4.9.40-stable review
Subsystems (4)
Greg Kroah-Hartman
maintainercover 4.9.40-stable review
This is the start of the stable review cycle for the 4.9.40 release. There are 125 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu Jul 27 19:19:43 UTC 2017. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.40-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.9.40-rc1
Greg Hackmann <[email protected]>
alarmtimer: don't rate limit one-shot timers
Chunyu Hu <[email protected]>
tracing: Fix kmemleak in instance_rmdir
Sudeep Holla <[email protected]>
PM / Domains: defer dev_pm_domain_set() until genpd->attach_dev succeeds if present
Jan Kara <[email protected]>
reiserfs: Don't clear SGID when inheriting ACLs
Bjorn Andersson <[email protected]>
spmi: Include OF based modalias in device uevent
Stephen Boyd <[email protected]>
of: device: Export of_device_{get_modalias, uvent_modalias} to modules
Prarit Bhargava <[email protected]>
acpi/nfit: Fix memory corruption/Unregister mce decoder on failure
Amir Goldstein <[email protected]>
ovl: fix random return value on mount
Jan Kara <[email protected]>
hfsplus: Don't clear SGID when inheriting ACLs
Bart Van Assche <[email protected]>
mlx5: Avoid that mlx5_ib_sg_to_klms() overflows the klms[] array
Imre Deak <[email protected]>
drm/mst: Avoid processing partially received up/down message transactions
Imre Deak <[email protected]>
drm/mst: Avoid dereferencing a NULL mstb in drm_dp_mst_handle_up_req()
Imre Deak <[email protected]>
drm/mst: Fix error handling during MST sideband message reception
Ismail, Mustafa <[email protected]>
RDMA/core: Initialize port_num in qp_attr
Yan, Zheng <[email protected]>
ceph: fix race in concurrent readdir
Arnd Bergmann <[email protected]>
staging: lustre: ko2iblnd: check copy_from_iter/copy_to_iter return code
Teddy Wang <[email protected]>
staging: sm750fb: avoid conflicting vesafb
Ian Abbott <[email protected]>
staging: comedi: ni_mio_common: fix AO timer off-by-one regression
Michael Gugino <[email protected]>
staging: rtl8188eu: add TL-WN722N v2 support
Ingo Molnar <[email protected]>
Revert "perf/core: Drop kernel samples even though :u is specified"
Jin Yao <[email protected]>
perf annotate: Fix broken arrow at row 0 connecting jmp instruction to its target
Nicholas Bellinger <[email protected]>
iser-target: Avoid isert_conn->cm_id dereference in isert_login_recv_done
Jiang Yi <[email protected]>
target: Fix COMPARE_AND_WRITE caw_sem leak during se_cmd quiesce
Jan Kara <[email protected]>
udf: Fix deadlock between writeback and udf_setsize()
NeilBrown <[email protected]>
NFS: only invalidate dentrys that are clearly invalid.
Jason A. Donenfeld <[email protected]>
sunrpc: use constant time memory comparison for mac
Moni Shoua <[email protected]>
IB/core: Namespace is mandatory input for address resolution
Vladimir Neyelov <[email protected]>
IB/iser: Fix connection teardown race condition
Chen Hong <[email protected]>
Input: i8042 - fix crash at boot time
Maciej W. Rozycki <[email protected]>
MIPS: Fix a typo: s/preset/present/ in r2-to-r6 emulation error message
Maciej W. Rozycki <[email protected]>
MIPS: Send SIGILL for R6 branches in `__compute_return_epc_for_insn'
Maciej W. Rozycki <[email protected]>
MIPS: Send SIGILL for linked branches in `__compute_return_epc_for_insn'
Maciej W. Rozycki <[email protected]>
MIPS: Rename sigill_r6' to sigill_r2r6' in `__compute_return_epc_for_insn'
Maciej W. Rozycki <[email protected]>
MIPS: Send SIGILL for BPOSGE32 in `__compute_return_epc_for_insn'
Maciej W. Rozycki <[email protected]>
MIPS: math-emu: Prevent wrong ISA mode instruction emulation
Maciej W. Rozycki <[email protected]>
MIPS: Fix unaligned PC interpretation in `compute_return_epc'
Maciej W. Rozycki <[email protected]>
MIPS: Actually decode JALX in `__compute_return_epc_for_insn'
James Hogan <[email protected]>
MIPS: Save static registers before sysmips
Maciej W. Rozycki <[email protected]>
MIPS: Fix MIPS I ISA /proc/cpuinfo reporting
Seunghun Han <[email protected]>
x86/ioapic: Pass the correct data to unmask_ioapic_irq()
Seunghun Han <[email protected]>
x86/acpi: Prevent out of bound access caused by broken ACPI tables
Lv Zheng <[email protected]>
Revert "ACPI / EC: Enable event freeze mode..." to fix a regression
Lv Zheng <[email protected]>
ACPI / EC: Drop EC noirq hooks to fix a regression
Richard Weinberger <[email protected]>
ubifs: Don't leak kernel memory to the MTD
James Hogan <[email protected]>
MIPS: Negate error syscall return in trace
James Hogan <[email protected]>
MIPS: Fix mips_atomic_set() with EVA
James Hogan <[email protected]>
MIPS: Fix mips_atomic_set() retry condition
Dan Carpenter <[email protected]>
ftrace: Fix uninitialized variable in match_records()
Marta Rybczynska <[email protected]>
nvme-rdma: remove race conditions from IB signalling
Alex Williamson <[email protected]>
vfio: New external user group/file match
Alex Williamson <[email protected]>
vfio: Fix group release deadlock
Konstantin Khlebnikov <[email protected]>
ovl: drop CAP_SYS_RESOURCE from saved mounter's credentials
John Brooks <[email protected]>
drm/ttm: Fix use-after-free in ttm_bo_clean_mm
Jaegeuk Kim <[email protected]>
f2fs: Don't clear SGID when inheriting ACLs
Jin Qian <[email protected]>
f2fs: sanity check size of nat and sit cache
Jan Kara <[email protected]>
xfs: Don't clear SGID when inheriting ACLs
Corey Minyard <[email protected]>
ipmi:ssif: Add missing unlock in error branch
Tony Camuso <[email protected]>
ipmi: use rcu lock around call to intf->handlers->sender()
Mario Kleiner <[email protected]>
drm/radeon: Fix eDP for single-display iMac10,1 (v2)
Alex Deucher <[email protected]>
drm/radeon/ci: disable mclk switching for high refresh rates (v2)
Tom St Denis <[email protected]>
drm/amd/amdgpu: Return error if initiating read out of range on vram
Jiri Olsa <[email protected]>
s390/syscalls: Fix out of bounds arguments access
Xiao Ni <[email protected]>
Raid5 should update rdev->sectors after reshape
Jan Kara <[email protected]>
ext2: Don't clear SGID when inheriting ACLs
Toshi Kani <[email protected]>
libnvdimm: fix badblock range handling of ARS range
Vishal Verma <[email protected]>
libnvdimm, btt: fix btt_rw_page not returning errors
Devin Heitmueller <[email protected]>
cx88: Fix regression in initial video standard setting
Marek Marczykowski-Górecki <[email protected]>
x86/xen: allow userspace access during hypercalls
Mikulas Patocka <[email protected]>
md: don't use flush_signals in userspace processes
Yoshihiro Shimoda <[email protected]>
usb: renesas_usbhs: gadget: disable all eps when the driver stops
Yoshihiro Shimoda <[email protected]>
usb: renesas_usbhs: fix usbhsc_resume() for !USBHSF_RUNTIME_PWCTRL
Johan Hovold <[email protected]>
USB: cdc-acm: add device-id for quirky printer
Colin Ian King <[email protected]>
usb: storage: return on error to avoid a null pointer dereference
Devin Heitmueller <[email protected]>
mxl111sf: Fix driver to use heap allocate buffers for USB messages
Jiahau Chang <[email protected]>
xhci: Bad Ethernet performance plugged in ASM1042A host
Mathias Nyman <[email protected]>
xhci: Fix NULL pointer dereference when cleaning up streams for removed host
Mathias Nyman <[email protected]>
xhci: fix 20000ms port resume timeout
Julian Anastasov <[email protected]>
ipvs: SNAT packet replies only for NATed connections
Chen Yu <[email protected]>
PCI/PM: Restore the status of PCI devices across hibernation
Shawn Lin <[email protected]>
PCI: rockchip: Use normal register bank for config accessors
Bjorn Helgaas <[email protected]>
PCI: Work around poweroff & suspend-to-RAM issue on Macbook Pro 11
Herbert Xu <[email protected]>
af_key: Fix sadb_x_ipsecrequest parsing
Benjamin Herrenschmidt <[email protected]>
powerpc/mm/radix: Properly clear process table entry
Oliver O'Halloran <[email protected]>
powerpc/asm: Mark cr0 as clobbered in mftb()
Anton Blanchard <[email protected]>
powerpc: Fix emulation of mfocrf in emulate_step()
Anton Blanchard <[email protected]>
powerpc: Fix emulation of mcrf in emulate_step()
Michael Ellerman <[email protected]>
powerpc/64: Fix atomic64_inc_not_zero() to return an int
Balbir Singh <[email protected]>
powerpc/pseries: Fix passing of pp0 in updatepp() and updateboltedpp()
Bart Van Assche <[email protected]>
xen/scsiback: Fix a TMR related use-after-free
Nicholas Bellinger <[email protected]>
iscsi-target: Add login_keys_workaround attribute for non RFC initiators
Ewan D. Milne <[email protected]>
scsi: Add STARGET_CREATED_REMOVE state to scsi_target_state
Maurizio Lombardi <[email protected]>
scsi: ses: do not add a device to an enclosure if enclosure_add_links() fails.
Krzysztof Kozlowski <[email protected]>
PM / Domains: Fix unsafe iteration over modified list of domains
Krzysztof Kozlowski <[email protected]>
PM / Domains: Fix unsafe iteration over modified list of domain providers
Krzysztof Kozlowski <[email protected]>
PM / Domains: Fix unsafe iteration over modified list of device links
Satish Babu Patakokila <[email protected]>
ASoC: compress: Derive substream from stream based on direction
Matwey V Kornilov <[email protected]>
igb: Explicitly select page 0 at initialization
Jan Kara <[email protected]>
btrfs: Don't clear SGID when inheriting ACLs
Arnd Bergmann <[email protected]>
wlcore: fix 64K page support
Jason A. Donenfeld <[email protected]>
Bluetooth: use constant time memory comparison for secret values
Adrian Hunter <[email protected]>
perf intel-pt: Clear FUP flag on error
Adrian Hunter <[email protected]>
perf intel-pt: Use FUP always when scanning for an IP
Adrian Hunter <[email protected]>
perf intel-pt: Ensure never to set 'last_ip' when packet 'count' is zero
Adrian Hunter <[email protected]>
perf intel-pt: Fix last_ip usage
Adrian Hunter <[email protected]>
perf intel-pt: Ensure IP is zero when state is INTEL_PT_STATE_NO_IP
Adrian Hunter <[email protected]>
perf intel-pt: Fix missing stack clear
Adrian Hunter <[email protected]>
perf intel-pt: Improve sample timestamp
Adrian Hunter <[email protected]>
perf intel-pt: Move decoder error setting into one condition
Mateusz Jurczyk <[email protected]>
NFC: Add sockaddr length checks before accessing sa_family in bind handlers
Mateusz Jurczyk <[email protected]>
nfc: Fix the sockaddr length sanitization in llcp_sock_connect
Mateusz Jurczyk <[email protected]>
nfc: Ensure presence of required attributes in the activate_target handler
Johan Hovold <[email protected]>
NFC: nfcmrvl: fix firmware-management initialisation
Johan Hovold <[email protected]>
NFC: nfcmrvl: use nfc-device for firmware download
Johan Hovold <[email protected]>
NFC: nfcmrvl: do not use device-managed resources
Johan Hovold <[email protected]>
NFC: nfcmrvl_uart: add missing tty-device sanity check
Johan Hovold <[email protected]>
NFC: fix broken device allocation
Miaoqing Pan <[email protected]>
ath9k: fix an invalid pointer dereference in ath9k_rng_stop()
Miaoqing Pan <[email protected]>
ath9k: fix tx99 bus error
Miaoqing Pan <[email protected]>
ath9k: fix tx99 use after free
Viresh Kumar <[email protected]>
thermal: cpu_cooling: Avoid accessing potentially freed structures
Johan Hovold <[email protected]>
thermal: max77620: fix device-node reference imbalance
Mauro Carvalho Chehab <[email protected]>
s5p-jpeg: don't return a random width/height
Mike Snitzer <[email protected]>
dm mpath: cleanup -Wbool-operation warning in choose_pgpath()
Arnd Bergmann <[email protected]>
ir-core: fix gcc-7 warning on bool arithmetic
Linus Torvalds <[email protected]>
disable new gcc-7.1.1 warnings for now
-------------
Diffstat:
Makefile | 7 +- arch/mips/include/asm/branch.h | 5 +- arch/mips/kernel/branch.c | 71 +++++++++----------- arch/mips/kernel/proc.c | 2 +- arch/mips/kernel/ptrace.c | 2 +- arch/mips/kernel/scall32-o32.S | 2 +- arch/mips/kernel/scall64-64.S | 2 +- arch/mips/kernel/scall64-n32.S | 2 +- arch/mips/kernel/scall64-o32.S | 2 +- arch/mips/kernel/syscall.c | 15 ++++- arch/mips/math-emu/cp1emu.c | 38 +++++++++++ arch/powerpc/include/asm/atomic.h | 4 +- arch/powerpc/include/asm/reg.h | 2 +- arch/powerpc/lib/sstep.c | 19 +++++- arch/powerpc/mm/mmu_context_book3s64.c | 12 +++- arch/powerpc/platforms/pseries/lpar.c | 11 ++- arch/s390/include/asm/syscall.h | 6 ++ arch/x86/include/asm/xen/hypercall.h | 3 + arch/x86/kernel/acpi/boot.c | 8 +++ arch/x86/kernel/apic/io_apic.c | 2 +- arch/x86/pci/fixup.c | 32 +++++++++ drivers/acpi/ec.c | 21 +----- drivers/acpi/nfit/core.c | 10 ++- drivers/base/power/domain.c | 20 +++--- drivers/char/ipmi/ipmi_msghandler.c | 5 ++ drivers/char/ipmi/ipmi_ssif.c | 5 ++ drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 3 + drivers/gpu/drm/drm_dp_mst_topology.c | 41 +++++++++--- drivers/gpu/drm/radeon/atombios_encoders.c | 13 +++- drivers/gpu/drm/radeon/ci_dpm.c | 6 ++ drivers/gpu/drm/ttm/ttm_bo.c | 4 +- drivers/infiniband/core/addr.c | 6 +- drivers/infiniband/core/cma.c | 2 + drivers/infiniband/hw/mlx5/mr.c | 2 +- drivers/infiniband/ulp/iser/iscsi_iser.c | 11 +++ drivers/infiniband/ulp/isert/ib_isert.c | 2 +- drivers/input/serio/i8042.c | 12 +++- drivers/md/dm-mpath.c | 4 +- drivers/md/raid1.c | 5 +- drivers/md/raid5.c | 9 +-- drivers/media/pci/cx88/cx88-cards.c | 9 ++- drivers/media/pci/cx88/cx88-video.c | 2 +- drivers/media/platform/s5p-jpeg/jpeg-core.c | 8 +-- drivers/media/rc/imon.c | 2 +- drivers/media/usb/dvb-usb-v2/mxl111sf-i2c.c | 4 +- drivers/media/usb/dvb-usb-v2/mxl111sf.c | 32 +++++---- drivers/media/usb/dvb-usb-v2/mxl111sf.h | 8 ++- drivers/misc/enclosure.c | 14 ++-- drivers/net/ethernet/intel/igb/e1000_82575.c | 1 + drivers/net/wireless/ath/ath9k/ar9003_phy.c | 2 - drivers/net/wireless/ath/ath9k/rng.c | 4 +- drivers/net/wireless/ath/ath9k/tx99.c | 13 ++-- drivers/net/wireless/ti/wlcore/spi.c | 6 +- drivers/nfc/nfcmrvl/fw_dnld.c | 7 +- drivers/nfc/nfcmrvl/main.c | 35 +++++----- drivers/nfc/nfcmrvl/uart.c | 8 +-- drivers/nvdimm/btt.c | 9 ++- drivers/nvdimm/core.c | 7 +- drivers/nvme/host/rdma.c | 20 +++--- drivers/of/device.c | 2 + drivers/pci/host/pcie-rockchip.c | 13 ++-- drivers/pci/pci-driver.c | 1 + drivers/scsi/scsi_scan.c | 5 +- drivers/scsi/scsi_sysfs.c | 8 ++- drivers/spmi/spmi.c | 12 ++++ drivers/staging/comedi/drivers/ni_mio_common.c | 3 +- .../staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c | 19 ++++-- drivers/staging/rtl8188eu/os_dep/usb_intf.c | 1 + drivers/staging/sm750fb/sm750.c | 24 +++++++ drivers/target/iscsi/iscsi_target_configfs.c | 2 + drivers/target/iscsi/iscsi_target_nego.c | 6 +- drivers/target/iscsi/iscsi_target_parameters.c | 41 ++++++++---- drivers/target/iscsi/iscsi_target_parameters.h | 2 +- drivers/target/iscsi/iscsi_target_tpg.c | 19 ++++++ drivers/target/iscsi/iscsi_target_tpg.h | 1 + drivers/target/target_core_transport.c | 9 +++ drivers/thermal/cpu_cooling.c | 4 +- drivers/thermal/max77620_thermal.c | 10 ++- drivers/usb/class/cdc-acm.c | 3 + drivers/usb/host/pci-quirks.c | 54 +++++++++++++++ drivers/usb/host/pci-quirks.h | 2 + drivers/usb/host/xhci-hub.c | 3 + drivers/usb/host/xhci-pci.c | 6 ++ drivers/usb/host/xhci-ring.c | 11 +-- drivers/usb/host/xhci.c | 6 ++ drivers/usb/host/xhci.h | 1 + drivers/usb/renesas_usbhs/common.c | 4 +- drivers/usb/renesas_usbhs/mod_gadget.c | 31 +++++++-- drivers/usb/storage/isd200.c | 5 +- drivers/vfio/vfio.c | 46 ++++++++++++- drivers/xen/xen-scsiback.c | 33 +++------ fs/btrfs/acl.c | 13 ++-- fs/ceph/dir.c | 5 ++ fs/ext2/acl.c | 36 ++++++---- fs/f2fs/acl.c | 2 +- fs/f2fs/segment.c | 7 ++ fs/hfsplus/posix_acl.c | 30 +++++---- fs/nfs/dir.c | 12 ++-- fs/nfs/inode.c | 4 +- fs/overlayfs/super.c | 9 ++- fs/reiserfs/xattr_acl.c | 12 ++-- fs/ubifs/journal.c | 10 +-- fs/udf/inode.c | 4 +- fs/xfs/xfs_acl.c | 6 +- fs/xfs/xfs_acl.h | 1 + fs/xfs/xfs_iops.c | 4 +- include/linux/vfio.h | 2 + include/scsi/scsi_device.h | 1 + include/target/iscsi/iscsi_target_core.h | 9 +++ kernel/events/core.c | 21 ------ kernel/time/alarmtimer.c | 3 +- kernel/trace/ftrace.c | 2 +- kernel/trace/trace.c | 1 + net/bluetooth/smp.c | 35 +++++----- net/key/af_key.c | 47 +++++++------ net/netfilter/ipvs/ip_vs_core.c | 19 ++++-- net/nfc/core.c | 31 +++++---- net/nfc/llcp_sock.c | 9 +-- net/nfc/nci/core.c | 3 +- net/nfc/netlink.c | 4 +- net/sunrpc/auth_gss/gss_krb5_crypto.c | 3 +- sound/soc/soc-compress.c | 6 +- tools/perf/ui/browser.c | 2 +- .../perf/util/intel-pt-decoder/intel-pt-decoder.c | 78 +++++++++++++++++----- virt/kvm/vfio.c | 27 +++++--- 125 files changed, 1026 insertions(+), 438 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/125 disable new gcc-7.1.1 warnings for now
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Torvalds <[email protected]>
commit bd664f6b3e376a8ef4990f87d08271cc2d01ba9a upstream.
I made the mistake of upgrading my desktop to the new Fedora 26 that comes with gcc-7.1.1.
There's nothing wrong per se that I've noticed, but I now have 1500 lines of warnings, mostly from the new format-truncation warning triggering all over the tree.
We use 'snprintf()' and friends in a lot of places, and often know that the numbers are fairly small (ie a controller index or similar), but gcc doesn't know that, and sees an 'int', and thinks that it could be some huge number. And then complains when our buffers are not able to fit the name for the ten millionth controller.
These warnings aren't necessarily bad per se, and we probably want to look through them subsystem by subsystem, but at least during the merge window they just mean that I can't even see if somebody is introducing any *real* problems when I pull.
So warnings disabled for now.
--- Makefile | 3 +++ 1 file changed, 3 insertions(+)
Makefile +3 -0
@@ -629,6 +629,9 @@ include arch/$(SRCARCH)/Makefile KBUILD_CFLAGS += $(call cc-option,-fno-delete-null-pointer-checks,) KBUILD_CFLAGS += $(call cc-disable-warning,frame-address,) +KBUILD_CFLAGS += $(call cc-disable-warning, format-truncation) +KBUILD_CFLAGS += $(call cc-disable-warning, format-overflow) +KBUILD_CFLAGS += $(call cc-disable-warning, int-in-bool-context) ifdef CONFIG_LD_DEAD_CODE_DATA_ELIMINATION KBUILD_CFLAGS += $(call cc-option,-ffunction-sections,)
Greg Kroah-Hartman
maintainerPATCH 2/125 ir-core: fix gcc-7 warning on bool arithmetic
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
commit bd7e31bbade02bc1e92aa00d5cf2cee2da66838a upstream.
gcc-7 suggests that an expression using a bitwise not and a bitmask on a 'bool' variable is better written using boolean logic:
drivers/media/rc/imon.c: In function 'imon_incoming_scancode':drivers/media/rc/imon.c:1725:22: error: '~' on a boolean expression [-Werror=bool-operation]
ictx->pad_mouse = ~(ictx->pad_mouse) & 0x1;
^drivers/media/rc/imon.c:1725:22: note: did you mean to use logical not?
I agree.
--- drivers/media/rc/imon.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/rc/imon.c +1 -1
@@ -1629,7 +1629,7 @@ static void imon_incoming_packet(structif (kc ==KEY_KEYBOARD && !ictx->release_code) { ictx->last_keycode = kc;if (!nomouse) { - ictx->pad_mouse = ~(ictx->pad_mouse) &0x1 ; + ictx->pad_mouse = !ictx->pad_mouse;dev_dbg (dev,"toggling to %s mode\n" , ictx->pad_mouse ?"mouse" :"keyboard" );spin_unlock_irqrestore (&ictx->kc_lock, flags);
Greg Kroah-Hartman
maintainerPATCH 3/125 dm mpath: cleanup -Wbool-operation warning in choose_pgpath()
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Snitzer <[email protected]>
commit d19a55ccad15a486ffe03030570744e5d5bd9f8e upstream.
--- drivers/md/dm-mpath.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/md/dm-mpath.c +2 -2
@@ -431,7 +431,7 @@ static struct pgpath *choose_pgpath(struunsigned long flags;struct priority_group *pg;struct pgpath *pgpath; -bool bypassed = true; +unsigned bypassed =1 ;if (!atomic_read (&m->nr_valid_paths)) {clear_bit (MPATHF_QUEUE_IO , &m->flags);
@@ -470,7 +470,7 @@ check_current_pg:*/ do { list_for_each_entry(pg, &m->priority_groups, list) { - if (pg->bypassed == bypassed) + if (pg->bypassed == !!bypassed) continue; pgpath = choose_path_in_pg(m, pg, nr_bytes); if (!IS_ERR_OR_NULL(pgpath)) {
Greg Kroah-Hartman
maintainerPATCH 4/125 s5p-jpeg: dont return a random width/height
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mauro Carvalho Chehab <[email protected]>
commit a16e37726c444cbda91e73ed5f742e717bfe866f upstream.
Gcc 7.1 complains about:
drivers/media/platform/s5p-jpeg/jpeg-core.c: In function 's5p_jpeg_parse_hdr.isra.9':drivers/media/platform/s5p-jpeg/jpeg-core.c:1207:12: warning: 'width' may be used uninitialized in this function [-Wmaybe-uninitialized]
result->w = width;
~~~~~~~~~~^~~~~~~drivers/media/platform/s5p-jpeg/jpeg-core.c:1208:12: warning: 'height' may be used uninitialized in this function [-Wmaybe-uninitialized]
result->h = height;
~~~~~~~~~~^~~~~~~~
Indeed the code would allow it to return a random value (although it shouldn't happen, in practice). So, explicitly set both to zero, just in case.
--- drivers/media/platform/s5p-jpeg/jpeg-core.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/media/platform/s5p-jpeg/jpeg-core.c +4 -4
@@ -1099,10 +1099,10 @@ static bool s5p_jpeg_parse_hdr(struct s5 struct s5p_jpeg_ctx *ctx) {int c, components =0 , notfound, n_dht =0 , n_dqt =0 ; -unsigned int height, width, word, subsampling =0 , sos =0 , sof =0 , - sof_len =0 ; -unsigned int dht[S5P_JPEG_MAX_MARKER ], dht_len[S5P_JPEG_MAX_MARKER ], - dqt[S5P_JPEG_MAX_MARKER ], dqt_len[S5P_JPEG_MAX_MARKER ]; +unsigned int height =0 , width =0 , word, subsampling =0 ; +unsigned int sos =0 , sof =0 , sof_len =0 ; +unsigned int dht[S5P_JPEG_MAX_MARKER ], dht_len[S5P_JPEG_MAX_MARKER ]; +unsigned int dqt[S5P_JPEG_MAX_MARKER ], dqt_len[S5P_JPEG_MAX_MARKER ];long length;struct s5p_jpeg_buffer jpeg_buffer;
Greg Kroah-Hartman
maintainerPATCH 5/125 thermal: max77620: fix device-node reference imbalance
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit c592fafbdbb6b1279b76a54722d1465ca77e5bde upstream.
The thermal child device reuses the parent MFD-device device-tree node when registering a thermal zone, but did not take a reference to the node.
This leads to a reference imbalance, and potential use-after-free, when the node reference is dropped by the platform-bus device destructor (once for the child and later again for the parent).
Fix this by dropping any reference already held to a device-tree node and getting a reference to the parent's node which will be balanced on reprobe or on platform-device release, whichever comes first.
Note that simply clearing the of_node pointer on probe errors and on driver unbind would not allow the use of device-managed resources as specifically thermal_zone_of_sensor_unregister() claims that a valid device-tree node pointer is needed during deregistration (even if it currently does not seem to use it).
--- drivers/thermal/max77620_thermal.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/thermal/max77620_thermal.c +8 -2
@@ -104,8 +104,6 @@ static int max77620_thermal_probe(structreturn -EINVAL ; } - pdev->dev.of_node = pdev->dev.parent->of_node; - mtherm->dev = &pdev->dev; mtherm->rmap =dev_get_regmap (pdev->dev.parent,NULL );if (!mtherm->rmap) {
@@ -113,6 +111,14 @@ static int max77620_thermal_probe(structreturn -ENODEV ; } +/* +* Drop any current reference to a device-tree node and get a +* reference to the parent's node which will be balanced on reprobe or +* on platform-device release. +*/ +of_node_put (pdev->dev.of_node); + pdev->dev.of_node =of_node_get (pdev->dev.parent->of_node); + mtherm->tz_device =devm_thermal_zone_of_sensor_register (&pdev->dev,0 , mtherm, &max77620_thermal_ops);if (IS_ERR (mtherm->tz_device)) {
Greg Kroah-Hartman
maintainerPATCH 6/125 thermal: cpu_cooling: Avoid accessing potentially freed structures
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viresh Kumar <[email protected]>
commit 289d72afddf83440117c35d864bf0c6309c1d011 upstream.
After the lock is dropped, it is possible that the cpufreq_dev gets freed before we call get_level() and that can cause kernel to crash.
Drop the lock after we are done using the structure.
--- drivers/thermal/cpu_cooling.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/thermal/cpu_cooling.c +3 -1
@@ -191,8 +191,10 @@ unsigned long cpufreq_cooling_get_level(mutex_lock (&cooling_list_lock);list_for_each_entry (cpufreq_dev, &cpufreq_dev_list, node) {if (cpumask_test_cpu (cpu, &cpufreq_dev->allowed_cpus)) { +unsigned long level =get_level (cpufreq_dev, freq); +mutex_unlock (&cooling_list_lock); -return get_level (cpufreq_dev, freq); +return level; } }mutex_unlock (&cooling_list_lock);
Greg Kroah-Hartman
maintainerPATCH 7/125 ath9k: fix tx99 use after free
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miaoqing Pan <[email protected]>
commit cf8ce1ea61b75712a154c93e40f2a5af2e4dd997 upstream.
One scenario that could lead to UAF is two threads writing simultaneously to the "tx99" debug file. One of them would set the "start" value to true and follow to ath9k_tx99_init(). Inside the function it would set the sc->tx99_state to true after allocating sc->tx99skb. Then, the other thread would execute write_file_tx99() and call ath9k_tx99_deinit(). sc->tx99_state would be freed. After that, the first thread would continue inside ath9k_tx99_init() and call
r = ath9k_tx99_send(sc, sc->tx99_skb, &txctl);
that would make use of the freed sc->tx99_skb memory.
--- drivers/net/wireless/ath/ath9k/tx99.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
drivers/net/wireless/ath/ath9k/tx99.c +9 -4
@@ -189,22 +189,27 @@ static ssize_t write_file_tx99(struct fiif (strtobool (buf, &start))return -EINVAL ; +mutex_lock (&sc->mutex); +if (start == sc->tx99_state) {if (!start) -return count; + goto out;ath_dbg (common,XMIT ,"Resetting TX99\n" );ath9k_tx99_deinit (sc); }if (!start) {ath9k_tx99_deinit (sc); -return count; + goto out; } r =ath9k_tx99_init (sc); -if (r) +if (r) { +mutex_unlock (&sc->mutex);return r; - + } +out: +mutex_unlock (&sc->mutex);return count; }
Greg Kroah-Hartman
maintainerPATCH 8/125 ath9k: fix tx99 bus error
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miaoqing Pan <[email protected]>
commit bde717ab473668377fc65872398a102d40cb2d58 upstream.
The hard coded register 0x9864 and 0x9924 are invalid for ar9300 chips.
--- drivers/net/wireless/ath/ath9k/ar9003_phy.c | 2 -- 1 file changed, 2 deletions(-)
drivers/net/wireless/ath/ath9k/ar9003_phy.c +0 -2
@@ -1821,8 +1821,6 @@ static void ar9003_hw_spectral_scan_waitstatic void ar9003_hw_tx99_start (struct ath_hw *ah,u32 qnum) {REG_SET_BIT (ah,AR_PHY_TEST ,PHY_AGC_CLR ); -REG_SET_BIT (ah,0x9864 ,0x7f000 ); -REG_SET_BIT (ah,0x9924 ,0x7f00fe );REG_CLR_BIT (ah,AR_DIAG_SW ,AR_DIAG_RX_DIS );REG_WRITE (ah,AR_CR ,AR_CR_RXD );REG_WRITE (ah,AR_DLCL_IFS (qnum),0 );
Greg Kroah-Hartman
maintainerPATCH 9/125 ath9k: fix an invalid pointer dereference in ath9k_rng_stop()
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miaoqing Pan <[email protected]>
commit 07246c115801c27652700e3679bb58661ef7ed65 upstream.
The bug was triggered when do suspend/resuming continuously on Dell XPS L322X/0PJHXN version 9333 (2013) with kernel 4.12.0-041200rc4-generic. But can't reproduce on DELL E5440 + AR9300 PCIE chips.
The warning is caused by accessing invalid pointer sc->rng_task. sc->rng_task is not be cleared after kthread_stop(sc->rng_task) be called in ath9k_rng_stop(). Because the kthread is stopped before ath9k_rng_kthread() be scheduled.
So set sc->rng_task to null after kthread_stop(sc->rng_task) to resolve this issue.
WARNING: CPU: 0 PID: 984 at linux/kernel/kthread.c:71 kthread_stop+0xf1/0x100 CPU: 0 PID: 984 Comm: NetworkManager Not tainted 4.12.0-041200rc4-generic #201706042031 Hardware name: Dell Inc. Dell System XPS L322X/0PJHXN, BIOS A09 05/15/2013 task: ffff950170fdda00 task.stack: ffffa22c01538000 RIP: 0010:kthread_stop+0xf1/0x100 RSP: 0018:ffffa22c0153b5b0 EFLAGS: 00010246 RAX: ffffffffa6257800 RBX: ffff950171b79560 RCX: 0000000000000000 RDX: 0000000080000000 RSI: 000000007fffffff RDI: ffff9500ac9a9680 RBP: ffffa22c0153b5c8 R08: 0000000000000000 R09: 0000000000000000 R10: ffffa22c0153b648 R11: ffff9501768004b8 R12: ffff9500ac9a9680 R13: ffff950171b79f70 R14: ffff950171b78780 R15: ffff9501749dc018 FS: 00007f0d6bfd5540(0000) GS:ffff95017f200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fc190161a08 CR3: 0000000232906000 CR4: 00000000001406f0 Call Trace: ath9k_rng_stop+0x1a/0x20 [ath9k] ath9k_stop+0x3b/0x1d0 [ath9k] drv_stop+0x33/0xf0 [mac80211] ieee80211_stop_device+0x43/0x50 [mac80211] ieee80211_do_stop+0x4f2/0x810 [mac80211]
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=196043
--- drivers/net/wireless/ath/ath9k/rng.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/wireless/ath/ath9k/rng.c +3 -1
@@ -120,6 +120,8 @@ void ath9k_rng_start(struct ath_softc *svoid ath9k_rng_stop (struct ath_softc *sc) { -if (sc->rng_task) +if (sc->rng_task) {kthread_stop (sc->rng_task); + sc->rng_task =NULL ; + } }
Greg Kroah-Hartman
maintainerPATCH 10/125 NFC: fix broken device allocation
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 20777bc57c346b6994f465e0d8261a7fbf213a09 upstream.
