4.4.262-rc1 review
Subsystems (2)
[email protected]
maintainercover 4.4.262-rc1 review
From: Greg Kroah-Hartman <[email protected]>
This is the start of the stable review cycle for the 4.4.262 release. There are 75 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 17 Mar 2021 13:51:52 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.262-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.4.262-rc1
Juergen Gross <[email protected]>
xen/events: avoid handling the same event on two cpus at the same time
Juergen Gross <[email protected]>
xen/events: don't unmask an event channel when an eoi is pending
Juergen Gross <[email protected]>
xen/events: reset affinity of 2-level event when tearing it down
Navid Emamdoost <[email protected]>
iio: imu: adis16400: fix memory leak
Navid Emamdoost <[email protected]>
iio: imu: adis16400: release allocated memory on failure
Marc Zyngier <[email protected]>
KVM: arm64: Fix exclusive limit for IPA size
Arvind Yadav <[email protected]>
media: hdpvr: Fix an error handling path in hdpvr_probe()
Naveen N. Rao <[email protected]>
powerpc/64s: Fix instruction encoding for lis in ppc_function_entry()
Al Viro <[email protected]>
alpha: switch __copy_user() and __do_clean_user() to normal calling conventions
Al Viro <[email protected]>
alpha: get rid of tail-zeroing in __copy_user()
Al Viro <[email protected]>
alpha: move exports to actual definitions
Richard Henderson <[email protected]>
alpha: Package string routines together
Masahiro Yamada <[email protected]>
alpha: make short build log available for division routines
Masahiro Yamada <[email protected]>
alpha: merge build rules of division routines
Masahiro Yamada <[email protected]>
alpha: add $(src)/ rather than $(obj)/ to make source file path
Alexey Dobriyan <[email protected]>
prctl: fix PR_SET_MM_AUXV kernel stack leak
Jia-Ju Bai <[email protected]>
block: rsxx: fix error return code of rsxx_pci_probe()
Ondrej Mosnacek <[email protected]>
NFSv4.2: fix return value of _nfs4_get_security_label()
Ian Abbott <[email protected]>
staging: comedi: pcl818: Fix endian problem for AI command data
Ian Abbott <[email protected]>
staging: comedi: pcl711: Fix endian problem for AI command data
Ian Abbott <[email protected]>
staging: comedi: me4000: Fix endian problem for AI command data
Ian Abbott <[email protected]>
staging: comedi: dmm32at: Fix endian problem for AI command data
Ian Abbott <[email protected]>
staging: comedi: das800: Fix endian problem for AI command data
Ian Abbott <[email protected]>
staging: comedi: das6402: Fix endian problem for AI command data
Ian Abbott <[email protected]>
staging: comedi: adv_pci1710: Fix endian problem for AI command data
Ian Abbott <[email protected]>
staging: comedi: addi_apci_1500: Fix endian problem for command sample
Ian Abbott <[email protected]>
staging: comedi: addi_apci_1032: Fix endian problem for COS sample
Lee Gibson <[email protected]>
staging: rtl8192e: Fix possible buffer overflow in _rtl92e_wx_set_scan
Lee Gibson <[email protected]>
staging: rtl8712: Fix possible buffer overflow in r8712_sitesurvey_cmd
Dan Carpenter <[email protected]>
staging: rtl8188eu: fix potential memory corruption in rtw_check_beacon_data()
Dan Carpenter <[email protected]>
staging: rtl8712: unterminated string leads to read overflow
Dan Carpenter <[email protected]>
staging: rtl8188eu: prevent ->ssid overflow in rtw_wx_set_scan()
Dan Carpenter <[email protected]>
staging: rtl8192u: fix ->ssid overflow in r8192_wx_set_scan()
Shuah Khan <[email protected]>
usbip: fix stub_dev usbip_sockfd_store() races leading to gpf
Shuah Khan <[email protected]>
usbip: fix vhci_hcd to check for stream socket
Shuah Khan <[email protected]>
usbip: fix stub_dev to check for stream socket
Sebastian Reichel <[email protected]>
USB: serial: cp210x: add some more GE USB IDs
Karan Singhal <[email protected]>
USB: serial: cp210x: add ID for Acuity Brands nLight Air Adapter
Niv Sardi <[email protected]>
USB: serial: ch341: add new Product ID
Pavel Skripkin <[email protected]>
USB: serial: io_edgeport: fix memory leak in edge_startup
Mathias Nyman <[email protected]>
xhci: Improve detection of device initiated wake signal.
Yoshihiro Shimoda <[email protected]>
usb: renesas_usbhs: Clear PIPECFG for re-enabling pipe with other EPNUM
Ruslan Bilovol <[email protected]>
usb: gadget: f_uac2: always increase endpoint max_packet_size by one audio slot
Yorick de Wid <[email protected]>
Goodix Fingerprint device is not a modem
Allen Pais <[email protected]>
libertas: fix a potential NULL pointer dereference
Joe Lawrence <[email protected]>
scripts/recordmcount.{c,pl}: support -ffunction-sections .text.* section names
Adrian Hunter <[email protected]>
mmc: core: Fix partition switch time for eMMC
Stefan Haberland <[email protected]>
s390/dasd: fix hanging DASD driver unbind
Takashi Iwai <[email protected]>
ALSA: usb-audio: Fix "cannot get freq eq" errors on Dell AE515 sound bar
Takashi Iwai <[email protected]>
ALSA: hda: Avoid spurious unsol event handling during S3/S4
Takashi Iwai <[email protected]>
ALSA: hda/hdmi: Cancel pending works before suspend
Mike Christie <[email protected]>
scsi: libiscsi: Fix iscsi_prep_scsi_cmd_pdu() error handling
Heiko Carstens <[email protected]>
s390/smp: __smp_rescan_cpus() - move cpumask away from stack
Martin Kaiser <[email protected]>
PCI: xgene-msi: Fix race in installing chained irq handler
Athira Rajeev <[email protected]>
powerpc/perf: Record counter overflow always if SAMPLE_IP is unset
Chaotian Jing <[email protected]>
mmc: mediatek: fix race condition between msdc_request_timeout and irq
Christophe JAILLET <[email protected]>
mmc: mxs-mmc: Fix a resource leak in an error handling path in 'mxs_mmc_probe()'
Maxim Mikityanskiy <[email protected]>
media: usbtv: Fix deadlock on suspend
Paul Cercueil <[email protected]>
net: davicom: Fix regulator not turned off on driver removal
Paul Cercueil <[email protected]>
net: davicom: Fix regulator not turned off on failed probe
Xie He <[email protected]>
net: lapbether: Remove netif_start_queue / netif_stop_queue
Kevin(Yudong) Yang <[email protected]>
net/mlx4_en: update moderation when config reset
Thomas Gleixner <[email protected]>
futex: fix dead code in attach_to_pi_owner()
Thomas Gleixner <[email protected]>
futex: Cure exit race
Peter Zijlstra <[email protected]>
futex: Change locking rules
Linus Torvalds <[email protected]>
Revert "mm, slub: consider rest of partial list if acquire_slab() fails"
Jiri Kosina <[email protected]>
floppy: fix lock_fdc() signal handling
Paulo Alcantara <[email protected]>
cifs: return proper error code in statfs(2)
Vasily Averin <[email protected]>
netfilter: x_tables: gpf inside xt_find_revision()
Joakim Zhang <[email protected]>
can: flexcan: enable RX FIFO after FRZ/HALT valid
Joakim Zhang <[email protected]>
can: flexcan: assert FRZ bit in flexcan_chip_freeze()
Oleksij Rempel <[email protected]>
can: skb: can_skb_set_owner(): fix ref counting if socket was closed before setting skb ownership
Daniel Borkmann <[email protected]>
net: Fix gro aggregation for udp encaps with zero csum
Felix Fietkau <[email protected]>
ath9k: fix transmitting to stations in dynamic SMPS mode
Dmitry V. Levin <[email protected]>
uapi: nfnetlink_cthelper.h: fix userspace compilation error
-------------
Diffstat:
Makefile | 4 +- arch/alpha/include/asm/Kbuild | 1 + arch/alpha/include/asm/uaccess.h | 76 ++------ arch/alpha/kernel/Makefile | 2 +- arch/alpha/kernel/alpha_ksyms.c | 102 ----------- arch/alpha/kernel/machvec_impl.h | 6 +- arch/alpha/kernel/setup.c | 1 + arch/alpha/lib/Makefile | 33 ++-- arch/alpha/lib/callback_srm.S | 5 + arch/alpha/lib/checksum.c | 3 + arch/alpha/lib/clear_page.S | 3 +- arch/alpha/lib/clear_user.S | 66 +++---- arch/alpha/lib/copy_page.S | 3 +- arch/alpha/lib/copy_user.S | 101 ++++------- arch/alpha/lib/csum_ipv6_magic.S | 2 + arch/alpha/lib/csum_partial_copy.c | 2 + arch/alpha/lib/dec_and_lock.c | 2 + arch/alpha/lib/divide.S | 3 + arch/alpha/lib/ev6-clear_page.S | 3 +- arch/alpha/lib/ev6-clear_user.S | 85 ++++----- arch/alpha/lib/ev6-copy_page.S | 3 +- arch/alpha/lib/ev6-copy_user.S | 130 +++++--------- arch/alpha/lib/ev6-csum_ipv6_magic.S | 2 + arch/alpha/lib/ev6-divide.S | 3 + arch/alpha/lib/ev6-memchr.S | 3 +- arch/alpha/lib/ev6-memcpy.S | 3 +- arch/alpha/lib/ev6-memset.S | 7 +- arch/alpha/lib/ev67-strcat.S | 3 +- arch/alpha/lib/ev67-strchr.S | 3 +- arch/alpha/lib/ev67-strlen.S | 3 +- arch/alpha/lib/ev67-strncat.S | 3 +- arch/alpha/lib/ev67-strrchr.S | 3 +- arch/alpha/lib/fpreg.c | 7 + arch/alpha/lib/memchr.S | 3 +- arch/alpha/lib/memcpy.c | 5 +- arch/alpha/lib/memmove.S | 3 +- arch/alpha/lib/memset.S | 7 +- arch/alpha/lib/strcat.S | 2 + arch/alpha/lib/strchr.S | 3 +- arch/alpha/lib/strcpy.S | 3 +- arch/alpha/lib/strlen.S | 3 +- arch/alpha/lib/strncat.S | 3 +- arch/alpha/lib/strncpy.S | 3 +- arch/alpha/lib/strrchr.S | 3 +- arch/arm/kvm/mmu.c | 2 +- arch/powerpc/include/asm/code-patching.h | 2 +- arch/powerpc/perf/core-book3s.c | 19 +- arch/s390/kernel/smp.c | 2 +- drivers/block/floppy.c | 35 ++-- drivers/block/rsxx/core.c | 1 + drivers/iio/imu/adis16400_buffer.c | 5 +- drivers/iio/imu/adis_buffer.c | 5 +- drivers/media/usb/hdpvr/hdpvr-core.c | 33 ++-- drivers/media/usb/usbtv/usbtv-audio.c | 2 +- drivers/mmc/core/mmc.c | 15 +- drivers/mmc/host/mtk-sd.c | 18 +- drivers/mmc/host/mxs-mmc.c | 2 +- drivers/net/can/flexcan.c | 12 +- drivers/net/ethernet/davicom/dm9000.c | 21 ++- drivers/net/ethernet/mellanox/mlx4/en_ethtool.c | 2 +- drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 2 + drivers/net/ethernet/mellanox/mlx4/mlx4_en.h | 1 + drivers/net/wan/lapbether.c | 3 - drivers/net/wireless/ath/ath9k/ath9k.h | 3 +- drivers/net/wireless/ath/ath9k/xmit.c | 6 + drivers/net/wireless/libertas/if_sdio.c | 5 + drivers/pci/host/pci-xgene-msi.c | 10 +- drivers/s390/block/dasd.c | 3 +- drivers/scsi/libiscsi.c | 11 +- drivers/staging/comedi/drivers/addi_apci_1032.c | 4 +- drivers/staging/comedi/drivers/addi_apci_1500.c | 18 +- drivers/staging/comedi/drivers/adv_pci1710.c | 10 +- drivers/staging/comedi/drivers/das6402.c | 2 +- drivers/staging/comedi/drivers/das800.c | 2 +- drivers/staging/comedi/drivers/dmm32at.c | 2 +- drivers/staging/comedi/drivers/me4000.c | 2 +- drivers/staging/comedi/drivers/pcl711.c | 2 +- drivers/staging/comedi/drivers/pcl818.c | 2 +- drivers/staging/rtl8188eu/core/rtw_ap.c | 5 + drivers/staging/rtl8188eu/os_dep/ioctl_linux.c | 6 +- drivers/staging/rtl8192e/rtl8192e/rtl_wx.c | 7 +- drivers/staging/rtl8192u/r8192U_wx.c | 6 +- drivers/staging/rtl8712/rtl871x_cmd.c | 6 +- drivers/staging/rtl8712/rtl871x_ioctl_linux.c | 2 +- drivers/usb/class/cdc-acm.c | 5 + drivers/usb/gadget/function/f_uac2.c | 2 +- drivers/usb/host/xhci.c | 16 +- drivers/usb/renesas_usbhs/pipe.c | 2 + drivers/usb/serial/ch341.c | 1 + drivers/usb/serial/cp210x.c | 3 + drivers/usb/serial/io_edgeport.c | 26 +-- drivers/usb/usbip/stub_dev.c | 42 ++++- drivers/usb/usbip/vhci_sysfs.c | 10 +- drivers/xen/events/events_2l.c | 22 ++- drivers/xen/events/events_base.c | 130 ++++++++++---- drivers/xen/events/events_fifo.c | 7 - drivers/xen/events/events_internal.h | 22 ++- fs/cifs/cifsfs.c | 2 +- fs/nfs/nfs4proc.c | 2 +- include/linux/can/skb.h | 8 +- include/uapi/linux/netfilter/nfnetlink_cthelper.h | 2 +- kernel/futex.c | 209 ++++++++++++++++++---- kernel/sys.c | 2 +- mm/slub.c | 2 +- net/ipv4/udp_offload.c | 2 +- net/netfilter/x_tables.c | 6 +- scripts/recordmcount.c | 2 +- scripts/recordmcount.pl | 13 ++ sound/pci/hda/hda_bind.c | 4 + sound/pci/hda/patch_hdmi.c | 13 ++ sound/usb/quirks.c | 1 + 111 files changed, 895 insertions(+), 671 deletions(-)
[email protected]
maintainerPATCH 1/75 uapi: nfnetlink_cthelper.h: fix userspace compilation error
From: Greg Kroah-Hartman <[email protected]>
From: Dmitry V. Levin <[email protected]>
commit c33cb0020ee6dd96cc9976d6085a7d8422f6dbed upstream.
Apparently, <linux/netfilter/nfnetlink_cthelper.h> and <linux/netfilter/nfnetlink_acct.h> could not be included into the same compilation unit because of a cut-and-paste typo in the former header.
--- include/uapi/linux/netfilter/nfnetlink_cthelper.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/uapi/linux/netfilter/nfnetlink_cthelper.h +1 -1
@@ -4,7 +4,7 @@#define NFCT_HELPER_STATUS_DISABLED 0#define NFCT_HELPER_STATUS_ENABLED 1 -enum nfnl_acct_msg_types { +enum nfnl_cthelper_msg_types {NFNL_MSG_CTHELPER_NEW ,NFNL_MSG_CTHELPER_GET ,NFNL_MSG_CTHELPER_DEL ,
[email protected]
maintainerPATCH 2/75 ath9k: fix transmitting to stations in dynamic SMPS mode
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Felix Fietkau <[email protected]>
commit 3b9ea7206d7e1fdd7419cbd10badd3b2c80d04b4 upstream.
When transmitting to a receiver in dynamic SMPS mode, all transmissions that use multiple spatial streams need to be sent using CTS-to-self or RTS/CTS to give the receiver's extra chains some time to wake up.
This fixes the tx rate getting stuck at <= MCS7 for some clients, especially Intel ones, which make aggressive use of SMPS.
--- drivers/net/wireless/ath/ath9k/ath9k.h | 3 ++- drivers/net/wireless/ath/ath9k/xmit.c | 6 ++++++ 2 files changed, 8 insertions(+), 1 deletion(-)
drivers/net/wireless/ath/ath9k/ath9k.h +2 -1
@@ -178,7 +178,8 @@ struct ath_frame_info {s8 txq;u8 keyix;u8 rtscts_rate; - u8 retries : 7; + u8 retries : 6; + u8 dyn_smps : 1; u8 baw_tracked : 1;u8 tx_power; enum ath9k_key_type keytype:2;
drivers/net/wireless/ath/ath9k/xmit.c +6 -0
@@ -1228,6 +1228,11 @@ static void ath_buf_set_rate(struct ath_ is_40, is_sgi, is_sp);if (rix <8 && (tx_info->flags &IEEE80211_TX_CTL_STBC )) info->rates[i].RateFlags |=ATH9K_RATESERIES_STBC ; +if (rix >=8 && fi->dyn_smps) { + info->rates[i].RateFlags |= +ATH9K_RATESERIES_RTS_CTS ; + info->flags |=ATH9K_TXDESC_CTSENA ; + } info->txpower[i] =ath_get_rate_txpower (sc, bf, rix, is_40, false);
@@ -2114,6 +2119,7 @@ static void setup_frame_info(struct ieee fi->keyix = an->ps_key; else fi->keyix = ATH9K_TXKEYIX_INVALID; + fi->dyn_smps = sta && sta->smps_mode ==IEEE80211_SMPS_DYNAMIC ; fi->keytype = keytype; fi->framelen = framelen; fi->tx_power = txpower;
[email protected]
maintainerPATCH 3/75 net: Fix gro aggregation for udp encaps with zero csum
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Daniel Borkmann <[email protected]>
commit 89e5c58fc1e2857ccdaae506fb8bc5fed57ee063 upstream.
We noticed a GRO issue for UDP-based encaps such as vxlan/geneve when the csum for the UDP header itself is 0. In that case, GRO aggregation does not take place on the phys dev, but instead is deferred to the vxlan/geneve driver (see trace below).
The reason is essentially that GRO aggregation bails out in udp_gro_receive() for such case when drivers marked the skb with CHECKSUM_UNNECESSARY (ice, i40e, others) where for non-zero csums 2abb7cdc0dc8 ("udp: Add support for doing checksum unnecessary conversion") promotes those skbs to CHECKSUM_COMPLETE and napi context has csum_valid set. This is however not the case for zero UDP csum (here: csum_cnt is still 0 and csum_valid continues to be false).
At the same time 57c67ff4bd92 ("udp: additional GRO support") added matches on !uh->check ^ !uh2->check as part to determine candidates for aggregation, so it certainly is expected to handle zero csums in udp_gro_receive(). The purpose of the check added via 662880f44203 ("net: Allow GRO to use and set levels of checksum unnecessary") seems to catch bad csum and stop aggregation right away.
One way to fix aggregation in the zero case is to only perform the !csum_valid check in udp_gro_receive() if uh->check is infact non-zero.
Before:
[...]
swapper 0 [008] 731.946506: net:netif_receive_skb: dev=enp10s0f0 skbaddr=0xffff966497100400 len=1500 (1) swapper 0 [008] 731.946507: net:netif_receive_skb: dev=enp10s0f0 skbaddr=0xffff966497100200 len=1500 swapper 0 [008] 731.946507: net:netif_receive_skb: dev=enp10s0f0 skbaddr=0xffff966497101100 len=1500 swapper 0 [008] 731.946508: net:netif_receive_skb: dev=enp10s0f0 skbaddr=0xffff966497101700 len=1500 swapper 0 [008] 731.946508: net:netif_receive_skb: dev=enp10s0f0 skbaddr=0xffff966497101b00 len=1500 swapper 0 [008] 731.946508: net:netif_receive_skb: dev=enp10s0f0 skbaddr=0xffff966497100600 len=1500 swapper 0 [008] 731.946508: net:netif_receive_skb: dev=enp10s0f0 skbaddr=0xffff966497100f00 len=1500 swapper 0 [008] 731.946509: net:netif_receive_skb: dev=enp10s0f0 skbaddr=0xffff966497100a00 len=1500 swapper 0 [008] 731.946516: net:netif_receive_skb: dev=enp10s0f0 skbaddr=0xffff966497100500 len=1500 swapper 0 [008] 731.946516: net:netif_receive_skb: dev=enp10s0f0 skbaddr=0xffff966497100700 len=1500 swapper 0 [008] 731.946516: net:netif_receive_skb: dev=enp10s0f0 skbaddr=0xffff966497101d00 len=1500 (2) swapper 0 [008] 731.946517: net:netif_receive_skb: dev=enp10s0f0 skbaddr=0xffff966497101000 len=1500 swapper 0 [008] 731.946517: net:netif_receive_skb: dev=enp10s0f0 skbaddr=0xffff966497101c00 len=1500 swapper 0 [008] 731.946517: net:netif_receive_skb: dev=enp10s0f0 skbaddr=0xffff966497101400 len=1500 swapper 0 [008] 731.946518: net:netif_receive_skb: dev=enp10s0f0 skbaddr=0xffff966497100e00 len=1500 swapper 0 [008] 731.946518: net:netif_receive_skb: dev=enp10s0f0 skbaddr=0xffff966497101600 len=1500 swapper 0 [008] 731.946521: net:netif_receive_skb: dev=enp10s0f0 skbaddr=0xffff966497100800 len=774 swapper 0 [008] 731.946530: net:netif_receive_skb: dev=test_vxlan skbaddr=0xffff966497100400 len=14032 (1) swapper 0 [008] 731.946530: net:netif_receive_skb: dev=test_vxlan skbaddr=0xffff966497101d00 len=9112 (2)
[...]
# netperf -H 10.55.10.4 -t TCP_STREAM -l 20 MIGRATED TCP STREAM TEST from 0.0.0.0 (0.0.0.0) port 0 AF_INET to 10.55.10.4 () port 0 AF_INET : demo Recv Send Send Socket Socket Message Elapsed Size Size Size Time Throughput bytes bytes bytes secs. 10^6bits/sec
87380 16384 16384 20.01 13129.24
After:
[...]
swapper 0 [026] 521.862641: net:netif_receive_skb: dev=enp10s0f0 skbaddr=0xffff93ab0d479000 len=11286 (1) swapper 0 [026] 521.862643: net:netif_receive_skb: dev=test_vxlan skbaddr=0xffff93ab0d479000 len=11236 (1) swapper 0 [026] 521.862650: net:netif_receive_skb: dev=enp10s0f0 skbaddr=0xffff93ab0d478500 len=2898 (2) swapper 0 [026] 521.862650: net:netif_receive_skb: dev=enp10s0f0 skbaddr=0xffff93ab0d479f00 len=8490 (3) swapper 0 [026] 521.862653: net:netif_receive_skb: dev=test_vxlan skbaddr=0xffff93ab0d478500 len=2848 (2) swapper 0 [026] 521.862653: net:netif_receive_skb: dev=test_vxlan skbaddr=0xffff93ab0d479f00 len=8440 (3)
[...]
# netperf -H 10.55.10.4 -t TCP_STREAM -l 20 MIGRATED TCP STREAM TEST from 0.0.0.0 (0.0.0.0) port 0 AF_INET to 10.55.10.4 () port 0 AF_INET : demo Recv Send Send Socket Socket Message Elapsed Size Size Size Time Throughput bytes bytes bytes secs. 10^6bits/sec
87380 16384 16384 20.01 24576.53
--- net/ipv4/udp_offload.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv4/udp_offload.c +1 -1
@@ -300,7 +300,7 @@ struct sk_buff **udp_gro_receive(structint flush =1 ;if (NAPI_GRO_CB (skb)->encap_mark || - (skb->ip_summed !=CHECKSUM_PARTIAL && + (uh->check && skb->ip_summed !=CHECKSUM_PARTIAL &&NAPI_GRO_CB (skb)->csum_cnt ==0 && !NAPI_GRO_CB (skb)->csum_valid)) goto out;
[email protected]
maintainerPATCH 4/75 can: skb: can_skb_set_owner(): fix ref counting if socket was closed before setting skb ownership
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Oleksij Rempel <[email protected]>
commit e940e0895a82c6fbaa259f2615eb52b57ee91a7e upstream.
