3.12.71-stable review
Subsystems (2)
cover 3.12.71-stable review
This is the start of the stable review cycle for the 3.12.71 release. There are 113 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed Mar 8 10:10:31 CET 2017. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
http://kernel.org/pub/linux/kernel/people/jirislaby/stable-review/patch-3.12.71-rc1.xz
and the diffstat can be found below.
thanks,
js
===============
Aleksander Morgado (1):
USB: serial: qcserial: add Dell DW5570 QDL
Aleksandr Makarov (2):
USB: serial: option: add WeTelecom WM-D200
USB: serial: option: add WeTelecom 0x6802 and 0x6803 products
Alexei Starovoitov (1):
net: filter: x86: fix JIT address randomization
Alexey Khoroshilov (1):
USB: cdc-acm: fix double usb_autopm_put_interface() in
acm_port_activate()
Alexey Kodanev (1):
tcp: initialize max window for a new fastopen socket
Ander Conselvan de Oliveira (1):
drm/i915: Don't leak edid in intel_crt_detect_ddc()
Andrey Konovalov (1):
dccp: fix freeing skb too early for IPV6_RECVPKTINFO
Andrey Ryabinin (1):
drm/i915: fix use-after-free in page_flip_completed()
Andy Shevchenko (1):
platform/x86: intel_mid_powerbtn: Set IRQ_ONESHOT
Anoob Soman (1):
packet: Do not call fanout_release from atomic contexts
Arnd Bergmann (2):
ISDN: eicon: silence misleading array-bounds warning
s5k4ecgx: select CRC32 helper
Arvind Yadav (1):
ata: sata_mv:- Handle return value of devm_ioremap.
Ben Hutchings (1):
ocfs2: do not write error flag to user structure we cannot copy
from/to
Bjørn Mork (3):
qmi_wwan/cdc_ether: add device ID for HP lt2523 (Novatel E371) WWAN
card
USB: serial: option: add device ID for HP lt2523 (Novatel E371)
cpufreq: fix garbage kobjects on errors during suspend/resume
Christoph Hellwig (1):
scsi: move the nr_phys_segments assert into scsi_init_io
Chuck Lever (1):
nfs: Don't increment lock sequence ID after NFS4ERR_MOVED
Claudiu Manoil (1):
gianfar: Check if phydev present on ethtool -A
Colin Ian King (1):
rtc: interface: ignore expired timers when enqueuing new timers
Dan Carpenter (6):
ipv6: pointer math error in ip6_tnl_parse_tlv_enc_lim()
af_packet: remove a stray tab in packet_set_ring() 6lowpan: release device on error path
mfd: pm8921: Potential NULL dereference in pm8921_remove()
Staging: vt6655-6: potential NULL dereference in
hostap_disable_hostapd()
drm/nv50/disp: min/max are reversed in nv50_crtc_gamma_set()
Daniel Borkmann (2):
net: 6lowpan: fix lowpan_header_create non-compression memcpy call
net: sctp: rework multihoming retransmission path selection to rfc4960
Dave Martin (2):
tile/ptrace: Preserve previous registers for short regset write
ARM: 8643/3: arm/ptrace: Preserve previous registers for short regset
write
David S. Miller (1):
irda: Fix lockdep annotations in hashbin_delete().
Einar Jón (1):
can: c_can_pci: fix null-pointer-deref in c_can_start() - set device
pointer
Eric Dumazet (13):
sysctl: fix proc_doulongvec_ms_jiffies_minmax()
net: fix harmonize_features() vs NETIF_F_HIGHDMA
can: Fix kernel panic at security_sock_rcv_skb
ipv6: fix ip6_tnl_parse_tlv_enc_lim()
tcp: fix 0 divide in __tcp_select_window()
net: use a work queue to defer net_disable_timestamp() work
ipv4: keep skb->dst around in presence of IP options
netlabel: out of bound access in cipso_v4_validate()
ip6_gre: fix ip6gre_err() invalid reads
tcp: avoid infinite loop in tcp_splice_read()
l2tp: do not use udp_ioctl()
net/llc: avoid BUG_ON() in skb_orphan()
packet: fix races in fanout_add()
Eryu Guan (1):
ext4: validate s_first_meta_bg at mount time
Francesco Ruggeri (1):
net: possible use after free in dst_release
Hannes Frederic Sowa (1):
ipv6: simplify detection of first operational link-local address on
interface
Heiko Carstens (1):
net: filter: s390: fix JIT address randomization
Helge Deller (1):
parisc: Don't use BITS_PER_LONG in userspace-exported swab.h header
Herbert Xu (1):
tun: Fix TUN_PKT_STRIP setting
Ilia Mirkin (1):
drm/nouveau/nv1a,nv1f/disp: fix memory clock rate retrieval
J. Bruce Fields (1):
svcrpc: fix oops in absence of krb5 module
Jan Beulich (1):
x86/Kconfig: Simplify X86_IO_APIC dependencies
Javier Martinez Canillas (1):
tty: serial: msm: Fix module autoload
Jingoo Han (1):
PCI: mvebu: Use max_t() instead of max(resource_size_t,)
Johan Hovold (9):
USB: serial: mos7840: fix another NULL-deref at open
USB: serial: ftdi_sio: fix modem-status error handling
USB: serial: ftdi_sio: fix extreme low-latency setting
USB: serial: ftdi_sio: fix line-status over-reporting
USB: serial: spcp8x5: fix modem-status handling
USB: serial: opticon: fix CTS retrieval at open
USB: serial: ark3116: fix register-accessor error handling
USB: cdc-acm: fix open and suspend race
USB: cdc-acm: fix failed open not being detected
Johannes Thumshirn (1):
scsi: don't BUG_ON() empty DMA transfers
Kees Cook (1):
fbdev: color map copying bounds checking
Kefeng Wang (1):
ipv6: addrconf: Avoid addrconf_disable_change() using RCU read-side
lock
Ken Lin (1):
USB: serial: cp210x: add new IDs for GE Bx50v3 boards
Kinglong Mee (1):
SUNRPC: cleanup ida information when removing sunrpc module
Lei Liu (1):
USB: serial: option: add even more ZTE device ids
Li RongQing (1):
ipv6: fix the use of pcpu_tstats in ip6_tunnel
Lukáš Lalinský (1):
USB: Add quirk for WORLDE easykey.25 MIDI keyboard
Marcel J.E. Mol (1):
USB: serial: pl2303: add ATEN device ID
Marcelo Ricardo Leitner (1):
sctp: avoid BUG_ON on sctp_wait_for_sndbuf
Mauro Carvalho Chehab (1):
siano: make it work again with CONFIG_VMAP_STACK
Maxime Jayat (1):
net: socket: fix recvmmsg not returning error from sock_error
Michael Schenk (1):
rtlwifi: rtl_usb: Fix for URB leaking when doing ifconfig up/down
Michal Hocko (1):
mm, fs: check for fatal signals in do_generic_file_read()
Miklos Szeredi (1):
vfs: fix uninitialized flags in splice_to_pipe()
Nicholas Bellinger (1):
target: Fix COMPARE_AND_WRITE ref leak for non GOOD status
Oliver Hartkopp (1):
can: bcm: fix hrtimer/tasklet termination in bcm op removal
Rabin Vincent (2):
cifs: initialize file_info_lock sched/debug: Don't dump sched debug info in SysRq-W
Rafael J. Wysocki (1):
cpufreq: Clean up after a failing light-weight initialization
Russell King (1):
crypto: caam - fix non-hmac hashes
Salvatore Benedetto (1):
crypto: api - Clear CRYPTO_ALG_DEAD bit before registering an alg
Sergey Senozhatsky (1):
printk: use rcuidle console tracepoint
Steffen Klassert (1):
vti4: Don't count header length twice.
Steffen Maier (1):
scsi: zfcp: fix use-after-free by not tracing WKA port open/close on
failed send
Stephen Smalley (1):
selinux: fix off-by-one in setprocattr
Takashi Iwai (2):
ALSA: seq: Fix race at creating a queue
ALSA: seq: Don't handle loop timeout at snd_seq_pool_done()
Theodore Ts'o (1):
ext4: fix fencepost in s_first_meta_bg validation
Thomas Gleixner (2):
x86/platform/goldfish: Prevent unconditional loading
goldfish: Sanitize the broken interrupt handler
Thomas Petazzoni (1):
PCI: mvebu: split PCIe BARs into multiple MBus windows when needed
Thorsten Horstmann (1):
mac80211: Fix adding of mesh vendor IEs
Toshi Kani (1):
mm/memory_hotplug.c: check start_pfn in test_pages_in_a_zone()
Vineet Gupta (2):
ARC: [arcompact] handle unaligned access delay slot corner case
ARC: [arcompact] brown paper bag bug in unaligned access delay slot
fixup
Viresh Kumar (2):
cpufreq: remove sysfs files for CPUs which failed to come back after
resume
cpufreq: preserve user_policy across suspend/resume
WANG Cong (2):
af_unix: move unix_mknod() out of bindlock
ping: fix a null pointer dereference
Willem de Bruijn (3):
tun: read vnet_hdr_sz once
macvtap: read vnet_hdr_size once
packet: round up linear to header len
Yang Yang (1):
futex: Move futex_init() to core_initcall
Yegor Yefremov (1):
can: ti_hecc: add missing prepare and unprepare of the clock
lei liu (1):
USB: serial: option: add more ZTE device ids
Documentation/kernel-parameters.txt | 4 + arch/arc/kernel/unaligned.c | 3 +- arch/arm/kernel/ptrace.c | 2 +- arch/parisc/include/asm/bitops.h | 8 +- arch/parisc/include/uapi/asm/bitsperlong.h | 2 - arch/parisc/include/uapi/asm/swab.h | 5 +- arch/s390/net/bpf_jit_comp.c | 2 +- arch/tile/kernel/ptrace.c | 2 +- arch/x86/Kconfig | 2 +- arch/x86/net/bpf_jit_comp.c | 2 +- arch/x86/platform/goldfish/goldfish.c | 14 ++- crypto/algapi.c | 1 + drivers/ata/sata_mv.c | 3 + drivers/cpufreq/cpufreq.c | 101 ++++++++-------- drivers/crypto/caam/caamhash.c | 1 + drivers/gpu/drm/i915/intel_crt.c | 9 +- drivers/gpu/drm/i915/intel_display.c | 4 +- drivers/gpu/drm/nouveau/dispnv04/hw.c | 3 +- drivers/gpu/drm/nouveau/nv50_display.c | 2 +- drivers/isdn/hardware/eicon/message.c | 3 +- drivers/media/i2c/Kconfig | 1 + drivers/media/usb/siano/smsusb.c | 18 ++- drivers/mfd/pm8921-core.c | 9 +- drivers/net/can/c_can/c_can_pci.c | 1 + drivers/net/can/ti_hecc.c | 16 ++- drivers/net/ethernet/freescale/gianfar_ethtool.c | 3 + drivers/net/macvtap.c | 4 +- drivers/net/tun.c | 20 ++-- drivers/net/usb/cdc_ether.c | 8 ++ drivers/net/usb/qmi_wwan.c | 7 ++ drivers/net/wireless/rtlwifi/usb.c | 18 +++ drivers/pci/host/pci-mvebu.c | 88 +++++++++++--- drivers/platform/goldfish/pdev_bus.c | 13 ++- drivers/platform/x86/intel_mid_powerbtn.c | 4 +- drivers/rtc/interface.c | 16 ++- drivers/s390/scsi/zfcp_fsf.c | 8 +- drivers/scsi/scsi_lib.c | 17 +-- drivers/staging/vt6655/hostap.c | 3 +- drivers/staging/vt6656/hostap.c | 3 +- drivers/target/target_core_sbc.c | 8 +- drivers/tty/serial/msm_serial.c | 1 + drivers/usb/class/cdc-acm.c | 17 +-- drivers/usb/core/quirks.c | 4 + drivers/usb/serial/ark3116.c | 13 ++- drivers/usb/serial/cp210x.c | 2 + drivers/usb/serial/ftdi_sio.c | 31 +++-- drivers/usb/serial/mos7840.c | 4 +- drivers/usb/serial/opticon.c | 2 +- drivers/usb/serial/option.c | 140 ++++++++++++++++++++++- drivers/usb/serial/pl2303.c | 1 + drivers/usb/serial/pl2303.h | 1 + drivers/usb/serial/qcserial.c | 1 + drivers/usb/serial/spcp8x5.c | 8 +- drivers/video/fbcmap.c | 26 +++-- fs/cifs/readdir.c | 1 + fs/ext4/super.c | 9 ++ fs/ocfs2/ioctl.c | 129 +++++++-------------- fs/splice.c | 1 + include/linux/can/core.h | 7 +- include/linux/nfs4.h | 3 +- include/linux/sunrpc/clnt.h | 1 + include/net/cipso_ipv4.h | 4 + include/net/if_inet6.h | 1 - include/net/sock.h | 1 + kernel/futex.c | 2 +- kernel/printk/printk.c | 2 +- kernel/sched/core.c | 3 +- kernel/sysctl.c | 1 + mm/filemap.c | 5 + mm/memory_hotplug.c | 12 +- net/can/af_can.c | 12 +- net/can/af_can.h | 3 +- net/can/bcm.c | 27 +++-- net/can/gw.c | 2 +- net/can/raw.c | 4 +- net/core/dev.c | 35 +++--- net/core/dst.c | 3 +- net/core/sock.c | 6 + net/dccp/input.c | 3 +- net/ieee802154/6lowpan.c | 6 +- net/ipv4/cipso_ipv4.c | 4 + net/ipv4/ip_sockglue.c | 9 +- net/ipv4/ip_vti.c | 1 - net/ipv4/ping.c | 2 + net/ipv4/tcp.c | 6 + net/ipv4/tcp_ipv4.c | 1 + net/ipv4/tcp_output.c | 6 +- net/ipv6/addrconf.c | 42 +++---- net/ipv6/ip6_gre.c | 41 ++++--- net/ipv6/ip6_tunnel.c | 55 ++++++--- net/irda/irqueue.c | 34 +++--- net/l2tp/l2tp_core.h | 1 + net/l2tp/l2tp_ip.c | 27 ++++- net/l2tp/l2tp_ip6.c | 2 +- net/llc/llc_conn.c | 3 + net/llc/llc_sap.c | 3 + net/mac80211/mesh.c | 2 +- net/packet/af_packet.c | 55 ++++++--- net/sctp/associola.c | 129 +++++++++++++-------- net/sctp/socket.c | 3 +- net/socket.c | 4 +- net/sunrpc/auth_gss/gss_rpc_xdr.c | 2 +- net/sunrpc/clnt.c | 5 + net/sunrpc/sunrpc_syms.c | 1 + net/unix/af_unix.c | 27 +++-- security/selinux/hooks.c | 2 +- sound/core/seq/seq_memory.c | 9 +- sound/core/seq/seq_queue.c | 33 +++--- 108 files changed, 982 insertions(+), 499 deletions(-)
Signature · 1 line
2.12.0
PATCH 1/113 x86/Kconfig: Simplify X86_IO_APIC dependencies
From: Jan Beulich <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit b1da1e715d4faf01468b7f45f7098922bc85ea8e upstream.
Since dependencies are transitive, we don't really need to repeat those of X86_UP_IOAPIC.
Furthermore avoid the symbol getting entered into .config when it is off by having the default simply Y and the dependencies solely handled via the intended for that purpose "depends on".
--- arch/x86/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/Kconfig +1 -1
@@ -894,7 +894,7 @@ config X86_LOCAL_APIC config X86_IO_APIC def_bool y - depends on X86_64 || SMP || X86_32_NON_STANDARD || X86_UP_IOAPIC || PCI_MSI + depends on X86_LOCAL_APIC || X86_UP_IOAPIC config X86_VISWS_APIC def_bool y
Signature · 1 line
2.12.0
PATCH 2/113 crypto: caam - fix non-hmac hashes
From: Russell King <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit a0118c8b2be9297aed8e915c60b4013326b256d4 upstream.
Since 6de62f15b581 ("crypto: algif_hash - Require setkey before accept(2)"), the AF_ALG interface requires userspace to provide a key to any algorithm that has a setkey method. However, the non-HMAC algorithms are not keyed, so setting a key is unnecessary.
Fix this by removing the setkey method from the non-keyed hash algorithms.
--- drivers/crypto/caam/caamhash.c | 1 + 1 file changed, 1 insertion(+)
drivers/crypto/caam/caamhash.c +1 -0
@@ -1799,6 +1799,7 @@ caam_hash_alloc(struct device *ctrldev, struct caam_hash_template *template, template->name);snprintf (alg->cra_driver_name,CRYPTO_MAX_ALG_NAME ,"%s" , template->driver_name); + t_alg->ahash_alg.setkey =NULL ; } alg->cra_module =THIS_MODULE ; alg->cra_init = caam_hash_cra_init;
Signature · 1 line
2.12.0
PATCH 3/113 net: possible use after free in dst_release
In reply to Jiri SlabyFrom: Francesco Ruggeri <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 07a5d38453599052aff0877b16bb9c1585f08609 upstream.
dst_release should not access dst->flags after decrementing __refcnt to 0. The dst_entry may be in dst_busy_list and dst_gc_task may dst_destroy it before dst_release gets a chance to access dst->flags.
--- net/core/dst.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/core/dst.c +2 -1
@@ -280,12 +280,13 @@ void dst_release(struct dst_entry *dst) {if (dst) {int newrefcnt; +unsigned short nocache = dst->flags &DST_NOCACHE ; newrefcnt =atomic_dec_return (&dst->__refcnt);if (unlikely (newrefcnt <0 ))net_warn_ratelimited ("%s: dst:%p refcnt:%d\n" , __func__, dst, newrefcnt); -if (!newrefcnt &&unlikely (dst->flags &DST_NOCACHE )) +if (!newrefcnt &&unlikely (nocache))call_rcu (&dst->rcu_head, dst_destroy_rcu); } }
Signature · 1 line
2.12.0
PATCH 4/113 fbdev: color map copying bounds checking
In reply to Jiri SlabyFrom: Kees Cook <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 2dc705a9930b4806250fbf5a76e55266e59389f2 upstream.
Copying color maps to userspace doesn't check the value of to->start, which will cause kernel heap buffer OOB read due to signedness wraps.
CVE-2016-8405
--- drivers/video/fbcmap.c | 26 ++++++++++++++------------ 1 file changed, 14 insertions(+), 12 deletions(-)
drivers/video/fbcmap.c +14 -12
@@ -163,17 +163,18 @@ void fb_dealloc_cmap(struct fb_cmap *cmap)int fb_copy_cmap (const struct fb_cmap *from,struct fb_cmap *to) { -int tooff =0 , fromoff =0 ; -int size; +unsigned int tooff =0 , fromoff =0 ; +size_t size;if (to->start > from->start) fromoff = to->start - from->start;else tooff = from->start - to->start; - size = to->len - tooff; -if (size > (int ) (from->len - fromoff)) - size = from->len - fromoff; -if (size <=0 ) +if (fromoff >= from->len || tooff >= to->len) +return -EINVAL ; + + size =min_t (size_t, to->len - tooff, from->len - fromoff); +if (size ==0 )return -EINVAL ; size *=sizeof (u16);
@@ -187,17 +188,18 @@ int fb_copy_cmap(const struct fb_cmap *from, struct fb_cmap *to)int fb_cmap_to_user (const struct fb_cmap *from,struct fb_cmap_user *to) { -int tooff =0 , fromoff =0 ; -int size; +unsigned int tooff =0 , fromoff =0 ; +size_t size;if (to->start > from->start) fromoff = to->start - from->start;else tooff = from->start - to->start; - size = to->len - tooff; -if (size > (int ) (from->len - fromoff)) - size = from->len - fromoff; -if (size <=0 ) +if (fromoff >= from->len || tooff >= to->len) +return -EINVAL ; + + size =min_t (size_t, to->len - tooff, from->len - fromoff); +if (size ==0 )return -EINVAL ; size *=sizeof (u16);
Signature · 1 line
2.12.0
PATCH 5/113 tile/ptrace: Preserve previous registers for short regset write
In reply to Jiri SlabyFrom: Dave Martin <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit fd7c99142d77dc4a851879a66715abf12a3193fb upstream.
Ensure that if userspace supplies insufficient data to PTRACE_SETREGSET to fill all the registers, the thread's old registers are preserved.
--- arch/tile/kernel/ptrace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/tile/kernel/ptrace.c +1 -1
@@ -110,7 +110,7 @@ static int tile_gpr_set(struct task_struct *target, const void *kbuf, const void __user *ubuf) { int ret; -struct pt_regs regs; +struct pt_regs regs = *task_pt_regs (target); ret =user_regset_copyin (&pos, &count, &kbuf, &ubuf, ®s,0 ,sizeof (regs));
Signature · 1 line
2.12.0
PATCH 6/113 sysctl: fix proc_doulongvec_ms_jiffies_minmax()
In reply to Jiri SlabyFrom: Eric Dumazet <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit ff9f8a7cf935468a94d9927c68b00daae701667e upstream.
We perform the conversion between kernel jiffies and ms only when exporting kernel value to user space.
We need to do the opposite operation when value is written by user.
Only matters when HZ != 1000
--- kernel/sysctl.c | 1 + 1 file changed, 1 insertion(+)
kernel/sysctl.c +1 -0
@@ -2229,6 +2229,7 @@ static int __do_proc_doulongvec_minmax(void *data, struct ctl_table *table, intbreak ;if (neg)continue ; + val = convmul * val / convdiv;if ((min && val < *min) || (max && val > *max))continue ; *i = val;
Signature · 1 line
2.12.0
PATCH 7/113 ISDN: eicon: silence misleading array-bounds warning
In reply to Jiri SlabyFrom: Arnd Bergmann <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 950eabbd6ddedc1b08350b9169a6a51b130ebaaf upstream.
With some gcc versions, we get a warning about the eicon driver, and that currently shows up as the only remaining warning in one of the build bots:
In file included from ../drivers/isdn/hardware/eicon/message.c:30:0:eicon/message.c: In function 'mixer_notify_update':eicon/platform.h:333:18: warning: array subscript is above array bounds [-Warray-bounds]
The code is easily changed to open-code the unusual PUT_WORD() line causing this to avoid the warning.
--- drivers/isdn/hardware/eicon/message.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/isdn/hardware/eicon/message.c +2 -1
@@ -11304,7 +11304,8 @@ static void mixer_notify_update(PLCI *plci, byte others) ((CAPI_MSG *) msg)->header.ncci =0 ; ((CAPI_MSG *) msg)->info.facility_req.Selector =SELECTOR_LINE_INTERCONNECT ; ((CAPI_MSG *) msg)->info.facility_req.structs[0 ] =3 ; -PUT_WORD (&(((CAPI_MSG *) msg)->info.facility_req.structs[1 ]),LI_REQ_SILENT_UPDATE ); + ((CAPI_MSG *) msg)->info.facility_req.structs[1 ] =LI_REQ_SILENT_UPDATE &0xff ; + ((CAPI_MSG *) msg)->info.facility_req.structs[2 ] =LI_REQ_SILENT_UPDATE >>8 ; ((CAPI_MSG *) msg)->info.facility_req.structs[3 ] =0 ; w =api_put (notify_plci->appl, (CAPI_MSG *) msg);if (w != _QUEUE_FULL)
Signature · 1 line
2.12.0
PATCH 8/113 can: c_can_pci: fix null-pointer-deref in c_can_start() - set device pointer
In reply to Jiri SlabyFrom: Einar Jón <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit c97c52be78b8463ac5407f1cf1f22f8f6cf93a37 upstream.
The priv->device pointer for c_can_pci is never set, but it is used without a NULL check in c_can_start(). Setting it in c_can_pci_probe() like c_can_plat_probe() prevents c_can_pci.ko from crashing, with and without CONFIG_PM.
This might also cause the pm_runtime_*() functions in c_can.c to actually be executed for c_can_pci devices - they are the only other place where priv->device is used, but they all contain a null check.
--- drivers/net/can/c_can/c_can_pci.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/can/c_can/c_can_pci.c +1 -0
@@ -109,6 +109,7 @@ static int c_can_pci_probe(struct pci_dev *pdev, dev->irq = pdev->irq; priv->base = addr; + priv->device = &pdev->dev;if (!c_can_pci_data->freq) {dev_err (&pdev->dev,"no clock frequency defined\n" );
Signature · 1 line
2.12.0
PATCH 9/113 can: ti_hecc: add missing prepare and unprepare of the clock
In reply to Jiri SlabyFrom: Yegor Yefremov <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit befa60113ce7ea270cb51eada28443ca2756f480 upstream.
In order to make the driver work with the common clock framework, this patch converts the clk_enable()/clk_disable() to clk_prepare_enable()/clk_disable_unprepare().
Also add error checking for clk_prepare_enable().
--- drivers/net/can/ti_hecc.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-)
drivers/net/can/ti_hecc.c +12 -4
@@ -962,7 +962,12 @@ static int ti_hecc_probe(struct platform_device *pdev)netif_napi_add (ndev, &priv->napi, ti_hecc_rx_poll,HECC_DEF_NAPI_WEIGHT ); -clk_enable (priv->clk); + err =clk_prepare_enable (priv->clk); +if (err) { +dev_err (&pdev->dev,"clk_prepare_enable() failed\n" ); + goto probe_exit_clk; + } + err =register_candev (ndev);if (err) {dev_err (&pdev->dev,"register_candev() failed\n" );
@@ -995,7 +1000,7 @@ static int ti_hecc_remove(struct platform_device *pdev)struct ti_hecc_priv *priv =netdev_priv (ndev);unregister_candev (ndev); -clk_disable (priv->clk); +clk_disable_unprepare (priv->clk);clk_put (priv->clk); res =platform_get_resource (pdev,IORESOURCE_MEM ,0 );iounmap (priv->base);
@@ -1020,7 +1025,7 @@ static int ti_hecc_suspend(struct platform_device *pdev, pm_message_t state)hecc_set_bit (priv,HECC_CANMC ,HECC_CANMC_PDR ); priv->can.state =CAN_STATE_SLEEPING ; -clk_disable (priv->clk); +clk_disable_unprepare (priv->clk);return 0 ; }
@@ -1029,8 +1034,11 @@ static int ti_hecc_resume(struct platform_device *pdev) {struct net_device *dev =platform_get_drvdata (pdev);struct ti_hecc_priv *priv =netdev_priv (dev); +int err; -clk_enable (priv->clk); + err =clk_prepare_enable (priv->clk); +if (err) +return err;hecc_clear_bit (priv,HECC_CANMC ,HECC_CANMC_PDR ); priv->can.state =CAN_STATE_ERROR_ACTIVE ;
Signature · 1 line
2.12.0
PATCH 10/113 ARC: [arcompact] handle unaligned access delay slot corner case
In reply to Jiri SlabyFrom: Vineet Gupta <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 9aed02feae57bf7a40cb04ea0e3017cb7a998db4 upstream.
After emulating an unaligned access in delay slot of a branch, we pretend as the delay slot never happened - so return back to actual branch target (or next PC if branch was not taken).
Curently we did this by handling STATUS32.DE, we also need to clear the BTA.T bit, which is disregarded when returning from original misaligned exception, but could cause weirdness if it took the interrupt return path (in case interrupt was acive too)
One ARC700 customer ran into this when enabling unaligned access fixup for kernel mode accesses as well
--- arch/arc/kernel/unaligned.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/arc/kernel/unaligned.c +2 -1
@@ -240,8 +240,9 @@ int misaligned_fixup(unsigned long address, struct pt_regs *regs,if (state.fault) goto fault; +/* clear any remanants of delay slot */ if (delay_mode (regs)) { - regs->ret = regs->bta; + regs->ret = regs->bta ~1U; regs->status32 &= ~STATUS_DE_MASK ; }else { regs->ret += state.instr_len;
Signature · 1 line
2.12.0
PATCH 11/113 parisc: Don't use BITS_PER_LONG in userspace-exported swab.h header
In reply to Jiri SlabyFrom: Helge Deller <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 2ad5d52d42810bed95100a3d912679d8864421ec upstream.
In swab.h the "#if BITS_PER_LONG > 32" breaks compiling userspace programs if BITS_PER_LONG is #defined by userspace with the sizeof() compiler builtin.
Solve this problem by using __BITS_PER_LONG instead. Since we now #include asm/bitsperlong.h avoid further potential userspace pollution by moving the #define of SHIFT_PER_LONG to bitops.h which is not exported to userspace.
This patch unbreaks compiling qemu on hppa/parisc.
--- arch/parisc/include/asm/bitops.h | 8 +++++++- arch/parisc/include/uapi/asm/bitsperlong.h | 2 -- arch/parisc/include/uapi/asm/swab.h | 5 +++-- 3 files changed, 10 insertions(+), 5 deletions(-)
arch/parisc/include/asm/bitops.h +7 -1
@@ -6,7 +6,7 @@#endif #include <linux/compiler.h> -#include <asm/types.h> /* for BITS_PER_LONG/SHIFT_PER_LONG */ +#include <asm/types.h> #include <asm/byteorder.h> #include <linux/atomic.h>
@@ -16,6 +16,12 @@* to include/asm-i386/bitops.h or kerneldoc */ +#if __BITS_PER_LONG ==64 +#define SHIFT_PER_LONG 6 +#else +#define SHIFT_PER_LONG 5 +#endif +#define CHOP_SHIFTCOUNT (x) (((unsigned long) (x)) & (BITS_PER_LONG - 1))
arch/parisc/include/uapi/asm/bitsperlong.h +0 -2
@@ -9,10 +9,8 @@*/ #if (defined(__KERNEL__) && defined(CONFIG_64BIT )) || defined (__LP64__)#define __BITS_PER_LONG 64 -#define SHIFT_PER_LONG 6#else #define __BITS_PER_LONG 32 -#define SHIFT_PER_LONG 5#endif #include <asm-generic/bitsperlong.h>
arch/parisc/include/uapi/asm/swab.h +3 -2
@@ -1,6 +1,7 @@#ifndef _PARISC_SWAB_H#define _PARISC_SWAB_H +#include <asm/bitsperlong.h> #include <linux/types.h> #include <linux/compiler.h>
@@ -38,7 +39,7 @@ static inline __attribute_const__ __u32 __arch_swab32(__u32 x) }#define __arch_swab32 __arch_swab32 -#if BITS_PER_LONG >32 +#if __BITS_PER_LONG >32 /* ** From "PA-RISC 2.0 Architecture", HP Professional Books. ** See Appendix I page 8 , "Endian Byte Swapping".
@@ -61,6 +62,6 @@ static inline __attribute_const__ __u64 __arch_swab64(__u64 x)return x; }#define __arch_swab64 __arch_swab64 -#endif /* BITS_PER_LONG > 32 */ +#endif /* __BITS_PER_LONG > 32 */ #endif /* _PARISC_SWAB_H */
Signature · 1 line
2.12.0
PATCH 12/113 nfs: Don't increment lock sequence ID after NFS4ERR_MOVED
In reply to Jiri SlabyFrom: Chuck Lever <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 059aa734824165507c65fd30a55ff000afd14983 upstream.
Xuan Qi reports that the Linux NFSv4 client failed to lock a file that was migrated. The steps he observed on the wire:
1. The client sent a LOCK request to the source server
2. The source server replied NFS4ERR_MOVED
3. The client switched to the destination server
4. The client sent the same LOCK request to the destination server with a bumped lock sequence ID
5. The destination server rejected the LOCK request with NFS4ERR_BAD_SEQID
RFC 3530 section 8.1.5 provides a list of NFS errors which do not bump a lock sequence ID.
However, RFC 3530 is now obsoleted by RFC 7530. In RFC 7530 section 9.1.7, this list has been updated by the addition of NFS4ERR_MOVED.