Commit 7eda8b8e9677 ("NFC: Use IDR library to assing NFC devices IDs") moved device-id allocation and struct-device initialisation from nfc_allocate_device() to nfc_register_device().
This broke just about every nfc-device-registration error path, which continue to call nfc_free_device() that tries to put the device reference of the now uninitialised (but zeroed) struct device:
kobject: '(null)' (ce316420): is not initialized, yet kobject_put() is being called.
The late struct-device initialisation also meant that various work queues whose names are derived from the nfc device name were also misnamed:
421 root 0 SW< [(null)_nci_cmd_] 422 root 0 SW< [(null)_nci_rx_w] 423 root 0 SW< [(null)_nci_tx_w]
Move the id-allocation and struct-device initialisation back to nfc_allocate_device() and fix up the single call site which did not use nfc_free_device() in its error path.
--- net/nfc/core.c | 31 ++++++++++++++++++------------- net/nfc/nci/core.c | 3 +-- 2 files changed, 19 insertions(+), 15 deletions(-)
net/nfc/core.c +18 -13
@@ -982,6 +982,8 @@ static void nfc_release(struct device *dkfree (se); } +ida_simple_remove (&nfc_index_ida, dev->idx); +kfree (dev); }
@@ -1056,6 +1058,7 @@ struct nfc_dev *nfc_allocate_device(stru int tx_headroom, int tx_tailroom) {struct nfc_dev *dev; +int rc;if (!ops->start_poll || !ops->stop_poll || !ops->activate_target || !ops->deactivate_target || !ops->im_transceive)
@@ -1068,6 +1071,15 @@ struct nfc_dev *nfc_allocate_device(struif (!dev)return NULL ; + rc =ida_simple_get (&nfc_index_ida,0 ,0 ,GFP_KERNEL ); +if (rc <0 ) + goto err_free_dev; + dev->idx = rc; + + dev->dev.class = &nfc_class; +dev_set_name (&dev->dev,"nfc%d" , dev->idx); +device_initialize (&dev->dev); + dev->ops = ops; dev->supported_protocols = supported_protocols; dev->tx_headroom = tx_headroom;
@@ -1090,6 +1102,11 @@ struct nfc_dev *nfc_allocate_device(stru }return dev; + +err_free_dev: +kfree (dev); + +return ERR_PTR (rc); }EXPORT_SYMBOL (nfc_allocate_device);
@@ -1104,14 +1121,6 @@ int nfc_register_device(struct nfc_dev *pr_debug ("dev_name=%s\n" ,dev_name (&dev->dev)); - dev->idx =ida_simple_get (&nfc_index_ida,0 ,0 ,GFP_KERNEL ); -if (dev->idx <0 ) -return dev->idx; - - dev->dev.class = &nfc_class; -dev_set_name (&dev->dev,"nfc%d" , dev->idx); -device_initialize (&dev->dev); -mutex_lock (&nfc_devlist_mutex); nfc_devlist_generation++; rc =device_add (&dev->dev);
@@ -1149,12 +1158,10 @@ EXPORT_SYMBOL(nfc_register_device);*/ void nfc_unregister_device (struct nfc_dev *dev) { -int rc, id; +int rc;pr_debug ("dev_name=%s\n" ,dev_name (&dev->dev)); - id = dev->idx; -if (dev->rfkill) {rfkill_unregister (dev->rfkill);rfkill_destroy (dev->rfkill);
@@ -1179,8 +1186,6 @@ void nfc_unregister_device(struct nfc_de nfc_devlist_generation++;device_del (&dev->dev);mutex_unlock (&nfc_devlist_mutex); - -ida_simple_remove (&nfc_index_ida, id); }EXPORT_SYMBOL (nfc_unregister_device);
net/nfc/nci/core.c +1 -2
@@ -1173,8 +1173,7 @@ struct nci_dev *nci_allocate_device(strureturn ndev; free_nfc: -kfree (ndev->nfc_dev); - +nfc_free_device (ndev->nfc_dev); free_nci:kfree (ndev);return NULL ;
Greg Kroah-Hartman
maintainerPATCH 11/125 NFC: nfcmrvl_uart: add missing tty-device sanity check
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 15e0c59f1535926a939d1df66d6edcf997d7c1b9 upstream.
Make sure to check the tty-device pointer before trying to access the parent device to avoid dereferencing a NULL-pointer when the tty is one end of a Unix98 pty.
--- drivers/nfc/nfcmrvl/uart.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/nfc/nfcmrvl/uart.c +4 -4
@@ -109,6 +109,7 @@ static int nfcmrvl_nci_uart_open(structstruct nfcmrvl_private *priv;struct nfcmrvl_platform_data *pdata =NULL ;struct nfcmrvl_platform_data config; +struct device *dev = nu->tty->dev;/* * Platform data cannot be used here since usually it is already used
@@ -116,9 +117,8 @@ static int nfcmrvl_nci_uart_open(struct* and check if DT entries were added. */ -if (nu->tty->dev->parent && nu->tty->dev->parent->of_node) -if (nfcmrvl_uart_parse_dt (nu->tty->dev->parent->of_node, - &config) ==0 ) +if (dev && dev->parent && dev->parent->of_node) +if (nfcmrvl_uart_parse_dt (dev->parent->of_node, &config) ==0 ) pdata = &config;if (!pdata) {
@@ -131,7 +131,7 @@ static int nfcmrvl_nci_uart_open(struct } priv =nfcmrvl_nci_register_dev (NFCMRVL_PHY_UART , nu, &uart_ops, - nu->tty->dev, pdata); + dev, pdata);if (IS_ERR (priv))return PTR_ERR (priv);
Greg Kroah-Hartman
maintainerPATCH 12/125 NFC: nfcmrvl: do not use device-managed resources
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 0cbe40112f42cf5e008f9127f6cd5952ba3946c7 upstream.
This specifically fixes resource leaks in the registration error paths.
Device-managed resources is a bad fit for this driver as devices can be registered from the n_nci line discipline. Firstly, a tty may not even have a corresponding device (should it be part of a Unix98 pty) something which would lead to a NULL-pointer dereference when registering resources.
Secondly, if the tty has a class device, its lifetime exceeds that of the line discipline, which means that resources would leak every time the line discipline is closed (or if registration fails).
Currently, the devres interface was only being used to request a reset gpio despite the fact that it was already explicitly freed in nfcmrvl_nci_unregister_dev() (along with the private data), something which also prevented the resource leak at close.
Note that the driver treats gpio number 0 as invalid despite it being perfectly valid. This will be addressed in a follow-up patch.
--- drivers/nfc/nfcmrvl/main.c | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-)
drivers/nfc/nfcmrvl/main.c +11 -8
@@ -124,12 +124,13 @@ struct nfcmrvl_private *nfcmrvl_nci_regimemcpy (&priv->config, pdata,sizeof (*pdata));if (priv->config.reset_n_io) { - rc =devm_gpio_request_one (dev, - priv->config.reset_n_io, -GPIOF_OUT_INIT_LOW , -"nfcmrvl_reset_n" ); -if (rc <0 ) + rc =gpio_request_one (priv->config.reset_n_io, +GPIOF_OUT_INIT_LOW , +"nfcmrvl_reset_n" ); +if (rc <0 ) { + priv->config.reset_n_io =0 ;nfc_err (dev,"failed to request reset_n io\n" ); + } }if (phy ==NFCMRVL_PHY_SPI ) {
@@ -154,7 +155,7 @@ struct nfcmrvl_private *nfcmrvl_nci_regiif (!priv->ndev) {nfc_err (dev,"nci_allocate_device failed\n" ); rc = -ENOMEM ; - goto error; + goto error_free_gpio; }nci_set_drvdata (priv->ndev, priv);
@@ -179,7 +180,9 @@ struct nfcmrvl_private *nfcmrvl_nci_regi error_free_dev:nci_free_device (priv->ndev); -error: +error_free_gpio: +if (priv->config.reset_n_io) +gpio_free (priv->config.reset_n_io);kfree (priv);return ERR_PTR (rc); }
@@ -195,7 +198,7 @@ void nfcmrvl_nci_unregister_dev(struct nnfcmrvl_fw_dnld_deinit (priv);if (priv->config.reset_n_io) -devm_gpio_free (priv->dev, priv->config.reset_n_io); +gpio_free (priv->config.reset_n_io);nci_unregister_device (ndev);nci_free_device (ndev);
Greg Kroah-Hartman
maintainerPATCH 13/125 NFC: nfcmrvl: use nfc-device for firmware download
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit e5834ac22948169bbd7c45996d8d4905edd20f5e upstream.
Use the nfc- rather than phy-device in firmware-management code that needs a valid struct device.
This specifically fixes a NULL-pointer dereference in nfcmrvl_fw_dnld_init() during registration when the underlying tty is one end of a Unix98 pty.
Note that the driver still uses the phy device for any debugging, which is fine for now.
--- drivers/nfc/nfcmrvl/fw_dnld.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/nfc/nfcmrvl/fw_dnld.c +5 -2
@@ -459,7 +459,7 @@ int nfcmrvl_fw_dnld_init(struct nfcmrvl_INIT_WORK (&priv->fw_dnld.rx_work, fw_dnld_rx_work);snprintf (name,sizeof (name),"%s_nfcmrvl_fw_dnld_rx_wq" , -dev_name (priv->dev)); +dev_name (&priv->ndev->nfc_dev->dev)); priv->fw_dnld.rx_wq =create_singlethread_workqueue (name);if (!priv->fw_dnld.rx_wq)return -ENOMEM ;
@@ -496,6 +496,7 @@ int nfcmrvl_fw_dnld_start(struct nci_dev {struct nfcmrvl_private *priv =nci_get_drvdata (ndev);struct nfcmrvl_fw_dnld *fw_dnld = &priv->fw_dnld; +int res;if (!priv->support_fw_dnld)return -ENOTSUPP ;
@@ -511,7 +512,9 @@ int nfcmrvl_fw_dnld_start(struct nci_dev*/ /* Retrieve FW binary */ -if (request_firmware (&fw_dnld->fw, firmware_name, priv->dev) <0 ) { + res =request_firmware (&fw_dnld->fw, firmware_name, + &ndev->nfc_dev->dev); +if (res <0 ) {nfc_err (priv->dev,"failed to retrieve FW %s" , firmware_name);return -ENOENT ; }
Greg Kroah-Hartman
maintainerPATCH 14/125 NFC: nfcmrvl: fix firmware-management initialisation
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 45dd39b974f6632222dd5cdcbea7358a077ab0b0 upstream.
The nci-device was never deregistered in the event that fw-initialisation failed.
Fix this by moving the firmware initialisation before device registration since the firmware work queue should be available before registering.
Note that this depends on a recent fix that moved device-name initialisation back to to nci_allocate_device() as the firmware-workqueue name is now derived from the nfc-device name.
--- drivers/nfc/nfcmrvl/main.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-)
drivers/nfc/nfcmrvl/main.c +9 -7
@@ -158,26 +158,28 @@ struct nfcmrvl_private *nfcmrvl_nci_regi goto error_free_gpio; } + rc =nfcmrvl_fw_dnld_init (priv); +if (rc) { +nfc_err (dev,"failed to initialize FW download %d\n" , rc); + goto error_free_dev; + } +nci_set_drvdata (priv->ndev, priv); rc =nci_register_device (priv->ndev);if (rc) {nfc_err (dev,"nci_register_device failed %d\n" , rc); - goto error_free_dev; + goto error_fw_dnld_deinit; }/* Ensure that controller is powered off */ nfcmrvl_chip_halt (priv); - rc =nfcmrvl_fw_dnld_init (priv); -if (rc) { -nfc_err (dev,"failed to initialize FW download %d\n" , rc); - goto error_free_dev; - } -nfc_info (dev,"registered with nci successfully\n" );return priv; +error_fw_dnld_deinit: +nfcmrvl_fw_dnld_deinit (priv); error_free_dev:nci_free_device (priv->ndev); error_free_gpio:
Greg Kroah-Hartman
maintainerPATCH 15/125 nfc: Ensure presence of required attributes in the activate_target handler
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mateusz Jurczyk <[email protected]>
commit a0323b979f81ad2deb2c8836eab506534891876a upstream.
Check that the NFC_ATTR_TARGET_INDEX and NFC_ATTR_PROTOCOLS attributes (in addition to NFC_ATTR_DEVICE_INDEX) are provided by the netlink client prior to accessing them. This prevents potential unhandled NULL pointer dereference exceptions which can be triggered by malicious user-mode programs, if they omit one or both of these attributes.
--- net/nfc/netlink.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/nfc/netlink.c +3 -1
@@ -910,7 +910,9 @@ static int nfc_genl_activate_target(struu32 device_idx, target_idx, protocol;int rc; -if (!info->attrs[NFC_ATTR_DEVICE_INDEX ]) +if (!info->attrs[NFC_ATTR_DEVICE_INDEX ] || + !info->attrs[NFC_ATTR_TARGET_INDEX ] || + !info->attrs[NFC_ATTR_PROTOCOLS ])return -EINVAL ; device_idx =nla_get_u32 (info->attrs[NFC_ATTR_DEVICE_INDEX ]);
Greg Kroah-Hartman
maintainerPATCH 16/125 nfc: Fix the sockaddr length sanitization in llcp_sock_connect
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mateusz Jurczyk <[email protected]>
commit 608c4adfcabab220142ee335a2a003ccd1c0b25b upstream.
Fix the sockaddr length verification in the connect() handler of NFC/LLCP sockets, to compare against the size of the actual structure expected on input (sockaddr_nfc_llcp) instead of its shorter version (sockaddr_nfc).
Both structures are defined in include/uapi/linux/nfc.h. The fields specific to the _llcp extended struct are as follows:
276 __u8 dsap; /* Destination SAP, if known */
277 __u8 ssap; /* Source SAP to be bound to */
278 char service_name[NFC_LLCP_MAX_SERVICE_NAME]; /* Service name URI */;
279 size_t service_name_len;
If the caller doesn't provide a sufficiently long sockaddr buffer, these fields remain uninitialized (and they currently originate from the stack frame of the top-level sys_connect handler). They are then copied by llcp_sock_connect() into internal storage (nfc_llcp_sock structure), and could be subsequently read back through the user-mode getsockname() function (handled by llcp_sock_getname()). This would result in the disclosure of up to ~70 uninitialized bytes from the kernel stack to user-mode clients capable of creating AFC_NFC sockets.
--- net/nfc/llcp_sock.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
net/nfc/llcp_sock.c +1 -2
@@ -661,8 +661,7 @@ static int llcp_sock_connect(struct sockpr_debug ("sock %p sk %p flags 0x%x\n" , sock, sk, flags); -if (!addr || len <sizeof (struct sockaddr_nfc ) || - addr->sa_family !=AF_NFC ) +if (!addr || len <sizeof (*addr) || addr->sa_family !=AF_NFC )return -EINVAL ;if (addr->service_name_len ==0 && addr->dsap ==0 )
Greg Kroah-Hartman
maintainerPATCH 17/125 NFC: Add sockaddr length checks before accessing sa_family in bind handlers
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mateusz Jurczyk <[email protected]>
commit f6a5885fc4d68e7f25ffb42b9d8d80aebb3bacbb upstream.
Verify that the caller-provided sockaddr structure is large enough to contain the sa_family field, before accessing it in bind() handlers of the AF_NFC socket. Since the syscall doesn't enforce a minimum size of the corresponding memory region, very short sockaddrs (zero or one byte long) result in operating on uninitialized memory while referencing .sa_family.
--- net/nfc/llcp_sock.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
net/nfc/llcp_sock.c +4 -2
@@ -76,7 +76,8 @@ static int llcp_sock_bind(struct socketstruct sockaddr_nfc_llcp llcp_addr;int len, ret =0 ; -if (!addr || addr->sa_family !=AF_NFC ) + if (!addr || alen < offsetofend(struct sockaddr, sa_family) || + addr->sa_family !=AF_NFC )return -EINVAL ;pr_debug ("sk %p addr %p family %d\n" , sk, addr, addr->sa_family);
@@ -150,7 +151,8 @@ static int llcp_raw_sock_bind(struct socstruct sockaddr_nfc_llcp llcp_addr;int len, ret =0 ; -if (!addr || addr->sa_family !=AF_NFC ) + if (!addr || alen < offsetofend(struct sockaddr, sa_family) || + addr->sa_family !=AF_NFC )return -EINVAL ;pr_debug ("sk %p addr %p family %d\n" , sk, addr, addr->sa_family);
Greg Kroah-Hartman
maintainerPATCH 18/125 perf intel-pt: Move decoder error setting into one condition
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <[email protected]>
commit 22c06892332d8916115525145b78e606e9cc6492 upstream.
Move decoder error setting into one condition.
Cc'ed to stable because later fixes depend on it.
--- tools/perf/util/intel-pt-decoder/intel-pt-decoder.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
tools/perf/util/intel-pt-decoder/intel-pt-decoder.c +7 -4
@@ -2128,15 +2128,18 @@ const struct intel_pt_state *intel_pt_de } }while (err == -ENOLINK ); - decoder->state.err = err ?intel_pt_ext_err (err) :0 ; +if (err) { + decoder->state.err =intel_pt_ext_err (err); + decoder->state.from_ip = decoder->ip; + }else { + decoder->state.err =0 ; + } + decoder->state.timestamp = decoder->timestamp; decoder->state.est_timestamp =intel_pt_est_timestamp (decoder); decoder->state.cr3 = decoder->cr3; decoder->state.tot_insn_cnt = decoder->tot_insn_cnt; -if (err) - decoder->state.from_ip = decoder->ip; -return &decoder->state; }
Greg Kroah-Hartman
maintainerPATCH 19/125 perf intel-pt: Improve sample timestamp
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <[email protected]>
commit 3f04d98e972b59706bd43d6cc75efac91f8fba50 upstream.
The decoder uses its current timestamp in samples. Usually that is a timestamp that has already passed, but in some cases it is a timestamp for a branch that the decoder is walking towards, and consequently hasn't reached. Improve that situation by using the pkt_state to determine when to use the current or previous timestamp.
--- tools/perf/util/intel-pt-decoder/intel-pt-decoder.c | 34 ++++++++++++++++++-- 1 file changed, 31 insertions(+), 3 deletions(-)
tools/perf/util/intel-pt-decoder/intel-pt-decoder.c +31 -3
@@ -64,6 +64,25 @@ enum intel_pt_pkt_state { INTEL_PT_STATE_FUP_NO_TIP, }; +static inline bool intel_pt_sample_time (enum intel_pt_pkt_state pkt_state) +{ +switch (pkt_state) { +case INTEL_PT_STATE_NO_PSB : +case INTEL_PT_STATE_NO_IP : +case INTEL_PT_STATE_ERR_RESYNC : +case INTEL_PT_STATE_IN_SYNC : +case INTEL_PT_STATE_TNT : +return true; +case INTEL_PT_STATE_TIP : +case INTEL_PT_STATE_TIP_PGD : +case INTEL_PT_STATE_FUP : +case INTEL_PT_STATE_FUP_NO_TIP : +return false; +default : +return true; + }; +} +#ifdef INTEL_PT_STRICT #define INTEL_PT_STATE_ERR1 INTEL_PT_STATE_NO_PSB#define INTEL_PT_STATE_ERR2 INTEL_PT_STATE_NO_PSB
@@ -99,6 +118,7 @@ struct intel_pt_decoder {uint64_t timestamp;uint64_t tsc_timestamp;uint64_t ref_timestamp; +uint64_t sample_timestamp;uint64_t ret_addr;uint64_t ctc_timestamp;uint64_t ctc_delta;
@@ -139,6 +159,7 @@ struct intel_pt_decoder {unsigned int fup_tx_flags;unsigned int tx_flags;uint64_t timestamp_insn_cnt; +uint64_t sample_insn_cnt;uint64_t stuck_ip;int no_progress;int stuck_ip_prd;
@@ -898,6 +919,7 @@ static int intel_pt_walk_insn(struct int decoder->tot_insn_cnt += insn_cnt; decoder->timestamp_insn_cnt += insn_cnt; + decoder->sample_insn_cnt += insn_cnt; decoder->period_insn_cnt += insn_cnt;if (err) {
@@ -2067,7 +2089,7 @@ static int intel_pt_sync(struct intel_ptstatic uint64_t intel_pt_est_timestamp (struct intel_pt_decoder *decoder) { -uint64_t est = decoder->timestamp_insn_cnt <<1 ; +uint64_t est = decoder->sample_insn_cnt <<1 ;if (!decoder->cbr || !decoder->max_non_turbo_ratio) goto out;
@@ -2075,7 +2097,7 @@ static uint64_t intel_pt_est_timestamp(s est *= decoder->max_non_turbo_ratio; est /= decoder->cbr; out: -return decoder->timestamp + est; +return decoder->sample_timestamp + est; }const struct intel_pt_state *intel_pt_decode (struct intel_pt_decoder *decoder)
@@ -2131,11 +2153,17 @@ const struct intel_pt_state *intel_pt_deif (err) { decoder->state.err =intel_pt_ext_err (err); decoder->state.from_ip = decoder->ip; + decoder->sample_timestamp = decoder->timestamp; + decoder->sample_insn_cnt = decoder->timestamp_insn_cnt; }else { decoder->state.err =0 ; +if (intel_pt_sample_time (decoder->pkt_state)) { + decoder->sample_timestamp = decoder->timestamp; + decoder->sample_insn_cnt = decoder->timestamp_insn_cnt; + } } - decoder->state.timestamp = decoder->timestamp; + decoder->state.timestamp = decoder->sample_timestamp; decoder->state.est_timestamp =intel_pt_est_timestamp (decoder); decoder->state.cr3 = decoder->cr3; decoder->state.tot_insn_cnt = decoder->tot_insn_cnt;
Greg Kroah-Hartman
maintainerPATCH 20/125 perf intel-pt: Fix missing stack clear
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <[email protected]>
commit 12b7080609097753fd8198cc1daf589be3ec1cca upstream.
The return compression stack must be cleared whenever there is a PSB. Fix one case where that was not happening.
--- tools/perf/util/intel-pt-decoder/intel-pt-decoder.c | 1 + 1 file changed, 1 insertion(+)
tools/perf/util/intel-pt-decoder/intel-pt-decoder.c +1 -0
@@ -1930,6 +1930,7 @@ static int intel_pt_walk_to_ip(struct inbreak ;case INTEL_PT_PSB : +intel_pt_clear_stack (&decoder->stack); err =intel_pt_walk_psb (decoder);if (err)return err;
Greg Kroah-Hartman
maintainerPATCH 21/125 perf intel-pt: Ensure IP is zero when state is INTEL_PT_STATE_NO_IP
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <[email protected]>
commit ad7167a8cd174ba7d8c0d0ed8d8410521206d104 upstream.
A value of zero is used to indicate that there is no IP. Ensure the value is zero when the state is INTEL_PT_STATE_NO_IP.
--- tools/perf/util/intel-pt-decoder/intel-pt-decoder.c | 1 + 1 file changed, 1 insertion(+)
tools/perf/util/intel-pt-decoder/intel-pt-decoder.c +1 -0
@@ -2115,6 +2115,7 @@ const struct intel_pt_state *intel_pt_debreak ;case INTEL_PT_STATE_NO_IP : decoder->last_ip =0 ; + decoder->ip =0 ;/* Fall through */ case INTEL_PT_STATE_ERR_RESYNC : err =intel_pt_sync_ip (decoder);
Greg Kroah-Hartman
maintainerPATCH 22/125 perf intel-pt: Fix last_ip usage
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <[email protected]>
commit ee14ac0ef6827cd6f9a572cc83dd0191ea17812c upstream.
Intel PT uses IP compression based on the last IP. For decoding purposes, 'last IP' is considered to be reset to zero whenever there is a synchronization packet (PSB). The decoder wasn't doing that, and was treating the zero value to mean that there was no last IP, whereas compression can be done against the zero value. Fix by setting last_ip to zero when a PSB is received and keep track of have_last_ip.
--- tools/perf/util/intel-pt-decoder/intel-pt-decoder.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
tools/perf/util/intel-pt-decoder/intel-pt-decoder.c +11 -2
@@ -111,6 +111,7 @@ struct intel_pt_decoder {bool have_tma;bool have_cyc;bool fixup_last_mtc; +bool have_last_ip;uint64_t pos;uint64_t last_ip;uint64_t ip;
@@ -419,6 +420,7 @@ static uint64_t intel_pt_calc_ip(const sstatic inline void intel_pt_set_last_ip (struct intel_pt_decoder *decoder) { decoder->last_ip =intel_pt_calc_ip (&decoder->packet, decoder->last_ip); + decoder->have_last_ip = true; }static inline void intel_pt_set_ip (struct intel_pt_decoder *decoder)
@@ -1670,6 +1672,8 @@ next:break ;case INTEL_PT_PSB : + decoder->last_ip =0 ; + decoder->have_last_ip = true;intel_pt_clear_stack (&decoder->stack); err =intel_pt_walk_psbend (decoder);if (err == -EAGAIN )
@@ -1750,7 +1754,7 @@ next:static inline bool intel_pt_have_ip (struct intel_pt_decoder *decoder) { -return decoder->last_ip || decoder->packet.count ==0 || +return decoder->have_last_ip || decoder->packet.count ==0 || decoder->packet.count ==3 || decoder->packet.count ==6 ; }
@@ -1880,7 +1884,7 @@ static int intel_pt_walk_to_ip(struct inif (decoder->ip)return 0 ; } -if (decoder->packet.count) +if (decoder->packet.count && decoder->have_last_ip)intel_pt_set_last_ip (decoder);break ;
@@ -1930,6 +1934,8 @@ static int intel_pt_walk_to_ip(struct inbreak ;case INTEL_PT_PSB : + decoder->last_ip =0 ; + decoder->have_last_ip = true;intel_pt_clear_stack (&decoder->stack); err =intel_pt_walk_psb (decoder);if (err)
@@ -2064,6 +2070,7 @@ static int intel_pt_sync(struct intel_pt decoder->pge = false; decoder->continuous_period = false; + decoder->have_last_ip = false; decoder->last_ip =0 ; decoder->ip =0 ;intel_pt_clear_stack (&decoder->stack);
@@ -2072,6 +2079,7 @@ static int intel_pt_sync(struct intel_ptif (err)return err; + decoder->have_last_ip = true; decoder->pkt_state =INTEL_PT_STATE_NO_IP ; err =intel_pt_walk_psb (decoder);
@@ -2114,6 +2122,7 @@ const struct intel_pt_state *intel_pt_de err =intel_pt_sync (decoder);break ;case INTEL_PT_STATE_NO_IP : + decoder->have_last_ip = false; decoder->last_ip =0 ; decoder->ip =0 ;/* Fall through */
Greg Kroah-Hartman
maintainerPATCH 23/125 perf intel-pt: Ensure never to set last_ip when packet count is zero
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <[email protected]>
commit f952eaceb089b691eba7c4e13686e742a8f26bf5 upstream.
Intel PT uses IP compression based on the last IP. For decoding purposes, 'last IP' is not updated when a branch target has been suppressed, which is indicated by IPBytes == 0. IPBytes is stored in the packet 'count', so ensure never to set 'last_ip' when packet 'count' is zero.
--- tools/perf/util/intel-pt-decoder/intel-pt-decoder.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
tools/perf/util/intel-pt-decoder/intel-pt-decoder.c +5 -3
@@ -1468,7 +1468,8 @@ static int intel_pt_walk_psbend(struct icase INTEL_PT_FUP : decoder->pge = true; -intel_pt_set_last_ip (decoder); +if (decoder->packet.count) +intel_pt_set_last_ip (decoder);break ;case INTEL_PT_MODE_TSX :
@@ -1754,8 +1755,9 @@ next:static inline bool intel_pt_have_ip (struct intel_pt_decoder *decoder) { -return decoder->have_last_ip || decoder->packet.count ==0 || - decoder->packet.count ==3 || decoder->packet.count ==6 ; +return decoder->packet.count && + (decoder->have_last_ip || decoder->packet.count ==3 || + decoder->packet.count ==6 ); }/* Walk PSB+ packets to get in sync. */
Greg Kroah-Hartman
maintainerPATCH 24/125 perf intel-pt: Use FUP always when scanning for an IP
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <[email protected]>
commit 622b7a47b843c78626f40c1d1aeef8483383fba2 upstream.
The decoder will try to use branch packets to find an IP to start decoding or to recover from errors. Currently the FUP packet is used only in the case of an overflow, however there is no reason for that to be a special case. So just use FUP always when scanning for an IP.
--- tools/perf/util/intel-pt-decoder/intel-pt-decoder.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-)
tools/perf/util/intel-pt-decoder/intel-pt-decoder.c +4 -8
@@ -1880,14 +1880,10 @@ static int intel_pt_walk_to_ip(struct inbreak ;case INTEL_PT_FUP : -if (decoder->overflow) { -if (intel_pt_have_ip (decoder)) -intel_pt_set_ip (decoder); -if (decoder->ip) -return 0 ; - } -if (decoder->packet.count && decoder->have_last_ip) -intel_pt_set_last_ip (decoder); +if (intel_pt_have_ip (decoder)) +intel_pt_set_ip (decoder); +if (decoder->ip) +return 0 ;break ;case INTEL_PT_MTC :
Greg Kroah-Hartman
maintainerPATCH 25/125 perf intel-pt: Clear FUP flag on error
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <[email protected]>
commit 6a558f12dbe85437acbdec5e149ea07b5554eced upstream.
Sometimes a FUP packet is associated with a TSX transaction and a flag is set to indicate that. Ensure that flag is cleared on any error condition because at that point the decoder can no longer assume it is correct.
--- tools/perf/util/intel-pt-decoder/intel-pt-decoder.c | 2 ++ 1 file changed, 2 insertions(+)
tools/perf/util/intel-pt-decoder/intel-pt-decoder.c +2 -0
@@ -1960,6 +1960,8 @@ static int intel_pt_sync_ip(struct intel {int err; + decoder->set_fup_tx_flags = false; +intel_pt_log ("Scanning for full IP\n" ); err =intel_pt_walk_to_ip (decoder);if (err)
Greg Kroah-Hartman
maintainerPATCH 26/125 Bluetooth: use constant time memory comparison for secret values
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason A. Donenfeld <[email protected]>
commit 329d82309824ff1082dc4a91a5bbed8c3bec1580 upstream.
This file is filled with complex cryptography. Thus, the comparisons of MACs and secret keys and curve points and so forth should not add timing attacks, which could either result in a direct forgery, or, given the complexity, some other type of attack.
