3.12.65-stable review
Subsystems (4)
cover 3.12.65-stable review
This is the start of the stable review cycle for the 3.12.65 release. There are 84 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed Oct 19 09:48:13 CEST 2016. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
http://kernel.org/pub/linux/kernel/people/jirislaby/stable-review/patch-3.12.65-rc1.xz
and the diffstat can be found below.
thanks,
js
===============
Al Viro (2):
fix fault_in_multipages_...() on architectures with no-op access_ok() fix memory leaks in tracing_buffers_splice_read()
Alex Deucher (1):
drm/radeon/si/dpm: add workaround for for Jet parts
Alex Vesker (2):
IB/ipoib: Don't allow MC joins during light MC flush IB/mlx4: Fix incorrect MC join state bit-masking on SR-IOV
Alexander Graf (2):
KVM: PPC: Book3S PR: Ignore PMU SPRs
KVM: PPC: Book3S PR: Emulate TIR register
Arnd Bergmann (6):
gcov: disable tree-loop-im to reduce stack usage
Kbuild: disable 'maybe-uninitialized' warning for
CONFIG_PROFILE_ALL_BRANCHES
gcov: disable -Wmaybe-uninitialized warning
net: caif: fix misleading indentation
iwlegacy: avoid warning about missing braces
gspca: avoid unused variable warnings
Ashish Samant (1):
ocfs2: fix start offset to ocfs2_zero_range_for_truncate()
Balbir Singh (1):
sched/core: Fix a race between try_to_wake_up() and a woken up task
Bart Van Assche (1):
IB/srpt: Simplify srpt_handle_tsk_mgmt()
Chuck Lever (2):
svc: Avoid garbage replies when pc_func() returns rpc_drop_reply
NFS: Don't drop CB requests with invalid principals
Colin Ian King (1):
Staging: iio: adc: fix indent on break statement
Dan Carpenter (8):
mtd: pmcmsp-flash: Allocating too much in init_msp_flash()
qxl: check for kmap failures
hostfs: Freeing an ERR_PTR in hostfs_fill_sb_common() tools/vm/slabinfo: fix an unintentional printf
usb: gadget: fsl_qe_udc: signedness bug in qe_get_frame()
em28xx-i2c: rt_mutex_trylock() returns zero on failure
avr32: off by one in at32_init_pio()
mfd: 88pm80x: Double shifting bug in suspend/resume
Erez Shitrit (2):
IB/ipoib: Fix memory corruption in ipoib cm mode connect flow IB/core: Fix use after free in send_leave function
Fabio Estevam (1):
can: flexcan: fix resume function
Florian Fainelli (2):
brcmsmac: Free packet if dma_mapping_error() fails in dma_rxfill
brcmsmac: Initialize power in brcms_c_stf_ss_algo_channel_get()
Greg Kroah-Hartman (2):
usb: misc: legousbtower: Fix NULL pointer deference Revert "usbtmc: convert to devm_kzalloc"
Herbert Xu (1):
crypto: skcipher - Fix blkcipher walk OOM crash
James Hogan (2):
tile: Define AT_VECTOR_SIZE_ARCH for ARCH_DLINFO
KVM: MIPS: Drop other CPU ASIDs on guest MMU changes
Jann Horn (1):
security: let security modules use PTRACE_MODE_* with bitmasks
Jeff Mahoney (3):
reiserfs: fix "new_insert_key may be used uninitialized ..."
btrfs: ensure that file descriptor used with subvol ioctls is a dir
xfs: fixed signedness of error code in xfs_inode_buf_verify
Joerg Roedel (1):
iommu/amd: Update Alias-DTE in update_device_table()
Joseph Qi (1):
ocfs2/dlm: fix race between convert and migration
Karl Beldan (1):
mtd: nand: davinci: Reinitialize the HW ECC engine in 4bit hwctl
Khem Raj (1):
powerpc/ptrace: Fix out of bounds array access warning
Kinglong Mee (1):
NFSD: Using free_conn free connection
Konstantin Shkolnyy (1):
USB: serial: cp210x: fix hardware flow-control disable
Kyle Jones (1):
USB: serial: cp210x: Add ID for a Juniper console
Linus Torvalds (2):
Disable "maybe-uninitialized" warning globally
Disable "frame-address" warning
Michael Ellerman (3):
powerpc/ps3: Remove unused os_area_db_id_video_mode
powerpc: Add macros for the ibm_architecture_vec[] lengths powerpc/prom: Fix sub-processor option passed to ibm,
client-architecture-support
Michael Walle (1):
hwmon: (adt7411) set bit 3 in CFG1 register
Michal Hocko (1):
kernel/fork: fix CLONE_CHILD_CLEARTID regression in nscd
Michal Marek (1):
kbuild: Do not run modules_install and install in paralel
Nicolas Iooss (1):
printk: fix parsing of "brl=" option
Nishanth Menon (1):
hwrng: omap - Fix assumption that runtime_get_sync will always succeed
Oliver Neukum (1):
kaweth: fix firmware download
Paul Burton (1):
MIPS: Malta: Fix IOCU disable switch read for MIPS64
Peter Ujfalusi (1):
ASoC: omap-mcpdm: Fix irq resource handling
Peter Zijlstra (1):
sched/core: Fix an SMP ordering race in try_to_wake_up() vs.
schedule()
Prarit Bhargava (1):
ACPICA: acpi_get_sleep_type_data: Reduce warnings
Radim Krčmář (1):
KVM: nVMX: postpone VMCS changes on MSR_IA32_APICBASE write
Robert Jarzmik (1):
kbuild: forbid kernel directory to contain spaces and colons
Robin Murphy (1):
ARM: 8616/1: dt: Respect property size when parsing CPUs
Russell King (2):
ARM: sa1100: clear reset status prior to reboot
ARM: sa1111: fix pcmcia suspend/resume
Sam Ravnborg (1):
CRIS: Fix headers_install
Sara Sharon (1):
iwlwifi: pcie: fix access to scratch buffer
Sergei Miroshnichenko (1):
can: dev: fix deadlock reported after bus-off
Srinivas Ramana (1):
ARM: 8618/1: decompressor: reset ttbcr fields to use TTBR0 on ARMv7
Steven Rostedt (1):
Makefile: Mute warning for __builtin_return_address(>0) for tracing
only
Steven Rostedt (Red Hat) (1):
tracing: Move mutex to protect against resetting of seq data
Takashi Iwai (1):
ALSA: ali5451: Fix out-of-bound position reporting
Takashi Sakamoto (1):
ALSA: usb-line6: use the same declaration as definition in header for
MIDI manufacturer ID
Thomas Huth (1):
KVM: PPC: Book3s PR: Allow access to unprivileged MMCR2 register
Uwe Kleine-König (1):
mfd: wm8350-i2c: Make sure the i2c regmap functions are compiled
Vitaly Kuznetsov (1):
clockevents: export clockevents_unbind_device instead of
clockevents_unbind
WANG Cong (1):
ppp: defer netns reference release for ppp channel
Wang YanQing (1):
Makefile: revert "Makefile: Document ability to make file.lst and
file.S" partially
Will Deacon (1):
arm64: debug: avoid resetting stepping state machine when
TIF_SINGLESTEP
Yadi.hu (1):
i2c-eg20t: fix race between i2c init and interrupt enable
zhong jiang (1):
mm,ksm: fix endless looping in allocating memory when ksm enable
Makefile | 22 ++++++++-- arch/arm/boot/compressed/head.S | 2 +- arch/arm/common/sa1111.c | 22 ++++++---- arch/arm/kernel/devtree.c | 14 +++++-- arch/arm/mach-sa1100/generic.c | 3 ++ arch/arm64/kernel/debug-monitors.c | 6 ++- arch/avr32/mach-at32ap/pio.c | 2 +- arch/cris/include/asm/Kbuild | 4 -- arch/cris/include/uapi/asm/Kbuild | 4 +- arch/mips/kvm/kvm_mips_emul.c | 57 ++++++++++++++++++++++++-- arch/mips/mti-malta/malta-setup.c | 8 +++- arch/powerpc/include/asm/reg.h | 1 + arch/powerpc/kernel/prom_init.c | 32 ++++++++++----- arch/powerpc/kernel/ptrace.c | 4 +- arch/powerpc/kvm/book3s_emulate.c | 17 ++++++++ arch/powerpc/platforms/ps3/os-area.c | 5 --- arch/tile/include/asm/elf.h | 1 + arch/tile/include/uapi/asm/auxvec.h | 2 + arch/x86/kvm/vmx.c | 13 ++++++ crypto/blkcipher.c | 3 +- drivers/acpi/acpica/hwxface.c | 24 +++++++---- drivers/char/hw_random/omap-rng.c | 16 +++++++- drivers/gpu/drm/qxl/qxl_draw.c | 2 + drivers/gpu/drm/radeon/si_dpm.c | 6 +++ drivers/hwmon/adt7411.c | 5 ++- drivers/i2c/busses/i2c-eg20t.c | 18 ++++---- drivers/infiniband/core/multicast.c | 13 +----- drivers/infiniband/hw/mlx4/mcg.c | 14 +++---- drivers/infiniband/ulp/ipoib/ipoib.h | 1 + drivers/infiniband/ulp/ipoib/ipoib_cm.c | 16 ++++++++ drivers/infiniband/ulp/ipoib/ipoib_ib.c | 9 ++++ drivers/infiniband/ulp/ipoib/ipoib_main.c | 2 +- drivers/infiniband/ulp/srpt/ib_srpt.c | 59 +-------------------------- drivers/iommu/amd_iommu.c | 10 ++++- drivers/media/usb/em28xx/em28xx-i2c.c | 5 +-- drivers/media/usb/gspca/cpia1.c | 2 +- drivers/media/usb/gspca/konica.c | 2 +- drivers/media/usb/gspca/t613.c | 2 +- drivers/mfd/Kconfig | 1 + drivers/mtd/maps/pmcmsp-flash.c | 6 +-- drivers/mtd/nand/davinci_nand.c | 3 ++ drivers/net/can/dev.c | 27 +++++++----- drivers/net/can/flexcan.c | 13 +++--- drivers/net/ppp/ppp_generic.c | 5 ++- drivers/net/usb/kaweth.c | 3 +- drivers/net/wireless/brcm80211/brcmsmac/dma.c | 4 +- drivers/net/wireless/brcm80211/brcmsmac/stf.c | 2 +- drivers/net/wireless/iwlegacy/3945.c | 3 +- drivers/net/wireless/iwlwifi/pcie/tx.c | 4 +- drivers/staging/iio/adc/ad7192.c | 2 +- drivers/staging/line6/driver.c | 2 +- drivers/usb/class/usbtmc.c | 3 +- drivers/usb/gadget/fsl_qe_udc.c | 7 +--- drivers/usb/misc/legousbtower.c | 35 ++++++++-------- drivers/usb/serial/cp210x.c | 3 +- fs/btrfs/ioctl.c | 12 ++++++ fs/hostfs/hostfs_kern.c | 7 ++-- fs/nfs/callback_xdr.c | 6 ++- fs/nfsd/nfs4state.c | 3 +- fs/ocfs2/dlm/dlmconvert.c | 12 +++--- fs/ocfs2/file.c | 34 ++++++++++----- fs/reiserfs/ibalance.c | 3 +- fs/xfs/xfs_inode_buf.c | 2 +- include/linux/can/dev.h | 3 +- include/linux/mfd/88pm80x.h | 4 +- include/linux/pagemap.h | 38 ++++++++--------- kernel/fork.c | 10 ++--- kernel/printk/braille.c | 4 +- kernel/sched/core.c | 41 +++++++++++++++++++ kernel/time/clockevents.c | 2 +- kernel/trace/Makefile | 4 ++ kernel/trace/trace.c | 32 ++++++++------- mm/ksm.c | 3 +- net/caif/cfpkt_skbuff.c | 2 +- net/sunrpc/svc.c | 8 +++- scripts/headers.sh | 2 - security/yama/yama_lsm.c | 4 +- sound/pci/ali5451/ali5451.c | 2 + sound/soc/omap/omap-mcpdm.c | 5 ++- tools/vm/slabinfo.c | 3 +- 80 files changed, 515 insertions(+), 282 deletions(-)
Signature · 1 line
2.10.1
PATCH 1/84 gcov: disable tree-loop-im to reduce stack usage
From: Arnd Bergmann <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit c87bf431448b404a6ef5fbabd74c0e3e42157a7f upstream.
Enabling CONFIG_GCOV_PROFILE_ALL produces us a lot of warnings like
lib/lz4/lz4hc_compress.c: In function 'lz4_compresshcctx':lib/lz4/lz4hc_compress.c:514:1: warning: the frame size of 1504 bytes is larger than 1024 bytes [-Wframe-larger-than=]
After some investigation, I found that this behavior started with gcc-4.9, and opened https://gcc.gnu.org/bugzilla/show_bug.cgi?id=69702.
A suggested workaround for it is to use the -fno-tree-loop-im flag that turns off one of the optimization stages in gcc, so the code runs a little slower but does not use excessive amounts of stack.
We could make this conditional on the gcc version, but I could not find an easy way to do this in Kbuild and the benefit would be fairly small, given that most of the gcc version in production are affected now.
I'm marking this for 'stable' backports because it addresses a bug with code generation in gcc that exists in all kernel versions with the affected gcc releases.
--- Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Makefile +1 -1
@@ -347,7 +347,7 @@ AFLAGS_MODULE = LDFLAGS_MODULE = CFLAGS_KERNEL = AFLAGS_KERNEL = -CFLAGS_GCOV = -fprofile-arcs -ftest-coverage +CFLAGS_GCOV = -fprofile-arcs -ftest-coverage -fno-tree-loop-im # Use USERINCLUDE when you must reference the UAPI directories only.
Signature · 1 line
2.10.1
PATCH 2/84 reiserfs: fix "new_insert_key may be used uninitialized ..."
From: Jeff Mahoney <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 0a11b9aae49adf1f952427ef1a1d9e793dd6ffb6 upstream.
new_insert_key only makes any sense when it's associated with a new_insert_ptr, which is initialized to NULL and changed to a buffer_head when we also initialize new_insert_key. We can key off of that to avoid the uninitialized warning.
--- fs/reiserfs/ibalance.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/reiserfs/ibalance.c +2 -1
@@ -1082,8 +1082,9 @@ int balance_internal(struct tree_balance *tb, /* tree_balance structure insert_ptr); } -memcpy (new_insert_key_addr, &new_insert_key,KEY_SIZE ); insert_ptr[0 ] = new_insert_ptr; +if (new_insert_ptr) +memcpy (new_insert_key_addr, &new_insert_key,KEY_SIZE );return order; }
Signature · 1 line
2.10.1
PATCH 3/84 crypto: skcipher - Fix blkcipher walk OOM crash
In reply to Jiri SlabyFrom: Herbert Xu <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit acdb04d0b36769b3e05990c488dc74d8b7ac8060 upstream.
When we need to allocate a temporary blkcipher_walk_next and it fails, the code is supposed to take the slow path of processing the data block by block. However, due to an unrelated change we instead end up dereferencing the NULL pointer.
This patch fixes it by moving the unrelated bsize setting out of the way so that we enter the slow path as inteded.
--- crypto/blkcipher.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
crypto/blkcipher.c +2 -1
@@ -238,6 +238,8 @@ static int blkcipher_walk_next(struct blkcipher_desc *desc,return blkcipher_walk_done (desc, walk, -EINVAL ); } + bsize =min (walk->blocksize, n); + walk->flags &= ~(BLKCIPHER_WALK_SLOW |BLKCIPHER_WALK_COPY |BLKCIPHER_WALK_DIFF ); if (!scatterwalk_aligned(&walk->in, alignmask) ||
@@ -250,7 +252,6 @@ static int blkcipher_walk_next(struct blkcipher_desc *desc, } } - bsize =min (walk->blocksize, n); n =scatterwalk_clamp (&walk->in, n); n =scatterwalk_clamp (&walk->out, n);
Signature · 1 line
2.10.1
PATCH 4/84 ocfs2/dlm: fix race between convert and migration
In reply to Jiri SlabyFrom: Joseph Qi <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit e6f0c6e6170fec175fe676495f29029aecdf486c upstream.
Commit ac7cf246dfdb ("ocfs2/dlm: fix race between convert and recovery") checks if lockres master has changed to identify whether new master has finished recovery or not. This will introduce a race that right after old master does umount ( means master will change), a new convert request comes.
In this case, it will reset lockres state to DLM_RECOVERING and then retry convert, and then fail with lockres->l_action being set to OCFS2_AST_INVALID, which will cause inconsistent lock level between ocfs2 and dlm, and then finally BUG.
Since dlm recovery will clear lock->convert_pending in dlm_move_lockres_to_recovery_list, we can use it to correctly identify the race case between convert and recovery. So fix it.
--- fs/ocfs2/dlm/dlmconvert.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
fs/ocfs2/dlm/dlmconvert.c +6 -6
@@ -262,7 +262,6 @@ enum dlm_status dlmconvert_remote(struct dlm_ctxt *dlm, struct dlm_lock *lock, int flags, int type) { enum dlm_status status; -u8 old_owner = res->owner;mlog (0 ,"type=%d, convert_type=%d, busy=%d\n" , lock->ml.type, lock->ml.convert_type, res->state &DLM_LOCK_RES_IN_PROGRESS );
@@ -329,7 +328,6 @@ enum dlm_status dlmconvert_remote(struct dlm_ctxt *dlm,spin_lock (&res->spinlock); res->state &= ~DLM_LOCK_RES_IN_PROGRESS ; - lock->convert_pending =0 ;/* if it failed, move it back to granted queue. * if master returns DLM_NORMAL and then down before sending ast, * it may have already been moved to granted queue, reset to
@@ -338,12 +336,14 @@ enum dlm_status dlmconvert_remote(struct dlm_ctxt *dlm,if (status !=DLM_NOTQUEUED )dlm_error (status);dlm_revert_pending_convert (res, lock); - }else if ((res->state &DLM_LOCK_RES_RECOVERING ) || - (old_owner != res->owner)) { -mlog (0 ,"res %.*s is in recovering or has been recovered.\n" , - res->lockname.len, res->lockname.name); + }else if (!lock->convert_pending) { +mlog (0 ,"%s: res %.*s, owner died and lock has been moved back " +"to granted list, retry convert.\n" , + dlm->name, res->lockname.len, res->lockname.name); status =DLM_RECOVERING ; } + + lock->convert_pending =0 ; bail:spin_unlock (&res->spinlock);
Signature · 1 line
2.10.1
PATCH 5/84 ocfs2: fix start offset to ocfs2_zero_range_for_truncate()
In reply to Jiri SlabyFrom: Ashish Samant <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit d21c353d5e99c56cdd5b5c1183ffbcaf23b8b960 upstream.
If we punch a hole on a reflink such that following conditions are met:
1. start offset is on a cluster boundary
2. end offset is not on a cluster boundary
3. (end offset is somewhere in another extent) or
(hole range > MAX_CONTIG_BYTES(1MB)),
we dont COW the first cluster starting at the start offset. But in this case, we were wrongly passing this cluster to ocfs2_zero_range_for_truncate() to zero out. This will modify the cluster in place and zero it in the source too.
Fix this by skipping this cluster in such a scenario.
To reproduce:
1. Create a random file of say 10 MB
xfs_io -c 'pwrite -b 4k 0 10M' -f 10MBfile
2. Reflink it
reflink -f 10MBfile reflnktest
3. Punch a hole at starting at cluster boundary with range greater that 1MB. You can also use a range that will put the end offset in another extent.
fallocate -p -o 0 -l 1048615 reflnktest
4. sync
5. Check the first cluster in the source file. (It will be zeroed out). dd if=10MBfile iflag=direct bs=<cluster size> count=1 | hexdump -C
--- fs/ocfs2/file.c | 34 ++++++++++++++++++++++++---------- 1 file changed, 24 insertions(+), 10 deletions(-)
fs/ocfs2/file.c +24 -10
@@ -1495,7 +1495,8 @@ static int ocfs2_zero_partial_clusters(struct inode *inode, u64 start, u64 len) { int ret = 0; -u64 tmpend, end = start + len; +u64 tmpend =0 ; +u64 end = start + len;struct ocfs2_super *osb =OCFS2_SB (inode->i_sb);unsigned int csize = osb->s_clustersize;handle_t *handle;
@@ -1527,18 +1528,31 @@ static int ocfs2_zero_partial_clusters(struct inode *inode, }/* -* We want to get the byte offset of the end of the 1st cluster. +* If start is on a cluster boundary and end is somewhere in another +* cluster, we have not COWed the cluster starting at start, unless +* end is also within the same cluster. So, in this case, we skip this +* first call to ocfs2_zero_range_for_truncate() truncate and move on +* to the next one. */ - tmpend = (u64 )osb->s_clustersize + (start & ~(osb->s_clustersize -1 )); -if (tmpend > end) - tmpend = end; +if ((start & (csize -1 )) !=0 ) { +/* +* We want to get the byte offset of the end of the 1st +* cluster. +*/ + tmpend = (u64 )osb->s_clustersize + + (start & ~(osb->s_clustersize -1 )); +if (tmpend > end) + tmpend = end; -trace_ocfs2_zero_partial_clusters_range1 ((unsigned long long )start, - (unsigned long long )tmpend); +trace_ocfs2_zero_partial_clusters_range1 ( + (unsigned long long )start, + (unsigned long long )tmpend); - ret =ocfs2_zero_range_for_truncate (inode, handle, start, tmpend); -if (ret) -mlog_errno (ret); + ret =ocfs2_zero_range_for_truncate (inode, handle, start, + tmpend); +if (ret) +mlog_errno (ret); + }if (tmpend < end) {/*
Signature · 1 line
2.10.1
PATCH 6/84 kbuild: Do not run modules_install and install in paralel
In reply to Jiri SlabyFrom: Michal Marek <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit a85a41ed69f27c4c667d8c418df14b4fb220c4ad upstream.
