4.11.7-stable review

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 fs/read_write.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

fs/read_write.c +1 -1

@@ -1210,7 +1210,7 @@ static size_t compat_writev(struct file
 	if (!(file->f_mode & FMODE_CAN_WRITE))
 		goto out;
 
-	ret = compat_do_readv_writev(WRITE, file, vec, vlen, pos, 0);
+	ret = compat_do_readv_writev(WRITE, file, vec, vlen, pos, flags);
 
 out:
 	if (ret > 0)

Greg Kroah-Hartman

author maintainer

2017-06-19 15:15 UTC #2 lore raw

PATCH 2/78 configfs: Fix race between create_link and configfs_rmdir

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Nicholas Bellinger <[email protected]>

commit ba80aa909c99802c428682c352b0ee0baac0acd3 upstream.

This patch closes a long standing race in configfs between the creation of a new symlink in create_link(), while the symlink target's config_item is being concurrently removed via configfs_rmdir().

This can happen because the symlink target's reference is obtained by config_item_get() in create_link() before the CONFIGFS_USET_DROPPING bit set by configfs_detach_prep() during configfs_rmdir() shutdown is actually checked..

This originally manifested itself on ppc64 on v4.8.y under heavy load using ibmvscsi target ports with Novalink API:

[ 7877.289863] rpadlpar_io: slot U8247.22L.212A91A-V1-C8 added
[ 7879.893760] ------------[ cut here ]------------
[ 7879.893768] WARNING: CPU: 15 PID: 17585 at ./include/linux/kref.h:46 config_item_get+0x7c/0x90 [configfs]
[ 7879.893811] CPU: 15 PID: 17585 Comm: targetcli Tainted: G           O 4.8.17-customv2.22 #12
[ 7879.893812] task: c00000018a0d3400 task.stack: c0000001f3b40000
[ 7879.893813] NIP: d000000002c664ec LR: d000000002c60980 CTR: c000000000b70870
[ 7879.893814] REGS: c0000001f3b43810 TRAP: 0700   Tainted: G O     (4.8.17-customv2.22)
[ 7879.893815] MSR: 8000000000029033 <SF,EE,ME,IR,DR,RI,LE>  CR: 28222242  XER: 00000000
[ 7879.893820] CFAR: d000000002c664bc SOFTE: 1
                GPR00: d000000002c60980 c0000001f3b43a90 d000000002c70908 c0000000fbc06820
                GPR04: c0000001ef1bd900 0000000000000004 0000000000000001 0000000000000000
                GPR08: 0000000000000000 0000000000000001 d000000002c69560 d000000002c66d80
                GPR12: c000000000b70870 c00000000e798700 c0000001f3b43ca0 c0000001d4949d40
                GPR16: c00000014637e1c0 0000000000000000 0000000000000000 c0000000f2392940
                GPR20: c0000001f3b43b98 0000000000000041 0000000000600000 0000000000000000
                GPR24: fffffffffffff000 0000000000000000 d000000002c60be0 c0000001f1dac490
                GPR28: 0000000000000004 0000000000000000 c0000001ef1bd900 c0000000f2392940
[ 7879.893839] NIP [d000000002c664ec] config_item_get+0x7c/0x90 [configfs]
[ 7879.893841] LR [d000000002c60980] check_perm+0x80/0x2e0 [configfs]
[ 7879.893842] Call Trace:
[ 7879.893844] [c0000001f3b43ac0] [d000000002c60980] check_perm+0x80/0x2e0 [configfs]
[ 7879.893847] [c0000001f3b43b10] [c000000000329770] do_dentry_open+0x2c0/0x460
[ 7879.893849] [c0000001f3b43b70] [c000000000344480] path_openat+0x210/0x1490
[ 7879.893851] [c0000001f3b43c80] [c00000000034708c] do_filp_open+0xfc/0x170
[ 7879.893853] [c0000001f3b43db0] [c00000000032b5bc] do_sys_open+0x1cc/0x390
[ 7879.893856] [c0000001f3b43e30] [c000000000009584] system_call+0x38/0xec
[ 7879.893856] Instruction dump:
[ 7879.893858] 409d0014 38210030 e8010010 7c0803a6 4e800020 3d220000 e94981e0 892a0000
[ 7879.893861] 2f890000 409effe0 39200001 992a0000 <0fe00000> 4bffffd0 60000000 60000000
[ 7879.893866] ---[ end trace 14078f0b3b5ad0aa ]---

To close this race, go ahead and obtain the symlink's target config_item reference only after the existing CONFIGFS_USET_DROPPING check succeeds.

This way, if configfs_rmdir() wins create_link() will return -ENONET, and if create_link() wins configfs_rmdir() will return -EBUSY.

Reported-by Bryant G. Ly <[email protected]>

Tested-by Bryant G. Ly <[email protected]>

Signed-off-by Nicholas Bellinger <[email protected]>

Signed-off-by Christoph Hellwig <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 fs/configfs/symlink.c |    3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

fs/configfs/symlink.c +1 -2

@@ -83,14 +83,13 @@ static int create_link(struct config_ite
 	ret = -ENOMEM;
 	sl = kmalloc(sizeof(struct configfs_symlink), GFP_KERNEL);
 	if (sl) {
-		sl->sl_target = config_item_get(item);
 		spin_lock(&configfs_dirent_lock);
 		if (target_sd->s_type & CONFIGFS_USET_DROPPING) {
 			spin_unlock(&configfs_dirent_lock);
-			config_item_put(item);
 			kfree(sl);
 			return -ENOENT;
 		}
+		sl->sl_target = config_item_get(item);
 		list_add(&sl->sl_list, &target_sd->s_links);
 		spin_unlock(&configfs_dirent_lock);
 		ret = configfs_create_link(sl, parent_item->ci_dentry,

Greg Kroah-Hartman

author maintainer

2017-06-19 15:17 UTC #3 lore raw

PATCH 3/78 can: gs_usb: fix memory leak in gs_cmd_reset()

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Marc Kleine-Budde <[email protected]>

commit 5cda3ee5138e91ac369ed9d0b55eab0dab077686 upstream.

This patch adds the missing kfree() in gs_cmd_reset() to free the memory that is not used anymore after usb_control_msg().

Cc Maximilian Schneider <[email protected]>

Signed-off-by Marc Kleine-Budde <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/net/can/usb/gs_usb.c |    2 ++
 1 file changed, 2 insertions(+)

drivers/net/can/usb/gs_usb.c +2 -0

@@ -265,6 +265,8 @@ static int gs_cmd_reset(struct gs_usb *g
 			     sizeof(*dm),
 			     1000);
 
+	kfree(dm);
+
 	return rc;
 }

Greg Kroah-Hartman

author maintainer

2017-06-19 15:18 UTC #4 lore raw

PATCH 4/78 ila_xlat: add missing hash secret initialization

Link https://www.spinics.net/lists/kernel/msg2527243.html

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Arnd Bergmann <[email protected]>

commit 0db47e3d323411beeb6ea97f2c4d19395c91fd8b upstream.

While discussing the possible merits of clang warning about unused initialized functions, I found one function that was clearly meant to be called but never actually is.

__ila_hash_secret_init() initializes the hash value for the ila locator, apparently this is intended to prevent hash collision attacks, but this ends up being a read-only zero constant since there is no caller. I could find no indication of why it was never called, the earliest patch submission for the module already was like this. If my interpretation is right, we certainly want to backport the patch to stable kernels as well.

I considered adding it to the ila_xlat_init callback, but for best effect the random data is read as late as possible, just before it is first used. The underlying net_get_random_once() is already highly optimized to avoid overhead when called frequently.

Fixes 7f00feaf1076 ("ila: Add generic ILA translation facility")

Signed-off-by Arnd Bergmann <[email protected]>

Signed-off-by David S. Miller <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 net/ipv6/ila/ila_xlat.c |    1 +
 1 file changed, 1 insertion(+)

net/ipv6/ila/ila_xlat.c +1 -0

@@ -68,6 +68,7 @@ static inline u32 ila_locator_hash(struc
 {
 	u32 *v = (u32 *)loc.v32;
 
+	__ila_hash_secret_init();
 	return jhash_2words(v[0], v[1], hashrnd);
 }

Greg Kroah-Hartman

author maintainer

2017-06-19 15:18 UTC #5 lore raw

PATCH 6/78 vb2: Fix an off by one error in vb2_plane_vaddr

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Christophe JAILLET <[email protected]>

commit 5ebb6dd36c9f5fb37b1077b393c254d70a14cb46 upstream.

We should ensure that 'plane_no' is '< vb->num_planes' as done in 'vb2_plane_cookie' just a few lines below.

Fixes e23ccc0ad925 ("[media] v4l: add videobuf2 Video for Linux 2 driver framework")

Signed-off-by Christophe JAILLET <[email protected]>

Reviewed-by Sakari Ailus <[email protected]>

Signed-off-by Mauro Carvalho Chehab <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/media/v4l2-core/videobuf2-core.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

drivers/media/v4l2-core/videobuf2-core.c +1 -1

@@ -868,7 +868,7 @@ EXPORT_SYMBOL_GPL(vb2_core_create_bufs);
 
 void *vb2_plane_vaddr(struct vb2_buffer *vb, unsigned int plane_no)
 {
-	if (plane_no > vb->num_planes || !vb->planes[plane_no].mem_priv)
+	if (plane_no >= vb->num_planes || !vb->planes[plane_no].mem_priv)
 		return NULL;
 
 	return call_ptr_memop(vb, vaddr, vb->planes[plane_no].mem_priv);

Greg Kroah-Hartman

author maintainer

2017-06-19 15:18 UTC #6 lore raw

PATCH 7/78 cec: race fix: dont return -ENONET in cec_receive()

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Hans Verkuil <[email protected]>

commit b94aac64a4c17c5af92f9b4ba7164c5b384d5c02 upstream.

When calling CEC_RECEIVE do not check if the adapter is configured. Typically CEC_RECEIVE is called after a select() and if that indicates that there are messages in the receive queue, then you should always be able to dequeue a message.

The race condition here is that a message has been received and is queued, so select() tells userspace that a message is available. But before the application calls CEC_RECEIVE the adapter is unconfigured (e.g. the HDMI cable is removed). Now select will always report that there is a message, but calling CEC_RECEIVE will always return -ENONET because the adapter is no longer configured and so will never actually dequeue the message.

There is really no need for this check, and in fact the ENONET error code was never documented for CEC_RECEIVE. This may have been a left-over of old code that was never updated.

Signed-off-by Mauro Carvalho Chehab <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/media/cec/cec-api.c |    8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

drivers/media/cec/cec-api.c +1 -7

@@ -267,16 +267,10 @@ static long cec_receive(struct cec_adapt
 			bool block, struct cec_msg __user *parg)
 {
 	struct cec_msg msg = {};
-	long err = 0;
+	long err;
 
 	if (copy_from_user(&msg, parg, sizeof(msg)))
 		return -EFAULT;
-	mutex_lock(&adap->lock);
-	if (!adap->is_configured && fh->mode_follower < CEC_MODE_MONITOR)
-		err = -ENONET;
-	mutex_unlock(&adap->lock);
-	if (err)
-		return err;
 
 	err = cec_receive_msg(fh, &msg, block);
 	if (err)

Greg Kroah-Hartman

author maintainer

2017-06-19 15:18 UTC #7 lore raw

PATCH 8/78 selinux: fix double free in selinux_parse_opts_str()

* https://marc.info/?t=149035659300001&r=1&w=2

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Paul Moore <[email protected]>

commit 023f108dcc187e34ef864bf10ed966cf25e14e2a upstream.

This patch is based on a discussion generated by an earlier patch from Tetsuo Handa:

The double free problem involves the mnt_opts field of the security_mnt_opts struct, selinux_parse_opts_str() frees the memory on error, but doesn't set the field to NULL so if the caller later attempts to call security_free_mnt_opts() we trigger the problem.

In order to play it safe we change selinux_parse_opts_str() to call security_free_mnt_opts() on error instead of free'ing the memory directly. This should ensure that everything is handled correctly, regardless of what the caller may do.

Fixes e0007529893c1c06 ("LSM/SELinux: Interfaces to allow FS to control mount options")

Cc Tetsuo Handa <[email protected]>

Reported-by Dmitry Vyukov <[email protected]>

Signed-off-by Paul Moore <[email protected]>

Signed-off-by James Morris <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 security/selinux/hooks.c |    5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

security/selinux/hooks.c +2 -3

@@ -1106,10 +1106,8 @@ static int selinux_parse_opts_str(char *
 
 	opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int),
 				       GFP_KERNEL);
-	if (!opts->mnt_opts_flags) {
-		kfree(opts->mnt_opts);
+	if (!opts->mnt_opts_flags)
 		goto out_err;
-	}
 
 	if (fscontext) {
 		opts->mnt_opts[num_mnt_opts] = fscontext;

@@ -1132,6 +1130,7 @@ static int selinux_parse_opts_str(char *
 	return 0;
 
 out_err:
+	security_free_mnt_opts(opts);
 	kfree(context);
 	kfree(defcontext);
 	kfree(fscontext);

Greg Kroah-Hartman

author maintainer

2017-06-19 15:18 UTC #8 lore raw

PATCH 9/78 mac80211: dont look at the PM bit of BAR frames

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Emmanuel Grumbach <[email protected]>

commit 769dc04db3ed8484798aceb015b94deacc2ba557 upstream.

When a peer sends a BAR frame with PM bit clear, we should not modify its PM state as madated by the spec in 802.11-20012 10.2.1.2.

Signed-off-by Emmanuel Grumbach <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 net/mac80211/rx.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

net/mac80211/rx.c +5 -1

@@ -1587,12 +1587,16 @@ ieee80211_rx_h_sta_process(struct ieee80
 	 */
 	if (!ieee80211_hw_check(&sta->local->hw, AP_LINK_PS) &&
 	    !ieee80211_has_morefrags(hdr->frame_control) &&
+	    !ieee80211_is_back_req(hdr->frame_control) &&
 	    !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
 	    (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
 	     rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
-	    /* PM bit is only checked in frames where it isn't reserved,
+	    /*
+	     * PM bit is only checked in frames where it isn't reserved,
 	     * in AP mode it's reserved in non-bufferable management frames
 	     * (cf. IEEE 802.11-2012 8.2.4.1.7 Power Management field)
+	     * BAR frames should be ignored as specified in
+	     * IEEE 802.11-2012 10.2.1.2.
 	     */
 	    (!ieee80211_is_mgmt(hdr->frame_control) ||
 	     ieee80211_is_bufferable_mmpdu(hdr->frame_control))) {

Greg Kroah-Hartman

author maintainer

2017-06-19 15:15 UTC #9 lore raw

PATCH 10/78 mac80211/wpa: use constant time memory comparison for MACs

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jason A. Donenfeld <[email protected]>

commit 98c67d187db7808b1f3c95f2110dd4392d034182 upstream.

Otherwise, we enable all sorts of forgeries via timing attack.

Signed-off-by Jason A. Donenfeld <[email protected]>

Cc Johannes Berg <[email protected]>

Cc [email protected]

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 net/mac80211/wpa.c |    9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

net/mac80211/wpa.c +5 -4

@@ -17,6 +17,7 @@
 #include <asm/unaligned.h>
 #include <net/mac80211.h>
 #include <crypto/aes.h>
+#include <crypto/algapi.h>
 
 #include "ieee80211_i.h"
 #include "michael.h"

@@ -153,7 +154,7 @@ ieee80211_rx_h_michael_mic_verify(struct
 	data_len = skb->len - hdrlen - MICHAEL_MIC_LEN;
 	key = &rx->key->conf.key[NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY];
 	michael_mic(key, hdr, data, data_len, mic);
-	if (memcmp(mic, data + data_len, MICHAEL_MIC_LEN) != 0)
+	if (crypto_memneq(mic, data + data_len, MICHAEL_MIC_LEN))
 		goto mic_fail;
 
 	/* remove Michael MIC from payload */

@@ -1048,7 +1049,7 @@ ieee80211_crypto_aes_cmac_decrypt(struct
 		bip_aad(skb, aad);
 		ieee80211_aes_cmac(key->u.aes_cmac.tfm, aad,
 				   skb->data + 24, skb->len - 24, mic);
-		if (memcmp(mic, mmie->mic, sizeof(mmie->mic)) != 0) {
+		if (crypto_memneq(mic, mmie->mic, sizeof(mmie->mic))) {
 			key->u.aes_cmac.icverrors++;
 			return RX_DROP_UNUSABLE;
 		}

@@ -1098,7 +1099,7 @@ ieee80211_crypto_aes_cmac_256_decrypt(st
 		bip_aad(skb, aad);
 		ieee80211_aes_cmac_256(key->u.aes_cmac.tfm, aad,
 				       skb->data + 24, skb->len - 24, mic);
-		if (memcmp(mic, mmie->mic, sizeof(mmie->mic)) != 0) {
+		if (crypto_memneq(mic, mmie->mic, sizeof(mmie->mic))) {
 			key->u.aes_cmac.icverrors++;
 			return RX_DROP_UNUSABLE;
 		}

@@ -1202,7 +1203,7 @@ ieee80211_crypto_aes_gmac_decrypt(struct
 		if (ieee80211_aes_gmac(key->u.aes_gmac.tfm, aad, nonce,
 				       skb->data + 24, skb->len - 24,
 				       mic) < 0 ||
-		    memcmp(mic, mmie->mic, sizeof(mmie->mic)) != 0) {
+		    crypto_memneq(mic, mmie->mic, sizeof(mmie->mic))) {
 			key->u.aes_gmac.icverrors++;
 			return RX_DROP_UNUSABLE;
 		}

Greg Kroah-Hartman

author maintainer

2017-06-19 15:16 UTC #10 lore raw

PATCH 11/78 drm: mxsfb_crtc: Reset the eLCDIF controller

Link http://patchwork.freedesktop.org/patch/msgid/[email protected]

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Fabio Estevam <[email protected]>

commit 0f933328f018c118ded2035f12068bbdfdef399d upstream.

According to the eLCDIF initialization steps listed in the MX6SX Reference Manual the eLCDIF block reset is mandatory.

Without performing the eLCDIF reset the display shows garbage content when the kernel boots.

In earlier tests this issue has not been observed because the bootloader was previously showing a splash screen and the bootloader display driver does properly implement the eLCDIF reset.

Add the eLCDIF reset to the driver, so that it can operate correctly independently of the bootloader.

Tested on a imx6sx-sdb board.

Signed-off-by Fabio Estevam <[email protected]>

Signed-off-by Sean Paul <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/gpu/drm/mxsfb/mxsfb_crtc.c |   42 +++++++++++++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)

drivers/gpu/drm/mxsfb/mxsfb_crtc.c +42 -0

@@ -35,6 +35,13 @@
 #include "mxsfb_drv.h"
 #include "mxsfb_regs.h"
 
+#define MXS_SET_ADDR		0x4
+#define MXS_CLR_ADDR		0x8
+#define MODULE_CLKGATE		BIT(30)
+#define MODULE_SFTRST		BIT(31)
+/* 1 second delay should be plenty of time for block reset */
+#define RESET_TIMEOUT		1000000
+
 static u32 set_hsync_pulse_width(struct mxsfb_drm_private *mxsfb, u32 val)
 {
 	return (val & mxsfb->devdata->hs_wdth_mask) <<

@@ -159,6 +166,36 @@ static void mxsfb_disable_controller(str
 		clk_disable_unprepare(mxsfb->clk_disp_axi);
 }
 
+/*
+ * Clear the bit and poll it cleared.  This is usually called with
+ * a reset address and mask being either SFTRST(bit 31) or CLKGATE
+ * (bit 30).
+ */
+static int clear_poll_bit(void __iomem *addr, u32 mask)
+{
+	u32 reg;
+
+	writel(mask, addr + MXS_CLR_ADDR);
+	return readl_poll_timeout(addr, reg, !(reg & mask), 0, RESET_TIMEOUT);
+}
+
+static int mxsfb_reset_block(void __iomem *reset_addr)
+{
+	int ret;
+
+	ret = clear_poll_bit(reset_addr, MODULE_SFTRST);
+	if (ret)
+		return ret;
+
+	writel(MODULE_CLKGATE, reset_addr + MXS_CLR_ADDR);
+
+	ret = clear_poll_bit(reset_addr, MODULE_SFTRST);
+	if (ret)
+		return ret;
+
+	return clear_poll_bit(reset_addr, MODULE_CLKGATE);
+}
+
 static void mxsfb_crtc_mode_set_nofb(struct mxsfb_drm_private *mxsfb)
 {
 	struct drm_display_mode *m = &mxsfb->pipe.crtc.state->adjusted_mode;

@@ -173,6 +210,11 @@ static void mxsfb_crtc_mode_set_nofb(str
 	 */
 	mxsfb_enable_axi_clk(mxsfb);
 
+	/* Mandatory eLCDIF reset as per the Reference Manual */
+	err = mxsfb_reset_block(mxsfb->base);
+	if (err)
+		return;
+
 	/* Clear the FIFOs */
 	writel(CTRL1_FIFO_CLEAR, mxsfb->base + LCDC_CTRL1 + REG_SET);

Greg Kroah-Hartman

author maintainer

2017-06-19 15:16 UTC #11 lore raw

PATCH 12/78 drm/amdgpu: Fix overflow of watermark calcs at > 4k resolutions.

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Mario Kleiner <[email protected]>

commit bea10413934dcf98cb9b2dfcdc56e1d28f192897 upstream.

Commit d63c277dc672e0
("drm/amdgpu: Make display watermark calculations more accurate") made watermark calculations more accurate, but not for > 4k resolutions on 32-Bit architectures, as it introduced an integer overflow for those setups and resolutions.

Fix this by proper u64 casting and division.

