg for one shrinker. In do_shrink_slab:
1. Check cg1. nr_deferred = 0, assume total_scan = 700. batch size is 1024, then no memory is freed. nr_deferred = 700
2. Check cg2. nr_deferred = 700. Assume freeable = 20, then total_scan = 10 or 40. Let's assume it's 10. No memory is freed. nr_deferred = 10.
The deferred share of cg1 is lost in this case. kswapd will free no memory even run above steps again and again.
The fix makes sure one memcg's deferred share isn't lost.
--- mm/vmscan.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)
mm/vmscan.c +11 -3
@@ -291,6 +291,7 @@ static unsigned long do_shrink_slab(struint nid = shrinkctl->nid;long batch_size = shrinker->batch ? shrinker->batch :SHRINK_BATCH ; +long scanned =0 , next_deferred; freeable = shrinker->count_objects (shrinker, shrinkctl);if (freeable ==0 )
@@ -312,7 +313,9 @@ static unsigned long do_shrink_slab(strupr_err ("shrink_slab: %pF negative objects to delete nr=%ld\n" , shrinker->scan_objects, total_scan); total_scan = freeable; - } + next_deferred = nr; + }else + next_deferred = total_scan;/* * We need to avoid excessive windup on filesystem shrinkers
@@ -369,17 +372,22 @@ static unsigned long do_shrink_slab(strucount_vm_events (SLABS_SCANNED , nr_to_scan); total_scan -= nr_to_scan; + scanned += nr_to_scan;cond_resched (); } +if (next_deferred >= scanned) + next_deferred -= scanned; +else + next_deferred =0 ;/* * move the unused scan count back into the shrinker in a * manner that handles concurrent updates. If we exhausted the * scan, there is no need to do an update. */ -if (total_scan >0 ) - new_nr =atomic_long_add_return (total_scan, +if (next_deferred >0 ) + new_nr =atomic_long_add_return (next_deferred, &shrinker->nr_deferred[nid]);else new_nr =atomic_long_read (&shrinker->nr_deferred[nid]);
Greg Kroah-Hartman
maintainerPATCH 54/83 mm, page_alloc: keep pcp count and list contents in sync if struct page is corrupted
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mel Gorman <[email protected]>
commit a6de734bc002fe2027ccc074fbbd87d72957b7a4 upstream.
Vlastimil Babka pointed out that commit 479f854a207c ("mm, page_alloc:
defer debugging checks of pages allocated from the PCP") will allow the per-cpu list counter to be out of sync with the per-cpu list contents if a struct page is corrupted.
The consequence is an infinite loop if the per-cpu lists get fully drained by free_pcppages_bulk because all the lists are empty but the count is positive. The infinite loop occurs here
do {
batch_free++;
if (++migratetype == MIGRATE_PCPTYPES)
migratetype = 0;
list = &pcp->lists[migratetype];
} while (list_empty(list));What the user sees is a bad page warning followed by a soft lockup with interrupts disabled in free_pcppages_bulk().
This patch keeps the accounting in sync.
--- mm/page_alloc.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
mm/page_alloc.c +10 -2
@@ -2192,7 +2192,7 @@ static int rmqueue_bulk(struct zone *zon unsigned long count, struct list_head *list, int migratetype, bool cold) { - int i; + int i, alloced = 0;spin_lock (&zone->lock);for (i =0 ; i < count; ++i) {
@@ -2217,13 +2217,21 @@ static int rmqueue_bulk(struct zone *zonelse list_add_tail (&page->lru, list); list = &page->lru; + alloced++;if (is_migrate_cma (get_pcppage_migratetype (page)))__mod_zone_page_state (zone,NR_FREE_CMA_PAGES , -(1 << order)); } + +/* +* i pages were removed from the buddy list even if some leak due +* to check_pcp_refill failing so adjust NR_FREE_PAGES based +* on i. Do not confuse with 'alloced' which is the number of +* pages added to the pcp list. +*/ __mod_zone_page_state (zone,NR_FREE_PAGES , -(i << order));spin_unlock (&zone->lock); -return i; +return alloced; }#ifdef CONFIG_NUMA
Greg Kroah-Hartman
maintainerPATCH 55/83 usb: gadget: composite: always set ep->mult to a sensible value
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felipe Balbi <[email protected]>
commit eaa496ffaaf19591fe471a36cef366146eeb9153 upstream.
ep->mult is supposed to be set to Isochronous and Interrupt Endapoint's multiplier value. This value is computed from different places depending on the link speed.
If we're dealing with HighSpeed, then it's part of bits [12:11] of wMaxPacketSize. This case wasn't taken into consideration before.
While at that, also make sure the ep->mult defaults to one so drivers can use it unconditionally and assume they'll never multiply ep->maxpacket to zero.
--- drivers/usb/gadget/composite.c | 9 +++++++-- drivers/usb/gadget/function/uvc_video.c | 2 +- 2 files changed, 8 insertions(+), 3 deletions(-)
drivers/usb/gadget/composite.c +7 -2
@@ -201,7 +201,12 @@ ep_found: _ep->desc = chosen_desc; _ep->comp_desc =NULL ; _ep->maxburst =0 ; - _ep->mult =0 ; + _ep->mult =1 ; + +if (g->speed ==USB_SPEED_HIGH && (usb_endpoint_xfer_isoc (_ep->desc) || +usb_endpoint_xfer_int (_ep->desc))) + _ep->mult =usb_endpoint_maxp (_ep->desc) &0x7ff ; +if (!want_comp_desc)return 0 ;
@@ -218,7 +223,7 @@ ep_found:switch (usb_endpoint_type (_ep->desc)) {case USB_ENDPOINT_XFER_ISOC :/* mult: bits 1:0 of bmAttributes */ - _ep->mult = comp_desc->bmAttributes &0x3 ; + _ep->mult = (comp_desc->bmAttributes &0x3 ) +1 ;case USB_ENDPOINT_XFER_BULK :case USB_ENDPOINT_XFER_INT : _ep->maxburst = comp_desc->bMaxBurst +1 ;
drivers/usb/gadget/function/uvc_video.c +1 -1
@@ -243,7 +243,7 @@ uvc_video_alloc_requests(struct uvc_vide req_size = video->ep->maxpacket * max_t(unsigned int, video->ep->maxburst, 1) - * (video->ep->mult +1 ); + * (video->ep->mult);for (i =0 ; i <UVC_NUM_REQUESTS ; ++i) { video->req_buffer[i] =kmalloc (req_size,GFP_KERNEL );
Greg Kroah-Hartman
maintainerPATCH 56/83 PM / OPP: Pass opp_table to dev_pm_opp_put_regulator()
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Boyd <[email protected]>
commit 91291d9ad92faa65a56a9a19d658d8049b78d3d4 upstream.
Joonyoung Shim reported an interesting problem on his ARM octa-core Odoroid-XU3 platform. During system suspend, dev_pm_opp_put_regulator() was failing for a struct device for which dev_pm_opp_set_regulator() is called earlier.
This happened because an earlier call to dev_pm_opp_of_cpumask_remove_table() function (from cpufreq-dt.c file) removed all the entries from opp_table->dev_list apart from the last CPU device in the cpumask of CPUs sharing the OPP.
But both dev_pm_opp_set_regulator() and dev_pm_opp_put_regulator() routines get CPU device for the first CPU in the cpumask. And so the OPP core failed to find the OPP table for the struct device.
This patch attempts to fix this problem by returning a pointer to the opp_table from dev_pm_opp_set_regulator() and using that as the parameter to dev_pm_opp_put_regulator(). This ensures that the dev_pm_opp_put_regulator() doesn't fail to find the opp table.
Note that similar design problem also exists with other dev_pm_opp_put_*() APIs, but those aren't used currently by anyone and so we don't need to update them for now.