Based on a x86-only patch by Andy Lutomirski <[email protected]>
With modular kernels, 'make install' is going to need the installed modules at some point to generate the initramfs.
--- Makefile | 6 ++++++ 1 file changed, 6 insertions(+)
Makefile +6 -0
@@ -476,6 +476,12 @@ ifeq ($(KBUILD_EXTMOD),) endif endif endif +# install and module_install need also be processed one by one +ifneq ($(filter install,$(MAKECMDGOALS)),) + ifneq ($(filter modules_install,$(MAKECMDGOALS)),) + mixed-targets := 1 + endif +endif ifeq ($(mixed-targets),1) # ===========================================================================
Signature · 1 line
2.10.1
PATCH 7/84 Makefile: revert "Makefile: Document ability to make file.lst and file.S" partially
In reply to Jiri SlabyFrom: Wang YanQing <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 40ab87a4003c7952976ce901a2b9ece5ed833168 upstream.
Commit 627189797807 ("Makefile: Document ability to make file.lst and file.S") document ability to make file.S, but there isn't such ability in kbuild, so revert it.
--- Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Makefile +1 -1
@@ -1119,7 +1119,7 @@ help: @echo ' firmware_install- Install all firmware to INSTALL_FW_PATH' @echo ' (default: $$(INSTALL_MOD_PATH)/lib/firmware)' @echo ' dir/ - Build all files in dir and below' - @echo ' dir/file.[oisS] - Build specified target only' + @echo ' dir/file.[ois] - Build specified target only' @echo ' dir/file.lst - Build specified mixed source/assembly target only' @echo ' (requires a recent binutils and recent build (System.map))' @echo ' dir/file.ko - Build module including final link'
Signature · 1 line
2.10.1
PATCH 8/84 kbuild: forbid kernel directory to contain spaces and colons
In reply to Jiri SlabyFrom: Robert Jarzmik <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 51193b76bfff5027cf96ba63effae808ad67cca7 upstream.
When the kernel path contains a space or a colon somewhere in the path name, the modules_install target doesn't work anymore, as the path names are not enclosed in double quotes. It is also supposed that and O= build will suffer from the same weakness as modules_install.
Instead of checking and improving kbuild to resist to directories including these characters, error out early to prevent any build if the kernel's main directory contains a space.
--- Makefile | 4 ++++ 1 file changed, 4 insertions(+)
Makefile +4 -0
@@ -113,6 +113,10 @@ _all: # Cancel implicit rules on top Makefile $(CURDIR)/Makefile Makefile: ; +ifneq ($(words $(subst :, ,$(CURDIR))), 1) + $(error main directory cannot contain spaces nor colons) +endif + ifneq ($(KBUILD_OUTPUT),) # Invoke a second make in the output directory, passing relevant variables # check that the output directory actually exists
Signature · 1 line
2.10.1
PATCH 9/84 Kbuild: disable 'maybe-uninitialized' warning for CONFIG_PROFILE_ALL_BRANCHES
In reply to Jiri SlabyFrom: Arnd Bergmann <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 815eb71e7149ecce40db9dd0ad09c4dd9d33c60f upstream.
CONFIG_PROFILE_ALL_BRANCHES confuses gcc-5.x to the degree that it prints incorrect warnings about a lot of variables that it thinks can be used uninitialized, e.g.:
i2c/busses/i2c-diolan-u2c.c: In function 'diolan_usb_xfer':i2c/busses/i2c-diolan-u2c.c:391:16: warning: 'byte' may be used uninitialized in this function iio/gyro/itg3200_core.c: In function 'itg3200_probe':iio/gyro/itg3200_core.c:213:6: warning: 'val' may be used uninitialized in this function leds/leds-lp55xx-common.c: In function 'lp55xx_update_bits':leds/leds-lp55xx-common.c:350:6: warning: 'tmp' may be used uninitialized in this function misc/bmp085.c: In function 'show_pressure':misc/bmp085.c:363:10: warning: 'pressure' may be used uninitialized in this function power/ds2782_battery.c: In function 'ds2786_get_capacity':power/ds2782_battery.c:214:17: warning: 'raw' may be used uninitialized in this function
These are all false positives that either rob someone's time when trying to figure out whether they are real, or they get people to send wrong patches to shut up the warnings.
Nobody normally wants to run a CONFIG_PROFILE_ALL_BRANCHES kernel in production, so disabling the whole class of warnings for this configuration has no serious downsides either.
--- Makefile | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
Makefile +5 -1
@@ -585,7 +585,11 @@ all: vmlinux ifdef CONFIG_CC_OPTIMIZE_FOR_SIZE KBUILD_CFLAGS += -Os $(call cc-disable-warning,maybe-uninitialized,) else -KBUILD_CFLAGS += -O2 +ifdef CONFIG_PROFILE_ALL_BRANCHES +KBUILD_CFLAGS += -O2 $(call cc-disable-warning,maybe-uninitialized,) +else +KBUILD_CFLAGS += -O2 +endif endif include $(srctree)/arch/$(SRCARCH)/Makefile
Signature · 1 line
2.10.1
PATCH 10/84 gcov: disable -Wmaybe-uninitialized warning
In reply to Jiri SlabyFrom: Arnd Bergmann <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit e72e2dfe7c16ffbfbabf9cb24adc6d9f93a4fe37 upstream.
When gcov profiling is enabled, we see a lot of spurious warnings about possibly uninitialized variables being used:
arch/arm/mm/dma-mapping.c: In function 'arm_coherent_iommu_map_page':arch/arm/mm/dma-mapping.c:1085:16: warning: 'start' may be used uninitialized in this function [-Wmaybe-uninitialized] drivers/clk/st/clk-flexgen.c: In function 'st_of_flexgen_setup':drivers/clk/st/clk-flexgen.c:323:9: warning: 'num_parents' may be used uninitialized in this function [-Wmaybe-uninitialized] kernel/cgroup.c: In function 'cgroup_mount':kernel/cgroup.c:2119:11: warning: 'root' may be used uninitialized in this function [-Wmaybe-uninitialized]
All of these are false positives, so it seems better to just disable the warnings whenever GCOV is enabled. Most users don't enable GCOV, and based on a prior patch, it is now also disabled for 'allmodconfig' builds, so there should be no downsides of doing this.
--- Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Makefile +1 -1
@@ -351,7 +351,7 @@ AFLAGS_MODULE = LDFLAGS_MODULE = CFLAGS_KERNEL = AFLAGS_KERNEL = -CFLAGS_GCOV = -fprofile-arcs -ftest-coverage -fno-tree-loop-im +CFLAGS_GCOV = -fprofile-arcs -ftest-coverage -fno-tree-loop-im -Wno-maybe-uninitialized # Use USERINCLUDE when you must reference the UAPI directories only.
Signature · 1 line
2.10.1
PATCH 11/84 Disable "maybe-uninitialized" warning globally
In reply to Jiri SlabyFrom: Linus Torvalds <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 6e8d666e925333c55378e8d5540a8a9ee0eea9c5 upstream.
Several build configurations had already disabled this warning because it generates a lot of false positives. But some had not, and it was still enabled for "allmodconfig" builds, for example.
Looking at the warnings produced, every single one I looked at was a false positive, and the warnings are frequent enough (and big enough) that they can easily hide real problems that you don't notice in the noise generated by -Wmaybe-uninitialized.
The warning is good in theory, but this is a classic case of a warning that causes more problems than the warning can solve.
If gcc gets better at avoiding false positives, we may be able to re-enable this warning. But as is, we're better off without it, and I want to be able to see the *real* warnings.
--- Makefile | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
Makefile +5 -3
@@ -351,7 +351,7 @@ AFLAGS_MODULE = LDFLAGS_MODULE = CFLAGS_KERNEL = AFLAGS_KERNEL = -CFLAGS_GCOV = -fprofile-arcs -ftest-coverage -fno-tree-loop-im -Wno-maybe-uninitialized +CFLAGS_GCOV = -fprofile-arcs -ftest-coverage -fno-tree-loop-im # Use USERINCLUDE when you must reference the UAPI directories only.
@@ -582,11 +582,13 @@ endif # $(dot-config) # Defaults to vmlinux, but the arch makefile usually adds further targets all: vmlinux +KBUILD_CFLAGS += $(call cc-disable-warning,maybe-uninitialized,) + ifdef CONFIG_CC_OPTIMIZE_FOR_SIZE -KBUILD_CFLAGS += -Os $(call cc-disable-warning,maybe-uninitialized,) +KBUILD_CFLAGS += -Os else ifdef CONFIG_PROFILE_ALL_BRANCHES -KBUILD_CFLAGS += -O2 $(call cc-disable-warning,maybe-uninitialized,) +KBUILD_CFLAGS += -O2 else KBUILD_CFLAGS += -O2 endif
Signature · 1 line
2.10.1
PATCH 12/84 Disable "frame-address" warning
In reply to Jiri SlabyFrom: Linus Torvalds <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 124a3d88fa20e1869fc229d7d8c740cc81944264 upstream.
Newer versions of gcc warn about the use of __builtin_return_address() with a non-zero argument when "-Wall" is specified:
kernel/trace/trace_irqsoff.c: In function ‘stop_critical_timings’:
kernel/trace/trace_irqsoff.c:433:86: warning: calling ‘__builtin_return_address’ with a nonzero argument is unsafe [-Wframe-address]
stop_critical_timing(CALLER_ADDR0, CALLER_ADDR1);
[ .. repeats a few times for other similar cases .. ]
It is true that a non-zero argument is somewhat dangerous, and we do not actually have very many uses of that in the kernel - but the ftrace code does use it, and as Stephen Rostedt says:
"We are well aware of the danger of using __builtin_return_address() of
Quoted 1 line
0. In fact that's part of the reason for having the "thunk" code in
x86 (See arch/x86/entry/thunk_{64,32}.S). [..] it adds extra frames when tracking irqs off sections, to prevent __builtin_return_address() from accessing bad areas. In fact the thunk_32.S states: 'Trampoline to trace irqs off. (otherwise CALLER_ADDR1 might crash)'."
For now, __builtin_return_address() with a non-zero argument is the best we can do, and the warning is not helpful and can end up making people miss other warnings for real problems.
So disable the frame-address warning on compilers that need it.
--- Makefile | 1 + 1 file changed, 1 insertion(+)
Makefile +1 -0
@@ -583,6 +583,7 @@ endif # $(dot-config) all: vmlinux KBUILD_CFLAGS += $(call cc-disable-warning,maybe-uninitialized,) +KBUILD_CFLAGS += $(call cc-disable-warning,frame-address,) ifdef CONFIG_CC_OPTIMIZE_FOR_SIZE KBUILD_CFLAGS += -Os
Signature · 1 line
2.10.1
PATCH 13/84 Makefile: Mute warning for __builtin_return_address(>0) for tracing only
In reply to Jiri SlabyFrom: Steven Rostedt <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 377ccbb483738f84400ddf5840c7dd8825716985 upstream.
With the latest gcc compilers, they give a warning if __builtin_return_address() parameter is greater than 0. That is because if it is used by a function called by a top level function (or in the case of the kernel, by assembly), it can try to access stack frames outside the stack and crash the system.
The tracing system uses __builtin_return_address() of up to 2! But it is well aware of the dangers that it may have, and has even added precautions to protect against it (see the thunk code in arch/x86/entry/thunk*.S)
Linus originally added KBUILD_CFLAGS that would suppress the warning for the entire kernel, as simply adding KBUILD_CFLAGS to the tracing directory wouldn't work. The tracing directory plays a bit with the CFLAGS and requires a little more logic.
This adds that special logic to only suppress the warning for the tracing directory. If it is used anywhere else outside of tracing, the warning will still be triggered.
--- Makefile | 1 - kernel/trace/Makefile | 4 ++++ 2 files changed, 4 insertions(+), 1 deletion(-)
Makefile +0 -1
@@ -583,7 +583,6 @@ endif # $(dot-config) all: vmlinux KBUILD_CFLAGS += $(call cc-disable-warning,maybe-uninitialized,) -KBUILD_CFLAGS += $(call cc-disable-warning,frame-address,) ifdef CONFIG_CC_OPTIMIZE_FOR_SIZE KBUILD_CFLAGS += -Os
kernel/trace/Makefile +4 -0
@@ -1,4 +1,8 @@ +# We are fully aware of the dangers of __builtin_return_address() +FRAME_CFLAGS := $(call cc-disable-warning,frame-address) +KBUILD_CFLAGS += $(FRAME_CFLAGS) + # Do not instrument the tracer itself: ifdef CONFIG_FUNCTION_TRACER
Signature · 1 line
2.10.1
PATCH 14/84 net: caif: fix misleading indentation
In reply to Jiri SlabyFrom: Arnd Bergmann <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 8e0cc8c326d99e41468c96fea9785ab78883a281 upstream.
gcc points out code that is not indented the way it is interpreted:
net/caif/cfpkt_skbuff.c: In function 'cfpkt_setlen':net/caif/cfpkt_skbuff.c:289:4: error: statement is indented as if it were guarded by... [-Werror=misleading-indentation]
return cfpkt_getlen(pkt);
^~~~~~net/caif/cfpkt_skbuff.c:286:3: note: ...this 'else' clause, but it is not
else
^~~~
It is clear from the context that not returning here would be a bug, as we'd end up passing a negative length into a function that takes a u16 length, so it is not missing curly braces here, and I'm assuming that the indentation is the only part that's wrong about it.
--- net/caif/cfpkt_skbuff.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/caif/cfpkt_skbuff.c +1 -1
@@ -296,7 +296,7 @@ int cfpkt_setlen(struct cfpkt *pkt, u16 len)else skb_trim (skb, len); -return cfpkt_getlen (pkt); +return cfpkt_getlen (pkt); }/* Need to expand SKB */
Signature · 1 line
2.10.1
PATCH 15/84 iwlegacy: avoid warning about missing braces
In reply to Jiri SlabyFrom: Arnd Bergmann <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 2cce76c3fab410520610a7d2f52faebc3cfcf843 upstream.
gcc-6 warns about code in il3945_hw_txq_ctx_free() being somewhat ambiguous:
drivers/net/wireless/intel/iwlegacy/3945.c:1022:5: warning: suggest explicit braces to avoid ambiguous 'else' [-Wparentheses]
This adds a set of curly braces to avoid the warning.
--- drivers/net/wireless/iwlegacy/3945.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/wireless/iwlegacy/3945.c +2 -1
@@ -1020,12 +1020,13 @@ il3945_hw_txq_ctx_free(struct il_priv *il)int txq_id;/* Tx queues */ -if (il->txq) +if (il->txq) {for (txq_id =0 ; txq_id < il->hw_params.max_txq_num; txq_id++)if (txq_id ==IL39_CMD_QUEUE_NUM )il_cmd_queue_free (il);else il_tx_queue_free (il, txq_id); + }/* free tx queue structure */ il_free_txq_mem (il);
Signature · 1 line
2.10.1
PATCH 16/84 Staging: iio: adc: fix indent on break statement
In reply to Jiri SlabyFrom: Colin Ian King <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit b6acb0cfc21293a1bfc283e9217f58f7474ef728 upstream.
Fix indent warning when building with gcc 6:drivers/staging/iio/adc/ad7192.c:239:4: warning: statement is indented
as if it were guarded by... [-Wmisleading-indentation]
--- drivers/staging/iio/adc/ad7192.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/iio/adc/ad7192.c +1 -1
@@ -236,7 +236,7 @@ static int ad7192_setup(struct ad7192_state *st, st->mclk = pdata->ext_clk_Hz; else st->mclk = AD7192_INT_FREQ_MHz; -break ; +break ;default : ret = -EINVAL ; goto out;
Signature · 1 line
2.10.1
PATCH 17/84 fix fault_in_multipages_...() on architectures with no-op access_ok()
In reply to Jiri SlabyFrom: Al Viro <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit e23d4159b109167126e5bcd7f3775c95de7fee47 upstream.
Switching iov_iter fault-in to multipages variants has exposed an old bug in underlying fault_in_multipages_...(); they break if the range passed to them wraps around. Normally access_ok() done by callers will prevent such (and it's a guaranteed EFAULT - ERR_PTR() values fall into such a range and they should not point to any valid objects).
However, on architectures where userland and kernel live in different MMU contexts (e.g. s390) access_ok() is a no-op and on those a range with a wraparound can reach fault_in_multipages_...().
Since any wraparound means EFAULT there, the fix is trivial - turn those
while (uaddr <= end)
...
into
if (unlikely(uaddr > end))
return -EFAULT;
do
...
while (uaddr <= end);--- include/linux/pagemap.h | 38 +++++++++++++++++++------------------- 1 file changed, 19 insertions(+), 19 deletions(-)
include/linux/pagemap.h +19 -19
@@ -574,56 +574,56 @@ static inline int fault_in_pages_readable(const char __user *uaddr, int size)*/ static inline int fault_in_multipages_writeable (char __user *uaddr,int size) { -int ret =0 ;char __user *end = uaddr + size -1 ;if (unlikely (size ==0 )) -return ret; +return 0 ; +if (unlikely (uaddr > end)) +return -EFAULT ;/* * Writing zeroes into userspace here is OK, because we know that if * the zero gets there, we'll be overwriting it. */ -while (uaddr <= end) { - ret =__put_user (0 , uaddr); -if (ret !=0 ) -return ret; +do { +if (unlikely (__put_user (0 , uaddr) !=0 )) +return -EFAULT ; uaddr +=PAGE_SIZE ; - } + }while (uaddr <= end);/* Check whether the range spilled into the next page. */ if (((unsigned long )uaddr &PAGE_MASK ) == ((unsigned long )end &PAGE_MASK )) - ret =__put_user (0 , end); +return __put_user (0 , end); -return ret; +return 0 ; }static inline int fault_in_multipages_readable (const char __user *uaddr,int size) {volatile char c; -int ret =0 ;const char __user *end = uaddr + size -1 ;if (unlikely (size ==0 )) -return ret; +return 0 ; -while (uaddr <= end) { - ret =__get_user (c, uaddr); -if (ret !=0 ) -return ret; +if (unlikely (uaddr > end)) +return -EFAULT ; + +do { +if (unlikely (__get_user (c, uaddr) !=0 )) +return -EFAULT ; uaddr +=PAGE_SIZE ; - } + }while (uaddr <= end);/* Check whether the range spilled into the next page. */ if (((unsigned long )uaddr &PAGE_MASK ) == ((unsigned long )end &PAGE_MASK )) { - ret =__get_user (c, end); - (void )c; +return __get_user (c, end); } -return ret; +return 0 ; } int add_to_page_cache_locked(struct page *page, struct address_space *mapping,
Signature · 1 line
2.10.1
PATCH 18/84 mtd: pmcmsp-flash: Allocating too much in init_msp_flash()
In reply to Jiri SlabyFrom: Dan Carpenter <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 79ad07d45743721010e766e65dc004ad249bd429 upstream.
There is a cut and paste issue here. The bug is that we are allocating more memory than necessary for msp_maps. We should be allocating enough space for a map_info struct (144 bytes) but we instead allocate enough for an mtd_info struct (1840 bytes). It's a small waste.
The other part of this is not harmful but when we allocated msp_flash then we allocated enough space fro a map_info pointer instead of an mtd_info pointer. But since pointers are the same size it works out fine.
Anyway, I decided to clean up all three allocations a bit to make them a bit more consistent and clear.
--- drivers/mtd/maps/pmcmsp-flash.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/mtd/maps/pmcmsp-flash.c +3 -3
@@ -75,15 +75,15 @@ static int __init init_msp_flash(void)printk (KERN_NOTICE "Found %d PMC flash devices\n" , fcnt); - msp_flash =kmalloc (fcnt *sizeof (struct map_info *),GFP_KERNEL ); + msp_flash =kcalloc (fcnt,sizeof (*msp_flash),GFP_KERNEL );if (!msp_flash)return -ENOMEM ; - msp_parts =kmalloc (fcnt *sizeof (struct mtd_partition *),GFP_KERNEL ); + msp_parts =kcalloc (fcnt,sizeof (*msp_parts),GFP_KERNEL );if (!msp_parts) goto free_msp_flash; - msp_maps =kcalloc (fcnt,sizeof (struct mtd_info ),GFP_KERNEL ); + msp_maps =kcalloc (fcnt,sizeof (*msp_maps),GFP_KERNEL );if (!msp_maps) goto free_msp_parts;
Signature · 1 line
2.10.1
PATCH 19/84 fix memory leaks in tracing_buffers_splice_read()
In reply to Jiri SlabyFrom: Al Viro <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 1ae2293dd6d2f5c823cf97e60b70d03631cd622f upstream.
