4.11.3-stable review
Subsystems (7)
Greg Kroah-Hartman
maintainercover 4.11.3-stable review
This is the start of the stable review cycle for the 4.11.3 release. There are 197 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu May 25 20:07:44 UTC 2017. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.11.3-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.11.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.11.3-rc1
Tadeusz Struk <[email protected]>
IB/hfi1: Protect the global dev_cntr_names and port_cntr_names
Chris Wilson <[email protected]>
drm/i915/gvt: Disable access to stolen memory as a guest
Julius Werner <[email protected]>
drivers: char: mem: Check for address space wraparound with mmap()
Trond Myklebust <[email protected]>
nfsd: Fix up the "supattr_exclcreat" attributes
J. Bruce Fields <[email protected]>
nfsd: encoders mustn't use unitialized values in error cases
Ari Kauppi <[email protected]>
nfsd: fix undefined behavior in nfsd4_layout_verify
Trond Myklebust <[email protected]>
NFSv4: Fix an rcu lock leak
Trond Myklebust <[email protected]>
pNFS/flexfiles: Check the result of nfs4_pnfs_ds_connect
Benjamin Coddington <[email protected]>
NFS: Use GFP_NOIO for two allocations in writeback
Fred Isaman <[email protected]>
NFS: Fix use after free in write error path
Trond Myklebust <[email protected]>
NFSv4: Fix a hang in OPEN related to server reboot
Mario Kleiner <[email protected]>
drm/edid: Add 10 bpc quirk for LGD 764 panel in HP zBook 17 G2
Alexander Couzens <[email protected]>
mtd: nand: add ooblayout for old hamming layout
Roger Quadros <[email protected]>
mtd: nand: omap2: Fix partition creation via cmdline mtdparts
Simon Baatz <[email protected]>
mtd: nand: orion: fix clk handling
Lukas Wunner <[email protected]>
PCI: Freeze PME scan before suspending devices
David Woodhouse <[email protected]>
PCI: Only allow WC mmap on prefetchable resources
David Woodhouse <[email protected]>
PCI: Fix another sanity check bug in /proc/pci mmap
David Woodhouse <[email protected]>
PCI: Fix pci_mmap_fits() for HAVE_PCI_RESOURCE_TO_USER platforms
K. Y. Srinivasan <[email protected]>
PCI: hv: Specify CPU_AFFINITY_ALL for MSI affinity when >= 32 CPUs
K. Y. Srinivasan <[email protected]>
PCI: hv: Allocate interrupt descriptors with GFP_ATOMIC
Tomasz Nowicki <[email protected]>
PCI/ACPI: Add ThunderX pass2.x 2nd node MCFG quirk
Bjorn Helgaas <[email protected]>
PCI/ACPI: Tidy up MCFG quirk whitespace
Dawei Chien <[email protected]>
thermal: mt8173: minor mtk_thermal.c cleanups
Thomas Gleixner <[email protected]>
tracing/kprobes: Enforce kprobes teardown after testing
Arnd Bergmann <[email protected]>
firmware: ti_sci: fix strncat length check
Masami Hiramatsu <[email protected]>
um: Fix to call read_initrd after init_bootmem
Lars Ellenberg <[email protected]>
drbd: fix request leak introduced by locking/atomic, kref: Kill kref_sub()
Al Viro <[email protected]>
osf_wait4(): fix infoleak
Suzuki K Poulose <[email protected]>
kvm: arm/arm64: Force reading uncached stage2 PGD
Suzuki K Poulose <[email protected]>
kvm: arm/arm64: Fix use after free of stage2 page table
Suzuki K Poulose <[email protected]>
kvm: arm/arm64: Fix race in resetting stage2 PGD
Huacai Chen <[email protected]>
MIPS: Loongson-3: Select MIPS_L1_CACHE_SHIFT_6
Jon Derrick <[email protected]>
nvme: unmap CMB and remove sysfs file in reset path
Thomas Gleixner <[email protected]>
genirq: Fix chained interrupt data ordering
Johan Hovold <[email protected]>
uwb: fix device quirk on big-endian hosts
Daniel Micay <[email protected]>
stackprotector: Increase the per-task stack canary's random range from 32 bits to 64 bits on 64-bit platforms
James Hogan <[email protected]>
metag/uaccess: Check access_ok in strncpy_from_user
James Hogan <[email protected]>
metag/uaccess: Fix access_ok()
Li, Fei <[email protected]>
cpuidle: check dev before usage in cpuidle_use_deepest_state()
KarimAllah Ahmed <[email protected]>
iommu/vt-d: Flush the IOTLB to get rid of the initial kdump mappings
Malcolm Priestley <[email protected]>
staging: rtl8192e: GetTs Fix invalid TID 7 warning.
Malcolm Priestley <[email protected]>
staging: rtl8192e: rtl92e_get_eeprom_size Fix read size of EPROM_CMD.
Malcolm Priestley <[email protected]>
staging: rtl8192e: fix 2 byte alignment of register BSSIDR.
Malcolm Priestley <[email protected]>
staging: rtl8192e: rtl92e_fill_tx_desc fix write to mapped out memory.
Phil Elwell <[email protected]>
staging: vc04_services: Fix bulk cache maintenance
Kristina Martsenko <[email protected]>
arm64: documentation: document tagged pointer stack constraints
Kristina Martsenko <[email protected]>
arm64: entry: improve data abort handling of tagged pointers
Kristina Martsenko <[email protected]>
arm64: hw_breakpoint: fix watchpoint matching for tagged pointers
Kristina Martsenko <[email protected]>
arm64: traps: fix userspace cache maintenance emulation on a tagged pointer
Mark Rutland <[email protected]>
arm64: uaccess: ensure extension of access_ok() addr
Mark Rutland <[email protected]>
arm64: armv8_deprecated: ensure extension of addr
Mark Rutland <[email protected]>
arm64: ensure extension of smp_store_release value
Mark Rutland <[email protected]>
arm64: xchg: hazard against entire exchange variable
Daniel Lezcano <[email protected]>
arm64: dts: hi6220: Reset the mmc hosts
Leonard Crestez <[email protected]>
ARM: dts: imx6sx-sdb: Remove OPP override
Ludovic Desroches <[email protected]>
ARM: dts: at91: sama5d3_xplained: not all ADC channels are available
Ludovic Desroches <[email protected]>
ARM: dts: at91: sama5d3_xplained: fix ADC vref
Vladimir Murzin <[email protected]>
ARM: 8670/1: V7M: Do not corrupt vector table around v7m_invalidate_l1 call
Jon Medhurst <[email protected]>
ARM: 8667/3: Fix memory attribute inconsistencies when using fixmap
Ard Biesheuvel <[email protected]>
ARM: 8662/1: module: split core and init PLT sections
Zhichao Huang <[email protected]>
KVM: arm: plug potential guest hardware debug leakage
Marc Zyngier <[email protected]>
KVM: arm/arm64: vgic-v3: Do not use Active+Pending state for a HW interrupt
Marc Zyngier <[email protected]>
KVM: arm/arm64: vgic-v2: Do not use Active+Pending state for a HW interrupt
Marc Zyngier <[email protected]>
arm: KVM: Do not use stack-protector to compile HYP code
Marc Zyngier <[email protected]>
arm64: KVM: Do not use stack-protector to compile EL2 code
Michael Neuling <[email protected]>
powerpc/tm: Fix FP and VMX register corruption
Michael Ellerman <[email protected]>
powerpc/mm: Fix crash in page table dump with huge pages
LiuHailong <[email protected]>
powerpc/64e: Fix hang when debugging programs with relocated kernel
Alistair Popple <[email protected]>
powerpc/powernv: Fix TCE kill on NVLink2
Alexey Kardashevskiy <[email protected]>
powerpc/iommu: Do not call PageTransHuge() on tail pages
Tyrel Datwyler <[email protected]>
powerpc/sysfs: Fix reference leak of cpu device_nodes present at boot
Tyrel Datwyler <[email protected]>
powerpc/pseries: Fix of_node_put() underflow during DLPAR remove
Mahesh Salgaonkar <[email protected]>
powerpc/book3s/mce: Move add_taint() later in virtual mode
Russell Currey <[email protected]>
powerpc/eeh: Avoid use after free in eeh_handle_special_event()
David Gibson <[email protected]>
powerpc/mm: Ensure IRQs are off in switch_mm()
Johan Hovold <[email protected]>
cx231xx-cards: fix NULL-deref at probe
Johan Hovold <[email protected]>
cx231xx-audio: fix NULL-deref at probe
Johan Hovold <[email protected]>
cx231xx-audio: fix init error path
Alyssa Milburn <[email protected]>
dw2102: limit messages to buffer size
Alyssa Milburn <[email protected]>
digitv: limit messages to buffer size
Daniel Scheller <[email protected]>
dvb-frontends/cxd2841er: define symbol_rate_min/max in T/C fe-ops
Alyssa Milburn <[email protected]>
zr364xx: enforce minimum size when reading header
Johan Hovold <[email protected]>
dib0700: fix NULL-deref at probe
Marek Szyprowski <[email protected]>
s5p-mfc: Fix unbalanced call to clock management
Johan Hovold <[email protected]>
gspca: konica: add missing endpoint sanity check
Marek Szyprowski <[email protected]>
s5p-mfc: Fix race between interrupt routine and device functions
Lee Jones <[email protected]>
cec: Fix runtime BUG when (CONFIG_RC_CORE && !CEC_CAP_RC)
Srinivas Pandruvada <[email protected]>
iio: hid-sensor: Store restore poll and hysteresis on S3
Matt Ranostay <[email protected]>
iio: proximity: as3935: fix as3935_write
Dan Carpenter <[email protected]>
ipx: call ipxitf_put() in ioctl error path
Johan Hovold <[email protected]>
USB: hub: fix non-SS hub-descriptor handling
Johan Hovold <[email protected]>
USB: hub: fix SS hub-descriptor handling
Johan Hovold <[email protected]>
USB: serial: io_ti: fix div-by-zero in set_termios
Johan Hovold <[email protected]>
USB: serial: mct_u232: fix big-endian baud-rate handling
Bjørn Mork <[email protected]>
USB: serial: qcserial: add more Lenovo EM74xx device IDs
Daniele Palmas <[email protected]>
usb: serial: option: add Telit ME910 support
Johan Hovold <[email protected]>
USB: iowarrior: fix info ioctl on big-endian hosts
Tony Lindgren <[email protected]>
usb: musb: Fix trying to suspend while active for OTG configurations
Peter Ujfalusi <[email protected]>
usb: musb: tusb6010_omap: Do not reset the other direction's packet size
Thinh Nguyen <[email protected]>
usb: dwc3: gadget: Prevent losing events in event cache
Ben Hutchings <[email protected]>
dvb-usb-dibusb-mc-common: Add MODULE_LICENSE
Alyssa Milburn <[email protected]>
ttusb2: limit messages to buffer size
Johan Hovold <[email protected]>
mceusb: fix NULL-deref at probe
Johan Hovold <[email protected]>
usbvision: fix NULL-deref at probe
Johan Hovold <[email protected]>
net: irda: irda-usb: fix firmware name on big-endian hosts
Peter Chen <[email protected]>
usb: host: xhci-mem: allocate zeroed Scratchpad Buffer
Mathias Nyman <[email protected]>
xhci: apply PME_STUCK_QUIRK and MISSING_CAS quirk for Denverton
Alan Stern <[email protected]>
USB: xhci: fix lock-inversion problem
Thomas Petazzoni <[email protected]>
usb: host: xhci-plat: propagate return value of platform_get_irq()
Matthias Lange <[email protected]>
xhci: remove GFP_DMA flag from allocation
Mathias Nyman <[email protected]>
xhci: Fix command ring stop regression in 4.11
Yazen Ghannam <[email protected]>
EDAC, amd64: Fix reporting of Chip Select sizes on Fam17h
Jan Kara <[email protected]>
dax: fix data corruption when fault races with write
Toshi Kani <[email protected]>
libnvdimm: fix clear length of nvdimm_forget_poison()
David Howells <[email protected]>
Make stat/lstat/fstatat pass AT_NO_AUTOMOUNT to vfs_statx()
Johan Hovold <[email protected]>
USB: chaoskey: fix Alea quirk on big-endian hosts
Andrey Korolyov <[email protected]>
USB: serial: ftdi_sio: add Olimex ARM-USB-TINY(H) PIDs
Anthony Mallet <[email protected]>
USB: serial: ftdi_sio: fix setting latency for unprivileged users
Kirill Tkhai <[email protected]>
pid_ns: Fix race between setns'ed fork() and zap_pid_ns_processes()
Eric W. Biederman <[email protected]>
pid_ns: Sleep in TASK_INTERRUPTIBLE in zap_pid_ns_processes
Michael J. Ruhl <[email protected]>
IB/hfi1: Fix a subcontext memory leak
Michael J. Ruhl <[email protected]>
IB/hfi1: Return an error on memory allocation failure
Fabrice Gasnier <[email protected]>
iio: stm32 trigger: fix sampling_frequency read
Andreas Klinger <[email protected]>
IIO: bmp280-core.c: fix error in humidity calculation
Pavel Roskin <[email protected]>
iio: dac: ad7303: fix channel description
James Smart <[email protected]>
scsi: lpfc: Fix panic on BFS configuration
Bryant G. Ly <[email protected]>
ibmvscsis: Do not send aborted task response
Johan Hovold <[email protected]>
of: fdt: add missing allocation-failure check
Tyrel Datwyler <[email protected]>
of: fix "/cpus" reference leak in of_numa_parse_cpu_nodes()
Rob Herring <[email protected]>
of: fix sparse warning in of_pci_range_parser_one
Takashi Iwai <[email protected]>
proc: Fix unbalanced hard link numbers
Vaibhav Jain <[email protected]>
cxl: Route eeh events to all drivers in cxl_pci_error_detected()
Vaibhav Jain <[email protected]>
cxl: Force context lock during EEH flow
Gerd Hoffmann <[email protected]>
ohci-pci: add qemu quirk
Tobias Herzog <[email protected]>
cdc-acm: fix possible invalid access when processing notification
David Rivshin <[email protected]>
gpio: omap: return error if requested debounce time is not possible
Ben Skeggs <[email protected]>
drm/nouveau/tmr: handle races with hw when updating the next alarm time
Ben Skeggs <[email protected]>
drm/nouveau/tmr: avoid processing completed alarms when adding a new one
Ben Skeggs <[email protected]>
drm/nouveau/tmr: fix corruption of the pending list when rescheduling an alarm
Ben Skeggs <[email protected]>
drm/nouveau/tmr: ack interrupt before processing alarms
Ben Skeggs <[email protected]>
drm/nouveau/kms/nv50: skip core channel cursor update on position-only changes
Ben Skeggs <[email protected]>
drm/nouveau/kms/nv50: fix source-rect-only plane updates
Ben Skeggs <[email protected]>
drm/nouveau/therm: remove ineffective workarounds for alarm bugs
Mario Kleiner <[email protected]>
drm/amdgpu: Add missing lb_vblank_lead_lines setup to DCE-6 path.
Mario Kleiner <[email protected]>
drm/amdgpu: Avoid overflows/divide-by-zero in latency_watermark calculations.
Mario Kleiner <[email protected]>
drm/amdgpu: Make display watermark calculations more accurate
Johan Hovold <[email protected]>
ath9k_htc: fix NULL-deref at probe
Dmitry Tunin <[email protected]>
ath9k_htc: Add support of AirTies 1eda:2315 AR9271 device
Martin Schwidefsky <[email protected]>
s390/cputime: fix incorrect system time
Michael Holzheu <[email protected]>
s390/kdump: Add final note
Richard Cochran <[email protected]>
regulator: tps65023: Fix inverted core enable logic.
Wadim Egorov <[email protected]>
regulator: rk808: Fix RK818 LDO2
Linus Torvalds <[email protected]>
x86: fix 32-bit case of __get_user_asm_u64()
Wanpeng Li <[email protected]>
KVM: X86: Fix read out-of-bounds vulnerability in kvm pio emulation
Wanpeng Li <[email protected]>
KVM: x86: Fix potential preemption when get the current kvmclock timestamp
Wanpeng Li <[email protected]>
KVM: x86: Fix load damaged SSEx MXCSR register
Daniel Glöckner <[email protected]>
ima: accept previously set IMA_NEW_FILE
Brian Norris <[email protected]>
mwifiex: pcie: fix cmd_buf use-after-free in remove/reset
Brian Norris <[email protected]>
mwifiex: MAC randomization should not be persistent
Larry Finger <[email protected]>
rtlwifi: rtl8821ae: setup 8812ae RFE according to device type
NeilBrown <[email protected]>
md: MD_CLOSING needs to be cleared after called md_set_readonly or do_md_stop
Dennis Yang <[email protected]>
md: update slab_cache before releasing new stripes when stripes resizing
Joe Thornber <[email protected]>
dm space map disk: fix some book keeping in the disk space map
Joe Thornber <[email protected]>
dm thin metadata: call precommit before saving the roots
Mikulas Patocka <[email protected]>
dm bufio: make the parameter "retain_bytes" unsigned long
Mike Snitzer <[email protected]>
dm cache metadata: fail operations if fail_io mode has been established
Bart Van Assche <[email protected]>
dm mpath: delay requeuing while path initialization is in progress
Bart Van Assche <[email protected]>
dm mpath: avoid that path removal can trigger an infinite loop
Bart Van Assche <[email protected]>
dm mpath: split and rename activate_path() to prepare for its expanded use
Bart Van Assche <[email protected]>
dm mpath: requeue after a small delay if blk_get_request() fails
Mikulas Patocka <[email protected]>
dm bufio: check new buffer allocation watermark every 30 seconds
Mikulas Patocka <[email protected]>
dm bufio: avoid a possible ABBA deadlock
Mikulas Patocka <[email protected]>
dm raid: select the Kconfig option CONFIG_MD_RAID0
Vinothkumar Raja <[email protected]>
dm btree: fix for dm_btree_find_lowest_key()
Paolo Abeni <[email protected]>
infiniband: call ipv6 route lookup via the stub interface
Sagi Grimberg <[email protected]>
mlx5: Fix mlx5_ib_map_mr_sg mr length
Alexander Sverdlin <[email protected]>
ASoC: cs4271: configure reset GPIO as output
Petr Vandrovec <[email protected]>
tpm: fix handling of the TPM 2.0 event logs
Hon Ching \(Vicky) Lo <[email protected]>
vTPM: Fix missing NULL check
Jerry Snitselaar <[email protected]>
tpm_crb: check for bad response size
Nayna Jain <[email protected]>
tpm: add sleep only for retry in i2c_nuvoton_write_status()
Nayna Jain <[email protected]>
tpm: msleep() delays - replace with usleep_range() in i2c nuvoton driver
Peter Huewe <[email protected]>
tpm_tis_spi: Add small delay after last transfer
Peter Huewe <[email protected]>
tpm_tis_spi: Remove limitation of transfers to MAX_SPI_FRAMESIZE bytes
Peter Huewe <[email protected]>
tpm_tis_spi: Check correct byte for wait state indicator
Peter Huewe <[email protected]>
tpm_tis_spi: Abort transfer when too many wait states are signaled
Peter Huewe <[email protected]>
tpm_tis_spi: Use single function to transfer data
Amir Goldstein <[email protected]>
fanotify: don't expose EOPENSTALE to userspace
Jeeja KP <[email protected]>
ALSA: hda: Fix cpu lockup when stopping the cmd dmas
Alexander Steffen <[email protected]>
tpm_tis_core: Choose appropriate timeout for reading burstcount
Vamsi Krishna Samavedam <[email protected]>
USB: core: replace %p with %pK
Willy Tarreau <[email protected]>
char: lp: fix possible integer overflow in lp_setup()
Johan Hovold <[email protected]>
watchdog: pcwd_usb: fix NULL-deref at probe
Alan Stern <[email protected]>
USB: ene_usb6250: fix DMA to the stack
Maksim Salau <[email protected]>
usb: misc: legousbtower: Fix memory leak
Maksim Salau <[email protected]>
usb: misc: legousbtower: Fix buffers on stack
-------------
Diffstat:
Documentation/arm64/tagged-pointers.txt | 62 ++++++-- Makefile | 4 +- arch/alpha/kernel/osf_sys.c | 6 +- arch/arm/boot/dts/at91-sama5d3_xplained.dts | 5 +- arch/arm/boot/dts/imx6sx-sdb.dts | 17 --- arch/arm/include/asm/fixmap.h | 2 +- arch/arm/include/asm/kvm_coproc.h | 3 +- arch/arm/include/asm/module.h | 9 +- arch/arm/kernel/module-plts.c | 87 +++++++---- arch/arm/kernel/module.lds | 1 + arch/arm/kernel/setup.c | 4 +- arch/arm/kvm/coproc.c | 77 +++++++--- arch/arm/kvm/handle_exit.c | 4 +- arch/arm/kvm/hyp/Makefile | 2 + arch/arm/kvm/hyp/switch.c | 4 +- arch/arm/kvm/mmu.c | 33 +++-- arch/arm/mm/mmu.c | 16 ++- arch/arm/mm/proc-v7m.S | 4 +- arch/arm64/boot/dts/hisilicon/hi6220.dtsi | 3 + arch/arm64/include/asm/asm-uaccess.h | 9 ++ arch/arm64/include/asm/barrier.h | 20 ++- arch/arm64/include/asm/cmpxchg.h | 2 +- arch/arm64/include/asm/uaccess.h | 9 +- arch/arm64/kernel/armv8_deprecated.c | 3 +- arch/arm64/kernel/entry.S | 5 +- arch/arm64/kernel/hw_breakpoint.c | 3 + arch/arm64/kernel/traps.c | 4 +- arch/arm64/kvm/hyp/Makefile | 2 + arch/metag/include/asm/uaccess.h | 49 ++++--- arch/mips/Kconfig | 1 + arch/powerpc/include/asm/mmu_context.h | 17 ++- arch/powerpc/kernel/eeh_driver.c | 19 ++- arch/powerpc/kernel/exceptions-64e.S | 12 ++ arch/powerpc/kernel/mce.c | 2 + arch/powerpc/kernel/process.c | 19 +++ arch/powerpc/kernel/sysfs.c | 6 + arch/powerpc/kernel/traps.c | 4 +- arch/powerpc/mm/dump_linuxpagetables.c | 7 +- arch/powerpc/mm/mmu_context_iommu.c | 4 +- arch/powerpc/platforms/powernv/npu-dma.c | 8 +- arch/powerpc/platforms/powernv/pci-ioda.c | 10 +- arch/powerpc/platforms/powernv/pci.h | 2 +- arch/powerpc/platforms/pseries/dlpar.c | 1 - arch/s390/kernel/crash_dump.c | 15 ++ arch/s390/kernel/entry.S | 21 ++- arch/um/kernel/initrd.c | 4 +- arch/um/kernel/um_arch.c | 6 + arch/x86/include/asm/uaccess.h | 6 +- arch/x86/kernel/fpu/init.c | 1 + arch/x86/kvm/x86.c | 43 ++++-- drivers/acpi/pci_mcfg.c | 14 +- drivers/block/drbd/drbd_req.c | 27 ++-- drivers/char/lp.c | 6 +- drivers/char/mem.c | 5 + drivers/char/tpm/tpm2_eventlog.c | 14 +- drivers/char/tpm/tpm_crb.c | 3 +- drivers/char/tpm/tpm_i2c_nuvoton.c | 24 ++-- drivers/char/tpm/tpm_ibmvtpm.c | 8 +- drivers/char/tpm/tpm_tis_core.c | 6 +- drivers/char/tpm/tpm_tis_spi.c | 160 +++++++++------------ drivers/cpuidle/cpuidle.c | 3 +- drivers/edac/amd64_edac.c | 40 +++--- drivers/firmware/ti_sci.c | 3 +- drivers/gpio/gpio-omap.c | 23 ++- drivers/gpu/drm/amd/amdgpu/dce_v10_0.c | 29 ++-- drivers/gpu/drm/amd/amdgpu/dce_v11_0.c | 29 ++-- drivers/gpu/drm/amd/amdgpu/dce_v6_0.c | 36 ++--- drivers/gpu/drm/amd/amdgpu/dce_v8_0.c | 29 ++-- drivers/gpu/drm/drm_edid.c | 8 ++ drivers/gpu/drm/i915/i915_gem_stolen.c | 5 + drivers/gpu/drm/nouveau/nv50_display.c | 18 +-- drivers/gpu/drm/nouveau/nvkm/subdev/therm/base.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/therm/fan.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/therm/fantog.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/therm/temp.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c | 59 +++++--- drivers/gpu/drm/nouveau/nvkm/subdev/timer/nv04.c | 2 +- .../iio/common/hid-sensors/hid-sensor-attributes.c | 26 +++- .../iio/common/hid-sensors/hid-sensor-trigger.c | 20 ++- drivers/iio/dac/ad7303.c | 6 +- drivers/iio/pressure/bmp280-core.c | 11 +- drivers/iio/proximity/as3935.c | 3 +- drivers/iio/trigger/stm32-timer-trigger.c | 6 +- drivers/infiniband/core/addr.c | 4 +- drivers/infiniband/hw/hfi1/file_ops.c | 5 +- drivers/infiniband/hw/hfi1/init.c | 1 + drivers/infiniband/hw/hfi1/user_exp_rcv.c | 32 +++-- drivers/infiniband/hw/hfi1/user_exp_rcv.h | 1 + drivers/infiniband/hw/hfi1/verbs.c | 12 +- drivers/infiniband/hw/mlx5/mr.c | 2 +- drivers/iommu/intel-iommu.c | 5 +- drivers/md/Kconfig | 1 + drivers/md/dm-bufio.c | 35 +++-- drivers/md/dm-cache-metadata.c | 12 +- drivers/md/dm-mpath.c | 47 ++++-- drivers/md/dm-rq.c | 2 +- drivers/md/dm-thin-metadata.c | 4 +- drivers/md/md.c | 5 + drivers/md/persistent-data/dm-btree.c | 8 +- drivers/md/persistent-data/dm-space-map-disk.c | 15 +- drivers/md/raid5.c | 6 +- drivers/media/cec/cec-core.c | 2 +- drivers/media/dvb-frontends/cxd2841er.c | 4 +- drivers/media/platform/s5p-mfc/s5p_mfc.c | 13 +- drivers/media/rc/mceusb.c | 4 +- drivers/media/usb/cx231xx/cx231xx-audio.c | 42 ++++-- drivers/media/usb/cx231xx/cx231xx-cards.c | 45 +++++- drivers/media/usb/dvb-usb/dib0700_core.c | 3 + drivers/media/usb/dvb-usb/dibusb-mc-common.c | 2 + drivers/media/usb/dvb-usb/digitv.c | 3 + drivers/media/usb/dvb-usb/dw2102.c | 54 +++++++ drivers/media/usb/dvb-usb/ttusb2.c | 19 +++ drivers/media/usb/gspca/konica.c | 3 + drivers/media/usb/usbvision/usbvision-video.c | 9 +- drivers/media/usb/zr364xx/zr364xx.c | 8 ++ drivers/misc/cxl/pci.c | 34 +++-- drivers/mtd/nand/nand_base.c | 70 ++++++++- drivers/mtd/nand/omap2.c | 9 ++ drivers/mtd/nand/orion_nand.c | 42 +++--- drivers/net/irda/irda-usb.c | 2 +- drivers/net/wireless/ath/ath9k/hif_usb.c | 4 + drivers/net/wireless/marvell/mwifiex/cfg80211.c | 4 +- drivers/net/wireless/marvell/mwifiex/pcie.c | 7 + .../net/wireless/realtek/rtlwifi/rtl8821ae/phy.c | 122 +++++++++++++--- .../net/wireless/realtek/rtlwifi/rtl8821ae/reg.h | 1 + drivers/nvdimm/bus.c | 5 +- drivers/nvme/host/pci.c | 7 +- drivers/of/address.c | 2 +- drivers/of/fdt.c | 3 + drivers/of/of_numa.c | 2 + drivers/pci/host/pci-hyperv.c | 13 +- drivers/pci/pci-sysfs.c | 10 +- drivers/pci/pci.c | 9 +- drivers/pci/proc.c | 21 ++- drivers/regulator/rk808-regulator.c | 2 +- drivers/regulator/tps65023-regulator.c | 3 +- drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c | 114 +++++++++++---- drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.h | 2 + drivers/scsi/lpfc/lpfc_crtn.h | 1 + drivers/scsi/lpfc/lpfc_init.c | 7 + drivers/scsi/lpfc/lpfc_sli.c | 19 ++- drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c | 24 ++-- drivers/staging/rtl8192e/rtl819x_TSProc.c | 15 +- .../interface/vchiq_arm/vchiq_2835_arm.c | 31 ++-- drivers/thermal/mtk_thermal.c | 2 +- drivers/usb/class/cdc-acm.c | 13 +- drivers/usb/core/devio.c | 14 +- drivers/usb/core/hcd.c | 4 +- drivers/usb/core/hub.c | 19 ++- drivers/usb/core/urb.c | 2 +- drivers/usb/dwc3/gadget.c | 9 ++ drivers/usb/host/ohci-hcd.c | 3 +- drivers/usb/host/ohci-pci.c | 16 +++ drivers/usb/host/ohci.h | 1 + drivers/usb/host/xhci-hub.c | 2 +- drivers/usb/host/xhci-mem.c | 4 +- drivers/usb/host/xhci-pci.c | 7 +- drivers/usb/host/xhci-plat.c | 2 +- drivers/usb/host/xhci-ring.c | 13 +- drivers/usb/host/xhci.c | 8 +- drivers/usb/misc/chaoskey.c | 2 +- drivers/usb/misc/iowarrior.c | 2 +- drivers/usb/misc/legousbtower.c | 38 +++-- drivers/usb/musb/musb_host.c | 9 +- drivers/usb/musb/tusb6010_omap.c | 13 +- drivers/usb/serial/ftdi_sio.c | 10 +- drivers/usb/serial/ftdi_sio_ids.h | 2 + drivers/usb/serial/io_ti.c | 5 +- drivers/usb/serial/mct_u232.c | 2 +- drivers/usb/serial/option.c | 8 ++ drivers/usb/serial/qcserial.c | 2 + drivers/usb/storage/ene_ub6250.c | 90 +++++++----- drivers/uwb/i1480/dfu/usb.c | 5 +- drivers/watchdog/pcwd_usb.c | 3 + fs/dax.c | 32 ++--- fs/nfs/callback_proc.c | 6 +- fs/nfs/flexfilelayout/flexfilelayoutdev.c | 2 +- fs/nfs/nfs4proc.c | 4 +- fs/nfs/pagelist.c | 15 +- fs/nfs/write.c | 2 +- fs/nfsd/nfs4proc.c | 3 +- fs/nfsd/nfs4xdr.c | 19 ++- fs/notify/fanotify/fanotify_user.c | 26 ++-- fs/proc/generic.c | 1 + include/linux/fs.h | 8 +- include/linux/hid-sensor-hub.h | 2 + include/linux/kprobes.h | 3 + kernel/fork.c | 10 +- kernel/irq/chip.c | 2 +- kernel/kprobes.c | 2 +- kernel/pid_namespace.c | 2 +- kernel/trace/trace_kprobe.c | 5 + net/ipx/af_ipx.c | 5 +- security/integrity/ima/ima_appraise.c | 5 +- sound/hda/hdac_controller.c | 4 + sound/soc/codecs/cs4271.c | 2 +- virt/kvm/arm/vgic/vgic-v2.c | 7 + virt/kvm/arm/vgic/vgic-v3.c | 7 + 198 files changed, 1908 insertions(+), 857 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/197 usb: misc: legousbtower: Fix buffers on stack
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maksim Salau <[email protected]>
commit 942a48730faf149ccbf3e12ac718aee120bb3529 upstream.
Allocate buffers on HEAP instead of STACK for local structures that are to be received using usb_control_msg().
--- drivers/usb/misc/legousbtower.c | 37 +++++++++++++++++++++++++++---------- 1 file changed, 27 insertions(+), 10 deletions(-)
drivers/usb/misc/legousbtower.c +27 -10
@@ -317,9 +317,16 @@ static int tower_open (struct inode *inoint subminor;int retval =0 ;struct usb_interface *interface; -struct tower_reset_reply reset_reply; +struct tower_reset_reply *reset_reply;int result; + reset_reply =kmalloc (sizeof (*reset_reply),GFP_KERNEL ); + +if (!reset_reply) { + retval = -ENOMEM ; + goto exit; + } +nonseekable_open (inode, file); subminor =iminor (inode);
@@ -364,8 +371,8 @@ static int tower_open (struct inode *inoUSB_TYPE_VENDOR |USB_DIR_IN |USB_RECIP_DEVICE ,0 ,0 , - &reset_reply, -sizeof (reset_reply), + reset_reply, +sizeof (*reset_reply), 1000);if (result <0 ) { dev_err(&dev->udev->dev,
@@ -406,6 +413,7 @@ unlock_exit:mutex_unlock (&dev->lock); exit: +kfree (reset_reply);return retval; }
@@ -808,7 +816,7 @@ static int tower_probe (struct usb_interstruct lego_usb_tower *dev =NULL ;struct usb_host_interface *iface_desc;struct usb_endpoint_descriptor * endpoint; -struct tower_get_version_reply get_version_reply; +struct tower_get_version_reply *get_version_reply =NULL ;int i;int retval = -ENOMEM ;int result;
@@ -886,6 +894,13 @@ static int tower_probe (struct usb_inter dev->interrupt_in_interval = interrupt_in_interval ? interrupt_in_interval : dev->interrupt_in_endpoint->bInterval; dev->interrupt_out_interval = interrupt_out_interval ? interrupt_out_interval : dev->interrupt_out_endpoint->bInterval; + get_version_reply =kmalloc (sizeof (*get_version_reply),GFP_KERNEL ); + +if (!get_version_reply) { + retval = -ENOMEM ; + goto error; + } +/* get the firmware version and log it */ result = usb_control_msg (udev, usb_rcvctrlpipe(udev, 0),
@@ -893,18 +908,19 @@ static int tower_probe (struct usb_interUSB_TYPE_VENDOR |USB_DIR_IN |USB_RECIP_DEVICE ,0 ,0 , - &get_version_reply, -sizeof (get_version_reply), + get_version_reply, +sizeof (*get_version_reply), 1000);if (result <0 ) {dev_err (idev,"LEGO USB Tower get version control request failed\n" ); retval = result; goto error; } -dev_info (&interface->dev,"LEGO USB Tower firmware version is %d.%d " -"build %d\n" , get_version_reply.major, - get_version_reply.minor, -le16_to_cpu (get_version_reply.build_no)); +dev_info (&interface->dev, +"LEGO USB Tower firmware version is %d.%d build %d\n" , + get_version_reply->major, + get_version_reply->minor, +le16_to_cpu (get_version_reply->build_no));/* we can register the device now, as it is ready */ usb_set_intfdata (interface, dev);
@@ -928,6 +944,7 @@ exit:return retval; error: +kfree (get_version_reply);tower_delete (dev);return retval; }
Greg Kroah-Hartman
maintainerPATCH 2/197 usb: misc: legousbtower: Fix memory leak
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maksim Salau <[email protected]>
commit 0bd193d62b4270a2a7a09da43ad1034c7ca5b3d3 upstream.
get_version_reply is not freed if function returns with success.
--- drivers/usb/misc/legousbtower.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/misc/legousbtower.c +1 -0
@@ -941,6 +941,7 @@ static int tower_probe (struct usb_inter USB_MAJOR, dev->minor); exit: +kfree (get_version_reply);return retval; error:
Greg Kroah-Hartman
maintainerPATCH 3/197 USB: ene_usb6250: fix DMA to the stack
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <[email protected]>
commit 628c2893d44876ddd11602400c70606ade62e129 upstream.
The ene_usb6250 sub-driver in usb-storage does USB I/O to buffers on the stack, which doesn't work with vmapped stacks. This patch fixes the problem by allocating a separate 512-byte buffer at probe time and using it for all of the offending I/O operations.
--- drivers/usb/storage/ene_ub6250.c | 90 +++++++++++++++++++++++---------------- 1 file changed, 55 insertions(+), 35 deletions(-)
drivers/usb/storage/ene_ub6250.c +55 -35
@@ -446,6 +446,10 @@ struct ms_lib_ctrl {#define SD_BLOCK_LEN 9struct ene_ub6250_info { + +/* I/O bounce buffer */ +u8 *bbuf; +/* for 6250 code */ struct SD_STATUS SD_Status;struct MS_STATUS MS_Status;
@@ -493,8 +497,11 @@ static int ene_load_bincode(struct us_dastatic void ene_ub6250_info_destructor (void *extra) { +struct ene_ub6250_info *info = (struct ene_ub6250_info *) extra; +if (!extra)return ; +kfree (info->bbuf); }static int ene_send_scsi_cmd (struct us_data *us,u8 fDir,void *buf,int use_sg)
@@ -860,8 +867,9 @@ static int ms_read_readpage(struct us_da u8 PageNum, u32 *PageBuf, struct ms_lib_type_extdat *ExtraDat) { struct bulk_cb_wrap *bcb = (struct bulk_cb_wrap *) us->iobuf; +struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra; +u8 *bbuf = info->bbuf;int result; -u8 ExtBuf[4 ];u32 bn = PhyBlockAddr *0x20 + PageNum; result =ene_load_bincode (us,MS_RW_PATTERN );
@@ -901,7 +909,7 @@ static int ms_read_readpage(struct us_da bcb->CDB[2 ] = (unsigned char )(PhyBlockAddr>>16 ); bcb->CDB[6 ] =0x01 ; - result =ene_send_scsi_cmd (us,FDIR_READ , &ExtBuf,0 ); + result =ene_send_scsi_cmd (us,FDIR_READ , bbuf,0 );if (result !=USB_STOR_XFER_GOOD )return USB_STOR_TRANSPORT_ERROR ;
@@ -910,9 +918,9 @@ static int ms_read_readpage(struct us_da ExtraDat->status0 =0x10 ;/* Not yet,fireware support */ ExtraDat->status1 =0x00 ;/* Not yet,fireware support */ - ExtraDat->ovrflg = ExtBuf[0 ]; - ExtraDat->mngflg = ExtBuf[1 ]; - ExtraDat->logadr =memstick_logaddr (ExtBuf[2 ], ExtBuf[3 ]); + ExtraDat->ovrflg = bbuf[0 ]; + ExtraDat->mngflg = bbuf[1 ]; + ExtraDat->logadr =memstick_logaddr (bbuf[2 ], bbuf[3 ]);return USB_STOR_TRANSPORT_GOOD ; }
@@ -1332,8 +1340,9 @@ static int ms_lib_read_extra(struct us_d u8 PageNum, struct ms_lib_type_extdat *ExtraDat) { struct bulk_cb_wrap *bcb = (struct bulk_cb_wrap *) us->iobuf; +struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra; +u8 *bbuf = info->bbuf;int result; -u8 ExtBuf[4 ];memset (bcb,0 ,sizeof (struct bulk_cb_wrap )); bcb->Signature =cpu_to_le32 (US_BULK_CB_SIGN );
@@ -1347,7 +1356,7 @@ static int ms_lib_read_extra(struct us_d bcb->CDB[2 ] = (unsigned char )(PhyBlock>>16 ); bcb->CDB[6 ] =0x01 ; - result =ene_send_scsi_cmd (us,FDIR_READ , &ExtBuf,0 ); + result =ene_send_scsi_cmd (us,FDIR_READ , bbuf,0 );if (result !=USB_STOR_XFER_GOOD )return USB_STOR_TRANSPORT_ERROR ;
@@ -1355,9 +1364,9 @@ static int ms_lib_read_extra(struct us_d ExtraDat->intr =0x80 ;/* Not yet, waiting for fireware support */ ExtraDat->status0 =0x10 ;/* Not yet, waiting for fireware support */ ExtraDat->status1 =0x00 ;/* Not yet, waiting for fireware support */ - ExtraDat->ovrflg = ExtBuf[0 ]; - ExtraDat->mngflg = ExtBuf[1 ]; - ExtraDat->logadr =memstick_logaddr (ExtBuf[2 ], ExtBuf[3 ]); + ExtraDat->ovrflg = bbuf[0 ]; + ExtraDat->mngflg = bbuf[1 ]; + ExtraDat->logadr =memstick_logaddr (bbuf[2 ], bbuf[3 ]);return USB_STOR_TRANSPORT_GOOD ; }
@@ -1556,9 +1565,9 @@ static int ms_lib_scan_logicalblocknumbeu16 PhyBlock, newblk, i;u16 LogStart, LogEnde;struct ms_lib_type_extdat extdat; -u8 buf[0x200 ];u32 count =0 , index =0 ;struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra; +u8 *bbuf = info->bbuf;for (PhyBlock =0 ; PhyBlock < info->MS_Lib.NumberOfPhyBlock;) {ms_lib_phy_to_log_range (PhyBlock, &LogStart, &LogEnde);
@@ -1572,14 +1581,16 @@ static int ms_lib_scan_logicalblocknumbe }if (count == PhyBlock) { -ms_lib_read_extrablock (us, PhyBlock,0 ,0x80 , &buf); +ms_lib_read_extrablock (us, PhyBlock,0 ,0x80 , + bbuf); count +=0x80 ; } index = (PhyBlock %0x80 ) *4 ; - extdat.ovrflg = buf[index]; - extdat.mngflg = buf[index+1 ]; - extdat.logadr =memstick_logaddr (buf[index+2 ], buf[index+3 ]); + extdat.ovrflg = bbuf[index]; + extdat.mngflg = bbuf[index+1 ]; + extdat.logadr =memstick_logaddr (bbuf[index+2 ], + bbuf[index+3 ]);if ((extdat.ovrflg &MS_REG_OVR_BKST ) !=MS_REG_OVR_BKST_OK ) {ms_lib_setacquired_errorblock (us, PhyBlock);
@@ -2062,9 +2073,9 @@ static int ene_ms_init(struct us_data *u {struct bulk_cb_wrap *bcb = (struct bulk_cb_wrap *) us->iobuf;int result; -u8 buf[0x200 ];u16 MSP_BlockSize, MSP_UserAreaBlocks;struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra; +u8 *bbuf = info->bbuf;printk (KERN_INFO "transport --- ENE_MSInit\n" );
@@ -2083,13 +2094,13 @@ static int ene_ms_init(struct us_data *u bcb->CDB[0 ] =0xF1 ; bcb->CDB[1 ] =0x01 ; - result =ene_send_scsi_cmd (us,FDIR_READ , &buf,0 ); + result =ene_send_scsi_cmd (us,FDIR_READ , bbuf,0 );if (result !=USB_STOR_XFER_GOOD ) {printk (KERN_ERR "Execution MS Init Code Fail !!\n" );return USB_STOR_TRANSPORT_ERROR ; }/* the same part to test ENE */ - info->MS_Status = *(struct MS_STATUS *)&buf[0 ]; + info->MS_Status = *(struct MS_STATUS *) bbuf;if (info->MS_Status.Insert && info->MS_Status.Ready) {printk (KERN_INFO "Insert = %x\n" , info->MS_Status.Insert);
@@ -2098,15 +2109,15 @@ static int ene_ms_init(struct us_data *uprintk (KERN_INFO "IsMSPHG = %x\n" , info->MS_Status.IsMSPHG);printk (KERN_INFO "WtP= %x\n" , info->MS_Status.WtP);if (info->MS_Status.IsMSPro) { - MSP_BlockSize = (buf[6 ] <<8 ) | buf[7 ]; - MSP_UserAreaBlocks = (buf[10 ] <<8 ) | buf[11 ]; + MSP_BlockSize = (bbuf[6 ] <<8 ) | bbuf[7 ]; + MSP_UserAreaBlocks = (bbuf[10 ] <<8 ) | bbuf[11 ]; info->MSP_TotalBlock = MSP_BlockSize * MSP_UserAreaBlocks; }else {ms_card_init (us);/* Card is MS (to ms.c)*/ }usb_stor_dbg (us,"MS Init Code OK !!\n" ); }else { -usb_stor_dbg (us,"MS Card Not Ready --- %x\n" , buf[0 ]); +usb_stor_dbg (us,"MS Card Not Ready --- %x\n" , bbuf[0 ]);return USB_STOR_TRANSPORT_ERROR ; }
@@ -2116,9 +2127,9 @@ static int ene_ms_init(struct us_data *ustatic int ene_sd_init (struct us_data *us) {int result; -u8 buf[0x200 ];struct bulk_cb_wrap *bcb = (struct bulk_cb_wrap *) us->iobuf;struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra; +u8 *bbuf = info->bbuf;usb_stor_dbg (us,"transport --- ENE_SDInit\n" );/* SD Init Part-1 */
@@ -2152,17 +2163,17 @@ static int ene_sd_init(struct us_data *u bcb->Flags =US_BULK_FLAG_IN ; bcb->CDB[0 ] =0xF1 ; - result =ene_send_scsi_cmd (us,FDIR_READ , &buf,0 ); + result =ene_send_scsi_cmd (us,FDIR_READ , bbuf,0 );if (result !=USB_STOR_XFER_GOOD ) {usb_stor_dbg (us,"Execution SD Init Code Fail !!\n" );return USB_STOR_TRANSPORT_ERROR ; } - info->SD_Status = *(struct SD_STATUS *)&buf[0 ]; + info->SD_Status = *(struct SD_STATUS *) bbuf;if (info->SD_Status.Insert && info->SD_Status.Ready) {struct SD_STATUS *s = &info->SD_Status; -ene_get_card_status (us, (unsigned char *)&buf); +ene_get_card_status (us, bbuf);usb_stor_dbg (us,"Insert = %x\n" , s->Insert);usb_stor_dbg (us,"Ready = %x\n" , s->Ready);usb_stor_dbg (us,"IsMMC = %x\n" , s->IsMMC);
@@ -2170,7 +2181,7 @@ static int ene_sd_init(struct us_data *uusb_stor_dbg (us,"HiSpeed = %x\n" , s->HiSpeed);usb_stor_dbg (us,"WtP = %x\n" , s->WtP); }else { -usb_stor_dbg (us,"SD Card Not Ready --- %x\n" , buf[0 ]); +usb_stor_dbg (us,"SD Card Not Ready --- %x\n" , bbuf[0 ]);return USB_STOR_TRANSPORT_ERROR ; }return USB_STOR_TRANSPORT_GOOD ;
@@ -2180,13 +2191,15 @@ static int ene_sd_init(struct us_data *ustatic int ene_init (struct us_data *us) {int result; -u8 misc_reg03 =0 ; +u8 misc_reg03;struct ene_ub6250_info *info = (struct ene_ub6250_info *)(us->extra); +u8 *bbuf = info->bbuf; - result =ene_get_card_type (us,REG_CARD_STATUS , &misc_reg03); + result =ene_get_card_type (us,REG_CARD_STATUS , bbuf);if (result !=USB_STOR_XFER_GOOD )return USB_STOR_TRANSPORT_ERROR ; + misc_reg03 = bbuf[0 ];if (misc_reg03 &0x01 ) {if (!info->SD_Status.Ready) { result =ene_sd_init (us);
@@ -2303,8 +2316,9 @@ static int ene_ub6250_probe(struct usb_i const struct usb_device_id *id) {int result; -u8 misc_reg03 =0 ; +u8 misc_reg03;struct us_data *us; +struct ene_ub6250_info *info; result = usb_stor_probe1(&us, intf, id, (id - ene_ub6250_usb_ids) + ene_ub6250_unusual_dev_list,
@@ -2313,11 +2327,16 @@ static int ene_ub6250_probe(struct usb_ireturn result;/* FIXME: where should the code alloc extra buf ? */ -if (!us->extra) { - us->extra =kzalloc (sizeof (struct ene_ub6250_info ),GFP_KERNEL ); -if (!us->extra) -return -ENOMEM ; - us->extra_destructor = ene_ub6250_info_destructor; + us->extra =kzalloc (sizeof (struct ene_ub6250_info ),GFP_KERNEL ); +if (!us->extra) +return -ENOMEM ; + us->extra_destructor = ene_ub6250_info_destructor; + + info = (struct ene_ub6250_info *)(us->extra); + info->bbuf =kmalloc (512 ,GFP_KERNEL ); +if (!info->bbuf) { +kfree (us->extra); +return -ENOMEM ; } us->transport_name ="ene_ub6250" ;
@@ -2329,12 +2348,13 @@ static int ene_ub6250_probe(struct usb_ireturn result;/* probe card type */ - result =ene_get_card_type (us,REG_CARD_STATUS , &misc_reg03); + result =ene_get_card_type (us,REG_CARD_STATUS , info->bbuf);if (result !=USB_STOR_XFER_GOOD ) {usb_stor_disconnect (intf);return USB_STOR_TRANSPORT_ERROR ; } + misc_reg03 = info->bbuf[0 ];if (!(misc_reg03 &0x01 )) {pr_info ("ums_eneub6250: This driver only supports SD/MS cards. " "It does not support SM cards.\n" );
Greg Kroah-Hartman
maintainerPATCH 4/197 watchdog: pcwd_usb: fix NULL-deref at probe
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 46c319b848268dab3f0e7c4a5b6e9146d3bca8a4 upstream.
Make sure to check the number of endpoints to avoid dereferencing a NULL-pointer should a malicious device lack endpoints.
--- drivers/watchdog/pcwd_usb.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/watchdog/pcwd_usb.c +3 -0
@@ -630,6 +630,9 @@ static int usb_pcwd_probe(struct usb_intreturn -ENODEV ; } +if (iface_desc->desc.bNumEndpoints <1 ) +return -ENODEV ; +/* check out the endpoint: it has to be Interrupt & IN */ endpoint = &iface_desc->endpoint[0 ].desc;
Greg Kroah-Hartman
maintainerPATCH 5/197 char: lp: fix possible integer overflow in lp_setup()
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Willy Tarreau <[email protected]>
commit 3e21f4af170bebf47c187c1ff8bf155583c9f3b1 upstream.
The lp_setup() code doesn't apply any bounds checking when passing "lp=none", and only in this case, resulting in an overflow of the parport_nr[] array. All versions in Git history are affected.