There are two ref count variables controlling the free()ing of a socket:
- struct sock::sk_refcnt - which is changed by sock_hold()/sock_put()
- struct sock::sk_wmem_alloc - which accounts the memory allocated by the skbs in the send path.
In case there are still TX skbs on the fly and the socket() is closed, the struct sock::sk_refcnt reaches 0. In the TX-path the CAN stack clones an "echo" skb, calls sock_hold() on the original socket and references it. This produces the following back trace:
| WARNING: CPU: 0 PID: 280 at lib/refcount.c:25 refcount_warn_saturate+0x114/0x134 | refcount_t: addition on 0; use-after-free. | Modules linked in: coda_vpu(E) v4l2_jpeg(E) videobuf2_vmalloc(E) imx_vdoa(E) | CPU: 0 PID: 280 Comm: test_can.sh Tainted: G E 5.11.0-04577-gf8ff6603c617 #203 | Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree) | Backtrace: | [<80bafea4>] (dump_backtrace) from [<80bb0280>] (show_stack+0x20/0x24) r7:00000000 r6:600f0113 r5:00000000 r4:81441220 | [<80bb0260>] (show_stack) from [<80bb593c>] (dump_stack+0xa0/0xc8) | [<80bb589c>] (dump_stack) from [<8012b268>] (__warn+0xd4/0x114) r9:00000019 r8:80f4a8c2 r7:83e4150c r6:00000000 r5:00000009 r4:80528f90 | [<8012b194>] (__warn) from [<80bb09c4>] (warn_slowpath_fmt+0x88/0xc8) r9:83f26400 r8:80f4a8d1 r7:00000009 r6:80528f90 r5:00000019 r4:80f4a8c2 | [<80bb0940>] (warn_slowpath_fmt) from [<80528f90>] (refcount_warn_saturate+0x114/0x134) r8:00000000 r7:00000000 r6:82b44000 r5:834e5600 r4:83f4d540 | [<80528e7c>] (refcount_warn_saturate) from [<8079a4c8>] (__refcount_add.constprop.0+0x4c/0x50) | [<8079a47c>] (__refcount_add.constprop.0) from [<8079a57c>] (can_put_echo_skb+0xb0/0x13c) | [<8079a4cc>] (can_put_echo_skb) from [<8079ba98>] (flexcan_start_xmit+0x1c4/0x230) r9:00000010 r8:83f48610 r7:0fdc0000 r6:0c080000 r5:82b44000 r4:834e5600 | [<8079b8d4>] (flexcan_start_xmit) from [<80969078>] (netdev_start_xmit+0x44/0x70) r9:814c0ba0 r8:80c8790c r7:00000000 r6:834e5600 r5:82b44000 r4:82ab1f00 | [<80969034>] (netdev_start_xmit) from [<809725a4>] (dev_hard_start_xmit+0x19c/0x318) r9:814c0ba0 r8:00000000 r7:82ab1f00 r6:82b44000 r5:00000000 r4:834e5600 | [<80972408>] (dev_hard_start_xmit) from [<809c6584>] (sch_direct_xmit+0xcc/0x264) r10:834e5600 r9:00000000 r8:00000000 r7:82b44000 r6:82ab1f00 r5:834e5600 r4:83f27400 | [<809c64b8>] (sch_direct_xmit) from [<809c6c0c>] (__qdisc_run+0x4f0/0x534)
To fix this problem, only set skb ownership to sockets which have still a ref count > 0.
--- include/linux/can/skb.h | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
include/linux/can/skb.h +6 -2
@@ -48,8 +48,12 @@ static inline void can_skb_reserve(strucstatic inline void can_skb_set_owner (struct sk_buff *skb,struct sock *sk) { -if (sk) { -sock_hold (sk); +/* If the socket has already been closed by user space, the +* refcount may already be 0 (and the socket will be freed +* after the last TX skb has been freed). So only increase +* socket refcount if the refcount is > 0. +*/ +if (sk &&atomic_inc_not_zero (&sk->sk_refcnt)) { skb->destructor = sock_efree; skb->sk = sk; }
[email protected]
maintainerPATCH 5/75 can: flexcan: assert FRZ bit in flexcan_chip_freeze()
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Joakim Zhang <[email protected]>
commit 449052cfebf624b670faa040245d3feed770d22f upstream.
Assert HALT bit to enter freeze mode, there is a premise that FRZ bit is asserted. This patch asserts FRZ bit in flexcan_chip_freeze, although the reset value is 1b'1. This is a prepare patch, later patch will invoke flexcan_chip_freeze() to enter freeze mode, which polling freeze mode acknowledge.
--- drivers/net/can/flexcan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/can/flexcan.c +1 -1
@@ -383,7 +383,7 @@ static int flexcan_chip_freeze(struct flu32 reg; reg =flexcan_read (®s->mcr); - reg |=FLEXCAN_MCR_HALT ; + reg |=FLEXCAN_MCR_FRZ |FLEXCAN_MCR_HALT ;flexcan_write (reg, ®s->mcr);while (timeout-- && !(flexcan_read (®s->mcr) &FLEXCAN_MCR_FRZ_ACK ))
[email protected]
maintainerPATCH 6/75 can: flexcan: enable RX FIFO after FRZ/HALT valid
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Joakim Zhang <[email protected]>
commit ec15e27cc8904605846a354bb1f808ea1432f853 upstream.
RX FIFO enable failed could happen when do system reboot stress test:
[ 0.303958] flexcan 5a8d0000.can: 5a8d0000.can supply xceiver not found, using dummy regulator [ 0.304281] flexcan 5a8d0000.can (unnamed net_device) (uninitialized): Could not enable RX FIFO, unsupported core [ 0.314640] flexcan 5a8d0000.can: registering netdev failed [ 0.320728] flexcan 5a8e0000.can: 5a8e0000.can supply xceiver not found, using dummy regulator [ 0.320991] flexcan 5a8e0000.can (unnamed net_device) (uninitialized): Could not enable RX FIFO, unsupported core [ 0.331360] flexcan 5a8e0000.can: registering netdev failed [ 0.337444] flexcan 5a8f0000.can: 5a8f0000.can supply xceiver not found, using dummy regulator [ 0.337716] flexcan 5a8f0000.can (unnamed net_device) (uninitialized): Could not enable RX FIFO, unsupported core [ 0.348117] flexcan 5a8f0000.can: registering netdev failed
RX FIFO should be enabled after the FRZ/HALT are valid. But the current code enable RX FIFO and FRZ/HALT at the same time.
--- drivers/net/can/flexcan.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/net/can/flexcan.c +7 -3
@@ -1098,10 +1098,14 @@ static int register_flexcandev(struct neif (err) goto out_chip_disable; -/* set freeze, halt and activate FIFO, restrict register access */ +/* set freeze, halt */ + err =flexcan_chip_freeze (priv); +if (err) + goto out_chip_disable; + +/* activate FIFO, restrict register access */ reg =flexcan_read (®s->mcr); - reg |=FLEXCAN_MCR_FRZ |FLEXCAN_MCR_HALT | -FLEXCAN_MCR_FEN |FLEXCAN_MCR_SUPV ; + reg |=FLEXCAN_MCR_FEN |FLEXCAN_MCR_SUPV ;flexcan_write (reg, ®s->mcr);/* Currently we only support newer versions of this core
[email protected]
maintainerPATCH 7/75 netfilter: x_tables: gpf inside xt_find_revision()
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Vasily Averin <[email protected]>
commit 8e24edddad152b998b37a7f583175137ed2e04a5 upstream.
nested target/match_revfn() calls work with xt[NFPROTO_UNSPEC] lists without taking xt[NFPROTO_UNSPEC].mutex. This can race with module unload and cause host to crash:
general protection fault: 0000 [#1] Modules linked in: ... [last unloaded: xt_cluster] CPU: 0 PID: 542455 Comm: iptables RIP: 0010:[<ffffffff8ffbd518>] [<ffffffff8ffbd518>] strcmp+0x18/0x40 RDX: 0000000000000003 RSI: ffff9a5a5d9abe10 RDI: dead000000000111 R13: ffff9a5a5d9abe10 R14: ffff9a5a5d9abd8c R15: dead000000000100 (VvS: %R15 -- &xt_match, %RDI -- &xt_match.name, xt_cluster unregister match in xt[NFPROTO_UNSPEC].match list) Call Trace: [<ffffffff902ccf44>] match_revfn+0x54/0xc0 [<ffffffff902ccf9f>] match_revfn+0xaf/0xc0 [<ffffffff902cd01e>] xt_find_revision+0x6e/0xf0 [<ffffffffc05a5be0>] do_ipt_get_ctl+0x100/0x420 [ip_tables] [<ffffffff902cc6bf>] nf_getsockopt+0x4f/0x70 [<ffffffff902dd99e>] ip_getsockopt+0xde/0x100 [<ffffffff903039b5>] raw_getsockopt+0x25/0x50 [<ffffffff9026c5da>] sock_common_getsockopt+0x1a/0x20 [<ffffffff9026b89d>] SyS_getsockopt+0x7d/0xf0 [<ffffffff903cbf92>] system_call_fastpath+0x25/0x2a
--- net/netfilter/x_tables.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
net/netfilter/x_tables.c +4 -2
@@ -271,6 +271,7 @@ static int match_revfn(u8 af, const charconst struct xt_match *m;int have_rev =0 ; +mutex_lock (&xt[af].mutex);list_for_each_entry (m, &xt[af].match, list) {if (strcmp (m->name, name) ==0 ) {if (m->revision > *bestp)
@@ -279,6 +280,7 @@ static int match_revfn(u8 af, const char have_rev =1 ; } } +mutex_unlock (&xt[af].mutex);if (af !=NFPROTO_UNSPEC && !have_rev)return match_revfn (NFPROTO_UNSPEC , name, revision, bestp);
@@ -291,6 +293,7 @@ static int target_revfn(u8 af, const chaconst struct xt_target *t;int have_rev =0 ; +mutex_lock (&xt[af].mutex);list_for_each_entry (t, &xt[af].target, list) {if (strcmp (t->name, name) ==0 ) {if (t->revision > *bestp)
@@ -299,6 +302,7 @@ static int target_revfn(u8 af, const cha have_rev =1 ; } } +mutex_unlock (&xt[af].mutex);if (af !=NFPROTO_UNSPEC && !have_rev)return target_revfn (NFPROTO_UNSPEC , name, revision, bestp);
@@ -312,12 +316,10 @@ int xt_find_revision(u8 af, const char * {int have_rev, best =-1 ; -mutex_lock (&xt[af].mutex);if (target ==1 ) have_rev =target_revfn (af, name, revision, &best);else have_rev =match_revfn (af, name, revision, &best); -mutex_unlock (&xt[af].mutex);/* Nothing at all? Return 0 to try loading module. */ if (best ==-1 ) {
[email protected]
maintainerPATCH 8/75 cifs: return proper error code in statfs(2)
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Paulo Alcantara <[email protected]>
commit 14302ee3301b3a77b331cc14efb95bf7184c73cc upstream.
In cifs_statfs(), if server->ops->queryfs is not NULL, then we should use its return value rather than always returning 0. Instead, use rc variable as it is properly set to 0 in case there is no server->ops->queryfs.
--- fs/cifs/cifsfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/cifs/cifsfs.c +1 -1
@@ -204,7 +204,7 @@ cifs_statfs(struct dentry *dentry, struc rc = server->ops->queryfs (xid, tcon, buf);free_xid (xid); -return 0 ; +return rc; }static long cifs_fallocate (struct file *file,int mode,loff_t off,loff_t len)
[email protected]
maintainerPATCH 9/75 floppy: fix lock_fdc() signal handling
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Jiri Kosina <[email protected]>
commit a0c80efe5956ccce9fe7ae5c78542578c07bc20a upstream.
floppy_revalidate() doesn't perform any error handling on lock_fdc() result. lock_fdc() might actually be interrupted by a signal (it waits for fdc becoming non-busy interruptibly). In such case, floppy_revalidate() proceeds as if it had claimed the lock, but it fact it doesn't.
In case of multiple threads trying to open("/dev/fdX"), this leads to serious corruptions all over the place, because all of a sudden there is no critical section protection (that'd otherwise be guaranteed by locked fd) whatsoever.
While at this, fix the fact that the 'interruptible' parameter to lock_fdc() doesn't make any sense whatsoever, because we always wait interruptibly anyway.
Most of the lock_fdc() callsites do properly handle error (and propagate EINTR), but floppy_revalidate() and floppy_check_events() don't. Fix this.
Spotted by 'syzkaller' tool.
--- drivers/block/floppy.c | 35 +++++++++++++++++++---------------- 1 file changed, 19 insertions(+), 16 deletions(-)
drivers/block/floppy.c +19 -16
@@ -870,7 +870,7 @@ static void set_fdc(int drive) }/* locks the driver */ -static int lock_fdc (int drive,bool interruptible) +static int lock_fdc (int drive) {if (WARN (atomic_read (&usage_count) ==0 ,"Trying to lock fdc while usage count=0\n" ))
@@ -2180,7 +2180,7 @@ static int do_format(int drive, struct f {int ret; -if (lock_fdc (drive, true)) +if (lock_fdc (drive))return -EINTR ;set_floppy (drive);
@@ -2967,7 +2967,7 @@ static int user_reset_fdc(int drive, int {int ret; -if (lock_fdc (drive, interruptible)) +if (lock_fdc (drive))return -EINTR ;if (arg ==FD_RESET_ALWAYS )
@@ -3254,7 +3254,7 @@ static int set_geometry(unsigned int cmdif (!capable (CAP_SYS_ADMIN ))return -EPERM ;mutex_lock (&open_lock); -if (lock_fdc (drive, true)) { +if (lock_fdc (drive)) {mutex_unlock (&open_lock);return -EINTR ; }
@@ -3274,7 +3274,7 @@ static int set_geometry(unsigned int cmd }else {int oldStretch; -if (lock_fdc (drive, true)) +if (lock_fdc (drive))return -EINTR ;if (cmd !=FDDEFPRM ) {/* notice a disk change immediately, else
@@ -3360,7 +3360,7 @@ static int get_floppy_geometry(int driveif (type) *g = &floppy_type[type];else { -if (lock_fdc (drive, false)) +if (lock_fdc (drive))return -EINTR ;if (poll_drive (false,0 ) == -EINTR )return -EINTR ;
@@ -3462,7 +3462,7 @@ static int fd_locked_ioctl(struct block_if (UDRS ->fd_ref !=1 )/* somebody else has this drive open */ return -EBUSY ; -if (lock_fdc (drive, true)) +if (lock_fdc (drive))return -EINTR ;/* do the actual eject. Fails on
@@ -3474,7 +3474,7 @@ static int fd_locked_ioctl(struct block_process_fd_request ();return ret;case FDCLRPRM : -if (lock_fdc (drive, true)) +if (lock_fdc (drive))return -EINTR ; current_type[drive] =NULL ; floppy_sizes[drive] =MAX_DISK_SIZE <<1 ;
@@ -3499,7 +3499,7 @@ static int fd_locked_ioctl(struct block_UDP ->flags &= ~FTD_MSG ;return 0 ;case FDFMTBEG : -if (lock_fdc (drive, true)) +if (lock_fdc (drive))return -EINTR ;if (poll_drive (true,FD_RAW_NEED_DISK ) == -EINTR )return -EINTR ;
@@ -3516,7 +3516,7 @@ static int fd_locked_ioctl(struct block_return do_format (drive, &inparam.f);case FDFMTEND :case FDFLUSH : -if (lock_fdc (drive, true)) +if (lock_fdc (drive))return -EINTR ;return invalidate_drive (bdev);case FDSETEMSGTRESH :
@@ -3542,7 +3542,7 @@ static int fd_locked_ioctl(struct block_ outparam =UDP ;break ;case FDPOLLDRVSTAT : -if (lock_fdc (drive, true)) +if (lock_fdc (drive))return -EINTR ;if (poll_drive (true,FD_RAW_NEED_DISK ) == -EINTR )return -EINTR ;
@@ -3565,7 +3565,7 @@ static int fd_locked_ioctl(struct block_case FDRAWCMD :if (type)return -EINVAL ; -if (lock_fdc (drive, true)) +if (lock_fdc (drive))return -EINTR ;set_floppy (drive); i =raw_cmd_ioctl (cmd, (void __user *)param);
@@ -3574,7 +3574,7 @@ static int fd_locked_ioctl(struct block_process_fd_request ();return i;case FDTWADDLE : -if (lock_fdc (drive, true)) +if (lock_fdc (drive))return -EINTR ;twaddle ();process_fd_request ();
@@ -3801,7 +3801,7 @@ static int compat_getdrvstat(int drive,mutex_lock (&floppy_mutex);if (poll) { -if (lock_fdc (drive, true)) +if (lock_fdc (drive)) goto Eintr;if (poll_drive (true,FD_RAW_NEED_DISK ) == -EINTR ) goto Eintr;
@@ -4109,7 +4109,8 @@ static unsigned int floppy_check_events(return DISK_EVENT_MEDIA_CHANGE ;if (time_after (jiffies,UDRS ->last_checked +UDP ->checkfreq)) { -lock_fdc (drive, false); +if (lock_fdc (drive)) +return -EINTR ;poll_drive (false,0 );process_fd_request (); }
@@ -4208,7 +4209,9 @@ static int floppy_revalidate(struct gend "VFS: revalidate called on non-open device.\n"))return -EFAULT ; -lock_fdc (drive, false); + res =lock_fdc (drive); +if (res) +return res; cf = (test_bit (FD_DISK_CHANGED_BIT , &UDRS ->flags) ||test_bit (FD_VERIFY_BIT , &UDRS ->flags));if (!(cf ||test_bit (drive, &fake_change) ||drive_no_geom (drive))) {
[email protected]
maintainerPATCH 10/75 Revert "mm, slub: consider rest of partial list if acquire_slab() fails"
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Linus Torvalds <[email protected]>
commit 9b1ea29bc0d7b94d420f96a0f4121403efc3dd85 upstream.
This reverts commit 8ff60eb052eeba95cfb3efe16b08c9199f8121cf.
The kernel test robot reports a huge performance regression due to the commit, and the reason seems fairly straightforward: when there is contention on the page list (which is what causes acquire_slab() to fail), we do _not_ want to just loop and try again, because that will transfer the contention to the 'n->list_lock' spinlock we hold, and just make things even worse.
This is admittedly likely a problem only on big machines - the kernel test robot report comes from a 96-thread dual socket Intel Xeon Gold 6252 setup, but the regression there really is quite noticeable:
-47.9% regression of stress-ng.rawpkt.ops_per_sec
and the commit that was marked as being fixed (7ced37197196: "slub:Acquire_slab() avoid loop") actually did the loop exit early very intentionally (the hint being that "avoid loop" part of that commit message), exactly to avoid this issue.
The correct thing to do may be to pick some kind of reasonable middle
ground: instead of breaking out of the loop on the very first sign of contention, or trying over and over and over again, the right thing may be to re-try _once_, and then give up on the second failure (or pick your favorite value for "once"..).
--- mm/slub.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
mm/slub.c +1 -1
@@ -1682,7 +1682,7 @@ static void *get_partial_node(struct kme t =acquire_slab (s, n, page, object ==NULL , &objects);if (!t) -continue ;/* cmpxchg raced */ +break ; available += objects;if (!object) {
[email protected]
maintainerPATCH 11/75 futex: Change locking rules
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Peter Zijlstra <[email protected]>
commit 734009e96d1983ad739e5b656e03430b3660c913 upstream.
This patch comes directly from an origin patch (commit dc3f2ff11740159080f2e8e359ae0ab57c8e74b6) in v4.9.
Currently futex-pi relies on hb->lock to serialize everything. But hb->lock creates another set of problems, especially priority inversions on RT where hb->lock becomes a rt_mutex itself.
The rt_mutex::wait_lock is the most obvious protection for keeping the futex user space value and the kernel internal pi_state in sync.
Rework and document the locking so rt_mutex::wait_lock is held accross all operations which modify the user space value and the pi state.
This allows to invoke rt_mutex_unlock() (including deboost) without holding hb->lock as a next step.
Nothing yet relies on the new locking rules.