--- kernel/trace/trace.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-)
kernel/trace/trace.c +9 -8
@@ -5179,11 +5179,6 @@ tracing_buffers_splice_read(struct file *file, loff_t *ppos, }#endif -if (splice_grow_spd (pipe, &spd)) { - ret = -ENOMEM ; - goto out; - } -if (*ppos & (PAGE_SIZE -1 )) { ret = -EINVAL ; goto out;
@@ -5197,6 +5192,11 @@ tracing_buffers_splice_read(struct file *file, loff_t *ppos, len &=PAGE_MASK ; } +if (splice_grow_spd (pipe, &spd)) { + ret = -ENOMEM ; + goto out; + } + again:trace_access_lock (iter->cpu_file); entries =ring_buffer_entries_cpu (iter->trace_buffer->buffer, iter->cpu_file);
@@ -5252,21 +5252,22 @@ tracing_buffers_splice_read(struct file *file, loff_t *ppos,if (!spd.nr_pages) {if ((file->f_flags &O_NONBLOCK ) || (flags &SPLICE_F_NONBLOCK )) { ret = -EAGAIN ; - goto out; + goto out_shrink; }mutex_unlock (&trace_types_lock); ret = iter->trace->wait_pipe (iter);mutex_lock (&trace_types_lock);if (ret) - goto out; + goto out_shrink;if (signal_pending (current)) { ret = -EINTR ; - goto out; + goto out_shrink; } goto again; } ret =splice_to_pipe (pipe, &spd); +out_shrink:splice_shrink_spd (&spd); out:mutex_unlock (&trace_types_lock);
Signature · 1 line
2.10.1
PATCH 20/84 tracing: Move mutex to protect against resetting of seq data
In reply to Jiri SlabyFrom: "Steven Rostedt (Red Hat)" <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 1245800c0f96eb6ebb368593e251d66c01e61022 upstream.
The iter->seq can be reset outside the protection of the mutex. So can reading of user data. Move the mutex up to the beginning of the function.
--- kernel/trace/trace.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-)
kernel/trace/trace.c +8 -7
@@ -4132,13 +4132,6 @@ tracing_read_pipe(struct file *filp, char __user *ubuf,struct trace_array *tr = iter->tr;ssize_t sret; -/* return any leftover data */ - sret =trace_seq_to_user (&iter->seq, ubuf, cnt); -if (sret != -EBUSY ) -return sret; - -trace_seq_init (&iter->seq); -/* copy the tracer to avoid using a global lock all around */ mutex_lock (&trace_types_lock);if (unlikely (iter->trace->name != tr->current_trace->name))
@@ -4151,6 +4144,14 @@ tracing_read_pipe(struct file *filp, char __user *ubuf,* is protected. */ mutex_lock (&iter->mutex); + +/* return any leftover data */ + sret =trace_seq_to_user (&iter->seq, ubuf, cnt); +if (sret != -EBUSY ) + goto out; + +trace_seq_init (&iter->seq); +if (iter->trace->read) { sret = iter->trace->read (iter, filp, ubuf, cnt, ppos);if (sret)
Signature · 1 line
2.10.1
PATCH 21/84 can: flexcan: fix resume function
In reply to Jiri SlabyFrom: Fabio Estevam <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 4de349e786a3a2d51bd02d56f3de151bbc3c3df9 upstream.
On a imx6ul-pico board the following error is seen during system suspend:
dpm_run_callback(): platform_pm_resume+0x0/0x54 returns -110
PM: Device 2090000.flexcan failed to resume: error -110
The reason for this suspend error is because when the CAN interface is not active the clocks are disabled and then flexcan_chip_enable() will always fail due to a timeout error.
In order to fix this issue, only call flexcan_chip_enable/disable() when the CAN interface is active.
Based on a patch from Dong Aisheng in the NXP kernel.
--- drivers/net/can/flexcan.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
drivers/net/can/flexcan.c +8 -5
@@ -1164,11 +1164,10 @@ static int flexcan_suspend(struct device *device)struct flexcan_priv *priv =netdev_priv (dev);int err; - err =flexcan_chip_disable (priv); -if (err) -return err; -if (netif_running (dev)) { + err =flexcan_chip_disable (priv); +if (err) +return err;netif_stop_queue (dev);netif_device_detach (dev); }
@@ -1181,13 +1180,17 @@ static int flexcan_resume(struct device *device) {struct net_device *dev =dev_get_drvdata (device);struct flexcan_priv *priv =netdev_priv (dev); +int err; priv->can.state =CAN_STATE_ERROR_ACTIVE ;if (netif_running (dev)) {netif_device_attach (dev);netif_start_queue (dev); + err =flexcan_chip_enable (priv); +if (err) +return err; } -return flexcan_chip_enable (priv); +return 0 ; }#endif /* CONFIG_PM_SLEEP */
Signature · 1 line
2.10.1
PATCH 22/84 btrfs: ensure that file descriptor used with subvol ioctls is a dir
In reply to Jiri SlabyFrom: Jeff Mahoney <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 325c50e3cebb9208009083e841550f98a863bfa0 upstream.
If the subvol/snapshot create/destroy ioctls are passed a regular file with execute permissions set, we'll eventually Oops while trying to do inode->i_op->lookup via lookup_one_len.
This patch ensures that the file descriptor refers to a directory.
--- fs/btrfs/ioctl.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
fs/btrfs/ioctl.c +12 -0
@@ -1516,6 +1516,9 @@ static noinline int btrfs_ioctl_snap_create_transid(struct file *file,int namelen;int ret =0 ; +if (!S_ISDIR (file_inode (file)->i_mode)) +return -ENOTDIR ; + ret =mnt_want_write_file (file);if (ret) goto out;
@@ -1573,6 +1576,9 @@ static noinline int btrfs_ioctl_snap_create(struct file *file,struct btrfs_ioctl_vol_args *vol_args;int ret; +if (!S_ISDIR (file_inode (file)->i_mode)) +return -ENOTDIR ; + vol_args =memdup_user (arg,sizeof (*vol_args));if (IS_ERR (vol_args))return PTR_ERR (vol_args);
@@ -1596,6 +1602,9 @@ static noinline int btrfs_ioctl_snap_create_v2(struct file *file,bool readonly = false;struct btrfs_qgroup_inherit *inherit =NULL ; +if (!S_ISDIR (file_inode (file)->i_mode)) +return -ENOTDIR ; + vol_args =memdup_user (arg,sizeof (*vol_args));if (IS_ERR (vol_args))return PTR_ERR (vol_args);
@@ -2118,6 +2127,9 @@ static noinline int btrfs_ioctl_snap_destroy(struct file *file,int ret;int err =0 ; +if (!S_ISDIR (dir->i_mode)) +return -ENOTDIR ; + vol_args =memdup_user (arg,sizeof (*vol_args));if (IS_ERR (vol_args))return PTR_ERR (vol_args);
Signature · 1 line
2.10.1
PATCH 23/84 i2c-eg20t: fix race between i2c init and interrupt enable
In reply to Jiri SlabyFrom: "Yadi.hu" <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 371a015344b6e270e7e3632107d9554ec6d27a6b upstream.
the eg20t driver call request_irq() function before the pch_base_address, base address of i2c controller's register, is assigned an effective value.
there is one possible scenario that an interrupt which isn't inside eg20t arrives immediately after request_irq() is executed when i2c controller shares an interrupt number with others. since the interrupt handler pch_i2c_handler() has already active as shared action, it will be called and read its own register to determine if this interrupt is from itself.
At that moment, since base address of i2c registers is not remapped in kernel space yet,so the INT handler will access an illegal address and then a error occurs.
--- drivers/i2c/busses/i2c-eg20t.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-)
drivers/i2c/busses/i2c-eg20t.c +11 -7
@@ -798,13 +798,6 @@ static int pch_i2c_probe(struct pci_dev *pdev,/* Set the number of I2C channel instance */ adap_info->ch_num = id->driver_data; - ret =request_irq (pdev->irq, pch_i2c_handler,IRQF_SHARED , -KBUILD_MODNAME , adap_info); -if (ret) { -pch_pci_err (pdev,"request_irq FAILED\n" ); - goto err_request_irq; - } -for (i =0 ; i < adap_info->ch_num; i++) { pch_adap = &adap_info->pch_data[i].pch_adapter; adap_info->pch_i2c_suspended = false;
@@ -821,6 +814,17 @@ static int pch_i2c_probe(struct pci_dev *pdev, adap_info->pch_data[i].pch_base_address = base_addr +0x100 * i; pch_adap->dev.parent = &pdev->dev; + } + + ret =request_irq (pdev->irq, pch_i2c_handler,IRQF_SHARED , +KBUILD_MODNAME , adap_info); +if (ret) { +pch_pci_err (pdev,"request_irq FAILED\n" ); + goto err_request_irq; + } + +for (i =0 ; i < adap_info->ch_num; i++) { + pch_adap = &adap_info->pch_data[i].pch_adapter;pch_i2c_init (&adap_info->pch_data[i]);
Signature · 1 line
2.10.1
PATCH 24/84 qxl: check for kmap failures
In reply to Jiri SlabyFrom: Dan Carpenter <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit f4cceb2affcd1285d4ce498089e8a79f4cd2fa66 upstream.
If kmap fails, it leads to memory corruption.
--- drivers/gpu/drm/qxl/qxl_draw.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/qxl/qxl_draw.c +2 -0
@@ -136,6 +136,8 @@ static int qxl_palette_create_1bit(struct qxl_bo *palette_bo,* correctly globaly, since that would require * tracking all of our palettes. */ ret =qxl_bo_kmap (palette_bo, (void **)&pal); +if (ret) +return ret; pal->num_ents =2 ; pal->unique = unique++;if (visual ==FB_VISUAL_TRUECOLOR || visual ==FB_VISUAL_DIRECTCOLOR ) {
Signature · 1 line
2.10.1
PATCH 25/84 hostfs: Freeing an ERR_PTR in hostfs_fill_sb_common()
In reply to Jiri SlabyFrom: Dan Carpenter <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 8a545f185145e3c09348cd74326268ecfc6715a3 upstream.
We can't pass error pointers to kfree() or it causes an oops.
--- fs/hostfs/hostfs_kern.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
fs/hostfs/hostfs_kern.c +4 -3
@@ -948,10 +948,11 @@ static int hostfs_fill_sb_common(struct super_block *sb, void *d, int silent)if (S_ISLNK (root_inode->i_mode)) {char *name =follow_link (host_root_path); -if (IS_ERR (name)) +if (IS_ERR (name)) { err =PTR_ERR (name); -else - err =read_name (root_inode, name); + goto out_put; + } + err =read_name (root_inode, name);kfree (name);if (err) goto out_put;
Signature · 1 line
2.10.1
PATCH 26/84 sched/core: Fix a race between try_to_wake_up() and a woken up task
In reply to Jiri SlabyFrom: Balbir Singh <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 135e8c9250dd5c8c9aae5984fde6f230d0cbfeaf upstream.
The origin of the issue I've seen is related to
a missing memory barrier between check for task->state and the check for task->on_rq.
The task being woken up is already awake from a schedule() and is doing the following:
do {
schedule()
set_current_state(TASK_(UN)INTERRUPTIBLE);
} while (!cond);The waker, actually gets stuck doing the following in try_to_wake_up():
while (p->on_cpu) cpu_relax();
Analysis:
The instance I've seen involves the following race:
CPU1 CPU2
while () {
if (cond)
break;
do {
schedule();
set_current_state(TASK_UN..) } while (!cond);
wakeup_routine()
spin_lock_irqsave(wait_lock)
raw_spin_lock_irqsave(wait_lock) wake_up_process()
} try_to_wake_up()
set_current_state(TASK_RUNNING); ..
list_del(&waiter.list);
CPU2 wakes up CPU1, but before it can get the wait_lock and set current state to TASK_RUNNING the following occurs:
CPU3
wakeup_routine()
raw_spin_lock_irqsave(wait_lock)
if (!list_empty)
wake_up_process()
try_to_wake_up()
raw_spin_lock_irqsave(p->pi_lock)
..
if (p->on_rq && ttwu_wakeup())
..
while (p->on_cpu)
cpu_relax()
..
CPU3 tries to wake up the task on CPU1 again since it finds it on the wait_queue, CPU1 is spinning on wait_lock, but immediately after CPU2, CPU3 got it.
CPU3 checks the state of p on CPU1, it is TASK_UNINTERRUPTIBLE and the task is spinning on the wait_lock. Interestingly since p->on_rq is checked under pi_lock, I've noticed that try_to_wake_up() finds p->on_rq to be 0. This was the most confusing bit of the analysis, but p->on_rq is changed under runqueue lock, rq_lock, the p->on_rq check is not reliable without this fix IMHO. The race is visible (based on the analysis) only when ttwu_queue() does a remote wakeup via ttwu_queue_remote. In which case the p->on_rq change is not done uder the pi_lock.
The result is that after a while the entire system locks up on the raw_spin_irqlock_save(wait_lock) and the holder spins infintely
Reproduction of the issue:
The issue can be reproduced after a long run on my system with 80 threads and having to tweak available memory to very low and running memory stress-ng mmapfork test. It usually takes a long time to reproduce. I am trying to work on a test case that can reproduce the issue faster, but thats work in progress. I am still testing the changes on my still in a loop and the tests seem OK thus far.
Big thanks to Benjamin and Nick for helping debug this as well. Ben helped catch the missing barrier, Nick caught every missing bit in my theory.
[ Updated comment to clarify matching barriers. Many
architectures do not have a full barrier in switch_to() so that cannot be relied upon. ]
--- kernel/sched/core.c | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+)
kernel/sched/core.c +22 -0
@@ -1503,6 +1503,28 @@ try_to_wake_up(struct task_struct *p, unsigned int state, int wake_flags) success =1 ;/* we're going to change ->state */ cpu =task_cpu (p); +/* +* Ensure we load p->on_rq _after_ p->state, otherwise it would +* be possible to, falsely, observe p->on_rq == 0 and get stuck +* in smp_cond_load_acquire() below. +* +* sched_ttwu_pending() try_to_wake_up() +* [S] p->on_rq = 1; [L] P->state +* UNLOCK rq->lock -----. +* \ +* +--- RMB +* schedule() / +* LOCK rq->lock -----' +* UNLOCK rq->lock +* +* [task p] +* [S] p->state = UNINTERRUPTIBLE [L] p->on_rq +* +* Pairs with the UNLOCK+LOCK on rq->lock from the +* last wakeup of our task and the schedule that got our task +* current. +*/ +smp_rmb ();if (p->on_rq &&ttwu_remote (p, wake_flags)) goto stat;
Signature · 1 line
2.10.1
PATCH 27/84 CRIS: Fix headers_install
In reply to Jiri SlabyFrom: Sam Ravnborg <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 6eb64b8c64f7177b160b4bdbabd317d523bf4bfc upstream.
Fix headers_install by adjusting the path to arch files. And delete unused Kbuild file.
Drop special handling of cris in the headers.sh script as a nice side-effect.
--- arch/cris/include/asm/Kbuild | 4 ---- arch/cris/include/uapi/asm/Kbuild | 4 ++-- scripts/headers.sh | 2 -- 3 files changed, 2 insertions(+), 8 deletions(-)
arch/cris/include/asm/Kbuild +0 -4
@@ -1,8 +1,4 @@ -header-y += arch-v10/ -header-y += arch-v32/ - - generic-y += clkdev.h generic-y += exec.h generic-y += kvm_para.h
arch/cris/include/uapi/asm/Kbuild +2 -2
@@ -1,8 +1,8 @@ # UAPI Header export list include include/uapi/asm-generic/Kbuild.asm -header-y += arch-v10/ -header-y += arch-v32/ +header-y += ../arch-v10/arch/ +header-y += ../arch-v32/arch/ header-y += auxvec.h header-y += bitsperlong.h header-y += byteorder.h
scripts/headers.sh +0 -2
@@ -19,8 +19,6 @@ for arch in ${archs}; do case ${arch} in um) # no userspace export ;; - cris) # headers export are known broken - ;; *) if [ -d ${srctree}/arch/${arch} ]; then do_command $1 ${arch}
Signature · 1 line
2.10.1
PATCH 28/84 powerpc/ps3: Remove unused os_area_db_id_video_mode
In reply to Jiri SlabyFrom: Michael Ellerman <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 4fa9a3f6b616fd9f2555d9d0c04513a942750986 upstream.
This struct is unused, which is now a build error with gcc 6:
error: 'os_area_db_id_video_mode' defined but not used
There doesn't seem to be any good reason to keep it around so remove it, it's in the history if anyone needs it.
--- arch/powerpc/platforms/ps3/os-area.c | 5 ----- 1 file changed, 5 deletions(-)
arch/powerpc/platforms/ps3/os-area.c +0 -5
@@ -194,11 +194,6 @@ static const struct os_area_db_id os_area_db_id_rtc_diff = { .key = OS_AREA_DB_KEY_RTC_DIFF }; -static const struct os_area_db_id os_area_db_id_video_mode = { - .owner =OS_AREA_DB_OWNER_LINUX , - .key =OS_AREA_DB_KEY_VIDEO_MODE -}; -#define SECONDS_FROM_1970_TO_2000 946684800LL/**
Signature · 1 line
2.10.1
PATCH 29/84 powerpc/ptrace: Fix out of bounds array access warning
In reply to Jiri SlabyFrom: Khem Raj <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 1e407ee3b21f981140491d5b8a36422979ca246f upstream.
gcc-6 correctly warns about a out of bounds access
arch/powerpc/kernel/ptrace.c:407:24: warning: index 32 denotes an offset greater than size of 'u64[32][1] {aka long long unsigned int[32][1]}' [-Warray-bounds]
offsetof(struct thread_fp_state, fpr[32][0]));
^check the end of array instead of beginning of next element to fix this
--- arch/powerpc/kernel/ptrace.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/powerpc/kernel/ptrace.c +2 -2
@@ -376,7 +376,7 @@ static int fpr_get(struct task_struct *target, const struct user_regset *regset,#else BUILD_BUG_ON (offsetof(struct thread_struct , fpscr) != - offsetof(struct thread_struct, TS_FPR(32))); + offsetof(struct thread_struct, fpr[32]));return user_regset_copyout (&pos, &count, &kbuf, &ubuf, &target->thread.fpr,0 ,-1 );
@@ -404,7 +404,7 @@ static int fpr_set(struct task_struct *target, const struct user_regset *regset,return 0 ;#else BUILD_BUG_ON (offsetof(struct thread_struct , fpscr) != - offsetof(struct thread_struct, TS_FPR(32))); + offsetof(struct thread_struct, fpr[32]));return user_regset_copyin (&pos, &count, &kbuf, &ubuf, &target->thread.fpr,0 ,-1 );
Signature · 1 line
2.10.1
PATCH 30/84 ppp: defer netns reference release for ppp channel
In reply to Jiri SlabyFrom: WANG Cong <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
=======
commit 205e1e255c479f3fd77446415706463b282f94e4 upstream.
Matt reported that we have a NULL pointer dereference in ppp_pernet() from ppp_connect_channel(), i.e. pch->chan_net is NULL.
This is due to that a parallel ppp_unregister_channel() could happen while we are in ppp_connect_channel(), during which pch->chan_net set to NULL. Since we need a reference to net per channel, it makes sense to sync the refcnt with the life time of the channel, therefore we should release this reference when we destroy it.
--- drivers/net/ppp/ppp_generic.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/net/ppp/ppp_generic.c +3 -2
@@ -2317,8 +2317,6 @@ ppp_unregister_channel(struct ppp_channel *chan)spin_lock_bh (&pn->all_channels_lock);list_del (&pch->list);spin_unlock_bh (&pn->all_channels_lock); -put_net (pch->chan_net); - pch->chan_net =NULL ; pch->file.dead =1 ;wake_up_interruptible (&pch->file.rwait);
@@ -2925,6 +2923,9 @@ ppp_disconnect_channel(struct channel *pch)*/ static void ppp_destroy_channel (struct channel *pch) { +put_net (pch->chan_net); + pch->chan_net =NULL ; +atomic_dec (&channel_count);if (!pch->file.dead) {
Signature · 1 line
2.10.1
PATCH 31/84 iommu/amd: Update Alias-DTE in update_device_table()
In reply to Jiri SlabyFrom: Joerg Roedel <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 3254de6bf74fe94c197c9f819fe62a3a3c36f073 upstream.
Not doing so might cause IO-Page-Faults when a device uses an alias request-id and the alias-dte is left in a lower page-mode which does not cover the address allocated from the iova-allocator.