--- drivers/base/power/opp/core.c | 22 ++++++---------------- drivers/cpufreq/cpufreq-dt.c | 12 ++++++++---- include/linux/pm_opp.h | 11 ++++++----- 3 files changed, 20 insertions(+), 25 deletions(-)
drivers/base/power/opp/core.c +6 -16
@@ -1316,7 +1316,7 @@ EXPORT_SYMBOL_GPL(dev_pm_opp_put_prop_na* that this function is *NOT* called under RCU protection or in contexts where * mutex cannot be locked. */ -int dev_pm_opp_set_regulator (struct device *dev,const char *name) +struct opp_table *dev_pm_opp_set_regulator (struct device *dev,const char *name) {struct opp_table *opp_table;struct regulator *reg;
@@ -1354,20 +1354,20 @@ int dev_pm_opp_set_regulator(struct devi opp_table->regulator = reg;mutex_unlock (&opp_table_lock); -return 0 ; +return opp_table; err:_remove_opp_table (opp_table); unlock:mutex_unlock (&opp_table_lock); -return ret; +return ERR_PTR (ret); }EXPORT_SYMBOL_GPL (dev_pm_opp_set_regulator);/** * dev_pm_opp_put_regulator() - Releases resources blocked for regulator -* @dev: Device for which regulator was set. +* @opp_table: OPP table returned from dev_pm_opp_set_regulator(). * * Locking: The internal opp_table and opp structures are RCU protected. * Hence this function internally uses RCU updater strategy with mutex locks
@@ -1375,22 +1375,12 @@ EXPORT_SYMBOL_GPL(dev_pm_opp_set_regulat* that this function is *NOT* called under RCU protection or in contexts where * mutex cannot be locked. */ -void dev_pm_opp_put_regulator (struct device *dev) +void dev_pm_opp_put_regulator (struct opp_table *opp_table) { -struct opp_table *opp_table; -mutex_lock (&opp_table_lock); -/* Check for existing table for 'dev' first */ - opp_table =_find_opp_table (dev); -if (IS_ERR (opp_table)) { -dev_err (dev,"Failed to find opp_table: %ld\n" , -PTR_ERR (opp_table)); - goto unlock; - } -if (IS_ERR (opp_table->regulator)) { -dev_err (dev,"%s: Doesn't have regulator set\n" , __func__); +pr_err ("%s: Doesn't have regulator set\n" , __func__); goto unlock; }
drivers/cpufreq/cpufreq-dt.c +8 -4
@@ -28,6 +28,7 @@#include "cpufreq-dt.h" struct private_data { +struct opp_table *opp_table;struct device *cpu_dev;struct thermal_cooling_device *cdev;const char *reg_name;
@@ -143,6 +144,7 @@ static int resources_available(void)static int cpufreq_init (struct cpufreq_policy *policy) {struct cpufreq_frequency_table *freq_table; +struct opp_table *opp_table =NULL ;struct private_data *priv;struct device *cpu_dev;struct clk *cpu_clk;
@@ -186,8 +188,9 @@ static int cpufreq_init(struct cpufreq_p*/ name =find_supply_name (cpu_dev);if (name) { - ret =dev_pm_opp_set_regulator (cpu_dev, name); -if (ret) { + opp_table =dev_pm_opp_set_regulator (cpu_dev, name); +if (IS_ERR (opp_table)) { + ret =PTR_ERR (opp_table);dev_err (cpu_dev,"Failed to set regulator for cpu%d: %d\n" , policy->cpu, ret); goto out_put_clk;
@@ -237,6 +240,7 @@ static int cpufreq_init(struct cpufreq_p } priv->reg_name = name; + priv->opp_table = opp_table; ret =dev_pm_opp_init_cpufreq_table (cpu_dev, &freq_table);if (ret) {
@@ -285,7 +289,7 @@ out_free_priv: out_free_opp:dev_pm_opp_of_cpumask_remove_table (policy->cpus);if (name) -dev_pm_opp_put_regulator (cpu_dev); +dev_pm_opp_put_regulator (opp_table); out_put_clk:clk_put (cpu_clk);
@@ -300,7 +304,7 @@ static int cpufreq_exit(struct cpufreq_pdev_pm_opp_free_cpufreq_table (priv->cpu_dev, &policy->freq_table);dev_pm_opp_of_cpumask_remove_table (policy->related_cpus);if (priv->reg_name) -dev_pm_opp_put_regulator (priv->cpu_dev); +dev_pm_opp_put_regulator (priv->opp_table);clk_put (policy->clk);kfree (priv);
include/linux/pm_opp.h +6 -5
@@ -19,6 +19,7 @@struct dev_pm_opp ;struct device ; +struct opp_table ;enum dev_pm_opp_event {OPP_EVENT_ADD ,OPP_EVENT_REMOVE ,OPP_EVENT_ENABLE ,OPP_EVENT_DISABLE ,
@@ -62,8 +63,8 @@ int dev_pm_opp_set_supported_hw(struct dvoid dev_pm_opp_put_supported_hw (struct device *dev);int dev_pm_opp_set_prop_name (struct device *dev,const char *name);void dev_pm_opp_put_prop_name (struct device *dev); -int dev_pm_opp_set_regulator (struct device *dev,const char *name); -void dev_pm_opp_put_regulator (struct device *dev); +struct opp_table *dev_pm_opp_set_regulator (struct device *dev,const char *name); +void dev_pm_opp_put_regulator (struct opp_table *opp_table);int dev_pm_opp_set_rate (struct device *dev,unsigned long target_freq);int dev_pm_opp_set_sharing_cpus (struct device *cpu_dev,const struct cpumask *cpumask);int dev_pm_opp_get_sharing_cpus (struct device *cpu_dev,struct cpumask *cpumask);
@@ -170,12 +171,12 @@ static inline int dev_pm_opp_set_prop_nastatic inline void dev_pm_opp_put_prop_name (struct device *dev) {} -static inline int dev_pm_opp_set_regulator (struct device *dev,const char *name) +static inline struct opp_table *dev_pm_opp_set_regulator (struct device *dev,const char *name) { -return -ENOTSUPP ; +return ERR_PTR (-ENOTSUPP ); } -static inline void dev_pm_opp_put_regulator (struct device *dev) {} +static inline void dev_pm_opp_put_regulator (struct opp_table *opp_table) {}static inline int dev_pm_opp_set_rate (struct device *dev,unsigned long target_freq) {
Greg Kroah-Hartman
maintainerPATCH 57/83 PM / OPP: Dont use OPP structure outside of rcu protected section
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viresh Kumar <[email protected]>
commit dc39d06fcd7a4a82d72eae7b71e94e888b96d29e upstream.
The OPP structure must not be used out of the rcu protected section. Cache the values to be used in separate variables instead.
--- drivers/base/power/opp/core.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-)
drivers/base/power/opp/core.c +13 -3
@@ -584,6 +584,7 @@ int dev_pm_opp_set_rate(struct device *dstruct clk *clk;unsigned long freq, old_freq;unsigned long u_volt, u_volt_min, u_volt_max; +unsigned long old_u_volt, old_u_volt_min, old_u_volt_max;int ret;if (unlikely (!target_freq)) {
@@ -633,6 +634,14 @@ int dev_pm_opp_set_rate(struct device *dreturn ret; } +if (IS_ERR (old_opp)) { + old_u_volt =0 ; + }else { + old_u_volt = old_opp->u_volt; + old_u_volt_min = old_opp->u_volt_min; + old_u_volt_max = old_opp->u_volt_max; + } + u_volt = opp->u_volt; u_volt_min = opp->u_volt_min; u_volt_max = opp->u_volt_max;
@@ -677,9 +686,10 @@ restore_freq: __func__, old_freq); restore_voltage:/* This shouldn't harm even if the voltages weren't updated earlier */ -if (!IS_ERR (old_opp)) -_set_opp_voltage (dev, reg, old_opp->u_volt, - old_opp->u_volt_min, old_opp->u_volt_max); +if (old_u_volt) { +_set_opp_voltage (dev, reg, old_u_volt, old_u_volt_min, + old_u_volt_max); + }return ret; }
Greg Kroah-Hartman
maintainerPATCH 58/83 blk-mq: Do not invoke .queue_rq() for a stopped queue
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <[email protected]>
commit bc27c01b5c46d3bfec42c96537c7a3fae0bb2cc4 upstream.
The meaning of the BLK_MQ_S_STOPPED flag is "do not call .queue_rq()". Hence modify blk_mq_make_request() such that requests are queued instead of issued if a queue has been stopped.
--- block/blk-mq.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
block/blk-mq.c +3 -3
@@ -1332,9 +1332,9 @@ static blk_qc_t blk_mq_make_request(strublk_mq_put_ctx (data.ctx);if (!old_rq) goto done; -if (!blk_mq_direct_issue_request (old_rq, &cookie)) - goto done; -blk_mq_insert_request (old_rq, false, true, true); +if (test_bit (BLK_MQ_S_STOPPED , &data.hctx->state) || +blk_mq_direct_issue_request (old_rq, &cookie) !=0 ) +blk_mq_insert_request (old_rq, false, true, true); goto done; }
Greg Kroah-Hartman
maintainerPATCH 59/83 dm table: fix all_blk_mq inconsistency when an empty table is loaded
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Snitzer <[email protected]>
commit 6936c12cf809850180b24947271b8f068fdb15e9 upstream.
