3.8.5-stable review
Subsystems (59)
Greg Kroah-Hartman
maintainercover 3.8.5-stable review
This is the start of the stable review cycle for the 3.8.5 release. There are 98 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu Mar 28 22:41:38 UTC 2013. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v3.0/stable-review/patch-3.8.5-rc1.gz
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 3.8.5-rc1
Felix Fietkau <[email protected]>
rt2x00: error in configurations with mesh support disabled
Marek Szyprowski <[email protected]>
ARM: DMA-mapping: add missing GFP_DMA flag for atomic buffer allocation
Mikhail Kshevetskiy <[email protected]>
usb: musb: da8xx: Fix build breakage due to typo
Johan Hovold <[email protected]>
USB: io_ti: fix get_icount for two port adapters
Johan Hovold <[email protected]>
USB: garmin_gps: fix memory leak on disconnect
Jan Kara <[email protected]>
udf: Fix bitmap overflow on large filesystems with small block size
Rafael J. Wysocki <[email protected]>
ACPI: Rework acpi_get_child() to be more efficient
Ben Hutchings <[email protected]>
efivars: Fix check for CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE
Seth Forshee <[email protected]>
efivars: Add module parameter to disable use as a pstore backend
Seth Forshee <[email protected]>
efivars: Allow disabling use as a pstore backend
Johan Hovold <[email protected]>
USB: serial: fix interface refcounting
Andrzej Pietrasiewicz <[email protected]>
usb: gadget: ffs: fix enable multiple instances
Alan Stern <[email protected]>
USB: EHCI: fix regression in QH unlinking
Alan Stern <[email protected]>
USB: EHCI: fix regression during bus resume
Johan Hovold <[email protected]>
USB: cdc-acm: fix device unregistration
Hannes Reinecke <[email protected]>
USB: xhci: correctly enable interrupts
Dmitry Torokhov <[email protected]>
USB: xhci - fix bit definitions for IMAN register
CQ Tang <[email protected]>
x86-64: Fix the failure case in copy_user_handle_tail()
Mark Rutland <[email protected]>
clockevents: Don't allow dummy broadcast timers
Kent Overstreet <[email protected]>
nfsd: fix bad offset use
NeilBrown <[email protected]>
md/raid5: ensure sync and DISCARD don't happen at the same time.
Jonathan Brassow <[email protected]>
MD RAID5: Avoid accessing gendisk or queue structs when not available
NeilBrown <[email protected]>
md/raid5: schedule_construction should abort if nothing to do.
Takahisa Tanaka <[email protected]>
watchdog: sp5100_tco: Remove code that may cause a boot failure
Takahisa Tanaka <[email protected]>
watchdog: sp5100_tco: Set the AcpiMmioSel bitmask value to 1 instead of 2
Mike Marciniszyn <[email protected]>
IPoIB: Fix send lockup due to missed TX completion
Theodore Ts'o <[email protected]>
ext4: fix data=journal fast mount/umount hang
Lukas Czerner <[email protected]>
ext4: use s_extent_max_zeroout_kb value as number of kb
Theodore Ts'o <[email protected]>
ext4: use atomic64_t for the per-flexbg free_clusters count
Dmitry Artamonow <[email protected]>
usb-storage: add unusual_devs entry for Samsung YP-Z3 mp3 player
Zheng Liu <[email protected]>
ext4: fix the wrong number of the allocated blocks in ext4_split_extent()
Jan Kara <[email protected]>
jbd2: fix use after free in jbd2_journal_dirty_metadata()
Jeff Layton <[email protected]>
cifs: ignore everything in SPNEGO blob after mechTypes
Mateusz Guzik <[email protected]>
cifs: delay super block destruction until all cifsFileInfo objects are gone
Alex Deucher <[email protected]>
drm/radeon/benchmark: make sure bo blit copy exists before using it
Alex Deucher <[email protected]>
drm/radeon: fix backend map setup on 1 RB trinity boards
Alex Deucher <[email protected]>
drm/radeon: fix S/R on VM systems (cayman/TN/SI)
Alex Deucher <[email protected]>
drm/radeon: add support for Richland APUs
Alex Deucher <[email protected]>
drm/radeon: add Richland pci ids
Julia Lemire <[email protected]>
drm/mgag200: Bug fix: Modified pll algorithm for EH project
Mikulas Patocka <[email protected]>
dm verity: avoid deadlock
Joe Thornber <[email protected]>
dm thin: fix discard corruption
Laxman Dewangan <[email protected]>
ARM: tegra: fix register address of slink controller
Nicholas Bellinger <[email protected]>
target/file: Bump FD_MAX_SECTORS to 2048 to handle 1M sized I/Os
Andy Grover <[email protected]>
target/iscsi: Fix mutual CHAP auth on big-endian arches
Vladimir Davydov <[email protected]>
mqueue: sys_mq_open: do not call mnt_drop_write() if read-only
H Hartley Sweeten <[email protected]>
drivers/video/ep93xx-fb.c: include <linux/io.h> for devm_ioremap()
Wanpeng Li <[email protected]>
mm/hugetlb: fix total hugetlbfs pages count when using memory overcommit accouting
Nicolas Ferre <[email protected]>
drivers/rtc/rtc-at91rm9200.c: use a variable for storing IMR
Torsten Duwe <[email protected]>
KMS: fix EDID detailed timing frame rate
Torsten Duwe <[email protected]>
KMS: fix EDID detailed timing vsync parsing
Laxman Dewangan <[email protected]>
i2c: tegra: check the clk_prepare_enable() return value
Daniel Vetter <[email protected]>
Revert "drm/i915: write backlight harder"
Kees Cook <[email protected]>
drm/i915: bounds check execbuffer relocation count
Bing Zhao <[email protected]>
mwifiex: fix potential out-of-boundary access to ibss rate table
Larry Finger <[email protected]>
rtlwifi: rtl8192cu: Fix problem that prevents reassociation
Larry Finger <[email protected]>
rtlwifi: rtl8192cu: Fix schedule while atomic bug splat
Steven Rostedt (Red Hat) <[email protected]>
tracing: Keep overwrite in sync between regular and snapshot buffers
Steven Rostedt (Red Hat) <[email protected]>
tracing: Protect tracer flags with trace_types_lock
Steven Rostedt (Red Hat) <[email protected]>
tracing: Fix free of probe entry by calling call_rcu_sched()
Steven Rostedt (Red Hat) <[email protected]>
tracing: Fix race in snapshot swapping
Kees Cook <[email protected]>
drm/i915: restrict kernel address leak in debugfs
Takashi Iwai <[email protected]>
Revert "drm/i915: try to train DP even harder"
Linus Torvalds <[email protected]>
vfs,proc: guarantee unique inodes in /proc
Al Viro <[email protected]>
saner proc_get_inode() calling conventions
Daniel Mack <[email protected]>
ALSA: snd-usb: mixer: ignore -EINVAL in snd_usb_mixer_controls()
Daniel Mack <[email protected]>
ALSA: snd-usb: mixer: propagate errors up the call chain
Torstein Hegge <[email protected]>
ALSA: usb: Parse UAC2 extension unit like for UAC1
Takashi Iwai <[email protected]>
ALSA: hda - Fix typo in checking IEC958 emphasis bit
Takashi Iwai <[email protected]>
ALSA: hda/cirrus - Fix the digital beep registration
Ben Hutchings <[email protected]>
sfc: Only use TX push if a single descriptor is to be written
Ben Hutchings <[email protected]>
sfc: Disable soft interrupt handling during efx_device_detach_sync()
Ben Hutchings <[email protected]>
sfc: Detach net device when stopping queues for reconfiguration
Ben Hutchings <[email protected]>
sfc: Fix efx_rx_buf_offset() in the presence of swiotlb
Ben Hutchings <[email protected]>
sfc: Properly sync RX DMA buffer when it is not the last in the page
Julia Lawall <[email protected]>
drivers/net/ethernet/sfc/ptp.c: adjust duplicate test
Hannes Frederic Sowa <[email protected]>
inet: limit length of fragment queue hash table bucket lists
Eric Dumazet <[email protected]>
tcp: dont handle MTU reduction on LISTEN socket
Maciej Żenczykowski <[email protected]>
bnx2x: fix occasional statistics off-by-4GB error
Michael S. Tsirkin <[email protected]>
vhost/net: fix heads usage of ubuf_info
Michal Schmidt <[email protected]>
bnx2x: add missing napi deletion in error path
Bjørn Mork <[email protected]>
net: cdc_ncm, cdc_mbim: allow user to prefer NCM for backwards compatibility
Vlad Yasevich <[email protected]>
rtnetlink: Mask the rta_type when range checking
Timo Teräs <[email protected]>
Revert "ip_gre: make ipgre_tunnel_xmit() not parse network header as IP unconditionally"
Pavel Emelyanov <[email protected]>
skb: Propagate pfmemalloc on skb from head page only
Eric Dumazet <[email protected]>
tcp: fix skb_availroom()
Bjørn Mork <[email protected]>
net: qmi_wwan: set correct altsetting for Gobi 1K devices
Denis V. Lunev <[email protected]>
ipv4: fix definition of FIB_TABLE_HASHSZ
Xufeng Zhang <[email protected]>
sctp: don't break the loop while meeting the active_path so as to find the matched transport
Vlad Yasevich <[email protected]>
sctp: Use correct sideffect command in duplicate cookie handling
Nithin Sujir <[email protected]>
tg3: 5715 does not link up when autoneg off
Veaceslav Falico <[email protected]>
bonding: don't call update_speed_duplex() under spinlocks
Marek Lindner <[email protected]>
batman-adv: verify tt len does not exceed packet len
Veaceslav Falico <[email protected]>
netconsole: don't call __netpoll_cleanup() while atomic
stephen hemminger <[email protected]>
bridge: reserve space for IFLA_BRPORT_FAST_LEAVE
David Ward <[email protected]>
net/ipv4: Ensure that location of timestamp option is stored
Tkhai Kirill <[email protected]>
sunsu: Fix panic in case of nonexistent port at "console=ttySY" cmdline option
Alan Stern <[email protected]>
USB: EHCI: work around silicon bug in Intel's EHCI controllers
-------------
Diffstat:
Makefile | 4 +- arch/arm/boot/dts/tegra20.dtsi | 2 +- arch/arm/boot/dts/tegra30.dtsi | 2 +- arch/arm/mm/dma-mapping.c | 5 +- arch/x86/lib/usercopy_64.c | 4 +- drivers/acpi/glue.c | 35 +++--- drivers/firmware/Kconfig | 18 ++++ drivers/firmware/efivars.c | 70 +++++------- drivers/gpu/drm/drm_edid.c | 3 +- drivers/gpu/drm/i915/i915_debugfs.c | 2 +- drivers/gpu/drm/i915/i915_gem_execbuffer.c | 11 +- drivers/gpu/drm/i915/intel_dp.c | 2 +- drivers/gpu/drm/i915/intel_panel.c | 13 +-- drivers/gpu/drm/mgag200/mgag200_mode.c | 10 +- drivers/gpu/drm/radeon/ni.c | 33 ++++-- drivers/gpu/drm/radeon/radeon_benchmark.c | 16 +-- drivers/gpu/drm/radeon/si.c | 1 + drivers/i2c/busses/i2c-tegra.c | 13 ++- drivers/infiniband/ulp/ipoib/ipoib_cm.c | 8 +- drivers/md/dm-bufio.c | 2 + drivers/md/dm-thin.c | 4 +- drivers/md/dm-verity.c | 39 ++++++- drivers/md/persistent-data/dm-btree-remove.c | 46 ++++---- drivers/md/raid5.c | 116 ++++++++++++++------ drivers/md/raid5.h | 1 + drivers/net/bonding/bond_main.c | 6 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 1 + drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.h | 3 +- drivers/net/ethernet/broadcom/tg3.c | 8 ++ drivers/net/ethernet/sfc/efx.c | 16 ++- drivers/net/ethernet/sfc/efx.h | 4 +- drivers/net/ethernet/sfc/net_driver.h | 4 +- drivers/net/ethernet/sfc/nic.c | 3 +- drivers/net/ethernet/sfc/ptp.c | 2 +- drivers/net/ethernet/sfc/rx.c | 25 +++-- drivers/net/netconsole.c | 15 +-- drivers/net/usb/cdc_mbim.c | 11 +- drivers/net/usb/cdc_ncm.c | 49 ++++++--- drivers/net/usb/qmi_wwan.c | 49 +++------ drivers/net/wireless/mwifiex/join.c | 7 +- drivers/net/wireless/rt2x00/rt2x00dev.c | 2 + drivers/net/wireless/rtlwifi/rtl8192cu/hw.c | 89 ++++++--------- drivers/rtc/rtc-at91rm9200.c | 50 +++++---- drivers/rtc/rtc-at91rm9200.h | 1 - drivers/target/iscsi/iscsi_target_auth.c | 5 +- drivers/target/target_core_file.h | 2 +- drivers/tty/serial/sunsu.c | 21 ++-- drivers/usb/class/cdc-acm.c | 3 +- drivers/usb/core/hcd-pci.c | 23 ++-- drivers/usb/gadget/g_ffs.c | 4 +- drivers/usb/host/ehci-hcd.c | 7 +- drivers/usb/host/ehci-hub.c | 2 +- drivers/usb/host/ehci-q.c | 31 +++++- drivers/usb/host/ehci-timer.c | 2 +- drivers/usb/host/xhci.c | 3 +- drivers/usb/host/xhci.h | 4 +- drivers/usb/musb/da8xx.c | 2 +- drivers/usb/serial/garmin_gps.c | 7 +- drivers/usb/serial/io_ti.c | 1 + drivers/usb/serial/usb-serial.c | 3 +- drivers/usb/storage/unusual_devs.h | 7 ++ drivers/vhost/net.c | 3 +- drivers/video/ep93xx-fb.c | 1 + drivers/watchdog/sp5100_tco.c | 126 ++-------------------- drivers/watchdog/sp5100_tco.h | 2 +- fs/cifs/asn1.c | 53 +-------- fs/cifs/cifsfs.c | 24 +++++ fs/cifs/cifsfs.h | 4 + fs/cifs/file.c | 6 +- fs/ext4/ext4.h | 6 +- fs/ext4/extents.c | 8 +- fs/ext4/ialloc.c | 4 +- fs/ext4/inode.c | 3 +- fs/ext4/mballoc.c | 12 +-- fs/ext4/resize.c | 4 +- fs/ext4/super.c | 4 +- fs/jbd2/transaction.c | 15 ++- fs/nfsd/vfs.c | 3 +- fs/proc/generic.c | 21 ++-- fs/proc/inode.c | 12 +-- fs/udf/udf_sb.h | 2 +- include/drm/drm_pciids.h | 13 ++- include/linux/skbuff.h | 13 ++- include/linux/usb/cdc_ncm.h | 1 + include/net/inet_frag.h | 9 ++ include/net/ip_fib.h | 12 +-- ipc/mqueue.c | 3 +- kernel/time/tick-broadcast.c | 3 +- kernel/trace/ftrace.c | 4 +- kernel/trace/trace.c | 21 ++-- mm/hugetlb.c | 8 +- net/batman-adv/bat_iv_ogm.c | 6 +- net/bridge/br_netlink.c | 1 + net/core/rtnetlink.c | 2 +- net/ipv4/inet_fragment.c | 20 +++- net/ipv4/ip_fragment.c | 11 +- net/ipv4/ip_gre.c | 5 +- net/ipv4/ip_options.c | 5 +- net/ipv4/tcp.c | 2 +- net/ipv4/tcp_ipv4.c | 14 +-- net/ipv4/tcp_output.c | 1 - net/ipv6/netfilter/nf_conntrack_reasm.c | 12 +-- net/ipv6/reassembly.c | 8 +- net/ipv6/tcp_ipv6.c | 7 ++ net/sctp/associola.c | 2 +- net/sctp/sm_statefuns.c | 2 +- sound/pci/hda/hda_codec.c | 2 +- sound/pci/hda/patch_conexant.c | 8 +- sound/usb/mixer.c | 21 ++-- 109 files changed, 778 insertions(+), 683 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/98 USB: EHCI: work around silicon bug in Intels EHCI controllers
3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <[email protected]>
commit 6402c796d3b4205d3d7296157956c5100a05d7d6 upstream.
This patch (as1660) works around a hardware problem present in some (if not all) Intel EHCI controllers. After a QH has been unlinked from the async schedule and the corresponding IAA interrupt has occurred, the controller is not supposed access the QH and its qTDs. There certainly shouldn't be any more DMA writes to those structures. Nevertheless, Intel's controllers have been observed to perform a final writeback to the QH's overlay region and to the most recent qTD. For more information and a test program to determine whether this problem is present in a particular controller, see
http://marc.info/?l=linux-usb&m=135492071812265&w=2 http://marc.info/?l=linux-usb&m=136182570800963&w=2
This patch works around the problem by always waiting for two IAA cycles when unlinking an async QH. The extra IAA delay gives the controller time to perform its final writeback.
Surprisingly enough, the effects of this silicon bug have gone undetected until quite recently. More through luck than anything else, it hasn't caused any apparent problems. However, it does interact badly with the path that follows this one, so it needs to be addressed.
This is the first part of a fix for the regression reported at:
https://bugs.launchpad.net/bugs/1088733
--- drivers/usb/host/ehci-hcd.c | 6 ++---- drivers/usb/host/ehci-q.c | 18 ++++++++++++++---- 2 files changed, 16 insertions(+), 8 deletions(-)
drivers/usb/host/ehci-hcd.c +2 -4
@@ -748,11 +748,9 @@ static irqreturn_t ehci_irq (struct usb_/* guard against (alleged) silicon errata */ if (cmd &CMD_IAAD )ehci_dbg (ehci,"IAA with IAAD still set?\n" ); -if (ehci->async_iaa) { +if (ehci->async_iaa)COUNT (ehci->stats.iaa); -end_unlink_async (ehci); - }else -ehci_dbg (ehci,"IAA with nothing unlinked?\n" ); +end_unlink_async (ehci); }/* remote wakeup [4.3.1] */
drivers/usb/host/ehci-q.c +14 -4
@@ -1178,7 +1178,7 @@ static void single_unlink_async(struct estruct ehci_qh *prev;/* Add to the end of the list of QHs waiting for the next IAAD */ - qh->qh_state =QH_STATE_UNLINK ; + qh->qh_state =QH_STATE_UNLINK_WAIT ;if (ehci->async_unlink) ehci->async_unlink_last->unlink_next = qh;else
@@ -1221,9 +1221,19 @@ static void start_iaa_cycle(struct ehci_/* Do only the first waiting QH (nVidia bug?) */ qh = ehci->async_unlink; - ehci->async_iaa = qh; - ehci->async_unlink = qh->unlink_next; - qh->unlink_next =NULL ; + +/* +* Intel (?) bug: The HC can write back the overlay region +* even after the IAA interrupt occurs. In self-defense, +* always go through two IAA cycles for each QH. +*/ +if (qh->qh_state ==QH_STATE_UNLINK_WAIT ) { + qh->qh_state =QH_STATE_UNLINK ; + }else { + ehci->async_iaa = qh; + ehci->async_unlink = qh->unlink_next; + qh->unlink_next =NULL ; + }/* Make sure the unlinks are all visible to the hardware */ wmb ();
Greg Kroah-Hartman
maintainerPATCH 2/98 sunsu: Fix panic in case of nonexistent port at "console=ttySY" cmdline option
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tkhai Kirill <[email protected]>
[ Upstream commit cb29529ea0030e60ef1bbbf8399a43d397a51526 ]
If a machine has X (X < 4) sunsu ports and cmdline option "console=ttySY" is passed, where X < Y <= 4, than the following panic happens:
Unable to handle kernel NULL pointer dereference TPC: <sunsu_console_setup+0x78/0xe0> RPC: <sunsu_console_setup+0x74/0xe0> I7: <register_console+0x378/0x3e0> Call Trace: [0000000000453a38] register_console+0x378/0x3e0 [0000000000576fa0] uart_add_one_port+0x2e0/0x340 [000000000057af40] su_probe+0x160/0x2e0 [00000000005b8a4c] platform_drv_probe+0xc/0x20 [00000000005b6c2c] driver_probe_device+0x12c/0x220 [00000000005b6da8] __driver_attach+0x88/0xa0 [00000000005b4df4] bus_for_each_dev+0x54/0xa0 [00000000005b5a54] bus_add_driver+0x154/0x260 [00000000005b7190] driver_register+0x50/0x180 [00000000006d250c] sunsu_init+0x18c/0x1e0 [00000000006c2668] do_one_initcall+0xe8/0x160 [00000000006c282c] kernel_init_freeable+0x12c/0x1e0 [0000000000603764] kernel_init+0x4/0x100 [0000000000405f64] ret_from_syscall+0x1c/0x2c [0000000000000000] (null)
1)Fix the panic;
2)Increment registered port number every successful probe.
--- drivers/tty/serial/sunsu.c | 21 +++++++++------------ 1 file changed, 9 insertions(+), 12 deletions(-)
drivers/tty/serial/sunsu.c +9 -12
@@ -974,6 +974,7 @@ static struct uart_ops sunsu_pops = {#define UART_NR 4static struct uart_sunsu_port sunsu_ports[UART_NR ]; +static int nr_inst;/* Number of already registered ports */ #ifdef CONFIG_SERIO
@@ -1343,13 +1344,8 @@ static int __init sunsu_console_setup(stprintk ("Console: ttyS%d (SU)\n" , (sunsu_reg.minor -64 ) + co->index); -/* -* Check whether an invalid uart number has been specified, and -* if so, search for the first available port that does have -* console support. -*/ -if (co->index >=UART_NR ) - co->index =0 ; +if (co->index > nr_inst) +return -ENODEV ; port = &sunsu_ports[co->index].port;/*
@@ -1414,7 +1410,6 @@ static enum su_type su_get_type(struct dstatic int su_probe (struct platform_device *op) { -static int inst;struct device_node *dp = op->dev.of_node;struct uart_sunsu_port *up;struct resource *rp;
@@ -1424,16 +1419,16 @@ static int su_probe(struct platform_devi type =su_get_type (dp);if (type ==SU_PORT_PORT ) { -if (inst >=UART_NR ) +if (nr_inst >=UART_NR )return -EINVAL ; - up = &sunsu_ports[inst]; + up = &sunsu_ports[nr_inst]; }else { up =kzalloc (sizeof (*up),GFP_KERNEL );if (!up)return -ENOMEM ; } - up->port.line = inst; + up->port.line = nr_inst;spin_lock_init (&up->port.lock);
@@ -1467,6 +1462,8 @@ static int su_probe(struct platform_devi }dev_set_drvdata (&op->dev, up); + nr_inst++; +return 0 ; }
@@ -1494,7 +1491,7 @@ static int su_probe(struct platform_devidev_set_drvdata (&op->dev, up); - inst++; + nr_inst++;return 0 ;
Greg Kroah-Hartman
maintainerPATCH 3/98 net/ipv4: Ensure that location of timestamp option is stored
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Ward <[email protected]>
[ Upstream commit 4660c7f498c07c43173142ea95145e9dac5a6d14 ]
This is needed in order to detect if the timestamp option appears more than once in a packet, to remove the option if the packet is fragmented, etc. My previous change neglected to store the option location when the router addresses were prespecified and Pointer > Length. But now the option location is also stored when Flag is an unrecognized value, to ensure these option handling behaviors are still performed.
--- net/ipv4/ip_options.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
net/ipv4/ip_options.c +1 -4
@@ -370,7 +370,6 @@ int ip_options_compile(struct net *net, }switch (optptr[3 ]&0xF ) {case IPOPT_TS_TSONLY : - opt->ts = optptr - iph;if (skb) timeptr = &optptr[optptr[2 ]-1 ]; opt->ts_needtime =1 ;
@@ -381,7 +380,6 @@ int ip_options_compile(struct net *net, pp_ptr = optptr +2 ; goto error; } - opt->ts = optptr - iph;if (rt) {spec_dst_fill (&spec_dst, skb);memcpy (&optptr[optptr[2 ]-1 ], &spec_dst,4 );
@@ -396,7 +394,6 @@ int ip_options_compile(struct net *net, pp_ptr = optptr +2 ; goto error; } - opt->ts = optptr - iph; {__be32 addr;memcpy (&addr, &optptr[optptr[2 ]-1 ],4 );
@@ -429,12 +426,12 @@ int ip_options_compile(struct net *net, pp_ptr = optptr +3 ; goto error; } - opt->ts = optptr - iph;if (skb) { optptr[3 ] = (optptr[3 ]&0xF )|((overflow+1 )<<4 ); opt->is_changed =1 ; } } + opt->ts = optptr - iph;break ;case IPOPT_RA :if (optlen <4 ) {
Greg Kroah-Hartman
maintainerPATCH 4/98 bridge: reserve space for IFLA_BRPORT_FAST_LEAVE
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: stephen hemminger <[email protected]>
[ Upstream commit 3da889b616164bde76a37350cf28e0d17a94e979 ]
The bridge multicast fast leave feature was added sufficient space was not reserved in the netlink message. This means the flag may be lost in netlink events and results of queries.
Found by observation while looking up some netlink stuff for discussion with Vlad. Problem introduced by commit c2d3babfafbb9f6629cfb47139758e59a5eb0d80
Author: David S. Miller <[email protected]> Date: Wed Dec 5 16:24:45 2012 -0500
bridge: implement multicast fast leave
--- net/bridge/br_netlink.c | 1 + 1 file changed, 1 insertion(+)
net/bridge/br_netlink.c +1 -0
@@ -28,6 +28,7 @@ static inline size_t br_port_info_size(v +nla_total_size (1 )/* IFLA_BRPORT_MODE */ +nla_total_size (1 )/* IFLA_BRPORT_GUARD */ +nla_total_size (1 )/* IFLA_BRPORT_PROTECT */ + +nla_total_size (1 )/* IFLA_BRPORT_FAST_LEAVE */ +0 ; }
Greg Kroah-Hartman
maintainerPATCH 5/98 netconsole: dont call __netpoll_cleanup() while atomic
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Veaceslav Falico <[email protected]>
[ Upstream commit 3f315bef23075ea8a98a6fe4221a83b83456d970 ]
__netpoll_cleanup() is called in netconsole_netdev_event() while holding a spinlock. Release/acquire the spinlock before/after it and restart the loop. Also, disable the netconsole completely, because we won't have chance after the restart of the loop, and might end up in a situation where nt->enabled == 1 and nt->np.dev == NULL.
--- drivers/net/netconsole.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)
drivers/net/netconsole.c +9 -6
@@ -630,6 +630,7 @@ static int netconsole_netdev_event(struc goto done;spin_lock_irqsave (&target_list_lock, flags); +restart:list_for_each_entry (nt, &target_list, list) {netconsole_target_get (nt);if (nt->np.dev == dev) {
@@ -642,15 +643,17 @@ static int netconsole_netdev_event(struccase NETDEV_UNREGISTER :/* * rtnl_lock already held +* we might sleep in __netpoll_cleanup() */ -if (nt->np.dev) { -__netpoll_cleanup (&nt->np); -dev_put (nt->np.dev); - nt->np.dev =NULL ; - } +spin_unlock_irqrestore (&target_list_lock, flags); +__netpoll_cleanup (&nt->np); +spin_lock_irqsave (&target_list_lock, flags); +dev_put (nt->np.dev); + nt->np.dev =NULL ; nt->enabled =0 ; stopped = true; -break ; +netconsole_target_put (nt); + goto restart; } }netconsole_target_put (nt);
Greg Kroah-Hartman
maintainerPATCH 6/98 batman-adv: verify tt len does not exceed packet len
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Lindner <[email protected]>
[ Upstream commit b47506d91259c29b9c75c404737eb6525556f9b4 ]
batadv_iv_ogm_process() accesses the packet using the tt_num_changes attribute regardless of the real packet len (assuming the length check was done before). Therefore a length check is needed to avoid reading random memory.