Signed-off-by Mario Kleiner <[email protected]>

Reported-by Ben Hutchings <[email protected]>

Fixes d63c277dc672 ("drm/amdgpu: Make display watermark calculations more accurate")

Cc Ben Hutchings <[email protected]>

Cc Alex Deucher <[email protected]>

Signed-off-by Alex Deucher <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/gpu/drm/amd/amdgpu/dce_v10_0.c |    7 +++++--
 drivers/gpu/drm/amd/amdgpu/dce_v11_0.c |    7 +++++--
 drivers/gpu/drm/amd/amdgpu/dce_v6_0.c  |    7 +++++--
 drivers/gpu/drm/amd/amdgpu/dce_v8_0.c  |    7 +++++--
 4 files changed, 20 insertions(+), 8 deletions(-)

drivers/gpu/drm/amd/amdgpu/dce_v10_0.c +5 -2

@@ -1207,8 +1207,11 @@ static void dce_v10_0_program_watermarks
 	u32 tmp, wm_mask, lb_vblank_lead_lines = 0;
 
 	if (amdgpu_crtc->base.enabled && num_heads && mode) {
-		active_time = 1000000UL * (u32)mode->crtc_hdisplay / (u32)mode->clock;
-		line_time = min((u32) (1000000UL * (u32)mode->crtc_htotal / (u32)mode->clock), (u32)65535);
+		active_time = (u32) div_u64((u64)mode->crtc_hdisplay * 1000000,
+					    (u32)mode->clock);
+		line_time = (u32) div_u64((u64)mode->crtc_htotal * 1000000,
+					  (u32)mode->clock);
+		line_time = min(line_time, (u32)65535);
 
 		/* watermark for high clocks */
 		if (adev->pm.dpm_enabled) {

drivers/gpu/drm/amd/amdgpu/dce_v11_0.c +5 -2

@@ -1176,8 +1176,11 @@ static void dce_v11_0_program_watermarks
 	u32 tmp, wm_mask, lb_vblank_lead_lines = 0;
 
 	if (amdgpu_crtc->base.enabled && num_heads && mode) {
-		active_time = 1000000UL * (u32)mode->crtc_hdisplay / (u32)mode->clock;
-		line_time = min((u32) (1000000UL * (u32)mode->crtc_htotal / (u32)mode->clock), (u32)65535);
+		active_time = (u32) div_u64((u64)mode->crtc_hdisplay * 1000000,
+					    (u32)mode->clock);
+		line_time = (u32) div_u64((u64)mode->crtc_htotal * 1000000,
+					  (u32)mode->clock);
+		line_time = min(line_time, (u32)65535);
 
 		/* watermark for high clocks */
 		if (adev->pm.dpm_enabled) {

drivers/gpu/drm/amd/amdgpu/dce_v6_0.c +5 -2

@@ -983,8 +983,11 @@ static void dce_v6_0_program_watermarks(
 	fixed20_12 a, b, c;
 
 	if (amdgpu_crtc->base.enabled && num_heads && mode) {
-		active_time = 1000000UL * (u32)mode->crtc_hdisplay / (u32)mode->clock;
-		line_time = min((u32) (1000000UL * (u32)mode->crtc_htotal / (u32)mode->clock), (u32)65535);
+		active_time = (u32) div_u64((u64)mode->crtc_hdisplay * 1000000,
+					    (u32)mode->clock);
+		line_time = (u32) div_u64((u64)mode->crtc_htotal * 1000000,
+					  (u32)mode->clock);
+		line_time = min(line_time, (u32)65535);
 		priority_a_cnt = 0;
 		priority_b_cnt = 0;

drivers/gpu/drm/amd/amdgpu/dce_v8_0.c +5 -2

@@ -1091,8 +1091,11 @@ static void dce_v8_0_program_watermarks(
 	u32 tmp, wm_mask, lb_vblank_lead_lines = 0;
 
 	if (amdgpu_crtc->base.enabled && num_heads && mode) {
-		active_time = 1000000UL * (u32)mode->crtc_hdisplay / (u32)mode->clock;
-		line_time = min((u32) (1000000UL * (u32)mode->crtc_htotal / (u32)mode->clock), (u32)65535);
+		active_time = (u32) div_u64((u64)mode->crtc_hdisplay * 1000000,
+					    (u32)mode->clock);
+		line_time = (u32) div_u64((u64)mode->crtc_htotal * 1000000,
+					  (u32)mode->clock);
+		line_time = min(line_time, (u32)65535);
 
 		/* watermark for high clocks */
 		if (adev->pm.dpm_enabled) {

Greg Kroah-Hartman

author maintainer

2017-06-19 15:15 UTC #12 lore raw

PATCH 13/78 drm/i915: Fix GVT-g PVINFO version compatibility check

Link http://patchwork.freedesktop.org/patch/msgid/[email protected]

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Zhenyu Wang <[email protected]>

commit c380f681245d7ae57f17d9ebbbe8f8f1557ee1fb upstream.

Current it's strictly checked if PVINFO version matches 1.0 for GVT-g i915 guest which doesn't help for compatibility at all and forces GVT-g host can't extend PVINFO easily with version bump for real compatibility check.

This fixes that to check minimal required PVINFO version instead.

v2:
- drop unneeded version macro
- use only major version for sanity check

v3:
- fix up PVInfo value with kernel type
- one indent fix

Reviewed-by Joonas Lahtinen <[email protected]>

Cc Chuanxiao Dong <[email protected]>

Cc Joonas Lahtinen <[email protected]>

Signed-off-by Zhenyu Wang <[email protected]>

Signed-off-by Joonas Lahtinen <[email protected]>

(cherry picked from commit 0c8792d00d38de85b6ceb1dd67d3ee009d7c8e42)

Signed-off-by Jani Nikula <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/gpu/drm/i915/i915_pvinfo.h |    8 ++------
 drivers/gpu/drm/i915/i915_vgpu.c   |   10 ++++------
 2 files changed, 6 insertions(+), 12 deletions(-)

drivers/gpu/drm/i915/i915_pvinfo.h +2 -6

@@ -36,10 +36,6 @@
 #define VGT_VERSION_MAJOR 1
 #define VGT_VERSION_MINOR 0
 
-#define INTEL_VGT_IF_VERSION_ENCODE(major, minor) ((major) << 16 | (minor))
-#define INTEL_VGT_IF_VERSION \
-	INTEL_VGT_IF_VERSION_ENCODE(VGT_VERSION_MAJOR, VGT_VERSION_MINOR)
-
 /*
  * notifications from guest to vgpu device model
  */

@@ -55,8 +51,8 @@ enum vgt_g2v_type {
 
 struct vgt_if {
 	u64 magic;		/* VGT_MAGIC */
-	uint16_t version_major;
-	uint16_t version_minor;
+	u16 version_major;
+	u16 version_minor;
 	u32 vgt_id;		/* ID of vGT instance */
 	u32 rsv1[12];		/* pad to offset 0x40 */
 	/*

drivers/gpu/drm/i915/i915_vgpu.c +4 -6

@@ -60,8 +60,8 @@
  */
 void i915_check_vgpu(struct drm_i915_private *dev_priv)
 {
-	uint64_t magic;
-	uint32_t version;
+	u64 magic;
+	u16 version_major;
 
 	BUILD_BUG_ON(sizeof(struct vgt_if) != VGT_PVINFO_SIZE);

@@ -69,10 +69,8 @@ void i915_check_vgpu(struct drm_i915_pri
 	if (magic != VGT_MAGIC)
 		return;
 
-	version = INTEL_VGT_IF_VERSION_ENCODE(
-		__raw_i915_read16(dev_priv, vgtif_reg(version_major)),
-		__raw_i915_read16(dev_priv, vgtif_reg(version_minor)));
-	if (version != INTEL_VGT_IF_VERSION) {
+	version_major = __raw_i915_read16(dev_priv, vgtif_reg(version_major));
+	if (version_major < VGT_VERSION_MAJOR) {
 		DRM_INFO("VGT interface version mismatch!\n");
 		return;
 	}

Greg Kroah-Hartman

author maintainer

2017-06-19 15:17 UTC #13 lore raw

PATCH 15/78 drm/i915: Do not sync RCU during shrinking

Link http://patchwork.freedesktop.org/patch/msgid/[email protected]

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Joonas Lahtinen <[email protected]>

commit 4681ee21d62cfed4364e09ec50ee8e88185dd628 upstream.

Due to the complex dependencies between workqueues and RCU, which are not easily detected by lockdep, do not synchronize RCU during shrinking.

On low-on-memory systems (mem=1G for example), the RCU sync leads to all system workqueus freezing and unrelated lockdep splats are displayed according to reports. GIT bisecting done by J. R. Okajima points to the commit where RCU syncing was extended.

RCU sync gains us very little benefit in real life scenarios where the amount of memory used by object backing storage is dominant over the metadata under RCU, so drop it altogether.

" Yeeeaah, if core could just, go ahead and reclaim RCU
queues, that'd be great. "

- Chris Wilson, 2016 (0eafec6d3244)

v2: More information to commit message.
v3: Remove "grep _rcu_" escapee from i915_gem_shrink_all (Andrea)

Fixes c053b5a506d3 ("drm/i915: Don't call synchronize_rcu_expedited under struct_mutex")

Reported-by J. R. Okajima <[email protected]>

Signed-off-by Joonas Lahtinen <[email protected]>

Reviewed-by Chris Wilson <[email protected]>

Tested-by Hugh Dickins <[email protected]>

Tested-by Andrea Arcangeli <[email protected]>

Cc Chris Wilson <[email protected]>

Cc Tvrtko Ursulin <[email protected]>

Cc J. R. Okajima <[email protected]>

Cc Andrea Arcangeli <[email protected]>

Cc Hugh Dickins <[email protected]>

Cc Jani Nikula <[email protected]>

(cherry picked from commit 73cc0b9aa9afa5ba65d92e46ded61d29430d72a4)

Signed-off-by Jani Nikula <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/gpu/drm/i915/i915_gem_shrinker.c |    5 -----
 1 file changed, 5 deletions(-)

drivers/gpu/drm/i915/i915_gem_shrinker.c +0 -5

@@ -59,9 +59,6 @@ static void i915_gem_shrinker_unlock(str
 		return;
 
 	mutex_unlock(&dev->struct_mutex);
-
-	/* expedite the RCU grace period to free some request slabs */
-	synchronize_rcu_expedited();
 }
 
 static bool any_vma_pinned(struct drm_i915_gem_object *obj)

@@ -271,8 +268,6 @@ unsigned long i915_gem_shrink_all(struct
 				I915_SHRINK_BOUND |
 				I915_SHRINK_UNBOUND |
 				I915_SHRINK_ACTIVE);
-	synchronize_rcu(); /* wait for our earlier RCU delayed slab frees */
-
 	return freed;
 }

Greg Kroah-Hartman

author maintainer

2017-06-19 15:16 UTC #14 lore raw

PATCH 16/78 mac80211: fix IBSS presp allocation size

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Johannes Berg <[email protected]>

commit f1f3e9e2a50a70de908f9dfe0d870e9cdc67e042 upstream.

When VHT IBSS support was added, the size of the extra elements wasn't considered in ieee80211_ibss_build_presp(), which makes it possible that it would overrun the allocated buffer. Fix it by allocating the necessary space.

Fixes abcff6ef01f9 ("mac80211: add VHT support for IBSS")

Reported-by Shaul Triebitz <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 net/mac80211/ibss.c |    2 ++
 1 file changed, 2 insertions(+)

net/mac80211/ibss.c +2 -0

@@ -66,6 +66,8 @@ ieee80211_ibss_build_presp(struct ieee80
 		    2 + (IEEE80211_MAX_SUPP_RATES - 8) +
 		    2 + sizeof(struct ieee80211_ht_cap) +
 		    2 + sizeof(struct ieee80211_ht_operation) +
+		    2 + sizeof(struct ieee80211_vht_cap) +
+		    2 + sizeof(struct ieee80211_vht_operation) +
 		    ifibss->ie_len;
 	presp = kzalloc(sizeof(*presp) + frame_len, GFP_KERNEL);
 	if (!presp)

Greg Kroah-Hartman

author maintainer

2017-06-19 15:17 UTC #15 lore raw

PATCH 17/78 mac80211: strictly check mesh address extension mode

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Rajkumar Manoharan <[email protected]>

commit 5667c86acf021e6dcf02584408b4484a273ac68f upstream.

Mesh forwarding path checks for address extension mode to fetch appropriate proxied address and MPP address. Existing condition that looks for 6 address format is not strict enough so that frames with improper values are processed and invalid entries are added into MPP table. Fix that by adding a stricter check before processing the packet.

Per IEEE Std 802.11s-2011 spec. Table 7-6g1 lists address extension mode 0x3 as reserved one. And also Table Table 9-13 does not specify 0x3 as valid address field.

Fixes 9b395bc3be1c ("mac80211: verify that skb data is present")

Signed-off-by Rajkumar Manoharan <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 net/mac80211/rx.c   |    3 ++-
 net/wireless/util.c |   10 ++++++----
 2 files changed, 8 insertions(+), 5 deletions(-)

net/mac80211/rx.c +2 -1

@@ -2470,7 +2470,8 @@ ieee80211_rx_h_mesh_fwding(struct ieee80
 		if (is_multicast_ether_addr(hdr->addr1)) {
 			mpp_addr = hdr->addr3;
 			proxied_addr = mesh_hdr->eaddr1;
-		} else if (mesh_hdr->flags & MESH_FLAGS_AE_A5_A6) {
+		} else if ((mesh_hdr->flags & MESH_FLAGS_AE) ==
+			    MESH_FLAGS_AE_A5_A6) {
 			/* has_a4 already checked in ieee80211_rx_mesh_check */
 			mpp_addr = hdr->addr4;
 			proxied_addr = mesh_hdr->eaddr2;

net/wireless/util.c +6 -4

@@ -454,6 +454,8 @@ int ieee80211_data_to_8023_exthdr(struct
 	if (iftype == NL80211_IFTYPE_MESH_POINT)
 		skb_copy_bits(skb, hdrlen, &mesh_flags, 1);
 
+	mesh_flags &= MESH_FLAGS_AE;
+
 	switch (hdr->frame_control &
 		cpu_to_le16(IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) {
 	case cpu_to_le16(IEEE80211_FCTL_TODS):

@@ -469,9 +471,9 @@ int ieee80211_data_to_8023_exthdr(struct
 			     iftype != NL80211_IFTYPE_STATION))
 			return -1;
 		if (iftype == NL80211_IFTYPE_MESH_POINT) {
-			if (mesh_flags & MESH_FLAGS_AE_A4)
+			if (mesh_flags == MESH_FLAGS_AE_A4)
 				return -1;
-			if (mesh_flags & MESH_FLAGS_AE_A5_A6) {
+			if (mesh_flags == MESH_FLAGS_AE_A5_A6) {
 				skb_copy_bits(skb, hdrlen +
 					offsetof(struct ieee80211s_hdr, eaddr1),
 					tmp.h_dest, 2 * ETH_ALEN);

@@ -487,9 +489,9 @@ int ieee80211_data_to_8023_exthdr(struct
 		     ether_addr_equal(tmp.h_source, addr)))
 			return -1;
 		if (iftype == NL80211_IFTYPE_MESH_POINT) {
-			if (mesh_flags & MESH_FLAGS_AE_A5_A6)
+			if (mesh_flags == MESH_FLAGS_AE_A5_A6)
 				return -1;
-			if (mesh_flags & MESH_FLAGS_AE_A4)
+			if (mesh_flags == MESH_FLAGS_AE_A4)
 				skb_copy_bits(skb, hdrlen +
 					offsetof(struct ieee80211s_hdr, eaddr1),
 					tmp.h_source, ETH_ALEN);

Greg Kroah-Hartman

author maintainer

2017-06-19 15:17 UTC #16 lore raw

PATCH 18/78 mac80211: fix dropped counter in multiqueue RX

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Johannes Berg <[email protected]>

commit e165bc02a02c70e40d5c811c705ba269aeca0497 upstream.

In the commit enabling per-CPU station statistics, I inadvertedly copy-pasted some code to update rx_packets and forgot to change it to update rx_dropped_misc. Fix that.

This addresses https://bugzilla.kernel.org/show_bug.cgi?id=195953.

Fixes c9c5962b56c1 ("mac80211: enable collecting station statistics per-CPU")

Reported-by Petru-Florin Mihancea <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 net/mac80211/sta_info.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

net/mac80211/sta_info.c +1 -1

@@ -2143,7 +2143,7 @@ void sta_set_sinfo(struct sta_info *sta,
 			struct ieee80211_sta_rx_stats *cpurxs;
 
 			cpurxs = per_cpu_ptr(sta->pcpu_rx_stats, cpu);
-			sinfo->rx_packets += cpurxs->dropped;
+			sinfo->rx_dropped_misc += cpurxs->dropped;
 		}
 	}

Greg Kroah-Hartman

author maintainer

2017-06-19 15:17 UTC #17 lore raw

PATCH 19/78 mac80211: dont send SMPS action frame in AP mode when not needed

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Emmanuel Grumbach <[email protected]>

commit b3dd8279659f14f3624bb32559782d699fa6f7d1 upstream.

mac80211 allows to modify the SMPS state of an AP both, when it is started, and after it has been started. Such a change will trigger an action frame to all the peers that are currently connected, and will be remembered so that new peers will get notified as soon as they connect (since the SMPS setting in the beacon may not be the right one).

This means that we need to remember the SMPS state currently requested as well as the SMPS state that was configured initially (and advertised in the beacon). The former is bss->req_smps and the latter is sdata->smps_mode.

Initially, the AP interface could only be started with SMPS_OFF, which means that sdata->smps_mode was SMPS_OFF always. Later, a nl80211 API was added to be able to start an AP with a different AP mode. That code forgot to update bss->req_smps and because of that, if the AP interface was started with SMPS_DYNAMIC, we had:
sdata->smps_mode = SMPS_DYNAMIC
bss->req_smps = SMPS_OFF

That configuration made mac80211 think it needs to fire off an action frame to any new station connecting to the AP in order to let it know that the actual SMPS configuration is SMPS_OFF.

Fix that by properly setting bss->req_smps in
ieee80211_start_ap.

Fixes f69931748730 ("mac80211: set smps_mode according to ap params")

Signed-off-by Emmanuel Grumbach <[email protected]>

Signed-off-by Luca Coelho <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 net/mac80211/cfg.c |    2 ++
 1 file changed, 2 insertions(+)

net/mac80211/cfg.c +2 -0

@@ -862,6 +862,8 @@ static int ieee80211_start_ap(struct wip
 	default:
 		return -EINVAL;
 	}
+	sdata->u.ap.req_smps = sdata->smps_mode;
+
 	sdata->needed_rx_chains = sdata->local->rx_chains;
 
 	sdata->vif.bss_conf.beacon_int = params->beacon_interval;

Greg Kroah-Hartman

author maintainer

2017-06-19 15:15 UTC #18 lore raw

PATCH 20/78 drm/mediatek: fix mtk_hdmi_setup_vendor_specific_infoframe mistake

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: YYS <[email protected]>

commit 014580ffab654bb83256783a2b185cf6c06dffaa upstream.

mtk_hdmi_setup_vendor_specific_infoframe will return before handle mtk_hdmi_hw_send_info_frame.Because hdmi_vendor_infoframe_pack returns the number of bytes packed into the binary buffer or a negative error code on failure.
So correct it.

Fixes 8f83f26891e1 ("drm/mediatek: Add HDMI support")

Signed-off-by Nickey Yang <[email protected]>

Signed-off-by CK Hu <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/gpu/drm/mediatek/mtk_hdmi.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

drivers/gpu/drm/mediatek/mtk_hdmi.c +1 -1

@@ -1062,7 +1062,7 @@ static int mtk_hdmi_setup_vendor_specifi
 	}
 
 	err = hdmi_vendor_infoframe_pack(&frame, buffer, sizeof(buffer));
-	if (err) {
+	if (err < 0) {
 		dev_err(hdmi->dev, "Failed to pack vendor infoframe: %zd\n",
 			err);
 		return err;

Greg Kroah-Hartman

author maintainer

2017-06-19 15:15 UTC #19 lore raw

PATCH 21/78 drm/vc4: Fix OOPSes from trying to cache a partially constructed BO.

Link http://patchwork.freedesktop.org/patch/msgid/[email protected]

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Eric Anholt <[email protected]>

commit ca39b449f6d03e8235969f12f5dd25b8eb4304d6 upstream.

If a CMA allocation failed, the partially constructed BO would be unreferenced through the normal path, and we might choose to put it in the BO cache. If we then reused it before it expired from the cache, the kernel would OOPS.

Signed-off-by Eric Anholt <[email protected]>

Fixes c826a6e10644 ("drm/vc4: Add a BO cache.")

Reviewed-by Boris Brezillon <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/gpu/drm/vc4/vc4_bo.c |    8 ++++++++
 1 file changed, 8 insertions(+)

drivers/gpu/drm/vc4/vc4_bo.c +8 -0

@@ -313,6 +313,14 @@ void vc4_free_object(struct drm_gem_obje
 		goto out;
 	}
 
+	/* If this object was partially constructed but CMA allocation
+	 * had failed, just free it.
+	 */
+	if (!bo->base.vaddr) {
+		vc4_bo_destroy(bo);
+		goto out;
+	}
+
 	cache_list = vc4_get_cache_list_for_size(dev, gem_bo->size);
 	if (!cache_list) {
 		vc4_bo_destroy(bo);

Greg Kroah-Hartman

author maintainer

2017-06-19 15:15 UTC #20 lore raw

PATCH 23/78 serial: 8250_lpss: Unconditionally set PCI master for Quark

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jan Kiszka <[email protected]>

commit 7cd3e9dbdd4c0025d0e37c8c73a2ac8641fc55bc upstream.

MSI needs it as well.

Should have no practical impact, though, as DMA is always available on the Quark. But given the few users of pci_alloc_irq_vectors so far, this incorrect pattern may spread otherwise.

Fixes 3f3a46951e02 ("serial: 8250_lpss: set PCI master only for private DMA")

Signed-off-by Jan Kiszka <[email protected]>

Reviewed-by Andy Shevchenko <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/tty/serial/8250/8250_lpss.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

drivers/tty/serial/8250/8250_lpss.c +2 -1

@@ -183,7 +183,6 @@ static void qrk_serial_setup_dma(struct
 	if (ret)
 		return;
 
-	pci_set_master(pdev);
 	pci_try_set_mwi(pdev);
 
 	/* Special DMA address for UART */

@@ -216,6 +215,8 @@ static int qrk_serial_setup(struct lpss8
 	struct pci_dev *pdev = to_pci_dev(port->dev);
 	int ret;
 
+	pci_set_master(pdev);
+
 	ret = pci_alloc_irq_vectors(pdev, 1, 1, PCI_IRQ_ALL_TYPES);
 	if (ret < 0)
 		return ret;

Greg Kroah-Hartman

author maintainer

2017-06-19 15:15 UTC #21 lore raw

PATCH 24/78 serial: sh-sci: Fix (AUTO)RTS in sci_init_pins()

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Geert Uytterhoeven <[email protected]>

commit cfa6eb239154315e6efcdda1d929e024097f927b upstream.

If a UART has dedicated RTS/CTS pins, and hardware control flow is disabled (or AUTORTS is not yet effective), changing any serial port configuration deasserts RTS, as .set_termios() calls sci_init_pins().

To fix this, consider the current (AUTO)RTS state when (re)initializing the pins. Note that for SCIFA/SCIFB, AUTORTS needs explicit configuration of the RTS# pin function, while (H)SCIF handles this automatically.

Fixes d2b9775d795ec05f ("serial: sh-sci: Correct pin initialization on (H)SCIF")

Fixes e9d7a45a03991349 ("serial: sh-sci: Add pin initialization for SCIFA/SCIFB")

Signed-off-by Geert Uytterhoeven <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/tty/serial/sh-sci.c |   25 +++++++++++++++++++------
 1 file changed, 19 insertions(+), 6 deletions(-)

drivers/tty/serial/sh-sci.c +19 -6

@@ -683,24 +683,37 @@ static void sci_init_pins(struct uart_po
 	}
 
 	if (port->type == PORT_SCIFA || port->type == PORT_SCIFB) {
+		u16 data = serial_port_in(port, SCPDR);
 		u16 ctrl = serial_port_in(port, SCPCR);
 
 		/* Enable RXD and TXD pin functions */
 		ctrl &= ~(SCPCR_RXDC | SCPCR_TXDC);
 		if (to_sci_port(port)->has_rtscts) {
-			/* RTS# is output, driven 1 */
-			ctrl |= SCPCR_RTSC;
-			serial_port_out(port, SCPDR,
-				serial_port_in(port, SCPDR) | SCPDR_RTSD);
+			/* RTS# is output, active low, unless autorts */
+			if (!(port->mctrl & TIOCM_RTS)) {
+				ctrl |= SCPCR_RTSC;
+				data |= SCPDR_RTSD;
+			} else if (!s->autorts) {
+				ctrl |= SCPCR_RTSC;
+				data &= ~SCPDR_RTSD;
+			} else {
+				/* Enable RTS# pin function */
+				ctrl &= ~SCPCR_RTSC;
+			}
 			/* Enable CTS# pin function */
 			ctrl &= ~SCPCR_CTSC;
 		}
+		serial_port_out(port, SCPDR, data);
 		serial_port_out(port, SCPCR, ctrl);
 	} else if (sci_getreg(port, SCSPTR)->size) {
 		u16 status = serial_port_in(port, SCSPTR);
 
-		/* RTS# is output, driven 1 */
-		status |= SCSPTR_RTSIO | SCSPTR_RTSDT;
+		/* RTS# is always output; and active low, unless autorts */
+		status |= SCSPTR_RTSIO;
+		if (!(port->mctrl & TIOCM_RTS))
+			status |= SCSPTR_RTSDT;
+		else if (!s->autorts)
+			status &= ~SCSPTR_RTSDT;
 		/* CTS# and SCK are inputs */
 		status &= ~(SCSPTR_CTSIO | SCSPTR_SCKIO);
 		serial_port_out(port, SCSPTR, status);

Greg Kroah-Hartman

author maintainer

2017-06-19 15:15 UTC #22 lore raw

PATCH 25/78 serial: sh-sci: Fix late enablement of AUTORTS

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Geert Uytterhoeven <[email protected]>

commit 5f76895e4c712b1b5af450cf344389b8c53ac2c2 upstream.