An earlier DM multipath table could have been build ontop of underlying devices that were all using blk-mq. In that case, if that active multipath table is replaced with an empty DM multipath table (that reflects all paths have failed) then it is important that the 'all_blk_mq' state of the active table is transfered to the new empty DM table. Otherwise dm-rq.c:dm_old_prep_tio() will incorrectly clone a request that isn't needed by the DM multipath target when it is to issue IO to an underlying blk-mq device.
--- drivers/md/dm-table.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-)
drivers/md/dm-table.c +13 -6
@@ -924,12 +924,6 @@ static int dm_table_determine_type(strucBUG_ON (!request_based);/* No targets in this table */ -if (list_empty (devices) &&__table_type_request_based (live_md_type)) { -/* inherit live MD type */ - t->type = live_md_type; -return 0 ; - } -/* * The only way to establish DM_TYPE_MQ_REQUEST_BASED is by * having a compatible target use dm_table_set_type.
@@ -948,6 +942,19 @@ verify_rq_based:return -EINVAL ; } +if (list_empty (devices)) { +int srcu_idx; +struct dm_table *live_table =dm_get_live_table (t->md, &srcu_idx); + +/* inherit live table's type and all_blk_mq */ +if (live_table) { + t->type = live_table->type; + t->all_blk_mq = live_table->all_blk_mq; + } +dm_put_live_table (t->md, srcu_idx); +return 0 ; + } +/* Non-request-stackable devices can't be used for request-based dm */ list_for_each_entry (dd, devices, list) {struct request_queue *q =bdev_get_queue (dd->dm_dev->bdev);
Greg Kroah-Hartman
maintainerPATCH 60/83 dm table: an all_blk_mq table must be loaded for a blk-mq DM device
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <[email protected]>
commit 301fc3f5efb98633115bd887655b19f42c6dfaa8 upstream.
When dm_table_set_type() is used by a target to establish a DM table's type (e.g. DM_TYPE_MQ_REQUEST_BASED in the case of DM multipath) the DM core must go on to verify that the devices in the table are compatible with the established type.
--- drivers/md/dm-table.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/md/dm-table.c +5 -0
@@ -981,6 +981,11 @@ verify_rq_based: t->all_blk_mq = true; } +if (t->type ==DM_TYPE_MQ_REQUEST_BASED && !t->all_blk_mq) { +DMERR ("table load rejected: all devices are not blk-mq request-stackable" ); +return -EINVAL ; + } +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 61/83 dm flakey: return -EINVAL on interval bounds error in flakey_ctr()
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Yongjun <[email protected]>
commit bff7e067ee518f9ed7e1cbc63e4c9e01670d0b71 upstream.
Fix to return error code -EINVAL instead of 0, as is done elsewhere in this function.
--- drivers/md/dm-flakey.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/md/dm-flakey.c +2 -0
@@ -200,11 +200,13 @@ static int flakey_ctr(struct dm_target *if (!(fc->up_interval + fc->down_interval)) { ti->error ="Total (up + down) interval is zero" ; + r = -EINVAL ; goto bad; }if (fc->up_interval + fc->down_interval < fc->up_interval) { ti->error ="Interval overflow" ; + r = -EINVAL ; goto bad; }
Greg Kroah-Hartman
maintainerPATCH 62/83 dm crypt: mark key as invalid until properly loaded
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ondrej Kozina <[email protected]>
commit 265e9098bac02bc5e36cda21fdbad34cb5b2f48d upstream.
In crypt_set_key(), if a failure occurs while replacing the old key (e.g. tfm->setkey() fails) the key must not have DM_CRYPT_KEY_VALID flag set. Otherwise, the crypto layer would have an invalid key that still has DM_CRYPT_KEY_VALID flag set.
--- drivers/md/dm-crypt.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/md/dm-crypt.c +5 -2
@@ -1503,12 +1503,15 @@ static int crypt_set_key(struct crypt_coif (!cc->key_size &&strcmp (key,"-" )) goto out; +/* clear the flag since following operations may invalidate previously valid key */ +clear_bit (DM_CRYPT_KEY_VALID , &cc->flags); +if (cc->key_size &&crypt_decode_key (cc->key, key, cc->key_size) <0 ) goto out; -set_bit (DM_CRYPT_KEY_VALID , &cc->flags); - r =crypt_setkey_allcpus (cc); +if (!r) +set_bit (DM_CRYPT_KEY_VALID , &cc->flags); out:/* Hex key string not needed after here, so wipe it. */
Greg Kroah-Hartman
maintainerPATCH 63/83 dm rq: fix a race condition in rq_completed()
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <[email protected]>
commit d15bb3a6467e102e60d954aadda5fb19ce6fd8ec upstream.
It is required to hold the queue lock when calling blk_run_queue_async() to avoid that a race between blk_run_queue_async() and blk_cleanup_queue() is triggered.
--- drivers/md/dm-rq.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/md/dm-rq.c +8 -2
@@ -226,6 +226,9 @@ static void rq_end_stats(struct mapped_d*/ static void rq_completed (struct mapped_device *md,int rw,bool run_queue) { +struct request_queue *q = md->queue; +unsigned long flags; +atomic_dec (&md->pending[rw]);/* nudge anyone waiting on suspend queue */
@@ -238,8 +241,11 @@ static void rq_completed(struct mapped_d* back into ->request_fn() could deadlock attempting to grab the * queue lock again. */ -if (!md->queue->mq_ops && run_queue) -blk_run_queue_async (md->queue); +if (!q->mq_ops && run_queue) { +spin_lock_irqsave (q->queue_lock, flags); +blk_run_queue_async (q); +spin_unlock_irqrestore (q->queue_lock, flags); + }/* * dm_put() must be at the end of this function. See the comment above
Greg Kroah-Hartman
maintainerPATCH 64/83 dm raid: fix discard support regression
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heinz Mauelshagen <[email protected]>
commit 11e2968478edc07a75ee1efb45011b3033c621c2 upstream.
Commit ecbfb9f118 ("dm raid: add raid level takeover support") moved the configure_discard_support() call from raid_ctr() to raid_preresume().
Enabling/disabling discard _must_ happen during table load (through the .ctr hook). Fix this regression by moving the configure_discard_support() call back to raid_ctr().
--- drivers/md/dm-raid.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-)
drivers/md/dm-raid.c +3 -6
@@ -2994,6 +2994,9 @@ static int raid_ctr(struct dm_target *ti } } +/* Disable/enable discard support on raid set. */ +configure_discard_support (rs); +mddev_unlock (&rs->md);return 0 ;
@@ -3580,12 +3583,6 @@ static int raid_preresume(struct dm_targif (test_bit (RT_FLAG_UPDATE_SBS , &rs->runtime_flags))rs_update_sbs (rs); -/* -* Disable/enable discard support on raid set after any -* conversion, because devices can have been added -*/ -configure_discard_support (rs); -/* Load the bitmap from disk unless raid0 */ r =__load_dirty_region_bitmap (rs);if (r)
Greg Kroah-Hartman
maintainerPATCH 65/83 dm space map metadata: fix struct sm_metadata leak on failed create
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Marzinski <[email protected]>
commit 314c25c56c1ee5026cf99c570bdfe01847927acb upstream.
In dm_sm_metadata_create() we temporarily change the dm_space_map operations from 'ops' (whose .destroy function deallocates the sm_metadata) to 'bootstrap_ops' (whose .destroy function doesn't).
If dm_sm_metadata_create() fails in sm_ll_new_metadata() or sm_ll_extend(), it exits back to dm_tm_create_internal(), which calls dm_sm_destroy() with the intention of freeing the sm_metadata, but it doesn't (because the dm_space_map operations is still set to 'bootstrap_ops').
Fix this by setting the dm_space_map operations back to 'ops' if dm_sm_metadata_create() fails when it is set to 'bootstrap_ops'.
--- drivers/md/persistent-data/dm-space-map-metadata.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-)
drivers/md/persistent-data/dm-space-map-metadata.c +6 -8
@@ -775,17 +775,15 @@ int dm_sm_metadata_create(struct dm_spacmemcpy (&smm->sm, &bootstrap_ops,sizeof (smm->sm)); r =sm_ll_new_metadata (&smm->ll, tm); +if (!r) { +if (nr_blocks >DM_SM_METADATA_MAX_BLOCKS ) + nr_blocks =DM_SM_METADATA_MAX_BLOCKS ; + r =sm_ll_extend (&smm->ll, nr_blocks); + } +memcpy (&smm->sm, &ops,sizeof (smm->sm));if (r)return r; -if (nr_blocks >DM_SM_METADATA_MAX_BLOCKS ) - nr_blocks =DM_SM_METADATA_MAX_BLOCKS ; - r =sm_ll_extend (&smm->ll, nr_blocks); -if (r) -return r; - -memcpy (&smm->sm, &ops,sizeof (smm->sm)); -/* * Now we need to update the newly created data structures with the * allocated blocks that they were built from.