--- drivers/iommu/amd_iommu.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
drivers/iommu/amd_iommu.c +9 -1
@@ -2592,8 +2592,16 @@ static void update_device_table(struct protection_domain *domain) {struct iommu_dev_data *dev_data; -list_for_each_entry (dev_data, &domain->dev_list, list) +list_for_each_entry (dev_data, &domain->dev_list, list) {set_dte_entry (dev_data->devid, domain, dev_data->ats.enabled); + +if (dev_data->alias_data ==NULL ) +continue ; + +/* There is an alias, update device table entry for it */ +set_dte_entry (dev_data->alias_data->devid, domain, + dev_data->alias_data->ats.enabled); + } }static void update_domain (struct protection_domain *domain)
Signature · 1 line
2.10.1
PATCH 32/84 clockevents: export clockevents_unbind_device instead of clockevents_unbind
In reply to Jiri SlabyFrom: Vitaly Kuznetsov <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 32a158325acf12842764b1681f53903673f2f22e upstream.
It looks like clockevents_unbind is being exported by mistake as:
- it is static;
- it is not listed in include/linux/clockchips.h;
- EXPORT_SYMBOL_GPL(clockevents_unbind) follows clockevents_unbind_device() implementation.
I think clockevents_unbind_device should be exported instead. This is going to be used to teardown Hyper-V clockevent devices on module unload.
--- kernel/time/clockevents.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/time/clockevents.c +1 -1
@@ -371,7 +371,7 @@ int clockevents_unbind_device(struct clock_event_device *ced, int cpu)mutex_unlock (&clockevents_mutex);return ret; } -EXPORT_SYMBOL_GPL (clockevents_unbind); +EXPORT_SYMBOL_GPL (clockevents_unbind_device);/** * clockevents_register_device - register a clock event device
Signature · 1 line
2.10.1
PATCH 33/84 kernel/fork: fix CLONE_CHILD_CLEARTID regression in nscd
In reply to Jiri SlabyFrom: Michal Hocko <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 735f2770a770156100f534646158cb58cb8b2939 upstream.
Commit fec1d0115240 ("[PATCH] Disable CLONE_CHILD_CLEARTID for abnormal exit") has caused a subtle regression in nscd which uses CLONE_CHILD_CLEARTID to clear the nscd_certainly_running flag in the shared databases, so that the clients are notified when nscd is restarted. Now, when nscd uses a non-persistent database, clients that have it mapped keep thinking the database is being updated by nscd, when in fact nscd has created a new (anonymous) one (for non-persistent databases it uses an unlinked file as backend).
The original proposal for the CLONE_CHILD_CLEARTID change claimed
(https://lkml.org/lkml/2006/10/25/233):
: The NPTL library uses the CLONE_CHILD_CLEARTID flag on clone() syscalls : on behalf of pthread_create() library calls. This feature is used to : request that the kernel clear the thread-id in user space (at an address : provided in the syscall) when the thread disassociates itself from the : address space, which is done in mm_release().
:
: Unfortunately, when a multi-threaded process incurs a core dump (such as : from a SIGSEGV), the core-dumping thread sends SIGKILL signals to all of : the other threads, which then proceed to clear their user-space tids : before synchronizing in exit_mm() with the start of core dumping. This : misrepresents the state of process's address space at the time of the : SIGSEGV and makes it more difficult for someone to debug NPTL and glibc : problems (misleading him/her to conclude that the threads had gone away : before the fault).
:
: The fix below is to simply avoid the CLONE_CHILD_CLEARTID action if a : core dump has been initiated.
The resulting patch from Roland (https://lkml.org/lkml/2006/10/26/269)
seems to have a larger scope than the original patch asked for. It seems that limitting the scope of the check to core dumping should work for SIGSEGV issue describe above.
--- kernel/fork.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
kernel/fork.c +4 -6
@@ -770,14 +770,12 @@ void mm_release(struct task_struct *tsk, struct mm_struct *mm)deactivate_mm (tsk, mm);/* -* If we're exiting normally, clear a user-space tid field if -* requested. We leave this alone when dying by signal, to leave -* the value intact in a core dump, and to save the unnecessary -* trouble, say, a killed vfork parent shouldn't touch this mm. -* Userland only wants this done for a sys_exit. +* Signal userspace if we're not exiting with a core dump +* because we want to leave the value intact for debugging +* purposes. */ if (tsk->clear_child_tid) { -if (!(tsk->flags &PF_SIGNALED ) && +if (!(tsk->signal->flags &SIGNAL_GROUP_COREDUMP ) &&atomic_read (&mm->mm_users) >1 ) {/* * We don't check the error code - if userspace has
Signature · 1 line
2.10.1
PATCH 34/84 NFSD: Using free_conn free connection
In reply to Jiri SlabyFrom: Kinglong Mee <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 3f42d2c428c724212c5f4249daea97e254eb0546 upstream.
Connection from alloc_conn must be freed through free_conn, otherwise, the reference of svc_xprt will never be put.
--- fs/nfsd/nfs4state.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/nfsd/nfs4state.c +2 -1
@@ -2270,7 +2270,8 @@ out:if (!list_empty (&clp->cl_revoked)) seq->status_flags |=SEQ4_STATUS_RECALLABLE_STATE_REVOKED ; out_no_session: -kfree (conn); +if (conn) +free_conn (conn);spin_unlock (&nn->client_lock);return status; out_put_session:
Signature · 1 line
2.10.1
PATCH 35/84 kaweth: fix firmware download
In reply to Jiri SlabyFrom: Oliver Neukum <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 60bcabd080f53561efa9288be45c128feda1a8bb upstream.
This fixes the oops discovered by the Umap2 project and Alan Stern. The intf member needs to be set before the firmware is downloaded.
--- drivers/net/usb/kaweth.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/net/usb/kaweth.c +1 -2
@@ -1031,6 +1031,7 @@ static int kaweth_probe( kaweth =netdev_priv (netdev); kaweth->dev = udev; kaweth->net = netdev; + kaweth->intf = intf;spin_lock_init (&kaweth->device_lock);init_waitqueue_head (&kaweth->term_wait);
@@ -1141,8 +1142,6 @@ err_fw:dev_dbg (dev,"Initializing net device.\n" ); - kaweth->intf = intf; - kaweth->tx_urb =usb_alloc_urb (0 ,GFP_KERNEL );if (!kaweth->tx_urb) goto err_free_netdev;
Signature · 1 line
2.10.1
PATCH 36/84 IB/srpt: Simplify srpt_handle_tsk_mgmt()
In reply to Jiri SlabyFrom: Bart Van Assche <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 51093254bf879bc9ce96590400a87897c7498463 upstream.
Let the target core check task existence instead of the SRP target driver. Additionally, let the target core check the validity of the task management request instead of the ib_srpt driver.
This patch fixes the following kernel crash:
BUG: unable to handle kernel NULL pointer dereference at 0000000000000001 IP: [<ffffffffa0565f37>] srpt_handle_new_iu+0x6d7/0x790 [ib_srpt] Oops: 0002 [#1] SMP Call Trace: [<ffffffffa05660ce>] srpt_process_completion+0xde/0x570 [ib_srpt] [<ffffffffa056669f>] srpt_compl_thread+0x13f/0x160 [ib_srpt] [<ffffffff8109726f>] kthread+0xcf/0xe0 [<ffffffff81613cfc>] ret_from_fork+0x7c/0xb0
--- drivers/infiniband/ulp/srpt/ib_srpt.c | 59 +---------------------------------- 1 file changed, 1 insertion(+), 58 deletions(-)
drivers/infiniband/ulp/srpt/ib_srpt.c +1 -58
@@ -1754,47 +1754,6 @@ send_sense:return -1 ; } -/** -* srpt_rx_mgmt_fn_tag() - Process a task management function by tag. -* @ch: RDMA channel of the task management request. -* @fn: Task management function to perform. -* @req_tag: Tag of the SRP task management request. -* @mgmt_ioctx: I/O context of the task management request. -* -* Returns zero if the target core will process the task management -* request asynchronously. -* -* Note: It is assumed that the initiator serializes tag-based task management -* requests. -*/ -static int srpt_rx_mgmt_fn_tag (struct srpt_send_ioctx *ioctx,u64 tag) -{ -struct srpt_device *sdev; -struct srpt_rdma_ch *ch; -struct srpt_send_ioctx *target; -int ret, i; - - ret = -EINVAL ; - ch = ioctx->ch; -BUG_ON (!ch); -BUG_ON (!ch->sport); - sdev = ch->sport->sdev; -BUG_ON (!sdev); -spin_lock_irq (&sdev->spinlock); -for (i =0 ; i < ch->rq_size; ++i) { - target = ch->ioctx_ring[i]; -if (target->cmd.se_lun == ioctx->cmd.se_lun && - target->tag == tag && -srpt_get_cmd_state (target) !=SRPT_STATE_DONE ) { - ret =0 ; -/* now let the target core abort &target->cmd; */ -break ; - } - } -spin_unlock_irq (&sdev->spinlock); -return ret; -} -static int srp_tmr_to_tcm (int fn) {switch (fn) {
@@ -1829,7 +1788,6 @@ static void srpt_handle_tsk_mgmt(struct srpt_rdma_ch *ch,struct se_cmd *cmd;struct se_session *sess = ch->sess;uint64_t unpacked_lun; -uint32_t tag =0 ;int tcm_tmr;int rc;
@@ -1845,25 +1803,10 @@ static void srpt_handle_tsk_mgmt(struct srpt_rdma_ch *ch,srpt_set_cmd_state (send_ioctx,SRPT_STATE_MGMT ); send_ioctx->tag = srp_tsk->tag; tcm_tmr =srp_tmr_to_tcm (srp_tsk->tsk_mgmt_func); -if (tcm_tmr <0 ) { - send_ioctx->cmd.se_tmr_req->response = -TMR_TASK_MGMT_FUNCTION_NOT_SUPPORTED ; - goto fail; - } unpacked_lun =srpt_unpack_lun ((uint8_t *)&srp_tsk->lun,sizeof (srp_tsk->lun)); - -if (srp_tsk->tsk_mgmt_func ==SRP_TSK_ABORT_TASK ) { - rc =srpt_rx_mgmt_fn_tag (send_ioctx, srp_tsk->task_tag); -if (rc <0 ) { - send_ioctx->cmd.se_tmr_req->response = -TMR_TASK_DOES_NOT_EXIST ; - goto fail; - } - tag = srp_tsk->task_tag; - } rc =target_submit_tmr (&send_ioctx->cmd, sess,NULL , unpacked_lun, - srp_tsk, tcm_tmr,GFP_KERNEL , tag, + srp_tsk, tcm_tmr,GFP_KERNEL , srp_tsk->task_tag,TARGET_SCF_ACK_KREF );if (rc !=0 ) { send_ioctx->cmd.se_tmr_req->response =TMR_FUNCTION_REJECTED ;
Signature · 1 line
2.10.1
PATCH 37/84 xfs: fixed signedness of error code in xfs_inode_buf_verify
In reply to Jiri SlabyFrom: Jeff Mahoney <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
Prior to v3.17, XFS used positive error codes internally. Commit af8d971602b9583e5e8400e637e2a48c7480bc64 (xfs: inode recovery readahead can race with inode buffer creation), upstream commit b79f4a1c68bb99152d0785ee4ea3ab4396cdacc6 backported from later releases need the error code signs reversed. Negative error codes will cause assertion failures (BUG_ON on kernels with assertions enabled.
--- fs/xfs/xfs_inode_buf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/xfs/xfs_inode_buf.c +1 -1
@@ -99,7 +99,7 @@ xfs_inode_buf_verify( XFS_RANDOM_ITOBP_INOTOBP))) {if (readahead) { bp->b_flags &= ~XBF_DONE ; -xfs_buf_ioerror (bp, -EIO ); +xfs_buf_ioerror (bp,EIO );return ; }
Signature · 1 line
2.10.1
PATCH 38/84 sched/core: Fix an SMP ordering race in try_to_wake_up() vs. schedule()
In reply to Jiri SlabyFrom: Peter Zijlstra <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit ecf7d01c229d11a44609c0067889372c91fb4f36 upstream.
Oleg noticed that its possible to falsely observe p->on_cpu == 0 such that we'll prematurely continue with the wakeup and effectively run p on two CPUs at the same time.
Even though the overlap is very limited; the task is in the middle of being scheduled out; it could still result in corruption of the scheduler data structures.
CPU0 CPU1
set_current_state(...)
<preempt_schedule>
context_switch(X, Y)
prepare_lock_switch(Y)
Y->on_cpu = 1;
finish_lock_switch(X)
store_release(X->on_cpu, 0);
try_to_wake_up(X)
LOCK(p->pi_lock);
t = X->on_cpu; // 0
context_switch(Y, X)
prepare_lock_switch(X)
X->on_cpu = 1;
finish_lock_switch(Y)
store_release(Y->on_cpu, 0);
</preempt_schedule>
schedule();
deactivate_task(X);
X->on_rq = 0;
if (X->on_rq) // false
if (t) while (X->on_cpu)
cpu_relax();
context_switch(X, ..)
finish_lock_switch(X)
store_release(X->on_cpu, 0);Avoid the load of X->on_cpu being hoisted over the X->on_rq load.
--- kernel/sched/core.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+)
kernel/sched/core.c +19 -0
@@ -1530,6 +1530,25 @@ try_to_wake_up(struct task_struct *p, unsigned int state, int wake_flags)#ifdef CONFIG_SMP /* +* Ensure we load p->on_cpu _after_ p->on_rq, otherwise it would be +* possible to, falsely, observe p->on_cpu == 0. +* +* One must be running (->on_cpu == 1) in order to remove oneself +* from the runqueue. +* +* [S] ->on_cpu = 1; [L] ->on_rq +* UNLOCK rq->lock +* RMB +* LOCK rq->lock +* [S] ->on_rq = 0; [L] ->on_cpu +* +* Pairs with the full barrier implied in the UNLOCK+LOCK on rq->lock +* from the consecutive calls to schedule(); the first switching to our +* task, the second putting it to sleep. +*/ +smp_rmb (); + +/* * If the owning (remote) cpu is still in the middle of schedule() with * this task as prev, wait until its done referencing the task. */
Signature · 1 line
2.10.1
PATCH 39/84 powerpc: Add macros for the ibm_architecture_vec[] lengths
In reply to Jiri SlabyFrom: Michael Ellerman <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit e8a4fd0afe05d5213d809fa686d3b8319464acfd upstream.
The encoding of the lengths in the ibm_architecture_vec array is "interesting" to say the least. It's non-obvious how the number of bytes we provide relates to the length value.
In fact we already got it wrong once, see 11e9ed43ca8a "Fix up ibm_architecture_vec definition".
So add some macros to make it (hopefully) clearer. These at least have the property that the integer present in the code is equal to the number of bytes that follows it.
--- arch/powerpc/kernel/prom_init.c | 25 +++++++++++++++++-------- 1 file changed, 17 insertions(+), 8 deletions(-)
arch/powerpc/kernel/prom_init.c +17 -8
@@ -642,6 +642,15 @@ static void __init early_cmdline_parse(void)#define W (x) ((x) >> 24) & 0xff, ((x) >> 16) & 0xff, \ ((x) >> 8) & 0xff, (x) & 0xff +/* Firmware expects the value to be n - 1, where n is the # of vectors */ +#define NUM_VECTORS (n) ((n) - 1) + +/* +* Firmware expects 1 + n - 2, where n is the length of the option vector in +* bytes. The 1 accounts for the length byte itself, the - 2 .. ? +*/ +#define VECTOR_LENGTH (n) (1 + (n) - 2) +unsigned char ibm_architecture_vec[] = {W (0xfffe0000 ),W (0x003a0000 ),/* POWER5/POWER5+ */ W (0xffff0000 ),W (0x003e0000 ),/* POWER6 */
@@ -652,16 +661,16 @@ unsigned char ibm_architecture_vec[] = {W (0xffffffff ),W (0x0f000003 ),/* all 2.06-compliant */ W (0xffffffff ),W (0x0f000002 ),/* all 2.05-compliant */ W (0xfffffffe ),W (0x0f000001 ),/* all 2.04-compliant and earlier */ -6 -1 ,/* 6 option vectors */ +NUM_VECTORS (6 ),/* 6 option vectors */ /* option vector 1: processor architectures supported */ -3 -2 ,/* length */ +VECTOR_LENGTH (2 ),/* length */ 0 ,/* don't ignore, don't halt */ OV1_PPC_2_00 |OV1_PPC_2_01 |OV1_PPC_2_02 |OV1_PPC_2_03 |OV1_PPC_2_04 |OV1_PPC_2_05 |OV1_PPC_2_06 |OV1_PPC_2_07 ,/* option vector 2: Open Firmware options supported */ -34 -2 ,/* length */ +VECTOR_LENGTH (33 ),/* length */ OV2_REAL_MODE ,0 ,0 , W(0xffffffff), /* real_base */
@@ -675,17 +684,17 @@ unsigned char ibm_architecture_vec[] = {48 ,/* max log_2(hash table size) */ /* option vector 3: processor options supported */ -3 -2 ,/* length */ +VECTOR_LENGTH (2 ),/* length */ 0 ,/* don't ignore, don't halt */ OV3_FP |OV3_VMX |OV3_DFP ,/* option vector 4: IBM PAPR implementation */ -3 -2 ,/* length */ +VECTOR_LENGTH (2 ),/* length */ 0 ,/* don't halt */ OV4_MIN_ENT_CAP ,/* minimum VP entitled capacity */ /* option vector 5: PAPR/OF options */ -19 -2 ,/* length */ +VECTOR_LENGTH (18 ),/* length */ 0 ,/* don't ignore, don't halt */ OV5_FEAT (OV5_LPAR ) |OV5_FEAT (OV5_SPLPAR ) |OV5_FEAT (OV5_LARGE_PAGES ) | OV5_FEAT(OV5_DRCONF_MEMORY) | OV5_FEAT(OV5_DONATE_DEDICATE_CPU) |
@@ -718,12 +727,12 @@ unsigned char ibm_architecture_vec[] = {OV5_FEAT (OV5_PFO_HW_RNG ) |OV5_FEAT (OV5_PFO_HW_ENCR ) |OV5_FEAT (OV5_PFO_HW_842 ),OV5_FEAT (OV5_SUB_PROCESSORS ), +/* option vector 6: IBM PAPR hints */ -4 -2 ,/* length */ +VECTOR_LENGTH (3 ),/* length */ 0 ,0 , OV6_LINUX, - };/* Old method - ELF header with PT_NOTE sections only works on BE */
Signature · 1 line
2.10.1
PATCH 40/84 mtd: nand: davinci: Reinitialize the HW ECC engine in 4bit hwctl
In reply to Jiri SlabyFrom: Karl Beldan <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit f6d7c1b5598b6407c3f1da795dd54acf99c1990c upstream.
This fixes subpage writes when using 4-bit HW ECC.
There has been numerous reports about ECC errors with devices using this driver for a while. Also the 4-bit ECC has been reported as broken with subpages in [1] and with 16 bits NANDs in the driver and in mach* board files both in mainline and in the vendor BSPs.
What I saw with 4-bit ECC on a 16bits NAND (on an LCDK) which got me to try reinitializing the ECC engine:
- R/W on whole pages properly generates/checks RS code
- try writing the 1st subpage only of a blank page, the subpage is well written and the RS code properly generated, re-reading the same page the HW detects some ECC error, reading the same page again no ECC error is detected
Note that the ECC engine is already reinitialized in the 1-bit case.
Tested on my LCDK with UBI+UBIFS using subpages.
This could potentially get rid of the issue workarounded in [1].
[1] 28c015a9daab ("mtd: davinci-nand: disable subpage write for keystone-nand")
--- drivers/mtd/nand/davinci_nand.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/mtd/nand/davinci_nand.c +3 -0
@@ -241,6 +241,9 @@ static void nand_davinci_hwctl_4bit(struct mtd_info *mtd, int mode)unsigned long flags;u32 val; +/* Reset ECC hardware */ +davinci_nand_readl (info,NAND_4BIT_ECC1_OFFSET ); +spin_lock_irqsave (&davinci_nand_lock, flags);/* Start 4-bit ECC calculation for read/write */
Signature · 1 line
2.10.1
PATCH 41/84 mm,ksm: fix endless looping in allocating memory when ksm enable
In reply to Jiri SlabyFrom: zhong jiang <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 5b398e416e880159fe55eefd93c6588fa072cd66 upstream.
I hit the following hung task when runing a OOM LTP test case with 4.1 kernel.
Call trace: [<ffffffc000086a88>] __switch_to+0x74/0x8c [<ffffffc000a1bae0>] __schedule+0x23c/0x7bc [<ffffffc000a1c09c>] schedule+0x3c/0x94 [<ffffffc000a1eb84>] rwsem_down_write_failed+0x214/0x350 [<ffffffc000a1e32c>] down_write+0x64/0x80 [<ffffffc00021f794>] __ksm_exit+0x90/0x19c [<ffffffc0000be650>] mmput+0x118/0x11c [<ffffffc0000c3ec4>] do_exit+0x2dc/0xa74 [<ffffffc0000c46f8>] do_group_exit+0x4c/0xe4 [<ffffffc0000d0f34>] get_signal+0x444/0x5e0 [<ffffffc000089fcc>] do_signal+0x1d8/0x450 [<ffffffc00008a35c>] do_notify_resume+0x70/0x78
The oom victim cannot terminate because it needs to take mmap_sem for write while the lock is held by ksmd for read which loops in the page allocator
ksm_do_scan
scan_get_next_rmap_item
down_read
get_next_rmap_item
alloc_rmap_item #ksmd will loop permanently.