When changing hardware control flow for a UART with dedicated RTS/CTS pins, the new AUTORTS state is not immediately reflected in the hardware, but only when RTS is raised. However, the serial core does not call .set_mctrl() after .set_termios(), hence AUTORTS may only become effective when the port is closed, and reopened later. Note that this problem does not happen when manually using stty to change CRTSCTS, as AUTORTS will work fine on next open.

To fix this, call .set_mctrl() from .set_termios() when dedicated RTS/CTS pins are present, to refresh the AUTORTS or RTS state. This is similar to what other drivers supporting AUTORTS do (e.g. omap-serial).

Reported-by Baumann, Christoph (C.) <[email protected]>

Fixes 33f50ffc253854cf ("serial: sh-sci: Fix support for hardware-assisted RTS/CTS")

Signed-off-by Geert Uytterhoeven <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/tty/serial/sh-sci.c |    4 ++++
 1 file changed, 4 insertions(+)

drivers/tty/serial/sh-sci.c +4 -0

@@ -2389,6 +2389,10 @@ done:
 
 		serial_port_out(port, SCFCR, ctrl);
 	}
+	if (port->flags & UPF_HARD_FLOW) {
+		/* Refresh (Auto) RTS */
+		sci_set_mctrl(port, port->mctrl);
+	}
 
 	scr_val |= SCSCR_RE | SCSCR_TE |
 		   (s->cfg->scscr & ~(SCSCR_CKE1 | SCSCR_CKE0));

Greg Kroah-Hartman

author maintainer

2017-06-19 15:15 UTC #23 lore raw

PATCH 26/78 x86/mm/32: Set the __vmalloc_start_set flag in initmem_init()

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Laura Abbott <[email protected]>

commit 861ce4a3244c21b0af64f880d5bfe5e6e2fb9e4a upstream.

'__vmalloc_start_set' currently only gets set in initmem_init() when !CONFIG_NEED_MULTIPLE_NODES. This breaks detection of vmalloc address with virt_addr_valid() with CONFIG_NEED_MULTIPLE_NODES=y, causing a kernel crash:

[mm/usercopy] 517e1fbeb6: kernel BUG at arch/x86/mm/physaddr.c:78!

Set '__vmalloc_start_set' appropriately for that case as well.

Reported-by kbuild test robot <[email protected]>

Signed-off-by Laura Abbott <[email protected]>

Reviewed-by Kees Cook <[email protected]>

Cc Linus Torvalds <[email protected]>

Cc Peter Zijlstra <[email protected]>

Cc Thomas Gleixner <[email protected]>

Fixes dc16ecf7fd1f ("x86-32: use specific __vmalloc_start_set flag in __virt_addr_valid")

Link http://lkml.kernel.org/r/[email protected] open here

Signed-off-by Ingo Molnar <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 arch/x86/mm/numa_32.c |    1 +
 1 file changed, 1 insertion(+)

arch/x86/mm/numa_32.c +1 -0

@@ -100,5 +100,6 @@ void __init initmem_init(void)
 	printk(KERN_DEBUG "High memory starts at vaddr %08lx\n",
 			(ulong) pfn_to_kaddr(highstart_pfn));
 
+	__vmalloc_start_set = true;
 	setup_bootmem_allocator();
 }

Greg Kroah-Hartman

author maintainer

2017-06-19 15:17 UTC #24 lore raw

PATCH 27/78 mfd: omap-usb-tll: Fix inverted bit use for USB TLL mode

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Tony Lindgren <[email protected]>

commit 8b8a84c54aff4256d592dc18346c65ecf6811b45 upstream.

Commit 16fa3dc75c22 ("mfd: omap-usb-tll: HOST TLL platform driver") added support for USB TLL, but uses OMAP_TLL_CHANNEL_CONF_ULPINOBITSTUFF bit the wrong way. The comments in the code are correct, but the inverted use of OMAP_TLL_CHANNEL_CONF_ULPINOBITSTUFF causes the register to be enabled instead of disabled unlike what the comments say.

Without this change the Wrigley 3G LTE modem on droid 4 EHCI bus can be only pinged few times before it stops responding.

Fixes 16fa3dc75c22 ("mfd: omap-usb-tll: HOST TLL platform driver")

Acked-by Roger Quadros <[email protected]>

Signed-off-by Lee Jones <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/mfd/omap-usb-tll.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

drivers/mfd/omap-usb-tll.c +1 -1

@@ -377,8 +377,8 @@ int omap_tll_init(struct usbhs_omap_plat
 				 * and use SDR Mode
 				 */
 				reg &= ~(OMAP_TLL_CHANNEL_CONF_UTMIAUTOIDLE
-					| OMAP_TLL_CHANNEL_CONF_ULPINOBITSTUFF
 					| OMAP_TLL_CHANNEL_CONF_ULPIDDRMODE);
+				reg |= OMAP_TLL_CHANNEL_CONF_ULPINOBITSTUFF;
 			} else if (pdata->port_mode[i] ==
 					OMAP_EHCI_PORT_MODE_HSIC) {
 				/*

Greg Kroah-Hartman

author maintainer

2017-06-19 15:17 UTC #25 lore raw

PATCH 28/78 mfd: axp20x: Add support for dts property "xpowers,master-mode"

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Rask Ingemann Lambertsen <[email protected]>

commit c0369698e6455c734a772e3acb09cff9a0c8ed9f upstream.

commit b101829a029a ("mfd: axp20x: Fix AXP806 access errors on cold boot") was intended to fix the case where a board uses an AXP806 in slave mode, but the boot loader leaves it in master mode for lack of AXP806 support. But now the driver breaks on boards where the PMIC is operating in master mode. This patch lets the driver use the new device tree property "xpowers,master-mode" to set the correct operating mode for the board.

Fixes 8824ee857348 ("mfd: axp20x: Add support for AXP806 PMIC")

Signed-off-by Rask Ingemann Lambertsen <[email protected]>

Signed-off-by Lee Jones <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/mfd/axp20x.c |   21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)

drivers/mfd/axp20x.c +13 -8

@@ -31,6 +31,7 @@
 
 #define AXP20X_OFF	0x80
 
+#define AXP806_REG_ADDR_EXT_ADDR_MASTER_MODE	0
 #define AXP806_REG_ADDR_EXT_ADDR_SLAVE_MODE	BIT(4)
 
 static const char * const axp20x_model_names[] = {

@@ -877,15 +878,19 @@ int axp20x_device_probe(struct axp20x_de
 	 * the these device addressing bits (in the upper 4 bits of the
 	 * registers) match.
 	 *
-	 * Since we only support an AXP806 chained to an AXP809 in slave
-	 * mode, and there isn't any existing hardware which uses AXP806
-	 * in master mode, or has 2 AXP806s in the same system, we can
-	 * just program the register address extension to the slave mode
-	 * address.
+	 * By default we support an AXP806 chained to an AXP809 in slave
+	 * mode. Boards which use an AXP806 in master mode can set the
+	 * property "x-powers,master-mode" to override the default.
 	 */
-	if (axp20x->variant == AXP806_ID)
-		regmap_write(axp20x->regmap, AXP806_REG_ADDR_EXT,
-			     AXP806_REG_ADDR_EXT_ADDR_SLAVE_MODE);
+	if (axp20x->variant == AXP806_ID) {
+		if (of_property_read_bool(axp20x->dev->of_node,
+					  "x-powers,master-mode"))
+			regmap_write(axp20x->regmap, AXP806_REG_ADDR_EXT,
+				     AXP806_REG_ADDR_EXT_ADDR_MASTER_MODE);
+		else
+			regmap_write(axp20x->regmap, AXP806_REG_ADDR_EXT,
+				     AXP806_REG_ADDR_EXT_ADDR_SLAVE_MODE);
+	}
 
 	ret = regmap_add_irq_chip(axp20x->regmap, axp20x->irq,
 			  IRQF_ONESHOT | IRQF_SHARED | axp20x->irq_flags,

Greg Kroah-Hartman

author maintainer

2017-06-19 15:18 UTC #26 lore raw

PATCH 29/78 dt-bindings: mfd: axp20x: Add "xpowers,master-mode" property for AXP806 PMICs

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Rask Ingemann Lambertsen <[email protected]>

commit 8461cf20d17e0090e9236b73d25b31be4f7fadc5 upstream.

commit b101829a029a ("mfd: axp20x: Fix AXP806 access errors on cold boot") was intended to fix the case where a board uses an AXP806 in slave mode, but the boot loader leaves it in master mode for lack of AXP806 support. But now the driver breaks on boards where the PMIC is operating in master mode. To let the device tree describe which mode of operation is needed, this patch introduces a new property "xpowers,master-mode".

Fixes 204ae2963e10 ("mfd: axp20x: Add bindings for AXP806 PMIC")

Signed-off-by Rask Ingemann Lambertsen <[email protected]>

Acked-by Chen-Yu Tsai <[email protected]>

Signed-off-by Lee Jones <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 Documentation/devicetree/bindings/mfd/axp20x.txt |    3 +++
 1 file changed, 3 insertions(+)

Documentation/devicetree/bindings/mfd/axp20x.txt +3 -0

@@ -28,6 +28,9 @@ Optional properties:
 		  regulator to drive the OTG VBus, rather then as an input pin
 		  which signals whether the board is driving OTG VBus or not.
 
+- x-powers,master-mode: Boolean (axp806 only). Set this when the PMIC is
+			wired for master mode. The default is slave mode.
+
 - <input>-supply: a phandle to the regulator supply node. May be omitted if
 		  inputs are unregulated, such as using the IPSOUT output
 		  from the PMIC.

Greg Kroah-Hartman

author maintainer

2017-06-19 15:17 UTC #27 lore raw

PATCH 30/78 mfd: cpcap: Fix interrupt to use level interrupt

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Tony Lindgren <[email protected]>

commit ac89473213c602b98172d92e40f5e78032b1aba0 upstream.

I made a mistake assuming the device tree configuration for interrupt triggering was somehow passed to the SPI device but it's not.

In the Motorola Linux kernel tree CPCAP PMIC is configured as a rising edge triggered interrupt, but then then it's interrupt handler keeps looping until the GPIO line goes down. So the CPCAP interrupt is clearly a level interrupt and not an edge interrupt.

Earlier when I tried to configure it as level interrupt using the device tree, I did not account that the triggering only gets passed to the SPI core and it also needs to be specified in the CPCAP driver when we do devm_regmap_add_irq_chip().

Fixes 56e1d40d3bea ("mfd: cpcap: Add minimal support")

Acked-by Charles Keepax <[email protected]>

Signed-off-by Lee Jones <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/mfd/motorola-cpcap.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

drivers/mfd/motorola-cpcap.c +1 -1

@@ -126,7 +126,7 @@ static int cpcap_init_irq_chip(struct cp
 
 	ret = devm_regmap_add_irq_chip(&cpcap->spi->dev, cpcap->regmap,
 				       cpcap->spi->irq,
-				       IRQF_TRIGGER_RISING |
+				       irq_get_trigger_type(cpcap->spi->irq) |
 				       IRQF_SHARED, -1,
 				       chip, &cpcap->irqdata[irq_chip]);
 	if (ret) {

Greg Kroah-Hartman

author maintainer

2017-06-19 15:17 UTC #28 lore raw

PATCH 31/78 mfd: cpcap: Use ack_invert interrupts

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Tony Lindgren <[email protected]>

commit 5a88d4120029601a0868e20774382d312952d3b5 upstream.

We should use ack_invert as the int_read_and_clear() in the Motorola kernel tree does "ireg_val & ~mreg_val" before writing to the mask register.

Fixes 56e1d40d3bea ("mfd: cpcap: Add minimal support")

Tested-by Sebastian Reichel <[email protected]>

Signed-off-by Lee Jones <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/mfd/motorola-cpcap.c |    3 +++
 1 file changed, 3 insertions(+)

drivers/mfd/motorola-cpcap.c +3 -0

@@ -71,6 +71,7 @@ static struct regmap_irq_chip cpcap_irq_
 		.ack_base = CPCAP_REG_MI1,
 		.mask_base = CPCAP_REG_MIM1,
 		.use_ack = true,
+		.ack_invert = true,
 	},
 	{
 		.name = "cpcap-m2",

@@ -79,6 +80,7 @@ static struct regmap_irq_chip cpcap_irq_
 		.ack_base = CPCAP_REG_MI2,
 		.mask_base = CPCAP_REG_MIM2,
 		.use_ack = true,
+		.ack_invert = true,
 	},
 	{
 		.name = "cpcap1-4",

@@ -88,6 +90,7 @@ static struct regmap_irq_chip cpcap_irq_
 		.mask_base = CPCAP_REG_INTM1,
 		.type_base = CPCAP_REG_INTS1,
 		.use_ack = true,
+		.ack_invert = true,
 	},
 };

Greg Kroah-Hartman

author maintainer

2017-06-19 15:18 UTC #29 lore raw

PATCH 32/78 mfd: cpcap: Fix bad use of IRQ sense register

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Tony Lindgren <[email protected]>

commit be269180c9335c257a2763c3fd3a44e65c90c1f0 upstream.

The cpcap INTS registers are for getting the value of the line, not for configuring the type.

Fixes 56e1d40d3bea ("mfd: cpcap: Add minimal support")

Reviewed-by Sebastian Reichel <[email protected]>

Tested-by Sebastian Reichel <[email protected]>

Signed-off-by Lee Jones <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/mfd/motorola-cpcap.c |    1 -
 1 file changed, 1 deletion(-)

drivers/mfd/motorola-cpcap.c +0 -1

@@ -88,7 +88,6 @@ static struct regmap_irq_chip cpcap_irq_
 		.status_base = CPCAP_REG_INT1,
 		.ack_base = CPCAP_REG_INT1,
 		.mask_base = CPCAP_REG_INTM1,
-		.type_base = CPCAP_REG_INTS1,
 		.use_ack = true,
 		.ack_invert = true,
 	},

Greg Kroah-Hartman

author maintainer

2017-06-19 15:17 UTC #30 lore raw

PATCH 33/78 phy: rcar-gen3-usb2: fix implementation for runtime PM

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Yoshihiro Shimoda <[email protected]>

commit 441a681b8843474c9796b50c35794ff102701f37 upstream.

This patch fixes an issue that this driver doesn't take care of the runtime PM. This code assumed that devm_phy_create() called pm_runtime_enable(dev), but it misunderstood the dev_phy_create()'s specification.
This driver should call its own pm_runtime_enable() before dev_phy_create().

Fixes f3b5a8d9b50d ("phy: rcar-gen3-usb2: Add R-Car Gen3 USB2 PHY driver")

Signed-off-by Yoshihiro Shimoda <[email protected]>

Signed-off-by Kishon Vijay Abraham I <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/phy/phy-rcar-gen3-usb2.c |   31 ++++++++++++++++++++++++-------
 1 file changed, 24 insertions(+), 7 deletions(-)

drivers/phy/phy-rcar-gen3-usb2.c +24 -7

@@ -20,6 +20,7 @@
 #include <linux/of_address.h>
 #include <linux/phy/phy.h>
 #include <linux/platform_device.h>
+#include <linux/pm_runtime.h>
 #include <linux/regulator/consumer.h>
 #include <linux/workqueue.h>

@@ -395,7 +396,7 @@ static int rcar_gen3_phy_usb2_probe(stru
 	struct rcar_gen3_chan *channel;
 	struct phy_provider *provider;
 	struct resource *res;
-	int irq;
+	int irq, ret = 0;
 
 	if (!dev->of_node) {
 		dev_err(dev, "This driver needs device tree\n");

@@ -434,17 +435,24 @@ static int rcar_gen3_phy_usb2_probe(stru
 		}
 	}
 
-	/* devm_phy_create() will call pm_runtime_enable(dev); */
+	/*
+	 * devm_phy_create() will call pm_runtime_enable(&phy->dev);
+	 * And then, phy-core will manage runtime pm for this device.
+	 */
+	pm_runtime_enable(dev);
 	channel->phy = devm_phy_create(dev, NULL, &rcar_gen3_phy_usb2_ops);
 	if (IS_ERR(channel->phy)) {
 		dev_err(dev, "Failed to create USB2 PHY\n");
-		return PTR_ERR(channel->phy);
+		ret = PTR_ERR(channel->phy);
+		goto error;
 	}
 
 	channel->vbus = devm_regulator_get_optional(dev, "vbus");
 	if (IS_ERR(channel->vbus)) {
-		if (PTR_ERR(channel->vbus) == -EPROBE_DEFER)
-			return PTR_ERR(channel->vbus);
+		if (PTR_ERR(channel->vbus) == -EPROBE_DEFER) {
+			ret = PTR_ERR(channel->vbus);
+			goto error;
+		}
 		channel->vbus = NULL;
 	}

@@ -454,15 +462,22 @@ static int rcar_gen3_phy_usb2_probe(stru
 	provider = devm_of_phy_provider_register(dev, of_phy_simple_xlate);
 	if (IS_ERR(provider)) {
 		dev_err(dev, "Failed to register PHY provider\n");
+		ret = PTR_ERR(provider);
+		goto error;
 	} else if (channel->has_otg) {
 		int ret;
 
 		ret = device_create_file(dev, &dev_attr_role);
 		if (ret < 0)
-			return ret;
+			goto error;
 	}
 
-	return PTR_ERR_OR_ZERO(provider);
+	return 0;
+
+error:
+	pm_runtime_disable(dev);
+
+	return ret;
 }
 
 static int rcar_gen3_phy_usb2_remove(struct platform_device *pdev)

@@ -472,6 +487,8 @@ static int rcar_gen3_phy_usb2_remove(str
 	if (channel->has_otg)
 		device_remove_file(&pdev->dev, &dev_attr_role);
 
+	pm_runtime_disable(&pdev->dev);
+
 	return 0;
 };

Greg Kroah-Hartman

author maintainer

2017-06-19 15:15 UTC #31 lore raw

PATCH 34/78 mtd: physmap_of: really fix the physmap add-ons

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Linus Walleij <[email protected]>

commit 8c925b263584e5a37244297ea9bd072020265fd4 upstream.

The current way of building the of_physmap add-ons result in just the add-on being in the object code, and not the actual core implementation and regress the Gemini and Versatile.

Bake the physmap_of.o object by baking physmap_of_core.o and adding the Versatile and/or Gemini add-ons to the final object. Rename the source file physmap_of_core.c to get the desired build components.

Fixes 4f04f68e1598 ("mtd: physmap_of: fixup gemini/versatile dependencies")

Signed-off-by Linus Walleij <[email protected]>

Acked-by Boris Brezillon <[email protected]>

Signed-off-by Brian Norris <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/mtd/maps/Makefile          |   10 
 drivers/mtd/maps/physmap_of.c      |  389 -------------------------------------
 drivers/mtd/maps/physmap_of_core.c |  389 +++++++++++++++++++++++++++++++++++++
 3 files changed, 393 insertions(+), 395 deletions(-)

drivers/mtd/maps/Makefile +4 -6

@@ -17,12 +17,10 @@ obj-$(CONFIG_MTD_CK804XROM)	+= ck804xrom
 obj-$(CONFIG_MTD_TSUNAMI)	+= tsunami_flash.o
 obj-$(CONFIG_MTD_PXA2XX)	+= pxa2xx-flash.o
 obj-$(CONFIG_MTD_PHYSMAP)	+= physmap.o
-ifdef CONFIG_MTD_PHYSMAP_OF_VERSATILE
-physmap_of-objs += physmap_of_versatile.o
-endif
-ifdef CONFIG_MTD_PHYSMAP_OF_GEMINI
-physmap_of-objs += physmap_of_gemini.o
-endif
+physmap_of-objs-y		+= physmap_of_core.o
+physmap_of-objs-$(CONFIG_MTD_PHYSMAP_OF_VERSATILE) += physmap_of_versatile.o
+physmap_of-objs-$(CONFIG_MTD_PHYSMAP_OF_GEMINI) += physmap_of_gemini.o
+physmap_of-objs			:= $(physmap_of-objs-y)
 obj-$(CONFIG_MTD_PHYSMAP_OF)	+= physmap_of.o
 obj-$(CONFIG_MTD_PISMO)		+= pismo.o
 obj-$(CONFIG_MTD_PMC_MSP_EVM)   += pmcmsp-flash.o

drivers/mtd/maps/physmap_of.c deleted +0 ~~-389~~

389 lines not on this page · raw message

drivers/mtd/maps/physmap_of_core.c new file +389 -0

389 lines not on this page · raw message

Greg Kroah-Hartman

author maintainer

2017-06-19 15:15 UTC #32 lore raw

PATCH 35/78 powerpc/mm: Add physical address to Linux page table dump

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Oliver O'Halloran <[email protected]>

commit aaa229529244a1135b29353fefb001c430db79f0 upstream.

The current page table dumper scans the Linux page tables and coalesces mappings with adjacent virtual addresses and similar PTE flags. This behaviour is somewhat broken when you consider the IOREMAP space where entirely unrelated mappings will appear to be virtually contiguous. This patch modifies the range coalescing so that only ranges that are both physically and virtually contiguous are combined. This patch also adds to the dump output the physical address at the start of each range.

Fixes 8eb07b187000 ("powerpc/mm: Dump linux pagetables")

Signed-off-by Oliver O'Halloran <[email protected]>

[mpe: Print the physicall address with 0x like the other addresses]

Signed-off-by Michael Ellerman <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 arch/powerpc/mm/dump_linuxpagetables.c |   18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

arch/powerpc/mm/dump_linuxpagetables.c +16 -2

@@ -57,6 +57,8 @@ struct pg_state {
 	struct seq_file *seq;
 	const struct addr_marker *marker;
 	unsigned long start_address;
+	unsigned long start_pa;
+	unsigned long last_pa;
 	unsigned int level;
 	u64 current_flags;
 };

@@ -253,7 +255,9 @@ static void dump_addr(struct pg_state *s
 	const char *unit = units;
 	unsigned long delta;
 
-	seq_printf(st->seq, "0x%016lx-0x%016lx   ", st->start_address, addr-1);
+	seq_printf(st->seq, "0x%016lx-0x%016lx ", st->start_address, addr-1);
+	seq_printf(st->seq, "0x%016lx ", st->start_pa);
+
 	delta = (addr - st->start_address) >> 10;
 	/* Work out what appropriate unit to use */
 	while (!(delta & 1023) && unit[1]) {

@@ -268,11 +272,15 @@ static void note_page(struct pg_state *s
 	       unsigned int level, u64 val)
 {
 	u64 flag = val & pg_level[level].mask;
+	u64 pa = val & PTE_RPN_MASK;
+
 	/* At first no level is set */
 	if (!st->level) {
 		st->level = level;
 		st->current_flags = flag;
 		st->start_address = addr;
+		st->start_pa = pa;
+		st->last_pa = pa;
 		seq_printf(st->seq, "---[ %s ]---\n", st->marker->name);
 	/*
 	 * Dump the section of virtual memory when:

@@ -280,9 +288,11 @@ static void note_page(struct pg_state *s
 	 *   - we change levels in the tree.
 	 *   - the address is in a different section of memory and is thus
 	 *   used for a different purpose, regardless of the flags.
+	 *   - the pa of this page is not adjacent to the last inspected page
 	 */
 	} else if (flag != st->current_flags || level != st->level ||
-		   addr >= st->marker[1].start_address) {
+		   addr >= st->marker[1].start_address ||
+		   pa != st->last_pa + PAGE_SIZE) {
 
 		/* Check the PTE flags */
 		if (st->current_flags) {

@@ -306,8 +316,12 @@ static void note_page(struct pg_state *s
 			seq_printf(st->seq, "---[ %s ]---\n", st->marker->name);
 		}
 		st->start_address = addr;
+		st->start_pa = pa;
+		st->last_pa = pa;
 		st->current_flags = flag;
 		st->level = level;
+	} else {
+		st->last_pa = pa;
 	}
 }

Greg Kroah-Hartman

author maintainer

2017-06-19 15:15 UTC #33 lore raw

PATCH 36/78 staging: rtl8188eu: prevent an underflow in rtw_check_beacon_data()

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Dan Carpenter <[email protected]>

commit 784047eb2d3405a35087af70cba46170c5576b25 upstream.