Greg Kroah-Hartman
maintainerPATCH 66/83 ASoC: intel: Fix crash at suspend/resume without card registration
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 2fc995a87f2efcd803438f07bfecd35cc3d90d32 upstream.
When ASoC Intel SST Medfield driver is probed but without codec / card assigned, it causes an Oops and freezes the kernel at suspend/resume,
PM: Suspending system (freeze)
Suspending console(s) (use no_console_suspend to debug)
BUG: unable to handle kernel NULL pointer dereference at 0000000000000018 IP: [<ffffffffc09d9409>] sst_soc_prepare+0x19/0xa0 [snd_soc_sst_mfld_platform] Oops: 0000 [#1] PREEMPT SMP CPU: 0 PID: 1552 Comm: systemd-sleep Tainted: G W 4.9.0-rc6-1.g5f5c2ad-default #1 Call Trace: [<ffffffffb45318f9>] dpm_prepare+0x209/0x460 [<ffffffffb4531b61>] dpm_suspend_start+0x11/0x60 [<ffffffffb40d3cc2>] suspend_devices_and_enter+0xb2/0x710 [<ffffffffb40d462e>] pm_suspend+0x30e/0x390 [<ffffffffb40d2eba>] state_store+0x8a/0x90 [<ffffffffb43c670f>] kobj_attr_store+0xf/0x20 [<ffffffffb42b0d97>] sysfs_kf_write+0x37/0x40 [<ffffffffb42b02bc>] kernfs_fop_write+0x11c/0x1b0 [<ffffffffb422be68>] __vfs_write+0x28/0x140 [<ffffffffb43728a8>] ? apparmor_file_permission+0x18/0x20 [<ffffffffb433b2ab>] ? security_file_permission+0x3b/0xc0 [<ffffffffb422d095>] vfs_write+0xb5/0x1a0 [<ffffffffb422e3d6>] SyS_write+0x46/0xa0 [<ffffffffb4719fbb>] entry_SYSCALL_64_fastpath+0x1e/0xad
Add proper NULL checks in the PM code of mdfld driver.
--- sound/soc/intel/atom/sst-mfld-platform-pcm.c | 6 ++++++ 1 file changed, 6 insertions(+)
sound/soc/intel/atom/sst-mfld-platform-pcm.c +6 -0
@@ -771,6 +771,9 @@ static int sst_soc_prepare(struct devicestruct sst_data *drv =dev_get_drvdata (dev);struct snd_soc_pcm_runtime *rtd; +if (!drv->soc_card) +return 0 ; +/* suspend all pcms first */ snd_soc_suspend (drv->soc_card->dev);snd_soc_poweroff (drv->soc_card->dev);
@@ -793,6 +796,9 @@ static void sst_soc_complete(struct devistruct sst_data *drv =dev_get_drvdata (dev);struct snd_soc_pcm_runtime *rtd; +if (!drv->soc_card) +return ; +/* restart SSPs */ list_for_each_entry (rtd, &drv->soc_card->rtd_list, list) {struct snd_soc_dai *dai = rtd->cpu_dai;
Greg Kroah-Hartman
maintainerPATCH 67/83 cifs: Fix smbencrypt() to stop pointing a scatterlist at the stack
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Lutomirski <[email protected]>
commit 06deeec77a5a689cc94b21a8a91a76e42176685d upstream.
smbencrypt() points a scatterlist to the stack, which is breaks if CONFIG_VMAP_STACK=y.
Fix it by switching to crypto_cipher_encrypt_one(). The new code should be considerably faster as an added benefit.
This code is nearly identical to some code that Eric Biggers suggested.
--- fs/cifs/smbencrypt.c | 40 ++++++++-------------------------------- 1 file changed, 8 insertions(+), 32 deletions(-)
fs/cifs/smbencrypt.c +8 -32
@@ -23,7 +23,7 @@Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */ -#include <crypto/skcipher.h> +#include <linux/crypto.h> #include <linux/module.h> #include <linux/slab.h> #include <linux/fs.h>
@@ -69,46 +69,22 @@ str_to_key(unsigned char *str, unsignedstatic int smbhash (unsigned char *out,const unsigned char *in,unsigned char *key) { -int rc;unsigned char key2[8 ]; -struct crypto_skcipher *tfm_des; -struct scatterlist sgin, sgout; -struct skcipher_request *req; +struct crypto_cipher *tfm_des;str_to_key (key, key2); - tfm_des =crypto_alloc_skcipher ("ecb(des)" ,0 ,CRYPTO_ALG_ASYNC ); + tfm_des =crypto_alloc_cipher ("des" ,0 ,0 );if (IS_ERR (tfm_des)) { - rc =PTR_ERR (tfm_des);cifs_dbg (VFS ,"could not allocate des crypto API\n" ); - goto smbhash_err; +return PTR_ERR (tfm_des); } - req =skcipher_request_alloc (tfm_des,GFP_KERNEL ); -if (!req) { - rc = -ENOMEM ; -cifs_dbg (VFS ,"could not allocate des crypto API\n" ); - goto smbhash_free_skcipher; - } - -crypto_skcipher_setkey (tfm_des, key2,8 ); - -sg_init_one (&sgin, in,8 ); -sg_init_one (&sgout, out,8 ); - -skcipher_request_set_callback (req,0 ,NULL ,NULL ); -skcipher_request_set_crypt (req, &sgin, &sgout,8 ,NULL ); - - rc =crypto_skcipher_encrypt (req); -if (rc) -cifs_dbg (VFS ,"could not encrypt crypt key rc: %d\n" , rc); - -skcipher_request_free (req); +crypto_cipher_setkey (tfm_des, key2,8 ); +crypto_cipher_encrypt_one (tfm_des, out, in); +crypto_free_cipher (tfm_des); -smbhash_free_skcipher: -crypto_free_skcipher (tfm_des); -smbhash_err: -return rc; +return 0 ; } static int
Greg Kroah-Hartman
maintainerPATCH 68/83 CIFS: Fix a possible memory corruption during reconnect
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Shilovsky <[email protected]>
commit 53e0e11efe9289535b060a51d4cf37c25e0d0f2b upstream.
We can not unlock/lock cifs_tcp_ses_lock while walking through ses and tcon lists because it can corrupt list iterator pointers and a tcon structure can be released if we don't hold an extra reference. Fix it by moving a reconnect process to a separate delayed work and acquiring a reference to every tcon that needs to be reconnected. Also do not send an echo request on newly established connections.