There is no way forward because the oom victim cannot release any memory in 4.1 based kernel. Since 4.6 we have the oom reaper which would solve this problem because it would release the memory asynchronously. Nevertheless we can relax alloc_rmap_item requirements and use __GFP_NORETRY because the allocation failure is acceptable as ksm_do_scan would just retry later after the lock got dropped.
Such a patch would be also easy to backport to older stable kernels which do not have oom_reaper.
While we are at it add GFP_NOWARN so the admin doesn't have to be alarmed by the allocation failure.
--- mm/ksm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
mm/ksm.c +2 -1
@@ -283,7 +283,8 @@ static inline struct rmap_item *alloc_rmap_item(void) {struct rmap_item *rmap_item; - rmap_item =kmem_cache_zalloc (rmap_item_cache,GFP_KERNEL ); + rmap_item =kmem_cache_zalloc (rmap_item_cache,GFP_KERNEL | + __GFP_NORETRY | __GFP_NOWARN);if (rmap_item) ksm_rmap_items++;return rmap_item;
Signature · 1 line
2.10.1
PATCH 42/84 can: dev: fix deadlock reported after bus-off
In reply to Jiri SlabyFrom: Sergei Miroshnichenko <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 9abefcb1aaa58b9d5aa40a8bb12c87d02415e4c8 upstream.
A timer was used to restart after the bus-off state, leading to a relatively large can_restart() executed in an interrupt context, which in turn sets up pinctrl. When this happens during system boot, there is a high probability of grabbing the pinctrl_list_mutex, which is locked already by the probe() of other device, making the kernel suspect a deadlock condition [1].
To resolve this issue, the restart_timer is replaced by a delayed work.
[1] https://github.com/victronenergy/venus/issues/24
--- drivers/net/can/dev.c | 27 +++++++++++++++++---------- include/linux/can/dev.h | 3 ++- 2 files changed, 19 insertions(+), 11 deletions(-)
drivers/net/can/dev.c +17 -10
@@ -22,6 +22,7 @@#include <linux/slab.h> #include <linux/netdevice.h> #include <linux/if_arp.h> +#include <linux/workqueue.h> #include <linux/can.h> #include <linux/can/dev.h> #include <linux/can/skb.h>
@@ -394,9 +395,8 @@ EXPORT_SYMBOL_GPL(can_free_echo_skb);/* * CAN device restart for bus-off recovery */ -static void can_restart (unsigned long data) +static void can_restart (struct net_device *dev) { -struct net_device *dev = (struct net_device *)data;struct can_priv *priv =netdev_priv (dev);struct net_device_stats *stats = &dev->stats;struct sk_buff *skb;
@@ -436,6 +436,14 @@ restart:netdev_err (dev,"Error %d during restart" , err); } +static void can_restart_work (struct work_struct *work) +{ +struct delayed_work *dwork =to_delayed_work (work); + struct can_priv *priv = container_of(dwork, struct can_priv, restart_work); + +can_restart (priv->dev); +} +int can_restart_now (struct net_device *dev) {struct can_priv *priv =netdev_priv (dev);
@@ -449,8 +457,8 @@ int can_restart_now(struct net_device *dev)if (priv->state !=CAN_STATE_BUS_OFF )return -EBUSY ; -/* Runs as soon as possible in the timer context */ -mod_timer (&priv->restart_timer, jiffies); +cancel_delayed_work_sync (&priv->restart_work); +can_restart (dev);return 0 ; }
@@ -472,8 +480,8 @@ void can_bus_off(struct net_device *dev) priv->can_stats.bus_off++;if (priv->restart_ms) -mod_timer (&priv->restart_timer, - jiffies + (priv->restart_ms *HZ ) /1000 ); +schedule_delayed_work (&priv->restart_work, +msecs_to_jiffies (priv->restart_ms)); }EXPORT_SYMBOL_GPL (can_bus_off);
@@ -556,6 +564,7 @@ struct net_device *alloc_candev(int sizeof_priv, unsigned int echo_skb_max)return NULL ; priv =netdev_priv (dev); + priv->dev = dev;if (echo_skb_max) { priv->echo_skb_max = echo_skb_max;
@@ -565,7 +574,7 @@ struct net_device *alloc_candev(int sizeof_priv, unsigned int echo_skb_max) priv->state =CAN_STATE_STOPPED ; -init_timer (&priv->restart_timer); +INIT_DELAYED_WORK (&priv->restart_work, can_restart_work);return dev; }
@@ -599,8 +608,6 @@ int open_candev(struct net_device *dev)if (!netif_carrier_ok (dev))netif_carrier_on (dev); -setup_timer (&priv->restart_timer, can_restart, (unsigned long )dev); -return 0 ; }EXPORT_SYMBOL_GPL (open_candev);
@@ -615,7 +622,7 @@ void close_candev(struct net_device *dev) {struct can_priv *priv =netdev_priv (dev); -del_timer_sync (&priv->restart_timer); +cancel_delayed_work_sync (&priv->restart_work);can_flush_echo_skb (dev); }EXPORT_SYMBOL_GPL (close_candev);
include/linux/can/dev.h +2 -1
@@ -31,6 +31,7 @@ enum can_mode {* CAN common private data */ struct can_priv { +struct net_device *dev;struct can_device_stats can_stats;struct can_bittiming bittiming;
@@ -42,7 +43,7 @@ struct can_priv {u32 ctrlmode_supported;int restart_ms; -struct timer_list restart_timer; +struct delayed_work restart_work;int (*do_set_bittiming)(struct net_device *dev);int (*do_set_mode)(struct net_device *dev,enum can_mode mode);
Signature · 1 line
2.10.1
PATCH 43/84 drm/radeon/si/dpm: add workaround for for Jet parts
In reply to Jiri SlabyFrom: Alex Deucher <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 670bb4fd21c966d0d2a59ad4a99bb4889f9a2987 upstream.
Add clock quirks for Jet parts.
--- drivers/gpu/drm/radeon/si_dpm.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/gpu/drm/radeon/si_dpm.c +6 -0
@@ -3012,6 +3012,12 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev,if (rdev->pdev->device ==0x6811 && rdev->pdev->revision ==0x81 ) max_mclk =120000 ; +/* limit sclk/mclk on Jet parts for stability */ +if (rdev->pdev->device ==0x6665 && + rdev->pdev->revision ==0xc3 ) { + max_sclk =75000 ; + max_mclk =80000 ; + }/* XXX validate the min clocks required for display */
Signature · 1 line
2.10.1
PATCH 44/84 ARM: 8616/1: dt: Respect property size when parsing CPUs
In reply to Jiri SlabyFrom: Robin Murphy <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit ba6dea4f7cedb4b1c17e36f4087675d817c2e24b upstream.
Whilst MPIDR values themselves are less than 32 bits, it is still perfectly valid for a DT to have #address-cells > 1 in the CPUs node, resulting in the "reg" property having leading zero cell(s). In that situation, the big-endian nature of the data conspires with the current behaviour of only reading the first cell to cause the kernel to think all CPUs have ID 0, and become resoundingly unhappy as a consequence.
Take the full property length into account when parsing CPUs so as to be correct under any circumstances.
--- arch/arm/kernel/devtree.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)
arch/arm/kernel/devtree.c +11 -3
@@ -90,6 +90,8 @@ void __init arm_dt_init_cpu_maps(void)return ;for_each_child_of_node (cpus, cpu) { +const __be32 *cell; +int prop_bytes;u32 hwid;if (of_node_cmp (cpu->type,"cpu" ))
@@ -101,17 +103,23 @@ void __init arm_dt_init_cpu_maps(void)* properties is considered invalid to build the * cpu_logical_map. */ -if (of_property_read_u32 (cpu,"reg" , &hwid)) { + cell =of_get_property (cpu,"reg" , &prop_bytes); +if (!cell || prop_bytes <sizeof (*cell)) {pr_debug (" * %s missing reg property\n" , cpu->full_name);return ; }/* -* 8 MSBs must be set to 0 in the DT since the reg property +* Bits n:24 must be set to 0 in the DT since the reg property * defines the MPIDR[23:0]. */ -if (hwid & ~MPIDR_HWID_BITMASK ) +do { + hwid =be32_to_cpu (*cell++); + prop_bytes -=sizeof (*cell); + }while (!hwid && prop_bytes >0 ); + +if (prop_bytes || (hwid & ~MPIDR_HWID_BITMASK ))return ;/*
Signature · 1 line
2.10.1
PATCH 45/84 tools/vm/slabinfo: fix an unintentional printf
In reply to Jiri SlabyFrom: Dan Carpenter <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 2d6a4d64812bb12dda53704943b61a7496d02098 upstream.
The curly braces are missing here so we print stuff unintentionally.
--- tools/vm/slabinfo.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
tools/vm/slabinfo.c +2 -1
@@ -493,10 +493,11 @@ static void slab_stats(struct slabinfo *s) s->alloc_node_mismatch, (s->alloc_node_mismatch * 100) / total); } -if (s->cmpxchg_double_fail || s->cmpxchg_double_cpu_fail) +if (s->cmpxchg_double_fail || s->cmpxchg_double_cpu_fail) {printf ("\nCmpxchg_double Looping\n------------------------\n" );printf ("Locked Cmpxchg Double redos %lu\nUnlocked Cmpxchg Double redos %lu\n" , s->cmpxchg_double_fail, s->cmpxchg_double_cpu_fail); + } }static void report (struct slabinfo *s)
Signature · 1 line
2.10.1
PATCH 46/84 hwmon: (adt7411) set bit 3 in CFG1 register
In reply to Jiri SlabyFrom: Michael Walle <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit b53893aae441a034bf4dbbad42fe218561d7d81f upstream.
According to the datasheet you should only write 1 to this bit. If it is not set, at least AIN3 will return bad values on newer silicon revisions.
--- drivers/hwmon/adt7411.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/hwmon/adt7411.c +4 -1
@@ -30,6 +30,7 @@#define ADT7411_REG_CFG1 0x18#define ADT7411_CFG1_START_MONITOR (1 << 0) +#define ADT7411_CFG1_RESERVED_BIT3 (1 << 3)#define ADT7411_REG_CFG2 0x19#define ADT7411_CFG2_DISABLE_AVG (1 << 5)
@@ -292,8 +293,10 @@ static int adt7411_probe(struct i2c_client *client,mutex_init (&data->device_lock);mutex_init (&data->update_lock); +/* According to the datasheet, we must only write 1 to bit 3 */ ret =adt7411_modify_bit (client,ADT7411_REG_CFG1 , -ADT7411_CFG1_START_MONITOR ,1 ); +ADT7411_CFG1_RESERVED_BIT3 + |ADT7411_CFG1_START_MONITOR ,1 );if (ret <0 )return ret;
Signature · 1 line
2.10.1
PATCH 47/84 iwlwifi: pcie: fix access to scratch buffer
In reply to Jiri SlabyFrom: Sara Sharon <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit d5d0689aefc59c6a5352ca25d7e6d47d03f543ce upstream.
This fixes a pretty ancient bug that hasn't manifested itself until now.
The scratchbuf for command queue is allocated only for 32 slots but is accessed with the queue write pointer - which can be up to 256.
Since the scratch buf size was 16 and there are up to 256 TFDs we never passed a page boundary when accessing the scratch buffer, but when attempting to increase the size of the scratch buffer a panic was quick to follow when trying to access the address resulted in a page boundary.
--- drivers/net/wireless/iwlwifi/pcie/tx.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/iwlwifi/pcie/tx.c +2 -2
@@ -1328,9 +1328,9 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,/* start the TFD with the scratchbuf */ scratch_size =min_t (int, copy_size,IWL_HCMD_SCRATCHBUF_SIZE ); -memcpy (&txq->scratchbufs[q->write_ptr], &out_cmd->hdr, scratch_size); +memcpy (&txq->scratchbufs[idx], &out_cmd->hdr, scratch_size);iwl_pcie_txq_build_tfd (trans, txq, -iwl_pcie_get_scratchbuf_dma (txq, q->write_ptr), +iwl_pcie_get_scratchbuf_dma (txq, idx), scratch_size,1 );/* map first command fragment, if any remains */
Signature · 1 line
2.10.1
PATCH 48/84 usb: gadget: fsl_qe_udc: signedness bug in qe_get_frame()
In reply to Jiri SlabyFrom: Dan Carpenter <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit f4693b08cc901912a87369c46537b94ed4084ea0 upstream.
We can't assign -EINVAL to a u16.
--- drivers/usb/gadget/fsl_qe_udc.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-)
drivers/usb/gadget/fsl_qe_udc.c +2 -5
@@ -1881,11 +1881,8 @@ static int qe_get_frame(struct usb_gadget *gadget) tmp =in_be16 (&udc->usb_param->frame_n);if (tmp &0x8000 ) - tmp = tmp &0x07ff ; -else - tmp = -EINVAL ; - -return (int )tmp; +return tmp &0x07ff ; +return -EINVAL ; } static int fsl_qe_start(struct usb_gadget *gadget,
Signature · 1 line
2.10.1
PATCH 49/84 ARM: 8618/1: decompressor: reset ttbcr fields to use TTBR0 on ARMv7
In reply to Jiri SlabyFrom: Srinivas Ramana <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 117e5e9c4cfcb7628f08de074fbfefec1bb678b7 upstream.
If the bootloader uses the long descriptor format and jumps to kernel decompressor code, TTBCR may not be in a right state. Before enabling the MMU, it is required to clear the TTBCR.PD0 field to use TTBR0 for translation table walks.
The commit dbece45894d3a ("ARM: 7501/1: decompressor:
reset ttbcr for VMSA ARMv7 cores") does the reset of TTBCR.N, but doesn't consider all the bits for the size of TTBCR.N.
Clear TTBCR.PD0 field and reset all the three bits of TTBCR.N to indicate the use of TTBR0 and the correct base address width.
--- arch/arm/boot/compressed/head.S | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/compressed/head.S +1 -1
@@ -734,7 +734,7 @@ __armv7_mmu_cache_on: orrne r0, r0, #1 @ MMU enabled movne r1, #0xfffffffd @ domain 0 = client bic r6, r6, #1 << 31 @ 32-bit translation system - bic r6, r6, #3 << 0 @ use only ttbr0 + bic r6, r6, #(7 << 0) | (1 << 4) @ use only ttbr0 mcrne p15, 0, r3, c2, c0, 0 @ load page table pointer mcrne p15, 0, r1, c3, c0, 0 @ load domain access control mcrne p15, 0, r6, c2, c0, 2 @ load ttb control
Signature · 1 line
2.10.1
PATCH 50/84 arm64: debug: avoid resetting stepping state machine when TIF_SINGLESTEP
In reply to Jiri SlabyFrom: Will Deacon <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 3a402a709500c5a3faca2111668c33d96555e35a upstream.
When TIF_SINGLESTEP is set for a task, the single-step state machine is enabled and we must take care not to reset it to the active-not-pending state if it is already in the active-pending state.
Unfortunately, that's exactly what user_enable_single_step does, by unconditionally setting the SS bit in the SPSR for the current task. This causes failures in the GDB testsuite, where GDB ends up missing expected step traps if the instruction being stepped generates another trap, e.g. PTRACE_EVENT_FORK from an SVC instruction.
This patch fixes the problem by preserving the current state of the stepping state machine when TIF_SINGLESTEP is set on the current thread.
--- arch/arm64/kernel/debug-monitors.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
arch/arm64/kernel/debug-monitors.c +4 -2
@@ -338,8 +338,10 @@ int kernel_active_single_step(void)/* ptrace API */ void user_enable_single_step (struct task_struct *task) { -set_ti_thread_flag (task_thread_info (task),TIF_SINGLESTEP ); -set_regs_spsr_ss (task_pt_regs (task)); +struct thread_info *ti =task_thread_info (task); + +if (!test_and_set_ti_thread_flag (ti,TIF_SINGLESTEP )) +set_regs_spsr_ss (task_pt_regs (task)); }void user_disable_single_step (struct task_struct *task)
Signature · 1 line
2.10.1
PATCH 51/84 MIPS: Malta: Fix IOCU disable switch read for MIPS64
In reply to Jiri SlabyFrom: Paul Burton <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 305723ab439e14debc1d339aa04e835d488b8253 upstream.
Malta boards used with CPU emulators feature a switch to disable use of an IOCU. Software has to check this switch & ignore any present IOCU if the switch is closed. The read used to do this was unsafe for 64 bit kernels, as it simply casted the address 0xbf403000 to a pointer & dereferenced it. Whilst in a 32 bit kernel this would access kseg1, in a 64 bit kernel this attempts to access xuseg & results in an address error exception.
Fix by accessing a correctly formed ckseg1 address generated using the CKSEG1ADDR macro.
Whilst modifying this code, define the name of the register and the bit we care about within it, which indicates whether PCI DMA is routed to the IOCU or straight to DRAM. The code previously checked that bit 0 was also set, but the least significant 7 bits of the CONFIG_GEN0 register contain the value of the MReqInfo signal provided to the IOCU OCP bus, so singling out bit 0 makes little sense & that part of the check is dropped.
Patchwork: https://patchwork.linux-mips.org/patch/14187/
--- arch/mips/mti-malta/malta-setup.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
arch/mips/mti-malta/malta-setup.c +7 -1
@@ -36,6 +36,9 @@#include <linux/console.h> #endif +#define ROCIT_CONFIG_GEN0 0x1f403000 +#define ROCIT_CONFIG_GEN0_PCI_IOCU BIT(7) +extern void malta_be_init (void );extern int malta_be_handler (struct pt_regs *regs,int is_fixup);
@@ -108,6 +111,8 @@ static void __init fd_activate(void)static int __init plat_enable_iocoherency (void ) {int supported =0 ; +u32 cfg; +if (mips_revision_sconid ==MIPS_REVISION_SCON_BONITO ) {if (BONITO_PCICACHECTRL &BONITO_PCICACHECTRL_CPUCOH_PRES ) {BONITO_PCICACHECTRL |=BONITO_PCICACHECTRL_CPUCOH_EN ;
@@ -130,7 +135,8 @@ static int __init plat_enable_iocoherency(void) }else if (gcmp_niocu () !=0 ) {/* Nothing special needs to be done to enable coherency */ pr_info ("CMP IOCU detected\n" ); -if ((*(unsigned int *)0xbf403000 &0x81 ) !=0x81 ) { + cfg =__raw_readl ((u32 *)CKSEG1ADDR (ROCIT_CONFIG_GEN0 )); +if (!(cfg &ROCIT_CONFIG_GEN0_PCI_IOCU )) {pr_crit ("IOCU OPERATION DISABLED BY SWITCH - DEFAULTING TO SW IO COHERENCY\n" );return 0 ; }
Signature · 1 line
2.10.1
PATCH 52/84 printk: fix parsing of "brl=" option
In reply to Jiri SlabyFrom: Nicolas Iooss <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit ae6c33ba6e37eea3012fe2640b22400ef3f2d0f3 upstream.
Commit bbeddf52adc1 ("printk: move braille console support into separate braille.[ch] files") moved the parsing of braille-related options into _braille_console_setup(), changing the type of variable str from char* to char**. In this commit, memcmp(str, "brl,", 4) was correctly updated to memcmp(*str, "brl,", 4) but not memcmp(str, "brl=", 4).
Update the code to make "brl=" option work again and replace memcmp() with strncmp() to make the compiler able to detect such an issue.
--- kernel/printk/braille.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/printk/braille.c +2 -2
@@ -9,10 +9,10 @@char *_braille_console_setup (char **str,char **brl_options) { -if (!memcmp (*str,"brl," ,4 )) { +if (!strncmp (*str,"brl," ,4 )) { *brl_options ="" ; *str +=4 ; - }else if (!memcmp (str,"brl=" ,4 )) { + }else if (!strncmp (*str,"brl=" ,4 )) { *brl_options = *str +4 ; *str =strchr (*brl_options,',' );if (!*str)
Signature · 1 line
2.10.1
PATCH 53/84 ARM: sa1100: clear reset status prior to reboot
In reply to Jiri SlabyFrom: Russell King <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit da60626e7d02a4f385cae80e450afc8b07035368 upstream.
Clear the current reset status prior to rebooting the platform. This adds the bit missing from 04fef228fb00 ("[ARM] pxa: introduce reset_status and clear_reset_status for driver's usage").
--- arch/arm/mach-sa1100/generic.c | 3 +++ 1 file changed, 3 insertions(+)
arch/arm/mach-sa1100/generic.c +3 -0
@@ -31,6 +31,7 @@#include <mach/hardware.h> #include <mach/irqs.h> +#include <mach/reset.h> #include "generic.h"
@@ -134,6 +135,8 @@ static void sa1100_power_off(void)void sa11x0_restart (enum reboot_mode mode,const char *cmd) { +clear_reset_status (RESET_STATUS_ALL ); +if (mode ==REBOOT_SOFT ) {/* Jump into ROM at address 0 */ soft_restart (0 );
Signature · 1 line
2.10.1
PATCH 54/84 ARM: sa1111: fix pcmcia suspend/resume
In reply to Jiri SlabyFrom: Russell King <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 06dfe5cc0cc684e735cb0232fdb756d30780b05d upstream.