--- drivers/char/lp.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/char/lp.c +5 -1
@@ -859,7 +859,11 @@ static int __init lp_setup (char *str) }else if (!strcmp (str,"auto" )) { parport_nr[0 ] =LP_PARPORT_AUTO ; }else if (!strcmp (str,"none" )) { - parport_nr[parport_ptr++] =LP_PARPORT_NONE ; +if (parport_ptr <LP_NO ) + parport_nr[parport_ptr++] =LP_PARPORT_NONE ; +else +printk (KERN_INFO "lp: too many ports, %s ignored.\n" , + str); }else if (!strcmp (str,"reset" )) { reset =1 ; }
Greg Kroah-Hartman
maintainerPATCH 6/197 USB: core: replace %p with %pK
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vamsi Krishna Samavedam <[email protected]>
commit 2f964780c03b73de269b08d12aff96a9618d13f3 upstream.
Format specifier %p can leak kernel addresses while not valuing the kptr_restrict system settings. When kptr_restrict is set to (1), kernel pointers printed using the %pK format specifier will be replaced with Zeros. Debugging Note : &pK prints only Zeros as address. If you need actual address information, write 0 to kptr_restrict.
echo 0 > /proc/sys/kernel/kptr_restrict
[Found by poking around in a random vendor kernel tree, it would be nice if someone would actually send these types of patches upstream - gkh]
--- drivers/usb/core/devio.c | 14 +++++++------- drivers/usb/core/hcd.c | 4 ++-- drivers/usb/core/urb.c | 2 +- 3 files changed, 10 insertions(+), 10 deletions(-)
drivers/usb/core/devio.c +7 -7
@@ -475,11 +475,11 @@ static void snoop_urb(struct usb_deviceif (userurb) {/* Async */ if (when ==SUBMIT ) -dev_info (&udev->dev,"userurb %p, ep%d %s-%s, " +dev_info (&udev->dev,"userurb %pK, ep%d %s-%s, " "length %u\n" , userurb, ep, t, d, length);else -dev_info (&udev->dev,"userurb %p, ep%d %s-%s, " +dev_info (&udev->dev,"userurb %pK, ep%d %s-%s, " "actual_length %u status %d\n" , userurb, ep, t, d, length, timeout_or_status);
@@ -1895,7 +1895,7 @@ static int proc_reapurb(struct usb_dev_sif (as) {int retval; -snoop (&ps->dev->dev,"reap %p\n" , as->userurb); +snoop (&ps->dev->dev,"reap %pK\n" , as->userurb); retval =processcompl (as, (void __user *__user *)arg);free_async (as);return retval;
@@ -1912,7 +1912,7 @@ static int proc_reapurbnonblock(struct u as =async_getcompleted (ps);if (as) { -snoop (&ps->dev->dev,"reap %p\n" , as->userurb); +snoop (&ps->dev->dev,"reap %pK\n" , as->userurb); retval =processcompl (as, (void __user *__user *)arg);free_async (as); }else {
@@ -2043,7 +2043,7 @@ static int proc_reapurb_compat(struct usif (as) {int retval; -snoop (&ps->dev->dev,"reap %p\n" , as->userurb); +snoop (&ps->dev->dev,"reap %pK\n" , as->userurb); retval =processcompl_compat (as, (void __user *__user *)arg);free_async (as);return retval;
@@ -2060,7 +2060,7 @@ static int proc_reapurbnonblock_compat(s as =async_getcompleted (ps);if (as) { -snoop (&ps->dev->dev,"reap %p\n" , as->userurb); +snoop (&ps->dev->dev,"reap %pK\n" , as->userurb); retval =processcompl_compat (as, (void __user *__user *)arg);free_async (as); }else {
@@ -2489,7 +2489,7 @@ static long usbdev_do_ioctl(struct file#endif case USBDEVFS_DISCARDURB : -snoop (&dev->dev,"%s: DISCARDURB %p\n" , __func__, p); +snoop (&dev->dev,"%s: DISCARDURB %pK\n" , __func__, p); ret =proc_unlinkurb (ps, p);break ;
drivers/usb/core/hcd.c +2 -2
@@ -1722,7 +1722,7 @@ int usb_hcd_unlink_urb (struct urb *urb,if (retval ==0 ) retval = -EINPROGRESS ;else if (retval != -EIDRM && retval != -EBUSY ) -dev_dbg (&udev->dev,"hcd_unlink_urb %p fail %d\n" , +dev_dbg (&udev->dev,"hcd_unlink_urb %pK fail %d\n" , urb, retval);usb_put_dev (udev); }
@@ -1889,7 +1889,7 @@ rescan:/* kick hcd */ unlink1 (hcd, urb, -ESHUTDOWN ); dev_dbg (hcd->self.controller, - "shutdown urb %p ep%d%s%s\n", + "shutdown urb %pK ep%d%s%s\n", urb, usb_endpoint_num(&ep->desc), is_in ? "in" : "out", ({ char *s;
drivers/usb/core/urb.c +1 -1
@@ -338,7 +338,7 @@ int usb_submit_urb(struct urb *urb, gfp_if (!urb || !urb->complete)return -EINVAL ;if (urb->hcpriv) { -WARN_ONCE (1 ,"URB %p submitted while active\n" , urb); +WARN_ONCE (1 ,"URB %pK submitted while active\n" , urb);return -EBUSY ; }
Greg Kroah-Hartman
maintainerPATCH 7/197 tpm_tis_core: Choose appropriate timeout for reading burstcount
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Steffen <[email protected]>
commit 302a6ad7fc77146191126a1f3e2c5d724fd72416 upstream.
TIS v1.3 for TPM 1.2 and PTP for TPM 2.0 disagree about which timeout value applies to reading a valid burstcount. It is TIMEOUT_D according to TIS, but TIMEOUT_A according to PTP, so choose the appropriate value depending on whether we deal with a TPM 1.2 or a TPM 2.0.
This is important since according to the PTP TIMEOUT_D is much smaller than TIMEOUT_A. So the previous implementation could run into timeouts with a TPM 2.0, even though the TPM was behaving perfectly fine.
During tpm2_probe TIMEOUT_D will be used even with a TPM 2.0, because TPM_CHIP_FLAG_TPM2 is not yet set. This is fine, since the timeout values will only be changed afterwards by tpm_get_timeouts. Until then TIS_TIMEOUT_D_MAX applies, which is large enough.
--- drivers/char/tpm/tpm_tis_core.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/char/tpm/tpm_tis_core.c +4 -2
@@ -160,8 +160,10 @@ static int get_burstcount(struct tpm_chiu32 value;/* wait for burstcount */ -/* which timeout value, spec has 2 answers (c & d) */ - stop = jiffies + chip->timeout_d; +if (chip->flags &TPM_CHIP_FLAG_TPM2 ) + stop = jiffies + chip->timeout_a; +else + stop = jiffies + chip->timeout_d; do { rc = tpm_tis_read32(priv, TPM_STS(priv->locality), &value); if (rc < 0)
Greg Kroah-Hartman
maintainerPATCH 8/197 ALSA: hda: Fix cpu lockup when stopping the cmd dmas
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeeja KP <[email protected]>
commit 960013762df0a214b57f2fce655422fb52bdfd2c upstream.
Using jiffies in hdac_wait_for_cmd_dmas() to determine when to time out when interrupts are off (snd_hdac_bus_stop_cmd_io()/spin_lock_irq()) causes hard lockup so unlock while waiting using jiffies.
---<-snip->---
<0>[ 1211.603046] NMI watchdog: Watchdog detected hard LOCKUP on cpu 3 <4>[ 1211.603047] Modules linked in: snd_hda_intel i915 vgem <4>[ 1211.603053] irq event stamp: 13366 <4>[ 1211.603053] hardirqs last enabled at (13365): ... <4>[ 1211.603059] Call Trace: <4>[ 1211.603059] ? delay_tsc+0x3d/0xc0 <4>[ 1211.603059] __delay+0xa/0x10 <4>[ 1211.603060] __const_udelay+0x31/0x40 <4>[ 1211.603060] snd_hdac_bus_stop_cmd_io+0x96/0xe0 [snd_hda_core] <4>[ 1211.603060] ? azx_dev_disconnect+0x20/0x20 [snd_hda_intel] <4>[ 1211.603061] snd_hdac_bus_stop_chip+0xb1/0x100 [snd_hda_core] <4>[ 1211.603061] azx_stop_chip+0x9/0x10 [snd_hda_codec] <4>[ 1211.603061] azx_suspend+0x72/0x220 [snd_hda_intel] <4>[ 1211.603061] pci_pm_suspend+0x71/0x140 <4>[ 1211.603062] dpm_run_callback+0x6f/0x330 <4>[ 1211.603062] ? pci_pm_freeze+0xe0/0xe0 <4>[ 1211.603062] __device_suspend+0xf9/0x370 <4>[ 1211.603062] ? dpm_watchdog_set+0x60/0x60 <4>[ 1211.603063] async_suspend+0x1a/0x90 <4>[ 1211.603063] async_run_entry_fn+0x34/0x160 <4>[ 1211.603063] process_one_work+0x1f4/0x6d0 <4>[ 1211.603063] ? process_one_work+0x16e/0x6d0 <4>[ 1211.603064] worker_thread+0x49/0x4a0 <4>[ 1211.603064] kthread+0x107/0x140 <4>[ 1211.603064] ? process_one_work+0x6d0/0x6d0 <4>[ 1211.603065] ? kthread_create_on_node+0x40/0x40 <4>[ 1211.603065] ret_from_fork+0x2e/0x40
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=100419
--- sound/hda/hdac_controller.c | 4 ++++ 1 file changed, 4 insertions(+)
sound/hda/hdac_controller.c +4 -0
@@ -106,7 +106,11 @@ void snd_hdac_bus_stop_cmd_io(struct hda/* disable ringbuffer DMAs */ snd_hdac_chip_writeb (bus,RIRBCTL ,0 );snd_hdac_chip_writeb (bus,CORBCTL ,0 ); +spin_unlock_irq (&bus->reg_lock); +hdac_wait_for_cmd_dmas (bus); + +spin_lock_irq (&bus->reg_lock);/* disable unsolicited responses */ snd_hdac_chip_updatel (bus,GCTL ,AZX_GCTL_UNSOL ,0 );spin_unlock_irq (&bus->reg_lock);
Greg Kroah-Hartman
maintainerPATCH 9/197 fanotify: dont expose EOPENSTALE to userspace
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amir Goldstein <[email protected]>
commit 4ff33aafd32e084f5ee7faa54ba06e95f8b1b8af upstream.
When delivering an event to userspace for a file on an NFS share, if the file is deleted on server side before user reads the event, user will not get the event.
If the event queue contained several events, the stale event is quietly dropped and read() returns to user with events read so far in the buffer.
If the event queue contains a single stale event or if the stale event is a permission event, read() returns to user with the kernel internal error code 518 (EOPENSTALE), which is not a POSIX error code.
Check the internal return value -EOPENSTALE in fanotify_read(), just the same as it is checked in path_openat() and drop the event in the cases that it is not already dropped.
This is a reproducer from Marko Rauhamaa:
Just take the example program listed under "man fanotify" ("fantest") and follow these steps:
==============================================================
NFS Server NFS Client(1) NFS Client(2)
==============================================================
# echo foo >/nfsshare/bar.txt
# cat /nfsshare/bar.txt
foo
# ./fantest /nfsshare Press enter key to terminate. Listening for events.
# rm -f /nfsshare/bar.txt
# cat /nfsshare/bar.txt
read: Unknown error 518
cat: /nfsshare/bar.txt: Operation not permitted
==============================================================
where NFS Client (1) and (2) are two terminal sessions on a single NFS Client machine.
--- fs/notify/fanotify/fanotify_user.c | 26 ++++++++++++++++++-------- 1 file changed, 18 insertions(+), 8 deletions(-)
fs/notify/fanotify/fanotify_user.c +18 -8
@@ -295,27 +295,37 @@ static ssize_t fanotify_read(struct file } ret =copy_event_to_user (group, kevent, buf); +if (unlikely (ret == -EOPENSTALE )) { +/* +* We cannot report events with stale fd so drop it. +* Setting ret to 0 will continue the event loop and +* do the right thing if there are no more events to +* read (i.e. return bytes read, -EAGAIN or wait). +*/ + ret =0 ; + } +/* * Permission events get queued to wait for response. Other * events can be destroyed now. */ if (!(kevent->mask &FAN_ALL_PERM_EVENTS )) {fsnotify_destroy_event (group, kevent); -if (ret <0 ) -break ; }else {#ifdef CONFIG_FANOTIFY_ACCESS_PERMISSIONS -if (ret <0 ) { +if (ret <=0 ) {FANOTIFY_PE (kevent)->response =FAN_DENY ;wake_up (&group->fanotify_data.access_waitq); -break ; + }else { +spin_lock (&group->notification_lock); +list_add_tail (&kevent->list, + &group->fanotify_data.access_list); +spin_unlock (&group->notification_lock); } -spin_lock (&group->notification_lock); -list_add_tail (&kevent->list, - &group->fanotify_data.access_list); -spin_unlock (&group->notification_lock);#endif } +if (ret <0 ) +break ; buf += ret; count -= ret; }
Greg Kroah-Hartman
maintainerPATCH 10/197 tpm_tis_spi: Use single function to transfer data
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Huewe <[email protected]>
commit f848f2143ae42dc0918400039257a893835254d1 upstream.
The algorithm for sending data to the TPM is mostly identical to the algorithm for receiving data from the TPM, so a single function is sufficient to handle both cases.
This is a prequisite for all the other fixes, so we don't have to fix everything twice (send/receive)
v2: u16 instead of u8 for the length.
--- drivers/char/tpm/tpm_tis_spi.c | 87 +++++++++++------------------------------ 1 file changed, 24 insertions(+), 63 deletions(-)
drivers/char/tpm/tpm_tis_spi.c +24 -63
@@ -47,8 +47,8 @@ struct tpm_tis_spi_phy {struct tpm_tis_data priv;struct spi_device *spi_device; -u8 tx_buf[MAX_SPI_FRAMESIZE +4 ]; -u8 rx_buf[MAX_SPI_FRAMESIZE +4 ]; +u8 tx_buf[4 ]; +u8 rx_buf[4 ]; };static inline struct tpm_tis_spi_phy *to_tpm_tis_spi_phy (struct tpm_tis_data *data)
@@ -56,8 +56,8 @@ static inline struct tpm_tis_spi_phy *to return container_of(data, struct tpm_tis_spi_phy, priv); } -static int tpm_tis_spi_read_bytes (struct tpm_tis_data *data,u32 addr, -u16 len,u8 *result) +static int tpm_tis_spi_transfer (struct tpm_tis_data *data,u32 addr,u16 len, +u8 *buffer,u8 direction) {struct tpm_tis_spi_phy *phy =to_tpm_tis_spi_phy (data);int ret, i;
@@ -66,17 +66,17 @@ static int tpm_tis_spi_read_bytes(struct .tx_buf = phy->tx_buf, .rx_buf = phy->rx_buf, .len = 4, + .cs_change = 1, };if (len >MAX_SPI_FRAMESIZE )return -ENOMEM ; - phy->tx_buf[0 ] =0x80 | (len -1 ); + phy->tx_buf[0 ] = direction | (len -1 ); phy->tx_buf[1 ] =0xd4 ; - phy->tx_buf[2 ] = (addr >>8 ) &0xFF ; - phy->tx_buf[3 ] = addr &0xFF ; + phy->tx_buf[2 ] = addr >>8 ; + phy->tx_buf[3 ] = addr; - spi_xfer.cs_change =1 ;spi_message_init (&m);spi_message_add_tail (&spi_xfer, &m);
@@ -85,7 +85,7 @@ static int tpm_tis_spi_read_bytes(structif (ret <0 ) goto exit; -memset (phy->tx_buf,0 , len); + phy->tx_buf[0 ] =0 ;/* According to TCG PTP specification, if there is no TPM present at * all, then the design has a weak pull-up on MISO. If a TPM is not
@@ -103,7 +103,14 @@ static int tpm_tis_spi_read_bytes(struct spi_xfer.cs_change =0 ; spi_xfer.len = len; - spi_xfer.rx_buf = result; + +if (direction) { + spi_xfer.tx_buf =NULL ; + spi_xfer.rx_buf = buffer; + }else { + spi_xfer.tx_buf = buffer; + spi_xfer.rx_buf =NULL ; + }spi_message_init (&m);spi_message_add_tail (&spi_xfer, &m);
@@ -114,62 +121,16 @@ exit:return ret; } +static int tpm_tis_spi_read_bytes (struct tpm_tis_data *data,u32 addr, +u16 len,u8 *result) +{ +return tpm_tis_spi_transfer (data, addr, len, result,0x80 ); +} +static int tpm_tis_spi_write_bytes (struct tpm_tis_data *data,u32 addr,u16 len,u8 *value) { -struct tpm_tis_spi_phy *phy =to_tpm_tis_spi_phy (data); -int ret, i; -struct spi_message m; -struct spi_transfer spi_xfer = { - .tx_buf = phy->tx_buf, - .rx_buf = phy->rx_buf, - .len =4 , - }; - -if (len >MAX_SPI_FRAMESIZE ) -return -ENOMEM ; - - phy->tx_buf[0 ] = len -1 ; - phy->tx_buf[1 ] =0xd4 ; - phy->tx_buf[2 ] = (addr >>8 ) &0xFF ; - phy->tx_buf[3 ] = addr &0xFF ; - - spi_xfer.cs_change =1 ; -spi_message_init (&m); -spi_message_add_tail (&spi_xfer, &m); - -spi_bus_lock (phy->spi_device->master); - ret =spi_sync_locked (phy->spi_device, &m); -if (ret <0 ) - goto exit; - -memset (phy->tx_buf,0 , len); - -/* According to TCG PTP specification, if there is no TPM present at -* all, then the design has a weak pull-up on MISO. If a TPM is not -* present, a pull-up on MISO means that the SB controller sees a 1, -* and will latch in 0xFF on the read. -*/ -for (i =0 ; (phy->rx_buf[0 ] &0x01 ) ==0 && i <TPM_RETRY ; i++) { - spi_xfer.len =1 ; -spi_message_init (&m); -spi_message_add_tail (&spi_xfer, &m); - ret =spi_sync_locked (phy->spi_device, &m); -if (ret <0 ) - goto exit; - } - - spi_xfer.len = len; - spi_xfer.tx_buf = value; - spi_xfer.cs_change =0 ; - spi_xfer.tx_buf = value; -spi_message_init (&m); -spi_message_add_tail (&spi_xfer, &m); - ret =spi_sync_locked (phy->spi_device, &m); - -exit: -spi_bus_unlock (phy->spi_device->master); -return ret; +return tpm_tis_spi_transfer (data, addr, len, value,0 ); }static int tpm_tis_spi_read16 (struct tpm_tis_data *data,u32 addr,u16 *result)
Greg Kroah-Hartman
maintainerPATCH 11/197 tpm_tis_spi: Abort transfer when too many wait states are signaled
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Huewe <[email protected]>
commit 975094ddc369a32f27210248bdd9bbd153061b00 upstream.
Abort the transfer with ETIMEDOUT when the TPM signals more than TPM_RETRY wait states. Continuing with the transfer in this state will only lead to arbitrary failures in other parts of the code.
--- drivers/char/tpm/tpm_tis_spi.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/char/tpm/tpm_tis_spi.c +5 -0
@@ -101,6 +101,11 @@ static int tpm_tis_spi_transfer(struct t goto exit; } +if (i ==TPM_RETRY ) { + ret = -ETIMEDOUT ; + goto exit; + } + spi_xfer.cs_change =0 ; spi_xfer.len = len;
Greg Kroah-Hartman
maintainerPATCH 12/197 tpm_tis_spi: Check correct byte for wait state indicator
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Huewe <[email protected]>
commit e110cc69dc2ad679d6d478df636b99b14e6fbbc9 upstream.
Wait states are signaled in the last byte received from the TPM in response to the header, not the first byte. Check rx_buf[3] instead of rx_buf[0].
--- drivers/char/tpm/tpm_tis_spi.c | 34 +++++++++++++++++----------------- 1 file changed, 17 insertions(+), 17 deletions(-)
drivers/char/tpm/tpm_tis_spi.c +17 -17
@@ -85,25 +85,25 @@ static int tpm_tis_spi_transfer(struct tif (ret <0 ) goto exit; - phy->tx_buf[0 ] =0 ; +if ((phy->rx_buf[3 ] &0x01 ) ==0 ) { +// handle SPI wait states + phy->tx_buf[0 ] =0 ; -/* According to TCG PTP specification, if there is no TPM present at -* all, then the design has a weak pull-up on MISO. If a TPM is not -* present, a pull-up on MISO means that the SB controller sees a 1, -* and will latch in 0xFF on the read. -*/ -for (i =0 ; (phy->rx_buf[0 ] &0x01 ) ==0 && i <TPM_RETRY ; i++) { - spi_xfer.len =1 ; -spi_message_init (&m); -spi_message_add_tail (&spi_xfer, &m); - ret =spi_sync_locked (phy->spi_device, &m); -if (ret <0 ) - goto exit; - } +for (i =0 ; i <TPM_RETRY ; i++) { + spi_xfer.len =1 ; +spi_message_init (&m); +spi_message_add_tail (&spi_xfer, &m); + ret =spi_sync_locked (phy->spi_device, &m); +if (ret <0 ) + goto exit; +if (phy->rx_buf[0 ] &0x01 ) +break ; + } -if (i ==TPM_RETRY ) { - ret = -ETIMEDOUT ; - goto exit; +if (i ==TPM_RETRY ) { + ret = -ETIMEDOUT ; + goto exit; + } } spi_xfer.cs_change =0 ;
Greg Kroah-Hartman
maintainerPATCH 13/197 tpm_tis_spi: Remove limitation of transfers to MAX_SPI_FRAMESIZE bytes
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Huewe <[email protected]>
commit 591e48c26ced7c455751eef27fb5963e902c2137 upstream.
Limiting transfers to MAX_SPI_FRAMESIZE was not expected by the upper layers, as tpm_tis has no such limitation. Add a loop to hide that limitation.
v2: Moved scope of spi_message to the top as requested by Jarkko
--- drivers/char/tpm/tpm_tis_spi.c | 109 ++++++++++++++++++++++------------------- 1 file changed, 59 insertions(+), 50 deletions(-)
drivers/char/tpm/tpm_tis_spi.c +59 -50
@@ -60,67 +60,76 @@ static int tpm_tis_spi_transfer(struct t u8 *buffer, u8 direction) {struct tpm_tis_spi_phy *phy =to_tpm_tis_spi_phy (data); -int ret, i; +int ret =0 ; +int i;struct spi_message m; -struct spi_transfer spi_xfer = { - .tx_buf = phy->tx_buf, - .rx_buf = phy->rx_buf, - .len =4 , - .cs_change =1 , - }; - -if (len >MAX_SPI_FRAMESIZE ) -return -ENOMEM ; - - phy->tx_buf[0 ] = direction | (len -1 ); - phy->tx_buf[1 ] =0xd4 ; - phy->tx_buf[2 ] = addr >>8 ; - phy->tx_buf[3 ] = addr; - -spi_message_init (&m); -spi_message_add_tail (&spi_xfer, &m); +struct spi_transfer spi_xfer; +u8 transfer_len;spi_bus_lock (phy->spi_device->master); - ret =spi_sync_locked (phy->spi_device, &m); -if (ret <0 ) - goto exit; - -if ((phy->rx_buf[3 ] &0x01 ) ==0 ) { -// handle SPI wait states - phy->tx_buf[0 ] =0 ; - -for (i =0 ; i <TPM_RETRY ; i++) { - spi_xfer.len =1 ; -spi_message_init (&m); -spi_message_add_tail (&spi_xfer, &m); - ret =spi_sync_locked (phy->spi_device, &m); -if (ret <0 ) + +while (len) { + transfer_len =min_t (u16, len,MAX_SPI_FRAMESIZE ); + + phy->tx_buf[0 ] = direction | (transfer_len -1 ); + phy->tx_buf[1 ] =0xd4 ; + phy->tx_buf[2 ] = addr >>8 ; + phy->tx_buf[3 ] = addr; + +memset (&spi_xfer,0 ,sizeof (spi_xfer)); + spi_xfer.tx_buf = phy->tx_buf; + spi_xfer.rx_buf = phy->rx_buf; + spi_xfer.len =4 ; + spi_xfer.cs_change =1 ; + +spi_message_init (&m); +spi_message_add_tail (&spi_xfer, &m); + ret =spi_sync_locked (phy->spi_device, &m); +if (ret <0 ) + goto exit; + +if ((phy->rx_buf[3 ] &0x01 ) ==0 ) { +// handle SPI wait states + phy->tx_buf[0 ] =0 ; + +for (i =0 ; i <TPM_RETRY ; i++) { + spi_xfer.len =1 ; +spi_message_init (&m); +spi_message_add_tail (&spi_xfer, &m); + ret =spi_sync_locked (phy->spi_device, &m); +if (ret <0 ) + goto exit; +if (phy->rx_buf[0 ] &0x01 ) +break ; + } + +if (i ==TPM_RETRY ) { + ret = -ETIMEDOUT ; goto exit; -if (phy->rx_buf[0 ] &0x01 ) -break ; + } } -if (i ==TPM_RETRY ) { - ret = -ETIMEDOUT ; - goto exit; + spi_xfer.cs_change =0 ; + spi_xfer.len = transfer_len; + +if (direction) { + spi_xfer.tx_buf =NULL ; + spi_xfer.rx_buf = buffer; + }else { + spi_xfer.tx_buf = buffer; + spi_xfer.rx_buf =NULL ; } - } - spi_xfer.cs_change =0 ; - spi_xfer.len = len; +spi_message_init (&m); +spi_message_add_tail (&spi_xfer, &m); + ret =spi_sync_locked (phy->spi_device, &m); +if (ret <0 ) + goto exit; -if (direction) { - spi_xfer.tx_buf =NULL ; - spi_xfer.rx_buf = buffer; - }else { - spi_xfer.tx_buf = buffer; - spi_xfer.rx_buf =NULL ; + len -= transfer_len; + buffer += transfer_len; } -spi_message_init (&m); -spi_message_add_tail (&spi_xfer, &m); - ret =spi_sync_locked (phy->spi_device, &m); - exit:spi_bus_unlock (phy->spi_device->master);return ret;
Greg Kroah-Hartman
maintainerPATCH 14/197 tpm_tis_spi: Add small delay after last transfer
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Huewe <[email protected]>
commit 5cc0101d1f88500f8901d01b035af743215d4c3a upstream.
Testing the implementation with a Raspberry Pi 2 showed that under some circumstances its SPI master erroneously releases the CS line before the transfer is complete, i.e. before the end of the last clock. In this case the TPM ignores the transfer and misses for example the GO command. The driver is unable to detect this communication problem and will wait for a command response that is never going to arrive, timing out eventually.
As a workaround, the small delay ensures that the CS line is held long enough, even with a faulty SPI master. Other SPI masters are not affected, except for a negligible performance penalty.
--- drivers/char/tpm/tpm_tis_spi.c | 1 + 1 file changed, 1 insertion(+)
drivers/char/tpm/tpm_tis_spi.c +1 -0
@@ -111,6 +111,7 @@ static int tpm_tis_spi_transfer(struct t spi_xfer.cs_change =0 ; spi_xfer.len = transfer_len; + spi_xfer.delay_usecs =5 ;if (direction) { spi_xfer.tx_buf =NULL ;
Greg Kroah-Hartman
maintainerPATCH 15/197 tpm: msleep() delays - replace with usleep_range() in i2c nuvoton driver
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nayna Jain <[email protected]>
commit a233a0289cf9a96ef9b42c730a7621ccbf9a6f98 upstream.
Commit 500462a9de65 "timers: Switch to a non-cascading wheel" replaced the 'classic' timer wheel, which aimed for near 'exact' expiry of the timers. Their analysis was that the vast majority of timeout timers are used as safeguards, not as real timers, and are cancelled or rearmed before expiration. The only exception noted to this were networking timers with a small expiry time.
Not included in the analysis was the TPM polling timer, which resulted in a longer normal delay and, every so often, a very long delay. The non-cascading wheel delay is based on CONFIG_HZ. For a description of the different rings and their delays, refer to the comments in kernel/time/timer.c.
Below are the delays given for rings 0 - 2, which explains the longer "normal" delays and the very, long delays as seen on systems with CONFIG_HZ 250.
* HZ 1000 steps
* Level Offset Granularity Range
* 0 0 1 ms 0 ms - 63 ms * 1 64 8 ms 64 ms - 511 ms * 2 128 64 ms 512 ms - 4095 ms (512ms - ~4s)
* HZ 250
* Level Offset Granularity Range
* 0 0 4 ms 0 ms - 255 ms * 1 64 32 ms 256 ms - 2047 ms (256ms - ~2s) * 2 128 256 ms 2048 ms - 16383 ms (~2s - ~16s)
Below is a comparison of extending the TPM with 1000 measurements, using msleep() vs. usleep_delay() when configured for 1000 hz vs. 250 hz, before and after commit 500462a9de65.
linux-4.7 | msleep() usleep_range()
1000 hz: 0m44.628s | 1m34.497s 29.243s
250 hz: 1m28.510s | 4m49.269s 32.386s
linux-4.7 | min-max (msleep) min-max (usleep_range)
1000 hz: 0:017 - 2:760s | 0:015 - 3:967s 0:014 - 0:418s
250 hz: 0:028 - 1:954s | 0:040 - 4:096s 0:016 - 0:816s
This patch replaces the msleep() with usleep_range() calls in the i2c nuvoton driver with a consistent max range value.
--- drivers/char/tpm/tpm_i2c_nuvoton.c | 23 +++++++++++++++-------- 1 file changed, 15 insertions(+), 8 deletions(-)
drivers/char/tpm/tpm_i2c_nuvoton.c +15 -8
@@ -49,9 +49,10 @@*/ #define TPM_I2C_MAX_BUF_SIZE 32#define TPM_I2C_RETRY_COUNT 32 -#define TPM_I2C_BUS_DELAY 1/* msec */ -#define TPM_I2C_RETRY_DELAY_SHORT 2/* msec */ -#define TPM_I2C_RETRY_DELAY_LONG 10/* msec */ +#define TPM_I2C_BUS_DELAY 1000/* usec */ +#define TPM_I2C_RETRY_DELAY_SHORT (2 * 1000)/* usec */ +#define TPM_I2C_RETRY_DELAY_LONG (10 * 1000)/* usec */ +#define TPM_I2C_DELAY_RANGE 300/* usec */ #define OF_IS_TPM2 ((void *)1)#define I2C_IS_TPM2 1
@@ -123,7 +124,8 @@ static s32 i2c_nuvoton_write_status(stru/* this causes the current command to be aborted */ for (i =0 , status =-1 ; i <TPM_I2C_RETRY_COUNT && status <0 ; i++) { status =i2c_nuvoton_write_buf (client,TPM_STS ,1 , &data); -msleep (TPM_I2C_BUS_DELAY ); +usleep_range (TPM_I2C_BUS_DELAY ,TPM_I2C_BUS_DELAY + +TPM_I2C_DELAY_RANGE ); }return status; }
@@ -160,7 +162,8 @@ static int i2c_nuvoton_get_burstcount(st burst_count =min_t (u8,TPM_I2C_MAX_BUF_SIZE , data);break ; } -msleep (TPM_I2C_BUS_DELAY ); +usleep_range (TPM_I2C_BUS_DELAY ,TPM_I2C_BUS_DELAY + +TPM_I2C_DELAY_RANGE ); }while (time_before (jiffies, stop));return burst_count;
@@ -203,13 +206,17 @@ static int i2c_nuvoton_wait_for_stat(strreturn 0 ;/* use polling to wait for the event */ - ten_msec = jiffies +msecs_to_jiffies (TPM_I2C_RETRY_DELAY_LONG ); + ten_msec = jiffies +usecs_to_jiffies (TPM_I2C_RETRY_DELAY_LONG ); stop = jiffies + timeout; do { if (time_before(jiffies, ten_msec)) - msleep(TPM_I2C_RETRY_DELAY_SHORT); + usleep_range(TPM_I2C_RETRY_DELAY_SHORT, + TPM_I2C_RETRY_DELAY_SHORT + + TPM_I2C_DELAY_RANGE); else - msleep(TPM_I2C_RETRY_DELAY_LONG); + usleep_range(TPM_I2C_RETRY_DELAY_LONG, + TPM_I2C_RETRY_DELAY_LONG + + TPM_I2C_DELAY_RANGE); status_valid = i2c_nuvoton_check_status(chip, mask, value); if (status_valid)
Greg Kroah-Hartman
maintainerPATCH 16/197 tpm: add sleep only for retry in i2c_nuvoton_write_status()
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nayna Jain <[email protected]>
commit 0afb7118ae021e80ecf70f5a3336e0935505518a upstream.
Currently, there is an unnecessary 1 msec delay added in i2c_nuvoton_write_status() for the successful case. This function is called multiple times during send() and recv(), which implies adding multiple extra delays for every TPM operation.
This patch calls usleep_range() only if retry is to be done.
--- drivers/char/tpm/tpm_i2c_nuvoton.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/char/tpm/tpm_i2c_nuvoton.c +3 -2
@@ -124,8 +124,9 @@ static s32 i2c_nuvoton_write_status(stru/* this causes the current command to be aborted */ for (i =0 , status =-1 ; i <TPM_I2C_RETRY_COUNT && status <0 ; i++) { status =i2c_nuvoton_write_buf (client,TPM_STS ,1 , &data); -usleep_range (TPM_I2C_BUS_DELAY ,TPM_I2C_BUS_DELAY - +TPM_I2C_DELAY_RANGE ); +if (status <0 ) +usleep_range (TPM_I2C_BUS_DELAY ,TPM_I2C_BUS_DELAY + +TPM_I2C_DELAY_RANGE ); }return status; }
Greg Kroah-Hartman
maintainerPATCH 17/197 tpm_crb: check for bad response size
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerry Snitselaar <[email protected]>
commit 8569defde8057258835c51ce01a33de82e14b148 upstream.
Make sure size of response buffer is at least 6 bytes, or we will underflow and pass large size_t to memcpy_fromio(). This was encountered while testing earlier version of locality patchset.
--- drivers/char/tpm/tpm_crb.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/char/tpm/tpm_crb.c +1 -2
@@ -176,8 +176,7 @@ static int crb_recv(struct tpm_chip *chimemcpy_fromio (buf, priv->rsp,6 ); expected =be32_to_cpup ((__be32 *) &buf[2 ]); - -if (expected > count) +if (expected > count || expected <6 )return -EIO ;memcpy_fromio (&buf[6 ], &priv->rsp[6 ], expected -6 );
Greg Kroah-Hartman
maintainerPATCH 18/197 vTPM: Fix missing NULL check
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hon Ching \(Vicky\) Lo <[email protected]>
commit 31574d321c70f6d3b40fe98f9b2eafd9a903fef9 upstream.
The current code passes the address of tpm_chip as the argument to dev_get_drvdata() without prior NULL check in tpm_ibmvtpm_get_desired_dma. This resulted an oops during kernel boot when vTPM is enabled in Power partition configured in active memory sharing mode.
The vio_driver's get_desired_dma() is called before the probe(), which for vtpm is tpm_ibmvtpm_probe, and it's this latter function that initializes the driver and set data. Attempting to get data before the probe() caused the problem.
This patch adds a NULL check to the tpm_ibmvtpm_get_desired_dma.
--- drivers/char/tpm/tpm_ibmvtpm.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/char/tpm/tpm_ibmvtpm.c +6 -2
@@ -299,6 +299,8 @@ static int tpm_ibmvtpm_remove(struct vio }kfree (ibmvtpm); +/* For tpm_ibmvtpm_get_desired_dma */ +dev_set_drvdata (&vdev->dev,NULL );return 0 ; }
@@ -313,14 +315,16 @@ static int tpm_ibmvtpm_remove(struct viostatic unsigned long tpm_ibmvtpm_get_desired_dma (struct vio_dev *vdev) {struct tpm_chip *chip =dev_get_drvdata (&vdev->dev); -struct ibmvtpm_dev *ibmvtpm =dev_get_drvdata (&chip->dev); +struct ibmvtpm_dev *ibmvtpm;/* * ibmvtpm initializes at probe time, so the data we are * asking for may not be set yet. Estimate that 4K required * for TCE-mapped buffer in addition to CRQ. */ -if (!ibmvtpm) +if (chip) + ibmvtpm =dev_get_drvdata (&chip->dev); +else return CRQ_RES_BUF_SIZE +PAGE_SIZE ;return CRQ_RES_BUF_SIZE + ibmvtpm->rtce_size;
Greg Kroah-Hartman
maintainerPATCH 19/197 tpm: fix handling of the TPM 2.0 event logs
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Petr Vandrovec <[email protected]>
commit fd5c78694f3f1c875e293de7a641ba8a3d60d00d upstream.
When TPM2 log has entries with more than 3 digests, or with digests not listed in the log header, log gets misparsed, eventually leading to kernel complaint that code tried to vmalloc 512MB of memory (I have no idea what would happen on bigger system).
So code should not parse only first 3 digests: both event header and event itself are already in memory, so we can parse any number of digests, as long as we do not try to parse whole memory when given count of 0xFFFFFFFF.
So this change:
* Rejects event entry with more digests than log header describes. Digest types should be unique, and all should be described in log header, so there cannot be more digests in the event than in the header.
* Reject event entry with digest that is not described in the log header. In theory code could hardcode information about digest IDs already assigned by TCG, but if firmware authors cannot get event log format right, why should anyone believe that they got event log content right.
--- drivers/char/tpm/tpm2_eventlog.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
drivers/char/tpm/tpm2_eventlog.c +10 -4
@@ -56,18 +56,24 @@ static int calc_tpm2_event_size(struct t efispecid = (struct tcg_efi_specid_event *)event_header->event; -for (i =0 ; (i < event->count) && (i <TPM2_ACTIVE_PCR_BANKS ); - i++) { +/* Check if event is malformed. */ +if (event->count > efispecid->num_algs) +return 0 ; + +for (i =0 ; i < event->count; i++) { halg_size =sizeof (event->digests[i].alg_id);memcpy (&halg, marker, halg_size); marker = marker + halg_size; -for (j =0 ; (j < efispecid->num_algs); j++) { +for (j =0 ; j < efispecid->num_algs; j++) {if (halg == efispecid->digest_sizes[j].alg_id) { - marker = marker + + marker += efispecid->digest_sizes[j].digest_size;break ; } } +/* Algorithm without known length. Such event is unparseable. */ +if (j == efispecid->num_algs) +return 0 ; } event_field = (struct tcg_event_field *)marker;
Greg Kroah-Hartman
maintainerPATCH 20/197 ASoC: cs4271: configure reset GPIO as output
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Sverdlin <[email protected]>
commit 49b2e27ab9f66b0a22c21980ad8118a4038324ae upstream.
During reset "refactoring" the output configuration was lost. This commit repairs sound on EDB93XX boards.
--- sound/soc/codecs/cs4271.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/codecs/cs4271.c +1 -1
@@ -498,7 +498,7 @@ static int cs4271_reset(struct snd_soc_cstruct cs4271_private *cs4271 =snd_soc_codec_get_drvdata (codec);if (gpio_is_valid (cs4271->gpio_nreset)) { -gpio_set_value (cs4271->gpio_nreset,0 ); +gpio_direction_output (cs4271->gpio_nreset,0 );mdelay (1 );gpio_set_value (cs4271->gpio_nreset,1 );mdelay (1 );
Greg Kroah-Hartman
maintainerPATCH 21/197 mlx5: Fix mlx5_ib_map_mr_sg mr length
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sagi Grimberg <[email protected]>
commit 0a49f2c31c3efbeb0de3e4b5598764887f629be2 upstream.
In case we got an initial sg_offset, we need to
account for it in the mr length.
--- drivers/infiniband/hw/mlx5/mr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/mlx5/mr.c +1 -1
@@ -1782,7 +1782,7 @@ mlx5_ib_sg_to_klms(struct mlx5_ib_mr *mr klms[i].va =cpu_to_be64 (sg_dma_address (sg) + sg_offset); klms[i].bcount =cpu_to_be32 (sg_dma_len (sg) - sg_offset); klms[i].key =cpu_to_be32 (lkey); - mr->ibmr.length +=sg_dma_len (sg); + mr->ibmr.length +=sg_dma_len (sg) - sg_offset; sg_offset =0 ; }
Greg Kroah-Hartman
maintainerPATCH 22/197 infiniband: call ipv6 route lookup via the stub interface
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <[email protected]>
commit eea40b8f624f25cbc02d55f2d93203f60cee9341 upstream.
The infiniband address handle can be triggered to resolve an ipv6 address in response to MAD packets, regardless of the ipv6 module being disabled via the kernel command line argument.
That will cause a call into the ipv6 routing code, which is not initialized, and a conseguent oops.
This commit addresses the above issue replacing the direct lookup call with an indirect one via the ipv6 stub, which is properly initialized according to the ipv6 status (e.g. if ipv6 is disabled, the routing lookup fails gracefully)
--- drivers/infiniband/core/addr.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/infiniband/core/addr.c +2 -2
@@ -444,8 +444,8 @@ static int addr6_resolve(struct sockaddr fl6.saddr = src_in->sin6_addr; fl6.flowi6_oif = addr->bound_dev_if; - dst =ip6_route_output (addr->net,NULL , &fl6); -if ((ret = dst->error)) + ret = ipv6_stub->ipv6_dst_lookup (addr->net,NULL , &dst, &fl6); +if (ret <0 ) goto put; rt = (struct rt6_info *)dst;
Greg Kroah-Hartman
maintainerPATCH 23/197 dm btree: fix for dm_btree_find_lowest_key()
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vinothkumar Raja <[email protected]>
commit 7d1fedb6e96a960aa91e4ff70714c3fb09195a5a upstream.
dm_btree_find_lowest_key() is giving incorrect results. find_key() traverses the btree correctly for finding the highest key, but there is an error in the way it traverses the btree for retrieving the lowest key. dm_btree_find_lowest_key() fetches the first key of the rightmost block of the btree instead of fetching the first key from the leftmost block.
Fix this by conditionally passing the correct parameter to value64() based on the @find_highest flag.
--- drivers/md/persistent-data/dm-btree.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/md/persistent-data/dm-btree.c +6 -2
@@ -902,8 +902,12 @@ static int find_key(struct ro_spine *s,else *result_key =le64_to_cpu (ro_node (s)->keys[0 ]); -if (next_block || flags &INTERNAL_NODE ) - block =value64 (ro_node (s), i); +if (next_block || flags &INTERNAL_NODE ) { +if (find_highest) + block =value64 (ro_node (s), i); +else + block =value64 (ro_node (s),0 ); + } }while (flags &INTERNAL_NODE );
Greg Kroah-Hartman
maintainerPATCH 24/197 dm raid: select the Kconfig option CONFIG_MD_RAID0
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <[email protected]>
commit 7b81ef8b14f80033e4a4168d199a0f5fd79b9426 upstream.
Since the commit 0cf4503174c1 ("dm raid: add support for the MD RAID0 personality"), the dm-raid subsystem can activate a RAID-0 array. Therefore, add MD_RAID0 to the dependencies of DM_RAID, so that MD_RAID0 will be selected when DM_RAID is selected.
--- drivers/md/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/md/Kconfig +1 -0
@@ -365,6 +365,7 @@ config DM_LOG_USERSPACE config DM_RAID tristate "RAID 1/4/5/6/10 target" depends on BLK_DEV_DM + select MD_RAID0 select MD_RAID1 select MD_RAID10 select MD_RAID456
Greg Kroah-Hartman
maintainerPATCH 25/197 dm bufio: avoid a possible ABBA deadlock
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <[email protected]>
commit 1b0fb5a5b2dc0dddcfa575060441a7176ba7ac37 upstream.
__get_memory_limit() tests if dm_bufio_cache_size changed and calls __cache_size_refresh() if it did. It takes dm_bufio_clients_lock while it already holds the client lock. However, lock ordering is violated because in cleanup_old_buffers() dm_bufio_clients_lock is taken before the client lock.
This results in a possible deadlock and lockdep engine warning.
Fix this deadlock by changing mutex_lock() to mutex_trylock(). If the lock can't be taken, it will be re-checked next time when a new buffer is allocated.
Also add "unlikely" to the if condition, so that the optimizer assumes that the condition is false.
--- drivers/md/dm-bufio.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/md/dm-bufio.c +5 -4
@@ -933,10 +933,11 @@ static void __get_memory_limit(struct dm {unsigned long buffers; -if (ACCESS_ONCE (dm_bufio_cache_size) != dm_bufio_cache_size_latch) { -mutex_lock (&dm_bufio_clients_lock); -__cache_size_refresh (); -mutex_unlock (&dm_bufio_clients_lock); +if (unlikely (ACCESS_ONCE (dm_bufio_cache_size) != dm_bufio_cache_size_latch)) { +if (mutex_trylock (&dm_bufio_clients_lock)) { +__cache_size_refresh (); +mutex_unlock (&dm_bufio_clients_lock); + } } buffers = dm_bufio_cache_size_per_client >>
Greg Kroah-Hartman
maintainerPATCH 26/197 dm bufio: check new buffer allocation watermark every 30 seconds
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <[email protected]>
commit 390020ad2af9ca04844c4f3b1f299ad8746d84c8 upstream.
dm-bufio checks a watermark when it allocates a new buffer in __bufio_new(). However, it doesn't check the watermark when the user changes /sys/module/dm_bufio/parameters/max_cache_size_bytes.
This may result in a problem - if the watermark is high enough so that all possible buffers are allocated and if the user lowers the value of "max_cache_size_bytes", the watermark will never be checked against the new value because no new buffer would be allocated.
To fix this, change __evict_old_buffers() so that it checks the watermark. __evict_old_buffers() is called every 30 seconds, so if the user reduces "max_cache_size_bytes", dm-bufio will react to this change within 30 seconds and decrease memory consumption.
Depends-on: 1b0fb5a5b2 ("dm bufio: avoid a possible ABBA deadlock")
--- drivers/md/dm-bufio.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/md/dm-bufio.c +10 -0
@@ -1783,9 +1783,17 @@ static void __evict_old_buffers(struct dstruct dm_buffer *b, *tmp;unsigned retain_target =get_retain_buffers (c);unsigned count; +LIST_HEAD (write_list);dm_bufio_lock (c); +__check_watermark (c, &write_list); +if (unlikely (!list_empty (&write_list))) { +dm_bufio_unlock (c); +__flush_write_list (&write_list); +dm_bufio_lock (c); + } + count = c->n_buffers[LIST_CLEAN ] + c->n_buffers[LIST_DIRTY ];list_for_each_entry_safe_reverse (b, tmp, &c->lru[LIST_CLEAN ], lru_list) {if (count <= retain_target)
@@ -1810,6 +1818,8 @@ static void cleanup_old_buffers(void)mutex_lock (&dm_bufio_clients_lock); +__cache_size_refresh (); +list_for_each_entry (c, &dm_bufio_all_clients, client_list)__evict_old_buffers (c, max_age_hz);
Greg Kroah-Hartman
maintainerPATCH 27/197 dm mpath: requeue after a small delay if blk_get_request() fails
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <[email protected]>
commit 06eb061f48594aa369f6e852b352410298b317a8 upstream.
If blk_get_request() returns ENODEV then multipath_clone_and_map() causes a request to be requeued immediately. This can cause a kworker thread to spend 100% of the CPU time of a single core in __blk_mq_run_hw_queue() and also can cause device removal to never finish.
Avoid this by only requeuing after a delay if blk_get_request() fails. Additionally, reduce the requeue delay.
--- drivers/md/dm-mpath.c | 5 ++--- drivers/md/dm-rq.c | 2 +- 2 files changed, 3 insertions(+), 4 deletions(-)
drivers/md/dm-mpath.c +2 -3
@@ -484,7 +484,6 @@ static int multipath_clone_and_map(struc struct request **__clone) {struct multipath *m = ti->private; -int r =DM_MAPIO_REQUEUE ;size_t nr_bytes =blk_rq_bytes (rq);struct pgpath *pgpath;struct block_device *bdev;
@@ -503,7 +502,7 @@ static int multipath_clone_and_map(struc }else if (test_bit (MPATHF_QUEUE_IO , &m->flags) ||test_bit (MPATHF_PG_INIT_REQUIRED , &m->flags)) {pg_init_all_paths (m); -return r; +return DM_MAPIO_REQUEUE ; }memset (mpio,0 ,sizeof (*mpio));
@@ -517,7 +516,7 @@ static int multipath_clone_and_map(struc GFP_ATOMIC);if (IS_ERR (clone)) {/* EBUSY, ENODEV or EWOULDBLOCK: requeue */ -return r; +return DM_MAPIO_DELAY_REQUEUE ; } clone->bio = clone->biotail =NULL ; clone->rq_disk = bdev->bd_disk;
drivers/md/dm-rq.c +1 -1
@@ -280,7 +280,7 @@ static void dm_requeue_original_request(if (!rq->q->mq_ops)dm_old_requeue_request (rq);else -dm_mq_delay_requeue_request (rq, delay_requeue ?5000 :0 ); +dm_mq_delay_requeue_request (rq, delay_requeue ?100 /*ms*/ :0 );rq_completed (md, rw, false); }
Greg Kroah-Hartman
maintainerPATCH 28/197 dm mpath: split and rename activate_path() to prepare for its expanded use
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <[email protected]>
commit 89bfce763e43fa4897e0d3af6b29ed909df64cfd upstream.
activate_path() is renamed to activate_path_work() which now calls activate_or_offline_path(). activate_or_offline_path() will be used by the next commit.