--- fs/cifs/cifsglob.h | 3 ++ fs/cifs/cifsproto.h | 3 ++ fs/cifs/connect.c | 34 ++++++++++++++++++----- fs/cifs/smb2pdu.c | 75 +++++++++++++++++++++++++++++++++++----------------- fs/cifs/smb2proto.h | 1 5 files changed, 85 insertions(+), 31 deletions(-)
fs/cifs/cifsglob.h +3 -0
@@ -646,6 +646,8 @@ struct TCP_Server_Info {unsigned int max_read;unsigned int max_write;__u8 preauth_hash[512 ]; +struct delayed_work reconnect;/* reconnect workqueue job */ +struct mutex reconnect_mutex;/* prevent simultaneous reconnects */ #endif /* CONFIG_CIFS_SMB2 */ unsigned long echo_interval; };
@@ -849,6 +851,7 @@ cap_unix(struct cifs_ses *ses)struct cifs_tcon {struct list_head tcon_list;int tc_count; +struct list_head rlist;/* reconnect list */ struct list_head openFileList;spinlock_t open_file_lock;/* protects list above */ struct cifs_ses *ses;/* pointer to session associated with */
fs/cifs/cifsproto.h +3 -0
@@ -206,6 +206,9 @@ extern void cifs_add_pending_open_lockedstruct tcon_link *tlink, struct cifs_pending_open *open);extern void cifs_del_pending_open (struct cifs_pending_open *open); +extern void cifs_put_tcp_session (struct TCP_Server_Info *server, +int from_reconnect); +extern void cifs_put_tcon (struct cifs_tcon *tcon);#if IS_ENABLED (CONFIG_CIFS_DFS_UPCALL )extern void cifs_dfs_release_automount_timer (void );
fs/cifs/connect.c +27 -7
@@ -52,6 +52,9 @@#include "nterr.h" #include "rfc1002pdu.h" #include "fscache.h" +#ifdef CONFIG_CIFS_SMB2 +#include "smb2proto.h" +#endif #define CIFS_PORT 445#define RFC1001_PORT 139
@@ -2100,8 +2103,8 @@ cifs_find_tcp_session(struct smb_vol *voreturn NULL ; } -static void -cifs_put_tcp_session (struct TCP_Server_Info *server) +void +cifs_put_tcp_session (struct TCP_Server_Info *server,int from_reconnect) {struct task_struct *task;
@@ -2118,6 +2121,19 @@ cifs_put_tcp_session(struct TCP_Server_Icancel_delayed_work_sync (&server->echo); +#ifdef CONFIG_CIFS_SMB2 +if (from_reconnect) +/* +* Avoid deadlock here: reconnect work calls +* cifs_put_tcp_session() at its end. Need to be sure +* that reconnect work does nothing with server pointer after +* that step. +*/ +cancel_delayed_work (&server->reconnect); +else +cancel_delayed_work_sync (&server->reconnect); +#endif +spin_lock (&GlobalMid_Lock); server->tcpStatus = CifsExiting;spin_unlock (&GlobalMid_Lock);
@@ -2182,6 +2198,10 @@ cifs_get_tcp_session(struct smb_vol *volINIT_LIST_HEAD (&tcp_ses->tcp_ses_list);INIT_LIST_HEAD (&tcp_ses->smb_ses_list);INIT_DELAYED_WORK (&tcp_ses->echo, cifs_echo_request); +#ifdef CONFIG_CIFS_SMB2 +INIT_DELAYED_WORK (&tcp_ses->reconnect, smb2_reconnect_server); +mutex_init (&tcp_ses->reconnect_mutex); +#endif memcpy (&tcp_ses->srcaddr, &volume_info->srcaddr,sizeof (tcp_ses->srcaddr)); memcpy(&tcp_ses->dstaddr, &volume_info->dstaddr,
@@ -2340,7 +2360,7 @@ cifs_put_smb_ses(struct cifs_ses *ses)spin_unlock (&cifs_tcp_ses_lock);sesInfoFree (ses); -cifs_put_tcp_session (server); +cifs_put_tcp_session (server,0 ); }#ifdef CONFIG_KEYS
@@ -2514,7 +2534,7 @@ cifs_get_smb_ses(struct TCP_Server_Infomutex_unlock (&ses->session_mutex);/* existing SMB ses has a server reference already */ -cifs_put_tcp_session (server); +cifs_put_tcp_session (server,0 );free_xid (xid);return ses; }
@@ -2604,7 +2624,7 @@ cifs_find_tcon(struct cifs_ses *ses, conreturn NULL ; } -static void +void cifs_put_tcon (struct cifs_tcon *tcon) {unsigned int xid;
@@ -3792,7 +3812,7 @@ mount_fail_check:else if (ses)cifs_put_smb_ses (ses);else -cifs_put_tcp_session (server); +cifs_put_tcp_session (server,0 );bdi_destroy (&cifs_sb->bdi); }
@@ -4103,7 +4123,7 @@ cifs_construct_tcon(struct cifs_sb_info ses =cifs_get_smb_ses (master_tcon->ses->server, vol_info);if (IS_ERR (ses)) { tcon = (struct cifs_tcon *)ses; -cifs_put_tcp_session (master_tcon->ses->server); +cifs_put_tcp_session (master_tcon->ses->server,0 ); goto out; }
fs/cifs/smb2pdu.c +51 -24
89 lines not on this page · raw message
fs/cifs/smb2proto.h +1 -0
@@ -96,6 +96,7 @@ extern int smb2_open_file(const unsignedextern int smb2_unlock_range (struct cifsFileInfo *cfile,struct file_lock *flock,const unsigned int xid);extern int smb2_push_mandatory_locks (struct cifsFileInfo *cfile); +extern void smb2_reconnect_server (struct work_struct *work);/* * SMB2 Worker functions - most of protocol specific implementation details
Greg Kroah-Hartman
maintainerPATCH 69/83 CIFS: Fix missing nls unload in smb2_reconnect()
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Shilovsky <[email protected]>
commit 4772c79599564bd08ee6682715a7d3516f67433f upstream.
--- fs/cifs/smb2pdu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/cifs/smb2pdu.c +1 -1
@@ -280,7 +280,7 @@ out:case SMB2_CHANGE_NOTIFY :case SMB2_QUERY_INFO :case SMB2_SET_INFO : -return -EAGAIN ; + rc = -EAGAIN ; }unload_nls (nls_codepage);return rc;
Greg Kroah-Hartman
maintainerPATCH 70/83 CIFS: Fix a possible double locking of mutex during reconnect
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Shilovsky <[email protected]>
commit 96a988ffeb90dba33a71c3826086fe67c897a183 upstream.
With the current code it is possible to lock a mutex twice when a subsequent reconnects are triggered. On the 1st reconnect we reconnect sessions and tcons and then persistent file handles. If the 2nd reconnect happens during the reconnecting of persistent file handles then the following sequence of calls is observed:
cifs_reopen_file -> SMB2_open -> small_smb2_init -> smb2_reconnect -> cifs_reopen_persistent_file_handles -> cifs_reopen_file (again!).
So, we are trying to acquire the same cfile->fh_mutex twice which is wrong. Fix this by moving reconnecting of persistent handles to the delayed work (smb2_reconnect_server) and submitting this work every time we reconnect tcon in SMB2 commands handling codepath.
This can also lead to corruption of a temporary file list in cifs_reopen_persistent_file_handles() because we can recursively call this function twice.
--- fs/cifs/cifsglob.h | 1 + fs/cifs/file.c | 8 +++++++- fs/cifs/smb2pdu.c | 14 +++++++++----- fs/cifs/smb2pdu.h | 2 ++ 4 files changed, 19 insertions(+), 6 deletions(-)
fs/cifs/cifsglob.h +1 -0
@@ -925,6 +925,7 @@ struct cifs_tcon {bool broken_posix_open;/* e.g. Samba server versions < 3.3.2, 3.2.9 */ bool broken_sparse_sup;/* if server or share does not support sparse */ bool need_reconnect:1; /* connection reset, tid now invalid */ + bool need_reopen_files:1; /* need to reopen tcon file handles */ bool use_resilient:1; /* use resilient instead of durable handles */ bool use_persistent:1; /* use persistent instead of durable handles */#ifdef CONFIG_CIFS_SMB2
fs/cifs/file.c +7 -1
@@ -777,6 +777,11 @@ cifs_reopen_persistent_handles(struct cistruct list_head *tmp1;struct list_head tmp_list; +if (!tcon->use_persistent || !tcon->need_reopen_files) +return ; + + tcon->need_reopen_files = false; +cifs_dbg (FYI ,"Reopen persistent handles" );INIT_LIST_HEAD (&tmp_list);
@@ -793,7 +798,8 @@ cifs_reopen_persistent_handles(struct cilist_for_each_safe (tmp, tmp1, &tmp_list) { open_file = list_entry(tmp, struct cifsFileInfo, rlist); -cifs_reopen_file (open_file, false/* do not flush */ ); +if (cifs_reopen_file (open_file, false/* do not flush */ )) + tcon->need_reopen_files = true;list_del_init (&open_file->rlist);cifsFileInfo_put (open_file); }
fs/cifs/smb2pdu.c +9 -5
@@ -250,16 +250,19 @@ smb2_reconnect(__le16 smb2_command, stru }cifs_mark_open_files_invalid (tcon); +if (tcon->use_persistent) + tcon->need_reopen_files = true; rc =SMB2_tcon (0 , tcon->ses, tcon->treeName, tcon, nls_codepage);mutex_unlock (&tcon->ses->session_mutex); -if (tcon->use_persistent) -cifs_reopen_persistent_handles (tcon); -cifs_dbg (FYI ,"reconnect tcon rc = %d\n" , rc);if (rc) goto out; + +if (smb2_command !=SMB2_INTERNAL_CMD ) +queue_delayed_work (cifsiod_wq, &server->reconnect,0 ); +atomic_inc (&tconInfoReconnectCount); out:/*
@@ -1990,7 +1993,7 @@ void smb2_reconnect_server(struct work_sspin_lock (&cifs_tcp_ses_lock);list_for_each_entry (ses, &server->smb_ses_list, smb_ses_list) {list_for_each_entry (tcon, &ses->tcon_list, tcon_list) { -if (tcon->need_reconnect) { +if (tcon->need_reconnect || tcon->need_reopen_files) { tcon->tc_count++;list_add_tail (&tcon->rlist, &tmp_list); tcon_exist = true;
@@ -2007,7 +2010,8 @@ void smb2_reconnect_server(struct work_sspin_unlock (&cifs_tcp_ses_lock);list_for_each_entry_safe (tcon, tcon2, &tmp_list, rlist) { -smb2_reconnect (SMB2_ECHO , tcon); +if (!smb2_reconnect (SMB2_INTERNAL_CMD , tcon)) +cifs_reopen_persistent_handles (tcon);list_del_init (&tcon->rlist);cifs_put_tcon (tcon); }
fs/cifs/smb2pdu.h +2 -0
@@ -80,6 +80,8 @@#define SMB2_SET_INFO cpu_to_le16(SMB2_SET_INFO_HE)#define SMB2_OPLOCK_BREAK cpu_to_le16(SMB2_OPLOCK_BREAK_HE) +#define SMB2_INTERNAL_CMD cpu_to_le16(0xFFFF) +#define NUMBER_OF_SMB2_COMMANDS 0x0013/* BB FIXME - analyze following length BB */
Greg Kroah-Hartman
maintainerPATCH 71/83 CIFS: Decrease verbosity of ioctl call
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Shilovsky <[email protected]>
commit b0a752b5ce76bd1d8b733a53757c3263511dcb69 upstream.