--- include/linux/nfs4.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
include/linux/nfs4.h +2 -1
@@ -240,7 +240,7 @@ enum nfsstat4 {static inline bool seqid_mutating_err (u32 err) { -/* rfc 3530 section 8.1.5: */ +/* See RFC 7530, section 9.1.7 */ switch (err) {case NFS4ERR_STALE_CLIENTID :case NFS4ERR_STALE_STATEID :
@@ -249,6 +249,7 @@ static inline bool seqid_mutating_err(u32 err)case NFS4ERR_BADXDR :case NFS4ERR_RESOURCE :case NFS4ERR_NOFILEHANDLE : +case NFS4ERR_MOVED :return false; };return true;
Signature · 1 line
2.12.0
PATCH 13/113 SUNRPC: cleanup ida information when removing sunrpc module
In reply to Jiri SlabyFrom: Kinglong Mee <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit c929ea0b910355e1876c64431f3d5802f95b3d75 upstream.
After removing sunrpc module, I get many kmemleak information as, unreferenced object 0xffff88003316b1e0 (size 544):
comm "gssproxy", pid 2148, jiffies 4294794465 (age 4200.081s) hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffffb0cfb58a>] kmemleak_alloc+0x4a/0xa0
[<ffffffffb03507fe>] kmem_cache_alloc+0x15e/0x1f0
[<ffffffffb0639baa>] ida_pre_get+0xaa/0x150
[<ffffffffb0639cfd>] ida_simple_get+0xad/0x180
[<ffffffffc06054fb>] nlmsvc_lookup_host+0x4ab/0x7f0 [lockd]
[<ffffffffc0605e1d>] lockd+0x4d/0x270 [lockd]
[<ffffffffc06061e5>] param_set_timeout+0x55/0x100 [lockd]
[<ffffffffc06cba24>] svc_defer+0x114/0x3f0 [sunrpc]
[<ffffffffc06cbbe7>] svc_defer+0x2d7/0x3f0 [sunrpc]
[<ffffffffc06c71da>] rpc_show_info+0x8a/0x110 [sunrpc]
[<ffffffffb044a33f>] proc_reg_write+0x7f/0xc0
[<ffffffffb038e41f>] __vfs_write+0xdf/0x3c0
[<ffffffffb0390f1f>] vfs_write+0xef/0x240
[<ffffffffb0392fbd>] SyS_write+0xad/0x130
[<ffffffffb0d06c37>] entry_SYSCALL_64_fastpath+0x1a/0xa9
[<ffffffffffffffff>] 0xffffffffffffffffI found, the ida information (dynamic memory) isn't cleanup.
--- include/linux/sunrpc/clnt.h | 1 + net/sunrpc/clnt.c | 5 +++++ net/sunrpc/sunrpc_syms.c | 1 + 3 files changed, 7 insertions(+)
include/linux/sunrpc/clnt.h +1 -0
@@ -168,5 +168,6 @@ size_t rpc_peeraddr(struct rpc_clnt *, struct sockaddr *, size_t);const char *rpc_peeraddr2str (struct rpc_clnt *,enum rpc_display_format_t );int rpc_localaddr (struct rpc_clnt *,struct sockaddr *,size_t ); +void rpc_cleanup_clids (void );#endif /* __KERNEL__ */ #endif /* _LINUX_SUNRPC_CLNT_H */
net/sunrpc/clnt.c +5 -0
@@ -315,6 +315,11 @@ out:static DEFINE_IDA (rpc_clids); +void rpc_cleanup_clids (void ) +{ +ida_destroy (&rpc_clids); +} +static int rpc_alloc_clid (struct rpc_clnt *clnt) {int clid;
net/sunrpc/sunrpc_syms.c +1 -0
@@ -111,6 +111,7 @@ out: static void __exitcleanup_sunrpc (void ) { +rpc_cleanup_clids ();rpcauth_remove_module ();cleanup_socket_xprt ();svc_cleanup_xprt_sock ();
Signature · 1 line
2.12.0
PATCH 14/113 drm/i915: Don't leak edid in intel_crt_detect_ddc()
In reply to Jiri SlabyFrom: Ander Conselvan de Oliveira <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit c34f078675f505c4437919bb1897b1351f16a050 upstream.
In the path where intel_crt_detect_ddc() detects a CRT, if would return true without freeing the edid.
--- drivers/gpu/drm/i915/intel_crt.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/gpu/drm/i915/intel_crt.c +5 -4
@@ -475,6 +475,7 @@ static bool intel_crt_detect_ddc(struct drm_connector *connector)struct drm_i915_private *dev_priv = crt->base.base.dev->dev_private;struct edid *edid;struct i2c_adapter *i2c; +bool ret = false;BUG_ON (crt->base.type !=INTEL_OUTPUT_ANALOG );
@@ -491,17 +492,17 @@ static bool intel_crt_detect_ddc(struct drm_connector *connector)*/ if (!is_digital) {DRM_DEBUG_KMS ("CRT detected via DDC:0x50 [EDID]\n" ); -return true; + ret = true; + }else { +DRM_DEBUG_KMS ("CRT not detected via DDC:0x50 [EDID reports a digital panel]\n" ); } - -DRM_DEBUG_KMS ("CRT not detected via DDC:0x50 [EDID reports a digital panel]\n" ); }else {DRM_DEBUG_KMS ("CRT not detected via DDC:0x50 [no valid EDID found]\n" ); }kfree (edid); -return false; +return ret; } static enum drm_connector_status
Signature · 6 lines
2.12.0 _______________________________________________ Intel-gfx mailing list [email protected] https://lists.freedesktop.org/mailman/listinfo/intel-gfx
PATCH 15/113 s5k4ecgx: select CRC32 helper
In reply to Jiri SlabyFrom: Arnd Bergmann <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit c739c0a7c3c2472d7562b8f802cdce44d2597c8b upstream.
A rare randconfig build failure shows up in this driver when the CRC32 helper is not there:
drivers/media/built-in.o: In function `s5k4ecgx_s_power':
s5k4ecgx.c:(.text+0x9eb4): undefined reference to `crc32_le'
This adds the 'select' that all other users of this function have.
--- drivers/media/i2c/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/media/i2c/Kconfig +1 -0
@@ -590,6 +590,7 @@ config VIDEO_S5K6AA config VIDEO_S5K4ECGX tristate "Samsung S5K4ECGX sensor support" depends on I2C && VIDEO_V4L2 && VIDEO_V4L2_SUBDEV_API + select CRC32 ---help--- This is a V4L2 sensor-level driver for Samsung S5K4ECGX 5M camera sensor with an embedded SoC image signal processor.
Signature · 1 line
2.12.0
PATCH 16/113 platform/x86: intel_mid_powerbtn: Set IRQ_ONESHOT
In reply to Jiri SlabyFrom: Andy Shevchenko <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 5a00b6c2438460b870a451f14593fc40d3c7edf6 upstream.
The commit 1c6c69525b40 ("genirq: Reject bogus threaded irq requests") starts refusing misconfigured interrupt handlers. This makes intel_mid_powerbtn not working anymore.
Add a mandatory flag to a threaded IRQ request in the driver.
--- drivers/platform/x86/intel_mid_powerbtn.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/platform/x86/intel_mid_powerbtn.c +2 -2
@@ -78,8 +78,8 @@ static int mfld_pb_probe(struct platform_device *pdev)input_set_capability (input,EV_KEY ,KEY_POWER ); - error =request_threaded_irq (irq,NULL , mfld_pb_isr,IRQF_NO_SUSPEND , -DRIVER_NAME , input); + error =request_threaded_irq (irq,NULL , mfld_pb_isr,IRQF_NO_SUSPEND | +IRQF_ONESHOT ,DRIVER_NAME , input);if (error) {dev_err (&pdev->dev,"Unable to request irq %d for mfld power" "button\n" , irq);
Signature · 1 line
2.12.0
PATCH 17/113 net: fix harmonize_features() vs NETIF_F_HIGHDMA
In reply to Jiri SlabyFrom: Eric Dumazet <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit 7be2c82cfd5d28d7adb66821a992604eb6dd112e ]
Ashizuka reported a highmem oddity and sent a patch for freescale fec driver.
But the problem root cause is that core networking stack must ensure no skb with highmem fragment is ever sent through a device that does not assert NETIF_F_HIGHDMA in its features.
We need to call illegal_highdma() from harmonize_features() regardless of CSUM checks.
--- net/core/dev.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/core/dev.c +2 -2
@@ -2489,9 +2489,9 @@ static netdev_features_t harmonize_features(struct sk_buff *skb,if (skb->ip_summed !=CHECKSUM_NONE && !can_checksum_protocol (features,skb_network_protocol (skb))) { features &= ~NETIF_F_ALL_CSUM ; - }else if (illegal_highdma (dev, skb)) { - features &= ~NETIF_F_SG ; } +if (illegal_highdma (dev, skb)) + features &= ~NETIF_F_SG ;return features; }
Signature · 1 line
2.12.0
PATCH 18/113 ipv6: addrconf: Avoid addrconf_disable_change() using RCU read-side lock
In reply to Jiri SlabyFrom: Kefeng Wang <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit 03e4deff4987f79c34112c5ba4eb195d4f9382b0 ]
Just like commit 4acd4945cd1e ("ipv6: addrconf: Avoid calling netdevice notifiers with RCU read-side lock"), it is unnecessary to make addrconf_disable_change() use RCU iteration over the netdev list, since it already holds the RTNL lock, or we may meet Illegal context switch in RCU read-side critical section.
--- net/ipv6/addrconf.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
net/ipv6/addrconf.c +1 -3
@@ -4693,8 +4693,7 @@ static void addrconf_disable_change(struct net *net, __s32 newf)struct net_device *dev;struct inet6_dev *idev; -rcu_read_lock (); -for_each_netdev_rcu (net, dev) { +for_each_netdev (net, dev) { idev =__in6_dev_get (dev);if (idev) {int changed = (!idev->cnf.disable_ipv6) ^ (!newf);
@@ -4703,7 +4702,6 @@ static void addrconf_disable_change(struct net *net, __s32 newf)dev_disable_change (idev); } } -rcu_read_unlock (); }static int addrconf_disable_ipv6 (struct ctl_table *table,int *p,int newf)
Signature · 1 line
2.12.0
PATCH 19/113 tcp: initialize max window for a new fastopen socket
In reply to Jiri SlabyFrom: Alexey Kodanev <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit 0dbd7ff3ac5017a46033a9d0a87a8267d69119d9 ]
Found that if we run LTP netstress test with large MSS (65K), the first attempt from server to send data comparable to this MSS on fastopen connection will be delayed by the probe timer.
Here is an example:
< S seq 0:0 win 43690 options [mss 65495 wscale 7 tfo cookie] length 32
> S. seq 0:0 ack 1 win 43690 options [mss 65495 wscale 7] length 0
< . ack 1 win 342 length 0Inside tcp_sendmsg(), tcp_send_mss() returns max MSS in 'mss_now', as well as in 'size_goal'. This results the segment not queued for transmition until all the data copied from user buffer. Then, inside __tcp_push_pending_frames(), it breaks on send window test and continues with the check probe timer.
Fragmentation occurs in tcp_write_wakeup()...
+0.2 > P. seq 1:43777 ack 1 win 342 length 43776
< . ack 43777, win 1365 length 0
> P. seq 43777:65001 ack 1 win 342 options [...] length 21224
...This also contradicts with the fact that we should bound to the half of the window if it is large.
Fix this flaw by correctly initializing max_window. Before that, it could have large values that affect further calculations of 'size_goal'.
[js] the code is in tcp_ipv4.c in 3.12 yet
--- net/ipv4/tcp_ipv4.c | 1 + 1 file changed, 1 insertion(+)
net/ipv4/tcp_ipv4.c +1 -0
@@ -1408,6 +1408,7 @@ static int tcp_v4_conn_req_fastopen(struct sock *sk,* scaled. So correct it appropriately. */ tp->snd_wnd =ntohs (tcp_hdr (skb)->window); + tp->max_window = tp->snd_wnd;/* Activate the retrans timer so that SYNACK can be retransmitted. * The request socket is not added to the SYN table of the parent
Signature · 1 line
2.12.0
PATCH 20/113 af_unix: move unix_mknod() out of bindlock
In reply to Jiri SlabyFrom: WANG Cong <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit 0fb44559ffd67de8517098b81f675fa0210f13f0 ]
Dmitry reported a deadlock scenario:
unix_bind() path:u->bindlock ==> sb_writer
do_splice() path:sb_writer ==> pipe->mutex ==> u->bindlock
In the unix_bind() code path, unix_mknod() does not have to be done with u->bindlock held, since it is a pure fs operation, so we can just move unix_mknod() out.
--- net/unix/af_unix.c | 27 ++++++++++++++++----------- 1 file changed, 16 insertions(+), 11 deletions(-)
net/unix/af_unix.c +16 -11
@@ -978,6 +978,7 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)unsigned int hash;struct unix_address *addr;struct hlist_head *list; +struct path path = {NULL ,NULL }; err = -EINVAL ;if (sunaddr->sun_family !=AF_UNIX )
@@ -993,9 +994,20 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) goto out; addr_len = err; +if (sun_path[0 ]) { +umode_t mode =S_IFSOCK | + (SOCK_INODE (sock)->i_mode & ~current_umask ()); + err =unix_mknod (sun_path, mode, &path); +if (err) { +if (err == -EEXIST ) + err = -EADDRINUSE ; + goto out; + } + } + err =mutex_lock_interruptible (&u->readlock);if (err) - goto out; + goto out_put; err = -EINVAL ;if (u->addr)
@@ -1012,16 +1024,6 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)atomic_set (&addr->refcnt,1 );if (sun_path[0 ]) { -struct path path; -umode_t mode =S_IFSOCK | - (SOCK_INODE (sock)->i_mode & ~current_umask ()); - err =unix_mknod (sun_path, mode, &path); -if (err) { -if (err == -EEXIST ) - err = -EADDRINUSE ; -unix_release_addr (addr); - goto out_up; - } addr->hash =UNIX_HASH_SIZE ; hash = path.dentry->d_inode->i_ino & (UNIX_HASH_SIZE -1 );spin_lock (&unix_table_lock);
@@ -1048,6 +1050,9 @@ out_unlock:spin_unlock (&unix_table_lock); out_up:mutex_unlock (&u->readlock); +out_put: +if (err) +path_put (&path); out:return err; }
Signature · 1 line
2.12.0
PATCH 21/113 qmi_wwan/cdc_ether: add device ID for HP lt2523 (Novatel E371) WWAN card
In reply to Jiri SlabyFrom: Bjørn Mork <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit 5b9f57516337b523f7466a53939aaaea7b78141b ]
Another rebranded Novatel E371. qmi_wwan should drive this device, while cdc_ether should ignore it. Even though the USB descriptors are plain CDC-ETHER that USB interface is a QMI interface. Ref commit 7fdb7846c9ca ("qmi_wwan/cdc_ether: add device IDs for Dell 5804 (Novatel E371) WWAN card")
--- drivers/net/usb/cdc_ether.c | 8 ++++++++ drivers/net/usb/qmi_wwan.c | 7 +++++++ 2 files changed, 15 insertions(+)
drivers/net/usb/cdc_ether.c +8 -0
@@ -487,6 +487,7 @@ static const struct driver_info wwan_info = {#define ZTE_VENDOR_ID 0x19D2#define DELL_VENDOR_ID 0x413C#define REALTEK_VENDOR_ID 0x0bda +#define HP_VENDOR_ID 0x03f0static const struct usb_device_id products[] = {/* BLACKLIST !!
@@ -633,6 +634,13 @@ static const struct usb_device_id products[] = { .driver_info = 0, }, +/* HP lt2523 (Novatel E371) - handled by qmi_wwan */ +{ +USB_DEVICE_AND_INTERFACE_INFO (HP_VENDOR_ID ,0x421d ,USB_CLASS_COMM , + USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE), + .driver_info =0 , +}, + /* AnyDATA ADU960S - handled by qmi_wwan */ { USB_DEVICE_AND_INTERFACE_INFO(0x16d5, 0x650a, USB_CLASS_COMM,
drivers/net/usb/qmi_wwan.c +7 -0
@@ -560,6 +560,13 @@ static const struct usb_device_id products[] = { USB_CDC_PROTO_NONE), .driver_info = (unsigned long )&qmi_wwan_info, }, + { /* HP lt2523 (Novatel E371) */ +USB_DEVICE_AND_INTERFACE_INFO (0x03f0 ,0x421d , +USB_CLASS_COMM , +USB_CDC_SUBCLASS_ETHERNET , +USB_CDC_PROTO_NONE ), + .driver_info = (unsigned long)&qmi_wwan_info, + }, { /* HP lt4112 LTE/HSPA+ Gobi 4G Module (Huawei me906e) */USB_DEVICE_AND_INTERFACE_INFO (0x03f0 ,0x581d ,USB_CLASS_VENDOR_SPEC ,1 ,7 ), .driver_info = (unsigned long)&qmi_wwan_info,
Signature · 1 line
2.12.0
PATCH 22/113 USB: serial: option: add WeTelecom WM-D200
In reply to Jiri SlabyFrom: Aleksandr Makarov <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 6695593e4a7659db49ac6eca98c164f7b5589f72 upstream.
Add support for WeTelecom WM-D200.
T: Bus=03 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 4 Spd=12 MxCh= 0 D: Ver= 1.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=22de ProdID=6801 Rev=00.00 S: Manufacturer=WeTelecom Incorporated S: Product=WeTelecom Mobile Products C: #Ifs= 4 Cfg#= 1 Atr=80 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) I: If#= 3 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage
--- drivers/usb/serial/option.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/usb/serial/option.c +5 -0
@@ -527,6 +527,10 @@ static void option_instat_callback(struct urb *urb);#define VIATELECOM_VENDOR_ID 0x15eb#define VIATELECOM_PRODUCT_CDS7 0x0001 +/* WeTelecom products */ +#define WETELECOM_VENDOR_ID 0x22de +#define WETELECOM_PRODUCT_WMD200 0x6801 +/* some devices interfaces need special handling due to a number of reasons */ enum option_blacklist_reason {OPTION_BLACKLIST_NONE =0 ,
@@ -1871,6 +1875,7 @@ static const struct usb_device_id option_ids[] = { { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /* OLICARD300 - MT6225 */ { USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) }, { USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) }, + { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD200, 0xff, 0xff, 0xff) }, { } /* Terminating entry */ };MODULE_DEVICE_TABLE (usb, option_ids);
Signature · 1 line
2.12.0
PATCH 23/113 USB: serial: option: add WeTelecom 0x6802 and 0x6803 products
In reply to Jiri SlabyFrom: Aleksandr Makarov <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 40d9c32525cba79130612650b1abc47c0c0f19a8 upstream.
These product IDs are listed in Windows driver.0x6803 corresponds to WeTelecom WM-D300.0x6802 name is unknown.
--- drivers/usb/serial/option.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/usb/serial/option.c +4 -0
@@ -530,6 +530,8 @@ static void option_instat_callback(struct urb *urb);/* WeTelecom products */ #define WETELECOM_VENDOR_ID 0x22de#define WETELECOM_PRODUCT_WMD200 0x6801 +#define WETELECOM_PRODUCT_6802 0x6802 +#define WETELECOM_PRODUCT_WMD300 0x6803/* some devices interfaces need special handling due to a number of reasons */ enum option_blacklist_reason {
@@ -1876,6 +1878,8 @@ static const struct usb_device_id option_ids[] = { { USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) }, { USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) }, { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD200, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_6802, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD300, 0xff, 0xff, 0xff) }, { } /* Terminating entry */ };MODULE_DEVICE_TABLE (usb, option_ids);
Signature · 1 line
2.12.0
PATCH 24/113 USB: serial: option: add more ZTE device ids
In reply to Jiri SlabyFrom: lei liu <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit f0d09463c59c2d764a6c6d492cbe6d2c77f27153 upstream.
More ZTE device ids.
--- drivers/usb/serial/option.c | 76 +++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 74 insertions(+), 2 deletions(-)
drivers/usb/serial/option.c +74 -2
@@ -1654,7 +1654,79 @@ static const struct usb_device_id option_ids[] = { .driver_info = (kernel_ulong_t)&net_intf3_blacklist }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0178, 0xff, 0xff, 0xff), .driver_info = (kernel_ulong_t)&net_intf3_blacklist }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffe9, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff42, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff43, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff44, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff45, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff46, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff47, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff48, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff49, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff4a, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff4b, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff4c, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff4d, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff4e, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff4f, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff50, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff51, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff52, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff53, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff54, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff55, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff56, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff57, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff58, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff59, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff5a, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff5b, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff5c, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff5d, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff5e, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff5f, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff60, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff61, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff62, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff63, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff64, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff65, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff66, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff67, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff68, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff69, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff6a, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff6b, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff6c, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff6d, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff6e, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff6f, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff70, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff71, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff72, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff73, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff74, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff75, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff76, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff77, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff78, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff79, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff7a, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff7b, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff7c, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff7d, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff7e, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff7f, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff80, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff81, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff82, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff83, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff84, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff85, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff86, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff87, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff88, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff89, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8a, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8b, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8c, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8d, 0xff, 0xff, 0xff) },
@@ -1665,7 +1737,7 @@ static const struct usb_device_id option_ids[] = { { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff92, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff93, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff94, 0xff, 0xff, 0xff) }, - + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffe9, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_CDMA_TECH, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC2726, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC8710T, 0xff, 0xff, 0xff) },
Signature · 1 line
2.12.0
PATCH 25/113 USB: serial: option: add even more ZTE device ids
In reply to Jiri SlabyFrom: Lei Liu <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 74d2a91aec97ab832790c9398d320413ad185321 upstream.
Add even more ZTE device ids.
--- drivers/usb/serial/option.c | 54 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 54 insertions(+)
drivers/usb/serial/option.c +54 -0
@@ -1737,6 +1737,60 @@ static const struct usb_device_id option_ids[] = { { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff92, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff93, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff94, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff9f, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffa0, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffa1, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffa2, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffa3, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffa4, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffa5, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffa6, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffa7, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffa8, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffa9, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffaa, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffab, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffac, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffae, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffaf, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffb0, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffb1, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffb2, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffb3, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffb4, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffb5, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffb6, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffb7, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffb8, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffb9, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffba, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffbb, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffbc, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffbd, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffbe, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffbf, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffc0, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffc1, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffc2, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffc3, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffc4, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffc5, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffc6, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffc7, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffc8, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffc9, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffca, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffcb, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffcc, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffcd, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffce, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffcf, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffd0, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffd1, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffd2, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffd3, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffd4, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffd5, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffe9, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_CDMA_TECH, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC2726, 0xff, 0xff, 0xff) },
Signature · 1 line
2.12.0
PATCH 26/113 drm/nouveau/nv1a,nv1f/disp: fix memory clock rate retrieval
In reply to Jiri SlabyFrom: Ilia Mirkin <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 24bf7ae359b8cca165bb30742d2b1c03a1eb23af upstream.
Based on the xf86-video-nv code, NFORCE (NV1A) and NFORCE2 (NV1F) have a different way of retrieving clocks. See the nv_hw.c:nForceUpdateArbitrationSettings function in the original code for how these clocks were accessed.
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=54587
--- drivers/gpu/drm/nouveau/dispnv04/hw.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/nouveau/dispnv04/hw.c +2 -1
@@ -224,6 +224,7 @@ nouveau_hw_get_clock(struct drm_device *dev, enum nvbios_pll_type plltype)uint32_t mpllP;pci_read_config_dword (pci_get_bus_and_slot (0 ,3 ),0x6c , &mpllP); + mpllP = (mpllP >>8 ) &0xf ;if (!mpllP) mpllP =4 ;
@@ -234,7 +235,7 @@ nouveau_hw_get_clock(struct drm_device *dev, enum nvbios_pll_type plltype)uint32_t clock;pci_read_config_dword (pci_get_bus_and_slot (0 ,5 ),0x4c , &clock); -return clock; +return clock /1000 ; } ret =nouveau_hw_get_pllvals (dev, plltype, &pllvals);
Signature · 1 line
2.12.0
PATCH 27/113 crypto: api - Clear CRYPTO_ALG_DEAD bit before registering an alg
In reply to Jiri SlabyFrom: Salvatore Benedetto <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit d6040764adcb5cb6de1489422411d701c158bb69 upstream.
Make sure CRYPTO_ALG_DEAD bit is cleared before proceeding with the algorithm registration. This fixes qat-dh registration when driver is restarted
--- crypto/algapi.c | 1 + 1 file changed, 1 insertion(+)
crypto/algapi.c +1 -0
@@ -337,6 +337,7 @@ int crypto_register_alg(struct crypto_alg *alg)struct crypto_larval *larval;int err; + alg->cra_flags &= ~CRYPTO_ALG_DEAD ; err =crypto_check_alg (alg);if (err)return err;
Signature · 1 line
2.12.0
PATCH 28/113 ata: sata_mv:- Handle return value of devm_ioremap.
In reply to Jiri SlabyFrom: Arvind Yadav <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 064c3db9c564cc5be514ac21fb4aa26cc33db746 upstream.
Here, If devm_ioremap will fail. It will return NULL. Then hpriv->base = NULL - 0x20000; Kernel can run into a NULL-pointer dereference. This error check will avoid NULL pointer dereference.
--- drivers/ata/sata_mv.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/ata/sata_mv.c +3 -0
@@ -4098,6 +4098,9 @@ static int mv_platform_probe(struct platform_device *pdev) host->iomap =NULL ; hpriv->base =devm_ioremap (&pdev->dev, res->start,resource_size (res)); +if (!hpriv->base) +return -ENOMEM ; + hpriv->base -=SATAHC0_REG_BASE ; hpriv->clk =clk_get (&pdev->dev,NULL );
Signature · 1 line
2.12.0
PATCH 29/113 svcrpc: fix oops in absence of krb5 module
In reply to Jiri SlabyFrom: "J. Bruce Fields" <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 034dd34ff4916ec1f8f74e39ca3efb04eab2f791 upstream.
Olga Kornievskaia says: "I ran into this oops in the nfsd (below) (4.10-rc3 kernel). To trigger this I had a client (unsuccessfully) try to mount the server with krb5 where the server doesn't have the rpcsec_gss_krb5 module built."
The problem is that rsci.cred is copied from a svc_cred structure that gss_proxy didn't properly initialize. Fix that.
[120408.542387] general protection fault: 0000 [#1] SMP ... [120408.565724] CPU: 0 PID: 3601 Comm: nfsd Not tainted 4.10.0-rc3+ #16 [120408.567037] Hardware name: VMware, Inc. VMware Virtual = Platform/440BX Desktop Reference Platform, BIOS 6.00 07/02/2015 [120408.569225] task: ffff8800776f95c0 task.stack: ffffc90003d58000 [120408.570483] RIP: 0010:gss_mech_put+0xb/0x20 [auth_rpcgss] ... [120408.584946] ? rsc_free+0x55/0x90 [auth_rpcgss] [120408.585901] gss_proxy_save_rsc+0xb2/0x2a0 [auth_rpcgss] [120408.587017] svcauth_gss_proxy_init+0x3cc/0x520 [auth_rpcgss] [120408.588257] ? __enqueue_entity+0x6c/0x70 [120408.589101] svcauth_gss_accept+0x391/0xb90 [auth_rpcgss] [120408.590212] ? try_to_wake_up+0x4a/0x360 [120408.591036] ? wake_up_process+0x15/0x20 [120408.592093] ? svc_xprt_do_enqueue+0x12e/0x2d0 [sunrpc] [120408.593177] svc_authenticate+0xe1/0x100 [sunrpc] [120408.594168] svc_process_common+0x203/0x710 [sunrpc] [120408.595220] svc_process+0x105/0x1c0 [sunrpc] [120408.596278] nfsd+0xe9/0x160 [nfsd] [120408.597060] kthread+0x101/0x140 [120408.597734] ? nfsd_destroy+0x60/0x60 [nfsd] [120408.598626] ? kthread_park+0x90/0x90 [120408.599448] ret_from_fork+0x22/0x30
--- net/sunrpc/auth_gss/gss_rpc_xdr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/sunrpc/auth_gss/gss_rpc_xdr.c +1 -1
@@ -260,7 +260,7 @@ static int gssx_dec_option_array(struct xdr_stream *xdr,if (!oa->data)return -ENOMEM ; - creds =kmalloc (sizeof (struct svc_cred ),GFP_KERNEL ); + creds =kzalloc (sizeof (struct svc_cred ),GFP_KERNEL );if (!creds) {kfree (oa->data);return -ENOMEM ;
Signature · 1 line
2.12.0
PATCH 30/113 cifs: initialize file_info_lock
In reply to Jiri SlabyFrom: Rabin Vincent <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 81ddd8c0c5e1cb41184d66567140cb48c53eb3d1 upstream.
file_info_lock is not initalized in initiate_cifs_search(), leading to the following splat after a simple "mount.cifs ... dir && ls dir/":
BUG: spinlock bad magic on CPU#0, ls/486 lock: 0xffff880009301110, .magic: 00000000, .owner: <none>/-1, .owner_cpu: 0 CPU: 0 PID: 486 Comm: ls Not tainted 4.9.0 #27 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) ffffc900042f3db0 ffffffff81327533 0000000000000000 ffff880009301110 ffffc900042f3dd0 ffffffff810baf75 ffff880009301110 ffffffff817ae077 ffffc900042f3df0 ffffffff810baff6 ffff880009301110 ffff880008d69900 Call Trace: [<ffffffff81327533>] dump_stack+0x65/0x92 [<ffffffff810baf75>] spin_dump+0x85/0xe0 [<ffffffff810baff6>] spin_bug+0x26/0x30 [<ffffffff810bb159>] do_raw_spin_lock+0xe9/0x130 [<ffffffff8159ad2f>] _raw_spin_lock+0x1f/0x30 [<ffffffff8127e50d>] cifs_closedir+0x4d/0x100 [<ffffffff81181cfd>] __fput+0x5d/0x160 [<ffffffff81181e3e>] ____fput+0xe/0x10 [<ffffffff8109410e>] task_work_run+0x7e/0xa0 [<ffffffff81002512>] exit_to_usermode_loop+0x92/0xa0 [<ffffffff810026f9>] syscall_return_slowpath+0x49/0x50 [<ffffffff8159b484>] entry_SYSCALL_64_fastpath+0xa7/0xa9
--- fs/cifs/readdir.c | 1 + 1 file changed, 1 insertion(+)
fs/cifs/readdir.c +1 -0
@@ -280,6 +280,7 @@ initiate_cifs_search(const unsigned int xid, struct file *file) rc = -ENOMEM ; goto error_exit; } +spin_lock_init (&cifsFile->file_info_lock); file->private_data = cifsFile; cifsFile->tlink =cifs_get_tlink (tlink); tcon =tlink_tcon (tlink);
Signature · 1 line
2.12.0
PATCH 31/113 mm/memory_hotplug.c: check start_pfn in test_pages_in_a_zone()
In reply to Jiri SlabyFrom: Toshi Kani <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit deb88a2a19e85842d79ba96b05031739ec327ff4 upstream.
Patch series "fix a kernel oops when reading sysfs valid_zones", v2.
A sysfs memory file is created for each 2GiB memory block on x86-64 when the system has 64GiB or more memory. [1] When the start address of a memory block is not backed by struct page, i.e. a memory range is not aligned by 2GiB, reading its 'valid_zones' attribute file leads to a kernel oops. This issue was observed on multiple x86-64 systems with more than 64GiB of memory. This patch-set fixes this issue.