--- drivers/md/dm-mpath.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-)
drivers/md/dm-mpath.c +12 -5
@@ -111,7 +111,8 @@ typedef int (*action_fn) (struct pgpathstatic struct workqueue_struct *kmultipathd, *kmpath_handlerd;static void trigger_event (struct work_struct *work); -static void activate_path (struct work_struct *work); +static void activate_or_offline_path (struct pgpath *pgpath); +static void activate_path_work (struct work_struct *work);static void process_queued_bios (struct work_struct *work);/*-----------------------------------------------
@@ -136,7 +137,7 @@ static struct pgpath *alloc_pgpath(void)if (pgpath) { pgpath->is_active = true; -INIT_DELAYED_WORK (&pgpath->activate_path, activate_path); +INIT_DELAYED_WORK (&pgpath->activate_path, activate_path_work); }return pgpath;
@@ -1436,10 +1437,8 @@ out:spin_unlock_irqrestore (&m->lock, flags); } -static void activate_path (struct work_struct *work) +static void activate_or_offline_path (struct pgpath *pgpath) { -struct pgpath *pgpath = - container_of(work, struct pgpath, activate_path.work);struct request_queue *q =bdev_get_queue (pgpath->path.dev->bdev);if (pgpath->is_active && !blk_queue_dying (q))
@@ -1448,6 +1447,14 @@ static void activate_path(struct work_stpg_init_done (pgpath,SCSI_DH_DEV_OFFLINED ); } +static void activate_path_work (struct work_struct *work) +{ +struct pgpath *pgpath = + container_of(work, struct pgpath, activate_path.work); + +activate_or_offline_path (pgpath); +} +static int noretry_error (int error) {switch (error) {
Greg Kroah-Hartman
maintainerPATCH 29/197 dm mpath: avoid that path removal can trigger an infinite loop
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <[email protected]>
commit 7083abbbfc4fa706ff72d27d33a5214881979336 upstream.
If blk_get_request() fails, check whether the failure is due to a path being removed. If that is the case, fail the path by triggering a call to fail_path(). This avoids that the following scenario can be encountered while removing paths:
* CPU usage of a kworker thread jumps to 100%.
* Removing the DM device becomes impossible.
Delay requeueing if blk_get_request() returns -EBUSY or -EWOULDBLOCK, and the queue is not dying, because in these cases immediate requeuing is inappropriate.
--- drivers/md/dm-mpath.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
drivers/md/dm-mpath.c +11 -4
@@ -489,6 +489,7 @@ static int multipath_clone_and_map(strucstruct pgpath *pgpath;struct block_device *bdev;struct dm_mpath_io *mpio =get_mpio (map_context); +struct request_queue *q;struct request *clone;/* Do we need to select a new pgpath? */
@@ -511,12 +512,18 @@ static int multipath_clone_and_map(struc mpio->nr_bytes = nr_bytes; bdev = pgpath->path.dev->bdev; - - clone =blk_get_request (bdev_get_queue (bdev), - rq->cmd_flags |REQ_NOMERGE , -GFP_ATOMIC ); + q =bdev_get_queue (bdev); + clone =blk_get_request (q, rq->cmd_flags |REQ_NOMERGE ,GFP_ATOMIC );if (IS_ERR (clone)) {/* EBUSY, ENODEV or EWOULDBLOCK: requeue */ +bool queue_dying =blk_queue_dying (q); +DMERR_LIMIT ("blk_get_request() returned %ld%s - requeuing" , +PTR_ERR (clone), queue_dying ?" (path offline)" :"" ); +if (queue_dying) { +atomic_inc (&m->pg_init_in_progress); +activate_or_offline_path (pgpath); +return DM_MAPIO_REQUEUE ; + }return DM_MAPIO_DELAY_REQUEUE ; } clone->bio = clone->biotail =NULL ;
Greg Kroah-Hartman
maintainerPATCH 30/197 dm mpath: delay requeuing while path initialization is in progress
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <[email protected]>
commit c1d7ecf7ca11d0edd3085262c8597203440d056c upstream.
Requeuing a request immediately while path initialization is ongoing causes high CPU usage, something that is undesired. Hence delay requeuing while path initialization is in progress.
--- drivers/md/dm-mpath.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/md/dm-mpath.c +7 -3
@@ -322,13 +322,16 @@ static int __pg_init_all_paths(struct mureturn atomic_read (&m->pg_init_in_progress); } -static void pg_init_all_paths (struct multipath *m) +static int pg_init_all_paths (struct multipath *m) { +int ret;unsigned long flags;spin_lock_irqsave (&m->lock, flags); -__pg_init_all_paths (m); + ret =__pg_init_all_paths (m);spin_unlock_irqrestore (&m->lock, flags); + +return ret; }static void __switch_pg (struct multipath *m,struct priority_group *pg)
@@ -503,7 +506,8 @@ static int multipath_clone_and_map(strucreturn -EIO ;/* Failed */ }else if (test_bit (MPATHF_QUEUE_IO , &m->flags) ||test_bit (MPATHF_PG_INIT_REQUIRED , &m->flags)) { -pg_init_all_paths (m); +if (pg_init_all_paths (m)) +return DM_MAPIO_DELAY_REQUEUE ;return DM_MAPIO_REQUEUE ; }
Greg Kroah-Hartman
maintainerPATCH 31/197 dm cache metadata: fail operations if fail_io mode has been established
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Snitzer <[email protected]>
commit 10add84e276432d9dd8044679a1028dd4084117e upstream.
Otherwise it is possible to trigger crashes due to the metadata being inaccessible yet these methods don't safely account for that possibility without these checks.
--- drivers/md/dm-cache-metadata.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
drivers/md/dm-cache-metadata.c +8 -4
@@ -1627,17 +1627,19 @@ void dm_cache_metadata_set_stats(structint dm_cache_commit (struct dm_cache_metadata *cmd,bool clean_shutdown) { -int r; +int r = -EINVAL ;flags_mutator mutator = (clean_shutdown ? set_clean_shutdown : clear_clean_shutdown);WRITE_LOCK (cmd); +if (cmd->fail_io) + goto out; + r =__commit_transaction (cmd, mutator);if (r) goto out; r =__begin_transaction (cmd); - out:WRITE_UNLOCK (cmd);return r;
@@ -1649,7 +1651,8 @@ int dm_cache_get_free_metadata_block_couint r = -EINVAL ;READ_LOCK (cmd); - r =dm_sm_get_nr_free (cmd->metadata_sm, result); +if (!cmd->fail_io) + r =dm_sm_get_nr_free (cmd->metadata_sm, result);READ_UNLOCK (cmd);return r;
@@ -1661,7 +1664,8 @@ int dm_cache_get_metadata_dev_size(strucint r = -EINVAL ;READ_LOCK (cmd); - r =dm_sm_get_nr_blocks (cmd->metadata_sm, result); +if (!cmd->fail_io) + r =dm_sm_get_nr_blocks (cmd->metadata_sm, result);READ_UNLOCK (cmd);return r;
Greg Kroah-Hartman
maintainerPATCH 32/197 dm bufio: make the parameter "retain_bytes" unsigned long
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <[email protected]>
commit 13840d38016203f0095cd547b90352812d24b787 upstream.
Change the type of the parameter "retain_bytes" from unsigned to unsigned long, so that on 64-bit machines the user can set more than 4GiB of data to be retained.
Also, change the type of the variable "count" in the function "__evict_old_buffers" to unsigned long. The assignment "count = c->n_buffers[LIST_CLEAN] + c->n_buffers[LIST_DIRTY];" could result in unsigned long to unsigned overflow and that could result in buffers not being freed when they should.
While at it, avoid division in get_retain_buffers(). Division is slow, we can change it to shift because we have precalculated the log2 of block size.
--- drivers/md/dm-bufio.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/md/dm-bufio.c +8 -8
@@ -216,7 +216,7 @@ static DEFINE_SPINLOCK(param_spinlock);* Buffers are freed after this timeout */ static unsigned dm_bufio_max_age =DM_BUFIO_DEFAULT_AGE_SECS ; -static unsigned dm_bufio_retain_bytes =DM_BUFIO_DEFAULT_RETAIN_BYTES ; +static unsigned long dm_bufio_retain_bytes =DM_BUFIO_DEFAULT_RETAIN_BYTES ;static unsigned long dm_bufio_peak_allocated;static unsigned long dm_bufio_allocated_kmem_cache;
@@ -1551,10 +1551,10 @@ static bool __try_evict_buffer(struct dmreturn true; } -static unsigned get_retain_buffers (struct dm_bufio_client *c) +static unsigned long get_retain_buffers (struct dm_bufio_client *c) { -unsigned retain_bytes =ACCESS_ONCE (dm_bufio_retain_bytes); -return retain_bytes / c->block_size; +unsigned long retain_bytes =ACCESS_ONCE (dm_bufio_retain_bytes); +return retain_bytes >> (c->sectors_per_block_bits +SECTOR_SHIFT ); } static unsigned long __scan(struct dm_bufio_client *c, unsigned long nr_to_scan,
@@ -1564,7 +1564,7 @@ static unsigned long __scan(struct dm_bustruct dm_buffer *b, *tmp;unsigned long freed =0 ;unsigned long count = nr_to_scan; -unsigned retain_target =get_retain_buffers (c); +unsigned long retain_target =get_retain_buffers (c);for (l =0 ; l <LIST_SIZE ; l++) {list_for_each_entry_safe_reverse (b, tmp, &c->lru[l], lru_list) {
@@ -1781,8 +1781,8 @@ static bool older_than(struct dm_bufferstatic void __evict_old_buffers (struct dm_bufio_client *c,unsigned long age_hz) {struct dm_buffer *b, *tmp; -unsigned retain_target =get_retain_buffers (c); -unsigned count; +unsigned long retain_target =get_retain_buffers (c); +unsigned long count;LIST_HEAD (write_list);dm_bufio_lock (c);
@@ -1942,7 +1942,7 @@ MODULE_PARM_DESC(max_cache_size_bytes, "module_param_named (max_age_seconds, dm_bufio_max_age, uint,S_IRUGO |S_IWUSR );MODULE_PARM_DESC (max_age_seconds,"Max age of a buffer in seconds" ); -module_param_named (retain_bytes, dm_bufio_retain_bytes, uint,S_IRUGO |S_IWUSR ); +module_param_named (retain_bytes, dm_bufio_retain_bytes, ulong,S_IRUGO |S_IWUSR );MODULE_PARM_DESC (retain_bytes,"Try to keep at least this many bytes cached in memory" );module_param_named (peak_allocated_bytes, dm_bufio_peak_allocated, ulong,S_IRUGO |S_IWUSR );
Greg Kroah-Hartman
maintainerPATCH 33/197 dm thin metadata: call precommit before saving the roots
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Thornber <[email protected]>
commit 91bcdb92d39711d1adb40c26b653b7978d93eb98 upstream.
These calls were the wrong way round in __write_initial_superblock.
--- drivers/md/dm-thin-metadata.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/md/dm-thin-metadata.c +2 -2
@@ -485,11 +485,11 @@ static int __write_initial_superblock(stif (r <0 )return r; - r =save_sm_roots (pmd); + r =dm_tm_pre_commit (pmd->tm);if (r <0 )return r; - r =dm_tm_pre_commit (pmd->tm); + r =save_sm_roots (pmd);if (r <0 )return r;
Greg Kroah-Hartman
maintainerPATCH 34/197 dm space map disk: fix some book keeping in the disk space map
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Thornber <[email protected]>
commit 0377a07c7a035e0d033cd8b29f0cb15244c0916a upstream.
When decrementing the reference count for a block, the free count wasn't being updated if the reference count went to zero.
--- drivers/md/persistent-data/dm-space-map-disk.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-)
drivers/md/persistent-data/dm-space-map-disk.c +14 -1
@@ -142,10 +142,23 @@ static int sm_disk_inc_block(struct dm_sstatic int sm_disk_dec_block (struct dm_space_map *sm,dm_block_t b) { +int r; +uint32_t old_count;enum allocation_event ev; struct sm_disk *smd = container_of(sm, struct sm_disk, sm); -return sm_ll_dec (&smd->ll, b, &ev); + r =sm_ll_dec (&smd->ll, b, &ev); +if (!r && (ev ==SM_FREE )) { +/* +* It's only free if it's also free in the last +* transaction. +*/ + r =sm_ll_lookup (&smd->old_ll, b, &old_count); +if (!r && !old_count) + smd->nr_allocated_this_transaction--; + } + +return r; }static int sm_disk_new_block (struct dm_space_map *sm,dm_block_t *b)
Greg Kroah-Hartman
maintainerPATCH 35/197 md: update slab_cache before releasing new stripes when stripes resizing
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dennis Yang <[email protected]>
commit 583da48e388f472e8818d9bb60ef6a1d40ee9f9d upstream.
When growing raid5 device on machine with small memory, there is chance that mdadm will be killed and the following bug report can be observed. The same bug could also be reproduced in linux-4.10.6.
[57600.075774] BUG: unable to handle kernel NULL pointer dereference at (null) [57600.083796] IP: [<ffffffff81a6aa87>] _raw_spin_lock+0x7/0x20 [57600.110378] PGD 421cf067 PUD 4442d067 PMD 0 [57600.114678] Oops: 0002 [#1] SMP [57600.180799] CPU: 1 PID: 25990 Comm: mdadm Tainted: P O 4.2.8 #1 [57600.187849] Hardware name: To be filled by O.E.M. To be filled by O.E.M./MAHOBAY, BIOS QV05AR66 03/06/2013 [57600.197490] task: ffff880044e47240 ti: ffff880043070000 task.ti: ffff880043070000 [57600.204963] RIP: 0010:[<ffffffff81a6aa87>] [<ffffffff81a6aa87>] _raw_spin_lock+0x7/0x20 [57600.213057] RSP: 0018:ffff880043073810 EFLAGS: 00010046 [57600.218359] RAX: 0000000000000000 RBX: 000000000000000c RCX: ffff88011e296dd0 [57600.225486] RDX: 0000000000000001 RSI: ffffe8ffffcb46c0 RDI: 0000000000000000 [57600.232613] RBP: ffff880043073878 R08: ffff88011e5f8170 R09: 0000000000000282 [57600.239739] R10: 0000000000000005 R11: 28f5c28f5c28f5c3 R12: ffff880043073838 [57600.246872] R13: ffffe8ffffcb46c0 R14: 0000000000000000 R15: ffff8800b9706a00 [57600.253999] FS: 00007f576106c700(0000) GS:ffff88011e280000(0000) knlGS:0000000000000000 [57600.262078] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [57600.267817] CR2: 0000000000000000 CR3: 00000000428fe000 CR4: 00000000001406e0 [57600.274942] Stack: [57600.276949] ffffffff8114ee35 ffff880043073868 0000000000000282 000000000000eb3f [57600.284383] ffffffff81119043 ffff880043073838 ffff880043073838 ffff88003e197b98 [57600.291820] ffffe8ffffcb46c0 ffff88003e197360 0000000000000286 ffff880043073968 [57600.299254] Call Trace: [57600.301698] [<ffffffff8114ee35>] ? cache_flusharray+0x35/0xe0 [57600.307523] [<ffffffff81119043>] ? __page_cache_release+0x23/0x110 [57600.313779] [<ffffffff8114eb53>] kmem_cache_free+0x63/0xc0 [57600.319344] [<ffffffff81579942>] drop_one_stripe+0x62/0x90 [57600.324915] [<ffffffff81579b5b>] raid5_cache_scan+0x8b/0xb0 [57600.330563] [<ffffffff8111b98a>] shrink_slab.part.36+0x19a/0x250 [57600.336650] [<ffffffff8111e38c>] shrink_zone+0x23c/0x250 [57600.342039] [<ffffffff8111e4f3>] do_try_to_free_pages+0x153/0x420 [57600.348210] [<ffffffff8111e851>] try_to_free_pages+0x91/0xa0 [57600.353959] [<ffffffff811145b1>] __alloc_pages_nodemask+0x4d1/0x8b0 [57600.360303] [<ffffffff8157a30b>] check_reshape+0x62b/0x770 [57600.365866] [<ffffffff8157a4a5>] raid5_check_reshape+0x55/0xa0 [57600.371778] [<ffffffff81583df7>] update_raid_disks+0xc7/0x110 [57600.377604] [<ffffffff81592b73>] md_ioctl+0xd83/0x1b10 [57600.382827] [<ffffffff81385380>] blkdev_ioctl+0x170/0x690 [57600.388307] [<ffffffff81195238>] block_ioctl+0x38/0x40 [57600.393525] [<ffffffff811731c5>] do_vfs_ioctl+0x2b5/0x480 [57600.399010] [<ffffffff8115e07b>] ? vfs_write+0x14b/0x1f0 [57600.404400] [<ffffffff811733cc>] SyS_ioctl+0x3c/0x70 [57600.409447] [<ffffffff81a6ad97>] entry_SYSCALL_64_fastpath+0x12/0x6a [57600.415875] Code: 00 00 00 00 55 48 89 e5 8b 07 85 c0 74 04 31 c0 5d c3 ba 01 00 00 00 f0 0f b1 17 85 c0 75 ef b0 01 5d c3 90 31 c0 ba 01 00 00 00 <f0> 0f b1 17 85 c0 75 01 c3 55 89 c6 48 89 e5 e8 85 d1 63 ff 5d [57600.435460] RIP [<ffffffff81a6aa87>] _raw_spin_lock+0x7/0x20 [57600.441208] RSP <ffff880043073810> [57600.444690] CR2: 0000000000000000 [57600.448000] ---[ end trace cbc6b5cc4bf9831d ]---
The problem is that resize_stripes() releases new stripe_heads before assigning new slab cache to conf->slab_cache. If the shrinker function raid5_cache_scan() gets called after resize_stripes() starting releasing new stripes but right before new slab cache being assigned, it is possible that these new stripe_heads will be freed with the old slab_cache which was already been destoryed and that triggers this bug.
--- drivers/md/raid5.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/md/raid5.c +4 -2
@@ -2323,6 +2323,10 @@ static int resize_stripes(struct r5conf err = -ENOMEM ;mutex_unlock (&conf->cache_size_mutex); + + conf->slab_cache = sc; + conf->active_name =1 -conf->active_name; +/* Step 4, return new stripes to service */ while (!list_empty (&newstripes)) { nsh = list_entry(newstripes.next, struct stripe_head, lru);
@@ -2340,8 +2344,6 @@ static int resize_stripes(struct r5conf }/* critical section pass, GFP_NOIO no longer needed */ - conf->slab_cache = sc; - conf->active_name =1 -conf->active_name;if (!err) conf->pool_size = newsize;return err;
Greg Kroah-Hartman
maintainerPATCH 36/197 md: MD_CLOSING needs to be cleared after called md_set_readonly or do_md_stop
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <[email protected]>
commit 065e519e71b2c1f41936cce75b46b5ab34adb588 upstream.
if called md_set_readonly and set MD_CLOSING bit, the mddev cannot be opened any more due to the MD_CLOING bit wasn't cleared. Thus it needs to be cleared in md_ioctl after any call to md_set_readonly() or do_md_stop().
--- drivers/md/md.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/md/md.c +5 -0
@@ -6776,6 +6776,7 @@ static int md_ioctl(struct block_devicevoid __user *argp = (void __user *)arg;struct mddev *mddev =NULL ;int ro; +bool did_set_md_closing = false;if (!md_ioctl_valid (cmd))return -ENOTTY ;
@@ -6865,7 +6866,9 @@ static int md_ioctl(struct block_device err = -EBUSY ; goto out; } +WARN_ON_ONCE (test_bit (MD_CLOSING , &mddev->flags));set_bit (MD_CLOSING , &mddev->flags); + did_set_md_closing = true;mutex_unlock (&mddev->open_mutex);sync_blockdev (bdev); }
@@ -7058,6 +7061,8 @@ unlock: mddev->hold_active =0 ;mddev_unlock (mddev); out: +if (did_set_md_closing) +clear_bit (MD_CLOSING , &mddev->flags);return err; }#ifdef CONFIG_COMPAT
Greg Kroah-Hartman
maintainerPATCH 37/197 rtlwifi: rtl8821ae: setup 8812ae RFE according to device type
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Larry Finger <[email protected]>
commit 46cfa2148e7371c537efff1a1c693e58f523089d upstream.
Current channel switch implementation sets 8812ae RFE reg value assuming that device always has type 2.
Extend possible RFE types set and write corresponding reg values.
Source for new code is
http://dlcdnet.asus.com/pub/ASUS/wireless/PCE-AC51/DR_PCE_AC51_20232801152016.zip
--- drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c | 122 ++++++++++++++++--- drivers/net/wireless/realtek/rtlwifi/rtl8821ae/reg.h | 1 2 files changed, 107 insertions(+), 16 deletions(-)
drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c +106 -16
@@ -358,6 +358,107 @@ bool rtl8821ae_phy_rf_config(struct ieeereturn rtl8821ae_phy_rf6052_config (hw); } +static void _rtl8812ae_phy_set_rfe_reg_24g (struct ieee80211_hw *hw) +{ +struct rtl_priv *rtlpriv =rtl_priv (hw); +struct rtl_hal *rtlhal =rtl_hal (rtl_priv (hw)); +u8 tmp; + +switch (rtlhal->rfe_type) { +case 3 : +rtl_set_bbreg (hw,RA_RFE_PINMUX ,BMASKDWORD ,0x54337770 ); +rtl_set_bbreg (hw,RB_RFE_PINMUX ,BMASKDWORD ,0x54337770 ); +rtl_set_bbreg (hw,RA_RFE_INV ,BMASKRFEINV ,0x010 ); +rtl_set_bbreg (hw,RB_RFE_INV ,BMASKRFEINV ,0x010 ); +rtl_set_bbreg (hw,0x900 ,0x00000303 ,0x1 ); +break ; +case 4 : +rtl_set_bbreg (hw,RA_RFE_PINMUX ,BMASKDWORD ,0x77777777 ); +rtl_set_bbreg (hw,RB_RFE_PINMUX ,BMASKDWORD ,0x77777777 ); +rtl_set_bbreg (hw,RA_RFE_INV ,BMASKRFEINV ,0x001 ); +rtl_set_bbreg (hw,RB_RFE_INV ,BMASKRFEINV ,0x001 ); +break ; +case 5 : +rtl_write_byte (rtlpriv,RA_RFE_PINMUX +2 ,0x77 ); +rtl_set_bbreg (hw,RB_RFE_PINMUX ,BMASKDWORD ,0x77777777 ); + tmp =rtl_read_byte (rtlpriv,RA_RFE_INV +3 ); +rtl_write_byte (rtlpriv,RA_RFE_INV +3 , tmp & ~0x1 ); +rtl_set_bbreg (hw,RB_RFE_INV ,BMASKRFEINV ,0x000 ); +break ; +case 1 : +if (rtlpriv->btcoexist.bt_coexistence) { +rtl_set_bbreg (hw,RA_RFE_PINMUX ,0xffffff ,0x777777 ); +rtl_set_bbreg (hw,RB_RFE_PINMUX ,BMASKDWORD , +0x77777777 ); +rtl_set_bbreg (hw,RA_RFE_INV ,0x33f00000 ,0x000 ); +rtl_set_bbreg (hw,RB_RFE_INV ,BMASKRFEINV ,0x000 ); +break ; + } +case 0 : +case 2 : +default : +rtl_set_bbreg (hw,RA_RFE_PINMUX ,BMASKDWORD ,0x77777777 ); +rtl_set_bbreg (hw,RB_RFE_PINMUX ,BMASKDWORD ,0x77777777 ); +rtl_set_bbreg (hw,RA_RFE_INV ,BMASKRFEINV ,0x000 ); +rtl_set_bbreg (hw,RB_RFE_INV ,BMASKRFEINV ,0x000 ); +break ; + } +} + +static void _rtl8812ae_phy_set_rfe_reg_5g (struct ieee80211_hw *hw) +{ +struct rtl_priv *rtlpriv =rtl_priv (hw); +struct rtl_hal *rtlhal =rtl_hal (rtl_priv (hw)); +u8 tmp; + +switch (rtlhal->rfe_type) { +case 0 : +rtl_set_bbreg (hw,RA_RFE_PINMUX ,BMASKDWORD ,0x77337717 ); +rtl_set_bbreg (hw,RB_RFE_PINMUX ,BMASKDWORD ,0x77337717 ); +rtl_set_bbreg (hw,RA_RFE_INV ,BMASKRFEINV ,0x010 ); +rtl_set_bbreg (hw,RB_RFE_INV ,BMASKRFEINV ,0x010 ); +break ; +case 1 : +if (rtlpriv->btcoexist.bt_coexistence) { +rtl_set_bbreg (hw,RA_RFE_PINMUX ,0xffffff ,0x337717 ); +rtl_set_bbreg (hw,RB_RFE_PINMUX ,BMASKDWORD , +0x77337717 ); +rtl_set_bbreg (hw,RA_RFE_INV ,0x33f00000 ,0x000 ); +rtl_set_bbreg (hw,RB_RFE_INV ,BMASKRFEINV ,0x000 ); + }else { +rtl_set_bbreg (hw,RA_RFE_PINMUX ,BMASKDWORD , +0x77337717 ); +rtl_set_bbreg (hw,RB_RFE_PINMUX ,BMASKDWORD , +0x77337717 ); +rtl_set_bbreg (hw,RA_RFE_INV ,BMASKRFEINV ,0x000 ); +rtl_set_bbreg (hw,RB_RFE_INV ,BMASKRFEINV ,0x000 ); + } +break ; +case 3 : +rtl_set_bbreg (hw,RA_RFE_PINMUX ,BMASKDWORD ,0x54337717 ); +rtl_set_bbreg (hw,RB_RFE_PINMUX ,BMASKDWORD ,0x54337717 ); +rtl_set_bbreg (hw,RA_RFE_INV ,BMASKRFEINV ,0x010 ); +rtl_set_bbreg (hw,RB_RFE_INV ,BMASKRFEINV ,0x010 ); +rtl_set_bbreg (hw,0x900 ,0x00000303 ,0x1 ); +break ; +case 5 : +rtl_write_byte (rtlpriv,RA_RFE_PINMUX +2 ,0x33 ); +rtl_set_bbreg (hw,RB_RFE_PINMUX ,BMASKDWORD ,0x77337777 ); + tmp =rtl_read_byte (rtlpriv,RA_RFE_INV +3 ); +rtl_write_byte (rtlpriv,RA_RFE_INV +3 , tmp |0x1 ); +rtl_set_bbreg (hw,RB_RFE_INV ,BMASKRFEINV ,0x010 ); +break ; +case 2 : +case 4 : +default : +rtl_set_bbreg (hw,RA_RFE_PINMUX ,BMASKDWORD ,0x77337777 ); +rtl_set_bbreg (hw,RB_RFE_PINMUX ,BMASKDWORD ,0x77337777 ); +rtl_set_bbreg (hw,RA_RFE_INV ,BMASKRFEINV ,0x010 ); +rtl_set_bbreg (hw,RB_RFE_INV ,BMASKRFEINV ,0x010 ); +break ; + } +} +u32 phy_get_tx_swing_8812A (struct ieee80211_hw *hw,u8 band,u8 rf_path) {
@@ -552,14 +653,9 @@ void rtl8821ae_phy_switch_wirelessband(s/* 0x82C[1:0] = 2b'00 */ rtl_set_bbreg (hw,0x82c ,0x3 ,0 ); } -if (rtlhal->hw_type ==HARDWARE_TYPE_RTL8812AE ) { -rtl_set_bbreg (hw,RA_RFE_PINMUX ,BMASKDWORD , -0x77777777 ); -rtl_set_bbreg (hw,RB_RFE_PINMUX ,BMASKDWORD , -0x77777777 ); -rtl_set_bbreg (hw,RA_RFE_INV ,0x3ff00000 ,0x000 ); -rtl_set_bbreg (hw,RB_RFE_INV ,0x3ff00000 ,0x000 ); - } + +if (rtlhal->hw_type ==HARDWARE_TYPE_RTL8812AE ) +_rtl8812ae_phy_set_rfe_reg_24g (hw);rtl_set_bbreg (hw,RTXPATH ,0xf0 ,0x1 );rtl_set_bbreg (hw,RCCK_RX ,0x0f000000 ,0x1 );
@@ -614,14 +710,8 @@ void rtl8821ae_phy_switch_wirelessband(s/* 0x82C[1:0] = 2'b00 */ rtl_set_bbreg (hw,0x82c ,0x3 ,1 ); -if (rtlhal->hw_type ==HARDWARE_TYPE_RTL8812AE ) { -rtl_set_bbreg (hw,RA_RFE_PINMUX ,BMASKDWORD , -0x77337777 ); -rtl_set_bbreg (hw,RB_RFE_PINMUX ,BMASKDWORD , -0x77337777 ); -rtl_set_bbreg (hw,RA_RFE_INV ,0x3ff00000 ,0x010 ); -rtl_set_bbreg (hw,RB_RFE_INV ,0x3ff00000 ,0x010 ); - } +if (rtlhal->hw_type ==HARDWARE_TYPE_RTL8812AE ) +_rtl8812ae_phy_set_rfe_reg_5g (hw);rtl_set_bbreg (hw,RTXPATH ,0xf0 ,0 );rtl_set_bbreg (hw,RCCK_RX ,0x0f000000 ,0xf );
drivers/net/wireless/realtek/rtlwifi/rtl8821ae/reg.h +1 -0
@@ -2424,6 +2424,7 @@#define BMASKH4BITS 0xf0000000#define BMASKOFDM_D 0xffc00000#define BMASKCCK 0x3f3f3f3f +#define BMASKRFEINV 0x3ff00000#define BRFREGOFFSETMASK 0xfffff
Greg Kroah-Hartman
maintainerPATCH 38/197 mwifiex: MAC randomization should not be persistent
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Norris <[email protected]>
commit 7e2f18f06408ff56d7f75e68de8064777137b319 upstream.
nl80211 provides the NL80211_SCAN_FLAG_RANDOM_ADDR for every scan request that should be randomized; the absence of such a flag means we should not randomize. However, mwifiex was stashing the latest randomization request and *always* using it for future scans, even those that didn't set the flag.
Let's zero out the randomization info whenever we get a scan request without NL80211_SCAN_FLAG_RANDOM_ADDR. I'd prefer to remove priv->random_mac entirely (and plumb the randomization MAC properly through the call sequence), but the spaghetti is a little difficult to unravel here for me.
--- drivers/net/wireless/marvell/mwifiex/cfg80211.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/wireless/marvell/mwifiex/cfg80211.c +3 -1
@@ -2528,9 +2528,11 @@ mwifiex_cfg80211_scan(struct wiphy *wiph priv->random_mac[i] |=get_random_int () & ~(request->mac_addr_mask[i]); } +ether_addr_copy (user_scan_cfg->random_mac, priv->random_mac); + }else { +eth_zero_addr (priv->random_mac); } -ether_addr_copy (user_scan_cfg->random_mac, priv->random_mac); user_scan_cfg->num_ssids = request->n_ssids; user_scan_cfg->ssid_list = request->ssids;
Greg Kroah-Hartman
maintainerPATCH 39/197 mwifiex: pcie: fix cmd_buf use-after-free in remove/reset
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Norris <[email protected]>
commit 3c8cb9ad032d737b874e402c59eb51e3c991a144 upstream.
Command buffers (skb's) are allocated by the main driver, and freed upon the last use. That last use is often in mwifiex_free_cmd_buffer(). In the meantime, if the command buffer gets used by the PCI driver, we map it as DMA-able, and store the mapping information in the 'cb' memory.
However, if a command was in-flight when resetting the device (and therefore was still mapped), we don't get a chance to unmap this memory until after the core has cleaned up its command handling.
Let's keep a refcount within the PCI driver, so we ensure the memory only gets freed after we've finished unmapping it.
Noticed by KASAN when forcing a reset via:
echo 1 > /sys/bus/pci/.../reset
The same code path can presumably be exercised in remove() and shutdown().
[ 205.390377] mwifiex_pcie 0000:01:00.0: info: shutdown mwifiex... [ 205.400393] ================================================================== [ 205.407719] BUG: KASAN: use-after-free in mwifiex_unmap_pci_memory.isra.14+0x4c/0x100 [mwifiex_pcie] at addr ffffffc0ad471b28 [ 205.419040] Read of size 16 by task bash/1913 [ 205.423421] ============================================================================= [ 205.431625] BUG skbuff_head_cache (Tainted: G B ): kasan: bad access detected [ 205.439815] ----------------------------------------------------------------------------- [ 205.439815] [ 205.449534] INFO: Allocated in __build_skb+0x48/0x114 age=1311 cpu=4 pid=1913 [ 205.456709] alloc_debug_processing+0x124/0x178 [ 205.461282] ___slab_alloc.constprop.58+0x528/0x608 [ 205.466196] __slab_alloc.isra.54.constprop.57+0x44/0x54 [ 205.471542] kmem_cache_alloc+0xcc/0x278 [ 205.475497] __build_skb+0x48/0x114 [ 205.479019] __netdev_alloc_skb+0xe0/0x170 [ 205.483244] mwifiex_alloc_cmd_buffer+0x68/0xdc [mwifiex] [ 205.488759] mwifiex_init_fw+0x40/0x6cc [mwifiex] [ 205.493584] _mwifiex_fw_dpc+0x158/0x520 [mwifiex] [ 205.498491] mwifiex_reinit_sw+0x2c4/0x398 [mwifiex] [ 205.503510] mwifiex_pcie_reset_notify+0x114/0x15c [mwifiex_pcie] [ 205.509643] pci_reset_notify+0x5c/0x6c [ 205.513519] pci_reset_function+0x6c/0x7c [ 205.517567] reset_store+0x68/0x98 [ 205.521003] dev_attr_store+0x54/0x60 [ 205.524705] sysfs_kf_write+0x9c/0xb0 [ 205.528413] INFO: Freed in __kfree_skb+0xb0/0xbc age=131 cpu=4 pid=1913 [ 205.535064] free_debug_processing+0x264/0x370 [ 205.539550] __slab_free+0x84/0x40c [ 205.543075] kmem_cache_free+0x1c8/0x2a0 [ 205.547030] __kfree_skb+0xb0/0xbc [ 205.550465] consume_skb+0x164/0x178 [ 205.554079] __dev_kfree_skb_any+0x58/0x64 [ 205.558304] mwifiex_free_cmd_buffer+0xa0/0x158 [mwifiex] [ 205.563817] mwifiex_shutdown_drv+0x578/0x5c4 [mwifiex] [ 205.569164] mwifiex_shutdown_sw+0x178/0x310 [mwifiex] [ 205.574353] mwifiex_pcie_reset_notify+0xd4/0x15c [mwifiex_pcie] [ 205.580398] pci_reset_notify+0x5c/0x6c [ 205.584274] pci_dev_save_and_disable+0x24/0x6c [ 205.588837] pci_reset_function+0x30/0x7c [ 205.592885] reset_store+0x68/0x98 [ 205.596324] dev_attr_store+0x54/0x60 [ 205.600017] sysfs_kf_write+0x9c/0xb0 ... [ 205.800488] Call trace: [ 205.802980] [<ffffffc00020a69c>] dump_backtrace+0x0/0x190 [ 205.808415] [<ffffffc00020a96c>] show_stack+0x20/0x28 [ 205.813506] [<ffffffc0005d020c>] dump_stack+0xa4/0xcc [ 205.818598] [<ffffffc0003be44c>] print_trailer+0x158/0x168 [ 205.824120] [<ffffffc0003be5f0>] object_err+0x4c/0x5c [ 205.829210] [<ffffffc0003c45bc>] kasan_report+0x334/0x500 [ 205.834641] [<ffffffc0003c3994>] check_memory_region+0x20/0x14c [ 205.840593] [<ffffffc0003c3b14>] __asan_loadN+0x14/0x1c [ 205.845879] [<ffffffbffc46171c>] mwifiex_unmap_pci_memory.isra.14+0x4c/0x100 [mwifiex_pcie] [ 205.854282] [<ffffffbffc461864>] mwifiex_pcie_delete_cmdrsp_buf+0x94/0xa8 [mwifiex_pcie] [ 205.862421] [<ffffffbffc462028>] mwifiex_pcie_free_buffers+0x11c/0x158 [mwifiex_pcie] [ 205.870302] [<ffffffbffc4620d4>] mwifiex_pcie_down_dev+0x70/0x80 [mwifiex_pcie] [ 205.877736] [<ffffffbffc1397a8>] mwifiex_shutdown_sw+0x190/0x310 [mwifiex] [ 205.884658] [<ffffffbffc4606b4>] mwifiex_pcie_reset_notify+0xd4/0x15c [mwifiex_pcie] [ 205.892446] [<ffffffc000635f54>] pci_reset_notify+0x5c/0x6c [ 205.898048] [<ffffffc00063a044>] pci_dev_save_and_disable+0x24/0x6c [ 205.904350] [<ffffffc00063cf0c>] pci_reset_function+0x30/0x7c [ 205.910134] [<ffffffc000641118>] reset_store+0x68/0x98 [ 205.915312] [<ffffffc000771588>] dev_attr_store+0x54/0x60 [ 205.920750] [<ffffffc00046f53c>] sysfs_kf_write+0x9c/0xb0 [ 205.926182] [<ffffffc00046dfb0>] kernfs_fop_write+0x184/0x1f8 [ 205.931963] [<ffffffc0003d64f4>] __vfs_write+0x6c/0x17c [ 205.937221] [<ffffffc0003d7164>] vfs_write+0xf0/0x1c4 [ 205.942310] [<ffffffc0003d7da0>] SyS_write+0x78/0xd8 [ 205.947312] [<ffffffc000204634>] el0_svc_naked+0x24/0x28 ... [ 205.998268] ==================================================================
This bug has been around in different forms for a while. It was sort of noticed in commit 955ab095c51a ("mwifiex: Do not kfree cmd buf while unregistering PCIe"), but it just fixed the double-free, without acknowledging the potential for use-after-free.
--- drivers/net/wireless/marvell/mwifiex/pcie.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/net/wireless/marvell/mwifiex/pcie.c +7 -0
@@ -1039,6 +1039,7 @@ static int mwifiex_pcie_delete_cmdrsp_buif (card && card->cmd_buf) {mwifiex_unmap_pci_memory (adapter, card->cmd_buf,PCI_DMA_TODEVICE ); +dev_kfree_skb_any (card->cmd_buf); }return 0 ; }
@@ -1608,6 +1609,11 @@ mwifiex_pcie_send_cmd(struct mwifiex_adareturn -1 ; card->cmd_buf = skb; +/* +* Need to keep a reference, since core driver might free up this +* buffer before we've unmapped it. +*/ +skb_get (skb);/* To send a command, the driver will: 1. Write the 64bit physical address of the data buffer to
@@ -1711,6 +1717,7 @@ static int mwifiex_pcie_process_cmd_compif (card->cmd_buf) {mwifiex_unmap_pci_memory (adapter, card->cmd_buf,PCI_DMA_TODEVICE ); +dev_kfree_skb_any (card->cmd_buf); card->cmd_buf =NULL ; }
Greg Kroah-Hartman
maintainerPATCH 44/197 x86: fix 32-bit case of __get_user_asm_u64()
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Torvalds <[email protected]>
commit 33c9e9729033387ef0521324c62e7eba529294af upstream.
The code to fetch a 64-bit value from user space was entirely buggered, and has been since the code was merged in early 2016 in commit b2f680380ddf ("x86/mm/32: Add support for 64-bit __get_user() on 32-bit kernels").
Happily the buggered routine is almost certainly entirely unused, since the normal way to access user space memory is just with the non-inlined "get_user()", and the inlined version didn't even historically exist.
The normal "get_user()" case is handled by external hand-written asm in arch/x86/lib/getuser.S that doesn't have either of these issues.
There were two independent bugs in __get_user_asm_u64():
- it still did the STAC/CLAC user space access marking, even though that is now done by the wrapper macros, see commit 11f1a4b9755f ("x86: reorganize SMAP handling in user space accesses").
This didn't result in a semantic error, it just means that the inlined optimized version was hugely less efficient than the allegedly slower standard version, since the CLAC/STAC overhead is quite high on modern Intel CPU's.
- the double register %eax/%edx was marked as an output, but the %eax part of it was touched early in the asm, and could thus clobber other inputs to the asm that gcc didn't expect it to touch.
In particular, that meant that the generated code could look like this:
mov (%eax),%eax
mov 0x4(%eax),%edxwhere the load of %edx obviously was _supposed_ to be from the 32-bit word that followed the source of %eax, but because %eax was overwritten by the first instruction, the source of %edx was basically random garbage.
The fixes are trivial: remove the extraneous STAC/CLAC entries, and mark the 64-bit output as early-clobber to let gcc know that no inputs should alias with the output register.
--- arch/x86/include/asm/uaccess.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/x86/include/asm/uaccess.h +3 -3
@@ -324,10 +324,10 @@ do { \#define __get_user_asm_u64 (x, ptr, retval, errret) \ ({ \ __typeof__(ptr) __ptr = (ptr); \ - asm volatile(ASM_STAC "\n" \ + asm volatile("\n" \ "1: movl %2,%%eax\n" \ "2: movl %3,%%edx\n" \ - "3: " ASM_CLAC "\n" \ + "3:\n" \ ".section .fixup,\"ax\"\n" \ "4: mov %4,%0\n" \ " xorl %%eax,%%eax\n" \
@@ -336,7 +336,7 @@ do { \".previous\n" \ _ASM_EXTABLE(1b, 4b) \_ASM_EXTABLE (2b ,4b ) \ - : "=r" (retval), "=A"(x) \ + : "=r" (retval), "=&A"(x) \: " m" (__m(__ptr)), " m" __m(((u32 *)(__ptr)) + 1), \ "i" (errret), "0" (retval)); \ })
Re: [PATCH 4.11 044/197] x86: fix 32-bit case of __get_user_asm_u64()
Quoted 1 line · Greg Kroah-Hartman
4.11-stable review patch. If anyone has any objections, please let me know.
No objections, but I do want to note that I verified with a "allyesconfig" build on i386 that this code actually never triggers at least in current -git. I might have screwed something up, but I added a "fsin" instruction to that inline asm, and then verified that "objdump" didn't find any fsin instructions in any object files after the build.
There are people who do 64-bit reads from user space, but they all seem to happily use "get_user()" that gets it right, not the "__get_user()" helper that did not.
So it's still worth putting in stable (just in case of future or external users), but at least it doesn't seem to be a potential security issue (which it might have been - with the right unlucky code generation you could make the 64-bit load basically be a pointer following thing).
Linus
Greg Kroah-Hartman
maintainerPATCH 45/197 regulator: rk808: Fix RK818 LDO2
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wadim Egorov <[email protected]>
commit 75f88115391156b3f0fecbbae76bf870c89bcab8 upstream.
Set the correct voltage select register for LDO2.
--- drivers/regulator/rk808-regulator.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/regulator/rk808-regulator.c +1 -1
@@ -519,7 +519,7 @@ static const struct regulator_desc rk818 RK818_LDO1_ON_VSEL_REG, RK818_LDO_VSEL_MASK, RK818_LDO_EN_REG, BIT(0), 400),RK8XX_DESC (RK818_ID_LDO2 ,"LDO_REG2" ,"vcc6" ,1800 ,3400 ,100 , -RK818_LDO1_ON_VSEL_REG ,RK818_LDO_VSEL_MASK ,RK818_LDO_EN_REG , +RK818_LDO2_ON_VSEL_REG ,RK818_LDO_VSEL_MASK ,RK818_LDO_EN_REG , BIT(1), 400), { .name = "LDO_REG3",
Greg Kroah-Hartman
maintainerPATCH 46/197 regulator: tps65023: Fix inverted core enable logic.
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Cochran <[email protected]>
commit c90722b54a4f5e21ac59301ed9a6dbaa439bdb16 upstream.
Commit 43530b69d758328d3ffe6ab98fd640463e8e3667 ("regulator: Use regmap_read/write(), regmap_update_bits functions directly") intended to replace working inline helper functions with standard regmap calls. However, it also inverted the set/clear logic of the "CORE ADJ Allowed" bit. That patch was clearly never tested, since without that bit cleared, the core VDCDC1 voltage output does not react to I2C configuration changes.
This patch fixes the issue by clearing the bit as in the original, correct implementation. Note for stable back porting that, due to subsequent driver churn, this patch will not apply on every kernel version.
--- drivers/regulator/tps65023-regulator.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/regulator/tps65023-regulator.c +1 -2
@@ -311,8 +311,7 @@ static int tps_65023_probe(struct i2c_cl/* Enable setting output voltage by I2C */ regmap_update_bits (tps->regmap,TPS65023_REG_CON_CTRL2 , -TPS65023_REG_CTRL2_CORE_ADJ , -TPS65023_REG_CTRL2_CORE_ADJ ); +TPS65023_REG_CTRL2_CORE_ADJ ,0 );return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 47/197 s390/kdump: Add final note
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Holzheu <[email protected]>
commit dcc00b79fc3d076832f7240de8870f492629b171 upstream.
Since linux v3.14 with commit 38dfac843cb6d7be1 ("vmcore: prevent PT_NOTE p_memsz overflow during header update") on s390 we get the following message in the kdump kernel:
Warning: Exceeded p_memsz, dropping PT_NOTE entry n_namesz=0x6b6b6b6b, n_descsz=0x6b6b6b6b
The reason for this is that we don't create a final zero note in the ELF header which the proc/vmcore code uses to find out the end of the notes section (see also kernel/kexec_core.c:final_note()).
It still worked on s390 by chance because we (most of the time?) have the byte pattern 0x6b6b6b6b after the notes section which also makes the notes parsing code stop in update_note_header_size_elf64() because 0x6b6b6b6b is interpreded as note size:
if ((real_sz + sz) > max_sz) {
pr_warn("Warning: Exceeded p_memsz, dropping P ...);
break;
}So fix this and add the missing final note to the ELF header. We don't have to adjust the memory size for ELF header ("alloc_size") because the new ELF note still fits into the 0x1000 base memory.
--- arch/s390/kernel/crash_dump.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
arch/s390/kernel/crash_dump.c +15 -0
@@ -429,6 +429,20 @@ static void *nt_vmcoreinfo(void *ptr) }/* +* Initialize final note (needed for /proc/vmcore code) +*/ +static void *nt_final (void *ptr) +{ +Elf64_Nhdr *note; + + note = (Elf64_Nhdr *) ptr; + note->n_namesz =0 ; + note->n_descsz =0 ; + note->n_type =0 ; +return PTR_ADD (ptr,sizeof (Elf64_Nhdr)); +} + +/* * Initialize ELF header (new kernel) */ static void *ehdr_init (Elf64_Ehdr *ehdr,int mem_chunk_cnt)
@@ -515,6 +529,7 @@ static void *notes_init(Elf64_Phdr *phdrif (sa->prefix !=0 ) ptr =fill_cpu_elf_notes (ptr, cpu++, sa); ptr =nt_vmcoreinfo (ptr); + ptr =nt_final (ptr);memset (phdr,0 ,sizeof (*phdr)); phdr->p_type =PT_NOTE ; phdr->p_offset = notes_offset;
Greg Kroah-Hartman
maintainerPATCH 48/197 s390/cputime: fix incorrect system time
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Schwidefsky <[email protected]>
commit 07a63cbe8bcb6ba72fb989dcab1ec55ec6c36c7e upstream.
git commit c5328901aa1db134 "[S390] entry[64].S improvements" removed the update of the exit_timer lowcore field from the critical section cleanup of the .Lsysc_restore/.Lsysc_done and .Lio_restore/.Lio_done blocks. If the PSW is updated by the critical section cleanup to point to user space again, the interrupt entry code will do a vtime calculation after the cleanup completed with an exit_timer value which has *not* been updated. Due to this incorrect system time deltas are calculated.
If an interrupt occured with an old PSW between .Lsysc_restore/.Lsysc_done or .Lio_restore/.Lio_done update __LC_EXIT_TIMER with the system entry time of the interrupt.
--- arch/s390/kernel/entry.S | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-)
arch/s390/kernel/entry.S +18 -3
@@ -314,6 +314,7 @@ ENTRY(system_call) lg %r14,__LC_VDSO_PER_CPU lmg %r0,%r10,__PT_R0(%r11) mvc __LC_RETURN_PSW(16),__PT_PSW(%r11) +.Lsysc_exit_timer: stpt __LC_EXIT_TIMER mvc __VDSO_ECTG_BASE(16,%r14),__LC_EXIT_TIMER lmg %r11,%r15,__PT_R11(%r11)
@@ -601,6 +602,7 @@ ENTRY(io_int_handler) lg %r14,__LC_VDSO_PER_CPU lmg %r0,%r10,__PT_R0(%r11) mvc __LC_RETURN_PSW(16),__PT_PSW(%r11) +.Lio_exit_timer: stpt __LC_EXIT_TIMER mvc __VDSO_ECTG_BASE(16,%r14),__LC_EXIT_TIMER lmg %r11,%r15,__PT_R11(%r11)
@@ -1124,15 +1126,23 @@ cleanup_critical: br %r14 .Lcleanup_sysc_restore: + # check if stpt has been executed clg %r9,BASED(.Lcleanup_sysc_restore_insn) + jh 0f + mvc __LC_EXIT_TIMER(8),__LC_ASYNC_ENTER_TIMER + cghi %r11,__LC_SAVE_AREA_ASYNC je 0f + mvc __LC_EXIT_TIMER(8),__LC_MCCK_ENTER_TIMER +0: clg %r9,BASED(.Lcleanup_sysc_restore_insn+8) + je 1f lg %r9,24(%r11) # get saved pointer to pt_regs mvc __LC_RETURN_PSW(16),__PT_PSW(%r9) mvc 0(64,%r11),__PT_R8(%r9) lmg %r0,%r7,__PT_R0(%r9) -0: lmg %r8,%r9,__LC_RETURN_PSW +1: lmg %r8,%r9,__LC_RETURN_PSW br %r14 .Lcleanup_sysc_restore_insn: + .quad .Lsysc_exit_timer .quad .Lsysc_done - 4 .Lcleanup_io_tif:
@@ -1140,15 +1150,20 @@ cleanup_critical: br %r14 .Lcleanup_io_restore: + # check if stpt has been executed clg %r9,BASED(.Lcleanup_io_restore_insn) - je 0f + jh 0f + mvc __LC_EXIT_TIMER(8),__LC_MCCK_ENTER_TIMER +0: clg %r9,BASED(.Lcleanup_io_restore_insn+8) + je 1f lg %r9,24(%r11) # get saved r11 pointer to pt_regs mvc __LC_RETURN_PSW(16),__PT_PSW(%r9) mvc 0(64,%r11),__PT_R8(%r9) lmg %r0,%r7,__PT_R0(%r9) -0: lmg %r8,%r9,__LC_RETURN_PSW +1: lmg %r8,%r9,__LC_RETURN_PSW br %r14 .Lcleanup_io_restore_insn: + .quad .Lio_exit_timer .quad .Lio_done - 4 .Lcleanup_idle:
Greg Kroah-Hartman
maintainerPATCH 49/197 ath9k_htc: Add support of AirTies 1eda:2315 AR9271 device
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Tunin <[email protected]>
commit 16ff1fb0e32f76a5d285a6f23b82d21aa52813c6 upstream.
