3.12.23-stable review
Subsystems (2)
cover 3.12.23-stable review
This is the start of the stable review cycle for the 3.12.23 release. There are 111 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed Jun 25 08:31:21 2014 Anything received after that time might be too late.
The whole patch series can be found in one patch at:
http://kernel.org/pub/linux/kernel/people/jirislaby/stable-review/patch-3.12.23-rc1.xz
and the diffstat can be found below.
thanks,
js
===============
Alan Stern (1):
USB: Avoid runtime suspend loops for HCDs that can't handle
suspend/resume
Alessandro Miceli (2):
rtl28xxu: add [1b80:d39d] Sveon STV20
rtl28xxu: add [1b80:d3af] Sveon STV27
Alex Deucher (1):
drm/radeon: handle non-VGA class pci devices with ATRM
Alexei Starovoitov (2):
net: filter: fix typo in sparc BPF JIT
net: filter: fix sparc32 typo
Alexej Starschenko (1):
USB: serial: option: add support for Novatel E371 PCIe card
Andreas Schrägle (1):
ahci: add PCI ID for Marvell 88SE91A0 SATA Controller
Andrey Ryabinin (2):
ARM: 8051/1: put_user: fix possible data corruption in put_user
mm: rmap: fix use-after-free in __put_anon_vma
Andy Lutomirski (2):
fs,userns: Change inode_capable to capable_wrt_inode_uidgid
auditsc: audit_krule mask accesses need bounds checking
Antti Palosaari (1):
[media] rtl28xxu: add 15f4:0131 Astrometa DVB-T2
Ben Dooks (1):
sh_eth: use RNC mode for packet reception
Ben Hutchings (2):
Staging: speakup: Move pasting into a work item
Staging: speakup: Update __speakup_paste_selection() tty (ab)usage to
match vt
Ben Skeggs (1):
drm/gf119-/disp: fix nasty bug which can clobber SOR0's clock setup
Bibek Basu (1):
cpufreq: remove race while accessing cur_policy
Bjørn Mork (2):
usb: cdc-wdm: export cdc-wdm uapi header
net: qmi_wwan: add Olivetti Olicard modems
Boris BREZILLON (2):
rtc: rtc-at91rm9200: fix infinite wait for ACKUPD irq
ARM: at91: fix at91_sysirq_mask_rtc for sam9x5 SoCs
Brian Healy (1):
rtl28xxu: add 1b80:d395 Peak DVB-T USB
Chris Wilson (1):
drm/i915: Only copy back the modified fields to userspace from
execbuffer
Christian König (2):
drm/radeon: also try GART for CPU accessed buffers drm/radeon: avoid crash if VM command submission isn't available
Cong Wang (1):
vxlan: use dev->needed_headroom instead of dev->hard_header_len
Dan Carpenter (1):
qlcnic: info leak in qlcnic_dcb_peer_app_info()
Daniel Vetter (1):
drm/i915: restrict vt-d stolen memory workaround to pre-gen8
David Woodhouse (1):
iommu/vt-d: Fix missing IOTLB flush in intel_iommu_unmap()
Denis Turischev (1):
xhci: Switch only Intel Lynx Point-LP ports to EHCI on shutdown.
Dmitry Kasatkin (1):
ima: introduce ima_kernel_read()
Dmitry Popov (1):
ipip, sit: fix ipv4_{update_pmtu,redirect} calls
Emil Goode (1):
ARM: imx: fix error handling in ipu device registration
Eric Dumazet (3):
net: fix inet_getid() and ipv6_select_ident() bugs
net: force a list_del() in unregister_netdevice_many()
ipv4: fix a race in ip4_datagram_release_cb()
Eric W. Biederman (6):
netlink: Rename netlink_capable netlink_allowed
net: Move the permission check in sock_diag_put_filterinfo to
packet_diag_dump
net: Add variants of capable for use on on sockets
net: Add variants of capable for use on netlink messages
net: Use netlink_ns_capable to verify the permisions of netlink
messages
netlink: Only check file credentials for implicit destinations
George McCollister (1):
USB: ftdi_sio: add NovaTech OrionLXm product ID
Greg Kroah-Hartman (1):
USB: cdc-wdm: properly include types.h
Heinz Mauelshagen (1):
dm cache: always split discards on cache block boundaries
Helmut Schaa (1):
ath9k: Fix sequence number assignment for non-data frames
Ian Abbott (1):
staging: comedi: ni_daq_700: add mux settling delay
Igor Gnatenko (1):
xhci: extend quirk for Renesas cards
Jan Vcelak (2):
rtl28xxu: add USB ID for Genius TVGo DVB-T03
rtl28xxu: add chipset version comments into device list
Jean Delvare (2):
hwmon: (ntc_thermistor) Fix dependencies
hwmon: (ntc_thermistor) Fix OF device ID mapping
Jiri Kosina (1):
floppy: do not corrupt bio.bi_flags when reading block 0
Jiri Olsa (1):
perf: Prevent false warning in perf_swevent_add
Jiri Pirko (1):
team: fix mtu setting
Joe Lawrence (1):
SCSI: scsi_transport_sas: move bsg destructor into sas_rphy_remove
Johan Hovold (1):
USB: io_ti: fix firmware download on big-endian machines (part 2)
Johannes Berg (1):
Documentation: fix DOCBOOKS=... building
Justin Maggard (1):
btrfs: fix defrag 32-bit integer overflow
Jérôme Carretero (1):
ahci: Add Device ID for HighPoint RocketRaid 642L
Lai Jiangshan (1):
sched: Fix hotplug vs. set_cpus_allowed_ptr()
Larry Finger (1):
rtlwifi: rtl8192se: Fix regression due to commit 1bf4bbb
Laurent Pinchart (1):
ARM: OMAP3: clock: Back-propagate rate change from cam_mclk to
dpll4_m5 on all OMAP3 platforms
Markos Chandras (1):
MIPS: asm: thread_info: Add _TIF_SECCOMP flag
Martin K. Petersen (1):
libata: Blacklist queued trim for Crucial M500
Mathias Nyman (2):
xhci: delete endpoints from bandwidth list before freeing whole device
usb: pci-quirks: Prevent Sony VAIO t-series from switching usb ports
Michael S. Tsirkin (5):
skbuff: skb_segment: s/frag/nskb_frag/
skbuff: skb_segment: s/skb_frag/frag/
skbuff: skb_segment: s/skb/head_skb/
skbuff: skb_segment: s/fskb/list_skb/
skbuff: skb_segment: orphan frags before copying
Michael Welling (1):
gpio: mcp23s08: Bug fix of SPI device tree registration.
Michal Schmidt (2):
netlink: rate-limit leftover bytes warning and print process name
rtnetlink: fix userspace API breakage for iproute2 < v3.9.0
Mimi Zohar (2):
ima: audit log files opened with O_DIRECT flag
evm: prohibit userspace writing 'security.evm' HMAC value
Naoya Horiguchi (1):
mm/memory-failure.c: fix memory leak by race between poison and
unpoison
NeilBrown (2):
md: always set MD_RECOVERY_INTR when aborting a reshape or other
"resync".
md: always set MD_RECOVERY_INTR when interrupting a reshape thread.
Nicholas Bellinger (6):
target: Fix NULL pointer dereference for XCOPY in target_put_sess_cmd
iser-target: Add missing target_put_sess_cmd for ImmedateData failure
target: Fix alua_access_state attribute OOPs for un-configured devices
iser-target: Fix multi network portal shutdown regression
target: Allow READ_CAPACITY opcode in ALUA Standby access state
iscsi-target: Reject mutual authentication with reflected CHAP_C
Peter Ujfalusi (1):
ARM: omap5: hwmod_data: Correct IDLEMODE for McPDM
Peter Zijlstra (2):
perf: Limit perf_event_attr::sample_period to 63 bits
perf: Fix race in removing an event
Rabin Vincent (1):
ARM: 8064/1: fix v7-M signal return
Robert Backhaus (1):
[media] Add USB IDs for Winfast DTV Dongle Mini-D
Ronan Marquet (1):
ALSA: hda/realtek - Correction of fixup codes for PB V7900 laptop
Sagi Grimberg (1):
Target/iscsi,iser: Avoid accepting transport connections during stop
stage
Sebastian Ott (1):
percpu-refcount: fix usage of this_cpu_ops
Sergei Shtylyov (1):
sh_eth: fix SH7619/771x support
Steven Rostedt (Red Hat) (1):
sched: Use CPUPRI_NR_PRIORITIES instead of MAX_RT_PRIO in cpupri check
Takashi Iwai (2):
ALSA: hda/analog - Fix silent output on ASUS A8JN
ALSA: hda/realtek - Fix COEF widget NID for ALC260 replacer fixup
Thomas Gleixner (1):
sched: Sanitize irq accounting madness
Till Dörges (1):
rtl28xxu: add ID [0ccd:00b4] TerraTec NOXON DAB Stick (rev 3)
Tom Gundersen (1):
net: tunnels - enable module autoloading
Tomas Winkler (1):
mei: me: drop harmful wait optimization
Toshiaki Makita (1):
bridge: Prevent insertion of FDB entry with disallowed vlan
Ville Syrjälä (1):
drm/i915: Allow user modes to exceed DVI 165MHz limit
Vlastimil Babka (3):
mm: compaction: reset cached scanner pfn's before reading them
mm: compaction: detect when scanners meet in isolate_freepages mm/compaction: make isolate_freepages start at pageblock boundary
Will Deacon (1):
ARM: perf: hook up perf_sample_event_took around pmu irq handling
Xufeng Zhang (1):
sctp: Fix sk_ack_backlog wrap-around problem
Yuchung Cheng (1):
tcp: fix cwnd undo on DSACK in F-RTO
Documentation/ABI/testing/ima_policy | 2 +- Documentation/DocBook/media/Makefile | 2 +- arch/arm/include/asm/uaccess.h | 3 +- arch/arm/kernel/entry-header.S | 4 + arch/arm/kernel/perf_event.c | 11 ++- arch/arm/mach-at91/sysirq_mask.c | 22 +++-- arch/arm/mach-imx/devices/platform-ipu-core.c | 2 +- arch/arm/mach-omap2/cclock3xxx_data.c | 3 +- arch/arm/mach-omap2/omap_hwmod_54xx_data.c | 2 +- arch/mips/include/asm/thread_info.h | 2 +- arch/sparc/net/bpf_jit_comp.c | 8 +- crypto/crypto_user.c | 2 +- drivers/ata/ahci.c | 4 + drivers/ata/libata-core.c | 8 +- drivers/block/floppy.c | 2 +- drivers/connector/cn_proc.c | 2 +- drivers/cpufreq/cpufreq_governor.c | 6 ++ drivers/gpio/gpio-mcp23s08.c | 11 ++- drivers/gpu/drm/i915/i915_gem_execbuffer.c | 54 +++++++----- drivers/gpu/drm/i915/i915_gem_stolen.c | 2 +- drivers/gpu/drm/i915/intel_hdmi.c | 9 +- drivers/gpu/drm/nouveau/core/engine/disp/nvd0.c | 2 +- drivers/gpu/drm/radeon/radeon_bios.c | 14 +++ drivers/gpu/drm/radeon/radeon_cs.c | 15 +++- drivers/gpu/drm/radeon/radeon_object.c | 38 +++++---- drivers/hwmon/Kconfig | 2 +- drivers/hwmon/ntc_thermistor.c | 15 ++-- drivers/infiniband/ulp/isert/ib_isert.c | 10 +++ drivers/iommu/intel-iommu.c | 18 +++- drivers/md/dm-cache-target.c | 2 + drivers/md/md.c | 5 +- drivers/media/dvb-core/dvb-usb-ids.h | 4 + drivers/media/usb/dvb-usb-v2/rtl28xxu.c | 18 ++++ drivers/misc/mei/hw-me.c | 4 +- drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c | 1 + drivers/net/ethernet/renesas/sh_eth.c | 31 +++++-- drivers/net/ethernet/renesas/sh_eth.h | 2 - drivers/net/macvlan.c | 1 - drivers/net/team/team.c | 7 +- drivers/net/usb/qmi_wwan.c | 7 +- drivers/net/vxlan.c | 7 +- drivers/net/wireless/ath/ath9k/xmit.c | 4 +- drivers/net/wireless/rtlwifi/rtl8192se/trx.c | 6 ++ drivers/rtc/rtc-at91rm9200.c | 16 +++- drivers/scsi/scsi_netlink.c | 2 +- drivers/scsi/scsi_transport_sas.c | 3 +- drivers/staging/comedi/drivers/ni_daq_700.c | 2 + drivers/staging/speakup/main.c | 1 + drivers/staging/speakup/selection.c | 52 +++++++++-- drivers/staging/speakup/speakup.h | 1 + drivers/target/iscsi/iscsi_target.c | 1 + drivers/target/iscsi/iscsi_target_auth.c | 10 +++ drivers/target/iscsi/iscsi_target_core.h | 1 + drivers/target/iscsi/iscsi_target_login.c | 1 + drivers/target/iscsi/iscsi_target_tpg.c | 2 + drivers/target/target_core_alua.c | 9 ++ drivers/target/target_core_configfs.c | 5 ++ drivers/target/target_core_transport.c | 4 + drivers/tty/tty_buffer.c | 2 + drivers/usb/core/driver.c | 9 +- drivers/usb/core/hub.c | 15 +++- drivers/usb/host/pci-quirks.c | 7 ++ drivers/usb/host/xhci-mem.c | 20 ++--- drivers/usb/host/xhci-pci.c | 8 +- drivers/usb/serial/ftdi_sio.c | 2 + drivers/usb/serial/ftdi_sio_ids.h | 5 ++ drivers/usb/serial/io_ti.c | 2 +- drivers/usb/serial/io_usbvend.h | 2 +- drivers/usb/serial/option.c | 2 + fs/attr.c | 8 +- fs/btrfs/ioctl.c | 6 +- fs/inode.c | 10 ++- fs/namei.c | 11 +-- fs/xfs/xfs_ioctl.c | 2 +- include/linux/capability.h | 2 +- include/linux/if_team.h | 1 + include/linux/netlink.h | 14 ++- include/linux/percpu-refcount.h | 6 +- include/linux/sock_diag.h | 2 +- include/net/inetpeer.h | 9 +- include/net/sock.h | 5 ++ include/uapi/linux/usb/Kbuild | 1 + include/uapi/linux/usb/cdc-wdm.h | 2 + kernel/audit.c | 4 +- kernel/auditsc.c | 27 ++++-- kernel/capability.c | 20 ++--- kernel/cpu.c | 6 +- kernel/events/core.c | 63 +++++++++----- kernel/sched/core.c | 1 - kernel/sched/cpupri.c | 3 +- kernel/sched/cputime.c | 32 +++---- lib/nlattr.c | 4 +- mm/compaction.c | 57 ++++++++----- mm/memory-failure.c | 2 + mm/rmap.c | 3 +- net/bridge/br_input.c | 4 +- net/bridge/br_private.h | 7 ++ net/bridge/br_vlan.c | 28 ++++++ net/can/gw.c | 4 +- net/core/dev.c | 5 +- net/core/rtnetlink.c | 43 +++++++--- net/core/skbuff.c | 109 +++++++++++++----------- net/core/sock.c | 49 +++++++++++ net/core/sock_diag.c | 4 +- net/dcb/dcbnl.c | 2 +- net/decnet/dn_dev.c | 4 +- net/decnet/dn_fib.c | 4 +- net/decnet/netfilter/dn_rtmsg.c | 2 +- net/ipv4/datagram.c | 20 +++-- net/ipv4/ipip.c | 5 +- net/ipv4/tcp_input.c | 11 ++- net/ipv6/ip6_tunnel.c | 1 + net/ipv6/output_core.c | 11 +-- net/ipv6/sit.c | 5 +- net/mac80211/iface.c | 1 - net/netfilter/nfnetlink.c | 2 +- net/netlink/af_netlink.c | 80 +++++++++++++++-- net/netlink/genetlink.c | 2 +- net/packet/diag.c | 7 +- net/phonet/pn_netlink.c | 8 +- net/sched/act_api.c | 2 +- net/sched/cls_api.c | 2 +- net/sched/sch_api.c | 6 +- net/sctp/associola.c | 2 +- net/tipc/netlink.c | 2 +- net/xfrm/xfrm_user.c | 2 +- security/integrity/evm/evm_main.c | 12 ++- security/integrity/ima/ima_api.c | 9 +- security/integrity/ima/ima_crypto.c | 32 ++++++- security/integrity/ima/ima_main.c | 5 +- security/integrity/ima/ima_policy.c | 6 +- security/integrity/integrity.h | 1 + sound/pci/hda/patch_analog.c | 1 + sound/pci/hda/patch_realtek.c | 10 +-- 134 files changed, 964 insertions(+), 405 deletions(-)
Signature · 1 line
2.0.0
PATCH 1/111 ath9k: Fix sequence number assignment for non-data frames
From: Helmut Schaa <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 5998be879719384af2014b79697eed6e38ee2706 upstream.
Since commit 558ff225de80ac95b132d3a115ddadcd64498b4f (ath9k: fix ps-poll responses under a-mpdu sessions) non-data frames would have gotten a sequence number from a TIDs sequence counter instead of using the global sequence counter.
This can lead to instable connections.
To fix this only select the correct TID if we are processing a data frame. Furthermore, prevent non-data frames to get a sequence number from a TID sequence counter by adding a check to ath_tx_setup_buffer.
--- drivers/net/wireless/ath/ath9k/xmit.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/ath/ath9k/xmit.c +2 -2
@@ -2078,7 +2078,7 @@ static struct ath_buf *ath_tx_setup_buffer(struct ath_softc *sc,ATH_TXBUF_RESET (bf); -if (tid) { +if (tid &&ieee80211_is_data_present (hdr->frame_control)) { fragno =le16_to_cpu (hdr->seq_ctrl) &IEEE80211_SCTL_FRAG ; seqno = tid->seq_next; hdr->seq_ctrl =cpu_to_le16 (tid->seq_next <<IEEE80211_SEQ_SEQ_SHIFT );
@@ -2201,7 +2201,7 @@ int ath_tx_start(struct ieee80211_hw *hw, struct sk_buff *skb, txq->stopped = true; } -if (txctl->an) +if (txctl->an &&ieee80211_is_data_present (hdr->frame_control)) tid =ath_get_skb_tid (sc, txctl->an, skb);if (info->flags &IEEE80211_TX_CTL_PS_RESPONSE ) {
Signature · 1 line
2.0.0
PATCH 2/111 rtlwifi: rtl8192se: Fix regression due to commit 1bf4bbb
From: Larry Finger <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 5f9186990ec4579ee5b7a99b3254c29eda479f36 upstream.
Beginning with kernel 3.13, this driver fails on some systems. The problem was bisected to:
Commit 1bf4bbb4024dcdab5e57634dd8ae1072d42a53ac
Author: Felix Fietkau <[email protected]>
Title: mac80211: send control port protocol frames to the VO queue
There is noting wrong with the above commit. The regression occurs because V0 queue on RTL8192SE cards uses priority 6, not the usual 7. The fix is to modify the rtl8192se routine that sets the correct transmit queue.
--- drivers/net/wireless/rtlwifi/rtl8192se/trx.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/net/wireless/rtlwifi/rtl8192se/trx.c +6 -0
@@ -49,6 +49,12 @@ static u8 _rtl92se_map_hwqueue_to_fwqueue(struct sk_buff *skb, u8 skb_queue)if (ieee80211_is_nullfunc (fc))return QSLT_HIGH ; +/* Kernel commit 1bf4bbb4024dcdab changed EAPOL packets to use +* queue V0 at priority 7; however, the RTL8192SE appears to have +* that queue at priority 6 +*/ +if (skb->priority ==7 ) +return QSLT_VO ;return skb->priority; }
Signature · 1 line
2.0.0
PATCH 3/111 xhci: extend quirk for Renesas cards
In reply to Jiri SlabyFrom: Igor Gnatenko <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 6db249ebefc6bf5c39f35dfaacc046d8ad3ffd70 upstream.
After suspend another Renesas PCI-X USB 3.0 card doesn't work. [root@fedora-20 ~]# lspci -vmnnd 1912:
Device: 03:00.0
Class: USB controller [0c03]
Vendor: Renesas Technology Corp. [1912]
Device: uPD720202 USB 3.0 Host Controller [0015]
SVendor: Renesas Technology Corp. [1912]
SDevice: uPD720202 USB 3.0 Host Controller [0015]
Rev: 02
ProgIf: 30
This patch should be applied to stable kernel 3.14 that contain the commit 1aa9578c1a9450fb21501c4f549f5b1edb557e6d "xhci: Fix resume issues on Renesas chips in Samsung laptops"
Reference: http://redmine.russianfedora.pro/issues/1315
--- drivers/usb/host/xhci-pci.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/usb/host/xhci-pci.c +1 -3
@@ -145,9 +145,7 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) xhci->quirks |=XHCI_TRUST_TX_LENGTH ; }if (pdev->vendor ==PCI_VENDOR_ID_RENESAS && - pdev->device ==0x0015 && - pdev->subsystem_vendor ==PCI_VENDOR_ID_SAMSUNG && - pdev->subsystem_device ==0xc0cd ) + pdev->device ==0x0015 ) xhci->quirks |=XHCI_RESET_ON_RESUME ;if (pdev->vendor ==PCI_VENDOR_ID_VIA ) xhci->quirks |=XHCI_RESET_ON_RESUME ;
Signature · 1 line
2.0.0
PATCH 4/111 drm/i915: restrict vt-d stolen memory workaround to pre-gen8
In reply to Jiri SlabyFrom: Daniel Vetter <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit fcc9fe1a5ad2b826c6ac58c03cdc0cf17a63c7a1 upstream.
We want future generations to at least attempt to use all features, so restrict the stolen memory disabling when vt-d is enabled to the latest generation we have reports for. Which is a HSW per the original report.
Also once we get a bit a hold of some of the mysterious framebuffer in stolen memory issues that still haunt bugzilla, we should probably drop this hack again and see what happens.
This was introduced in
commit 0f4706d2740f2a221cd502922b22e522009041d9
Author: Chris Wilson <[email protected]> Date: Tue Mar 18 14:50:50 2014 +0200
drm/i915: Disable stolen memory when DMAR is active
Cc: Chris Wilson <[email protected]>
Cc: Jani Nikula <[email protected]>
Cc: David Woodhouse <[email protected]>
References: https://bugs.freedesktop.org/show_bug.cgi?id=68535
--- drivers/gpu/drm/i915/i915_gem_stolen.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/i915/i915_gem_stolen.c +1 -1
@@ -202,7 +202,7 @@ int i915_gem_init_stolen(struct drm_device *dev)int bios_reserved =0 ;#ifdef CONFIG_INTEL_IOMMU -if (intel_iommu_gfx_mapped) { +if (intel_iommu_gfx_mapped &&INTEL_INFO (dev)->gen <8 ) {DRM_INFO ("DMAR active, disabling use of stolen memory\n" );return 0 ; }
Signature · 1 line
2.0.0
PATCH 5/111 floppy: do not corrupt bio.bi_flags when reading block 0
In reply to Jiri SlabyFrom: Jiri Kosina <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 6314a108ec19aefa5160535b2bfe1ca9c38efe37 upstream.
Commit 41a55b4de39 ("floppy: silence warning during disk test") caused bio.bi_flags being overwritten, and its initialization to BIO_UPTODATE in bio_init() to be lost.
This was unnoticed until 7b7b68bba5 ("floppy: bail out in open() if drive is not responding to block0 read"), because the error value wasn't checked for in the bio completion callback.
Now we are actually looking at the error, and the loss of BIO_UPTODATE causes EIO to be wrongly passed to the callback, which confuses the FD_OPEN_SHOULD_FAIL_BIT logic.
Fix this by not destroying previous value of bi_flags when setting BIO_QUIET.
--- drivers/block/floppy.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/block/floppy.c +1 -1
@@ -3798,7 +3798,7 @@ static int __floppy_read_block_0(struct block_device *bdev, int drive) bio.bi_size = size; bio.bi_bdev = bdev; bio.bi_sector =0 ; - bio.bi_flags = (1 <<BIO_QUIET ); + bio.bi_flags |= (1 <<BIO_QUIET ); bio.bi_private = &cbdata; bio.bi_end_io = floppy_rb0_cb;
Signature · 1 line
2.0.0
PATCH 6/111 xhci: Switch only Intel Lynx Point-LP ports to EHCI on shutdown.
In reply to Jiri SlabyFrom: Denis Turischev <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 0a939993bff117d3657108ca13b011fc0378aedb upstream.
Patch "xhci: Switch Intel Lynx Point ports to EHCI on shutdown." commit c09ec25d3684cad74d851c0f028a495999591279 is not fully correct
It switches both Lynx Point and Lynx Point-LP ports to EHCI on shutdown. On some Lynx Point machines it causes spurious interrupt, which wake the system: bugzilla.kernel.org/show_bug.cgi?id=76291
On Lynx Point-LP on the contrary switching ports to EHCI seems to be necessary to fix these spurious interrupts.
--- drivers/usb/host/xhci-pci.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/host/xhci-pci.c +3 -1
@@ -134,7 +134,9 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)*/ if (pdev->subsystem_vendor ==PCI_VENDOR_ID_HP ) xhci->quirks |=XHCI_SPURIOUS_WAKEUP ; - + } +if (pdev->vendor ==PCI_VENDOR_ID_INTEL && + pdev->device ==PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI ) { xhci->quirks |=XHCI_SPURIOUS_REBOOT ; } if (pdev->vendor == PCI_VENDOR_ID_ETRON &&
Signature · 1 line
2.0.0
PATCH 7/111 MIPS: asm: thread_info: Add _TIF_SECCOMP flag
In reply to Jiri SlabyFrom: Markos Chandras <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 137f7df8cead00688524c82360930845396b8a21 upstream.
Add _TIF_SECCOMP flag to _TIF_WORK_SYSCALL_ENTRY to indicate that the system call needs to be checked against a seccomp filter.
Patchwork: https://patchwork.linux-mips.org/patch/6405/
--- arch/mips/include/asm/thread_info.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/mips/include/asm/thread_info.h +1 -1
@@ -134,7 +134,7 @@ static inline struct thread_info *current_thread_info(void)#define _TIF_LOAD_WATCH (1<<TIF_LOAD_WATCH)#define _TIF_WORK_SYSCALL_ENTRY (_TIF_NOHZ | _TIF_SYSCALL_TRACE | \ - _TIF_SYSCALL_AUDIT) + _TIF_SYSCALL_AUDIT | _TIF_SECCOMP)/* work to do in syscall_trace_leave() */ #define _TIF_WORK_SYSCALL_EXIT (_TIF_NOHZ | _TIF_SYSCALL_TRACE | \
Signature · 1 line
2.0.0
PATCH 8/111 btrfs: fix defrag 32-bit integer overflow
In reply to Jiri SlabyFrom: Justin Maggard <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit c41570c9d29764f797fa35490d72b7395a0105c3 upstream.
When defragging a very large file, the cluster variable can wrap its 32-bit signed int type and become negative, which eventually gets passed to btrfs_force_ra() as a very large unsigned long value. On 32-bit platforms, this eventually results in an Oops from the SLAB allocator.
Change the cluster and max_cluster signed int variables to unsigned long to match the readahead functions. This also allows the min() comparison in btrfs_defrag_file() to work as intended.
--- fs/btrfs/ioctl.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
fs/btrfs/ioctl.c +3 -3
@@ -1014,7 +1014,7 @@ out:static int cluster_pages_for_defrag (struct inode *inode,struct page **pages,unsigned long start_index, -int num_pages) +unsigned long num_pages) {unsigned long file_end;u64 isize =i_size_read (inode);
@@ -1172,8 +1172,8 @@ int btrfs_defrag_file(struct inode *inode, struct file *file,int defrag_count =0 ;int compress_type =BTRFS_COMPRESS_ZLIB ;int extent_thresh = range->extent_thresh; -int max_cluster = (256 *1024 ) >>PAGE_CACHE_SHIFT ; -int cluster = max_cluster; +unsigned long max_cluster = (256 *1024 ) >>PAGE_CACHE_SHIFT ; +unsigned long cluster = max_cluster;u64 new_align = ~((u64 )128 *1024 -1 );struct page **pages =NULL ;
Signature · 1 line
2.0.0
PATCH 9/111 target: Fix NULL pointer dereference for XCOPY in target_put_sess_cmd
In reply to Jiri SlabyFrom: Nicholas Bellinger <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 0ed6e189e3f6ac3a25383ed5cc8b0ac24c9b97b7 upstream.
This patch fixes a NULL pointer dereference regression bug that was introduced with:
commit 1e1110c43b1cda9fe77fc4a04835e460550e6b3c
Author: Mikulas Patocka <[email protected]> Date: Sat May 17 06:49:22 2014 -0400
target: fix memory leak on XCOPY
Now that target_put_sess_cmd() -> kref_put_spinlock_irqsave() is called with a valid se_cmd->cmd_kref, a NULL pointer dereference is triggered because the XCOPY passthrough commands don't have an associated se_session pointer.
To address this bug, go ahead and checking for a NULL se_sess pointer within target_put_sess_cmd(), and call se_cmd->se_tfo->release_cmd() to release the XCOPY's xcopy_pt_cmd memory.
--- drivers/target/target_core_transport.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/target/target_core_transport.c +4 -0
@@ -2343,6 +2343,10 @@ static void target_release_cmd_kref(struct kref *kref)*/ int target_put_sess_cmd (struct se_session *se_sess,struct se_cmd *se_cmd) { +if (!se_sess) { + se_cmd->se_tfo->release_cmd (se_cmd); +return 1 ; + }return kref_put_spinlock_irqsave (&se_cmd->cmd_kref, target_release_cmd_kref, &se_sess->sess_cmd_lock); }
Signature · 1 line
2.0.0
PATCH 10/111 mm: compaction: reset cached scanner pfn's before reading them
In reply to Jiri SlabyFrom: Vlastimil Babka <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit d3132e4b83e6bd383c74d716f7281d7c3136089c upstream.
Compaction caches pfn's for its migrate and free scanners to avoid scanning the whole zone each time. In compact_zone(), the cached values are read to set up initial values for the scanners. There are several situations when these cached pfn's are reset to the first and last pfn of the zone, respectively. One of these situations is when a compaction has been deferred for a zone and is now being restarted during a direct compaction, which is also done in compact_zone().
However, compact_zone() currently reads the cached pfn's *before* resetting them. This means the reset doesn't affect the compaction that performs it, and with good chance also subsequent compactions, as update_pageblock_skip() is likely to be called and update the cached pfn's to those being processed. Another chance for a successful reset is when a direct compaction detects that migration and free scanners meet (which has its own problems addressed by another patch) and sets update_pageblock_skip flag which kswapd uses to do the reset because it goes to sleep.
This is clearly a bug that results in non-deterministic behavior, so this patch moves the cached pfn reset to be performed *before* the values are read.
--- mm/compaction.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
mm/compaction.c +8 -8
@@ -954,6 +954,14 @@ static int compact_zone(struct zone *zone, struct compact_control *cc) }/* +* Clear pageblock skip if there were failures recently and compaction +* is about to be retried after being deferred. kswapd does not do +* this reset as it'll reset the cached information when going to sleep. +*/ +if (compaction_restarting (zone, cc->order) && !current_is_kswapd ()) +__reset_isolation_suitable (zone); + +/* * Setup to move all movable pages to the end of the zone. Used cached * information on where the scanners should start but check that it * is initialised by ensuring the values are within zone boundaries.
@@ -969,14 +977,6 @@ static int compact_zone(struct zone *zone, struct compact_control *cc) zone->compact_cached_migrate_pfn = cc->migrate_pfn; } -/* -* Clear pageblock skip if there were failures recently and compaction -* is about to be retried after being deferred. kswapd does not do -* this reset as it'll reset the cached information when going to sleep. -*/ -if (compaction_restarting (zone, cc->order) && !current_is_kswapd ()) -__reset_isolation_suitable (zone); -migrate_prep_local ();while ((ret =compact_finished (zone, cc)) ==COMPACT_CONTINUE ) {
Signature · 1 line
2.0.0
PATCH 11/111 mm: compaction: detect when scanners meet in isolate_freepages
In reply to Jiri SlabyFrom: Vlastimil Babka <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 7ed695e069c3cbea5e1fd08f84a04536da91f584 upstream.
Compaction of a zone is finished when the migrate scanner (which begins at the zone's lowest pfn) meets the free page scanner (which begins at the zone's highest pfn). This is detected in compact_zone() and in the case of direct compaction, the compact_blockskip_flush flag is set so that kswapd later resets the cached scanner pfn's, and a new compaction may again start at the zone's borders.
The meeting of the scanners can happen during either scanner's activity. However, it may currently fail to be detected when it occurs in the free page scanner, due to two problems. First, isolate_freepages() keeps free_pfn at the highest block where it isolated pages from, for the purposes of not missing the pages that are returned back to allocator when migration fails. Second, failing to isolate enough free pages due to scanners meeting results in -ENOMEM being returned by migrate_pages(), which makes compact_zone() bail out immediately without calling compact_finished() that would detect scanners meeting.
This failure to detect scanners meeting might result in repeated attempts at compaction of a zone that keep starting from the cached pfn's close to the meeting point, and quickly failing through the -ENOMEM path, without the cached pfns being reset, over and over. This has been observed (through additional tracepoints) in the third phase of the mmtests stress-highalloc benchmark, where the allocator runs on an otherwise idle system. The problem was observed in the DMA32 zone, which was used as a fallback to the preferred Normal zone, but on the 4GB system it was actually the largest zone. The problem is even amplified for such fallback zone - the deferred compaction logic, which could (after being fixed by a previous patch) reset the cached scanner pfn's, is only applied to the preferred zone and not for the fallbacks.
The problem in the third phase of the benchmark was further amplified by commit 81c0a2bb515f ("mm: page_alloc: fair zone allocator policy") which resulted in a non-deterministic regression of the allocation success rate from ~85% to ~65%. This occurs in about half of benchmark runs, making bisection problematic. It is unlikely that the commit itself is buggy, but it should put more pressure on the DMA32 zone during phases 1 and 2, which may leave it more fragmented in phase 3 and expose the bugs that this patch fixes.
The fix is to make scanners meeting in isolate_freepage() stay that way, and to check in compact_zone() for scanners meeting when migrate_pages() returns -ENOMEM. The result is that compact_finished() also detects scanners meeting and sets the compact_blockskip_flush flag to make kswapd reset the scanner pfn's.
The results in stress-highalloc benchmark show that the "regression" by commit 81c0a2bb515f in phase 3 no longer occurs, and phase 1 and 2 allocation success rates are also significantly improved.
--- mm/compaction.c | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-)
mm/compaction.c +15 -4
@@ -667,7 +667,7 @@ static void isolate_freepages(struct zone *zone,* is the end of the pageblock the migration scanner is using. */ pfn = cc->free_pfn; - low_pfn = cc->migrate_pfn + pageblock_nr_pages; + low_pfn =ALIGN (cc->migrate_pfn +1 , pageblock_nr_pages);/* * Take care that if the migration scanner is at the end of the zone
@@ -683,7 +683,7 @@ static void isolate_freepages(struct zone *zone,* pages on cc->migratepages. We stop searching if the migrate * and free page scanners meet or enough free pages are isolated. */ -for (; pfn > low_pfn && cc->nr_migratepages > nr_freepages; +for (; pfn >= low_pfn && cc->nr_migratepages > nr_freepages; pfn -= pageblock_nr_pages) {unsigned long isolated;
@@ -745,7 +745,14 @@ static void isolate_freepages(struct zone *zone,/* split_free_page does not map the pages */ map_pages (freelist); - cc->free_pfn = high_pfn; +/* +* If we crossed the migrate scanner, we want to keep it that way +* so that compact_finished() may detect this +*/ +if (pfn < low_pfn) + cc->free_pfn =max (pfn, zone->zone_start_pfn); +else + cc->free_pfn = high_pfn; cc->nr_freepages = nr_freepages; }
@@ -1010,7 +1017,11 @@ static int compact_zone(struct zone *zone, struct compact_control *cc)if (err) {putback_movable_pages (&cc->migratepages); cc->nr_migratepages =0 ; -if (err == -ENOMEM ) { +/* +* migrate_pages() may return -ENOMEM when scanners meet +* and we want compact_finished() to detect it +*/ +if (err == -ENOMEM && cc->free_pfn > cc->migrate_pfn) { ret =COMPACT_PARTIAL ; goto out; }
Signature · 1 line
2.0.0
PATCH 12/111 mm/compaction: make isolate_freepages start at pageblock boundary
In reply to Jiri SlabyFrom: Vlastimil Babka <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 49e068f0b73dd042c186ffa9b420a9943e90389a upstream.
The compaction freepage scanner implementation in isolate_freepages() starts by taking the current cc->free_pfn value as the first pfn. In a for loop, it scans from this first pfn to the end of the pageblock, and then subtracts pageblock_nr_pages from the first pfn to obtain the first pfn for the next for loop iteration.