Patch 1 first fixes an issue in test_pages_in_a_zone(), which does not test the start section.
Patch 2 then fixes the kernel oops by extending test_pages_in_a_zone() to return valid [start, end).
Note for stable kernels: The memory block size change was made by commit bdee237c0343 ("x86: mm: Use 2GB memory block size on large-memory x86-64 systems"), which was accepted to 3.9. However, this patch-set depends on (and fixes) the change to test_pages_in_a_zone() made by commit 5f0f2887f4de ("mm/memory_hotplug.c: check for missing sections in test_pages_in_a_zone()"), which was accepted to 4.4.
So, I recommend that we backport it up to 4.4.
[1] 'Commit bdee237c0343 ("x86: mm: Use 2GB memory block size on
large-memory x86-64 systems")'
This patch (of 2):
test_pages_in_a_zone() does not check 'start_pfn' when it is aligned by section since 'sec_end_pfn' is set equal to 'pfn'. Since this function is called for testing the range of a sysfs memory file, 'start_pfn' is always aligned by section.
Fix it by properly setting 'sec_end_pfn' to the next section pfn.
Also make sure that this function returns 1 only when the range belongs to a zone.
--- mm/memory_hotplug.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
mm/memory_hotplug.c +8 -4
@@ -1205,7 +1205,7 @@ int is_mem_section_removable(unsigned long start_pfn, unsigned long nr_pages) }/* -* Confirm all pages in a range [start, end) is belongs to the same zone. +* Confirm all pages in a range [start, end) belong to the same zone. */ static int test_pages_in_a_zone (unsigned long start_pfn,unsigned long end_pfn) {
@@ -1213,9 +1213,9 @@ static int test_pages_in_a_zone(unsigned long start_pfn, unsigned long end_pfn)struct zone *zone =NULL ;struct page *page;int i; -for (pfn = start_pfn, sec_end_pfn =SECTION_ALIGN_UP (start_pfn); +for (pfn = start_pfn, sec_end_pfn =SECTION_ALIGN_UP (start_pfn +1 ); pfn < end_pfn; - pfn = sec_end_pfn +1 , sec_end_pfn +=PAGES_PER_SECTION ) { + pfn = sec_end_pfn, sec_end_pfn +=PAGES_PER_SECTION ) {/* Make sure the memory section is present first */ if (!present_section_nr (pfn_to_section_nr (pfn)))continue ;
@@ -1234,7 +1234,11 @@ static int test_pages_in_a_zone(unsigned long start_pfn, unsigned long end_pfn) zone =page_zone (page); } } -return 1 ; + +if (zone) +return 1 ; +else +return 0 ; }/*
Signature · 1 line
2.12.0
PATCH 32/113 mm, fs: check for fatal signals in do_generic_file_read()
In reply to Jiri SlabyFrom: Michal Hocko <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 5abf186a30a89d5b9c18a6bf93a2c192c9fd52f6 upstream.
do_generic_file_read() can be told to perform a large request from userspace. If the system is under OOM and the reading task is the OOM victim then it has an access to memory reserves and finishing the full request can lead to the full memory depletion which is dangerous. Make sure we rather go with a short read and allow the killed task to terminate.
--- mm/filemap.c | 5 +++++ 1 file changed, 5 insertions(+)
mm/filemap.c +5 -0
@@ -1338,6 +1338,11 @@ static void do_generic_file_read(struct file *filp, loff_t *ppos,cond_resched (); find_page: +if (fatal_signal_pending (current)) { + error = -EINTR ; + goto out; + } + page =find_get_page (mapping, index);if (!page) { page_cache_sync_readahead(mapping,
Signature · 1 line
2.12.0
PATCH 33/113 can: bcm: fix hrtimer/tasklet termination in bcm op removal
In reply to Jiri SlabyFrom: Oliver Hartkopp <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit a06393ed03167771246c4c43192d9c264bc48412 upstream.
When removing a bcm tx operation either a hrtimer or a tasklet might run. As the hrtimer triggers its associated tasklet and vice versa we need to take care to mutually terminate both handlers.
--- net/can/bcm.c | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-)
net/can/bcm.c +16 -7
@@ -706,14 +706,23 @@ static struct bcm_op *bcm_find_op(struct list_head *ops, canid_t can_id,static void bcm_remove_op (struct bcm_op *op) { -hrtimer_cancel (&op->timer); -hrtimer_cancel (&op->thrtimer); - -if (op->tsklet.func) -tasklet_kill (&op->tsklet); +if (op->tsklet.func) { +while (test_bit (TASKLET_STATE_SCHED , &op->tsklet.state) || +test_bit (TASKLET_STATE_RUN , &op->tsklet.state) || +hrtimer_active (&op->timer)) { +hrtimer_cancel (&op->timer); +tasklet_kill (&op->tsklet); + } + } -if (op->thrtsklet.func) -tasklet_kill (&op->thrtsklet); +if (op->thrtsklet.func) { +while (test_bit (TASKLET_STATE_SCHED , &op->thrtsklet.state) || +test_bit (TASKLET_STATE_RUN , &op->thrtsklet.state) || +hrtimer_active (&op->thrtimer)) { +hrtimer_cancel (&op->thrtimer); +tasklet_kill (&op->thrtsklet); + } + }if ((op->frames) && (op->frames != &op->sframe))kfree (op->frames);
Signature · 1 line
2.12.0
PATCH 34/113 USB: serial: qcserial: add Dell DW5570 QDL
In reply to Jiri SlabyFrom: Aleksander Morgado <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 24d615a694d649aa2e167c3f97f62bdad07e3f84 upstream.
The Dell DW5570 is a re-branded Sierra Wireless MC8805 which will by default boot with vid 0x413c and pid 0x81a3. When triggered QDL download mode, the device switches to pid 0x81a6 and provides the standard TTY used for firmware upgrade.
--- drivers/usb/serial/qcserial.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/serial/qcserial.c +1 -0
@@ -119,6 +119,7 @@ static const struct usb_device_id id_table[] = { {USB_DEVICE(0x1410, 0xa021)}, /* Novatel Gobi 3000 Composite */ {USB_DEVICE(0x413c, 0x8193)}, /* Dell Gobi 3000 QDL */ {USB_DEVICE(0x413c, 0x8194)}, /* Dell Gobi 3000 Composite */ + {USB_DEVICE(0x413c, 0x81a6)}, /* Dell DW5570 QDL (MC8805) */ {USB_DEVICE(0x1199, 0x68a4)}, /* Sierra Wireless QDL */ {USB_DEVICE(0x1199, 0x68a5)}, /* Sierra Wireless Modem */ {USB_DEVICE(0x1199, 0x68a8)}, /* Sierra Wireless QDL */
Signature · 1 line
2.12.0
PATCH 35/113 USB: serial: pl2303: add ATEN device ID
In reply to Jiri SlabyFrom: "Marcel J.E. Mol" <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit d07830db1bdb254e4b50d366010b219286b8c937 upstream.
Seems that ATEN serial-to-usb devices using pl2303 exist with different device ids. This patch adds a missing device ID so it is recognised by the driver.
--- drivers/usb/serial/pl2303.c | 1 + drivers/usb/serial/pl2303.h | 1 + 2 files changed, 2 insertions(+)
drivers/usb/serial/pl2303.c +1 -0
@@ -52,6 +52,7 @@ static const struct usb_device_id id_table[] = { { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID) }, { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID_RSAQ5) }, { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID) }, + { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID2) }, { USB_DEVICE(ATEN_VENDOR_ID2, ATEN_PRODUCT_ID) }, { USB_DEVICE(ELCOM_VENDOR_ID, ELCOM_PRODUCT_ID) }, { USB_DEVICE(ELCOM_VENDOR_ID, ELCOM_PRODUCT_ID_UCSGT) },
drivers/usb/serial/pl2303.h +1 -0
@@ -27,6 +27,7 @@#define ATEN_VENDOR_ID 0x0557#define ATEN_VENDOR_ID2 0x0547#define ATEN_PRODUCT_ID 0x2008 +#define ATEN_PRODUCT_ID2 0x2118#define IODATA_VENDOR_ID 0x04bb#define IODATA_PRODUCT_ID 0x0a03
Signature · 1 line
2.12.0
PATCH 36/113 USB: Add quirk for WORLDE easykey.25 MIDI keyboard
In reply to Jiri SlabyFrom: Lukáš Lalinský <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit d9b2997e4a0a874e452df7cdd7de5a54502bd0aa upstream.
Add a quirk for WORLDE easykey.25 MIDI keyboard (idVendor=0218, idProduct=0401). The device reports that it has config string descriptor at index 3, but when the system selects the configuration and tries to get the description, it returns a -EPROTO error, the communication restarts and this keeps repeating over and over again. Not requesting the string descriptor makes the device work correctly.
Relevant info from Wireshark:
[...]
CONFIGURATION DESCRIPTOR
bLength: 9
bDescriptorType: 0x02 (CONFIGURATION)
wTotalLength: 101
bNumInterfaces: 2
bConfigurationValue: 1
iConfiguration: 3
Configuration bmAttributes: 0xc0 SELF-POWERED NO REMOTE-WAKEUP
1... .... = Must be 1: Must be 1 for USB 1.1 and higher
.1.. .... = Self-Powered: This device is SELF-POWERED
..0. .... = Remote Wakeup: This device does NOT support remote wakeup
bMaxPower: 50 (100mA)[...]
45 0.369104 host 2.38.0 USB 64 GET DESCRIPTOR Request STRING
[...]
URB setup
bmRequestType: 0x80
1... .... = Direction: Device-to-host
.00. .... = Type: Standard (0x00)
...0 0000 = Recipient: Device (0x00)
bRequest: GET DESCRIPTOR (6)
Descriptor Index: 0x03
bDescriptorType: 0x03
Language Id: English (United States) (0x0409)
wLength: 255
46 0.369255 2.38.0 host USB 64 GET DESCRIPTOR Response STRING[Malformed Packet][...]
Frame 46: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface 0 USB URB
[Source: 2.38.0]
[Destination: host]
URB id: 0xffff88021f62d480
URB type: URB_COMPLETE ('C')
URB transfer type: URB_CONTROL (0x02)
Endpoint: 0x80, Direction: IN
Device: 38
URB bus id: 2
Device setup request: not relevant ('-')
Data: present (0)
URB sec: 1484896277
URB usec: 455031
URB status: Protocol error (-EPROTO) (-71)
URB length [bytes]: 0
Data length [bytes]: 0
[Request in: 45]
[Time from request: 0.000151000 seconds]
Unused Setup Header
Interval: 0
Start frame: 0
Copy of Transfer Flags: 0x00000200
Number of ISO descriptors: 0
[Malformed Packet: USB]
[Expert Info (Error/Malformed): Malformed Packet (Exception occurred)]
[Malformed Packet (Exception occurred)]
[Severity level: Error]
[Group: Malformed]
--- drivers/usb/core/quirks.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/usb/core/quirks.c +4 -0
@@ -37,6 +37,10 @@ static const struct usb_device_id usb_quirk_list[] = {/* CBM - Flash disk */ { USB_DEVICE(0x0204, 0x6025), .driver_info = USB_QUIRK_RESET_RESUME }, + /* WORLDE easy key (easykey.25) MIDI controller */ + { USB_DEVICE(0x0218, 0x0401), .driver_info = + USB_QUIRK_CONFIG_INTF_STRINGS }, + /* HP 5300/5370C scanner */ { USB_DEVICE(0x03f0, 0x0701), .driver_info = USB_QUIRK_STRING_FETCH_255 },
Signature · 1 line
2.12.0
PATCH 37/113 USB: serial: option: add device ID for HP lt2523 (Novatel E371)
In reply to Jiri SlabyFrom: Bjørn Mork <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 5d03a2fd2292e71936c4235885c35ccc3c94695b upstream.
Yet another laptop vendor rebranded Novatel E371.
--- drivers/usb/serial/option.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/serial/option.c +1 -0
@@ -2006,6 +2006,7 @@ static const struct usb_device_id option_ids[] = { { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD200, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_6802, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD300, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0x421d, 0xff, 0xff, 0xff) }, /* HP lt2523 (Novatel E371) */ { } /* Terminating entry */ };MODULE_DEVICE_TABLE (usb, option_ids);
Signature · 1 line
2.12.0
PATCH 38/113 ARC: [arcompact] brown paper bag bug in unaligned access delay slot fixup
In reply to Jiri SlabyFrom: Vineet Gupta <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit a524c218bc94c705886a0e0fedeee45d1931da32 upstream.
--- arch/arc/kernel/unaligned.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arc/kernel/unaligned.c +1 -1
@@ -242,7 +242,7 @@ int misaligned_fixup(unsigned long address, struct pt_regs *regs,/* clear any remanants of delay slot */ if (delay_mode (regs)) { - regs->ret = regs->bta ~1U; + regs->ret = regs->bta & ~1U ; regs->status32 &= ~STATUS_DE_MASK ; }else { regs->ret += state.instr_len;
Signature · 1 line
2.12.0
PATCH 39/113 selinux: fix off-by-one in setprocattr
In reply to Jiri SlabyFrom: Stephen Smalley <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 0c461cb727d146c9ef2d3e86214f498b78b7d125 upstream.
SELinux tries to support setting/clearing of /proc/pid/attr attributes from the shell by ignoring terminating newlines and treating an attribute value that begins with a NUL or newline as an attempt to clear the attribute. However, the test for clearing attributes has always been wrong; it has an off-by-one error, and this could further lead to reading past the end of the allocated buffer since commit bb646cdb12e75d82258c2f2e7746d5952d3e321a ("proc_pid_attr_write():
switch to memdup_user()"). Fix the off-by-one error.
Even with this fix, setting and clearing /proc/pid/attr attributes from the shell is not straightforward since the interface does not support multiple write() calls (so shells that write the value and newline separately will set and then immediately clear the attribute, requiring use of echo -n to set the attribute), whereas trying to use echo -n "" to clear the attribute causes the shell to skip the write() call altogether since POSIX says that a zero-length write causes no side effects. Thus, one must use echo -n to set and echo without -n to clear, as in the following example:
$ echo -n unconfined_u:object_r:user_home_t:s0 > /proc/$$/attr/fscreate $ cat /proc/$$/attr/fscreate unconfined_u:object_r:user_home_t:s0 $ echo "" > /proc/$$/attr/fscreate $ cat /proc/$$/attr/fscreate
Note the use of /proc/$$ rather than /proc/self, as otherwise the cat command will read its own attribute value, not that of the shell.
There are no users of this facility to my knowledge; possibly we should just get rid of it.
UPDATE: Upon further investigation it appears that a local process with the process:setfscreate permission can cause a kernel panic as a result of this bug. This patch fixes CVE-2017-2618.
--- security/selinux/hooks.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
security/selinux/hooks.c +1 -1
@@ -5511,7 +5511,7 @@ static int selinux_setprocattr(struct task_struct *p,return error;/* Obtain a SID for the context, if one was specified. */ -if (size && str[1 ] && str[1 ] !='\n' ) { +if (size && str[0 ] && str[0 ] !='\n' ) {if (str[size-1 ] =='\n' ) { str[size-1 ] =0 ; size--;
Signature · 1 line
2.12.0
PATCH 40/113 ARM: 8643/3: arm/ptrace: Preserve previous registers for short regset write
In reply to Jiri SlabyFrom: Dave Martin <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 228dbbfb5d77f8e047b2a1d78da14b7158433027 upstream.
Ensure that if userspace supplies insufficient data to PTRACE_SETREGSET to fill all the registers, the thread's old registers are preserved.
--- arch/arm/kernel/ptrace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/kernel/ptrace.c +1 -1
@@ -600,7 +600,7 @@ static int gpr_set(struct task_struct *target, const void *kbuf, const void __user *ubuf) { int ret; -struct pt_regs newregs; +struct pt_regs newregs = *task_pt_regs (target); ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &newregs,
Signature · 1 line
2.12.0
PATCH 41/113 target: Fix COMPARE_AND_WRITE ref leak for non GOOD status
In reply to Jiri SlabyFrom: Nicholas Bellinger <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 9b2792c3da1e80f2d460167d319302a24c9ca2b7 upstream.
This patch addresses a long standing bug where the commit phase of COMPARE_AND_WRITE would result in a se_cmd->cmd_kref reference leak if se_cmd->scsi_status returned non SAM_STAT_GOOD.
This would manifest first as a lost SCSI response, and eventual hung task during fabric driver logout or re-login, as existing shutdown logic waited for the COMPARE_AND_WRITE se_cmd->cmd_kref to reach zero.
To address this bug, compare_and_write_post() has been changed to drop the incorrect !cmd->scsi_status conditional that was preventing *post_ret = 1 for being set during non SAM_STAT_GOOD status.
This patch has been tested with SAM_STAT_CHECK_CONDITION status from normal target_complete_cmd() callback path, as well as the incoming __target_execute_cmd() submission failure path when se_cmd->execute_cmd() returns non zero status.
--- drivers/target/target_core_sbc.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/target/target_core_sbc.c +6 -2
@@ -367,6 +367,7 @@ static sense_reason_t compare_and_write_post(struct se_cmd *cmd, bool success, int *post_ret) {struct se_device *dev = cmd->se_dev; +sense_reason_t ret =TCM_NO_SENSE ;/* * Only set SCF_COMPARE_AND_WRITE_POST to force a response fall-through
@@ -374,9 +375,12 @@ static sense_reason_t compare_and_write_post(struct se_cmd *cmd, bool success,* sent to the backend driver. */ spin_lock_irq (&cmd->t_state_lock); -if ((cmd->transport_state &CMD_T_SENT ) && !cmd->scsi_status) { +if (cmd->transport_state &CMD_T_SENT ) { cmd->se_cmd_flags |=SCF_COMPARE_AND_WRITE_POST ; *post_ret =1 ; + +if (cmd->scsi_status ==SAM_STAT_CHECK_CONDITION ) + ret =TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE ; }spin_unlock_irq (&cmd->t_state_lock);
@@ -386,7 +390,7 @@ static sense_reason_t compare_and_write_post(struct se_cmd *cmd, bool success,*/ up (&dev->caw_sem); -return TCM_NO_SENSE ; +return ret; } static sense_reason_t compare_and_write_callback(struct se_cmd *cmd, bool success,
Signature · 1 line
2.12.0
PATCH 42/113 mac80211: Fix adding of mesh vendor IEs
In reply to Jiri SlabyFrom: Thorsten Horstmann <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit da7061c82e4a1bc6a5e134ef362c86261906c860 upstream.
The function ieee80211_ie_split_vendor doesn't return 0 on errors. Instead it returns any offset < ielen when WLAN_EID_VENDOR_SPECIFIC is found. The return value in mesh_add_vendor_ies must therefore be checked against ifmsh->ie_len and not 0. Otherwise all ifmsh->ie starting with WLAN_EID_VENDOR_SPECIFIC will be rejected.
--- net/mac80211/mesh.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/mac80211/mesh.c +1 -1
@@ -345,7 +345,7 @@ int mesh_add_vendor_ies(struct ieee80211_sub_if_data *sdata,/* fast-forward to vendor IEs */ offset =ieee80211_ie_split_vendor (ifmsh->ie, ifmsh->ie_len,0 ); -if (offset) { +if (offset < ifmsh->ie_len) { len = ifmsh->ie_len - offset; data = ifmsh->ie + offset;if (skb_tailroom (skb) < len)
Signature · 1 line
2.12.0
PATCH 43/113 scsi: zfcp: fix use-after-free by not tracing WKA port open/close on failed send
In reply to Jiri SlabyFrom: Steffen Maier <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 2dfa6688aafdc3f74efeb1cf05fb871465d67f79 upstream.
Dan Carpenter kindly reported:
<quote>
The patch d27a7cb91960: "zfcp: trace on request for open and close of WKA port" from Aug 10, 2016, leads to the following static checker warning:
drivers/s390/scsi/zfcp_fsf.c:1615 zfcp_fsf_open_wka_port() warn: 'req' was already freed.
drivers/s390/scsi/zfcp_fsf.c
1609 zfcp_fsf_start_timer(req, ZFCP_FSF_REQUEST_TIMEOUT);
1610 retval = zfcp_fsf_req_send(req);
1611 if (retval)
1612 zfcp_fsf_req_free(req);
^^^Freed.
1613 out:
1614 spin_unlock_irq(&qdio->req_q_lock);
1615 if (req && !IS_ERR(req))
1616 zfcp_dbf_rec_run_wka("fsowp_1", wka_port, req->req_id);
^^^^^^^^^^^Use after free.
1617 return retval;
1618 }
Same thing for zfcp_fsf_close_wka_port() as well.
</quote>
Rather than relying on req being NULL (or ERR_PTR) for all cases where we don't want to trace or should not trace,
simply check retval which is unconditionally initialized with -EIO != 0 and it can only become 0 on successful retval = zfcp_fsf_req_send(req). With that we can also remove the then again unnecessary unconditional initialization of req which was introduced with that earlier commit.
--- drivers/s390/scsi/zfcp_fsf.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/s390/scsi/zfcp_fsf.c +4 -4
@@ -1584,7 +1584,7 @@ out:int zfcp_fsf_open_wka_port (struct zfcp_fc_wka_port *wka_port) {struct zfcp_qdio *qdio = wka_port->adapter->qdio; -struct zfcp_fsf_req *req =NULL ; +struct zfcp_fsf_req *req;int retval = -EIO ;spin_lock_irq (&qdio->req_q_lock);
@@ -1613,7 +1613,7 @@ int zfcp_fsf_open_wka_port(struct zfcp_fc_wka_port *wka_port)zfcp_fsf_req_free (req); out:spin_unlock_irq (&qdio->req_q_lock); -if (req && !IS_ERR (req)) +if (!retval)zfcp_dbf_rec_run_wka ("fsowp_1" , wka_port, req->req_id);return retval; }
@@ -1639,7 +1639,7 @@ static void zfcp_fsf_close_wka_port_handler(struct zfcp_fsf_req *req)int zfcp_fsf_close_wka_port (struct zfcp_fc_wka_port *wka_port) {struct zfcp_qdio *qdio = wka_port->adapter->qdio; -struct zfcp_fsf_req *req =NULL ; +struct zfcp_fsf_req *req;int retval = -EIO ;spin_lock_irq (&qdio->req_q_lock);
@@ -1668,7 +1668,7 @@ int zfcp_fsf_close_wka_port(struct zfcp_fc_wka_port *wka_port)zfcp_fsf_req_free (req); out:spin_unlock_irq (&qdio->req_q_lock); -if (req && !IS_ERR (req)) +if (!retval)zfcp_dbf_rec_run_wka ("fscwp_1" , wka_port, req->req_id);return retval; }
Signature · 1 line
2.12.0
PATCH 44/113 ALSA: seq: Fix race at creating a queue
In reply to Jiri SlabyFrom: Takashi Iwai <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 4842e98f26dd80be3623c4714a244ba52ea096a8 upstream.
When a sequencer queue is created in snd_seq_queue_alloc(),it adds the new queue element to the public list before referencing it. Thus the queue might be deleted before the call of snd_seq_queue_use(), and it results in the use-after-free error, as spotted by syzkaller.
The fix is to reference the queue object at the right time.
--- sound/core/seq/seq_queue.c | 33 ++++++++++++++++++++------------- 1 file changed, 20 insertions(+), 13 deletions(-)
sound/core/seq/seq_queue.c +20 -13
@@ -183,6 +183,8 @@ void __exit snd_seq_queues_delete(void) } } +static void queue_use (struct snd_seq_queue *queue,int client,int use); +/* allocate a new queue - * return queue index value or negative value for error */
@@ -194,11 +196,11 @@ int snd_seq_queue_alloc(int client, int locked, unsigned int info_flags)if (q ==NULL )return -ENOMEM ; q->info_flags = info_flags; +queue_use (q, client,1 );if (queue_list_add (q) <0 ) {queue_delete (q);return -ENOMEM ; } -snd_seq_queue_use (q->queue, client,1 );/* use this queue */ return q->queue; }
@@ -504,19 +506,9 @@ int snd_seq_queue_timer_set_tempo(int queueid, int client,return result; } - -/* use or unuse this queue - -* if it is the first client, starts the timer. -* if it is not longer used by any clients, stop the timer. -*/ -int snd_seq_queue_use (int queueid,int client,int use) +/* use or unuse this queue */ +static void queue_use (struct snd_seq_queue *queue,int client,int use) { -struct snd_seq_queue *queue; - - queue =queueptr (queueid); -if (queue ==NULL ) -return -EINVAL ; -mutex_lock (&queue->timer_mutex);if (use) {if (!test_and_set_bit (client, queue->clients_bitmap)) queue->clients++;
@@ -531,6 +523,21 @@ int snd_seq_queue_use(int queueid, int client, int use) }else {snd_seq_timer_close (queue); } +} + +/* use or unuse this queue - +* if it is the first client, starts the timer. +* if it is not longer used by any clients, stop the timer. +*/ +int snd_seq_queue_use (int queueid,int client,int use) +{ +struct snd_seq_queue *queue; + + queue =queueptr (queueid); +if (queue ==NULL ) +return -EINVAL ; +mutex_lock (&queue->timer_mutex); +queue_use (queue, client, use);mutex_unlock (&queue->timer_mutex);queuefree (queue);return 0 ;
Signature · 1 line
2.12.0
PATCH 45/113 ALSA: seq: Don't handle loop timeout at snd_seq_pool_done()
In reply to Jiri SlabyFrom: Takashi Iwai <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 37a7ea4a9b81f6a864c10a7cb0b96458df5310a3 upstream.
snd_seq_pool_done() syncs with closing of all opened threads, but it aborts the wait loop with a timeout, and proceeds to the release resource even if not all threads have been closed. The timeout was 5 seconds, and if you run a crazy stuff, it can exceed easily, and may result in the access of the invalid memory address -- this is what syzkaller detected in a bug report.
As a fix, let the code graduate from naiveness, simply remove the loop timeout.
--- sound/core/seq/seq_memory.c | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-)
sound/core/seq/seq_memory.c +1 -8
@@ -419,7 +419,6 @@ int snd_seq_pool_done(struct snd_seq_pool *pool) {unsigned long flags;struct snd_seq_event_cell *ptr; -int max_count =5 *HZ ;if (snd_BUG_ON (!pool))return -EINVAL ;
@@ -432,14 +431,8 @@ int snd_seq_pool_done(struct snd_seq_pool *pool)if (waitqueue_active (&pool->output_sleep))wake_up (&pool->output_sleep); -while (atomic_read (&pool->counter) >0 ) { -if (max_count ==0 ) { -snd_printk (KERN_WARNING "snd_seq_pool_done timeout: %d cells remain\n" ,atomic_read (&pool->counter)); -break ; - } +while (atomic_read (&pool->counter) >0 )schedule_timeout_uninterruptible (1 ); - max_count--; - }/* release all resources */ spin_lock_irqsave (&pool->lock, flags);
Signature · 1 line
2.12.0
PATCH 46/113 drm/i915: fix use-after-free in page_flip_completed()
In reply to Jiri SlabyFrom: Andrey Ryabinin <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 5351fbb1bf1413f6024892093528280769ca852f upstream.
page_flip_completed() dereferences 'work' variable after executing queue_work(). This is not safe as the 'work' item might be already freed by queued work:
BUG: KASAN: use-after-free in page_flip_completed+0x3ff/0x490 at addr ffff8803dc010f90
Call Trace:
__asan_report_load8_noabort+0x59/0x80
page_flip_completed+0x3ff/0x490
intel_finish_page_flip_mmio+0xe3/0x130
intel_pipe_handle_vblank+0x2d/0x40
gen8_irq_handler+0x4a7/0xed0
__handle_irq_event_percpu+0xf6/0x860
handle_irq_event_percpu+0x6b/0x160
handle_irq_event+0xc7/0x1b0
handle_edge_irq+0x1f4/0xa50
handle_irq+0x41/0x70
do_IRQ+0x9a/0x200
common_interrupt+0x89/0x89 Freed:
kfree+0x113/0x4d0
intel_unpin_work_fn+0x29a/0x3b0
process_one_work+0x79e/0x1b70
worker_thread+0x611/0x1460
kthread+0x241/0x3a0
ret_from_fork+0x27/0x40Move queue_work() after trace_i915_flip_complete() to fix this.
--- drivers/gpu/drm/i915/intel_display.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/i915/intel_display.c +2 -2
@@ -7696,9 +7696,9 @@ static void do_intel_finish_page_flip(struct drm_device *dev,wake_up_all (&dev_priv->pending_flip_queue); -queue_work (dev_priv->wq, &work->work); -trace_i915_flip_complete (intel_crtc->plane, work->pending_flip_obj); + +queue_work (dev_priv->wq, &work->work); }void intel_finish_page_flip (struct drm_device *dev,int pipe)
Signature · 1 line
2.12.0
PATCH 47/113 sched/debug: Don't dump sched debug info in SysRq-W
In reply to Jiri SlabyFrom: Rabin Vincent <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit fb90a6e93c0684ab2629a42462400603aa829b9c upstream.
sysrq_sched_debug_show() can dump a lot of information. Don't print out all that if we're just trying to get a list of blocked tasks (SysRq-W). The information is still accessible with SysRq-T.
--- kernel/sched/core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
kernel/sched/core.c +2 -1
@@ -4233,7 +4233,8 @@ void show_state_filter(unsigned long state_filter)touch_all_softlockup_watchdogs ();#ifdef CONFIG_SCHED_DEBUG -sysrq_sched_debug_show (); +if (!state_filter) +sysrq_sched_debug_show ();#endif rcu_read_unlock ();/*
Signature · 1 line
2.12.0
PATCH 48/113 tun: Fix TUN_PKT_STRIP setting
In reply to Jiri SlabyFrom: Herbert Xu <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 2eb783c43e7cf807a45899c10ed556b6dc116625 upstream.
We set the flag TUN_PKT_STRIP if the user buffer provided is too small to contain the entire packet plus meta-data. However, this has been broken ever since we added GSO meta-data. VLAN acceleration also has the same problem.
This patch fixes this by taking both into account when setting the TUN_PKT_STRIP flag.
The fact that this has been broken for six years without anyone realising means that nobody actually uses this flag.
--- drivers/net/tun.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
drivers/net/tun.c +8 -4
@@ -1187,15 +1187,19 @@ static ssize_t tun_put_user(struct tun_struct *tun,ssize_t total =0 ;int vlan_offset =0 , copied;int vlan_hlen =0 ; +int vnet_hdr_sz =0 ;if (vlan_tx_tag_present (skb)) vlan_hlen =VLAN_HLEN ; +if (tun->flags &TUN_VNET_HDR ) + vnet_hdr_sz = tun->vnet_hdr_sz; +if (!(tun->flags &TUN_NO_PI )) {if ((len -=sizeof (pi)) <0 )return -EINVAL ; -if (len < skb->len) { +if (len < skb->len + vlan_hlen + vnet_hdr_sz) {/* Packet will be striped */ pi.flags |=TUN_PKT_STRIP ; }
@@ -1205,9 +1209,9 @@ static ssize_t tun_put_user(struct tun_struct *tun, total +=sizeof (pi); } -if (tun->flags &TUN_VNET_HDR ) { +if (vnet_hdr_sz) {struct virtio_net_hdr gso = {0 };/* no info leak */ -if ((len -= tun->vnet_hdr_sz) <0 ) +if ((len -= vnet_hdr_sz) <0 )return -EINVAL ;if (skb_is_gso (skb)) {
@@ -1251,7 +1255,7 @@ static ssize_t tun_put_user(struct tun_struct *tun,if (unlikely (memcpy_toiovecend (iv, (void *)&gso, total,sizeof (gso))))return -EFAULT ; - total += tun->vnet_hdr_sz; + total += vnet_hdr_sz; } copied = total;
Signature · 1 line
2.12.0
PATCH 49/113 can: Fix kernel panic at security_sock_rcv_skb
In reply to Jiri SlabyFrom: Eric Dumazet <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit f1712c73714088a7252d276a57126d56c7d37e64 ]
Zhang Yanmin reported crashes [1] and provided a patch adding a synchronize_rcu() call in can_rx_unregister()
The main problem seems that the sockets themselves are not RCU protected.