T: Bus=01 Lev=02 Prnt=02 Port=02 Cnt=01 Dev#= 7 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ff(vend.) Sub=ff Prot=ff MxPS=64 #Cfgs= 1 P: Vendor=1eda ProdID=2315 Rev=01.08 S: Manufacturer=ATHEROS S: Product=USB2.0 WLAN S: SerialNumber=12345 C: #Ifs= 1 Cfg#= 1 Atr=80 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 6 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none)
--- drivers/net/wireless/ath/ath9k/hif_usb.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/ath/ath9k/hif_usb.c +1 -0
@@ -37,6 +37,7 @@ static struct usb_device_id ath9k_hif_us { USB_DEVICE(0x0cf3, 0xb002) }, /* Ubiquiti WifiStation */ { USB_DEVICE(0x057c, 0x8403) }, /* AVM FRITZ!WLAN 11N v2 USB */ { USB_DEVICE(0x0471, 0x209e) }, /* Philips (or NXP) PTA01 */ + { USB_DEVICE(0x1eda, 0x2315) }, /* AirTies */ { USB_DEVICE(0x0cf3, 0x7015), .driver_info = AR9287_USB }, /* Atheros */
Greg Kroah-Hartman
maintainerPATCH 50/197 ath9k_htc: fix NULL-deref at probe
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit ebeb36670ecac36c179b5fb5d5c88ff03ba191ec upstream.
Make sure to check the number of endpoints to avoid dereferencing a NULL-pointer or accessing memory beyond the endpoint array should a malicious device lack the expected endpoints.
--- drivers/net/wireless/ath/ath9k/hif_usb.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/wireless/ath/ath9k/hif_usb.c +3 -0
@@ -1220,6 +1220,9 @@ static int send_eject_command(struct usbu8 bulk_out_ep;int r; +if (iface_desc->desc.bNumEndpoints <2 ) +return -ENODEV ; +/* Find bulk out endpoint */ for (r =1 ; r >=0 ; r--) { endpoint = &iface_desc->endpoint[r].desc;
Greg Kroah-Hartman
maintainerPATCH 51/197 drm/amdgpu: Make display watermark calculations more accurate
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Kleiner <[email protected]>
commit d63c277dc672e0c568481af043359420fa9d4736 upstream.
Avoid big roundoff errors in scanline/hactive durations for high pixel clocks, especially for >= 500 Mhz, and thereby program more accurate display fifo watermarks.
Implemented here for DCE 6,8,10,11. Successfully tested on DCE 10 with AMD R9 380 Tonga.
--- drivers/gpu/drm/amd/amdgpu/dce_v10_0.c | 10 +++++----- drivers/gpu/drm/amd/amdgpu/dce_v11_0.c | 10 +++++----- drivers/gpu/drm/amd/amdgpu/dce_v6_0.c | 10 +++++----- drivers/gpu/drm/amd/amdgpu/dce_v8_0.c | 10 +++++----- 4 files changed, 20 insertions(+), 20 deletions(-)
drivers/gpu/drm/amd/amdgpu/dce_v10_0.c +5 -5
@@ -1214,14 +1214,14 @@ static void dce_v10_0_program_watermarks {struct drm_display_mode *mode = &amdgpu_crtc->base.mode;struct dce10_wm_params wm_low, wm_high; -u32 pixel_period; +u32 active_time;u32 line_time =0 ;u32 latency_watermark_a =0 , latency_watermark_b =0 ;u32 tmp, wm_mask, lb_vblank_lead_lines =0 ;if (amdgpu_crtc->base.enabled && num_heads && mode) { - pixel_period =1000000 / (u32 )mode->clock; - line_time =min ((u32 )mode->crtc_htotal * pixel_period, (u32 )65535 ); + active_time =1000000UL * (u32 )mode->crtc_hdisplay / (u32 )mode->clock; + line_time =min ((u32) (1000000UL * (u32 )mode->crtc_htotal / (u32 )mode->clock), (u32 )65535 );/* watermark for high clocks */ if (adev->pm.dpm_enabled) {
@@ -1236,7 +1236,7 @@ static void dce_v10_0_program_watermarks wm_high.disp_clk = mode->clock; wm_high.src_width = mode->crtc_hdisplay; - wm_high.active_time = mode->crtc_hdisplay * pixel_period; + wm_high.active_time = active_time; wm_high.blank_time = line_time - wm_high.active_time; wm_high.interlaced = false;if (mode->flags &DRM_MODE_FLAG_INTERLACE )
@@ -1275,7 +1275,7 @@ static void dce_v10_0_program_watermarks wm_low.disp_clk = mode->clock; wm_low.src_width = mode->crtc_hdisplay; - wm_low.active_time = mode->crtc_hdisplay * pixel_period; + wm_low.active_time = active_time; wm_low.blank_time = line_time - wm_low.active_time; wm_low.interlaced = false;if (mode->flags &DRM_MODE_FLAG_INTERLACE )
drivers/gpu/drm/amd/amdgpu/dce_v11_0.c +5 -5
@@ -1183,14 +1183,14 @@ static void dce_v11_0_program_watermarks {struct drm_display_mode *mode = &amdgpu_crtc->base.mode;struct dce10_wm_params wm_low, wm_high; -u32 pixel_period; +u32 active_time;u32 line_time =0 ;u32 latency_watermark_a =0 , latency_watermark_b =0 ;u32 tmp, wm_mask, lb_vblank_lead_lines =0 ;if (amdgpu_crtc->base.enabled && num_heads && mode) { - pixel_period =1000000 / (u32 )mode->clock; - line_time =min ((u32 )mode->crtc_htotal * pixel_period, (u32 )65535 ); + active_time =1000000UL * (u32 )mode->crtc_hdisplay / (u32 )mode->clock; + line_time =min ((u32) (1000000UL * (u32 )mode->crtc_htotal / (u32 )mode->clock), (u32 )65535 );/* watermark for high clocks */ if (adev->pm.dpm_enabled) {
@@ -1205,7 +1205,7 @@ static void dce_v11_0_program_watermarks wm_high.disp_clk = mode->clock; wm_high.src_width = mode->crtc_hdisplay; - wm_high.active_time = mode->crtc_hdisplay * pixel_period; + wm_high.active_time = active_time; wm_high.blank_time = line_time - wm_high.active_time; wm_high.interlaced = false;if (mode->flags &DRM_MODE_FLAG_INTERLACE )
@@ -1244,7 +1244,7 @@ static void dce_v11_0_program_watermarks wm_low.disp_clk = mode->clock; wm_low.src_width = mode->crtc_hdisplay; - wm_low.active_time = mode->crtc_hdisplay * pixel_period; + wm_low.active_time = active_time; wm_low.blank_time = line_time - wm_low.active_time; wm_low.interlaced = false;if (mode->flags &DRM_MODE_FLAG_INTERLACE )
drivers/gpu/drm/amd/amdgpu/dce_v6_0.c +5 -5
@@ -986,7 +986,7 @@ static void dce_v6_0_program_watermarks(struct drm_display_mode *mode = &amdgpu_crtc->base.mode;struct dce6_wm_params wm_low, wm_high;u32 dram_channels; -u32 pixel_period; +u32 active_time;u32 line_time =0 ;u32 latency_watermark_a =0 , latency_watermark_b =0 ;u32 priority_a_mark =0 , priority_b_mark =0 ;
@@ -996,8 +996,8 @@ static void dce_v6_0_program_watermarks(fixed20_12 a, b, c;if (amdgpu_crtc->base.enabled && num_heads && mode) { - pixel_period =1000000 / (u32 )mode->clock; - line_time =min ((u32 )mode->crtc_htotal * pixel_period, (u32 )65535 ); + active_time =1000000UL * (u32 )mode->crtc_hdisplay / (u32 )mode->clock; + line_time =min ((u32) (1000000UL * (u32 )mode->crtc_htotal / (u32 )mode->clock), (u32 )65535 ); priority_a_cnt =0 ; priority_b_cnt =0 ;
@@ -1016,7 +1016,7 @@ static void dce_v6_0_program_watermarks( wm_high.disp_clk = mode->clock; wm_high.src_width = mode->crtc_hdisplay; - wm_high.active_time = mode->crtc_hdisplay * pixel_period; + wm_high.active_time = active_time; wm_high.blank_time = line_time - wm_high.active_time; wm_high.interlaced = false;if (mode->flags &DRM_MODE_FLAG_INTERLACE )
@@ -1043,7 +1043,7 @@ static void dce_v6_0_program_watermarks( wm_low.disp_clk = mode->clock; wm_low.src_width = mode->crtc_hdisplay; - wm_low.active_time = mode->crtc_hdisplay * pixel_period; + wm_low.active_time = active_time; wm_low.blank_time = line_time - wm_low.active_time; wm_low.interlaced = false;if (mode->flags &DRM_MODE_FLAG_INTERLACE )
drivers/gpu/drm/amd/amdgpu/dce_v8_0.c +5 -5
@@ -1098,14 +1098,14 @@ static void dce_v8_0_program_watermarks( {struct drm_display_mode *mode = &amdgpu_crtc->base.mode;struct dce8_wm_params wm_low, wm_high; -u32 pixel_period; +u32 active_time;u32 line_time =0 ;u32 latency_watermark_a =0 , latency_watermark_b =0 ;u32 tmp, wm_mask, lb_vblank_lead_lines =0 ;if (amdgpu_crtc->base.enabled && num_heads && mode) { - pixel_period =1000000 / (u32 )mode->clock; - line_time =min ((u32 )mode->crtc_htotal * pixel_period, (u32 )65535 ); + active_time =1000000UL * (u32 )mode->crtc_hdisplay / (u32 )mode->clock; + line_time =min ((u32) (1000000UL * (u32 )mode->crtc_htotal / (u32 )mode->clock), (u32 )65535 );/* watermark for high clocks */ if (adev->pm.dpm_enabled) {
@@ -1120,7 +1120,7 @@ static void dce_v8_0_program_watermarks( wm_high.disp_clk = mode->clock; wm_high.src_width = mode->crtc_hdisplay; - wm_high.active_time = mode->crtc_hdisplay * pixel_period; + wm_high.active_time = active_time; wm_high.blank_time = line_time - wm_high.active_time; wm_high.interlaced = false;if (mode->flags &DRM_MODE_FLAG_INTERLACE )
@@ -1159,7 +1159,7 @@ static void dce_v8_0_program_watermarks( wm_low.disp_clk = mode->clock; wm_low.src_width = mode->crtc_hdisplay; - wm_low.active_time = mode->crtc_hdisplay * pixel_period; + wm_low.active_time = active_time; wm_low.blank_time = line_time - wm_low.active_time; wm_low.interlaced = false;if (mode->flags &DRM_MODE_FLAG_INTERLACE )
Greg Kroah-Hartman
maintainerPATCH 52/197 drm/amdgpu: Avoid overflows/divide-by-zero in latency_watermark calculations.
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Kleiner <[email protected]>
commit e190ed1ea7458e446230de4113cc5d53b8dc4ec8 upstream.
At dot clocks > approx. 250 Mhz, some of these calcs will overflow and cause miscalculation of latency watermarks, and for some overflows also divide-by-zero driver crash ("divide error: 0000 [#1] PREEMPT SMP" in "dce_v10_0_latency_watermark+0x12d/0x190").
This zero-divide happened, e.g., on AMD Tonga Pro under DCE-10, on a Displayport panel when trying to set a video mode of 2560x1440 at 165 Hz vrefresh with a dot clock of 635.540 Mhz.
Refine calculations to avoid the overflows.
Tested for DCE-10 with R9 380 Tonga + ASUS ROG PG279 panel.
--- drivers/gpu/drm/amd/amdgpu/dce_v10_0.c | 19 +++---------------- drivers/gpu/drm/amd/amdgpu/dce_v11_0.c | 19 +++---------------- drivers/gpu/drm/amd/amdgpu/dce_v6_0.c | 19 +++---------------- drivers/gpu/drm/amd/amdgpu/dce_v8_0.c | 19 +++---------------- 4 files changed, 12 insertions(+), 64 deletions(-)
drivers/gpu/drm/amd/amdgpu/dce_v10_0.c +3 -16
@@ -1090,23 +1090,10 @@ static u32 dce_v10_0_latency_watermark(s a.full =dfixed_const (available_bandwidth); b.full =dfixed_const (wm->num_heads); a.full =dfixed_div (a, b); + tmp =div_u64 ((u64 ) dmif_size * (u64 ) wm->disp_clk, mc_latency +512 ); + tmp =min (dfixed_trunc (a), tmp); - b.full =dfixed_const (mc_latency +512 ); - c.full =dfixed_const (wm->disp_clk); - b.full =dfixed_div (b, c); - - c.full =dfixed_const (dmif_size); - b.full =dfixed_div (c, b); - - tmp =min (dfixed_trunc (a),dfixed_trunc (b)); - - b.full =dfixed_const (1000 ); - c.full =dfixed_const (wm->disp_clk); - b.full =dfixed_div (c, b); - c.full =dfixed_const (wm->bytes_per_pixel); - b.full =dfixed_mul (b, c); - - lb_fill_bw =min (tmp,dfixed_trunc (b)); + lb_fill_bw =min (tmp, wm->disp_clk * wm->bytes_per_pixel /1000 ); a.full =dfixed_const (max_src_lines_per_dst_line * wm->src_width * wm->bytes_per_pixel); b.full =dfixed_const (1000 );
drivers/gpu/drm/amd/amdgpu/dce_v11_0.c +3 -16
@@ -1059,23 +1059,10 @@ static u32 dce_v11_0_latency_watermark(s a.full =dfixed_const (available_bandwidth); b.full =dfixed_const (wm->num_heads); a.full =dfixed_div (a, b); + tmp =div_u64 ((u64 ) dmif_size * (u64 ) wm->disp_clk, mc_latency +512 ); + tmp =min (dfixed_trunc (a), tmp); - b.full =dfixed_const (mc_latency +512 ); - c.full =dfixed_const (wm->disp_clk); - b.full =dfixed_div (b, c); - - c.full =dfixed_const (dmif_size); - b.full =dfixed_div (c, b); - - tmp =min (dfixed_trunc (a),dfixed_trunc (b)); - - b.full =dfixed_const (1000 ); - c.full =dfixed_const (wm->disp_clk); - b.full =dfixed_div (c, b); - c.full =dfixed_const (wm->bytes_per_pixel); - b.full =dfixed_mul (b, c); - - lb_fill_bw =min (tmp,dfixed_trunc (b)); + lb_fill_bw =min (tmp, wm->disp_clk * wm->bytes_per_pixel /1000 ); a.full =dfixed_const (max_src_lines_per_dst_line * wm->src_width * wm->bytes_per_pixel); b.full =dfixed_const (1000 );
drivers/gpu/drm/amd/amdgpu/dce_v6_0.c +3 -16
@@ -861,23 +861,10 @@ static u32 dce_v6_0_latency_watermark(st a.full =dfixed_const (available_bandwidth); b.full =dfixed_const (wm->num_heads); a.full =dfixed_div (a, b); + tmp =div_u64 ((u64 ) dmif_size * (u64 ) wm->disp_clk, mc_latency +512 ); + tmp =min (dfixed_trunc (a), tmp); - b.full =dfixed_const (mc_latency +512 ); - c.full =dfixed_const (wm->disp_clk); - b.full =dfixed_div (b, c); - - c.full =dfixed_const (dmif_size); - b.full =dfixed_div (c, b); - - tmp =min (dfixed_trunc (a),dfixed_trunc (b)); - - b.full =dfixed_const (1000 ); - c.full =dfixed_const (wm->disp_clk); - b.full =dfixed_div (c, b); - c.full =dfixed_const (wm->bytes_per_pixel); - b.full =dfixed_mul (b, c); - - lb_fill_bw =min (tmp,dfixed_trunc (b)); + lb_fill_bw =min (tmp, wm->disp_clk * wm->bytes_per_pixel /1000 ); a.full =dfixed_const (max_src_lines_per_dst_line * wm->src_width * wm->bytes_per_pixel); b.full =dfixed_const (1000 );
drivers/gpu/drm/amd/amdgpu/dce_v8_0.c +3 -16
@@ -974,23 +974,10 @@ static u32 dce_v8_0_latency_watermark(st a.full =dfixed_const (available_bandwidth); b.full =dfixed_const (wm->num_heads); a.full =dfixed_div (a, b); + tmp =div_u64 ((u64 ) dmif_size * (u64 ) wm->disp_clk, mc_latency +512 ); + tmp =min (dfixed_trunc (a), tmp); - b.full =dfixed_const (mc_latency +512 ); - c.full =dfixed_const (wm->disp_clk); - b.full =dfixed_div (b, c); - - c.full =dfixed_const (dmif_size); - b.full =dfixed_div (c, b); - - tmp =min (dfixed_trunc (a),dfixed_trunc (b)); - - b.full =dfixed_const (1000 ); - c.full =dfixed_const (wm->disp_clk); - b.full =dfixed_div (c, b); - c.full =dfixed_const (wm->bytes_per_pixel); - b.full =dfixed_mul (b, c); - - lb_fill_bw =min (tmp,dfixed_trunc (b)); + lb_fill_bw =min (tmp, wm->disp_clk * wm->bytes_per_pixel /1000 ); a.full =dfixed_const (max_src_lines_per_dst_line * wm->src_width * wm->bytes_per_pixel); b.full =dfixed_const (1000 );
Greg Kroah-Hartman
maintainerPATCH 53/197 drm/amdgpu: Add missing lb_vblank_lead_lines setup to DCE-6 path.
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Kleiner <[email protected]>
commit effaf848b957fbf72a3b6a1ad87f5e031eda0b75 upstream.
This apparently got lost when implementing the new DCE-6 support and would cause failures in pageflip scheduling and timestamping.
--- drivers/gpu/drm/amd/amdgpu/dce_v6_0.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/dce_v6_0.c +6 -1
@@ -979,7 +979,7 @@ static void dce_v6_0_program_watermarks(u32 priority_a_mark =0 , priority_b_mark =0 ;u32 priority_a_cnt =PRIORITY_OFF ;u32 priority_b_cnt =PRIORITY_OFF ; -u32 tmp, arb_control3; +u32 tmp, arb_control3, lb_vblank_lead_lines =0 ;fixed20_12 a, b, c;if (amdgpu_crtc->base.enabled && num_heads && mode) {
@@ -1091,6 +1091,8 @@ static void dce_v6_0_program_watermarks( c.full =dfixed_div (c, a); priority_b_mark =dfixed_trunc (c); priority_b_cnt |= priority_b_mark &PRIORITY_MARK_MASK ; + + lb_vblank_lead_lines =DIV_ROUND_UP (lb_size, mode->crtc_hdisplay); }/* select wm A */
@@ -1120,6 +1122,9 @@ static void dce_v6_0_program_watermarks(/* save values for DPM */ amdgpu_crtc->line_time = line_time; amdgpu_crtc->wm_high = latency_watermark_a; + +/* Save number of lines the linebuffer leads before the scanout */ + amdgpu_crtc->lb_vblank_lead_lines = lb_vblank_lead_lines; }/* watermark setup */
Greg Kroah-Hartman
maintainerPATCH 54/197 drm/nouveau/therm: remove ineffective workarounds for alarm bugs
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Skeggs <[email protected]>
commit e4311ee51d1e2676001b2d8fcefd92bdd79aad85 upstream.
These were ineffective due to touching the list without the alarm lock, but should no longer be required.
--- drivers/gpu/drm/nouveau/nvkm/subdev/therm/base.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/therm/fan.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/therm/fantog.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/therm/temp.c | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-)
drivers/gpu/drm/nouveau/nvkm/subdev/therm/base.c +1 -1
@@ -146,7 +146,7 @@ nvkm_therm_update(struct nvkm_therm *the poll = false; } -if (list_empty (&therm->alarm.head) && poll) +if (poll)nvkm_timer_alarm (tmr,1000000000ULL , &therm->alarm);spin_unlock_irqrestore (&therm->lock, flags);
drivers/gpu/drm/nouveau/nvkm/subdev/therm/fan.c +1 -1
@@ -83,7 +83,7 @@ nvkm_fan_update(struct nvkm_fan *fan, bospin_unlock_irqrestore (&fan->lock, flags);/* schedule next fan update, if not at target speed already */ -if (list_empty (&fan->alarm.head) && target != duty) { +if (target != duty) {u16 bump_period = fan->bios.bump_period;u16 slow_down_period = fan->bios.slow_down_period;u64 delay;
drivers/gpu/drm/nouveau/nvkm/subdev/therm/fantog.c +1 -1
@@ -53,7 +53,7 @@ nvkm_fantog_update(struct nvkm_fantog *f duty = !nvkm_gpio_get (gpio,0 ,DCB_GPIO_FAN ,0xff );nvkm_gpio_set (gpio,0 ,DCB_GPIO_FAN ,0xff , duty); -if (list_empty (&fan->alarm.head) && percent != (duty *100 )) { +if (percent != (duty *100 )) {u64 next_change = (percent * fan->period_us) /100 ;if (!duty) next_change = fan->period_us - next_change;
drivers/gpu/drm/nouveau/nvkm/subdev/therm/temp.c +1 -1
@@ -185,7 +185,7 @@ alarm_timer_callback(struct nvkm_alarm *spin_unlock_irqrestore (&therm->sensor.alarm_program_lock, flags);/* schedule the next poll in one second */ -if (therm->func->temp_get (therm) >=0 &&list_empty (&alarm->head)) +if (therm->func->temp_get (therm) >=0 )nvkm_timer_alarm (tmr,1000000000ULL , alarm); }
Greg Kroah-Hartman
maintainerPATCH 55/197 drm/nouveau/kms/nv50: fix source-rect-only plane updates
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Skeggs <[email protected]>
commit 36601c2b36e27435d9be33cfa092120ff69914eb upstream.
This "optimisation" (which was originally meant to skip updating cursor settings in the core channel on position-only updates) turned out to be pointless in the final design of the code before it was merged.
Remove it completely, as it breaks other cases.
--- drivers/gpu/drm/nouveau/nv50_display.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-)
drivers/gpu/drm/nouveau/nv50_display.c +3 -5
@@ -906,11 +906,9 @@ nv50_wndw_atomic_check(struct drm_planeif (memcmp (&armw->point, &asyw->point,sizeof (asyw->point))) asyw->set.point = true; -if (!varm || asym || armw->state.fb != asyw->state.fb) { - ret =nv50_wndw_atomic_check_acquire (wndw, asyw, asyh); -if (ret) -return ret; - } + ret =nv50_wndw_atomic_check_acquire (wndw, asyw, asyh); +if (ret) +return ret; }else if (varm) {nv50_wndw_atomic_check_release (wndw, asyw, harm);
Greg Kroah-Hartman
maintainerPATCH 56/197 drm/nouveau/kms/nv50: skip core channel cursor update on position-only changes
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Skeggs <[email protected]>
commit e6db95799b1b870aae15682a6d0898df9e9dfb38 upstream.
The DRM core used to only call prepare_fb/cleanup_fb() when a plane's framebuffer changed, which achieved the desired effect.
It's apparently now up to the driver to decide on its own.
--- drivers/gpu/drm/nouveau/nv50_display.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/gpu/drm/nouveau/nv50_display.c +7 -3
@@ -1113,9 +1113,13 @@ static void nv50_curs_prepare(struct nv50_wndw *wndw, struct nv50_head_atom *asyh, struct nv50_wndw_atom *asyw) { - asyh->curs.handle = nv50_disp(wndw->plane.dev)->mast.base.vram.handle; - asyh->curs.offset = asyw->image.offset; - asyh->set.curs = asyh->curs.visible; + u32 handle = nv50_disp(wndw->plane.dev)->mast.base.vram.handle; +u32 offset = asyw->image.offset; +if (asyh->curs.handle != handle || asyh->curs.offset != offset) { + asyh->curs.handle = handle; + asyh->curs.offset = offset; + asyh->set.curs = asyh->curs.visible; + } } static void
Greg Kroah-Hartman
maintainerPATCH 57/197 drm/nouveau/tmr: ack interrupt before processing alarms
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Skeggs <[email protected]>
commit 3733bd8b407211739e72d051e5f30ad82a52c4bc upstream.
Fixes a race where we can miss an alarm that triggers while we're already processing previous alarms.
--- drivers/gpu/drm/nouveau/nvkm/subdev/timer/nv04.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/nouveau/nvkm/subdev/timer/nv04.c +1 -1
@@ -76,8 +76,8 @@ nv04_timer_intr(struct nvkm_timer *tmr)u32 stat =nvkm_rd32 (device,NV04_PTIMER_INTR_0 );if (stat &0x00000001 ) { -nvkm_timer_alarm_trigger (tmr);nvkm_wr32 (device,NV04_PTIMER_INTR_0 ,0x00000001 ); +nvkm_timer_alarm_trigger (tmr); stat &= ~0x00000001 ; }
Greg Kroah-Hartman
maintainerPATCH 58/197 drm/nouveau/tmr: fix corruption of the pending list when rescheduling an alarm
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Skeggs <[email protected]>
commit 9fc64667ee48c9a25e7dca1a6bcb6906fec5bcc5 upstream.
At least therm/fantog "attempts" to work around this issue, which could lead to corruption of the pending alarm list.
Fix it properly by not updating the timestamp without the lock held, or trying to add an already pending alarm to the pending alarm list....
--- drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-)
drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c +10 -7
@@ -65,14 +65,17 @@ nvkm_timer_alarm(struct nvkm_timer *tmr,struct nvkm_alarm *list;unsigned long flags; - alarm->timestamp =nvkm_timer_read (tmr) + nsec; - -/* append new alarm to list, in soonest-alarm-first order */ +/* Remove alarm from pending list. +* +* This both protects against the corruption of the list, +* and implements alarm rescheduling/cancellation. +*/ spin_lock_irqsave (&tmr->lock, flags); -if (!nsec) { -if (!list_empty (&alarm->head)) -list_del (&alarm->head); - }else { +list_del_init (&alarm->head); + +if (nsec) { +/* Insert into pending list, ordered earliest to latest. */ + alarm->timestamp =nvkm_timer_read (tmr) + nsec;list_for_each_entry (list, &tmr->alarms, head) {if (list->timestamp > alarm->timestamp)break ;
Greg Kroah-Hartman
maintainerPATCH 59/197 drm/nouveau/tmr: avoid processing completed alarms when adding a new one
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Skeggs <[email protected]>
commit 330bdf62fe6a6c5b99a647f7bf7157107c9348b3 upstream.
The idea here was to avoid having to "manually" program the HW if there's a new earliest alarm. This was lazy and bad, as it leads to loads of fun races between inter-related callers (ie. therm).
Turns out, it's not so difficult after all. Go figure ;)
--- drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-)
drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c +13 -3
@@ -80,12 +80,22 @@ nvkm_timer_alarm(struct nvkm_timer *tmr,if (list->timestamp > alarm->timestamp)break ; } +list_add_tail (&alarm->head, &list->head); + +/* Update HW if this is now the earliest alarm. */ + list =list_first_entry (&tmr->alarms,typeof (*list), head); +if (list == alarm) { + tmr->func->alarm_init (tmr, alarm->timestamp); +/* This shouldn't happen if callers aren't stupid. +* +* Worst case scenario is that it'll take roughly +* 4 seconds for the next alarm to trigger. +*/ +WARN_ON (alarm->timestamp <=nvkm_timer_read (tmr)); + } }spin_unlock_irqrestore (&tmr->lock, flags); - -/* process pending alarms */ -nvkm_timer_alarm_trigger (tmr); }void
Greg Kroah-Hartman
maintainerPATCH 60/197 drm/nouveau/tmr: handle races with hw when updating the next alarm time
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Skeggs <[email protected]>
commit 1b0f84380b10ee97f7d2dd191294de9017e94d1d upstream.
If the time to the next alarm is short enough, we could race with HW and end up with an ~4 second delay until it triggers.
Fix this by checking again after we update HW.
--- drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c | 26 ++++++++++++++--------- 1 file changed, 16 insertions(+), 10 deletions(-)
drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c +16 -10
@@ -36,23 +36,29 @@ nvkm_timer_alarm_trigger(struct nvkm_timunsigned long flags;LIST_HEAD (exec); -/* move any due alarms off the pending list */ +/* Process pending alarms. */ spin_lock_irqsave (&tmr->lock, flags);list_for_each_entry_safe (alarm, atemp, &tmr->alarms, head) { -if (alarm->timestamp <=nvkm_timer_read (tmr)) -list_move_tail (&alarm->head, &exec); +/* Have we hit the earliest alarm that hasn't gone off? */ +if (alarm->timestamp >nvkm_timer_read (tmr)) { +/* Schedule it. If we didn't race, we're done. */ + tmr->func->alarm_init (tmr, alarm->timestamp); +if (alarm->timestamp >nvkm_timer_read (tmr)) +break ; + } + +/* Move to completed list. We'll drop the lock before +* executing the callback so it can reschedule itself. +*/ +list_move_tail (&alarm->head, &exec); } -/* reschedule interrupt for next alarm time */ -if (!list_empty (&tmr->alarms)) { - alarm =list_first_entry (&tmr->alarms,typeof (*alarm), head); - tmr->func->alarm_init (tmr, alarm->timestamp); - }else { +/* Shut down interrupt if no more pending alarms. */ +if (list_empty (&tmr->alarms)) tmr->func->alarm_fini (tmr); - }spin_unlock_irqrestore (&tmr->lock, flags); -/* execute any pending alarm handlers */ +/* Execute completed callbacks. */ list_for_each_entry_safe (alarm, atemp, &exec, head) {list_del_init (&alarm->head); alarm->func (alarm);
Greg Kroah-Hartman
maintainerPATCH 61/197 gpio: omap: return error if requested debounce time is not possible
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Rivshin <[email protected]>
commit 83977443938122baeed28dc9f078db3da9855f7c upstream.
omap_gpio_debounce() does not validate that the requested debounce is within a range it can handle. Instead it lets the register value wrap silently, and always returns success.
This can lead to all sorts of unexpected behavior, such as gpio_keys asking for a too-long debounce, but getting a very short debounce in practice.
Fix this by returning -EINVAL if the requested value does not fit into the register field. If there is no debounce clock available at all, return -ENOTSUPP.
--- drivers/gpio/gpio-omap.c | 23 +++++++++++++++++------ 1 file changed, 17 insertions(+), 6 deletions(-)
drivers/gpio/gpio-omap.c +17 -6
@@ -208,9 +208,11 @@ static inline void omap_gpio_dbck_disabl* OMAP's debounce time is in 31us steps * <debounce time> = (GPIO_DEBOUNCINGTIME[7:0].DEBOUNCETIME + 1) x 31 * so we need to convert and round up to the closest unit. +* +* Return: 0 on success, negative error otherwise. */ -static void omap2_set_gpio_debounce (struct gpio_bank *bank,unsigned offset, -unsigned debounce) +static int omap2_set_gpio_debounce (struct gpio_bank *bank,unsigned offset, +unsigned debounce) {void __iomem *reg;u32 val;
@@ -218,11 +220,12 @@ static void omap2_set_gpio_debounce(strubool enable = !!debounce;if (!bank->dbck_flag) -return ; +return -ENOTSUPP ;if (enable) { debounce =DIV_ROUND_UP (debounce,31 ) -1 ; - debounce &=OMAP4_GPIO_DEBOUNCINGTIME_MASK ; +if ((debounce &OMAP4_GPIO_DEBOUNCINGTIME_MASK ) != debounce) +return -EINVAL ; } l =BIT (offset);
@@ -255,6 +258,8 @@ static void omap2_set_gpio_debounce(stru bank->context.debounce = debounce; bank->context.debounce_en = val; } + +return 0 ; }/**
@@ -964,14 +969,20 @@ static int omap_gpio_debounce(struct gpi {struct gpio_bank *bank;unsigned long flags; +int ret; bank =gpiochip_get_data (chip);raw_spin_lock_irqsave (&bank->lock, flags); -omap2_set_gpio_debounce (bank, offset, debounce); + ret =omap2_set_gpio_debounce (bank, offset, debounce);raw_spin_unlock_irqrestore (&bank->lock, flags); -return 0 ; +if (ret) +dev_info (chip->parent, +"Could not set line %u debounce to %u microseconds (%d)" , + offset, debounce, ret); + +return ret; } static int omap_gpio_set_config(struct gpio_chip *chip, unsigned offset,
Greg Kroah-Hartman
maintainerPATCH 62/197 cdc-acm: fix possible invalid access when processing notification
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tobias Herzog <[email protected]>
commit 1bb9914e1730417d530de9ed37e59efdc647146b upstream.
Notifications may only be 8 bytes long. Accessing the 9th and 10th byte of unimplemented/unknown notifications may be insecure. Also check the length of known notifications before accessing anything behind the 8th byte.
--- drivers/usb/class/cdc-acm.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
drivers/usb/class/cdc-acm.c +9 -4
@@ -323,6 +323,12 @@ static void acm_ctrl_irq(struct urb *urbbreak ;case USB_CDC_NOTIFY_SERIAL_STATE : +if (le16_to_cpu (dr->wLength) !=2 ) { +dev_dbg (&acm->control->dev, +"%s - malformed serial state\n" , __func__); +break ; + } + newctrl =get_unaligned_le16 (data);if (!acm->clocal && (acm->ctrlin & ~newctrl &ACM_CTRL_DCD )) {
@@ -359,11 +365,10 @@ static void acm_ctrl_irq(struct urb *urbdefault :dev_dbg (&acm->control->dev, -"%s - unknown notification %d received: index %d " -"len %d data0 %d data1 %d\n" , +"%s - unknown notification %d received: index %d len %d\n" , __func__, - dr->bNotificationType, dr->wIndex, - dr->wLength, data[0 ], data[1 ]); + dr->bNotificationType, dr->wIndex, dr->wLength); +break ; } exit:
Greg Kroah-Hartman
maintainerPATCH 63/197 ohci-pci: add qemu quirk
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gerd Hoffmann <[email protected]>
commit 21a60f6e65181cad64fd66ccc8080d413721ba27 upstream.
On a loaded virtualization host (dozen guests booting at the same time) it may happen that the ohci controller emulation doesn't manage to do timely frame processing, with the result that the io watchdog fires and considers the controller being dead, even though it's only the emulation being unusual slow due to the load peak.
So, add a quirk for qemu and don't use the watchdog in case we figure we are running on emulated ohci. The virtual ohci controller masquerades as apple ohci controller, but we can identify it by subsystem id.
--- drivers/usb/host/ohci-hcd.c | 3 ++- drivers/usb/host/ohci-pci.c | 16 ++++++++++++++++ drivers/usb/host/ohci.h | 1 + 3 files changed, 19 insertions(+), 1 deletion(-)
drivers/usb/host/ohci-hcd.c +2 -1
@@ -231,7 +231,8 @@ static int ohci_urb_enqueue (/* Start up the I/O watchdog timer, if it's not running */ if (!timer_pending (&ohci->io_watchdog) && -list_empty (&ohci->eds_in_use)) { +list_empty (&ohci->eds_in_use) && + !(ohci->flags &OHCI_QUIRK_QEMU )) { ohci->prev_frame_no =ohci_frame_no (ohci);mod_timer (&ohci->io_watchdog, jiffies +IO_WATCHDOG_DELAY );
drivers/usb/host/ohci-pci.c +16 -0
@@ -164,6 +164,15 @@ static int ohci_quirk_amd700(struct usb_return 0 ; } +static int ohci_quirk_qemu (struct usb_hcd *hcd) +{ +struct ohci_hcd *ohci =hcd_to_ohci (hcd); + + ohci->flags |=OHCI_QUIRK_QEMU ; +ohci_dbg (ohci,"enabled qemu quirk\n" ); +return 0 ; +} +/* List of quirks for OHCI */ static const struct pci_device_id ohci_pci_quirks[] = { {
@@ -214,6 +223,13 @@ static const struct pci_device_id ohci_p PCI_DEVICE(PCI_VENDOR_ID_ATI, 0x4399), .driver_data = (unsigned long)ohci_quirk_amd700, }, + { + .vendor = PCI_VENDOR_ID_APPLE, + .device = 0x003f, + .subvendor = PCI_SUBVENDOR_ID_REDHAT_QUMRANET, + .subdevice = PCI_SUBDEVICE_ID_QEMU, + .driver_data = (unsigned long)ohci_quirk_qemu, + },/* FIXME for some of the early AMD 760 southbridges, OHCI * won't work at all. blacklist them.
drivers/usb/host/ohci.h +1 -0
@@ -418,6 +418,7 @@ struct ohci_hcd {#define OHCI_QUIRK_AMD_PLL 0x200/* AMD PLL quirk*/ #define OHCI_QUIRK_AMD_PREFETCH 0x400/* pre-fetch for ISO transfer */ #define OHCI_QUIRK_GLOBAL_SUSPEND 0x800/* must suspend ports */ +#define OHCI_QUIRK_QEMU 0x1000/* relax timing expectations */ // there are also chip quirks/bugs in init logic
Greg Kroah-Hartman
maintainerPATCH 64/197 cxl: Force context lock during EEH flow
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vaibhav Jain <[email protected]>
commit ea9a26d117cf0637c71d3e0076f4a124bf5859df upstream.
During an eeh event when the cxl card is fenced and card sysfs attr perst_reloads_same_image is set following warning message is seen in the kernel logs:
Adapter context unlocked with 0 active contexts
------------[ cut here ]------------ WARNING: CPU: 12 PID: 627 at ../drivers/misc/cxl/main.c:325 cxl_adapter_context_unlock+0x60/0x80 [cxl]
Even though this warning is harmless, it clutters the kernel log during an eeh event. This warning is triggered as the EEH callback cxl_pci_error_detected doesn't obtain a context-lock before forcibly detaching all active context and when context-lock is released during call to cxl_configure_adapter from cxl_pci_slot_reset, a warning in cxl_adapter_context_unlock is triggered.
To fix this warning, we acquire the adapter context-lock via cxl_adapter_context_lock() in the eeh callback cxl_pci_error_detected() once all the virtual AFU PHBs are notified and their contexts detached. The context-lock is released in cxl_pci_slot_reset() after the adapter is successfully reconfigured and before the we call the slot_reset callback on slice attached device-drivers.
--- drivers/misc/cxl/pci.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-)
drivers/misc/cxl/pci.c +17 -2
@@ -1496,8 +1496,6 @@ static int cxl_configure_adapter(structif ((rc =cxl_native_register_psl_err_irq (adapter))) goto err; -/* Release the context lock as adapter is configured */ -cxl_adapter_context_unlock (adapter);return 0 ; err:
@@ -1596,6 +1594,9 @@ static struct cxl *cxl_pci_init_adapter(if ((rc =cxl_sysfs_adapter_add (adapter))) goto err_put1; +/* Release the context lock as adapter is configured */ +cxl_adapter_context_unlock (adapter); +return adapter; err_put1:
@@ -1895,6 +1896,13 @@ static pci_ers_result_t cxl_pci_error_de cxl_ops->afu_deactivate_mode (afu, afu->current_mode);pci_deconfigure_afu (afu); } + +/* should take the context lock here */ +if (cxl_adapter_context_lock (adapter) !=0 ) +dev_warn (&adapter->dev, +"Couldn't take context lock with %d active-contexts\n" , +atomic_read (&adapter->contexts_num)); +cxl_deconfigure_adapter (adapter);return result;
@@ -1913,6 +1921,13 @@ static pci_ers_result_t cxl_pci_slot_resif (cxl_configure_adapter (adapter, pdev)) goto err; +/* +* Unlock context activation for the adapter. Ideally this should be +* done in cxl_pci_resume but cxlflash module tries to activate the +* master context as part of slot_reset callback. +*/ +cxl_adapter_context_unlock (adapter); +for (i =0 ; i < adapter->slices; i++) { afu = adapter->afu[i];
Greg Kroah-Hartman
maintainerPATCH 65/197 cxl: Route eeh events to all drivers in cxl_pci_error_detected()
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vaibhav Jain <[email protected]>
commit 4f58f0bf155e87dda31a3088b1e107fa9dd79f0e upstream.
Fix a boundary condition where in some cases an eeh event that results in card reset isn't passed on to a driver attached to the virtual PCI device associated with a slice. This will happen in case when a slice attached device driver returns a value other than PCI_ERS_RESULT_NEED_RESET from the eeh error_detected() callback. This would result in an early return from cxl_pci_error_detected() and other drivers attached to other AFUs on the card wont be notified.
The patch fixes this by making sure that all slice attached device-drivers are notified and the return values from error_detected() callback are aggregated in a scheme where request for 'disconnect' trumps all and 'none' trumps 'need_reset'.
--- drivers/misc/cxl/pci.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)
drivers/misc/cxl/pci.c +9 -6
@@ -1782,7 +1782,7 @@ static pci_ers_result_t cxl_pci_error_de {struct cxl *adapter =pci_get_drvdata (pdev);struct cxl_afu *afu; -pci_ers_result_t result =PCI_ERS_RESULT_NEED_RESET ; +pci_ers_result_t result =PCI_ERS_RESULT_NEED_RESET , afu_result;int i;/* At this point, we could still have an interrupt pending.
@@ -1886,15 +1886,18 @@ static pci_ers_result_t cxl_pci_error_defor (i =0 ; i < adapter->slices; i++) { afu = adapter->afu[i]; - result =cxl_vphb_error_detected (afu, state); - -/* Only continue if everyone agrees on NEED_RESET */ -if (result !=PCI_ERS_RESULT_NEED_RESET ) -return result; + afu_result =cxl_vphb_error_detected (afu, state);cxl_context_detach_all (afu); cxl_ops->afu_deactivate_mode (afu, afu->current_mode);pci_deconfigure_afu (afu); + +/* Disconnect trumps all, NONE trumps NEED_RESET */ +if (afu_result ==PCI_ERS_RESULT_DISCONNECT ) + result =PCI_ERS_RESULT_DISCONNECT ; +else if ((afu_result ==PCI_ERS_RESULT_NONE ) && + (result ==PCI_ERS_RESULT_NEED_RESET )) + result =PCI_ERS_RESULT_NONE ; }/* should take the context lock here */
Greg Kroah-Hartman
maintainerPATCH 66/197 proc: Fix unbalanced hard link numbers
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit d66bb1607e2d8d384e53f3d93db5c18483c8c4f7 upstream.
proc_create_mount_point() forgot to increase the parent's nlink, and it resulted in unbalanced hard link numbers, e.g. /proc/fs shows one less than expected.
--- fs/proc/generic.c | 1 + 1 file changed, 1 insertion(+)
fs/proc/generic.c +1 -0
@@ -472,6 +472,7 @@ struct proc_dir_entry *proc_create_mount ent->data =NULL ; ent->proc_fops =NULL ; ent->proc_iops =NULL ; + parent->nlink++;if (proc_register (parent, ent) <0 ) {kfree (ent); parent->nlink--;
Greg Kroah-Hartman
maintainerPATCH 67/197 of: fix sparse warning in of_pci_range_parser_one
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Herring <[email protected]>
commit eb3100365791b06242b8bb5c3c2854ba41dabfbc upstream.
sparse gives the following warning for 'pci_space':
../drivers/of/address.c:266:26: warning: incorrect type in assignment (different base types)../drivers/of/address.c:266:26: expected unsigned int [unsigned] [usertype] pci_space../drivers/of/address.c:266:26: got restricted __be32 const [usertype] <noident>
It appears that pci_space is only ever accessed on powerpc, so the endian swap is often not needed.
--- drivers/of/address.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/of/address.c +1 -1
@@ -263,7 +263,7 @@ struct of_pci_range *of_pci_range_parserif (!parser->range || parser->range + parser->np > parser->end)return NULL ; - range->pci_space = parser->range[0 ]; + range->pci_space =be32_to_cpup (parser->range); range->flags =of_bus_pci_get_flags (parser->range); range->pci_addr =of_read_number (parser->range +1 , ns); range->cpu_addr = of_translate_address(parser->node,
Greg Kroah-Hartman
maintainerPATCH 68/197 of: fix "/cpus" reference leak in of_numa_parse_cpu_nodes()
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tyrel Datwyler <[email protected]>
commit b8475cbee5ab2eac05f9cd5dbcc94c453d3cbf10 upstream.
The call to of_find_node_by_path("/cpus") returns the cpus device_node with its reference count incremented. There is no matching of_node_put() call in of_numa_parse_cpu_nodes() which results in a leaked reference to the "/cpus" node.
This patch adds an of_node_put() to release the reference.
--- drivers/of/of_numa.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/of/of_numa.c +2 -0
@@ -57,6 +57,8 @@ static void __init of_numa_parse_cpu_nodelse node_set (nid, numa_nodes_parsed); } + +of_node_put (cpus); }static int __init of_numa_parse_memory_nodes (void )
Greg Kroah-Hartman
maintainerPATCH 69/197 of: fdt: add missing allocation-failure check
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 49e67dd17649b60b4d54966e18ec9c80198227f0 upstream.
The memory allocator passed to __unflatten_device_tree() (e.g. a wrapped kzalloc) can fail so add the missing sanity check to avoid dereferencing a NULL pointer.
--- drivers/of/fdt.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/of/fdt.c +3 -0
@@ -505,6 +505,9 @@ static void *__unflatten_device_tree(con/* Allocate memory for the expanded device tree */ mem =dt_alloc (size +4 , __alignof__(struct device_node )); +if (!mem) +return NULL ; +memset (mem,0 , size); *(__be32 *)(mem + size) =cpu_to_be32 (0xdeadbeef );
Greg Kroah-Hartman
maintainerPATCH 70/197 ibmvscsis: Do not send aborted task response
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryant G. Ly <[email protected]>
commit 25e78531268e9240fc594ce76587601b873d37c9 upstream.
The driver is sending a response to the actual scsi op that was aborted by an abort task TM, while LIO is sending a response to the abort task TM.
ibmvscsis_tgt does not send the response to the client until release_cmd time. The reason for this was because if we did it at queue_status time, then the client would be free to reuse the tag for that command, but we're still using the tag until the command is released at release_cmd time, so we chose to delay sending the response until then. That then caused this issue, because release_cmd is always called, even if queue_status is not.
SCSI spec says that the initiator that sends the abort task TM NEVER gets a response to the aborted op and with the current code it will send a response. Thus this fix will remove that response if the CMD_T_ABORTED && !CMD_T_TAS.
Another case with a small timing window is the case where if LIO sends a TMR_DOES_NOT_EXIST, and the release_cmd callback is called for the TMR Abort cmd before the release_cmd for the (attemped) aborted cmd, then we need to ensure that we send the response for the (attempted) abort cmd to the client before we send the response for the TMR Abort cmd.
--- drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c | 120 +++++++++++++++++++++++-------- drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.h | 2 2 files changed, 94 insertions(+), 28 deletions(-)
drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c +92 -28
@@ -1170,6 +1170,7 @@ static struct ibmvscsis_cmd *ibmvscsis_g cmd =list_first_entry_or_null (&vscsi->free_cmd, struct ibmvscsis_cmd, list);if (cmd) { + cmd->flags &= ~(DELAY_SEND );list_del (&cmd->list); cmd->iue = iue; cmd->type =UNSET_TYPE ;
@@ -1749,45 +1750,79 @@ static void srp_snd_msg_failed(struct scstatic void ibmvscsis_send_messages (struct scsi_info *vscsi) {u64 msg_hi =0 ; -/* note do not attmempt to access the IU_data_ptr with this pointer +/* note do not attempt to access the IU_data_ptr with this pointer * it is not valid */ struct viosrp_crq *crq = (struct viosrp_crq *)&msg_hi;struct ibmvscsis_cmd *cmd, *nxt;struct iu_entry *iue;long rc =ADAPT_SUCCESS ; +bool retry = false;if (!(vscsi->flags &RESPONSE_Q_DOWN )) { -list_for_each_entry_safe (cmd, nxt, &vscsi->waiting_rsp, list) { - iue = cmd->iue; - - crq->valid =VALID_CMD_RESP_EL ; - crq->format = cmd->rsp.format; - -if (cmd->flags &CMD_FAST_FAIL ) - crq->status =VIOSRP_ADAPTER_FAIL ; - - crq->IU_length =cpu_to_be16 (cmd->rsp.len); +do { + retry = false; +list_for_each_entry_safe (cmd, nxt, &vscsi->waiting_rsp, + list) { +/* +* Check to make sure abort cmd gets processed +* prior to the abort tmr cmd +*/ +if (cmd->flags &DELAY_SEND ) +continue ; - rc =h_send_crq (vscsi->dma_dev->unit_address, -be64_to_cpu (msg_hi), -be64_to_cpu (cmd->rsp.tag)); +if (cmd->abort_cmd) { + retry = true; + cmd->abort_cmd->flags &= ~(DELAY_SEND ); + } -pr_debug ("send_messages: cmd %p, tag 0x%llx, rc %ld\n" , - cmd,be64_to_cpu (cmd->rsp.tag), rc); +/* +* If CMD_T_ABORTED w/o CMD_T_TAS scenarios and +* the case where LIO issued a +* ABORT_TASK: Sending TMR_TASK_DOES_NOT_EXIST +* case then we dont send a response, since it +* was already done. +*/ +if (cmd->se_cmd.transport_state &CMD_T_ABORTED && + !(cmd->se_cmd.transport_state &CMD_T_TAS )) { +list_del (&cmd->list); +ibmvscsis_free_cmd_resources (vscsi, + cmd); + }else { + iue = cmd->iue; + + crq->valid =VALID_CMD_RESP_EL ; + crq->format = cmd->rsp.format; + +if (cmd->flags &CMD_FAST_FAIL ) + crq->status =VIOSRP_ADAPTER_FAIL ; + + crq->IU_length =cpu_to_be16 (cmd->rsp.len); + + rc =h_send_crq (vscsi->dma_dev->unit_address, +be64_to_cpu (msg_hi), +be64_to_cpu (cmd->rsp.tag)); -/* if all ok free up the command element resources */ -if (rc ==H_SUCCESS ) { -/* some movement has occurred */ - vscsi->rsp_q_timer.timer_pops =0 ; -list_del (&cmd->list); +pr_debug ("send_messages: cmd %p, tag 0x%llx, rc %ld\n" , + cmd,be64_to_cpu (cmd->rsp.tag), rc); -ibmvscsis_free_cmd_resources (vscsi, cmd); - }else { -srp_snd_msg_failed (vscsi, rc); -break ; +/* if all ok free up the command +* element resources +*/ +if (rc ==H_SUCCESS ) { +/* some movement has occurred */ + vscsi->rsp_q_timer.timer_pops =0 ; +list_del (&cmd->list); + +ibmvscsis_free_cmd_resources (vscsi, + cmd); + }else { +srp_snd_msg_failed (vscsi, rc); +break ; + } + } } - } + }while (retry);if (!rc) {/*
@@ -2708,6 +2743,7 @@ static int ibmvscsis_alloc_cmds(struct sfor (i =0 , cmd = (struct ibmvscsis_cmd *)vscsi->cmd_pool; i < num; i++, cmd++) { + cmd->abort_cmd =NULL ; cmd->adapter = vscsi;INIT_WORK (&cmd->work, ibmvscsis_scheduler);list_add_tail (&cmd->list, &vscsi->free_cmd);
@@ -3579,9 +3615,20 @@ static int ibmvscsis_write_pending(struc { struct ibmvscsis_cmd *cmd = container_of(se_cmd, struct ibmvscsis_cmd, se_cmd); +struct scsi_info *vscsi = cmd->adapter;struct iu_entry *iue = cmd->iue;int rc; +/* +* If CLIENT_FAILED OR RESPONSE_Q_DOWN, then just return success +* since LIO can't do anything about it, and we dont want to +* attempt an srp_transfer_data. +*/ +if ((vscsi->flags & (CLIENT_FAILED |RESPONSE_Q_DOWN ))) { +pr_err ("write_pending failed since: %d\n" , vscsi->flags); +return 0 ; + } + rc =srp_transfer_data (cmd, &vio_iu (iue)->srp.cmd, ibmvscsis_rdma,1 ,1 );if (rc) {
@@ -3660,11 +3707,28 @@ static void ibmvscsis_queue_tm_rsp(struc struct ibmvscsis_cmd *cmd = container_of(se_cmd, struct ibmvscsis_cmd, se_cmd);struct scsi_info *vscsi = cmd->adapter; +struct ibmvscsis_cmd *cmd_itr; +struct iu_entry *iue = iue = cmd->iue; +struct srp_tsk_mgmt *srp_tsk = &vio_iu (iue)->srp.tsk_mgmt; +u64 tag_to_abort =be64_to_cpu (srp_tsk->task_tag);uint len;pr_debug ("queue_tm_rsp %p, status %d\n" , se_cmd, (int )se_cmd->se_tmr_req->response); +if (srp_tsk->tsk_mgmt_func ==SRP_TSK_ABORT_TASK && + cmd->se_cmd.se_tmr_req->response ==TMR_TASK_DOES_NOT_EXIST ) { +spin_lock_bh (&vscsi->intr_lock); +list_for_each_entry (cmd_itr, &vscsi->active_q, list) { +if (tag_to_abort == cmd_itr->se_cmd.tag) { + cmd_itr->abort_cmd = cmd; + cmd->flags |=DELAY_SEND ; +break ; + } + } +spin_unlock_bh (&vscsi->intr_lock); + } +srp_build_response (vscsi, cmd, &len); cmd->rsp.format =SRP_FORMAT ; cmd->rsp.len = len;
@@ -3672,8 +3736,8 @@ static void ibmvscsis_queue_tm_rsp(strucstatic void ibmvscsis_aborted_task (struct se_cmd *se_cmd) { -/* TBD: What (if anything) should we do here? */ -pr_debug ("ibmvscsis_aborted_task %p\n" , se_cmd); +pr_debug ("ibmvscsis_aborted_task %p task_tag: %llu\n" , + se_cmd, se_cmd->tag); } static struct se_wwn *ibmvscsis_make_tport(struct target_fabric_configfs *tf,
drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.h +2 -0
@@ -168,10 +168,12 @@ struct ibmvscsis_cmd {struct iu_rsp rsp;struct work_struct work;struct scsi_info *adapter; +struct ibmvscsis_cmd *abort_cmd;/* Sense buffer that will be mapped into outgoing status */ unsigned char sense_buf[TRANSPORT_SENSE_BUFFER ];u64 init_time;#define CMD_FAST_FAIL BIT(0) +#define DELAY_SEND BIT(1)u32 flags;char type; };
Greg Kroah-Hartman
maintainerPATCH 71/197 scsi: lpfc: Fix panic on BFS configuration
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Smart <[email protected]>
commit 4492b739c9ccfaf828bd7c02dc779ec2a5e55ff4 upstream.
To select the appropriate shost template, the driver is issuing a mailbox command to retrieve the wwn. Turns out the sending of the command precedes the reset of the function. On SLI-4 adapters, this is inconsequential as the mailbox command location is specified by dma via the BMBX register. However, on SLI-3 adapters, the location of the mailbox command submission area changes. When the function is first powered on or reset, the cmd is submitted via PCI bar memory. Later the driver changes the function config to use host memory and DMA. The request to start a mailbox command is the same, a simple doorbell write, regardless of submission area. So.. if there has not been a boot driver run against the adapter, the mailbox command works as defaults are ok. But, if the boot driver has configured the card and, and if no platform pci function/slot reset occurs as the os starts, the mailbox command will fail. The SLI-3 device will use the stale boot driver dma location. This can cause PCI eeh errors.
Fix is to reset the sli-3 function before sending the mailbox command, thus synchronizing the function/driver on mailbox location.
Note: The fix uses routines that are typically invoked later in the call flow to reset the sli-3 device. The issue in using those routines is that the normal (non-fix) flow does additional initialization, namely the allocation of the pport structure. So, rather than significantly reworking the initialization flow so that the pport is alloc'd first, pointer checks are added to work around it. Checks are limited to the routines invoked by a sli-3 adapter (s3 routines) as this fix/early call is only invoked on a sli3 adapter. Nothing changes post the fix. Subsequent initialization, and another adapter reset, still occur - both on sli-3 and sli-4 adapters.
--- drivers/scsi/lpfc/lpfc_crtn.h | 1 + drivers/scsi/lpfc/lpfc_init.c | 7 +++++++ drivers/scsi/lpfc/lpfc_sli.c | 19 ++++++++++++------- 3 files changed, 20 insertions(+), 7 deletions(-)
drivers/scsi/lpfc/lpfc_crtn.h +1 -0
@@ -289,6 +289,7 @@ int lpfc_selective_reset(struct lpfc_hbavoid lpfc_reset_barrier (struct lpfc_hba *);int lpfc_sli_brdready (struct lpfc_hba *,uint32_t );int lpfc_sli_brdkill (struct lpfc_hba *); +int lpfc_sli_chipset_init (struct lpfc_hba *phba);int lpfc_sli_brdreset (struct lpfc_hba *);int lpfc_sli_brdrestart (struct lpfc_hba *);int lpfc_sli_hba_setup (struct lpfc_hba *);
drivers/scsi/lpfc/lpfc_init.c +7 -0
@@ -3563,6 +3563,13 @@ lpfc_get_wwpn(struct lpfc_hba *phba)LPFC_MBOXQ_t *mboxq;MAILBOX_t *mb; +if (phba->sli_rev <LPFC_SLI_REV4 ) { +/* Reset the port first */ +lpfc_sli_brdrestart (phba); + rc =lpfc_sli_chipset_init (phba); +if (rc) +return (uint64_t )-1 ; + } mboxq = (LPFC_MBOXQ_t *)mempool_alloc (phba->mbox_mem_pool,GFP_KERNEL );
drivers/scsi/lpfc/lpfc_sli.c +12 -7
@@ -4204,13 +4204,16 @@ lpfc_sli_brdreset(struct lpfc_hba *phba)/* Reset HBA */ lpfc_printf_log (phba,KERN_INFO ,LOG_SLI ,"0325 Reset HBA Data: x%x x%x\n" , - phba->pport->port_state, psli->sli_flag); + (phba->pport) ? phba->pport->port_state :0 , + psli->sli_flag);/* perform board reset */ phba->fc_eventTag =0 ; phba->link_events =0 ; - phba->pport->fc_myDID =0 ; - phba->pport->fc_prevDID =0 ; +if (phba->pport) { + phba->pport->fc_myDID =0 ; + phba->pport->fc_prevDID =0 ; + }/* Turn off parity checking and serr during the physical reset */ pci_read_config_word (phba->pcidev,PCI_COMMAND , &cfg_value);
@@ -4336,7 +4339,8 @@ lpfc_sli_brdrestart_s3(struct lpfc_hba */* Restart HBA */ lpfc_printf_log (phba,KERN_INFO ,LOG_SLI ,"0337 Restart HBA Data: x%x x%x\n" , - phba->pport->port_state, psli->sli_flag); + (phba->pport) ? phba->pport->port_state :0 , + psli->sli_flag); word0 =0 ; mb = (MAILBOX_t *) &word0;
@@ -4350,7 +4354,7 @@ lpfc_sli_brdrestart_s3(struct lpfc_hba *readl (to_slim);/* flush */ /* Only skip post after fc_ffinit is completed */ -if (phba->pport->port_state) +if (phba->pport && phba->pport->port_state) word0 =1 ;/* This is really setting up word1 */ else word0 =0 ;/* This is really setting up word1 */
@@ -4359,7 +4363,8 @@ lpfc_sli_brdrestart_s3(struct lpfc_hba *readl (to_slim);/* flush */ lpfc_sli_brdreset (phba); - phba->pport->stopped =0 ; +if (phba->pport) + phba->pport->stopped =0 ; phba->link_state =LPFC_INIT_START ; phba->hba_flag =0 ;spin_unlock_irq (&phba->hbalock);
@@ -4446,7 +4451,7 @@ lpfc_sli_brdrestart(struct lpfc_hba *phb* iteration, the function will restart the HBA again. The function returns * zero if HBA successfully restarted else returns negative error code. **/ -static int +int lpfc_sli_chipset_init (struct lpfc_hba *phba) {uint32_t status, i =0 ;
Greg Kroah-Hartman
maintainerPATCH 72/197 iio: dac: ad7303: fix channel description
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Roskin <[email protected]>
commit ce420fd4251809b4c3119b3b20c8b13bd8eba150 upstream.
realbits, storagebits and shift should be numbers, not ASCII characters.
--- drivers/iio/dac/ad7303.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/iio/dac/ad7303.c +3 -3
@@ -184,9 +184,9 @@ static const struct iio_chan_spec_ext_in .address = (chan), \ .scan_type = { \ .sign = 'u', \ - .realbits = '8', \ - .storagebits = '8', \ - .shift = '0', \ + .realbits = 8, \ + .storagebits = 8, \ + .shift = 0, \ }, \ .ext_info = ad7303_ext_info, \ }
Greg Kroah-Hartman
maintainerPATCH 73/197 IIO: bmp280-core.c: fix error in humidity calculation
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Klinger <[email protected]>
commit ed3730c435f1a9f9559ed7762035d22d8a95adfe upstream.
While calculating the compensation of the humidity there are negative values interpreted as unsigned because of unsigned variables used. These values as well as the constants need to be casted to signed as indicated by the documentation of the sensor.
--- drivers/iio/pressure/bmp280-core.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
drivers/iio/pressure/bmp280-core.c +6 -5
@@ -175,11 +175,12 @@ static u32 bmp280_compensate_humidity(st }H6 =sign_extend32 (tmp,7 ); - var = ((s32 )data->t_fine) -76800 ; - var = ((((adc_humidity <<14 ) - (H4 <<20 ) - (H5 * var)) +16384 ) >>15 ) - * (((((((var *H6 ) >>10 ) * (((var *H3 ) >>11 ) +32768 )) >>10 ) - +2097152 ) *H2 +8192 ) >>14 ); - var -= ((((var >>15 ) * (var >>15 )) >>7 ) *H1 ) >>4 ; + var = ((s32 )data->t_fine) - (s32 )76800 ; + var = ((((adc_humidity <<14 ) - (H4 <<20 ) - (H5 * var)) + + (s32 )16384 ) >>15 ) * (((((((var *H6 ) >>10 ) + * (((var * (s32 )H3 ) >>11 ) + (s32 )32768 )) >>10 ) + + (s32 )2097152 ) *H2 +8192 ) >>14 ); + var -= ((((var >>15 ) * (var >>15 )) >>7 ) * (s32 )H1 ) >>4 ;return var >>12 ; };
Greg Kroah-Hartman
maintainerPATCH 74/197 iio: stm32 trigger: fix sampling_frequency read
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabrice Gasnier <[email protected]>
commit 77a9febfd81f9e8550d09dc76e8e9c06307b7aca upstream.
When prescaler (PSC) is 0, it means div factor is 1: counter clock frequency is equal to input clk / (PSC + 1).
When reload value is 8 for example, counter counts 9 cycles, from 0 to 8. This is handled in frequency write routine, by writing respectively:
- prescaler - 1 to PSC
- reload value - 1 to ARR
This fix does the opposite when reading the frequency from PSC and ARR:
- prescaler is PSC + 1
- reload value is ARR + 1
Thus, PSC may be 0, depending on requested sampling frequency (div 1). In this case, reading freq wrongly reports 0, instead of computing and reporting correct value.
Remove test on !psc and !arr.
Small test on stm32f4 (example on tim1_trgo), before this fix:
$ cd /sys/bus/iio/devices/triggerX $ echo 10000 > sampling_frequency $ cat sampling_frequency 0
After this fix:
$ echo 10000 > sampling_frequency $ cat sampling_frequency 10000
--- drivers/iio/trigger/stm32-timer-trigger.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/iio/trigger/stm32-timer-trigger.c +3 -3
@@ -152,10 +152,10 @@ static ssize_t stm32_tt_read_frequency(sregmap_read (priv->regmap,TIM_PSC , &psc);regmap_read (priv->regmap,TIM_ARR , &arr); -if (psc && arr && (cr1 &TIM_CR1_CEN )) { +if (cr1 &TIM_CR1_CEN ) { freq = (unsigned long long )clk_get_rate (priv->clk); -do_div (freq, psc); -do_div (freq, arr); +do_div (freq, psc +1 ); +do_div (freq, arr +1 ); }return sprintf (buf,"%d\n" , (unsigned int )freq);
Greg Kroah-Hartman
maintainerPATCH 75/197 IB/hfi1: Return an error on memory allocation failure
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael J. Ruhl <[email protected]>
commit 94679061dcdddbafcf24e3bfb526e54dedcc2f2f upstream.
If the eager buffer allocation fails, it is necessary to return an error code.
--- drivers/infiniband/hw/hfi1/init.c | 1 + 1 file changed, 1 insertion(+)
drivers/infiniband/hw/hfi1/init.c +1 -0
@@ -1758,6 +1758,7 @@ int hfi1_setup_eagerbufs(struct hfi1_ctx !HFI1_CAP_KGET_MASK(rcd->flags, MULTI_PKT_EGR)) {dd_dev_err (dd,"ctxt%u: Failed to allocate eager buffers\n" , rcd->ctxt); + ret = -ENOMEM ; goto bail_rcvegrbuf_phys; }
Greg Kroah-Hartman
maintainerPATCH 76/197 IB/hfi1: Fix a subcontext memory leak
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael J. Ruhl <[email protected]>
commit 224d71f910102c966cdcd782c97e096d5e26e4da upstream.
The only context that frees user_exp_rcv data structures is the last context closed (from a sub-context set). This leaks the allocations from the other sub-contexts. Separate the common frees from the specific frees and call them at the appropriate time.
Using KEDR to check for memory leaks we get:
Before test:
[leak_check] Possible leaks: 25
After test:
[leak_check] Possible leaks: 31 (6 leaked data structures)
After patch applied (before and after test have the same value)
[leak_check] Possible leaks: 25
Each leak is 192 + 13440 + 6720 = 20352 bytes per sub-context.
--- drivers/infiniband/hw/hfi1/file_ops.c | 5 +++- drivers/infiniband/hw/hfi1/user_exp_rcv.c | 32 ++++++++++++++++-------------- drivers/infiniband/hw/hfi1/user_exp_rcv.h | 1 3 files changed, 23 insertions(+), 15 deletions(-)
drivers/infiniband/hw/hfi1/file_ops.c +4 -1
@@ -752,6 +752,9 @@ static int hfi1_file_close(struct inode/* release the cpu */ hfi1_put_proc_affinity (fdata->rec_cpu_num); +/* clean up rcv side */ +hfi1_user_exp_rcv_free (fdata); +/* * Clear any left over, unhandled events so the next process that * gets this context doesn't get confused.
@@ -791,7 +794,7 @@ static int hfi1_file_close(struct inode dd->rcd[uctxt->ctxt] =NULL ; -hfi1_user_exp_rcv_free (fdata); +hfi1_user_exp_rcv_grp_free (uctxt);hfi1_clear_ctxt_pkey (dd, uctxt->ctxt); uctxt->rcvwait_to =0 ;
drivers/infiniband/hw/hfi1/user_exp_rcv.c +18 -14
@@ -251,36 +251,40 @@ done:return ret; } +void hfi1_user_exp_rcv_grp_free (struct hfi1_ctxtdata *uctxt) +{ +struct tid_group *grp, *gptr; + +list_for_each_entry_safe (grp, gptr, &uctxt->tid_group_list.list, + list) { +list_del_init (&grp->list); +kfree (grp); + } +hfi1_clear_tids (uctxt); +} +int hfi1_user_exp_rcv_free (struct hfi1_filedata *fd) {struct hfi1_ctxtdata *uctxt = fd->uctxt; -struct tid_group *grp, *gptr; -if (!test_bit (HFI1_CTXT_SETUP_DONE , &uctxt->event_flags)) -return 0 ;/* * The notifier would have been removed when the process'es mm * was freed. */ -if (fd->handler) +if (fd->handler) {hfi1_mmu_rb_unregister (fd->handler); - -kfree (fd->invalid_tids); - -if (!uctxt->cnt) { + }else {if (!EXP_TID_SET_EMPTY (uctxt->tid_full_list))unlock_exp_tids (uctxt, &uctxt->tid_full_list, fd);if (!EXP_TID_SET_EMPTY (uctxt->tid_used_list))unlock_exp_tids (uctxt, &uctxt->tid_used_list, fd); -list_for_each_entry_safe (grp, gptr, &uctxt->tid_group_list.list, - list) { -list_del_init (&grp->list); -kfree (grp); - } -hfi1_clear_tids (uctxt); } +kfree (fd->invalid_tids); + fd->invalid_tids =NULL ; +kfree (fd->entry_to_rb); + fd->entry_to_rb =NULL ;return 0 ; }
drivers/infiniband/hw/hfi1/user_exp_rcv.h +1 -0
@@ -70,6 +70,7 @@ (tid) |=EXP_TID_SET (field, (value)); \ }while (0 ) +void hfi1_user_exp_rcv_grp_free(struct hfi1_ctxtdata *uctxt);int hfi1_user_exp_rcv_init (struct file *);int hfi1_user_exp_rcv_free (struct hfi1_filedata *);int hfi1_user_exp_rcv_setup (struct file *,struct hfi1_tid_info *);
Greg Kroah-Hartman
maintainerPATCH 77/197 pid_ns: Sleep in TASK_INTERRUPTIBLE in zap_pid_ns_processes
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric W. Biederman <[email protected]>
commit b9a985db98961ae1ba0be169f19df1c567e4ffe0 upstream.
The code can potentially sleep for an indefinite amount of time in zap_pid_ns_processes triggering the hung task timeout, and increasing the system average. This is undesirable. Sleep with a task state of TASK_INTERRUPTIBLE instead of TASK_UNINTERRUPTIBLE to remove these undesirable side effects.
Apparently under heavy load this has been allowing Chrome to trigger the hung time task timeout error and cause ChromeOS to reboot.
--- kernel/pid_namespace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/pid_namespace.c +1 -1
@@ -277,7 +277,7 @@ void zap_pid_ns_processes(struct pid_nam* if reparented. */ for (;;) { -set_current_state (TASK_UNINTERRUPTIBLE ); +set_current_state (TASK_INTERRUPTIBLE );if (pid_ns->nr_hashed == init_pids)break ;schedule ();
Greg Kroah-Hartman
maintainerPATCH 78/197 pid_ns: Fix race between setnsed fork() and zap_pid_ns_processes()
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kirill Tkhai <[email protected]>
commit 3fd37226216620c1a468afa999739d5016fbc349 upstream.
Imagine we have a pid namespace and a task from its parent's pid_ns, which made setns() to the pid namespace. The task is doing fork(), while the pid namespace's child reaper is dying. We have the race between them:
Task from parent pid_ns Child reaper copy_process() .. alloc_pid() .. .. zap_pid_ns_processes() .. disable_pid_allocation() .. read_lock(&tasklist_lock) .. iterate over pids in pid_ns .. kill tasks linked to pids .. read_unlock(&tasklist_lock) write_lock_irq(&tasklist_lock); .. attach_pid(p, PIDTYPE_PID); .. .. ..
So, just created task p won't receive SIGKILL signal, and the pid namespace will be in contradictory state. Only manual kill will help there, but does the userspace care about this? I suppose, the most users just inject a task into a pid namespace and wait a SIGCHLD from it.
The patch fixes the problem. It simply checks for (pid_ns->nr_hashed & PIDNS_HASH_ADDING) in copy_process(). We do it under the tasklist_lock, and can't skip PIDNS_HASH_ADDING as noted by Oleg:
"zap_pid_ns_processes() does disable_pid_allocation() and then takes tasklist_lock to kill the whole namespace. Given that copy_process() checks PIDNS_HASH_ADDING under write_lock(tasklist) they can't race;
if copy_process() takes this lock first, the new child will be killed, otherwise copy_process() can't miss
the change in ->nr_hashed."
If allocation is disabled, we just return -ENOMEM
like it's made for such cases in alloc_pid().
v2: Do not move disable_pid_allocation(), do not introduce a new variable in copy_process() and simplify the patch as suggested by Oleg Nesterov. Account the problem with double irq enabling found by Eric W. Biederman.
--- kernel/fork.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
kernel/fork.c +6 -2
@@ -1815,11 +1815,13 @@ static __latent_entropy struct task_stru*/ recalc_sigpending ();if (signal_pending (current)) { -spin_unlock (¤t->sighand->siglock); -write_unlock_irq (&tasklist_lock); retval = -ERESTARTNOINTR ; goto bad_fork_cancel_cgroup; } +if (unlikely (!(ns_of_pid (pid)->nr_hashed &PIDNS_HASH_ADDING ))) { + retval = -ENOMEM ; + goto bad_fork_cancel_cgroup; + }if (likely (p->pid)) {ptrace_init_task (p, (clone_flags &CLONE_PTRACE ) || trace);
@@ -1877,6 +1879,8 @@ static __latent_entropy struct task_strureturn p; bad_fork_cancel_cgroup: +spin_unlock (¤t->sighand->siglock); +write_unlock_irq (&tasklist_lock);cgroup_cancel_fork (p); bad_fork_free_pid:cgroup_threadgroup_change_end (current);
Greg Kroah-Hartman
maintainerPATCH 79/197 USB: serial: ftdi_sio: fix setting latency for unprivileged users
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anthony Mallet <[email protected]>
commit bb246681b3ed0967489a7401ad528c1aaa1a4c2e upstream.
Commit 557aaa7ffab6 ("ft232: support the ASYNC_LOW_LATENCY flag") enables unprivileged users to set the FTDI latency timer, but there was a logic flaw that skipped sending the corresponding USB control message to the device.
Specifically, the device latency timer would not be updated until next open, something which was later also inadvertently broken by commit c19db4c9e49a ("USB: ftdi_sio: set device latency timeout at port probe").
A recent commit c6dce2626606 ("USB: serial: ftdi_sio: fix extreme low-latency setting") disabled the low-latency mode by default so we now need this fix to allow unprivileged users to again enable it.
--- drivers/usb/serial/ftdi_sio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/serial/ftdi_sio.c +1 -1
@@ -1506,9 +1506,9 @@ static int set_serial_info(struct tty_st (new_serial.flags & ASYNC_FLAGS)); priv->custom_divisor = new_serial.custom_divisor; +check_and_exit:write_latency_timer (port); -check_and_exit:if ((old_priv.flags &ASYNC_SPD_MASK ) != (priv->flags &ASYNC_SPD_MASK )) {if ((priv->flags &ASYNC_SPD_MASK ) ==ASYNC_SPD_HI )
Greg Kroah-Hartman
maintainerPATCH 80/197 USB: serial: ftdi_sio: add Olimex ARM-USB-TINY(H) PIDs
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrey Korolyov <[email protected]>
commit 5f63424ab7daac840df2b12dd5bcc5b38d50f779 upstream.
This patch adds support for recognition of ARM-USB-TINY(H) devices which are almost identical to ARM-USB-OCD(H) but lacking separate barrel jack and serial console.
By suggestion from Johan Hovold it is possible to replace ftdi_jtag_quirk with a bit more generic construction. Since all Olimex-ARM debuggers has exactly two ports, we could safely always use only second port within the debugger family.
--- drivers/usb/serial/ftdi_sio.c | 8 ++++---- drivers/usb/serial/ftdi_sio_ids.h | 2 ++ 2 files changed, 6 insertions(+), 4 deletions(-)
drivers/usb/serial/ftdi_sio.c +4 -4
@@ -809,10 +809,10 @@ static const struct usb_device_id id_tab { USB_DEVICE(FTDI_VID, FTDI_PROPOX_ISPCABLEIII_PID) }, { USB_DEVICE(FTDI_VID, CYBER_CORTEX_AV_PID), .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(OLIMEX_VID, OLIMEX_ARM_USB_OCD_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(OLIMEX_VID, OLIMEX_ARM_USB_OCD_H_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE_INTERFACE_NUMBER(OLIMEX_VID, OLIMEX_ARM_USB_OCD_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(OLIMEX_VID, OLIMEX_ARM_USB_OCD_H_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(OLIMEX_VID, OLIMEX_ARM_USB_TINY_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(OLIMEX_VID, OLIMEX_ARM_USB_TINY_H_PID, 1) }, { USB_DEVICE(FIC_VID, FIC_NEO1973_DEBUG_PID), .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, { USB_DEVICE(FTDI_VID, FTDI_OOCDLINK_PID),
drivers/usb/serial/ftdi_sio_ids.h +2 -0
@@ -882,6 +882,8 @@/* Olimex */ #define OLIMEX_VID 0x15BA#define OLIMEX_ARM_USB_OCD_PID 0x0003 +#define OLIMEX_ARM_USB_TINY_PID 0x0004 +#define OLIMEX_ARM_USB_TINY_H_PID 0x002a#define OLIMEX_ARM_USB_OCD_H_PID 0x002b/*
Greg Kroah-Hartman
maintainerPATCH 81/197 USB: chaoskey: fix Alea quirk on big-endian hosts
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 63afd5cc78775018ea2dec4004428dafa5283e93 upstream.
Add missing endianness conversion when applying the Alea timeout quirk.
Found using sparse:
warning: restricted __le16 degrades to integer
--- drivers/usb/misc/chaoskey.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/misc/chaoskey.c +1 -1
@@ -194,7 +194,7 @@ static int chaoskey_probe(struct usb_int dev->in_ep = in_ep; -if (udev->descriptor.idVendor !=ALEA_VENDOR_ID ) +if (le16_to_cpu (udev->descriptor.idVendor) !=ALEA_VENDOR_ID ) dev->reads_started =1 ; dev->size = size;
Greg Kroah-Hartman
maintainerPATCH 82/197 Make stat/lstat/fstatat pass AT_NO_AUTOMOUNT to vfs_statx()
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <[email protected]>
commit deccf497d804a4c5fca2dbfad2f104675a6f9102 upstream.
stat/lstat/fstatat need to pass AT_NO_AUTOMOUNT to vfs_statx() as the pre-statx code didn't set LOOKUP_AUTOMOUNT, even though fstatat() accepted the AT_NO_AUTOMOUNT flag.
--- include/linux/fs.h | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
include/linux/fs.h +5 -3
@@ -2921,17 +2921,19 @@ extern int vfs_statx_fd(unsigned int, ststatic inline int vfs_stat (const char __user *filename,struct kstat *stat) { -return vfs_statx (AT_FDCWD , filename,0 , stat,STATX_BASIC_STATS ); +return vfs_statx (AT_FDCWD , filename,AT_NO_AUTOMOUNT , + stat,STATX_BASIC_STATS ); }static inline int vfs_lstat (const char __user *name,struct kstat *stat) { -return vfs_statx (AT_FDCWD , name,AT_SYMLINK_NOFOLLOW , +return vfs_statx (AT_FDCWD , name,AT_SYMLINK_NOFOLLOW |AT_NO_AUTOMOUNT , stat,STATX_BASIC_STATS ); }static inline int vfs_fstatat (int dfd,const char __user *filename,struct kstat *stat,int flags) { -return vfs_statx (dfd, filename, flags, stat,STATX_BASIC_STATS ); +return vfs_statx (dfd, filename, flags |AT_NO_AUTOMOUNT , + stat,STATX_BASIC_STATS ); }static inline int vfs_fstat (int fd,struct kstat *stat) {
Greg Kroah-Hartman
maintainerPATCH 83/197 libnvdimm: fix clear length of nvdimm_forget_poison()
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Toshi Kani <[email protected]>
commit 8d13c0290655b883df9083a2a0af0d782bc38aef upstream.
ND_CMD_CLEAR_ERROR command returns 'clear_err.cleared', the length of error actually cleared, which may be smaller than its requested 'len'.
Change nvdimm_clear_poison() to call nvdimm_forget_poison() with 'clear_err.cleared' when this value is valid.
--- drivers/nvdimm/bus.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/nvdimm/bus.c +4 -1
@@ -218,7 +218,10 @@ long nvdimm_clear_poison(struct device *if (cmd_rc <0 )return cmd_rc; -nvdimm_clear_from_poison_list (nvdimm_bus, phys, len); +if (clear_err.cleared >0 ) +nvdimm_clear_from_poison_list (nvdimm_bus, phys, + clear_err.cleared); +return clear_err.cleared; }EXPORT_SYMBOL_GPL (nvdimm_clear_poison);
Greg Kroah-Hartman
maintainerPATCH 84/197 dax: fix data corruption when fault races with write
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
commit 13e451fdc1af05568ea379d71c02a126295d2244 upstream.
Currently DAX read fault can race with write(2) in the following way:
CPU1 - write(2) CPU2 - read fault
dax_iomap_pte_fault() ->iomap_begin() - sees hole
dax_iomap_rw()
iomap_apply()
->iomap_begin - allocates blocks
dax_iomap_actor()
invalidate_inode_pages2_range()
- there's nothing to invalidate grab_mapping_entry()
- we add zero page in the radix tree and map it to page tables
The result is that hole page is mapped into page tables (and thus zeros are seen in mmap) while file has data written in that place.
Fix the problem by locking exception entry before mapping blocks for the fault. That way we are sure invalidate_inode_pages2_range() call for racing write will either block on entry lock waiting for the fault to finish (and unmap stale page tables after that) or read fault will see already allocated blocks by write(2).
--- fs/dax.c | 32 ++++++++++++++++---------------- 1 file changed, 16 insertions(+), 16 deletions(-)
fs/dax.c +16 -16
@@ -1124,23 +1124,23 @@ static int dax_iomap_pte_fault(struct vmif ((vmf->flags &FAULT_FLAG_WRITE ) && !vmf->cow_page) flags |=IOMAP_WRITE ; + entry =grab_mapping_entry (mapping, vmf->pgoff,0 ); +if (IS_ERR (entry)) +return dax_fault_return (PTR_ERR (entry)); +/* * Note that we don't bother to use iomap_apply here: DAX required * the file system block size to be equal the page size, which means * that we never have to deal with more than a single extent here. */ error = ops->iomap_begin (inode, pos,PAGE_SIZE , flags, &iomap); -if (error) -return dax_fault_return (error); -if (WARN_ON_ONCE (iomap.offset + iomap.length < pos +PAGE_SIZE )) { - vmf_ret =dax_fault_return (-EIO );/* fs corruption? */ - goto finish_iomap; +if (error) { + vmf_ret =dax_fault_return (error); + goto unlock_entry; } - - entry =grab_mapping_entry (mapping, vmf->pgoff,0 ); -if (IS_ERR (entry)) { - vmf_ret =dax_fault_return (PTR_ERR (entry)); - goto finish_iomap; +if (WARN_ON_ONCE (iomap.offset + iomap.length < pos +PAGE_SIZE )) { + error = -EIO ;/* fs corruption? */ + goto error_finish_iomap; } sector =dax_iomap_sector (&iomap, pos);
@@ -1162,13 +1162,13 @@ static int dax_iomap_pte_fault(struct vm }if (error) - goto error_unlock_entry; + goto error_finish_iomap;__SetPageUptodate (vmf->cow_page); vmf_ret =finish_fault (vmf);if (!vmf_ret) vmf_ret =VM_FAULT_DONE_COW ; - goto unlock_entry; + goto finish_iomap; }switch (iomap.type) {
@@ -1188,7 +1188,7 @@ static int dax_iomap_pte_fault(struct vmcase IOMAP_HOLE :if (!(vmf->flags &FAULT_FLAG_WRITE )) { vmf_ret =dax_load_hole (mapping, &entry, vmf); - goto unlock_entry; + goto finish_iomap; }/*FALLTHRU*/ default :
@@ -1197,10 +1197,8 @@ static int dax_iomap_pte_fault(struct vmbreak ; } - error_unlock_entry: + error_finish_iomap: vmf_ret =dax_fault_return (error) | major; - unlock_entry: -put_locked_mapping_entry (mapping, vmf->pgoff, entry); finish_iomap:if (ops->iomap_end) {int copied =PAGE_SIZE ;
@@ -1215,6 +1213,8 @@ static int dax_iomap_pte_fault(struct vm*/ ops->iomap_end (inode, pos,PAGE_SIZE , copied, flags, &iomap); } + unlock_entry: +put_locked_mapping_entry (mapping, vmf->pgoff, entry);return vmf_ret; }
Greg Kroah-Hartman
maintainerPATCH 85/197 EDAC, amd64: Fix reporting of Chip Select sizes on Fam17h
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yazen Ghannam <[email protected]>
commit eb77e6b80f3bed262c7773236f0fb84649fd3091 upstream.
The wrong index into the csbases/csmasks arrays was being passed to the function to compute the chip select sizes, which resulted in the wrong size being computed. Address that so that the correct values are computed and printed.
Also, redo how we calculate the number of pages in a CS row.
--- drivers/edac/amd64_edac.c | 40 +++++++++++++++++++--------------------- 1 file changed, 19 insertions(+), 21 deletions(-)
--
To unsubscribe from this list: send the line "unsubscribe linux-edac" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
drivers/edac/amd64_edac.c +19 -21
@@ -782,24 +782,26 @@ static void debug_dump_dramcfg_low(strucstatic void debug_display_dimm_sizes_df (struct amd64_pvt *pvt,u8 ctrl) { -u32 *dcsb = ctrl ? pvt->csels[1 ].csbases : pvt->csels[0 ].csbases; -int dimm, size0, size1; +int dimm, size0, size1, cs0, cs1;edac_printk (KERN_DEBUG ,EDAC_MC ,"UMC%d chip selects:\n" , ctrl);for (dimm =0 ; dimm <4 ; dimm++) { size0 =0 ; + cs0 = dimm *2 ; -if (dcsb[dimm*2 ] &DCSB_CS_ENABLE ) - size0 = pvt->ops->dbam_to_cs (pvt, ctrl,0 , dimm); +if (csrow_enabled (cs0, ctrl, pvt)) + size0 = pvt->ops->dbam_to_cs (pvt, ctrl,0 , cs0); size1 =0 ; -if (dcsb[dimm*2 +1 ] &DCSB_CS_ENABLE ) - size1 = pvt->ops->dbam_to_cs (pvt, ctrl,0 , dimm); + cs1 = dimm *2 +1 ; + +if (csrow_enabled (cs1, ctrl, pvt)) + size1 = pvt->ops->dbam_to_cs (pvt, ctrl,0 , cs1);amd64_info (EDAC_MC ": %d: %5dMB %d: %5dMB\n" , - dimm *2 , size0, - dimm *2 +1 , size1); + cs0, size0, + cs1, size1); } }
@@ -2756,26 +2758,22 @@ skip:* encompasses * */ -static u32 get_csrow_nr_pages (struct amd64_pvt *pvt,u8 dct,int csrow_nr) +static u32 get_csrow_nr_pages (struct amd64_pvt *pvt,u8 dct,int csrow_nr_orig) { -u32 cs_mode, nr_pages;u32 dbam = dct ? pvt->dbam1 : pvt->dbam0; +int csrow_nr = csrow_nr_orig; +u32 cs_mode, nr_pages; +if (!pvt->umc) + csrow_nr >>=1 ; -/* -* The math on this doesn't look right on the surface because x/2*4 can -* be simplified to x*2 but this expression makes use of the fact that -* it is integral math where 1/2=0. This intermediate value becomes the -* number of bits to shift the DBAM register to extract the proper CSROW -* field. -*/ - cs_mode =DBAM_DIMM (csrow_nr /2 , dbam); + cs_mode =DBAM_DIMM (csrow_nr, dbam); - nr_pages = pvt->ops->dbam_to_cs (pvt, dct, cs_mode, (csrow_nr /2 )) - << (20 -PAGE_SHIFT ); + nr_pages = pvt->ops->dbam_to_cs (pvt, dct, cs_mode, csrow_nr); + nr_pages <<=20 -PAGE_SHIFT ;edac_dbg (0 ,"csrow: %d, channel: %d, DBAM idx: %d\n" , - csrow_nr, dct, cs_mode); + csrow_nr_orig, dct, cs_mode);edac_dbg (0 ,"nr_pages/channel: %u\n" , nr_pages);return nr_pages;
Greg Kroah-Hartman
maintainerPATCH 86/197 xhci: Fix command ring stop regression in 4.11
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <[email protected]>
commit 604d02a2a66ab7f93fd3b2bde3698c29ef057b65 upstream.
In 4.11 TRB completion codes were renamed to match spec.
Completion codes for command ring stopped and endpoint stopped were mixed, leading to failures while handling a stopped command ring.
Use the correct completion code for command ring stopped events.
--- drivers/usb/host/xhci-hub.c | 2 +- drivers/usb/host/xhci-ring.c | 8 ++++---- drivers/usb/host/xhci.c | 8 ++++---- 3 files changed, 9 insertions(+), 9 deletions(-)
drivers/usb/host/xhci-hub.c +1 -1
@@ -421,7 +421,7 @@ static int xhci_stop_device(struct xhci_wait_for_completion (cmd->completion);if (cmd->status ==COMP_COMMAND_ABORTED || - cmd->status ==COMP_STOPPED ) { + cmd->status ==COMP_COMMAND_RING_STOPPED ) {xhci_warn (xhci,"Timeout while waiting for stop endpoint command\n" ); ret = -ETIME ; }
drivers/usb/host/xhci-ring.c +4 -4
@@ -321,7 +321,7 @@ static void xhci_handle_stopped_cmd_ringif (i_cmd->status !=COMP_COMMAND_ABORTED )continue ; - i_cmd->status =COMP_STOPPED ; + i_cmd->status =COMP_COMMAND_RING_STOPPED ;xhci_dbg (xhci,"Turn aborted command %p to no-op\n" , i_cmd->command_trb);
@@ -1342,7 +1342,7 @@ static void handle_cmd_completion(struct cmd_comp_code =GET_COMP_CODE (le32_to_cpu (event->status));/* If CMD ring stopped we own the trbs between enqueue and dequeue */ -if (cmd_comp_code ==COMP_STOPPED ) { +if (cmd_comp_code ==COMP_COMMAND_RING_STOPPED ) {complete_all (&xhci->cmd_ring_stop_completion);return ; }
@@ -1397,8 +1397,8 @@ static void handle_cmd_completion(structbreak ;case TRB_CMD_NOOP :/* Is this an aborted command turned to NO-OP? */ -if (cmd->status ==COMP_STOPPED ) - cmd_comp_code =COMP_STOPPED ; +if (cmd->status ==COMP_COMMAND_RING_STOPPED ) + cmd_comp_code =COMP_COMMAND_RING_STOPPED ;break ;case TRB_RESET_EP : WARN_ON(slot_id != TRB_TO_SLOT_ID(
drivers/usb/host/xhci.c +4 -4
@@ -1805,7 +1805,7 @@ static int xhci_configure_endpoint_resulswitch (*cmd_status) {case COMP_COMMAND_ABORTED : -case COMP_STOPPED : +case COMP_COMMAND_RING_STOPPED :xhci_warn (xhci,"Timeout while waiting for configure endpoint command\n" ); ret = -ETIME ;break ;
@@ -1856,7 +1856,7 @@ static int xhci_evaluate_context_result(switch (*cmd_status) {case COMP_COMMAND_ABORTED : -case COMP_STOPPED : +case COMP_COMMAND_RING_STOPPED :xhci_warn (xhci,"Timeout while waiting for evaluate context command\n" ); ret = -ETIME ;break ;
@@ -3478,7 +3478,7 @@ int xhci_discover_or_reset_device(struct ret = reset_device_cmd->status;switch (ret) {case COMP_COMMAND_ABORTED : -case COMP_STOPPED : +case COMP_COMMAND_RING_STOPPED :xhci_warn (xhci,"Timeout waiting for reset device command\n" ); ret = -ETIME ; goto command_cleanup;
@@ -3845,7 +3845,7 @@ static int xhci_setup_device(struct usb_*/ switch (command->status) {case COMP_COMMAND_ABORTED : -case COMP_STOPPED : +case COMP_COMMAND_RING_STOPPED :xhci_warn (xhci,"Timeout while waiting for setup device command\n" ); ret = -ETIME ;break ;
Greg Kroah-Hartman
maintainerPATCH 87/197 xhci: remove GFP_DMA flag from allocation
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthias Lange <[email protected]>
commit 5db851cf20857c5504b146046e97cb7781f2a743 upstream.
There is no reason to restrict allocations to the first 16MB ISA DMA addresses.
It is causing problems in a virtualization setup with enabled IOMMU (x86_64). The result is that USB is not working in the VM.
--- drivers/usb/host/xhci-mem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/host/xhci-mem.c +1 -1
@@ -56,7 +56,7 @@ static struct xhci_segment *xhci_segment }if (max_packet) { - seg->bounce_buf =kzalloc (max_packet, flags |GFP_DMA ); + seg->bounce_buf =kzalloc (max_packet, flags);if (!seg->bounce_buf) {dma_pool_free (xhci->segment_pool, seg->trbs, dma);kfree (seg);
Greg Kroah-Hartman
maintainerPATCH 88/197 usb: host: xhci-plat: propagate return value of platform_get_irq()
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Petazzoni <[email protected]>
commit 4b148d5144d64ee135b8924350cb0b3a7fd21150 upstream.
platform_get_irq() returns an error code, but the xhci-plat driver ignores it and always returns -ENODEV. This is not correct, and prevents -EPROBE_DEFER from being propagated properly.
--- drivers/usb/host/xhci-plat.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/host/xhci-plat.c +1 -1
@@ -162,7 +162,7 @@ static int xhci_plat_probe(struct platfo irq =platform_get_irq (pdev,0 );if (irq <0 ) -return -ENODEV ; +return irq;/* Try to set 64-bit DMA first */ if (!pdev->dev.dma_mask)
Greg Kroah-Hartman
maintainerPATCH 89/197 USB: xhci: fix lock-inversion problem
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <[email protected]>
commit 63aea0dbab90a2461faaae357cbc8cfd6c8de9fe upstream.
With threaded interrupts, bottom-half handlers are called with interrupts enabled. Therefore they can't safely use spin_lock(); they have to use spin_lock_irqsave(). Lockdep warns about a violation occurring in xhci_irq():
=========================================================
[ INFO: possible irq lock inversion dependency detected ] 4.11.0-rc8-dbg+ #1 Not tainted
---------------------------------------------------------
swapper/7/0 just changed the state of lock:
(&(&ehci->lock)->rlock){-.-...}, at: [<ffffffffa0130a69>]ehci_hrtimer_func+0x29/0xc0 [ehci_hcd]
but this lock took another, HARDIRQ-unsafe lock in the past:
(hcd_urb_list_lock){+.....}
and interrupts could create inverse lock ordering between them.
other info that might help us debug this:
Possible interrupt unsafe locking scenario:
CPU0 CPU1
---- ----
lock(hcd_urb_list_lock);
local_irq_disable();
lock(&(&ehci->lock)->rlock);
lock(hcd_urb_list_lock);
<Interrupt>
lock(&(&ehci->lock)->rlock);*** DEADLOCK ***
no locks held by swapper/7/0.
the shortest dependencies between 2nd lock and 1st lock:
-> (hcd_urb_list_lock){+.....} ops: 252 {
HARDIRQ-ON-W at:
__lock_acquire+0x602/0x1280
lock_acquire+0xd5/0x1c0
_raw_spin_lock+0x2f/0x40
usb_hcd_unlink_urb_from_ep+0x1b/0x60 [usbcore]
xhci_giveback_urb_in_irq.isra.45+0x70/0x1b0 [xhci_hcd]
finish_td.constprop.60+0x1d8/0x2e0 [xhci_hcd]
xhci_irq+0xdd6/0x1fa0 [xhci_hcd]
usb_hcd_irq+0x26/0x40 [usbcore]
irq_forced_thread_fn+0x2f/0x70
irq_thread+0x149/0x1d0
kthread+0x113/0x150
ret_from_fork+0x2e/0x40This patch fixes the problem.
--- drivers/usb/host/xhci-ring.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/usb/host/xhci-ring.c +3 -2
@@ -2616,11 +2616,12 @@ irqreturn_t xhci_irq(struct usb_hcd *hcdstruct xhci_hcd *xhci =hcd_to_xhci (hcd);union xhci_trb *event_ring_deq;irqreturn_t ret =IRQ_NONE ; +unsigned long flags;dma_addr_t deq;u64 temp_64;u32 status; -spin_lock (&xhci->lock); +spin_lock_irqsave (&xhci->lock, flags);/* Check if the xHC generated the interrupt, or the irq is shared */ status =readl (&xhci->op_regs->status);if (status ==0xffffffff ) {
@@ -2695,7 +2696,7 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd ret =IRQ_HANDLED ; out: -spin_unlock (&xhci->lock); +spin_unlock_irqrestore (&xhci->lock, flags);return ret; }
Greg Kroah-Hartman
maintainerPATCH 90/197 xhci: apply PME_STUCK_QUIRK and MISSING_CAS quirk for Denverton
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <[email protected]>
commit a0c16630d35a874e82bdf2088f58ecaca1024315 upstream.
Intel Denverton microserver is Atom based and need the PME and CAS quirks as well.
--- drivers/usb/host/xhci-pci.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/usb/host/xhci-pci.c +5 -2
@@ -52,6 +52,7 @@#define PCI_DEVICE_ID_INTEL_BROXTON_M_XHCI 0x0aa8#define PCI_DEVICE_ID_INTEL_BROXTON_B_XHCI 0x1aa8#define PCI_DEVICE_ID_INTEL_APL_XHCI 0x5aa8 +#define PCI_DEVICE_ID_INTEL_DNV_XHCI 0x19d0static const char hcd_name[] ="xhci_hcd" ;
@@ -166,7 +167,8 @@ static void xhci_pci_quirks(struct devic pdev->device ==PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI || pdev->device ==PCI_DEVICE_ID_INTEL_BROXTON_M_XHCI || pdev->device ==PCI_DEVICE_ID_INTEL_BROXTON_B_XHCI || - pdev->device == PCI_DEVICE_ID_INTEL_APL_XHCI)) { + pdev->device ==PCI_DEVICE_ID_INTEL_APL_XHCI || + pdev->device == PCI_DEVICE_ID_INTEL_DNV_XHCI)) { xhci->quirks |= XHCI_PME_STUCK_QUIRK; } if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
@@ -175,7 +177,8 @@ static void xhci_pci_quirks(struct devic }if (pdev->vendor ==PCI_VENDOR_ID_INTEL && (pdev->device ==PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI || - pdev->device ==PCI_DEVICE_ID_INTEL_APL_XHCI )) + pdev->device ==PCI_DEVICE_ID_INTEL_APL_XHCI || + pdev->device ==PCI_DEVICE_ID_INTEL_DNV_XHCI )) xhci->quirks |=XHCI_MISSING_CAS ; if (pdev->vendor == PCI_VENDOR_ID_ETRON &&
Greg Kroah-Hartman
maintainerPATCH 91/197 usb: host: xhci-mem: allocate zeroed Scratchpad Buffer
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Chen <[email protected]>
commit 7480d912d549f414e0ce39331870899e89a5598c upstream.
According to xHCI ch4.20 Scratchpad Buffers, the Scratchpad Buffer needs to be zeroed.
...