The "len" could be as low as -14 so we should check for negatives.

Fixes 9a7fe54ddc3a ("staging: r8188eu: Add source files for new driver - part 1")

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/staging/rtl8188eu/core/rtw_ap.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

drivers/staging/rtl8188eu/core/rtw_ap.c +1 -1

@@ -888,7 +888,7 @@ int rtw_check_beacon_data(struct adapter
 		return _FAIL;
 
 
-	if (len > MAX_IE_SZ)
+	if (len < 0 || len > MAX_IE_SZ)
 		return _FAIL;
 
 	pbss_network->IELength = len;

Greg Kroah-Hartman

author maintainer

2017-06-19 15:15 UTC #34 lore raw

PATCH 37/78 staging: bcm2835-camera: fix error handling in init

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Dan Carpenter <[email protected]>

commit 8e17858a8818b40d66e83de2bf3724c64eaad72d upstream.

The unwinding here isn't right. We don't free gdev[0] and instead free 1 step past what was allocated. Also we can't allocate "dev" then we should unwind instead of returning directly.

Fixes 7b3ad5abf027 ("staging: Import the BCM2835 MMAL-based V4L2 camera driver.")

Acked-by walter harms <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/staging/media/platform/bcm2835/bcm2835-camera.c |   14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

drivers/staging/media/platform/bcm2835/bcm2835-camera.c +9 -5

@@ -1901,6 +1901,7 @@ static int __init bm2835_mmal_init(void)
 	unsigned int num_cameras;
 	struct vchiq_mmal_instance *instance;
 	unsigned int resolutions[MAX_BCM2835_CAMERAS][2];
+	int i;
 
 	ret = vchiq_mmal_init(&instance);
 	if (ret < 0)

@@ -1914,8 +1915,10 @@ static int __init bm2835_mmal_init(void)
 
 	for (camera = 0; camera < num_cameras; camera++) {
 		dev = kzalloc(sizeof(struct bm2835_mmal_dev), GFP_KERNEL);
-		if (!dev)
-			return -ENOMEM;
+		if (!dev) {
+			ret = -ENOMEM;
+			goto cleanup_gdev;
+		}
 
 		dev->camera_num = camera;
 		dev->max_width = resolutions[camera][0];

@@ -1998,9 +2001,10 @@ unreg_dev:
 free_dev:
 	kfree(dev);
 
-	for ( ; camera > 0; camera--) {
-		bcm2835_cleanup_instance(gdev[camera]);
-		gdev[camera] = NULL;
+cleanup_gdev:
+	for (i = 0; i < camera; i++) {
+		bcm2835_cleanup_instance(gdev[i]);
+		gdev[i] = NULL;
 	}
 	pr_info("%s: error %d while loading driver\n",
 		BM2835_MMAL_MODULE_NAME, ret);

Greg Kroah-Hartman

author maintainer

2017-06-19 15:18 UTC #35 lore raw

PATCH 38/78 staging: iio: tsl2x7x_core: Fix standard deviation calculation

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Eva Rachel Retuya <[email protected]>

commit cf6c77323a96fc40309cc8a4921ef206cccdd961 upstream.

Standard deviation is calculated as the square root of the variance where variance is the mean of sample_sum and length. Correct the computation of statP->stddev in accordance to the proper calculation.

Fixes 3c97c08b5735 ("staging: iio: add TAOS tsl2x7x driver")

Reported-by Abhiram Balasubramanian <[email protected]>

Signed-off-by Eva Rachel Retuya <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/staging/iio/light/tsl2x7x_core.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

drivers/staging/iio/light/tsl2x7x_core.c +1 -1

@@ -854,7 +854,7 @@ void tsl2x7x_prox_calculate(int *data, i
 		tmp = data[i] - statP->mean;
 		sample_sum += tmp * tmp;
 	}
-	statP->stddev = int_sqrt((long)sample_sum) / length;
+	statP->stddev = int_sqrt((long)sample_sum / length);
 }
 
 /**

Greg Kroah-Hartman

author maintainer

2017-06-19 15:19 UTC #36 lore raw

PATCH 39/78 iio: imu: st_lsm6dsx: do not apply ODR configuration in write_raw handler

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Lorenzo Bianconi <[email protected]>

commit 2ccc15036d812e75f334c0fb813104ef765a2c77 upstream.

This patch allows to avoid a transitory that occurs when a given sensor has been already enabled (e.g. gyroscope) and the user is configuring the sample frequency of the other one (e.g. accelerometer). The transitory lasts until the accelerometer is enabled. During that time slice the gyroscope ODR is incorrectly modified as well. At the end of the transitory both sensors work at the right frequency. Fix it introducing st_lsm6dsx_check_odr() routine to check ODR consistency in write_raw handler in order to apply frequency configuration just in st_lsm6dsx_set_odr()

Fixes 290a6ce11d93 (iio: imu: add support to lsm6dsx driver)

Signed-off-by Lorenzo Bianconi <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c |   41 +++++++++++++++++----------
 1 file changed, 26 insertions(+), 15 deletions(-)

drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c +26 ~~-15~~

@@ -298,32 +298,40 @@ static int st_lsm6dsx_set_full_scale(str
 	return 0;
 }
 
-static int st_lsm6dsx_set_odr(struct st_lsm6dsx_sensor *sensor, u16 odr)
+static int st_lsm6dsx_check_odr(struct st_lsm6dsx_sensor *sensor, u16 odr,
+				u8 *val)
 {
-	enum st_lsm6dsx_sensor_id id = sensor->id;
-	int i, err;
-	u8 val;
+	int i;
 
 	for (i = 0; i < ST_LSM6DSX_ODR_LIST_SIZE; i++)
-		if (st_lsm6dsx_odr_table[id].odr_avl[i].hz == odr)
+		if (st_lsm6dsx_odr_table[sensor->id].odr_avl[i].hz == odr)
 			break;
 
 	if (i == ST_LSM6DSX_ODR_LIST_SIZE)
 		return -EINVAL;
 
-	val = st_lsm6dsx_odr_table[id].odr_avl[i].val;
-	err = st_lsm6dsx_write_with_mask(sensor->hw,
-					 st_lsm6dsx_odr_table[id].reg.addr,
-					 st_lsm6dsx_odr_table[id].reg.mask,
-					 val);
-	if (err < 0)
-		return err;
-
+	*val = st_lsm6dsx_odr_table[sensor->id].odr_avl[i].val;
 	sensor->odr = odr;
 
 	return 0;
 }
 
+static int st_lsm6dsx_set_odr(struct st_lsm6dsx_sensor *sensor, u16 odr)
+{
+	enum st_lsm6dsx_sensor_id id = sensor->id;
+	int err;
+	u8 val;
+
+	err = st_lsm6dsx_check_odr(sensor, odr, &val);
+	if (err < 0)
+		return err;
+
+	return st_lsm6dsx_write_with_mask(sensor->hw,
+					  st_lsm6dsx_odr_table[id].reg.addr,
+					  st_lsm6dsx_odr_table[id].reg.mask,
+					  val);
+}
+
 int st_lsm6dsx_sensor_enable(struct st_lsm6dsx_sensor *sensor)
 {
 	int err;

@@ -426,9 +434,12 @@ static int st_lsm6dsx_write_raw(struct i
 	case IIO_CHAN_INFO_SCALE:
 		err = st_lsm6dsx_set_full_scale(sensor, val2);
 		break;
-	case IIO_CHAN_INFO_SAMP_FREQ:
-		err = st_lsm6dsx_set_odr(sensor, val);
+	case IIO_CHAN_INFO_SAMP_FREQ: {
+		u8 data;
+
+		err = st_lsm6dsx_check_odr(sensor, val, &data);
 		break;
+	}
 	default:
 		err = -EINVAL;
 		break;

Greg Kroah-Hartman

author maintainer

2017-06-19 15:15 UTC #37 lore raw

PATCH 40/78 iio: proximity: as3935: recalibrate RCO after resume

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Matt Ranostay <[email protected]>

commit 6272c0de13abf1480f701d38288f28a11b4301c4 upstream.

According to the datasheet the RCO must be recalibrated on every power-on-reset. Also remove mutex locking in the calibration function since callers other than the probe function (which doesn't need it) will have a lock.

Fixes 24ddb0e4bba4 ("iio: Add AS3935 lightning sensor support")

Cc George McCollister <[email protected]>

Signed-off-by Matt Ranostay <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/iio/proximity/as3935.c |    6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

drivers/iio/proximity/as3935.c +2 -4

@@ -269,8 +269,6 @@ static irqreturn_t as3935_interrupt_hand
 
 static void calibrate_as3935(struct as3935_state *st)
 {
-	mutex_lock(&st->lock);
-
 	/* mask disturber interrupt bit */
 	as3935_write(st, AS3935_INT, BIT(5));

@@ -280,8 +278,6 @@ static void calibrate_as3935(struct as39
 
 	mdelay(2);
 	as3935_write(st, AS3935_TUNE_CAP, (st->tune_cap / TUNE_CAP_DIV));
-
-	mutex_unlock(&st->lock);
 }
 
 #ifdef CONFIG_PM_SLEEP

@@ -318,6 +314,8 @@ static int as3935_resume(struct device *
 	val &= ~AS3935_AFE_PWR_BIT;
 	ret = as3935_write(st, AS3935_AFE_GAIN, val);
 
+	calibrate_as3935(st);
+
 err_resume:
 	mutex_unlock(&st->lock);

Greg Kroah-Hartman

author maintainer

2017-06-19 15:22 UTC #38 lore raw

PATCH 41/78 iio: adc: ti_am335x_adc: allocating too much in probe

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Dan Carpenter <[email protected]>

commit 5ba5b437efaa7a502eec393c045d3bf90c92c4e9 upstream.

We should be allocating enough information for a tiadc_device struct which is about 400 bytes but instead we allocate enough for a second iio_dev struct which is over 2000 bytes.

Fixes fea89e2dfcea ("iio: adc: ti_am335x_adc: use variable names for sizeof() operator")

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/iio/adc/ti_am335x_adc.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

drivers/iio/adc/ti_am335x_adc.c +1 -1

@@ -614,7 +614,7 @@ static int tiadc_probe(struct platform_d
 		return -EINVAL;
 	}
 
-	indio_dev = devm_iio_device_alloc(&pdev->dev, sizeof(*indio_dev));
+	indio_dev = devm_iio_device_alloc(&pdev->dev, sizeof(*adc_dev));
 	if (indio_dev == NULL) {
 		dev_err(&pdev->dev, "failed to allocate iio device\n");
 		return -ENOMEM;

Greg Kroah-Hartman

author maintainer

2017-06-19 15:22 UTC #39 lore raw

PATCH 42/78 ALSA: hda: Add Geminilake id to SKL_PLUS

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Subhransu S. Prusty <[email protected]>

commit 12ee4022f67f8854061b46e5c0a7ad6258ab66c2 upstream.

Geminilake is Skylake family platform. So add it's id to skl_plus check.

Fixes 126cfa2f5e15 ("ALSA: hda: Add Geminilake HDMI codec ID")

Signed-off-by Subhransu S. Prusty <[email protected]>

Cc Senthilnathan Veppur <[email protected]>

Cc Vinod Koul <[email protected]>

Cc Takashi Iwai <[email protected]>

Signed-off-by Takashi Iwai <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 sound/pci/hda/hda_intel.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

sound/pci/hda/hda_intel.c +3 -1

@@ -369,8 +369,10 @@ enum {
 #define IS_KBL_LP(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0x9d71)
 #define IS_KBL_H(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0xa2f0)
 #define IS_BXT(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0x5a98)
+#define IS_GLK(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0x3198)
 #define IS_SKL_PLUS(pci) (IS_SKL(pci) || IS_SKL_LP(pci) || IS_BXT(pci)) || \
-			IS_KBL(pci) || IS_KBL_LP(pci) || IS_KBL_H(pci)
+			IS_KBL(pci) || IS_KBL_LP(pci) || IS_KBL_H(pci)	|| \
+			IS_GLK(pci)
 
 static char *driver_short_names[] = {
 	[AZX_DRIVER_ICH] = "HDA Intel",

Greg Kroah-Hartman

author maintainer

2017-06-19 15:15 UTC #40 lore raw

PATCH 43/78 ALSA: usb-audio: fix Amanero Combo384 quirk on big-endian hosts

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Johan Hovold <[email protected]>

commit f83914fdfcc3ecb62a5a83eeb609ff59a9c2052d upstream.

Add missing endianness conversion when using the USB device-descriptor bcdDevice field when applying the Amanero Combo384 (endianness!) quirk.

Fixes 3eff682d765b ("ALSA: usb-audio: Support both DSD LE/BE Amanero firmware versions")

Cc Jussi Laako <[email protected]>

Signed-off-by Takashi Iwai <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 sound/usb/quirks.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

sound/usb/quirks.c +1 -1

@@ -1364,7 +1364,7 @@ u64 snd_usb_interface_dsd_format_quirks(
 	/* Amanero Combo384 USB interface with native DSD support */
 	case USB_ID(0x16d0, 0x071a):
 		if (fp->altsetting == 2) {
-			switch (chip->dev->descriptor.bcdDevice) {
+			switch (le16_to_cpu(chip->dev->descriptor.bcdDevice)) {
 			case 0x199:
 				return SNDRV_PCM_FMTBIT_DSD_U32_LE;
 			case 0x19b:

Greg Kroah-Hartman

author maintainer

2017-06-19 15:15 UTC #41 lore raw

PATCH 44/78 usb: gadget: udc: renesas_usb3: fix pm_runtime functions calling

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Yoshihiro Shimoda <[email protected]>

commit cdc876877ebc3f0677b267756d4564e2a429e730 upstream.

This patch fixes an issue that this driver is possible to access the registers before pm_runtime_get_sync() if a gadget driver is installed first. After that, oops happens on R-Car Gen3 environment. To avoid it, this patch changes the pm_runtime call timing from probe/remove to udc_start/udc_stop.

Fixes 746bfe63bba3 ("usb: gadget: renesas_usb3: add support for Renesas USB3.0 peripheral controller")

Signed-off-by Yoshihiro Shimoda <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/usb/gadget/udc/renesas_usb3.c |   12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

drivers/usb/gadget/udc/renesas_usb3.c +6 -6

@@ -1707,6 +1707,9 @@ static int renesas_usb3_start(struct usb
 	/* hook up the driver */
 	usb3->driver = driver;
 
+	pm_runtime_enable(usb3_to_dev(usb3));
+	pm_runtime_get_sync(usb3_to_dev(usb3));
+
 	renesas_usb3_init_controller(usb3);
 
 	return 0;

@@ -1724,6 +1727,9 @@ static int renesas_usb3_stop(struct usb_
 	renesas_usb3_stop_controller(usb3);
 	spin_unlock_irqrestore(&usb3->lock, flags);
 
+	pm_runtime_put(usb3_to_dev(usb3));
+	pm_runtime_disable(usb3_to_dev(usb3));
+
 	return 0;
 }

@@ -1761,9 +1767,6 @@ static int renesas_usb3_remove(struct pl
 {
 	struct renesas_usb3 *usb3 = platform_get_drvdata(pdev);
 
-	pm_runtime_put(&pdev->dev);
-	pm_runtime_disable(&pdev->dev);
-
 	usb_del_gadget_udc(&usb3->gadget);
 
 	__renesas_usb3_ep_free_request(usb3->ep0_req);

@@ -1948,9 +1951,6 @@ static int renesas_usb3_probe(struct pla
 
 	usb3->workaround_for_vbus = priv->workaround_for_vbus;
 
-	pm_runtime_enable(&pdev->dev);
-	pm_runtime_get_sync(&pdev->dev);
-
 	dev_info(&pdev->dev, "probed\n");
 
 	return 0;

Greg Kroah-Hartman

author maintainer

2017-06-19 15:22 UTC #42 lore raw

PATCH 45/78 usb: gadget: udc: renesas_usb3: fix deadlock by spinlock

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Yoshihiro Shimoda <[email protected]>

commit 067d6fdc558d2c43f0bfdc7af99630dd5eb08dc5 upstream.

This patch fixes an issue that this driver is possible to cause deadlock by double-spinclocked in renesas_usb3_stop_controller(). So, this patch removes spinlock API calling in renesas_usb3_stop(). (In other words, the previous code had a redundant lock.)

Fixes 746bfe63bba3 ("usb: gadget: renesas_usb3: add support for Renesas USB3.0 peripheral controller")

Signed-off-by Yoshihiro Shimoda <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/usb/gadget/udc/renesas_usb3.c |    3 ---
 1 file changed, 3 deletions(-)

drivers/usb/gadget/udc/renesas_usb3.c +0 -3

@@ -1718,14 +1718,11 @@ static int renesas_usb3_start(struct usb
 static int renesas_usb3_stop(struct usb_gadget *gadget)
 {
 	struct renesas_usb3 *usb3 = gadget_to_renesas_usb3(gadget);
-	unsigned long flags;
 
-	spin_lock_irqsave(&usb3->lock, flags);
 	usb3->softconnect = false;
 	usb3->gadget.speed = USB_SPEED_UNKNOWN;
 	usb3->driver = NULL;
 	renesas_usb3_stop_controller(usb3);
-	spin_unlock_irqrestore(&usb3->lock, flags);
 
 	pm_runtime_put(usb3_to_dev(usb3));
 	pm_runtime_disable(usb3_to_dev(usb3));

Greg Kroah-Hartman

author maintainer

2017-06-19 15:22 UTC #43 lore raw

PATCH 46/78 usb: gadget: udc: renesas_usb3: lock for PN_ registers access

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Yoshihiro Shimoda <[email protected]>

commit 940f538a100c84c6e72813e4ac88bd1753a86945 upstream.

This controller disallows to change the PIPE until reading/writing a packet finishes. However. the previous code is not enough to hold the lock in some functions. So, this patch fixes it.

Fixes 746bfe63bba3 ("usb: gadget: renesas_usb3: add support for Renesas USB3.0 peripheral controller")

Signed-off-by Yoshihiro Shimoda <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/usb/gadget/udc/renesas_usb3.c |   28 +++++++++++++++++++++++++---
 1 file changed, 25 insertions(+), 3 deletions(-)

drivers/usb/gadget/udc/renesas_usb3.c +25 -3

@@ -1401,7 +1401,13 @@ static void usb3_request_done_pipen(stru
 				    struct renesas_usb3_request *usb3_req,
 				    int status)
 {
-	usb3_pn_stop(usb3);
+	unsigned long flags;
+
+	spin_lock_irqsave(&usb3->lock, flags);
+	if (usb3_pn_change(usb3, usb3_ep->num))
+		usb3_pn_stop(usb3);
+	spin_unlock_irqrestore(&usb3->lock, flags);
+
 	usb3_disable_pipe_irq(usb3, usb3_ep->num);
 	usb3_request_done(usb3_ep, usb3_req, status);

@@ -1430,30 +1436,46 @@ static void usb3_irq_epc_pipen_bfrdy(str
 {
 	struct renesas_usb3_ep *usb3_ep = usb3_get_ep(usb3, num);
 	struct renesas_usb3_request *usb3_req = usb3_get_request(usb3_ep);
+	bool done = false;
 
 	if (!usb3_req)
 		return;
 
+	spin_lock(&usb3->lock);
+	if (usb3_pn_change(usb3, num))
+		goto out;
+
 	if (usb3_ep->dir_in) {
 		/* Do not stop the IN pipe here to detect LSTTR interrupt */
 		if (!usb3_write_pipe(usb3_ep, usb3_req, USB3_PN_WRITE))
 			usb3_clear_bit(usb3, PN_INT_BFRDY, USB3_PN_INT_ENA);
 	} else {
 		if (!usb3_read_pipe(usb3_ep, usb3_req, USB3_PN_READ))
-			usb3_request_done_pipen(usb3, usb3_ep, usb3_req, 0);
+			done = true;
 	}
+
+out:
+	/* need to unlock because usb3_request_done_pipen() locks it */
+	spin_unlock(&usb3->lock);
+
+	if (done)
+		usb3_request_done_pipen(usb3, usb3_ep, usb3_req, 0);
 }
 
 static void usb3_irq_epc_pipen(struct renesas_usb3 *usb3, int num)
 {
 	u32 pn_int_sta;
 
-	if (usb3_pn_change(usb3, num) < 0)
+	spin_lock(&usb3->lock);
+	if (usb3_pn_change(usb3, num) < 0) {
+		spin_unlock(&usb3->lock);
 		return;
+	}
 
 	pn_int_sta = usb3_read(usb3, USB3_PN_INT_STA);
 	pn_int_sta &= usb3_read(usb3, USB3_PN_INT_ENA);
 	usb3_write(usb3, pn_int_sta, USB3_PN_INT_STA);
+	spin_unlock(&usb3->lock);
 	if (pn_int_sta & PN_INT_LSTTR)
 		usb3_irq_epc_pipen_lsttr(usb3, num);
 	if (pn_int_sta & PN_INT_BFRDY)

Greg Kroah-Hartman

author maintainer

2017-06-19 15:15 UTC #44 lore raw

PATCH 47/78 USB: hub: fix SS max number of ports

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Johan Hovold <[email protected]>

commit 93491ced3c87c94b12220dbac0527e1356702179 upstream.

Add define for the maximum number of ports on a SuperSpeed hub as per USB 3.1 spec Table 10-5, and use it when verifying the retrieved hub descriptor.

This specifically avoids benign attempts to update the DeviceRemovable mask for non-existing ports (should we get that far).

Fixes dbe79bbe9dcb ("USB 3.0 Hub Changes")

Acked-by Alan Stern <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/usb/core/hub.c        |    8 +++++++-
 include/uapi/linux/usb/ch11.h |    3 +++
 2 files changed, 10 insertions(+), 1 deletion(-)

drivers/usb/core/hub.c +7 -1

@@ -1336,7 +1336,13 @@ static int hub_configure(struct usb_hub
 	if (ret < 0) {
 		message = "can't read hub descriptor";
 		goto fail;
-	} else if (hub->descriptor->bNbrPorts > USB_MAXCHILDREN) {
+	}
+
+	maxchild = USB_MAXCHILDREN;
+	if (hub_is_superspeed(hdev))
+		maxchild = min_t(unsigned, maxchild, USB_SS_MAXPORTS);
+
+	if (hub->descriptor->bNbrPorts > maxchild) {
 		message = "hub has too many ports!";
 		ret = -ENODEV;
 		goto fail;

include/uapi/linux/usb/ch11.h +3 -0

@@ -22,6 +22,9 @@
  */
 #define USB_MAXCHILDREN		31
 
+/* See USB 3.1 spec Table 10-5 */
+#define USB_SS_MAXPORTS		15
+
 /*
  * Hub request types
  */

Greg Kroah-Hartman

author maintainer

2017-06-19 15:15 UTC #45 lore raw

PATCH 48/78 usb: core: fix potential memory leak in error path during hcd creation

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Anton Bondarenko <[email protected]>

commit 1a744d2eb76aaafb997fda004ae3ae62a1538f85 upstream.

