4.9.66-stable review
Subsystems (2)
Greg Kroah-Hartman
maintainercover 4.9.66-stable review
This is the start of the stable review cycle for the 4.9.66 release. There are 138 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu Nov 30 10:05:07 UTC 2017. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.66-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.9.66-rc1
Juergen Gross <[email protected]>
xen: xenbus driver must not accept invalid transaction ids
Daniel Verkamp <[email protected]>
nvmet: fix KATO offset in Set Features
Hans Verkuil <[email protected]>
cec: update log_addr[] before finishing configuration
Hans Verkuil <[email protected]>
cec: CEC_MSG_GIVE_FEATURES should abort for CEC version < 2
Hans Verkuil <[email protected]>
cec: when canceling a message, don't overwrite old status info
Heiko Carstens <[email protected]>
s390/kbuild: enable modversions for symbols exported from asm
Richard Fitzgerald <[email protected]>
ASoC: wm_adsp: Don't overrun firmware file buffer when reading region data
Pan Bian <[email protected]>
btrfs: return the actual error value from from btrfs_uuid_tree_iterate
Romain Perier <[email protected]>
crypto: marvell - Copy IVDIG before launching partial DMA ahash requests
Colin Ian King <[email protected]>
ASoC: rsnd: don't double free kctrl
Florian Westphal <[email protected]>
netfilter: nf_tables: fix oob access
Pablo Neira Ayuso <[email protected]>
netfilter: nft_queue: use raw_smp_processor_id()
Geert Uytterhoeven <[email protected]>
spi: SPI_FSL_DSPI should depend on HAS_DMA
Pan Bian <[email protected]>
staging: iio: cdc: fix improper return value
Pan Bian <[email protected]>
iio: light: fix improper return value
Alexey Khoroshilov <[email protected]>
adm80211: add checks for dma mapping errors
Masashi Honma <[email protected]>
mac80211: Suppress NEW_PEER_CANDIDATE event if no room
Masashi Honma <[email protected]>
mac80211: Remove invalid flag operations in mesh TSF synchronization
Daniel Vetter <[email protected]>
drm/mediatek: don't use drm_put_dev
Abhishek Sahu <[email protected]>
clk: qcom: ipq4019: Add all the frequencies for apss cpu
Chris Wilson <[email protected]>
drm: Apply range restriction after color adjustment when allocation
Bartosz Golaszewski <[email protected]>
gpio: mockup: dynamically allocate memory for chip name
Gabriele Mazzotta <[email protected]>
ALSA: hda - Apply ALC269_FIXUP_NO_SHUTUP on HDA_FIXUP_ACT_PROBE
Bartosz Markowski <[email protected]>
ath10k: set CTS protection VDEV param only if VDEV is up
Michael Chan <[email protected]>
bnxt_en: Set default completion ring for async events.
Christophe JAILLET <[email protected]>
pinctrl: sirf: atlas7: Add missing 'of_node_put()'
Christian Lamparter <[email protected]>
ath10k: fix potential memory leak in ath10k_wmi_tlv_op_pull_fw_stats()
Ryan Hsu <[email protected]>
ath10k: ignore configuring the incorrect board_id
Ryan Hsu <[email protected]>
ath10k: fix incorrect txpower set by P2P_DEVICE interface
Amitkumar Karwar <[email protected]>
mwifiex: sdio: fix use after free issue for save_adapter
Dan Carpenter <[email protected]>
adm80211: return an error if adm8211_alloc_rings() fails
Stanislaw Gruszka <[email protected]>
rt2800: set minimum MPDU and PSDU lengths to sane values
Daniel Vetter <[email protected]>
drm/armada: Fix compile fail
Thomas Preisner <[email protected]>
net: 3com: typhoon: typhoon_init_one: fix incorrect return values
Thomas Preisner <[email protected]>
net: 3com: typhoon: typhoon_init_one: make return values more specific
David Ahern <[email protected]>
net: Allow IP_MULTICAST_IF to set index to L3 slave
Eric Biggers <[email protected]>
fscrypt: use ENOTDIR when setting encryption policy on nondirectory
Eric Biggers <[email protected]>
fscrypt: use ENOKEY when file cannot be created w/o key
Shawn Guo <[email protected]>
dmaengine: zx: set DMA_CYCLIC cap_mask bit
Icenowy Zheng <[email protected]>
clk: sunxi-ng: fix PLL_CPUX adjusting on A33
Marcus Cooper <[email protected]>
clk: sunxi-ng: A31: Fix spdif clock register
Christophe JAILLET <[email protected]>
drm/sun4i: Fix a return value in case of error
Bjorn Helgaas <[email protected]>
PCI: Apply _HPX settings only to relevant devices
Santosh Shilimkar <[email protected]>
RDS: RDMA: fix the ib_map_mr_sg_zbva() argument
Santosh Shilimkar <[email protected]>
RDS: RDMA: return appropriate error on rdma map failures
Avinash Repaka <[email protected]>
RDS: make message size limit compliant with spec
Benjamin Poirier <[email protected]>
e1000e: Avoid receiver overrun interrupt bursts
Benjamin Poirier <[email protected]>
e1000e: Separate signaling for link check/link up
Benjamin Poirier <[email protected]>
e1000e: Fix return value test
Benjamin Poirier <[email protected]>
e1000e: Fix error path in link detection
Greg Kroah-Hartman <[email protected]>
Revert "drm/i915: Do not rely on wm preservation for ILK watermarks"
Tobias Jordan <[email protected]>
PM / OPP: Add missing of_node_put(np)
Tuomas Tynkkynen <[email protected]>
net/9p: Switch to wait_event_killable()
Eric Biggers <[email protected]>
fscrypt: lock mutex before checking for bounce page pool
Steven Rostedt (Red Hat) <[email protected]>
sched/rt: Simplify the IPI based RT balancing logic
Ricardo Ribalda Delgado <[email protected]>
media: v4l2-ctrl: Fix flags field on Control events
Johan Hovold <[email protected]>
cx231xx-cards: fix NULL-deref on missing association descriptor
Sean Young <[email protected]>
media: rc: check for integer overflow
Michele Baldessari <[email protected]>
media: Don't do DMA on stack for firmware upload in the AS102 driver
Naveen N. Rao <[email protected]>
powerpc/signal: Properly handle return value from uprobe_deny_signal()
John David Anglin <[email protected]>
parisc: Fix validity check of pointer size argument in new CAS implementation
Brian King <[email protected]>
ixgbe: Fix skb list corruption on Power systems
Brian King <[email protected]>
fm10k: Use smp_rmb rather than read_barrier_depends
Brian King <[email protected]>
i40evf: Use smp_rmb rather than read_barrier_depends
Brian King <[email protected]>
ixgbevf: Use smp_rmb rather than read_barrier_depends
Brian King <[email protected]>
igbvf: Use smp_rmb rather than read_barrier_depends
Brian King <[email protected]>
igb: Use smp_rmb rather than read_barrier_depends
Brian King <[email protected]>
i40e: Use smp_rmb rather than read_barrier_depends
Johan Hovold <[email protected]>
NFC: fix device-allocation error return
Bart Van Assche <[email protected]>
IB/srp: Avoid that a cable pull can trigger a kernel crash
Bart Van Assche <[email protected]>
IB/srpt: Do not accept invalid initiator port names
Dan Williams <[email protected]>
libnvdimm, namespace: make 'resource' attribute only readable by root
Dan Williams <[email protected]>
libnvdimm, namespace: fix label initialization to use valid seq numbers
Dan Williams <[email protected]>
libnvdimm, pfn: make 'resource' attribute only readable by root
Johan Hovold <[email protected]>
clk: ti: dra7-atl-clock: fix child-node lookups
Trond Myklebust <[email protected]>
SUNRPC: Fix tracepoint storage issues with svc_recv and svc_rqst_status
Paolo Bonzini <[email protected]>
KVM: SVM: obey guest PAT
Ladi Prosek <[email protected]>
KVM: nVMX: set IDTR and GDTR limits when loading L1 host state
Vasily Averin <[email protected]>
lockd: double unregister of inetaddr notifiers
Johan Hovold <[email protected]>
irqchip/gic-v3: Fix ppi-partitions lookup
Bart Van Assche <[email protected]>
block: Fix a race between blk_cleanup_queue() and timeout handling
Andrey Konovalov <[email protected]>
p54: don't unregister leds when they are not initialized
Xiaolei Li <[email protected]>
mtd: nand: mtk: fix infinite ECC decode IRQ issue
Brent Taylor <[email protected]>
mtd: nand: Fix writing mtdoops to nand flash.
Roger Quadros <[email protected]>
mtd: nand: omap2: Fix subpage write
Nicholas Bellinger <[email protected]>
target: Fix QUEUE_FULL + SCSI task attribute handling
Nicholas Bellinger <[email protected]>
iscsi-target: Fix non-immediate TMR reference leak
Tuomas Tynkkynen <[email protected]>
fs/9p: Compare qid.path in v9fs_test_inode
Al Viro <[email protected]>
fix a page leak in vhost_scsi_iov_to_sgl() error recovery
Kailang Yang <[email protected]>
ALSA: hda/realtek - Fix ALC700 family no sound issue
Takashi Iwai <[email protected]>
ALSA: hda: Fix too short HDMI/DP chmap reporting
Takashi Iwai <[email protected]>
ALSA: timer: Remove kernel warning at compat ioctl error paths
Takashi Iwai <[email protected]>
ALSA: usb-audio: Add sanity checks in v2 clock parsers
Takashi Iwai <[email protected]>
ALSA: usb-audio: Fix potential out-of-bound access at parsing SU
Takashi Iwai <[email protected]>
ALSA: usb-audio: Add sanity checks to FE parser
Henrik Eriksson <[email protected]>
ALSA: pcm: update tstamp only if audio_tstamp changed
Theodore Ts'o <[email protected]>
ext4: fix interaction between i_size, fallocate, and delalloc after a crash
Rameshwar Prasad Sahu <[email protected]>
ata: fixes kernel crash while tracing ata_eh_link_autopsy event
Arnd Bergmann <[email protected]>
rtlwifi: fix uninitialized rtlhal->last_suspend_sec time
Larry Finger <[email protected]>
rtlwifi: rtl8192ee: Fix memory leak when loading firmware
Andrew Elble <[email protected]>
nfsd: deal with revoked delegations appropriately
Anna Schumaker <[email protected]>
NFS: Avoid RCU usage in tracepoints
Chuck Lever <[email protected]>
nfs: Fix ugly referral attributes
Joshua Watt <[email protected]>
NFS: Fix typo in nomigration mount option
Arnd Bergmann <[email protected]>
isofs: fix timestamps beyond 2027
Coly Li <[email protected]>
bcache: check ca->alloc_thread initialized before wake up it
Eric Biggers <[email protected]>
libceph: don't WARN() if user tries to add invalid key
Dan Carpenter <[email protected]>
eCryptfs: use after free in ecryptfs_release_messaging()
Andreas Rohner <[email protected]>
nilfs2: fix race condition that causes file system corruption
NeilBrown <[email protected]>
autofs: don't fail mount for transient error
Stanislaw Gruszka <[email protected]>
rt2x00usb: mark device removed when get ENOENT usb error
Mirko Parthey <[email protected]>
MIPS: BCM47XX: Fix LED inversion for WRT54GSv1
Maciej W. Rozycki <[email protected]>
MIPS: Fix an n32 core file generation regset support regression
Masahiro Yamada <[email protected]>
MIPS: dts: remove bogus bcm96358nb4ser.dtb from dtb-y entry
James Hogan <[email protected]>
MIPS: Fix odd fp register warnings with MIPS64r2
Hou Tao <[email protected]>
dm: fix race between dm_get_from_kobject() and __dm_destroy()
John Crispin <[email protected]>
MIPS: pci: Remove KERN_WARN instance inside the mt7620 driver
Mikulas Patocka <[email protected]>
dm: allocate struct mapped_device with kvzalloc
Eric Biggers <[email protected]>
dm bufio: fix integer overflow when limiting maximum cache size
Vijendar Mukunda <[email protected]>
ALSA: hda: Add Raven PCI ID
Vadim Lomovtsev <[email protected]>
PCI: Set Cavium ACS capability quirk flags to assert RR/CR/SV/UF
Mathias Kresin <[email protected]>
MIPS: ralink: Fix typo in mt7628 pinmux function
Mathias Kresin <[email protected]>
MIPS: ralink: Fix MT7628 pinmux
Philip Derrin <[email protected]>
ARM: 8721/1: mm: dump: check hardware RO bit for LPAE
Philip Derrin <[email protected]>
ARM: 8722/1: mm: make STRICT_KERNEL_RWX effective for LPAE
Catalin Marinas <[email protected]>
arm64: Implement arch-specific pte_access_permitted()
Andy Lutomirski <[email protected]>
x86/entry/64: Add missing irqflags tracing to native_load_gs_index()
Masami Hiramatsu <[email protected]>
x86/decoder: Add new TEST instruction pattern
Eric Biggers <[email protected]>
lib/mpi: call cond_resched() from mpi_powm() loop
Paul E. McKenney <[email protected]>
sched: Make resched_cpu() unconditional
WANG Cong <[email protected]>
vsock: use new wait API for vsock_stream_sendmsg()
WANG Cong <[email protected]>
ipv6: only call ip6_route_dev_notify() once for NETDEV_UNREGISTER
Vlastimil Babka <[email protected]>
x86/mm: fix use-after-free of vma during userfaultfd fault
Lv Zheng <[email protected]>
ACPI / EC: Fix regression related to triggering source of EC event handling
Vasily Gorbik <[email protected]>
s390/disassembler: increase show_code buffer size
Heiko Carstens <[email protected]>
s390/disassembler: add missing end marker for e7 table
Heiko Carstens <[email protected]>
s390/runtime instrumention: fix possible memory corruption
Heiko Carstens <[email protected]>
s390: fix transactional execution control register handling
-------------
Diffstat:
Makefile | 4 +- arch/arm/mm/dump.c | 4 +- arch/arm/mm/init.c | 4 +- arch/arm64/include/asm/pgtable.h | 14 + arch/mips/bcm47xx/leds.c | 2 +- arch/mips/boot/dts/brcm/Makefile | 1 - arch/mips/include/asm/asmmacro.h | 8 +- arch/mips/kernel/ptrace.c | 17 ++ arch/mips/pci/pci-mt7620.c | 2 +- arch/mips/ralink/mt7620.c | 4 +- arch/parisc/kernel/syscall.S | 6 +- arch/powerpc/kernel/signal.c | 2 +- arch/s390/include/asm/asm-prototypes.h | 8 + arch/s390/include/asm/switch_to.h | 2 +- arch/s390/kernel/dis.c | 5 +- arch/s390/kernel/early.c | 4 +- arch/s390/kernel/process.c | 1 + arch/s390/kernel/runtime_instr.c | 4 +- arch/x86/entry/entry_64.S | 10 +- arch/x86/kvm/svm.c | 7 + arch/x86/kvm/vmx.c | 2 + arch/x86/lib/x86-opcode-map.txt | 2 +- arch/x86/mm/fault.c | 11 +- block/blk-core.c | 2 + block/blk-timeout.c | 3 - drivers/acpi/ec.c | 12 +- drivers/ata/libata-eh.c | 2 +- drivers/base/power/opp/of.c | 1 + drivers/clk/qcom/gcc-ipq4019.c | 14 +- drivers/clk/sunxi-ng/ccu-sun6i-a31.c | 4 +- drivers/clk/sunxi-ng/ccu-sun8i-a33.c | 10 + drivers/clk/ti/clk-dra7-atl.c | 3 +- drivers/crypto/marvell/cesa.h | 3 +- drivers/crypto/marvell/hash.c | 34 ++- drivers/crypto/marvell/tdma.c | 9 +- drivers/dma/zx296702_dma.c | 1 + drivers/gpio/gpio-mockup.c | 10 +- drivers/gpu/drm/armada/Makefile | 2 + drivers/gpu/drm/drm_mm.c | 16 +- drivers/gpu/drm/i915/intel_drv.h | 1 + drivers/gpu/drm/i915/intel_pm.c | 52 ++-- drivers/gpu/drm/mediatek/mtk_drm_drv.c | 3 +- drivers/gpu/drm/sun4i/sun4i_backend.c | 2 +- drivers/iio/light/cm3232.c | 2 +- drivers/infiniband/ulp/srp/ib_srp.c | 25 +- drivers/infiniband/ulp/srpt/ib_srpt.c | 9 +- drivers/irqchip/irq-gic-v3.c | 9 +- drivers/md/bcache/alloc.c | 3 +- drivers/md/dm-bufio.c | 15 +- drivers/md/dm-core.h | 3 +- drivers/md/dm.c | 19 +- drivers/media/rc/ir-lirc-codec.c | 9 +- drivers/media/usb/as102/as102_fw.c | 28 +- drivers/media/usb/cx231xx/cx231xx-cards.c | 2 +- drivers/media/v4l2-core/v4l2-ctrls.c | 16 +- drivers/mtd/nand/mtk_ecc.c | 13 +- drivers/mtd/nand/nand_base.c | 9 +- drivers/mtd/nand/omap2.c | 339 ++++++++++++++------- drivers/net/ethernet/3com/typhoon.c | 25 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 30 ++ drivers/net/ethernet/intel/e1000e/defines.h | 1 + drivers/net/ethernet/intel/e1000e/mac.c | 11 +- drivers/net/ethernet/intel/e1000e/netdev.c | 37 ++- drivers/net/ethernet/intel/e1000e/phy.c | 7 +- drivers/net/ethernet/intel/fm10k/fm10k_main.c | 2 +- drivers/net/ethernet/intel/i40e/i40e_main.c | 2 +- drivers/net/ethernet/intel/i40e/i40e_txrx.c | 2 +- drivers/net/ethernet/intel/i40evf/i40e_txrx.c | 2 +- drivers/net/ethernet/intel/igb/igb_main.c | 2 +- drivers/net/ethernet/intel/igbvf/netdev.c | 2 +- drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 2 +- drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c | 2 +- drivers/net/wireless/admtek/adm8211.c | 27 +- drivers/net/wireless/ath/ath10k/core.c | 5 +- drivers/net/wireless/ath/ath10k/mac.c | 58 +++- drivers/net/wireless/ath/ath10k/wmi-tlv.c | 12 +- drivers/net/wireless/intersil/p54/main.c | 7 +- drivers/net/wireless/marvell/mwifiex/sdio.c | 6 + drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 4 +- drivers/net/wireless/ralink/rt2x00/rt2x00usb.c | 6 +- .../net/wireless/realtek/rtlwifi/rtl8192ee/fw.c | 6 +- .../net/wireless/realtek/rtlwifi/rtl8821ae/hw.c | 1 + drivers/nvdimm/label.c | 2 +- drivers/nvdimm/namespace_devs.c | 2 +- drivers/nvdimm/pfn_devs.c | 8 + drivers/nvme/target/admin-cmd.c | 4 +- drivers/pci/probe.c | 15 +- drivers/pci/quirks.c | 12 +- drivers/pinctrl/sirf/pinctrl-atlas7.c | 7 +- drivers/spi/Kconfig | 1 + drivers/staging/iio/cdc/ad7150.c | 2 +- drivers/staging/media/cec/cec-adap.c | 16 +- drivers/target/iscsi/iscsi_target.c | 8 +- drivers/target/target_core_transport.c | 4 + drivers/vhost/scsi.c | 5 +- drivers/xen/xenbus/xenbus_dev_frontend.c | 2 +- fs/9p/vfs_inode.c | 3 + fs/9p/vfs_inode_dotl.c | 3 + fs/autofs4/waitq.c | 15 +- fs/btrfs/uuid-tree.c | 4 +- fs/crypto/crypto.c | 3 - fs/crypto/fname.c | 4 +- fs/crypto/policy.c | 2 +- fs/ecryptfs/messaging.c | 7 +- fs/ext4/extents.c | 6 +- fs/ext4/ialloc.c | 2 +- fs/ext4/namei.c | 4 +- fs/f2fs/dir.c | 5 +- fs/f2fs/namei.c | 4 +- fs/isofs/isofs.h | 2 +- fs/isofs/rock.h | 2 +- fs/isofs/util.c | 2 +- fs/lockd/svc.c | 20 +- fs/nfs/nfs4proc.c | 18 +- fs/nfs/nfs4trace.h | 24 +- fs/nfs/super.c | 2 +- fs/nfsd/nfs4state.c | 25 +- fs/nilfs2/segment.c | 6 +- include/trace/events/sunrpc.h | 17 +- kernel/sched/core.c | 9 +- kernel/sched/rt.c | 235 +++++++------- kernel/sched/sched.h | 24 +- lib/mpi/mpi-pow.c | 2 + net/9p/client.c | 3 +- net/9p/trans_virtio.c | 13 +- net/ceph/crypto.c | 4 +- net/ipv4/ip_sockglue.c | 7 +- net/ipv6/ipv6_sockglue.c | 16 +- net/ipv6/route.c | 6 +- net/mac80211/ieee80211_i.h | 1 - net/mac80211/mesh.c | 3 - net/mac80211/mesh_plink.c | 14 +- net/mac80211/mesh_sync.c | 11 - net/netfilter/nf_tables_api.c | 2 +- net/netfilter/nft_queue.c | 2 +- net/nfc/core.c | 2 +- net/rds/ib_frmr.c | 5 +- net/rds/rdma.c | 9 +- net/rds/rds.h | 3 + net/rds/send.c | 42 ++- net/vmw_vsock/af_vsock.c | 21 +- sound/core/pcm_lib.c | 6 +- sound/core/timer_compat.c | 12 +- sound/hda/hdmi_chmap.c | 2 +- sound/pci/hda/hda_intel.c | 3 + sound/pci/hda/patch_realtek.c | 4 +- sound/soc/codecs/wm_adsp.c | 25 +- sound/soc/sh/rcar/core.c | 4 +- sound/usb/clock.c | 9 +- sound/usb/mixer.c | 15 +- 150 files changed, 1223 insertions(+), 627 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 2/138 s390/runtime instrumention: fix possible memory corruption
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <[email protected]>
commit d6e646ad7cfa7034d280459b2b2546288f247144 upstream.
For PREEMPT enabled kernels the runtime instrumentation (RI) code contains a possible use-after-free bug. If a task that makes use of RI exits, it will execute do_exit() while still enabled for preemption.
That function will call exit_thread_runtime_instr() via exit_thread(). If exit_thread_runtime_instr() gets preempted after the RI control block of the task has been freed but before the pointer to it is set to NULL, then save_ri_cb(), called from switch_to(), will write to already freed memory.
Avoid this and simply disable preemption while freeing the control block and setting the pointer to NULL.
--- arch/s390/kernel/runtime_instr.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/s390/kernel/runtime_instr.c +2 -2
@@ -47,11 +47,13 @@ void exit_thread_runtime_instr(void) {struct task_struct *task = current; +preempt_disable ();if (!task->thread.ri_cb)return ;disable_runtime_instr ();kfree (task->thread.ri_cb); task->thread.ri_cb =NULL ; +preempt_enable (); }SYSCALL_DEFINE1 (s390_runtime_instr, int, command)
@@ -62,9 +64,7 @@ SYSCALL_DEFINE1(s390_runtime_instr, int,return -EOPNOTSUPP ;if (command ==S390_RUNTIME_INSTR_STOP ) { -preempt_disable ();exit_thread_runtime_instr (); -preempt_enable ();return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 3/138 s390/disassembler: add missing end marker for e7 table
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <[email protected]>
commit 5c50538752af7968f53924b22dede8ed4ce4cb3b upstream.
The e7 opcode table does not have an end marker. Hence when trying to find an unknown e7 instruction the code will access memory behind the table until it finds something that matches the opcode, or the kernel crashes, whatever comes first.
This affects not only the in-kernel disassembler but also uprobes and kprobes which refuse to set a probe on unknown instructions, and therefore search the opcode tables to figure out if instructions are known or not.
--- arch/s390/kernel/dis.c | 1 + 1 file changed, 1 insertion(+)
arch/s390/kernel/dis.c +1 -0
@@ -1548,6 +1548,7 @@ static struct s390_insn opcode_e7[] = { { "vfsq", 0xce, INSTR_VRR_VV000MM }, { "vfs", 0xe2, INSTR_VRR_VVV00MM }, { "vftci", 0x4a, INSTR_VRI_VVIMM }, + { "", 0, INSTR_INVALID } }; static struct s390_insn opcode_eb[] = {
Greg Kroah-Hartman
maintainerPATCH 4/138 s390/disassembler: increase show_code buffer size
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasily Gorbik <[email protected]>
commit b192571d1ae375e0bbe0aa3ccfa1a3c3704454b9 upstream.
Current buffer size of 64 is too small. objdump shows that there are instructions which would require up to 75 bytes buffer (with current formating). 128 bytes "ought to be enough for anybody".
Also replaces 8 spaces with a single tab to reduce the memory footprint.
Fixes the following KASAN finding:
BUG: KASAN: stack-out-of-bounds in number+0x3fe/0x538
Write of size 1 at addr 000000005a4a75a0 by task bash/1282
CPU: 1 PID: 1282 Comm: bash Not tainted 4.14.0+ #215
Hardware name: IBM 2964 N96 702 (z/VM 6.4.0)
Call Trace:
([<000000000011eeb6>] show_stack+0x56/0x88)
[<0000000000e1ce1a>] dump_stack+0x15a/0x1b0
[<00000000004e2994>] print_address_description+0xf4/0x288
[<00000000004e2cf2>] kasan_report+0x13a/0x230
[<0000000000e38ae6>] number+0x3fe/0x538
[<0000000000e3dfe4>] vsnprintf+0x194/0x948
[<0000000000e3ea42>] sprintf+0xa2/0xb8
[<00000000001198dc>] print_insn+0x374/0x500
[<0000000000119346>] show_code+0x4ee/0x538
[<000000000011f234>] show_registers+0x34c/0x388
[<000000000011f2ae>] show_regs+0x3e/0xa8
[<000000000011f502>] die+0x1ea/0x2e8
[<0000000000138f0e>] do_no_context+0x106/0x168
[<0000000000139a1a>] do_protection_exception+0x4da/0x7d0
[<0000000000e55914>] pgm_check_handler+0x16c/0x1c0
[<000000000090639e>] sysrq_handle_crash+0x46/0x58
([<0000000000000007>] 0x7)
[<00000000009073fa>] __handle_sysrq+0x102/0x218
[<0000000000907c06>] write_sysrq_trigger+0xd6/0x100
[<000000000061d67a>] proc_reg_write+0xb2/0x128
[<0000000000520be6>] __vfs_write+0xee/0x368
[<0000000000521222>] vfs_write+0x21a/0x278
[<000000000052156a>] SyS_write+0xda/0x178
[<0000000000e555cc>] system_call+0xc4/0x270
The buggy address belongs to the page:
page:000003d1016929c0 count:0 mapcount:0 mapping: (null) index:0x0
flags: 0x0()
raw: 0000000000000000 0000000000000000 0000000000000000 ffffffff00000000
raw: 0000000000000100 0000000000000200 0000000000000000 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
000000005a4a7480: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1
000000005a4a7500: 00 00 00 00 00 00 00 00 f2 f2 f2 f2 00 00 00 00
>000000005a4a7580: 00 00 00 00 f3 f3 f3 f3 00 00 00 00 00 00 00 00
^
000000005a4a7600: 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 f8 f8
000000005a4a7680: f2 f2 f2 f2 f2 f2 f8 f8 f2 f2 f3 f3 f3 f3 00 00
==================================================================--- arch/s390/kernel/dis.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/s390/kernel/dis.c +2 -2
@@ -1954,7 +1954,7 @@ void show_code(struct pt_regs *regs) {char *mode =user_mode (regs) ?"User" :"Krnl" ;unsigned char code[64 ]; -char buffer[64 ], *ptr; +char buffer[128 ], *ptr;mm_segment_t old_fs;unsigned long addr;int start, end, opsize, hops, i;
@@ -2017,7 +2017,7 @@ void show_code(struct pt_regs *regs) start += opsize;pr_cont ("%s" , buffer); ptr = buffer; - ptr +=sprintf (ptr,"\n " ); + ptr +=sprintf (ptr,"\n\t " ); hops++; }pr_cont ("\n" );
Greg Kroah-Hartman
maintainerPATCH 5/138 ACPI / EC: Fix regression related to triggering source of EC event handling
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lv Zheng <[email protected]>
commit 53c5eaabaea9a1b7a96f95ccc486d2ad721d95bb upstream.
Originally the Samsung quirks removed by commit 4c237371 can be covered by commit e923e8e7 and ec_freeze_events=Y mode. But commit 9c40f956 changed ec_freeze_events=Y back to N, making this problem re-surface.
Actually, if commit e923e8e7 is robust enough, we can freely change ec_freeze_events mode, so this patch fixes the issue by improving commit e923e8e7.
Related commits listed in the merged order:
Commit: e923e8e79e18fd6be9162f1be6b99a002e9df2cb
Subject: ACPI / EC: Fix an issue that SCI_EVT cannot be detected
after event is enabled
Commit: 4c237371f290d1ed3b2071dd43554362137b1cce
Subject: ACPI / EC: Remove old CLEAR_ON_RESUME quirk
Commit: 9c40f956ce9b331493347d1b3cb7e384f7dc0581
Subject: Revert "ACPI / EC: Enable event freeze mode..." to fix
a regression
This patch not only fixes the reported post-resume EC event triggering source issue, but also fixes an unreported similar issue related to the driver bind by adding EC event triggering source in ec_install_handlers().
--- drivers/acpi/ec.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
drivers/acpi/ec.c +7 -5
@@ -482,8 +482,11 @@ static inline void __acpi_ec_enable_even {if (!test_and_set_bit (EC_FLAGS_QUERY_ENABLED , &ec->flags))ec_log_drv ("event unblocked" ); -if (!test_bit (EC_FLAGS_QUERY_PENDING , &ec->flags)) -advance_transaction (ec); +/* +* Unconditionally invoke this once after enabling the event +* handling mechanism to detect the pending events. +*/ +advance_transaction (ec); }static inline void __acpi_ec_disable_event (struct acpi_ec *ec)
@@ -1458,11 +1461,10 @@ static int ec_install_handlers(struct acif (test_bit (EC_FLAGS_STARTED , &ec->flags) && ec->reference_count >=1 )acpi_ec_enable_gpe (ec, true); - -/* EC is fully operational, allow queries */ -acpi_ec_enable_event (ec); } } +/* EC is fully operational, allow queries */ +acpi_ec_enable_event (ec);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 6/138 x86/mm: fix use-after-free of vma during userfaultfd fault
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vlastimil Babka <[email protected]>
commit cb0631fd3cf9e989cd48293fe631cbc402aec9a9 upstream.
Syzkaller with KASAN has reported a use-after-free of vma->vm_flags in __do_page_fault() with the following reproducer:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0)
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000-0x18)={0xaa, 0x0, 0x0}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000019000)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1, 0x0}) r1 = gettid() syz_open_dev$evdev(&(0x7f0000013000-0x12)="2f6465762f696e7075742f6576656e742300", 0x0, 0x0) tkill(r1, 0x7)
The vma should be pinned by mmap_sem, but handle_userfault() might (in a return to userspace scenario) release it and then acquire again, so when we return to __do_page_fault() (with other result than VM_FAULT_RETRY), the vma might be gone.
Specifically, per Andrea the scenario is
"A return to userland to repeat the page fault later with a
VM_FAULT_NOPAGE retval (potentially after handling any pending signal during the return to userland). The return to userland is identified whenever FAULT_FLAG_USER|FAULT_FLAG_KILLABLE are both set in vmf->flags"
However, since commit a3c4fb7c9c2e ("x86/mm: Fix fault error path using unsafe vma pointer") there is a vma_pkey() read of vma->vm_flags after that point, which can thus become use-after-free. Fix this by moving the read before calling handle_mm_fault().
--- arch/x86/mm/fault.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
arch/x86/mm/fault.c +10 -1
@@ -1393,7 +1393,17 @@ good_area:* make sure we exit gracefully rather than endlessly redo * the fault. Since we never set FAULT_FLAG_RETRY_NOWAIT, if * we get VM_FAULT_RETRY back, the mmap_sem has been unlocked. +* +* Note that handle_userfault() may also release and reacquire mmap_sem +* (and not return with VM_FAULT_RETRY), when returning to userland to +* repeat the page fault later with a VM_FAULT_NOPAGE retval +* (potentially after handling any pending signal during the return to +* userland). The return to userland is identified whenever +* FAULT_FLAG_USER|FAULT_FLAG_KILLABLE are both set in flags. +* Thus we have to be careful about not touching vma after handling the +* fault, so we read the pkey beforehand. */ + pkey =vma_pkey (vma); fault =handle_mm_fault (vma, address, flags); major |= fault &VM_FAULT_MAJOR ;
@@ -1420,7 +1430,6 @@ good_area:return ; } - pkey =vma_pkey (vma);up_read (&mm->mmap_sem);if (unlikely (fault &VM_FAULT_ERROR )) {mm_fault_error (regs, error_code, address, &pkey, fault);
Greg Kroah-Hartman
maintainerPATCH 7/138 ipv6: only call ip6_route_dev_notify() once for NETDEV_UNREGISTER
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: WANG Cong <[email protected]>
commit 76da0704507bbc51875013f6557877ab308cfd0a upstream.
In commit 242d3a49a2a1 ("ipv6: reorder ip6_route_dev_notifier after ipv6_dev_notf") I assumed NETDEV_REGISTER and NETDEV_UNREGISTER are paired, unfortunately, as reported by jeffy, netdev_wait_allrefs()
could rebroadcast NETDEV_UNREGISTER event until all refs are
gone.
We have to add an additional check to avoid this corner case. For netdev_wait_allrefs() dev->reg_state is NETREG_UNREGISTERED, for dev_change_net_namespace(), dev->reg_state is NETREG_REGISTERED. So check for dev->reg_state != NETREG_UNREGISTERED.
--- net/ipv6/route.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
net/ipv6/route.c +5 -1
@@ -3495,7 +3495,11 @@ static int ip6_route_dev_notify(struct n net->ipv6.ip6_blk_hole_entry->dst.dev = dev; net->ipv6.ip6_blk_hole_entry->rt6i_idev =in6_dev_get (dev);#endif - }else if (event ==NETDEV_UNREGISTER ) { + }else if (event ==NETDEV_UNREGISTER && + dev->reg_state !=NETREG_UNREGISTERED ) { +/* NETDEV_UNREGISTER could be fired for multiple times by +* netdev_wait_allrefs(). Make sure we only call this once. +*/ in6_dev_put (net->ipv6.ip6_null_entry->rt6i_idev);#ifdef CONFIG_IPV6_MULTIPLE_TABLES in6_dev_put (net->ipv6.ip6_prohibit_entry->rt6i_idev);
Greg Kroah-Hartman
maintainerPATCH 8/138 vsock: use new wait API for vsock_stream_sendmsg()
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: WANG Cong <[email protected]>
commit 499fde662f1957e3cb8d192a94a099ebe19c714b upstream.
As reported by Michal, vsock_stream_sendmsg() could still sleep at vsock_stream_has_space() after prepare_to_wait():
vsock_stream_has_space
vmci_transport_stream_has_space
vmci_qpair_produce_free_space
qp_lock
qp_acquire_queue_mutex
mutex_lock
Just switch to the new wait API like we did for commit d9dc8b0f8b4e ("net: fix sleeping for sk_wait_event()").
--- net/vmw_vsock/af_vsock.c | 21 ++++++++------------- 1 file changed, 8 insertions(+), 13 deletions(-)
net/vmw_vsock/af_vsock.c +8 -13
@@ -1524,8 +1524,7 @@ static int vsock_stream_sendmsg(struct slong timeout;int err;struct vsock_transport_send_notify_data send_data; - -DEFINE_WAIT (wait); +DEFINE_WAIT_FUNC (wait, woken_wake_function); sk = sock->sk; vsk =vsock_sk (sk);
@@ -1568,11 +1567,10 @@ static int vsock_stream_sendmsg(struct sif (err <0 ) goto out; -while (total_written < len) {ssize_t written; -prepare_to_wait (sk_sleep (sk), &wait,TASK_INTERRUPTIBLE ); +add_wait_queue (sk_sleep (sk), &wait); while (vsock_stream_has_space(vsk) == 0 && sk->sk_err == 0 && !(sk->sk_shutdown & SEND_SHUTDOWN) &&
@@ -1581,33 +1579,30 @@ static int vsock_stream_sendmsg(struct s/* Don't wait for non-blocking sockets. */ if (timeout ==0 ) { err = -EAGAIN ; -finish_wait (sk_sleep (sk), &wait); +remove_wait_queue (sk_sleep (sk), &wait); goto out_err; } err = transport->notify_send_pre_block (vsk, &send_data);if (err <0 ) { -finish_wait (sk_sleep (sk), &wait); +remove_wait_queue (sk_sleep (sk), &wait); goto out_err; }release_sock (sk); - timeout =schedule_timeout (timeout); + timeout =wait_woken (&wait,TASK_INTERRUPTIBLE , timeout);lock_sock (sk);if (signal_pending (current)) { err =sock_intr_errno (timeout); -finish_wait (sk_sleep (sk), &wait); +remove_wait_queue (sk_sleep (sk), &wait); goto out_err; }else if (timeout ==0 ) { err = -EAGAIN ; -finish_wait (sk_sleep (sk), &wait); +remove_wait_queue (sk_sleep (sk), &wait); goto out_err; } - -prepare_to_wait (sk_sleep (sk), &wait, -TASK_INTERRUPTIBLE ); } -finish_wait (sk_sleep (sk), &wait); +remove_wait_queue (sk_sleep (sk), &wait);/* These checks occur both as part of and after the loop * conditional since we need to check before and after
Greg Kroah-Hartman
maintainerPATCH 9/138 sched: Make resched_cpu() unconditional
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul E. McKenney <[email protected]>
commit 7c2102e56a3f7d85b5d8f33efbd7aecc1f36fdd8 upstream.