The following operations take place to allocate Scratchpad Buffers to the xHC:
...
b. Software clears the Scratchpad Buffer to '0'
--- drivers/usb/host/xhci-mem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/host/xhci-mem.c +1 -1
@@ -1729,7 +1729,7 @@ static int scratchpad_alloc(struct xhci_ xhci->dcbaa->dev_context_ptrs[0 ] =cpu_to_le64 (xhci->scratchpad->sp_dma);for (i =0 ; i < num_sp; i++) {dma_addr_t dma; -void *buf =dma_alloc_coherent (dev, xhci->page_size, &dma, +void *buf =dma_zalloc_coherent (dev, xhci->page_size, &dma, flags);if (!buf) goto fail_sp5;
Greg Kroah-Hartman
maintainerPATCH 92/197 net: irda: irda-usb: fix firmware name on big-endian hosts
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 75cf067953d5ee543b3bda90bbfcbee5e1f94ae8 upstream.
Add missing endianness conversion when using the USB device-descriptor bcdDevice field to construct a firmware file name.
--- drivers/net/irda/irda-usb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/irda/irda-usb.c +1 -1
@@ -1077,7 +1077,7 @@ static int stir421x_patch_device(struct* are "42101001.sb" or "42101002.sb" */ sprintf (stir421x_fw_name,"4210%4X.sb" , - self->usbdev->descriptor.bcdDevice); +le16_to_cpu (self->usbdev->descriptor.bcdDevice)); ret =request_firmware (&fw, stir421x_fw_name, &self->usbdev->dev);if (ret <0 )return ret;
Greg Kroah-Hartman
maintainerPATCH 93/197 usbvision: fix NULL-deref at probe
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit eacb975b48272f54532b62f515a3cf7eefa35123 upstream.
Make sure to check the number of endpoints to avoid dereferencing a NULL-pointer or accessing memory beyond the endpoint array should a malicious device lack the expected endpoints.
modification")
--- drivers/media/usb/usbvision/usbvision-video.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/media/usb/usbvision/usbvision-video.c +8 -1
@@ -1501,7 +1501,14 @@ static int usbvision_probe(struct usb_in }for (i =0 ; i < usbvision->num_alt; i++) { -u16 tmp =le16_to_cpu (uif->altsetting[i].endpoint[1 ].desc. +u16 tmp; + +if (uif->altsetting[i].desc.bNumEndpoints <2 ) { + ret = -ENODEV ; + goto err_pkt; + } + + tmp =le16_to_cpu (uif->altsetting[i].endpoint[1 ].desc. wMaxPacketSize); usbvision->alt_max_pkt_size[i] = (tmp &0x07ff ) * (((tmp &0x1800 ) >>11 ) +1 );
Greg Kroah-Hartman
maintainerPATCH 94/197 mceusb: fix NULL-deref at probe
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 03eb2a557ed552e920a0942b774aaf931596eec1 upstream.
Make sure to check for the required out endpoint to avoid dereferencing a NULL-pointer in mce_request_packet should a malicious device lack such an endpoint. Note that this path is hit during probe.
--- drivers/media/rc/mceusb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/media/rc/mceusb.c +2 -2
@@ -1288,8 +1288,8 @@ static int mceusb_dev_probe(struct usb_i } } } -if (ep_in ==NULL ) { -dev_dbg (&intf->dev,"inbound and/or endpoint not found" ); +if (!ep_in || !ep_out) { +dev_dbg (&intf->dev,"required endpoints not found\n" );return -ENODEV ; }
Greg Kroah-Hartman
maintainerPATCH 95/197 ttusb2: limit messages to buffer size
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alyssa Milburn <[email protected]>
commit a12b8ab8c5ff7ccd7b107a564743507c850a441d upstream.
Otherwise ttusb2_i2c_xfer can read or write beyond the end of static and heap buffers.
--- drivers/media/usb/dvb-usb/ttusb2.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+)
drivers/media/usb/dvb-usb/ttusb2.c +19 -0
@@ -78,6 +78,9 @@ static int ttusb2_msg(struct dvb_usb_devu8 *s, *r =NULL ;int ret =0 ; +if (4 + rlen >64 ) +return -EIO ; + s =kzalloc (wlen+4 ,GFP_KERNEL );if (!s)return -ENOMEM ;
@@ -381,6 +384,22 @@ static int ttusb2_i2c_xfer(struct i2c_ad write_read = i+1 < num && (msg[i+1 ].flags &I2C_M_RD ); read = msg[i].flags &I2C_M_RD ; +if (3 + msg[i].len >sizeof (obuf)) { +err ("i2c wr len=%d too high" , msg[i].len); +break ; + } +if (write_read) { +if (3 + msg[i+1 ].len >sizeof (ibuf)) { +err ("i2c rd len=%d too high" , msg[i+1 ].len); +break ; + } + }else if (read) { +if (3 + msg[i].len >sizeof (ibuf)) { +err ("i2c rd len=%d too high" , msg[i].len); +break ; + } + } + obuf[0 ] = (msg[i].addr <<1 ) | (write_read | read);if (read) obuf[1 ] =0 ;
Greg Kroah-Hartman
maintainerPATCH 96/197 dvb-usb-dibusb-mc-common: Add MODULE_LICENSE
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <[email protected]>
commit bf05b65a9fe5f6a6dd3e72cab2aacd8b5b96e41d upstream.
dvb-usb-dibusb-mc-common is licensed under GPLv2, and if we don't say so then it won't even load since it needs a GPL-only symbol.
--- drivers/media/usb/dvb-usb/dibusb-mc-common.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/media/usb/dvb-usb/dibusb-mc-common.c +2 -0
@@ -11,6 +11,8 @@#include "dibusb.h" +MODULE_LICENSE ("GPL" ); +/* 3000MC/P stuff */ // Config Adjacent channels Perf -cal22 static struct dibx000_agc_config dib3000p_mt2060_agc_config = {
Greg Kroah-Hartman
maintainerPATCH 97/197 usb: dwc3: gadget: Prevent losing events in event cache
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thinh Nguyen <[email protected]>
commit d325a1de49d61ee11aca58a529571c91ecea7879 upstream.
The dwc3 driver can overwite its previous events if its top-half IRQ handler (TH) gets invoked again before processing the events in the cache. We see this as a hang in the file transfer and the host will attempt to reset the device. TH gets the event count and deasserts the interrupt line by writing DWC3_GEVNTSIZ_INTMASK to DWC3_GEVNTSIZ. If there's a new event coming between reading the event count and interrupt deassertion, dwc3 will lose previous pending events. More generally, we will see 0 event count, which should not affect anything.
This shouldn't be possible in the current dwc3 implementation. However, through testing and reading the PCIe trace, the TH occasionally still gets invoked one more time after HW interrupt deassertion. (With PCIe legacy interrupts, TH is called repeatedly as long as the interrupt line is asserted). We suspect that there is a small detection delay in the SW.
To avoid this issue, Check DWC3_EVENT_PENDING flag to determine if the events are processed in the bottom-half IRQ handler. If not, return IRQ_HANDLED and don't process new event.
--- drivers/usb/dwc3/gadget.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/usb/dwc3/gadget.c +9 -0
@@ -3078,6 +3078,15 @@ static irqreturn_t dwc3_check_event_buf(return IRQ_HANDLED ; } +/* +* With PCIe legacy interrupt, test shows that top-half irq handler can +* be called again after HW interrupt deassertion. Check if bottom-half +* irq event handler completes before caching new event to prevent +* losing events. +*/ +if (evt->flags &DWC3_EVENT_PENDING ) +return IRQ_HANDLED ; + count =dwc3_readl (dwc->regs,DWC3_GEVNTCOUNT (0 )); count &=DWC3_GEVNTCOUNT_MASK ;if (!count)
Greg Kroah-Hartman
maintainerPATCH 98/197 usb: musb: tusb6010_omap: Do not reset the other directions packet size
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <[email protected]>
commit 6df2b42f7c040d57d9ecb67244e04e905ab87ac6 upstream.
We have one register for each EP to set the maximum packet size for both TX and RX.
If for example an RX programming would happen before the previous TX transfer finishes we would reset the TX packet side.
To fix this issue, only modify the TX or RX part of the register.
--- drivers/usb/musb/tusb6010_omap.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
drivers/usb/musb/tusb6010_omap.c +9 -4
@@ -219,6 +219,7 @@ static int tusb_omap_dma_program(structu32 dma_remaining;int src_burst, dst_burst;u16 csr; +u32 psize;int ch;s8 dmareq;s8 sync_dev;
@@ -390,15 +391,19 @@ static int tusb_omap_dma_program(structif (chdat->tx) {/* Send transfer_packet_sz packets at a time */ -musb_writel (ep_conf,TUSB_EP_MAX_PACKET_SIZE_OFFSET , - chdat->transfer_packet_sz); + psize =musb_readl (ep_conf,TUSB_EP_MAX_PACKET_SIZE_OFFSET ); + psize &= ~0x7ff ; + psize |= chdat->transfer_packet_sz; +musb_writel (ep_conf,TUSB_EP_MAX_PACKET_SIZE_OFFSET , psize);musb_writel (ep_conf,TUSB_EP_TX_OFFSET ,TUSB_EP_CONFIG_XFR_SIZE (chdat->transfer_len)); }else {/* Receive transfer_packet_sz packets at a time */ -musb_writel (ep_conf,TUSB_EP_MAX_PACKET_SIZE_OFFSET , - chdat->transfer_packet_sz <<16 ); + psize =musb_readl (ep_conf,TUSB_EP_MAX_PACKET_SIZE_OFFSET ); + psize &= ~(0x7ff <<16 ); + psize |= (chdat->transfer_packet_sz <<16 ); +musb_writel (ep_conf,TUSB_EP_MAX_PACKET_SIZE_OFFSET , psize);musb_writel (ep_conf,TUSB_EP_RX_OFFSET ,TUSB_EP_CONFIG_XFR_SIZE (chdat->transfer_len));
Greg Kroah-Hartman
maintainerPATCH 99/197 usb: musb: Fix trying to suspend while active for OTG configurations
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Lindgren <[email protected]>
commit 3c50ffef25855a9d9e4b07b02d756a8cdd653069 upstream.
Commit d8e5f0eca1e8 ("usb: musb: Fix hardirq-safe hardirq-unsafe lock order error") caused a regression where musb keeps trying to enable host mode with no cable connected. This seems to be caused by the fact that now phy is enabled earlier, and we are wrongly trying to force USB host mode on an OTG port. The errors we are getting are "trying to suspend as a_idle while active".
For ports configured as OTG, we should not need to do anything to try to force USB host mode on it's OTG port. Trying to force host mode in this case just seems to completely confuse the musb state machine.
Let's fix the issue by making musb_host_setup() attempt to force the mode only if port_mode is configured for host mode.
--- drivers/usb/musb/musb_host.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/usb/musb/musb_host.c +5 -4
@@ -2780,10 +2780,11 @@ int musb_host_setup(struct musb *musb, iint ret;struct usb_hcd *hcd = musb->hcd; -MUSB_HST_MODE (musb); - musb->xceiv->otg->default_a =1 ; - musb->xceiv->otg->state =OTG_STATE_A_IDLE ; - +if (musb->port_mode ==MUSB_PORT_MODE_HOST ) { +MUSB_HST_MODE (musb); + musb->xceiv->otg->default_a =1 ; + musb->xceiv->otg->state =OTG_STATE_A_IDLE ; + }otg_set_host (musb->xceiv->otg, &hcd->self); hcd->self.otg_port =1 ; musb->xceiv->otg->host = &hcd->self;
Greg Kroah-Hartman
maintainerPATCH 100/197 USB: iowarrior: fix info ioctl on big-endian hosts
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit dd5ca753fa92fb736b1395db892bd29f78e6d408 upstream.
Drop erroneous le16_to_cpu when returning the USB device speed which is already in host byte order.
Found using sparse:
warning: cast to restricted __le16
--- drivers/usb/misc/iowarrior.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/misc/iowarrior.c +1 -1
@@ -554,7 +554,7 @@ static long iowarrior_ioctl(struct file info.revision =le16_to_cpu (dev->udev->descriptor.bcdDevice);/* 0==UNKNOWN, 1==LOW(usb1.1) ,2=FULL(usb1.1), 3=HIGH(usb2.0) */ - info.speed =le16_to_cpu (dev->udev->speed); + info.speed = dev->udev->speed; info.if_num = dev->interface->cur_altsetting->desc.bInterfaceNumber; info.report_size = dev->report_size;
Greg Kroah-Hartman
maintainerPATCH 101/197 usb: serial: option: add Telit ME910 support
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniele Palmas <[email protected]>
commit 40dd46048c155b8f0683f468c950a1c107f77a7c upstream.
This patch adds support for Telit ME910 PID 0x1100.
--- drivers/usb/serial/option.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/usb/serial/option.c +8 -0
@@ -281,6 +281,7 @@ static void option_instat_callback(struc#define TELIT_PRODUCT_LE922_USBCFG0 0x1042#define TELIT_PRODUCT_LE922_USBCFG3 0x1043#define TELIT_PRODUCT_LE922_USBCFG5 0x1045 +#define TELIT_PRODUCT_ME910 0x1100#define TELIT_PRODUCT_LE920 0x1200#define TELIT_PRODUCT_LE910 0x1201#define TELIT_PRODUCT_LE910_USBCFG4 0x1206
@@ -640,6 +641,11 @@ static const struct option_blacklist_inf .reserved = BIT(5) | BIT(6), }; +static const struct option_blacklist_info telit_me910_blacklist = { + .sendsetup =BIT (0 ), + .reserved =BIT (1 ) |BIT (3 ), +}; +static const struct option_blacklist_info telit_le910_blacklist = { .sendsetup =BIT (0 ), .reserved =BIT (1 ) |BIT (2 ),
@@ -1235,6 +1241,8 @@ static const struct usb_device_id option .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG5, 0xff), .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg0 }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910), + .driver_info = (kernel_ulong_t)&telit_me910_blacklist }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910), .driver_info = (kernel_ulong_t)&telit_le910_blacklist }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910_USBCFG4),
Greg Kroah-Hartman
maintainerPATCH 103/197 USB: serial: mct_u232: fix big-endian baud-rate handling
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 26cede343656c0bc2c33cdc783771282405c7fb2 upstream.
Drop erroneous cpu_to_le32 when setting the baud rate, something which corrupted the divisor on big-endian hosts.
Found using sparse:
warning: incorrect type in argument 1 (different base types)
expected unsigned int [unsigned] [usertype] val got restricted __le32 [usertype] <noident>
--- drivers/usb/serial/mct_u232.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/serial/mct_u232.c +1 -1
@@ -189,7 +189,7 @@ static int mct_u232_set_baud_rate(structreturn -ENOMEM ; divisor =mct_u232_calculate_baud_rate (serial, value, &speed); -put_unaligned_le32 (cpu_to_le32 (divisor), buf); +put_unaligned_le32 (divisor, buf); rc = usb_control_msg(serial->dev, usb_sndctrlpipe(serial->dev, 0), MCT_U232_SET_BAUD_RATE_REQUEST, MCT_U232_SET_REQUEST_TYPE,
Greg Kroah-Hartman
maintainerPATCH 104/197 USB: serial: io_ti: fix div-by-zero in set_termios
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 6aeb75e6adfaed16e58780309613a578fe1ee90b upstream.
Fix a division-by-zero in set_termios when debugging is enabled and a high-enough speed has been requested so that the divisor value becomes zero.
Instead of just fixing the offending debug statement, cap the baud rate at the base as a zero divisor value also appears to crash the firmware.
--- drivers/usb/serial/io_ti.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/usb/serial/io_ti.c +4 -1
@@ -2349,8 +2349,11 @@ static void change_port_settings(structif (!baud) {/* pick a default, any default... */ baud =9600 ; - }else + }else { +/* Avoid a zero divisor. */ + baud =min (baud,461550 );tty_encode_baud_rate (tty, baud, baud); + } edge_port->baud_rate = baud; config->wBaudRate = (__u16)((461550L + baud/2 ) / baud);
Greg Kroah-Hartman
maintainerPATCH 105/197 USB: hub: fix SS hub-descriptor handling
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 2c25a2c818023df64463aac3288a9f969491e507 upstream.
A SuperSpeed hub descriptor does not have any variable-length fields so bail out when reading a short descriptor.
This avoids parsing and leaking two bytes of uninitialised slab data through sysfs removable-attributes.
--- drivers/usb/core/hub.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/usb/core/hub.c +6 -2
@@ -380,8 +380,12 @@ static int get_hub_descriptor(struct usbUSB_REQ_GET_DESCRIPTOR ,USB_DIR_IN |USB_RT_HUB , dtype <<8 ,0 , data, size, USB_CTRL_GET_TIMEOUT); -if (ret >= (USB_DT_HUB_NONVAR_SIZE +2 )) +if (hub_is_superspeed (hdev)) { +if (ret == size) +return ret; + }else if (ret >= (USB_DT_HUB_NONVAR_SIZE +2 )) {return ret; + } }return -EINVAL ; }
@@ -1321,7 +1325,7 @@ static int hub_configure(struct usb_hub/* Request the entire hub descriptor. * hub->descriptor can handle USB_MAXCHILDREN ports, -* but the hub can/will return fewer bytes here. +* but a (non-SS) hub can/will return fewer bytes here. */ ret =get_hub_descriptor (hdev, hub->descriptor);if (ret <0 ) {
Greg Kroah-Hartman
maintainerPATCH 106/197 USB: hub: fix non-SS hub-descriptor handling
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit bec444cd1c94c48df409a35ad4e5b143c245c3f7 upstream.
Add missing sanity check on the non-SuperSpeed hub-descriptor length in order to avoid parsing and leaking two bytes of uninitialised slab data through sysfs removable-attributes (or a compound-device debug statement).
Note that we only make sure that the DeviceRemovable field is always present (and specifically ignore the unused PortPwrCtrlMask field) in order to continue support any hubs with non-compliant descriptors. As a further safeguard, the descriptor buffer is also cleared.
--- drivers/usb/core/hub.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
drivers/usb/core/hub.c +9 -4
@@ -362,7 +362,8 @@ static void usb_set_lpm_parameters(struc }/* USB 2.0 spec Section 11.24.4.5 */ -static int get_hub_descriptor (struct usb_device *hdev,void *data) +static int get_hub_descriptor (struct usb_device *hdev, +struct usb_hub_descriptor *desc) {int i, ret, size;unsigned dtype;
@@ -378,12 +379,16 @@ static int get_hub_descriptor(struct usbfor (i =0 ; i <3 ; i++) { ret =usb_control_msg (hdev,usb_rcvctrlpipe (hdev,0 ),USB_REQ_GET_DESCRIPTOR ,USB_DIR_IN |USB_RT_HUB , - dtype <<8 ,0 , data, size, + dtype <<8 ,0 , desc, size,USB_CTRL_GET_TIMEOUT );if (hub_is_superspeed (hdev)) {if (ret == size)return ret; - }else if (ret >= (USB_DT_HUB_NONVAR_SIZE +2 )) { + }else if (ret >=USB_DT_HUB_NONVAR_SIZE +2 ) { +/* Make sure we have the DeviceRemovable field. */ + size =USB_DT_HUB_NONVAR_SIZE + desc->bNbrPorts /8 +1 ; +if (ret < size) +return -EMSGSIZE ;return ret; } }
@@ -1317,7 +1322,7 @@ static int hub_configure(struct usb_hub }mutex_init (&hub->status_mutex); - hub->descriptor =kmalloc (sizeof (*hub->descriptor),GFP_KERNEL ); + hub->descriptor =kzalloc (sizeof (*hub->descriptor),GFP_KERNEL );if (!hub->descriptor) { ret = -ENOMEM ; goto fail;
Greg Kroah-Hartman
maintainerPATCH 108/197 iio: proximity: as3935: fix as3935_write
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Ranostay <[email protected]>
commit 84ca8e364acb26aba3292bc113ca8ed4335380fd upstream.
AS3935_WRITE_DATA macro bit is incorrect and the actual write sequence is two leading zeros.
--- drivers/iio/proximity/as3935.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/iio/proximity/as3935.c +1 -2
@@ -50,7 +50,6 @@#define AS3935_TUNE_CAP 0x08#define AS3935_CALIBRATE 0x3D -#define AS3935_WRITE_DATA BIT(15)#define AS3935_READ_DATA BIT(14)#define AS3935_ADDRESS (x) ((x) << 8)
@@ -105,7 +104,7 @@ static int as3935_write(struct as3935_st {u8 *buf = st->buf; - buf[0 ] = (AS3935_WRITE_DATA |AS3935_ADDRESS (reg)) >>8 ; + buf[0 ] =AS3935_ADDRESS (reg) >>8 ; buf[1 ] = val;return spi_write (st->spi, buf,2 );
Greg Kroah-Hartman
maintainerPATCH 109/197 iio: hid-sensor: Store restore poll and hysteresis on S3
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Pandruvada <[email protected]>
commit 5d9854eaea776441b38a9a45b4e6879524c4f48c upstream.
This change undo the change done by 'commit 3bec24747446 ("iio: hid-sensor-trigger: Change get poll value function order to avoid sensor properties losing after resume from S3")' as this breaks some USB/i2c sensor hubs.
Instead of relying on HW for restoring poll and hysteresis, driver stores and restores on resume (S3). In this way user space modified settings are not lost for any kind of sensor hub behavior.
In this change, whenever user space modifies sampling frequency or hysteresis driver will get the feature value from the hub and store in the per device hid_sensor_common data structure. On resume callback from S3, system will set the feature to sensor hub, if user space ever modified the feature value.
--- drivers/iio/common/hid-sensors/hid-sensor-attributes.c | 26 +++++++++++++++-- drivers/iio/common/hid-sensors/hid-sensor-trigger.c | 20 +++++++++++-- include/linux/hid-sensor-hub.h | 2 + 3 files changed, 43 insertions(+), 5 deletions(-)
drivers/iio/common/hid-sensors/hid-sensor-attributes.c +24 -2
@@ -221,7 +221,15 @@ int hid_sensor_write_samp_freq_value(strif (ret <0 || value <0 ) ret = -EINVAL ; -return ret; + ret =sensor_hub_get_feature (st->hsdev, + st->poll.report_id, + st->poll.index,sizeof (value), &value); +if (ret <0 || value <0 ) +return -EINVAL ; + + st->poll_interval = value; + +return 0 ; }EXPORT_SYMBOL (hid_sensor_write_samp_freq_value);
@@ -266,7 +274,16 @@ int hid_sensor_write_raw_hyst_value(struif (ret <0 || value <0 ) ret = -EINVAL ; -return ret; + ret =sensor_hub_get_feature (st->hsdev, + st->sensitivity.report_id, + st->sensitivity.index,sizeof (value), + &value); +if (ret <0 || value <0 ) +return -EINVAL ; + + st->raw_hystersis = value; + +return 0 ; }EXPORT_SYMBOL (hid_sensor_write_raw_hyst_value);
@@ -369,6 +386,9 @@ int hid_sensor_get_reporting_interval(st/* Default unit of measure is milliseconds */ if (st->poll.units ==0 ) st->poll.units =HID_USAGE_SENSOR_UNITS_MILLISECOND ; + + st->poll_interval =-1 ; +return 0 ; }
@@ -399,6 +419,8 @@ int hid_sensor_parse_common_attributes(sHID_USAGE_SENSOR_PROP_SENSITIVITY_ABS , &st->sensitivity); + st->raw_hystersis =-1 ; + sensor_hub_input_get_attribute_info(hsdev, HID_INPUT_REPORT, usage_id, HID_USAGE_SENSOR_TIME_TIMESTAMP,
drivers/iio/common/hid-sensors/hid-sensor-trigger.c +17 -3
@@ -51,6 +51,8 @@ static int _hid_sensor_power_state(struc st->report_state.report_id, st->report_state.index, HID_USAGE_SENSOR_PROP_REPORTING_STATE_ALL_EVENTS_ENUM); + + poll_value =hid_sensor_read_poll_value (st); }else {int val;
@@ -87,9 +89,7 @@ static int _hid_sensor_power_state(strucsensor_hub_get_feature (st->hsdev, st->power_state.report_id, st->power_state.index,sizeof (state_val), &state_val); -if (state) - poll_value =hid_sensor_read_poll_value (st); -if (poll_value >0 ) +if (state && poll_value)msleep_interruptible (poll_value *2 );return 0 ;
@@ -127,6 +127,20 @@ static void hid_sensor_set_power_work(ststruct hid_sensor_common *attrb =container_of (work, struct hid_sensor_common, work); + +if (attrb->poll_interval >=0 ) +sensor_hub_set_feature (attrb->hsdev, attrb->poll.report_id, + attrb->poll.index, +sizeof (attrb->poll_interval), + &attrb->poll_interval); + +if (attrb->raw_hystersis >=0 ) +sensor_hub_set_feature (attrb->hsdev, + attrb->sensitivity.report_id, + attrb->sensitivity.index, +sizeof (attrb->raw_hystersis), + &attrb->raw_hystersis); +_hid_sensor_power_state (attrb, true); }
include/linux/hid-sensor-hub.h +2 -0
@@ -231,6 +231,8 @@ struct hid_sensor_common {unsigned usage_id;atomic_t data_ready;atomic_t user_requested_state; +int poll_interval; +int raw_hystersis;struct iio_trigger *trigger;int timestamp_ns_scale;struct hid_sensor_hub_attribute_info poll;
Greg Kroah-Hartman
maintainerPATCH 110/197 cec: Fix runtime BUG when (CONFIG_RC_CORE && !CEC_CAP_RC)
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lee Jones <[email protected]>
commit 43c0c03961d0b19bd225a336897606b46e0021a6 upstream.
Currently when the RC Core is enabled (reachable) core code located in cec_register_adapter() attempts to populate the RC structure with a pointer to the 'parent' passed in by the caller.
Unfortunately if the caller did not specify RC capability when calling cec_allocate_adapter(), then there will be no RC structure to populate.
This causes a "NULL pointer dereference" error.
--- drivers/media/cec/cec-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/cec/cec-core.c +1 -1
@@ -286,8 +286,8 @@ int cec_register_adapter(struct cec_adap adap->devnode.dev.parent = parent;#if IS_REACHABLE (CONFIG_RC_CORE ) - adap->rc->dev.parent = parent;if (adap->capabilities &CEC_CAP_RC ) { + adap->rc->dev.parent = parent; res =rc_register_device (adap->rc);if (res) {
Greg Kroah-Hartman
maintainerPATCH 111/197 s5p-mfc: Fix race between interrupt routine and device functions
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Szyprowski <[email protected]>
commit 0c32b8ec02832df167e16ad659cb11dc148f2ddf upstream.
Interrupt routine must wake process waiting for given interrupt AFTER updating driver's internal structures and contexts. Doing it in-between is a serious bug. This patch moves all calls to the wake() function to the end of the interrupt processing block to avoid potential and real races, especially on multi-core platforms. This also fixes following issue reported from clock core (clocks were disabled in interrupt after being unprepared from the other place in the driver, the stack trace however points to the different place than s5p_mfc driver because of the race):
WARNING: CPU: 1 PID: 18 at drivers/clk/clk.c:544 clk_core_unprepare+0xc8/0x108 Modules linked in: CPU: 1 PID: 18 Comm: kworker/1:0 Not tainted 4.10.0-next-20170223-00070-g04e18bc99ab9-dirty #2154 Hardware name: SAMSUNG EXYNOS (Flattened Device Tree) Workqueue: pm pm_runtime_work [<c010d8b0>] (unwind_backtrace) from [<c010a534>] (show_stack+0x10/0x14) [<c010a534>] (show_stack) from [<c033292c>] (dump_stack+0x74/0x94) [<c033292c>] (dump_stack) from [<c011cef4>] (__warn+0xd4/0x100) [<c011cef4>] (__warn) from [<c011cf40>] (warn_slowpath_null+0x20/0x28) [<c011cf40>] (warn_slowpath_null) from [<c0387a84>] (clk_core_unprepare+0xc8/0x108) [<c0387a84>] (clk_core_unprepare) from [<c0389d84>] (clk_unprepare+0x24/0x2c) [<c0389d84>] (clk_unprepare) from [<c03d4660>] (exynos_sysmmu_suspend+0x48/0x60) [<c03d4660>] (exynos_sysmmu_suspend) from [<c042b9b0>] (pm_generic_runtime_suspend+0x2c/0x38) [<c042b9b0>] (pm_generic_runtime_suspend) from [<c0437580>] (genpd_runtime_suspend+0x94/0x220) [<c0437580>] (genpd_runtime_suspend) from [<c042e240>] (__rpm_callback+0x134/0x208) [<c042e240>] (__rpm_callback) from [<c042e334>] (rpm_callback+0x20/0x80) [<c042e334>] (rpm_callback) from [<c042d3b8>] (rpm_suspend+0xdc/0x458) [<c042d3b8>] (rpm_suspend) from [<c042ea24>] (pm_runtime_work+0x80/0x90) [<c042ea24>] (pm_runtime_work) from [<c01322c4>] (process_one_work+0x120/0x318) [<c01322c4>] (process_one_work) from [<c0132520>] (worker_thread+0x2c/0x4ac) [<c0132520>] (worker_thread) from [<c0137ab0>] (kthread+0xfc/0x134) [<c0137ab0>] (kthread) from [<c0107978>] (ret_from_fork+0x14/0x3c) ---[ end trace 1ead49a7bb83f0d8 ]---
--- drivers/media/platform/s5p-mfc/s5p_mfc.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-)
drivers/media/platform/s5p-mfc/s5p_mfc.c +4 -8
@@ -666,9 +666,9 @@ static irqreturn_t s5p_mfc_irq(int irq,break ; }s5p_mfc_hw_call (dev->mfc_ops, clear_int_flags, dev); -wake_up_ctx (ctx, reason, err);WARN_ON (test_and_clear_bit (0 , &dev->hw_lock) ==0 );s5p_mfc_clock_off (); +wake_up_ctx (ctx, reason, err);s5p_mfc_hw_call (dev->mfc_ops, try_run, dev); }else {s5p_mfc_handle_frame (ctx, reason, err);
@@ -682,15 +682,11 @@ static irqreturn_t s5p_mfc_irq(int irq,case S5P_MFC_R2H_CMD_OPEN_INSTANCE_RET : ctx->inst_no =s5p_mfc_hw_call (dev->mfc_ops, get_inst_no, dev); ctx->state =MFCINST_GOT_INST ; -clear_work_bit (ctx); -wake_up (&ctx->queue); goto irq_cleanup_hw;case S5P_MFC_R2H_CMD_CLOSE_INSTANCE_RET : -clear_work_bit (ctx); ctx->inst_no =MFC_NO_INSTANCE_SET ; ctx->state =MFCINST_FREE ; -wake_up (&ctx->queue); goto irq_cleanup_hw;case S5P_MFC_R2H_CMD_SYS_INIT_RET :
@@ -700,9 +696,9 @@ static irqreturn_t s5p_mfc_irq(int irq,if (ctx)clear_work_bit (ctx);s5p_mfc_hw_call (dev->mfc_ops, clear_int_flags, dev); -wake_up_dev (dev, reason, err);clear_bit (0 , &dev->hw_lock);clear_bit (0 , &dev->enter_suspend); +wake_up_dev (dev, reason, err);break ;case S5P_MFC_R2H_CMD_INIT_BUFFERS_RET :
@@ -717,9 +713,7 @@ static irqreturn_t s5p_mfc_irq(int irq,break ;case S5P_MFC_R2H_CMD_DPB_FLUSH_RET : -clear_work_bit (ctx); ctx->state =MFCINST_RUNNING ; -wake_up (&ctx->queue); goto irq_cleanup_hw;default :
@@ -738,6 +732,8 @@ irq_cleanup_hw:mfc_err ("Failed to unlock hw\n" );s5p_mfc_clock_off (); +clear_work_bit (ctx); +wake_up (&ctx->queue);s5p_mfc_hw_call (dev->mfc_ops, try_run, dev);spin_unlock (&dev->irqlock);
Greg Kroah-Hartman
maintainerPATCH 112/197 gspca: konica: add missing endpoint sanity check
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit aa58fedb8c7b6cf2f05941d238495f9e2f29655c upstream.
Make sure to check the number of endpoints to avoid accessing memory beyond the endpoint array should a device lack the expected endpoints.
Note that, as far as I can tell, the gspca framework has already made sure there is at least one endpoint in the current alternate setting so there should be no risk for a NULL-pointer dereference here.
konica chipset using cams")
--- drivers/media/usb/gspca/konica.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/media/usb/gspca/konica.c +3 -0
@@ -184,6 +184,9 @@ static int sd_start(struct gspca_dev *gsreturn -EIO ; } +if (alt->desc.bNumEndpoints <2 ) +return -ENODEV ; + packet_size =le16_to_cpu (alt->endpoint[0 ].desc.wMaxPacketSize); n = gspca_dev->cam.cam_mode[gspca_dev->curr_mode].priv;
Greg Kroah-Hartman
maintainerPATCH 113/197 s5p-mfc: Fix unbalanced call to clock management
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Szyprowski <[email protected]>
commit a5cb00eb4223458250b55daf03ac7ea5f424d601 upstream.
Clock should be turned off after calling s5p_mfc_init_hw() from the watchdog worker, like it is already done in the s5p_mfc_open() which also calls this function.
--- drivers/media/platform/s5p-mfc/s5p_mfc.c | 1 + 1 file changed, 1 insertion(+)
drivers/media/platform/s5p-mfc/s5p_mfc.c +1 -0
@@ -206,6 +206,7 @@ static void s5p_mfc_watchdog_worker(stru }s5p_mfc_clock_on (); ret =s5p_mfc_init_hw (dev); +s5p_mfc_clock_off ();if (ret)mfc_err ("Failed to reinit FW\n" ); }
Greg Kroah-Hartman
maintainerPATCH 114/197 dib0700: fix NULL-deref at probe
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit d5823511c0f8719a39e72ede1bce65411ac653b7 upstream.
Make sure to check the number of endpoints to avoid dereferencing a NULL-pointer should a malicious device lack endpoints.
Nova-TD")
--- drivers/media/usb/dvb-usb/dib0700_core.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/media/usb/dvb-usb/dib0700_core.c +3 -0
@@ -809,6 +809,9 @@ int dib0700_rc_setup(struct dvb_usb_devi/* Starting in firmware 1.20, the RC info is provided on a bulk pipe */ +if (intf->altsetting[0 ].desc.bNumEndpoints < rc_ep +1 ) +return -ENODEV ; + purb =usb_alloc_urb (0 ,GFP_KERNEL );if (purb ==NULL )return -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 115/197 zr364xx: enforce minimum size when reading header
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alyssa Milburn <[email protected]>
commit ee0fe833d96793853335844b6d99fb76bd12cbeb upstream.
This code copies actual_length-128 bytes from the header, which will underflow if the received buffer is too small.
--- drivers/media/usb/zr364xx/zr364xx.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/media/usb/zr364xx/zr364xx.c +8 -0
@@ -600,6 +600,14 @@ static int zr364xx_read_video_callback(s ptr = pdest = frm->lpvbits;if (frm->ulState ==ZR364XX_READ_IDLE ) { +if (purb->actual_length <128 ) { +/* header incomplete */ +dev_info (&cam->udev->dev, +"%s: buffer (%d bytes) too small to hold jpeg header. Discarding.\n" , + __func__, purb->actual_length); +return -EINVAL ; + } + frm->ulState =ZR364XX_READ_FRAME ; frm->cur_size =0 ;
Greg Kroah-Hartman
maintainerPATCH 116/197 dvb-frontends/cxd2841er: define symbol_rate_min/max in T/C fe-ops
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Scheller <[email protected]>
commit 158f0328af86a99d64073851967a02694bff987d upstream.
Fixes "w_scan -f c" complaining with
This dvb driver is *buggy*: the symbol rate limits are undefined - please report to linuxtv.org)
--- drivers/media/dvb-frontends/cxd2841er.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/media/dvb-frontends/cxd2841er.c +3 -1
@@ -3852,7 +3852,9 @@ static struct dvb_frontend_ops cxd2841erFE_CAN_MUTE_TS | FE_CAN_2G_MODULATION, .frequency_min = 42000000, - .frequency_max =1002000000 + .frequency_max = 1002000000, + .symbol_rate_min = 870000, + .symbol_rate_max =11700000 }, .init = cxd2841er_init_tc, .sleep = cxd2841er_sleep_tc,
Greg Kroah-Hartman
maintainerPATCH 117/197 digitv: limit messages to buffer size
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alyssa Milburn <[email protected]>
commit 821117dc21083a99dd99174c10848d70ff43de29 upstream.
Return an error rather than memcpy()ing beyond the end of the buffer. Internal callers use appropriate sizes, but digitv_i2c_xfer may not.
--- drivers/media/usb/dvb-usb/digitv.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/media/usb/dvb-usb/digitv.c +3 -0
@@ -33,6 +33,9 @@ static int digitv_ctrl_msg(struct dvb_us wo = (rbuf ==NULL || rlen ==0 );/* write-only */ +if (wlen >4 || rlen >4 ) +return -EIO ; +memset (st->sndbuf,0 ,7 );memset (st->rcvbuf,0 ,7 );
Greg Kroah-Hartman
maintainerPATCH 118/197 dw2102: limit messages to buffer size
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alyssa Milburn <[email protected]>
commit 950e252cb469f323740d78e4907843acef89eedb upstream.
Otherwise the i2c transfer functions can read or write beyond the end of stack or heap buffers.
--- drivers/media/usb/dvb-usb/dw2102.c | 54 +++++++++++++++++++++++++++++++++++++ 1 file changed, 54 insertions(+)
drivers/media/usb/dvb-usb/dw2102.c +54 -0
@@ -204,6 +204,20 @@ static int dw2102_serit_i2c_transfer(strswitch (num) {case 2 : +if (msg[0 ].len !=1 ) { +warn ("i2c rd: len=%d is not 1!\n" , + msg[0 ].len); + num = -EOPNOTSUPP ; +break ; + } + +if (2 + msg[1 ].len >sizeof (buf6)) { +warn ("i2c rd: len=%d is too big!\n" , + msg[1 ].len); + num = -EOPNOTSUPP ; +break ; + } +/* read si2109 register by number */ buf6[0 ] = msg[0 ].addr <<1 ; buf6[1 ] = msg[0 ].len;
@@ -219,6 +233,13 @@ static int dw2102_serit_i2c_transfer(strcase 1 :switch (msg[0 ].addr) {case 0x68 : +if (2 + msg[0 ].len >sizeof (buf6)) { +warn ("i2c wr: len=%d is too big!\n" , + msg[0 ].len); + num = -EOPNOTSUPP ; +break ; + } +/* write to si2109 register */ buf6[0 ] = msg[0 ].addr <<1 ; buf6[1 ] = msg[0 ].len;
@@ -262,6 +283,13 @@ static int dw2102_earda_i2c_transfer(str/* first write first register number */ u8 ibuf[MAX_XFER_SIZE ], obuf[3 ]; +if (2 + msg[0 ].len !=sizeof (obuf)) { +warn ("i2c rd: len=%d is not 1!\n" , + msg[0 ].len); + ret = -EOPNOTSUPP ; + goto unlock; + } +if (2 + msg[1 ].len >sizeof (ibuf)) {warn ("i2c rd: len=%d is too big!\n" , msg[1 ].len);
@@ -462,6 +490,12 @@ static int dw3101_i2c_transfer(struct i2/* first write first register number */ u8 ibuf[MAX_XFER_SIZE ], obuf[3 ]; +if (2 + msg[0 ].len !=sizeof (obuf)) { +warn ("i2c rd: len=%d is not 1!\n" , + msg[0 ].len); + ret = -EOPNOTSUPP ; + goto unlock; + }if (2 + msg[1 ].len >sizeof (ibuf)) {warn ("i2c rd: len=%d is too big!\n" , msg[1 ].len);
@@ -696,6 +730,13 @@ static int su3000_i2c_transfer(struct i2 msg[0 ].buf[0 ] = state->data[1 ];break ;default : +if (3 + msg[0 ].len >sizeof (state->data)) { +warn ("i2c wr: len=%d is too big!\n" , + msg[0 ].len); + num = -EOPNOTSUPP ; +break ; + } +/* always i2c write*/ state->data[0 ] =0x08 ; state->data[1 ] = msg[0 ].addr;
@@ -711,6 +752,19 @@ static int su3000_i2c_transfer(struct i2break ;case 2 :/* always i2c read */ +if (4 + msg[0 ].len >sizeof (state->data)) { +warn ("i2c rd: len=%d is too big!\n" , + msg[0 ].len); + num = -EOPNOTSUPP ; +break ; + } +if (1 + msg[1 ].len >sizeof (state->data)) { +warn ("i2c rd: len=%d is too big!\n" , + msg[1 ].len); + num = -EOPNOTSUPP ; +break ; + } + state->data[0 ] =0x09 ; state->data[1 ] = msg[0 ].len; state->data[2 ] = msg[1 ].len;
Greg Kroah-Hartman
maintainerPATCH 119/197 cx231xx-audio: fix init error path
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit fff1abc4d54e469140a699612b4db8d6397bfcba upstream.
Make sure to release the snd_card also on a late allocation error.
--- drivers/media/usb/cx231xx/cx231xx-audio.c | 25 ++++++++++++++----------- 1 file changed, 14 insertions(+), 11 deletions(-)
drivers/media/usb/cx231xx/cx231xx-audio.c +14 -11
@@ -670,10 +670,8 @@ static int cx231xx_audio_init(struct cx2spin_lock_init (&adev->slock); err =snd_pcm_new (card,"Cx231xx Audio" ,0 ,0 ,1 , &pcm); -if (err <0 ) { -snd_card_free (card); -return err; - } +if (err <0 ) + goto err_free_card;snd_pcm_set_ops (pcm,SNDRV_PCM_STREAM_CAPTURE , &snd_cx231xx_pcm_capture);
@@ -687,10 +685,9 @@ static int cx231xx_audio_init(struct cx2INIT_WORK (&dev->wq_trigger, audio_trigger); err =snd_card_register (card); -if (err <0 ) { -snd_card_free (card); -return err; - } +if (err <0 ) + goto err_free_card; + adev->sndcard = card; adev->udev = dev->udev;
@@ -709,9 +706,10 @@ static int cx231xx_audio_init(struct cx2"audio EndPoint Addr 0x%x, Alternate settings: %i\n" , adev->end_point_addr, adev->num_alt); adev->alt_max_pkt_size =kmalloc (32 * adev->num_alt,GFP_KERNEL ); - -if (adev->alt_max_pkt_size ==NULL ) -return -ENOMEM ; +if (!adev->alt_max_pkt_size) { + err = -ENOMEM ; + goto err_free_card; + }for (i =0 ; i < adev->num_alt; i++) { u16 tmp =
@@ -725,6 +723,11 @@ static int cx231xx_audio_init(struct cx2 }return 0 ; + +err_free_card: +snd_card_free (card); + +return err; }static int cx231xx_audio_fini (struct cx231xx *dev)
Greg Kroah-Hartman
maintainerPATCH 120/197 cx231xx-audio: fix NULL-deref at probe
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 65f921647f4c89a2068478c89691f39b309b58f7 upstream.
Make sure to check the number of endpoints to avoid dereferencing a NULL-pointer or accessing memory beyond the endpoint array should a malicious device lack the expected endpoints.
--- drivers/media/usb/cx231xx/cx231xx-audio.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-)
drivers/media/usb/cx231xx/cx231xx-audio.c +15 -2
@@ -697,6 +697,11 @@ static int cx231xx_audio_init(struct cx2 hs_config_info[0 ].interface_info. audio_index + 1]; +if (uif->altsetting[0 ].desc.bNumEndpoints < isoc_pipe +1 ) { + err = -ENODEV ; + goto err_free_card; + } + adev->end_point_addr = uif->altsetting[0 ].endpoint[isoc_pipe].desc. bEndpointAddress;
@@ -712,8 +717,14 @@ static int cx231xx_audio_init(struct cx2 }for (i =0 ; i < adev->num_alt; i++) { -u16 tmp = -le16_to_cpu (uif->altsetting[i].endpoint[isoc_pipe].desc. +u16 tmp; + +if (uif->altsetting[i].desc.bNumEndpoints < isoc_pipe +1 ) { + err = -ENODEV ; + goto err_free_pkt_size; + } + + tmp =le16_to_cpu (uif->altsetting[i].endpoint[isoc_pipe].desc. wMaxPacketSize); adev->alt_max_pkt_size[i] = (tmp &0x07ff ) * (((tmp &0x1800 ) >>11 ) +1 );
@@ -724,6 +735,8 @@ static int cx231xx_audio_init(struct cx2return 0 ; +err_free_pkt_size: +kfree (adev->alt_max_pkt_size); err_free_card:snd_card_free (card);
Greg Kroah-Hartman
maintainerPATCH 121/197 cx231xx-cards: fix NULL-deref at probe
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 0cd273bb5e4d1828efaaa8dfd11b7928131ed149 upstream.
Make sure to check the number of endpoints to avoid dereferencing a NULL-pointer or accessing memory beyond the endpoint array should a malicious device lack the expected endpoints.
--- drivers/media/usb/cx231xx/cx231xx-cards.c | 45 ++++++++++++++++++++++++++---- 1 file changed, 40 insertions(+), 5 deletions(-)
drivers/media/usb/cx231xx/cx231xx-cards.c +40 -5
@@ -1426,6 +1426,9 @@ static int cx231xx_init_v4l2(struct cx23 uif = udev->actconfig->interface[idx]; +if (uif->altsetting[0 ].desc.bNumEndpoints < isoc_pipe +1 ) +return -ENODEV ; + dev->video_mode.end_point_addr = uif->altsetting[0 ].endpoint[isoc_pipe].desc.bEndpointAddress; dev->video_mode.num_alt = uif->num_altsetting;
@@ -1439,7 +1442,12 @@ static int cx231xx_init_v4l2(struct cx23return -ENOMEM ;for (i =0 ; i < dev->video_mode.num_alt; i++) { -u16 tmp =le16_to_cpu (uif->altsetting[i].endpoint[isoc_pipe].desc.wMaxPacketSize); +u16 tmp; + +if (uif->altsetting[i].desc.bNumEndpoints < isoc_pipe +1 ) +return -ENODEV ; + + tmp =le16_to_cpu (uif->altsetting[i].endpoint[isoc_pipe].desc.wMaxPacketSize); dev->video_mode.alt_max_pkt_size[i] = (tmp &0x07ff ) * (((tmp &0x1800 ) >>11 ) +1 ); dev_dbg(dev->dev, "Alternate setting %i, max size= %i\n", i,
@@ -1456,6 +1464,9 @@ static int cx231xx_init_v4l2(struct cx23 } uif = udev->actconfig->interface[idx]; +if (uif->altsetting[0 ].desc.bNumEndpoints < isoc_pipe +1 ) +return -ENODEV ; + dev->vbi_mode.end_point_addr = uif->altsetting[0 ].endpoint[isoc_pipe].desc. bEndpointAddress;
@@ -1472,8 +1483,12 @@ static int cx231xx_init_v4l2(struct cx23return -ENOMEM ;for (i =0 ; i < dev->vbi_mode.num_alt; i++) { -u16 tmp = -le16_to_cpu (uif->altsetting[i].endpoint[isoc_pipe]. +u16 tmp; + +if (uif->altsetting[i].desc.bNumEndpoints < isoc_pipe +1 ) +return -ENODEV ; + + tmp =le16_to_cpu (uif->altsetting[i].endpoint[isoc_pipe]. desc.wMaxPacketSize); dev->vbi_mode.alt_max_pkt_size[i] = (tmp &0x07ff ) * (((tmp &0x1800 ) >>11 ) +1 );
@@ -1493,6 +1508,9 @@ static int cx231xx_init_v4l2(struct cx23 } uif = udev->actconfig->interface[idx]; +if (uif->altsetting[0 ].desc.bNumEndpoints < isoc_pipe +1 ) +return -ENODEV ; + dev->sliced_cc_mode.end_point_addr = uif->altsetting[0 ].endpoint[isoc_pipe].desc. bEndpointAddress;
@@ -1507,7 +1525,12 @@ static int cx231xx_init_v4l2(struct cx23return -ENOMEM ;for (i =0 ; i < dev->sliced_cc_mode.num_alt; i++) { -u16 tmp =le16_to_cpu (uif->altsetting[i].endpoint[isoc_pipe]. +u16 tmp; + +if (uif->altsetting[i].desc.bNumEndpoints < isoc_pipe +1 ) +return -ENODEV ; + + tmp =le16_to_cpu (uif->altsetting[i].endpoint[isoc_pipe]. desc.wMaxPacketSize); dev->sliced_cc_mode.alt_max_pkt_size[i] = (tmp &0x07ff ) * (((tmp &0x1800 ) >>11 ) +1 );
@@ -1676,6 +1699,11 @@ static int cx231xx_usb_probe(struct usb_ } uif = udev->actconfig->interface[idx]; +if (uif->altsetting[0 ].desc.bNumEndpoints < isoc_pipe +1 ) { + retval = -ENODEV ; + goto err_video_alt; + } + dev->ts1_mode.end_point_addr = uif->altsetting[0 ].endpoint[isoc_pipe]. desc.bEndpointAddress;
@@ -1693,7 +1721,14 @@ static int cx231xx_usb_probe(struct usb_ }for (i =0 ; i < dev->ts1_mode.num_alt; i++) { -u16 tmp =le16_to_cpu (uif->altsetting[i]. +u16 tmp; + +if (uif->altsetting[i].desc.bNumEndpoints < isoc_pipe +1 ) { + retval = -ENODEV ; + goto err_video_alt; + } + + tmp =le16_to_cpu (uif->altsetting[i]. endpoint[isoc_pipe].desc. wMaxPacketSize); dev->ts1_mode.alt_max_pkt_size[i] =
Greg Kroah-Hartman
maintainerPATCH 122/197 powerpc/mm: Ensure IRQs are off in switch_mm()
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Gibson <[email protected]>
commit 9765ad134a00a01cbcc69c78ff6defbfad209bc5 upstream.
powerpc expects IRQs to already be (soft) disabled when switch_mm() is called, as made clear in the commit message of 9c1e105238c4 ("powerpc: Allow perf_counters to access user memory at interrupt time").
Aside from any race conditions that might exist between switch_mm() and an IRQ, there is also an unconditional hard_irq_disable() in switch_slb(). If that isn't followed at some point by an IRQ enable then interrupts will remain disabled until we return to userspace.