--- net/bluetooth/smp.c | 35 ++++++++++++++++++----------------- 1 file changed, 18 insertions(+), 17 deletions(-)
net/bluetooth/smp.c +18 -17
@@ -23,6 +23,7 @@#include <linux/debugfs.h> #include <linux/scatterlist.h> #include <linux/crypto.h> +#include <crypto/algapi.h> #include <crypto/b128ops.h> #include <crypto/hash.h>
@@ -506,7 +507,7 @@ bool smp_irk_matches(struct hci_dev *hdeif (err)return false; -return !memcmp (bdaddr->b, hash,3 ); +return !crypto_memneq (bdaddr->b, hash,3 ); }int smp_generate_rpa (struct hci_dev *hdev,const u8 irk[16 ],bdaddr_t *rpa)
@@ -559,7 +560,7 @@ int smp_generate_oob(struct hci_dev *hde/* This is unlikely, but we need to check that * we didn't accidentially generate a debug key. */ -if (memcmp (smp->local_sk, debug_sk,32 )) +if (crypto_memneq (smp->local_sk, debug_sk,32 ))break ; } smp->debug_key = false;
@@ -973,7 +974,7 @@ static u8 smp_random(struct smp_chan *smif (ret)return SMP_UNSPECIFIED ; -if (memcmp (smp->pcnf, confirm,sizeof (smp->pcnf)) !=0 ) { +if (crypto_memneq (smp->pcnf, confirm,sizeof (smp->pcnf))) {BT_ERR ("Pairing failed (confirmation values mismatch)" );return SMP_CONFIRM_FAILED ; }
@@ -1473,7 +1474,7 @@ static u8 sc_passkey_round(struct smp_ch smp->rrnd, r, cfm))return SMP_UNSPECIFIED ; -if (memcmp (smp->pcnf, cfm,16 )) +if (crypto_memneq (smp->pcnf, cfm,16 ))return SMP_CONFIRM_FAILED ; smp->passkey_round++;
@@ -1857,7 +1858,7 @@ static u8 sc_send_public_key(struct smp_/* This is unlikely, but we need to check that * we didn't accidentially generate a debug key. */ -if (memcmp (smp->local_sk, debug_sk,32 )) +if (crypto_memneq (smp->local_sk, debug_sk,32 ))break ; } }
@@ -2122,7 +2123,7 @@ static u8 smp_cmd_pairing_random(structif (err)return SMP_UNSPECIFIED ; -if (memcmp (smp->pcnf, cfm,16 )) +if (crypto_memneq (smp->pcnf, cfm,16 ))return SMP_CONFIRM_FAILED ; }else { smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd),
@@ -2603,7 +2604,7 @@ static int smp_cmd_public_key(struct l2cif (err)return SMP_UNSPECIFIED ; -if (memcmp (cfm.confirm_val, smp->pcnf,16 )) +if (crypto_memneq (cfm.confirm_val, smp->pcnf,16 ))return SMP_CONFIRM_FAILED ; }
@@ -2636,7 +2637,7 @@ static int smp_cmd_public_key(struct l2celse hcon->pending_sec_level =BT_SECURITY_FIPS ; -if (!memcmp (debug_pk, smp->remote_pk,64 )) +if (!crypto_memneq (debug_pk, smp->remote_pk,64 ))set_bit (SMP_FLAG_DEBUG_KEY , &smp->flags);if (smp->method ==DSP_PASSKEY ) {
@@ -2735,7 +2736,7 @@ static int smp_cmd_dhkey_check(struct l2if (err)return SMP_UNSPECIFIED ; -if (memcmp (check->e, e,16 )) +if (crypto_memneq (check->e, e,16 ))return SMP_DHKEY_CHECK_FAILED ;if (!hcon->out) {
@@ -3446,7 +3447,7 @@ static int __init test_ah(struct crypto_if (err)return err; -if (memcmp (res, exp,3 )) +if (crypto_memneq (res, exp,3 ))return -EINVAL ;return 0 ;
@@ -3476,7 +3477,7 @@ static int __init test_c1(struct crypto_if (err)return err; -if (memcmp (res, exp,16 )) +if (crypto_memneq (res, exp,16 ))return -EINVAL ;return 0 ;
@@ -3501,7 +3502,7 @@ static int __init test_s1(struct crypto_if (err)return err; -if (memcmp (res, exp,16 )) +if (crypto_memneq (res, exp,16 ))return -EINVAL ;return 0 ;
@@ -3533,7 +3534,7 @@ static int __init test_f4(struct crypto_if (err)return err; -if (memcmp (res, exp,16 )) +if (crypto_memneq (res, exp,16 ))return -EINVAL ;return 0 ;
@@ -3567,10 +3568,10 @@ static int __init test_f5(struct crypto_if (err)return err; -if (memcmp (mackey, exp_mackey,16 )) +if (crypto_memneq (mackey, exp_mackey,16 ))return -EINVAL ; -if (memcmp (ltk, exp_ltk,16 )) +if (crypto_memneq (ltk, exp_ltk,16 ))return -EINVAL ;return 0 ;
@@ -3603,7 +3604,7 @@ static int __init test_f6(struct crypto_if (err)return err; -if (memcmp (res, exp,16 )) +if (crypto_memneq (res, exp,16 ))return -EINVAL ;return 0 ;
@@ -3657,7 +3658,7 @@ static int __init test_h6(struct crypto_if (err)return err; -if (memcmp (res, exp,16 )) +if (crypto_memneq (res, exp,16 ))return -EINVAL ;return 0 ;
Greg Kroah-Hartman
maintainerPATCH 27/125 wlcore: fix 64K page support
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
commit 4a4274bf2dbbd1c7a45be0c89a1687c9d2eef4a0 upstream.
In the stable linux-3.16 branch, I ran into a warning in the wlcore driver:
drivers/net/wireless/ti/wlcore/spi.c: In function 'wl12xx_spi_raw_write':drivers/net/wireless/ti/wlcore/spi.c:315:1: error: the frame size of 12848 bytes is larger than 2048 bytes [-Werror=frame-larger-than=]
Newer kernels no longer show the warning, but the bug is still there, as the allocation is based on the CPU page size rather than the actual capabilities of the hardware.
This replaces the PAGE_SIZE macro with the SZ_4K macro, i.e. 4096 bytes per buffer.
--- drivers/net/wireless/ti/wlcore/spi.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/wireless/ti/wlcore/spi.c +3 -3
@@ -70,10 +70,10 @@#define WSPI_MAX_CHUNK_SIZE 4092/* -* wl18xx driver aggregation buffer size is (13 * PAGE_SIZE) compared to -* (4 * PAGE_SIZE) for wl12xx, so use the larger buffer needed for wl18xx +* wl18xx driver aggregation buffer size is (13 * 4K) compared to +* (4 * 4K) for wl12xx, so use the larger buffer needed for wl18xx */ -#define SPI_AGGR_BUFFER_SIZE (13 * PAGE_SIZE) +#define SPI_AGGR_BUFFER_SIZE (13 * SZ_4K)/* Maximum number of SPI write chunks */ #define WSPI_MAX_NUM_OF_CHUNKS \
Greg Kroah-Hartman
maintainerPATCH 28/125 btrfs: Dont clear SGID when inheriting ACLs
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
commit b7f8a09f8097db776b8d160862540e4fc1f51296 upstream.
When new directory 'DIR1' is created in a directory 'DIR0' with SGID bit set, DIR1 is expected to have SGID bit set (and owning group equal to the owning group of 'DIR0'). However when 'DIR0' also has some default ACLs that 'DIR1' inherits, setting these ACLs will result in SGID bit on 'DIR1' to get cleared if user is not member of the owning group.
Fix the problem by moving posix_acl_update_mode() out of __btrfs_set_acl() into btrfs_set_acl(). That way the function will not be called when inheriting ACLs which is what we want as it prevents SGID bit clearing and the mode has been properly set by posix_acl_create() anyway.
--- fs/btrfs/acl.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
fs/btrfs/acl.c +7 -6
@@ -78,12 +78,6 @@ static int __btrfs_set_acl(struct btrfs_switch (type) {case ACL_TYPE_ACCESS : name =XATTR_NAME_POSIX_ACL_ACCESS ; -if (acl) { - ret =posix_acl_update_mode (inode, &inode->i_mode, &acl); -if (ret) -return ret; - } - ret =0 ;break ;case ACL_TYPE_DEFAULT :if (!S_ISDIR (inode->i_mode))
@@ -119,6 +113,13 @@ out:int btrfs_set_acl (struct inode *inode,struct posix_acl *acl,int type) { +int ret; + +if (type ==ACL_TYPE_ACCESS && acl) { + ret =posix_acl_update_mode (inode, &inode->i_mode, &acl); +if (ret) +return ret; + }return __btrfs_set_acl (NULL , inode, acl, type); }
Greg Kroah-Hartman
maintainerPATCH 29/125 igb: Explicitly select page 0 at initialization
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matwey V Kornilov <[email protected]>
commit 440aeca4b9858248d8f16d724d9fa87a4f65fa33 upstream.
The functions igb_read_phy_reg_gs40g/igb_write_phy_reg_gs40g (which were removed in 2a3cdea) explicitly selected the required page at every phy_reg access. Currently, igb_get_phy_id_82575 relays on the fact that page 0 is already selected. The assumption is not fulfilled for my Lex 3I380CW motherboard with integrated dual i211 based gigabit ethernet. This leads to igb initialization failure and network interfaces are not working:
igb: Intel(R) Gigabit Ethernet Network Driver - version 5.4.0-k
igb: Copyright (c) 2007-2014 Intel Corporation.
igb: probe of 0000:01:00.0 failed with error -2
igb: probe of 0000:02:00.0 failed with error -2In order to fix it, we explicitly select page 0 before first access to phy registers.
See also: https://bugzilla.suse.com/show_bug.cgi?id=1009911
See also: http://www.lex.com.tw/products/pdf/3I380A&3I380CW.pdf
--- drivers/net/ethernet/intel/igb/e1000_82575.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/intel/igb/e1000_82575.c +1 -0
@@ -246,6 +246,7 @@ static s32 igb_init_phy_params_82575(strE1000_STATUS_FUNC_SHIFT ;/* Set phy->phy_addr and phy->id. */ +igb_write_phy_reg_82580 (hw,I347AT4_PAGE_SELECT ,0 ); ret_val =igb_get_phy_id_82575 (hw);if (ret_val)return ret_val;
Greg Kroah-Hartman
maintainerPATCH 30/125 ASoC: compress: Derive substream from stream based on direction
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Satish Babu Patakokila <[email protected]>
commit 01b8cedfd0422326caae308641dcadaa85e0ca72 upstream.
Currently compress driver hardcodes direction as playback to get substream from the stream. This results in getting the incorrect substream for compressed capture usecase.
To fix this, remove the hardcoding and derive substream based on the stream direction.
--- sound/soc/soc-compress.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
sound/soc/soc-compress.c +4 -2
@@ -68,7 +68,8 @@ out:static int soc_compr_open_fe (struct snd_compr_stream *cstream) {struct snd_soc_pcm_runtime *fe = cstream->private_data; -struct snd_pcm_substream *fe_substream = fe->pcm->streams[0 ].substream; +struct snd_pcm_substream *fe_substream = + fe->pcm->streams[cstream->direction].substream;struct snd_soc_platform *platform = fe->platform;struct snd_soc_dpcm *dpcm;struct snd_soc_dapm_widget_list *list;
@@ -414,7 +415,8 @@ static int soc_compr_set_params_fe(struc struct snd_compr_params *params) {struct snd_soc_pcm_runtime *fe = cstream->private_data; -struct snd_pcm_substream *fe_substream = fe->pcm->streams[0 ].substream; +struct snd_pcm_substream *fe_substream = + fe->pcm->streams[cstream->direction].substream;struct snd_soc_platform *platform = fe->platform;int ret =0 , stream;
Greg Kroah-Hartman
maintainerPATCH 31/125 PM / Domains: Fix unsafe iteration over modified list of device links
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
commit c6e83cac3eda5f7dd32ee1453df2f7abb5c6cd46 upstream.
pm_genpd_remove_subdomain() iterates over domain's master_links list and removes matching element thus it has to use safe version of list iteration.
--- drivers/base/power/domain.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/base/power/domain.c +2 -2
@@ -1244,7 +1244,7 @@ EXPORT_SYMBOL_GPL(pm_genpd_add_subdomainint pm_genpd_remove_subdomain (struct generic_pm_domain *genpd,struct generic_pm_domain *subdomain) { -struct gpd_link *link; +struct gpd_link *l, *link;int ret = -EINVAL ;if (IS_ERR_OR_NULL (genpd) ||IS_ERR_OR_NULL (subdomain))
@@ -1260,7 +1260,7 @@ int pm_genpd_remove_subdomain(struct gen goto out; } -list_for_each_entry (link, &genpd->master_links, master_node) { +list_for_each_entry_safe (link, l, &genpd->master_links, master_node) {if (link->slave != subdomain)continue ;
Greg Kroah-Hartman
maintainerPATCH 32/125 PM / Domains: Fix unsafe iteration over modified list of domain providers
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
commit b556b15dc04e9b9b98790f04c21acf5e24f994b2 upstream.
of_genpd_del_provider() iterates over list of domain provides and removes matching element thus it has to use safe version of list iteration.
--- drivers/base/power/domain.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/base/power/domain.c +2 -2
@@ -1607,12 +1607,12 @@ EXPORT_SYMBOL_GPL(of_genpd_add_provider_*/ void of_genpd_del_provider (struct device_node *np) { -struct of_genpd_provider *cp; +struct of_genpd_provider *cp, *tmp;struct generic_pm_domain *gpd;mutex_lock (&gpd_list_lock);mutex_lock (&of_genpd_mutex); -list_for_each_entry (cp, &of_genpd_providers, link) { +list_for_each_entry_safe (cp, tmp, &of_genpd_providers, link) {if (cp->node == np) {/* * For each PM domain associated with the
Greg Kroah-Hartman
maintainerPATCH 33/125 PM / Domains: Fix unsafe iteration over modified list of domains
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
commit a7e2d1bce4c1db471f1cbc0c4666a3112bbf0994 upstream.
of_genpd_remove_last() iterates over list of domains and removes matching element thus it has to use safe version of list iteration.
--- drivers/base/power/domain.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/base/power/domain.c +2 -2
@@ -1752,14 +1752,14 @@ EXPORT_SYMBOL_GPL(of_genpd_add_subdomain*/ struct generic_pm_domain *of_genpd_remove_last (struct device_node *np) { -struct generic_pm_domain *gpd, *genpd =ERR_PTR (-ENOENT ); +struct generic_pm_domain *gpd, *tmp, *genpd =ERR_PTR (-ENOENT );int ret;if (IS_ERR_OR_NULL (np))return ERR_PTR (-EINVAL );mutex_lock (&gpd_list_lock); -list_for_each_entry (gpd, &gpd_list, gpd_list_node) { +list_for_each_entry_safe (gpd, tmp, &gpd_list, gpd_list_node) {if (gpd->provider == &np->fwnode) { ret =genpd_remove (gpd); genpd = ret ?ERR_PTR (ret) : gpd;
Greg Kroah-Hartman
maintainerPATCH 34/125 scsi: ses: do not add a device to an enclosure if enclosure_add_links() fails.
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maurizio Lombardi <[email protected]>
commit 62e62ffd95539b9220894a7900a619e0f3ef4756 upstream.
The enclosure_add_device() function should fail if it can't create the relevant sysfs links.
--- drivers/misc/enclosure.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
drivers/misc/enclosure.c +10 -4
@@ -375,6 +375,7 @@ int enclosure_add_device(struct enclosur struct device *dev) {struct enclosure_component *cdev; +int err;if (!edev || component >= edev->components)return -EINVAL ;
@@ -384,12 +385,17 @@ int enclosure_add_device(struct enclosurif (cdev->dev == dev)return -EEXIST ; -if (cdev->dev) +if (cdev->dev) {enclosure_remove_links (cdev); - -put_device (cdev->dev); +put_device (cdev->dev); + } cdev->dev =get_device (dev); -return enclosure_add_links (cdev); + err =enclosure_add_links (cdev); +if (err) { +put_device (cdev->dev); + cdev->dev =NULL ; + } +return err; }EXPORT_SYMBOL_GPL (enclosure_add_device);
Greg Kroah-Hartman
maintainerPATCH 35/125 scsi: Add STARGET_CREATED_REMOVE state to scsi_target_state
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ewan D. Milne <[email protected]>
commit f9279c968c257ee39b0d7bd2571a4d231a67bcc1 upstream.
The addition of the STARGET_REMOVE state had the side effect of introducing a race condition that can cause a crash.
scsi_target_reap_ref_release() checks the starget->state to see if it still in STARGET_CREATED, and if so, skips calling transport_remove_device() and device_del(), because the starget->state is only set to STARGET_RUNNING after scsi_target_add() has called device_add() and transport_add_device().
However, if an rport loss occurs while a target is being scanned, it can happen that scsi_remove_target() will be called while the starget is still in the STARGET_CREATED state. In this case, the starget->state will be set to STARGET_REMOVE, and as a result, scsi_target_reap_ref_release() will take the wrong path. The end result is a panic:
[ 1255.356653] Oops: 0000 [#1] SMP [ 1255.360154] Modules linked in: x86_pkg_temp_thermal kvm_intel kvm irqbypass crc32c_intel ghash_clmulni_i [ 1255.393234] CPU: 5 PID: 149 Comm: kworker/u96:4 Tainted: G W 4.11.0+ #8 [ 1255.401879] Hardware name: Dell Inc. PowerEdge R320/08VT7V, BIOS 2.0.22 11/19/2013 [ 1255.410327] Workqueue: scsi_wq_6 fc_scsi_scan_rport [scsi_transport_fc] [ 1255.417720] task: ffff88060ca8c8c0 task.stack: ffffc900048a8000 [ 1255.424331] RIP: 0010:kernfs_find_ns+0x13/0xc0 [ 1255.429287] RSP: 0018:ffffc900048abbf0 EFLAGS: 00010246 [ 1255.435123] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 1255.443083] RDX: 0000000000000000 RSI: ffffffff8188d659 RDI: 0000000000000000 [ 1255.451043] RBP: ffffc900048abc10 R08: 0000000000000000 R09: 0000012433fe0025 [ 1255.459005] R10: 0000000025e5a4b5 R11: 0000000025e5a4b5 R12: ffffffff8188d659 [ 1255.466972] R13: 0000000000000000 R14: ffff8805f55e5088 R15: 0000000000000000 [ 1255.474931] FS: 0000000000000000(0000) GS:ffff880616b40000(0000) knlGS:0000000000000000 [ 1255.483959] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1255.490370] CR2: 0000000000000068 CR3: 0000000001c09000 CR4: 00000000000406e0 [ 1255.498332] Call Trace: [ 1255.501058] kernfs_find_and_get_ns+0x31/0x60 [ 1255.505916] sysfs_unmerge_group+0x1d/0x60 [ 1255.510498] dpm_sysfs_remove+0x22/0x60 [ 1255.514783] device_del+0xf4/0x2e0 [ 1255.518577] ? device_remove_file+0x19/0x20 [ 1255.523241] attribute_container_class_device_del+0x1a/0x20 [ 1255.529457] transport_remove_classdev+0x4e/0x60 [ 1255.534607] ? transport_add_class_device+0x40/0x40 [ 1255.540046] attribute_container_device_trigger+0xb0/0xc0 [ 1255.546069] transport_remove_device+0x15/0x20 [ 1255.551025] scsi_target_reap_ref_release+0x25/0x40 [ 1255.556467] scsi_target_reap+0x2e/0x40 [ 1255.560744] __scsi_scan_target+0xaa/0x5b0 [ 1255.565312] scsi_scan_target+0xec/0x100 [ 1255.569689] fc_scsi_scan_rport+0xb1/0xc0 [scsi_transport_fc] [ 1255.576099] process_one_work+0x14b/0x390 [ 1255.580569] worker_thread+0x4b/0x390 [ 1255.584651] kthread+0x109/0x140 [ 1255.588251] ? rescuer_thread+0x330/0x330 [ 1255.592730] ? kthread_park+0x60/0x60 [ 1255.596815] ret_from_fork+0x29/0x40 [ 1255.600801] Code: 24 08 48 83 42 40 01 5b 41 5c 5d c3 66 66 66 2e 0f 1f 84 00 00 00 00 00 66 66 66 66 90 [ 1255.621876] RIP: kernfs_find_ns+0x13/0xc0 RSP: ffffc900048abbf0 [ 1255.628479] CR2: 0000000000000068 [ 1255.632756] ---[ end trace 34a69ba0477d036f ]---
Fix this by adding another scsi_target state STARGET_CREATED_REMOVE to distinguish this case.
--- drivers/scsi/scsi_scan.c | 5 +++-- drivers/scsi/scsi_sysfs.c | 8 ++++++-- include/scsi/scsi_device.h | 1 + 3 files changed, 10 insertions(+), 4 deletions(-)
drivers/scsi/scsi_scan.c +3 -2
@@ -384,11 +384,12 @@ static void scsi_target_reap_ref_release = container_of(kref, struct scsi_target, reap_ref);/* -* if we get here and the target is still in the CREATED state that +* if we get here and the target is still in a CREATED state that * means it was allocated but never made visible (because a scan * turned up no LUNs), so don't call device_del() on it. */ -if (starget->state !=STARGET_CREATED ) { +if ((starget->state !=STARGET_CREATED ) && + (starget->state !=STARGET_CREATED_REMOVE )) {transport_remove_device (&starget->dev);device_del (&starget->dev); }
drivers/scsi/scsi_sysfs.c +6 -2
@@ -1370,11 +1370,15 @@ restart:spin_lock_irqsave (shost->host_lock, flags);list_for_each_entry (starget, &shost->__targets, siblings) {if (starget->state ==STARGET_DEL || - starget->state ==STARGET_REMOVE ) + starget->state ==STARGET_REMOVE || + starget->state ==STARGET_CREATED_REMOVE )continue ;if (starget->dev.parent == dev || &starget->dev == dev) {kref_get (&starget->reap_ref); - starget->state =STARGET_REMOVE ; +if (starget->state ==STARGET_CREATED ) + starget->state =STARGET_CREATED_REMOVE ; +else + starget->state =STARGET_REMOVE ;spin_unlock_irqrestore (shost->host_lock, flags);__scsi_remove_target (starget);scsi_target_reap (starget);
include/scsi/scsi_device.h +1 -0
@@ -248,6 +248,7 @@ enum scsi_target_state {STARGET_CREATED =1 ,STARGET_RUNNING ,STARGET_REMOVE , +STARGET_CREATED_REMOVE , STARGET_DEL, };
Greg Kroah-Hartman
maintainerPATCH 36/125 iscsi-target: Add login_keys_workaround attribute for non RFC initiators
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Bellinger <[email protected]>
commit 138d351eefb727ab9e41a3dc5f112ceb4f6e59f2 upstream.
This patch re-introduces part of a long standing login workaround that was recently dropped by:
commit 1c99de981f30b3e7868b8d20ce5479fa1c0fea46
Author: Nicholas Bellinger <[email protected]>
Date: Sun Apr 2 13:36:44 2017 -0700
iscsi-target: Drop work-around for legacy GlobalSAN initiator
Namely, the workaround for FirstBurstLength ended up being required by Mellanox Flexboot PXE boot ROMs as reported by Robert.
So this patch re-adds the work-around for FirstBurstLength within iscsi_check_proposer_for_optional_reply(), and makes the key optional to respond when the initiator does not propose, nor respond to it.
Also as requested by Arun, this patch introduces a new TPG attribute named 'login_keys_workaround' that controls the use of both the FirstBurstLength workaround, as well as the two other existing workarounds for gPXE iSCSI boot client.
By default, the workaround is enabled with login_keys_workaround=1, since Mellanox FlexBoot requires it, and Arun has verified the Qlogic MSFT initiator already proposes FirstBurstLength, so it's uneffected by this re-adding this part of the original work-around.
--- drivers/target/iscsi/iscsi_target_configfs.c | 2 + drivers/target/iscsi/iscsi_target_nego.c | 6 ++- drivers/target/iscsi/iscsi_target_parameters.c | 41 +++++++++++++++++-------- drivers/target/iscsi/iscsi_target_parameters.h | 2 - drivers/target/iscsi/iscsi_target_tpg.c | 19 +++++++++++ drivers/target/iscsi/iscsi_target_tpg.h | 1 include/target/iscsi/iscsi_target_core.h | 9 +++++ 7 files changed, 64 insertions(+), 16 deletions(-)
drivers/target/iscsi/iscsi_target_configfs.c +2 -0
@@ -802,6 +802,7 @@ DEF_TPG_ATTRIB(default_erl);DEF_TPG_ATTRIB (t10_pi);DEF_TPG_ATTRIB (fabric_prot_type);DEF_TPG_ATTRIB (tpg_enabled_sendtargets); +DEF_TPG_ATTRIB (login_keys_workaround);static struct configfs_attribute *lio_target_tpg_attrib_attrs[] = { &iscsi_tpg_attrib_attr_authentication,
@@ -817,6 +818,7 @@ static struct configfs_attribute *lio_ta &iscsi_tpg_attrib_attr_t10_pi, &iscsi_tpg_attrib_attr_fabric_prot_type, &iscsi_tpg_attrib_attr_tpg_enabled_sendtargets, + &iscsi_tpg_attrib_attr_login_keys_workaround, NULL, };
drivers/target/iscsi/iscsi_target_nego.c +4 -2
@@ -819,7 +819,8 @@ static int iscsi_target_handle_csg_zero(SENDER_TARGET , login->rsp_buf, &login->rsp_length, - conn->param_list); + conn->param_list, + conn->tpg->tpg_attrib.login_keys_workaround);if (ret <0 )return -1 ;
@@ -889,7 +890,8 @@ static int iscsi_target_handle_csg_one(sSENDER_TARGET , login->rsp_buf, &login->rsp_length, - conn->param_list); + conn->param_list, + conn->tpg->tpg_attrib.login_keys_workaround);if (ret <0 ) {iscsit_tx_login_rsp (conn,ISCSI_STATUS_CLS_INITIATOR_ERR ,ISCSI_LOGIN_STATUS_INIT_ERR );
drivers/target/iscsi/iscsi_target_parameters.c +28 -13
68 lines not on this page · raw message
drivers/target/iscsi/iscsi_target_parameters.h +1 -1
@@ -40,7 +40,7 @@ extern int iscsi_extract_key_value(charextern int iscsi_update_param_value (struct iscsi_param *,char *);extern int iscsi_decode_text_input (u8 ,u8 ,char *,u32 ,struct iscsi_conn *);extern int iscsi_encode_text_output (u8 ,u8 ,char *,u32 *, -struct iscsi_param_list *); +struct iscsi_param_list *,bool );extern int iscsi_check_negotiated_keys (struct iscsi_param_list *);extern void iscsi_set_connection_parameters (struct iscsi_conn_ops *,struct iscsi_param_list *);
drivers/target/iscsi/iscsi_target_tpg.c +19 -0
@@ -227,6 +227,7 @@ static void iscsit_set_default_tpg_attri a->t10_pi =TA_DEFAULT_T10_PI ; a->fabric_prot_type =TA_DEFAULT_FABRIC_PROT_TYPE ; a->tpg_enabled_sendtargets =TA_DEFAULT_TPG_ENABLED_SENDTARGETS ; + a->login_keys_workaround =TA_DEFAULT_LOGIN_KEYS_WORKAROUND ; }int iscsit_tpg_add_portal_group (struct iscsi_tiqn *tiqn,struct iscsi_portal_group *tpg)
@@ -899,3 +900,21 @@ int iscsit_ta_tpg_enabled_sendtargets(return 0 ; } + +int iscsit_ta_login_keys_workaround ( +struct iscsi_portal_group *tpg, +u32 flag) +{ +struct iscsi_tpg_attrib *a = &tpg->tpg_attrib; + +if ((flag !=0 ) && (flag !=1 )) { +pr_err ("Illegal value %d\n" , flag); +return -EINVAL ; + } + + a->login_keys_workaround = flag; +pr_debug ("iSCSI_TPG[%hu] - TPG enabled bit for login keys workaround: %s " , + tpg->tpgt, (a->login_keys_workaround) ?"ON" :"OFF" ); + +return 0 ; +}
drivers/target/iscsi/iscsi_target_tpg.h +1 -0
@@ -39,5 +39,6 @@ extern int iscsit_ta_default_erl(structextern int iscsit_ta_t10_pi (struct iscsi_portal_group *,u32 );extern int iscsit_ta_fabric_prot_type (struct iscsi_portal_group *,u32 );extern int iscsit_ta_tpg_enabled_sendtargets (struct iscsi_portal_group *,u32 ); +extern int iscsit_ta_login_keys_workaround (struct iscsi_portal_group *,u32 );#endif /* ISCSI_TARGET_TPG_H */
include/target/iscsi/iscsi_target_core.h +9 -0
@@ -64,6 +64,14 @@#define TA_DEFAULT_FABRIC_PROT_TYPE 0/* TPG status needs to be enabled to return sendtargets discovery endpoint info */ #define TA_DEFAULT_TPG_ENABLED_SENDTARGETS 1 +/* +* Used to control the sending of keys with optional to respond state bit, +* as a workaround for non RFC compliant initiators,that do not propose, +* nor respond to specific keys required for login to complete. +* +* See iscsi_check_proposer_for_optional_reply() for more details. +*/ +#define TA_DEFAULT_LOGIN_KEYS_WORKAROUND 1#define ISCSI_IOV_DATA_BUFFER 5
@@ -766,6 +774,7 @@ struct iscsi_tpg_attrib {u8 t10_pi;u32 fabric_prot_type;u32 tpg_enabled_sendtargets; +u32 login_keys_workaround;struct iscsi_portal_group *tpg; };
Greg Kroah-Hartman
maintainerPATCH 37/125 xen/scsiback: Fix a TMR related use-after-free
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <[email protected]>
commit 9f4ab18ac51dc87345a9cbd2527e6acf7a0a9335 upstream.
scsiback_release_cmd() must not dereference se_cmd->se_tmr_req because that memory is freed by target_free_cmd_mem() before scsiback_release_cmd() is called. Fix this use-after-free by inlining struct scsiback_tmr into struct vscsibk_pend.
--- drivers/xen/xen-scsiback.c | 33 +++++++++------------------------ 1 file changed, 9 insertions(+), 24 deletions(-)
drivers/xen/xen-scsiback.c +9 -24
@@ -134,9 +134,7 @@ struct vscsibk_pend {struct page *pages[VSCSI_MAX_GRANTS ];struct se_cmd se_cmd; -}; -struct scsiback_tmr {atomic_t tmr_complete;wait_queue_head_t tmr_wait; };
@@ -599,26 +597,20 @@ static void scsiback_device_action(strucstruct scsiback_tpg *tpg = pending_req->v2p->tpg;struct scsiback_nexus *nexus = tpg->tpg_nexus;struct se_cmd *se_cmd = &pending_req->se_cmd; -struct scsiback_tmr *tmr;u64 unpacked_lun = pending_req->v2p->lun;int rc, err =FAILED ; - tmr =kzalloc (sizeof (struct scsiback_tmr ),GFP_KERNEL ); -if (!tmr) { -target_put_sess_cmd (se_cmd); - goto err; - } - -init_waitqueue_head (&tmr->tmr_wait); +init_waitqueue_head (&pending_req->tmr_wait); rc =target_submit_tmr (&pending_req->se_cmd, nexus->tvn_se_sess, &pending_req->sense_buffer[0 ], - unpacked_lun, tmr, act,GFP_KERNEL , + unpacked_lun,NULL , act,GFP_KERNEL , tag,TARGET_SCF_ACK_KREF );if (rc) goto err; -wait_event (tmr->tmr_wait,atomic_read (&tmr->tmr_complete)); +wait_event (pending_req->tmr_wait, +atomic_read (&pending_req->tmr_complete)); err = (se_cmd->se_tmr_req->response ==TMR_FUNCTION_COMPLETE ) ?SUCCESS :FAILED ;
@@ -626,9 +618,8 @@ static void scsiback_device_action(strucscsiback_do_resp_with_sense (NULL , err,0 , pending_req);transport_generic_free_cmd (&pending_req->se_cmd,1 );return ; + err: -if (tmr) -kfree (tmr);scsiback_do_resp_with_sense (NULL , err,0 , pending_req); }
@@ -1389,12 +1380,6 @@ static int scsiback_check_stop_free(strustatic void scsiback_release_cmd (struct se_cmd *se_cmd) {struct se_session *se_sess = se_cmd->se_sess; -struct se_tmr_req *se_tmr = se_cmd->se_tmr_req; - -if (se_tmr && se_cmd->se_cmd_flags &SCF_SCSI_TMR_CDB ) { -struct scsiback_tmr *tmr = se_tmr->fabric_tmr_ptr; -kfree (tmr); - }percpu_ida_free (&se_sess->sess_tag_pool, se_cmd->map_tag); }
@@ -1455,11 +1440,11 @@ static int scsiback_queue_status(structstatic void scsiback_queue_tm_rsp (struct se_cmd *se_cmd) { -struct se_tmr_req *se_tmr = se_cmd->se_tmr_req; -struct scsiback_tmr *tmr = se_tmr->fabric_tmr_ptr; +struct vscsibk_pend *pending_req =container_of (se_cmd, + struct vscsibk_pend, se_cmd); -atomic_set (&tmr->tmr_complete,1 ); -wake_up (&tmr->tmr_wait); +atomic_set (&pending_req->tmr_complete,1 ); +wake_up (&pending_req->tmr_wait); }static void scsiback_aborted_task (struct se_cmd *se_cmd)
Greg Kroah-Hartman
maintainerPATCH 38/125 powerpc/pseries: Fix passing of pp0 in updatepp() and updateboltedpp()
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Balbir Singh <[email protected]>
commit e71ff982ae4c17d176e9f0132157d54973788377 upstream.
Once upon a time there were only two PP (page protection) bits. In ISA 2.03 an additional PP bit was added, but because of the layout of the HPTE it could not be made contiguous with the existing PP bits.
The result is that we now have three PP bits, named pp0, pp1, pp2, where pp0 occupies bit 63 of dword 1 of the HPTE and pp1 and pp2 occupy bits 1 and 0 respectively. Until recently Linux hasn't used pp0, however with the addition of _PAGE_KERNEL_RO we started using it.
The problem arises in the LPAR code, where we need to translate the PP bits into the argument for the H_PROTECT hypercall. Currently the code only passes bits 0-2 of newpp, which covers pp1, pp2 and N (no execute), meaning pp0 is not passed to the hypervisor at all.
We can't simply pass it through in bit 63, as that would collide with a different field in the flags argument, as defined in PAPR. Instead we have to shift it down to bit 8 (IBM bit 55).
--- arch/powerpc/platforms/pseries/lpar.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
arch/powerpc/platforms/pseries/lpar.c +10 -1
@@ -279,7 +279,7 @@ static long pSeries_lpar_hpte_updatepp(u int ssize, unsigned long inv_flags) { unsigned long lpar_rc; -unsigned long flags = (newpp &7 ) |H_AVPN ; +unsigned long flags;unsigned long want_v; want_v =hpte_encode_avpn (vpn, psize, ssize);
@@ -287,6 +287,11 @@ static long pSeries_lpar_hpte_updatepp(upr_devel (" update: avpnv=%016lx, hash=%016lx, f=%lx, psize: %d ..." , want_v, slot, flags, psize); + flags = (newpp &7 ) |H_AVPN ; +if (mmu_has_feature (MMU_FTR_KERNEL_RO )) +/* Move pp0 into bit 8 (IBM 55) */ + flags |= (newpp &HPTE_R_PP0 ) >>55 ; + lpar_rc =plpar_pte_protect (flags, slot, want_v);if (lpar_rc ==H_NOT_FOUND ) {
@@ -358,6 +363,10 @@ static void pSeries_lpar_hpte_updateboltBUG_ON (slot ==-1 ); flags = newpp &7 ; +if (mmu_has_feature (MMU_FTR_KERNEL_RO )) +/* Move pp0 into bit 8 (IBM 55) */ + flags |= (newpp &HPTE_R_PP0 ) >>55 ; + lpar_rc =plpar_pte_protect (flags, slot,0 );BUG_ON (lpar_rc !=H_SUCCESS );
Greg Kroah-Hartman
maintainerPATCH 39/125 powerpc/64: Fix atomic64_inc_not_zero() to return an int
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Ellerman <[email protected]>
commit 01e6a61aceb82e13bec29502a8eb70d9574f97ad upstream.