If CAN uses RCU for delivery, then sockets should be freed only after one RCU grace period.
Recent kernels could use sock_set_flag(sk, SOCK_RCU_FREE), but let's ease stable backports with the following fix instead.
[1]
BUG: unable to handle kernel NULL pointer dereference at (null) IP: [<ffffffff81495e25>] selinux_socket_sock_rcv_skb+0x65/0x2a0 Call Trace: <IRQ> [<ffffffff81485d8c>] security_sock_rcv_skb+0x4c/0x60 [<ffffffff81d55771>] sk_filter+0x41/0x210 [<ffffffff81d12913>] sock_queue_rcv_skb+0x53/0x3a0 [<ffffffff81f0a2b3>] raw_rcv+0x2a3/0x3c0 [<ffffffff81f06eab>] can_rcv_filter+0x12b/0x370 [<ffffffff81f07af9>] can_receive+0xd9/0x120 [<ffffffff81f07beb>] can_rcv+0xab/0x100 [<ffffffff81d362ac>] __netif_receive_skb_core+0xd8c/0x11f0 [<ffffffff81d36734>] __netif_receive_skb+0x24/0xb0 [<ffffffff81d37f67>] process_backlog+0x127/0x280 [<ffffffff81d36f7b>] net_rx_action+0x33b/0x4f0 [<ffffffff810c88d4>] __do_softirq+0x184/0x440 [<ffffffff81f9e86c>] do_softirq_own_stack+0x1c/0x30 <EOI> [<ffffffff810c76fb>] do_softirq.part.18+0x3b/0x40 [<ffffffff810c8bed>] do_softirq+0x1d/0x20 [<ffffffff81d30085>] netif_rx_ni+0xe5/0x110 [<ffffffff8199cc87>] slcan_receive_buf+0x507/0x520 [<ffffffff8167ef7c>] flush_to_ldisc+0x21c/0x230 [<ffffffff810e3baf>] process_one_work+0x24f/0x670 [<ffffffff810e44ed>] worker_thread+0x9d/0x6f0 [<ffffffff810e4450>] ? rescuer_thread+0x480/0x480 [<ffffffff810ebafc>] kthread+0x12c/0x150 [<ffffffff81f9ccef>] ret_from_fork+0x3f/0x70
--- include/linux/can/core.h | 7 +++---- net/can/af_can.c | 12 ++++++++++-- net/can/af_can.h | 3 ++- net/can/bcm.c | 4 ++-- net/can/gw.c | 2 +- net/can/raw.c | 4 ++-- 6 files changed, 20 insertions(+), 12 deletions(-)
include/linux/can/core.h +3 -4
@@ -45,10 +45,9 @@ struct can_proto {extern int can_proto_register (const struct can_proto *cp);extern void can_proto_unregister (const struct can_proto *cp); -extern int can_rx_register (struct net_device *dev,canid_t can_id, -canid_t mask, -void (*func)(struct sk_buff *,void *), -void *data,char *ident); +int can_rx_register (struct net_device *dev,canid_t can_id,canid_t mask, +void (*func)(struct sk_buff *,void *), +void *data,char *ident,struct sock *sk); extern void can_rx_unregister(struct net_device *dev, canid_t can_id, canid_t mask,
net/can/af_can.c +10 -2
@@ -425,6 +425,7 @@ static struct hlist_head *find_rcv_list(canid_t *can_id, canid_t *mask,* @func: callback function on filter match * @data: returned parameter for callback function * @ident: string for calling module indentification +* @sk: socket pointer (might be NULL) * * Description: * Invokes the callback function with the received sk_buff and the given
@@ -448,7 +449,7 @@ static struct hlist_head *find_rcv_list(canid_t *can_id, canid_t *mask,*/ int can_rx_register (struct net_device *dev,canid_t can_id,canid_t mask,void (*func)(struct sk_buff *,void *),void *data, -char *ident) +char *ident,struct sock *sk) {struct receiver *r;struct hlist_head *rl;
@@ -476,6 +477,7 @@ int can_rx_register(struct net_device *dev, canid_t can_id, canid_t mask, r->func = func; r->data = data; r->ident = ident; + r->sk = sk;hlist_add_head_rcu (&r->list, rl); d->entries++;
@@ -500,8 +502,11 @@ EXPORT_SYMBOL(can_rx_register);static void can_rx_delete_receiver (struct rcu_head *rp) { struct receiver *r = container_of(rp, struct receiver, rcu); +struct sock *sk = r->sk;kmem_cache_free (rcv_cache, r); +if (sk) +sock_put (sk); }/**
@@ -576,8 +581,11 @@ void can_rx_unregister(struct net_device *dev, canid_t can_id, canid_t mask,spin_unlock (&can_rcvlists_lock);/* schedule the receiver item for deletion */ -if (r) +if (r) { +if (r->sk) +sock_hold (r->sk);call_rcu (&r->rcu, can_rx_delete_receiver); + } }EXPORT_SYMBOL (can_rx_unregister);
net/can/af_can.h +2 -1
@@ -50,13 +50,14 @@struct receiver {struct hlist_node list; -struct rcu_head rcu;canid_t can_id;canid_t mask;unsigned long matches;void (*func)(struct sk_buff *,void *);void *data;char *ident; +struct sock *sk; +struct rcu_head rcu; };enum {RX_ERR ,RX_ALL ,RX_FIL ,RX_INV ,RX_EFF ,RX_MAX };
net/can/bcm.c +2 -2
@@ -1178,7 +1178,7 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg, err =can_rx_register (dev, op->can_id,REGMASK (op->can_id), bcm_rx_handler, op, -"bcm" ); +"bcm" , sk); op->rx_reg_dev = dev;dev_put (dev);
@@ -1187,7 +1187,7 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg, }else err =can_rx_register (NULL , op->can_id,REGMASK (op->can_id), - bcm_rx_handler, op,"bcm" ); + bcm_rx_handler, op,"bcm" , sk);if (err) {/* this bcm rx op is broken -> remove it */ list_del (&op->list);
net/can/gw.c +1 -1
@@ -441,7 +441,7 @@ static inline int cgw_register_filter(struct cgw_job *gwj) {return can_rx_register (gwj->src.dev, gwj->ccgw.filter.can_id, gwj->ccgw.filter.can_mask, can_can_gw_rcv, - gwj,"gw" ); + gwj,"gw" ,NULL ); }static inline void cgw_unregister_filter (struct cgw_job *gwj)
net/can/raw.c +2 -2
@@ -168,7 +168,7 @@ static int raw_enable_filters(struct net_device *dev, struct sock *sk,for (i =0 ; i < count; i++) { err =can_rx_register (dev, filter[i].can_id, filter[i].can_mask, - raw_rcv, sk,"raw" ); + raw_rcv, sk,"raw" , sk);if (err) {/* clean up successfully registered filters */ while (--i >=0 )
@@ -189,7 +189,7 @@ static int raw_enable_errfilter(struct net_device *dev, struct sock *sk,if (err_mask) err =can_rx_register (dev,0 , err_mask |CAN_ERR_FLAG , - raw_rcv, sk,"raw" ); + raw_rcv, sk,"raw" , sk);return err; }
Signature · 1 line
2.12.0
PATCH 50/113 ipv6: fix ip6_tnl_parse_tlv_enc_lim()
In reply to Jiri SlabyFrom: Eric Dumazet <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit fbfa743a9d2a0ffa24251764f10afc13eb21e739 ]
This function suffers from multiple issues.
First one is that pskb_may_pull() may reallocate skb->head, so the 'raw' pointer needs either to be reloaded or not used at all.
Second issue is that NEXTHDR_DEST handling does not validate that the options are present in skb->data, so we might read garbage or access non existent memory.
With help from Willem de Bruijn.
--- net/ipv6/ip6_tunnel.c | 34 ++++++++++++++++++++++------------ 1 file changed, 22 insertions(+), 12 deletions(-)
net/ipv6/ip6_tunnel.c +22 -12
@@ -396,18 +396,19 @@ ip6_tnl_dev_uninit(struct net_device *dev)__u16 ip6_tnl_parse_tlv_enc_lim (struct sk_buff *skb,__u8 *raw) { -const struct ipv6hdr *ipv6h = (const struct ipv6hdr *) raw; -__u8 nexthdr = ipv6h->nexthdr; -__u16 off =sizeof (*ipv6h); +const struct ipv6hdr *ipv6h = (const struct ipv6hdr *)raw; +unsigned int nhoff = raw - skb->data; +unsigned int off = nhoff +sizeof (*ipv6h); +u8 next, nexthdr = ipv6h->nexthdr;while (ipv6_ext_hdr (nexthdr) && nexthdr !=NEXTHDR_NONE ) { -__u16 optlen =0 ;struct ipv6_opt_hdr *hdr; -if (raw + off +sizeof (*hdr) > skb->data && - !pskb_may_pull (skb, raw - skb->data + off +sizeof (*hdr))) +u16 optlen; + +if (!pskb_may_pull (skb, off +sizeof (*hdr)))break ; - hdr = (struct ipv6_opt_hdr *) (raw + off); + hdr = (struct ipv6_opt_hdr *)(skb->data + off);if (nexthdr ==NEXTHDR_FRAGMENT ) {struct frag_hdr *frag_hdr = (struct frag_hdr *) hdr;if (frag_hdr->frag_off)
@@ -418,20 +419,29 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw) }else { optlen =ipv6_optlen (hdr); } +/* cache hdr->nexthdr, since pskb_may_pull() might +* invalidate hdr +*/ + next = hdr->nexthdr;if (nexthdr ==NEXTHDR_DEST ) { -__u16 i = off +2 ; +u16 i =2 ; + +/* Remember : hdr is no longer valid at this point. */ +if (!pskb_may_pull (skb, off + optlen)) +break ; +while (1 ) {struct ipv6_tlv_tnl_enc_lim *tel;/* No more room for encapsulation limit */ -if (i +sizeof (*tel) > off + optlen) +if (i +sizeof (*tel) > optlen)break ; - tel = (struct ipv6_tlv_tnl_enc_lim *) &raw[i]; + tel = (struct ipv6_tlv_tnl_enc_lim *) skb->data + off + i;/* return index of option if found and valid */ if (tel->type ==IPV6_TLV_TNL_ENCAP_LIMIT && tel->length ==1 ) -return i; +return i + off - nhoff;/* else jump to next option */ if (tel->type) i += tel->length +2 ;
@@ -439,7 +449,7 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw) i++; } } - nexthdr = hdr->nexthdr; + nexthdr = next; off += optlen; }return 0 ;
Signature · 1 line
2.12.0
PATCH 51/113 ipv6: pointer math error in ip6_tnl_parse_tlv_enc_lim()
In reply to Jiri SlabyFrom: Dan Carpenter <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit 63117f09c768be05a0bf465911297dc76394f686 ]
Casting is a high precedence operation but "off" and "i" are in terms of bytes so we need to have some parenthesis here.
--- net/ipv6/ip6_tunnel.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv6/ip6_tunnel.c +1 -1
@@ -437,7 +437,7 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw)if (i +sizeof (*tel) > optlen)break ; - tel = (struct ipv6_tlv_tnl_enc_lim *) skb->data + off + i; + tel = (struct ipv6_tlv_tnl_enc_lim *)(skb->data + off + i);/* return index of option if found and valid */ if (tel->type ==IPV6_TLV_TNL_ENCAP_LIMIT && tel->length ==1 )
Signature · 1 line
2.12.0
PATCH 52/113 tcp: fix 0 divide in __tcp_select_window()
In reply to Jiri SlabyFrom: Eric Dumazet <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit 06425c308b92eaf60767bc71d359f4cbc7a561f8 ]
syszkaller fuzzer was able to trigger a divide by zero, when TCP window scaling is not enabled.
SO_RCVBUF can be used not only to increase sk_rcvbuf, also to decrease it below current receive buffers utilization.
If mss is negative or 0, just return a zero TCP window.
--- net/ipv4/tcp_output.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
net/ipv4/tcp_output.c +4 -2
@@ -2163,9 +2163,11 @@ u32 __tcp_select_window(struct sock *sk)int full_space =min_t (int, tp->window_clamp,tcp_full_space (sk));int window; -if (mss > full_space) +if (unlikely (mss > full_space)) { mss = full_space; - +if (mss <=0 ) +return 0 ; + }if (free_space < (full_space >>1 )) { icsk->icsk_ack.quick =0 ;
Signature · 1 line
2.12.0
PATCH 53/113 net: use a work queue to defer net_disable_timestamp() work
In reply to Jiri SlabyFrom: Eric Dumazet <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit 5fa8bbda38c668e56b0c6cdecced2eac2fe36dec ]
Dmitry reported a warning [1] showing that we were calling net_disable_timestamp() -> static_key_slow_dec() from a non process context.
Grabbing a mutex while holding a spinlock or rcu_read_lock() is not allowed.
As Cong suggested, we now use a work queue.
It is possible netstamp_clear() exits while netstamp_needed_deferred is not zero, but it is probably not worth trying to do better than that.
netstamp_needed_deferred atomic tracks the exact number of deferred decrements.
[1]
[ INFO: suspicious RCU usage. ]
4.10.0-rc5+ #192 Not tainted
-------------------------------./include/linux/rcupdate.h:561 Illegal context switch in RCU read-side critical section!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 0
2 locks held by syz-executor14/23111:
#0: (sk_lock-AF_INET6){+.+.+.}, at: [<ffffffff83a35c35>] lock_sockinclude/net/sock.h:1454 [inline]
#0: (sk_lock-AF_INET6){+.+.+.}, at: [<ffffffff83a35c35>]
rawv6_sendmsg+0x1e65/0x3ec0 net/ipv6/raw.c:919
#1: (rcu_read_lock){......}, at: [<ffffffff83ae2678>] nf_hook
include/linux/netfilter.h:201 [inline]
#1: (rcu_read_lock){......}, at: [<ffffffff83ae2678>]
__ip6_local_out+0x258/0x840 net/ipv6/output_core.c:160
stack backtrace:
CPU: 2 PID: 23111 Comm: syz-executor14 Not tainted 4.10.0-rc5+ #192
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs
01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:15 [inline]
dump_stack+0x2ee/0x3ef lib/dump_stack.c:51
lockdep_rcu_suspicious+0x139/0x180 kernel/locking/lockdep.c:4452
rcu_preempt_sleep_check include/linux/rcupdate.h:560 [inline]
___might_sleep+0x560/0x650 kernel/sched/core.c:7748
__might_sleep+0x95/0x1a0 kernel/sched/core.c:7739
mutex_lock_nested+0x24f/0x1730 kernel/locking/mutex.c:752
atomic_dec_and_mutex_lock+0x119/0x160 kernel/locking/mutex.c:1060
__static_key_slow_dec+0x7a/0x1e0 kernel/jump_label.c:149
static_key_slow_dec+0x51/0x90 kernel/jump_label.c:174
net_disable_timestamp+0x3b/0x50 net/core/dev.c:1728
sock_disable_timestamp+0x98/0xc0 net/core/sock.c:403
__sk_destruct+0x27d/0x6b0 net/core/sock.c:1441
sk_destruct+0x47/0x80 net/core/sock.c:1460
__sk_free+0x57/0x230 net/core/sock.c:1468
sock_wfree+0xae/0x120 net/core/sock.c:1645
skb_release_head_state+0xfc/0x200 net/core/skbuff.c:655
skb_release_all+0x15/0x60 net/core/skbuff.c:668
__kfree_skb+0x15/0x20 net/core/skbuff.c:684
kfree_skb+0x16e/0x4c0 net/core/skbuff.c:705
inet_frag_destroy+0x121/0x290 net/ipv4/inet_fragment.c:304
inet_frag_put include/net/inet_frag.h:133 [inline]
nf_ct_frag6_gather+0x1106/0x3840
net/ipv6/netfilter/nf_conntrack_reasm.c:617
ipv6_defrag+0x1be/0x2b0 net/ipv6/netfilter/nf_defrag_ipv6_hooks.c:68
nf_hook_entry_hookfn include/linux/netfilter.h:102 [inline]
nf_hook_slow+0xc3/0x290 net/netfilter/core.c:310
nf_hook include/linux/netfilter.h:212 [inline]
__ip6_local_out+0x489/0x840 net/ipv6/output_core.c:160
ip6_local_out+0x2d/0x170 net/ipv6/output_core.c:170
ip6_send_skb+0xa1/0x340 net/ipv6/ip6_output.c:1722
ip6_push_pending_frames+0xb3/0xe0 net/ipv6/ip6_output.c:1742
rawv6_push_pending_frames net/ipv6/raw.c:613 [inline]
rawv6_sendmsg+0x2d1a/0x3ec0 net/ipv6/raw.c:927
inet_sendmsg+0x164/0x5b0 net/ipv4/af_inet.c:744
sock_sendmsg_nosec net/socket.c:635 [inline]
sock_sendmsg+0xca/0x110 net/socket.c:645
sock_write_iter+0x326/0x600 net/socket.c:848
do_iter_readv_writev+0x2e3/0x5b0 fs/read_write.c:695
do_readv_writev+0x42c/0x9b0 fs/read_write.c:872
vfs_writev+0x87/0xc0 fs/read_write.c:911
do_writev+0x110/0x2c0 fs/read_write.c:944
SYSC_writev fs/read_write.c:1017 [inline]
SyS_writev+0x27/0x30 fs/read_write.c:1014
entry_SYSCALL_64_fastpath+0x1f/0xc2
RIP: 0033:0x445559
RSP: 002b:00007f6f46fceb58 EFLAGS: 00000292 ORIG_RAX: 0000000000000014
RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000445559
RDX: 0000000000000001 RSI: 0000000020f1eff0 RDI: 0000000000000005
RBP: 00000000006e19c0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000700000
R13: 0000000020f59000 R14: 0000000000000015 R15: 0000000000020400
BUG: sleeping function called from invalid context at
kernel/locking/mutex.c:752
in_atomic(): 1, irqs_disabled(): 0, pid: 23111, name: syz-executor14
INFO: lockdep is turned off.
CPU: 2 PID: 23111 Comm: syz-executor14 Not tainted 4.10.0-rc5+ #192
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs
01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:15 [inline]
dump_stack+0x2ee/0x3ef lib/dump_stack.c:51
___might_sleep+0x47e/0x650 kernel/sched/core.c:7780
__might_sleep+0x95/0x1a0 kernel/sched/core.c:7739
mutex_lock_nested+0x24f/0x1730 kernel/locking/mutex.c:752
atomic_dec_and_mutex_lock+0x119/0x160 kernel/locking/mutex.c:1060
__static_key_slow_dec+0x7a/0x1e0 kernel/jump_label.c:149
static_key_slow_dec+0x51/0x90 kernel/jump_label.c:174
net_disable_timestamp+0x3b/0x50 net/core/dev.c:1728
sock_disable_timestamp+0x98/0xc0 net/core/sock.c:403
__sk_destruct+0x27d/0x6b0 net/core/sock.c:1441
sk_destruct+0x47/0x80 net/core/sock.c:1460
__sk_free+0x57/0x230 net/core/sock.c:1468
sock_wfree+0xae/0x120 net/core/sock.c:1645
skb_release_head_state+0xfc/0x200 net/core/skbuff.c:655
skb_release_all+0x15/0x60 net/core/skbuff.c:668
__kfree_skb+0x15/0x20 net/core/skbuff.c:684
kfree_skb+0x16e/0x4c0 net/core/skbuff.c:705
inet_frag_destroy+0x121/0x290 net/ipv4/inet_fragment.c:304
inet_frag_put include/net/inet_frag.h:133 [inline]
nf_ct_frag6_gather+0x1106/0x3840
net/ipv6/netfilter/nf_conntrack_reasm.c:617
ipv6_defrag+0x1be/0x2b0 net/ipv6/netfilter/nf_defrag_ipv6_hooks.c:68
nf_hook_entry_hookfn include/linux/netfilter.h:102 [inline]
nf_hook_slow+0xc3/0x290 net/netfilter/core.c:310
nf_hook include/linux/netfilter.h:212 [inline]
__ip6_local_out+0x489/0x840 net/ipv6/output_core.c:160
ip6_local_out+0x2d/0x170 net/ipv6/output_core.c:170
ip6_send_skb+0xa1/0x340 net/ipv6/ip6_output.c:1722
ip6_push_pending_frames+0xb3/0xe0 net/ipv6/ip6_output.c:1742
rawv6_push_pending_frames net/ipv6/raw.c:613 [inline]
rawv6_sendmsg+0x2d1a/0x3ec0 net/ipv6/raw.c:927
inet_sendmsg+0x164/0x5b0 net/ipv4/af_inet.c:744
sock_sendmsg_nosec net/socket.c:635 [inline]
sock_sendmsg+0xca/0x110 net/socket.c:645
sock_write_iter+0x326/0x600 net/socket.c:848
do_iter_readv_writev+0x2e3/0x5b0 fs/read_write.c:695
do_readv_writev+0x42c/0x9b0 fs/read_write.c:872
vfs_writev+0x87/0xc0 fs/read_write.c:911
do_writev+0x110/0x2c0 fs/read_write.c:944
SYSC_writev fs/read_write.c:1017 [inline]
SyS_writev+0x27/0x30 fs/read_write.c:1014
entry_SYSCALL_64_fastpath+0x1f/0xc2
RIP: 0033:0x445559--- net/core/dev.c | 31 +++++++++++++------------------ 1 file changed, 13 insertions(+), 18 deletions(-)
net/core/dev.c +13 -18
@@ -1594,24 +1594,19 @@ EXPORT_SYMBOL(call_netdevice_notifiers);static struct static_key netstamp_needed__read_mostly ;#ifdef HAVE_JUMP_LABEL -/* We are not allowed to call static_key_slow_dec() from irq context -* If net_disable_timestamp() is called from irq context, defer the -* static_key_slow_dec() calls. -*/ static atomic_t netstamp_needed_deferred; -#endif - -void net_enable_timestamp (void ) +static void netstamp_clear (struct work_struct *work) { -#ifdef HAVE_JUMP_LABEL int deferred =atomic_xchg (&netstamp_needed_deferred,0 ); -if (deferred) { -while (--deferred) -static_key_slow_dec (&netstamp_needed); -return ; - } +while (deferred--) +static_key_slow_dec (&netstamp_needed); +} +static DECLARE_WORK(netstamp_work, netstamp_clear);#endif + +void net_enable_timestamp (void ) +{static_key_slow_inc (&netstamp_needed); }EXPORT_SYMBOL (net_enable_timestamp);
@@ -1619,12 +1614,12 @@ EXPORT_SYMBOL(net_enable_timestamp);void net_disable_timestamp (void ) {#ifdef HAVE_JUMP_LABEL -if (in_interrupt ()) { -atomic_inc (&netstamp_needed_deferred); -return ; - } -#endif +/* net_disable_timestamp() can be called from non process context */ +atomic_inc (&netstamp_needed_deferred); +schedule_work (&netstamp_work); +#else static_key_slow_dec (&netstamp_needed); +#endif }EXPORT_SYMBOL (net_disable_timestamp);
Signature · 1 line
2.12.0
PATCH 54/113 ipv4: keep skb->dst around in presence of IP options
In reply to Jiri SlabyFrom: Eric Dumazet <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit 34b2cef20f19c87999fff3da4071e66937db9644 ]
Andrey Konovalov got crashes in __ip_options_echo() when a NULL skb->dst is accessed.
ipv4_pktinfo_prepare() should not drop the dst if (evil) IP options are present.
We could refine the test to the presence of ts_needtime or srr, but IP options are not often used, so let's be conservative.
Thanks to syzkaller team for finding this bug.
--- net/ipv4/ip_sockglue.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
net/ipv4/ip_sockglue.c +8 -1
@@ -1044,7 +1044,14 @@ void ipv4_pktinfo_prepare(struct sk_buff *skb) pktinfo->ipi_ifindex =0 ; pktinfo->ipi_spec_dst.s_addr =0 ; } -skb_dst_drop (skb); +/* We need to keep the dst for __ip_options_echo() +* We could restrict the test to opt.ts_needtime || opt.srr, +* but the following is good enough as IP options are not often used. +*/ +if (unlikely (IPCB (skb)->opt.optlen)) +skb_dst_force (skb); +else +skb_dst_drop (skb); } int ip_setsockopt(struct sock *sk, int level,
Signature · 1 line
2.12.0
PATCH 55/113 netlabel: out of bound access in cipso_v4_validate()
In reply to Jiri SlabyFrom: Eric Dumazet <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit d71b7896886345c53ef1d84bda2bc758554f5d61 ]
syzkaller found another out of bound access in ip_options_compile(), or more exactly in cipso_v4_validate()
--- include/net/cipso_ipv4.h | 4 ++++ net/ipv4/cipso_ipv4.c | 4 ++++ 2 files changed, 8 insertions(+)
include/net/cipso_ipv4.h +4 -0
@@ -303,6 +303,10 @@ static inline int cipso_v4_validate(const struct sk_buff *skb, }for (opt_iter =6 ; opt_iter < opt_len;) { +if (opt_iter +1 == opt_len) { + err_offset = opt_iter; + goto out; + } tag_len = opt[opt_iter +1 ];if ((tag_len ==0 ) || (opt[opt_iter +1 ] > (opt_len - opt_iter))) { err_offset = opt_iter +1 ;
net/ipv4/cipso_ipv4.c +4 -0
@@ -1649,6 +1649,10 @@ int cipso_v4_validate(const struct sk_buff *skb, unsigned char **option) goto validate_return_locked; } +if (opt_iter +1 == opt_len) { + err_offset = opt_iter; + goto validate_return_locked; + } tag_len = tag[1 ];if (tag_len > (opt_len - opt_iter)) { err_offset = opt_iter +1 ;
Signature · 1 line
2.12.0
PATCH 56/113 ip6_gre: fix ip6gre_err() invalid reads
In reply to Jiri SlabyFrom: Eric Dumazet <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit 7892032cfe67f4bde6fc2ee967e45a8fbaf33756 ]
Andrey Konovalov reported out of bound accesses in ip6gre_err()
If GRE flags contains GRE_KEY, the following expression *(((__be32 *)p) + (grehlen / 4) - 1)
accesses data ~40 bytes after the expected point, since grehlen includes the size of IPv6 headers.
Let's use a "struct gre_base_hdr *greh" pointer to make this code more readable.
p[1] becomes greh->protocol.
grhlen is the GRE header length.
--- net/ipv6/ip6_gre.c | 41 ++++++++++++++++++++++------------------- 1 file changed, 22 insertions(+), 19 deletions(-)
net/ipv6/ip6_gre.c +22 -19
@@ -55,6 +55,7 @@#include <net/ip6_fib.h> #include <net/ip6_route.h> #include <net/ip6_tunnel.h> +#include <net/gre.h> static bool log_ecn_error = true;
@@ -366,35 +367,37 @@ static void ip6gre_tunnel_uninit(struct net_device *dev)static void ip6gre_err (struct sk_buff *skb,struct inet6_skb_parm *opt, -u8 type,u8 code,int offset,__be32 info) +u8 type,u8 code,int offset,__be32 info) { -const struct ipv6hdr *ipv6h = (const struct ipv6hdr *)skb->data; -__be16 *p = (__be16 *)(skb->data + offset); -int grehlen = offset +4 ; +const struct gre_base_hdr *greh; +const struct ipv6hdr *ipv6h; +int grehlen =sizeof (*greh);struct ip6_tnl *t; +int key_off =0 ;__be16 flags; +__be32 key; - flags = p[0 ]; -if (flags&(GRE_CSUM |GRE_KEY |GRE_SEQ |GRE_ROUTING |GRE_VERSION )) { -if (flags&(GRE_VERSION |GRE_ROUTING )) -return ; -if (flags&GRE_KEY ) { - grehlen +=4 ; -if (flags&GRE_CSUM ) - grehlen +=4 ; - } +if (!pskb_may_pull (skb, offset + grehlen)) +return ; + greh = (const struct gre_base_hdr *)(skb->data + offset); + flags = greh->flags; +if (flags & (GRE_VERSION |GRE_ROUTING )) +return ; +if (flags &GRE_CSUM ) + grehlen +=4 ; +if (flags &GRE_KEY ) { + key_off = grehlen + offset; + grehlen +=4 ; } -/* If only 8 bytes returned, keyed message will be dropped here */ -if (!pskb_may_pull (skb, grehlen)) +if (!pskb_may_pull (skb, offset + grehlen))return ; ipv6h = (const struct ipv6hdr *)skb->data; - p = (__be16 *)(skb->data + offset); + greh = (const struct gre_base_hdr *)(skb->data + offset); + key = key_off ? *(__be32 *)(skb->data + key_off) :0 ; t =ip6gre_tunnel_lookup (skb->dev, &ipv6h->daddr, &ipv6h->saddr, - flags &GRE_KEY ? - *(((__be32 *)p) + (grehlen /4 ) -1 ) :0 , - p[1 ]); + key, greh->protocol);if (t ==NULL )return ;
Signature · 1 line
2.12.0
PATCH 57/113 tcp: avoid infinite loop in tcp_splice_read()
In reply to Jiri SlabyFrom: Eric Dumazet <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit ccf7abb93af09ad0868ae9033d1ca8108bdaec82 ]
Splicing from TCP socket is vulnerable when a packet with URG flag is received and stored into receive queue.
__tcp_splice_read() returns 0, and sk_wait_data() immediately returns since there is the problematic skb in queue.
This is a nice way to burn cpu (aka infinite loop) and trigger soft lockups.
Again, this gem was found by syzkaller tool.
--- net/ipv4/tcp.c | 6 ++++++ 1 file changed, 6 insertions(+)
net/ipv4/tcp.c +6 -0
@@ -722,6 +722,12 @@ ssize_t tcp_splice_read(struct socket *sock, loff_t *ppos, ret = -EAGAIN ;break ; } +/* if __tcp_splice_read() got nothing while we have +* an skb in receive queue, we do not want to loop. +* This might happen with URG data. +*/ +if (!skb_queue_empty (&sk->sk_receive_queue)) +break ;sk_wait_data (sk, &timeo);if (signal_pending (current)) { ret =sock_intr_errno (timeo);
Signature · 1 line
2.12.0
PATCH 58/113 tun: read vnet_hdr_sz once
In reply to Jiri SlabyFrom: Willem de Bruijn <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit e1edab87faf6ca30cd137e0795bc73aa9a9a22ec ]
When IFF_VNET_HDR is enabled, a virtio_net header must precede data. Data length is verified to be greater than or equal to expected header length tun->vnet_hdr_sz before copying.
Read this value once and cache locally, as it can be updated between the test and use (TOCTOU).
[js] we have TUN_VNET_HDR in 3.12
--- drivers/net/tun.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/net/tun.c +6 -4
@@ -997,9 +997,11 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile, }if (tun->flags &TUN_VNET_HDR ) { -if (len < tun->vnet_hdr_sz) +int vnet_hdr_sz =READ_ONCE (tun->vnet_hdr_sz); + +if (len < vnet_hdr_sz)return -EINVAL ; - len -= tun->vnet_hdr_sz; + len -= vnet_hdr_sz;if (memcpy_fromiovecend ((void *)&gso, iv, offset,sizeof (gso)))return -EFAULT ;
@@ -1010,7 +1012,7 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,if (gso.hdr_len > len)return -EINVAL ; - offset += tun->vnet_hdr_sz; + offset += vnet_hdr_sz; }if ((tun->flags &TUN_TYPE_MASK ) ==TUN_TAP_DEV ) {
@@ -1193,7 +1195,7 @@ static ssize_t tun_put_user(struct tun_struct *tun, vlan_hlen =VLAN_HLEN ;if (tun->flags &TUN_VNET_HDR ) - vnet_hdr_sz = tun->vnet_hdr_sz; + vnet_hdr_sz =READ_ONCE (tun->vnet_hdr_sz);if (!(tun->flags &TUN_NO_PI )) {if ((len -=sizeof (pi)) <0 )
Signature · 1 line
2.12.0
PATCH 59/113 macvtap: read vnet_hdr_size once
In reply to Jiri SlabyFrom: Willem de Bruijn <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit 837585a5375c38d40361cfe64e6fd11e1addb936 ]
When IFF_VNET_HDR is enabled, a virtio_net header must precede data. Data length is verified to be greater than or equal to expected header length tun->vnet_hdr_sz before copying.