--- fs/cifs/ioctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/cifs/ioctl.c +1 -1
@@ -189,7 +189,7 @@ long cifs_ioctl(struct file *filep, unsi xid =get_xid (); cifs_sb =CIFS_SB (inode->i_sb); -cifs_dbg (VFS ,"cifs ioctl 0x%x\n" , command); +cifs_dbg (FYI ,"cifs ioctl 0x%x\n" , command);switch (command) {case FS_IOC_GETFLAGS :if (pSMBFile ==NULL )
Greg Kroah-Hartman
maintainerPATCH 72/83 CIFS: Fix a possible memory corruption in push locks
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Shilovsky <[email protected]>
commit e3d240e9d505fc67f8f8735836df97a794bbd946 upstream.
If maxBuf is not 0 but less than a size of SMB2 lock structure we can end up with a memory corruption.
--- fs/cifs/smb2file.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/cifs/smb2file.c +1 -1
@@ -260,7 +260,7 @@ smb2_push_mandatory_locks(struct cifsFil* and check it for zero before using. */ max_buf =tlink_tcon (cfile->tlink)->ses->server->maxBuf; -if (!max_buf) { +if (max_buf <sizeof (struct smb2_lock_element )) {free_xid (xid);return -EINVAL ; }
Greg Kroah-Hartman
maintainerPATCH 73/83 kernel/watchdog: use nmi registers snapshot in hardlockup handler
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Khlebnikov <[email protected]>
commit 4d1f0fb096aedea7bb5489af93498a82e467c480 upstream.
NMI handler doesn't call set_irq_regs(), it's set only by normal IRQ. Thus get_irq_regs() returns NULL or stale registers snapshot with IP/SP pointing to the code interrupted by IRQ which was interrupted by NMI. NULL isn't a problem: in this case watchdog calls dump_stack() and prints full stack trace including NMI. But if we're stuck in IRQ handler then NMI watchlog will print stack trace without IRQ part at all.
This patch uses registers snapshot passed into NMI handler as arguments:
these registers point exactly to the instruction interrupted by NMI.
--- kernel/watchdog.c | 1 - 1 file changed, 1 deletion(-)
kernel/watchdog.c +0 -1
@@ -344,7 +344,6 @@ static void watchdog_overflow_callback(s*/ if (is_hardlockup ()) {int this_cpu =smp_processor_id (); -struct pt_regs *regs =get_irq_regs ();/* only print hardlockups once */ if (__this_cpu_read (hard_watchdog_warn) == true)
Greg Kroah-Hartman
maintainerPATCH 74/83 watchdog: mei_wdt: request stop on reboot to prevent false positive event
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Usyskin <[email protected]>
commit 9eff1140a82db8c5520f76e51c21827b4af670b3 upstream.
Systemd on reboot enables shutdown watchdog that leaves the watchdog device open to ensure that even if power down process get stuck the platform reboots nonetheless.
The iamt_wdt is an alarm-only watchdog and can't reboot system, but the FW will generate an alarm event reboot was completed in time, as the watchdog is not automatically disabled during power cycle. So we should request stop watchdog on reboot to eliminate wrong alarm from the FW.
--- drivers/watchdog/mei_wdt.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/watchdog/mei_wdt.c +2 -0
@@ -389,6 +389,8 @@ static int mei_wdt_register(struct mei_w wdt->wdd.max_timeout =MEI_WDT_MAX_TIMEOUT ;watchdog_set_drvdata (&wdt->wdd, wdt); +watchdog_stop_on_reboot (&wdt->wdd); + ret =watchdog_register_device (&wdt->wdd);if (ret) {dev_err (dev,"unable to register watchdog device = %d.\n" , ret);
Greg Kroah-Hartman
maintainerPATCH 75/83 watchdog: qcom: fix kernel panic due to external abort on non-linefetch
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Lamparter <[email protected]>
commit f06f35c66fdbd5ac38901a3305ce763a0cd59375 upstream.
This patch fixes a off-by-one in the "watchdog: qcom: add option for standalone watchdog not in timer block" patch that causes the following panic on boot:
Quoted 16 lines
Unhandled fault: external abort on non-linefetch (
0x1008) at0xc8874002pgd =c0204000
[c8874002] *pgd=87806811, *pte=0b017653, *ppte=0b017453Internal error: : 1008 [#1] SMP ARM CPU: 2 PID: 1 Comm: swapper/0 Not tainted 4.8.6 #0 Hardware name: Generic DT based system PC is at 0xc02222f4 LR is at 0x1 pc : [<c02222f4>] lr : [<00000001>] psr: 00000113sp :
c782fc98ip : 00000003 fp : 00000000
r10: 00000004 r9 :c782e000r8 :c04ab98c
r7 : 00000001 r6 :c8874002r5 :c782fe00r4 : 00000002 r3 : 00000000 r2 :c782fe00r1 : 00100000 r0 :c8874002
Flags: nzcv IRQs on FIQs on ModeSVC_32ISA ARM Segment none
Control:10c5387dTable:8020406aDAC: 00000051 Process swapper/0 (pid: 1, stack limit =0xc782e210)
Quoted 2 lines
Stack: (0xc782fc98 to 0xc7830000)[...]
The WDT_STS (status) needs to be translated via wdt_addr as well.
--- drivers/watchdog/qcom-wdt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/watchdog/qcom-wdt.c +1 -1
@@ -209,7 +209,7 @@ static int qcom_wdt_probe(struct platfor wdt->wdd.parent = &pdev->dev; wdt->layout = regs; -if (readl (wdt->base +WDT_STS ) &1 ) +if (readl (wdt_addr (wdt,WDT_STS )) &1 ) wdt->wdd.bootstatus =WDIOF_CARDRESET ;/*
Greg Kroah-Hartman
maintainerPATCH 76/83 kernel/debug/debug_core.c: more properly delay for secondary CPUs
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Douglas Anderson <[email protected]>
commit 2d13bb6494c807bcf3f78af0e96c0b8615a94385 upstream.
We've got a delay loop waiting for secondary CPUs. That loop uses loops_per_jiffy. However, loops_per_jiffy doesn't actually mean how many tight loops make up a jiffy on all architectures. It is quite common to see things like this in the boot log:
Calibrating delay loop (skipped), value calculated using timer frequency.. 48.00 BogoMIPS (lpj=24000)
In my case I was seeing lots of cases where other CPUs timed out entering the debugger only to print their stack crawls shortly after the kdb> prompt was written.
Elsewhere in kgdb we already use udelay(), so that should be safe enough to use to implement our timeout. We'll delay 1 ms for 1000 times, which should give us a full second of delay (just like the old code wanted) but allow us to notice that we're done every 1 ms.
--- kernel/debug/debug_core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/debug/debug_core.c +2 -2
@@ -598,11 +598,11 @@ return_normal:/* * Wait for the other CPUs to be notified and be waiting for us: */ - time_left = loops_per_jiffy *HZ ; + time_left =MSEC_PER_SEC ;while (kgdb_do_roundup && --time_left && (atomic_read (&masters_in_kgdb) +atomic_read (&slaves_in_kgdb)) != online_cpus) -cpu_relax (); +udelay (1000 );if (!time_left)pr_crit ("Timed out waiting for secondary CPUs.\n" );
Greg Kroah-Hartman
maintainerPATCH 77/83 tpm xen: Remove bogus tpm_chip_unregister
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Gunthorpe <[email protected]>
commit 1f0f30e404b3d8f4597a2d9b77fba55452f8fd0e upstream.
tpm_chip_unregister can only be called after tpm_chip_register. devm manages the allocation so no unwind is needed here.