Free memory allocated for address0_mutex if allocation of bandwidth_mutex failed.

Fixes feb26ac31a2a ("usb: core: hub: hub_port_init lock controller instead of bus")

Signed-off-by Anton Bondarenko <[email protected]>

Acked-by Alan Stern <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/usb/core/hcd.c |    1 +
 1 file changed, 1 insertion(+)

drivers/usb/core/hcd.c +1 -0

@@ -2535,6 +2535,7 @@ struct usb_hcd *usb_create_shared_hcd(co
 		hcd->bandwidth_mutex = kmalloc(sizeof(*hcd->bandwidth_mutex),
 				GFP_KERNEL);
 		if (!hcd->bandwidth_mutex) {
+			kfree(hcd->address0_mutex);
 			kfree(hcd);
 			dev_dbg(dev, "hcd bandwidth mutex alloc failed\n");
 			return NULL;

Greg Kroah-Hartman

author maintainer

2017-06-19 15:18 UTC #46 lore raw

PATCH 49/78 USB: usbip: fix nonconforming hub descriptor

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Johan Hovold <[email protected]>

commit ec963b412a54aac8e527708ecad06a6988a86fb4 upstream.

Fix up the root-hub descriptor to accommodate the variable-length DeviceRemovable and PortPwrCtrlMask fields, while marking all ports as removable (and leaving the reserved bit zero unset).

Also add a build-time constraint on VHCI_HC_PORTS which must never be greater than USB_MAXCHILDREN (but this was only enforced through a KConfig constant).

This specifically fixes the descriptor layout whenever VHCI_HC_PORTS is greater than seven (default is 8).

Fixes 04679b3489e0 ("Staging: USB/IP: add client driver")

Cc Takahiro Hirofuchi <[email protected]>

Cc Valentina Manea <[email protected]>

Acked-by Shuah Khan <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/usb/usbip/vhci_hcd.c |   11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

drivers/usb/usbip/vhci_hcd.c +8 -3

@@ -235,14 +235,19 @@ done:
 
 static inline void hub_descriptor(struct usb_hub_descriptor *desc)
 {
+	int width;
+
 	memset(desc, 0, sizeof(*desc));
 	desc->bDescriptorType = USB_DT_HUB;
-	desc->bDescLength = 9;
 	desc->wHubCharacteristics = cpu_to_le16(
 		HUB_CHAR_INDV_PORT_LPSM | HUB_CHAR_COMMON_OCPM);
+
 	desc->bNbrPorts = VHCI_HC_PORTS;
-	desc->u.hs.DeviceRemovable[0] = 0xff;
-	desc->u.hs.DeviceRemovable[1] = 0xff;
+	BUILD_BUG_ON(VHCI_HC_PORTS > USB_MAXCHILDREN);
+	width = desc->bNbrPorts / 8 + 1;
+	desc->bDescLength = USB_DT_HUB_NONVAR_SIZE + 2 * width;
+	memset(&desc->u.hs.DeviceRemovable[0], 0, width);
+	memset(&desc->u.hs.DeviceRemovable[width], 0xff, width);
 }
 
 static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,

Greg Kroah-Hartman

author maintainer

2017-06-19 15:15 UTC #47 lore raw

PATCH 50/78 usb: dwc3: gadget: Fix ISO transfer performance

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Roger Quadros <[email protected]>

commit f1d6826cae30e97e37a1f2481d7e1dc4faa09ce1 upstream.

Commit 08a36b543803 ("usb: dwc3: gadget: simplify __dwc3_gadget_ep_queue()") caused a small change in the way ISO transfer is handled in the case when XferInProgress event happens on Isoc EP with an active transfer. This caused a performance degradation of 50%. e.g. using g_webcam on DUT and luvcview on host the video frame rate dropped from 16fps to 8fps @high-speed.

Make the ISO transfer handling equivalent to that prior to that commit to get back the original ISO performance numbers.

Fixes 08a36b543803 ("usb: dwc3: gadget: simplify __dwc3_gadget_ep_queue()")

Signed-off-by Roger Quadros <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/usb/dwc3/gadget.c |   12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

drivers/usb/dwc3/gadget.c +11 -1

@@ -1258,14 +1258,24 @@ static int __dwc3_gadget_ep_queue(struct
 				__dwc3_gadget_start_isoc(dwc, dep, cur_uf);
 				dep->flags &= ~DWC3_EP_PENDING_REQUEST;
 			}
+			return 0;
 		}
-		return 0;
+
+		if ((dep->flags & DWC3_EP_BUSY) &&
+		    !(dep->flags & DWC3_EP_MISSED_ISOC)) {
+			WARN_ON_ONCE(!dep->resource_index);
+			ret = __dwc3_gadget_kick_transfer(dep,
+							  dep->resource_index);
+		}
+
+		goto out;
 	}
 
 	if (!dwc3_calc_trbs_left(dep))
 		return 0;
 
 	ret = __dwc3_gadget_kick_transfer(dep, 0);
+out:
 	if (ret == -EBUSY)
 		ret = 0;

Greg Kroah-Hartman

author maintainer

2017-06-19 15:15 UTC #48 lore raw

PATCH 51/78 pvrusb2: reduce stack usage pvr2_eeprom_analyze()

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Arnd Bergmann <[email protected]>

commit 6830733d53a4517588e56227b9c8538633f0c496 upstream.

The driver uses a relatively large data structure on the stack, which showed up on my radar as we get a warning with the "latent entropy" GCC plugin:

drivers/media/usb/pvrusb2/pvrusb2-eeprom.c:153:1: error: the frame size of 1376 bytes is larger than 1152 bytes [-Werror=frame-larger-than=]

The warning is usually hidden as we raise the warning limit to 2048 when the plugin is enabled, but I'd like to lower that again in the future, and making this function smaller helps to do that without build regressions.

Further analysis shows that putting an 'i2c_client' structure on the stack is not really supported, as the embedded 'struct device' is not initialized here, and we are only saved by the fact that the function that is called here does not use the pointer at all.

Fixes d855497edbfb ("V4L/DVB (4228a): pvrusb2 to kernel 2.6.18")

Signed-off-by Arnd Bergmann <[email protected]>

Signed-off-by Mauro Carvalho Chehab <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/media/usb/pvrusb2/pvrusb2-eeprom.c |   11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)

drivers/media/usb/pvrusb2/pvrusb2-eeprom.c +3 -8

@@ -118,15 +118,10 @@ int pvr2_eeprom_analyze(struct pvr2_hdw
 	memset(&tvdata,0,sizeof(tvdata));
 
 	eeprom = pvr2_eeprom_fetch(hdw);
-	if (!eeprom) return -EINVAL;
+	if (!eeprom)
+		return -EINVAL;
 
-	{
-		struct i2c_client fake_client;
-		/* Newer version expects a useless client interface */
-		fake_client.addr = hdw->eeprom_addr;
-		fake_client.adapter = &hdw->i2c_adap;
-		tveeprom_hauppauge_analog(&fake_client,&tvdata,eeprom);
-	}
+	tveeprom_hauppauge_analog(NULL, &tvdata, eeprom);
 
 	trace_eeprom("eeprom assumed v4l tveeprom module");
 	trace_eeprom("eeprom direct call results:");

Greg Kroah-Hartman

author maintainer

2017-06-19 15:15 UTC #49 lore raw

PATCH 52/78 USB: gadget: dummy_hcd: fix hub-descriptor removable fields

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Johan Hovold <[email protected]>

commit d81182ce30dbd497a1e7047d7fda2af040347790 upstream.

Flag the first and only port as removable while also leaving the remaining bits (including the reserved bit zero) unset in accordance with the specifications:

"Within a byte, if no port exists for a given location, the bit field representing the port characteristics shall be 0."

Also add a comment marking the legacy PortPwrCtrlMask field.

Fixes 1cd8fd2887e1 ("usb: gadget: dummy_hcd: add SuperSpeed support")

Fixes 1da177e4c3f4 ("Linux-2.6.12-rc2")

Cc Tatyana Brokhman <[email protected]>

Acked-by Alan Stern <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/usb/gadget/udc/dummy_hcd.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

drivers/usb/gadget/udc/dummy_hcd.c +3 -3

@@ -2008,7 +2008,7 @@ ss_hub_descriptor(struct usb_hub_descrip
 			HUB_CHAR_COMMON_OCPM);
 	desc->bNbrPorts = 1;
 	desc->u.ss.bHubHdrDecLat = 0x04; /* Worst case: 0.4 micro sec*/
-	desc->u.ss.DeviceRemovable = 0xffff;
+	desc->u.ss.DeviceRemovable = 0;
 }
 
 static inline void hub_descriptor(struct usb_hub_descriptor *desc)

@@ -2020,8 +2020,8 @@ static inline void hub_descriptor(struct
 			HUB_CHAR_INDV_PORT_LPSM |
 			HUB_CHAR_COMMON_OCPM);
 	desc->bNbrPorts = 1;
-	desc->u.hs.DeviceRemovable[0] = 0xff;
-	desc->u.hs.DeviceRemovable[1] = 0xff;
+	desc->u.hs.DeviceRemovable[0] = 0;
+	desc->u.hs.DeviceRemovable[1] = 0xff;	/* PortPwrCtrlMask */
 }
 
 static int dummy_hub_control(

Greg Kroah-Hartman

author maintainer

2017-06-19 15:15 UTC #50 lore raw

PATCH 53/78 usb: r8a66597-hcd: select a different endpoint on timeout

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Chris Brandt <[email protected]>

commit 1f873d857b6c2fefb4dada952674aa01bcfb92bd upstream.

If multiple endpoints on a single device have pending IN URBs and one endpoint times out due to NAKs (perfectly legal), select a different endpoint URB to try.
The existing code only checked to see another device address has pending URBs and ignores other IN endpoints on the current device address. This leads to endpoints never getting serviced if one endpoint is using NAK as a flow control method.

Fixes 5d3043586db4 ("usb: r8a66597-hcd: host controller driver for R8A6659")

Signed-off-by Chris Brandt <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/usb/host/r8a66597-hcd.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

drivers/usb/host/r8a66597-hcd.c +3 -1

@@ -1785,6 +1785,7 @@ static void r8a66597_td_timer(unsigned l
 		pipe = td->pipe;
 		pipe_stop(r8a66597, pipe);
 
+		/* Select a different address or endpoint */
 		new_td = td;
 		do {
 			list_move_tail(&new_td->queue,

@@ -1794,7 +1795,8 @@ static void r8a66597_td_timer(unsigned l
 				new_td = td;
 				break;
 			}
-		} while (td != new_td && td->address == new_td->address);
+		} while (td != new_td && td->address == new_td->address &&
+			td->pipe->info.epnum == new_td->pipe->info.epnum);
 
 		start_transfer(r8a66597, new_td);

Greg Kroah-Hartman

author maintainer

2017-06-19 15:18 UTC #51 lore raw

PATCH 54/78 usb: r8a66597-hcd: decrease timeout

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Chris Brandt <[email protected]>

commit dd14a3e9b92ac6f0918054f9e3477438760a4fa6 upstream.

The timeout for BULK packets was 300ms which is a long time if other endpoints or devices are waiting for their turn. Changing it to 50ms greatly increased the overall performance for multi-endpoint devices.

Fixes 5d3043586db4 ("usb: r8a66597-hcd: host controller driver for R8A6659")

Signed-off-by Chris Brandt <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/usb/host/r8a66597-hcd.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

drivers/usb/host/r8a66597-hcd.c +1 -1

@@ -1269,7 +1269,7 @@ static void set_td_timer(struct r8a66597
 			time = 30;
 			break;
 		default:
-			time = 300;
+			time = 50;
 			break;
 		}

Greg Kroah-Hartman

author maintainer

2017-06-19 15:19 UTC #52 lore raw

PATCH 55/78 coda: restore original firmware locations

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Philipp Zabel <[email protected]>

commit 1e9b71d53ddc3b8df81ef6be052e31b70442a47f upstream.

Recently, an unfinished patch was merged that added a third entry to the beginning of the array of firmware locations without changing the code to also look at the third element, thus pushing an old firmware location off the list.

Fixes 8af7779f3cbc ("[media] coda: add Freescale firmware compatibility location")

Signed-off-by Philipp Zabel <[email protected]>

Acked-by Baruch Siach <[email protected]>

Reviewed-by Fabio Estevam <[email protected]>

Signed-off-by Mauro Carvalho Chehab <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/media/platform/coda/coda-common.c |   21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)

drivers/media/platform/coda/coda-common.c +13 -8

@@ -2126,7 +2126,12 @@ static void coda_fw_callback(const struc
 
 static int coda_firmware_request(struct coda_dev *dev)
 {
-	char *fw = dev->devtype->firmware[dev->firmware];
+	char *fw;
+
+	if (dev->firmware >= ARRAY_SIZE(dev->devtype->firmware))
+		return -EINVAL;
+
+	fw = dev->devtype->firmware[dev->firmware];
 
 	dev_dbg(&dev->plat_dev->dev, "requesting firmware '%s' for %s\n", fw,
 		coda_product_name(dev->devtype->product));

@@ -2142,16 +2147,16 @@ static void coda_fw_callback(const struc
 	struct platform_device *pdev = dev->plat_dev;
 	int i, ret;
 
-	if (!fw && dev->firmware == 1) {
-		v4l2_err(&dev->v4l2_dev, "firmware request failed\n");
-		goto put_pm;
-	}
 	if (!fw) {
-		dev->firmware = 1;
-		coda_firmware_request(dev);
+		dev->firmware++;
+		ret = coda_firmware_request(dev);
+		if (ret < 0) {
+			v4l2_err(&dev->v4l2_dev, "firmware request failed\n");
+			goto put_pm;
+		}
 		return;
 	}
-	if (dev->firmware == 1) {
+	if (dev->firmware > 0) {
 		/*
 		 * Since we can't suppress warnings for failed asynchronous
 		 * firmware requests, report that the fallback firmware was

Greg Kroah-Hartman

author maintainer

2017-06-19 15:19 UTC #53 lore raw

PATCH 56/78 drivers/misc/c2port/c2port-duramar2150.c: checking for NULL instead of IS_ERR()

Link http://lkml.kernel.org/r/20170412083321.GC3250@mwanda open here

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Dan Carpenter <[email protected]>

commit 8128a31eaadbcdfa37774bbd28f3f00bac69996a upstream.

c2port_device_register() never returns NULL, it uses error pointers.

Fixes 65131cd52b9e ("c2port: add c2port support for Eurotech Duramar 2150")

Acked-by Rodolfo Giometti <[email protected]>

Cc Greg Kroah-Hartman <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/misc/c2port/c2port-duramar2150.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

drivers/misc/c2port/c2port-duramar2150.c +2 -2

@@ -129,8 +129,8 @@ static int __init duramar2150_c2port_ini
 
 	duramar2150_c2port_dev = c2port_device_register("uc",
 					&duramar2150_c2port_ops, NULL);
-	if (!duramar2150_c2port_dev) {
-		ret = -ENODEV;
+	if (IS_ERR(duramar2150_c2port_dev)) {
+		ret = PTR_ERR(duramar2150_c2port_dev);
 		goto free_region;
 	}

Greg Kroah-Hartman

author maintainer

2017-06-19 15:19 UTC #54 lore raw

PATCH 57/78 usb: xhci: Fix USB 3.1 supported protocol parsing

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: YD Tseng <[email protected]>

commit b72eb8435b25be3a1880264cf32ac91e626ba5ba upstream.

xHCI host controllers can have both USB 3.1 and 3.0 extended speed protocol lists. If the USB3.1 speed is parsed first and 3.0 second then the minor revision supported will be overwritten by the 3.0 speeds and the USB3 roothub will only show support for USB 3.0 speeds.

This was the case with a xhci controller with the supported protocol capability listed below.
In xhci-mem.c, the USB 3.1 speed is parsed first, the min_rev of usb3_rhub is set as 0x10. And then USB 3.0 is parsed. However, the min_rev of usb3_rhub will be changed to 0x00. If USB 3.1 device is connected behind this host controller, the speed of USB 3.1 device just reports 5G speed using lsusb.

     00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00 01 08 00 00 00 00 00 40 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
20 02 08 10 03 55 53 42 20 01 02 00 00 00 00 00 00 //USB 3.1
30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
40 02 08 00 03 55 53 42 20 03 06 00 00 00 00 00 00 //USB 3.0
50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
60 02 08 00 02 55 53 42 20 09 0E 19 00 00 00 00 00 //USB 2.0
70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

This patch fixes the issue by only owerwriting the minor revision if it is higher than the existing one.

[reword commit message -Mathias]

Signed-off-by YD Tseng <[email protected]>

Signed-off-by Mathias Nyman <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/usb/host/xhci-mem.c |    7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

drivers/usb/host/xhci-mem.c +5 -2

@@ -2128,11 +2128,12 @@ static void xhci_add_in_port(struct xhci
 {
 	u32 temp, port_offset, port_count;
 	int i;
-	u8 major_revision;
+	u8 major_revision, minor_revision;
 	struct xhci_hub *rhub;
 
 	temp = readl(addr);
 	major_revision = XHCI_EXT_PORT_MAJOR(temp);
+	minor_revision = XHCI_EXT_PORT_MINOR(temp);
 
 	if (major_revision == 0x03) {
 		rhub = &xhci->usb3_rhub;

@@ -2146,7 +2147,9 @@ static void xhci_add_in_port(struct xhci
 		return;
 	}
 	rhub->maj_rev = XHCI_EXT_PORT_MAJOR(temp);
-	rhub->min_rev = XHCI_EXT_PORT_MINOR(temp);
+
+	if (rhub->min_rev < minor_revision)
+		rhub->min_rev = minor_revision;
 
 	/* Port offset and count in the third dword, see section 7.2 */
 	temp = readl(addr + 2);

Greg Kroah-Hartman

author maintainer

2017-06-19 15:21 UTC #55 lore raw

PATCH 58/78 usb: xhci: ASMedia ASM1042A chipset need shorts TX quirk

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Corentin Labbe <[email protected]>

commit d2f48f05cd2a2a0a708fbfa45f1a00a87660d937 upstream.

When plugging an USB webcam I see the following message:

[106385.615559] xhci_hcd 0000:04:00.0: WARN Successful completion on short TX: needs XHCI_TRUST_TX_LENGTH quirk?
[106390.583860] handle_tx_event: 913 callbacks suppressed

With this patch applied, I get no more printing of this message.

Signed-off-by Corentin Labbe <[email protected]>

Signed-off-by Mathias Nyman <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/usb/host/xhci-pci.c |    3 +++
 1 file changed, 3 insertions(+)

drivers/usb/host/xhci-pci.c +3 -0

@@ -201,6 +201,9 @@ static void xhci_pci_quirks(struct devic
 	if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
 			pdev->device == 0x1042)
 		xhci->quirks |= XHCI_BROKEN_STREAMS;
+	if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
+			pdev->device == 0x1142)
+		xhci->quirks |= XHCI_TRUST_TX_LENGTH;
 
 	if (pdev->vendor == PCI_VENDOR_ID_TI && pdev->device == 0x8241)
 		xhci->quirks |= XHCI_LIMIT_ENDPOINT_INTERVAL_7;

Greg Kroah-Hartman

author maintainer

2017-06-19 15:21 UTC #56 lore raw

PATCH 59/78 USB: gadget: fix GPF in gadgetfs

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Alan Stern <[email protected]>

commit f50b878fed33e360d01dcdc31a8eeb1815d033d5 upstream.

A NULL-pointer dereference bug in gadgetfs was uncovered by syzkaller:

Quoted 40 lines

kasan: GPF could be caused by NULL-ptr deref or user memory access

general protection fault: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 2 PID: 4820 Comm: syz-executor0 Not tainted 4.12.0-rc4+ #5
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
task: ffff880039542dc0 task.stack: ffff88003bdd0000
RIP: 0010:__list_del_entry_valid+0x7e/0x170 lib/list_debug.c:51
RSP: 0018:ffff88003bdd6e50 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000010000
RDX: 0000000000000000 RSI: ffffffff86504948 RDI: ffffffff86504950
RBP: ffff88003bdd6e68 R08: ffff880039542dc0 R09: ffffffff8778ce00
R10: ffff88003bdd6e68 R11: dffffc0000000000 R12: 0000000000000000
R13: dffffc0000000000 R14: 1ffff100077badd2 R15: ffffffff864d2e40
FS:  0000000000000000(0000) GS:ffff88006dc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000002014aff9 CR3: 0000000006022000 CR4: 00000000000006e0
Call Trace:
 __list_del_entry include/linux/list.h:116 [inline]
 list_del include/linux/list.h:124 [inline]
 usb_gadget_unregister_driver+0x166/0x4c0 drivers/usb/gadget/udc/core.c:1387
 dev_release+0x80/0x160 drivers/usb/gadget/legacy/inode.c:1187
 __fput+0x332/0x7f0 fs/file_table.c:209
 ____fput+0x15/0x20 fs/file_table.c:245
 task_work_run+0x19b/0x270 kernel/task_work.c:116
 exit_task_work include/linux/task_work.h:21 [inline]
 do_exit+0x18a3/0x2820 kernel/exit.c:878
 do_group_exit+0x149/0x420 kernel/exit.c:982
 get_signal+0x77f/0x1780 kernel/signal.c:2318
 do_signal+0xd2/0x2130 arch/x86/kernel/signal.c:808
 exit_to_usermode_loop+0x1a7/0x240 arch/x86/entry/common.c:157
 prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline]
 syscall_return_slowpath+0x3ba/0x410 arch/x86/entry/common.c:263
 entry_SYSCALL_64_fastpath+0xbc/0xbe
RIP: 0033:0x4461f9
RSP: 002b:00007fdac2b1ecf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00000000007080c8 RCX: 00000000004461f9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000007080c8
RBP: 00000000007080a8 R08: 0000000000000000 R09: 0000000000000000

Quoted 8 lines

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fdac2b1f9c0 R15: 00007fdac2b1f700
Code: 00 00 00 00 ad de 49 39 c4 74 6a 48 b8 00 02 00 00 00 00 ad de
48 89 da 48 39 c3 74 74 48 c1 ea 03 48 b8 00 00 00 00 00 fc ff df <80>
3c 02 00 0f 85 92 00 00 00 48 8b 13 48 39 f2 75 66 49 8d 7c
RIP: __list_del_entry_valid+0x7e/0x170 lib/list_debug.c:51 RSP: ffff88003bdd6e50
---[ end trace 30e94b1eec4831c8 ]---
Kernel panic - not syncing: Fatal exception

The bug was caused by dev_release() failing to turn off its gadget_registered flag after unregistering the gadget driver. As a result, when a later user closed the device file before writing a valid set of descriptors, dev_release() thought the gadget had been registered and tried to unregister it, even though it had not been. This led to the NULL pointer dereference.

The fix is simple: turn off the flag when the gadget is unregistered.

Signed-off-by Alan Stern <[email protected]>

Reported-and-tested-by Andrey Konovalov <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/usb/gadget/legacy/inode.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

drivers/usb/gadget/legacy/inode.c +3 -1

@@ -1182,8 +1182,10 @@ dev_release (struct inode *inode, struct
 
 	/* closing ep0 === shutdown all */
 
-	if (dev->gadget_registered)
+	if (dev->gadget_registered) {
 		usb_gadget_unregister_driver (&gadgetfs_driver);
+		dev->gadget_registered = false;
+	}
 
 	/* at this point "good" hardware has disconnected the
 	 * device from USB; the host won't see it any more.

Greg Kroah-Hartman

author maintainer

2017-06-19 15:21 UTC #57 lore raw

PATCH 60/78 USB: gadgetfs, dummy-hcd, net2280: fix locking for callbacks

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Alan Stern <[email protected]>

commit f16443a034c7aa359ddf6f0f9bc40d01ca31faea upstream.