This means that when cc->free_pfn starts at offset X rather than being aligned on pageblock boundary, the scanner will start at offset X in all scanned pageblock, ignoring potentially many free pages. Currently this can happen when
a) zone's end pfn is not pageblock aligned, or
b) through zone->compact_cached_free_pfn with CONFIG_HOLES_IN_ZONE enabled and a hole spanning the beginning of a pageblock
This patch fixes the problem by aligning the initial pfn in isolate_freepages() to pageblock boundary. This also permits replacing the end-of-pageblock alignment within the for loop with a simple pageblock_nr_pages increment.
--- mm/compaction.c | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-)
mm/compaction.c +12 -10
@@ -657,16 +657,20 @@ static void isolate_freepages(struct zone *zone, struct compact_control *cc) {struct page *page; -unsigned long high_pfn, low_pfn, pfn, z_end_pfn, end_pfn; +unsigned long high_pfn, low_pfn, pfn, z_end_pfn;int nr_freepages = cc->nr_freepages;struct list_head *freelist = &cc->freepages;/* * Initialise the free scanner. The starting point is where we last -* scanned from (or the end of the zone if starting). The low point -* is the end of the pageblock the migration scanner is using. +* successfully isolated from, zone-cached value, or the end of the +* zone when isolating for the first time. We need this aligned to +* the pageblock boundary, because we do pfn -= pageblock_nr_pages +* in the for loop. +* The low boundary is the end of the pageblock the migration scanner +* is using. */ - pfn = cc->free_pfn; + pfn = cc->free_pfn & ~(pageblock_nr_pages-1 ); low_pfn =ALIGN (cc->migrate_pfn +1 , pageblock_nr_pages);/*
@@ -686,6 +690,7 @@ static void isolate_freepages(struct zone *zone,for (; pfn >= low_pfn && cc->nr_migratepages > nr_freepages; pfn -= pageblock_nr_pages) {unsigned long isolated; +unsigned long end_pfn;/* * This can iterate a massively long zone without finding any
@@ -720,13 +725,10 @@ static void isolate_freepages(struct zone *zone, isolated =0 ;/* -* As pfn may not start aligned, pfn+pageblock_nr_page -* may cross a MAX_ORDER_NR_PAGES boundary and miss -* a pfn_valid check. Ensure isolate_freepages_block() -* only scans within a pageblock +* Take care when isolating in last pageblock of a zone which +* ends in the middle of a pageblock. */ - end_pfn =ALIGN (pfn +1 , pageblock_nr_pages); - end_pfn =min (end_pfn, z_end_pfn); + end_pfn =min (pfn + pageblock_nr_pages, z_end_pfn); isolated =isolate_freepages_block (cc, pfn, end_pfn, freelist, false); nr_freepages += isolated;
Signature · 1 line
2.0.0
PATCH 13/111 ARM: perf: hook up perf_sample_event_took around pmu irq handling
In reply to Jiri SlabyFrom: Will Deacon <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 5f5092e72cc25a6a5785308270e0085b2b2772cc upstream.
Since we indirect all of our PMU IRQ handling through a dispatcher, it's trivial to hook up perf_sample_event_took to prevent applications such as oprofile from generating interrupt storms due to an unrealisticly low sample period.
--- arch/arm/kernel/perf_event.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
arch/arm/kernel/perf_event.c +9 -2
@@ -303,11 +303,18 @@ static irqreturn_t armpmu_dispatch_irq(int irq, void *dev)struct arm_pmu *armpmu = (struct arm_pmu *) dev;struct platform_device *plat_device = armpmu->plat_device;struct arm_pmu_platdata *plat =dev_get_platdata (&plat_device->dev); +int ret; +u64 start_clock, finish_clock; + start_clock =sched_clock ();if (plat && plat->handle_irq) -return plat->handle_irq (irq, dev, armpmu->handle_irq); + ret = plat->handle_irq (irq, dev, armpmu->handle_irq);else -return armpmu->handle_irq (irq, dev); + ret = armpmu->handle_irq (irq, dev); + finish_clock =sched_clock (); + +perf_sample_event_took (finish_clock - start_clock); +return ret; } static void
Signature · 1 line
2.0.0
PATCH 14/111 iommu/vt-d: Fix missing IOTLB flush in intel_iommu_unmap()
In reply to Jiri SlabyFrom: David Woodhouse <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
This is a small excerpt of the upstream commit ea8ea460c9ace60bbb5ac6e5521d637d5c15293d (iommu/vt-d: Clean up and fix page table clear/free behaviour).
This missing IOTLB flush was added as a minor, inconsequential bug-fix in commit ea8ea460c ("iommu/vt-d: Clean up and fix page table clear/free behaviour") in 3.15. It wasn't originally intended for -stable but a couple of users have reported issues which turn out to be fixed by adding the missing flush.
--- drivers/iommu/intel-iommu.c | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-)
drivers/iommu/intel-iommu.c +17 -1
@@ -4117,7 +4117,7 @@ static size_t intel_iommu_unmap(struct iommu_domain *domain, unsigned long iova, size_t size) {struct dmar_domain *dmar_domain = domain->priv; -int order; +int order, iommu_id; order =dma_pte_clear_range (dmar_domain, iova >>VTD_PAGE_SHIFT , (iova + size -1 ) >>VTD_PAGE_SHIFT );
@@ -4125,6 +4125,22 @@ static size_t intel_iommu_unmap(struct iommu_domain *domain,if (dmar_domain->max_addr == iova + size) dmar_domain->max_addr = iova; +for_each_set_bit (iommu_id, dmar_domain->iommu_bmp, g_num_of_iommus) { +struct intel_iommu *iommu = g_iommus[iommu_id]; +int num, ndomains; + +/* +* find bit position of dmar_domain +*/ + ndomains =cap_ndoms (iommu->cap); +for_each_set_bit (num, iommu->domain_ids, ndomains) { +if (iommu->domains[num] == dmar_domain) +iommu_flush_iotlb_psi (iommu, num, + iova >>VTD_PAGE_SHIFT , +1 << order,0 ); + } + } +return PAGE_SIZE << order; }
Signature · 1 line
2.0.0
PATCH 15/111 sched: Use CPUPRI_NR_PRIORITIES instead of MAX_RT_PRIO in cpupri check
In reply to Jiri SlabyFrom: "Steven Rostedt (Red Hat)" <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 6227cb00cc120f9a43ce8313bb0475ddabcb7d01 upstream.
The check at the beginning of cpupri_find() makes sure that the task_pri variable does not exceed the cp->pri_to_cpu array length. But that length is CPUPRI_NR_PRIORITIES not MAX_RT_PRIO, where it will miss the last two priorities in that array.
As task_pri is computed from convert_prio() which should never be bigger than CPUPRI_NR_PRIORITIES, if the check should cause a panic if it is hit.
--- kernel/sched/cpupri.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
kernel/sched/cpupri.c +1 -2
@@ -70,8 +70,7 @@ int cpupri_find(struct cpupri *cp, struct task_struct *p,int idx =0 ;int task_pri =convert_prio (p->prio); -if (task_pri >=MAX_RT_PRIO ) -return 0 ; +BUG_ON (task_pri >=CPUPRI_NR_PRIORITIES );for (idx =0 ; idx < task_pri; idx++) {struct cpupri_vec *vec = &cp->pri_to_cpu[idx];
Signature · 1 line
2.0.0
PATCH 16/111 sched: Sanitize irq accounting madness
In reply to Jiri SlabyFrom: Thomas Gleixner <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 2d513868e2a33e1d5315490ef4c861ee65babd65 upstream.
Russell reported, that irqtime_account_idle_ticks() takes ages due to:
for (i = 0; i < ticks; i++)
irqtime_account_process_tick(current, 0, rq);It's sad, that this code was written way _AFTER_ the NOHZ idle functionality was available. I charge myself guitly for not paying attention when that crap got merged with commit abb74cefa ("sched:
Export ns irqtimes through /proc/stat")
So instead of looping nr_ticks times just apply the whole thing at once.
As a side note: The whole cputime_t vs. u64 business in that context wants to be cleaned up as well. There is no point in having all these back and forth conversions. Lets standardise on u64 nsec for all kernel internal accounting and be done with it. Everything else does not make sense at all for fine grained accounting. Frederic, can you please take care of that?
--- kernel/sched/cputime.c | 32 ++++++++++++++++---------------- 1 file changed, 16 insertions(+), 16 deletions(-)
kernel/sched/cputime.c +16 -16
@@ -326,50 +326,50 @@ out:* softirq as those do not count in task exec_runtime any more. */ static void irqtime_account_process_tick (struct task_struct *p,int user_tick, -struct rq *rq) +struct rq *rq,int ticks) { -cputime_t one_jiffy_scaled =cputime_to_scaled (cputime_one_jiffy); +cputime_t scaled =cputime_to_scaled (cputime_one_jiffy); +u64 cputime = (__force u64 ) cputime_one_jiffy;u64 *cpustat = kcpustat_this_cpu->cpustat;if (steal_account_process_tick ())return ; + cputime *= ticks; + scaled *= ticks; +if (irqtime_account_hi_update ()) { - cpustat[CPUTIME_IRQ ] += (__force u64 ) cputime_one_jiffy; + cpustat[CPUTIME_IRQ ] += cputime; }else if (irqtime_account_si_update ()) { - cpustat[CPUTIME_SOFTIRQ ] += (__force u64 ) cputime_one_jiffy; + cpustat[CPUTIME_SOFTIRQ ] += cputime; }else if (this_cpu_ksoftirqd () == p) {/* * ksoftirqd time do not get accounted in cpu_softirq_time. * So, we have to handle it separately here. * Also, p->stime needs to be updated for ksoftirqd. */ -__account_system_time (p, cputime_one_jiffy, one_jiffy_scaled, -CPUTIME_SOFTIRQ ); +__account_system_time (p, cputime, scaled,CPUTIME_SOFTIRQ ); }else if (user_tick) { -account_user_time (p, cputime_one_jiffy, one_jiffy_scaled); +account_user_time (p, cputime, scaled); }else if (p == rq->idle) { -account_idle_time (cputime_one_jiffy); +account_idle_time (cputime); }else if (p->flags &PF_VCPU ) {/* System time or guest time */ -account_guest_time (p, cputime_one_jiffy, one_jiffy_scaled); +account_guest_time (p, cputime, scaled); }else { -__account_system_time (p, cputime_one_jiffy, one_jiffy_scaled, -CPUTIME_SYSTEM ); +__account_system_time (p, cputime, scaled,CPUTIME_SYSTEM ); } }static void irqtime_account_idle_ticks (int ticks) { -int i;struct rq *rq =this_rq (); -for (i =0 ; i < ticks; i++) -irqtime_account_process_tick (current,0 , rq); +irqtime_account_process_tick (current,0 , rq, ticks); }#else /* CONFIG_IRQ_TIME_ACCOUNTING */ static inline void irqtime_account_idle_ticks (int ticks) {}static inline void irqtime_account_process_tick (struct task_struct *p,int user_tick, -struct rq *rq) {} +struct rq *rq,int nr_ticks) {}#endif /* CONFIG_IRQ_TIME_ACCOUNTING */ /*
@@ -458,7 +458,7 @@ void account_process_tick(struct task_struct *p, int user_tick)return ;if (sched_clock_irqtime) { -irqtime_account_process_tick (p, user_tick, rq); +irqtime_account_process_tick (p, user_tick, rq,1 );return ; }
Signature · 1 line
2.0.0
PATCH 17/111 perf: Prevent false warning in perf_swevent_add
In reply to Jiri SlabyFrom: Jiri Olsa <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 39af6b1678afa5880dda7e375cf3f9d395087f6d upstream.
The perf cpu offline callback takes down all cpu context events and releases swhash->swevent_hlist.
This could race with task context software event being just scheduled on this cpu via perf_swevent_add while cpu hotplug code already cleaned up event's data.
The race happens in the gap between the cpu notifier code and the cpu being actually taken down. Note that only cpu ctx events are terminated in the perf cpu hotplug code.
It's easily reproduced with:
$ perf record -e faults perf bench sched pipe
while putting one of the cpus offline:
# echo 0 > /sys/devices/system/cpu/cpu1/online
Console emits following warning:
WARNING: CPU: 1 PID: 2845 at kernel/events/core.c:5672 perf_swevent_add+0x18d/0x1a0() Modules linked in: CPU: 1 PID: 2845 Comm: sched-pipe Tainted: G W 3.14.0+ #256 Hardware name: Intel Corporation Montevina platform/To be filled by O.E.M., BIOS AMVACRB1.86C.0066.B00.0805070703 05/07/2008 0000000000000009 ffff880077233ab8 ffffffff81665a23 0000000000200005 0000000000000000 ffff880077233af8 ffffffff8104732c 0000000000000046 ffff88007467c800 0000000000000002 ffff88007a9cf2a0 0000000000000001 Call Trace: [<ffffffff81665a23>] dump_stack+0x4f/0x7c [<ffffffff8104732c>] warn_slowpath_common+0x8c/0xc0 [<ffffffff8104737a>] warn_slowpath_null+0x1a/0x20 [<ffffffff8110fb3d>] perf_swevent_add+0x18d/0x1a0 [<ffffffff811162ae>] event_sched_in.isra.75+0x9e/0x1f0 [<ffffffff8111646a>] group_sched_in+0x6a/0x1f0 [<ffffffff81083dd5>] ? sched_clock_local+0x25/0xa0 [<ffffffff811167e6>] ctx_sched_in+0x1f6/0x450 [<ffffffff8111757b>] perf_event_sched_in+0x6b/0xa0 [<ffffffff81117a4b>] perf_event_context_sched_in+0x7b/0xc0 [<ffffffff81117ece>] __perf_event_task_sched_in+0x43e/0x460 [<ffffffff81096f1e>] ? put_lock_stats.isra.18+0xe/0x30 [<ffffffff8107b3c8>] finish_task_switch+0xb8/0x100 [<ffffffff8166a7de>] __schedule+0x30e/0xad0 [<ffffffff81172dd2>] ? pipe_read+0x3e2/0x560 [<ffffffff8166b45e>] ? preempt_schedule_irq+0x3e/0x70 [<ffffffff8166b45e>] ? preempt_schedule_irq+0x3e/0x70 [<ffffffff8166b464>] preempt_schedule_irq+0x44/0x70 [<ffffffff816707f0>] retint_kernel+0x20/0x30 [<ffffffff8109e60a>] ? lockdep_sys_exit+0x1a/0x90 [<ffffffff812a4234>] lockdep_sys_exit_thunk+0x35/0x67 [<ffffffff81679321>] ? sysret_check+0x5/0x56
Fixing this by tracking the cpu hotplug state and displaying the WARN only if current cpu is initialized properly.
--- kernel/events/core.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
kernel/events/core.c +12 -1
@@ -5336,6 +5336,9 @@ struct swevent_htable {/* Recursion avoidance in each contexts */ int recursion[PERF_NR_CONTEXTS ]; + +/* Keeps track of cpu being initialized/exited */ +bool online; }; static DEFINE_PER_CPU(struct swevent_htable, swevent_htable);
@@ -5582,8 +5585,14 @@ static int perf_swevent_add(struct perf_event *event, int flags) hwc->state = !(flags &PERF_EF_START ); head =find_swevent_head (swhash, event); -if (WARN_ON_ONCE (!head)) +if (!head) { +/* +* We can race with cpu hotplug code. Do not +* WARN if the cpu just got unplugged. +*/ +WARN_ON_ONCE (swhash->online);return -EINVAL ; + }hlist_add_head_rcu (&event->hlist_entry, head);
@@ -7762,6 +7771,7 @@ static void perf_event_init_cpu(int cpu)struct swevent_htable *swhash = &per_cpu (swevent_htable, cpu);mutex_lock (&swhash->hlist_mutex); + swhash->online = true;if (swhash->hlist_refcount >0 ) {struct swevent_hlist *hlist;
@@ -7819,6 +7829,7 @@ static void perf_event_exit_cpu(int cpu)perf_event_exit_cpu_context (cpu);mutex_lock (&swhash->hlist_mutex); + swhash->online = false;swevent_hlist_release (swhash);mutex_unlock (&swhash->hlist_mutex); }
Signature · 1 line
2.0.0
PATCH 18/111 perf: Limit perf_event_attr::sample_period to 63 bits
In reply to Jiri SlabyFrom: Peter Zijlstra <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 0819b2e30ccb93edf04876237b6205eef84ec8d2 upstream.
Vince reported that using a large sample_period (one with bit 63 set) results in wreckage since while the sample_period is fundamentally unsigned (negative periods don't make sense) the way we implement things very much rely on signed logic.
So limit sample_period to 63 bits to avoid tripping over this.
--- kernel/events/core.c | 3 +++ 1 file changed, 3 insertions(+)
kernel/events/core.c +3 -0
@@ -6956,6 +6956,9 @@ SYSCALL_DEFINE5(perf_event_open,if (attr.freq) {if (attr.sample_freq > sysctl_perf_event_sample_rate)return -EINVAL ; + }else { +if (attr.sample_period & (1ULL <<63 )) +return -EINVAL ; }/*
Signature · 1 line
2.0.0
PATCH 19/111 perf: Fix race in removing an event
In reply to Jiri SlabyFrom: Peter Zijlstra <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 46ce0fe97a6be7532ce6126bb26ce89fed81528c upstream.
When removing a (sibling) event we do:
raw_spin_lock_irq(&ctx->lock); perf_group_detach(event); raw_spin_unlock_irq(&ctx->lock); <hole> perf_remove_from_context(event); raw_spin_lock_irq(&ctx->lock); ... raw_spin_unlock_irq(&ctx->lock);
Now, assuming the event is a sibling, it will be 'unreachable' for things like ctx_sched_out() because that iterates the groups->siblings, and we just unhooked the sibling.
So, if during <hole> we get ctx_sched_out(), it will miss the event and not call event_sched_out() on it, leaving it programmed on the PMU.
The subsequent perf_remove_from_context() call will find the ctx is inactive and only call list_del_event() to remove the event from all other lists.
Hereafter we can proceed to free the event; while still programmed!
Close this hole by moving perf_group_detach() inside the same ctx->lock region(s) perf_remove_from_context() has.
The condition on inherited events only in __perf_event_exit_task() is likely complete crap because non-inherited events are part of groups too and we're tearing down just the same. But leave that for another patch.
Most-likely-Fixes: e03a9a55b4e ("perf: Change close() semantics for group events")
--- kernel/events/core.c | 47 ++++++++++++++++++++++++++--------------------- 1 file changed, 26 insertions(+), 21 deletions(-)
kernel/events/core.c +26 -21
@@ -1426,6 +1426,11 @@ group_sched_out(struct perf_event *group_event, cpuctx->exclusive =0 ; } +struct remove_event { +struct perf_event *event; +bool detach_group; +}; +/* * Cross CPU call to remove a performance event *
@@ -1434,12 +1439,15 @@ group_sched_out(struct perf_event *group_event,*/ static int __perf_remove_from_context (void *info) { -struct perf_event *event = info; +struct remove_event *re = info; +struct perf_event *event = re->event;struct perf_event_context *ctx = event->ctx;struct perf_cpu_context *cpuctx =__get_cpu_context (ctx);raw_spin_lock (&ctx->lock);event_sched_out (event, cpuctx, ctx); +if (re->detach_group) +perf_group_detach (event);list_del_event (event, ctx);if (!ctx->nr_events && cpuctx->task_ctx == ctx) { ctx->is_active =0 ;
@@ -1464,10 +1472,14 @@ static int __perf_remove_from_context(void *info)* When called from perf_event_exit_task, it's OK because the * context has been detached from its task. */ -static void perf_remove_from_context (struct perf_event *event) +static void perf_remove_from_context (struct perf_event *event,bool detach_group) {struct perf_event_context *ctx = event->ctx;struct task_struct *task = ctx->task; +struct remove_event re = { + .event = event, + .detach_group = detach_group, + };lockdep_assert_held (&ctx->mutex);
@@ -1476,12 +1488,12 @@ static void perf_remove_from_context(struct perf_event *event)* Per cpu events are removed via an smp call and * the removal is always successful. */ -cpu_function_call (event->cpu, __perf_remove_from_context, event); +cpu_function_call (event->cpu, __perf_remove_from_context, &re);return ; } retry: -if (!task_function_call (task, __perf_remove_from_context, event)) +if (!task_function_call (task, __perf_remove_from_context, &re))return ;raw_spin_lock_irq (&ctx->lock);
@@ -1498,6 +1510,8 @@ retry:* Since the task isn't running, its safe to remove the event, us * holding the ctx->lock ensures the task won't get scheduled in. */ +if (detach_group) +perf_group_detach (event);list_del_event (event, ctx);raw_spin_unlock_irq (&ctx->lock); }
@@ -3230,10 +3244,7 @@ int perf_event_release_kernel(struct perf_event *event)* to trigger the AB-BA case. */ mutex_lock_nested (&ctx->mutex,SINGLE_DEPTH_NESTING ); -raw_spin_lock_irq (&ctx->lock); -perf_group_detach (event); -raw_spin_unlock_irq (&ctx->lock); -perf_remove_from_context (event); +perf_remove_from_context (event, true);mutex_unlock (&ctx->mutex);free_event (event);
@@ -7102,7 +7113,7 @@ SYSCALL_DEFINE5(perf_event_open,struct perf_event_context *gctx = group_leader->ctx;mutex_lock (&gctx->mutex); -perf_remove_from_context (group_leader); +perf_remove_from_context (group_leader, false);/* * Removing from the context ends up with disabled
@@ -7112,7 +7123,7 @@ SYSCALL_DEFINE5(perf_event_open,perf_event__state_init (group_leader);list_for_each_entry (sibling, &group_leader->sibling_list, group_entry) { -perf_remove_from_context (sibling); +perf_remove_from_context (sibling, false);perf_event__state_init (sibling);put_ctx (gctx); }
@@ -7244,7 +7255,7 @@ void perf_pmu_migrate_context(struct pmu *pmu, int src_cpu, int dst_cpu)mutex_lock (&src_ctx->mutex);list_for_each_entry_safe (event, tmp, &src_ctx->event_list, event_entry) { -perf_remove_from_context (event); +perf_remove_from_context (event, false);unaccount_event_cpu (event, src_cpu);put_ctx (src_ctx);list_add (&event->migrate_entry, &events);
@@ -7306,13 +7317,7 @@ __perf_event_exit_task(struct perf_event *child_event,struct perf_event_context *child_ctx, struct task_struct *child) { -if (child_event->parent) { -raw_spin_lock_irq (&child_ctx->lock); -perf_group_detach (child_event); -raw_spin_unlock_irq (&child_ctx->lock); - } - -perf_remove_from_context (child_event); + perf_remove_from_context(child_event, !!child_event->parent);/* * It can happen that the parent exits first, and has events
@@ -7797,14 +7802,14 @@ static void perf_pmu_rotate_stop(struct pmu *pmu)static void __perf_event_exit_context (void *__info) { +struct remove_event re = { .detach_group = false };struct perf_event_context *ctx = __info; -struct perf_event *event;perf_pmu_rotate_stop (ctx->pmu);rcu_read_lock (); -list_for_each_entry_rcu (event, &ctx->event_list, event_entry) -__perf_remove_from_context (event); +list_for_each_entry_rcu (re.event, &ctx->event_list, event_entry) +__perf_remove_from_context (&re);rcu_read_unlock (); }
Signature · 1 line
2.0.0
PATCH 20/111 mm/memory-failure.c: fix memory leak by race between poison and unpoison
In reply to Jiri SlabyFrom: Naoya Horiguchi <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 3e030ecc0fc7de10fd0da10c1c19939872a31717 upstream.
When a memory error happens on an in-use page or (free and in-use) hugepage, the victim page is isolated with its refcount set to one.
When you try to unpoison it later, unpoison_memory() calls put_page() for it twice in order to bring the page back to free page pool (buddy or free hugepage list). However, if another memory error occurs on the page which we are unpoisoning, memory_failure() returns without releasing the refcount which was incremented in the same call at first, which results in memory leak and unconsistent num_poisoned_pages statistics. This patch fixes it.
--- mm/memory-failure.c | 2 ++ 1 file changed, 2 insertions(+)
mm/memory-failure.c +2 -0
@@ -1157,6 +1157,8 @@ int memory_failure(unsigned long pfn, int trapno, int flags)*/ if (!PageHWPoison (p)) {printk (KERN_ERR "MCE %#lx: just unpoisoned\n" , pfn); +atomic_long_sub (nr_pages, &num_poisoned_pages); +put_page (hpage); res =0 ; goto out; }
Signature · 1 line
2.0.0
PATCH 21/111 Documentation: fix DOCBOOKS=... building
In reply to Jiri SlabyFrom: Johannes Berg <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit e60cbeedc48d80689c249ab5dcc3c31ad0452dea upstream.
Prior to commit 4266129964b8 ("[media] DocBook: Move all media docbook stuff into its own directory") it was possible to build only a single (or more) book(s) by calling, for example
make htmldocs DOCBOOKS=80211.xml
This now fails:
cp: target `.../Documentation/DocBook//media_api' is not a directory
Ignore errors from that copy to make this possible again.
--- Documentation/DocBook/media/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Documentation/DocBook/media/Makefile +1 -1
@@ -195,7 +195,7 @@ DVB_DOCUMENTED = \ # install_media_images = \ - $(Q)cp $(OBJIMGFILES) $(MEDIA_SRC_DIR)/v4l/*.svg $(MEDIA_OBJ_DIR)/media_api + $(Q)-cp $(OBJIMGFILES) $(MEDIA_SRC_DIR)/v4l/*.svg $(MEDIA_OBJ_DIR)/media_api $(MEDIA_OBJ_DIR)/%: $(MEDIA_SRC_DIR)/%.b64 $(Q)base64 -d $< >$@
Signature · 1 line
2.0.0
PATCH 22/111 hwmon: (ntc_thermistor) Fix dependencies
In reply to Jiri SlabyFrom: Jean Delvare <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 59cf4243e557aa64ab2ef51280454aa1f3828e14 upstream.
In commit 9e8269de, support was added for ntc_thermistor devices being declared in the device tree and implemented on top of IIO. With that change, a dependency was added to the ntc_thermistor driver:
depends on (!OF && !IIO) || (OF && IIO)
This construct has the drawback that the driver can no longer be selected when OF is set and IIO isn't, nor when IIO is set and OF is not. This is a regression for the original users of the driver.
As the new code depends on IIO and is useless without OF, include it only if both are enabled, and set the dependencies accordingly. This is clearer, more simple and more correct.
--- drivers/hwmon/Kconfig | 2 +- drivers/hwmon/ntc_thermistor.c | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-)
drivers/hwmon/Kconfig +1 -1
@@ -969,7 +969,7 @@ config SENSORS_NCT6775 config SENSORS_NTC_THERMISTOR tristate "NTC thermistor support" - depends on (!OF && !IIO) || (OF && IIO) + depends on !OF || IIO=n || IIO help This driver supports NTC thermistors sensor reading and its interpretation. The driver can also monitor the temperature and
drivers/hwmon/ntc_thermistor.c +3 -1
@@ -141,7 +141,7 @@ struct ntc_data {char name[PLATFORM_NAME_SIZE ]; }; -#ifdef CONFIG_OF +#if defined(CONFIG_OF ) &&IS_ENABLED (CONFIG_IIO )static int ntc_adc_iio_read (struct ntc_thermistor_platform_data *pdata) {struct iio_channel *channel = pdata->chan;
@@ -223,6 +223,8 @@ ntc_thermistor_parse_dt(struct platform_device *pdev) return NULL; } +#define ntc_match NULL +static void ntc_iio_channel_release (struct ntc_thermistor_platform_data *pdata) { }#endif
Signature · 1 line
2.0.0
PATCH 23/111 hwmon: (ntc_thermistor) Fix OF device ID mapping
In reply to Jiri SlabyFrom: Jean Delvare <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit ead82d6792ef5c600d535bca6ec50a4da14ff7c7 upstream.
The mapping from OF device IDs to platform device IDs is wrong. TYPE_NCPXXWB473 is 0, TYPE_NCPXXWL333 is 1, so ntc_thermistor_id[TYPE_NCPXXWB473] is { "ncp15wb473", TYPE_NCPXXWB473 } while
ntc_thermistor_id[TYPE_NCPXXWL333] is { "ncp18wb473", TYPE_NCPXXWB473 }.
So the name is wrong for all but the "ntc,ncp15wb473" entry, and the type is wrong for the "ntc,ncp15wl333" entry.
So map the entries by index, it is neither elegant nor robust but at least it is correct.
--- drivers/hwmon/ntc_thermistor.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
drivers/hwmon/ntc_thermistor.c +6 -5
@@ -44,6 +44,7 @@ struct ntc_compensation {unsigned int ohm; }; +/* Order matters, ntc_match references the entries by index */ static const struct platform_device_id ntc_thermistor_id[] = { {"ncp15wb473" ,TYPE_NCPXXWB473 }, {"ncp18wb473" ,TYPE_NCPXXWB473 },
@@ -163,15 +164,15 @@ static int ntc_adc_iio_read(struct ntc_thermistor_platform_data *pdata)static const struct of_device_id ntc_match[] = { { .compatible ="ntc,ncp15wb473" , - .data = &ntc_thermistor_id[TYPE_NCPXXWB473 ] }, + .data = &ntc_thermistor_id[0 ] }, { .compatible ="ntc,ncp18wb473" , - .data = &ntc_thermistor_id[TYPE_NCPXXWB473 ] }, + .data = &ntc_thermistor_id[1 ] }, { .compatible ="ntc,ncp21wb473" , - .data = &ntc_thermistor_id[TYPE_NCPXXWB473 ] }, + .data = &ntc_thermistor_id[2 ] }, { .compatible ="ntc,ncp03wb473" , - .data = &ntc_thermistor_id[TYPE_NCPXXWB473 ] }, + .data = &ntc_thermistor_id[3 ] }, { .compatible ="ntc,ncp15wl333" , - .data = &ntc_thermistor_id[TYPE_NCPXXWL333 ] }, + .data = &ntc_thermistor_id[4 ] }, { }, };MODULE_DEVICE_TABLE (of, ntc_match);
Signature · 1 line
2.0.0
PATCH 24/111 drm/gf119-/disp: fix nasty bug which can clobber SOR0's clock setup
In reply to Jiri SlabyFrom: Ben Skeggs <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 0f1d360b2ee3a2a0f510d3f1bcd3f5ebe5d41265 upstream.
Fixes a LVDS bleed issue on Lenovo W530 that can occur under a number of circumstances.
--- drivers/gpu/drm/nouveau/core/engine/disp/nvd0.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/nouveau/core/engine/disp/nvd0.c +1 -1
@@ -678,7 +678,7 @@ exec_clkcmp(struct nv50_disp_priv *priv, int head, int id, }if (outp ==8 ) -return false; +return conf; data =exec_lookup (priv, head, outp, ctrl, dcb, &ver, &hdr, &cnt, &len, &info1);if (data ==0x0000 )
Signature · 1 line
2.0.0
PATCH 25/111 drm/radeon: also try GART for CPU accessed buffers
In reply to Jiri SlabyFrom: Christian König <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 544092596e8ac269f70e70961b5e9381909c9b1e upstream.
Placing them exclusively into VRAM might not work all the time.
--- drivers/gpu/drm/radeon/radeon_object.c | 38 ++++++++++++++++++++-------------- 1 file changed, 23 insertions(+), 15 deletions(-)
drivers/gpu/drm/radeon/radeon_object.c +23 -15
@@ -586,22 +586,30 @@ int radeon_bo_fault_reserve_notify(struct ttm_buffer_object *bo) rbo = container_of(bo, struct radeon_bo, tbo);radeon_bo_check_tiling (rbo,0 ,0 ); rdev = rbo->rdev; -if (bo->mem.mem_type ==TTM_PL_VRAM ) { - size = bo->mem.num_pages <<PAGE_SHIFT ; - offset = bo->mem.start <<PAGE_SHIFT ; -if ((offset + size) > rdev->mc.visible_vram_size) { -/* hurrah the memory is not visible ! */ -radeon_ttm_placement_from_domain (rbo,RADEON_GEM_DOMAIN_VRAM ); - rbo->placement.lpfn = rdev->mc.visible_vram_size >>PAGE_SHIFT ; - r =ttm_bo_validate (bo, &rbo->placement, false, false); -if (unlikely (r !=0 )) -return r; - offset = bo->mem.start <<PAGE_SHIFT ; -/* this should not happen */ -if ((offset + size) > rdev->mc.visible_vram_size) -return -EINVAL ; - } +if (bo->mem.mem_type !=TTM_PL_VRAM ) +return 0 ; + + size = bo->mem.num_pages <<PAGE_SHIFT ; + offset = bo->mem.start <<PAGE_SHIFT ; +if ((offset + size) <= rdev->mc.visible_vram_size) +return 0 ; + +/* hurrah the memory is not visible ! */ +radeon_ttm_placement_from_domain (rbo,RADEON_GEM_DOMAIN_VRAM ); + rbo->placement.lpfn = rdev->mc.visible_vram_size >>PAGE_SHIFT ; + r =ttm_bo_validate (bo, &rbo->placement, false, false); +if (unlikely (r == -ENOMEM )) { +radeon_ttm_placement_from_domain (rbo,RADEON_GEM_DOMAIN_GTT ); +return ttm_bo_validate (bo, &rbo->placement, false, false); + }else if (unlikely (r !=0 )) { +return r; } + + offset = bo->mem.start <<PAGE_SHIFT ; +/* this should never happen */ +if ((offset + size) > rdev->mc.visible_vram_size) +return -EINVAL ; +return 0 ; }
Signature · 1 line
2.0.0
PATCH 26/111 drm/radeon: handle non-VGA class pci devices with ATRM
In reply to Jiri SlabyFrom: Alex Deucher <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit d8ade3526b2aa0505132c404c05a38b73ea15490 upstream.
Newer PX systems have non-VGA pci class dGPUs. Update the ATRM fetch method to handle those cases.
bug:
https://bugzilla.kernel.org/show_bug.cgi?id=75401
--- drivers/gpu/drm/radeon/radeon_bios.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
drivers/gpu/drm/radeon/radeon_bios.c +14 -0
@@ -196,6 +196,20 @@ static bool radeon_atrm_get_bios(struct radeon_device *rdev) } } +if (!found) { +while ((pdev =pci_get_class (PCI_CLASS_DISPLAY_OTHER <<8 , pdev)) !=NULL ) { + dhandle =ACPI_HANDLE (&pdev->dev); +if (!dhandle) +continue ; + + status =acpi_get_handle (dhandle,"ATRM" , &atrm_handle); +if (!ACPI_FAILURE (status)) { + found = true; +break ; + } + } + } +if (!found)return false;
Signature · 1 line
2.0.0
PATCH 27/111 SCSI: scsi_transport_sas: move bsg destructor into sas_rphy_remove
In reply to Jiri SlabyFrom: Joe Lawrence <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 6aa6caff30f5dcb9e55b03b9710c30b83750cae5 upstream.
The recent change in sysfs, bcdde7e221a8750f9b62b6d0bd31b72ea4ad9309 "sysfs: make __sysfs_remove_dir() recursive" revealed an asymmetric rphy device creation/deletion sequence in scsi_transport_sas:
modprobe mpt2sas
sas_rphy_add
device_add A rphy->dev
device_add B sas_device transport class
device_add C sas_end_device transport class
device_add D bsg class
rmmod mpt2sas
sas_rphy_delete
sas_rphy_remove
device_del B
device_del C
device_del A
sysfs_remove_group recursive sysfs dir removal
sas_rphy_free
device_del D warning
where device A is the parent of B, C, and D.
When sas_rphy_free tries to unregister the bsg request queue (device D above), the ensuing sysfs cleanup discovers that its sysfs group has already been removed and emits a warning, "sysfs group... not found for kobject 'end_device-X:0'".
Since bsg creation is a side effect of sas_rphy_add, move its complementary removal call into sas_rphy_remove. This imposes the following tear-down order for the devices above: D, B, C, A.
Note the sas_device and sas_end_device transport class devices (B and C above) are created and destroyed both via the list match traversal in attribute_container_device_trigger, so the order in which they are handled is fixed. This is fine as long as they are deleted before their parent device.
--- drivers/scsi/scsi_transport_sas.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/scsi/scsi_transport_sas.c +1 -2
@@ -1621,8 +1621,6 @@ void sas_rphy_free(struct sas_rphy *rphy)list_del (&rphy->list);mutex_unlock (&sas_host->lock); -sas_bsg_remove (shost, rphy); -transport_destroy_device (dev);put_device (dev);
@@ -1681,6 +1679,7 @@ sas_rphy_remove(struct sas_rphy *rphy) }sas_rphy_unlink (rphy); +sas_bsg_remove (NULL , rphy);transport_remove_device (dev);device_del (dev); }
Signature · 1 line
2.0.0
PATCH 28/111 ARM: imx: fix error handling in ipu device registration
In reply to Jiri SlabyFrom: Emil Goode <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit d1d70e5dc2cfa9047bb935c41ba808ebb8135696 upstream.
If we fail to allocate struct platform_device pdev we dereference it after the goto label err.
This bug was found using coccinelle.