Although it's not documented anywhere, there is an expectation that atomic64_inc_not_zero() returns a result which fits in an int. This is the behaviour implemented on all arches except powerpc.
This has caused at least one bug in practice, in the percpu-refcount code, where the long result from our atomic64_inc_not_zero() was truncated to an int leading to lost references and stuck systems. That was worked around in that code in commit 966d2b04e070 ("percpu-refcount:
fix reference leak during percpu-atomic transition").
To the best of my grepping abilities there are no other callers in-tree which truncate the value, but we should fix it anyway. Because the breakage is subtle and potentially very harmful I'm also tagging it for stable.
Code generation is largely unaffected because in most cases the callers are just using the result for a test anyway. In particular the case of fget() that was mentioned in commit a6cf7ed5119f ("powerpc/atomic: Implement atomic*_inc_not_zero") generates exactly the same code.
--- arch/powerpc/include/asm/atomic.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/powerpc/include/asm/atomic.h +2 -2
@@ -560,7 +560,7 @@ static __inline__ int atomic64_add_unles* Atomically increments @v by 1, so long as @v is non-zero. * Returns non-zero if @v was non-zero, and zero otherwise. */ -static __inline__long atomic64_inc_not_zero (atomic64_t *v) +static __inline__int atomic64_inc_not_zero (atomic64_t *v) {long t1, t2;
@@ -579,7 +579,7 @@ static __inline__ long atomic64_inc_not_ : "r" (&v->counter) : "cc", "xer", "memory"); - return t1; + return t1 != 0; }#endif /* __powerpc64__ */
Greg Kroah-Hartman
maintainerPATCH 40/125 powerpc: Fix emulation of mcrf in emulate_step()
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anton Blanchard <[email protected]>
commit 87c4b83e0fe234a1f0eed131ab6fa232036860d5 upstream.
The mcrf emulation code was using the CR field number directly as the shift value, without taking into account that CR fields are numbered from 0-7 starting at the high bits. That meant it was looking at the CR fields in the reverse order.
--- arch/powerpc/lib/sstep.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
arch/powerpc/lib/sstep.c +4 -2
@@ -687,8 +687,10 @@ int __kprobes analyse_instr(struct instrcase 19 :switch ((instr >>1 ) &0x3ff ) {case 0 :/* mcrf */ - rd = (instr >>21 ) &0x1c ; - ra = (instr >>16 ) &0x1c ; + rd =7 - ((instr >>23 ) &0x7 ); + ra =7 - ((instr >>18 ) &0x7 ); + rd *=4 ; + ra *=4 ; val = (regs->ccr >> ra) &0xf ; regs->ccr = (regs->ccr & ~(0xfUL << rd)) | (val << rd); goto instr_done;
Greg Kroah-Hartman
maintainerPATCH 41/125 powerpc: Fix emulation of mfocrf in emulate_step()
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anton Blanchard <[email protected]>
commit 64e756c55aa46fc18fd53e8f3598b73b528d8637 upstream.
Quoted 1 line
Quoted 1 line
From POWER4 onwards,
mfocrf()only places the specified CR field into
the destination GPR, and the rest of it is set to 0. The PowerPC AS from version 3.0 now requires this behaviour.
The emulation code currently puts the entire CR into the destination GPR. Fix it.
--- arch/powerpc/lib/sstep.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
arch/powerpc/lib/sstep.c +13 -0
@@ -970,6 +970,19 @@ int __kprobes analyse_instr(struct instr#endif case 19 :/* mfcr */ +if ((instr >>20 ) &1 ) { + imm =0xf0000000UL ; +for (sh =0 ; sh <8 ; ++sh) { +if (instr & (0x80000 >> sh)) { + regs->gpr[rd] = regs->ccr & imm; +break ; + } + imm >>=4 ; + } + + goto instr_done; + } + regs->gpr[rd] = regs->ccr; regs->gpr[rd] &=0xffffffffUL ; goto instr_done;
Greg Kroah-Hartman
maintainerPATCH 42/125 powerpc/asm: Mark cr0 as clobbered in mftb()
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver O'Halloran <[email protected]>
commit 2400fd822f467cb4c886c879d8ad99feac9cf319 upstream.
The workaround for the CELL timebase bug does not correctly mark cr0 as being clobbered. This means GCC doesn't know that the asm block changes cr0 and might leave the result of an unrelated comparison in cr0 across the block, which we then trash, leading to basically random behaviour.
--- arch/powerpc/include/asm/reg.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/include/asm/reg.h +1 -1
@@ -1283,7 +1283,7 @@ static inline void msr_check_and_clear(u " .llong 0\n" \ ".previous" \ : "=r" (rval) \ - : "i" (CPU_FTR_CELL_TB_BUG), "i" (SPRN_TBRL)); \ + : "i" (CPU_FTR_CELL_TB_BUG), "i" (SPRN_TBRL) : "cr0"); \ rval;}) #else #define mftb() ({unsigned long rval; \
Greg Kroah-Hartman
maintainerPATCH 43/125 powerpc/mm/radix: Properly clear process table entry
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Herrenschmidt <[email protected]>
commit c6bb0b8d426a8cf865ca9c8a532cc3a2927cfceb upstream.
On radix, the process table entry we want to clear when destroying a context is entry 0, not entry 1. This has no *immediate* consequence on Power9, but it can cause other bugs to become worse.
--- arch/powerpc/mm/mmu_context_book3s64.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
arch/powerpc/mm/mmu_context_book3s64.c +9 -3
@@ -167,9 +167,15 @@ void destroy_context(struct mm_struct *m mm->context.cop_lockp =NULL ;#endif /* CONFIG_PPC_ICSWX */ -if (radix_enabled ()) - process_tb[mm->context.id].prtb1 =0 ; -else +if (radix_enabled ()) { +/* +* Radix doesn't have a valid bit in the process table +* entries. However we know that at least P9 implementation +* will avoid caching an entry with an invalid RTS field, +* and 0 is invalid. So this will do. +*/ + process_tb[mm->context.id].prtb0 =0 ; + }else subpage_prot_free (mm);destroy_pagetable_page (mm);__destroy_context (mm->context.id);
Greg Kroah-Hartman
maintainerPATCH 44/125 af_key: Fix sadb_x_ipsecrequest parsing
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
commit 096f41d3a8fcbb8dde7f71379b1ca85fe213eded upstream.
The parsing of sadb_x_ipsecrequest is broken in a number of ways. First of all we're not verifying sadb_x_ipsecrequest_len. This is needed when the structure carries addresses at the end. Worse we don't even look at the length when we parse those optional addresses.
The migration code had similar parsing code that's better but it also has some deficiencies. The length is overcounted first of all as it includes the header itself. It also fails to check the length before dereferencing the sa_family field.
This patch fixes those problems in parse_sockaddr_pair and then uses it in parse_ipsecrequest.
--- net/key/af_key.c | 47 ++++++++++++++++++++++++++--------------------- 1 file changed, 26 insertions(+), 21 deletions(-)
net/key/af_key.c +26 -21
@@ -65,6 +65,10 @@ struct pfkey_sock { } dump; }; +static int parse_sockaddr_pair (struct sockaddr *sa,int ext_len, +xfrm_address_t *saddr,xfrm_address_t *daddr, +u16 *family); +static inline struct pfkey_sock *pfkey_sk (struct sock *sk) {return (struct pfkey_sock *)sk;
@@ -1922,19 +1926,14 @@ parse_ipsecrequest(struct xfrm_policy *x/* addresses present only in tunnel mode */ if (t->mode ==XFRM_MODE_TUNNEL ) { -u8 *sa = (u8 *) (rq +1 ); -int family, socklen; +int err; - family =pfkey_sockaddr_extract ((struct sockaddr *)sa, - &t->saddr); -if (!family) -return -EINVAL ; - - socklen =pfkey_sockaddr_len (family); -if (pfkey_sockaddr_extract ((struct sockaddr *)(sa + socklen), - &t->id.daddr) != family) -return -EINVAL ; - t->encap_family = family; + err =parse_sockaddr_pair ( + (struct sockaddr *)(rq +1 ), + rq->sadb_x_ipsecrequest_len -sizeof (*rq), + &t->saddr, &t->id.daddr, &t->encap_family); +if (err) +return err; }else t->encap_family = xp->family;
@@ -1954,7 +1953,11 @@ parse_ipsecrequests(struct xfrm_policy *if (pol->sadb_x_policy_len *8 <sizeof (struct sadb_x_policy ))return -EINVAL ; -while (len >=sizeof (struct sadb_x_ipsecrequest )) { +while (len >=sizeof (*rq)) { +if (len < rq->sadb_x_ipsecrequest_len || + rq->sadb_x_ipsecrequest_len <sizeof (*rq)) +return -EINVAL ; +if ((err =parse_ipsecrequest (xp, rq)) <0 )return err; len -= rq->sadb_x_ipsecrequest_len;
@@ -2417,7 +2420,6 @@ out:return err; } -#ifdef CONFIG_NET_KEY_MIGRATE static int pfkey_sockaddr_pair_size (sa_family_t family) {return PFKEY_ALIGN8 (pfkey_sockaddr_len (family) *2 );
@@ -2429,7 +2431,7 @@ static int parse_sockaddr_pair(struct so {int af, socklen; -if (ext_len <pfkey_sockaddr_pair_size (sa->sa_family)) +if (ext_len <2 || ext_len <pfkey_sockaddr_pair_size (sa->sa_family))return -EINVAL ; af =pfkey_sockaddr_extract (sa, saddr);
@@ -2445,6 +2447,7 @@ static int parse_sockaddr_pair(struct soreturn 0 ; } +#ifdef CONFIG_NET_KEY_MIGRATE static int ipsecrequests_to_migrate (struct sadb_x_ipsecrequest *rq1,int len,struct xfrm_migrate *m) {
@@ -2452,13 +2455,14 @@ static int ipsecrequests_to_migrate(strustruct sadb_x_ipsecrequest *rq2;int mode; -if (len <=sizeof (struct sadb_x_ipsecrequest ) || - len < rq1->sadb_x_ipsecrequest_len) +if (len <sizeof (*rq1) || + len < rq1->sadb_x_ipsecrequest_len || + rq1->sadb_x_ipsecrequest_len <sizeof (*rq1))return -EINVAL ;/* old endoints */ err =parse_sockaddr_pair ((struct sockaddr *)(rq1 +1 ), - rq1->sadb_x_ipsecrequest_len, + rq1->sadb_x_ipsecrequest_len -sizeof (*rq1), &m->old_saddr, &m->old_daddr, &m->old_family);if (err)
@@ -2467,13 +2471,14 @@ static int ipsecrequests_to_migrate(stru rq2 = (struct sadb_x_ipsecrequest *)((u8 *)rq1 + rq1->sadb_x_ipsecrequest_len); len -= rq1->sadb_x_ipsecrequest_len; -if (len <=sizeof (struct sadb_x_ipsecrequest ) || - len < rq2->sadb_x_ipsecrequest_len) +if (len <=sizeof (*rq2) || + len < rq2->sadb_x_ipsecrequest_len || + rq2->sadb_x_ipsecrequest_len <sizeof (*rq2))return -EINVAL ;/* new endpoints */ err =parse_sockaddr_pair ((struct sockaddr *)(rq2 +1 ), - rq2->sadb_x_ipsecrequest_len, + rq2->sadb_x_ipsecrequest_len -sizeof (*rq2), &m->new_saddr, &m->new_daddr, &m->new_family);if (err)
Greg Kroah-Hartman
maintainerPATCH 45/125 PCI: Work around poweroff & suspend-to-RAM issue on Macbook Pro 11
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bjorn Helgaas <[email protected]>
commit 13cfc732160f7bc7e596128ce34cda361c556966 upstream.
Neither soft poweroff (transition to ACPI power state S5) nor suspend-to-RAM (transition to state S3) works on the Macbook Pro 11,4 and 11,5.
The problem is related to the [mem 0x7fa00000-0x7fbfffff] space. When we use that space, e.g., by assigning it to the 00:1c.0 Root Port, the ACPI Power Management 1 Control Register (PM1_CNT) at [io 0x1804] doesn't work anymore.
Linux does a soft poweroff (transition to S5) by writing to PM1_CNT. The theory about why this doesn't work is:
- The write to PM1_CNT causes an SMI
- The BIOS SMI handler depends on something in
[mem 0x7fa00000-0x7fbfffff]
- When Linux assigns [mem 0x7fa00000-0x7fbfffff] to the 00:1c.0 Port, it covers up whatever the SMI handler uses, so the SMI handler no longer works correctly
Reserve the [mem 0x7fa00000-0x7fbfffff] space so we don't assign it to anything.
This is voodoo programming, since we don't know what the real conflict is, but we've failed to find the root cause.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=103211
--- arch/x86/pci/fixup.c | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+)
arch/x86/pci/fixup.c +32 -0
@@ -571,3 +571,35 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INDECLARE_PCI_FIXUP_EARLY (PCI_VENDOR_ID_INTEL ,0x6f60 , pci_invalid_bar);DECLARE_PCI_FIXUP_EARLY (PCI_VENDOR_ID_INTEL ,0x6fa0 , pci_invalid_bar);DECLARE_PCI_FIXUP_EARLY (PCI_VENDOR_ID_INTEL ,0x6fc0 , pci_invalid_bar); + +/* +* Apple MacBook Pro: Avoid [mem 0x7fa00000-0x7fbfffff] +* +* Using the [mem 0x7fa00000-0x7fbfffff] region, e.g., by assigning it to +* the 00:1c.0 Root Port, causes a conflict with [io 0x1804], which is used +* for soft poweroff and suspend-to-RAM. +* +* As far as we know, this is related to the address space, not to the Root +* Port itself. Attaching the quirk to the Root Port is a convenience, but +* it could probably also be a standalone DMI quirk. +* +* https://bugzilla.kernel.org/show_bug.cgi?id=103211 +*/ +static void quirk_apple_mbp_poweroff (struct pci_dev *pdev) +{ +struct device *dev = &pdev->dev; +struct resource *res; + +if ((!dmi_match (DMI_PRODUCT_NAME ,"MacBookPro11,4" ) && + !dmi_match (DMI_PRODUCT_NAME ,"MacBookPro11,5" )) || + pdev->bus->number !=0 || pdev->devfn !=PCI_DEVFN (0x1c ,0 )) +return ; + + res =request_mem_region (0x7fa00000 ,0x200000 , +"MacBook Pro poweroff workaround" ); +if (res) +dev_info (dev,"claimed %s %pR\n" , res->name, res); +else +dev_info (dev,"can't work around MacBook Pro poweroff issue\n" ); +} +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0x8c10 , quirk_apple_mbp_poweroff);
Greg Kroah-Hartman
maintainerPATCH 46/125 PCI: rockchip: Use normal register bank for config accessors
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shawn Lin <[email protected]>
commit dc8cca5ef25ac4cb0dfc37467521a759767ff361 upstream.
Rockchip's RC has two banks of registers for the root port: a normal bank that is strictly compatible with the PCIe spec, and a privileged bank that can be used to change RO bits of root port registers.
When probing the RC driver, we use the privileged bank to do some basic setup work as some RO bits are hw-inited to wrong value. But we didn't change to the normal bank after probing the driver.
This leads to a serious problem when the PME code tries to clear the PME status by writing PCI_EXP_RTSTA_PME to the register of PCI_EXP_RTSTA. Per PCIe 3.0 spec, section 7.8.14, the PME status bit is RW1C. So the PME code is doing the right thing to clear the PME status but we find the RC doesn't clear it but actually setting it to one. So finally the system trap in pcie_pme_work_fn() as PCI_EXP_RTSTA_PME is true now forever. This issue can be reproduced by booting kernel with pci=nomsi.
Use the normal register bank for the PCI config accessors. The privileged bank is used only internally by this driver.
--- drivers/pci/host/pcie-rockchip.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
drivers/pci/host/pcie-rockchip.c +9 -4
@@ -131,6 +131,7 @@ PCIE_CORE_INT_CT | PCIE_CORE_INT_UTC | \ PCIE_CORE_INT_MMVC) +#define PCIE_RC_CONFIG_NORMAL_BASE 0x800000#define PCIE_RC_CONFIG_BASE 0xa00000#define PCIE_RC_CONFIG_VENDOR (PCIE_RC_CONFIG_BASE + 0x00)#define PCIE_RC_CONFIG_RID_CCR (PCIE_RC_CONFIG_BASE + 0x08)
@@ -267,7 +268,9 @@ static int rockchip_pcie_valid_device(ststatic int rockchip_pcie_rd_own_conf (struct rockchip_pcie *rockchip,int where,int size,u32 *val) { -void __iomem *addr = rockchip->apb_base +PCIE_RC_CONFIG_BASE + where; +void __iomem *addr; + + addr = rockchip->apb_base +PCIE_RC_CONFIG_NORMAL_BASE + where;if (!IS_ALIGNED ((uintptr_t )addr, size)) { *val =0 ;
@@ -291,11 +294,13 @@ static int rockchip_pcie_wr_own_conf(str int where, int size, u32 val) { u32 mask, tmp, offset; +void __iomem *addr; offset = where & ~0x3 ; + addr = rockchip->apb_base +PCIE_RC_CONFIG_NORMAL_BASE + offset;if (size ==4 ) { -writel (val, rockchip->apb_base +PCIE_RC_CONFIG_BASE + offset); +writel (val, addr);return PCIBIOS_SUCCESSFUL ; }
@@ -306,9 +311,9 @@ static int rockchip_pcie_wr_own_conf(str* corrupt RW1C bits in adjacent registers. But the hardware * doesn't support smaller writes. */ - tmp =readl (rockchip->apb_base +PCIE_RC_CONFIG_BASE + offset) & mask; + tmp =readl (addr) & mask; tmp |= val << ((where &0x3 ) *8 ); -writel (tmp, rockchip->apb_base +PCIE_RC_CONFIG_BASE + offset); +writel (tmp, addr);return PCIBIOS_SUCCESSFUL ; }
Greg Kroah-Hartman
maintainerPATCH 47/125 PCI/PM: Restore the status of PCI devices across hibernation
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Yu <[email protected]>
commit e60514bd4485c0c7c5a7cf779b200ce0b95c70d6 upstream.
Currently we saw a lot of "No irq handler" errors during hibernation, which caused the system hang finally:
ata4.00: qc timeout (cmd 0xec)
ata4.00: failed to IDENTIFY (I/O error, err_mask=0x4) ata4.00: revalidation failed (errno=-5)
ata4: SATA link up 6.0 Gbps (SStatus 133 SControl 300)
do_IRQ: 31.151 No irq handler for vector
According to above logs, there is an interrupt triggered and it is dispatched to CPU31 with a vector number 151, but there is no handler for it, thus this IRQ will not get acked and will cause an IRQ flood which kills the system. To be more specific, the 31.151 is an interrupt from the AHCI host controller.
After some investigation, the reason why this issue is triggered is because the thaw_noirq() function does not restore the MSI/MSI-X settings across hibernation.
The scenario is illustrated below:
1. Before hibernation, IRQ 34 is the handler for the AHCI device, which is bound to CPU31.
2. Hibernation starts, the AHCI device is put into low power state.
3. All the nonboot CPUs are put offline, so IRQ 34 has to be migrated to the last alive one - CPU0.
4. After the snapshot has been created, all the nonboot CPUs are brought up again; IRQ 34 remains bound to CPU0.
5. AHCI devices are put into D0.
6. The snapshot is written to the disk.
The issue is triggered in step 6. The AHCI interrupt should be delivered to CPU0, however it is delivered to the original CPU31 instead, which causes the "No irq handler" issue.
Ying Huang has provided a clue that, in step 3 it is possible that writing to the register might not take effect as the PCI devices have been suspended.
In step 3, the IRQ 34 affinity should be modified from CPU31 to CPU0, but in fact it is not. In __pci_write_msi_msg(), if the device is already in low power state, the low level MSI message entry will not be updated but cached. During the device restore process after a normal suspend/resume, pci_restore_msi_state() writes the cached MSI back to the hardware.
But this is not the case for hibernation. pci_restore_msi_state() is not currently called in pci_pm_thaw_noirq(), although pci_save_state() has saved the necessary PCI cached information in pci_pm_freeze_noirq().
Restore the PCI status for the device during hibernation. Otherwise the status might be lost across hibernation (for example, settings for MSI, MSI-X, ATS, ACS, IOV, etc.), which might cause problems during hibernation.
--- drivers/pci/pci-driver.c | 1 + 1 file changed, 1 insertion(+)
drivers/pci/pci-driver.c +1 -0
@@ -954,6 +954,7 @@ static int pci_pm_thaw_noirq(struct devireturn pci_legacy_resume_early (dev);pci_update_current_state (pci_dev,PCI_D0 ); +pci_restore_state (pci_dev);if (drv && drv->pm && drv->pm->thaw_noirq) error = drv->pm->thaw_noirq (dev);
Greg Kroah-Hartman
maintainerPATCH 48/125 ipvs: SNAT packet replies only for NATed connections
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julian Anastasov <[email protected]>
commit 3c5ab3f395d66a9e4e937fcfdf6ebc63894f028b upstream.
We do not check if packet from real server is for NAT connection before performing SNAT. This causes problems for setups that use DR/TUN and allow local clients to access the real server directly, for example:
- local client in director creates IPVS-DR/TUN connection CIP->VIP and the request packets are routed to RIP. Talks are finished but IPVS connection is not expired yet.
- second local client creates non-IPVS connection CIP->RIP with same reply tuple RIP->CIP and when replies are received on LOCAL_IN we wrongly assign them for the first client connection because RIP->CIP matches the reply direction. As result, IPVS SNATs replies for non-IPVS connections.
The problem is more visible to local UDP clients but in rare cases it can happen also for TCP or remote clients when the real server sends the reply traffic via the director.
So, better to be more precise for the reply traffic. As replies are not expected for DR/TUN connections, better to not touch them.
--- net/netfilter/ipvs/ip_vs_core.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-)
net/netfilter/ipvs/ip_vs_core.c +14 -5
@@ -849,10 +849,8 @@ static int handle_response_icmp(int af, {unsigned int verdict =NF_DROP ; -if (IP_VS_FWD_METHOD (cp) !=0 ) { -pr_err ("shouldn't reach here, because the box is on the " -"half connection in the tun/dr module.\n" ); - } +if (IP_VS_FWD_METHOD (cp) !=IP_VS_CONN_F_MASQ ) + goto ignore_cp;/* Ensure the checksum is correct */ if (!skb_csum_unnecessary (skb) &&ip_vs_checksum_complete (skb, ihl)) {
@@ -886,6 +884,8 @@ static int handle_response_icmp(int af,ip_vs_notrack (skb); else ip_vs_update_conntrack(skb, cp, 0); + +ignore_cp: verdict = NF_ACCEPT; out:
@@ -1385,8 +1385,11 @@ ip_vs_out(struct netns_ipvs *ipvs, unsig*/ cp = pp->conn_out_get (ipvs, af, skb, &iph); -if (likely (cp)) +if (likely (cp)) { +if (IP_VS_FWD_METHOD (cp) !=IP_VS_CONN_F_MASQ ) + goto ignore_cp;return handle_response (af, skb, pd, cp, &iph, hooknum); + }/* Check for real-server-started requests */ if (atomic_read (&ipvs->conn_out_counter)) {
@@ -1444,9 +1447,15 @@ ip_vs_out(struct netns_ipvs *ipvs, unsig } } } + +out:IP_VS_DBG_PKT (12 , af, pp, skb, iph.off,"ip_vs_out: packet continues traversal as normal" );return NF_ACCEPT ; + +ignore_cp: +__ip_vs_conn_put (cp); + goto out; }/*
Greg Kroah-Hartman
maintainerPATCH 49/125 xhci: fix 20000ms port resume timeout
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <[email protected]>
commit a54408d0a004757789863d74e29c2297edae0b4d upstream.
A uncleared PLC (port link change) bit will prevent furuther port event interrupts for that port. Leaving it uncleared caused get_port_status() to timeout after 20000ms while waiting to get the final port event interrupt for resume -> U0 state change.
This is a targeted fix for a specific case where we get a port resume event racing with xhci resume. The port event interrupt handler notices xHC is not yet running and bails out early, leaving PLC uncleared.
The whole xhci port resuming needs more attention, but while working on it it anyways makes sense to always ensure PLC is cleared in get_port_status before setting a new link state and waiting for its completion.
--- drivers/usb/host/xhci-hub.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/host/xhci-hub.c +3 -0
@@ -783,6 +783,9 @@ static u32 xhci_get_port_status(struct uclear_bit (wIndex, &bus_state->resuming_ports);set_bit (wIndex, &bus_state->rexit_ports); + +xhci_test_and_clear_bit (xhci, port_array, wIndex, +PORT_PLC );xhci_set_link_state (xhci, port_array, wIndex,XDEV_U0 );
Greg Kroah-Hartman
maintainerPATCH 50/125 xhci: Fix NULL pointer dereference when cleaning up streams for removed host
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <[email protected]>
commit 4b895868bb2da60a386a17cde3bf9ecbc70c79f4 upstream.
This off by one in stream_id indexing caused NULL pointer dereference and soft lockup on machines with USB attached SCSI devices connected to a hotpluggable xhci controller.
The code that cleans up pending URBs for dead hosts tried to dereference a stream ring at the invalid stream_id 0. ep->stream_info->stream_rings[0] doesn't point to a ring.
Start looping stream_id from 1 like in all the other places in the driver, and check that the ring exists before trying to kill URBs on it.
--- drivers/usb/host/xhci-ring.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
drivers/usb/host/xhci-ring.c +7 -4
@@ -860,13 +860,16 @@ static void xhci_kill_endpoint_urbs(stru (ep->ep_state & EP_GETTING_NO_STREAMS)) {int stream_id; -for (stream_id =0 ; stream_id < ep->stream_info->num_streams; +for (stream_id =1 ; stream_id < ep->stream_info->num_streams; stream_id++) { + ring = ep->stream_info->stream_rings[stream_id]; +if (!ring) +continue ; +xhci_dbg_trace (xhci, trace_xhci_dbg_cancel_urb,"Killing URBs for slot ID %u, ep index %u, stream %u" , - slot_id, ep_index, stream_id +1 ); -xhci_kill_ring_urbs (xhci, - ep->stream_info->stream_rings[stream_id]); + slot_id, ep_index, stream_id); +xhci_kill_ring_urbs (xhci, ring); } } else { ring = ep->ring;
Greg Kroah-Hartman
maintainerPATCH 51/125 xhci: Bad Ethernet performance plugged in ASM1042A host
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiahau Chang <[email protected]>
commit 9da5a1092b13468839b1a864b126cacfb72ad016 upstream.
When USB Ethernet is plugged in ASMEDIA ASM1042A xHCI host, bad performance was manifesting in Web browser use (like download large file such as ISO image). It is known limitation of ASM1042A that is not compatible with driver scheduling, As a workaround we can modify flow control handling of ASM1042A. The register we modify is changes the behavior
--- drivers/usb/host/pci-quirks.c | 54 ++++++++++++++++++++++++++++++++++++++++++ drivers/usb/host/pci-quirks.h | 2 + drivers/usb/host/xhci-pci.c | 6 ++++ drivers/usb/host/xhci.c | 6 ++++ drivers/usb/host/xhci.h | 1 5 files changed, 69 insertions(+)
drivers/usb/host/pci-quirks.c +54 -0
@@ -77,6 +77,16 @@#define USB_INTEL_USB3_PSSEN 0xD8#define USB_INTEL_USB3PRM 0xDC +/* ASMEDIA quirk use */ +#define ASMT_DATA_WRITE0_REG 0xF8 +#define ASMT_DATA_WRITE1_REG 0xFC +#define ASMT_CONTROL_REG 0xE0 +#define ASMT_CONTROL_WRITE_BIT 0x02 +#define ASMT_WRITEREG_CMD 0x10423 +#define ASMT_FLOWCTL_ADDR 0xFA30 +#define ASMT_FLOWCTL_DATA 0xBA +#define ASMT_PSEUDO_DATA 0 +/* * amd_chipset_gen values represent AMD different chipset generations */
@@ -412,6 +422,50 @@ void usb_amd_quirk_pll_disable(void) }EXPORT_SYMBOL_GPL (usb_amd_quirk_pll_disable); +static int usb_asmedia_wait_write (struct pci_dev *pdev) +{ +unsigned long retry_count; +unsigned char value; + +for (retry_count =1000 ; retry_count >0 ; --retry_count) { + +pci_read_config_byte (pdev,ASMT_CONTROL_REG , &value); + +if (value ==0xff ) { +dev_err (&pdev->dev,"%s: check_ready ERROR" , __func__); +return -EIO ; + } + +if ((value &ASMT_CONTROL_WRITE_BIT ) ==0 ) +return 0 ; + +usleep_range (40 ,60 ); + } + +dev_warn (&pdev->dev,"%s: check_write_ready timeout" , __func__); +return -ETIMEDOUT ; +} + +void usb_asmedia_modifyflowcontrol (struct pci_dev *pdev) +{ +if (usb_asmedia_wait_write (pdev) !=0 ) +return ; + +/* send command and address to device */ +pci_write_config_dword (pdev,ASMT_DATA_WRITE0_REG ,ASMT_WRITEREG_CMD ); +pci_write_config_dword (pdev,ASMT_DATA_WRITE1_REG ,ASMT_FLOWCTL_ADDR ); +pci_write_config_byte (pdev,ASMT_CONTROL_REG ,ASMT_CONTROL_WRITE_BIT ); + +if (usb_asmedia_wait_write (pdev) !=0 ) +return ; + +/* send data to device */ +pci_write_config_dword (pdev,ASMT_DATA_WRITE0_REG ,ASMT_FLOWCTL_DATA ); +pci_write_config_dword (pdev,ASMT_DATA_WRITE1_REG ,ASMT_PSEUDO_DATA ); +pci_write_config_byte (pdev,ASMT_CONTROL_REG ,ASMT_CONTROL_WRITE_BIT ); +} +EXPORT_SYMBOL_GPL (usb_asmedia_modifyflowcontrol); +void usb_amd_quirk_pll_enable (void ) {usb_amd_quirk_pll (0 );
drivers/usb/host/pci-quirks.h +2 -0
@@ -11,6 +11,7 @@ bool usb_amd_prefetch_quirk(void);void usb_amd_dev_put (void );void usb_amd_quirk_pll_disable (void );void usb_amd_quirk_pll_enable (void ); +void usb_asmedia_modifyflowcontrol (struct pci_dev *pdev);void usb_enable_intel_xhci_ports (struct pci_dev *xhci_pdev);void usb_disable_xhci_ports (struct pci_dev *xhci_pdev);void sb800_prefetch (struct device *dev,int on);
@@ -18,6 +19,7 @@ void sb800_prefetch(struct device *dev,struct pci_dev ;static inline void usb_amd_quirk_pll_disable (void ) {}static inline void usb_amd_quirk_pll_enable (void ) {} +static inline void usb_asmedia_modifyflowcontrol (struct pci_dev *pdev) {}static inline void usb_amd_dev_put (void ) {}static inline void usb_disable_xhci_ports (struct pci_dev *xhci_pdev) {}static inline void sb800_prefetch (struct device *dev,int on) {}
drivers/usb/host/xhci-pci.c +6 -0
@@ -59,6 +59,8 @@#define PCI_DEVICE_ID_AMD_PROMONTORYA_2 0x43bb#define PCI_DEVICE_ID_AMD_PROMONTORYA_1 0x43bc +#define PCI_DEVICE_ID_ASMEDIA_1042A_XHCI 0x1142 +static const char hcd_name[] ="xhci_hcd" ;static struct hc_driver __read_mostly xhci_pci_hc_driver;
@@ -217,6 +219,10 @@ static void xhci_pci_quirks(struct devic pdev->device == 0x1142) xhci->quirks |=XHCI_TRUST_TX_LENGTH ; +if (pdev->vendor ==PCI_VENDOR_ID_ASMEDIA && + pdev->device ==PCI_DEVICE_ID_ASMEDIA_1042A_XHCI ) + xhci->quirks |=XHCI_ASMEDIA_MODIFY_FLOWCONTROL ; +if (pdev->vendor ==PCI_VENDOR_ID_TI && pdev->device ==0x8241 ) xhci->quirks |=XHCI_LIMIT_ENDPOINT_INTERVAL_7 ;
drivers/usb/host/xhci.c +6 -0
@@ -192,6 +192,9 @@ int xhci_reset(struct xhci_hcd *xhci)if (ret)return ret; +if (xhci->quirks &XHCI_ASMEDIA_MODIFY_FLOWCONTROL ) +usb_asmedia_modifyflowcontrol (to_pci_dev (xhci_to_hcd (xhci)->self.controller)); +xhci_dbg_trace (xhci, trace_xhci_dbg_init,"Wait for controller to be ready for doorbell rings" );/*
@@ -1122,6 +1125,9 @@ int xhci_resume(struct xhci_hcd *xhci, bif ((xhci->quirks &XHCI_COMP_MODE_QUIRK ) && !comp_timer_running)compliance_mode_recovery_timer_init (xhci); +if (xhci->quirks &XHCI_ASMEDIA_MODIFY_FLOWCONTROL ) +usb_asmedia_modifyflowcontrol (to_pci_dev (hcd->self.controller)); +/* Re-enable port polling. */ xhci_dbg (xhci,"%s: starting port polling.\n" , __func__);set_bit (HCD_FLAG_POLL_RH , &xhci->shared_hcd->flags);
drivers/usb/host/xhci.h +1 -0
@@ -1661,6 +1661,7 @@ struct xhci_hcd {#define XHCI_BROKEN_PORT_PED (1 << 25)#define XHCI_LIMIT_ENDPOINT_INTERVAL_7 (1 << 26)#define XHCI_U2_DISABLE_WAKE (1 << 27) +#define XHCI_ASMEDIA_MODIFY_FLOWCONTROL (1 << 28)unsigned int num_active_eps;unsigned int limit_active_eps;
Greg Kroah-Hartman
maintainerPATCH 52/125 mxl111sf: Fix driver to use heap allocate buffers for USB messages
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Devin Heitmueller <[email protected]>
commit d90b336f3f652ff0441e631a06236f785581c8f7 upstream.