Using the syzkaller kernel fuzzer, Andrey Konovalov generated the following error in gadgetfs:

Quoted 101 lines

BUG: KASAN: use-after-free in __lock_acquire+0x3069/0x3690
kernel/locking/lockdep.c:3246
Read of size 8 at addr ffff88003a2bdaf8 by task kworker/3:1/903

CPU: 3 PID: 903 Comm: kworker/3:1 Not tainted 4.12.0-rc4+ #35
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
Workqueue: usb_hub_wq hub_event
Call Trace:
 __dump_stack lib/dump_stack.c:16 [inline]
 dump_stack+0x292/0x395 lib/dump_stack.c:52
 print_address_description+0x78/0x280 mm/kasan/report.c:252
 kasan_report_error mm/kasan/report.c:351 [inline]
 kasan_report+0x230/0x340 mm/kasan/report.c:408
 __asan_report_load8_noabort+0x19/0x20 mm/kasan/report.c:429
 __lock_acquire+0x3069/0x3690 kernel/locking/lockdep.c:3246
 lock_acquire+0x22d/0x560 kernel/locking/lockdep.c:3855
 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
 _raw_spin_lock+0x2f/0x40 kernel/locking/spinlock.c:151
 spin_lock include/linux/spinlock.h:299 [inline]
 gadgetfs_suspend+0x89/0x130 drivers/usb/gadget/legacy/inode.c:1682
 set_link_state+0x88e/0xae0 drivers/usb/gadget/udc/dummy_hcd.c:455
 dummy_hub_control+0xd7e/0x1fb0 drivers/usb/gadget/udc/dummy_hcd.c:2074
 rh_call_control drivers/usb/core/hcd.c:689 [inline]
 rh_urb_enqueue drivers/usb/core/hcd.c:846 [inline]
 usb_hcd_submit_urb+0x92f/0x20b0 drivers/usb/core/hcd.c:1650
 usb_submit_urb+0x8b2/0x12c0 drivers/usb/core/urb.c:542
 usb_start_wait_urb+0x148/0x5b0 drivers/usb/core/message.c:56
 usb_internal_control_msg drivers/usb/core/message.c:100 [inline]
 usb_control_msg+0x341/0x4d0 drivers/usb/core/message.c:151
 usb_clear_port_feature+0x74/0xa0 drivers/usb/core/hub.c:412
 hub_port_disable+0x123/0x510 drivers/usb/core/hub.c:4177
 hub_port_init+0x1ed/0x2940 drivers/usb/core/hub.c:4648
 hub_port_connect drivers/usb/core/hub.c:4826 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:4999 [inline]
 port_event drivers/usb/core/hub.c:5105 [inline]
 hub_event+0x1ae1/0x3d40 drivers/usb/core/hub.c:5185
 process_one_work+0xc08/0x1bd0 kernel/workqueue.c:2097
 process_scheduled_works kernel/workqueue.c:2157 [inline]
 worker_thread+0xb2b/0x1860 kernel/workqueue.c:2233
 kthread+0x363/0x440 kernel/kthread.c:231
 ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:424

Allocated by task 9958:
 save_stack_trace+0x1b/0x20 arch/x86/kernel/stacktrace.c:59
 save_stack+0x43/0xd0 mm/kasan/kasan.c:513
 set_track mm/kasan/kasan.c:525 [inline]
 kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:617
 kmem_cache_alloc_trace+0x87/0x280 mm/slub.c:2745
 kmalloc include/linux/slab.h:492 [inline]
 kzalloc include/linux/slab.h:665 [inline]
 dev_new drivers/usb/gadget/legacy/inode.c:170 [inline]
 gadgetfs_fill_super+0x24f/0x540 drivers/usb/gadget/legacy/inode.c:1993
 mount_single+0xf6/0x160 fs/super.c:1192
 gadgetfs_mount+0x31/0x40 drivers/usb/gadget/legacy/inode.c:2019
 mount_fs+0x9c/0x2d0 fs/super.c:1223
 vfs_kern_mount.part.25+0xcb/0x490 fs/namespace.c:976
 vfs_kern_mount fs/namespace.c:2509 [inline]
 do_new_mount fs/namespace.c:2512 [inline]
 do_mount+0x41b/0x2d90 fs/namespace.c:2834
 SYSC_mount fs/namespace.c:3050 [inline]
 SyS_mount+0xb0/0x120 fs/namespace.c:3027
 entry_SYSCALL_64_fastpath+0x1f/0xbe

Freed by task 9960:
 save_stack_trace+0x1b/0x20 arch/x86/kernel/stacktrace.c:59
 save_stack+0x43/0xd0 mm/kasan/kasan.c:513
 set_track mm/kasan/kasan.c:525 [inline]
 kasan_slab_free+0x72/0xc0 mm/kasan/kasan.c:590
 slab_free_hook mm/slub.c:1357 [inline]
 slab_free_freelist_hook mm/slub.c:1379 [inline]
 slab_free mm/slub.c:2961 [inline]
 kfree+0xed/0x2b0 mm/slub.c:3882
 put_dev+0x124/0x160 drivers/usb/gadget/legacy/inode.c:163
 gadgetfs_kill_sb+0x33/0x60 drivers/usb/gadget/legacy/inode.c:2027
 deactivate_locked_super+0x8d/0xd0 fs/super.c:309
 deactivate_super+0x21e/0x310 fs/super.c:340
 cleanup_mnt+0xb7/0x150 fs/namespace.c:1112
 __cleanup_mnt+0x1b/0x20 fs/namespace.c:1119
 task_work_run+0x1a0/0x280 kernel/task_work.c:116
 exit_task_work include/linux/task_work.h:21 [inline]
 do_exit+0x18a8/0x2820 kernel/exit.c:878
 do_group_exit+0x14e/0x420 kernel/exit.c:982
 get_signal+0x784/0x1780 kernel/signal.c:2318
 do_signal+0xd7/0x2130 arch/x86/kernel/signal.c:808
 exit_to_usermode_loop+0x1ac/0x240 arch/x86/entry/common.c:157
 prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline]
 syscall_return_slowpath+0x3ba/0x410 arch/x86/entry/common.c:263
 entry_SYSCALL_64_fastpath+0xbc/0xbe

The buggy address belongs to the object at ffff88003a2bdae0
 which belongs to the cache kmalloc-1024 of size 1024
The buggy address is located 24 bytes inside of
 1024-byte region [ffff88003a2bdae0, ffff88003a2bdee0)
The buggy address belongs to the page:
page:ffffea0000e8ae00 count:1 mapcount:0 mapping:          (null)
index:0x0 compound_mapcount: 0
flags: 0x100000000008100(slab|head)
raw: 0100000000008100 0000000000000000 0000000000000000 0000000100170017
raw: ffffea0000ed3020 ffffea0000f5f820 ffff88003e80efc0 0000000000000000
page dumped because: kasan: bad access detected

Quoted 8 lines

Memory state around the buggy address:
 ffff88003a2bd980: fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff88003a2bda00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88003a2bda80: fc fc fc fc fc fc fc fc fc fc fc fc fb fb fb fb
                                                                ^
 ffff88003a2bdb00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88003a2bdb80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

What this means is that the gadgetfs_suspend() routine was trying to access dev->lock after it had been deallocated. The root cause is a race in the dummy_hcd driver; the dummy_udc_stop() routine can race with the rest of the driver because it contains no locking. And even when proper locking is added, it can still race with the set_link_state() function because that function incorrectly drops the private spinlock before invoking any gadget driver callbacks.

The result of this race, as seen above, is that set_link_state() can invoke a callback in gadgetfs even after gadgetfs has been unbound from dummy_hcd's UDC and its private data structures have been deallocated.

include/linux/usb/gadget.h documents that the ->reset, ->disconnect, ->suspend, and ->resume callbacks may be invoked in interrupt context. In general this is necessary, to prevent races with gadget driver removal. This patch fixes dummy_hcd to retain the spinlock across these calls, and it adds a spinlock acquisition to dummy_udc_stop() to prevent the race.

The net2280 driver makes the same mistake of dropping the private spinlock for its ->disconnect and ->reset callback invocations. The patch fixes it too.

Lastly, since gadgetfs_suspend() may be invoked in interrupt context, it cannot assume that interrupts are enabled when it runs. It must use spin_lock_irqsave() instead of spin_lock_irq(). The patch fixes that bug as well.

Signed-off-by Alan Stern <[email protected]>

Reported-and-tested-by Andrey Konovalov <[email protected]>

Acked-by Felipe Balbi <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/usb/gadget/legacy/inode.c  |    5 +++--
 drivers/usb/gadget/udc/dummy_hcd.c |   13 ++++---------
 drivers/usb/gadget/udc/net2280.c   |    9 +--------
 3 files changed, 8 insertions(+), 19 deletions(-)

drivers/usb/gadget/legacy/inode.c +3 -2

@@ -1678,9 +1678,10 @@ static void
 gadgetfs_suspend (struct usb_gadget *gadget)
 {
 	struct dev_data		*dev = get_gadget_data (gadget);
+	unsigned long		flags;
 
 	INFO (dev, "suspended from state %d\n", dev->state);
-	spin_lock (&dev->lock);
+	spin_lock_irqsave(&dev->lock, flags);
 	switch (dev->state) {
 	case STATE_DEV_SETUP:		// VERY odd... host died??
 	case STATE_DEV_CONNECTED:

@@ -1691,7 +1692,7 @@ gadgetfs_suspend (struct usb_gadget *gad
 	default:
 		break;
 	}
-	spin_unlock (&dev->lock);
+	spin_unlock_irqrestore(&dev->lock, flags);
 }
 
 static struct usb_gadget_driver gadgetfs_driver = {

drivers/usb/gadget/udc/dummy_hcd.c +4 -9

@@ -442,23 +442,16 @@ static void set_link_state(struct dummy_
 		/* Report reset and disconnect events to the driver */
 		if (dum->driver && (disconnect || reset)) {
 			stop_activity(dum);
-			spin_unlock(&dum->lock);
 			if (reset)
 				usb_gadget_udc_reset(&dum->gadget, dum->driver);
 			else
 				dum->driver->disconnect(&dum->gadget);
-			spin_lock(&dum->lock);
 		}
 	} else if (dum_hcd->active != dum_hcd->old_active) {
-		if (dum_hcd->old_active && dum->driver->suspend) {
-			spin_unlock(&dum->lock);
+		if (dum_hcd->old_active && dum->driver->suspend)
 			dum->driver->suspend(&dum->gadget);
-			spin_lock(&dum->lock);
-		} else if (!dum_hcd->old_active &&  dum->driver->resume) {
-			spin_unlock(&dum->lock);
+		else if (!dum_hcd->old_active &&  dum->driver->resume)
 			dum->driver->resume(&dum->gadget);
-			spin_lock(&dum->lock);
-		}
 	}
 
 	dum_hcd->old_status = dum_hcd->port_status;

@@ -983,7 +976,9 @@ static int dummy_udc_stop(struct usb_gad
 	struct dummy_hcd	*dum_hcd = gadget_to_dummy_hcd(g);
 	struct dummy		*dum = dum_hcd->dum;
 
+	spin_lock_irq(&dum->lock);
 	dum->driver = NULL;
+	spin_unlock_irq(&dum->lock);
 
 	return 0;
 }

drivers/usb/gadget/udc/net2280.c +1 -8

@@ -2470,11 +2470,8 @@ static void stop_activity(struct net2280
 		nuke(&dev->ep[i]);
 
 	/* report disconnect; the driver is already quiesced */
-	if (driver) {
-		spin_unlock(&dev->lock);
+	if (driver)
 		driver->disconnect(&dev->gadget);
-		spin_lock(&dev->lock);
-	}
 
 	usb_reinit(dev);
 }

@@ -3348,8 +3345,6 @@ next_endpoints:
 		BIT(PCI_RETRY_ABORT_INTERRUPT))
 
 static void handle_stat1_irqs(struct net2280 *dev, u32 stat)
-__releases(dev->lock)
-__acquires(dev->lock)
 {
 	struct net2280_ep	*ep;
 	u32			tmp, num, mask, scratch;

@@ -3390,14 +3385,12 @@ __acquires(dev->lock)
 			if (disconnect || reset) {
 				stop_activity(dev, dev->driver);
 				ep0_start(dev);
-				spin_unlock(&dev->lock);
 				if (reset)
 					usb_gadget_udc_reset
 						(&dev->gadget, dev->driver);
 				else
 					(dev->driver->disconnect)
 						(&dev->gadget);
-				spin_lock(&dev->lock);
 				return;
 			}
 		}

Greg Kroah-Hartman

author maintainer

2017-06-19 15:21 UTC #58 lore raw

PATCH 61/78 mm/memory-failure.c: use compound_head() flags for huge pages

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: James Morse <[email protected]>

commit 7258ae5c5a2ce2f5969e8b18b881be40ab55433d upstream.

memory_failure() chooses a recovery action function based on the page flags. For huge pages it uses the tail page flags which don't have anything interesting set, resulting in:

Quoted 2 lines

Memory failure: 0x9be3b4: Unknown page state
Memory failure: 0x9be3b4: recovery action for unknown page: Failed

Instead, save a copy of the head page's flags if this is a huge page, this means if there are no relevant flags for this tail page, we use the head pages flags instead. This results in the me_huge_page() recovery action being called:

Quoted 1 line

Memory failure: 0x9b7969: recovery action for huge page: Delayed

For hugepages that have not yet been allocated, this allows the hugepage to be dequeued.

Fixes 524fca1e7356 ("HWPOISON: fix misjudgement of page_action() for errors on mlocked pages")

Link http://lkml.kernel.org/r/[email protected] open here

Signed-off-by James Morse <[email protected]>

Tested-by Punit Agrawal <[email protected]>

Acked-by Punit Agrawal <[email protected]>

Acked-by Naoya Horiguchi <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 mm/memory-failure.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

mm/memory-failure.c +4 -1

@@ -1175,7 +1175,10 @@ int memory_failure(unsigned long pfn, in
 	 * page_remove_rmap() in try_to_unmap_one(). So to determine page status
 	 * correctly, we save a copy of the page flags at this time.
 	 */
-	page_flags = p->flags;
+	if (PageHuge(p))
+		page_flags = hpage->flags;
+	else
+		page_flags = p->flags;
 
 	/*
 	 * unpoison always clear PG_hwpoison inside page lock

Greg Kroah-Hartman

author maintainer

2017-06-19 15:16 UTC #59 lore raw

PATCH 62/78 swap: cond_resched in swap_cgroup_prepare()

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Yu Zhao <[email protected]>

commit ef70762948dde012146926720b70e79736336764 upstream.

I saw need_resched() warnings when swapping on large swapfile (TBs) because continuously allocating many pages in swap_cgroup_prepare() took too long.

We already cond_resched when freeing page in swap_cgroup_swapoff(). Do the same for the page allocation.

Link http://lkml.kernel.org/r/[email protected] open here

Signed-off-by Yu Zhao <[email protected]>

Acked-by Michal Hocko <[email protected]>

Acked-by Vladimir Davydov <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 mm/swap_cgroup.c |    3 +++
 1 file changed, 3 insertions(+)

mm/swap_cgroup.c +3 -0

@@ -48,6 +48,9 @@ static int swap_cgroup_prepare(int type)
 		if (!page)
 			goto not_enough_page;
 		ctrl->map[idx] = page;
+
+		if (!(idx % SWAP_CLUSTER_MAX))
+			cond_resched();
 	}
 	return 0;
 not_enough_page:

Greg Kroah-Hartman

author maintainer

2017-06-19 15:21 UTC #60 lore raw

PATCH 63/78 mm: numa: avoid waiting on freed migrated pages

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Mark Rutland <[email protected]>

commit 3c226c637b69104f6b9f1c6ec5b08d7b741b3229 upstream.

In do_huge_pmd_numa_page(), we attempt to handle a migrating thp pmd by waiting until the pmd is unlocked before we return and retry. However, we can race with migrate_misplaced_transhuge_page():

    // do_huge_pmd_numa_page                // migrate_misplaced_transhuge_page()
    // Holds 0 refs on page                 // Holds 2 refs on page

    vmf->ptl = pmd_lock(vma->vm_mm, vmf->pmd);
    /* ... */
    if (pmd_trans_migrating(*vmf->pmd)) {
            page = pmd_page(*vmf->pmd);
            spin_unlock(vmf->ptl);
                                            ptl = pmd_lock(mm, pmd);
                                            if (page_count(page) != 2)) {
                                                    /* roll back */
                                            }
                                            /* ... */
                                            mlock_migrate_page(new_page, page);
                                            /* ... */
                                            spin_unlock(ptl);
                                            put_page(page);
                                            put_page(page); // page freed here
            wait_on_page_locked(page);
            goto out;
    }

This can result in the freed page having its waiters flag set unexpectedly, which trips the PAGE_FLAGS_CHECK_AT_PREP checks in the page alloc/free functions. This has been observed on arm64 KVM guests.

We can avoid this by having do_huge_pmd_numa_page() take a reference on the page before dropping the pmd lock, mirroring what we do in __migration_entry_wait().

When we hit the race, migrate_misplaced_transhuge_page() will see the reference and abort the migration, as it may do today in other cases.

Fixes b8916634b77bffb2 ("mm: Prevent parallel splits during THP migration")

Link http://lkml.kernel.org/r/[email protected] open here

Signed-off-by Mark Rutland <[email protected]>

Signed-off-by Will Deacon <[email protected]>

Acked-by Steve Capper <[email protected]>

Acked-by Kirill A. Shutemov <[email protected]>

Acked-by Vlastimil Babka <[email protected]>

Cc Mel Gorman <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 mm/huge_memory.c |    8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

mm/huge_memory.c +7 -1

@@ -1412,8 +1412,11 @@ int do_huge_pmd_numa_page(struct vm_faul
 	 */
 	if (unlikely(pmd_trans_migrating(*vmf->pmd))) {
 		page = pmd_page(*vmf->pmd);
+		if (!get_page_unless_zero(page))
+			goto out_unlock;
 		spin_unlock(vmf->ptl);
 		wait_on_page_locked(page);
+		put_page(page);
 		goto out;
 	}

@@ -1445,9 +1448,12 @@ int do_huge_pmd_numa_page(struct vm_faul
 
 	/* Migration could have started since the pmd_trans_migrating check */
 	if (!page_locked) {
+		page_nid = -1;
+		if (!get_page_unless_zero(page))
+			goto out_unlock;
 		spin_unlock(vmf->ptl);
 		wait_on_page_locked(page);
-		page_nid = -1;
+		put_page(page);
 		goto out;
 	}

Greg Kroah-Hartman

author maintainer

2017-06-19 15:16 UTC #61 lore raw

PATCH 64/78 userfaultfd: shmem: handle coredumping in handle_userfault()

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Andrea Arcangeli <[email protected]>

commit 64c2b20301f62c697352c8028c569b1b2bdd8e82 upstream.

Anon and hugetlbfs handle FOLL_DUMP set by get_dump_page() internally to __get_user_pages().

shmem as opposed has no special FOLL_DUMP handling there so handle_mm_fault() is invoked without mmap_sem and ends up calling handle_userfault() that isn't expecting to be invoked without mmap_sem held.

This makes handle_userfault() fail immediately if invoked through shmem_vm_ops->fault during coredumping and solves the problem.

The side effect is a BUG_ON with no lock held triggered by the coredumping process which exits. Only 4.11 is affected, pre-4.11 anon memory holes are skipped in __get_user_pages by checking FOLL_DUMP explicitly against empty pagetables (mm/gup.c:no_page_table()).

It's zero cost as we already had a check for current->flags to prevent futex to trigger userfaults during exit (PF_EXITING).

Link http://lkml.kernel.org/r/[email protected] open here

Signed-off-by Andrea Arcangeli <[email protected]>

Reported-by "Dr. David Alan Gilbert" <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 fs/userfaultfd.c |   29 +++++++++++++++++++++--------
 1 file changed, 21 insertions(+), 8 deletions(-)

fs/userfaultfd.c +21 -8

@@ -340,9 +340,28 @@ int handle_userfault(struct vm_fault *vm
 	bool must_wait, return_to_userland;
 	long blocking_state;
 
-	BUG_ON(!rwsem_is_locked(&mm->mmap_sem));
-
 	ret = VM_FAULT_SIGBUS;
+
+	/*
+	 * We don't do userfault handling for the final child pid update.
+	 *
+	 * We also don't do userfault handling during
+	 * coredumping. hugetlbfs has the special
+	 * follow_hugetlb_page() to skip missing pages in the
+	 * FOLL_DUMP case, anon memory also checks for FOLL_DUMP with
+	 * the no_page_table() helper in follow_page_mask(), but the
+	 * shmem_vm_ops->fault method is invoked even during
+	 * coredumping without mmap_sem and it ends up here.
+	 */
+	if (current->flags & (PF_EXITING|PF_DUMPCORE))
+		goto out;
+
+	/*
+	 * Coredumping runs without mmap_sem so we can only check that
+	 * the mmap_sem is held, if PF_DUMPCORE was not set.
+	 */
+	WARN_ON_ONCE(!rwsem_is_locked(&mm->mmap_sem));
+
 	ctx = vmf->vma->vm_userfaultfd_ctx.ctx;
 	if (!ctx)
 		goto out;

@@ -361,12 +380,6 @@ int handle_userfault(struct vm_fault *vm
 		goto out;
 
 	/*
-	 * We don't do userfault handling for the final child pid update.
-	 */
-	if (current->flags & PF_EXITING)
-		goto out;
-
-	/*
 	 * Check that we can return VM_FAULT_RETRY.
 	 *
 	 * NOTE: it should become possible to return VM_FAULT_RETRY

Greg Kroah-Hartman

author maintainer

2017-06-19 15:16 UTC #62 lore raw

PATCH 65/78 iio: imu: inv_mpu6050: add accel lpf setting for chip >= MPU6500

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jean-Baptiste Maneyrol <[email protected]>

commit 948588e25b8af5e66962ed3f53e1cae1656fa5af upstream.

Starting from MPU6500, accelerometer dlpf is set in a separate register named ACCEL_CONFIG_2.
Add this new register in the map and set it for the corresponding chips.