--- kernel/futex.c | 138 ++++++++++++++++++++++++++++++++++++++++++++++----------- 1 file changed, 112 insertions(+), 26 deletions(-)
kernel/futex.c +112 -26
@@ -1016,6 +1016,39 @@ static void exit_pi_state_list(struct ta* [10] There is no transient state which leaves owner and user space * TID out of sync. Except one error case where the kernel is denied * write access to the user address, see fixup_pi_state_owner(). +* +* +* Serialization and lifetime rules: +* +* hb->lock: +* +* hb -> futex_q, relation +* futex_q -> pi_state, relation +* +* (cannot be raw because hb can contain arbitrary amount +* of futex_q's) +* +* pi_mutex->wait_lock: +* +* {uval, pi_state} +* +* (and pi_mutex 'obviously') +* +* p->pi_lock: +* +* p->pi_state_list -> pi_state->list, relation +* +* pi_state->refcount: +* +* pi_state lifetime +* +* +* Lock order: +* +* hb->lock +* pi_mutex->wait_lock +* p->pi_lock +* */ /*
@@ -1023,10 +1056,12 @@ static void exit_pi_state_list(struct ta* the pi_state against the user space value. If correct, attach to * it. */ -static int attach_to_pi_state (u32 uval,struct futex_pi_state *pi_state, +static int attach_to_pi_state (u32 __user *uaddr,u32 uval, +struct futex_pi_state *pi_state,struct futex_pi_state **ps) {pid_t pid = uval &FUTEX_TID_MASK ; +int ret, uval2;/* * Userspace might have messed up non-PI and PI futexes [3]
@@ -1034,9 +1069,34 @@ static int attach_to_pi_state(u32 uval,if (unlikely (!pi_state))return -EINVAL ; +/* +* We get here with hb->lock held, and having found a +* futex_top_waiter(). This means that futex_lock_pi() of said futex_q +* has dropped the hb->lock in between queue_me() and unqueue_me_pi(), +* which in turn means that futex_lock_pi() still has a reference on +* our pi_state. +*/ WARN_ON (!atomic_read (&pi_state->refcount));/* +* Now that we have a pi_state, we can acquire wait_lock +* and do the state validation. +*/ +raw_spin_lock_irq (&pi_state->pi_mutex.wait_lock); + +/* +* Since {uval, pi_state} is serialized by wait_lock, and our current +* uval was read without holding it, it can have changed. Verify it +* still is what we expect it to be, otherwise retry the entire +* operation. +*/ +if (get_futex_value_locked (&uval2, uaddr)) + goto out_efault; + +if (uval != uval2) + goto out_eagain; + +/* * Handle the owner died case: */ if (uval &FUTEX_OWNER_DIED ) {
@@ -1051,11 +1111,11 @@ static int attach_to_pi_state(u32 uval,* is not 0. Inconsistent state. [5] */ if (pid) -return -EINVAL ; + goto out_einval;/* * Take a ref on the state and return success. [4] */ - goto out_state; + goto out_attach; }/*
@@ -1067,14 +1127,14 @@ static int attach_to_pi_state(u32 uval,* Take a ref on the state and return success. [6] */ if (!pid) - goto out_state; + goto out_attach; }else {/* * If the owner died bit is not set, then the pi_state * must have an owner. [7] */ if (!pi_state->owner) -return -EINVAL ; + goto out_einval; }/*
@@ -1083,11 +1143,29 @@ static int attach_to_pi_state(u32 uval,* user space TID. [9/10] */ if (pid !=task_pid_vnr (pi_state->owner)) -return -EINVAL ; -out_state: + goto out_einval; + +out_attach:atomic_inc (&pi_state->refcount); +raw_spin_unlock_irq (&pi_state->pi_mutex.wait_lock); *ps = pi_state;return 0 ; + +out_einval: + ret = -EINVAL ; + goto out_error; + +out_eagain: + ret = -EAGAIN ; + goto out_error; + +out_efault: + ret = -EFAULT ; + goto out_error; + +out_error: +raw_spin_unlock_irq (&pi_state->pi_mutex.wait_lock); +return ret; }/**
@@ -1180,6 +1258,9 @@ static int attach_to_pi_owner(u32 uval,/* * No existing pi state. First waiter. [2] +* +* This creates pi_state, we have hb->lock held, this means nothing can +* observe this state, wait_lock is irrelevant. */ pi_state =alloc_pi_state ();
@@ -1204,7 +1285,8 @@ static int attach_to_pi_owner(u32 uval,return 0 ; } -static int lookup_pi_state (u32 uval,struct futex_hash_bucket *hb, +static int lookup_pi_state (u32 __user *uaddr,u32 uval, +struct futex_hash_bucket *hb,union futex_key *key,struct futex_pi_state **ps,struct task_struct **exiting) {
@@ -1215,7 +1297,7 @@ static int lookup_pi_state(u32 uval, str* attach to the pi_state when the validation succeeds. */ if (match) -return attach_to_pi_state (uval, match->pi_state, ps); +return attach_to_pi_state (uaddr, uval, match->pi_state, ps);/* * We are the first waiter - try to look up the owner based on
@@ -1234,7 +1316,7 @@ static int lock_pi_update_atomic(u32 __uif (unlikely (cmpxchg_futex_value_locked (&curval, uaddr, uval, newval)))return -EFAULT ; -/*If user space value changed, let the caller retry */ +/* If user space value changed, let the caller retry */ return curval != uval ? -EAGAIN :0 ; }
@@ -1298,7 +1380,7 @@ static int futex_lock_pi_atomic(u32 __us*/ match =futex_top_waiter (hb, key);if (match) -return attach_to_pi_state (uval, match->pi_state, ps); +return attach_to_pi_state (uaddr, uval, match->pi_state, ps);/* * No waiter and user TID is 0. We are here because the
@@ -1438,6 +1520,7 @@ static int wake_futex_pi(u32 __user *uadif (cmpxchg_futex_value_locked (&curval, uaddr, uval, newval)) { ret = -EFAULT ; + }else if (curval != uval) {/* * If a unconditional UNLOCK_PI operation (user space did not
@@ -1971,7 +2054,7 @@ retry_private:* rereading and handing potential crap to * lookup_pi_state. */ - ret =lookup_pi_state (ret, hb2, &key2, + ret =lookup_pi_state (uaddr2, ret, hb2, &key2, &pi_state, &exiting); }
@@ -2249,7 +2332,6 @@ static int __fixup_pi_state_owner(u32 __int err =0 ; oldowner = pi_state->owner; -/* * We are here because either: *
@@ -2268,11 +2350,10 @@ static int __fixup_pi_state_owner(u32 __* because we can fault here. Imagine swapped out pages or a fork * that marked all the anonymous memory readonly for cow. * -* Modifying pi_state _before_ the user space value would -* leave the pi_state in an inconsistent state when we fault -* here, because we need to drop the hash bucket lock to -* handle the fault. This might be observed in the PID check -* in lookup_pi_state. +* Modifying pi_state _before_ the user space value would leave the +* pi_state in an inconsistent state when we fault here, because we +* need to drop the locks to handle the fault. This might be observed +* in the PID check in lookup_pi_state. */ retry:if (!argowner) {
@@ -2333,21 +2414,26 @@ retry:return argowner == current;/* -* To handle the page fault we need to drop the hash bucket -* lock here. That gives the other task (either the highest priority -* waiter itself or the task which stole the rtmutex) the -* chance to try the fixup of the pi_state. So once we are -* back from handling the fault we need to check the pi_state -* after reacquiring the hash bucket lock and before trying to -* do another fixup. When the fixup has been done already we -* simply return. +* To handle the page fault we need to drop the locks here. That gives +* the other task (either the highest priority waiter itself or the +* task which stole the rtmutex) the chance to try the fixup of the +* pi_state. So once we are back from handling the fault we need to +* check the pi_state after reacquiring the locks and before trying to +* do another fixup. When the fixup has been done already we simply +* return. +* +* Note: we hold both hb->lock and pi_mutex->wait_lock. We can safely +* drop hb->lock since the caller owns the hb -> futex_q relation. +* Dropping the pi_mutex->wait_lock requires the state revalidate. */ handle_fault: +raw_spin_unlock_irq (&pi_state->pi_mutex.wait_lock);spin_unlock (q->lock_ptr); err =fault_in_user_writeable (uaddr);spin_lock (q->lock_ptr); +raw_spin_lock_irq (&pi_state->pi_mutex.wait_lock);/* * Check if someone else fixed it for us:
[email protected]
maintainerPATCH 12/75 futex: Cure exit race
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Thomas Gleixner <[email protected]>
commit da791a667536bf8322042e38ca85d55a78d3c273 upstream.
This patch comes directly from an origin patch (commit 9c3f3986036760c48a92f04b36774aa9f63673f80) in v4.9.
Stefan reported, that the glibc tst-robustpi4 test case fails occasionally. That case creates the following race between sys_exit() and sys_futex_lock_pi():
CPU0 CPU1
sys_exit() sys_futex()
do_exit() futex_lock_pi()
exit_signals(tsk) No waiters:
tsk->flags |= PF_EXITING; *uaddr == 0x00000PID
mm_release(tsk) Set waiter bit
exit_robust_list(tsk) { *uaddr = 0x80000PID;
Set owner died attach_to_pi_owner() {
*uaddr = 0xC0000000; tsk = get_task(PID);
} if (!tsk->flags & PF_EXITING) {
... attach();
tsk->flags |= PF_EXITPIDONE; } else {
if (!(tsk->flags & PF_EXITPIDONE))
return -EAGAIN;
return -ESRCH; <--- FAIL
}ESRCH is returned all the way to user space, which triggers the glibc test case assert. Returning ESRCH unconditionally is wrong here because the user space value has been changed by the exiting task to 0xC0000000, i.e. the FUTEX_OWNER_DIED bit is set and the futex PID value has been cleared. This is a valid state and the kernel has to handle it, i.e. taking the futex.
Cure it by rereading the user space value when PF_EXITING and PF_EXITPIDONE is set in the task which 'owns' the futex. If the value has changed, let the kernel retry the operation, which includes all regular sanity checks and correctly handles the FUTEX_OWNER_DIED case.
If it hasn't changed, then return ESRCH as there is no way to distinguish this case from malfunctioning user space. This happens when the exiting task did not have a robust list, the robust list was corrupted or the user space value in the futex was simply bogus.
[Lee: Required to satisfy functional dependency from futex back-port.
Re-add the missing handle_exit_race() parts from:
3d4775df0a89 ("futex: Replace PF_EXITPIDONE with a state")]
--- kernel/futex.c | 71 ++++++++++++++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 65 insertions(+), 6 deletions(-)
kernel/futex.c +65 -6
@@ -1198,11 +1198,67 @@ static void wait_for_owner_exiting(int rput_task_struct (exiting); } +static int handle_exit_race (u32 __user *uaddr,u32 uval, +struct task_struct *tsk) +{ +u32 uval2; + +/* +* If the futex exit state is not yet FUTEX_STATE_DEAD, wait +* for it to finish. +*/ +if (tsk && tsk->futex_state !=FUTEX_STATE_DEAD ) +return -EAGAIN ; + +/* +* Reread the user space value to handle the following situation: +* +* CPU0 CPU1 +* +* sys_exit() sys_futex() +* do_exit() futex_lock_pi() +* futex_lock_pi_atomic() +* exit_signals(tsk) No waiters: +* tsk->flags |= PF_EXITING; *uaddr == 0x00000PID +* mm_release(tsk) Set waiter bit +* exit_robust_list(tsk) { *uaddr = 0x80000PID; +* Set owner died attach_to_pi_owner() { +* *uaddr = 0xC0000000; tsk = get_task(PID); +* } if (!tsk->flags & PF_EXITING) { +* ... attach(); +* tsk->futex_state = } else { +* FUTEX_STATE_DEAD; if (tsk->futex_state != +* FUTEX_STATE_DEAD) +* return -EAGAIN; +* return -ESRCH; <--- FAIL +* } +* +* Returning ESRCH unconditionally is wrong here because the +* user space value has been changed by the exiting task. +* +* The same logic applies to the case where the exiting task is +* already gone. +*/ +if (get_futex_value_locked (&uval2, uaddr)) +return -EFAULT ; + +/* If the user space value has changed, try again. */ +if (uval2 != uval) +return -EAGAIN ; + +/* +* The exiting task did not have a robust list, the robust list was +* corrupted or the user space value in *uaddr is simply bogus. +* Give up and tell user space. +*/ +return -ESRCH ; +} +/* * Lookup the task for the TID provided from user space and attach to * it after doing proper sanity checks. */ -static int attach_to_pi_owner (u32 uval,union futex_key *key, +static int attach_to_pi_owner (u32 __user *uaddr,u32 uval,union futex_key *key,struct futex_pi_state **ps,struct task_struct **exiting) {
@@ -1213,12 +1269,15 @@ static int attach_to_pi_owner(u32 uval,/* * We are the first waiter - try to look up the real owner and attach * the new pi_state to it, but bail out when TID = 0 [1] +* +* The !pid check is paranoid. None of the call sites should end up +* with pid == 0, but better safe than sorry. Let the caller retry */ if (!pid) -return -ESRCH ; +return -EAGAIN ; p =futex_find_get_task (pid);if (!p) -return -ESRCH ; +return handle_exit_race (uaddr, uval,NULL );if (unlikely (p->flags &PF_KTHREAD )) {put_task_struct (p);
@@ -1237,7 +1296,7 @@ static int attach_to_pi_owner(u32 uval,* FUTEX_STATE_DEAD, we know that the task has finished * the cleanup: */ -int ret = (p->futex_state =FUTEX_STATE_DEAD ) ? -ESRCH : -EAGAIN ; +int ret =handle_exit_race (uaddr, uval, p);raw_spin_unlock_irq (&p->pi_lock);/*
@@ -1303,7 +1362,7 @@ static int lookup_pi_state(u32 __user *u* We are the first waiter - try to look up the owner based on * @uval and attach to it. */ -return attach_to_pi_owner (uval, key, ps, exiting); +return attach_to_pi_owner (uaddr, uval, key, ps, exiting); }static int lock_pi_update_atomic (u32 __user *uaddr,u32 uval,u32 newval)
@@ -1419,7 +1478,7 @@ static int futex_lock_pi_atomic(u32 __us* attach to the owner. If that fails, no harm done, we only * set the FUTEX_WAITERS bit in the user space variable. */ -return attach_to_pi_owner (uval, key, ps, exiting); +return attach_to_pi_owner (uaddr, newval, key, ps, exiting); }/**
[email protected]
maintainerPATCH 13/75 futex: fix dead code in attach_to_pi_owner()
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Thomas Gleixner <[email protected]>
This patch comes directly from an origin patch (commit 91509e84949fc97e7424521c32a9e227746e0b85) in v4.9. And it is part of a full patch which was originally back-ported to v4.14 as commit e6e00df182908f34360c3c9f2d13cc719362e9c0
The handle_exit_race() function is defined in commit 9c3f39860367
("futex: Cure exit race"), which never returns -EBUSY. This results
in a small piece of dead code in the attach_to_pi_owner() function:
int ret = handle_exit_race(uaddr, uval, p); /* Never return -EBUSY */ ... if (ret == -EBUSY) *exiting = p; /* dead code */
The return value -EBUSY is added to handle_exit_race() in upsteam commit ac31c7ff8624409 ("futex: Provide distinct return value when owner is exiting"). This commit was incorporated into v4.9.255, before the function handle_exit_race() was introduced, whitout Modify handle_exit_race().
To fix dead code, extract the change of handle_exit_race() from commit ac31c7ff8624409 ("futex: Provide distinct return value when owner
is exiting"), re-incorporated.
Lee writes:
This commit takes the remaining functional snippet of:
ac31c7ff8624409 ("futex: Provide distinct return value when owner is exiting")
... and is the correct fix for this issue.
--- kernel/futex.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
kernel/futex.c +3 -3
@@ -1204,11 +1204,11 @@ static int handle_exit_race(u32 __user *u32 uval2;/* -* If the futex exit state is not yet FUTEX_STATE_DEAD, wait -* for it to finish. +* If the futex exit state is not yet FUTEX_STATE_DEAD, tell the +* caller that the alleged owner is busy. */ if (tsk && tsk->futex_state !=FUTEX_STATE_DEAD ) -return -EAGAIN ; +return -EBUSY ;/* * Reread the user space value to handle the following situation:
[email protected]
maintainerPATCH 14/75 net/mlx4_en: update moderation when config reset
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Kevin(Yudong) Yang <[email protected]>
commit 00ff801bb8ce6711e919af4530b6ffa14a22390a upstream.
This patch fixes a bug that the moderation config will not be applied when calling mlx4_en_reset_config. For example, when turning on rx timestamping, mlx4_en_reset_config() will be called, causing the NIC to forget previous moderation config.
This fix is in phase with a previous fix:
commit 79c54b6bbf06 ("net/mlx4_en: Fix TX moderation info loss after set_ringparam is called")
Tested: Before this patch, on a host with NIC using mlx4, run netserver and stream TCP to the host at full utilization.
$ sar -I SUM 1
INTR intr/s
14:03:56 sum 48758.00After rx hwtstamp is enabled:
$ sar -I SUM 1 14:10:38 sum 317771.00 We see the moderation is not working properly and issued 7x more interrupts.
After the patch, and turned on rx hwtstamp, the rate of interrupts is as expected:
$ sar -I SUM 1 14:52:11 sum 49332.00
--- drivers/net/ethernet/mellanox/mlx4/en_ethtool.c | 2 +- drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 2 ++ drivers/net/ethernet/mellanox/mlx4/mlx4_en.h | 1 + 3 files changed, 4 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx4/en_ethtool.c +1 -1
@@ -47,7 +47,7 @@#define EN_ETHTOOL_SHORT_MASK cpu_to_be16(0xffff)#define EN_ETHTOOL_WORD_MASK cpu_to_be32(0xffffffff) -static int mlx4_en_moderation_update (struct mlx4_en_priv *priv) +int mlx4_en_moderation_update (struct mlx4_en_priv *priv) {int i;int err =0 ;
drivers/net/ethernet/mellanox/mlx4/en_netdev.c +2 -0
@@ -3188,6 +3188,8 @@ int mlx4_en_reset_config(struct net_devien_err (priv,"Failed starting port\n" ); } +if (!err) + err =mlx4_en_moderation_update (priv); out:mutex_unlock (&mdev->state_lock);netdev_features_change (dev);
drivers/net/ethernet/mellanox/mlx4/mlx4_en.h +1 -0
@@ -839,6 +839,7 @@ void mlx4_en_ptp_overflow_check(struct m#define DEV_FEATURE_CHANGED (dev, new_features, feature) \ ((dev->features & feature) ^ (new_features & feature)) +int mlx4_en_moderation_update (struct mlx4_en_priv *priv);int mlx4_en_reset_config (struct net_device *dev,struct hwtstamp_config ts_config,netdev_features_t new_features);
[email protected]
maintainerPATCH 15/75 net: lapbether: Remove netif_start_queue / netif_stop_queue
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Xie He <[email protected]>
commit f7d9d4854519fdf4d45c70a4d953438cd88e7e58 upstream.
For the devices in this driver, the default qdisc is "noqueue", because their "tx_queue_len" is 0.
In function "__dev_queue_xmit" in "net/core/dev.c", devices with the "noqueue" qdisc are specially handled. Packets are transmitted without being queued after a "dev->flags & IFF_UP" check. However, it's possible that even if this check succeeds, "ops->ndo_stop" may still have already been called. This is because in "__dev_close_many", "ops->ndo_stop" is called before clearing the "IFF_UP" flag.
If we call "netif_stop_queue" in "ops->ndo_stop", then it's possible in "__dev_queue_xmit", it sees the "IFF_UP" flag is present, and then it checks "netif_xmit_stopped" and finds that the queue is already stopped. In this case, it will complain that:
"Virtual device ... asks to queue packet!"
To prevent "__dev_queue_xmit" from generating this complaint, we should not call "netif_stop_queue" in "ops->ndo_stop".
We also don't need to call "netif_start_queue" in "ops->ndo_open", because after a netdev is allocated and registered, the "__QUEUE_STATE_DRV_XOFF" flag is initially not set, so there is no need to call "netif_start_queue" to clear it.
--- drivers/net/wan/lapbether.c | 3 --- 1 file changed, 3 deletions(-)
drivers/net/wan/lapbether.c +0 -3
@@ -286,7 +286,6 @@ static int lapbeth_open(struct net_devicreturn -ENODEV ; } -netif_start_queue (dev);return 0 ; }
@@ -294,8 +293,6 @@ static int lapbeth_close(struct net_devi {int err; -netif_stop_queue (dev); -if ((err =lapb_unregister (dev)) !=LAPB_OK )pr_err ("lapb_unregister error: %d\n" , err);
[email protected]
maintainerPATCH 16/75 net: davicom: Fix regulator not turned off on failed probe
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Paul Cercueil <[email protected]>
commit ac88c531a5b38877eba2365a3f28f0c8b513dc33 upstream.
When the probe fails or requests to be defered, we must disable the regulator that was previously enabled.
--- drivers/net/ethernet/davicom/dm9000.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
drivers/net/ethernet/davicom/dm9000.c +9 -3
@@ -1462,7 +1462,7 @@ dm9000_probe(struct platform_device *pdeif (ret) {dev_err (dev,"failed to request reset gpio %d: %d\n" , reset_gpios, ret); -return -ENODEV ; + goto out_regulator_disable; }/* According to manual PWRST# Low Period Min 1ms */
@@ -1474,8 +1474,10 @@ dm9000_probe(struct platform_device *pdeif (!pdata) { pdata =dm9000_parse_dt (&pdev->dev); -if (IS_ERR (pdata)) -return PTR_ERR (pdata); +if (IS_ERR (pdata)) { + ret =PTR_ERR (pdata); + goto out_regulator_disable; + } }/* Init network device */
@@ -1710,6 +1712,10 @@ out:dm9000_release_board (pdev, db);free_netdev (ndev); +out_regulator_disable: +if (!IS_ERR (power)) +regulator_disable (power); +return ret; }
[email protected]
maintainerPATCH 17/75 net: davicom: Fix regulator not turned off on driver removal
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Paul Cercueil <[email protected]>
commit cf9e60aa69ae6c40d3e3e4c94dd6c8de31674e9b upstream.
We must disable the regulator that was enabled in the probe function.
--- drivers/net/ethernet/davicom/dm9000.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/net/ethernet/davicom/dm9000.c +8 -1
@@ -144,6 +144,8 @@ struct board_info {u32 wake_state;int ip_summed; + +struct regulator *power_supply; };/* debug code */
@@ -1494,6 +1496,8 @@ dm9000_probe(struct platform_device *pde db->dev = &pdev->dev; db->ndev = ndev; +if (!IS_ERR (power)) + db->power_supply = power;spin_lock_init (&db->lock);mutex_init (&db->addr_lock);
@@ -1775,10 +1779,13 @@ static int dm9000_drv_remove(struct platform_device *pdev) {struct net_device *ndev =platform_get_drvdata (pdev); +struct board_info *dm =to_dm9000_board (ndev);unregister_netdev (ndev); -dm9000_release_board (pdev,netdev_priv (ndev)); +dm9000_release_board (pdev, dm);free_netdev (ndev);/* free device structure */ +if (dm->power_supply) +regulator_disable (dm->power_supply);dev_dbg (&pdev->dev,"released and freed device\n" );return 0 ;
[email protected]
maintainerPATCH 18/75 media: usbtv: Fix deadlock on suspend
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Maxim Mikityanskiy <[email protected]>
commit 8a7e27fd5cd696ba564a3f62cedef7269cfd0723 upstream.
usbtv doesn't support power management, so on system suspend the .disconnect callback of the driver is called. The teardown sequence includes a call to snd_card_free. Its implementation waits until the refcount of the sound card device drops to zero, however, if its file is open, snd_card_file_add takes a reference, which can't be dropped during the suspend, because the userspace processes are already frozen at this point. snd_card_free waits for completion forever, leading to a hang on suspend.
This commit fixes this deadlock condition by replacing snd_card_free with snd_card_free_when_closed, that doesn't wait until all references are released, allowing suspend to progress.
--- drivers/media/usb/usbtv/usbtv-audio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/usb/usbtv/usbtv-audio.c +1 -1
@@ -384,7 +384,7 @@ void usbtv_audio_free(struct usbtv *usbtcancel_work_sync (&usbtv->snd_trigger);if (usbtv->snd && usbtv->udev) { -snd_card_free (usbtv->snd); +snd_card_free_when_closed (usbtv->snd); usbtv->snd =NULL ; } }
[email protected]
maintainerPATCH 19/75 mmc: mxs-mmc: Fix a resource leak in an error handling path in mxs_mmc_probe()
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Christophe JAILLET <[email protected]>
[ Upstream commit 0bb7e560f821c7770973a94e346654c4bdccd42c ]
If 'mmc_of_parse()' fails, we must undo the previous 'dma_request_chan()' call.
--- drivers/mmc/host/mxs-mmc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mmc/host/mxs-mmc.c +1 -1
@@ -651,7 +651,7 @@ static int mxs_mmc_probe(struct platform_device *pdev) ret =mmc_of_parse (mmc);if (ret) - goto out_clk_disable; + goto out_free_dma; mmc->ocr_avail =MMC_VDD_32_33 |MMC_VDD_33_34 ;
Signature · 1 line
2.30.1
[email protected]
maintainerPATCH 20/75 mmc: mediatek: fix race condition between msdc_request_timeout and irq
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Chaotian Jing <[email protected]>
[ Upstream commit 0354ca6edd464a2cf332f390581977b8699ed081 ]
when get request SW timeout, if CMD/DAT xfer done irq coming right now, then there is race between the msdc_request_timeout work and irq handler, and the host->cmd and host->data may set to NULL in irq handler. also, current flow ensure that only one path can go to msdc_request_done(), so no need check the return value of cancel_delayed_work().
--- drivers/mmc/host/mtk-sd.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-)
drivers/mmc/host/mtk-sd.c +10 -8
@@ -720,13 +720,13 @@ static void msdc_track_cmd_data(struct msdc_host *host,static void msdc_request_done (struct msdc_host *host,struct mmc_request *mrq) {unsigned long flags; -bool ret; - ret =cancel_delayed_work (&host->req_timeout); -if (!ret) { -/* delay work already running */ -return ; - } +/* +* No need check the return value of cancel_delayed_work, as only ONE +* path will go here! +*/ +cancel_delayed_work (&host->req_timeout); +spin_lock_irqsave (&host->lock, flags); host->mrq =NULL ;spin_unlock_irqrestore (&host->lock, flags);
@@ -747,7 +747,7 @@ static bool msdc_cmd_done(struct msdc_host *host, int events,bool done = false;bool sbc_error;unsigned long flags; -u32 *rsp = cmd->resp; +u32 *rsp; if (mrq->sbc && cmd == mrq->cmd && (events & (MSDC_INT_ACMDRDY | MSDC_INT_ACMDCRCERR
@@ -768,6 +768,7 @@ static bool msdc_cmd_done(struct msdc_host *host, int events,if (done)return true; + rsp = cmd->resp;sdr_clr_bits (host->base +MSDC_INTEN , cmd_ints_mask);
@@ -942,7 +943,7 @@ static void msdc_data_xfer_next(struct msdc_host *host,static bool msdc_data_xfer_done (struct msdc_host *host,u32 events,struct mmc_request *mrq,struct mmc_data *data) { -struct mmc_command *stop = data->stop; +struct mmc_command *stop;unsigned long flags;bool done; unsigned int check_data = events &
@@ -958,6 +959,7 @@ static bool msdc_data_xfer_done(struct msdc_host *host, u32 events,if (done)return true; + stop = data->stop;if (check_data || (stop && stop->error)) { dev_dbg(host->dev, "DMA status: 0x%8X\n",
Signature · 1 line
2.30.1
[email protected]
maintainerPATCH 21/75 powerpc/perf: Record counter overflow always if SAMPLE_IP is unset
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Athira Rajeev <[email protected]>
[ Upstream commit d137845c973147a22622cc76c7b0bc16f6206323 ]
While sampling for marked events, currently we record the sample only if the SIAR valid bit of Sampled Instruction Event Register (SIER) is set. SIAR_VALID bit is used for fetching the instruction address from Sampled Instruction Address Register(SIAR). But there are some usecases, where the user is interested only in the PMU stats at each counter overflow and the exact IP of the overflow event is not required. Dropping SIAR invalid samples will fail to record some of the counter overflows in such cases.