The current implementation of synchronize_sched_expedited() incorrectly assumes that resched_cpu() is unconditional, which it is not. This means that synchronize_sched_expedited() can hang when resched_cpu()'s trylock fails as follows (analysis by Neeraj Upadhyay):
o CPU1 is waiting for expedited wait to complete:
sync_rcu_exp_select_cpus rdp->exp_dynticks_snap & 0x1 // returns 1 for CPU5 IPI sent to CPU5 synchronize_sched_expedited_wait ret = swait_event_timeout(rsp->expedited_wq, sync_rcu_preempt_exp_done(rnp_root), jiffies_stall); expmask = 0x20, CPU 5 in idle path (in cpuidle_enter())
o CPU5 handles IPI and fails to acquire rq lock.
Handles IPI sync_sched_exp_handler resched_cpu returns while failing to try lock acquire rq->lock need_resched is not set
o CPU5 calls rcu_idle_enter() and as need_resched is not set, goes to
idle (schedule() is not called).
o CPU 1 reports RCU stall.
Given that resched_cpu() is now used only by RCU, this commit fixes the assumption by making resched_cpu() unconditional.
--- kernel/sched/core.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
kernel/sched/core.c +1 -2
@@ -507,8 +507,7 @@ void resched_cpu(int cpu)struct rq *rq =cpu_rq (cpu);unsigned long flags; -if (!raw_spin_trylock_irqsave (&rq->lock, flags)) -return ; +raw_spin_lock_irqsave (&rq->lock, flags);resched_curr (rq);raw_spin_unlock_irqrestore (&rq->lock, flags); }
Greg Kroah-Hartman
maintainerPATCH 10/138 lib/mpi: call cond_resched() from mpi_powm() loop
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
commit 1d9ddde12e3c9bab7f3d3484eb9446315e3571ca upstream.
On a non-preemptible kernel, if KEYCTL_DH_COMPUTE is called with the largest permitted inputs (16384 bits), the kernel spends 10+ seconds doing modular exponentiation in mpi_powm() without rescheduling. If all threads do it, it locks up the system. Moreover, it can cause rcu_sched-stall warnings.
Notwithstanding the insanity of doing this calculation in kernel mode rather than in userspace, fix it by calling cond_resched() as each bit from the exponent is processed. It's still noninterruptible, but at least it's preemptible now.
Do the cond_resched() once per bit rather than once per MPI limb because each limb might still easily take 100+ milliseconds on slow CPUs.
--- lib/mpi/mpi-pow.c | 2 ++ 1 file changed, 2 insertions(+)
lib/mpi/mpi-pow.c +2 -0
@@ -26,6 +26,7 @@* however I decided to publish this code under the plain GPL. */ +#include <linux/sched.h> #include <linux/string.h> #include "mpi-internal.h" #include "longlong.h"
@@ -256,6 +257,7 @@ int mpi_powm(MPI res, MPI base, MPI exp, } e <<=1 ; c--; +cond_resched (); } i--;
Greg Kroah-Hartman
maintainerPATCH 11/138 x86/decoder: Add new TEST instruction pattern
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masami Hiramatsu <[email protected]>
commit 12a78d43de767eaf8fb272facb7a7b6f2dc6a9df upstream.
The kbuild test robot reported this build warning:
Warning: arch/x86/tools/test_get_len found difference at <jump_table>:ffffffff8103dd2c
Warning: ffffffff8103dd82: f6 09 d8 testb $0xd8,(%rcx)
Warning: objdump says 3 bytes, but insn_get_length() says 2
Warning: decoded and checked 1569014 instructions with 1 warnings
This sequence seems to be a new instruction not in the opcode map in the Intel SDM.
The instruction sequence is "F6 09 d8", means Group3(F6), MOD(00)REG(001)RM(001), and 0xd8. Intel SDM vol2 A.4 Table A-6 said the table index in the group is "Encoding of Bits 5,4,3 of the ModR/M Byte (bits 2,1,0 in parenthesis)"
In that table, opcodes listed by the index REG bits as:
000 001 010 011 100 101 110 111
TEST Ib/Iz,(undefined),NOT,NEG,MUL AL/rAX,IMUL AL/rAX,DIV AL/rAX,IDIV AL/rAX
So, it seems TEST Ib is assigned to 001.
Add the new pattern.
--- arch/x86/lib/x86-opcode-map.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/lib/x86-opcode-map.txt +1 -1
@@ -896,7 +896,7 @@ EndTable GrpTable: Grp3_1 0: TEST Eb,Ib -1: +1: TEST Eb,Ib 2: NOT Eb 3: NEG Eb 4: MUL AL,Eb
Greg Kroah-Hartman
maintainerPATCH 12/138 x86/entry/64: Add missing irqflags tracing to native_load_gs_index()
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Lutomirski <[email protected]>
commit ca37e57bbe0cf1455ea3e84eb89ed04a132d59e1 upstream.
Running this code with IRQs enabled (where dummy_lock is a spinlock):
static void check_load_gs_index(void)
{
/* This will fail. */
load_gs_index(0xffff);
spin_lock(&dummy_lock);
spin_unlock(&dummy_lock);
}Will generate a lockdep warning. The issue is that the actual write to %gs would cause an exception with IRQs disabled, and the exception handler would, as an inadvertent side effect, update irqflag tracing to reflect the IRQs-off status. native_load_gs_index() would then turn IRQs back on and return with irqflag tracing still thinking that IRQs were off. The dummy lock-and-unlock causes lockdep to notice the error and warn.
Fix it by adding the missing tracing.
Apparently nothing did this in a context where it mattered. I haven't tried to find a code path that would actually exhibit the warning if appropriately nasty user code were running.
I suspect that the security impact of this bug is very, very low -- production systems don't run with lockdep enabled, and the warning is mostly harmless anyway.
Found during a quick audit of the entry code to try to track down an unrelated bug that Ingo found in some still-in-development code.
--- arch/x86/entry/entry_64.S | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
arch/x86/entry/entry_64.S +8 -2
@@ -54,15 +54,19 @@ ENTRY(native_usergs_sysret64) ENDPROC(native_usergs_sysret64) #endif /* CONFIG_PARAVIRT */ -.macro TRACE_IRQS_IRETQ +.macro TRACE_IRQS_FLAGS flags:req #ifdef CONFIG_TRACE_IRQFLAGS - bt $9, EFLAGS(%rsp) /* interrupts off? */ + bt $9, \flags /* interrupts off? */ jnc 1f TRACE_IRQS_ON 1: #endif .endm +.macro TRACE_IRQS_IRETQ + TRACE_IRQS_FLAGS EFLAGS(%rsp) +.endm + /* * When dynamic function tracer is enabled it will add a breakpoint * to all locations that it is about to modify, sync CPUs, update
@@ -868,11 +872,13 @@ idtentry simd_coprocessor_error do_simd ENTRY(native_load_gs_index) pushfq DISABLE_INTERRUPTS(CLBR_ANY & ~CLBR_RDI) + TRACE_IRQS_OFF SWAPGS .Lgs_change: movl %edi, %gs 2: ALTERNATIVE "", "mfence", X86_BUG_SWAPGS_FENCE SWAPGS + TRACE_IRQS_FLAGS (%rsp) popfq ret END(native_load_gs_index)
Greg Kroah-Hartman
maintainerPATCH 13/138 arm64: Implement arch-specific pte_access_permitted()
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Catalin Marinas <[email protected]>
commit 6218f96c58dbf44a06aeaf767aab1f54fc397838 upstream.
The generic pte_access_permitted() implementation only checks for pte_present() (together with the write permission where applicable). However, for both kernel ptes and PROT_NONE mappings pte_present() also returns true on arm64 even though such mappings are not user accessible. Additionally, arm64 now supports execute-only user permission (PROT_EXEC) which is implemented by clearing the PTE_USER bit.
With this patch the arm64 implementation of pte_access_permitted() checks for the PTE_VALID and PTE_USER bits together with writable access if applicable.
--- arch/arm64/include/asm/pgtable.h | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
arch/arm64/include/asm/pgtable.h +14 -0
@@ -91,6 +91,8 @@ extern unsigned long empty_zero_page[PAG ((pte_val(pte) & (PTE_VALID | PTE_USER | PTE_UXN)) == (PTE_VALID | PTE_UXN))#define pte_valid_young (pte) \ ((pte_val(pte) & (PTE_VALID | PTE_AF)) == (PTE_VALID | PTE_AF)) +#define pte_valid_user (pte) \ + ((pte_val(pte) & (PTE_VALID | PTE_USER)) == (PTE_VALID | PTE_USER))/* * Could the pte be present in the TLB? We must check mm_tlb_flush_pending
@@ -100,6 +102,18 @@ extern unsigned long empty_zero_page[PAG#define pte_accessible (mm, pte) \ (mm_tlb_flush_pending(mm) ? pte_present(pte) : pte_valid_young(pte)) +/* +* p??_access_permitted() is true for valid user mappings (subject to the +* write permission check) other than user execute-only which do not have the +* PTE_USER bit set. PROT_NONE mappings do not have the PTE_VALID bit set. +*/ +#define pte_access_permitted (pte, write) \ + (pte_valid_user(pte) && (!(write) || pte_write(pte))) +#define pmd_access_permitted (pmd, write) \ + (pte_access_permitted(pmd_pte(pmd), (write))) +#define pud_access_permitted (pud, write) \ + (pte_access_permitted(pud_pte(pud), (write))) +static inline pte_t clear_pte_bit (pte_t pte,pgprot_t prot) {pte_val (pte) &= ~pgprot_val (prot);
Greg Kroah-Hartman
maintainerPATCH 14/138 ARM: 8722/1: mm: make STRICT_KERNEL_RWX effective for LPAE
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Philip Derrin <[email protected]>
commit 400eeffaffc7232c0ae1134fe04e14ae4fb48d8c upstream.
Currently, for ARM kernels with CONFIG_ARM_LPAE and CONFIG_STRICT_KERNEL_RWX enabled, the 2MiB pages mapping the kernel code and rodata are writable. They are marked read-only in a software bit (L_PMD_SECT_RDONLY) but the hardware read-only bit is not set (PMD_SECT_AP2).
For user mappings, the logic that propagates the software bit to the hardware bit is in set_pmd_at(); but for the kernel, section_update() writes the PMDs directly, skipping this logic.
The fix is to set PMD_SECT_AP2 for read-only sections in section_update(), at the same time as L_PMD_SECT_RDONLY.
--- arch/arm/mm/init.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/mm/init.c +2 -2
@@ -619,8 +619,8 @@ static struct section_perm ro_perms[] = .start = (unsigned long)_stext, .end = (unsigned long )__init_begin, #ifdef CONFIG_ARM_LPAE - .mask = ~L_PMD_SECT_RDONLY , - .prot = L_PMD_SECT_RDONLY, + .mask = ~(L_PMD_SECT_RDONLY |PMD_SECT_AP2 ), + .prot = L_PMD_SECT_RDONLY | PMD_SECT_AP2, #else .mask = ~(PMD_SECT_APX |PMD_SECT_AP_WRITE ), .prot = PMD_SECT_APX | PMD_SECT_AP_WRITE,
Greg Kroah-Hartman
maintainerPATCH 15/138 ARM: 8721/1: mm: dump: check hardware RO bit for LPAE
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Philip Derrin <[email protected]>
commit 3b0c0c922ff4be275a8beb87ce5657d16f355b54 upstream.
When CONFIG_ARM_LPAE is set, the PMD dump relies on the software read-only bit to determine whether a page is writable. This concealed a bug which left the kernel text section writable (AP2=0) while marked read-only in the software bit.
In a kernel with the AP2 bug, the dump looks like this:
---[ Kernel Mapping ]---
0xc0000000-0xc0200000 2M RW NX SHD
0xc0200000-0xc0600000 4M ro x SHD
0xc0600000-0xc0800000 2M ro NX SHD
0xc0800000-0xc4800000 64M RW NX SHDThe fix is to check that the software and hardware bits are both set before displaying "ro". The dump then shows the true perms:
---[ Kernel Mapping ]---
0xc0000000-0xc0200000 2M RW NX SHD
0xc0200000-0xc0600000 4M RW x SHD
0xc0600000-0xc0800000 2M RW NX SHD
0xc0800000-0xc4800000 64M RW NX SHD--- arch/arm/mm/dump.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/mm/dump.c +2 -2
@@ -126,8 +126,8 @@ static const struct prot_bits section_bi .val = PMD_SECT_USER, .set = "USR", }, { - .mask = L_PMD_SECT_RDONLY, - .val = L_PMD_SECT_RDONLY, + .mask = L_PMD_SECT_RDONLY | PMD_SECT_AP2, + .val = L_PMD_SECT_RDONLY | PMD_SECT_AP2, .set = "ro", .clear = "RW",#elif __LINUX_ARM_ARCH__ >= 6
Greg Kroah-Hartman
maintainerPATCH 16/138 MIPS: ralink: Fix MT7628 pinmux
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Kresin <[email protected]>
commit 8ef4b43cd3794d63052d85898e42424fd3b14d24 upstream.
According to the datasheet the REFCLK pin is shared with GPIO#37 and the PERST pin is shared with GPIO#36.
Patchwork: https://patchwork.linux-mips.org/patch/16046/
--- arch/mips/ralink/mt7620.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/mips/ralink/mt7620.c +2 -2
@@ -141,8 +141,8 @@ static struct rt2880_pmx_func i2c_grp_mt FUNC("i2c", 0, 4, 2), }; -static struct rt2880_pmx_func refclk_grp_mt7628[] = {FUNC ("reclk" ,0 ,36 ,1 ) }; -static struct rt2880_pmx_func perst_grp_mt7628[] = {FUNC ("perst" ,0 ,37 ,1 ) }; +static struct rt2880_pmx_func refclk_grp_mt7628[] = {FUNC ("reclk" ,0 ,37 ,1 ) }; +static struct rt2880_pmx_func perst_grp_mt7628[] = {FUNC ("perst" ,0 ,36 ,1 ) };static struct rt2880_pmx_func wdt_grp_mt7628[] = {FUNC ("wdt" ,0 ,38 ,1 ) };static struct rt2880_pmx_func spi_grp_mt7628[] = {FUNC ("spi" ,0 ,7 ,4 ) };
Greg Kroah-Hartman
maintainerPATCH 17/138 MIPS: ralink: Fix typo in mt7628 pinmux function
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Kresin <[email protected]>
commit 05a67cc258e75ac9758e6f13d26337b8be51162a upstream.
There is a typo inside the pinmux setup code. The function is called refclk and not reclk.
Patchwork: https://patchwork.linux-mips.org/patch/16047/
--- arch/mips/ralink/mt7620.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/mips/ralink/mt7620.c +1 -1
@@ -141,7 +141,7 @@ static struct rt2880_pmx_func i2c_grp_mt FUNC("i2c", 0, 4, 2), }; -static struct rt2880_pmx_func refclk_grp_mt7628[] = {FUNC ("reclk" ,0 ,37 ,1 ) }; +static struct rt2880_pmx_func refclk_grp_mt7628[] = {FUNC ("refclk" ,0 ,37 ,1 ) };static struct rt2880_pmx_func perst_grp_mt7628[] = {FUNC ("perst" ,0 ,36 ,1 ) };static struct rt2880_pmx_func wdt_grp_mt7628[] = {FUNC ("wdt" ,0 ,38 ,1 ) };static struct rt2880_pmx_func spi_grp_mt7628[] = {FUNC ("spi" ,0 ,7 ,4 ) };
Greg Kroah-Hartman
maintainerPATCH 18/138 PCI: Set Cavium ACS capability quirk flags to assert RR/CR/SV/UF
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vadim Lomovtsev <[email protected]>
commit 7f342678634f16795892677204366e835e450dda upstream.
The Cavium ThunderX (CN8XXX) family of PCIe Root Ports does not advertise an ACS capability. However, the RTL internally implements similar protection as if ACS had Request Redirection, Completion Redirection, Source Validation, and Upstream Forwarding features enabled.
Change Cavium ACS capabilities quirk flags accordingly.
--- drivers/pci/quirks.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
drivers/pci/quirks.c +7 -5
@@ -4088,12 +4088,14 @@ static int pci_quirk_amd_sb_acs(struct pstatic int pci_quirk_cavium_acs (struct pci_dev *dev,u16 acs_flags) {/* -* Cavium devices matching this quirk do not perform peer-to-peer -* with other functions, allowing masking out these bits as if they -* were unimplemented in the ACS capability. +* Cavium root ports don't advertise an ACS capability. However, +* the RTL internally implements similar protection as if ACS had +* Request Redirection, Completion Redirection, Source Validation, +* and Upstream Forwarding features enabled. Assert that the +* hardware implements and enables equivalent ACS functionality for +* these flags. */ - acs_flags &= ~(PCI_ACS_SV |PCI_ACS_TB |PCI_ACS_RR | -PCI_ACS_CR |PCI_ACS_UF |PCI_ACS_DT ); + acs_flags &= ~(PCI_ACS_RR |PCI_ACS_CR |PCI_ACS_SV |PCI_ACS_UF );return acs_flags ?0 :1 ; }
Greg Kroah-Hartman
maintainerPATCH 19/138 ALSA: hda: Add Raven PCI ID
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vijendar Mukunda <[email protected]>
commit 9ceace3c9c18c67676e75141032a65a8e01f9a7a upstream.
This commit adds PCI ID for Raven platform
--- sound/pci/hda/hda_intel.c | 3 +++ 1 file changed, 3 insertions(+)
sound/pci/hda/hda_intel.c +3 -0
@@ -2305,6 +2305,9 @@ static const struct pci_device_id azx_id/* AMD Hudson */ { PCI_DEVICE(0x1022, 0x780d), .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB }, + /* AMD Raven */ + { PCI_DEVICE(0x1022, 0x15e3), + .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB }, /* ATI HDMI */ { PCI_DEVICE(0x1002, 0x0002), .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
Greg Kroah-Hartman
maintainerPATCH 20/138 dm bufio: fix integer overflow when limiting maximum cache size
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
commit 74d4108d9e681dbbe4a2940ed8fdff1f6868184c upstream.
The default max_cache_size_bytes for dm-bufio is meant to be the lesser of 25% of the size of the vmalloc area and 2% of the size of lowmem. However, on 32-bit systems the intermediate result in the expression
(VMALLOC_END - VMALLOC_START) * DM_BUFIO_VMALLOC_PERCENT / 100
overflows, causing the wrong result to be computed. For example, on a 32-bit system where the vmalloc area is 520093696 bytes, the result is 1174405 rather than the expected 130023424, which makes the maximum cache size much too small (far less than 2% of lowmem). This causes severe performance problems for dm-verity users on affected systems.
Fix this by using mult_frac() to correctly multiply by a percentage. Do this for all places in dm-bufio that multiply by a percentage. Also replace (VMALLOC_END - VMALLOC_START) with VMALLOC_TOTAL, which contrary to the comment is now defined in include/linux/vmalloc.h.
Depends-on: 9993bc635 ("sched/x86: Fix overflow in cyc2ns_offset")
--- drivers/md/dm-bufio.c | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-)
drivers/md/dm-bufio.c +6 -9
@@ -937,7 +937,8 @@ static void __get_memory_limit(struct dm buffers = c->minimum_buffers; *limit_buffers = buffers; - *threshold_buffers = buffers *DM_BUFIO_WRITEBACK_PERCENT /100 ; + *threshold_buffers =mult_frac (buffers, +DM_BUFIO_WRITEBACK_PERCENT ,100 ); }/*
@@ -1856,19 +1857,15 @@ static int __init dm_bufio_init(void)memset (&dm_bufio_caches,0 ,sizeof dm_bufio_caches);memset (&dm_bufio_cache_names,0 ,sizeof dm_bufio_cache_names); - mem = (__u64)((totalram_pages - totalhigh_pages) * -DM_BUFIO_MEMORY_PERCENT /100 ) <<PAGE_SHIFT ; + mem = (__u64 )mult_frac (totalram_pages - totalhigh_pages, +DM_BUFIO_MEMORY_PERCENT ,100 ) <<PAGE_SHIFT ;if (mem >ULONG_MAX ) mem =ULONG_MAX ;#ifdef CONFIG_MMU -/* -* Get the size of vmalloc space the same way as VMALLOC_TOTAL -* in fs/proc/internal.h -*/ -if (mem > (VMALLOC_END -VMALLOC_START ) *DM_BUFIO_VMALLOC_PERCENT /100 ) - mem = (VMALLOC_END -VMALLOC_START ) *DM_BUFIO_VMALLOC_PERCENT /100 ; +if (mem >mult_frac (VMALLOC_TOTAL ,DM_BUFIO_VMALLOC_PERCENT ,100 )) + mem =mult_frac (VMALLOC_TOTAL ,DM_BUFIO_VMALLOC_PERCENT ,100 );#endif dm_bufio_default_cache_size = mem;
Greg Kroah-Hartman
maintainerPATCH 21/138 dm: allocate struct mapped_device with kvzalloc
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <[email protected]>
commit 856eb0916d181da6d043cc33e03f54d5c5bbe54a upstream.
The structure srcu_struct can be very big, its size is proportional to the value CONFIG_NR_CPUS. The Fedora kernel has CONFIG_NR_CPUS 8192, the field io_barrier in the struct mapped_device has 84kB in the debugging kernel and 50kB in the non-debugging kernel. The large size may result in failure of the function kzalloc_node.
In order to avoid the allocation failure, we use the function kvzalloc_node, this function falls back to vmalloc if a large contiguous chunk of memory is not available. This patch also moves the field io_barrier to the last position of struct mapped_device - the reason is that on many processor architectures, short memory offsets result in smaller code than long memory offsets - on x86-64 it reduces code size by 320 bytes.
Note to stable kernel maintainers - the kernels 4.11 and older don't have the function kvzalloc_node, you can use the function vzalloc_node instead.
--- drivers/md/dm-core.h | 3 ++- drivers/md/dm.c | 7 ++++--- 2 files changed, 6 insertions(+), 4 deletions(-)
drivers/md/dm-core.h +2 -1
@@ -29,7 +29,6 @@ struct dm_kobject_holder {* DM targets must _not_ deference a mapped_device to directly access its members! */ struct mapped_device { -struct srcu_struct io_barrier;struct mutex suspend_lock;/*
@@ -127,6 +126,8 @@ struct mapped_device {struct blk_mq_tag_set *tag_set; bool use_blk_mq:1; bool init_tio_pdu:1; + +struct srcu_struct io_barrier; };void dm_init_md_queue (struct mapped_device *md);
drivers/md/dm.c +4 -3
@@ -21,6 +21,7 @@#include <linux/delay.h> #include <linux/wait.h> #include <linux/pr.h> +#include <linux/vmalloc.h> #define DM_MSG_PREFIX "core"
@@ -1511,7 +1512,7 @@ static struct mapped_device *alloc_dev(istruct mapped_device *md;void *old_md; - md =kzalloc_node (sizeof (*md),GFP_KERNEL , numa_node_id); + md =vzalloc_node (sizeof (*md), numa_node_id);if (!md) {DMWARN ("unable to allocate device, out of memory." );return NULL ;
@@ -1605,7 +1606,7 @@ bad_io_barrier: bad_minor:module_put (THIS_MODULE ); bad_module_get: -kfree (md); +kvfree (md);return NULL ; }
@@ -1624,7 +1625,7 @@ static void free_dev(struct mapped_devicfree_minor (minor);module_put (THIS_MODULE ); -kfree (md); +kvfree (md); }static void __bind_mempools (struct mapped_device *md,struct dm_table *t)
Greg Kroah-Hartman
maintainerPATCH 22/138 MIPS: pci: Remove KERN_WARN instance inside the mt7620 driver
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Crispin <[email protected]>
commit 8593b18ad348733b5d5ddfa0c79dcabf51dff308 upstream.
Switch the printk() call to the prefered pr_warn() api.
Patchwork: https://patchwork.linux-mips.org/patch/15321/
--- arch/mips/pci/pci-mt7620.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/mips/pci/pci-mt7620.c +1 -1
@@ -121,7 +121,7 @@ static int wait_pciephy_busy(void)else break ;if (retry++ >WAITRETRY_MAX ) { -printk (KERN_WARN "PCIE-PHY retry failed.\n" ); +pr_warn ("PCIE-PHY retry failed.\n" );return -1 ; } }
Greg Kroah-Hartman
maintainerPATCH 23/138 dm: fix race between dm_get_from_kobject() and __dm_destroy()
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hou Tao <[email protected]>
commit b9a41d21dceadf8104812626ef85dc56ee8a60ed upstream.
The following BUG_ON was hit when testing repeat creation and removal of DM devices:
kernel BUG at drivers/md/dm.c:2919!
CPU: 7 PID: 750 Comm: systemd-udevd Not tainted 4.1.44
Call Trace:
[<ffffffff81649e8b>] dm_get_from_kobject+0x34/0x3a
[<ffffffff81650ef1>] dm_attr_show+0x2b/0x5e
[<ffffffff817b46d1>] ? mutex_lock+0x26/0x44
[<ffffffff811df7f5>] sysfs_kf_seq_show+0x83/0xcf
[<ffffffff811de257>] kernfs_seq_show+0x23/0x25
[<ffffffff81199118>] seq_read+0x16f/0x325
[<ffffffff811de994>] kernfs_fop_read+0x3a/0x13f
[<ffffffff8117b625>] __vfs_read+0x26/0x9d
[<ffffffff8130eb59>] ? security_file_permission+0x3c/0x44
[<ffffffff8117bdb8>] ? rw_verify_area+0x83/0xd9
[<ffffffff8117be9d>] vfs_read+0x8f/0xcf
[<ffffffff81193e34>] ? __fdget_pos+0x12/0x41
[<ffffffff8117c686>] SyS_read+0x4b/0x76
[<ffffffff817b606e>] system_call_fastpath+0x12/0x71The bug can be easily triggered, if an extra delay (e.g. 10ms) is added between the test of DMF_FREEING & DMF_DELETING and dm_get() in dm_get_from_kobject().
To fix it, we need to ensure the test of DMF_FREEING & DMF_DELETING and dm_get() are done in an atomic way, so _minor_lock is used.
The other callers of dm_get() have also been checked to be OK: some callers invoke dm_get() under _minor_lock, some callers invoke it under _hash_lock, and dm_start_request() invoke it after increasing md->open_count.
--- drivers/md/dm.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
drivers/md/dm.c +8 -4
@@ -2515,11 +2515,15 @@ struct mapped_device *dm_get_from_kobjec md = container_of(kobj, struct mapped_device, kobj_holder.kobj); -if (test_bit (DMF_FREEING , &md->flags) || -dm_deleting_md (md)) -return NULL ; - +spin_lock (&_minor_lock); +if (test_bit (DMF_FREEING , &md->flags) ||dm_deleting_md (md)) { + md =NULL ; + goto out; + }dm_get (md); +out: +spin_unlock (&_minor_lock); +return md; }
Greg Kroah-Hartman
maintainerPATCH 24/138 MIPS: Fix odd fp register warnings with MIPS64r2
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Hogan <[email protected]>
commit c7fd89a6407ea3a44a2a2fa12d290162c42499c4 upstream.
Building 32-bit MIPS64r2 kernels produces warnings like the following on certain toolchains (such as GNU assembler 2.24.90, but not GNU assembler 2.28.51) since commit 22b8ba765a72 ("MIPS: Fix MIPS64 FP save/restore on 32-bit kernels"), due to the exposure of fpu_save_16odd from fpu_save_double and fpu_restore_16odd from fpu_restore_double:
arch/mips/kernel/r4k_fpu.S:47: Warning: float register should be even, was 1
...arch/mips/kernel/r4k_fpu.S:59: Warning: float register should be even, was 1
...
This appears to be because .set mips64r2 does not change the FPU ABI to 64-bit when -march=mips64r2 (or e.g. -march=xlp) is provided on the command line on that toolchain, from the default FPU ABI of 32-bit due to the -mabi=32. This makes access to the odd FPU registers invalid.
Fix by explicitly changing the FPU ABI with .set fp=64 directives in fpu_save_16odd and fpu_restore_16odd, and moving the undefine of fp up in asmmacro.h so fp doesn't turn into $30.
Patchwork: https://patchwork.linux-mips.org/patch/17656/
--- arch/mips/include/asm/asmmacro.h | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
arch/mips/include/asm/asmmacro.h +5 -3
@@ -19,6 +19,9 @@#include <asm/asmmacro-64.h> #endif +/* preprocessor replaces the fp in ".set fp=64" with $30 otherwise */ +#undef fp +/* * Helper macros for generating raw instruction encodings. */
@@ -105,6 +108,7 @@ .macro fpu_save_16odd thread .set push .set mips64r2 + .set fp=64SET_HARDFLOAT sdc1 $f1, THREAD_FPR1(\thread) sdc1 $f3, THREAD_FPR3(\thread)
@@ -163,6 +167,7 @@ .macro fpu_restore_16odd thread .set push .set mips64r2 + .set fp=64SET_HARDFLOAT ldc1 $f1, THREAD_FPR1(\thread) ldc1 $f3, THREAD_FPR3(\thread)
@@ -234,9 +239,6 @@ .endm#ifdef TOOLCHAIN_SUPPORTS_MSA -/* preprocessor replaces the fp in ".set fp=64" with $30 otherwise */ -#undef fp - .macro _cfcmsa rd, cs .set push .set mips32r2
Greg Kroah-Hartman
maintainerPATCH 25/138 MIPS: dts: remove bogus bcm96358nb4ser.dtb from dtb-y entry
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masahiro Yamada <[email protected]>
commit 3cad14d56adbf7d621fc5a35db42f3acc0a2d6e8 upstream.
arch/mips/boot/dts/brcm/bcm96358nb4ser.dts does not exist, so we cannot build bcm96358nb4ser.dtb .
--- arch/mips/boot/dts/brcm/Makefile | 1 - 1 file changed, 1 deletion(-)
arch/mips/boot/dts/brcm/Makefile +0 -1
@@ -22,7 +22,6 @@ dtb-$(CONFIG_DT_NONE) += \ bcm63268-comtrend-vr-3032u.dtb \ bcm93384wvg.dtb \ bcm93384wvg_viper.dtb \ - bcm96358nb4ser.dtb \ bcm96368mvwg.dtb \ bcm9ejtagprb.dtb \ bcm97125cbmb.dtb \
Greg Kroah-Hartman
maintainerPATCH 26/138 MIPS: Fix an n32 core file generation regset support regression
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej W. Rozycki <[email protected]>
commit 547da673173de51f73887377eb275304775064ad upstream.
Fix a commit 7aeb753b5353 ("MIPS: Implement task_user_regset_view.") regression, then activated by commit 6a9c001b7ec3 ("MIPS: Switch ELF core dumper to use regsets.)", that caused n32 processes to dump o32 core files by failing to set the EF_MIPS_ABI2 flag in the ELF core file header's `e_flags' member:
$ file tls-core tls-core: ELF 32-bit MSB executable, MIPS, N32 MIPS64 rel2 version 1 (SYSV), [...] $ ./tls-core Aborted (core dumped) $ file core core: ELF 32-bit MSB core file MIPS, MIPS-I version 1 (SYSV), SVR4-style $
Previously the flag was set as the result of a:
statement placed in arch/mips/kernel/binfmt_elfn32.c, however in the regset case, i.e. when CORE_DUMP_USE_REGSET is set, ELF_CORE_EFLAGS is no longer used by fill_note_info' in fs/binfmt_elf.c, and instead the ->e_flags' member of the regset view chosen is. We have the views defined in arch/mips/kernel/ptrace.c, however only an o32 and an n64 one, and the latter is used for n32 as well. Consequently an o32 core file is incorrectly dumped from n32 processes (the ELF32 vs ELF64 class is chosen elsewhere, and the 32-bit one is correctly selected for n32).
Correct the issue then by defining an n32 regset view and using it as appropriate. Issue discovered in GDB testing.
Patchwork: https://patchwork.linux-mips.org/patch/17617/
--- arch/mips/kernel/ptrace.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+)
arch/mips/kernel/ptrace.c +17 -0
@@ -647,6 +647,19 @@ static const struct user_regset_view use .n = ARRAY_SIZE(mips64_regsets), }; +#ifdef CONFIG_MIPS32_N32 + +static const struct user_regset_view user_mipsn32_view = { + .name ="mipsn32" , + .e_flags =EF_MIPS_ABI2 , + .e_machine =ELF_ARCH , + .ei_osabi =ELF_OSABI , + .regsets = mips64_regsets, + .n =ARRAY_SIZE (mips64_regsets), +}; + +#endif /* CONFIG_MIPS32_N32 */ +#endif /* CONFIG_64BIT */ const struct user_regset_view *task_user_regset_view (struct task_struct *task)
@@ -658,6 +671,10 @@ const struct user_regset_view *task_userif (test_tsk_thread_flag (task,TIF_32BIT_REGS ))return &user_mips_view;#endif +#ifdef CONFIG_MIPS32_N32 +if (test_tsk_thread_flag (task,TIF_32BIT_ADDR )) +return &user_mipsn32_view; +#endif return &user_mips64_view;#endif }
Greg Kroah-Hartman
maintainerPATCH 27/138 MIPS: BCM47XX: Fix LED inversion for WRT54GSv1
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mirko Parthey <[email protected]>
commit 56a46acf62af5ba44fca2f3f1c7c25a2d5385b19 upstream.
The WLAN LED on the Linksys WRT54GSv1 is active low, but the software treats it as active high. Fix the inverted logic.
Patchwork: https://patchwork.linux-mips.org/patch/16071/
--- arch/mips/bcm47xx/leds.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/mips/bcm47xx/leds.c +1 -1
@@ -330,7 +330,7 @@ bcm47xx_leds_linksys_wrt54g3gv2[] __init/* Verified on: WRT54GS V1.0 */ static const struct gpio_led bcm47xx_leds_linksys_wrt54g_type_0101[]__initconst = { -BCM47XX_GPIO_LED (0 ,"green" ,"wlan" ,0 ,LEDS_GPIO_DEFSTATE_OFF ), +BCM47XX_GPIO_LED (0 ,"green" ,"wlan" ,1 ,LEDS_GPIO_DEFSTATE_OFF ),BCM47XX_GPIO_LED (1 ,"green" ,"power" ,0 ,LEDS_GPIO_DEFSTATE_ON ),BCM47XX_GPIO_LED (7 ,"green" ,"dmz" ,1 ,LEDS_GPIO_DEFSTATE_OFF ), };
Greg Kroah-Hartman
maintainerPATCH 28/138 rt2x00usb: mark device removed when get ENOENT usb error
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanislaw Gruszka <[email protected]>
commit bfa62a52cad93686bb8d8171ea5288813248a7c6 upstream.
ENOENT usb error mean "specified interface or endpoint does not exist or is not enabled". Mark device not present when we encounter this error similar like we do with ENODEV error.
Otherwise we can have infinite loop in rt2x00usb_work_rxdone(), because we remove and put again RX entries to the queue infinitely.
We can have similar situation when submit urb will fail all the time with other error, so we need consider to limit number of entries processed by rxdone work. But for now, since the patch fixes reproducible soft lockup issue on single processor systems and taken ENOENT error meaning, let apply this fix.
Patch adds additional ENOENT check not only in rx kick routine, but also on other places where we check for ENODEV error.
--- drivers/net/wireless/ralink/rt2x00/rt2x00usb.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/wireless/ralink/rt2x00/rt2x00usb.c +3 -3
@@ -57,7 +57,7 @@ int rt2x00usb_vendor_request(struct rt2xif (status >=0 )return 0 ; -if (status == -ENODEV ) { +if (status == -ENODEV || status == -ENOENT ) {/* Device has disappeared. */ clear_bit (DEVICE_STATE_PRESENT , &rt2x00dev->flags);break ;
@@ -321,7 +321,7 @@ static bool rt2x00usb_kick_tx_entry(stru status =usb_submit_urb (entry_priv->urb,GFP_ATOMIC );if (status) { -if (status == -ENODEV ) +if (status == -ENODEV || status == -ENOENT )clear_bit (DEVICE_STATE_PRESENT , &rt2x00dev->flags);set_bit (ENTRY_DATA_IO_FAILED , &entry->flags);rt2x00lib_dmadone (entry);
@@ -410,7 +410,7 @@ static bool rt2x00usb_kick_rx_entry(stru status =usb_submit_urb (entry_priv->urb,GFP_ATOMIC );if (status) { -if (status == -ENODEV ) +if (status == -ENODEV || status == -ENOENT )clear_bit (DEVICE_STATE_PRESENT , &rt2x00dev->flags);set_bit (ENTRY_DATA_IO_FAILED , &entry->flags);rt2x00lib_dmadone (entry);
Greg Kroah-Hartman
maintainerPATCH 29/138 autofs: dont fail mount for transient error
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <[email protected]>
commit ecc0c469f27765ed1e2b967be0aa17cee1a60b76 upstream.
Currently if the autofs kernel module gets an error when writing to the pipe which links to the daemon, then it marks the whole moutpoint as catatonic, and it will stop working.
It is possible that the error is transient. This can happen if the daemon is slow and more than 16 requests queue up. If a subsequent process tries to queue a request, and is then signalled, the write to the pipe will return -ERESTARTSYS and autofs will take that as total failure.
So change the code to assess -ERESTARTSYS and -ENOMEM as transient failures which only abort the current request, not the whole mountpoint.
It isn't a crash or a data corruption, but having autofs mountpoints suddenly stop working is rather inconvenient.