SA1111 PCMCIA was broken when PCMCIA switched to using dev_pm_ops for the PCMCIA socket class. PCMCIA used to handle suspend/resume via the socket hosting device, which happened at normal device suspend/resume time.
However, the referenced commit changed this: much of the resume now happens much earlier, in the noirq resume handler of dev_pm_ops.
However, on SA1111, the PCMCIA device is not accessible as the SA1111 has not been resumed at _noirq time. It's slightly worse than that, because the SA1111 has already been put to sleep at _noirq time, so suspend doesn't work properly.
Fix this by converting the core SA1111 code to use dev_pm_ops as well, and performing its own suspend/resume at noirq time.
This fixes these errors in the kernel log:
pcmcia_socket pcmcia_socket0: time out after reset pcmcia_socket pcmcia_socket1: time out after reset
and the resulting lack of PCMCIA cards after a S2RAM cycle.
--- arch/arm/common/sa1111.c | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-)
arch/arm/common/sa1111.c +13 -9
@@ -872,9 +872,9 @@ struct sa1111_save_data {#ifdef CONFIG_PM -static int sa1111_suspend (struct platform_device *dev,pm_message_t state) +static int sa1111_suspend_noirq (struct device *dev) { -struct sa1111 *sachip =platform_get_drvdata (dev); +struct sa1111 *sachip =dev_get_drvdata (dev);struct sa1111_save_data *save;unsigned long flags;unsigned int val;
@@ -937,9 +937,9 @@ static int sa1111_suspend(struct platform_device *dev, pm_message_t state)* restored by their respective drivers, and must be called * via LDM after this function. */ -static int sa1111_resume (struct platform_device *dev) +static int sa1111_resume_noirq (struct device *dev) { -struct sa1111 *sachip =platform_get_drvdata (dev); +struct sa1111 *sachip =dev_get_drvdata (dev);struct sa1111_save_data *save;unsigned long flags, id;void __iomem *base;
@@ -955,7 +955,7 @@ static int sa1111_resume(struct platform_device *dev) id =sa1111_readl (sachip->base +SA1111_SKID );if ((id &SKID_ID_MASK ) !=SKID_SA1111_ID ) {__sa1111_remove (sachip); -platform_set_drvdata (dev,NULL ); +dev_set_drvdata (dev,NULL );kfree (save);return 0 ; }
@@ -1006,8 +1006,8 @@ static int sa1111_resume(struct platform_device *dev) }#else -#define sa1111_suspend NULL -#define sa1111_resume NULL +#define sa1111_suspend_noirq NULL +#define sa1111_resume_noirq NULL#endif static int sa1111_probe (struct platform_device *pdev)
@@ -1041,6 +1041,11 @@ static int sa1111_remove(struct platform_device *pdev)return 0 ; } +static struct dev_pm_ops sa1111_pm_ops = { + .suspend_noirq = sa1111_suspend_noirq, + .resume_noirq = sa1111_resume_noirq, +}; +/* * Not sure if this should be on the system bus or not yet. * We really want some way to register a system device at
@@ -1053,11 +1058,10 @@ static int sa1111_remove(struct platform_device *pdev)static struct platform_driver sa1111_device_driver = { .probe = sa1111_probe, .remove = sa1111_remove, - .suspend = sa1111_suspend, - .resume = sa1111_resume, .driver = { .name ="sa1111" , .owner =THIS_MODULE , + .pm = &sa1111_pm_ops, }, };
Signature · 1 line
2.10.1
PATCH 55/84 hwrng: omap - Fix assumption that runtime_get_sync will always succeed
In reply to Jiri SlabyFrom: Nishanth Menon <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 61dc0a446e5d08f2de8a24b45f69a1e302bb1b1b upstream.
pm_runtime_get_sync does return a error value that must be checked for error conditions, else, due to various reasons, the device maynot be enabled and the system will crash due to lack of clock to the hardware module.
Before:
12.562784] [00000000] *pgd=fe193835
12.562792] Internal error: : 1406 [#1] SMP ARM
[...]
12.562864] CPU: 1 PID: 241 Comm: modprobe Not tainted 4.7.0-rc4-next-20160624 #2 12.562867] Hardware name: Generic DRA74X (Flattened Device Tree) 12.562872] task: ed51f140 ti: ed44c000 task.ti: ed44c000
12.562886] PC is at omap4_rng_init+0x20/0x84 [omap_rng]
12.562899] LR is at set_current_rng+0xc0/0x154 [rng_core]
[...]
After the proper checks:
[ 94.366705] omap_rng 48090000.rng: _od_fail_runtime_resume: FIXME: missing hwmod/omap_dev info [ 94.375767] omap_rng 48090000.rng: Failed to runtime_get device -19 [ 94.382351] omap_rng 48090000.rng: initialization failed.
--- drivers/char/hw_random/omap-rng.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-)
drivers/char/hw_random/omap-rng.c +14 -2
@@ -386,7 +386,12 @@ static int omap_rng_probe(struct platform_device *pdev) }pm_runtime_enable (&pdev->dev); -pm_runtime_get_sync (&pdev->dev); + ret =pm_runtime_get_sync (&pdev->dev); +if (ret) { +dev_err (&pdev->dev,"Failed to runtime_get device: %d\n" , ret); +pm_runtime_put_noidle (&pdev->dev); + goto err_ioremap; + } ret = (dev->of_node) ?of_get_omap_rng_device_details (priv, pdev) :get_omap_rng_device_details (priv);
@@ -439,8 +444,15 @@ static int omap_rng_suspend(struct device *dev)static int omap_rng_resume (struct device *dev) {struct omap_rng_dev *priv =dev_get_drvdata (dev); +int ret; + + ret =pm_runtime_get_sync (dev); +if (ret) { +dev_err (dev,"Failed to runtime_get device: %d\n" , ret); +pm_runtime_put_noidle (dev); +return ret; + } -pm_runtime_get_sync (dev); priv->pdata->init (priv);return 0 ;
Signature · 1 line
2.10.1
PATCH 56/84 tile: Define AT_VECTOR_SIZE_ARCH for ARCH_DLINFO
In reply to Jiri SlabyFrom: James Hogan <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit cdf8b4633075f2171d440d2e37c9c2609019a81a upstream.
AT_VECTOR_SIZE_ARCH should be defined with the maximum number of NEW_AUX_ENT entries that ARCH_DLINFO can contain, but it wasn't defined for tile at all even though ARCH_DLINFO will contain one NEW_AUX_ENT for the VDSO address.
This shouldn't be a problem as AT_VECTOR_SIZE_BASE includes space for AT_BASE_PLATFORM which tile doesn't use, but lets define it now and add the comment above ARCH_DLINFO as found in several other architectures to remind future modifiers of ARCH_DLINFO to keep AT_VECTOR_SIZE_ARCH up to date.
--- arch/tile/include/asm/elf.h | 1 + arch/tile/include/uapi/asm/auxvec.h | 2 ++ 2 files changed, 3 insertions(+)
arch/tile/include/asm/elf.h +1 -0
@@ -131,6 +131,7 @@ extern int dump_task_regs(struct task_struct *, elf_gregset_t *);struct linux_binprm ;extern int arch_setup_additional_pages (struct linux_binprm *bprm,int executable_stack); +/* update AT_VECTOR_SIZE_ARCH if the number of NEW_AUX_ENT entries changes */ #define ARCH_DLINFO \ do { \ NEW_AUX_ENT(AT_SYSINFO_EHDR, VDSO_BASE); \
arch/tile/include/uapi/asm/auxvec.h +2 -0
@@ -18,4 +18,6 @@/* The vDSO location. */ #define AT_SYSINFO_EHDR 33 +#define AT_VECTOR_SIZE_ARCH 1/* entries in ARCH_DLINFO */ +#endif /* _ASM_TILE_AUXVEC_H */
Signature · 1 line
2.10.1
PATCH 57/84 em28xx-i2c: rt_mutex_trylock() returns zero on failure
In reply to Jiri SlabyFrom: Dan Carpenter <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit e44c153b30c9a0580fc2b5a93f3c6d593def2278 upstream.
The code is checking for negative returns but it should be checking for zero.
--- drivers/media/usb/em28xx/em28xx-i2c.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/media/usb/em28xx/em28xx-i2c.c +2 -3
@@ -469,9 +469,8 @@ static int em28xx_i2c_xfer(struct i2c_adapter *i2c_adap,int addr, rc, i;u8 reg; - rc =rt_mutex_trylock (&dev->i2c_bus_lock); -if (rc <0 ) -return rc; +if (!rt_mutex_trylock (&dev->i2c_bus_lock)) +return -EAGAIN ;/* Switch I2C bus if needed */ if (bus != dev->cur_i2c_bus &&
Signature · 1 line
2.10.1
PATCH 58/84 gspca: avoid unused variable warnings
In reply to Jiri SlabyFrom: Arnd Bergmann <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit d7e92e15e92fc987640772bf110586898b5f15aa upstream.
When CONFIG_INPUT is disabled, multiple gspca backend drivers print compile-time warnings about unused variables:
media/usb/gspca/cpia1.c: In function 'sd_stopN':media/usb/gspca/cpia1.c:1627:13: error: unused variable 'sd' [-Werror=unused-variable] media/usb/gspca/konica.c: In function 'sd_stopN':media/usb/gspca/konica.c:246:13: error: unused variable 'sd' [-Werror=unused-variable]
This annotates the variables as __maybe_unused, to let the compiler know that they are declared intentionally.
--- drivers/media/usb/gspca/cpia1.c | 2 +- drivers/media/usb/gspca/konica.c | 2 +- drivers/media/usb/gspca/t613.c | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-)
drivers/media/usb/gspca/cpia1.c +1 -1
@@ -1624,7 +1624,7 @@ static int sd_start(struct gspca_dev *gspca_dev)static void sd_stopN (struct gspca_dev *gspca_dev) { -struct sd *sd = (struct sd *) gspca_dev; +struct sd *sd__maybe_unused = (struct sd *) gspca_dev;command_pause (gspca_dev);
drivers/media/usb/gspca/konica.c +1 -1
@@ -243,7 +243,7 @@ static int sd_start(struct gspca_dev *gspca_dev)static void sd_stopN (struct gspca_dev *gspca_dev) { -struct sd *sd = (struct sd *) gspca_dev; +struct sd *sd__maybe_unused = (struct sd *) gspca_dev;konica_stream_off (gspca_dev);#if IS_ENABLED (CONFIG_INPUT )
drivers/media/usb/gspca/t613.c +1 -1
@@ -837,7 +837,7 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev, u8 *data, /* isoc packet */ int len) /* iso packet length */ { -struct sd *sd = (struct sd *) gspca_dev; +struct sd *sd__maybe_unused = (struct sd *) gspca_dev;int pkt_type;if (data[0 ] ==0x5a ) {
Signature · 1 line
2.10.1
PATCH 59/84 avr32: off by one in at32_init_pio()
In reply to Jiri SlabyFrom: Dan Carpenter <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 55f1cf83d5cf885c75267269729805852039c834 upstream.
The pio_dev[] array has MAX_NR_PIO_DEVICES elements so the > should be
Quoted 1 line
=.
--- arch/avr32/mach-at32ap/pio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/avr32/mach-at32ap/pio.c +1 -1
@@ -435,7 +435,7 @@ void __init at32_init_pio(struct platform_device *pdev)struct resource *regs;struct pio_device *pio; -if (pdev->id >MAX_NR_PIO_DEVICES ) { +if (pdev->id >=MAX_NR_PIO_DEVICES ) {dev_err (&pdev->dev,"only %d PIO devices supported\n" ,MAX_NR_PIO_DEVICES );return ;
Signature · 1 line
2.10.1
PATCH 60/84 svc: Avoid garbage replies when pc_func() returns rpc_drop_reply
In reply to Jiri SlabyFrom: Chuck Lever <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 0533b13072f4bf35738290d2cf9e299c7bc6c42a upstream.
If an RPC program does not set vs_dispatch and pc_func() returns rpc_drop_reply, the server sends a reply anyway containing a single word containing the value RPC_DROP_REPLY (in network byte-order, of course). This is a nonsense RPC message.
--- net/sunrpc/svc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/sunrpc/svc.c +2 -1
@@ -1182,7 +1182,8 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv) *statp = procp->pc_func (rqstp, rqstp->rq_argp, rqstp->rq_resp);/* Encode reply */ -if (rqstp->rq_dropme) { +if (*statp == rpc_drop_reply || + rqstp->rq_dropme) {if (procp->pc_release) procp->pc_release (rqstp,NULL , rqstp->rq_resp); goto dropit;
Signature · 1 line
2.10.1
PATCH 61/84 NFS: Don't drop CB requests with invalid principals
In reply to Jiri SlabyFrom: Chuck Lever <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit a4e187d83d88eeaba6252aac0a2ffe5eaa73a818 upstream.
Before commit 778be232a207 ("NFS do not find client in NFSv4 pg_authenticate"), the Linux callback server replied with RPC_AUTH_ERROR / RPC_AUTH_BADCRED, instead of dropping the CB request. Let's restore that behavior so the server has a chance to do something useful about it, and provide a warning that helps admins correct the problem.
--- fs/nfs/callback_xdr.c | 6 +++++- net/sunrpc/svc.c | 5 +++++ 2 files changed, 10 insertions(+), 1 deletion(-)
fs/nfs/callback_xdr.c +5 -1
@@ -915,7 +915,7 @@ static __be32 nfs4_callback_compound(struct svc_rqst *rqstp, void *argp, void *rif (hdr_arg.minorversion ==0 ) { cps.clp =nfs4_find_client_ident (SVC_NET (rqstp), hdr_arg.cb_ident);if (!cps.clp || !check_gss_callback_principal (cps.clp, rqstp)) -return rpc_drop_reply; + goto out_invalidcred; } cps.minorversion = hdr_arg.minorversion;
@@ -943,6 +943,10 @@ static __be32 nfs4_callback_compound(struct svc_rqst *rqstp, void *argp, void *rnfs_put_client (cps.clp);dprintk ("%s: done, status = %u\n" , __func__,ntohl (status));return rpc_success; + +out_invalidcred: +pr_warn_ratelimited ("NFS: NFSv4 callback contains invalid cred\n" ); +return rpc_autherr_badcred; }/*
net/sunrpc/svc.c +5 -0
@@ -1188,6 +1188,11 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv) procp->pc_release (rqstp,NULL , rqstp->rq_resp); goto dropit; } +if (*statp == rpc_autherr_badcred) { +if (procp->pc_release) + procp->pc_release (rqstp,NULL , rqstp->rq_resp); + goto err_bad_auth; + }if (*statp == rpc_success && (xdr = procp->pc_encode) && !xdr (rqstp, resv->iov_base+resv->iov_len, rqstp->rq_resp)) {
Signature · 1 line
2.10.1
PATCH 62/84 brcmsmac: Free packet if dma_mapping_error() fails in dma_rxfill
In reply to Jiri SlabyFrom: Florian Fainelli <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 5c5fa1f464ac954982df1d96b9f9a5103d21aedd upstream.
In case dma_mapping_error() returns an error in dma_rxfill, we would be leaking a packet that we allocated with brcmu_pkt_buf_get_skb().
--- drivers/net/wireless/brcm80211/brcmsmac/dma.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/wireless/brcm80211/brcmsmac/dma.c +3 -1
@@ -1079,8 +1079,10 @@ bool dma_rxfill(struct dma_pub *pub) pa =dma_map_single (di->dmadev, p->data, di->rxbufsize,DMA_FROM_DEVICE ); -if (dma_mapping_error (di->dmadev, pa)) +if (dma_mapping_error (di->dmadev, pa)) { +brcmu_pkt_buf_free_skb (p);return false; + }/* save the free packet pointer */ di->rxp[rxout] = p;
Signature · 1 line
2.10.1
PATCH 63/84 brcmsmac: Initialize power in brcms_c_stf_ss_algo_channel_get()
In reply to Jiri SlabyFrom: Florian Fainelli <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit f823a2aa8f4674c095a5413b9e3ba12d82df06f2 upstream.
wlc_phy_txpower_get_current() does a logical OR of power->flags, which presumes that power.flags was initiliazed earlier by the caller, unfortunately, this is not the case, so make sure we zero out the struct tx_power before calling into wlc_phy_txpower_get_current().
--- drivers/net/wireless/brcm80211/brcmsmac/stf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/brcm80211/brcmsmac/stf.c +1 -1
@@ -87,7 +87,7 @@ void brcms_c_stf_ss_algo_channel_get(struct brcms_c_info *wlc, u16 *ss_algo_channel, u16 chanspec) { - struct tx_power power; + struct tx_power power = { };u8 siso_mcs_id, cdd_mcs_id, stbc_mcs_id;/* Clear previous settings */
Signature · 1 line
2.10.1
PATCH 64/84 powerpc/prom: Fix sub-processor option passed to ibm, client-architecture-support
In reply to Jiri SlabyFrom: Michael Ellerman <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 66443efa83dc73775100b7442962ce2cb0d4472e upstream.
When booting from an OpenFirmware which supports it, we use the "ibm,client-architecture-support" firmware call to communicate our capabilities to firmware.
The format of the structure we pass to firmware is specified in PAPR (Power Architecture Platform Requirements), or the public version LoPAPR (Linux on Power Architecture Platform Reference).
Referring to table 244 in LoPAPR v1.1, option vector 5 contains a 4 byte field at bytes 17-20 for the "Platform Facilities Enable". This is followed by a 1 byte field at byte 21 for "Sub-Processor Represenation Level".
Comparing to the code, there we have the Platform Facilities options (OV5_PFO_*) at byte 17, but we fail to pad that field out to its full width of 4 bytes. This means the OV5_SUB_PROCESSORS option is incorrectly placed at byte 18.
Fix it by adding zero bytes for bytes 18, 19, 20, and comment the bytes to hopefully make it clearer in future.
As far as I'm aware nothing actually consumes this value at this time, so the effect of this bug is nil in practice.
It does mean we've been incorrectly setting bit 15 of the "Platform Facilities Enable" option for the past ~3 1/2 years, so we should avoid allocating that bit to anything else in future.
--- arch/powerpc/kernel/prom_init.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
arch/powerpc/kernel/prom_init.c +6 -3
@@ -694,7 +694,7 @@ unsigned char ibm_architecture_vec[] = {OV4_MIN_ENT_CAP ,/* minimum VP entitled capacity */ /* option vector 5: PAPR/OF options */ -VECTOR_LENGTH (18 ),/* length */ +VECTOR_LENGTH (21 ),/* length */ 0 ,/* don't ignore, don't halt */ OV5_FEAT (OV5_LPAR ) |OV5_FEAT (OV5_SPLPAR ) |OV5_FEAT (OV5_LARGE_PAGES ) | OV5_FEAT(OV5_DRCONF_MEMORY) | OV5_FEAT(OV5_DONATE_DEDICATE_CPU) |
@@ -725,8 +725,11 @@ unsigned char ibm_architecture_vec[] = {0 ,0 ,OV5_FEAT (OV5_PFO_HW_RNG ) |OV5_FEAT (OV5_PFO_HW_ENCR ) | -OV5_FEAT (OV5_PFO_HW_842 ), -OV5_FEAT (OV5_SUB_PROCESSORS ), +OV5_FEAT (OV5_PFO_HW_842 ),/* Byte 17 */ +0 ,/* Byte 18 */ +0 ,/* Byte 19 */ +0 ,/* Byte 20 */ +OV5_FEAT (OV5_SUB_PROCESSORS ),/* Byte 21 */ /* option vector 6: IBM PAPR hints */ VECTOR_LENGTH(3), /* length */
Signature · 1 line
2.10.1
PATCH 65/84 ASoC: omap-mcpdm: Fix irq resource handling
In reply to Jiri SlabyFrom: Peter Ujfalusi <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit a8719670687c46ed2e904c0d05fa4cd7e4950cd1 upstream.
Managed irq request will not doing any good in ASoC probe level as it is not going to free up the irq when the driver is unbound from the sound card.
--- sound/soc/omap/omap-mcpdm.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
sound/soc/omap/omap-mcpdm.c +3 -2
@@ -392,8 +392,8 @@ static int omap_mcpdm_probe(struct snd_soc_dai *dai)pm_runtime_get_sync (mcpdm->dev);omap_mcpdm_write (mcpdm,MCPDM_REG_CTRL ,0x00 ); - ret =devm_request_irq (mcpdm->dev, mcpdm->irq, omap_mcpdm_irq_handler, -0 ,"McPDM" , (void *)mcpdm); + ret =request_irq (mcpdm->irq, omap_mcpdm_irq_handler,0 ,"McPDM" , + (void *)mcpdm);pm_runtime_put_sync (mcpdm->dev);
@@ -413,6 +413,7 @@ static int omap_mcpdm_remove(struct snd_soc_dai *dai) {struct omap_mcpdm *mcpdm =snd_soc_dai_get_drvdata (dai); +free_irq (mcpdm->irq, (void *)mcpdm);pm_runtime_disable (mcpdm->dev);return 0 ;
Signature · 1 line
2.10.1
PATCH 66/84 KVM: nVMX: postpone VMCS changes on MSR_IA32_APICBASE write
In reply to Jiri SlabyFrom: Radim Krčmář <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit dccbfcf52cebb8963246eba5b177b77f26b34da0 upstream.
If vmcs12 does not intercept APIC_BASE writes, then KVM will handle the write with vmcs02 as the current VMCS.
This will incorrectly apply modifications intended for vmcs01 to vmcs02 and L2 can use it to gain access to L0's x2APIC registers by disabling virtualized x2APIC while using msr bitmap that assumes enabled.
Postpone execution of vmx_set_virtual_x2apic_mode until vmcs01 is the current VMCS. An alternative solution would temporarily make vmcs01 the current VMCS, but it requires more care.
--- arch/x86/kvm/vmx.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
arch/x86/kvm/vmx.c +13 -0
@@ -366,6 +366,7 @@ struct nested_vmx {struct list_head vmcs02_pool;int vmcs02_num;u64 vmcs01_tsc_offset; +bool change_vmcs01_virtual_x2apic_mode;/* L2 must run next, and mustn't decide to exit to L1. */ bool nested_run_pending;/*
@@ -6861,6 +6862,12 @@ static void vmx_set_virtual_x2apic_mode(struct kvm_vcpu *vcpu, bool set) {u32 sec_exec_control; +/* Postpone execution until vmcs01 is the current VMCS. */ +if (is_guest_mode (vcpu)) { +to_vmx (vcpu)->nested.change_vmcs01_virtual_x2apic_mode = true; +return ; + } +/* * There is not point to enable virtualize x2apic without enable * apicv
@@ -8367,6 +8374,12 @@ static void nested_vmx_vmexit(struct kvm_vcpu *vcpu)/* Update TSC_OFFSET if TSC was changed while L2 ran */ vmcs_write64 (TSC_OFFSET , vmx->nested.vmcs01_tsc_offset); +if (vmx->nested.change_vmcs01_virtual_x2apic_mode) { + vmx->nested.change_vmcs01_virtual_x2apic_mode = false; +vmx_set_virtual_x2apic_mode (vcpu, + vcpu->arch.apic_base &X2APIC_ENABLE ); + } +/* This is needed for same reason as it was needed in prepare_vmcs02 */ vmx->host_rsp =0 ;
Signature · 1 line
2.10.1
PATCH 67/84 IB/ipoib: Fix memory corruption in ipoib cm mode connect flow
In reply to Jiri SlabyFrom: Erez Shitrit <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 546481c2816ea3c061ee9d5658eb48070f69212e upstream.
When a new CM connection is being requested, ipoib driver copies data from the path pointer in the CM/tx object, the path object might be invalid at the point and memory corruption will happened later when now the CM driver will try using that data.
The next scenario demonstrates it:
neigh_add_path --> ipoib_cm_create_tx --> queue_work (pointer to path is in the cm/tx struct) #while the work is still in the queue, #the port goes down and causes the ipoib_flush_paths: ipoib_flush_paths --> path_free --> kfree(path) #at this point the work scheduled starts. ipoib_cm_tx_start --> copy from the (invalid)path pointer: (memcpy(&pathrec, &p->path->pathrec, sizeof pathrec);) -> memory corruption.
To fix that the driver now starts the CM/tx connection only if that specific path exists in the general paths database.
This check is protected with the relevant locks, and uses the gid from the neigh member in the CM/tx object which is valid according to the ref count that was taken by the CM/tx.
--- drivers/infiniband/ulp/ipoib/ipoib.h | 1 + drivers/infiniband/ulp/ipoib/ipoib_cm.c | 16 ++++++++++++++++ drivers/infiniband/ulp/ipoib/ipoib_main.c | 2 +- 3 files changed, 18 insertions(+), 1 deletion(-)
drivers/infiniband/ulp/ipoib/ipoib.h +1 -0
@@ -460,6 +460,7 @@ void ipoib_send(struct net_device *dev, struct sk_buff *skb, struct ipoib_ah *address, u32 qpn);void ipoib_reap_ah (struct work_struct *work); +struct ipoib_path *__path_find (struct net_device *dev,void *gid);void ipoib_mark_paths_invalid (struct net_device *dev);void ipoib_flush_paths (struct net_device *dev);struct ipoib_dev_priv *ipoib_intf_alloc (const char *format);
drivers/infiniband/ulp/ipoib/ipoib_cm.c +16 -0
@@ -1288,6 +1288,8 @@ void ipoib_cm_destroy_tx(struct ipoib_cm_tx *tx) } } +#define QPN_AND_OPTIONS_OFFSET 4 +static void ipoib_cm_tx_start (struct work_struct *work) { struct ipoib_dev_priv *priv = container_of(work, struct ipoib_dev_priv,
@@ -1296,6 +1298,7 @@ static void ipoib_cm_tx_start(struct work_struct *work)struct ipoib_neigh *neigh;struct ipoib_cm_tx *p;unsigned long flags; +struct ipoib_path *path;int ret;struct ib_sa_path_rec pathrec;
@@ -1308,7 +1311,19 @@ static void ipoib_cm_tx_start(struct work_struct *work) p =list_entry (priv->cm.start_list.next,typeof (*p), list);list_del_init (&p->list); neigh = p->neigh; + qpn =IPOIB_QPN (neigh->daddr); +/* +* As long as the search is with these 2 locks, +* path existence indicates its validity. +*/ + path =__path_find (dev, neigh->daddr +QPN_AND_OPTIONS_OFFSET ); +if (!path) { +pr_info ("%s ignore not valid path %pI6\n" , + __func__, + neigh->daddr +QPN_AND_OPTIONS_OFFSET ); + goto free_neigh; + }memcpy (&pathrec, &p->path->pathrec,sizeof pathrec);spin_unlock_irqrestore (&priv->lock, flags);
@@ -1320,6 +1335,7 @@ static void ipoib_cm_tx_start(struct work_struct *work)spin_lock_irqsave (&priv->lock, flags);if (ret) { +free_neigh: neigh = p->neigh;if (neigh) { neigh->cm =NULL ;
drivers/infiniband/ulp/ipoib/ipoib_main.c +1 -1
@@ -251,7 +251,7 @@ int ipoib_set_mode(struct net_device *dev, const char *buf)return -EINVAL ; } -static struct ipoib_path *__path_find (struct net_device *dev,void *gid) +struct ipoib_path *__path_find (struct net_device *dev,void *gid) {struct ipoib_dev_priv *priv =netdev_priv (dev);struct rb_node *n = priv->path_tree.rb_node;
Signature · 1 line
2.10.1
PATCH 68/84 IB/core: Fix use after free in send_leave function
In reply to Jiri SlabyFrom: Erez Shitrit <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 68c6bcdd8bd00394c234b915ab9b97c74104130c upstream.
The function send_leave sets the member: group->query_id (group->query_id = ret) after calling the sa_query, but leave_handler can be executed before the setting and it might delete the group object, and will get a memory corruption.
Additionally, this patch gets rid of group->query_id variable which is not used.
--- drivers/infiniband/core/multicast.c | 13 ++----------- 1 file changed, 2 insertions(+), 11 deletions(-)
drivers/infiniband/core/multicast.c +2 -11
@@ -106,7 +106,6 @@ struct mcast_group {atomic_t refcount;enum mcast_group_state state;struct ib_sa_query *query; -int query_id;u16 pkey_index;u8 leave_state;int retries;
@@ -339,11 +338,7 @@ static int send_join(struct mcast_group *group, struct mcast_member *member) member->multicast.comp_mask,3000 ,GFP_KERNEL , join_handler, group, &group->query); -if (ret >=0 ) { - group->query_id = ret; - ret =0 ; - } -return ret; +return (ret >0 ) ?0 : ret; }static int send_leave (struct mcast_group *group,u8 leave_state)
@@ -363,11 +358,7 @@ static int send_leave(struct mcast_group *group, u8 leave_state)IB_SA_MCMEMBER_REC_JOIN_STATE ,3000 ,GFP_KERNEL , leave_handler, group, &group->query); -if (ret >=0 ) { - group->query_id = ret; - ret =0 ; - } -return ret; +return (ret >0 ) ?0 : ret; } static void join_group(struct mcast_group *group, struct mcast_member *member,
Signature · 1 line
2.10.1
PATCH 69/84 IB/ipoib: Don't allow MC joins during light MC flush
In reply to Jiri SlabyFrom: Alex Vesker <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 344bacca8cd811809fc33a249f2738ab757d327f upstream.
This fix solves a race between light flush and on the fly joins. Light flush doesn't set the device to down and unset IPOIB_OPER_UP flag, this means that if while flushing we have a MC join in progress and the QP was attached to BC MGID we can have a mismatches when re-attaching a QP to the BC MGID.
The light flush would set the broadcast group to NULL causing an on the fly join to rejoin and reattach to the BC MCG as well as adding the BC MGID to the multicast list. The flush process would later on remove the BC MGID and detach it from the QP. On the next flush the BC MGID is present in the multicast list but not found when trying to detach it because of the previous double attach and single detach.
[18332.714265] ------------[ cut here ]------------ [18332.717775] WARNING: CPU: 6 PID: 3767 at drivers/infiniband/core/verbs.c:280 ib_dealloc_pd+0xff/0x120 [ib_core] ... [18332.775198] Hardware name: Red Hat KVM, BIOS Bochs 01/01/2011 [18332.779411] 0000000000000000 ffff8800b50dfbb0 ffffffff813fed47 0000000000000000 [18332.784960] 0000000000000000 ffff8800b50dfbf0 ffffffff8109add1 0000011832f58300 [18332.790547] ffff880226a596c0 ffff880032482000 ffff880032482830 ffff880226a59280 [18332.796199] Call Trace: [18332.798015] [<ffffffff813fed47>] dump_stack+0x63/0x8c [18332.801831] [<ffffffff8109add1>] __warn+0xd1/0xf0 [18332.805403] [<ffffffff8109aebd>] warn_slowpath_null+0x1d/0x20 [18332.809706] [<ffffffffa025d90f>] ib_dealloc_pd+0xff/0x120 [ib_core] [18332.814384] [<ffffffffa04f3d7c>] ipoib_transport_dev_cleanup+0xfc/0x1d0 [ib_ipoib] [18332.820031] [<ffffffffa04ed648>] ipoib_ib_dev_cleanup+0x98/0x110 [ib_ipoib] [18332.825220] [<ffffffffa04e62c8>] ipoib_dev_cleanup+0x2d8/0x550 [ib_ipoib] [18332.830290] [<ffffffffa04e656f>] ipoib_uninit+0x2f/0x40 [ib_ipoib] [18332.834911] [<ffffffff81772a8a>] rollback_registered_many+0x1aa/0x2c0 [18332.839741] [<ffffffff81772bd1>] rollback_registered+0x31/0x40 [18332.844091] [<ffffffff81773b18>] unregister_netdevice_queue+0x48/0x80 [18332.848880] [<ffffffffa04f489b>] ipoib_vlan_delete+0x1fb/0x290 [ib_ipoib] [18332.853848] [<ffffffffa04df1cd>] delete_child+0x7d/0xf0 [ib_ipoib] [18332.858474] [<ffffffff81520c08>] dev_attr_store+0x18/0x30 [18332.862510] [<ffffffff8127fe4a>] sysfs_kf_write+0x3a/0x50 [18332.866349] [<ffffffff8127f4e0>] kernfs_fop_write+0x120/0x170 [18332.870471] [<ffffffff81207198>] __vfs_write+0x28/0xe0 [18332.874152] [<ffffffff810e09bf>] ? percpu_down_read+0x1f/0x50 [18332.878274] [<ffffffff81208062>] vfs_write+0xa2/0x1a0 [18332.881896] [<ffffffff812093a6>] SyS_write+0x46/0xa0 [18332.885632] [<ffffffff810039b7>] do_syscall_64+0x57/0xb0 [18332.889709] [<ffffffff81883321>] entry_SYSCALL64_slow_path+0x25/0x25 [18332.894727] ---[ end trace 09ebbe31f831ef17 ]---
--- drivers/infiniband/ulp/ipoib/ipoib_ib.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/infiniband/ulp/ipoib/ipoib_ib.c +9 -0
@@ -1029,8 +1029,17 @@ static void __ipoib_ib_dev_flush(struct ipoib_dev_priv *priv, }if (level ==IPOIB_FLUSH_LIGHT ) { +int oper_up;ipoib_mark_paths_invalid (dev); +/* Set IPoIB operation as down to prevent races between: +* the flush flow which leaves MCG and on the fly joins +* which can happen during that time. mcast restart task +* should deal with join requests we missed. +*/ + oper_up =test_and_clear_bit (IPOIB_FLAG_OPER_UP , &priv->flags);ipoib_mcast_dev_flush (dev); +if (oper_up) +set_bit (IPOIB_FLAG_OPER_UP , &priv->flags); }if (level >=IPOIB_FLUSH_NORMAL )
Signature · 1 line
2.10.1
PATCH 70/84 IB/mlx4: Fix incorrect MC join state bit-masking on SR-IOV
In reply to Jiri SlabyFrom: Alex Vesker <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit e5ac40cd66c2f3cd11bc5edc658f012661b16347 upstream.
Because of an incorrect bit-masking done on the join state bits, when handling a join request we failed to detect a difference between the group join state and the request join state when joining as send only full member (0x8). This caused the MC join request not to be sent. This issue is relevant only when SRIOV is enabled and SM supports send only full member.
This fix separates scope bits and join states bits a nibble each.
--- drivers/infiniband/hw/mlx4/mcg.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
drivers/infiniband/hw/mlx4/mcg.c +7 -7
@@ -483,7 +483,7 @@ static u8 get_leave_state(struct mcast_group *group)if (!group->members[i]) leave_state |= (1 << i); -return leave_state & (group->rec.scope_join_state &7 ); +return leave_state & (group->rec.scope_join_state &0xf ); }static int join_group (struct mcast_group *group,int slave,u8 join_mask)
@@ -558,8 +558,8 @@ static void mlx4_ib_mcg_timeout_handler(struct work_struct *work) }else mcg_warn_group (group,"DRIVER BUG\n" ); }else if (group->state ==MCAST_LEAVE_SENT ) { -if (group->rec.scope_join_state &7 ) - group->rec.scope_join_state &=0xf8 ; +if (group->rec.scope_join_state &0xf ) + group->rec.scope_join_state &=0xf0 ; group->state =MCAST_IDLE ;mutex_unlock (&group->lock);if (release_group (group,1 ))
@@ -599,7 +599,7 @@ static int handle_leave_req(struct mcast_group *group, u8 leave_mask,static int handle_join_req (struct mcast_group *group,u8 join_mask,struct mcast_req *req) { -u8 group_join_state = group->rec.scope_join_state &7 ; +u8 group_join_state = group->rec.scope_join_state &0xf ;int ref =0 ;u16 status;struct ib_sa_mcmember_data *sa_data = (struct ib_sa_mcmember_data *)req->sa_mad.data;
@@ -684,8 +684,8 @@ static void mlx4_ib_mcg_work_handler(struct work_struct *work)u8 cur_join_state; resp_join_state = ((struct ib_sa_mcmember_data *) - group->response_sa_mad.data)->scope_join_state &7 ; - cur_join_state = group->rec.scope_join_state &7 ; + group->response_sa_mad.data)->scope_join_state &0xf ; + cur_join_state = group->rec.scope_join_state &0xf ;if (method ==IB_MGMT_METHOD_GET_RESP ) {/* successfull join */
@@ -704,7 +704,7 @@ process_requests: req = list_first_entry(&group->pending_list, struct mcast_req, group_list); sa_data = (struct ib_sa_mcmember_data *)req->sa_mad.data; - req_join_state = sa_data->scope_join_state &0x7 ; + req_join_state = sa_data->scope_join_state &0xf ;/* For a leave request, we will immediately answer the VF, and * update our internal counters. The actual leave will be sent
Signature · 1 line
2.10.1
PATCH 71/84 USB: serial: cp210x: fix hardware flow-control disable
In reply to Jiri SlabyFrom: Konstantin Shkolnyy <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit a377f9e906af4df9071ba8ddba60188cb4013d93 upstream.
A bug in the CRTSCTS handling caused RTS to alternate between
CRTSCTS=0 => "RTS is transmit active signal" and CRTSCTS=1 => "RTS is used for receive flow control"
instead of
CRTSCTS=0 => "RTS is statically active" and CRTSCTS=1 => "RTS is used for receive flow control"
This only happened after first having enabled CRTSCTS.
--- drivers/usb/serial/cp210x.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/serial/cp210x.c +1 -1
@@ -858,7 +858,7 @@ static void cp210x_set_termios(struct tty_struct *tty, }else { modem_ctl[0 ] &= ~0x7B ; modem_ctl[0 ] |=0x01 ; - modem_ctl[1 ] |=0x40 ; + modem_ctl[1 ] =0x40 ;dev_dbg (dev,"%s - flow control = NONE\n" , __func__); }
Signature · 1 line
2.10.1
PATCH 72/84 usb: misc: legousbtower: Fix NULL pointer deference
In reply to Jiri SlabyFrom: Greg Kroah-Hartman <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 2fae9e5a7babada041e2e161699ade2447a01989 upstream.
This patch fixes a NULL pointer dereference caused by a race codition in the probe function of the legousbtower driver. It re-structures the probe function to only register the interface after successfully reading the board's firmware ID.
The probe function does not deregister the usb interface after an error receiving the devices firmware ID. The device file registered (/dev/usb/legousbtower%d) may be read/written globally before the probe function returns. When tower_delete is called in the probe function (after an r/w has been initiated), core dev structures are deleted while the file operation functions are still running. If the 0 address is mappable on the machine, this vulnerability can be used to create a Local Priviege Escalation exploit via a write-what-where condition by remapping dev->interrupt_out_buffer in tower_write. A forged USB device and local program execution would be required for LPE. The USB device would have to delay the control message in tower_probe and accept the control urb in tower_open whilst guest code initiated a write to the device file as tower_delete is called from the error in tower_probe.
This bug has existed since 2003. Patch tested by emulated device.
--- drivers/usb/misc/legousbtower.c | 35 +++++++++++++++++------------------ 1 file changed, 17 insertions(+), 18 deletions(-)
drivers/usb/misc/legousbtower.c +17 -18
@@ -899,24 +899,6 @@ static int tower_probe (struct usb_interface *interface, const struct usb_device dev->interrupt_in_interval = interrupt_in_interval ? interrupt_in_interval : dev->interrupt_in_endpoint->bInterval; dev->interrupt_out_interval = interrupt_out_interval ? interrupt_out_interval : dev->interrupt_out_endpoint->bInterval; -/* we can register the device now, as it is ready */ -usb_set_intfdata (interface, dev); - - retval =usb_register_dev (interface, &tower_class); - -if (retval) { -/* something prevented us from registering this driver */ -dev_err (idev,"Not able to get a minor for this device.\n" ); -usb_set_intfdata (interface,NULL ); - goto error; - } - dev->minor = interface->minor; - -/* let the user know what node this device is now attached to */ -dev_info (&interface->dev,"LEGO USB Tower #%d now attached to major " -"%d minor %d\n" , (dev->minor -LEGO_USB_TOWER_MINOR_BASE ), -USB_MAJOR , dev->minor); -/* get the firmware version and log it */ result = usb_control_msg (udev, usb_rcvctrlpipe(udev, 0),
@@ -937,6 +919,23 @@ static int tower_probe (struct usb_interface *interface, const struct usb_device get_version_reply.minor, le16_to_cpu(get_version_reply.build_no)); +/* we can register the device now, as it is ready */ +usb_set_intfdata (interface, dev); + + retval =usb_register_dev (interface, &tower_class); + +if (retval) { +/* something prevented us from registering this driver */ +dev_err (idev,"Not able to get a minor for this device.\n" ); +usb_set_intfdata (interface,NULL ); + goto error; + } + dev->minor = interface->minor; + +/* let the user know what node this device is now attached to */ +dev_info (&interface->dev,"LEGO USB Tower #%d now attached to major " +"%d minor %d\n" , (dev->minor -LEGO_USB_TOWER_MINOR_BASE ), +USB_MAJOR , dev->minor); exit:return retval;
Signature · 1 line
2.10.1
PATCH 73/84 USB: serial: cp210x: Add ID for a Juniper console
In reply to Jiri SlabyFrom: Kyle Jones <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit decc5360f23e9efe0252094f47f57f254dcbb3a9 upstream.