Example of such usecase is dumping the PMU stats (event counts) after some regular amount of instructions/events from the userspace (ex: via ptrace). Here counter overflow is indicated to userspace via signal handler, and captured by monitoring and enabling I/O signaling on the event file descriptor. In these cases, we expect to get sample/overflow indication after each specified sample_period.
Perf event attribute will not have PERF_SAMPLE_IP set in the sample_type if exact IP of the overflow event is not requested. So while profiling if SAMPLE_IP is not set, just record the counter overflow irrespective of SIAR_VALID check.
--- arch/powerpc/perf/core-book3s.c | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-)
arch/powerpc/perf/core-book3s.c +15 -4
@@ -2008,7 +2008,17 @@ static void record_and_restart(struct perf_event *event, unsigned long val, left += period;if (left <=0 ) left = period; - record =siar_valid (regs); + +/* +* If address is not requested in the sample via +* PERF_SAMPLE_IP, just record that sample irrespective +* of SIAR valid check. +*/ +if (event->attr.sample_type &PERF_SAMPLE_IP ) + record =siar_valid (regs); +else + record =1 ; + event->hw.last_period = event->hw.sample_period; }if (left <0x80000000LL )
@@ -2026,9 +2036,10 @@ static void record_and_restart(struct perf_event *event, unsigned long val,* MMCR2. Check attr.exclude_kernel and address to drop the sample in * these cases. */ -if (event->attr.exclude_kernel && record) -if (is_kernel_addr (mfspr (SPRN_SIAR ))) - record =0 ; +if (event->attr.exclude_kernel && + (event->attr.sample_type &PERF_SAMPLE_IP ) && +is_kernel_addr (mfspr (SPRN_SIAR ))) + record =0 ;/* * Finally record data if requested.
Signature · 1 line
2.30.1
[email protected]
maintainerPATCH 22/75 PCI: xgene-msi: Fix race in installing chained irq handler
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Martin Kaiser <[email protected]>
[ Upstream commit a93c00e5f975f23592895b7e83f35de2d36b7633 ]
Fix a race where a pending interrupt could be received and the handler called before the handler's data has been setup, by converting to irq_set_chained_handler_and_data().
See also 2cf5a03cb29d ("PCI/keystone: Fix race in installing chained IRQ handler").
Based on the mail discussion, it seems ok to drop the error handling.
--- drivers/pci/host/pci-xgene-msi.c | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-)
drivers/pci/host/pci-xgene-msi.c +3 -7
@@ -393,13 +393,9 @@ static int xgene_msi_hwirq_alloc(unsigned int cpu)if (!msi_group->gic_irq)continue ; -irq_set_chained_handler (msi_group->gic_irq, - xgene_msi_isr); - err =irq_set_handler_data (msi_group->gic_irq, msi_group); -if (err) { -pr_err ("failed to register GIC IRQ handler\n" ); -return -EINVAL ; - } +irq_set_chained_handler_and_data (msi_group->gic_irq, + xgene_msi_isr, msi_group); +/* * Statically allocate MSI GIC IRQs to each CPU core. * With 8-core X-Gene v1, 2 MSI GIC IRQs are allocated
Signature · 1 line
2.30.1
[email protected]
maintainerPATCH 23/75 s390/smp: __smp_rescan_cpus() - move cpumask away from stack
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Heiko Carstens <[email protected]>
[ Upstream commit 62c8dca9e194326802b43c60763f856d782b225c ]
Avoid a potentially large stack frame and overflow by making "cpumask_t avail" a static variable. There is no concurrent access due to the existing locking.
--- arch/s390/kernel/smp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/s390/kernel/smp.c +1 -1
@@ -738,7 +738,7 @@ static int smp_add_core(struct sclp_core_entry *core, cpumask_t *avail,static int __smp_rescan_cpus (struct sclp_core_info *info,bool early) {struct sclp_core_entry *core; -cpumask_t avail; +static cpumask_t avail;bool configured;u16 core_id;int nr, i;
Signature · 1 line
2.30.1
[email protected]
maintainerPATCH 24/75 scsi: libiscsi: Fix iscsi_prep_scsi_cmd_pdu() error handling
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Mike Christie <[email protected]>
[ Upstream commit d28d48c699779973ab9a3bd0e5acfa112bd4fdef ]
If iscsi_prep_scsi_cmd_pdu() fails we try to add it back to the cmdqueue, but we leave it partially setup. We don't have functions that can undo the pdu and init task setup. We only have cleanup_task which can clean up both parts. So this has us just fail the cmd and go through the standard cleanup routine and then have the SCSI midlayer retry it like is done when it fails in the queuecommand path.
--- drivers/scsi/libiscsi.c | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-)
drivers/scsi/libiscsi.c +3 -8
@@ -1568,14 +1568,9 @@ static int iscsi_data_xmit(struct iscsi_conn *conn) } rc =iscsi_prep_scsi_cmd_pdu (conn->task);if (rc) { -if (rc == -ENOMEM || rc == -EACCES ) { -spin_lock_bh (&conn->taskqueuelock); -list_add_tail (&conn->task->running, - &conn->cmdqueue); - conn->task =NULL ; -spin_unlock_bh (&conn->taskqueuelock); - goto done; - }else +if (rc == -ENOMEM || rc == -EACCES ) +fail_scsi_task (conn->task,DID_IMM_RETRY ); +else fail_scsi_task (conn->task,DID_ABORT );spin_lock_bh (&conn->taskqueuelock);continue ;
Signature · 1 line
2.30.1
[email protected]
maintainerPATCH 25/75 ALSA: hda/hdmi: Cancel pending works before suspend
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Takashi Iwai <[email protected]>
commit eea46a0879bcca23e15071f9968c0f6e6596e470 upstream.
The per_pin->work might be still floating at the suspend, and this may hit the access to the hardware at an unexpected timing. Cancel the work properly at the suspend callback for avoiding the buggy access.
Note that the bug doesn't trigger easily in the recent kernels since the work is queued only when the repoll count is set, and usually it's only at the resume callback, but it's still possible to hit in theory.
--- sound/pci/hda/patch_hdmi.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
sound/pci/hda/patch_hdmi.c +13 -0
@@ -2239,6 +2239,18 @@ static void generic_hdmi_free(struct hda }#ifdef CONFIG_PM +static int generic_hdmi_suspend (struct hda_codec *codec) +{ +struct hdmi_spec *spec = codec->spec; +int pin_idx; + +for (pin_idx =0 ; pin_idx < spec->num_pins; pin_idx++) { +struct hdmi_spec_per_pin *per_pin =get_pin (spec, pin_idx); +cancel_delayed_work_sync (&per_pin->work); + } +return 0 ; +} +static int generic_hdmi_resume (struct hda_codec *codec) {struct hdmi_spec *spec = codec->spec;
@@ -2262,6 +2274,7 @@ static const struct hda_codec_ops generi .build_controls = generic_hdmi_build_controls, .unsol_event = hdmi_unsol_event, #ifdef CONFIG_PM + .suspend = generic_hdmi_suspend, .resume = generic_hdmi_resume,#endif };
[email protected]
maintainerPATCH 26/75 ALSA: hda: Avoid spurious unsol event handling during S3/S4
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Takashi Iwai <[email protected]>
commit 5ff9dde42e8c72ed8102eb8cb62e03f9dc2103ab upstream.
When HD-audio bus receives unsolicited events during its system suspend/resume (S3 and S4) phase, the controller driver may still try to process events although the codec chips are already (or yet) powered down. This might screw up the codec communication, resulting in CORB/RIRB errors. Such events should be rather skipped, as the codec chip status such as the jack status will be fully refreshed at the system resume time.
Since we're tracking the system suspend/resume state in codec power.power_state field, let's add the check in the common unsol event handler entry point to filter out such events.
--- sound/pci/hda/hda_bind.c | 4 ++++ 1 file changed, 4 insertions(+)
sound/pci/hda/hda_bind.c +4 -0
@@ -46,6 +46,10 @@ static void hda_codec_unsol_event(structif (codec->bus->shutdown)return ; +/* ignore unsol events during system suspend/resume */ +if (codec->core.dev.power.power_state.event !=PM_EVENT_ON ) +return ; +if (codec->patch_ops.unsol_event) codec->patch_ops.unsol_event (codec, ev); }
[email protected]
maintainerPATCH 27/75 ALSA: usb-audio: Fix "cannot get freq eq" errors on Dell AE515 sound bar
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Takashi Iwai <[email protected]>
commit fec60c3bc5d1713db2727cdffc638d48f9c07dc3 upstream.
Dell AE515 sound bar (413c:a506) spews the error messages when the driver tries to read the current sample frequency, hence it needs to be on the list in snd_usb_get_sample_rate_quirk().
--- sound/usb/quirks.c | 1 + 1 file changed, 1 insertion(+)
sound/usb/quirks.c +1 -0
@@ -1154,6 +1154,7 @@ bool snd_usb_get_sample_rate_quirk(struccase USB_ID (0x1de7 ,0x0114 ):/* Phoenix Audio MT202pcs */ case USB_ID (0x21B4 ,0x0081 ):/* AudioQuest DragonFly */ case USB_ID (0x2912 ,0x30c8 ):/* Audioengine D1 */ +case USB_ID (0x413c ,0xa506 ):/* Dell AE515 sound bar */ return true; }return false;
[email protected]
maintainerPATCH 28/75 s390/dasd: fix hanging DASD driver unbind
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Stefan Haberland <[email protected]>
commit 7d365bd0bff3c0310c39ebaffc9a8458e036d666 upstream.
In case of an unbind of the DASD device driver the function dasd_generic_remove() is called which shuts down the device. Among others this functions removes the int_handler from the cdev. During shutdown the device cancels all outstanding IO requests and waits for completion of the clear request.
Unfortunately the clear interrupt will never be received when there is no interrupt handler connected.
Fix by moving the int_handler removal after the call to the state machine where no request or interrupt is outstanding.
--- drivers/s390/block/dasd.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/s390/block/dasd.c +1 -2
@@ -3286,8 +3286,6 @@ void dasd_generic_remove(struct ccw_devistruct dasd_device *device;struct dasd_block *block; - cdev->handler =NULL ; - device =dasd_device_from_cdev (cdev);if (IS_ERR (device)) {dasd_remove_sysfs_files (cdev);
@@ -3306,6 +3304,7 @@ void dasd_generic_remove(struct ccw_devi* no quite down yet. */ dasd_set_target_state (device,DASD_STATE_NEW ); + cdev->handler =NULL ;/* dasd_delete_device destroys the device reference. */ block = device->block;dasd_delete_device (device);
[email protected]
maintainerPATCH 29/75 mmc: core: Fix partition switch time for eMMC
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Adrian Hunter <[email protected]>
commit 66fbacccbab91e6e55d9c8f1fc0910a8eb6c81f7 upstream.
Avoid the following warning by always defining partition switch time:
[ 3.209874] mmc1: unspecified timeout for CMD6 - use generic [ 3.222780] ------------[ cut here ]------------ [ 3.233363] WARNING: CPU: 1 PID: 111 at drivers/mmc/core/mmc_ops.c:575 __mmc_switch+0x200/0x204
--- drivers/mmc/core/mmc.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
drivers/mmc/core/mmc.c +11 -4
@@ -400,10 +400,6 @@ static int mmc_decode_ext_csd(struct mmc/* EXT_CSD value is in units of 10ms, but we store in ms */ card->ext_csd.part_time =10 * ext_csd[EXT_CSD_PART_SWITCH_TIME ]; -/* Some eMMC set the value too low so set a minimum */ -if (card->ext_csd.part_time && - card->ext_csd.part_time <MMC_MIN_PART_SWITCH_TIME ) - card->ext_csd.part_time =MMC_MIN_PART_SWITCH_TIME ;/* Sleep / awake timeout in 100ns units */ if (sa_shift >0 && sa_shift <=0x17 )
@@ -585,6 +581,17 @@ static int mmc_decode_ext_csd(struct mmc card->ext_csd.data_sector_size =512 ; } +/* +* GENERIC_CMD6_TIME is to be used "unless a specific timeout is defined +* when accessing a specific field", so use it here if there is no +* PARTITION_SWITCH_TIME. +*/ +if (!card->ext_csd.part_time) + card->ext_csd.part_time = card->ext_csd.generic_cmd6_time; +/* Some eMMC set the value too low so set a minimum */ +if (card->ext_csd.part_time <MMC_MIN_PART_SWITCH_TIME ) + card->ext_csd.part_time =MMC_MIN_PART_SWITCH_TIME ; +/* eMMC v5 or later */ if (card->ext_csd.rev >=7 ) { memcpy(card->ext_csd.fwrev, &ext_csd[EXT_CSD_FIRMWARE_VERSION],
[email protected]
maintainerPATCH 30/75 scripts/recordmcount.{c,pl}: support -ffunction-sections .text.* section names
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Joe Lawrence <[email protected]>
commit 9c8e2f6d3d361439cc6744a094f1c15681b55269 upstream.
When building with -ffunction-sections, the compiler will place each function into its own ELF section, prefixed with ".text". For example, a simple test module with functions test_module_do_work() and test_module_wq_func():
% objdump --section-headers test_module.o | awk '/\.text/{print $2}'
.text
.text.test_module_do_work
.text.test_module_wq_func
.init.text
.exit.textAdjust the recordmcount scripts to look for ".text" as a section name prefix. This will ensure that those functions will be included in the __mcount_loc relocations:
% objdump --reloc --section __mcount_loc test_module.o OFFSET TYPE VALUE 0000000000000000 R_X86_64_64 .text.test_module_do_work 0000000000000008 R_X86_64_64 .text.test_module_wq_func 0000000000000010 R_X86_64_64 .init.text
--- scripts/recordmcount.c | 2 +- scripts/recordmcount.pl | 13 +++++++++++++ 2 files changed, 14 insertions(+), 1 deletion(-)
scripts/recordmcount.c +1 -1
@@ -362,7 +362,7 @@ static uint32_t (*w2)(uint16_t);static int is_mcounted_section_name (char const *const txtname) { -return strcmp (".text" , txtname) ==0 || +return strncmp (".text" , txtname,5 ) ==0 ||strcmp (".ref.text" , txtname) ==0 ||strcmp (".sched.text" , txtname) ==0 || strcmp(".spinlock.text", txtname) == 0 ||
scripts/recordmcount.pl +13 -0
@@ -138,6 +138,11 @@ my %text_sections = ( ".text.unlikely" => 1, ); +# Acceptable section-prefixes to record. +my %text_section_prefixes = ( + ".text." => 1, +); + # Note: we are nice to C-programmers here, thus we skip the '||='-idiom. $objdump = 'objdump' if (!$objdump); $objcopy = 'objcopy' if (!$objcopy);
@@ -503,6 +508,14 @@ while (<IN>) { # Only record text sections that we know are safe $read_function = defined($text_sections{$1}); + if (!$read_function) { + foreach my $prefix (keys %text_section_prefixes) { + if (substr($1, 0, length $prefix) eq $prefix) { + $read_function = 1; + last; + } + } + } # print out any recorded offsets update_funcs();
[email protected]
maintainerPATCH 31/75 libertas: fix a potential NULL pointer dereference
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Allen Pais <[email protected]>
commit 7da413a18583baaf35dd4a8eb414fa410367d7f2 upstream.
alloc_workqueue is not checked for errors and as a result, a potential NULL dereference could occur.
--- drivers/net/wireless/libertas/if_sdio.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/wireless/libertas/if_sdio.c +5 -0
@@ -1229,6 +1229,10 @@ static int if_sdio_probe(struct sdio_funspin_lock_init (&card->lock); card->workqueue =create_workqueue ("libertas_sdio" ); +if (unlikely (!card->workqueue)) { + ret = -ENOMEM ; + goto err_queue; + }INIT_WORK (&card->packet_worker, if_sdio_host_to_card_worker);init_waitqueue_head (&card->pwron_waitq);
@@ -1282,6 +1286,7 @@ err_activate_card:lbs_remove_card (priv); free:destroy_workqueue (card->workqueue); +err_queue:while (card->packets) { packet = card->packets; card->packets = card->packets->next;
[email protected]
maintainerPATCH 32/75 Goodix Fingerprint device is not a modem
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Yorick de Wid <[email protected]>
commit 4d8654e81db7346f915eca9f1aff18f385cab621 upstream.
The CDC ACM driver is false matching the Goodix Fingerprint device against the USB_CDC_ACM_PROTO_AT_V25TER.
The Goodix Fingerprint device is a biometrics sensor that should be handled in user-space. libfprint has some support for Goodix fingerprint sensors, although not for this particular one. It is possible that the vendor allocates a PID per OEM (Lenovo, Dell etc). If this happens to be the case then more devices from the same vendor could potentially match the ACM modem module table.
--- drivers/usb/class/cdc-acm.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/usb/class/cdc-acm.c +5 -0
@@ -1928,6 +1928,11 @@ static const struct usb_device_id acm_id .driver_info = SEND_ZERO_PACKET, }, +/* Exclude Goodix Fingerprint Reader */ + { USB_DEVICE(0x27c6, 0x5395), + .driver_info =IGNORE_DEVICE , + }, + /* control interfaces without any protocol set */ { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM, USB_CDC_PROTO_NONE) },
[email protected]
maintainerPATCH 33/75 usb: gadget: f_uac2: always increase endpoint max_packet_size by one audio slot
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Ruslan Bilovol <[email protected]>
commit 789ea77310f0200c84002884ffd628e2baf3ad8a upstream.
As per UAC2 Audio Data Formats spec (2.3.1.1 USB Packets), if the sampling rate is a constant, the allowable variation of number of audio slots per virtual frame is +/- 1 audio slot.
It means that endpoint should be able to accept/send +1 audio slot.
Previous endpoint max_packet_size calculation code was adding sometimes +1 audio slot due to DIV_ROUND_UP behaviour which was rounding up to closest integer. However this doesn't work if the numbers are divisible.
It had no any impact with Linux hosts which ignore this issue, but in case of more strict Windows it caused rejected enumeration
Thus always add +1 audio slot to endpoint's max packet size
--- drivers/usb/gadget/function/f_uac2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/gadget/function/f_uac2.c +1 -1
@@ -997,7 +997,7 @@ static int set_ep_max_packet_size(const } max_size_bw =num_channels (chmask) * ssize * -DIV_ROUND_UP (srate, factor / (1 << (ep_desc->bInterval -1 ))); + ((srate / (factor / (1 << (ep_desc->bInterval -1 )))) +1 ); ep_desc->wMaxPacketSize =cpu_to_le16 (min_t (u16, max_size_bw, max_size_ep));
[email protected]
maintainerPATCH 34/75 usb: renesas_usbhs: Clear PIPECFG for re-enabling pipe with other EPNUM
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Yoshihiro Shimoda <[email protected]>
commit b1d25e6ee57c2605845595b6c61340d734253eb3 upstream.
According to the datasheet, this controller has a restriction which "set an endpoint number so that combinations of the DIR bit and the EPNUM bits do not overlap.". However, since the udc core driver is possible to assign a bulk pipe as an interrupt endpoint, an endpoint number may not match the pipe number. After that, when user rebinds another gadget driver, this driver broke the restriction because the driver didn't clear any configuration in usb_ep_disable().
Example:
# modprobe g_ncm Then, EP3 = pipe 3, EP4 = pipe 4, EP5 = pipe 6 # rmmod g_ncm # modprobe g_hid Then, EP3 = pipe 6, EP4 = pipe 7. So, pipe 3 and pipe 6 are set as EP3.
So, clear PIPECFG register in usbhs_pipe_free().
--- drivers/usb/renesas_usbhs/pipe.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/renesas_usbhs/pipe.c +2 -0
@@ -805,6 +805,8 @@ struct usbhs_pipe *usbhs_pipe_malloc(strvoid usbhs_pipe_free (struct usbhs_pipe *pipe) { +usbhsp_pipe_select (pipe); +usbhsp_pipe_cfg_set (pipe,0xFFFF ,0 );usbhsp_put_pipe (pipe); }
[email protected]
maintainerPATCH 35/75 xhci: Improve detection of device initiated wake signal.
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Mathias Nyman <[email protected]>
commit 253f588c70f66184b1f3a9bbb428b49bbda73e80 upstream.
A xHC USB 3 port might miss the first wake signal from a USB 3 device if the port LFPS reveiver isn't enabled fast enough after xHC resume.
xHC host will anyway be resumed by a PME# signal, but will go back to suspend if no port activity is seen.
The device resends the U3 LFPS wake signal after a 100ms delay, but by then host is already suspended, starting all over from the beginning of this issue.
USB 3 specs say U3 wake LFPS signal is sent for max 10ms, then device needs to delay 100ms before resending the wake.
Don't suspend immediately if port activity isn't detected in resume. Instead add a retry. If there is no port activity then delay for 120ms, and re-check for port activity.
--- drivers/usb/host/xhci.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-)
drivers/usb/host/xhci.c +13 -3
@@ -1018,6 +1018,7 @@ int xhci_resume(struct xhci_hcd *xhci, bstruct usb_hcd *secondary_hcd;int retval =0 ;bool comp_timer_running = false; +bool pending_portevent = false;if (!hcd->state)return 0 ;
@@ -1151,13 +1152,22 @@ int xhci_resume(struct xhci_hcd *xhci, b done:if (retval ==0 ) { -/* Resume root hubs only when have pending events. */ -if (xhci_pending_portevent (xhci)) { +/* +* Resume roothubs only if there are pending events. +* USB 3 devices resend U3 LFPS wake after a 100ms delay if +* the first wake signalling failed, give it that chance. +*/ + pending_portevent =xhci_pending_portevent (xhci); +if (!pending_portevent) { +msleep (120 ); + pending_portevent =xhci_pending_portevent (xhci); + } + +if (pending_portevent) {usb_hcd_resume_root_hub (xhci->shared_hcd);usb_hcd_resume_root_hub (hcd); } } -/* * If system is subject to the Quirk, Compliance Mode Timer needs to * be re-initialized Always after a system resume. Ports are subject
[email protected]
maintainerPATCH 36/75 USB: serial: io_edgeport: fix memory leak in edge_startup
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Pavel Skripkin <[email protected]>
commit cfdc67acc785e01a8719eeb7012709d245564701 upstream.
sysbot found memory leak in edge_startup().
The problem was that when an error was received from the usb_submit_urb(), nothing was cleaned up.
--- drivers/usb/serial/io_edgeport.c | 26 ++++++++++++++++---------- 1 file changed, 16 insertions(+), 10 deletions(-)
drivers/usb/serial/io_edgeport.c +16 -10
@@ -2966,26 +2966,32 @@ static int edge_startup(struct usb_seria response = -ENODEV ; } -usb_free_urb (edge_serial->interrupt_read_urb); -kfree (edge_serial->interrupt_in_buffer); - -usb_free_urb (edge_serial->read_urb); -kfree (edge_serial->bulk_in_buffer); - -kfree (edge_serial); - -return response; + goto error; }/* start interrupt read for this edgeport this interrupt will * continue as long as the edgeport is connected */ response =usb_submit_urb (edge_serial->interrupt_read_urb,GFP_KERNEL ); -if (response) +if (response) {dev_err (ddev,"%s - Error %d submitting control urb\n" , __func__, response); + + goto error; + } }return response; + +error: +usb_free_urb (edge_serial->interrupt_read_urb); +kfree (edge_serial->interrupt_in_buffer); + +usb_free_urb (edge_serial->read_urb); +kfree (edge_serial->bulk_in_buffer); + +kfree (edge_serial); + +return response; }
[email protected]
maintainerPATCH 37/75 USB: serial: ch341: add new Product ID
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Niv Sardi <[email protected]>
commit 5563b3b6420362c8a1f468ca04afe6d5f0a8d0a3 upstream.