--- drivers/char/tpm/xen-tpmfront.c | 1 - 1 file changed, 1 deletion(-)
drivers/char/tpm/xen-tpmfront.c +0 -1
@@ -307,7 +307,6 @@ static int tpmfront_probe(struct xenbus_ rv =setup_ring (dev, priv);if (rv) { chip =dev_get_drvdata (&dev->dev); -tpm_chip_unregister (chip);ring_free (priv);return rv; }
Greg Kroah-Hartman
maintainerPATCH 78/83 xen/gntdev: Use VM_MIXEDMAP instead of VM_IO to avoid NUMA balancing
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boris Ostrovsky <[email protected]>
commit 30faaafdfa0c754c91bac60f216c9f34a2bfdf7e upstream.
Commit 9c17d96500f7 ("xen/gntdev: Grant maps should not be subject to NUMA balancing") set VM_IO flag to prevent grant maps from being subjected to NUMA balancing.
It was discovered recently that this flag causes get_user_pages() to always fail with -EFAULT.
check_vma_flags__get_user_pages__get_user_pages_locked__get_user_pages_unlockedget_user_pages_fastiov_iter_get_pagesdio_refill_pagesdo_direct_IOdo_blockdev_direct_IOdo_blockdev_direct_IOext4_direct_IO_readgeneric_file_read_iteraio_run_iocb
(which can happen if guest's vdisk has direct-io-safe option).
To avoid this let's use VM_MIXEDMAP flag instead --- it prevents NUMA balancing just as VM_IO does and has no effect on check_vma_flags().
--- drivers/xen/gntdev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/xen/gntdev.c +1 -1
@@ -1007,7 +1007,7 @@ static int gntdev_mmap(struct file *flip vma->vm_ops = &gntdev_vmops; - vma->vm_flags |=VM_DONTEXPAND |VM_DONTDUMP |VM_IO ; + vma->vm_flags |=VM_DONTEXPAND |VM_DONTDUMP |VM_MIXEDMAP ;if (use_ptemod) vma->vm_flags |=VM_DONTCOPY ;
Greg Kroah-Hartman
maintainerPATCH 79/83 arm/xen: Use alloc_percpu rather than __alloc_percpu
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julien Grall <[email protected]>
commit 24d5373dda7c00a438d26016bce140299fae675e upstream.
The function xen_guest_init is using __alloc_percpu with an alignment which are not power of two.
However, the percpu allocator never supported alignments which are not power of two and has always behaved incorectly in thise case.
Commit 3ca45a4 "percpu: ensure requested alignment is power of two" introduced a check which trigger a warning [1] when booting linux-next on Xen. But in reality this bug was always present.
This can be fixed by replacing the call to __alloc_percpu with alloc_percpu. The latter will use an alignment which are a power of two.
[1]
[ 0.023921] illegal size (48) or align (48) for percpu allocation
[ 0.024167] ------------[ cut here ]------------
[ 0.024344] WARNING: CPU: 0 PID: 1 at linux/mm/percpu.c:892 pcpu_alloc+0x88/0x6c0
[ 0.024584] Modules linked in:
[ 0.024708]
[ 0.024804] CPU: 0 PID: 1 Comm: swapper/0 Not tainted
4.9.0-rc7-next-20161128 #473
[ 0.025012] Hardware name: Foundation-v8A (DT)
[ 0.025162] task: ffff80003d870000 task.stack: ffff80003d844000
[ 0.025351] PC is at pcpu_alloc+0x88/0x6c0
[ 0.025490] LR is at pcpu_alloc+0x88/0x6c0
[ 0.025624] pc : [<ffff00000818e678>] lr : [<ffff00000818e678>]
pstate: 60000045
[ 0.025830] sp : ffff80003d847cd0
[ 0.025946] x29: ffff80003d847cd0 x28: 0000000000000000
[ 0.026147] x27: 0000000000000000 x26: 0000000000000000
[ 0.026348] x25: 0000000000000000 x24: 0000000000000000
[ 0.026549] x23: 0000000000000000 x22: 00000000024000c0
[ 0.026752] x21: ffff000008e97000 x20: 0000000000000000
[ 0.026953] x19: 0000000000000030 x18: 0000000000000010
[ 0.027155] x17: 0000000000000a3f x16: 00000000deadbeef
[ 0.027357] x15: 0000000000000006 x14: ffff000088f79c3f
[ 0.027573] x13: ffff000008f79c4d x12: 0000000000000041
[ 0.027782] x11: 0000000000000006 x10: 0000000000000042
[ 0.027995] x9 : ffff80003d847a40 x8 : 6f697461636f6c6c
[ 0.028208] x7 : 6120757063726570 x6 : ffff000008f79c84
[ 0.028419] x5 : 0000000000000005 x4 : 0000000000000000
[ 0.028628] x3 : 0000000000000000 x2 : 000000000000017f
[ 0.028840] x1 : ffff80003d870000 x0 : 0000000000000035
[ 0.029056]
[ 0.029152] ---[ end trace 0000000000000000 ]---
[ 0.029297] Call trace:
[ 0.029403] Exception stack(0xffff80003d847b00 to
0xffff80003d847c30)
[ 0.029621] 7b00: 0000000000000030 0001000000000000
ffff80003d847cd0 ffff00000818e678
[ 0.029901] 7b20: 0000000000000002 0000000000000004
ffff000008f7c060 0000000000000035
[ 0.030153] 7b40: ffff000008f79000 ffff000008c4cd88
ffff80003d847bf0 ffff000008101778
[ 0.030402] 7b60: 0000000000000030 0000000000000000
ffff000008e97000 00000000024000c0
[ 0.030647] 7b80: 0000000000000000 0000000000000000
0000000000000000 0000000000000000
[ 0.030895] 7ba0: 0000000000000035 ffff80003d870000
000000000000017f 0000000000000000
[ 0.031144] 7bc0: 0000000000000000 0000000000000005
ffff000008f79c84 6120757063726570
[ 0.031394] 7be0: 6f697461636f6c6c ffff80003d847a40
0000000000000042 0000000000000006
[ 0.031643] 7c00: 0000000000000041 ffff000008f79c4d
ffff000088f79c3f 0000000000000006
[ 0.031877] 7c20: 00000000deadbeef 0000000000000a3f
[ 0.032051] [<ffff00000818e678>] pcpu_alloc+0x88/0x6c0
[ 0.032229] [<ffff00000818ece8>] __alloc_percpu+0x18/0x20
[ 0.032409] [<ffff000008d9606c>] xen_guest_init+0x174/0x2f4
[ 0.032591] [<ffff0000080830f8>] do_one_initcall+0x38/0x130
[ 0.032783] [<ffff000008d90c34>] kernel_init_freeable+0xe0/0x248
[ 0.032995] [<ffff00000899a890>] kernel_init+0x10/0x100
[ 0.033172] [<ffff000008082ec0>] ret_from_fork+0x10/0x50--- arch/arm/xen/enlighten.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
arch/arm/xen/enlighten.c +1 -2
@@ -372,8 +372,7 @@ static int __init xen_guest_init(void)* for secondary CPUs as they are brought up. * For uniformity we use VCPUOP_register_vcpu_info even on cpu0. */ - xen_vcpu_info =__alloc_percpu (sizeof (struct vcpu_info ), -sizeof (struct vcpu_info )); + xen_vcpu_info = alloc_percpu(struct vcpu_info);if (xen_vcpu_info ==NULL )return -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 80/83 xfs: fix up xfs_swap_extent_forks inline extent handling
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Sandeen <[email protected]>
commit 4dfce57db6354603641132fac3c887614e3ebe81 upstream.
There have been several reports over the years of NULL pointer dereferences in xfs_trans_log_inode during xfs_fsr processes, when the process is doing an fput and tearing down extents on the temporary inode, something like:
BUG: unable to handle kernel NULL pointer dereference at 0000000000000018
PID: 29439 TASK: ffff880550584fa0 CPU: 6 COMMAND: "xfs_fsr"
[exception RIP: xfs_trans_log_inode+0x10]
#9 [ffff8800a57bbbe0] xfs_bunmapi at ffffffffa037398e [xfs]#10 [ffff8800a57bbce8] xfs_itruncate_extents at ffffffffa0391b29 [xfs] #11 [ffff8800a57bbd88] xfs_inactive_truncate at ffffffffa0391d0c [xfs] #12 [ffff8800a57bbdb8] xfs_inactive at ffffffffa0392508 [xfs] #13 [ffff8800a57bbdd8] xfs_fs_evict_inode at ffffffffa035907e [xfs] #14 [ffff8800a57bbe00] evict at ffffffff811e1b67
#15 [ffff8800a57bbe28] iput at ffffffff811e23a5
#16 [ffff8800a57bbe58] dentry_kill at ffffffff811dcfc8
#17 [ffff8800a57bbe88] dput at ffffffff811dd06c
#18 [ffff8800a57bbea8] __fput at ffffffff811c823b
#19 [ffff8800a57bbef0] ____fput at ffffffff811c846e
#20 [ffff8800a57bbf00] task_work_run at ffffffff81093b27 #21 [ffff8800a57bbf30] do_notify_resume at ffffffff81013b0c #22 [ffff8800a57bbf50] int_signal at ffffffff8161405d
As it turns out, this is because the i_itemp pointer, along with the d_ops pointer, has been overwritten with zeros when we tear down the extents during truncate. When the in-core inode fork on the temporary inode used by xfs_fsr was originally set up during the extent swap, we mistakenly looked at di_nextents to determine whether all extents fit inline, but this misses extents generated by speculative preallocation; we should be using if_bytes instead.