The recent changes in 4.9 to mandate USB buffers be heap allocated broke this driver, which was allocating the buffers on the stack. This resulted in the device failing at initialization.
Introduce dedicated send/receive buffers as part of the state structure, and add a mutex to protect access to them.
Note: we also had to tweak the API to mxl111sf_ctrl_msg to pass the pointer to the state struct rather than the device, since we need it inside the function to access the buffers and the mutex. This patch adjusts the callers to match the API change.
--- drivers/media/usb/dvb-usb-v2/mxl111sf-i2c.c | 4 +-- drivers/media/usb/dvb-usb-v2/mxl111sf.c | 32 ++++++++++++++++------------ drivers/media/usb/dvb-usb-v2/mxl111sf.h | 8 ++++++- 3 files changed, 28 insertions(+), 16 deletions(-)
drivers/media/usb/dvb-usb-v2/mxl111sf-i2c.c +2 -2
@@ -320,7 +320,7 @@ fail:static int mxl111sf_i2c_send_data (struct mxl111sf_state *state,u8 index,u8 *wdata) { -int ret =mxl111sf_ctrl_msg (state->d, wdata[0 ], +int ret =mxl111sf_ctrl_msg (state, wdata[0 ], &wdata[1 ],25 ,NULL ,0 );mxl_fail (ret);
@@ -330,7 +330,7 @@ static int mxl111sf_i2c_send_data(structstatic int mxl111sf_i2c_get_data (struct mxl111sf_state *state,u8 index,u8 *wdata,u8 *rdata) { -int ret =mxl111sf_ctrl_msg (state->d, wdata[0 ], +int ret =mxl111sf_ctrl_msg (state, wdata[0 ], &wdata[1 ],25 , rdata,24 );mxl_fail (ret);
drivers/media/usb/dvb-usb-v2/mxl111sf.c +19 -13
@@ -24,9 +24,6 @@#include "lgdt3305.h" #include "lg2160.h" -/* Max transfer size done by I2C transfer functions */ -#define MAX_XFER_SIZE 64 -int dvb_usb_mxl111sf_debug;module_param_named (debug, dvb_usb_mxl111sf_debug, int,0644 ); MODULE_PARM_DESC(debug, "set debugging level "
@@ -56,27 +53,34 @@ MODULE_PARM_DESC(rfswitch, "force rf swiDVB_DEFINE_MOD_OPT_ADAPTER_NR (adapter_nr); -int mxl111sf_ctrl_msg (struct dvb_usb_device *d, +int mxl111sf_ctrl_msg (struct mxl111sf_state *state,u8 cmd,u8 *wbuf,int wlen,u8 *rbuf,int rlen) { +struct dvb_usb_device *d = state->d;int wo = (rbuf ==NULL || rlen ==0 );/* write-only */ int ret; -u8 sndbuf[MAX_XFER_SIZE ]; -if (1 + wlen >sizeof (sndbuf)) { +if (1 + wlen >MXL_MAX_XFER_SIZE ) {pr_warn ("%s: len=%d is too big!\n" , __func__, wlen);return -EOPNOTSUPP ; }pr_debug ("%s(wlen = %d, rlen = %d)\n" , __func__, wlen, rlen); -memset (sndbuf,0 ,1 +wlen); +mutex_lock (&state->msg_lock); +memset (state->sndbuf,0 ,1 +wlen); +memset (state->rcvbuf,0 , rlen); + + state->sndbuf[0 ] = cmd; +memcpy (&state->sndbuf[1 ], wbuf, wlen); + + ret = (wo) ?dvb_usbv2_generic_write (d, state->sndbuf,1 +wlen) : +dvb_usbv2_generic_rw (d, state->sndbuf,1 +wlen, state->rcvbuf, + rlen); - sndbuf[0 ] = cmd; -memcpy (&sndbuf[1 ], wbuf, wlen); +memcpy (rbuf, state->rcvbuf, rlen); +mutex_unlock (&state->msg_lock); - ret = (wo) ?dvb_usbv2_generic_write (d, sndbuf,1 +wlen) : -dvb_usbv2_generic_rw (d, sndbuf,1 +wlen, rbuf, rlen);mxl_fail (ret);return ret;
@@ -92,7 +96,7 @@ int mxl111sf_read_reg(struct mxl111sf_stu8 buf[2 ];int ret; - ret =mxl111sf_ctrl_msg (state->d,MXL_CMD_REG_READ , &addr,1 , buf,2 ); + ret =mxl111sf_ctrl_msg (state,MXL_CMD_REG_READ , &addr,1 , buf,2 );if (mxl_fail (ret)) {mxl_debug ("error reading reg: 0x%02x" , addr); goto fail;
@@ -118,7 +122,7 @@ int mxl111sf_write_reg(struct mxl111sf_spr_debug ("W: (0x%02x, 0x%02x)\n" , addr, data); - ret =mxl111sf_ctrl_msg (state->d,MXL_CMD_REG_WRITE , buf,2 ,NULL ,0 ); + ret =mxl111sf_ctrl_msg (state,MXL_CMD_REG_WRITE , buf,2 ,NULL ,0 );if (mxl_fail (ret))pr_err ("error writing reg: 0x%02x, val: 0x%02x" , addr, data);return ret;
@@ -922,6 +926,8 @@ static int mxl111sf_init(struct dvb_usb_static u8 eeprom[256 ];struct i2c_client c; +mutex_init (&state->msg_lock); + ret =get_chip_info (state);if (mxl_fail (ret))pr_err ("failed to get chip info during probe" );
drivers/media/usb/dvb-usb-v2/mxl111sf.h +7 -1
@@ -19,6 +19,9 @@#include <media/tveeprom.h> #include <media/media-entity.h> +/* Max transfer size done by I2C transfer functions */ +#define MXL_MAX_XFER_SIZE 64 +#define MXL_EP1_REG_READ 1#define MXL_EP2_REG_WRITE 2#define MXL_EP3_INTERRUPT 3
@@ -86,6 +89,9 @@ struct mxl111sf_state {struct mutex fe_lock;u8 num_frontends;struct mxl111sf_adap_state adap_state[3 ]; +u8 sndbuf[MXL_MAX_XFER_SIZE ]; +u8 rcvbuf[MXL_MAX_XFER_SIZE ]; +struct mutex msg_lock;#ifdef CONFIG_MEDIA_CONTROLLER_DVB struct media_entity tuner;struct media_pad tuner_pads[2 ];
@@ -108,7 +114,7 @@ int mxl111sf_ctrl_program_regs(struct mx/* needed for hardware i2c functions in mxl111sf-i2c.c: * mxl111sf_i2c_send_data / mxl111sf_i2c_get_data */ -int mxl111sf_ctrl_msg (struct dvb_usb_device *d, +int mxl111sf_ctrl_msg (struct mxl111sf_state *state,u8 cmd,u8 *wbuf,int wlen,u8 *rbuf,int rlen); #define mxl_printk(kern, fmt, arg...) \
Greg Kroah-Hartman
maintainerPATCH 53/125 usb: storage: return on error to avoid a null pointer dereference
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Colin Ian King <[email protected]>
commit 446230f52a5bef593554510302465eabab45a372 upstream.
When us->extra is null the driver is not initialized, however, a later call to osd200_scsi_to_ata is made that dereferences us->extra, causing a null pointer dereference. The code currently detects and reports that the driver is not initialized; add a return to avoid the subsequent dereference issue in this check.
Thanks to Alan Stern for pointing out that srb->result needs setting to DID_ERROR << 16
Detected by CoverityScan, CID#100308 ("Dereference after null check")
--- drivers/usb/storage/isd200.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/usb/storage/isd200.c +4 -1
@@ -1529,8 +1529,11 @@ static void isd200_ata_command(struct sc/* Make sure driver was initialized */ -if (us->extra ==NULL ) +if (us->extra ==NULL ) {usb_stor_dbg (us,"ERROR Driver not initialized\n" ); + srb->result =DID_ERROR <<16 ; +return ; + }scsi_set_resid (srb,0 );/* scsi_bufflen might change in protocol translation to ata */
Greg Kroah-Hartman
maintainerPATCH 54/125 USB: cdc-acm: add device-id for quirky printer
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit fe855789d605590e57f9cd968d85ecce46f5c3fd upstream.
Add device-id entry for DATECS FP-2000 fiscal printer needing the NO_UNION_NORMAL quirk.
--- drivers/usb/class/cdc-acm.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/class/cdc-acm.c +3 -0
@@ -1770,6 +1770,9 @@ static const struct usb_device_id acm_id { USB_DEVICE(0x1576, 0x03b1), /* Maretron USB100 */ .driver_info =NO_UNION_NORMAL ,/* reports zero length descriptor */ }, + { USB_DEVICE(0xfff0, 0x0100), /* DATECS FP-2000 */ + .driver_info = NO_UNION_NORMAL, /* reports zero length descriptor */ + }, { USB_DEVICE(0x2912, 0x0001), /* ATOL FPrint */ .driver_info = CLEAR_HALT_CONDITIONS,
Greg Kroah-Hartman
maintainerPATCH 55/125 usb: renesas_usbhs: fix usbhsc_resume() for !USBHSF_RUNTIME_PWCTRL
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yoshihiro Shimoda <[email protected]>
commit 59a0879a0e17b2e43ecdc5e3299da85b8410d7ce upstream.
This patch fixes an issue that some registers may be not initialized after resume if the USBHSF_RUNTIME_PWCTRL is not set. Otherwise, if a cable is not connected, the driver will not enable INTENB0.VBSE after resume. And then, the driver cannot detect the VBUS.
--- drivers/usb/renesas_usbhs/common.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/renesas_usbhs/common.c +3 -1
@@ -752,8 +752,10 @@ static int usbhsc_resume(struct device *struct usbhs_priv *priv =dev_get_drvdata (dev);struct platform_device *pdev =usbhs_priv_to_pdev (priv); -if (!usbhsc_flags_has (priv,USBHSF_RUNTIME_PWCTRL )) +if (!usbhsc_flags_has (priv,USBHSF_RUNTIME_PWCTRL )) {usbhsc_power_ctrl (priv,1 ); +usbhs_mod_autonomy_mode (priv); + }usbhs_platform_call (priv, phy_reset, pdev);
Greg Kroah-Hartman
maintainerPATCH 56/125 usb: renesas_usbhs: gadget: disable all eps when the driver stops
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yoshihiro Shimoda <[email protected]>
commit b8b9c974afee685789fcbb191b52d1790be3608c upstream.
A gadget driver will not disable eps immediately when ->disconnect() is called. But, since this driver assumes all eps stop after the ->disconnect(), unexpected behavior happens (especially in system suspend).
So, this patch disables all eps in usbhsg_try_stop(). After disabling eps by renesas_usbhs driver, since some functions will be called by both a gadget and renesas_usbhs driver, renesas_usbhs driver should protect uep->pipe. To protect uep->pipe easily, this patch adds a new lock in struct usbhsg_uep.
--- drivers/usb/renesas_usbhs/mod_gadget.c | 31 ++++++++++++++++++++++++------- 1 file changed, 24 insertions(+), 7 deletions(-)
drivers/usb/renesas_usbhs/mod_gadget.c +24 -7
@@ -37,6 +37,7 @@ struct usbhsg_gpriv;struct usbhsg_uep {struct usb_ep ep;struct usbhs_pipe *pipe; +spinlock_t lock;/* protect the pipe */ char ep_name[EP_NAME_SIZE ];
@@ -636,10 +637,16 @@ usbhsg_ep_enable_end:static int usbhsg_ep_disable (struct usb_ep *ep) {struct usbhsg_uep *uep =usbhsg_ep_to_uep (ep); -struct usbhs_pipe *pipe =usbhsg_uep_to_pipe (uep); +struct usbhs_pipe *pipe; +unsigned long flags; +int ret =0 ; -if (!pipe) -return -EINVAL ; +spin_lock_irqsave (&uep->lock, flags); + pipe =usbhsg_uep_to_pipe (uep); +if (!pipe) { + ret = -EINVAL ; + goto out; + }usbhsg_pipe_disable (uep);usbhs_pipe_free (pipe);
@@ -647,6 +654,9 @@ static int usbhsg_ep_disable(struct usb_ uep->pipe->mod_private =NULL ; uep->pipe =NULL ; +out: +spin_unlock_irqrestore (&uep->lock, flags); +return 0 ; }
@@ -696,8 +706,11 @@ static int usbhsg_ep_dequeue(struct usb_ {struct usbhsg_uep *uep =usbhsg_ep_to_uep (ep);struct usbhsg_request *ureq =usbhsg_req_to_ureq (req); -struct usbhs_pipe *pipe =usbhsg_uep_to_pipe (uep); +struct usbhs_pipe *pipe; +unsigned long flags; +spin_lock_irqsave (&uep->lock, flags); + pipe =usbhsg_uep_to_pipe (uep);if (pipe)usbhs_pkt_pop (pipe,usbhsg_ureq_to_pkt (ureq));
@@ -706,6 +719,7 @@ static int usbhsg_ep_dequeue(struct usb_* even if the pipe is NULL. */ usbhsg_queue_pop (uep, ureq, -ECONNRESET ); +spin_unlock_irqrestore (&uep->lock, flags);return 0 ; }
@@ -852,10 +866,10 @@ static int usbhsg_try_stop(struct usbhs_ {struct usbhsg_gpriv *gpriv =usbhsg_priv_to_gpriv (priv);struct usbhs_mod *mod =usbhs_mod_get_current (priv); -struct usbhsg_uep *dcp =usbhsg_gpriv_to_dcp (gpriv); +struct usbhsg_uep *uep;struct device *dev =usbhs_priv_to_dev (priv);unsigned long flags; -int ret =0 ; +int ret =0 , i;/******************** spin lock ********************/ usbhs_lock (priv, flags);
@@ -887,7 +901,9 @@ static int usbhsg_try_stop(struct usbhs_usbhs_sys_set_test_mode (priv,0 );usbhs_sys_function_ctrl (priv,0 ); -usbhsg_ep_disable (&dcp->ep); +/* disable all eps */ +usbhsg_for_each_uep_with_dcp (uep, gpriv, i) +usbhsg_ep_disable (&uep->ep);dev_dbg (dev,"stop gadget\n" );
@@ -1069,6 +1085,7 @@ int usbhs_mod_gadget_probe(struct usbhs_ ret = -ENOMEM ; goto usbhs_mod_gadget_probe_err_gpriv; } +spin_lock_init (&uep->lock); gpriv->transceiver =usb_get_phy (USB_PHY_TYPE_UNDEFINED ); dev_info(dev, "%stransceiver found\n",
Greg Kroah-Hartman
maintainerPATCH 57/125 md: dont use flush_signals in userspace processes
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <[email protected]>
commit f9c79bc05a2a91f4fba8bfd653579e066714b1ec upstream.
The function flush_signals clears all pending signals for the process. It may be used by kernel threads when we need to prepare a kernel thread for responding to signals. However using this function for an userspaces processes is incorrect - clearing signals without the program expecting it can cause misbehavior.
The raid1 and raid5 code uses flush_signals in its request routine because it wants to prepare for an interruptible wait. This patch drops flush_signals and uses sigprocmask instead to block all signals (including SIGKILL) around the schedule() call. The signals are not lost, but the schedule() call won't respond to them.
--- drivers/md/raid1.c | 5 ++++- drivers/md/raid5.c | 5 ++++- 2 files changed, 8 insertions(+), 2 deletions(-)
drivers/md/raid1.c +4 -1
@@ -1073,7 +1073,7 @@ static void raid1_make_request(struct md*/ DEFINE_WAIT (w);for (;;) { -flush_signals (current); +sigset_t full, old;prepare_to_wait (&conf->wait_barrier, &w,TASK_INTERRUPTIBLE ); if (bio_end_sector(bio) <= mddev->suspend_lo ||
@@ -1082,7 +1082,10 @@ static void raid1_make_request(struct md !md_cluster_ops->area_resyncing (mddev,WRITE , bio->bi_iter.bi_sector, bio_end_sector(bio)))) break; +sigfillset (&full); +sigprocmask (SIG_BLOCK , &full, &old);schedule (); +sigprocmask (SIG_SETMASK , &old,NULL ); }finish_wait (&conf->wait_barrier, &w); }
drivers/md/raid5.c +4 -1
@@ -5300,12 +5300,15 @@ static void raid5_make_request(struct md* userspace, we want an interruptible * wait. */ -flush_signals (current);prepare_to_wait (&conf->wait_for_overlap, &w,TASK_INTERRUPTIBLE );if (logical_sector >= mddev->suspend_lo && logical_sector < mddev->suspend_hi) { +sigset_t full, old; +sigfillset (&full); +sigprocmask (SIG_BLOCK , &full, &old);schedule (); +sigprocmask (SIG_SETMASK , &old,NULL ); do_prepare = true; } goto retry;
Greg Kroah-Hartman
maintainerPATCH 59/125 cx88: Fix regression in initial video standard setting
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Devin Heitmueller <[email protected]>
commit 4e0973a918b9a42e217093f078e04a61e5dd95a5 upstream.
Setting initial standard at the top of cx8800_initdev would cause the first call to cx88_set_tvnorm() to return without programming any registers (leaving the driver saying it's set to NTSC but the hardware isn't programmed). Even worse, any subsequent attempt to explicitly set it to NTSC-M will return success but actually fail to program the underlying registers unless first changing the standard to something other than NTSC-M.
Set the initial standard later in the process, and make sure the field is zero at the beginning to ensure that the call always goes through.
This regression was introduced in the following commit:
commit ccd6f1d488e7 ("[media] cx88: move width, height and field to core struct")
Author: Hans Verkuil <[email protected]>
[media] cx88: move width, height and field to core struct
--- drivers/media/pci/cx88/cx88-cards.c | 9 ++++++++- drivers/media/pci/cx88/cx88-video.c | 2 +- 2 files changed, 9 insertions(+), 2 deletions(-)
drivers/media/pci/cx88/cx88-cards.c +8 -1
@@ -3691,7 +3691,14 @@ struct cx88_core *cx88_core_create(struc core->nr = nr;sprintf (core->name,"cx88[%d]" , core->nr); - core->tvnorm =V4L2_STD_NTSC_M ; +/* +* Note: Setting initial standard here would cause first call to +* cx88_set_tvnorm() to return without programming any registers. Leave +* it blank for at this point and it will get set later in +* cx8800_initdev() +*/ + core->tvnorm =0 ; + core->width =320 ; core->height =240 ; core->field =V4L2_FIELD_INTERLACED ;
drivers/media/pci/cx88/cx88-video.c +1 -1
@@ -1422,7 +1422,7 @@ static int cx8800_initdev(struct pci_dev/* initial device configuration */ mutex_lock (&core->lock); -cx88_set_tvnorm (core, core->tvnorm); +cx88_set_tvnorm (core,V4L2_STD_NTSC_M );v4l2_ctrl_handler_setup (&core->video_hdl);v4l2_ctrl_handler_setup (&core->audio_hdl);cx88_video_mux (core,0 );
Greg Kroah-Hartman
maintainerPATCH 60/125 libnvdimm, btt: fix btt_rw_page not returning errors
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vishal Verma <[email protected]>
commit c13c43d54f2c6a3be1c675766778ac1ad8dfbfcc upstream.
btt_rw_page was not propagating errors frm btt_do_bvec, resulting in any IO errors via the rw_page path going unnoticed. the pmem driver recently fixed this in e10624f pmem: fail io-requests to known bad blocks but same problem in BTT went neglected.
--- drivers/nvdimm/btt.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/nvdimm/btt.c +6 -3
@@ -1203,10 +1203,13 @@ static int btt_rw_page(struct block_devi struct page *page, bool is_write) {struct btt *btt = bdev->bd_disk->private_data; +int rc; -btt_do_bvec (btt,NULL , page,PAGE_SIZE ,0 , is_write, sector); -page_endio (page, is_write,0 ); -return 0 ; + rc =btt_do_bvec (btt,NULL , page,PAGE_SIZE ,0 , is_write, sector); +if (rc ==0 ) +page_endio (page, is_write,0 ); + +return rc; }
Greg Kroah-Hartman
maintainerPATCH 61/125 libnvdimm: fix badblock range handling of ARS range
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Toshi Kani <[email protected]>
commit 4e3f0701f25ab194c5362576b1146a1e6cc6c2e7 upstream.
__add_badblock_range() does not account sector alignment when it sets 'num_sectors'. Therefore, an ARS error record range spanning across two sectors is set to a single sector length, which leaves the 2nd sector unprotected.
Change __add_badblock_range() to set 'num_sectors' properly.
--- drivers/nvdimm/core.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/nvdimm/core.c +4 -3
@@ -450,14 +450,15 @@ static void set_badblock(struct badblockstatic void __add_badblock_range (struct badblocks *bb,u64 ns_offset,u64 len) {const unsigned int sector_size =512 ; -sector_t start_sector; +sector_t start_sector, end_sector;u64 num_sectors;u32 rem; start_sector =div_u64 (ns_offset, sector_size); - num_sectors =div_u64_rem (len, sector_size, &rem); + end_sector =div_u64_rem (ns_offset + len, sector_size, &rem);if (rem) - num_sectors++; + end_sector++; + num_sectors = end_sector - start_sector;if (unlikely (num_sectors > (u64 )INT_MAX )) {u64 remaining = num_sectors;
Greg Kroah-Hartman
maintainerPATCH 62/125 ext2: Dont clear SGID when inheriting ACLs
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
commit a992f2d38e4ce17b8c7d1f7f67b2de0eebdea069 upstream.
When new directory 'DIR1' is created in a directory 'DIR0' with SGID bit set, DIR1 is expected to have SGID bit set (and owning group equal to the owning group of 'DIR0'). However when 'DIR0' also has some default ACLs that 'DIR1' inherits, setting these ACLs will result in SGID bit on 'DIR1' to get cleared if user is not member of the owning group.
Fix the problem by creating __ext2_set_acl() function that does not call posix_acl_update_mode() and use it when inheriting ACLs. That prevents SGID bit clearing and the mode has been properly set by posix_acl_create() anyway.
--- fs/ext2/acl.c | 36 ++++++++++++++++++++++-------------- 1 file changed, 22 insertions(+), 14 deletions(-)
fs/ext2/acl.c +22 -14
@@ -175,11 +175,8 @@ ext2_get_acl(struct inode *inode, int tyreturn acl; } -/* -* inode->i_mutex: down -*/ -int -ext2_set_acl (struct inode *inode,struct posix_acl *acl,int type) +static int +__ext2_set_acl (struct inode *inode,struct posix_acl *acl,int type) {int name_index;void *value =NULL ;
@@ -189,13 +186,6 @@ ext2_set_acl(struct inode *inode, structswitch (type) {case ACL_TYPE_ACCESS : name_index =EXT2_XATTR_INDEX_POSIX_ACL_ACCESS ; -if (acl) { - error =posix_acl_update_mode (inode, &inode->i_mode, &acl); -if (error) -return error; - inode->i_ctime =current_time (inode); -mark_inode_dirty (inode); - }break ;case ACL_TYPE_DEFAULT :
@@ -222,6 +212,24 @@ ext2_set_acl(struct inode *inode, struct }/* +* inode->i_mutex: down +*/ +int +ext2_set_acl (struct inode *inode,struct posix_acl *acl,int type) +{ +int error; + +if (type ==ACL_TYPE_ACCESS && acl) { + error =posix_acl_update_mode (inode, &inode->i_mode, &acl); +if (error) +return error; + inode->i_ctime =current_time (inode); +mark_inode_dirty (inode); + } +return __ext2_set_acl (inode, acl, type); +} + +/* * Initialize the ACLs of a new inode. Called from ext2_new_inode. * * dir->i_mutex: down
@@ -238,12 +246,12 @@ ext2_init_acl(struct inode *inode, strucreturn error;if (default_acl) { - error =ext2_set_acl (inode, default_acl,ACL_TYPE_DEFAULT ); + error =__ext2_set_acl (inode, default_acl,ACL_TYPE_DEFAULT );posix_acl_release (default_acl); }if (acl) {if (!error) - error =ext2_set_acl (inode, acl,ACL_TYPE_ACCESS ); + error =__ext2_set_acl (inode, acl,ACL_TYPE_ACCESS );posix_acl_release (acl); }return error;
Greg Kroah-Hartman
maintainerPATCH 63/125 Raid5 should update rdev->sectors after reshape
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiao Ni <[email protected]>
commit b5d27718f38843a74552e9a93d32e2391fd3999f upstream.
The raid5 md device is created by the disks which we don't use the total size. For example, the size of the device is 5G and it just uses 3G of the devices to create one raid5 device. Then change the chunksize and wait reshape to finish. After reshape finishing stop the raid and assemble it again. It fails.
mdadm -CR /dev/md0 -l5 -n3 /dev/loop[0-2] --size=3G --chunk=32 --assume-clean mdadm /dev/md0 --grow --chunk=64
wait reshape to finish
mdadm -S /dev/md0
mdadm -As
The error messages:
[197519.814302] md: loop1 does not have a valid v1.2 superblock, not importing! [197519.821686] md: md_import_device returned -22
After reshape the data offset is changed. It selects backwards direction in this condition. In function super_1_load it compares the available space of the underlying device with sb->data_size. The new data offset gets bigger after reshape. So super_1_load returns -EINVAL. rdev->sectors is updated in md_finish_reshape. Then sb->data_size is set in super_1_sync based on rdev->sectors. So add md_finish_reshape in end_reshape.
--- drivers/md/raid5.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/md/raid5.c +1 -3
@@ -7560,12 +7560,10 @@ static void end_reshape(struct r5conf *c {if (!test_bit (MD_RECOVERY_INTR , &conf->mddev->recovery)) { -struct md_rdev *rdev;spin_lock_irq (&conf->device_lock); conf->previous_raid_disks = conf->raid_disks; -rdev_for_each (rdev, conf->mddev) - rdev->data_offset = rdev->new_data_offset; +md_finish_reshape (conf->mddev);smp_wmb (); conf->reshape_progress = MaxSector; conf->mddev->reshape_position = MaxSector;
Greg Kroah-Hartman
maintainerPATCH 64/125 s390/syscalls: Fix out of bounds arguments access
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Olsa <[email protected]>
commit c46fc0424ced3fb71208e72bd597d91b9169a781 upstream.
Zorro reported following crash while having enabled syscall tracing (CONFIG_FTRACE_SYSCALLS):
Unable to handle kernel pointer dereference at virtual ... Oops: 0011 [#1] SMP DEBUG_PAGEALLOC
SNIP
Call Trace: ([<000000000024d79c>] ftrace_syscall_enter+0xec/0x1d8) [<00000000001099c6>] do_syscall_trace_enter+0x236/0x2f8 [<0000000000730f1c>] sysc_tracesys+0x1a/0x32 [<000003fffcf946a2>] 0x3fffcf946a2 INFO: lockdep is turned off. Last Breaking-Event-Address: [<000000000022dd44>] rb_event_data+0x34/0x40 ---[ end trace 8c795f86b1b3f7b9 ]---
The crash happens in syscall_get_arguments function for syscalls with zero arguments, that will try to access first argument (args[0]) in event entry, but it's not allocated.
Bail out of there are no arguments.
--- arch/s390/include/asm/syscall.h | 6 ++++++ 1 file changed, 6 insertions(+)
arch/s390/include/asm/syscall.h +6 -0
@@ -64,6 +64,12 @@ static inline void syscall_get_arguments {unsigned long mask =-1UL ; +/* +* No arguments for this syscall, there's nothing to do. +*/ +if (!n) +return ; +BUG_ON (i + n >6 );#ifdef CONFIG_COMPAT if (test_tsk_thread_flag (task,TIF_31BIT ))
Greg Kroah-Hartman
maintainerPATCH 68/125 ipmi: use rcu lock around call to intf->handlers->sender()
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Camuso <[email protected]>
commit cdea46566bb21ce309725a024208322a409055cc upstream.
A vendor with a system having more than 128 CPUs occasionally encounters the following crash during shutdown. This is not an easily reproduceable event, but the vendor was able to provide the following analysis of the crash, which exhibits the same footprint each time.
crash> bt
PID: 0 TASK: ffff88017c70ce70 CPU: 5 COMMAND: "swapper/5"
#0 [ffff88085c143ac8] machine_kexec at ffffffff81059c8b #1 [ffff88085c143b28] __crash_kexec at ffffffff811052e2 #2 [ffff88085c143bf8] crash_kexec at ffffffff811053d0 #3 [ffff88085c143c10] oops_end at ffffffff8168ef88
#4 [ffff88085c143c38] no_context at ffffffff8167ebb3 #5 [ffff88085c143c88] __bad_area_nosemaphore at ffffffff8167ec49 #6 [ffff88085c143cd0] bad_area_nosemaphore at ffffffff8167edb3 #7 [ffff88085c143ce0] __do_page_fault at ffffffff81691d1e #8 [ffff88085c143d40] do_page_fault at ffffffff81691ec5 #9 [ffff88085c143d70] page_fault at ffffffff8168e188
[exception RIP: unknown or invalid address]
RIP: ffffffffa053c800 RSP: ffff88085c143e28 RFLAGS: 00010206
RAX: ffff88017c72bfd8 RBX: ffff88017a8dc000 RCX: ffff8810588b5ac8
RDX: ffff8810588b5a00 RSI: ffffffffa053c800 RDI: ffff8810588b5a00
RBP: ffff88085c143e58 R8: ffff88017c70d408 R9: ffff88017a8dc000
R10: 0000000000000002 R11: ffff88085c143da0 R12: ffff8810588b5ac8
R13: 0000000000000100 R14: ffffffffa053c800 R15: ffff8810588b5a00
ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018
<IRQ stack>
[exception RIP: cpuidle_enter_state+82]
RIP: ffffffff81514192 RSP: ffff88017c72be50 RFLAGS: 00000202
RAX: 0000001e4c3c6f16 RBX: 000000000000f8a0 RCX: 0000000000000018
RDX: 0000000225c17d03 RSI: ffff88017c72bfd8 RDI: 0000001e4c3c6f16
RBP: ffff88017c72be78 R8: 000000000000237e R9: 0000000000000018
R10: 0000000000002494 R11: 0000000000000001 R12: ffff88017c72be20
R13: ffff88085c14f8e0 R14: 0000000000000082 R15: 0000001e4c3bb400
ORIG_RAX: ffffffffffffff10 CS: 0010 SS: 0018This is the corresponding stack trace
It has crashed because the area pointed with RIP extracted from timer element is already removed during a shutdown process.
The function is smi_timeout().
And we think ffff8810588b5a00 in RDX is a parameter struct smi_info
crash> rd ffff8810588b5a00 20
ffff8810588b5a00: ffff8810588b6000 0000000000000000 .`.X............ ffff8810588b5a10: ffff880853264400 ffffffffa05417e0 .D&S......T..... ffff8810588b5a20: 24a024a000000000 0000000000000000 .....$.$........ ffff8810588b5a30: 0000000000000000 0000000000000000 ................ ffff8810588b5a30: 0000000000000000 0000000000000000 ................ ffff8810588b5a40: ffffffffa053a040 ffffffffa053a060 @.S.....`.S..... ffff8810588b5a50: 0000000000000000 0000000100000001 ................ ffff8810588b5a60: 0000000000000000 0000000000000e00 ................ ffff8810588b5a70: ffffffffa053a580 ffffffffa053a6e0 ..S.......S..... ffff8810588b5a80: ffffffffa053a4a0 ffffffffa053a250 ..S.....P.S..... ffff8810588b5a90: 0000000500000002 0000000000000000 ................
Unfortunately the top of this area is already detroyed by someone. But because of two reasonns we think this is struct smi_info
1) The address included in between ffff8810588b5a70 and ffff8810588b5a80:
are inside of ipmi_si_intf.c see crash> module ffff88085779d2c0
2) We've found the area which point this.
It is offset 0x68 of ffff880859df4000
crash> rd ffff880859df4000 100
ffff880859df4000: 0000000000000000 0000000000000001 ................ ffff880859df4010: ffffffffa0535290 dead000000000200 .RS............. ffff880859df4020: ffff880859df4020 ffff880859df4020 @.Y.... @.Y.... ffff880859df4030: 0000000000000002 0000000000100010 ................ ffff880859df4040: ffff880859df4040 ffff880859df4040 @@.Y....@@.Y.... ffff880859df4050: 0000000000000000 0000000000000000 ................ ffff880859df4060: 0000000000000000 ffff8810588b5a00 .........Z.X.... ffff880859df4070: 0000000000000001 ffff880859df4078 [email protected]....
If we regards it as struct ipmi_smi in shutdown process it looks consistent.
The remedy for this apparent race is affixed below.
This was first introduced in 7ea0ed2b5be817 ipmi: Make the message handler easier to use for SMI interfaces where some code was moved outside of the rcu_read_lock() and the lock was not added.