--- arch/arm/mach-imx/devices/platform-ipu-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/mach-imx/devices/platform-ipu-core.c +1 -1
@@ -77,7 +77,7 @@ struct platform_device *__init imx_alloc_mx3_camera( pdev =platform_device_alloc ("mx3-camera" ,0 );if (!pdev) - goto err; +return ERR_PTR (-ENOMEM ); pdev->dev.dma_mask =kmalloc (sizeof (*pdev->dev.dma_mask),GFP_KERNEL );if (!pdev->dev.dma_mask)
Signature · 1 line
2.0.0
PATCH 29/111 ARM: omap5: hwmod_data: Correct IDLEMODE for McPDM
In reply to Jiri SlabyFrom: Peter Ujfalusi <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 0f9e19ad88eee820f517b85531b555a0fa73e7e4 upstream.
McPDM need to be configured to NO_IDLE mode when it is in used otherwise vital clocks will be gated which results 'slow motion' audio playback.
--- arch/arm/mach-omap2/omap_hwmod_54xx_data.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/mach-omap2/omap_hwmod_54xx_data.c +1 -1
@@ -895,7 +895,7 @@ static struct omap_hwmod omap54xx_mcpdm_hwmod = {* current exception. */ - .flags = HWMOD_EXT_OPT_MAIN_CLK, + .flags = HWMOD_EXT_OPT_MAIN_CLK | HWMOD_SWSUP_SIDLE, .main_clk = "pad_clks_ck", .prcm = { .omap4 = {
Signature · 1 line
2.0.0
PATCH 30/111 ARM: OMAP3: clock: Back-propagate rate change from cam_mclk to dpll4_m5 on all OMAP3 platforms
In reply to Jiri SlabyFrom: Laurent Pinchart <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 98d7e1aee6dd534f468993f8c6a1bc730d4cfa81 upstream.
Commit 7b2e1277598e4187c9be3e61fd9b0f0423f97986 ("ARM: OMAP3: clock:
Back-propagate rate change from cam_mclk to dpll4_m5") enabled clock rate back-propagation from cam_mclk do dpll4_m5 on OMAP3630 only. Perform back-propagation on other OMAP3 platforms as well.
--- arch/arm/mach-omap2/cclock3xxx_data.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/arm/mach-omap2/cclock3xxx_data.c +2 -1
@@ -418,7 +418,8 @@ static struct clk_hw_omap dpll4_m5x2_ck_hw = { .clkdm_name = "dpll4_clkdm", }; -DEFINE_STRUCT_CLK (dpll4_m5x2_ck, dpll4_m5x2_ck_parent_names, dpll4_m5x2_ck_ops); +DEFINE_STRUCT_CLK_FLAGS (dpll4_m5x2_ck, dpll4_m5x2_ck_parent_names, + dpll4_m5x2_ck_ops,CLK_SET_RATE_PARENT );static struct clk dpll4_m5x2_ck_3630 = { .name ="dpll4_m5x2_ck" ,
Signature · 1 line
2.0.0
PATCH 31/111 ARM: 8051/1: put_user: fix possible data corruption in put_user
In reply to Jiri SlabyFrom: Andrey Ryabinin <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 537094b64b229bf3ad146042f83e74cf6abe59df upstream.
According to arm procedure call standart r2 register is call-cloberred. So after the result of x expression was put into r2 any following function call in p may overwrite r2. To fix this, the result of p expression must be saved to the temporary variable before the assigment x expression to __r2.
--- arch/arm/include/asm/uaccess.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/arm/include/asm/uaccess.h +2 -1
@@ -171,8 +171,9 @@ extern int __put_user_8(void *, unsigned long long);#define __put_user_check (x,p) \ ({ \ unsigned long __limit = current_thread_info()->addr_limit - 1; \ + const typeof(*(p)) __user *__tmp_p = (p); \ register const typeof(*(p)) __r2 asm("r2") = (x); \ - register const typeof(*(p)) __user *__p asm("r0") = (p);\ + register const typeof(*(p)) __user *__p asm("r0") = __tmp_p; \ register unsigned long __l asm("r1") = __limit; \ register int __e asm("r0"); \ switch (sizeof(*(__p))) { \
Signature · 1 line
2.0.0
PATCH 32/111 ARM: 8064/1: fix v7-M signal return
In reply to Jiri SlabyFrom: Rabin Vincent <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 483a6c9d447f625b991fa04a1530493d893984db upstream.
According to the ARM ARM, the behaviour is UNPREDICTABLE if the PC read from the exception return stack is not half word aligned. See the pseudo code for ExceptionReturn() and PopStack().
The signal handler's address has the bit 0 set, and setup_return() directly writes this to regs->ARM_pc. Current hardware happens to discard this bit, but QEMU's emulation doesn't and this makes processes crash. Mask out bit 0 before the exception return in order to get predictable behaviour.
--- arch/arm/kernel/entry-header.S | 4 ++++ 1 file changed, 4 insertions(+)
arch/arm/kernel/entry-header.S +4 -0
@@ -132,6 +132,10 @@ orrne r5, V7M_xPSR_FRAMEPTRALIGN biceq r5, V7M_xPSR_FRAMEPTRALIGN + @ ensure bit 0 is cleared in the PC, otherwise behaviour is + @ unpredictable + bic r4, #1 + @ write basic exception frame stmdb r2!, {r1, r3-r5} ldmia sp, {r1, r3-r5}
Signature · 1 line
2.0.0
PATCH 33/111 cpufreq: remove race while accessing cur_policy
In reply to Jiri SlabyFrom: Bibek Basu <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit c5450db85b828d0c46ac8fc570fb8a51bf07ac40 upstream.
While accessing cur_policy during executing events CPUFREQ_GOV_START, CPUFREQ_GOV_STOP, CPUFREQ_GOV_LIMITS, same mutex lock is not taken, dbs_data->mutex, which leads to race and data corruption while running continious suspend resume test. This is seen with ondemand governor with suspend resume test using rtcwake.
Unable to handle kernel NULL pointer dereference at virtual address 00000028 pgd = ed610000 [00000028] *pgd=adf11831, *pte=00000000, *ppte=00000000 Internal error: Oops: 17 [#1] PREEMPT SMP ARM Modules linked in: nvhost_vi CPU: 1 PID: 3243 Comm: rtcwake Not tainted 3.10.24-gf5cf9e5 #1 task: ee708040 ti: ed61c000 task.ti: ed61c000 PC is at cpufreq_governor_dbs+0x400/0x634 LR is at cpufreq_governor_dbs+0x3f8/0x634 pc : [<c05652b8>] lr : [<c05652b0>] psr: 600f0013 sp : ed61dcb0 ip : 000493e0 fp : c1cc14f0 r10: 00000000 r9 : 00000000 r8 : 00000000 r7 : eb725280 r6 : c1cc1560 r5 : eb575200 r4 : ebad7740 r3 : ee708040 r2 : ed61dca8 r1 : 001ebd24 r0 : 00000000 Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user Control: 10c5387d Table: ad61006a DAC: 00000015 [<c05652b8>] (cpufreq_governor_dbs+0x400/0x634) from [<c055f700>] (__cpufreq_governor+0x98/0x1b4) [<c055f700>] (__cpufreq_governor+0x98/0x1b4) from [<c0560770>] (__cpufreq_set_policy+0x250/0x320) [<c0560770>] (__cpufreq_set_policy+0x250/0x320) from [<c0561dcc>] (cpufreq_update_policy+0xcc/0x168) [<c0561dcc>] (cpufreq_update_policy+0xcc/0x168) from [<c0561ed0>] (cpu_freq_notify+0x68/0xdc) [<c0561ed0>] (cpu_freq_notify+0x68/0xdc) from [<c008eff8>] (notifier_call_chain+0x4c/0x8c) [<c008eff8>] (notifier_call_chain+0x4c/0x8c) from [<c008f3d4>] (__blocking_notifier_call_chain+0x50/0x68) [<c008f3d4>] (__blocking_notifier_call_chain+0x50/0x68) from [<c008f40c>] (blocking_notifier_call_chain+0x20/0x28) [<c008f40c>] (blocking_notifier_call_chain+0x20/0x28) from [<c00aac6c>] (pm_qos_update_bounded_target+0xd8/0x310) [<c00aac6c>] (pm_qos_update_bounded_target+0xd8/0x310) from [<c00ab3b0>] (__pm_qos_update_request+0x64/0x70) [<c00ab3b0>] (__pm_qos_update_request+0x64/0x70) from [<c004b4b8>] (tegra_pm_notify+0x114/0x134) [<c004b4b8>] (tegra_pm_notify+0x114/0x134) from [<c008eff8>] (notifier_call_chain+0x4c/0x8c) [<c008eff8>] (notifier_call_chain+0x4c/0x8c) from [<c008f3d4>] (__blocking_notifier_call_chain+0x50/0x68) [<c008f3d4>] (__blocking_notifier_call_chain+0x50/0x68) from [<c008f40c>] (blocking_notifier_call_chain+0x20/0x28) [<c008f40c>] (blocking_notifier_call_chain+0x20/0x28) from [<c00ac228>] (pm_notifier_call_chain+0x1c/0x34) [<c00ac228>] (pm_notifier_call_chain+0x1c/0x34) from [<c00ad38c>] (enter_state+0xec/0x128) [<c00ad38c>] (enter_state+0xec/0x128) from [<c00ad400>] (pm_suspend+0x38/0xa4) [<c00ad400>] (pm_suspend+0x38/0xa4) from [<c00ac114>] (state_store+0x70/0xc0) [<c00ac114>] (state_store+0x70/0xc0) from [<c027b1e8>] (kobj_attr_store+0x14/0x20) [<c027b1e8>] (kobj_attr_store+0x14/0x20) from [<c019cd9c>] (sysfs_write_file+0x104/0x184) [<c019cd9c>] (sysfs_write_file+0x104/0x184) from [<c0143038>] (vfs_write+0xd0/0x19c) [<c0143038>] (vfs_write+0xd0/0x19c) from [<c0143414>] (SyS_write+0x4c/0x78) [<c0143414>] (SyS_write+0x4c/0x78) from [<c000f080>] (ret_fast_syscall+0x0/0x30) Code: e1a00006 eb084346 e59b0020 e5951024 (e5903028) ---[ end trace 0488523c8f6b0f9d ]---
--- drivers/cpufreq/cpufreq_governor.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/cpufreq/cpufreq_governor.c +6 -0
@@ -366,6 +366,11 @@ int cpufreq_governor_dbs(struct cpufreq_policy *policy,break ;case CPUFREQ_GOV_LIMITS : +mutex_lock (&dbs_data->mutex); +if (!cpu_cdbs->cur_policy) { +mutex_unlock (&dbs_data->mutex); +break ; + }mutex_lock (&cpu_cdbs->timer_mutex);if (policy->max < cpu_cdbs->cur_policy->cur) __cpufreq_driver_target(cpu_cdbs->cur_policy,
@@ -375,6 +380,7 @@ int cpufreq_governor_dbs(struct cpufreq_policy *policy, policy->min, CPUFREQ_RELATION_L);dbs_check_cpu (dbs_data, cpu);mutex_unlock (&cpu_cdbs->timer_mutex); +mutex_unlock (&dbs_data->mutex);break ; }return 0 ;
Signature · 1 line
2.0.0
PATCH 34/111 dm cache: always split discards on cache block boundaries
In reply to Jiri SlabyFrom: Heinz Mauelshagen <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit f1daa838e861ae1a0fb7cd9721a21258430fcc8c upstream.
The DM cache target cannot cope with discards that span multiple cache blocks, so each discard bio that spans more than one cache block must get split by the DM core.
--- drivers/md/dm-cache-target.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/md/dm-cache-target.c +2 -0
@@ -1932,6 +1932,8 @@ static int cache_create(struct cache_args *ca, struct cache **result) ti->num_discard_bios =1 ; ti->discards_supported = true; ti->discard_zeroes_data_unsupported = true; +/* Discard bios must be split on a block boundary */ + ti->split_discard_bios = true; cache->features = ca->features; ti->per_bio_data_size =get_per_bio_data_size (cache);
Signature · 1 line
2.0.0
PATCH 35/111 sched: Fix hotplug vs. set_cpus_allowed_ptr()
In reply to Jiri SlabyFrom: Lai Jiangshan <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 6acbfb96976fc3350e30d964acb1dbbdf876d55e upstream.
Lai found that:
WARNING: CPU: 1 PID: 13 at arch/x86/kernel/smp.c:124 native_smp_send_reschedule+0x2d/0x4b() ... migration_cpu_stop+0x1d/0x22
was caused by set_cpus_allowed_ptr() assuming that cpu_active_mask is always a sub-set of cpu_online_mask.
This isn't true since 5fbd036b552f ("sched: Cleanup cpu_active madness").
So set active and online at the same time to avoid this particular problem.
--- kernel/cpu.c | 6 ++++-- kernel/sched/core.c | 1 - 2 files changed, 4 insertions(+), 3 deletions(-)
kernel/cpu.c +4 -2
@@ -695,10 +695,12 @@ void set_cpu_present(unsigned int cpu, bool present)void set_cpu_online (unsigned int cpu,bool online) { -if (online) +if (online) {cpumask_set_cpu (cpu,to_cpumask (cpu_online_bits)); -else +cpumask_set_cpu (cpu,to_cpumask (cpu_active_bits)); + }else {cpumask_clear_cpu (cpu,to_cpumask (cpu_online_bits)); + } }void set_cpu_active (unsigned int cpu,bool active)
kernel/sched/core.c +0 -1
@@ -4726,7 +4726,6 @@ static int sched_cpu_active(struct notifier_block *nfb, unsigned long action, void *hcpu) {switch (action & ~CPU_TASKS_FROZEN ) { -case CPU_STARTING :case CPU_DOWN_FAILED :set_cpu_active ((long )hcpu, true);return NOTIFY_OK ;
Signature · 1 line
2.0.0
PATCH 36/111 drm/radeon: avoid crash if VM command submission isn't available
In reply to Jiri SlabyFrom: Christian König <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 60a445405a1731bac2279eab354173c9c3156747 upstream.
--- drivers/gpu/drm/radeon/radeon_cs.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
drivers/gpu/drm/radeon/radeon_cs.c +11 -4
@@ -271,10 +271,17 @@ int radeon_cs_parser_init(struct radeon_cs_parser *p, void *data)return -EINVAL ;/* we only support VM on some SI+ rings */ -if ((p->rdev->asic->ring[p->ring]->cs_parse ==NULL ) && - ((p->cs_flags &RADEON_CS_USE_VM ) ==0 )) { -DRM_ERROR ("Ring %d requires VM!\n" , p->ring); -return -EINVAL ; +if ((p->cs_flags &RADEON_CS_USE_VM ) ==0 ) { +if (p->rdev->asic->ring[p->ring]->cs_parse ==NULL ) { +DRM_ERROR ("Ring %d requires VM!\n" , p->ring); +return -EINVAL ; + } + }else { +if (p->rdev->asic->ring[p->ring]->ib_parse ==NULL ) { +DRM_ERROR ("VM not supported on ring %d!\n" , + p->ring); +return -EINVAL ; + } } }
Signature · 1 line
2.0.0
PATCH 37/111 drm/i915: Only copy back the modified fields to userspace from execbuffer
In reply to Jiri SlabyFrom: Chris Wilson <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 9aab8bff7aa3bee567213ad3c1fdfb217bb980a2 upstream.
We only want to modifiy a single field in the userspace view of the execbuffer command buffer, so explicitly change that rather than copy everything back again.
This serves two purposes:
1. The single fields are much cheaper to copy (constant size so the copy uses special case code) and much smaller than the whole array.
2. We modify the array for internal use that need to be masked from the user.
Note: We need this backported since without it the next bugfix will blow up when userspace recycles batchbuffers and relocations.
--- drivers/gpu/drm/i915/i915_gem_execbuffer.c | 54 ++++++++++++++++++------------ 1 file changed, 32 insertions(+), 22 deletions(-)
drivers/gpu/drm/i915/i915_gem_execbuffer.c +32 -22
@@ -674,9 +674,9 @@ i915_gem_execbuffer_relocate_slow(struct drm_device *dev,* relocations were valid. */ for (j =0 ; j < exec[i].relocation_count; j++) { -if (copy_to_user (&user_relocs[j].presumed_offset, - &invalid_offset, -sizeof (invalid_offset))) { +if (__copy_to_user (&user_relocs[j].presumed_offset, + &invalid_offset, +sizeof (invalid_offset))) { ret = -EFAULT ;mutex_lock (&dev->struct_mutex); goto err;
@@ -1211,18 +1211,21 @@ i915_gem_execbuffer(struct drm_device *dev, void *data, ret =i915_gem_do_execbuffer (dev, data, file, &exec2, exec2_list, &dev_priv->gtt.base);if (!ret) { +struct drm_i915_gem_exec_object __user *user_exec_list = +to_user_ptr (args->buffers_ptr); +/* Copy the new buffer offsets back to the user's exec list. */ -for (i =0 ; i < args->buffer_count; i++) - exec_list[i].offset = exec2_list[i].offset; -/* ... and back out to userspace */ - ret =copy_to_user (to_user_ptr (args->buffers_ptr), - exec_list, -sizeof (*exec_list) * args->buffer_count); -if (ret) { - ret = -EFAULT ; -DRM_DEBUG ("failed to copy %d exec entries " -"back to user (%d)\n" , - args->buffer_count, ret); +for (i =0 ; i < args->buffer_count; i++) { + ret =__copy_to_user (&user_exec_list[i].offset, + &exec2_list[i].offset, +sizeof (user_exec_list[i].offset)); +if (ret) { + ret = -EFAULT ; +DRM_DEBUG ("failed to copy %d exec entries " +"back to user (%d)\n" , + args->buffer_count, ret); +break ; + } } }
@@ -1270,14 +1273,21 @@ i915_gem_execbuffer2(struct drm_device *dev, void *data, &dev_priv->gtt.base);if (!ret) {/* Copy the new buffer offsets back to the user's exec list. */ - ret =copy_to_user (to_user_ptr (args->buffers_ptr), - exec2_list, -sizeof (*exec2_list) * args->buffer_count); -if (ret) { - ret = -EFAULT ; -DRM_DEBUG ("failed to copy %d exec entries " -"back to user (%d)\n" , - args->buffer_count, ret); +struct drm_i915_gem_exec_object2 *user_exec_list = +to_user_ptr (args->buffers_ptr); +int i; + +for (i =0 ; i < args->buffer_count; i++) { + ret =__copy_to_user (&user_exec_list[i].offset, + &exec2_list[i].offset, +sizeof (user_exec_list[i].offset)); +if (ret) { + ret = -EFAULT ; +DRM_DEBUG ("failed to copy %d exec entries " +"back to user\n" , + args->buffer_count); +break ; + } } }
Signature · 1 line
2.0.0
PATCH 38/111 libata: Blacklist queued trim for Crucial M500
In reply to Jiri SlabyFrom: "Martin K. Petersen" <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 3b8d2676d15d6b2326757adb66b70a9cd6650373 upstream.
Queued trim only works for some users with MU05 firmware. Revert to blacklisting all firmware versions.
Introduced by commit d121f7d0cbb8 ("libata: Update queued trim blacklist for M5x0 drives") which this effectively reverts, while retaining the blacklisting of M550.
See
https://bugzilla.kernel.org/show_bug.cgi?id=71371
for reports of trouble with MU05 firmware.
--- drivers/ata/libata-core.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/ata/libata-core.c +4 -4
@@ -4224,10 +4224,10 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { { "PIONEER DVD-RW DVR-216D", NULL, ATA_HORKAGE_NOSETXFER },/* devices that don't properly handle queued TRIM commands */ - { "Micron_M500*", "MU0[1-4]*", ATA_HORKAGE_NO_NCQ_TRIM, }, - { "Crucial_CT???M500SSD*", "MU0[1-4]*", ATA_HORKAGE_NO_NCQ_TRIM, }, - { "Micron_M550*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, }, - { "Crucial_CT???M550SSD*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, }, + { "Micron_M500*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, }, + { "Crucial_CT???M500SSD*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, }, + { "Micron_M550*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, }, + { "Crucial_CT???M550SSD*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, },/* * Some WD SATA-I drives spin up and down erratically when the link
Signature · 1 line
2.0.0
PATCH 39/111 md: always set MD_RECOVERY_INTR when aborting a reshape or other "resync".
In reply to Jiri SlabyFrom: NeilBrown <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 3991b31ea072b070081ca3bfa860a077eda67de5 upstream.
If mddev->ro is set, md_to_sync will (correctly) abort. However in that case MD_RECOVERY_INTR isn't set.
If a RESHAPE had been requested, then ->finish_reshape() will be called and it will think the reshape was successful even though nothing happened.
Normally a resync will not be requested if ->ro is set, but if an array is stopped while a reshape is on-going, then when the array is started, the reshape will be restarted. If the array is also set read-only at this point, the reshape will instantly appear to success, resulting in data corruption.
Consequently, this patch is suitable for any -stable kernel.
--- drivers/md/md.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/md/md.c +3 -1
@@ -7371,8 +7371,10 @@ void md_do_sync(struct md_thread *thread)/* just incase thread restarts... */ if (test_bit (MD_RECOVERY_DONE , &mddev->recovery))return ; -if (mddev->ro)/* never try to sync a read-only array */ +if (mddev->ro) {/* never try to sync a read-only array */ +set_bit (MD_RECOVERY_INTR , &mddev->recovery);return ; + }if (test_bit (MD_RECOVERY_SYNC , &mddev->recovery)) {if (test_bit (MD_RECOVERY_CHECK , &mddev->recovery)) {
Signature · 1 line
2.0.0
PATCH 40/111 md: always set MD_RECOVERY_INTR when interrupting a reshape thread.
In reply to Jiri SlabyFrom: NeilBrown <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 2ac295a544dcae9299cba13ce250419117ae7fd1 upstream.
Commit 8313b8e57f55b15e5b7f7fc5d1630bbf686a9a97
md: fix problem when adding device to read-only array with bitmap.
added a called to md_reap_sync_thread() which cause a reshape thread to be interrupted (in particular, it could cause md_thread() to never even call md_do_sync()).
However it didn't set MD_RECOVERY_INTR so ->finish_reshape() would not know that the reshape didn't complete.
This only happens when mddev->ro is set and normally reshape threads don't run in that situation. But raid5 and raid10 can start a reshape thread during "run" is the array is in the middle of a reshape. They do this even if ->ro is set.
So it is best to set MD_RECOVERY_INTR before abortingg the sync thread, just in case.
Though it rare for this to trigger a problem it can cause data corruption because the reshape isn't finished properly.
So it is suitable for any stable which the offending commit was applied to. (3.2 or later)
--- drivers/md/md.c | 1 + 1 file changed, 1 insertion(+)
drivers/md/md.c +1 -0
@@ -7827,6 +7827,7 @@ void md_check_recovery(struct mddev *mddev)/* There is no thread, but we need to call * ->spare_active and clear saved_raid_disk */ +set_bit (MD_RECOVERY_INTR , &mddev->recovery);md_reap_sync_thread (mddev);clear_bit (MD_RECOVERY_NEEDED , &mddev->recovery); goto unlock;
Signature · 1 line
2.0.0
PATCH 41/111 xhci: delete endpoints from bandwidth list before freeing whole device
In reply to Jiri SlabyFrom: Mathias Nyman <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 5dc2808c4729bf080487e61b80ee04e0fdb12a37 upstream.
Lists of endpoints are stored for bandwidth calculation for roothub ports. Make sure we remove all endpoints from the list before the whole device, containing its endpoints list_head stuctures, is freed.
This used to be done in the wrong order in xhci_mem_cleanup(), and triggered an oops in resume from S4 (hibernate).
--- drivers/usb/host/xhci-mem.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-)
drivers/usb/host/xhci-mem.c +10 -10
@@ -1722,6 +1722,16 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci)kfree (cur_cd); } + num_ports =HCS_MAX_PORTS (xhci->hcs_params1); +for (i =0 ; i < num_ports; i++) { +struct xhci_interval_bw_table *bwt = &xhci->rh_bw[i].bw_table; +for (j =0 ; j <XHCI_MAX_INTERVAL ; j++) { +struct list_head *ep = &bwt->interval_bw[j].endpoints; +while (!list_empty (ep)) +list_del_init (ep->next); + } + } +for (i =1 ; i <MAX_HC_SLOTS ; ++i)xhci_free_virt_device (xhci, i);
@@ -1757,16 +1767,6 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci)if (!xhci->rh_bw) goto no_bw; - num_ports =HCS_MAX_PORTS (xhci->hcs_params1); -for (i =0 ; i < num_ports; i++) { -struct xhci_interval_bw_table *bwt = &xhci->rh_bw[i].bw_table; -for (j =0 ; j <XHCI_MAX_INTERVAL ; j++) { -struct list_head *ep = &bwt->interval_bw[j].endpoints; -while (!list_empty (ep)) -list_del_init (ep->next); - } - } -for (i =0 ; i < num_ports; i++) {struct xhci_tt_bw_info *tt, *n;list_for_each_entry_safe (tt, n, &xhci->rh_bw[i].tts, tt_list) {
Signature · 1 line
2.0.0
PATCH 42/111 Staging: speakup: Move pasting into a work item
In reply to Jiri SlabyFrom: Ben Hutchings <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit d7500135802ca55b3f4e01a16544e8b34082f8c3 upstream.
Input is handled in softirq context, but when pasting we may need to sleep. speakup_paste_selection() currently tries to bodge this by busy-waiting if in_atomic(), but that doesn't help because the ldisc may also sleep.
For bonus breakage, speakup_paste_selection() changes the state of current, even though it's not running in process context.
Move it into a work item and make sure to cancel it on exit.
References: https://bugs.debian.org/735202
References: https://bugs.debian.org/744015
--- drivers/staging/speakup/main.c | 1 + drivers/staging/speakup/selection.c | 38 +++++++++++++++++++++++++++++++------ drivers/staging/speakup/speakup.h | 1 + 3 files changed, 34 insertions(+), 6 deletions(-)
drivers/staging/speakup/main.c +1 -0
@@ -2220,6 +2220,7 @@ static void __exit speakup_exit(void)unregister_keyboard_notifier (&keyboard_notifier_block);unregister_vt_notifier (&vt_notifier_block);speakup_unregister_devsynth (); +speakup_cancel_paste ();del_timer (&cursor_timer);kthread_stop (speakup_task); speakup_task =NULL ;
drivers/staging/speakup/selection.c +32 -6
@@ -4,6 +4,8 @@#include <linux/sched.h> #include <linux/device.h> /* for dev_warn */ #include <linux/selection.h> +#include <linux/workqueue.h> +#include <asm/cmpxchg.h> #include "speakup.h"
@@ -121,20 +123,24 @@ int speakup_set_selection(struct tty_struct *tty)return 0 ; } -/* TODO: move to some helper thread, probably. That'd fix having to check for -* in_atomic(). */ -int speakup_paste_selection (struct tty_struct *tty) +struct speakup_paste_work { +struct work_struct work; +struct tty_struct *tty; +}; + +static void __speakup_paste_selection (struct work_struct *work) { +struct speakup_paste_work *spw = + container_of(work, struct speakup_paste_work, work); +struct tty_struct *tty =xchg (&spw->tty,NULL );struct vc_data *vc = (struct vc_data *) tty->driver_data;int pasted =0 , count;DECLARE_WAITQUEUE (wait, current); +add_wait_queue (&vc->paste_wait, &wait);while (sel_buffer && sel_buffer_lth > pasted) {set_current_state (TASK_INTERRUPTIBLE );if (test_bit (TTY_THROTTLED , &tty->flags)) { -if (in_atomic ()) -/* if we are in an interrupt handler, abort */ -break ;schedule ();continue ; }
@@ -146,6 +152,26 @@ int speakup_paste_selection(struct tty_struct *tty) }remove_wait_queue (&vc->paste_wait, &wait); current->state =TASK_RUNNING ; +tty_kref_put (tty); +} + +static struct speakup_paste_work speakup_paste_work = { + .work =__WORK_INITIALIZER (speakup_paste_work.work, + __speakup_paste_selection) +}; + +int speakup_paste_selection (struct tty_struct *tty) +{ +if (cmpxchg (&speakup_paste_work.tty,NULL , tty) !=NULL ) +return -EBUSY ; + +tty_kref_get (tty); +schedule_work_on (WORK_CPU_UNBOUND , &speakup_paste_work.work);return 0 ; } +void speakup_cancel_paste (void ) +{ +cancel_work_sync (&speakup_paste_work.work); +tty_kref_put (speakup_paste_work.tty); +}
drivers/staging/speakup/speakup.h +1 -0
@@ -77,6 +77,7 @@ extern void synth_buffer_clear(void);extern void speakup_clear_selection (void );extern int speakup_set_selection (struct tty_struct *tty);extern int speakup_paste_selection (struct tty_struct *tty); +extern void speakup_cancel_paste (void );extern void speakup_register_devsynth (void );extern void speakup_unregister_devsynth (void );extern void synth_write (const char *buf,size_t count);
Signature · 1 line
2.0.0
PATCH 43/111 staging: comedi: ni_daq_700: add mux settling delay
In reply to Jiri SlabyFrom: Ian Abbott <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit ffed54dced86723f352323f15789d9ad6bee25e1 upstream.
I got a patch from the original author, Fred Brooks, to add a small settling delay after setting the AI channel multiplexor. The lack of delay resulted in unstable or scrambled data on faster processors.
--- drivers/staging/comedi/drivers/ni_daq_700.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/staging/comedi/drivers/ni_daq_700.c +2 -0
@@ -118,6 +118,8 @@ static int daq700_ai_rinsn(struct comedi_device *dev,/* write channel to multiplexer */ /* set mask scan bit high to disable scanning */ outb (chan |0x80 , dev->iobase +CMD_R1 ); +/* mux needs 2us to really settle [Fred Brooks]. */ +udelay (2 );/* convert n samples */ for (n =0 ; n < insn->n; n++) {
Signature · 1 line
2.0.0
PATCH 44/111 Staging: speakup: Update __speakup_paste_selection() tty (ab)usage to match vt
In reply to Jiri SlabyFrom: Ben Hutchings <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 28a821c306889b9f2c3fff49abedc9b2c743eb73 upstream.
This function is largely a duplicate of paste_selection() in drivers/tty/vt/selection.c, but with its own selection state. The speakup selection mechanism should really be merged with vt.
For now, apply the changes from 'TTY: vt, fix paste_selection ldisc handling', 'tty: Make ldisc input flow control concurrency-friendly', and 'tty: Fix unsafe vt paste_selection()'.
References: https://bugs.debian.org/735202
References: https://bugs.debian.org/744015
--- drivers/staging/speakup/selection.c | 14 +++++++++++--- drivers/tty/tty_buffer.c | 2 ++ 2 files changed, 13 insertions(+), 3 deletions(-)
drivers/staging/speakup/selection.c +11 -3
@@ -5,6 +5,8 @@#include <linux/device.h> /* for dev_warn */ #include <linux/selection.h> #include <linux/workqueue.h> +#include <linux/tty.h> +#include <linux/tty_flip.h> #include <asm/cmpxchg.h> #include "speakup.h"
@@ -135,8 +137,12 @@ static void __speakup_paste_selection(struct work_struct *work)struct tty_struct *tty =xchg (&spw->tty,NULL );struct vc_data *vc = (struct vc_data *) tty->driver_data;int pasted =0 , count; +struct tty_ldisc *ld;DECLARE_WAITQUEUE (wait, current); + ld =tty_ldisc_ref_wait (tty); +tty_buffer_lock_exclusive (&vc->port); +add_wait_queue (&vc->paste_wait, &wait);while (sel_buffer && sel_buffer_lth > pasted) {set_current_state (TASK_INTERRUPTIBLE );
@@ -145,13 +151,15 @@ static void __speakup_paste_selection(struct work_struct *work)continue ; } count = sel_buffer_lth - pasted; - count =min_t (int, count, tty->receive_room); - tty->ldisc->ops->receive_buf (tty, sel_buffer + pasted, -NULL , count); + count =tty_ldisc_receive_buf (ld, sel_buffer + pasted,NULL , + count); pasted += count; }remove_wait_queue (&vc->paste_wait, &wait); current->state =TASK_RUNNING ; + +tty_buffer_unlock_exclusive (&vc->port); +tty_ldisc_deref (ld);tty_kref_put (tty); }
drivers/tty/tty_buffer.c +2 -0
@@ -61,6 +61,7 @@ void tty_buffer_lock_exclusive(struct tty_port *port)atomic_inc (&buf->priority);mutex_lock (&buf->lock); } +EXPORT_SYMBOL_GPL (tty_buffer_lock_exclusive);void tty_buffer_unlock_exclusive (struct tty_port *port) {
@@ -74,6 +75,7 @@ void tty_buffer_unlock_exclusive(struct tty_port *port)if (restart)queue_work (system_unbound_wq, &buf->work); } +EXPORT_SYMBOL_GPL (tty_buffer_unlock_exclusive);/** * tty_buffer_space_avail - return unused buffer space
Signature · 1 line
2.0.0
PATCH 45/111 ALSA: hda/analog - Fix silent output on ASUS A8JN
In reply to Jiri SlabyFrom: Takashi Iwai <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 598e306184d26fa1d546334f2eb370b4d94a4ad3 upstream.
ASUS A8JN with AD1986A codec seems following the normal EAPD in the normal order (0 = off, 1 = on) unlike other machines with AD1986A. Apply the workaround used for Toshiba laptop that showed the same problem.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=75041
--- sound/pci/hda/patch_analog.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_analog.c +1 -0
@@ -316,6 +316,7 @@ static const struct hda_fixup ad1986a_fixups[] = {static const struct snd_pci_quirk ad1986a_fixup_tbl[] = {SND_PCI_QUIRK (0x103c ,0x30af ,"HP B2800" ,AD1986A_FIXUP_LAPTOP_IMIC ), +SND_PCI_QUIRK (0x1043 ,0x1447 ,"ASUS A8JN" ,AD1986A_FIXUP_EAPD ),SND_PCI_QUIRK_MASK (0x1043 ,0xff00 ,0x8100 ,"ASUS P5" ,AD1986A_FIXUP_3STACK ),SND_PCI_QUIRK_MASK (0x1043 ,0xff00 ,0x8200 ,"ASUS M2" ,AD1986A_FIXUP_3STACK ),SND_PCI_QUIRK (0x10de ,0xcb84 ,"ASUS A8N-VM" ,AD1986A_FIXUP_3STACK ),
Signature · 1 line
2.0.0
PATCH 46/111 ALSA: hda/realtek - Correction of fixup codes for PB V7900 laptop
In reply to Jiri SlabyFrom: Ronan Marquet <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit e30cf2d2bed3aed74a651c64de323ba26e4ff7d0 upstream.
Correcion of wrong fixup entries add in commit ca8f0424 to replace static model quirk for PB V7900 laptop (will model).
[note: the removal of ALC260_FIXUP_HP_PIN_0F chain is also needed as a
part of the fix; otherwise the pin is set up wrongly as a headphone, and user-space (PulseAudio) may be wrongly trying to detect the jack state -- tiwai]
--- sound/pci/hda/patch_realtek.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
sound/pci/hda/patch_realtek.c +2 -4
@@ -1597,12 +1597,10 @@ static const struct hda_fixup alc260_fixups[] = { [ALC260_FIXUP_COEF] = { .type = HDA_FIXUP_VERBS, .v.verbs = (const struct hda_verb []) { - {0x20 ,AC_VERB_SET_COEF_INDEX ,0x07 }, - {0x20 ,AC_VERB_SET_PROC_COEF ,0x3040 }, + {0x1a ,AC_VERB_SET_COEF_INDEX ,0x07 }, + {0x1a ,AC_VERB_SET_PROC_COEF ,0x3040 }, { } }, - .chained = true, - .chain_id = ALC260_FIXUP_HP_PIN_0F, }, [ALC260_FIXUP_GPIO1] = { .type = HDA_FIXUP_VERBS,
Signature · 1 line
2.0.0
PATCH 47/111 ALSA: hda/realtek - Fix COEF widget NID for ALC260 replacer fixup
In reply to Jiri SlabyFrom: Takashi Iwai <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 192a98e280e560510a62aca8cfa83b4ae7c095bb upstream.
The conversion to a fixup table for Replacer model with ALC260 in commit 20f7d928 took the wrong widget NID for COEF setups. Namely, NID 0x1a should have been used instead of NID 0x20, which is the common node for all Realtek codecs but ALC260.
--- sound/pci/hda/patch_realtek.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/pci/hda/patch_realtek.c +2 -2
@@ -1615,8 +1615,8 @@ static const struct hda_fixup alc260_fixups[] = { [ALC260_FIXUP_REPLACER] = { .type = HDA_FIXUP_VERBS, .v.verbs = (const struct hda_verb []) { - {0x20 ,AC_VERB_SET_COEF_INDEX ,0x07 }, - {0x20 ,AC_VERB_SET_PROC_COEF ,0x3050 }, + {0x1a ,AC_VERB_SET_COEF_INDEX ,0x07 }, + {0x1a ,AC_VERB_SET_PROC_COEF ,0x3050 }, { } }, .chained = true,
Signature · 1 line
2.0.0
PATCH 48/111 USB: ftdi_sio: add NovaTech OrionLXm product ID
In reply to Jiri SlabyFrom: George McCollister <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit d0839d757e6294921c31b1c4ca4f1dcc5df63bcd upstream.