Signed-off-by Jean-Baptiste Maneyrol <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/iio/imu/inv_mpu6050/inv_mpu_core.c |   39 ++++++++++++++++++++++++++---
 drivers/iio/imu/inv_mpu6050/inv_mpu_iio.h  |    3 ++
 2 files changed, 39 insertions(+), 3 deletions(-)

drivers/iio/imu/inv_mpu6050/inv_mpu_core.c +36 -3

@@ -41,6 +41,7 @@ static const int accel_scale[] = {598, 1
 static const struct inv_mpu6050_reg_map reg_set_6500 = {
 	.sample_rate_div	= INV_MPU6050_REG_SAMPLE_RATE_DIV,
 	.lpf                    = INV_MPU6050_REG_CONFIG,
+	.accel_lpf              = INV_MPU6500_REG_ACCEL_CONFIG_2,
 	.user_ctrl              = INV_MPU6050_REG_USER_CTRL,
 	.fifo_en                = INV_MPU6050_REG_FIFO_EN,
 	.gyro_config            = INV_MPU6050_REG_GYRO_CONFIG,

@@ -205,6 +206,37 @@ int inv_mpu6050_set_power_itg(struct inv
 EXPORT_SYMBOL_GPL(inv_mpu6050_set_power_itg);
 
 /**
+ *  inv_mpu6050_set_lpf_regs() - set low pass filter registers, chip dependent
+ *
+ *  MPU60xx/MPU9150 use only 1 register for accelerometer + gyroscope
+ *  MPU6500 and above have a dedicated register for accelerometer
+ */
+static int inv_mpu6050_set_lpf_regs(struct inv_mpu6050_state *st,
+				    enum inv_mpu6050_filter_e val)
+{
+	int result;
+
+	result = regmap_write(st->map, st->reg->lpf, val);
+	if (result)
+		return result;
+
+	switch (st->chip_type) {
+	case INV_MPU6050:
+	case INV_MPU6000:
+	case INV_MPU9150:
+		/* old chips, nothing to do */
+		result = 0;
+		break;
+	default:
+		/* set accel lpf */
+		result = regmap_write(st->map, st->reg->accel_lpf, val);
+		break;
+	}
+
+	return result;
+}
+
+/**
  *  inv_mpu6050_init_config() - Initialize hardware, disable FIFO.
  *
  *  Initial configuration:

@@ -227,8 +259,7 @@ static int inv_mpu6050_init_config(struc
 	if (result)
 		return result;
 
-	d = INV_MPU6050_FILTER_20HZ;
-	result = regmap_write(st->map, st->reg->lpf, d);
+	result = inv_mpu6050_set_lpf_regs(st, INV_MPU6050_FILTER_20HZ);
 	if (result)
 		return result;

@@ -531,6 +562,8 @@ error_write_raw:
  *                  would be alising. This function basically search for the
  *                  correct low pass parameters based on the fifo rate, e.g,
  *                  sampling frequency.
+ *
+ *  lpf is set automatically when setting sampling rate to avoid any aliases.
  */
 static int inv_mpu6050_set_lpf(struct inv_mpu6050_state *st, int rate)
 {

@@ -546,7 +579,7 @@ static int inv_mpu6050_set_lpf(struct in
 	while ((h < hz[i]) && (i < ARRAY_SIZE(d) - 1))
 		i++;
 	data = d[i];
-	result = regmap_write(st->map, st->reg->lpf, data);
+	result = inv_mpu6050_set_lpf_regs(st, data);
 	if (result)
 		return result;
 	st->chip_config.lpf = data;

drivers/iio/imu/inv_mpu6050/inv_mpu_iio.h +3 -0

@@ -28,6 +28,7 @@
  *  struct inv_mpu6050_reg_map - Notable registers.
  *  @sample_rate_div:	Divider applied to gyro output rate.
  *  @lpf:		Configures internal low pass filter.
+ *  @accel_lpf:		Configures accelerometer low pass filter.
  *  @user_ctrl:		Enables/resets the FIFO.
  *  @fifo_en:		Determines which data will appear in FIFO.
  *  @gyro_config:	gyro config register.

@@ -47,6 +48,7 @@
 struct inv_mpu6050_reg_map {
 	u8 sample_rate_div;
 	u8 lpf;
+	u8 accel_lpf;
 	u8 user_ctrl;
 	u8 fifo_en;
 	u8 gyro_config;

@@ -187,6 +189,7 @@ struct inv_mpu6050_state {
 #define INV_MPU6050_FIFO_THRESHOLD           500
 
 /* mpu6500 registers */
+#define INV_MPU6500_REG_ACCEL_CONFIG_2      0x1D
 #define INV_MPU6500_REG_ACCEL_OFFSET        0x77
 
 /* delay time in milliseconds */

Greg Kroah-Hartman

author maintainer

2017-06-19 15:21 UTC #63 lore raw

PATCH 66/78 staging: iio: ad7152: Fix deadlock in ad7152_write_raw_samp_freq()

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Alexey Khoroshilov <[email protected]>

commit 95264c8c6a9040e84edda883dbbe9d193c41f46c upstream.

ad7152_write_raw_samp_freq() is called by ad7152_write_raw() with chip->state_lock held. So, there is unavoidable deadlock when ad7152_write_raw_samp_freq() locks the mutex itself.

The patch removes unneeded locking.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by Alexey Khoroshilov <[email protected]>

Fixes 6572389bcc11 ("staging: iio: cdc: ad7152: Implement IIO_CHAN_INFO_SAMP_FREQ attribute")

Acked-by Lars-Peter Clausen <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/staging/iio/cdc/ad7152.c |    6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

drivers/staging/iio/cdc/ad7152.c +1 -5

@@ -231,16 +231,12 @@ static int ad7152_write_raw_samp_freq(st
 	if (i >= ARRAY_SIZE(ad7152_filter_rate_table))
 		i = ARRAY_SIZE(ad7152_filter_rate_table) - 1;
 
-	mutex_lock(&chip->state_lock);
 	ret = i2c_smbus_write_byte_data(chip->client,
 					AD7152_REG_CFG2, AD7152_CFG2_OSR(i));
-	if (ret < 0) {
-		mutex_unlock(&chip->state_lock);
+	if (ret < 0)
 		return ret;
-	}
 
 	chip->filter_rate_setup = i;
-	mutex_unlock(&chip->state_lock);
 
 	return ret;
 }

Greg Kroah-Hartman

author maintainer

2017-06-19 15:21 UTC #64 lore raw

PATCH 67/78 iio: adc: meson-saradc: fix potential crash in meson_sar_adc_clear_fifo

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Martin Blumenstingl <[email protected]>

commit 103a07d4278203d6299798cd74cdc4d209801cac upstream.

meson_sar_adc_clear_fifo passes a 0 as value-pointer to regmap_read(). In case of the meson-saradc driver this ends up in regmap_mmio_read(), where the value-pointer is de-referenced unconditionally to assign the value which was read.
Fix this by passing an actual pointer, even though all we want to do is to discard the value.

As a side-effect this fixes a sparse warning ("Using plain integer as NULL pointer") as reported by Paolo Cretaro.

Fixes 3adbf3427330 ("iio: adc: add a driver for the SAR ADC found in Amlogic Meson SoCs")

Reported-by Paolo Cretaro <[email protected]>

Signed-off-by Martin Blumenstingl <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/iio/adc/meson_saradc.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

drivers/iio/adc/meson_saradc.c +2 -2

@@ -440,13 +440,13 @@ static void meson_sar_adc_unlock(struct
 static void meson_sar_adc_clear_fifo(struct iio_dev *indio_dev)
 {
 	struct meson_sar_adc_priv *priv = iio_priv(indio_dev);
-	int count;
+	unsigned int count, tmp;
 
 	for (count = 0; count < MESON_SAR_ADC_MAX_FIFO_SIZE; count++) {
 		if (!meson_sar_adc_get_fifo_count(indio_dev))
 			break;
 
-		regmap_read(priv->regmap, MESON_SAR_ADC_FIFO_RD, 0);
+		regmap_read(priv->regmap, MESON_SAR_ADC_FIFO_RD, &tmp);
 	}
 }

Greg Kroah-Hartman

author maintainer

2017-06-19 15:16 UTC #65 lore raw

PATCH 68/78 sched/core: Idle_task_exit() shouldnt use switch_mm_irqs_off()

Link http://lkml.kernel.org/r/ca3d1a9fa93a0b49f5a8ff729eda3640fb6abdf9.1497034141.git.luto@kernel.org open here

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Andy Lutomirski <[email protected]>

commit 252d2a4117bc181b287eeddf848863788da733ae upstream.

idle_task_exit() can be called with IRQs on x86 on and therefore should use switch_mm(), not switch_mm_irqs_off().

This doesn't seem to cause any problems right now, but it will confuse my upcoming TLB flush changes. Nonetheless, I think it should be backported because it's trivial. There won't be any meaningful performance impact because idle_task_exit() is only used when offlining a CPU.

Signed-off-by Andy Lutomirski <[email protected]>

Cc Borislav Petkov <[email protected]>

Cc Linus Torvalds <[email protected]>

Cc Peter Zijlstra <[email protected]>

Cc Thomas Gleixner <[email protected]>

Fixes f98db6013c55 ("sched/core: Add switch_mm_irqs_off() and use it in the scheduler")

Signed-off-by Ingo Molnar <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 kernel/sched/core.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

kernel/sched/core.c +1 -1

@@ -5533,7 +5533,7 @@ void idle_task_exit(void)
 	BUG_ON(cpu_online(smp_processor_id()));
 
 	if (mm != &init_mm) {
-		switch_mm_irqs_off(mm, &init_mm, current);
+		switch_mm(mm, &init_mm, current);
 		finish_arch_post_lock_switch();
 	}
 	mmdrop(mm);

Greg Kroah-Hartman

author maintainer

2017-06-19 15:16 UTC #66 lore raw

PATCH 69/78 genirq: Release resources in __setup_irq() error path

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Heiner Kallweit <[email protected]>

commit fa07ab72cbb0d843429e61bf179308aed6cbe0dd upstream.

In case __irq_set_trigger() fails the resources requested via irq_request_resources() are not released.

Add the missing release call into the error handling path.

Fixes c1bacbae8192 ("genirq: Provide irq_request/release_resources chip callbacks")

Signed-off-by Heiner Kallweit <[email protected]>

Signed-off-by Thomas Gleixner <[email protected]>

Link http://lkml.kernel.org/r/[email protected] open here

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 kernel/irq/manage.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

kernel/irq/manage.c +3 -1

@@ -1310,8 +1310,10 @@ __setup_irq(unsigned int irq, struct irq
 			ret = __irq_set_trigger(desc,
 						new->flags & IRQF_TRIGGER_MASK);
 
-			if (ret)
+			if (ret) {
+				irq_release_resources(desc);
 				goto out_mask;
+			}
 		}
 
 		desc->istate &= ~(IRQS_AUTODETECT | IRQS_SPURIOUS_DISABLED | \

Greg Kroah-Hartman

author maintainer

2017-06-19 15:21 UTC #67 lore raw

PATCH 70/78 alarmtimer: Prevent overflow of relative timers

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Thomas Gleixner <[email protected]>

commit f4781e76f90df7aec400635d73ea4c35ee1d4765 upstream.

Andrey reported a alartimer related RCU stall while fuzzing the kernel with syzkaller.

The reason for this is an overflow in ktime_add() which brings the resulting time into negative space and causes immediate expiry of the timer. The following rearm with a small interval does not bring the timer back into positive space due to the same issue.

This results in a permanent firing alarmtimer which hogs the CPU.

Use ktime_add_safe() instead which detects the overflow and clamps the result to KTIME_SEC_MAX.

Reported-by Andrey Konovalov <[email protected]>

Signed-off-by Thomas Gleixner <[email protected]>

Cc Peter Zijlstra <[email protected]>

Cc Kostya Serebryany <[email protected]>

Cc syzkaller <[email protected]>

Cc John Stultz <[email protected]>

Cc Dmitry Vyukov <[email protected]>

Link http://lkml.kernel.org/r/[email protected] open here

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 kernel/time/alarmtimer.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

kernel/time/alarmtimer.c +3 -3

@@ -387,7 +387,7 @@ void alarm_start_relative(struct alarm *
 {
 	struct alarm_base *base = &alarm_bases[alarm->type];
 
-	start = ktime_add(start, base->gettime());
+	start = ktime_add_safe(start, base->gettime());
 	alarm_start(alarm, start);
 }
 EXPORT_SYMBOL_GPL(alarm_start_relative);

@@ -475,7 +475,7 @@ u64 alarm_forward(struct alarm *alarm, k
 		overrun++;
 	}
 
-	alarm->node.expires = ktime_add(alarm->node.expires, interval);
+	alarm->node.expires = ktime_add_safe(alarm->node.expires, interval);
 	return overrun;
 }
 EXPORT_SYMBOL_GPL(alarm_forward);

@@ -666,7 +666,7 @@ static int alarm_timer_set(struct k_itim
 		ktime_t now;
 
 		now = alarm_bases[timr->it.alarm.alarmtimer.type].gettime();
-		exp = ktime_add(now, exp);
+		exp = ktime_add_safe(now, exp);
 	}
 
 	alarm_start(&timr->it.alarm.alarmtimer, exp);

Greg Kroah-Hartman

author maintainer

2017-06-19 15:16 UTC #68 lore raw

PATCH 71/78 alarmtimer: Rate limit periodic intervals

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Thomas Gleixner <[email protected]>

commit ff86bf0c65f14346bf2440534f9ba5ac232c39a0 upstream.

The alarmtimer code has another source of potentially rearming itself too fast. Interval timers with a very samll interval have a similar CPU hog effect as the previously fixed overflow issue.

The reason is that alarmtimers do not implement the normal protection against this kind of problem which the other posix timer use:

timer expires -> queue signal -> deliver signal -> rearm timer

This scheme brings the rearming under scheduler control and prevents permanently firing timers which hog the CPU.

Bringing this scheme to the alarm timer code is a major overhaul because it lacks all the necessary mechanisms completely.

So for a quick fix limit the interval to one jiffie. This is not problematic in practice as alarmtimers are usually backed by an RTC for suspend which have 1 second resolution. It could be therefor argued that the resolution of this clock should be set to 1 second in general, but that's outside the scope of this fix.

Signed-off-by Thomas Gleixner <[email protected]>

Cc Peter Zijlstra <[email protected]>

Cc Kostya Serebryany <[email protected]>

Cc syzkaller <[email protected]>

Cc John Stultz <[email protected]>

Cc Dmitry Vyukov <[email protected]>

Link http://lkml.kernel.org/r/[email protected] open here

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 kernel/time/alarmtimer.c |    8 ++++++++
 1 file changed, 8 insertions(+)

kernel/time/alarmtimer.c +8 -0

@@ -660,6 +660,14 @@ static int alarm_timer_set(struct k_itim
 
 	/* start the timer */
 	timr->it.alarm.interval = timespec_to_ktime(new_setting->it_interval);
+
+	/*
+	 * Rate limit to the tick as a hot fix to prevent DOS. Will be
+	 * mopped up later.
+	 */
+	if (timr->it.alarm.interval < TICK_NSEC)
+		timr->it.alarm.interval = TICK_NSEC;
+
 	exp = timespec_to_ktime(new_setting->it_value);
 	/* Convert (if necessary) to absolute time */
 	if (flags != TIMER_ABSTIME) {

Greg Kroah-Hartman

author maintainer

2017-06-19 15:21 UTC #69 lore raw

PATCH 72/78 virtio_balloon: disable VIOMMU support

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Michael S. Tsirkin <[email protected]>

commit e41b1355508debe45fda33ef8c03ff3ba5d206b9 upstream.

virtio balloon bypasses the DMA API entirely so does not support the VIOMMU right now. It's not clear we need that support, for now let's just make sure we don't pretend to support it.

Cc Wei Wang <[email protected]>

Fixes 1a937693993f ("virtio: new feature to detect IOMMU device quirk")

Signed-off-by Michael S. Tsirkin <[email protected]>

Acked-by Jason Wang <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/virtio/virtio_balloon.c |    7 +++++++
 1 file changed, 7 insertions(+)

drivers/virtio/virtio_balloon.c +7 -0

@@ -664,6 +664,12 @@ static int virtballoon_restore(struct vi
 }
 #endif
 
+static int virtballoon_validate(struct virtio_device *vdev)
+{
+	__virtio_clear_bit(vdev, VIRTIO_F_IOMMU_PLATFORM);
+	return 0;
+}
+
 static unsigned int features[] = {
 	VIRTIO_BALLOON_F_MUST_TELL_HOST,
 	VIRTIO_BALLOON_F_STATS_VQ,

@@ -676,6 +682,7 @@ static struct virtio_driver virtio_ballo
 	.driver.name =	KBUILD_MODNAME,
 	.driver.owner =	THIS_MODULE,
 	.id_table =	id_table,
+	.validate =	virtballoon_validate,
 	.probe =	virtballoon_probe,
 	.remove =	virtballoon_remove,
 	.config_changed = virtballoon_changed,

Greg Kroah-Hartman

author maintainer

2017-06-19 15:22 UTC #70 lore raw

PATCH 73/78 MIPS: Fix bnezc/jialc return address calculation

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Paul Burton <[email protected]>

commit 1a73d9310e093fc3adffba4d0a67b9fab2ee3f63 upstream.

The code handling the pop76 opcode (ie. bnezc & jialc instructions) in __compute_return_epc_for_insn() needs to set the value of $31 in the jialc case, which is encoded with rs = 0. However its check to differentiate bnezc (rs != 0) from jialc (rs = 0) was unfortunately backwards, meaning that if we emulate a bnezc instruction we clobber $31 & if we emulate a jialc instruction it actually behaves like a jic instruction.

Fix this by inverting the check of rs to match the way the instructions are actually encoded.

Signed-off-by Paul Burton <[email protected]>

Fixes 28d6f93d201d ("MIPS: Emulate the new MIPS R6 BNEZC and JIALC instructions")

Cc [email protected]

Patchwork: https://patchwork.linux-mips.org/patch/16178/

Signed-off-by Ralf Baechle <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 arch/mips/kernel/branch.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

arch/mips/kernel/branch.c +3 -1

@@ -804,8 +804,10 @@ int __compute_return_epc_for_insn(struct
 			break;
 		}
 		/* Compact branch: BNEZC || JIALC */
-		if (insn.i_format.rs)
+		if (!insn.i_format.rs) {
+			/* JIALC: set $31/ra */
 			regs->regs[31] = epc + 4;
+		}
 		regs->cp0_epc += 8;
 		break;
 #endif

Greg Kroah-Hartman

author maintainer

2017-06-19 15:22 UTC #71 lore raw

PATCH 74/78 MIPS: .its targets depend on vmlinux

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Paul Burton <[email protected]>

commit bcd7c45e0d5a82be9a64b90050f0e09d41a50758 upstream.

The .its targets require information about the kernel binary, such as its entry point, which is extracted from the vmlinux ELF. We therefore require that the ELF is built before the .its files are generated. Declare this requirement in the Makefile such that make will ensure this is always the case, otherwise in corner cases we can hit issues as the .its is generated with an incorrect (either invalid or stale) entry point.

Signed-off-by Paul Burton <[email protected]>

Fixes cf2a5e0bb4c6 ("MIPS: Support generating Flattened Image Trees (.itb)")

Cc [email protected]

Patchwork: https://patchwork.linux-mips.org/patch/16179/

Signed-off-by Ralf Baechle <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 arch/mips/boot/Makefile |   10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

arch/mips/boot/Makefile +5 -5

@@ -128,19 +128,19 @@ quiet_cmd_cpp_its_S = ITS     $@
 			-DADDR_BITS=$(ADDR_BITS) \
 			-DADDR_CELLS=$(itb_addr_cells)
 
-$(obj)/vmlinux.its: $(srctree)/arch/mips/$(PLATFORM)/vmlinux.its.S FORCE
+$(obj)/vmlinux.its: $(srctree)/arch/mips/$(PLATFORM)/vmlinux.its.S $(VMLINUX) FORCE
 	$(call if_changed_dep,cpp_its_S,none,vmlinux.bin)
 
-$(obj)/vmlinux.gz.its: $(srctree)/arch/mips/$(PLATFORM)/vmlinux.its.S FORCE
+$(obj)/vmlinux.gz.its: $(srctree)/arch/mips/$(PLATFORM)/vmlinux.its.S $(VMLINUX) FORCE
 	$(call if_changed_dep,cpp_its_S,gzip,vmlinux.bin.gz)
 
-$(obj)/vmlinux.bz2.its: $(srctree)/arch/mips/$(PLATFORM)/vmlinux.its.S FORCE
+$(obj)/vmlinux.bz2.its: $(srctree)/arch/mips/$(PLATFORM)/vmlinux.its.S $(VMLINUX)  FORCE
 	$(call if_changed_dep,cpp_its_S,bzip2,vmlinux.bin.bz2)
 
-$(obj)/vmlinux.lzma.its: $(srctree)/arch/mips/$(PLATFORM)/vmlinux.its.S FORCE
+$(obj)/vmlinux.lzma.its: $(srctree)/arch/mips/$(PLATFORM)/vmlinux.its.S $(VMLINUX) FORCE
 	$(call if_changed_dep,cpp_its_S,lzma,vmlinux.bin.lzma)
 
-$(obj)/vmlinux.lzo.its: $(srctree)/arch/mips/$(PLATFORM)/vmlinux.its.S FORCE
+$(obj)/vmlinux.lzo.its: $(srctree)/arch/mips/$(PLATFORM)/vmlinux.its.S $(VMLINUX) FORCE
 	$(call if_changed_dep,cpp_its_S,lzo,vmlinux.bin.lzo)
 
 quiet_cmd_itb-image = ITB     $@

Greg Kroah-Hartman

author maintainer

2017-06-19 15:16 UTC #72 lore raw

PATCH 75/78 crypto: Work around deallocated stack frame reference gcc bug on sparc.

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: David Miller <[email protected]>

commit d41519a69b35b10af7fda867fb9100df24fdf403 upstream.

On sparc, if we have an alloca() like situation, as is the case with SHASH_DESC_ON_STACK(), we can end up referencing deallocated stack memory. The result can be that the value is clobbered if a trap or interrupt arrives at just the right instruction.

It only occurs if the function ends returning a value from that alloca() area and that value can be placed into the return value register using a single instruction.

For example, in lib/libcrc32c.c:crc32c() we end up with a return sequence like:

        return  %i7+8
         lduw   [%o5+16], %o0   ! MEM[(u32 *)__shash_desc.1_10 + 16B],

%o5 holds the base of the on-stack area allocated for the shash descriptor. But the return released the stack frame and the register window.

So if an intererupt arrives between 'return' and 'lduw', then the value read at %o5+16 can be corrupted.

Add a data compiler barrier to work around this problem. This is exactly what the gcc fix will end up doing as well, and it absolutely should not change the code generated for other cpus (unless gcc on them has the same bug :-)

With crucial insight from Eric Sandeen.

Reported-by Anatoly Pugachev <[email protected]>

Signed-off-by David S. Miller <[email protected]>

Signed-off-by Herbert Xu <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 fs/btrfs/hash.c |    5 ++++-
 fs/f2fs/f2fs.h  |    5 ++++-
 lib/libcrc32c.c |    6 ++++--
 3 files changed, 12 insertions(+), 4 deletions(-)

fs/btrfs/hash.c +4 -1

@@ -38,6 +38,7 @@ u32 btrfs_crc32c(u32 crc, const void *ad
 {
 	SHASH_DESC_ON_STACK(shash, tfm);
 	u32 *ctx = (u32 *)shash_desc_ctx(shash);
+	u32 retval;
 	int err;
 
 	shash->tfm = tfm;

@@ -47,5 +48,7 @@ u32 btrfs_crc32c(u32 crc, const void *ad
 	err = crypto_shash_update(shash, address, length);
 	BUG_ON(err);
 
-	return *ctx;
+	retval = *ctx;
+	barrier_data(ctx);
+	return retval;
 }

fs/f2fs/f2fs.h +4 -1

@@ -1007,6 +1007,7 @@ static inline u32 f2fs_crc32(struct f2fs
 {
 	SHASH_DESC_ON_STACK(shash, sbi->s_chksum_driver);
 	u32 *ctx = (u32 *)shash_desc_ctx(shash);
+	u32 retval;
 	int err;
 
 	shash->tfm = sbi->s_chksum_driver;

@@ -1016,7 +1017,9 @@ static inline u32 f2fs_crc32(struct f2fs
 	err = crypto_shash_update(shash, address, length);
 	BUG_ON(err);
 
-	return *ctx;
+	retval = *ctx;
+	barrier_data(ctx);
+	return retval;
 }
 
 static inline bool f2fs_crc_valid(struct f2fs_sb_info *sbi, __u32 blk_crc,

lib/libcrc32c.c +4 -2

@@ -43,7 +43,7 @@ static struct crypto_shash *tfm;
 u32 crc32c(u32 crc, const void *address, unsigned int length)
 {
 	SHASH_DESC_ON_STACK(shash, tfm);
-	u32 *ctx = (u32 *)shash_desc_ctx(shash);
+	u32 ret, *ctx = (u32 *)shash_desc_ctx(shash);
 	int err;
 
 	shash->tfm = tfm;

@@ -53,7 +53,9 @@ u32 crc32c(u32 crc, const void *address,
 	err = crypto_shash_update(shash, address, length);
 	BUG_ON(err);
 
-	return *ctx;
+	ret = *ctx;
+	barrier_data(ctx);
+	return ret;
 }
 
 EXPORT_SYMBOL(crc32c);

Greg Kroah-Hartman

author maintainer

2017-06-19 15:22 UTC #73 lore raw

PATCH 76/78 ARM: dts: am335x-sl50: Fix card detect pin for mmc1

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Enric Balletbo i Serra <[email protected]>

commit 56b74ed9c1e8050408b9beeee25888a49a458997 upstream.