It is true that when switch_mm() is called from the scheduler IRQs are off, but not when it's called by use_mm(). Looking closer we see that last year in commit f98db6013c55 ("sched/core: Add switch_mm_irqs_off() and use it in the scheduler") this was made more explicit by the addition of switch_mm_irqs_off() which is now called by the scheduler, vs switch_mm() which is used by use_mm().
Arguably it is a bug in use_mm() to call switch_mm() in a different context than it expects, but fixing that will take time.
This was discovered recently when vhost started throwing warnings such as:
BUG: sleeping function called from invalid context at kernel/mutex.c:578
in_atomic(): 0, irqs_disabled(): 1, pid: 10768, name: vhost-10760
no locks held by vhost-10760/10768.
irq event stamp: 10
hardirqs last enabled at (9): _raw_spin_unlock_irq+0x40/0x80
hardirqs last disabled at (10): switch_slb+0x2e4/0x490
softirqs last enabled at (0): copy_process+0x5e8/0x1260
softirqs last disabled at (0): (null)
Call Trace:
show_stack+0x88/0x390 (unreliable)
dump_stack+0x30/0x44
__might_sleep+0x1c4/0x2d0
mutex_lock_nested+0x74/0x5c0
cgroup_attach_task_all+0x5c/0x180
vhost_attach_cgroups_work+0x58/0x80 [vhost]
vhost_worker+0x24c/0x3d0 [vhost]
kthread+0xec/0x100
ret_from_kernel_thread+0x5c/0xd4Prior to commit 04b96e5528ca ("vhost: lockless enqueuing") (Aug 2016) the vhost_worker() would do a spin_unlock_irq() not long after calling use_mm(), which had the effect of reenabling IRQs. Since that commit removed the locking in vhost_worker() the body of the vhost_worker() loop now runs with interrupts off causing the warnings.
This patch addresses the problem by making the powerpc code mirror the x86 code, ie. we disable interrupts in switch_mm(), and optimise the scheduler case by defining switch_mm_irqs_off().
--- arch/powerpc/include/asm/mmu_context.h | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-)
arch/powerpc/include/asm/mmu_context.h +15 -2
@@ -70,8 +70,9 @@ extern void drop_cop(unsigned long acop,* switch_mm is the entry point called from the architecture independent * code in kernel/sched/core.c */ -static inline void switch_mm (struct mm_struct *prev,struct mm_struct *next, -struct task_struct *tsk) +static inline void switch_mm_irqs_off (struct mm_struct *prev, +struct mm_struct *next, +struct task_struct *tsk) {/* Mark this context has been used on the new CPU */ if (!cpumask_test_cpu (smp_processor_id (),mm_cpumask (next)))
@@ -110,6 +111,18 @@ static inline void switch_mm(struct mm_sswitch_mmu_context (prev, next, tsk); } +static inline void switch_mm (struct mm_struct *prev,struct mm_struct *next, +struct task_struct *tsk) +{ +unsigned long flags; + +local_irq_save (flags); +switch_mm_irqs_off (prev, next, tsk); +local_irq_restore (flags); +} +#define switch_mm_irqs_off switch_mm_irqs_off + +#define deactivate_mm (tsk,mm) do { } while (0)/*
Greg Kroah-Hartman
maintainerPATCH 123/197 powerpc/eeh: Avoid use after free in eeh_handle_special_event()
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Russell Currey <[email protected]>
commit daeba2956f32f91f3493788ff6ee02fb1b2f02fa upstream.
eeh_handle_special_event() is called when an EEH event is detected but can't be narrowed down to a specific PE. This function looks through every PE to find one in an erroneous state, then calls the regular event handler eeh_handle_normal_event() once it knows which PE has an error.
However, if eeh_handle_normal_event() found that the PE cannot possibly be recovered, it will free it, rendering the passed PE stale.
This leads to a use after free in eeh_handle_special_event() as it attempts to clear the "recovering" state on the PE after eeh_handle_normal_event() returns.
Thus, make sure the PE is valid when attempting to clear state in eeh_handle_special_event().
--- arch/powerpc/kernel/eeh_driver.c | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-)
arch/powerpc/kernel/eeh_driver.c +15 -4
@@ -724,7 +724,7 @@ static int eeh_reset_device(struct eeh_p*/ #define MAX_WAIT_FOR_RECOVERY 300 -static void eeh_handle_normal_event (struct eeh_pe *pe) +static bool eeh_handle_normal_event (struct eeh_pe *pe) {struct pci_bus *frozen_bus;struct eeh_dev *edev, *tmp;
@@ -736,7 +736,7 @@ static void eeh_handle_normal_event(struif (!frozen_bus) {pr_err ("%s: Cannot find PCI bus for PHB#%x-PE#%x\n" , __func__, pe->phb->global_number, pe->addr); -return ; +return false; }eeh_pe_update_time_stamp (pe);
@@ -870,7 +870,7 @@ static void eeh_handle_normal_event(strupr_info ("EEH: Notify device driver to resume\n" );eeh_pe_dev_traverse (pe, eeh_report_resume,NULL ); -return ; +return false; excess_failures:/*
@@ -915,8 +915,12 @@ perm_error:pci_lock_rescan_remove ();pci_hp_remove_devices (frozen_bus);pci_unlock_rescan_remove (); + +/* The passed PE should no longer be used */ +return true; } } +return false; }static void eeh_handle_special_event (void )
@@ -982,7 +986,14 @@ static void eeh_handle_special_event(voi*/ if (rc ==EEH_NEXT_ERR_FROZEN_PE || rc ==EEH_NEXT_ERR_FENCED_PHB ) { -eeh_handle_normal_event (pe); +/* +* eeh_handle_normal_event() can make the PE stale if it +* determines that the PE cannot possibly be recovered. +* Don't modify the PE state if that's the case. +*/ +if (eeh_handle_normal_event (pe)) +continue ; +eeh_pe_state_clear (pe,EEH_PE_RECOVERING ); }else {pci_lock_rescan_remove ();
Greg Kroah-Hartman
maintainerPATCH 124/197 powerpc/book3s/mce: Move add_taint() later in virtual mode
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mahesh Salgaonkar <[email protected]>
commit d93b0ac01a9ce276ec39644be47001873d3d183c upstream.
machine_check_early() gets called in real mode. The very first time when add_taint() is called, it prints a warning which ends up calling opal call (that uses OPAL_CALL wrapper) for writing it to console. If we get a very first machine check while we are in opal we are doomed. OPAL_CALL overwrites the PACASAVEDMSR in r13 and in this case when we are done with MCE handling the original opal call will use this new MSR on it's way back to opal_return. This usually leads to unexpected behaviour or the kernel to panic. Instead move the add_taint() call later in the virtual mode where it is safe to call.
This is broken with current FW level. We got lucky so far for not getting very first MCE hit while in OPAL. But easily reproducible on Mambo.
--- arch/powerpc/kernel/mce.c | 2 ++ arch/powerpc/kernel/traps.c | 4 ++-- 2 files changed, 4 insertions(+), 2 deletions(-)
arch/powerpc/kernel/mce.c +2 -0
@@ -221,6 +221,8 @@ static void machine_check_process_queued {int index; +add_taint (TAINT_MACHINE_CHECK ,LOCKDEP_NOW_UNRELIABLE ); +/* * For now just print it to console. * TODO: log this error event to FSP or nvram.
arch/powerpc/kernel/traps.c +2 -2
@@ -306,8 +306,6 @@ long machine_check_early(struct pt_regs__this_cpu_inc (irq_stat.mce_exceptions); -add_taint (TAINT_MACHINE_CHECK ,LOCKDEP_NOW_UNRELIABLE ); -if (cur_cpu_spec && cur_cpu_spec->machine_check_early) handled = cur_cpu_spec->machine_check_early (regs);return handled;
@@ -741,6 +739,8 @@ void machine_check_exception(struct pt_r__this_cpu_inc (irq_stat.mce_exceptions); +add_taint (TAINT_MACHINE_CHECK ,LOCKDEP_NOW_UNRELIABLE ); +/* See if any machine dependent calls. In theory, we would want * to call the CPU first, and call the ppc_md. one if the CPU * one returns a positive number. However there is existing code
Greg Kroah-Hartman
maintainerPATCH 125/197 powerpc/pseries: Fix of_node_put() underflow during DLPAR remove
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tyrel Datwyler <[email protected]>
commit 68baf692c435339e6295cb470ea5545cbc28160e upstream.
Historically struct device_node references were tracked using a kref embedded as a struct field. Commit 75b57ecf9d1d ("of: Make device nodes kobjects so they show up in sysfs") (Mar 2014) refactored device_nodes to be kobjects such that the device tree could by more simply exposed to userspace using sysfs.
Commit 0829f6d1f69e ("of: device_node kobject lifecycle fixes") (Mar 2014) followed up these changes to better control the kobject lifecycle and in particular the referecne counting via of_node_get(), of_node_put(), and of_node_init().
A result of this second commit was that it introduced an of_node_put() call when a dynamic node is detached, in of_node_remove(), that removes the initial kobj reference created by of_node_init().
Traditionally as the original dynamic device node user the pseries code had assumed responsibilty for releasing this final reference in its platform specific DLPAR detach code.
This patch fixes a refcount underflow introduced by commit 0829f6d1f6, and recently exposed by the upstreaming of the recount API.
Messages like the following are no longer seen in the kernel log with this patch following DLPAR remove operations of cpus and pci devices.
rpadlpar_io: slot PHB 72 removed
refcount_t: underflow; use-after-free.
------------[ cut here ]------------ WARNING: CPU: 5 PID: 3335 at lib/refcount.c:128 refcount_sub_and_test+0xf4/0x110
--- arch/powerpc/platforms/pseries/dlpar.c | 1 - 1 file changed, 1 deletion(-)
arch/powerpc/platforms/pseries/dlpar.c +0 -1
@@ -288,7 +288,6 @@ int dlpar_detach_node(struct device_nodeif (rc)return rc; -of_node_put (dn);/* Must decrement the refcount */ return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 126/197 powerpc/sysfs: Fix reference leak of cpu device_nodes present at boot
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tyrel Datwyler <[email protected]>
commit e76ca27790a514590af782f83f6eae49e0ccf8c9 upstream.
For CPUs present at boot each logical CPU acquires a reference to the associated device node of the core. This happens in register_cpu() which is called by topology_init(). The result of this is that we end up with a reference held by each thread of the core. However, these references are never freed if the CPU core is DLPAR removed.
This patch fixes the reference leaks by acquiring and releasing the references in the CPU hotplug callbacks un/register_cpu_online(). With this patch symmetric reference counting is observed with both CPUs present at boot, and those DLPAR added after boot.
--- arch/powerpc/kernel/sysfs.c | 6 ++++++ 1 file changed, 6 insertions(+)
arch/powerpc/kernel/sysfs.c +6 -0
@@ -710,6 +710,10 @@ static int register_cpu_online(unsignedstruct device_attribute *attrs, *pmc_attrs;int i, nattrs; +/* For cpus present at boot a reference was already grabbed in register_cpu() */ +if (!s->of_node) + s->of_node =of_get_cpu_node (cpu,NULL ); +#ifdef CONFIG_PPC64 if (cpu_has_feature (CPU_FTR_SMT ))device_create_file (s, &dev_attr_smt_snooze_delay);
@@ -864,6 +868,8 @@ static int unregister_cpu_online(unsigne }#endif cacheinfo_cpu_offline (cpu); +of_node_put (s->of_node); + s->of_node =NULL ;#endif /* CONFIG_HOTPLUG_CPU */ return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 127/197 powerpc/iommu: Do not call PageTransHuge() on tail pages
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Kardashevskiy <[email protected]>
commit e889e96e98e8da97bd39e46b7253615eabe14397 upstream.
The CMA pages migration code does not support compound pages at the moment so it performs few tests before proceeding to actual page migration.
One of the tests - PageTransHuge() - has VM_BUG_ON_PAGE(PageTail()) as it is designed to be called on head pages only. Since we also test for PageCompound(), and it contains PageTail() and PageHead(), we can simplify the check by leaving just PageCompound() and therefore avoid possible VM_BUG_ON_PAGE.
--- arch/powerpc/mm/mmu_context_iommu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/powerpc/mm/mmu_context_iommu.c +2 -2
@@ -81,7 +81,7 @@ struct page *new_iommu_non_cma_page(strugfp_t gfp_mask =GFP_USER ;struct page *new_page; -if (PageHuge (page) ||PageTransHuge (page) ||PageCompound (page)) +if (PageCompound (page))return NULL ;if (PageHighMem (page))
@@ -100,7 +100,7 @@ static int mm_iommu_move_page_from_cma(sLIST_HEAD (cma_migrate_pages);/* Ignore huge pages for now */ -if (PageHuge (page) ||PageTransHuge (page) ||PageCompound (page)) +if (PageCompound (page))return -EBUSY ;lru_add_drain ();
Greg Kroah-Hartman
maintainerPATCH 128/197 powerpc/powernv: Fix TCE kill on NVLink2
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alistair Popple <[email protected]>
commit 6b3d12a948d27977816a15eb48409a298902a548 upstream.
Commit 616badd2fb49 ("powerpc/powernv: Use OPAL call for TCE kill on NVLink2") forced all TCE kills to go via the OPAL call for NVLink2. However the PHB3 implementation of TCE kill was still being called directly from some functions which in some circumstances caused a machine check.
This patch adds an equivalent IODA2 version of the function which uses the correct invalidation method depending on PHB model and changes all external callers to use it instead.
--- arch/powerpc/platforms/powernv/npu-dma.c | 8 ++++---- arch/powerpc/platforms/powernv/pci-ioda.c | 10 +++++++++- arch/powerpc/platforms/powernv/pci.h | 2 +- 3 files changed, 14 insertions(+), 6 deletions(-)
arch/powerpc/platforms/powernv/npu-dma.c +4 -4
@@ -180,7 +180,7 @@ long pnv_npu_set_window(struct pnv_ioda_pe_err (npe,"Failed to configure TCE table, err %lld\n" , rc);return rc; } -pnv_pci_phb3_tce_invalidate_entire (phb, false); +pnv_pci_ioda2_tce_invalidate_entire (phb, false);/* Add the table to the list so its TCE cache will get invalidated */ pnv_pci_link_table_and_group(phb->hose->node, num,
@@ -204,7 +204,7 @@ long pnv_npu_unset_window(struct pnv_iodpe_err (npe,"Unmapping failed, ret = %lld\n" , rc);return rc; } -pnv_pci_phb3_tce_invalidate_entire (phb, false); +pnv_pci_ioda2_tce_invalidate_entire (phb, false);pnv_pci_unlink_table_and_group (npe->table_group.tables[num], &npe->table_group);
@@ -270,7 +270,7 @@ static int pnv_npu_dma_set_bypass(struct 0 /* bypass base */, top);if (rc ==OPAL_SUCCESS ) -pnv_pci_phb3_tce_invalidate_entire (phb, false); +pnv_pci_ioda2_tce_invalidate_entire (phb, false);return rc; }
@@ -334,7 +334,7 @@ void pnv_npu_take_ownership(struct pnv_ipe_err (npe,"Failed to disable bypass, err %lld\n" , rc);return ; } -pnv_pci_phb3_tce_invalidate_entire (npe->phb, false); +pnv_pci_ioda2_tce_invalidate_entire (npe->phb, false); }struct pnv_ioda_pe *pnv_pci_npu_setup_iommu (struct pnv_ioda_pe *npe)
arch/powerpc/platforms/powernv/pci-ioda.c +9 -1
@@ -1883,7 +1883,7 @@ static struct iommu_table_ops pnv_ioda1_#define PHB3_TCE_KILL_INVAL_PE PPC_BIT(1)#define PHB3_TCE_KILL_INVAL_ONE PPC_BIT(2) -void pnv_pci_phb3_tce_invalidate_entire (struct pnv_phb *phb,bool rm) +static void pnv_pci_phb3_tce_invalidate_entire (struct pnv_phb *phb,bool rm) {__be64 __iomem *invalidate =pnv_ioda_get_inval_reg (phb, rm);const unsigned long val =PHB3_TCE_KILL_INVAL_ALL ;
@@ -1979,6 +1979,14 @@ static void pnv_pci_ioda2_tce_invalidate } } +void pnv_pci_ioda2_tce_invalidate_entire (struct pnv_phb *phb,bool rm) +{ +if (phb->model ==PNV_PHB_MODEL_NPU || phb->model ==PNV_PHB_MODEL_PHB3 ) +pnv_pci_phb3_tce_invalidate_entire (phb, rm); +else +opal_pci_tce_kill (phb->opal_id,OPAL_PCI_TCE_KILL ,0 ,0 ,0 ,0 ); +} + static int pnv_ioda2_tce_build(struct iommu_table *tbl, long index, long npages, unsigned long uaddr, enum dma_data_direction direction,
arch/powerpc/platforms/powernv/pci.h +1 -1
@@ -229,7 +229,7 @@ extern void pe_level_printk(const struct/* Nvlink functions */ extern void pnv_npu_try_dma_set_bypass (struct pci_dev *gpdev,bool bypass); -extern void pnv_pci_phb3_tce_invalidate_entire (struct pnv_phb *phb,bool rm); +extern void pnv_pci_ioda2_tce_invalidate_entire (struct pnv_phb *phb,bool rm);extern struct pnv_ioda_pe *pnv_pci_npu_setup_iommu (struct pnv_ioda_pe *npe);extern long pnv_npu_set_window (struct pnv_ioda_pe *npe,int num,struct iommu_table *tbl);
Greg Kroah-Hartman
maintainerPATCH 129/197 powerpc/64e: Fix hang when debugging programs with relocated kernel
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: LiuHailong <[email protected]>
commit fd615f69a18a9d4aa5ef02a1dc83f319f75da8e7 upstream.
Debug interrupts can be taken during interrupt entry, since interrupt entry does not automatically turn them off. The kernel will check whether the faulting instruction is between [interrupt_base_book3e, __end_interrupts], and if so clear MSR[DE] and return.
However, when the kernel is built with CONFIG_RELOCATABLE, it can't use LOAD_REG_IMMEDIATE(r14,interrupt_base_book3e) and LOAD_REG_IMMEDIATE(r15,__end_interrupts), as they ignore relocation. Thus, if the kernel is actually running at a different address than it was built at, the address comparison will fail, and the exception entry code will hang at kernel_dbg_exc.
r2(toc) is also not usable here, as r2 still holds data from the interrupted context, so LOAD_REG_ADDR() doesn't work either. So we use the *name@got* to get the EV of two labels directly.
Test programs test.c shows as follows:
int main(int argc, char *argv[])
{
if (access("/proc/sys/kernel/perf_event_paranoid", F_OK) == -1)
printf("Kernel doesn't have perf_event support\n");
}Steps to reproduce the bug, for example:
1) ./gdb ./test
2) (gdb) b access
3) (gdb) r
4) (gdb) s
[scottwood: cleaned up commit message, and specified bad behavior
as a hang rather than an oops to correspond to mainline kernel behavior]
--- arch/powerpc/kernel/exceptions-64e.S | 12 ++++++++++++ 1 file changed, 12 insertions(+)
arch/powerpc/kernel/exceptions-64e.S +12 -0
@@ -735,8 +735,14 @@ END_FTR_SECTION_IFSET(CPU_FTR_ALTIVEC) andis. r15,r14,(DBSR_IC|DBSR_BT)@h beq+ 1f +#ifdef CONFIG_RELOCATABLE + ld r15,PACATOC(r13) + ld r14,interrupt_base_book3e@got(r15) + ld r15,__end_interrupts@got(r15) +#else LOAD_REG_IMMEDIATE(r14,interrupt_base_book3e) LOAD_REG_IMMEDIATE(r15,__end_interrupts) +#endif cmpld cr0,r10,r14 cmpld cr1,r10,r15 blt+ cr0,1f
@@ -799,8 +805,14 @@ kernel_dbg_exc: andis. r15,r14,(DBSR_IC|DBSR_BT)@h beq+ 1f +#ifdef CONFIG_RELOCATABLE + ld r15,PACATOC(r13) + ld r14,interrupt_base_book3e@got(r15) + ld r15,__end_interrupts@got(r15) +#else LOAD_REG_IMMEDIATE(r14,interrupt_base_book3e) LOAD_REG_IMMEDIATE(r15,__end_interrupts) +#endif cmpld cr0,r10,r14 cmpld cr1,r10,r15 blt+ cr0,1f
Greg Kroah-Hartman
maintainerPATCH 130/197 powerpc/mm: Fix crash in page table dump with huge pages
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Ellerman <[email protected]>
commit bfb9956ab4d8242f4594b5f4bee534b935384fd9 upstream.
The page table dump code doesn't know about huge pages, so currently it crashes (or walks random memory, usually leading to a crash), if it finds a huge page. On Book3S we only see huge pages in the Linux page tables when we're using the P9 Radix MMU.
Teaching the code to properly handle huge pages is a bit more involved, so for now just prevent the crash.
--- arch/powerpc/mm/dump_linuxpagetables.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
arch/powerpc/mm/dump_linuxpagetables.c +4 -3
@@ -16,6 +16,7 @@*/ #include <linux/debugfs.h> #include <linux/fs.h> +#include <linux/hugetlb.h> #include <linux/io.h> #include <linux/mm.h> #include <linux/sched.h>
@@ -331,7 +332,7 @@ static void walk_pmd(struct pg_state *stfor (i =0 ; i <PTRS_PER_PMD ; i++, pmd++) { addr = start + i *PMD_SIZE ; -if (!pmd_none (*pmd)) +if (!pmd_none (*pmd) && !pmd_huge (*pmd))/* pmd exists */ walk_pte (st, pmd, addr);else
@@ -347,7 +348,7 @@ static void walk_pud(struct pg_state *stfor (i =0 ; i <PTRS_PER_PUD ; i++, pud++) { addr = start + i *PUD_SIZE ; -if (!pud_none (*pud)) +if (!pud_none (*pud) && !pud_huge (*pud))/* pud exists */ walk_pmd (st, pud, addr);else
@@ -367,7 +368,7 @@ static void walk_pagetables(struct pg_st*/ for (i =0 ; i <PTRS_PER_PGD ; i++, pgd++) { addr =KERN_VIRT_START + i *PGDIR_SIZE ; -if (!pgd_none (*pgd)) +if (!pgd_none (*pgd) && !pgd_huge (*pgd))/* pgd exists */ walk_pud (st, pgd, addr);else
Greg Kroah-Hartman
maintainerPATCH 131/197 powerpc/tm: Fix FP and VMX register corruption
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Neuling <[email protected]>
commit f48e91e87e67b56bef63393d1a02c6e22c1d7078 upstream.
In commit dc3106690b20 ("powerpc: tm: Always use fp_state and vr_state to store live registers"), a section of code was removed that copied the current state to checkpointed state. That code should not have been removed.
When an FP (Floating Point) unavailable is taken inside a transaction, we need to abort the transaction. This is because at the time of the tbegin, the FP state is bogus so the state stored in the checkpointed registers is incorrect. To fix this, we treclaim (to get the checkpointed GPRs) and then copy the thread_struct FP live state into the checkpointed state. We then trecheckpoint so that the FP state is correctly restored into the CPU.
The copying of the FP registers from live to checkpointed is what was missing.
This simplifies the logic slightly from the original patch. tm_reclaim_thread() will now always write the checkpointed FP state. Either the checkpointed FP state will be written as part of the actual treclaim (in tm.S), or it'll be a copy of the live state. Which one we use is based on MSR[FP] from userspace.
Similarly for VMX.
--- arch/powerpc/kernel/process.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+)
arch/powerpc/kernel/process.c +19 -0
@@ -864,6 +864,25 @@ static void tm_reclaim_thread(struct thrif (!MSR_TM_SUSPENDED (mfmsr ()))return ; +/* +* If we are in a transaction and FP is off then we can't have +* used FP inside that transaction. Hence the checkpointed +* state is the same as the live state. We need to copy the +* live state to the checkpointed state so that when the +* transaction is restored, the checkpointed state is correct +* and the aborted transaction sees the correct state. We use +* ckpt_regs.msr here as that's what tm_reclaim will use to +* determine if it's going to write the checkpointed state or +* not. So either this will write the checkpointed registers, +* or reclaim will. Similarly for VMX. +*/ +if ((thr->ckpt_regs.msr &MSR_FP ) ==0 ) +memcpy (&thr->ckfp_state, &thr->fp_state, +sizeof (struct thread_fp_state )); +if ((thr->ckpt_regs.msr &MSR_VEC ) ==0 ) +memcpy (&thr->ckvr_state, &thr->vr_state, +sizeof (struct thread_vr_state )); +giveup_all (container_of(thr ,struct task_struct ,thread ));tm_reclaim (thr, thr->ckpt_regs.msr, cause);
Greg Kroah-Hartman
maintainerPATCH 132/197 arm64: KVM: Do not use stack-protector to compile EL2 code
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Zyngier <[email protected]>
commit cde13b5dad60471886a3bccb4f4134c647c4a9dc upstream.
We like living dangerously. Nothing explicitely forbids stack-protector to be used in the EL2 code, while distributions routinely compile their kernel with it. We're just lucky that no code actually triggers the instrumentation.
Let's not try our luck for much longer, and disable stack-protector for code living at EL2.
--- arch/arm64/kvm/hyp/Makefile | 2 ++ 1 file changed, 2 insertions(+)
arch/arm64/kvm/hyp/Makefile +2 -0
@@ -2,6 +2,8 @@ # Makefile for Kernel-based Virtual Machine module, HYP part # +ccflags-y += -fno-stack-protector + KVM=../../../../virt/kvm obj-$(CONFIG_KVM_ARM_HOST) += $(KVM)/arm/hyp/vgic-v2-sr.o
Greg Kroah-Hartman
maintainerPATCH 133/197 arm: KVM: Do not use stack-protector to compile HYP code
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Zyngier <[email protected]>
commit 501ad27c67ed0b90df465f23d33e9aed64058a47 upstream.
We like living dangerously. Nothing explicitely forbids stack-protector to be used in the HYP code, while distributions routinely compile their kernel with it. We're just lucky that no code actually triggers the instrumentation.
Let's not try our luck for much longer, and disable stack-protector for code living at HYP.
--- arch/arm/kvm/hyp/Makefile | 2 ++ 1 file changed, 2 insertions(+)
arch/arm/kvm/hyp/Makefile +2 -0
@@ -2,6 +2,8 @@ # Makefile for Kernel-based Virtual Machine module, HYP part # +ccflags-y += -fno-stack-protector + KVM=../../../../virt/kvm obj-$(CONFIG_KVM_ARM_HOST) += $(KVM)/arm/hyp/vgic-v2-sr.o
Greg Kroah-Hartman
maintainerPATCH 134/197 KVM: arm/arm64: vgic-v2: Do not use Active+Pending state for a HW interrupt
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Zyngier <[email protected]>
commit ddf42d068f8802de122bb7efdfcb3179336053f1 upstream.
When an interrupt is injected with the HW bit set (indicating that deactivation should be propagated to the physical distributor), special care must be taken so that we never mark the corresponding LR with the Active+Pending state (as the pending state is kept in the physycal distributor).
--- virt/kvm/arm/vgic/vgic-v2.c | 7 +++++++ 1 file changed, 7 insertions(+)
virt/kvm/arm/vgic/vgic-v2.c +7 -0
@@ -181,6 +181,13 @@ void vgic_v2_populate_lr(struct kvm_vcpuif (irq->hw) { val |=GICH_LR_HW ; val |= irq->hwintid <<GICH_LR_PHYSID_CPUID_SHIFT ; +/* +* Never set pending+active on a HW interrupt, as the +* pending state is kept at the physical distributor +* level. +*/ +if (irq->active &&irq_is_pending (irq)) + val &= ~GICH_LR_PENDING_BIT ; }else {if (irq->config ==VGIC_CONFIG_LEVEL ) val |=GICH_LR_EOI ;
Greg Kroah-Hartman
maintainerPATCH 135/197 KVM: arm/arm64: vgic-v3: Do not use Active+Pending state for a HW interrupt
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Zyngier <[email protected]>
commit 3d6e77ad1489650afa20da92bb589c8778baa8da upstream.
When an interrupt is injected with the HW bit set (indicating that deactivation should be propagated to the physical distributor), special care must be taken so that we never mark the corresponding LR with the Active+Pending state (as the pending state is kept in the physycal distributor).
--- virt/kvm/arm/vgic/vgic-v3.c | 7 +++++++ 1 file changed, 7 insertions(+)
virt/kvm/arm/vgic/vgic-v3.c +7 -0
@@ -149,6 +149,13 @@ void vgic_v3_populate_lr(struct kvm_vcpuif (irq->hw) { val |=ICH_LR_HW ; val |= ((u64 )irq->hwintid) <<ICH_LR_PHYS_ID_SHIFT ; +/* +* Never set pending+active on a HW interrupt, as the +* pending state is kept at the physical distributor +* level. +*/ +if (irq->active &&irq_is_pending (irq)) + val &= ~ICH_LR_PENDING_BIT ; }else {if (irq->config ==VGIC_CONFIG_LEVEL ) val |=ICH_LR_EOI ;
Greg Kroah-Hartman
maintainerPATCH 137/197 ARM: 8662/1: module: split core and init PLT sections
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ard Biesheuvel <[email protected]>
commit b7ede5a1f5905ac394cc8e61712a13e3c5cb7b8f upstream.
Since commit 35fa91eed817 ("ARM: kernel: merge core and init PLTs"), the ARM module PLT code allocates all PLT entries in a single core section, since the overhead of having a separate init PLT section is not justified by the small number of PLT entries usually required for init code.
However, the core and init module regions are allocated independently, and there is a corner case where the core region may be allocated from the VMALLOC region if the dedicated module region is exhausted, but the init region, being much smaller, can still be allocated from the module region. This puts the PLT entries out of reach of the relocated branch instructions, defeating the whole purpose of PLTs.
So split the core and init PLT regions, and name the latter ".init.plt" so it gets allocated along with (and sufficiently close to) the .init sections that it serves. Also, given that init PLT entries may need to be emitted for branches that target the core module, modify the logic that disregards defined symbols to only disregard symbols that are defined in the same section.
--- arch/arm/include/asm/module.h | 9 +++- arch/arm/kernel/module-plts.c | 85 +++++++++++++++++++++++++++++------------- arch/arm/kernel/module.lds | 1 3 files changed, 67 insertions(+), 28 deletions(-)
arch/arm/include/asm/module.h +7 -2
@@ -18,13 +18,18 @@ enum { };#endif +struct mod_plt_sec { +struct elf32_shdr *plt; +int plt_count; +}; +struct mod_arch_specific {#ifdef CONFIG_ARM_UNWIND struct unwind_table *unwind[ARM_SEC_MAX ];#endif #ifdef CONFIG_ARM_MODULE_PLTS -struct elf32_shdr *plt; -int plt_count; +struct mod_plt_sec core; +struct mod_plt_sec init;#endif };
arch/arm/kernel/module-plts.c +59 -26
153 lines not on this page · raw message
arch/arm/kernel/module.lds +1 -0
@@ -1,3 +1,4 @@ SECTIONS { .plt : { BYTE(0) } + .init.plt : { BYTE(0) } }
Greg Kroah-Hartman
maintainerPATCH 138/197 ARM: 8667/3: Fix memory attribute inconsistencies when using fixmap
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jon Medhurst <[email protected]>
commit b089c31c519c3906c14801b6ec483e18a5152a50 upstream.
To cope with the variety in ARM architectures and configurations, the pagetable attributes for kernel memory are generated at runtime to match the system the kernel finds itself on. This calculated value is stored in pgprot_kernel.
However, when early fixmap support was added for ARM (commit a5f4c561b3b1) the attributes used for mappings were hard coded because pgprot_kernel is not set up early enough. Unfortunately, when fixmap is used after early boot this means the memory being mapped can have different attributes to existing mappings, potentially leading to unpredictable behaviour. A specific problem also exists due to the hard coded values not include the 'shareable' attribute which means on systems where this matters (e.g. those with multiple CPU clusters) the cache contents for a memory location can become inconsistent between CPUs.
To resolve these issues we change fixmap to use the same memory attributes (from pgprot_kernel) that the rest of the kernel uses. To enable this we need to refactor the initialisation code so build_mem_type_table() is called early enough. Note, that relies on early param parsing for memory type overrides passed via the kernel command line, so we need to make sure this call is still after parse_early_params().
[ardb: keep early_fixmap_init() before param parsing, for earlycon]
--- arch/arm/include/asm/fixmap.h | 2 +- arch/arm/kernel/setup.c | 4 ++-- arch/arm/mm/mmu.c | 16 +++++++++++++--- 3 files changed, 16 insertions(+), 6 deletions(-)
arch/arm/include/asm/fixmap.h +1 -1
@@ -41,7 +41,7 @@ static const enum fixed_addresses __end_#define FIXMAP_PAGE_COMMON (L_PTE_YOUNG | L_PTE_PRESENT | L_PTE_XN | L_PTE_DIRTY) -#define FIXMAP_PAGE_NORMAL (FIXMAP_PAGE_COMMON | L_PTE_MT_WRITEBACK) +#define FIXMAP_PAGE_NORMAL (pgprot_kernel | L_PTE_XN)#define FIXMAP_PAGE_RO (FIXMAP_PAGE_NORMAL | L_PTE_RDONLY)/* Used by set_fixmap_(io|nocache), both meant for mapping a device */
arch/arm/kernel/setup.c +2 -2
@@ -80,7 +80,7 @@ __setup("fpe=", fpe_setup);extern void init_default_cache_policy (unsigned long );extern void paging_init (const struct machine_desc *desc); -extern void early_paging_init (const struct machine_desc *); +extern void early_mm_init (const struct machine_desc *);extern void adjust_lowmem_bounds (void );extern enum reboot_mode reboot_mode;extern void setup_dma_zone (const struct machine_desc *desc);
@@ -1088,7 +1088,7 @@ void __init setup_arch(char **cmdline_p)parse_early_param ();#ifdef CONFIG_MMU -early_paging_init (mdesc); +early_mm_init (mdesc);#endif setup_dma_zone (mdesc);xen_early_init ();
arch/arm/mm/mmu.c +13 -3
@@ -414,6 +414,11 @@ void __set_fixmap(enum fixed_addresses i FIXADDR_END);BUG_ON (idx >= __end_of_fixed_addresses); +/* we only support device mappings until pgprot_kernel has been set */ +if (WARN_ON (pgprot_val (prot) !=pgprot_val (FIXMAP_PAGE_IO ) && +pgprot_val (pgprot_kernel) ==0 )) +return ; +if (pgprot_val (prot))set_pte_at (NULL , vaddr, pte,pfn_pte (phys >>PAGE_SHIFT , prot));
@@ -1492,7 +1497,7 @@ pgtables_remap lpae_pgtables_remap_asm;* early_paging_init() recreates boot time page table setup, allowing machines * to switch over to a high (>4G) address space on LPAE systems */ -void __init early_paging_init (const struct machine_desc *mdesc) +static void __init early_paging_init (const struct machine_desc *mdesc) {pgtables_remap *lpae_pgtables_remap;unsigned long pa_pgd;
@@ -1560,7 +1565,7 @@ void __init early_paging_init(const stru#else -void __init early_paging_init (const struct machine_desc *mdesc) +static void __init early_paging_init (const struct machine_desc *mdesc) {long long offset;
@@ -1616,7 +1621,6 @@ void __init paging_init(const struct mac {void *zero_page; -build_mem_type_table ();prepare_page_table ();map_lowmem ();memblock_set_current_limit (arm_lowmem_limit);
@@ -1636,3 +1640,9 @@ void __init paging_init(const struct mac empty_zero_page =virt_to_page (zero_page);__flush_dcache_page (NULL , empty_zero_page); } + +void __init early_mm_init (const struct machine_desc *mdesc) +{ +build_mem_type_table (); +early_paging_init (mdesc); +}
Greg Kroah-Hartman
maintainerPATCH 139/197 ARM: 8670/1: V7M: Do not corrupt vector table around v7m_invalidate_l1 call
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Murzin <[email protected]>
commit 6d80594936914e798b1b54b3bfe4bd68d8418966 upstream.
We save/restore registers around v7m_invalidate_l1 to address pointed by r12, which is vector table, so the first eight entries are overwritten with a garbage. We already have stack setup at that stage, so use it to save/restore register.
--- arch/arm/mm/proc-v7m.S | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/mm/proc-v7m.S +2 -2
@@ -147,10 +147,10 @@ __v7m_setup_cont: @ Configure caches (if implemented) teq r8, #0 - stmneia r12, {r0-r6, lr} @ v7m_invalidate_l1 touches r0-r6 + stmneia sp, {r0-r6, lr} @ v7m_invalidate_l1 touches r0-r6 blne v7m_invalidate_l1 teq r8, #0 @ re-evalutae condition - ldmneia r12, {r0-r6, lr} + ldmneia sp, {r0-r6, lr} @ Configure the System Control Register to ensure 8-byte stack alignment @ Note the STKALIGN bit is either RW or RAO.
Greg Kroah-Hartman
maintainerPATCH 140/197 ARM: dts: at91: sama5d3_xplained: fix ADC vref
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ludovic Desroches <[email protected]>
commit 9cdd31e5913c1f86dce7e201b086155b3f24896b upstream.
The voltage reference for the ADC is not 3V but 3.3V since it is connected to VDDANA.
--- arch/arm/boot/dts/at91-sama5d3_xplained.dts | 1 + 1 file changed, 1 insertion(+)
arch/arm/boot/dts/at91-sama5d3_xplained.dts +1 -0
@@ -162,6 +162,7 @@ }; adc0: adc@f8018000 { + atmel,adc-vref = <3300>; pinctrl-0 = < &pinctrl_adc0_adtrg &pinctrl_adc0_ad0
Greg Kroah-Hartman
maintainerPATCH 141/197 ARM: dts: at91: sama5d3_xplained: not all ADC channels are available
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ludovic Desroches <[email protected]>
commit d3df1ec06353e51fc44563d2e7e18d42811af290 upstream.
Remove ADC channels that are not available by default on the sama5d3_xplained board (resistor not populated) in order to not create confusion.
--- arch/arm/boot/dts/at91-sama5d3_xplained.dts | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
arch/arm/boot/dts/at91-sama5d3_xplained.dts +1 -3
@@ -163,9 +163,9 @@ adc0: adc@f8018000 { atmel,adc-vref = <3300>; + atmel,adc-channels-used = <0xfe>; pinctrl-0 = < &pinctrl_adc0_adtrg - &pinctrl_adc0_ad0 &pinctrl_adc0_ad1 &pinctrl_adc0_ad2 &pinctrl_adc0_ad3
@@ -173,8 +173,6 @@ &pinctrl_adc0_ad5 &pinctrl_adc0_ad6 &pinctrl_adc0_ad7 - &pinctrl_adc0_ad8 - &pinctrl_adc0_ad9 >; status = "okay"; };
Greg Kroah-Hartman
maintainerPATCH 142/197 ARM: dts: imx6sx-sdb: Remove OPP override
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leonard Crestez <[email protected]>
commit d8581c7c8be172dac156a19d261f988a72ce596f upstream.
The board file for imx6sx-sdb overrides cpufreq operating points to use higher voltages. This is done because the board has a shared rail for VDD_ARM_IN and VDD_SOC_IN and when using LDO bypass the shared voltage needs to be a value suitable for both ARM and SOC.
This only applies to LDO bypass mode, a feature not present in upstream. When LDOs are enabled the effect is to use higher voltages than necessary for no good reason.
Setting these higher voltages can make some boards fail to boot with ugly semi-random crashes reminiscent of memory corruption. These failures only happen on board rev. C, rev. B is reported to still work.
--- arch/arm/boot/dts/imx6sx-sdb.dts | 17 ----------------- 1 file changed, 17 deletions(-)
arch/arm/boot/dts/imx6sx-sdb.dts +0 -17
@@ -12,23 +12,6 @@ model = "Freescale i.MX6 SoloX SDB RevB Board"; }; -&cpu0 { - operating-points = < - /* kHz uV */ - 996000 1250000 - 792000 1175000 - 396000 1175000 - 198000 1175000 - >; - fsl,soc-operating-points = < - /* ARM kHz SOC uV */ - 996000 1250000 - 792000 1175000 - 396000 1175000 - 198000 1175000 - >; -}; - &i2c1 { clock-frequency = <100000>; pinctrl-names = "default";
Greg Kroah-Hartman
maintainerPATCH 143/197 arm64: dts: hi6220: Reset the mmc hosts
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Lezcano <[email protected]>
commit 0fbdf9953b41c28845fe8d05007ff09634ee3000 upstream.
The MMC hosts could be left in an unconsistent or uninitialized state from the firmware. Instead of assuming, the firmware did the right things, let's reset the host controllers.
This change fixes a bug when the mmc2/sdio is initialized leading to a hung task:
[ 242.704294] INFO: task kworker/7:1:675 blocked for more than 120 seconds. [ 242.711129] Not tainted 4.9.0-rc8-00017-gcf0251f #3 [ 242.716571] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 242.724435] kworker/7:1 D 0 675 2 0x00000000 [ 242.729973] Workqueue: events_freezable mmc_rescan [ 242.734796] Call trace: [ 242.737269] [<ffff00000808611c>] __switch_to+0xa8/0xb4 [ 242.742437] [<ffff000008d07c04>] __schedule+0x1c0/0x67c [ 242.747689] [<ffff000008d08254>] schedule+0x40/0xa0 [ 242.752594] [<ffff000008d0b284>] schedule_timeout+0x1c4/0x35c [ 242.758366] [<ffff000008d08e38>] wait_for_common+0xd0/0x15c [ 242.763964] [<ffff000008d09008>] wait_for_completion+0x28/0x34 [ 242.769825] [<ffff000008a1a9f4>] mmc_wait_for_req_done+0x40/0x124 [ 242.775949] [<ffff000008a1ab98>] mmc_wait_for_req+0xc0/0xf8 [ 242.781549] [<ffff000008a1ac3c>] mmc_wait_for_cmd+0x6c/0x84 [ 242.787149] [<ffff000008a26610>] mmc_io_rw_direct_host+0x9c/0x114 [ 242.793270] [<ffff000008a26aa0>] sdio_reset+0x34/0x7c [ 242.798347] [<ffff000008a1d46c>] mmc_rescan+0x2fc/0x360
[ ... ]
--- arch/arm64/boot/dts/hisilicon/hi6220.dtsi | 3 +++ 1 file changed, 3 insertions(+)
arch/arm64/boot/dts/hisilicon/hi6220.dtsi +3 -0
@@ -774,6 +774,7 @@ clocks = <&sys_ctrl 2>, <&sys_ctrl 1>; clock-names = "ciu", "biu"; resets = <&sys_ctrl PERIPH_RSTDIS0_MMC0>; + reset-names = "reset"; bus-width = <0x8>; vmmc-supply = <&ldo19>; pinctrl-names = "default";
@@ -797,6 +798,7 @@ clocks = <&sys_ctrl 4>, <&sys_ctrl 3>; clock-names = "ciu", "biu"; resets = <&sys_ctrl PERIPH_RSTDIS0_MMC1>; + reset-names = "reset"; vqmmc-supply = <&ldo7>; vmmc-supply = <&ldo10>; bus-width = <0x4>;
@@ -815,6 +817,7 @@ clocks = <&sys_ctrl HI6220_MMC2_CIUCLK>, <&sys_ctrl HI6220_MMC2_CLK>; clock-names = "ciu", "biu"; resets = <&sys_ctrl PERIPH_RSTDIS0_MMC2>; + reset-names = "reset"; bus-width = <0x4>; broken-cd; pinctrl-names = "default", "idle";
Greg Kroah-Hartman
maintainerPATCH 144/197 arm64: xchg: hazard against entire exchange variable
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <[email protected]>
commit fee960bed5e857eb126c4e56dd9ff85938356579 upstream.
The inline assembly in __XCHG_CASE() uses a +Q constraint to hazard against other accesses to the memory location being exchanged. However, the pointer passed to the constraint is a u8 pointer, and thus the hazard only applies to the first byte of the location.
GCC can take advantage of this, assuming that other portions of the location are unchanged, as demonstrated with the following test case:
union u {
unsigned long l;
unsigned int i[2];
};unsigned long update_char_hazard(union u *u)
{
unsigned int a, b;
a = u->i[1];
asm ("str %1, %0" : "+Q" (*(char *)&u->l) : "r" (0UL));
b = u->i[1];
return a ^ b;
}unsigned long update_long_hazard(union u *u)
{
unsigned int a, b;
a = u->i[1];
asm ("str %1, %0" : "+Q" (*(long *)&u->l) : "r" (0UL));
b = u->i[1];
return a ^ b;
}The linaro 15.08 GCC 5.1.1 toolchain compiles the above as follows when using -O2 or above:
0000000000000000 <update_char_hazard>:
0: d2800001 mov x1, #0x0 // #0
4: f9000001 str x1, [x0]
8: d2800000 mov x0, #0x0 // #0
c: d65f03c0 ret
0000000000000010 <update_long_hazard>:
10: b9400401 ldr w1, [x0,#4]
14: d2800002 mov x2, #0x0 // #0
18: f9000002 str x2, [x0]
1c: b9400400 ldr w0, [x0,#4]
20: 4a000020 eor w0, w1, w0
24: d65f03c0 ret
This patch fixes the issue by passing an unsigned long pointer into the +Q constraint, as we do for our cmpxchg code. This may hazard against more than is necessary, but this is better than missing a necessary hazard.
--- arch/arm64/include/asm/cmpxchg.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/include/asm/cmpxchg.h +1 -1
@@ -46,7 +46,7 @@ static inline unsigned long __xchg_case_ " swp" #acq_lse #rel #sz "\t%" #w "3, %" #w "0, %2\n" \ __nops(3) \ " " #nop_lse) \ - : "=&r" (ret), "=&r" (tmp), "+Q" (*(u8 *)ptr) \ + : "=&r" (ret), "=&r" (tmp), "+Q" (*(unsigned long *)ptr) \ : "r" (x) \ : cl); \ \
Greg Kroah-Hartman
maintainerPATCH 145/197 arm64: ensure extension of smp_store_release value
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <[email protected]>
commit 994870bead4ab19087a79492400a5478e2906196 upstream.
When an inline assembly operand's type is narrower than the register it is allocated to, the least significant bits of the register (up to the operand type's width) are valid, and any other bits are permitted to contain any arbitrary value. This aligns with the AAPCS64 parameter passing rules.
Our __smp_store_release() implementation does not account for this, and implicitly assumes that operands have been zero-extended to the width of the type being stored to. Thus, we may store unknown values to memory when the value type is narrower than the pointer type (e.g. when storing a char to a long).
This patch fixes the issue by casting the value operand to the same width as the pointer operand in all cases, which ensures that the value is zero-extended as we expect. We use the same union trickery as __smp_load_acquire and {READ,WRITE}_ONCE() to avoid GCC complaining that pointers are potentially cast to narrower width integers in unreachable paths.
A whitespace issue at the top of __smp_store_release() is also corrected.
No changes are necessary for __smp_load_acquire(). Load instructions implicitly clear any upper bits of the register, and the compiler will only consider the least significant bits of the register as valid regardless.
--- arch/arm64/include/asm/barrier.h | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-)
arch/arm64/include/asm/barrier.h +15 -5
@@ -42,25 +42,35 @@#define __smp_rmb () dmb(ishld)#define __smp_wmb () dmb(ishst) -#define __smp_store_release (p, v) \ +#define __smp_store_release (p, v) \ do { \ + union { typeof(*p) __val; char __c[1]; } __u = \ + { .__val = (__force typeof(*p)) (v) }; \ compiletime_assert_atomic_type(*p); \ switch (sizeof(*p)) { \ case 1: \ asm volatile ("stlrb %w1, %0" \ - : "=Q" (*p) : "r" (v) : "memory"); \ + : "=Q" (*p) \ + : "r" (*(__u8 *)__u.__c) \ + : "memory"); \ break; \ case 2: \ asm volatile ("stlrh %w1, %0" \ - : "=Q" (*p) : "r" (v) : "memory"); \ + : "=Q" (*p) \ + : "r" (*(__u16 *)__u.__c) \ + : "memory"); \ break; \ case 4: \ asm volatile ("stlr %w1, %0" \ - : "=Q" (*p) : "r" (v) : "memory"); \ + : "=Q" (*p) \ + : "r" (*(__u32 *)__u.__c) \ + : "memory"); \ break; \ case 8: \ asm volatile ("stlr %1, %0" \ - : "=Q" (*p) : "r" (v) : "memory"); \ + : "=Q" (*p) \ + : "r" (*(__u64 *)__u.__c) \ + : "memory"); \ break; \ } \ } while (0)
Greg Kroah-Hartman
maintainerPATCH 146/197 arm64: armv8_deprecated: ensure extension of addr
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <[email protected]>
commit 55de49f9aa17b0b2b144dd2af587177b9aadf429 upstream.
Our compat swp emulation holds the compat user address in an unsigned int, which it passes to __user_swpX_asm(). When a 32-bit value is passed in a register, the upper 32 bits of the register are unknown, and we must extend the value to 64 bits before we can use it as a base address.
This patch casts the address to unsigned long to ensure it has been suitably extended, avoiding the potential issue, and silencing a related warning from clang.
--- arch/arm64/kernel/armv8_deprecated.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/arm64/kernel/armv8_deprecated.c +2 -1
@@ -306,7 +306,8 @@ do { \ _ASM_EXTABLE(0b, 4b) \_ASM_EXTABLE (1b ,4b ) \ : "=&r" (res), "+r" (data), "=&r" (temp), "=&r" (temp2) \ -: " r" (addr), " i" (-EAGAIN), " i" (-EFAULT), \ +: " r" ((unsigned long)addr), " i" (-EAGAIN), \ +" i" (-EFAULT), \ " i" (__SWP_LL_SC_LOOPS) \ : " memory"); \ uaccess_disable(); \
Greg Kroah-Hartman
maintainerPATCH 147/197 arm64: uaccess: ensure extension of access_ok() addr
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <[email protected]>
commit a06040d7a791a9177581dcf7293941bd92400856 upstream.