--- drivers/usb/serial/cp210x.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/serial/cp210x.c +1 -0
@@ -117,6 +117,7 @@ static const struct usb_device_id id_table[] = { { USB_DEVICE(0x10C4, 0x8411) }, /* Kyocera GPS Module */ { USB_DEVICE(0x10C4, 0x8418) }, /* IRZ Automation Teleport SG-10 GSM/GPRS Modem */ { USB_DEVICE(0x10C4, 0x846E) }, /* BEI USB Sensor Interface (VCP) */ + { USB_DEVICE(0x10C4, 0x8470) }, /* Juniper Networks BX Series System Console */ { USB_DEVICE(0x10C4, 0x8477) }, /* Balluff RFID */ { USB_DEVICE(0x10C4, 0x84B6) }, /* Starizona Hyperion */ { USB_DEVICE(0x10C4, 0x85EA) }, /* AC-Services IBUS-IF */
Signature · 1 line
2.10.1
PATCH 74/84 Revert "usbtmc: convert to devm_kzalloc"
In reply to Jiri SlabyFrom: Greg Kroah-Hartman <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit ab21b63e8aedfc73565dd9cdd51eb338341177cb upstream.
This reverts commit e6c7efdcb76f11b04e3d3f71c8d764ab75c9423b.
Turns out it was totally wrong. The memory is supposed to be bound to the kref, as the original code was doing correctly, not the device/driver binding as the devm_kzalloc() would cause.
This fixes an oops when read would be called after the device was unbound from the driver.
--- drivers/usb/class/usbtmc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/usb/class/usbtmc.c +2 -1
@@ -122,6 +122,7 @@ static void usbtmc_delete(struct kref *kref)struct usbtmc_device_data *data =to_usbtmc_data (kref);usb_put_dev (data->usb_dev); +kfree (data); }static int usbtmc_open (struct inode *inode,struct file *filp)
@@ -1101,7 +1102,7 @@ static int usbtmc_probe(struct usb_interface *intf,dev_dbg (&intf->dev,"%s called\n" , __func__); - data =devm_kzalloc (&intf->dev,sizeof (*data),GFP_KERNEL ); + data =kmalloc (sizeof (*data),GFP_KERNEL );if (!data) {dev_err (&intf->dev,"Unable to allocate kernel memory\n" );return -ENOMEM ;
Signature · 1 line
2.10.1
PATCH 75/84 ACPICA: acpi_get_sleep_type_data: Reduce warnings
In reply to Jiri SlabyFrom: Prarit Bhargava <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit a59b679ab85635737947310323f2f2bcfa0664a7 upstream.
ACPICA commit 7bb77313091e52a846df4c9c2bea90be31bfb9d8
Eliminate warnings for "not found" _Sx errors, since these are optional. Original NOT_FOUND status is still returned.
Original changes by Prarit Bhargava.
ACPICA BZ 1208.
--- drivers/acpi/acpica/hwxface.c | 24 +++++++++++++++++------- 1 file changed, 17 insertions(+), 7 deletions(-)
drivers/acpi/acpica/hwxface.c +17 -7
@@ -495,11 +495,20 @@ acpi_get_sleep_type_data(u8 sleep_state, u8 *sleep_type_a, u8 *sleep_type_b)* Evaluate the \_Sx namespace object containing the register values * for this state */ - info->relative_pathname = -ACPI_CAST_PTR (char, acpi_gbl_sleep_state_names[sleep_state]); + info->relative_pathname =ACPI_CAST_PTR (char, + acpi_gbl_sleep_state_names + [sleep_state]); + status =acpi_ns_evaluate (info);if (ACPI_FAILURE (status)) { - goto cleanup; +if (status ==AE_NOT_FOUND ) { + +/* The _Sx states are optional, ignore NOT_FOUND */ + + goto final_cleanup; + } + + goto warning_cleanup; }/* Must have a return object */
@@ -508,7 +517,7 @@ acpi_get_sleep_type_data(u8 sleep_state, u8 *sleep_type_a, u8 *sleep_type_b)ACPI_ERROR ((AE_INFO ,"No Sleep State object returned from [%s]" , info->relative_pathname)); status =AE_AML_NO_RETURN_VALUE ; - goto cleanup; + goto warning_cleanup; }/* Return object must be of type Package */
@@ -517,7 +526,7 @@ acpi_get_sleep_type_data(u8 sleep_state, u8 *sleep_type_a, u8 *sleep_type_b)ACPI_ERROR ((AE_INFO ,"Sleep State return object is not a Package" )); status =AE_AML_OPERAND_TYPE ; - goto cleanup1; + goto return_value_cleanup; }/*
@@ -561,16 +570,17 @@ acpi_get_sleep_type_data(u8 sleep_state, u8 *sleep_type_a, u8 *sleep_type_b)break ; } - cleanup1: +return_value_cleanup:acpi_ut_remove_reference (info->return_object); - cleanup: +warning_cleanup:if (ACPI_FAILURE (status)) {ACPI_EXCEPTION ((AE_INFO , status,"While evaluating Sleep State [%s]" , info->relative_pathname)); } +final_cleanup:ACPI_FREE (info);return_ACPI_STATUS (status); }
Signature · 1 line
2.10.1
PATCH 76/84 security: let security modules use PTRACE_MODE_* with bitmasks
In reply to Jiri SlabyFrom: Jann Horn <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 3dfb7d8cdbc7ea0c2970450e60818bb3eefbad69 upstream.
It looks like smack and yama weren't aware that the ptrace mode can have flags ORed into it - PTRACE_MODE_NOAUDIT until now, but only for /proc/$pid/stat, and with the PTRACE_MODE_*CREDS patch, all modes have flags ORed into them.
[js] no smack changes in 3.12 as the code is not there yet
--- security/yama/yama_lsm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
security/yama/yama_lsm.c +2 -2
@@ -292,7 +292,7 @@ int yama_ptrace_access_check(struct task_struct *child,return rc;/* require ptrace target be a child of ptracer on attach */ -if (mode ==PTRACE_MODE_ATTACH ) { +if (mode &PTRACE_MODE_ATTACH ) {switch (ptrace_scope) {case YAMA_SCOPE_DISABLED :/* No additional restrictions. */
@@ -318,7 +318,7 @@ int yama_ptrace_access_check(struct task_struct *child, } } -if (rc) { +if (rc && (mode &PTRACE_MODE_NOAUDIT ) ==0 ) {printk_ratelimited (KERN_NOTICE "ptrace of pid %d was attempted by: %s (pid %d)\n" , child->pid, current->comm, current->pid);
Signature · 1 line
2.10.1
PATCH 77/84 KVM: PPC: Book3S PR: Ignore PMU SPRs
In reply to Jiri SlabyFrom: Alexander Graf <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit f8f6eb0d189cf2724af5ebc8cad460c78fb1994e upstream.
When we expose a POWER8 CPU into the guest, it will start accessing PMU SPRs that we don't emulate. Just ignore accesses to them.
--- arch/powerpc/kvm/book3s_emulate.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
arch/powerpc/kvm/book3s_emulate.c +14 -0
@@ -459,6 +459,13 @@ int kvmppc_core_emulate_mtspr(struct kvm_vcpu *vcpu, int sprn, ulong spr_val)case SPRN_WPAR_GEKKO :case SPRN_MSSSR0 :case SPRN_DABR : +#ifdef CONFIG_PPC_BOOK3S_64 +case SPRN_MMCRS : +case SPRN_MMCRA : +case SPRN_MMCR0 : +case SPRN_MMCR1 : +case SPRN_MMCR2 : +#endif break ; unprivileged:default :
@@ -557,6 +564,13 @@ int kvmppc_core_emulate_mfspr(struct kvm_vcpu *vcpu, int sprn, ulong *spr_val)case SPRN_WPAR_GEKKO :case SPRN_MSSSR0 :case SPRN_DABR : +#ifdef CONFIG_PPC_BOOK3S_64 +case SPRN_MMCRS : +case SPRN_MMCRA : +case SPRN_MMCR0 : +case SPRN_MMCR1 : +case SPRN_MMCR2 : +#endif *spr_val =0 ;break ;default :
Signature · 1 line
2.10.1
PATCH 78/84 KVM: PPC: Book3S PR: Emulate TIR register
In reply to Jiri SlabyFrom: Alexander Graf <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit a5948fa092a04dfd6b9ee31c99eb6896c158eb08 upstream.
In parallel to the Processor ID Register (PIR) threaded POWER8 also adds a Thread ID Register (TIR). Since PR KVM doesn't emulate more than one thread per core, we can just always expose 0 here.
--- arch/powerpc/kvm/book3s_emulate.c | 1 + 1 file changed, 1 insertion(+)
arch/powerpc/kvm/book3s_emulate.c +1 -0
@@ -570,6 +570,7 @@ int kvmppc_core_emulate_mfspr(struct kvm_vcpu *vcpu, int sprn, ulong *spr_val)case SPRN_MMCR0 :case SPRN_MMCR1 :case SPRN_MMCR2 : +case SPRN_TIR :#endif *spr_val =0 ;break ;
Signature · 1 line
2.10.1
PATCH 79/84 ALSA: ali5451: Fix out-of-bound position reporting
In reply to Jiri SlabyFrom: Takashi Iwai <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit db68577966abc1aeae4ec597b3dcfa0d56e92041 upstream.
The pointer callbacks of ali5451 driver may return the value at the boundary occasionally, and it results in the kernel warning like
snd_ali5451 0000:00:06.0: BUG: , pos = 16384, buffer size = 16384, period size = 1024
It seems that folding the position offset is enough for fixing the warning and no ill-effect has been seen by that.
--- sound/pci/ali5451/ali5451.c | 2 ++ 1 file changed, 2 insertions(+)
sound/pci/ali5451/ali5451.c +2 -0
@@ -1422,6 +1422,7 @@ snd_ali_playback_pointer(struct snd_pcm_substream *substream)spin_unlock (&codec->reg_lock);snd_ali_printk ("playback pointer returned cso=%xh.\n" , cso); + cso %= runtime->buffer_size;return cso; }
@@ -1442,6 +1443,7 @@ static snd_pcm_uframes_t snd_ali_pointer(struct snd_pcm_substream *substream) cso =inw (ALI_REG (codec,ALI_CSO_ALPHA_FMS +2 ));spin_unlock (&codec->reg_lock); + cso %= runtime->buffer_size;return cso; }
Signature · 1 line
2.10.1
PATCH 80/84 ALSA: usb-line6: use the same declaration as definition in header for MIDI manufacturer ID
In reply to Jiri SlabyFrom: Takashi Sakamoto <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 8da08ca03b73593d5299893bf29fc08569c3fb5f upstream.
Currently, usb-line6 module exports an array of MIDI manufacturer ID and usb-pod module uses it. However, the declaration is not the definition in common header. The difference is explicit length of array. Although compiler calculates it and everything goes well, it's better to use the same representation between definition and declaration.
This commit fills the length of array for usb-line6 module. As a small good sub-effect, this commit suppress below warnings from static analysis by sparse v0.5.0.
sound/usb/line6/driver.c:274:43: error: cannot size expression sound/usb/line6/driver.c:275:16: error: cannot size expression sound/usb/line6/driver.c:276:16: error: cannot size expression sound/usb/line6/driver.c:277:16: error: cannot size expression
--- drivers/staging/line6/driver.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/line6/driver.c +1 -1
@@ -83,7 +83,7 @@ static struct line6_properties line6_properties_table[] = {/* This is Line6's MIDI manufacturer ID. */ -const unsigned char line6_midi_id[] = { +const unsigned char line6_midi_id[3 ] = {0x00 ,0x01 ,0x0c };
Signature · 1 line
2.10.1
PATCH 81/84 mfd: 88pm80x: Double shifting bug in suspend/resume
In reply to Jiri SlabyFrom: Dan Carpenter <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 9a6dc644512fd083400a96ac4a035ac154fe6b8d upstream.
set_bit() and clear_bit() take the bit number so this code is really doing "1 << (1 << irq)" which is a double shift bug. It's done consistently so it won't cause a problem unless "irq" is more than 4.
--- include/linux/mfd/88pm80x.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
include/linux/mfd/88pm80x.h +2 -2
@@ -349,7 +349,7 @@ static inline int pm80x_dev_suspend(struct device *dev)int irq =platform_get_irq (pdev,0 );if (device_may_wakeup (dev)) -set_bit ((1 << irq), &chip->wu_flag); +set_bit (irq, &chip->wu_flag);return 0 ; }
@@ -361,7 +361,7 @@ static inline int pm80x_dev_resume(struct device *dev)int irq =platform_get_irq (pdev,0 );if (device_may_wakeup (dev)) -clear_bit ((1 << irq), &chip->wu_flag); +clear_bit (irq, &chip->wu_flag);return 0 ; }
Signature · 1 line
2.10.1
PATCH 82/84 mfd: wm8350-i2c: Make sure the i2c regmap functions are compiled
In reply to Jiri SlabyFrom: Uwe Kleine-König <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 88003fb10f1fc606e1704611c62ceae95fd1d7da upstream.
This fixes a compile failure:
drivers/built-in.o: In function `wm8350_i2c_probe': core.c:(.text+0x828b0): undefined reference to `__devm_regmap_init_i2c' Makefile:953: recipe for target 'vmlinux' failed
--- drivers/mfd/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/mfd/Kconfig +1 -0
@@ -1129,6 +1129,7 @@ config MFD_WM8350 config MFD_WM8350_I2C bool "Wolfson Microelectronics WM8350 with I2C" select MFD_WM8350 + select REGMAP_I2C depends on I2C=y help The WM8350 is an integrated audio and power management
Signature · 1 line
2.10.1
PATCH 83/84 KVM: PPC: Book3s PR: Allow access to unprivileged MMCR2 register
In reply to Jiri SlabyFrom: Thomas Huth <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit fa73c3b25bd8d0d393dc6109a1dba3c2aef0451e upstream.
The MMCR2 register is available twice, one time with number 785 (privileged access), and one time with number 769 (unprivileged, but it can be disabled completely). In former times, the Linux kernel was using the unprivileged register 769 only, but since commit 8dd75ccb571f3c92c ("powerpc: Use privileged SPR number for MMCR2"), it uses the privileged register 785 instead. The KVM-PR code then of course also switched to use the SPR 785, but this is causing older guest kernels to crash, since these kernels still access 769 instead. So to support older kernels with KVM-PR again, we have to support register 769 in KVM-PR, too.
--- arch/powerpc/include/asm/reg.h | 1 + arch/powerpc/kvm/book3s_emulate.c | 2 ++ 2 files changed, 3 insertions(+)
arch/powerpc/include/asm/reg.h +1 -0
@@ -648,6 +648,7 @@#define MMCR0_FCHV 0x00000001UL/* freeze conditions in hypervisor mode */ #define SPRN_MMCR1 798#define SPRN_MMCR2 785 +#define SPRN_UMMCR2 769#define SPRN_MMCRA 0x312#define MMCRA_SDSYNC 0x80000000UL/* SDAR synced with SIAR */ #define MMCRA_SDAR_DCACHE_MISS 0x40000000UL
arch/powerpc/kvm/book3s_emulate.c +2 -0
@@ -465,6 +465,7 @@ int kvmppc_core_emulate_mtspr(struct kvm_vcpu *vcpu, int sprn, ulong spr_val)case SPRN_MMCR0 :case SPRN_MMCR1 :case SPRN_MMCR2 : +case SPRN_UMMCR2 :#endif break ; unprivileged:
@@ -570,6 +571,7 @@ int kvmppc_core_emulate_mfspr(struct kvm_vcpu *vcpu, int sprn, ulong *spr_val)case SPRN_MMCR0 :case SPRN_MMCR1 :case SPRN_MMCR2 : +case SPRN_UMMCR2 :case SPRN_TIR :#endif *spr_val =0 ;
Signature · 1 line
2.10.1
PATCH 84/84 KVM: MIPS: Drop other CPU ASIDs on guest MMU changes
In reply to Jiri SlabyFrom: James Hogan <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 91e4f1b6073dd680d86cdb7e42d7cccca9db39d8 upstream.
When a guest TLB entry is replaced by TLBWI or TLBWR, we only invalidate TLB entries on the local CPU. This doesn't work correctly on an SMP host when the guest is migrated to a different physical CPU, as it could pick up stale TLB mappings from the last time the vCPU ran on that physical CPU.
Therefore invalidate both user and kernel host ASIDs on other CPUs, which will cause new ASIDs to be generated when it next runs on those CPUs.
We're careful only to do this if the TLB entry was already valid, and only for the kernel ASID where the virtual address it mapped is outside of the guest user address range.
--- arch/mips/kvm/kvm_mips_emul.c | 57 ++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 53 insertions(+), 4 deletions(-)
arch/mips/kvm/kvm_mips_emul.c +53 -4
@@ -310,6 +310,47 @@ enum emulation_result kvm_mips_emul_tlbr(struct kvm_vcpu *vcpu)return er; } +/** +* kvm_mips_invalidate_guest_tlb() - Indicates a change in guest MMU map. +* @vcpu: VCPU with changed mappings. +* @tlb: TLB entry being removed. +* +* This is called to indicate a single change in guest MMU mappings, so that we +* can arrange TLB flushes on this and other CPUs. +*/ +static void kvm_mips_invalidate_guest_tlb (struct kvm_vcpu *vcpu, +struct kvm_mips_tlb *tlb) +{ +int cpu, i; +bool user; + +/* No need to flush for entries which are already invalid */ +if (!((tlb->tlb_lo[0 ] | tlb->tlb_lo[1 ]) &ENTRYLO_V )) +return ; +/* User address space doesn't need flushing for KSeg2/3 changes */ + user = tlb->tlb_hi <KVM_GUEST_KSEG0 ; + +preempt_disable (); + +/* +* Probe the shadow host TLB for the entry being overwritten, if one +* matches, invalidate it +*/ +kvm_mips_host_tlb_inv (vcpu, tlb->tlb_hi); + +/* Invalidate the whole ASID on other CPUs */ + cpu =smp_processor_id (); +for_each_possible_cpu (i) { +if (i == cpu) +continue ; +if (user) + vcpu->arch.guest_user_asid[i] =0 ; + vcpu->arch.guest_kernel_asid[i] =0 ; + } + +preempt_enable (); +} +/* Write Guest TLB Entry @ Index */ enum emulation_result kvm_mips_emul_tlbwi (struct kvm_vcpu *vcpu) {
@@ -332,8 +373,8 @@ enum emulation_result kvm_mips_emul_tlbwi(struct kvm_vcpu *vcpu) tlb = &vcpu->arch.guest_tlb[index];#if 1 -/* Probe the shadow host TLB for the entry being overwritten, if one matches, invalidate it */ -kvm_mips_host_tlb_inv (vcpu, tlb->tlb_hi); + +kvm_mips_invalidate_guest_tlb (vcpu, tlb);#endif tlb->tlb_mask =kvm_read_c0_guest_pagemask (cop0);
@@ -374,8 +415,7 @@ enum emulation_result kvm_mips_emul_tlbwr(struct kvm_vcpu *vcpu) tlb = &vcpu->arch.guest_tlb[index];#if 1 -/* Probe the shadow host TLB for the entry being overwritten, if one matches, invalidate it */ -kvm_mips_host_tlb_inv (vcpu, tlb->tlb_hi); +kvm_mips_invalidate_guest_tlb (vcpu, tlb);#endif tlb->tlb_mask =kvm_read_c0_guest_pagemask (cop0);
@@ -419,6 +459,7 @@ kvm_mips_emulate_CP0(uint32_t inst, uint32_t *opc, uint32_t cause,int32_t rt, rd, copz, sel, co_bit, op;uint32_t pc = vcpu->arch.pc;unsigned long curr_pc; +int cpu, i;/* * Update PC and hold onto current PC in case there is
@@ -538,8 +579,16 @@ kvm_mips_emulate_CP0(uint32_t inst, uint32_t *opc, uint32_t cause,ASID_MASK , vcpu->arch.gprs[rt] & ASID_MASK); +preempt_disable ();/* Blow away the shadow host TLBs */ kvm_mips_flush_host_tlb (1 ); + cpu =smp_processor_id (); +for_each_possible_cpu (i) +if (i != cpu) { + vcpu->arch.guest_user_asid[i] =0 ; + vcpu->arch.guest_kernel_asid[i] =0 ; + } +preempt_enable (); }kvm_write_c0_guest_entryhi (cop0, vcpu->arch.gprs[rt]);
Signature · 1 line
2.10.1
Quoted 8 lines · Jiri Slaby
This is the start of the stable review cycle for the 3.12.65 release. There are 84 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed Oct 19 09:48:13 CEST 2016. Anything received after that time might be too late.
Build results:
total: 128 pass: 128 fail: 0 Qemu test results: total: 85 pass: 85 fail: 0
Details are available at http://kerneltests.org/builders.
Guenter
Quoted 8 lines · Jiri Slaby
This is the start of the stable review cycle for the 3.12.65 release. There are 84 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed Oct 19 09:48:13 CEST 2016. Anything received after that time might be too late.
Quoted 8 lines
The whole patch series can be found in one patch at:
http://kernel.org/pub/linux/kernel/people/jirislaby/stable-review/patch-3.12.65-rc1.xzand the diffstat can be found below.
thanks,
js===============
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
Signature · 5 lines
Shuah Khan Sr. Linux Kernel Developer Open Source Innovation Group Samsung Research America(Silicon Valley) [email protected]