This mistake corrupts the in-memory inode, and code in xfs_iext_remove_inline eventually gets bad inputs, causing it to memmove and memset incorrect ranges; this became apparent because the two values in ifp->if_u2.if_inline_ext[1] contained what should have been in d_ops and i_itemp; they were memmoved due to incorrect array indexing and then the original locations were zeroed with memset, again due to an array overrun.
Fix this by properly using i_df.if_bytes to determine the number of extents, not di_nextents.
Thanks to dchinner for looking at this with me and spotting the root cause.
--- fs/xfs/xfs_bmap_util.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
fs/xfs/xfs_bmap_util.c +5 -2
@@ -1792,6 +1792,7 @@ xfs_swap_extent_forks(struct xfs_ifork tempifp, *ifp, *tifp;int aforkblks =0 ;int taforkblks =0 ; +xfs_extnum_t nextents;__uint64_t tmp;int error;
@@ -1881,7 +1882,8 @@ xfs_swap_extent_forks(* pointer. Otherwise it's already NULL or * pointing to the extent. */ -if (ip->i_d.di_nextents <=XFS_INLINE_EXTS ) { + nextents = ip->i_df.if_bytes / (uint )sizeof (xfs_bmbt_rec_t); +if (nextents <=XFS_INLINE_EXTS ) { ifp->if_u1.if_extents = ifp->if_u2.if_inline_ext; }
@@ -1900,7 +1902,8 @@ xfs_swap_extent_forks(* pointer. Otherwise it's already NULL or * pointing to the extent. */ -if (tip->i_d.di_nextents <=XFS_INLINE_EXTS ) { + nextents = tip->i_df.if_bytes / (uint )sizeof (xfs_bmbt_rec_t); +if (nextents <=XFS_INLINE_EXTS ) { tifp->if_u1.if_extents = tifp->if_u2.if_inline_ext; }
Greg Kroah-Hartman
maintainerPATCH 81/83 xfs: set AGI buffer type in xlog_recover_clear_agi_bucket
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Sandeen <[email protected]>
commit 6b10b23ca94451fae153a5cc8d62fd721bec2019 upstream.
xlog_recover_clear_agi_bucket didn't set the type to XFS_BLFT_AGI_BUF, so we got a warning during log replay (or an ASSERT on a debug build).
XFS (md0): Unknown buffer type 0!
XFS (md0): _xfs_buf_ioapply: no ops on block 0xaea8802/0x1
Fix this, as was done in f19b872b for 2 other locations with the same problem.
--- fs/xfs/xfs_log_recover.c | 1 + 1 file changed, 1 insertion(+)
fs/xfs/xfs_log_recover.c +1 -0
@@ -4929,6 +4929,7 @@ xlog_recover_clear_agi_bucket( agi->agi_unlinked[bucket] =cpu_to_be32 (NULLAGINO ); offset = offsetof(xfs_agi_t , agi_unlinked) + (sizeof (xfs_agino_t) * bucket); +xfs_trans_buf_set_type (tp, agibp,XFS_BLFT_AGI_BUF );xfs_trans_log_buf (tp, agibp, offset, (offset +sizeof (xfs_agino_t) -1 ));
Greg Kroah-Hartman
maintainerPATCH 82/83 builddeb: fix cross-building to arm64 producing host-arch debs
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adam Borowski <[email protected]>
commit 152b695d74376bfe55cd2a6265ccc75b0d39dd19 upstream.
Both Debian and kernel archs are "arm64" but UTS_MACHINE and gcc say "aarch64". Recognizing just the latter should be enough but let's accept both in case something regresses again or an user sets UTS_MACHINE=arm64.
Regressed in cfa88c7: arm64: Set UTS_MACHINE in the Makefile.
--- scripts/package/builddeb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
scripts/package/builddeb +1 -1
@@ -51,7 +51,7 @@ set_debarch() { debarch=hppa ;; mips*) debarch=mips$(grep -q CPU_LITTLE_ENDIAN=y $KCONFIG_CONFIG && echo el || true) ;; - arm64) + aarch64|arm64) debarch=arm64 ;; arm*) if grep -q CONFIG_AEABI=y $KCONFIG_CONFIG; then
Greg Kroah-Hartman
maintainerPATCH 83/83 x86/kbuild: enable modversions for symbols exported from asm
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adam Borowski <[email protected]>
commit 334bb773876403eae3457d81be0b8ea70f8e4ccc upstream.
Commit 4efca4ed ("kbuild: modversions for EXPORT_SYMBOL() for asm") adds modversion support for symbols exported from asm files. Architectures must include C-style declarations for those symbols in asm/asm-prototypes.h in order for them to be versioned.
Add these declarations for x86, and an architecture-independent file that can be used for common symbols.
With f27c2f6 reverting 8ab2ae6 ("default exported asm symbols to zero") we produce a scary warning on x86, this commit fixes that.
--- arch/x86/include/asm/asm-prototypes.h | 16 ++++++++++++++++ include/asm-generic/asm-prototypes.h | 7 +++++++ 2 files changed, 23 insertions(+)
arch/x86/include/asm/asm-prototypes.h new file +16 -0
@@ -0,0 +1,16 @@ +#include <asm/ftrace.h> +#include <asm/uaccess.h> +#include <asm/string.h> +#include <asm/page.h> +#include <asm/checksum.h> + +#include <asm-generic/asm-prototypes.h> + +#include <asm/page.h> +#include <asm/pgtable.h> +#include <asm/special_insns.h> +#include <asm/preempt.h> + +#ifndef CONFIG_X86_CMPXCHG64 +extern void cmpxchg8b_emu (void ); +#endif
include/asm-generic/asm-prototypes.h new file +7 -0
@@ -0,0 +1,7 @@ +#include <linux/bitops.h> +extern void *__memset (void *,int ,__kernel_size_t ); +extern void *__memcpy (void *,const void *,__kernel_size_t ); +extern void *__memmove (void *,const void *,__kernel_size_t ); +extern void *memset (void *,int ,__kernel_size_t ); +extern void *memcpy (void *,const void *,__kernel_size_t ); +extern void *memmove (void *,const void *,__kernel_size_t );
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.9.1 release. There are 83 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri Jan 6 20:04:25 UTC 2017. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.1-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.9.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
Signature · 5 lines
Shuah Khan Sr. Linux Kernel Developer Open Source Innovation Group Samsung Research America(Silicon Valley) [email protected]
Greg Kroah-Hartman
maintainerQuoted 15 lines · Shuah Khan
Quoted 14 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.9.1 release. There are 83 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri Jan 6 20:04:25 UTC 2017. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.1-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.9.y
and the diffstat can be found below.
Quoted 6 lines
Quoted 4 lines
thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
Thanks for testing all of these and letting me know.
greg k-h
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.9.1 release. There are 83 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri Jan 6 20:04:25 UTC 2017. Anything received after that time might be too late.
Build results:
total: 149 pass: 148 fail: 1 Failed builds: avr32:merisc_defconfig Qemu test results: total: 122 pass: 122 fail: 0
Failure is due to an avr32 compiler or linker problem. Nothing we can do about it. I'll probably drop the avr32 builds in the future unless I find a way to avoid the failure.
Details are available at http://kerneltests.org/builders.
Guenter
Greg Kroah-Hartman
maintainerQuoted 17 lines · Guenter Roeck
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.9.1 release. There are 83 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri Jan 6 20:04:25 UTC 2017. Anything received after that time might be too late.
Build results:
total: 149 pass: 148 fail: 1 Failed builds: avr32:merisc_defconfig Qemu test results: total: 122 pass: 122 fail: 0
Quoted 3 lines
Failure is due to an avr32 compiler or linker problem. Nothing we can do about it. I'll probably drop the avr32 builds in the future unless I find a way to avoid the failure.
Oh good, I got worried I broke something there :)
Thanks for testing all of these.
greg k-h