Macvtap functions read the value once, but unless READ_ONCE is used, the compiler may ignore this and read multiple times. Enforce a single read and locally cached value to avoid updates between test and use.
--- drivers/net/macvtap.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/macvtap.c +2 -2
@@ -655,7 +655,7 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m,size_t linear;if (q->flags &IFF_VNET_HDR ) { - vnet_hdr_len = q->vnet_hdr_sz; + vnet_hdr_len =READ_ONCE (q->vnet_hdr_sz); err = -EINVAL ;if (len < vnet_hdr_len)
@@ -792,7 +792,7 @@ static ssize_t macvtap_put_user(struct macvtap_queue *q,if (q->flags &IFF_VNET_HDR ) {struct virtio_net_hdr vnet_hdr; - vnet_hdr_len = q->vnet_hdr_sz; + vnet_hdr_len =READ_ONCE (q->vnet_hdr_sz);if ((len -= vnet_hdr_len) <0 )return -EINVAL ;
Signature · 1 line
2.12.0
PATCH 60/113 sctp: avoid BUG_ON on sctp_wait_for_sndbuf
In reply to Jiri SlabyFrom: Marcelo Ricardo Leitner <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit 2dcab598484185dea7ec22219c76dcdd59e3cb90 ]
Alexander Popov reported that an application may trigger a BUG_ON in sctp_wait_for_sndbuf if the socket tx buffer is full, a thread is waiting on it to queue more data and meanwhile another thread peels off the association being used by the first thread.
This patch replaces the BUG_ON call with a proper error handling. It will return -EPIPE to the original sendmsg call, similarly to what would have been done if the association wasn't found in the first place.
--- net/sctp/socket.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/sctp/socket.c +2 -1
@@ -6712,7 +6712,8 @@ static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p,*/ sctp_release_sock (sk); current_timeo =schedule_timeout (current_timeo); -BUG_ON (sk != asoc->base.sk); +if (sk != asoc->base.sk) + goto do_error;sctp_lock_sock (sk); *timeo_p = current_timeo;
Signature · 1 line
2.12.0
PATCH 61/113 packet: round up linear to header len
In reply to Jiri SlabyFrom: Willem de Bruijn <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit 57031eb794906eea4e1c7b31dc1e2429c0af0c66 ]
Link layer protocols may unconditionally pull headers, as Ethernet does in eth_type_trans. Ensure that the entire link layer header always lies in the skb linear segment. tpacket_snd has such a check. Extend this to packet_snd.
Variable length link layer headers complicate the computation somewhat. Here skb->len may be smaller than dev->hard_header_len.
Round up the linear length to be at least as long as the smallest of the two.
[js] no virtio helpers in 3.12
--- net/packet/af_packet.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
net/packet/af_packet.c +4 -2
@@ -2255,7 +2255,7 @@ static int packet_snd(struct socket *sock,int vnet_hdr_len;struct packet_sock *po =pkt_sk (sk);unsigned short gso_type =0 ; -int hlen, tlen; +int hlen, tlen, linear;int extra_len =0 ;/*
@@ -2349,7 +2349,9 @@ static int packet_snd(struct socket *sock, err = -ENOBUFS ; hlen =LL_RESERVED_SPACE (dev); tlen = dev->needed_tailroom; - skb =packet_alloc_skb (sk, hlen + tlen, hlen, len, vnet_hdr.hdr_len, + linear = vnet_hdr.hdr_len; + linear =max (linear,min_t (int, len, dev->hard_header_len)); + skb =packet_alloc_skb (sk, hlen + tlen, hlen, len, linear, msg->msg_flags &MSG_DONTWAIT , &err);if (skb ==NULL ) goto out_unlock;
Signature · 1 line
2.12.0
PATCH 62/113 ping: fix a null pointer dereference
In reply to Jiri SlabyFrom: WANG Cong <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit 73d2c6678e6c3af7e7a42b1e78cd0211782ade32 ]
Andrey reported a kernel crash:
general protection fault: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
(ftrace buffer empty)
Modules linked in:
CPU: 2 PID: 3880 Comm: syz-executor1 Not tainted 4.10.0-rc6+ #124
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
task: ffff880060048040 task.stack: ffff880069be8000
RIP: 0010:ping_v4_push_pending_frames net/ipv4/ping.c:647 [inline]
RIP: 0010:ping_v4_sendmsg+0x1acd/0x23f0 net/ipv4/ping.c:837
RSP: 0018:ffff880069bef8b8 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: ffff880069befb90 RCX: 0000000000000000
RDX: 0000000000000018 RSI: ffff880069befa30 RDI: 00000000000000c2
RBP: ffff880069befbb8 R08: 0000000000000008 R09: 0000000000000000
R10: 0000000000000002 R11: 0000000000000000 R12: ffff880069befab0
R13: ffff88006c624a80 R14: ffff880069befa70 R15: 0000000000000000
FS: 00007f6f7c716700(0000) GS:ffff88006de00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000004a6f28 CR3: 000000003a134000 CR4: 00000000000006e0
Call Trace:
inet_sendmsg+0x164/0x5b0 net/ipv4/af_inet.c:744
sock_sendmsg_nosec net/socket.c:635 [inline]
sock_sendmsg+0xca/0x110 net/socket.c:645
SYSC_sendto+0x660/0x810 net/socket.c:1687
SyS_sendto+0x40/0x50 net/socket.c:1655
entry_SYSCALL_64_fastpath+0x1f/0xc2This is because we miss a check for NULL pointer for skb_peek() when the queue is empty. Other places already have the same check.
--- net/ipv4/ping.c | 2 ++ 1 file changed, 2 insertions(+)
net/ipv4/ping.c +2 -0
@@ -640,6 +640,8 @@ static int ping_v4_push_pending_frames(struct sock *sk, struct pingfakehdr *pfh, {struct sk_buff *skb =skb_peek (&sk->sk_write_queue); +if (!skb) +return 0 ; pfh->wcheck =csum_partial ((char *)&pfh->icmph,sizeof (struct icmphdr ), pfh->wcheck); pfh->icmph.checksum =csum_fold (pfh->wcheck);
Signature · 1 line
2.12.0
PATCH 63/113 l2tp: do not use udp_ioctl()
In reply to Jiri SlabyFrom: Eric Dumazet <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit 72fb96e7bdbbdd4421b0726992496531060f3636 ]
udp_ioctl(), as its name suggests, is used by UDP protocols, but is also used by L2TP :(
L2TP should use its own handler, because it really does not look the same.
SIOCINQ for instance should not assume UDP checksum or headers.
Thanks to Andrey and syzkaller team for providing the report and a nice reproducer.
While crashes only happen on recent kernels (after commit 7c13f97ffde6 ("udp: do fwd memory scheduling on dequeue")), this probably needs to be backported to older kernels.
--- net/l2tp/l2tp_core.h | 1 + net/l2tp/l2tp_ip.c | 27 ++++++++++++++++++++++++++- net/l2tp/l2tp_ip6.c | 2 +- 3 files changed, 28 insertions(+), 2 deletions(-)
net/l2tp/l2tp_core.h +1 -0
@@ -261,6 +261,7 @@ extern int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, intextern int l2tp_nl_register_ops (enum l2tp_pwtype pw_type,const struct l2tp_nl_cmd_ops *ops);extern void l2tp_nl_unregister_ops (enum l2tp_pwtype pw_type); +int l2tp_ioctl (struct sock *sk,int cmd,unsigned long arg);/* Session reference counts. Incremented when code obtains a reference * to a session.
net/l2tp/l2tp_ip.c +26 -1
@@ -11,6 +11,7 @@#define pr_fmt (fmt) KBUILD_MODNAME ": " fmt +#include <asm/ioctls.h> #include <linux/icmp.h> #include <linux/module.h> #include <linux/skbuff.h>
@@ -555,6 +556,30 @@ out:return err ? err : copied; } +int l2tp_ioctl (struct sock *sk,int cmd,unsigned long arg) +{ +struct sk_buff *skb; +int amount; + +switch (cmd) { +case SIOCOUTQ : + amount =sk_wmem_alloc_get (sk); +break ; +case SIOCINQ : +spin_lock_bh (&sk->sk_receive_queue.lock); + skb =skb_peek (&sk->sk_receive_queue); + amount = skb ? skb->len :0 ; +spin_unlock_bh (&sk->sk_receive_queue.lock); +break ; + +default : +return -ENOIOCTLCMD ; + } + +return put_user (amount, (int __user *)arg); +} +EXPORT_SYMBOL (l2tp_ioctl); +static struct proto l2tp_ip_prot = { .name ="L2TP/IP" , .owner =THIS_MODULE ,
@@ -563,7 +588,7 @@ static struct proto l2tp_ip_prot = { .bind = l2tp_ip_bind, .connect = l2tp_ip_connect, .disconnect = l2tp_ip_disconnect, - .ioctl = udp_ioctl, + .ioctl = l2tp_ioctl, .destroy = l2tp_ip_destroy_sock, .setsockopt = ip_setsockopt, .getsockopt = ip_getsockopt,
net/l2tp/l2tp_ip6.c +1 -1
@@ -721,7 +721,7 @@ static struct proto l2tp_ip6_prot = { .bind = l2tp_ip6_bind, .connect = l2tp_ip6_connect, .disconnect = l2tp_ip6_disconnect, - .ioctl = udp_ioctl, + .ioctl = l2tp_ioctl, .destroy = l2tp_ip6_destroy_sock, .setsockopt = ipv6_setsockopt, .getsockopt = ipv6_getsockopt,
Signature · 1 line
2.12.0
PATCH 64/113 scsi: move the nr_phys_segments assert into scsi_init_io
In reply to Jiri SlabyFrom: Christoph Hellwig <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 635d98b1d0cfc2ba3426a701725d31a6102c059a upstream.
scsi_init_io should only be called for requests that transfer data, so move the assert that a request has segments from the callers into scsi_init_io.
--- drivers/scsi/scsi_lib.c | 16 +++++----------- 1 file changed, 5 insertions(+), 11 deletions(-)
drivers/scsi/scsi_lib.c +5 -11
@@ -1025,8 +1025,11 @@ static int scsi_init_sgtable(struct request *req, struct scsi_data_buffer *sdb,int scsi_init_io (struct scsi_cmnd *cmd,gfp_t gfp_mask) {struct request *rq = cmd->request; +int error; -int error =scsi_init_sgtable (rq, &cmd->sdb, gfp_mask); +BUG_ON (!rq->nr_phys_segments); + + error =scsi_init_sgtable (rq, &cmd->sdb, gfp_mask);if (error) goto err_exit;
@@ -1128,11 +1131,7 @@ int scsi_setup_blk_pc_cmnd(struct scsi_device *sdev, struct request *req)* submit a request without an attached bio. */ if (req->bio) { -int ret; - -BUG_ON (!req->nr_phys_segments); - - ret =scsi_init_io (cmd,GFP_ATOMIC ); +int ret =scsi_init_io (cmd,GFP_ATOMIC );if (unlikely (ret))return ret; }else {
@@ -1176,11 +1175,6 @@ int scsi_setup_fs_cmnd(struct scsi_device *sdev, struct request *req)return ret; } -/* -* Filesystem requests must transfer data. -*/ -BUG_ON (!req->nr_phys_segments); - cmd =scsi_get_cmd_from_req (sdev, req);if (unlikely (!cmd))return BLKPREP_DEFER ;
Signature · 1 line
2.12.0
PATCH 65/113 vfs: fix uninitialized flags in splice_to_pipe()
In reply to Jiri SlabyFrom: Miklos Szeredi <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 5a81e6a171cdbd1fa8bc1fdd80c23d3d71816fac upstream.
Flags (PIPE_BUF_FLAG_PACKET, PIPE_BUF_FLAG_GIFT) could remain on the unused part of the pipe ring buffer. Previously splice_to_pipe() left the flags value alone, which could result in incorrect behavior.
Uninitialized flags appears to have been there from the introduction of the splice syscall.
--- fs/splice.c | 1 + 1 file changed, 1 insertion(+)
fs/splice.c +1 -0
@@ -215,6 +215,7 @@ ssize_t splice_to_pipe(struct pipe_inode_info *pipe, buf->len = spd->partial[page_nr].len; buf->private = spd->partial[page_nr].private; buf->ops = spd->ops; + buf->flags =0 ;if (spd->flags &SPLICE_F_GIFT ) buf->flags |=PIPE_BUF_FLAG_GIFT ;
Signature · 1 line
2.12.0
PATCH 66/113 siano: make it work again with CONFIG_VMAP_STACK
In reply to Jiri SlabyFrom: Mauro Carvalho Chehab <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit f9c85ee67164b37f9296eab3b754e543e4e96a1c upstream.
Reported as a Kaffeine bug:
https://bugs.kde.org/show_bug.cgi?id=375811
The USB control messages require DMA to work. We cannot pass a stack-allocated buffer, as it is not warranted that the stack would be into a DMA enabled area.
On Kernel 4.9, the default is to not accept DMA on stack anymore on x86 architecture. On other architectures, this has been a requirement since Kernel 2.2. So, after this patch, this driver should likely work fine on all archs.
Tested with USB ID 2040:5510: Hauppauge Windham
--- drivers/media/usb/siano/smsusb.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-)
drivers/media/usb/siano/smsusb.c +13 -5
@@ -206,20 +206,28 @@ static int smsusb_start_streaming(struct smsusb_device_t *dev)static int smsusb_sendrequest (void *context,void *buffer,size_t size) {struct smsusb_device_t *dev = (struct smsusb_device_t *) context; -struct sms_msg_hdr *phdr = (struct sms_msg_hdr *) buffer; -int dummy; +struct sms_msg_hdr *phdr; +int dummy, ret;if (dev->state !=SMSUSB_ACTIVE )return -ENOENT ; + phdr =kmalloc (size,GFP_KERNEL ); +if (!phdr) +return -ENOMEM ; +memcpy (phdr, buffer, size); +sms_debug ("sending %s(%d) size: %d" ,smscore_translate_msg (phdr->msg_type), phdr->msg_type, phdr->msg_length);smsendian_handle_tx_message ((struct sms_msg_data *) phdr); -smsendian_handle_message_header ((struct sms_msg_hdr *)buffer); -return usb_bulk_msg (dev->udev,usb_sndbulkpipe (dev->udev,2 ), - buffer, size, &dummy,1000 ); +smsendian_handle_message_header ((struct sms_msg_hdr *)phdr); + ret =usb_bulk_msg (dev->udev,usb_sndbulkpipe (dev->udev,2 ), + phdr, size, &dummy,1000 ); + +kfree (phdr); +return ret; }static char *smsusb1_fw_lkup[] = {
Signature · 1 line
2.12.0
PATCH 67/113 scsi: don't BUG_ON() empty DMA transfers
In reply to Jiri SlabyFrom: Johannes Thumshirn <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit fd3fc0b4d7305fa7246622dcc0dec69c42443f45 upstream.
Don't crash the machine just because of an empty transfer. Use WARN_ON() combined with returning an error.
Found by Dmitry Vyukov and syzkaller.
[ Changed to "WARN_ON_ONCE()". Al has a patch that should fix the root
cause, but a BUG_ON() is not acceptable in any case, and a WARN_ON() might still be a cause of excessive log spamming.
NOTE! If this warning ever triggers, we may end up leaking resources, since this doesn't bother to try to clean the command up. So this WARN_ON_ONCE() triggering does imply real problems. But BUG_ON() is much worse.
People really need to stop using BUG_ON() for "this shouldn't ever
happen". It makes pretty much any bug worse. - Linus ]
--- drivers/scsi/scsi_lib.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/scsi/scsi_lib.c +2 -1
@@ -1027,7 +1027,8 @@ int scsi_init_io(struct scsi_cmnd *cmd, gfp_t gfp_mask)struct request *rq = cmd->request;int error; -BUG_ON (!rq->nr_phys_segments); +if (WARN_ON_ONCE (!rq->nr_phys_segments)) +return -EINVAL ; error =scsi_init_sgtable (rq, &cmd->sdb, gfp_mask);if (error)
Signature · 1 line
2.12.0
PATCH 68/113 futex: Move futex_init() to core_initcall
In reply to Jiri SlabyFrom: Yang Yang <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 25f71d1c3e98ef0e52371746220d66458eac75bc upstream.
The UEVENT user mode helper is enabled before the initcalls are executed and is available when the root filesystem has been mounted.
The user mode helper is triggered by device init calls and the executable might use the futex syscall.
futex_init() is marked __initcall which maps to device_initcall, but there is no guarantee that futex_init() is invoked _before_ the first device init call which triggers the UEVENT user mode helper.
If the user mode helper uses the futex syscall before futex_init() then the syscall crashes with a NULL pointer dereference because the futex subsystem has not been initialized yet.
Move futex_init() to core_initcall so futexes are initialized before the root filesystem is mounted and the usermode helper becomes available.
[ tglx: Rewrote changelog ]
--- kernel/futex.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/futex.c +1 -1
@@ -2905,4 +2905,4 @@ static int __init futex_init(void)return 0 ; } -__initcall (futex_init); +core_initcall (futex_init);
Signature · 1 line
2.12.0
PATCH 69/113 printk: use rcuidle console tracepoint
In reply to Jiri SlabyFrom: Sergey Senozhatsky <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit fc98c3c8c9dcafd67adcce69e6ce3191d5306c9c upstream.
Use rcuidle console tracepoint because, apparently, it may be issued from an idle CPU:
hw-breakpoint: Failed to enable monitor mode on CPU 0.
hw-breakpoint: CPU 0 failed to disable vector catch
===============================
[ ERR: suspicious RCU usage. ]
4.10.0-rc8-next-20170215+ #119 Not tainted
-------------------------------
./include/trace/events/printk.h:32 suspicious rcu_dereference_check() usage!
other info that might help us debug this:
RCU used illegally from idle CPU!
rcu_scheduler_active = 2, debug_locks = 0
RCU used illegally from extended quiescent state!
2 locks held by swapper/0/0:
#0: (cpu_pm_notifier_lock){......}, at: [<c0237e2c>] cpu_pm_exit+0x10/0x54 #1: (console_lock){+.+.+.}, at: [<c01ab350>] vprintk_emit+0x264/0x474
stack backtrace:
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.10.0-rc8-next-20170215+ #119
Hardware name: Generic OMAP4 (Flattened Device Tree)
console_unlock
vprintk_emit
vprintk_default
printk
reset_ctrl_regs
dbg_cpu_pm_notify
notifier_call_chain
cpu_pm_exit
omap_enter_idle_coupled
cpuidle_enter_state
cpuidle_enter_state_coupled
do_idle
cpu_startup_entry
start_kernelThis RCU warning, however, is suppressed by lockdep_off() in printk(). lockdep_off() increments the ->lockdep_recursion counter and thus disables RCU_LOCKDEP_WARN() and debug_lockdep_rcu_enabled(), which want lockdep to be enabled "current->lockdep_recursion == 0".
--- kernel/printk/printk.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/printk/printk.c +1 -1
@@ -1261,7 +1261,7 @@ static void call_console_drivers(int level, const char *text, size_t len) {struct console *con; -trace_console (text, len); +trace_console_rcuidle (text, len);if (level >= console_loglevel && !ignore_loglevel)return ;
Signature · 1 line
2.12.0
PATCH 70/113 rtc: interface: ignore expired timers when enqueuing new timers
In reply to Jiri SlabyFrom: Colin Ian King <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 2b2f5ff00f63847d95adad6289bd8b05f5983dd5 upstream.
This patch fixes a RTC wakealarm issue, namely, the event fires during hibernate and is not cleared from the list, causing hwclock to block.
The current enqueuing does not trigger an alarm if any expired timers already exist on the timerqueue. This can occur when a RTC wake alarm is used to wake a machine out of hibernate and the resumed state has old expired timers that have not been removed from the timer queue. This fix skips over any expired timers and triggers an alarm if there are no pending timers on the timerqueue. Note that the skipped expired timer will get reaped later on, so there is no need to clean it up immediately.
The issue can be reproduced by putting a machine into hibernate and waking it with the RTC wakealarm. Running the example RTC test program from tools/testing/selftests/timers/rtctest.c after the hibernate will block indefinitely. With the fix, it no longer blocks after the hibernate resume.
--- drivers/rtc/interface.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-)
drivers/rtc/interface.c +15 -1
@@ -773,9 +773,23 @@ EXPORT_SYMBOL_GPL(rtc_irq_set_freq);*/ static int rtc_timer_enqueue (struct rtc_device *rtc,struct rtc_timer *timer) { +struct timerqueue_node *next =timerqueue_getnext (&rtc->timerqueue); +struct rtc_time tm; +ktime_t now; + timer->enabled =1 ; +__rtc_read_time (rtc, &tm); + now =rtc_tm_to_ktime (tm); + +/* Skip over expired timers */ +while (next) { +if (next->expires.tv64 >= now.tv64) +break ; + next =timerqueue_iterate_next (next); + } +timerqueue_add (&rtc->timerqueue, &timer->node); -if (&timer->node ==timerqueue_getnext (&rtc->timerqueue)) { +if (!next) {struct rtc_wkalrm alarm;int err; alarm.time =rtc_ktime_to_tm (timer->node.expires);
Signature · 1 line
2.12.0
PATCH 71/113 net/llc: avoid BUG_ON() in skb_orphan()
In reply to Jiri SlabyFrom: Eric Dumazet <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit 8b74d439e1697110c5e5c600643e823eb1dd0762 ]
It seems nobody used LLC since linux-3.12.
Fortunately fuzzers like syzkaller still know how to run this code, otherwise it would be no fun.
Setting skb->sk without skb->destructor leads to all kinds of bugs, we now prefer to be very strict about it.
Ideally here we would use skb_set_owner() but this helper does not exist yet, only CAN seems to have a private helper for that.
[js] take sock_efree from 62bccb8cdb6905
--- include/net/sock.h | 1 + net/core/sock.c | 6 ++++++ net/llc/llc_conn.c | 3 +++ net/llc/llc_sap.c | 3 +++ 4 files changed, 13 insertions(+)
include/net/sock.h +1 -0
@@ -1554,6 +1554,7 @@ extern struct sk_buff *sock_rmalloc(struct sock *sk,extern void sock_wfree (struct sk_buff *skb);extern void skb_orphan_partial (struct sk_buff *skb);extern void sock_rfree (struct sk_buff *skb); +void sock_efree (struct sk_buff *skb);extern void sock_edemux (struct sk_buff *skb); extern int sock_setsockopt(struct socket *sock, int level,
net/core/sock.c +6 -0
@@ -1656,6 +1656,12 @@ void sock_rfree(struct sk_buff *skb) }EXPORT_SYMBOL (sock_rfree); +void sock_efree (struct sk_buff *skb) +{ +sock_put (skb->sk); +} +EXPORT_SYMBOL (sock_efree); +void sock_edemux (struct sk_buff *skb) {struct sock *sk = skb->sk;
net/llc/llc_conn.c +3 -0
@@ -821,7 +821,10 @@ void llc_conn_handler(struct llc_sap *sap, struct sk_buff *skb)* another trick required to cope with how the PROCOM state * machine works. -acme */ +skb_orphan (skb); +sock_hold (sk); skb->sk = sk; + skb->destructor = sock_efree; }if (!sock_owned_by_user (sk))llc_conn_rcv (sk, skb);
net/llc/llc_sap.c +3 -0
@@ -290,7 +290,10 @@ static void llc_sap_rcv(struct llc_sap *sap, struct sk_buff *skb, ev->type =LLC_SAP_EV_TYPE_PDU ; ev->reason =0 ; +skb_orphan (skb); +sock_hold (sk); skb->sk = sk; + skb->destructor = sock_efree;llc_sap_state_process (sap, skb); }
Signature · 1 line
2.12.0
PATCH 72/113 packet: fix races in fanout_add()
In reply to Jiri SlabyFrom: Eric Dumazet <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit d199fab63c11998a602205f7ee7ff7c05c97164b ]
Multiple threads can call fanout_add() at the same time.
We need to grab fanout_mutex earlier to avoid races that could lead to one thread freeing po->rollover that was set by another thread.
Do the same in fanout_release(), for peace of mind, and to help us finding lockdep issues earlier.
[js] no rollover in 3.12
--- net/packet/af_packet.c | 26 ++++++++++++++------------ 1 file changed, 14 insertions(+), 12 deletions(-)
net/packet/af_packet.c +14 -12
@@ -1316,13 +1316,16 @@ static int fanout_add(struct sock *sk, u16 id, u16 type_flags)return -EINVAL ; } +mutex_lock (&fanout_mutex); + + err = -EINVAL ;if (!po->running) -return -EINVAL ; + goto out; + err = -EALREADY ;if (po->fanout) -return -EALREADY ; + goto out; -mutex_lock (&fanout_mutex); match =NULL ;list_for_each_entry (f, &fanout_list, list) { if (f->id == id &&
@@ -1378,17 +1381,16 @@ static void fanout_release(struct sock *sk)struct packet_sock *po =pkt_sk (sk);struct packet_fanout *f; - f = po->fanout; -if (!f) -return ; -mutex_lock (&fanout_mutex); - po->fanout =NULL ; + f = po->fanout; +if (f) { + po->fanout =NULL ; -if (atomic_dec_and_test (&f->sk_ref)) { -list_del (&f->list); -dev_remove_pack (&f->prot_hook); -kfree (f); +if (atomic_dec_and_test (&f->sk_ref)) { +list_del (&f->list); +dev_remove_pack (&f->prot_hook); +kfree (f); + } }mutex_unlock (&fanout_mutex); }
Signature · 1 line
2.12.0
PATCH 73/113 packet: Do not call fanout_release from atomic contexts
In reply to Jiri SlabyFrom: Anoob Soman <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit 2bd624b4611ffee36422782d16e1c944d1351e98 ]
Commit 6664498280cf ("packet: call fanout_release, while UNREGISTERING a netdev"), unfortunately, introduced the following issues.
1. calling mutex_lock(&fanout_mutex) (fanout_release()) from inside rcu_read-side critical section. rcu_read_lock disables preemption, most often, which prohibits calling sleeping functions.
[ ] include/linux/rcupdate.h:560 Illegal context switch in RCU read-side critical section!
[ ]
[ ] rcu_scheduler_active = 1, debug_locks = 0
[ ] 4 locks held by ovs-vswitchd/1969:
[ ] #0: (cb_lock){++++++}, at: [<ffffffff8158a6c9>] genl_rcv+0x19/0x40
[ ] #1: (ovs_mutex){+.+.+.}, at: [<ffffffffa04878ca>] ovs_vport_cmd_del+0x4a/0x100 [openvswitch]
[ ] #2: (rtnl_mutex){+.+.+.}, at: [<ffffffff81564157>] rtnl_lock+0x17/0x20
[ ] #3: (rcu_read_lock){......}, at: [<ffffffff81614165>] packet_notifier+0x5/0x3f0
[ ]
[ ] Call Trace:
[ ] [<ffffffff813770c1>] dump_stack+0x85/0xc4
[ ] [<ffffffff810c9077>] lockdep_rcu_suspicious+0x107/0x110
[ ] [<ffffffff810a2da7>] ___might_sleep+0x57/0x210
[ ] [<ffffffff810a2fd0>] __might_sleep+0x70/0x90
[ ] [<ffffffff8162e80c>] mutex_lock_nested+0x3c/0x3a0
[ ] [<ffffffff810de93f>] ? vprintk_default+0x1f/0x30
[ ] [<ffffffff81186e88>] ? printk+0x4d/0x4f
[ ] [<ffffffff816106dd>] fanout_release+0x1d/0xe0
[ ] [<ffffffff81614459>] packet_notifier+0x2f9/0x3f02. calling mutex_lock(&fanout_mutex) inside spin_lock(&po->bind_lock). "sleeping function called from invalid context"
[ ] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:620 [ ] in_atomic(): 1, irqs_disabled(): 0, pid: 1969, name: ovs-vswitchd [ ] INFO: lockdep is turned off. [ ] Call Trace: [ ] [<ffffffff813770c1>] dump_stack+0x85/0xc4 [ ] [<ffffffff810a2f52>] ___might_sleep+0x202/0x210 [ ] [<ffffffff810a2fd0>] __might_sleep+0x70/0x90 [ ] [<ffffffff8162e80c>] mutex_lock_nested+0x3c/0x3a0 [ ] [<ffffffff816106dd>] fanout_release+0x1d/0xe0 [ ] [<ffffffff81614459>] packet_notifier+0x2f9/0x3f0
3. calling dev_remove_pack(&fanout->prot_hook), from inside spin_lock(&po->bind_lock) or rcu_read-side critical-section. dev_remove_pack() -> synchronize_net(), which might sleep.
[ ] BUG: scheduling while atomic: ovs-vswitchd/1969/0x00000002 [ ] INFO: lockdep is turned off. [ ] Call Trace: [ ] [<ffffffff813770c1>] dump_stack+0x85/0xc4 [ ] [<ffffffff81186274>] __schedule_bug+0x64/0x73 [ ] [<ffffffff8162b8cb>] __schedule+0x6b/0xd10 [ ] [<ffffffff8162c5db>] schedule+0x6b/0x80 [ ] [<ffffffff81630b1d>] schedule_timeout+0x38d/0x410 [ ] [<ffffffff810ea3fd>] synchronize_sched_expedited+0x53d/0x810 [ ] [<ffffffff810ea6de>] synchronize_rcu_expedited+0xe/0x10 [ ] [<ffffffff8154eab5>] synchronize_net+0x35/0x50 [ ] [<ffffffff8154eae3>] dev_remove_pack+0x13/0x20 [ ] [<ffffffff8161077e>] fanout_release+0xbe/0xe0 [ ] [<ffffffff81614459>] packet_notifier+0x2f9/0x3f0
4. fanout_release() races with calls from different CPU.
To fix the above problems, remove the call to fanout_release() under rcu_read_lock(). Instead, call __dev_remove_pack(&fanout->prot_hook) and netdev_run_todo will be happy that &dev->ptype_specific list is empty. In order to achieve this, I moved dev_{add,remove}_pack() out of fanout_{add,release} to __fanout_{link,unlink}. So, call to {,__}unregister_prot_hook() will make sure fanout->prot_hook is removed as well.