The NovaTech OrionLXm uses an onboard FTDI serial converter for JTAG and console access.
Here is the lsusb output:
Bus 004 Device 123: ID 0403:7c90 Future Technology Devices International, Ltd
--- drivers/usb/serial/ftdi_sio.c | 2 ++ drivers/usb/serial/ftdi_sio_ids.h | 5 +++++ 2 files changed, 7 insertions(+)
drivers/usb/serial/ftdi_sio.c +2 -0
@@ -581,6 +581,8 @@ static struct usb_device_id id_table_combined [] = { { USB_DEVICE(FTDI_VID, FTDI_TAVIR_STK500_PID) }, { USB_DEVICE(FTDI_VID, FTDI_TIAO_UMPA_PID), .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLXM_PID), + .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },/* * ELV devices: */
drivers/usb/serial/ftdi_sio_ids.h +5 -0
@@ -538,6 +538,11 @@*/ #define FTDI_TIAO_UMPA_PID 0x8a98/* TIAO/DIYGADGET USB Multi-Protocol Adapter */ +/* +* NovaTech product ids (FTDI_VID) +*/ +#define FTDI_NT_ORIONLXM_PID 0x7c90/* OrionLXm Substation Automation Platform */ +/********************************/ /** third-party VID/PID combos **/
Signature · 1 line
2.0.0
PATCH 49/111 usb: cdc-wdm: export cdc-wdm uapi header
In reply to Jiri SlabyFrom: Bjørn Mork <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 7d1896360f4d055d68565ef8ed56a677580f1a39 upstream.
The include/uapi/linux/usb/cdc-wdm.h header defines cdc-wdm userspace APIs and should be exported by make headers_install.
--- include/uapi/linux/usb/Kbuild | 1 + 1 file changed, 1 insertion(+)
include/uapi/linux/usb/Kbuild +1 -0
@@ -1,6 +1,7 @@ # UAPI Header export list header-y += audio.h header-y += cdc.h +header-y += cdc-wdm.h header-y += ch11.h header-y += ch9.h header-y += functionfs.h
Signature · 1 line
2.0.0
PATCH 50/111 USB: cdc-wdm: properly include types.h
In reply to Jiri SlabyFrom: Greg Kroah-Hartman <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 7ac3764fcafc06e72e1a79a9d998b9fdd900b2a6 upstream.
The file include/uapi/linux/usb/cdc-wdm.h uses a __u16 so it needs to include types.h as well to make the build system happy.
--- include/uapi/linux/usb/cdc-wdm.h | 2 ++ 1 file changed, 2 insertions(+)
include/uapi/linux/usb/cdc-wdm.h +2 -0
@@ -9,6 +9,8 @@#ifndef _UAPI__LINUX_USB_CDC_WDM_H#define _UAPI__LINUX_USB_CDC_WDM_H +#include <linux/types.h> +/* * This IOCTL is used to retrieve the wMaxCommand for the device, * defining the message limit for both reading and writing.
Signature · 1 line
2.0.0
PATCH 51/111 USB: serial: option: add support for Novatel E371 PCIe card
In reply to Jiri SlabyFrom: Alexej Starschenko <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 8a61ba3a47ac39f660702aa66a172185dd605a86 upstream.
Adds product ID for the Novatel E371 PCI Express Mini Card.
$ lsusb Bus 001 Device 024: ID 1410:9011 Novatel Wireless
$ usb-devices T: Bus=01 Lev=01 Prnt=01 Port=03 Cnt=01 Dev#= 24 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=1410 ProdID=9011 Rev=00.03 S: Manufacturer=Novatel Wireless, Inc. S: Product=Novatel Wireless HSPA S: SerialNumber=012773002115811 C: #Ifs= 6 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option I: If#= 6 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether I: If#= 7 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether
Tested with kernel 3.2.0.
--- drivers/usb/serial/option.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/serial/option.c +2 -0
@@ -161,6 +161,7 @@ static void option_instat_callback(struct urb *urb);#define NOVATELWIRELESS_PRODUCT_HSPA_EMBEDDED_FULLSPEED 0x9000#define NOVATELWIRELESS_PRODUCT_HSPA_EMBEDDED_HIGHSPEED 0x9001#define NOVATELWIRELESS_PRODUCT_E362 0x9010 +#define NOVATELWIRELESS_PRODUCT_E371 0x9011#define NOVATELWIRELESS_PRODUCT_G2 0xA010#define NOVATELWIRELESS_PRODUCT_MC551 0xB001
@@ -1012,6 +1013,7 @@ static const struct usb_device_id option_ids[] = {/* Novatel Ovation MC551 a.k.a. Verizon USB551L */ { USB_DEVICE_AND_INTERFACE_INFO(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_MC551, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_E362, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_E371, 0xff, 0xff, 0xff) }, { USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_H01) }, { USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_H01A) },
Signature · 1 line
2.0.0
PATCH 52/111 USB: io_ti: fix firmware download on big-endian machines (part 2)
In reply to Jiri SlabyFrom: Johan Hovold <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit c03890ff5e24a4bf59059f2d179f427559b7330a upstream.
A recent patch that purported to fix firmware download on big-endian machines failed to add the corresponding sparse annotation to the i2c-header. This was reported by the kbuild test robot.
Adding the appropriate annotation revealed another endianess bug related to the i2c-header Size-field in a code path that is exercised when the firmware is actually being downloaded (and not just verified and left untouched unless older than the firmware at hand).
This patch adds the required sparse annotation to the i2c-header and makes sure that the Size-field is sent in little-endian byte order during firmware download also on big-endian machines.
Note that this patch is only compile-tested, but that there is no functional change for little-endian systems.
--- drivers/usb/serial/io_ti.c | 2 +- drivers/usb/serial/io_usbvend.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/usb/serial/io_ti.c +1 -1
@@ -832,7 +832,7 @@ static int build_i2c_fw_hdr(__u8 *header, struct device *dev) firmware_rec = (struct ti_i2c_firmware_rec *)i2c_header->Data; i2c_header->Type =I2C_DESC_TYPE_FIRMWARE_BLANK ; - i2c_header->Size = (__u16 )buffer_size; + i2c_header->Size =cpu_to_le16 (buffer_size); i2c_header->CheckSum = cs; firmware_rec->Ver_Major = OperationalMajorVersion; firmware_rec->Ver_Minor = OperationalMinorVersion;
drivers/usb/serial/io_usbvend.h +1 -1
@@ -594,7 +594,7 @@ struct edge_boot_descriptor {struct ti_i2c_desc {__u8 Type;// Type of descriptor -__u16 Size;// Size of data only not including header +__le16 Size;// Size of data only not including header __u8 CheckSum;// Checksum (8 bit sum of data only) __u8 Data[0 ];// Data starts here } __attribute__((packed));
Signature · 1 line
2.0.0
PATCH 53/111 usb: pci-quirks: Prevent Sony VAIO t-series from switching usb ports
In reply to Jiri SlabyFrom: Mathias Nyman <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit b38f09ccc3fd453180e96273bf3f34083c30809a upstream.
Sony VAIO t-series machines are not capable of switching usb2 ports over from Intel EHCI to xHCI controller. If tried the USB2 port will be left unconnected and unusable.
This patch should be backported to stable kernels as old as 3.12, that contain the commit 26b76798e0507429506b93cd49f8c4cfdab06896 "Intel xhci: refactor EHCI/xHCI port switching"
--- drivers/usb/host/pci-quirks.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/usb/host/pci-quirks.c +7 -0
@@ -836,6 +836,13 @@ void usb_enable_intel_xhci_ports(struct pci_dev *xhci_pdev)bool ehci_found = false;struct pci_dev *companion =NULL ; +/* Sony VAIO t-series with subsystem device ID 90a8 is not capable of +* switching ports from EHCI to xHCI +*/ +if (xhci_pdev->subsystem_vendor ==PCI_VENDOR_ID_SONY && + xhci_pdev->subsystem_device ==0x90a8 ) +return ; +/* make sure an intel EHCI controller exists */ for_each_pci_dev (companion) { if (companion->class == PCI_CLASS_SERIAL_USB_EHCI &&
Signature · 1 line
2.0.0
PATCH 54/111 USB: Avoid runtime suspend loops for HCDs that can't handle suspend/resume
In reply to Jiri SlabyFrom: Alan Stern <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 8ef42ddd9a53b73e6fc3934278710c27f80f324f upstream.
Not all host controller drivers have bus-suspend and bus-resume methods. When one doesn't, it will cause problems if runtime PM is enabled in the kernel. The PM core will attempt to suspend the controller's root hub, the suspend will fail because there is no bus-suspend routine, and a -EBUSY error code will be returned to the PM core. This will cause the suspend attempt to be repeated shortly thereafter, in a never-ending loop.
Part of the problem is that the original error code -ENOENT gets changed to -EBUSY in usb_runtime_suspend(), on the grounds that the PM core will interpret -ENOENT as meaning that the root hub has gotten into a runtime-PM error state. While this change is appropriate for real USB devices, it's not such a good idea for a root hub. In fact, considering the root hub to be in a runtime-PM error state would not be far from the truth. Therefore this patch updates usb_runtime_suspend() so that it adjusts error codes only for non-root-hub devices.
Furthermore, the patch attempts to prevent the problem from occurring in the first place by not enabling runtime PM by default for root hubs whose host controller driver doesn't have bus_suspend and bus_resume methods.
--- drivers/usb/core/driver.c | 9 ++++++--- drivers/usb/core/hub.c | 15 +++++++++++++-- 2 files changed, 19 insertions(+), 5 deletions(-)
drivers/usb/core/driver.c +6 -3
@@ -1770,10 +1770,13 @@ int usb_runtime_suspend(struct device *dev)if (status == -EAGAIN || status == -EBUSY )usb_mark_last_busy (udev); -/* The PM core reacts badly unless the return code is 0, -* -EAGAIN, or -EBUSY, so always return -EBUSY on an error. +/* +* The PM core reacts badly unless the return code is 0, +* -EAGAIN, or -EBUSY, so always return -EBUSY on an error +* (except for root hubs, because they don't suspend through +* an upstream port like other USB devices). */ -if (status !=0 ) +if (status !=0 && udev->parent)return -EBUSY ;return status; }
drivers/usb/core/hub.c +13 -2
@@ -1688,8 +1688,19 @@ static int hub_probe(struct usb_interface *intf, const struct usb_device_id *id)*/ pm_runtime_set_autosuspend_delay (&hdev->dev,0 ); -/* Hubs have proper suspend/resume support. */ -usb_enable_autosuspend (hdev); +/* +* Hubs have proper suspend/resume support, except for root hubs +* where the controller driver doesn't have bus_suspend and +* bus_resume methods. +*/ +if (hdev->parent) {/* normal device */ +usb_enable_autosuspend (hdev); + }else {/* root hub */ +const struct hc_driver *drv =bus_to_hcd (hdev->bus)->driver; + +if (drv->bus_suspend && drv->bus_resume) +usb_enable_autosuspend (hdev); + }if (hdev->level ==MAX_TOPO_LEVEL ) { dev_err(&intf->dev,
Signature · 1 line
2.0.0
PATCH 55/111 percpu-refcount: fix usage of this_cpu_ops
In reply to Jiri SlabyFrom: Sebastian Ott <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 0c36b390a546055b6815d4b93a2c9fed4d980ffb upstream.
The percpu-refcount infrastructure uses the underscore variants of this_cpu_ops in order to modify percpu reference counters. (e.g. __this_cpu_inc()).
However the underscore variants do not atomically update the percpu variable, instead they may be implemented using read-modify-write semantics (more than one instruction). Therefore it is only safe to use the underscore variant if the context is always the same (process, softirq, or hardirq). Otherwise it is possible to lose updates.
This problem is something that Sebastian has seen within the aio subsystem which uses percpu refcounters both in process and softirq context leading to reference counts that never dropped to zeroes; even though the number of "get" and "put" calls matched.
Fix this by using the non-underscore this_cpu_ops variant which provides correct per cpu atomic semantics and fixes the corrupted reference counts.
References: http://lkml.kernel.org/g/alpine.LFD.2.11.1406041540520.21183@denkbrett
--- include/linux/percpu-refcount.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
include/linux/percpu-refcount.h +3 -3
@@ -110,7 +110,7 @@ static inline void percpu_ref_get(struct percpu_ref *ref) pcpu_count =ACCESS_ONCE (ref->pcpu_count);if (likely (REF_STATUS (pcpu_count) ==PCPU_REF_PTR )) -__this_cpu_inc (*pcpu_count); +this_cpu_inc (*pcpu_count);else atomic_inc (&ref->count);
@@ -139,7 +139,7 @@ static inline bool percpu_ref_tryget(struct percpu_ref *ref) pcpu_count =ACCESS_ONCE (ref->pcpu_count);if (likely (REF_STATUS (pcpu_count) ==PCPU_REF_PTR )) { -__this_cpu_inc (*pcpu_count); +this_cpu_inc (*pcpu_count); ret = true; }
@@ -164,7 +164,7 @@ static inline void percpu_ref_put(struct percpu_ref *ref) pcpu_count =ACCESS_ONCE (ref->pcpu_count);if (likely (REF_STATUS (pcpu_count) ==PCPU_REF_PTR )) -__this_cpu_dec (*pcpu_count); +this_cpu_dec (*pcpu_count);else if (unlikely (atomic_dec_and_test (&ref->count))) ref->release (ref);
Signature · 1 line
2.0.0
PATCH 56/111 mm: rmap: fix use-after-free in __put_anon_vma
In reply to Jiri SlabyFrom: Andrey Ryabinin <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 624483f3ea82598ab0f62f1bdb9177f531ab1892 upstream.
While working address sanitizer for kernel I've discovered use-after-free bug in __put_anon_vma.
For the last anon_vma, anon_vma->root freed before child anon_vma. Later in anon_vma_free(anon_vma) we are referencing to already freed anon_vma->root to check rwsem.
This fixes it by freeing the child anon_vma before freeing anon_vma->root.
--- mm/rmap.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
mm/rmap.c +1 -2
@@ -1681,10 +1681,9 @@ void __put_anon_vma(struct anon_vma *anon_vma) {struct anon_vma *root = anon_vma->root; +anon_vma_free (anon_vma);if (root != anon_vma &&atomic_dec_and_test (&root->refcount))anon_vma_free (root); - -anon_vma_free (anon_vma); }#ifdef CONFIG_MIGRATION
Signature · 1 line
2.0.0
PATCH 57/111 iser-target: Add missing target_put_sess_cmd for ImmedateData failure
In reply to Jiri SlabyFrom: Nicholas Bellinger <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 6cc44a6fb46e1ecc1c28125aa8fa34d317aa9ea7 upstream.
This patch addresses a bug where an early exception for SCSI WRITE with ImmediateData=Yes was missing the target_put_sess_cmd() call to drop the extra se_cmd->cmd_kref reference obtained during the normal iscsit_setup_scsi_cmd() codepath execution.
This bug was manifesting itself during session shutdown within isert_cq_rx_comp_err() where target_wait_for_sess_cmds() would end up waiting indefinately for the last se_cmd->cmd_kref put to occur for the failed SCSI WRITE + ImmediateData descriptors.
This fix follows what traditional iscsi-target code already does for the same failure case within iscsit_get_immediate_data().
--- drivers/infiniband/ulp/isert/ib_isert.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/infiniband/ulp/isert/ib_isert.c +2 -0
@@ -1081,6 +1081,8 @@ sequence_cmd:if (!rc && dump_payload == false && unsol_data)iscsit_set_unsoliticed_dataout (cmd); +else if (dump_payload && imm_data) +target_put_sess_cmd (conn->sess->se_sess, &cmd->se_cmd);return 0 ; }
Signature · 1 line
2.0.0
PATCH 58/111 target: Fix alua_access_state attribute OOPs for un-configured devices
In reply to Jiri SlabyFrom: Nicholas Bellinger <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit f1453773514bb8b0bba0716301e8c8f17f8d39c7 upstream.
This patch fixes a OOPs where an attempt to write to the per-device alua_access_state configfs attribute at:
/sys/kernel/config/target/core/$HBA/$DEV/alua/$TG_PT_GP/alua_access_state
results in an NULL pointer dereference when the backend device has not yet been configured.
This patch adds an explicit check for DF_CONFIGURED, and fails with -ENODEV to avoid this case.
--- drivers/target/target_core_configfs.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/target/target_core_configfs.c +5 -0
@@ -2040,6 +2040,11 @@ static ssize_t target_core_alua_tg_pt_gp_store_attr_alua_access_state( " tg_pt_gp ID: %hu\n", tg_pt_gp->tg_pt_gp_valid_id);return -EINVAL ; } +if (!(dev->dev_flags &DF_CONFIGURED )) { +pr_err ("Unable to set alua_access_state while device is" +" not configured\n" ); +return -ENODEV ; + } ret =kstrtoul (page,0 , &tmp);if (ret <0 ) {
Signature · 1 line
2.0.0
PATCH 59/111 gpio: mcp23s08: Bug fix of SPI device tree registration.
In reply to Jiri SlabyFrom: Michael Welling <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 99e4b98dbe3ad1fe38a74d12c3b8d44a55930de4 upstream.
The chips variable needs to be incremented for each chip that is found in the spi_present_mask when registering via device tree. Without this and the checking a negative index is passed to the data->chip array in a subsequent loop.
--- drivers/gpio/gpio-mcp23s08.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
drivers/gpio/gpio-mcp23s08.c +7 -4
@@ -657,8 +657,11 @@ static int mcp23s08_probe(struct spi_device *spi)return -ENODEV ; } -for (addr =0 ; addr <ARRAY_SIZE (pdata->chip); addr++) +for (addr =0 ; addr <ARRAY_SIZE (pdata->chip); addr++) { pullups[addr] =0 ; +if (spi_present_mask & (1 << addr)) + chips++; + } }else { type =spi_get_device_id (spi)->driver_data; pdata =dev_get_platdata (&spi->dev);
@@ -681,12 +684,12 @@ static int mcp23s08_probe(struct spi_device *spi) pullups[addr] = pdata->chip[addr].pullups; } -if (!chips) -return -ENODEV ; - base = pdata->base; } +if (!chips) +return -ENODEV ; + data =kzalloc (sizeof *data + chips *sizeof (struct mcp23s08 ),GFP_KERNEL );if (!data)
Signature · 1 line
2.0.0
PATCH 60/111 rtl28xxu: add 15f4:0131 Astrometa DVB-T2
In reply to Jiri SlabyFrom: Antti Palosaari <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 8fdd33b1bcf32ed9cf21aa9e4a66fa68c6beaa1b upstream.
Components are RTL2832P + R828D + MN88472.
Currently support only DVB-T as there is no driver for MN88472 demod.
--- drivers/media/usb/dvb-usb-v2/rtl28xxu.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/media/usb/dvb-usb-v2/rtl28xxu.c +3 -0
@@ -1388,6 +1388,9 @@ static const struct usb_device_id rtl28xxu_id_table[] = { &rtl2832u_props, "Leadtek WinFast DTV Dongle mini", NULL) }, {DVB_USB_DEVICE (USB_VID_GTEK ,USB_PID_CPYTO_REDI_PC50A , &rtl2832u_props, "Crypto ReDi PC 50 A", NULL) }, + + { DVB_USB_DEVICE(USB_VID_HANFTEK, 0x0131, + &rtl2832u_props, "Astrometa DVB-T2", NULL) }, { } };MODULE_DEVICE_TABLE (usb, rtl28xxu_id_table);
Signature · 1 line
2.0.0
PATCH 61/111 Add USB IDs for Winfast DTV Dongle Mini-D
In reply to Jiri SlabyFrom: Robert Backhaus <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit d22d32e117c19efa1761d871d9dab5e294b7b77d upstream.
GIT_AUTHOR_DATE=1386943312
Add USB IDs for the WinFast DTV Dongle Mini.
Device is tested and works fine under MythTV
--- drivers/media/dvb-core/dvb-usb-ids.h | 1 + drivers/media/usb/dvb-usb-v2/rtl28xxu.c | 2 ++ 2 files changed, 3 insertions(+)
drivers/media/dvb-core/dvb-usb-ids.h +1 -0
@@ -318,6 +318,7 @@#define USB_PID_WINFAST_DTV_DONGLE_H 0x60f6#define USB_PID_WINFAST_DTV_DONGLE_STK7700P_2 0x6f01#define USB_PID_WINFAST_DTV_DONGLE_GOLD 0x6029 +#define USB_PID_WINFAST_DTV_DONGLE_MINID 0x6f0f#define USB_PID_GENPIX_8PSK_REV_1_COLD 0x0200#define USB_PID_GENPIX_8PSK_REV_1_WARM 0x0201#define USB_PID_GENPIX_8PSK_REV_2 0x0202
drivers/media/usb/dvb-usb-v2/rtl28xxu.c +2 -0
@@ -1368,6 +1368,8 @@ static const struct usb_device_id rtl28xxu_id_table[] = { &rtl2832u_props, "Dexatek DK DVB-T Dongle", NULL) }, {DVB_USB_DEVICE (USB_VID_LEADTEK ,0x6680 , &rtl2832u_props, "DigitalNow Quad DVB-T Receiver", NULL) }, + { DVB_USB_DEVICE(USB_VID_LEADTEK, USB_PID_WINFAST_DTV_DONGLE_MINID, + &rtl2832u_props, "Leadtek Winfast DTV Dongle Mini D", NULL) }, { DVB_USB_DEVICE(USB_VID_TERRATEC, 0x00d3, &rtl2832u_props, "TerraTec Cinergy T Stick RC (Rev. 3)", NULL) }, { DVB_USB_DEVICE(USB_VID_DEXATEK, 0x1102,
Signature · 1 line
2.0.0
PATCH 62/111 fs,userns: Change inode_capable to capable_wrt_inode_uidgid
In reply to Jiri SlabyFrom: Andy Lutomirski <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 23adbe12ef7d3d4195e80800ab36b37bee28cd03 upstream.
The kernel has no concept of capabilities with respect to inodes; inodes exist independently of namespaces. For example, inode_capable(inode, CAP_LINUX_IMMUTABLE) would be nonsense.
This patch changes inode_capable to check for uid and gid mappings and renames it to capable_wrt_inode_uidgid, which should make it more obvious what it does.
Fixes CVE-2014-4014.
--- fs/attr.c | 8 ++++---- fs/inode.c | 10 +++++++--- fs/namei.c | 11 ++++++----- fs/xfs/xfs_ioctl.c | 2 +- include/linux/capability.h | 2 +- kernel/capability.c | 20 ++++++++------------ 6 files changed, 27 insertions(+), 26 deletions(-)
fs/attr.c +4 -4
@@ -50,14 +50,14 @@ int inode_change_ok(const struct inode *inode, struct iattr *attr)if ((ia_valid &ATTR_UID ) && (!uid_eq (current_fsuid (), inode->i_uid) || !uid_eq (attr->ia_uid, inode->i_uid)) && - !inode_capable (inode,CAP_CHOWN )) + !capable_wrt_inode_uidgid (inode,CAP_CHOWN ))return -EPERM ;/* Make sure caller can chgrp. */ if ((ia_valid &ATTR_GID ) && (!uid_eq (current_fsuid (), inode->i_uid) || (!in_group_p (attr->ia_gid) && !gid_eq (attr->ia_gid, inode->i_gid))) && - !inode_capable (inode,CAP_CHOWN )) + !capable_wrt_inode_uidgid (inode,CAP_CHOWN ))return -EPERM ;/* Make sure a caller can chmod. */
@@ -67,7 +67,7 @@ int inode_change_ok(const struct inode *inode, struct iattr *attr)/* Also check the setgid bit! */ if (!in_group_p ((ia_valid &ATTR_GID ) ? attr->ia_gid : inode->i_gid) && - !inode_capable (inode,CAP_FSETID )) + !capable_wrt_inode_uidgid (inode,CAP_FSETID )) attr->ia_mode &= ~S_ISGID ; }
@@ -160,7 +160,7 @@ void setattr_copy(struct inode *inode, const struct iattr *attr)umode_t mode = attr->ia_mode;if (!in_group_p (inode->i_gid) && - !inode_capable (inode,CAP_FSETID )) + !capable_wrt_inode_uidgid (inode,CAP_FSETID )) mode &= ~S_ISGID ; inode->i_mode = mode; }
fs/inode.c +7 -3
@@ -1808,14 +1808,18 @@ EXPORT_SYMBOL(inode_init_owner);* inode_owner_or_capable - check current task permissions to inode * @inode: inode being checked * -* Return true if current either has CAP_FOWNER to the inode, or -* owns the file. +* Return true if current either has CAP_FOWNER in a namespace with the +* inode owner uid mapped, or owns the file. */ bool inode_owner_or_capable (const struct inode *inode) { +struct user_namespace *ns; +if (uid_eq (current_fsuid (), inode->i_uid))return true; -if (inode_capable (inode,CAP_FOWNER )) + + ns =current_user_ns (); +if (ns_capable (ns,CAP_FOWNER ) &&kuid_has_mapping (ns, inode->i_uid))return true;return false; }
fs/namei.c +6 -5
@@ -321,10 +321,11 @@ int generic_permission(struct inode *inode, int mask)if (S_ISDIR (inode->i_mode)) {/* DACs are overridable for directories */ -if (inode_capable (inode,CAP_DAC_OVERRIDE )) +if (capable_wrt_inode_uidgid (inode,CAP_DAC_OVERRIDE ))return 0 ;if (!(mask &MAY_WRITE )) -if (inode_capable (inode,CAP_DAC_READ_SEARCH )) +if (capable_wrt_inode_uidgid (inode, +CAP_DAC_READ_SEARCH ))return 0 ;return -EACCES ; }
@@ -334,7 +335,7 @@ int generic_permission(struct inode *inode, int mask)* at least one exec bit set. */ if (!(mask &MAY_EXEC ) || (inode->i_mode &S_IXUGO )) -if (inode_capable (inode,CAP_DAC_OVERRIDE )) +if (capable_wrt_inode_uidgid (inode,CAP_DAC_OVERRIDE ))return 0 ;/*
@@ -342,7 +343,7 @@ int generic_permission(struct inode *inode, int mask)*/ mask &=MAY_READ |MAY_WRITE |MAY_EXEC ;if (mask ==MAY_READ ) -if (inode_capable (inode,CAP_DAC_READ_SEARCH )) +if (capable_wrt_inode_uidgid (inode,CAP_DAC_READ_SEARCH ))return 0 ;return -EACCES ;
@@ -2404,7 +2405,7 @@ static inline int check_sticky(struct inode *dir, struct inode *inode)return 0 ;if (uid_eq (dir->i_uid, fsuid))return 0 ; -return !inode_capable (inode,CAP_FOWNER ); +return !capable_wrt_inode_uidgid (inode,CAP_FOWNER ); }/*
fs/xfs/xfs_ioctl.c +1 -1
@@ -1133,7 +1133,7 @@ xfs_ioctl_setattr(* cleared upon successful return from chown() */ if ((ip->i_d.di_mode & (S_ISUID |S_ISGID )) && - !inode_capable (VFS_I (ip),CAP_FSETID )) + !capable_wrt_inode_uidgid (VFS_I (ip),CAP_FSETID )) ip->i_d.di_mode &= ~(S_ISUID |S_ISGID );/*
include/linux/capability.h +1 -1
@@ -210,7 +210,7 @@ extern bool has_ns_capability_noaudit(struct task_struct *t, struct user_namespace *ns, int cap);extern bool capable (int cap);extern bool ns_capable (struct user_namespace *ns,int cap); -extern bool inode_capable (const struct inode *inode,int cap); +extern bool capable_wrt_inode_uidgid (const struct inode *inode,int cap);extern bool file_ns_capable (const struct file *file,struct user_namespace *ns,int cap);/* audit system wants to get cap info from files as well */
kernel/capability.c +8 -12
@@ -433,23 +433,19 @@ bool capable(int cap)EXPORT_SYMBOL (capable);/** -* inode_capable - Check superior capability over inode +* capable_wrt_inode_uidgid - Check nsown_capable and uid and gid mapped * @inode: The inode in question * @cap: The capability in question * -* Return true if the current task has the given superior capability -* targeted at it's own user namespace and that the given inode is owned -* by the current user namespace or a child namespace. -* -* Currently we check to see if an inode is owned by the current -* user namespace by seeing if the inode's owner maps into the -* current user namespace. -* +* Return true if the current task has the given capability targeted at +* its own user namespace and that the given inode's uid and gid are +* mapped into the current user namespace. */ -bool inode_capable (const struct inode *inode,int cap) +bool capable_wrt_inode_uidgid (const struct inode *inode,int cap) {struct user_namespace *ns =current_user_ns (); -return ns_capable (ns, cap) &&kuid_has_mapping (ns, inode->i_uid); +return ns_capable (ns, cap) &&kuid_has_mapping (ns, inode->i_uid) && +kgid_has_mapping (ns, inode->i_gid); } -EXPORT_SYMBOL (inode_capable); +EXPORT_SYMBOL (capable_wrt_inode_uidgid);
Signature · 1 line
2.0.0
PATCH 63/111 Target/iscsi,iser: Avoid accepting transport connections during stop stage
In reply to Jiri SlabyFrom: Sagi Grimberg <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 14f4b54fe38f3a8f8392a50b951c8aa43b63687a upstream.
When the target is in stop stage, iSER transport initiates RDMA disconnects. The iSER initiator may wish to establish a new connection over the still existing network portal. In this case iSER transport should not accept and resume new RDMA connections. In order to learn that, iscsi_np is added with enabled flag so the iSER transport can check when deciding weather to accept and resume a new connection request.
The iscsi_np is enabled after successful transport setup, and disabled before iscsi_np login threads are cleaned up.
--- drivers/infiniband/ulp/isert/ib_isert.c | 8 ++++++++ drivers/target/iscsi/iscsi_target_core.h | 1 + drivers/target/iscsi/iscsi_target_login.c | 1 + drivers/target/iscsi/iscsi_target_tpg.c | 1 + 4 files changed, 11 insertions(+)
drivers/infiniband/ulp/isert/ib_isert.c +8 -0
@@ -493,6 +493,14 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)struct ib_device *ib_dev = cma_id->device;int ret =0 ; +spin_lock_bh (&np->np_thread_lock); +if (!np->enabled) { +spin_unlock_bh (&np->np_thread_lock); +pr_debug ("iscsi_np is not enabled, reject connect request\n" ); +return rdma_reject (cma_id,NULL ,0 ); + } +spin_unlock_bh (&np->np_thread_lock); +pr_debug ("Entering isert_connect_request cma_id: %p, context: %p\n" , cma_id, cma_id->context);
drivers/target/iscsi/iscsi_target_core.h +1 -0
@@ -777,6 +777,7 @@ struct iscsi_np {int np_ip_proto;int np_sock_type;enum np_thread_state_table np_thread_state; +bool enabled;enum iscsi_timer_flags_table np_login_timer_flags;u32 np_exports;enum np_flags_table np_flags;
drivers/target/iscsi/iscsi_target_login.c +1 -0
@@ -983,6 +983,7 @@ int iscsi_target_setup_login_socket( } np->np_transport = t; + np->enabled = true;return 0 ; }
drivers/target/iscsi/iscsi_target_tpg.c +1 -0
@@ -184,6 +184,7 @@ static void iscsit_clear_tpg_np_login_thread(return ; } + tpg_np->tpg_np->enabled = false;iscsit_reset_np_thread (tpg_np->tpg_np, tpg_np, tpg, shutdown); }
Signature · 1 line
2.0.0
PATCH 64/111 iser-target: Fix multi network portal shutdown regression
In reply to Jiri SlabyFrom: Nicholas Bellinger <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 2363d196686e44c0158929e7cf96c8589a24a81b upstream.
This patch fixes a iser-target specific regression introduced in v3.15-rc6 with:
commit 14f4b54fe38f3a8f8392a50b951c8aa43b63687a
Author: Sagi Grimberg <[email protected]> Date: Tue Apr 29 13:13:47 2014 +0300
Target/iscsi,iser: Avoid accepting transport connections during stop stage
where the change to set iscsi_np->enabled = false within iscsit_clear_tpg_np_login_thread() meant that a iscsi_np with two iscsi_tpg_np exports would have it's parent iscsi_np set to a disabled state, even if other iscsi_tpg_np exports still existed.
This patch changes iscsit_clear_tpg_np_login_thread() to only set iscsi_np->enabled = false when shutdown = true, and also changes iscsit_del_np() to set iscsi_np->enabled = true when iscsi_np->np_exports is non zero.
--- drivers/target/iscsi/iscsi_target.c | 1 + drivers/target/iscsi/iscsi_target_tpg.c | 3 ++- 2 files changed, 3 insertions(+), 1 deletion(-)
drivers/target/iscsi/iscsi_target.c +1 -0
@@ -460,6 +460,7 @@ int iscsit_del_np(struct iscsi_np *np)spin_lock_bh (&np->np_thread_lock); np->np_exports--;if (np->np_exports) { + np->enabled = true;spin_unlock_bh (&np->np_thread_lock);return 0 ; }
drivers/target/iscsi/iscsi_target_tpg.c +2 -1
@@ -184,7 +184,8 @@ static void iscsit_clear_tpg_np_login_thread(return ; } - tpg_np->tpg_np->enabled = false; +if (shutdown) + tpg_np->tpg_np->enabled = false;iscsit_reset_np_thread (tpg_np->tpg_np, tpg_np, tpg, shutdown); }
Signature · 1 line
2.0.0
PATCH 65/111 target: Allow READ_CAPACITY opcode in ALUA Standby access state
In reply to Jiri SlabyFrom: Nicholas Bellinger <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit e7810c2d2c37fa8e58dda74b00790dab60fe6fba upstream.
This patch allows READ_CAPACITY + SAI_READ_CAPACITY_16 opcode processing to occur while the associated ALUA group is in Standby access state.
This is required to avoid host side LUN probe failures during the initial scan if an ALUA group has already implicitly changed into Standby access state.
This addresses a bug reported by Chris + Philip using dm-multipath
+ ESX hosts configured with ALUA multipath.
(Drop v3.15 specific set_ascq usage - nab)
--- drivers/target/target_core_alua.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/target/target_core_alua.c +9 -0
@@ -409,7 +409,16 @@ static inline int core_alua_state_standby(case REPORT_LUNS :case RECEIVE_DIAGNOSTIC :case SEND_DIAGNOSTIC : +case READ_CAPACITY :return 0 ; +case SERVICE_ACTION_IN : +switch (cdb[1 ] &0x1f ) { +case SAI_READ_CAPACITY_16 : +return 0 ; +default : + *alua_ascq =ASCQ_04H_ALUA_TG_PT_STANDBY ; +return 1 ; + }case MAINTENANCE_IN :switch (cdb[1 ] &0x1f ) {case MI_REPORT_TARGET_PGS :
Signature · 1 line
2.0.0
PATCH 66/111 auditsc: audit_krule mask accesses need bounds checking
In reply to Jiri SlabyFrom: Andy Lutomirski <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit a3c54931199565930d6d84f4c3456f6440aefd41 upstream.
Fixes an easy DoS and possible information disclosure.
This does nothing about the broken state of x32 auditing.
eparis: If the admin has enabled auditd and has specifically loaded audit rules. This bug has been around since before git. Wow...
--- kernel/auditsc.c | 27 ++++++++++++++++++--------- 1 file changed, 18 insertions(+), 9 deletions(-)
kernel/auditsc.c +18 -9
@@ -733,6 +733,22 @@ static enum audit_state audit_filter_task(struct task_struct *tsk, char **key)return AUDIT_BUILD_CONTEXT ; } +static int audit_in_mask (const struct audit_krule *rule,unsigned long val) +{ +int word, bit; + +if (val >0xffffffff ) +return false; + + word =AUDIT_WORD (val); +if (word >=AUDIT_BITMASK_SIZE ) +return false; + + bit =AUDIT_BIT (val); + +return rule->mask[word] & bit; +} +/* At syscall entry and exit time, this filter is called if the * audit_state is not low enough that auditing cannot take place, but is * also not high enough that we already know we have to write an audit
@@ -750,11 +766,8 @@ static enum audit_state audit_filter_syscall(struct task_struct *tsk,rcu_read_lock ();if (!list_empty (list)) { -int word =AUDIT_WORD (ctx->major); -int bit =AUDIT_BIT (ctx->major); -list_for_each_entry_rcu (e, list, list) { -if ((e->rule.mask[word] & bit) == bit && +if (audit_in_mask (&e->rule, ctx->major) &&audit_filter_rules (tsk, &e->rule, ctx,NULL , &state, false)) {rcu_read_unlock ();
@@ -774,20 +787,16 @@ static enum audit_state audit_filter_syscall(struct task_struct *tsk,static int audit_filter_inode_name (struct task_struct *tsk,struct audit_names *n,struct audit_context *ctx) { -int word, bit;int h =audit_hash_ino ((u32 )n->ino);struct list_head *list = &audit_inode_hash[h];struct audit_entry *e;enum audit_state state; - word =AUDIT_WORD (ctx->major); - bit =AUDIT_BIT (ctx->major); -if (list_empty (list))return 0 ;list_for_each_entry_rcu (e, list, list) { -if ((e->rule.mask[word] & bit) == bit && +if (audit_in_mask (&e->rule, ctx->major) &&audit_filter_rules (tsk, &e->rule, ctx, n, &state, false)) { ctx->current_state = state;return 1 ;
Signature · 1 line
2.0.0
PATCH 67/111 mei: me: drop harmful wait optimization
In reply to Jiri SlabyFrom: Tomas Winkler <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 07cd7be3d92eeeae1f92a017f2cfe4fdd9256526 upstream.