Ian said:
: And given the problems with a half dozen (or so) user space applications : consuming large amounts of CPU under heavy mount and umount activity this : could happen more easily than we expect.
--- fs/autofs4/waitq.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-)
fs/autofs4/waitq.c +14 -1
@@ -87,7 +87,8 @@ static int autofs4_write(struct autofs_sspin_unlock_irqrestore (¤t->sighand->siglock, flags); } -return (bytes >0 ); +/* if 'wr' returned 0 (impossible) we assume -EIO (safe) */ +return bytes ==0 ?0 : wr <0 ? wr : -EIO ; } static void autofs4_notify_daemon(struct autofs_sb_info *sbi,
@@ -101,6 +102,7 @@ static void autofs4_notify_daemon(struct } pkt;struct file *pipe =NULL ;size_t pktsz; +int ret; pr_debug("wait id = 0x%08lx, name = %.*s, type=%d\n", (unsigned long) wq->wait_queue_token,
@@ -175,7 +177,18 @@ static void autofs4_notify_daemon(structmutex_unlock (&sbi->wq_mutex);if (autofs4_write (sbi, pipe, &pkt, pktsz)) +switch (ret =autofs4_write (sbi, pipe, &pkt, pktsz)) { +case 0 : +break ; +case -ENOMEM : +case -ERESTARTSYS : +/* Just fail this one */ +autofs4_wait_release (sbi, wq->wait_queue_token, ret); +break ; +default :autofs4_catatonic_mode (sbi); +break ; + }fput (pipe); }
Greg Kroah-Hartman
maintainerPATCH 30/138 nilfs2: fix race condition that causes file system corruption
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Rohner <[email protected]>
commit 31ccb1f7ba3cfe29631587d451cf5bb8ab593550 upstream.
There is a race condition between nilfs_dirty_inode() and nilfs_set_file_dirty().
When a file is opened, nilfs_dirty_inode() is called to update the access timestamp in the inode. It calls __nilfs_mark_inode_dirty() in a separate transaction. __nilfs_mark_inode_dirty() caches the ifile buffer_head in the i_bh field of the inode info structure and marks it as dirty.
After some data was written to the file in another transaction, the function nilfs_set_file_dirty() is called, which adds the inode to the ns_dirty_files list.
Then the segment construction calls nilfs_segctor_collect_dirty_files(), which goes through the ns_dirty_files list and checks the i_bh field. If there is a cached buffer_head in i_bh it is not marked as dirty again.
Since nilfs_dirty_inode() and nilfs_set_file_dirty() use separate transactions, it is possible that a segment construction that writes out the ifile occurs in-between the two. If this happens the inode is not on the ns_dirty_files list, but its ifile block is still marked as dirty and written out.
In the next segment construction, the data for the file is written out and nilfs_bmap_propagate() updates the b-tree. Eventually the bmap root is written into the i_bh block, which is not dirty, because it was written out in another segment construction.
As a result the bmap update can be lost, which leads to file system corruption. Either the virtual block address points to an unallocated DAT block, or the DAT entry will be reused for something different.
The error can remain undetected for a long time. A typical error message would be one of the "bad btree" errors or a warning that a DAT entry could not be found.
This bug can be reproduced reliably by a simple benchmark that creates and overwrites millions of 4k files.
--- fs/nilfs2/segment.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
fs/nilfs2/segment.c +4 -2
@@ -1956,8 +1956,6 @@ static int nilfs_segctor_collect_dirty_f err, ii->vfs_inode.i_ino);return err; } -mark_buffer_dirty (ibh); -nilfs_mdt_mark_dirty (ifile);spin_lock (&nilfs->ns_inode_lock);if (likely (!ii->i_bh)) ii->i_bh = ibh;
@@ -1966,6 +1964,10 @@ static int nilfs_segctor_collect_dirty_f goto retry; } +// Always redirty the buffer to avoid race condition +mark_buffer_dirty (ii->i_bh); +nilfs_mdt_mark_dirty (ifile); +clear_bit (NILFS_I_QUEUED , &ii->i_state);set_bit (NILFS_I_BUSY , &ii->i_state);list_move_tail (&ii->i_dirty, &sci->sc_dirty_files);
Greg Kroah-Hartman
maintainerPATCH 31/138 eCryptfs: use after free in ecryptfs_release_messaging()
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
commit db86be3a12d0b6e5c5b51c2ab2a48f06329cb590 upstream.
We're freeing the list iterator so we should be using the _safe() version of hlist_for_each_entry().
--- fs/ecryptfs/messaging.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
fs/ecryptfs/messaging.c +4 -3
@@ -442,15 +442,16 @@ void ecryptfs_release_messaging(void) }if (ecryptfs_daemon_hash) {struct ecryptfs_daemon *daemon; +struct hlist_node *n;int i;mutex_lock (&ecryptfs_daemon_hash_mux);for (i =0 ; i < (1 << ecryptfs_hash_bits); i++) {int rc; -hlist_for_each_entry (daemon, - &ecryptfs_daemon_hash[i], - euid_chain) { +hlist_for_each_entry_safe (daemon, n, + &ecryptfs_daemon_hash[i], + euid_chain) { rc =ecryptfs_exorcise_daemon (daemon);if (rc) printk(KERN_ERR "%s: Error whilst "
Greg Kroah-Hartman
maintainerPATCH 32/138 libceph: dont WARN() if user tries to add invalid key
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
commit b11270853fa3654f08d4a6a03b23ddb220512d8d upstream.
The WARN_ON(!key->len) in set_secret() in net/ceph/crypto.c is hit if a user tries to add a key of type "ceph" with an invalid payload as follows (assuming CONFIG_CEPH_LIB=y):
echo -e -n '\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' \
| keyctl padd ceph desc @s
This can be hit by fuzzers. As this is merely bad input and not a kernel bug, replace the WARN_ON() with return -EINVAL.
--- net/ceph/crypto.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/ceph/crypto.c +3 -1
@@ -34,7 +34,9 @@ static int set_secret(struct ceph_cryptoreturn -ENOTSUPP ; } -WARN_ON (!key->len); +if (!key->len) +return -EINVAL ; + key->key =kmemdup (buf, key->len,GFP_NOIO );if (!key->key) { ret = -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 33/138 bcache: check ca->alloc_thread initialized before wake up it
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Coly Li <[email protected]>
commit 91af8300d9c1d7c6b6a2fd754109e08d4798b8d8 upstream.
In bcache code, sysfs entries are created before all resources get allocated, e.g. allocation thread of a cache set.
There is posibility for NULL pointer deference if a resource is accessed but which is not initialized yet. Indeed Jorg Bornschein catches one on cache set allocation thread and gets a kernel oops.
The reason for this bug is, when bch_bucket_alloc() is called during cache set registration and attaching, ca->alloc_thread is not properly allocated and initialized yet, call wake_up_process() on ca->alloc_thread triggers NULL pointer deference failure. A simple and fast fix is, before waking up ca->alloc_thread, checking whether it is allocated, and only wake up ca->alloc_thread when it is not NULL.
--- drivers/md/bcache/alloc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/md/bcache/alloc.c +2 -1
@@ -404,7 +404,8 @@ long bch_bucket_alloc(struct cache *ca,finish_wait (&ca->set->bucket_wait, &w); out: -wake_up_process (ca->alloc_thread); +if (ca->alloc_thread) +wake_up_process (ca->alloc_thread);trace_bcache_alloc (ca, reserve);
Greg Kroah-Hartman
maintainerPATCH 34/138 isofs: fix timestamps beyond 2027
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
commit 34be4dbf87fc3e474a842305394534216d428f5d upstream.
isofs uses a 'char' variable to load the number of years since 1900 for an inode timestamp. On architectures that use a signed char type by default, this results in an invalid date for anything beyond 2027.
This changes the function argument to a 'u8' array, which is defined the same way on all architectures, and unambiguously lets us use years until 2155.
This should be backported to all kernels that might still be in use by that date.
--- fs/isofs/isofs.h | 2 +- fs/isofs/rock.h | 2 +- fs/isofs/util.c | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-)
fs/isofs/isofs.h +1 -1
@@ -103,7 +103,7 @@ static inline unsigned int isonum_733(ch/* Ignore bigendian datum due to broken mastering programs */ return get_unaligned_le32 (p); } -extern int iso_date (char *,int ); +extern int iso_date (u8 *,int );struct inode ;/* To make gcc happy */
fs/isofs/rock.h +1 -1
@@ -65,7 +65,7 @@ struct RR_PL_s { };struct stamp { -char time[7 ]; +__u8 time[7 ];/* actually 6 unsigned, 1 signed */ } __attribute__ ((packed));struct RR_TF_s {
fs/isofs/util.c +1 -1
@@ -15,7 +15,7 @@* to GMT. Thus we should always be correct. */ -int iso_date (char * p,int flag) +int iso_date (u8 *p,int flag) {int year, month, day, hour, minute, second, tz;int crtime;
Greg Kroah-Hartman
maintainerPATCH 35/138 NFS: Fix typo in nomigration mount option
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joshua Watt <[email protected]>
commit f02fee227e5f21981152850744a6084ff3fa94ee upstream.
The option was incorrectly masking off all other options.
--- fs/nfs/super.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/nfs/super.c +1 -1
@@ -1339,7 +1339,7 @@ static int nfs_parse_mount_options(char mnt->options |=NFS_OPTION_MIGRATION ;break ;case Opt_nomigration: - mnt->options &=NFS_OPTION_MIGRATION ; + mnt->options &= ~NFS_OPTION_MIGRATION ;break ;/*
Greg Kroah-Hartman
maintainerPATCH 36/138 nfs: Fix ugly referral attributes
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <[email protected]>
commit c05cefcc72416a37eba5a2b35f0704ed758a9145 upstream.
Before traversing a referral and performing a mount, the mounted-on directory looks strange:
dr-xr-xr-x. 2 4294967294 4294967294 0 Dec 31 1969 dir.0
nfs4_get_referral is wiping out any cached attributes with what was returned via GETATTR(fs_locations), but the bit mask for that operation does not request any file attributes.
Retrieve owner and timestamp information so that the memcpy in nfs4_get_referral fills in more attributes.
Changes since v1:
- Don't request attributes that the client unconditionally replaces
- Request only MOUNTED_ON_FILEID or FILEID attribute, not both
- encode_fs_locations() doesn't use the third bitmask word
--- fs/nfs/nfs4proc.c | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-)
fs/nfs/nfs4proc.c +8 -10
@@ -256,15 +256,12 @@ const u32 nfs4_fsinfo_bitmap[3] = { FATT };const u32 nfs4_fs_locations_bitmap[3 ] = { -FATTR4_WORD0_TYPE - |FATTR4_WORD0_CHANGE +FATTR4_WORD0_CHANGE |FATTR4_WORD0_SIZE |FATTR4_WORD0_FSID |FATTR4_WORD0_FILEID |FATTR4_WORD0_FS_LOCATIONS , -FATTR4_WORD1_MODE - |FATTR4_WORD1_NUMLINKS - |FATTR4_WORD1_OWNER +FATTR4_WORD1_OWNER |FATTR4_WORD1_OWNER_GROUP |FATTR4_WORD1_RAWDEV |FATTR4_WORD1_SPACE_USED
@@ -6678,9 +6675,7 @@ static int _nfs4_proc_fs_locations(struc struct page *page) {struct nfs_server *server =NFS_SERVER (dir); -u32 bitmask[3 ] = { - [0 ] =FATTR4_WORD0_FSID |FATTR4_WORD0_FS_LOCATIONS , - }; +u32 bitmask[3 ];struct nfs4_fs_locations_arg args = { .dir_fh =NFS_FH (dir), .name = name,
@@ -6699,12 +6694,15 @@ static int _nfs4_proc_fs_locations(strucdprintk ("%s: start\n" , __func__); + bitmask[0 ] = nfs4_fattr_bitmap[0 ] |FATTR4_WORD0_FS_LOCATIONS ; + bitmask[1 ] = nfs4_fattr_bitmap[1 ]; +/* Ask for the fileid of the absent filesystem if mounted_on_fileid * is not supported */ if (NFS_SERVER (dir)->attr_bitmask[1 ] &FATTR4_WORD1_MOUNTED_ON_FILEID ) - bitmask[1 ] |=FATTR4_WORD1_MOUNTED_ON_FILEID ; + bitmask[0 ] &= ~FATTR4_WORD0_FILEID ;else - bitmask[0 ] |=FATTR4_WORD0_FILEID ; + bitmask[1 ] &= ~FATTR4_WORD1_MOUNTED_ON_FILEID ;nfs_fattr_init (&fs_locations->fattr); fs_locations->server = server;
Greg Kroah-Hartman
maintainerPATCH 37/138 NFS: Avoid RCU usage in tracepoints
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anna Schumaker <[email protected]>
commit 3944369db701f075092357b511fd9f5755771585 upstream.
There isn't an obvious way to acquire and release the RCU lock during a tracepoint, so we can't use the rpc_peeraddr2str() function here. Instead, rely on the client's cl_hostname, which should have similar enough information without needing an rcu_dereference().
--- fs/nfs/nfs4trace.h | 24 ++++++------------------ 1 file changed, 6 insertions(+), 18 deletions(-)
fs/nfs/nfs4trace.h +6 -18
@@ -201,17 +201,13 @@ DECLARE_EVENT_CLASS(nfs4_clientid_event,TP_ARGS (clp, error),TP_STRUCT__entry ( - __string(dstaddr, - rpc_peeraddr2str(clp->cl_rpcclient, - RPC_DISPLAY_ADDR)) + __string(dstaddr, clp->cl_hostname)__field (int, error) ),TP_fast_assign ( __entry->error = error; -__assign_str (dstaddr, -rpc_peeraddr2str (clp->cl_rpcclient, -RPC_DISPLAY_ADDR )); +__assign_str (dstaddr, clp->cl_hostname); ), TP_printk(
@@ -1103,9 +1099,7 @@ DECLARE_EVENT_CLASS(nfs4_inode_callback_ __field(dev_t, dev) __field(u32, fhandle) __field(u64, fileid) -__string (dstaddr, clp ? -rpc_peeraddr2str (clp->cl_rpcclient, -RPC_DISPLAY_ADDR ) :"unknown" ) +__string (dstaddr, clp ? clp->cl_hostname :"unknown" ) ), TP_fast_assign(
@@ -1118,9 +1112,7 @@ DECLARE_EVENT_CLASS(nfs4_inode_callback_ __entry->fileid =0 ; __entry->dev =0 ; } -__assign_str (dstaddr, clp ? -rpc_peeraddr2str (clp->cl_rpcclient, -RPC_DISPLAY_ADDR ) :"unknown" ) +__assign_str (dstaddr, clp ? clp->cl_hostname :"unknown" ) ), TP_printk(
@@ -1162,9 +1154,7 @@ DECLARE_EVENT_CLASS(nfs4_inode_stateid_c __field(dev_t, dev) __field(u32, fhandle) __field(u64, fileid) -__string (dstaddr, clp ? -rpc_peeraddr2str (clp->cl_rpcclient, - RPC_DISPLAY_ADDR) : "unknown") + __string(dstaddr, clp ? clp->cl_hostname : "unknown") __field(int, stateid_seq)__field (u32, stateid_hash) ),
@@ -1179,9 +1169,7 @@ DECLARE_EVENT_CLASS(nfs4_inode_stateid_c __entry->fileid =0 ; __entry->dev =0 ; } -__assign_str (dstaddr, clp ? -rpc_peeraddr2str (clp->cl_rpcclient, -RPC_DISPLAY_ADDR ) :"unknown" ) +__assign_str (dstaddr, clp ? clp->cl_hostname :"unknown" ) __entry->stateid_seq =be32_to_cpu (stateid->seqid); __entry->stateid_hash =
Greg Kroah-Hartman
maintainerPATCH 38/138 nfsd: deal with revoked delegations appropriately
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Elble <[email protected]>
commit 95da1b3a5aded124dd1bda1e3cdb876184813140 upstream.
If a delegation has been revoked by the server, operations using that delegation should error out with NFS4ERR_DELEG_REVOKED in the >4.1 case, and NFS4ERR_BAD_STATEID otherwise.
The server needs NFSv4.1 clients to explicitly free revoked delegations. If the server returns NFS4ERR_DELEG_REVOKED, the client will do that; otherwise it may just forget about the delegation and be unable to recover when it later sees SEQ4_STATUS_RECALLABLE_STATE_REVOKED set on a SEQUENCE reply. That can cause the Linux 4.1 client to loop in its stage manager.
--- fs/nfsd/nfs4state.c | 25 ++++++++++++++++++++++++- 1 file changed, 24 insertions(+), 1 deletion(-)
fs/nfsd/nfs4state.c +24 -1
@@ -3967,7 +3967,8 @@ static struct nfs4_delegation *find_dele {struct nfs4_stid *ret; - ret =find_stateid_by_type (cl, s,NFS4_DELEG_STID ); + ret =find_stateid_by_type (cl, s, +NFS4_DELEG_STID |NFS4_REVOKED_DELEG_STID );if (!ret)return NULL ;return delegstateid (ret);
@@ -3990,6 +3991,12 @@ nfs4_check_deleg(struct nfs4_client *cl, deleg =find_deleg_stateid (cl, &open->op_delegate_stateid);if (deleg ==NULL ) goto out; +if (deleg->dl_stid.sc_type ==NFS4_REVOKED_DELEG_STID ) { +nfs4_put_stid (&deleg->dl_stid); +if (cl->cl_minorversion) + status = nfserr_deleg_revoked; + goto out; + } flags =share_access_to_flags (open->op_share_access); status =nfs4_check_delegmode (deleg, flags);if (status) {
@@ -4858,6 +4865,16 @@ nfsd4_lookup_stateid(struct nfsd4_compou struct nfs4_stid **s, struct nfsd_net *nn) { __be32 status; +bool return_revoked = false; + +/* +* only return revoked delegations if explicitly asked. +* otherwise we report revoked or bad_stateid status. +*/ +if (typemask &NFS4_REVOKED_DELEG_STID ) + return_revoked = true; +else if (typemask &NFS4_DELEG_STID ) + typemask |=NFS4_REVOKED_DELEG_STID ;if (ZERO_STATEID (stateid) ||ONE_STATEID (stateid))return nfserr_bad_stateid;
@@ -4872,6 +4889,12 @@ nfsd4_lookup_stateid(struct nfsd4_compou *s =find_stateid_by_type (cstate->clp, stateid, typemask);if (!*s)return nfserr_bad_stateid; +if (((*s)->sc_type ==NFS4_REVOKED_DELEG_STID ) && !return_revoked) { +nfs4_put_stid (*s); +if (cstate->minorversion) +return nfserr_deleg_revoked; +return nfserr_bad_stateid; + }return nfs_ok; }
Greg Kroah-Hartman
maintainerPATCH 39/138 rtlwifi: rtl8192ee: Fix memory leak when loading firmware
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Larry Finger <[email protected]>
commit 519ce2f933fa14acf69d5c8cabcc18711943d629 upstream.
In routine rtl92ee_set_fw_rsvdpagepkt(), the driver allocates an skb, but never calls rtl_cmd_send_packet(), which will free the buffer. All other rtlwifi drivers perform this operation correctly.
This problem has been in the driver since it was included in the kernel. Fortunately, each firmware load only leaks 4 buffers, which likely explains why it has not previously been detected.
--- drivers/net/wireless/realtek/rtlwifi/rtl8192ee/fw.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/wireless/realtek/rtlwifi/rtl8192ee/fw.c +4 -2
@@ -664,7 +664,7 @@ void rtl92ee_set_fw_rsvdpagepkt(struct istruct rtl_priv *rtlpriv =rtl_priv (hw);struct rtl_mac *mac =rtl_mac (rtl_priv (hw));struct sk_buff *skb =NULL ; - +bool rtstatus;u32 totalpacketlen;u8 u1rsvdpageloc[5 ] = {0 };bool b_dlok = false;
@@ -727,7 +727,9 @@ void rtl92ee_set_fw_rsvdpagepkt(struct imemcpy ((u8 *)skb_put (skb, totalpacketlen), &reserved_page_packet, totalpacketlen); - b_dlok = true; + rtstatus =rtl_cmd_send_packet (hw, skb); +if (rtstatus) + b_dlok = true;if (b_dlok) { RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD ,
Greg Kroah-Hartman
maintainerPATCH 40/138 rtlwifi: fix uninitialized rtlhal->last_suspend_sec time
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
commit 3f2a162fab15aee243178b5308bb5d1206fc4043 upstream.
We set rtlhal->last_suspend_sec to an uninitialized stack variable, but unfortunately gcc never warned about this, I only found it while working on another patch. I opened a gcc bug for this.
Presumably the value of rtlhal->last_suspend_sec is not all that important, but it does get used, so we probably want the patch backported to stable kernels.
--- drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c +1 -0
@@ -1378,6 +1378,7 @@ static void _rtl8821ae_get_wakeup_reason ppsc->wakeup_reason =0 ; +do_gettimeofday (&ts); rtlhal->last_suspend_sec = ts.tv_sec;switch (fw_reason) {
Greg Kroah-Hartman
maintainerPATCH 41/138 ata: fixes kernel crash while tracing ata_eh_link_autopsy event
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rameshwar Prasad Sahu <[email protected]>
commit f1601113ddc0339a745e702f4fb1ca37d4875e65 upstream.
When tracing ata link error event, the kernel crashes when the disk is removed due to NULL pointer access by trace_ata_eh_link_autopsy API. This occurs as the dev is NULL when the disk disappeared. This patch fixes this crash by calling trace_ata_eh_link_autopsy only if "dev" is not NULL.
v2 changes:
Removed direct passing "link" pointer instead of "dev" in trace API.
--- drivers/ata/libata-eh.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/ata/libata-eh.c +1 -1
@@ -2329,8 +2329,8 @@ static void ata_eh_link_autopsy(struct aif (dev->flags &ATA_DFLAG_DUBIOUS_XFER ) eflags |=ATA_EFLAG_DUBIOUS_XFER ; ehc->i.action |=ata_eh_speed_down (dev, eflags, all_err_mask); +trace_ata_eh_link_autopsy (dev, ehc->i.action, all_err_mask); } -trace_ata_eh_link_autopsy (dev, ehc->i.action, all_err_mask);DPRINTK ("EXIT\n" ); }
Greg Kroah-Hartman
maintainerPATCH 42/138 ext4: fix interaction between i_size, fallocate, and delalloc after a crash
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Theodore Ts'o <[email protected]>
commit 51e3ae81ec58e95f10a98ef3dd6d7bce5d8e35a2 upstream.
If there are pending writes subject to delayed allocation, then i_size will show size after the writes have completed, while i_disksize contains the value of i_size on the disk (since the writes have not been persisted to disk).
If fallocate(2) is called with the FALLOC_FL_KEEP_SIZE flag, either with or without the FALLOC_FL_ZERO_RANGE flag set, and the new size after the fallocate(2) is between i_size and i_disksize, then after a crash, if a journal commit has resulted in the changes made by the fallocate() call to be persisted after a crash, but the delayed allocation write has not resolved itself, i_size would not be updated, and this would cause the following e2fsck complaint:
Inode 12, end of extent exceeds allowed value
(logical block 33, physical block 33441, len 7)
This can only take place on a sparse file, where the fallocate(2) call is allocating blocks in a range which is before a pending delayed allocation write which is extending i_size. Since this situation is quite rare, and the window in which the crash must take place is typically < 30 seconds, in practice this condition will rarely happen.
Nevertheless, it can be triggered in testing, and in particular by xfstests generic/456.
--- fs/ext4/extents.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
fs/ext4/extents.c +4 -2
@@ -4803,7 +4803,8 @@ static long ext4_zero_range(struct file }if (!(mode &FALLOC_FL_KEEP_SIZE ) && - offset + len >i_size_read (inode)) { + (offset + len >i_size_read (inode) || + offset + len >EXT4_I (inode)->i_disksize)) { new_size = offset + len; ret =inode_newsize_ok (inode, new_size);if (ret)
@@ -4974,7 +4975,8 @@ long ext4_fallocate(struct file *file, i }if (!(mode &FALLOC_FL_KEEP_SIZE ) && - offset + len >i_size_read (inode)) { + (offset + len >i_size_read (inode) || + offset + len >EXT4_I (inode)->i_disksize)) { new_size = offset + len; ret =inode_newsize_ok (inode, new_size);if (ret)
Greg Kroah-Hartman
maintainerPATCH 43/138 ALSA: pcm: update tstamp only if audio_tstamp changed
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Henrik Eriksson <[email protected]>
commit 20e3f985bb875fea4f86b04eba4b6cc29bfd6b71 upstream.
commit 3179f6200188 ("ALSA: core: add .get_time_info") had a side effect of changing the behaviour of the PCM runtime tstamp. Prior to this change tstamp was not updated by snd_pcm_update_hw_ptr0() unless the hw_ptr had moved, after this change tstamp was always updated.
For an application using alsa-lib, doing snd_pcm_readi() followed by snd_pcm_status() to estimate the age of the read samples by subtracting status->avail * [sample rate] from status->tstamp this change degraded the accuracy of the estimate on devices where the pcm hw does not provide a granular hw_ptr, e.g., devices using soc-generic-dmaengine-pcm.c and a dma-engine with residue_granularity DMA_RESIDUE_GRANULARITY_DESCRIPTOR. The accuracy of the estimate depended on the latency between the PCM hw completing a period and the driver called snd_pcm_period_elapsed() to notify ALSA core, typically determined by interrupt handling latency. After the change the accuracy of the estimate depended on the latency between the PCM hw completing a period and the application calling snd_pcm_status(), determined by the scheduling of the application process. The maximum error of the estimate is one period length in both cases, but the error average and variance is smaller when it depends on interrupt latency.
Instead of always updating tstamp, update it only if audio_tstamp changed.
--- sound/core/pcm_lib.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
sound/core/pcm_lib.c +4 -2
@@ -264,8 +264,10 @@ static void update_audio_tstamp(struct s runtime->rate); *audio_tstamp =ns_to_timespec (audio_nsecs); } - runtime->status->audio_tstamp = *audio_tstamp; - runtime->status->tstamp = *curr_tstamp; +if (!timespec_equal (&runtime->status->audio_tstamp, audio_tstamp)) { + runtime->status->audio_tstamp = *audio_tstamp; + runtime->status->tstamp = *curr_tstamp; + }/* * re-take a driver timestamp to let apps detect if the reference tstamp
Greg Kroah-Hartman
maintainerPATCH 44/138 ALSA: usb-audio: Add sanity checks to FE parser
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit d937cd6790a2bef2d07b500487646bd794c039bb upstream.
When the usb-audio descriptor contains the malformed feature unit description with a too short length, the driver may access out-of-bounds. Add a sanity check of the header size at the beginning of parse_audio_feature_unit().
--- sound/usb/mixer.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
sound/usb/mixer.c +12 -0
@@ -1463,6 +1463,12 @@ static int parse_audio_feature_unit(stru__u8 *bmaControls;if (state->mixer->protocol ==UAC_VERSION_1 ) { +if (hdr->bLength <7 ) { +usb_audio_err (state->chip, +"unit %u: invalid UAC_FEATURE_UNIT descriptor\n" , + unitid); +return -EINVAL ; + } csize = hdr->bControlSize;if (!csize) { usb_audio_dbg(state->chip,
@@ -1480,6 +1486,12 @@ static int parse_audio_feature_unit(stru } }else {struct uac2_feature_unit_descriptor *ftr = _ftr; +if (hdr->bLength <6 ) { +usb_audio_err (state->chip, +"unit %u: invalid UAC_FEATURE_UNIT descriptor\n" , + unitid); +return -EINVAL ; + } csize =4 ; channels = (hdr->bLength -6 ) /4 -1 ; bmaControls = ftr->bmaControls;
Greg Kroah-Hartman
maintainerPATCH 45/138 ALSA: usb-audio: Fix potential out-of-bound access at parsing SU
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit f658f17b5e0e339935dca23e77e0f3cad591926b upstream.
The usb-audio driver may trigger an out-of-bound access at parsing a malformed selector unit, as it checks the header length only after evaluating bNrInPins field, which can be already above the given length. Fix it by adding the length check beforehand.
--- sound/usb/mixer.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
sound/usb/mixer.c +2 -1
@@ -2092,7 +2092,8 @@ static int parse_audio_selector_unit(strconst struct usbmix_name_map *map;char **namelist; -if (!desc->bNrInPins || desc->bLength <5 + desc->bNrInPins) { +if (desc->bLength <5 || !desc->bNrInPins || + desc->bLength <5 + desc->bNrInPins) {usb_audio_err (state->chip,"invalid SELECTOR UNIT descriptor %d\n" , unitid);return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 46/138 ALSA: usb-audio: Add sanity checks in v2 clock parsers
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 0a62d6c966956d77397c32836a5bbfe3af786fc1 upstream.
The helper functions to parse and look for the clock source, selector and multiplier unit may return the descriptor with a too short length than required, while there is no sanity check in the caller side. Add some sanity checks in the parsers, at least, to guarantee the given descriptor size, for avoiding the potential crashes.
--- sound/usb/clock.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
sound/usb/clock.c +6 -3
@@ -43,7 +43,7 @@ static struct uac_clock_source_descriptowhile ((cs =snd_usb_find_csint_desc (ctrl_iface->extra, ctrl_iface->extralen, cs,UAC2_CLOCK_SOURCE ))) { -if (cs->bClockID == clock_id) +if (cs->bLength >=sizeof (*cs) && cs->bClockID == clock_id)return cs; }
@@ -59,8 +59,11 @@ static struct uac_clock_selector_descripwhile ((cs =snd_usb_find_csint_desc (ctrl_iface->extra, ctrl_iface->extralen, cs,UAC2_CLOCK_SELECTOR ))) { -if (cs->bClockID == clock_id) +if (cs->bLength >=sizeof (*cs) && cs->bClockID == clock_id) { +if (cs->bLength <5 + cs->bNrInPins) +return NULL ;return cs; + } }return NULL ;
@@ -75,7 +78,7 @@ static struct uac_clock_multiplier_descrwhile ((cs =snd_usb_find_csint_desc (ctrl_iface->extra, ctrl_iface->extralen, cs,UAC2_CLOCK_MULTIPLIER ))) { -if (cs->bClockID == clock_id) +if (cs->bLength >=sizeof (*cs) && cs->bClockID == clock_id)return cs; }
Greg Kroah-Hartman
maintainerPATCH 47/138 ALSA: timer: Remove kernel warning at compat ioctl error paths
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 3d4e8303f2c747c8540a0a0126d0151514f6468b upstream.
Some timer compat ioctls have NULL checks of timer instance with snd_BUG_ON() that bring up WARN_ON() when the debug option is set. Actually the condition can be met in the normal situation and it's confusing and bad to spew kernel warnings with stack trace there. Let's remove snd_BUG_ON() invocation and replace with the simple checks. Also, correct the error code to EBADFD to follow the native ioctl error handling.
--- sound/core/timer_compat.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
sound/core/timer_compat.c +6 -6
@@ -66,11 +66,11 @@ static int snd_timer_user_info_compat(ststruct snd_timer *t; tu = file->private_data; -if (snd_BUG_ON (!tu->timeri)) -return -ENXIO ; +if (!tu->timeri) +return -EBADFD ; t = tu->timeri->timer; -if (snd_BUG_ON (!t)) -return -ENXIO ; +if (!t) +return -EBADFD ;memset (&info,0 ,sizeof (info)); info.card = t->card ? t->card->number :-1 ;if (t->hw.flags &SNDRV_TIMER_HW_SLAVE )
@@ -99,8 +99,8 @@ static int snd_timer_user_status_compat(struct snd_timer_status32 status; tu = file->private_data; -if (snd_BUG_ON (!tu->timeri)) -return -ENXIO ; +if (!tu->timeri) +return -EBADFD ;memset (&status,0 ,sizeof (status)); status.tstamp.tv_sec = tu->tstamp.tv_sec; status.tstamp.tv_nsec = tu->tstamp.tv_nsec;
Greg Kroah-Hartman
maintainerPATCH 48/138 ALSA: hda: Fix too short HDMI/DP chmap reporting
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit c2432466f583cb719b35a41e757da587d9ab1d00 upstream.
We got a regression report about the HD-audio HDMI chmap, where some surround channels are reported as UNKNOWN. The git bisection pointed the culprit at the commit 9b3dc8aa3fb1 ("ALSA: hda - Register chmap obj as priv data instead of codec"). The story behind scene is like this:
- While moving the code out of the legacy HDA to the HDA common place, the patch modifies the code to obtain the chmap array indirectly in a byte array, and it expands it to kctl value array.
- At the latter operation, the size of the array is wrongly passed by sizeof() to the pointer.
- It can be 4 on 32bit arch, thus too short for 6+ channels. (And that's the reason why it didn't hit other persons; it's 8 on 64bit arch, thus it's usually enough.)
The code was further changed meanwhile, but the problem persisted. Let's fix it by correctly evaluating the array size.
--- sound/hda/hdmi_chmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/hda/hdmi_chmap.c +1 -1
@@ -746,7 +746,7 @@ static int hdmi_chmap_ctl_get(struct sndmemset (pcm_chmap,0 ,sizeof (pcm_chmap)); chmap->ops.get_chmap (chmap->hdac, pcm_idx, pcm_chmap); -for (i =0 ; i <sizeof (chmap); i++) +for (i =0 ; i <ARRAY_SIZE (pcm_chmap); i++) ucontrol->value.integer.value[i] = pcm_chmap[i];return 0 ;
Greg Kroah-Hartman
maintainerPATCH 49/138 ALSA: hda/realtek - Fix ALC700 family no sound issue
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kailang Yang <[email protected]>
commit 2d7fe6185722b0817bb345f62ab06b76a7b26542 upstream.
It maybe the typo for ALC700 support patch.
To fix the bit value on this patch.
--- sound/pci/hda/patch_realtek.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/pci/hda/patch_realtek.c +1 -1
@@ -6272,7 +6272,7 @@ static int patch_alc269(struct hda_codeccase 0x10ec0703 : spec->codec_variant =ALC269_TYPE_ALC700 ; spec->gen.mixer_nid =0 ;/* ALC700 does not have any loopback mixer path */ -alc_update_coef_idx (codec,0x4a ,0 ,1 <<15 );/* Combo jack auto trigger control */ +alc_update_coef_idx (codec,0x4a ,1 <<15 ,0 );/* Combo jack auto trigger control */ break ; }
Greg Kroah-Hartman
maintainerPATCH 50/138 fix a page leak in vhost_scsi_iov_to_sgl() error recovery
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
commit 11d49e9d089ccec81be87c2386dfdd010d7f7f6e upstream.
we are advancing sg as we go, so the pages we need to drop in case of error are *before* the current sg.
--- drivers/vhost/scsi.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/vhost/scsi.c +3 -2
@@ -693,6 +693,7 @@ vhost_scsi_iov_to_sgl(struct vhost_scsi_ struct scatterlist *sg, int sg_count) { size_t off = iter->iov_offset; +struct scatterlist *p = sg;int i, ret;for (i =0 ; i < iter->nr_segs; i++) {
@@ -701,8 +702,8 @@ vhost_scsi_iov_to_sgl(struct vhost_scsi_ ret =vhost_scsi_map_to_sgl (cmd, base, len, sg, write);if (ret <0 ) { -for (i =0 ; i < sg_count; i++) { -struct page *page =sg_page (&sg[i]); +while (p < sg) { +struct page *page =sg_page (p++);if (page)put_page (page); }
Greg Kroah-Hartman
maintainerPATCH 51/138 fs/9p: Compare qid.path in v9fs_test_inode
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tuomas Tynkkynen <[email protected]>
commit 8ee031631546cf2f7859cc69593bd60bbdd70b46 upstream.
Commit fd2421f54423 ("fs/9p: When doing inode lookup compare qid details and inode mode bits.") transformed v9fs_qid_iget() to use iget5_locked() instead of iget_locked(). However, the test() callback is not checking fid.path at all, which means that a lookup in the inode cache can now accidentally locate a completely wrong inode from the same inode hash bucket if the other fields (qid.type and qid.version) match.
--- fs/9p/vfs_inode.c | 3 +++ fs/9p/vfs_inode_dotl.c | 3 +++ 2 files changed, 6 insertions(+)
fs/9p/vfs_inode.c +3 -0
@@ -483,6 +483,9 @@ static int v9fs_test_inode(struct inodeif (v9inode->qid.type != st->qid.type)return 0 ; + +if (v9inode->qid.path != st->qid.path) +return 0 ;return 1 ; }
fs/9p/vfs_inode_dotl.c +3 -0
@@ -87,6 +87,9 @@ static int v9fs_test_inode_dotl(struct iif (v9inode->qid.type != st->qid.type)return 0 ; + +if (v9inode->qid.path != st->qid.path) +return 0 ;return 1 ; }
Greg Kroah-Hartman
maintainerPATCH 52/138 iscsi-target: Fix non-immediate TMR reference leak
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Bellinger <[email protected]>
commit 3fc9fb13a4b2576aeab86c62fd64eb29ab68659c upstream.
This patch fixes a se_cmd->cmd_kref reference leak that can occur when a non immediate TMR is proceeded our of command sequence number order, and CMDSN_LOWER_THAN_EXP is returned by iscsit_sequence_cmd().
To address this bug, call target_put_sess_cmd() during this special case following what iscsit_process_scsi_cmd() does upon CMDSN_LOWER_THAN_EXP.