Our access_ok() simply hands its arguments over to __range_ok(), which implicitly assummes that the addr parameter is 64 bits wide. This isn't necessarily true for compat code, which might pass down a 32-bit address parameter.
In these cases, we don't have a guarantee that the address has been zero extended to 64 bits, and the upper bits of the register may contain unknown values, potentially resulting in a suprious failure.
Avoid this by explicitly casting the addr parameter to an unsigned long (as is done on other architectures), ensuring that the parameter is widened appropriately.
--- arch/arm64/include/asm/uaccess.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/arm64/include/asm/uaccess.h +2 -1
@@ -95,11 +95,12 @@ static inline void set_fs(mm_segment_t f*/ #define __range_ok (addr, size) \ ({ \ + unsigned long __addr = (unsigned long __force)(addr); \ unsigned long flag, roksum; \ __chk_user_ptr(addr); \ asm("adds %1, %1, %3; ccmp %1, %4, #2, cc; cset %0, ls" \ : "=&r" (flag), "=&r" (roksum) \ - : "1" (addr), "Ir" (size), \ + : "1" (__addr), "Ir" (size), \ "r" (current_thread_info()->addr_limit) \ : "cc"); \ flag; \
Greg Kroah-Hartman
maintainerPATCH 148/197 arm64: traps: fix userspace cache maintenance emulation on a tagged pointer
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kristina Martsenko <[email protected]>
commit 81cddd65b5c82758ea5571a25e31ff6f1f89ff02 upstream.
When we emulate userspace cache maintenance in the kernel, we can currently send the task a SIGSEGV even though the maintenance was done on a valid address. This happens if the address has a non-zero address tag, and happens to not be mapped in.
When we get the address from a user register, we don't currently remove the address tag before performing cache maintenance on it. If the maintenance faults, we end up in either __do_page_fault, where find_vma can't find the VMA if the address has a tag, or in do_translation_fault, where the tagged address will appear to be above TASK_SIZE. In both cases, the address is not mapped in, and the task is sent a SIGSEGV.
This patch removes the tag from the address before using it. With this patch, the fault is handled correctly, the address gets mapped in, and the cache maintenance succeeds.
As a second bug, if cache maintenance (correctly) fails on an invalid tagged address, the address gets passed into arm64_notify_segfault, where find_vma fails to find the VMA due to the tag, and the wrong si_code may be sent as part of the siginfo_t of the segfault. With this patch, the correct si_code is sent.
--- arch/arm64/kernel/traps.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/kernel/traps.c +2 -2
@@ -443,7 +443,7 @@ int cpu_enable_cache_maint_trap(void *__ }#define __user_cache_maint (insn, address, res) \ - if (untagged_addr(address) >= user_addr_max()) { \ + if (address >= user_addr_max()) { \ res = -EFAULT; \ } else { \ uaccess_ttbr0_enable(); \
@@ -469,7 +469,7 @@ static void user_cache_maint_handler(unsint crm = (esr & ESR_ELx_SYS64_ISS_CRM_MASK) >> ESR_ELx_SYS64_ISS_CRM_SHIFT;int ret =0 ; - address =pt_regs_read_reg (regs, rt); + address =untagged_addr (pt_regs_read_reg (regs, rt));switch (crm) {case ESR_ELx_SYS64_ISS_CRM_DC_CVAU:/* DC CVAU, gets promoted */
Greg Kroah-Hartman
maintainerPATCH 149/197 arm64: hw_breakpoint: fix watchpoint matching for tagged pointers
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kristina Martsenko <[email protected]>
commit 7dcd9dd8cebe9fa626af7e2358d03a37041a70fb upstream.
When we take a watchpoint exception, the address that triggered the watchpoint is found in FAR_EL1. We compare it to the address of each configured watchpoint to see which one was hit.
The configured watchpoint addresses are untagged, while the address in FAR_EL1 will have an address tag if the data access was done using a tagged address. The tag needs to be removed to compare the address to the watchpoints.
Currently we don't remove it, and as a result can report the wrong watchpoint as being hit (specifically, always either the highest TTBR0 watchpoint or lowest TTBR1 watchpoint). This patch removes the tag.
--- arch/arm64/include/asm/uaccess.h | 6 +++--- arch/arm64/kernel/hw_breakpoint.c | 3 +++ 2 files changed, 6 insertions(+), 3 deletions(-)
arch/arm64/include/asm/uaccess.h +3 -3
@@ -107,9 +107,9 @@ static inline void set_fs(mm_segment_t f })/* -* When dealing with data aborts or instruction traps we may end up with -* a tagged userland pointer. Clear the tag to get a sane pointer to pass -* on to access_ok(), for instance. +* When dealing with data aborts, watchpoints, or instruction traps we may end +* up with a tagged userland pointer. Clear the tag to get a sane pointer to +* pass on to access_ok(), for instance. */ #define untagged_addr (addr) sign_extend64(addr, 55)
arch/arm64/kernel/hw_breakpoint.c +3 -0
@@ -36,6 +36,7 @@#include <asm/traps.h> #include <asm/cputype.h> #include <asm/system_misc.h> +#include <asm/uaccess.h> /* Breakpoint currently in use for each BRP. */ static DEFINE_PER_CPU(struct perf_event *, bp_on_reg[ARM_MAX_BRP]);
@@ -721,6 +722,8 @@ static u64 get_distance_from_watchpoint(u64 wp_low, wp_high;u32 lens, lene; + addr =untagged_addr (addr); + lens =__ffs (ctrl->len); lene =__fls (ctrl->len);
Greg Kroah-Hartman
maintainerPATCH 150/197 arm64: entry: improve data abort handling of tagged pointers
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kristina Martsenko <[email protected]>
commit 276e93279a630657fff4b086ba14c95955912dfa upstream.
When handling a data abort from EL0, we currently zero the top byte of the faulting address, as we assume the address is a TTBR0 address, which may contain a non-zero address tag. However, the address may be a TTBR1 address, in which case we should not zero the top byte. This patch fixes that. The effect is that the full TTBR1 address is passed to the task's signal handler (or printed out in the kernel log).
When handling a data abort from EL1, we leave the faulting address intact, as we assume it's either a TTBR1 address or a TTBR0 address with tag 0x00. This is true as far as I'm aware, we don't seem to access a tagged TTBR0 address anywhere in the kernel. Regardless, it's easy to forget about address tags, and code added in the future may not always remember to remove tags from addresses before accessing them. So add tag handling to the EL1 data abort handler as well. This also makes it consistent with the EL0 data abort handler.
--- arch/arm64/include/asm/asm-uaccess.h | 9 +++++++++ arch/arm64/kernel/entry.S | 5 +++-- 2 files changed, 12 insertions(+), 2 deletions(-)
arch/arm64/include/asm/asm-uaccess.h +9 -0
@@ -62,4 +62,13 @@ alternative_if ARM64_ALT_PAN_NOT_UAO alternative_else_nop_endif .endm +/* +* Remove the address tag from a virtual address, if present. +*/ + .macro clear_address_tag, dst, addr + tst \addr, #(1 << 55) + bic \dst, \addr, #(0xff << 56) + csel \dst, \dst, \addr, eq + .endm + #endif
arch/arm64/kernel/entry.S +3 -2
@@ -428,12 +428,13 @@ el1_da: /* * Data abort handling */ - mrs x0, far_el1 + mrs x3, far_el1 enable_dbg // re-enable interrupts if they were enabled in the aborted context tbnz x23, #7, 1f // PSR_I_BIT enable_irq 1: + clear_address_tag x0, x3 mov x2, sp // struct pt_regs bl do_mem_abort
@@ -594,7 +595,7 @@ el0_da: // enable interrupts before calling the main handler enable_dbg_and_irq ct_user_exit - bic x0, x26, #(0xff << 56) + clear_address_tag x0, x26 mov x1, x25 mov x2, sp bl do_mem_abort
Greg Kroah-Hartman
maintainerPATCH 151/197 arm64: documentation: document tagged pointer stack constraints
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kristina Martsenko <[email protected]>
commit f0e421b1bf7af97f026e1bb8bfe4c5a7a8c08f42 upstream.
Some kernel features don't currently work if a task puts a non-zero address tag in its stack pointer, frame pointer, or frame record entries (FP, LR).
For example, with a tagged stack pointer, the kernel can't deliver signals to the process, and the task is killed instead. As another example, with a tagged frame pointer or frame records, perf fails to generate call graphs or resolve symbols.
For now, just document these limitations, instead of finding and fixing everything that doesn't work, as it's not known if anyone needs to use tags in these places anyway.
In addition, as requested by Dave Martin, generalize the limitations into a general kernel address tag policy, and refactor tagged-pointers.txt to include it.
--- Documentation/arm64/tagged-pointers.txt | 66 +++++++++++++++++++++++--------- 1 file changed, 49 insertions(+), 17 deletions(-)
Documentation/arm64/tagged-pointers.txt +49 -17
@@ -11,24 +11,56 @@ in AArch64 Linux. The kernel configures the translation tables so that translations made via TTBR0 (i.e. userspace mappings) have the top byte (bits 63:56) of the virtual address ignored by the translation hardware. This frees up -this byte for application use, with the following caveats: +this byte for application use. - (1) The kernel requires that all user addresses passed to EL1 - are tagged with tag 0x00. This means that any syscall - parameters containing user virtual addresses *must* have - their top byte cleared before trapping to the kernel. - - (2) Non-zero tags are not preserved when delivering signals. - This means that signal handlers in applications making use - of tags cannot rely on the tag information for user virtual - addresses being maintained for fields inside siginfo_t. - One exception to this rule is for signals raised in response - to watchpoint debug exceptions, where the tag information - will be preserved. - - (3) Special care should be taken when using tagged pointers, - since it is likely that C compilers will not hazard two - virtual addresses differing only in the upper byte. + +Passing tagged addresses to the kernel +-------------------------------------- + +All interpretation of userspace memory addresses by the kernel assumes +an address tag of 0x00. + +This includes, but is not limited to, addresses found in: + + - pointer arguments to system calls, including pointers in structures + passed to system calls, + + - the stack pointer (sp), e.g. when interpreting it to deliver a + signal, + + - the frame pointer (x29) and frame records, e.g. when interpreting + them to generate a backtrace or call graph. + +Using non-zero address tags in any of these locations may result in an +error code being returned, a (fatal) signal being raised, or other modes +of failure. + +For these reasons, passing non-zero address tags to the kernel via +system calls is forbidden, and using a non-zero address tag for sp is +strongly discouraged. + +Programs maintaining a frame pointer and frame records that use non-zero +address tags may suffer impaired or inaccurate debug and profiling +visibility. + + +Preserving tags +--------------- + +Non-zero tags are not preserved when delivering signals. This means that +signal handlers in applications making use of tags cannot rely on the +tag information for user virtual addresses being maintained for fields +inside siginfo_t. One exception to this rule is for signals raised in +response to watchpoint debug exceptions, where the tag information will +be preserved. The architecture prevents the use of a tagged PC, so the upper byte will be set to a sign-extension of bit 55 on exception return. + + +Other considerations +-------------------- + +Special care should be taken when using tagged pointers, since it is +likely that C compilers will not hazard two virtual addresses differing +only in the upper byte.
Greg Kroah-Hartman
maintainerPATCH 152/197 staging: vc04_services: Fix bulk cache maintenance
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Phil Elwell <[email protected]>
commit ff92b9e3c9f85fa442c430d70bf075499e1193b7 upstream.
vchiq_arm supports transfers less than one page and at arbitrary alignment, using the dma-mapping API to perform its cache maintenance (even though the VPU drives the DMA hardware). Read (DMA_FROM_DEVICE) operations use cache invalidation for speed, falling back to clean+invalidate on partial cache lines, with writes (DMA_TO_DEVICE) using flushes.
If a read transfer has ends which aren't page-aligned, performing cache maintenance as if they were whole pages can lead to memory corruption since the partial cache lines at the ends (and any cache lines before or after the transfer area) will be invalidated. This bug was masked until the disabling of the cache flush in flush_dcache_page().
Honouring the requested transfer start- and end-points prevents the corruption.
--- drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c | 31 ++++++---- 1 file changed, 19 insertions(+), 12 deletions(-)
drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c +19 -12
@@ -501,8 +501,15 @@ create_pagelist(char __user *buf, size_t*/ sg_init_table (scatterlist, num_pages);/* Now set the pages for each scatterlist */ -for (i =0 ; i < num_pages; i++) -sg_set_page (scatterlist + i, pages[i],PAGE_SIZE ,0 ); +for (i =0 ; i < num_pages; i++) { +unsigned int len =PAGE_SIZE - offset; + +if (len > count) + len = count; +sg_set_page (scatterlist + i, pages[i], len, offset); + offset =0 ; + count -= len; + } dma_buffers = dma_map_sg(g_dev, scatterlist,
@@ -523,20 +530,20 @@ create_pagelist(char __user *buf, size_tu32 addr =sg_dma_address (sg);/* Note: addrs is the address + page_count - 1 -* The firmware expects the block to be page +* The firmware expects blocks after the first to be page- * aligned and a multiple of the page size */ WARN_ON (len ==0 ); -WARN_ON (len & ~PAGE_MASK ); -WARN_ON (addr & ~PAGE_MASK ); +WARN_ON (i && (i != (dma_buffers -1 )) && (len & ~PAGE_MASK )); +WARN_ON (i && (addr & ~PAGE_MASK ));if (k >0 && - ((addrs[k -1 ] &PAGE_MASK ) | - ((addrs[k -1 ] & ~PAGE_MASK ) +1 ) <<PAGE_SHIFT ) - == addr) { - addrs[k -1 ] += (len >>PAGE_SHIFT ); - }else { - addrs[k++] = addr | ((len >>PAGE_SHIFT ) -1 ); - } + ((addrs[k -1 ] &PAGE_MASK ) + + (((addrs[k -1 ] & ~PAGE_MASK ) +1 ) <<PAGE_SHIFT )) + == (addr &PAGE_MASK )) + addrs[k -1 ] += ((len +PAGE_SIZE -1 ) >>PAGE_SHIFT ); +else + addrs[k++] = (addr &PAGE_MASK ) | + (((len +PAGE_SIZE -1 ) >>PAGE_SHIFT ) -1 ); }/* Partial cache lines (fragments) require special measures */
Greg Kroah-Hartman
maintainerPATCH 153/197 staging: rtl8192e: rtl92e_fill_tx_desc fix write to mapped out memory.
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Malcolm Priestley <[email protected]>
commit baabd567f87be05330faa5140f72a91960e7405a upstream.
The driver attempts to alter memory that is mapped to PCI device.
This is because tx_fwinfo_8190pci points to skb->data
Move the pci_map_single to when completed buffer is ready to be mapped with psdec is empty to drop on mapping error.
--- drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c +9 -4
@@ -1184,8 +1184,7 @@ void rtl92e_fill_tx_desc(struct net_dev struct cb_desc *cb_desc, struct sk_buff *skb) { struct r8192_priv *priv = rtllib_priv(dev); -dma_addr_t mapping =pci_map_single (priv->pdev, skb->data, skb->len, -PCI_DMA_TODEVICE ); +dma_addr_t mapping;struct tx_fwinfo_8190pci *pTxFwInfo; pTxFwInfo = (struct tx_fwinfo_8190pci *)skb->data;
@@ -1196,8 +1195,6 @@ void rtl92e_fill_tx_desc(struct net_dev pTxFwInfo->Short =_rtl92e_query_is_short (pTxFwInfo->TxHT, pTxFwInfo->TxRate, cb_desc); -if (pci_dma_mapping_error (priv->pdev, mapping)) -netdev_err (dev,"%s(): DMA Mapping error\n" , __func__);if (cb_desc->bAMPDUEnable) { pTxFwInfo->AllowAggregation =1 ; pTxFwInfo->RxMF = cb_desc->ampdu_factor;
@@ -1232,6 +1229,14 @@ void rtl92e_fill_tx_desc(struct net_dev }memset ((u8 *)pdesc,0 ,12 ); + + mapping =pci_map_single (priv->pdev, skb->data, skb->len, +PCI_DMA_TODEVICE ); +if (pci_dma_mapping_error (priv->pdev, mapping)) { +netdev_err (dev,"%s(): DMA Mapping error\n" , __func__); +return ; + } + pdesc->LINIP =0 ; pdesc->CmdInit =1 ; pdesc->Offset =sizeof (struct tx_fwinfo_8190pci ) +8 ;
Greg Kroah-Hartman
maintainerPATCH 154/197 staging: rtl8192e: fix 2 byte alignment of register BSSIDR.
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Malcolm Priestley <[email protected]>
commit 867510bde14e7b7fc6dd0f50b48f6753cfbd227a upstream.
BSSIDR has two byte alignment on PCI ioremap correct the write by swapping to 16 bits first.
This fixes a problem that the device associates fail because the filter is not set correctly.
--- drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c +5 -4
@@ -97,8 +97,9 @@ void rtl92e_set_reg(struct net_device *dswitch (variable) {case HW_VAR_BSSID : -rtl92e_writel (dev,BSSIDR , ((u32 *)(val))[0 ]); -rtl92e_writew (dev,BSSIDR +2 , ((u16 *)(val+2 ))[0 ]); +/* BSSIDR 2 byte alignment */ +rtl92e_writew (dev,BSSIDR , *(u16 *)val); +rtl92e_writel (dev,BSSIDR +2 , *(u32 *)(val +2 ));break ;case HW_VAR_MEDIA_STATUS :
@@ -963,8 +964,8 @@ static void _rtl92e_net_update(struct nertl92e_config_rate (dev, &rate_config); priv->dot11CurrentPreambleMode =PREAMBLE_AUTO ; priv->basic_rate = rate_config &=0x15f ; -rtl92e_writel (dev,BSSIDR , ((u32 *)net->bssid)[0 ]); -rtl92e_writew (dev,BSSIDR +4 , ((u16 *)net->bssid)[2 ]); +rtl92e_writew (dev,BSSIDR , *(u16 *)net->bssid); +rtl92e_writel (dev,BSSIDR +2 , *(u32 *)(net->bssid +2 ));if (priv->rtllib->iw_mode ==IW_MODE_ADHOC ) {rtl92e_writew (dev,ATIMWND ,2 );
Greg Kroah-Hartman
maintainerPATCH 155/197 staging: rtl8192e: rtl92e_get_eeprom_size Fix read size of EPROM_CMD.
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Malcolm Priestley <[email protected]>
commit 90be652c9f157d44b9c2803f902a8839796c090d upstream.
EPROM_CMD is 2 byte aligned on PCI map so calling with rtl92e_readl will return invalid data so use rtl92e_readw.
The device is unable to select the right eeprom type.
--- drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c +1 -1
@@ -627,7 +627,7 @@ void rtl92e_get_eeprom_size(struct net_dstruct r8192_priv *priv =rtllib_priv (dev);RT_TRACE (COMP_INIT ,"===========>%s()\n" , __func__); - curCR =rtl92e_readl (dev,EPROM_CMD ); + curCR =rtl92e_readw (dev,EPROM_CMD );RT_TRACE (COMP_INIT ,"read from Reg Cmd9346CR(%x):%x\n" ,EPROM_CMD , curCR); priv->epromtype = (curCR & EPROM_CMD_9356SEL) ? EEPROM_93C56 :
Greg Kroah-Hartman
maintainerPATCH 156/197 staging: rtl8192e: GetTs Fix invalid TID 7 warning.
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Malcolm Priestley <[email protected]>
commit 95d93e271d920dfda369d4740b1cc1061d41fe7f upstream.
TID 7 is a valid value for QoS IEEE 802.11e.
The switch statement that follows states 7 is valid.
Remove function IsACValid and use the default case to filter invalid TIDs.
--- drivers/staging/rtl8192e/rtl819x_TSProc.c | 15 ++++----------- 1 file changed, 4 insertions(+), 11 deletions(-)
drivers/staging/rtl8192e/rtl819x_TSProc.c +4 -11
@@ -306,11 +306,6 @@ static void MakeTSEntry(struct ts_common pTsCommonInfo->TClasNum = TCLAS_Num; } -static bool IsACValid (unsigned int tid) -{ -return tid <7 ; -} -bool GetTs (struct rtllib_device *ieee,struct ts_common_info **ppTS,u8 *Addr,u8 TID ,enum tr_select TxRxSelect,bool bAddNewTs) {
@@ -328,12 +323,6 @@ bool GetTs(struct rtllib_device *ieee, sif (ieee->current_network.qos_data.supported ==0 ) {UP =0 ; }else { -if (!IsACValid (TID )) { -netdev_warn (ieee->dev,"%s(): TID(%d) is not valid\n" , - __func__,TID ); -return false; - } -switch (TID ) {case 0 :case 3 :
@@ -351,6 +340,10 @@ bool GetTs(struct rtllib_device *ieee, scase 7 :UP =7 ;break ; +default : +netdev_warn (ieee->dev,"%s(): TID(%d) is not valid\n" , + __func__,TID ); +return false; } }
Greg Kroah-Hartman
maintainerPATCH 157/197 iommu/vt-d: Flush the IOTLB to get rid of the initial kdump mappings
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: KarimAllah Ahmed <[email protected]>
commit f73a7eee900e95404b61408a23a1df5c5811704c upstream.
Ever since commit 091d42e43d ("iommu/vt-d: Copy translation tables from old kernel") the kdump kernel copies the IOMMU context tables from the previous kernel. Each device mappings will be destroyed once the driver for the respective device takes over.
This unfortunately breaks the workflow of mapping and unmapping a new context to the IOMMU. The mapping function assumes that either:
1) Unmapping did the proper IOMMU flushing and it only ever flush if the IOMMU unit supports caching invalid entries.
2) The system just booted and the initialization code took care of flushing all IOMMU caches.
This assumption is not true for the kdump kernel since the context tables have been copied from the previous kernel and translations could have been cached ever since. So make sure to flush the IOTLB as well when we destroy these old copied mappings.
--- drivers/iommu/intel-iommu.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/iommu/intel-iommu.c +4 -1
@@ -2050,11 +2050,14 @@ static int domain_context_mapping_one(stif (context_copied (context)) {u16 did_old =context_domain_id (context); -if (did_old >=0 && did_old <cap_ndoms (iommu->cap)) +if (did_old >=0 && did_old <cap_ndoms (iommu->cap)) { iommu->flush.flush_context (iommu, did_old, (((u16 )bus) <<8 ) | devfn,DMA_CCMD_MASK_NOBIT ,DMA_CCMD_DEVICE_INVL ); + iommu->flush.flush_iotlb (iommu, did_old,0 ,0 , +DMA_TLB_DSI_FLUSH ); + } } pgd = domain->pgd;
Greg Kroah-Hartman
maintainerPATCH 158/197 cpuidle: check dev before usage in cpuidle_use_deepest_state()
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li, Fei <[email protected]>
commit 41dc750ea67f317c0deedde713d1728425524ef2 upstream.
In case of there is no cpuidle devices registered, dev will be null, and panic will be triggered like below;
In this patch, add checking of dev before usage, like that done in cpuidle_idle_call.
Panic without fix:
[ 184.961328] BUG: unable to handle kernel NULL pointer dereference at (null) [ 184.961328] IP: cpuidle_use_deepest_state+0x30/0x60 ... [ 184.961328] play_idle+0x8d/0x210 [ 184.961328] ? __schedule+0x359/0x8e0 [ 184.961328] ? _raw_spin_unlock_irqrestore+0x28/0x50 [ 184.961328] ? kthread_queue_delayed_work+0x41/0x80 [ 184.961328] clamp_idle_injection_func+0x64/0x1e0
--- drivers/cpuidle/cpuidle.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/cpuidle/cpuidle.c +2 -1
@@ -111,7 +111,8 @@ void cpuidle_use_deepest_state(bool enabpreempt_disable (); dev =cpuidle_get_device (); - dev->use_deepest_state = enable; +if (dev) + dev->use_deepest_state = enable;preempt_enable (); }
Greg Kroah-Hartman
maintainerPATCH 159/197 metag/uaccess: Fix access_ok()
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Hogan <[email protected]>
commit 8a8b56638bcac4e64cccc88bf95a0f9f4b19a2fb upstream.
The __user_bad() macro used by access_ok() has a few corner cases noticed by Al Viro where it doesn't behave correctly:
- The kernel range check has off by 1 errors which permit access to the first and last byte of the kernel mapped range.
- The kernel range check ends at LINCORE_BASE rather than META_MEMORY_LIMIT, which is ineffective when the kernel is in global space (an extremely uncommon configuration).
There are a couple of other shortcomings here too:
- Access to the whole of the other address space is permitted (i.e. the global half of the address space when the kernel is in local space). This isn't ideal as it could theoretically still contain privileged mappings set up by the bootloader.
- The size argument is unused, permitting user copies which start on valid pages at the end of the user address range and cross the boundary into the kernel address space (e.g. addr = 0x3ffffff0, size
Quoted 1 line
0x10).
It isn't very convenient to add size checks when disallowing certain regions, and it seems far safer to be sure and explicit about what userland is able to access, so invert the logic to allow certain regions instead, and fix the off by 1 errors and missing size checks. This also allows the get_fs() == KERNEL_DS check to be more easily optimised into the user address range case.
We now have 3 such allowed regions:
- The user address range (incorporating the get_fs() == KERNEL_DS check).
- NULL (some kernel code expects this to work, and we'll always catch the fault anyway).
- The core code memory region.
--- arch/metag/include/asm/uaccess.h | 40 +++++++++++++++++++++++---------------- 1 file changed, 24 insertions(+), 16 deletions(-)
arch/metag/include/asm/uaccess.h +24 -16
@@ -28,24 +28,32 @@#define segment_eq (a, b) ((a).seg == (b).seg) -#define __kernel_ok (segment_eq(get_fs(), KERNEL_DS)) -/* -* Explicitly allow NULL pointers here. Parts of the kernel such -* as readv/writev use access_ok to validate pointers, but want -* to allow NULL pointers for various reasons. NULL pointers are -* safe to allow through because the first page is not mappable on -* Meta. -* -* We also wish to avoid letting user code access the system area -* and the kernel half of the address space. -*/ -#define __user_bad (addr, size) (((addr) > 0 && (addr) < META_MEMORY_BASE) || \ - ((addr) > PAGE_OFFSET && \ - (addr) < LINCORE_BASE)) -static inline int __access_ok (unsigned long addr,unsigned long size) { -return __kernel_ok || !__user_bad (addr, size); +/* +* Allow access to the user mapped memory area, but not the system area +* before it. The check extends to the top of the address space when +* kernel access is allowed (there's no real reason to user copy to the +* system area in any case). +*/ +if (likely (addr >=META_MEMORY_BASE && addr <get_fs ().seg && + size <=get_fs ().seg - addr)) +return true; +/* +* Explicitly allow NULL pointers here. Parts of the kernel such +* as readv/writev use access_ok to validate pointers, but want +* to allow NULL pointers for various reasons. NULL pointers are +* safe to allow through because the first page is not mappable on +* Meta. +*/ +if (!addr) +return true; +/* Allow access to core code memory area... */ +if (addr >=LINCORE_CODE_BASE && addr <=LINCORE_CODE_LIMIT && + size <=LINCORE_CODE_LIMIT +1 - addr) +return true; +/* ... but no other areas. */ +return false; }#define access_ok (type, addr, size) __access_ok((unsigned long)(addr), \
Greg Kroah-Hartman
maintainerPATCH 160/197 metag/uaccess: Check access_ok in strncpy_from_user
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Hogan <[email protected]>
commit 3a158a62da0673db918b53ac1440845a5b64fd90 upstream.
The metag implementation of strncpy_from_user() doesn't validate the src pointer, which could allow reading of arbitrary kernel memory. Add a short access_ok() check to prevent that.
Its still possible for it to read across the user/kernel boundary, but it will invariably reach a NUL character after only 9 bytes, leaking only a static kernel address being loaded into D0Re0 at the beginning of __start, which is acceptable for the immediate fix.
--- arch/metag/include/asm/uaccess.h | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
arch/metag/include/asm/uaccess.h +7 -2
@@ -194,8 +194,13 @@ do {extern long __must_check __strncpy_from_user (char *dst,const char __user *src,long count); -#define strncpy_from_user (dst, src, count) __strncpy_from_user(dst, src, count) - +static inline long +strncpy_from_user (char *dst,const char __user *src,long count) +{ +if (!access_ok (VERIFY_READ , src,1 )) +return -EFAULT ; +return __strncpy_from_user (dst, src, count); +}/* * Return the size of a string (including the ending 0) *
Greg Kroah-Hartman
maintainerPATCH 161/197 stackprotector: Increase the per-task stack canarys random range from 32 bits to 64 bits on 64-bit platforms
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Micay <[email protected]>
commit 5ea30e4e58040cfd6434c2f33dc3ea76e2c15b05 upstream.
The stack canary is an 'unsigned long' and should be fully initialized to random data rather than only 32 bits of random data.
--- kernel/fork.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/fork.c +1 -1
@@ -536,7 +536,7 @@ static struct task_struct *dup_task_struset_task_stack_end_magic (tsk);#ifdef CONFIG_CC_STACKPROTECTOR - tsk->stack_canary =get_random_int (); + tsk->stack_canary =get_random_long ();#endif /*
Greg Kroah-Hartman
maintainerPATCH 162/197 uwb: fix device quirk on big-endian hosts
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 41318a2b82f5d5fe1fb408f6d6e0b22aa557111d upstream.
Add missing endianness conversion when using the USB device-descriptor idProduct field to apply a hardware quirk.
--- drivers/uwb/i1480/dfu/usb.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/uwb/i1480/dfu/usb.c +3 -2
@@ -341,6 +341,7 @@ error_submit_ep1:static int i1480_usb_probe (struct usb_interface *iface,const struct usb_device_id *id) { +struct usb_device *udev =interface_to_usbdev (iface);struct i1480_usb *i1480_usb;struct i1480 *i1480;struct device *dev = &iface->dev;
@@ -352,8 +353,8 @@ int i1480_usb_probe(struct usb_interface iface->cur_altsetting->desc.bInterfaceNumber); goto error; } -if (iface->num_altsetting >1 - &&interface_to_usbdev (iface)->descriptor.idProduct ==0xbabe ) { +if (iface->num_altsetting >1 && +le16_to_cpu (udev->descriptor.idProduct) ==0xbabe ) {/* Need altsetting #1 [HW QUIRK] or EP1 won't work */ result =usb_set_interface (interface_to_usbdev (iface),0 ,1 );if (result <0 )
Greg Kroah-Hartman
maintainerPATCH 163/197 genirq: Fix chained interrupt data ordering
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <[email protected]>
commit 2c4569ca26986d18243f282dd727da27e9adae4c upstream.
irq_set_chained_handler_and_data() sets up the chained interrupt and then stores the handler data.
That's racy against an immediate interrupt which gets handled before the store of the handler data happened. The handler will dereference a NULL pointer and crash.
Cure it by storing handler data before installing the chained handler.
--- kernel/irq/chip.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/irq/chip.c +1 -1
@@ -877,8 +877,8 @@ irq_set_chained_handler_and_data(unsigneif (!desc)return ; -__irq_do_set_handler (desc, handle,1 ,NULL ); desc->irq_common_data.handler_data = data; +__irq_do_set_handler (desc, handle,1 ,NULL );irq_put_desc_busunlock (desc, flags); }
Greg Kroah-Hartman
maintainerPATCH 164/197 nvme: unmap CMB and remove sysfs file in reset path
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jon Derrick <[email protected]>
commit f63572dff1421b6ca6abce71d46e03411e605c94 upstream.
CMB doesn't get unmapped until removal while getting remapped on every reset. Add the unmapping and sysfs file removal to the reset path in nvme_pci_disable to match the mapping path in nvme_pci_enable.
--- drivers/nvme/host/pci.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/nvme/host/pci.c +6 -1
@@ -1394,6 +1394,11 @@ static inline void nvme_release_cmb(struif (dev->cmb) {iounmap (dev->cmb); dev->cmb =NULL ; +if (dev->cmbsz) { +sysfs_remove_file_from_group (&dev->ctrl.device->kobj, + &dev_attr_cmb.attr,NULL ); + dev->cmbsz =0 ; + } } }
@@ -1665,6 +1670,7 @@ static void nvme_pci_disable(struct nvme {struct pci_dev *pdev =to_pci_dev (dev->dev); +nvme_release_cmb (dev);pci_free_irq_vectors (pdev);if (pci_is_enabled (pdev)) {
@@ -2062,7 +2068,6 @@ static void nvme_remove(struct pci_dev *nvme_dev_disable (dev, true);nvme_dev_remove_admin (dev);nvme_free_queues (dev,0 ); -nvme_release_cmb (dev);nvme_release_prp_pools (dev);nvme_dev_unmap (dev);nvme_put_ctrl (&dev->ctrl);
Greg Kroah-Hartman
maintainerPATCH 165/197 MIPS: Loongson-3: Select MIPS_L1_CACHE_SHIFT_6
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <[email protected]>
commit 17c99d9421695a0e0de18bf1e7091d859e20ec1d upstream.
Some newer Loongson-3 have 64 bytes cache lines, so select MIPS_L1_CACHE_SHIFT_6.
Patchwork: https://patchwork.linux-mips.org/patch/15755/
--- arch/mips/Kconfig | 1 + 1 file changed, 1 insertion(+)
arch/mips/Kconfig +1 -0
@@ -1373,6 +1373,7 @@ config CPU_LOONGSON3 select WEAK_ORDERING select WEAK_REORDERING_BEYOND_LLSC select MIPS_PGD_C0_CONTEXT + select MIPS_L1_CACHE_SHIFT_6 select GPIOLIB help The Loongson 3 processor implements the MIPS64R2 instruction
Greg Kroah-Hartman
maintainerPATCH 168/197 kvm: arm/arm64: Force reading uncached stage2 PGD
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Suzuki K Poulose <[email protected]>
commit 2952a6070e07ebdd5896f1f5b861acad677caded upstream.
Make sure we don't use a cached value of the KVM stage2 PGD while resetting the PGD.
--- arch/arm/kvm/mmu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/kvm/mmu.c +1 -1
@@ -844,7 +844,7 @@ void kvm_free_stage2_pgd(struct kvm *kvmspin_lock (&kvm->mmu_lock);if (kvm->arch.pgd) {unmap_stage2_range (kvm,0 ,KVM_PHYS_SIZE ); - pgd = kvm->arch.pgd; + pgd =READ_ONCE (kvm->arch.pgd); kvm->arch.pgd =NULL ; }spin_unlock (&kvm->mmu_lock);
Greg Kroah-Hartman
maintainerPATCH 169/197 osf_wait4(): fix infoleak
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
commit a8c39544a6eb2093c04afd5005b6192bd0e880c6 upstream.
failing sys_wait4() won't fill struct rusage...
--- arch/alpha/kernel/osf_sys.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
arch/alpha/kernel/osf_sys.c +4 -2
@@ -1199,8 +1199,10 @@ SYSCALL_DEFINE4(osf_wait4, pid_t, pid, iif (!access_ok (VERIFY_WRITE , ur,sizeof (*ur)))return -EFAULT ; - err =0 ; - err |=put_user (status, ustatus); + err =put_user (status, ustatus); +if (ret <0 ) +return err ? err : ret; + err |=__put_user (r.ru_utime.tv_sec, &ur->ru_utime.tv_sec); err |=__put_user (r.ru_utime.tv_usec, &ur->ru_utime.tv_usec); err |=__put_user (r.ru_stime.tv_sec, &ur->ru_stime.tv_sec);
Greg Kroah-Hartman
maintainerPATCH 170/197 drbd: fix request leak introduced by locking/atomic, kref: Kill kref_sub()
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lars Ellenberg <[email protected]>
commit a00ebd1cf12c378a1d4f7a1d6daf1d76c1eaad82 upstream.
When killing kref_sub(), the unconditional additional kref_get() was not properly paired with the necessary kref_put(), causing a leak of struct drbd_requests (~ 224 Bytes) per submitted bio, and breaking DRBD in general, as the destructor of those "drbd_requests" does more than just the mempoll_free().
--- drivers/block/drbd/drbd_req.c | 27 +++++++++++++++------------ 1 file changed, 15 insertions(+), 12 deletions(-)
drivers/block/drbd/drbd_req.c +15 -12
@@ -314,24 +314,32 @@ void drbd_req_complete(struct drbd_reque }/* still holds resource->req_lock */ -static int drbd_req_put_completion_ref (struct drbd_request *req,struct bio_and_error *m,int put) +static void drbd_req_put_completion_ref (struct drbd_request *req,struct bio_and_error *m,int put) {struct drbd_device *device = req->device;D_ASSERT (device, m || (req->rq_state &RQ_POSTPONED )); +if (!put) +return ; +if (!atomic_sub_and_test (put, &req->completion_ref)) -return 0 ; +return ;drbd_req_complete (req, m); +/* local completion may still come in later, +* we need to keep the req object around. */ +if (req->rq_state &RQ_LOCAL_ABORTED ) +return ; +if (req->rq_state &RQ_POSTPONED ) {/* don't destroy the req object just yet, * but queue it for retry */ drbd_restart_request (req); -return 0 ; +return ; } -return 1 ; +kref_put (&req->kref, drbd_req_destroy); }static void set_if_null_req_next (struct drbd_peer_device *peer_device,struct drbd_request *req)
@@ -518,12 +526,8 @@ static void mod_rq_state(struct drbd_reqif (req->i.waiting)wake_up (&device->misc_wait); -if (c_put) { -if (drbd_req_put_completion_ref (req, m, c_put)) -kref_put (&req->kref, drbd_req_destroy); - }else { -kref_put (&req->kref, drbd_req_destroy); - } +drbd_req_put_completion_ref (req, m, c_put); +kref_put (&req->kref, drbd_req_destroy); }static void drbd_report_io_error (struct drbd_device *device,struct drbd_request *req)
@@ -1363,8 +1367,7 @@ nodata: } out: -if (drbd_req_put_completion_ref (req, &m,1 )) -kref_put (&req->kref, drbd_req_destroy); +drbd_req_put_completion_ref (req, &m,1 );spin_unlock_irq (&resource->req_lock);/* Even though above is a kref_put(), this is safe.
Greg Kroah-Hartman
maintainerPATCH 171/197 um: Fix to call read_initrd after init_bootmem
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masami Hiramatsu <[email protected]>
commit 5b4236e17cc1bd9fa14b2b0c7a4ae632d41f2e20 upstream.
Since read_initrd() invokes alloc_bootmem() for allocating memory to load initrd image, it must be called after init_bootmem.
This makes read_initrd() called directly from setup_arch() after init_bootmem() and mem_total_pages().
--- arch/um/kernel/initrd.c | 4 +--- arch/um/kernel/um_arch.c | 6 ++++++ 2 files changed, 7 insertions(+), 3 deletions(-)
arch/um/kernel/initrd.c +1 -3
@@ -14,7 +14,7 @@static char *initrd__initdata =NULL ;static int load_initrd (char *filename,void *buf,int size); -static int __init read_initrd (void ) +int __init read_initrd (void ) {void *area;long long size;
@@ -46,8 +46,6 @@ static int __init read_initrd(void)return 0 ; } -__uml_postsetup (read_initrd); -static int __init uml_initrd_setup (char *line,int *add) { initrd = line;
arch/um/kernel/um_arch.c +6 -0
@@ -338,11 +338,17 @@ int __init linux_main(int argc, char **areturn start_uml (); } +int __init __weak read_initrd (void ) +{ +return 0 ; +} +void __init setup_arch (char **cmdline_p) {stack_protections ((unsigned long ) &init_thread_info);setup_physmem (uml_physmem, uml_reserved, physmem_size, highmem);mem_total_pages (physmem_size, iomem_size, highmem); +read_initrd ();paging_init ();strlcpy (boot_command_line, command_line,COMMAND_LINE_SIZE );
Greg Kroah-Hartman
maintainerPATCH 172/197 firmware: ti_sci: fix strncat length check
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
commit 76cefef8e838304a71725a0b5007c375619d78fb upstream.
gcc-7 notices that the length we pass to strncat is wrong:
drivers/firmware/ti_sci.c: In function 'ti_sci_probe':drivers/firmware/ti_sci.c:204:32: error: specified bound 50 equals the size of the destination [-Werror=stringop-overflow=]
Instead of the total length, we must pass the length of the remaining space here.
--- drivers/firmware/ti_sci.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/firmware/ti_sci.c +2 -1
@@ -202,7 +202,8 @@ static int ti_sci_debugfs_create(struct info->debug_buffer[info->debug_region_size] =0 ; info->d =debugfs_create_file (strncat (debug_name,dev_name (dev), -sizeof (debug_name)), +sizeof (debug_name) - +sizeof ("ti_sci_debug@" )),0444 ,NULL , info, &ti_sci_debug_fops);if (IS_ERR (info->d))return PTR_ERR (info->d);
Greg Kroah-Hartman
maintainerPATCH 173/197 tracing/kprobes: Enforce kprobes teardown after testing
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <[email protected]>
commit 30e7d894c1478c88d50ce94ddcdbd7f9763d9cdd upstream.
Enabling the tracer selftest triggers occasionally the warning in text_poke(), which warns when the to be modified page is not marked reserved.
The reason is that the tracer selftest installs kprobes on functions marked __init for testing. These probes are removed after the tests, but that removal schedules the delayed kprobes_optimizer work, which will do the actual text poke. If the work is executed after the init text is freed, then the warning triggers. The bug can be reproduced reliably when the work delay is increased.
Flush the optimizer work and wait for the optimizing/unoptimizing lists to become empty before returning from the kprobes tracer selftest. That ensures that all operations which were queued due to the probes removal have completed.
--- include/linux/kprobes.h | 3 +++ kernel/kprobes.c | 2 +- kernel/trace/trace_kprobe.c | 5 +++++ 3 files changed, 9 insertions(+), 1 deletion(-)
include/linux/kprobes.h +3 -0
@@ -347,6 +347,9 @@ extern int proc_kprobes_optimization_han int write, void __user *buffer, size_t *length, loff_t *ppos);#endif +extern void wait_for_kprobe_optimizer (void ); +#else +static inline void wait_for_kprobe_optimizer (void ) { }#endif /* CONFIG_OPTPROBES */ #ifdef CONFIG_KPROBES_ON_FTRACE extern void kprobe_ftrace_handler(unsigned long ip, unsigned long parent_ip,
kernel/kprobes.c +1 -1
@@ -598,7 +598,7 @@ static void kprobe_optimizer(struct work }/* Wait for completing optimization and unoptimization */ -static void wait_for_kprobe_optimizer (void ) +void wait_for_kprobe_optimizer (void ) {mutex_lock (&kprobe_mutex);
kernel/trace/trace_kprobe.c +5 -0
@@ -1511,6 +1511,11 @@ static __init int kprobe_trace_self_test end:release_all_trace_kprobes (); +/* +* Wait for the optimizer work to finish. Otherwise it might fiddle +* with probes in already freed __init text. +*/ +wait_for_kprobe_optimizer ();if (warn)pr_cont ("NG: Some tests are failed. Please check them.\n" );else
Greg Kroah-Hartman
maintainerPATCH 174/197 thermal: mt8173: minor mtk_thermal.c cleanups
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dawei Chien <[email protected]>
commit 05d7839aa290901429d8edcd8f7974c9df2bcaa5 upstream.
If thermal bank with 4 sensors, thermal driver should read TEMP_MSR3.
However, currently thermal driver would not read TEMP_MSR3 since mt8173 thermal driver only use 3 sensors on each thermal bank at the same time, so this patch would not effect temperature.
Only if mt mt8173 thermal driver use 4 sensors on any thermal bank, would read third sensor two times, and lose fourth sensor of vale.
--- drivers/thermal/mtk_thermal.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/thermal/mtk_thermal.c +1 -1
@@ -191,7 +191,7 @@ static const int mt8173_bank_data[MT8173 };static const int mt8173_msr[MT8173_NUM_SENSORS_PER_ZONE ] = { -TEMP_MSR0 ,TEMP_MSR1 ,TEMP_MSR2 ,TEMP_MSR2 +TEMP_MSR0 ,TEMP_MSR1 ,TEMP_MSR2 ,TEMP_MSR3 };static const int mt8173_adcpnp[MT8173_NUM_SENSORS_PER_ZONE ] = {
Greg Kroah-Hartman
maintainerPATCH 175/197 PCI/ACPI: Tidy up MCFG quirk whitespace
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bjorn Helgaas <[email protected]>
commit ced414a14f709fc0af60bd381ba8a566dc566869 upstream.
With no blank lines, it's not obvious where the macro definitions end and the uses begin. Add some blank lines and reorder the ThunderX definitions. No functional change intended.
--- drivers/acpi/pci_mcfg.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-)
drivers/acpi/pci_mcfg.c +10 -3
@@ -54,6 +54,7 @@ static struct mcfg_fixup mcfg_quirks[] =#define QCOM_ECAM32 (seg) \ { "QCOM ", "QDF2432 ", 1, seg, MCFG_BUS_ANY, &pci_32b_ops } +QCOM_ECAM32 (0 ),QCOM_ECAM32 (1 ), QCOM_ECAM32(2),
@@ -68,6 +69,7 @@ static struct mcfg_fixup mcfg_quirks[] = { "HISI ", table_id, 0, (seg) + 1, MCFG_BUS_ANY, ops }, \ { "HISI ", table_id, 0, (seg) + 2, MCFG_BUS_ANY, ops }, \ { "HISI ", table_id, 0, (seg) + 3, MCFG_BUS_ANY, ops } +HISI_QUAD_DOM ("HIP05 " ,0 , &hisi_pcie_ops),HISI_QUAD_DOM ("HIP06 " ,0 , &hisi_pcie_ops), HISI_QUAD_DOM("HIP07 ", 0, &hisi_pcie_ops),
@@ -77,6 +79,7 @@ static struct mcfg_fixup mcfg_quirks[] =#define THUNDER_PEM_RES (addr, node) \ DEFINE_RES_MEM((addr) + ((u64) (node) << 44), 0x39 * SZ_16M) +#define THUNDER_PEM_QUIRK (rev, node) \ { "CAVIUM", "THUNDERX", rev, 4 + (10 * (node)), MCFG_BUS_ANY, \ &thunder_pem_ecam_ops, THUNDER_PEM_RES(0x88001f000000UL, node) }, \
@@ -90,13 +93,15 @@ static struct mcfg_fixup mcfg_quirks[] = &thunder_pem_ecam_ops, THUNDER_PEM_RES(0x894057000000UL, node) }, \ {"CAVIUM" ,"THUNDERX" , rev,9 + (10 * (node)),MCFG_BUS_ANY , \ &thunder_pem_ecam_ops, THUNDER_PEM_RES(0x89808f000000UL, node) } -/* SoC pass2.x */ - THUNDER_PEM_QUIRK(1, 0), - THUNDER_PEM_QUIRK(1, 1),#define THUNDER_ECAM_QUIRK (rev, seg) \ { "CAVIUM", "THUNDERX", rev, seg, MCFG_BUS_ANY, \ &pci_thunder_ecam_ops } + +/* SoC pass2.x */ + THUNDER_PEM_QUIRK(1, 0), + THUNDER_PEM_QUIRK(1, 1), +/* SoC pass1.x */ THUNDER_PEM_QUIRK(2, 0), /* off-chip devices */ THUNDER_PEM_QUIRK(2, 1), /* off-chip devices */
@@ -112,9 +117,11 @@ static struct mcfg_fixup mcfg_quirks[] =#define XGENE_V1_ECAM_MCFG (rev, seg) \ {"APM ", "XGENE ", rev, seg, MCFG_BUS_ANY, \ &xgene_v1_pcie_ecam_ops } +#define XGENE_V2_ECAM_MCFG (rev, seg) \ {"APM ", "XGENE ", rev, seg, MCFG_BUS_ANY, \ &xgene_v2_pcie_ecam_ops } +/* X-Gene SoC with v1 PCIe controller */ XGENE_V1_ECAM_MCFG (1 ,0 ), XGENE_V1_ECAM_MCFG(1, 1),
Greg Kroah-Hartman
maintainerPATCH 176/197 PCI/ACPI: Add ThunderX pass2.x 2nd node MCFG quirk
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomasz Nowicki <[email protected]>
commit cd183740480f045600aa1fa38fe70809b5498f05 upstream.
Currently SoCs pass2.x do not emulate EA headers for ACPI boot method at all. However, for pass2.x some devices (like EDAC) advertise incorrect base addresses in their BARs which results in driver probe failure during resource request. Since all problematic blocks are on 2nd NUMA node under domain 10 add necessary quirk entry to obtain BAR addresses correction using EA header emulation.
--- drivers/acpi/pci_mcfg.c | 1 + 1 file changed, 1 insertion(+)
drivers/acpi/pci_mcfg.c +1 -0
@@ -101,6 +101,7 @@ static struct mcfg_fixup mcfg_quirks[] =/* SoC pass2.x */ THUNDER_PEM_QUIRK (1 ,0 ),THUNDER_PEM_QUIRK (1 ,1 ), +THUNDER_ECAM_QUIRK (1 ,10 ),/* SoC pass1.x */ THUNDER_PEM_QUIRK(2, 0), /* off-chip devices */
Greg Kroah-Hartman
maintainerPATCH 177/197 PCI: hv: Allocate interrupt descriptors with GFP_ATOMIC
In reply to Greg Kroah-Hartman4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: K. Y. Srinivasan <[email protected]>
commit 59c58ceeea9cdc6144d7b0303753e6bd26d87455 upstream.
The memory allocation here needs to be non-blocking. Fix the issue.
--- drivers/pci/host/pci-hyperv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pci/host/pci-hyperv.c +1 -1
@@ -876,7 +876,7 @@ static void hv_compose_msi_msg(struct irhv_int_desc_free (hpdev, int_desc); } - int_desc =kzalloc (sizeof (*int_desc),GFP_KERNEL ); + int_desc =kzalloc (sizeof (*int_desc),GFP_ATOMIC );if (!int_desc) goto drop_reference;