--- drivers/char/ipmi/ipmi_msghandler.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/char/ipmi/ipmi_msghandler.c +5 -0
@@ -3877,6 +3877,9 @@ static void smi_recv_tasklet(unsigned lo* because the lower layer is allowed to hold locks while calling * message delivery. */ + +rcu_read_lock (); +if (!run_to_completion)spin_lock_irqsave (&intf->xmit_msgs_lock, flags);if (intf->curr_msg ==NULL && !intf->in_shutdown) {
@@ -3899,6 +3902,8 @@ static void smi_recv_tasklet(unsigned loif (newmsg) intf->handlers->sender (intf->send_info, newmsg); +rcu_read_unlock (); +handle_new_recv_msgs (intf); }
Greg Kroah-Hartman
maintainerPATCH 69/125 ipmi:ssif: Add missing unlock in error branch
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Corey Minyard <[email protected]>
commit 4495ec6d770e1bca7a04e93ac453ab6720c56c5d upstream.
When getting flags, a response to a different message would result in a deadlock because of a missing unlock. Add that unlock and a comment. Found by static analysis.
--- drivers/char/ipmi/ipmi_ssif.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/char/ipmi/ipmi_ssif.c +5 -0
@@ -762,6 +762,11 @@ static void msg_done_handler(struct ssif result, len, data[2]); }else if (data[0 ] != (IPMI_NETFN_APP_REQUEST |1 ) <<2 || data[1 ] !=IPMI_GET_MSG_FLAGS_CMD ) { +/* +* Don't abort here, maybe it was a queued +* response to a previous command. +*/ +ipmi_ssif_unlock_cond (ssif_info, flags);pr_warn (PFX "Invalid response getting flags: %x %x\n" , data[0 ], data[1 ]); }else {
Greg Kroah-Hartman
maintainerPATCH 70/125 xfs: Dont clear SGID when inheriting ACLs
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
commit 8ba358756aa08414fa9e65a1a41d28304ed6fd7f upstream.
When new directory 'DIR1' is created in a directory 'DIR0' with SGID bit set, DIR1 is expected to have SGID bit set (and owning group equal to the owning group of 'DIR0'). However when 'DIR0' also has some default ACLs that 'DIR1' inherits, setting these ACLs will result in SGID bit on 'DIR1' to get cleared if user is not member of the owning group.
Fix the problem by calling __xfs_set_acl() instead of xfs_set_acl() when setting up inode in xfs_generic_create(). That prevents SGID bit clearing and mode is properly set by posix_acl_create() anyway. We also reorder arguments of __xfs_set_acl() to match the ordering of xfs_set_acl() to make things consistent.
--- fs/xfs/xfs_acl.c | 6 +++--- fs/xfs/xfs_acl.h | 1 + fs/xfs/xfs_iops.c | 4 ++-- 3 files changed, 6 insertions(+), 5 deletions(-)
fs/xfs/xfs_acl.c +3 -3
@@ -170,8 +170,8 @@ xfs_get_acl(struct inode *inode, int typreturn acl; } -STATIC int -__xfs_set_acl (struct inode *inode,int type,struct posix_acl *acl) +int +__xfs_set_acl (struct inode *inode,struct posix_acl *acl,int type) {struct xfs_inode *ip =XFS_I (inode);unsigned char *ea_name;
@@ -268,5 +268,5 @@ xfs_set_acl(struct inode *inode, struct } set_acl: -return __xfs_set_acl (inode, type, acl); +return __xfs_set_acl (inode, acl, type); }
fs/xfs/xfs_acl.h +1 -0
@@ -24,6 +24,7 @@ struct posix_acl;#ifdef CONFIG_XFS_POSIX_ACL extern struct posix_acl *xfs_get_acl (struct inode *inode,int type);extern int xfs_set_acl (struct inode *inode,struct posix_acl *acl,int type); +extern int __xfs_set_acl (struct inode *inode,struct posix_acl *acl,int type);#else static inline struct posix_acl *xfs_get_acl (struct inode *inode,int type) {
fs/xfs/xfs_iops.c +2 -2
@@ -190,12 +190,12 @@ xfs_generic_create(#ifdef CONFIG_XFS_POSIX_ACL if (default_acl) { - error =xfs_set_acl (inode, default_acl,ACL_TYPE_DEFAULT ); + error =__xfs_set_acl (inode, default_acl,ACL_TYPE_DEFAULT );if (error) goto out_cleanup_inode; }if (acl) { - error =xfs_set_acl (inode, acl,ACL_TYPE_ACCESS ); + error =__xfs_set_acl (inode, acl,ACL_TYPE_ACCESS );if (error) goto out_cleanup_inode; }
Greg Kroah-Hartman
maintainerPATCH 71/125 f2fs: sanity check size of nat and sit cache
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jin Qian <[email protected]>
commit 21d3f8e1c3b7996ce239ab6fa82e9f7a8c47d84d upstream.
Make sure number of entires doesn't exceed max journal size.
--- fs/f2fs/segment.c | 7 +++++++ 1 file changed, 7 insertions(+)
fs/f2fs/segment.c +7 -0
@@ -1805,6 +1805,8 @@ static int read_normal_summaries(structstatic int restore_curseg_summaries (struct f2fs_sb_info *sbi) { +struct f2fs_journal *sit_j =CURSEG_I (sbi,CURSEG_COLD_DATA )->journal; +struct f2fs_journal *nat_j =CURSEG_I (sbi,CURSEG_HOT_DATA )->journal;int type =CURSEG_HOT_DATA ;int err;
@@ -1831,6 +1833,11 @@ static int restore_curseg_summaries(strureturn err; } +/* sanity check for summary blocks */ +if (nats_in_cursum (nat_j) >NAT_JOURNAL_ENTRIES || +sits_in_cursum (sit_j) >SIT_JOURNAL_ENTRIES ) +return -EINVAL ; +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 72/125 f2fs: Dont clear SGID when inheriting ACLs
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jaegeuk Kim <[email protected]>
commit c925dc162f770578ff4a65ec9b08270382dba9e6 upstream.
This patch copies commit b7f8a09f80:
"btrfs: Don't clear SGID when inheriting ACLs" written by Jan.
--- fs/f2fs/acl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/f2fs/acl.c +1 -1
@@ -211,7 +211,7 @@ static int __f2fs_set_acl(struct inode *switch (type) {case ACL_TYPE_ACCESS : name_index =F2FS_XATTR_INDEX_POSIX_ACL_ACCESS ; -if (acl) { +if (acl && !ipage) { error =posix_acl_update_mode (inode, &inode->i_mode, &acl);if (error)return error;
Greg Kroah-Hartman
maintainerPATCH 74/125 ovl: drop CAP_SYS_RESOURCE from saved mounters credentials
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Khlebnikov <[email protected]>
commit 51f8f3c4e22535933ef9aecc00e9a6069e051b57 upstream.
If overlay was mounted by root then quota set for upper layer does not work because overlay now always use mounter's credentials for operations. Also overlay might deplete reserved space and inodes in ext4.
This patch drops capability SYS_RESOURCE from saved credentials. This affects creation new files, whiteouts, and copy-up operations.
--- fs/overlayfs/super.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
fs/overlayfs/super.c +6 -2
@@ -1146,6 +1146,7 @@ static int ovl_fill_super(struct super_bunsigned int stacklen =0 ;unsigned int i;bool remote = false; +struct cred *cred;int err; err = -ENOMEM ;
@@ -1309,10 +1310,13 @@ static int ovl_fill_super(struct super_belse sb->s_d_op = &ovl_dentry_operations; - ufs->creator_cred =prepare_creds (); -if (!ufs->creator_cred) + ufs->creator_cred = cred =prepare_creds (); +if (!cred) goto out_put_lower_mnt; +/* Never override disk quota limits or use reserved space */ +cap_lower (cred->cap_effective,CAP_SYS_RESOURCE ); + err = -ENOMEM ; oe =ovl_alloc_entry (numlower);if (!oe)
Greg Kroah-Hartman
maintainerPATCH 75/125 vfio: Fix group release deadlock
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Williamson <[email protected]>
commit 811642d8d8a82c0cce8dc2debfdaf23c5a144839 upstream.
If vfio_iommu_group_notifier() acquires a group reference and that reference becomes the last reference to the group, then vfio_group_put introduces a deadlock code path where we're trying to unregister from the iommu notifier chain from within a callout of that chain. Use a work_struct to release this reference asynchronously.
--- drivers/vfio/vfio.c | 37 ++++++++++++++++++++++++++++++++++++- 1 file changed, 36 insertions(+), 1 deletion(-)
drivers/vfio/vfio.c +36 -1
@@ -419,6 +419,34 @@ static void vfio_group_put(struct vfio_gkref_put_mutex (&group->kref, vfio_group_release, &vfio.group_lock); } +struct vfio_group_put_work { +struct work_struct work; +struct vfio_group *group; +}; + +static void vfio_group_put_bg (struct work_struct *work) +{ +struct vfio_group_put_work *do_work; + + do_work = container_of(work, struct vfio_group_put_work, work); + +vfio_group_put (do_work->group); +kfree (do_work); +} + +static void vfio_group_schedule_put (struct vfio_group *group) +{ +struct vfio_group_put_work *do_work; + + do_work =kmalloc (sizeof (*do_work),GFP_KERNEL ); +if (WARN_ON (!do_work)) +return ; + +INIT_WORK (&do_work->work, vfio_group_put_bg); + do_work->group = group; +schedule_work (&do_work->work); +} +/* Assume group_lock or group reference is held */ static void vfio_group_get (struct vfio_group *group) {
@@ -743,7 +771,14 @@ static int vfio_iommu_group_notifier(strbreak ; } -vfio_group_put (group); +/* +* If we're the last reference to the group, the group will be +* released, which includes unregistering the iommu group notifier. +* We hold a read-lock on that notifier list, unregistering needs +* a write-lock... deadlock. Release our reference asynchronously +* to avoid that situation. +*/ +vfio_group_schedule_put (group);return NOTIFY_OK ; }
Greg Kroah-Hartman
maintainerPATCH 76/125 vfio: New external user group/file match
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Williamson <[email protected]>
commit 5d6dee80a1e94cc284d03e06d930e60e8d3ecf7d upstream.
At the point where the kvm-vfio pseudo device wants to release its vfio group reference, we can't always acquire a new reference to make that happen. The group can be in a state where we wouldn't allow a new reference to be added. This new helper function allows a caller to match a file to a group to facilitate this. Given a file and group, report if they match. Thus the caller needs to already have a group reference to match to the file. This allows the deletion of a group without acquiring a new reference.
--- drivers/vfio/vfio.c | 9 +++++++++ include/linux/vfio.h | 2 ++ virt/kvm/vfio.c | 27 +++++++++++++++++++-------- 3 files changed, 30 insertions(+), 8 deletions(-)
drivers/vfio/vfio.c +9 -0
@@ -1751,6 +1751,15 @@ void vfio_group_put_external_user(struct }EXPORT_SYMBOL_GPL (vfio_group_put_external_user); +bool vfio_external_group_match_file (struct vfio_group *test_group, +struct file *filep) +{ +struct vfio_group *group = filep->private_data; + +return (filep->f_op == &vfio_group_fops) && (group == test_group); +} +EXPORT_SYMBOL_GPL (vfio_external_group_match_file); +int vfio_external_user_iommu_id (struct vfio_group *group) {return iommu_group_id (group->iommu_group);
include/linux/vfio.h +2 -0
@@ -88,6 +88,8 @@ extern void vfio_unregister_iommu_driver*/ extern struct vfio_group *vfio_group_get_external_user (struct file *filep);extern void vfio_group_put_external_user (struct vfio_group *group); +extern bool vfio_external_group_match_file (struct vfio_group *group, +struct file *filep);extern int vfio_external_user_iommu_id (struct vfio_group *group);extern long vfio_external_check_extension (struct vfio_group *group,unsigned long arg);
virt/kvm/vfio.c +19 -8
@@ -47,6 +47,22 @@ static struct vfio_group *kvm_vfio_groupreturn vfio_group; } +static bool kvm_vfio_external_group_match_file (struct vfio_group *group, +struct file *filep) +{ +bool ret, (*fn)(struct vfio_group *,struct file *); + + fn =symbol_get (vfio_external_group_match_file); +if (!fn) +return false; + + ret =fn (group, filep); + +symbol_put (vfio_external_group_match_file); + +return ret; +} +static void kvm_vfio_group_put_external_user (struct vfio_group *vfio_group) {void (*fn)(struct vfio_group *);
@@ -171,18 +187,13 @@ static int kvm_vfio_set_group(struct kvmif (!f.file)return -EBADF ; - vfio_group =kvm_vfio_group_get_external_user (f.file); -fdput (f); - -if (IS_ERR (vfio_group)) -return PTR_ERR (vfio_group); - ret = -ENOENT ;mutex_lock (&kv->lock);list_for_each_entry (kvg, &kv->group_list, node) { -if (kvg->vfio_group != vfio_group) +if (!kvm_vfio_external_group_match_file (kvg->vfio_group, + f.file))continue ;list_del (&kvg->node);
@@ -196,7 +207,7 @@ static int kvm_vfio_set_group(struct kvmmutex_unlock (&kv->lock); -kvm_vfio_group_put_external_user (vfio_group); +fdput (f);kvm_vfio_update_coherency (dev);
Greg Kroah-Hartman
maintainerPATCH 77/125 nvme-rdma: remove race conditions from IB signalling
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marta Rybczynska <[email protected]>
commit 5e599d73c1c1816af07f94ddba879499aa39b43c upstream.
This patch improves the way the RDMA IB signalling is done by using atomic operations for the signalling variable. This avoids race conditions on sig_count.
The signalling interval changes slightly and is now the largest power of two not larger than queue depth / 2.
ilog() usage idea by Bart Van Assche.
--- drivers/nvme/host/rdma.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-)
drivers/nvme/host/rdma.c +10 -10
@@ -88,7 +88,7 @@ enum nvme_rdma_queue_flags {struct nvme_rdma_queue {struct nvme_rdma_qe *rsp_ring; -u8 sig_count; +atomic_t sig_count;int queue_size;size_t cmnd_capsule_len;struct nvme_rdma_ctrl *ctrl;
@@ -555,6 +555,7 @@ static int nvme_rdma_init_queue(struct n queue->cmnd_capsule_len =sizeof (struct nvme_command ); queue->queue_size = queue_size; +atomic_set (&queue->sig_count,0 ); queue->cm_id =rdma_create_id (&init_net, nvme_rdma_cm_handler, queue,RDMA_PS_TCP ,IB_QPT_RC );
@@ -1011,17 +1012,16 @@ static void nvme_rdma_send_done(struct invme_rdma_wr_error (cq, wc,"SEND" ); } -static inline int nvme_rdma_queue_sig_limit (struct nvme_rdma_queue *queue) +/* +* We want to signal completion at least every queue depth/2. This returns the +* largest power of two that is not above half of (queue size + 1) to optimize +* (avoid divisions). +*/ +static inline bool nvme_rdma_queue_sig_limit (struct nvme_rdma_queue *queue) { -int sig_limit; +int limit =1 <<ilog2 ((queue->queue_size +1 ) /2 ); -/* -* We signal completion every queue depth/2 and also handle the -* degenerated case of a device with queue_depth=1, where we -* would need to signal every message. -*/ - sig_limit =max (queue->queue_size /2 ,1 ); -return (++queue->sig_count % sig_limit) ==0 ; +return (atomic_inc_return (&queue->sig_count) & (limit -1 )) ==0 ; } static int nvme_rdma_post_send(struct nvme_rdma_queue *queue,
Greg Kroah-Hartman
maintainerPATCH 78/125 ftrace: Fix uninitialized variable in match_records()
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
commit 2e028c4fe12907f226b8221815f16c2486ad3aa7 upstream.
My static checker complains that if "func" is NULL then "clear_filter" is uninitialized. This seems like it could be true, although it's possible something subtle is happening that I haven't seen.
kernel/trace/ftrace.c:3844 match_records()
error: uninitialized symbol 'clear_filter'.
--- kernel/trace/ftrace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/trace/ftrace.c +1 -1
@@ -3590,7 +3590,7 @@ match_records(struct ftrace_hash *hash,int exclude_mod =0 ;int found =0 ;int ret; -int clear_filter; +int clear_filter =0 ;if (func) { func_g.type = filter_parse_regex(func, len, &func_g.search,
Greg Kroah-Hartman
maintainerPATCH 79/125 MIPS: Fix mips_atomic_set() retry condition
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Hogan <[email protected]>
commit 2ec420b26f7b6ff332393f0bb5a7d245f7ad87f0 upstream.
The inline asm retry check in the MIPS_ATOMIC_SET operation of the sysmips system call has been backwards since commit f1e39a4a616c ("MIPS:
Rewrite sysmips(MIPS_ATOMIC_SET, ...) in C with inline assembler") merged in v2.6.32, resulting in the non R10000_LLSC_WAR case retrying until the operation was inatomic, before returning the new value that was probably just written multiple times instead of the old value.
Invert the branch condition to fix that particular issue.
Patchwork: https://patchwork.linux-mips.org/patch/16148/
--- arch/mips/kernel/syscall.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/mips/kernel/syscall.c +1 -1
@@ -141,7 +141,7 @@ static inline int mips_atomic_set(unsign"1: ll %[old], (%[addr]) \n" " move %[tmp], %[new] \n" "2: sc %[tmp], (%[addr]) \n" -" bnez %[tmp], 4f \n" +" beqz %[tmp], 4f \n" "3: \n" " .insn \n" " .subsection 2 \n"
Greg Kroah-Hartman
maintainerPATCH 80/125 MIPS: Fix mips_atomic_set() with EVA
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Hogan <[email protected]>
commit 4915e1b043d6286928207b1f6968197b50407294 upstream.
EVA linked loads (LLE) and conditional stores (SCE) should be used on EVA kernels for the MIPS_ATOMIC_SET operation of the sysmips system call, or else the atomic set will apply to the kernel view of the virtual address space (potentially unmapped on EVA kernels) rather than the user view (TLB mapped).
Patchwork: https://patchwork.linux-mips.org/patch/16151/
--- arch/mips/kernel/syscall.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
arch/mips/kernel/syscall.c +5 -2
@@ -28,6 +28,7 @@#include <linux/elf.h> #include <asm/asm.h> +#include <asm/asm-eva.h> #include <asm/branch.h> #include <asm/cachectl.h> #include <asm/cacheflush.h>
@@ -138,9 +139,11 @@ static inline int mips_atomic_set(unsign __asm__ __volatile__ (" .set " MIPS_ISA_ARCH_LEVEL " \n" " li %[err], 0 \n" -"1: ll %[old], (%[addr]) \n" +"1: \n" + user_ll("%[old]", "(%[addr])")" move %[tmp], %[new] \n" -"2: sc %[tmp], (%[addr]) \n" +"2: \n" + user_sc("%[tmp]", "(%[addr])")" beqz %[tmp], 4f \n" "3: \n" " .insn \n"
Greg Kroah-Hartman
maintainerPATCH 81/125 MIPS: Negate error syscall return in trace
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Hogan <[email protected]>
commit 4f32a39d49b25eaa66d2420f1f03d371ea4cd906 upstream.
The sys_exit trace event takes a single return value for the system call, which MIPS passes the value of the $v0 (result) register, however MIPS returns positive error codes in $v0 with $a3 specifying that $v0 contains an error code. As a result erroring system calls are traced returning positive error numbers that can't always be distinguished from success.
Use regs_return_value() to negate the error code if $a3 is set.
Patchwork: https://patchwork.linux-mips.org/patch/16651/
--- arch/mips/kernel/ptrace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/mips/kernel/ptrace.c +1 -1
@@ -924,7 +924,7 @@ asmlinkage void syscall_trace_leave(struaudit_syscall_exit (regs);if (unlikely (test_thread_flag (TIF_SYSCALL_TRACEPOINT ))) -trace_sys_exit (regs, regs->regs[2 ]); +trace_sys_exit (regs,regs_return_value (regs));if (test_thread_flag (TIF_SYSCALL_TRACE ))tracehook_report_syscall_exit (regs,0 );
Greg Kroah-Hartman
maintainerPATCH 82/125 ubifs: Dont leak kernel memory to the MTD
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Weinberger <[email protected]>
commit 4acadda74ff8b949c448c0282765ae747e088c87 upstream.
When UBIFS prepares data structures which will be written to the MTD it ensues that their lengths are multiple of 8. Since it uses kmalloc() the padded bytes are left uninitialized and we leak a few bytes of kernel memory to the MTD.
To make sure that all bytes are initialized, let's switch to kzalloc(). Kzalloc() is fine in this case because the buffers are not huge and in the IO path the performance bottleneck is anyway the MTD.
--- fs/ubifs/journal.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
fs/ubifs/journal.c +5 -5
@@ -576,7 +576,7 @@ int ubifs_jnl_update(struct ubifs_info */* Make sure to also account for extended attributes */ len += host_ui->data_len; - dent =kmalloc (len,GFP_NOFS ); + dent =kzalloc (len,GFP_NOFS );if (!dent)return -ENOMEM ;
@@ -952,7 +952,7 @@ int ubifs_jnl_xrename(struct ubifs_infoif (twoparents) len += plen; - dent1 =kmalloc (len,GFP_NOFS ); + dent1 =kzalloc (len,GFP_NOFS );if (!dent1)return -ENOMEM ;
@@ -1102,7 +1102,7 @@ int ubifs_jnl_rename(struct ubifs_info * len = aligned_dlen1 + aligned_dlen2 +ALIGN (ilen,8 ) +ALIGN (plen,8 );if (move) len += plen; - dent =kmalloc (len,GFP_NOFS ); + dent =kzalloc (len,GFP_NOFS );if (!dent)return -ENOMEM ;
@@ -1466,7 +1466,7 @@ int ubifs_jnl_delete_xattr(struct ubifs_ hlen = host_ui->data_len +UBIFS_INO_NODE_SZ ; len = aligned_xlen +UBIFS_INO_NODE_SZ +ALIGN (hlen,8 ); - xent =kmalloc (len,GFP_NOFS ); + xent =kzalloc (len,GFP_NOFS );if (!xent)return -ENOMEM ;
@@ -1573,7 +1573,7 @@ int ubifs_jnl_change_xattr(struct ubifs_ aligned_len1 =ALIGN (len1,8 ); aligned_len = aligned_len1 +ALIGN (len2,8 ); - ino =kmalloc (aligned_len,GFP_NOFS ); + ino =kzalloc (aligned_len,GFP_NOFS );if (!ino)return -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 83/125 ACPI / EC: Drop EC noirq hooks to fix a regression
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lv Zheng <[email protected]>
commit 662591461c4b9a1e3b9b159dbf37648a585ebaae upstream.
According to bug reports, although the busy polling mode can make noirq stages execute faster, it causes abnormal fan blowing up after system resume (see the first link below for a video demonstration) on Lenovo ThinkPad X1 Carbon - the 5th Generation. The problem can be fixed by upgrading the EC firmware on that machine.
However, many reporters confirm that the problem can be fixed by stopping busy polling during suspend/resume and for some of them upgrading the EC firmware is not an option.
For this reason, drop the noirq stage hooks from the EC driver to fix the regression.
--- drivers/acpi/ec.c | 19 ------------------- 1 file changed, 19 deletions(-)
drivers/acpi/ec.c +0 -19
@@ -1865,24 +1865,6 @@ error: }#ifdef CONFIG_PM_SLEEP -static int acpi_ec_suspend_noirq (struct device *dev) -{ -struct acpi_ec *ec = -acpi_driver_data (to_acpi_device (dev)); - -acpi_ec_enter_noirq (ec); -return 0 ; -} - -static int acpi_ec_resume_noirq (struct device *dev) -{ -struct acpi_ec *ec = -acpi_driver_data (to_acpi_device (dev)); - -acpi_ec_leave_noirq (ec); -return 0 ; -} -static int acpi_ec_suspend (struct device *dev) { struct acpi_ec *ec =
@@ -1904,7 +1886,6 @@ static int acpi_ec_resume(struct device#endif static const struct dev_pm_ops acpi_ec_pm = { - SET_NOIRQ_SYSTEM_SLEEP_PM_OPS(acpi_ec_suspend_noirq, acpi_ec_resume_noirq)SET_SYSTEM_SLEEP_PM_OPS (acpi_ec_suspend, acpi_ec_resume) };
Greg Kroah-Hartman
maintainerPATCH 84/125 Revert "ACPI / EC: Enable event freeze mode..." to fix a regression
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lv Zheng <[email protected]>
commit 9c40f956ce9b331493347d1b3cb7e384f7dc0581 upstream.
On Lenovo ThinkPad X1 Carbon - the 5th Generation, enabling an earlier EC event freezing timing causes acpitz-virtual-0 to report a stuck 48C temparature. And with EC firmware revisioned as 1.14, without reverting back to old EC event freezing timing, the fan still blows up after a system resume.
This reverts the culprit change so that the regression can be fixed without upgrading the EC firmware.
--- drivers/acpi/ec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/acpi/ec.c +1 -1
@@ -147,7 +147,7 @@ static unsigned int ec_storm_thresholdmodule_param (ec_storm_threshold, uint,0644 );MODULE_PARM_DESC (ec_storm_threshold,"Maxim false GPE numbers not considered as GPE storm" ); -static bool ec_freeze_events__read_mostly = true; +static bool ec_freeze_events__read_mostly = false;module_param (ec_freeze_events, bool,0644 );MODULE_PARM_DESC (ec_freeze_events,"Disabling event handling during suspend/resume" );
Greg Kroah-Hartman
maintainerPATCH 85/125 x86/acpi: Prevent out of bound access caused by broken ACPI tables
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seunghun Han <[email protected]>
commit dad5ab0db8deac535d03e3fe3d8f2892173fa6a4 upstream.
The bus_irq argument of mp_override_legacy_irq() is used as the index into the isa_irq_to_gsi[] array. The bus_irq argument originates from ACPI_MADT_TYPE_IO_APIC and ACPI_MADT_TYPE_INTERRUPT items in the ACPI tables, but is nowhere sanity checked.
That allows broken or malicious ACPI tables to overwrite memory, which might cause malfunction, panic or arbitrary code execution.
Add a sanity check and emit a warning when that triggers.
[ tglx: Added warning and rewrote changelog ]
--- arch/x86/kernel/acpi/boot.c | 8 ++++++++ 1 file changed, 8 insertions(+)
arch/x86/kernel/acpi/boot.c +8 -0
@@ -338,6 +338,14 @@ static void __init mp_override_legacy_irstruct mpc_intsrc mp_irq;/* +* Check bus_irq boundary. +*/ +if (bus_irq >=NR_IRQS_LEGACY ) { +pr_warn ("Invalid bus_irq %u for legacy override\n" , bus_irq); +return ; + } + +/* * Convert 'gsi' to 'ioapic.pin'. */ ioapic =mp_find_ioapic (gsi);
Greg Kroah-Hartman
maintainerPATCH 86/125 x86/ioapic: Pass the correct data to unmask_ioapic_irq()
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seunghun Han <[email protected]>
commit e708e35ba6d89ff785b225cd07dcccab04fa954a upstream.
One of the rarely executed code pathes in check_timer() calls unmask_ioapic_irq() passing irq_get_chip_data(0) as argument.
That's wrong as unmask_ioapic_irq() expects a pointer to the irq data of interrupt 0. irq_get_chip_data(0) returns NULL, so the following dereference in unmask_ioapic_irq() causes a kernel panic.
The issue went unnoticed in the first place because irq_get_chip_data() returns a void pointer so the compiler cannot do a type check on the argument. The code path was added for machines with broken configuration, but it seems that those machines are either not running current kernels or simply do not longer exist.
Hand in irq_get_irq_data(0) as argument which provides the correct data.
[ tglx: Rewrote changelog ]
--- arch/x86/kernel/apic/io_apic.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kernel/apic/io_apic.c +1 -1
@@ -2116,7 +2116,7 @@ static inline void __init check_timer(voint idx; idx =find_irq_entry (apic1, pin1, mp_INT);if (idx !=-1 &&irq_trigger (idx)) -unmask_ioapic_irq (irq_get_chip_data (0 )); +unmask_ioapic_irq (irq_get_irq_data (0 )); }irq_domain_deactivate_irq (irq_data);irq_domain_activate_irq (irq_data);
Greg Kroah-Hartman
maintainerPATCH 87/125 MIPS: Fix MIPS I ISA /proc/cpuinfo reporting
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej W. Rozycki <[email protected]>
commit e5f5a5b06e51a36f6ddf31a4a485358263953a3d upstream.
Correct a commit 515a6393dbac ("MIPS: kernel: proc: Add MIPS R6 support to /proc/cpuinfo") regression that caused MIPS I systems to show no ISA levels supported in /proc/cpuinfo, e.g.:
system type : Digital DECstation 2100/3100
machine : Unknown
processor : 0
cpu model : R3000 V2.0 FPU V2.0
BogoMIPS : 10.69
wait instruction : no
microsecond timers : notlb_entries : 64
extra interrupt vector : no
hardware watchpoint : no
isa :
ASEs implemented :
shadow register sets : 1
kscratch registers : 0
package : 0
core : 0
VCED exceptions : not available
VCEI exceptions : not available
and similarly exclude mips1' from the ISA list for any processors below MIPSr1. This is because the condition to show mips1' on has been made cpu_has_mips_r1' rather than newly-introduced cpu_has_mips_1'. Use the correct condition then.
Patchwork: https://patchwork.linux-mips.org/patch/16758/
--- arch/mips/kernel/proc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/mips/kernel/proc.c +1 -1
@@ -83,7 +83,7 @@ static int show_cpuinfo(struct seq_file }seq_printf (m,"isa\t\t\t:" ); -if (cpu_has_mips_r1) +if (cpu_has_mips_1)seq_printf (m," mips1" );if (cpu_has_mips_2)seq_printf (m,"%s" ," mips2" );
Greg Kroah-Hartman
maintainerPATCH 88/125 MIPS: Save static registers before sysmips
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Hogan <[email protected]>
commit 49955d84cd9ccdca5a16a495e448e1a06fad9e49 upstream.
The MIPS sysmips system call handler may return directly from the MIPS_ATOMIC_SET case (mips_atomic_set()) to syscall_exit. This path restores the static (callee saved) registers, however they won't have been saved on entry to the system call.
Use the save_static_function() macro to create a __sys_sysmips wrapper function which saves the static registers before calling sys_sysmips, so that the correct static register state is restored by syscall_exit.
Patchwork: https://patchwork.linux-mips.org/patch/16149/
--- arch/mips/kernel/scall32-o32.S | 2 +- arch/mips/kernel/scall64-64.S | 2 +- arch/mips/kernel/scall64-n32.S | 2 +- arch/mips/kernel/scall64-o32.S | 2 +- arch/mips/kernel/syscall.c | 6 ++++++ 5 files changed, 10 insertions(+), 4 deletions(-)
arch/mips/kernel/scall32-o32.S +1 -1
@@ -371,7 +371,7 @@ EXPORT(sys_call_table) PTR sys_writev PTR sys_cacheflush PTR sys_cachectl - PTR sys_sysmips + PTR __sys_sysmips PTR sys_ni_syscall /* 4150 */ PTR sys_getsid PTR sys_fdatasync
arch/mips/kernel/scall64-64.S +1 -1
@@ -311,7 +311,7 @@ EXPORT(sys_call_table) PTR sys_sched_getaffinity PTR sys_cacheflush PTR sys_cachectl - PTR sys_sysmips + PTR __sys_sysmips PTR sys_io_setup /* 5200 */ PTR sys_io_destroy PTR sys_io_getevents
arch/mips/kernel/scall64-n32.S +1 -1
@@ -302,7 +302,7 @@ EXPORT(sysn32_call_table) PTR compat_sys_sched_getaffinity PTR sys_cacheflush PTR sys_cachectl - PTR sys_sysmips + PTR __sys_sysmips PTR compat_sys_io_setup /* 6200 */ PTR sys_io_destroy PTR compat_sys_io_getevents
arch/mips/kernel/scall64-o32.S +1 -1
@@ -371,7 +371,7 @@ EXPORT(sys32_call_table) PTR compat_sys_writev PTR sys_cacheflush PTR sys_cachectl - PTR sys_sysmips + PTR __sys_sysmips PTR sys_ni_syscall /* 4150 */ PTR sys_getsid PTR sys_fdatasync
arch/mips/kernel/syscall.c +6 -0
@@ -202,6 +202,12 @@ static inline int mips_atomic_set(unsignunreachable (); } +/* +* mips_atomic_set() normally returns directly via syscall_exit potentially +* clobbering static registers, so be sure to preserve them. +*/ +save_static_function (sys_sysmips); + SYSCALL_DEFINE3(sysmips, long, cmd, long, arg1, long, arg2) {switch (cmd) {
Greg Kroah-Hartman
maintainerPATCH 89/125 MIPS: Actually decode JALX in `__compute_return_epc_for_insn
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej W. Rozycki <[email protected]>
commit a9db101b735a9d49295326ae41f610f6da62b08c upstream.
Complement commit fb6883e5809c ("MIPS: microMIPS: Support handling of delay slots.") and actually decode the regular MIPS JALX major instruction opcode, the handling of which has been added with the said commit for EPC calculation in `__compute_return_epc_for_insn'.
Patchwork: https://patchwork.linux-mips.org/patch/16394/
--- arch/mips/kernel/branch.c | 1 + 1 file changed, 1 insertion(+)
arch/mips/kernel/branch.c +1 -0
@@ -556,6 +556,7 @@ int __compute_return_epc_for_insn(struct/* * These are unconditional and in j_format. */ +case jalx_op:case jal_op: regs->regs[31 ] = regs->cp0_epc +8 ;case j_op:
Greg Kroah-Hartman
maintainerPATCH 90/125 MIPS: Fix unaligned PC interpretation in `compute_return_epc
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej W. Rozycki <[email protected]>
commit 11a3799dbeb620bf0400b1fda5cc2c6bea55f20a upstream.