It my take time till ME_RDY will be cleared after the reset, so we cannot check the bit before we got the interrupt
--- drivers/misc/mei/hw-me.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/misc/mei/hw-me.c +1 -3
@@ -183,6 +183,7 @@ static int mei_me_hw_reset(struct mei_device *dev, bool intr_enable)else hcsr &= ~H_IE ; + dev->recvd_hw_ready = false;mei_me_reg_write (hw,H_CSR , hcsr);if (dev->dev_state ==MEI_DEV_POWER_DOWN )
@@ -233,10 +234,7 @@ static bool mei_me_hw_is_ready(struct mei_device *dev)static int mei_me_hw_ready_wait (struct mei_device *dev) {int err; -if (mei_me_hw_is_ready (dev)) -return 0 ; - dev->recvd_hw_ready = false;mutex_unlock (&dev->device_lock); err = wait_event_interruptible_timeout(dev->wait_hw_ready, dev->recvd_hw_ready,
Signature · 1 line
2.0.0
PATCH 68/111 rtl28xxu: add ID [0ccd:00b4] TerraTec NOXON DAB Stick (rev 3)
In reply to Jiri SlabyFrom: Till Dörges <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit a24bc323eb07e2a3a751e23c172b68d1b239db67 upstream.
I've got the following DAB USB stick that also works fine with the DVB_USB_RTL28XXU driver after I added its USB ID:
Bus 001 Device 009: ID 0ccd:00b4 TerraTec Electronic GmbH
--- drivers/media/dvb-core/dvb-usb-ids.h | 1 + drivers/media/usb/dvb-usb-v2/rtl28xxu.c | 2 ++ 2 files changed, 3 insertions(+)
drivers/media/dvb-core/dvb-usb-ids.h +1 -0
@@ -257,6 +257,7 @@#define USB_PID_TERRATEC_T5 0x10a1#define USB_PID_NOXON_DAB_STICK 0x00b3#define USB_PID_NOXON_DAB_STICK_REV2 0x00e0 +#define USB_PID_NOXON_DAB_STICK_REV3 0x00b4#define USB_PID_PINNACLE_EXPRESSCARD_320CX 0x022e#define USB_PID_PINNACLE_PCTV2000E 0x022c#define USB_PID_PINNACLE_PCTV_DVB_T_FLASH 0x0228
drivers/media/usb/dvb-usb-v2/rtl28xxu.c +2 -0
@@ -1362,6 +1362,8 @@ static const struct usb_device_id rtl28xxu_id_table[] = { &rtl2832u_props, "TerraTec NOXON DAB Stick", NULL) }, {DVB_USB_DEVICE (USB_VID_TERRATEC ,USB_PID_NOXON_DAB_STICK_REV2 , &rtl2832u_props, "TerraTec NOXON DAB Stick (rev 2)", NULL) }, + { DVB_USB_DEVICE(USB_VID_TERRATEC, USB_PID_NOXON_DAB_STICK_REV3, + &rtl2832u_props, "TerraTec NOXON DAB Stick (rev 3)", NULL) }, { DVB_USB_DEVICE(USB_VID_GTEK, USB_PID_TREKSTOR_TERRES_2_0, &rtl2832u_props, "Trekstor DVB-T Stick Terres 2.0", NULL) }, { DVB_USB_DEVICE(USB_VID_DEXATEK, 0x1101,
Signature · 1 line
2.0.0
PATCH 69/111 rtl28xxu: add USB ID for Genius TVGo DVB-T03
In reply to Jiri SlabyFrom: Jan Vcelak <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit ac298ccdde4fe9b0a966e548a232ff4e8a6b8a31 upstream.
0458:707f KYE Systems Corp. (Mouse Systems) TVGo DVB-T03 [RTL2832]
The USB dongle uses RTL2832U demodulator and FC0012 tuner.
--- drivers/media/usb/dvb-usb-v2/rtl28xxu.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/media/usb/dvb-usb-v2/rtl28xxu.c +2 -0
@@ -1392,6 +1392,8 @@ static const struct usb_device_id rtl28xxu_id_table[] = { &rtl2832u_props, "Leadtek WinFast DTV Dongle mini", NULL) }, {DVB_USB_DEVICE (USB_VID_GTEK ,USB_PID_CPYTO_REDI_PC50A , &rtl2832u_props, "Crypto ReDi PC 50 A", NULL) }, + { DVB_USB_DEVICE(USB_VID_KYE, 0x707f, + &rtl2832u_props, "Genius TVGo DVB-T03", NULL) }, { DVB_USB_DEVICE(USB_VID_HANFTEK, 0x0131, &rtl2832u_props, "Astrometa DVB-T2", NULL) },
Signature · 1 line
2.0.0
PATCH 70/111 rtl28xxu: add chipset version comments into device list
In reply to Jiri SlabyFrom: Jan Vcelak <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 60aa4c6fa5723af72cff154a5cd33ac4995d1e0a upstream.
--- drivers/media/usb/dvb-usb-v2/rtl28xxu.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/media/usb/dvb-usb-v2/rtl28xxu.c +3 -0
@@ -1343,6 +1343,7 @@ static const struct dvb_usb_device_properties rtl2832u_props = { };static const struct usb_device_id rtl28xxu_id_table[] = { +/* RTL2831U devices: */ {DVB_USB_DEVICE (USB_VID_REALTEK ,USB_PID_REALTEK_RTL2831U , &rtl2831u_props,"Realtek RTL2831U reference design" ,NULL ) }, { DVB_USB_DEVICE(USB_VID_WIDEVIEW, USB_PID_FREECOM_DVBT,
@@ -1350,6 +1351,7 @@ static const struct usb_device_id rtl28xxu_id_table[] = { {DVB_USB_DEVICE (USB_VID_WIDEVIEW ,USB_PID_FREECOM_DVBT_2 , &rtl2831u_props, "Freecom USB2.0 DVB-T", NULL) }, +/* RTL2832U devices: */ { DVB_USB_DEVICE(USB_VID_REALTEK, 0x2832, &rtl2832u_props, "Realtek RTL2832U reference design", NULL) }, { DVB_USB_DEVICE(USB_VID_REALTEK, 0x2838,
@@ -1395,6 +1397,7 @@ static const struct usb_device_id rtl28xxu_id_table[] = { {DVB_USB_DEVICE (USB_VID_KYE ,0x707f , &rtl2832u_props, "Genius TVGo DVB-T03", NULL) }, +/* RTL2832P devices: */ { DVB_USB_DEVICE(USB_VID_HANFTEK, 0x0131, &rtl2832u_props, "Astrometa DVB-T2", NULL) }, { }
Signature · 1 line
2.0.0
PATCH 71/111 rtl28xxu: add 1b80:d395 Peak DVB-T USB
In reply to Jiri SlabyFrom: Brian Healy <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 9ca24ae4083665bda38da45f4b5dc9bbaf936bc0 upstream.
Add USB ID for Peak DVB-T USB.
--- drivers/media/usb/dvb-usb-v2/rtl28xxu.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/media/usb/dvb-usb-v2/rtl28xxu.c +2 -0
@@ -1396,6 +1396,8 @@ static const struct usb_device_id rtl28xxu_id_table[] = { &rtl2832u_props, "Crypto ReDi PC 50 A", NULL) }, {DVB_USB_DEVICE (USB_VID_KYE ,0x707f , &rtl2832u_props, "Genius TVGo DVB-T03", NULL) }, + { DVB_USB_DEVICE(USB_VID_KWORLD_2, 0xd395, + &rtl2832u_props, "Peak DVB-T USB", NULL) },/* RTL2832P devices: */ { DVB_USB_DEVICE(USB_VID_HANFTEK, 0x0131,
Signature · 1 line
2.0.0
PATCH 72/111 rtl28xxu: add [1b80:d39d] Sveon STV20
In reply to Jiri SlabyFrom: Alessandro Miceli <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit f27f5b0ee4967babfb8b03511f5e76b79d781014 upstream.
Added Sveon STV20 device based on Realtek RTL2832U and FC0012 tuner
--- drivers/media/dvb-core/dvb-usb-ids.h | 1 + drivers/media/usb/dvb-usb-v2/rtl28xxu.c | 2 ++ 2 files changed, 3 insertions(+)
drivers/media/dvb-core/dvb-usb-ids.h +1 -0
@@ -361,6 +361,7 @@#define USB_PID_FRIIO_WHITE 0x0001#define USB_PID_TVWAY_PLUS 0x0002#define USB_PID_SVEON_STV20 0xe39d +#define USB_PID_SVEON_STV20_RTL2832U 0xd39d#define USB_PID_SVEON_STV22 0xe401#define USB_PID_SVEON_STV22_IT9137 0xe411#define USB_PID_AZUREWAVE_AZ6027 0x3275
drivers/media/usb/dvb-usb-v2/rtl28xxu.c +2 -0
@@ -1398,6 +1398,8 @@ static const struct usb_device_id rtl28xxu_id_table[] = { &rtl2832u_props, "Genius TVGo DVB-T03", NULL) }, {DVB_USB_DEVICE (USB_VID_KWORLD_2 ,0xd395 , &rtl2832u_props, "Peak DVB-T USB", NULL) }, + { DVB_USB_DEVICE(USB_VID_KWORLD_2, USB_PID_SVEON_STV20_RTL2832U, + &rtl2832u_props, "Sveon STV20", NULL) },/* RTL2832P devices: */ { DVB_USB_DEVICE(USB_VID_HANFTEK, 0x0131,
Signature · 1 line
2.0.0
PATCH 73/111 rtl28xxu: add [1b80:d3af] Sveon STV27
In reply to Jiri SlabyFrom: Alessandro Miceli <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 74a86272f05c3dae40f2d7b17ff09a0608cf3304 upstream.
Added support for Sveon STV27 device (rtl2832u + FC0013 tuner)
--- drivers/media/dvb-core/dvb-usb-ids.h | 1 + drivers/media/usb/dvb-usb-v2/rtl28xxu.c | 2 ++ 2 files changed, 3 insertions(+)
drivers/media/dvb-core/dvb-usb-ids.h +1 -0
@@ -375,4 +375,5 @@#define USB_PID_CTVDIGDUAL_V2 0xe410#define USB_PID_PCTV_2002E 0x025c#define USB_PID_PCTV_2002E_SE 0x025d +#define USB_PID_SVEON_STV27 0xd3af#endif
drivers/media/usb/dvb-usb-v2/rtl28xxu.c +2 -0
@@ -1400,6 +1400,8 @@ static const struct usb_device_id rtl28xxu_id_table[] = { &rtl2832u_props, "Peak DVB-T USB", NULL) }, {DVB_USB_DEVICE (USB_VID_KWORLD_2 ,USB_PID_SVEON_STV20_RTL2832U , &rtl2832u_props, "Sveon STV20", NULL) }, + { DVB_USB_DEVICE(USB_VID_KWORLD_2, USB_PID_SVEON_STV27, + &rtl2832u_props, "Sveon STV27", NULL) },/* RTL2832P devices: */ { DVB_USB_DEVICE(USB_VID_HANFTEK, 0x0131,
Signature · 1 line
2.0.0
PATCH 74/111 ahci: Add Device ID for HighPoint RocketRaid 642L
In reply to Jiri SlabyFrom: Jérôme Carretero <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit d251836508fb26cd1a22b41381739835ee23728d upstream.
This device normally comes with a proprietary driver, using a web GUI to configure RAID:
http://www.highpoint-tech.com/USA_new/series_rr600-download.htm
But thankfully it also works out of the box with the AHCI driver, being just a Marvell 88SE9235.
Devices 640L, 644L, 644LS should also be supported but not tested here.
--- drivers/ata/ahci.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/ata/ahci.c +2 -0
@@ -448,6 +448,8 @@ static const struct pci_device_id ahci_pci_tbl[] = { .driver_data = board_ahci_yes_fbs }, { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x9230), .driver_data = board_ahci_yes_fbs }, + { PCI_DEVICE(PCI_VENDOR_ID_TTI, 0x0642), + .driver_data = board_ahci_yes_fbs },/* Promise */ { PCI_VDEVICE(PROMISE, 0x3f20), board_ahci }, /* PDC42819 */
Signature · 1 line
2.0.0
PATCH 75/111 ahci: add PCI ID for Marvell 88SE91A0 SATA Controller
In reply to Jiri SlabyFrom: Andreas Schrägle <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 754a292fe6b08196cb135c03b404444e17de520a upstream.
Add support for Marvell Technology Group Ltd. 88SE91A0 SATA 6Gb/s Controller by adding its PCI ID.
--- drivers/ata/ahci.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/ata/ahci.c +2 -0
@@ -444,6 +444,8 @@ static const struct pci_device_id ahci_pci_tbl[] = { .driver_data = board_ahci_yes_fbs }, /* 88se9172 */ { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x9192), .driver_data = board_ahci_yes_fbs }, /* 88se9172 on some Gigabyte */ + { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x91a0), + .driver_data = board_ahci_yes_fbs }, { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x91a3), .driver_data = board_ahci_yes_fbs }, { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x9230),
Signature · 1 line
2.0.0
PATCH 76/111 drm/i915: Allow user modes to exceed DVI 165MHz limit
In reply to Jiri SlabyFrom: Ville Syrjälä <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 40478455fefdc0bde24ae872c3f88d58a1b0e435 upstream.
In commit
commit 6375b768a9850b6154478993e5fb566fa4614a9c
Author: Ville Syrjälä <[email protected]>
Date: Mon Mar 3 11:33:36 2014 +0200
drm/i915: Reject >165MHz modes w/ DVI monitors
the driver started to filter out display modes which exceed the single-link DVI 165Mz dotclock limits when the monitor doesn't report itself as being HDMI compliant. The intent was to filter out all EDID derived modes that require dual-link DVI to operate since we don't support dual-link.
However the patch went a bit too far and also causes the driver to reject such modes even when specified by the user. Normally we don't check the sink limitations when setting a mode from the user. This allows the user to specify any mode whether the sink reports to support it or not. This can be useful since often the sinks support more modes than they report in the EDID.
So relax the checks a bit, and apply the single-link DVI dotclock limit only when filtering the mode list, and ignore the limit when setting a user specified mode.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=72961
--- drivers/gpu/drm/i915/intel_hdmi.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/gpu/drm/i915/intel_hdmi.c +5 -4
@@ -830,11 +830,11 @@ static void intel_disable_hdmi(struct intel_encoder *encoder) } } -static int hdmi_portclock_limit (struct intel_hdmi *hdmi) +static int hdmi_portclock_limit (struct intel_hdmi *hdmi,bool respect_dvi_limit) {struct drm_device *dev =intel_hdmi_to_dev (hdmi); -if (!hdmi->has_hdmi_sink ||IS_G4X (dev)) +if ((respect_dvi_limit && !hdmi->has_hdmi_sink) ||IS_G4X (dev))return 165000 ;else if (IS_HASWELL (dev))return 300000 ;
@@ -845,7 +845,8 @@ static int hdmi_portclock_limit(struct intel_hdmi *hdmi)static int intel_hdmi_mode_valid (struct drm_connector *connector,struct drm_display_mode *mode) { -if (mode->clock >hdmi_portclock_limit (intel_attached_hdmi (connector))) +if (mode->clock >hdmi_portclock_limit (intel_attached_hdmi (connector), + true))return MODE_CLOCK_HIGH ;if (mode->clock <20000 )return MODE_CLOCK_LOW ;
@@ -863,7 +864,7 @@ bool intel_hdmi_compute_config(struct intel_encoder *encoder,struct drm_device *dev = encoder->base.dev;struct drm_display_mode *adjusted_mode = &pipe_config->adjusted_mode;int clock_12bpc = pipe_config->requested_mode.clock *3 /2 ; -int portclock_limit =hdmi_portclock_limit (intel_hdmi); +int portclock_limit =hdmi_portclock_limit (intel_hdmi, false);int desired_bpp;if (intel_hdmi->color_range_auto) {
Signature · 1 line
2.0.0
PATCH 77/111 ima: audit log files opened with O_DIRECT flag
In reply to Jiri SlabyFrom: Mimi Zohar <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit f9b2a735bdddf836214b5dca74f6ca7712e5a08c upstream.
Files are measured or appraised based on the IMA policy. When a file, in policy, is opened with the O_DIRECT flag, a deadlock occurs.
The first attempt at resolving this lockdep temporarily removed the O_DIRECT flag and restored it, after calculating the hash. The second attempt introduced the O_DIRECT_HAVELOCK flag. Based on this flag, do_blockdev_direct_IO() would skip taking the i_mutex a second time. The third attempt, by Dmitry Kasatkin, resolves the i_mutex locking issue, by re-introducing the IMA mutex, but uncovered another problem. Reading a file with O_DIRECT flag set, writes directly to userspace pages. A second patch allocates a user-space like memory. This works for all IMA hooks, except ima_file_free(), which is called on __fput() to recalculate the file hash.
Until this last issue is addressed, do not 'collect' the measurement for measuring, appraising, or auditing files opened with the O_DIRECT flag set. Based on policy, permit or deny file access. This patch defines a new IMA policy rule option named 'permit_directio'. Policy rules could be defined, based on LSM or other criteria, to permit specific applications to open files with the O_DIRECT flag set.
Changelog v1:
- permit or deny file access based IMA policy rules
--- Documentation/ABI/testing/ima_policy | 2 +- security/integrity/ima/ima_api.c | 9 ++++++++- security/integrity/ima/ima_main.c | 5 ++++- security/integrity/ima/ima_policy.c | 6 +++++- security/integrity/integrity.h | 1 + 5 files changed, 19 insertions(+), 4 deletions(-)
Documentation/ABI/testing/ima_policy +1 -1
@@ -23,7 +23,7 @@ Description: [fowner]] lsm: [[subj_user=] [subj_role=] [subj_type=] [obj_user=] [obj_role=] [obj_type=]] - option: [[appraise_type=]] + option: [[appraise_type=]] [permit_directio] base: func:= [BPRM_CHECK][MMAP_CHECK][FILE_CHECK][MODULE_CHECK] mask:= [MAY_READ] [MAY_WRITE] [MAY_APPEND] [MAY_EXEC]
security/integrity/ima/ima_api.c +8 -1
@@ -140,6 +140,7 @@ int ima_must_measure(struct inode *inode, int mask, int function)int ima_collect_measurement (struct integrity_iint_cache *iint,struct file *file) { +const char *audit_cause ="failed" ;struct inode *inode =file_inode (file);const char *filename = file->f_dentry->d_name.name;int result =0 ;
@@ -147,6 +148,11 @@ int ima_collect_measurement(struct integrity_iint_cache *iint,if (!(iint->flags &IMA_COLLECTED )) {u64 i_version =file_inode (file)->i_version; +if (file->f_flags &O_DIRECT ) { + audit_cause ="failed(directio)" ; + result = -EACCES ; + goto out; + } iint->ima_xattr.type =IMA_XATTR_DIGEST ; result =ima_calc_file_hash (file, iint->ima_xattr.digest);if (!result) {
@@ -154,9 +160,10 @@ int ima_collect_measurement(struct integrity_iint_cache *iint, iint->flags |=IMA_COLLECTED ; } } +out:if (result)integrity_audit_msg (AUDIT_INTEGRITY_DATA , inode, - filename,"collect_data" ,"failed" , + filename,"collect_data" , audit_cause, result,0 );return result; }
security/integrity/ima/ima_main.c +4 -1
@@ -186,8 +186,11 @@ static int process_measurement(struct file *file, const char *filename, } rc =ima_collect_measurement (iint, file); -if (rc !=0 ) +if (rc !=0 ) { +if (file->f_flags &O_DIRECT ) + rc = (iint->flags &IMA_PERMIT_DIRECTIO ) ?0 : -EACCES ; goto out_digsig; + } pathname = !filename ?ima_d_path (&file->f_path, &pathbuf) : filename;if (!pathname)
security/integrity/ima/ima_policy.c +5 -1
@@ -351,7 +351,7 @@ enum { Opt_obj_user, Opt_obj_role, Opt_obj_type, Opt_subj_user, Opt_subj_role, Opt_subj_type, Opt_func, Opt_mask, Opt_fsmagic, Opt_uid, Opt_fowner, - Opt_appraise_type, Opt_fsuuid + Opt_appraise_type, Opt_fsuuid, Opt_permit_directio }; static match_table_t policy_tokens = {
@@ -373,6 +373,7 @@ static match_table_t policy_tokens = { {Opt_uid, "uid=%s"}, {Opt_fowner, "fowner=%s"}, {Opt_appraise_type, "appraise_type=%s"}, + {Opt_permit_directio, "permit_directio"}, {Opt_err, NULL} };
@@ -621,6 +622,9 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry)else result = -EINVAL ;break ; +case Opt_permit_directio: + entry->flags |=IMA_PERMIT_DIRECTIO ; +break ;case Opt_err:ima_log_string (ab,"UNKNOWN" , p); result = -EINVAL ;
security/integrity/integrity.h +1 -0
@@ -30,6 +30,7 @@#define IMA_ACTION_FLAGS 0xff000000#define IMA_DIGSIG 0x01000000#define IMA_DIGSIG_REQUIRED 0x02000000 +#define IMA_PERMIT_DIRECTIO 0x04000000#define IMA_DO_MASK (IMA_MEASURE | IMA_APPRAISE | IMA_AUDIT | \ IMA_APPRAISE_SUBMASK)
Signature · 1 line
2.0.0
PATCH 78/111 skbuff: skb_segment: s/frag/nskb_frag/
In reply to Jiri SlabyFrom: "Michael S. Tsirkin" <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit 8cb19905e9287a93ce7c2cbbdf742a060b00e219 ]
frag points at nskb, so name it appropriately
--- net/core/skbuff.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
net/core/skbuff.c +9 -9
@@ -2753,7 +2753,7 @@ struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features) do { struct sk_buff *nskb; - skb_frag_t *frag; + skb_frag_t *nskb_frag; int hsize; int size;
@@ -2853,7 +2853,7 @@ struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features)continue ; } - frag =skb_shinfo (nskb)->frags; + nskb_frag =skb_shinfo (nskb)->frags;skb_copy_from_linear_data_offset (skb, offset,skb_put (nskb, hsize), hsize);
@@ -2881,13 +2881,13 @@ struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features) goto err; } - *frag = *skb_frag; -__skb_frag_ref (frag); - size =skb_frag_size (frag); + *nskb_frag = *skb_frag; +__skb_frag_ref (nskb_frag); + size =skb_frag_size (nskb_frag);if (pos < offset) { - frag->page_offset += offset - pos; -skb_frag_size_sub (frag, offset - pos); + nskb_frag->page_offset += offset - pos; +skb_frag_size_sub (nskb_frag, offset - pos); }skb_shinfo (nskb)->nr_frags++;
@@ -2897,11 +2897,11 @@ struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features) skb_frag++; pos += size; }else { -skb_frag_size_sub (frag, pos + size - (offset + len)); +skb_frag_size_sub (nskb_frag, pos + size - (offset + len)); goto skip_fraglist; } - frag++; + nskb_frag++; } skip_fraglist:
Signature · 1 line
2.0.0
PATCH 79/111 skbuff: skb_segment: s/skb_frag/frag/
In reply to Jiri SlabyFrom: "Michael S. Tsirkin" <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit 4e1beba12d094c6c761ba5c49032b9b9e46380e8 ]
skb_frag can in fact point at either skb
or fskb so rename it generally "frag".
--- net/core/skbuff.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
net/core/skbuff.c +7 -7
@@ -2727,7 +2727,7 @@ struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features)struct sk_buff *segs =NULL ;struct sk_buff *tail =NULL ;struct sk_buff *fskb =skb_shinfo (skb)->frag_list; -skb_frag_t *skb_frag =skb_shinfo (skb)->frags; +skb_frag_t *frag =skb_shinfo (skb)->frags;unsigned int mss =skb_shinfo (skb)->gso_size;unsigned int doffset = skb->data -skb_mac_header (skb);unsigned int offset = doffset;
@@ -2773,19 +2773,19 @@ struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features) i =0 ; nfrags =skb_shinfo (fskb)->nr_frags; - skb_frag =skb_shinfo (fskb)->frags; + frag =skb_shinfo (fskb)->frags; pos +=skb_headlen (fskb);while (pos < offset + len) {BUG_ON (i >= nfrags); - size =skb_frag_size (skb_frag); + size =skb_frag_size (frag);if (pos + size > offset + len)break ; i++; pos += size; - skb_frag++; + frag++; } nskb =skb_clone (fskb,GFP_ATOMIC );
@@ -2866,7 +2866,7 @@ struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features) i =0 ; nfrags =skb_shinfo (fskb)->nr_frags; - skb_frag =skb_shinfo (fskb)->frags; + frag =skb_shinfo (fskb)->frags;BUG_ON (!nfrags);
@@ -2881,7 +2881,7 @@ struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features) goto err; } - *nskb_frag = *skb_frag; + *nskb_frag = *frag;__skb_frag_ref (nskb_frag); size =skb_frag_size (nskb_frag);
@@ -2894,7 +2894,7 @@ struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features)if (pos + size <= offset + len) { i++; - skb_frag++; + frag++; pos += size; }else {skb_frag_size_sub (nskb_frag, pos + size - (offset + len));
Signature · 1 line
2.0.0
PATCH 80/111 skbuff: skb_segment: s/skb/head_skb/
In reply to Jiri SlabyFrom: "Michael S. Tsirkin" <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit df5771ffefb13f8af5392bd54fd7e2b596a3a357 ]
rename local variable to make it easier to tell at a glance that we are dealing with a head skb.
--- net/core/skbuff.c | 55 +++++++++++++++++++++++++++---------------------------- 1 file changed, 27 insertions(+), 28 deletions(-)
net/core/skbuff.c +27 -28
@@ -2715,41 +2715,42 @@ EXPORT_SYMBOL_GPL(skb_pull_rcsum);/** * skb_segment - Perform protocol segmentation on skb. -* @skb: buffer to segment +* @head_skb: buffer to segment * @features: features for the output path (see dev->features) * * This function performs segmentation on the given skb. It returns * a pointer to the first in a list of new skbs for the segments. * In case of error it returns ERR_PTR(err). */ -struct sk_buff *skb_segment (struct sk_buff *skb,netdev_features_t features) +struct sk_buff *skb_segment (struct sk_buff *head_skb, +netdev_features_t features) {struct sk_buff *segs =NULL ;struct sk_buff *tail =NULL ; -struct sk_buff *fskb =skb_shinfo (skb)->frag_list; -skb_frag_t *frag =skb_shinfo (skb)->frags; -unsigned int mss =skb_shinfo (skb)->gso_size; -unsigned int doffset = skb->data -skb_mac_header (skb); +struct sk_buff *fskb =skb_shinfo (head_skb)->frag_list; +skb_frag_t *frag =skb_shinfo (head_skb)->frags; +unsigned int mss =skb_shinfo (head_skb)->gso_size; +unsigned int doffset = head_skb->data -skb_mac_header (head_skb);unsigned int offset = doffset; -unsigned int tnl_hlen =skb_tnl_header_len (skb); +unsigned int tnl_hlen =skb_tnl_header_len (head_skb);unsigned int headroom;unsigned int len;__be16 proto;bool csum;int sg = !!(features &NETIF_F_SG ); -int nfrags =skb_shinfo (skb)->nr_frags; +int nfrags =skb_shinfo (head_skb)->nr_frags;int err = -ENOMEM ;int i =0 ;int pos; - proto =skb_network_protocol (skb); + proto =skb_network_protocol (head_skb);if (unlikely (!proto))return ERR_PTR (-EINVAL ); csum = !!can_checksum_protocol (features, proto); -__skb_push (skb, doffset); - headroom =skb_headroom (skb); - pos =skb_headlen (skb); +__skb_push (head_skb, doffset); + headroom =skb_headroom (head_skb); + pos =skb_headlen (head_skb); do { struct sk_buff *nskb;
@@ -2757,11 +2758,11 @@ struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features)int hsize;int size; - len = skb->len - offset; + len = head_skb->len - offset;if (len > mss) len = mss; - hsize =skb_headlen (skb) - offset; + hsize =skb_headlen (head_skb) - offset;if (hsize <0 ) hsize =0 ;if (hsize > len || !sg)
@@ -2810,7 +2811,7 @@ struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features)__skb_push (nskb, doffset); }else { nskb =__alloc_skb (hsize + doffset + headroom, -GFP_ATOMIC ,skb_alloc_rx_flag (skb), +GFP_ATOMIC ,skb_alloc_rx_flag (head_skb),NUMA_NO_NODE );if (unlikely (!nskb))
@@ -2826,19 +2827,19 @@ struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features) segs = nskb; tail = nskb; -__copy_skb_header (nskb, skb); - nskb->mac_len = skb->mac_len; +__copy_skb_header (nskb, head_skb); + nskb->mac_len = head_skb->mac_len;/* nskb and skb might have different headroom */ if (nskb->ip_summed ==CHECKSUM_PARTIAL ) nskb->csum_start +=skb_headroom (nskb) - headroom;skb_reset_mac_header (nskb); -skb_set_network_header (nskb, skb->mac_len); +skb_set_network_header (nskb, head_skb->mac_len); nskb->transport_header = (nskb->network_header + -skb_network_header_len (skb)); +skb_network_header_len (head_skb)); -skb_copy_from_linear_data_offset (skb, -tnl_hlen, +skb_copy_from_linear_data_offset (head_skb, -tnl_hlen, nskb->data - tnl_hlen, doffset + tnl_hlen);
@@ -2847,7 +2848,7 @@ struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features)if (!sg) { nskb->ip_summed =CHECKSUM_NONE ; - nskb->csum =skb_copy_and_csum_bits (skb, offset, + nskb->csum =skb_copy_and_csum_bits (head_skb, offset,skb_put (nskb, len), len,0 );continue ;
@@ -2855,10 +2856,11 @@ struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features) nskb_frag =skb_shinfo (nskb)->frags; -skb_copy_from_linear_data_offset (skb, offset, +skb_copy_from_linear_data_offset (head_skb, offset,skb_put (nskb, hsize), hsize); -skb_shinfo (nskb)->tx_flags =skb_shinfo (skb)->tx_flags &SKBTX_SHARED_FRAG ; +skb_shinfo (nskb)->tx_flags =skb_shinfo (head_skb)->tx_flags & +SKBTX_SHARED_FRAG ;while (pos < offset + len) {if (i >= nfrags) {
@@ -2915,15 +2917,12 @@ perform_csum_check: nskb->len - doffset, 0); nskb->ip_summed =CHECKSUM_NONE ; } - }while ((offset += len) < skb->len); + }while ((offset += len) < head_skb->len);return segs; err: -while ((skb = segs)) { - segs = skb->next; -kfree_skb (skb); - } +kfree_skb_list (segs);return ERR_PTR (err); }EXPORT_SYMBOL_GPL (skb_segment);
Signature · 1 line
2.0.0
PATCH 81/111 skbuff: skb_segment: s/fskb/list_skb/
In reply to Jiri SlabyFrom: "Michael S. Tsirkin" <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit 1a4cedaf65491e66e1e55b8428c89209da729209 ]
fskb is unrelated to frag: it's coming from frag_list. Rename it list_skb to avoid confusion.
--- net/core/skbuff.c | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-)
net/core/skbuff.c +13 -13
@@ -2727,7 +2727,7 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb, {struct sk_buff *segs =NULL ;struct sk_buff *tail =NULL ; -struct sk_buff *fskb =skb_shinfo (head_skb)->frag_list; +struct sk_buff *list_skb =skb_shinfo (head_skb)->frag_list;skb_frag_t *frag =skb_shinfo (head_skb)->frags;unsigned int mss =skb_shinfo (head_skb)->gso_size;unsigned int doffset = head_skb->data -skb_mac_header (head_skb);
@@ -2768,14 +2768,14 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb,if (hsize > len || !sg) hsize = len; -if (!hsize && i >= nfrags &&skb_headlen (fskb) && - (skb_headlen (fskb) == len || sg)) { -BUG_ON (skb_headlen (fskb) > len); +if (!hsize && i >= nfrags &&skb_headlen (list_skb) && + (skb_headlen (list_skb) == len || sg)) { +BUG_ON (skb_headlen (list_skb) > len); i =0 ; - nfrags =skb_shinfo (fskb)->nr_frags; - frag =skb_shinfo (fskb)->frags; - pos +=skb_headlen (fskb); + nfrags =skb_shinfo (list_skb)->nr_frags; + frag =skb_shinfo (list_skb)->frags; + pos +=skb_headlen (list_skb);while (pos < offset + len) {BUG_ON (i >= nfrags);
@@ -2789,8 +2789,8 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb, frag++; } - nskb =skb_clone (fskb,GFP_ATOMIC ); - fskb = fskb->next; + nskb =skb_clone (list_skb,GFP_ATOMIC ); + list_skb = list_skb->next;if (unlikely (!nskb)) goto err;
@@ -2864,15 +2864,15 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb,while (pos < offset + len) {if (i >= nfrags) { -BUG_ON (skb_headlen (fskb)); +BUG_ON (skb_headlen (list_skb)); i =0 ; - nfrags =skb_shinfo (fskb)->nr_frags; - frag =skb_shinfo (fskb)->frags; + nfrags =skb_shinfo (list_skb)->nr_frags; + frag =skb_shinfo (list_skb)->frags;BUG_ON (!nfrags); - fskb = fskb->next; + list_skb = list_skb->next; } if (unlikely(skb_shinfo(nskb)->nr_frags >=
Signature · 1 line
2.0.0
PATCH 82/111 skbuff: skb_segment: orphan frags before copying
In reply to Jiri SlabyFrom: "Michael S. Tsirkin" <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit 1fd819ecb90cc9b822cd84d3056ddba315d3340f ]
skb_segment copies frags around, so we need to copy them carefully to avoid accessing user memory after reporting completion to userspace through a callback.
skb_segment doesn't normally happen on datapath:
TSO needs to be disabled - so disabling zero copy in this case does not look like a big deal.
--- net/core/skbuff.c | 6 ++++++ 1 file changed, 6 insertions(+)
net/core/skbuff.c +6 -0
@@ -2731,6 +2731,7 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb,skb_frag_t *frag =skb_shinfo (head_skb)->frags;unsigned int mss =skb_shinfo (head_skb)->gso_size;unsigned int doffset = head_skb->data -skb_mac_header (head_skb); +struct sk_buff *frag_skb = head_skb;unsigned int offset = doffset;unsigned int tnl_hlen =skb_tnl_header_len (head_skb);unsigned int headroom;
@@ -2775,6 +2776,7 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb, i =0 ; nfrags =skb_shinfo (list_skb)->nr_frags; frag =skb_shinfo (list_skb)->frags; + frag_skb = list_skb; pos +=skb_headlen (list_skb);while (pos < offset + len) {
@@ -2869,6 +2871,7 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb, i =0 ; nfrags =skb_shinfo (list_skb)->nr_frags; frag =skb_shinfo (list_skb)->frags; + frag_skb = list_skb;BUG_ON (!nfrags);
@@ -2883,6 +2886,9 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb, goto err; } +if (unlikely (skb_orphan_frags (frag_skb,GFP_ATOMIC ))) + goto err; + *nskb_frag = *frag;__skb_frag_ref (nskb_frag); size =skb_frag_size (nskb_frag);
Signature · 1 line
2.0.0
PATCH 83/111 rtc: rtc-at91rm9200: fix infinite wait for ACKUPD irq
In reply to Jiri SlabyFrom: Boris BREZILLON <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 2fe121e1f5aa3bf31b418a9790db6c400e922291 upstream.
The rtc user must wait at least 1 sec between each time/calandar update (see atmel's datasheet chapter "Updating Time/Calendar").
Use the 1Hz interrupt to update the at91_rtc_upd_rdy flag and wait for the at91_rtc_wait_upd_rdy event if the rtc is not ready.
This patch fixes a deadlock in an uninterruptible wait when the RTC is updated more than once every second. AFAICT the bug is here from the beginning, but I think we should at least backport this fix to 3.10 and the following longterm and stable releases.