Add PID for CH340 that's found on cheap programmers.
The driver works flawlessly as soon as the new PID (0x9986) is added to it. These look like ANU232MI but ship with a ch341 inside. They have no special identifiers (mine only has the string "DB9D20130716" printed on the PCB and nothing identifiable on the packaging. The merchant i bought it from doesn't sell these anymore).
the lsusb -v output is:
Bus 001 Device 009: ID 9986:7523
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 1.10
bDeviceClass 255 Vendor Specific Class
bDeviceSubClass 0 bDeviceProtocol 0 bMaxPacketSize0 8 idVendor 0x9986 idProduct 0x7523 bcdDevice 2.54 iManufacturer 0 iProduct 0 iSerial 0 bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 0x0027
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 0
bmAttributes 0x80
(Bus Powered)
MaxPower 96mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 3
bInterfaceClass 255 Vendor Specific Class
bInterfaceSubClass 1
bInterfaceProtocol 2
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x82 EP 2 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0020 1x 32 bytes
bInterval 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x02 EP 2 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0020 1x 32 bytes
bInterval 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0008 1x 8 bytes
bInterval 1
--- drivers/usb/serial/ch341.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/serial/ch341.c +1 -0
@@ -75,6 +75,7 @@ static const struct usb_device_id id_tab { USB_DEVICE(0x1a86, 0x7522) }, { USB_DEVICE(0x1a86, 0x7523) }, { USB_DEVICE(0x4348, 0x5523) }, + { USB_DEVICE(0x9986, 0x7523) }, { }, };MODULE_DEVICE_TABLE (usb, id_table);
[email protected]
maintainerPATCH 38/75 USB: serial: cp210x: add ID for Acuity Brands nLight Air Adapter
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Karan Singhal <[email protected]>
commit ca667a33207daeaf9c62b106815728718def60ec upstream.
IDs of nLight Air Adapter, Acuity Brands, Inc.:
vid: 10c4
pid: 88d8
--- drivers/usb/serial/cp210x.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/serial/cp210x.c +1 -0
@@ -142,6 +142,7 @@ static const struct usb_device_id id_tab { USB_DEVICE(0x10C4, 0x8857) }, /* CEL EM357 ZigBee USB Stick */ { USB_DEVICE(0x10C4, 0x88A4) }, /* MMB Networks ZigBee USB Device */ { USB_DEVICE(0x10C4, 0x88A5) }, /* Planet Innovation Ingeni ZigBee USB Device */ + { USB_DEVICE(0x10C4, 0x88D8) }, /* Acuity Brands nLight Air Adapter */ { USB_DEVICE(0x10C4, 0x88FB) }, /* CESINEL MEDCAL STII Network Analyzer */ { USB_DEVICE(0x10C4, 0x8938) }, /* CESINEL MEDCAL S II Network Analyzer */ { USB_DEVICE(0x10C4, 0x8946) }, /* Ketra N1 Wireless Interface */
[email protected]
maintainerPATCH 39/75 USB: serial: cp210x: add some more GE USB IDs
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Sebastian Reichel <[email protected]>
commit 42213a0190b535093a604945db05a4225bf43885 upstream.
GE CS1000 has some more custom USB IDs for CP2102N; add them to the driver to have working auto-probing.
--- drivers/usb/serial/cp210x.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/serial/cp210x.c +2 -0
@@ -199,6 +199,8 @@ static const struct usb_device_id id_tab { USB_DEVICE(0x1901, 0x0194) }, /* GE Healthcare Remote Alarm Box */ { USB_DEVICE(0x1901, 0x0195) }, /* GE B850/B650/B450 CP2104 DP UART interface */ { USB_DEVICE(0x1901, 0x0196) }, /* GE B850 CP2105 DP UART interface */ + { USB_DEVICE(0x1901, 0x0197) }, /* GE CS1000 Display serial interface */ + { USB_DEVICE(0x1901, 0x0198) }, /* GE CS1000 M.2 Key E serial interface */ { USB_DEVICE(0x199B, 0xBA30) }, /* LORD WSDA-200-USB */ { USB_DEVICE(0x19CF, 0x3000) }, /* Parrot NMEA GPS Flight Recorder */ { USB_DEVICE(0x1ADB, 0x0001) }, /* Schweitzer Engineering C662 Cable */
[email protected]
maintainerPATCH 40/75 usbip: fix stub_dev to check for stream socket
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Shuah Khan <[email protected]>
commit 47ccc8fc2c9c94558b27b6f9e2582df32d29e6e8 upstream.
Fix usbip_sockfd_store() to validate the passed in file descriptor is a stream socket. If the file descriptor passed was a SOCK_DGRAM socket, sock_recvmsg() can't detect end of stream.
--- drivers/usb/usbip/stub_dev.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
drivers/usb/usbip/stub_dev.c +11 -1
@@ -83,8 +83,16 @@ static ssize_t store_sockfd(struct devic } socket =sockfd_lookup (sockfd, &err); -if (!socket) +if (!socket) { +dev_err (dev,"failed to lookup sock" ); goto err; + } + +if (socket->type !=SOCK_STREAM ) { +dev_err (dev,"Expecting SOCK_STREAM - found %d" , + socket->type); + goto sock_err; + } sdev->ud.tcp_socket = socket; sdev->ud.sockfd = sockfd;
@@ -114,6 +122,8 @@ static ssize_t store_sockfd(struct devicreturn count; +sock_err: +sockfd_put (socket); err:spin_unlock_irq (&sdev->ud.lock);return -EINVAL ;
[email protected]
maintainerPATCH 41/75 usbip: fix vhci_hcd to check for stream socket
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Shuah Khan <[email protected]>
commit f55a0571690c4aae03180e001522538c0927432f upstream.
Fix attach_store() to validate the passed in file descriptor is a stream socket. If the file descriptor passed was a SOCK_DGRAM socket, sock_recvmsg() can't detect end of stream.
--- drivers/usb/usbip/vhci_sysfs.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
drivers/usb/usbip/vhci_sysfs.c +9 -1
@@ -202,8 +202,16 @@ static ssize_t store_attach(struct devic/* Extract socket from fd. */ socket =sockfd_lookup (sockfd, &err); -if (!socket) +if (!socket) { +dev_err (dev,"failed to lookup sock" );return -EINVAL ; + } +if (socket->type !=SOCK_STREAM ) { +dev_err (dev,"Expecting SOCK_STREAM - found %d" , + socket->type); +sockfd_put (socket); +return -EINVAL ; + }/* now need lock until setting vdev status as used */
[email protected]
maintainerPATCH 42/75 usbip: fix stub_dev usbip_sockfd_store() races leading to gpf
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Shuah Khan <[email protected]>
commit 9380afd6df70e24eacbdbde33afc6a3950965d22 upstream.
usbip_sockfd_store() is invoked when user requests attach (import) detach (unimport) usb device from usbip host. vhci_hcd sends import request and usbip_sockfd_store() exports the device if it is free for export.
Export and unexport are governed by local state and shared state
- Shared state (usbip device status, sockfd) - sockfd and Device status are used to determine if stub should be brought up or shut down.
- Local state (tcp_socket, rx and tx thread task_struct ptrs) A valid tcp_socket controls rx and tx thread operations while the device is in exported state.
- While the device is exported, device status is marked used and socket, sockfd, and thread pointers are valid.
Export sequence (stub-up) includes validating the socket and creating receive (rx) and transmit (tx) threads to talk to the client to provide access to the exported device. rx and tx threads depends on local and shared state to be correct and in sync.
Unexport (stub-down) sequence shuts the socket down and stops the rx and tx threads. Stub-down sequence relies on local and shared states to be in sync.
There are races in updating the local and shared status in the current stub-up sequence resulting in crashes. These stem from starting rx and tx threads before local and global state is updated correctly to be in sync.
1. Doesn't handle kthread_create() error and saves invalid ptr in local state that drives rx and tx threads.
2. Updates tcp_socket and sockfd, starts stub_rx and stub_tx threads before updating usbip_device status to SDEV_ST_USED. This opens up a race condition between the threads and usbip_sockfd_store() stub up and down handling.
Fix the above problems:
- Stop using kthread_get_run() macro to create/start threads.
- Create threads and get task struct reference.
- Add kthread_create() failure handling and bail out.
- Hold usbip_device lock to update local and shared states after creating rx and tx threads.
- Update usbip_device status to SDEV_ST_USED.
- Update usbip_device tcp_socket, sockfd, tcp_rx, and tcp_tx
- Start threads after usbip_device (tcp_socket, sockfd, tcp_rx, tcp_tx, and status) is complete.
Credit goes to syzbot and Tetsuo Handa for finding and root-causing the kthread_get_run() improper error handling problem and others. This is a hard problem to find and debug since the races aren't seen in a normal case. Fuzzing forces the race window to be small enough for the kthread_get_run() error path bug and starting threads before updating the local and shared state bug in the stub-up sequence.
Tested with syzbot reproducer:
- https://syzkaller.appspot.com/text?tag=ReproC&x=14801034d00000
--- drivers/usb/usbip/stub_dev.c | 32 +++++++++++++++++++++++++------- 1 file changed, 25 insertions(+), 7 deletions(-)
drivers/usb/usbip/stub_dev.c +25 -7
@@ -60,6 +60,8 @@ static ssize_t store_sockfd(struct devicint sockfd =0 ;struct socket *socket;int rv; +struct task_struct *tcp_rx =NULL ; +struct task_struct *tcp_tx =NULL ;if (!sdev) {dev_err (dev,"sdev is null\n" );
@@ -94,20 +96,36 @@ static ssize_t store_sockfd(struct devic goto sock_err; } - sdev->ud.tcp_socket = socket; - sdev->ud.sockfd = sockfd; - +/* unlock and create threads and get tasks */ spin_unlock_irq (&sdev->ud.lock); + tcp_rx =kthread_create (stub_rx_loop, &sdev->ud,"stub_rx" ); +if (IS_ERR (tcp_rx)) { +sockfd_put (socket); +return -EINVAL ; + } + tcp_tx =kthread_create (stub_tx_loop, &sdev->ud,"stub_tx" ); +if (IS_ERR (tcp_tx)) { +kthread_stop (tcp_rx); +sockfd_put (socket); +return -EINVAL ; + } - sdev->ud.tcp_rx =kthread_get_run (stub_rx_loop, &sdev->ud, -"stub_rx" ); - sdev->ud.tcp_tx =kthread_get_run (stub_tx_loop, &sdev->ud, -"stub_tx" ); +/* get task structs now */ +get_task_struct (tcp_rx); +get_task_struct (tcp_tx); +/* lock and update sdev->ud state */ spin_lock_irq (&sdev->ud.lock); + sdev->ud.tcp_socket = socket; + sdev->ud.sockfd = sockfd; + sdev->ud.tcp_rx = tcp_rx; + sdev->ud.tcp_tx = tcp_tx; sdev->ud.status =SDEV_ST_USED ;spin_unlock_irq (&sdev->ud.lock); +wake_up_process (sdev->ud.tcp_rx); +wake_up_process (sdev->ud.tcp_tx); + }else {dev_info (dev,"stub down\n" );
[email protected]
maintainerPATCH 43/75 staging: rtl8192u: fix ->ssid overflow in r8192_wx_set_scan()
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Dan Carpenter <[email protected]>
commit 87107518d7a93fec6cdb2559588862afeee800fb upstream.
We need to cap len at IW_ESSID_MAX_SIZE (32) to avoid memory corruption. This can be controlled by the user via the ioctl.
--- drivers/staging/rtl8192u/r8192U_wx.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/staging/rtl8192u/r8192U_wx.c +4 -2
@@ -341,8 +341,10 @@ static int r8192_wx_set_scan(struct net_struct iw_scan_req *req = (struct iw_scan_req *)b;if (req->essid_len) { - ieee->current_network.ssid_len = req->essid_len; -memcpy (ieee->current_network.ssid, req->essid, req->essid_len); +int len =min_t (int, req->essid_len,IW_ESSID_MAX_SIZE ); + + ieee->current_network.ssid_len = len; +memcpy (ieee->current_network.ssid, req->essid, len); } }
[email protected]
maintainerPATCH 44/75 staging: rtl8188eu: prevent ->ssid overflow in rtw_wx_set_scan()
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Dan Carpenter <[email protected]>
commit 74b6b20df8cfe90ada777d621b54c32e69e27cd7 upstream.
This code has a check to prevent read overflow but it needs another check to prevent writing beyond the end of the ->ssid[] array.
--- drivers/staging/rtl8188eu/os_dep/ioctl_linux.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/staging/rtl8188eu/os_dep/ioctl_linux.c +4 -2
@@ -1174,9 +1174,11 @@ static int rtw_wx_set_scan(struct net_debreak ; } sec_len = *(pos++); len -=1 ; -if (sec_len >0 && sec_len <= len) { +if (sec_len >0 && + sec_len <= len && + sec_len <=32 ) { ssid[ssid_index].SsidLength = sec_len; -memcpy (ssid[ssid_index].Ssid, pos, ssid[ssid_index].SsidLength); +memcpy (ssid[ssid_index].Ssid, pos, sec_len); ssid_index++; } pos += sec_len;
[email protected]
maintainerPATCH 45/75 staging: rtl8712: unterminated string leads to read overflow
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Dan Carpenter <[email protected]>
commit d660f4f42ccea50262c6ee90c8e7ad19a69fb225 upstream.
The memdup_user() function does not necessarily return a NUL terminated string so this can lead to a read overflow. Switch from memdup_user() to strndup_user() to fix this bug.
--- drivers/staging/rtl8712/rtl871x_ioctl_linux.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/rtl8712/rtl871x_ioctl_linux.c +1 -1
@@ -935,7 +935,7 @@ static int r871x_wx_set_priv(struct net_struct iw_point *dwrq = (struct iw_point *)awrq; len = dwrq->length; - ext =memdup_user (dwrq->pointer, len); + ext =strndup_user (dwrq->pointer, len);if (IS_ERR (ext))return PTR_ERR (ext);
[email protected]
maintainerPATCH 46/75 staging: rtl8188eu: fix potential memory corruption in rtw_check_beacon_data()
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Dan Carpenter <[email protected]>
commit d4ac640322b06095128a5c45ba4a1e80929fe7f3 upstream.
The "ie_len" is a value in the 1-255 range that comes from the user. We have to cap it to ensure that it's not too large or it could lead to memory corruption.
--- drivers/staging/rtl8188eu/core/rtw_ap.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/staging/rtl8188eu/core/rtw_ap.c +5 -0
@@ -921,6 +921,7 @@ int rtw_check_beacon_data(struct adapter/* SSID */ p =rtw_get_ie (ie + _BEACON_IE_OFFSET_, _SSID_IE_, &ie_len, (pbss_network->IELength - _BEACON_IE_OFFSET_));if (p && ie_len >0 ) { + ie_len =min_t (int, ie_len,sizeof (pbss_network->Ssid.Ssid));memset (&pbss_network->Ssid,0 ,sizeof (struct ndis_802_11_ssid ));memcpy (pbss_network->Ssid.Ssid, (p +2 ), ie_len); pbss_network->Ssid.SsidLength = ie_len;
@@ -939,6 +940,7 @@ int rtw_check_beacon_data(struct adapter/* get supported rates */ p =rtw_get_ie (ie + _BEACON_IE_OFFSET_, _SUPPORTEDRATES_IE_, &ie_len, (pbss_network->IELength - _BEACON_IE_OFFSET_));if (p !=NULL ) { + ie_len =min_t (int, ie_len,NDIS_802_11_LENGTH_RATES_EX );memcpy (supportRate, p+2 , ie_len); supportRateNum = ie_len; }
@@ -946,6 +948,8 @@ int rtw_check_beacon_data(struct adapter/* get ext_supported rates */ p =rtw_get_ie (ie + _BEACON_IE_OFFSET_, _EXT_SUPPORTEDRATES_IE_, &ie_len, pbss_network->IELength - _BEACON_IE_OFFSET_);if (p !=NULL ) { + ie_len =min_t (int, ie_len, +NDIS_802_11_LENGTH_RATES_EX - supportRateNum);memcpy (supportRate+supportRateNum, p+2 , ie_len); supportRateNum += ie_len; }
@@ -1061,6 +1065,7 @@ int rtw_check_beacon_data(struct adapter pht_cap->supp_mcs_set[0 ] =0xff ; pht_cap->supp_mcs_set[1 ] =0x0 ; } + ie_len =min_t (int, ie_len,sizeof (pmlmepriv->htpriv.ht_cap));memcpy (&pmlmepriv->htpriv.ht_cap, p+2 , ie_len); }
[email protected]
maintainerPATCH 47/75 staging: rtl8712: Fix possible buffer overflow in r8712_sitesurvey_cmd
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Lee Gibson <[email protected]>
commit b93c1e3981af19527beee1c10a2bef67a228c48c upstream.
Function r8712_sitesurvey_cmd calls memcpy without checking the length. A user could control that length and trigger a buffer overflow. Fix by checking the length is within the maximum allowed size.
--- drivers/staging/rtl8712/rtl871x_cmd.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/staging/rtl8712/rtl871x_cmd.c +4 -2
@@ -242,8 +242,10 @@ u8 r8712_sitesurvey_cmd(struct _adapter psurveyPara->ss_ssidlen =0 ;memset (psurveyPara->ss_ssid,0 ,IW_ESSID_MAX_SIZE +1 );if ((pssid !=NULL ) && (pssid->SsidLength)) { -memcpy (psurveyPara->ss_ssid, pssid->Ssid, pssid->SsidLength); - psurveyPara->ss_ssidlen =cpu_to_le32 (pssid->SsidLength); +int len =min_t (int, pssid->SsidLength,IW_ESSID_MAX_SIZE ); + +memcpy (psurveyPara->ss_ssid, pssid->Ssid, len); + psurveyPara->ss_ssidlen =cpu_to_le32 (len); }set_fwstate (pmlmepriv, _FW_UNDER_SURVEY);r8712_enqueue_cmd (pcmdpriv, ph2c);
[email protected]
maintainerPATCH 48/75 staging: rtl8192e: Fix possible buffer overflow in _rtl92e_wx_set_scan
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Lee Gibson <[email protected]>
commit 8687bf9ef9551bcf93897e33364d121667b1aadf upstream.
Function _rtl92e_wx_set_scan calls memcpy without checking the length. A user could control that length and trigger a buffer overflow. Fix by checking the length is within the maximum allowed size.
--- drivers/staging/rtl8192e/rtl8192e/rtl_wx.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/staging/rtl8192e/rtl8192e/rtl_wx.c +4 -3
@@ -419,9 +419,10 @@ static int _rtl92e_wx_set_scan(struct nestruct iw_scan_req *req = (struct iw_scan_req *)b;if (req->essid_len) { - ieee->current_network.ssid_len = req->essid_len; -memcpy (ieee->current_network.ssid, req->essid, - req->essid_len); +int len =min_t (int, req->essid_len,IW_ESSID_MAX_SIZE ); + + ieee->current_network.ssid_len = len; +memcpy (ieee->current_network.ssid, req->essid, len); } }
[email protected]
maintainerPATCH 49/75 staging: comedi: addi_apci_1032: Fix endian problem for COS sample
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Ian Abbott <[email protected]>
commit 25317f428a78fde71b2bf3f24d05850f08a73a52 upstream.
The Change-Of-State (COS) subdevice supports Comedi asynchronous commands to read 16-bit change-of-state values. However, the interrupt handler is calling comedi_buf_write_samples() with the address of a 32-bit integer &s->state. On bigendian architectures, it will copy 2 bytes from the wrong end of the 32-bit integer. Fix it by transferring the value via a 16-bit integer.
--- drivers/staging/comedi/drivers/addi_apci_1032.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/staging/comedi/drivers/addi_apci_1032.c +3 -1
@@ -269,6 +269,7 @@ static irqreturn_t apci1032_interrupt(instruct apci1032_private *devpriv = dev->private;struct comedi_subdevice *s = dev->read_subdev;unsigned int ctrl; +unsigned short val;/* check interrupt is from this device */ if ((inl(devpriv->amcc_iobase + AMCC_OP_REG_INTCSR) &
@@ -284,7 +285,8 @@ static irqreturn_t apci1032_interrupt(inoutl (ctrl & ~APCI1032_CTRL_INT_ENA , dev->iobase +APCI1032_CTRL_REG ); s->state =inl (dev->iobase +APCI1032_STATUS_REG ) &0xffff ; -comedi_buf_write_samples (s, &s->state,1 ); + val = s->state; +comedi_buf_write_samples (s, &val,1 );comedi_handle_events (dev, s);/* enable the interrupt */
[email protected]
maintainerPATCH 50/75 staging: comedi: addi_apci_1500: Fix endian problem for command sample
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Ian Abbott <[email protected]>
commit ac0bbf55ed3be75fde1f8907e91ecd2fd589bde3 upstream.
The digital input subdevice supports Comedi asynchronous commands that read interrupt status information. This uses 16-bit Comedi samples (of which only the bottom 8 bits contain status information). However, the interrupt handler is calling comedi_buf_write_samples() with the address of a 32-bit variable unsigned int status. On a bigendian machine, this will copy 2 bytes from the wrong end of the variable. Fix it by changing the type of the variable to unsigned short.
--- drivers/staging/comedi/drivers/addi_apci_1500.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
drivers/staging/comedi/drivers/addi_apci_1500.c +9 -9
@@ -217,7 +217,7 @@ static irqreturn_t apci1500_interrupt(instruct comedi_device *dev = d;struct apci1500_private *devpriv = dev->private;struct comedi_subdevice *s = dev->read_subdev; -unsigned int status =0 ; +unsigned short status =0 ;unsigned int val; val =inl (devpriv->amcc +AMCC_OP_REG_INTCSR );
@@ -247,14 +247,14 @@ static irqreturn_t apci1500_interrupt(in* * Mask Meaning * ---------- ------------------------------------------ -* 0x00000001 Event 1 has occurred -* 0x00000010 Event 2 has occurred -* 0x00000100 Counter/timer 1 has run down (not implemented) -* 0x00001000 Counter/timer 2 has run down (not implemented) -* 0x00010000 Counter 3 has run down (not implemented) -* 0x00100000 Watchdog has run down (not implemented) -* 0x01000000 Voltage error -* 0x10000000 Short-circuit error +* 0b00000001 Event 1 has occurred +* 0b00000010 Event 2 has occurred +* 0b00000100 Counter/timer 1 has run down (not implemented) +* 0b00001000 Counter/timer 2 has run down (not implemented) +* 0b00010000 Counter 3 has run down (not implemented) +* 0b00100000 Watchdog has run down (not implemented) +* 0b01000000 Voltage error +* 0b10000000 Short-circuit error */ comedi_buf_write_samples (s, &status,1 );comedi_handle_events (dev, s);
[email protected]
maintainerPATCH 51/75 staging: comedi: adv_pci1710: Fix endian problem for AI command data
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Ian Abbott <[email protected]>
commit b2e78630f733a76508b53ba680528ca39c890e82 upstream.
The analog input subdevice supports Comedi asynchronous commands that use Comedi's 16-bit sample format. However, the calls to comedi_buf_write_samples() are passing the address of a 32-bit integer variable. On bigendian machines, this will copy 2 bytes from the wrong end of the 32-bit value. Fix it by changing the type of the variables holding the sample value to unsigned short. The type of the val parameter of pci1710_ai_read_sample() is changed to unsigned short * accordingly. The type of the val variable in pci1710_ai_insn_read() is also changed to unsigned short since its address is passed to pci1710_ai_read_sample().