[js] no rollover in 3.12
--- net/packet/af_packet.c | 29 +++++++++++++++++++++-------- 1 file changed, 21 insertions(+), 8 deletions(-)
net/packet/af_packet.c +21 -8
@@ -1268,6 +1268,8 @@ static void __fanout_link(struct sock *sk, struct packet_sock *po) f->arr[f->num_members] = sk;smp_wmb (); f->num_members++; +if (f->num_members ==1 ) +dev_add_pack (&f->prot_hook);spin_unlock (&f->lock); }
@@ -1284,6 +1286,8 @@ static void __fanout_unlink(struct sock *sk, struct packet_sock *po)BUG_ON (i >= f->num_members); f->arr[i] = f->arr[f->num_members -1 ]; f->num_members--; +if (f->num_members ==0 ) +__dev_remove_pack (&f->prot_hook);spin_unlock (&f->lock); }
@@ -1355,7 +1359,6 @@ static int fanout_add(struct sock *sk, u16 id, u16 type_flags) match->prot_hook.func = packet_rcv_fanout; match->prot_hook.af_packet_priv = match; match->prot_hook.id_match = match_fanout_group; -dev_add_pack (&match->prot_hook);list_add (&match->list, &fanout_list); } err = -EINVAL ;
@@ -1376,7 +1379,12 @@ out:return err; } -static void fanout_release (struct sock *sk) +/* If pkt_sk(sk)->fanout->sk_ref is zero, this function removes +* pkt_sk(sk)->fanout from fanout_list and returns pkt_sk(sk)->fanout. +* It is the responsibility of the caller to call fanout_release_data() and +* free the returned packet_fanout (after synchronize_net()) +*/ +static struct packet_fanout *fanout_release (struct sock *sk) {struct packet_sock *po =pkt_sk (sk);struct packet_fanout *f;
@@ -1386,13 +1394,14 @@ static void fanout_release(struct sock *sk)if (f) { po->fanout =NULL ; -if (atomic_dec_and_test (&f->sk_ref)) { +if (atomic_dec_and_test (&f->sk_ref))list_del (&f->list); -dev_remove_pack (&f->prot_hook); -kfree (f); - } +else + f =NULL ; }mutex_unlock (&fanout_mutex); + +return f; }static const struct proto_ops packet_ops;
@@ -2456,6 +2465,7 @@ static int packet_release(struct socket *sock) {struct sock *sk = sock->sk;struct packet_sock *po; +struct packet_fanout *f;struct net *net;union tpacket_req_u req_u;
@@ -2495,9 +2505,13 @@ static int packet_release(struct socket *sock)packet_set_ring (sk, &req_u,1 ,1 ); } -fanout_release (sk); + f =fanout_release (sk);synchronize_net (); + +if (f) { +kfree (f); + }/* * Now the socket is dead. No more input will appear. */
@@ -3375,7 +3389,6 @@ static int packet_notifier(struct notifier_block *this, }if (msg ==NETDEV_UNREGISTER ) {packet_cached_dev_reset (po); -fanout_release (sk); po->ifindex =-1 ;if (po->prot_hook.dev)dev_put (po->prot_hook.dev);
Signature · 1 line
2.12.0
PATCH 74/113 dccp: fix freeing skb too early for IPV6_RECVPKTINFO
In reply to Jiri SlabyFrom: Andrey Konovalov <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit 5edabca9d4cff7f1f2b68f0bac55ef99d9798ba4 ]
In the current DCCP implementation an skb for a DCCP_PKT_REQUEST packet is forcibly freed via __kfree_skb in dccp_rcv_state_process if dccp_v6_conn_request successfully returns.
However, if IPV6_RECVPKTINFO is set on a socket, the address of the skb is saved to ireq->pktopts and the ref count for skb is incremented in dccp_v6_conn_request, so skb is still in use. Nevertheless, it gets freed in dccp_rcv_state_process.
Fix by calling consume_skb instead of doing goto discard and therefore calling __kfree_skb.
Similar fixes for TCP:
fb7e2399ec17f1004c0e0ccfd17439f8759ede01 [TCP]: skb is unexpectedly freed. 0aea76d35c9651d55bbaf746e7914e5f9ae5a25d tcp: SYN packets are now simply consumed
--- net/dccp/input.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/dccp/input.c +2 -1
@@ -606,7 +606,8 @@ int dccp_rcv_state_process(struct sock *sk, struct sk_buff *skb,if (inet_csk (sk)->icsk_af_ops->conn_request (sk, skb) <0 )return 1 ; - goto discard; +consume_skb (skb); +return 0 ; }if (dh->dccph_type ==DCCP_PKT_RESET ) goto discard;
Signature · 1 line
2.12.0
PATCH 75/113 irda: Fix lockdep annotations in hashbin_delete().
In reply to Jiri SlabyFrom: "David S. Miller" <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit 4c03b862b12f980456f9de92db6d508a4999b788 ]
A nested lock depth was added to the hasbin_delete() code but it doesn't actually work some well and results in tons of lockdep splats.
Fix the code instead to properly drop the lock around the operation and just keep peeking the head of the hashbin queue.
--- net/irda/irqueue.c | 34 ++++++++++++++++------------------ 1 file changed, 16 insertions(+), 18 deletions(-)
net/irda/irqueue.c +16 -18
@@ -385,9 +385,6 @@ EXPORT_SYMBOL(hashbin_new);* for deallocating this structure if it's complex. If not the user can * just supply kfree, which should take care of the job. */ -#ifdef CONFIG_LOCKDEP -static int hashbin_lock_depth =0 ; -#endif int hashbin_delete (hashbin_t * hashbin,FREE_FUNC free_func) {irda_queue_t * queue;
@@ -398,22 +395,27 @@ int hashbin_delete( hashbin_t* hashbin, FREE_FUNC free_func) IRDA_ASSERT(hashbin->magic == HB_MAGIC, return -1;);/* Synchronize */ -if ( hashbin->hb_type &HB_LOCK ) { -spin_lock_irqsave_nested (&hashbin->hb_spinlock, flags, - hashbin_lock_depth++); - } +if (hashbin->hb_type &HB_LOCK ) +spin_lock_irqsave (&hashbin->hb_spinlock, flags);/* * Free the entries in the hashbin, TODO: use hashbin_clear when * it has been shown to work */ for (i =0 ; i <HASHBIN_SIZE ; i ++ ) { - queue =dequeue_first ((irda_queue_t **) &hashbin->hb_queue[i]); -while (queue ) { -if (free_func) - (*free_func)(queue); - queue =dequeue_first ( - (irda_queue_t **) &hashbin->hb_queue[i]); +while (1 ) { + queue =dequeue_first ((irda_queue_t **) &hashbin->hb_queue[i]); + +if (!queue) +break ; + +if (free_func) { +if (hashbin->hb_type &HB_LOCK ) +spin_unlock_irqrestore (&hashbin->hb_spinlock, flags); +free_func (queue); +if (hashbin->hb_type &HB_LOCK ) +spin_lock_irqsave (&hashbin->hb_spinlock, flags); + } } }
@@ -422,12 +424,8 @@ int hashbin_delete( hashbin_t* hashbin, FREE_FUNC free_func) hashbin->magic = ~HB_MAGIC ;/* Release lock */ -if ( hashbin->hb_type &HB_LOCK ) { +if (hashbin->hb_type &HB_LOCK )spin_unlock_irqrestore (&hashbin->hb_spinlock, flags); -#ifdef CONFIG_LOCKDEP - hashbin_lock_depth--; -#endif - }/* * Free the hashbin structure
Signature · 1 line
2.12.0
PATCH 76/113 net: socket: fix recvmmsg not returning error from sock_error
In reply to Jiri SlabyFrom: Maxime Jayat <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit e623a9e9dec29ae811d11f83d0074ba254aba374 ]
Commit 34b88a68f26a ("net: Fix use after free in the recvmmsg exit path"), changed the exit path of recvmmsg to always return the datagrams variable and modified the error paths to set the variable to the error code returned by recvmsg if necessary.
However in the case sock_error returned an error, the error code was then ignored, and recvmmsg returned 0.
Change the error path of recvmmsg to correctly return the error code of sock_error.
The bug was triggered by using recvmmsg on a CAN interface which was not up. Linux 4.6 and later return 0 in this case while earlier releases returned -ENETDOWN.
--- net/socket.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/socket.c +3 -1
@@ -2334,8 +2334,10 @@ int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,return err; err =sock_error (sock->sk); -if (err) +if (err) { + datagrams = err; goto out_put; + } entry = mmsg; compat_entry = (struct compat_mmsghdr __user *)mmsg;
Signature · 1 line
2.12.0
PATCH 77/113 tty: serial: msm: Fix module autoload
In reply to Jiri SlabyFrom: Javier Martinez Canillas <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit abe81f3b8ed2996e1712d26d38ff6b73f582c616 upstream.
If the driver is built as a module, autoload won't work because the module alias information is not filled. So user-space can't match the registered device with the corresponding module.
Export the module alias information using the MODULE_DEVICE_TABLE() macro.
Before this patch:
$ modinfo drivers/tty/serial/msm_serial.ko | grep alias $
After this patch:
$ modinfo drivers/tty/serial/msm_serial.ko | grep alias alias: of:N*T*Cqcom,msm-uartdmC* alias: of:N*T*Cqcom,msm-uartdm alias: of:N*T*Cqcom,msm-uartC* alias: of:N*T*Cqcom,msm-uart
--- drivers/tty/serial/msm_serial.c | 1 + 1 file changed, 1 insertion(+)
drivers/tty/serial/msm_serial.c +1 -0
@@ -973,6 +973,7 @@ static struct of_device_id msm_match_table[] = { { .compatible = "qcom,msm-uartdm" }, {} }; +MODULE_DEVICE_TABLE (of, msm_match_table);static struct platform_driver msm_platform_driver = { .remove = msm_serial_remove,
Signature · 1 line
2.12.0
PATCH 78/113 USB: serial: mos7840: fix another NULL-deref at open
In reply to Jiri SlabyFrom: Johan Hovold <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 5182c2cf2a9bfb7f066ef0bdd2bb6330b94dd74e upstream.
Fix another NULL-pointer dereference at open should a malicious device lack an interrupt-in endpoint.
Note that the driver has a broken check for an interrupt-in endpoint which means that an interrupt URB has never even been submitted.
--- drivers/usb/serial/mos7840.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/serial/mos7840.c +3 -1
@@ -1031,6 +1031,7 @@ static int mos7840_open(struct tty_struct *tty, struct usb_serial_port *port)* (can't set it up in mos7840_startup as the structures * * were not set up at that time.) */ if (port0->open_ports ==1 ) { +/* FIXME: Buffer never NULL, so URB is not submitted. */ if (serial->port[0 ]->interrupt_in_buffer ==NULL ) {/* set up interrupt urb */ usb_fill_int_urb(serial->port[0]->interrupt_in_urb,
@@ -2195,7 +2196,8 @@ static int mos7840_calc_num_ports(struct usb_serial *serial)static int mos7840_attach (struct usb_serial *serial) {if (serial->num_bulk_in < serial->num_ports || - serial->num_bulk_out < serial->num_ports) { + serial->num_bulk_out < serial->num_ports || + serial->num_interrupt_in <1 ) {dev_err (&serial->interface->dev,"missing endpoints\n" );return -ENODEV ; }
Signature · 1 line
2.12.0
PATCH 79/113 USB: serial: cp210x: add new IDs for GE Bx50v3 boards
In reply to Jiri SlabyFrom: Ken Lin <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 9a593656def0dc2f6c227851e8e602077267a5f1 upstream.
Add new USB IDs for cp2104/5 devices on Bx50v3 boards due to the design change.
--- drivers/usb/serial/cp210x.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/serial/cp210x.c +2 -0
@@ -171,6 +171,8 @@ static const struct usb_device_id id_table[] = { { USB_DEVICE(0x1901, 0x0190) }, /* GE B850 CP2105 Recorder interface */ { USB_DEVICE(0x1901, 0x0193) }, /* GE B650 CP2104 PMC interface */ { USB_DEVICE(0x1901, 0x0194) }, /* GE Healthcare Remote Alarm Box */ + { USB_DEVICE(0x1901, 0x0195) }, /* GE B850/B650/B450 CP2104 DP UART interface */ + { USB_DEVICE(0x1901, 0x0196) }, /* GE B850 CP2105 DP UART interface */ { USB_DEVICE(0x19CF, 0x3000) }, /* Parrot NMEA GPS Flight Recorder */ { USB_DEVICE(0x1ADB, 0x0001) }, /* Schweitzer Engineering C662 Cable */ { USB_DEVICE(0x1B1C, 0x1C00) }, /* Corsair USB Dongle */
Signature · 1 line
2.12.0
PATCH 80/113 USB: serial: ftdi_sio: fix modem-status error handling
In reply to Jiri SlabyFrom: Johan Hovold <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 427c3a95e3e29e65f59d99aaf320d7506f3eed57 upstream.
Make sure to detect short responses when fetching the modem status in order to avoid parsing uninitialised buffer data and having bits of it leak to user space.
Note that we still allow for short 1-byte responses.
--- drivers/usb/serial/ftdi_sio.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/usb/serial/ftdi_sio.c +5 -1
@@ -2465,8 +2465,12 @@ static int ftdi_get_modem_status(struct usb_serial_port *port,FTDI_SIO_GET_MODEM_STATUS_REQUEST_TYPE ,0 , priv->interface, buf, len, WDR_TIMEOUT); -if (ret <0 ) { + +/* NOTE: We allow short responses and handle that below. */ +if (ret <1 ) {dev_err (&port->dev,"failed to get modem status: %d\n" , ret); +if (ret >=0 ) + ret = -EIO ; ret =usb_translate_errors (ret); goto out; }
Signature · 1 line
2.12.0
PATCH 81/113 USB: serial: ftdi_sio: fix extreme low-latency setting
In reply to Jiri SlabyFrom: Johan Hovold <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit c6dce2626606ef16434802989466636bc28c1419 upstream.
Since commit 557aaa7ffab6 ("ft232: support the ASYNC_LOW_LATENCY flag") the FTDI driver has been using a receive latency-timer value of 1 ms instead of the device default of 16 ms.
The latency timer is used to periodically empty a non-full receive buffer, but a status header is always sent when the timer expires including when the buffer is empty. This means that a two-byte bulk message is received every millisecond also for an otherwise idle port as long as it is open.
Let's restore the pre-2009 behaviour which reduces the rate of the status messages to 1/16th (e.g. interrupt frequency drops from 1 kHz to 62.5 Hz) by not setting ASYNC_LOW_LATENCY by default.
Anyone willing to pay the price for the minimum-latency behaviour should set the flag explicitly instead using the TIOCSSERIAL ioctl or a tool such as setserial (e.g. setserial /dev/ttyUSB0 low_latency).
Note that since commit 0cbd81a9f6ba ("USB: ftdi_sio: remove tty->low_latency") the ASYNC_LOW_LATENCY flag has no other effects but to set a minimal latency timer.
--- drivers/usb/serial/ftdi_sio.c | 2 -- 1 file changed, 2 deletions(-)
drivers/usb/serial/ftdi_sio.c +0 -2
@@ -1829,8 +1829,6 @@ static int ftdi_sio_port_probe(struct usb_serial_port *port)mutex_init (&priv->cfg_lock); - priv->flags =ASYNC_LOW_LATENCY ; -if (quirk && quirk->port_probe) quirk->port_probe (priv);
Signature · 1 line
2.12.0
PATCH 82/113 USB: serial: ftdi_sio: fix line-status over-reporting
In reply to Jiri SlabyFrom: Johan Hovold <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit a6bb1e17a39818b01b55d8e6238b4b5f06d55038 upstream.
FTDI devices use a receive latency timer to periodically empty the receive buffer and report modem and line status (also when the buffer is empty).
When a break or error condition is detected the corresponding status flags will be set on a packet with nonzero data payload and the flags are not updated until the break is over or further characters are received.
In order to avoid over-reporting break and error conditions, these flags must therefore only be processed for packets with payload.
This specifically fixes the case where after an overrun, the error condition is continuously reported and NULL-characters inserted until further data is received.
break")
--- drivers/usb/serial/ftdi_sio.c | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-)
drivers/usb/serial/ftdi_sio.c +14 -9
@@ -2102,6 +2102,20 @@ static int ftdi_process_packet(struct usb_serial_port *port, priv->prev_status = status; } +/* save if the transmitter is empty or not */ +if (packet[1 ] &FTDI_RS_TEMT ) + priv->transmit_empty =1 ; +else + priv->transmit_empty =0 ; + + len -=2 ; +if (!len) +return 0 ;/* status only */ + +/* +* Break and error status must only be processed for packets with +* data payload to avoid over-reporting. +*/ flag =TTY_NORMAL ;if (packet[1 ] &FTDI_RS_ERR_MASK ) {/* Break takes precedence over parity, which takes precedence
@@ -2124,15 +2138,6 @@ static int ftdi_process_packet(struct usb_serial_port *port, } } -/* save if the transmitter is empty or not */ -if (packet[1 ] &FTDI_RS_TEMT ) - priv->transmit_empty =1 ; -else - priv->transmit_empty =0 ; - - len -=2 ; -if (!len) -return 0 ;/* status only */ port->icount.rx += len; ch = packet +2 ;
Signature · 1 line
2.12.0
PATCH 83/113 USB: serial: spcp8x5: fix modem-status handling
In reply to Jiri SlabyFrom: Johan Hovold <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 5ed8d41023751bdd3546f2fe4118304357efe8d2 upstream.
Make sure to detect short control transfers and return zero on success when retrieving the modem status.
This fixes the TIOCMGET implementation which since e1ed212d8593 ("USB:
spcp8x5: add proper modem-status support") has returned TIOCM_LE on successful retrieval, and avoids leaking bits from the stack on short transfers.
This also fixes the carrier-detect implementation which since the above mentioned commit unconditionally has returned true.
--- drivers/usb/serial/spcp8x5.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/usb/serial/spcp8x5.c +7 -1
@@ -233,11 +233,17 @@ static int spcp8x5_get_msr(struct usb_serial_port *port, u8 *status) ret =usb_control_msg (dev,usb_rcvctrlpipe (dev,0 ),GET_UART_STATUS ,GET_UART_STATUS_TYPE ,0 ,GET_UART_STATUS_MSR , buf,1 ,100 ); -if (ret <0 ) +if (ret <1 ) {dev_err (&port->dev,"failed to get modem status: %d" , ret); +if (ret >=0 ) + ret = -EIO ; + goto out; + }dev_dbg (&port->dev,"0xc0:0x22:0:6 %d - 0x02%x" , ret, *buf); *status = *buf; + ret =0 ; +out:kfree (buf);return ret;
Signature · 1 line
2.12.0
PATCH 84/113 USB: serial: opticon: fix CTS retrieval at open
In reply to Jiri SlabyFrom: Johan Hovold <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 2eee05020a0e7ee7c04422cbacdb07859e45dce6 upstream.
The opticon driver used a control request at open to trigger a CTS status notification to be sent over the bulk-in pipe. When the driver was converted to using the generic read implementation, an inverted test prevented this request from being sent, something which could lead to TIOCMGET reporting an incorrect CTS state.
--- drivers/usb/serial/opticon.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/serial/opticon.c +1 -1
@@ -143,7 +143,7 @@ static int opticon_open(struct tty_struct *tty, struct usb_serial_port *port)usb_clear_halt (port->serial->dev, port->read_urb->pipe); res =usb_serial_generic_open (tty, port); -if (!res) +if (res)return res;/* Request CTS line state, sometimes during opening the current
Signature · 1 line
2.12.0
PATCH 85/113 USB: serial: ark3116: fix register-accessor error handling
In reply to Jiri SlabyFrom: Johan Hovold <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 9fef37d7cf170522fb354d6d0ea6de09b9b16678 upstream.
The current implementation failed to detect short transfers, something which could lead to bits of the uninitialised heap transfer buffer leaking to user space.
--- drivers/usb/serial/ark3116.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-)
drivers/usb/serial/ark3116.c +10 -3
@@ -100,10 +100,17 @@ static int ark3116_read_reg(struct usb_serial *serial,usb_rcvctrlpipe (serial->dev,0 ),0xfe ,0xc0 ,0 , reg, buf, 1, ARK_TIMEOUT); -if (result <0 ) +if (result <1 ) { +dev_err (&serial->interface->dev, +"failed to read register %u: %d\n" , + reg, result); +if (result >=0 ) + result = -EIO ; +return result; -else -return buf[0 ]; + } + +return buf[0 ]; }static inline int calc_divisor (int bps)
Signature · 1 line
2.12.0
PATCH 86/113 x86/platform/goldfish: Prevent unconditional loading
In reply to Jiri SlabyFrom: Thomas Gleixner <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 47512cfd0d7a8bd6ab71d01cd89fca19eb2093eb upstream.
The goldfish platform code registers the platform device unconditionally which causes havoc in several ways if the goldfish_pdev_bus driver is enabled:
- Access to the hardcoded physical memory region, which is either not available or contains stuff which is completely unrelated.
- Prevents that the interrupt of the serial port can be requested
- In case of a spurious interrupt it goes into a infinite loop in the interrupt handler of the pdev_bus driver (which needs to be fixed seperately).
Add a 'goldfish' command line option to make the registration opt-in when the platform is compiled in.
I'm seriously grumpy about this engineering trainwreck, which has seven SOBs from Intel developers for 50 lines of code. And none of them figured out that this is broken. Impressive fail!
--- Documentation/kernel-parameters.txt | 4 ++++ arch/x86/platform/goldfish/goldfish.c | 14 +++++++++++++- 2 files changed, 17 insertions(+), 1 deletion(-)
Documentation/kernel-parameters.txt +4 -0
@@ -1013,6 +1013,10 @@ bytes respectively. Such letter suffixes can also be entirely omitted. When zero, profiling data is discarded and associated debugfs files are removed at module unload time. + goldfish [X86] Enable the goldfish android emulator platform. + Don't use this when you are not running on the + android emulator + gpt [EFI] Forces disk with valid GPT signature but invalid Protective MBR to be treated as GPT.
arch/x86/platform/goldfish/goldfish.c +13 -1
@@ -42,10 +42,22 @@ static struct resource goldfish_pdev_bus_resources[] = { } }; +static bool goldfish_enable__initdata ; + +static int __init goldfish_setup (char *str) +{ + goldfish_enable = true; +return 0 ; +} +__setup ("goldfish" , goldfish_setup); +static int __init goldfish_init (void ) { +if (!goldfish_enable) +return -ENODEV ; +platform_device_register_simple ("goldfish_pdev_bus" ,-1 , - goldfish_pdev_bus_resources,2 ); + goldfish_pdev_bus_resources,2 );return 0 ; }device_initcall (goldfish_init);
Signature · 1 line
2.12.0
PATCH 87/113 goldfish: Sanitize the broken interrupt handler
In reply to Jiri SlabyFrom: Thomas Gleixner <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 6cf18e6927c0b224f972e3042fb85770d63cb9f8 upstream.
This interrupt handler is broken in several ways:
- It loops forever when the op code is not decodeable
- It never returns IRQ_HANDLED because the only way to exit the loop returns IRQ_NONE unconditionally.
The whole concept of this is broken. Creating devices in an interrupt handler is beyond any point of sanity.
Make it at least behave halfways sane so accidental users do not have to deal with a hard to debug lockup.
--- drivers/platform/goldfish/pdev_bus.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
drivers/platform/goldfish/pdev_bus.c +8 -5
@@ -153,23 +153,26 @@ static int goldfish_new_pdev(void)static irqreturn_t goldfish_pdev_bus_interrupt (int irq,void *dev_id) {irqreturn_t ret =IRQ_NONE ; +while (1 ) {u32 op =readl (pdev_bus_base +PDEV_BUS_OP ); -switch (op) { -case PDEV_BUS_OP_DONE : -return IRQ_NONE ; +switch (op) {case PDEV_BUS_OP_REMOVE_DEV :goldfish_pdev_remove (); + ret =IRQ_HANDLED ;break ;case PDEV_BUS_OP_ADD_DEV :goldfish_new_pdev (); + ret =IRQ_HANDLED ;break ; + +case PDEV_BUS_OP_DONE : +default : +return ret; } - ret =IRQ_HANDLED ; } -return ret; }static int goldfish_pdev_bus_probe (struct platform_device *pdev)
Signature · 1 line
2.12.0
PATCH 88/113 rtlwifi: rtl_usb: Fix for URB leaking when doing ifconfig up/down
In reply to Jiri SlabyFrom: Michael Schenk <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 575ddce0507789bf9830d089557d2199d2f91865 upstream.
In the function rtl_usb_start we pre-allocate a certain number of urbs for RX path but they will not be freed when calling rtl_usb_stop. This results in leaking urbs when doing ifconfig up and down. Eventually, the system has no available urbs.
--- drivers/net/wireless/rtlwifi/usb.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
drivers/net/wireless/rtlwifi/usb.c +18 -0
@@ -830,6 +830,7 @@ static void rtl_usb_stop(struct ieee80211_hw *hw)struct rtl_priv *rtlpriv =rtl_priv (hw);struct rtl_hal *rtlhal =rtl_hal (rtl_priv (hw));struct rtl_usb *rtlusb =rtl_usbdev (rtl_usbpriv (hw)); +struct urb *urb;/* should after adapter start and interrupt enable. */ set_hal_stop (rtlhal);
@@ -837,6 +838,23 @@ static void rtl_usb_stop(struct ieee80211_hw *hw)/* Enable software */ SET_USB_STOP (rtlusb);rtl_usb_deinit (hw); + +/* free pre-allocated URBs from rtl_usb_start() */ +usb_kill_anchored_urbs (&rtlusb->rx_submitted); + +tasklet_kill (&rtlusb->rx_work_tasklet); +cancel_work_sync (&rtlpriv->works.lps_change_work); + +flush_workqueue (rtlpriv->works.rtl_wq); + +skb_queue_purge (&rtlusb->rx_queue); + +while ((urb =usb_get_from_anchor (&rtlusb->rx_cleanup_urbs))) { +usb_free_coherent (urb->dev, urb->transfer_buffer_length, + urb->transfer_buffer, urb->transfer_dma); +usb_free_urb (urb); + } + rtlpriv->cfg->ops->hw_disable (hw); }
Signature · 1 line
2.12.0
PATCH 89/113 af_packet: remove a stray tab in packet_set_ring()
In reply to Jiri SlabyFrom: Dan Carpenter <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit d7cf0c34af067555737193b6c1aa7abaa677f29c upstream.
At first glance it looks like there is a missing curly brace but actually the code works the same either way. I have adjusted the indenting but left the code the same.
--- net/packet/af_packet.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/packet/af_packet.c +1 -1
@@ -3677,7 +3677,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,*/ if (!tx_ring)init_prb_bdqc (po, rb, pg_vec, req_u, tx_ring); -break ; +break ;default :break ; }
Signature · 1 line
2.12.0
PATCH 90/113 ext4: validate s_first_meta_bg at mount time
In reply to Jiri SlabyFrom: Eryu Guan <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 3a4b77cd47bb837b8557595ec7425f281f2ca1fe upstream.
Ralf Spenneberg reported that he hit a kernel crash when mounting a modified ext4 image. And it turns out that kernel crashed when calculating fs overhead (ext4_calculate_overhead()), this is because the image has very large s_first_meta_bg (debug code shows it's 842150400), and ext4 overruns the memory in count_overhead() when setting bitmap buffer, which is PAGE_SIZE.
ext4_calculate_overhead():
buf = get_zeroed_page(GFP_NOFS); <=== PAGE_SIZE buffer blks = count_overhead(sb, i, buf);
count_overhead():
for (j = ext4_bg_num_gdb(sb, grp); j > 0; j--) { <=== j = 842150400
ext4_set_bit(EXT4_B2C(sbi, s++), buf); <=== buffer overrun
count++;}
This can be reproduced easily for me by this script:
#!/bin/bash
rm -f fs.img
mkdir -p /mnt/ext4
fallocate -l 16M fs.img
mke2fs -t ext4 -O bigalloc,meta_bg,^resize_inode -F fs.img debugfs -w -R "ssv first_meta_bg 842150400" fs.img mount -o loop fs.img /mnt/ext4
Fix it by validating s_first_meta_bg first at mount time, and refusing to mount if its value exceeds the largest possible meta_bg number.
[js] use EXT4_HAS_INCOMPAT_FEATURE instead of new
ext4_has_feature_meta_bg
--- fs/ext4/super.c | 9 +++++++++ 1 file changed, 9 insertions(+)
fs/ext4/super.c +9 -0
@@ -3852,6 +3852,15 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) (EXT4_MAX_BLOCK_FILE_PHYS / EXT4_BLOCKS_PER_GROUP(sb))); db_count = (sbi->s_groups_count +EXT4_DESC_PER_BLOCK (sb) -1 ) /EXT4_DESC_PER_BLOCK (sb); +if (EXT4_HAS_INCOMPAT_FEATURE (sb,EXT4_FEATURE_INCOMPAT_META_BG )) { +if (le32_to_cpu (es->s_first_meta_bg) >= db_count) { +ext4_msg (sb,KERN_WARNING , +"first meta block group too large: %u " +"(group descriptor block count %u)" , +le32_to_cpu (es->s_first_meta_bg), db_count); + goto failed_mount; + } + } sbi->s_group_desc =ext4_kvmalloc (db_count *sizeof (struct buffer_head *),GFP_KERNEL );
Signature · 1 line
2.12.0
PATCH 91/113 ext4: fix fencepost in s_first_meta_bg validation
In reply to Jiri SlabyFrom: Theodore Ts'o <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 2ba3e6e8afc9b6188b471f27cf2b5e3cf34e7af2 upstream.
It is OK for s_first_meta_bg to be equal to the number of block group descriptor blocks. (It rarely happens, but it shouldn't cause any problems.)
https://bugzilla.kernel.org/show_bug.cgi?id=194567
--- fs/ext4/super.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ext4/super.c +1 -1
@@ -3853,7 +3853,7 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) db_count = (sbi->s_groups_count +EXT4_DESC_PER_BLOCK (sb) -1 ) /EXT4_DESC_PER_BLOCK (sb);if (EXT4_HAS_INCOMPAT_FEATURE (sb,EXT4_FEATURE_INCOMPAT_META_BG )) { -if (le32_to_cpu (es->s_first_meta_bg) >= db_count) { +if (le32_to_cpu (es->s_first_meta_bg) > db_count) { ext4_msg(sb, KERN_WARNING, "first meta block group too large: %u " "(group descriptor block count %u)",
Signature · 1 line
2.12.0
PATCH 92/113 ocfs2: do not write error flag to user structure we cannot copy from/to
In reply to Jiri SlabyFrom: Ben Hutchings <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 2b462638e41ea62230297c21c4da9955937b7a3c upstream.
If we failed to copy from the structure, writing back the flags leaks 31 bits of kernel memory (the rest of the ir_flags field).
In any case, if we cannot copy from/to the structure, why should we expect putting just the flags to work?
Also make sure ocfs2_info_handle_freeinode() returns the right error code if the copy_to_user() fails.