--- drivers/rtc/rtc-at91rm9200.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-)
drivers/rtc/rtc-at91rm9200.c +14 -2
@@ -48,6 +48,7 @@ struct at91_rtc_config {static const struct at91_rtc_config *at91_rtc_config;static DECLARE_COMPLETION (at91_rtc_updated); +static DECLARE_COMPLETION (at91_rtc_upd_rdy);static unsigned int at91_alarm_year =AT91_RTC_EPOCH ;static void __iomem *at91_rtc_regs;static int irq;
@@ -161,6 +162,8 @@ static int at91_rtc_settime(struct device *dev, struct rtc_time *tm)1900 + tm->tm_year, tm->tm_mon, tm->tm_mday, tm->tm_hour, tm->tm_min, tm->tm_sec); +wait_for_completion (&at91_rtc_upd_rdy); +/* Stop Time/Calendar from counting */ cr =at91_rtc_read (AT91_RTC_CR );at91_rtc_write (AT91_RTC_CR , cr |AT91_RTC_UPDCAL |AT91_RTC_UPDTIM );
@@ -183,7 +186,9 @@ static int at91_rtc_settime(struct device *dev, struct rtc_time *tm)/* Restart Time/Calendar */ cr =at91_rtc_read (AT91_RTC_CR ); +at91_rtc_write (AT91_RTC_SCCR ,AT91_RTC_SECEV );at91_rtc_write (AT91_RTC_CR , cr & ~(AT91_RTC_UPDCAL |AT91_RTC_UPDTIM )); +at91_rtc_write_ier (AT91_RTC_SECEV );return 0 ; }
@@ -290,8 +295,10 @@ static irqreturn_t at91_rtc_interrupt(int irq, void *dev_id)if (rtsr) {/* this interrupt is shared! Is it ours? */ if (rtsr &AT91_RTC_ALARM ) events |= (RTC_AF |RTC_IRQF ); -if (rtsr &AT91_RTC_SECEV ) - events |= (RTC_UF |RTC_IRQF ); +if (rtsr &AT91_RTC_SECEV ) { +complete (&at91_rtc_upd_rdy); +at91_rtc_write_idr (AT91_RTC_SECEV ); + }if (rtsr &AT91_RTC_ACKUPD )complete (&at91_rtc_updated);
@@ -414,6 +421,11 @@ static int __init at91_rtc_probe(struct platform_device *pdev) }platform_set_drvdata (pdev, rtc); +/* enable SECEV interrupt in order to initialize at91_rtc_upd_rdy +* completion. +*/ +at91_rtc_write_ier (AT91_RTC_SECEV ); +dev_info (&pdev->dev,"AT91 Real Time Clock driver.\n" );return 0 ;
Signature · 1 line
2.0.0
PATCH 84/111 iscsi-target: Reject mutual authentication with reflected CHAP_C
In reply to Jiri SlabyFrom: Nicholas Bellinger <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 1d2b60a5545942b1376cb48c1d55843d71e3a08f upstream.
This patch adds an explicit check in chap_server_compute_md5() to ensure the CHAP_C value received from the initiator during mutual authentication does not match the original CHAP_C provided by the target.
This is in line with RFC-3720, section 8.2.1:
Originators MUST NOT reuse the CHAP challenge sent by the Responder for the other direction of a bidirectional authentication. Responders MUST check for this condition and close the iSCSI TCP connection if it occurs.
--- drivers/target/iscsi/iscsi_target_auth.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/target/iscsi/iscsi_target_auth.c +10 -0
@@ -314,6 +314,16 @@ static int chap_server_compute_md5( goto out; }/* +* During mutual authentication, the CHAP_C generated by the +* initiator must not match the original CHAP_C generated by +* the target. +*/ +if (!memcmp (challenge_binhex, chap->challenge,CHAP_CHALLENGE_LENGTH )) { +pr_err ("initiator CHAP_C matches target CHAP_C, failing" +" login attempt\n" ); + goto out; + } +/* * Generate CHAP_N and CHAP_R for mutual authentication. */ tfm =crypto_alloc_hash ("md5" ,0 ,CRYPTO_ALG_ASYNC );
Signature · 1 line
2.0.0
PATCH 85/111 ima: introduce ima_kernel_read()
In reply to Jiri SlabyFrom: Dmitry Kasatkin <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 0430e49b6e7c6b5e076be8fefdee089958c9adad upstream.
Commit 8aac62706 "move exit_task_namespaces() outside of exit_notify" introduced the kernel opps since the kernel v3.10, which happens when Apparmor and IMA-appraisal are enabled at the same time.
----------------------------------------------------------------------
[ 106.750167] BUG: unable to handle kernel NULL pointer dereference at 0000000000000018 [ 106.750221] IP: [<ffffffff811ec7da>] our_mnt+0x1a/0x30 [ 106.750241] PGD 0 [ 106.750254] Oops: 0000 [#1] SMP [ 106.750272] Modules linked in: cuse parport_pc ppdev bnep rfcomm
bluetooth rpcsec_gss_krb5 nfsd auth_rpcgss nfs_acl nfs lockd sunrpc fscache dm_crypt intel_rapl x86_pkg_temp_thermal intel_powerclamp kvm_intel snd_hda_codec_hdmi kvm crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel aes_x86_64 glue_helper lrw gf128mul ablk_helper cryptd snd_hda_codec_realtek dcdbas snd_hda_intel snd_hda_codec snd_hwdep snd_pcm snd_page_alloc snd_seq_midi snd_seq_midi_event snd_rawmidi psmouse snd_seq microcode serio_raw snd_timer snd_seq_device snd soundcore video lpc_ich coretemp mac_hid lp parport mei_me mei nbd hid_generic e1000e usbhid ahci ptp hid libahci pps_core
[ 106.750658] CPU: 6 PID: 1394 Comm: mysqld Not tainted 3.13.0-rc7-kds+ #15 [ 106.750673] Hardware name: Dell Inc. OptiPlex 9010/0M9KCM, BIOS A08 09/19/2012 [ 106.750689] task: ffff8800de804920 ti: ffff880400fca000 task.ti: ffff880400fca000 [ 106.750704] RIP: 0010:[<ffffffff811ec7da>] [<ffffffff811ec7da>] our_mnt+0x1a/0x30 [ 106.750725] RSP: 0018:ffff880400fcba60 EFLAGS: 00010286 [ 106.750738] RAX: 0000000000000000 RBX: 0000000000000100 RCX: ffff8800d51523e7 [ 106.750764] RDX: ffffffffffffffea RSI: ffff880400fcba34 RDI: ffff880402d20020 [ 106.750791] RBP: ffff880400fcbae0 R08: 0000000000000000 R09: 0000000000000001 [ 106.750817] R10: 0000000000000000 R11: 0000000000000001 R12: ffff8800d5152300 [ 106.750844] R13: ffff8803eb8df510 R14: ffff880400fcbb28 R15: ffff8800d51523e7 [ 106.750871] FS: 0000000000000000(0000) GS:ffff88040d200000(0000) knlGS:0000000000000000 [ 106.750910] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 106.750935] CR2: 0000000000000018 CR3: 0000000001c0e000 CR4: 00000000001407e0 [ 106.750962] Stack: [ 106.750981] ffffffff813434eb ffff880400fcbb20 ffff880400fcbb18 0000000000000000 [ 106.751037] ffff8800de804920 ffffffff8101b9b9 0001800000000000 0000000000000100 [ 106.751093] 0000010000000000 0000000000000002 000000000000000e ffff8803eb8df500 [ 106.751149] Call Trace: [ 106.751172] [<ffffffff813434eb>] ? aa_path_name+0x2ab/0x430 [ 106.751199] [<ffffffff8101b9b9>] ? sched_clock+0x9/0x10 [ 106.751225] [<ffffffff8134a68d>] aa_path_perm+0x7d/0x170 [ 106.751250] [<ffffffff8101b945>] ? native_sched_clock+0x15/0x80 [ 106.751276] [<ffffffff8134aa73>] aa_file_perm+0x33/0x40 [ 106.751301] [<ffffffff81348c5e>] common_file_perm+0x8e/0xb0 [ 106.751327] [<ffffffff81348d78>] apparmor_file_permission+0x18/0x20 [ 106.751355] [<ffffffff8130c853>] security_file_permission+0x23/0xa0 [ 106.751382] [<ffffffff811c77a2>] rw_verify_area+0x52/0xe0 [ 106.751407] [<ffffffff811c789d>] vfs_read+0x6d/0x170 [ 106.751432] [<ffffffff811cda31>] kernel_read+0x41/0x60 [ 106.751457] [<ffffffff8134fd45>] ima_calc_file_hash+0x225/0x280 [ 106.751483] [<ffffffff8134fb52>] ? ima_calc_file_hash+0x32/0x280 [ 106.751509] [<ffffffff8135022d>] ima_collect_measurement+0x9d/0x160 [ 106.751536] [<ffffffff810b552d>] ? trace_hardirqs_on+0xd/0x10 [ 106.751562] [<ffffffff8134f07c>] ? ima_file_free+0x6c/0xd0 [ 106.751587] [<ffffffff81352824>] ima_update_xattr+0x34/0x60 [ 106.751612] [<ffffffff8134f0d0>] ima_file_free+0xc0/0xd0 [ 106.751637] [<ffffffff811c9635>] __fput+0xd5/0x300 [ 106.751662] [<ffffffff811c98ae>] ____fput+0xe/0x10 [ 106.751687] [<ffffffff81086774>] task_work_run+0xc4/0xe0 [ 106.751712] [<ffffffff81066fad>] do_exit+0x2bd/0xa90 [ 106.751738] [<ffffffff8173c958>] ? retint_swapgs+0x13/0x1b [ 106.751763] [<ffffffff8106780c>] do_group_exit+0x4c/0xc0 [ 106.751788] [<ffffffff81067894>] SyS_exit_group+0x14/0x20 [ 106.751814] [<ffffffff8174522d>] system_call_fastpath+0x1a/0x1f [ 106.751839] Code: c3 0f 1f 44 00 00 55 48 89 e5 e8 22 fe ff ff 5d c3 0f 1f 44 00 00 55 65 48 8b 04 25 c0 c9 00 00 48 8b 80 28 06 00 00 48 89 e5 5d <48> 8b 40 18 48 39 87 c0 00 00 00 0f 94 c0 c3 0f 1f 80 00 00 00 [ 106.752185] RIP [<ffffffff811ec7da>] our_mnt+0x1a/0x30 [ 106.752214] RSP <ffff880400fcba60> [ 106.752236] CR2: 0000000000000018 [ 106.752258] ---[ end trace 3c520748b4732721 ]---
----------------------------------------------------------------------
The reason for the oops is that IMA-appraisal uses "kernel_read()" when file is closed. kernel_read() honors LSM security hook which calls Apparmor handler, which uses current->nsproxy->mnt_ns. The 'guilty' commit changed the order of cleanup code so that nsproxy->mnt_ns was not already available for Apparmor.
Discussion about the issue with Al Viro and Eric W. Biederman suggested that kernel_read() is too high-level for IMA. Another issue, except security checking, that was identified is mandatory locking. kernel_read honors it as well and it might prevent IMA from calculating necessary hash. It was suggested to use simplified version of the function without security and locking checks.
This patch introduces special version ima_kernel_read(), which skips security and mandatory locking checking. It prevents the kernel oops to happen.
--- security/integrity/ima/ima_crypto.c | 32 +++++++++++++++++++++++++++++++- 1 file changed, 31 insertions(+), 1 deletion(-)
security/integrity/ima/ima_crypto.c +31 -1
@@ -24,6 +24,36 @@static struct crypto_shash *ima_shash_tfm; +/** +* ima_kernel_read - read file content +* +* This is a function for reading file content instead of kernel_read(). +* It does not perform locking checks to ensure it cannot be blocked. +* It does not perform security checks because it is irrelevant for IMA. +* +*/ +static int ima_kernel_read (struct file *file,loff_t offset, +char *addr,unsigned long count) +{ +mm_segment_t old_fs; +char __user *buf = addr; +ssize_t ret; + +if (!(file->f_mode &FMODE_READ )) +return -EBADF ; +if (!file->f_op->read && !file->f_op->aio_read) +return -EINVAL ; + + old_fs =get_fs (); +set_fs (get_ds ()); +if (file->f_op->read) + ret = file->f_op->read (file, buf, count, &offset); +else + ret =do_sync_read (file, buf, count, &offset); +set_fs (old_fs); +return ret; +} +int ima_init_crypto (void ) {long rc;
@@ -70,7 +100,7 @@ int ima_calc_file_hash(struct file *file, char *digest)while (offset < i_size) {int rbuf_len; - rbuf_len =kernel_read (file, offset, rbuf,PAGE_SIZE ); + rbuf_len =ima_kernel_read (file, offset, rbuf,PAGE_SIZE );if (rbuf_len <0 ) { rc = rbuf_len;break ;
Signature · 1 line
2.0.0
PATCH 86/111 evm: prohibit userspace writing 'security.evm' HMAC value
In reply to Jiri SlabyFrom: Mimi Zohar <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 2fb1c9a4f2dbc2f0bd2431c7fa64d0b5483864e4 upstream.
Calculating the 'security.evm' HMAC value requires access to the EVM encrypted key. Only the kernel should have access to it. This patch prevents userspace tools(eg. setfattr, cp --preserve=xattr) from setting/modifying the 'security.evm' HMAC value directly.
--- security/integrity/evm/evm_main.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
security/integrity/evm/evm_main.c +10 -2
@@ -285,12 +285,20 @@ out:* @xattr_value: pointer to the new extended attribute value * @xattr_value_len: pointer to the new extended attribute value length * -* Updating 'security.evm' requires CAP_SYS_ADMIN privileges and that -* the current value is valid. +* Before allowing the 'security.evm' protected xattr to be updated, +* verify the existing value is valid. As only the kernel should have +* access to the EVM encrypted key needed to calculate the HMAC, prevent +* userspace from writing HMAC value. Writing 'security.evm' requires +* requires CAP_SYS_ADMIN privileges. */ int evm_inode_setxattr (struct dentry *dentry,const char *xattr_name,const void *xattr_value,size_t xattr_value_len) { +const struct evm_ima_xattr_data *xattr_data = xattr_value; + +if ((strcmp (xattr_name,XATTR_NAME_EVM ) ==0 ) + && (xattr_data->type ==EVM_XATTR_HMAC )) +return -EPERM ;return evm_protect_xattr (dentry, xattr_name, xattr_value, xattr_value_len); }
Signature · 1 line
2.0.0
PATCH 87/111 netlink: Rename netlink_capable netlink_allowed
In reply to Jiri SlabyFrom: "Eric W. Biederman" <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit 5187cd055b6e81fc6526109456f8b20623148d5f ]
netlink_capable is a static internal function in af_netlink.c and we have better uses for the name netlink_capable.
--- net/netlink/af_netlink.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
net/netlink/af_netlink.c +5 -5
@@ -1352,7 +1352,7 @@ retry:return err; } -static inline int netlink_capable (const struct socket *sock,unsigned int flag) +static inline int netlink_allowed (const struct socket *sock,unsigned int flag) {return (nl_table[sock->sk->sk_protocol].flags & flag) ||ns_capable (sock_net (sock->sk)->user_ns,CAP_NET_ADMIN );
@@ -1420,7 +1420,7 @@ static int netlink_bind(struct socket *sock, struct sockaddr *addr,/* Only superuser is allowed to listen multicasts */ if (nladdr->nl_groups) { -if (!netlink_capable (sock,NL_CFG_F_NONROOT_RECV )) +if (!netlink_allowed (sock,NL_CFG_F_NONROOT_RECV ))return -EPERM ; err =netlink_realloc_groups (sk);if (err)
@@ -1482,7 +1482,7 @@ static int netlink_connect(struct socket *sock, struct sockaddr *addr,return -EINVAL ;/* Only superuser is allowed to send multicasts */ -if (nladdr->nl_groups && !netlink_capable (sock,NL_CFG_F_NONROOT_SEND )) +if (nladdr->nl_groups && !netlink_allowed (sock,NL_CFG_F_NONROOT_SEND ))return -EPERM ;if (!nlk->portid)
@@ -2088,7 +2088,7 @@ static int netlink_setsockopt(struct socket *sock, int level, int optname,break ;case NETLINK_ADD_MEMBERSHIP :case NETLINK_DROP_MEMBERSHIP : { -if (!netlink_capable (sock,NL_CFG_F_NONROOT_RECV )) +if (!netlink_allowed (sock,NL_CFG_F_NONROOT_RECV ))return -EPERM ; err =netlink_realloc_groups (sk);if (err)
@@ -2239,7 +2239,7 @@ static int netlink_sendmsg(struct kiocb *kiocb, struct socket *sock, dst_group =ffs (addr->nl_groups); err = -EPERM ;if ((dst_group || dst_portid) && - !netlink_capable (sock,NL_CFG_F_NONROOT_SEND )) + !netlink_allowed (sock,NL_CFG_F_NONROOT_SEND )) goto out; }else { dst_portid = nlk->dst_portid;
Signature · 1 line
2.0.0
PATCH 88/111 net: Move the permission check in sock_diag_put_filterinfo to packet_diag_dump
In reply to Jiri SlabyFrom: "Eric W. Biederman" <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit a53b72c83a4216f2eb883ed45a0cbce014b8e62d ]
The permission check in sock_diag_put_filterinfo is wrong, and it is so removed from it's sources it is not clear why it is wrong. Move the computation into packet_diag_dump and pass a bool of the result into sock_diag_filterinfo.
This does not yet correct the capability check but instead simply moves it to make it clear what is going on.
--- include/linux/sock_diag.h | 2 +- net/core/sock_diag.c | 4 ++-- net/packet/diag.c | 7 ++++++- 3 files changed, 9 insertions(+), 4 deletions(-)
include/linux/sock_diag.h +1 -1
@@ -23,7 +23,7 @@ int sock_diag_check_cookie(void *sk, __u32 *cookie);void sock_diag_save_cookie (void *sk,__u32 *cookie);int sock_diag_put_meminfo (struct sock *sk,struct sk_buff *skb,int attr); -int sock_diag_put_filterinfo (struct sock *sk, +int sock_diag_put_filterinfo (bool may_report_filterinfo,struct sock *sk,struct sk_buff *skb,int attrtype);#endif
net/core/sock_diag.c +2 -2
@@ -49,7 +49,7 @@ int sock_diag_put_meminfo(struct sock *sk, struct sk_buff *skb, int attrtype) }EXPORT_SYMBOL_GPL (sock_diag_put_meminfo); -int sock_diag_put_filterinfo (struct sock *sk, +int sock_diag_put_filterinfo (bool may_report_filterinfo,struct sock *sk,struct sk_buff *skb,int attrtype) {struct nlattr *attr;
@@ -57,7 +57,7 @@ int sock_diag_put_filterinfo(struct sock *sk,unsigned int len;int err =0 ; -if (!ns_capable (sock_net (sk)->user_ns,CAP_NET_ADMIN )) { +if (!may_report_filterinfo) {nla_reserve (skb, attrtype,0 );return 0 ; }
net/packet/diag.c +6 -1
@@ -127,6 +127,7 @@ static int pdiag_put_fanout(struct packet_sock *po, struct sk_buff *nlskb)static int sk_diag_fill (struct sock *sk,struct sk_buff *skb,struct packet_diag_req *req, +bool may_report_filterinfo,struct user_namespace *user_ns,u32 portid,u32 seq,u32 flags,int sk_ino) {
@@ -171,7 +172,8 @@ static int sk_diag_fill(struct sock *sk, struct sk_buff *skb, goto out_nlmsg_trim;if ((req->pdiag_show &PACKET_SHOW_FILTER ) && -sock_diag_put_filterinfo (sk, skb,PACKET_DIAG_FILTER )) +sock_diag_put_filterinfo (may_report_filterinfo, sk, skb, +PACKET_DIAG_FILTER )) goto out_nlmsg_trim;return nlmsg_end (skb, nlh);
@@ -187,9 +189,11 @@ static int packet_diag_dump(struct sk_buff *skb, struct netlink_callback *cb)struct packet_diag_req *req;struct net *net;struct sock *sk; +bool may_report_filterinfo; net =sock_net (skb->sk); req =nlmsg_data (cb->nlh); + may_report_filterinfo =ns_capable (net->user_ns,CAP_NET_ADMIN );mutex_lock (&net->packet.sklist_lock);sk_for_each (sk, &net->packet.sklist) {
@@ -199,6 +203,7 @@ static int packet_diag_dump(struct sk_buff *skb, struct netlink_callback *cb) goto next; if (sk_diag_fill(sk, skb, req, + may_report_filterinfo, sk_user_ns(NETLINK_CB(cb->skb).sk), NETLINK_CB(cb->skb).portid, cb->nlh->nlmsg_seq, NLM_F_MULTI,
Signature · 1 line
2.0.0
PATCH 89/111 net: Add variants of capable for use on on sockets
In reply to Jiri SlabyFrom: "Eric W. Biederman" <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit a3b299da869d6e78cf42ae0b1b41797bcb8c5e4b ]
sk_net_capable - The common case, operations that are safe in a network namespace. sk_capable - Operations that are not known to be safe in a network namespace sk_ns_capable - The general case for special cases.
--- include/net/sock.h | 5 +++++ net/core/sock.c | 49 +++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 54 insertions(+)
include/net/sock.h +5 -0
@@ -2275,6 +2275,11 @@ extern int sock_get_timestampns(struct sock *, struct timespec __user *);extern int sock_recv_errqueue (struct sock *sk,struct msghdr *msg,int len,int level,int type); +bool sk_ns_capable (const struct sock *sk, +struct user_namespace *user_ns,int cap); +bool sk_capable (const struct sock *sk,int cap); +bool sk_net_capable (const struct sock *sk,int cap); +/* * Enable debug/info messages */
net/core/sock.c +49 -0
55 lines not on this page · raw message
Signature · 1 line
2.0.0
PATCH 90/111 net: Add variants of capable for use on netlink messages
In reply to Jiri SlabyFrom: "Eric W. Biederman" <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit aa4cf9452f469f16cea8c96283b641b4576d4a7b ]
netlink_net_capable - The common case use, for operations that are safe on a network namespace netlink_capable - For operations that are only known to be safe for the global root netlink_ns_capable - The general case of capable used to handle special cases
__netlink_ns_capable - Same as netlink_ns_capable except taking a netlink_skb_parms instead of
the skbuff of a netlink message.
--- include/linux/netlink.h | 7 ++++++ net/netlink/af_netlink.c | 65 ++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 72 insertions(+)
include/linux/netlink.h +7 -0
@@ -171,4 +171,11 @@ extern int netlink_add_tap(struct netlink_tap *nt);extern int __netlink_remove_tap (struct netlink_tap *nt);extern int netlink_remove_tap (struct netlink_tap *nt); +bool __netlink_ns_capable (const struct netlink_skb_parms *nsp, +struct user_namespace *ns,int cap); +bool netlink_ns_capable (const struct sk_buff *skb, +struct user_namespace *ns,int cap); +bool netlink_capable (const struct sk_buff *skb,int cap); +bool netlink_net_capable (const struct sk_buff *skb,int cap); +#endif /* __LINUX_NETLINK_H */
net/netlink/af_netlink.c +65 -0
71 lines not on this page · raw message
Signature · 1 line
2.0.0
PATCH 91/111 net: Use netlink_ns_capable to verify the permisions of netlink messages
In reply to Jiri SlabyFrom: "Eric W. Biederman" <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit 90f62cf30a78721641e08737bda787552428061e ]
It is possible by passing a netlink socket to a more privileged executable and then to fool that executable into writing to the socket data that happens to be valid netlink message to do something that privileged executable did not intend to do.
To keep this from happening replace bare capable and ns_capable calls with netlink_capable, netlink_net_calls and netlink_ns_capable calls. Which act the same as the previous calls except they verify that the opener of the socket had the desired permissions as well.
--- crypto/crypto_user.c | 2 +- drivers/connector/cn_proc.c | 2 +- drivers/scsi/scsi_netlink.c | 2 +- kernel/audit.c | 4 ++-- net/can/gw.c | 4 ++-- net/core/rtnetlink.c | 20 +++++++++++--------- net/dcb/dcbnl.c | 2 +- net/decnet/dn_dev.c | 4 ++-- net/decnet/dn_fib.c | 4 ++-- net/decnet/netfilter/dn_rtmsg.c | 2 +- net/netfilter/nfnetlink.c | 2 +- net/netlink/genetlink.c | 2 +- net/packet/diag.c | 2 +- net/phonet/pn_netlink.c | 8 ++++---- net/sched/act_api.c | 2 +- net/sched/cls_api.c | 2 +- net/sched/sch_api.c | 6 +++--- net/tipc/netlink.c | 2 +- net/xfrm/xfrm_user.c | 2 +- 19 files changed, 38 insertions(+), 36 deletions(-)
crypto/crypto_user.c +1 -1
@@ -466,7 +466,7 @@ static int crypto_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh) type -=CRYPTO_MSG_BASE ; link = &crypto_dispatch[type]; -if (!capable (CAP_NET_ADMIN )) +if (!netlink_capable (skb,CAP_NET_ADMIN ))return -EPERM ; if ((type == (CRYPTO_MSG_GETALG - CRYPTO_MSG_BASE) &&
drivers/connector/cn_proc.c +1 -1
@@ -369,7 +369,7 @@ static void cn_proc_mcast_ctl(struct cn_msg *msg,return ;/* Can only change if privileged. */ -if (!capable (CAP_NET_ADMIN )) { +if (!__netlink_ns_capable (nsp, &init_user_ns,CAP_NET_ADMIN )) { err =EPERM ; goto out; }
drivers/scsi/scsi_netlink.c +1 -1
@@ -77,7 +77,7 @@ scsi_nl_rcv_msg(struct sk_buff *skb) goto next_msg; } -if (!capable (CAP_SYS_ADMIN )) { +if (!netlink_capable (skb,CAP_SYS_ADMIN )) { err = -EPERM ; goto next_msg; }
kernel/audit.c +2 -2
@@ -593,13 +593,13 @@ static int audit_netlink_ok(struct sk_buff *skb, u16 msg_type)case AUDIT_TTY_SET :case AUDIT_TRIM :case AUDIT_MAKE_EQUIV : -if (!capable (CAP_AUDIT_CONTROL )) +if (!netlink_capable (skb,CAP_AUDIT_CONTROL )) err = -EPERM ;break ;case AUDIT_USER : case AUDIT_FIRST_USER_MSG ... AUDIT_LAST_USER_MSG: case AUDIT_FIRST_USER_MSG2 ... AUDIT_LAST_USER_MSG2: -if (!capable (CAP_AUDIT_WRITE )) +if (!netlink_capable (skb,CAP_AUDIT_WRITE )) err = -EPERM ;break ;default :/* bad msg */
net/can/gw.c +2 -2
@@ -804,7 +804,7 @@ static int cgw_create_job(struct sk_buff *skb, struct nlmsghdr *nlh)u8 limhops =0 ;int err =0 ; -if (!capable (CAP_NET_ADMIN )) +if (!netlink_capable (skb,CAP_NET_ADMIN ))return -EPERM ;if (nlmsg_len (nlh) <sizeof (*r))
@@ -900,7 +900,7 @@ static int cgw_remove_job(struct sk_buff *skb, struct nlmsghdr *nlh)u8 limhops =0 ;int err =0 ; -if (!capable (CAP_NET_ADMIN )) +if (!netlink_capable (skb,CAP_NET_ADMIN ))return -EPERM ;if (nlmsg_len (nlh) <sizeof (*r))
net/core/rtnetlink.c +11 -9
@@ -1366,7 +1366,8 @@ static int do_set_master(struct net_device *dev, int ifindex)return 0 ; } -static int do_setlink (struct net_device *dev,struct ifinfomsg *ifm, +static int do_setlink (const struct sk_buff *skb, +struct net_device *dev,struct ifinfomsg *ifm,struct nlattr **tb,char *ifname,int modified) {const struct net_device_ops *ops = dev->netdev_ops;
@@ -1378,7 +1379,7 @@ static int do_setlink(struct net_device *dev, struct ifinfomsg *ifm, err =PTR_ERR (net); goto errout; } -if (!ns_capable (net->user_ns,CAP_NET_ADMIN )) { +if (!netlink_ns_capable (skb, net->user_ns,CAP_NET_ADMIN )) { err = -EPERM ; goto errout; }
@@ -1632,7 +1633,7 @@ static int rtnl_setlink(struct sk_buff *skb, struct nlmsghdr *nlh)if (err <0 ) goto errout; - err =do_setlink (dev, ifm, tb, ifname,0 ); + err =do_setlink (skb, dev, ifm, tb, ifname,0 ); errout:return err; }
@@ -1750,7 +1751,8 @@ err: }EXPORT_SYMBOL (rtnl_create_link); -static int rtnl_group_changelink (struct net *net,int group, +static int rtnl_group_changelink (const struct sk_buff *skb, +struct net *net,int group,struct ifinfomsg *ifm,struct nlattr **tb) {
@@ -1759,7 +1761,7 @@ static int rtnl_group_changelink(struct net *net, int group,for_each_netdev (net, dev) {if (dev->group == group) { - err =do_setlink (dev, ifm, tb,NULL ,0 ); + err =do_setlink (skb, dev, ifm, tb,NULL ,0 );if (err <0 )return err; }
@@ -1861,12 +1863,12 @@ replay: modified =1 ; } -return do_setlink (dev, ifm, tb, ifname, modified); +return do_setlink (skb, dev, ifm, tb, ifname, modified); }if (!(nlh->nlmsg_flags &NLM_F_CREATE )) {if (ifm->ifi_index ==0 && tb[IFLA_GROUP ]) -return rtnl_group_changelink (net, +return rtnl_group_changelink (skb, net,nla_get_u32 (tb[IFLA_GROUP ]), ifm, tb);return -ENODEV ;
@@ -2247,7 +2249,7 @@ static int rtnl_fdb_del(struct sk_buff *skb, struct nlmsghdr *nlh)int err = -EINVAL ;__u8 *addr; -if (!capable (CAP_NET_ADMIN )) +if (!netlink_capable (skb,CAP_NET_ADMIN ))return -EPERM ; err =nlmsg_parse (nlh,sizeof (*ndm), tb,NDA_MAX ,NULL );
@@ -2699,7 +2701,7 @@ static int rtnetlink_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh) sz_idx = type>>2 ; kind = type&3 ; -if (kind !=2 && !ns_capable (net->user_ns,CAP_NET_ADMIN )) +if (kind !=2 && !netlink_net_capable (skb,CAP_NET_ADMIN ))return -EPERM ;if (kind ==2 && nlh->nlmsg_flags&NLM_F_DUMP ) {
net/dcb/dcbnl.c +1 -1
@@ -1670,7 +1670,7 @@ static int dcb_doit(struct sk_buff *skb, struct nlmsghdr *nlh)struct nlmsghdr *reply_nlh =NULL ;const struct reply_func *fn; -if ((nlh->nlmsg_type ==RTM_SETDCB ) && !capable (CAP_NET_ADMIN )) +if ((nlh->nlmsg_type ==RTM_SETDCB ) && !netlink_capable (skb,CAP_NET_ADMIN ))return -EPERM ; ret = nlmsg_parse(nlh, sizeof(*dcb), tb, DCB_ATTR_MAX,
net/decnet/dn_dev.c +2 -2
@@ -573,7 +573,7 @@ static int dn_nl_deladdr(struct sk_buff *skb, struct nlmsghdr *nlh)struct dn_ifaddr __rcu **ifap;int err = -EINVAL ; -if (!capable (CAP_NET_ADMIN )) +if (!netlink_capable (skb,CAP_NET_ADMIN ))return -EPERM ;if (!net_eq (net, &init_net))
@@ -617,7 +617,7 @@ static int dn_nl_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh)struct dn_ifaddr *ifa;int err; -if (!capable (CAP_NET_ADMIN )) +if (!netlink_capable (skb,CAP_NET_ADMIN ))return -EPERM ;if (!net_eq (net, &init_net))
net/decnet/dn_fib.c +2 -2
@@ -505,7 +505,7 @@ static int dn_fib_rtm_delroute(struct sk_buff *skb, struct nlmsghdr *nlh)struct nlattr *attrs[RTA_MAX +1 ];int err; -if (!capable (CAP_NET_ADMIN )) +if (!netlink_capable (skb,CAP_NET_ADMIN ))return -EPERM ;if (!net_eq (net, &init_net))
@@ -530,7 +530,7 @@ static int dn_fib_rtm_newroute(struct sk_buff *skb, struct nlmsghdr *nlh)struct nlattr *attrs[RTA_MAX +1 ];int err; -if (!capable (CAP_NET_ADMIN )) +if (!netlink_capable (skb,CAP_NET_ADMIN ))return -EPERM ;if (!net_eq (net, &init_net))
net/decnet/netfilter/dn_rtmsg.c +1 -1
@@ -107,7 +107,7 @@ static inline void dnrmg_receive_user_skb(struct sk_buff *skb)if (nlh->nlmsg_len <sizeof (*nlh) || skb->len < nlh->nlmsg_len)return ; -if (!capable (CAP_NET_ADMIN )) +if (!netlink_capable (skb,CAP_NET_ADMIN ))RCV_SKB_FAIL (-EPERM );/* Eventually we might send routing messages too */
net/netfilter/nfnetlink.c +1 -1
@@ -147,7 +147,7 @@ static int nfnetlink_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)const struct nfnetlink_subsystem *ss;int type, err; -if (!ns_capable (net->user_ns,CAP_NET_ADMIN )) +if (!netlink_net_capable (skb,CAP_NET_ADMIN ))return -EPERM ;/* All the messages must at least contain nfgenmsg */
net/netlink/genetlink.c +1 -1
@@ -592,7 +592,7 @@ static int genl_family_rcv_msg(struct genl_family *family,return -EOPNOTSUPP ;if ((ops->flags &GENL_ADMIN_PERM ) && - !capable (CAP_NET_ADMIN )) + !netlink_capable (skb,CAP_NET_ADMIN ))return -EPERM ;if ((nlh->nlmsg_flags &NLM_F_DUMP ) ==NLM_F_DUMP ) {
net/packet/diag.c +1 -1
@@ -193,7 +193,7 @@ static int packet_diag_dump(struct sk_buff *skb, struct netlink_callback *cb) net =sock_net (skb->sk); req =nlmsg_data (cb->nlh); - may_report_filterinfo =ns_capable (net->user_ns,CAP_NET_ADMIN ); + may_report_filterinfo =netlink_net_capable (cb->skb,CAP_NET_ADMIN );mutex_lock (&net->packet.sklist_lock);sk_for_each (sk, &net->packet.sklist) {
net/phonet/pn_netlink.c +4 -4
@@ -70,10 +70,10 @@ static int addr_doit(struct sk_buff *skb, struct nlmsghdr *nlh)int err;u8 pnaddr; -if (!capable (CAP_NET_ADMIN )) +if (!netlink_capable (skb,CAP_NET_ADMIN ))return -EPERM ; -if (!capable (CAP_SYS_ADMIN )) +if (!netlink_capable (skb,CAP_SYS_ADMIN ))return -EPERM ;ASSERT_RTNL ();
@@ -233,10 +233,10 @@ static int route_doit(struct sk_buff *skb, struct nlmsghdr *nlh)int err;u8 dst; -if (!capable (CAP_NET_ADMIN )) +if (!netlink_capable (skb,CAP_NET_ADMIN ))return -EPERM ; -if (!capable (CAP_SYS_ADMIN )) +if (!netlink_capable (skb,CAP_SYS_ADMIN ))return -EPERM ;ASSERT_RTNL ();
net/sched/act_api.c +1 -1
@@ -989,7 +989,7 @@ static int tc_ctl_action(struct sk_buff *skb, struct nlmsghdr *n)u32 portid = skb ?NETLINK_CB (skb).portid :0 ;int ret =0 , ovr =0 ; -if ((n->nlmsg_type !=RTM_GETACTION ) && !capable (CAP_NET_ADMIN )) +if ((n->nlmsg_type !=RTM_GETACTION ) && !netlink_capable (skb,CAP_NET_ADMIN ))return -EPERM ; ret =nlmsg_parse (n,sizeof (struct tcamsg ), tca,TCA_ACT_MAX ,NULL );
net/sched/cls_api.c +1 -1
@@ -138,7 +138,7 @@ static int tc_ctl_tfilter(struct sk_buff *skb, struct nlmsghdr *n)int err;int tp_created =0 ; -if ((n->nlmsg_type !=RTM_GETTFILTER ) && !capable (CAP_NET_ADMIN )) +if ((n->nlmsg_type !=RTM_GETTFILTER ) && !netlink_capable (skb,CAP_NET_ADMIN ))return -EPERM ; replay:
net/sched/sch_api.c +3 -3
@@ -1076,7 +1076,7 @@ static int tc_get_qdisc(struct sk_buff *skb, struct nlmsghdr *n)struct Qdisc *p =NULL ;int err; -if ((n->nlmsg_type !=RTM_GETQDISC ) && !capable (CAP_NET_ADMIN )) +if ((n->nlmsg_type !=RTM_GETQDISC ) && !netlink_capable (skb,CAP_NET_ADMIN ))return -EPERM ; err =nlmsg_parse (n,sizeof (*tcm), tca,TCA_MAX ,NULL );
@@ -1143,7 +1143,7 @@ static int tc_modify_qdisc(struct sk_buff *skb, struct nlmsghdr *n)struct Qdisc *q, *p;int err; -if (!capable (CAP_NET_ADMIN )) +if (!netlink_capable (skb,CAP_NET_ADMIN ))return -EPERM ; replay:
@@ -1483,7 +1483,7 @@ static int tc_ctl_tclass(struct sk_buff *skb, struct nlmsghdr *n)u32 qid;int err; -if ((n->nlmsg_type !=RTM_GETTCLASS ) && !capable (CAP_NET_ADMIN )) +if ((n->nlmsg_type !=RTM_GETTCLASS ) && !netlink_capable (skb,CAP_NET_ADMIN ))return -EPERM ; err =nlmsg_parse (n,sizeof (*tcm), tca,TCA_MAX ,NULL );
net/tipc/netlink.c +1 -1
@@ -47,7 +47,7 @@ static int handle_cmd(struct sk_buff *skb, struct genl_info *info)int hdr_space =nlmsg_total_size (GENL_HDRLEN +TIPC_GENL_HDRLEN );u16 cmd; -if ((req_userhdr->cmd &0xC000 ) && (!capable (CAP_NET_ADMIN ))) +if ((req_userhdr->cmd &0xC000 ) && (!netlink_capable (skb,CAP_NET_ADMIN ))) cmd =TIPC_CMD_NOT_NET_ADMIN ;else cmd = req_userhdr->cmd;
net/xfrm/xfrm_user.c +1 -1
@@ -2363,7 +2363,7 @@ static int xfrm_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh) link = &xfrm_dispatch[type];/* All operations require privileges, even GET */ -if (!ns_capable (net->user_ns,CAP_NET_ADMIN )) +if (!netlink_net_capable (skb,CAP_NET_ADMIN ))return -EPERM ; if ((type == (XFRM_MSG_GETSA - XFRM_MSG_BASE) ||
Signature · 1 line
2.0.0
PATCH 92/111 netlink: Only check file credentials for implicit destinations
In reply to Jiri SlabyFrom: "Eric W. Biederman" <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit 2d7a85f4b06e9c27ff629f07a524c48074f07f81 ]
It was possible to get a setuid root or setcap executable to write to it's stdout or stderr (which has been set made a netlink socket) and inadvertently reconfigure the networking stack.
To prevent this we check that both the creator of the socket and the currentl applications has permission to reconfigure the network stack.
Unfortunately this breaks Zebra which always uses sendto/sendmsg and creates it's socket without any privileges.
To keep Zebra working don't bother checking if the creator of the socket has privilege when a destination address is specified. Instead rely exclusively on the privileges of the sender of the socket.
Note from Andy: This is exactly Eric's code except for some comment clarifications and formatting fixes. Neither I nor, I think, anyone else is thrilled with this approach, but I'm hesitant to wait on a better fix since 3.15 is almost here.
Note to stable maintainers: This is a mess. An earlier series of patches in 3.15 fix a rather serious security issue (CVE-2014-0181), but they did so in a way that breaks Zebra. The offending series includes:
commit aa4cf9452f469f16cea8c96283b641b4576d4a7b
Author: Eric W. Biederman <[email protected]>
Date: Wed Apr 23 14:28:03 2014 -0700
net: Add variants of capable for use on netlink messages
If a given kernel version is missing that series of fixes, it's probably worth backporting it and this patch. if that series is present, then this fix is critical if you care about Zebra.
--- include/linux/netlink.h | 7 ++++--- net/netlink/af_netlink.c | 7 ++++++- 2 files changed, 10 insertions(+), 4 deletions(-)
include/linux/netlink.h +4 -3
@@ -16,9 +16,10 @@ static inline struct nlmsghdr *nlmsg_hdr(const struct sk_buff *skb) }enum netlink_skb_flags { -NETLINK_SKB_MMAPED =0x1 ,/* Packet data is mmaped */ -NETLINK_SKB_TX =0x2 ,/* Packet was sent by userspace */ -NETLINK_SKB_DELIVERED =0x4 ,/* Packet was delivered */ +NETLINK_SKB_MMAPED =0x1 ,/* Packet data is mmaped */ +NETLINK_SKB_TX =0x2 ,/* Packet was sent by userspace */ +NETLINK_SKB_DELIVERED =0x4 ,/* Packet was delivered */ +NETLINK_SKB_DST =0x8 ,/* Dst set in sendto or sendmsg */ };struct netlink_skb_parms {
net/netlink/af_netlink.c +6 -1
@@ -1365,7 +1365,9 @@ retry:bool __netlink_ns_capable (const struct netlink_skb_parms *nsp,struct user_namespace *user_ns,int cap) { -return sk_ns_capable (nsp->sk, user_ns, cap); +return ((nsp->flags &NETLINK_SKB_DST ) || +file_ns_capable (nsp->sk->sk_socket->file, user_ns, cap)) && +ns_capable (user_ns, cap); }EXPORT_SYMBOL (__netlink_ns_capable);
@@ -2285,6 +2287,7 @@ static int netlink_sendmsg(struct kiocb *kiocb, struct socket *sock,struct sk_buff *skb;int err;struct scm_cookie scm; +u32 netlink_skb_flags =0 ;if (msg->msg_flags&MSG_OOB )return -EOPNOTSUPP ;
@@ -2306,6 +2309,7 @@ static int netlink_sendmsg(struct kiocb *kiocb, struct socket *sock,if ((dst_group || dst_portid) && !netlink_allowed (sock,NL_CFG_F_NONROOT_SEND )) goto out; + netlink_skb_flags |=NETLINK_SKB_DST ; }else { dst_portid = nlk->dst_portid; dst_group = nlk->dst_group;
@@ -2335,6 +2339,7 @@ static int netlink_sendmsg(struct kiocb *kiocb, struct socket *sock,NETLINK_CB (skb).portid = nlk->portid;NETLINK_CB (skb).dst_group = dst_group;NETLINK_CB (skb).creds = siocb->scm->creds; +NETLINK_CB (skb).flags = netlink_skb_flags; err = -EFAULT ;if (memcpy_fromiovec (skb_put (skb, len), msg->msg_iov, len)) {
Signature · 1 line
2.0.0
PATCH 93/111 qlcnic: info leak in qlcnic_dcb_peer_app_info()
In reply to Jiri SlabyFrom: Dan Carpenter <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit 7df566bbdd0af0785542b89466a937e94257fcfb ]
This function is called from dcbnl_build_peer_app(). The "info" struct isn't initialized at all so we disclose 2 bytes of uninitialized stack data. We should clear it before passing it to the user.
--- drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c +1 -0
@@ -1053,6 +1053,7 @@ static int qlcnic_dcb_peer_app_info(struct net_device *netdev,struct qlcnic_dcb_cee *peer;int i; +memset (info,0 ,sizeof (*info)); *app_count =0 ;if (!test_bit (__QLCNIC_DCB_STATE, &adapter->state))
Signature · 1 line
2.0.0
PATCH 94/111 netlink: rate-limit leftover bytes warning and print process name
In reply to Jiri SlabyFrom: Michal Schmidt <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit bfc5184b69cf9eeb286137640351c650c27f118a ]
Any process is able to send netlink messages with leftover bytes. Make the warning rate-limited to prevent too much log spam.
The warning is supposed to help find userspace bugs, so print the triggering command name to implicate the buggy program.
[v2: Use pr_warn_ratelimited instead of printk_ratelimited.]
--- lib/nlattr.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
lib/nlattr.c +2 -2
@@ -201,8 +201,8 @@ int nla_parse(struct nlattr **tb, int maxtype, const struct nlattr *head, }if (unlikely (rem >0 )) -printk (KERN_WARNING "netlink: %d bytes leftover after parsing " -"attributes.\n" , rem); +pr_warn_ratelimited ("netlink: %d bytes leftover after parsing attributes in process `%s'.\n" , + rem, current->comm); err =0 ; errout:
Signature · 1 line
2.0.0
PATCH 95/111 bridge: Prevent insertion of FDB entry with disallowed vlan
In reply to Jiri SlabyFrom: Toshiaki Makita <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit e0d7968ab6c8bce2437b36fa7f04117e333f196d ]
br_handle_local_finish() is allowing us to insert an FDB entry with disallowed vlan. For example, when port 1 and 2 are communicating in vlan 10, and even if vlan 10 is disallowed on port 3, port 3 can interfere with their communication by spoofed src mac address with vlan id 10.
Note: Even if it is judged that a frame should not be learned, it should not be dropped because it is destined for not forwarding layer but higher layer. See IEEE 802.1Q-2011 8.13.10.
--- net/bridge/br_input.c | 4 ++-- net/bridge/br_private.h | 7 +++++++ net/bridge/br_vlan.c | 28 ++++++++++++++++++++++++++++ 3 files changed, 37 insertions(+), 2 deletions(-)
net/bridge/br_input.c +2 -2
@@ -146,8 +146,8 @@ static int br_handle_local_finish(struct sk_buff *skb)struct net_bridge_port *p =br_port_get_rcu (skb->dev);u16 vid =0 ; -br_vlan_get_tag (skb, &vid); -if (p->flags &BR_LEARNING ) +/* check if vlan is allowed, to avoid spoofing */ +if (p->flags &BR_LEARNING &&br_should_learn (p, skb, &vid))br_fdb_update (p->br, p,eth_hdr (skb)->h_source, vid);return 0 ;/* process further */ }
net/bridge/br_private.h +7 -0
@@ -605,6 +605,7 @@ extern bool br_allowed_ingress(struct net_bridge *br, struct net_port_vlans *v,extern bool br_allowed_egress (struct net_bridge *br,const struct net_port_vlans *v,const struct sk_buff *skb); +bool br_should_learn (struct net_bridge_port *p,struct sk_buff *skb,u16 *vid);extern struct sk_buff *br_handle_vlan (struct net_bridge *br,const struct net_port_vlans *v,struct sk_buff *skb);
@@ -671,6 +672,12 @@ static inline bool br_allowed_egress(struct net_bridge *br,return true; } +static inline bool br_should_learn (struct net_bridge_port *p, +struct sk_buff *skb,u16 *vid) +{ +return true; +} +static inline struct sk_buff *br_handle_vlan (struct net_bridge *br,const struct net_port_vlans *v,struct sk_buff *skb)
net/bridge/br_vlan.c +28 -0
@@ -260,6 +260,34 @@ bool br_allowed_egress(struct net_bridge *br,return false; } +/* Called under RCU */ +bool br_should_learn (struct net_bridge_port *p,struct sk_buff *skb,u16 *vid) +{ +struct net_bridge *br = p->br; +struct net_port_vlans *v; + +if (!br->vlan_enabled) +return true; + + v =rcu_dereference (p->vlan_info); +if (!v) +return false; + +br_vlan_get_tag (skb, vid); +if (!*vid) { + *vid =br_get_pvid (v); +if (*vid ==VLAN_N_VID ) +return false; + +return true; + } + +if (test_bit (*vid, v->vlan_bitmap)) +return true; + +return false; +} +/* Must be protected by RTNL. * Must be called with vid in range from 1 to 4094 inclusive. */
Signature · 1 line
2.0.0
PATCH 96/111 net: tunnels - enable module autoloading
In reply to Jiri SlabyFrom: Tom Gundersen <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit f98f89a0104454f35a62d681683c844f6dbf4043 ]
Enable the module alias hookup to allow tunnel modules to be autoloaded on demand.
This is in line with how most other netdev kinds work, and will allow userspace to create tunnels without having CAP_SYS_MODULE.
--- net/ipv4/ipip.c | 1 + net/ipv6/ip6_tunnel.c | 1 + net/ipv6/sit.c | 1 + 3 files changed, 3 insertions(+)
net/ipv4/ipip.c +1 -0
@@ -485,4 +485,5 @@ static void __exit ipip_fini(void)module_init (ipip_init);module_exit (ipip_fini);MODULE_LICENSE ("GPL" ); +MODULE_ALIAS_RTNL_LINK ("ipip" );MODULE_ALIAS_NETDEV ("tunl0" );
net/ipv6/ip6_tunnel.c +1 -0
@@ -62,6 +62,7 @@MODULE_AUTHOR ("Ville Nuorvala" );MODULE_DESCRIPTION ("IPv6 tunneling device" );MODULE_LICENSE ("GPL" ); +MODULE_ALIAS_RTNL_LINK ("ip6tnl" );MODULE_ALIAS_NETDEV ("ip6tnl0" );#ifdef IP6_TNL_DEBUG
net/ipv6/sit.c +1 -0
@@ -1770,4 +1770,5 @@ xfrm_tunnel_failed:module_init (sit_init);module_exit (sit_cleanup);MODULE_LICENSE ("GPL" ); +MODULE_ALIAS_RTNL_LINK ("sit" );MODULE_ALIAS_NETDEV ("sit0" );
Signature · 1 line
2.0.0
PATCH 97/111 net: fix inet_getid() and ipv6_select_ident() bugs
In reply to Jiri SlabyFrom: Eric Dumazet <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit 39c36094d78c39e038c1e499b2364e13bce36f54 ]
I noticed we were sending wrong IPv4 ID in TCP flows when MTU discovery is disabled.
Note how GSO/TSO packets do not have monotonically incrementing ID.
06:37:41.575531 IP (id 14227, proto: TCP (6), length: 4396) 06:37:41.575534 IP (id 14272, proto: TCP (6), length: 65212) 06:37:41.575544 IP (id 14312, proto: TCP (6), length: 57972) 06:37:41.575678 IP (id 14317, proto: TCP (6), length: 7292) 06:37:41.575683 IP (id 14361, proto: TCP (6), length: 63764)
It appears I introduced this bug in linux-3.1.
inet_getid() must return the old value of peer->ip_id_count, not the new one.
Lets revert this part, and remove the prevention of a null identification field in IPv6 Fragment Extension Header, which is dubious and not even done properly.
--- include/net/inetpeer.h | 9 +-------- net/ipv6/output_core.c | 11 +++-------- 2 files changed, 4 insertions(+), 16 deletions(-)
include/net/inetpeer.h +1 -8
@@ -178,16 +178,9 @@ static inline void inet_peer_refcheck(const struct inet_peer *p)/* can be called with or without local BH being disabled */ static inline int inet_getid (struct inet_peer *p,int more) { -int old, new; more++;inet_peer_refcheck (p); -do { - old =atomic_read (&p->ip_id_count); - new = old + more; -if (!new) - new =1 ; - }while (atomic_cmpxchg (&p->ip_id_count, old, new) != old); -return new; +return atomic_add_return (more, &p->ip_id_count) - more; }#endif /* _NET_INETPEER_H */
net/ipv6/output_core.c +3 -8
@@ -10,7 +10,7 @@void ipv6_select_ident (struct frag_hdr *fhdr,struct rt6_info *rt) {static atomic_t ipv6_fragmentation_id; -int old, new; +int ident;#if IS_ENABLED (CONFIG_IPV6 )if (rt && !(rt->dst.flags &DST_NOPEER )) {
@@ -26,13 +26,8 @@ void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt) } }#endif -do { - old =atomic_read (&ipv6_fragmentation_id); - new = old +1 ; -if (!new) - new =1 ; - }while (atomic_cmpxchg (&ipv6_fragmentation_id, old, new) != old); - fhdr->identification =htonl (new); + ident =atomic_inc_return (&ipv6_fragmentation_id); + fhdr->identification =htonl (ident); }EXPORT_SYMBOL (ipv6_select_ident);
Signature · 1 line
2.0.0
PATCH 98/111 team: fix mtu setting
In reply to Jiri SlabyFrom: Jiri Pirko <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit 9d0d68faea6962d62dd501cd6e71ce5cc8ed262b ]
Now it is not possible to set mtu to team device which has a port enslaved to it. The reason is that when team_change_mtu() calls dev_set_mtu() for port device, notificator for NETDEV_PRECHANGEMTU event is called and team_device_event() returns NOTIFY_BAD forbidding the change. So fix this by returning NOTIFY_DONE here in case team is changing mtu in team_change_mtu().
--- drivers/net/team/team.c | 7 ++++++- include/linux/if_team.h | 1 + 2 files changed, 7 insertions(+), 1 deletion(-)
drivers/net/team/team.c +6 -1
@@ -1725,6 +1725,7 @@ static int team_change_mtu(struct net_device *dev, int new_mtu)* to traverse list in reverse under rcu_read_lock */ mutex_lock (&team->lock); + team->port_mtu_change_allowed = true;list_for_each_entry (port, &team->port_list, list) { err =dev_set_mtu (port->dev, new_mtu);if (err) {
@@ -1733,6 +1734,7 @@ static int team_change_mtu(struct net_device *dev, int new_mtu) goto unwind; } } + team->port_mtu_change_allowed = false;mutex_unlock (&team->lock); dev->mtu = new_mtu;
@@ -1742,6 +1744,7 @@ static int team_change_mtu(struct net_device *dev, int new_mtu) unwind:list_for_each_entry_continue_reverse (port, &team->port_list, list)dev_set_mtu (port->dev, dev->mtu); + team->port_mtu_change_allowed = false;mutex_unlock (&team->lock);return err;
@@ -2861,7 +2864,9 @@ static int team_device_event(struct notifier_block *unused,break ;case NETDEV_CHANGEMTU :/* Forbid to change mtu of underlaying device */ -return NOTIFY_BAD ; +if (!port->team->port_mtu_change_allowed) +return NOTIFY_BAD ; +break ;case NETDEV_PRE_TYPE_CHANGE :/* Forbid to change type of underlaying device */ return NOTIFY_BAD ;
include/linux/if_team.h +1 -0
@@ -194,6 +194,7 @@ struct team {bool user_carrier_enabled;bool queue_override_enabled;struct list_head *qom_lists;/* array of queue override mapping lists */ +bool port_mtu_change_allowed;struct {unsigned int count;unsigned int interval;/* in ms */
Signature · 1 line
2.0.0
PATCH 99/111 tcp: fix cwnd undo on DSACK in F-RTO
In reply to Jiri SlabyFrom: Yuchung Cheng <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit 0cfa5c07d6d1d7f8e710fc671c5ba1ce85e09fa4 ]
This bug is discovered by an recent F-RTO issue on tcpm list
https://www.ietf.org/mail-archive/web/tcpm/current/msg08794.html
The bug is that currently F-RTO does not use DSACK to undo cwnd in certain cases: upon receiving an ACK after the RTO retransmission in F-RTO, and the ACK has DSACK indicating the retransmission is spurious, the sender only calls tcp_try_undo_loss() if some never retransmisted data is sacked (FLAG_ORIG_DATA_SACKED).
The correct behavior is to unconditionally call tcp_try_undo_loss so the DSACK information is used properly to undo the cwnd reduction.
--- net/ipv4/tcp_input.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-)
net/ipv4/tcp_input.c +5 -6
@@ -2633,13 +2633,12 @@ static void tcp_process_loss(struct sock *sk, int flag, bool is_dupack)bool recovered = !before (tp->snd_una, tp->high_seq);if (tp->frto) {/* F-RTO RFC5682 sec 3.1 (sack enhanced version). */ -if (flag &FLAG_ORIG_SACK_ACKED ) { -/* Step 3.b. A timeout is spurious if not all data are -* lost, i.e., never-retransmitted data are (s)acked. -*/ -tcp_try_undo_loss (sk, true); +/* Step 3.b. A timeout is spurious if not all data are +* lost, i.e., never-retransmitted data are (s)acked. +*/ +if (tcp_try_undo_loss (sk, flag &FLAG_ORIG_SACK_ACKED ))return ; - } +if (after (tp->snd_nxt, tp->high_seq) && (flag &FLAG_DATA_SACKED || is_dupack)) { tp->frto =0 ;/* Loss was real: 2nd part of step 3.a */
Signature · 1 line
2.0.0
PATCH 100/111 sh_eth: use RNC mode for packet reception
In reply to Jiri SlabyFrom: Ben Dooks <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit 530aa2d0d9d55ab2775d47621ddf4b5b15bc1110 ]
The current behaviour of the sh_eth driver is not to use the RNC bit for the receive ring. This means that every packet recieved is not only generating an IRQ but it also stops the receive ring DMA as well until the driver re-enables it after unloading the packet.
This means that a number of the following errors are generated due to the receive packet FIFO overflowing due to nowhere to put packets:
net eth0: Receive FIFO Overflow
Since feedback from Yoshihiro Shimoda shows that every supported LSI for this driver should have the bit enabled it seems the best way is to remove the RMCR default value from the per-system data and just write it when initialising the RMCR value. This is discussed in the message (http://www.spinics.net/lists/netdev/msg284912.html).
I have tested the 0x00000001 configuration with NFS root filesystem and the driver has not failed yet. There are further test reports from Sergei Shtylov and others for both the R8A7790 and R8A7791.
There is also feedback fron Cao Minh Hiep[1] which reports the same issue in (http://comments.gmane.org/gmane.linux.network/316285)
showing this fixes issues with losing UDP datagrams under iperf.
--- drivers/net/ethernet/renesas/sh_eth.c | 10 ++-------- drivers/net/ethernet/renesas/sh_eth.h | 2 -- 2 files changed, 2 insertions(+), 10 deletions(-)
drivers/net/ethernet/renesas/sh_eth.c +2 -8
@@ -483,7 +483,6 @@ static struct sh_eth_cpu_data sh7757_data = { .register_type = SH_ETH_REG_FAST_SH4, .eesipr_value = DMAC_M_RFRMER | DMAC_M_ECI | 0x003fffff, - .rmcr_value = 0x00000001, .tx_check = EESR_FTC | EESR_CND | EESR_DLC | EESR_CD | EESR_RTO, .eesr_err_check = EESR_TWB | EESR_TABT | EESR_RABT | EESR_RFE |
@@ -561,7 +560,6 @@ static struct sh_eth_cpu_data sh7757_data_giga = {EESR_RFE |EESR_RDE |EESR_RFRMER |EESR_TFE | EESR_TDE | EESR_ECI, .fdr_value = 0x0000072f, - .rmcr_value = 0x00000001, .irq_flags = IRQF_SHARED, .apr = 1,
@@ -689,7 +687,6 @@ static struct sh_eth_cpu_data r8a7740_data = {EESR_RFE |EESR_RDE |EESR_RFRMER |EESR_TFE | EESR_TDE | EESR_ECI, .fdr_value = 0x0000070f, - .rmcr_value = 0x00000001, .apr = 1, .mpr = 1,
@@ -738,9 +735,6 @@ static void sh_eth_set_default_cpu_data(struct sh_eth_cpu_data *cd)if (!cd->fdr_value) cd->fdr_value =DEFAULT_FDR_INIT ; -if (!cd->rmcr_value) - cd->rmcr_value =DEFAULT_RMCR_VALUE ; -if (!cd->tx_check) cd->tx_check =DEFAULT_TX_CHECK ;
@@ -1193,8 +1187,8 @@ static int sh_eth_dev_init(struct net_device *ndev, bool start)sh_eth_write (ndev, mdp->cd->fdr_value,FDR );sh_eth_write (ndev,0 ,TFTR ); -/* Frame recv control */ -sh_eth_write (ndev, mdp->cd->rmcr_value,RMCR ); +/* Frame recv control (enable multiple-packets per rx irq) */ +sh_eth_write (ndev,0x00000001 ,RMCR );sh_eth_write (ndev,DESC_I_RINT8 |DESC_I_RINT5 |DESC_I_TINT2 ,TRSCER );
drivers/net/ethernet/renesas/sh_eth.h +0 -2
@@ -321,7 +321,6 @@ enum TD_STS_BIT {#define TD_TFP (TD_TFP1|TD_TFP0)/* RMCR */ -#define DEFAULT_RMCR_VALUE 0x00000000/* ECMR */ enum FELIC_MODE_BIT {
@@ -470,7 +469,6 @@ struct sh_eth_cpu_data {unsigned long fdr_value;unsigned long fcftr_value;unsigned long rpadir_value; -unsigned long rmcr_value;/* interrupt checking mask */ unsigned long tx_check;
Signature · 1 line
2.0.0
PATCH 101/111 sh_eth: fix SH7619/771x support
In reply to Jiri SlabyFrom: Sergei Shtylyov <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit d8b0426af5b67973585712c9af36b86f6ea97815 ]
Commit 4a55530f38e4 (net: sh_eth: modify the definitions of register) managed to leave out the E-DMAC register entries in sh_eth_offset_fast_sh3_sh2[], thus totally breaking SH7619/771x support. Add the missing entries using the data from before that commit.
--- drivers/net/ethernet/renesas/sh_eth.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+)
drivers/net/ethernet/renesas/sh_eth.c +21 -0
@@ -247,6 +247,27 @@ static const u16 sh_eth_offset_fast_sh4[SH_ETH_MAX_REGISTER_OFFSET] = { };static const u16 sh_eth_offset_fast_sh3_sh2[SH_ETH_MAX_REGISTER_OFFSET ] = { + [EDMR ] =0x0000 , + [EDTRR ] =0x0004 , + [EDRRR ] =0x0008 , + [TDLAR ] =0x000c , + [RDLAR ] =0x0010 , + [EESR ] =0x0014 , + [EESIPR ] =0x0018 , + [TRSCER ] =0x001c , + [RMFCR ] =0x0020 , + [TFTR ] =0x0024 , + [FDR ] =0x0028 , + [RMCR ] =0x002c , + [EDOCR ] =0x0030 , + [FCFTR ] =0x0034 , + [RPADIR ] =0x0038 , + [TRIMD ] =0x003c , + [RBWAR ] =0x0040 , + [RDFAR ] =0x0044 , + [TBRAR ] =0x004c , + [TDFAR ] =0x0050 , + [ECMR ] =0x0160 , [ECSR ] =0x0164 , [ECSIPR ] =0x0168 ,
Signature · 1 line
2.0.0
PATCH 102/111 net: filter: fix typo in sparc BPF JIT
In reply to Jiri SlabyFrom: Alexei Starovoitov <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit 569810d1e3278907264f5b115281fca3f0038d53 ]
fix typo in sparc codegen for SKF_AD_IFINDEX and SKF_AD_HATYPE classic BPF extensions
--- arch/sparc/net/bpf_jit_comp.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/sparc/net/bpf_jit_comp.c +4 -4
@@ -83,9 +83,9 @@ static void bpf_flush_icache(void *start_, void *end_)#define BNE (F2(0, 2) | CONDNE)#ifdef CONFIG_SPARC64 -#define BNE_PTR (F2(0, 1) | CONDNE | (2 << 20)) +#define BE_PTR (F2(0, 1) | CONDE | (2 << 20))#else -#define BNE_PTR BNE +#define BE_PTR BNE#endif #define SETHI (K ,REG ) \
@@ -600,7 +600,7 @@ void bpf_jit_compile(struct sk_filter *fp)case BPF_S_ANC_IFINDEX :emit_skb_loadptr (dev, r_A);emit_cmpi (r_A,0 ); -emit_branch (BNE_PTR , cleanup_addr +4 ); +emit_branch (BE_PTR , cleanup_addr +4 );emit_nop (); emit_load32(r_A, struct net_device, ifindex, r_A);break ;
@@ -613,7 +613,7 @@ void bpf_jit_compile(struct sk_filter *fp)case BPF_S_ANC_HATYPE :emit_skb_loadptr (dev, r_A);emit_cmpi (r_A,0 ); -emit_branch (BNE_PTR , cleanup_addr +4 ); +emit_branch (BE_PTR , cleanup_addr +4 );emit_nop (); emit_load16(r_A, struct net_device, type, r_A);break ;
Signature · 1 line
2.0.0
PATCH 103/111 net: filter: fix sparc32 typo
In reply to Jiri SlabyFrom: Alexei Starovoitov <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit 588f5d629b3369aba88f52217d1c473a28fa7723 ]
--- arch/sparc/net/bpf_jit_comp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/sparc/net/bpf_jit_comp.c +1 -1
@@ -85,7 +85,7 @@ static void bpf_flush_icache(void *start_, void *end_)#ifdef CONFIG_SPARC64 #define BE_PTR (F2(0, 1) | CONDE | (2 << 20))#else -#define BE_PTR BNE +#define BE_PTR BE#endif #define SETHI (K ,REG ) \
Signature · 1 line
2.0.0
PATCH 104/111 net: qmi_wwan: add Olivetti Olicard modems
In reply to Jiri SlabyFrom: Bjørn Mork <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit ba6de0f5304ccdc45ae260e7e0feb6e0ef2dd558 ]
Lars writes: "I'm only 99% sure that the net interfaces are qmi interfaces, nothing to lose by adding them in my opinion."
And I tend to agree based on the similarity with the two Olicard modems we already have here.
--- drivers/net/usb/qmi_wwan.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/net/usb/qmi_wwan.c +6 -1
@@ -739,7 +739,12 @@ static const struct usb_device_id products[] = { {QMI_FIXED_INTF(0x2357, 0x9000, 4)}, /* TP-LINK MA260 */ {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)}, /* Telit LE920 */ {QMI_FIXED_INTF(0x1bc7, 0x1201, 2)}, /* Telit LE920 */ - {QMI_FIXED_INTF(0x0b3c, 0xc005, 6)}, /* Olivetti Olicard 200 */ + {QMI_FIXED_INTF(0x0b3c, 0xc000, 4)}, /* Olivetti Olicard 100 */ + {QMI_FIXED_INTF(0x0b3c, 0xc001, 4)}, /* Olivetti Olicard 120 */ + {QMI_FIXED_INTF(0x0b3c, 0xc002, 4)}, /* Olivetti Olicard 140 */ + {QMI_FIXED_INTF(0x0b3c, 0xc004, 6)}, /* Olivetti Olicard 155 */ + {QMI_FIXED_INTF(0x0b3c, 0xc005, 6)}, /* Olivetti Olicard 200 */ + {QMI_FIXED_INTF(0x0b3c, 0xc00a, 6)}, /* Olivetti Olicard 160 */ {QMI_FIXED_INTF(0x0b3c, 0xc00b, 4)}, /* Olivetti Olicard 500 */ {QMI_FIXED_INTF(0x1e2d, 0x0060, 4)}, /* Cinterion PLxx */ {QMI_FIXED_INTF(0x1e2d, 0x0053, 4)}, /* Cinterion PHxx,PXxx */
Signature · 1 line
2.0.0
PATCH 105/111 net: force a list_del() in unregister_netdevice_many()
In reply to Jiri SlabyFrom: Eric Dumazet <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit 87757a917b0b3c0787e0563c679762152be81312 ]
unregister_netdevice_many() API is error prone and we had too many bugs because of dangling LIST_HEAD on stacks.
See commit f87e6f47933e3e ("net: dont leave active on stack LIST_HEAD")
In fact, instead of making sure no caller leaves an active list_head, just force a list_del() in the callee. No one seems to need to access the list after unregister_netdevice_many()
--- drivers/net/macvlan.c | 1 - net/core/dev.c | 5 ++++- net/core/rtnetlink.c | 1 - net/mac80211/iface.c | 1 - 4 files changed, 4 insertions(+), 4 deletions(-)
drivers/net/macvlan.c +0 -1
@@ -991,7 +991,6 @@ static int macvlan_device_event(struct notifier_block *unused,list_for_each_entry_safe (vlan, next, &port->vlans, list) vlan->dev->rtnl_link_ops->dellink (vlan->dev, &list_kill);unregister_netdevice_many (&list_kill); -list_del (&list_kill);break ;case NETDEV_PRE_TYPE_CHANGE :/* Forbid underlaying device to change its type. */
net/core/dev.c +4 -1
@@ -6208,6 +6208,9 @@ EXPORT_SYMBOL(unregister_netdevice_queue);/** * unregister_netdevice_many - unregister many devices * @head: list of devices +* +* Note: As most callers use a stack allocated list_head, +* we force a list_del() to make sure stack wont be corrupted later. */ void unregister_netdevice_many (struct list_head *head) {
@@ -6217,6 +6220,7 @@ void unregister_netdevice_many(struct list_head *head)rollback_registered_many (head);list_for_each_entry (dev, head, unreg_list)net_set_todo (dev); +list_del (head); } }EXPORT_SYMBOL (unregister_netdevice_many);
@@ -6672,7 +6676,6 @@ static void __net_exit default_device_exit_batch(struct list_head *net_list) } }unregister_netdevice_many (&dev_kill_list); -list_del (&dev_kill_list);rtnl_unlock (); }
net/core/rtnetlink.c +0 -1
@@ -1673,7 +1673,6 @@ static int rtnl_dellink(struct sk_buff *skb, struct nlmsghdr *nlh) ops->dellink (dev, &list_kill);unregister_netdevice_many (&list_kill); -list_del (&list_kill);return 0 ; }
net/mac80211/iface.c +0 -1
@@ -1766,7 +1766,6 @@ void ieee80211_remove_interfaces(struct ieee80211_local *local) }mutex_unlock (&local->iflist_mtx);unregister_netdevice_many (&unreg_list); -list_del (&unreg_list);list_for_each_entry_safe (sdata, tmp, &wdev_list, list) {list_del (&sdata->list);
Signature · 1 line
2.0.0
PATCH 106/111 ipip, sit: fix ipv4_{update_pmtu,redirect} calls
In reply to Jiri SlabyFrom: Dmitry Popov <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit 2346829e641b804ece9ac9298136b56d9567c278 ]
ipv4_{update_pmtu,redirect} were called with tunnel's ifindex (t->dev is a tunnel netdevice). It caused wrong route lookup and failure of pmtu update or redirect. We should use the same ifindex that we use in ip_route_output_* in *tunnel_xmit code. It is t->parms.link .
--- net/ipv4/ipip.c | 4 ++-- net/ipv6/sit.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-)
net/ipv4/ipip.c +2 -2
@@ -149,13 +149,13 @@ static int ipip_err(struct sk_buff *skb, u32 info)if (type ==ICMP_DEST_UNREACH && code ==ICMP_FRAG_NEEDED ) {ipv4_update_pmtu (skb,dev_net (skb->dev), info, - t->dev->ifindex,0 ,IPPROTO_IPIP ,0 ); + t->parms.link,0 ,IPPROTO_IPIP ,0 ); err =0 ; goto out; }if (type ==ICMP_REDIRECT ) { -ipv4_redirect (skb,dev_net (skb->dev), t->dev->ifindex,0 , +ipv4_redirect (skb,dev_net (skb->dev), t->parms.link,0 ,IPPROTO_IPIP ,0 ); err =0 ; goto out;
net/ipv6/sit.c +2 -2
@@ -530,12 +530,12 @@ static int ipip6_err(struct sk_buff *skb, u32 info)if (type ==ICMP_DEST_UNREACH && code ==ICMP_FRAG_NEEDED ) {ipv4_update_pmtu (skb,dev_net (skb->dev), info, - t->dev->ifindex,0 ,IPPROTO_IPV6 ,0 ); + t->parms.link,0 ,IPPROTO_IPV6 ,0 ); err =0 ; goto out; }if (type ==ICMP_REDIRECT ) { -ipv4_redirect (skb,dev_net (skb->dev), t->dev->ifindex,0 , +ipv4_redirect (skb,dev_net (skb->dev), t->parms.link,0 ,IPPROTO_IPV6 ,0 ); err =0 ; goto out;
Signature · 1 line
2.0.0
PATCH 107/111 ipv4: fix a race in ip4_datagram_release_cb()
In reply to Jiri SlabyFrom: Eric Dumazet <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit 9709674e68646cee5a24e3000b3558d25412203a ]
Alexey gave a AddressSanitizer[1] report that finally gave a good hint at where was the origin of various problems already reported by Dormando in the past [2]
Problem comes from the fact that UDP can have a lockless TX path, and concurrent threads can manipulate sk_dst_cache, while another thread, is holding socket lock and calls __sk_dst_set() in ip4_datagram_release_cb() (this was added in linux-3.8)
It seems that all we need to do is to use sk_dst_check() and sk_dst_set() so that all the writers hold same spinlock (sk->sk_dst_lock) to prevent corruptions.
TCP stack do not need this protection, as all sk_dst_cache writers hold the socket lock.
[1]
https://code.google.com/p/address-sanitizer/wiki/AddressSanitizerForKernel
AddressSanitizer: heap-use-after-free in ipv4_dst_check
Read of size 2 by thread T15453: [<ffffffff817daa3a>] ipv4_dst_check+0x1a/0x90 ./net/ipv4/route.c:1116 [<ffffffff8175b789>] __sk_dst_check+0x89/0xe0 ./net/core/sock.c:531 [<ffffffff81830a36>] ip4_datagram_release_cb+0x46/0x390 ??:0 [<ffffffff8175eaea>] release_sock+0x17a/0x230 ./net/core/sock.c:2413 [<ffffffff81830882>] ip4_datagram_connect+0x462/0x5d0 ??:0 [<ffffffff81846d06>] inet_dgram_connect+0x76/0xd0 ./net/ipv4/af_inet.c:534 [<ffffffff817580ac>] SYSC_connect+0x15c/0x1c0 ./net/socket.c:1701 [<ffffffff817596ce>] SyS_connect+0xe/0x10 ./net/socket.c:1682 [<ffffffff818b0a29>] system_call_fastpath+0x16/0x1b
./arch/x86/kernel/entry_64.S:629
Freed by thread T15455:
[<ffffffff8178d9b8>] dst_destroy+0xa8/0x160 ./net/core/dst.c:251 [<ffffffff8178de25>] dst_release+0x45/0x80 ./net/core/dst.c:280 [<ffffffff818304c1>] ip4_datagram_connect+0xa1/0x5d0 ??:0 [<ffffffff81846d06>] inet_dgram_connect+0x76/0xd0 ./net/ipv4/af_inet.c:534 [<ffffffff817580ac>] SYSC_connect+0x15c/0x1c0 ./net/socket.c:1701 [<ffffffff817596ce>] SyS_connect+0xe/0x10 ./net/socket.c:1682 [<ffffffff818b0a29>] system_call_fastpath+0x16/0x1b
./arch/x86/kernel/entry_64.S:629
Allocated by thread T15453:
[<ffffffff8178d291>] dst_alloc+0x81/0x2b0 ./net/core/dst.c:171 [<ffffffff817db3b7>] rt_dst_alloc+0x47/0x50 ./net/ipv4/route.c:1406 [< inlined >] __ip_route_output_key+0x3e8/0xf70 __mkroute_output ./net/ipv4/route.c:1939 [<ffffffff817dde08>] __ip_route_output_key+0x3e8/0xf70 ./net/ipv4/route.c:2161 [<ffffffff817deb34>] ip_route_output_flow+0x14/0x30 ./net/ipv4/route.c:2249 [<ffffffff81830737>] ip4_datagram_connect+0x317/0x5d0 ??:0 [<ffffffff81846d06>] inet_dgram_connect+0x76/0xd0 ./net/ipv4/af_inet.c:534 [<ffffffff817580ac>] SYSC_connect+0x15c/0x1c0 ./net/socket.c:1701 [<ffffffff817596ce>] SyS_connect+0xe/0x10 ./net/socket.c:1682 [<ffffffff818b0a29>] system_call_fastpath+0x16/0x1b
./arch/x86/kernel/entry_64.S:629
[2]
<4>[196727.311203] general protection fault: 0000 [#1] SMP <4>[196727.311224] Modules linked in: xt_TEE xt_dscp xt_DSCP macvlan bridge coretemp crc32_pclmul ghash_clmulni_intel gpio_ich microcode ipmi_watchdog ipmi_devintf sb_edac edac_core lpc_ich mfd_core tpm_tis tpm tpm_bios ipmi_si ipmi_msghandler isci igb libsas i2c_algo_bit ixgbe ptp pps_core mdio <4>[196727.311333] CPU: 17 PID: 0 Comm: swapper/17 Not tainted 3.10.26 #1 <4>[196727.311344] Hardware name: Supermicro X9DRi-LN4+/X9DR3-LN4+/X9DRi-LN4+/X9DR3-LN4+, BIOS 3.0 07/05/2013 <4>[196727.311364] task: ffff885e6f069700 ti: ffff885e6f072000 task.ti: ffff885e6f072000 <4>[196727.311377] RIP: 0010:[<ffffffff815f8c7f>] [<ffffffff815f8c7f>] ipv4_dst_destroy+0x4f/0x80 <4>[196727.311399] RSP: 0018:ffff885effd23a70 EFLAGS: 00010282 <4>[196727.311409] RAX: dead000000200200 RBX: ffff8854c398ecc0 RCX: 0000000000000040 <4>[196727.311423] RDX: dead000000100100 RSI: dead000000100100 RDI: dead000000200200 <4>[196727.311437] RBP: ffff885effd23a80 R08: ffffffff815fd9e0 R09: ffff885d5a590800 <4>[196727.311451] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 <4>[196727.311464] R13: ffffffff81c8c280 R14: 0000000000000000 R15: ffff880e85ee16ce <4>[196727.311510] FS: 0000000000000000(0000) GS:ffff885effd20000(0000) knlGS:0000000000000000 <4>[196727.311554] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 <4>[196727.311581] CR2: 00007a46751eb000 CR3: 0000005e65688000 CR4: 00000000000407e0 <4>[196727.311625] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 <4>[196727.311669] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 <4>[196727.311713] Stack: <4>[196727.311733] ffff8854c398ecc0 ffff8854c398ecc0 ffff885effd23ab0 ffffffff815b7f42 <4>[196727.311784] ffff88be6595bc00 ffff8854c398ecc0 0000000000000000 ffff8854c398ecc0 <4>[196727.311834] ffff885effd23ad0 ffffffff815b86c6 ffff885d5a590800 ffff8816827821c0 <4>[196727.311885] Call Trace: <4>[196727.311907] <IRQ> <4>[196727.311912] [<ffffffff815b7f42>] dst_destroy+0x32/0xe0 <4>[196727.311959] [<ffffffff815b86c6>] dst_release+0x56/0x80 <4>[196727.311986] [<ffffffff81620bd5>] tcp_v4_do_rcv+0x2a5/0x4a0 <4>[196727.312013] [<ffffffff81622b5a>] tcp_v4_rcv+0x7da/0x820 <4>[196727.312041] [<ffffffff815fd9e0>] ? ip_rcv_finish+0x360/0x360 <4>[196727.312070] [<ffffffff815de02d>] ? nf_hook_slow+0x7d/0x150 <4>[196727.312097] [<ffffffff815fd9e0>] ? ip_rcv_finish+0x360/0x360 <4>[196727.312125] [<ffffffff815fda92>] ip_local_deliver_finish+0xb2/0x230 <4>[196727.312154] [<ffffffff815fdd9a>] ip_local_deliver+0x4a/0x90 <4>[196727.312183] [<ffffffff815fd799>] ip_rcv_finish+0x119/0x360 <4>[196727.312212] [<ffffffff815fe00b>] ip_rcv+0x22b/0x340 <4>[196727.312242] [<ffffffffa0339680>] ? macvlan_broadcast+0x160/0x160 [macvlan] <4>[196727.312275] [<ffffffff815b0c62>] __netif_receive_skb_core+0x512/0x640 <4>[196727.312308] [<ffffffff811427fb>] ? kmem_cache_alloc+0x13b/0x150 <4>[196727.312338] [<ffffffff815b0db1>] __netif_receive_skb+0x21/0x70 <4>[196727.312368] [<ffffffff815b0fa1>] netif_receive_skb+0x31/0xa0 <4>[196727.312397] [<ffffffff815b1ae8>] napi_gro_receive+0xe8/0x140 <4>[196727.312433] [<ffffffffa00274f1>] ixgbe_poll+0x551/0x11f0 [ixgbe] <4>[196727.312463] [<ffffffff815fe00b>] ? ip_rcv+0x22b/0x340 <4>[196727.312491] [<ffffffff815b1691>] net_rx_action+0x111/0x210 <4>[196727.312521] [<ffffffff815b0db1>] ? __netif_receive_skb+0x21/0x70 <4>[196727.312552] [<ffffffff810519d0>] __do_softirq+0xd0/0x270 <4>[196727.312583] [<ffffffff816cef3c>] call_softirq+0x1c/0x30 <4>[196727.312613] [<ffffffff81004205>] do_softirq+0x55/0x90 <4>[196727.312640] [<ffffffff81051c85>] irq_exit+0x55/0x60 <4>[196727.312668] [<ffffffff816cf5c3>] do_IRQ+0x63/0xe0 <4>[196727.312696] [<ffffffff816c5aaa>] common_interrupt+0x6a/0x6a <4>[196727.312722] <EOI> <1>[196727.313071] RIP [<ffffffff815f8c7f>] ipv4_dst_destroy+0x4f/0x80 <4>[196727.313100] RSP <ffff885effd23a70> <4>[196727.313377] ---[ end trace 64b3f14fae0f2e29 ]--- <0>[196727.380908] Kernel panic - not syncing: Fatal exception in interrupt
--- net/ipv4/datagram.c | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-)
net/ipv4/datagram.c +15 -5
@@ -86,18 +86,26 @@ out: }EXPORT_SYMBOL (ip4_datagram_connect); +/* Because UDP xmit path can manipulate sk_dst_cache without holding +* socket lock, we need to use sk_dst_set() here, +* even if we own the socket lock. +*/ void ip4_datagram_release_cb (struct sock *sk) {const struct inet_sock *inet =inet_sk (sk);const struct ip_options_rcu *inet_opt;__be32 daddr = inet->inet_daddr; +struct dst_entry *dst;struct flowi4 fl4;struct rtable *rt; -if (!__sk_dst_get (sk) ||__sk_dst_check (sk,0 )) -return ; -rcu_read_lock (); + + dst =__sk_dst_get (sk); +if (!dst || !dst->obsolete || dst->ops->check (dst,0 )) { +rcu_read_unlock (); +return ; + } inet_opt =rcu_dereference (inet->inet_opt);if (inet_opt && inet_opt->opt.srr) daddr = inet_opt->opt.faddr;
@@ -105,8 +113,10 @@ void ip4_datagram_release_cb(struct sock *sk) inet->inet_saddr, inet->inet_dport, inet->inet_sport, sk->sk_protocol, RT_CONN_FLAGS(sk), sk->sk_bound_dev_if); -if (!IS_ERR (rt)) -__sk_dst_set (sk, &rt->dst); + + dst = !IS_ERR (rt) ? &rt->dst :NULL ; +sk_dst_set (sk, dst); +rcu_read_unlock (); }EXPORT_SYMBOL_GPL (ip4_datagram_release_cb);
Signature · 1 line
2.0.0
PATCH 108/111 sctp: Fix sk_ack_backlog wrap-around problem
In reply to Jiri SlabyFrom: Xufeng Zhang <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit d3217b15a19a4779c39b212358a5c71d725822ee ]
Consider the scenario:
For a TCP-style socket, while processing the COOKIE_ECHO chunk in sctp_sf_do_5_1D_ce(), after it has passed a series of sanity check, a new association would be created in sctp_unpack_cookie(), but afterwards, some processing maybe failed, and sctp_association_free() will be called to free the previously allocated association, in sctp_association_free(), sk_ack_backlog value is decremented for this socket, since the initial value for sk_ack_backlog is 0, after the decrement, it will be 65535, a wrap-around problem happens, and if we want to establish new associations afterward in the same socket, ABORT would be triggered since sctp deem the accept queue as full.
Fix this issue by only decrementing sk_ack_backlog for associations in the endpoint's list.
--- net/sctp/associola.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/sctp/associola.c +1 -1
@@ -375,7 +375,7 @@ void sctp_association_free(struct sctp_association *asoc)/* Only real associations count against the endpoint, so * don't bother for if this is a temporary association. */ -if (!asoc->temp) { +if (!list_empty (&asoc->asocs)) {list_del (&asoc->asocs);/* Decrement the backlog value for a TCP-style listening
Signature · 1 line
2.0.0
PATCH 109/111 rtnetlink: fix userspace API breakage for iproute2 < v3.9.0
In reply to Jiri SlabyFrom: Michal Schmidt <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit e5eca6d41f53db48edd8cf88a3f59d2c30227f8e ]
When running RHEL6 userspace on a current upstream kernel, "ip link" fails to show VF information.
The reason is a kernel<->userspace API change introduced by commit 88c5b5ce5cb57 ("rtnetlink: Call nlmsg_parse() with correct header length"), after which the kernel does not see iproute2's IFLA_EXT_MASK attribute in the netlink request.
iproute2 adjusted for the API change in its commit 63338dca4513 ("libnetlink: Use ifinfomsg instead of rtgenmsg in rtnl_wilddump_req_filter").
The problem has been noticed before:
http://marc.info/?l=linux-netdev&m=136692296022182&w=2
(Subject: Re: getting VF link info seems to be broken in 3.9-rc8)
We can do better than tell those with old userspace to upgrade. We can recognize the old iproute2 in the kernel by checking the netlink message length. Even when including the IFLA_EXT_MASK attribute, its netlink message is shorter than struct ifinfomsg.
With this patch "ip link" shows VF information in both old and new iproute2 versions.
--- net/core/rtnetlink.c | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-)
net/core/rtnetlink.c +18 -4
@@ -1106,6 +1106,7 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)struct nlattr *tb[IFLA_MAX +1 ];u32 ext_filter_mask =0 ;int err; +int hdrlen; s_h = cb->args[0 ]; s_idx = cb->args[1 ];
@@ -1113,8 +1114,17 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)rcu_read_lock (); cb->seq = net->dev_base_seq; -if (nlmsg_parse (cb->nlh,sizeof (struct ifinfomsg ), tb,IFLA_MAX , - ifla_policy) >=0 ) { +/* A hack to preserve kernel<->userspace interface. +* The correct header is ifinfomsg. It is consistent with rtnl_getlink. +* However, before Linux v3.9 the code here assumed rtgenmsg and that's +* what iproute2 < v3.9.0 used. +* We can detect the old iproute2. Even including the IFLA_EXT_MASK +* attribute, its netlink message is shorter than struct ifinfomsg. +*/ + hdrlen =nlmsg_len (cb->nlh) <sizeof (struct ifinfomsg ) ? +sizeof (struct rtgenmsg ) :sizeof (struct ifinfomsg ); + +if (nlmsg_parse (cb->nlh, hdrlen, tb,IFLA_MAX , ifla_policy) >=0 ) {if (tb[IFLA_EXT_MASK ]) ext_filter_mask =nla_get_u32 (tb[IFLA_EXT_MASK ]);
@@ -1979,9 +1989,13 @@ static u16 rtnl_calcit(struct sk_buff *skb, struct nlmsghdr *nlh)struct nlattr *tb[IFLA_MAX +1 ];u32 ext_filter_mask =0 ;u16 min_ifinfo_dump_size =0 ; +int hdrlen; + +/* Same kernel<->userspace interface hack as in rtnl_dump_ifinfo. */ + hdrlen =nlmsg_len (nlh) <sizeof (struct ifinfomsg ) ? +sizeof (struct rtgenmsg ) :sizeof (struct ifinfomsg ); -if (nlmsg_parse (nlh,sizeof (struct ifinfomsg ), tb,IFLA_MAX , - ifla_policy) >=0 ) { +if (nlmsg_parse (nlh, hdrlen, tb,IFLA_MAX , ifla_policy) >=0 ) {if (tb[IFLA_EXT_MASK ]) ext_filter_mask =nla_get_u32 (tb[IFLA_EXT_MASK ]); }
Signature · 1 line
2.0.0
PATCH 110/111 vxlan: use dev->needed_headroom instead of dev->hard_header_len
In reply to Jiri SlabyFrom: Cong Wang <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit 2853af6a2ea1a8ed09b09dd4fb578e7f435e8d34 ]
When we mirror packets from a vxlan tunnel to other device, the mirror device should see the same packets (that is, without outer header). Because vxlan tunnel sets dev->hard_header_len, tcf_mirred() resets mac header back to outer mac, the mirror device actually sees packets with outer headers
Vxlan tunnel should set dev->needed_headroom instead of dev->hard_header_len, like what other ip tunnels do. This fixes the above problem.
--- drivers/net/vxlan.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
drivers/net/vxlan.c +3 -4
@@ -2157,9 +2157,9 @@ static void vxlan_setup(struct net_device *dev)eth_hw_addr_random (dev);ether_setup (dev);if (vxlan->default_dst.remote_ip.sa.sa_family ==AF_INET6 ) - dev->hard_header_len =ETH_HLEN +VXLAN6_HEADROOM ; + dev->needed_headroom =ETH_HLEN +VXLAN6_HEADROOM ;else - dev->hard_header_len =ETH_HLEN +VXLAN_HEADROOM ; + dev->needed_headroom =ETH_HLEN +VXLAN_HEADROOM ; dev->netdev_ops = &vxlan_netdev_ops; dev->destructor = free_netdev;
@@ -2540,8 +2540,7 @@ static int vxlan_newlink(struct net *net, struct net_device *dev,if (!tb[IFLA_MTU ]) dev->mtu = lowerdev->mtu - (use_ipv6 ?VXLAN6_HEADROOM :VXLAN_HEADROOM ); -/* update header length based on lower device */ - dev->hard_header_len = lowerdev->hard_header_len + + dev->needed_headroom = lowerdev->hard_header_len + (use_ipv6 ?VXLAN6_HEADROOM :VXLAN_HEADROOM ); }
Signature · 1 line
2.0.0
PATCH 111/111 ARM: at91: fix at91_sysirq_mask_rtc for sam9x5 SoCs
In reply to Jiri SlabyFrom: Boris BREZILLON <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 9dcc87fec8947308e0111c65dcd881e6aa5b1673 upstream.
sam9x5 SoCs have the following errata:
"RTC: Interrupt Mask Register cannot be used
Interrupt Mask Register read always returns 0."
Hence we should not rely on what IMR claims about already masked IRQs and just disable all IRQs.
--- arch/arm/mach-at91/sysirq_mask.c | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-)
arch/arm/mach-at91/sysirq_mask.c +13 -9
@@ -25,24 +25,28 @@#include "generic.h" -#define AT91_RTC_IDR 0x24/* Interrupt Disable Register */ -#define AT91_RTC_IMR 0x28/* Interrupt Mask Register */ +#define AT91_RTC_IDR 0x24/* Interrupt Disable Register */ +#define AT91_RTC_IMR 0x28/* Interrupt Mask Register */ +#define AT91_RTC_IRQ_MASK 0x1f/* Available IRQs mask */ void __init at91_sysirq_mask_rtc (u32 rtc_base) {void __iomem *base; -u32 mask; base =ioremap (rtc_base,64 );if (!base)return ; - mask =readl_relaxed (base +AT91_RTC_IMR ); -if (mask) { -pr_info ("AT91: Disabling rtc irq\n" ); -writel_relaxed (mask, base +AT91_RTC_IDR ); - (void )readl_relaxed (base +AT91_RTC_IMR );/* flush */ - } +/* +* sam9x5 SoCs have the following errata: +* "RTC: Interrupt Mask Register cannot be used +* Interrupt Mask Register read always returns 0." +* +* Hence we're not relying on IMR values to disable +* interrupts. +*/ +writel_relaxed (AT91_RTC_IRQ_MASK , base +AT91_RTC_IDR ); + (void )readl_relaxed (base +AT91_RTC_IMR );/* flush */ iounmap (base); }
Signature · 1 line
2.0.0
Quoted 8 lines · Jiri Slaby
This is the start of the stable review cycle for the 3.12.23 release. There are 111 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed Jun 25 08:31:21 2014 Anything received after that time might be too late.
Build results:
total: 144 pass: 136 skipped: 7 fail: 1
Failed builds:
unicore32:defconfig
Qemu tests all passed.
Results are as expected. Details are available at http://server.roeck-us.net:8010/builders.
Number of builds is up to 144. I added one more build, score:defconfig, which passes.
The unicore32 build now passes in mainline. To get it to pass in 3.12, you'd have to cherry-pick commit 1ff38c56cbd0 (arch/unicore32/mm/alignment.c:
include "asm/pgtable.h" to avoid compiling error) and backport commit fbc6c4a13bbfb (drivers/video/fbdev/fb-puv3.c: Add header files for function unifb_mmap). The video file was moved from drivers/video/fb-puv3.c after 3.12, which is why the patch doesn't apply directly.
Guenter
Quoted 17 lines · Guenter Roeck
Quoted 8 lines · Jiri Slaby
This is the start of the stable review cycle for the 3.12.23 release. There are 111 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed Jun 25 08:31:21 2014 Anything received after that time might be too late.
Build results:
total: 144 pass: 136 skipped: 7 fail: 1Failed builds:
unicore32:defconfig
Qemu tests all passed.Results are as expected. Details are available at
...
Quoted 9 lines
The unicore32 build now passes in mainline. To get it to pass in 3.12, you'd have to cherry-pick commit
1ff38c56cbd0(arch/unicore32/mm/alignment.c:
include "asm/pgtable.h" to avoid compiling error) and backport commitfbc6c4a13bbfb
(drivers/video/fbdev/fb-puv3.c: Add header files for functionunifb_mmap). The video file was moved fromdrivers/video/fb-puv3.cafter 3.12, which is why
the patch doesn't apply directly.
Done.
Quoted 1 line · Shuah Khan
Compiled and booted on my test system. No dmesg regressions.
Quoted 1 line · Satoru Takeuchi
This kernel passed my test.
Thank you all.
Signature · 2 lines
js suse labs
Quoted 8 lines · Jiri Slaby
This is the start of the stable review cycle for the 3.12.23 release. There are 111 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed Jun 25 08:31:21 2014 Anything received after that time might be too late.
Quoted 7 lines
The whole patch series can be found in one patch at:
http://kernel.org/pub/linux/kernel/people/jirislaby/stable-review/patch-3.12.23-rc1.xzand the diffstat can be found below.
thanks,
js
Compiled and booted on my test system. No dmesg regressions.
-- Shuah
Signature · 4 lines
Shuah Khan Senior Linux Kernel Developer - Open Source Group Samsung Research America(Silicon Valley) [email protected] | (970) 672-0658
Hi Jiri,
At Mon, 23 Jun 2014 10:32:06 +0200,
Quoted 8 lines · Jiri Slaby
This is the start of the stable review cycle for the 3.12.23 release. There are 111 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed Jun 25 08:31:21 2014 Anything received after that time might be too late.
This kernel passed my test.
- Test Cases:
- Build this kernel.
- Boot this kernel.
- Build the latest mainline kernel with this kernel.
- Test Tool:
https://github.com/satoru-takeuchi/test-linux-stable
- Test Result (kernel .config, ktest config and test log):
http://satoru-takeuchi.org/test-linux-stable/results/<version>-<test datetime>.tar.xz
- Build Environment:
- OS: Debian Jessy x86_64
- CPU: Intel(R) Core(TM) i5-2400 CPU @ 3.10GHz x 4
- memory: 8GB
- Test Target Environment:
- Debian Jessy x86_64 (KVM guest on the Build Environment)
- # of vCPU: 2
- memory: 2GB
Thanks,
Satoru
Quoted 424 lines
The whole patch series can be found in one patch at:
http://kernel.org/pub/linux/kernel/people/jirislaby/stable-review/patch-3.12.23-rc1.xzand the diffstat can be found below.
thanks,
js===============
Alan Stern (1):
USB: Avoid runtime suspend loops for HCDs that can't handle
suspend/resumeAlessandro Miceli (2):
rtl28xxu: add [1b80:d39d] Sveon STV20
rtl28xxu: add [1b80:d3af] Sveon STV27Alex Deucher (1):
drm/radeon: handle non-VGA class pci devices with ATRMAlexei Starovoitov (2):
net: filter: fix typo in sparc BPF JIT
net: filter: fix sparc32 typoAlexej Starschenko (1):
USB: serial: option: add support for Novatel E371 PCIe cardAndreas Schr�gle (1):
ahci: add PCI ID for Marvell 88SE91A0 SATA ControllerAndrey Ryabinin (2):
ARM: 8051/1:put_user: fix possible data corruption input_user
mm: rmap: fix use-after-free in__put_anon_vmaAndy Lutomirski (2):
fs,userns: Changeinode_capabletocapable_wrt_inode_uidgid
auditsc:audit_krulemask accesses need bounds checkingAntti Palosaari (1):
[media] rtl28xxu: add 15f4:0131 Astrometa DVB-T2Ben Dooks (1):
sh_eth: use RNC mode for packet receptionBen Hutchings (2):
Staging: speakup: Move pasting into a work item
Staging: speakup: Update__speakup_paste_selection()tty (ab)usage to
match vtBen Skeggs (1):
drm/gf119-/disp: fix nasty bug which can clobber SOR0's clock setupBibek Basu (1):
cpufreq: remove race while accessingcur_policyBj�rn Mork (2):
usb: cdc-wdm: export cdc-wdm uapi header
net:qmi_wwan: add Olivetti Olicard modemsBoris BREZILLON (2):
rtc: rtc-at91rm9200: fix infinite wait for ACKUPD irq
ARM: at91: fixat91_sysirq_mask_rtcfor sam9x5 SoCsBrian Healy (1):
rtl28xxu: add 1b80:d395 Peak DVB-T USBChris Wilson (1):
drm/i915: Only copy back the modified fields to userspace from
execbufferChristian K�nig (2):
drm/radeon: also try GART for CPU accessed buffers drm/radeon: avoid crash if VM command submission isn't availableCong Wang (1):
vxlan: usedev->needed_headroominstead ofdev->hard_header_lenDan Carpenter (1):
qlcnic: info leak inqlcnic_dcb_peer_app_info()Daniel Vetter (1):
drm/i915: restrict vt-d stolen memory workaround to pre-gen8David Woodhouse (1):
iommu/vt-d: Fix missing IOTLB flush inintel_iommu_unmap()Denis Turischev (1):
xhci: Switch only Intel Lynx Point-LP ports to EHCI on shutdown.Dmitry Kasatkin (1):
ima: introduceima_kernel_read()Dmitry Popov (1):
ipip, sit: fix ipv4_{update_pmtu,redirect} callsEmil Goode (1):
ARM: imx: fix error handling in ipu device registrationEric Dumazet (3):
net: fixinet_getid()andipv6_select_ident()bugs
net: force alist_del()inunregister_netdevice_many()
ipv4: fix a race inip4_datagram_release_cb()Eric W. Biederman (6):
netlink: Renamenetlink_capablenetlink_allowed
net: Move the permission check insock_diag_put_filterinfoto
packet_diag_dump
net: Add variants of capable for use on on sockets
net: Add variants of capable for use on netlink messages
net: Usenetlink_ns_capableto verify the permisions of netlink
messages
netlink: Only check file credentials for implicit destinationsGeorge McCollister (1):
USB:ftdi_sio: add NovaTech OrionLXm product IDGreg Kroah-Hartman (1):
USB: cdc-wdm: properly includetypes.hHeinz Mauelshagen (1):
dm cache: always split discards on cache block boundariesHelmut Schaa (1):
ath9k: Fix sequence number assignment for non-data framesIan Abbott (1):
staging: comedi:ni_daq_700: add mux settling delayIgor Gnatenko (1):
xhci: extend quirk for Renesas cardsJan Vcelak (2):
rtl28xxu: add USB ID for Genius TVGo DVB-T03
rtl28xxu: add chipset version comments into device listJean Delvare (2):
hwmon: (ntc_thermistor) Fix dependencies
hwmon: (ntc_thermistor) Fix OF device ID mappingJiri Kosina (1):
floppy: do not corrupt bio.bi_flags when reading block 0Jiri Olsa (1):
perf: Prevent false warning inperf_swevent_addJiri Pirko (1):
team: fix mtu settingJoe Lawrence (1):
SCSI:scsi_transport_sas: move bsg destructor intosas_rphy_removeJohan Hovold (1):
USB:io_ti: fix firmware download on big-endian machines (part 2)Johannes Berg (1):
Documentation: fix DOCBOOKS=... buildingJustin Maggard (1):
btrfs: fix defrag 32-bit integer overflowJ�r�me Carretero (1):
ahci: Add Device ID for HighPoint RocketRaid 642LLai Jiangshan (1):
sched: Fix hotplug vs.set_cpus_allowed_ptr()Larry Finger (1):
rtlwifi: rtl8192se: Fix regression due to commit 1bf4bbbLaurent Pinchart (1):
ARM: OMAP3: clock: Back-propagate rate change fromcam_mclkto
dpll4_m5on all OMAP3 platformsMarkos Chandras (1):
MIPS: asm:thread_info: Add_TIF_SECCOMPflagMartin K. Petersen (1):
libata: Blacklist queued trim for Crucial M500Mathias Nyman (2):
xhci: delete endpoints from bandwidth list before freeing whole device
usb: pci-quirks: Prevent Sony VAIO t-series from switching usb portsMichael S. Tsirkin (5):
skbuff:skb_segment: s/frag/nskb_frag/
skbuff:skb_segment: s/skb_frag/frag/
skbuff:skb_segment: s/skb/head_skb/
skbuff:skb_segment: s/fskb/list_skb/
skbuff:skb_segment: orphan frags before copyingMichael Welling (1):
gpio: mcp23s08: Bug fix of SPI device tree registration.Michal Schmidt (2):
netlink: rate-limit leftover bytes warning and print process name
rtnetlink: fix userspace API breakage for iproute2 < v3.9.0Mimi Zohar (2):
ima: audit log files opened withO_DIRECTflag
evm: prohibit userspace writing 'security.evm' HMAC valueNaoya Horiguchi (1):
mm/memory-failure.c: fix memory leak by race between poison and
unpoisonNeilBrown (2):
md: always setMD_RECOVERY_INTRwhen aborting a reshape or other"resync".md: always set
MD_RECOVERY_INTRwhen interrupting a reshape thread.Nicholas Bellinger (6):
target: Fix NULL pointer dereference for XCOPY intarget_put_sess_cmd
iser-target: Add missingtarget_put_sess_cmdfor ImmedateData failure
target: Fixalua_access_stateattribute OOPs for un-configured devices
iser-target: Fix multi network portal shutdown regression
target: AllowREAD_CAPACITYopcode in ALUA Standby access state
iscsi-target: Reject mutual authentication with reflectedCHAP_CPeter Ujfalusi (1):
ARM: omap5:hwmod_data: Correct IDLEMODE for McPDMPeter Zijlstra (2):
perf: Limitperf_event_attr::sample_periodto 63 bits
perf: Fix race in removing an eventRabin Vincent (1):
ARM: 8064/1: fix v7-M signal returnRobert Backhaus (1):
[media] Add USB IDs for Winfast DTV Dongle Mini-DRonan Marquet (1):
ALSA: hda/realtek - Correction of fixup codes for PB V7900 laptopSagi Grimberg (1):
Target/iscsi,iser: Avoid accepting transport connections during stop
stageSebastian Ott (1):
percpu-refcount: fix usage ofthis_cpu_opsSergei Shtylyov (1):
sh_eth: fix SH7619/771x supportSteven Rostedt (Red Hat) (1):
sched: UseCPUPRI_NR_PRIORITIESinstead ofMAX_RT_PRIOin cpupri checkTakashi Iwai (2):
ALSA: hda/analog - Fix silent output on ASUS A8JN
ALSA: hda/realtek - Fix COEF widget NID for ALC260 replacer fixupThomas Gleixner (1):
sched: Sanitize irq accounting madnessTill D�rges (1):
rtl28xxu: add ID [0ccd:00b4] TerraTec NOXON DAB Stick (rev 3)Tom Gundersen (1):
net: tunnels - enable module autoloadingTomas Winkler (1):
mei: me: drop harmful wait optimizationToshiaki Makita (1):
bridge: Prevent insertion of FDB entry with disallowed vlanVille Syrj�l� (1):
drm/i915: Allow user modes to exceed DVI 165MHz limitVlastimil Babka (3):
mm: compaction: reset cached scanner pfn's before reading them
mm: compaction: detect when scanners meet inisolate_freepagesmm/compaction: makeisolate_freepagesstart at pageblock boundaryWill Deacon (1):
ARM: perf: hook upperf_sample_event_tookaround pmu irq handlingXufeng Zhang (1):
sctp: Fixsk_ack_backlogwrap-around problemYuchung Cheng (1):
tcp: fix cwnd undo on DSACK in F-RTODocumentation/ABI/testing/ima_policy | 2 +- Documentation/DocBook/media/Makefile | 2 +- arch/arm/include/asm/uaccess.h | 3 +- arch/arm/kernel/entry-header.S | 4 + arch/arm/kernel/perf_event.c | 11 ++- arch/arm/mach-at91/sysirq_mask.c | 22 +++-- arch/arm/mach-imx/devices/platform-ipu-core.c | 2 +- arch/arm/mach-omap2/cclock3xxx_data.c | 3 +- arch/arm/mach-omap2/omap_hwmod_54xx_data.c | 2 +- arch/mips/include/asm/thread_info.h | 2 +- arch/sparc/net/bpf_jit_comp.c | 8 +- crypto/crypto_user.c | 2 +- drivers/ata/ahci.c | 4 + drivers/ata/libata-core.c | 8 +- drivers/block/floppy.c | 2 +- drivers/connector/cn_proc.c | 2 +- drivers/cpufreq/cpufreq_governor.c | 6 ++ drivers/gpio/gpio-mcp23s08.c | 11 ++- drivers/gpu/drm/i915/i915_gem_execbuffer.c | 54 +++++++----- drivers/gpu/drm/i915/i915_gem_stolen.c | 2 +- drivers/gpu/drm/i915/intel_hdmi.c | 9 +- drivers/gpu/drm/nouveau/core/engine/disp/nvd0.c | 2 +- drivers/gpu/drm/radeon/radeon_bios.c | 14 +++ drivers/gpu/drm/radeon/radeon_cs.c | 15 +++- drivers/gpu/drm/radeon/radeon_object.c | 38 +++++---- drivers/hwmon/Kconfig | 2 +- drivers/hwmon/ntc_thermistor.c | 15 ++-- drivers/infiniband/ulp/isert/ib_isert.c | 10 +++ drivers/iommu/intel-iommu.c | 18 +++- drivers/md/dm-cache-target.c | 2 + drivers/md/md.c | 5 +- drivers/media/dvb-core/dvb-usb-ids.h | 4 + drivers/media/usb/dvb-usb-v2/rtl28xxu.c | 18 ++++ drivers/misc/mei/hw-me.c | 4 +- drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c | 1 + drivers/net/ethernet/renesas/sh_eth.c | 31 +++++-- drivers/net/ethernet/renesas/sh_eth.h | 2 - drivers/net/macvlan.c | 1 - drivers/net/team/team.c | 7 +- drivers/net/usb/qmi_wwan.c | 7 +- drivers/net/vxlan.c | 7 +- drivers/net/wireless/ath/ath9k/xmit.c | 4 +- drivers/net/wireless/rtlwifi/rtl8192se/trx.c | 6 ++ drivers/rtc/rtc-at91rm9200.c | 16 +++- drivers/scsi/scsi_netlink.c | 2 +- drivers/scsi/scsi_transport_sas.c | 3 +- drivers/staging/comedi/drivers/ni_daq_700.c | 2 + drivers/staging/speakup/main.c | 1 + drivers/staging/speakup/selection.c | 52 +++++++++-- drivers/staging/speakup/speakup.h | 1 + drivers/target/iscsi/iscsi_target.c | 1 + drivers/target/iscsi/iscsi_target_auth.c | 10 +++ drivers/target/iscsi/iscsi_target_core.h | 1 + drivers/target/iscsi/iscsi_target_login.c | 1 + drivers/target/iscsi/iscsi_target_tpg.c | 2 + drivers/target/target_core_alua.c | 9 ++ drivers/target/target_core_configfs.c | 5 ++ drivers/target/target_core_transport.c | 4 + drivers/tty/tty_buffer.c | 2 + drivers/usb/core/driver.c | 9 +- drivers/usb/core/hub.c | 15 +++- drivers/usb/host/pci-quirks.c | 7 ++ drivers/usb/host/xhci-mem.c | 20 ++--- drivers/usb/host/xhci-pci.c | 8 +- drivers/usb/serial/ftdi_sio.c | 2 + drivers/usb/serial/ftdi_sio_ids.h | 5 ++ drivers/usb/serial/io_ti.c | 2 +- drivers/usb/serial/io_usbvend.h | 2 +- drivers/usb/serial/option.c | 2 + fs/attr.c | 8 +- fs/btrfs/ioctl.c | 6 +- fs/inode.c | 10 ++- fs/namei.c | 11 +-- fs/xfs/xfs_ioctl.c | 2 +- include/linux/capability.h | 2 +- include/linux/if_team.h | 1 + include/linux/netlink.h | 14 ++- include/linux/percpu-refcount.h | 6 +- include/linux/sock_diag.h | 2 +- include/net/inetpeer.h | 9 +- include/net/sock.h | 5 ++ include/uapi/linux/usb/Kbuild | 1 + include/uapi/linux/usb/cdc-wdm.h | 2 + kernel/audit.c | 4 +- kernel/auditsc.c | 27 ++++-- kernel/capability.c | 20 ++--- kernel/cpu.c | 6 +- kernel/events/core.c | 63 +++++++++----- kernel/sched/core.c | 1 - kernel/sched/cpupri.c | 3 +- kernel/sched/cputime.c | 32 +++---- lib/nlattr.c | 4 +- mm/compaction.c | 57 ++++++++----- mm/memory-failure.c | 2 + mm/rmap.c | 3 +- net/bridge/br_input.c | 4 +- net/bridge/br_private.h | 7 ++ net/bridge/br_vlan.c | 28 ++++++ net/can/gw.c | 4 +- net/core/dev.c | 5 +- net/core/rtnetlink.c | 43 +++++++--- net/core/skbuff.c | 109 +++++++++++++----------- net/core/sock.c | 49 +++++++++++ net/core/sock_diag.c | 4 +- net/dcb/dcbnl.c | 2 +- net/decnet/dn_dev.c | 4 +- net/decnet/dn_fib.c | 4 +- net/decnet/netfilter/dn_rtmsg.c | 2 +- net/ipv4/datagram.c | 20 +++-- net/ipv4/ipip.c | 5 +- net/ipv4/tcp_input.c | 11 ++- net/ipv6/ip6_tunnel.c | 1 + net/ipv6/output_core.c | 11 +-- net/ipv6/sit.c | 5 +- net/mac80211/iface.c | 1 - net/netfilter/nfnetlink.c | 2 +- net/netlink/af_netlink.c | 80 +++++++++++++++-- net/netlink/genetlink.c | 2 +- net/packet/diag.c | 7 +- net/phonet/pn_netlink.c | 8 +- net/sched/act_api.c | 2 +- net/sched/cls_api.c | 2 +- net/sched/sch_api.c | 6 +- net/sctp/associola.c | 2 +- net/tipc/netlink.c | 2 +- net/xfrm/xfrm_user.c | 2 +- security/integrity/evm/evm_main.c | 12 ++- security/integrity/ima/ima_api.c | 9 +- security/integrity/ima/ima_crypto.c | 32 ++++++- security/integrity/ima/ima_main.c | 5 +- security/integrity/ima/ima_policy.c | 6 +- security/integrity/integrity.h | 1 + sound/pci/hda/patch_analog.c | 1 + sound/pci/hda/patch_realtek.c | 10 +-- 134 files changed, 964 insertions(+), 405 deletions(-)Signature · 1 line
2.0.0