--- drivers/target/iscsi/iscsi_target.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/target/iscsi/iscsi_target.c +5 -3
@@ -2104,12 +2104,14 @@ attach:if (!(hdr->opcode &ISCSI_OP_IMMEDIATE )) {int cmdsn_ret =iscsit_sequence_cmd (conn, cmd, buf, hdr->cmdsn); -if (cmdsn_ret ==CMDSN_HIGHER_THAN_EXP ) +if (cmdsn_ret ==CMDSN_HIGHER_THAN_EXP ) { out_of_order_cmdsn =1 ; -else if (cmdsn_ret ==CMDSN_LOWER_THAN_EXP ) + }else if (cmdsn_ret ==CMDSN_LOWER_THAN_EXP ) { +target_put_sess_cmd (&cmd->se_cmd);return 0 ; -else if (cmdsn_ret ==CMDSN_ERROR_CANNOT_RECOVER ) + }else if (cmdsn_ret ==CMDSN_ERROR_CANNOT_RECOVER ) {return -1 ; + } }iscsit_ack_from_expstatsn (conn,be32_to_cpu (hdr->exp_statsn));
Greg Kroah-Hartman
maintainerPATCH 53/138 target: Fix QUEUE_FULL + SCSI task attribute handling
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Bellinger <[email protected]>
commit 1c79df1f349fb6050016cea4ef1dfbc3853a5685 upstream.
This patch fixes a bug during QUEUE_FULL where transport_complete_qf() calls transport_complete_task_attr() after it's already been invoked by target_complete_ok_work() or transport_generic_request_failure() during initial completion, preceeding QUEUE_FULL.
This will result in se_device->simple_cmds, se_device->dev_cur_ordered_id and/or se_device->dev_ordered_sync being updated multiple times for a single se_cmd.
To address this bug, clear SCF_TASK_ATTR_SET after the first call to transport_complete_task_attr(), and avoid updating SCSI task attribute related counters for any subsequent calls.
Also, when a se_cmd is deferred due to ordered tags and executed via target_restart_delayed_cmds(), set CMD_T_SENT before execution matching what target_execute_cmd() does.
--- drivers/target/target_core_transport.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/target/target_core_transport.c +4 -0
@@ -1976,6 +1976,8 @@ static void target_restart_delayed_cmds(list_del (&cmd->se_delayed_node);spin_unlock (&dev->delayed_cmd_lock); + cmd->transport_state |=CMD_T_SENT ; +__target_execute_cmd (cmd, true);if (cmd->sam_task_attr ==TCM_ORDERED_TAG )
@@ -2013,6 +2015,8 @@ static void transport_complete_task_attrpr_debug ("Incremented dev_cur_ordered_id: %u for ORDERED\n" , dev->dev_cur_ordered_id); } + cmd->se_cmd_flags &= ~SCF_TASK_ATTR_SET ; + restart:target_restart_delayed_cmds (dev); }
Greg Kroah-Hartman
maintainerPATCH 54/138 mtd: nand: omap2: Fix subpage write
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roger Quadros <[email protected]>
commit 739c64414f01748a36e7d82c8e0611dea94412bd upstream.
Since v4.12, NAND subpage writes were causing a NULL pointer dereference on OMAP platforms (omap2-nand) using OMAP_ECC_BCH4_CODE_HW, OMAP_ECC_BCH8_CODE_HW and OMAP_ECC_BCH16_CODE_HW.
This is because for those ECC modes, omap_calculate_ecc_bch() generates ECC bytes for the entire (multi-sector) page and this can overflow the ECC buffer provided by nand_write_subpage_hwecc() as it expects ecc.calculate() to return ECC bytes for just one sector.
However, the root cause of the problem is present since v3.9 but was not seen then as NAND buffers were being allocated as one big chunk prior to commit 3deb9979c731 ("mtd: nand: allocate aligned buffers if NAND_OWN_BUFFERS is unset").
Fix the issue by providing a OMAP optimized write_subpage() implementation.
--- drivers/mtd/nand/omap2.c | 339 +++++++++++++++++++++++++++++++---------------- 1 file changed, 224 insertions(+), 115 deletions(-)
drivers/mtd/nand/omap2.c +224 -115
@@ -1133,129 +1133,172 @@ static u8 bch8_polynomial[] = {0xef, 0x 0x97, 0x79, 0xe5, 0x24, 0xb5};/** -* omap_calculate_ecc_bch - Generate bytes of ECC bytes +* _omap_calculate_ecc_bch - Generate ECC bytes for one sector * @mtd: MTD device structure * @dat: The pointer to data on which ecc is computed * @ecc_code: The ecc_code buffer +* @i: The sector number (for a multi sector page) * -* Support calculating of BCH4/8 ecc vectors for the page +* Support calculating of BCH4/8/16 ECC vectors for one sector +* within a page. Sector number is in @i. */ -static int __maybe_unused omap_calculate_ecc_bch (struct mtd_info *mtd, -const u_char *dat,u_char *ecc_calc) +static int _omap_calculate_ecc_bch (struct mtd_info *mtd, +const u_char *dat,u_char *ecc_calc,int i) {struct omap_nand_info *info =mtd_to_omap (mtd);int eccbytes = info->nand.ecc.bytes;struct gpmc_nand_regs *gpmc_regs = &info->reg;u8 *ecc_code; -unsigned long nsectors, bch_val1, bch_val2, bch_val3, bch_val4; +unsigned long bch_val1, bch_val2, bch_val3, bch_val4;u32 val; -int i, j; +int j; + + ecc_code = ecc_calc; +switch (info->ecc_opt) { +case OMAP_ECC_BCH8_CODE_HW_DETECTION_SW : +case OMAP_ECC_BCH8_CODE_HW : + bch_val1 =readl (gpmc_regs->gpmc_bch_result0[i]); + bch_val2 =readl (gpmc_regs->gpmc_bch_result1[i]); + bch_val3 =readl (gpmc_regs->gpmc_bch_result2[i]); + bch_val4 =readl (gpmc_regs->gpmc_bch_result3[i]); + *ecc_code++ = (bch_val4 &0xFF ); + *ecc_code++ = ((bch_val3 >>24 ) &0xFF ); + *ecc_code++ = ((bch_val3 >>16 ) &0xFF ); + *ecc_code++ = ((bch_val3 >>8 ) &0xFF ); + *ecc_code++ = (bch_val3 &0xFF ); + *ecc_code++ = ((bch_val2 >>24 ) &0xFF ); + *ecc_code++ = ((bch_val2 >>16 ) &0xFF ); + *ecc_code++ = ((bch_val2 >>8 ) &0xFF ); + *ecc_code++ = (bch_val2 &0xFF ); + *ecc_code++ = ((bch_val1 >>24 ) &0xFF ); + *ecc_code++ = ((bch_val1 >>16 ) &0xFF ); + *ecc_code++ = ((bch_val1 >>8 ) &0xFF ); + *ecc_code++ = (bch_val1 &0xFF ); +break ; +case OMAP_ECC_BCH4_CODE_HW_DETECTION_SW : +case OMAP_ECC_BCH4_CODE_HW : + bch_val1 =readl (gpmc_regs->gpmc_bch_result0[i]); + bch_val2 =readl (gpmc_regs->gpmc_bch_result1[i]); + *ecc_code++ = ((bch_val2 >>12 ) &0xFF ); + *ecc_code++ = ((bch_val2 >>4 ) &0xFF ); + *ecc_code++ = ((bch_val2 &0xF ) <<4 ) | + ((bch_val1 >>28 ) &0xF ); + *ecc_code++ = ((bch_val1 >>20 ) &0xFF ); + *ecc_code++ = ((bch_val1 >>12 ) &0xFF ); + *ecc_code++ = ((bch_val1 >>4 ) &0xFF ); + *ecc_code++ = ((bch_val1 &0xF ) <<4 ); +break ; +case OMAP_ECC_BCH16_CODE_HW : + val =readl (gpmc_regs->gpmc_bch_result6[i]); + ecc_code[0 ] = ((val >>8 ) &0xFF ); + ecc_code[1 ] = ((val >>0 ) &0xFF ); + val =readl (gpmc_regs->gpmc_bch_result5[i]); + ecc_code[2 ] = ((val >>24 ) &0xFF ); + ecc_code[3 ] = ((val >>16 ) &0xFF ); + ecc_code[4 ] = ((val >>8 ) &0xFF ); + ecc_code[5 ] = ((val >>0 ) &0xFF ); + val =readl (gpmc_regs->gpmc_bch_result4[i]); + ecc_code[6 ] = ((val >>24 ) &0xFF ); + ecc_code[7 ] = ((val >>16 ) &0xFF ); + ecc_code[8 ] = ((val >>8 ) &0xFF ); + ecc_code[9 ] = ((val >>0 ) &0xFF ); + val =readl (gpmc_regs->gpmc_bch_result3[i]); + ecc_code[10 ] = ((val >>24 ) &0xFF ); + ecc_code[11 ] = ((val >>16 ) &0xFF ); + ecc_code[12 ] = ((val >>8 ) &0xFF ); + ecc_code[13 ] = ((val >>0 ) &0xFF ); + val =readl (gpmc_regs->gpmc_bch_result2[i]); + ecc_code[14 ] = ((val >>24 ) &0xFF ); + ecc_code[15 ] = ((val >>16 ) &0xFF ); + ecc_code[16 ] = ((val >>8 ) &0xFF ); + ecc_code[17 ] = ((val >>0 ) &0xFF ); + val =readl (gpmc_regs->gpmc_bch_result1[i]); + ecc_code[18 ] = ((val >>24 ) &0xFF ); + ecc_code[19 ] = ((val >>16 ) &0xFF ); + ecc_code[20 ] = ((val >>8 ) &0xFF ); + ecc_code[21 ] = ((val >>0 ) &0xFF ); + val =readl (gpmc_regs->gpmc_bch_result0[i]); + ecc_code[22 ] = ((val >>24 ) &0xFF ); + ecc_code[23 ] = ((val >>16 ) &0xFF ); + ecc_code[24 ] = ((val >>8 ) &0xFF ); + ecc_code[25 ] = ((val >>0 ) &0xFF ); +break ; +default : +return -EINVAL ; + } + +/* ECC scheme specific syndrome customizations */ +switch (info->ecc_opt) { +case OMAP_ECC_BCH4_CODE_HW_DETECTION_SW : +/* Add constant polynomial to remainder, so that +* ECC of blank pages results in 0x0 on reading back +*/ +for (j =0 ; j < eccbytes; j++) + ecc_calc[j] ^= bch4_polynomial[j]; +break ; +case OMAP_ECC_BCH4_CODE_HW : +/* Set 8th ECC byte as 0x0 for ROM compatibility */ + ecc_calc[eccbytes -1 ] =0x0 ; +break ; +case OMAP_ECC_BCH8_CODE_HW_DETECTION_SW : +/* Add constant polynomial to remainder, so that +* ECC of blank pages results in 0x0 on reading back +*/ +for (j =0 ; j < eccbytes; j++) + ecc_calc[j] ^= bch8_polynomial[j]; +break ; +case OMAP_ECC_BCH8_CODE_HW : +/* Set 14th ECC byte as 0x0 for ROM compatibility */ + ecc_calc[eccbytes -1 ] =0x0 ; +break ; +case OMAP_ECC_BCH16_CODE_HW : +break ; +default : +return -EINVAL ; + } + +return 0 ; +} + +/** +* omap_calculate_ecc_bch_sw - ECC generator for sector for SW based correction +* @mtd: MTD device structure +* @dat: The pointer to data on which ecc is computed +* @ecc_code: The ecc_code buffer +* +* Support calculating of BCH4/8/16 ECC vectors for one sector. This is used +* when SW based correction is required as ECC is required for one sector +* at a time. +*/ +static int omap_calculate_ecc_bch_sw (struct mtd_info *mtd, +const u_char *dat,u_char *ecc_calc) +{ +return _omap_calculate_ecc_bch (mtd, dat, ecc_calc,0 ); +} + +/** +* omap_calculate_ecc_bch_multi - Generate ECC for multiple sectors +* @mtd: MTD device structure +* @dat: The pointer to data on which ecc is computed +* @ecc_code: The ecc_code buffer +* +* Support calculating of BCH4/8/16 ecc vectors for the entire page in one go. +*/ +static int omap_calculate_ecc_bch_multi (struct mtd_info *mtd, +const u_char *dat,u_char *ecc_calc) +{ +struct omap_nand_info *info =mtd_to_omap (mtd); +int eccbytes = info->nand.ecc.bytes; +unsigned long nsectors; +int i, ret; nsectors = ((readl (info->reg.gpmc_ecc_config) >>4 ) &0x7 ) +1 ;for (i =0 ; i < nsectors; i++) { - ecc_code = ecc_calc; -switch (info->ecc_opt) { -case OMAP_ECC_BCH8_CODE_HW_DETECTION_SW : -case OMAP_ECC_BCH8_CODE_HW : - bch_val1 =readl (gpmc_regs->gpmc_bch_result0[i]); - bch_val2 =readl (gpmc_regs->gpmc_bch_result1[i]); - bch_val3 =readl (gpmc_regs->gpmc_bch_result2[i]); - bch_val4 =readl (gpmc_regs->gpmc_bch_result3[i]); - *ecc_code++ = (bch_val4 &0xFF ); - *ecc_code++ = ((bch_val3 >>24 ) &0xFF ); - *ecc_code++ = ((bch_val3 >>16 ) &0xFF ); - *ecc_code++ = ((bch_val3 >>8 ) &0xFF ); - *ecc_code++ = (bch_val3 &0xFF ); - *ecc_code++ = ((bch_val2 >>24 ) &0xFF ); - *ecc_code++ = ((bch_val2 >>16 ) &0xFF ); - *ecc_code++ = ((bch_val2 >>8 ) &0xFF ); - *ecc_code++ = (bch_val2 &0xFF ); - *ecc_code++ = ((bch_val1 >>24 ) &0xFF ); - *ecc_code++ = ((bch_val1 >>16 ) &0xFF ); - *ecc_code++ = ((bch_val1 >>8 ) &0xFF ); - *ecc_code++ = (bch_val1 &0xFF ); -break ; -case OMAP_ECC_BCH4_CODE_HW_DETECTION_SW : -case OMAP_ECC_BCH4_CODE_HW : - bch_val1 =readl (gpmc_regs->gpmc_bch_result0[i]); - bch_val2 =readl (gpmc_regs->gpmc_bch_result1[i]); - *ecc_code++ = ((bch_val2 >>12 ) &0xFF ); - *ecc_code++ = ((bch_val2 >>4 ) &0xFF ); - *ecc_code++ = ((bch_val2 &0xF ) <<4 ) | - ((bch_val1 >>28 ) &0xF ); - *ecc_code++ = ((bch_val1 >>20 ) &0xFF ); - *ecc_code++ = ((bch_val1 >>12 ) &0xFF ); - *ecc_code++ = ((bch_val1 >>4 ) &0xFF ); - *ecc_code++ = ((bch_val1 &0xF ) <<4 ); -break ; -case OMAP_ECC_BCH16_CODE_HW : - val =readl (gpmc_regs->gpmc_bch_result6[i]); - ecc_code[0 ] = ((val >>8 ) &0xFF ); - ecc_code[1 ] = ((val >>0 ) &0xFF ); - val =readl (gpmc_regs->gpmc_bch_result5[i]); - ecc_code[2 ] = ((val >>24 ) &0xFF ); - ecc_code[3 ] = ((val >>16 ) &0xFF ); - ecc_code[4 ] = ((val >>8 ) &0xFF ); - ecc_code[5 ] = ((val >>0 ) &0xFF ); - val =readl (gpmc_regs->gpmc_bch_result4[i]); - ecc_code[6 ] = ((val >>24 ) &0xFF ); - ecc_code[7 ] = ((val >>16 ) &0xFF ); - ecc_code[8 ] = ((val >>8 ) &0xFF ); - ecc_code[9 ] = ((val >>0 ) &0xFF ); - val =readl (gpmc_regs->gpmc_bch_result3[i]); - ecc_code[10 ] = ((val >>24 ) &0xFF ); - ecc_code[11 ] = ((val >>16 ) &0xFF ); - ecc_code[12 ] = ((val >>8 ) &0xFF ); - ecc_code[13 ] = ((val >>0 ) &0xFF ); - val =readl (gpmc_regs->gpmc_bch_result2[i]); - ecc_code[14 ] = ((val >>24 ) &0xFF ); - ecc_code[15 ] = ((val >>16 ) &0xFF ); - ecc_code[16 ] = ((val >>8 ) &0xFF ); - ecc_code[17 ] = ((val >>0 ) &0xFF ); - val =readl (gpmc_regs->gpmc_bch_result1[i]); - ecc_code[18 ] = ((val >>24 ) &0xFF ); - ecc_code[19 ] = ((val >>16 ) &0xFF ); - ecc_code[20 ] = ((val >>8 ) &0xFF ); - ecc_code[21 ] = ((val >>0 ) &0xFF ); - val =readl (gpmc_regs->gpmc_bch_result0[i]); - ecc_code[22 ] = ((val >>24 ) &0xFF ); - ecc_code[23 ] = ((val >>16 ) &0xFF ); - ecc_code[24 ] = ((val >>8 ) &0xFF ); - ecc_code[25 ] = ((val >>0 ) &0xFF ); -break ; -default : -return -EINVAL ; - } - -/* ECC scheme specific syndrome customizations */ -switch (info->ecc_opt) { -case OMAP_ECC_BCH4_CODE_HW_DETECTION_SW : -/* Add constant polynomial to remainder, so that -* ECC of blank pages results in 0x0 on reading back */ -for (j =0 ; j < eccbytes; j++) - ecc_calc[j] ^= bch4_polynomial[j]; -break ; -case OMAP_ECC_BCH4_CODE_HW : -/* Set 8th ECC byte as 0x0 for ROM compatibility */ - ecc_calc[eccbytes -1 ] =0x0 ; -break ; -case OMAP_ECC_BCH8_CODE_HW_DETECTION_SW : -/* Add constant polynomial to remainder, so that -* ECC of blank pages results in 0x0 on reading back */ -for (j =0 ; j < eccbytes; j++) - ecc_calc[j] ^= bch8_polynomial[j]; -break ; -case OMAP_ECC_BCH8_CODE_HW : -/* Set 14th ECC byte as 0x0 for ROM compatibility */ - ecc_calc[eccbytes -1 ] =0x0 ; -break ; -case OMAP_ECC_BCH16_CODE_HW : -break ; -default : -return -EINVAL ; - } + ret =_omap_calculate_ecc_bch (mtd, dat, ecc_calc, i); +if (ret) +return ret; - ecc_calc += eccbytes; + ecc_calc += eccbytes; }return 0 ;
@@ -1496,7 +1539,7 @@ static int omap_write_page_bch(struct mt chip->write_buf (mtd, buf, mtd->writesize);/* Update ecc vector from GPMC result registers */ - chip->ecc.calculate (mtd, buf, &ecc_calc[0 ]); +omap_calculate_ecc_bch_multi (mtd, buf, &ecc_calc[0 ]); ret =mtd_ooblayout_set_eccbytes (mtd, ecc_calc, chip->oob_poi,0 , chip->ecc.total);
@@ -1509,6 +1552,72 @@ static int omap_write_page_bch(struct mt }/** +* omap_write_subpage_bch - BCH hardware ECC based subpage write +* @mtd: mtd info structure +* @chip: nand chip info structure +* @offset: column address of subpage within the page +* @data_len: data length +* @buf: data buffer +* @oob_required: must write chip->oob_poi to OOB +* @page: page number to write +* +* OMAP optimized subpage write method. +*/ +static int omap_write_subpage_bch (struct mtd_info *mtd, +struct nand_chip *chip,u32 offset, +u32 data_len,const u8 *buf, +int oob_required,int page) +{ +u8 *ecc_calc = chip->buffers->ecccalc; +int ecc_size = chip->ecc.size; +int ecc_bytes = chip->ecc.bytes; +int ecc_steps = chip->ecc.steps; +u32 start_step = offset / ecc_size; +u32 end_step = (offset + data_len -1 ) / ecc_size; +int step, ret =0 ; + +/* +* Write entire page at one go as it would be optimal +* as ECC is calculated by hardware. +* ECC is calculated for all subpages but we choose +* only what we want. +*/ + +/* Enable GPMC ECC engine */ + chip->ecc.hwctl (mtd,NAND_ECC_WRITE ); + +/* Write data */ + chip->write_buf (mtd, buf, mtd->writesize); + +for (step =0 ; step < ecc_steps; step++) { +/* mask ECC of un-touched subpages by padding 0xFF */ +if (step < start_step || step > end_step) +memset (ecc_calc,0xff , ecc_bytes); +else + ret =_omap_calculate_ecc_bch (mtd, buf, ecc_calc, step); + +if (ret) +return ret; + + buf += ecc_size; + ecc_calc += ecc_bytes; + } + +/* copy calculated ECC for whole page to chip->buffer->oob */ +/* this include masked-value(0xFF) for unwritten subpages */ + ecc_calc = chip->buffers->ecccalc; + ret =mtd_ooblayout_set_eccbytes (mtd, ecc_calc, chip->oob_poi,0 , + chip->ecc.total); +if (ret) +return ret; + +/* write OOB buffer to NAND device */ + chip->write_buf (mtd, chip->oob_poi, mtd->oobsize); + +return 0 ; +} + +/** * omap_read_page_bch - BCH ecc based page read function for entire page * @mtd: mtd info structure * @chip: nand chip info structure
@@ -1544,7 +1653,7 @@ static int omap_read_page_bch(struct mtd chip->ecc.total);/* Calculate ecc bytes */ - chip->ecc.calculate (mtd, buf, ecc_calc); +omap_calculate_ecc_bch_multi (mtd, buf, ecc_calc); ret =mtd_ooblayout_get_eccbytes (mtd, ecc_code, chip->oob_poi,0 , chip->ecc.total);
@@ -2044,7 +2153,7 @@ static int omap_nand_probe(struct platfo nand_chip->ecc.strength =4 ; nand_chip->ecc.hwctl = omap_enable_hwecc_bch; nand_chip->ecc.correct = nand_bch_correct_data; - nand_chip->ecc.calculate = omap_calculate_ecc_bch; + nand_chip->ecc.calculate = omap_calculate_ecc_bch_sw;mtd_set_ooblayout (mtd, &omap_sw_ooblayout_ops);/* Reserve one byte for the OMAP marker */ oobbytes_per_step = nand_chip->ecc.bytes +1 ;
@@ -2066,9 +2175,9 @@ static int omap_nand_probe(struct platfo nand_chip->ecc.strength =4 ; nand_chip->ecc.hwctl = omap_enable_hwecc_bch; nand_chip->ecc.correct = omap_elm_correct_data; - nand_chip->ecc.calculate = omap_calculate_ecc_bch; nand_chip->ecc.read_page = omap_read_page_bch; nand_chip->ecc.write_page = omap_write_page_bch; + nand_chip->ecc.write_subpage = omap_write_subpage_bch;mtd_set_ooblayout (mtd, &omap_ooblayout_ops); oobbytes_per_step = nand_chip->ecc.bytes;
@@ -2087,7 +2196,7 @@ static int omap_nand_probe(struct platfo nand_chip->ecc.strength =8 ; nand_chip->ecc.hwctl = omap_enable_hwecc_bch; nand_chip->ecc.correct = nand_bch_correct_data; - nand_chip->ecc.calculate = omap_calculate_ecc_bch; + nand_chip->ecc.calculate = omap_calculate_ecc_bch_sw;mtd_set_ooblayout (mtd, &omap_sw_ooblayout_ops);/* Reserve one byte for the OMAP marker */ oobbytes_per_step = nand_chip->ecc.bytes +1 ;
@@ -2109,9 +2218,9 @@ static int omap_nand_probe(struct platfo nand_chip->ecc.strength =8 ; nand_chip->ecc.hwctl = omap_enable_hwecc_bch; nand_chip->ecc.correct = omap_elm_correct_data; - nand_chip->ecc.calculate = omap_calculate_ecc_bch; nand_chip->ecc.read_page = omap_read_page_bch; nand_chip->ecc.write_page = omap_write_page_bch; + nand_chip->ecc.write_subpage = omap_write_subpage_bch;mtd_set_ooblayout (mtd, &omap_ooblayout_ops); oobbytes_per_step = nand_chip->ecc.bytes;
@@ -2131,9 +2240,9 @@ static int omap_nand_probe(struct platfo nand_chip->ecc.strength =16 ; nand_chip->ecc.hwctl = omap_enable_hwecc_bch; nand_chip->ecc.correct = omap_elm_correct_data; - nand_chip->ecc.calculate = omap_calculate_ecc_bch; nand_chip->ecc.read_page = omap_read_page_bch; nand_chip->ecc.write_page = omap_write_page_bch; + nand_chip->ecc.write_subpage = omap_write_subpage_bch;mtd_set_ooblayout (mtd, &omap_ooblayout_ops); oobbytes_per_step = nand_chip->ecc.bytes;
Greg Kroah-Hartman
maintainerPATCH 55/138 mtd: nand: Fix writing mtdoops to nand flash.
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brent Taylor <[email protected]>
commit 30863e38ebeb500a31cecee8096fb5002677dd9b upstream.
When mtdoops calls mtd_panic_write(), it eventually calls panic_nand_write() in nand_base.c. In order to properly wait for the nand chip to be ready in panic_nand_wait(), the chip must first be selected.
When using the atmel nand flash controller, a panic would occur due to a NULL pointer exception.
--- drivers/mtd/nand/nand_base.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/mtd/nand/nand_base.c +6 -3
@@ -2935,15 +2935,18 @@ static int panic_nand_write(struct mtd_i size_t *retlen, const uint8_t *buf) { struct nand_chip *chip = mtd_to_nand(mtd); +int chipnr = (int )(to >> chip->chip_shift);struct mtd_oob_ops ops;int ret; -/* Wait for the device to get ready */ -panic_nand_wait (mtd, chip,400 ); -/* Grab the device */ panic_nand_get_device (chip, mtd,FL_WRITING ); + chip->select_chip (mtd, chipnr); + +/* Wait for the device to get ready */ +panic_nand_wait (mtd, chip,400 ); +memset (&ops,0 ,sizeof (ops)); ops.len = len; ops.datbuf = (uint8_t *)buf;
Greg Kroah-Hartman
maintainerPATCH 56/138 mtd: nand: mtk: fix infinite ECC decode IRQ issue
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiaolei Li <[email protected]>
commit 1d2fcdcf33339c7c8016243de0f7f31cf6845e8d upstream.
For MT2701 NAND Controller, there may generate infinite ECC decode IRQ during long time burn test on some platforms. Once this issue occurred, the ECC decode IRQ status cannot be cleared in the IRQ handler function, and threads cannot be scheduled.
ECC HW generates decode IRQ each sector, so there will have more than one decode IRQ if read one page of large page NAND.
Currently, ECC IRQ handle flow is that we will check whether it is decode IRQ at first by reading the register ECC_DECIRQ_STA. This is a read-clear type register. If this IRQ is decode IRQ, then the ECC IRQ signal will be cleared at the same time.
Secondly, we will check whether all sectors are decoded by reading the register ECC_DECDONE. This is because the current IRQ may be not dealed in time, and the next sectors have been decoded before reading the register ECC_DECIRQ_STA. Then, the next sectors's decode IRQs will not be generated.
Thirdly, if all sectors are decoded by comparing with ecc->sectors, then we will complete ecc->done, set ecc->sectors as 0, and disable ECC IRQ by programming the register ECC_IRQ_REG(op) as 0. Otherwise, wait for the next ECC IRQ.
But, there is a timing issue between step one and two. When we read the reigster ECC_DECIRQ_STA, all sectors are decoded except the last sector, and the ECC IRQ signal is cleared. But the last sector is decoded before reading ECC_DECDONE, so the ECC IRQ signal is enabled again by ECC HW, and it means we will receive one extra ECC IRQ later. In step three, we will find that all sectors were decoded, then disable ECC IRQ and return. When deal with the extra ECC IRQ, the ECC IRQ status cannot be cleared anymore. That is because the register ECC_DECIRQ_STA can only be cleared when the register ECC_IRQ_REG(op) is enabled. But actually we have disabled ECC IRQ in the previous ECC IRQ handle. So, there will keep receiving ECC decode IRQ.
Now, we read the register ECC_DECIRQ_STA once again before completing the ecc done event. This ensures that there will be no extra ECC decode IRQ.
Also, remove writel(0, ecc->regs + ECC_IRQ_REG(op)) from irq handler, because ECC IRQ is disabled in mtk_ecc_disable(). And clear ECC_DECIRQ_STA in mtk_ecc_disable() in case there is a timeout to wait decode IRQ.
--- drivers/mtd/nand/mtk_ecc.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
drivers/mtd/nand/mtk_ecc.c +11 -2
@@ -116,6 +116,11 @@ static irqreturn_t mtk_ecc_irq(int irq, op =ECC_DECODE ; dec =readw (ecc->regs +ECC_DECDONE );if (dec & ecc->sectors) { +/* +* Clear decode IRQ status once again to ensure that +* there will be no extra IRQ. +*/ +readw (ecc->regs +ECC_DECIRQ_STA ); ecc->sectors =0 ;complete (&ecc->done); }else {
@@ -131,8 +136,6 @@ static irqreturn_t mtk_ecc_irq(int irq, } } -writel (0 , ecc->regs +ECC_IRQ_REG (op)); -return IRQ_HANDLED ; }
@@ -342,6 +345,12 @@ void mtk_ecc_disable(struct mtk_ecc *ecc/* disable it */ mtk_ecc_wait_idle (ecc, op); +if (op ==ECC_DECODE ) +/* +* Clear decode IRQ status in case there is a timeout to wait +* decode IRQ. +*/ +readw (ecc->regs +ECC_DECIRQ_STA );writew (0 , ecc->regs +ECC_IRQ_REG (op));writew (ECC_OP_DISABLE , ecc->regs +ECC_CTL_REG (op));
Greg Kroah-Hartman
maintainerPATCH 57/138 p54: dont unregister leds when they are not initialized
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrey Konovalov <[email protected]>
commit fc09785de0a364427a5df63d703bae9a306ed116 upstream.
ieee80211_register_hw() in p54_register_common() may fail and leds won't get initialized. Currently p54_unregister_common() doesn't check that and always calls p54_unregister_leds(). The fix is to check priv->registered flag before calling p54_unregister_leds().
Found by syzkaller.
INFO: trying to register non-static key.
the code is fine but needs lockdep annotation.
turning off the locking correctness validator.
CPU: 1 PID: 1404 Comm: kworker/1:1 Not tainted 4.14.0-rc1-42251-gebb2c2437d80-dirty #205 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 Workqueue: usb_hub_wq hub_event Call Trace: __dump_stack lib/dump_stack.c:16 dump_stack+0x292/0x395 lib/dump_stack.c:52 register_lock_class+0x6c4/0x1a00 kernel/locking/lockdep.c:769 __lock_acquire+0x27e/0x4550 kernel/locking/lockdep.c:3385 lock_acquire+0x259/0x620 kernel/locking/lockdep.c:4002 flush_work+0xf0/0x8c0 kernel/workqueue.c:2886 __cancel_work_timer+0x51d/0x870 kernel/workqueue.c:2961 cancel_delayed_work_sync+0x1f/0x30 kernel/workqueue.c:3081 p54_unregister_leds+0x6c/0xc0 drivers/net/wireless/intersil/p54/led.c:160 p54_unregister_common+0x3d/0xb0 drivers/net/wireless/intersil/p54/main.c:856 p54u_disconnect+0x86/0x120 drivers/net/wireless/intersil/p54/p54usb.c:1073 usb_unbind_interface+0x21c/0xa90 drivers/usb/core/driver.c:423 __device_release_driver drivers/base/dd.c:861 device_release_driver_internal+0x4f4/0x5c0 drivers/base/dd.c:893 device_release_driver+0x1e/0x30 drivers/base/dd.c:918 bus_remove_device+0x2f4/0x4b0 drivers/base/bus.c:565 device_del+0x5c4/0xab0 drivers/base/core.c:1985 usb_disable_device+0x1e9/0x680 drivers/usb/core/message.c:1170 usb_disconnect+0x260/0x7a0 drivers/usb/core/hub.c:2124 hub_port_connect drivers/usb/core/hub.c:4754 hub_port_connect_change drivers/usb/core/hub.c:5009 port_event drivers/usb/core/hub.c:5115 hub_event+0x1318/0x3740 drivers/usb/core/hub.c:5195 process_one_work+0xc7f/0x1db0 kernel/workqueue.c:2119 process_scheduled_works kernel/workqueue.c:2179 worker_thread+0xb2b/0x1850 kernel/workqueue.c:2255 kthread+0x3a1/0x470 kernel/kthread.c:231 ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:431
--- drivers/net/wireless/intersil/p54/main.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
drivers/net/wireless/intersil/p54/main.c +3 -4
@@ -852,12 +852,11 @@ void p54_unregister_common(struct ieee80 {struct p54_common *priv = dev->priv; -#ifdef CONFIG_P54_LEDS -p54_unregister_leds (priv); -#endif /* CONFIG_P54_LEDS */ -if (priv->registered) { priv->registered = false; +#ifdef CONFIG_P54_LEDS +p54_unregister_leds (priv); +#endif /* CONFIG_P54_LEDS */ ieee80211_unregister_hw (dev); }
Greg Kroah-Hartman
maintainerPATCH 58/138 block: Fix a race between blk_cleanup_queue() and timeout handling
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <[email protected]>
commit 4e9b6f20828ac880dbc1fa2fdbafae779473d1af upstream.
Make sure that if the timeout timer fires after a queue has been marked "dying" that the affected requests are finished.
--- block/blk-core.c | 2 ++ block/blk-timeout.c | 3 --- 2 files changed, 2 insertions(+), 3 deletions(-)
block/blk-core.c +2 -0
@@ -282,6 +282,7 @@ EXPORT_SYMBOL(blk_stop_queue);void blk_sync_queue (struct request_queue *q) {del_timer_sync (&q->timeout); +cancel_work_sync (&q->timeout_work);if (q->mq_ops) {struct blk_mq_hw_ctx *hctx;
@@ -720,6 +721,7 @@ struct request_queue *blk_alloc_queue_nosetup_timer (&q->backing_dev_info.laptop_mode_wb_timer, laptop_mode_timer_fn, (unsigned long ) q);setup_timer (&q->timeout, blk_rq_timed_out_timer, (unsigned long ) q); +INIT_WORK (&q->timeout_work,NULL );INIT_LIST_HEAD (&q->queue_head);INIT_LIST_HEAD (&q->timeout_list);INIT_LIST_HEAD (&q->icq_list);
block/blk-timeout.c +0 -3
@@ -135,8 +135,6 @@ void blk_timeout_work(struct work_structstruct request *rq, *tmp;int next_set =0 ; -if (blk_queue_enter (q, true)) -return ;spin_lock_irqsave (q->queue_lock, flags);list_for_each_entry_safe (rq, tmp, &q->timeout_list, timeout_list)
@@ -146,7 +144,6 @@ void blk_timeout_work(struct work_structmod_timer (&q->timeout,round_jiffies_up (next));spin_unlock_irqrestore (q->queue_lock, flags); -blk_queue_exit (q); }/**
Greg Kroah-Hartman
maintainerPATCH 59/138 irqchip/gic-v3: Fix ppi-partitions lookup
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 00ee9a1ca5080202bc37b44e998c3b2c74d45817 upstream.
Fix child-node lookup during initialisation, which ended up searching the whole device tree depth-first starting at the parent rather than just matching on its children.
To make things worse, the parent gic node was prematurely freed, while the ppi-partitions node was leaked.
--- drivers/irqchip/irq-gic-v3.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/irqchip/irq-gic-v3.c +6 -3
@@ -1022,18 +1022,18 @@ static void __init gic_populate_ppi_partint nr_parts;struct partition_affinity *parts; - parts_node =of_find_node_by_name (gic_node,"ppi-partitions" ); + parts_node =of_get_child_by_name (gic_node,"ppi-partitions" );if (!parts_node)return ; nr_parts =of_get_child_count (parts_node);if (!nr_parts) -return ; + goto out_put_node; parts =kzalloc (sizeof (*parts) * nr_parts,GFP_KERNEL );if (WARN_ON (!parts)) -return ; + goto out_put_node;for_each_child_of_node (parts_node, child_part) {struct partition_affinity *part;
@@ -1100,6 +1100,9 @@ static void __init gic_populate_ppi_part gic_data.ppi_descs[i] = desc; } + +out_put_node: +of_node_put (parts_node); }static void __init gic_of_setup_kvm_info (struct device_node *node)
Greg Kroah-Hartman
maintainerPATCH 60/138 lockd: double unregister of inetaddr notifiers
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasily Averin <[email protected]>
commit dc3033e16c59a2c4e62b31341258a5786cbcee56 upstream.
lockd_up() can call lockd_unregister_notifiers twice:
inside lockd_start_svc() when it calls lockd_svc_exit_thread() and then in error path of lockd_up()
Patch forces lockd_start_svc() to unregister notifiers in all error cases and removes extra unregister in error path of lockd_up().
--- fs/lockd/svc.c | 20 +++++++++----------- 1 file changed, 9 insertions(+), 11 deletions(-)
fs/lockd/svc.c +9 -11
@@ -365,6 +365,7 @@ static int lockd_start_svc(struct svc_seprintk (KERN_WARNING "lockd_up: svc_rqst allocation failed, error=%d\n" , error); +lockd_unregister_notifiers (); goto out_rqst; }
@@ -455,13 +456,16 @@ int lockd_up(struct net *net) } error =lockd_up_net (serv, net); -if (error <0 ) - goto err_net; +if (error <0 ) { +lockd_unregister_notifiers (); + goto err_put; + } error =lockd_start_svc (serv); -if (error <0 ) - goto err_start; - +if (error <0 ) { +lockd_down_net (serv, net); + goto err_put; + } nlmsvc_users++;/* * Note: svc_serv structures have an initial use count of 1,
@@ -472,12 +476,6 @@ err_put: err_create:mutex_unlock (&nlmsvc_mutex);return error; - -err_start: -lockd_down_net (serv, net); -err_net: -lockd_unregister_notifiers (); - goto err_put; }EXPORT_SYMBOL_GPL (lockd_up);
Greg Kroah-Hartman
maintainerPATCH 61/138 KVM: nVMX: set IDTR and GDTR limits when loading L1 host state
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ladi Prosek <[email protected]>
commit 21f2d551183847bc7fbe8d866151d00cdad18752 upstream.
Intel SDM 27.5.2 Loading Host Segment and Descriptor-Table Registers:
"The GDTR and IDTR limits are each set to FFFFH."
--- arch/x86/kvm/vmx.c | 2 ++ 1 file changed, 2 insertions(+)
arch/x86/kvm/vmx.c +2 -0
@@ -10715,6 +10715,8 @@ static void load_vmcs12_host_state(strucvmcs_writel (GUEST_SYSENTER_EIP , vmcs12->host_ia32_sysenter_eip);vmcs_writel (GUEST_IDTR_BASE , vmcs12->host_idtr_base);vmcs_writel (GUEST_GDTR_BASE , vmcs12->host_gdtr_base); +vmcs_write32 (GUEST_IDTR_LIMIT ,0xFFFF ); +vmcs_write32 (GUEST_GDTR_LIMIT ,0xFFFF );/* If not VM_EXIT_CLEAR_BNDCFGS, the L2 value propagates to L1. */ if (vmcs12->vm_exit_controls &VM_EXIT_CLEAR_BNDCFGS )
Greg Kroah-Hartman
maintainerPATCH 63/138 SUNRPC: Fix tracepoint storage issues with svc_recv and svc_rqst_status
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
commit e9d4bf219c83d09579bc62512fea2ca10f025d93 upstream.
There is no guarantee that either the request or the svc_xprt exist by the time we get round to printing the trace message.
--- include/trace/events/sunrpc.h | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-)
include/trace/events/sunrpc.h +10 -7
@@ -455,20 +455,22 @@ TRACE_EVENT(svc_recv, TP_ARGS(rqst, status),TP_STRUCT__entry ( -__field (struct sockaddr *,addr )__field (__be32 ,xid )__field (int, status) __field(unsigned long, flags) + __dynamic_array(unsigned char, addr, rqst->rq_addrlen) ),TP_fast_assign ( - __entry->addr = (struct sockaddr *)&rqst->rq_addr; __entry->xid = status > 0 ? rqst->rq_xid : 0; __entry->status = status; __entry->flags = rqst->rq_flags; +memcpy (__get_dynamic_array (addr), + &rqst->rq_addr, rqst->rq_addrlen); ), -TP_printk ("addr=%pIScp xid=0x%x status=%d flags=%s" , __entry->addr, +TP_printk ("addr=%pIScp xid=0x%x status=%d flags=%s" , + (struct sockaddr *)__get_dynamic_array (addr),be32_to_cpu (__entry->xid), __entry->status,show_rqstp_flags (__entry->flags)) );
@@ -513,22 +515,23 @@ DECLARE_EVENT_CLASS(svc_rqst_status, TP_ARGS(rqst, status),TP_STRUCT__entry ( -__field (struct sockaddr *,addr )__field (__be32 ,xid ) -__field (int, dropme)__field (int, status) __field(unsigned long, flags) + __dynamic_array(unsigned char, addr, rqst->rq_addrlen) ),TP_fast_assign ( - __entry->addr = (struct sockaddr *)&rqst->rq_addr; __entry->xid = rqst->rq_xid; __entry->status = status; __entry->flags = rqst->rq_flags; +memcpy (__get_dynamic_array (addr), + &rqst->rq_addr, rqst->rq_addrlen); ),TP_printk ("addr=%pIScp rq_xid=0x%x status=%d flags=%s" , - __entry->addr,be32_to_cpu (__entry->xid), + (struct sockaddr *)__get_dynamic_array (addr), +be32_to_cpu (__entry->xid), __entry->status,show_rqstp_flags (__entry->flags)) );
Greg Kroah-Hartman
maintainerPATCH 64/138 clk: ti: dra7-atl-clock: fix child-node lookups
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 33ec6dbc5a02677509d97fe36cd2105753f0f0ea upstream.
Fix child node-lookup during probe, which ended up searching the whole device tree depth-first starting at parent rather than just matching on its children.
Note that the original premature free of the parent node has already been fixed separately, but that fix was apparently never backported to stable.
--- drivers/clk/ti/clk-dra7-atl.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/clk/ti/clk-dra7-atl.c +1 -2
@@ -265,8 +265,7 @@ static int of_dra7_atl_clk_probe(struct/* Get configuration for the ATL instances */ snprintf (prop,sizeof (prop),"atl%u" , i); -of_node_get (node); - cfg_node =of_find_node_by_name (node, prop); + cfg_node =of_get_child_by_name (node, prop);if (cfg_node) { ret =of_property_read_u32 (cfg_node,"bws" , &cdesc->bws);
Greg Kroah-Hartman
maintainerPATCH 65/138 libnvdimm, pfn: make resource attribute only readable by root
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Williams <[email protected]>
commit 26417ae4fc6108f8db436f24108b08f68bdc520e upstream.
For the same reason that /proc/iomem returns 0's for non-root readers and acpi tables are root-only, make the 'resource' attribute for pfn devices only readable by root. Otherwise we disclose physical address information.
--- drivers/nvdimm/pfn_devs.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/nvdimm/pfn_devs.c +8 -0
@@ -270,8 +270,16 @@ static struct attribute *nd_pfn_attribut NULL, }; +static umode_t pfn_visible (struct kobject *kobj,struct attribute *a,int n) +{ +if (a == &dev_attr_resource.attr) +return 0400 ; +return a->mode; +} +struct attribute_group nd_pfn_attribute_group = { .attrs = nd_pfn_attributes, + .is_visible = pfn_visible, };static const struct attribute_group *nd_pfn_attribute_groups[] = {
Greg Kroah-Hartman
maintainerPATCH 66/138 libnvdimm, namespace: fix label initialization to use valid seq numbers
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Williams <[email protected]>
commit b18d4b8a25af6fe83d7692191d6ff962ea611c4f upstream.
The set of valid sequence numbers is {1,2,3}. The specification indicates that an implementation should consider 0 a sign of a critical error:
UEFI 2.7: 13.19 NVDIMM Label Protocol
Software never writes the sequence number 00, so a correctly check-summed Index Block with this sequence number probably indicates a critical error. When software discovers this case it treats it as an invalid Index Block indication.
While the expectation is that the invalid block is just thrown away, the Robustness Principle says we should fix this to make both sequence numbers valid.
--- drivers/nvdimm/label.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/nvdimm/label.c +1 -1
@@ -861,7 +861,7 @@ static int init_labels(struct nd_mapping nsindex =to_namespace_index (ndd,0 );memset (nsindex,0 , ndd->nsarea.config_size);for (i =0 ; i <2 ; i++) { -int rc =nd_label_write_index (ndd, i, i*2 ,ND_NSINDEX_INIT ); +int rc =nd_label_write_index (ndd, i,3 - i,ND_NSINDEX_INIT );if (rc)return rc;
Greg Kroah-Hartman
maintainerPATCH 67/138 libnvdimm, namespace: make resource attribute only readable by root
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Williams <[email protected]>
commit c1fb3542074fd0c4d901d778bd52455111e4eb6f upstream.
For the same reason that /proc/iomem returns 0's for non-root readers and acpi tables are root-only, make the 'resource' attribute for namespace devices only readable by root. Otherwise we disclose physical address information.
--- drivers/nvdimm/namespace_devs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/nvdimm/namespace_devs.c +1 -1
@@ -1451,7 +1451,7 @@ static umode_t namespace_visible(structif (a == &dev_attr_resource.attr) {if (is_namespace_blk (dev))return 0 ; -return a->mode; +return 0400 ; }if (is_namespace_pmem (dev) ||is_namespace_blk (dev)) {
Greg Kroah-Hartman
maintainerPATCH 68/138 IB/srpt: Do not accept invalid initiator port names
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <[email protected]>
commit c70ca38960399a63d5c048b7b700612ea321d17e upstream.
Make srpt_parse_i_port_id() return a negative value if hex2bin() fails.
--- drivers/infiniband/ulp/srpt/ib_srpt.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
drivers/infiniband/ulp/srpt/ib_srpt.c +4 -5
@@ -2750,7 +2750,7 @@ static int srpt_parse_i_port_id(u8 i_por {const char *p;unsigned len, count, leading_zero_bytes; -int ret, rc; +int ret; p = name;if (strncasecmp (p,"0x" ,2 ) ==0 )
@@ -2762,10 +2762,9 @@ static int srpt_parse_i_port_id(u8 i_por count =min (len /2 ,16U ); leading_zero_bytes =16 - count;memset (i_port_id,0 , leading_zero_bytes); - rc =hex2bin (i_port_id + leading_zero_bytes, p, count); -if (rc <0 ) -pr_debug ("hex2bin failed for srpt_parse_i_port_id: %d\n" , rc); - ret =0 ; + ret =hex2bin (i_port_id + leading_zero_bytes, p, count); +if (ret <0 ) +pr_debug ("hex2bin failed for srpt_parse_i_port_id: %d\n" , ret); out:return ret; }
Greg Kroah-Hartman
maintainerPATCH 69/138 IB/srp: Avoid that a cable pull can trigger a kernel crash
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <[email protected]>
commit 8a0d18c62121d3c554a83eb96e2752861d84d937 upstream.
This patch fixes the following kernel crash:
general protection fault: 0000 [#1] PREEMPT SMP Workqueue: ib_mad2 timeout_sends [ib_core] Call Trace: ib_sa_path_rec_callback+0x1c4/0x1d0 [ib_core] send_handler+0xb2/0xd0 [ib_core] timeout_sends+0x14d/0x220 [ib_core] process_one_work+0x200/0x630 worker_thread+0x4e/0x3b0 kthread+0x113/0x150
--- drivers/infiniband/ulp/srp/ib_srp.c | 25 +++++++++++++++++++------ 1 file changed, 19 insertions(+), 6 deletions(-)
drivers/infiniband/ulp/srp/ib_srp.c +19 -6
@@ -648,12 +648,19 @@ static void srp_path_rec_completion(intstatic int srp_lookup_path (struct srp_rdma_ch *ch) {struct srp_target_port *target = ch->target; -int ret; +int ret = -ENODEV ; ch->path.numb_path =1 ;init_completion (&ch->done); +/* +* Avoid that the SCSI host can be removed by srp_remove_target() +* before srp_path_rec_completion() is called. +*/ +if (!scsi_host_get (target->scsi_host)) + goto out; + ch->path_query_id = ib_sa_path_rec_get(&srp_sa_client, target->srp_host->srp_dev->dev, target->srp_host->port,
@@ -667,18 +674,24 @@ static int srp_lookup_path(struct srp_rdGFP_KERNEL , srp_path_rec_completion, ch, &ch->path_query); -if (ch->path_query_id <0 ) -return ch->path_query_id; + ret = ch->path_query_id; +if (ret <0 ) + goto put; ret =wait_for_completion_interruptible (&ch->done);if (ret <0 ) -return ret; + goto put; -if (ch->status <0 ) + ret = ch->status; +if (ret <0 )shost_printk (KERN_WARNING , target->scsi_host,PFX "Path record query failed\n" ); -return ch->status; +put: +scsi_host_put (target->scsi_host); + +out: +return ret; }static int srp_send_req (struct srp_rdma_ch *ch,bool multich)
Greg Kroah-Hartman
maintainerPATCH 70/138 NFC: fix device-allocation error return
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit c45e3e4c5b134b081e8af362109905427967eb19 upstream.
A recent change fixing NFC device allocation itself introduced an error-handling bug by returning an error pointer in case device-id allocation failed. This is clearly broken as the callers still expected NULL to be returned on errors as detected by Dan's static checker.
Fix this up by returning NULL in the event that we've run out of memory when allocating a new device id.
Note that the offending commit is marked for stable (3.8) so this fix needs to be backported along with it.
--- net/nfc/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/nfc/core.c +1 -1
@@ -1106,7 +1106,7 @@ struct nfc_dev *nfc_allocate_device(stru err_free_dev:kfree (dev); -return ERR_PTR (rc); +return NULL ; }EXPORT_SYMBOL (nfc_allocate_device);
Greg Kroah-Hartman
maintainerPATCH 71/138 i40e: Use smp_rmb rather than read_barrier_depends
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian King <[email protected]>
commit 52c6912fde0133981ee50ba08808f257829c4c93 upstream.
The original issue being fixed in this patch was seen with the ixgbe driver, but the same issue exists with i40e as well, as the code is very similar. read_barrier_depends is not sufficient to ensure loads following it are not speculatively loaded out of order by the CPU, which can result in stale data being loaded, causing potential system crashes.
--- drivers/net/ethernet/intel/i40e/i40e_main.c | 2 +- drivers/net/ethernet/intel/i40e/i40e_txrx.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/intel/i40e/i40e_main.c +1 -1
@@ -3604,7 +3604,7 @@ static bool i40e_clean_fdir_tx_irq(strucbreak ;/* prevent any other reads prior to eop_desc */ -read_barrier_depends (); +smp_rmb ();/* if the descriptor isn't done, no work yet to do */ if (!(eop_desc->cmd_type_offset_bsz &
drivers/net/ethernet/intel/i40e/i40e_txrx.c +1 -1
@@ -679,7 +679,7 @@ static bool i40e_clean_tx_irq(struct i40break ;/* prevent any other reads prior to eop_desc */ -read_barrier_depends (); +smp_rmb ();/* we have caught up to head, no work left to do */ if (tx_head == tx_desc)
Greg Kroah-Hartman
maintainerPATCH 72/138 igb: Use smp_rmb rather than read_barrier_depends
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian King <[email protected]>
commit c4cb99185b4cc96c0a1c70104dc21ae14d7e7f28 upstream.
The original issue being fixed in this patch was seen with the ixgbe driver, but the same issue exists with igb as well, as the code is very similar. read_barrier_depends is not sufficient to ensure loads following it are not speculatively loaded out of order by the CPU, which can result in stale data being loaded, causing potential system crashes.
--- drivers/net/ethernet/intel/igb/igb_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/intel/igb/igb_main.c +1 -1
@@ -6660,7 +6660,7 @@ static bool igb_clean_tx_irq(struct igb_break ;/* prevent any other reads prior to eop_desc */ -read_barrier_depends (); +smp_rmb ();/* if DD is not set pending work has not been completed */ if (!(eop_desc->wb.status &cpu_to_le32 (E1000_TXD_STAT_DD )))
Greg Kroah-Hartman
maintainerPATCH 73/138 igbvf: Use smp_rmb rather than read_barrier_depends
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian King <[email protected]>
commit 1e1f9ca546556e508d021545861f6b5fc75a95fe upstream.
The original issue being fixed in this patch was seen with the ixgbe driver, but the same issue exists with igbvf as well, as the code is very similar. read_barrier_depends is not sufficient to ensure loads following it are not speculatively loaded out of order by the CPU, which can result in stale data being loaded, causing potential system crashes.
--- drivers/net/ethernet/intel/igbvf/netdev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/intel/igbvf/netdev.c +1 -1
@@ -810,7 +810,7 @@ static bool igbvf_clean_tx_irq(struct igbreak ;/* prevent any other reads prior to eop_desc */ -read_barrier_depends (); +smp_rmb ();/* if DD is not set pending work has not been completed */ if (!(eop_desc->wb.status &cpu_to_le32 (E1000_TXD_STAT_DD )))
Greg Kroah-Hartman
maintainerPATCH 74/138 ixgbevf: Use smp_rmb rather than read_barrier_depends
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian King <[email protected]>
commit ae0c585d93dfaf923d2c7eb44b2c3ab92854ea9b upstream.
The original issue being fixed in this patch was seen with the ixgbe driver, but the same issue exists with ixgbevf as well, as the code is very similar. read_barrier_depends is not sufficient to ensure loads following it are not speculatively loaded out of order by the CPU, which can result in stale data being loaded, causing potential system crashes.
--- drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c +1 -1
@@ -325,7 +325,7 @@ static bool ixgbevf_clean_tx_irq(structbreak ;/* prevent any other reads prior to eop_desc */ -read_barrier_depends (); +smp_rmb ();/* if DD is not set pending work has not been completed */ if (!(eop_desc->wb.status &cpu_to_le32 (IXGBE_TXD_STAT_DD )))
Greg Kroah-Hartman
maintainerPATCH 75/138 i40evf: Use smp_rmb rather than read_barrier_depends
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian King <[email protected]>
commit f72271e2a0ae4277d53c4053f5eed8bb346ba38a upstream.
The original issue being fixed in this patch was seen with the ixgbe driver, but the same issue exists with i40evf as well, as the code is very similar. read_barrier_depends is not sufficient to ensure loads following it are not speculatively loaded out of order by the CPU, which can result in stale data being loaded, causing potential system crashes.
--- drivers/net/ethernet/intel/i40evf/i40e_txrx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/intel/i40evf/i40e_txrx.c +1 -1
@@ -184,7 +184,7 @@ static bool i40e_clean_tx_irq(struct i40break ;/* prevent any other reads prior to eop_desc */ -read_barrier_depends (); +smp_rmb ();/* we have caught up to head, no work left to do */ if (tx_head == tx_desc)
Greg Kroah-Hartman
maintainerPATCH 76/138 fm10k: Use smp_rmb rather than read_barrier_depends
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian King <[email protected]>
commit 7b8edcc685b5e2c3c37aa13dc50a88e84a5bfef8 upstream.
The original issue being fixed in this patch was seen with the ixgbe driver, but the same issue exists with fm10k as well, as the code is very similar. read_barrier_depends is not sufficient to ensure loads following it are not speculatively loaded out of order by the CPU, which can result in stale data being loaded, causing potential system crashes.
--- drivers/net/ethernet/intel/fm10k/fm10k_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/intel/fm10k/fm10k_main.c +1 -1
@@ -1225,7 +1225,7 @@ static bool fm10k_clean_tx_irq(struct fmbreak ;/* prevent any other reads prior to eop_desc */ -read_barrier_depends (); +smp_rmb ();/* if DD is not set pending work has not been completed */ if (!(eop_desc->flags &FM10K_TXD_FLAG_DONE ))
Greg Kroah-Hartman
maintainerPATCH 77/138 ixgbe: Fix skb list corruption on Power systems
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian King <[email protected]>
commit 0a9a17e3bb4564caf4bfe2a6783ae1287667d188 upstream.
This patch fixes an issue seen on Power systems with ixgbe which results in skb list corruption and an eventual kernel oops. The following is what was observed:
CPU 1 CPU2 ============================ ============================ 1: ixgbe_xmit_frame_ring ixgbe_clean_tx_irq 2: first->skb = skb eop_desc = tx_buffer->next_to_watch 3: ixgbe_tx_map read_barrier_depends() 4: wmb check adapter written status bit 5: first->next_to_watch = tx_desc napi_consume_skb(tx_buffer->skb ..);
6: writel(i, tx_ring->tail);
The read_barrier_depends is insufficient to ensure that tx_buffer->skb does not get loaded prior to tx_buffer->next_to_watch, which then results in loading a stale skb pointer. This patch replaces the read_barrier_depends with smp_rmb to ensure loads are ordered with respect to the load of tx_buffer->next_to_watch.
--- drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +1 -1
@@ -1171,7 +1171,7 @@ static bool ixgbe_clean_tx_irq(struct ixbreak ;/* prevent any other reads prior to eop_desc */ -read_barrier_depends (); +smp_rmb ();/* if DD is not set pending work has not been completed */ if (!(eop_desc->wb.status &cpu_to_le32 (IXGBE_TXD_STAT_DD )))
Greg Kroah-Hartman
maintainerPATCH 78/138 parisc: Fix validity check of pointer size argument in new CAS implementation
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: John David Anglin <[email protected]>
commit 05f016d2ca7a4fab99d5d5472168506ddf95e74f upstream.
As noted by Christoph Biedl, passing a pointer size of 4 in the new CAS implementation causes a kernel crash. The attached patch corrects the off by one error in the argument validity check.
In reviewing the code, I noticed that we only perform word operations with the pointer size argument. The subi instruction intentionally uses a word condition on 64-bit kernels. Nullification was used instead of a cmpib instruction as the branch should never be taken. The shlw pseudo-operation generates a depw,z instruction and it clears the target before doing a shift left word deposit. Thus, we don't need to clip the upper 32 bits of this argument on 64-bit kernels.
Tested with a gcc testsuite run with a 64-bit kernel. The gcc atomic code in libgcc is the only direct user of the new CAS implementation that I am aware of.
--- arch/parisc/kernel/syscall.S | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/parisc/kernel/syscall.S +3 -3
@@ -690,15 +690,15 @@ cas_action: /* ELF32 Process entry path */ lws_compare_and_swap_2: #ifdef CONFIG_64BIT - /* Clip the input registers */ + /* Clip the input registers. We don't need to clip %r23 as we + only use it for word operations */ depdi 0, 31, 32, %r26 depdi 0, 31, 32, %r25 depdi 0, 31, 32, %r24 - depdi 0, 31, 32, %r23 #endif /* Check the validity of the size pointer */ - subi,>>= 4, %r23, %r0 + subi,>>= 3, %r23, %r0 b,n lws_exit_nosys /* Jump to the functions which will load the old and new values into
Greg Kroah-Hartman
maintainerPATCH 79/138 powerpc/signal: Properly handle return value from uprobe_deny_signal()
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Naveen N. Rao <[email protected]>
commit 46725b17f1c6c815a41429259b3f070c01e71bc1 upstream.
When a uprobe is installed on an instruction that we currently do not emulate, we copy the instruction into a xol buffer and single step that instruction. If that instruction generates a fault, we abort the single stepping before invoking the signal handler. Once the signal handler is done, the uprobe trap is hit again since the instruction is retried and the process repeats.
We use uprobe_deny_signal() to detect if the xol instruction triggered a signal. If so, we clear TIF_SIGPENDING and set TIF_UPROBE so that the signal is not handled until after the single stepping is aborted. In this case, uprobe_deny_signal() returns true and get_signal() ends up returning 0. However, in do_signal(), we are not looking at the return value, but depending on ksig.sig for further action, all with an uninitialized ksig that is not touched in this scenario. Fix the same by initializing ksig.sig to 0.
--- arch/powerpc/kernel/signal.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/kernel/signal.c +1 -1
@@ -102,7 +102,7 @@ static void check_syscall_restart(structstatic void do_signal (struct task_struct *tsk) {sigset_t *oldset =sigmask_to_save (); -struct ksignal ksig; +struct ksignal ksig = { .sig =0 };int ret;int is32 =is_32bit_task ();
Greg Kroah-Hartman
maintainerPATCH 80/138 media: Dont do DMA on stack for firmware upload in the AS102 driver
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michele Baldessari <[email protected]>
commit b3120d2cc447ee77b9d69bf4ad7b452c9adb4d39 upstream.
Firmware load on AS102 is using the stack which is not allowed any longer. We currently fail with:
kernel: transfer buffer not dma capable
kernel: ------------[ cut here ]------------
kernel: WARNING: CPU: 0 PID: 598 at drivers/usb/core/hcd.c:1595 usb_hcd_map_urb_for_dma+0x41d/0x620
kernel: Modules linked in: amd64_edac_mod(-) edac_mce_amd as102_fe dvb_as102(+) kvm_amd kvm snd_hda_codec_realtek dvb_core snd_hda_codec_generic snd_hda_codec_hdmi snd_hda_intel snd_hda_codec irqbypass crct10dif_pclmul crc32_pclmul snd_hda_core snd_hwdep snd_seq ghash_clmulni_intel sp5100_tco fam15h_power wmi k10temp i2c_piix4 snd_seq_device snd_pcm snd_timer parport_pc parport tpm_infineon snd tpm_tis soundcore tpm_tis_core tpm shpchp acpi_cpufreq xfs libcrc32c amdgpu amdkfd amd_iommu_v2 radeon hid_logitech_hidpp i2c_algo_bit drm_kms_helper crc32c_intel ttm drm r8169 mii hid_logitech_dj
kernel: CPU: 0 PID: 598 Comm: systemd-udevd Not tainted 4.13.10-200.fc26.x86_64 #1
kernel: Hardware name: ASUS All Series/AM1I-A, BIOS 0505 03/13/2014
kernel: task: ffff979933b24c80 task.stack: ffffaf83413a4000
kernel: RIP: 0010:usb_hcd_map_urb_for_dma+0x41d/0x620
systemd-fsck[659]: /dev/sda2: clean, 49/128016 files, 268609/512000 blocks
kernel: RSP: 0018:ffffaf83413a7728 EFLAGS: 00010282
systemd-udevd[604]: link_config: autonegotiation is unset or enabled, the speed and duplex are not writable.
kernel: RAX: 000000000000001f RBX: ffff979930bce780 RCX: 0000000000000000 kernel: RDX: 0000000000000000 RSI: ffff97993ec0e118 RDI: ffff97993ec0e118 kernel: RBP: ffffaf83413a7768 R08: 000000000000039a R09: 0000000000000000 kernel: R10: 0000000000000001 R11: 00000000ffffffff R12: 00000000fffffff5 kernel: R13: 0000000001400000 R14: 0000000000000001 R15: ffff979930806800 kernel: FS: 00007effaca5c8c0(0000) GS:ffff97993ec00000(0000) knlGS:0000000000000000 kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 kernel: CR2: 00007effa9fca962 CR3: 0000000233089000 CR4: 00000000000406f0 kernel: Call Trace: kernel: usb_hcd_submit_urb+0x493/0xb40 kernel: ? page_cache_tree_insert+0x100/0x100 kernel: ? xfs_iunlock+0xd5/0x100 [xfs] kernel: ? xfs_file_buffered_aio_read+0x57/0xc0 [xfs] kernel: usb_submit_urb+0x22d/0x560 kernel: usb_start_wait_urb+0x6e/0x180 kernel: usb_bulk_msg+0xb8/0x160 kernel: as102_send_ep1+0x49/0xe0 [dvb_as102] kernel: ? devres_add+0x3f/0x50 kernel: as102_firmware_upload.isra.0+0x1dc/0x210 [dvb_as102] kernel: as102_fw_upload+0xb6/0x1f0 [dvb_as102] kernel: as102_dvb_register+0x2af/0x2d0 [dvb_as102] kernel: as102_usb_probe+0x1f3/0x260 [dvb_as102] kernel: usb_probe_interface+0x124/0x300 kernel: driver_probe_device+0x2ff/0x450 kernel: __driver_attach+0xa4/0xe0 kernel: ? driver_probe_device+0x450/0x450 kernel: bus_for_each_dev+0x6e/0xb0 kernel: driver_attach+0x1e/0x20 kernel: bus_add_driver+0x1c7/0x270 kernel: driver_register+0x60/0xe0 kernel: usb_register_driver+0x81/0x150 kernel: ? 0xffffffffc0807000 kernel: as102_usb_driver_init+0x1e/0x1000 [dvb_as102] kernel: do_one_initcall+0x50/0x190 kernel: ? __vunmap+0x81/0xb0 kernel: ? kfree+0x154/0x170 kernel: ? kmem_cache_alloc_trace+0x15f/0x1c0 kernel: ? do_init_module+0x27/0x1e9 kernel: do_init_module+0x5f/0x1e9 kernel: load_module+0x2602/0x2c30 kernel: SYSC_init_module+0x170/0x1a0 kernel: ? SYSC_init_module+0x170/0x1a0 kernel: SyS_init_module+0xe/0x10 kernel: do_syscall_64+0x67/0x140 kernel: entry_SYSCALL64_slow_path+0x25/0x25 kernel: RIP: 0033:0x7effab6cf3ea kernel: RSP: 002b:00007fff5cfcbbc8 EFLAGS: 00000246 ORIG_RAX: 00000000000000af kernel: RAX: ffffffffffffffda RBX: 00005569e0b83760 RCX: 00007effab6cf3ea kernel: RDX: 00007effac2099c5 RSI: 0000000000009a13 RDI: 00005569e0b98c50 kernel: RBP: 00007effac2099c5 R08: 00005569e0b83ed0 R09: 0000000000001d80 kernel: R10: 00007effab98db00 R11: 0000000000000246 R12: 00005569e0b98c50 kernel: R13: 00005569e0b81c60 R14: 0000000000020000 R15: 00005569dfadfdf7 kernel: Code: 48 39 c8 73 30 80 3d 59 60 9d 00 00 41 bc f5 ff ff ff 0f 85 26 ff ff ff 48 c7 c7 b8 6b d0 92 c6 05 3f 60 9d 00 01 e8 24 3d ad ff <0f> ff 8b 53 64 e9 09 ff ff ff 65 48 8b 0c 25 00 d3 00 00 48 8b kernel: ---[ end trace c4cae366180e70ec ]--- kernel: as10x_usb: error during firmware upload part1
Let's allocate the the structure dynamically so we can get the firmware loaded correctly:
[ 14.243057] as10x_usb: firmware: as102_data1_st.hex loaded with success [ 14.500777] as10x_usb: firmware: as102_data2_st.hex loaded with success
--- drivers/media/usb/as102/as102_fw.c | 28 +++++++++++++++++----------- 1 file changed, 17 insertions(+), 11 deletions(-)
drivers/media/usb/as102/as102_fw.c +17 -11
@@ -101,18 +101,23 @@ static int as102_firmware_upload(structunsigned char *cmd, const struct firmware *firmware) { - struct as10x_fw_pkt_t fw_pkt; + struct as10x_fw_pkt_t *fw_pkt;int total_read_bytes =0 , errno =0 ;unsigned char addr_has_changed =0 ; + fw_pkt =kmalloc (sizeof (*fw_pkt),GFP_KERNEL ); +if (!fw_pkt) +return -ENOMEM ; + +for (total_read_bytes =0 ; total_read_bytes < firmware->size; ) {int read_bytes =0 , data_len =0 ;/* parse intel hex line */ read_bytes =parse_hex_line ( (u8 *) (firmware->data + total_read_bytes), - fw_pkt.raw.address, - fw_pkt.raw.data, + fw_pkt->raw.address, + fw_pkt->raw.data, &data_len, &addr_has_changed);
@@ -122,28 +127,28 @@ static int as102_firmware_upload(struct/* detect the end of file */ total_read_bytes += read_bytes;if (total_read_bytes == firmware->size) { - fw_pkt.u.request[0 ] =0x00 ; - fw_pkt.u.request[1 ] =0x03 ; + fw_pkt->u.request[0 ] =0x00 ; + fw_pkt->u.request[1 ] =0x03 ;/* send EOF command */ errno = bus_adap->ops->upload_fw_pkt (bus_adap, (uint8_t *) - &fw_pkt,2 ,0 ); + fw_pkt,2 ,0 );if (errno <0 ) goto error; }else {if (!addr_has_changed) {/* prepare command to send */ - fw_pkt.u.request[0 ] =0x00 ; - fw_pkt.u.request[1 ] =0x01 ; + fw_pkt->u.request[0 ] =0x00 ; + fw_pkt->u.request[1 ] =0x01 ; - data_len +=sizeof (fw_pkt.u.request); - data_len +=sizeof (fw_pkt.raw.address); + data_len +=sizeof (fw_pkt->u.request); + data_len +=sizeof (fw_pkt->raw.address);/* send cmd to device */ errno = bus_adap->ops->upload_fw_pkt (bus_adap, (uint8_t *) - &fw_pkt, + fw_pkt, data_len,0 );if (errno <0 )
@@ -152,6 +157,7 @@ static int as102_firmware_upload(struct } } error: +kfree (fw_pkt);return (errno ==0 ) ? total_read_bytes : errno; }
Greg Kroah-Hartman
maintainerPATCH 81/138 media: rc: check for integer overflow
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Young <[email protected]>
commit 3e45067f94bbd61dec0619b1c32744eb0de480c8 upstream.
The ioctl LIRC_SET_REC_TIMEOUT would set a timeout of 704ns if called with a timeout of 4294968us.
--- drivers/media/rc/ir-lirc-codec.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/media/rc/ir-lirc-codec.c +6 -3
@@ -286,11 +286,14 @@ static long ir_lirc_ioctl(struct file *fif (!dev->max_timeout)return -ENOSYS ; +/* Check for multiply overflow */ +if (val >U32_MAX /1000 ) +return -EINVAL ; + tmp = val *1000 ; -if (tmp < dev->min_timeout || - tmp > dev->max_timeout) -return -EINVAL ; +if (tmp < dev->min_timeout || tmp > dev->max_timeout) +return -EINVAL ;if (dev->s_timeout) ret = dev->s_timeout (dev, tmp);
Greg Kroah-Hartman
maintainerPATCH 82/138 cx231xx-cards: fix NULL-deref on missing association descriptor
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 6c3b047fa2d2286d5e438bcb470c7b1a49f415f6 upstream.
Make sure to check that we actually have an Interface Association Descriptor before dereferencing it during probe to avoid dereferencing a NULL-pointer.
--- drivers/media/usb/cx231xx/cx231xx-cards.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/usb/cx231xx/cx231xx-cards.c +1 -1
@@ -1622,7 +1622,7 @@ static int cx231xx_usb_probe(struct usb_ nr = dev->devno; assoc_desc = udev->actconfig->intf_assoc[0 ]; -if (assoc_desc->bFirstInterface != ifnum) { +if (!assoc_desc || assoc_desc->bFirstInterface != ifnum) {dev_err (d,"Not found matching IAD interface\n" ); retval = -ENODEV ; goto err_if;
Greg Kroah-Hartman
maintainerPATCH 83/138 media: v4l2-ctrl: Fix flags field on Control events
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Ribalda Delgado <[email protected]>
commit 9cac9d2fb2fe0e0cadacdb94415b3fe49e3f724f upstream.
VIDIOC_DQEVENT and VIDIOC_QUERY_EXT_CTRL should give the same output for the control flags field.
This patch creates a new function user_flags(), that calculates the user exported flags value (which is different than the kernel internal flags structure). This function is then used by all the code that exports the internal flags to userspace.
--- drivers/media/v4l2-core/v4l2-ctrls.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-)
drivers/media/v4l2-core/v4l2-ctrls.c +12 -4
@@ -1219,6 +1219,16 @@ void v4l2_ctrl_fill(u32 id, const char * }EXPORT_SYMBOL (v4l2_ctrl_fill); +static u32 user_flags (const struct v4l2_ctrl *ctrl) +{ +u32 flags = ctrl->flags; + +if (ctrl->is_ptr) + flags |=V4L2_CTRL_FLAG_HAS_PAYLOAD ; + +return flags; +} +static void fill_event (struct v4l2_event *ev,struct v4l2_ctrl *ctrl,u32 changes) {memset (ev->reserved,0 ,sizeof (ev->reserved));
@@ -1226,7 +1236,7 @@ static void fill_event(struct v4l2_event ev->id = ctrl->id; ev->u.ctrl.changes = changes; ev->u.ctrl.type = ctrl->type; - ev->u.ctrl.flags = ctrl->flags; + ev->u.ctrl.flags =user_flags (ctrl);if (ctrl->is_ptr) ev->u.ctrl.value64 =0 ;else
@@ -2550,10 +2560,8 @@ int v4l2_query_ext_ctrl(struct v4l2_ctrlelse qc->id = ctrl->id;strlcpy (qc->name, ctrl->name,sizeof (qc->name)); - qc->flags = ctrl->flags; + qc->flags =user_flags (ctrl); qc->type = ctrl->type; -if (ctrl->is_ptr) - qc->flags |=V4L2_CTRL_FLAG_HAS_PAYLOAD ; qc->elem_size = ctrl->elem_size; qc->elems = ctrl->elems; qc->nr_of_dims = ctrl->nr_of_dims;
Greg Kroah-Hartman
maintainerPATCH 84/138 sched/rt: Simplify the IPI based RT balancing logic
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt (Red Hat) <[email protected]>
commit 4bdced5c9a2922521e325896a7bbbf0132c94e56 upstream.
When a CPU lowers its priority (schedules out a high priority task for a lower priority one), a check is made to see if any other CPU has overloaded RT tasks (more than one). It checks the rto_mask to determine this and if so it will request to pull one of those tasks to itself if the non running RT task is of higher priority than the new priority of the next task to run on the current CPU.
When we deal with large number of CPUs, the original pull logic suffered from large lock contention on a single CPU run queue, which caused a huge latency across all CPUs. This was caused by only having one CPU having overloaded RT tasks and a bunch of other CPUs lowering their priority. To solve this issue, commit:
b6366f048e0c ("sched/rt: Use IPI to trigger RT task push migration instead of pulling")
changed the way to request a pull. Instead of grabbing the lock of the overloaded CPU's runqueue, it simply sent an IPI to that CPU to do the work.
Although the IPI logic worked very well in removing the large latency build up, it still could suffer from a large number of IPIs being sent to a single CPU. On a 80 CPU box, I measured over 200us of processing IPIs. Worse yet, when I tested this on a 120 CPU box, with a stress test that had lots of RT tasks scheduling on all CPUs, it actually triggered the hard lockup detector! One CPU had so many IPIs sent to it, and due to the restart mechanism that is triggered when the source run queue has a priority status change, the CPU spent minutes! processing the IPIs.
Thinking about this further, I realized there's no reason for each run queue to send its own IPI. As all CPUs with overloaded tasks must be scanned regardless if there's one or many CPUs lowering their priority, because there's no current way to find the CPU with the highest priority task that can schedule to one of these CPUs, there really only needs to be one IPI being sent around at a time.
This greatly simplifies the code!
The new approach is to have each root domain have its own irq work, as the rto_mask is per root domain. The root domain has the following fields attached to it:
rto_push_work - the irq work to process each CPU set in rto_mask
rto_lock - the lock to protect some of the other rto fields
rto_loop_start - an atomic that keeps contention down on rto_lock
the first CPU scheduling in a lower priority task is the one to kick off the process.
rto_loop_next - an atomic that gets incremented for each CPU that
schedules in a lower priority task.
rto_loop - a variable protected by rto_lock that is used to
compare against rto_loop_next
rto_cpu - The cpu to send the next IPI to, also protected by
the rto_lock.
When a CPU schedules in a lower priority task and wants to make sure overloaded CPUs know about it. It increments the rto_loop_next. Then it atomically sets rto_loop_start with a cmpxchg. If the old value is not "0", then it is done, as another CPU is kicking off the IPI loop. If the old value is "0", then it will take the rto_lock to synchronize with a possible IPI being sent around to the overloaded CPUs.
If rto_cpu is greater than or equal to nr_cpu_ids, then there's either no IPI being sent around, or one is about to finish. Then rto_cpu is set to the first CPU in rto_mask and an IPI is sent to that CPU. If there's no CPUs set in rto_mask, then there's nothing to be done.
When the CPU receives the IPI, it will first try to push any RT tasks that is queued on the CPU but can't run because a higher priority RT task is currently running on that CPU.
Then it takes the rto_lock and looks for the next CPU in the rto_mask. If it finds one, it simply sends an IPI to that CPU and the process continues.
If there's no more CPUs in the rto_mask, then rto_loop is compared with rto_loop_next. If they match, everything is done and the process is over. If they do not match, then a CPU scheduled in a lower priority task as the IPI was being passed around, and the process needs to start again. The first CPU in rto_mask is sent the IPI.
This change removes this duplication of work in the IPI logic, and greatly lowers the latency caused by the IPIs. This removed the lockup happening on the 120 CPU machine. It also simplifies the code tremendously. What else could anyone ask for?
Thanks to Peter Zijlstra for simplifying the rto_loop_start atomic logic and supplying me with the rto_start_trylock() and rto_start_unlock() helper functions.
--- kernel/sched/core.c | 6 + kernel/sched/rt.c | 235 ++++++++++++++++++++++++--------------------------- kernel/sched/sched.h | 24 +++-- 3 files changed, 138 insertions(+), 127 deletions(-)
kernel/sched/core.c +6 -0
@@ -5877,6 +5877,12 @@ static int init_rootdomain(struct root_dif (!zalloc_cpumask_var (&rd->rto_mask,GFP_KERNEL )) goto free_dlo_mask; +#ifdef HAVE_RT_PUSH_IPI + rd->rto_cpu =-1 ; +raw_spin_lock_init (&rd->rto_lock); +init_irq_work (&rd->rto_push_work, rto_push_irq_work_func); +#endif +init_dl_bw (&rd->dl_bw);if (cpudl_init (&rd->cpudl) !=0 ) goto free_dlo_mask;
kernel/sched/rt.c +115 -120
298 lines not on this page · raw message
kernel/sched/sched.h +17 -7
@@ -463,7 +463,7 @@ static inline int rt_bandwidth_enabled(v }/* RT IPI pull logic requires IRQ_WORK */ -#ifdef CONFIG_IRQ_WORK +#if defined(CONFIG_IRQ_WORK ) && defined(CONFIG_SMP )# define HAVE_RT_PUSH_IPI #endif
@@ -485,12 +485,6 @@ struct rt_rq {unsigned long rt_nr_total;int overloaded;struct plist_head pushable_tasks; -#ifdef HAVE_RT_PUSH_IPI -int push_flags; -int push_cpu; -struct irq_work push_work; -raw_spinlock_t push_lock; -#endif #endif /* CONFIG_SMP */ int rt_queued;
@@ -572,6 +566,19 @@ struct root_domain {struct dl_bw dl_bw;struct cpudl cpudl; +#ifdef HAVE_RT_PUSH_IPI +/* +* For IPI pull requests, loop across the rto_mask. +*/ +struct irq_work rto_push_work; +raw_spinlock_t rto_lock; +/* These are only updated and read within rto_lock */ +int rto_loop; +int rto_cpu; +/* These atomics are updated outside of a lock */ +atomic_t rto_loop_next; +atomic_t rto_loop_start; +#endif /* * The "RT overload" flag: it gets set if a CPU has more than * one runnable RT task.
@@ -584,6 +591,9 @@ struct root_domain {extern struct root_domain def_root_domain; +#ifdef HAVE_RT_PUSH_IPI +extern void rto_push_irq_work_func (struct irq_work *work); +#endif #endif /* CONFIG_SMP */ /*
Greg Kroah-Hartman
maintainerPATCH 85/138 fscrypt: lock mutex before checking for bounce page pool
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
commit a0b3bc855374c50b5ea85273553485af48caf2f7 upstream.
fscrypt_initialize(), which allocates the global bounce page pool when an encrypted file is first accessed, uses "double-checked locking" to try to avoid locking fscrypt_init_mutex. However, it doesn't use any memory barriers, so it's theoretically possible for a thread to observe a bounce page pool which has not been fully initialized. This is a classic bug with "double-checked locking".
While "only a theoretical issue" in the latest kernel, in pre-4.8 kernels the pointer that was checked was not even the last to be initialized, so it was easily possible for a crash (NULL pointer dereference) to happen. This was changed only incidentally by the large refactor to use fs/crypto/.
Solve both problems in a trivial way that can easily be backported: just always take the mutex. It's theoretically less efficient, but it shouldn't be noticeable in practice as the mutex is only acquired very briefly once per encrypted file.
Later I'd like to make this use a helper macro like DO_ONCE(). However, DO_ONCE() runs in atomic context, so we'd need to add a new macro that allows blocking.
--- fs/crypto/crypto.c | 3 --- 1 file changed, 3 deletions(-)
fs/crypto/crypto.c +0 -3
@@ -484,9 +484,6 @@ int fscrypt_initialize(void) {int i, res = -ENOMEM ; -if (fscrypt_bounce_page_pool) -return 0 ; -mutex_lock (&fscrypt_init_mutex);if (fscrypt_bounce_page_pool) goto already_initialized;
Greg Kroah-Hartman
maintainerPATCH 86/138 net/9p: Switch to wait_event_killable()
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tuomas Tynkkynen <[email protected]>
commit 9523feac272ccad2ad8186ba4fcc89103754de52 upstream.
Because userspace gets Very Unhappy when calls like stat() and execve() return -EINTR on 9p filesystem mounts. For instance, when bash is looking in PATH for things to execute and some SIGCHLD interrupts stat(), bash can throw a spurious 'command not found' since it doesn't retry the stat().
In practice, hitting the problem is rare and needs a really slow/bogged down 9p server.
--- net/9p/client.c | 3 +-- net/9p/trans_virtio.c | 13 ++++++------- 2 files changed, 7 insertions(+), 9 deletions(-)
net/9p/client.c +1 -2
@@ -749,8 +749,7 @@ p9_client_rpc(struct p9_client *c, int8_ } again:/* Wait for the response */ - err =wait_event_interruptible (*req->wq, - req->status >=REQ_STATUS_RCVD ); + err =wait_event_killable (*req->wq, req->status >=REQ_STATUS_RCVD );/* * Make sure our req is coherent with regard to updates in other
net/9p/trans_virtio.c +6 -7
@@ -286,8 +286,8 @@ req_retry:if (err == -ENOSPC ) { chan->ring_bufs_avail =0 ;spin_unlock_irqrestore (&chan->lock, flags); - err =wait_event_interruptible (*chan->vc_wq, - chan->ring_bufs_avail); + err =wait_event_killable (*chan->vc_wq, + chan->ring_bufs_avail);if (err == -ERESTARTSYS )return err;
@@ -327,7 +327,7 @@ static int p9_get_mapped_pages(struct vi* Other zc request to finish here */ if (atomic_read (&vp_pinned) >= chan->p9_max_pages) { - err =wait_event_interruptible (vp_wq, + err =wait_event_killable (vp_wq, (atomic_read (&vp_pinned) < chan->p9_max_pages));if (err == -ERESTARTSYS )return err;
@@ -471,8 +471,8 @@ req_retry_pinned:if (err == -ENOSPC ) { chan->ring_bufs_avail =0 ;spin_unlock_irqrestore (&chan->lock, flags); - err =wait_event_interruptible (*chan->vc_wq, - chan->ring_bufs_avail); + err =wait_event_killable (*chan->vc_wq, + chan->ring_bufs_avail);if (err == -ERESTARTSYS ) goto err_out;
@@ -489,8 +489,7 @@ req_retry_pinned:virtqueue_kick (chan->vq);spin_unlock_irqrestore (&chan->lock, flags);p9_debug (P9_DEBUG_TRANS ,"virtio request kicked\n" ); - err =wait_event_interruptible (*req->wq, - req->status >=REQ_STATUS_RCVD ); + err =wait_event_killable (*req->wq, req->status >=REQ_STATUS_RCVD );/* * Non kernel buffers are pinned, unpin them */
Greg Kroah-Hartman
maintainerPATCH 87/138 PM / OPP: Add missing of_node_put(np)
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tobias Jordan <[email protected]>
commit 7978db344719dab1e56d05e6fc04aaaddcde0a5e upstream.
The for_each_available_child_of_node() loop in _of_add_opp_table_v2() doesn't drop the reference to "np" on errors. Fix that.
--- drivers/base/power/opp/of.c | 1 + 1 file changed, 1 insertion(+)
drivers/base/power/opp/of.c +1 -0
@@ -348,6 +348,7 @@ static int _of_add_opp_table_v2(struct dif (ret) {dev_err (dev,"%s: Failed to add OPP, %d\n" , __func__, ret); +of_node_put (np); goto free_table; } }
Greg Kroah-Hartman
maintainerPATCH 89/138 e1000e: Fix error path in link detection
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Poirier <[email protected]>
commit c4c40e51f9c32c6dd8adf606624c930a1c4d9bbb upstream.
In case of error from e1e_rphy(), the loop will exit early and "success" will be set to true erroneously.
--- drivers/net/ethernet/intel/e1000e/phy.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/net/ethernet/intel/e1000e/phy.c +4 -3
@@ -1744,6 +1744,7 @@ s32 e1000e_phy_has_link_generic(struct es32 ret_val =0 ;u16 i, phy_status; + *success = false;for (i =0 ; i < iterations; i++) {/* Some PHYs require the MII_BMSR register to be read * twice due to the link bit being sticky. No harm doing
@@ -1763,16 +1764,16 @@ s32 e1000e_phy_has_link_generic(struct e ret_val =e1e_rphy (hw,MII_BMSR , &phy_status);if (ret_val)break ; -if (phy_status &BMSR_LSTATUS ) +if (phy_status &BMSR_LSTATUS ) { + *success = true;break ; + }if (usec_interval >=1000 )msleep (usec_interval /1000 );else udelay (usec_interval); } - *success = (i < iterations); -return ret_val; }
Greg Kroah-Hartman
maintainerPATCH 90/138 e1000e: Fix return value test
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Poirier <[email protected]>
commit d3509f8bc7b0560044c15f0e3ecfde1d9af757a6 upstream.
All the helpers return -E1000_ERR_PHY.
--- drivers/net/ethernet/intel/e1000e/netdev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/intel/e1000e/netdev.c +1 -1
@@ -5074,7 +5074,7 @@ static bool e1000e_has_link(struct e1000break ; } -if ((ret_val ==E1000_ERR_PHY ) && (hw->phy.type == e1000_phy_igp_3) && +if ((ret_val == -E1000_ERR_PHY ) && (hw->phy.type == e1000_phy_igp_3) && (er32 (CTRL ) &E1000_PHY_CTRL_GBE_DISABLE )) {/* See e1000_kmrn_lock_loss_workaround_ich8lan() */ e_info ("Gigabit has been disabled, downgrading speed\n" );
Greg Kroah-Hartman
maintainerPATCH 91/138 e1000e: Separate signaling for link check/link up
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Poirier <[email protected]>
commit 19110cfbb34d4af0cdfe14cd243f3b09dc95b013 upstream.
Lennart reported the following race condition:
\ e1000_watchdog_task
\ e1000e_has_link
\ hw->mac.ops.check_for_link() === e1000e_check_for_copper_link
/* link is up */
mac->get_link_status = false;
/* interrupt */
\ e1000_msix_other
hw->mac.get_link_status = true;
link_active = !hw->mac.get_link_status
/* link_active is false, wrongly */This problem arises because the single flag get_link_status is used to signal two different states: link status needs checking and link status is down.
Avoid the problem by using the return value of .check_for_link to signal the link status to e1000e_has_link().
--- drivers/net/ethernet/intel/e1000e/mac.c | 11 ++++++++--- drivers/net/ethernet/intel/e1000e/netdev.c | 2 +- 2 files changed, 9 insertions(+), 4 deletions(-)
drivers/net/ethernet/intel/e1000e/mac.c +8 -3
@@ -410,6 +410,9 @@ void e1000e_clear_hw_cntrs_base(struct e* Checks to see of the link status of the hardware has changed. If a * change in link status has been detected, then we read the PHY registers * to get the current speed/duplex if link exists. +* +* Returns a negative error code (-E1000_ERR_*) or 0 (link down) or 1 (link +* up). **/ s32 e1000e_check_for_copper_link (struct e1000_hw *hw) {
@@ -423,7 +426,7 @@ s32 e1000e_check_for_copper_link(struct* Change or Rx Sequence Error interrupt. */ if (!mac->get_link_status) -return 0 ; +return 1 ;/* First we want to see if the MII Status Register reports * link. If so, then we want to get the current speed/duplex
@@ -461,10 +464,12 @@ s32 e1000e_check_for_copper_link(struct* different link partner. */ ret_val =e1000e_config_fc_after_link_up (hw); -if (ret_val) +if (ret_val) {e_dbg ("Error configuring flow control\n" ); +return ret_val; + } -return ret_val; +return 1 ; }/**
drivers/net/ethernet/intel/e1000e/netdev.c +1 -1
@@ -5056,7 +5056,7 @@ static bool e1000e_has_link(struct e1000case e1000_media_type_copper:if (hw->mac.get_link_status) { ret_val = hw->mac.ops.check_for_link (hw); - link_active = !hw->mac.get_link_status; + link_active = ret_val >0 ; }else { link_active = true; }
Greg Kroah-Hartman
maintainerPATCH 92/138 e1000e: Avoid receiver overrun interrupt bursts
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Poirier <[email protected]>
commit 4aea7a5c5e940c1723add439f4088844cd26196d upstream.
When e1000e_poll() is not fast enough to keep up with incoming traffic, the adapter (when operating in msix mode) raises the Other interrupt to signal Receiver Overrun.
This is a double problem because 1) at the moment e1000_msix_other() assumes that it is only called in case of Link Status Change and 2) if the condition persists, the interrupt is repeatedly raised again in quick succession.
Ideally we would configure the Other interrupt to not be raised in case of receiver overrun but this doesn't seem possible on this adapter. Instead, we handle the first part of the problem by reverting to the practice of reading ICR in the other interrupt handler, like before commit 16ecba59bc33 ("e1000e: Do not read ICR in Other interrupt"). Thanks to commit 0a8047ac68e5 ("e1000e: Fix msi-x interrupt automask") which cleared IAME from CTRL_EXT, reading ICR doesn't interfere with RxQ0, TxQ0 interrupts anymore. We handle the second part of the problem by not re-enabling the Other interrupt right away when there is overrun. Instead, we wait until traffic subsides, napi polling mode is exited and interrupts are re-enabled.
--- drivers/net/ethernet/intel/e1000e/defines.h | 1 drivers/net/ethernet/intel/e1000e/netdev.c | 31 +++++++++++++++++++++------- 2 files changed, 25 insertions(+), 7 deletions(-)
drivers/net/ethernet/intel/e1000e/defines.h +1 -0
@@ -398,6 +398,7 @@#define E1000_ICR_LSC 0x00000004/* Link Status Change */ #define E1000_ICR_RXSEQ 0x00000008/* Rx sequence error */ #define E1000_ICR_RXDMT0 0x00000010/* Rx desc min. threshold (0) */ +#define E1000_ICR_RXO 0x00000040/* Receiver Overrun */ #define E1000_ICR_RXT0 0x00000080/* Rx timer intr (ring 0) */ #define E1000_ICR_ECCER 0x00400000/* Uncorrectable ECC Error */ /* If this bit asserted, the driver should claim the interrupt */
drivers/net/ethernet/intel/e1000e/netdev.c +24 -7
@@ -1905,14 +1905,30 @@ static irqreturn_t e1000_msix_other(intstruct net_device *netdev = data;struct e1000_adapter *adapter =netdev_priv (netdev);struct e1000_hw *hw = &adapter->hw; +u32 icr; +bool enable = true; - hw->mac.get_link_status = true; + icr =er32 (ICR ); +if (icr &E1000_ICR_RXO ) { +ew32 (ICR ,E1000_ICR_RXO ); + enable = false; +/* napi poll will re-enable Other, make sure it runs */ +if (napi_schedule_prep (&adapter->napi)) { + adapter->total_rx_bytes =0 ; + adapter->total_rx_packets =0 ; +__napi_schedule (&adapter->napi); + } + } +if (icr &E1000_ICR_LSC ) { +ew32 (ICR ,E1000_ICR_LSC ); + hw->mac.get_link_status = true; +/* guard against interrupt when we're going down */ +if (!test_bit (__E1000_DOWN, &adapter->state)) +mod_timer (&adapter->watchdog_timer, jiffies +1 ); + } -/* guard against interrupt when we're going down */ -if (!test_bit (__E1000_DOWN, &adapter->state)) { -mod_timer (&adapter->watchdog_timer, jiffies +1 ); +if (enable && !test_bit (__E1000_DOWN, &adapter->state))ew32 (IMS ,E1000_IMS_OTHER ); - }return IRQ_HANDLED ; }
@@ -2683,7 +2699,8 @@ static int e1000e_poll(struct napi_strucnapi_complete_done (napi, work_done);if (!test_bit (__E1000_DOWN, &adapter->state)) {if (adapter->msix_entries) -ew32 (IMS , adapter->rx_ring->ims_val); +ew32 (IMS , adapter->rx_ring->ims_val | +E1000_IMS_OTHER );else e1000_irq_enable (adapter); }
@@ -4178,7 +4195,7 @@ static void e1000e_trigger_lsc(struct e1struct e1000_hw *hw = &adapter->hw;if (adapter->msix_entries) -ew32 (ICS ,E1000_ICS_OTHER ); +ew32 (ICS ,E1000_ICS_LSC |E1000_ICS_OTHER );else ew32 (ICS ,E1000_ICS_LSC ); }
Greg Kroah-Hartman
maintainerPATCH 93/138 RDS: make message size limit compliant with spec
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Avinash Repaka <[email protected]>
[ Upstream commit f9fb69adb6c7acca60977a4db5a5f95b8e66c041 ]
RDS support max message size as 1M but the code doesn't check this in all cases. Patch fixes it for RDMA & non-RDMA and RDS MR size and its enforced irrespective of underlying transport.
--- net/rds/rdma.c | 9 ++++++++- net/rds/rds.h | 3 +++ net/rds/send.c | 31 +++++++++++++++++++++++++++++++ 3 files changed, 42 insertions(+), 1 deletion(-)
net/rds/rdma.c +8 -1
@@ -40,7 +40,6 @@/* * XXX * - build with sparse -* - should we limit the size of a mr region? let transport return failure? * - should we detect duplicate keys on a socket? hmm. * - an rdma is an mlock, apply rlimit? */
@@ -200,6 +199,14 @@ static int __rds_rdma_map(struct rds_soc goto out; } +/* Restrict the size of mr irrespective of underlying transport +* To account for unaligned mr regions, subtract one from nr_pages +*/ +if ((nr_pages -1 ) > (RDS_MAX_MSG_SIZE >>PAGE_SHIFT )) { + ret = -EMSGSIZE ; + goto out; + } +rdsdebug ("RDS: get_mr addr %llx len %llu nr_pages %u\n" , args->vec.addr, args->vec.bytes, nr_pages);
net/rds/rds.h +3 -0
@@ -50,6 +50,9 @@ void rdsdebug(char *fmt, ...)#define RDS_FRAG_SHIFT 12#define RDS_FRAG_SIZE ((unsigned int)(1 << RDS_FRAG_SHIFT)) +/* Used to limit both RDMA and non-RDMA RDS message to 1MB */ +#define RDS_MAX_MSG_SIZE ((unsigned int)(1 << 20)) +#define RDS_CONG_MAP_BYTES (65536 / 8)#define RDS_CONG_MAP_PAGES (PAGE_ALIGN(RDS_CONG_MAP_BYTES) / PAGE_SIZE)#define RDS_CONG_MAP_PAGE_BITS (PAGE_SIZE * 8)
net/rds/send.c +31 -0
@@ -988,6 +988,26 @@ static int rds_send_mprds_hash(struct rdreturn hash; } +static int rds_rdma_bytes (struct msghdr *msg,size_t *rdma_bytes) +{ +struct rds_rdma_args *args; +struct cmsghdr *cmsg; + +for_each_cmsghdr (cmsg, msg) { +if (!CMSG_OK (msg, cmsg)) +return -EINVAL ; + +if (cmsg->cmsg_level !=SOL_RDS ) +continue ; + +if (cmsg->cmsg_type ==RDS_CMSG_RDMA_ARGS ) { + args =CMSG_DATA (cmsg); + *rdma_bytes += args->remote_vec.bytes; + } + } +return 0 ; +} +int rds_sendmsg (struct socket *sock,struct msghdr *msg,size_t payload_len) {struct sock *sk = sock->sk;
@@ -1002,6 +1022,7 @@ int rds_sendmsg(struct socket *sock, strint nonblock = msg->msg_flags &MSG_DONTWAIT ;long timeo =sock_sndtimeo (sk, nonblock);struct rds_conn_path *cpath; +size_t total_payload_len = payload_len, rdma_payload_len =0 ;/* Mirror Linux UDP mirror of BSD error message compatibility */ /* XXX: Perhaps MSG_MORE someday */
@@ -1034,6 +1055,16 @@ int rds_sendmsg(struct socket *sock, str }release_sock (sk); + ret =rds_rdma_bytes (msg, &rdma_payload_len); +if (ret) + goto out; + + total_payload_len += rdma_payload_len; +if (max_t (size_t, payload_len, rdma_payload_len) >RDS_MAX_MSG_SIZE ) { + ret = -EMSGSIZE ; + goto out; + } +if (payload_len >rds_sk_sndbuf (rs)) { ret = -EMSGSIZE ; goto out;
Greg Kroah-Hartman
maintainerPATCH 94/138 RDS: RDMA: return appropriate error on rdma map failures
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Santosh Shilimkar <[email protected]>
[ Upstream commit 584a8279a44a800dea5a5c1e9d53a002e03016b4 ]
The first message to a remote node should prompt a new connection even if it is RDMA operation. For RDMA operation the MR mapping can fail because connections is not yet up.
Since the connection establishment is asynchronous, we make sure the map failure because of unavailable connection reach to the user by appropriate error code. Before returning to the user, lets trigger the connection so that its ready for the next retry.
--- net/rds/send.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
net/rds/send.c +10 -1
@@ -946,6 +946,11 @@ static int rds_cmsg_send(struct rds_sock ret =rds_cmsg_rdma_map (rs, rm, cmsg);if (!ret) *allocated_mr =1 ; +else if (ret == -ENODEV ) +/* Accommodate the get_mr() case which can fail +* if connection isn't established yet. +*/ + ret = -EAGAIN ;break ;case RDS_CMSG_ATOMIC_CSWP :case RDS_CMSG_ATOMIC_FADD :
@@ -1114,8 +1119,12 @@ int rds_sendmsg(struct socket *sock, str/* Parse any control messages the user may have included. */ ret =rds_cmsg_send (rs, rm, msg, &allocated_mr); -if (ret) +if (ret) { +/* Trigger connection so that its ready for the next retry */ +if (ret == -EAGAIN ) +rds_conn_connect_if_down (conn); goto out; + }if (rm->rdma.op_active && !conn->c_trans->xmit_rdma) { printk_ratelimited(KERN_NOTICE "rdma_op %p conn xmit_rdma %p\n",
Greg Kroah-Hartman
maintainerPATCH 95/138 RDS: RDMA: fix the ib_map_mr_sg_zbva() argument
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Santosh Shilimkar <[email protected]>
[ Upstream commit 3e56c2f856d7aba6a03feea834d68f9c05f7d0b6 ]
Fixes warning: Using plain integer as NULL pointer
--- net/rds/ib_frmr.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
net/rds/ib_frmr.c +3 -2
@@ -104,14 +104,15 @@ static int rds_ib_post_reg_frmr(struct rstruct rds_ib_frmr *frmr = &ibmr->u.frmr;struct ib_send_wr *failed_wr;struct ib_reg_wr reg_wr; -int ret; +int ret, off =0 ;while (atomic_dec_return (&ibmr->ic->i_fastreg_wrs) <=0 ) {atomic_inc (&ibmr->ic->i_fastreg_wrs);cpu_relax (); } - ret =ib_map_mr_sg_zbva (frmr->mr, ibmr->sg, ibmr->sg_len,0 ,PAGE_SIZE ); + ret =ib_map_mr_sg_zbva (frmr->mr, ibmr->sg, ibmr->sg_len, + &off,PAGE_SIZE );if (unlikely (ret != ibmr->sg_len))return ret <0 ? ret : -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 96/138 PCI: Apply _HPX settings only to relevant devices
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bjorn Helgaas <[email protected]>
[ Upstream commit 977509f7c5c6fb992ffcdf4291051af343b91645 ]
Previously we didn't check the type of device before trying to apply Type 1 (PCI-X) or Type 2 (PCIe) Setting Records from _HPX.
We don't support PCI-X Setting Records, so this was harmless, but the warning was useless.
We do support PCIe Setting Records, and we didn't check whether a device was PCIe before applying settings. I don't think anything bad happened on non-PCIe devices because pcie_capability_clear_and_set_word(), pcie_cap_has_lnkctl(), etc., would fail before doing any harm. But it's ugly to depend on those internals.
Check the device type before attempting to apply Type 1 and Type 2 Setting Records (Type 0 records are applicable to PCI, PCI-X, and PCIe devices).
A side benefit is that this prevents useless "not supported" warnings when a BIOS supplies a Type 1 (PCI-X) Setting Record and we try to apply it to every single device:
pci 0000:00:00.0: PCI-X settings not supported
After this patch, we'll get the warning only when a BIOS supplies a Type 1 record and we have a PCI-X device to which it should be applied.
--- drivers/pci/probe.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-)
drivers/pci/probe.c +13 -2
@@ -1438,8 +1438,16 @@ static void program_hpp_type0(struct pcistatic void program_hpp_type1 (struct pci_dev *dev,struct hpp_type1 *hpp) { -if (hpp) -dev_warn (&dev->dev,"PCI-X settings not supported\n" ); +int pos; + +if (!hpp) +return ; + + pos =pci_find_capability (dev,PCI_CAP_ID_PCIX ); +if (!pos) +return ; + +dev_warn (&dev->dev,"PCI-X settings not supported\n" ); }static bool pcie_root_rcb_set (struct pci_dev *dev)
@@ -1465,6 +1473,9 @@ static void program_hpp_type2(struct pciif (!hpp)return ; +if (!pci_is_pcie (dev)) +return ; +if (hpp->revision >1 ) {dev_warn (&dev->dev,"PCIe settings rev %d not supported\n" , hpp->revision);
Greg Kroah-Hartman
maintainerPATCH 97/138 drm/sun4i: Fix a return value in case of error
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit 0f0861e31e3c59ca4bc1ec59d99260cfca79740e ]
If 'sun4i_backend_drm_format_to_layer()' does not return 0, then 'val' is left unmodified.
As it is not initialized either, the return value can be anything.
It is likely that returning the error code was expected here.
As the only caller of 'sun4i_backend_update_layer_formats()' does not check the return value, this fix is purely theorical.
--- drivers/gpu/drm/sun4i/sun4i_backend.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/sun4i/sun4i_backend.c +1 -1
@@ -172,7 +172,7 @@ int sun4i_backend_update_layer_formats(s ret =sun4i_backend_drm_format_to_layer (plane, fb->pixel_format, &val);if (ret) {DRM_DEBUG_DRIVER ("Invalid format\n" ); -return val; +return ret; } regmap_update_bits(backend->regs, SUN4I_BACKEND_ATTCTL_REG1(layer),
Greg Kroah-Hartman
maintainerPATCH 98/138 clk: sunxi-ng: A31: Fix spdif clock register
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marcus Cooper <[email protected]>
[ Upstream commit 70421257c068b91476e70cade15fca68045d0693 ]
As the SPDIF was rarely documented on the earlier Allwinner SoCs it was assumed that it had a similar clock register to the one described in the H3 User Manual.
However this is not the case and it looks to shares the same setup as the I2S clock registers.
--- drivers/clk/sunxi-ng/ccu-sun6i-a31.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/clk/sunxi-ng/ccu-sun6i-a31.c +2 -2
@@ -468,8 +468,8 @@ static SUNXI_CCU_MUX_WITH_GATE(daudio0_c static SUNXI_CCU_MUX_WITH_GATE(daudio1_clk, "daudio1", daudio_parents, 0x0b4, 16, 2, BIT(31), CLK_SET_RATE_PARENT); -static SUNXI_CCU_M_WITH_GATE(spdif_clk, "spdif", "pll-audio", - 0x0c0, 0, 4, BIT(31), CLK_SET_RATE_PARENT); +static SUNXI_CCU_MUX_WITH_GATE(spdif_clk, "spdif", daudio_parents, + 0x0c0, 16, 2, BIT(31), CLK_SET_RATE_PARENT); static SUNXI_CCU_GATE(usb_phy0_clk, "usb-phy0", "osc24M", 0x0cc, BIT(8), 0);
Greg Kroah-Hartman
maintainerPATCH 99/138 clk: sunxi-ng: fix PLL_CPUX adjusting on A33
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Icenowy Zheng <[email protected]>
[ Upstream commit 790d929b540661945d1c70652ffb602c5c06ad85 ]
When adjusting PLL_CPUX on A33, the PLL is temporarily driven too high, and the system hangs.
Add a notifier to avoid this situation by temporarily switching to a known stable 24 MHz oscillator.
--- drivers/clk/sunxi-ng/ccu-sun8i-a33.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/clk/sunxi-ng/ccu-sun8i-a33.c +10 -0
@@ -752,6 +752,13 @@ static const struct sunxi_ccu_desc sun8i .num_resets = ARRAY_SIZE(sun8i_a33_ccu_resets), }; +static struct ccu_mux_nb sun8i_a33_cpu_nb = { + .common = &cpux_clk.common, + .cm = &cpux_clk.mux, + .delay_us =1 ,/* > 8 clock cycles at 24 MHz */ + .bypass_index =1 ,/* index of 24 MHz oscillator */ +}; +static void __init sun8i_a33_ccu_setup (struct device_node *node) {void __iomem *reg;
@@ -775,6 +782,9 @@ static void __init sun8i_a33_ccu_setup(swritel (val, reg +SUN8I_A33_PLL_MIPI_REG );sunxi_ccu_probe (node, reg, &sun8i_a33_ccu_desc); + +ccu_mux_notifier_register (pll_cpux_clk.common.hw.clk, + &sun8i_a33_cpu_nb); }CLK_OF_DECLARE (sun8i_a33_ccu,"allwinner,sun8i-a33-ccu" , sun8i_a33_ccu_setup);
Greg Kroah-Hartman
maintainerPATCH 100/138 dmaengine: zx: set DMA_CYCLIC cap_mask bit
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shawn Guo <[email protected]>
[ Upstream commit fc318d64f3d91e15babac00e08354b1beb650b57 ]
The zx_dma driver supports cyclic transfer mode. Let's set DMA_CYCLIC cap_mask bit to make that clear, and avoid unnecessary failure when clients request channel via dma_request_chan_by_mask() with DMA_CYCLIC bit set in mask.
--- drivers/dma/zx296702_dma.c | 1 + 1 file changed, 1 insertion(+)
drivers/dma/zx296702_dma.c +1 -0
@@ -813,6 +813,7 @@ static int zx_dma_probe(struct platform_INIT_LIST_HEAD (&d->slave.channels);dma_cap_set (DMA_SLAVE , d->slave.cap_mask);dma_cap_set (DMA_MEMCPY , d->slave.cap_mask); +dma_cap_set (DMA_CYCLIC , d->slave.cap_mask);dma_cap_set (DMA_PRIVATE , d->slave.cap_mask); d->slave.dev = &op->dev; d->slave.device_free_chan_resources = zx_dma_free_chan_resources;
Greg Kroah-Hartman
maintainerPATCH 101/138 fscrypt: use ENOKEY when file cannot be created w/o key
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
[ Upstream commit 54475f531bb8d7078f63c159e5e0615d486c498c ]
As part of an effort to clean up fscrypt-related error codes, make attempting to create a file in an encrypted directory that hasn't been "unlocked" fail with ENOKEY. Previously, several error codes were used for this case, including ENOENT, EACCES, and EPERM, and they were not consistent between and within filesystems. ENOKEY is a better choice because it expresses that the failure is due to lacking the encryption key. It also matches the error code returned when trying to open an encrypted regular file without the key.
I am not aware of any users who might be relying on the previous inconsistent error codes, which were never documented anywhere.
This failure case will be exercised by an xfstest.
--- fs/crypto/fname.c | 4 ++-- fs/ext4/ialloc.c | 2 +- fs/ext4/namei.c | 4 +++- fs/f2fs/dir.c | 5 ++++- fs/f2fs/namei.c | 4 ++-- 5 files changed, 12 insertions(+), 7 deletions(-)
fs/crypto/fname.c +2 -2
@@ -332,7 +332,7 @@ int fscrypt_fname_usr_to_disk(struct ino* in a directory. Consequently, a user space name cannot be mapped to * a disk-space name */ -return -EACCES ; +return -ENOKEY ; }EXPORT_SYMBOL (fscrypt_fname_usr_to_disk);
@@ -367,7 +367,7 @@ int fscrypt_setup_filename(struct inodereturn 0 ; }if (!lookup) -return -EACCES ; +return -ENOKEY ;/* * We don't have the key and we are doing a lookup; decode the
fs/ext4/ialloc.c +1 -1
@@ -771,7 +771,7 @@ struct inode *__ext4_new_inode(handle_tif (err)return ERR_PTR (err);if (!fscrypt_has_encryption_key (dir)) -return ERR_PTR (-EPERM ); +return ERR_PTR (-ENOKEY );if (!handle) nblocks +=EXT4_DATA_TRANS_BLOCKS (dir->i_sb); encrypt =1 ;
fs/ext4/namei.c +3 -1
@@ -1378,6 +1378,8 @@ static struct buffer_head * ext4_find_enreturn NULL ; retval =ext4_fname_setup_filename (dir, d_name,1 , &fname); +if (retval == -ENOENT ) +return NULL ;if (retval)return ERR_PTR (retval);
@@ -3090,7 +3092,7 @@ static int ext4_symlink(struct inode *diif (err)return err;if (!fscrypt_has_encryption_key (dir)) -return -EPERM ; +return -ENOKEY ; disk_link.len = (fscrypt_fname_encrypted_size (dir, len) +sizeof (struct fscrypt_symlink_data )); sd =kzalloc (disk_link.len,GFP_KERNEL );
fs/f2fs/dir.c +4 -1
@@ -277,7 +277,10 @@ struct f2fs_dir_entry *f2fs_find_entry(s err =fscrypt_setup_filename (dir, child,1 , &fname);if (err) { - *res_page =ERR_PTR (err); +if (err == -ENOENT ) + *res_page =NULL ; +else + *res_page =ERR_PTR (err);return NULL ; }
fs/f2fs/namei.c +2 -2
@@ -403,7 +403,7 @@ static int f2fs_symlink(struct inode *direturn err;if (!fscrypt_has_encryption_key (dir)) -return -EPERM ; +return -ENOKEY ; disk_link.len = (fscrypt_fname_encrypted_size (dir, len) +sizeof (struct fscrypt_symlink_data ));
@@ -447,7 +447,7 @@ static int f2fs_symlink(struct inode *di goto err_out;if (!fscrypt_has_encryption_key (inode)) { - err = -EPERM ; + err = -ENOKEY ; goto err_out; }
Greg Kroah-Hartman
maintainerPATCH 102/138 fscrypt: use ENOTDIR when setting encryption policy on nondirectory
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
[ Upstream commit dffd0cfa06d4ed83bb3ae8eb067989ceec5d18e1 ]
As part of an effort to clean up fscrypt-related error codes, make FS_IOC_SET_ENCRYPTION_POLICY fail with ENOTDIR when the file descriptor does not refer to a directory. This is more descriptive than EINVAL, which was ambiguous with some of the other error cases.
I am not aware of any users who might be relying on the previous error code of EINVAL, which was never documented anywhere, and in some buggy kernels did not exist at all as the S_ISDIR() check was missing.
This failure case will be exercised by an xfstest.
--- fs/crypto/policy.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/crypto/policy.c +1 -1
@@ -113,7 +113,7 @@ int fscrypt_process_policy(struct file *if (!inode_has_encryption_context (inode)) {if (!S_ISDIR (inode->i_mode)) - ret = -EINVAL ; + ret = -ENOTDIR ;else if (!inode->i_sb->s_cop->empty_dir) ret = -EOPNOTSUPP ;else if (!inode->i_sb->s_cop->empty_dir (inode))
Greg Kroah-Hartman
maintainerPATCH 103/138 net: Allow IP_MULTICAST_IF to set index to L3 slave
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Ahern <[email protected]>
[ Upstream commit 7bb387c5ab12aeac3d5eea28686489ff46b53ca9 ]
IP_MULTICAST_IF fails if sk_bound_dev_if is already set and the new index does not match it. e.g.,
ntpd[15381]: setsockopt IP_MULTICAST_IF 192.168.1.23 fails: Invalid argument
Relax the check in setsockopt to allow setting mc_index to an L3 slave if sk_bound_dev_if points to an L3 master.
Make a similar change for IPv6. In this case change the device lookup to take the rcu_read_lock avoiding a refcnt. The rcu lock is also needed for the lookup of a potential L3 master device.
This really only silences a setsockopt failure since uses of mc_index are secondary to sk_bound_dev_if if it is set. In both cases, if either index is an L3 slave or master, lookups are directed to the same FIB table so relaxing the check at setsockopt time causes no harm.
Patch is based on a suggested change by Darwin for a problem noted in their code base.
--- net/ipv4/ip_sockglue.c | 7 ++++++- net/ipv6/ipv6_sockglue.c | 16 ++++++++++++---- 2 files changed, 18 insertions(+), 5 deletions(-)
net/ipv4/ip_sockglue.c +6 -1
@@ -819,6 +819,7 @@ static int do_ip_setsockopt(struct sock {struct ip_mreqn mreq;struct net_device *dev =NULL ; +int midx;if (sk->sk_type ==SOCK_STREAM ) goto e_inval;
@@ -863,11 +864,15 @@ static int do_ip_setsockopt(struct sock err = -EADDRNOTAVAIL ;if (!dev)break ; + + midx =l3mdev_master_ifindex (dev); +dev_put (dev); err = -EINVAL ;if (sk->sk_bound_dev_if && - mreq.imr_ifindex != sk->sk_bound_dev_if) + mreq.imr_ifindex != sk->sk_bound_dev_if && + (!midx || midx != sk->sk_bound_dev_if))break ; inet->mc_index = mreq.imr_ifindex;
net/ipv6/ipv6_sockglue.c +12 -4
@@ -585,16 +585,24 @@ done:if (val) {struct net_device *dev; +int midx; -if (sk->sk_bound_dev_if && sk->sk_bound_dev_if != val) - goto e_inval; +rcu_read_lock (); - dev =dev_get_by_index (net, val); + dev =dev_get_by_index_rcu (net, val);if (!dev) { +rcu_read_unlock (); retv = -ENODEV ;break ; } -dev_put (dev); + midx =l3mdev_master_ifindex_rcu (dev); + +rcu_read_unlock (); + +if (sk->sk_bound_dev_if && + sk->sk_bound_dev_if != val && + (!midx || midx != sk->sk_bound_dev_if)) + goto e_inval; } np->mcast_oif = val; retv =0 ;
Greg Kroah-Hartman
maintainerPATCH 104/138 net: 3com: typhoon: typhoon_init_one: make return values more specific
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Preisner <[email protected]>
[ Upstream commit 6b6bbb5922a4b1d4b58125a572da91010295fba3 ]
In some cases the return value of a failing function is not being used and the function typhoon_init_one() returns another negative error code instead.
--- drivers/net/ethernet/3com/typhoon.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/net/ethernet/3com/typhoon.c +8 -8
@@ -2366,9 +2366,9 @@ typhoon_init_one(struct pci_dev *pdev, c* 4) Get the hardware address. * 5) Put the card to sleep. */ -if (typhoon_reset (ioaddr, WaitSleep) <0 ) { + err =typhoon_reset (ioaddr, WaitSleep); +if (err <0 ) { err_msg ="could not reset 3XP" ; - err = -EIO ; goto error_out_dma; }
@@ -2382,16 +2382,16 @@ typhoon_init_one(struct pci_dev *pdev, ctyphoon_init_interface (tp);typhoon_init_rings (tp); -if (typhoon_boot_3XP (tp,TYPHOON_STATUS_WAITING_FOR_HOST ) <0 ) { + err =typhoon_boot_3XP (tp,TYPHOON_STATUS_WAITING_FOR_HOST ); +if (err <0 ) { err_msg ="cannot boot 3XP sleep image" ; - err = -EIO ; goto error_out_reset; }INIT_COMMAND_WITH_RESPONSE (&xp_cmd,TYPHOON_CMD_READ_MAC_ADDRESS ); -if (typhoon_issue_command (tp,1 , &xp_cmd,1 , xp_resp) <0 ) { + err =typhoon_issue_command (tp,1 , &xp_cmd,1 , xp_resp); +if (err <0 ) { err_msg ="cannot read MAC address" ; - err = -EIO ; goto error_out_reset; }
@@ -2424,9 +2424,9 @@ typhoon_init_one(struct pci_dev *pdev, cif (xp_resp[0 ].numDesc !=0 ) tp->capabilities |=TYPHOON_WAKEUP_NEEDS_RESET ; -if (typhoon_sleep (tp, PCI_D3hot,0 ) <0 ) { + err =typhoon_sleep (tp, PCI_D3hot,0 ); +if (err <0 ) { err_msg ="cannot put adapter to sleep" ; - err = -EIO ; goto error_out_reset; }
Greg Kroah-Hartman
maintainerPATCH 105/138 net: 3com: typhoon: typhoon_init_one: fix incorrect return values
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Preisner <[email protected]>
[ Upstream commit 107fded7bf616ad6f46823d98b8ed6405d7adf2d ]
In a few cases the err-variable is not set to a negative error code if a function call in typhoon_init_one() fails and thus 0 is returned instead.
It may be better to set err to the appropriate negative error code before returning.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=188841
--- drivers/net/ethernet/3com/typhoon.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/net/ethernet/3com/typhoon.c +6 -3
@@ -2398,8 +2398,9 @@ typhoon_init_one(struct pci_dev *pdev, c *(__be16 *)&dev->dev_addr[0 ] =htons (le16_to_cpu (xp_resp[0 ].parm1)); *(__be32 *)&dev->dev_addr[2 ] =htonl (le32_to_cpu (xp_resp[0 ].parm2)); -if (!is_valid_ether_addr (dev->dev_addr)) { +if (!is_valid_ether_addr (dev->dev_addr)) { err_msg ="Could not obtain valid ethernet address, aborting" ; + err = -EIO ; goto error_out_reset; }
@@ -2407,7 +2408,8 @@ typhoon_init_one(struct pci_dev *pdev, c* later when we print out the version reported. */ INIT_COMMAND_WITH_RESPONSE (&xp_cmd,TYPHOON_CMD_READ_VERSIONS ); -if (typhoon_issue_command (tp,1 , &xp_cmd,3 , xp_resp) <0 ) { + err =typhoon_issue_command (tp,1 , &xp_cmd,3 , xp_resp); +if (err <0 ) { err_msg ="Could not get Sleep Image version" ; goto error_out_reset; }
@@ -2449,7 +2451,8 @@ typhoon_init_one(struct pci_dev *pdev, c dev->features = dev->hw_features |NETIF_F_HW_VLAN_CTAG_RX |NETIF_F_RXCSUM ; -if (register_netdev (dev) <0 ) { + err =register_netdev (dev); +if (err <0 ) { err_msg ="unable to register netdev" ; goto error_out_reset; }
Greg Kroah-Hartman
maintainerPATCH 106/138 drm/armada: Fix compile fail
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Vetter <[email protected]>
[ Upstream commit 7357f89954b6d005df6ab8929759e78d7d9a80f9 ]
I reported the include issue for tracepoints a while ago, but nothing seems to have happened. Now it bit us, since the drm_mm_print conversion was broken for armada. Fix it, so I can re-enable armada in the drm-misc build configs.
v2: Rebase just the compile fix on top of Chris' build fix.
Cc: Russell King <[email protected]>
Cc: Chris Wilson <[email protected]>
Acked: Chris Wilson <[email protected]>
--- drivers/gpu/drm/armada/Makefile | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/armada/Makefile +2 -0
@@ -4,3 +4,5 @@ armada-y += armada_510.o armada-$(CONFIG_DEBUG_FS) += armada_debugfs.o obj-$(CONFIG_DRM_ARMADA) := armada.o + +CFLAGS_armada_trace.o := -I$(src)
Greg Kroah-Hartman
maintainerPATCH 107/138 rt2800: set minimum MPDU and PSDU lengths to sane values
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanislaw Gruszka <[email protected]>
[ Upstream commit a51b89698ccc93c7e274eb71377fae49c4593ab2 ]
--- drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/ralink/rt2x00/rt2800lib.c +2 -2
@@ -4707,8 +4707,8 @@ static int rt2800_init_registers(structrt2x00_set_field32 (®,MAX_LEN_CFG_MAX_PSDU ,2 ); else rt2x00_set_field32(®, MAX_LEN_CFG_MAX_PSDU, 1); - rt2x00_set_field32(®, MAX_LEN_CFG_MIN_PSDU, 0); - rt2x00_set_field32(®, MAX_LEN_CFG_MIN_MPDU, 0); + rt2x00_set_field32(®, MAX_LEN_CFG_MIN_PSDU, 10); + rt2x00_set_field32(®, MAX_LEN_CFG_MIN_MPDU, 10); rt2800_register_write(rt2x00dev, MAX_LEN_CFG, reg); rt2800_register_read(rt2x00dev, LED_CFG, ®);
Greg Kroah-Hartman
maintainerPATCH 108/138 adm80211: return an error if adm8211_alloc_rings() fails
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit c705a6b3aa7804d7bc6660183f51e510c61dc807 ]
We accidentally return success when adm8211_alloc_rings() fails but we should preserve the error code.
--- drivers/net/wireless/admtek/adm8211.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/wireless/admtek/adm8211.c +2 -1
@@ -1843,7 +1843,8 @@ static int adm8211_probe(struct pci_dev priv->rx_ring_size = rx_ring_size; priv->tx_ring_size = tx_ring_size; -if (adm8211_alloc_rings (dev)) { + err =adm8211_alloc_rings (dev); +if (err) {printk (KERN_ERR "%s (adm8211): Cannot allocate TX/RX ring\n" ,pci_name (pdev)); goto err_iounmap;
Greg Kroah-Hartman
maintainerPATCH 109/138 mwifiex: sdio: fix use after free issue for save_adapter
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amitkumar Karwar <[email protected]>
[ Upstream commit 74c8719b8ee0922593a5cbec0bd6127d86d8a2f4 ]
If we have sdio work requests received when sdio card reset is happening, we may end up accessing older save_adapter pointer later which is already freed during card reset.
This patch solves the problem by cancelling those pending requests.
--- drivers/net/wireless/marvell/mwifiex/sdio.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/net/wireless/marvell/mwifiex/sdio.c +6 -0
@@ -2296,6 +2296,12 @@ static void mwifiex_recreate_adapter(strmmc_hw_reset (func->card->host);sdio_release_host (func); +/* Previous save_adapter won't be valid after this. We will cancel +* pending work requests. +*/ +clear_bit (MWIFIEX_IFACE_WORK_DEVICE_DUMP , &iface_work_flags); +clear_bit (MWIFIEX_IFACE_WORK_CARD_RESET , &iface_work_flags); +mwifiex_sdio_probe (func, device_id); }
Greg Kroah-Hartman
maintainerPATCH 110/138 ath10k: fix incorrect txpower set by P2P_DEVICE interface
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryan Hsu <[email protected]>
[ Upstream commit 88407beb1b1462f706a1950a355fd086e1c450b6 ]
Ath10k reports the phy capability that supports P2P_DEVICE interface.
When we use the P2P supported wpa_supplicant to start connection, it'll create two interfaces, one is wlan0 (vdev_id=0) and one is P2P_DEVICE p2p-dev-wlan0 which is for p2p control channel (vdev_id=1).
ath10k_pci mac vdev create 0 (add interface) type 2 subtype 0 ath10k_add_interface: vdev_id: 0, txpower: 0, bss_power: 0 ... ath10k_pci mac vdev create 1 (add interface) type 2 subtype 1 ath10k_add_interface: vdev_id: 1, txpower: 0, bss_power: 0
And the txpower in per vif bss_conf will only be set to valid tx power when the interface is assigned with channel_ctx.
But this P2P_DEVICE interface will never be used for any connection, so that the uninitialized bss_conf.txpower=0 is assinged to the arvif->txpower when interface created.
Since the txpower configuration is firmware per physical interface. So the smallest txpower of all vifs will be the one limit the tx power of the physical device, that causing the low txpower issue on other active interfaces.
wlan0: Limiting TX power to 21 (24 - 3) dBm ath10k_pci mac vdev_id 0 txpower 21
ath10k_mac_txpower_recalc: vdev_id: 1, txpower: 0
ath10k_mac_txpower_recalc: vdev_id: 0, txpower: 21 ath10k_pci mac txpower 0
This issue only happens when we use the wpa_supplicant that supports P2P or if we use the iw tool to create the control P2P_DEVICE interface.
--- drivers/net/wireless/ath/ath10k/mac.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/net/wireless/ath/ath10k/mac.c +4 -3
@@ -4668,7 +4668,8 @@ static int ath10k_mac_txpower_recalc(strlockdep_assert_held (&ar->conf_mutex);list_for_each_entry (arvif, &ar->arvifs, list) { -WARN_ON (arvif->txpower <0 ); +if (arvif->txpower <=0 ) +continue ;if (txpower ==-1 ) txpower = arvif->txpower;
@@ -4676,8 +4677,8 @@ static int ath10k_mac_txpower_recalc(str txpower =min (txpower, arvif->txpower); } -if (WARN_ON (txpower ==-1 )) -return -EINVAL ; +if (txpower ==-1 ) +return 0 ; ret =ath10k_mac_txpower_setup (ar, txpower);if (ret) {
Greg Kroah-Hartman
maintainerPATCH 111/138 ath10k: ignore configuring the incorrect board_id
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryan Hsu <[email protected]>
[ Upstream commit d2e202c06ca42d353d95df12437740921a6d05b5 ]
With command to get board_id from otp, in the case of following
boot get otp board id result 0x00000000 board_id 0 chip_id 0 boot using board name 'bus=pci,bmi-chip-id=0,bmi-board-id=0"
...
failed to fetch board data for bus=pci,bmi-chip-id=0,bmi-board-id=0 from ath10k/QCA6174/hw3.0/board-2.bin
The invalid board_id=0 will be used as index to search in the board-2.bin.
Ignore the case with board_id=0, as it means the otp is not carrying the board id information.
--- drivers/net/wireless/ath/ath10k/core.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/wireless/ath/ath10k/core.c +4 -1
@@ -691,8 +691,11 @@ static int ath10k_core_get_board_id_from"boot get otp board id result 0x%08x board_id %d chip_id %d\n" , result, board_id, chip_id); -if ((result &ATH10K_BMI_BOARD_ID_STATUS_MASK ) !=0 ) +if ((result &ATH10K_BMI_BOARD_ID_STATUS_MASK ) !=0 || + (board_id ==0 )) { +ath10k_warn (ar,"board id is not exist in otp, ignore it\n" );return -EOPNOTSUPP ; + } ar->id.bmi_ids_valid = true; ar->id.bmi_board_id = board_id;
Greg Kroah-Hartman
maintainerPATCH 112/138 ath10k: fix potential memory leak in ath10k_wmi_tlv_op_pull_fw_stats()
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Lamparter <[email protected]>
[ Upstream commit 097e46d2ae90265d1afe141ba6208ba598b79e01 ]
ath10k_wmi_tlv_op_pull_fw_stats() uses tb = ath10k_wmi_tlv_parse_alloc(...) function, which allocates memory. If any of the three error-paths are taken, this tb needs to be freed.
--- drivers/net/wireless/ath/ath10k/wmi-tlv.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
drivers/net/wireless/ath/ath10k/wmi-tlv.c +9 -3
@@ -1105,8 +1105,10 @@ static int ath10k_wmi_tlv_op_pull_fw_stastruct ath10k_fw_stats_pdev *dst; src = data; -if (data_len <sizeof (*src)) +if (data_len <sizeof (*src)) { +kfree (tb);return -EPROTO ; + } data +=sizeof (*src); data_len -=sizeof (*src);
@@ -1126,8 +1128,10 @@ static int ath10k_wmi_tlv_op_pull_fw_stastruct ath10k_fw_stats_vdev *dst; src = data; -if (data_len <sizeof (*src)) +if (data_len <sizeof (*src)) { +kfree (tb);return -EPROTO ; + } data +=sizeof (*src); data_len -=sizeof (*src);
@@ -1145,8 +1149,10 @@ static int ath10k_wmi_tlv_op_pull_fw_stastruct ath10k_fw_stats_peer *dst; src = data; -if (data_len <sizeof (*src)) +if (data_len <sizeof (*src)) { +kfree (tb);return -EPROTO ; + } data +=sizeof (*src); data_len -=sizeof (*src);
Greg Kroah-Hartman
maintainerPATCH 113/138 pinctrl: sirf: atlas7: Add missing of_node_put()
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit 7af355e6715b325d8af29822f4c3dbecd7eeebec ]
Reference to 'sys2pci_np' should be dropped in all cases here, not only in error handling path.
--- drivers/pinctrl/sirf/pinctrl-atlas7.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/pinctrl/sirf/pinctrl-atlas7.c +4 -3
@@ -5420,14 +5420,15 @@ static int atlas7_pinmux_probe(struct pl sys2pci_np =of_find_node_by_name (NULL ,"sys2pci" );if (!sys2pci_np)return -EINVAL ; + ret =of_address_to_resource (sys2pci_np,0 , &res); +of_node_put (sys2pci_np);if (ret)return ret; + pmx->sys2pci_base =devm_ioremap_resource (&pdev->dev, &res); -if (IS_ERR (pmx->sys2pci_base)) { -of_node_put (sys2pci_np); +if (IS_ERR (pmx->sys2pci_base))return -ENOMEM ; - } pmx->dev = &pdev->dev;
Greg Kroah-Hartman
maintainerPATCH 114/138 bnxt_en: Set default completion ring for async events.
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Chan <[email protected]>
[ Upstream commit 486b5c22ea1d35e00e90dd79a32a9ee530b18915 ]
With the added support for the bnxt_re RDMA driver, both drivers can be allocating completion rings in any order. The firmware does not know which completion ring should be receiving async events. Add an extra step to tell firmware the completion ring number for receiving async events after bnxt_en allocates the completion rings.
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +30 -0
@@ -3800,6 +3800,30 @@ static int hwrm_ring_alloc_send_msg(strureturn rc; } +static int bnxt_hwrm_set_async_event_cr (struct bnxt *bp,int idx) +{ +int rc; + +if (BNXT_PF (bp)) { +struct hwrm_func_cfg_input req = {0 }; + +bnxt_hwrm_cmd_hdr_init (bp, &req,HWRM_FUNC_CFG ,-1 ,-1 ); + req.fid =cpu_to_le16 (0xffff ); + req.enables =cpu_to_le32 (FUNC_CFG_REQ_ENABLES_ASYNC_EVENT_CR ); + req.async_event_cr =cpu_to_le16 (idx); + rc =hwrm_send_message (bp, &req,sizeof (req),HWRM_CMD_TIMEOUT ); + }else { +struct hwrm_func_vf_cfg_input req = {0 }; + +bnxt_hwrm_cmd_hdr_init (bp, &req,HWRM_FUNC_VF_CFG ,-1 ,-1 ); + req.enables = +cpu_to_le32 (FUNC_VF_CFG_REQ_ENABLES_ASYNC_EVENT_CR ); + req.async_event_cr =cpu_to_le16 (idx); + rc =hwrm_send_message (bp, &req,sizeof (req),HWRM_CMD_TIMEOUT ); + } +return rc; +} +static int bnxt_hwrm_ring_alloc (struct bnxt *bp) {int i, rc =0 ;
@@ -3816,6 +3840,12 @@ static int bnxt_hwrm_ring_alloc(struct b goto err_out;BNXT_CP_DB (cpr->cp_doorbell, cpr->cp_raw_cons); bp->grp_info[i].cp_fw_ring_id = ring->fw_ring_id; + +if (!i) { + rc =bnxt_hwrm_set_async_event_cr (bp, ring->fw_ring_id); +if (rc) +netdev_warn (bp->dev,"Failed to set async event completion ring.\n" ); + } }for (i =0 ; i < bp->tx_nr_rings; i++) {
Greg Kroah-Hartman
maintainerPATCH 115/138 ath10k: set CTS protection VDEV param only if VDEV is up
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartosz Markowski <[email protected]>
[ Upstream commit 7cfe0455ee1218add152e986b89b4bb8dbeafcdd ]
The cts protection vdev parameter, in new QCA9377 TF2.0 firmware, requires bss peer to be created for the STATION vdev type.
bss peer is being allocated by the firmware after vdev_start/_up commands. mac80211 may call the cts protection setup at any time, so the we needs to track the situation and defer the cts configuration to prevent firmware asserts, like below:
[00]: 0x05020001 0x000015B3 0x0099ACE2 0x00955B31
[04]: 0x0099ACE2 0x00060730 0x00000004 0x00000000
[08]: 0x0044C754 0x00412C10 0x00000000 0x00409C54
[12]: 0x00000009 0x00000000 0x00952F6C 0x00952F77
[16]: 0x00952CC4 0x00910712 0x00000000 0x00000000
[20]: 0x4099ACE2 0x0040E858 0x00421254 0x004127F4
[24]: 0x8099B9B2 0x0040E8B8 0x00000000 0xC099ACE2
[28]: 0x800B75CB 0x0040E8F8 0x00000007 0x00005008
[32]: 0x809B048A 0x0040E958 0x00000010 0x00433B10
[36]: 0x809AFBBC 0x0040E9A8 0x0042BB74 0x0042BBBC
[40]: 0x8091D252 0x0040E9C8 0x0042BBBC 0x00000001
[44]: 0x809FFA45 0x0040EA78 0x0043D3E4 0x0042C2C8
[48]: 0x809FCEF4 0x0040EA98 0x0043D3E4 0x00000001
[52]: 0x80911210 0x0040EAE8 0x00000010 0x004041D0
[56]: 0x80911154 0x0040EB28 0x00400000 0x00000000
--- drivers/net/wireless/ath/ath10k/mac.c | 51 ++++++++++++++++++++++++++++------ 1 file changed, 43 insertions(+), 8 deletions(-)
drivers/net/wireless/ath/ath10k/mac.c +43 -8
@@ -1224,6 +1224,36 @@ static int ath10k_monitor_recalc(structreturn ath10k_monitor_stop (ar); } +static bool ath10k_mac_can_set_cts_prot (struct ath10k_vif *arvif) +{ +struct ath10k *ar = arvif->ar; + +lockdep_assert_held (&ar->conf_mutex); + +if (!arvif->is_started) { +ath10k_dbg (ar,ATH10K_DBG_MAC ,"defer cts setup, vdev is not ready yet\n" ); +return false; + } + +return true; +} + +static int ath10k_mac_set_cts_prot (struct ath10k_vif *arvif) +{ +struct ath10k *ar = arvif->ar; +u32 vdev_param; + +lockdep_assert_held (&ar->conf_mutex); + + vdev_param = ar->wmi.vdev_param->protection_mode; + +ath10k_dbg (ar,ATH10K_DBG_MAC ,"mac vdev %d cts_protection %d\n" , + arvif->vdev_id, arvif->use_cts_prot); + +return ath10k_wmi_vdev_set_param (ar, arvif->vdev_id, vdev_param, + arvif->use_cts_prot ?1 :0 ); +} +static int ath10k_recalc_rtscts_prot (struct ath10k_vif *arvif) {struct ath10k *ar = arvif->ar;
@@ -5322,20 +5352,18 @@ static void ath10k_bss_info_changed(struif (changed &BSS_CHANGED_ERP_CTS_PROT ) { arvif->use_cts_prot = info->use_cts_prot; -ath10k_dbg (ar,ATH10K_DBG_MAC ,"mac vdev %d cts_prot %d\n" , - arvif->vdev_id, info->use_cts_prot); ret =ath10k_recalc_rtscts_prot (arvif);if (ret)ath10k_warn (ar,"failed to recalculate rts/cts prot for vdev %d: %d\n" , arvif->vdev_id, ret); - vdev_param = ar->wmi.vdev_param->protection_mode; - ret =ath10k_wmi_vdev_set_param (ar, arvif->vdev_id, vdev_param, - info->use_cts_prot ?1 :0 ); -if (ret) -ath10k_warn (ar,"failed to set protection mode %d on vdev %i: %d\n" , - info->use_cts_prot, arvif->vdev_id, ret); +if (ath10k_mac_can_set_cts_prot (arvif)) { + ret =ath10k_mac_set_cts_prot (arvif); +if (ret) +ath10k_warn (ar,"failed to set cts protection for vdev %d: %d\n" , + arvif->vdev_id, ret); + } }if (changed &BSS_CHANGED_ERP_SLOT ) {
@@ -7356,6 +7384,13 @@ ath10k_mac_op_assign_vif_chanctx(struct arvif->is_up = true; } +if (ath10k_mac_can_set_cts_prot (arvif)) { + ret =ath10k_mac_set_cts_prot (arvif); +if (ret) +ath10k_warn (ar,"failed to set cts protection for vdev %d: %d\n" , + arvif->vdev_id, ret); + } +mutex_unlock (&ar->conf_mutex);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 116/138 ALSA: hda - Apply ALC269_FIXUP_NO_SHUTUP on HDA_FIXUP_ACT_PROBE
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gabriele Mazzotta <[email protected]>
[ Upstream commit 972aa2c708703c21f14eb958b37e82aae2530e44 ]
Setting shutup when the action is HDA_FIXUP_ACT_PRE_PROBE might not have the desired effect since it could be overridden by another more generic shutup function. Prevent this by setting the more specific shutup function on HDA_FIXUP_ACT_PROBE.
--- sound/pci/hda/patch_realtek.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/pci/hda/patch_realtek.c +1 -1
@@ -4419,7 +4419,7 @@ static void alc_no_shutup(struct hda_codstatic void alc_fixup_no_shutup (struct hda_codec *codec,const struct hda_fixup *fix,int action) { -if (action ==HDA_FIXUP_ACT_PRE_PROBE ) { +if (action ==HDA_FIXUP_ACT_PROBE ) {struct alc_spec *spec = codec->spec; spec->shutup = alc_no_shutup; }
Greg Kroah-Hartman
maintainerPATCH 117/138 gpio: mockup: dynamically allocate memory for chip name
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartosz Golaszewski <[email protected]>
[ Upstream commit ad6d8004fa29a8958381b60215e32d1e903b0492 ]
Currently the chip name buffer is allocated on the stack and the address of the buffer is passed to the gpio framework. It's invalid after probe() returns, so the sysfs label attribute displays garbage.
Use devm_kasprintf() for each string instead.
--- drivers/gpio/gpio-mockup.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/gpio/gpio-mockup.c +7 -3
@@ -126,7 +126,7 @@ static int mockup_gpio_probe(struct platint i;int base;int ngpio; -char chip_name[sizeof (GPIO_NAME ) +3 ]; +char *chip_name;if (gpio_mockup_params_nr <2 )return -EINVAL ;
@@ -146,8 +146,12 @@ static int mockup_gpio_probe(struct plat ngpio = gpio_mockup_ranges[i *2 +1 ] - base;if (ngpio >=0 ) { -sprintf (chip_name,"%s-%c" ,GPIO_NAME , - pins_name_start + i); + chip_name =devm_kasprintf (dev,GFP_KERNEL , +"%s-%c" ,GPIO_NAME , + pins_name_start + i); +if (!chip_name) +return -ENOMEM ; + ret =mockup_gpio_add (dev, &cntr[i], chip_name, base, ngpio); }else {
Greg Kroah-Hartman
maintainerPATCH 118/138 drm: Apply range restriction after color adjustment when allocation
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Wilson <[email protected]>
[ Upstream commit 3db93756b501e5f0a3951c79cfa9ed43c26d3455 ]
mm->color_adjust() compares the hole with its neighbouring nodes. They only abutt before we restrict the hole, so we have to apply color_adjust before we apply the range restriction.
--- drivers/gpu/drm/drm_mm.c | 16 ++++++---------- 1 file changed, 6 insertions(+), 10 deletions(-)
drivers/gpu/drm/drm_mm.c +6 -10
@@ -348,14 +348,12 @@ static void drm_mm_insert_helper_range(sBUG_ON (!hole_node->hole_follows || node->allocated); -if (adj_start < start) - adj_start = start; -if (adj_end > end) - adj_end = end; -if (mm->color_adjust) mm->color_adjust (hole_node, color, &adj_start, &adj_end); + adj_start =max (adj_start, start); + adj_end =min (adj_end, end); +if (flags &DRM_MM_CREATE_TOP ) adj_start = adj_end - size;
@@ -566,17 +564,15 @@ static struct drm_mm_node *drm_mm_search flags & DRM_MM_SEARCH_BELOW) {u64 hole_size = adj_end - adj_start; -if (adj_start < start) - adj_start = start; -if (adj_end > end) - adj_end = end; -if (mm->color_adjust) { mm->color_adjust (entry, color, &adj_start, &adj_end);if (adj_end <= adj_start)continue ; } + adj_start =max (adj_start, start); + adj_end =min (adj_end, end); +if (!check_free_hole (adj_start, adj_end, size, alignment))continue ;
Greg Kroah-Hartman
maintainerPATCH 119/138 clk: qcom: ipq4019: Add all the frequencies for apss cpu
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abhishek Sahu <[email protected]>
[ Upstream commit 86c654d41a52e3d17e9bc2c2ba37f3c963e66a4a ]
The APSS CPU clock does not contain all the frequencies in its frequency table so this patch adds the same.
--- drivers/clk/qcom/gcc-ipq4019.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)
drivers/clk/qcom/gcc-ipq4019.c +12 -2
@@ -525,10 +525,20 @@ static struct clk_rcg2 sdcc1_apps_clk_s };static const struct freq_tbl ftbl_gcc_apps_clk[] = { -F (48000000 ,P_XO ,1 ,0 ,0 ), +F (48000000 ,P_XO ,1 ,0 ,0 ),F (200000000 ,P_FEPLL200 ,1 ,0 ,0 ), +F (384000000 ,P_DDRPLLAPSS ,1 ,0 ,0 ), +F (413000000 ,P_DDRPLLAPSS ,1 ,0 ,0 ), +F (448000000 ,P_DDRPLLAPSS ,1 ,0 ,0 ), +F (488000000 ,P_DDRPLLAPSS ,1 ,0 ,0 ),F (500000000 ,P_FEPLL500 ,1 ,0 ,0 ), -F (626000000 ,P_DDRPLLAPSS ,1 ,0 ,0 ), +F (512000000 ,P_DDRPLLAPSS ,1 ,0 ,0 ), +F (537000000 ,P_DDRPLLAPSS ,1 ,0 ,0 ), +F (565000000 ,P_DDRPLLAPSS ,1 ,0 ,0 ), +F (597000000 ,P_DDRPLLAPSS ,1 ,0 ,0 ), +F (632000000 ,P_DDRPLLAPSS ,1 ,0 ,0 ), +F (672000000 ,P_DDRPLLAPSS ,1 ,0 ,0 ), +F (716000000 ,P_DDRPLLAPSS ,1 ,0 ,0 ), { } };
Greg Kroah-Hartman
maintainerPATCH 120/138 drm/mediatek: dont use drm_put_dev
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Vetter <[email protected]>
[ Upstream commit ae9d2daecf086958a41ad216152ec208d70ba325 ]
fsl is already fully demidlayered in the probe function, but for convenience stuck with drm_put_dev. Call the unregister/unref parts separately, to make sure this driver works correct.
--- drivers/gpu/drm/mediatek/mtk_drm_drv.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/mediatek/mtk_drm_drv.c +2 -1
@@ -321,7 +321,8 @@ static void mtk_drm_unbind(struct device {struct mtk_drm_private *private =dev_get_drvdata (dev); -drm_put_dev (private->drm); +drm_dev_unregister (private->drm); +drm_dev_unref (private->drm); private->drm =NULL ; }
Greg Kroah-Hartman
maintainerPATCH 121/138 mac80211: Remove invalid flag operations in mesh TSF synchronization
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masashi Honma <[email protected]>
[ Upstream commit 76f43b4c0a9337af22827d78de4f2b8fd5328489 ]
mesh_sync_offset_adjust_tbtt() implements Extensible synchronization framework ([1] 13.13.2 Extensible synchronization framework). It shall not operate the flag "TBTT Adjusting subfield" ([1] 8.4.2.100.8 Mesh Capability), since it is used only for MBCA ([1] 13.13.4 Mesh beacon collision avoidance, see 13.13.4.4.3 TBTT scanning and adjustment procedures for detail). So this patch remove the flag operations.
[1] IEEE Std 802.11 2012
--- net/mac80211/ieee80211_i.h | 1 - net/mac80211/mesh.c | 3 --- net/mac80211/mesh_sync.c | 11 ----------- 3 files changed, 15 deletions(-)
net/mac80211/ieee80211_i.h +0 -1
@@ -681,7 +681,6 @@ struct ieee80211_if_mesh {const struct ieee80211_mesh_sync_ops *sync_ops;s64 sync_offset_clockdrift_max;spinlock_t sync_offset_lock; -bool adjusting_tbtt;/* mesh power save */ enum nl80211_mesh_power_mode nonpeer_pm;int ps_peers_light_sleep;
net/mac80211/mesh.c +0 -3
@@ -279,8 +279,6 @@ int mesh_add_meshconf_ie(struct ieee8021/* Mesh PS mode. See IEEE802.11-2012 8.4.2.100.8 */ *pos |= ifmsh->ps_peers_deep_sleep ?IEEE80211_MESHCONF_CAPAB_POWER_SAVE_LEVEL :0x00 ; - *pos++ |= ifmsh->adjusting_tbtt ? -IEEE80211_MESHCONF_CAPAB_TBTT_ADJUSTING :0x00 ; *pos++ =0x00 ;return 0 ;
@@ -850,7 +848,6 @@ int ieee80211_start_mesh(struct ieee8021 ifmsh->mesh_cc_id =0 ;/* Disabled */ /* register sync ops from extensible synchronization framework */ ifmsh->sync_ops =ieee80211_mesh_sync_ops_get (ifmsh->mesh_sp_id); - ifmsh->adjusting_tbtt = false; ifmsh->sync_offset_clockdrift_max =0 ;set_bit (MESH_WORK_HOUSEKEEPING , &ifmsh->wrkq_flags);ieee80211_mesh_root_setup (ifmsh);
net/mac80211/mesh_sync.c +0 -11
@@ -123,7 +123,6 @@ static void mesh_sync_offset_rx_bcn_pres*/ if (elems->mesh_config &&mesh_peer_tbtt_adjusting (elems)) { -clear_sta_flag (sta,WLAN_STA_TOFFSET_KNOWN );msync_dbg (sdata,"STA %pM : is adjusting TBTT\n" , sta->sta.addr); goto no_sync;
@@ -172,11 +171,9 @@ static void mesh_sync_offset_adjust_tbtt struct beacon_data *beacon) {struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh; -u8 cap;WARN_ON (ifmsh->mesh_sp_id !=IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET );WARN_ON (!rcu_read_lock_held ()); - cap = beacon->meshconf->meshconf_cap;spin_lock_bh (&ifmsh->sync_offset_lock);
@@ -190,21 +187,13 @@ static void mesh_sync_offset_adjust_tbtt"TBTT : kicking off TBTT adjustment with clockdrift_max=%lld\n" , ifmsh->sync_offset_clockdrift_max);set_bit (MESH_WORK_DRIFT_ADJUST , &ifmsh->wrkq_flags); - - ifmsh->adjusting_tbtt = true; }else {msync_dbg (sdata,"TBTT : max clockdrift=%lld; too small to adjust\n" , (long long )ifmsh->sync_offset_clockdrift_max); ifmsh->sync_offset_clockdrift_max =0 ; - - ifmsh->adjusting_tbtt = false; }spin_unlock_bh (&ifmsh->sync_offset_lock); - - beacon->meshconf->meshconf_cap = ifmsh->adjusting_tbtt ? -IEEE80211_MESHCONF_CAPAB_TBTT_ADJUSTING | cap : - ~IEEE80211_MESHCONF_CAPAB_TBTT_ADJUSTING & cap; }static const struct sync_method sync_methods[] = {
Greg Kroah-Hartman
maintainerPATCH 122/138 mac80211: Suppress NEW_PEER_CANDIDATE event if no room
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masashi Honma <[email protected]>
[ Upstream commit 11197d006bcfabf0173a7820a163fcaac420d10e ]
Previously, kernel sends NEW_PEER_CANDIDATE event to user land even if the found peer does not have any room to accept other peer. This causes continuous connection trials.
--- net/mac80211/mesh_plink.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
net/mac80211/mesh_plink.c +8 -6
@@ -505,12 +505,14 @@ mesh_sta_info_alloc(struct ieee80211_sub/* Userspace handles station allocation */ if (sdata->u.mesh.user_mpm || - sdata->u.mesh.security &IEEE80211_MESH_SEC_AUTHED ) -cfg80211_notify_new_peer_candidate (sdata->dev, addr, - elems->ie_start, - elems->total_len, -GFP_KERNEL ); -else + sdata->u.mesh.security &IEEE80211_MESH_SEC_AUTHED ) { +if (mesh_peer_accepts_plinks (elems) && +mesh_plink_availables (sdata)) +cfg80211_notify_new_peer_candidate (sdata->dev, addr, + elems->ie_start, + elems->total_len, +GFP_KERNEL ); + }else sta =__mesh_sta_info_alloc (sdata, addr);return sta;
Greg Kroah-Hartman
maintainerPATCH 123/138 adm80211: add checks for dma mapping errors
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Khoroshilov <[email protected]>
[ Upstream commit d15697de60db5570532fdedb8e13b2251d65b8e3 ]
The driver does not check if mapping dma memory succeed. The patch adds the checks and failure handling.
Found by Linux Driver Verification project (linuxtesting.org).
--- drivers/net/wireless/admtek/adm8211.c | 24 ++++++++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-)
drivers/net/wireless/admtek/adm8211.c +22 -2
@@ -413,6 +413,13 @@ static void adm8211_interrupt_rci(structskb_tail_pointer (newskb),RX_PKT_SIZE , PCI_DMA_FROMDEVICE); +if (pci_dma_mapping_error (priv->pdev, + priv->rx_buffers[entry].mapping)) { + priv->rx_buffers[entry].skb =NULL ; +dev_kfree_skb (newskb); + skb =NULL ; +/* TODO: update rx dropped stats */ + } }else { skb =NULL ;/* TODO: update rx dropped stats */
@@ -1450,6 +1457,12 @@ static int adm8211_init_rings(struct ieeskb_tail_pointer (rx_info->skb),RX_PKT_SIZE , PCI_DMA_FROMDEVICE); +if (pci_dma_mapping_error (priv->pdev, rx_info->mapping)) { +dev_kfree_skb (rx_info->skb); + rx_info->skb =NULL ; +break ; + } + desc->buffer1 =cpu_to_le32 (rx_info->mapping); desc->status =cpu_to_le32 (RDES0_STATUS_OWN |RDES0_STATUS_SQL ); }
@@ -1613,7 +1626,7 @@ static void adm8211_calc_durations(int * }/* Transmit skb w/adm8211_tx_hdr (802.11 header created by hardware) */ -static void adm8211_tx_raw (struct ieee80211_hw *dev,struct sk_buff *skb, +static int adm8211_tx_raw (struct ieee80211_hw *dev,struct sk_buff *skb,u16 plcp_signal,size_t hdrlen) {
@@ -1625,6 +1638,8 @@ static void adm8211_tx_raw(struct ieee80 mapping =pci_map_single (priv->pdev, skb->data, skb->len,PCI_DMA_TODEVICE ); +if (pci_dma_mapping_error (priv->pdev, mapping)) +return -ENOMEM ;spin_lock_irqsave (&priv->lock, flags);
@@ -1657,6 +1672,8 @@ static void adm8211_tx_raw(struct ieee80/* Trigger transmit poll */ ADM8211_CSR_WRITE (TDR ,0 ); + +return 0 ; }/* Put adm8211_tx_hdr on skb and transmit */
@@ -1710,7 +1727,10 @@ static void adm8211_tx(struct ieee80211_ txhdr->retry_limit = info->control.rates[0 ].count; -adm8211_tx_raw (dev, skb, plcp_signal, hdrlen); +if (adm8211_tx_raw (dev, skb, plcp_signal, hdrlen)) { +/* Drop packet */ +ieee80211_free_txskb (dev, skb); + } }static int adm8211_alloc_rings (struct ieee80211_hw *dev)
Greg Kroah-Hartman
maintainerPATCH 124/138 iio: light: fix improper return value
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pan Bian <[email protected]>
[ Upstream commit db4e5376d058af8924fafd0520a0942d92538d0e ]
In function cm3232_reg_init(), it returns 0 even if the last call to i2c_smbus_write_byte_data() returns a negative value (indicates error). As a result, the return value may be inconsistent with the execution status, and the caller of cm3232_reg_init() will not be able to detect the error. This patch fixes the bug.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=188641
--- drivers/iio/light/cm3232.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/light/cm3232.c +1 -1
@@ -119,7 +119,7 @@ static int cm3232_reg_init(struct cm3232if (ret <0 )dev_err (&chip->client->dev,"Error writing reg_cmd\n" ); -return 0 ; +return ret; }/**
Greg Kroah-Hartman
maintainerPATCH 125/138 staging: iio: cdc: fix improper return value
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pan Bian <[email protected]>
[ Upstream commit 91ca1a8c584f55857b1f6ab20a1d3a1ce7a559bb ]
At the end of function ad7150_write_event_config(), directly returns 0. As a result, the errors will be ignored by the callers. It may be better to return variable "ret".
--- drivers/staging/iio/cdc/ad7150.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/iio/cdc/ad7150.c +1 -1
@@ -274,7 +274,7 @@ static int ad7150_write_event_config(str error_ret:mutex_unlock (&chip->state_lock); -return 0 ; +return ret; } static int ad7150_read_event_value(struct iio_dev *indio_dev,
A message that is not in the archive (sent off-list or not yet received): [email protected]
Rainer Fiebig
AppliedRe: [PATCH 4.9 088/138] Revert "drm/i915: Do not rely on wm preservation for ILK watermarks"
Quoted 130 lines · Greg Kroah-Hartman
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
This reverts commit
7de694782cbe7840f2c0de6f1e70f41fc1b8b6e8which is commit8777b927b92cf5b6c29f9f9d3c737addea9ac8a7upstream.It was reported to cause flickering and other regressions.
Reported-by Rainer Fiebig <[email protected]>Cc Maarten Lankhorst <[email protected]>Cc Ville Syrjälä <[email protected]>Cc Matt Roper <[email protected]>Cc Rodrigo Vivi <[email protected]>Cc Jani Nikula <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>reverted:
--- drivers/gpu/drm/i915/intel_drv.h | 1 drivers/gpu/drm/i915/intel_pm.c | 52 ++++++++++++++++++++++----------------- 2 files changed, 31 insertions(+), 22 deletions(-)drivers/gpu/drm/i915/intel_drv.h +1
-0@@ -457,6 +457,7 @@ struct intel_crtc_scaler_state {struct intel_pipe_wm {struct intel_wm_level wm[5 ]; +struct intel_wm_level raw_wm[5 ];uint32_t linetime;bool fbc_wm_enabled;bool pipe_enabled;drivers/gpu/drm/i915/intel_pm.c +23
-22@@ -27,7 +27,6 @@#include <linux/cpufreq.h> #include <drm/drm_plane_helper.h> -#include <drm/drm_atomic_helper.h> #include "i915_drv.h" #include "intel_drv.h" #include "../../../platform/x86/intel_ips.h" @@ -2018,9 +2017,9 @@ static void ilk_compute_wm_level(const sconst struct intel_crtc *intel_crtc, int level, struct intel_crtc_state *cstate, - const struct intel_plane_state *pristate, - const struct intel_plane_state *sprstate, - const struct intel_plane_state *curstate, + struct intel_plane_state *pristate, + struct intel_plane_state *sprstate, + struct intel_plane_state *curstate, struct intel_wm_level *result) { uint16_t pri_latency = dev_priv->wm.pri_latency[level];@@ -2342,24 +2341,28 @@ static int ilk_compute_pipe_wm(struct instruct intel_pipe_wm *pipe_wm;struct drm_device *dev = state->dev;const struct drm_i915_private *dev_priv =to_i915 (dev); -struct drm_plane *plane; -const struct drm_plane_state *plane_state; -const struct intel_plane_state *pristate =NULL ; -const struct intel_plane_state *sprstate =NULL ; -const struct intel_plane_state *curstate =NULL ; +struct intel_plane *intel_plane; +struct intel_plane_state *pristate =NULL ; +struct intel_plane_state *sprstate =NULL ; +struct intel_plane_state *curstate =NULL ;int level, max_level =ilk_wm_max_level (dev), usable_level;struct ilk_wm_maximums max; pipe_wm = &cstate->wm.ilk.optimal; -drm_atomic_crtc_state_for_each_plane_state (plane, plane_state, &cstate->base) { -const struct intel_plane_state *ps =to_intel_plane_state (plane_state); +for_each_intel_plane_on_crtc (dev, intel_crtc, intel_plane) { +struct intel_plane_state *ps; -if (plane->type ==DRM_PLANE_TYPE_PRIMARY ) + ps =intel_atomic_get_existing_plane_state (state, + intel_plane); +if (!ps) +continue ; + +if (intel_plane->base.type ==DRM_PLANE_TYPE_PRIMARY ) pristate = ps; -else if (plane->type ==DRM_PLANE_TYPE_OVERLAY ) +else if (intel_plane->base.type ==DRM_PLANE_TYPE_OVERLAY ) sprstate = ps; -else if (plane->type ==DRM_PLANE_TYPE_CURSOR ) +else if (intel_plane->base.type ==DRM_PLANE_TYPE_CURSOR ) curstate = ps; }@@ -2381,9 +2384,11 @@ static int ilk_compute_pipe_wm(struct inif (pipe_wm->sprites_scaled) usable_level =0 ; -memset (&pipe_wm->wm,0 ,sizeof (pipe_wm->wm));ilk_compute_wm_level (dev_priv, intel_crtc,0 , cstate, - pristate, sprstate, curstate, &pipe_wm->wm[0 ]); + pristate, sprstate, curstate, &pipe_wm->raw_wm[0 ]); + +memset (&pipe_wm->wm,0 ,sizeof (pipe_wm->wm)); + pipe_wm->wm[0 ] = pipe_wm->raw_wm[0 ];if (IS_HASWELL (dev) ||IS_BROADWELL (dev)) pipe_wm->linetime =hsw_compute_linetime_wm (cstate);@@ -2393,8 +2398,8 @@ static int ilk_compute_pipe_wm(struct inilk_compute_wm_reg_maximums (dev,1 , &max); -for (level =1 ; level <= usable_level; level++) { -struct intel_wm_level *wm = &pipe_wm->wm[level]; +for (level =1 ; level <= max_level; level++) { +struct intel_wm_level *wm = &pipe_wm->raw_wm[level];ilk_compute_wm_level (dev_priv, intel_crtc, level, cstate, pristate, sprstate, curstate, wm);@@ -2404,10 +2409,13 @@ static int ilk_compute_pipe_wm(struct in* register maximums since such watermarks are * always invalid. */ -if (!ilk_validate_wm_level (level, &max, wm)) { -memset (wm,0 ,sizeof (*wm)); -break ; - }
drivers/gpu/drm/i915/intel_pm.c static int ilk_compute_pipe_wm(struct in · line 2421
Quoted 10 lines
drivers/gpu/drm/i915/intel_pm.c +7
-0+if (level > usable_level) +continue ; + +if (ilk_validate_wm_level (level, &max, wm)) + pipe_wm->wm[level] = *wm; +else + usable_level = level; }return 0 ;
Applied it to 4.9.65 and all's nice again.
Thanks.
Rainer Fiebig
Greg Kroah-Hartman
maintainerPATCH 126/138 spi: SPI_FSL_DSPI should depend on HAS_DMA
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <[email protected]>
[ Upstream commit dadab2d4e3cf708ceba22ecddd94aedfecb39199 ]
If NO_DMA=y:
ERROR: "bad_dma_ops" [drivers/spi/spi-fsl-dspi.ko] undefined!
Add a dependency on HAS_DMA to fix this.
--- drivers/spi/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/spi/Kconfig +1 -0
@@ -365,6 +365,7 @@ config SPI_FSL_SPI config SPI_FSL_DSPI tristate "Freescale DSPI controller" select REGMAP_MMIO + depends on HAS_DMA depends on SOC_VF610 || SOC_LS1021A || ARCH_LAYERSCAPE || COMPILE_TEST help This enables support for the Freescale DSPI controller in master
Greg Kroah-Hartman
maintainerPATCH 127/138 netfilter: nft_queue: use raw_smp_processor_id()
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit c2e756ff9e699865d294cdc112acfc36419cf5cc ]
Using smp_processor_id() causes splats with PREEMPT_RCU:
[19379.552780] BUG: using smp_processor_id() in preemptible [00000000] code: ping/32389 [19379.552793] caller is debug_smp_processor_id+0x17/0x19 [...] [19379.552823] Call Trace: [19379.552832] [<ffffffff81274e9e>] dump_stack+0x67/0x90 [19379.552837] [<ffffffff8129a4d4>] check_preemption_disabled+0xe5/0xf5 [19379.552842] [<ffffffff8129a4fb>] debug_smp_processor_id+0x17/0x19 [19379.552849] [<ffffffffa07c42dd>] nft_queue_eval+0x35/0x20c [nft_queue]
No need to disable preemption since we only fetch the numeric value, so let's use raw_smp_processor_id() instead.
--- net/netfilter/nft_queue.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/netfilter/nft_queue.c +1 -1
@@ -38,7 +38,7 @@ static void nft_queue_eval(const structif (priv->queues_total >1 ) {if (priv->flags &NFT_QUEUE_FLAG_CPU_FANOUT ) { -int cpu =smp_processor_id (); +int cpu =raw_smp_processor_id (); queue = priv->queuenum + cpu % priv->queues_total; }else {
Greg Kroah-Hartman
maintainerPATCH 128/138 netfilter: nf_tables: fix oob access
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 3e38df136e453aa69eb4472108ebce2fb00b1ba6 ]
BUG: KASAN: slab-out-of-bounds in nf_tables_rule_destroy+0xf1/0x130 at addr ffff88006a4c35c8 Read of size 8 by task nft/1607
When we've destroyed last valid expr, nft_expr_next() returns an invalid expr. We must not dereference it unless it passes != nft_expr_last() check.
--- net/netfilter/nf_tables_api.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/netfilter/nf_tables_api.c +1 -1
@@ -2068,7 +2068,7 @@ static void nf_tables_rule_destroy(const* is called on error from nf_tables_newrule(). */ expr =nft_expr_first (rule); -while (expr->ops && expr !=nft_expr_last (rule)) { +while (expr !=nft_expr_last (rule) && expr->ops) {nf_tables_expr_destroy (ctx, expr); expr =nft_expr_next (expr); }
Greg Kroah-Hartman
maintainerPATCH 129/138 ASoC: rsnd: dont double free kctrl
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Colin Ian King <[email protected]>
[ Upstream commit 0ea617a298dcdc2251b4e10f83ac3f3e627b66e3 ]
On an error, snd_ctl_add already free's kctrl, so calling snd_ctl_free_one to free it again leads to a double free error. Fix this by removing the extraneous snd_ctl_free_one call.
Issue found using static analysis with CoverityScan, CID 1372908
--- sound/soc/sh/rcar/core.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
sound/soc/sh/rcar/core.c +1 -3
@@ -978,10 +978,8 @@ static int __rsnd_kctrl_new(struct rsnd_return -ENOMEM ; ret =snd_ctl_add (card, kctrl); -if (ret <0 ) { -snd_ctl_free_one (kctrl); +if (ret <0 )return ret; - } cfg->update = update; cfg->card = card;
Greg Kroah-Hartman
maintainerPATCH 130/138 crypto: marvell - Copy IVDIG before launching partial DMA ahash requests
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Romain Perier <[email protected]>
[ Upstream commit 8759fec4af222f338d08f8f1a7ad6a77ca6cb301 ]
Currently, inner IV/DIGEST data are only copied once into the hash engines and not set explicitly before launching a request that is not a first frag. This is an issue especially when multiple ahash reqs are computed in parallel or chained with cipher request, as the state of the request being computed is not updated into the hash engine. It leads to non-deterministic corrupted digest results.
--- drivers/crypto/marvell/cesa.h | 3 ++- drivers/crypto/marvell/hash.c | 34 +++++++++++++++++++++++++++++++++- drivers/crypto/marvell/tdma.c | 9 ++++++++- 3 files changed, 43 insertions(+), 3 deletions(-)
drivers/crypto/marvell/cesa.h +2 -1
@@ -273,7 +273,8 @@ struct mv_cesa_op_ctx {#define CESA_TDMA_SRC_IN_SRAM BIT(30)#define CESA_TDMA_END_OF_REQ BIT(29)#define CESA_TDMA_BREAK_CHAIN BIT(28) -#define CESA_TDMA_TYPE_MSK GENMASK(27, 0) +#define CESA_TDMA_SET_STATE BIT(27) +#define CESA_TDMA_TYPE_MSK GENMASK(26, 0)#define CESA_TDMA_DUMMY 0#define CESA_TDMA_DATA 1#define CESA_TDMA_OP 2
drivers/crypto/marvell/hash.c +33 -1
@@ -280,13 +280,32 @@ static void mv_cesa_ahash_std_prepare(st sreq->offset =0 ; } +static void mv_cesa_ahash_dma_step (struct ahash_request *req) +{ +struct mv_cesa_ahash_req *creq =ahash_request_ctx (req); +struct mv_cesa_req *base = &creq->base; + +/* We must explicitly set the digest state. */ +if (base->chain.first->flags &CESA_TDMA_SET_STATE ) { +struct mv_cesa_engine *engine = base->engine; +int i; + +/* Set the hash state in the IVDIG regs. */ +for (i =0 ; i <ARRAY_SIZE (creq->state); i++) +writel_relaxed (creq->state[i], engine->regs + +CESA_IVDIG (i)); + } + +mv_cesa_dma_step (base); +} +static void mv_cesa_ahash_step (struct crypto_async_request *req) {struct ahash_request *ahashreq =ahash_request_cast (req);struct mv_cesa_ahash_req *creq =ahash_request_ctx (ahashreq);if (mv_cesa_req_get_type (&creq->base) ==CESA_DMA_REQ ) -mv_cesa_dma_step (&creq->base); +mv_cesa_ahash_dma_step (ahashreq);else mv_cesa_ahash_std_step (ahashreq); }
@@ -562,11 +581,15 @@ static int mv_cesa_ahash_dma_req_init(ststruct mv_cesa_ahash_dma_iter iter;struct mv_cesa_op_ctx *op =NULL ;unsigned int frag_len; +bool set_state = false;int ret; basereq->chain.first =NULL ; basereq->chain.last =NULL ; +if (!mv_cesa_mac_op_is_first_frag (&creq->op_tmpl)) + set_state = true; +if (creq->src_nents) { ret =dma_map_sg (cesa_dev->dev, req->src, creq->src_nents,DMA_TO_DEVICE );
@@ -650,6 +673,15 @@ static int mv_cesa_ahash_dma_req_init(st basereq->chain.last->flags |= (CESA_TDMA_END_OF_REQ |CESA_TDMA_BREAK_CHAIN ); +if (set_state) { +/* +* Put the CESA_TDMA_SET_STATE flag on the first tdma desc to +* let the step logic know that the IVDIG registers should be +* explicitly set before launching a TDMA chain. +*/ + basereq->chain.first->flags |=CESA_TDMA_SET_STATE ; + } +return 0 ; err_free_tdma:
drivers/crypto/marvell/tdma.c +8 -1
@@ -112,7 +112,14 @@ void mv_cesa_tdma_chain(struct mv_cesa_e last->next = dreq->chain.first; engine->chain.last = dreq->chain.last; -if (!(last->flags &CESA_TDMA_BREAK_CHAIN )) +/* +* Break the DMA chain if the CESA_TDMA_BREAK_CHAIN is set on +* the last element of the current chain, or if the request +* being queued needs the IV regs to be set before lauching +* the request. +*/ +if (!(last->flags &CESA_TDMA_BREAK_CHAIN ) && + !(dreq->chain.first->flags &CESA_TDMA_SET_STATE )) last->next_dma = dreq->chain.first->cur_dma; } }
Greg Kroah-Hartman
maintainerPATCH 131/138 btrfs: return the actual error value from from btrfs_uuid_tree_iterate
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pan Bian <[email protected]>
[ Upstream commit 73ba39ab9307340dc98ec3622891314bbc09cc2e ]
In function btrfs_uuid_tree_iterate(), errno is assigned to variable ret on errors. However, it directly returns 0. It may be better to return ret. This patch also removes the warning, because the caller already prints a warning.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=188731
--- fs/btrfs/uuid-tree.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
fs/btrfs/uuid-tree.c +1 -3
@@ -351,7 +351,5 @@ skip: out:btrfs_free_path (path); -if (ret) -btrfs_warn (fs_info,"btrfs_uuid_tree_iterate failed %d" , ret); -return 0 ; +return ret; }
Greg Kroah-Hartman
maintainerPATCH 132/138 ASoC: wm_adsp: Dont overrun firmware file buffer when reading region data
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Fitzgerald <[email protected]>
[ Upstream commit 1cab2a84f470e15ecc8e5143bfe9398c6e888032 ]
Protect against corrupt firmware files by ensuring that the length we get for the data in a region actually lies within the available firmware file data buffer.
--- sound/soc/codecs/wm_adsp.c | 25 ++++++++++++++++++++++++- 1 file changed, 24 insertions(+), 1 deletion(-)
sound/soc/codecs/wm_adsp.c +24 -1
@@ -1365,7 +1365,7 @@ static int wm_adsp_load(struct wm_adsp *const struct wmfw_region *region;const struct wm_adsp_region *mem;const char *region_name; -char *file, *text; +char *file, *text =NULL ;struct wm_adsp_buf *buf;unsigned int reg;int regions =0 ;
@@ -1526,10 +1526,21 @@ static int wm_adsp_load(struct wm_adsp * regions,le32_to_cpu (region->len), offset, region_name); +if ((pos +le32_to_cpu (region->len) +sizeof (*region)) > + firmware->size) { +adsp_err (dsp, +"%s.%d: %s region len %d bytes exceeds file length %zu\n" , + file, regions, region_name, +le32_to_cpu (region->len), firmware->size); + ret = -EINVAL ; + goto out_fw; + } +if (text) {memcpy (text, region->data,le32_to_cpu (region->len));adsp_info (dsp,"%s: %s\n" , file, text);kfree (text); + text =NULL ; }if (reg) {
@@ -1574,6 +1585,7 @@ out_fw:regmap_async_complete (regmap);wm_adsp_buf_free (&buf_list);release_firmware (firmware); +kfree (text); out:kfree (file);
@@ -2054,6 +2066,17 @@ static int wm_adsp_load_coeff(struct wm_ }if (reg) { +if ((pos +le32_to_cpu (blk->len) +sizeof (*blk)) > + firmware->size) { +adsp_err (dsp, +"%s.%d: %s region len %d bytes exceeds file length %zu\n" , + file, blocks, region_name, +le32_to_cpu (blk->len), + firmware->size); + ret = -EINVAL ; + goto out_fw; + } + buf =wm_adsp_buf_alloc (blk->data,le32_to_cpu (blk->len), &buf_list);
Greg Kroah-Hartman
maintainerPATCH 133/138 s390/kbuild: enable modversions for symbols exported from asm
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <[email protected]>
[ Upstream commit cabab3f9f5ca077535080b3252e6168935b914af ]
s390 version of commit 334bb7738764 ("x86/kbuild: enable modversions for symbols exported from asm") so we get also rid of all these warnings:
WARNING: EXPORT symbol "_mcount" [vmlinux] version generation failed, symbol will not be versioned.
WARNING: EXPORT symbol "memcpy" [vmlinux] version generation failed, symbol will not be versioned.
WARNING: EXPORT symbol "memmove" [vmlinux] version generation failed, symbol will not be versioned.
WARNING: EXPORT symbol "memset" [vmlinux] version generation failed, symbol will not be versioned.
WARNING: EXPORT symbol "save_fpu_regs" [vmlinux] version generation failed, symbol will not be versioned.
WARNING: EXPORT symbol "sie64a" [vmlinux] version generation failed, symbol will not be versioned.
WARNING: EXPORT symbol "sie_exit" [vmlinux] version generation failed, symbol will not be versioned.
--- arch/s390/include/asm/asm-prototypes.h | 8 ++++++++ 1 file changed, 8 insertions(+) create mode 100644 arch/s390/include/asm/asm-prototypes.h
arch/s390/include/asm/asm-prototypes.h new file +8 -0
@@ -0,0 +1,8 @@ +#ifndef _ASM_S390_PROTOTYPES_H + +#include <linux/kvm_host.h> +#include <linux/ftrace.h> +#include <asm/fpu/api.h> +#include <asm-generic/asm-prototypes.h> + +#endif /* _ASM_S390_PROTOTYPES_H */
Greg Kroah-Hartman
maintainerPATCH 134/138 cec: when canceling a message, dont overwrite old status info
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Verkuil <[email protected]>
[ Upstream commit 120476123646ba3619c90db7bcbc6f8eea53c990 ]
When a pending message was canceled (e.g. due to a timeout), then the old tx_status info was overwritten instead of ORed. The same happened with the tx_error_cnt field. So just modify them instead of overwriting them.
--- drivers/staging/media/cec/cec-adap.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/staging/media/cec/cec-adap.c +3 -3
@@ -288,10 +288,10 @@ static void cec_data_cancel(struct cec_d/* Mark it as an error */ data->msg.tx_ts =ktime_get_ns (); - data->msg.tx_status =CEC_TX_STATUS_ERROR | -CEC_TX_STATUS_MAX_RETRIES ; + data->msg.tx_status |=CEC_TX_STATUS_ERROR | +CEC_TX_STATUS_MAX_RETRIES ; + data->msg.tx_error_cnt++; data->attempts =0 ; - data->msg.tx_error_cnt =1 ;/* Queue transmitted message for monitoring purposes */ cec_queue_msg_monitor (data->adap, &data->msg,1 );
Greg Kroah-Hartman
maintainerPATCH 135/138 cec: CEC_MSG_GIVE_FEATURES should abort for CEC version < 2
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Verkuil <[email protected]>
[ Upstream commit a24f56d47930492c94ef6875bf45adf7607ca1a4 ]
This is a 2.0 only message, so it should return Feature Abort if the adapter is configured for CEC version 1.4.
Right now it does nothing, which means that the sender will time out.
--- drivers/staging/media/cec/cec-adap.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/staging/media/cec/cec-adap.c +3 -3
@@ -1557,9 +1557,9 @@ static int cec_receive_notify(struct cec }case CEC_MSG_GIVE_FEATURES : -if (adap->log_addrs.cec_version >=CEC_OP_CEC_VERSION_2_0 ) -return cec_report_features (adap, la_idx); -return 0 ; +if (adap->log_addrs.cec_version <CEC_OP_CEC_VERSION_2_0 ) +return cec_feature_abort (adap, msg); +return cec_report_features (adap, la_idx);default :/*
Greg Kroah-Hartman
maintainerPATCH 136/138 cec: update log_addr[] before finishing configuration
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Verkuil <[email protected]>
[ Upstream commit 7af26f889eb67db272021a939f7d4a57e96dd961 ]
The loop that sets the unused logical addresses to INVALID should be done before 'configured' is set to true. This ensures that cec_log_addrs is consistent before it will be used.
--- drivers/staging/media/cec/cec-adap.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/staging/media/cec/cec-adap.c +2 -2
@@ -1062,6 +1062,8 @@ configured:for (i =1 ; i < las->num_log_addrs; i++) las->log_addr[i] =CEC_LOG_ADDR_INVALID ; } +for (i = las->num_log_addrs; i <CEC_MAX_LOG_ADDRS ; i++) + las->log_addr[i] =CEC_LOG_ADDR_INVALID ; adap->is_configured = true; adap->is_configuring = false;cec_post_state_event (adap);
@@ -1079,8 +1081,6 @@ configured:cec_report_features (adap, i);cec_report_phys_addr (adap, i); } -for (i = las->num_log_addrs; i <CEC_MAX_LOG_ADDRS ; i++) - las->log_addr[i] =CEC_LOG_ADDR_INVALID ;mutex_lock (&adap->lock); adap->kthread_config =NULL ;mutex_unlock (&adap->lock);
Greg Kroah-Hartman
maintainerPATCH 137/138 nvmet: fix KATO offset in Set Features
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Verkamp <[email protected]>
[ Upstream commit 6c73f949300f17851f53fa80c9d1611ccd6909d3 ]
The Set Features implementation for Keep Alive Timer was using the wrong structure when retrieving the KATO value; it was treating the Set Features command as a Property Set command.
The NVMe spec defines the Keep Alive Timer feature as having one input in CDW11 (4 bytes at offset 44 in the command) whereas the code was reading 8 bytes at offset 48.
Since the Linux NVMe over Fabrics host never sets this feature, this code has presumably never been tested.
--- drivers/nvme/target/admin-cmd.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/nvme/target/admin-cmd.c +1 -3
@@ -381,7 +381,6 @@ static void nvmet_execute_set_features(s {struct nvmet_subsys *subsys = req->sq->ctrl->subsys;u32 cdw10 =le32_to_cpu (req->cmd->common.cdw10[0 ]); -u64 val;u32 val32;u16 status =0 ;
@@ -391,8 +390,7 @@ static void nvmet_execute_set_features(s (subsys->max_qid - 1) | ((subsys->max_qid - 1) << 16));break ;case NVME_FEAT_KATO : - val =le64_to_cpu (req->cmd->prop_set.value); - val32 = val &0xffff ; + val32 =le32_to_cpu (req->cmd->common.cdw10[1 ]); req->sq->ctrl->kato =DIV_ROUND_UP (val32,1000 );nvmet_set_result (req, req->sq->ctrl->kato);break ;
Greg Kroah-Hartman
maintainerPATCH 138/138 xen: xenbus driver must not accept invalid transaction ids
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Juergen Gross <[email protected]>
[ Upstream commit 639b08810d6ad74ded2c5f6e233c4fcb9d147168 ]
When accessing Xenstore in a transaction the user is specifying a transaction id which he normally obtained from Xenstore when starting the transaction. Xenstore is validating a transaction id against all known transaction ids of the connection the request came in. As all requests of a domain not being the one where Xenstore lives share one connection, validation of transaction ids of different users of Xenstore in that domain should be done by the kernel of that domain being the multiplexer between the Xenstore users in that domain and Xenstore.
In order to prohibit one Xenstore user "hijacking" a transaction from another user the xenbus driver has to verify a given transaction id against all known transaction ids of the user before forwarding it to Xenstore.
--- drivers/xen/xenbus/xenbus_dev_frontend.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/xen/xenbus/xenbus_dev_frontend.c +1 -1
@@ -316,7 +316,7 @@ static int xenbus_write_transaction(unsi rc = -ENOMEM ; goto out; } - }else if (msg_type ==XS_TRANSACTION_END ) { + }else if (u->u.msg.tx_id !=0 ) {list_for_each_entry (trans, &u->transactions, list)if (trans->handle.id == u->u.msg.tx_id)break ;
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.9.66 release. There are 138 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu Nov 30 10:05:07 UTC 2017. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.66-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.9.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm and x86_64.
Summary
------------------------------------------------------------------------
kernel: 4.9.66-rc1
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git branch: linux-4.9.y
git commit: c97b8b87ce7c42f4127772bb1f54a02099b19194
git describe: v4.9.65-139-gc97b8b87ce7c
Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-4.9-oe/build/v4.9.65-139-gc97b8b87ce7c
No regressions (compared to build v4.9.65-85-gc1c091cd0d80)
Boards, architectures and test suites:
-------------------------------------
hi6220-hikey - arm64
* boot - pass: 20
* kselftest - skip: 20, pass: 34
* libhugetlbfs - skip: 1, pass: 90
* ltp-cap_bounds-tests - pass: 2
* ltp-containers-tests - pass: 64
* ltp-fcntl-locktests-tests - pass: 2
* ltp-filecaps-tests - pass: 2
* ltp-fs-tests - pass: 60
* ltp-fs_bind-tests - pass: 2
* ltp-fs_perms_simple-tests - pass: 19
* ltp-fsx-tests - pass: 4
* ltp-hugetlb-tests - skip: 1, pass: 21
* ltp-io-tests - pass: 3
* ltp-ipc-tests - pass: 9
* ltp-math-tests - pass: 11
* ltp-nptl-tests - pass: 2
* ltp-pty-tests - pass: 4
* ltp-sched-tests - pass: 14
* ltp-securebits-tests - pass: 4
* ltp-syscalls-tests - skip: 121, pass: 982
* ltp-timers-tests - pass: 12
juno-r2 - arm64
* boot - pass: 20
* kselftest - skip: 17, pass: 34
* libhugetlbfs - skip: 1, pass: 90
* ltp-cap_bounds-tests - pass: 2
* ltp-containers-tests - pass: 64
* ltp-fcntl-locktests-tests - pass: 2
* ltp-filecaps-tests - pass: 2
* ltp-fs-tests - pass: 60
* ltp-fs_bind-tests - pass: 2
* ltp-fs_perms_simple-tests - pass: 19
* ltp-fsx-tests - pass: 2
* ltp-hugetlb-tests - pass: 22
* ltp-io-tests - pass: 3
* ltp-ipc-tests - pass: 9
* ltp-math-tests - pass: 11
* ltp-nptl-tests - pass: 2
* ltp-pty-tests - pass: 4
* ltp-sched-tests - pass: 10
* ltp-securebits-tests - pass: 4
* ltp-syscalls-tests - skip: 156, pass: 939
* ltp-timers-tests - pass: 12
x15 - arm
* boot - pass: 20
* kselftest - skip: 23, pass: 31
* libhugetlbfs - skip: 1, pass: 87
* ltp-cap_bounds-tests - pass: 2
* ltp-containers-tests - pass: 64
* ltp-fcntl-locktests-tests - pass: 2
* ltp-filecaps-tests - pass: 2
* ltp-fs-tests - pass: 60
* ltp-fs_bind-tests - pass: 2
* ltp-fs_perms_simple-tests - pass: 19
* ltp-fsx-tests - pass: 2
* ltp-hugetlb-tests - skip: 2, pass: 20
* ltp-io-tests - pass: 3
* ltp-ipc-tests - pass: 9
* ltp-math-tests - pass: 11
* ltp-nptl-tests - pass: 2
* ltp-pty-tests - pass: 4
* ltp-sched-tests - skip: 1, pass: 13
* ltp-securebits-tests - pass: 4
* ltp-syscalls-tests - skip: 66, pass: 1036
* ltp-timers-tests - pass: 12
x86_64
* boot - pass: 20
* kselftest - skip: 20, pass: 49
* libhugetlbfs - skip: 1, pass: 76
* ltp-cap_bounds-tests - pass: 1
* ltp-containers-tests - pass: 63
* ltp-fcntl-locktests-tests - pass: 1
* ltp-filecaps-tests - pass: 2
* ltp-fs-tests - skip: 1, pass: 61
* ltp-fs_bind-tests - pass: 2
* ltp-fs_perms_simple-tests - pass: 18
* ltp-fsx-tests - pass: 2
* ltp-hugetlb-tests - pass: 22
* ltp-io-tests - pass: 3
* ltp-ipc-tests - pass: 8
* ltp-math-tests - pass: 11
* ltp-nptl-tests - pass: 2
* ltp-pty-tests - pass: 3
* ltp-sched-tests - skip: 1, pass: 9
* ltp-securebits-tests - pass: 3
* ltp-syscalls-tests - skip: 163, pass: 957
* ltp-timers-tests - pass: 12
Documentation - https://collaborate.linaro.org/display/LKFT/Email+Reports
Greg Kroah-Hartman
maintainerQuoted 16 lines · Naresh Kamboju
Quoted 14 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.9.66 release. There are 138 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu Nov 30 10:05:07 UTC 2017. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.66-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.9.y
and the diffstat can be found below.
Quoted 6 lines
Quoted 3 lines
thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm andx86_64.
Thanks for testing.
What is up with the odd email subject prefix?
greg k-h
Quoted 8 lines · Greg Kroah-Hartman
Quoted 2 lines · Naresh Kamboju
Results from Linaro’s test farm.
No regressions on arm64, arm andx86_64.Thanks for testing.
What is up with the odd email subject prefix?
There's another internal list for looking at LKFT been set up and they've set it up as a mailman list adding subject prefixes :(
Greg Kroah-Hartman
maintainerQuoted 6 lines · Mark Brown
Quoted 4 lines · Greg Kroah-Hartman
Quoted 2 lines · Naresh Kamboju
Results from Linaro’s test farm.
No regressions on arm64, arm andx86_64.
Quoted 6 lines
Quoted 3 lines
Thanks for testing.
What is up with the odd email subject prefix?
There's another internal list for looking at LKFT been set up and they've set it up as a mailman list adding subject prefixes :(
That's a pretty horrid thing to spam the public with :(
I'm going to drop the linaro.org address from my -rc announcements now until someone learns how to properly sort their mailing lists by mail headers, and not email subjects...
greg k-h
Quoted 10 lines · Greg Kroah-Hartman
Quoted 2 lines · Mark Brown
There's another internal list for looking at LKFT been set up and they've set it up as a mailman list adding subject prefixes :(
That's a pretty horrid thing to spam the public with :(
I'm going to drop the linaro.org address from my -rc announcements now until someone learns how to properly sort their mailing lists by mail headers, and not email subjects...
I'm pretty sure it's just an oversight due to it being the default in mailman rather than something deliberately chosen but yeah.
Quoted 11 lines · Greg Kroah-Hartman
Quoted 10 lines · Mark Brown
Quoted 8 lines · Greg Kroah-Hartman
Quoted 2 lines · Naresh Kamboju
Results from Linaro’s test farm.
No regressions on arm64, arm andx86_64.Thanks for testing.
What is up with the odd email subject prefix?
Quoted 8 lines
Quoted 2 lines
There's another internal list for looking at LKFT been set up and they've set it up as a mailman list adding subject prefixes :(
That's a pretty horrid thing to spam the public with :(
I'm going to drop the linaro.org address from my -rc announcements now until someone learns how to properly sort their mailing lists by mail headers, and not email subjects...
This is now fixed - [email protected] will not modify the subject header henceforth.
Dan
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.9.66 release. There are 138 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu Nov 30 10:05:07 UTC 2017. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.66-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.9.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.9.66 release. There are 138 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu Nov 30 10:05:07 UTC 2017. Anything received after that time might be too late.
Build results:
total: 145 pass: 145 fail: 0 Qemu test results: total: 123 pass: 123 fail: 0
Details are available at http://kerneltests.org/builders.
Guenter