The second version of the hardware moved the card detect pin from gpio0_6 to gpio1_9, as we won't support the first hardware version fix the pinmux configuration of this pin.

Fixes 8584d4fc ("ARM: dts: am335x-sl50: Add Toby-Churchill SL50 board support.")

Signed-off-by Enric Balletbo i Serra <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 arch/arm/boot/dts/am335x-sl50.dts |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

arch/arm/boot/dts/am335x-sl50.dts +2 -2

@@ -220,7 +220,7 @@
 
 	mmc1_pins: pinmux_mmc1_pins {
 		pinctrl-single,pins = <
-			AM33XX_IOPAD(0x960, PIN_INPUT | MUX_MODE7)		/* spi0_cs1.gpio0_6 */
+			AM33XX_IOPAD(0x96c, PIN_INPUT | MUX_MODE7)		/* uart0_rtsn.gpio1_9 */
 		>;
 	};

@@ -384,7 +384,7 @@
 	pinctrl-names = "default";
 	pinctrl-0 = <&mmc1_pins>;
 	bus-width = <4>;
-	cd-gpios = <&gpio0 6 GPIO_ACTIVE_LOW>;
+	cd-gpios = <&gpio1 9 GPIO_ACTIVE_LOW>;
 	vmmc-supply = <&vmmcsd_fixed>;
 };

Greg Kroah-Hartman

author maintainer

2017-06-19 15:22 UTC #74 lore raw

PATCH 77/78 ARM: dts: am335x-sl50: Fix cannot claim requested pins for spi0

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Enric Balletbo i Serra <[email protected]>

commit db145db99f5bf30acc12d7450b9ad0707072a7be upstream.

We don't need to bitbang these pins anymore, instead we muxed these pins as SPI, after this change, done in commit 6c69f726, we introduced the following error:

pinctrl-single 44e10800.pinmux: pin PIN85 already requested \
by 44e10800.pinmux; cannot claim for 48030000.spi pinctrl-single 44e10800.pinmux: pin-85 (48030000.spi) status -22

Fixes 6c69f726 ("ARM: dts: am335x-sl50: Enable SPI0 interface and Flash Memory")

Signed-off-by Enric Balletbo i Serra <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 arch/arm/boot/dts/am335x-sl50.dts |    4 ----
 1 file changed, 4 deletions(-)

arch/arm/boot/dts/am335x-sl50.dts +0 -4

@@ -280,10 +280,6 @@
 			AM33XX_IOPAD(0x834, PIN_INPUT_PULLUP | MUX_MODE7)	/* nKbdReset - gpmc_ad13.gpio1_13 */
 			AM33XX_IOPAD(0x838, PIN_INPUT_PULLUP | MUX_MODE7)	/* nDispReset - gpmc_ad14.gpio1_14 */
 			AM33XX_IOPAD(0x844, PIN_INPUT_PULLUP | MUX_MODE7)	/* USB1_enPower - gpmc_a1.gpio1_17 */
-			/* AVR Programming - SPI Bus (bit bang) - Screen and Keyboard */
-			AM33XX_IOPAD(0x954, PIN_INPUT_PULLUP | MUX_MODE7)	/* Kbd/Disp/BattMOSI spi0_d0.gpio0_3 */
-			AM33XX_IOPAD(0x958, PIN_INPUT_PULLUP | MUX_MODE7)	/* Kbd/Disp/BattMISO spi0_d1.gpio0_4 */
-			AM33XX_IOPAD(0x950, PIN_INPUT_PULLUP | MUX_MODE7)	/* Kbd/Disp/BattSCLK spi0_clk.gpio0_2 */
 			/* PDI Bus - Battery system */
 			AM33XX_IOPAD(0x840, PIN_INPUT_PULLUP | MUX_MODE7)	/* nBattReset  gpmc_a0.gpio1_16 */
 			AM33XX_IOPAD(0x83c, PIN_INPUT_PULLUP | MUX_MODE7)	/* BattPDIData gpmc_ad15.gpio1_15 */

Greg Kroah-Hartman

author maintainer

2017-06-19 15:22 UTC #75 lore raw

PATCH 78/78 mm: larger stack guard gap, between vmas

4.11-stable review patch. If anyone has any objections, please let me know.

------------------

From: Hugh Dickins <[email protected]>

commit 1be7107fbe18eed3e319a6c3e83c78254b693acb upstream.

Stack guard page is a useful feature to reduce a risk of stack smashing into a different mapping. We have been using a single page gap which is sufficient to prevent having stack adjacent to a different mapping. But this seems to be insufficient in the light of the stack usage in userspace. E.g. glibc uses as large as 64kB alloca() in many commonly used functions. Others use constructs liks gid_t buffer[NGROUPS_MAX] which is 256kB or stack strings with MAX_ARG_STRLEN.

This will become especially dangerous for suid binaries and the default no limit for the stack size limit because those applications can be tricked to consume a large portion of the stack and a single glibc call could jump over the guard page. These attacks are not theoretical, unfortunatelly.

Make those attacks less probable by increasing the stack guard gap to 1MB (on systems with 4k pages; but make it depend on the page size because systems with larger base pages might cap stack allocations in the PAGE_SIZE units) which should cover larger alloca() and VLA stack allocations. It is obviously not a full fix because the problem is somehow inherent, but it should reduce attack space a lot.

One could argue that the gap size should be configurable from userspace, but that can be done later when somebody finds that the new 1MB is wrong for some special case applications. For now, add a kernel command line option (stack_guard_gap) to specify the stack gap size (in page units).

Implementation wise, first delete all the old code for stack guard page:
because although we could get away with accounting one extra page in a stack vma, accounting a larger gap can break userspace - case in point, a program run with "ulimit -S -v 20000" failed when the 1MB gap was counted for RLIMIT_AS; similar problems could come with RLIMIT_MLOCK and strict non-overcommit mode.

Instead of keeping gap inside the stack vma, maintain the stack guard gap as a gap between vmas: using vm_start_gap() in place of vm_start (or vm_end_gap() in place of vm_end if VM_GROWSUP) in just those few places which need to respect the gap - mainly arch_get_unmapped_area(), and and the vma tree's subtree_gap support for that.

Original-patch-by Oleg Nesterov <[email protected]>

Original-patch-by Michal Hocko <[email protected]>

Signed-off-by Hugh Dickins <[email protected]>

Acked-by Michal Hocko <[email protected]>

Tested-by Helge Deller <[email protected]> # parisc

[wt: backport to 4.11: adjust context]

Signed-off-by Willy Tarreau <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 Documentation/admin-guide/kernel-parameters.txt |    7 +
 arch/arc/mm/mmap.c                              |    2 
 arch/arm/mm/mmap.c                              |    4 
 arch/frv/mm/elf-fdpic.c                         |    2 
 arch/mips/mm/mmap.c                             |    2 
 arch/parisc/kernel/sys_parisc.c                 |   15 +-
 arch/powerpc/mm/hugetlbpage-radix.c             |    2 
 arch/powerpc/mm/mmap.c                          |    4 
 arch/powerpc/mm/slice.c                         |    2 
 arch/s390/mm/mmap.c                             |    4 
 arch/sh/mm/mmap.c                               |    4 
 arch/sparc/kernel/sys_sparc_64.c                |    4 
 arch/sparc/mm/hugetlbpage.c                     |    2 
 arch/tile/mm/hugetlbpage.c                      |    2 
 arch/x86/kernel/sys_x86_64.c                    |    4 
 arch/x86/mm/hugetlbpage.c                       |    2 
 arch/xtensa/kernel/syscall.c                    |    2 
 fs/hugetlbfs/inode.c                            |    2 
 fs/proc/task_mmu.c                              |    4 
 include/linux/mm.h                              |   53 ++++----
 mm/gup.c                                        |    5 
 mm/memory.c                                     |   38 ------
 mm/mmap.c                                       |  149 ++++++++++++++----------
 23 files changed, 152 insertions(+), 163 deletions(-)

Documentation/admin-guide/kernel-parameters.txt +7 -0

@@ -3779,6 +3779,13 @@
 	spia_pedr=
 	spia_peddr=
 
+	stack_guard_gap=	[MM]
+			override the default stack gap protection. The value
+			is in page units and it defines how many pages prior
+			to (for stacks growing down) resp. after (for stacks
+			growing up) the main stack are reserved for no other
+			mapping. Default value is 256 pages.
+
 	stacktrace	[FTRACE]
 			Enabled the stack tracer on boot up.

arch/arc/mm/mmap.c +1 -1

@@ -65,7 +65,7 @@ arch_get_unmapped_area(struct file *filp
 
 		vma = find_vma(mm, addr);
 		if (TASK_SIZE - len >= addr &&
-		    (!vma || addr + len <= vma->vm_start))
+		    (!vma || addr + len <= vm_start_gap(vma)))
 			return addr;
 	}

arch/arm/mm/mmap.c +2 -2

@@ -90,7 +90,7 @@ arch_get_unmapped_area(struct file *filp
 
 		vma = find_vma(mm, addr);
 		if (TASK_SIZE - len >= addr &&
-		    (!vma || addr + len <= vma->vm_start))
+		    (!vma || addr + len <= vm_start_gap(vma)))
 			return addr;
 	}

@@ -141,7 +141,7 @@ arch_get_unmapped_area_topdown(struct fi
 			addr = PAGE_ALIGN(addr);
 		vma = find_vma(mm, addr);
 		if (TASK_SIZE - len >= addr &&
-				(!vma || addr + len <= vma->vm_start))
+				(!vma || addr + len <= vm_start_gap(vma)))
 			return addr;
 	}

arch/frv/mm/elf-fdpic.c +1 -1

@@ -75,7 +75,7 @@ unsigned long arch_get_unmapped_area(str
 		addr = PAGE_ALIGN(addr);
 		vma = find_vma(current->mm, addr);
 		if (TASK_SIZE - len >= addr &&
-		    (!vma || addr + len <= vma->vm_start))
+		    (!vma || addr + len <= vm_start_gap(vma)))
 			goto success;
 	}

arch/mips/mm/mmap.c +1 -1

@@ -93,7 +93,7 @@ static unsigned long arch_get_unmapped_a
 
 		vma = find_vma(mm, addr);
 		if (TASK_SIZE - len >= addr &&
-		    (!vma || addr + len <= vma->vm_start))
+		    (!vma || addr + len <= vm_start_gap(vma)))
 			return addr;
 	}

arch/parisc/kernel/sys_parisc.c +9 -6

@@ -90,7 +90,7 @@ unsigned long arch_get_unmapped_area(str
 		unsigned long len, unsigned long pgoff, unsigned long flags)
 {
 	struct mm_struct *mm = current->mm;
-	struct vm_area_struct *vma;
+	struct vm_area_struct *vma, *prev;
 	unsigned long task_size = TASK_SIZE;
 	int do_color_align, last_mmap;
 	struct vm_unmapped_area_info info;

@@ -117,9 +117,10 @@ unsigned long arch_get_unmapped_area(str
 		else
 			addr = PAGE_ALIGN(addr);
 
-		vma = find_vma(mm, addr);
+		vma = find_vma_prev(mm, addr, &prev);
 		if (task_size - len >= addr &&
-		    (!vma || addr + len <= vma->vm_start))
+		    (!vma || addr + len <= vm_start_gap(vma)) &&
+		    (!prev || addr >= vm_end_gap(prev)))
 			goto found_addr;
 	}

@@ -143,7 +144,7 @@ arch_get_unmapped_area_topdown(struct fi
 			  const unsigned long len, const unsigned long pgoff,
 			  const unsigned long flags)
 {
-	struct vm_area_struct *vma;
+	struct vm_area_struct *vma, *prev;
 	struct mm_struct *mm = current->mm;
 	unsigned long addr = addr0;
 	int do_color_align, last_mmap;

@@ -177,9 +178,11 @@ arch_get_unmapped_area_topdown(struct fi
 			addr = COLOR_ALIGN(addr, last_mmap, pgoff);
 		else
 			addr = PAGE_ALIGN(addr);
-		vma = find_vma(mm, addr);
+
+		vma = find_vma_prev(mm, addr, &prev);
 		if (TASK_SIZE - len >= addr &&
-		    (!vma || addr + len <= vma->vm_start))
+		    (!vma || addr + len <= vm_start_gap(vma)) &&
+		    (!prev || addr >= vm_end_gap(prev)))
 			goto found_addr;
 	}

arch/powerpc/mm/hugetlbpage-radix.c +1 -1

@@ -65,7 +65,7 @@ radix__hugetlb_get_unmapped_area(struct
 		addr = ALIGN(addr, huge_page_size(h));
 		vma = find_vma(mm, addr);
 		if (TASK_SIZE - len >= addr &&
-		    (!vma || addr + len <= vma->vm_start))
+		    (!vma || addr + len <= vm_start_gap(vma)))
 			return addr;
 	}
 	/*

arch/powerpc/mm/mmap.c +2 -2

@@ -107,7 +107,7 @@ radix__arch_get_unmapped_area(struct fil
 		addr = PAGE_ALIGN(addr);
 		vma = find_vma(mm, addr);
 		if (TASK_SIZE - len >= addr && addr >= mmap_min_addr &&
-		    (!vma || addr + len <= vma->vm_start))
+		    (!vma || addr + len <= vm_start_gap(vma)))
 			return addr;
 	}

@@ -143,7 +143,7 @@ radix__arch_get_unmapped_area_topdown(st
 		addr = PAGE_ALIGN(addr);
 		vma = find_vma(mm, addr);
 		if (TASK_SIZE - len >= addr && addr >= mmap_min_addr &&
-				(!vma || addr + len <= vma->vm_start))
+				(!vma || addr + len <= vm_start_gap(vma)))
 			return addr;
 	}

arch/powerpc/mm/slice.c +1 -1

@@ -105,7 +105,7 @@ static int slice_area_is_free(struct mm_
 	if ((mm->task_size - len) < addr)
 		return 0;
 	vma = find_vma(mm, addr);
-	return (!vma || (addr + len) <= vma->vm_start);
+	return (!vma || (addr + len) <= vm_start_gap(vma));
 }
 
 static int slice_low_has_vma(struct mm_struct *mm, unsigned long slice)

arch/s390/mm/mmap.c +2 -2

@@ -100,7 +100,7 @@ arch_get_unmapped_area(struct file *filp
 		addr = PAGE_ALIGN(addr);
 		vma = find_vma(mm, addr);
 		if (TASK_SIZE - len >= addr && addr >= mmap_min_addr &&
-		    (!vma || addr + len <= vma->vm_start))
+		    (!vma || addr + len <= vm_start_gap(vma)))
 			return addr;
 	}

@@ -138,7 +138,7 @@ arch_get_unmapped_area_topdown(struct fi
 		addr = PAGE_ALIGN(addr);
 		vma = find_vma(mm, addr);
 		if (TASK_SIZE - len >= addr && addr >= mmap_min_addr &&
-				(!vma || addr + len <= vma->vm_start))
+				(!vma || addr + len <= vm_start_gap(vma)))
 			return addr;
 	}

arch/sh/mm/mmap.c +2 -2

@@ -64,7 +64,7 @@ unsigned long arch_get_unmapped_area(str
 
 		vma = find_vma(mm, addr);
 		if (TASK_SIZE - len >= addr &&
-		    (!vma || addr + len <= vma->vm_start))
+		    (!vma || addr + len <= vm_start_gap(vma)))
 			return addr;
 	}

@@ -114,7 +114,7 @@ arch_get_unmapped_area_topdown(struct fi
 
 		vma = find_vma(mm, addr);
 		if (TASK_SIZE - len >= addr &&
-		    (!vma || addr + len <= vma->vm_start))
+		    (!vma || addr + len <= vm_start_gap(vma)))
 			return addr;
 	}

arch/sparc/kernel/sys_sparc_64.c +2 -2

@@ -120,7 +120,7 @@ unsigned long arch_get_unmapped_area(str
 
 		vma = find_vma(mm, addr);
 		if (task_size - len >= addr &&
-		    (!vma || addr + len <= vma->vm_start))
+		    (!vma || addr + len <= vm_start_gap(vma)))
 			return addr;
 	}

@@ -183,7 +183,7 @@ arch_get_unmapped_area_topdown(struct fi
 
 		vma = find_vma(mm, addr);
 		if (task_size - len >= addr &&
-		    (!vma || addr + len <= vma->vm_start))
+		    (!vma || addr + len <= vm_start_gap(vma)))
 			return addr;
 	}

arch/sparc/mm/hugetlbpage.c +1 -1

@@ -120,7 +120,7 @@ hugetlb_get_unmapped_area(struct file *f
 		addr = ALIGN(addr, huge_page_size(h));
 		vma = find_vma(mm, addr);
 		if (task_size - len >= addr &&
-		    (!vma || addr + len <= vma->vm_start))
+		    (!vma || addr + len <= vm_start_gap(vma)))
 			return addr;
 	}
 	if (mm->get_unmapped_area == arch_get_unmapped_area)

arch/tile/mm/hugetlbpage.c +1 -1

@@ -233,7 +233,7 @@ unsigned long hugetlb_get_unmapped_area(
 		addr = ALIGN(addr, huge_page_size(h));
 		vma = find_vma(mm, addr);
 		if (TASK_SIZE - len >= addr &&
-		    (!vma || addr + len <= vma->vm_start))
+		    (!vma || addr + len <= vm_start_gap(vma)))
 			return addr;
 	}
 	if (current->mm->get_unmapped_area == arch_get_unmapped_area)

arch/x86/kernel/sys_x86_64.c +2 -2

@@ -141,7 +141,7 @@ arch_get_unmapped_area(struct file *filp
 		addr = PAGE_ALIGN(addr);
 		vma = find_vma(mm, addr);
 		if (end - len >= addr &&
-		    (!vma || addr + len <= vma->vm_start))
+		    (!vma || addr + len <= vm_start_gap(vma)))
 			return addr;
 	}

@@ -184,7 +184,7 @@ arch_get_unmapped_area_topdown(struct fi
 		addr = PAGE_ALIGN(addr);
 		vma = find_vma(mm, addr);
 		if (TASK_SIZE - len >= addr &&
-				(!vma || addr + len <= vma->vm_start))
+				(!vma || addr + len <= vm_start_gap(vma)))
 			return addr;
 	}

arch/x86/mm/hugetlbpage.c +1 -1

@@ -145,7 +145,7 @@ hugetlb_get_unmapped_area(struct file *f
 		addr = ALIGN(addr, huge_page_size(h));
 		vma = find_vma(mm, addr);
 		if (TASK_SIZE - len >= addr &&
-		    (!vma || addr + len <= vma->vm_start))
+		    (!vma || addr + len <= vm_start_gap(vma)))
 			return addr;
 	}
 	if (mm->get_unmapped_area == arch_get_unmapped_area)

arch/xtensa/kernel/syscall.c +1 -1

@@ -88,7 +88,7 @@ unsigned long arch_get_unmapped_area(str
 		/* At this point:  (!vmm || addr < vmm->vm_end). */
 		if (TASK_SIZE - len < addr)
 			return -ENOMEM;
-		if (!vmm || addr + len <= vmm->vm_start)
+		if (!vmm || addr + len <= vm_start_gap(vmm))
 			return addr;
 		addr = vmm->vm_end;
 		if (flags & MAP_SHARED)

fs/hugetlbfs/inode.c +1 -1

@@ -200,7 +200,7 @@ hugetlb_get_unmapped_area(struct file *f
 		addr = ALIGN(addr, huge_page_size(h));
 		vma = find_vma(mm, addr);
 		if (TASK_SIZE - len >= addr &&
-		    (!vma || addr + len <= vma->vm_start))
+		    (!vma || addr + len <= vm_start_gap(vma)))
 			return addr;
 	}

fs/proc/task_mmu.c +0 -4

@@ -300,11 +300,7 @@ show_map_vma(struct seq_file *m, struct
 
 	/* We don't show the stack guard page in /proc/maps */
 	start = vma->vm_start;
-	if (stack_guard_page_start(vma, start))
-		start += PAGE_SIZE;
 	end = vma->vm_end;
-	if (stack_guard_page_end(vma, end))
-		end -= PAGE_SIZE;
 
 	seq_setwidth(m, 25 + sizeof(void *) * 6 - 1);
 	seq_printf(m, "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu ",

include/linux/mm.h +25 ~~-28~~

77 lines not on this page · raw message

mm/gup.c +0 -5

@@ -387,11 +387,6 @@ static int faultin_page(struct task_stru
 	/* mlock all present pages, but do not fault in new pages */
 	if ((*flags & (FOLL_POPULATE | FOLL_MLOCK)) == FOLL_MLOCK)
 		return -ENOENT;
-	/* For mm_populate(), just skip the stack guard page. */
-	if ((*flags & FOLL_POPULATE) &&
-			(stack_guard_page_start(vma, address) ||
-			 stack_guard_page_end(vma, address + PAGE_SIZE)))
-		return -ENOENT;
 	if (*flags & FOLL_WRITE)
 		fault_flags |= FAULT_FLAG_WRITE;
 	if (*flags & FOLL_REMOTE)

mm/memory.c +0 ~~-38~~

@@ -2855,40 +2855,6 @@ out_release:
 }
 
 /*
- * This is like a special single-page "expand_{down|up}wards()",
- * except we must first make sure that 'address{-|+}PAGE_SIZE'
- * doesn't hit another vma.
- */
-static inline int check_stack_guard_page(struct vm_area_struct *vma, unsigned long address)
-{
-	address &= PAGE_MASK;
-	if ((vma->vm_flags & VM_GROWSDOWN) && address == vma->vm_start) {
-		struct vm_area_struct *prev = vma->vm_prev;
-
-		/*
-		 * Is there a mapping abutting this one below?
-		 *
-		 * That's only ok if it's the same stack mapping
-		 * that has gotten split..
-		 */
-		if (prev && prev->vm_end == address)
-			return prev->vm_flags & VM_GROWSDOWN ? 0 : -ENOMEM;
-
-		return expand_downwards(vma, address - PAGE_SIZE);
-	}
-	if ((vma->vm_flags & VM_GROWSUP) && address + PAGE_SIZE == vma->vm_end) {
-		struct vm_area_struct *next = vma->vm_next;
-
-		/* As VM_GROWSDOWN but s/below/above/ */
-		if (next && next->vm_start == address + PAGE_SIZE)
-			return next->vm_flags & VM_GROWSUP ? 0 : -ENOMEM;
-
-		return expand_upwards(vma, address + PAGE_SIZE);
-	}
-	return 0;
-}
-
-/*
  * We enter with non-exclusive mmap_sem (to exclude vma changes,
  * but allow concurrent faults), and pte mapped but not yet locked.
  * We return with mmap_sem still held, but pte unmapped and unlocked.

@@ -2904,10 +2870,6 @@ static int do_anonymous_page(struct vm_f
 	if (vma->vm_flags & VM_SHARED)
 		return VM_FAULT_SIGBUS;
 
-	/* Check if we need to add a guard page to the stack */
-	if (check_stack_guard_page(vma, vmf->address) < 0)
-		return VM_FAULT_SIGSEGV;
-
 	/*
 	 * Use pte_alloc() instead of pte_alloc_map().  We can't run
 	 * pte_offset_map() on pmds where a huge pmd might be created

mm/mmap.c +89 ~~-60~~

321 lines not on this page · raw message

Guenter Roeck

2017-06-19 22:48 UTC #76 lore raw