--- fs/ocfs2/ioctl.c | 129 +++++++++++++++++++------------------------------------ 1 file changed, 43 insertions(+), 86 deletions(-)
fs/ocfs2/ioctl.c +43 -86
@@ -34,9 +34,8 @@copy_to_user ((typeof (a)__user *)b, &(a),sizeof (a))/* -* This call is void because we are already reporting an error that may -* be -EFAULT. The error will be returned from the ioctl(2) call. It's -* just a best-effort to tell userspace that this request caused the error. +* This is just a best-effort to tell userspace that this request +* caused the error. */static inline void o2info_set_request_error (struct ocfs2_info_request *kreq,struct ocfs2_info_request __user *req)
@@ -145,136 +144,105 @@ bail:int ocfs2_info_handle_blocksize (struct inode *inode,struct ocfs2_info_request __user *req) { -int status = -EFAULT ;struct ocfs2_info_blocksize oib;if (o2info_from_user (oib, req)) - goto bail; +return -EFAULT ; oib.ib_blocksize = inode->i_sb->s_blocksize;o2info_set_request_filled (&oib.ib_req);if (o2info_to_user (oib, req)) - goto bail; - - status =0 ; -bail: -if (status) -o2info_set_request_error (&oib.ib_req, req); +return -EFAULT ; -return status; +return 0 ; }int ocfs2_info_handle_clustersize (struct inode *inode,struct ocfs2_info_request __user *req) { -int status = -EFAULT ;struct ocfs2_info_clustersize oic;struct ocfs2_super *osb =OCFS2_SB (inode->i_sb);if (o2info_from_user (oic, req)) - goto bail; +return -EFAULT ; oic.ic_clustersize = osb->s_clustersize;o2info_set_request_filled (&oic.ic_req);if (o2info_to_user (oic, req)) - goto bail; - - status =0 ; -bail: -if (status) -o2info_set_request_error (&oic.ic_req, req); +return -EFAULT ; -return status; +return 0 ; }int ocfs2_info_handle_maxslots (struct inode *inode,struct ocfs2_info_request __user *req) { -int status = -EFAULT ;struct ocfs2_info_maxslots oim;struct ocfs2_super *osb =OCFS2_SB (inode->i_sb);if (o2info_from_user (oim, req)) - goto bail; +return -EFAULT ; oim.im_max_slots = osb->max_slots;o2info_set_request_filled (&oim.im_req);if (o2info_to_user (oim, req)) - goto bail; +return -EFAULT ; - status =0 ; -bail: -if (status) -o2info_set_request_error (&oim.im_req, req); - -return status; +return 0 ; }int ocfs2_info_handle_label (struct inode *inode,struct ocfs2_info_request __user *req) { -int status = -EFAULT ;struct ocfs2_info_label oil;struct ocfs2_super *osb =OCFS2_SB (inode->i_sb);if (o2info_from_user (oil, req)) - goto bail; +return -EFAULT ;memcpy (oil.il_label, osb->vol_label,OCFS2_MAX_VOL_LABEL_LEN );o2info_set_request_filled (&oil.il_req);if (o2info_to_user (oil, req)) - goto bail; +return -EFAULT ; - status =0 ; -bail: -if (status) -o2info_set_request_error (&oil.il_req, req); - -return status; +return 0 ; }int ocfs2_info_handle_uuid (struct inode *inode,struct ocfs2_info_request __user *req) { -int status = -EFAULT ;struct ocfs2_info_uuid oiu;struct ocfs2_super *osb =OCFS2_SB (inode->i_sb);if (o2info_from_user (oiu, req)) - goto bail; +return -EFAULT ;memcpy (oiu.iu_uuid_str, osb->uuid_str,OCFS2_TEXT_UUID_LEN +1 );o2info_set_request_filled (&oiu.iu_req);if (o2info_to_user (oiu, req)) - goto bail; - - status =0 ; -bail: -if (status) -o2info_set_request_error (&oiu.iu_req, req); +return -EFAULT ; -return status; +return 0 ; }int ocfs2_info_handle_fs_features (struct inode *inode,struct ocfs2_info_request __user *req) { -int status = -EFAULT ;struct ocfs2_info_fs_features oif;struct ocfs2_super *osb =OCFS2_SB (inode->i_sb);if (o2info_from_user (oif, req)) - goto bail; +return -EFAULT ; oif.if_compat_features = osb->s_feature_compat; oif.if_incompat_features = osb->s_feature_incompat;
@@ -283,39 +251,28 @@ int ocfs2_info_handle_fs_features(struct inode *inode,o2info_set_request_filled (&oif.if_req);if (o2info_to_user (oif, req)) - goto bail; +return -EFAULT ; - status =0 ; -bail: -if (status) -o2info_set_request_error (&oif.if_req, req); - -return status; +return 0 ; }int ocfs2_info_handle_journal_size (struct inode *inode,struct ocfs2_info_request __user *req) { -int status = -EFAULT ;struct ocfs2_info_journal_size oij;struct ocfs2_super *osb =OCFS2_SB (inode->i_sb);if (o2info_from_user (oij, req)) - goto bail; +return -EFAULT ; oij.ij_journal_size =i_size_read (osb->journal->j_inode);o2info_set_request_filled (&oij.ij_req);if (o2info_to_user (oij, req)) - goto bail; +return -EFAULT ; - status =0 ; -bail: -if (status) -o2info_set_request_error (&oij.ij_req, req); - -return status; +return 0 ; } int ocfs2_info_scan_inode_alloc(struct ocfs2_super *osb,
@@ -371,7 +328,7 @@ int ocfs2_info_handle_freeinode(struct inode *inode,u32 i;u64 blkno =-1 ;char namebuf[40 ]; -int status = -EFAULT , type =INODE_ALLOC_SYSTEM_INODE ; +int status, type =INODE_ALLOC_SYSTEM_INODE ;struct ocfs2_info_freeinode *oifi =NULL ;struct ocfs2_super *osb =OCFS2_SB (inode->i_sb);struct inode *inode_alloc =NULL ;
@@ -383,8 +340,10 @@ int ocfs2_info_handle_freeinode(struct inode *inode, goto out_err; } -if (o2info_from_user (*oifi, req)) - goto bail; +if (o2info_from_user (*oifi, req)) { + status = -EFAULT ; + goto out_free; + } oifi->ifi_slotnum = osb->max_slots;
@@ -421,14 +380,16 @@ int ocfs2_info_handle_freeinode(struct inode *inode,o2info_set_request_filled (&oifi->ifi_req); -if (o2info_to_user (*oifi, req)) - goto bail; +if (o2info_to_user (*oifi, req)) { + status = -EFAULT ; + goto out_free; + } status =0 ; bail:if (status)o2info_set_request_error (&oifi->ifi_req, req); - +out_free:kfree (oifi); out_err:return status;
@@ -655,7 +616,7 @@ int ocfs2_info_handle_freefrag(struct inode *inode, {u64 blkno =-1 ;char namebuf[40 ]; -int status = -EFAULT , type =GLOBAL_BITMAP_SYSTEM_INODE ; +int status, type =GLOBAL_BITMAP_SYSTEM_INODE ;struct ocfs2_info_freefrag *oiff;struct ocfs2_super *osb =OCFS2_SB (inode->i_sb);
@@ -668,8 +629,10 @@ int ocfs2_info_handle_freefrag(struct inode *inode, goto out_err; } -if (o2info_from_user (*oiff, req)) - goto bail; +if (o2info_from_user (*oiff, req)) { + status = -EFAULT ; + goto out_free; + }/* * chunksize from userspace should be power of 2. */
@@ -708,14 +671,14 @@ int ocfs2_info_handle_freefrag(struct inode *inode,if (o2info_to_user (*oiff, req)) { status = -EFAULT ; - goto bail; + goto out_free; } status =0 ; bail:if (status)o2info_set_request_error (&oiff->iff_req, req); - +out_free:kfree (oiff); out_err:return status;
@@ -724,23 +687,17 @@ out_err:int ocfs2_info_handle_unknown (struct inode *inode,struct ocfs2_info_request __user *req) { -int status = -EFAULT ;struct ocfs2_info_request oir;if (o2info_from_user (oir, req)) - goto bail; +return -EFAULT ;o2info_clear_request_filled (&oir);if (o2info_to_user (oir, req)) - goto bail; +return -EFAULT ; - status =0 ; -bail: -if (status) -o2info_set_request_error (&oir, req); - -return status; +return 0 ; }/*
Signature · 1 line
2.12.0
PATCH 93/113 6lowpan: release device on error path
In reply to Jiri SlabyFrom: Dan Carpenter <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 78032f9b3eae3a43da9468d8ce30caa6be84f89d upstream.
We recently added a new error path and it needs a dev_put().
--- net/ieee802154/6lowpan.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/ieee802154/6lowpan.c +3 -1
@@ -1392,8 +1392,10 @@ static int lowpan_newlink(struct net *src_net, struct net_device *dev, real_dev =dev_get_by_index (src_net,nla_get_u32 (tb[IFLA_LINK ]));if (!real_dev)return -ENODEV ; -if (real_dev->type !=ARPHRD_IEEE802154 ) +if (real_dev->type !=ARPHRD_IEEE802154 ) { +dev_put (real_dev);return -EINVAL ; + }lowpan_dev_info (dev)->real_dev = real_dev;lowpan_dev_info (dev)->fragment_tag =0 ;
Signature · 1 line
2.12.0
PATCH 94/113 mfd: pm8921: Potential NULL dereference in pm8921_remove()
In reply to Jiri SlabyFrom: Dan Carpenter <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit d6daef95127e41233ac8e2d8472d8c0cd8687d38 upstream.
We assume that "pmic" could be NULL and then dereference it two lines later. I fix this by moving the dereference inside the NULL check.
--- drivers/mfd/pm8921-core.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/mfd/pm8921-core.c +5 -4
@@ -171,11 +171,12 @@ static int pm8921_remove(struct platform_device *pdev) drvdata =platform_get_drvdata (pdev);if (drvdata) pmic = drvdata->pm_chip_data; -if (pmic) +if (pmic) {mfd_remove_devices (pmic->dev); -if (pmic->irq_chip) { -pm8xxx_irq_exit (pmic->irq_chip); - pmic->irq_chip =NULL ; +if (pmic->irq_chip) { +pm8xxx_irq_exit (pmic->irq_chip); + pmic->irq_chip =NULL ; + } }return 0 ;
Signature · 1 line
2.12.0
PATCH 95/113 Staging: vt6655-6: potential NULL dereference in hostap_disable_hostapd()
In reply to Jiri SlabyFrom: Dan Carpenter <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit cb4855b49deb1acce27706ad9509d63c4fe8e988 upstream.
We fixed this to use free_netdev() instead of kfree() but unfortunately free_netdev() doesn't accept NULL pointers. Smatch complains about this, it's not something I discovered through testing.
--- drivers/staging/vt6655/hostap.c | 3 ++- drivers/staging/vt6656/hostap.c | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-)
drivers/staging/vt6655/hostap.c +2 -1
@@ -143,7 +143,8 @@ static int hostap_disable_hostapd(PSDevice pDevice, int rtnl_locked)DBG_PRT (MSG_LEVEL_DEBUG ,KERN_INFO "%s: Netdevice %s unregistered\n" , pDevice->dev->name, pDevice->apdev->name); } -free_netdev (pDevice->apdev); +if (pDevice->apdev) +free_netdev (pDevice->apdev); pDevice->apdev =NULL ; pDevice->bEnable8021x = false; pDevice->bEnableHostWEP = false;
drivers/staging/vt6656/hostap.c +2 -1
@@ -133,7 +133,8 @@ static int hostap_disable_hostapd(struct vnt_private *pDevice, int rtnl_locked)DBG_PRT (MSG_LEVEL_DEBUG ,KERN_INFO "%s: Netdevice %s unregistered\n" , pDevice->dev->name, pDevice->apdev->name); } -free_netdev (pDevice->apdev); +if (pDevice->apdev) +free_netdev (pDevice->apdev); pDevice->apdev =NULL ; pDevice->bEnable8021x = false; pDevice->bEnableHostWEP = false;
Signature · 1 line
2.12.0
PATCH 96/113 drm/nv50/disp: min/max are reversed in nv50_crtc_gamma_set()
In reply to Jiri SlabyFrom: Dan Carpenter <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit bdefc8cbdfc71ea73e0573dbd2d24c0a68232218 upstream.
We should be taking the minimum here instead of the max. It could lead to a buffer overflow.
a/drm/nv50_display.c b/drm/nv50_display.c
index f8e66c08b11a..4e384a2f99c3 100644
--- drivers/gpu/drm/nouveau/nv50_display.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/nouveau/nv50_display.c +1 -1
@@ -1265,7 +1265,7 @@ nv50_crtc_gamma_set(struct drm_crtc *crtc, u16 *r, u16 *g, u16 *b, uint32_t start, uint32_t size) {struct nouveau_crtc *nv_crtc =nouveau_crtc (crtc); -u32 end =max (start + size, (u32 )256 ); +u32 end =min_t (u32, start + size,256 );u32 i;for (i = start; i < end; i++) {
Signature · 1 line
2.12.0
PATCH 97/113 cpufreq: fix garbage kobjects on errors during suspend/resume
In reply to Jiri SlabyFrom: Bjørn Mork <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 2167e2399dc5e69c62db56d933e9c8cbe107620a upstream.
This is effectively a revert of commit 5302c3fb2e62 ("cpufreq: Perform light-weight init/teardown during suspend/resume"), which enabled suspend/resume optimizations leaving the sysfs files in place.
Errors during suspend/resume are not handled properly, leaving dead sysfs attributes in case of failures. There are are number of functions with special code for the "frozen" case, and all these need to also have special error handling.
The problem is easy to demonstrate by making cpufreq_driver->init() or cpufreq_driver->get() fail during resume.
The code is too complex for a simple fix, with split code paths in multiple blocks within a number of functions. It is therefore best to revert the patch enabling this code until the error handling is in place.
Examples of problems resulting from resume errors:
WARNING: CPU: 0 PID: 6055 at fs/sysfs/file.c:343 sysfs_open_file+0x77/0x212() missing sysfs attribute operations for kobject: (null) Modules linked in: [stripped as irrelevant] CPU: 0 PID: 6055 Comm: grep Tainted: G D 3.13.0-rc2 #153 Hardware name: LENOVO 2776LEG/2776LEG, BIOS 6EET55WW (3.15 ) 12/19/2011 0000000000000009 ffff8802327ebb78 ffffffff81380b0e 0000000000000006 ffff8802327ebbc8 ffff8802327ebbb8 ffffffff81038635 0000000000000000 ffffffff811823c7 ffff88021a19e688 ffff88021a19e688 ffff8802302f9310 Call Trace: [<ffffffff81380b0e>] dump_stack+0x55/0x76 [<ffffffff81038635>] warn_slowpath_common+0x7c/0x96 [<ffffffff811823c7>] ? sysfs_open_file+0x77/0x212 [<ffffffff810386e3>] warn_slowpath_fmt+0x41/0x43 [<ffffffff81182dec>] ? sysfs_get_active+0x6b/0x82 [<ffffffff81182382>] ? sysfs_open_file+0x32/0x212 [<ffffffff811823c7>] sysfs_open_file+0x77/0x212 [<ffffffff81182350>] ? sysfs_schedule_callback+0x1ac/0x1ac [<ffffffff81122562>] do_dentry_open+0x17c/0x257 [<ffffffff8112267e>] finish_open+0x41/0x4f [<ffffffff81130225>] do_last+0x80c/0x9ba [<ffffffff8112dbbd>] ? inode_permission+0x40/0x42 [<ffffffff81130606>] path_openat+0x233/0x4a1 [<ffffffff81130b7e>] do_filp_open+0x35/0x85 [<ffffffff8113b787>] ? __alloc_fd+0x172/0x184 [<ffffffff811232ea>] do_sys_open+0x6b/0xfa [<ffffffff811233a7>] SyS_openat+0xf/0x11 [<ffffffff8138c812>] system_call_fastpath+0x16/0x1b
The failure to restore cpufreq devices on cancelled hibernation is not a new bug. It is caused by the ACPI _PPC call failing unless the hibernate is completed. This makes the acpi_cpufreq driver fail its init.
Previously, the cpufreq device could be restored by offlining the cpu temporarily. And as a complete hibernation cycle would do this, it would be automatically restored most of the time. But after commit 5302c3fb2e62 the leftover sysfs attributes will block any device add action. Therefore offlining and onlining CPU 1 will no longer restore the cpufreq object, and a complete suspend/resume cycle will replace it with garbage.
--- drivers/cpufreq/cpufreq.c | 3 --- 1 file changed, 3 deletions(-)
drivers/cpufreq/cpufreq.c +0 -3
@@ -2062,9 +2062,6 @@ static int cpufreq_cpu_callback(struct notifier_block *nfb, dev =get_cpu_device (cpu);if (dev) { -if (action &CPU_TASKS_FROZEN ) - frozen = true; -switch (action & ~CPU_TASKS_FROZEN ) {case CPU_ONLINE :__cpufreq_add_dev (dev,NULL , frozen);
Signature · 1 line
2.12.0
PATCH 98/113 cpufreq: remove sysfs files for CPUs which failed to come back after resume
In reply to Jiri SlabyFrom: Viresh Kumar <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 42f921a6f10c6c2079b093a115eb7e3c3508357f upstream.
There are cases where cpufreq_add_dev() may fail for some CPUs during system resume. With the current code we will still have sysfs cpufreq files for those CPUs and struct cpufreq_policy would be already freed for them. Hence any operation on those sysfs files would result in kernel warnings.
Example of problems resulting from resume errors (from Bjørn Mork):
WARNING: CPU: 0 PID: 6055 at fs/sysfs/file.c:343 sysfs_open_file+0x77/0x212() missing sysfs attribute operations for kobject: (null) Modules linked in: [stripped as irrelevant] CPU: 0 PID: 6055 Comm: grep Tainted: G D 3.13.0-rc2 #153 Hardware name: LENOVO 2776LEG/2776LEG, BIOS 6EET55WW (3.15 ) 12/19/2011 0000000000000009 ffff8802327ebb78 ffffffff81380b0e 0000000000000006 ffff8802327ebbc8 ffff8802327ebbb8 ffffffff81038635 0000000000000000 ffffffff811823c7 ffff88021a19e688 ffff88021a19e688 ffff8802302f9310 Call Trace: [<ffffffff81380b0e>] dump_stack+0x55/0x76 [<ffffffff81038635>] warn_slowpath_common+0x7c/0x96 [<ffffffff811823c7>] ? sysfs_open_file+0x77/0x212 [<ffffffff810386e3>] warn_slowpath_fmt+0x41/0x43 [<ffffffff81182dec>] ? sysfs_get_active+0x6b/0x82 [<ffffffff81182382>] ? sysfs_open_file+0x32/0x212 [<ffffffff811823c7>] sysfs_open_file+0x77/0x212 [<ffffffff81182350>] ? sysfs_schedule_callback+0x1ac/0x1ac [<ffffffff81122562>] do_dentry_open+0x17c/0x257 [<ffffffff8112267e>] finish_open+0x41/0x4f [<ffffffff81130225>] do_last+0x80c/0x9ba [<ffffffff8112dbbd>] ? inode_permission+0x40/0x42 [<ffffffff81130606>] path_openat+0x233/0x4a1 [<ffffffff81130b7e>] do_filp_open+0x35/0x85 [<ffffffff8113b787>] ? __alloc_fd+0x172/0x184 [<ffffffff811232ea>] do_sys_open+0x6b/0xfa [<ffffffff811233a7>] SyS_openat+0xf/0x11 [<ffffffff8138c812>] system_call_fastpath+0x16/0x1b
To fix this, remove those sysfs files or put the associated kobject in case of such errors. Also, to make it simple, remove the cpufreq sysfs links from all the CPUs (except for the policy->cpu) during suspend, as that operation won't result in a loss of sysfs file permissions and we can create those links during resume just fine.
[js] no rwsem in 3.12 yet
--- drivers/cpufreq/cpufreq.c | 63 +++++++++++++++++++++++------------------------ 1 file changed, 31 insertions(+), 32 deletions(-)
drivers/cpufreq/cpufreq.c +31 -32
@@ -872,8 +872,7 @@ static void cpufreq_init_policy(struct cpufreq_policy *policy)#ifdef CONFIG_HOTPLUG_CPU static int cpufreq_add_policy_cpu (struct cpufreq_policy *policy, -unsigned int cpu,struct device *dev, -bool frozen) +unsigned int cpu,struct device *dev) {int ret =0 , has_target = !!cpufreq_driver->target;unsigned long flags;
@@ -904,11 +903,7 @@ static int cpufreq_add_policy_cpu(struct cpufreq_policy *policy, } } -/* Don't touch sysfs links during light-weight init */ -if (!frozen) - ret =sysfs_create_link (&dev->kobj, &policy->kobj,"cpufreq" ); - -return ret; +return sysfs_create_link (&dev->kobj, &policy->kobj,"cpufreq" ); }#endif
@@ -951,6 +946,27 @@ err_free_policy:return NULL ; } +static void cpufreq_policy_put_kobj (struct cpufreq_policy *policy) +{ +struct kobject *kobj; +struct completion *cmp; + +lock_policy_rwsem_read (policy->cpu); + kobj = &policy->kobj; + cmp = &policy->kobj_unregister; +unlock_policy_rwsem_read (policy->cpu); +kobject_put (kobj); + +/* +* We need to make sure that the underlying kobj is +* actually not referenced anymore by anybody before we +* proceed with unloading. +*/ +pr_debug ("waiting for dropping of refcount\n" ); +wait_for_completion (cmp); +pr_debug ("wait complete\n" ); +} +static void cpufreq_policy_free (struct cpufreq_policy *policy) {free_cpumask_var (policy->related_cpus);
@@ -1020,7 +1036,7 @@ static int __cpufreq_add_dev(struct device *dev, struct subsys_interface *sif,list_for_each_entry (tpolicy, &cpufreq_policy_list, policy_list) {if (cpumask_test_cpu (cpu, tpolicy->related_cpus)) {read_unlock_irqrestore (&cpufreq_driver_lock, flags); - ret =cpufreq_add_policy_cpu (tpolicy, cpu, dev, frozen); + ret =cpufreq_add_policy_cpu (tpolicy, cpu, dev);up_read (&cpufreq_rwsem);return ret; }
@@ -1119,7 +1135,10 @@ err_out_unregister:write_unlock_irqrestore (&cpufreq_driver_lock, flags); err_set_policy_cpu: +if (frozen) +cpufreq_policy_put_kobj (policy);cpufreq_policy_free (policy); + nomem_out:up_read (&cpufreq_rwsem);
@@ -1141,7 +1160,7 @@ static int cpufreq_add_dev(struct device *dev, struct subsys_interface *sif) }static int cpufreq_nominate_new_policy_cpu (struct cpufreq_policy *policy, -unsigned int old_cpu,bool frozen) +unsigned int old_cpu) {struct device *cpu_dev;int ret;
@@ -1149,10 +1168,6 @@ static int cpufreq_nominate_new_policy_cpu(struct cpufreq_policy *policy,/* first sibling now owns the new sysfs dir */ cpu_dev =get_cpu_device (cpumask_any_but (policy->cpus, old_cpu)); -/* Don't touch sysfs files during light-weight tear-down */ -if (frozen) -return cpu_dev->id; -sysfs_remove_link (&cpu_dev->kobj,"cpufreq" ); ret =kobject_move (&policy->kobj, &cpu_dev->kobj);if (ret) {
@@ -1220,7 +1235,7 @@ static int __cpufreq_remove_dev_prepare(struct device *dev,sysfs_remove_link (&dev->kobj,"cpufreq" ); }else if (cpus >1 ) { - new_cpu =cpufreq_nominate_new_policy_cpu (policy, cpu, frozen); + new_cpu =cpufreq_nominate_new_policy_cpu (policy, cpu);if (new_cpu >=0 ) {update_policy_cpu (policy, new_cpu);
@@ -1242,8 +1257,6 @@ static int __cpufreq_remove_dev_finish(struct device *dev,int ret;unsigned long flags;struct cpufreq_policy *policy; -struct kobject *kobj; -struct completion *cmp;read_lock_irqsave (&cpufreq_driver_lock, flags); policy =per_cpu (cpufreq_cpu_data, cpu);
@@ -1273,22 +1286,8 @@ static int __cpufreq_remove_dev_finish(struct device *dev, } } -if (!frozen) { -lock_policy_rwsem_read (cpu); - kobj = &policy->kobj; - cmp = &policy->kobj_unregister; -unlock_policy_rwsem_read (cpu); -kobject_put (kobj); - -/* -* We need to make sure that the underlying kobj is -* actually not referenced anymore by anybody before we -* proceed with unloading. -*/ -pr_debug ("waiting for dropping of refcount\n" ); -wait_for_completion (cmp); -pr_debug ("wait complete\n" ); - } +if (!frozen) +cpufreq_policy_put_kobj (policy);/* * Perform the ->exit() even during light-weight tear-down,
Signature · 1 line
2.12.0
PATCH 99/113 cpufreq: Clean up after a failing light-weight initialization
In reply to Jiri SlabyFrom: "Rafael J. Wysocki" <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 72368d122c7479aa6e14fbbd334717b8a0c157a6 upstream.
If cpufreq_policy_restore() returns NULL during system resume, __cpufreq_add_dev() should just fall back to the full initialization instead of returning an error, because that may actually make things work. Moreover, it should not leave stale fallback data behind after it has failed to restore a previously existing policy.
This change is based on Viresh Kumar's work.
--- drivers/cpufreq/cpufreq.c | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-)
drivers/cpufreq/cpufreq.c +14 -9
@@ -1044,15 +1044,17 @@ static int __cpufreq_add_dev(struct device *dev, struct subsys_interface *sif,read_unlock_irqrestore (&cpufreq_driver_lock, flags);#endif -if (frozen) -/* Restore the saved policy when doing light-weight init */ - policy =cpufreq_policy_restore (cpu); -else +/* +* Restore the saved policy when doing light-weight init and fall back +* to the full init if that fails. +*/ + policy = frozen ?cpufreq_policy_restore (cpu) :NULL ; +if (!policy) { + frozen = false; policy =cpufreq_policy_alloc (); - -if (!policy) - goto nomem_out; - +if (!policy) + goto nomem_out; + }/* * In the resume path, since we restore a saved policy, the assignment
@@ -1135,8 +1137,11 @@ err_out_unregister:write_unlock_irqrestore (&cpufreq_driver_lock, flags); err_set_policy_cpu: -if (frozen) +if (frozen) { +/* Do not leave stale fallback data behind. */ +per_cpu (cpufreq_cpu_data_fallback, cpu) =NULL ;cpufreq_policy_put_kobj (policy); + }cpufreq_policy_free (policy); nomem_out:
Signature · 1 line
2.12.0
PATCH 100/113 cpufreq: preserve user_policy across suspend/resume
In reply to Jiri SlabyFrom: Viresh Kumar <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 08fd8c1cf0a99abf34e09a8b99b74872e0d73a23 upstream.
Prevent __cpufreq_add_dev() from overwriting the existing values of user_policy.{min|max|policy|governor} with defaults during resume from system suspend.
--- drivers/cpufreq/cpufreq.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-)
drivers/cpufreq/cpufreq.c +9 -5
@@ -860,9 +860,6 @@ static void cpufreq_init_policy(struct cpufreq_policy *policy)/* set default policy */ ret =__cpufreq_set_policy (policy, &new_policy); - policy->user_policy.policy = policy->policy; - policy->user_policy.governor = policy->governor; -if (ret) {pr_debug ("setting policy failed\n" );if (cpufreq_driver->exit)
@@ -1091,8 +1088,10 @@ static int __cpufreq_add_dev(struct device *dev, struct subsys_interface *sif,*/ cpumask_and (policy->cpus, policy->cpus, cpu_online_mask); - policy->user_policy.min = policy->min; - policy->user_policy.max = policy->max; +if (!frozen) { + policy->user_policy.min = policy->min; + policy->user_policy.max = policy->max; + }blocking_notifier_call_chain (&cpufreq_policy_notifier_list,CPUFREQ_START , policy);
@@ -1123,6 +1122,11 @@ static int __cpufreq_add_dev(struct device *dev, struct subsys_interface *sif,cpufreq_init_policy (policy); +if (!frozen) { + policy->user_policy.policy = policy->policy; + policy->user_policy.governor = policy->governor; + } +kobject_uevent (&policy->kobj,KOBJ_ADD );up_read (&cpufreq_rwsem);
Signature · 1 line
2.12.0
PATCH 101/113 ipv6: fix the use of pcpu_tstats in ip6_tunnel
In reply to Jiri SlabyFrom: Li RongQing <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit abb6013cca147ad940b0e9fee260d2d9e93b7018 upstream.
when read/write the 64bit data, the correct lock should be hold.
--- net/ipv6/ip6_tunnel.c | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-)
net/ipv6/ip6_tunnel.c +16 -5
@@ -104,16 +104,25 @@ struct ip6_tnl_net {static struct net_device_stats *ip6_get_stats (struct net_device *dev) { -struct pcpu_tstats sum = {0 }; +struct pcpu_tstats tmp, sum = {0 };int i;for_each_possible_cpu (i) { +unsigned int start;const struct pcpu_tstats *tstats =per_cpu_ptr (dev->tstats, i); - sum.rx_packets += tstats->rx_packets; - sum.rx_bytes += tstats->rx_bytes; - sum.tx_packets += tstats->tx_packets; - sum.tx_bytes += tstats->tx_bytes; +do { + start =u64_stats_fetch_begin_bh (&tstats->syncp); + tmp.rx_packets = tstats->rx_packets; + tmp.rx_bytes = tstats->rx_bytes; + tmp.tx_packets = tstats->tx_packets; + tmp.tx_bytes = tstats->tx_bytes; + }while (u64_stats_fetch_retry_bh (&tstats->syncp, start)); + + sum.rx_packets += tmp.rx_packets; + sum.rx_bytes += tmp.rx_bytes; + sum.tx_packets += tmp.tx_packets; + sum.tx_bytes += tmp.tx_bytes; } dev->stats.rx_packets = sum.rx_packets; dev->stats.rx_bytes = sum.rx_bytes;
@@ -832,8 +841,10 @@ static int ip6_tnl_rcv(struct sk_buff *skb, __u16 protocol, } tstats =this_cpu_ptr (t->dev->tstats); +u64_stats_update_begin (&tstats->syncp); tstats->rx_packets++; tstats->rx_bytes += skb->len; +u64_stats_update_end (&tstats->syncp);netif_rx (skb);
Signature · 1 line
2.12.0
PATCH 102/113 net: 6lowpan: fix lowpan_header_create non-compression memcpy call
In reply to Jiri SlabyFrom: Daniel Borkmann <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 965801e1eb624154fe5e9dc5d2ff0b7f1951a11c upstream.
In function lowpan_header_create(), we invoke the following code construct:
struct ipv6hdr *hdr;
...
hdr = ipv6_hdr(skb);
...
if (...)
memcpy(hc06_ptr + 1, &hdr->flow_lbl[1], 2);
else
memcpy(hc06_ptr, &hdr, 4);Where the else path of the condition, that is, non-compression path, calls memcpy() with a pointer to struct ipv6hdr *hdr as source, thus two levels of indirection. This cannot be correct, and likely only one level of pointer was intended as source buffer for memcpy() here.
--- net/ieee802154/6lowpan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ieee802154/6lowpan.c +1 -1
@@ -548,7 +548,7 @@ static int lowpan_header_create(struct sk_buff *skb, hc06_ptr +=3 ; }else {/* compress nothing */ -memcpy (hc06_ptr, &hdr,4 ); +memcpy (hc06_ptr, hdr,4 );/* replace the top byte with new ECN | DSCP format */ *hc06_ptr = tmp; hc06_ptr +=4 ;
Signature · 1 line
2.12.0
PATCH 103/113 ipv6: simplify detection of first operational link-local address on interface
In reply to Jiri SlabyFrom: Hannes Frederic Sowa <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 11ffff752c6a5adc86f7dd397b2f75af8f917c51 upstream.
In commit 1ec047eb4751e3 ("ipv6: introduce per-interface counter for dad-completed ipv6 addresses") I build the detection of the first operational link-local address much to complex. Additionally this code now has a race condition.
Replace it with a much simpler variant, which just scans the address list when duplicate address detection completes, to check if this is the first valid link local address and send RS and MLD reports then.