--- net/batman-adv/bat_iv_ogm.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
net/batman-adv/bat_iv_ogm.c +3 -3
@@ -1298,7 +1298,8 @@ static int batadv_iv_ogm_receive(struct batadv_ogm_packet = (struct batadv_ogm_packet *)packet_buff;/* unpack the aggregated packets and process them one by one */ - do { +while (batadv_iv_ogm_aggr_packet (buff_pos, packet_len, + batadv_ogm_packet->tt_num_changes)) { tt_buff = packet_buff + buff_pos +BATADV_OGM_HLEN ; batadv_iv_ogm_process(ethhdr, batadv_ogm_packet, tt_buff,
@@ -1309,8 +1310,7 @@ static int batadv_iv_ogm_receive(struct packet_pos = packet_buff + buff_pos; batadv_ogm_packet = (struct batadv_ogm_packet *)packet_pos; - }while (batadv_iv_ogm_aggr_packet (buff_pos, packet_len, - batadv_ogm_packet->tt_num_changes)); + }kfree_skb (skb);return NET_RX_SUCCESS ;
Greg Kroah-Hartman
maintainerPATCH 7/98 bonding: dont call update_speed_duplex() under spinlocks
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Veaceslav Falico <[email protected]>
[ Upstream commit 876254ae2758d50dcb08c7bd00caf6a806571178 ]
bond_update_speed_duplex() might sleep while calling underlying slave's routines. Move it out of atomic context in bond_enslave() and remove it from bond_miimon_commit() - it was introduced by commit 546add79, however when the slave interfaces go up/change state it's their responsibility to fire NETDEV_UP/NETDEV_CHANGE events so that bonding can properly update their speed.
I've tested it on all combinations of ifup/ifdown, autoneg/speed/duplex changes, remote-controlled and local, on (not) MII-based cards. All changes are visible.
--- drivers/net/bonding/bond_main.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/net/bonding/bond_main.c +2 -4
@@ -1728,6 +1728,8 @@ int bond_enslave(struct net_device *bondbond_compute_features (bond); +bond_update_speed_duplex (new_slave); +read_lock (&bond->lock); new_slave->last_arp_rx = jiffies -
@@ -1780,8 +1782,6 @@ int bond_enslave(struct net_device *bond new_slave->link ==BOND_LINK_DOWN ?"DOWN" : (new_slave->link == BOND_LINK_UP ? "UP" : "BACK")); -bond_update_speed_duplex (new_slave); -if (USES_PRIMARY (bond->params.mode) && bond->params.primary[0 ]) {/* if there is a primary slave, remember it */ if (strcmp (bond->params.primary, new_slave->dev->name) ==0 ) {
@@ -2463,8 +2463,6 @@ static void bond_miimon_commit(struct bobond_set_backup_slave (slave); } -bond_update_speed_duplex (slave); -pr_info ("%s: link status definitely up for interface %s, %u Mbps %s duplex.\n" , bond->dev->name, slave->dev->name, slave->speed, slave->duplex ?"full" :"half" );
Greg Kroah-Hartman
maintainerPATCH 8/98 tg3: 5715 does not link up when autoneg off
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nithin Sujir <[email protected]>
[ Upstream commit 7c6cdead7cc9a99650d15497aae47d7472217eb1 ]
Commit d13ba512cbba7de5d55d7a3b2aae7d83c8921457 ("tg3: Remove SPEED_UNKNOWN checks") cleaned up the autoneg advertisement by removing some dead code. One effect of this change was that the advertisement register would not be updated if autoneg is turned off.
This exposed a bug on the 5715 device w.r.t linking. The 5715 defaults to advertise only 10Mb Full duplex. But with autoneg disabled, it needs the configured speed enabled in the advertisement register to link up.
This patch adds the work around to advertise all speeds on the 5715 when autoneg is disabled.
--- drivers/net/ethernet/broadcom/tg3.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/net/ethernet/broadcom/tg3.c +8 -0
@@ -4093,6 +4093,14 @@ static void tg3_phy_copper_begin(struct tp->link_config.active_speed = tp->link_config.speed; tp->link_config.active_duplex = tp->link_config.duplex; +if (GET_ASIC_REV (tp->pci_chip_rev_id) ==ASIC_REV_5714 ) { +/* With autoneg disabled, 5715 only links up when the +* advertisement register has the configured speed +* enabled. +*/ +tg3_writephy (tp,MII_ADVERTISE ,ADVERTISE_ALL ); + } + bmcr =0 ;switch (tp->link_config.speed) {default :
Greg Kroah-Hartman
maintainerPATCH 9/98 sctp: Use correct sideffect command in duplicate cookie handling
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vlad Yasevich <[email protected]>
[ Upstream commit f2815633504b442ca0b0605c16bf3d88a3a0fcea ]
When SCTP is done processing a duplicate cookie chunk, it tries to delete a newly created association. For that, it has to set the right association for the side-effect processing to work. However, when it uses the SCTP_CMD_NEW_ASOC command, that performs more work then really needed (like hashing the associationa and assigning it an id) and there is no point to do that only to delete the association as a next step. In fact, it also creates an impossible condition where an association may be found by the getsockopt() call, and that association is empty. This causes a crash in some sctp getsockopts.
The solution is rather simple. We simply use SCTP_CMD_SET_ASOC command that doesn't have all the overhead and does exactly what we need.
--- net/sctp/sm_statefuns.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/sctp/sm_statefuns.c +1 -1
@@ -2082,7 +2082,7 @@ sctp_disposition_t sctp_sf_do_5_2_4_dupc }/* Delete the tempory new association. */ -sctp_add_cmd_sf (commands,SCTP_CMD_NEW_ASOC ,SCTP_ASOC (new_asoc)); +sctp_add_cmd_sf (commands,SCTP_CMD_SET_ASOC ,SCTP_ASOC (new_asoc));sctp_add_cmd_sf (commands,SCTP_CMD_DELETE_TCB ,SCTP_NULL ());/* Restore association pointer to provide SCTP command interpeter
Greg Kroah-Hartman
maintainerPATCH 10/98 sctp: dont break the loop while meeting the active_path so as to find the matched transport
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xufeng Zhang <[email protected]>
[ Upstream commit 2317f449af30073cfa6ec8352e4a65a89e357bdd ]
sctp_assoc_lookup_tsn() function searchs which transport a certain TSN was sent on, if not found in the active_path transport, then go search all the other transports in the peer's transport_addr_list, however, we should continue to the next entry rather than break the loop when meet the active_path transport.
--- net/sctp/associola.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/sctp/associola.c +1 -1
@@ -1080,7 +1080,7 @@ struct sctp_transport *sctp_assoc_lookup transports) {if (transport == active) -break ; +continue ;list_for_each_entry (chunk, &transport->transmitted, transmitted_list) {if (key == chunk->subh.data_hdr->tsn) {
Greg Kroah-Hartman
maintainerPATCH 11/98 ipv4: fix definition of FIB_TABLE_HASHSZ
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Denis V. Lunev" <[email protected]>
[ Upstream commit 5b9e12dbf92b441b37136ea71dac59f05f2673a9 ]
a long time ago by the commit
commit 93456b6d7753def8760b423ac6b986eb9d5a4a95
Author: Denis V. Lunev <[email protected]>
Date: Thu Jan 10 03:23:38 2008 -0800
[IPV4]: Unify access to the routing tables.
the defenition of FIB_HASH_TABLE size has obtained wrong dependency:
it should depend upon CONFIG_IP_MULTIPLE_TABLES (as was in the original code) but it was depended from CONFIG_IP_ROUTE_MULTIPATH
This patch returns the situation to the original state.
The problem was spotted by Tingwei Liu.
--- include/net/ip_fib.h | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-)
include/net/ip_fib.h +5 -7
@@ -152,18 +152,16 @@ struct fib_result_nl { };#ifdef CONFIG_IP_ROUTE_MULTIPATH -#define FIB_RES_NH (res) ((res).fi->fib_nh[(res).nh_sel]) - -#define FIB_TABLE_HASHSZ 2 -#else /* CONFIG_IP_ROUTE_MULTIPATH */ -#define FIB_RES_NH (res) ((res).fi->fib_nh[0]) +#endif /* CONFIG_IP_ROUTE_MULTIPATH */ +#ifdef CONFIG_IP_MULTIPLE_TABLES #define FIB_TABLE_HASHSZ 256 - -#endif /* CONFIG_IP_ROUTE_MULTIPATH */ +#else +#define FIB_TABLE_HASHSZ 2 +#endif extern __be32 fib_info_update_nh_saddr (struct net *net,struct fib_nh *nh);
Greg Kroah-Hartman
maintainerPATCH 12/98 net: qmi_wwan: set correct altsetting for Gobi 1K devices
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bjørn Mork <[email protected]>
[ Upstream commit b701f16dd490d3f346724050f17d60beda094998 ]
commit bd877e4 ("net: qmi_wwan: use a single bind function for all device types") made Gobi 1K devices fail probing.
Using the number of endpoints in the default altsetting to decide whether the function use one or two interfaces is wrong. Other altsettings may provide more endpoints.
With Gobi 1K devices, USB interface #3's altsetting is 0 by default, but altsetting 0 only provides one interrupt endpoint and is not sufficent for QMI. Altsetting 1 provides all 3 endpoints required for qmi_wwan and works with QMI. Gobi 1K layout for intf#3 is:
Interface Descriptor: 255/255/255
bInterfaceNumber 3
bAlternateSetting 0
Endpoint Descriptor: Interrupt IN
Interface Descriptor: 255/255/255
bInterfaceNumber 3
bAlternateSetting 1
Endpoint Descriptor: Interrupt IN
Endpoint Descriptor: Bulk IN
Endpoint Descriptor: Bulk OUT
Prior to commit bd877e4, we would call usbnet_get_endpoints before giving up finding enough endpoints. Removing the early endpoint number test and the strict functional descriptor requirement allow qmi_wwan_bind to continue until usbnet_get_endpoints has made the final attempt to collect endpoints. This restores the behaviour from before commit bd877e4 without losing the added benefit of using a single bind function.
The driver has always required a CDC Union functional descriptor for two-interface functions. Using the existence of this descriptor to detect two-interface functions is the logically correct method.
--- drivers/net/usb/qmi_wwan.c | 49 ++++++++++++++------------------------------- 1 file changed, 16 insertions(+), 33 deletions(-)
drivers/net/usb/qmi_wwan.c +16 -33
@@ -139,16 +139,9 @@ static int qmi_wwan_bind(struct usbnet *BUILD_BUG_ON ((sizeof (((struct usbnet *)0 )->data) <sizeof (struct qmi_wwan_state ))); -/* control and data is shared? */ -if (intf->cur_altsetting->desc.bNumEndpoints ==3 ) { - info->control = intf; - info->data = intf; - goto shared; - } - -/* else require a single interrupt status endpoint on control intf */ -if (intf->cur_altsetting->desc.bNumEndpoints !=1 ) - goto err; +/* set up initial state */ + info->control = intf; + info->data = intf;/* and a number of CDC descriptors */ while (len >3 ) {
@@ -207,25 +200,14 @@ next_desc: buf += h->bLength; } -/* did we find all the required ones? */ -if (!(found & (1 <<USB_CDC_HEADER_TYPE )) || - !(found & (1 <<USB_CDC_UNION_TYPE ))) { -dev_err (&intf->dev,"CDC functional descriptors missing\n" ); - goto err; - } - -/* verify CDC Union */ -if (desc->bInterfaceNumber != cdc_union->bMasterInterface0) { -dev_err (&intf->dev,"bogus CDC Union: master=%u\n" , cdc_union->bMasterInterface0); - goto err; - } - -/* need to save these for unbind */ - info->control = intf; - info->data =usb_ifnum_to_if (dev->udev, cdc_union->bSlaveInterface0); -if (!info->data) { -dev_err (&intf->dev,"bogus CDC Union: slave=%u\n" , cdc_union->bSlaveInterface0); - goto err; +/* Use separate control and data interfaces if we found a CDC Union */ +if (cdc_union) { + info->data =usb_ifnum_to_if (dev->udev, cdc_union->bSlaveInterface0); +if (desc->bInterfaceNumber != cdc_union->bMasterInterface0 || !info->data) { +dev_err (&intf->dev,"bogus CDC Union: master=%u, slave=%u\n" , + cdc_union->bMasterInterface0, cdc_union->bSlaveInterface0); + goto err; + } }/* errors aren't fatal - we can live with the dynamic address */
@@ -235,11 +217,12 @@ next_desc: }/* claim data interface and set it up */ - status =usb_driver_claim_interface (driver, info->data, dev); -if (status <0 ) - goto err; +if (info->control != info->data) { + status =usb_driver_claim_interface (driver, info->data, dev); +if (status <0 ) + goto err; + } -shared: status =qmi_wwan_register_subdriver (dev);if (status <0 && info->control != info->data) {usb_set_intfdata (info->data,NULL );
Greg Kroah-Hartman
maintainerPATCH 13/98 tcp: fix skb_availroom()
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 16fad69cfe4adbbfa813de516757b87bcae36d93 ]
Chrome OS team reported a crash on a Pixel ChromeBook in TCP stack :
https://code.google.com/p/chromium/issues/detail?id=182056
commit a21d45726acac (tcp: avoid order-1 allocations on wifi and tx path) did a poor choice adding an 'avail_size' field to skb, while what we really needed was a 'reserved_tailroom' one.
It would have avoided commit 22b4a4f22da (tcp: fix retransmit of partially acked frames) and this commit.
Crash occurs because skb_split() is not aware of the 'avail_size' management (and should not be aware)
--- include/linux/skbuff.h | 7 +++++-- net/ipv4/tcp.c | 2 +- net/ipv4/tcp_output.c | 1 - 3 files changed, 6 insertions(+), 4 deletions(-)
include/linux/skbuff.h +5 -2
@@ -491,7 +491,7 @@ struct sk_buff {union {__u32 mark;__u32 dropcount; -__u32 avail_size; +__u32 reserved_tailroom; };sk_buff_data_t inner_transport_header;
@@ -1428,7 +1428,10 @@ static inline int skb_tailroom(const str*/ static inline int skb_availroom (const struct sk_buff *skb) { -return skb_is_nonlinear (skb) ?0 : skb->avail_size - skb->len; +if (skb_is_nonlinear (skb)) +return 0 ; + +return skb->end - skb->tail - skb->reserved_tailroom; }/**
net/ipv4/tcp.c +1 -1
@@ -773,7 +773,7 @@ struct sk_buff *sk_stream_alloc_skb(stru* Make sure that we have exactly size bytes * available to the caller, no more, no less. */ - skb->avail_size = size; + skb->reserved_tailroom = skb->end - skb->tail - size;return skb; }__kfree_skb (skb);
net/ipv4/tcp_output.c +0 -1
@@ -1298,7 +1298,6 @@ static void __pskb_trim_head(struct sk_b eat =min_t (int, len,skb_headlen (skb));if (eat) {__skb_pull (skb, eat); - skb->avail_size -= eat; len -= eat;if (!len)return ;
Greg Kroah-Hartman
maintainerPATCH 14/98 skb: Propagate pfmemalloc on skb from head page only
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Emelyanov <[email protected]>
[ Upstream commit cca7af3889bfa343d33d5e657a38d876abd10e58 ]
Hi.
I'm trying to send big chunks of memory from application address space via TCP socket using vmsplice + splice like this
mem = mmap(128Mb);
vmsplice(pipe[1], mem); /* splice memory into pipe */ splice(pipe[0], tcp_socket); /* send it into network */
When I'm lucky and a huge page splices into the pipe and then into the socket _and_ client and server ends of the TCP connection are on the same host, communicating via lo, the whole connection gets stuck! The sending queue becomes full and app stops writing/splicing more into it, but the receiving queue remains empty, and that's why.
The __skb_fill_page_desc observes a tail page of a huge page and erroneously propagates its page->pfmemalloc value onto socket (the pfmemalloc on tail pages contain garbage). Then this skb->pfmemalloc leaks through lo and due to the
tcp_v4_rcv
sk_filter
if (skb->pfmemalloc && !sock_flag(sk, SOCK_MEMALLOC)) /* true */
return -ENOMEM
goto release_and_discard;no packets reach the socket. Even TCP re-transmits are dropped by this, as skb cloning clones the pfmemalloc flag as well.
That said, here's the proper page->pfmemalloc propagation onto socket: we must check the huge-page's head page only, other pages' pfmemalloc and mapping values do not contain what is expected in this place. However, I'm not sure whether this fix is _complete_, since pfmemalloc propagation via lo also oesn't look great.
Both, bit propagation from page to skb and this check in sk_filter, were introduced by c48a11c7 (netvm: propagate page->pfmemalloc to skb), in v3.5 so Mel and stable@ are in Cc.
--- include/linux/skbuff.h | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
include/linux/skbuff.h +4 -2
@@ -1269,11 +1269,13 @@ static inline void __skb_fill_page_desc(* do not lose pfmemalloc information as the pages would not be * allocated using __GFP_MEMALLOC. */ -if (page->pfmemalloc && !page->mapping) - skb->pfmemalloc = true; frag->page.p = page; frag->page_offset = off;skb_frag_size_set (frag, size); + + page =compound_head (page); +if (page->pfmemalloc && !page->mapping) + skb->pfmemalloc = true; }/**
Greg Kroah-Hartman
maintainerPATCH 15/98 Revert "ip_gre: make ipgre_tunnel_xmit() not parse network header as IP unconditionally"
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timo Teräs <[email protected]>
[ Upstream commit 8c6216d7f118a128678270824b6a1286a63863ca ]
This reverts commit 412ed94744d16806fbec3bd250fd94e71cde5a1f.
The commit is wrong as tiph points to the outer IPv4 header which is installed at ipgre_header() and not the inner one which is protocol dependant.
This commit broke succesfully opennhrp which use PF_PACKET socket with ETH_P_NHRP protocol. Additionally ssl_addr is set to the link-layer IPv4 address. This address is written by ipgre_header() to the skb earlier, and this is the IPv4 header tiph should point to - regardless of the inner protocol payload.
--- net/ipv4/ip_gre.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
net/ipv4/ip_gre.c +1 -4
@@ -761,10 +761,7 @@ static netdev_tx_t ipgre_tunnel_xmit(strif (dev->header_ops && dev->type ==ARPHRD_IPGRE ) { gre_hlen =0 ; -if (skb->protocol ==htons (ETH_P_IP )) - tiph = (const struct iphdr *)skb->data; -else - tiph = &tunnel->parms.iph; + tiph = (const struct iphdr *)skb->data; }else { gre_hlen = tunnel->hlen; tiph = &tunnel->parms.iph;
Greg Kroah-Hartman
maintainerPATCH 16/98 rtnetlink: Mask the rta_type when range checking
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vlad Yasevich <[email protected]>
[ Upstream commit a5b8db91442fce9c9713fcd656c3698f1adde1d6 ]
Range/validity checks on rta_type in rtnetlink_rcv_msg() do not account for flags that may be set. This causes the function to return -EINVAL when flags are set on the type (for example NLA_F_NESTED).
--- net/core/rtnetlink.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/core/rtnetlink.c +1 -1
@@ -2539,7 +2539,7 @@ static int rtnetlink_rcv_msg(struct sk_bstruct rtattr *attr = (void *)nlh +NLMSG_ALIGN (min_len);while (RTA_OK (attr, attrlen)) { -unsigned int flavor = attr->rta_type; +unsigned int flavor = attr->rta_type &NLA_TYPE_MASK ;if (flavor) {if (flavor > rta_max[sz_idx])return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 17/98 net: cdc_ncm, cdc_mbim: allow user to prefer NCM for backwards compatibility
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bjørn Mork <[email protected]>
[ Upstream commit 1e8bbe6cd02fc300c88bd48244ce61ad9c7d1776 ]
commit bd329e1 ("net: cdc_ncm: do not bind to NCM compatible MBIM devices") introduced a new policy, preferring MBIM for dual NCM/MBIM functions if the cdc_mbim driver was enabled. This caused a regression for users wanting to use NCM.
Devices implementing NCM backwards compatibility according to section 3.2 of the MBIM v1.0 specification allow either NCM or MBIM on a single USB function, using different altsettings. The cdc_ncm and cdc_mbim drivers will both probe such functions, and must agree on a common policy for selecting either MBIM or NCM. Until now, this policy has been set at build time based on CONFIG_USB_NET_CDC_MBIM.
Use a module parameter to set the system policy at runtime, allowing the user to prefer NCM on systems with the cdc_mbim driver.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=54791
--- drivers/net/usb/cdc_mbim.c | 11 --------- drivers/net/usb/cdc_ncm.c | 49 ++++++++++++++++++++++++++++---------------- include/linux/usb/cdc_ncm.h | 1 3 files changed, 34 insertions(+), 27 deletions(-)
drivers/net/usb/cdc_mbim.c +1 -10
@@ -68,18 +68,9 @@ static int cdc_mbim_bind(struct usbnet *struct cdc_ncm_ctx *ctx;struct usb_driver *subdriver =ERR_PTR (-ENODEV );int ret = -ENODEV ; -u8 data_altsetting =CDC_NCM_DATA_ALTSETTING_NCM ; +u8 data_altsetting =cdc_ncm_select_altsetting (dev, intf);struct cdc_mbim_state *info = (void *)&dev->data; -/* see if interface supports MBIM alternate setting */ -if (intf->num_altsetting ==2 ) { -if (!cdc_ncm_comm_intf_is_mbim (intf->cur_altsetting)) -usb_set_interface (dev->udev, - intf->cur_altsetting->desc.bInterfaceNumber, -CDC_NCM_COMM_ALTSETTING_MBIM ); - data_altsetting =CDC_NCM_DATA_ALTSETTING_MBIM ; - } -/* Probably NCM, defer for cdc_ncm_bind */ if (!cdc_ncm_comm_intf_is_mbim (intf->cur_altsetting)) goto err;
drivers/net/usb/cdc_ncm.c +32 -17
70 lines not on this page · raw message
include/linux/usb/cdc_ncm.h +1 -0
@@ -127,6 +127,7 @@ struct cdc_ncm_ctx {u16 connected; }; +extern u8 cdc_ncm_select_altsetting (struct usbnet *dev,struct usb_interface *intf);extern int cdc_ncm_bind_common (struct usbnet *dev,struct usb_interface *intf,u8 data_altsetting);extern void cdc_ncm_unbind (struct usbnet *dev,struct usb_interface *intf);extern struct sk_buff *cdc_ncm_fill_tx_frame (struct cdc_ncm_ctx *ctx,struct sk_buff *skb,__le32 sign);
Greg Kroah-Hartman
maintainerPATCH 18/98 bnx2x: add missing napi deletion in error path
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Schmidt <[email protected]>
[ Upstream commit 722c6f585088a2c392b4c5d01b87a584bb8fb73f ]
If the hardware initialization fails in bnx2x_nic_load() after adding napi objects, they would not be deleted. A subsequent attempt to unload the bnx2x module detects a corruption in the napi list.
Add the missing napi deletion to the error path.
--- drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +1 -0
@@ -2523,6 +2523,7 @@ load_error2: bp->port.pmf =0 ; load_error1:bnx2x_napi_disable (bp); +bnx2x_del_all_napi (bp);/* clear pf_load status, as it was already set */ bnx2x_clear_pf_load (bp); load_error0:
Greg Kroah-Hartman
maintainerPATCH 19/98 vhost/net: fix heads usage of ubuf_info
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Michael S. Tsirkin" <[email protected]>
[ Upstream commit 46aa92d1ba162b4b3d6b7102440e459d4e4ee255 ]
ubuf info allocator uses guest controlled head as an index, so a malicious guest could put the same head entry in the ring twice, and we will get two callbacks on the same value.
To fix use upend_idx which is guaranteed to be unique.
--- drivers/vhost/net.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/vhost/net.c +2 -1
@@ -339,7 +339,8 @@ static void handle_tx(struct vhost_net * msg.msg_controllen =0 ; ubufs =NULL ; }else { -struct ubuf_info *ubuf = &vq->ubuf_info[head]; +struct ubuf_info *ubuf; + ubuf = vq->ubuf_info + vq->upend_idx; vq->heads[vq->upend_idx].len =VHOST_DMA_IN_PROGRESS ;
Greg Kroah-Hartman
maintainerPATCH 20/98 bnx2x: fix occasional statistics off-by-4GB error
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej Żenczykowski <[email protected]>
[ Upstream commit b009aac12cd0fe34293c68af8ac48b85be3bd858 ]
The UPDATE_QSTAT function introduced on February 15, 2012 in commit 1355b704b9ba "bnx2x: consistent statistics after internal driver reload" incorrectly fails to handle overflow during addition of the lower 32-bit field of a stat.
This bug is present since 3.4-rc1 and should thus be considered a candidate for stable 3.4+ releases.
Google-Bug-Id: 8374428
--- drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.h +2 -1
@@ -456,8 +456,9 @@ struct bnx2x_fw_port_stats_old {#define UPDATE_QSTAT (s, t) \ do { \ - qstats->t##_hi = qstats_old->t##_hi + le32_to_cpu(s.hi); \ qstats->t##_lo = qstats_old->t##_lo + le32_to_cpu(s.lo); \ + qstats->t##_hi = qstats_old->t##_hi + le32_to_cpu(s.hi) \ + + ((qstats->t##_lo < qstats_old->t##_lo) ? 1 : 0); \ } while (0)#define UPDATE_QSTAT_OLD (f) \
Greg Kroah-Hartman
maintainerPATCH 21/98 tcp: dont handle MTU reduction on LISTEN socket
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 0d4f0608619de59fd8169dd8e72aadc28d80e715 ]
When an ICMP ICMP_FRAG_NEEDED (or ICMPV6_PKT_TOOBIG) message finds a LISTEN socket, and this socket is currently owned by the user, we set TCP_MTU_REDUCED_DEFERRED flag in listener tsq_flags.
This is bad because if we clone the parent before it had a chance to clear the flag, the child inherits the tsq_flags value, and next tcp_release_cb() on the child will decrement sk_refcnt.
Result is that we might free a live TCP socket, as reported by Dormando.
IPv4: Attempt to release TCP socket in state 1
Fix this issue by testing sk_state against TCP_LISTEN early, so that we set TCP_MTU_REDUCED_DEFERRED on appropriate sockets (not a LISTEN one)
This bug was introduced in commit 563d34d05786
(tcp: dont drop MTU reduction indications)
--- net/ipv4/tcp_ipv4.c | 14 +++++++------- net/ipv6/tcp_ipv6.c | 7 +++++++ 2 files changed, 14 insertions(+), 7 deletions(-)
net/ipv4/tcp_ipv4.c +7 -7
@@ -274,13 +274,6 @@ static void tcp_v4_mtu_reduced(struct sostruct inet_sock *inet =inet_sk (sk);u32 mtu =tcp_sk (sk)->mtu_info; -/* We are not interested in TCP_LISTEN and open_requests (SYN-ACKs -* send out by Linux are always <576bytes so they should go through -* unfragmented). -*/ -if (sk->sk_state ==TCP_LISTEN ) -return ; - dst =inet_csk_update_pmtu (sk, mtu);if (!dst)return ;
@@ -408,6 +401,13 @@ void tcp_v4_err(struct sk_buff *icmp_skb goto out;if (code ==ICMP_FRAG_NEEDED ) {/* PMTU discovery (RFC1191) */ +/* We are not interested in TCP_LISTEN and open_requests +* (SYN-ACKs send out by Linux are always <576bytes so +* they should go through unfragmented). +*/ +if (sk->sk_state ==TCP_LISTEN ) + goto out; + tp->mtu_info = info;if (!sock_owned_by_user (sk)) {tcp_v4_mtu_reduced (sk);
net/ipv6/tcp_ipv6.c +7 -0
@@ -389,6 +389,13 @@ static void tcp_v6_err(struct sk_buff *s }if (type ==ICMPV6_PKT_TOOBIG ) { +/* We are not interested in TCP_LISTEN and open_requests +* (SYN-ACKs send out by Linux are always <576bytes so +* they should go through unfragmented). +*/ +if (sk->sk_state ==TCP_LISTEN ) + goto out; + tp->mtu_info =ntohl (info);if (!sock_owned_by_user (sk))tcp_v6_mtu_reduced (sk);
Greg Kroah-Hartman
maintainerPATCH 22/98 inet: limit length of fragment queue hash table bucket lists
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hannes Frederic Sowa <[email protected]>
[ Upstream commit 5a3da1fe9561828d0ca7eca664b16ec2b9bf0055 ]
This patch introduces a constant limit of the fragment queue hash table bucket list lengths. Currently the limit 128 is choosen somewhat arbitrary and just ensures that we can fill up the fragment cache with empty packets up to the default ip_frag_high_thresh limits. It should just protect from list iteration eating considerable amounts of cpu.