--- drivers/staging/comedi/drivers/adv_pci1710.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/staging/comedi/drivers/adv_pci1710.c +5 -5
@@ -351,11 +351,11 @@ static int pci171x_ai_eoc(struct comedi_static int pci171x_ai_read_sample (struct comedi_device *dev,struct comedi_subdevice *s,unsigned int cur_chan, -unsigned int *val) +unsigned short *val) {const struct boardtype *board = dev->board_ptr;struct pci1710_private *devpriv = dev->private; -unsigned int sample; +unsigned short sample;unsigned int chan; sample =inw (dev->iobase +PCI171X_AD_DATA_REG );
@@ -395,7 +395,7 @@ static int pci171x_ai_insn_read(struct cpci171x_ai_setup_chanlist (dev, s, &insn->chanspec,1 ,1 );for (i =0 ; i < insn->n; i++) { -unsigned int val; +unsigned short val;/* start conversion */ outw (0 , dev->iobase +PCI171X_SOFTTRG_REG );
@@ -516,7 +516,7 @@ static void pci1710_handle_every_sample( {struct comedi_cmd *cmd = &s->async->cmd;unsigned int status; -unsigned int val; +unsigned short val;int ret; status =inw (dev->iobase +PCI171X_STATUS_REG );
@@ -576,7 +576,7 @@ static void pci1710_handle_fifo(struct c }for (i =0 ; i < devpriv->max_samples; i++) { -unsigned int val; +unsigned short val;int ret; ret =pci171x_ai_read_sample (dev, s, s->async->cur_chan, &val);
[email protected]
maintainerPATCH 52/75 staging: comedi: das6402: Fix endian problem for AI command data
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Ian Abbott <[email protected]>
commit 1c0f20b78781b9ca50dc3ecfd396d0db5b141890 upstream.
The analog input subdevice supports Comedi asynchronous commands that use Comedi's 16-bit sample format. However, the call to comedi_buf_write_samples() is passing the address of a 32-bit integer variable. On bigendian machines, this will copy 2 bytes from the wrong end of the 32-bit value. Fix it by changing the type of the variable holding the sample value to unsigned short.
--- drivers/staging/comedi/drivers/das6402.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/comedi/drivers/das6402.c +1 -1
@@ -193,7 +193,7 @@ static irqreturn_t das6402_interrupt(intif (status &DAS6402_STATUS_FFULL ) { async->events |=COMEDI_CB_OVERFLOW ; }else if (status &DAS6402_STATUS_FFNE ) { -unsigned int val; +unsigned short val; val =das6402_ai_read_sample (dev, s);comedi_buf_write_samples (s, &val,1 );
[email protected]
maintainerPATCH 53/75 staging: comedi: das800: Fix endian problem for AI command data
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Ian Abbott <[email protected]>
commit 459b1e8c8fe97fcba0bd1b623471713dce2c5eaf upstream.
The analog input subdevice supports Comedi asynchronous commands that use Comedi's 16-bit sample format. However, the call to comedi_buf_write_samples() is passing the address of a 32-bit integer variable. On bigendian machines, this will copy 2 bytes from the wrong end of the 32-bit value. Fix it by changing the type of the variable holding the sample value to unsigned short.
--- drivers/staging/comedi/drivers/das800.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/comedi/drivers/das800.c +1 -1
@@ -436,7 +436,7 @@ static irqreturn_t das800_interrupt(intstruct comedi_cmd *cmd;unsigned long irq_flags;unsigned int status; -unsigned int val; +unsigned short val;bool fifo_empty;bool fifo_overflow;int i;
[email protected]
maintainerPATCH 54/75 staging: comedi: dmm32at: Fix endian problem for AI command data
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Ian Abbott <[email protected]>
commit 54999c0d94b3c26625f896f8e3460bc029821578 upstream.
The analog input subdevice supports Comedi asynchronous commands that use Comedi's 16-bit sample format. However, the call to comedi_buf_write_samples() is passing the address of a 32-bit integer variable. On bigendian machines, this will copy 2 bytes from the wrong end of the 32-bit value. Fix it by changing the type of the variable holding the sample value to unsigned short.
[Note: the bug was introduced in commit 1700529b24cc ("staging: comedi:
dmm32at: use comedi_buf_write_samples()") but the patch applies better to the later (but in the same kernel release) commit 0c0eadadcbe6e ("staging: comedi: dmm32at: introduce dmm32_ai_get_sample()").]
--- drivers/staging/comedi/drivers/dmm32at.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/comedi/drivers/dmm32at.c +1 -1
@@ -411,7 +411,7 @@ static irqreturn_t dmm32at_isr(int irq, {struct comedi_device *dev = d;unsigned char intstat; -unsigned int val; +unsigned short val;int i;if (!dev->attached) {
[email protected]
maintainerPATCH 55/75 staging: comedi: me4000: Fix endian problem for AI command data
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Ian Abbott <[email protected]>
commit b39dfcced399d31e7c4b7341693b18e01c8f655e upstream.
The analog input subdevice supports Comedi asynchronous commands that use Comedi's 16-bit sample format. However, the calls to comedi_buf_write_samples() are passing the address of a 32-bit integer variable. On bigendian machines, this will copy 2 bytes from the wrong end of the 32-bit value. Fix it by changing the type of the variable holding the sample value to unsigned short.
--- drivers/staging/comedi/drivers/me4000.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/comedi/drivers/me4000.c +1 -1
@@ -933,7 +933,7 @@ static irqreturn_t me4000_ai_isr(int irqstruct comedi_subdevice *s = dev->read_subdev;int i;int c =0 ; -unsigned int lval; +unsigned short lval;if (!dev->attached)return IRQ_NONE ;
[email protected]
maintainerPATCH 56/75 staging: comedi: pcl711: Fix endian problem for AI command data
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Ian Abbott <[email protected]>
commit a084303a645896e834883f2c5170d044410dfdb3 upstream.
The analog input subdevice supports Comedi asynchronous commands that use Comedi's 16-bit sample format. However, the call to comedi_buf_write_samples() is passing the address of a 32-bit integer variable. On bigendian machines, this will copy 2 bytes from the wrong end of the 32-bit value. Fix it by changing the type of the variable holding the sample value to unsigned short.
--- drivers/staging/comedi/drivers/pcl711.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/comedi/drivers/pcl711.c +1 -1
@@ -193,7 +193,7 @@ static irqreturn_t pcl711_interrupt(intstruct comedi_device *dev = d;struct comedi_subdevice *s = dev->read_subdev;struct comedi_cmd *cmd = &s->async->cmd; -unsigned int data; +unsigned short data;if (!dev->attached) {dev_err (dev->class_dev,"spurious interrupt\n" );
[email protected]
maintainerPATCH 57/75 staging: comedi: pcl818: Fix endian problem for AI command data
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Ian Abbott <[email protected]>
commit 148e34fd33d53740642db523724226de14ee5281 upstream.
The analog input subdevice supports Comedi asynchronous commands that use Comedi's 16-bit sample format. However, the call to comedi_buf_write_samples() is passing the address of a 32-bit integer parameter. On bigendian machines, this will copy 2 bytes from the wrong end of the 32-bit value. Fix it by changing the type of the parameter holding the sample value to unsigned short.
[Note: the bug was introduced in commit edf4537bcbf5 ("staging: comedi:
pcl818: use comedi_buf_write_samples()") but the patch applies better to commit d615416de615 ("staging: comedi: pcl818: introduce pcl818_ai_write_sample()").]
--- drivers/staging/comedi/drivers/pcl818.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/comedi/drivers/pcl818.c +1 -1
@@ -422,7 +422,7 @@ static int pcl818_ai_eoc(struct comedi_dstatic bool pcl818_ai_write_sample (struct comedi_device *dev,struct comedi_subdevice *s, -unsigned int chan,unsigned int val) +unsigned int chan,unsigned short val) {struct pcl818_private *devpriv = dev->private;struct comedi_cmd *cmd = &s->async->cmd;
[email protected]
maintainerPATCH 58/75 NFSv4.2: fix return value of _nfs4_get_security_label()
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Ondrej Mosnacek <[email protected]>
[ Upstream commit 53cb245454df5b13d7063162afd7a785aed6ebf2 ]
An xattr 'get' handler is expected to return the length of the value on success, yet _nfs4_get_security_label() (and consequently also nfs4_xattr_get_nfs4_label(), which is used as an xattr handler) returns just 0 on success.
Fix this by returning label.len instead, which contains the length of the result.
--- fs/nfs/nfs4proc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/nfs/nfs4proc.c +1 -1
@@ -4922,7 +4922,7 @@ static int _nfs4_get_security_label(struct inode *inode, void *buf,return ret;if (!(fattr.valid &NFS_ATTR_FATTR_V4_SECURITY_LABEL ))return -ENOENT ; -return 0 ; +return label.len; } static int nfs4_get_security_label(struct inode *inode, void *buf,
Signature · 1 line
2.30.1
[email protected]
maintainerPATCH 59/75 block: rsxx: fix error return code of rsxx_pci_probe()
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Jia-Ju Bai <[email protected]>
[ Upstream commit df66617bfe87487190a60783d26175b65d2502ce ]
When create_singlethread_workqueue returns NULL to card->event_wq, no error return code of rsxx_pci_probe() is assigned.
To fix this bug, st is assigned with -ENOMEM in this case.
--- drivers/block/rsxx/core.c | 1 + 1 file changed, 1 insertion(+)
drivers/block/rsxx/core.c +1 -0
@@ -895,6 +895,7 @@ static int rsxx_pci_probe(struct pci_dev *dev, card->event_wq =create_singlethread_workqueue (DRIVER_NAME "_event" );if (!card->event_wq) {dev_err (CARD_TO_DEV (card),"Failed card event setup.\n" ); + st = -ENOMEM ; goto failed_event_handler; }
Signature · 1 line
2.30.1
[email protected]
maintainerPATCH 60/75 prctl: fix PR_SET_MM_AUXV kernel stack leak
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Alexey Dobriyan <[email protected]>
[ Upstream commit c995f12ad8842dbf5cfed113fb52cdd083f5afd1 ]
Doing a
prctl(PR_SET_MM, PR_SET_MM_AUXV, addr, 1);
will copy 1 byte from userspace to (quite big) on-stack array and then stash everything to mm->saved_auxv. AT_NULL terminator will be inserted at the very end.
/proc/*/auxv handler will find that AT_NULL terminator and copy original stack contents to userspace.
This devious scheme requires CAP_SYS_RESOURCE.
--- kernel/sys.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/sys.c +1 -1
@@ -1910,7 +1910,7 @@ static int prctl_set_auxv(struct mm_struct *mm, unsigned long addr,* up to the caller to provide sane values here, otherwise userspace * tools which use this vector might be unhappy. */ -unsigned long user_auxv[AT_VECTOR_SIZE ]; +unsigned long user_auxv[AT_VECTOR_SIZE ] = {};if (len >sizeof (user_auxv))return -EINVAL ;
Signature · 1 line
2.30.1
[email protected]
maintainerPATCH 61/75 alpha: add $(src)/ rather than $(obj)/ to make source file path
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Masahiro Yamada <[email protected]>
commit 5ed78e5523fd9ba77b8444d380d54da1f88c53fc upstream.
$(ev6-y)divide.S is a source file, not a build-time generated file. So, it should be prefixed with $(src)/ rather than $(obj)/.
--- arch/alpha/lib/Makefile | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/alpha/lib/Makefile +4 -4
@@ -46,11 +46,11 @@ AFLAGS___remqu.o = -DREM AFLAGS___divlu.o = -DDIV -DINTSIZE AFLAGS___remlu.o = -DREM -DINTSIZE -$(obj)/__divqu.o: $(obj)/$(ev6-y)divide.S +$(obj)/__divqu.o: $(src)/$(ev6-y)divide.S $(cmd_as_o_S) -$(obj)/__remqu.o: $(obj)/$(ev6-y)divide.S +$(obj)/__remqu.o: $(src)/$(ev6-y)divide.S $(cmd_as_o_S) -$(obj)/__divlu.o: $(obj)/$(ev6-y)divide.S +$(obj)/__divlu.o: $(src)/$(ev6-y)divide.S $(cmd_as_o_S) -$(obj)/__remlu.o: $(obj)/$(ev6-y)divide.S +$(obj)/__remlu.o: $(src)/$(ev6-y)divide.S $(cmd_as_o_S)
[email protected]
maintainerPATCH 62/75 alpha: merge build rules of division routines
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Masahiro Yamada <[email protected]>
commit e19a4e3f1bffe45b8e2ea67fcfb0c9c88278c4cc upstream.
These four objects are generated by the same build rule, with different compile options. The build rules can be merged.
--- arch/alpha/lib/Makefile | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-)
arch/alpha/lib/Makefile +2 -7
@@ -46,11 +46,6 @@ AFLAGS___remqu.o = -DREM AFLAGS___divlu.o = -DDIV -DINTSIZE AFLAGS___remlu.o = -DREM -DINTSIZE -$(obj)/__divqu.o: $(src)/$(ev6-y)divide.S - $(cmd_as_o_S) -$(obj)/__remqu.o: $(src)/$(ev6-y)divide.S - $(cmd_as_o_S) -$(obj)/__divlu.o: $(src)/$(ev6-y)divide.S - $(cmd_as_o_S) -$(obj)/__remlu.o: $(src)/$(ev6-y)divide.S +$(addprefix $(obj)/,__divqu.o __remqu.o __divlu.o __remlu.o): \ + $(src)/$(ev6-y)divide.S $(cmd_as_o_S)
[email protected]
maintainerPATCH 63/75 alpha: make short build log available for division routines
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Masahiro Yamada <[email protected]>
commit 3eec0291830e4c28d09f73bab247f3b59172022b upstream.
This enables the Kbuild standard log style as follows:
AS arch/alpha/lib/__divlu.o AS arch/alpha/lib/__divqu.o AS arch/alpha/lib/__remlu.o AS arch/alpha/lib/__remqu.o
--- arch/alpha/lib/Makefile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/alpha/lib/Makefile +2 -2
@@ -47,5 +47,5 @@ AFLAGS___divlu.o = -DDIV -DINTSIZE AFLAGS___remlu.o = -DREM -DINTSIZE $(addprefix $(obj)/,__divqu.o __remqu.o __divlu.o __remlu.o): \ - $(src)/$(ev6-y)divide.S - $(cmd_as_o_S) + $(src)/$(ev6-y)divide.S FORCE + $(call if_changed_rule,as_o_S)
[email protected]
maintainerPATCH 64/75 alpha: Package string routines together
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Richard Henderson <[email protected]>
commit 4758ce82e66711b1a4557577e30a5f9b88d4a4b5 upstream.
There are direct branches between {str*cpy,str*cat} and stx*cpy. Ensure the branches are within range by merging these objects.
--- arch/alpha/lib/Makefile | 22 ++++++++++++++++------ 1 file changed, 16 insertions(+), 6 deletions(-)
arch/alpha/lib/Makefile +16 -6
@@ -20,12 +20,8 @@ lib-y = __divqu.o __remqu.o __divlu.o __ checksum.o \ csum_partial_copy.o \ $(ev67-y)strlen.o \ - $(ev67-y)strcat.o \ - strcpy.o \ - $(ev67-y)strncat.o \ - strncpy.o \ - $(ev6-y)stxcpy.o \ - $(ev6-y)stxncpy.o \ + stycpy.o \ + styncpy.o \ $(ev67-y)strchr.o \ $(ev67-y)strrchr.o \ $(ev6-y)memchr.o \
@@ -49,3 +45,17 @@ AFLAGS___remlu.o = -DREM -DINTSIZE $(addprefix $(obj)/,__divqu.o __remqu.o __divlu.o __remlu.o): \ $(src)/$(ev6-y)divide.S FORCE $(call if_changed_rule,as_o_S) + +# There are direct branches between {str*cpy,str*cat} and stx*cpy. +# Ensure the branches are within range by merging these objects. + +LDFLAGS_stycpy.o := -r +LDFLAGS_styncpy.o := -r + +$(obj)/stycpy.o: $(obj)/strcpy.o $(obj)/$(ev67-y)strcat.o \ + $(obj)/$(ev6-y)stxcpy.o FORCE + $(call if_changed,ld) + +$(obj)/styncpy.o: $(obj)/strncpy.o $(obj)/$(ev67-y)strncat.o \ + $(obj)/$(ev6-y)stxncpy.o FORCE + $(call if_changed,ld)
[email protected]
maintainerPATCH 65/75 alpha: move exports to actual definitions
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Al Viro <[email protected]>
commit 00fc0e0dda6286407f3854cd71a125f519a5689c upstream.
--- arch/alpha/include/asm/Kbuild | 1 arch/alpha/kernel/Makefile | 2 arch/alpha/kernel/alpha_ksyms.c | 102 ----------------------------------- arch/alpha/kernel/machvec_impl.h | 6 +- arch/alpha/kernel/setup.c | 1 arch/alpha/lib/callback_srm.S | 5 + arch/alpha/lib/checksum.c | 3 + arch/alpha/lib/clear_page.S | 3 - arch/alpha/lib/clear_user.S | 2 arch/alpha/lib/copy_page.S | 3 - arch/alpha/lib/copy_user.S | 3 + arch/alpha/lib/csum_ipv6_magic.S | 2 arch/alpha/lib/csum_partial_copy.c | 2 arch/alpha/lib/dec_and_lock.c | 2 arch/alpha/lib/divide.S | 3 + arch/alpha/lib/ev6-clear_page.S | 3 - arch/alpha/lib/ev6-clear_user.S | 3 - arch/alpha/lib/ev6-copy_page.S | 3 - arch/alpha/lib/ev6-copy_user.S | 3 - arch/alpha/lib/ev6-csum_ipv6_magic.S | 2 arch/alpha/lib/ev6-divide.S | 3 + arch/alpha/lib/ev6-memchr.S | 3 - arch/alpha/lib/ev6-memcpy.S | 3 - arch/alpha/lib/ev6-memset.S | 7 ++ arch/alpha/lib/ev67-strcat.S | 3 - arch/alpha/lib/ev67-strchr.S | 3 - arch/alpha/lib/ev67-strlen.S | 3 - arch/alpha/lib/ev67-strncat.S | 3 - arch/alpha/lib/ev67-strrchr.S | 3 - arch/alpha/lib/fpreg.c | 7 ++ arch/alpha/lib/memchr.S | 3 - arch/alpha/lib/memcpy.c | 5 - arch/alpha/lib/memmove.S | 3 - arch/alpha/lib/memset.S | 7 ++ arch/alpha/lib/strcat.S | 2 arch/alpha/lib/strchr.S | 3 - arch/alpha/lib/strcpy.S | 3 - arch/alpha/lib/strlen.S | 3 - arch/alpha/lib/strncat.S | 3 - arch/alpha/lib/strncpy.S | 3 - arch/alpha/lib/strrchr.S | 3 - 41 files changed, 99 insertions(+), 131 deletions(-) delete mode 100644 arch/alpha/kernel/alpha_ksyms.c
arch/alpha/include/asm/Kbuild +1 -0
@@ -3,6 +3,7 @@ generic-y += clkdev.h generic-y += cputime.h generic-y += exec.h +generic-y += export.h generic-y += irq_work.h generic-y += mcs_spinlock.h generic-y += mm-arch-hooks.h
arch/alpha/kernel/Makefile +1 -1
@@ -8,7 +8,7 @@ ccflags-y := -Wno-sign-compare obj-y := entry.o traps.o process.o osf_sys.o irq.o \ irq_alpha.o signal.o setup.o ptrace.o time.o \ - alpha_ksyms.o systbls.o err_common.o io.o + systbls.o err_common.o io.o obj-$(CONFIG_VGA_HOSE) += console.o obj-$(CONFIG_SMP) += smp.o
arch/alpha/kernel/alpha_ksyms.c deleted +0 -102
102 lines not on this page · raw message
arch/alpha/kernel/machvec_impl.h +4 -2
@@ -144,9 +144,11 @@else beforehand. Fine. We'll do it ourselves. */ #if 0 #define ALIAS_MV (system) \ - struct alpha_machine_vector alpha_mv __attribute__((alias(#system "_mv"))); + struct alpha_machine_vector alpha_mv __attribute__((alias(#system "_mv"))); \ + EXPORT_SYMBOL(alpha_mv);#else #define ALIAS_MV (system) \ - asm(".global alpha_mv\nalpha_mv = " #system "_mv"); + asm(".global alpha_mv\nalpha_mv = " #system "_mv"); \ + EXPORT_SYMBOL(alpha_mv);#endif #endif /* GENERIC */
arch/alpha/kernel/setup.c +1 -0
@@ -115,6 +115,7 @@ unsigned long alpha_agpgart_size = DEFAU#ifdef CONFIG_ALPHA_GENERIC struct alpha_machine_vector alpha_mv; +EXPORT_SYMBOL (alpha_mv);#endif #ifndef alpha_using_srm
arch/alpha/lib/callback_srm.S +5 -0
@@ -3,6 +3,7 @@ */ #include <asm/console.h> +#include <asm/export.h> .text #define HWRPB_CRB_OFFSET 0xc0
@@ -92,6 +93,10 @@ CALLBACK(reset_env, CCB_RESET_ENV, 4) CALLBACK(save_env, CCB_SAVE_ENV, 1) CALLBACK(pswitch, CCB_PSWITCH, 3) CALLBACK(bios_emul, CCB_BIOS_EMUL, 5) + +EXPORT_SYMBOL(callback_getenv) +EXPORT_SYMBOL(callback_setenv) +EXPORT_SYMBOL(callback_save_env) .data __alpha_using_srm: # For use by bootpheader
arch/alpha/lib/checksum.c +3 -0
@@ -50,6 +50,7 @@ __sum16 csum_tcpudp_magic(__be32 saddr, (__force u64 )saddr + (__force u64 )daddr + (__force u64)sum + ((len + proto) << 8)); } +EXPORT_SYMBOL (csum_tcpudp_magic); __wsum csum_tcpudp_nofold(__be32 saddr, __be32 daddr, unsigned short len,
@@ -148,6 +149,7 @@ __sum16 ip_fast_csum(const void *iph, un {return (__force __sum16 )~do_csum (iph,ihl*4 ); } +EXPORT_SYMBOL (ip_fast_csum);/* * computes the checksum of a memory block at buff, length len,
@@ -182,3 +184,4 @@ __sum16 ip_compute_csum(const void *buff {return (__force __sum16 )~from64to16 (do_csum (buff,len)); } +EXPORT_SYMBOL (ip_compute_csum);
arch/alpha/lib/clear_page.S +2 -1
@@ -3,7 +3,7 @@ * * Zero an entire page. */ - +#include <asm/export.h> .text .align 4 .global clear_page
@@ -37,3 +37,4 @@ clear_page: nop .end clear_page + EXPORT_SYMBOL(clear_page)
arch/alpha/lib/clear_user.S +2 -0
@@ -24,6 +24,7 @@ * Clobbers: * $1,$2,$3,$4,$5,$6 */ +#include <asm/export.h> /* Allow an exception for an insn; exit if we get one. */ #define EX(x,y...) \
@@ -111,3 +112,4 @@ $exception: ret $31, ($28), 1 # .. e1 : .end __do_clear_user + EXPORT_SYMBOL(__do_clear_user)
arch/alpha/lib/copy_page.S +2 -1
@@ -3,7 +3,7 @@ * * Copy an entire page. */ - +#include <asm/export.h> .text .align 4 .global copy_page
@@ -47,3 +47,4 @@ copy_page: nop .end copy_page + EXPORT_SYMBOL(copy_page)
arch/alpha/lib/copy_user.S +3 -0
@@ -26,6 +26,8 @@ * $1,$2,$3,$4,$5,$6,$7 */ +#include <asm/export.h> + /* Allow an exception for an insn; exit if we get one. */ #define EXI(x,y...) \ 99: x,##y; \
@@ -143,3 +145,4 @@ $101: ret $31,($28),1 .end __copy_user +EXPORT_SYMBOL(__copy_user)
arch/alpha/lib/csum_ipv6_magic.S +2 -0
@@ -12,6 +12,7 @@ * added by Ivan Kokshaysky <[email protected]> */ +#include <asm/export.h> .globl csum_ipv6_magic .align 4 .ent csum_ipv6_magic
@@ -113,3 +114,4 @@ csum_ipv6_magic: ret # .. e1 : .end csum_ipv6_magic + EXPORT_SYMBOL(csum_ipv6_magic)
arch/alpha/lib/csum_partial_copy.c +2 -0
@@ -374,6 +374,7 @@ csum_partial_copy_from_user(const void _ }return (__force __wsum )checksum; } +EXPORT_SYMBOL (csum_partial_copy_from_user);__wsum csum_partial_copy_nocheck (const void *src,void *dst,int len,__wsum sum)
@@ -386,3 +387,4 @@ csum_partial_copy_nocheck(const void *srset_fs (oldfs);return checksum; } +EXPORT_SYMBOL (csum_partial_copy_nocheck);
arch/alpha/lib/dec_and_lock.c +2 -0
@@ -7,6 +7,7 @@#include <linux/spinlock.h> #include <linux/atomic.h> +#include <linux/export.h> asm (".text \n\ .global _atomic_dec_and_lock \n\
@@ -39,3 +40,4 @@ static int __used atomic_dec_and_lock_1(spin_unlock (lock);return 0 ; } +EXPORT_SYMBOL (_atomic_dec_and_lock);
arch/alpha/lib/divide.S +3 -0
@@ -45,6 +45,7 @@ * $28 - compare status */ +#include <asm/export.h> #define halt .long 0 /*
@@ -151,6 +152,7 @@ ufunction: addq $30,STACK,$30 ret $31,($23),1 .end ufunction +EXPORT_SYMBOL(ufunction) /* * Uhh.. Ugly signed division. I'd rather not have it at all, but
@@ -193,3 +195,4 @@ sfunction: addq $30,STACK,$30 ret $31,($23),1 .end sfunction +EXPORT_SYMBOL(sfunction)
arch/alpha/lib/ev6-clear_page.S +2 -1
@@ -3,7 +3,7 @@ * * Zero an entire page. */ - +#include <asm/export.h> .text .align 4 .global clear_page
@@ -52,3 +52,4 @@ clear_page: nop .end clear_page + EXPORT_SYMBOL(clear_page)
arch/alpha/lib/ev6-clear_user.S +2 -1
@@ -43,6 +43,7 @@ * want to leave a hole (and we also want to avoid repeating lots of work) */ +#include <asm/export.h> /* Allow an exception for an insn; exit if we get one. */ #define EX(x,y...) \ 99: x,##y; \
@@ -222,4 +223,4 @@ $exception: # Destination for exceptio nop # .. E .. .. : ret $31, ($28), 1 # L0 .. .. .. : L U L U .end __do_clear_user - + EXPORT_SYMBOL(__do_clear_user)
arch/alpha/lib/ev6-copy_page.S +2 -1
@@ -56,7 +56,7 @@ destination pages are in the dcache, but it is my guess that this is less important than the dcache miss case. */ - +#include <asm/export.h> .text .align 4 .global copy_page
@@ -201,3 +201,4 @@ copy_page: nop .end copy_page + EXPORT_SYMBOL(copy_page)
arch/alpha/lib/ev6-copy_user.S +2 -1
@@ -37,6 +37,7 @@ * L - lower subcluster; L0 - subcluster L0; L1 - subcluster L1 */ +#include <asm/export.h> /* Allow an exception for an insn; exit if we get one. */ #define EXI(x,y...) \ 99: x,##y; \
@@ -256,4 +257,4 @@ $101: ret $31,($28),1 # L0 .end __copy_user - + EXPORT_SYMBOL(__copy_user)
arch/alpha/lib/ev6-csum_ipv6_magic.S +2 -0
@@ -52,6 +52,7 @@ * may cause additional delay in rare cases (load-load replay traps). */ +#include <asm/export.h> .globl csum_ipv6_magic .align 4 .ent csum_ipv6_magic
@@ -148,3 +149,4 @@ csum_ipv6_magic: ret # L0 : L U L U .end csum_ipv6_magic + EXPORT_SYMBOL(csum_ipv6_magic)
arch/alpha/lib/ev6-divide.S +3 -0
@@ -55,6 +55,7 @@ * Try not to change the actual algorithm if possible for consistency. */ +#include <asm/export.h> #define halt .long 0 /*
@@ -205,6 +206,7 @@ ufunction: addq $30,STACK,$30 # E : ret $31,($23),1 # L0 : L U U L .end ufunction +EXPORT_SYMBOL(ufunction) /* * Uhh.. Ugly signed division. I'd rather not have it at all, but
@@ -257,3 +259,4 @@ sfunction: addq $30,STACK,$30 # E : ret $31,($23),1 # L0 : L U U L .end sfunction +EXPORT_SYMBOL(sfunction)
arch/alpha/lib/ev6-memchr.S +2 -1
@@ -27,7 +27,7 @@ * L - lower subcluster; L0 - subcluster L0; L1 - subcluster L1 * Try not to change the actual algorithm if possible for consistency. */ - +#include <asm/export.h> .set noreorder .set noat
@@ -189,3 +189,4 @@ $not_found: ret # L0 : .end memchr + EXPORT_SYMBOL(memchr)
arch/alpha/lib/ev6-memcpy.S +2 -1
@@ -19,7 +19,7 @@ * Temp usage notes: * $1,$2, - scratch */ - +#include <asm/export.h> .set noreorder .set noat
@@ -242,6 +242,7 @@ $nomoredata: nop # E : .end memcpy + EXPORT_SYMBOL(memcpy) /* For backwards module compatibility. */ __memcpy = memcpy
arch/alpha/lib/ev6-memset.S +6 -1
@@ -26,7 +26,7 @@ * as fixes will need to be made in multiple places. The performance gain * is worth it. */ - +#include <asm/export.h> .set noat .set noreorder .text
@@ -229,6 +229,7 @@ end_b: nop ret $31,($26),1 # L0 : .end ___memset + EXPORT_SYMBOL(___memset) /* * This is the original body of code, prior to replication and
@@ -406,6 +407,7 @@ end: nop ret $31,($26),1 # L0 : .end __constant_c_memset + EXPORT_SYMBOL(__constant_c_memset) /* * This is a replicant of the __constant_c_memset code, rescheduled
@@ -594,6 +596,9 @@ end_w: ret $31,($26),1 # L0 : .end __memsetw + EXPORT_SYMBOL(__memsetw) memset = ___memset __memset = ___memset + EXPORT_SYMBOL(memset) + EXPORT_SYMBOL(__memset)
arch/alpha/lib/ev67-strcat.S +2 -1
@@ -19,7 +19,7 @@ * string once. */ - +#include <asm/export.h> .text .align 4
@@ -52,3 +52,4 @@ $found: cttz $2, $3 # U0 : br __stxcpy # L0 : .end strcat + EXPORT_SYMBOL(strcat)
arch/alpha/lib/ev67-strchr.S +2 -1
@@ -15,7 +15,7 @@ * L - lower subcluster; L0 - subcluster L0; L1 - subcluster L1 * Try not to change the actual algorithm if possible for consistency. */ - +#include <asm/export.h> #include <asm/regdef.h> .set noreorder
@@ -86,3 +86,4 @@ $found: negq t0, t1 # E : clear all ret # L0 : .end strchr + EXPORT_SYMBOL(strchr)
arch/alpha/lib/ev67-strlen.S +2 -1
@@ -17,7 +17,7 @@ * U - upper subcluster; U0 - subcluster U0; U1 - subcluster U1 * L - lower subcluster; L0 - subcluster L0; L1 - subcluster L1 */ - +#include <asm/export.h> .set noreorder .set noat
@@ -47,3 +47,4 @@ $found: ret $31, ($26) # L0 : .end strlen + EXPORT_SYMBOL(strlen)
arch/alpha/lib/ev67-strncat.S +2 -1
@@ -20,7 +20,7 @@ * Try not to change the actual algorithm if possible for consistency. */ - +#include <asm/export.h> .text .align 4
@@ -92,3 +92,4 @@ $zerocount: ret # L0 : .end strncat + EXPORT_SYMBOL(strncat)
arch/alpha/lib/ev67-strrchr.S +2 -1
@@ -18,7 +18,7 @@ * L - lower subcluster; L0 - subcluster L0; L1 - subcluster L1 */ - +#include <asm/export.h> #include <asm/regdef.h> .set noreorder
@@ -107,3 +107,4 @@ $eos: nop .end strrchr + EXPORT_SYMBOL(strrchr)
arch/alpha/lib/fpreg.c +7 -0
@@ -4,6 +4,9 @@* (C) Copyright 1998 Linus Torvalds */ +#include <linux/compiler.h> +#include <linux/export.h> +#if defined(CONFIG_ALPHA_EV6 ) || defined(CONFIG_ALPHA_EV67 )#define STT (reg,val) asm volatile ("ftoit $f"#reg",%0" : "=r"(val));#else
@@ -52,6 +55,7 @@ alpha_read_fp_reg (unsigned long reg) }return val; } +EXPORT_SYMBOL (alpha_read_fp_reg);#if defined(CONFIG_ALPHA_EV6 ) || defined(CONFIG_ALPHA_EV67 )#define LDT (reg,val) asm volatile ("itoft %0,$f"#reg : : "r"(val));
@@ -97,6 +101,7 @@ alpha_write_fp_reg (unsigned long reg, ucase 31 :LDT (31 , val);break ; } } +EXPORT_SYMBOL (alpha_write_fp_reg);#if defined(CONFIG_ALPHA_EV6 ) || defined(CONFIG_ALPHA_EV67 )#define STS (reg,val) asm volatile ("ftois $f"#reg",%0" : "=r"(val));
@@ -146,6 +151,7 @@ alpha_read_fp_reg_s (unsigned long reg) }return val; } +EXPORT_SYMBOL (alpha_read_fp_reg_s);#if defined(CONFIG_ALPHA_EV6 ) || defined(CONFIG_ALPHA_EV67 )#define LDS (reg,val) asm volatile ("itofs %0,$f"#reg : : "r"(val));
@@ -191,3 +197,4 @@ alpha_write_fp_reg_s (unsigned long reg,case 31 :LDS (31 , val);break ; } } +EXPORT_SYMBOL (alpha_write_fp_reg_s);
arch/alpha/lib/memchr.S +2 -1
@@ -31,7 +31,7 @@ For correctness consider that: - only minimum number of quadwords may be accessed - the third argument is an unsigned long */ - +#include <asm/export.h> .set noreorder .set noat
@@ -162,3 +162,4 @@ $not_found: ret # .. e1 : .end memchr + EXPORT_SYMBOL(memchr)
arch/alpha/lib/memcpy.c +2 -3
@@ -16,6 +16,7 @@*/ #include <linux/types.h> +#include <linux/export.h> /* * This should be done in one go with ldq_u*2/mask/stq_u. Do it
@@ -158,6 +159,4 @@ void * memcpy(void * dest, const void *s__memcpy_unaligned_up ((unsigned long ) dest, (unsigned long ) src, n);return dest; } - -/* For backward modules compatibility, define __memcpy. */ -asm("__memcpy = memcpy; .globl __memcpy" ); +EXPORT_SYMBOL (memcpy);
arch/alpha/lib/memmove.S +2 -1
@@ -6,7 +6,7 @@ * This is hand-massaged output from the original memcpy.c. We defer to * memcpy whenever possible; the backwards copy loops are not unrolled. */ - +#include <asm/export.h> .set noat .set noreorder .text
@@ -179,3 +179,4 @@ $egress: nop .end memmove + EXPORT_SYMBOL(memmove)
arch/alpha/lib/memset.S +6 -1
@@ -13,7 +13,7 @@ * The scheduling comments are according to the EV5 documentation (and done by * hand, so they might well be incorrect, please do tell me about it..) */ - +#include <asm/export.h> .set noat .set noreorder .text
@@ -106,6 +106,8 @@ within_one_quad: end: ret $31,($26),1 /* E1 */ .end ___memset +EXPORT_SYMBOL(___memset) +EXPORT_SYMBOL(__constant_c_memset) .align 5 .ent __memsetw
@@ -122,6 +124,9 @@ __memsetw: br __constant_c_memset /* .. E1 */ .end __memsetw +EXPORT_SYMBOL(__memsetw) memset = ___memset __memset = ___memset + EXPORT_SYMBOL(memset) + EXPORT_SYMBOL(__memset)
arch/alpha/lib/strcat.S +2 -0
@@ -4,6 +4,7 @@ * * Append a null-terminated string from SRC to DST. */ +#include <asm/export.h> .text
@@ -50,3 +51,4 @@ $found: negq $2, $3 # clear all but br __stxcpy .end strcat +EXPORT_SYMBOL(strcat);
arch/alpha/lib/strchr.S +2 -1
@@ -5,7 +5,7 @@ * Return the address of a given character within a null-terminated * string, or null if it is not found. */ - +#include <asm/export.h> #include <asm/regdef.h> .set noreorder
@@ -68,3 +68,4 @@ $retnull: ret # .. e1 : .end strchr + EXPORT_SYMBOL(strchr)
arch/alpha/lib/strcpy.S +2 -1
@@ -5,7 +5,7 @@ * Copy a null-terminated string from SRC to DST. Return a pointer * to the null-terminator in the source. */ - +#include <asm/export.h> .text .align 3
@@ -21,3 +21,4 @@ strcpy: br __stxcpy # do the copy .end strcpy + EXPORT_SYMBOL(strcpy)
arch/alpha/lib/strlen.S +2 -1
@@ -11,7 +11,7 @@ * do this instead of the 9 instructions that * binary search needs). */ - +#include <asm/export.h> .set noreorder .set noat
@@ -55,3 +55,4 @@ done: subq $0, $16, $0 ret $31, ($26) .end strlen + EXPORT_SYMBOL(strlen)
arch/alpha/lib/strncat.S +2 -1
@@ -9,7 +9,7 @@ * past count, whereas libc may write to count+1. This follows the generic * implementation in lib/string.c and is, IMHO, more sensible. */ - +#include <asm/export.h> .text .align 3
@@ -82,3 +82,4 @@ $zerocount: ret .end strncat + EXPORT_SYMBOL(strncat)
arch/alpha/lib/strncpy.S +2 -1
@@ -10,7 +10,7 @@ * version has cropped that bit o' nastiness as well as assuming that * __stxncpy is in range of a branch. */ - +#include <asm/export.h> .set noat .set noreorder
@@ -79,3 +79,4 @@ $zerolen: ret .end strncpy + EXPORT_SYMBOL(strncpy)
arch/alpha/lib/strrchr.S +2 -1
@@ -5,7 +5,7 @@ * Return the address of the last occurrence of a given character * within a null-terminated string, or null if it is not found. */ - +#include <asm/export.h> #include <asm/regdef.h> .set noreorder
@@ -85,3 +85,4 @@ $retnull: ret # .. e1 : .end strrchr + EXPORT_SYMBOL(strrchr)
[email protected]
maintainerPATCH 66/75 alpha: get rid of tail-zeroing in __copy_user()
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Al Viro <[email protected]>
commit 085354f907969fb3ee33f236368f6e1dd4c74d62 upstream.
... and adjust copy_from_user() accordingly
--- arch/alpha/include/asm/uaccess.h | 9 +++++---- arch/alpha/lib/copy_user.S | 16 +--------------- arch/alpha/lib/ev6-copy_user.S | 23 +---------------------- 3 files changed, 7 insertions(+), 41 deletions(-)
arch/alpha/include/asm/uaccess.h +5 -4
@@ -396,11 +396,12 @@ copy_to_user(void __user *to, const voidextern inline long copy_from_user (void *to,const void __user *from,long n) { +long res = n;if (likely (__access_ok ((unsigned long )from, n,get_fs ()))) - n =__copy_tofrom_user_nocheck (to, (__force void *)from, n); -else -memset (to,0 , n); -return n; + res =__copy_from_user_inatomic (to, from, n); +if (unlikely (res)) +memset (to + (n - res),0 , res); +return res; }extern void __do_clear_user (void );
arch/alpha/lib/copy_user.S +1 -15
@@ -126,22 +126,8 @@ $65: bis $31,$31,$0 $41: $35: -$exitout: - ret $31,($28),1 - $exitin: - /* A stupid byte-by-byte zeroing of the rest of the output - buffer. This cures security holes by never leaving - random kernel data around to be copied elsewhere. */ - - mov $0,$1 -$101: - EXO ( ldq_u $2,0($6) ) - subq $1,1,$1 - mskbl $2,$6,$2 - EXO ( stq_u $2,0($6) ) - addq $6,1,$6 - bgt $1,$101 +$exitout: ret $31,($28),1 .end __copy_user
arch/alpha/lib/ev6-copy_user.S +1 -22
@@ -228,33 +228,12 @@ $dirtyentry: bgt $0,$onebyteloop # U .. .. .. : U L U L $zerolength: +$exitin: $exitout: # Destination for exception recovery(?) nop # .. .. .. E nop # .. .. E .. nop # .. E .. .. ret $31,($28),1 # L0 .. .. .. : L U L U -$exitin: - - /* A stupid byte-by-byte zeroing of the rest of the output - buffer. This cures security holes by never leaving - random kernel data around to be copied elsewhere. */ - - nop - nop - nop - mov $0,$1 - -$101: - EXO ( stb $31,0($6) ) # L - subq $1,1,$1 # E - addq $6,1,$6 # E - bgt $1,$101 # U - - nop - nop - nop - ret $31,($28),1 # L0 - .end __copy_user EXPORT_SYMBOL(__copy_user)
[email protected]
maintainerPATCH 67/75 alpha: switch __copy_user() and __do_clean_user() to normal calling conventions
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Al Viro <[email protected]>
commit 8525023121de4848b5f0a7d867ffeadbc477774d upstream.
They used to need odd calling conventions due to old exception handling mechanism, the last remnants of which had disappeared back in 2002.
--- arch/alpha/include/asm/uaccess.h | 67 ++++--------------------- arch/alpha/lib/clear_user.S | 66 +++++++++--------------- arch/alpha/lib/copy_user.S | 82 ++++++++++++------------------ arch/alpha/lib/ev6-clear_user.S | 84 +++++++++++++------------------ arch/alpha/lib/ev6-copy_user.S | 104 ++++++++++++++++----------------------- 5 files changed, 151 insertions(+), 252 deletions(-)
arch/alpha/include/asm/uaccess.h +11 -56
@@ -341,45 +341,17 @@ __asm__ __volatile__("1: stb %r2,%1\n"* Complex access routines */ -/* This little bit of silliness is to get the GP loaded for a function -that ordinarily wouldn't. Otherwise we could have it done by the macro -directly, which can be optimized the linker. */ -#ifdef MODULE -#define __module_address (sym) "r"(sym), -#define __module_call (ra, arg, sym) "jsr $" #ra ",(%" #arg ")," #sym -#else -#define __module_address (sym) -#define __module_call (ra, arg, sym) "bsr $" #ra "," #sym " !samegp" -#endif +extern long __copy_user (void *to,const void *from,long len); -extern void __copy_user (void ); - -extern inline long -__copy_tofrom_user_nocheck (void *to,const void *from,long len) -{ - register void * __cu_to __asm__("$6") = to; - register const void * __cu_from __asm__("$7") = from; - register long __cu_len __asm__("$0") = len; - - __asm__ __volatile__( - __module_call(28, 3, __copy_user) - : "=r" (__cu_len), "=r" (__cu_from), "=r" (__cu_to) - : __module_address(__copy_user) - "0" (__cu_len), "1" (__cu_from), "2" (__cu_to) - : "$1", "$2", "$3", "$4", "$5", "$28", "memory"); - -return __cu_len; -} - -#define __copy_to_user (to, from, n) \ -({ \ - __chk_user_ptr(to); \ - __copy_tofrom_user_nocheck((__force void *)(to), (from), (n)); \ +#define __copy_to_user (to, from, n) \ +({ \ + __chk_user_ptr(to); \ + __copy_user((__force void *)(to), (from), (n)); \ }) -#define __copy_from_user (to, from, n) \ -({ \ - __chk_user_ptr(from); \ - __copy_tofrom_user_nocheck((to), (__force void *)(from), (n)); \ +#define __copy_from_user (to, from, n) \ +({ \ + __chk_user_ptr(from); \ + __copy_user((to), (__force void *)(from), (n)); \ })#define __copy_to_user_inatomic __copy_to_user
@@ -389,7 +361,7 @@ extern inline long copy_to_user(void __user *to, const void *from, long n) {if (likely (__access_ok ((unsigned long )to, n,get_fs ()))) - n =__copy_tofrom_user_nocheck ((__force void *)to, from, n); + n =__copy_user ((__force void *)to, from, n);return n; }
@@ -404,21 +376,7 @@ copy_from_user(void *to, const void __usreturn res; } -extern void __do_clear_user (void ); - -extern inline long -__clear_user (void __user *to,long len) -{ - register void __user * __cl_to __asm__("$6") = to; - register long __cl_len __asm__("$0") = len; - __asm__ __volatile__( - __module_call(28, 2, __do_clear_user) - : "=r"(__cl_len), "=r"(__cl_to) - : __module_address(__do_clear_user) - "0"(__cl_len), "1"(__cl_to) - : "$1", "$2", "$3", "$4", "$5", "$28", "memory"); -return __cl_len; -} +extern long __clear_user (void __user *to,long len);extern inline long clear_user (void __user *to,long len)
@@ -428,9 +386,6 @@ clear_user(void __user *to, long len)return len; } -#undef __module_address -#undef __module_call -#define user_addr_max () \ (segment_eq(get_fs(), USER_DS) ? TASK_SIZE : ~0UL)
arch/alpha/lib/clear_user.S +26 -40
124 lines not on this page · raw message
arch/alpha/lib/copy_user.S +34 -48
140 lines not on this page · raw message
arch/alpha/lib/ev6-clear_user.S +35 -49
184 lines not on this page · raw message
arch/alpha/lib/ev6-copy_user.S +45 -59
211 lines not on this page · raw message
[email protected]
maintainerPATCH 68/75 powerpc/64s: Fix instruction encoding for lis in ppc_function_entry()
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Naveen N. Rao <[email protected]>
commit cea15316ceee2d4a51dfdecd79e08a438135416c upstream.
'lis r2,N' is 'addis r2,0,N' and the instruction encoding in the macro LIS_R2 is incorrect (it currently maps to 'addis r0,r2,N'). Fix the same.
--- arch/powerpc/include/asm/code-patching.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/include/asm/code-patching.h +1 -1
@@ -45,7 +45,7 @@ void __patch_exception(int exc, unsigned#endif #define OP_RT_RA_MASK 0xffff0000UL -#define LIS_R2 0x3c020000UL +#define LIS_R2 0x3c400000UL#define ADDIS_R2_R12 0x3c4c0000UL#define ADDI_R2_R2 0x38420000UL
[email protected]
maintainerPATCH 69/75 media: hdpvr: Fix an error handling path in hdpvr_probe()
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Arvind Yadav <[email protected]>
commit c0f71bbb810237a38734607ca4599632f7f5d47f upstream.
Here, hdpvr_register_videodev() is responsible for setup and register a video device. Also defining and initializing a worker. hdpvr_register_videodev() is calling by hdpvr_probe at last. So no need to flush any work here.
Unregister v4l2, free buffers and memory. If hdpvr_probe() will fail.
[krzk: backport to v4.4, still using single thread workqueue which
is drained/destroyed now in proper step so it cannot be NULL]
--- drivers/media/usb/hdpvr/hdpvr-core.c | 33 +++++++++++++++++++-------------- 1 file changed, 19 insertions(+), 14 deletions(-)
drivers/media/usb/hdpvr/hdpvr-core.c +19 -14
@@ -297,7 +297,7 @@ static int hdpvr_probe(struct usb_interf/* register v4l2_device early so it can be used for printks */ if (v4l2_device_register (&interface->dev, &dev->v4l2_dev)) {dev_err (&interface->dev,"v4l2_device_register failed\n" ); - goto error; + goto error_free_dev; }mutex_init (&dev->io_mutex);
@@ -306,7 +306,7 @@ static int hdpvr_probe(struct usb_interf dev->usbc_buf =kmalloc (64 ,GFP_KERNEL );if (!dev->usbc_buf) {v4l2_err (&dev->v4l2_dev,"Out of memory\n" ); - goto error; + goto error_v4l2_unregister; }init_waitqueue_head (&dev->wait_buffer);
@@ -314,7 +314,7 @@ static int hdpvr_probe(struct usb_interf dev->workqueue =create_singlethread_workqueue ("hdpvr_buffer" );if (!dev->workqueue) - goto error; + goto err_free_usbc; dev->options = hdpvr_default_options;
@@ -348,13 +348,13 @@ static int hdpvr_probe(struct usb_interf }if (!dev->bulk_in_endpointAddr) {v4l2_err (&dev->v4l2_dev,"Could not find bulk-in endpoint\n" ); - goto error; + goto error_put_usb; }/* init the device */ if (hdpvr_device_init (dev)) {v4l2_err (&dev->v4l2_dev,"device init failed\n" ); - goto error; + goto error_put_usb; }mutex_lock (&dev->io_mutex);
@@ -362,7 +362,7 @@ static int hdpvr_probe(struct usb_interfmutex_unlock (&dev->io_mutex);v4l2_err (&dev->v4l2_dev,"allocating transfer buffers failed\n" ); - goto error; + goto error_put_usb; }mutex_unlock (&dev->io_mutex);
@@ -370,7 +370,7 @@ static int hdpvr_probe(struct usb_interf retval =hdpvr_register_i2c_adapter (dev);if (retval <0 ) {v4l2_err (&dev->v4l2_dev,"i2c adapter register failed\n" ); - goto error; + goto error_free_buffers; } client =hdpvr_register_ir_rx_i2c (dev);
@@ -412,15 +412,20 @@ static int hdpvr_probe(struct usb_interf reg_fail:#if IS_ENABLED (CONFIG_I2C )i2c_del_adapter (&dev->i2c_adapter); +error_free_buffers:#endif +hdpvr_free_buffers (dev); +error_put_usb: +usb_put_dev (dev->udev); +/* Destroy single thread */ +destroy_workqueue (dev->workqueue); +err_free_usbc: +kfree (dev->usbc_buf); +error_v4l2_unregister: +v4l2_device_unregister (&dev->v4l2_dev); +error_free_dev: +kfree (dev); error: -if (dev) { -/* Destroy single thread */ -if (dev->workqueue) -destroy_workqueue (dev->workqueue); -/* this frees allocated memory */ -hdpvr_delete (dev); - }return retval; }
[email protected]
maintainerPATCH 70/75 KVM: arm64: Fix exclusive limit for IPA size
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Marc Zyngier <[email protected]>
Commit 262b003d059c6671601a19057e9fe1a5e7f23722 upstream.
When registering a memslot, we check the size and location of that memslot against the IPA size to ensure that we can provide guest access to the whole of the memory.
Unfortunately, this check rejects memslot that end-up at the exact limit of the addressing capability for a given IPA size. For example, it refuses the creation of a 2GB memslot at 0x8000000 with a 32bit IPA space.
Fix it by relaxing the check to accept a memslot reaching the limit of the IPA space.
--- arch/arm/kvm/mmu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/kvm/mmu.c +1 -1
@@ -1789,7 +1789,7 @@ int kvm_arch_prepare_memory_region(struc* Prevent userspace from creating a memory region outside of the IPA * space addressable by the KVM guest IPA space. */ -if (memslot->base_gfn + memslot->npages >= +if (memslot->base_gfn + memslot->npages > (KVM_PHYS_SIZE >>PAGE_SHIFT ))return -EFAULT ;
[email protected]
maintainerPATCH 71/75 iio: imu: adis16400: release allocated memory on failure
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Navid Emamdoost <[email protected]>
commit ab612b1daf415b62c58e130cb3d0f30b255a14d0 upstream.
In adis_update_scan_mode, if allocation for adis->buffer fails, previously allocated adis->xfer needs to be released.
--- drivers/iio/imu/adis_buffer.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/iio/imu/adis_buffer.c +4 -1
@@ -39,8 +39,11 @@ int adis_update_scan_mode(struct iio_devreturn -ENOMEM ; adis->buffer =kzalloc (indio_dev->scan_bytes *2 ,GFP_KERNEL ); -if (!adis->buffer) +if (!adis->buffer) { +kfree (adis->xfer); + adis->xfer =NULL ;return -ENOMEM ; + } rx = adis->buffer; tx = rx + scan_count;
[email protected]
maintainerPATCH 72/75 iio: imu: adis16400: fix memory leak
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Navid Emamdoost <[email protected]>
commit 9c0530e898f384c5d279bfcebd8bb17af1105873 upstream.
In adis_update_scan_mode_burst, if adis->buffer allocation fails release the adis->xfer.
--- drivers/iio/imu/adis16400_buffer.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/iio/imu/adis16400_buffer.c +4 -1
@@ -37,8 +37,11 @@ int adis16400_update_scan_mode(struct iireturn -ENOMEM ; adis->buffer =kzalloc (burst_length +sizeof (u16),GFP_KERNEL ); -if (!adis->buffer) +if (!adis->buffer) { +kfree (adis->xfer); + adis->xfer =NULL ;return -ENOMEM ; + } tx = adis->buffer + burst_length; tx[0 ] =ADIS_READ_REG (ADIS16400_GLOB_CMD );
[email protected]
maintainerPATCH 73/75 xen/events: reset affinity of 2-level event when tearing it down
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Juergen Gross <[email protected]>
commit 9e77d96b8e2724ed00380189f7b0ded61113b39f upstream.
When creating a new event channel with 2-level events the affinity needs to be reset initially in order to avoid using an old affinity from earlier usage of the event channel port. So when tearing an event channel down reset all affinity bits.
The same applies to the affinity when onlining a vcpu: all old affinity settings for this vcpu must be reset. As percpu events get initialized before the percpu event channel hook is called, resetting of the affinities happens after offlining a vcpu (this is working, as initial percpu memory is zeroed out).
--- drivers/xen/events/events_2l.c | 15 +++++++++++++++ drivers/xen/events/events_base.c | 1 + drivers/xen/events/events_internal.h | 8 ++++++++ 3 files changed, 24 insertions(+)
drivers/xen/events/events_2l.c +15 -0
@@ -46,6 +46,11 @@ static unsigned evtchn_2l_max_channels(vreturn EVTCHN_2L_NR_CHANNELS ; } +static void evtchn_2l_remove (evtchn_port_t evtchn,unsigned int cpu) +{ +clear_bit (evtchn,BM (per_cpu (cpu_evtchn_mask, cpu))); +} +static void evtchn_2l_bind_to_cpu (struct irq_info *info,unsigned cpu) {clear_bit (info->evtchn,BM (per_cpu (cpu_evtchn_mask, info->cpu)));
@@ -353,9 +358,18 @@ static void evtchn_2l_resume(void) EVTCHN_2L_NR_CHANNELS/BITS_PER_EVTCHN_WORD); } +static int evtchn_2l_percpu_deinit (unsigned int cpu) +{ +memset (per_cpu (cpu_evtchn_mask, cpu),0 ,sizeof (xen_ulong_t) * +EVTCHN_2L_NR_CHANNELS /BITS_PER_EVTCHN_WORD ); + +return 0 ; +} +static const struct evtchn_ops evtchn_ops_2l = { .max_channels = evtchn_2l_max_channels, .nr_channels = evtchn_2l_max_channels, + .remove = evtchn_2l_remove, .bind_to_cpu = evtchn_2l_bind_to_cpu, .clear_pending = evtchn_2l_clear_pending, .set_pending = evtchn_2l_set_pending,
@@ -365,6 +379,7 @@ static const struct evtchn_ops evtchn_op .unmask = evtchn_2l_unmask, .handle_events = evtchn_2l_handle_events, .resume = evtchn_2l_resume, + .percpu_deinit = evtchn_2l_percpu_deinit, };void __init xen_evtchn_2l_init (void )
drivers/xen/events/events_base.c +1 -0
@@ -286,6 +286,7 @@ static int xen_irq_info_pirq_setup(unsigstatic void xen_irq_info_cleanup (struct irq_info *info) {set_evtchn_to_irq (info->evtchn,-1 ); +xen_evtchn_port_remove (info->evtchn, info->cpu); info->evtchn =0 ; }
drivers/xen/events/events_internal.h +8 -0
@@ -67,6 +67,7 @@ struct evtchn_ops {unsigned (*nr_channels)(void );int (*setup)(struct irq_info *info); +void (*remove)(evtchn_port_t port,unsigned int cpu);void (*bind_to_cpu)(struct irq_info *info,unsigned cpu);void (*clear_pending)(unsigned port);
@@ -109,6 +110,13 @@ static inline int xen_evtchn_port_setup(return 0 ; } +static inline void xen_evtchn_port_remove (evtchn_port_t evtchn, +unsigned int cpu) +{ +if (evtchn_ops->remove) + evtchn_ops->remove (evtchn, cpu); +} +static inline void xen_evtchn_port_bind_to_cpu (struct irq_info *info,unsigned cpu) {
[email protected]
maintainerPATCH 74/75 xen/events: dont unmask an event channel when an eoi is pending
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Juergen Gross <[email protected]>
commit 25da4618af240fbec6112401498301a6f2bc9702 upstream.
An event channel should be kept masked when an eoi is pending for it. When being migrated to another cpu it might be unmasked, though.
In order to avoid this keep three different flags for each event channel to be able to distinguish "normal" masking/unmasking from eoi related masking/unmasking and temporary masking. The event channel should only be able to generate an interrupt if all flags are cleared.
[boris -- corrected Fixed tag format]
--- drivers/xen/events/events_2l.c | 7 -- drivers/xen/events/events_base.c | 108 ++++++++++++++++++++++++++--------- drivers/xen/events/events_fifo.c | 7 -- drivers/xen/events/events_internal.h | 13 +--- 4 files changed, 87 insertions(+), 48 deletions(-)
drivers/xen/events/events_2l.c +0 -7
@@ -75,12 +75,6 @@ static bool evtchn_2l_is_pending(unsignereturn sync_test_bit (port,BM (&s->evtchn_pending[0 ])); } -static bool evtchn_2l_test_and_set_mask (unsigned port) -{ -struct shared_info *s = HYPERVISOR_shared_info; -return sync_test_and_set_bit (port,BM (&s->evtchn_mask[0 ])); -} -static void evtchn_2l_mask (unsigned port) {struct shared_info *s = HYPERVISOR_shared_info;
@@ -374,7 +368,6 @@ static const struct evtchn_ops evtchn_op .clear_pending = evtchn_2l_clear_pending, .set_pending = evtchn_2l_set_pending, .is_pending = evtchn_2l_is_pending, - .test_and_set_mask = evtchn_2l_test_and_set_mask, .mask = evtchn_2l_mask, .unmask = evtchn_2l_unmask, .handle_events = evtchn_2l_handle_events,
drivers/xen/events/events_base.c +81 -27
227 lines not on this page · raw message
drivers/xen/events/events_fifo.c +0 -7
@@ -209,12 +209,6 @@ static bool evtchn_fifo_is_pending(unsigreturn sync_test_bit (EVTCHN_FIFO_BIT (PENDING , word),BM (word)); } -static bool evtchn_fifo_test_and_set_mask (unsigned port) -{ -event_word_t *word =event_word_from_port (port); -return sync_test_and_set_bit (EVTCHN_FIFO_BIT (MASKED , word),BM (word)); -} -static void evtchn_fifo_mask (unsigned port) {event_word_t *word =event_word_from_port (port);
@@ -421,7 +415,6 @@ static const struct evtchn_ops evtchn_op .clear_pending = evtchn_fifo_clear_pending, .set_pending = evtchn_fifo_set_pending, .is_pending = evtchn_fifo_is_pending, - .test_and_set_mask = evtchn_fifo_test_and_set_mask, .mask = evtchn_fifo_mask, .unmask = evtchn_fifo_unmask, .handle_events = evtchn_fifo_handle_events,
drivers/xen/events/events_internal.h +6 -7
@@ -35,13 +35,18 @@ struct irq_info {struct list_head eoi_list;short refcnt;short spurious_cnt; -enum xen_irq_type type;/* type */ +short type;/* type */ +u8 mask_reason;/* Why is event channel masked */ +#define EVT_MASK_REASON_EXPLICIT 0x01 +#define EVT_MASK_REASON_TEMPORARY 0x02 +#define EVT_MASK_REASON_EOI_PENDING 0x04unsigned irq;unsigned int evtchn;/* event channel */ unsigned short cpu;/* cpu bound */ unsigned short eoi_cpu;/* EOI must happen on this cpu */ unsigned int irq_epoch;/* If eoi_cpu valid: irq_epoch of event */ u64 eoi_time;/* Time in jiffies when to EOI. */ +spinlock_t lock;union {unsigned short virq;
@@ -73,7 +78,6 @@ struct evtchn_ops {void (*clear_pending)(unsigned port);void (*set_pending)(unsigned port);bool (*is_pending)(unsigned port); -bool (*test_and_set_mask)(unsigned port);void (*mask)(unsigned port);void (*unmask)(unsigned port);
@@ -138,11 +142,6 @@ static inline bool test_evtchn(unsignedreturn evtchn_ops->is_pending (port); } -static inline bool test_and_set_mask (unsigned port) -{ -return evtchn_ops->test_and_set_mask (port); -} -static inline void mask_evtchn (unsigned port) {return evtchn_ops->mask (port);
[email protected]
maintainerPATCH 75/75 xen/events: avoid handling the same event on two cpus at the same time
In reply to [email protected]From: Greg Kroah-Hartman <[email protected]>
From: Juergen Gross <[email protected]>
commit b6622798bc50b625a1e62f82c7190df40c1f5b21 upstream.
When changing the cpu affinity of an event it can happen today that (with some unlucky timing) the same event will be handled on the old and the new cpu at the same time.
Avoid that by adding an "event active" flag to the per-event data and call the handler only if this flag isn't set.
--- drivers/xen/events/events_base.c | 25 +++++++++++++++++-------- drivers/xen/events/events_internal.h | 1 + 2 files changed, 18 insertions(+), 8 deletions(-)
drivers/xen/events/events_base.c +17 -8
@@ -702,6 +702,12 @@ static void xen_evtchn_close(unsigned inBUG (); } +static void event_handler_exit (struct irq_info *info) +{ +smp_store_release (&info->is_active,0 ); +clear_evtchn (info->evtchn); +} +static void pirq_query_unmask (int irq) {struct physdev_irq_status_query irq_status;
@@ -732,13 +738,13 @@ static void eoi_pirq(struct irq_data *da likely(!irqd_irq_disabled(data))) {do_mask (info,EVT_MASK_REASON_TEMPORARY ); -clear_evtchn (evtchn); +event_handler_exit (info);irq_move_masked_irq (data);do_unmask (info,EVT_MASK_REASON_TEMPORARY ); } else -clear_evtchn (evtchn ); +event_handler_exit (info );if (pirq_needs_eoi (data->irq)) { rc =HYPERVISOR_physdev_op (PHYSDEVOP_eoi, &eoi);
@@ -1573,6 +1579,8 @@ void handle_irq_for_port(evtchn_port_t p } info =info_for_irq (irq); +if (xchg_acquire (&info->is_active,1 )) +return ;if (ctrl->defer_eoi) { info->eoi_cpu =smp_processor_id ();
@@ -1749,13 +1757,13 @@ static void ack_dynirq(struct irq_data * likely(!irqd_irq_disabled(data))) {do_mask (info,EVT_MASK_REASON_TEMPORARY ); -clear_evtchn (evtchn); +event_handler_exit (info);irq_move_masked_irq (data);do_unmask (info,EVT_MASK_REASON_TEMPORARY ); } else -clear_evtchn (evtchn ); +event_handler_exit (info ); }static void mask_ack_dynirq (struct irq_data *data)
@@ -1771,7 +1779,7 @@ static void lateeoi_ack_dynirq(struct irif (VALID_EVTCHN (evtchn)) {do_mask (info,EVT_MASK_REASON_EOI_PENDING ); -clear_evtchn (evtchn); +event_handler_exit (info); } }
@@ -1782,7 +1790,7 @@ static void lateeoi_mask_ack_dynirq(struif (VALID_EVTCHN (evtchn)) {do_mask (info,EVT_MASK_REASON_EXPLICIT ); -clear_evtchn (evtchn); +event_handler_exit (info); } }
@@ -1891,10 +1899,11 @@ static void restore_cpu_ipis(unsigned in/* Clear an irq's pending state, in preparation for polling on it */ void xen_clear_irq_pending (int irq) { -int evtchn =evtchn_from_irq (irq); +struct irq_info *info =info_for_irq (irq); +evtchn_port_t evtchn = info ? info->evtchn :0 ;if (VALID_EVTCHN (evtchn)) -clear_evtchn (evtchn); +event_handler_exit (info); }EXPORT_SYMBOL (xen_clear_irq_pending);void xen_set_irq_pending (int irq)
drivers/xen/events/events_internal.h +1 -0
@@ -40,6 +40,7 @@ struct irq_info {#define EVT_MASK_REASON_EXPLICIT 0x01#define EVT_MASK_REASON_TEMPORARY 0x02#define EVT_MASK_REASON_EOI_PENDING 0x04 +u8 is_active;/* Is event just being handled? */ unsigned irq;unsigned int evtchn;/* event channel */ unsigned short cpu;/* cpu bound */
Quoted 11 lines · On Mon, 15 Mar 2021 14:51:14 +0100, [email protected] wrote:
From: Greg Kroah-Hartman <[email protected]>
This is the start of the stable review cycle for the 4.4.262 release. There are 75 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 17 Mar 2021 13:51:52 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.262-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.4.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v4.4:
6 builds: 6 pass, 0 fail
12 boots: 12 pass, 0 fail
28 tests: 28 pass, 0 failLinux version: 4.4.262-rc1-gaa7c5e8521a7
Boards tested: tegra124-jetson-tk1, tegra20-ventana,
tegra30-cardhu-a04
Jon
Hi!
Quoted 4 lines
This is the start of the stable review cycle for the 4.4.262 release. There are 75 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
CIP testing did not find any problems here:
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/tree/linux-4.4.y
Best regards,
Pavel
Signature · 2 lines
DENX Software Engineering GmbH, Managing Director: Wolfgang Denk HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Quoted 10 lines · On Mon, Mar 15, 2021 at 02:51:14PM +0100, [email protected] wrote:
From: Greg Kroah-Hartman <[email protected]>
This is the start of the stable review cycle for the 4.4.262 release. There are 75 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 17 Mar 2021 13:51:52 +0000. Anything received after that time might be too late.
Build results:
total: 165 pass: 165 fail: 0 Qemu test results: total: 328 pass: 328 fail: 0
Guenter
Quoted 3 lines · On Mon, 15 Mar 2021 14:51:14 +0100 [email protected] wrote:
From: Greg Kroah-Hartman <[email protected]>
This is the start of the stable review cycle for the 4.4.262 release.
Tested on amd64, arm64, armhf, i386, m68k, or1k, powerpc, ppc64, ppc64el, s390x, sparc64. No problems detected.
Quoted 12 lines · On Mon, 15 Mar 2021 at 19:23, <[email protected]> wrote:
From: Greg Kroah-Hartman <[email protected]>
This is the start of the stable review cycle for the 4.4.262 release. There are 75 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 17 Mar 2021 13:51:52 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.262-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.4.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
Summary
------------------------------------------------------------------------
kernel: 4.4.262-rc1
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git branch: linux-4.4.y
git commit: 712d2b53fc1193899b028c57bb0fe069936e958e
git describe: v4.4.261-76-g712d2b53fc11
Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-4.4.y/build/v4.4.261-76-g712d2b53fc11
No regressions (compared to build v4.4.261)
No fixes (compared to build v4.4.261)
Ran 30821 total tests in the following environments and test suites.
Environments
--------------
- arm
- arm64
- i386
- juno-64k_page_size
- juno-r2 - arm64
- juno-r2-compat
- juno-r2-kasan
- mips
- qemu-arm64-kasan
- qemu-x86_64-kasan
- qemu_arm
- qemu_arm64
- qemu_arm64-compat
- qemu_i386
- qemu_x86_64
- qemu_x86_64-compat
- sparc
- x15 - arm
- x86_64
- x86-kasan
- x86_64
Test Suites
-----------
* build
* linux-log-parser
* kselftest-android
* kselftest-bpf
* kselftest-capabilities
* kselftest-cgroup
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-cpufreq
* kselftest-efivarfs
* kselftest-filesystems
* kselftest-firmware
* kselftest-fpu
* kselftest-futex
* kselftest-gpio
* kselftest-intel_pstate
* kselftest-ipc
* kselftest-ir
* kselftest-kcmp
* kselftest-kexec
* kselftest-kvm
* kselftest-lib
* kselftest-livepatch
* kselftest-lkdtm
* kselftest-membarrier
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-seccomp
* kselftest-sigaltstack
* kselftest-size
* kselftest-splice
* kselftest-static_keys
* kselftest-sysctl
* kselftest-timens
* kselftest-timers
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user
* kselftest-vm
* kselftest-x86
* kselftest-zram
* libhugetlbfs
* ltp-cap_bounds-tests
* ltp-commands-tests
* ltp-containers-tests
* ltp-controllers-tests
* ltp-cpuhotplug-tests
* ltp-crypto-tests
* ltp-cve-tests
* ltp-dio-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-hugetlb-tests
* ltp-io-tests
* ltp-ipc-tests
* ltp-math-tests
* ltp-mm-tests
* ltp-nptl-tests
* ltp-open-posix-tests
* ltp-pty-tests
* ltp-sched-tests
* ltp-securebits-tests
* ltp-syscalls-tests
* ltp-tracing-tests
* network-basic-tests
* perf
* kselftest-sync
* kvm-unit-tests
* v4l2-compliance
* install-android-platform-tools-r2600
* fwts
* ssuite
Summary
------------------------------------------------------------------------
kernel: 4.4.262-rc1
git repo: https://git.linaro.org/lkft/arm64-stable-rc.git
git branch: 4.4.262-rc1-hikey-20210315-965
git commit: 0571025494b76ef8d857a1bbf7937b881e18ba1e
git describe: 4.4.262-rc1-hikey-20210315-965
Test details: https://qa-reports.linaro.org/lkft/linaro-hikey-stable-rc-4.4-oe/build/4.4.262-rc1-hikey-20210315-965
No regressions (compared to build 4.4.262-rc1-hikey-20210315-962)
No fixes (compared to build 4.4.262-rc1-hikey-20210315-962)
Ran 1966 total tests in the following environments and test suites.
Environments
--------------
- hi6220-hikey - arm64
Test Suites
-----------
* build
* install-android-platform-tools-r2600
* kselftest-android
* kselftest-bpf
* kselftest-capabilities
* kselftest-cgroup
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-cpufreq
* kselftest-efivarfs
* kselftest-filesystems
* kselftest-firmware
* kselftest-fpu
* kselftest-futex
* kselftest-gpio
* kselftest-intel_pstate
* kselftest-ipc
* kselftest-ir
* kselftest-kcmp
* kselftest-lib
* kselftest-livepatch
* kselftest-lkdtm
* kselftest-membarrier
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-seccomp
* kselftest-sigaltstack
* kselftest-size
* kselftest-splice
* kselftest-static_keys
* kselftest-sync
* kselftest-sysctl
* kselftest-timens
* kselftest-timers
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user
* kselftest-zram
* libhugetlbfs
* linux-log-parser
* ltp-cap_bounds-tests
* ltp-commands-tests
* ltp-containers-tests
* ltp-cpuhotplug-tests
* ltp-cve-tests
* ltp-dio-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-hugetlb-tests
* ltp-io-tests
* ltp-ipc-tests
* ltp-math-tests
* ltp-mm-tests
* ltp-nptl-tests
* ltp-pty-tests
* ltp-sched-tests
* ltp-securebits-tests
* ltp-syscalls-tests
* perf
* spectre-meltdown-checker-test
* v4l2-compliance
Signature · 2 lines
Linaro LKFT https://lkft.linaro.org