Fix a regression introduced with commit fb6883e5809c ("MIPS: microMIPS:
Support handling of delay slots.") and defer to `__compute_return_epc' if the ISA bit is set in EPC with non-MIPS16, non-microMIPS hardware, which will then arrange for a SIGBUS due to an unaligned instruction reference. Returning EPC here is never correct as the API defines this function's result to be either a negative error code on failure or one of 0 and BRANCH_LIKELY_TAKEN on success.
Patchwork: https://patchwork.linux-mips.org/patch/16395/
--- arch/mips/include/asm/branch.h | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
arch/mips/include/asm/branch.h +1 -4
@@ -74,10 +74,7 @@ static inline int compute_return_epc(strreturn __microMIPS_compute_return_epc (regs);if (cpu_has_mips16)return __MIPS16e_compute_return_epc (regs); -return regs->cp0_epc; - } - -if (!delay_slot (regs)) { + }else if (!delay_slot (regs)) { regs->cp0_epc +=4 ;return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 91/125 MIPS: math-emu: Prevent wrong ISA mode instruction emulation
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej W. Rozycki <[email protected]>
commit 13769ebad0c42738831787e27c7c7f982e7da579 upstream.
Terminate FPU emulation immediately whenever an ISA mode switch has been observed. This is so that we do not interpret machine code in the wrong mode, for example when a regular MIPS FPU instruction has been placed in a delay slot of a jump that switches into the MIPS16 mode, as with the following code (taken from a GCC test suite case):
00400650 <set_fast_math>:
400650: 3c020100 lui v0,0x100
400654: 03e00008 jr ra
400658: 44c2f800 ctc1 v0,c1_fcsr
40065c: 00000000 nop
[...]
004012d0 <__libc_csu_init>:
4012d0: f000 6a02 li v0,2
4012d4: f150 0b1c la v1,3f9430 <_DYNAMIC-0x6df0>
4012d8: f400 3240 sll v0,16
4012dc: e269 addu v0,v1
4012de: 659a move gp,v0
4012e0: f00c 64f6 save a0-a2,48,ra,s0-s1
4012e4: 673c move s1,gp
4012e6: f010 9978 lw v1,-32744(s1)
4012ea: d204 sw v0,16(sp) 4012ec: eb40 jalr v1 4012ee: 653b move t9,v1 4012f0: f010 997c lw v1,-32740(s1) 4012f4: f030 9920 lw s1,-32736(s1) 4012f8: e32f subu v1,s1 4012fa: 326b sra v0,v1,2 4012fc: d206 sw v0,24(sp) 4012fe: 220c beqz v0,401318 <__libc_csu_init+0x48> 401300: 6800 li s0,0 401302: 99e0 lw a3,0(s1) 401304: 4801 addiu s0,1 401306: 960e lw a2,56(sp) 401308: 4904 addiu s1,4 40130a: 950d lw a1,52(sp) 40130c: 940c lw a0,48(sp) 40130e: ef40 jalr a3 401310: 653f move t9,a3 401312: 9206 lw v0,24(sp) 401314: ea0a cmp v0,s0 401316: 61f5 btnez 401302 <__libc_csu_init+0x32> 401318: 6476 restore 48,ra,s0-s1 40131a: e8a0 jrc ra
Here set_fast_math' is called from 40130e' (40130f' with the ISA bit) and emulation triggers for the CTC1 instruction. As it is in a jump delay slot emulation continues from 401312' (`401313' with the ISA bit). However we have no path to handle MIPS16 FPU code emulation, because there are no MIPS16 FPU instructions. So the default emulation path is taken, interpreting a 32-bit word fetched by get_user' from 401313' as a regular MIPS instruction, which is:
401313: f5ea0a92 sdc1 $f10,2706(t7)
This makes the FPU emulator proceed with the supposed SDC1 instruction and consequently makes the program considered here terminate with SIGSEGV.
A similar although less severe issue exists with pure-microMIPS processors in the case where similarly an FPU instruction is emulated in a delay slot of a register jump that (incorrectly) switches into the regular MIPS mode. A subsequent instruction fetch from the jump's target is supposed to cause an Address Error exception, however instead we proceed with regular MIPS FPU emulation.
For simplicity then, always terminate the emulation loop whenever a mode change is detected, denoted by an ISA mode bit flip. As from commit 377cb1b6c16a ("MIPS: Disable MIPS16/microMIPS crap for platforms not supporting these ASEs.") the result of `get_isa16_mode' can be hardcoded to 0, so we need to examine the ISA mode bit by hand.
This complements commit 102cedc32a6e ("MIPS: microMIPS: Floating point support.") which added JALX decoding to FPU emulation.
Patchwork: https://patchwork.linux-mips.org/patch/16393/
--- arch/mips/math-emu/cp1emu.c | 38 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+)
arch/mips/math-emu/cp1emu.c +38 -0
@@ -2522,6 +2522,35 @@ dcopuop:return 0 ; } +/* +* Emulate FPU instructions. +* +* If we use FPU hardware, then we have been typically called to handle +* an unimplemented operation, such as where an operand is a NaN or +* denormalized. In that case exit the emulation loop after a single +* iteration so as to let hardware execute any subsequent instructions. +* +* If we have no FPU hardware or it has been disabled, then continue +* emulating floating-point instructions until one of these conditions +* has occurred: +* +* - a non-FPU instruction has been encountered, +* +* - an attempt to emulate has ended with a signal, +* +* - the ISA mode has been switched. +* +* We need to terminate the emulation loop if we got switched to the +* MIPS16 mode, whether supported or not, so that we do not attempt +* to emulate a MIPS16 instruction as a regular MIPS FPU instruction. +* Similarly if we got switched to the microMIPS mode and only the +* regular MIPS mode is supported, so that we do not attempt to emulate +* a microMIPS instruction as a regular MIPS FPU instruction. Or if +* we got switched to the regular MIPS mode and only the microMIPS mode +* is supported, so that we do not attempt to emulate a regular MIPS +* instruction that should cause an Address Error exception instead. +* For simplicity we always terminate upon an ISA mode switch. +*/ int fpu_emulator_cop1Handler (struct pt_regs *xcp,struct mips_fpu_struct *ctx,int has_fpu,void *__user *fault_addr) {
@@ -2607,6 +2636,15 @@ int fpu_emulator_cop1Handler(struct pt_rbreak ;if (sig)break ; +/* +* We have to check for the ISA bit explicitly here, +* because `get_isa16_mode' may return 0 if support +* for code compression has been globally disabled, +* or otherwise we may produce the wrong signal or +* even proceed successfully where we must not. +*/ +if ((xcp->cp0_epc ^ prevepc) &0x1 ) +break ;cond_resched (); }while (xcp->cp0_epc > prevepc);
Greg Kroah-Hartman
maintainerPATCH 92/125 MIPS: Send SIGILL for BPOSGE32 in `__compute_return_epc_for_insn
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej W. Rozycki <[email protected]>
commit 7b82c1058ac1f8f8b9f2b8786b1f710a57a870a8 upstream.
Fix commit e50c0a8fa60d ("Support the MIPS32 / MIPS64 DSP ASE.") and send SIGILL rather than SIGBUS whenever an unimplemented BPOSGE32 DSP ASE instruction has been encountered in `__compute_return_epc_for_insn' as our Reserved Instruction exception handler would in response to an attempt to actually execute the instruction. Sending SIGBUS only makes sense for the unaligned PC case, since moved to __compute_return_epc'. Adjust function documentation accordingly, correct formatting and use pr_info' rather than `printk' as the other exit path already does.
Patchwork: https://patchwork.linux-mips.org/patch/16396/
--- arch/mips/kernel/branch.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
arch/mips/kernel/branch.c +4 -3
@@ -399,7 +399,7 @@ int __MIPS16e_compute_return_epc(struct* * @regs: Pointer to pt_regs * @insn: branch instruction to decode -* @returns: -EFAULT on error and forces SIGBUS, and on success +* @returns: -EFAULT on error and forces SIGILL, and on success * returns 0 or BRANCH_LIKELY_TAKEN as appropriate after * evaluating the branch. *
@@ -832,8 +832,9 @@ int __compute_return_epc_for_insn(structreturn ret; sigill_dsp: -printk ("%s: DSP branch but not DSP ASE - sending SIGBUS.\n" , current->comm); -force_sig (SIGBUS , current); +pr_info ("%s: DSP branch but not DSP ASE - sending SIGILL.\n" , + current->comm); +force_sig (SIGILL , current);return -EFAULT ; sigill_r6: pr_info("%s: R2 branch but r2-to-r6 emulator is not preset - sending SIGILL.\n",
Greg Kroah-Hartman
maintainerPATCH 93/125 MIPS: Rename `sigill_r6 to `sigill_r2r6 in `__compute_return_epc_for_insn
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej W. Rozycki <[email protected]>
commit 1f4edde422961397cf4470b347958c13c6a740bb upstream.
Use the more accurate `sigill_r2r6' name for the label used in the case of sending SIGILL in the absence of the instruction emulator for an earlier ISA level instruction that has been removed as from the R6 ISA, so that the `sigill_r6' name is freed for the situation where an R6 instruction is not supposed to be interpreted, because the executing processor does not support the R6 ISA.
Patchwork: https://patchwork.linux-mips.org/patch/16397/
--- arch/mips/kernel/branch.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
arch/mips/kernel/branch.c +8 -8
@@ -431,7 +431,7 @@ int __compute_return_epc_for_insn(struct/* Fall through */ case jr_op:if (NO_R6EMU && insn.r_format.func == jr_op) - goto sigill_r6; + goto sigill_r2r6; regs->cp0_epc = regs->regs[insn.r_format.rs];break ; }
@@ -446,7 +446,7 @@ int __compute_return_epc_for_insn(structswitch (insn.i_format.rt) {case bltzl_op:if (NO_R6EMU ) - goto sigill_r6; + goto sigill_r2r6;case bltz_op:if ((long )regs->regs[insn.i_format.rs] <0 ) { epc = epc +4 + (insn.i_format.simmediate <<2 );
@@ -459,7 +459,7 @@ int __compute_return_epc_for_insn(structcase bgezl_op:if (NO_R6EMU ) - goto sigill_r6; + goto sigill_r2r6;case bgez_op:if ((long )regs->regs[insn.i_format.rs] >=0 ) { epc = epc +4 + (insn.i_format.simmediate <<2 );
@@ -574,7 +574,7 @@ int __compute_return_epc_for_insn(struct*/ case beql_op:if (NO_R6EMU ) - goto sigill_r6; + goto sigill_r2r6;case beq_op:if (regs->regs[insn.i_format.rs] == regs->regs[insn.i_format.rt]) {
@@ -588,7 +588,7 @@ int __compute_return_epc_for_insn(structcase bnel_op:if (NO_R6EMU ) - goto sigill_r6; + goto sigill_r2r6;case bne_op:if (regs->regs[insn.i_format.rs] != regs->regs[insn.i_format.rt]) {
@@ -602,7 +602,7 @@ int __compute_return_epc_for_insn(structcase blezl_op:/* not really i_format */ if (!insn.i_format.rt &&NO_R6EMU ) - goto sigill_r6; + goto sigill_r2r6;case blez_op:/* * Compact branches for R6 for the
@@ -637,7 +637,7 @@ int __compute_return_epc_for_insn(structcase bgtzl_op:if (!insn.i_format.rt &&NO_R6EMU ) - goto sigill_r6; + goto sigill_r2r6;case bgtz_op:/* * Compact branches for R6 for the
@@ -836,7 +836,7 @@ sigill_dsp: current->comm);force_sig (SIGILL , current);return -EFAULT ; -sigill_r6: +sigill_r2r6:pr_info ("%s: R2 branch but r2-to-r6 emulator is not preset - sending SIGILL.\n" , current->comm);force_sig (SIGILL , current);
Greg Kroah-Hartman
maintainerPATCH 94/125 MIPS: Send SIGILL for linked branches in `__compute_return_epc_for_insn
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej W. Rozycki <[email protected]>
commit fef40be6da856afead4177aaa9d869a66fb3381f upstream.
Fix commit 319824eabc3f ("MIPS: kernel: branch: Do not emulate the branch likelies on MIPS R6") and also send SIGILL rather than returning -SIGILL for BLTZAL, BLTZALL, BGEZAL and BGEZALL instruction encodings no longer supported in R6, except where emulated. Returning -SIGILL is never correct as the API defines this function's result upon error to be -EFAULT and a signal actually issued.
Patchwork: https://patchwork.linux-mips.org/patch/16398/
--- arch/mips/kernel/branch.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-)
arch/mips/kernel/branch.c +4 -8
@@ -473,10 +473,8 @@ int __compute_return_epc_for_insn(structcase bltzal_op:case bltzall_op:if (NO_R6EMU && (insn.i_format.rs || - insn.i_format.rt == bltzall_op)) { - ret = -SIGILL ; -break ; - } + insn.i_format.rt == bltzall_op)) + goto sigill_r2r6; regs->regs[31 ] = epc +8 ;/* * OK we are here either because we hit a NAL
@@ -507,10 +505,8 @@ int __compute_return_epc_for_insn(structcase bgezal_op:case bgezall_op:if (NO_R6EMU && (insn.i_format.rs || - insn.i_format.rt == bgezall_op)) { - ret = -SIGILL ; -break ; - } + insn.i_format.rt == bgezall_op)) + goto sigill_r2r6; regs->regs[31 ] = epc +8 ;/* * OK we are here either because we hit a BAL
Greg Kroah-Hartman
maintainerPATCH 95/125 MIPS: Send SIGILL for R6 branches in `__compute_return_epc_for_insn
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej W. Rozycki <[email protected]>
commit a60b1a5bf88a250f1a77977c0224e502c901c77b upstream.
Fix:
* commit 8467ca0122e2 ("MIPS: Emulate the new MIPS R6 branch compact (BC) instruction"),
* commit 84fef630127a ("MIPS: Emulate the new MIPS R6 BALC instruction"),
* commit 69b9a2fd05a3 ("MIPS: Emulate the new MIPS R6 BEQZC and JIC instructions"),
* commit 28d6f93d201d ("MIPS: Emulate the new MIPS R6 BNEZC and JIALC instructions"),
* commit c893ce38b265 ("MIPS: Emulate the new MIPS R6 BOVC, BEQC and BEQZALC instructions")
and send SIGILL rather than returning -SIGILL for R6 branch and jump instructions. Returning -SIGILL is never correct as the API defines this function's result upon error to be -EFAULT and a signal actually issued.
Patchwork: https://patchwork.linux-mips.org/patch/16399/
--- arch/mips/kernel/branch.c | 35 +++++++++++++++-------------------- 1 file changed, 15 insertions(+), 20 deletions(-)
arch/mips/kernel/branch.c +15 -20
@@ -771,35 +771,27 @@ int __compute_return_epc_for_insn(struct#else case bc6_op:/* Only valid for MIPS R6 */ -if (!cpu_has_mips_r6) { - ret = -SIGILL ; -break ; - } +if (!cpu_has_mips_r6) + goto sigill_r6; regs->cp0_epc +=8 ;break ;case balc6_op: -if (!cpu_has_mips_r6) { - ret = -SIGILL ; -break ; - } +if (!cpu_has_mips_r6) + goto sigill_r6;/* Compact branch: BALC */ regs->regs[31 ] = epc +4 ; epc +=4 + (insn.i_format.simmediate <<2 ); regs->cp0_epc = epc;break ;case pop66_op: -if (!cpu_has_mips_r6) { - ret = -SIGILL ; -break ; - } +if (!cpu_has_mips_r6) + goto sigill_r6;/* Compact branch: BEQZC || JIC */ regs->cp0_epc +=8 ;break ;case pop76_op: -if (!cpu_has_mips_r6) { - ret = -SIGILL ; -break ; - } +if (!cpu_has_mips_r6) + goto sigill_r6;/* Compact branch: BNEZC || JIALC */ if (!insn.i_format.rs) {/* JIALC: set $31/ra */
@@ -811,10 +803,8 @@ int __compute_return_epc_for_insn(structcase pop10_op:case pop30_op:/* Only valid for MIPS R6 */ -if (!cpu_has_mips_r6) { - ret = -SIGILL ; -break ; - } +if (!cpu_has_mips_r6) + goto sigill_r6;/* * Compact branches: * bovc, beqc, beqzalc, bnvc, bnec, bnezlac
@@ -837,6 +827,11 @@ sigill_r2r6: current->comm);force_sig (SIGILL , current);return -EFAULT ; +sigill_r6: +pr_info ("%s: R6 branch but no MIPSr6 ISA support - sending SIGILL.\n" , + current->comm); +force_sig (SIGILL , current); +return -EFAULT ; }EXPORT_SYMBOL_GPL (__compute_return_epc_for_insn);
Greg Kroah-Hartman
maintainerPATCH 96/125 MIPS: Fix a typo: s/preset/present/ in r2-to-r6 emulation error message
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej W. Rozycki <[email protected]>
commit 27fe2200dad2de8207a694024a7b9037dff1b280 upstream.
This is a user-visible message, so we want it to be spelled correctly.
Patchwork: https://patchwork.linux-mips.org/patch/16400/
--- arch/mips/kernel/branch.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/mips/kernel/branch.c +1 -1
@@ -823,7 +823,7 @@ sigill_dsp:force_sig (SIGILL , current);return -EFAULT ; sigill_r2r6: -pr_info ("%s: R2 branch but r2-to-r6 emulator is not preset - sending SIGILL.\n" , +pr_info ("%s: R2 branch but r2-to-r6 emulator is not present - sending SIGILL.\n" , current->comm);force_sig (SIGILL , current);return -EFAULT ;
Greg Kroah-Hartman
maintainerPATCH 97/125 Input: i8042 - fix crash at boot time
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Hong <[email protected]>
commit 340d394a789518018f834ff70f7534fc463d3226 upstream.
The driver checks port->exists twice in i8042_interrupt(), first when trying to assign temporary "serio" variable, and second time when deciding whether it should call serio_interrupt(). The value of port->exists may change between the 2 checks, and we may end up calling serio_interrupt() with a NULL pointer:
BUG: unable to handle kernel NULL pointer dereference at 0000000000000050 IP: [<ffffffff8150feaf>] _spin_lock_irqsave+0x1f/0x40 PGD 0 Oops: 0002 [#1] SMP last sysfs file: CPU 0 Modules linked in:
Pid: 1, comm: swapper Not tainted 2.6.32-358.el6.x86_64 #1 QEMU Standard PC (i440FX + PIIX, 1996)
RIP: 0010:[<ffffffff8150feaf>] [<ffffffff8150feaf>] _spin_lock_irqsave+0x1f/0x40 RSP: 0018:ffff880028203cc0 EFLAGS: 00010082 RAX: 0000000000010000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000282 RSI: 0000000000000098 RDI: 0000000000000050 RBP: ffff880028203cc0 R08: ffff88013e79c000 R09: ffff880028203ee0 R10: 0000000000000298 R11: 0000000000000282 R12: 0000000000000050 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000098 FS: 0000000000000000(0000) GS:ffff880028200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0018 ES: 0018 CR0: 000000008005003b CR2: 0000000000000050 CR3: 0000000001a85000 CR4: 00000000001407f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Process swapper (pid: 1, threadinfo ffff88013e79c000, task ffff88013e79b500) Stack: ffff880028203d00 ffffffff813de186 ffffffffffffff02 0000000000000000 <d> 0000000000000000 0000000000000000 0000000000000000 0000000000000098 <d> ffff880028203d70 ffffffff813e0162 ffff880028203d20 ffffffff8103b8ac Call Trace: <IRQ> [<ffffffff813de186>] serio_interrupt+0x36/0xa0 [<ffffffff813e0162>] i8042_interrupt+0x132/0x3a0 [<ffffffff8103b8ac>] ? kvm_clock_read+0x1c/0x20 [<ffffffff8103b8b9>] ? kvm_clock_get_cycles+0x9/0x10 [<ffffffff810e1640>] handle_IRQ_event+0x60/0x170 [<ffffffff8103b154>] ? kvm_guest_apic_eoi_write+0x44/0x50 [<ffffffff810e3d8e>] handle_edge_irq+0xde/0x180 [<ffffffff8100de89>] handle_irq+0x49/0xa0 [<ffffffff81516c8c>] do_IRQ+0x6c/0xf0 [<ffffffff8100b9d3>] ret_from_intr+0x0/0x11 [<ffffffff81076f63>] ? __do_softirq+0x73/0x1e0 [<ffffffff8109b75b>] ? hrtimer_interrupt+0x14b/0x260 [<ffffffff8100c1cc>] ? call_softirq+0x1c/0x30 [<ffffffff8100de05>] ? do_softirq+0x65/0xa0 [<ffffffff81076d95>] ? irq_exit+0x85/0x90 [<ffffffff81516d80>] ? smp_apic_timer_interrupt+0x70/0x9b [<ffffffff8100bb93>] ? apic_timer_interrupt+0x13/0x20
To avoid the issue let's change the second check to test whether serio is NULL or not.
Also, let's take i8042_lock in i8042_start() and i8042_stop() instead of trying to be overly smart and using memory barriers.
--- drivers/input/serio/i8042.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
drivers/input/serio/i8042.c +9 -3
@@ -434,8 +434,10 @@ static int i8042_start(struct serio *ser {struct i8042_port *port = serio->port_data; +spin_lock_irq (&i8042_lock); port->exists = true; -mb (); +spin_unlock_irq (&i8042_lock); +return 0 ; }
@@ -448,16 +450,20 @@ static void i8042_stop(struct serio *ser {struct i8042_port *port = serio->port_data; +spin_lock_irq (&i8042_lock); port->exists = false; + port->serio =NULL ; +spin_unlock_irq (&i8042_lock);/* +* We need to make sure that interrupt handler finishes using +* our serio port before we return from this function. * We synchronize with both AUX and KBD IRQs because there is * a (very unlikely) chance that AUX IRQ is raised for KBD port * and vice versa. */ synchronize_irq (I8042_AUX_IRQ );synchronize_irq (I8042_KBD_IRQ ); - port->serio =NULL ; }/*
@@ -574,7 +580,7 @@ static irqreturn_t i8042_interrupt(int ispin_unlock_irqrestore (&i8042_lock, flags); -if (likely (port->exists && !filtered)) +if (likely (serio && !filtered))serio_interrupt (serio, data, dfl); out:
Greg Kroah-Hartman
maintainerPATCH 98/125 IB/iser: Fix connection teardown race condition
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Neyelov <[email protected]>
commit c8c16d3bae967f1c7af541e8d016e5c51e4f010a upstream.
Under heavy iser target(scst) start/stop stress during login/logout on iser intitiator side happened trace call provided below.
The function iscsi_iser_slave_alloc iser_conn pointer could be NULL, due to the fact that function iscsi_iser_conn_stop can be called before and free iser connection. Let's protect that flow by introducing global mutex.
BUG: unable to handle kernel paging request at 0000000000001018 IP: [<ffffffffc0426f7e>] iscsi_iser_slave_alloc+0x1e/0x50 [ib_iser] Call Trace: ? scsi_alloc_sdev+0x242/0x300 scsi_probe_and_add_lun+0x9e1/0xea0 ? kfree_const+0x21/0x30 ? kobject_set_name_vargs+0x76/0x90 ? __pm_runtime_resume+0x5b/0x70 __scsi_scan_target+0xf6/0x250 scsi_scan_target+0xea/0x100 iscsi_user_scan_session.part.13+0x101/0x130 [scsi_transport_iscsi] ? iscsi_user_scan_session.part.13+0x130/0x130 [scsi_transport_iscsi] iscsi_user_scan_session+0x1e/0x30 [scsi_transport_iscsi] device_for_each_child+0x50/0x90 iscsi_user_scan+0x44/0x60 [scsi_transport_iscsi] store_scan+0xa8/0x100 ? common_file_perm+0x5d/0x1c0 dev_attr_store+0x18/0x30 sysfs_kf_write+0x37/0x40 kernfs_fop_write+0x12c/0x1c0 __vfs_write+0x18/0x40 vfs_write+0xb5/0x1a0 SyS_write+0x55/0xc0
--- drivers/infiniband/ulp/iser/iscsi_iser.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/infiniband/ulp/iser/iscsi_iser.c +11 -0
@@ -83,6 +83,7 @@ static struct scsi_host_template iscsi_istatic struct iscsi_transport iscsi_iser_transport;static struct scsi_transport_template *iscsi_iser_scsi_transport;static struct workqueue_struct *release_wq; +static DEFINE_MUTEX (unbind_iser_conn_mutex);struct iser_global ig;int iser_debug_level =0 ;
@@ -550,12 +551,14 @@ iscsi_iser_conn_stop(struct iscsi_cls_co*/ if (iser_conn) {mutex_lock (&iser_conn->state_mutex); +mutex_lock (&unbind_iser_conn_mutex);iser_conn_terminate (iser_conn);iscsi_conn_stop (cls_conn, flag);/* unbind */ iser_conn->iscsi_conn =NULL ; conn->dd_data =NULL ; +mutex_unlock (&unbind_iser_conn_mutex);complete (&iser_conn->stop_completion);mutex_unlock (&iser_conn->state_mutex);
@@ -973,13 +976,21 @@ static int iscsi_iser_slave_alloc(structstruct iser_conn *iser_conn;struct ib_device *ib_dev; +mutex_lock (&unbind_iser_conn_mutex); + session =starget_to_session (scsi_target (sdev))->dd_data; iser_conn = session->leadconn->dd_data; +if (!iser_conn) { +mutex_unlock (&unbind_iser_conn_mutex); +return -ENOTCONN ; + } ib_dev = iser_conn->ib_conn.device->ib_device;if (!(ib_dev->attrs.device_cap_flags &IB_DEVICE_SG_GAPS_REG ))blk_queue_virt_boundary (sdev->request_queue, ~MASK_4K ); +mutex_unlock (&unbind_iser_conn_mutex); +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 99/125 IB/core: Namespace is mandatory input for address resolution
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Moni Shoua <[email protected]>
commit bebb2a473a43c8f84a8210687d1cbdde503046d7 upstream.
In function addr_resolve() the namespace is a required input parameter and not an output. It is passed later for searching the routing table and device addresses. Also, it shouldn't be copied back to the caller.
--- drivers/infiniband/core/addr.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/infiniband/core/addr.c +5 -1
@@ -518,6 +518,11 @@ static int addr_resolve(struct sockaddrstruct dst_entry *dst;int ret; +if (!addr->net) { +pr_warn_ratelimited ("%s: missing namespace\n" , __func__); +return -EINVAL ; + } +if (src_in->sa_family ==AF_INET ) {struct rtable *rt =NULL ; const struct sockaddr_in *dst_in4 =
@@ -555,7 +560,6 @@ static int addr_resolve(struct sockaddr } addr->bound_dev_if = ndev->ifindex; - addr->net =dev_net (ndev);dev_put (ndev);return ret;
Greg Kroah-Hartman
maintainerPATCH 100/125 sunrpc: use constant time memory comparison for mac
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason A. Donenfeld <[email protected]>
commit 15a8b93fd5690de017ce665382ea45e5d61811a4 upstream.
Otherwise, we enable a MAC forgery via timing attack.
--- net/sunrpc/auth_gss/gss_krb5_crypto.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/sunrpc/auth_gss/gss_krb5_crypto.c +2 -1
@@ -34,6 +34,7 @@* WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE. */ +#include <crypto/algapi.h> #include <crypto/hash.h> #include <crypto/skcipher.h> #include <linux/err.h>
@@ -927,7 +928,7 @@ gss_krb5_aes_decrypt(struct krb5_ctx *kcif (ret) goto out_err; -if (memcmp (pkt_hmac, our_hmac, kctx->gk5e->cksumlength) !=0 ) { +if (crypto_memneq (pkt_hmac, our_hmac, kctx->gk5e->cksumlength) !=0 ) { ret =GSS_S_BAD_SIG ; goto out_err; }
Greg Kroah-Hartman
maintainerPATCH 101/125 NFS: only invalidate dentrys that are clearly invalid.
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <[email protected]>
commit cc89684c9a265828ce061037f1f79f4a68ccd3f7 upstream.
Since commit bafc9b754f75 ("vfs: More precise tests in d_invalidate") in v3.18, a return of '0' from ->d_revalidate() will cause the dentry to be invalidated even if it has filesystems mounted on or it or on a descendant. The mounted filesystem is unmounted.
This means we need to be careful not to return 0 unless the directory referred to truly is invalid. So -ESTALE or -ENOENT should invalidate the directory. Other errors such a -EPERM or -ERESTARTSYS should be returned from ->d_revalidate() so they are propagated to the caller.
A particular problem can be demonstrated by:
1/ mount an NFS filesystem using NFSv3 on /mnt
2/ mount any other filesystem on /mnt/foo
3/ ls /mnt/foo
4/ turn off network, or otherwise make the server unable to respond 5/ ls /mnt/foo &
6/ cat /proc/$!/stack # note that nfs_lookup_revalidate is in the call stack 7/ kill -9 $! # this results in -ERESTARTSYS being returned
8/ observe that /mnt/foo has been unmounted.
This patch changes nfs_lookup_revalidate() to only treat
-ESTALE from nfs_lookup_verify_inode() and -ESTALE or -ENOENT from ->lookup()
as indicating an invalid inode. Other errors are returned.
Also nfs_check_inode_attributes() is changed to return -ESTALE rather than -EIO. This is consistent with the error returned in similar circumstances from nfs_update_inode().
As this bug allows any user to unmount a filesystem mounted on an NFS filesystem, this fix is suitable for stable kernels.
--- fs/nfs/dir.c | 12 ++++++++---- fs/nfs/inode.c | 4 ++-- 2 files changed, 10 insertions(+), 6 deletions(-)
fs/nfs/dir.c +8 -4
@@ -1167,11 +1167,13 @@ static int nfs_lookup_revalidate(struct/* Force a full look up iff the parent directory has changed */ if (!nfs_is_exclusive_create (dir, flags) &&nfs_check_verifier (dir, dentry, flags &LOOKUP_RCU )) { - -if (nfs_lookup_verify_inode (inode, flags)) { + error =nfs_lookup_verify_inode (inode, flags); +if (error) {if (flags &LOOKUP_RCU )return -ECHILD ; - goto out_zap_parent; +if (error == -ESTALE ) + goto out_zap_parent; + goto out_error; } goto out_valid; }
@@ -1195,8 +1197,10 @@ static int nfs_lookup_revalidate(structtrace_nfs_lookup_revalidate_enter (dir, dentry, flags); error =NFS_PROTO (dir)->lookup (dir, &dentry->d_name, fhandle, fattr, label);trace_nfs_lookup_revalidate_exit (dir, dentry, flags, error); -if (error) +if (error == -ESTALE || error == -ENOENT ) goto out_bad; +if (error) + goto out_error;if (nfs_compare_fh (NFS_FH (inode), fhandle)) goto out_bad;if ((error =nfs_refresh_inode (inode, fattr)) !=0 )
fs/nfs/inode.c +2 -2
@@ -1278,9 +1278,9 @@ static int nfs_check_inode_attributes(streturn 0 ;/* Has the inode gone and changed behind our back? */ if ((fattr->valid &NFS_ATTR_FATTR_FILEID ) && nfsi->fileid != fattr->fileid) -return -EIO ; +return -ESTALE ;if ((fattr->valid &NFS_ATTR_FATTR_TYPE ) && (inode->i_mode &S_IFMT ) != (fattr->mode &S_IFMT )) -return -EIO ; +return -ESTALE ;if (!nfs_file_has_buffered_writers (nfsi)) {/* Verify a few of the more important attributes */
Greg Kroah-Hartman
maintainerPATCH 102/125 udf: Fix deadlock between writeback and udf_setsize()
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
commit f2e95355891153f66d4156bf3a142c6489cd78c6 upstream.
udf_setsize() called truncate_setsize() with i_data_sem held. Thus truncate_pagecache() called from truncate_setsize() could lock a page under i_data_sem which can deadlock as page lock ranks below i_data_sem - e. g. writeback can hold page lock and try to acquire i_data_sem to map a block.
Fix the problem by moving truncate_setsize() calls from under i_data_sem. It is safe for us to change i_size without holding i_data_sem as all the places that depend on i_size being stable already hold inode_lock.
--- fs/udf/inode.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/udf/inode.c +2 -2
@@ -1243,8 +1243,8 @@ int udf_setsize(struct inode *inode, lofreturn err; } set_size: -truncate_setsize (inode, newsize);up_write (&iinfo->i_data_sem); +truncate_setsize (inode, newsize); }else {if (iinfo->i_alloc_type ==ICBTAG_FLAG_AD_IN_ICB ) {down_write (&iinfo->i_data_sem);
@@ -1261,9 +1261,9 @@ set_size: udf_get_block);if (err)return err; +truncate_setsize (inode, newsize);down_write (&iinfo->i_data_sem);udf_clear_extent_cache (inode); -truncate_setsize (inode, newsize);udf_truncate_extents (inode);up_write (&iinfo->i_data_sem); }
Greg Kroah-Hartman
maintainerPATCH 103/125 target: Fix COMPARE_AND_WRITE caw_sem leak during se_cmd quiesce
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiang Yi <[email protected]>
commit 1d6ef276594a781686058802996e09c8550fd767 upstream.
This patch addresses a COMPARE_AND_WRITE se_device->caw_sem leak, that would be triggered during normal se_cmd shutdown or abort via __transport_wait_for_tasks().
This would occur because target_complete_cmd() would catch this early and do complete_all(&cmd->t_transport_stop_comp), but since target_complete_ok_work() or target_complete_failure_work() are never called to invoke se_cmd->transport_complete_callback(), the COMPARE_AND_WRITE specific callbacks never release caw_sem.