If we reach the maximum length in one hash bucket a warning is printed. This is implemented on the caller side of inet_frag_find to distinguish between the different users of inet_fragment.c.
I dropped the out of memory warning in the ipv4 fragment lookup path, because we already get a warning by the slab allocator.
--- include/net/inet_frag.h | 9 +++++++++ net/ipv4/inet_fragment.c | 20 +++++++++++++++++++- net/ipv4/ip_fragment.c | 11 ++++------- net/ipv6/netfilter/nf_conntrack_reasm.c | 12 ++++++------ net/ipv6/reassembly.c | 8 ++++++-- 5 files changed, 44 insertions(+), 16 deletions(-)
include/net/inet_frag.h +9 -0
@@ -35,6 +35,13 @@ struct inet_frag_queue {#define INETFRAGS_HASHSZ 64 +/* averaged: +* max_depth = default ipfrag_high_thresh / INETFRAGS_HASHSZ / +* rounded up (SKB_TRUELEN(0) + sizeof(struct ipq or +* struct frag_queue)) +*/ +#define INETFRAGS_MAXDEPTH 128 +struct inet_frags {struct hlist_head hash[INETFRAGS_HASHSZ ];rwlock_t lock;
@@ -65,6 +72,8 @@ int inet_frag_evictor(struct netns_fragsstruct inet_frag_queue *inet_frag_find (struct netns_frags *nf,struct inet_frags *f,void *key,unsigned int hash) __releases(&f->lock); +void inet_frag_maybe_warn_overflow (struct inet_frag_queue *q, +const char *prefix);static inline void inet_frag_put (struct inet_frag_queue *q,struct inet_frags *f) {
net/ipv4/inet_fragment.c +19 -1
@@ -21,6 +21,7 @@#include <linux/rtnetlink.h> #include <linux/slab.h> +#include <net/sock.h> #include <net/inet_frag.h> static void inet_frag_secret_rebuild (unsigned long dummy)
@@ -276,6 +277,7 @@ struct inet_frag_queue *inet_frag_find(s {struct inet_frag_queue *q;struct hlist_node *n; +int depth =0 ;hlist_for_each_entry (q, n, &f->hash[hash], list) {if (q->net == nf && f->match (q, key)) {
@@ -283,9 +285,25 @@ struct inet_frag_queue *inet_frag_find(sread_unlock (&f->lock);return q; } + depth++; }read_unlock (&f->lock); -return inet_frag_create (nf, f, key); +if (depth <=INETFRAGS_MAXDEPTH ) +return inet_frag_create (nf, f, key); +else +return ERR_PTR (-ENOBUFS ); }EXPORT_SYMBOL (inet_frag_find); + +void inet_frag_maybe_warn_overflow (struct inet_frag_queue *q, +const char *prefix) +{ +static const char msg[] ="inet_frag_find: Fragment hash bucket" + " list length grew over limit " __stringify(INETFRAGS_MAXDEPTH) +". Dropping fragment.\n" ; + +if (PTR_ERR (q) == -ENOBUFS ) +LIMIT_NETDEBUG (KERN_WARNING "%s%s" , prefix, msg); +} +EXPORT_SYMBOL (inet_frag_maybe_warn_overflow);
net/ipv4/ip_fragment.c +4 -7
@@ -299,14 +299,11 @@ static inline struct ipq *ip_find(struct hash =ipqhashfn (iph->id, iph->saddr, iph->daddr, iph->protocol); q =inet_frag_find (&net->ipv4.frags, &ip4_frags, &arg, hash); -if (q ==NULL ) - goto out_nomem; - +if (IS_ERR_OR_NULL (q)) { +inet_frag_maybe_warn_overflow (q,pr_fmt ()); +return NULL ; + } return container_of(q, struct ipq, q); - -out_nomem: - LIMIT_NETDEBUG(KERN_ERR pr_fmt("ip_frag_create: no memory left !\n")); -return NULL ; }/* Is the fragment too far ahead to be part of ipq? */
net/ipv6/netfilter/nf_conntrack_reasm.c +6 -6
@@ -14,6 +14,8 @@* 2 of the License, or (at your option) any later version. */ +#define pr_fmt (fmt) "IPv6-nf: " fmt +#include <linux/errno.h> #include <linux/types.h> #include <linux/string.h>
@@ -180,13 +182,11 @@ static inline struct frag_queue *fq_find q =inet_frag_find (&net->nf_frag.frags, &nf_frags, &arg, hash);local_bh_enable (); -if (q ==NULL ) - goto oom; - +if (IS_ERR_OR_NULL (q)) { +inet_frag_maybe_warn_overflow (q,pr_fmt ()); +return NULL ; + } return container_of(q, struct frag_queue, q); - -oom: -return NULL ; }
net/ipv6/reassembly.c +6 -2
@@ -26,6 +26,9 @@* YOSHIFUJI,H. @USAGI Always remove fragment header to * calculate ICV correctly. */ + +#define pr_fmt (fmt) "IPv6: " fmt +#include <linux/errno.h> #include <linux/types.h> #include <linux/string.h>
@@ -197,9 +200,10 @@ fq_find(struct net *net, __be32 id, cons hash =inet6_hash_frag (id, src, dst, ip6_frags.rnd); q =inet_frag_find (&net->ipv6.frags, &ip6_frags, &arg, hash); -if (q ==NULL ) +if (IS_ERR_OR_NULL (q)) { +inet_frag_maybe_warn_overflow (q,pr_fmt ());return NULL ; - + } return container_of(q, struct frag_queue, q); }
Greg Kroah-Hartman
maintainerPATCH 23/98 drivers/net/ethernet/sfc/ptp.c: adjust duplicate test
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julia Lawall <[email protected]>
[ Upstream commit 56567c6f8751c633581ca7c8e1cf08eed503f5ea ]
Delete successive tests to the same location. rc was previously tested and not subsequently updated. efx_phc_adjtime can return an error code, so the call is updated so that is tested instead.
A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)
// <smpl>
@s exists@
local idexpression y;
expression x,e;
@@
*if ( \(x == NULL\|IS_ERR(x)\|y != 0\) )
{ ... when forall
return ...; }
... when != \(y = e\|y += e\|y -= e\|y |= e\|y &= e\|y++\|y--\|&y\)
when != \(XT_GETPAGE(...,y)\|WMI_CMD_BUF(...)\)
*if ( \(x == NULL\|IS_ERR(x)\|y != 0\) )
{ ... when forall
return ...; }
// </smpl>
--- drivers/net/ethernet/sfc/ptp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/sfc/ptp.c +1 -1
@@ -1439,7 +1439,7 @@ static int efx_phc_settime(struct ptp_cl delta =timespec_sub (*e_ts, time_now); -efx_phc_adjtime (ptp,timespec_to_ns (&delta)); + rc =efx_phc_adjtime (ptp,timespec_to_ns (&delta));if (rc !=0 )return rc;
Greg Kroah-Hartman
maintainerPATCH 24/98 sfc: Properly sync RX DMA buffer when it is not the last in the page
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <[email protected]>
[ Upstream commit 3a68f19d7afb80f548d016effbc6ed52643a8085 ]
We may currently allocate two RX DMA buffers to a page, and only unmap the page when the second is completed. We do not sync the first RX buffer to be completed; this can result in packet loss or corruption if the last RX buffer completed in a NAPI poll is the first in a page and is not DMA-coherent. (In the middle of a NAPI poll, we will handle the following RX completion and unmap the page *before* looking at the content of the first buffer.)
--- drivers/net/ethernet/sfc/rx.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-)
drivers/net/ethernet/sfc/rx.c +10 -5
@@ -236,7 +236,8 @@ static int efx_init_rx_buffers_page(stru }static void efx_unmap_rx_buffer (struct efx_nic *efx, -struct efx_rx_buffer *rx_buf) +struct efx_rx_buffer *rx_buf, +unsigned int used_len) {if ((rx_buf->flags &EFX_RX_BUF_PAGE ) && rx_buf->u.page) {struct efx_rx_page_state *state;
@@ -247,6 +248,10 @@ static void efx_unmap_rx_buffer(struct e state->dma_addr,efx_rx_buf_size (efx), DMA_FROM_DEVICE); + }else if (used_len) { +dma_sync_single_for_cpu (&efx->pci_dev->dev, + rx_buf->dma_addr, used_len, +DMA_FROM_DEVICE ); } }else if (!(rx_buf->flags &EFX_RX_BUF_PAGE ) && rx_buf->u.skb) { dma_unmap_single(&efx->pci_dev->dev, rx_buf->dma_addr,
@@ -269,7 +274,7 @@ static void efx_free_rx_buffer(struct efstatic void efx_fini_rx_buffer (struct efx_rx_queue *rx_queue,struct efx_rx_buffer *rx_buf) { -efx_unmap_rx_buffer (rx_queue->efx, rx_buf); +efx_unmap_rx_buffer (rx_queue->efx, rx_buf,0 );efx_free_rx_buffer (rx_queue->efx, rx_buf); }
@@ -535,10 +540,10 @@ void efx_rx_packet(struct efx_rx_queue * goto out; } -/* Release card resources - assumes all RX buffers consumed in-order -* per RX queue +/* Release and/or sync DMA mapping - assumes all RX buffers +* consumed in-order per RX queue */ -efx_unmap_rx_buffer (efx, rx_buf); +efx_unmap_rx_buffer (efx, rx_buf, len);/* Prefetch nice and early so data will (hopefully) be in cache by * the time we look at it.
Greg Kroah-Hartman
maintainerPATCH 25/98 sfc: Fix efx_rx_buf_offset() in the presence of swiotlb
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <[email protected]>
[ Upstream commits b590ace09d51cd39744e0f7662c5e4a0d1b5d952 and
c73e787a8db9117d59b5180baf83203a42ecadca ]
We assume that the mapping between DMA and virtual addresses is done on whole pages, so we can find the page offset of an RX buffer using the lower bits of the DMA address. However, swiotlb maps in units of 2K, breaking this assumption.
Add an explicit page_offset field to struct efx_rx_buffer.
--- drivers/net/ethernet/sfc/net_driver.h | 4 +++- drivers/net/ethernet/sfc/rx.c | 10 +++++----- 2 files changed, 8 insertions(+), 6 deletions(-)
drivers/net/ethernet/sfc/net_driver.h +3 -1
@@ -210,6 +210,7 @@ struct efx_tx_queue {* Will be %NULL if the buffer slot is currently free. * @page: The associated page buffer. Valif iff @flags & %EFX_RX_BUF_PAGE. * Will be %NULL if the buffer slot is currently free. +* @page_offset: Offset within page. Valid iff @flags & %EFX_RX_BUF_PAGE. * @len: Buffer length, in bytes. * @flags: Flags for buffer and packet state. */
@@ -219,7 +220,8 @@ struct efx_rx_buffer {struct sk_buff *skb;struct page *page; } u; -unsigned int len; +u16 page_offset; +u16 len;u16 flags; };#define EFX_RX_BUF_PAGE 0x0001
drivers/net/ethernet/sfc/rx.c +5 -5
@@ -90,11 +90,7 @@ static unsigned int rx_refill_threshold;static inline unsigned int efx_rx_buf_offset (struct efx_nic *efx,struct efx_rx_buffer *buf) { -/* Offset is always within one page, so we don't need to consider -* the page order. -*/ -return ((unsigned int ) buf->dma_addr & (PAGE_SIZE -1 )) + - efx->type->rx_buffer_hash_size; +return buf->page_offset + efx->type->rx_buffer_hash_size; }static inline unsigned int efx_rx_buf_size (struct efx_nic *efx) {
@@ -187,6 +183,7 @@ static int efx_init_rx_buffers_page(strustruct efx_nic *efx = rx_queue->efx;struct efx_rx_buffer *rx_buf;struct page *page; +unsigned int page_offset;struct efx_rx_page_state *state;dma_addr_t dma_addr;unsigned index, count;
@@ -211,12 +208,14 @@ static int efx_init_rx_buffers_page(stru state->dma_addr = dma_addr; dma_addr +=sizeof (struct efx_rx_page_state ); + page_offset =sizeof (struct efx_rx_page_state ); split: index = rx_queue->added_count & rx_queue->ptr_mask; rx_buf =efx_rx_buffer (rx_queue, index); rx_buf->dma_addr = dma_addr +EFX_PAGE_IP_ALIGN ; rx_buf->u.page = page; + rx_buf->page_offset = page_offset +EFX_PAGE_IP_ALIGN ; rx_buf->len = efx->rx_buffer_len -EFX_PAGE_IP_ALIGN ; rx_buf->flags =EFX_RX_BUF_PAGE ; ++rx_queue->added_count;
@@ -227,6 +226,7 @@ static int efx_init_rx_buffers_page(stru/* Use the second half of the page */ get_page (page); dma_addr += (PAGE_SIZE >>1 ); + page_offset += (PAGE_SIZE >>1 ); ++count; goto split; }
Greg Kroah-Hartman
maintainerPATCH 26/98 sfc: Detach net device when stopping queues for reconfiguration
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <[email protected]>
[ Upstream commit 29c69a4882641285a854d6d03ca5adbba68c0034 ]
We must only ever stop TX queues when they are full or the net device is not 'ready' so far as the net core, and specifically the watchdog, is concerned. Otherwise, the watchdog may fire *immediately* if no packets have been added to the queue in the last 5 seconds.
The device is ready if all the following are true:
(a) It has a qdisc
(b) It is marked present
(c) It is running
(d) The link is reported up
(a) and (c) are normally true, and must not be changed by a driver.
(d) is under our control, but fake link changes may disturb userland. This leaves (b). We already mark the device absent during reset and self-test, but we need to do the same during MTU changes and ring reallocation. We don't need to do this when the device is brought down because then (c) is already false.
--- drivers/net/ethernet/sfc/efx.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-)
drivers/net/ethernet/sfc/efx.c +12 -4
@@ -779,6 +779,7 @@ efx_realloc_channels(struct efx_nic *efx tx_queue->txd.entries); } +efx_device_detach_sync (efx);efx_stop_all (efx);efx_stop_interrupts (efx, true);
@@ -832,6 +833,7 @@ out:efx_start_interrupts (efx, true);efx_start_all (efx); +netif_device_attach (efx->net_dev);return rc; rollback:
@@ -1641,8 +1643,12 @@ static void efx_stop_all(struct efx_nic/* Flush efx_mac_work(), refill_workqueue, monitor_work */ efx_flush_all (efx); -/* Stop the kernel transmit interface late, so the watchdog -* timer isn't ticking over the flush */ +/* Stop the kernel transmit interface. This is only valid if +* the device is stopped or detached; otherwise the watchdog +* may fire immediately. +*/ +WARN_ON (netif_running (efx->net_dev) && +netif_device_present (efx->net_dev));netif_tx_disable (efx->net_dev);efx_stop_datapath (efx);
@@ -1963,16 +1969,18 @@ static int efx_change_mtu(struct net_devif (new_mtu >EFX_MAX_MTU )return -EINVAL ; -efx_stop_all (efx); -netif_dbg (efx, drv, efx->net_dev,"changing MTU to %d\n" , new_mtu); +efx_device_detach_sync (efx); +efx_stop_all (efx); +mutex_lock (&efx->mac_lock); net_dev->mtu = new_mtu; efx->type->reconfigure_mac (efx);mutex_unlock (&efx->mac_lock);efx_start_all (efx); +netif_device_attach (efx->net_dev);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 27/98 sfc: Disable soft interrupt handling during efx_device_detach_sync()
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <[email protected]>
[ Upstream commit 35205b211c8d17a8a0b5e8926cb7c73e9a7ef1ad ]
efx_device_detach_sync() locks all TX queues before marking the device detached and thus disabling further TX scheduling. But it can still be interrupted by TX completions which then result in TX scheduling in soft interrupt context. This will deadlock when it tries to acquire a TX queue lock that efx_device_detach_sync() already acquired.
To avoid deadlock, we must use netif_tx_{,un}lock_bh().
--- drivers/net/ethernet/sfc/efx.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/sfc/efx.h +2 -2
@@ -171,9 +171,9 @@ static inline void efx_device_detach_syn* TX scheduler is stopped when we're done and before * netif_device_present() becomes false. */ -netif_tx_lock (dev); +netif_tx_lock_bh (dev);netif_device_detach (dev); - netif_tx_unlock(dev); + netif_tx_unlock_bh(dev); }#endif /* EFX_EFX_H */
Greg Kroah-Hartman
maintainerPATCH 28/98 sfc: Only use TX push if a single descriptor is to be written
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <[email protected]>
[ Upstream commit fae8563b25f73dc584a07bcda7a82750ff4f7672 ]
Using TX push when notifying the NIC of multiple new descriptors in the ring will very occasionally cause the TX DMA engine to re-use an old descriptor. This can result in a duplicated or partly duplicated packet (new headers with old data), or an IOMMU page fault. This does not happen when the pushed descriptor is the only one written.
TX push also provides little latency benefit when a packet requires more than one descriptor.
--- drivers/net/ethernet/sfc/nic.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/sfc/nic.c +2 -1
@@ -376,7 +376,8 @@ efx_may_push_tx_desc(struct efx_tx_queuereturn false; tx_queue->empty_read_count =0 ; -return ((empty_read_count ^ write_count) & ~EFX_EMPTY_COUNT_VALID ) ==0 ; +return ((empty_read_count ^ write_count) & ~EFX_EMPTY_COUNT_VALID ) ==0 + && tx_queue->write_count - write_count ==1 ; }/* For each entry inserted into the software descriptor ring, create a
Greg Kroah-Hartman
maintainerPATCH 29/98 ALSA: hda/cirrus - Fix the digital beep registration
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit a86b1a2cd2f81f74e815e07f756edd7bc5b6f034 upstream.
The argument passed to snd_hda_attach_beep_device() is a widget NID while spec->beep_amp holds the composed value for amp controls.
--- sound/pci/hda/patch_conexant.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
sound/pci/hda/patch_conexant.c +4 -4
@@ -1175,7 +1175,7 @@ static int patch_cxt5045(struct hda_code }if (spec->beep_amp) -snd_hda_attach_beep_device (codec, spec->beep_amp); +snd_hda_attach_beep_device (codec,get_amp_nid_ (spec->beep_amp));return 0 ; }
@@ -1954,7 +1954,7 @@ static int patch_cxt5051(struct hda_code }if (spec->beep_amp) -snd_hda_attach_beep_device (codec, spec->beep_amp); +snd_hda_attach_beep_device (codec,get_amp_nid_ (spec->beep_amp));return 0 ; }
@@ -3136,7 +3136,7 @@ static int patch_cxt5066(struct hda_code }if (spec->beep_amp) -snd_hda_attach_beep_device (codec, spec->beep_amp); +snd_hda_attach_beep_device (codec,get_amp_nid_ (spec->beep_amp));return 0 ; }
@@ -4576,7 +4576,7 @@ static int patch_conexant_auto(struct hd spec->capture_stream = &cx_auto_pcm_analog_capture; codec->patch_ops = cx_auto_patch_ops;if (spec->beep_amp) -snd_hda_attach_beep_device (codec, spec->beep_amp); +snd_hda_attach_beep_device (codec,get_amp_nid_ (spec->beep_amp));/* Some laptops with Conexant chips show stalls in S3 resume, * which falls into the single-cmd mode.
Greg Kroah-Hartman
maintainerPATCH 30/98 ALSA: hda - Fix typo in checking IEC958 emphasis bit
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit a686fd141e20244ad75f80ad54706da07d7bb90a upstream.
There is a typo in convert_to_spdif_status() about checking the emphasis IEC958 status bit. It should check the given value instead of the resultant value.
--- sound/pci/hda/hda_codec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/pci/hda/hda_codec.c +1 -1
@@ -2967,7 +2967,7 @@ static unsigned int convert_to_spdif_staif (val &AC_DIG1_PROFESSIONAL ) sbits |=IEC958_AES0_PROFESSIONAL ;if (sbits &IEC958_AES0_PROFESSIONAL ) { -if (sbits &AC_DIG1_EMPHASIS ) +if (val &AC_DIG1_EMPHASIS ) sbits |=IEC958_AES0_PRO_EMPHASIS_5015 ; }else {if (val &AC_DIG1_EMPHASIS )
Greg Kroah-Hartman
maintainerPATCH 31/98 ALSA: usb: Parse UAC2 extension unit like for UAC1
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Torstein Hegge <[email protected]>
commit 61ac51301e6c6d4ed977d7674ce2b8e713619a9b upstream.
UAC2_EXTENSION_UNIT_V2 differs from UAC1_EXTENSION_UNIT, but can be handled in the same way when parsing the unit. Otherwise parse_audio_unit() fails when it sees an extension unit on a UAC2 device.
UAC2_EXTENSION_UNIT_V2 is outside the range allocated by UAC1.
--- sound/usb/mixer.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
sound/usb/mixer.c +4 -1
@@ -725,7 +725,8 @@ static int check_input_term(struct mixercase UAC1_PROCESSING_UNIT :case UAC1_EXTENSION_UNIT :/* UAC2_PROCESSING_UNIT_V2 */ -/* UAC2_EFFECT_UNIT */ { +/* UAC2_EFFECT_UNIT */ +case UAC2_EXTENSION_UNIT_V2 : {struct uac_processing_unit_descriptor *d = p1; if (state->mixer->protocol == UAC_VERSION_2 &&
@@ -2051,6 +2052,8 @@ static int parse_audio_unit(struct mixerreturn parse_audio_extension_unit (state, unitid, p1); else /* UAC_VERSION_2 */ return parse_audio_processing_unit(state, unitid, p1); +case UAC2_EXTENSION_UNIT_V2 : +return parse_audio_extension_unit (state, unitid, p1);default :snd_printk (KERN_ERR "usbaudio: unit %u: unexpected type 0x%02x\n" , unitid, p1[2 ]);return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 32/98 ALSA: snd-usb: mixer: propagate errors up the call chain
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Mack <[email protected]>
commit 4d7b86c98e445b075c2c4c3757eb6d3d6efbe72e upstream.
In check_input_term() and parse_audio_feature_unit(), propagate the error value that has been returned by a failing function instead of -EINVAL. That helps cleaning up the error pathes in the mixer.
--- sound/usb/mixer.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
sound/usb/mixer.c +6 -4
@@ -715,8 +715,9 @@ static int check_input_term(struct mixercase UAC2_CLOCK_SELECTOR : {struct uac_selector_unit_descriptor *d = p1;/* call recursively to retrieve the channel info */ -if (check_input_term (state, d->baSourceID[0 ], term) <0 ) -return -ENODEV ; + err =check_input_term (state, d->baSourceID[0 ], term); +if (err <0 ) +return err; term->type = d->bDescriptorSubtype <<16 ;/* virtual type */ term->id = id; term->name =uac_selector_unit_iSelector (d);
@@ -1356,8 +1357,9 @@ static int parse_audio_feature_unit(strureturn err;/* determine the input source type and name */ -if (check_input_term (state, hdr->bSourceID, &iterm) <0 ) -return -EINVAL ; + err =check_input_term (state, hdr->bSourceID, &iterm); +if (err <0 ) +return err; master_bits =snd_usb_combine_bytes (bmaControls, csize);/* master configuration quirks */
Greg Kroah-Hartman
maintainerPATCH 33/98 ALSA: snd-usb: mixer: ignore -EINVAL in snd_usb_mixer_controls()
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Mack <[email protected]>
commit 83ea5d18d74f032a760fecde78c0210f66f7f70c upstream.
Creation of individual mixer controls may fail, but that shouldn't cause the entire mixer creation to fail. Even worse, if the mixer creation fails, that will error out the entire device probing.
All the functions called by parse_audio_unit() should return -EINVAL if they find descriptors that are unsupported or believed to be malformed, so we can safely handle this error code as a non-fatal condition in snd_usb_mixer_controls().
That fixes a long standing bug which is commonly worked around by adding quirks which make the driver ignore entire interfaces. Some of them might now be unnecessary.
--- sound/usb/mixer.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
sound/usb/mixer.c +3 -3
@@ -2122,7 +2122,7 @@ static int snd_usb_mixer_controls(struct state.oterm.type =le16_to_cpu (desc->wTerminalType); state.oterm.name = desc->iTerminal; err =parse_audio_unit (&state, desc->bSourceID); -if (err <0 ) +if (err <0 && err != -EINVAL )return err; }else {/* UAC_VERSION_2 */ struct uac2_output_terminal_descriptor *desc = p;
@@ -2134,12 +2134,12 @@ static int snd_usb_mixer_controls(struct state.oterm.type =le16_to_cpu (desc->wTerminalType); state.oterm.name = desc->iTerminal; err =parse_audio_unit (&state, desc->bSourceID); -if (err <0 ) +if (err <0 && err != -EINVAL )return err;/* for UAC2, use the same approach to also add the clock selectors */ err =parse_audio_unit (&state, desc->bCSourceID); -if (err <0 ) +if (err <0 && err != -EINVAL )return err; } }
Greg Kroah-Hartman
maintainerPATCH 34/98 saner proc_get_inode() calling conventions
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
commit d3d009cb965eae7e002ea5badf603ea8f4c34915 upstream.
Make it drop the pde in *all* cases when no new reference to it is put into an inode - both when an inode had already been set up (as we were already doing) and when inode allocation has failed. Makes for simpler logics in callers...
--- fs/proc/generic.c | 21 +++++++-------------- fs/proc/inode.c | 10 +++------- 2 files changed, 10 insertions(+), 21 deletions(-)
fs/proc/generic.c +7 -14
@@ -412,8 +412,7 @@ static const struct dentry_operations prstruct dentry *proc_lookup_de (struct proc_dir_entry *de,struct inode *dir,struct dentry *dentry) { -struct inode *inode =NULL ; -int error = -ENOENT ; +struct inode *inode;spin_lock (&proc_subdir_lock);for (de = de->subdir; de ; de = de->next) {
@@ -422,22 +421,16 @@ struct dentry *proc_lookup_de(struct proif (!memcmp (dentry->d_name.name, de->name, de->namelen)) {pde_get (de);spin_unlock (&proc_subdir_lock); - error = -ENOMEM ; inode =proc_get_inode (dir->i_sb, de); - goto out_unlock; +if (!inode) +return ERR_PTR (-ENOMEM ); +d_set_d_op (dentry, &proc_dentry_operations); +d_add (dentry, inode); +return NULL ; } }spin_unlock (&proc_subdir_lock); -out_unlock: - -if (inode) { -d_set_d_op (dentry, &proc_dentry_operations); -d_add (dentry, inode); -return NULL ; - } -if (de) -pde_put (de); -return ERR_PTR (error); +return ERR_PTR (-ENOENT ); } struct dentry *proc_lookup(struct inode *dir, struct dentry *dentry,
fs/proc/inode.c +3 -7
@@ -445,12 +445,9 @@ static const struct file_operations procstruct inode *proc_get_inode (struct super_block *sb,struct proc_dir_entry *de) { -struct inode * inode; +struct inode *inode =iget_locked (sb, de->low_ino); - inode =iget_locked (sb, de->low_ino); -if (!inode) -return NULL ; -if (inode->i_state &I_NEW ) { +if (inode && (inode->i_state &I_NEW )) { inode->i_mtime = inode->i_atime = inode->i_ctime =CURRENT_TIME ;PROC_I (inode)->pde = de;
@@ -482,7 +479,7 @@ struct inode *proc_get_inode(struct supe }else pde_put (de);return inode; -} +}int proc_fill_super (struct super_block *s) {
@@ -499,6 +496,5 @@ int proc_fill_super(struct super_block *return 0 ;printk ("proc_read_super: get root inode failed\n" ); -pde_put (&proc_root);return -ENOMEM ; }
Greg Kroah-Hartman
maintainerPATCH 35/98 vfs,proc: guarantee unique inodes in /proc
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Torvalds <[email protected]>
commit 51f0885e5415b4cc6535e9cdcc5145bfbc134353 upstream.
Dave Jones found another /proc issue with his Trinity tool: thanks to the namespace model, we can have multiple /proc dentries that point to the same inode, aliasing directories in /proc/<pid>/net/ for example.
This ends up being a total disaster, because it acts like hardlinked directories, and causes locking problems. We rely on the topological sort of the inodes pointed to by dentries, and if we have aliased directories, that odering becomes unreliable.
In short: don't do this. Multiple dentries with the same (directory) inode is just a bad idea, and the namespace code should never have exposed things this way. But we're kind of stuck with it.
This solves things by just always allocating a new inode during /proc dentry lookup, instead of using "iget_locked()" to look up existing inodes by superblock and number. That actually simplies the code a bit, at the cost of potentially doing more inode [de]allocations.
That said, the inode lookup wasn't free either (and did a lot of locking of inodes), so it is probably not that noticeable. We could easily keep the old lookup model for non-directory entries, but rather than try to be excessively clever this just implements the minimal and simplest workaround for the problem.
--- fs/proc/inode.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
fs/proc/inode.c +3 -3
@@ -445,9 +445,10 @@ static const struct file_operations procstruct inode *proc_get_inode (struct super_block *sb,struct proc_dir_entry *de) { -struct inode *inode =iget_locked (sb, de->low_ino); +struct inode *inode =new_inode_pseudo (sb); -if (inode && (inode->i_state &I_NEW )) { +if (inode) { + inode->i_ino = de->low_ino; inode->i_mtime = inode->i_atime = inode->i_ctime =CURRENT_TIME ;PROC_I (inode)->pde = de;
@@ -475,7 +476,6 @@ struct inode *proc_get_inode(struct supe inode->i_fop = de->proc_fops; } } -unlock_new_inode (inode); }else pde_put (de);return inode;
Greg Kroah-Hartman
maintainerPATCH 36/98 Revert "drm/i915: try to train DP even harder"
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 3b4f819d5eac94ba8fe5e8c061f6dabfe8d7b22c upstream.
This reverts commit 0d71068835e2610576d369d6d4cbf90e0f802a71.
Not only that the commit introduces a bogus check (voltage_tries == 5 will never meet at the inserted code path), it brings the i915 driver into an endless dp-train loop on HP Z1 desktop machine with IVY+eDP.
At least reverting this commit recovers the framebuffer (but X is still broken by other reasons...)
--- drivers/gpu/drm/i915/intel_dp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/i915/intel_dp.c +1 -1
@@ -1850,7 +1850,7 @@ intel_dp_start_link_train(struct intel_dfor (i =0 ; i < intel_dp->lane_count; i++)if ((intel_dp->train_set[i] &DP_TRAIN_MAX_SWING_REACHED ) ==0 )break ; -if (i == intel_dp->lane_count && voltage_tries ==5 ) { +if (i == intel_dp->lane_count) { ++loop_tries;if (loop_tries ==5 ) {DRM_DEBUG_KMS ("too many full retries, give up\n" );
Greg Kroah-Hartman
maintainerPATCH 37/98 drm/i915: restrict kernel address leak in debugfs
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
commit 2563a4524febe8f4a98e717e02436d1aaf672aa2 upstream.
Masks kernel address info-leak in object dumps with the %pK suffix, so they cannot be used to target kernel memory corruption attacks if the kptr_restrict sysctl is set.
--- drivers/gpu/drm/i915/i915_debugfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/i915/i915_debugfs.c +1 -1
@@ -103,7 +103,7 @@ static const char *cache_level_str(int tstatic void describe_obj (struct seq_file *m,struct drm_i915_gem_object *obj) { - seq_printf(m, "%p: %s%s %8zdKiB %04x %04x %d %d %d%s%s%s", + seq_printf(m, "%pK: %s%s %8zdKiB %04x %04x %d %d %d%s%s%s", &obj->base, get_pin_flag(obj), get_tiling_flag(obj),
Greg Kroah-Hartman
maintainerPATCH 38/98 tracing: Fix race in snapshot swapping
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Steven Rostedt (Red Hat)" <[email protected]>
commit 2721e72dd10f71a3ba90f59781becf02638aa0d9 upstream.
Although the swap is wrapped with a spin_lock, the assignment of the temp buffer used to swap is not within that lock. It needs to be moved into that lock, otherwise two swaps happening on two different CPUs, can end up using the wrong temp buffer to assign in the swap.
Luckily, all current callers of the swap function appear to have their own locks. But in case something is added that allows two different callers to call the swap, then there's a chance that this race can trigger and corrupt the buffers.
New code is coming soon that will allow for this race to trigger.
I've Cc'd stable, so this bug will not show up if someone backports one of the changes that can trigger this bug.
--- kernel/trace/trace.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
kernel/trace/trace.c +2 -1
@@ -703,7 +703,7 @@ __update_max_tr(struct trace_array *tr,void update_max_tr (struct trace_array *tr,struct task_struct *tsk,int cpu) { -struct ring_buffer *buf = tr->buffer; +struct ring_buffer *buf;if (trace_stop_count)return ;
@@ -715,6 +715,7 @@ update_max_tr(struct trace_array *tr, st }arch_spin_lock (&ftrace_max_lock); + buf = tr->buffer; tr->buffer = max_tr.buffer; max_tr.buffer = buf;
Greg Kroah-Hartman
maintainerPATCH 39/98 tracing: Fix free of probe entry by calling call_rcu_sched()
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Steven Rostedt (Red Hat)" <[email protected]>
commit 740466bc89ad8bd5afcc8de220f715f62b21e365 upstream.
Because function tracing is very invasive, and can even trace calls to rcu_read_lock(), RCU access in function tracing is done with preempt_disable_notrace(). This requires a synchronize_sched() for updates and not a synchronize_rcu().
Function probes (traceon, traceoff, etc) must be freed after a synchronize_sched() after its entry has been removed from the hash. But call_rcu() is used. Fix this by using call_rcu_sched().
Also fix the usage to use hlist_del_rcu() instead of hlist_del().
--- kernel/trace/ftrace.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/trace/ftrace.c +2 -2
@@ -3082,8 +3082,8 @@ __unregister_ftrace_function_probe(charcontinue ; } -hlist_del (&entry->node); -call_rcu (&entry->rcu, ftrace_free_entry_rcu); +hlist_del_rcu (&entry->node); +call_rcu_sched (&entry->rcu, ftrace_free_entry_rcu); } }__disable_ftrace_function_probe ();
Greg Kroah-Hartman
maintainerPATCH 40/98 tracing: Protect tracer flags with trace_types_lock
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Steven Rostedt (Red Hat)" <[email protected]>
commit 69d34da2984c95b33ea21518227e1f9470f11d95 upstream.
Seems that the tracer flags have never been protected from synchronous writes. Luckily, admins don't usually modify the tracing flags via two different tasks. But if scripts were to be used to modify them, then they could get corrupted.
Move the trace_types_lock that protects against tracers changing to also protect the flags being set.
--- kernel/trace/trace.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
kernel/trace/trace.c +8 -4
@@ -2871,6 +2871,8 @@ static int trace_set_options(char *optio cmp +=2 ; } +mutex_lock (&trace_types_lock); +for (i =0 ; trace_options[i]; i++) {if (strcmp (cmp, trace_options[i]) ==0 ) {set_tracer_flags (1 << i, !neg);
@@ -2879,11 +2881,10 @@ static int trace_set_options(char *optio }/* If no option could be set, test the specific tracer options */ -if (!trace_options[i]) { -mutex_lock (&trace_types_lock); +if (!trace_options[i]) ret =set_tracer_option (current_trace, cmp, neg); -mutex_unlock (&trace_types_lock); - } + +mutex_unlock (&trace_types_lock);return ret; }
@@ -4641,7 +4642,10 @@ trace_options_core_write(struct file *fiif (val !=0 && val !=1 )return -EINVAL ; + +mutex_lock (&trace_types_lock);set_tracer_flags (1 << index, val); +mutex_unlock (&trace_types_lock); *ppos += cnt;
Greg Kroah-Hartman
maintainerPATCH 41/98 tracing: Keep overwrite in sync between regular and snapshot buffers
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Steven Rostedt (Red Hat)" <[email protected]>
commit 80902822658aab18330569587cdb69ac1dfdcea8 upstream.
Changing the overwrite mode for the ring buffer via the trace option only sets the normal buffer. But the snapshot buffer could swap with it, and then the snapshot would be in non overwrite mode and the normal buffer would be in overwrite mode, even though the option flag states otherwise.
Keep the two buffers overwrite modes in sync.
--- kernel/trace/trace.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
kernel/trace/trace.c +5 -1
@@ -2850,8 +2850,12 @@ static void set_tracer_flags(unsigned inif (mask ==TRACE_ITER_RECORD_CMD )trace_event_enable_cmd_record (enabled); -if (mask ==TRACE_ITER_OVERWRITE ) +if (mask ==TRACE_ITER_OVERWRITE ) {ring_buffer_change_overwrite (global_trace.buffer, enabled); +#ifdef CONFIG_TRACER_MAX_TRACE +ring_buffer_change_overwrite (max_tr.buffer, enabled); +#endif + }if (mask ==TRACE_ITER_PRINTK )trace_printk_start_stop_comm (enabled);
Greg Kroah-Hartman
maintainerPATCH 42/98 rtlwifi: rtl8192cu: Fix schedule while atomic bug splat
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Larry Finger <[email protected]>
commit 664899786cb49cb52f620e06ac19c0be524a7cfa upstream.
When run at debug 3 or higher, rtl8192cu reports a BUG as follows:
BUG: scheduling while atomic: kworker/u:0/5281/0x00000002 INFO: lockdep is turned off. Modules linked in: rtl8192cu rtl8192c_common rtlwifi fuse af_packet bnep bluetooth b43 mac80211 cfg80211 ipv6 snd_hda_codec_conexant kvm_amd k
vm snd_hda_intel snd_hda_codec bcma rng_core snd_pcm ssb mmc_core snd_seq snd_timer snd_seq_device snd i2c_nforce2 sr_mod pcmcia forcedeth i2c_core soundcore
cdrom sg serio_raw k8temp hwmon joydev ac battery pcmcia_core snd_page_alloc video button wmi autofs4 ext4 mbcache jbd2 crc16 thermal processor scsi_dh_alua scsi_dh_hp_sw scsi_dh_rdac scsi_dh_emc scsi_dh ata_generic pata_acpi pata_amd [last unloaded: rtlwifi]
Pid: 5281, comm: kworker/u:0 Tainted: G W 3.8.0-wl+ #119
Call Trace: [<ffffffff814531e7>] __schedule_bug+0x62/0x70 [<ffffffff81459af0>] __schedule+0x730/0xa30 [<ffffffff81326e49>] ? usb_hcd_link_urb_to_ep+0x19/0xa0 [<ffffffff8145a0d4>] schedule+0x24/0x70 [<ffffffff814575ec>] schedule_timeout+0x18c/0x2f0 [<ffffffff81459ec0>] ? wait_for_common+0x40/0x180 [<ffffffff8133f461>] ? ehci_urb_enqueue+0xf1/0xee0 [<ffffffff810a579d>] ? trace_hardirqs_on+0xd/0x10 [<ffffffff81459f65>] wait_for_common+0xe5/0x180 [<ffffffff8107d1c0>] ? try_to_wake_up+0x2d0/0x2d0 [<ffffffff8145a08e>] wait_for_completion_timeout+0xe/0x10 [<ffffffff8132ab1c>] usb_start_wait_urb+0x8c/0x100 [<ffffffff8132adf9>] usb_control_msg+0xd9/0x130 [<ffffffffa057dd8d>] _usb_read_sync+0xcd/0x140 [rtlwifi] [<ffffffffa057de0e>] _usb_read32_sync+0xe/0x10 [rtlwifi] [<ffffffffa04b0555>] rtl92cu_update_hal_rate_table+0x1a5/0x1f0 [rtl8192cu]
The cause is a synchronous read from routine rtl92cu_update_hal_rate_table(). The resulting output is not critical, thus the debug statement is deleted.
--- drivers/net/wireless/rtlwifi/rtl8192cu/hw.c | 2 -- 1 file changed, 2 deletions(-)
drivers/net/wireless/rtlwifi/rtl8192cu/hw.c +0 -2
@@ -2058,8 +2058,6 @@ void rtl92cu_update_hal_rate_table(struc (shortgi_rate <<4 ) | (shortgi_rate); }rtl_write_dword (rtlpriv,REG_ARFR0 + ratr_index *4 , ratr_value); -RT_TRACE (rtlpriv,COMP_RATR ,DBG_DMESG ,"%x\n" , -rtl_read_dword (rtlpriv,REG_ARFR0 )); }void rtl92cu_update_hal_rate_mask (struct ieee80211_hw *hw,u8 rssi_level)
Greg Kroah-Hartman
maintainerPATCH 43/98 rtlwifi: rtl8192cu: Fix problem that prevents reassociation
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Larry Finger <[email protected]>
commit 9437a248e7cac427c898bdb11bd1ac6844a1ead4 upstream.
The driver was failing to clear the BSSID when a disconnect happened. That prevented a reconnection. This problem is reported at
https://bugzilla.redhat.com/show_bug.cgi?id=789605,
https://bugzilla.redhat.com/show_bug.cgi?id=866786,
https://bugzilla.redhat.com/show_bug.cgi?id=906734, and
https://bugzilla.kernel.org/show_bug.cgi?id=46171.
Thanks to Jussi Kivilinna for making the critical observation that led to the solution.
--- drivers/net/wireless/rtlwifi/rtl8192cu/hw.c | 87 +++++++++++----------------- 1 file changed, 35 insertions(+), 52 deletions(-)
drivers/net/wireless/rtlwifi/rtl8192cu/hw.c +35 -52
@@ -1377,74 +1377,57 @@ void rtl92cu_card_disable(struct ieee802void rtl92cu_set_check_bssid (struct ieee80211_hw *hw,bool check_bssid) { -/* dummy routine needed for callback from rtl_op_configure_filter() */ -} - -/*========================================================================== */ - -static void _rtl92cu_set_check_bssid (struct ieee80211_hw *hw, -enum nl80211_iftype type) -{struct rtl_priv *rtlpriv =rtl_priv (hw); -u32 reg_rcr =rtl_read_dword (rtlpriv,REG_RCR );struct rtl_hal *rtlhal =rtl_hal (rtlpriv); -struct rtl_phy *rtlphy = &(rtlpriv->phy); -u8 filterout_non_associated_bssid = false; +u32 reg_rcr =rtl_read_dword (rtlpriv,REG_RCR ); -switch (type) { -case NL80211_IFTYPE_ADHOC : -case NL80211_IFTYPE_STATION : - filterout_non_associated_bssid = true; -break ; -case NL80211_IFTYPE_UNSPECIFIED : -case NL80211_IFTYPE_AP : -default : -break ; - } -if (filterout_non_associated_bssid) { +if (rtlpriv->psc.rfpwr_state !=ERFON ) +return ; + +if (check_bssid) { +u8 tmp;if (IS_NORMAL_CHIP (rtlhal->version)) { -switch (rtlphy->current_io_type) { -case IO_CMD_RESUME_DM_BY_SCAN : - reg_rcr |= (RCR_CBSSID_DATA |RCR_CBSSID_BCN ); - rtlpriv->cfg->ops->set_hw_reg (hw, -HW_VAR_RCR , (u8 *)(®_rcr)); -/* enable update TSF */ -_rtl92cu_set_bcn_ctrl_reg (hw,0 ,BIT (4 )); -break ; -case IO_CMD_PAUSE_DM_BY_SCAN : - reg_rcr &= ~(RCR_CBSSID_DATA |RCR_CBSSID_BCN ); - rtlpriv->cfg->ops->set_hw_reg (hw, -HW_VAR_RCR , (u8 *)(®_rcr)); -/* disable update TSF */ -_rtl92cu_set_bcn_ctrl_reg (hw,BIT (4 ),0 ); -break ; - } + reg_rcr |= (RCR_CBSSID_DATA |RCR_CBSSID_BCN ); + tmp =BIT (4 ); }else { - reg_rcr |= (RCR_CBSSID ); - rtlpriv->cfg->ops->set_hw_reg (hw,HW_VAR_RCR , - (u8 *)(®_rcr)); -_rtl92cu_set_bcn_ctrl_reg (hw,0 , (BIT (4 )|BIT (5 ))); + reg_rcr |=RCR_CBSSID ; + tmp =BIT (4 ) |BIT (5 ); } - }else if (filterout_non_associated_bssid == false) { + rtlpriv->cfg->ops->set_hw_reg (hw,HW_VAR_RCR , + (u8 *) (®_rcr)); +_rtl92cu_set_bcn_ctrl_reg (hw,0 , tmp); + }else { +u8 tmp;if (IS_NORMAL_CHIP (rtlhal->version)) { - reg_rcr &= (~(RCR_CBSSID_DATA |RCR_CBSSID_BCN )); - rtlpriv->cfg->ops->set_hw_reg (hw,HW_VAR_RCR , - (u8 *)(®_rcr)); -_rtl92cu_set_bcn_ctrl_reg (hw,BIT (4 ),0 ); + reg_rcr &= ~(RCR_CBSSID_DATA |RCR_CBSSID_BCN ); + tmp =BIT (4 ); }else { - reg_rcr &= (~RCR_CBSSID ); - rtlpriv->cfg->ops->set_hw_reg (hw,HW_VAR_RCR , - (u8 *)(®_rcr)); -_rtl92cu_set_bcn_ctrl_reg (hw, (BIT (4 )|BIT (5 )),0 ); + reg_rcr &= ~RCR_CBSSID ; + tmp =BIT (4 ) |BIT (5 ); } + reg_rcr &= (~(RCR_CBSSID_DATA |RCR_CBSSID_BCN )); + rtlpriv->cfg->ops->set_hw_reg (hw, +HW_VAR_RCR , (u8 *) (®_rcr)); +_rtl92cu_set_bcn_ctrl_reg (hw, tmp,0 ); } } +/*========================================================================== */ +int rtl92cu_set_network_type (struct ieee80211_hw *hw,enum nl80211_iftype type) { +struct rtl_priv *rtlpriv =rtl_priv (hw); +if (_rtl92cu_set_media_status (hw, type))return -EOPNOTSUPP ; -_rtl92cu_set_check_bssid (hw, type); + +if (rtlpriv->mac80211.link_state ==MAC80211_LINKED ) { +if (type !=NL80211_IFTYPE_AP ) +rtl92cu_set_check_bssid (hw, true); + }else { +rtl92cu_set_check_bssid (hw, false); + } +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 44/98 mwifiex: fix potential out-of-boundary access to ibss rate table
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bing Zhao <[email protected]>
commit 5f0fabf84d7b52f979dcbafa3d3c530c60d9a92c upstream.
smatch found this error:
CHECK drivers/net/wireless/mwifiex/join.c
drivers/net/wireless/mwifiex/join.c:1121
mwifiex_cmd_802_11_ad_hoc_join()
error: testing array offset 'i' after use.
--- drivers/net/wireless/mwifiex/join.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
drivers/net/wireless/mwifiex/join.c +3 -4
@@ -1092,10 +1092,9 @@ mwifiex_cmd_802_11_ad_hoc_join(struct mw adhoc_join->bss_descriptor.bssid, adhoc_join->bss_descriptor.ssid); -for (i =0 ; bss_desc->supported_rates[i] && - i <MWIFIEX_SUPPORTED_RATES ; - i++) - ; +for (i =0 ; i <MWIFIEX_SUPPORTED_RATES && + bss_desc->supported_rates[i]; i++) + ; rates_size = i;/* Copy Data Rates from the Rates recorded in scan response */
Greg Kroah-Hartman
maintainerPATCH 45/98 drm/i915: bounds check execbuffer relocation count
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
commit 3118a4f652c7b12c752f3222af0447008f9b2368 upstream.
It is possible to wrap the counter used to allocate the buffer for relocation copies. This could lead to heap writing overflows.
CVE-2013-0913
v3: collapse test, improve comment
v2: move check into validate_exec_list
--- drivers/gpu/drm/i915/i915_gem_execbuffer.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
drivers/gpu/drm/i915/i915_gem_execbuffer.c +8 -3
@@ -706,15 +706,20 @@ validate_exec_list(struct drm_i915_gem_e int count) {int i; +int relocs_total =0 ; +int relocs_max =INT_MAX /sizeof (struct drm_i915_gem_relocation_entry );for (i =0 ; i < count; i++) {char __user *ptr = (char __user *)(uintptr_t )exec[i].relocs_ptr;int length;/* limited by fault_in_pages_readable() */ -/* First check for malicious input causing overflow */ -if (exec[i].relocation_count > -INT_MAX /sizeof (struct drm_i915_gem_relocation_entry )) +/* First check for malicious input causing overflow in +* the worst case where we need to allocate the entire +* relocation tree as a single array. +*/ +if (exec[i].relocation_count > relocs_max - relocs_total)return -EINVAL ; + relocs_total += exec[i].relocation_count; length = exec[i].relocation_count *sizeof (struct drm_i915_gem_relocation_entry );
Greg Kroah-Hartman
maintainerPATCH 46/98 Revert "drm/i915: write backlight harder"
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Vetter <[email protected]>
commit b1289371fcd580b4c412e6d05c4cb8ac8d277239 upstream.
This reverts commit cf0a6584aa6d382f802f2c3cacac23ccbccde0cd.
Turns out that cargo-culting breaks systems. Note that we can't revert further, since
commit 770c12312ad617172b1a65b911d3e6564fc5aca8
Author: Takashi Iwai <[email protected]> Date: Sat Aug 11 08:56:42 2012 +0200
drm/i915: Fix blank panel at reopening lid
fixed a regression in 3.6-rc kernels for which we've never figured out the exact root cause. But some further inspection of the backlight code reveals that it's seriously lacking locking. And especially the asle backlight update is know to get fired (through some smm magic) when writing specific backlight control registers. So the possibility of suffering from races is rather real.
Until those races are fixed I don't think it makes sense to try further hacks. Which sucks a bit, but sometimes that's how it is :(
References: http://www.mail-archive.com/[email protected]/msg18788.html
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=47941
--- drivers/gpu/drm/i915/intel_panel.c | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-)
drivers/gpu/drm/i915/intel_panel.c +5 -8
@@ -321,9 +321,6 @@ void intel_panel_enable_backlight(structif (dev_priv->backlight_level ==0 ) dev_priv->backlight_level =intel_panel_get_max_backlight (dev); - dev_priv->backlight_enabled = true; -intel_panel_actually_set_backlight (dev, dev_priv->backlight_level); -if (INTEL_INFO (dev)->gen >=4 ) {uint32_t reg, tmp;
@@ -359,12 +356,12 @@ void intel_panel_enable_backlight(struct } set_level: -/* Check the current backlight level and try to set again if it's zero. -* On some machines, BLC_PWM_CPU_CTL is cleared to zero automatically -* when BLC_PWM_CPU_CTL2 and BLC_PWM_PCH_CTL1 are written. +/* Call below after setting BLC_PWM_CPU_CTL2 and BLC_PWM_PCH_CTL1. +* BLC_PWM_CPU_CTL may be cleared to zero automatically when these +* registers are set. */ -if (!intel_panel_get_backlight (dev)) -intel_panel_actually_set_backlight (dev, dev_priv->backlight_level); + dev_priv->backlight_enabled = true; +intel_panel_actually_set_backlight (dev, dev_priv->backlight_level); }static void intel_panel_init_backlight (struct drm_device *dev)
Greg Kroah-Hartman
maintainerPATCH 47/98 i2c: tegra: check the clk_prepare_enable() return value
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laxman Dewangan <[email protected]>
commit 132c803f7b70b17322579f6f4f3f65cf68e55135 upstream.
NVIDIA's Tegra SoC allows read/write of controller register only if controller clock is enabled. System hangs if read/write happens to registers without enabling clock.
clk_prepare_enable() can be fail due to unknown reason and hence adding check for return value of this function. If this function success then only access register otherwise return to caller with error.
--- drivers/i2c/busses/i2c-tegra.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
drivers/i2c/busses/i2c-tegra.c +11 -2
@@ -392,7 +392,11 @@ static int tegra_i2c_init(struct tegra_iu32 val;int err =0 ; -tegra_i2c_clock_enable (i2c_dev); + err =tegra_i2c_clock_enable (i2c_dev); +if (err <0 ) { +dev_err (i2c_dev->dev,"Clock enable failed %d\n" , err); +return err; + }tegra_periph_reset_assert (i2c_dev->div_clk);udelay (2 );
@@ -599,7 +603,12 @@ static int tegra_i2c_xfer(struct i2c_adaif (i2c_dev->is_suspended)return -EBUSY ; -tegra_i2c_clock_enable (i2c_dev); + ret =tegra_i2c_clock_enable (i2c_dev); +if (ret <0 ) { +dev_err (i2c_dev->dev,"Clock enable failed %d\n" , ret); +return ret; + } +for (i =0 ; i < num; i++) {enum msg_end_type end_type =MSG_END_STOP ;if (i < (num -1 )) {
Greg Kroah-Hartman
maintainerPATCH 48/98 KMS: fix EDID detailed timing vsync parsing
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Torsten Duwe <[email protected]>
commit 16dad1d743d31a104a849c8944e6b9eb479f6cd7 upstream.
EDID spreads some values across multiple bytes; bit-fiddling is needed to retrieve these. The current code to parse "detailed timings" has a cut&paste error that results in a vsync offset of at most 15 lines instead of 63.
See
http://en.wikipedia.org/wiki/EDID
and in the "EDID Detailed Timing Descriptor" see bytes 10+11 show why that needs to be a left shift.
--- drivers/gpu/drm/drm_edid.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/drm_edid.c +1 -1
@@ -894,7 +894,7 @@ static struct drm_display_mode *drm_modeunsigned vblank = (pt->vactive_vblank_hi &0xf ) <<8 | pt->vblank_lo;unsigned hsync_offset = (pt->hsync_vsync_offset_pulse_width_hi &0xc0 ) <<2 | pt->hsync_offset_lo;unsigned hsync_pulse_width = (pt->hsync_vsync_offset_pulse_width_hi &0x30 ) <<4 | pt->hsync_pulse_width_lo; -unsigned vsync_offset = (pt->hsync_vsync_offset_pulse_width_hi &0xc ) >>2 | pt->vsync_offset_pulse_width_lo >>4 ; +unsigned vsync_offset = (pt->hsync_vsync_offset_pulse_width_hi &0xc ) <<2 | pt->vsync_offset_pulse_width_lo >>4 ;unsigned vsync_pulse_width = (pt->hsync_vsync_offset_pulse_width_hi &0x3 ) <<4 | (pt->vsync_offset_pulse_width_lo &0xf );/* ignore tiny modes */
Greg Kroah-Hartman
maintainerPATCH 49/98 KMS: fix EDID detailed timing frame rate
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Torsten Duwe <[email protected]>
commit c19b3b0f6eed552952845e4ad908dba2113d67b4 upstream.
When KMS has parsed an EDID "detailed timing", it leaves the frame rate zeroed. Consecutive (debug-) output of that mode thus yields 0 for vsync. This simple fix also speeds up future invocations of drm_mode_vrefresh().
While it is debatable whether this qualifies as a -stable fix I'd apply it for consistency's sake; drm_helper_probe_single_connector_modes() does the same thing already for all probed modes.
--- drivers/gpu/drm/drm_edid.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/drm_edid.c +1 -0
@@ -975,6 +975,7 @@ set_size: } mode->type =DRM_MODE_TYPE_DRIVER ; + mode->vrefresh =drm_mode_vrefresh (mode);drm_mode_set_name (mode);return mode;
Greg Kroah-Hartman
maintainerPATCH 50/98 drivers/rtc/rtc-at91rm9200.c: use a variable for storing IMR
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolas Ferre <[email protected]>
commit 0ef1594c017521ea89278e80fe3f80dafb17abde upstream.
On some revisions of AT91 SoCs, the RTC IMR register is not working. Instead of elaborating a workaround for that specific SoC or IP version, we simply use a software variable to store the Interrupt Mask Register and modify it for each enabling/disabling of an interrupt. The overhead of this is negligible anyway.
The interrupt mask register (IMR) for the RTC is broken on the AT91SAM9x5 sub-family of SoCs (good overview of the members here:
http://www.eewiki.net/display/linuxonarm/AT91SAM9x5 ). The "user visible effect" is the RTC doesn't work.
That sub-family is less than two years old and only has devicetree (DT) support and came online circa lk 3.7 . The dust is yet to settle on the DT stuff at least for AT91 SoCs (translation: lots of stuff is still broken, so much that it is hard to know where to start).
The fix in the patch is pretty simple: just shadow the silicon IMR register with a variable in the driver. Some older SoCs (pre-DT) use the the rtc-at91rm9200 driver (e.g. obviously the AT91RM9200) and they should not be impacted by the change. There shouldn't be a large volume of interrupts associated with a RTC.
--- drivers/rtc/rtc-at91rm9200.c | 50 ++++++++++++++++++++++++++----------------- drivers/rtc/rtc-at91rm9200.h | 1 2 files changed, 31 insertions(+), 20 deletions(-)
drivers/rtc/rtc-at91rm9200.c +31 -19
@@ -44,6 +44,7 @@ static DECLARE_COMPLETION(at91_rtc_updatstatic unsigned int at91_alarm_year =AT91_RTC_EPOCH ;static void __iomem *at91_rtc_regs;static int irq; +static u32 at91_rtc_imr;/* * Decode time/date into rtc_time structure
@@ -108,9 +109,11 @@ static int at91_rtc_settime(struct devic cr =at91_rtc_read (AT91_RTC_CR );at91_rtc_write (AT91_RTC_CR , cr |AT91_RTC_UPDCAL |AT91_RTC_UPDTIM ); + at91_rtc_imr |=AT91_RTC_ACKUPD ;at91_rtc_write (AT91_RTC_IER ,AT91_RTC_ACKUPD );wait_for_completion (&at91_rtc_updated);/* wait for ACKUPD interrupt */ at91_rtc_write (AT91_RTC_IDR ,AT91_RTC_ACKUPD ); + at91_rtc_imr &= ~AT91_RTC_ACKUPD ;at91_rtc_write (AT91_RTC_TIMR , bin2bcd(tm->tm_sec) << 0
@@ -142,7 +145,7 @@ static int at91_rtc_readalarm(struct dev tm->tm_yday =rtc_year_days (tm->tm_mday, tm->tm_mon, tm->tm_year); tm->tm_year = at91_alarm_year -1900 ; - alrm->enabled = (at91_rtc_read (AT91_RTC_IMR ) &AT91_RTC_ALARM ) + alrm->enabled = (at91_rtc_imr &AT91_RTC_ALARM ) ?1 :0 ; pr_debug("%s(): %4d-%02d-%02d %02d:%02d:%02d\n", __func__,
@@ -168,6 +171,7 @@ static int at91_rtc_setalarm(struct devi tm.tm_sec = alrm->time.tm_sec;at91_rtc_write (AT91_RTC_IDR ,AT91_RTC_ALARM ); + at91_rtc_imr &= ~AT91_RTC_ALARM ;at91_rtc_write (AT91_RTC_TIMALR ,bin2bcd (tm.tm_sec) <<0 | bin2bcd(tm.tm_min) << 8
@@ -180,6 +184,7 @@ static int at91_rtc_setalarm(struct deviif (alrm->enabled) {at91_rtc_write (AT91_RTC_SCCR ,AT91_RTC_ALARM ); + at91_rtc_imr |=AT91_RTC_ALARM ;at91_rtc_write (AT91_RTC_IER ,AT91_RTC_ALARM ); }
@@ -196,9 +201,12 @@ static int at91_rtc_alarm_irq_enable(strif (enabled) {at91_rtc_write (AT91_RTC_SCCR ,AT91_RTC_ALARM ); + at91_rtc_imr |=AT91_RTC_ALARM ;at91_rtc_write (AT91_RTC_IER ,AT91_RTC_ALARM ); - }else + }else {at91_rtc_write (AT91_RTC_IDR ,AT91_RTC_ALARM ); + at91_rtc_imr &= ~AT91_RTC_ALARM ; + }return 0 ; }
@@ -207,12 +215,10 @@ static int at91_rtc_alarm_irq_enable(str*/ static int at91_rtc_proc (struct device *dev,struct seq_file *seq) { -unsigned long imr =at91_rtc_read (AT91_RTC_IMR ); -seq_printf (seq,"update_IRQ\t: %s\n" , - (imr &AT91_RTC_ACKUPD ) ?"yes" :"no" ); + (at91_rtc_imr &AT91_RTC_ACKUPD ) ?"yes" :"no" );seq_printf (seq,"periodic_IRQ\t: %s\n" , - (imr &AT91_RTC_SECEV ) ?"yes" :"no" ); + (at91_rtc_imr &AT91_RTC_SECEV ) ?"yes" :"no" );return 0 ; }
@@ -227,7 +233,7 @@ static irqreturn_t at91_rtc_interrupt(inunsigned int rtsr;unsigned long events =0 ; - rtsr =at91_rtc_read (AT91_RTC_SR ) &at91_rtc_read (AT91_RTC_IMR ); + rtsr =at91_rtc_read (AT91_RTC_SR ) & at91_rtc_imr;if (rtsr) {/* this interrupt is shared! Is it ours? */ if (rtsr &AT91_RTC_ALARM ) events |= (RTC_AF |RTC_IRQF );
@@ -291,6 +297,7 @@ static int __init at91_rtc_probe(structat91_rtc_write (AT91_RTC_IDR ,AT91_RTC_ACKUPD |AT91_RTC_ALARM |AT91_RTC_SECEV |AT91_RTC_TIMEV |AT91_RTC_CALEV ); + at91_rtc_imr =0 ; ret = request_irq(irq, at91_rtc_interrupt, IRQF_SHARED,
@@ -330,6 +337,7 @@ static int __exit at91_rtc_remove(structat91_rtc_write (AT91_RTC_IDR ,AT91_RTC_ACKUPD |AT91_RTC_ALARM |AT91_RTC_SECEV |AT91_RTC_TIMEV |AT91_RTC_CALEV ); + at91_rtc_imr =0 ;free_irq (irq, pdev);rtc_device_unregister (rtc);
@@ -342,31 +350,35 @@ static int __exit at91_rtc_remove(struct/* AT91RM9200 RTC Power management control */ -static u32 at91_rtc_imr; +static u32 at91_rtc_bkpimr; +static int at91_rtc_suspend (struct device *dev) {/* this IRQ is shared with DBGU and other hardware which isn't * necessarily doing PM like we are... */ - at91_rtc_imr =at91_rtc_read (AT91_RTC_IMR ) - & (AT91_RTC_ALARM |AT91_RTC_SECEV ); -if (at91_rtc_imr) { -if (device_may_wakeup (dev)) + at91_rtc_bkpimr = at91_rtc_imr & (AT91_RTC_ALARM |AT91_RTC_SECEV ); +if (at91_rtc_bkpimr) { +if (device_may_wakeup (dev)) {enable_irq_wake (irq); -else -at91_rtc_write (AT91_RTC_IDR , at91_rtc_imr); - } + }else { +at91_rtc_write (AT91_RTC_IDR , at91_rtc_bkpimr); + at91_rtc_imr &= ~at91_rtc_bkpimr; + } +}return 0 ; }static int at91_rtc_resume (struct device *dev) { -if (at91_rtc_imr) { -if (device_may_wakeup (dev)) +if (at91_rtc_bkpimr) { +if (device_may_wakeup (dev)) {disable_irq_wake (irq); -else -at91_rtc_write (AT91_RTC_IER , at91_rtc_imr); + }else { + at91_rtc_imr |= at91_rtc_bkpimr; +at91_rtc_write (AT91_RTC_IER , at91_rtc_bkpimr); + } }return 0 ; }
drivers/rtc/rtc-at91rm9200.h +0 -1
@@ -64,7 +64,6 @@#define AT91_RTC_SCCR 0x1c/* Status Clear Command Register */ #define AT91_RTC_IER 0x20/* Interrupt Enable Register */ #define AT91_RTC_IDR 0x24/* Interrupt Disable Register */ -#define AT91_RTC_IMR 0x28/* Interrupt Mask Register */ #define AT91_RTC_VER 0x2c/* Valid Entry Register */ #define AT91_RTC_NVTIM (1 << 0)/* Non valid Time */
Greg Kroah-Hartman
maintainerPATCH 51/98 mm/hugetlb: fix total hugetlbfs pages count when using memory overcommit accouting
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wanpeng Li <[email protected]>
commit d00285884c0892bb1310df96bce6056e9ce9b9d9 upstream.
hugetlb_total_pages is used for overcommit calculations but the current implementation considers only the default hugetlb page size (which is either the first defined hugepage size or the one specified by default_hugepagesz kernel boot parameter).
If the system is configured for more than one hugepage size, which is possible since commit a137e1cc6d6e ("hugetlbfs: per mount huge page sizes") then the overcommit estimation done by __vm_enough_memory() (resp. shown by meminfo_proc_show) is not precise - there is an impression of more available/allowed memory. This can lead to an unexpected ENOMEM/EFAULT resp. SIGSEGV when memory is accounted.
Testcase:
boot: hugepagesz=1G hugepages=1
the default overcommit ratio is 50
before patch:
egrep 'CommitLimit' /proc/meminfo
CommitLimit: 55434168 kB
after patch:
egrep 'CommitLimit' /proc/meminfo
CommitLimit: 54909880 kB
--- mm/hugetlb.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
mm/hugetlb.c +6 -2
@@ -2127,8 +2127,12 @@ int hugetlb_report_node_meminfo(int nid,/* Return the number pages of memory we physically have, in PAGE_SIZE units. */ unsigned long hugetlb_total_pages (void ) { -struct hstate *h = &default_hstate; -return h->nr_huge_pages *pages_per_huge_page (h); +struct hstate *h; +unsigned long nr_total_pages =0 ; + +for_each_hstate (h) + nr_total_pages += h->nr_huge_pages *pages_per_huge_page (h); +return nr_total_pages; }static int hugetlb_acct_memory (struct hstate *h,long delta)
Greg Kroah-Hartman
maintainerPATCH 52/98 drivers/video/ep93xx-fb.c: include <linux/io.h> for devm_ioremap()
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: H Hartley Sweeten <[email protected]>
commit e66b05873a7a76afc569da6382509471cba8d5ff upstream.
Commit be8678149701 ("drivers/video/ep93xx-fb.c: use devm_ functions") introduced a build error:
drivers/video/ep93xx-fb.c: In function 'ep93xxfb_probe':
drivers/video/ep93xx-fb.c:532: error: implicit declaration of function 'devm_ioremap' drivers/video/ep93xx-fb.c:533: warning: assignment makes pointer from integer without a cast
Include <linux/io.h> to pickup the declaration of 'devm_ioremap'.
--- drivers/video/ep93xx-fb.c | 1 + 1 file changed, 1 insertion(+)
drivers/video/ep93xx-fb.c +1 -0
@@ -23,6 +23,7 @@#include <linux/slab.h> #include <linux/clk.h> #include <linux/fb.h> +#include <linux/io.h> #include <linux/platform_data/video-ep93xx.h>
Greg Kroah-Hartman
maintainerPATCH 53/98 mqueue: sys_mq_open: do not call mnt_drop_write() if read-only
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Davydov <[email protected]>
commit 38d78e587d4960d0db94add518d27ee74bad2301 upstream.
mnt_drop_write() must be called only if mnt_want_write() succeeded, otherwise the mnt_writers counter will diverge.
mnt_writers counters are used to check if remounting FS as read-only is OK, so after an extra mnt_drop_write() call, it would be impossible to remount mqueue FS as read-only. Besides, on umount a warning would be printed like this one:
=====================================
[ BUG: bad unlock balance detected! ] 3.9.0-rc3 #5 Not tainted
-------------------------------------
a.out/12486 is trying to release lock (sb_writers) at:
mnt_drop_write+0x1f/0x30 but there are no more locks to release!
--- ipc/mqueue.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
ipc/mqueue.c +2 -1
@@ -840,7 +840,8 @@ out_putfd: fd = error; }mutex_unlock (&root->d_inode->i_mutex); -mnt_drop_write (mnt); +if (!ro) +mnt_drop_write (mnt); out_putname:putname (name);return fd;
Greg Kroah-Hartman
maintainerPATCH 54/98 target/iscsi: Fix mutual CHAP auth on big-endian arches
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Grover <[email protected]>
commit 7ac9ad11b2a5cf77a92b58ee6b672ad2fa155eb1 upstream.
See https://bugzilla.redhat.com/show_bug.cgi?id=916290
Used a temp var since we take its address in sg_init_one.
--- drivers/target/iscsi/iscsi_target_auth.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/target/iscsi/iscsi_target_auth.c +4 -1
@@ -166,6 +166,7 @@ static int chap_server_compute_md5( {char *endptr;unsigned long id; +unsigned char id_as_uchar;unsigned char digest[MD5_SIGNATURE_SIZE ];unsigned char type, response[MD5_SIGNATURE_SIZE *2 +2 ];unsigned char identifier[10 ], *challenge =NULL ;
@@ -355,7 +356,9 @@ static int chap_server_compute_md5( goto out; } -sg_init_one (&sg, &id,1 ); +/* To handle both endiannesses */ + id_as_uchar = id; +sg_init_one (&sg, &id_as_uchar,1 ); ret =crypto_hash_update (&desc, &sg,1 );if (ret <0 ) {pr_err ("crypto_hash_update() failed for id\n" );
Greg Kroah-Hartman
maintainerPATCH 55/98 target/file: Bump FD_MAX_SECTORS to 2048 to handle 1M sized I/Os
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Bellinger <[email protected]>
commit f002a24388cc460c8a9be7d446a9871f7c9d52b6 upstream.
This patch bumps the default FILEIO backend FD_MAX_SECTORS value from 1024 -> 2048 in order to allow block_size=512 to handle 1M sized I/Os.
The current default rejects I/Os larger than 512K in sbc_parse_cdb():
[12015.915146] SCSI OP 2ah with too big sectors 1347 exceeds backend hw_max_sectors: 1024 [12015.977744] SCSI OP 2ah with too big sectors 2048 exceeds backend
hw_max_sectors: 1024
This issue is present in >= v3.5 based kernels, introduced after the removal of se_task logic.
--- drivers/target/target_core_file.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/target/target_core_file.h +1 -1
@@ -7,7 +7,7 @@#define FD_DEVICE_QUEUE_DEPTH 32#define FD_MAX_DEVICE_QUEUE_DEPTH 128#define FD_BLOCKSIZE 512 -#define FD_MAX_SECTORS 1024 +#define FD_MAX_SECTORS 2048#define RRF_EMULATE_CDB 0x01#define RRF_GOT_LBA 0x02
Greg Kroah-Hartman
maintainerPATCH 56/98 ARM: tegra: fix register address of slink controller
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laxman Dewangan <[email protected]>
commit 57471c8d3c22873f70813820e6b4d2d1fea9629d upstream.
Fix typo on register address of slink3 controller where register address is wrongly set as 0x7000d480 but it is 0x7000d800.
--- arch/arm/boot/dts/tegra20.dtsi | 2 +- arch/arm/boot/dts/tegra30.dtsi | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
arch/arm/boot/dts/tegra20.dtsi +1 -1
@@ -314,7 +314,7 @@ spi@7000d800 { compatible = "nvidia,tegra20-slink"; - reg = <0x7000d480 0x200>; + reg = <0x7000d800 0x200>; interrupts = <0 83 0x04>; nvidia,dma-request-selector = <&apbdma 17>; #address-cells = <1>;
arch/arm/boot/dts/tegra30.dtsi +1 -1
@@ -309,7 +309,7 @@ spi@7000d800 { compatible = "nvidia,tegra30-slink", "nvidia,tegra20-slink"; - reg = <0x7000d480 0x200>; + reg = <0x7000d800 0x200>; interrupts = <0 83 0x04>; nvidia,dma-request-selector = <&apbdma 17>; #address-cells = <1>;
Greg Kroah-Hartman
maintainerPATCH 57/98 dm thin: fix discard corruption
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Thornber <[email protected]>
commit f046f89a99ccfd9408b94c653374ff3065c7edb3 upstream.
Fix a bug in dm_btree_remove that could leave leaf values with incorrect reference counts. The effect of this was that removal of a shared block could result in the space maps thinking the block was no longer used. More concretely, if you have a thin device and a snapshot of it, sending a discard to a shared region of the thin could corrupt the snapshot.
Thinp uses a 2-level nested btree to store it's mappings. This first level is indexed by thin device, and the second level by logical block.
Often when we're removing an entry in this mapping tree we need to rebalance nodes, which can involve shadowing them, possibly creating a copy if the block is shared. If we do create a copy then children of that node need to have their reference counts incremented. In this way reference counts percolate down the tree as shared trees diverge.
The rebalance functions were incrementing the children at the appropriate time, but they were always assuming the children were internal nodes. This meant the leaf values (in our case packed block/flags entries) were not being incremented.
--- drivers/md/dm-thin.c | 4 +- drivers/md/persistent-data/dm-btree-remove.c | 46 ++++++++++++++------------- 2 files changed, 26 insertions(+), 24 deletions(-)
drivers/md/dm-thin.c +2 -2
@@ -2479,7 +2479,7 @@ static struct target_type pool_target = .name = "thin-pool", .features = DM_TARGET_SINGLETON | DM_TARGET_ALWAYS_WRITEABLE | DM_TARGET_IMMUTABLE, - .version = {1, 6, 1}, + .version = {1, 7, 0}, .module = THIS_MODULE, .ctr = pool_ctr, .dtr = pool_dtr,
@@ -2766,7 +2766,7 @@ static int thin_iterate_devices(struct dstatic struct target_type thin_target = { .name ="thin" , - .version = {1 ,7 ,1 }, + .version = {1 ,8 ,0 }, .module =THIS_MODULE , .ctr = thin_ctr, .dtr = thin_dtr,
drivers/md/persistent-data/dm-btree-remove.c +24 -22
121 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 58/98 dm verity: avoid deadlock
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <[email protected]>
commit 3b6b7813b198b578aa7e04e4047ddb8225c37b7f upstream.
A deadlock was found in the prefetch code in the dm verity map function. This patch fixes this by transferring the prefetch to a worker thread and skipping it completely if kmalloc fails.
If generic_make_request is called recursively, it queues the I/O request on the current->bio_list without making the I/O request and returns. The routine making the recursive call cannot wait for the I/O to complete.
The deadlock occurs when one thread grabs the bufio_client mutex and waits for an I/O to complete but the I/O is queued on another thread's current->bio_list and is waiting to get the mutex held by the first thread.
The fix recognises that prefetching is not essential. If memory can be allocated, it queues the prefetch request to the worker thread, but if not, it does nothing.
--- drivers/md/dm-bufio.c | 2 ++ drivers/md/dm-verity.c | 39 ++++++++++++++++++++++++++++++++++----- 2 files changed, 36 insertions(+), 5 deletions(-)
drivers/md/dm-bufio.c +2 -0
@@ -1026,6 +1026,8 @@ void dm_bufio_prefetch(struct dm_bufio_c {struct blk_plug plug; +BUG_ON (dm_bufio_in_request ()); +blk_start_plug (&plug);dm_bufio_lock (c);
drivers/md/dm-verity.c +34 -5
@@ -93,6 +93,13 @@ struct dm_verity_io {*/ }; +struct dm_verity_prefetch_work { +struct work_struct work; +struct dm_verity *v; +sector_t block; +unsigned n_blocks; +}; +static struct shash_desc *io_hash_desc (struct dm_verity *v,struct dm_verity_io *io) {return (struct shash_desc *)(io +1 );
@@ -424,15 +431,18 @@ static void verity_end_io(struct bio *bi* The root buffer is not prefetched, it is assumed that it will be cached * all the time. */ -static void verity_prefetch_io (struct dm_verity *v,struct dm_verity_io *io) +static void verity_prefetch_io (struct work_struct *work) { +struct dm_verity_prefetch_work *pw = + container_of(work, struct dm_verity_prefetch_work, work); +struct dm_verity *v = pw->v;int i;for (i = v->levels -2 ; i >=0 ; i--) {sector_t hash_block_start;sector_t hash_block_end; -verity_hash_at_level (v, io->block, i, &hash_block_start,NULL ); -verity_hash_at_level (v, io->block + io->n_blocks -1 , i, &hash_block_end,NULL ); +verity_hash_at_level (v, pw->block, i, &hash_block_start,NULL ); +verity_hash_at_level (v, pw->block + pw->n_blocks -1 , i, &hash_block_end,NULL );if (!i) {unsigned cluster =ACCESS_ONCE (dm_verity_prefetch_cluster);
@@ -452,6 +462,25 @@ no_prefetch_cluster:dm_bufio_prefetch (v->bufio, hash_block_start, hash_block_end - hash_block_start +1 ); } + +kfree (pw); +} + +static void verity_submit_prefetch (struct dm_verity *v,struct dm_verity_io *io) +{ +struct dm_verity_prefetch_work *pw; + + pw =kmalloc (sizeof (struct dm_verity_prefetch_work ), +GFP_NOIO | __GFP_NORETRY | __GFP_NOMEMALLOC | __GFP_NOWARN); + +if (!pw) +return ; + +INIT_WORK (&pw->work, verity_prefetch_io); + pw->v = v; + pw->block = io->block; + pw->n_blocks = io->n_blocks; +queue_work (v->verify_wq, &pw->work); }/*
@@ -498,7 +527,7 @@ static int verity_map(struct dm_target *memcpy (io->io_vec,bio_iovec (bio), io->io_vec_size *sizeof (struct bio_vec )); -verity_prefetch_io (v, io); +verity_submit_prefetch (v, io);generic_make_request (bio);
@@ -858,7 +887,7 @@ bad:static struct target_type verity_target = { .name ="verity" , - .version = {1 ,1 ,1 }, + .version = {1 ,2 ,0 }, .module =THIS_MODULE , .ctr = verity_ctr, .dtr = verity_dtr,
Greg Kroah-Hartman
maintainerPATCH 59/98 drm/mgag200: Bug fix: Modified pll algorithm for EH project
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julia Lemire <[email protected]>
commit 260b3f1291a75a580d22ce8bfb1499c617272716 upstream.
While testing the mgag200 kms driver on the HP ProLiant Gen8, a bug was seen. Once the bootloader would load the selected kernel, the screen would go black. At first it was assumed that the mgag200 kms driver was hanging. But after setting up the grub serial output, it was seen that the driver was being loaded properly. After trying serval monitors, one finaly displayed the message "Frequency Out of Range". By comparing the kms pll algorithm with the previous mgag200 xorg driver pll algorithm, discrepencies were found. Once the kms pll algorithm was modified, the expected pll values were produced. This fix was tested on several monitors of varying native resolutions.
--- drivers/gpu/drm/mgag200/mgag200_mode.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/gpu/drm/mgag200/mgag200_mode.c +5 -5
@@ -382,19 +382,19 @@ static int mga_g200eh_set_plls(struct mg m = n = p =0 ; vcomax =800000 ; vcomin =400000 ; - pllreffreq =3333 ; + pllreffreq =33333 ; delta =0xffffffff ; permitteddelta = clock *5 /1000 ; -for (testp =16 ; testp >0 ; testp--) { +for (testp =16 ; testp >0 ; testp >>=1 ) {if (clock * testp > vcomax)continue ;if (clock * testp < vcomin)continue ;for (testm =1 ; testm <33 ; testm++) { -for (testn =1 ; testn <257 ; testn++) { +for (testn =17 ; testn <257 ; testn++) { computed = (pllreffreq * testn) / (testm * testp);if (computed > clock)
@@ -404,11 +404,11 @@ static int mga_g200eh_set_plls(struct mgif (tmpdelta < delta) { delta = tmpdelta; n = testn -1 ; - m = (testm -1 ) | ((n >>1 ) &0x80 ); + m = (testm -1 ); p = testp -1 ; }if ((clock * testp) >=600000 ) - p |=80 ; + p |=0x80 ; } } }
Greg Kroah-Hartman
maintainerPATCH 60/98 drm/radeon: add Richland pci ids
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit b75bbaa038ffc426e88ea3df6c4ae11834fc3e4f upstream.
--- include/drm/drm_pciids.h | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
include/drm/drm_pciids.h +12 -1
@@ -568,7 +568,11 @@ {0x1002, 0x9908, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \ {0x1002, 0x9909, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \ {0x1002, 0x990A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \ - {0x1002, 0x990F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \ + {0x1002, 0x990B, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \ + {0x1002, 0x990C, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \ + {0x1002, 0x990D, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \ + {0x1002, 0x990E, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \ + {0x1002, 0x990F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \ {0x1002, 0x9910, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \ {0x1002, 0x9913, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \ {0x1002, 0x9917, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
@@ -579,6 +583,13 @@ {0x1002, 0x9992, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \ {0x1002, 0x9993, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \ {0x1002, 0x9994, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \ + {0x1002, 0x9995, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \ + {0x1002, 0x9996, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \ + {0x1002, 0x9997, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \ + {0x1002, 0x9998, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \ + {0x1002, 0x9999, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \ + {0x1002, 0x999A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \ + {0x1002, 0x999B, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \ {0x1002, 0x99A0, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \ {0x1002, 0x99A2, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \ {0x1002, 0x99A4, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
Greg Kroah-Hartman
maintainerPATCH 61/98 drm/radeon: add support for Richland APUs
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit e4d170633fde379f39a90f8a5e7eb619b5d1144d upstream.
Richland APUs are a new version of the Trinity APUs with performance and power management improvements.
--- drivers/gpu/drm/radeon/ni.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
drivers/gpu/drm/radeon/ni.c +10 -1
@@ -466,13 +466,19 @@ static void cayman_gpu_init(struct radeo (rdev->pdev->device ==0x9907 ) || (rdev->pdev->device ==0x9908 ) || (rdev->pdev->device ==0x9909 ) || + (rdev->pdev->device ==0x990B ) || + (rdev->pdev->device ==0x990C ) || + (rdev->pdev->device ==0x990F ) || (rdev->pdev->device ==0x9910 ) || - (rdev->pdev->device == 0x9917)) { + (rdev->pdev->device ==0x9917 ) || + (rdev->pdev->device == 0x9999)) { rdev->config.cayman.max_simds_per_se = 6; rdev->config.cayman.max_backends_per_se =2 ; } else if ((rdev->pdev->device == 0x9903) || (rdev->pdev->device ==0x9904 ) || (rdev->pdev->device ==0x990A ) || + (rdev->pdev->device ==0x990D ) || + (rdev->pdev->device ==0x990E ) || (rdev->pdev->device ==0x9913 ) || (rdev->pdev->device ==0x9918 )) { rdev->config.cayman.max_simds_per_se =4 ;
@@ -481,6 +487,9 @@ static void cayman_gpu_init(struct radeo (rdev->pdev->device ==0x9990 ) || (rdev->pdev->device ==0x9991 ) || (rdev->pdev->device ==0x9994 ) || + (rdev->pdev->device ==0x9995 ) || + (rdev->pdev->device ==0x9996 ) || + (rdev->pdev->device ==0x999A ) || (rdev->pdev->device == 0x99A0)) { rdev->config.cayman.max_simds_per_se = 3; rdev->config.cayman.max_backends_per_se =1 ;
Greg Kroah-Hartman
maintainerPATCH 62/98 drm/radeon: fix S/R on VM systems (cayman/TN/SI)
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit fa3daf9aa74a3ac1c87d8188a43d283d06720032 upstream.
We weren't properly tearing down the VM sub-alloctor on suspend leading to bogus VM PTs on resume.
Fixes:
https://bugs.freedesktop.org/show_bug.cgi?id=60439
--- drivers/gpu/drm/radeon/ni.c | 1 + drivers/gpu/drm/radeon/si.c | 1 + 2 files changed, 2 insertions(+)
drivers/gpu/drm/radeon/ni.c +1 -0
@@ -1671,6 +1671,7 @@ int cayman_resume(struct radeon_device *int cayman_suspend (struct radeon_device *rdev) {r600_audio_fini (rdev); +radeon_vm_manager_fini (rdev);cayman_cp_enable (rdev, false);cayman_dma_stop (rdev);evergreen_irq_suspend (rdev);
drivers/gpu/drm/radeon/si.c +1 -0
@@ -4232,6 +4232,7 @@ int si_resume(struct radeon_device *rdevint si_suspend (struct radeon_device *rdev) { +radeon_vm_manager_fini (rdev);si_cp_enable (rdev, false);cayman_dma_stop (rdev);si_irq_suspend (rdev);
Greg Kroah-Hartman
maintainerPATCH 63/98 drm/radeon: fix backend map setup on 1 RB trinity boards
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit 8f612b23a17dce86fef75407e698de6243cc99a1 upstream.
Need to adjust the backend map depending on which RB is enabled. This is the trinity equivalent of:f7eb97300832f4fe5fe916c5d84cd2e25169330e
May fix:
https://bugs.freedesktop.org/show_bug.cgi?id=57919
--- drivers/gpu/drm/radeon/ni.c | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-)
drivers/gpu/drm/radeon/ni.c +16 -5
@@ -623,11 +623,22 @@ static void cayman_gpu_init(struct radeoWREG32 (DMA_TILING_CONFIG +DMA0_REGISTER_OFFSET , gb_addr_config);WREG32 (DMA_TILING_CONFIG +DMA1_REGISTER_OFFSET , gb_addr_config); - tmp = gb_addr_config &NUM_PIPES_MASK ; - tmp =r6xx_remap_render_backend (rdev, tmp, - rdev->config.cayman.max_backends_per_se * - rdev->config.cayman.max_shader_engines, -CAYMAN_MAX_BACKENDS , disabled_rb_mask); +if ((rdev->config.cayman.max_backends_per_se ==1 ) && + (rdev->flags &RADEON_IS_IGP )) { +if ((disabled_rb_mask &3 ) ==1 ) { +/* RB0 disabled, RB1 enabled */ + tmp =0x11111111 ; + }else { +/* RB1 disabled, RB0 enabled */ + tmp =0x00000000 ; + } + }else { + tmp = gb_addr_config &NUM_PIPES_MASK ; + tmp =r6xx_remap_render_backend (rdev, tmp, + rdev->config.cayman.max_backends_per_se * + rdev->config.cayman.max_shader_engines, +CAYMAN_MAX_BACKENDS , disabled_rb_mask); + }WREG32 (GB_BACKEND_MAP , tmp); cgts_tcc_disable =0xffff0000 ;
Greg Kroah-Hartman
maintainerPATCH 64/98 drm/radeon/benchmark: make sure bo blit copy exists before using it
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit fa8d387dc3f62062a6b4afbbb2a3438094fd8584 upstream.
Fixes a segfault on asics without a blit callback.
Fixes:
https://bugs.freedesktop.org/show_bug.cgi?id=62239
--- drivers/gpu/drm/radeon/radeon_benchmark.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-)
drivers/gpu/drm/radeon/radeon_benchmark.c +9 -7
@@ -135,13 +135,15 @@ static void radeon_benchmark_move(struct sdomain, ddomain, "dma"); } - time =radeon_benchmark_do_move (rdev, size, saddr, daddr, -RADEON_BENCHMARK_COPY_BLIT , n); -if (time <0 ) - goto out_cleanup; -if (time >0 ) -radeon_benchmark_log_results (n, size, time, - sdomain, ddomain,"blit" ); +if (rdev->asic->copy.blit) { + time =radeon_benchmark_do_move (rdev, size, saddr, daddr, +RADEON_BENCHMARK_COPY_BLIT , n); +if (time <0 ) + goto out_cleanup; +if (time >0 ) +radeon_benchmark_log_results (n, size, time, + sdomain, ddomain,"blit" ); + } out_cleanup:if (sobj) {
Greg Kroah-Hartman
maintainerPATCH 65/98 cifs: delay super block destruction until all cifsFileInfo objects are gone
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mateusz Guzik <[email protected]>
commit 24261fc23db950951760d00c188ba63cc756b932 upstream.
cifsFileInfo objects hold references to dentries and it is possible that these will still be around in workqueues when VFS decides to kill super block during unmount.
This results in panics like this one:
BUG: Dentry ffff88001f5e76c0{i=66b4a,n=1M-2} still in use (1) [unmount of cifs cifs]
------------[ cut here ]------------
kernel BUG at fs/dcache.c:943!
[..]
Process umount (pid: 1781, threadinfo ffff88003d6e8000, task ffff880035eeaec0)
[..]
Call Trace:
[<ffffffff811b44f3>] shrink_dcache_for_umount+0x33/0x60
[<ffffffff8119f7fc>] generic_shutdown_super+0x2c/0xe0
[<ffffffff8119f946>] kill_anon_super+0x16/0x30
[<ffffffffa036623a>] cifs_kill_sb+0x1a/0x30 [cifs]
[<ffffffff8119fcc7>] deactivate_locked_super+0x57/0x80
[<ffffffff811a085e>] deactivate_super+0x4e/0x70
[<ffffffff811bb417>] mntput_no_expire+0xd7/0x130
[<ffffffff811bc30c>] sys_umount+0x9c/0x3c0
[<ffffffff81657c19>] system_call_fastpath+0x16/0x1bFix this by making each cifsFileInfo object hold a reference to cifs super block, which implicitly keeps VFS super block around as well.
--- fs/cifs/cifsfs.c | 24 ++++++++++++++++++++++++ fs/cifs/cifsfs.h | 4 ++++ fs/cifs/file.c | 6 +++++- 3 files changed, 33 insertions(+), 1 deletion(-)
fs/cifs/cifsfs.c +24 -0
@@ -91,6 +91,30 @@ struct workqueue_struct *cifsiod_wq;__u8 cifs_client_guid[SMB2_CLIENT_GUID_SIZE ];#endif +/* +* Bumps refcount for cifs super block. +* Note that it should be only called if a referece to VFS super block is +* already held, e.g. in open-type syscalls context. Otherwise it can race with +* atomic_dec_and_test in deactivate_locked_super. +*/ +void +cifs_sb_active (struct super_block *sb) +{ +struct cifs_sb_info *server =CIFS_SB (sb); + +if (atomic_inc_return (&server->active) ==1 ) +atomic_inc (&sb->s_active); +} + +void +cifs_sb_deactive (struct super_block *sb) +{ +struct cifs_sb_info *server =CIFS_SB (sb); + +if (atomic_dec_and_test (&server->active)) +deactivate_super (sb); +} +static int cifs_read_super (struct super_block *sb) {
fs/cifs/cifsfs.h +4 -0
@@ -41,6 +41,10 @@ extern struct file_system_type cifs_fs_textern const struct address_space_operations cifs_addr_ops;extern const struct address_space_operations cifs_addr_ops_smallbuf; +/* Functions related to super block operations */ +extern void cifs_sb_active (struct super_block *sb); +extern void cifs_sb_deactive (struct super_block *sb); +/* Functions related to inodes */ extern const struct inode_operations cifs_dir_inode_ops;extern struct inode *cifs_root_iget (struct super_block *);
fs/cifs/file.c +5 -1
@@ -294,6 +294,8 @@ cifs_new_fileinfo(struct cifs_fid *fid,INIT_WORK (&cfile->oplock_break, cifs_oplock_break);mutex_init (&cfile->fh_mutex); +cifs_sb_active (inode->i_sb); +/* * If the server returned a read oplock and we have mandatory brlocks, * set oplock level to None.
@@ -343,7 +345,8 @@ void cifsFileInfo_put(struct cifsFileInfstruct cifs_tcon *tcon =tlink_tcon (cifs_file->tlink);struct TCP_Server_Info *server = tcon->ses->server;struct cifsInodeInfo *cifsi =CIFS_I (inode); -struct cifs_sb_info *cifs_sb =CIFS_SB (inode->i_sb); +struct super_block *sb = inode->i_sb; +struct cifs_sb_info *cifs_sb =CIFS_SB (sb);struct cifsLockInfo *li, *tmp;struct cifs_fid fid;struct cifs_pending_open open;
@@ -408,6 +411,7 @@ void cifsFileInfo_put(struct cifsFileInfcifs_put_tlink (cifs_file->tlink);dput (cifs_file->dentry); +cifs_sb_deactive (sb);kfree (cifs_file); }
Greg Kroah-Hartman
maintainerPATCH 66/98 cifs: ignore everything in SPNEGO blob after mechTypes
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <[email protected]>
commit f853c616883a8de966873a1dab283f1369e275a1 upstream.
We've had several reports of people attempting to mount Windows 8 shares and getting failures with a return code of -EINVAL. The default sec= mode changed recently to sec=ntlmssp. With that, we expect and parse a SPNEGO blob from the server in the NEGOTIATE reply.
The current decode_negTokenInit function first parses all of the mechTypes and then tries to parse the rest of the negTokenInit reply. The parser however currently expects a mechListMIC or nothing to follow the mechTypes, but Windows 8 puts a mechToken field there instead to carry some info for the new NegoEx stuff.
In practice, we don't do anything with the fields after the mechTypes anyway so I don't see any real benefit in continuing to parse them. This patch just has the kernel ignore the fields after the mechTypes. We'll probably need to reinstate some of this if we ever want to support NegoEx.
--- fs/cifs/asn1.c | 53 +++++------------------------------------------------ 1 file changed, 5 insertions(+), 48 deletions(-)
fs/cifs/asn1.c +5 -48
@@ -614,53 +614,10 @@ decode_negTokenInit(unsigned char *secur } } -/* mechlistMIC */ -if (asn1_header_decode (&ctx, &end, &cls, &con, &tag) ==0 ) { -/* Check if we have reached the end of the blob, but with -no mechListMic (e.g. NTLMSSP instead of KRB5) */ -if (ctx.error ==ASN1_ERR_DEC_EMPTY ) - goto decode_negtoken_exit; -cFYI (1 ,"Error decoding last part negTokenInit exit3" ); -return 0 ; - }else if ((cls !=ASN1_CTX ) || (con !=ASN1_CON )) { -/* tag = 3 indicating mechListMIC */ -cFYI (1 ,"Exit 4 cls = %d con = %d tag = %d end = %p (%d)" , - cls, con, tag, end, *end); -return 0 ; - } - -/* sequence */ -if (asn1_header_decode (&ctx, &end, &cls, &con, &tag) ==0 ) { -cFYI (1 ,"Error decoding last part negTokenInit exit5" ); -return 0 ; - }else if ((cls !=ASN1_UNI ) || (con !=ASN1_CON ) - || (tag !=ASN1_SEQ )) { -cFYI (1 ,"cls = %d con = %d tag = %d end = %p (%d)" , - cls, con, tag, end, *end); - } - -/* sequence of */ -if (asn1_header_decode (&ctx, &end, &cls, &con, &tag) ==0 ) { -cFYI (1 ,"Error decoding last part negTokenInit exit 7" ); -return 0 ; - }else if ((cls !=ASN1_CTX ) || (con !=ASN1_CON )) { -cFYI (1 ,"Exit 8 cls = %d con = %d tag = %d end = %p (%d)" , - cls, con, tag, end, *end); -return 0 ; - } - -/* general string */ -if (asn1_header_decode (&ctx, &end, &cls, &con, &tag) ==0 ) { -cFYI (1 ,"Error decoding last part negTokenInit exit9" ); -return 0 ; - }else if ((cls !=ASN1_UNI ) || (con !=ASN1_PRI ) - || (tag !=ASN1_GENSTR )) { -cFYI (1 ,"Exit10 cls = %d con = %d tag = %d end = %p (%d)" , - cls, con, tag, end, *end); -return 0 ; - } -cFYI (1 ,"Need to call asn1_octets_decode() function for %s" , - ctx.pointer);/* is this UTF-8 or ASCII? */ -decode_negtoken_exit: +/* +* We currently ignore anything at the end of the SPNEGO blob after +* the mechTypes have been parsed, since none of that info is +* used at the moment. +*/ return 1 ; }
Greg Kroah-Hartman
maintainerPATCH 67/98 jbd2: fix use after free in jbd2_journal_dirty_metadata()
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
commit ad56edad089b56300fd13bb9eeb7d0424d978239 upstream.
jbd2_journal_dirty_metadata() didn't get a reference to journal_head it was working with. This is OK in most of the cases since the journal head should be attached to a transaction but in rare occasions when we are journalling data, __ext4_journalled_writepage() can race with jbd2_journal_invalidatepage() stripping buffers from a page and thus journal head can be freed under hands of jbd2_journal_dirty_metadata().
Fix the problem by getting own journal head reference in jbd2_journal_dirty_metadata() (and also in jbd2_journal_set_triggers() which can possibly have the same issue).
--- fs/jbd2/transaction.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-)
fs/jbd2/transaction.c +10 -5
@@ -1047,9 +1047,12 @@ out:void jbd2_journal_set_triggers (struct buffer_head *bh,struct jbd2_buffer_trigger_type *type) { -struct journal_head *jh =bh2jh (bh); +struct journal_head *jh =jbd2_journal_grab_journal_head (bh); +if (WARN_ON (!jh)) +return ; jh->b_triggers = type; +jbd2_journal_put_journal_head (jh); } void jbd2_buffer_frozen_trigger(struct journal_head *jh, void *mapped_data,
@@ -1101,17 +1104,18 @@ int jbd2_journal_dirty_metadata(handle_t {transaction_t *transaction = handle->h_transaction;journal_t *journal = transaction->t_journal; -struct journal_head *jh =bh2jh (bh); +struct journal_head *jh;int ret =0 ; -jbd_debug (5 ,"journal_head %p\n" , jh); -JBUFFER_TRACE (jh,"entry" );if (is_handle_aborted (handle)) goto out; -if (!buffer_jbd (bh)) { + jh =jbd2_journal_grab_journal_head (bh); +if (!jh) { ret = -EUCLEAN ; goto out; } +jbd_debug (5 ,"journal_head %p\n" , jh); +JBUFFER_TRACE (jh,"entry" );jbd_lock_bh_state (bh);
@@ -1202,6 +1206,7 @@ int jbd2_journal_dirty_metadata(handle_tspin_unlock (&journal->j_list_lock); out_unlock_bh:jbd_unlock_bh_state (bh); +jbd2_journal_put_journal_head (jh); out:JBUFFER_TRACE (jh,"exit" );WARN_ON (ret);/* All errors are bugs, so dump the stack */
Greg Kroah-Hartman
maintainerPATCH 68/98 ext4: fix the wrong number of the allocated blocks in ext4_split_extent()
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zheng Liu <[email protected]>
commit 3a2256702e47f68f921dfad41b1764d05c572329 upstream.
This commit fixes a wrong return value of the number of the allocated blocks in ext4_split_extent. When the length of blocks we want to allocate is greater than the length of the current extent, we return a wrong number. Let's see what happens in the following case when we call ext4_split_extent().
map: [48, 72]
ex: [32, 64, u]
'ex' will be split into two parts:
ex1: [32, 47, u]
ex2: [48, 64, w]
'map->m_len' is returned from this function, and the value is 24. But the real length is 16. So it should be fixed.
Meanwhile in this commit we use right length of the allocated blocks when get_reserved_cluster_alloc in ext4_ext_handle_uninitialized_extents is called.
--- fs/ext4/extents.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
fs/ext4/extents.c +5 -1
@@ -3089,6 +3089,7 @@ static int ext4_split_extent(handle_t *hint err =0 ;int uninitialized;int split_flag1, flags1; +int allocated = map->m_len; depth =ext_depth (inode); ex = path[depth].p_ext;
@@ -3108,6 +3109,8 @@ static int ext4_split_extent(handle_t *h map->m_lblk + map->m_len, split_flag1, flags1);if (err) goto out; + }else { + allocated = ee_len - (map->m_lblk - ee_block); }ext4_ext_drop_refs (path);
@@ -3130,7 +3133,7 @@ static int ext4_split_extent(handle_t *hext4_ext_show_leaf (inode, path); out: -return err ? err : map->m_len; +return err ? err : allocated; }/*
@@ -3720,6 +3723,7 @@ out: allocated - map->m_len); allocated = map->m_len; } + map->m_len = allocated;/* * If we have done fallocate with the offset that is already
Greg Kroah-Hartman
maintainerPATCH 69/98 usb-storage: add unusual_devs entry for Samsung YP-Z3 mp3 player
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Artamonow <[email protected]>
commit 29f86e66428ee083aec106cca1748dc63d98ce23 upstream.
Device stucks on filesystem writes, unless following quirk is passed:
echo 04e8:5136:m > /sys/module/usb_storage/parameters/quirks
Add corresponding entry to unusual_devs.h
--- drivers/usb/storage/unusual_devs.h | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/usb/storage/unusual_devs.h +7 -0
@@ -488,6 +488,13 @@ UNUSUAL_DEV( 0x04e8, 0x5122, 0x0000, 0x USB_SC_DEVICE, USB_PR_DEVICE, NULL, US_FL_MAX_SECTORS_64 | US_FL_BULK_IGNORE_TAG), +/* Added by Dmitry Artamonow <[email protected]> */ +UNUSUAL_DEV (0x04e8 ,0x5136 ,0x0000 ,0x9999 , +"Samsung" , +"YP-Z3" , +USB_SC_DEVICE ,USB_PR_DEVICE ,NULL , + US_FL_MAX_SECTORS_64), +/* Entry and supporting patch by Theodore Kilgore <[email protected]>. * Device uses standards-violating 32-byte Bulk Command Block Wrappers and * reports itself as "Proprietary SCSI Bulk." Cf. device entry 0x084d:0x0011.
Greg Kroah-Hartman
maintainerPATCH 70/98 ext4: use atomic64_t for the per-flexbg free_clusters count
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Theodore Ts'o <[email protected]>
commit 90ba983f6889e65a3b506b30dc606aa9d1d46cd2 upstream.
A user who was using a 8TB+ file system and with a very large flexbg size (> 65536) could cause the atomic_t used in the struct flex_groups to overflow. This was detected by PaX security patchset:
http://forums.grsecurity.net/viewtopic.php?f=3&t=3289&p=12551#p12551
This bug was introduced in commit 9f24e4208f7e, so it's been around since 2.6.30. :-(
Fix this by using an atomic64_t for struct orlav_stats's free_clusters.
--- fs/ext4/ext4.h | 6 +++--- fs/ext4/ialloc.c | 4 ++-- fs/ext4/mballoc.c | 12 ++++++------ fs/ext4/resize.c | 4 ++-- fs/ext4/super.c | 4 ++-- 5 files changed, 15 insertions(+), 15 deletions(-)
fs/ext4/ext4.h +3 -3
@@ -338,9 +338,9 @@ struct ext4_group_desc*/ struct flex_groups { -atomic_t free_inodes; -atomic_t free_clusters; -atomic_t used_dirs; +atomic64_t free_clusters; +atomic_t free_inodes; +atomic_t used_dirs; };#define EXT4_BG_INODE_UNINIT 0x0001/* Inode table/bitmap not in use */
fs/ext4/ialloc.c +2 -2
@@ -324,8 +324,8 @@ error_return: }struct orlov_stats { +__u64 free_clusters;__u32 free_inodes; -__u32 free_clusters;__u32 used_dirs; };
@@ -342,7 +342,7 @@ static void get_orlov_stats(struct superif (flex_size >1 ) { stats->free_inodes =atomic_read (&flex_group[g].free_inodes); - stats->free_clusters =atomic_read (&flex_group[g].free_clusters); + stats->free_clusters =atomic64_read (&flex_group[g].free_clusters); stats->used_dirs =atomic_read (&flex_group[g].used_dirs);return ; }
fs/ext4/mballoc.c +6 -6
@@ -2829,8 +2829,8 @@ ext4_mb_mark_diskspace_used(struct ext4_if (sbi->s_log_groups_per_flex) {ext4_group_t flex_group =ext4_flex_group (sbi, ac->ac_b_ex.fe_group); -atomic_sub (ac->ac_b_ex.fe_len, - &sbi->s_flex_groups[flex_group].free_clusters); +atomic64_sub (ac->ac_b_ex.fe_len, + &sbi->s_flex_groups[flex_group].free_clusters); } err =ext4_handle_dirty_metadata (handle,NULL , bitmap_bh);
@@ -4691,8 +4691,8 @@ do_more:if (sbi->s_log_groups_per_flex) {ext4_group_t flex_group =ext4_flex_group (sbi, block_group); -atomic_add (count_clusters, - &sbi->s_flex_groups[flex_group].free_clusters); +atomic64_add (count_clusters, + &sbi->s_flex_groups[flex_group].free_clusters); }ext4_mb_unload_buddy (&e4b);
@@ -4836,8 +4836,8 @@ int ext4_group_add_blocks(handle_t *handif (sbi->s_log_groups_per_flex) {ext4_group_t flex_group =ext4_flex_group (sbi, block_group); -atomic_add (EXT4_NUM_B2C (sbi, blocks_freed), - &sbi->s_flex_groups[flex_group].free_clusters); +atomic64_add (EXT4_NUM_B2C (sbi, blocks_freed), + &sbi->s_flex_groups[flex_group].free_clusters); }ext4_mb_unload_buddy (&e4b);
fs/ext4/resize.c +2 -2
@@ -1360,8 +1360,8 @@ static void ext4_update_super(struct sup sbi->s_log_groups_per_flex) {ext4_group_t flex_group; flex_group =ext4_flex_group (sbi, group_data[0 ].group); -atomic_add (EXT4_NUM_B2C (sbi, free_blocks), - &sbi->s_flex_groups[flex_group].free_clusters); +atomic64_add (EXT4_NUM_B2C (sbi, free_blocks), + &sbi->s_flex_groups[flex_group].free_clusters);atomic_add (EXT4_INODES_PER_GROUP (sb) * flex_gd->count, &sbi->s_flex_groups[flex_group].free_inodes); }
fs/ext4/super.c +2 -2
@@ -1979,8 +1979,8 @@ static int ext4_fill_flex_info(struct su flex_group =ext4_flex_group (sbi, i);atomic_add (ext4_free_inodes_count (sb, gdp), &sbi->s_flex_groups[flex_group].free_inodes); -atomic_add (ext4_free_group_clusters (sb, gdp), - &sbi->s_flex_groups[flex_group].free_clusters); +atomic64_add (ext4_free_group_clusters (sb, gdp), + &sbi->s_flex_groups[flex_group].free_clusters);atomic_add (ext4_used_dirs_count (sb, gdp), &sbi->s_flex_groups[flex_group].used_dirs); }
Greg Kroah-Hartman
maintainerPATCH 71/98 ext4: use s_extent_max_zeroout_kb value as number of kb
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukas Czerner <[email protected]>
commit 4f42f80a8f08d4c3f52c4267361241885d5dee3a upstream.
Currently when converting extent to initialized, we have to decide whether to zeroout part/all of the uninitialized extent in order to avoid extent tree growing rapidly.
The decision is made by comparing the size of the extent with the configurable value s_extent_max_zeroout_kb which is in kibibytes units.
However when converting it to number of blocks we currently use it as it was in bytes. This is obviously bug and it will result in ext4 _never_ zeroout extents, but rather always split and convert parts to initialized while leaving the rest uninitialized in default setting.
Fix this by using s_extent_max_zeroout_kb as kibibytes.
--- fs/ext4/extents.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ext4/extents.c +1 -1
@@ -3278,7 +3278,7 @@ static int ext4_ext_convert_to_initializif (EXT4_EXT_MAY_ZEROOUT & split_flag) max_zeroout = sbi->s_extent_max_zeroout_kb >> - inode->i_sb->s_blocksize_bits; + (inode->i_sb->s_blocksize_bits -10 );/* If extent is less than s_max_zeroout_kb, zeroout directly */ if (max_zeroout && (ee_len <= max_zeroout)) {
Greg Kroah-Hartman
maintainerPATCH 72/98 ext4: fix data=journal fast mount/umount hang
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Theodore Ts'o <[email protected]>
commit 2b405bfa84063bfa35621d2d6879f52693c614b0 upstream.
In data=journal mode, if we unmount the file system before a transaction has a chance to complete, when the journal inode is being evicted, we can end up calling into jbd2_log_wait_commit() for the last transaction, after the journalling machinery has been shut down.
Arguably we should adjust ext4_should_journal_data() to return FALSE for the journal inode, but the only place it matters is ext4_evict_inode(), and so to save a bit of CPU time, and to make the patch much more obviously correct by inspection(tm), we'll fix it by explicitly not trying to waiting for a journal commit when we are evicting the journal inode, since it's guaranteed to never succeed in this case.
This can be easily replicated via:
mount -t ext4 -o data=journal /dev/vdb /vdb ; umount /vdb
------------[ cut here ]------------ WARNING: at /usr/projects/linux/ext4/fs/jbd2/journal.c:542 __jbd2_log_start_commit+0xba/0xcd() Hardware name: Bochs JBD2: bad log_start_commit: 3005630206 3005630206 0 0 Modules linked in: Pid: 2909, comm: umount Not tainted 3.8.0-rc3 #1020 Call Trace: [<c015c0ef>] warn_slowpath_common+0x68/0x7d [<c02b7e7d>] ? __jbd2_log_start_commit+0xba/0xcd [<c015c177>] warn_slowpath_fmt+0x2b/0x2f [<c02b7e7d>] __jbd2_log_start_commit+0xba/0xcd [<c02b8075>] jbd2_log_start_commit+0x24/0x34 [<c0279ed5>] ext4_evict_inode+0x71/0x2e3 [<c021f0ec>] evict+0x94/0x135 [<c021f9aa>] iput+0x10a/0x110 [<c02b7836>] jbd2_journal_destroy+0x190/0x1ce [<c0175284>] ? bit_waitqueue+0x50/0x50 [<c028d23f>] ext4_put_super+0x52/0x294 [<c020efe3>] generic_shutdown_super+0x48/0xb4 [<c020f071>] kill_block_super+0x22/0x60 [<c020f3e0>] deactivate_locked_super+0x22/0x49 [<c020f5d6>] deactivate_super+0x30/0x33 [<c0222795>] mntput_no_expire+0x107/0x10c [<c02233a7>] sys_umount+0x2cf/0x2e0 [<c02233ca>] sys_oldumount+0x12/0x14 [<c08096b8>] syscall_call+0x7/0xb ---[ end trace 6a954cc790501c1f ]---
jbd2_log_wait_commit: error: j_commit_request=-1289337090, tid=0
--- fs/ext4/inode.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/ext4/inode.c +2 -1
@@ -211,7 +211,8 @@ void ext4_evict_inode(struct inode *inod* don't use page cache. */ if (ext4_should_journal_data (inode) && - (S_ISLNK (inode->i_mode) ||S_ISREG (inode->i_mode))) { + (S_ISLNK (inode->i_mode) ||S_ISREG (inode->i_mode)) && + inode->i_ino !=EXT4_JOURNAL_INO ) {journal_t *journal =EXT4_SB (inode->i_sb)->s_journal;tid_t commit_tid =EXT4_I (inode)->i_datasync_tid;
Greg Kroah-Hartman
maintainerPATCH 73/98 IPoIB: Fix send lockup due to missed TX completion
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Marciniszyn <[email protected]>
commit 1ee9e2aa7b31427303466776f455d43e5e3c9275 upstream.
Commit f0dc117abdfa ("IPoIB: Fix TX queue lockup with mixed UD/CM traffic") attempts to solve an issue where unprocessed UD send completions can deadlock the netdev.
The patch doesn't fully resolve the issue because if more than half the tx_outstanding's were UD and all of the destinations are RC reachable, arming the CQ doesn't solve the issue.
This patch uses the IB_CQ_REPORT_MISSED_EVENTS on the ib_req_notify_cq(). If the rc is above 0, the UD send cq completion callback is called directly to re-arm the send completion timer.
This issue is seen in very large parallel filesystem deployments and the patch has been shown to correct the issue.
--- drivers/infiniband/ulp/ipoib/ipoib_cm.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/infiniband/ulp/ipoib/ipoib_cm.c +6 -2
@@ -758,9 +758,13 @@ void ipoib_cm_send(struct net_device *deif (++priv->tx_outstanding == ipoib_sendq_size) {ipoib_dbg (priv,"TX ring 0x%x full, stopping kernel net queue\n" , tx->qp->qp_num); -if (ib_req_notify_cq (priv->send_cq,IB_CQ_NEXT_COMP )) -ipoib_warn (priv,"request notify on send CQ failed\n" );netif_stop_queue (dev); + rc =ib_req_notify_cq (priv->send_cq, +IB_CQ_NEXT_COMP |IB_CQ_REPORT_MISSED_EVENTS ); +if (rc <0 ) +ipoib_warn (priv,"request notify on send CQ failed\n" ); +else if (rc) +ipoib_send_comp_handler (priv->send_cq, dev); } } }
Greg Kroah-Hartman
maintainerPATCH 74/98 watchdog: sp5100_tco: Set the AcpiMmioSel bitmask value to 1 instead of 2
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takahisa Tanaka <[email protected]>
commit 81fc933f176cd95f757bfc8a98109ef422598b79 upstream.
The AcpiMmioSel bit is bit 1 in the AcpiMmioEn register, but the current sp5100_tco driver is using bit 2.
See 2.3.3 Power Management (PM) Registers page 150 of the AMD SB800-Series Southbridges Register Reference Guide [1].
AcpiMmioEn - RW – 8/16/32 bits - [PM_Reg: 24h]
Field Name Bits Default Description
AcpiMMioDecodeEn 0 0b Set to 1 to enable AcpiMMio space.
AcpiMMIoSel 1 0b Set AcpiMMio registers to be memory-mapped or IO-mapped space.
0: Memory-mapped space 1: I/O-mapped space
The sp5100_tco driver expects zero as a value of AcpiMmioSel (bit 1).
Fortunately, no problems were caused by this typo, because the default value of the undocumented misused bit 2 seems to be zero.
However, the sp5100_tco driver should use the correct bitmask value.
[1] http://support.amd.com/us/Embedded_TechDocs/45482.pdf
--- drivers/watchdog/sp5100_tco.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/watchdog/sp5100_tco.h +1 -1
@@ -57,7 +57,7 @@#define SB800_PM_WATCHDOG_DISABLE (1 << 2)#define SB800_PM_WATCHDOG_SECOND_RES (3 << 0)#define SB800_ACPI_MMIO_DECODE_EN (1 << 0) -#define SB800_ACPI_MMIO_SEL (1 << 2) +#define SB800_ACPI_MMIO_SEL (1 << 1)#define SB800_PM_WDT_MMIO_OFFSET 0xB00
Greg Kroah-Hartman
maintainerPATCH 75/98 watchdog: sp5100_tco: Remove code that may cause a boot failure
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takahisa Tanaka <[email protected]>
commit 18e4321276fcf083b85b788fee7cf15be29ed72a upstream.
A problem was found on PC's with the SB700 chipset: The PC fails to load BIOS after running the 3.8.x kernel until the power is completely cut off. It occurs in all 3.8.x versions and the mainline version as of 2/4. The issue does not occur with the 3.7.x builds.
There are two methods for accessing the watchdog registers.
1. Re-programming a resource address obtained by allocate_resource()
to chipset.
2. Use the direct memory-mapped IO access.
The method 1 can be used by all the chipsets (SP5100, SB7x0, SB8x0 or later). However, experience shows that only PC with the SB8x0 (or later) chipsets can use the method 2.
This patch removes the method 1, because the critical problem was found. That's why the watchdog timer was able to be used on SP5100 and SB7x0 chipsets until now.
--- drivers/watchdog/sp5100_tco.c | 126 ++---------------------------------------- 1 file changed, 6 insertions(+), 120 deletions(-)
drivers/watchdog/sp5100_tco.c +6 -120
@@ -40,13 +40,12 @@#include "sp5100_tco.h" /* Module and version information */ -#define TCO_VERSION "0.03" +#define TCO_VERSION "0.05"#define TCO_MODULE_NAME "SP5100 TCO timer"#define TCO_DRIVER_NAME TCO_MODULE_NAME ", v" TCO_VERSION/* internal variables */ static u32 tcobase_phys; -static u32 resbase_phys;static u32 tco_wdt_fired;static void __iomem *tcobase;static unsigned int pm_iobase;
@@ -54,10 +53,6 @@ static DEFINE_SPINLOCK(tco_lock); /* Guastatic unsigned long timer_alive;static char tco_expect_close;static struct pci_dev *sp5100_tco_pci; -static struct resource wdt_res = { - .name ="Watchdog Timer" , - .flags =IORESOURCE_MEM , -};/* the watchdog platform device */ static struct platform_device *sp5100_tco_platform_device;
@@ -75,12 +70,6 @@ module_param(nowayout, bool, 0); MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started." " (default=" __MODULE_STRING(WATCHDOG_NOWAYOUT) ")"); -static unsigned int force_addr; -module_param (force_addr, uint,0 ); -MODULE_PARM_DESC (force_addr,"Force the use of specified MMIO address." -" ONLY USE THIS PARAMETER IF YOU REALLY KNOW" -" WHAT YOU ARE DOING (default=none)" ); -/* * Some TCO specific functions */
@@ -176,39 +165,6 @@ static void tco_timer_enable(void) } } -static void tco_timer_disable (void ) -{ -int val; - -if (sp5100_tco_pci->revision >=0x40 ) { -/* For SB800 or later */ -/* Enable watchdog decode bit and Disable watchdog timer */ -outb (SB800_PM_WATCHDOG_CONTROL ,SB800_IO_PM_INDEX_REG ); - val =inb (SB800_IO_PM_DATA_REG ); - val |=SB800_PCI_WATCHDOG_DECODE_EN ; - val |=SB800_PM_WATCHDOG_DISABLE ; -outb (val,SB800_IO_PM_DATA_REG ); - }else { -/* For SP5100 or SB7x0 */ -/* Enable watchdog decode bit */ -pci_read_config_dword (sp5100_tco_pci, -SP5100_PCI_WATCHDOG_MISC_REG , - &val); - - val |=SP5100_PCI_WATCHDOG_DECODE_EN ; - -pci_write_config_dword (sp5100_tco_pci, -SP5100_PCI_WATCHDOG_MISC_REG , - val); - -/* Disable Watchdog timer */ -outb (SP5100_PM_WATCHDOG_CONTROL ,SP5100_IO_PM_INDEX_REG ); - val =inb (SP5100_IO_PM_DATA_REG ); - val |=SP5100_PM_WATCHDOG_DISABLE ; -outb (val,SP5100_IO_PM_DATA_REG ); - } -} -/* * /dev/watchdog handling */
@@ -361,7 +317,7 @@ static unsigned char sp5100_tco_setupdev {struct pci_dev *dev =NULL ;const char *dev_name =NULL ; -u32 val, tmp_val; +u32 val;u32 index_reg, data_reg, base_addr;/* Match the PCI device */
@@ -459,63 +415,8 @@ static unsigned char sp5100_tco_setupdev }else pr_debug ("SBResource_MMIO is disabled(0x%04x)\n" , val); -/* -* Lastly re-programming the watchdog timer MMIO address, -* This method is a last resort... -* -* Before re-programming, to ensure that the watchdog timer -* is disabled, disable the watchdog timer. -*/ -tco_timer_disable (); - -if (force_addr) { -/* -* Force the use of watchdog timer MMIO address, and aligned to -* 8byte boundary. -*/ - force_addr &= ~0x7 ; - val = force_addr; - -pr_info ("Force the use of 0x%04x as MMIO address\n" , val); - }else { -/* -* Get empty slot into the resource tree for watchdog timer. -*/ -if (allocate_resource (&iomem_resource, - &wdt_res, -SP5100_WDT_MEM_MAP_SIZE , -0xf0000000 , -0xfffffff8 , -0x8 , -NULL , -NULL )) { -pr_err ("MMIO allocation failed\n" ); - goto unreg_region; - } - - val = resbase_phys = wdt_res.start; -pr_debug ("Got 0x%04x from resource tree\n" , val); - } - -/* Restore to the low three bits */ -outb (base_addr+0 , index_reg); - tmp_val = val | (inb (data_reg) &0x7 ); - -/* Re-programming the watchdog timer base address */ -outb (base_addr+0 , index_reg); -outb ((tmp_val >>0 ) &0xff , data_reg); -outb (base_addr+1 , index_reg); -outb ((tmp_val >>8 ) &0xff , data_reg); -outb (base_addr+2 , index_reg); -outb ((tmp_val >>16 ) &0xff , data_reg); -outb (base_addr+3 , index_reg); -outb ((tmp_val >>24 ) &0xff , data_reg); - -if (!request_mem_region_exclusive (val,SP5100_WDT_MEM_MAP_SIZE , - dev_name)) { -pr_err ("MMIO address 0x%04x already in use\n" , val); - goto unreg_resource; - } +pr_notice ("failed to find MMIO address, giving up.\n" ); + goto unreg_region; setup_wdt: tcobase_phys = val;
@@ -555,9 +456,6 @@ setup_wdt: unreg_mem_region:release_mem_region (tcobase_phys,SP5100_WDT_MEM_MAP_SIZE ); -unreg_resource: -if (resbase_phys) -release_resource (&wdt_res); unreg_region:release_region (pm_iobase,SP5100_PM_IOPORTS_SIZE ); exit:
@@ -567,7 +465,6 @@ exit:static int sp5100_tco_init (struct platform_device *dev) {int ret; -char addr_str[16 ];/* * Check whether or not the hardware watchdog is there. If found, then
@@ -599,23 +496,14 @@ static int sp5100_tco_init(struct platfoclear_bit (0 , &timer_alive);/* Show module parameters */ -if (force_addr == tcobase_phys) -/* The force_addr is vaild */ -sprintf (addr_str,"0x%04x" , force_addr); -else -strcpy (addr_str,"none" ); - -pr_info ("initialized (0x%p). heartbeat=%d sec (nowayout=%d, " -"force_addr=%s)\n" , - tcobase, heartbeat, nowayout, addr_str); +pr_info ("initialized (0x%p). heartbeat=%d sec (nowayout=%d)\n" , + tcobase, heartbeat, nowayout);return 0 ; exit:iounmap (tcobase);release_mem_region (tcobase_phys,SP5100_WDT_MEM_MAP_SIZE ); -if (resbase_phys) -release_resource (&wdt_res);release_region (pm_iobase,SP5100_PM_IOPORTS_SIZE );return ret; }
@@ -630,8 +518,6 @@ static void sp5100_tco_cleanup(void)misc_deregister (&sp5100_tco_miscdev);iounmap (tcobase);release_mem_region (tcobase_phys,SP5100_WDT_MEM_MAP_SIZE ); -if (resbase_phys) -release_resource (&wdt_res);release_region (pm_iobase,SP5100_PM_IOPORTS_SIZE ); }
Greg Kroah-Hartman
maintainerPATCH 76/98 md/raid5: schedule_construction should abort if nothing to do.
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <[email protected]>
commit ce7d363aaf1e28be8406a2976220944ca487e8ca upstream.
Since commit 1ed850f356a0a422013846b5291acff08815008b
md/raid5: make sure to_read and to_write never go negative.
It has been possible for handle_stripe_dirtying to be called when there isn't actually any work to do.
It then calls schedule_reconstruction() which will set R5_LOCKED on the parity block(s) even when nothing else is happening. This then causes problems in do_release_stripe().
So add checks to schedule_reconstruction() so that if it doesn't find anything to do, it just aborts.
This bug was introduced in v3.7, so the patch is suitable for -stable kernels since then.
--- drivers/md/raid5.c | 38 ++++++++++++++++++++++---------------- 1 file changed, 22 insertions(+), 16 deletions(-)
drivers/md/raid5.c +22 -16
@@ -2319,17 +2319,6 @@ schedule_reconstruction(struct stripe_heint level = conf->level;if (rcw) { -/* if we are not expanding this is a proper write request, and -* there will be bios with new data to be drained into the -* stripe cache -*/ -if (!expand) { - sh->reconstruct_state = reconstruct_state_drain_run; -set_bit (STRIPE_OP_BIODRAIN , &s->ops_request); - }else - sh->reconstruct_state = reconstruct_state_run; - -set_bit (STRIPE_OP_RECONSTRUCT , &s->ops_request);for (i = disks; i--; ) {struct r5dev *dev = &sh->dev[i];
@@ -2342,6 +2331,21 @@ schedule_reconstruction(struct stripe_he s->locked++; } } +/* if we are not expanding this is a proper write request, and +* there will be bios with new data to be drained into the +* stripe cache +*/ +if (!expand) { +if (!s->locked) +/* False alarm, nothing to do */ +return ; + sh->reconstruct_state = reconstruct_state_drain_run; +set_bit (STRIPE_OP_BIODRAIN , &s->ops_request); + }else + sh->reconstruct_state = reconstruct_state_run; + +set_bit (STRIPE_OP_RECONSTRUCT , &s->ops_request); +if (s->locked + conf->max_degraded == disks)if (!test_and_set_bit (STRIPE_FULL_WRITE , &sh->state))atomic_inc (&conf->pending_full_writes);
@@ -2350,11 +2354,6 @@ schedule_reconstruction(struct stripe_heBUG_ON (!(test_bit (R5_UPTODATE , &sh->dev[pd_idx].flags) ||test_bit (R5_Wantcompute, &sh->dev[pd_idx].flags))); - sh->reconstruct_state = reconstruct_state_prexor_drain_run; -set_bit (STRIPE_OP_PREXOR , &s->ops_request); -set_bit (STRIPE_OP_BIODRAIN , &s->ops_request); -set_bit (STRIPE_OP_RECONSTRUCT , &s->ops_request); -for (i = disks; i--; ) {struct r5dev *dev = &sh->dev[i];if (i == pd_idx)
@@ -2369,6 +2368,13 @@ schedule_reconstruction(struct stripe_he s->locked++; } } +if (!s->locked) +/* False alarm - nothing to do */ +return ; + sh->reconstruct_state = reconstruct_state_prexor_drain_run; +set_bit (STRIPE_OP_PREXOR , &s->ops_request); +set_bit (STRIPE_OP_BIODRAIN , &s->ops_request); +set_bit (STRIPE_OP_RECONSTRUCT , &s->ops_request); }/* keep the parity disk(s) locked while asynchronous operations
Greg Kroah-Hartman
maintainerPATCH 77/98 MD RAID5: Avoid accessing gendisk or queue structs when not available
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonathan Brassow <[email protected]>
commit e3620a3ad52609f64a2402e4b59300afb4b83b77 upstream.
MD RAID5: Fix kernel oops when RAID4/5/6 is used via device-mapper
Commit a9add5d (v3.8-rc1) added blktrace calls to the RAID4/5/6 driver. However, when device-mapper is used to create RAID4/5/6 arrays, the mddev->gendisk and mddev->queue fields are not setup. Therefore, calling things like trace_block_bio_remap will cause a kernel oops. This patch conditionalizes those calls on whether the proper fields exist to make the calls. (Device-mapper will call trace_block_bio_remap on its own.)
This patch is suitable for the 3.8.y stable kernel.
--- drivers/md/raid5.c | 33 ++++++++++++++++++++------------- 1 file changed, 20 insertions(+), 13 deletions(-)
drivers/md/raid5.c +20 -13
@@ -674,9 +674,11 @@ static void ops_run_io(struct stripe_hea bi->bi_next =NULL ;if (rrdev)set_bit (R5_DOUBLE_LOCKED , &sh->dev[i].flags); -trace_block_bio_remap (bdev_get_queue (bi->bi_bdev), - bi,disk_devt (conf->mddev->gendisk), - sh->dev[i].sector); + +if (conf->mddev->gendisk) +trace_block_bio_remap (bdev_get_queue (bi->bi_bdev), + bi,disk_devt (conf->mddev->gendisk), + sh->dev[i].sector);generic_make_request (bi); }if (rrdev) {
@@ -704,9 +706,10 @@ static void ops_run_io(struct stripe_hea rbi->bi_io_vec[0 ].bv_offset =0 ; rbi->bi_size =STRIPE_SIZE ; rbi->bi_next =NULL ; -trace_block_bio_remap (bdev_get_queue (rbi->bi_bdev), - rbi,disk_devt (conf->mddev->gendisk), - sh->dev[i].sector); +if (conf->mddev->gendisk) +trace_block_bio_remap (bdev_get_queue (rbi->bi_bdev), + rbi,disk_devt (conf->mddev->gendisk), + sh->dev[i].sector);generic_make_request (rbi); }if (!rdev && !rrdev) {
@@ -2871,8 +2874,10 @@ static void handle_stripe_dirtying(strucset_bit (STRIPE_HANDLE , &sh->state);if (rmw < rcw && rmw >0 ) {/* prefer read-modify-write, but need to get some data */ -blk_add_trace_msg (conf->mddev->queue,"raid5 rmw %llu %d" , - (unsigned long long )sh->sector, rmw); +if (conf->mddev->queue) +blk_add_trace_msg (conf->mddev->queue, +"raid5 rmw %llu %d" , + (unsigned long long )sh->sector, rmw);for (i = disks; i--; ) {struct r5dev *dev = &sh->dev[i]; if ((dev->towrite || i == sh->pd_idx) &&
@@ -2922,7 +2927,7 @@ static void handle_stripe_dirtying(struc } } } -if (rcw) +if (rcw && conf->mddev->queue)blk_add_trace_msg (conf->mddev->queue,"raid5 rcw %llu %d %d %d" , (unsigned long long )sh->sector, rcw, qread,test_bit (STRIPE_DELAYED , &sh->state));
@@ -4029,9 +4034,10 @@ static int chunk_aligned_read(struct mddatomic_inc (&conf->active_aligned_reads);spin_unlock_irq (&conf->device_lock); -trace_block_bio_remap (bdev_get_queue (align_bi->bi_bdev), - align_bi,disk_devt (mddev->gendisk), - raid_bio->bi_sector); +if (mddev->gendisk) +trace_block_bio_remap (bdev_get_queue (align_bi->bi_bdev), + align_bi,disk_devt (mddev->gendisk), + raid_bio->bi_sector);generic_make_request (align_bi);return 1 ; }else {
@@ -4125,7 +4131,8 @@ static void raid5_unplug(struct blk_plug }spin_unlock_irq (&conf->device_lock); } -trace_block_unplug (mddev->queue, cnt, !from_schedule); +if (mddev->queue) +trace_block_unplug (mddev->queue, cnt, !from_schedule);kfree (cb); }
Greg Kroah-Hartman
maintainerPATCH 78/98 md/raid5: ensure sync and DISCARD dont happen at the same time.
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <[email protected]>
commit f8dfcffd0472a0f353f34a567ad3f53568914d04 upstream.
A number of problems can occur due to races between resync/recovery and discard.
- if sync_request calls handle_stripe() while a discard is happening on the stripe, it might call handle_stripe_clean_event before all of the individual discard requests have completed (so some devices are still locked, but not all).
Since commit ca64cae96037de16e4af92678814f5d4bf0c1c65
md/raid5: Make sure we clear R5_Discard when discard is finished.
this will cause R5_Discard to be cleared for the parity device, so handle_stripe_clean_event() will not be called when the other devices do become unlocked, so their ->written will not be cleared. This ultimately leads to a WARN_ON in init_stripe and a lock-up.
- If handle_stripe_clean_event() does clear R5_UPTODATE at an awkward time for resync, it can lead to s->uptodate being less than disks in handle_parity_checks5(), which triggers a BUG (because it is one).
So:
- keep R5_Discard on the parity device until all other devices have completed their discard request
- make sure we don't try to have a 'discard' and a 'sync' action at the same time.
This involves a new stripe flag to we know when a 'discard' is happening, and the use of R5_Overlap on the parity disk so when a discard is wanted while a sync is active, so we know to wake up the discard at the appropriate time.
Discard support for RAID5 was added in 3.7, so this is suitable for any -stable kernel since 3.7.
--- drivers/md/raid5.c | 45 +++++++++++++++++++++++++++++++++++++++------ drivers/md/raid5.h | 1 + 2 files changed, 40 insertions(+), 6 deletions(-)
drivers/md/raid5.c +39 -6
@@ -2612,6 +2612,8 @@ handle_failed_sync(struct r5conf *conf,int i;clear_bit (STRIPE_SYNCING , &sh->state); +if (test_and_clear_bit (R5_Overlap, &sh->dev[sh->pd_idx].flags)) +wake_up (&conf->wait_for_overlap); s->syncing =0 ; s->replacing =0 ;/* There is nothing more to do for sync/check/repair.
@@ -2785,6 +2787,7 @@ static void handle_stripe_clean_event(st {int i;struct r5dev *dev; +int discard_pending =0 ;for (i = disks; i--; )if (sh->dev[i].written) {
@@ -2813,9 +2816,23 @@ static void handle_stripe_clean_event(stSTRIPE_SECTORS , !test_bit (STRIPE_DEGRADED , &sh->state), 0); - } - }else if (test_bit (R5_Discard, &sh->dev[i].flags)) -clear_bit (R5_Discard, &sh->dev[i].flags); + }else if (test_bit (R5_Discard, &dev->flags)) + discard_pending =1 ; + } +if (!discard_pending && +test_bit (R5_Discard, &sh->dev[sh->pd_idx].flags)) { +clear_bit (R5_Discard, &sh->dev[sh->pd_idx].flags); +clear_bit (R5_UPTODATE , &sh->dev[sh->pd_idx].flags); +if (sh->qd_idx >=0 ) { +clear_bit (R5_Discard, &sh->dev[sh->qd_idx].flags); +clear_bit (R5_UPTODATE , &sh->dev[sh->qd_idx].flags); + } +/* now that discard is done we can proceed with any sync */ +clear_bit (STRIPE_DISCARD , &sh->state); +if (test_bit (STRIPE_SYNC_REQUESTED , &sh->state)) +set_bit (STRIPE_HANDLE , &sh->state); + + }if (test_and_clear_bit (STRIPE_FULL_WRITE , &sh->state))if (atomic_dec_and_test (&conf->pending_full_writes))
@@ -3467,9 +3484,15 @@ static void handle_stripe(struct stripe_return ; } -if (test_and_clear_bit (STRIPE_SYNC_REQUESTED , &sh->state)) { -set_bit (STRIPE_SYNCING , &sh->state); -clear_bit (STRIPE_INSYNC , &sh->state); +if (test_bit (STRIPE_SYNC_REQUESTED , &sh->state)) { +spin_lock (&sh->stripe_lock); +/* Cannot process 'sync' concurrently with 'discard' */ +if (!test_bit (STRIPE_DISCARD , &sh->state) && +test_and_clear_bit (STRIPE_SYNC_REQUESTED , &sh->state)) { +set_bit (STRIPE_SYNCING , &sh->state); +clear_bit (STRIPE_INSYNC , &sh->state); + } +spin_unlock (&sh->stripe_lock); }clear_bit (STRIPE_DELAYED , &sh->state);
@@ -3629,6 +3652,8 @@ static void handle_stripe(struct stripe_ test_bit(STRIPE_INSYNC, &sh->state)) {md_done_sync (conf->mddev,STRIPE_SECTORS ,1 );clear_bit (STRIPE_SYNCING , &sh->state); +if (test_and_clear_bit (R5_Overlap, &sh->dev[sh->pd_idx].flags)) +wake_up (&conf->wait_for_overlap); }/* If the failed drives are just a ReadError, then we might need
@@ -4195,6 +4220,13 @@ static void make_discard_request(struct sh =get_active_stripe (conf, logical_sector,0 ,0 ,0 );prepare_to_wait (&conf->wait_for_overlap, &w,TASK_UNINTERRUPTIBLE ); +set_bit (R5_Overlap, &sh->dev[sh->pd_idx].flags); +if (test_bit (STRIPE_SYNCING , &sh->state)) { +release_stripe (sh); +schedule (); + goto again; + } +clear_bit (R5_Overlap, &sh->dev[sh->pd_idx].flags);spin_lock_irq (&sh->stripe_lock);for (d =0 ; d < conf->raid_disks; d++) {if (d == sh->pd_idx || d == sh->qd_idx)
@@ -4207,6 +4239,7 @@ static void make_discard_request(struct goto again; } } +set_bit (STRIPE_DISCARD , &sh->state);finish_wait (&conf->wait_for_overlap, &w);for (d =0 ; d < conf->raid_disks; d++) {if (d == sh->pd_idx || d == sh->qd_idx)
drivers/md/raid5.h +1 -0
@@ -323,6 +323,7 @@ enum {STRIPE_COMPUTE_RUN ,STRIPE_OPS_REQ_PENDING ,STRIPE_ON_UNPLUG_LIST , + STRIPE_DISCARD, };/*
Greg Kroah-Hartman
maintainerPATCH 79/98 nfsd: fix bad offset use
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kent Overstreet <[email protected]>
commit e49dbbf3e770aa590a8a464ac4978a09027060b9 upstream.
vfs_writev() updates the offset argument - but the code then passes the offset to vfs_fsync_range(). Since offset now points to the offset after what was just written, this is probably not what was intended
Introduced by face15025ffdf664de95e86ae831544154d26c9c "nfsd: use vfs_fsync_range(), not O_SYNC, for stable writes".
--- fs/nfsd/vfs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/nfsd/vfs.c +2 -1
@@ -1013,6 +1013,7 @@ nfsd_vfs_write(struct svc_rqst *rqstp, sint host_err;int stable = *stablep;int use_wgather; +loff_t pos = offset; dentry = file->f_path.dentry; inode = dentry->d_inode;
@@ -1025,7 +1026,7 @@ nfsd_vfs_write(struct svc_rqst *rqstp, s/* Write the data. */ oldfs =get_fs ();set_fs (KERNEL_DS ); - host_err =vfs_writev (file, (struct iovec __user *)vec, vlen, &offset); + host_err =vfs_writev (file, (struct iovec __user *)vec, vlen, &pos);set_fs (oldfs);if (host_err <0 ) goto out_nfserr;
Greg Kroah-Hartman
maintainerPATCH 80/98 clockevents: Dont allow dummy broadcast timers
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <[email protected]>
commit a7dc19b8652c862d5b7c4d2339bd3c428bd29c4a upstream.
Currently tick_check_broadcast_device doesn't reject clock_event_devices with CLOCK_EVT_FEAT_DUMMY, and may select them in preference to real hardware if they have a higher rating value. In this situation, the dummy timer is responsible for broadcasting to itself, and the core clockevents code may attempt to call non-existent callbacks for programming the dummy, eventually leading to a panic.
This patch makes tick_check_broadcast_device always reject dummy timers, preventing this problem.
--- kernel/time/tick-broadcast.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
kernel/time/tick-broadcast.c +2 -1
@@ -66,7 +66,8 @@ static void tick_broadcast_start_periodi*/ int tick_check_broadcast_device (struct clock_event_device *dev) { -if ((tick_broadcast_device.evtdev && +if ((dev->features &CLOCK_EVT_FEAT_DUMMY ) || + (tick_broadcast_device.evtdev && tick_broadcast_device.evtdev->rating >= dev->rating) || (dev->features &CLOCK_EVT_FEAT_C3STOP ))return 0 ;
Greg Kroah-Hartman
maintainerPATCH 81/98 x86-64: Fix the failure case in copy_user_handle_tail()
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: CQ Tang <[email protected]>
commit 66db3feb486c01349f767b98ebb10b0c3d2d021b upstream.
The increment of "to" in copy_user_handle_tail() will have incremented before a failure has been noted. This causes us to skip a byte in the failure case.
Only do the increment when assured there is no failure.
--- arch/x86/lib/usercopy_64.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/x86/lib/usercopy_64.c +2 -2
@@ -74,10 +74,10 @@ copy_user_handle_tail(char *to, char *frchar c;unsigned zero_len; -for (; len; --len) { +for (; len; --len, to++) {if (__get_user_nocheck (c, from++,sizeof (char )))break ; -if (__put_user_nocheck (c, to++,sizeof (char ))) +if (__put_user_nocheck (c, to,sizeof (char )))break ; }
Greg Kroah-Hartman
maintainerPATCH 82/98 USB: xhci - fix bit definitions for IMAN register
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <[email protected]>
commit f8264340e694604863255cc0276491d17c402390 upstream.
According to XHCI specification (5.5.2.1) the IP is bit 0 and IE is bit 1 of IMAN register. Previously their definitions were reversed.
Even though there are no ill effects being observed from the swapped definitions (because IMAN_IP is RW1C and in legacy PCI case we come in with it already set to 1 so it was clearing itself even though we were setting IMAN_IE instead of IMAN_IP), we should still correct the values.
This patch should be backported to kernels as old as 2.6.36, that contain the commit 4e833c0b87a30798e67f06120cecebef6ee9644c "xhci: don't re-enable IE constantly".
--- drivers/usb/host/xhci.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/usb/host/xhci.h +2 -2
@@ -206,8 +206,8 @@ struct xhci_op_regs {/* bits 12:31 are reserved (and should be preserved on writes). */ /* IMAN - Interrupt Management Register */ -#define IMAN_IP (1 << 1) -#define IMAN_IE (1 << 0) +#define IMAN_IE (1 << 1) +#define IMAN_IP (1 << 0)/* USBSTS - USB status - status bitmasks */ /* HC not running - set to 1 when run/stop bit is cleared. */
Greg Kroah-Hartman
maintainerPATCH 83/98 USB: xhci: correctly enable interrupts
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hannes Reinecke <[email protected]>
commit 00eed9c814cb8f281be6f0f5d8f45025dc0a97eb upstream.
xhci has its own interrupt enabling routine, which will try to use MSI-X/MSI if present. So the usb core shouldn't try to enable legacy interrupts; on some machines the xhci legacy IRQ setting is invalid.
v3: Be careful to not break XHCI_BROKEN_MSI workaround (by trenn)
--- drivers/usb/core/hcd-pci.c | 23 ++++++++++++++--------- drivers/usb/host/xhci.c | 3 ++- 2 files changed, 16 insertions(+), 10 deletions(-)
drivers/usb/core/hcd-pci.c +14 -9
@@ -173,6 +173,7 @@ int usb_hcd_pci_probe(struct pci_dev *destruct hc_driver *driver;struct usb_hcd *hcd;int retval; +int hcd_irq =0 ;if (usb_disabled ())return -ENODEV ;
@@ -187,15 +188,19 @@ int usb_hcd_pci_probe(struct pci_dev *dereturn -ENODEV ; dev->current_state =PCI_D0 ; -/* The xHCI driver supports MSI and MSI-X, -* so don't fail if the BIOS doesn't provide a legacy IRQ. +/* +* The xHCI driver has its own irq management +* make sure irq setup is not touched for xhci in generic hcd code */ -if (!dev->irq && (driver->flags &HCD_MASK ) !=HCD_USB3 ) { -dev_err (&dev->dev, -"Found HC with no IRQ. Check BIOS/PCI %s setup!\n" , -pci_name (dev)); - retval = -ENODEV ; - goto disable_pci; +if ((driver->flags &HCD_MASK ) !=HCD_USB3 ) { +if (!dev->irq) { +dev_err (&dev->dev, +"Found HC with no IRQ. Check BIOS/PCI %s setup!\n" , +pci_name (dev)); + retval = -ENODEV ; + goto disable_pci; + } + hcd_irq = dev->irq; } hcd =usb_create_hcd (driver, &dev->dev,pci_name (dev));
@@ -245,7 +250,7 @@ int usb_hcd_pci_probe(struct pci_dev *depci_set_master (dev); - retval =usb_add_hcd (hcd, dev->irq,IRQF_SHARED ); + retval =usb_add_hcd (hcd, hcd_irq,IRQF_SHARED );if (retval !=0 ) goto unmap_registers;set_hs_companion (dev, hcd);
drivers/usb/host/xhci.c +2 -1
@@ -350,7 +350,7 @@ static int xhci_try_enable_msi(struct us* generate interrupts. Don't even try to enable MSI. */ if (xhci->quirks &XHCI_BROKEN_MSI ) -return 0 ; + goto legacy_irq;/* unregister the legacy interrupt */ if (hcd->irq)
@@ -371,6 +371,7 @@ static int xhci_try_enable_msi(struct usreturn -EINVAL ; } + legacy_irq:/* fall back to legacy interrupt*/ ret =request_irq (pdev->irq, &usb_hcd_irq,IRQF_SHARED , hcd->irq_descr, hcd);
Greg Kroah-Hartman
maintainerPATCH 84/98 USB: cdc-acm: fix device unregistration
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit cb25505fc604292c70fc02143fc102f54c8595f0 upstream.
Unregister tty device in disconnect as is required by the USB stack.
By deferring unregistration to when the last tty reference is dropped, the parent interface device can get unregistered before the child resulting in broken hotplug events being generated when the tty is finally closed:
KERNEL[2290.798128] remove /devices/pci0000:00/0000:00:1d.7/usb2/2-1/2-1:3.1 (usb) KERNEL[2290.804589] remove /devices/pci0000:00/0000:00:1d.7/usb2/2-1 (usb) KERNEL[2294.554799] remove /2-1:3.1/tty/ttyACM0 (tty)
The driver must deal with tty callbacks after disconnect by checking the disconnected flag. Specifically, further opens must be prevented and this is already implemented.
--- drivers/usb/class/cdc-acm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/usb/class/cdc-acm.c +2 -1
@@ -600,7 +600,6 @@ static void acm_port_destruct(struct ttydev_dbg (&acm->control->dev,"%s\n" , __func__); -tty_unregister_device (acm_tty_driver, acm->minor);acm_release_minor (acm);usb_put_intf (acm->control);kfree (acm->country_codes);
@@ -1418,6 +1417,8 @@ static void acm_disconnect(struct usb_instop_data_traffic (acm); +tty_unregister_device (acm_tty_driver, acm->minor); +usb_free_urb (acm->ctrlurb);for (i =0 ; i <ACM_NW ; i++)usb_free_urb (acm->wb[i].urb);
Greg Kroah-Hartman
maintainerPATCH 85/98 USB: EHCI: fix regression during bus resume
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <[email protected]>
commit 2a40f324541ee61c22146214349c2ce9f5c30bcf upstream.
This patch (as1663) fixes a regression caused by commit 6e0c3339a6f19d748f16091d0a05adeb1e1f822b (USB: EHCI: unlink one async QH at a time). In order to avoid keeping multiple QHs in an unusable intermediate state, that commit changed unlink_empty_async() so that it unlinks only one empty QH at a time.
However, when the EHCI root hub is suspended, _all_ async QHs need to be unlinked. ehci_bus_suspend() used to do this by calling unlink_empty_async(), but now this only unlinks one of the QHs, not all of them.
The symptom is that when the root hub is resumed, USB communications don't work for some period of time. This is because ehci-hcd doesn't realize it needs to restart the async schedule; it assumes that because some QHs are already on the schedule, the schedule must be running.
The easiest way to fix the problem is add a new function that unlinks all the async QHs when the root hub is suspended.
This patch should be applied to all kernels that have the 6e0c3339a6f1 commit.
--- drivers/usb/host/ehci-hcd.c | 1 + drivers/usb/host/ehci-hub.c | 2 +- drivers/usb/host/ehci-q.c | 13 +++++++++++++ 3 files changed, 15 insertions(+), 1 deletion(-)
drivers/usb/host/ehci-hcd.c +1 -0
@@ -302,6 +302,7 @@ static void ehci_quiesce (struct ehci_hcstatic void end_unlink_async (struct ehci_hcd *ehci);static void unlink_empty_async (struct ehci_hcd *ehci); +static void unlink_empty_async_suspended (struct ehci_hcd *ehci);static void ehci_work (struct ehci_hcd *ehci);static void start_unlink_intr (struct ehci_hcd *ehci,struct ehci_qh *qh);static void end_unlink_intr (struct ehci_hcd *ehci,struct ehci_qh *qh);
drivers/usb/host/ehci-hub.c +1 -1
@@ -328,7 +328,7 @@ static int ehci_bus_suspend (struct usb_ ehci->rh_state =EHCI_RH_SUSPENDED ;end_unlink_async (ehci); -unlink_empty_async (ehci); +unlink_empty_async_suspended (ehci);ehci_handle_intr_unlinks (ehci);end_free_itds (ehci);
drivers/usb/host/ehci-q.c +13 -0
@@ -1316,6 +1316,19 @@ static void unlink_empty_async(struct eh } } +/* The root hub is suspended; unlink all the async QHs */ +static void unlink_empty_async_suspended (struct ehci_hcd *ehci) +{ +struct ehci_qh *qh; + +while (ehci->async->qh_next.qh) { + qh = ehci->async->qh_next.qh; +WARN_ON (!list_empty (&qh->qtd_list)); +single_unlink_async (ehci, qh); + } +start_iaa_cycle (ehci, false); +} +/* makes sure the async qh will become idle */ /* caller must own ehci->lock */
Greg Kroah-Hartman
maintainerPATCH 86/98 USB: EHCI: fix regression in QH unlinking
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <[email protected]>
commit d714aaf649460cbfd5e82e75520baa856b4fa0a0 upstream.
This patch (as1670) fixes a regression caused by commit 6402c796d3b4205d3d7296157956c5100a05d7d6 (USB: EHCI: work around silicon bug in Intel's EHCI controllers). The workaround goes through two IAA cycles for each QH being unlinked. During the first cycle, the QH is not added to the async_iaa list (because it isn't fully gone from the hardware yet), which means that list will be empty.
Unfortunately, I forgot to update the IAA watchdog timer routine. It thinks that an empty async_iaa list means the timer expiration was an error, which isn't true any more. This problem didn't show up during initial testing because the controllers being tested all had working IAA interrupts. But not all controllers do, and when the watchdog timer expires, the empty-list check prevents the second IAA cycle from starting. As a result, URB unlinks never complete. The check needs to be removed.
Among the symptoms of the regression are processes stuck in D wait states and hangs during system shutdown.
--- drivers/usb/host/ehci-timer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/host/ehci-timer.c +1 -1
@@ -304,7 +304,7 @@ static void ehci_iaa_watchdog(struct ehc* (a) SMP races against real IAA firing and retriggering, and * (b) clean HC shutdown, when IAA watchdog was pending. */ -if (ehci->async_iaa) { +if (1 ) {u32 cmd, status;/* If we get here, IAA is *REALLY* late. It's barely
Greg Kroah-Hartman
maintainerPATCH 87/98 usb: gadget: ffs: fix enable multiple instances
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrzej Pietrasiewicz <[email protected]>
commit 3416905ba058e43112ad7b1b4859797f027f5a07 upstream.
This patch fixes an "off-by-one" bug found in
581791f (FunctionFS: enable multiple functions).
During gfs_bind/gfs_unbind the functionfs_bind/functionfs_unbind should be called for every functionfs instance. With the "i" pre-decremented they were not called for the zeroth instance.
--- drivers/usb/gadget/g_ffs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/usb/gadget/g_ffs.c +2 -2
@@ -357,7 +357,7 @@ static int gfs_bind(struct usb_composite goto error; gfs_dev_desc.iProduct = gfs_strings[USB_GADGET_PRODUCT_IDX ].id; -for (i = func_num; --i; ) { +for (i = func_num; i--; ) { ret =functionfs_bind (ffs_tab[i].ffs_data, cdev);if (unlikely (ret <0 )) {while (++i < func_num)
@@ -413,7 +413,7 @@ static int gfs_unbind(struct usb_composigether_cleanup (); gfs_ether_setup = false; -for (i = func_num; --i; ) +for (i = func_num; i--; )if (ffs_tab[i].ffs_data)functionfs_unbind (ffs_tab[i].ffs_data);
Greg Kroah-Hartman
maintainerPATCH 88/98 USB: serial: fix interface refcounting
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit d7971051e4df825e0bc11b995e87bfe86355b8e5 upstream.
Make sure the interface is not released before our serial device.
Note that drivers are still not allowed to access the interface in any way that may interfere with another driver that may have gotten bound to the same interface after disconnect returns.
--- drivers/usb/serial/usb-serial.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/usb/serial/usb-serial.c +2 -1
@@ -151,6 +151,7 @@ static void destroy_serial(struct kref * } } +usb_put_intf (serial->interface);usb_put_dev (serial->dev);kfree (serial); }
@@ -614,7 +615,7 @@ static struct usb_serial *create_serial( } serial->dev =usb_get_dev (dev); serial->type = driver; - serial->interface = interface; + serial->interface =usb_get_intf (interface);kref_init (&serial->kref);mutex_init (&serial->disc_mutex); serial->minor =SERIAL_TTY_NO_MINOR ;
Greg Kroah-Hartman
maintainerPATCH 89/98 efivars: Allow disabling use as a pstore backend
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seth Forshee <[email protected]>
commit ed9dc8ce7a1c8115dba9483a9b51df8b63a2e0ef upstream.
Add a new option, CONFIG_EFI_VARS_PSTORE, which can be set to N to avoid using efivars as a backend to pstore, as some users may want to compile out the code completely.
Set the default to Y to maintain backwards compatability, since this feature has always been enabled until now.
--- drivers/firmware/Kconfig | 9 ++++++ drivers/firmware/efivars.c | 64 ++++++++++++++------------------------------- 2 files changed, 29 insertions(+), 44 deletions(-)
drivers/firmware/Kconfig +9 -0
@@ -53,6 +53,15 @@ config EFI_VARS Subsequent efibootmgr releases may be found at: <http://linux.dell.com/efibootmgr> +config EFI_VARS_PSTORE + bool "Register efivars backend for pstore" + depends on EFI_VARS && PSTORE + default y + help + Say Y here to enable use efivars as a backend to pstore. This + will allow writing console messages, crash dumps, or anything + else supported by pstore to EFI variables. + config EFI_PCDP bool "Console device selection via EFI PCDP or HCDP table" depends on ACPI && EFI && IA64
drivers/firmware/efivars.c +20 -44
88 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 90/98 efivars: Add module parameter to disable use as a pstore backend
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seth Forshee <[email protected]>
commit ec0971ba5372a4dfa753f232449d23a8fd98490e upstream.
We know that with some firmware implementations writing too much data to UEFI variables can lead to bricking machines. Recent changes attempt to address this issue, but for some it may still be prudent to avoid writing large amounts of data until the solution has been proven on a wide variety of hardware.
Crash dumps or other data from pstore can potentially be a large data source. Add a pstore_module parameter to efivars to allow disabling its use as a backend for pstore. Also add a config option, CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE, to allow setting the default value of this paramter to true (i.e. disabled by default).
--- drivers/firmware/Kconfig | 9 +++++++++ drivers/firmware/efivars.c | 8 +++++++- 2 files changed, 16 insertions(+), 1 deletion(-)
drivers/firmware/Kconfig +9 -0
@@ -62,6 +62,15 @@ config EFI_VARS_PSTORE will allow writing console messages, crash dumps, or anything else supported by pstore to EFI variables. +config EFI_VARS_PSTORE_DEFAULT_DISABLE + bool "Disable using efivars as a pstore backend by default" + depends on EFI_VARS_PSTORE + default n + help + Saying Y here will disable the use of efivars as a storage + backend for pstore by default. This setting can be overridden + using the efivars module's pstore_disable parameter. + config EFI_PCDP bool "Console device selection via EFI PCDP or HCDP table" depends on ACPI && EFI && IA64
drivers/firmware/efivars.c +7 -1
@@ -103,6 +103,11 @@ MODULE_VERSION(EFIVARS_VERSION);*/ #define GUID_LEN 36 +static bool efivars_pstore_disable = +IS_ENABLED (EFI_VARS_PSTORE_DEFAULT_DISABLE ); + +module_param_named (pstore_disable, efivars_pstore_disable, bool,0644 ); +/* * The maximum size of VariableName + Data = 1024 * Therefore, it's reasonable to save that much
@@ -1926,7 +1931,8 @@ int register_efivars(struct efivars *efiif (error)unregister_efivars (efivars); -efivar_pstore_register (efivars); +if (!efivars_pstore_disable) +efivar_pstore_register (efivars);register_filesystem (&efivarfs_type);
Greg Kroah-Hartman
maintainerPATCH 91/98 efivars: Fix check for CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <[email protected]>
commit ca0ba26fbbd2d81c43085df49ce0abfe34535a90 upstream.
The 'CONFIG_' prefix is not implicit in IS_ENABLED().
--- drivers/firmware/efivars.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/firmware/efivars.c +1 -1
@@ -104,7 +104,7 @@ MODULE_VERSION(EFIVARS_VERSION);#define GUID_LEN 36static bool efivars_pstore_disable = -IS_ENABLED (EFI_VARS_PSTORE_DEFAULT_DISABLE ); +IS_ENABLED (CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE );module_param_named (pstore_disable, efivars_pstore_disable, bool,0644 );
Greg Kroah-Hartman
maintainerPATCH 92/98 ACPI: Rework acpi_get_child() to be more efficient
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Rafael J. Wysocki" <[email protected]>
commit 33f767d767e9a684e9cd60704d4c049a2014c8d5 upstream.
Observe that acpi_get_child() doesn't need to use the helper struct acpi_find_child structure and change it to work without it. Also, using acpi_get_object_info() to get the output of _ADR for the given device is overkill, because that function does much more than just evaluating _ADR (let alone the additional memory allocation done by it).
Moreover, acpi_get_child() doesn't need to loop any more once it has found a matching handle, so make it stop in that case. To prevent the results from changing, make it use do_acpi_find_child() as a post-order callback.
--- drivers/acpi/glue.c | 33 ++++++++++++--------------------- 1 file changed, 12 insertions(+), 21 deletions(-)
drivers/acpi/glue.c +12 -21
@@ -95,40 +95,31 @@ static int acpi_find_bridge_device(strucreturn ret; } -/* Get device's handler per its address under its parent */ -struct acpi_find_child { -acpi_handle handle; -u64 address; -}; - -static acpi_status -do_acpi_find_child (acpi_handle handle,u32 lvl,void *context,void **rv) +static acpi_status do_acpi_find_child (acpi_handle handle,u32 lvl_not_used, +void *addr_p,void **ret_p) { +unsigned long long addr;acpi_status status; -struct acpi_device_info *info; -struct acpi_find_child *find = context; - status =acpi_get_object_info (handle, &info); -if (ACPI_SUCCESS (status)) { -if ((info->address == find->address) - && (info->valid &ACPI_VALID_ADR )) - find->handle = handle; -kfree (info); + status =acpi_evaluate_integer (handle,METHOD_NAME__ADR ,NULL , &addr); +if (ACPI_SUCCESS (status) && addr == *((u64 *)addr_p)) { + *ret_p = handle; +return AE_CTRL_TERMINATE ; }return AE_OK ; }acpi_handle acpi_get_child (acpi_handle parent,u64 address) { -struct acpi_find_child find = {NULL , address }; +void *ret =NULL ;if (!parent)return NULL ; -acpi_walk_namespace (ACPI_TYPE_DEVICE , parent, -1 , do_acpi_find_child,NULL , &find,NULL ); -return find.handle; -} +acpi_walk_namespace (ACPI_TYPE_DEVICE , parent,1 ,NULL , + do_acpi_find_child, &address, &ret); +return (acpi_handle )ret; +}EXPORT_SYMBOL (acpi_get_child);static int acpi_bind_one (struct device *dev,acpi_handle handle)
Greg Kroah-Hartman
maintainerPATCH 93/98 udf: Fix bitmap overflow on large filesystems with small block size
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
commit 89b1f39eb4189de745fae554b0d614d87c8d5c63 upstream.
For large UDF filesystems with 512-byte blocks the number of necessary bitmap blocks is larger than 2^16 so s_nr_groups in udf_bitmap overflows (the number will overflow for filesystems larger than 128 GB with 512-byte blocks). That results in ENOSPC errors despite the filesystem has plenty of free space.
Fix the problem by changing s_nr_groups' type to 'int'. That is enough even for filesystems 2^32 blocks (UDF maximum) and 512-byte blocksize.
--- fs/udf/udf_sb.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/udf/udf_sb.h +1 -1
@@ -82,7 +82,7 @@ struct udf_virtual_data {struct udf_bitmap {__u32 s_extLength;__u32 s_extPosition; -__u16 s_nr_groups; +int s_nr_groups;struct buffer_head **s_block_bitmap; };
Greg Kroah-Hartman
maintainerPATCH 94/98 USB: garmin_gps: fix memory leak on disconnect
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 618aa1068df29c37a58045fe940f9106664153fd upstream.
Remove bogus disconnect test introduced by 95bef012e ("USB: more serial drivers writing after disconnect") which prevented queued data from being freed on disconnect.
The possible IO it was supposed to prevent is long gone.
--- drivers/usb/serial/garmin_gps.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-)
drivers/usb/serial/garmin_gps.c +1 -6
@@ -959,10 +959,7 @@ static void garmin_close(struct usb_seriif (!serial)return ; -mutex_lock (&port->serial->disc_mutex); - -if (!port->serial->disconnected) -garmin_clear (garmin_data_p); +garmin_clear (garmin_data_p);/* shutdown our urbs */ usb_kill_urb (port->read_urb);
@@ -971,8 +968,6 @@ static void garmin_close(struct usb_seri/* keep reset state so we know that we must start a new session */ if (garmin_data_p->state !=STATE_RESET ) garmin_data_p->state =STATE_DISCONNECTED ; - -mutex_unlock (&port->serial->disc_mutex); }
Greg Kroah-Hartman
maintainerPATCH 95/98 USB: io_ti: fix get_icount for two port adapters
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 5492bf3d5655b4954164f69c02955a7fca267611 upstream.
Add missing get_icount field to two-port driver.
The two-port driver was not updated when switching to the new icount interface in commit 0bca1b913aff ("tty: Convert the USB drivers to the new icount interface").
--- drivers/usb/serial/io_ti.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/serial/io_ti.c +1 -0
@@ -2702,6 +2702,7 @@ static struct usb_serial_driver edgeport .set_termios = edge_set_termios, .tiocmget = edge_tiocmget, .tiocmset = edge_tiocmset, + .get_icount = edge_get_icount, .write = edge_write, .write_room = edge_write_room, .chars_in_buffer = edge_chars_in_buffer,
Greg Kroah-Hartman
maintainerPATCH 96/98 usb: musb: da8xx: Fix build breakage due to typo
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikhail Kshevetskiy <[email protected]>
commit db9e51617faad3a54d10b7cb340a82688ec0232d upstream.
Commit 032ec49f5351e9cb242b1a1c367d14415043ab95 (usb: musb: drop useless board_mode usage) introduced a typo that breaks the build.
[ Fixed commit message ]
--- drivers/usb/musb/da8xx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/musb/da8xx.c +1 -1
@@ -327,7 +327,7 @@ static irqreturn_t da8xx_musb_interrupt(u8 devctl =musb_readb (mregs,MUSB_DEVCTL );int err; - err = musb->int_usb &USB_INTR_VBUSERROR ; + err = musb->int_usb &MUSB_INTR_VBUSERROR ;if (err) {/* * The Mentor core doesn't debounce VBUS as needed
Greg Kroah-Hartman
maintainerPATCH 97/98 ARM: DMA-mapping: add missing GFP_DMA flag for atomic buffer allocation
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Szyprowski <[email protected]>
commit 9d1400cf79afb49584b4873eb22cd5130cb341db upstream.
Atomic pool should always be allocated from DMA zone if such zone is available in the system to avoid issues caused by limited dma mask of any of the devices used for making an atomic allocation.
--- arch/arm/mm/dma-mapping.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
arch/arm/mm/dma-mapping.c +3 -2
@@ -330,6 +330,7 @@ static int __init atomic_pool_init(void) {struct dma_pool *pool = &atomic_pool;pgprot_t prot =pgprot_dmacoherent (pgprot_kernel); +gfp_t gfp =GFP_KERNEL |GFP_DMA ;unsigned long nr_pages = pool->size >>PAGE_SHIFT ;unsigned long *bitmap;struct page *page;
@@ -348,8 +349,8 @@ static int __init atomic_pool_init(void)if (IS_ENABLED (CONFIG_CMA )) ptr =__alloc_from_contiguous (NULL , pool->size, prot, &page);else - ptr =__alloc_remap_buffer (NULL , pool->size,GFP_KERNEL , prot, - &page,NULL ); + ptr =__alloc_remap_buffer (NULL , pool->size, gfp, prot, &page, +NULL );if (ptr) {int i;
Greg Kroah-Hartman
maintainerPATCH 98/98 rt2x00: error in configurations with mesh support disabled
In reply to Greg Kroah-Hartman3.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <[email protected]>
commit 6ef9e2f6d12ce9e2120916804d2ddd46b954a70b upstream.
If CONFIG_MAC80211_MESH is not set, cfg80211 will now allow advertising interface combinations with NL80211_IFTYPE_MESH_POINT present. Add appropriate ifdefs to avoid running into errors.
[Backported for 3.8-stable. Removed code of simultaneous AP and mesh mode added in 4a5fc6d 3.9-rc1.]
--- drivers/net/wireless/rt2x00/rt2x00dev.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/wireless/rt2x00/rt2x00dev.c +2 -0
@@ -1209,7 +1209,9 @@ int rt2x00lib_probe_dev(struct rt2x00_de rt2x00dev->hw->wiphy->interface_modes |=BIT (NL80211_IFTYPE_ADHOC ) |BIT (NL80211_IFTYPE_AP ) | +#ifdef CONFIG_MAC80211_MESHBIT (NL80211_IFTYPE_MESH_POINT ) | +#endifBIT (NL80211_IFTYPE_WDS ); rt2x00dev->hw->wiphy->flags |=WIPHY_FLAG_IBSS_RSN ;
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 3.8.5 release. There are 98 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu Mar 28 22:41:38 UTC 2013. Anything received after that time might be too late.
Quoted 8 lines
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v3.0/stable-review/patch-3.8.5-rc1.gzand the diffstat can be found below.
thanks,
greg k-h
Patches applied cleanly to 3.0.70, 3.4.37, and 3.8.4
Compiled and booted on the following systems:
HP EliteBook 6930p Intel(R) Core(TM)2 Duo CPU T9400 @ 2.53GHz HP ProBook 6475b AMD A10-4600M APU with Radeon(tm) HD Graphics
dmesgs for all releases look good. No regressions compared to the previous dmesgs for each of these releases.
Cross-compile tests results:
alpha: defconfig passed on all
arm: defconfig passed on all
arm64: not applicable to 3.0.y, 3.4.y. defconfig passed on 3.8.y
c6x: not applicable to 3.0.y, defconfig passed on 3.4.y, and 3.8.y.
powerpc: wii_defconfig passed on all
sh: defconfig passed on all
sparc: defconfig passed on all
tile: tilegx_defconfig passed on all
Known issue since 3.0.70, 3.4.37 and 3.8.4
kernel/signal.c: In function �flush_signal_handlers�:kernel/signal.c:441:9: error: �struct sigaction� has no member named �sa_restorer�
make[1]: *** [kernel/signal.o] Error 1
make: *** [kernel] Error 2
mips: defconfig failed
mipsel: defconfig failed
-- Shuah
Greg Kroah-Hartman
maintainerQuoted 19 lines · Shuah Khan
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 3.8.5 release. There are 98 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu Mar 28 22:41:38 UTC 2013. Anything received after that time might be too late.
Quoted 8 lines
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v3.0/stable-review/patch-3.8.5-rc1.gzand the diffstat can be found below.
thanks,
greg k-h
Quoted 6 lines
Patches applied cleanly to 3.0.70, 3.4.37, and 3.8.4
Compiled and booted on the following systems:
HP EliteBook 6930p Intel(R) Core(TM)2 Duo CPU T9400 @ 2.53GHz HP ProBook 6475b AMD A10-4600M APU with Radeon(tm) HD Graphics
Thanks for testing.
Quoted 16 lines
dmesgs for all releases look good. No regressions compared to the previous dmesgs for each of these releases.
Cross-compile tests results:
alpha: defconfig passed on all
arm: defconfig passed on all
arm64: not applicable to 3.0.y, 3.4.y. defconfig passed on 3.8.y
c6x: not applicable to 3.0.y, defconfig passed on 3.4.y, and 3.8.y.
powerpc:wii_defconfigpassed on all
sh: defconfig passed on all
sparc: defconfig passed on all
tile:tilegx_defconfigpassed on allKnown issue since 3.0.70, 3.4.37 and 3.8.4
Quoted 8 lines
kernel/signal.c: In function ‘flush_signal_handlers’:kernel/signal.c:441:9: error: ‘struct sigaction’ has no member named ‘sa_restorer’
make[1]: *** [kernel/signal.o] Error 1
make: *** [kernel] Error 2mips: defconfig failed
mipsel: defconfig failed
Yeah, I really should fix that... :)
greg k-h
At Tue, 26 Mar 2013 15:41:49 -0700,
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 3.8.5 release. There are 98 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu Mar 28 22:41:38 UTC 2013. Anything received after that time might be too late.
This kernel can be built and boot without any problem. Building a kernel with this kernel also works fine.
- Build Machine: debian wheezy x86_64
CPU: Intel(R) Core(TM) i5-2400 CPU @ 3.10GHz x 4
memory: 8GB
- Test machine: debian wheezy x86_64(KVM guest on the Build Machine)
vCPU: x2
memory: 2GB
I reviewed the following patches and it looks good to me.
Quoted 5 lines
Ben Hutchings <[email protected]>
efivars: Fix check forCONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLESeth Forshee <[email protected]>
efivars: Add module parameter to disable use as a pstore backend
...
Quoted 5 lines
CQ Tang <[email protected]>
x86-64: Fix the failure case incopy_user_handle_tail()Mark Rutland <[email protected]>
clockevents: Don't allow dummy broadcast timers
...
Quoted 2 lines
Lukas Czerner <[email protected]>
ext4: uses_extent_max_zeroout_kbvalue as number of kb
Thanks,
Satoru