--- include/net/if_inet6.h | 1 - net/ipv6/addrconf.c | 38 +++++++++++++++++--------------------- 2 files changed, 17 insertions(+), 22 deletions(-)
include/net/if_inet6.h +0 -1
@@ -166,7 +166,6 @@ struct inet6_dev {struct net_device *dev;struct list_head addr_list; -int valid_ll_addr_cnt;struct ifmcaddr6 *mc_list;struct ifmcaddr6 *mc_tomb;
net/ipv6/addrconf.c +17 -21
@@ -3237,6 +3237,22 @@ out:in6_ifa_put (ifp); } +/* ifp->idev must be at least read locked */ +static bool ipv6_lonely_lladdr (struct inet6_ifaddr *ifp) +{ +struct inet6_ifaddr *ifpiter; +struct inet6_dev *idev = ifp->idev; + +list_for_each_entry (ifpiter, &idev->addr_list, if_list) { +if (ifp != ifpiter && ifpiter->scope ==IFA_LINK && + (ifpiter->flags & (IFA_F_PERMANENT |IFA_F_TENTATIVE | +IFA_F_OPTIMISTIC |IFA_F_DADFAILED )) == +IFA_F_PERMANENT ) +return false; + } +return true; +} +static void addrconf_dad_completed (struct inet6_ifaddr *ifp) {struct net_device *dev = ifp->idev->dev;
@@ -3256,14 +3272,11 @@ static void addrconf_dad_completed(struct inet6_ifaddr *ifp)*/ read_lock_bh (&ifp->idev->lock); -spin_lock (&ifp->lock); - send_mld =ipv6_addr_type (&ifp->addr) &IPV6_ADDR_LINKLOCAL && - ifp->idev->valid_ll_addr_cnt ==1 ; + send_mld = ifp->scope ==IFA_LINK &&ipv6_lonely_lladdr (ifp); send_rs = send_mld &&ipv6_accept_ra (ifp->idev) && ifp->idev->cnf.rtr_solicits >0 && (dev->flags&IFF_LOOPBACK ) ==0 ; -spin_unlock (&ifp->lock);read_unlock_bh (&ifp->idev->lock);/* While dad is in progress mld report's source address is in6_addrany.
@@ -4558,19 +4571,6 @@ errout:rtnl_set_sk_err (net,RTNLGRP_IPV6_PREFIX , err); } -static void update_valid_ll_addr_cnt (struct inet6_ifaddr *ifp,int count) -{ -write_lock_bh (&ifp->idev->lock); -spin_lock (&ifp->lock); -if (((ifp->flags & (IFA_F_PERMANENT |IFA_F_TENTATIVE |IFA_F_OPTIMISTIC | -IFA_F_DADFAILED )) ==IFA_F_PERMANENT ) && - (ipv6_addr_type (&ifp->addr) &IPV6_ADDR_LINKLOCAL )) - ifp->idev->valid_ll_addr_cnt += count; -WARN_ON (ifp->idev->valid_ll_addr_cnt <0 ); -spin_unlock (&ifp->lock); -write_unlock_bh (&ifp->idev->lock); -} -static void __ipv6_ifa_notify (int event,struct inet6_ifaddr *ifp) {struct net *net =dev_net (ifp->idev->dev);
@@ -4579,8 +4579,6 @@ static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)switch (event) {case RTM_NEWADDR : -update_valid_ll_addr_cnt (ifp,1 ); -/* * If the address was optimistic * we inserted the route at the start of
@@ -4596,8 +4594,6 @@ static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp) ifp->idev->dev, 0, 0);break ;case RTM_DELADDR : -update_valid_ll_addr_cnt (ifp,-1 ); -if (ifp->idev->cnf.forwarding)addrconf_leave_anycast (ifp);addrconf_leave_solict (ifp->idev, &ifp->addr);
Signature · 1 line
2.12.0
PATCH 104/113 net: sctp: rework multihoming retransmission path selection to rfc4960
In reply to Jiri SlabyFrom: Daniel Borkmann <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 4c47af4d5eb2c2f78f886079a3920a7078a6f0a0 upstream.
Problem statement: 1) both paths (primary path1 and alternate path2) are up after the association has been established i.e., HB packets are normally exchanged, 2) path2 gets inactive after path_max_retrans * max_rto timed out (i.e. path2 is down completely),
3) now, if a transmission times out on the only surviving/active path1 (any ~1sec network service impact could cause this like a channel bonding failover), then the retransmitted packets are sent over the inactive path2; this happens with partial failover and without it.
Besides not being optimal in the above scenario, a small failure or timeout in the only existing path has the potential to cause long delays in the retransmission (depending on RTO_MAX) until the still active path is reselected. Further, when the T3-timeout occurs, we have active_patch == retrans_path, and even though the timeout occurred on the initial transmission of data, not a retransmit, we end up updating retransmit path.
RFC4960, section 6.4. "Multi-Homed SCTP Endpoints" states under 6.4.1. "Failover from an Inactive Destination Address" the following:
Some of the transport addresses of a multi-homed SCTP endpoint may become inactive due to either the occurrence of certain error conditions (see Section 8.2) or adjustments from the SCTP user.
When there is outbound data to send and the primary path becomes inactive (e.g., due to failures), or where the SCTP user explicitly requests to send data to an inactive destination transport address, before reporting an error to its ULP, the SCTP endpoint should try to send the data to an alternate __active__ destination transport address if one exists.
When retransmitting data that timed out, if the endpoint is multihomed, it should consider each source-destination address pair in its retransmission selection policy. When retransmitting timed-out data, the endpoint should attempt to pick the most divergent source-destination pair from the original source-destination pair to which the packet was transmitted.
Note: Rules for picking the most divergent source-destination pair are an implementation decision and are not specified within this document.
So, we should first reconsider to take the current active retransmission transport if we cannot find an alternative active one. If all of that fails, we can still round robin through unkown, partial failover, and inactive ones in the hope to find something still suitable.
Commit 4141ddc02a92 ("sctp: retran_path update bug fix") broke that behaviour by selecting the next inactive transport when no other active transport was found besides the current assoc's peer.retran_path. Before commit 4141ddc02a92, we would have traversed through the list until we reach our peer.retran_path again, and in case that is still in state SCTP_ACTIVE, we would take it and return. Only if that is not the case either, we take the next inactive transport.
Besides all that, another issue is that transports in state SCTP_UNKNOWN could be preferred over transports in state SCTP_ACTIVE in case a SCTP_ACTIVE transport appears after SCTP_UNKNOWN in the transport list yielding a weaker transport state to be used in retransmission.
This patch mostly reverts 4141ddc02a92, but also rewrites this function to introduce more clarity and strictness into the code. A strict priority of transport states is enforced in this patch, hence selection is active > unkown > partial failover > inactive.
--- net/sctp/associola.c | 129 +++++++++++++++++++++++++++++++-------------------- 1 file changed, 79 insertions(+), 50 deletions(-)
net/sctp/associola.c +79 -50
@@ -1286,78 +1286,107 @@ void sctp_assoc_update(struct sctp_association *asoc, }/* Update the retran path for sending a retransmitted packet. -* Round-robin through the active transports, else round-robin -* through the inactive transports as this is the next best thing -* we can try. +* See also RFC4960, 6.4. Multi-Homed SCTP Endpoints: +* +* When there is outbound data to send and the primary path +* becomes inactive (e.g., due to failures), or where the +* SCTP user explicitly requests to send data to an +* inactive destination transport address, before reporting +* an error to its ULP, the SCTP endpoint should try to send +* the data to an alternate active destination transport +* address if one exists. +* +* When retransmitting data that timed out, if the endpoint +* is multihomed, it should consider each source-destination +* address pair in its retransmission selection policy. +* When retransmitting timed-out data, the endpoint should +* attempt to pick the most divergent source-destination +* pair from the original source-destination pair to which +* the packet was transmitted. +* +* Note: Rules for picking the most divergent source-destination +* pair are an implementation decision and are not specified +* within this document. +* +* Our basic strategy is to round-robin transports in priorities +* according to sctp_state_prio_map[] e.g., if no such +* transport with state SCTP_ACTIVE exists, round-robin through +* SCTP_UNKNOWN, etc. You get the picture. */ -void sctp_assoc_update_retran_path (struct sctp_association *asoc) +static const u8 sctp_trans_state_to_prio_map[] = { + [SCTP_ACTIVE ] =3 ,/* best case */ + [SCTP_UNKNOWN ] =2 , + [SCTP_PF ] =1 , + [SCTP_INACTIVE ] =0 ,/* worst case */ +}; + +static u8 sctp_trans_score (const struct sctp_transport *trans) { -struct sctp_transport *t, *next; -struct list_head *head = &asoc->peer.transport_addr_list; -struct list_head *pos; +return sctp_trans_state_to_prio_map[trans->state]; +} -if (asoc->peer.transport_count ==1 ) -return ; +static struct sctp_transport *sctp_trans_elect_best (struct sctp_transport *curr, +struct sctp_transport *best) +{ +if (best ==NULL ) +return curr; -/* Find the next transport in a round-robin fashion. */ - t = asoc->peer.retran_path; - pos = &t->transports; - next =NULL ; +return sctp_trans_score (curr) >sctp_trans_score (best) ? curr : best; +} -while (1 ) { -/* Skip the head. */ -if (pos->next == head) - pos = head->next; -else - pos = pos->next; +void sctp_assoc_update_retran_path (struct sctp_association *asoc) +{ +struct sctp_transport *trans = asoc->peer.retran_path; +struct sctp_transport *trans_next =NULL ; - t = list_entry(pos, struct sctp_transport, transports); +/* We're done as we only have the one and only path. */ +if (asoc->peer.transport_count ==1 ) +return ; +/* If active_path and retran_path are the same and active, +* then this is the only active path. Use it. +*/ +if (asoc->peer.active_path == asoc->peer.retran_path && + asoc->peer.active_path->state ==SCTP_ACTIVE ) +return ; -/* We have exhausted the list, but didn't find any -* other active transports. If so, use the next -* transport. -*/ -if (t == asoc->peer.retran_path) { - t = next; +/* Iterate from retran_path's successor back to retran_path. */ +for (trans =list_next_entry (trans, transports);1 ; + trans =list_next_entry (trans, transports)) { +/* Manually skip the head element. */ +if (&trans->transports == &asoc->peer.transport_addr_list) +continue ; +if (trans->state ==SCTP_UNCONFIRMED ) +continue ; + trans_next =sctp_trans_elect_best (trans, trans_next); +/* Active is good enough for immediate return. */ +if (trans_next->state ==SCTP_ACTIVE )break ; - } - -/* Try to find an active transport. */ - -if ((t->state ==SCTP_ACTIVE ) || - (t->state ==SCTP_UNKNOWN )) { +/* We've reached the end, time to update path. */ +if (trans == asoc->peer.retran_path)break ; - }else { -/* Keep track of the next transport in case -* we don't find any active transport. -*/ -if (t->state !=SCTP_UNCONFIRMED && !next) - next = t; - } } -if (t) - asoc->peer.retran_path = t; -else - t = asoc->peer.retran_path; +if (trans_next !=NULL ) + asoc->peer.retran_path = trans_next; -pr_debug ("%s: association:%p addr:%pISpc\n" , __func__, asoc, - &t->ipaddr.sa); +pr_debug ("%s: association:%p updated new path to addr:%pISpc\n" , + __func__, asoc, &asoc->peer.retran_path->ipaddr.sa); } -/* Choose the transport for sending retransmit packet. */ -struct sctp_transport *sctp_assoc_choose_alter_transport ( -struct sctp_association *asoc,struct sctp_transport *last_sent_to) +struct sctp_transport * +sctp_assoc_choose_alter_transport (struct sctp_association *asoc, +struct sctp_transport *last_sent_to) {/* If this is the first time packet is sent, use the active path, * else use the retran path. If the last packet was sent over the * retran path, update the retran path and use it. */ -if (!last_sent_to) +if (last_sent_to ==NULL ) {return asoc->peer.active_path; -else { + }else {if (last_sent_to == asoc->peer.retran_path)sctp_assoc_update_retran_path (asoc); +return asoc->peer.retran_path; } }
Signature · 1 line
2.12.0
PATCH 105/113 vti4: Don't count header length twice.
In reply to Jiri SlabyFrom: Steffen Klassert <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit a32452366b7250c42e96a18ffc3ad8db9e0ca3c2 upstream.
We currently count the size of LL_MAX_HEADER and struct iphdr twice for vti4 devices, this leads to a wrong device mtu. The size of LL_MAX_HEADER and struct iphdr is already counted in ip_tunnel_bind_dev(), so don't do it again in vti_tunnel_init().
--- net/ipv4/ip_vti.c | 1 - 1 file changed, 1 deletion(-)
net/ipv4/ip_vti.c +0 -1
@@ -283,7 +283,6 @@ static int vti_tunnel_init(struct net_device *dev)memcpy (dev->dev_addr, &iph->saddr,4 );memcpy (dev->broadcast, &iph->daddr,4 ); - dev->hard_header_len =LL_MAX_HEADER +sizeof (struct iphdr ); dev->mtu =ETH_DATA_LEN ; dev->flags =IFF_NOARP ; dev->iflink =0 ;
Signature · 1 line
2.12.0
PATCH 106/113 PCI: mvebu: Use max_t() instead of max(resource_size_t,)
In reply to Jiri SlabyFrom: Jingoo Han <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 06489002a175680e18b4c0dd0beb6aff2a6d3781 upstream.
Use max_t() instead of max(resource_size_t,) in order to fix the following checkpatch warning.
WARNING: max() should probably be max_t(resource_size_t, SZ_64K, size)
WARNING: max() should probably be max_t(resource_size_t, SZ_1M, size)
--- drivers/pci/host/pci-mvebu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/pci/host/pci-mvebu.c +2 -2
@@ -682,9 +682,9 @@ resource_size_t mvebu_pcie_align_resource(struct pci_dev *dev,* aligned on their size */ if (res->flags &IORESOURCE_IO ) -return round_up (start,max ((resource_size_t )SZ_64K , size)); +return round_up (start,max_t (resource_size_t,SZ_64K , size));else if (res->flags &IORESOURCE_MEM ) -return round_up (start,max ((resource_size_t )SZ_1M , size)); +return round_up (start,max_t (resource_size_t,SZ_1M , size));else return start; }
Signature · 1 line
2.12.0
PATCH 107/113 PCI: mvebu: split PCIe BARs into multiple MBus windows when needed
In reply to Jiri SlabyFrom: Thomas Petazzoni <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 398f5d5e10b6b917cd9d35ef21d545b0afbada22 upstream.
MBus windows are used on Marvell platforms to map certain peripherals in the physical address space. In the PCIe context, MBus windows are needed to map PCIe I/O and memory regions in the physical address.
However, those MBus windows can only have power of two sizes, while PCIe BAR do not necessarily guarantee this. For this reason, the current pci-mvebu breaks on platforms where PCIe devices have BARs that don't sum up to a power of two size at the emulated bridge level.
This commit fixes this by allowing the pci-mvebu driver to create multiple contiguous MBus windows (each having a power of two size) to cover a given PCIe BAR.
To achieve this, two functions are added: mvebu_pcie_add_windows() and mvebu_pcie_del_windows() to respectively add and remove all the MBus windows that are needed to map the provided PCIe region base and size. The emulated PCI bridge code now calls those functions, instead of directly calling the mvebu-mbus driver functions.
--- drivers/pci/host/pci-mvebu.c | 88 +++++++++++++++++++++++++++++++++++++------- 1 file changed, 74 insertions(+), 14 deletions(-)
drivers/pci/host/pci-mvebu.c +74 -14
@@ -266,6 +266,58 @@ static int mvebu_pcie_hw_wr_conf(struct mvebu_pcie_port *port,return ret; } +/* +* Remove windows, starting from the largest ones to the smallest +* ones. +*/ +static void mvebu_pcie_del_windows (struct mvebu_pcie_port *port, +phys_addr_t base,size_t size) +{ +while (size) { +size_t sz =1 << (fls (size) -1 ); + +mvebu_mbus_del_window (base, sz); + base += sz; + size -= sz; + } +} + +/* +* MBus windows can only have a power of two size, but PCI BARs do not +* have this constraint. Therefore, we have to split the PCI BAR into +* areas each having a power of two size. We start from the largest +* one (i.e highest order bit set in the size). +*/ +static void mvebu_pcie_add_windows (struct mvebu_pcie_port *port, +unsigned int target,unsigned int attribute, +phys_addr_t base,size_t size, +phys_addr_t remap) +{ +size_t size_mapped =0 ; + +while (size) { +size_t sz =1 << (fls (size) -1 ); +int ret; + + ret =mvebu_mbus_add_window_remap_by_id (target, attribute, base, + sz, remap); +if (ret) { +dev_err (&port->pcie->pdev->dev, +"Could not create MBus window at 0x%x, size 0x%x: %d\n" , + base, sz, ret); +mvebu_pcie_del_windows (port, base - size_mapped, + size_mapped); +return ; + } + + size -= sz; + size_mapped += sz; + base += sz; +if (remap !=MVEBU_MBUS_NO_REMAP ) + remap += sz; + } +} +static void mvebu_pcie_handle_iobase_change (struct mvebu_pcie_port *port) {phys_addr_t iobase;
@@ -276,8 +328,8 @@ static void mvebu_pcie_handle_iobase_change(struct mvebu_pcie_port *port)/* If a window was configured, remove it */ if (port->iowin_base) { -mvebu_mbus_del_window (port->iowin_base, - port->iowin_size); +mvebu_pcie_del_windows (port, port->iowin_base, + port->iowin_size); port->iowin_base =0 ; port->iowin_size =0 ; }
@@ -299,9 +351,9 @@ static void mvebu_pcie_handle_iobase_change(struct mvebu_pcie_port *port) (port->bridge.iolimitupper << 16)) - iobase) + 1; -mvebu_mbus_add_window_remap_by_id (port->io_target, port->io_attr, - port->iowin_base, port->iowin_size, - iobase); +mvebu_pcie_add_windows (port, port->io_target, port->io_attr, + port->iowin_base, port->iowin_size, + iobase);pci_ioremap_io (iobase, port->iowin_base); }
@@ -313,8 +365,8 @@ static void mvebu_pcie_handle_membase_change(struct mvebu_pcie_port *port)/* If a window was configured, remove it */ if (port->memwin_base) { -mvebu_mbus_del_window (port->memwin_base, - port->memwin_size); +mvebu_pcie_del_windows (port, port->memwin_base, + port->memwin_size); port->memwin_base =0 ; port->memwin_size =0 ; }
@@ -333,8 +385,9 @@ static void mvebu_pcie_handle_membase_change(struct mvebu_pcie_port *port) (((port->bridge.memlimit &0xFFF0 ) <<16 ) |0xFFFFF ) - port->memwin_base +1 ; -mvebu_mbus_add_window_by_id (port->mem_target, port->mem_attr, - port->memwin_base, port->memwin_size); +mvebu_pcie_add_windows (port, port->mem_target, port->mem_attr, + port->memwin_base, port->memwin_size, +MVEBU_MBUS_NO_REMAP ); }/*
@@ -677,14 +730,21 @@ resource_size_t mvebu_pcie_align_resource(struct pci_dev *dev,/* * On the PCI-to-PCI bridge side, the I/O windows must have at -* least a 64 KB size and be aligned on their size, and the -* memory windows must have at least a 1 MB size and be -* aligned on their size +* least a 64 KB size and the memory windows must have at +* least a 1 MB size. Moreover, MBus windows need to have a +* base address aligned on their size, and their size must be +* a power of two. This means that if the BAR doesn't have a +* power of two size, several MBus windows will actually be +* created. We need to ensure that the biggest MBus window +* (which will be the first one) is aligned on its size, which +* explains the rounddown_pow_of_two() being done here. */ if (res->flags &IORESOURCE_IO ) -return round_up (start,max_t (resource_size_t,SZ_64K , size)); +return round_up (start,max_t (resource_size_t,SZ_64K , +rounddown_pow_of_two (size)));else if (res->flags &IORESOURCE_MEM ) -return round_up (start,max_t (resource_size_t,SZ_1M , size)); +return round_up (start,max_t (resource_size_t,SZ_1M , +rounddown_pow_of_two (size)));else return start; }
Signature · 1 line
2.12.0
PATCH 108/113 gianfar: Check if phydev present on ethtool -A
In reply to Jiri SlabyFrom: Claudiu Manoil <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 98a46d46d1bc983125b6ff9a0e831050a7011713 upstream.
This fixes a seg fault on 'ethtool -A' entry if the interface is down. Obviously we need to have the phy device initialized / "connected" (see of_phy_connect()) to be able to advertise pause frame capabilities.
--- drivers/net/ethernet/freescale/gianfar_ethtool.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/freescale/gianfar_ethtool.c +3 -0
@@ -553,6 +553,9 @@ static int gfar_spauseparam(struct net_device *dev,struct gfar __iomem *regs = priv->gfargrp[0 ].regs;u32 oldadv, newadv; +if (!phydev) +return -ENODEV ; +if (!(phydev->supported & SUPPORTED_Pause) || (!(phydev->supported & SUPPORTED_Asym_Pause) && (epause->rx_pause != epause->tx_pause)))
Signature · 1 line
2.12.0
PATCH 109/113 net: filter: x86: fix JIT address randomization
In reply to Jiri SlabyFrom: Alexei Starovoitov <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 773cd38f40b8834be991dbfed36683acc1dd41ee upstream.
bpf_alloc_binary() adds 128 bytes of room to JITed program image and rounds it up to the nearest page size. If image size is close to page size (like 4000), it is rounded to two pages:round_up(4000 + 4 + 128) == 8192
then 'hole' is computed as 8192 - (4000 + 4) = 4188
If prandom_u32() % hole selects a number >= PAGE_SIZE - sizeof(*header) then kernel will crash during bpf_jit_free():
kernel BUG at arch/x86/mm/pageattr.c:887!
Call Trace: [<ffffffff81037285>] change_page_attr_set_clr+0x135/0x460 [<ffffffff81694cc0>] ? _raw_spin_unlock_irq+0x30/0x50 [<ffffffff810378ff>] set_memory_rw+0x2f/0x40 [<ffffffffa01a0d8d>] bpf_jit_free_deferred+0x2d/0x60 [<ffffffff8106bf98>] process_one_work+0x1d8/0x6a0 [<ffffffff8106bf38>] ? process_one_work+0x178/0x6a0 [<ffffffff8106c90c>] worker_thread+0x11c/0x370
since bpf_jit_free() does:
unsigned long addr = (unsigned long)fp->bpf_func & PAGE_MASK; struct bpf_binary_header *header = (void *)addr;
to compute start address of 'bpf_binary_header'
and header->pages will pass junk to:
set_memory_rw(addr, header->pages);
Fix it by making sure that &header->image[prandom_u32() % hole] and &header are in the same page
--- arch/x86/net/bpf_jit_comp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/net/bpf_jit_comp.c +1 -1
@@ -171,7 +171,7 @@ static struct bpf_binary_header *bpf_alloc_binary(unsigned int proglen,memset (header,0xcc , sz);/* fill whole space with int3 instructions */ header->pages = sz /PAGE_SIZE ; - hole = sz - (proglen +sizeof (*header)); + hole =min (sz - (proglen +sizeof (*header)),PAGE_SIZE -sizeof (*header));/* insert a random number of int3 instructions before BPF code */ *image_ptr = &header->image[prandom_u32 () % hole];
Signature · 1 line
2.12.0
PATCH 110/113 net: filter: s390: fix JIT address randomization
In reply to Jiri SlabyFrom: Heiko Carstens <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit e84d2f8d2ae33c8215429824e1ecf24cbca9645e upstream.
This is the s390 variant of Alexei's JIT bug fix. (patch description below stolen from Alexei's patch)
bpf_alloc_binary() adds 128 bytes of room to JITed program image and rounds it up to the nearest page size. If image size is close to page size (like 4000), it is rounded to two pages:round_up(4000 + 4 + 128) == 8192
then 'hole' is computed as 8192 - (4000 + 4) = 4188
If prandom_u32() % hole selects a number >= PAGE_SIZE - sizeof(*header) then kernel will crash during bpf_jit_free():
kernel BUG at arch/x86/mm/pageattr.c:887!
Call Trace: [<ffffffff81037285>] change_page_attr_set_clr+0x135/0x460 [<ffffffff81694cc0>] ? _raw_spin_unlock_irq+0x30/0x50 [<ffffffff810378ff>] set_memory_rw+0x2f/0x40 [<ffffffffa01a0d8d>] bpf_jit_free_deferred+0x2d/0x60 [<ffffffff8106bf98>] process_one_work+0x1d8/0x6a0 [<ffffffff8106bf38>] ? process_one_work+0x178/0x6a0 [<ffffffff8106c90c>] worker_thread+0x11c/0x370
since bpf_jit_free() does:
unsigned long addr = (unsigned long)fp->bpf_func & PAGE_MASK; struct bpf_binary_header *header = (void *)addr;
to compute start address of 'bpf_binary_header'
and header->pages will pass junk to:
set_memory_rw(addr, header->pages);
Fix it by making sure that &header->image[prandom_u32() % hole] and &header are in the same page.
--- arch/s390/net/bpf_jit_comp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/s390/net/bpf_jit_comp.c +1 -1
@@ -811,7 +811,7 @@ static struct bpf_binary_header *bpf_alloc_binary(unsigned int bpfsize,return NULL ;memset (header,0 , sz); header->pages = sz /PAGE_SIZE ; - hole = sz - (bpfsize +sizeof (*header)); + hole =min (sz - (bpfsize +sizeof (*header)),PAGE_SIZE -sizeof (*header));/* Insert random number of illegal instructions before BPF code * and make sure the first instruction starts at an even address. */
Signature · 1 line
2.12.0
PATCH 111/113 USB: cdc-acm: fix double usb_autopm_put_interface() in acm_port_activate()
In reply to Jiri SlabyFrom: Alexey Khoroshilov <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 070c0b17f6a1ba39dff9be112218127e7e8fd456 upstream.
If acm_submit_read_urbs() fails in acm_port_activate(), error handling code calls usb_autopm_put_interface() while it is already called before acm_submit_read_urbs(). The patch reorganizes error handling code to avoid double decrement of USB interface's PM-usage counter.
Found by Linux Driver Verification project (linuxtesting.org).
--- drivers/usb/class/cdc-acm.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/usb/class/cdc-acm.c +4 -2
@@ -517,13 +517,16 @@ static int acm_port_activate(struct tty_port *port, struct tty_struct *tty)if (usb_submit_urb (acm->ctrlurb,GFP_KERNEL )) {dev_err (&acm->control->dev,"%s - usb_submit_urb(ctrl irq) failed\n" , __func__); +usb_autopm_put_interface (acm->control); goto error_submit_urb; } acm->ctrlout =ACM_CTRL_DTR |ACM_CTRL_RTS ;if (acm_set_control (acm, acm->ctrlout) <0 && - (acm->ctrl_caps &USB_CDC_CAP_LINE )) + (acm->ctrl_caps &USB_CDC_CAP_LINE )) { +usb_autopm_put_interface (acm->control); goto error_set_control; + }usb_autopm_put_interface (acm->control);
@@ -550,7 +553,6 @@ error_submit_read_urbs: error_set_control:usb_kill_urb (acm->ctrlurb); error_submit_urb: -usb_autopm_put_interface (acm->control); error_get_interface: disconnected:mutex_unlock (&acm->mutex);
Signature · 1 line
2.12.0
PATCH 112/113 USB: cdc-acm: fix open and suspend race
In reply to Jiri SlabyFrom: Johan Hovold <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 703df3297fb1950b0aa53e656108eb936d3f21d9 upstream.
We must not do the usb_autopm_put_interface() before submitting the read urbs or we might end up doing I/O to a suspended device.
--- drivers/usb/class/cdc-acm.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
drivers/usb/class/cdc-acm.c +3 -4
@@ -517,19 +517,15 @@ static int acm_port_activate(struct tty_port *port, struct tty_struct *tty)if (usb_submit_urb (acm->ctrlurb,GFP_KERNEL )) {dev_err (&acm->control->dev,"%s - usb_submit_urb(ctrl irq) failed\n" , __func__); -usb_autopm_put_interface (acm->control); goto error_submit_urb; } acm->ctrlout =ACM_CTRL_DTR |ACM_CTRL_RTS ;if (acm_set_control (acm, acm->ctrlout) <0 && (acm->ctrl_caps &USB_CDC_CAP_LINE )) { -usb_autopm_put_interface (acm->control); goto error_set_control; } -usb_autopm_put_interface (acm->control); -/* * Unthrottle device in case the TTY was closed while throttled. */
@@ -541,6 +537,8 @@ static int acm_port_activate(struct tty_port *port, struct tty_struct *tty)if (acm_submit_read_urbs (acm,GFP_KERNEL )) goto error_submit_read_urbs; +usb_autopm_put_interface (acm->control); +mutex_unlock (&acm->mutex);return 0 ;
@@ -553,6 +551,7 @@ error_submit_read_urbs: error_set_control:usb_kill_urb (acm->ctrlurb); error_submit_urb: +usb_autopm_put_interface (acm->control); error_get_interface: disconnected:mutex_unlock (&acm->mutex);
Signature · 1 line
2.12.0
PATCH 113/113 USB: cdc-acm: fix failed open not being detected
In reply to Jiri SlabyFrom: Johan Hovold <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 8727bf689a77a79816065e23a7a58a474ad544f9 upstream.
Fix errors during open not being returned to userspace. Specifically, failed control-line manipulations or control or read urb submissions would not be detected.
warning)")
--- drivers/usb/class/cdc-acm.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
drivers/usb/class/cdc-acm.c +8 -6
@@ -514,17 +514,17 @@ static int acm_port_activate(struct tty_port *port, struct tty_struct *tty) acm->control->needs_remote_wakeup =1 ; acm->ctrlurb->dev = acm->dev; -if (usb_submit_urb (acm->ctrlurb,GFP_KERNEL )) { + retval =usb_submit_urb (acm->ctrlurb,GFP_KERNEL ); +if (retval) {dev_err (&acm->control->dev,"%s - usb_submit_urb(ctrl irq) failed\n" , __func__); goto error_submit_urb; } acm->ctrlout =ACM_CTRL_DTR |ACM_CTRL_RTS ; -if (acm_set_control (acm, acm->ctrlout) <0 && - (acm->ctrl_caps &USB_CDC_CAP_LINE )) { + retval =acm_set_control (acm, acm->ctrlout); +if (retval <0 && (acm->ctrl_caps &USB_CDC_CAP_LINE )) goto error_set_control; - }/* * Unthrottle device in case the TTY was closed while throttled.
@@ -534,7 +534,8 @@ static int acm_port_activate(struct tty_port *port, struct tty_struct *tty) acm->throttle_req =0 ;spin_unlock_irq (&acm->read_lock); -if (acm_submit_read_urbs (acm,GFP_KERNEL )) + retval =acm_submit_read_urbs (acm,GFP_KERNEL ); +if (retval) goto error_submit_read_urbs;usb_autopm_put_interface (acm->control);
@@ -555,7 +556,8 @@ error_submit_urb: error_get_interface: disconnected:mutex_unlock (&acm->mutex); -return retval; + +return usb_translate_errors (retval); }static void acm_port_destruct (struct tty_port *port)
Signature · 1 line
2.12.0
Quoted 8 lines · Jiri Slaby
This is the start of the stable review cycle for the 3.12.71 release. There are 113 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed Mar 8 10:10:31 CET 2017. Anything received after that time might be too late.
Build results:
total: 128 pass: 128 fail: 0 Qemu test results: total: 93 pass: 93 fail: 0
Details are available at http://kerneltests.org/builders.
Guenter
Quoted 14 lines · Guenter Roeck
Quoted 8 lines · Jiri Slaby
This is the start of the stable review cycle for the 3.12.71 release. There are 113 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed Mar 8 10:10:31 CET 2017. Anything received after that time might be too late.
Build results:
total: 128 pass: 128 fail: 0 Qemu test results: total: 93 pass: 93 fail: 0
Quoted 1 line · Shuah Khan
Compiled and booted on my test system. No dmesg regressions.
Thank you both!
Signature · 2 lines
js suse labs
Quoted 8 lines · Jiri Slaby
This is the start of the stable review cycle for the 3.12.71 release. There are 113 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed Mar 8 10:10:31 CET 2017. Anything received after that time might be too late.
Quoted 7 lines
The whole patch series can be found in one patch at:
http://kernel.org/pub/linux/kernel/people/jirislaby/stable-review/patch-3.12.71-rc1.xzand the diffstat can be found below.
thanks,
js
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah