3.14.49-stable review
Subsystems (5)
Greg Kroah-Hartman
maintainercover 3.14.49-stable review
This is the start of the stable review cycle for the 3.14.49 release. There are 125 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun Aug 2 19:40:05 UTC 2015. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v3.x/stable-review/patch-3.14.49-rc1.gz
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 3.14.49-rc1
Nicholas Mc Guire <[email protected]>
MIPS: KVM: Do not sign extend on unsigned MMIO load
Chad Dupuis <[email protected]>
qla2xxx: Mark port lost when we receive an RSCN for it.
Linus Torvalds <[email protected]>
Fix firmware loader uevent buffer NULL pointer dereference
Joe Perches <[email protected]>
hpfs: hpfs_error: Remove static buffer, use vsprintf extension %pV instead
Christoffer Dall <[email protected]>
arm64: Don't report clear pmds and puds as huge
Chris Wilson <[email protected]>
agp/intel: Fix typo in needs_ilk_vtd_wa()
Ilya Dryomov <[email protected]>
rbd: use GFP_NOIO in rbd_obj_request_create()
Al Viro <[email protected]>
9p: don't leave a half-initialized inode sitting around
Al Viro <[email protected]>
9p: forgetting to cancel request on interrupted zero-copy RPC
Trond Myklebust <[email protected]>
SUNRPC: Fix a memory leak in the backchannel code
Jeff Layton <[email protected]>
nfs: increase size of EXCHANGE_ID name string buffer
Olga Kornievskaia <[email protected]>
fixing infinite OPEN loop in 4.0 stateid recovery
Chuck Lever <[email protected]>
NFS: Fix size of NFSACL SETACL operations
Uwe Kleine-König <[email protected]>
watchdog: omap: assert the counter being stopped before reprogramming
Konstantin Khlebnikov <[email protected]>
of: return NUMA_NO_NODE from fallback of_node_to_nid()
Martin K. Petersen <[email protected]>
block: Do a full clone when splitting discard bios
Alan Stern <[email protected]>
USB: usbfs: allow URBs to be reaped after disconnection
Pali Rohár <[email protected]>
dell-laptop: Fix allocating & freeing SMI buffer page
Arnd Bergmann <[email protected]>
ideapad: fix software rfkill setting
Damian Eppel <[email protected]>
clocksource: exynos_mct: Avoid blocking calls in the cpu hotplug notifier
Michal Kazior <[email protected]>
mac80211: prevent possible crypto tx tailroom corruption
Vasily Averin <[email protected]>
security_syslog() should be called once only
Chris Metcalf <[email protected]>
__bitmap_parselist: fix bug in empty string handling
Takashi Iwai <[email protected]>
PM / sleep: Increase default DPM watchdog timeout to 60
Ding Wang <[email protected]>
mmc: card: Fixup request missing in mmc_blk_issue_rw_rq
Sagi Grimberg <[email protected]>
iser-target: release stale iser connections
Sagi Grimberg <[email protected]>
iser-target: Fix possible deadlock in RDMA_CM connection error
Nicholas Bellinger <[email protected]>
iscsi-target: Convert iscsi_thread_set usage to kthread.h
Lv Zheng <[email protected]>
ACPICA: Tables: Fix an issue that FACS initialization is performed twice
Ilya Dryomov <[email protected]>
crush: fix a bug in tree bucket decode
Miklos Szeredi <[email protected]>
fuse: initialize fc->release before calling it
Filipe Manana <[email protected]>
Btrfs: fix memory leak in the extent_same ioctl
Filipe Manana <[email protected]>
Btrfs: use kmem_cache_free when freeing entry in inode cache
Firo Yang <[email protected]>
md: fix a build warning
Stevens, Nick <[email protected]>
hwmon: (mcp3021) Fix broken output scaling
Lior Amsalem <[email protected]>
dmaengine: mv_xor: bug fix for racing condition in descriptors cleanup
Steven Rostedt (Red Hat) <[email protected]>
tracing: Have branch tracer use recursive field of task struct
Steven Rostedt (Red Hat) <[email protected]>
tracing/filter: Do not allow infix to exceed end of string
Steven Rostedt (Red Hat) <[email protected]>
tracing/filter: Do not WARN on operand count going below zero
Arne Fitzenreiter <[email protected]>
libata: force disable trim for SuperSSpeed S238
Arne Fitzenreiter <[email protected]>
libata: add ATA_HORKAGE_NOTRIM
Mimi Zohar <[email protected]>
evm: labeling pseudo filesystems exception
Mimi Zohar <[email protected]>
ima: fix ima_show_template_data_ascii()
Colin Ian King <[email protected]>
KEYS: ensure we free the assoc array edit if edit is valid
Hon Ching \\(Vicky\\) Lo <[email protected]>
vTPM: set virtual device before passing to ibmvtpm_reset_crq
Eric Sandeen <[email protected]>
xfs: fix remote symlinks on V5/CRC filesystems
Zhao Junwang <[email protected]>
drm: add a check for x/y in drm_mode_setcrtc
Alex Deucher <[email protected]>
drm/radeon: add a dpm quirk for Sapphire Radeon R9 270X 2GB GDDR5
Michel Dänzer <[email protected]>
drm/radeon: Don't flush the GART TLB if rdev->gart.ptr == NULL
Jérôme Glisse <[email protected]>
drm/radeon: SDMA fix hibernation (CI GPU family).
Jérôme Glisse <[email protected]>
drm/radeon: compute ring fix hibernation (CI GPU family) v2.
Alex Deucher <[email protected]>
drm/radeon: take the mode_config mutex when dealing with hpds (v2)
Frediano Ziglio <[email protected]>
drm/qxl: Do not leak memory if qxl_release_list_add fails
Frediano Ziglio <[email protected]>
drm/qxl: Do not cause spice-server to clean our objects
Tomas Winkler <[email protected]>
mmc: block: Add missing mmc_blk_put() in power_ro_lock_show()
Joe Thornber <[email protected]>
dm btree: silence lockdep lock inversion in dm_btree_del()
Dennis Yang <[email protected]>
dm btree remove: fix bug in redistribute3
Joe Thornber <[email protected]>
dm space map metadata: fix occasional leak of a metadata block on resize
Mikulas Patocka <[email protected]>
dm stats: fix divide by zero if 'number_of_areas' arg is zero
AMAN DEEP <[email protected]>
usb: xhci: Bugfix for NULL pointer deference in xhci_endpoint_init() function
Johannes Thumshirn <[email protected]>
USB: serial: Destroy serial_minors IDR on module exit
Claudio Cappelli <[email protected]>
USB: option: add 2020:4000 ID
Peter Sanford <[email protected]>
USB: cp210x: add ID for Aruba Networks controllers
Felipe Balbi <[email protected]>
usb: musb: host: rely on port_mode to call musb_start()
Dan Carpenter <[email protected]>
USB: devio: fix a condition in async_completed()
John Youn <[email protected]>
usb: dwc3: Reset the transfer resource index on SET_INTERFACE
Subbaraya Sundeep Bhatta <[email protected]>
usb: dwc3: gadget: return error if command sent to DEPCMD register fails
Subbaraya Sundeep Bhatta <[email protected]>
usb: dwc3: gadget: return error if command sent to DGCMD register fails
Mikulas Patocka <[email protected]>
libata: increase the timeout when setting transfer mode
Aleksei Mamlin <[email protected]>
libata: add ATA_HORKAGE_BROKEN_FPDMA_AA quirk for HP 250GB SATA disk VB0250EAVER
Zidan Wang <[email protected]>
ASoC: wm8960: the enum of "DAC Polarity" should be wm8960_enum[1]
Axel Lin <[email protected]>
ASoC: wm8903: Fix define for WM8903_VMID_RES_250K
Axel Lin <[email protected]>
ASoC: wm8955: Fix setting wrong register for WM8955_K_8_0_MASK bits
Axel Lin <[email protected]>
ASoC: wm8737: Fixup setting VMID Impedance control register
Dan Carpenter <[email protected]>
ASoC: imx-wm8962: Add a missing error check
Richard Fitzgerald <[email protected]>
ASoC: arizona: Fix noise generator gain TLV
Mauro Carvalho Chehab <[email protected]>
cx24116: fix a buffer overflow when checking userspace params
Mauro Carvalho Chehab <[email protected]>
s5h1420: fix a buffer overflow when checking userspace params
Mauro Carvalho Chehab <[email protected]>
af9013: Don't accept invalid bandwidth
Mauro Carvalho Chehab <[email protected]>
cx24117: fix a buffer overflow when checking userspace params
Jan Leupold <[email protected]>
iio: adc: at91_adc: allow to use full range of startup time
Peter Meerwald <[email protected]>
iio: tmp006: Check channel info on write
JM Friedt <[email protected]>
iio: DAC: ad5624r_spi: fix bit shift of output data value
Cyrille Pitchen <[email protected]>
i2c: at91: fix a race condition when using the DMA controller
Joseph Qi <[email protected]>
jbd2: fix ocfs2 corrupt when updating journal superblock fails
Dmitry Monakhov <[email protected]>
jbd2: use GFP_NOFS in jbd2_cleanup_journal_tail()
Michal Hocko <[email protected]>
ext4: replace open coded nofail allocation in ext4_free_blocks()
Eryu Guan <[email protected]>
ext4: correctly migrate a file with a hole at the beginning
Eryu Guan <[email protected]>
ext4: be more strict when migrating to non-extent based file
Lukas Czerner <[email protected]>
ext4: fix reservation release on invalidatepage for delalloc fs
Darrick J. Wong <[email protected]>
ext4: don't retry file block mapping on bigalloc fs with non-extent file
Theodore Ts'o <[email protected]>
ext4: call sync_blockdev() before invalidate_bdev() in put_super()
Theodore Ts'o <[email protected]>
ext4: fix race between truncate and __ext4_journalled_writepage()
Haggai Eran <[email protected]>
staging: rtl8712: prevent buffer overrun in recvbuf2recvframe
Felix Fietkau <[email protected]>
ath9k: fix DMA stop sequence for AR9003+
Marcel Holtmann <[email protected]>
Bluetooth: btusb: Fix memory leak in Intel setup routine
Boris BREZILLON <[email protected]>
mtd: nand: fix erroneous read_buf call in nand_write_page_raw_syndrome
Brian Norris <[email protected]>
mtd: nand: don't use read_buf for 8-bit ONFI transfers
Thomas Petazzoni <[email protected]>
pinctrl: mvebu: armada-xp: fix functions of MPP48
Thomas Petazzoni <[email protected]>
pinctrl: mvebu: armada-xp: remove non-existing VDD cpu_pd functions
Thomas Petazzoni <[email protected]>
pinctrl: mvebu: armada-xp: remove non-existing NAND pins
Thomas Petazzoni <[email protected]>
pinctrl: mvebu: armada-370: fix spi0 pin description
Lukasz Majewski <[email protected]>
thermal: step_wise: fix: Prevent from binary overflow when trend is dropping
Uwe Kleine-König <[email protected]>
mtd: dc21285: use raw spinlock functions for nw_gpio_lock
Brian Norris <[email protected]>
mtd: fix: avoid race condition when accessing mtd->usecount
Grygorii Strashko <[email protected]>
leds / PM: fix hibernation on arm when gpio-led used with CPU led trigger
Axel Lin <[email protected]>
genirq: devres: Fix testing return value of request_any_context_irq()
Bart Van Assche <[email protected]>
scsi_transport_srp: Fix a race condition
Bart Van Assche <[email protected]>
scsi_transport_srp: Introduce srp_wait_for_queuecommand()
Ezequiel Garcia <[email protected]>
spi: pl022: Specify 'num-cs' property as required in devicetree binding
Martin Sperl <[email protected]>
spi: fix race freeing dummy_tx/rx before it is unmapped
Stefan Wahren <[email protected]>
regulator: core: fix constraints output buffer
Maxime Coquelin <[email protected]>
regmap: Fix possible shift overflow in regmap_field_init()
Arun Chandran <[email protected]>
regmap: Fix regmap_bulk_read in BE mode
Rafael J. Wysocki <[email protected]>
cpuidle / menu: Return (-1) if there are no suitable states
Will Deacon <[email protected]>
arm64: vdso: work-around broken ELF toolchains in Makefile
Dave P Martin <[email protected]>
arm64: mm: Fix freeing of the wrong memmap entries with !SPARSEMEM_VMEMMAP
Catalin Marinas <[email protected]>
arm64: Do not attempt to use init_mm in reset_context()
Vineet Gupta <[email protected]>
ARC: add compiler barrier to LLSC based cmpxchg
Rafael J. Wysocki <[email protected]>
ACPI / init: Switch over platform to the ACPI mode later
Takashi Iwai <[email protected]>
ALSA: hda - Fix the dock headphone output on Fujitsu Lifebook E780
Takashi Iwai <[email protected]>
ALSA: hda - Add headset support to Acer Aspire V5
Ryan Underwood <[email protected]>
Disable write buffering on Toshiba ToPIC95
Brian King <[email protected]>
ipr: Increase default adapter init stage change timeout
Paul E. McKenney <[email protected]>
rcu: Correctly handle non-empty Tiny RCU callback list with none ready
-------------
Diffstat:
.../pinctrl/marvell,armada-370-pinctrl.txt | 4 +- .../bindings/pinctrl/marvell,armada-xp-pinctrl.txt | 32 +++---- .../devicetree/bindings/spi/spi_pl022.txt | 2 +- Makefile | 4 +- arch/arc/include/asm/cmpxchg.h | 9 +- arch/arm64/kernel/vdso/Makefile | 4 + arch/arm64/mm/context.c | 8 ++ arch/arm64/mm/hugetlbpage.c | 4 +- arch/arm64/mm/init.c | 2 +- arch/mips/kvm/kvm_mips_emul.c | 2 +- drivers/acpi/acpica/utxfinit.c | 10 +- drivers/acpi/bus.c | 56 ++++++++--- drivers/ata/libata-core.c | 9 +- drivers/ata/libata-scsi.c | 3 +- drivers/base/firmware_class.c | 16 +++- drivers/base/regmap/regmap.c | 5 +- drivers/block/rbd.c | 4 +- drivers/bluetooth/btusb.c | 2 + drivers/char/agp/intel-gtt.c | 2 +- drivers/char/tpm/tpm_ibmvtpm.c | 5 +- drivers/clocksource/exynos_mct.c | 43 ++++++--- drivers/cpuidle/cpuidle.c | 3 + drivers/cpuidle/governors/menu.c | 2 +- drivers/dma/mv_xor.c | 72 ++++++++------ drivers/dma/mv_xor.h | 1 + drivers/gpu/drm/drm_crtc.c | 7 +- drivers/gpu/drm/qxl/qxl_cmd.c | 1 + drivers/gpu/drm/qxl/qxl_ioctl.c | 4 +- drivers/gpu/drm/radeon/cik.c | 34 +++++++ drivers/gpu/drm/radeon/cik_sdma.c | 11 +++ drivers/gpu/drm/radeon/radeon_gart.c | 12 ++- drivers/gpu/drm/radeon/radeon_irq_kms.c | 2 + drivers/gpu/drm/radeon/si_dpm.c | 1 + drivers/hwmon/mcp3021.c | 14 +-- drivers/i2c/busses/i2c-at91.c | 70 ++++++++++---- drivers/iio/adc/at91_adc.c | 8 +- drivers/iio/dac/ad5624r_spi.c | 4 +- drivers/iio/temperature/tmp006.c | 3 + drivers/infiniband/ulp/isert/ib_isert.c | 32 +++++-- drivers/leds/led-class.c | 7 +- drivers/md/dm-stats.c | 2 + drivers/md/md.c | 2 +- drivers/md/persistent-data/dm-btree-remove.c | 6 +- drivers/md/persistent-data/dm-btree.c | 2 +- drivers/md/persistent-data/dm-space-map-metadata.c | 50 +++++++--- drivers/media/dvb-frontends/af9013.c | 4 + drivers/media/dvb-frontends/cx24116.c | 8 +- drivers/media/dvb-frontends/cx24117.c | 2 +- drivers/media/dvb-frontends/s5h1420.c | 2 +- drivers/mmc/card/block.c | 10 +- drivers/mtd/maps/dc21285.c | 4 +- drivers/mtd/mtd_blkdevs.c | 5 + drivers/mtd/nand/nand_base.c | 16 +--- drivers/net/wireless/ath/ath9k/main.c | 12 ++- drivers/of/base.c | 2 +- drivers/pcmcia/topic.h | 16 ++++ drivers/pinctrl/mvebu/pinctrl-armada-370.c | 4 +- drivers/pinctrl/mvebu/pinctrl-armada-xp.c | 37 +++----- drivers/platform/x86/dell-laptop.c | 8 +- drivers/platform/x86/ideapad-laptop.c | 3 +- drivers/regulator/core.c | 2 +- drivers/scsi/ipr.h | 2 +- drivers/scsi/qla2xxx/qla_isr.c | 17 +++- drivers/scsi/scsi_transport_srp.c | 58 +++++++----- drivers/spi/spi.c | 11 ++- drivers/staging/rtl8712/rtl8712_recv.c | 3 +- drivers/target/iscsi/iscsi_target.c | 104 +++++++++------------ drivers/target/iscsi/iscsi_target_core.h | 7 ++ drivers/target/iscsi/iscsi_target_erl0.c | 13 ++- drivers/target/iscsi/iscsi_target_login.c | 59 +++++++++++- drivers/thermal/step_wise.c | 2 +- drivers/usb/core/devio.c | 65 +++++++------ drivers/usb/dwc3/ep0.c | 4 + drivers/usb/dwc3/gadget.c | 4 + drivers/usb/host/xhci-mem.c | 2 +- drivers/usb/musb/musb_virthub.c | 4 +- drivers/usb/serial/cp210x.c | 1 + drivers/usb/serial/option.c | 1 + drivers/usb/serial/usb-serial.c | 1 + drivers/watchdog/omap_wdt.c | 7 ++ fs/9p/vfs_inode.c | 3 +- fs/9p/vfs_inode_dotl.c | 3 +- fs/bio.c | 15 ++- fs/btrfs/inode-map.c | 2 +- fs/btrfs/ioctl.c | 4 +- fs/ext4/indirect.c | 2 +- fs/ext4/inode.c | 38 ++++++-- fs/ext4/mballoc.c | 16 +--- fs/ext4/migrate.c | 17 +++- fs/ext4/super.c | 1 + fs/fuse/inode.c | 2 +- fs/hpfs/super.c | 11 ++- fs/jbd2/checkpoint.c | 7 +- fs/jbd2/journal.c | 38 ++++++-- fs/nfs/nfs3xdr.c | 2 +- fs/nfs/nfs4state.c | 2 + fs/xfs/xfs_symlink.c | 2 +- include/acpi/actypes.h | 1 + include/linux/acpi.h | 2 + include/linux/jbd2.h | 4 +- include/linux/libata.h | 1 + include/linux/nfs_xdr.h | 2 +- include/linux/of.h | 5 +- include/uapi/linux/usbdevice_fs.h | 3 +- init/main.c | 1 + kernel/irq/devres.c | 4 +- kernel/power/Kconfig | 2 +- kernel/printk/printk.c | 11 +-- kernel/rcu/tiny.c | 5 + kernel/trace/trace.h | 1 + kernel/trace/trace_branch.c | 17 ++-- kernel/trace/trace_events_filter.c | 10 +- lib/bitmap.c | 17 ++-- net/9p/client.c | 3 +- net/ceph/osdmap.c | 2 +- net/mac80211/main.c | 3 + net/sunrpc/backchannel_rqst.c | 2 +- security/integrity/evm/evm_main.c | 12 +++ security/integrity/ima/ima.h | 2 +- security/integrity/ima/ima_fs.c | 4 +- security/integrity/ima/ima_template_lib.c | 3 +- security/keys/keyring.c | 8 +- sound/pci/hda/patch_realtek.c | 18 ++++ sound/soc/codecs/wm5102.c | 2 +- sound/soc/codecs/wm5110.c | 2 +- sound/soc/codecs/wm8737.c | 6 +- sound/soc/codecs/wm8903.h | 2 +- sound/soc/codecs/wm8955.c | 2 +- sound/soc/codecs/wm8960.c | 2 +- sound/soc/codecs/wm8997.c | 2 +- sound/soc/fsl/imx-wm8962.c | 2 +- 131 files changed, 930 insertions(+), 474 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/125 rcu: Correctly handle non-empty Tiny RCU callback list with none ready
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Paul E. McKenney" <[email protected]>
commit 6e91f8cb138625be96070b778d9ba71ce520ea7e upstream.
If, at the time __rcu_process_callbacks() is invoked, there are callbacks in Tiny RCU's callback list, but none of them are ready to be invoked, the current list-management code will knit the non-ready callbacks out of the list. This can result in hangs and possibly worse. This commit therefore inserts a check for there being no callbacks that can be invoked immediately.
This bug is unlikely to occur -- you have to get a new callback between the time rcu_sched_qs() or rcu_bh_qs() was called, but before we get to __rcu_process_callbacks(). It was detected by the addition of RCU-bh testing to rcutorture, which in turn was instigated by Iftekhar Ahmed's mutation testing. Although this bug was made much more likely by 915e8a4fe45e (rcu: Remove fastpath from __rcu_process_callbacks()), this
did not cause the bug, but rather made it much more probable. That
said, it takes more than 40 hours of rcutorture testing, on average, for this bug to appear, so this fix cannot be considered an emergency.
--- kernel/rcu/tiny.c | 5 +++++ 1 file changed, 5 insertions(+)
kernel/rcu/tiny.c +5 -0
@@ -284,6 +284,11 @@ static void __rcu_process_callbacks(stru/* Move the ready-to-invoke callbacks to a local list. */ local_irq_save (flags); +if (rcp->donetail == &rcp->rcucblist) { +/* No callbacks ready, so just leave. */ +local_irq_restore (flags); +return ; + }RCU_TRACE (trace_rcu_batch_start (rcp->name,0 , rcp->qlen,-1 )); list = rcp->rcucblist; rcp->rcucblist = *rcp->donetail;
Greg Kroah-Hartman
maintainerPATCH 2/125 ipr: Increase default adapter init stage change timeout
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian King <[email protected]>
commit 45c44b5ff9caa743ed9c2bfd44307c536c9caf1e upstream.
Increase the default init stage change timeout from 15 seconds to 30 seconds. This resolves issues we have seen with some adapters not transitioning to the first init stage within 15 seconds, which results in adapter initialization failures.
--- drivers/scsi/ipr.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/ipr.h +1 -1
@@ -264,7 +264,7 @@#define IPR_RUNTIME_RESET 0x40000000#define IPR_IPL_INIT_MIN_STAGE_TIME 5 -#define IPR_IPL_INIT_DEFAULT_STAGE_TIME 15 +#define IPR_IPL_INIT_DEFAULT_STAGE_TIME 30#define IPR_IPL_INIT_STAGE_UNKNOWN 0x0#define IPR_IPL_INIT_STAGE_TRANSOP 0xB0000000#define IPR_IPL_INIT_STAGE_MASK 0xff000000
Greg Kroah-Hartman
maintainerPATCH 3/125 Disable write buffering on Toshiba ToPIC95
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryan Underwood <[email protected]>
commit 2fb22a8042fe96b4220843f79241c116d90922c4 upstream.
Disable write buffering on the Toshiba ToPIC95 if it is enabled by somebody (it is not supposed to be a power-on default according to the datasheet). On the ToPIC95, practically no 32-bit Cardbus card will work under heavy load without locking up the whole system if this is left enabled. I tried about a dozen. It does not affect 16-bit cards. This is similar to the O2 bugs in early controller revisions it seems.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=55961
--- drivers/pcmcia/topic.h | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
drivers/pcmcia/topic.h +16 -0
@@ -104,6 +104,9 @@#define TOPIC_EXCA_IF_CONTROL 0x3e/* 8 bit */ #define TOPIC_EXCA_IFC_33V_ENA 0x01 +#define TOPIC_PCI_CFG_PPBCN 0x3e/* 16-bit */ +#define TOPIC_PCI_CFG_PPBCN_WBEN 0x0400 +static void topic97_zoom_video (struct pcmcia_socket *sock,int onoff) { struct yenta_socket *socket = container_of(sock, struct yenta_socket, socket);
@@ -138,6 +141,7 @@ static int topic97_override(struct yentastatic int topic95_override (struct yenta_socket *socket) {u8 fctrl; +u16 ppbcn;/* enable 3.3V support for 16bit cards */ fctrl =exca_readb (socket,TOPIC_EXCA_IF_CONTROL );
@@ -146,6 +150,18 @@ static int topic95_override(struct yenta/* tell yenta to use exca registers to power 16bit cards */ socket->flags |=YENTA_16BIT_POWER_EXCA |YENTA_16BIT_POWER_DF ; +/* Disable write buffers to prevent lockups under load with numerous +Cardbus cards, observed on Tecra 500CDT and reported elsewhere on the +net. This is not a power-on default according to the datasheet +but some BIOSes seem to set it. */ +if (pci_read_config_word (socket->dev,TOPIC_PCI_CFG_PPBCN , &ppbcn) ==0 + && socket->dev->revision <=7 + && (ppbcn &TOPIC_PCI_CFG_PPBCN_WBEN )) { + ppbcn &= ~TOPIC_PCI_CFG_PPBCN_WBEN ; +pci_write_config_word (socket->dev,TOPIC_PCI_CFG_PPBCN , ppbcn); +dev_info (&socket->dev->dev,"Disabled ToPIC95 Cardbus write buffers.\n" ); + } +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 4/125 ALSA: hda - Add headset support to Acer Aspire V5
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 7819717b11346b8a5420b223b46600e394049c66 upstream.
Acer Aspire V5 with ALC282 codec needs the similar quirk like Dell laptops to support the headset mic. The headset mic pin is 0x19 and it's not exposed by BIOS, thus we need to fix the pincfg as well.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=96201
--- sound/pci/hda/patch_realtek.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
sound/pci/hda/patch_realtek.c +12 -0
@@ -3973,6 +3973,7 @@ enum {ALC269_FIXUP_DELL3_MIC_NO_PRESENCE ,ALC269_FIXUP_HEADSET_MODE ,ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC , +ALC269_FIXUP_ASPIRE_HEADSET_MIC ,ALC269_FIXUP_ASUS_X101_FUNC ,ALC269_FIXUP_ASUS_X101_VERB , ALC269_FIXUP_ASUS_X101,
@@ -4214,6 +4215,15 @@ static const struct hda_fixup alc269_fix .type = HDA_FIXUP_FUNC, .v.func = alc_fixup_headset_mode_no_hp_mic, }, + [ALC269_FIXUP_ASPIRE_HEADSET_MIC] = { + .type = HDA_FIXUP_PINS, + .v.pins = (const struct hda_pintbl []) { + {0x19 ,0x01a1913c },/* headset mic w/o jack detect */ + { } + }, + .chained = true, + .chain_id = ALC269_FIXUP_HEADSET_MODE, + }, [ALC286_FIXUP_SONY_MIC_NO_PRESENCE] = { .type = HDA_FIXUP_PINS, .v.pins = (const struct hda_pintbl []) {
@@ -4397,6 +4407,8 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x1025 ,0x029b ,"Acer 1810TZ" ,ALC269_FIXUP_INV_DMIC ),SND_PCI_QUIRK (0x1025 ,0x0349 ,"Acer AOD260" ,ALC269_FIXUP_INV_DMIC ),SND_PCI_QUIRK (0x1025 ,0x047c ,"Acer AC700" ,ALC269_FIXUP_ACER_AC700 ), +SND_PCI_QUIRK (0x1025 ,0x072d ,"Acer Aspire V5-571G" ,ALC269_FIXUP_ASPIRE_HEADSET_MIC ), +SND_PCI_QUIRK (0x1025 ,0x080d ,"Acer Aspire V5-122P" ,ALC269_FIXUP_ASPIRE_HEADSET_MIC ),SND_PCI_QUIRK (0x1025 ,0x0740 ,"Acer AO725" ,ALC271_FIXUP_HP_GATE_MIC_JACK ),SND_PCI_QUIRK (0x1025 ,0x0742 ,"Acer AO756" ,ALC271_FIXUP_HP_GATE_MIC_JACK ), SND_PCI_QUIRK_VENDOR(0x1025, "Acer Aspire", ALC271_FIXUP_DMIC),
Greg Kroah-Hartman
maintainerPATCH 5/125 ALSA: hda - Fix the dock headphone output on Fujitsu Lifebook E780
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 4df3fd1700abbb53bd874143dfd1f9ac9e7cbf4b upstream.
Fujitsu Lifebook E780 sets the sequence number 0x0f to only only of the two headphones, thus the driver tries to assign another as the line-out, and this results in the inconsistent mapping between the created jack ctl and the actual I/O. Due to this, PulseAudio doesn't handle it properly and gets the silent output.
The fix is to ignore the non-HP sequencer checks.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=99681
--- sound/pci/hda/patch_realtek.c | 6 ++++++ 1 file changed, 6 insertions(+)
sound/pci/hda/patch_realtek.c +6 -0
@@ -3955,6 +3955,7 @@ enum {ALC269_FIXUP_LIFEBOOK ,ALC269_FIXUP_LIFEBOOK_EXTMIC ,ALC269_FIXUP_LIFEBOOK_HP_PIN , +ALC269_FIXUP_LIFEBOOK_NO_HP_TO_LINEOUT ,ALC269_FIXUP_AMIC ,ALC269_FIXUP_DMIC , ALC269VB_FIXUP_AMIC,
@@ -4097,6 +4098,10 @@ static const struct hda_fixup alc269_fix { } }, }, + [ALC269_FIXUP_LIFEBOOK_NO_HP_TO_LINEOUT] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc269_fixup_pincfg_no_hp_to_lineout, + }, [ALC269_FIXUP_AMIC] = { .type = HDA_FIXUP_PINS, .v.pins = (const struct hda_pintbl[]) {
@@ -4561,6 +4566,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x104d ,0x9084 ,"Sony VAIO" ,ALC275_FIXUP_SONY_HWEQ ),SND_PCI_QUIRK_VENDOR (0x104d ,"Sony VAIO" ,ALC269_FIXUP_SONY_VAIO ),SND_PCI_QUIRK (0x10cf ,0x1475 ,"Lifebook" ,ALC269_FIXUP_LIFEBOOK ), +SND_PCI_QUIRK (0x10cf ,0x159f ,"Lifebook E780" ,ALC269_FIXUP_LIFEBOOK_NO_HP_TO_LINEOUT ),SND_PCI_QUIRK (0x10cf ,0x15dc ,"Lifebook T731" ,ALC269_FIXUP_LIFEBOOK_HP_PIN ),SND_PCI_QUIRK (0x10cf ,0x1757 ,"Lifebook E752" ,ALC269_FIXUP_LIFEBOOK_HP_PIN ), SND_PCI_QUIRK(0x10cf, 0x1845, "Lifebook U904", ALC269_FIXUP_LIFEBOOK_EXTMIC),
Greg Kroah-Hartman
maintainerPATCH 6/125 ACPI / init: Switch over platform to the ACPI mode later
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Rafael J. Wysocki" <[email protected]>
commit b064a8fa77dfead647564c46ac8fc5b13bd1ab73 upstream.
Commit 73f7d1ca3263 "ACPI / init: Run acpi_early_init() before timekeeping_init()" moved the ACPI subsystem initialization, including the ACPI mode enabling, to an earlier point in the initialization sequence, to allow the timekeeping subsystem use ACPI early. Unfortunately, that resulted in boot regressions on some systems and the early ACPI initialization was moved toward its original position in the kernel initialization code by commit c4e1acbb35e4 "ACPI / init: Invoke early ACPI initialization later".
However, that turns out to be insufficient, as boot is still broken on the Tyan S8812 mainboard.
To fix that issue, split the ACPI early initialization code into two pieces so the majority of it still located in acpi_early_init() and the part switching over the platform into the ACPI mode goes into a new function, acpi_subsystem_init(), executed at the original early ACPI initialization spot.
That fixes the Tyan S8812 boot problem, but still allows ACPI tables to be loaded earlier which is useful to the EFI code in efi_enter_virtual_mode().
--- drivers/acpi/bus.c | 56 +++++++++++++++++++++++++++++++++++++-------------- include/linux/acpi.h | 2 + init/main.c | 1 3 files changed, 44 insertions(+), 15 deletions(-)
drivers/acpi/bus.c +41 -15
@@ -450,6 +450,16 @@ static int __init acpi_bus_init_irq(voidu8 acpi_gbl_permanent_mmap; +/** +* acpi_early_init - Initialize ACPICA and populate the ACPI namespace. +* +* The ACPI tables are accessible after this, but the handling of events has not +* been initialized and the global lock is not available yet, so AML should not +* be executed at this point. +* +* Doing this before switching the EFI runtime services to virtual mode allows +* the EfiBootServices memory to be freed slightly earlier on boot. +*/ void __init acpi_early_init (void ) {acpi_status status;
@@ -510,26 +520,42 @@ void __init acpi_early_init(void) acpi_gbl_FADT.sci_interrupt = acpi_sci_override_gsi; }#endif +return ; + + error0: +disable_acpi (); +} + +/** +* acpi_subsystem_init - Finalize the early initialization of ACPI. +* +* Switch over the platform to the ACPI mode (if possible), initialize the +* handling of ACPI events, install the interrupt and global lock handlers. +* +* Doing this too early is generally unsafe, but at the same time it needs to be +* done before all things that really depend on ACPI. The right spot appears to +* be before finalizing the EFI initialization. +*/ +void __init acpi_subsystem_init (void ) +{ +acpi_status status; + +if (acpi_disabled) +return ; status =acpi_enable_subsystem (~ACPI_NO_ACPI_ENABLE );if (ACPI_FAILURE (status)) { printk(KERN_ERR PREFIX "Unable to enable ACPI\n"); - goto error0; +disable_acpi (); + }else { +/* +* If the system is using ACPI then we can be reasonably +* confident that any regulators are managed by the firmware +* so tell the regulator core it has everything it needs to +* know. +*/ +regulator_has_full_constraints (); } - -/* -* If the system is using ACPI then we can be reasonably -* confident that any regulators are managed by the firmware -* so tell the regulator core it has everything it needs to -* know. -*/ -regulator_has_full_constraints (); - -return ; - - error0: -disable_acpi (); -return ; }static int __init acpi_bus_init (void )
include/linux/acpi.h +2 -0
@@ -402,6 +402,7 @@ extern acpi_status acpi_pci_osc_control_#define ACPI_OST_SC_INSERT_NOT_SUPPORTED 0x82extern void acpi_early_init (void ); +extern void acpi_subsystem_init (void );extern int acpi_nvs_register (__u64 start,__u64 size);
@@ -436,6 +437,7 @@ static inline const char *acpi_dev_name( }static inline void acpi_early_init (void ) { } +static inline void acpi_subsystem_init (void ) { }static inline int early_acpi_boot_init (void ) {
init/main.c +1 -0
@@ -643,6 +643,7 @@ asmlinkage void __init start_kernel(voidcheck_bugs (); +acpi_subsystem_init ();sfi_init_late ();if (efi_enabled (EFI_RUNTIME_SERVICES )) {
Greg Kroah-Hartman
maintainerPATCH 7/125 ARC: add compiler barrier to LLSC based cmpxchg
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vineet Gupta <[email protected]>
commit d57f727264f1425a94689bafc7e99e502cb135b5 upstream.
When auditing cmpxchg call sites, Chuck noted that gcc was optimizing away some of the desired LDs.
| do {
| new = old = *ipi_data_ptr;
| new |= 1U << msg;
| } while (cmpxchg(ipi_data_ptr, old, new) != old);was generating to below
| 8015cef8: ld r2,[r4,0] <-- First LD | 8015cefc: bset r1,r2,r1 | | 8015cf00: llock r3,[r4] <-- atomic op | 8015cf04: brne r3,r2,8015cf10 | 8015cf08: scond r1,[r4] | 8015cf0c: bnz 8015cf00 | | 8015cf10: brne r3,r2,8015cf00 <-- Branch doesn't go to orig LD
Although this was fixed by adding a ACCESS_ONCE in this call site, it seems safer (for now at least) to add compiler barrier to LLSC based cmpxchg
--- arch/arc/include/asm/cmpxchg.h | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
arch/arc/include/asm/cmpxchg.h +5 -4
@@ -25,10 +25,11 @@ __cmpxchg(volatile void *ptr, unsigned l" scond %3, [%1] \n" " bnz 1b \n" "2: \n" - : "=&r"(prev) - : "r"(ptr), "ir"(expected), -" r"(new) /* can't be " ir". scond can't take limm for " b" */ - : "cc"); + : "=&r"(prev) /* Early clobber, to prevent reg reuse */ + : "r"(ptr), /* Not "m": llock only supports reg direct addr mode */ +" ir"(expected), +" r"(new) /* can't be " ir". scond can't take LIMM for " b" */ + : "cc", "memory"); /* so that gcc knows memory is being written here */ return prev; }
Greg Kroah-Hartman
maintainerPATCH 8/125 arm64: Do not attempt to use init_mm in reset_context()
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Catalin Marinas <[email protected]>
commit 565630d503ef24e44c252bed55571b3a0d68455f upstream.
After secondary CPU boot or hotplug, the active_mm of the idle thread is &init_mm. The init_mm.pgd (swapper_pg_dir) is only meant for TTBR1_EL1 and must not be set in TTBR0_EL1. Since when active_mm == &init_mm the TTBR0_EL1 is already set to the reserved value, there is no need to perform any context reset.
--- arch/arm64/mm/context.c | 8 ++++++++ 1 file changed, 8 insertions(+)
arch/arm64/mm/context.c +8 -0
@@ -92,6 +92,14 @@ static void reset_context(void *info)unsigned int cpu =smp_processor_id ();struct mm_struct *mm = current->active_mm; +/* +* current->active_mm could be init_mm for the idle thread immediately +* after secondary CPU boot or hotplug. TTBR0_EL1 is already set to +* the reserved value, so no need to reset any context. +*/ +if (mm == &init_mm) +return ; +smp_rmb (); asid = cpu_last_asid + cpu;
Greg Kroah-Hartman
maintainerPATCH 9/125 arm64: mm: Fix freeing of the wrong memmap entries with !SPARSEMEM_VMEMMAP
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave P Martin <[email protected]>
commit b9bcc919931611498e856eae9bf66337330d04cc upstream.
The memmap freeing code in free_unused_memmap() computes the end of each memblock by adding the memblock size onto the base. However, if SPARSEMEM is enabled then the value (start) used for the base may already have been rounded downwards to work out which memmap entries to free after the previous memblock.
This may cause memmap entries that are in use to get freed.
In general, you're not likely to hit this problem unless there are at least 2 memblocks and one of them is not aligned to a sparsemem section boundary. Note that carve-outs can increase the number of memblocks by splitting the regions listed in the device tree.
This problem doesn't occur with SPARSEMEM_VMEMMAP, because the vmemmap code deals with freeing the unused regions of the memmap instead of requiring the arch code to do it.
This patch gets the memblock base out of the memblock directly when computing the block end address to ensure the correct value is used.
--- arch/arm64/mm/init.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/mm/init.c +1 -1
@@ -243,7 +243,7 @@ static void __init free_unused_memmap(vo* memmap entries are valid from the bank end aligned to * MAX_ORDER_NR_PAGES. */ - prev_end =ALIGN (start +__phys_to_pfn (reg->size), + prev_end =ALIGN (__phys_to_pfn (reg->base + reg->size),MAX_ORDER_NR_PAGES ); }
Greg Kroah-Hartman
maintainerPATCH 10/125 arm64: vdso: work-around broken ELF toolchains in Makefile
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Will Deacon <[email protected]>
commit 6f1a6ae87c0c60d7c462ef8fd071f291aa7a9abb upstream.
When building the kernel with a bare-metal (ELF) toolchain, the -shared option may not be passed down to collect2, resulting in silent corruption of the vDSO image (in particular, the DYNAMIC section is omitted).
The effect of this corruption is that the dynamic linker fails to find the vDSO symbols and libc is instead used for the syscalls that we intended to optimise (e.g. gettimeofday). Functionally, there is no issue as the sigreturn trampoline is still intact and located by the kernel.
This patch fixes the problem by explicitly passing -shared to the linker when building the vDSO.
--- arch/arm64/kernel/vdso/Makefile | 4 ++++ 1 file changed, 4 insertions(+)
arch/arm64/kernel/vdso/Makefile +4 -0
@@ -15,6 +15,10 @@ ccflags-y := -shared -fno-common -fno-bu ccflags-y += -nostdlib -Wl,-soname=linux-vdso.so.1 \ $(call cc-ldoption, -Wl$(comma)--hash-style=sysv) +# Workaround for bare-metal (ELF) toolchains that neglect to pass -shared +# down to collect2, resulting in silent corruption of the vDSO image. +ccflags-y += -Wl,-shared + obj-y += vdso.o extra-y += vdso.lds vdso-offsets.h CPPFLAGS_vdso.lds += -P -C -U$(ARCH)
Greg Kroah-Hartman
maintainerPATCH 11/125 cpuidle / menu: Return (-1) if there are no suitable states
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Rafael J. Wysocki" <[email protected]>
commit 3836785a1bdcd6706c68ad46bf53adc0b057b310 upstream.
If there is a PM QoS latency limit and all of the sufficiently shallow C-states are disabled, the cpuidle menu governor returns 0 which on some systems is CPUIDLE_DRIVER_STATE_START and shouldn't be returned if that C-state has been disabled.
Fix the issue by modifying the menu governor to return (-1) in such situations.
[shilpab: Backport to 3.10.y
- adjust context
- add a check if 'next_state' is less than 0 in 'cpuidle_idle_call()', this ensures that we exit 'cpuidle_idle_call()' if governor->select() returns negative value]
--- drivers/cpuidle/cpuidle.c | 3 +++ drivers/cpuidle/governors/menu.c | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-)
drivers/cpuidle/cpuidle.c +3 -0
@@ -131,6 +131,9 @@ int cpuidle_idle_call(void)/* ask the governor for the next state */ next_state = cpuidle_curr_governor->select (drv, dev); +if (next_state <0 ) +return -EBUSY ; +if (need_resched ()) { dev->last_residency =0 ;/* give the governor an opportunity to reflect on the outcome */
drivers/cpuidle/governors/menu.c +1 -1
@@ -297,7 +297,7 @@ static int menu_select(struct cpuidle_dr data->needs_update =0 ; } - data->last_state_idx =0 ; + data->last_state_idx =CPUIDLE_DRIVER_STATE_START -1 ; data->exit_us =0 ;/* Special case when user has set very strict latency requirement */
Greg Kroah-Hartman
maintainerPATCH 12/125 regmap: Fix regmap_bulk_read in BE mode
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arun Chandran <[email protected]>
commit 15b8d2c41fe5839582029f65c5f7004db451cc2b upstream.
In big endian mode regmap_bulk_read gives incorrect data for byte reads.
This is because memcpy of a single byte from an address after full word read gives different results when endianness differs. ie. we get little-end in LE and big-end in BE.
--- drivers/base/regmap/regmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/base/regmap/regmap.c +1 -1
@@ -1947,7 +1947,7 @@ int regmap_bulk_read(struct regmap *map, &ival);if (ret !=0 )return ret; -memcpy (val + (i * val_bytes), &ival, val_bytes); + map->format.format_val (val + (i * val_bytes), ival,0 ); } }
Greg Kroah-Hartman
maintainerPATCH 13/125 regmap: Fix possible shift overflow in regmap_field_init()
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maxime Coquelin <[email protected]>
commit 921cc29473a0d7c109105c1876ddb432f4a4be7d upstream.
The way the mask is generated in regmap_field_init() is wrong. Indeed, a field initialized with msb = 31 and lsb = 0 provokes a shift overflow while calculating the mask field.
On some 32 bits architectures, such as x86, the generated mask is 0, instead of the expected 0xffffffff.
This patch uses GENMASK() to fix the problem, as this macro is already safe regarding shift overflow.
--- drivers/base/regmap/regmap.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/base/regmap/regmap.c +1 -2
@@ -808,11 +808,10 @@ EXPORT_SYMBOL_GPL(devm_regmap_init);static void regmap_field_init (struct regmap_field *rm_field,struct regmap *regmap,struct reg_field reg_field) { -int field_bits = reg_field.msb - reg_field.lsb +1 ; rm_field->regmap = regmap; rm_field->reg = reg_field.reg; rm_field->shift = reg_field.lsb; - rm_field->mask = ((BIT (field_bits) -1 ) << reg_field.lsb); + rm_field->mask =GENMASK (reg_field.msb, reg_field.lsb); rm_field->id_size = reg_field.id_size; rm_field->id_offset = reg_field.id_offset; }
Greg Kroah-Hartman
maintainerPATCH 14/125 regulator: core: fix constraints output buffer
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Wahren <[email protected]>
commit a7068e3932eee8268c4ce4e080a338ee7b8a27bf upstream.
The buffer for condtraints debug isn't big enough to hold the output in all cases. So fix this issue by increasing the buffer.
--- drivers/regulator/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/regulator/core.c +1 -1
@@ -773,7 +773,7 @@ static int suspend_prepare(struct regulastatic void print_constraints (struct regulator_dev *rdev) {struct regulation_constraints *constraints = rdev->constraints; -char buf[80 ] ="" ; +char buf[160 ] ="" ;int count =0 ;int ret;
Greg Kroah-Hartman
maintainerPATCH 16/125 spi: pl022: Specify num-cs property as required in devicetree binding
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ezequiel Garcia <[email protected]>
commit ea6055c46eda1e19e02209814955e13f334bbe1b upstream.
Since commit 39a6ac11df65 ("spi/pl022: Devicetree support w/o platform data") the 'num-cs' parameter cannot be passed through platform data when probing with devicetree. Instead, it's a required devicetree property.
Fix the binding documentation so the property is properly specified.
--- Documentation/devicetree/bindings/spi/spi_pl022.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Documentation/devicetree/bindings/spi/spi_pl022.txt +1 -1
@@ -4,9 +4,9 @@ Required properties: - compatible : "arm,pl022", "arm,primecell" - reg : Offset and length of the register set for the device - interrupts : Should contain SPI controller interrupt +- num-cs : total number of chipselects Optional properties: -- num-cs : total number of chipselects - cs-gpios : should specify GPIOs used for chipselects. The gpios will be referred to as reg = <index> in the SPI child nodes. If unspecified, a single SPI device without a chip select can be used.
Greg Kroah-Hartman
maintainerPATCH 17/125 scsi_transport_srp: Introduce srp_wait_for_queuecommand()
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <[email protected]>
commit be34c62ddf39d1931780b07a6f4241393e4ba2ee upstream.
Introduce the helper function srp_wait_for_queuecommand(). Move the definition of scsi_request_fn_active(). Add a comment above srp_wait_for_queuecommand() that support for scsi-mq needs to be added.
This patch does not change any functionality. A second call to srp_wait_for_queuecommand() will be introduced in the next patch.
--- drivers/scsi/scsi_transport_srp.c | 54 +++++++++++++++++++++----------------- 1 file changed, 31 insertions(+), 23 deletions(-)
drivers/scsi/scsi_transport_srp.c +31 -23
@@ -397,6 +397,36 @@ static void srp_reconnect_work(struct wo } } +/** +* scsi_request_fn_active() - number of kernel threads inside scsi_request_fn() +* @shost: SCSI host for which to count the number of scsi_request_fn() callers. +* +* To do: add support for scsi-mq in this function. +*/ +static int scsi_request_fn_active (struct Scsi_Host *shost) +{ +struct scsi_device *sdev; +struct request_queue *q; +int request_fn_active =0 ; + +shost_for_each_device (sdev, shost) { + q = sdev->request_queue; + +spin_lock_irq (q->queue_lock); + request_fn_active += q->request_fn_active; +spin_unlock_irq (q->queue_lock); + } + +return request_fn_active; +} + +/* Wait until ongoing shost->hostt->queuecommand() calls have finished. */ +static void srp_wait_for_queuecommand (struct Scsi_Host *shost) +{ +while (scsi_request_fn_active (shost)) +msleep (20 ); +} +static void __rport_fail_io_fast (struct srp_rport *rport) {struct Scsi_Host *shost =rport_to_shost (rport);
@@ -505,27 +535,6 @@ void srp_start_tl_fail_timers(struct srpEXPORT_SYMBOL (srp_start_tl_fail_timers);/** -* scsi_request_fn_active() - number of kernel threads inside scsi_request_fn() -* @shost: SCSI host for which to count the number of scsi_request_fn() callers. -*/ -static int scsi_request_fn_active (struct Scsi_Host *shost) -{ -struct scsi_device *sdev; -struct request_queue *q; -int request_fn_active =0 ; - -shost_for_each_device (sdev, shost) { - q = sdev->request_queue; - -spin_lock_irq (q->queue_lock); - request_fn_active += q->request_fn_active; -spin_unlock_irq (q->queue_lock); - } - -return request_fn_active; -} - -/** * srp_reconnect_rport() - reconnect to an SRP target port * @rport: SRP target port. *
@@ -560,8 +569,7 @@ int srp_reconnect_rport(struct srp_rportif (res) goto out;scsi_target_block (&shost->shost_gendev); -while (scsi_request_fn_active (shost)) -msleep (20 ); +srp_wait_for_queuecommand (shost); res = rport->state !=SRP_RPORT_LOST ? i->f->reconnect (rport) : -ENODEV ;pr_debug ("%s (state %d): transport.reconnect() returned %d\n" ,dev_name (&shost->shost_gendev), rport->state, res);
Greg Kroah-Hartman
maintainerPATCH 18/125 scsi_transport_srp: Fix a race condition
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <[email protected]>
commit 535fb906225fb7436cb658144d0c0cea14a26f3e upstream.
Avoid that srp_terminate_io() can get invoked while srp_queuecommand() is in progress. This patch avoids that an I/O timeout can trigger the following kernel warning:
WARNING: at drivers/infiniband/ulp/srp/ib_srp.c:1447 srp_terminate_io+0xef/0x100 [ib_srp]() Call Trace: [<ffffffff814c65a2>] dump_stack+0x4e/0x68 [<ffffffff81051f71>] warn_slowpath_common+0x81/0xa0 [<ffffffff8105204a>] warn_slowpath_null+0x1a/0x20 [<ffffffffa075f51f>] srp_terminate_io+0xef/0x100 [ib_srp] [<ffffffffa07495da>] __rport_fail_io_fast+0xba/0xc0 [scsi_transport_srp] [<ffffffffa0749a90>] rport_fast_io_fail_timedout+0xe0/0xf0 [scsi_transport_srp] [<ffffffff8106e09b>] process_one_work+0x1db/0x780 [<ffffffff8106e75b>] worker_thread+0x11b/0x450 [<ffffffff81073c64>] kthread+0xe4/0x100 [<ffffffff814cf26c>] ret_from_fork+0x7c/0xb0
See also patch "scsi_transport_srp: Add transport layer error handling" (commit ID 29c17324803c).
--- drivers/scsi/scsi_transport_srp.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/scsi/scsi_transport_srp.c +3 -1
@@ -440,8 +440,10 @@ static void __rport_fail_io_fast(struct/* Involve the LLD if possible to terminate all I/O on the rport. */ i =to_srp_internal (shost->transportt); -if (i->f->terminate_rport_io) +if (i->f->terminate_rport_io) { +srp_wait_for_queuecommand (shost); i->f->terminate_rport_io (rport); + } }/**
Greg Kroah-Hartman
maintainerPATCH 19/125 genirq: devres: Fix testing return value of request_any_context_irq()
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Axel Lin <[email protected]>
commit 63781394c540dd9e666a6b21d70b64dd52bce76e upstream.
request_any_context_irq() returns a negative value on failure. It returns either IRQC_IS_HARDIRQ or IRQC_IS_NESTED on success. So fix testing return value of request_any_context_irq().
Also fixup the return value of devm_request_any_context_irq() to make it consistent with request_any_context_irq().
--- kernel/irq/devres.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/irq/devres.c +2 -2
@@ -104,7 +104,7 @@ int devm_request_any_context_irq(structreturn -ENOMEM ; rc =request_any_context_irq (irq, handler, irqflags, devname, dev_id); -if (rc) { +if (rc <0 ) {devres_free (dr);return rc; }
@@ -113,7 +113,7 @@ int devm_request_any_context_irq(struct dr->dev_id = dev_id;devres_add (dev, dr); -return 0 ; +return rc; }EXPORT_SYMBOL (devm_request_any_context_irq);
Greg Kroah-Hartman
maintainerPATCH 20/125 leds / PM: fix hibernation on arm when gpio-led used with CPU led trigger
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Grygorii Strashko <[email protected]>
commit 084609bf727981c7a2e6e69aefe0052c9d793300 upstream.
Setting a dev_pm_ops suspend/resume pair of callbacks but not a set of hibernation callbacks means those pm functions will not be called upon hibernation - that leads to system crash on ARM during freezing if gpio-led is used in combination with CPU led trigger. It may happen after freeze_noirq stage (GPIO is suspended) and before syscore_suspend stage (CPU led trigger is suspended)
- usually when disable_nonboot_cpus() is called.
Log:
PM: noirq freeze of devices complete after 1.425 msecs Disabling non-boot CPUs ...
^ system may crash or stuck here with message (TI AM572x)
WARNING: CPU: 0 PID: 3100 at drivers/bus/omap_l3_noc.c:148 l3_interrupt_handler+0x22c/0x370() 44000000.ocp:L3 Custom Error: MASTER MPU TARGET L4_PER1_P3 (Idle): Data Access in Supervisor mode during Functional access
CPU1: shutdown
^ or here
Fix this by using SIMPLE_DEV_PM_OPS, which appropriately assigns the suspend and hibernation callbacks and move led_suspend/led_resume under CONFIG_PM_SLEEP to avoid build warnings.
--- drivers/leds/led-class.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
drivers/leds/led-class.c +3 -4
@@ -178,6 +178,7 @@ void led_classdev_resume(struct led_clas }EXPORT_SYMBOL_GPL (led_classdev_resume); +#ifdef CONFIG_PM_SLEEP static int led_suspend (struct device *dev) {struct led_classdev *led_cdev =dev_get_drvdata (dev);
@@ -197,11 +198,9 @@ static int led_resume(struct device *devreturn 0 ; } +#endif -static const struct dev_pm_ops leds_class_dev_pm_ops = { - .suspend = led_suspend, - .resume = led_resume, -}; +static SIMPLE_DEV_PM_OPS(leds_class_dev_pm_ops, led_suspend, led_resume);/** * led_classdev_register - register a new object of led_classdev class.
Greg Kroah-Hartman
maintainerPATCH 21/125 mtd: fix: avoid race condition when accessing mtd->usecount
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Norris <[email protected]>
commit 073db4a51ee43ccb827f54a4261c0583b028d5ab upstream.
On A MIPS 32-cores machine a BUG_ON was triggered because some acesses to mtd->usecount were done without taking mtd_table_mutex.
kernel: Call Trace:
kernel: [<ffffffff80401818>] __put_mtd_device+0x20/0x50
kernel: [<ffffffff804086f4>] blktrans_release+0x8c/0xd8
kernel: [<ffffffff802577e0>] __blkdev_put+0x1a8/0x200
kernel: [<ffffffff802579a4>] blkdev_close+0x1c/0x30
kernel: [<ffffffff8022006c>] __fput+0xac/0x250
kernel: [<ffffffff80171208>] task_work_run+0xd8/0x120
kernel: [<ffffffff8012c23c>] work_notifysig+0x10/0x18
kernel:
kernel:
Code: 2442ffff ac8202d8 000217fe <00020336> dc820128 10400003
00000000 0040f809 00000000kernel: ---[ end trace 080fbb4579b47a73 ]---
Fixed by taking the mutex in blktrans_open and blktrans_release.
Note that this locking is already suggested ininclude/linux/mtd/blktrans.h:
struct mtd_blktrans_ops {
...
/* Called with mtd_table_mutex held; no race with add/remove */ int (*open)(struct mtd_blktrans_dev *dev); void (*release)(struct mtd_blktrans_dev *dev);
...
};
But we weren't following it.
Originally reported by (and patched by) Zhang and Giuseppe, independently. Improved and rewritten.
--- drivers/mtd/mtd_blkdevs.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/mtd/mtd_blkdevs.c +5 -0
@@ -199,6 +199,7 @@ static int blktrans_open(struct block_dereturn -ERESTARTSYS ;/* FIXME: busy loop! -arnd*/ mutex_lock (&dev->lock); +mutex_lock (&mtd_table_mutex);if (dev->open) goto unlock;
@@ -222,6 +223,7 @@ static int blktrans_open(struct block_de unlock: dev->open++; +mutex_unlock (&mtd_table_mutex);mutex_unlock (&dev->lock);blktrans_dev_put (dev);return ret;
@@ -232,6 +234,7 @@ error_release: error_put:module_put (dev->tr->owner);kref_put (&dev->ref, blktrans_dev_release); +mutex_unlock (&mtd_table_mutex);mutex_unlock (&dev->lock);blktrans_dev_put (dev);return ret;
@@ -245,6 +248,7 @@ static void blktrans_release(struct gendreturn ;mutex_lock (&dev->lock); +mutex_lock (&mtd_table_mutex);if (--dev->open) goto unlock;
@@ -258,6 +262,7 @@ static void blktrans_release(struct gend__put_mtd_device (dev->mtd); } unlock: +mutex_unlock (&mtd_table_mutex);mutex_unlock (&dev->lock);blktrans_dev_put (dev); }
Greg Kroah-Hartman
maintainerPATCH 23/125 thermal: step_wise: fix: Prevent from binary overflow when trend is dropping
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukasz Majewski <[email protected]>
commit 26bb0e9a1a938ec98ee07aa76533f1a711fba706 upstream.
It turns out that some boards can have instance->lower greater than 0 and when thermal trend is dropping it results with next_target equal to -1.
Since the next_target is defined as unsigned long it is interpreted as 0xFFFFFFFF and larger than instance->upper.
As a result the next_target is set to instance->upper which ramps up to maximal cooling device target when the temperature is steadily decreasing.
--- drivers/thermal/step_wise.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/thermal/step_wise.c +1 -1
@@ -76,7 +76,7 @@ static unsigned long get_target_state(st next_target = instance->upper;break ;case THERMAL_TREND_DROPPING : -if (cur_state == instance->lower) { +if (cur_state <= instance->lower) {if (!throttle) next_target =THERMAL_NO_TARGET ; }else {
Greg Kroah-Hartman
maintainerPATCH 24/125 pinctrl: mvebu: armada-370: fix spi0 pin description
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Petazzoni <[email protected]>
commit 438881dfddb9107ef0eb30b49368e91e092f0b3e upstream.
Due to a mistake, the CS0 and CS1 SPI0 functions were incorrectly named "spi0-1" instead of just "spi0". This commit fixes that.
This DT binding change does not affect any of the in-tree users.
--- Documentation/devicetree/bindings/pinctrl/marvell,armada-370-pinctrl.txt | 4 ++-- drivers/pinctrl/mvebu/pinctrl-armada-370.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-)
Documentation/devicetree/bindings/pinctrl/marvell,armada-370-pinctrl.txt +2 -2
@@ -91,5 +91,5 @@ mpp61 61 gpo, dev(wen1), u mpp62 62 gpio, dev(a2), uart1(cts), tdm(drx), pcie(clkreq0), audio(mclk), uart0(cts) mpp63 63 gpo, spi0(sck), tclk -mpp64 64 gpio, spi0(miso), spi0-1(cs1) -mpp65 65 gpio, spi0(mosi), spi0-1(cs2) +mpp64 64 gpio, spi0(miso), spi0(cs1) +mpp65 65 gpio, spi0(mosi), spi0(cs2)
drivers/pinctrl/mvebu/pinctrl-armada-370.c +2 -2
@@ -358,11 +358,11 @@ static struct mvebu_mpp_mode mv88f6710_mMPP_MODE (64 ,MPP_FUNCTION (0x0 ,"gpio" ,NULL ),MPP_FUNCTION (0x1 ,"spi0" ,"miso" ), -MPP_FUNCTION (0x2 ,"spi0-1" ,"cs1" )), +MPP_FUNCTION (0x2 ,"spi0" ,"cs1" )),MPP_MODE (65 ,MPP_FUNCTION (0x0 ,"gpio" ,NULL ),MPP_FUNCTION (0x1 ,"spi0" ,"mosi" ), - MPP_FUNCTION(0x2, "spi0-1", "cs2")), + MPP_FUNCTION(0x2, "spi0", "cs2")), };static struct mvebu_pinctrl_soc_info armada_370_pinctrl_info;
Greg Kroah-Hartman
maintainerPATCH 25/125 pinctrl: mvebu: armada-xp: remove non-existing NAND pins
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Petazzoni <[email protected]>
commit bc99357f3690c11817756adfee0ece811a3db2e7 upstream.
After updating to a more recent version of the Armada XP datasheet, we realized that some of the pins documented as having a NAND-related functionality in fact did not have such functionality. This commit updates the pinctrl driver accordingly.
--- Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt | 4 ++-- drivers/pinctrl/mvebu/pinctrl-armada-xp.c | 2 -- 2 files changed, 2 insertions(+), 4 deletions(-)
Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt +2 -2
@@ -41,8 +41,8 @@ mpp20 20 gpio, ge0(rxd4), mpp21 21 gpio, ge0(rxd5), ge1(rxd3), lcd(d21), mem(bat) mpp22 22 gpio, ge0(rxd6), ge1(rxctl), lcd(d22), sata0(prsnt) mpp23 23 gpio, ge0(rxd7), ge1(rxclk), lcd(d23), sata1(prsnt) -mpp24 24 gpio, lcd(hsync), sata1(prsnt), nf(bootcs-re), tdm(rst) -mpp25 25 gpio, lcd(vsync), sata0(prsnt), nf(bootcs-we), tdm(pclk) +mpp24 24 gpio, lcd(hsync), sata1(prsnt), tdm(rst) +mpp25 25 gpio, lcd(vsync), sata0(prsnt), tdm(pclk) mpp26 26 gpio, lcd(clk), tdm(fsync), vdd(cpu1-pd) mpp27 27 gpio, lcd(e), tdm(dtx), ptp(trig) mpp28 28 gpio, lcd(pwm), tdm(drx), ptp(evreq)
drivers/pinctrl/mvebu/pinctrl-armada-xp.c +0 -2
@@ -159,13 +159,11 @@ static struct mvebu_mpp_mode armada_xp_mMPP_MODE (24 ,MPP_VAR_FUNCTION (0x0 ,"gpio" ,NULL ,V_MV78230_PLUS ),MPP_VAR_FUNCTION (0x1 ,"sata1" ,"prsnt" ,V_MV78230_PLUS ), -MPP_VAR_FUNCTION (0x2 ,"nf" ,"bootcs-re" ,V_MV78230_PLUS ),MPP_VAR_FUNCTION (0x3 ,"tdm" ,"rst" ,V_MV78230_PLUS ),MPP_VAR_FUNCTION (0x4 ,"lcd" ,"hsync" ,V_MV78230_PLUS )),MPP_MODE (25 ,MPP_VAR_FUNCTION (0x0 ,"gpio" ,NULL ,V_MV78230_PLUS ),MPP_VAR_FUNCTION (0x1 ,"sata0" ,"prsnt" ,V_MV78230_PLUS ), -MPP_VAR_FUNCTION (0x2 ,"nf" ,"bootcs-we" ,V_MV78230_PLUS ),MPP_VAR_FUNCTION (0x3 ,"tdm" ,"pclk" ,V_MV78230_PLUS ),MPP_VAR_FUNCTION (0x4 ,"lcd" ,"vsync" ,V_MV78230_PLUS )), MPP_MODE(26,
Greg Kroah-Hartman
maintainerPATCH 26/125 pinctrl: mvebu: armada-xp: remove non-existing VDD cpu_pd functions
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Petazzoni <[email protected]>
commit 80b3d04feab5e69d51cb2375eb989a7165e43e3b upstream.
The latest version of the Armada XP datasheet no longer documents the VDD cpu_pd functions, which might indicate they are not working and/or not supported. This commit ensures the pinctrl driver matches the datasheet.
--- Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt | 26 +++---- drivers/pinctrl/mvebu/pinctrl-armada-xp.c | 33 +++------- 2 files changed, 20 insertions(+), 39 deletions(-)
Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt +10 -16
@@ -43,13 +43,13 @@ mpp22 22 gpio, ge0(rxd6), mpp23 23 gpio, ge0(rxd7), ge1(rxclk), lcd(d23), sata1(prsnt) mpp24 24 gpio, lcd(hsync), sata1(prsnt), tdm(rst) mpp25 25 gpio, lcd(vsync), sata0(prsnt), tdm(pclk) -mpp26 26 gpio, lcd(clk), tdm(fsync), vdd(cpu1-pd) +mpp26 26 gpio, lcd(clk), tdm(fsync) mpp27 27 gpio, lcd(e), tdm(dtx), ptp(trig) mpp28 28 gpio, lcd(pwm), tdm(drx), ptp(evreq) -mpp29 29 gpio, lcd(ref-clk), tdm(int0), ptp(clk), vdd(cpu0-pd) +mpp29 29 gpio, lcd(ref-clk), tdm(int0), ptp(clk) mpp30 30 gpio, tdm(int1), sd0(clk) -mpp31 31 gpio, tdm(int2), sd0(cmd), vdd(cpu0-pd) -mpp32 32 gpio, tdm(int3), sd0(d0), vdd(cpu1-pd) +mpp31 31 gpio, tdm(int2), sd0(cmd) +mpp32 32 gpio, tdm(int3), sd0(d0) mpp33 33 gpio, tdm(int4), sd0(d1), mem(bat) mpp34 34 gpio, tdm(int5), sd0(d2), sata0(prsnt) mpp35 35 gpio, tdm(int6), sd0(d3), sata1(prsnt)
@@ -57,14 +57,11 @@ mpp36 36 gpio, spi(mosi) mpp37 37 gpio, spi(miso) mpp38 38 gpio, spi(sck) mpp39 39 gpio, spi(cs0) -mpp40 40 gpio, spi(cs1), uart2(cts), lcd(vga-hsync), vdd(cpu1-pd), - pcie(clkreq0) +mpp40 40 gpio, spi(cs1), uart2(cts), lcd(vga-hsync), pcie(clkreq0) mpp41 41 gpio, spi(cs2), uart2(rts), lcd(vga-vsync), sata1(prsnt), pcie(clkreq1) -mpp42 42 gpio, uart2(rxd), uart0(cts), tdm(int7), tdm-1(timer), - vdd(cpu0-pd) -mpp43 43 gpio, uart2(txd), uart0(rts), spi(cs3), pcie(rstout), - vdd(cpu2-3-pd){1} +mpp42 42 gpio, uart2(rxd), uart0(cts), tdm(int7), tdm-1(timer) +mpp43 43 gpio, uart2(txd), uart0(rts), spi(cs3), pcie(rstout) mpp44 44 gpio, uart2(cts), uart3(rxd), spi(cs4), pcie(clkreq2), mem(bat) mpp45 45 gpio, uart2(rts), uart3(txd), spi(cs5), sata1(prsnt)
@@ -83,9 +80,9 @@ mpp51 51 gpio, dev(ad16) mpp52 52 gpio, dev(ad17) mpp53 53 gpio, dev(ad18) mpp54 54 gpio, dev(ad19) -mpp55 55 gpio, dev(ad20), vdd(cpu0-pd) -mpp56 56 gpio, dev(ad21), vdd(cpu1-pd) -mpp57 57 gpio, dev(ad22), vdd(cpu2-3-pd){1} +mpp55 55 gpio, dev(ad20) +mpp56 56 gpio, dev(ad21) +mpp57 57 gpio, dev(ad22) mpp58 58 gpio, dev(ad23) mpp59 59 gpio, dev(ad24) mpp60 60 gpio, dev(ad25)
@@ -95,6 +92,3 @@ mpp63 63 gpio, dev(ad28) mpp64 64 gpio, dev(ad29) mpp65 65 gpio, dev(ad30) mpp66 66 gpio, dev(ad31) - -Notes: -* {1} vdd(cpu2-3-pd) only available on mv78460.
drivers/pinctrl/mvebu/pinctrl-armada-xp.c +10 -23
@@ -14,10 +14,7 @@* available: mv78230, mv78260 and mv78460. From a pin muxing * perspective, the mv78230 has 49 MPP pins. The mv78260 and mv78460 * both have 67 MPP pins (more GPIOs and address lines for the memory -* bus mainly). The only difference between the mv78260 and the -* mv78460 in terms of pin muxing is the addition of two functions on -* pins 43 and 56 to access the VDD of the CPU2 and 3 (mv78260 has two -* cores, mv78460 has four cores). +* bus mainly). */ #include <linux/err.h>
@@ -169,8 +166,7 @@ static struct mvebu_mpp_mode armada_xp_mMPP_MODE (26 ,MPP_VAR_FUNCTION (0x0 ,"gpio" ,NULL ,V_MV78230_PLUS ),MPP_VAR_FUNCTION (0x3 ,"tdm" ,"fsync" ,V_MV78230_PLUS ), -MPP_VAR_FUNCTION (0x4 ,"lcd" ,"clk" ,V_MV78230_PLUS ), -MPP_VAR_FUNCTION (0x5 ,"vdd" ,"cpu1-pd" ,V_MV78230_PLUS )), +MPP_VAR_FUNCTION (0x4 ,"lcd" ,"clk" ,V_MV78230_PLUS )), MPP_MODE(27, MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS), MPP_VAR_FUNCTION(0x1, "ptp", "trig", V_MV78230_PLUS),
@@ -185,8 +181,7 @@ static struct mvebu_mpp_mode armada_xp_m MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS), MPP_VAR_FUNCTION(0x1, "ptp", "clk", V_MV78230_PLUS), MPP_VAR_FUNCTION(0x3, "tdm", "int0", V_MV78230_PLUS), - MPP_VAR_FUNCTION(0x4, "lcd", "ref-clk", V_MV78230_PLUS), - MPP_VAR_FUNCTION(0x5, "vdd", "cpu0-pd", V_MV78230_PLUS)), + MPP_VAR_FUNCTION(0x4, "lcd", "ref-clk", V_MV78230_PLUS)), MPP_MODE(30, MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS), MPP_VAR_FUNCTION(0x1, "sd0", "clk", V_MV78230_PLUS),
@@ -194,13 +189,11 @@ static struct mvebu_mpp_mode armada_xp_mMPP_MODE (31 ,MPP_VAR_FUNCTION (0x0 ,"gpio" ,NULL ,V_MV78230_PLUS ),MPP_VAR_FUNCTION (0x1 ,"sd0" ,"cmd" ,V_MV78230_PLUS ), -MPP_VAR_FUNCTION (0x3 ,"tdm" ,"int2" ,V_MV78230_PLUS ), -MPP_VAR_FUNCTION (0x5 ,"vdd" ,"cpu0-pd" ,V_MV78230_PLUS )), +MPP_VAR_FUNCTION (0x3 ,"tdm" ,"int2" ,V_MV78230_PLUS )),MPP_MODE (32 ,MPP_VAR_FUNCTION (0x0 ,"gpio" ,NULL ,V_MV78230_PLUS ),MPP_VAR_FUNCTION (0x1 ,"sd0" ,"d0" ,V_MV78230_PLUS ), -MPP_VAR_FUNCTION (0x3 ,"tdm" ,"int3" ,V_MV78230_PLUS ), -MPP_VAR_FUNCTION (0x5 ,"vdd" ,"cpu1-pd" ,V_MV78230_PLUS )), +MPP_VAR_FUNCTION (0x3 ,"tdm" ,"int3" ,V_MV78230_PLUS )), MPP_MODE(33, MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS), MPP_VAR_FUNCTION(0x1, "sd0", "d1", V_MV78230_PLUS),
@@ -232,7 +225,6 @@ static struct mvebu_mpp_mode armada_xp_mMPP_VAR_FUNCTION (0x0 ,"gpio" ,NULL ,V_MV78230_PLUS ),MPP_VAR_FUNCTION (0x1 ,"spi" ,"cs1" ,V_MV78230_PLUS ),MPP_VAR_FUNCTION (0x2 ,"uart2" ,"cts" ,V_MV78230_PLUS ), -MPP_VAR_FUNCTION (0x3 ,"vdd" ,"cpu1-pd" ,V_MV78230_PLUS ),MPP_VAR_FUNCTION (0x4 ,"lcd" ,"vga-hsync" ,V_MV78230_PLUS ), MPP_VAR_FUNCTION(0x5, "pcie", "clkreq0", V_MV78230_PLUS)), MPP_MODE(41,
@@ -247,15 +239,13 @@ static struct mvebu_mpp_mode armada_xp_m MPP_VAR_FUNCTION(0x1, "uart2", "rxd", V_MV78230_PLUS), MPP_VAR_FUNCTION(0x2, "uart0", "cts", V_MV78230_PLUS), MPP_VAR_FUNCTION(0x3, "tdm", "int7", V_MV78230_PLUS), - MPP_VAR_FUNCTION(0x4, "tdm-1", "timer", V_MV78230_PLUS), - MPP_VAR_FUNCTION(0x5, "vdd", "cpu0-pd", V_MV78230_PLUS)), + MPP_VAR_FUNCTION(0x4, "tdm-1", "timer", V_MV78230_PLUS)),MPP_MODE (43 ,MPP_VAR_FUNCTION (0x0 ,"gpio" ,NULL ,V_MV78230_PLUS ),MPP_VAR_FUNCTION (0x1 ,"uart2" ,"txd" ,V_MV78230_PLUS ),MPP_VAR_FUNCTION (0x2 ,"uart0" ,"rts" ,V_MV78230_PLUS ),MPP_VAR_FUNCTION (0x3 ,"spi" ,"cs3" ,V_MV78230_PLUS ), -MPP_VAR_FUNCTION (0x4 ,"pcie" ,"rstout" ,V_MV78230_PLUS ), -MPP_VAR_FUNCTION (0x5 ,"vdd" ,"cpu2-3-pd" ,V_MV78460 )), +MPP_VAR_FUNCTION (0x4 ,"pcie" ,"rstout" ,V_MV78230_PLUS )), MPP_MODE(44, MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS), MPP_VAR_FUNCTION(0x1, "uart2", "cts", V_MV78230_PLUS),
@@ -306,16 +296,13 @@ static struct mvebu_mpp_mode armada_xp_m MPP_VAR_FUNCTION(0x1, "dev", "ad19", V_MV78260_PLUS)),MPP_MODE (55 ,MPP_VAR_FUNCTION (0x0 ,"gpio" ,NULL ,V_MV78260_PLUS ), -MPP_VAR_FUNCTION (0x1 ,"dev" ,"ad20" ,V_MV78260_PLUS ), -MPP_VAR_FUNCTION (0x2 ,"vdd" ,"cpu0-pd" ,V_MV78260_PLUS )), +MPP_VAR_FUNCTION (0x1 ,"dev" ,"ad20" ,V_MV78260_PLUS )),MPP_MODE (56 ,MPP_VAR_FUNCTION (0x0 ,"gpio" ,NULL ,V_MV78260_PLUS ), -MPP_VAR_FUNCTION (0x1 ,"dev" ,"ad21" ,V_MV78260_PLUS ), -MPP_VAR_FUNCTION (0x2 ,"vdd" ,"cpu1-pd" ,V_MV78260_PLUS )), +MPP_VAR_FUNCTION (0x1 ,"dev" ,"ad21" ,V_MV78260_PLUS )),MPP_MODE (57 ,MPP_VAR_FUNCTION (0x0 ,"gpio" ,NULL ,V_MV78260_PLUS ), -MPP_VAR_FUNCTION (0x1 ,"dev" ,"ad22" ,V_MV78260_PLUS ), -MPP_VAR_FUNCTION (0x2 ,"vdd" ,"cpu2-3-pd" ,V_MV78460 )), +MPP_VAR_FUNCTION (0x1 ,"dev" ,"ad22" ,V_MV78260_PLUS )),MPP_MODE (58 ,MPP_VAR_FUNCTION (0x0 ,"gpio" ,NULL ,V_MV78260_PLUS ), MPP_VAR_FUNCTION(0x1, "dev", "ad23", V_MV78260_PLUS)),
Greg Kroah-Hartman
maintainerPATCH 27/125 pinctrl: mvebu: armada-xp: fix functions of MPP48
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Petazzoni <[email protected]>
commit ea78b9511a54d0de026e04b5da86b30515072f31 upstream.
There was a mistake in the definition of the functions for MPP48 on Marvell Armada XP. The second function is dev(clkout), and not tclk.
--- Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt | 2 +- drivers/pinctrl/mvebu/pinctrl-armada-xp.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt +1 -1
@@ -68,7 +68,7 @@ mpp45 45 gpio, uart2(rts), mpp46 46 gpio, uart3(rts), uart1(rts), spi(cs6), sata0(prsnt) mpp47 47 gpio, uart3(cts), uart1(cts), spi(cs7), pcie(clkreq3), ref(clkout) -mpp48 48 gpio, tclk, dev(burst/last) +mpp48 48 gpio, dev(clkout), dev(burst/last) * Marvell Armada XP (mv78260 and mv78460 only)
drivers/pinctrl/mvebu/pinctrl-armada-xp.c +1 -1
@@ -274,7 +274,7 @@ static struct mvebu_mpp_mode armada_xp_m MPP_VAR_FUNCTION(0x5, "pcie", "clkreq3", V_MV78230_PLUS)),MPP_MODE (48 ,MPP_VAR_FUNCTION (0x0 ,"gpio" ,NULL ,V_MV78230_PLUS ), -MPP_VAR_FUNCTION (0x1 ,"tclk" ,NULL ,V_MV78230_PLUS ), +MPP_VAR_FUNCTION (0x1 ,"dev" ,"clkout" ,V_MV78230_PLUS ),MPP_VAR_FUNCTION (0x2 ,"dev" ,"burst/last" ,V_MV78230_PLUS )), MPP_MODE(49, MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78260_PLUS),
Greg Kroah-Hartman
maintainerPATCH 29/125 mtd: nand: fix erroneous read_buf call in nand_write_page_raw_syndrome
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boris BREZILLON <[email protected]>
commit 60c3bc1fd6f1fa40b415ef5b83e2948a89a3d79c upstream.
read_buf is called in place of write_buf in thenand_write_page_raw_syndrome function.
--- drivers/mtd/nand/nand_base.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mtd/nand/nand_base.c +1 -1
@@ -2000,7 +2000,7 @@ static int nand_write_page_raw_syndrome( oob += chip->ecc.prepad; } - chip->read_buf (mtd, oob, eccbytes); + chip->write_buf (mtd, oob, eccbytes); oob += eccbytes;if (chip->ecc.postpad) {
Greg Kroah-Hartman
maintainerPATCH 30/125 Bluetooth: btusb: Fix memory leak in Intel setup routine
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marcel Holtmann <[email protected]>
commit ecffc80478cdce122f0ecb6a4e4f909132dd5c47 upstream.
The SKB returned from the Intel specific version information command is missing a kfree_skb.
--- drivers/bluetooth/btusb.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/bluetooth/btusb.c +2 -0
@@ -1293,6 +1293,8 @@ static int btusb_setup_intel(struct hci_ } fw_ptr = fw->data; +kfree_skb (skb); +/* This Intel specific command enables the manufacturer mode of the * controller. *
Greg Kroah-Hartman
maintainerPATCH 31/125 ath9k: fix DMA stop sequence for AR9003+
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <[email protected]>
commit 300f77c08ded96d33f492aaa02549103852f0c12 upstream.
AR93xx and newer needs to stop rx before tx to avoid getting the DMA engine or MAC into a stuck state.
This should reduce/fix the occurence of "Failed to stop Tx DMA" logspam.
--- drivers/net/wireless/ath/ath9k/main.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
drivers/net/wireless/ath/ath9k/main.c +7 -5
@@ -205,11 +205,13 @@ static bool ath_prepare_reset(struct athath_stop_ani (sc);ath9k_hw_disable_interrupts (ah); -if (!ath_drain_all_txq (sc)) - ret = false; - -if (!ath_stoprecv (sc)) - ret = false; +if (AR_SREV_9300_20_OR_LATER (ah)) { + ret &=ath_stoprecv (sc); + ret &=ath_drain_all_txq (sc); + }else { + ret &=ath_drain_all_txq (sc); + ret &=ath_stoprecv (sc); + }return ret; }
Greg Kroah-Hartman
maintainerPATCH 32/125 staging: rtl8712: prevent buffer overrun in recvbuf2recvframe
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haggai Eran <[email protected]>
commit cab462140f8a183e3cca0b51c8b59ef715cb6148 upstream.
With an RTL8191SU USB adaptor, sometimes the hints for a fragmented packet are set, but the packet length is too large. Allocate enough space to prevent memory corruption and a resulting kernel panic [1].
[1] http://www.spinics.net/lists/linux-wireless/msg136546.html
--- drivers/staging/rtl8712/rtl8712_recv.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/staging/rtl8712/rtl8712_recv.c +2 -1
@@ -1075,7 +1075,8 @@ static int recvbuf2recvframe(struct _ada/* for first fragment packet, driver need allocate 1536 + * drvinfo_sz + RXDESC_SIZE to defrag packet. */ if ((mf ==1 ) && (frag ==0 )) - alloc_sz =1658 ;/*1658+6=1664, 1664 is 128 alignment.*/ +/*1658+6=1664, 1664 is 128 alignment.*/ + alloc_sz =max_t (u16, tmp_len,1658 );else alloc_sz = tmp_len;/* 2 is for IP header 4 bytes alignment in QoS packet case.
Greg Kroah-Hartman
maintainerPATCH 33/125 ext4: fix race between truncate and __ext4_journalled_writepage()
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Theodore Ts'o <[email protected]>
commit bdf96838aea6a265f2ae6cbcfb12a778c84a0b8e upstream.
The commit cf108bca465d: "ext4: Invert the locking order of page_lock and transaction start" caused __ext4_journalled_writepage() to drop the page lock before the page was written back, as part of changing the locking order to jbd2_journal_start -> page_lock. However, this introduced a potential race if there was a truncate racing with the data=journalled writeback mode.
Fix this by grabbing the page lock after starting the journal handle, and then checking to see if page had gotten truncated out from under us.
This fixes a number of different warnings or BUG_ON's when running xfstests generic/086 in data=journalled mode, including:
jbd2_journal_dirty_metadata: vdc-8: bad jh for block 115643: transaction (ee3fe7 c0, 164), jh->b_transaction ( (null), 0), jh->b_next_transaction ( (null), 0), jlist 0
- and -
kernel BUG at /usr/projects/linux/ext4/fs/jbd2/transaction.c:2200!
... Call Trace: [<c02b2ded>] ? __ext4_journalled_invalidatepage+0x117/0x117 [<c02b2de5>] __ext4_journalled_invalidatepage+0x10f/0x117 [<c02b2ded>] ? __ext4_journalled_invalidatepage+0x117/0x117 [<c027d883>] ? lock_buffer+0x36/0x36 [<c02b2dfa>] ext4_journalled_invalidatepage+0xd/0x22 [<c0229139>] do_invalidatepage+0x22/0x26 [<c0229198>] truncate_inode_page+0x5b/0x85 [<c022934b>] truncate_inode_pages_range+0x156/0x38c [<c0229592>] truncate_inode_pages+0x11/0x15 [<c022962d>] truncate_pagecache+0x55/0x71 [<c02b913b>] ext4_setattr+0x4a9/0x560 [<c01ca542>] ? current_kernel_time+0x10/0x44 [<c026c4d8>] notify_change+0x1c7/0x2be [<c0256a00>] do_truncate+0x65/0x85 [<c0226f31>] ? file_ra_state_init+0x12/0x29
- and -
WARNING: CPU: 1 PID: 1331 at /usr/projects/linux/ext4/fs/jbd2/transaction.c:1396
irty_metadata+0x14a/0x1ae()
...
Call Trace:
[<c01b879f>] ? console_unlock+0x3a1/0x3ce
[<c082cbb4>] dump_stack+0x48/0x60
[<c0178b65>] warn_slowpath_common+0x89/0xa0
[<c02ef2cf>] ? jbd2_journal_dirty_metadata+0x14a/0x1ae
[<c0178bef>] warn_slowpath_null+0x14/0x18
[<c02ef2cf>] jbd2_journal_dirty_metadata+0x14a/0x1ae
[<c02d8615>] __ext4_handle_dirty_metadata+0xd4/0x19d
[<c02b2f44>] write_end_fn+0x40/0x53
[<c02b4a16>] ext4_walk_page_buffers+0x4e/0x6a
[<c02b59e7>] ext4_writepage+0x354/0x3b8
[<c02b2f04>] ? mpage_release_unused_pages+0xd4/0xd4
[<c02b1b21>] ? wait_on_buffer+0x2c/0x2c
[<c02b5a4b>] ? ext4_writepage+0x3b8/0x3b8
[<c02b5a5b>] __writepage+0x10/0x2e
[<c0225956>] write_cache_pages+0x22d/0x32c
[<c02b5a4b>] ? ext4_writepage+0x3b8/0x3b8
[<c02b6ee8>] ext4_writepages+0x102/0x607
[<c019adfe>] ? sched_clock_local+0x10/0x10e
[<c01a8a7c>] ? __lock_is_held+0x2e/0x44
[<c01a8ad5>] ? lock_is_held+0x43/0x51
[<c0226dff>] do_writepages+0x1c/0x29
[<c0276bed>] __writeback_single_inode+0xc3/0x545
[<c0277c07>] writeback_sb_inodes+0x21f/0x36d
...--- fs/ext4/inode.c | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-)
fs/ext4/inode.c +19 -4
@@ -1744,19 +1744,32 @@ static int __ext4_journalled_writepage(sext4_walk_page_buffers (handle, page_bufs,0 , len,NULL , bget_one); } -/* As soon as we unlock the page, it can go away, but we have -* references to buffers so we are safe */ +/* +* We need to release the page lock before we start the +* journal, so grab a reference so the page won't disappear +* out from under us. +*/ +get_page (page);unlock_page (page); handle =ext4_journal_start (inode,EXT4_HT_WRITE_PAGE ,ext4_writepage_trans_blocks (inode));if (IS_ERR (handle)) { ret =PTR_ERR (handle); - goto out; +put_page (page); + goto out_no_pagelock; } -BUG_ON (!ext4_handle_valid (handle)); +lock_page (page); +put_page (page); +if (page->mapping != mapping) { +/* The page got truncated from under us */ +ext4_journal_stop (handle); + ret =0 ; + goto out; + } +if (inline_data) { ret =ext4_journal_get_write_access (handle, inode_bh);
@@ -1781,6 +1794,8 @@ static int __ext4_journalled_writepage(s NULL, bput_one);ext4_set_inode_state (inode,EXT4_STATE_JDATA ); out: +unlock_page (page); +out_no_pagelock:brelse (inode_bh);return ret; }
Greg Kroah-Hartman
maintainerPATCH 34/125 ext4: call sync_blockdev() before invalidate_bdev() in put_super()
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Theodore Ts'o <[email protected]>
commit 89d96a6f8e6491f24fc8f99fd6ae66820e85c6c1 upstream.
Normally all of the buffers will have been forced out to disk before we call invalidate_bdev(), but there will be some cases, where a file system operation was aborted due to an ext4_error(), where there may still be some dirty buffers in the buffer cache for the device. So try to force them out to memory before calling invalidate_bdev().
This fixes a warning triggered by generic/081:
WARNING: CPU: 1 PID: 3473 at /usr/projects/linux/ext4/fs/block_dev.c:56 __blkdev_put+0xb5/0x16f()
--- fs/ext4/super.c | 1 + 1 file changed, 1 insertion(+)
fs/ext4/super.c +1 -0
@@ -832,6 +832,7 @@ static void ext4_put_super(struct super_dump_orphan_list (sb, sbi);J_ASSERT (list_empty (&sbi->s_orphan)); +sync_blockdev (sb->s_bdev);invalidate_bdev (sb->s_bdev);if (sbi->journal_bdev && sbi->journal_bdev != sb->s_bdev) {/*
Greg Kroah-Hartman
maintainerPATCH 35/125 ext4: dont retry file block mapping on bigalloc fs with non-extent file
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Darrick J. Wong" <[email protected]>
commit 292db1bc6c105d86111e858859456bcb11f90f91 upstream.
ext4 isn't willing to map clusters to a non-extent file. Don't signal this with an out of space error, since the FS will retry the allocation (which didn't fail) forever. Instead, return EUCLEAN so that the operation will fail immediately all the way back to userspace.
(The fix is either to run e2fsck -E bmap2extent, or to chattr +e the file.)
--- fs/ext4/indirect.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ext4/indirect.c +1 -1
@@ -576,7 +576,7 @@ int ext4_ind_map_blocks(handle_t *handle EXT4_FEATURE_RO_COMPAT_BIGALLOC)) {EXT4_ERROR_INODE (inode,"Can't allocate blocks for " "non-extent mapped inodes with bigalloc" ); -return -ENOSPC ; +return -EUCLEAN ; } goal =ext4_find_goal (inode, map->m_lblk, partial);
Greg Kroah-Hartman
maintainerPATCH 36/125 ext4: fix reservation release on invalidatepage for delalloc fs
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukas Czerner <[email protected]>
commit 9705acd63b125dee8b15c705216d7186daea4625 upstream.
On delalloc enabled file system on invalidatepage operation in ext4_da_page_release_reservation() we want to clear the delayed buffer and remove the extent covering the delayed buffer from the extent status tree.
However currently there is a bug where on the systems with page size > block size we will always remove extents from the start of the page regardless where the actual delayed buffers are positioned in the page. This leads to the errors like this:
EXT4-fs warning (device loop0): ext4_da_release_space:1225:ext4_da_release_space: ino 13, to_free 1 with only 0 reserved data blocks
This however can cause data loss on writeback time if the file system is in ENOSPC condition because we're releasing reservation for someones else delayed buffer.
Fix this by only removing extents that corresponds to the part of the page we want to invalidate.
This problem is reproducible by the following fio receipt (however I was only able to reproduce it with fio-2.1 or older.
[global]
bs=8k
iodepth=1024
iodepth_batch=60
randrepeat=1
size=1m
directory=/mnt/test
numjobs=20
[job1]
ioengine=sync
bs=1k
direct=1
rw=randread
filename=file1:file2
[job2]
ioengine=libaio
rw=randwrite
direct=1
filename=file1:file2
[job3]
bs=1k
ioengine=posixaio
rw=randwrite
direct=1
filename=file1:file2
[job5]
bs=1k
ioengine=sync
rw=randread
filename=file1:file2
[job7]
ioengine=libaio
rw=randwrite
filename=file1:file2
[job8]
ioengine=posixaio
rw=randwrite
filename=file1:file2
[job10]
ioengine=mmap
rw=randwrite
bs=1k
filename=file1:file2
[job11]
ioengine=mmap
rw=randwrite
direct=1
filename=file1:file2
--- fs/ext4/inode.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-)
fs/ext4/inode.c +12 -3
@@ -1357,7 +1357,7 @@ static void ext4_da_page_release_reservaunsigned int offset, unsigned int length) { - int to_release = 0; + int to_release = 0, contiguous_blks = 0;struct buffer_head *head, *bh;unsigned int curr_off =0 ;struct inode *inode = page->mapping->host;
@@ -1378,14 +1378,23 @@ static void ext4_da_page_release_reservaif ((offset <= curr_off) && (buffer_delay (bh))) { to_release++; + contiguous_blks++;clear_buffer_delay (bh); + }else if (contiguous_blks) { + lblk = page->index << + (PAGE_CACHE_SHIFT - inode->i_blkbits); + lblk += (curr_off >> inode->i_blkbits) - + contiguous_blks; +ext4_es_remove_extent (inode, lblk, contiguous_blks); + contiguous_blks =0 ; } curr_off = next_off; }while ((bh = bh->b_this_page) != head); -if (to_release) { +if (contiguous_blks) { lblk = page->index << (PAGE_CACHE_SHIFT - inode->i_blkbits); -ext4_es_remove_extent (inode, lblk, to_release); + lblk += (curr_off >> inode->i_blkbits) - contiguous_blks; +ext4_es_remove_extent (inode, lblk, contiguous_blks); }/* If we have released all the blocks belonging to a cluster, then we
Greg Kroah-Hartman
maintainerPATCH 37/125 ext4: be more strict when migrating to non-extent based file
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eryu Guan <[email protected]>
commit d6f123a9297496ad0b6335fe881504c4b5b2a5e5 upstream.
Currently the check in ext4_ind_migrate() is not enough before doing the real conversion:
a) delayed allocated extents could bypass the check on eh->eh_entries and eh->eh_depth
This can be demonstrated by this script
xfs_io -fc "pwrite 0 4k" -c "pwrite 8k 4k" /mnt/ext4/testfile chattr -e /mnt/ext4/testfile
where testfile has two extents but still be converted to non-extent based file format.
b) only extent length is checked but not the offset, which would result in data lose (delalloc) or fs corruption (nodelalloc), because non-extent based file only supports at most (12 + 2^10 + 2^20 + 2^30) blocks
This can be demostrated by
xfs_io -fc "pwrite 5T 4k" /mnt/ext4/testfile
chattr -e /mnt/ext4/testfile
sync
If delalloc is enabled, dmesg prints
EXT4-fs warning (device dm-4): ext4_block_to_path:105: block 1342177280 > max in inode 53
EXT4-fs (dm-4): Delayed block allocation failed for inode 53 at logical offset 1342177280 with max blocks 1 with error 5 EXT4-fs (dm-4): This should not happen!! Data will be lost
If delalloc is disabled, e2fsck -nf shows corruption
Inode 53, i_size is 5497558142976, should be 4096. Fix? no
Fix the two issues by
a) forcing all delayed allocation blocks to be allocated before checking eh->eh_depth and eh->eh_entries
b) limiting the last logical block of the extent is within direct map
--- fs/ext4/migrate.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
fs/ext4/migrate.c +11 -1
@@ -616,6 +616,7 @@ int ext4_ind_migrate(struct inode *inodestruct ext4_inode_info *ei =EXT4_I (inode);struct ext4_extent *ex;unsigned int i, len; +ext4_lblk_t end;ext4_fsblk_t blk;handle_t *handle;int ret;
@@ -629,6 +630,14 @@ int ext4_ind_migrate(struct inode *inode EXT4_FEATURE_RO_COMPAT_BIGALLOC))return -EOPNOTSUPP ; +/* +* In order to get correct extent info, force all delayed allocation +* blocks to be allocated, otherwise delayed allocation blocks may not +* be reflected and bypass the checks on extent header. +*/ +if (test_opt (inode->i_sb,DELALLOC )) +ext4_alloc_da_blocks (inode); + handle =ext4_journal_start (inode,EXT4_HT_MIGRATE ,1 );if (IS_ERR (handle))return PTR_ERR (handle);
@@ -650,7 +659,8 @@ int ext4_ind_migrate(struct inode *inodeelse { len =le16_to_cpu (ex->ee_len); blk =ext4_ext_pblock (ex); -if (len >EXT4_NDIR_BLOCKS ) { + end =le32_to_cpu (ex->ee_block) + len -1 ; +if (end >=EXT4_NDIR_BLOCKS ) { ret = -EOPNOTSUPP ; goto errout; }
Greg Kroah-Hartman
maintainerPATCH 38/125 ext4: correctly migrate a file with a hole at the beginning
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eryu Guan <[email protected]>
commit 8974fec7d72e3e02752fe0f27b4c3719c78d9a15 upstream.
Currently ext4_ind_migrate() doesn't correctly handle a file which contains a hole at the beginning of the file. This caused the migration to be done incorrectly, and then if there is a subsequent following delayed allocation write to the "hole", this would reclaim the same data blocks again and results in fs corruption.
# assmuing 4k block size ext4, with delalloc enabled # skip the first block and write to the second block xfs_io -fc "pwrite 4k 4k" -c "fsync" /mnt/ext4/testfile
# converting to indirect-mapped file, which would move the data blocks # to the beginning of the file, but extent status cache still marks # that region as a hole chattr -e /mnt/ext4/testfile
# delayed allocation writes to the "hole", reclaim the same data block # again, results in i_blocks corruption xfs_io -c "pwrite 0 4k" /mnt/ext4/testfile umount /mnt/ext4 e2fsck -nf /dev/sda6 ... Inode 53, i_blocks is 16, should be 8. Fix? no ...
--- fs/ext4/migrate.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
fs/ext4/migrate.c +5 -4
@@ -616,7 +616,7 @@ int ext4_ind_migrate(struct inode *inodestruct ext4_inode_info *ei =EXT4_I (inode);struct ext4_extent *ex;unsigned int i, len; -ext4_lblk_t end; +ext4_lblk_t start, end;ext4_fsblk_t blk;handle_t *handle;int ret;
@@ -655,11 +655,12 @@ int ext4_ind_migrate(struct inode *inode goto errout; }if (eh->eh_entries ==0 ) - blk = len =0 ; + blk = len = start = end =0 ;else { len =le16_to_cpu (ex->ee_len); blk =ext4_ext_pblock (ex); - end =le32_to_cpu (ex->ee_block) + len -1 ; + start =le32_to_cpu (ex->ee_block); + end = start + len -1 ;if (end >=EXT4_NDIR_BLOCKS ) { ret = -EOPNOTSUPP ; goto errout;
@@ -668,7 +669,7 @@ int ext4_ind_migrate(struct inode *inodeext4_clear_inode_flag (inode,EXT4_INODE_EXTENTS );memset (ei->i_data,0 ,sizeof (ei->i_data)); -for (i=0 ; i < len; i++) +for (i = start; i <= end; i++) ei->i_data[i] =cpu_to_le32 (blk++);ext4_mark_inode_dirty (handle, inode); errout:
Greg Kroah-Hartman
maintainerPATCH 39/125 ext4: replace open coded nofail allocation in ext4_free_blocks()
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Hocko <[email protected]>
commit 7444a072c387a93ebee7066e8aee776954ab0e41 upstream.
ext4_free_blocks is looping around the allocation request and mimics __GFP_NOFAIL behavior without any allocation fallback strategy. Let's remove the open coded loop and replace it with __GFP_NOFAIL. Without the flag the allocator has no way to find out never-fail requirement and cannot help in any way.
--- fs/ext4/mballoc.c | 16 +++++----------- 1 file changed, 5 insertions(+), 11 deletions(-)
fs/ext4/mballoc.c +5 -11
@@ -4793,18 +4793,12 @@ do_more:/* * blocks being freed are metadata. these blocks shouldn't * be used until this transaction is committed +* +* We use __GFP_NOFAIL because ext4_free_blocks() is not allowed +* to fail. */ - retry: - new_entry =kmem_cache_alloc (ext4_free_data_cachep,GFP_NOFS ); -if (!new_entry) { -/* -* We use a retry loop because -* ext4_free_blocks() is not allowed to fail. -*/ -cond_resched (); -congestion_wait (BLK_RW_ASYNC ,HZ /50 ); - goto retry; - } + new_entry =kmem_cache_alloc (ext4_free_data_cachep, +GFP_NOFS |__GFP_NOFAIL); new_entry->efd_start_cluster = bit; new_entry->efd_group = block_group; new_entry->efd_count = count_clusters;
Greg Kroah-Hartman
maintainerPATCH 40/125 jbd2: use GFP_NOFS in jbd2_cleanup_journal_tail()
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Monakhov <[email protected]>
commit b4f1afcd068f6e533230dfed00782cd8a907f96b upstream.
jbd2_cleanup_journal_tail() can be invoked by jbd2__journal_start() So allocations should be done with GFP_NOFS
[Full stack trace snipped from 3.10-rh7]
[<ffffffff815c4bd4>] dump_stack+0x19/0x1b [<ffffffff8105dba1>] warn_slowpath_common+0x61/0x80 [<ffffffff8105dcca>] warn_slowpath_null+0x1a/0x20 [<ffffffff815c2142>] slab_pre_alloc_hook.isra.31.part.32+0x15/0x17 [<ffffffff8119c045>] kmem_cache_alloc+0x55/0x210 [<ffffffff811477f5>] ? mempool_alloc_slab+0x15/0x20 [<ffffffff811477f5>] mempool_alloc_slab+0x15/0x20 [<ffffffff81147939>] mempool_alloc+0x69/0x170 [<ffffffff815cb69e>] ? _raw_spin_unlock_irq+0xe/0x20 [<ffffffff8109160d>] ? finish_task_switch+0x5d/0x150 [<ffffffff811f1a8e>] bio_alloc_bioset+0x1be/0x2e0 [<ffffffff8127ee49>] blkdev_issue_flush+0x99/0x120 [<ffffffffa019a733>] jbd2_cleanup_journal_tail+0x93/0xa0 [jbd2] -->GFP_KERNEL [<ffffffffa019aca1>] jbd2_log_do_checkpoint+0x221/0x4a0 [jbd2] [<ffffffffa019afc7>] __jbd2_log_wait_for_space+0xa7/0x1e0 [jbd2] [<ffffffffa01952d8>] start_this_handle+0x2d8/0x550 [jbd2] [<ffffffff811b02a9>] ? __memcg_kmem_put_cache+0x29/0x30 [<ffffffff8119c120>] ? kmem_cache_alloc+0x130/0x210 [<ffffffffa019573a>] jbd2__journal_start+0xba/0x190 [jbd2] [<ffffffff811532ce>] ? lru_cache_add+0xe/0x10 [<ffffffffa01c9549>] ? ext4_da_write_begin+0xf9/0x330 [ext4] [<ffffffffa01f2c77>] __ext4_journal_start_sb+0x77/0x160 [ext4] [<ffffffffa01c9549>] ext4_da_write_begin+0xf9/0x330 [ext4] [<ffffffff811446ec>] generic_file_buffered_write_iter+0x10c/0x270 [<ffffffff81146918>] __generic_file_write_iter+0x178/0x390 [<ffffffff81146c6b>] __generic_file_aio_write+0x8b/0xb0 [<ffffffff81146ced>] generic_file_aio_write+0x5d/0xc0 [<ffffffffa01bf289>] ext4_file_write+0xa9/0x450 [ext4] [<ffffffff811c31d9>] ? pipe_read+0x379/0x4f0 [<ffffffff811b93f0>] do_sync_write+0x90/0xe0 [<ffffffff811b9b6d>] vfs_write+0xbd/0x1e0 [<ffffffff811ba5b8>] SyS_write+0x58/0xb0 [<ffffffff815d4799>] system_call_fastpath+0x16/0x1b
--- fs/jbd2/checkpoint.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/jbd2/checkpoint.c +1 -1
@@ -463,7 +463,7 @@ int jbd2_cleanup_journal_tail(journal_t* jbd2_cleanup_journal_tail() doesn't get called all that often. */ if (journal->j_flags &JBD2_BARRIER ) -blkdev_issue_flush (journal->j_fs_dev,GFP_KERNEL ,NULL ); +blkdev_issue_flush (journal->j_fs_dev,GFP_NOFS ,NULL );__jbd2_update_log_tail (journal, first_tid, blocknr);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 41/125 jbd2: fix ocfs2 corrupt when updating journal superblock fails
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joseph Qi <[email protected]>
commit 6f6a6fda294506dfe0e3e0a253bb2d2923f28f0a upstream.
If updating journal superblock fails after journal data has been flushed, the error is omitted and this will mislead the caller as a normal case. In ocfs2, the checkpoint will be treated successfully and the other node can get the lock to update. Since the sb_start is still pointing to the old log block, it will rewrite the journal data during journal recovery by the other node. Thus the new updates will be overwritten and ocfs2 corrupts. So in above case we have to return the error, and ocfs2_commit_cache will take care of the error and prevent the other node to do update first. And only after recovering journal it can do the new updates.
The issue discussion mail can be found at:
https://oss.oracle.com/pipermail/ocfs2-devel/2015-June/010856.html
http://comments.gmane.org/gmane.comp.file-systems.ext4/48841
[ Fixed bug in patch which allowed a non-negative error return from
jbd2_cleanup_journal_tail() to leak out of jbd2_fjournal_flush(); this was causing xfstests ext4/306 to fail. -- Ted ]
--- fs/jbd2/checkpoint.c | 5 ++--- fs/jbd2/journal.c | 38 +++++++++++++++++++++++++++++++------- include/linux/jbd2.h | 4 ++-- 3 files changed, 35 insertions(+), 12 deletions(-)
fs/jbd2/checkpoint.c +2 -3
@@ -448,7 +448,7 @@ int jbd2_cleanup_journal_tail(journal_tunsigned long blocknr;if (is_journal_aborted (journal)) -return 1 ; +return -EIO ;if (!jbd2_journal_get_log_tail (journal, &first_tid, &blocknr))return 1 ;
@@ -465,8 +465,7 @@ int jbd2_cleanup_journal_tail(journal_tif (journal->j_flags &JBD2_BARRIER )blkdev_issue_flush (journal->j_fs_dev,GFP_NOFS ,NULL ); -__jbd2_update_log_tail (journal, first_tid, blocknr); -return 0 ; +return __jbd2_update_log_tail (journal, first_tid, blocknr); }
fs/jbd2/journal.c +31 -7
@@ -885,9 +885,10 @@ int jbd2_journal_get_log_tail(journal_t* * Requires j_checkpoint_mutex */ -void __jbd2_update_log_tail (journal_t *journal,tid_t tid,unsigned long block) +int __jbd2_update_log_tail (journal_t *journal,tid_t tid,unsigned long block) {unsigned long freed; +int ret;BUG_ON (!mutex_is_locked (&journal->j_checkpoint_mutex));
@@ -897,7 +898,10 @@ void __jbd2_update_log_tail(journal_t *j* space and if we lose sb update during power failure we'd replay * old transaction with possibly newly overwritten data. */ -jbd2_journal_update_sb_log_tail (journal, tid, block,WRITE_FUA ); + ret =jbd2_journal_update_sb_log_tail (journal, tid, block,WRITE_FUA ); +if (ret) + goto out; +write_lock (&journal->j_state_lock); freed = block - journal->j_tail;if (block < journal->j_tail)
@@ -913,6 +917,9 @@ void __jbd2_update_log_tail(journal_t *j journal->j_tail_sequence = tid; journal->j_tail = block;write_unlock (&journal->j_state_lock); + +out: +return ret; }/*
@@ -1331,7 +1338,7 @@ static int journal_reset(journal_t *jourreturn jbd2_journal_start_thread (journal); } -static void jbd2_write_superblock (journal_t *journal,int write_op) +static int jbd2_write_superblock (journal_t *journal,int write_op) {struct buffer_head *bh = journal->j_sb_buffer;journal_superblock_t *sb = journal->j_superblock;
@@ -1370,7 +1377,10 @@ static void jbd2_write_superblock(journaprintk (KERN_ERR "JBD2: Error %d detected when updating " "journal superblock for %s.\n" , ret, journal->j_devname); +jbd2_journal_abort (journal, ret); } + +return ret; }/**
@@ -1383,10 +1393,11 @@ static void jbd2_write_superblock(journa* Update a journal's superblock information about log tail and write it to * disk, waiting for the IO to complete. */ -void jbd2_journal_update_sb_log_tail (journal_t *journal,tid_t tail_tid, +int jbd2_journal_update_sb_log_tail (journal_t *journal,tid_t tail_tid,unsigned long tail_block,int write_op) {journal_superblock_t *sb = journal->j_superblock; +int ret;BUG_ON (!mutex_is_locked (&journal->j_checkpoint_mutex)); jbd_debug(1, "JBD2: updating superblock (start %lu, seq %u)\n",
@@ -1395,13 +1406,18 @@ void jbd2_journal_update_sb_log_tail(jou sb->s_sequence =cpu_to_be32 (tail_tid); sb->s_start =cpu_to_be32 (tail_block); -jbd2_write_superblock (journal, write_op); + ret =jbd2_write_superblock (journal, write_op); +if (ret) + goto out;/* Log is no longer empty */ write_lock (&journal->j_state_lock);WARN_ON (!sb->s_sequence); journal->j_flags &= ~JBD2_FLUSHED ;write_unlock (&journal->j_state_lock); + +out: +return ret; }/**
@@ -1952,7 +1968,14 @@ int jbd2_journal_flush(journal_t *journareturn -EIO ;mutex_lock (&journal->j_checkpoint_mutex); -jbd2_cleanup_journal_tail (journal); +if (!err) { + err =jbd2_cleanup_journal_tail (journal); +if (err <0 ) { +mutex_unlock (&journal->j_checkpoint_mutex); + goto out; + } + err =0 ; + }/* Finally, mark the journal as really needing no recovery. * This sets s_start==0 in the underlying superblock, which is
@@ -1968,7 +1991,8 @@ int jbd2_journal_flush(journal_t *journaJ_ASSERT (journal->j_head == journal->j_tail);J_ASSERT (journal->j_tail_sequence == journal->j_transaction_sequence);write_unlock (&journal->j_state_lock); -return 0 ; +out: +return err; }/**
include/linux/jbd2.h +2 -2
@@ -1035,7 +1035,7 @@ struct buffer_head *jbd2_journal_get_desint jbd2_journal_next_log_block (journal_t *,unsigned long long *);int jbd2_journal_get_log_tail (journal_t *journal,tid_t *tid,unsigned long *block); -void __jbd2_update_log_tail (journal_t *journal,tid_t tid,unsigned long block); +int __jbd2_update_log_tail (journal_t *journal,tid_t tid,unsigned long block);void jbd2_update_log_tail (journal_t *journal,tid_t tid,unsigned long block);/* Commit management */
@@ -1157,7 +1157,7 @@ extern int jbd2_journal_recover (jextern int jbd2_journal_wipe (journal_t *,int );extern int jbd2_journal_skip_recovery (journal_t *);extern void jbd2_journal_update_sb_errno (journal_t *); -extern void jbd2_journal_update_sb_log_tail (journal_t *,tid_t , +extern int jbd2_journal_update_sb_log_tail (journal_t *,tid_t ,unsigned long ,int );extern void __jbd2_journal_abort_hard (journal_t *);extern void jbd2_journal_abort (journal_t *,int );
Greg Kroah-Hartman
maintainerPATCH 42/125 i2c: at91: fix a race condition when using the DMA controller
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cyrille Pitchen <[email protected]>
commit 93563a6a71bb69dd324fc7354c60fb05f84aae6b upstream.
For TX transactions, the TXCOMP bit in the Status Register is cleared when the first data is written into the Transmit Holding Register.
In the lines from at91_do_twi_transfer():at91_twi_write_data_dma(dev); at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_TXCOMP);
the TXCOMP interrupt may be enabled before the DMA controller has actually started to write into the THR. In such a case, the TXCOMP bit is still set into the Status Register so the interrupt is triggered immediately. The driver understands that a transaction completion has occurred but this transaction hasn't started yet. Hence the TXCOMP interrupt is no longer enabled by at91_do_twi_transfer() but instead by at91_twi_write_data_dma_callback().
Also, the TXCOMP bit in the Status Register in not a clear on read flag but a snapshot of the transmission state at the time the Status Register is read.
When a NACK error is dectected by the I2C controller, the TXCOMP, NACK and TXRDY bits are set together to 1 in the SR. If enabled, the TXCOMP interrupt is triggered at the same time. Also setting the TXRDY to 1 triggers the DMA controller to write the next data into the THR. Such a write resets the TXCOMP bit to 0 in the SR. So depending on when the interrupt handler reads the SR, it may fail to detect the NACK error if it relies on the TXCOMP bit. The NACK bit and its interrupt should be used instead.
For RX transactions, the TXCOMP bit in the Status Register is cleared when the START bit is set into the Control Register. However to unify the management of the TXCOMP bit when the DMA controller is used, the TXCOMP interrupt is now enabled by the DMA callbacks for both TX and RX transfers.
--- drivers/i2c/busses/i2c-at91.c | 70 +++++++++++++++++++++++++++++++----------- 1 file changed, 53 insertions(+), 17 deletions(-)
drivers/i2c/busses/i2c-at91.c +53 -17
@@ -62,6 +62,9 @@#define AT91_TWI_UNRE 0x0080/* Underrun Error */ #define AT91_TWI_NACK 0x0100/* Not Acknowledged */ +#define AT91_TWI_INT_MASK \ + (AT91_TWI_TXCOMP | AT91_TWI_RXRDY | AT91_TWI_TXRDY | AT91_TWI_NACK) +#define AT91_TWI_IER 0x0024/* Interrupt Enable Register */ #define AT91_TWI_IDR 0x0028/* Interrupt Disable Register */ #define AT91_TWI_IMR 0x002c/* Interrupt Mask Register */
@@ -117,13 +120,12 @@ static void at91_twi_write(struct at91_tstatic void at91_disable_twi_interrupts (struct at91_twi_dev *dev) { -at91_twi_write (dev,AT91_TWI_IDR , -AT91_TWI_TXCOMP |AT91_TWI_RXRDY |AT91_TWI_TXRDY ); +at91_twi_write (dev,AT91_TWI_IDR ,AT91_TWI_INT_MASK ); }static void at91_twi_irq_save (struct at91_twi_dev *dev) { - dev->imr =at91_twi_read (dev,AT91_TWI_IMR ) &0x7 ; + dev->imr =at91_twi_read (dev,AT91_TWI_IMR ) &AT91_TWI_INT_MASK ;at91_disable_twi_interrupts (dev); }
@@ -213,6 +215,14 @@ static void at91_twi_write_data_dma_calldma_unmap_single (dev->dev,sg_dma_address (&dev->dma.sg), dev->buf_len,DMA_TO_DEVICE ); +/* +* When this callback is called, THR/TX FIFO is likely not to be empty +* yet. So we have to wait for TXCOMP or NACK bits to be set into the +* Status Register to be sure that the STOP bit has been sent and the +* transfer is completed. The NACK interrupt has already been enabled, +* we just have to enable TXCOMP one. +*/ +at91_twi_write (dev,AT91_TWI_IER ,AT91_TWI_TXCOMP );at91_twi_write (dev,AT91_TWI_CR ,AT91_TWI_STOP ); }
@@ -307,7 +317,7 @@ static void at91_twi_read_data_dma_callb/* The last two bytes have to be read without using dma */ dev->buf += dev->buf_len -2 ; dev->buf_len =2 ; -at91_twi_write (dev,AT91_TWI_IER ,AT91_TWI_RXRDY ); +at91_twi_write (dev,AT91_TWI_IER ,AT91_TWI_RXRDY |AT91_TWI_TXCOMP ); }static void at91_twi_read_data_dma (struct at91_twi_dev *dev)
@@ -368,7 +378,7 @@ static irqreturn_t atmel_twi_interrupt(i/* catch error flags */ dev->transfer_status |= status; -if (irqstatus &AT91_TWI_TXCOMP ) { +if (irqstatus & (AT91_TWI_TXCOMP |AT91_TWI_NACK )) {at91_disable_twi_interrupts (dev);complete (&dev->cmd_complete); }
@@ -381,6 +391,34 @@ static int at91_do_twi_transfer(struct aint ret;bool has_unre_flag = dev->pdata->has_unre_flag; +/* +* WARNING: the TXCOMP bit in the Status Register is NOT a clear on +* read flag but shows the state of the transmission at the time the +* Status Register is read. According to the programmer datasheet, +* TXCOMP is set when both holding register and internal shifter are +* empty and STOP condition has been sent. +* Consequently, we should enable NACK interrupt rather than TXCOMP to +* detect transmission failure. +* +* Besides, the TXCOMP bit is already set before the i2c transaction +* has been started. For read transactions, this bit is cleared when +* writing the START bit into the Control Register. So the +* corresponding interrupt can safely be enabled just after. +* However for write transactions managed by the CPU, we first write +* into THR, so TXCOMP is cleared. Then we can safely enable TXCOMP +* interrupt. If TXCOMP interrupt were enabled before writing into THR, +* the interrupt handler would be called immediately and the i2c command +* would be reported as completed. +* Also when a write transaction is managed by the DMA controller, +* enabling the TXCOMP interrupt in this function may lead to a race +* condition since we don't know whether the TXCOMP interrupt is enabled +* before or after the DMA has started to write into THR. So the TXCOMP +* interrupt is enabled later by at91_twi_write_data_dma_callback(). +* Immediately after in that DMA callback, we still need to send the +* STOP condition manually writing the corresponding bit into the +* Control Register. +*/ +dev_dbg (dev->dev,"transfer: %s %d bytes.\n" , (dev->msg->flags &I2C_M_RD ) ?"read" :"write" , dev->buf_len);
@@ -411,26 +449,24 @@ static int at91_do_twi_transfer(struct a* seems to be the best solution. */ if (dev->use_dma && (dev->buf_len >AT91_I2C_DMA_THRESHOLD )) { +at91_twi_write (dev,AT91_TWI_IER ,AT91_TWI_NACK );at91_twi_read_data_dma (dev); -/* -* It is important to enable TXCOMP irq here because -* doing it only when transferring the last two bytes -* will mask NACK errors since TXCOMP is set when a -* NACK occurs. -*/ -at91_twi_write (dev,AT91_TWI_IER , -AT91_TWI_TXCOMP ); - }else + }else {at91_twi_write (dev,AT91_TWI_IER , -AT91_TWI_TXCOMP |AT91_TWI_RXRDY ); +AT91_TWI_TXCOMP | +AT91_TWI_NACK | +AT91_TWI_RXRDY ); + } }else {if (dev->use_dma && (dev->buf_len >AT91_I2C_DMA_THRESHOLD )) { +at91_twi_write (dev,AT91_TWI_IER ,AT91_TWI_NACK );at91_twi_write_data_dma (dev); -at91_twi_write (dev,AT91_TWI_IER ,AT91_TWI_TXCOMP ); }else {at91_twi_write_next_byte (dev);at91_twi_write (dev,AT91_TWI_IER , -AT91_TWI_TXCOMP |AT91_TWI_TXRDY ); +AT91_TWI_TXCOMP | +AT91_TWI_NACK | +AT91_TWI_TXRDY ); } }
Greg Kroah-Hartman
maintainerPATCH 43/125 iio: DAC: ad5624r_spi: fix bit shift of output data value
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: JM Friedt <[email protected]>
commit adfa969850ae93beca57f7527f0e4dc10cbe1309 upstream.
The value sent on the SPI bus is shifted by an erroneous number of bits. The shift value was already computed in the iio_chan_spec structure and hence subtracting this argument to 16 yields an erroneous data position in the SPI stream.
--- drivers/iio/dac/ad5624r_spi.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/iio/dac/ad5624r_spi.c +2 -2
@@ -22,7 +22,7 @@#include "ad5624r.h" static int ad5624r_spi_write (struct spi_device *spi, -u8 cmd,u8 addr,u16 val,u8 len) +u8 cmd,u8 addr,u16 val,u8 shift) {u32 data;u8 msg[3 ];
@@ -35,7 +35,7 @@ static int ad5624r_spi_write(struct spi_* 14-, 12-bit input code followed by 0, 2, or 4 don't care bits, * for the AD5664R, AD5644R, and AD5624R, respectively. */ - data = (0 <<22 ) | (cmd <<19 ) | (addr <<16 ) | (val << (16 - len)); + data = (0 <<22 ) | (cmd <<19 ) | (addr <<16 ) | (val << shift); msg[0 ] = data >>16 ; msg[1 ] = data >>8 ; msg[2 ] = data;
Greg Kroah-Hartman
maintainerPATCH 44/125 iio: tmp006: Check channel info on write
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Meerwald <[email protected]>
commit 8d05abfaeff52bdf66aba3a3a337dcdbdb4911bf upstream.
only SAMP_FREQ is writable
Will lead to SAMP_FREQ being written by any attempt to write to the other exported attributes and hence a rather unexpected result!
--- drivers/iio/temperature/tmp006.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/iio/temperature/tmp006.c +3 -0
@@ -132,6 +132,9 @@ static int tmp006_write_raw(struct iio_dstruct tmp006_data *data =iio_priv (indio_dev);int i; +if (mask !=IIO_CHAN_INFO_SAMP_FREQ ) +return -EINVAL ; +for (i =0 ; i <ARRAY_SIZE (tmp006_freqs); i++)if ((val == tmp006_freqs[i][0 ]) && (val2 == tmp006_freqs[i][1 ])) {
Greg Kroah-Hartman
maintainerPATCH 45/125 iio: adc: at91_adc: allow to use full range of startup time
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Leupold <[email protected]>
commit 2ab5f39bc7825808e0fa1e7e5f0b23e174563467 upstream.
The DT-Property "atmel,adc-startup-time" is stored in an u8 for a microsecond value. When trying to increase the value of STARTUP in Register AT91_ADC_MR some higher values can't be reached.
Change the type in function parameter and private structure field from u8 to u32.
--- drivers/iio/adc/at91_adc.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/iio/adc/at91_adc.c +4 -4
@@ -58,7 +58,7 @@ struct at91_adc_caps {u8 ts_pen_detect_sensitivity;/* startup time calculate function */ -u32 (*calc_startup_ticks)(u8 startup_time,u32 adc_clk_khz); +u32 (*calc_startup_ticks)(u32 startup_time,u32 adc_clk_khz);u8 num_channels;struct at91_adc_reg_desc registers;
@@ -82,7 +82,7 @@ struct at91_adc_state {u8 num_channels;void __iomem *reg_base;struct at91_adc_reg_desc *registers; -u8 startup_time; +u32 startup_time;u8 sample_hold_time;bool sleep_mode;struct iio_trigger **trig;
@@ -590,7 +590,7 @@ ret:return ret; } -static u32 calc_startup_ticks_9260 (u8 startup_time,u32 adc_clk_khz) +static u32 calc_startup_ticks_9260 (u32 startup_time,u32 adc_clk_khz) {/* * Number of ticks needed to cover the startup time of the ADC
@@ -601,7 +601,7 @@ static u32 calc_startup_ticks_9260(u8 streturn round_up ((startup_time * adc_clk_khz /1000 ) -1 ,8 ) /8 ; } -static u32 calc_startup_ticks_9x5 (u8 startup_time,u32 adc_clk_khz) +static u32 calc_startup_ticks_9x5 (u32 startup_time,u32 adc_clk_khz) {/* * For sama5d3x and at91sam9x5, the formula changes to:
Greg Kroah-Hartman
maintainerPATCH 46/125 cx24117: fix a buffer overflow when checking userspace params
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mauro Carvalho Chehab <[email protected]>
commit 82e3b88b679049f043fe9b03991d6d66fc0a43c8 upstream.
The maximum size for a DiSEqC command is 6, according to the userspace API. However, the code allows to write up much more values:
drivers/media/dvb-frontends/cx24116.c:983 cx24116_send_diseqc_msg() error: buffer overflow 'd->msg' 6 <= 23
--- drivers/media/dvb-frontends/cx24117.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/dvb-frontends/cx24117.c +1 -1
@@ -1043,7 +1043,7 @@ static int cx24117_send_diseqc_msg(strucdev_dbg (&state->priv->i2c->dev,")\n" );/* Validate length */ -if (d->msg_len >15 ) +if (d->msg_len >sizeof (d->msg))return -EINVAL ;/* DiSEqC message */
Greg Kroah-Hartman
maintainerPATCH 47/125 af9013: Dont accept invalid bandwidth
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mauro Carvalho Chehab <[email protected]>
commit d7b76c91f471413de9ded837bddeca2164786571 upstream.
If userspace sends an invalid bandwidth, it should either return EINVAL or switch to auto mode.
This driver will go past an array and program the hardware on a wrong way if this happens.
--- drivers/media/dvb-frontends/af9013.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/media/dvb-frontends/af9013.c +4 -0
@@ -606,6 +606,10 @@ static int af9013_set_frontend(struct dv } } +/* Return an error if can't find bandwidth or the right clock */ +if (i ==ARRAY_SIZE (coeff_lut)) +return -EINVAL ; + ret =af9013_wr_regs (state,0xae00 , coeff_lut[i].val,sizeof (coeff_lut[i].val)); }
Greg Kroah-Hartman
maintainerPATCH 48/125 s5h1420: fix a buffer overflow when checking userspace params
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mauro Carvalho Chehab <[email protected]>
commit 12f4543f5d6811f864e6c4952eb27253c7466c02 upstream.
The maximum size for a DiSEqC command is 6, according to the userspace API. However, the code allows to write up to 7 values:
drivers/media/dvb-frontends/s5h1420.c:193 s5h1420_send_master_cmd() error: buffer overflow 'cmd->msg' 6 <= 7
--- drivers/media/dvb-frontends/s5h1420.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/dvb-frontends/s5h1420.c +1 -1
@@ -180,7 +180,7 @@ static int s5h1420_send_master_cmd (struint result =0 ;dprintk ("enter %s\n" , __func__); -if (cmd->msg_len >8 ) +if (cmd->msg_len >sizeof (cmd->msg))return -EINVAL ;/* setup for DISEQC */
Greg Kroah-Hartman
maintainerPATCH 49/125 cx24116: fix a buffer overflow when checking userspace params
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mauro Carvalho Chehab <[email protected]>
commit 1fa2337a315a2448c5434f41e00d56b01a22283c upstream.
The maximum size for a DiSEqC command is 6, according to the userspace API. However, the code allows to write up much more values:
drivers/media/dvb-frontends/cx24116.c:983 cx24116_send_diseqc_msg() error: buffer overflow 'd->msg' 6 <= 23
--- drivers/media/dvb-frontends/cx24116.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/media/dvb-frontends/cx24116.c +4 -4
@@ -963,6 +963,10 @@ static int cx24116_send_diseqc_msg(strucstruct cx24116_state *state = fe->demodulator_priv;int i, ret; +/* Validate length */ +if (d->msg_len >sizeof (d->msg)) +return -EINVAL ; +/* Dump DiSEqC message */ if (debug) {printk (KERN_INFO "cx24116: %s(" , __func__);
@@ -974,10 +978,6 @@ static int cx24116_send_diseqc_msg(strucprintk (") toneburst=%d\n" , toneburst); } -/* Validate length */ -if (d->msg_len > (CX24116_ARGLEN -CX24116_DISEQC_MSGOFS )) -return -EINVAL ; -/* DiSEqC message */ for (i =0 ; i < d->msg_len; i++) state->dsec_cmd.args[CX24116_DISEQC_MSGOFS + i] = d->msg[i];
Greg Kroah-Hartman
maintainerPATCH 50/125 ASoC: arizona: Fix noise generator gain TLV
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Fitzgerald <[email protected]>
commit 15575ed544910464715df5c45a44b9732e415b93 upstream.
The Arizona codec drivers had an incorrect dB scaling for the noise generator gain that started at 0dB and went upwards. Actually the highest setting is 0dB.
--- sound/soc/codecs/wm5102.c | 2 +- sound/soc/codecs/wm5110.c | 2 +- sound/soc/codecs/wm8997.c | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-)
sound/soc/codecs/wm5102.c +1 -1
@@ -41,7 +41,7 @@ struct wm5102_priv { static DECLARE_TLV_DB_SCALE(ana_tlv, 0, 100, 0); static DECLARE_TLV_DB_SCALE(eq_tlv, -1200, 100, 0); static DECLARE_TLV_DB_SCALE(digital_tlv, -6400, 50, 0); -static DECLARE_TLV_DB_SCALE(noise_tlv, 0, 600, 0); +static DECLARE_TLV_DB_SCALE(noise_tlv, -13200, 600, 0); static DECLARE_TLV_DB_SCALE(ng_tlv, -10200, 600, 0);static const struct wm_adsp_region wm5102_dsp1_regions[] = {
sound/soc/codecs/wm5110.c +1 -1
@@ -167,7 +167,7 @@ static int wm5110_sysclk_ev(struct snd_s static DECLARE_TLV_DB_SCALE(ana_tlv, 0, 100, 0); static DECLARE_TLV_DB_SCALE(eq_tlv, -1200, 100, 0); static DECLARE_TLV_DB_SCALE(digital_tlv, -6400, 50, 0); -static DECLARE_TLV_DB_SCALE(noise_tlv, 0, 600, 0); +static DECLARE_TLV_DB_SCALE(noise_tlv, -13200, 600, 0); static DECLARE_TLV_DB_SCALE(ng_tlv, -10200, 600, 0);#define WM5110_NG_SRC (name, base) \
sound/soc/codecs/wm8997.c +1 -1
@@ -40,7 +40,7 @@ struct wm8997_priv { static DECLARE_TLV_DB_SCALE(ana_tlv, 0, 100, 0); static DECLARE_TLV_DB_SCALE(eq_tlv, -1200, 100, 0); static DECLARE_TLV_DB_SCALE(digital_tlv, -6400, 50, 0); -static DECLARE_TLV_DB_SCALE(noise_tlv, 0, 600, 0); +static DECLARE_TLV_DB_SCALE(noise_tlv, -13200, 600, 0); static DECLARE_TLV_DB_SCALE(ng_tlv, -10200, 600, 0);static const struct reg_default wm8997_sysclk_reva_patch[] = {
Greg Kroah-Hartman
maintainerPATCH 51/125 ASoC: imx-wm8962: Add a missing error check
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
commit 474ff0ae23b834e9fc18374d14bb5f3e7b3828b4 upstream.
My static checker complains that:
sound/soc/fsl/imx-wm8962.c:196 imx_wm8962_probe() warn: we tested 'ret' before and it was 'false'
The intent was that we use "ret" to check imx_audmux_v2_configure_port().
Otherwise, Acked-by: Nicolin Chen <[email protected]>
--- sound/soc/fsl/imx-wm8962.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/fsl/imx-wm8962.c +1 -1
@@ -190,7 +190,7 @@ static int imx_wm8962_probe(struct platfdev_err (&pdev->dev,"audmux internal port setup failed\n" );return ret; } -imx_audmux_v2_configure_port (ext_port, + ret =imx_audmux_v2_configure_port (ext_port,IMX_AUDMUX_V2_PTCR_SYN ,IMX_AUDMUX_V2_PDCR_RXDSEL (int_port));if (ret) {
Greg Kroah-Hartman
maintainerPATCH 53/125 ASoC: wm8955: Fix setting wrong register for WM8955_K_8_0_MASK bits
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Axel Lin <[email protected]>
commit 12c350050538c7dc779c083b7342bfd20f74949c upstream.
WM8955_K_8_0_MASK bits is controlled by WM8955_PLL_CONTROL_3 rather than WM8955_PLL_CONTROL_2.
--- sound/soc/codecs/wm8955.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/codecs/wm8955.c +1 -1
@@ -298,7 +298,7 @@ static int wm8955_configure_clocking(strsnd_soc_update_bits (codec,WM8955_PLL_CONTROL_2 ,WM8955_K_17_9_MASK , (pll.k >>9 ) &WM8955_K_17_9_MASK ); -snd_soc_update_bits (codec,WM8955_PLL_CONTROL_2 , +snd_soc_update_bits (codec,WM8955_PLL_CONTROL_3 ,WM8955_K_8_0_MASK , pll.k &WM8955_K_8_0_MASK );if (pll.k)
Greg Kroah-Hartman
maintainerPATCH 55/125 ASoC: wm8960: the enum of "DAC Polarity" should be wm8960_enum[1]
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zidan Wang <[email protected]>
commit a077e81ec61e07a7f86997d045109f06719fbffe upstream.
the enum of "DAC Polarity" should be wm8960_enum[1].
--- sound/soc/codecs/wm8960.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/codecs/wm8960.c +1 -1
@@ -242,7 +242,7 @@ SOC_SINGLE("PCM Playback -6dB Switch", WSOC_ENUM ("ADC Polarity" , wm8960_enum[0 ]),SOC_SINGLE ("ADC High Pass Filter Switch" ,WM8960_DACCTL1 ,0 ,1 ,0 ), -SOC_ENUM ("DAC Polarity" , wm8960_enum[2 ]), +SOC_ENUM ("DAC Polarity" , wm8960_enum[1 ]),SOC_SINGLE_BOOL_EXT ("DAC Deemphasis Switch" ,0 , wm8960_get_deemph, wm8960_put_deemph),
Greg Kroah-Hartman
maintainerPATCH 56/125 libata: add ATA_HORKAGE_BROKEN_FPDMA_AA quirk for HP 250GB SATA disk VB0250EAVER
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksei Mamlin <[email protected]>
commit 08c85d2a599d967ede38a847f5594447b6100642 upstream.
Enabling AA on HP 250GB SATA disk VB0250EAVER causes errors:
[ 3.788362] ata3.00: failed to enable AA (error_mask=0x1) [ 3.789243] ata3.00: failed to enable AA (error_mask=0x1)
Add the ATA_HORKAGE_BROKEN_FPDMA_AA for this specific harddisk.
tj: Collected FPDMA_AA entries and updated comment.
--- drivers/ata/libata-core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/ata/libata-core.c +2 -1
@@ -4173,9 +4173,10 @@ static const struct ata_blacklist_entry {"ST3320[68]13AS" ,"SD1[5-9]" ,ATA_HORKAGE_NONCQ | ATA_HORKAGE_FIRMWARE_WARN }, -/* Seagate Momentus SpinPoint M8 seem to have FPMDA_AA issues */ +/* drives which fail FPDMA_AA activation (some may freeze afterwards) */ { "ST1000LM024 HN-M101MBB", "2AR10001", ATA_HORKAGE_BROKEN_FPDMA_AA }, { "ST1000LM024 HN-M101MBB", "2BA30001", ATA_HORKAGE_BROKEN_FPDMA_AA }, + { "VB0250EAVER", "HPG7", ATA_HORKAGE_BROKEN_FPDMA_AA },/* Blacklist entries taken from Silicon Image 3124/3132 Windows driver .inf file - also several Linux problem reports */
Greg Kroah-Hartman
maintainerPATCH 57/125 libata: increase the timeout when setting transfer mode
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <[email protected]>
commit d531be2ca2f27cca5f041b6a140504999144a617 upstream.
I have a ST4000DM000 disk. If Linux is booted while the disk is spun down, the command that sets transfer mode causes the disk to spin up. The spin-up takes longer than the default 5s timeout, so the command fails and timeout is reported.
Fix this by increasing the timeout to 15s, which is enough for the disk to spin up.
--- drivers/ata/libata-core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/ata/libata-core.c +2 -1
@@ -4534,7 +4534,8 @@ static unsigned int ata_dev_set_xfermodeelse /* In the ancient relic department - skip all of this */ return 0 ; - err_mask =ata_exec_internal (dev, &tf,NULL ,DMA_NONE ,NULL ,0 ,0 ); +/* On some disks, this command causes spin-up, so we need longer timeout */ + err_mask =ata_exec_internal (dev, &tf,NULL ,DMA_NONE ,NULL ,0 ,15000 );DPRINTK ("EXIT, err_mask=%x\n" , err_mask);return err_mask;
Greg Kroah-Hartman
maintainerPATCH 58/125 usb: dwc3: gadget: return error if command sent to DGCMD register fails
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Subbaraya Sundeep Bhatta <[email protected]>
commit 891b1dc022955d36cf4c0f42d383226a930db7ed upstream.
We need to return error to caller if command is not sent to controller succesfully.
--- drivers/usb/dwc3/gadget.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/dwc3/gadget.c +2 -0
@@ -299,6 +299,8 @@ int dwc3_send_gadget_generic_command(strif (!(reg &DWC3_DGCMD_CMDACT )) {dev_vdbg (dwc->dev,"Command Complete --> %d\n" ,DWC3_DGCMD_STATUS (reg)); +if (DWC3_DGCMD_STATUS (reg)) +return -EINVAL ;return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 59/125 usb: dwc3: gadget: return error if command sent to DEPCMD register fails
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Subbaraya Sundeep Bhatta <[email protected]>
commit 76e838c9f7765f9a6205b4d558d75a66104bc60d upstream.
We need to return error to caller if command is not sent to controller succesfully.
--- drivers/usb/dwc3/gadget.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/dwc3/gadget.c +2 -0
@@ -337,6 +337,8 @@ int dwc3_send_gadget_ep_cmd(struct dwc3if (!(reg &DWC3_DEPCMD_CMDACT )) {dev_vdbg (dwc->dev,"Command Complete --> %d\n" ,DWC3_DEPCMD_STATUS (reg)); +if (DWC3_DEPCMD_STATUS (reg)) +return -EINVAL ;return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 60/125 usb: dwc3: Reset the transfer resource index on SET_INTERFACE
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Youn <[email protected]>
commit aebda618718157a69c0dc0adb978d69bc2b8723c upstream.
This fixes an issue introduced in commit b23c843992b6 (usb: dwc3:
gadget: fix DEPSTARTCFG for non-EP0 EPs) that made sure we would only use DEPSTARTCFG once per SetConfig.
The trick is that we should use one DEPSTARTCFG per SetConfig *OR* SetInterface. SetInterface was completely missed from the original patch.
This problem became aparent after commit 76e838c9f776 (usb: dwc3:
gadget: return error if command sent to DEPCMD register fails) added checking of the return status of device endpoint commands.
'Set Endpoint Transfer Resource' command was caught failing occasionally. This is because the Transfer Resource Index was not getting reset during a SET_INTERFACE request.
Finally, to fix the issue, was we have to do is make sure that our start_config_issued flag gets reset whenever we receive a SetInterface request.
To verify the problem (and its fix), all we have to do is run test 9 from testusb with 'testusb -t 9 -s 2048 -a -c 5000'.
--- drivers/usb/dwc3/ep0.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/usb/dwc3/ep0.c +4 -0
@@ -707,6 +707,10 @@ static int dwc3_ep0_std_request(struct ddev_vdbg (dwc->dev,"USB_REQ_SET_ISOCH_DELAY\n" ); ret =dwc3_ep0_set_isoch_delay (dwc, ctrl);break ; +case USB_REQ_SET_INTERFACE : +dev_vdbg (dwc->dev,"USB_REQ_SET_INTERFACE\n" ); + dwc->start_config_issued = false; +/* Fall through */ default :dev_vdbg (dwc->dev,"Forwarding to gadget driver\n" ); ret =dwc3_ep0_delegate_req (dwc, ctrl);
Greg Kroah-Hartman
maintainerPATCH 61/125 USB: devio: fix a condition in async_completed()
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
commit 83ed07c5db71bc02bd646d6eb60b48908235cdf9 upstream.
Static checkers complain that the current condition is never true. It seems pretty likely that it's a typo and "URB" was intended instead of "USB".
--- drivers/usb/core/devio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/core/devio.c +1 -1
@@ -513,7 +513,7 @@ static void async_completed(struct urb *snoop (&urb->dev->dev,"urb complete\n" );snoop_urb (urb->dev, as->userurb, urb->pipe, urb->actual_length, as->status,COMPLETE ,NULL ,0 ); -if ((urb->transfer_flags &URB_DIR_MASK ) ==USB_DIR_IN ) +if ((urb->transfer_flags &URB_DIR_MASK ) ==URB_DIR_IN )snoop_urb_data (urb, urb->actual_length); if (as->status < 0 && as->bulk_addr && as->status != -ECONNRESET &&
Greg Kroah-Hartman
maintainerPATCH 62/125 usb: musb: host: rely on port_mode to call musb_start()
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felipe Balbi <[email protected]>
commit be9d39881fc4fa39a64b6eed6bab5d9ee5125344 upstream.
Currently, we're calling musb_start() twice for DRD ports in some situations. This has been observed to cause enumeration issues after suspend/resume cycles with AM335x.
In order to fix the problem, we just have to fix the check on musb_has_gadget() so that it only returns true if current mode is Host and ignore the fact that we have or not a gadget driver loaded.
--- drivers/usb/musb/musb_virthub.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/usb/musb/musb_virthub.c +1 -3
@@ -273,9 +273,7 @@ static int musb_has_gadget(struct musb *#ifdef CONFIG_USB_MUSB_HOST return 1 ;#else -if (musb->port_mode ==MUSB_PORT_MODE_HOST ) -return 1 ; -return musb->g.dev.driver !=NULL ; +return musb->port_mode ==MUSB_PORT_MODE_HOST ;#endif }
Greg Kroah-Hartman
maintainerPATCH 63/125 USB: cp210x: add ID for Aruba Networks controllers
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Sanford <[email protected]>
commit f98a7aa81eeeadcad25665c3501c236d531d4382 upstream.
Add the USB serial console device ID for Aruba Networks 7xxx series controllers which have a USB port for their serial console.
--- drivers/usb/serial/cp210x.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/serial/cp210x.c +1 -0
@@ -187,6 +187,7 @@ static const struct usb_device_id id_tab { USB_DEVICE(0x1FB9, 0x0602) }, /* Lake Shore Model 648 Magnet Power Supply */ { USB_DEVICE(0x1FB9, 0x0700) }, /* Lake Shore Model 737 VSM Controller */ { USB_DEVICE(0x1FB9, 0x0701) }, /* Lake Shore Model 776 Hall Matrix */ + { USB_DEVICE(0x2626, 0xEA60) }, /* Aruba Networks 7xxx USB Serial Console */ { USB_DEVICE(0x3195, 0xF190) }, /* Link Instruments MSO-19 */ { USB_DEVICE(0x3195, 0xF280) }, /* Link Instruments MSO-28 */ { USB_DEVICE(0x3195, 0xF281) }, /* Link Instruments MSO-28 */
Greg Kroah-Hartman
maintainerPATCH 64/125 USB: option: add 2020:4000 ID
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudio Cappelli <[email protected]>
commit f6d7fb37f92622479ef6da604f27561f5045ba1e upstream.
Add device Olivetti Olicard 300 (Network Connect: MT6225) - IDs 2020:4000.
T: Bus=01 Lev=02 Prnt=04 Port=00 Cnt=01 Dev#= 10 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=2020 ProdID=4000 Rev=03.00 S: Manufacturer=Network Connect S: Product=MT6225 C: #Ifs= 7 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=02 Prot=01 Driver=option I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#= 6 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage
--- drivers/usb/serial/option.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/serial/option.c +1 -0
@@ -1755,6 +1755,7 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x00, 0x00) }, { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */ + { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /* OLICARD300 - MT6225 */ { USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) }, { USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) }, { } /* Terminating entry */
Greg Kroah-Hartman
maintainerPATCH 65/125 USB: serial: Destroy serial_minors IDR on module exit
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Thumshirn <[email protected]>
commit d23f47d4927fd2f61b3a754d83c7bcec215b5cfe upstream.
Destroy serial_minors IDR on module exit, reclaiming the allocated memory.
This was detected by the following semantic patch (written by Luis Rodriguez <[email protected]>)
<SmPL>
@ defines_module_init @
declarer name module_init, module_exit;
declarer name DEFINE_IDR;
identifier init;
@@
module_init(init);
@ defines_module_exit @
identifier exit;
@@
module_exit(exit);
@ declares_idr depends on defines_module_init && defines_module_exit @ identifier idr;
@@
DEFINE_IDR(idr);
@ on_exit_calls_destroy depends on declares_idr && defines_module_exit @ identifier declares_idr.idr, defines_module_exit.exit;
@@
exit(void)
{
...
idr_destroy(&idr);
...
}
@ missing_module_idr_destroy depends on declares_idr && defines_module_exit && !on_exit_calls_destroy @ identifier declares_idr.idr, defines_module_exit.exit;
@@
exit(void)
{
...
+idr_destroy(&idr);
}
</SmPL>
--- drivers/usb/serial/usb-serial.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/serial/usb-serial.c +1 -0
@@ -1300,6 +1300,7 @@ static void __exit usb_serial_exit(void)tty_unregister_driver (usb_serial_tty_driver);put_tty_driver (usb_serial_tty_driver);bus_unregister (&usb_serial_bus_type); +idr_destroy (&serial_minors); }
Greg Kroah-Hartman
maintainerPATCH 66/125 usb: xhci: Bugfix for NULL pointer deference in xhci_endpoint_init() function
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: AMAN DEEP <[email protected]>
commit 3496810663922617d4b706ef2780c279252ddd6a upstream.
virt_dev->num_cached_rings counts on freed ring and is not updated correctly. In xhci_free_or_cache_endpoint_ring() function, the free ring is added into cache and then num_rings_cache is incremented as below:
virt_dev->ring_cache[rings_cached] = virt_dev->eps[ep_index].ring; virt_dev->num_rings_cached++;
here, free ring pointer is added to a current index and then index is incremented.
So current index always points to empty location in the ring cache. For getting available free ring, current index should be decremented first and then corresponding ring buffer value should be taken from ring cache.
But In function xhci_endpoint_init(), the num_rings_cached index is accessed before decrement.
virt_dev->eps[ep_index].new_ring = virt_dev->ring_cache[virt_dev->num_rings_cached]; virt_dev->ring_cache[virt_dev->num_rings_cached] = NULL; virt_dev->num_rings_cached--; This is bug in manipulating the index of ring cache. And it should be as below: virt_dev->num_rings_cached--; virt_dev->eps[ep_index].new_ring = virt_dev->ring_cache[virt_dev->num_rings_cached]; virt_dev->ring_cache[virt_dev->num_rings_cached] = NULL;
--- drivers/usb/host/xhci-mem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/host/xhci-mem.c +1 -1
@@ -1331,10 +1331,10 @@ int xhci_endpoint_init(struct xhci_hcd */* Attempt to use the ring cache */ if (virt_dev->num_rings_cached ==0 )return -ENOMEM ; + virt_dev->num_rings_cached--; virt_dev->eps[ep_index].new_ring = virt_dev->ring_cache[virt_dev->num_rings_cached]; virt_dev->ring_cache[virt_dev->num_rings_cached] =NULL ; - virt_dev->num_rings_cached--;xhci_reinit_cached_ring (xhci, virt_dev->eps[ep_index].new_ring,1 , type); }
Greg Kroah-Hartman
maintainerPATCH 67/125 dm stats: fix divide by zero if number_of_areas arg is zero
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <[email protected]>
commit dd4c1b7d0c95be1c9245118a3accc41a16f1db67 upstream.
If the number_of_areas argument was zero the kernel would crash on div-by-zero. Add better input validation.
--- drivers/md/dm-stats.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/md/dm-stats.c +2 -0
@@ -795,6 +795,8 @@ static int message_stats_create(struct mreturn -EINVAL ;if (sscanf (argv[2 ],"/%u%c" , &divisor, &dummy) ==1 ) { +if (!divisor) +return -EINVAL ; step = end - start;if (do_div (step, divisor)) step++;
Greg Kroah-Hartman
maintainerPATCH 68/125 dm space map metadata: fix occasional leak of a metadata block on resize
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Thornber <[email protected]>
commit 6096d91af0b65a3967139b32d5adbb3647858a26 upstream.
The metadata space map has a simplified 'bootstrap' mode that is operational when extending the space maps. Whilst in this mode it's possible for some refcount decrement operations to become queued (eg, as a result of shadowing one of the bitmap indexes). These decrements were not being applied when switching out of bootstrap mode.
The effect of this bug was the leaking of a 4k metadata block. This is detected by the latest version of thin_check as a non fatal error.
--- drivers/md/persistent-data/dm-space-map-metadata.c | 50 ++++++++++++++------- 1 file changed, 35 insertions(+), 15 deletions(-)
drivers/md/persistent-data/dm-space-map-metadata.c +35 -15
@@ -204,6 +204,27 @@ static void in(struct sm_metadata *smm) smm->recursion_count++; } +static int apply_bops (struct sm_metadata *smm) +{ +int r =0 ; + +while (!brb_empty (&smm->uncommitted)) { +struct block_op bop; + + r =brb_pop (&smm->uncommitted, &bop); +if (r) { +DMERR ("bug in bop ring buffer" ); +break ; + } + + r =commit_bop (smm, &bop); +if (r) +break ; + } + +return r; +} +static int out (struct sm_metadata *smm) {int r =0 ;
@@ -216,21 +237,8 @@ static int out(struct sm_metadata *smm)return -ENOMEM ; } -if (smm->recursion_count ==1 ) { -while (!brb_empty (&smm->uncommitted)) { -struct block_op bop; - - r =brb_pop (&smm->uncommitted, &bop); -if (r) { -DMERR ("bug in bop ring buffer" ); -break ; - } - - r =commit_bop (smm, &bop); -if (r) -break ; - } - } +if (smm->recursion_count ==1 ) +apply_bops (smm); smm->recursion_count--;
@@ -702,6 +710,12 @@ static int sm_metadata_extend(struct dm_ } old_len = smm->begin; + r =apply_bops (smm); +if (r) { +DMERR ("%s: apply_bops failed" , __func__); + goto out; + } + r =sm_ll_commit (&smm->ll);if (r) goto out;
@@ -771,6 +785,12 @@ int dm_sm_metadata_create(struct dm_spacif (r)return r; + r =apply_bops (smm); +if (r) { +DMERR ("%s: apply_bops failed" , __func__); +return r; + } +return sm_metadata_commit (sm); }
Greg Kroah-Hartman
maintainerPATCH 69/125 dm btree remove: fix bug in redistribute3
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dennis Yang <[email protected]>
commit 4c7e309340ff85072e96f529582d159002c36734 upstream.
redistribute3() shares entries out across 3 nodes. Some entries were being moved the wrong way, breaking the ordering. This manifested as a BUG() in dm-btree-remove.c:shift() when entries were removed from the btree.
For additional context see:
https://www.redhat.com/archives/dm-devel/2015-May/msg00113.html
--- drivers/md/persistent-data/dm-btree-remove.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/md/persistent-data/dm-btree-remove.c +3 -3
@@ -309,8 +309,8 @@ static void redistribute3(struct dm_btreif (s <0 && nr_center < -s) {/* not enough in central node */ -shift (left, center, nr_center); - s = nr_center - target; +shift (left, center, -nr_center); + s += nr_center;shift (left, right, s); nr_right += s; }else
@@ -323,7 +323,7 @@ static void redistribute3(struct dm_btreif (s >0 && nr_center < s) {/* not enough in central node */ shift (center, right, nr_center); - s = target - nr_center; + s -= nr_center;shift (left, right, s); nr_left -= s; }else
Greg Kroah-Hartman
maintainerPATCH 70/125 dm btree: silence lockdep lock inversion in dm_btree_del()
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Thornber <[email protected]>
commit 1c7518794a3647eb345d59ee52844e8a40405198 upstream.
Allocate memory using GFP_NOIO when deleting a btree. dm_btree_del() can be called via an ioctl and we don't want to recurse into the FS or block layer.
--- drivers/md/persistent-data/dm-btree.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/md/persistent-data/dm-btree.c +1 -1
@@ -255,7 +255,7 @@ int dm_btree_del(struct dm_btree_info *iint r;struct del_stack *s; - s =kmalloc (sizeof (*s),GFP_KERNEL ); + s =kmalloc (sizeof (*s),GFP_NOIO );if (!s)return -ENOMEM ; s->info = info;
Greg Kroah-Hartman
maintainerPATCH 71/125 mmc: block: Add missing mmc_blk_put() in power_ro_lock_show()
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomas Winkler <[email protected]>
commit 9098f84cced870f54d8c410dd2444cfa61467fa0 upstream.
Enclosing mmc_blk_put() is missing in power_ro_lock_show() sysfs handler, let's add it.
--- drivers/mmc/card/block.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/mmc/card/block.c +2 -0
@@ -205,6 +205,8 @@ static ssize_t power_ro_lock_show(struct ret =snprintf (buf,PAGE_SIZE ,"%d\n" , locked); +mmc_blk_put (md); +return ret; }
Greg Kroah-Hartman
maintainerPATCH 72/125 drm/qxl: Do not cause spice-server to clean our objects
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frediano Ziglio <[email protected]>
commit 2fa19535ca6abcbfd1ccc9ef694db52f49f77747 upstream.
If objects are moved back from system memory to VRAM (and spice id created again) memory is already initialized so we need to set flag to not clear memory.
If you don't do it after a while using desktop many images turns to black or transparents.
--- drivers/gpu/drm/qxl/qxl_cmd.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/qxl/qxl_cmd.c +1 -0
@@ -505,6 +505,7 @@ int qxl_hw_surface_alloc(struct qxl_devi cmd = (struct qxl_surface_cmd *)qxl_release_map (qdev, release); cmd->type =QXL_SURFACE_CMD_CREATE ; + cmd->flags =QXL_SURF_FLAG_KEEP_DATA ; cmd->u.surface_create.format = surf->surf.format; cmd->u.surface_create.width = surf->surf.width; cmd->u.surface_create.height = surf->surf.height;
Greg Kroah-Hartman
maintainerPATCH 73/125 drm/qxl: Do not leak memory if qxl_release_list_add fails
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frediano Ziglio <[email protected]>
commit 8451cc964c1d193b989c41a44e5e77109cc696f8 upstream.
If the function fails reference counter to the object is not decremented causing leaks.
This is hard to spot as it happens only on very low memory situations.
--- drivers/gpu/drm/qxl/qxl_ioctl.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/qxl/qxl_ioctl.c +3 -1
@@ -122,8 +122,10 @@ static struct qxl_bo *qxlhw_handle_to_bo qobj =gem_to_qxl_bo (gobj); ret =qxl_release_list_add (release, qobj); -if (ret) +if (ret) { +drm_gem_object_unreference_unlocked (gobj);return NULL ; + }return qobj; }
Greg Kroah-Hartman
maintainerPATCH 74/125 drm/radeon: take the mode_config mutex when dealing with hpds (v2)
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit 39fa10f7e21574a70cecf1fed0f9b36535aa68a0 upstream.
Since we are messing with state in the worker.
v2: drop the changes in the mst worker
--- drivers/gpu/drm/radeon/radeon_irq_kms.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/radeon/radeon_irq_kms.c +2 -0
@@ -79,10 +79,12 @@ static void radeon_hotplug_work_func(strstruct drm_mode_config *mode_config = &dev->mode_config;struct drm_connector *connector; +mutex_lock (&mode_config->mutex);if (mode_config->num_connector) {list_for_each_entry (connector, &mode_config->connector_list, head)radeon_connector_hotplug (connector); } +mutex_unlock (&mode_config->mutex);/* Just fire off a uevent and let userspace tell us what to do */ drm_helper_hpd_irq_event (dev); }
Greg Kroah-Hartman
maintainerPATCH 78/125 drm/radeon: add a dpm quirk for Sapphire Radeon R9 270X 2GB GDDR5
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit 5dfc71bc44d91d1620505c064fa22b0b3db58a9d upstream.
bug:
https://bugs.freedesktop.org/show_bug.cgi?id=76490
--- drivers/gpu/drm/radeon/si_dpm.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/radeon/si_dpm.c +1 -0
@@ -2914,6 +2914,7 @@ static struct si_dpm_quirk si_dpm_quirk_/* PITCAIRN - https://bugs.freedesktop.org/show_bug.cgi?id=76490 */ { PCI_VENDOR_ID_ATI, 0x6810, 0x1462, 0x3036, 0, 120000 }, { PCI_VENDOR_ID_ATI, 0x6811, 0x174b, 0xe271, 0, 120000 }, + { PCI_VENDOR_ID_ATI, 0x6810, 0x174b, 0xe271, 85000, 90000 }, { 0, 0, 0, 0 }, };
Greg Kroah-Hartman
maintainerPATCH 79/125 drm: add a check for x/y in drm_mode_setcrtc
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhao Junwang <[email protected]>
commit 01447e9f04ba1c49a9534ae6a5a6f26c2bb05226 upstream.
legacy setcrtc ioctl does take a 32 bit value which might indeed overflow
the checks of crtc_req->x > INT_MAX and crtc_req->y > INT_MAX aren't needed any more with this
v2: -polish the annotation according to Daniel's comment
--- drivers/gpu/drm/drm_crtc.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/gpu/drm/drm_crtc.c +5 -2
@@ -2155,8 +2155,11 @@ int drm_mode_setcrtc(struct drm_device *if (!drm_core_check_feature (dev,DRIVER_MODESET ))return -EINVAL ; -/* For some reason crtc x/y offsets are signed internally. */ -if (crtc_req->x >INT_MAX || crtc_req->y >INT_MAX ) +/* +* Universal plane src offsets are only 16.16, prevent havoc for +* drivers using universal plane code internally. +*/ +if (crtc_req->x &0xffff0000 || crtc_req->y &0xffff0000 )return -ERANGE ;drm_modeset_lock_all (dev);
Greg Kroah-Hartman
maintainerPATCH 80/125 xfs: fix remote symlinks on V5/CRC filesystems
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Sandeen <[email protected]>
commit 2ac56d3d4bd625450a54d4c3f9292d58f6b88232 upstream.
If we create a CRC filesystem, mount it, and create a symlink with a path long enough that it can't live in the inode, we get a very strange result upon remount:
# ls -l mnt total 4 lrwxrwxrwx. 1 root root 929 Jun 15 16:58 link -> XSLM
XSLM is the V5 symlink block header magic (which happens to be followed by a NUL, so the string looks terminated).
xfs_readlink_bmap() advanced cur_chunk by the size of the header for CRC filesystems, but never actually used that pointer; it kept reading from bp->b_addr, which is the start of the block, rather than the start of the symlink data after the header.
Looks like this problem goes back to v3.10.
Fixing this gets us reading the proper link target, again.
--- fs/xfs/xfs_symlink.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/xfs/xfs_symlink.c +1 -1
@@ -102,7 +102,7 @@ xfs_readlink_bmap( cur_chunk +=sizeof (struct xfs_dsymlink_hdr ); } -memcpy (link + offset, bp->b_addr, byte_cnt); +memcpy (link + offset, cur_chunk, byte_cnt); pathlen -= byte_cnt; offset += byte_cnt;
Greg Kroah-Hartman
maintainerPATCH 81/125 vTPM: set virtual device before passing to ibmvtpm_reset_crq
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Hon Ching \\(Vicky\\) Lo" <[email protected]>
commit 9d75f08946e8485109458ccf16f714697c207f41 upstream.
tpm_ibmvtpm_probe() calls ibmvtpm_reset_crq(ibmvtpm) without having yet set the virtual device in the ibmvtpm structure. So in ibmvtpm_reset_crq, the phype call contains empty unit addresses, ibmvtpm->vdev->unit_address.
--- drivers/char/tpm/tpm_ibmvtpm.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/char/tpm/tpm_ibmvtpm.c +3 -2
@@ -579,6 +579,9 @@ static int tpm_ibmvtpm_probe(struct vio_ goto cleanup; } + ibmvtpm->dev = dev; + ibmvtpm->vdev = vio_dev; + crq_q = &ibmvtpm->crq_queue; crq_q->crq_addr = (struct ibmvtpm_crq *)get_zeroed_page (GFP_KERNEL );if (!crq_q->crq_addr) {
@@ -623,8 +626,6 @@ static int tpm_ibmvtpm_probe(struct vio_ crq_q->index =0 ; - ibmvtpm->dev = dev; - ibmvtpm->vdev = vio_dev;TPM_VPRIV (chip) = (void *)ibmvtpm;spin_lock_init (&ibmvtpm->rtce_lock);
Greg Kroah-Hartman
maintainerPATCH 82/125 KEYS: ensure we free the assoc array edit if edit is valid
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Colin Ian King <[email protected]>
commit ca4da5dd1f99fe9c59f1709fb43e818b18ad20e0 upstream.
__key_link_end is not freeing the associated array edit structure and this leads to a 512 byte memory leak each time an identical existing key is added with add_key().
The reason the add_key() system call returns okay is that key_create_or_update() calls __key_link_begin() before checking to see whether it can update a key directly rather than adding/replacing - which it turns out it can. Thus __key_link() is not called through __key_instantiate_and_link() and __key_link_end() must cancel the edit.
CVE-2015-1333
--- security/keys/keyring.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
security/keys/keyring.c +5 -3
@@ -1151,9 +1151,11 @@ void __key_link_end(struct key *keyring,if (index_key->type == &key_type_keyring)up_write (&keyring_serialise_link_sem); -if (edit && !edit->dead_leaf) { -key_payload_reserve (keyring, - keyring->datalen -KEYQUOTA_LINK_BYTES ); +if (edit) { +if (!edit->dead_leaf) { +key_payload_reserve (keyring, + keyring->datalen -KEYQUOTA_LINK_BYTES ); + }assoc_array_cancel_edit (edit); }up_write (&keyring->sem);
Greg Kroah-Hartman
maintainerPATCH 83/125 ima: fix ima_show_template_data_ascii()
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mimi Zohar <[email protected]>
commit 45b26133b97871896b8c5241d59f4ff7839db7b2 upstream.
This patch fixes a bug introduced in "4d7aeee ima: define new template ima-ng and template fields d-ng and n-ng".
Changelog:
- change int to uint32 (Roberto Sassu's suggestion)
--- security/integrity/ima/ima.h | 2 +- security/integrity/ima/ima_fs.c | 4 ++-- security/integrity/ima/ima_template_lib.c | 3 ++- 3 files changed, 5 insertions(+), 4 deletions(-)
security/integrity/ima/ima.h +1 -1
@@ -106,7 +106,7 @@ void ima_add_violation(struct file *file const char *op, const char *cause);int ima_init_crypto (void );void ima_putc (struct seq_file *m,void *data,int datalen); -void ima_print_digest (struct seq_file *m,u8 *digest,int size); +void ima_print_digest (struct seq_file *m,u8 *digest,u32 size);struct ima_template_desc *ima_template_desc_current (void );int ima_init_template (void );
security/integrity/ima/ima_fs.c +2 -2
@@ -186,9 +186,9 @@ static const struct file_operations ima_ .release = seq_release, }; -void ima_print_digest (struct seq_file *m,u8 *digest,int size) +void ima_print_digest (struct seq_file *m,u8 *digest,u32 size) { -int i; +u32 i;for (i =0 ; i < size; i++)seq_printf (m,"%02x" , *(digest + i));
security/integrity/ima/ima_template_lib.c +2 -1
@@ -79,7 +79,8 @@ static void ima_show_template_data_asciienum data_formats datafmt, struct ima_field_data *field_data) { - u8 *buf_ptr = field_data->data, buflen = field_data->len; + u8 *buf_ptr = field_data->data; +u32 buflen = field_data->len;switch (datafmt) {case DATA_FMT_DIGEST_WITH_ALGO :
Greg Kroah-Hartman
maintainerPATCH 84/125 evm: labeling pseudo filesystems exception
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mimi Zohar <[email protected]>
commit 5101a1850bb7ccbf107929dee9af0cd2f400940f upstream.
To prevent offline stripping of existing file xattrs and relabeling of them at runtime, EVM allows only newly created files to be labeled. As pseudo filesystems are not persistent, stripping of xattrs is not a concern.
Some LSMs defer file labeling on pseudo filesystems. This patch permits the labeling of existing files on pseudo files systems.
--- security/integrity/evm/evm_main.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
security/integrity/evm/evm_main.c +12 -0
@@ -20,6 +20,7 @@#include <linux/xattr.h> #include <linux/integrity.h> #include <linux/evm.h> +#include <linux/magic.h> #include <crypto/hash.h> #include "evm.h"
@@ -275,6 +276,17 @@ static int evm_protect_xattr(struct dent iint =integrity_iint_find (dentry->d_inode);if (iint && (iint->flags &IMA_NEW_FILE ))return 0 ; + +/* exception for pseudo filesystems */ +if (dentry->d_inode->i_sb->s_magic ==TMPFS_MAGIC + || dentry->d_inode->i_sb->s_magic ==SYSFS_MAGIC ) +return 0 ; + +integrity_audit_msg (AUDIT_INTEGRITY_METADATA , + dentry->d_inode, dentry->d_name.name, +"update_metadata" , + integrity_status_msg[evm_status], + -EPERM ,0 ); } out:if (evm_status !=INTEGRITY_PASS )
Greg Kroah-Hartman
maintainerPATCH 85/125 libata: add ATA_HORKAGE_NOTRIM
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arne Fitzenreiter <[email protected]>
commit 71d126fd28de2d4d9b7b2088dbccd7ca62fad6e0 upstream.
Some devices lose data on TRIM whether queued or not. This patch adds a horkage to disable TRIM.
tj: Collapsed unnecessary if() nesting.
--- drivers/ata/libata-scsi.c | 3 ++- include/linux/libata.h | 1 + 2 files changed, 3 insertions(+), 1 deletion(-)
drivers/ata/libata-scsi.c +2 -1
@@ -2510,7 +2510,8 @@ static unsigned int ata_scsiop_read_cap( rbuf[14 ] = (lowest_aligned >>8 ) &0x3f ; rbuf[15 ] = lowest_aligned; -if (ata_id_has_trim (args->id)) { +if (ata_id_has_trim (args->id) && + !(dev->horkage &ATA_HORKAGE_NOTRIM )) { rbuf[14 ] |=0x80 ;/* TPE */ if (ata_id_has_zero_after_trim (args->id))
include/linux/libata.h +1 -0
@@ -428,6 +428,7 @@ enum {ATA_HORKAGE_NO_NCQ_TRIM = (1 <<19 ),/* don't use queued TRIM */ ATA_HORKAGE_NOLPM = (1 <<20 ),/* don't use LPM */ ATA_HORKAGE_WD_BROKEN_LPM = (1 <<21 ),/* some WDs have broken LPM */ + ATA_HORKAGE_NOTRIM = (1 << 24), /* don't use TRIM *//* DMA mask for user DMA control: User visible values; DO NOT renumber */
Greg Kroah-Hartman
maintainerPATCH 86/125 libata: force disable trim for SuperSSpeed S238
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arne Fitzenreiter <[email protected]>
commit cda57b1b05cf7b8b99ab4b732bea0b05b6c015cc upstream.
This device loses blocks, often the partition table area, on trim. Disable TRIM.
http://pcengines.ch/msata16a.htm
--- drivers/ata/libata-core.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/ata/libata-core.c +3 -0
@@ -4230,6 +4230,9 @@ static const struct ata_blacklist_entry { "Micron_M550*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, }, { "Crucial_CT*M550SSD*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, }, + /* devices that don't properly handle TRIM commands */ + { "SuperSSpeed S238*", NULL, ATA_HORKAGE_NOTRIM, }, +/* * Some WD SATA-I drives spin up and down erratically when the link * is put into the slumber mode. We don't have full list of the
Greg Kroah-Hartman
maintainerPATCH 87/125 tracing/filter: Do not WARN on operand count going below zero
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Steven Rostedt (Red Hat)" <[email protected]>
commit b4875bbe7e68f139bd3383828ae8e994a0df6d28 upstream.
When testing the fix for the trace filter, I could not come up with a scenario where the operand count goes below zero, so I added a WARN_ON_ONCE(cnt < 0) to the logic. But there is legitimate case that it can happen (although the filter would be wrong).
# echo '>' > /sys/kernel/debug/events/ext4/ext4_truncate_exit/filter
That is, a single operation without any operands will hit the path where the WARN_ON_ONCE() can trigger. Although this is harmless, and the filter is reported as a error. But instead of spitting out a warning to the kernel dmesg, just fail nicely and report it via the proper channels.
--- kernel/trace/trace_events_filter.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
kernel/trace/trace_events_filter.c +3 -1
@@ -1413,7 +1413,9 @@ static int check_preds(struct filter_parcontinue ; } n_normal_preds++; -WARN_ON_ONCE (cnt <0 ); +/* all ops should have operands */ +if (cnt <0 ) +break ; }if (cnt !=1 || !n_normal_preds || n_logical_preds >= n_normal_preds) {
Greg Kroah-Hartman
maintainerPATCH 88/125 tracing/filter: Do not allow infix to exceed end of string
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Steven Rostedt (Red Hat)" <[email protected]>
commit 6b88f44e161b9ee2a803e5b2b1fbcf4e20e8b980 upstream.
While debugging a WARN_ON() for filtering, I found that it is possible for the filter string to be referenced after its end. With the filter:
# echo '>' > /sys/kernel/debug/events/ext4/ext4_truncate_exit/filter
The filter_parse() function can call infix_get_op() which calls infix_advance() that updates the infix filter pointers for the cnt and tail without checking if the filter is already at the end, which will put the cnt to zero and the tail beyond the end. The loop then calls infix_next() that has
ps->infix.cnt--; return ps->infix.string[ps->infix.tail++];
The cnt will now be below zero, and the tail that is returned is already passed the end of the filter string. So far the allocation of the filter string usually has some buffer that is zeroed out, but if the filter string is of the exact size of the allocated buffer there's no guarantee that the charater after the nul terminating character will be zero.
Luckily, only root can write to the filter.
--- kernel/trace/trace_events_filter.c | 6 ++++++ 1 file changed, 6 insertions(+)
kernel/trace/trace_events_filter.c +6 -0
@@ -1086,6 +1086,9 @@ static void parse_init(struct filter_parstatic char infix_next (struct filter_parse_state *ps) { +if (!ps->infix.cnt) +return 0 ; + ps->infix.cnt--;return ps->infix.string[ps->infix.tail++];
@@ -1101,6 +1104,9 @@ static char infix_peek(struct filter_parstatic void infix_advance (struct filter_parse_state *ps) { +if (!ps->infix.cnt) +return ; + ps->infix.cnt--; ps->infix.tail++; }
Greg Kroah-Hartman
maintainerPATCH 89/125 tracing: Have branch tracer use recursive field of task struct
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Steven Rostedt (Red Hat)" <[email protected]>
commit 6224beb12e190ff11f3c7d4bf50cb2922878f600 upstream.
Fengguang Wu's tests triggered a bug in the branch tracer's start up test when CONFIG_DEBUG_PREEMPT set. This was because that config adds some debug logic in the per cpu field, which calls back into the branch tracer.
The branch tracer has its own recursive checks, but uses a per cpu variable to implement it. If retrieving the per cpu variable calls back into the branch tracer, you can see how things will break.
Instead of using a per cpu variable, use the trace_recursion field of the current task struct. Simply set a bit when entering the branch tracing and clear it when leaving. If the bit is set on entry, just don't do the tracing.
There's also the case with lockdep, as the local_irq_save() called before the recursion can also trigger code that can call back into the function. Changing that to a raw_local_irq_save() will protect that as well.
This prevents the recursion and the inevitable crash that follows.
--- kernel/trace/trace.h | 1 + kernel/trace/trace_branch.c | 17 ++++++++++------- 2 files changed, 11 insertions(+), 7 deletions(-)
kernel/trace/trace.h +1 -0
@@ -422,6 +422,7 @@ enum {TRACE_CONTROL_BIT , + TRACE_BRANCH_BIT,/* * Abuse of the trace_recursion. * As we need a way to maintain state if we are tracing the function
kernel/trace/trace_branch.c +10 -7
@@ -37,9 +37,12 @@ probe_likely_condition(struct ftrace_brastruct trace_branch *entry;struct ring_buffer *buffer;unsigned long flags; -int cpu, pc; +int pc;const char *p; +if (current->trace_recursion &TRACE_BRANCH_BIT ) +return ; +/* * I would love to save just the ftrace_likely_data pointer, but * this code can also be used by modules. Ugly things can happen
@@ -50,10 +53,10 @@ probe_likely_condition(struct ftrace_braif (unlikely (!tr))return ; -local_irq_save (flags); - cpu =raw_smp_processor_id (); - data =per_cpu_ptr (tr->trace_buffer.data, cpu); -if (atomic_inc_return (&data->disabled) !=1 ) +raw_local_irq_save (flags); + current->trace_recursion |=TRACE_BRANCH_BIT ; + data =this_cpu_ptr (tr->trace_buffer.data); +if (atomic_read (&data->disabled)) goto out; pc =preempt_count ();
@@ -82,8 +85,8 @@ probe_likely_condition(struct ftrace_bra__buffer_unlock_commit (buffer, event); out: -atomic_dec (&data->disabled); -local_irq_restore (flags); + current->trace_recursion &= ~TRACE_BRANCH_BIT ; +raw_local_irq_restore (flags); } static inline
Greg Kroah-Hartman
maintainerPATCH 90/125 dmaengine: mv_xor: bug fix for racing condition in descriptors cleanup
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lior Amsalem <[email protected]>
commit 9136291f1dbc1d4d1cacd2840fb35f4f3ce16c46 upstream.
This patch fixes a bug in the XOR driver where the cleanup function can be called and free descriptors that never been processed by the engine (which result in data errors).
The cleanup function will free descriptors based on the ownership bit in the descriptors.
--- drivers/dma/mv_xor.c | 74 ++++++++++++++++++++++++++++++++------------------- drivers/dma/mv_xor.h | 1 2 files changed, 48 insertions(+), 27 deletions(-)
drivers/dma/mv_xor.c +47 -27
@@ -316,7 +316,8 @@ static void __mv_xor_slot_cleanup(structdma_cookie_t cookie =0 ;int busy =mv_chan_is_busy (mv_chan);u32 current_desc =mv_chan_get_current_desc (mv_chan); -int seen_current =0 ; +int current_cleaned =0 ; +struct mv_xor_desc *hw_desc;dev_dbg (mv_chan_to_devp (mv_chan),"%s %d\n" , __func__, __LINE__);dev_dbg (mv_chan_to_devp (mv_chan),"current_desc %x\n" , current_desc);
@@ -328,38 +329,57 @@ static void __mv_xor_slot_cleanup(structlist_for_each_entry_safe (iter, _iter, &mv_chan->chain, chain_node) { -prefetch (_iter); -prefetch (&_iter->async_tx); -/* do not advance past the current descriptor loaded into the -* hardware channel, subsequent descriptors are either in -* process or have not been submitted -*/ -if (seen_current) -break ; - -/* stop the search if we reach the current descriptor and the -* channel is busy -*/ -if (iter->async_tx.phys == current_desc) { - seen_current =1 ; -if (busy) +/* clean finished descriptors */ + hw_desc = iter->hw_desc; +if (hw_desc->status &XOR_DESC_SUCCESS ) { + cookie =mv_xor_run_tx_complete_actions (iter, mv_chan, + cookie); + +/* done processing desc, clean slot */ +mv_xor_clean_slot (iter, mv_chan); + +/* break if we did cleaned the current */ +if (iter->async_tx.phys == current_desc) { + current_cleaned =1 ;break ; + } + }else { +if (iter->async_tx.phys == current_desc) { + current_cleaned =0 ; +break ; + } } - - cookie =mv_xor_run_tx_complete_actions (iter, mv_chan, cookie); - -if (mv_xor_clean_slot (iter, mv_chan)) -break ; }if ((busy ==0 ) && !list_empty (&mv_chan->chain)) { -struct mv_xor_desc_slot *chain_head; - chain_head =list_entry (mv_chan->chain.next, - struct mv_xor_desc_slot, - chain_node); - -mv_xor_start_new_chain (mv_chan, chain_head); +if (current_cleaned) { +/* +* current descriptor cleaned and removed, run +* from list head +*/ + iter =list_entry (mv_chan->chain.next, + struct mv_xor_desc_slot, + chain_node); +mv_xor_start_new_chain (mv_chan, iter); + }else { +if (!list_is_last (&iter->chain_node, &mv_chan->chain)) { +/* +* descriptors are still waiting after +* current, trigger them +*/ + iter =list_entry (iter->chain_node.next, + struct mv_xor_desc_slot, + chain_node); +mv_xor_start_new_chain (mv_chan, iter); + }else { +/* +* some descriptors are still waiting +* to be cleaned +*/ +tasklet_schedule (&mv_chan->irq_tasklet); + } + } }if (cookie >0 )
drivers/dma/mv_xor.h +1 -0
@@ -33,6 +33,7 @@#define XOR_OPERATION_MODE_XOR 0#define XOR_OPERATION_MODE_MEMCPY 2#define XOR_DESCRIPTOR_SWAP BIT(14) +#define XOR_DESC_SUCCESS 0x40000000#define XOR_CURR_DESC (chan) (chan->mmr_high_base + 0x10 + (chan->idx * 4))#define XOR_NEXT_DESC (chan) (chan->mmr_high_base + 0x00 + (chan->idx * 4))
Greg Kroah-Hartman
maintainerPATCH 91/125 hwmon: (mcp3021) Fix broken output scaling
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Stevens, Nick" <[email protected]>
commit 347d7e45bd09ce09cbc30d5cea9de377eb22f55c upstream.
The mcp3021 scaling code is dividing the VDD (full-scale) value in millivolts by the A2D resolution to obtain the scaling factor. When VDD is 3300mV (the standard value) and the resolution is 12-bit (4096 divisions), the result is a scale factor of 3300/4096, which is always one. Effectively, the raw A2D reading is always being returned because no scaling is applied.
This patch fixes the issue and simplifies the register-to-volts calculation, removing the unneeded "output_scale" struct member.
--- drivers/hwmon/mcp3021.c | 14 +------------- 1 file changed, 1 insertion(+), 13 deletions(-)
drivers/hwmon/mcp3021.c +1 -13
@@ -31,14 +31,11 @@/* output format */ #define MCP3021_SAR_SHIFT 2#define MCP3021_SAR_MASK 0x3ff -#define MCP3021_OUTPUT_RES 10/* 10-bit resolution */ -#define MCP3021_OUTPUT_SCALE 4#define MCP3221_SAR_SHIFT 0#define MCP3221_SAR_MASK 0xfff#define MCP3221_OUTPUT_RES 12/* 12-bit resolution */ -#define MCP3221_OUTPUT_SCALE 1enum chips { mcp3021,
@@ -54,7 +51,6 @@ struct mcp3021_data {u16 sar_shift;u16 sar_mask;u8 output_res; -u8 output_scale; };static int mcp3021_read16 (struct i2c_client *client)
@@ -84,13 +80,7 @@ static int mcp3021_read16(struct i2c_clistatic inline u16 volts_from_reg (struct mcp3021_data *data,u16 val) { -if (val ==0 ) -return 0 ; - - val = val * data->output_scale - data->output_scale /2 ; - -return val *DIV_ROUND_CLOSEST (data->vdd, - (1 << data->output_res) * data->output_scale); +return DIV_ROUND_CLOSEST (data->vdd * val,1 << data->output_res); } static ssize_t show_in_input(struct device *dev, struct device_attribute *attr,
@@ -132,14 +122,12 @@ static int mcp3021_probe(struct i2c_clie data->sar_shift =MCP3021_SAR_SHIFT ; data->sar_mask =MCP3021_SAR_MASK ; data->output_res =MCP3021_OUTPUT_RES ; - data->output_scale =MCP3021_OUTPUT_SCALE ;break ;case mcp3221: data->sar_shift =MCP3221_SAR_SHIFT ; data->sar_mask =MCP3221_SAR_MASK ; data->output_res =MCP3221_OUTPUT_RES ; - data->output_scale =MCP3221_OUTPUT_SCALE ;break ; }
Greg Kroah-Hartman
maintainerPATCH 92/125 md: fix a build warning
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Firo Yang <[email protected]>
commit 4e023612325a9034a542bfab79f78b1fe5ebb841 upstream.
Warning like this:
drivers/md/md.c: In function "update_array_info":drivers/md/md.c:6394:26: warning: logical not is only applied to the left hand side of comparison [-Wlogical-not-parentheses]
!mddev->persistent != info->not_persistent||
Fix it as Neil Brown said:mddev->persistent != !info->not_persistent ||
--- drivers/md/md.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/md/md.c +1 -1
@@ -6232,7 +6232,7 @@ static int update_array_info(struct mdde mddev->ctime != info->ctime || mddev->level != info->level ||/* mddev->layout != info->layout || */ - !mddev->persistent != info->not_persistent|| + mddev->persistent != !info->not_persistent || mddev->chunk_sectors != info->chunk_size >>9 ||/* ignore bottom 8 bits of state, and allow SB_BITMAP_PRESENT to change */ ((state^info->state) &0xfffffe00 )
Greg Kroah-Hartman
maintainerPATCH 93/125 Btrfs: use kmem_cache_free when freeing entry in inode cache
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
commit c3f4a1685bb87e59c886ee68f7967eae07d4dffa upstream.
The free space entries are allocated using kmem_cache_zalloc(), through __btrfs_add_free_space(), therefore we should use kmem_cache_free() and not kfree() to avoid any confusion and any potential problem. Looking at the kfree() definition at mm/slab.c it has the following comment:
/*
* (...)
*
* Don't free memory not originally allocated by kmalloc()
* or you will run into trouble.
*/
So better be safe and use kmem_cache_free().
--- fs/btrfs/inode-map.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/btrfs/inode-map.c +1 -1
@@ -281,7 +281,7 @@ void btrfs_unpin_free_ino(struct btrfs_r__btrfs_add_free_space (ctl, info->offset, count); free:rb_erase (&info->offset_index, rbroot); -kfree (info); +kmem_cache_free (btrfs_free_space_cachep, info); } }
Greg Kroah-Hartman
maintainerPATCH 94/125 Btrfs: fix memory leak in the extent_same ioctl
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
commit 497b4050e0eacd4c746dd396d14916b1e669849d upstream.
We were allocating memory with memdup_user() but we were never releasing that memory. This affected pretty much every call to the ioctl, whether it deduplicated extents or not.
This issue was reported on IRC by Julian Taylor and on the mailing list by Marcel Ritter, credit goes to them for finding the issue.
--- fs/btrfs/ioctl.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/btrfs/ioctl.c +3 -1
@@ -2743,7 +2743,7 @@ out_unlock:static long btrfs_ioctl_file_extent_same (struct file *file,struct btrfs_ioctl_same_args __user *argp) { -struct btrfs_ioctl_same_args *same; +struct btrfs_ioctl_same_args *same =NULL ;struct btrfs_ioctl_same_extent_info *info;struct inode *src =file_inode (file);u64 off;
@@ -2773,6 +2773,7 @@ static long btrfs_ioctl_file_extent_sameif (IS_ERR (same)) { ret =PTR_ERR (same); + same =NULL ; goto out; }
@@ -2843,6 +2844,7 @@ static long btrfs_ioctl_file_extent_same out:mnt_drop_write_file (file); +kfree (same);return ret; }
Greg Kroah-Hartman
maintainerPATCH 95/125 fuse: initialize fc->release before calling it
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miklos Szeredi <[email protected]>
commit 0ad0b3255a08020eaf50e34ef0d6df5bdf5e09ed upstream.
fc->release is called from fuse_conn_put() which was used in the error cleanup before fc->release was initialized.
[Jeremiah Mahler <[email protected]>: assign fc->release after calling fuse_conn_init(fc) instead of before.]
--- fs/fuse/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/fuse/inode.c +1 -1
@@ -1026,6 +1026,7 @@ static int fuse_fill_super(struct super_ goto err_fput;fuse_conn_init (fc); + fc->release = fuse_free_conn; fc->dev = sb->s_dev; fc->sb = sb;
@@ -1040,7 +1041,6 @@ static int fuse_fill_super(struct super_ fc->dont_mask =1 ; sb->s_flags |=MS_POSIXACL ; - fc->release = fuse_free_conn; fc->flags = d.flags; fc->user_id = d.user_id; fc->group_id = d.group_id;
Greg Kroah-Hartman
maintainerPATCH 96/125 crush: fix a bug in tree bucket decode
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilya Dryomov <[email protected]>
commit 82cd003a77173c91b9acad8033fb7931dac8d751 upstream.
struct crush_bucket_tree::num_nodes is u8, so ceph_decode_8_safe() should be used. -Wconversion catches this, but I guess it went unnoticed in all the noise it spews. The actual problem (at least for common crushmaps) isn't the u32 -> u8 truncation though - it's the advancement by 4 bytes instead of 1 in the crushmap buffer.
--- net/ceph/osdmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ceph/osdmap.c +1 -1
@@ -89,7 +89,7 @@ static int crush_decode_tree_bucket(void {int j;dout ("crush_decode_tree_bucket %p to %p\n" , *p, end); -ceph_decode_32_safe (p, end, b->num_nodes, bad); +ceph_decode_8_safe (p, end, b->num_nodes, bad); b->node_weights =kcalloc (b->num_nodes,sizeof (u32),GFP_NOFS );if (b->node_weights ==NULL )return -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 97/125 ACPICA: Tables: Fix an issue that FACS initialization is performed twice
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lv Zheng <[email protected]>
commit c04be18448355441a0c424362df65b6422e27bda upstream.
ACPICA commit 90f5332a15e9d9ba83831ca700b2b9f708274658
This patch adds a new FACS initialization flag for acpi_tb_initialize(). acpi_enable_subsystem() might be invoked several times in OS bootup process, and we don't want FACS initialization to be invoked twice. Lv Zheng.
--- drivers/acpi/acpica/utxfinit.c | 10 ++++++---- include/acpi/actypes.h | 1 + 2 files changed, 7 insertions(+), 4 deletions(-)
drivers/acpi/acpica/utxfinit.c +6 -4
@@ -175,10 +175,12 @@ acpi_status __init acpi_enable_subsystem* Obtain a permanent mapping for the FACS. This is required for the * Global Lock and the Firmware Waking Vector */ - status =acpi_tb_initialize_facs (); -if (ACPI_FAILURE (status)) { -ACPI_WARNING ((AE_INFO ,"Could not map the FACS table" )); -return_ACPI_STATUS (status); +if (!(flags &ACPI_NO_FACS_INIT )) { + status =acpi_tb_initialize_facs (); +if (ACPI_FAILURE (status)) { +ACPI_WARNING ((AE_INFO ,"Could not map the FACS table" )); +return_ACPI_STATUS (status); + } }#endif /* !ACPI_REDUCED_HARDWARE */
include/acpi/actypes.h +1 -0
@@ -561,6 +561,7 @@ typedef u64 acpi_integer;#define ACPI_NO_ACPI_ENABLE 0x10#define ACPI_NO_DEVICE_INIT 0x20#define ACPI_NO_OBJECT_INIT 0x40 +#define ACPI_NO_FACS_INIT 0x80/* * Initialization state
Greg Kroah-Hartman
maintainerPATCH 98/125 iscsi-target: Convert iscsi_thread_set usage to kthread.h
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Bellinger <[email protected]>
commit 88dcd2dab5c23b1c9cfc396246d8f476c872f0ca upstream.
This patch converts iscsi-target code to use modern kthread.h API callers for creating RX/TX threads for each new iscsi_conn descriptor, and releasing associated RX/TX threads during connection shutdown.
This is done using iscsit_start_kthreads() -> kthread_run() to start new kthreads from within iscsi_post_login_handler(), and invoking kthread_stop() from existing iscsit_close_connection() code.
Also, convert iscsit_logout_post_handler_closesession() code to use cmpxchg when determing when iscsit_cause_connection_reinstatement() needs to sleep waiting for completion.
--- drivers/target/iscsi/iscsi_target.c | 104 ++++++++++++------------------ drivers/target/iscsi/iscsi_target_core.h | 7 ++ drivers/target/iscsi/iscsi_target_erl0.c | 13 ++- drivers/target/iscsi/iscsi_target_login.c | 59 +++++++++++++++-- 4 files changed, 114 insertions(+), 69 deletions(-)
drivers/target/iscsi/iscsi_target.c +45 -59
@@ -518,7 +518,7 @@ static struct iscsit_transport iscsi_tarstatic int __init iscsi_target_init_module (void ) { -int ret =0 ; +int ret =0 , size;pr_debug ("iSCSI-Target " ISCSIT_VERSION "\n" );
@@ -527,6 +527,7 @@ static int __init iscsi_target_init_modupr_err ("Unable to allocate memory for iscsit_global\n" );return -1 ; } +spin_lock_init (&iscsit_global->ts_bitmap_lock);mutex_init (&auth_id_lock);spin_lock_init (&sess_idr_lock);idr_init (&tiqn_idr);
@@ -536,15 +537,11 @@ static int __init iscsi_target_init_moduif (ret <0 ) goto out; - ret =iscsi_thread_set_init (); -if (ret <0 ) + size =BITS_TO_LONGS (ISCSIT_BITMAP_BITS ) *sizeof (long ); + iscsit_global->ts_bitmap =vzalloc (size); +if (!iscsit_global->ts_bitmap) { +pr_err ("Unable to allocate iscsit_global->ts_bitmap\n" ); goto configfs_out; - -if (iscsi_allocate_thread_sets (TARGET_THREAD_SET_COUNT ) != -TARGET_THREAD_SET_COUNT ) { -pr_err ("iscsi_allocate_thread_sets() returned" -" unexpected value!\n" ); - goto ts_out1; } lio_qr_cache = kmem_cache_create("lio_qr_cache",
@@ -553,7 +550,7 @@ static int __init iscsi_target_init_moduif (!lio_qr_cache) {pr_err ("nable to kmem_cache_create() for" " lio_qr_cache\n" ); - goto ts_out2; + goto bitmap_out; } lio_dr_cache = kmem_cache_create("lio_dr_cache",
@@ -597,10 +594,8 @@ dr_out:kmem_cache_destroy (lio_dr_cache); qr_out:kmem_cache_destroy (lio_qr_cache); -ts_out2: -iscsi_deallocate_thread_sets (); -ts_out1: -iscsi_thread_set_free (); +bitmap_out: +vfree (iscsit_global->ts_bitmap); configfs_out:iscsi_target_deregister_configfs (); out:
@@ -610,8 +605,6 @@ out: static void __exit iscsi_target_cleanup_module(void) { -iscsi_deallocate_thread_sets (); -iscsi_thread_set_free ();iscsit_release_discovery_tpg ();iscsit_unregister_transport (&iscsi_target_transport);kmem_cache_destroy (lio_qr_cache);
@@ -621,6 +614,7 @@ static void __exit iscsi_target_cleanup_iscsi_target_deregister_configfs (); +vfree (iscsit_global->ts_bitmap);kfree (iscsit_global); }
@@ -3653,17 +3647,16 @@ static int iscsit_send_reject(void iscsit_thread_get_cpumask (struct iscsi_conn *conn) { -struct iscsi_thread_set *ts = conn->thread_set;int ord, cpu;/* -* thread_id is assigned from iscsit_global->ts_bitmap from -* within iscsi_thread_set.c:iscsi_allocate_thread_sets() +* bitmap_id is assigned from iscsit_global->ts_bitmap from +* within iscsit_start_kthreads() * -* Here we use thread_id to determine which CPU that this -* iSCSI connection's iscsi_thread_set will be scheduled to +* Here we use bitmap_id to determine which CPU that this +* iSCSI connection's RX/TX threads will be scheduled to * execute upon. */ - ord = ts->thread_id %cpumask_weight (cpu_online_mask); + ord = conn->bitmap_id %cpumask_weight (cpu_online_mask);for_each_online_cpu (cpu) {if (ord-- ==0 ) {cpumask_set_cpu (cpu, conn->conn_cpumask);
@@ -3855,7 +3848,7 @@ check_rsp_state:switch (state) {case ISTATE_SEND_LOGOUTRSP :if (!iscsit_logout_post_handler (cmd, conn)) - goto restart; +return -ECONNRESET ;/* fall through */ case ISTATE_SEND_STATUS :case ISTATE_SEND_ASYNCMSG :
@@ -3883,8 +3876,6 @@ check_rsp_state: err:return -1 ; -restart: -return -EAGAIN ; }static int iscsit_handle_response_queue (struct iscsi_conn *conn)
@@ -3911,21 +3902,13 @@ static int iscsit_handle_response_queue(int iscsi_target_tx_thread (void *arg) {int ret =0 ; -struct iscsi_conn *conn; -struct iscsi_thread_set *ts = arg; +struct iscsi_conn *conn = arg;/* * Allow ourselves to be interrupted by SIGINT so that a * connection recovery / failure event can be triggered externally. */ allow_signal (SIGINT ); -restart: - conn =iscsi_tx_thread_pre_handler (ts); -if (!conn) - goto out; - - ret =0 ; -while (!kthread_should_stop ()) {/* * Ensure that both TX and RX per connection kthreads
@@ -3934,11 +3917,9 @@ restart:iscsit_thread_check_cpumask (conn, current,1 );wait_event_interruptible (conn->queues_wq, - !iscsit_conn_all_queues_empty (conn) || - ts->status ==ISCSI_THREAD_SET_RESET ); + !iscsit_conn_all_queues_empty (conn)); -if ((ts->status ==ISCSI_THREAD_SET_RESET ) || -signal_pending (current)) +if (signal_pending (current)) goto transport_err; get_immediate:
@@ -3949,15 +3930,14 @@ get_immediate: ret =iscsit_handle_response_queue (conn);if (ret ==1 ) goto get_immediate; -else if (ret == -EAGAIN ) - goto restart; +else if (ret == -ECONNRESET ) + goto out;else if (ret <0 ) goto transport_err; } transport_err:iscsit_take_action_for_connection_exit (conn); - goto restart; out:return 0 ; }
@@ -4046,8 +4026,7 @@ int iscsi_target_rx_thread(void *arg)int ret;u8 buffer[ISCSI_HDR_LEN ], opcode;u32 checksum =0 , digest =0 ; -struct iscsi_conn *conn =NULL ; -struct iscsi_thread_set *ts = arg; +struct iscsi_conn *conn = arg;struct kvec iov;/* * Allow ourselves to be interrupted by SIGINT so that a
@@ -4055,11 +4034,6 @@ int iscsi_target_rx_thread(void *arg)*/ allow_signal (SIGINT ); -restart: - conn =iscsi_rx_thread_pre_handler (ts); -if (!conn) - goto out; -if (conn->conn_transport->transport_type ==ISCSI_INFINIBAND ) {struct completion comp;int rc;
@@ -4069,7 +4043,7 @@ restart:if (rc <0 ) goto transport_err; - goto out; + goto transport_err; }while (!kthread_should_stop ()) {
@@ -4145,8 +4119,6 @@ transport_err:if (!signal_pending (current))atomic_set (&conn->transport_failed,1 );iscsit_take_action_for_connection_exit (conn); - goto restart; -out:return 0 ; }
@@ -4208,7 +4180,24 @@ int iscsit_close_connection(if (conn->conn_transport->transport_type ==ISCSI_TCP )complete (&conn->conn_logout_comp); -iscsi_release_thread_set (conn); +if (!strcmp (current->comm,ISCSI_RX_THREAD_NAME )) { +if (conn->tx_thread && +cmpxchg (&conn->tx_thread_active, true, false)) { +send_sig (SIGINT , conn->tx_thread,1 ); +kthread_stop (conn->tx_thread); + } + }else if (!strcmp (current->comm,ISCSI_TX_THREAD_NAME )) { +if (conn->rx_thread && +cmpxchg (&conn->rx_thread_active, true, false)) { +send_sig (SIGINT , conn->rx_thread,1 ); +kthread_stop (conn->rx_thread); + } + } + +spin_lock (&iscsit_global->ts_bitmap_lock); +bitmap_release_region (iscsit_global->ts_bitmap, conn->bitmap_id, +get_order (1 )); +spin_unlock (&iscsit_global->ts_bitmap_lock);iscsit_stop_timers_for_cmds (conn);iscsit_stop_nopin_response_timer (conn);
@@ -4487,15 +4476,13 @@ static void iscsit_logout_post_handler_c struct iscsi_conn *conn) {struct iscsi_session *sess = conn->sess; - -iscsi_set_thread_clear (conn,ISCSI_CLEAR_TX_THREAD ); -iscsi_set_thread_set_signal (conn,ISCSI_SIGNAL_TX_THREAD ); +int sleep =cmpxchg (&conn->tx_thread_active, true, false);atomic_set (&conn->conn_logout_remove,0 );complete (&conn->conn_logout_comp);iscsit_dec_conn_usage_count (conn); -iscsit_stop_session (sess,1 ,1 ); +iscsit_stop_session (sess, sleep, sleep);iscsit_dec_session_usage_count (sess);target_put_session (sess->se_sess); }
@@ -4503,13 +4490,12 @@ static void iscsit_logout_post_handler_cstatic void iscsit_logout_post_handler_samecid (struct iscsi_conn *conn) { -iscsi_set_thread_clear (conn,ISCSI_CLEAR_TX_THREAD ); -iscsi_set_thread_set_signal (conn,ISCSI_SIGNAL_TX_THREAD ); +int sleep =cmpxchg (&conn->tx_thread_active, true, false);atomic_set (&conn->conn_logout_remove,0 );complete (&conn->conn_logout_comp); -iscsit_cause_connection_reinstatement (conn,1 ); +iscsit_cause_connection_reinstatement (conn, sleep);iscsit_dec_conn_usage_count (conn); }
drivers/target/iscsi/iscsi_target_core.h +7 -0
@@ -601,6 +601,11 @@ struct iscsi_conn {struct iscsi_session *sess;/* Pointer to thread_set in use for this conn's threads */ struct iscsi_thread_set *thread_set; +int bitmap_id; +int rx_thread_active; +struct task_struct *rx_thread; +int tx_thread_active; +struct task_struct *tx_thread;/* list_head for session connection list */ struct list_head conn_list; }____cacheline_aligned ;
@@ -869,10 +874,12 @@ struct iscsit_global {/* Unique identifier used for the authentication daemon */ u32 auth_id;u32 inactive_ts; +#define ISCSIT_BITMAP_BITS 262144/* Thread Set bitmap count */ int ts_bitmap_count;/* Thread Set bitmap pointer */ unsigned long *ts_bitmap; +spinlock_t ts_bitmap_lock;/* Used for iSCSI discovery session authentication */ struct iscsi_node_acl discovery_acl;struct iscsi_portal_group *discovery_tpg;
drivers/target/iscsi/iscsi_target_erl0.c +8 -5
@@ -864,7 +864,10 @@ void iscsit_connection_reinstatement_rcf }spin_unlock_bh (&conn->state_lock); -iscsi_thread_set_force_reinstatement (conn); +if (conn->tx_thread && conn->tx_thread_active) +send_sig (SIGINT , conn->tx_thread,1 ); +if (conn->rx_thread && conn->rx_thread_active) +send_sig (SIGINT , conn->rx_thread,1 ); sleep:wait_for_completion (&conn->conn_wait_rcfr_comp);
@@ -889,10 +892,10 @@ void iscsit_cause_connection_reinstatemereturn ; } -if (iscsi_thread_set_force_reinstatement (conn) <0 ) { -spin_unlock_bh (&conn->state_lock); -return ; - } +if (conn->tx_thread && conn->tx_thread_active) +send_sig (SIGINT , conn->tx_thread,1 ); +if (conn->rx_thread && conn->rx_thread_active) +send_sig (SIGINT , conn->rx_thread,1 );atomic_set (&conn->connection_reinstatement,1 );if (!sleep) {
drivers/target/iscsi/iscsi_target_login.c +54 -5
91 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 99/125 iser-target: Fix possible deadlock in RDMA_CM connection error
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sagi Grimberg <[email protected]>
commit 4a579da2586bd3b79b025947ea24ede2bbfede62 upstream.
Before we reach to connection established we may get an error event. In this case the core won't teardown this connection (never established it), so we take care of freeing it ourselves.
--- drivers/infiniband/ulp/isert/ib_isert.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-)
drivers/infiniband/ulp/isert/ib_isert.c +9 -5
@@ -206,7 +206,7 @@ fail:static void isert_free_rx_descriptors (struct isert_conn *isert_conn) { -struct ib_device *ib_dev = isert_conn->conn_cm_id->device; +struct ib_device *ib_dev = isert_conn->conn_device->ib_device;struct iser_rx_desc *rx_desc;int i;
@@ -647,9 +647,9 @@ out:static void isert_connect_release (struct isert_conn *isert_conn) { -struct ib_device *ib_dev = isert_conn->conn_cm_id->device;struct isert_device *device = isert_conn->conn_device;int cq_index; +struct ib_device *ib_dev = device->ib_device;pr_debug ("Entering isert_connect_release(): >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n" );
@@ -657,7 +657,8 @@ isert_connect_release(struct isert_connisert_conn_free_fastreg_pool (isert_conn);isert_free_rx_descriptors (isert_conn); -rdma_destroy_id (isert_conn->conn_cm_id); +if (isert_conn->conn_cm_id) +rdma_destroy_id (isert_conn->conn_cm_id);if (isert_conn->conn_qp) { cq_index = ((struct isert_cq_desc *)
@@ -815,12 +816,15 @@ isert_disconnected_handler(struct rdma_creturn 0 ; } -static void +static int isert_connect_error (struct rdma_cm_id *cma_id) {struct isert_conn *isert_conn = cma_id->qp->qp_context; + isert_conn->conn_cm_id =NULL ;isert_put_conn (isert_conn); + +return -1 ; } static int
@@ -850,7 +854,7 @@ isert_cma_handler(struct rdma_cm_id *cmacase RDMA_CM_EVENT_REJECTED :/* FALLTHRU */ case RDMA_CM_EVENT_UNREACHABLE :/* FALLTHRU */ case RDMA_CM_EVENT_CONNECT_ERROR : -isert_connect_error (cma_id); + ret =isert_connect_error (cma_id);break ;default :pr_err ("Unhandled RDMA CMA event: %d\n" , event->event);
Greg Kroah-Hartman
maintainerPATCH 100/125 iser-target: release stale iser connections
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sagi Grimberg <[email protected]>
commit 2f1b6b7d9a815f341b18dfd26a363f37d4d3c96a upstream.
When receiving a new iser connect request we serialize the pending requests by adding the newly created iser connection to the np accept list and let the login thread process the connect request one by one (np_accept_wait).
In case we received a disconnect request before the iser_conn has begun processing (still linked in np_accept_list) we should detach it from the list and clean it up and not have the login thread process a stale connection. We do it only when the connection state is not already terminating (initiator driven disconnect) as this might lead us to access np_accept_mutex after the np was released in live shutdown scenarios.
--- drivers/infiniband/ulp/isert/ib_isert.c | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-)
drivers/infiniband/ulp/isert/ib_isert.c +17 -1
@@ -59,6 +59,8 @@ static int isert_rdma_accept(struct isert_conn *isert_conn);struct rdma_cm_id *isert_setup_id (struct isert_np *isert_np); +static void isert_release_work (struct work_struct *work); +static void isert_qp_event_callback (struct ib_event *e,void *context) {
@@ -534,6 +536,7 @@ isert_connect_request(struct rdma_cm_idmutex_init (&isert_conn->conn_mutex);spin_lock_init (&isert_conn->conn_lock);INIT_LIST_HEAD (&isert_conn->conn_fr_pool); +INIT_WORK (&isert_conn->release_work, isert_release_work); isert_conn->conn_cm_id = cma_id; isert_conn->responder_resources = event->param.conn.responder_resources;
@@ -800,6 +803,7 @@ isert_disconnected_handler(struct rdma_c {struct isert_np *isert_np = cma_id->context;struct isert_conn *isert_conn; +bool terminating = false;if (isert_np->np_cm_id == cma_id)return isert_np_cma_handler (cma_id->context, event);
@@ -807,12 +811,25 @@ isert_disconnected_handler(struct rdma_c isert_conn = cma_id->qp->qp_context;mutex_lock (&isert_conn->conn_mutex); + terminating = (isert_conn->state ==ISER_CONN_TERMINATING );isert_conn_terminate (isert_conn);mutex_unlock (&isert_conn->conn_mutex);pr_info ("conn %p completing conn_wait\n" , isert_conn);complete (&isert_conn->conn_wait); +if (terminating) + goto out; + +mutex_lock (&isert_np->np_accept_mutex); +if (!list_empty (&isert_conn->conn_accept_node)) { +list_del_init (&isert_conn->conn_accept_node); +isert_put_conn (isert_conn); +queue_work (isert_release_wq, &isert_conn->release_work); + } +mutex_unlock (&isert_np->np_accept_mutex); + +out:return 0 ; }
@@ -2948,7 +2965,6 @@ static void isert_wait_conn(struct iscsiwait_for_completion (&isert_conn->conn_wait_comp_err); -INIT_WORK (&isert_conn->release_work, isert_release_work);queue_work (isert_release_wq, &isert_conn->release_work); }
Greg Kroah-Hartman
maintainerPATCH 101/125 mmc: card: Fixup request missing in mmc_blk_issue_rw_rq
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ding Wang <[email protected]>
commit 29535f7b797df35cc9b6b3bca635591cdd3dd2a8 upstream.
The current handler of MMC_BLK_CMD_ERR in mmc_blk_issue_rw_rq function may cause new coming request permanent missing when the ongoing request (previoulsy started) complete end.
The problem scenario is as follows:
(1) Request A is ongoing;
(2) Request B arrived, and finally mmc_blk_issue_rw_rq() is called;
(3) Request A encounters the MMC_BLK_CMD_ERR error;
(4) In the error handling of MMC_BLK_CMD_ERR, suppose mmc_blk_cmd_err() end request A completed and return zero. Continue the error handling, suppose mmc_blk_reset() reset device success;
(5) Continue the execution, while loop completed because variable ret
is zero now;
(6) Finally, mmc_blk_issue_rw_rq() return without processing request B.
The process related to the missing request may wait that IO request complete forever, possibly crashing the application or hanging the system.
Fix this issue by starting new request when reset success.
--- drivers/mmc/card/block.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/mmc/card/block.c +5 -3
@@ -1863,9 +1863,11 @@ static int mmc_blk_issue_rw_rq(struct mmbreak ;case MMC_BLK_CMD_ERR : ret =mmc_blk_cmd_err (md, card, brq, req, ret); -if (!mmc_blk_reset (md, card->host, type)) -break ; - goto cmd_abort; +if (mmc_blk_reset (md, card->host, type)) + goto cmd_abort; +if (!ret) + goto start_new_req; +break ;case MMC_BLK_RETRY :if (retry++ <5 )break ;
Greg Kroah-Hartman
maintainerPATCH 102/125 PM / sleep: Increase default DPM watchdog timeout to 60
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit fff3b16d2754a061a3549c4307a186423a0128fd upstream.
Many harddisks (mostly WD ones) have firmware problems and take too long, more than 10 seconds, to resume from suspend. And this often exceeds the default DPM watchdog timeout (12 seconds), resulting in a kernel panic out of sudden.
Since most distros just take the default as is, we should give a bit more safer value. This patch increases the default value from 12 seconds to one minute, which has been confirmed to be long enough for such problematic disks.
--- kernel/power/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/power/Kconfig +1 -1
@@ -191,7 +191,7 @@ config DPM_WATCHDOG config DPM_WATCHDOG_TIMEOUT int "Watchdog timeout in seconds" range 1 120 - default 12 + default 60 depends on DPM_WATCHDOG config PM_TRACE
Greg Kroah-Hartman
maintainerPATCH 103/125 __bitmap_parselist: fix bug in empty string handling
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Metcalf <[email protected]>
commit 2528a8b8f457d7432552d0e2b6f0f4046bb702f4 upstream.
bitmap_parselist("", &mask, nmaskbits) will erroneously set bit zero in the mask. The same bug is visible in cpumask_parselist() since it is layered on top of the bitmask code, e.g. if you boot with "isolcpus=", you will actually end up with cpu zero isolated.
The bug was introduced in commit 4b060420a596 ("bitmap, irq: add smp_affinity_list interface to /proc/irq") when bitmap_parselist() was generalized to support userspace as well as kernelspace.
--- lib/bitmap.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-)
lib/bitmap.c +9 -8
@@ -603,12 +603,12 @@ static int __bitmap_parselist(const charunsigned a, b;int c, old_c, totaldigits;const char __user __force *ubuf = (const char __user __force *)buf; -int exp_digit, in_range; +int at_start, in_range; totaldigits = c =0 ;bitmap_zero (maskp, nmaskbits); do { - exp_digit = 1; + at_start = 1; in_range = 0; a = b = 0;
@@ -637,11 +637,10 @@ static int __bitmap_parselist(const charbreak ;if (c =='-' ) { -if (exp_digit || in_range) +if (at_start || in_range)return -EINVAL ; b =0 ; in_range =1 ; - exp_digit =1 ;continue ; }
@@ -651,16 +650,18 @@ static int __bitmap_parselist(const char b = b *10 + (c -'0' );if (!in_range) a = b; - exp_digit =0 ; + at_start =0 ; totaldigits++; }if (!(a <= b))return -EINVAL ;if (b >= nmaskbits)return -ERANGE ; -while (a <= b) { -set_bit (a, maskp); - a++; +if (!at_start) { +while (a <= b) { +set_bit (a, maskp); + a++; + } } }while (buflen && c ==',' );return 0 ;
Greg Kroah-Hartman
maintainerPATCH 104/125 security_syslog() should be called once only
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasily Averin <[email protected]>
commit d194e5d666225b04c7754471df0948f645b6ab3a upstream.
The final version of commit 637241a900cb ("kmsg: honor dmesg_restrict sysctl on /dev/kmsg") lost few hooks, as result security_syslog() are processed incorrectly:
- open of /dev/kmsg checks syslog access permissions by using check_syslog_permissions() where security_syslog() is not called if dmesg_restrict is set.
- syslog syscall and /proc/kmsg calls do_syslog() where security_syslog can be executed twice (inside check_syslog_permissions() and then directly in do_syslog())
With this patch security_syslog() is called once only in all syslog-related operations regardless of dmesg_restrict value.
--- kernel/printk/printk.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-)
kernel/printk/printk.c +4 -7
@@ -383,11 +383,11 @@ static int check_syslog_permissions(int* already done the capabilities checks at open time. */ if (from_file && type !=SYSLOG_ACTION_OPEN ) -return 0 ; + goto ok;if (syslog_action_restricted (type)) {if (capable (CAP_SYSLOG )) -return 0 ; + goto ok;/* * For historical reasons, accept CAP_SYS_ADMIN too, with * a warning.
@@ -397,10 +397,11 @@ static int check_syslog_permissions(int"CAP_SYS_ADMIN but no CAP_SYSLOG " "(deprecated).\n" , current->comm, task_pid_nr(current)); -return 0 ; + goto ok; }return -EPERM ; } +ok:return security_syslog (type); }
@@ -1126,10 +1127,6 @@ int do_syslog(int type, char __user *bufif (error) goto out; - error =security_syslog (type); -if (error) -return error; -switch (type) {case SYSLOG_ACTION_CLOSE :/* Close log */ break ;
Greg Kroah-Hartman
maintainerPATCH 105/125 mac80211: prevent possible crypto tx tailroom corruption
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Kazior <[email protected]>
commit ab499db80fcf07c18e4053f91a619500f663e90e upstream.
There was a possible race between ieee80211_reconfig() and ieee80211_delayed_tailroom_dec(). This could result in inability to transmit data if driver crashed during roaming or rekeying and subsequent skbs with insufficient tailroom appeared.
This race was probably never seen in the wild because a device driver would have to crash AND recover within 0.5s which is very unlikely.
I was able to prove this race exists after changing the delay to 10s locally and crashing ath10k via debugfs immediately after GTK rekeying. In case of ath10k the counter went below
0. This was harmless but other drivers which actually require tailroom (e.g. for WEP ICV or MMIC) could end up with the counter at 0 instead of >0 and introduce insufficient skb tailroom failures because mac80211 would not resize skbs appropriately anymore.
--- net/mac80211/main.c | 3 +++ 1 file changed, 3 insertions(+)
net/mac80211/main.c +3 -0
@@ -248,6 +248,7 @@ static void ieee80211_restart_work(struc {struct ieee80211_local *local = container_of(work, struct ieee80211_local, restart_work); +struct ieee80211_sub_if_data *sdata;/* wait for scan work complete */ flush_workqueue (local->workqueue);
@@ -256,6 +257,8 @@ static void ieee80211_restart_work(struc "%s called with hardware scan in progress\n", __func__);rtnl_lock (); +list_for_each_entry (sdata, &local->interfaces, list) +flush_delayed_work (&sdata->dec_tailroom_needed_wk);ieee80211_scan_cancel (local);ieee80211_reconfig (local);rtnl_unlock ();
Greg Kroah-Hartman
maintainerPATCH 106/125 clocksource: exynos_mct: Avoid blocking calls in the cpu hotplug notifier
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damian Eppel <[email protected]>
commit 56a94f13919c0db5958611b388e1581b4852f3c9 upstream.
Whilst testing cpu hotplug events on kernel configured with DEBUG_PREEMPT and DEBUG_ATOMIC_SLEEP we get following BUG message, caused by calling request_irq() and free_irq() in the context of hotplug notification (which is in this case atomic context).
[ 40.785859] CPU1: Software reset [ 40.786660] BUG: sleeping function called from invalid context at mm/slub.c:1241 [ 40.786668] in_atomic(): 1, irqs_disabled(): 128, pid: 0, name: swapper/1 [ 40.786678] Preemption disabled at:[< (null)>] (null) [ 40.786681] [ 40.786692] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 3.19.0-rc4-00024-g7dca860 #36 [ 40.786698] Hardware name: SAMSUNG EXYNOS (Flattened Device Tree) [ 40.786728] [<c0014a00>] (unwind_backtrace) from [<c0011980>] (show_stack+0x10/0x14) [ 40.786747] [<c0011980>] (show_stack) from [<c0449ba0>] (dump_stack+0x70/0xbc) [ 40.786767] [<c0449ba0>] (dump_stack) from [<c00c6124>] (kmem_cache_alloc+0xd8/0x170) [ 40.786785] [<c00c6124>] (kmem_cache_alloc) from [<c005d6f8>] (request_threaded_irq+0x64/0x128) [ 40.786804] [<c005d6f8>] (request_threaded_irq) from [<c0350b8c>] (exynos4_local_timer_setup+0xc0/0x13c) [ 40.786820] [<c0350b8c>] (exynos4_local_timer_setup) from [<c0350ca8>] (exynos4_mct_cpu_notify+0x30/0xa8) [ 40.786838] [<c0350ca8>] (exynos4_mct_cpu_notify) from [<c003b330>] (notifier_call_chain+0x44/0x84) [ 40.786857] [<c003b330>] (notifier_call_chain) from [<c0022fd4>] (__cpu_notify+0x28/0x44) [ 40.786873] [<c0022fd4>] (__cpu_notify) from [<c0013714>] (secondary_start_kernel+0xec/0x150) [ 40.786886] [<c0013714>] (secondary_start_kernel) from [<40008764>] (0x40008764)
Interrupts cannot be requested/freed in the CPU_STARTING/CPU_DYING notifications which run on the hotplugged cpu with interrupts and preemption disabled.
To avoid the issue, request the interrupts for all possible cpus in the boot code. The interrupts are marked NO_AUTOENABLE to avoid a racy request_irq/disable_irq() sequence. The flag prevents the request_irq() code from enabling the interrupt immediately.
The interrupt is then enabled in the CPU_STARTING notifier of the hotplugged cpu and again disabled with disable_irq_nosync() in the CPU_DYING notifier.
[ tglx: Massaged changelog to match the patch ]
--- drivers/clocksource/exynos_mct.c | 43 +++++++++++++++++++++++++++------------ 1 file changed, 30 insertions(+), 13 deletions(-)
drivers/clocksource/exynos_mct.c +30 -13
@@ -422,15 +422,12 @@ static int exynos4_local_timer_setup(strexynos4_mct_write (TICK_BASE_CNT , mevt->base +MCT_L_TCNTB_OFFSET );if (mct_int_type ==MCT_INT_SPI ) { - evt->irq = mct_irqs[MCT_L0_IRQ + cpu]; -if (request_irq (evt->irq, exynos4_mct_tick_isr, -IRQF_TIMER |IRQF_NOBALANCING , - evt->name, mevt)) { -pr_err ("exynos-mct: cannot register IRQ %d\n" , - evt->irq); + +if (evt->irq ==-1 )return -EIO ; - } -irq_force_affinity (mct_irqs[MCT_L0_IRQ + cpu],cpumask_of (cpu)); + +irq_force_affinity (evt->irq,cpumask_of (cpu)); +enable_irq (evt->irq); }else {enable_percpu_irq (mct_irqs[MCT_L0_IRQ ],0 ); }
@@ -443,10 +440,12 @@ static int exynos4_local_timer_setup(strstatic void exynos4_local_timer_stop (struct clock_event_device *evt) { evt->set_mode (CLOCK_EVT_MODE_UNUSED , evt); -if (mct_int_type ==MCT_INT_SPI ) -free_irq (evt->irq,this_cpu_ptr (&percpu_mct_tick)); -else +if (mct_int_type ==MCT_INT_SPI ) { +if (evt->irq !=-1 ) +disable_irq_nosync (evt->irq); + }else {disable_percpu_irq (mct_irqs[MCT_L0_IRQ ]); + } } static int exynos4_mct_cpu_notify(struct notifier_block *self,
@@ -478,7 +477,7 @@ static struct notifier_block exynos4_mctstatic void __init exynos4_timer_resources (struct device_node *np,void __iomem *base) { -int err; +int err, cpu;struct mct_clock_event_device *mevt =this_cpu_ptr (&percpu_mct_tick);struct clk *mct_clk, *tick_clk;
@@ -505,7 +504,25 @@ static void __init exynos4_timer_resourcWARN (err,"MCT: can't request IRQ %d (%d)\n" , mct_irqs[MCT_L0_IRQ ], err); }else { -irq_set_affinity (mct_irqs[MCT_L0_IRQ ],cpumask_of (0 )); +for_each_possible_cpu (cpu) { +int mct_irq = mct_irqs[MCT_L0_IRQ + cpu]; +struct mct_clock_event_device *pcpu_mevt = +per_cpu_ptr (&percpu_mct_tick, cpu); + + pcpu_mevt->evt.irq =-1 ; + +irq_set_status_flags (mct_irq,IRQ_NOAUTOEN ); +if (request_irq (mct_irq, + exynos4_mct_tick_isr, +IRQF_TIMER |IRQF_NOBALANCING , + pcpu_mevt->name, pcpu_mevt)) { +pr_err ("exynos-mct: cannot register IRQ (cpu%d)\n" , + cpu); + +continue ; + } + pcpu_mevt->evt.irq = mct_irq; + } } err =register_cpu_notifier (&exynos4_mct_cpu_nb);
Greg Kroah-Hartman
maintainerPATCH 107/125 ideapad: fix software rfkill setting
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
commit 4b200b4604bec3388426159f1656109d19fadf6e upstream.
This fixes a several year old regression that I found while trying to get the Yoga 3 11 to work. The ideapad_rfk_set function is meant to send a command to the embedded controller through ACPI, but as of c1f73658ed, it sends the index of the rfkill device instead of the command, and ignores the opcode field.
This changes it back to the original behavior, which indeed flips the rfkill state as seen in the debugfs interface.
--- drivers/platform/x86/ideapad-laptop.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/platform/x86/ideapad-laptop.c +2 -1
@@ -461,8 +461,9 @@ const struct ideapad_rfk_data ideapad_rfstatic int ideapad_rfk_set (void *data,bool blocked) {struct ideapad_rfk_priv *priv = data; +int opcode = ideapad_rfk_data[priv->dev].opcode; -return write_ec_cmd (priv->priv->adev->handle, priv->dev, !blocked); +return write_ec_cmd (priv->priv->adev->handle, opcode, !blocked); }static struct rfkill_ops ideapad_rfk_ops = {
Greg Kroah-Hartman
maintainerPATCH 109/125 USB: usbfs: allow URBs to be reaped after disconnection
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <[email protected]>
commit 3f2cee73b650921b2e214bf487b2061a1c266504 upstream.
The usbfs API has a peculiar hole: Users are not allowed to reap their URBs after the device has been disconnected. There doesn't seem to be any good reason for this; it is an ad-hoc inconsistency.
The patch allows users to issue the USBDEVFS_REAPURB and USBDEVFS_REAPURBNDELAY ioctls (together with their 32-bit counterparts on 64-bit systems) even after the device is gone. If no URBs are pending for a disconnected device then the ioctls will return -ENODEV rather than -EAGAIN, because obviously no new URBs will ever be able to complete.
The patch also adds a new capability flag for USBDEVFS_GET_CAPABILITIES to indicate that the reap-after-disconnect feature is supported.
--- drivers/usb/core/devio.c | 63 ++++++++++++++++++++++---------------- include/uapi/linux/usbdevice_fs.h | 3 + 2 files changed, 39 insertions(+), 27 deletions(-)
drivers/usb/core/devio.c +37 -26
@@ -1591,7 +1591,7 @@ static struct async *reap_as(struct dev_for (;;) {__set_current_state (TASK_INTERRUPTIBLE ); as =async_getcompleted (ps); -if (as) +if (as || !connected (ps))break ;if (signal_pending (current))break ;
@@ -1614,7 +1614,7 @@ static int proc_reapurb(struct dev_state }if (signal_pending (current))return -EINTR ; -return -EIO ; +return -ENODEV ; }static int proc_reapurbnonblock (struct dev_state *ps,void __user *arg)
@@ -1623,10 +1623,11 @@ static int proc_reapurbnonblock(struct dstruct async *as; as =async_getcompleted (ps); - retval = -EAGAIN ;if (as) { retval =processcompl (as, (void __user *__user *)arg);free_async (as); + }else { + retval = (connected (ps) ? -EAGAIN : -ENODEV ); }return retval; }
@@ -1756,7 +1757,7 @@ static int proc_reapurb_compat(struct de }if (signal_pending (current))return -EINTR ; -return -EIO ; +return -ENODEV ; }static int proc_reapurbnonblock_compat (struct dev_state *ps,void __user *arg)
@@ -1764,11 +1765,12 @@ static int proc_reapurbnonblock_compat(sint retval;struct async *as; - retval = -EAGAIN ; as =async_getcompleted (ps);if (as) { retval =processcompl_compat (as, (void __user *__user *)arg);free_async (as); + }else { + retval = (connected (ps) ? -EAGAIN : -ENODEV ); }return retval; }
@@ -1940,7 +1942,8 @@ static int proc_get_capabilities(struct {__u32 caps; - caps =USBDEVFS_CAP_ZERO_PACKET |USBDEVFS_CAP_NO_PACKET_SIZE_LIM ; + caps =USBDEVFS_CAP_ZERO_PACKET |USBDEVFS_CAP_NO_PACKET_SIZE_LIM | +USBDEVFS_CAP_REAP_AFTER_DISCONNECT ;if (!ps->dev->bus->no_stop_on_short) caps |=USBDEVFS_CAP_BULK_CONTINUATION ;if (ps->dev->bus->sg_tablesize)
@@ -2001,6 +2004,32 @@ static long usbdev_do_ioctl(struct filereturn -EPERM ;usb_lock_device (dev); + +/* Reap operations are allowed even after disconnection */ +switch (cmd) { +case USBDEVFS_REAPURB : +snoop (&dev->dev,"%s: REAPURB\n" , __func__); + ret =proc_reapurb (ps, p); + goto done; + +case USBDEVFS_REAPURBNDELAY : +snoop (&dev->dev,"%s: REAPURBNDELAY\n" , __func__); + ret =proc_reapurbnonblock (ps, p); + goto done; + +#ifdef CONFIG_COMPAT +case USBDEVFS_REAPURB32 : +snoop (&dev->dev,"%s: REAPURB32\n" , __func__); + ret =proc_reapurb_compat (ps, p); + goto done; + +case USBDEVFS_REAPURBNDELAY32 : +snoop (&dev->dev,"%s: REAPURBNDELAY32\n" , __func__); + ret =proc_reapurbnonblock_compat (ps, p); + goto done; +#endif + } +if (!connected (ps)) {usb_unlock_device (dev);return -ENODEV ;
@@ -2094,16 +2123,6 @@ static long usbdev_do_ioctl(struct file inode->i_mtime =CURRENT_TIME ;break ; -case USBDEVFS_REAPURB32 : -snoop (&dev->dev,"%s: REAPURB32\n" , __func__); - ret =proc_reapurb_compat (ps, p); -break ; - -case USBDEVFS_REAPURBNDELAY32 : -snoop (&dev->dev,"%s: REAPURBNDELAY32\n" , __func__); - ret =proc_reapurbnonblock_compat (ps, p); -break ; -case USBDEVFS_IOCTL32 :snoop (&dev->dev,"%s: IOCTL32\n" , __func__); ret =proc_ioctl_compat (ps,ptr_to_compat (p));
@@ -2115,16 +2134,6 @@ static long usbdev_do_ioctl(struct file ret =proc_unlinkurb (ps, p);break ; -case USBDEVFS_REAPURB : -snoop (&dev->dev,"%s: REAPURB\n" , __func__); - ret =proc_reapurb (ps, p); -break ; - -case USBDEVFS_REAPURBNDELAY : -snoop (&dev->dev,"%s: REAPURBNDELAY\n" , __func__); - ret =proc_reapurbnonblock (ps, p); -break ; -case USBDEVFS_DISCSIGNAL :snoop (&dev->dev,"%s: DISCSIGNAL\n" , __func__); ret =proc_disconnectsignal (ps, p);
@@ -2161,6 +2170,8 @@ static long usbdev_do_ioctl(struct file ret =proc_disconnect_claim (ps, p);break ; } + + done:usb_unlock_device (dev);if (ret >=0 ) inode->i_atime =CURRENT_TIME ;
include/uapi/linux/usbdevice_fs.h +2 -1
@@ -125,11 +125,12 @@ struct usbdevfs_hub_portinfo {char port [127 ];/* e.g. port 3 connects to device 27 */ }; -/* Device capability flags */ +/* System and bus capability flags */ #define USBDEVFS_CAP_ZERO_PACKET 0x01#define USBDEVFS_CAP_BULK_CONTINUATION 0x02#define USBDEVFS_CAP_NO_PACKET_SIZE_LIM 0x04#define USBDEVFS_CAP_BULK_SCATTER_GATHER 0x08 +#define USBDEVFS_CAP_REAP_AFTER_DISCONNECT 0x10/* USBDEVFS_DISCONNECT_CLAIM flags & struct */
Greg Kroah-Hartman
maintainerPATCH 110/125 block: Do a full clone when splitting discard bios
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Martin K. Petersen" <[email protected]>
commit f3f5da624e0a891c34d8cd513c57f1d9b0c7dadc upstream.
This fixes a data corruption bug when using discard on top of MD linear, raid0 and raid10 personalities.
Commit 20d0189b1012 "block: Introduce new bio_split()" permits sharing the bio_vec between the two resulting bios. That is fine for read/write requests where the bio_vec is immutable. For discards, however, we need to be able to attach a payload and update the bio_vec so the page can get mapped to a scatterlist entry. Therefore the bio_vec can not be shared when splitting discards and we must do a full clone.
--- fs/bio.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-)
fs/bio.c +12 -3
@@ -1806,8 +1806,9 @@ EXPORT_SYMBOL(bio_endio_nodec);* Allocates and returns a new bio which represents @sectors from the start of * @bio, and updates @bio to represent the remaining sectors. * -* The newly allocated bio will point to @bio's bi_io_vec; it is the caller's -* responsibility to ensure that @bio is not freed before the split. +* Unless this is a discard request the newly allocated bio will point +* to @bio's bi_io_vec; it is the caller's responsibility to ensure that +* @bio is not freed before the split. */ struct bio *bio_split (struct bio *bio,int sectors,gfp_t gfp,struct bio_set *bs)
@@ -1817,7 +1818,15 @@ struct bio *bio_split(struct bio *bio, iBUG_ON (sectors <=0 );BUG_ON (sectors >=bio_sectors (bio)); - split =bio_clone_fast (bio, gfp, bs); +/* +* Discards need a mutable bio_vec to accommodate the payload +* required by the DSM TRIM and UNMAP commands. +*/ +if (bio->bi_rw &REQ_DISCARD ) + split =bio_clone_bioset (bio, gfp, bs); +else + split =bio_clone_fast (bio, gfp, bs); +if (!split)return NULL ;
Greg Kroah-Hartman
maintainerPATCH 111/125 of: return NUMA_NO_NODE from fallback of_node_to_nid()
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Khlebnikov <[email protected]>
commit c8fff7bc5bba6bd59cad40441c189c4efe7190f6 upstream.
Node 0 might be offline as well as any other numa node, in this case kernel cannot handle memory allocation and crashes.
--- drivers/of/base.c | 2 +- include/linux/of.h | 5 ++++- 2 files changed, 5 insertions(+), 2 deletions(-)
drivers/of/base.c +1 -1
@@ -77,7 +77,7 @@ EXPORT_SYMBOL(of_n_size_cells);#ifdef CONFIG_NUMA int __weak of_node_to_nid (struct device_node *np) { -return numa_node_id (); +return NUMA_NO_NODE ; }#endif
include/linux/of.h +4 -1
@@ -517,7 +517,10 @@ static inline const char *of_prop_next_s#if defined(CONFIG_OF ) && defined(CONFIG_NUMA )extern int of_node_to_nid (struct device_node *np);#else -static inline int of_node_to_nid (struct device_node *device) {return 0 ; } +static inline int of_node_to_nid (struct device_node *device) +{ +return NUMA_NO_NODE ; +}#endif static inline struct device_node *of_find_matching_node(
Greg Kroah-Hartman
maintainerPATCH 113/125 NFS: Fix size of NFSACL SETACL operations
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <[email protected]>
commit d683cc49daf7c5afca8cd9654aaa1bf63cdf2ad9 upstream.
When encoding the NFSACL SETACL operation, reserve just the estimated size of the ACL rather than a fixed maximum. This eliminates needless zero padding on the wire that the server ignores.
--- fs/nfs/nfs3xdr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/nfs/nfs3xdr.c +1 -1
@@ -1342,7 +1342,7 @@ static void nfs3_xdr_enc_setacl3args(strif (args->npages !=0 )xdr_write_pages (xdr, args->pages,0 , args->len);else -xdr_reserve_space (xdr,NFS_ACL_INLINE_BUFSIZE ); +xdr_reserve_space (xdr, args->len); error = nfsacl_encode(xdr->buf, base, args->inode, (args->mask & NFS_ACL) ?
Greg Kroah-Hartman
maintainerPATCH 114/125 fixing infinite OPEN loop in 4.0 stateid recovery
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Olga Kornievskaia <[email protected]>
commit e8d975e73e5fa05f983fbf2723120edcf68e0b38 upstream.
Problem: When an operation like WRITE receives a BAD_STATEID, even though recovery code clears the RECLAIM_NOGRACE recovery flag before recovering the open state, because of clearing delegation state for the associated inode, nfs_inode_find_state_and_recover() gets called and it makes the same state with RECLAIM_NOGRACE flag again. As a results, when we restart looking over the open states, we end up in the infinite loop instead of breaking out in the next test of state flags.
Solution: unset the RECLAIM_NOGRACE set because of
calling of nfs_inode_find_state_and_recover() after returning from calling recover_open() function.
--- fs/nfs/nfs4state.c | 2 ++ 1 file changed, 2 insertions(+)
fs/nfs/nfs4state.c +2 -0
@@ -1482,6 +1482,8 @@ restart:spin_unlock (&state->state_lock); }nfs4_put_open_state (state); +clear_bit (NFS4CLNT_RECLAIM_NOGRACE , + &state->flags);spin_lock (&sp->so_lock); goto restart; }
Greg Kroah-Hartman
maintainerPATCH 115/125 nfs: increase size of EXCHANGE_ID name string buffer
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <[email protected]>
commit 764ad8ba8cd4c6f836fca9378f8c5121aece0842 upstream.
The current buffer is much too small if you have a relatively long hostname. Bring it up to the size of the one that SETCLIENTID has.
--- include/linux/nfs_xdr.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/nfs_xdr.h +1 -1
@@ -1155,7 +1155,7 @@ struct nfs41_state_protection {struct nfs4_op_map allow; }; -#define NFS4_EXCHANGE_ID_LEN (48) +#define NFS4_EXCHANGE_ID_LEN (127)struct nfs41_exchange_id_args {struct nfs_client *client;nfs4_verifier *verifier;
Greg Kroah-Hartman
maintainerPATCH 116/125 SUNRPC: Fix a memory leak in the backchannel code
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
commit 88de6af24f2b48b06c514d3c3d0a8f22fafe30bd upstream.
req->rq_private_buf isn't initialised when xprt_setup_backchannel calls xprt_free_allocation.
--- net/sunrpc/backchannel_rqst.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/sunrpc/backchannel_rqst.c +1 -1
@@ -60,7 +60,7 @@ static void xprt_free_allocation(structdprintk ("RPC: free allocations for req= %p\n" , req);WARN_ON_ONCE (test_bit (RPC_BC_PA_IN_USE , &req->rq_bc_pa_state)); - xbufp = &req->rq_private_buf; + xbufp = &req->rq_rcv_buf;free_page ((unsigned long )xbufp->head[0 ].iov_base); xbufp = &req->rq_snd_buf;free_page ((unsigned long )xbufp->head[0 ].iov_base);
Greg Kroah-Hartman
maintainerPATCH 117/125 9p: forgetting to cancel request on interrupted zero-copy RPC
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
commit a84b69cb6e0a41e86bc593904faa6def3b957343 upstream.
If we'd already sent a request and decide to abort it, we *must* issue TFLUSH properly and not just blindly reuse the tag, or we'll get seriously screwed when response eventually arrives and we confuse it for response to later request that had reused the same tag.
--- net/9p/client.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/9p/client.c +2 -1
@@ -839,7 +839,8 @@ static struct p9_req_t *p9_client_zc_rpcif (err <0 ) {if (err == -EIO ) c->status = Disconnected; - goto reterr; +if (err != -ERESTARTSYS ) + goto reterr; }if (req->status ==REQ_STATUS_ERROR ) {p9_debug (P9_DEBUG_ERROR ,"req_status error %d\n" , req->t_err);
Greg Kroah-Hartman
maintainerPATCH 118/125 9p: dont leave a half-initialized inode sitting around
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
commit 0a73d0a204a4a04a1e110539c5a524ae51f91d6d upstream.
--- fs/9p/vfs_inode.c | 3 +-- fs/9p/vfs_inode_dotl.c | 3 +-- 2 files changed, 2 insertions(+), 4 deletions(-)
fs/9p/vfs_inode.c +1 -2
@@ -540,8 +540,7 @@ static struct inode *v9fs_qid_iget(strucunlock_new_inode (inode);return inode; error: -unlock_new_inode (inode); -iput (inode); +iget_failed (inode);return ERR_PTR (retval); }
fs/9p/vfs_inode_dotl.c +1 -2
@@ -149,8 +149,7 @@ static struct inode *v9fs_qid_iget_dotl(unlock_new_inode (inode);return inode; error: -unlock_new_inode (inode); -iput (inode); +iget_failed (inode);return ERR_PTR (retval); }
Greg Kroah-Hartman
maintainerPATCH 119/125 rbd: use GFP_NOIO in rbd_obj_request_create()
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilya Dryomov <[email protected]>
commit 5a60e87603c4c533492c515b7f62578189b03c9c upstream.
rbd_obj_request_create() is called on the main I/O path, so we need to use GFP_NOIO to make sure allocation doesn't blow back on us. Not all callers need this, but I'm still hardcoding the flag inside rather than making it a parameter because a) this is going to stable, and b) those callers shouldn't really use rbd_obj_request_create() and will be fixed in the future.
More memory allocation fixes will follow.
--- drivers/block/rbd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/block/rbd.c +2 -2
@@ -1826,11 +1826,11 @@ static struct rbd_obj_request *rbd_obj_rrbd_assert (obj_request_type_valid (type)); size =strlen (object_name) +1 ; - name =kmalloc (size,GFP_KERNEL ); + name =kmalloc (size,GFP_NOIO );if (!name)return NULL ; - obj_request =kmem_cache_zalloc (rbd_obj_request_cache,GFP_KERNEL ); + obj_request =kmem_cache_zalloc (rbd_obj_request_cache,GFP_NOIO );if (!obj_request) {kfree (name);return NULL ;
Greg Kroah-Hartman
maintainerPATCH 120/125 agp/intel: Fix typo in needs_ilk_vtd_wa()
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Wilson <[email protected]>
commit 8b572a4200828b4e75cc22ed2f494b58d5372d65 upstream.
In needs_ilk_vtd_wa(), we pass in the GPU device but compared it against the ids for the mobile GPU and the mobile host bridge. That latter is impossible and so likely was just a typo for the desktop GPU device id (which is also buggy).
Fixes commit da88a5f7f7d434e2cde1b3e19d952e6d84533662
Author: Chris Wilson <[email protected]> Date: Wed Feb 13 09:31:53 2013 +0000
drm/i915: Disable WC PTE updates to w/a buggy IOMMU on ILK
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=91127
References: https://bugzilla.freedesktop.org/show_bug.cgi?id=60391
--- drivers/char/agp/intel-gtt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/char/agp/intel-gtt.c +1 -1
@@ -586,7 +586,7 @@ static inline int needs_ilk_vtd_wa(void)/* Query intel_iommu to see if we need the workaround. Presumably that * was loaded first. */ -if ((gpu_devid ==PCI_DEVICE_ID_INTEL_IRONLAKE_M_HB || +if ((gpu_devid ==PCI_DEVICE_ID_INTEL_IRONLAKE_D_IG || gpu_devid ==PCI_DEVICE_ID_INTEL_IRONLAKE_M_IG ) && intel_iommu_gfx_mapped)return 1 ;
Greg Kroah-Hartman
maintainerPATCH 121/125 arm64: Dont report clear pmds and puds as huge
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoffer Dall <[email protected]>
commit fd28f5d439fca77348c129d5b73043a56f8a0296 upstream.
The current pmd_huge() and pud_huge() functions simply check if the table bit is not set and reports the entries as huge in that case. This is counter-intuitive as a clear pmd/pud cannot also be a huge pmd/pud, and it is inconsistent with at least arm and x86.
To prevent others from making the same mistake as me in looking at code that calls these functions and to fix an issue with KVM on arm64 that causes memory corruption due to incorrect page reference counting resulting from this mistake, let's change the behavior.
--- arch/arm64/mm/hugetlbpage.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/mm/hugetlbpage.c +2 -2
@@ -46,13 +46,13 @@ struct page *follow_huge_addr(struct mm_int pmd_huge (pmd_t pmd) { -return !(pmd_val (pmd) &PMD_TABLE_BIT ); +return pmd_val (pmd) && !(pmd_val (pmd) &PMD_TABLE_BIT ); }int pud_huge (pud_t pud) {#ifndef __PAGETABLE_PMD_FOLDED -return !(pud_val (pud) &PUD_TABLE_BIT ); +return pud_val (pud) && !(pud_val (pud) &PUD_TABLE_BIT );#else return 0 ;#endif
Greg Kroah-Hartman
maintainerPATCH 122/125 hpfs: hpfs_error: Remove static buffer, use vsprintf extension %pV instead
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Perches <[email protected]>
commit a28e4b2b18ccb90df402da3f21e1a83c9d4f8ec1 upstream.
Removing unnecessary static buffers is good.
Use the vsprintf %pV extension instead.
--- fs/hpfs/super.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
fs/hpfs/super.c +7 -4
@@ -52,17 +52,20 @@ static void unmark_dirty(struct super_bl }/* Filesystem error... */ -static char err_buf[1024 ]; -void hpfs_error (struct super_block *s,const char *fmt, ...) { +struct va_format vaf;va_list args;va_start (args, fmt); -vsnprintf (err_buf,sizeof (err_buf), fmt, args); + + vaf.fmt = fmt; + vaf.va = &args; + +pr_err ("filesystem error: %pV" , &vaf); +va_end (args); -printk ("HPFS: filesystem error: %s" , err_buf);if (!hpfs_sb (s)->sb_was_error) {if (hpfs_sb (s)->sb_err ==2 ) {printk ("; crashing the system because you wanted it\n" );
Greg Kroah-Hartman
maintainerPATCH 123/125 Fix firmware loader uevent buffer NULL pointer dereference
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Torvalds <[email protected]>
commit 6f957724b94cb19f5c1c97efd01dd4df8ced323c upstream.
The firmware class uevent function accessed the "fw_priv->buf" buffer without the proper locking and testing for NULL. This is an old bug (looks like it goes back to 2012 and commit 1244691c73b2: "firmware
loader: introduce firmware_buf"), but for some reason it's triggering only now in 4.2-rc1.
Shuah Khan is trying to bisect what it is that causes this to trigger more easily, but in the meantime let's just fix the bug since others are hitting it too (at least Ingo reports having seen it as well).
--- drivers/base/firmware_class.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-)
drivers/base/firmware_class.c +13 -3
@@ -544,10 +544,8 @@ static void fw_dev_release(struct devicekfree (fw_priv); } -static int firmware_uevent (struct device *dev,struct kobj_uevent_env *env) +static int do_firmware_uevent (struct firmware_priv *fw_priv,struct kobj_uevent_env *env) { -struct firmware_priv *fw_priv =to_firmware_priv (dev); -if (add_uevent_var (env,"FIRMWARE=%s" , fw_priv->buf->fw_id))return -ENOMEM ;if (add_uevent_var (env,"TIMEOUT=%i" , loading_timeout))
@@ -558,6 +556,18 @@ static int firmware_uevent(struct devicereturn 0 ; } +static int firmware_uevent (struct device *dev,struct kobj_uevent_env *env) +{ +struct firmware_priv *fw_priv =to_firmware_priv (dev); +int err =0 ; + +mutex_lock (&fw_lock); +if (fw_priv->buf) + err =do_firmware_uevent (fw_priv, env); +mutex_unlock (&fw_lock); +return err; +} +static struct class firmware_class = { .name ="firmware" , .class_attrs = firmware_class_attrs,
Greg Kroah-Hartman
maintainerPATCH 124/125 qla2xxx: Mark port lost when we receive an RSCN for it.
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chad Dupuis <[email protected]>
commit ef86cb2059a14b4024c7320999ee58e938873032 upstream.
--- drivers/scsi/qla2xxx/qla_isr.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-)
drivers/scsi/qla2xxx/qla_isr.c +16 -1
@@ -572,8 +572,9 @@ qla2x00_async_event(scsi_qla_host_t *vhastruct device_reg_2xxx __iomem *reg = &ha->iobase->isp;struct device_reg_24xx __iomem *reg24 = &ha->iobase->isp24;struct device_reg_82xx __iomem *reg82 = &ha->iobase->isp82; -uint32_t rscn_entry, host_pid; +uint32_t rscn_entry, host_pid, tmp_pid;unsigned long flags; +fc_port_t *fcport =NULL ;/* Setup to process RIO completion. */ handle_cnt =0 ;
@@ -968,6 +969,20 @@ skip_rio:if (qla2x00_is_a_vp_did (vha, rscn_entry))break ; +/* +* Search for the rport related to this RSCN entry and mark it +* as lost. +*/ +list_for_each_entry (fcport, &vha->vp_fcports, list) { +if (atomic_read (&fcport->state) !=FCS_ONLINE ) +continue ; + tmp_pid = fcport->d_id.b24; +if (fcport->d_id.b24 == rscn_entry) { +qla2x00_mark_device_lost (vha, fcport,0 ,0 ); +break ; + } + } +atomic_set (&vha->loop_down_timer,0 ); vha->flags.management_server_logged_in =0 ;
Greg Kroah-Hartman
maintainerPATCH 125/125 MIPS: KVM: Do not sign extend on unsigned MMIO load
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Mc Guire <[email protected]>
commit ed9244e6c534612d2b5ae47feab2f55a0d4b4ced upstream.
Fix possible unintended sign extension in unsigned MMIO loads by casting to uint16_t in the case of mmio_needed != 2.
Patchwork: https://patchwork.linux-mips.org/patch/9985/
--- arch/mips/kvm/kvm_mips_emul.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/mips/kvm/kvm_mips_emul.c +1 -1
@@ -1626,7 +1626,7 @@ kvm_mips_complete_mmio_load(struct kvm_vif (vcpu->mmio_needed ==2 ) *gpr = *(int16_t *) run->mmio.data;else - *gpr = *(int16_t *) run->mmio.data; + *gpr = *(uint16_t *)run->mmio.data;break ;case 1 :
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 3.14.49 release. There are 125 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun Aug 2 19:40:05 UTC 2015. Anything received after that time might be too late.
Build results:
total: 132 pass: 132 fail: 0 Qemu test results: total: 32 pass: 32 fail: 0
Details are available at http://server.roeck-us.net:8010/builders.
Guenter
Quoted 7 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 3.14.49 release. There are 125 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun Aug 2 19:40:05 UTC 2015. Anything received after that time might be too late.
Compiled and booted on x86_32.
While kselftest got a report of segmentation fault and in dmesg:
psock_fanout[2509]: segfault at 401fd000 ip 080492ab sp bfc40cd0 error 4
in psock_fanout[8048000+2000]
regards
sudip
Quoted 6 lines · Sudip Mukherjee
Quoted 5 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 3.14.49 release. There are 125 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Quoted 7 lines
Quoted 2 lines
Responses should be made by Sun Aug 2 19:40:05 UTC 2015. Anything received after that time might be too late.
Compiled and booted on
x86_32.While kselftest got a report of segmentation fault and in dmesg:
psock_fanout[2509]: segfault at401fd000ip080492abspbfc40cd0error 4in psock_fanout[8048000+2000]
Missed a clarification, kselftest is not there. ran the tests with:
sudo make -C tools/testing/selftests run_tests
regards
sudip
Greg Kroah-Hartman
maintainerQuoted 9 lines · Sudip Mukherjee
Quoted 8 lines · Sudip Mukherjee
Quoted 7 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 3.14.49 release. There are 125 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun Aug 2 19:40:05 UTC 2015. Anything received after that time might be too late.
Quoted 8 lines
Quoted 5 lines
Compiled and booted on
x86_32.While kselftest got a report of segmentation fault and in dmesg:
psock_fanout[2509]: segfault at401fd000ip080492abspbfc40cd0error 4in psock_fanout[8048000+2000]Missed a clarification, kselftest is not there. ran the tests with:
sudo make -Ctools/testing/selftestsrun_tests
Is this something new that shows up in 3.14.49-rc1 and is not in .48?
thanks,
greg k-h
Quoted 10 lines · Greg Kroah-Hartman
Quoted 9 lines · Sudip Mukherjee
Quoted 8 lines · Sudip Mukherjee
Quoted 7 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 3.14.49 release. There are 125 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun Aug 2 19:40:05 UTC 2015. Anything received after that time might be too late.
Quoted 7 lines
Quoted 7 lines
Quoted 5 lines
Compiled and booted on
x86_32.While kselftest got a report of segmentation fault and in dmesg:
psock_fanout[2509]: segfault at401fd000ip080492abspbfc40cd0error 4in psock_fanout[8048000+2000]Missed a clarification, kselftest is not there. ran the tests with:
kselftest target isn't in 3.14. It was added to 3.17 or 3.18.
Quoted 4 lines
Quoted 1 line
sudo make -C
tools/testing/selftestsrun_testsIs this something new that shows up in 3.14.49-rc1 and is not in .48?
This is a known issue, fixed in 3.19?? - the following is the commit. Adding Dave Miller to the thread.
commit fbf8e7211ac7858d3df4a4203c18da7a58560784
Author: Shuah Khan <[email protected]> Date: Tue Nov 11 10:04:13 2014 -0700
selftests/net: psock_fanout seg faults in sock_fanout_read_ring()
The while loop in sock_fanout_read_ring() checks mmap region bounds after access, causing it to segfault. Fix it to check count before accessing header->tp_status. This problem can be reproduced consistently when the test in run as follows:
make -C tools/testing/selftests TARGETS=net run_tests or
make run_tests from tools/testing/selftests or
make run_test from tools/testing/selftests/net
thanks,
-- Shuah
Signature · 5 lines
Shuah Khan Sr. Linux Kernel Developer Open Source Innovation Group Samsung Research America (Silicon Valley) [email protected] | (970) 217-8978
Greg Kroah-Hartman
maintainerQuoted 40 lines · Shuah Khan
Quoted 10 lines · Greg Kroah-Hartman
Quoted 9 lines · Sudip Mukherjee
Quoted 8 lines · Sudip Mukherjee
Quoted 7 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 3.14.49 release. There are 125 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun Aug 2 19:40:05 UTC 2015. Anything received after that time might be too late.
Quoted 7 lines
Quoted 7 lines
Quoted 5 lines
Compiled and booted on
x86_32.While kselftest got a report of segmentation fault and in dmesg:
psock_fanout[2509]: segfault at401fd000ip080492abspbfc40cd0error 4in psock_fanout[8048000+2000]Missed a clarification, kselftest is not there. ran the tests with:
kselftest target isn't in 3.14. It was added to 3.17 or 3.18.
Quoted 4 lines
Quoted 1 line
sudo make -C
tools/testing/selftestsrun_testsIs this something new that shows up in 3.14.49-rc1 and is not in .48?
This is a known issue, fixed in 3.19?? - the following is the commit. Adding Dave Miller to the thread.
commit
fbf8e7211ac7858d3df4a4203c18da7a58560784Author: Shuah Khan <[email protected]> Date: Tue Nov 11 10:04:13 2014 -0700selftests/net:
psock_fanoutseg faults insock_fanout_read_ring()The while loop in
sock_fanout_read_ring()checks mmap region bounds after access, causing it to segfault. Fix it to check count before accessingheader->tp_status. This problem can be reproduced consistently when the test in run as follows:
Quoted 8 lines
make -C
tools/testing/selftestsTARGETS=netrun_testsor
makerun_testsfromtools/testing/selftestsor
makerun_testfromtools/testing/selftests/netSigned-off-by Shuah Khan <[email protected]>Signed-off-by David S. Miller <[email protected]>
Ah, that showed up in 3.18, and it's not worth adding it to 3.14 if the other selftest infrastructure isn't realy there either.
thanks,
greg k-h
Quoted 5 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 3.14.49 release. There are 125 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Quoted 7 lines
Responses should be made by Sun Aug 2 19:40:05 UTC 2015. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v3.x/stable-review/patch-3.14.49-rc1.gzand the diffstat can be found below.
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
Signature · 5 lines
Shuah Khan Sr. Linux Kernel Developer Open Source Innovation Group Samsung Research America (Silicon Valley) [email protected] | (970) 217-8978