To address this special case, go ahead and release caw_sem directly from target_complete_cmd().
(Remove '&& success' from check, to release caw_sem regardless
of scsi_status - nab)
--- drivers/target/target_core_transport.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/target/target_core_transport.c +9 -0
@@ -753,6 +753,15 @@ void target_complete_cmd(struct se_cmd *if (cmd->transport_state &CMD_T_ABORTED || cmd->transport_state &CMD_T_STOP ) {spin_unlock_irqrestore (&cmd->t_state_lock, flags); +/* +* If COMPARE_AND_WRITE was stopped by __transport_wait_for_tasks(), +* release se_device->caw_sem obtained by sbc_compare_and_write() +* since target_complete_ok_work() or target_complete_failure_work() +* won't be called to invoke the normal CAW completion callbacks. +*/ +if (cmd->se_cmd_flags &SCF_COMPARE_AND_WRITE ) { +up (&dev->caw_sem); + }complete_all (&cmd->t_transport_stop_comp);return ; }else if (!success) {
Greg Kroah-Hartman
maintainerPATCH 104/125 iser-target: Avoid isert_conn->cm_id dereference in isert_login_recv_done
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Bellinger <[email protected]>
commit fce50a2fa4e9c6e103915c351b6d4a98661341d6 upstream.
This patch fixes a NULL pointer dereference in isert_login_recv_done() of isert_conn->cm_id due to isert_cma_handler() -> isert_connect_error() resetting isert_conn->cm_id = NULL during a failed login attempt.
As per Sagi, we will always see the completion of all recv wrs posted on the qp (given that we assigned a ->done handler), this is a FLUSH error completion, we just don't get to verify that because we deref NULL before.
The issue here, was the assumption that dereferencing the connection cm_id is always safe, which is not true since:
commit 4a579da2586bd3b79b025947ea24ede2bbfede62
Author: Sagi Grimberg <[email protected]>
Date: Sun Mar 29 15:52:04 2015 +0300
iser-target: Fix possible deadlock in RDMA_CM connection error
As I see it, we have a direct reference to the isert_device from isert_conn which is the one-liner fix that we actually need like we do in isert_rdma_read_done() and isert_rdma_write_done().
--- drivers/infiniband/ulp/isert/ib_isert.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/ulp/isert/ib_isert.c +1 -1
@@ -1447,7 +1447,7 @@ static void isert_login_recv_done(struct ib_cq *cq, struct ib_wc *wc) { struct isert_conn *isert_conn = wc->qp->qp_context; -struct ib_device *ib_dev = isert_conn->cm_id->device; +struct ib_device *ib_dev = isert_conn->device->ib_device;if (unlikely (wc->status !=IB_WC_SUCCESS )) {isert_print_wc (wc,"login recv" );
Greg Kroah-Hartman
maintainerPATCH 106/125 Revert "perf/core: Drop kernel samples even though :u is specified"
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ingo Molnar <[email protected]>
commit 6a8a75f3235724c5941a33e287b2f98966ad14c5 upstream.
This reverts commit cc1582c231ea041fbc68861dfaf957eaf902b829.
This commit introduced a regression that broke rr-project, which uses sampling events to receive a signal on overflow (but does not care about the contents of the sample). These signals are critical to the correct operation of rr.
There's been some back and forth about how to fix it - but to not keep applications in limbo queue up a revert.
--- kernel/events/core.c | 21 --------------------- 1 file changed, 21 deletions(-)
kernel/events/core.c +0 -21
@@ -7088,21 +7088,6 @@ static void perf_log_itrace_start(structperf_output_end (&handle); } -static bool sample_is_allowed (struct perf_event *event,struct pt_regs *regs) -{ -/* -* Due to interrupt latency (AKA "skid"), we may enter the -* kernel before taking an overflow, even if the PMU is only -* counting user events. -* To avoid leaking information to userspace, we must always -* reject kernel samples when exclude_kernel is set. -*/ -if (event->attr.exclude_kernel && !user_mode (regs)) -return false; - -return true; -} -/* * Generic event overflow handling, sampling. */
@@ -7150,12 +7135,6 @@ static int __perf_event_overflow(struct }/* -* For security, drop the skid kernel samples if necessary. -*/ -if (!sample_is_allowed (event, regs)) -return ret; - -/* * XXX event_limit might not quite work as expected on inherited * events */
Greg Kroah-Hartman
maintainerPATCH 107/125 staging: rtl8188eu: add TL-WN722N v2 support
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Gugino <[email protected]>
commit 5a1d4c5dd4eb2f1f8a9b30e61762f3b3b564df70 upstream.
Add support for USB Device TP-Link TL-WN722N v2.
VendorID: 0x2357, ProductID: 0x010c
--- drivers/staging/rtl8188eu/os_dep/usb_intf.c | 1 + 1 file changed, 1 insertion(+)
drivers/staging/rtl8188eu/os_dep/usb_intf.c +1 -0
@@ -43,6 +43,7 @@ static struct usb_device_id rtw_usb_id_t {USB_DEVICE(0x2001, 0x330F)}, /* DLink DWA-125 REV D1 */ {USB_DEVICE(0x2001, 0x3310)}, /* Dlink DWA-123 REV D1 */ {USB_DEVICE(0x2001, 0x3311)}, /* DLink GO-USB-N150 REV B1 */ + {USB_DEVICE(0x2357, 0x010c)}, /* TP-Link TL-WN722N v2 */ {USB_DEVICE(0x0df6, 0x0076)}, /* Sitecom N150 v2 */ {} /* Terminating entry */ };
Greg Kroah-Hartman
maintainerPATCH 109/125 staging: sm750fb: avoid conflicting vesafb
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Teddy Wang <[email protected]>
commit 740c433ec35187b45abe08bb6c45a321a791be8e upstream.
If vesafb is enabled in the config then /dev/fb0 is created by vesa and this sm750 driver gets fb1, fb2. But we need to be fb0 and fb1 to effectively work with xorg.
So if it has been alloted fb1, then try to remove the other fb0.
In the previous send, why #ifdef is used was asked.
https://lkml.org/lkml/2017/6/25/57
Answered at: https://lkml.org/lkml/2017/6/25/69
Also pasting here for reference.
'Did a quick research into "why".
The patch d8801e4df91e ("x86/PCI: Set IORESOURCE_ROM_SHADOW only for the default VGA device") has started setting IORESOURCE_ROM_SHADOW in flags for a default VGA device and that is being done only for x86. And so, we will need that #ifdef to check IORESOURCE_ROM_SHADOW as that needs to be checked only for a x86 and not for other arch.'
--- drivers/staging/sm750fb/sm750.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+)
drivers/staging/sm750fb/sm750.c +24 -0
@@ -1049,6 +1049,26 @@ release_fb:return err; } +static int lynxfb_kick_out_firmware_fb (struct pci_dev *pdev) +{ +struct apertures_struct *ap; +bool primary = false; + + ap =alloc_apertures (1 ); +if (!ap) +return -ENOMEM ; + + ap->ranges[0 ].base =pci_resource_start (pdev,0 ); + ap->ranges[0 ].size =pci_resource_len (pdev,0 ); +#ifdef CONFIG_X86 + primary = pdev->resource[PCI_ROM_RESOURCE ].flags & +IORESOURCE_ROM_SHADOW ; +#endif +remove_conflicting_framebuffers (ap,"sm750_fb1" , primary); +kfree (ap); +return 0 ; +} +static int lynxfb_pci_probe (struct pci_dev *pdev,const struct pci_device_id *ent) {
@@ -1057,6 +1077,10 @@ static int lynxfb_pci_probe(struct pci_dint fbidx;int err; + err =lynxfb_kick_out_firmware_fb (pdev); +if (err) +return err; +/* enable device */ err =pcim_enable_device (pdev);if (err)
Greg Kroah-Hartman
maintainerPATCH 110/125 staging: lustre: ko2iblnd: check copy_from_iter/copy_to_iter return code
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
commit 566e1ce22e04426fa52328b2adcdf1df49acd98e upstream.
We now get a helpful warning for code that calls copy_{from,to}_iter without checking the return value, introduced by commit aa28de275a24 ("iov_iter/hardening: move object size checks to inlined part").
drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c: In function 'kiblnd_send':drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c:1643:2: error: ignoring return value of 'copy_from_iter', declared with attribute warn_unused_result [-Werror=unused-result] drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c: In function 'kiblnd_recv':drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c:1744:3: error: ignoring return value of 'copy_to_iter', declared with attribute warn_unused_result [-Werror=unused-result]
In case we get short copies here, we may get incorrect behavior. I've added failure handling for both rx and tx now, returning -EFAULT as expected.
--- drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c | 19 +++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-)
drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c +15 -4
@@ -1650,8 +1650,13 @@ kiblnd_send(lnet_ni_t *ni, void *private ibmsg = tx->tx_msg; ibmsg->ibm_u.immediate.ibim_hdr = *hdr; -copy_from_iter (&ibmsg->ibm_u.immediate.ibim_payload,IBLND_MSG_SIZE , - &from); + rc =copy_from_iter (&ibmsg->ibm_u.immediate.ibim_payload, payload_nob, + &from); +if (rc != payload_nob) { +kiblnd_pool_free_node (&tx->tx_pool->tpo_pool, &tx->tx_list); +return -EFAULT ; + } + nob = offsetof(struct kib_immediate_msg, ibim_payload[payload_nob]);kiblnd_init_tx_msg (ni, tx,IBLND_MSG_IMMEDIATE , nob);
@@ -1751,8 +1756,14 @@ kiblnd_recv(lnet_ni_t *ni, void *privatebreak ; } -copy_to_iter (&rxmsg->ibm_u.immediate.ibim_payload, -IBLND_MSG_SIZE , to); + rc =copy_to_iter (&rxmsg->ibm_u.immediate.ibim_payload, rlen, + to); +if (rc != rlen) { + rc = -EFAULT ; +break ; + } + + rc =0 ;lnet_finalize (ni, lntmsg,0 );break ;
Greg Kroah-Hartman
maintainerPATCH 111/125 ceph: fix race in concurrent readdir
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yan, Zheng <[email protected]>
commit 84583cfb973c4313955c6231cc9cb3772d280b15 upstream.
For a large directory, program needs to issue multiple readdir syscalls to get all dentries. When there are multiple programs read the directory concurrently. Following sequence of events can happen.
- program calls readdir with pos = 2. ceph sends readdir request to mds. The reply contains N1 entries. ceph adds these N1 entries to readdir cache.
- program calls readdir with pos = N1+2. The readdir is satisfied by the readdir cache, N2 entries are returned. (Other program calls readdir in the middle, which fills the cache)
- program calls readdir with pos = N1+N2+2. ceph sends readdir request to mds. The reply contains N3 entries and it reaches directory end. ceph adds these N3 entries to the readdir cache and marks directory complete.
The second readdir call does not update fi->readdir_cache_idx. ceph add the last N3 entries to wrong places.
--- fs/ceph/dir.c | 5 +++++ 1 file changed, 5 insertions(+)
fs/ceph/dir.c +5 -0
@@ -292,6 +292,11 @@ out:if (ret <0 ) err = ret;dput (last); +/* last_name no longer match cache index */ +if (fi->readdir_cache_idx >=0 ) { + fi->readdir_cache_idx =-1 ; + fi->dir_release_count =0 ; + } }return err; }
Greg Kroah-Hartman
maintainerPATCH 112/125 RDMA/core: Initialize port_num in qp_attr
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ismail, Mustafa <[email protected]>
commit a62ab66b13a0f9bcb17b7b761f6670941ed5cd62 upstream.
Initialize the port_num for iWARP in rdma_init_qp_attr.
--- drivers/infiniband/core/cma.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/infiniband/core/cma.c +2 -0
@@ -976,6 +976,8 @@ int rdma_init_qp_attr(struct rdma_cm_id }else ret =iw_cm_init_qp_attr (id_priv->cm_id.iw, qp_attr, qp_attr_mask); + qp_attr->port_num = id_priv->id.port_num; + *qp_attr_mask |=IB_QP_PORT ; }else ret = -ENOSYS ;
Greg Kroah-Hartman
maintainerPATCH 113/125 drm/mst: Fix error handling during MST sideband message reception
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Imre Deak <[email protected]>
commit 448421b5e93b9177c5698f0cf6f5e72d2995eeca upstream.
Handle any error due to partial reads, timeouts etc. to avoid parsing uninitialized data subsequently. Also bail out if the parsing itself fails.
--- drivers/gpu/drm/drm_dp_mst_topology.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/gpu/drm/drm_dp_mst_topology.c +8 -2
@@ -2200,11 +2200,17 @@ static void drm_dp_get_one_sb_msg(struct ret =drm_dp_dpcd_read (mgr->aux, basereg + curreply, replyblock, len);if (ret != len) { -DRM_DEBUG_KMS ("failed to read a chunk\n" ); +DRM_DEBUG_KMS ("failed to read a chunk (len %d, ret %d)\n" , + len, ret); +return ; } + ret =drm_dp_sideband_msg_build (msg, replyblock, len, false); -if (ret == false) +if (!ret) {DRM_DEBUG_KMS ("failed to build sideband msg\n" ); +return ; + } + curreply += len; replylen -= len; }
Greg Kroah-Hartman
maintainerPATCH 114/125 drm/mst: Avoid dereferencing a NULL mstb in drm_dp_mst_handle_up_req()
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Imre Deak <[email protected]>
commit 7f8b3987da54cb4d41ad2545cd4d7958b9a36bdf upstream.
In case of an unknown broadcast message is sent mstb will remain unset, so check for this.
--- drivers/gpu/drm/drm_dp_mst_topology.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/drm_dp_mst_topology.c +3 -1
@@ -2328,7 +2328,9 @@ static int drm_dp_mst_handle_up_req(struDRM_DEBUG_KMS ("Got RSN: pn: %d avail_pbn %d\n" , msg.u.resource_stat.port_number, msg.u.resource_stat.available_pbn); } -drm_dp_put_mst_branch_device (mstb); +if (mstb) +drm_dp_put_mst_branch_device (mstb); +memset (&mgr->up_req_recv,0 ,sizeof (struct drm_dp_sideband_msg_rx )); }return ret;
Greg Kroah-Hartman
maintainerPATCH 115/125 drm/mst: Avoid processing partially received up/down message transactions
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Imre Deak <[email protected]>
commit 636c4c3e762b62aa93632c645ca65879285b16e3 upstream.
Currently we may process up/down message transactions containing uninitialized data. This can happen if there was an error during the reception of any message in the transaction, but we happened to receive the last message correctly with the end-of-message flag set.
To avoid this abort the reception of the transaction when the first error is detected, rejecting any messages until a message with the start-of-message flag is received (which will start a new transaction). This is also what the DP 1.4 spec 2.11.8.2 calls for in this case.
In addtion this also prevents receiving bogus transactions without the first message with the the start-of-message flag set.
v2:
- unchanged
v3:
- git add the part that actually skips messages after an error in drm_dp_sideband_msg_build()
--- drivers/gpu/drm/drm_dp_mst_topology.c | 31 ++++++++++++++++++++++++------- 1 file changed, 24 insertions(+), 7 deletions(-)
drivers/gpu/drm/drm_dp_mst_topology.c +24 -7
@@ -330,6 +330,13 @@ static bool drm_dp_sideband_msg_build(streturn false; } +/* +* ignore out-of-order messages or messages that are part of a +* failed transaction +*/ +if (!recv_hdr.somt && !msg->have_somt) +return false; +/* get length contained in this portion */ msg->curchunk_len = recv_hdr.msg_len; msg->curchunk_hdrlen = hdrlen;
@@ -2168,7 +2175,7 @@ out_unlock: }EXPORT_SYMBOL (drm_dp_mst_topology_mgr_resume); -static void drm_dp_get_one_sb_msg (struct drm_dp_mst_topology_mgr *mgr,bool up) +static bool drm_dp_get_one_sb_msg (struct drm_dp_mst_topology_mgr *mgr,bool up) {int len;u8 replyblock[32 ];
@@ -2183,12 +2190,12 @@ static void drm_dp_get_one_sb_msg(struct replyblock, len);if (ret != len) {DRM_DEBUG_KMS ("failed to read DPCD down rep %d %d\n" , len, ret); -return ; +return false; } ret =drm_dp_sideband_msg_build (msg, replyblock, len, true);if (!ret) {DRM_DEBUG_KMS ("sideband msg build failed %d\n" , replyblock[0 ]); -return ; +return false; } replylen = msg->curchunk_len + msg->curchunk_hdrlen;
@@ -2202,25 +2209,30 @@ static void drm_dp_get_one_sb_msg(structif (ret != len) {DRM_DEBUG_KMS ("failed to read a chunk (len %d, ret %d)\n" , len, ret); -return ; +return false; } ret =drm_dp_sideband_msg_build (msg, replyblock, len, false);if (!ret) {DRM_DEBUG_KMS ("failed to build sideband msg\n" ); -return ; +return false; } curreply += len; replylen -= len; } +return true; }static int drm_dp_mst_handle_down_rep (struct drm_dp_mst_topology_mgr *mgr) {int ret =0 ; -drm_dp_get_one_sb_msg (mgr, false); +if (!drm_dp_get_one_sb_msg (mgr, false)) { +memset (&mgr->down_rep_recv,0 , +sizeof (struct drm_dp_sideband_msg_rx )); +return 0 ; + }if (mgr->down_rep_recv.have_eomt) {struct drm_dp_sideband_msg_tx *txmsg;
@@ -2276,7 +2288,12 @@ static int drm_dp_mst_handle_down_rep(ststatic int drm_dp_mst_handle_up_req (struct drm_dp_mst_topology_mgr *mgr) {int ret =0 ; -drm_dp_get_one_sb_msg (mgr, true); + +if (!drm_dp_get_one_sb_msg (mgr, true)) { +memset (&mgr->up_req_recv,0 , +sizeof (struct drm_dp_sideband_msg_rx )); +return 0 ; + }if (mgr->up_req_recv.have_eomt) {struct drm_dp_sideband_msg_req_body msg;
Greg Kroah-Hartman
maintainerPATCH 116/125 mlx5: Avoid that mlx5_ib_sg_to_klms() overflows the klms[] array
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <[email protected]>
commit 99975cd4fda52974a767aa44fe0b1a8f74950d9d upstream.
ib_map_mr_sg() can pass an SG-list to .map_mr_sg() that is larger than what fits into a single MR. .map_mr_sg() must not attempt to map more SG-list elements than what fits into a single MR. Hence make sure that mlx5_ib_sg_to_klms() does not write outside the MR klms[] array.
--- drivers/infiniband/hw/mlx5/mr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/mlx5/mr.c +1 -1
@@ -1823,7 +1823,7 @@ mlx5_ib_sg_to_klms(struct mlx5_ib_mr *mr mr->ndescs = sg_nents;for_each_sg (sgl, sg, sg_nents, i) { -if (unlikely (i > mr->max_descs)) +if (unlikely (i >= mr->max_descs))break ; klms[i].va =cpu_to_be64 (sg_dma_address (sg) + sg_offset); klms[i].bcount =cpu_to_be32 (sg_dma_len (sg) - sg_offset);
Greg Kroah-Hartman
maintainerPATCH 117/125 hfsplus: Dont clear SGID when inheriting ACLs
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
commit 84969465ddc4f8aeb3b993123b571aa01c5f2683 upstream.
When new directory 'DIR1' is created in a directory 'DIR0' with SGID bit set, DIR1 is expected to have SGID bit set (and owning group equal to the owning group of 'DIR0'). However when 'DIR0' also has some default ACLs that 'DIR1' inherits, setting these ACLs will result in SGID bit on 'DIR1' to get cleared if user is not member of the owning group.
Fix the problem by creating __hfsplus_set_posix_acl() function that does not call posix_acl_update_mode() and use it when inheriting ACLs. That prevents SGID bit clearing and the mode has been properly set by posix_acl_create() anyway.
--- fs/hfsplus/posix_acl.c | 30 ++++++++++++++++++------------ 1 file changed, 18 insertions(+), 12 deletions(-)
fs/hfsplus/posix_acl.c +18 -12
@@ -51,8 +51,8 @@ struct posix_acl *hfsplus_get_posix_acl(return acl; } -int hfsplus_set_posix_acl (struct inode *inode,struct posix_acl *acl, -int type) +static int __hfsplus_set_posix_acl (struct inode *inode,struct posix_acl *acl, +int type) {int err;char *xattr_name;
@@ -64,12 +64,6 @@ int hfsplus_set_posix_acl(struct inode *switch (type) {case ACL_TYPE_ACCESS : xattr_name =XATTR_NAME_POSIX_ACL_ACCESS ; -if (acl) { - err =posix_acl_update_mode (inode, &inode->i_mode, &acl); -if (err) -return err; - } - err =0 ;break ;case ACL_TYPE_DEFAULT :
@@ -105,6 +99,18 @@ end_set_acl:return err; } +int hfsplus_set_posix_acl (struct inode *inode,struct posix_acl *acl,int type) +{ +int err; + +if (type ==ACL_TYPE_ACCESS && acl) { + err =posix_acl_update_mode (inode, &inode->i_mode, &acl); +if (err) +return err; + } +return __hfsplus_set_posix_acl (inode, acl, type); +} +int hfsplus_init_posix_acl (struct inode *inode,struct inode *dir) {int err =0 ;
@@ -122,15 +128,15 @@ int hfsplus_init_posix_acl(struct inodereturn err;if (default_acl) { - err =hfsplus_set_posix_acl (inode, default_acl, -ACL_TYPE_DEFAULT ); + err =__hfsplus_set_posix_acl (inode, default_acl, +ACL_TYPE_DEFAULT );posix_acl_release (default_acl); }if (acl) {if (!err) - err =hfsplus_set_posix_acl (inode, acl, -ACL_TYPE_ACCESS ); + err =__hfsplus_set_posix_acl (inode, acl, +ACL_TYPE_ACCESS );posix_acl_release (acl); }return err;
Greg Kroah-Hartman
maintainerPATCH 118/125 ovl: fix random return value on mount
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amir Goldstein <[email protected]>
commit 8fc646b44385ff0a9853f6590497e43049eeb311 upstream.
On failure to prepare_creds(), mount fails with a random return value, as err was last set to an integer cast of a valid lower mnt pointer or set to 0 if inodes index feature is enabled.
--- fs/overlayfs/super.c | 1 + 1 file changed, 1 insertion(+)
fs/overlayfs/super.c +1 -0
@@ -1310,6 +1310,7 @@ static int ovl_fill_super(struct super_belse sb->s_d_op = &ovl_dentry_operations; + err = -ENOMEM ; ufs->creator_cred = cred =prepare_creds ();if (!cred) goto out_put_lower_mnt;
Greg Kroah-Hartman
maintainerPATCH 119/125 acpi/nfit: Fix memory corruption/Unregister mce decoder on failure
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Prarit Bhargava <[email protected]>
commit 7e700d2c59e5853c9126642976b4f5768f64c9b3 upstream.
nfit_init() calls nfit_mce_register() on module load. When the module load fails the nfit mce decoder is not unregistered. The module's memory is freed leaving the decoder chain referencing junk. This will cause panics as future registrations will reference the free'd memory.
Unregister the nfit mce decoder on module init failure.
[v2]: register and then unregister mce handler to avoid losing mce events [v3]: also cleanup nfit workqueue
--- drivers/acpi/nfit/core.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
drivers/acpi/nfit/core.c +9 -1
@@ -2945,6 +2945,8 @@ static struct acpi_driver acpi_nfit_drivstatic __init int nfit_init (void ) { +int ret; +BUILD_BUG_ON (sizeof (struct acpi_table_nfit ) !=40 );BUILD_BUG_ON (sizeof (struct acpi_nfit_system_address ) !=56 );BUILD_BUG_ON (sizeof (struct acpi_nfit_memory_map ) !=48 );
@@ -2972,8 +2974,14 @@ static __init int nfit_init(void)return -ENOMEM ;nfit_mce_register (); + ret =acpi_bus_register_driver (&acpi_nfit_driver); +if (ret) { +nfit_mce_unregister (); +destroy_workqueue (nfit_wq); + } + +return ret; -return acpi_bus_register_driver (&acpi_nfit_driver); } static __exit void nfit_exit(void)
Greg Kroah-Hartman
maintainerPATCH 120/125 of: device: Export of_device_{get_modalias, uvent_modalias} to modules
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Boyd <[email protected]>
commit 7a3b7cd332db08546f3cdd984f11773e0d1999e7 upstream.
The ULPI bus can be built as a module, and it will soon be calling these functions when it supports probing devices from DT. Export them so they can be used by the ULPI module.
--- drivers/of/device.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/of/device.c +2 -0
@@ -225,6 +225,7 @@ ssize_t of_device_get_modalias(struct dereturn tsize; } +EXPORT_SYMBOL_GPL (of_device_get_modalias);/** * of_device_uevent - Display OF related uevent information
@@ -287,3 +288,4 @@ int of_device_uevent_modalias(struct devreturn 0 ; } +EXPORT_SYMBOL_GPL (of_device_uevent_modalias);
Greg Kroah-Hartman
maintainerPATCH 121/125 spmi: Include OF based modalias in device uevent
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bjorn Andersson <[email protected]>
commit d50daa2af2618dab6d21634e65a5fbcf4ae437d6 upstream.
Include the OF-based modalias in the uevent sent when registering SPMI devices, so that user space has a chance to autoload the kernel module for the device.
--- drivers/spmi/spmi.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/spmi/spmi.c +12 -0
@@ -365,11 +365,23 @@ static int spmi_drv_remove(struct devicereturn 0 ; } +static int spmi_drv_uevent (struct device *dev,struct kobj_uevent_env *env) +{ +int ret; + + ret =of_device_uevent_modalias (dev, env); +if (ret != -ENODEV ) +return ret; + +return 0 ; +} +static struct bus_type spmi_bus_type = { .name ="spmi" , .match = spmi_device_match, .probe = spmi_drv_probe, .remove = spmi_drv_remove, + .uevent = spmi_drv_uevent, };/**
Greg Kroah-Hartman
maintainerPATCH 122/125 reiserfs: Dont clear SGID when inheriting ACLs
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
commit 6883cd7f68245e43e91e5ee583b7550abf14523f upstream.
When new directory 'DIR1' is created in a directory 'DIR0' with SGID bit set, DIR1 is expected to have SGID bit set (and owning group equal to the owning group of 'DIR0'). However when 'DIR0' also has some default ACLs that 'DIR1' inherits, setting these ACLs will result in SGID bit on 'DIR1' to get cleared if user is not member of the owning group.
Fix the problem by moving posix_acl_update_mode() out of __reiserfs_set_acl() into reiserfs_set_acl(). That way the function will not be called when inheriting ACLs which is what we want as it prevents SGID bit clearing and the mode has been properly set by posix_acl_create() anyway.
--- fs/reiserfs/xattr_acl.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
fs/reiserfs/xattr_acl.c +7 -5
@@ -37,7 +37,14 @@ reiserfs_set_acl(struct inode *inode, st error =journal_begin (&th, inode->i_sb, jcreate_blocks);reiserfs_write_unlock (inode->i_sb);if (error ==0 ) { +if (type ==ACL_TYPE_ACCESS && acl) { + error =posix_acl_update_mode (inode, &inode->i_mode, + &acl); +if (error) + goto unlock; + } error =__reiserfs_set_acl (&th, inode, type, acl); +unlock:reiserfs_write_lock (inode->i_sb); error2 =journal_end (&th);reiserfs_write_unlock (inode->i_sb);
@@ -241,11 +248,6 @@ __reiserfs_set_acl(struct reiserfs_transswitch (type) {case ACL_TYPE_ACCESS : name =XATTR_NAME_POSIX_ACL_ACCESS ; -if (acl) { - error =posix_acl_update_mode (inode, &inode->i_mode, &acl); -if (error) -return error; - }break ;case ACL_TYPE_DEFAULT : name =XATTR_NAME_POSIX_ACL_DEFAULT ;
Greg Kroah-Hartman
maintainerPATCH 123/125 PM / Domains: defer dev_pm_domain_set() until genpd->attach_dev succeeds if present
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudeep Holla <[email protected]>
commit 975e83cfb8dc16e7a2fdc58188c77c0c605876c2 upstream.
If the genpd->attach_dev or genpd->power_on fails, genpd_dev_pm_attach may return -EPROBE_DEFER initially. However genpd_alloc_dev_data sets the PM domain for the device unconditionally.
When subsequent attempts are made to call genpd_dev_pm_attach, it may return -EEXISTS checking dev->pm_domain without re-attempting to call attach_dev or power_on.
platform_drv_probe then attempts to call drv->probe as the return value -EEXIST != -EPROBE_DEFER, which may end up in a situation where the device is accessed without it's power domain switched on.
--- drivers/base/power/domain.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/base/power/domain.c +4 -4
@@ -1029,8 +1029,6 @@ static struct generic_pm_domain_data *gespin_unlock_irq (&dev->power.lock); -dev_pm_domain_set (dev, &genpd->domain); -return gpd_data; err_free:
@@ -1044,8 +1042,6 @@ static struct generic_pm_domain_data *gestatic void genpd_free_dev_data (struct device *dev,struct generic_pm_domain_data *gpd_data) { -dev_pm_domain_set (dev,NULL ); -spin_lock_irq (&dev->power.lock); dev->power.subsys_data->domain_data =NULL ;
@@ -1082,6 +1078,8 @@ static int genpd_add_device(struct generif (ret) goto out; +dev_pm_domain_set (dev, &genpd->domain); + genpd->device_count++; genpd->max_off_time_changed = true;
@@ -1143,6 +1141,8 @@ static int genpd_remove_device(struct geif (genpd->detach_dev) genpd->detach_dev (genpd, dev); +dev_pm_domain_set (dev,NULL ); +list_del_init (&pdd->list_node);mutex_unlock (&genpd->lock);
Greg Kroah-Hartman
maintainerPATCH 124/125 tracing: Fix kmemleak in instance_rmdir
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chunyu Hu <[email protected]>
commit db9108e054700c96322b0f0028546aa4e643cf0b upstream.
Hit the kmemleak when executing instance_rmdir, it forgot releasing mem of tracing_cpumask. With this fix, the warn does not appear any more.
unreferenced object 0xffff93a8dfaa7c18 (size 8):
comm "mkdir", pid 1436, jiffies 4294763622 (age 9134.308s) hex dump (first 8 bytes):
ff ff ff ff ff ff ff ff ........
backtrace:
[<ffffffff88b6567a>] kmemleak_alloc+0x4a/0xa0
[<ffffffff8861ea41>] __kmalloc_node+0xf1/0x280
[<ffffffff88b505d3>] alloc_cpumask_var_node+0x23/0x30
[<ffffffff88b5060e>] alloc_cpumask_var+0xe/0x10
[<ffffffff88571ab0>] instance_mkdir+0x90/0x240
[<ffffffff886e5100>] tracefs_syscall_mkdir+0x40/0x70
[<ffffffff886565c9>] vfs_mkdir+0x109/0x1b0
[<ffffffff8865b1d0>] SyS_mkdir+0xd0/0x100
[<ffffffff88403857>] do_syscall_64+0x67/0x150
[<ffffffff88b710e7>] return_from_SYSCALL_64+0x0/0x6a
[<ffffffffffffffff>] 0xffffffffffffffff--- kernel/trace/trace.c | 1 + 1 file changed, 1 insertion(+)
kernel/trace/trace.c +1 -0
@@ -7162,6 +7162,7 @@ static int instance_rmdir(const char *na }kfree (tr->topts); +free_cpumask_var (tr->tracing_cpumask);kfree (tr->name);kfree (tr);
Greg Kroah-Hartman
maintainerPATCH 125/125 alarmtimer: dont rate limit one-shot timers
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Hackmann <[email protected]>
Commit ff86bf0c65f1 ("alarmtimer: Rate limit periodic intervals") sets a minimum bound on the alarm timer interval. This minimum bound shouldn't be applied if the interval is 0. Otherwise, one-shot timers will be converted into periodic ones.
--- kernel/time/alarmtimer.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
kernel/time/alarmtimer.c +2 -1
@@ -629,7 +629,8 @@ static int alarm_timer_set(struct k_itim* Rate limit to the tick as a hot fix to prevent DOS. Will be * mopped up later. */ -if (ktime_to_ns (timr->it.alarm.interval) <TICK_NSEC ) +if (timr->it.alarm.interval.tv64 && +ktime_to_ns (timr->it.alarm.interval) <TICK_NSEC ) timr->it.alarm.interval =ktime_set (0 ,TICK_NSEC ); exp =timespec_to_ktime (new_setting->it_value);
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.9.40 release. There are 125 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu Jul 27 19:19:43 UTC 2017. Anything received after that time might be too late.
Build results:
total: 145 pass: 145 fail: 0 Qemu test results: total: 122 pass: 122 fail: 0
Details are available at http://kerneltests.org/builders.
Guenter
Hi Greg,
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.9.40 release. There are 125 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu Jul 27 19:19:43 UTC 2017. Anything received after that time might be too late.
For ARM64, built and boot tested with defconfig on Hikey - no regressions noted.
Quoted 10 lines
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.40-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.9.y
and the diffstat can be found below.thanks,
greg k-h
Best,
Sumit.
Greg Kroah-Hartman
maintainerQuoted 8 lines · Sumit Semwal
Hi Greg,
Quoted 5 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.9.40 release. There are 125 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Quoted 4 lines
Quoted 3 lines
Responses should be made by Thu Jul 27 19:19:43 UTC 2017. Anything received after that time might be too late.
For ARM64, built and boot tested with defconfig on Hikey - no regressions noted.
Thanks for testing and letting me know.
greg k-h
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.9.40 release. There are 125 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu Jul 27 19:19:43 UTC 2017. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.40-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.9.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah