4.3.6-stable review
Subsystems (2)
Greg Kroah-Hartman
maintainercover 4.3.6-stable review
-------------------------
NOTE: This is the last 4.3.y kernel to be released. After this one, it is end-of-life, please move to 4.4.y at this point in time.
-------------------------
This is the start of the stable review cycle for the 4.3.6 release. There are 200 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Tue Feb 16 22:21:48 UTC 2016. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.3.6-rc1.gz
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.3.6-rc1
Maciej W. Rozycki <[email protected]>
binfmt_elf: Don't clobber passed executable's file header
Eric Biggers <[email protected]>
fs/pipe.c: return error code rather than 0 in pipe_write()
Junil Lee <[email protected]>
zsmalloc: fix migrate_zspage-zs_free race condition
Jerome Marchand <[email protected]>
zram: don't call idr_remove() from zram_remove()
Kyeongdon Kim <[email protected]>
zram: try vmalloc() after kmalloc()
Sergey Senozhatsky <[email protected]>
zram/zcomp: use GFP_NOIO to allocate streams
Alexandre Courbot <[email protected]>
drm/nouveau/pmu: do not assume a PMU is present
Mika Westerberg <[email protected]>
HID: multitouch: Fetch feature reports on demand for Win8 devices
Larry Finger <[email protected]>
rtlwifi: rtl8821ae: Fix lockups on boot
Geert Uytterhoeven <[email protected]>
FS-Cache: Add missing initialization of ret in cachefiles_write_page()
David Howells <[email protected]>
FS-Cache: Handle a write to the page immediately beyond the EOF marker
Kinglong Mee <[email protected]>
FS-Cache: Don't override netfs's primary_index if registering failed
Kinglong Mee <[email protected]>
FS-Cache: Increase reference of parent after registering, netfs success
Boris BREZILLON <[email protected]>
crypto: marvell/cesa - fix test in mv_cesa_dev_dma_init()
Herbert Xu <[email protected]>
crypto: algif_skcipher - Do not set MAY_BACKLOG on the async path
Herbert Xu <[email protected]>
crypto: algif_skcipher - Do not dereference ctx without socket lock
Herbert Xu <[email protected]>
crypto: algif_skcipher - Do not assume that req is unchanged
Mathias Krause <[email protected]>
crypto: user - lock crypto_alg_list on alg dump
Ryan Ware <[email protected]>
EVM: Use crypto_memneq() for digest comparisons
Wang, Rui Y <[email protected]>
crypto: algif_hash - wait for crypto_ahash_init() to complete
Herbert Xu <[email protected]>
crypto: shash - Fix has_key setting
Eli Cooper <[email protected]>
crypto: chacha20-ssse3 - Align stack pointer to 64 bytes
Horia Geant? <[email protected]>
crypto: caam - make write transactions bufferable on PPC platforms
Herbert Xu <[email protected]>
crypto: algif_skcipher - sendmsg SG marking is off by one
Herbert Xu <[email protected]>
crypto: algif_skcipher - Load TX SG list after waiting
Jean Delvare <[email protected]>
crypto: crc32c - Fix crc32c soft dependency
Herbert Xu <[email protected]>
crypto: algif_skcipher - Fix race condition in skcipher_check_key
Herbert Xu <[email protected]>
crypto: algif_hash - Fix race condition in hash_check_key
Herbert Xu <[email protected]>
crypto: af_alg - Forbid bind(2) when nokey child sockets are present
Herbert Xu <[email protected]>
crypto: algif_skcipher - Remove custom release parent function
Herbert Xu <[email protected]>
crypto: algif_hash - Remove custom release parent function
Herbert Xu <[email protected]>
crypto: af_alg - Allow af_af_alg_release_parent to be called on nokey path
Alexandra Yates <[email protected]>
ahci: Intel DNV device IDs SATA
Tejun Heo <[email protected]>
libata: disable forced PORTS_IMPL for >= AHCI 1.3
Xiangliang Yu <[email protected]>
AHCI: Fix softreset failed issue of Port Multiplier
Herbert Xu <[email protected]>
crypto: algif_skcipher - Add key check exception for cipher_null
Herbert Xu <[email protected]>
crypto: skcipher - Add crypto_skcipher_has_setkey
Herbert Xu <[email protected]>
crypto: algif_hash - Require setkey before accept(2)
Herbert Xu <[email protected]>
crypto: hash - Add crypto_ahash_has_setkey
Herbert Xu <[email protected]>
crypto: algif_skcipher - Add nokey compatibility path
Herbert Xu <[email protected]>
crypto: af_alg - Add nokey compatibility path
Herbert Xu <[email protected]>
crypto: af_alg - Fix socket double-free when accept fails
Herbert Xu <[email protected]>
crypto: af_alg - Disallow bind/setkey/... after accept(2)
Herbert Xu <[email protected]>
crypto: algif_skcipher - Require setkey before accept(2)
Raghavendra K T <[email protected]>
sched: Fix crash in sched_init_numa()
Al Viro <[email protected]>
ext4: fix an endianness bug in ext4_encrypted_follow_link()
Al Viro <[email protected]>
ext4: fix an endianness bug in ext4_encrypted_zeroout()
David Turner <[email protected]>
ext4: Fix handling of extended tv_sec
Dan Williams <[email protected]>
ext2, ext4: warn when mounting with dax enabled
Tadeusz Struk <[email protected]>
crypto: fix test vector for rsa
Mathias Nyman <[email protected]>
xhci: fix usb2 resume timing and races.
Ard Biesheuvel <[email protected]>
arm64: mm: use correct mapping granularity under DEBUG_RODATA
Will Deacon <[email protected]>
iommu/io-pgtable-arm: Ensure we free the final level on teardown
Peter Hurley <[email protected]>
tty: Fix unsafe ldisc reference via ioctl(TIOCGETD)
Peter Hurley <[email protected]>
tty: Retry failed reopen if tty teardown in-progress
Peter Hurley <[email protected]>
tty: Fix GPF in flush_to_ldisc()
Peter Hurley <[email protected]>
n_tty: Fix unsafe reference to "other" ldisc
Peter Hurley <[email protected]>
n_tty: Fix poll() after buffer-limited eof push read
Lu Baolu <[email protected]>
usb: xhci: apply XHCI_PME_STUCK_QUIRK to Intel Broxton-M platforms
Lu Baolu <[email protected]>
usb: xhci: handle both SSIC ports in PME stuck quirk
Srinivas Kandagatla <[email protected]>
usb: phy: msm: fix error handling in probe.
Lu Baolu <[email protected]>
usb: cdc-acm: send zero packet for intel 7260 modem
Lu Baolu <[email protected]>
usb: cdc-acm: handle unlinked urb in acm read callback
John Ernberg <[email protected]>
USB: option: fix Cinterion AHxx enumeration
Daniele Palmas <[email protected]>
USB: serial: option: Adding support for Telit LE922
Peter Dedecker <[email protected]>
USB: cp210x: add ID for IAI USB to RS485 adaptor
Greg Kroah-Hartman <[email protected]>
USB: serial: ftdi_sio: add support for Yaesu SCU-18 cable
Du, Changbin <[email protected]>
usb: hub: do not clear BOS field during reset device
Johan Hovold <[email protected]>
USB: visor: fix null-deref at probe
Vladis Dronov <[email protected]>
USB: serial: visor: fix crash on detecting device without write_urbs
Bard Liao <[email protected]>
ASoC: rt5645: fix the shift bit of IN1 boost
Mauro Carvalho Chehab <[email protected]>
saa7134-alsa: Only frees registered sound cards
Takashi Iwai <[email protected]>
ALSA: dummy: Implement timer backend switching more safely
Takashi Iwai <[email protected]>
ALSA: hda - Fix bad dereference of jack object
Takashi Iwai <[email protected]>
ALSA: hda - Fix speaker output from VAIO AiO machines
Takashi Iwai <[email protected]>
Revert "ALSA: hda - Fix noise on Gigabyte Z170X mobo"
David Henningsson <[email protected]>
ALSA: hda - Fix static checker warning in patch_hdmi.c
Takashi Iwai <[email protected]>
ALSA: hda - Add fixup for Mac Mini 7,1 model
Takashi Iwai <[email protected]>
ALSA: timer: Fix race between stop and interrupt
Takashi Iwai <[email protected]>
ALSA: timer: Fix wrong instance passed to slave callbacks
Takashi Iwai <[email protected]>
ALSA: timer: Fix race at concurrent reads
Takashi Iwai <[email protected]>
ALSA: timer: Fix link corruption due to double start or stop
Takashi Iwai <[email protected]>
ALSA: timer: Fix leftover link at closing
Takashi Iwai <[email protected]>
ALSA: timer: Code cleanup
Takashi Iwai <[email protected]>
ALSA: seq: Fix lockdep warnings due to double mutex locks
Takashi Iwai <[email protected]>
ALSA: seq: Fix race at closing in virmidi driver
Takashi Iwai <[email protected]>
ALSA: seq: Fix yet another races among ALSA timer accesses
Vinod Koul <[email protected]>
ASoC: dpcm: fix the BE state on hw_free
Takashi Iwai <[email protected]>
ALSA: pcm: Fix potential deadlock in OSS emulation
Takashi Iwai <[email protected]>
ALSA: rawmidi: Fix race at copying & updating the position
Takashi Iwai <[email protected]>
ALSA: rawmidi: Remove kernel WARNING for NULL user-space buffer check
Takashi Iwai <[email protected]>
ALSA: rawmidi: Make snd_rawmidi_transmit() race-free
Takashi Iwai <[email protected]>
ALSA: seq: Degrade the error message for too many opens
Takashi Iwai <[email protected]>
ALSA: seq: Fix incorrect sanity check at snd_seq_oss_synth_cleanup()
Takashi Iwai <[email protected]>
ALSA: dummy: Disable switching timer backend via sysfs
Takashi Iwai <[email protected]>
ALSA: compress: Disable GET_CODEC_CAPS ioctl for some architectures
Lucas Tanure <[email protected]>
ALSA: bebob: Use a signed return type for get_formation_index
Andrey Konovalov <[email protected]>
ALSA: usb-audio: avoid freeing umidi object twice
Jurgen Kramer <[email protected]>
ALSA: usb-audio: Add native DSD support for PS Audio NuWave DAC
Jurgen Kramer <[email protected]>
ALSA: usb-audio: Fix OPPO HA-1 vendor ID
Lev Lybin <[email protected]>
ALSA: usb-audio: Add quirk for Microsoft LifeCam HD-6000
Guillaume Fougnies <[email protected]>
ALSA: usb-audio: Fix TEAC UD-501/UD-503/NT-503 usb delay
Thomas Gleixner <[email protected]>
hrtimer: Handle remaining time proper for TIME_LOW_RES
Al Viro <[email protected]>
fix sysvfs symlinks
Artur Paszkiewicz <[email protected]>
md/raid10: fix data corruption and crash during resync
Vladimir Davydov <[email protected]>
mm: memcontrol: fix possible memcg leak due to interrupted reclaim
Mauro Carvalho Chehab <[email protected]>
Revert "[media] ivtv: avoid going past input/audio array"
Antonio Ospite <[email protected]>
media/v4l2-ctrls: fix setting autocluster to manual with VIDIOC_S_CTRL
Tiffany Lin <[email protected]>
media: vb2 dma-sg: Fully cache synchronise buffers in prepare and finish
Tiffany Lin <[email protected]>
media: vb2 dma-contig: Fully cache synchronise buffers in prepare and finish
Benoit Parrot <[email protected]>
media: v4l2-ctrls: Fix 64bit support in get_ctrl()
Hans Verkuil <[email protected]>
v4l2-ctrls: arrays are also considered compound controls
Takashi Iwai <[email protected]>
c8sectpfe: Remove select on CONFIG_FW_LOADER_USER_HELPER_FALLBACK
Andrzej Hajda <[email protected]>
v4l2-compat-ioctl32: fix alignment for ARM64
Ezequiel Garcia <[email protected]>
vivid: Fix iteration in driver removal path
Wolfram Sang <[email protected]>
i2c: rcar: disable runtime PM correctly in slave mode
Wolfram Sang <[email protected]>
i2c: rk3x: populate correct variable for sda_falling_time
Hans de Goede <[email protected]>
i2c: mv64xxx: The n clockdiv factor is 0 based on sunxi SoCs
Javier Martinez Canillas <[email protected]>
media: i2c: Don't export ir-kbd-i2c module alias
Grygorii Strashko <[email protected]>
i2c: fix wakeup irq parsing
Ludovic Desroches <[email protected]>
i2c: at91: manage unexpected RXRDY flag when starting a transfer
Cyrille Pitchen <[email protected]>
i2c: at91: fix write transfers by clearing pending interrupt first
Max Filippov <[email protected]>
xtensa: fix secondary core boot in SMP
Max Filippov <[email protected]>
xtensa: fixes for configs without loop option
Helge Deller <[email protected]>
parisc: Fix __ARCH_SI_PREAMBLE_SIZE
Helge Deller <[email protected]>
parisc: Fix syscall restarts
Helge Deller <[email protected]>
parisc: Drop unused MADV_xxxK_PAGES flags from asm/mman.h
Helge Deller <[email protected]>
parisc: Fixes and cleanups in kernel uapi header files
Mathias Krause <[email protected]>
printk: prevent userland from spoofing kernel messages
Andy Leiserson <[email protected]>
fix calculation of meta_bg descriptor backups
Junxiao Bi <[email protected]>
jbd2: fix null committed data return in undo_access
Jan Kara <[email protected]>
jbd2: Fix unreclaimed pages after truncate in data=journal mode
Jan Kara <[email protected]>
jbd2: fix checkpoint list cleanup
Daniel Borkmann <[email protected]>
tracefs: Fix refcount imbalance in start_creating()
Steven Rostedt <[email protected]>
tracing/stacktrace: Show entire trace if passed in function not found
Qiu Peiyang <[email protected]>
tracing: Fix setting of start_index in find_next()
Jiaxing Wang <[email protected]>
tracing: Update instance_rmdir() to use tracefs_remove_recursive
Christoph Biedl <[email protected]>
PCI: Fix minimum allocation address overwrite
Grygorii Strashko <[email protected]>
PCI: host: Mark PCIe/PCI (MSI) IRQ cascade handlers as IRQF_NO_THREAD
Mathias Krause <[email protected]>
PCI: Prevent out of bounds access in numa_node override
Alexander Duyck <[email protected]>
PCI: Set SR-IOV NumVFs to zero after enumeration
Gabriele Paoloni <[email protected]>
PCI: spear: Fix dw_pcie_cfg_read/write() usage
Sebastian Siewior <[email protected]>
mtd: ubi: don't leak e if schedule_erase() fails
Sebastian Siewior <[email protected]>
mtd: ubi: fixup error correction in do_sync_erase()
Brian Norris <[email protected]>
mtd: jz4740_nand: fix build on jz4740 after removing gpio.h
Brian Norris <[email protected]>
mtd: nand: fix shutdown/reboot for multi-chip systems
Brian Norris <[email protected]>
mtd: blkdevs: fix potential deadlock + lockdep warnings
Boris BREZILLON <[email protected]>
mtd: mtdpart: fix add_mtd_partitions error path
Dmitry Kasatkin <[email protected]>
integrity: prevent loading untrusted certificates on the IMA trusted keyring
Jarkko Sakkinen <[email protected]>
TPM: revert the list handling logic fixed in 398a1e7
Martin Wilck <[email protected]>
tpm_tis: free irq after probing
Hon Ching \(Vicky\) Lo <[email protected]>
vTPM: fix memory allocation flag for rtce buffer at kernel boot
Jarkko Sakkinen <[email protected]>
tpm, tpm_crb: fix unaligned read of the command buffer address
Ricardo Ribalda Delgado <[email protected]>
spi/spi-xilinx: Fix race condition on last word read
Uri Mashiach <[email protected]>
wlcore/wl12xx: spi: fix NULL pointer dereference (Oops)
Uri Mashiach <[email protected]>
wlcore/wl12xx: spi: fix oops on firmware load
Johan Hovold <[email protected]>
spi: fix parent-device reference leak
Vignesh R <[email protected]>
spi: ti-qspi: Fix data corruption seen on r/w stress test
David Mosberger-Tang <[email protected]>
spi: atmel: Fix DMA-setup for transfers with more than 8 bits per word
Neil Armstrong <[email protected]>
spi: omap2-mcspi: disable other channels CHCONF_FORCE in prepare_message
Mauricio Faria de Oliveira <[email protected]>
Revert "dm mpath: fix stalls when handling invalid ioctls"
Mikulas Patocka <[email protected]>
dm: initialize non-blk-mq queue data before queue is used
Dmitry V. Levin <[email protected]>
sh64: fix __NR_fgetxattr
xuejiufei <[email protected]>
ocfs2/dlm: clear refmap bit of recovery lock while doing local recovery cleanup
xuejiufei <[email protected]>
ocfs2/dlm: ignore cleaning the migration mle that is inuse
Joseph Qi <[email protected]>
ocfs2: fix BUG when calculate new backup super
Junxiao Bi <[email protected]>
ocfs2: fix SGID not inherited issue
Mike Kravetz <[email protected]>
mm/hugetlb.c: fix resv map memory leak for placeholder entries
Richard Weinberger <[email protected]>
kernel/signal.c: unexport sigsuspend()
Naoya Horiguchi <[email protected]>
mm: hugetlb: call huge_pte_alloc() only if ptep is null
OGAWA Hirofumi <[email protected]>
fat: fix fake_offset handling on error path
Mike Kravetz <[email protected]>
mm/hugetlbfs: fix bugs in fallocate hole punch of areas with holes
Michal Hocko <[email protected]>
mm, vmstat: allow WQ concurrency to discover memory reclaim doesn't make any progress
Naoya Horiguchi <[email protected]>
mm: hugetlb: fix hugepage memory leak caused by wrong reserve count
Michal Hocko <[email protected]>
memcg: fix thresholds for 32b architectures.
Greg Thelen <[email protected]>
fs, seqfile: always allow oom killer
Andy Shevchenko <[email protected]>
lib/hexdump.c: truncate output in case of overflow
Tetsuo Handa <[email protected]>
mm/oom_kill.c: reverse the order of setting TIF_MEMDIE and sending SIGKILL
Catalin Marinas <[email protected]>
mm: slab: only move management objects off-slab for sizes larger than KMALLOC_MIN_SIZE
Colin Ian King <[email protected]>
proc: fix -ESRCH error when writing to /proc/$pid/coredump_filter
Arnd Bergmann <[email protected]>
remoteproc: avoid stack overflow in debugfs file
Oleg Nesterov <[email protected]>
proc: actually make proc_fd_permission() thread-friendly
Takashi Iwai <[email protected]>
ALSA: hda - Implement loopback control switch for Realtek and other codecs
Ioan-Adrian Ratiu <[email protected]>
HID: usbhid: fix recursive deadlock
Tariq Saeed <[email protected]>
ocfs2: NFS hangs in __ocfs2_cluster_lock due to race with ocfs2_unblock_lock
Trond Myklebust <[email protected]>
NFSv4.1/pnfs: Fixup an lo->plh_block_lgets imbalance in layoutreturn
Junichi Nomura <[email protected]>
block: ensure to split after potentially bouncing a bio
Seth Jennings <[email protected]>
drivers/base/memory.c: prohibit offlining of memory blocks with missing sections
Mike Snitzer <[email protected]>
dm btree: fix leak of bufio-backed block in btree_split_sibling error path
Hannes Reinecke <[email protected]>
block: Always check queue limits for cloned requests
LABBE Corentin <[email protected]>
crypto: sun4i-ss - add missing statesize
Herbert Xu <[email protected]>
crypto: algif_skcipher - Use new skcipher interface
Jason A. Donenfeld <[email protected]>
crypto: skcipher - Copy iv from desc even for 0-len walks
David Gstir <[email protected]>
crypto: talitos - Fix timing leak in ESP ICV verification
David Gstir <[email protected]>
crypto: nx - Fix timing leak in GCM and CCM decryption
Tadeusz Struk <[email protected]>
crypto: qat - don't use userspace pointer
Herbert Xu <[email protected]>
crypto: algif_hash - Only export and import on sockets with data
Jaegeuk Kim <[email protected]>
f2fs crypto: allocate buffer for decrypting filename
Russell King <[email protected]>
crypto: caam - fix non-block aligned hash calculation
Nicolas Iooss <[email protected]>
crypto: crc32c-pclmul - use .rodata instead of .rotata
-------------
Diffstat:
Makefile | 4 +- arch/arm64/mm/mmu.c | 13 +- arch/parisc/include/asm/compat.h | 4 +- arch/parisc/include/uapi/asm/ipcbuf.h | 19 +- arch/parisc/include/uapi/asm/mman.h | 10 - arch/parisc/include/uapi/asm/msgbuf.h | 10 +- arch/parisc/include/uapi/asm/posix_types.h | 2 + arch/parisc/include/uapi/asm/sembuf.h | 6 +- arch/parisc/include/uapi/asm/shmbuf.h | 8 +- arch/parisc/include/uapi/asm/siginfo.h | 4 + arch/parisc/kernel/signal.c | 64 ++++-- arch/parisc/mm/init.c | 16 ++ arch/sh/include/uapi/asm/unistd_64.h | 2 +- arch/x86/crypto/chacha20-ssse3-x86_64.S | 6 +- arch/x86/crypto/crc32c-pcl-intel-asm_64.S | 2 +- arch/xtensa/include/asm/asmmacro.h | 7 +- arch/xtensa/include/asm/vectors.h | 9 +- arch/xtensa/kernel/Makefile | 1 + arch/xtensa/kernel/entry.S | 8 +- arch/xtensa/kernel/head.S | 2 +- arch/xtensa/kernel/setup.c | 9 +- arch/xtensa/kernel/vectors.S | 4 +- arch/xtensa/kernel/vmlinux.lds.S | 12 +- arch/xtensa/lib/usercopy.S | 6 +- arch/xtensa/platforms/iss/setup.c | 2 + arch/xtensa/platforms/xt2000/setup.c | 2 + arch/xtensa/platforms/xtfpga/setup.c | 2 + block/blk-core.c | 25 +-- crypto/ablkcipher.c | 2 +- crypto/af_alg.c | 55 ++++- crypto/ahash.c | 5 +- crypto/algif_hash.c | 181 +++++++++++++++- crypto/algif_skcipher.c | 279 +++++++++++++++++++------ crypto/blkcipher.c | 2 +- crypto/crc32c_generic.c | 1 - crypto/crypto_user.c | 6 +- crypto/shash.c | 5 +- crypto/skcipher.c | 2 + crypto/testmgr.h | 7 +- drivers/ata/ahci.c | 20 ++ drivers/ata/libahci.c | 13 +- drivers/base/memory.c | 4 + drivers/block/zram/zcomp.c | 4 +- drivers/block/zram/zcomp_lz4.c | 23 +- drivers/block/zram/zcomp_lzo.c | 23 +- drivers/block/zram/zram_drv.c | 7 +- drivers/char/tpm/tpm-chip.c | 2 +- drivers/char/tpm/tpm_crb.c | 7 +- drivers/char/tpm/tpm_ibmvtpm.c | 2 +- drivers/char/tpm/tpm_tis.c | 2 + drivers/crypto/caam/caamhash.c | 2 +- drivers/crypto/caam/ctrl.c | 4 +- drivers/crypto/marvell/cesa.c | 2 +- drivers/crypto/nx/nx-aes-ccm.c | 2 +- drivers/crypto/nx/nx-aes-gcm.c | 3 +- drivers/crypto/qat/qat_common/adf_ctl_drv.c | 2 +- drivers/crypto/sunxi-ss/sun4i-ss-core.c | 2 + drivers/crypto/talitos.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/pmu/base.c | 2 +- drivers/hid/hid-multitouch.c | 45 +++- drivers/hid/usbhid/hid-core.c | 4 +- drivers/i2c/busses/i2c-at91.c | 82 ++++++-- drivers/i2c/busses/i2c-mv64xxx.c | 27 ++- drivers/i2c/busses/i2c-rcar.c | 4 +- drivers/i2c/busses/i2c-rk3x.c | 2 +- drivers/i2c/i2c-core.c | 2 +- drivers/iommu/io-pgtable-arm.c | 11 +- drivers/md/dm-mpath.c | 7 +- drivers/md/dm.c | 10 +- drivers/md/persistent-data/dm-btree.c | 4 +- drivers/md/raid10.c | 4 +- drivers/media/i2c/ir-kbd-i2c.c | 1 - drivers/media/pci/ivtv/ivtv-driver.c | 4 +- drivers/media/pci/saa7134/saa7134-alsa.c | 5 +- drivers/media/platform/sti/c8sectpfe/Kconfig | 1 - drivers/media/platform/vivid/vivid-core.c | 5 +- drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 9 +- drivers/media/v4l2-core/v4l2-ctrls.c | 12 +- drivers/media/v4l2-core/videobuf2-dma-contig.c | 5 +- drivers/media/v4l2-core/videobuf2-dma-sg.c | 5 +- drivers/mtd/mtd_blkdevs.c | 10 +- drivers/mtd/mtdpart.c | 4 +- drivers/mtd/nand/jz4740_nand.c | 1 + drivers/mtd/nand/nand_base.c | 2 +- drivers/mtd/ubi/wl.c | 53 ++--- drivers/net/wireless/rtlwifi/rtl8821ae/hw.c | 2 +- drivers/net/wireless/rtlwifi/rtl8821ae/sw.c | 2 +- drivers/net/wireless/ti/wlcore/io.h | 10 +- drivers/net/wireless/ti/wlcore/spi.c | 10 +- drivers/pci/bus.c | 6 +- drivers/pci/host/pci-dra7xx.c | 3 +- drivers/pci/host/pci-exynos.c | 3 +- drivers/pci/host/pci-imx6.c | 3 +- drivers/pci/host/pci-tegra.c | 2 +- drivers/pci/host/pcie-rcar.c | 6 +- drivers/pci/host/pcie-spear13xx.c | 29 +-- drivers/pci/host/pcie-xilinx.c | 3 +- drivers/pci/iov.c | 41 ++-- drivers/pci/pci-sysfs.c | 5 +- drivers/remoteproc/remoteproc_debugfs.c | 2 +- drivers/spi/spi-atmel.c | 3 +- drivers/spi/spi-omap2-mcspi.c | 28 +++ drivers/spi/spi-ti-qspi.c | 3 +- drivers/spi/spi-xilinx.c | 38 ++-- drivers/spi/spi.c | 2 +- drivers/tty/n_tty.c | 29 +-- drivers/tty/tty_buffer.c | 2 +- drivers/tty/tty_io.c | 36 +++- drivers/usb/class/cdc-acm.c | 9 +- drivers/usb/class/cdc-acm.h | 1 + drivers/usb/core/hub.c | 8 +- drivers/usb/host/xhci-hub.c | 45 +++- drivers/usb/host/xhci-pci.c | 52 +++-- drivers/usb/host/xhci-ring.c | 3 +- drivers/usb/phy/phy-msm-usb.c | 37 ++-- drivers/usb/serial/cp210x.c | 1 + drivers/usb/serial/ftdi_sio.c | 1 + drivers/usb/serial/ftdi_sio_ids.h | 1 + drivers/usb/serial/option.c | 18 +- drivers/usb/serial/visor.c | 11 +- fs/binfmt_elf.c | 10 +- fs/cachefiles/rdwr.c | 69 +++--- fs/ext2/super.c | 2 + fs/ext4/crypto.c | 2 +- fs/ext4/ext4.h | 51 ++++- fs/ext4/resize.c | 4 +- fs/ext4/super.c | 6 +- fs/ext4/symlink.c | 2 +- fs/f2fs/dir.c | 13 +- fs/f2fs/namei.c | 10 +- fs/fat/dir.c | 16 +- fs/fscache/netfs.c | 38 ++-- fs/fscache/page.c | 2 +- fs/hugetlbfs/inode.c | 65 +++--- fs/jbd2/checkpoint.c | 8 +- fs/jbd2/transaction.c | 12 +- fs/nfs/nfs4proc.c | 1 - fs/ocfs2/dlm/dlmmaster.c | 26 ++- fs/ocfs2/dlm/dlmrecovery.c | 2 + fs/ocfs2/dlmglue.c | 6 + fs/ocfs2/namei.c | 4 +- fs/ocfs2/resize.c | 15 +- fs/pipe.c | 9 +- fs/proc/base.c | 1 + fs/proc/fd.c | 14 +- fs/seq_file.c | 11 +- fs/sysv/inode.c | 11 +- fs/tracefs/inode.c | 6 +- include/crypto/hash.h | 6 + include/crypto/if_alg.h | 11 +- include/crypto/skcipher.h | 7 + include/linux/blkdev.h | 1 - include/linux/hrtimer.h | 34 ++- include/linux/signal.h | 1 - include/sound/rawmidi.h | 4 + kernel/printk/printk.c | 13 +- kernel/sched/core.c | 2 +- kernel/signal.c | 2 +- kernel/time/hrtimer.c | 55 +++-- kernel/time/timer_list.c | 2 +- kernel/trace/trace.c | 2 +- kernel/trace/trace_printk.c | 1 + kernel/trace/trace_stack.c | 7 + lib/hexdump.c | 6 +- lib/libcrc32c.c | 1 + mm/backing-dev.c | 19 +- mm/hugetlb.c | 27 ++- mm/memcontrol.c | 71 +++++-- mm/oom_kill.c | 7 +- mm/slab.c | 5 +- mm/vmstat.c | 6 +- mm/zsmalloc.c | 14 +- security/integrity/digsig.c | 2 +- security/integrity/evm/evm_main.c | 3 +- sound/core/compress_offload.c | 11 + sound/core/oss/pcm_oss.c | 21 +- sound/core/rawmidi.c | 134 ++++++++---- sound/core/seq/oss/seq_oss_init.c | 2 +- sound/core/seq/oss/seq_oss_synth.c | 2 +- sound/core/seq/seq_clientmgr.c | 3 + sound/core/seq/seq_ports.c | 233 ++++++++++++--------- sound/core/seq/seq_timer.c | 87 ++++++-- sound/core/seq/seq_virmidi.c | 23 +- sound/core/timer.c | 98 +++++---- sound/drivers/dummy.c | 35 ++-- sound/firewire/bebob/bebob_stream.c | 14 +- sound/pci/hda/hda_generic.c | 91 ++++++-- sound/pci/hda/hda_jack.c | 2 +- sound/pci/hda/hda_jack.h | 2 +- sound/pci/hda/patch_ca0132.c | 5 +- sound/pci/hda/patch_cirrus.c | 27 +++ sound/pci/hda/patch_hdmi.c | 5 +- sound/pci/hda/patch_realtek.c | 11 +- sound/pci/hda/patch_sigmatel.c | 6 +- sound/soc/codecs/rt5645.c | 2 +- sound/soc/soc-pcm.c | 3 +- sound/usb/midi.c | 1 - sound/usb/quirks.c | 18 +- 198 files changed, 2305 insertions(+), 962 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 3/200 f2fs crypto: allocate buffer for decrypting filename
4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jaegeuk Kim <[email protected]>
commit 569cf1876a32e574ba8a7fb825cd91bafd003882 upstream.
We got dentry pages from high_mem, and its address space directly goes into the decryption path via f2fs_fname_disk_to_usr.
But, sg_init_one assumes the address is not from high_mem, so we can get this panic since it doesn't call kmap_high but kunmap_high is triggered at the end.
kernel BUG at ../../../../../../kernel/mm/highmem.c:290!
Internal error: Oops - BUG: 0 [#1] PREEMPT SMP ARM
...
(kunmap_high+0xb0/0xb8) from [<c0114534>] (__kunmap_atomic+0xa0/0xa4) (__kunmap_atomic+0xa0/0xa4) from [<c035f028>] (blkcipher_walk_done+0x128/0x1ec) (blkcipher_walk_done+0x128/0x1ec) from [<c0366c24>] (crypto_cbc_decrypt+0xc0/0x170) (crypto_cbc_decrypt+0xc0/0x170) from [<c0367148>] (crypto_cts_decrypt+0xc0/0x114) (crypto_cts_decrypt+0xc0/0x114) from [<c035ea98>] (async_decrypt+0x40/0x48) (async_decrypt+0x40/0x48) from [<c032ca34>] (f2fs_fname_disk_to_usr+0x124/0x304) (f2fs_fname_disk_to_usr+0x124/0x304) from [<c03056fc>] (f2fs_fill_dentries+0xac/0x188) (f2fs_fill_dentries+0xac/0x188) from [<c03059c8>] (f2fs_readdir+0x1f0/0x300) (f2fs_readdir+0x1f0/0x300) from [<c0218054>] (vfs_readdir+0x90/0xb4) (vfs_readdir+0x90/0xb4) from [<c0218418>] (SyS_getdents64+0x64/0xcc) (SyS_getdents64+0x64/0xcc) from [<c0105ba0>] (ret_fast_syscall+0x0/0x30)
--- fs/f2fs/dir.c | 13 ++++++++++--- fs/f2fs/namei.c | 10 +++++++++- 2 files changed, 19 insertions(+), 4 deletions(-)
fs/f2fs/dir.c +10 -3
@@ -787,7 +787,6 @@ bool f2fs_fill_dentries(struct dir_conteelse d_type =DT_UNKNOWN ; -/* encrypted case */ de_name.name = d->filename[bit_pos]; de_name.len =le16_to_cpu (de->name_len);
@@ -795,12 +794,20 @@ bool f2fs_fill_dentries(struct dir_conteint save_len = fstr->len;int ret; + de_name.name =kmalloc (de_name.len,GFP_NOFS ); +if (!de_name.name) +return false; + +memcpy (de_name.name, d->filename[bit_pos], de_name.len); + ret =f2fs_fname_disk_to_usr (d->inode, &de->hash_code, &de_name, fstr); - de_name = *fstr; - fstr->len = save_len; +kfree (de_name.name);if (ret <0 )return true; + + de_name = *fstr; + fstr->len = save_len; } if (!dir_emit(ctx, de_name.name, de_name.len,
fs/f2fs/namei.c +9 -1
@@ -947,8 +947,13 @@ static const char *f2fs_encrypted_follow/* Symlink is encrypted */ sd = (struct f2fs_encrypted_symlink_data *)caddr; - cstr.name = sd->encrypted_path; cstr.len =le16_to_cpu (sd->len); + cstr.name =kmalloc (cstr.len,GFP_NOFS ); +if (!cstr.name) { + res = -ENOMEM ; + goto errout; + } +memcpy (cstr.name, sd->encrypted_path, cstr.len);/* this is broken symlink case */ if (cstr.name[0 ] ==0 && cstr.len ==0 ) {
@@ -970,6 +975,8 @@ static const char *f2fs_encrypted_followif (res <0 ) goto errout; +kfree (cstr.name); + paddr = pstr.name;/* Null-terminate the name */
@@ -979,6 +986,7 @@ static const char *f2fs_encrypted_followpage_cache_release (cpage);return *cookie = paddr; errout: +kfree (cstr.name);f2fs_fname_crypto_free_buffer (&pstr);kunmap (cpage);page_cache_release (cpage);
Greg Kroah-Hartman
maintainerPATCH 7/200 crypto: talitos - Fix timing leak in ESP ICV verification
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Gstir <[email protected]>
commit 79960943fdc114fd4583c9ab164b5c89da7aa601 upstream.
Using non-constant time memcmp() makes the verification of the authentication tag in the decrypt path vulnerable to timing attacks. Fix this by using crypto_memneq() instead.
--- drivers/crypto/talitos.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/crypto/talitos.c +1 -1
@@ -1015,7 +1015,7 @@ static void ipsec_esp_decrypt_swauth_don }else oicv = (char *)&edesc->link_tbl[0 ]; - err =memcmp (oicv, icv, authsize) ? -EBADMSG :0 ; + err =crypto_memneq (oicv, icv, authsize) ? -EBADMSG :0 ; }kfree (edesc);
Greg Kroah-Hartman
maintainerPATCH 8/200 crypto: skcipher - Copy iv from desc even for 0-len walks
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Jason A. Donenfeld" <[email protected]>
commit 70d906bc17500edfa9bdd8c8b7e59618c7911613 upstream.
Some ciphers actually support encrypting zero length plaintexts. For example, many AEAD modes support this. The resulting ciphertext for those winds up being only the authentication tag, which is a result of the key, the iv, the additional data, and the fact that the plaintext had zero length. The blkcipher constructors won't copy the IV to the right place, however, when using a zero length input, resulting in some significant problems when ciphers call their initialization routines, only to find that the ->iv parameter is uninitialized. One such example of this would be using chacha20poly1305 with a zero length input, which then calls chacha20, which calls the key setup routine, which eventually OOPSes due to the uninitialized ->iv member.
--- crypto/ablkcipher.c | 2 +- crypto/blkcipher.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
crypto/ablkcipher.c +1 -1
@@ -277,12 +277,12 @@ static int ablkcipher_walk_first(structif (WARN_ON_ONCE (in_irq ()))return -EDEADLK ; + walk->iv = req->info; walk->nbytes = walk->total;if (unlikely (!walk->total))return 0 ; walk->iv_buffer =NULL ; - walk->iv = req->info;if (unlikely (((unsigned long )walk->iv & alignmask))) {int err =ablkcipher_copy_iv (walk, tfm, alignmask);
crypto/blkcipher.c +1 -1
@@ -326,12 +326,12 @@ static int blkcipher_walk_first(struct bif (WARN_ON_ONCE (in_irq ()))return -EDEADLK ; + walk->iv = desc->info; walk->nbytes = walk->total;if (unlikely (!walk->total))return 0 ; walk->buffer =NULL ; - walk->iv = desc->info;if (unlikely (((unsigned long )walk->iv & walk->alignmask))) {int err =blkcipher_copy_iv (walk);if (err)
Greg Kroah-Hartman
maintainerPATCH 9/200 crypto: algif_skcipher - Use new skcipher interface
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
commit 0d96e4bab2855a030077cc695a3563fd7cb0e7d8 upstream.
This patch replaces uses of ablkcipher with the new skcipher interface.
--- crypto/algif_skcipher.c | 61 +++++++++++++++++++++++------------------------- 1 file changed, 30 insertions(+), 31 deletions(-)
crypto/algif_skcipher.c +30 -31
@@ -47,7 +47,7 @@ struct skcipher_ctx {bool merge;bool enc; -struct ablkcipher_request req; +struct skcipher_request req; };struct skcipher_async_rsgl {
@@ -64,13 +64,13 @@ struct skcipher_async_req { };#define GET_SREQ (areq, ctx) (struct skcipher_async_req *)((char *)areq + \ - crypto_ablkcipher_reqsize(crypto_ablkcipher_reqtfm(&ctx->req))) + crypto_skcipher_reqsize(crypto_skcipher_reqtfm(&ctx->req)))#define GET_REQ_SIZE (ctx) \ - crypto_ablkcipher_reqsize(crypto_ablkcipher_reqtfm(&ctx->req)) + crypto_skcipher_reqsize(crypto_skcipher_reqtfm(&ctx->req))#define GET_IV_SIZE (ctx) \ - crypto_ablkcipher_ivsize(crypto_ablkcipher_reqtfm(&ctx->req)) + crypto_skcipher_ivsize(crypto_skcipher_reqtfm(&ctx->req))#define MAX_SGL_ENTS ((4096 - sizeof(struct skcipher_sg_list)) / \ sizeof(struct scatterlist) - 1)
@@ -302,8 +302,8 @@ static int skcipher_sendmsg(struct sockestruct sock *sk = sock->sk;struct alg_sock *ask =alg_sk (sk);struct skcipher_ctx *ctx = ask->private; -struct crypto_ablkcipher *tfm =crypto_ablkcipher_reqtfm (&ctx->req); -unsigned ivsize =crypto_ablkcipher_ivsize (tfm); +struct crypto_skcipher *tfm =crypto_skcipher_reqtfm (&ctx->req); +unsigned ivsize =crypto_skcipher_ivsize (tfm);struct skcipher_sg_list *sgl;struct af_alg_control con = {};long copied =0 ;
@@ -507,7 +507,7 @@ static int skcipher_recvmsg_async(structstruct skcipher_sg_list *sgl;struct scatterlist *sg;struct skcipher_async_req *sreq; -struct ablkcipher_request *req; +struct skcipher_request *req;struct skcipher_async_rsgl *last_rsgl =NULL ;unsigned int txbufs =0 , len =0 , tx_nents =skcipher_all_sg_nents (ctx); unsigned int reqlen = sizeof(struct skcipher_async_req) +
@@ -531,9 +531,9 @@ static int skcipher_recvmsg_async(struct }sg_init_table (sreq->tsg, tx_nents);memcpy (sreq->iv, ctx->iv,GET_IV_SIZE (ctx)); -ablkcipher_request_set_tfm (req,crypto_ablkcipher_reqtfm (&ctx->req)); -ablkcipher_request_set_callback (req,CRYPTO_TFM_REQ_MAY_BACKLOG , - skcipher_async_cb, sk); +skcipher_request_set_tfm (req,crypto_skcipher_reqtfm (&ctx->req)); +skcipher_request_set_callback (req,CRYPTO_TFM_REQ_MAY_BACKLOG , + skcipher_async_cb, sk);while (iov_iter_count (&msg->msg_iter)) {struct skcipher_async_rsgl *rsgl;
@@ -608,10 +608,10 @@ static int skcipher_recvmsg_async(structif (mark)sg_mark_end (sreq->tsg + txbufs -1 ); -ablkcipher_request_set_crypt (req, sreq->tsg, sreq->first_sgl.sgl.sg, - len, sreq->iv); - err = ctx->enc ?crypto_ablkcipher_encrypt (req) : -crypto_ablkcipher_decrypt (req); +skcipher_request_set_crypt (req, sreq->tsg, sreq->first_sgl.sgl.sg, + len, sreq->iv); + err = ctx->enc ?crypto_skcipher_encrypt (req) : +crypto_skcipher_decrypt (req);if (err == -EINPROGRESS ) {atomic_inc (&ctx->inflight); err = -EIOCBQUEUED ;
@@ -632,7 +632,7 @@ static int skcipher_recvmsg_sync(structstruct sock *sk = sock->sk;struct alg_sock *ask =alg_sk (sk);struct skcipher_ctx *ctx = ask->private; -unsigned bs =crypto_ablkcipher_blocksize (crypto_ablkcipher_reqtfm ( +unsigned bs =crypto_skcipher_blocksize (crypto_skcipher_reqtfm ( &ctx->req));struct skcipher_sg_list *sgl;struct scatterlist *sg;
@@ -669,14 +669,13 @@ static int skcipher_recvmsg_sync(structif (!used) goto free; -ablkcipher_request_set_crypt (&ctx->req, sg, - ctx->rsgl.sg, used, - ctx->iv); +skcipher_request_set_crypt (&ctx->req, sg, ctx->rsgl.sg, used, + ctx->iv); err =af_alg_wait_for_completion ( ctx->enc ? -crypto_ablkcipher_encrypt (&ctx->req) : -crypto_ablkcipher_decrypt (&ctx->req), +crypto_skcipher_encrypt (&ctx->req) : +crypto_skcipher_decrypt (&ctx->req), &ctx->completion); free:
@@ -751,17 +750,17 @@ static struct proto_ops algif_skcipher_ostatic void *skcipher_bind (const char *name,u32 type,u32 mask) { -return crypto_alloc_ablkcipher (name, type, mask); +return crypto_alloc_skcipher (name, type, mask); }static void skcipher_release (void *private) { -crypto_free_ablkcipher (private); +crypto_free_skcipher (private); }static int skcipher_setkey (void *private,const u8 *key,unsigned int keylen) { -return crypto_ablkcipher_setkey (private, key, keylen); +return crypto_skcipher_setkey (private, key, keylen); }static void skcipher_wait (struct sock *sk)
@@ -778,13 +777,13 @@ static void skcipher_sock_destruct(struc {struct alg_sock *ask =alg_sk (sk);struct skcipher_ctx *ctx = ask->private; -struct crypto_ablkcipher *tfm =crypto_ablkcipher_reqtfm (&ctx->req); +struct crypto_skcipher *tfm =crypto_skcipher_reqtfm (&ctx->req);if (atomic_read (&ctx->inflight))skcipher_wait (sk);skcipher_free_sgl (sk); -sock_kzfree_s (sk, ctx->iv,crypto_ablkcipher_ivsize (tfm)); +sock_kzfree_s (sk, ctx->iv,crypto_skcipher_ivsize (tfm));sock_kfree_s (sk, ctx, ctx->len);af_alg_release_parent (sk); }
@@ -793,20 +792,20 @@ static int skcipher_accept_parent(void * {struct skcipher_ctx *ctx;struct alg_sock *ask =alg_sk (sk); -unsigned int len =sizeof (*ctx) +crypto_ablkcipher_reqsize (private); +unsigned int len =sizeof (*ctx) +crypto_skcipher_reqsize (private); ctx =sock_kmalloc (sk, len,GFP_KERNEL );if (!ctx)return -ENOMEM ; - ctx->iv =sock_kmalloc (sk,crypto_ablkcipher_ivsize (private), + ctx->iv =sock_kmalloc (sk,crypto_skcipher_ivsize (private),GFP_KERNEL );if (!ctx->iv) {sock_kfree_s (sk, ctx, len);return -ENOMEM ; } -memset (ctx->iv,0 ,crypto_ablkcipher_ivsize (private)); +memset (ctx->iv,0 ,crypto_skcipher_ivsize (private));INIT_LIST_HEAD (&ctx->tsgl); ctx->len = len;
@@ -819,9 +818,9 @@ static int skcipher_accept_parent(void * ask->private = ctx; -ablkcipher_request_set_tfm (&ctx->req, private); -ablkcipher_request_set_callback (&ctx->req,CRYPTO_TFM_REQ_MAY_BACKLOG , - af_alg_complete, &ctx->completion); +skcipher_request_set_tfm (&ctx->req, private); +skcipher_request_set_callback (&ctx->req,CRYPTO_TFM_REQ_MAY_BACKLOG , + af_alg_complete, &ctx->completion); sk->sk_destruct = skcipher_sock_destruct;
Greg Kroah-Hartman
maintainerPATCH 12/200 dm btree: fix leak of bufio-backed block in btree_split_sibling error path
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Snitzer <[email protected]>
commit 30ce6e1cc5a0f781d60227e9096c86e188d2c2bd upstream.
The block allocated at the start of btree_split_sibling() is never released if later insert_at() fails.
Fix this by releasing the previously allocated bufio block using unlock_block().
--- drivers/md/persistent-data/dm-btree.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/md/persistent-data/dm-btree.c +3 -1
@@ -471,8 +471,10 @@ static int btree_split_sibling(struct sh r =insert_at (sizeof (__le64), pn, parent_index +1 ,le64_to_cpu (rn->keys[0 ]), &location); -if (r) +if (r) { +unlock_block (s->info, right);return r; + }if (key <le64_to_cpu (rn->keys[0 ])) {unlock_block (s->info, right);
Greg Kroah-Hartman
maintainerPATCH 13/200 drivers/base/memory.c: prohibit offlining of memory blocks with missing sections
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seth Jennings <[email protected]>
commit 26bbe7ef6d5cdc7ec08cba6d433fca4060f258f3 upstream.
Commit bdee237c0343 ("x86: mm: Use 2GB memory block size on large-memory x86-64 systems") and 982792c782ef ("x86, mm: probe memory block size for generic x86 64bit") introduced large block sizes for x86. This made it possible to have multiple sections per memory block where previously, there was a only every one section per block.
Since blocks consist of contiguous ranges of section, there can be holes in the blocks where sections are not present. If one attempts to offline such a block, a crash occurs since the code is not designed to deal with this.
This patch is a quick fix to gaurd against the crash by not allowing blocks with non-present sections to be offlined.
Addresses https://bugzilla.kernel.org/show_bug.cgi?id=107781
--- drivers/base/memory.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/base/memory.c +4 -0
@@ -303,6 +303,10 @@ static int memory_subsys_offline(structif (mem->state ==MEM_OFFLINE )return 0 ; +/* Can't offline block with non-present sections */ +if (mem->section_count != sections_per_block) +return -EINVAL ; +return memory_block_change_state (mem,MEM_OFFLINE ,MEM_ONLINE ); }
Greg Kroah-Hartman
maintainerPATCH 14/200 block: ensure to split after potentially bouncing a bio
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junichi Nomura <[email protected]>
commit 23688bf4f830a89866fd0ed3501e342a7360fe4f upstream.
blk_queue_bio() does split then bounce, which makes the segment counting based on pages before bouncing and could go wrong. Move the split to after bouncing, like we do for blk-mq, and the we fix the issue of having the bio count for segments be wrong.
--- block/blk-core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
block/blk-core.c +2 -2
@@ -1616,8 +1616,6 @@ static void blk_queue_bio(struct requeststruct request *req;unsigned int request_count =0 ; -blk_queue_split (q, &bio, q->bio_split); -/* * low level driver can indicate that it wants pages above a * certain limit bounced to low memory (ie for highmem, or even
@@ -1625,6 +1623,8 @@ static void blk_queue_bio(struct request*/ blk_queue_bounce (q, &bio); +blk_queue_split (q, &bio, q->bio_split); +if (bio_integrity_enabled (bio) &&bio_integrity_prep (bio)) { bio->bi_error = -EIO ;bio_endio (bio);
Greg Kroah-Hartman
maintainerPATCH 18/200 ALSA: hda - Implement loopback control switch for Realtek and other codecs
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit e7fdd52779a6c2b49d457f452296a77c8cffef6a upstream.
Many codecs, typically found on Realtek codecs, have the analog loopback path merged to the secondary input of the middle of the output paths. Currently, we don't offer the dynamic switching in such configuration but let each loopback path mute by itself.
This should work well in theory, but in reality, we often see that such a dead loopback path causes some background noises even if all the elements get muted. Such a problem has been fixed by adding the quirk accordingly to disable aamix, and it's the right fix, per se. The only problem is that it's not so trivial to achieve it; user needs to pass a hint string via patch module option or sysfs.
This patch gives a bit improvement on the situation: it adds "Loopback Mixing" control element for such codecs like other codecs (e.g. IDT or VIA codecs) with the individual loopback paths. User can turn on/off the loopback path simply via a mixer app.
For keeping the compatibility, the loopback is still enabled on these codecs. But user can try to turn it off if experiencing a suspicious background or click noise on the fly, then build a static fixup later once after the problem is addressed.
Other than the addition of the loopback enable/disablement control, there should be no changes.
--- sound/pci/hda/hda_generic.c | 87 ++++++++++++++++++++++++++++++++++---------- 1 file changed, 68 insertions(+), 19 deletions(-)
sound/pci/hda/hda_generic.c +68 -19
@@ -771,9 +771,6 @@ static void activate_amp(struct hda_codeunsigned int caps;unsigned int mask, val; -if (!enable &&is_active_nid (codec, nid, dir, idx_to_check)) -return ; - caps =query_amp_caps (codec, nid, dir); val =get_amp_val_to_activate (codec, nid, dir, caps, enable); mask =get_amp_mask_to_modify (codec, nid, dir, idx_to_check, caps);
@@ -784,12 +781,22 @@ static void activate_amp(struct hda_codeupdate_amp (codec, nid, dir, idx, mask, val); } +static void check_and_activate_amp (struct hda_codec *codec,hda_nid_t nid, +int dir,int idx,int idx_to_check, +bool enable) +{ +/* check whether the given amp is still used by others */ +if (!enable &&is_active_nid (codec, nid, dir, idx_to_check)) +return ; +activate_amp (codec, nid, dir, idx, idx_to_check, enable); +} +static void activate_amp_out (struct hda_codec *codec,struct nid_path *path,int i,bool enable) {hda_nid_t nid = path->path[i];init_amp (codec, nid,HDA_OUTPUT ,0 ); -activate_amp (codec, nid,HDA_OUTPUT ,0 ,0 , enable); +check_and_activate_amp (codec, nid,HDA_OUTPUT ,0 ,0 , enable); } static void activate_amp_in(struct hda_codec *codec, struct nid_path *path,
@@ -817,9 +824,16 @@ static void activate_amp_in(struct hda_c* when aa-mixer is available, we need to enable the path as well */ for (n =0 ; n < nums; n++) { -if (n != idx && (!add_aamix || conn[n] != spec->mixer_merge_nid)) -continue ; -activate_amp (codec, nid,HDA_INPUT , n, idx, enable); +if (n != idx) { +if (conn[n] != spec->mixer_merge_nid) +continue ; +/* when aamix is disabled, force to off */ +if (!add_aamix) { +activate_amp (codec, nid,HDA_INPUT , n, n, false); +continue ; + } + } +check_and_activate_amp (codec, nid,HDA_INPUT , n, idx, enable); } }
@@ -1580,6 +1594,12 @@ static bool map_singles(struct hda_codecreturn found; } +static inline bool has_aamix_out_paths (struct hda_gen_spec *spec) +{ +return spec->aamix_out_paths[0 ] || spec->aamix_out_paths[1 ] || + spec->aamix_out_paths[2 ]; +} +/* create a new path including aamix if available, and return its index */ static int check_aamix_out_path (struct hda_codec *codec,int path_idx) {
@@ -2422,25 +2442,51 @@ static void update_aamix_paths(struct hd } } +/* re-initialize the output paths; only called from loopback_mixing_put() */ +static void update_output_paths (struct hda_codec *codec,int num_outs, +const int *paths) +{ +struct hda_gen_spec *spec = codec->spec; +struct nid_path *path; +int i; + +for (i =0 ; i < num_outs; i++) { + path =snd_hda_get_path_from_idx (codec, paths[i]); +if (path) +snd_hda_activate_path (codec, path, path->active, + spec->aamix_mode); + } +} +static int loopback_mixing_put (struct snd_kcontrol *kcontrol,struct snd_ctl_elem_value *ucontrol) {struct hda_codec *codec =snd_kcontrol_chip (kcontrol);struct hda_gen_spec *spec = codec->spec; +const struct auto_pin_cfg *cfg = &spec->autocfg;unsigned int val = ucontrol->value.enumerated.item[0 ];if (val == spec->aamix_mode)return 0 ; spec->aamix_mode = val; -update_aamix_paths (codec, val, spec->out_paths[0 ], - spec->aamix_out_paths[0 ], - spec->autocfg.line_out_type); -update_aamix_paths (codec, val, spec->hp_paths[0 ], - spec->aamix_out_paths[1 ], -AUTO_PIN_HP_OUT ); -update_aamix_paths (codec, val, spec->speaker_paths[0 ], - spec->aamix_out_paths[2 ], -AUTO_PIN_SPEAKER_OUT ); +if (has_aamix_out_paths (spec)) { +update_aamix_paths (codec, val, spec->out_paths[0 ], + spec->aamix_out_paths[0 ], + cfg->line_out_type); +update_aamix_paths (codec, val, spec->hp_paths[0 ], + spec->aamix_out_paths[1 ], +AUTO_PIN_HP_OUT ); +update_aamix_paths (codec, val, spec->speaker_paths[0 ], + spec->aamix_out_paths[2 ], +AUTO_PIN_SPEAKER_OUT ); + }else { +update_output_paths (codec, cfg->line_outs, spec->out_paths); +if (cfg->line_out_type !=AUTO_PIN_HP_OUT ) +update_output_paths (codec, cfg->hp_outs, spec->hp_paths); +if (cfg->line_out_type !=AUTO_PIN_SPEAKER_OUT ) +update_output_paths (codec, cfg->speaker_outs, + spec->speaker_paths); + }return 1 ; }
@@ -2458,12 +2504,13 @@ static int create_loopback_mixing_ctl(stif (!spec->mixer_nid)return 0 ; -if (!(spec->aamix_out_paths[0 ] || spec->aamix_out_paths[1 ] || - spec->aamix_out_paths[2 ])) -return 0 ;if (!snd_hda_gen_add_kctl (spec,NULL , &loopback_mixing_enum))return -ENOMEM ; spec->have_aamix_ctl =1 ; +/* if no explicit aamix path is present (e.g. for Realtek codecs), +* enable aamix as default -- just for compatibility +*/ + spec->aamix_mode = !has_aamix_out_paths (spec);return 0 ; }
@@ -5664,6 +5711,8 @@ static void init_aamix_paths(struct hda_if (!spec->have_aamix_ctl)return ; +if (!has_aamix_out_paths (spec)) +return ;update_aamix_paths (codec, spec->aamix_mode, spec->out_paths[0 ], spec->aamix_out_paths[0 ], spec->autocfg.line_out_type);
Greg Kroah-Hartman
maintainerPATCH 19/200 proc: actually make proc_fd_permission() thread-friendly
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleg Nesterov <[email protected]>
commit 54708d2858e79a2bdda10bf8a20c80eb96c20613 upstream.
The commit 96d0df79f264 ("proc: make proc_fd_permission() thread-friendly") fixed the access to /proc/self/fd from sub-threads, but introduced another
problem: a sub-thread can't access /proc/<tid>/fd/ or /proc/thread-self/fd if generic_permission() fails.
Change proc_fd_permission() to check same_thread_group(pid_task(), current).
--- fs/proc/fd.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)
fs/proc/fd.c +11 -3
@@ -291,11 +291,19 @@ static struct dentry *proc_lookupfd(stru*/ int proc_fd_permission (struct inode *inode,int mask) { -int rv =generic_permission (inode, mask); +struct task_struct *p; +int rv; + + rv =generic_permission (inode, mask);if (rv ==0 ) -return 0 ; -if (task_tgid (current) ==proc_pid (inode)) +return rv; + +rcu_read_lock (); + p =pid_task (proc_pid (inode),PIDTYPE_PID ); +if (p &&same_thread_group (p, current)) rv =0 ; +rcu_read_unlock (); +return rv; }
Greg Kroah-Hartman
maintainerPATCH 21/200 proc: fix -ESRCH error when writing to /proc/$pid/coredump_filter
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Colin Ian King <[email protected]>
commit 41a0c249cb8706a2efa1ab3d59466b23a27d0c8b upstream.
Writing to /proc/$pid/coredump_filter always returns -ESRCH because commit 774636e19ed51 ("proc: convert to kstrto*()/kstrto*_from_user()") removed the setting of ret after the get_proc_task call and incorrectly left it as -ESRCH. Instead, return 0 when successful.
Example breakage:
echo 0 > /proc/self/coredump_filter
bash: echo: write error: No such process
--- fs/proc/base.c | 1 + 1 file changed, 1 insertion(+)
fs/proc/base.c +1 -0
@@ -2484,6 +2484,7 @@ static ssize_t proc_coredump_filter_writ mm =get_task_mm (task);if (!mm) goto out_no_mm; + ret =0 ;for (i =0 , mask =1 ; i <MMF_DUMP_FILTER_BITS ; i++, mask <<=1 ) {if (val & mask)
Greg Kroah-Hartman
maintainerPATCH 22/200 mm: slab: only move management objects off-slab for sizes larger than KMALLOC_MIN_SIZE
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Catalin Marinas <[email protected]>
commit d4322d88f5fdf92729dd40f923013414fbb2184d upstream.
On systems with a KMALLOC_MIN_SIZE of 128 (arm64, some mips and powerpc configurations defining ARCH_DMA_MINALIGN to 128), the first kmalloc_caches[] entry to be initialised after slab_early_init = 0 is "kmalloc-128" with index 7. Depending on the debug kernel configuration, sizeof(struct kmem_cache) can be larger than 128 resulting in an INDEX_NODE of 8.
Commit 8fc9cf420b36 ("slab: make more slab management structure off the slab") enables off-slab management objects for sizes starting with PAGE_SIZE >> 5 (128 bytes for a 4KB page configuration) and the creation of the "kmalloc-128" cache would try to place the management objects off-slab. However, since KMALLOC_MIN_SIZE is already 128 and freelist_size == 32 in __kmem_cache_create(), kmalloc_slab(freelist_size) returns NULL (kmalloc_caches[7] not populated yet). This triggers the following bug on arm64:
kernel BUG at /work/Linux/linux-2.6-aarch64/mm/slab.c:2283!
Internal error: Oops - BUG: 0 [#1] SMP
Modules linked in:
CPU: 0 PID: 0 Comm: swapper Not tainted 4.3.0-rc4+ #540
Hardware name: Juno (DT)
PC is at __kmem_cache_create+0x21c/0x280
LR is at __kmem_cache_create+0x210/0x280
[...]
Call trace:
__kmem_cache_create+0x21c/0x280
create_boot_cache+0x48/0x80
create_kmalloc_cache+0x50/0x88
create_kmalloc_caches+0x4c/0xf4
kmem_cache_init+0x100/0x118
start_kernel+0x214/0x33cThis patch introduces an OFF_SLAB_MIN_SIZE definition to avoid off-slab management objects for sizes equal to or smaller than KMALLOC_MIN_SIZE.
--- mm/slab.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
mm/slab.c +3 -2
@@ -282,6 +282,7 @@ static void kmem_cache_node_init(struct#define CFLGS_OFF_SLAB (0x80000000UL)#define OFF_SLAB (x) ((x)->flags & CFLGS_OFF_SLAB) +#define OFF_SLAB_MIN_SIZE (max_t(size_t, PAGE_SIZE >> 5, KMALLOC_MIN_SIZE + 1))#define BATCHREFILL_LIMIT 16/*
@@ -2212,7 +2213,7 @@ __kmem_cache_create (struct kmem_cache ** it too early on. Always use on-slab management when * SLAB_NOLEAKTRACE to avoid recursive calls into kmemleak) */ -if ((size >= (PAGE_SIZE >>5 )) && !slab_early_init && +if (size >=OFF_SLAB_MIN_SIZE && !slab_early_init && !(flags &SLAB_NOLEAKTRACE ))/* * Size is large, assume best to place the slab management obj
@@ -2276,7 +2277,7 @@ __kmem_cache_create (struct kmem_cache */* * This is a possibility for one of the kmalloc_{dma,}_caches. * But since we go off slab only for object size greater than -* PAGE_SIZE/8, and kmalloc_{dma,}_caches get created +* OFF_SLAB_MIN_SIZE, and kmalloc_{dma,}_caches get created * in ascending order,this should not happen at all. * But leave a BUG_ON for some lucky dude. */
Greg Kroah-Hartman
maintainerPATCH 23/200 mm/oom_kill.c: reverse the order of setting TIF_MEMDIE and sending SIGKILL
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <[email protected]>
commit 426fb5e72d92b868912e47a1e3ca2df6eabc3872 upstream.
It was confirmed that a local unprivileged user can consume all memory reserves and hang up that system using time lag between the OOM killer sets TIF_MEMDIE on an OOM victim and sends SIGKILL to that victim, for printk() inside for_each_process() loop at oom_kill_process() can consume many seconds when there are many thread groups sharing the same memory.
Before starting oom-depleter process:
Node 0 DMA: 3*4kB (UM) 6*8kB (U) 4*16kB (UEM) 0*32kB 0*64kB 1*128kB (M) 2*256kB (EM) 2*512kB (UE) 2*1024kB (EM) 1*2048kB (E) 1*4096kB (M) = 9980kB
Node 0 DMA32: 31*4kB (UEM) 27*8kB (UE) 32*16kB (UE) 13*32kB (UE) 14*64kB (UM) 7*128kB (UM) 8*256kB (UM) 8*512kB (UM) 3*1024kB (U) 4*2048kB (UM) 362*4096kB (UM) = 1503220kBAs of invoking the OOM killer:
Node 0 DMA: 11*4kB (UE) 8*8kB (UEM) 6*16kB (UE) 2*32kB (EM) 0*64kB 1*128kB (U) 3*256kB (UEM) 2*512kB (UE) 3*1024kB (UEM) 1*2048kB (U) 0*4096kB = 7308kB
Node 0 DMA32: 1049*4kB (UEM) 507*8kB (UE) 151*16kB (UE) 53*32kB (UEM) 83*64kB (UEM) 52*128kB (EM) 25*256kB (UEM) 11*512kB (M) 6*1024kB (UM) 1*2048kB (M) 0*4096kB = 44556kBBetween the thread group leader got TIF_MEMDIE and receives SIGKILL:
Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB
Node 0 DMA32: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kBThe oom-depleter's thread group leader which got TIF_MEMDIE started memset() in user space after the OOM killer set TIF_MEMDIE, and it was free to abuse ALLOC_NO_WATERMARKS by TIF_MEMDIE for memset() in user space until SIGKILL is delivered. If SIGKILL is delivered before TIF_MEMDIE is set, the oom-depleter can terminate without touching memory reserves.
Although the possibility of hitting this time lag is very small for 3.19 and earlier kernels because TIF_MEMDIE is set immediately before sending SIGKILL, preemption or long interrupts (an extreme example is SysRq-t) can step between and allow memory allocations which are not needed for terminating the OOM victim.
--- mm/oom_kill.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
mm/oom_kill.c +6 -1
@@ -554,6 +554,12 @@ void oom_kill_process(struct oom_control/* mm cannot safely be dereferenced after task_unlock(victim) */ mm = victim->mm; +/* +* We should send SIGKILL before setting TIF_MEMDIE in order to prevent +* the OOM victim from depleting the memory reserves from the user +* space under its control. +*/ +do_send_sig_info (SIGKILL ,SEND_SIG_FORCED , victim, true);mark_oom_victim (victim); pr_err("Killed process %d (%s) total-vm:%lukB, anon-rss:%lukB, file-rss:%lukB\n", task_pid_nr(victim), victim->comm, K(victim->mm->total_vm),
@@ -585,7 +591,6 @@ void oom_kill_process(struct oom_control }rcu_read_unlock (); -do_send_sig_info (SIGKILL ,SEND_SIG_FORCED , victim, true);put_task_struct (victim); }#undef K
Greg Kroah-Hartman
maintainerPATCH 24/200 lib/hexdump.c: truncate output in case of overflow
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
commit 9f029f540c2f7e010e4922d44ba0dfd05da79f88 upstream.
There is a classical off-by-one error in case when we try to place, for example, 1+1 bytes as hex in the buffer of size 6. The expected result is to get an output truncated, but in the reality we get 6 bytes filed followed by terminating NUL.
Change the logic how we fill the output in case of byte dumping into limited space. This will follow the snprintf() behaviour by truncating output even on half bytes.
--- lib/hexdump.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
lib/hexdump.c +5 -1
@@ -169,11 +169,15 @@ int hex_dump_to_buffer(const void *buf, } }else {for (j =0 ; j < len; j++) { -if (linebuflen < lx +3 ) +if (linebuflen < lx +2 ) goto overflow2; ch = ptr[j]; linebuf[lx++] =hex_asc_hi (ch); +if (linebuflen < lx +2 ) + goto overflow2; linebuf[lx++] =hex_asc_lo (ch); +if (linebuflen < lx +2 ) + goto overflow2; linebuf[lx++] =' ' ; }if (j)
Greg Kroah-Hartman
maintainerPATCH 25/200 fs, seqfile: always allow oom killer
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Thelen <[email protected]>
commit 0f930902eb8806cff8dcaef9ff9faf3cfa5fd748 upstream.
Since 5cec38ac866b ("fs, seq_file: fallback to vmalloc instead of oom kill processes") seq_buf_alloc() avoids calling the oom killer for PAGE_SIZE or smaller allocations; but larger allocations can use the oom killer via vmalloc(). Thus reads of small files can return ENOMEM, but larger files use the oom killer to avoid ENOMEM.
The effect of this bug is that reads from /proc and other virtual filesystems can return ENOMEM instead of the preferred behavior - oom killing something (possibly the calling process). I don't know of anyone except Google who has noticed the issue.
I suspect the fix is more needed in smaller systems where there isn't any reclaimable memory. But these seem like the kinds of systems which probably don't use the oom killer for production situations.
Memory overcommit requires use of the oom killer to select a victim regardless of file size.
Enable oom killer for small seq_buf_alloc() allocations.
--- fs/seq_file.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
fs/seq_file.c +8 -3
@@ -25,12 +25,17 @@ static void seq_set_overflow(struct seq_static void *seq_buf_alloc (unsigned long size) {void *buf; +gfp_t gfp =GFP_KERNEL ;/* -* __GFP_NORETRY to avoid oom-killings with high-order allocations - -* it's better to fall back to vmalloc() than to kill things. +* For high order allocations, use __GFP_NORETRY to avoid oom-killing - +* it's better to fall back to vmalloc() than to kill things. For small +* allocations, just use GFP_KERNEL which will oom kill, thus no need +* for vmalloc fallback. */ - buf =kmalloc (size,GFP_KERNEL | __GFP_NORETRY | __GFP_NOWARN); +if (size >PAGE_SIZE ) + gfp |= __GFP_NORETRY | __GFP_NOWARN; + buf =kmalloc (size, gfp);if (!buf && size >PAGE_SIZE ) buf =vmalloc (size);return buf;
Greg Kroah-Hartman
maintainerPATCH 26/200 memcg: fix thresholds for 32b architectures.
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Hocko <[email protected]>
commit c12176d3368b9b36ae484d323d41e94be26f9b65 upstream.
Commit 424cdc141380 ("memcg: convert threshold to bytes") has fixed a regression introduced by 3e32cb2e0a12 ("mm: memcontrol: lockless page counters") where thresholds were silently converted to use page units rather than bytes when interpreting the user input.
The fix is not complete, though, as properly pointed out by Ben Hutchings during stable backport review. The page count is converted to bytes but unsigned long is used to hold the value which would be obviously not sufficient for 32b systems with more than 4G thresholds. The same applies to usage as taken from mem_cgroup_usage which might overflow.
Let's remove this bytes vs. pages internal tracking differences and handle thresholds in page units internally. Chage mem_cgroup_usage() to return the value in page units and revert 424cdc141380 because this should be sufficient for the consistent handling. mem_cgroup_read_u64 as the only users of mem_cgroup_usage outside of the threshold handling code is converted to give the proper in bytes result. It is doing that already for page_counter output so this is more consistent as well.
The value presented to the userspace is still in bytes units.
From: Michal Hocko <[email protected]>
Subject: [PATCH 4.3 026/200] memcg: fix thresholds for 32b architectures.
Cc: Ben Hutchings <[email protected]>
Cc: Vladimir Davydov <[email protected]>
Cc: Johannes Weiner <[email protected]>
From: Andrew Morton <[email protected]>
Subject: [PATCH 4.3 026/200] memcg: fix thresholds for 32b architectures.
don't attempt to inline mem_cgroup_usage()
The compiler ignores the inline anwyay. And __always_inlining it adds 600 bytes of goop to the .o file.
--- mm/memcontrol.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-)
mm/memcontrol.c +5 -6
@@ -2836,9 +2836,9 @@ static unsigned long tree_stat(struct mereturn val; } -static inline u64 mem_cgroup_usage (struct mem_cgroup *memcg,bool swap) +static inline unsigned long mem_cgroup_usage (struct mem_cgroup *memcg,bool swap) { -u64 val; +unsigned long val;if (mem_cgroup_is_root (memcg)) { val =tree_stat (memcg,MEM_CGROUP_STAT_CACHE );
@@ -2851,7 +2851,7 @@ static inline u64 mem_cgroup_usage(strucelse val =page_counter_read (&memcg->memsw); } -return val <<PAGE_SHIFT ; +return val; }enum {
@@ -2885,9 +2885,9 @@ static u64 mem_cgroup_read_u64(struct cgswitch (MEMFILE_ATTR (cft->private)) {case RES_USAGE :if (counter == &memcg->memory) -return mem_cgroup_usage (memcg, false); +return (u64 )mem_cgroup_usage (memcg, false) *PAGE_SIZE ;if (counter == &memcg->memsw) -return mem_cgroup_usage (memcg, true); +return (u64 )mem_cgroup_usage (memcg, true) *PAGE_SIZE ;return (u64 )page_counter_read (counter) *PAGE_SIZE ;case RES_LIMIT :return (u64 )counter->limit *PAGE_SIZE ;
@@ -3387,7 +3387,6 @@ static int __mem_cgroup_usage_register_e ret =page_counter_memparse (args,"-1" , &threshold);if (ret)return ret; - threshold <<=PAGE_SHIFT ;mutex_lock (&memcg->thresholds_lock);
Greg Kroah-Hartman
maintainerPATCH 27/200 mm: hugetlb: fix hugepage memory leak caused by wrong reserve count
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Naoya Horiguchi <[email protected]>
commit a88c769548047b21f76fd71e04b6a3300ff17160 upstream.
When dequeue_huge_page_vma() in alloc_huge_page() fails, we fall back on alloc_buddy_huge_page() to directly create a hugepage from the buddy allocator.
In that case, however, if alloc_buddy_huge_page() succeeds we don't decrement h->resv_huge_pages, which means that successful hugetlb_fault() returns without releasing the reserve count. As a result, subsequent hugetlb_fault() might fail despite that there are still free hugepages.
This patch simply adds decrementing code on that code path.
I reproduced this problem when testing v4.3 kernel in the following situation:
- the test machine/VM is a NUMA system,
- hugepage overcommiting is enabled,
- most of hugepages are allocated and there's only one free hugepage which is on node 0 (for example),
- another program, which calls set_mempolicy(MPOL_BIND) to bind itself to node 1, tries to allocate a hugepage,
- the allocation should fail but the reserve count is still hold.
--- mm/hugetlb.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
mm/hugetlb.c +4 -1
@@ -1790,7 +1790,10 @@ struct page *alloc_huge_page(struct vm_a page =alloc_buddy_huge_page (h,NUMA_NO_NODE );if (!page) goto out_uncharge_cgroup; - +if (!avoid_reserve &&vma_has_reserves (vma, gbl_chg)) { +SetPagePrivate (page); + h->resv_huge_pages--; + }spin_lock (&hugetlb_lock);list_move (&page->lru, &h->hugepage_activelist);/* Fall through */
Greg Kroah-Hartman
maintainerPATCH 29/200 mm/hugetlbfs: fix bugs in fallocate hole punch of areas with holes
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Kravetz <[email protected]>
commit 1817889e3b2cc1db8abb595712095129ff9156c1 upstream.
Hugh Dickins pointed out problems with the new hugetlbfs fallocate hole punch code. These problems are in the routine remove_inode_hugepages and mostly occur in the case where there are holes in the range of pages to be removed. These holes could be the result of a previous hole punch or simply sparse allocation. The current code could access pages outside the specified range.
remove_inode_hugepages handles both hole punch and truncate operations. Page index handling was fixed/cleaned up so that the loop index always matches the page being processed. The code now only makes a single pass through the range of pages as it was determined page faults could not race with truncate. A cond_resched() was added after removing up to PAGEVEC_SIZE pages.
Some totally unnecessary code in hugetlbfs_fallocate() that remained from early development was also removed.
Tested with fallocate tests submitted here:
http://librelist.com/browser//libhugetlbfs/2015/6/25/patch-tests-add-tests-for-fallocate-system-call/
And, some ftruncate tests under development
--- fs/hugetlbfs/inode.c | 65 +++++++++++++++++++++++++-------------------------- 1 file changed, 32 insertions(+), 33 deletions(-)
fs/hugetlbfs/inode.c +32 -33
@@ -332,12 +332,17 @@ static void remove_huge_page(struct page* truncation is indicated by end of range being LLONG_MAX * In this case, we first scan the range and release found pages. * After releasing pages, hugetlb_unreserve_pages cleans up region/reserv -* maps and global counts. +* maps and global counts. Page faults can not race with truncation +* in this routine. hugetlb_no_page() prevents page faults in the +* truncated range. It checks i_size before allocation, and again after +* with the page table lock for the page held. The same lock must be +* acquired to unmap a page. * hole punch is indicated if end is not LLONG_MAX * In the hole punch case we scan the range and release found pages. * Only when releasing a page is the associated region/reserv map * deleted. The region/reserv map for ranges without associated -* pages are not modified. +* pages are not modified. Page faults can race with hole punch. +* This is indicated if we find a mapped page. * Note: If the passed end of range value is beyond the end of file, but * not LLONG_MAX this routine still performs a hole punch operation. */
@@ -361,46 +366,37 @@ static void remove_inode_hugepages(struc next = start;while (next < end) {/* -* Make sure to never grab more pages that we -* might possibly need. +* Don't grab more pages than the number left in the range. */ if (end - next < lookup_nr) lookup_nr = end - next;/* -* This pagevec_lookup() may return pages past 'end', -* so we must check for page->index > end. +* When no more pages are found, we are done. */ -if (!pagevec_lookup (&pvec, mapping, next, lookup_nr)) { -if (next == start) -break ; - next = start; -continue ; - } +if (!pagevec_lookup (&pvec, mapping, next, lookup_nr)) +break ;for (i =0 ; i <pagevec_count (&pvec); ++i) {struct page *page = pvec.pages[i];u32 hash; +/* +* The page (index) could be beyond end. This is +* only possible in the punch hole case as end is +* max page offset in the truncate case. +*/ + next = page->index; +if (next >= end) +break ; + hash =hugetlb_fault_mutex_hash (h, current->mm, &pseudo_vma, mapping, next,0 );mutex_lock (&hugetlb_fault_mutex_table[hash]);lock_page (page); -if (page->index >= end) { -unlock_page (page); -mutex_unlock (&hugetlb_fault_mutex_table[hash]); - next = end;/* we are done */ -break ; - } - -/* -* If page is mapped, it was faulted in after being -* unmapped. Do nothing in this race case. In the -* normal case page is not mapped. -*/ -if (!page_mapped (page)) { +if (likely (!page_mapped (page))) {bool rsv_on_error = !PagePrivate (page);/* * We must free the huge page and remove
@@ -421,17 +417,23 @@ static void remove_inode_hugepages(struchugetlb_fix_reserve_counts ( inode, rsv_on_error); } + }else { +/* +* If page is mapped, it was faulted in after +* being unmapped. It indicates a race between +* hole punch and page fault. Do nothing in +* this case. Getting here in a truncate +* operation is a bug. +*/ +BUG_ON (truncate_op); } -if (page->index > next) - next = page->index; - - ++next;unlock_page (page); -mutex_unlock (&hugetlb_fault_mutex_table[hash]); } + ++next;huge_pagevec_release (&pvec); +cond_resched (); }if (truncate_op)
@@ -647,9 +649,6 @@ static long hugetlbfs_fallocate(struct fif (!(mode &FALLOC_FL_KEEP_SIZE ) && offset + len > inode->i_size)i_size_write (inode, offset + len); inode->i_ctime =CURRENT_TIME ; -spin_lock (&inode->i_lock); - inode->i_private =NULL ; -spin_unlock (&inode->i_lock); out:mutex_unlock (&inode->i_mutex);return error;
Greg Kroah-Hartman
maintainerPATCH 30/200 fat: fix fake_offset handling on error path
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: OGAWA Hirofumi <[email protected]>
commit 928a477102c4fc6739883415b66987207e3502f4 upstream.
For the root directory, . and .. are faked (using dir_emit_dots()) and ctx->pos is reset from 2 to 0.
A corrupted root directory could cause fat_get_entry() to fail, but ->iterate() (fat_readdir()) reports progress to the VFS (with ctx->pos rewound to 0), so any following calls to ->iterate() continue to return the same entries again and again.
The result is that userspace will never see the end of the directory, causing e.g. 'ls' to hang in a getdents() loop.
--- fs/fat/dir.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-)
fs/fat/dir.c +11 -5
@@ -610,9 +610,9 @@ parse_record:int status =fat_parse_long (inode, &cpos, &bh, &de, &unicode, &nr_slots);if (status <0 ) { - ctx->pos = cpos; + bh =NULL ; ret = status; - goto out; + goto end_of_dir; }else if (status ==PARSE_INVALID ) goto record_end;else if (status ==PARSE_NOT_LONGNAME )
@@ -654,8 +654,9 @@ parse_record: fill_len = short_len; start_filldir: -if (!fake_offset) - ctx->pos = cpos - (nr_slots +1 ) *sizeof (struct msdos_dir_entry ); + ctx->pos = cpos - (nr_slots +1 ) *sizeof (struct msdos_dir_entry ); +if (fake_offset && ctx->pos <2 ) + ctx->pos =2 ;if (!memcmp (de->name,MSDOS_DOT ,MSDOS_NAME )) {if (!dir_emit_dot (file, ctx))
@@ -681,14 +682,19 @@ record_end: fake_offset =0 ; ctx->pos = cpos; goto get_new; + end_of_dir: - ctx->pos = cpos; +if (fake_offset && cpos <2 ) + ctx->pos =2 ; +else + ctx->pos = cpos; fill_failed:brelse (bh);if (unicode)__putname (unicode); out:mutex_unlock (&sbi->s_lock); +return ret; }
Greg Kroah-Hartman
maintainerPATCH 31/200 mm: hugetlb: call huge_pte_alloc() only if ptep is null
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Naoya Horiguchi <[email protected]>
commit 0d777df5d8953293be090d9ab5a355db893e8357 upstream.
Currently at the beginning of hugetlb_fault(), we call huge_pte_offset() and check whether the obtained *ptep is a migration/hwpoison entry or not. And if not, then we get to call huge_pte_alloc(). This is racy because the *ptep could turn into migration/hwpoison entry after the huge_pte_offset() check. This race results in BUG_ON in huge_pte_alloc().
We don't have to call huge_pte_alloc() when the huge_pte_offset() returns non-NULL, so let's fix this bug with moving the code into else block.
Note that the *ptep could turn into a migration/hwpoison entry after this block, but that's not a problem because we have another !pte_present check later (we never go into hugetlb_no_page() in that case.)
--- mm/hugetlb.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
mm/hugetlb.c +4 -4
@@ -3590,12 +3590,12 @@ int hugetlb_fault(struct mm_struct *mm, }else if (unlikely (is_hugetlb_entry_hwpoisoned (entry)))return VM_FAULT_HWPOISON_LARGE |VM_FAULT_SET_HINDEX (hstate_index (h)); + }else { + ptep =huge_pte_alloc (mm, address,huge_page_size (h)); +if (!ptep) +return VM_FAULT_OOM ; } - ptep =huge_pte_alloc (mm, address,huge_page_size (h)); -if (!ptep) -return VM_FAULT_OOM ; - mapping = vma->vm_file->f_mapping; idx =vma_hugecache_offset (h, vma, address);
Greg Kroah-Hartman
maintainerPATCH 33/200 mm/hugetlb.c: fix resv map memory leak for placeholder entries
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Kravetz <[email protected]>
commit dbe409e4f5e5075bd9ff7f8dd5c627abf3ee38c1 upstream.
Dmitry Vyukov reported the following memory leak
unreferenced object 0xffff88002eaafd88 (size 32):
comm "a.out", pid 5063, jiffies 4295774645 (age 15.810s) hex dump (first 32 bytes):
28 e9 4e 63 00 88 ff ff 28 e9 4e 63 00 88 ff ff (.Nc....(.Nc....
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
kmalloc include/linux/slab.h:458
region_chg+0x2d4/0x6b0 mm/hugetlb.c:398
__vma_reservation_common+0x2c3/0x390 mm/hugetlb.c:1791
vma_needs_reservation mm/hugetlb.c:1813
alloc_huge_page+0x19e/0xc70 mm/hugetlb.c:1845
hugetlb_no_page mm/hugetlb.c:3543
hugetlb_fault+0x7a1/0x1250 mm/hugetlb.c:3717
follow_hugetlb_page+0x339/0xc70 mm/hugetlb.c:3880
__get_user_pages+0x542/0xf30 mm/gup.c:497
populate_vma_page_range+0xde/0x110 mm/gup.c:919
__mm_populate+0x1c7/0x310 mm/gup.c:969
do_mlock+0x291/0x360 mm/mlock.c:637
SYSC_mlock2 mm/mlock.c:658
SyS_mlock2+0x4b/0x70 mm/mlock.c:648Dmitry identified a potential memory leak in the routine region_chg, where a region descriptor is not free'ed on an error path.
However, the root cause for the above memory leak resides in region_del. In this specific case, a "placeholder" entry is created in region_chg. The associated page allocation fails, and the placeholder entry is left in the reserve map. This is "by design" as the entry should be deleted when the map is released. The bug is in the region_del routine which is used to delete entries within a specific range (and when the map is released). region_del did not handle the case where a placeholder entry exactly matched the start of the range range to be deleted. In this case, the entry would not be deleted and leaked. The fix is to take these special placeholder entries into account in region_del.
The region_chg error path leak is also fixed.
--- mm/hugetlb.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)
mm/hugetlb.c +12 -2
@@ -372,8 +372,10 @@ retry_locked:spin_unlock (&resv->lock); trg =kmalloc (sizeof (*trg),GFP_KERNEL ); -if (!trg) +if (!trg) { +kfree (nrg);return -ENOMEM ; + }spin_lock (&resv->lock);list_add (&trg->link, &resv->region_cache);
@@ -483,8 +485,16 @@ static long region_del(struct resv_map * retry:spin_lock (&resv->lock);list_for_each_entry_safe (rg, trg, head, link) { -if (rg->to <= f) +/* +* Skip regions before the range to be deleted. file_region +* ranges are normally of the form [from, to). However, there +* may be a "placeholder" entry in the map which is of the form +* (from, to) with from == to. Check for placeholder entries +* at the beginning of the range to be deleted. +*/ +if (rg->to <= f && (rg->to != rg->from || rg->to != f))continue ; +if (rg->from >= t)break ;
Greg Kroah-Hartman
maintainerPATCH 34/200 ocfs2: fix SGID not inherited issue
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junxiao Bi <[email protected]>
commit 854ee2e944b4daf795e32562a7d2f9e90ab5a6a8 upstream.
Commit 8f1eb48758aa ("ocfs2: fix umask ignored issue") introduced an issue, SGID of sub dir was not inherited from its parents dir. It is because SGID is set into "inode->i_mode" in ocfs2_get_init_inode(), but is overwritten by "mode" which don't have SGID set later.
--- fs/ocfs2/namei.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
fs/ocfs2/namei.c +1 -3
@@ -369,13 +369,11 @@ static int ocfs2_mknod(struct inode *dir goto leave; } - status =posix_acl_create (dir, &mode, &default_acl, &acl); + status =posix_acl_create (dir, &inode->i_mode, &default_acl, &acl);if (status) {mlog_errno (status); goto leave; } -/* update inode->i_mode after mask with "umask". */ - inode->i_mode = mode; handle = ocfs2_start_trans(osb, ocfs2_mknod_credits(osb->sb, S_ISDIR(mode),
Greg Kroah-Hartman
maintainerPATCH 38/200 sh64: fix __NR_fgetxattr
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry V. Levin <[email protected]>
commit 2d33fa1059da4c8e816627a688d950b613ec0474 upstream.
According to arch/sh/kernel/syscalls_64.S and common sense, __NR_fgetxattr has to be defined to 259, but it doesn't. Instead, it's defined to 269, which is of course used by another syscall, __NR_sched_setaffinity in this case.
This bug was found by strace test suite.
--- arch/sh/include/uapi/asm/unistd_64.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/sh/include/uapi/asm/unistd_64.h +1 -1
@@ -278,7 +278,7 @@#define __NR_fsetxattr 256#define __NR_getxattr 257#define __NR_lgetxattr 258 -#define __NR_fgetxattr 269 +#define __NR_fgetxattr 259#define __NR_listxattr 260#define __NR_llistxattr 261#define __NR_flistxattr 262
Greg Kroah-Hartman
maintainerPATCH 41/200 spi: omap2-mcspi: disable other channels CHCONF_FORCE in prepare_message
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Neil Armstrong <[email protected]>
commit 468a32082b04c7febccfcd55b06ecbc438fcddcc upstream.
Since the "Switch driver to use transfer_one" change, the cs_change behavior has changed and a channel chip select can still be asserted when changing channel from a previous last transfer in a message having the cs_change attribute.
Since there is no sense having multiple chip select being asserted at the same time, disable all the remaining forced chip selects in a the prepare_message called right before a spi_transfer_one_message call. It ignores the current channel configuration in order to keep the possibility to leave the chip select asserted between messages.
It fixes this bug on a DM8168 SoC ES2.1 Soc and an OMAP4 ES2.1 SoC. It was hanging all the other channels transfers when a CHCONF_FORCE is present on the wrong channel.
--- drivers/spi/spi-omap2-mcspi.c | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+)
drivers/spi/spi-omap2-mcspi.c +28 -0
@@ -1217,6 +1217,33 @@ out:return status; } +static int omap2_mcspi_prepare_message (struct spi_master *master, +struct spi_message *msg) +{ +struct omap2_mcspi *mcspi =spi_master_get_devdata (master); +struct omap2_mcspi_regs *ctx = &mcspi->ctx; +struct omap2_mcspi_cs *cs; + +/* Only a single channel can have the FORCE bit enabled +* in its chconf0 register. +* Scan all channels and disable them except the current one. +* A FORCE can remain from a last transfer having cs_change enabled +*/ +list_for_each_entry (cs, &ctx->cs, node) { +if (msg->spi->controller_state == cs) +continue ; + +if ((cs->chconf0 &OMAP2_MCSPI_CHCONF_FORCE )) { + cs->chconf0 &= ~OMAP2_MCSPI_CHCONF_FORCE ; +writel_relaxed (cs->chconf0, + cs->base +OMAP2_MCSPI_CHCONF0 ); +readl_relaxed (cs->base +OMAP2_MCSPI_CHCONF0 ); + } + } + +return 0 ; +} +static int omap2_mcspi_transfer_one (struct spi_master *master,struct spi_device *spi,struct spi_transfer *t) {
@@ -1344,6 +1371,7 @@ static int omap2_mcspi_probe(struct plat master->bits_per_word_mask =SPI_BPW_RANGE_MASK (4 ,32 ); master->setup = omap2_mcspi_setup; master->auto_runtime_pm = true; + master->prepare_message = omap2_mcspi_prepare_message; master->transfer_one = omap2_mcspi_transfer_one; master->set_cs = omap2_mcspi_set_cs; master->cleanup = omap2_mcspi_cleanup;
Greg Kroah-Hartman
maintainerPATCH 43/200 spi: ti-qspi: Fix data corruption seen on r/w stress test
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vignesh R <[email protected]>
commit bc27a53928981662079aa243915b443370294a03 upstream.
Writing invalid command to QSPI_SPI_CMD_REG will terminate current transfer and de-assert the chip select. This has to be done before calling spi_finalize_current_message(). Because spi_finalize_current_message() will mark the end of current message transfer and schedule the next transfer. If the chipselect is not de-asserted before calling spi_finalize_current_message() then the next transfer will overlap with the previous transfer leading to data corruption.__spi_pump_message() can be called either from kthread worker context or directly from the calling process's context. It is possible that these two calls can race against each other. But race is serialized by checking whether master->cur_msg == NULL (pointer to msg being handled by transfer_one() at present). The master->cur_msg is set to NULL when spi_finalize_current_message() is called on that message, which means calling spi_finalize_current_message() allows __spi_sync() to pump next message in calling process context.
Now if spi-ti-qspi calls spi_finalize_current_message() before we terminate transfer at hardware side, if __spi_pump_message() is called from process context then the successive transactions can overlap.
Fix this by moving writing invalid command to QSPI_SPI_CMD_REG to before calling spi_finalize_current_message() call.
--- drivers/spi/spi-ti-qspi.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/spi/spi-ti-qspi.c +1 -2
@@ -410,11 +410,10 @@ static int ti_qspi_start_transfer_one(stmutex_unlock (&qspi->list_lock); +ti_qspi_write (qspi, qspi->cmd |QSPI_INVAL ,QSPI_SPI_CMD_REG ); m->status = status;spi_finalize_current_message (master); -ti_qspi_write (qspi, qspi->cmd |QSPI_INVAL ,QSPI_SPI_CMD_REG ); -return status; }
Greg Kroah-Hartman
maintainerPATCH 44/200 spi: fix parent-device reference leak
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 157f38f993919b648187ba341bfb05d0e91ad2f6 upstream.
Fix parent-device reference leak due to SPI-core taking an unnecessary reference to the parent when allocating the master structure, a reference that was never released.
Note that driver core takes its own reference to the parent when the master device is registered.
--- drivers/spi/spi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/spi/spi.c +1 -1
@@ -1627,7 +1627,7 @@ struct spi_master *spi_alloc_master(stru master->bus_num =-1 ; master->num_chipselect =1 ; master->dev.class = &spi_master_class; - master->dev.parent =get_device (dev); + master->dev.parent = dev;spi_master_set_devdata (master, &master[1 ]);return master;
Greg Kroah-Hartman
maintainerPATCH 45/200 wlcore/wl12xx: spi: fix oops on firmware load
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uri Mashiach <[email protected]>
commit 9b2761cb72dc41e1948c8a5512b4efd384eda130 upstream.
The maximum chunks used by the function is (SPI_AGGR_BUFFER_SIZE / WSPI_MAX_CHUNK_SIZE + 1).
The original commands array had space for (SPI_AGGR_BUFFER_SIZE / WSPI_MAX_CHUNK_SIZE) commands. When the last chunk is used (len > 4 * WSPI_MAX_CHUNK_SIZE), the last command is stored outside the bounds of the commands array.
Oops 5 (page fault) is generated during current wl1271 firmware load attempt:
root@debian-armhf:~# ifconfig wlan0 up [ 294.312399] Unable to handle kernel paging request at virtual address 00203fc4 [ 294.320173] pgd = de528000 [ 294.323028] [00203fc4] *pgd=00000000 [ 294.326916] Internal error: Oops: 5 [#1] SMP ARM [ 294.331789] Modules linked in: bnep rfcomm bluetooth ipv6 arc4 wl12xx wlcore mac80211 musb_dsps cfg80211 musb_hdrc usbcore usb_common wlcore_spi omap_rng rng_core musb_am335x omap_wdt cpufreq_dt thermal_sys hwmon [ 294.351838] CPU: 0 PID: 1827 Comm: ifconfig Not tainted 4.2.0-00002-g3e9ad27-dirty #78 [ 294.360154] Hardware name: Generic AM33XX (Flattened Device Tree) [ 294.366557] task: dc9d6d40 ti: de550000 task.ti: de550000 [ 294.372236] PC is at __spi_validate+0xa8/0x2ac [ 294.376902] LR is at __spi_sync+0x78/0x210 [ 294.381200] pc : [<c049c760>] lr : [<c049ebe0>] psr: 60000013 [ 294.381200] sp : de551998 ip : de5519d8 fp : 00200000 [ 294.393242] r10: de551c8c r9 : de5519d8 r8 : de3a9000 [ 294.398730] r7 : de3a9258 r6 : de3a9400 r5 : de551a48 r4 : 00203fbc [ 294.405577] r3 : 00000000 r2 : 00000000 r1 : 00000000 r0 : de3a9000 [ 294.412420] Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user [ 294.419918] Control: 10c5387d Table: 9e528019 DAC: 00000015 [ 294.425954] Process ifconfig (pid: 1827, stack limit = 0xde550218) [ 294.432437] Stack: (0xde551998 to 0xde552000)
...
[ 294.883613] [<c049c760>] (__spi_validate) from [<c049ebe0>] (__spi_sync+0x78/0x210) [ 294.891670] [<c049ebe0>] (__spi_sync) from [<bf036598>] (wl12xx_spi_raw_write+0xfc/0x148 [wlcore_spi]) [ 294.901661] [<bf036598>] (wl12xx_spi_raw_write [wlcore_spi]) from [<bf21c694>] (wlcore_boot_upload_firmware+0x1ec/0x458 [wlcore]) [ 294.914038] [<bf21c694>] (wlcore_boot_upload_firmware [wlcore]) from [<bf24532c>] (wl12xx_boot+0xc10/0xfac [wl12xx]) [ 294.925161] [<bf24532c>] (wl12xx_boot [wl12xx]) from [<bf20d5cc>] (wl1271_op_add_interface+0x5b0/0x910 [wlcore]) [ 294.936364] [<bf20d5cc>] (wl1271_op_add_interface [wlcore]) from [<bf15c4ac>] (ieee80211_do_open+0x44c/0xf7c [mac80211]) [ 294.947963] [<bf15c4ac>] (ieee80211_do_open [mac80211]) from [<c0537978>] (__dev_open+0xa8/0x110) [ 294.957307] [<c0537978>] (__dev_open) from [<c0537bf8>] (__dev_change_flags+0x88/0x148) [ 294.965713] [<c0537bf8>] (__dev_change_flags) from [<c0537cd0>] (dev_change_flags+0x18/0x48) [ 294.974576] [<c0537cd0>] (dev_change_flags) from [<c05a55a0>] (devinet_ioctl+0x6b4/0x7d0) [ 294.983191] [<c05a55a0>] (devinet_ioctl) from [<c0517040>] (sock_ioctl+0x1e4/0x2bc) [ 294.991244] [<c0517040>] (sock_ioctl) from [<c017d378>] (do_vfs_ioctl+0x420/0x6b0) [ 294.999208] [<c017d378>] (do_vfs_ioctl) from [<c017d674>] (SyS_ioctl+0x6c/0x7c) [ 295.006880] [<c017d674>] (SyS_ioctl) from [<c000f4c0>] (ret_fast_syscall+0x0/0x54) [ 295.014835] Code: e1550004 e2444034 0a00007d e5953018 (e5942008) [ 295.021544] ---[ end trace 66ed188198f4e24e ]---
--- drivers/net/wireless/ti/wlcore/spi.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/net/wireless/ti/wlcore/spi.c +7 -3
@@ -73,7 +73,10 @@*/ #define SPI_AGGR_BUFFER_SIZE (4 * PAGE_SIZE) -#define WSPI_MAX_NUM_OF_CHUNKS (SPI_AGGR_BUFFER_SIZE / WSPI_MAX_CHUNK_SIZE) +/* Maximum number of SPI write chunks */ +#define WSPI_MAX_NUM_OF_CHUNKS \ + ((SPI_AGGR_BUFFER_SIZE / WSPI_MAX_CHUNK_SIZE) + 1) +struct wl12xx_spi_glue {struct device *dev;
@@ -268,9 +271,10 @@ static int __must_check wl12xx_spi_raw_w void *buf, size_t len, bool fixed) {struct wl12xx_spi_glue *glue =dev_get_drvdata (child->parent); -struct spi_transfer t[2 * (WSPI_MAX_NUM_OF_CHUNKS +1 )]; +/* SPI write buffers - 2 for each chunk */ +struct spi_transfer t[2 *WSPI_MAX_NUM_OF_CHUNKS ];struct spi_message m; -u32 commands[WSPI_MAX_NUM_OF_CHUNKS ]; +u32 commands[WSPI_MAX_NUM_OF_CHUNKS ];/* 1 command per chunk */ u32 *cmd;u32 chunk_len;int i;
Greg Kroah-Hartman
maintainerPATCH 46/200 wlcore/wl12xx: spi: fix NULL pointer dereference (Oops)
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uri Mashiach <[email protected]>
commit e47301b06d5a65678690f04c2248fd181db1e59a upstream.
Fix the below Oops when trying to modprobe wlcore_spi. The oops occurs because the wl1271_power_{off,on}() function doesn't check the power() function pointer.
[ 23.401447] Unable to handle kernel NULL pointer dereference at virtual address 00000000 [ 23.409954] pgd = c0004000 [ 23.412922] [00000000] *pgd=00000000 [ 23.416693] Internal error: Oops: 80000007 [#1] SMP ARM [ 23.422168] Modules linked in: wl12xx wlcore mac80211 cfg80211
musb_dsps musb_hdrc usbcore usb_common snd_soc_simple_card evdev joydev omap_rng wlcore_spi snd_soc_tlv320aic23_i2c rng_core snd_soc_tlv320aic23 c_can_platform c_can can_dev snd_soc_davinci_mcasp snd_soc_edma snd_soc_omap omap_wdt musb_am335x cpufreq_dt thermal_sys hwmon
[ 23.453253] CPU: 0 PID: 36 Comm: kworker/0:2 Not tainted 4.2.0-00002-g951efee-dirty #233 [ 23.461720] Hardware name: Generic AM33XX (Flattened Device Tree) [ 23.468123] Workqueue: events request_firmware_work_func [ 23.473690] task: de32efc0 ti: de4ee000 task.ti: de4ee000 [ 23.479341] PC is at 0x0 [ 23.482112] LR is at wl12xx_set_power_on+0x28/0x124 [wlcore] [ 23.488074] pc : [<00000000>] lr : [<bf2581f0>] psr: 60000013 [ 23.488074] sp : de4efe50 ip : 00000002 fp : 00000000 [ 23.500162] r10: de7cdd00 r9 : dc848800 r8 : bf27af00 [ 23.505663] r7 : bf27a1a8 r6 : dcbd8a80 r5 : dce0e2e0 r4 : dce0d2e0 [ 23.512536] r3 : 00000000 r2 : 00000000 r1 : 00000001 r0 : dc848810 [ 23.519412] Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment kernel [ 23.527109] Control: 10c5387d Table: 9cb78019 DAC: 00000015 [ 23.533160] Process kworker/0:2 (pid: 36, stack limit = 0xde4ee218) [ 23.539760] Stack: (0xde4efe50 to 0xde4f0000)
[...]
[ 23.665030] [<bf2581f0>] (wl12xx_set_power_on [wlcore]) from [<bf25f7ac>] (wlcore_nvs_cb+0x118/0xa4c [wlcore]) [ 23.675604] [<bf25f7ac>] (wlcore_nvs_cb [wlcore]) from [<c04387ec>] (request_firmware_work_func+0x30/0x58) [ 23.685784] [<c04387ec>] (request_firmware_work_func) from [<c0058e2c>] (process_one_work+0x1b4/0x4b4) [ 23.695591] [<c0058e2c>] (process_one_work) from [<c0059168>] (worker_thread+0x3c/0x4a4) [ 23.704124] [<c0059168>] (worker_thread) from [<c005ee68>] (kthread+0xd4/0xf0) [ 23.711747] [<c005ee68>] (kthread) from [<c000f598>] (ret_from_fork+0x14/0x3c) [ 23.719357] Code: bad PC value [ 23.722760] ---[ end trace 981be8510db9b3a9 ]---
Prevent oops by validationg power() pointer value before calling the function.
--- drivers/net/wireless/ti/wlcore/io.h | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/net/wireless/ti/wlcore/io.h +7 -3
@@ -207,19 +207,23 @@ static inline int __must_check wlcore_wrstatic inline void wl1271_power_off (struct wl1271 *wl) { -int ret; +int ret =0 ;if (!test_bit (WL1271_FLAG_GPIO_POWER , &wl->flags))return ; - ret = wl->if_ops->power (wl->dev, false); +if (wl->if_ops->power) + ret = wl->if_ops->power (wl->dev, false);if (!ret)clear_bit (WL1271_FLAG_GPIO_POWER , &wl->flags); }static inline int wl1271_power_on (struct wl1271 *wl) { -int ret = wl->if_ops->power (wl->dev, true); +int ret =0 ; + +if (wl->if_ops->power) + ret = wl->if_ops->power (wl->dev, true);if (ret ==0 )set_bit (WL1271_FLAG_GPIO_POWER , &wl->flags);
Greg Kroah-Hartman
maintainerPATCH 47/200 spi/spi-xilinx: Fix race condition on last word read
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Ribalda Delgado <[email protected]>
commit eca37c7c117460e2fbe4e32c991bff32a961f688 upstream.
Some users have reported that in polled mode the driver fails randomly to read the last word of the transfer.
The end condition used for the transmissions (in polled and irq mode) has been the TX_EMPTY flag. But Lars-Peter Clausen has identified a delay from the TX_EMPTY to the actual end of the data rx.
I believe that this race condition has not been detected until now because of the latency added by the IRQ handler or the PCIe bridge. This bugs affects setups with low latency access to the spi core.
This patch replaces the readout logic:
For all the words, except the last one, the TX_EMPTY flag is used (and cached).
If !TX_EMPY or is the last word. The status register is read and the RX_EMPTY flag is used.
The performance is not affected: there is an extra read of the Status Register, but the readout can start as soon as there is a word in the buffer.
--- drivers/spi/spi-xilinx.c | 38 ++++++++++++++++++++++++-------------- 1 file changed, 24 insertions(+), 14 deletions(-)
drivers/spi/spi-xilinx.c +24 -14
@@ -270,6 +270,7 @@ static int xilinx_spi_txrx_bufs(struct swhile (remaining_words) {int n_words, tx_words, rx_words; +u32 sr; n_words =min (remaining_words, xspi->buffer_size);
@@ -284,24 +285,33 @@ static int xilinx_spi_txrx_bufs(struct sif (use_irq) { xspi->write_fn (cr, xspi->regs +XSPI_CR_OFFSET );wait_for_completion (&xspi->done); - }else -while (!(xspi->read_fn (xspi->regs +XSPI_SR_OFFSET ) & -XSPI_SR_TX_EMPTY_MASK )) - ; - -/* A transmit has just completed. Process received data and -* check for more data to transmit. Always inhibit the -* transmitter while the Isr refills the transmit register/FIFO, -* or make sure it is stopped if we're done. -*/ -if (use_irq) +/* A transmit has just completed. Process received data +* and check for more data to transmit. Always inhibit +* the transmitter while the Isr refills the transmit +* register/FIFO, or make sure it is stopped if we're +* done. +*/ xspi->write_fn (cr |XSPI_CR_TRANS_INHIBIT , - xspi->regs +XSPI_CR_OFFSET ); + xspi->regs +XSPI_CR_OFFSET ); + sr =XSPI_SR_TX_EMPTY_MASK ; + }else + sr = xspi->read_fn (xspi->regs +XSPI_SR_OFFSET );/* Read out all the data from the Rx FIFO */ rx_words = n_words; -while (rx_words--) -xilinx_spi_rx (xspi); +while (rx_words) { +if ((sr &XSPI_SR_TX_EMPTY_MASK ) && (rx_words >1 )) { +xilinx_spi_rx (xspi); + rx_words--; +continue ; + } + + sr = xspi->read_fn (xspi->regs +XSPI_SR_OFFSET ); +if (!(sr &XSPI_SR_RX_EMPTY_MASK )) { +xilinx_spi_rx (xspi); + rx_words--; + } + } remaining_words -= n_words; }
Greg Kroah-Hartman
maintainerPATCH 48/200 tpm, tpm_crb: fix unaligned read of the command buffer address
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jarkko Sakkinen <[email protected]>
commit 149789ce9d472e6b4fd99336e779ab843754a96c upstream.
The command buffer address must be read with exactly two 32-bit reads. Otherwise, on some HW platforms, it seems that HW will abort the read operation, which causes CPU to fill the read bytes with 1's. Therefore, we cannot rely on memcpy_fromio() but must call ioread32() two times instead.
Also, this matches the PC Client Platform TPM Profile specification, which defines command buffer address with two 32-bit fields.
--- drivers/char/tpm/tpm_crb.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/char/tpm/tpm_crb.c +4 -3
@@ -68,7 +68,8 @@ struct crb_control_area {u32 int_enable;u32 int_sts;u32 cmd_size; -u64 cmd_pa; +u32 cmd_pa_low; +u32 cmd_pa_high;u32 rsp_size;u64 rsp_pa; } __packed;
@@ -263,8 +264,8 @@ static int crb_acpi_add(struct acpi_devireturn -ENOMEM ; } -memcpy_fromio (&pa, &priv->cca->cmd_pa,8 ); - pa =le64_to_cpu (pa); + pa = ((u64 )le32_to_cpu (ioread32 (&priv->cca->cmd_pa_high)) <<32 ) | + (u64 )le32_to_cpu (ioread32 (&priv->cca->cmd_pa_low)); priv->cmd =devm_ioremap_nocache (dev, pa,ioread32 (&priv->cca->cmd_size));if (!priv->cmd) {
Greg Kroah-Hartman
maintainerPATCH 49/200 vTPM: fix memory allocation flag for rtce buffer at kernel boot
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hon Ching \(Vicky\) Lo <[email protected]>
commit 60ecd86c4d985750efa0ea3d8610972b09951715 upstream.
At ibm vtpm initialzation, tpm_ibmvtpm_probe() registers its interrupt handler, ibmvtpm_interrupt, which calls ibmvtpm_crq_process to allocate memory for rtce buffer. The current code uses 'GFP_KERNEL' as the type of kernel memory allocation, which resulted a warning at kernel/lockdep.c. This patch uses 'GFP_ATOMIC' instead so that the allocation is high-priority and does not sleep.
--- drivers/char/tpm/tpm_ibmvtpm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/char/tpm/tpm_ibmvtpm.c +1 -1
@@ -491,7 +491,7 @@ static void ibmvtpm_crq_process(struct i } ibmvtpm->rtce_size =be16_to_cpu (crq->len); ibmvtpm->rtce_buf =kmalloc (ibmvtpm->rtce_size, -GFP_KERNEL ); +GFP_ATOMIC );if (!ibmvtpm->rtce_buf) {dev_err (ibmvtpm->dev,"Failed to allocate memory for rtce buffer\n" );return ;
Greg Kroah-Hartman
maintainerPATCH 52/200 integrity: prevent loading untrusted certificates on the IMA trusted keyring
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Kasatkin <[email protected]>
commit 72e1eed8abb11c79749266d433c817ce36732893 upstream.
If IMA_LOAD_X509 is enabled, either directly or indirectly via IMA_APPRAISE_SIGNED_INIT, certificates are loaded onto the IMA trusted keyring by the kernel via key_create_or_update(). When the KEY_ALLOC_TRUSTED flag is provided, certificates are loaded without first verifying the certificate is properly signed by a trusted key on the system keyring. This patch removes the KEY_ALLOC_TRUSTED flag.
--- security/integrity/digsig.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
security/integrity/digsig.c +1 -1
@@ -105,7 +105,7 @@ int __init integrity_load_x509(const uns rc, ((KEY_POS_ALL & ~KEY_POS_SETATTR ) |KEY_USR_VIEW |KEY_USR_READ ), - KEY_ALLOC_NOT_IN_QUOTA | KEY_ALLOC_TRUSTED); + KEY_ALLOC_NOT_IN_QUOTA);if (IS_ERR (key)) { rc =PTR_ERR (key); pr_err("Problem loading X.509 certificate (%d): %s\n",
Greg Kroah-Hartman
maintainerPATCH 53/200 mtd: mtdpart: fix add_mtd_partitions error path
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boris BREZILLON <[email protected]>
commit e5bae86797141e4a95e42d825f737cb36d7b8c37 upstream.
If we fail to allocate a partition structure in the middle of the partition creation process, the already allocated partitions are never removed, which means they are still present in the partition list and their resources are never freed.
--- drivers/mtd/mtdpart.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/mtd/mtdpart.c +3 -1
@@ -664,8 +664,10 @@ int add_mtd_partitions(struct mtd_info *for (i =0 ; i < nbparts; i++) { slave =allocate_partition (master, parts + i, i, cur_offset); -if (IS_ERR (slave)) +if (IS_ERR (slave)) { +del_mtd_partitions (master);return PTR_ERR (slave); + }mutex_lock (&mtd_partitions_mutex);list_add (&slave->list, &mtd_partitions);
Greg Kroah-Hartman
maintainerPATCH 54/200 mtd: blkdevs: fix potential deadlock + lockdep warnings
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Norris <[email protected]>
commit f3c63795e90f0c6238306883b6c72f14d5355721 upstream.
Commit 073db4a51ee4 ("mtd: fix: avoid race condition when accessing mtd->usecount") fixed a race condition but due to poor ordering of the mutex acquisition, introduced a potential deadlock.
The deadlock can occur, for example, when rmmod'ing the m25p80 module, which will delete one or more MTDs, along with any corresponding mtdblock devices. This could potentially race with an acquisition of the block device as follows.
-> blktrans_open()
-> mutex_lock(&dev->lock);
-> mutex_lock(&mtd_table_mutex); -> del_mtd_device()
-> mutex_lock(&mtd_table_mutex);
-> blktrans_notify_remove() -> del_mtd_blktrans_dev()
-> mutex_lock(&dev->lock);This is a classic (potential) ABBA deadlock, which can be fixed by making the A->B ordering consistent everywhere. There was no real purpose to the ordering in the original patch, AFAIR, so this shouldn't be a problem. This ordering was actually already present in del_mtd_blktrans_dev(), for one, where the function tried to ensure that its caller already held mtd_table_mutex before it acquired &dev->lock:
if (mutex_trylock(&mtd_table_mutex)) {
mutex_unlock(&mtd_table_mutex);
BUG();
}So, reverse the ordering of acquisition of &dev->lock and &mtd_table_mutex so we always acquire mtd_table_mutex first.
Snippets of the lockdep output follow:
# modprobe -r m25p80
[ 53.419251]
[ 53.420838] ======================================================
[ 53.427300] [ INFO: possible circular locking dependency detected ]
[ 53.433865] 4.3.0-rc6 #96 Not tainted
[ 53.437686] -------------------------------------------------------
[ 53.444220] modprobe/372 is trying to acquire lock:
[ 53.449320] (&new->lock){+.+...}, at: [<c043fe4c>] del_mtd_blktrans_dev+0x80/0xdc
[ 53.457271]
[ 53.457271] but task is already holding lock:
[ 53.463372] (mtd_table_mutex){+.+.+.}, at: [<c0439994>] del_mtd_device+0x18/0x100
[ 53.471321]
[ 53.471321] which lock already depends on the new lock.
[ 53.471321]
[ 53.479856]
[ 53.479856] the existing dependency chain (in reverse order) is:
[ 53.487660]
-> #1 (mtd_table_mutex){+.+.+.}:
[ 53.492331] [<c043fc5c>] blktrans_open+0x34/0x1a4
[ 53.497879] [<c01afce0>] __blkdev_get+0xc4/0x3b0
[ 53.503364] [<c01b0bb8>] blkdev_get+0x108/0x320
[ 53.508743] [<c01713c0>] do_dentry_open+0x218/0x314
[ 53.514496] [<c0180454>] path_openat+0x4c0/0xf9c
[ 53.519959] [<c0182044>] do_filp_open+0x5c/0xc0
[ 53.525336] [<c0172758>] do_sys_open+0xfc/0x1cc
[ 53.530716] [<c000f740>] ret_fast_syscall+0x0/0x1c
[ 53.536375]
-> #0 (&new->lock){+.+...}:
[ 53.540587] [<c063f124>] mutex_lock_nested+0x38/0x3cc
[ 53.546504] [<c043fe4c>] del_mtd_blktrans_dev+0x80/0xdc
[ 53.552606] [<c043f164>] blktrans_notify_remove+0x7c/0x84
[ 53.558891] [<c04399f0>] del_mtd_device+0x74/0x100
[ 53.564544] [<c043c670>] del_mtd_partitions+0x80/0xc8
[ 53.570451] [<c0439aa0>] mtd_device_unregister+0x24/0x48
[ 53.576637] [<c046ce6c>] spi_drv_remove+0x1c/0x34
[ 53.582207] [<c03de0f0>] __device_release_driver+0x88/0x114
[ 53.588663] [<c03de19c>] device_release_driver+0x20/0x2c
[ 53.594843] [<c03dd9e8>] bus_remove_device+0xd8/0x108
[ 53.600748] [<c03dacc0>] device_del+0x10c/0x210
[ 53.606127] [<c03dadd0>] device_unregister+0xc/0x20
[ 53.611849] [<c046d878>] __unregister+0x10/0x20
[ 53.617211] [<c03da868>] device_for_each_child+0x50/0x7c
[ 53.623387] [<c046eae8>] spi_unregister_master+0x58/0x8c
[ 53.629578] [<c03e12f0>] release_nodes+0x15c/0x1c8
[ 53.635223] [<c03de0f8>] __device_release_driver+0x90/0x114
[ 53.641689] [<c03de900>] driver_detach+0xb4/0xb8
[ 53.647147] [<c03ddc78>] bus_remove_driver+0x4c/0xa0
[ 53.652970] [<c00cab50>] SyS_delete_module+0x11c/0x1e4
[ 53.658976] [<c000f740>] ret_fast_syscall+0x0/0x1c
[ 53.664621]
[ 53.664621] other info that might help us debug this:
[ 53.664621]
[ 53.672979] Possible unsafe locking scenario:
[ 53.672979]
[ 53.679169] CPU0 CPU1
[ 53.683900] ---- ----
[ 53.688633] lock(mtd_table_mutex);
[ 53.692383] lock(&new->lock);
[ 53.698306] lock(mtd_table_mutex);
[ 53.704658] lock(&new->lock);
[ 53.707946]
[ 53.707946] *** DEADLOCK ***--- drivers/mtd/mtd_blkdevs.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/mtd/mtd_blkdevs.c +5 -5
@@ -192,8 +192,8 @@ static int blktrans_open(struct block_deif (!dev)return -ERESTARTSYS ;/* FIXME: busy loop! -arnd*/ -mutex_lock (&dev->lock);mutex_lock (&mtd_table_mutex); +mutex_lock (&dev->lock);if (dev->open) goto unlock;
@@ -217,8 +217,8 @@ static int blktrans_open(struct block_de unlock: dev->open++; -mutex_unlock (&mtd_table_mutex);mutex_unlock (&dev->lock); +mutex_unlock (&mtd_table_mutex);blktrans_dev_put (dev);return ret;
@@ -228,8 +228,8 @@ error_release: error_put:module_put (dev->tr->owner);kref_put (&dev->ref, blktrans_dev_release); -mutex_unlock (&mtd_table_mutex);mutex_unlock (&dev->lock); +mutex_unlock (&mtd_table_mutex);blktrans_dev_put (dev);return ret; }
@@ -241,8 +241,8 @@ static void blktrans_release(struct gendif (!dev)return ; -mutex_lock (&dev->lock);mutex_lock (&mtd_table_mutex); +mutex_lock (&dev->lock);if (--dev->open) goto unlock;
@@ -256,8 +256,8 @@ static void blktrans_release(struct gend__put_mtd_device (dev->mtd); } unlock: -mutex_unlock (&mtd_table_mutex);mutex_unlock (&dev->lock); +mutex_unlock (&mtd_table_mutex);blktrans_dev_put (dev); }
Greg Kroah-Hartman
maintainerPATCH 55/200 mtd: nand: fix shutdown/reboot for multi-chip systems
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Norris <[email protected]>
commit 9ca641b0f02a3a1eedbc8c296e695326da9bbaf9 upstream.
If multiple NAND chips are registered to the same controller, then when rebooting the system, the first one will grab the controller lock, while the second will wait forever for the first one to release it. i.e., a classic deadlock.
This problem was solved for a similar case (suspend/resume) back in commit 6b0d9a841249 ("mtd: nand: fix multi-chip suspend problem"), and the shutdown state really isn't much different for us, so rather than adding a new special case to nand_get_device(), we can just overload the FL_PM_SUSPENDED state.
Now, multiple chips can "get" the same controller lock (preventing further I/O), while we still allow other chips to pass through nand_shutdown().
Original report:
http://thread.gmane.org/gmane.linux.drivers.mtd/59726
http://lists.infradead.org/pipermail/linux-mtd/2015-July/059992.html
--- drivers/mtd/nand/nand_base.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mtd/nand/nand_base.c +1 -1
@@ -2964,7 +2964,7 @@ static void nand_resume(struct mtd_info*/ static void nand_shutdown (struct mtd_info *mtd) { -nand_get_device (mtd,FL_SHUTDOWN ); +nand_get_device (mtd,FL_PM_SUSPENDED ); }/* Set default functions */
Greg Kroah-Hartman
maintainerPATCH 56/200 mtd: jz4740_nand: fix build on jz4740 after removing gpio.h
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Norris <[email protected]>
commit 96dd922c198286681fbbc15100e196e0f629e2fb upstream.
Fallout from commit 832f5dacfa0b ("MIPS: Remove all the uses of custom gpio.h")
We see errors like this:
drivers/mtd/nand/jz4740_nand.c: In function 'jz_nand_detect_bank':drivers/mtd/nand/jz4740_nand.c:340:9: error: 'JZ_GPIO_MEM_CS0' undeclared (first use in this function) drivers/mtd/nand/jz4740_nand.c:340:9: note: each undeclared identifier is reported only once for each function it appears in drivers/mtd/nand/jz4740_nand.c:359:2: error: implicit declaration of function 'jz_gpio_set_function' [-Werror=implicit-function-declaration] drivers/mtd/nand/jz4740_nand.c:359:29: error: 'JZ_GPIO_FUNC_MEM_CS0' undeclared (first use in this function) drivers/mtd/nand/jz4740_nand.c:399:29: error: 'JZ_GPIO_FUNC_NONE' undeclared (first use in this function) drivers/mtd/nand/jz4740_nand.c: In function 'jz_nand_probe':drivers/mtd/nand/jz4740_nand.c:528:13: error: 'JZ_GPIO_MEM_CS0' undeclared (first use in this function) drivers/mtd/nand/jz4740_nand.c: In function 'jz_nand_remove':drivers/mtd/nand/jz4740_nand.c:555:14: error: 'JZ_GPIO_MEM_CS0' undeclared (first use in this function)
Patched similarly to:
https://patchwork.linux-mips.org/patch/11089/
--- drivers/mtd/nand/jz4740_nand.c | 1 + 1 file changed, 1 insertion(+)
drivers/mtd/nand/jz4740_nand.c +1 -0
@@ -25,6 +25,7 @@#include <linux/gpio.h> +#include <asm/mach-jz4740/gpio.h> #include <asm/mach-jz4740/jz4740_nand.h> #define JZ_REG_NAND_CTRL 0x50
Greg Kroah-Hartman
maintainerPATCH 57/200 mtd: ubi: fixup error correction in do_sync_erase()
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Siewior <[email protected]>
commit 1a31b20cd81d5cbc7ec6e24cb08066009a1ca32d upstream.
Since fastmap we gained do_sync_erase(). This function can return an error and its error handling isn't obvious. First the memory allocation for struct ubi_work can fail and as such struct ubi_wl_entry is leaked. However if the memory allocation succeeds then the tail function takes care of the struct ubi_wl_entry. A free here could result in a double free.
To make the error handling simpler, I split the tail function into one piece which does the work and another which frees the struct ubi_work which is passed as argument. As result do_sync_erase() can keep the struct on stack and we get rid of one error source.
--- drivers/mtd/ubi/wl.c | 52 +++++++++++++++++++++++++++------------------------ 1 file changed, 28 insertions(+), 24 deletions(-)
drivers/mtd/ubi/wl.c +28 -24
@@ -603,6 +603,7 @@ static int schedule_erase(struct ubi_devreturn 0 ; } +static int __erase_worker (struct ubi_device *ubi,struct ubi_work *wl_wrk);/** * do_sync_erase - run the erase worker synchronously. * @ubi: UBI device description object
@@ -615,20 +616,16 @@ static int schedule_erase(struct ubi_devstatic int do_sync_erase (struct ubi_device *ubi,struct ubi_wl_entry *e,int vol_id,int lnum,int torture) { -struct ubi_work *wl_wrk; +struct ubi_work wl_wrk;dbg_wl ("sync erase of PEB %i" , e->pnum); - wl_wrk =kmalloc (sizeof (struct ubi_work ),GFP_NOFS ); -if (!wl_wrk) -return -ENOMEM ; - - wl_wrk->e = e; - wl_wrk->vol_id = vol_id; - wl_wrk->lnum = lnum; - wl_wrk->torture = torture; + wl_wrk.e = e; + wl_wrk.vol_id = vol_id; + wl_wrk.lnum = lnum; + wl_wrk.torture = torture; -return erase_worker (ubi, wl_wrk,0 ); +return __erase_worker (ubi, &wl_wrk); }/**
@@ -1014,7 +1011,7 @@ out_unlock: }/** -* erase_worker - physical eraseblock erase worker function. +* __erase_worker - physical eraseblock erase worker function. * @ubi: UBI device description object * @wl_wrk: the work object * @shutdown: non-zero if the worker has to free memory and exit
@@ -1025,8 +1022,7 @@ out_unlock:* needed. Returns zero in case of success and a negative error code in case of * failure. */ -static int erase_worker (struct ubi_device *ubi,struct ubi_work *wl_wrk, -int shutdown) +static int __erase_worker (struct ubi_device *ubi,struct ubi_work *wl_wrk) {struct ubi_wl_entry *e = wl_wrk->e;int pnum = e->pnum;
@@ -1034,21 +1030,11 @@ static int erase_worker(struct ubi_devicint lnum = wl_wrk->lnum;int err, available_consumed =0 ; -if (shutdown) { -dbg_wl ("cancel erasure of PEB %d EC %d" , pnum, e->ec); -kfree (wl_wrk); -wl_entry_destroy (ubi, e); -return 0 ; - } -dbg_wl ("erase PEB %d EC %d LEB %d:%d" , pnum, e->ec, wl_wrk->vol_id, wl_wrk->lnum); err =sync_erase (ubi, e, wl_wrk->torture);if (!err) { -/* Fine, we've erased it successfully */ -kfree (wl_wrk); -spin_lock (&ubi->wl_lock);wl_tree_add (e, &ubi->free); ubi->free_count++;
@@ -1066,7 +1052,6 @@ static int erase_worker(struct ubi_devic }ubi_err (ubi,"failed to erase PEB %d, error %d" , pnum, err); -kfree (wl_wrk);if (err == -EINTR || err == -ENOMEM || err == -EAGAIN || err == -EBUSY ) {
@@ -1150,6 +1135,25 @@ out_ro:return err; } +static int erase_worker (struct ubi_device *ubi,struct ubi_work *wl_wrk, +int shutdown) +{ +int ret; + +if (shutdown) { +struct ubi_wl_entry *e = wl_wrk->e; + +dbg_wl ("cancel erasure of PEB %d EC %d" , e->pnum, e->ec); +kfree (wl_wrk); +wl_entry_destroy (ubi, e); +return 0 ; + } + + ret =__erase_worker (ubi, wl_wrk); +kfree (wl_wrk); +return ret; +} +/** * ubi_wl_put_peb - return a PEB to the wear-leveling sub-system. * @ubi: UBI device description object
Greg Kroah-Hartman
maintainerPATCH 59/200 PCI: spear: Fix dw_pcie_cfg_read/write() usage
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gabriele Paoloni <[email protected]>
commit fa3b7cbab548b15da438b0cc13aa515f7f291f4d upstream.
The first argument of dw_pcie_cfg_read/write() is a 32-bit aligned address. The second argument is the byte offset into a 32-bit word, and dw_pcie_cfg_read/write() only look at the low two bits.
SPEAr13xx used dw_pcie_cfg_read() and dw_pcie_cfg_write() incorrectly: it passed important address bits in the second argument, where they were ignored.
Pass the complete 32-bit word address in the first argument and only the 2-bit offset into that word in the second argument.
Without this fix, SPEAr13xx host will never work with few buggy gen1 card which connects with only gen1 host and also with any endpoint which would generate a read request of more than 128 bytes.
--- drivers/pci/host/pcie-spear13xx.c | 26 ++++++++++++++------------ 1 file changed, 14 insertions(+), 12 deletions(-)
drivers/pci/host/pcie-spear13xx.c +14 -12
@@ -163,34 +163,36 @@ static int spear13xx_pcie_establish_link* default value in capability register is 512 bytes. So force * it to 128 here. */ -dw_pcie_cfg_read (pp->dbi_base, exp_cap_off +PCI_EXP_DEVCTL ,4 , &val); +dw_pcie_cfg_read (pp->dbi_base + exp_cap_off +PCI_EXP_DEVCTL , +0 ,2 , &val); val &= ~PCI_EXP_DEVCTL_READRQ ; -dw_pcie_cfg_write (pp->dbi_base, exp_cap_off +PCI_EXP_DEVCTL ,4 , val); +dw_pcie_cfg_write (pp->dbi_base + exp_cap_off +PCI_EXP_DEVCTL , +0 ,2 , val); -dw_pcie_cfg_write (pp->dbi_base,PCI_VENDOR_ID ,2 ,0x104A ); -dw_pcie_cfg_write (pp->dbi_base,PCI_DEVICE_ID ,2 ,0xCD80 ); +dw_pcie_cfg_write (pp->dbi_base +PCI_VENDOR_ID ,0 ,2 ,0x104A ); +dw_pcie_cfg_write (pp->dbi_base +PCI_VENDOR_ID ,2 ,2 ,0xCD80 );/* * if is_gen1 is set then handle it, so that some buggy card * also works */ if (spear13xx_pcie->is_gen1) { -dw_pcie_cfg_read (pp->dbi_base, exp_cap_off +PCI_EXP_LNKCAP ,4 , - &val); +dw_pcie_cfg_read (pp->dbi_base + exp_cap_off +PCI_EXP_LNKCAP , +0 ,4 , &val);if ((val &PCI_EXP_LNKCAP_SLS ) !=PCI_EXP_LNKCAP_SLS_2_5GB ) { val &= ~((u32 )PCI_EXP_LNKCAP_SLS ); val |=PCI_EXP_LNKCAP_SLS_2_5GB ; -dw_pcie_cfg_write (pp->dbi_base, exp_cap_off + -PCI_EXP_LNKCAP ,4 , val); +dw_pcie_cfg_write (pp->dbi_base + exp_cap_off + +PCI_EXP_LNKCAP ,0 ,4 , val); } -dw_pcie_cfg_read (pp->dbi_base, exp_cap_off +PCI_EXP_LNKCTL2 ,4 , - &val); +dw_pcie_cfg_read (pp->dbi_base + exp_cap_off +PCI_EXP_LNKCTL2 , +0 ,2 , &val);if ((val &PCI_EXP_LNKCAP_SLS ) !=PCI_EXP_LNKCAP_SLS_2_5GB ) { val &= ~((u32 )PCI_EXP_LNKCAP_SLS ); val |=PCI_EXP_LNKCAP_SLS_2_5GB ; -dw_pcie_cfg_write (pp->dbi_base, exp_cap_off + -PCI_EXP_LNKCTL2 ,4 , val); +dw_pcie_cfg_write (pp->dbi_base + exp_cap_off + +PCI_EXP_LNKCTL2 ,0 ,2 , val); } }
Greg Kroah-Hartman
maintainerPATCH 60/200 PCI: Set SR-IOV NumVFs to zero after enumeration
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Duyck <[email protected]>
commit ea9a8854161d9580cfabe011c0ae296ecc0e1d4f upstream.
The enumeration path should leave NumVFs set to zero. But after 4449f079722c ("PCI: Calculate maximum number of buses required for VFs"), we call virtfn_max_buses() in the enumeration path, which changes NumVFs. This NumVFs change is visible via lspci and sysfs until a driver enables SR-IOV.
Iterate from TotalVFs down to zero so NumVFs is zero when we're finished computing the maximum number of buses. Validate offset and stride in the loop, so we can test it at every possible NumVFs setting. Rename virtfn_max_buses() to compute_max_vf_buses() to hint that it does have a side effect of updating iov->max_VF_buses.
[bhelgaas: changelog, rename, allow numVF==1 && stride==0, rework loop, reverse sense of error path]
--- drivers/pci/iov.c | 41 ++++++++++++++++++++++------------------- 1 file changed, 22 insertions(+), 19 deletions(-)
drivers/pci/iov.c +22 -19
@@ -54,24 +54,29 @@ static inline void pci_iov_set_numvfs(st* The PF consumes one bus number. NumVFs, First VF Offset, and VF Stride * determine how many additional bus numbers will be consumed by VFs. * -* Iterate over all valid NumVFs and calculate the maximum number of bus -* numbers that could ever be required. +* Iterate over all valid NumVFs, validate offset and stride, and calculate +* the maximum number of bus numbers that could ever be required. */ -static inline u8 virtfn_max_buses (struct pci_dev *dev) +static int compute_max_vf_buses (struct pci_dev *dev) {struct pci_sriov *iov = dev->sriov; -int nr_virtfn; -u8 max =0 ; -int busnr; +int nr_virtfn, busnr, rc =0 ; -for (nr_virtfn =1 ; nr_virtfn <= iov->total_VFs; nr_virtfn++) { +for (nr_virtfn = iov->total_VFs; nr_virtfn; nr_virtfn--) {pci_iov_set_numvfs (dev, nr_virtfn); +if (!iov->offset || (nr_virtfn >1 && !iov->stride)) { + rc = -EIO ; + goto out; + } + busnr =pci_iov_virtfn_bus (dev, nr_virtfn -1 ); -if (busnr > max) - max = busnr; +if (busnr > iov->max_VF_buses) + iov->max_VF_buses = busnr; } -return max; +out: +pci_iov_set_numvfs (dev,0 ); +return rc; }static struct pci_bus *virtfn_add_bus (struct pci_bus *bus,int busnr)
@@ -384,7 +389,7 @@ static int sriov_init(struct pci_dev *deint rc;int nres;u32 pgsz; -u16 ctrl, total, offset, stride; +u16 ctrl, total;struct pci_sriov *iov;struct resource *res;struct pci_dev *pdev;
@@ -414,11 +419,6 @@ static int sriov_init(struct pci_dev *de found:pci_write_config_word (dev, pos +PCI_SRIOV_CTRL , ctrl); -pci_write_config_word (dev, pos +PCI_SRIOV_NUM_VF ,0 ); -pci_read_config_word (dev, pos +PCI_SRIOV_VF_OFFSET , &offset); -pci_read_config_word (dev, pos +PCI_SRIOV_VF_STRIDE , &stride); -if (!offset || (total >1 && !stride)) -return -EIO ;pci_read_config_dword (dev, pos +PCI_SRIOV_SUP_PGSIZE , &pgsz); i =PAGE_SHIFT >12 ?PAGE_SHIFT -12 :0 ;
@@ -456,8 +456,6 @@ found: iov->nres = nres; iov->ctrl = ctrl; iov->total_VFs = total; - iov->offset = offset; - iov->stride = stride; iov->pgsz = pgsz; iov->self = dev;pci_read_config_dword (dev, pos +PCI_SRIOV_CAP , &iov->cap);
@@ -474,10 +472,15 @@ found: dev->sriov = iov; dev->is_physfn =1 ; - iov->max_VF_buses =virtfn_max_buses (dev); + rc =compute_max_vf_buses (dev); +if (rc) + goto fail_max_buses;return 0 ; +fail_max_buses: + dev->sriov =NULL ; + dev->is_physfn =0 ; failed:for (i =0 ; i <PCI_SRIOV_NUM_BARS ; i++) { res = &dev->resource[i +PCI_IOV_RESOURCES ];
Greg Kroah-Hartman
maintainerPATCH 61/200 PCI: Prevent out of bounds access in numa_node override
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Krause <[email protected]>
commit 3dcc8d39cf15fa3ceabedcffcbd3958fe953555a upstream.
Commit 1266963170f5 ("PCI: Prevent out of bounds access in numa_node override") missed that the user-provided node could also be negative. Handle this case as well to avoid out-of-bounds accesses to the node_states[] array. However, allow the special value -1, i.e. NUMA_NO_NODE, to be able to set the 'no specific node' configuration.
--- drivers/pci/pci-sysfs.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/pci/pci-sysfs.c +4 -1
@@ -216,7 +216,10 @@ static ssize_t numa_node_store(struct deif (ret)return ret; -if (node >=MAX_NUMNODES || !node_online (node)) +if ((node <0 && node !=NUMA_NO_NODE ) || node >=MAX_NUMNODES ) +return -EINVAL ; + +if (node !=NUMA_NO_NODE && !node_online (node))return -EINVAL ;add_taint (TAINT_FIRMWARE_WORKAROUND ,LOCKDEP_STILL_OK );
Greg Kroah-Hartman
maintainerPATCH 64/200 tracing: Update instance_rmdir() to use tracefs_remove_recursive
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiaxing Wang <[email protected]>
commit 681a4a2f4529517422835b7395df07404dfe2278 upstream.
Update instancd_rmdir to use tracefs_remove_recursive instead of debugfs_remove_recursive.This was left in the transition from debugfs to tracefs.
--- kernel/trace/trace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/trace/trace.c +1 -1
@@ -6602,7 +6602,7 @@ static int instance_rmdir(const char *natracing_set_nop (tr);event_trace_del_tracer (tr);ftrace_destroy_function_files (tr); -debugfs_remove_recursive (tr->dir); +tracefs_remove_recursive (tr->dir);free_trace_buffers (tr);kfree (tr->name);
Greg Kroah-Hartman
maintainerPATCH 65/200 tracing: Fix setting of start_index in find_next()
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qiu Peiyang <[email protected]>
commit f36d1be2930ede0a1947686e1126ffda5d5ee1bb upstream.
When we do cat /sys/kernel/debug/tracing/printk_formats, we hit kernel panic at t_show.
general protection fault: 0000 [#1] PREEMPT SMP CPU: 0 PID: 2957 Comm: sh Tainted: G W O 3.14.55-x86_64-01062-gd4acdc7 #2 RIP: 0010:[<ffffffff811375b2>] [<ffffffff811375b2>] t_show+0x22/0xe0 RSP: 0000:ffff88002b4ebe80 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000004 RDX: 0000000000000004 RSI: ffffffff81fd26a6 RDI: ffff880032f9f7b1 RBP: ffff88002b4ebe98 R08: 0000000000001000 R09: 000000000000ffec R10: 0000000000000000 R11: 000000000000000f R12: ffff880004d9b6c0 R13: 7365725f6d706400 R14: ffff880004d9b6c0 R15: ffffffff82020570 FS: 0000000000000000(0000) GS:ffff88003aa00000(0063) knlGS:00000000f776bc40 CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 CR2: 00000000f6c02ff0 CR3: 000000002c2b3000 CR4: 00000000001007f0 Call Trace: [<ffffffff811dc076>] seq_read+0x2f6/0x3e0 [<ffffffff811b749b>] vfs_read+0x9b/0x160 [<ffffffff811b7f69>] SyS_read+0x49/0xb0 [<ffffffff81a3a4b9>] ia32_do_call+0x13/0x13 ---[ end trace 5bd9eb630614861e ]--- Kernel panic - not syncing: Fatal exception
When the first time find_next calls find_next_mod_format, it should iterate the trace_bprintk_fmt_list to find the first print format of the module. However in current code, start_index is smaller than *pos at first, and code will not iterate the list. Latter container_of will get the wrong address with former v, which will cause mod_fmt be a meaningless object and so is the returned mod_fmt->fmt.
This patch will fix it by correcting the start_index. After fixed, when the first time calls find_next_mod_format, start_index will be equal to *pos, and code will iterate the trace_bprintk_fmt_list to get the right module printk format, so is the returned mod_fmt->fmt.
--- kernel/trace/trace_printk.c | 1 + 1 file changed, 1 insertion(+)
kernel/trace/trace_printk.c +1 -0
@@ -267,6 +267,7 @@ static const char **find_next(void *v, lif (*pos < last_index + start_index)return __start___tracepoint_str + (*pos - last_index); + start_index += last_index;return find_next_mod_format (start_index, v, fmt, pos); }
Greg Kroah-Hartman
maintainerPATCH 67/200 tracefs: Fix refcount imbalance in start_creating()
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <[email protected]>
commit d227c3ae4e94e5eb11dd780a811f59e1a7b74ccd upstream.
In tracefs' start_creating(), we pin the file system to safely access its root. When we failed to create a file, we unpin the file system via failed_creating() to release the mount count and eventually the reference of the singleton vfsmount.
However, when we run into an error during lookup_one_len() when still in start_creating(), we only release the parent's mutex but not so the reference on the mount.
F.e., in securityfs_create_file(), after doing simple_pin_fs() when lookup_one_len() fails there, we infact do simple_release_fs(). This seems necessary here as well.
Same issue seen in debugfs due to 190afd81e4a5 ("debugfs: split the beginning and the end of __create_file() off"), which seemed to got carried over into tracefs, too. Noticed during code review.
--- fs/tracefs/inode.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
fs/tracefs/inode.c +5 -1
@@ -340,8 +340,12 @@ static struct dentry *start_creating(condput (dentry); dentry =ERR_PTR (-EEXIST ); } -if (IS_ERR (dentry)) + +if (IS_ERR (dentry)) {mutex_unlock (&parent->d_inode->i_mutex); +simple_release_fs (&tracefs_mount, &tracefs_mount_count); + } +return dentry; }
Greg Kroah-Hartman
maintainerPATCH 68/200 jbd2: fix checkpoint list cleanup
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
commit 33d14975e5ac469963d5d63856b61698ad0bff07 upstream.
Unlike comments and expectation of callers journal_clean_one_cp_list() returned 1 not only if it freed the transaction but also if it freed some buffers in the transaction. That could make __jbd2_journal_clean_checkpoint_list() skip processing t_checkpoint_io_list and continue with processing the next transaction. This is mostly a cosmetic issue since the only result is we can sometimes free less memory than we could. But it's still worth fixing. Fix journal_clean_one_cp_list() to return 1 only if the transaction was really freed.
--- fs/jbd2/checkpoint.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-)
fs/jbd2/checkpoint.c +3 -5
@@ -427,7 +427,6 @@ static int journal_clean_one_cp_list(strstruct journal_head *last_jh;struct journal_head *next_jh = jh;int ret; -int freed =0 ;if (!jh)return 0 ;
@@ -441,10 +440,9 @@ static int journal_clean_one_cp_list(strelse ret =__jbd2_journal_remove_checkpoint (jh) +1 ;if (!ret) -return freed; +return 0 ;if (ret ==2 )return 1 ; - freed =1 ;/* * This function only frees up some memory * if possible so we dont have an obligation
@@ -452,10 +450,10 @@ static int journal_clean_one_cp_list(str* requested: */ if (need_resched ()) -return freed; +return 0 ; }while (jh != last_jh); -return freed; +return 0 ; }/*
Greg Kroah-Hartman
maintainerPATCH 69/200 jbd2: Fix unreclaimed pages after truncate in data=journal mode
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
commit bc23f0c8d7ccd8d924c4e70ce311288cb3e61ea8 upstream.
Ted and Namjae have reported that truncated pages don't get timely reclaimed after being truncated in data=journal mode. The following test triggers the issue easily:
for (i = 0; i < 1000; i++) {
pwrite(fd, buf, 1024*1024, 0);
fsync(fd);
fsync(fd);
ftruncate(fd, 0);
}The reason is that journal_unmap_buffer() finds that truncated buffers are not journalled (jh->b_transaction == NULL), they are part of checkpoint list of a transaction (jh->b_cp_transaction != NULL) and have been already written out (!buffer_dirty(bh)). We clean such buffers but we leave them in the checkpoint list. Since checkpoint transaction holds a reference to the journal head, these buffers cannot be released until the checkpoint transaction is cleaned up. And at that point we don't call release_buffer_page() anymore so pages detached from mapping are lingering in the system waiting for reclaim to find them and free them.
Fix the problem by removing buffers from transaction checkpoint lists when journal_unmap_buffer() finds out they don't have to be there anymore.
--- fs/jbd2/transaction.c | 2 ++ 1 file changed, 2 insertions(+)
fs/jbd2/transaction.c +2 -0
@@ -2152,6 +2152,7 @@ static int journal_unmap_buffer(journal_if (!buffer_dirty (bh)) {/* bdflush has written it. We can drop it now */ +__jbd2_journal_remove_checkpoint (jh); goto zap_buffer; }
@@ -2181,6 +2182,7 @@ static int journal_unmap_buffer(journal_/* The orphan record's transaction has * committed. We can cleanse this buffer */ clear_buffer_jbddirty (bh); +__jbd2_journal_remove_checkpoint (jh); goto zap_buffer; } }
Greg Kroah-Hartman
maintainerPATCH 72/200 printk: prevent userland from spoofing kernel messages
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Krause <[email protected]>
commit 3824657c522f19f85a76bd932821174a5557a382 upstream.
The following statement of ABI/testing/dev-kmsg is not quite right:
It is not possible to inject messages from userspace with the facility number LOG_KERN (0), to make sure that the origin of the messages can always be reliably determined.
Userland actually can inject messages with a facility of 0 by abusing the fact that the facility is stored in a u8 data type. By using a facility which is a multiple of 256 the assignment of msg->facility in log_store() implicitly truncates it to 0, i.e. LOG_KERN, allowing users of /dev/kmsg to spoof kernel messages as shown below:
The following call...
# printf '<%d>Kernel panic - not syncing: beer empty\n' 0 >/dev/kmsg ...leads to the following log entry (dmesg -x | tail -n 1): user :emerg : [ 66.137758] Kernel panic - not syncing: beer empty
However, this call...
# printf '<%d>Kernel panic - not syncing: beer empty\n' 0x800 >/dev/kmsg ...leads to the slightly different log entry (note the kernel facility): kern :emerg : [ 74.177343] Kernel panic - not syncing: beer empty
Fix that by limiting the user provided facility to 8 bit right from the beginning and catch the truncation early.
--- kernel/printk/printk.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
kernel/printk/printk.c +8 -5
@@ -269,6 +269,9 @@ static u32 clear_idx;#define PREFIX_MAX 32#define LOG_LINE_MAX (1024 - PREFIX_MAX) +#define LOG_LEVEL (v) ((v) & 0x07) +#define LOG_FACILITY (v) ((v) >> 3 & 0xff) +/* record buffer */ #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS )#define LOG_ALIGN 4
@@ -611,7 +614,6 @@ struct devkmsg_user {static ssize_t devkmsg_write (struct kiocb *iocb,struct iov_iter *from) {char *buf, *line; -int i;int level = default_message_loglevel;int facility =1 ;/* LOG_USER */ size_t len =iov_iter_count (from);
@@ -641,12 +643,13 @@ static ssize_t devkmsg_write(struct kioc line = buf;if (line[0 ] =='<' ) {char *endp =NULL ; +unsigned int u; - i =simple_strtoul (line+1 , &endp,10 ); + u =simple_strtoul (line +1 , &endp,10 );if (endp && endp[0 ] =='>' ) { - level = i &7 ; -if (i >>3 ) - facility = i >>3 ; + level =LOG_LEVEL (u); +if (LOG_FACILITY (u) !=0 ) + facility =LOG_FACILITY (u); endp++; len -= endp - line; line = endp;
Greg Kroah-Hartman
maintainerPATCH 74/200 parisc: Drop unused MADV_xxxK_PAGES flags from asm/mman.h
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Helge Deller <[email protected]>
commit dcbf0d299c00ed4f82ea8d6e359ad88a5182f9b8 upstream.
Drop the MADV_xxK_PAGES flags, which were never used and were from a proposed API which was never integrated into the generic Linux kernel code.
--- arch/parisc/include/uapi/asm/mman.h | 10 ---------- 1 file changed, 10 deletions(-)
arch/parisc/include/uapi/asm/mman.h +0 -10
@@ -46,16 +46,6 @@#define MADV_DONTFORK 10/* don't inherit across fork */ #define MADV_DOFORK 11/* do inherit across fork */ -/* The range 12-64 is reserved for page size specification. */ -#define MADV_4K_PAGES 12/* Use 4K pages */ -#define MADV_16K_PAGES 14/* Use 16K pages */ -#define MADV_64K_PAGES 16/* Use 64K pages */ -#define MADV_256K_PAGES 18/* Use 256K pages */ -#define MADV_1M_PAGES 20/* Use 1 Megabyte pages */ -#define MADV_4M_PAGES 22/* Use 4 Megabyte pages */ -#define MADV_16M_PAGES 24/* Use 16 Megabyte pages */ -#define MADV_64M_PAGES 26/* Use 64 Megabyte pages */ -#define MADV_MERGEABLE 65/* KSM may merge identical pages */ #define MADV_UNMERGEABLE 66/* KSM may not merge identical pages */
Greg Kroah-Hartman
maintainerPATCH 75/200 parisc: Fix syscall restarts
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Helge Deller <[email protected]>
commit 71a71fb5374a23be36a91981b5614590b9e722c3 upstream.
On parisc syscalls which are interrupted by signals sometimes failed to restart and instead returned -ENOSYS which in the worst case lead to userspace crashes.
A similiar problem existed on MIPS and was fixed by commit e967ef02 ("MIPS: Fix restart of indirect syscalls").
On parisc the current syscall restart code assumes that all syscall callers load the syscall number in the delay slot of the ble instruction. That's how it is e.g. done in the unistd.h header file:
ble 0x100(%sr2, %r0) ldi #syscall_nr, %r20
Because of that assumption the current code never restored %r20 before returning to userspace.
This assumption is at least not true for code which uses the glibc syscall() function, which instead uses this syntax:
ble 0x100(%sr2, %r0) copy regX, %r20
where regX depend on how the compiler optimizes the code and register usage.
This patch fixes this problem by adding code to analyze how the syscall number is loaded in the delay branch and - if needed - copy the syscall number to regX prior returning to userspace for the syscall restart.
--- arch/parisc/kernel/signal.c | 64 +++++++++++++++++++++++++++++++++++--------- 1 file changed, 52 insertions(+), 12 deletions(-)
arch/parisc/kernel/signal.c +52 -12
@@ -435,6 +435,55 @@ handle_signal(struct ksignal *ksig, stru regs->gr[28]); } +/* +* Check how the syscall number gets loaded into %r20 within +* the delay branch in userspace and adjust as needed. +*/ + +static void check_syscallno_in_delay_branch (struct pt_regs *regs) +{ +u32 opcode, source_reg; +u32 __user *uaddr; +int err; + +/* Usually we don't have to restore %r20 (the system call number) +* because it gets loaded in the delay slot of the branch external +* instruction via the ldi instruction. +* In some cases a register-to-register copy instruction might have +* been used instead, in which case we need to copy the syscall +* number into the source register before returning to userspace. +*/ + +/* A syscall is just a branch, so all we have to do is fiddle the +* return pointer so that the ble instruction gets executed again. +*/ + regs->gr[31 ] -=8 ;/* delayed branching */ + +/* Get assembler opcode of code in delay branch */ + uaddr = (unsigned int *) ((regs->gr[31 ] & ~3 ) +4 ); + err =get_user (opcode, uaddr); +if (err) +return ; + +/* Check if delay branch uses "ldi int,%r20" */ +if ((opcode &0xffff0000 ) ==0x34140000 ) +return ;/* everything ok, just return */ + +/* Check if delay branch uses "nop" */ +if (opcode ==INSN_NOP ) +return ; + +/* Check if delay branch uses "copy %rX,%r20" */ +if ((opcode &0xffe0ffff ) ==0x08000254 ) { + source_reg = (opcode >>16 ) &31 ; + regs->gr[source_reg] = regs->gr[20 ]; +return ; + } + +pr_warn ("syscall restart: %s (pid %d): unexpected opcode 0x%08x\n" , + current->comm,task_pid_nr (current), opcode); +} +static inline void syscall_restart (struct pt_regs *regs,struct k_sigaction *ka) {
@@ -457,10 +506,7 @@ syscall_restart(struct pt_regs *regs, st }/* fallthrough */ case -ERESTARTNOINTR : -/* A syscall is just a branch, so all -* we have to do is fiddle the return pointer. -*/ - regs->gr[31 ] -=8 ;/* delayed branching */ +check_syscallno_in_delay_branch (regs);break ; } }
@@ -510,15 +556,9 @@ insert_restart_trampoline(struct pt_regs }case -ERESTARTNOHAND :case -ERESTARTSYS : -case -ERESTARTNOINTR : { -/* Hooray for delayed branching. We don't -* have to restore %r20 (the system call -* number) because it gets loaded in the delay -* slot of the branch external instruction. -*/ - regs->gr[31 ] -=8 ; +case -ERESTARTNOINTR : +check_syscallno_in_delay_branch (regs);return ; - }default :break ; }
Greg Kroah-Hartman
maintainerPATCH 76/200 parisc: Fix __ARCH_SI_PREAMBLE_SIZE
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Helge Deller <[email protected]>
commit e60fc5aa608eb38b47ba4ee058f306f739eb70a0 upstream.
On a 64bit kernel build the compiler aligns the _sifields union in the struct siginfo_t on a 64bit address. The __ARCH_SI_PREAMBLE_SIZE define compensates for this alignment and thus fixes the wait testcase of the strace package.
The symptoms of a wrong __ARCH_SI_PREAMBLE_SIZE value is that _sigchld.si_stime variable is missed to be copied and thus after a copy_siginfo() will have uninitialized values.
--- arch/parisc/include/uapi/asm/siginfo.h | 4 ++++ 1 file changed, 4 insertions(+)
arch/parisc/include/uapi/asm/siginfo.h +4 -0
@@ -1,6 +1,10 @@#ifndef _PARISC_SIGINFO_H#define _PARISC_SIGINFO_H +#if defined(__LP64__) +#define __ARCH_SI_PREAMBLE_SIZE (4 * sizeof(int)) +#endif +#include <asm-generic/siginfo.h> #undef NSIGTRAP
Greg Kroah-Hartman
maintainerPATCH 77/200 xtensa: fixes for configs without loop option
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Filippov <[email protected]>
commit 5029615e25dc5040beb065f36743c127a8e51497 upstream.
Build-time fixes:
- make lbeg/lend/lcount save/restore conditional on kernel entry;
- don't clear lcount in platform_restart functions unconditionally.
Run-time fixes:
- use correct end of range register in __endla paired with __loopt, not the unused temporary register. This fixes .bss zero-initialization. Update comments in asmmacro.h;
- don't clobber a10 in the usercopy that leads to access to unmapped memory.
--- arch/xtensa/include/asm/asmmacro.h | 7 ++++--- arch/xtensa/kernel/entry.S | 8 ++++++-- arch/xtensa/kernel/head.S | 2 +- arch/xtensa/lib/usercopy.S | 6 +++--- arch/xtensa/platforms/iss/setup.c | 2 ++ arch/xtensa/platforms/xt2000/setup.c | 2 ++ arch/xtensa/platforms/xtfpga/setup.c | 2 ++ 7 files changed, 20 insertions(+), 9 deletions(-)
arch/xtensa/include/asm/asmmacro.h +4 -3
@@ -35,9 +35,10 @@* __loop as * restart loop. 'as' register must not have been modified! * -* __endla ar, at, incr +* __endla ar, as, incr * ar start address (modified) -* as scratch register used by macro +* as scratch register used by __loops/__loopi macros or +* end address used by __loopt macro * inc increment */
@@ -97,7 +98,7 @@ .endm /* - * loop from ar to ax + * loop from ar to as */ .macro __loopt ar, as, at, incr_log2
arch/xtensa/kernel/entry.S +6 -2
@@ -367,8 +367,10 @@ common_exception: s32i a2, a1, PT_SYSCALL movi a2, 0 s32i a3, a1, PT_EXCVADDR +#if XCHAL_HAVE_LOOPS xsr a2, lcount s32i a2, a1, PT_LCOUNT +#endif /* It is now save to restore the EXC_TABLE_FIXUP variable. */
@@ -429,11 +431,12 @@ common_exception: rsync # PS.WOE => rsync => overflow /* Save lbeg, lend */ - +#if XCHAL_HAVE_LOOPS rsr a4, lbeg rsr a3, lend s32i a4, a1, PT_LBEG s32i a3, a1, PT_LEND +#endif /* Save SCOMPARE1 */
@@ -724,13 +727,14 @@ common_exception_exit: wsr a3, sar /* Restore LBEG, LEND, LCOUNT */ - +#if XCHAL_HAVE_LOOPS l32i a2, a1, PT_LBEG l32i a3, a1, PT_LEND wsr a2, lbeg l32i a2, a1, PT_LCOUNT wsr a3, lend wsr a2, lcount +#endif /* We control single stepping through the ICOUNTLEVEL register. */
arch/xtensa/kernel/head.S +1 -1
@@ -249,7 +249,7 @@ ENTRY(_startup) __loopt a2, a3, a4, 2 s32i a0, a2, 0 - __endla a2, a4, 4 + __endla a2, a3, 4 #if XCHAL_DCACHE_IS_WRITEBACK
arch/xtensa/lib/usercopy.S +3 -3
@@ -222,8 +222,8 @@ __xtensa_copy_user: loopnez a7, .Loop2done #else /* !XCHAL_HAVE_LOOPS */ beqz a7, .Loop2done - slli a10, a7, 4 - add a10, a10, a3 # a10 = end of last 16B source chunk + slli a12, a7, 4 + add a12, a12, a3 # a12 = end of last 16B source chunk #endif /* !XCHAL_HAVE_LOOPS */ .Loop2: EX(l32i, a7, a3, 4, l_fixup)
@@ -241,7 +241,7 @@ __xtensa_copy_user: EX(s32i, a9, a5, 12, s_fixup) addi a5, a5, 16 #if !XCHAL_HAVE_LOOPS - blt a3, a10, .Loop2 + blt a3, a12, .Loop2 #endif /* !XCHAL_HAVE_LOOPS */ .Loop2done: bbci.l a4, 3, .L12
arch/xtensa/platforms/iss/setup.c +2 -0
@@ -61,7 +61,9 @@ void platform_restart(void)#if XCHAL_NUM_IBREAK >0 "wsr a2, ibreakenable\n\t"#endif +#if XCHAL_HAVE_LOOPS "wsr a2, lcount\n\t" +#endif "movi a2, 0x1f\n\t" "wsr a2, ps\n\t" "isync\n\t"
arch/xtensa/platforms/xt2000/setup.c +2 -0
@@ -72,7 +72,9 @@ void platform_restart(void)#if XCHAL_NUM_IBREAK >0 "wsr a2, ibreakenable\n\t"#endif +#if XCHAL_HAVE_LOOPS "wsr a2, lcount\n\t" +#endif "movi a2, 0x1f\n\t" "wsr a2, ps\n\t" "isync\n\t"
arch/xtensa/platforms/xtfpga/setup.c +2 -0
@@ -63,7 +63,9 @@ void platform_restart(void)#if XCHAL_NUM_IBREAK >0 "wsr a2, ibreakenable\n\t"#endif +#if XCHAL_HAVE_LOOPS "wsr a2, lcount\n\t" +#endif "movi a2, 0x1f\n\t" "wsr a2, ps\n\t" "isync\n\t"
Greg Kroah-Hartman
maintainerPATCH 78/200 xtensa: fix secondary core boot in SMP
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Filippov <[email protected]>
commit ab45fb145096799dabd18afc58bb5f97171017cd upstream.
There are multiple factors adding to the issue in different configurations:
- commit 17290231df16eeee ("xtensa: add fixup for double exception raised in window overflow") added function window_overflow_restore_a0_fixup to double exception vector overlapping reset vector location of secondary processor cores.
- on MMUv2 cores RESET_VECTOR1_VADDR may point to uncached kernel memory making code overlapping depend on cache type and size, so that without cache or with WT cache reset vector code overwrites double exception code, making issue even harder to detect.
- on MMUv3 cores RESET_VECTOR1_VADDR may point to unmapped area, as MMUv3 cores change virtual address map to match MMUv2 layout, but reset vector virtual address is given for the original MMUv3 mapping.
- physical memory region of the secondary reset vector is not reserved in the physical memory map, and thus may be allocated and overwritten at arbitrary moment.
Fix it as follows:
- move window_overflow_restore_a0_fixup code to .text section.
- define RESET_VECTOR1_VADDR so that it points to reset vector in the cacheable MMUv2 map for cores with MMU.
- reserve reset vector region in the physical memory map. Drop separate literal section and build mxhead.S with text section literals.
--- arch/xtensa/include/asm/vectors.h | 9 +++++---- arch/xtensa/kernel/Makefile | 1 + arch/xtensa/kernel/setup.c | 9 ++++++++- arch/xtensa/kernel/vectors.S | 4 +++- arch/xtensa/kernel/vmlinux.lds.S | 12 ++---------- 5 files changed, 19 insertions(+), 16 deletions(-)
arch/xtensa/include/asm/vectors.h +5 -4
@@ -48,6 +48,9 @@#define LOAD_MEMORY_ADDRESS 0xD0003000#endif +#define RESET_VECTOR1_VADDR (VIRTUAL_MEMORY_ADDRESS + \ + XCHAL_RESET_VECTOR1_PADDR) +#else /* !defined(CONFIG_MMU) */ /* MMU Not being used - Virtual == Physical */
@@ -60,6 +63,8 @@/* Loaded just above possibly live vectors */ #define LOAD_MEMORY_ADDRESS (PLATFORM_DEFAULT_MEM_START + 0x3000) +#define RESET_VECTOR1_VADDR (XCHAL_RESET_VECTOR1_VADDR) +#endif /* CONFIG_MMU */ #define XC_VADDR (offset) (VIRTUAL_MEMORY_ADDRESS + offset)
@@ -71,10 +76,6 @@ VECBASE_RESET_VADDR)#define RESET_VECTOR_VADDR XC_VADDR(RESET_VECTOR_VECOFS) -#define RESET_VECTOR1_VECOFS (XCHAL_RESET_VECTOR1_VADDR - \ - VECBASE_RESET_VADDR) -#define RESET_VECTOR1_VADDR XC_VADDR(RESET_VECTOR1_VECOFS) -#if defined(XCHAL_HAVE_VECBASE ) &&XCHAL_HAVE_VECBASE #define USER_VECTOR_VADDR XC_VADDR(XCHAL_USER_VECOFS)
arch/xtensa/kernel/Makefile +1 -0
@@ -16,6 +16,7 @@ obj-$(CONFIG_SMP) += smp.o mxhead.o obj-$(CONFIG_XTENSA_VARIANT_HAVE_PERF_EVENTS) += perf_event.o AFLAGS_head.o += -mtext-section-literals +AFLAGS_mxhead.o += -mtext-section-literals # In the Xtensa architecture, assembly generates literals which must always # precede the L32R instruction with a relative offset less than 256 kB.
arch/xtensa/kernel/setup.c +8 -1
@@ -334,7 +334,10 @@ extern char _Level5InterruptVector_text_extern char _Level6InterruptVector_text_start;extern char _Level6InterruptVector_text_end;#endif - +#ifdef CONFIG_SMP +extern char _SecondaryResetVector_text_start; +extern char _SecondaryResetVector_text_end; +#endif #ifdef CONFIG_S32C1I_SELFTEST
@@ -506,6 +509,10 @@ void __init setup_arch(char **cmdline_p) __pa(&_Level6InterruptVector_text_end), 0);#endif +#ifdef CONFIG_SMP +mem_reserve (__pa (&_SecondaryResetVector_text_start), +__pa (&_SecondaryResetVector_text_end),0 ); +#endif parse_early_param ();bootmem_init ();
arch/xtensa/kernel/vectors.S +3 -1
@@ -478,6 +478,9 @@ _DoubleExceptionVector_handle_exception: ENDPROC(_DoubleExceptionVector) + .end literal_prefix + + .text /* * Fixup handler for TLB miss in double exception handler for window owerflow. * We get here with windowbase set to the window that was being spilled and
@@ -587,7 +590,6 @@ ENTRY(window_overflow_restore_a0_fixup) ENDPROC(window_overflow_restore_a0_fixup) - .end literal_prefix /* * Debug interrupt vector *
arch/xtensa/kernel/vmlinux.lds.S +2 -10
@@ -166,8 +166,6 @@ SECTIONS RELOCATE_ENTRY(_DebugInterruptVector_text, .DebugInterruptVector.text); #if defined(CONFIG_SMP) - RELOCATE_ENTRY(_SecondaryResetVector_literal, - .SecondaryResetVector.literal); RELOCATE_ENTRY(_SecondaryResetVector_text, .SecondaryResetVector.text); #endif
@@ -282,17 +280,11 @@ SECTIONS #if defined(CONFIG_SMP) - SECTION_VECTOR (_SecondaryResetVector_literal, - .SecondaryResetVector.literal, - RESET_VECTOR1_VADDR - 4, - SIZEOF(.DoubleExceptionVector.text), - .DoubleExceptionVector.text) - SECTION_VECTOR (_SecondaryResetVector_text, .SecondaryResetVector.text, RESET_VECTOR1_VADDR, - 4, - .SecondaryResetVector.literal) + SIZEOF(.DoubleExceptionVector.text), + .DoubleExceptionVector.text) . = LOADADDR(.SecondaryResetVector.text)+SIZEOF(.SecondaryResetVector.text);
Greg Kroah-Hartman
maintainerPATCH 80/200 i2c: at91: manage unexpected RXRDY flag when starting a transfer
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ludovic Desroches <[email protected]>
commit a9bed6b10bd117a300cceb9062003f7a2761ef99 upstream.
In some cases, we could start a new i2c transfer with the RXRDY flag set. It is not a clean state and it leads to print annoying error messages even if there no real issue. The cause is only having garbage data in the Receive Holding Register because of a weird behavior of the RXRDY flag.
--- drivers/i2c/busses/i2c-at91.c | 36 ++++++++++++++++++++++++++---------- 1 file changed, 26 insertions(+), 10 deletions(-)
drivers/i2c/busses/i2c-at91.c +26 -10
@@ -347,8 +347,14 @@ error:static void at91_twi_read_next_byte (struct at91_twi_dev *dev) { -if (!dev->buf_len) +/* +* If we are in this case, it means there is garbage data in RHR, so +* delete them. +*/ +if (!dev->buf_len) { +at91_twi_read (dev,AT91_TWI_RHR );return ; + }/* 8bit read works with and without FIFO */ *dev->buf =readb_relaxed (dev->base +AT91_TWI_RHR );
@@ -465,6 +471,24 @@ static irqreturn_t atmel_twi_interrupt(iif (!irqstatus)return IRQ_NONE ; +/* +* In reception, the behavior of the twi device (before sama5d2) is +* weird. There is some magic about RXRDY flag! When a data has been +* almost received, the reception of a new one is anticipated if there +* is no stop command to send. That is the reason why ask for sending +* the stop command not on the last data but on the second last one. +* +* Unfortunately, we could still have the RXRDY flag set even if the +* transfer is done and we have read the last data. It might happen +* when the i2c slave device sends too quickly data after receiving the +* ack from the master. The data has been almost received before having +* the order to send stop. In this case, sending the stop command could +* cause a RXRDY interrupt with a TXCOMP one. It is better to manage +* the RXRDY interrupt first in order to not keep garbage data in the +* Receive Holding Register for the next transfer. +*/ +if (irqstatus &AT91_TWI_RXRDY ) +at91_twi_read_next_byte (dev);/* * When a NACK condition is detected, the I2C controller sets the NACK,
@@ -507,8 +531,6 @@ static irqreturn_t atmel_twi_interrupt(iif (irqstatus & (AT91_TWI_TXCOMP |AT91_TWI_NACK )) {at91_disable_twi_interrupts (dev);complete (&dev->cmd_complete); - }else if (irqstatus &AT91_TWI_RXRDY ) { -at91_twi_read_next_byte (dev); }else if (irqstatus &AT91_TWI_TXRDY ) {at91_twi_write_next_byte (dev); }
@@ -525,7 +547,6 @@ static int at91_do_twi_transfer(struct aunsigned long time_left;bool has_unre_flag = dev->pdata->has_unre_flag;bool has_alt_cmd = dev->pdata->has_alt_cmd; -unsigned sr;/* * WARNING: the TXCOMP bit in the Status Register is NOT a clear on
@@ -577,7 +598,7 @@ static int at91_do_twi_transfer(struct a dev->transfer_status =0 ;/* Clear pending interrupts, such as NACK. */ - sr =at91_twi_read (dev,AT91_TWI_SR ); +at91_twi_read (dev,AT91_TWI_SR );if (dev->fifo_size) {unsigned fifo_mr =at91_twi_read (dev,AT91_TWI_FMR );
@@ -600,11 +621,6 @@ static int at91_do_twi_transfer(struct a }else if (dev->msg->flags &I2C_M_RD ) {unsigned start_flags =AT91_TWI_START ; -if (sr &AT91_TWI_RXRDY ) { -dev_err (dev->dev,"RXRDY still set!" ); -at91_twi_read (dev,AT91_TWI_RHR ); - } -/* if only one byte is to be read, immediately stop transfer */ if (!has_alt_cmd && dev->buf_len <=1 && !(dev->msg->flags &I2C_M_RECV_LEN ))
Greg Kroah-Hartman
maintainerPATCH 81/200 i2c: fix wakeup irq parsing
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Grygorii Strashko <[email protected]>
commit c18fba23061f16dde128e10d4869ba4e88e0e81a upstream.
This patch fixes obvious copy-past error in wake up irq parsing code which leads to the fact that dev_pm_set_wake_irq() will be called with wrong IRQ number when "wakeup" IRQ is not defined in DT.
--- drivers/i2c/i2c-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/i2c/i2c-core.c +1 -1
@@ -679,7 +679,7 @@ static int i2c_device_probe(struct devicif (wakeirq >0 && wakeirq != client->irq) status =dev_pm_set_dedicated_wake_irq (dev, wakeirq);else if (client->irq >0 ) - status =dev_pm_set_wake_irq (dev, wakeirq); + status =dev_pm_set_wake_irq (dev, client->irq);else status =0 ;
Greg Kroah-Hartman
maintainerPATCH 84/200 i2c: rk3x: populate correct variable for sda_falling_time
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wolfram Sang <[email protected]>
commit 9abd29e7c13de24ce73213a425d9574b35ac0c6a upstream.
--- drivers/i2c/busses/i2c-rk3x.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/i2c/busses/i2c-rk3x.c +1 -1
@@ -907,7 +907,7 @@ static int rk3x_i2c_probe(struct platfor &i2c->scl_fall_ns)) i2c->scl_fall_ns =300 ;if (of_property_read_u32 (pdev->dev.of_node,"i2c-sda-falling-time-ns" , - &i2c->scl_fall_ns)) + &i2c->sda_fall_ns)) i2c->sda_fall_ns = i2c->scl_fall_ns;strlcpy (i2c->adap.name,"rk3x-i2c" ,sizeof (i2c->adap.name));
Greg Kroah-Hartman
maintainerPATCH 85/200 i2c: rcar: disable runtime PM correctly in slave mode
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wolfram Sang <[email protected]>
commit b4cd08aa1f53c831e67dc5c6bc9f9acff27abcba upstream.
When we also are I2C slave, we need to disable runtime PM because the address detection mechanism needs to be active all the time. However, we can reenable runtime PM once the slave instance was unregistered. So, use pm_runtime_get_sync/put to achieve this, since it has proper refcounting. pm_runtime_allow/forbid is like a global knob controllable from userspace which is unsuitable here.
--- drivers/i2c/busses/i2c-rcar.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/i2c/busses/i2c-rcar.c +2 -2
@@ -575,7 +575,7 @@ static int rcar_reg_slave(struct i2c_cliif (slave->flags &I2C_CLIENT_TEN )return -EAFNOSUPPORT ; -pm_runtime_forbid (rcar_i2c_priv_to_dev (priv)); +pm_runtime_get_sync (rcar_i2c_priv_to_dev (priv)); priv->slave = slave;rcar_i2c_write (priv,ICSAR , slave->addr);
@@ -597,7 +597,7 @@ static int rcar_unreg_slave(struct i2c_c priv->slave =NULL ; -pm_runtime_allow (rcar_i2c_priv_to_dev (priv)); +pm_runtime_put (rcar_i2c_priv_to_dev (priv));return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 89/200 v4l2-ctrls: arrays are also considered compound controls
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Verkuil <[email protected]>
commit 35204e2e84f2dae72012f8ca319659c12f428430 upstream.
Array controls weren't skipped when only V4L2_CTRL_FLAG_NEXT_CTRL was provided (so no V4L2_CTRL_FLAG_NEXT_COMPOUND was set). This is wrong since arrays are also considered compound controls (i.e. with more than one value), and applications that do not know about arrays will not be able to handle such controls.
Fix the test to include arrays.
--- drivers/media/v4l2-core/v4l2-ctrls.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/media/v4l2-core/v4l2-ctrls.c +2 -2
@@ -2498,7 +2498,7 @@ int v4l2_query_ext_ctrl(struct v4l2_ctrl/* We found a control with the given ID, so just get the next valid one in the list. */ list_for_each_entry_continue (ref, &hdl->ctrl_refs, node) { - is_compound = + is_compound = ref->ctrl->is_array || ref->ctrl->type >=V4L2_CTRL_COMPOUND_TYPES ;if (id < ref->ctrl->id && (is_compound & mask) == match)
@@ -2512,7 +2512,7 @@ int v4l2_query_ext_ctrl(struct v4l2_ctrlis one, otherwise the first 'if' above would have been true. */ list_for_each_entry (ref, &hdl->ctrl_refs, node) { - is_compound = + is_compound = ref->ctrl->is_array || ref->ctrl->type >=V4L2_CTRL_COMPOUND_TYPES ;if (id < ref->ctrl->id && (is_compound & mask) == match)
Greg Kroah-Hartman
maintainerPATCH 90/200 media: v4l2-ctrls: Fix 64bit support in get_ctrl()
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benoit Parrot <[email protected]>
commit a8077734055f870ba630563868a6349671ca8dfc upstream.
When trying to use v4l2_ctrl_g_ctrl_int64() to retrieve a V4L2_CTRL_TYPE_INTEGER64 type value the internal helper function get_ctrl() would prematurely exit because for this control type the 'is_int' flag is not set. This would result in v4l2_ctrl_g_ctrl_int64 always returning 0.
Also v4l2_ctrl_g_ctrl_int64() is reading and returning the 32bit value member instead of the 64bit version, so fixing that as well.
This patch extends the condition check to allow the V4L2_CTRL_TYPE_INTEGER64 type to continue processing instead of exiting.
--- drivers/media/v4l2-core/v4l2-ctrls.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/media/v4l2-core/v4l2-ctrls.c +3 -3
@@ -2884,7 +2884,7 @@ static int get_ctrl(struct v4l2_ctrl *ct* cur_to_user() calls below would need to be modified not to access * userspace memory when called from get_ctrl(). */ -if (!ctrl->is_int) +if (!ctrl->is_int && ctrl->type !=V4L2_CTRL_TYPE_INTEGER64 )return -EINVAL ;if (ctrl->flags &V4L2_CTRL_FLAG_WRITE_ONLY )
@@ -2942,9 +2942,9 @@ s64 v4l2_ctrl_g_ctrl_int64(struct v4l2_c/* It's a driver bug if this happens. */ WARN_ON (ctrl->is_ptr || ctrl->type !=V4L2_CTRL_TYPE_INTEGER64 ); - c.value =0 ; + c.value64 =0 ;get_ctrl (ctrl, &c); -return c.value; +return c.value64; }EXPORT_SYMBOL (v4l2_ctrl_g_ctrl_int64);
Greg Kroah-Hartman
maintainerPATCH 91/200 media: vb2 dma-contig: Fully cache synchronise buffers in prepare and finish
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tiffany Lin <[email protected]>
commit d9a985883fa32453d099d6293188c11d75cef1fa upstream.
In videobuf2 dma-contig memory type the prepare and finish ops, instead of passing the number of entries in the original scatterlist as the "nents" parameter to dma_sync_sg_for_device() and dma_sync_sg_for_cpu(), the value returned by dma_map_sg() was used. Albeit this has been suggested in comments of some implementations (which have since been corrected), this is wrong.
--- drivers/media/v4l2-core/videobuf2-dma-contig.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/media/v4l2-core/videobuf2-dma-contig.c +3 -2
@@ -100,7 +100,8 @@ static void vb2_dc_prepare(void *buf_priif (!sgt || buf->db_attach)return ; -dma_sync_sg_for_device (buf->dev, sgt->sgl, sgt->nents, buf->dma_dir); +dma_sync_sg_for_device (buf->dev, sgt->sgl, sgt->orig_nents, + buf->dma_dir); }static void vb2_dc_finish (void *buf_priv)
@@ -112,7 +113,7 @@ static void vb2_dc_finish(void *buf_privif (!sgt || buf->db_attach)return ; -dma_sync_sg_for_cpu (buf->dev, sgt->sgl, sgt->nents, buf->dma_dir); +dma_sync_sg_for_cpu (buf->dev, sgt->sgl, sgt->orig_nents, buf->dma_dir); }/*********************************************/
Greg Kroah-Hartman
maintainerPATCH 92/200 media: vb2 dma-sg: Fully cache synchronise buffers in prepare and finish
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tiffany Lin <[email protected]>
commit 418dae2276065680bde7ae27d2c075e612a54de6 upstream.
In videobuf2 dma-sg memory types the prepare and finish ops, instead of passing the number of entries in the original scatterlist as the "nents" parameter to dma_sync_sg_for_device() and dma_sync_sg_for_cpu(), the value returned by dma_map_sg() was used. Albeit this has been suggested in comments of some implementations (which have since been corrected), this is wrong.
--- drivers/media/v4l2-core/videobuf2-dma-sg.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/media/v4l2-core/videobuf2-dma-sg.c +3 -2
@@ -210,7 +210,8 @@ static void vb2_dma_sg_prepare(void *bufif (buf->db_attach)return ; -dma_sync_sg_for_device (buf->dev, sgt->sgl, sgt->nents, buf->dma_dir); +dma_sync_sg_for_device (buf->dev, sgt->sgl, sgt->orig_nents, + buf->dma_dir); }static void vb2_dma_sg_finish (void *buf_priv)
@@ -222,7 +223,7 @@ static void vb2_dma_sg_finish(void *buf_if (buf->db_attach)return ; -dma_sync_sg_for_cpu (buf->dev, sgt->sgl, sgt->nents, buf->dma_dir); +dma_sync_sg_for_cpu (buf->dev, sgt->sgl, sgt->orig_nents, buf->dma_dir); } static void *vb2_dma_sg_get_userptr(void *alloc_ctx, unsigned long vaddr,
Greg Kroah-Hartman
maintainerPATCH 93/200 media/v4l2-ctrls: fix setting autocluster to manual with VIDIOC_S_CTRL
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Antonio Ospite <[email protected]>
commit 759b26a1d916400a1a20948eb964dea6ad0bd9e9 upstream.
Since commit 5d0360a4f027576e5419d4a7c711c9ca0f1be8ca it's not possible anymore to set auto clusters from auto to manual using VIDIOC_S_CTRL.
For example, setting autogain to manual with gspca/ov534 driver and this sequence of commands does not work:
v4l2-ctl --set-ctrl=gain_automatic=1 v4l2-ctl --list-ctrls | grep gain_automatic # The following does not work v4l2-ctl --set-ctrl=gain_automatic=0 v4l2-ctl --list-ctrls | grep gain_automatic
Changing the value using VIDIOC_S_EXT_CTRLS (like qv4l2 does) works fine.
The apparent cause by looking at the changes in 5d0360a and comparing with the code path for VIDIOC_S_EXT_CTRLS seems to be that the code in v4l2-ctrls.c::set_ctrl() is not calling user_to_new() anymore after calling update_from_auto_cluster(master).
However the root cause of the problem is that calling update_from_auto_cluster(master) overrides also the _master_ control state calling cur_to_new() while it was supposed to only update the volatile controls.
Calling user_to_new() after update_from_auto_cluster(master) was just masking the original bug by restoring the correct new value of the master control before making the changes permanent.
Fix the original bug by making update_from_auto_cluster() not override the new master control value.
--- drivers/media/v4l2-core/v4l2-ctrls.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/v4l2-core/v4l2-ctrls.c +1 -1
@@ -3043,7 +3043,7 @@ static void update_from_auto_cluster(str {int i; -for (i =0 ; i < master->ncontrols; i++) +for (i =1 ; i < master->ncontrols; i++)cur_to_new (master->cluster[i]);if (!call_op (master, g_volatile_ctrl))for (i =1 ; i < master->ncontrols; i++)
Greg Kroah-Hartman
maintainerPATCH 94/200 Revert "[media] ivtv: avoid going past input/audio array"
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mauro Carvalho Chehab <[email protected]>
commit 823873481b2a17ce5900899f8ef85118f8407b67 upstream.
This patch broke ivtv logic, as reported at
https://bugzilla.redhat.com/show_bug.cgi?id=1278942
This reverts commit 09290cc885937cab3b2d60a6d48fe3d2d3e04061.
--- drivers/media/pci/ivtv/ivtv-driver.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/media/pci/ivtv/ivtv-driver.c +2 -2
@@ -805,11 +805,11 @@ static void ivtv_init_struct2(struct ivt {int i; -for (i =0 ; i <IVTV_CARD_MAX_VIDEO_INPUTS -1 ; i++) +for (i =0 ; i <IVTV_CARD_MAX_VIDEO_INPUTS ; i++)if (itv->card->video_inputs[i].video_type ==0 )break ; itv->nof_inputs = i; -for (i =0 ; i <IVTV_CARD_MAX_AUDIO_INPUTS -1 ; i++) +for (i =0 ; i <IVTV_CARD_MAX_AUDIO_INPUTS ; i++)if (itv->card->audio_inputs[i].audio_type ==0 )break ; itv->nof_audio_inputs = i;
Greg Kroah-Hartman
maintainerPATCH 97/200 fix sysvfs symlinks
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
commit 0ebf7f10d67a70e120f365018f1c5fce9ddc567d upstream.
The thing got broken back in 2002 - sysvfs does *not* have inline symlinks; even short ones have bodies stored in the first block of file. sysv_symlink() handles that correctly; unfortunately, attempting to look an existing symlink up will end up confusing them for inline symlinks, and interpret the block number containing the body as the body itself.
Nobody has noticed until now, which says something about the level of testing sysvfs gets ;-/
--- fs/sysv/inode.c | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-)
fs/sysv/inode.c +2 -9
@@ -162,15 +162,8 @@ void sysv_set_inode(struct inode *inode, inode->i_fop = &sysv_dir_operations; inode->i_mapping->a_ops = &sysv_aops; }else if (S_ISLNK (inode->i_mode)) { -if (inode->i_blocks) { - inode->i_op = &sysv_symlink_inode_operations; - inode->i_mapping->a_ops = &sysv_aops; - }else { - inode->i_op = &simple_symlink_inode_operations; - inode->i_link = (char *)SYSV_I (inode)->i_data; -nd_terminate_link (inode->i_link, inode->i_size, -sizeof (SYSV_I (inode)->i_data) -1 ); - } + inode->i_op = &sysv_symlink_inode_operations; + inode->i_mapping->a_ops = &sysv_aops; }else init_special_inode (inode, inode->i_mode, rdev); }
Greg Kroah-Hartman
maintainerPATCH 98/200 hrtimer: Handle remaining time proper for TIME_LOW_RES
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <[email protected]>
commit 203cbf77de59fc8f13502dcfd11350c6d4a5c95f upstream.
If CONFIG_TIME_LOW_RES is enabled we add a jiffie to the relative timeout to prevent short sleeps, but we do not account for that in interfaces which retrieve the remaining time.
Helge observed that timerfd can return a remaining time larger than the relative timeout. That's not expected and breaks userland test programs.
Store the information that the timer was armed relative and provide functions to adjust the remaining time. To avoid bloating the hrtimer struct make state a u8, which as a bonus results in better code on x86 at least.
--- include/linux/hrtimer.h | 34 ++++++++++++++++++++++++++--- kernel/time/hrtimer.c | 55 +++++++++++++++++++++++++++++++---------------- kernel/time/timer_list.c | 2 - 3 files changed, 69 insertions(+), 22 deletions(-)
include/linux/hrtimer.h +31 -3
@@ -87,7 +87,8 @@ enum hrtimer_restart {* @function: timer expiry callback function * @base: pointer to the timer base (per cpu and per clock) * @state: state information (See bit values above) -* @start_pid: timer statistics field to store the pid of the task which +* @is_rel: Set if the timer was armed relative +* @start_pid: timer statistics field to store the pid of the task which * started the timer * @start_site: timer statistics field to store the site where the timer * was started
@@ -101,7 +102,8 @@ struct hrtimer {ktime_t _softexpires;enum hrtimer_restart (*function)(struct hrtimer *);struct hrtimer_clock_base *base; -unsigned long state; +u8 state; +u8 is_rel;#ifdef CONFIG_TIMER_STATS int start_pid;void *start_site;
@@ -321,6 +323,27 @@ static inline void clock_was_set_delayed#endif +static inline ktime_t +__hrtimer_expires_remaining_adjusted (const struct hrtimer *timer,ktime_t now) +{ +ktime_t rem =ktime_sub (timer->node.expires, now); + +/* +* Adjust relative timers for the extra we added in +* hrtimer_start_range_ns() to prevent short timeouts. +*/ +if (IS_ENABLED (CONFIG_TIME_LOW_RES ) && timer->is_rel) + rem.tv64 -= hrtimer_resolution; +return rem; +} + +static inline ktime_t +hrtimer_expires_remaining_adjusted (const struct hrtimer *timer) +{ +return __hrtimer_expires_remaining_adjusted (timer, + timer->base->get_time ()); +} +extern void clock_was_set (void );#ifdef CONFIG_TIMERFD extern void timerfd_clock_was_set (void );
@@ -390,7 +413,12 @@ static inline void hrtimer_restart(struc }/* Query timers: */ -extern ktime_t hrtimer_get_remaining (const struct hrtimer *timer); +extern ktime_t __hrtimer_get_remaining (const struct hrtimer *timer,bool adjust); + +static inline ktime_t hrtimer_get_remaining (const struct hrtimer *timer) +{ +return __hrtimer_get_remaining (timer, false); +}extern u64 hrtimer_get_next_event (void );
kernel/time/hrtimer.c +37 -18
104 lines not on this page · raw message
kernel/time/timer_list.c +1 -1
@@ -69,7 +69,7 @@ print_timer(struct seq_file *m, struct hprint_name_offset (m, taddr);SEQ_printf (m,", " );print_name_offset (m, timer->function); -SEQ_printf (m,", S:%02lx" , timer->state); +SEQ_printf (m,", S:%02x" , timer->state);#ifdef CONFIG_TIMER_STATS SEQ_printf (m,", " );print_name_offset (m, timer->start_site);
Greg Kroah-Hartman
maintainerPATCH 99/200 ALSA: usb-audio: Fix TEAC UD-501/UD-503/NT-503 usb delay
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guillaume Fougnies <[email protected]>
commit 5a4ff9ec8d6edd2ab1cfe8ce6a080d6e57cbea9a upstream.
TEAC UD-501/UD-503/NT-503 fail to switch properly between different rate/format. Similar to 'Playback Design', this patch corrects the invalid clock source error for TEAC products and avoids complete freeze of the usb interface of 503 series.
--- sound/usb/quirks.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-)
sound/usb/quirks.c +13 -1
@@ -1202,8 +1202,12 @@ void snd_usb_set_interface_quirk(struct* "Playback Design" products need a 50ms delay after setting the * USB interface. */ -if (le16_to_cpu (dev->descriptor.idVendor) ==0x23ba ) +switch (le16_to_cpu (dev->descriptor.idVendor)) { +case 0x23ba :/* Playback Design */ +case 0x0644 :/* TEAC Corp. */ mdelay (50 ); +break ; + } } void snd_usb_ctl_msg_quirk(struct usb_device *dev, unsigned int pipe,
@@ -1218,6 +1222,14 @@ void snd_usb_ctl_msg_quirk(struct usb_de (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS)mdelay (20 ); +/* +* "TEAC Corp." products need a 20ms delay after each +* class compliant request +*/ +if ((le16_to_cpu (dev->descriptor.idVendor) ==0x0644 ) && + (requesttype &USB_TYPE_MASK ) ==USB_TYPE_CLASS ) +mdelay (20 ); +/* Marantz/Denon devices with USB DAC functionality need a delay * after each class compliant request */
Greg Kroah-Hartman
maintainerPATCH 100/200 ALSA: usb-audio: Add quirk for Microsoft LifeCam HD-6000
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lev Lybin <[email protected]>
commit 1b3c993a699bed282e47c3f7c49d539c331dae04 upstream.
Microsoft LifeCam HD-6000 (045e:076f) requires the similar quirk for avoiding the stall due to the invalid sample rate reads.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=111491
--- sound/usb/quirks.c | 1 + 1 file changed, 1 insertion(+)
sound/usb/quirks.c +1 -0
@@ -1118,6 +1118,7 @@ bool snd_usb_get_sample_rate_quirk(strucswitch (chip->usb_id) {case USB_ID (0x045E ,0x075D ):/* MS Lifecam Cinema */ case USB_ID (0x045E ,0x076D ):/* MS Lifecam HD-5000 */ +case USB_ID (0x045E ,0x076F ):/* MS Lifecam HD-6000 */ case USB_ID (0x045E ,0x0772 ):/* MS Lifecam Studio */ case USB_ID (0x045E ,0x0779 ):/* MS Lifecam HD-3000 */ case USB_ID (0x04D8 ,0xFEEA ):/* Benchmark DAC1 Pre */
Greg Kroah-Hartman
maintainerPATCH 102/200 ALSA: usb-audio: Add native DSD support for PS Audio NuWave DAC
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jurgen Kramer <[email protected]>
commit ad678b4ccd41aa51cf5f142c0e8cffe9d61fc2bf upstream.
This patch adds native DSD support for the PS Audio NuWave DAC.
--- sound/usb/quirks.c | 1 + 1 file changed, 1 insertion(+)
sound/usb/quirks.c +1 -0
@@ -1288,6 +1288,7 @@ u64 snd_usb_interface_dsd_format_quirks(case USB_ID (0x20b1 ,0x2009 ):/* DIYINHK DSD DXD 384kHz USB to I2S/DSD */ case USB_ID (0x20b1 ,0x2023 ):/* JLsounds I2SoverUSB */ case USB_ID (0x20b1 ,0x3023 ):/* Aune X1S 32BIT/384 DSD DAC */ +case USB_ID (0x2616 ,0x0106 ):/* PS Audio NuWave DAC */ if (fp->altsetting ==3 )return SNDRV_PCM_FMTBIT_DSD_U32_BE ;break ;
Greg Kroah-Hartman
maintainerPATCH 105/200 ALSA: compress: Disable GET_CODEC_CAPS ioctl for some architectures
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 462b3f161beb62eeb290f4ec52f5ead29a2f8ac7 upstream.
Some architectures like PowerPC can handle the maximum struct size in an ioctl only up to 13 bits, and struct snd_compr_codec_caps used by SNDRV_COMPRESS_GET_CODEC_CAPS ioctl overflows this limit. This problem was revealed recently by a powerpc change, as it's now treated as a fatal build error.
This patch is a stop-gap for that: for architectures with less than 14 bit ioctl struct size, get rid of the handling of the relevant ioctl. We should provide an alternative equivalent ioctl code later, but for now just paper over it. Luckily, the compress API hasn't been used on such architectures, so the impact must be effectively zero.
--- sound/core/compress_offload.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
sound/core/compress_offload.c +11 -0
@@ -44,6 +44,13 @@#include <sound/compress_offload.h> #include <sound/compress_driver.h> +/* struct snd_compr_codec_caps overflows the ioctl bit size for some +* architectures, so we need to disable the relevant ioctls. +*/ +#if _IOC_SIZEBITS <14 +#define COMPR_CODEC_CAPS_OVERFLOW +#endif +/* TODO: * - add substream support for multiple devices in case of * SND_DYNAMIC_MINORS is not used
@@ -438,6 +445,7 @@ out:return retval; } +#ifndef COMPR_CODEC_CAPS_OVERFLOW static int snd_compr_get_codec_caps (struct snd_compr_stream *stream,unsigned long arg) {
@@ -461,6 +469,7 @@ out:kfree (caps);return retval; } +#endif /* !COMPR_CODEC_CAPS_OVERFLOW */ /* revisit this with snd_pcm_preallocate_xxx */ static int snd_compr_allocate_buffer(struct snd_compr_stream *stream,
@@ -799,9 +808,11 @@ static long snd_compr_ioctl(struct filecase _IOC_NR (SNDRV_COMPRESS_GET_CAPS ): retval =snd_compr_get_caps (stream, arg);break ; +#ifndef COMPR_CODEC_CAPS_OVERFLOW case _IOC_NR (SNDRV_COMPRESS_GET_CODEC_CAPS ): retval =snd_compr_get_codec_caps (stream, arg);break ; +#endif case _IOC_NR (SNDRV_COMPRESS_SET_PARAMS ): retval =snd_compr_set_params (stream, arg);break ;
Greg Kroah-Hartman
maintainerPATCH 106/200 ALSA: dummy: Disable switching timer backend via sysfs
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 7ee96216c31aabe1eb42fb91ff50dae9fcd014b2 upstream.
ALSA dummy driver can switch the timer backend between system timer and hrtimer via its hrtimer module option. This can be also switched dynamically via sysfs, but it may lead to a memory corruption when switching is done while a PCM stream is running; the stream instance for the newly switched timer method tries to access the memory that was allocated by another timer method although the sizes differ.
As the simplest fix, this patch just disables the switch via sysfs by dropping the writable bit.
--- sound/drivers/dummy.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/drivers/dummy.c +1 -1
@@ -87,7 +87,7 @@ MODULE_PARM_DESC(pcm_substreams, "PCM sumodule_param (fake_buffer, bool,0444 );MODULE_PARM_DESC (fake_buffer,"Fake buffer allocations." );#ifdef CONFIG_HIGH_RES_TIMERS -module_param (hrtimer, bool,0644 ); +module_param (hrtimer, bool,0444 );MODULE_PARM_DESC (hrtimer,"Use hrtimer as the timer source." );#endif
Greg Kroah-Hartman
maintainerPATCH 107/200 ALSA: seq: Fix incorrect sanity check at snd_seq_oss_synth_cleanup()
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 599151336638d57b98d92338aa59c048e3a3e97d upstream.
ALSA sequencer OSS emulation code has a sanity check for currently opened devices, but there is a thinko there, eventually it spews warnings and skips the operation wrongly like:
WARNING: CPU: 1 PID: 7573 at sound/core/seq/oss/seq_oss_synth.c:311
Fix this off-by-one error.
--- sound/core/seq/oss/seq_oss_synth.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/core/seq/oss/seq_oss_synth.c +1 -1
@@ -308,7 +308,7 @@ snd_seq_oss_synth_cleanup(struct seq_ossstruct seq_oss_synth *rec;struct seq_oss_synthinfo *info; -if (snd_BUG_ON (dp->max_synthdev >=SNDRV_SEQ_OSS_MAX_SYNTH_DEVS )) +if (snd_BUG_ON (dp->max_synthdev >SNDRV_SEQ_OSS_MAX_SYNTH_DEVS ))return ;for (i =0 ; i < dp->max_synthdev; i++) { info = &dp->synths[i];
Greg Kroah-Hartman
maintainerPATCH 108/200 ALSA: seq: Degrade the error message for too many opens
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit da10816e3d923565b470fec78a674baba794ed33 upstream.
ALSA OSS sequencer spews a kernel error message ("ALSA: seq_oss: too many applications") when user-space tries to open more than the limit. This means that it can easily fill the log buffer.
Since it's merely a normal error, it's safe to suppress it via pr_debug() instead.
--- sound/core/seq/oss/seq_oss_init.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/core/seq/oss/seq_oss_init.c +1 -1
@@ -202,7 +202,7 @@ snd_seq_oss_open(struct file *file, int dp->index = i;if (i >=SNDRV_SEQ_OSS_MAX_CLIENTS ) { -pr_err ("ALSA: seq_oss: too many applications\n" ); +pr_debug ("ALSA: seq_oss: too many applications\n" ); rc = -ENOMEM ; goto _error; }
Greg Kroah-Hartman
maintainerPATCH 109/200 ALSA: rawmidi: Make snd_rawmidi_transmit() race-free
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 06ab30034ed9c200a570ab13c017bde248ddb2a6 upstream.
A kernel WARNING in snd_rawmidi_transmit_ack() is triggered by syzkaller fuzzer:
WARNING: CPU: 1 PID: 20739 at sound/core/rawmidi.c:1136 Call Trace: [< inline >] __dump_stack lib/dump_stack.c:15 [<ffffffff82999e2d>] dump_stack+0x6f/0xa2 lib/dump_stack.c:50 [<ffffffff81352089>] warn_slowpath_common+0xd9/0x140 kernel/panic.c:482 [<ffffffff813522b9>] warn_slowpath_null+0x29/0x30 kernel/panic.c:515 [<ffffffff84f80bd5>] snd_rawmidi_transmit_ack+0x275/0x400 sound/core/rawmidi.c:1136 [<ffffffff84fdb3c1>] snd_virmidi_output_trigger+0x4b1/0x5a0 sound/core/seq/seq_virmidi.c:163 [< inline >] snd_rawmidi_output_trigger sound/core/rawmidi.c:150 [<ffffffff84f87ed9>] snd_rawmidi_kernel_write1+0x549/0x780 sound/core/rawmidi.c:1223 [<ffffffff84f89fd3>] snd_rawmidi_write+0x543/0xb30 sound/core/rawmidi.c:1273 [<ffffffff817b0323>] __vfs_write+0x113/0x480 fs/read_write.c:528 [<ffffffff817b1db7>] vfs_write+0x167/0x4a0 fs/read_write.c:577 [< inline >] SYSC_write fs/read_write.c:624 [<ffffffff817b50a1>] SyS_write+0x111/0x220 fs/read_write.c:616 [<ffffffff86336c36>] entry_SYSCALL_64_fastpath+0x16/0x7a arch/x86/entry/entry_64.S:185
Also a similar warning is found but in another path:
Call Trace: [< inline >] __dump_stack lib/dump_stack.c:15 [<ffffffff82be2c0d>] dump_stack+0x6f/0xa2 lib/dump_stack.c:50 [<ffffffff81355139>] warn_slowpath_common+0xd9/0x140 kernel/panic.c:482 [<ffffffff81355369>] warn_slowpath_null+0x29/0x30 kernel/panic.c:515 [<ffffffff8527e69a>] rawmidi_transmit_ack+0x24a/0x3b0 sound/core/rawmidi.c:1133 [<ffffffff8527e851>] snd_rawmidi_transmit_ack+0x51/0x80 sound/core/rawmidi.c:1163 [<ffffffff852d9046>] snd_virmidi_output_trigger+0x2b6/0x570 sound/core/seq/seq_virmidi.c:185 [< inline >] snd_rawmidi_output_trigger sound/core/rawmidi.c:150 [<ffffffff85285a0b>] snd_rawmidi_kernel_write1+0x4bb/0x760 sound/core/rawmidi.c:1252 [<ffffffff85287b73>] snd_rawmidi_write+0x543/0xb30 sound/core/rawmidi.c:1302 [<ffffffff817ba5f3>] __vfs_write+0x113/0x480 fs/read_write.c:528 [<ffffffff817bc087>] vfs_write+0x167/0x4a0 fs/read_write.c:577 [< inline >] SYSC_write fs/read_write.c:624 [<ffffffff817bf371>] SyS_write+0x111/0x220 fs/read_write.c:616 [<ffffffff86660276>] entry_SYSCALL_64_fastpath+0x16/0x7a arch/x86/entry/entry_64.S:185
In the former case, the reason is that virmidi has an open code calling snd_rawmidi_transmit_ack() with the value calculated outside
the spinlock. We may use snd_rawmidi_transmit() in a loop just for
consuming the input data, but even there, there is a race between snd_rawmidi_transmit_peek() and snd_rawmidi_tranmit_ack().
Similarly in the latter case, it calls snd_rawmidi_transmit_peek() and snd_rawmidi_tranmit_ack() separately without protection, so they are racy as well.
The patch tries to address these issues by the following ways:
- Introduce the unlocked versions of snd_rawmidi_transmit_peek() and snd_rawmidi_transmit_ack() to be called inside the explicit lock.
- Rewrite snd_rawmidi_transmit() to be race-free (the former case).
- Make the split calls (the latter case) protected in the rawmidi spin lock.
--- include/sound/rawmidi.h | 4 + sound/core/rawmidi.c | 98 +++++++++++++++++++++++++++++++------------ sound/core/seq/seq_virmidi.c | 17 +++++-- 3 files changed, 88 insertions(+), 31 deletions(-)
include/sound/rawmidi.h +4 -0
@@ -167,6 +167,10 @@ int snd_rawmidi_transmit_peek(struct sndint snd_rawmidi_transmit_ack (struct snd_rawmidi_substream *substream,int count);int snd_rawmidi_transmit (struct snd_rawmidi_substream *substream,unsigned char *buffer,int count); +int __snd_rawmidi_transmit_peek (struct snd_rawmidi_substream *substream, +unsigned char *buffer,int count); +int __snd_rawmidi_transmit_ack (struct snd_rawmidi_substream *substream, +int count);/* main midi functions */
sound/core/rawmidi.c +72 -26
155 lines not on this page · raw message
sound/core/seq/seq_virmidi.c +12 -5
@@ -155,21 +155,26 @@ static void snd_virmidi_output_trigger(sstruct snd_virmidi *vmidi = substream->runtime->private_data;int count, res;unsigned char buf[32 ], *pbuf; +unsigned long flags;if (up) { vmidi->trigger =1 ;if (vmidi->seq_mode ==SNDRV_VIRMIDI_SEQ_DISPATCH && !(vmidi->rdev->flags &SNDRV_VIRMIDI_SUBSCRIBE )) { -snd_rawmidi_transmit_ack (substream, substream->runtime->buffer_size - substream->runtime->avail); -return ;/* ignored */ +while (snd_rawmidi_transmit (substream, buf, +sizeof (buf)) >0 ) { +/* ignored */ + } +return ; }if (vmidi->event.type !=SNDRV_SEQ_EVENT_NONE ) {if (snd_seq_kernel_client_dispatch (vmidi->client, &vmidi->event,in_atomic (),0 ) <0 )return ; vmidi->event.type =SNDRV_SEQ_EVENT_NONE ; } +spin_lock_irqsave (&substream->runtime->lock, flags);while (1 ) { - count =snd_rawmidi_transmit_peek (substream, buf,sizeof (buf)); + count =__snd_rawmidi_transmit_peek (substream, buf,sizeof (buf));if (count <=0 )break ; pbuf = buf;
@@ -179,16 +184,18 @@ static void snd_virmidi_output_trigger(ssnd_midi_event_reset_encode (vmidi->parser);continue ; } -snd_rawmidi_transmit_ack (substream, res); +__snd_rawmidi_transmit_ack (substream, res); pbuf += res; count -= res;if (vmidi->event.type !=SNDRV_SEQ_EVENT_NONE ) {if (snd_seq_kernel_client_dispatch (vmidi->client, &vmidi->event,in_atomic (),0 ) <0 ) -return ; + goto out; vmidi->event.type =SNDRV_SEQ_EVENT_NONE ; } } } + out: +spin_unlock_irqrestore (&substream->runtime->lock, flags); }else { vmidi->trigger =0 ; }
Greg Kroah-Hartman
maintainerPATCH 110/200 ALSA: rawmidi: Remove kernel WARNING for NULL user-space buffer check
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit cc85f7a634cfaf9f0713c6aa06d08817424db37a upstream.
NULL user-space buffer can be passed even in a normal path, thus it's not good to spew a kernel warning with stack trace at each time. Just drop snd_BUG_ON() macro usage there.
--- sound/core/rawmidi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/core/rawmidi.c +1 -1
@@ -1224,7 +1224,7 @@ static long snd_rawmidi_kernel_write1(stlong count1, result;struct snd_rawmidi_runtime *runtime = substream->runtime; -if (snd_BUG_ON (!kernelbuf && !userbuf)) +if (!kernelbuf && !userbuf)return -EINVAL ;if (snd_BUG_ON (!runtime->buffer))return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 111/200 ALSA: rawmidi: Fix race at copying & updating the position
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 81f577542af15640cbcb6ef68baa4caa610cbbfc upstream.
The rawmidi read and write functions manage runtime stream status such as runtime->appl_ptr and runtime->avail. These point where to copy the new data and how many bytes have been copied (or to be read). The problem is that rawmidi read/write call copy_from_user() or copy_to_user(), and the runtime spinlock is temporarily unlocked and relocked while copying user-space. Since the current code advances and updates the runtime status after the spin unlock/relock, the copy and the update may be asynchronous, and eventually runtime->avail might go to a negative value when many concurrent accesses are done. This may lead to memory corruption in the end.
For fixing this race, in this patch, the status update code is performed in the same lock before the temporary unlock. Also, the spinlock is now taken more widely in snd_rawmidi_kernel_read1() for protecting more properly during the whole operation.
--- sound/core/rawmidi.c | 34 ++++++++++++++++++++++------------ 1 file changed, 22 insertions(+), 12 deletions(-)
sound/core/rawmidi.c +22 -12
@@ -942,31 +942,36 @@ static long snd_rawmidi_kernel_read1(strunsigned long flags;long result =0 , count1;struct snd_rawmidi_runtime *runtime = substream->runtime; +unsigned long appl_ptr; +spin_lock_irqsave (&runtime->lock, flags);while (count >0 && runtime->avail) { count1 = runtime->buffer_size - runtime->appl_ptr;if (count1 > count) count1 = count; -spin_lock_irqsave (&runtime->lock, flags);if (count1 > (int )runtime->avail) count1 = runtime->avail; + +/* update runtime->appl_ptr before unlocking for userbuf */ + appl_ptr = runtime->appl_ptr; + runtime->appl_ptr += count1; + runtime->appl_ptr %= runtime->buffer_size; + runtime->avail -= count1; +if (kernelbuf) -memcpy (kernelbuf + result, runtime->buffer + runtime->appl_ptr, count1); +memcpy (kernelbuf + result, runtime->buffer + appl_ptr, count1);if (userbuf) {spin_unlock_irqrestore (&runtime->lock, flags);if (copy_to_user (userbuf + result, - runtime->buffer + runtime->appl_ptr, count1)) { + runtime->buffer + appl_ptr, count1)) {return result >0 ? result : -EFAULT ; }spin_lock_irqsave (&runtime->lock, flags); } - runtime->appl_ptr += count1; - runtime->appl_ptr %= runtime->buffer_size; - runtime->avail -= count1; -spin_unlock_irqrestore (&runtime->lock, flags); result += count1; count -= count1; } +spin_unlock_irqrestore (&runtime->lock, flags);return result; }
@@ -1223,6 +1228,7 @@ static long snd_rawmidi_kernel_write1(stunsigned long flags;long count1, result;struct snd_rawmidi_runtime *runtime = substream->runtime; +unsigned long appl_ptr;if (!kernelbuf && !userbuf)return -EINVAL ;
@@ -1243,12 +1249,19 @@ static long snd_rawmidi_kernel_write1(st count1 = count;if (count1 > (long )runtime->avail) count1 = runtime->avail; + +/* update runtime->appl_ptr before unlocking for userbuf */ + appl_ptr = runtime->appl_ptr; + runtime->appl_ptr += count1; + runtime->appl_ptr %= runtime->buffer_size; + runtime->avail -= count1; +if (kernelbuf) -memcpy (runtime->buffer + runtime->appl_ptr, +memcpy (runtime->buffer + appl_ptr, kernelbuf + result, count1);else if (userbuf) {spin_unlock_irqrestore (&runtime->lock, flags); -if (copy_from_user (runtime->buffer + runtime->appl_ptr, +if (copy_from_user (runtime->buffer + appl_ptr, userbuf + result, count1)) {spin_lock_irqsave (&runtime->lock, flags); result = result >0 ? result : -EFAULT ;
@@ -1256,9 +1269,6 @@ static long snd_rawmidi_kernel_write1(st }spin_lock_irqsave (&runtime->lock, flags); } - runtime->appl_ptr += count1; - runtime->appl_ptr %= runtime->buffer_size; - runtime->avail -= count1; result += count1; count -= count1; }
Greg Kroah-Hartman
maintainerPATCH 113/200 ASoC: dpcm: fix the BE state on hw_free
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vinod Koul <[email protected]>
commit 5e82d2be6ee53275c72e964507518d7964c82753 upstream.
While performing hw_free, DPCM checks the BE state but leaves out the suspend state. The suspend state needs to be checked as well, as we might be suspended and then usermode closes rather than resuming the audio stream.
This was found by a stress testing of system with playback in loop and killed after few seconds running in background and second script running suspend-resume test in loop
--- sound/soc/soc-pcm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
sound/soc/soc-pcm.c +2 -1
@@ -1696,7 +1696,8 @@ int dpcm_be_dai_hw_free(struct snd_soc_p (be->dpcm[stream].state !=SND_SOC_DPCM_STATE_PREPARE ) && (be->dpcm[stream].state !=SND_SOC_DPCM_STATE_HW_FREE ) && (be->dpcm[stream].state !=SND_SOC_DPCM_STATE_PAUSED ) && - (be->dpcm[stream].state != SND_SOC_DPCM_STATE_STOP)) + (be->dpcm[stream].state !=SND_SOC_DPCM_STATE_STOP ) && + (be->dpcm[stream].state != SND_SOC_DPCM_STATE_SUSPEND)) continue; dev_dbg(be->dev, "ASoC: hw_free BE %s\n",
Greg Kroah-Hartman
maintainerPATCH 114/200 ALSA: seq: Fix yet another races among ALSA timer accesses
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 2cdc7b636d55cbcf42e1e6c8accd85e62d3e9ae8 upstream.
ALSA sequencer may open/close and control ALSA timer instance dynamically either via sequencer events or direct ioctls. These are done mostly asynchronously, and it may call still some timer action like snd_timer_start() while another is calling snd_timer_close(). Since the instance gets removed by snd_timer_close(), it may lead to a use-after-free.
This patch tries to address such a race by protecting each snd_timer_*() call via the existing spinlock and also by avoiding the access to timer during close call.
--- sound/core/seq/seq_timer.c | 87 ++++++++++++++++++++++++++++++++++----------- 1 file changed, 67 insertions(+), 20 deletions(-)
sound/core/seq/seq_timer.c +67 -20
@@ -90,6 +90,9 @@ void snd_seq_timer_delete(struct snd_seqvoid snd_seq_timer_defaults (struct snd_seq_timer * tmr) { +unsigned long flags; + +spin_lock_irqsave (&tmr->lock, flags);/* setup defaults */ tmr->ppq =96 ;/* 96 PPQ */ tmr->tempo =500000 ;/* 120 BPM */
@@ -105,21 +108,25 @@ void snd_seq_timer_defaults(struct snd_s tmr->preferred_resolution = seq_default_timer_resolution; tmr->skew = tmr->skew_base =SKEW_BASE ; +spin_unlock_irqrestore (&tmr->lock, flags); } -void snd_seq_timer_reset (struct snd_seq_timer * tmr) +static void seq_timer_reset (struct snd_seq_timer *tmr) { -unsigned long flags; - -spin_lock_irqsave (&tmr->lock, flags); -/* reset time & songposition */ tmr->cur_time.tv_sec =0 ; tmr->cur_time.tv_nsec =0 ; tmr->tick.cur_tick =0 ; tmr->tick.fraction =0 ; +} + +void snd_seq_timer_reset (struct snd_seq_timer *tmr) +{ +unsigned long flags; +spin_lock_irqsave (&tmr->lock, flags); +seq_timer_reset (tmr);spin_unlock_irqrestore (&tmr->lock, flags); }
@@ -138,8 +145,11 @@ static void snd_seq_timer_interrupt(stru tmr = q->timer;if (tmr ==NULL )return ; -if (!tmr->running) +spin_lock_irqsave (&tmr->lock, flags); +if (!tmr->running) { +spin_unlock_irqrestore (&tmr->lock, flags);return ; + } resolution *= ticks;if (tmr->skew != tmr->skew_base) {
@@ -148,8 +158,6 @@ static void snd_seq_timer_interrupt(stru (((resolution &0xffff ) * tmr->skew) >>16 ); } -spin_lock_irqsave (&tmr->lock, flags); -/* update timer */ snd_seq_inc_time_nsec (&tmr->cur_time, resolution);
@@ -296,26 +304,30 @@ int snd_seq_timer_open(struct snd_seq_qu t->callback = snd_seq_timer_interrupt; t->callback_data = q; t->flags |=SNDRV_TIMER_IFLG_AUTO ; +spin_lock_irq (&tmr->lock); tmr->timeri = t; +spin_unlock_irq (&tmr->lock);return 0 ; }int snd_seq_timer_close (struct snd_seq_queue *q) {struct snd_seq_timer *tmr; +struct snd_timer_instance *t; tmr = q->timer;if (snd_BUG_ON (!tmr))return -EINVAL ; -if (tmr->timeri) { -snd_timer_stop (tmr->timeri); -snd_timer_close (tmr->timeri); - tmr->timeri =NULL ; - } +spin_lock_irq (&tmr->lock); + t = tmr->timeri; + tmr->timeri =NULL ; +spin_unlock_irq (&tmr->lock); +if (t) +snd_timer_close (t);return 0 ; } -int snd_seq_timer_stop (struct snd_seq_timer * tmr) +static int seq_timer_stop (struct snd_seq_timer *tmr) {if (! tmr->timeri)return -EINVAL ;
@@ -326,6 +338,17 @@ int snd_seq_timer_stop(struct snd_seq_tireturn 0 ; } +int snd_seq_timer_stop (struct snd_seq_timer *tmr) +{ +unsigned long flags; +int err; + +spin_lock_irqsave (&tmr->lock, flags); + err =seq_timer_stop (tmr); +spin_unlock_irqrestore (&tmr->lock, flags); +return err; +} +static int initialize_timer (struct snd_seq_timer *tmr) {struct snd_timer *t;
@@ -358,13 +381,13 @@ static int initialize_timer(struct snd_sreturn 0 ; } -int snd_seq_timer_start (struct snd_seq_timer * tmr) +static int seq_timer_start (struct snd_seq_timer *tmr) {if (! tmr->timeri)return -EINVAL ;if (tmr->running) -snd_seq_timer_stop (tmr); -snd_seq_timer_reset (tmr); +seq_timer_stop (tmr); +seq_timer_reset (tmr);if (initialize_timer (tmr) <0 )return -EINVAL ;snd_timer_start (tmr->timeri, tmr->ticks);
@@ -373,14 +396,25 @@ int snd_seq_timer_start(struct snd_seq_treturn 0 ; } -int snd_seq_timer_continue (struct snd_seq_timer * tmr) +int snd_seq_timer_start (struct snd_seq_timer *tmr) +{ +unsigned long flags; +int err; + +spin_lock_irqsave (&tmr->lock, flags); + err =seq_timer_start (tmr); +spin_unlock_irqrestore (&tmr->lock, flags); +return err; +} + +static int seq_timer_continue (struct snd_seq_timer *tmr) {if (! tmr->timeri)return -EINVAL ;if (tmr->running)return -EBUSY ;if (! tmr->initialized) { -snd_seq_timer_reset (tmr); +seq_timer_reset (tmr);if (initialize_timer (tmr) <0 )return -EINVAL ; }
@@ -390,11 +424,24 @@ int snd_seq_timer_continue(struct snd_sereturn 0 ; } +int snd_seq_timer_continue (struct snd_seq_timer *tmr) +{ +unsigned long flags; +int err; + +spin_lock_irqsave (&tmr->lock, flags); + err =seq_timer_continue (tmr); +spin_unlock_irqrestore (&tmr->lock, flags); +return err; +} +/* return current 'real' time. use timeofday() to get better granularity. */ snd_seq_real_time_t snd_seq_timer_get_cur_time (struct snd_seq_timer *tmr) {snd_seq_real_time_t cur_time; +unsigned long flags; +spin_lock_irqsave (&tmr->lock, flags); cur_time = tmr->cur_time;if (tmr->running) {struct timeval tm;
@@ -410,7 +457,7 @@ snd_seq_real_time_t snd_seq_timer_get_cu }snd_seq_sanity_real_time (&cur_time); } - +spin_unlock_irqrestore (&tmr->lock, flags);return cur_time; }
Greg Kroah-Hartman
maintainerPATCH 116/200 ALSA: seq: Fix lockdep warnings due to double mutex locks
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 7f0973e973cd74aa40747c9d38844560cd184ee8 upstream.
The port subscription code uses double mutex locks for source and destination ports, and this may become racy once when wrongly set up. It leads to lockdep warning splat, typically triggered by fuzzer like syzkaller, although the actual deadlock hasn't been seen, so far.
This patch simplifies the handling by reducing to two single locks, so that no lockdep warning will be trigger any longer.
By splitting to two actions, a still-in-progress element shall be added in one list while handling another. For ignoring this element, a new check is added in deliver_to_subscribers().
Along with it, the code to add/remove the subscribers list element was cleaned up and refactored.
--- sound/core/seq/seq_clientmgr.c | 3 sound/core/seq/seq_ports.c | 235 ++++++++++++++++++++++------------------- 2 files changed, 134 insertions(+), 104 deletions(-)
sound/core/seq/seq_clientmgr.c +3 -0
@@ -678,6 +678,9 @@ static int deliver_to_subscribers(structelse down_read (&grp->list_mutex);list_for_each_entry (subs, &grp->list_head, src_list) { +/* both ports ready? */ +if (atomic_read (&subs->ref_count) !=2 ) +continue ; event->dest = subs->info.dest;if (subs->info.flags &SNDRV_SEQ_PORT_SUBS_TIMESTAMP )/* convert time according to flag with subscription */
sound/core/seq/seq_ports.c +131 -104
320 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 117/200 ALSA: timer: Code cleanup
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit c3b1681375dc6e71d89a3ae00cc3ce9e775a8917 upstream.
This is a minor code cleanup without any functional changes:
- Kill keep_flag argument from _snd_timer_stop(), as all callers pass only it false.
- Remove redundant NULL check in _snd_timer_stop().
--- sound/core/timer.c | 28 +++++++++++----------------- 1 file changed, 11 insertions(+), 17 deletions(-)
sound/core/timer.c +11 -17
@@ -305,8 +305,7 @@ int snd_timer_open(struct snd_timer_instreturn 0 ; } -static int _snd_timer_stop (struct snd_timer_instance *timeri, -int keep_flag,int event); +static int _snd_timer_stop (struct snd_timer_instance *timeri,int event);/* * close a timer instance
@@ -348,7 +347,7 @@ int snd_timer_close(struct snd_timer_insspin_unlock_irq (&timer->lock);mutex_lock (®ister_mutex);list_del (&timeri->open_list); -if (timer &&list_empty (&timer->open_list_head) && +if (list_empty (&timer->open_list_head) && timer->hw.close) timer->hw.close (timer);/* remove slave links */
@@ -493,8 +492,7 @@ int snd_timer_start(struct snd_timer_insreturn result; } -static int _snd_timer_stop (struct snd_timer_instance * timeri, -int keep_flag,int event) +static int _snd_timer_stop (struct snd_timer_instance *timeri,int event) {struct snd_timer *timer;unsigned long flags;
@@ -503,13 +501,11 @@ static int _snd_timer_stop(struct snd_tireturn -ENXIO ;if (timeri->flags &SNDRV_TIMER_IFLG_SLAVE ) { -if (!keep_flag) { -spin_lock_irqsave (&slave_active_lock, flags); - timeri->flags &= ~SNDRV_TIMER_IFLG_RUNNING ; -list_del_init (&timeri->ack_list); -list_del_init (&timeri->active_list); -spin_unlock_irqrestore (&slave_active_lock, flags); - } +spin_lock_irqsave (&slave_active_lock, flags); + timeri->flags &= ~SNDRV_TIMER_IFLG_RUNNING ; +list_del_init (&timeri->ack_list); +list_del_init (&timeri->active_list); +spin_unlock_irqrestore (&slave_active_lock, flags); goto __end; } timer = timeri->timer;
@@ -534,9 +530,7 @@ static int _snd_timer_stop(struct snd_ti } } } -if (!keep_flag) - timeri->flags &= - ~(SNDRV_TIMER_IFLG_RUNNING |SNDRV_TIMER_IFLG_START ); + timeri->flags &= ~(SNDRV_TIMER_IFLG_RUNNING |SNDRV_TIMER_IFLG_START );spin_unlock_irqrestore (&timer->lock, flags); __end:if (event !=SNDRV_TIMER_EVENT_RESOLUTION )
@@ -555,7 +549,7 @@ int snd_timer_stop(struct snd_timer_instunsigned long flags;int err; - err =_snd_timer_stop (timeri,0 ,SNDRV_TIMER_EVENT_STOP ); + err =_snd_timer_stop (timeri,SNDRV_TIMER_EVENT_STOP );if (err <0 )return err; timer = timeri->timer;
@@ -601,7 +595,7 @@ int snd_timer_continue(struct snd_timer_*/ int snd_timer_pause (struct snd_timer_instance * timeri) { -return _snd_timer_stop (timeri,0 ,SNDRV_TIMER_EVENT_PAUSE ); +return _snd_timer_stop (timeri,SNDRV_TIMER_EVENT_PAUSE ); }/*
Greg Kroah-Hartman
maintainerPATCH 118/200 ALSA: timer: Fix leftover link at closing
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 094fd3be87b0f102589e2d5c3fa5d06b7e20496d upstream.
In ALSA timer core, the active timer instance is managed in active_list linked list. Each element is added / removed dynamically at timer start, stop and in timer interrupt. The problem is that snd_timer_interrupt() has a thinko and leaves the element in active_list when it's the last opened element. This eventually leads to list corruption or use-after-free error.
This hasn't been revealed because we used to delete the list forcibly in snd_timer_stop() in the past. However, the recent fix avoids the double-stop behavior (in commit [f784beb75ce8: ALSA: timer: Fix link corruption due to double start or stop]), and this leak hits reality.
This patch fixes the link management in snd_timer_interrupt(). Now it simply unlinks no matter which stream is.
--- sound/core/timer.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/core/timer.c +2 -2
@@ -718,8 +718,8 @@ void snd_timer_interrupt(struct snd_time ti->cticks = ti->ticks; }else { ti->flags &= ~SNDRV_TIMER_IFLG_RUNNING ; -if (--timer->running) -list_del_init (&ti->active_list); + --timer->running; +list_del_init (&ti->active_list); }if ((timer->hw.flags &SNDRV_TIMER_HW_TASKLET ) || (ti->flags &SNDRV_TIMER_IFLG_FAST ))
Greg Kroah-Hartman
maintainerPATCH 120/200 ALSA: timer: Fix race at concurrent reads
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 4dff5c7b7093b19c19d3a100f8a3ad87cb7cd9e7 upstream.
snd_timer_user_read() has a potential race among parallel reads, as qhead and qused are updated outside the critical section due to copy_to_user() calls. Move them into the critical section, and also sanitize the relevant code a bit.
--- sound/core/timer.c | 34 +++++++++++++++------------------- 1 file changed, 15 insertions(+), 19 deletions(-)
sound/core/timer.c +15 -19
@@ -1920,6 +1920,7 @@ static ssize_t snd_timer_user_read(struc {struct snd_timer_user *tu;long result =0 , unit; +int qhead;int err =0 ; tu = file->private_data;
@@ -1931,7 +1932,7 @@ static ssize_t snd_timer_user_read(strucif ((file->f_flags &O_NONBLOCK ) !=0 || result >0 ) { err = -EAGAIN ; -break ; + goto _error; }set_current_state (TASK_INTERRUPTIBLE );
@@ -1946,42 +1947,37 @@ static ssize_t snd_timer_user_read(strucif (tu->disconnected) { err = -ENODEV ; -break ; + goto _error; }if (signal_pending (current)) { err = -ERESTARTSYS ; -break ; + goto _error; } } + qhead = tu->qhead++; + tu->qhead %= tu->queue_size;spin_unlock_irq (&tu->qlock); -if (err <0 ) - goto _error;if (tu->tread) { -if (copy_to_user (buffer, &tu->tqueue[tu->qhead++], -sizeof (struct snd_timer_tread ))) { +if (copy_to_user (buffer, &tu->tqueue[qhead], +sizeof (struct snd_timer_tread ))) err = -EFAULT ; - goto _error; - } }else { -if (copy_to_user (buffer, &tu->queue[tu->qhead++], -sizeof (struct snd_timer_read ))) { +if (copy_to_user (buffer, &tu->queue[qhead], +sizeof (struct snd_timer_read ))) err = -EFAULT ; - goto _error; - } } - tu->qhead %= tu->queue_size; - - result += unit; - buffer += unit; -spin_lock_irq (&tu->qlock); tu->qused--; +if (err <0 ) + goto _error; + result += unit; + buffer += unit; } -spin_unlock_irq (&tu->qlock); _error: +spin_unlock_irq (&tu->qlock);return result >0 ? result : err; }
Greg Kroah-Hartman
maintainerPATCH 121/200 ALSA: timer: Fix wrong instance passed to slave callbacks
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 117159f0b9d392fb433a7871426fad50317f06f7 upstream.
In snd_timer_notify1(), the wrong timer instance was passed for slave ccallback function. This leads to the access to the wrong data when an incompatible master is handled (e.g. the master is the sequencer timer and the slave is a user timer), as spotted by syzkaller fuzzer.
This patch fixes that wrong assignment.
--- sound/core/timer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/core/timer.c +1 -1
@@ -422,7 +422,7 @@ static void snd_timer_notify1(struct sndspin_lock_irqsave (&timer->lock, flags);list_for_each_entry (ts, &ti->slave_active_head, active_list)if (ts->ccallback) - ts->ccallback (ti, event +100 , &tstamp, resolution); + ts->ccallback (ts, event +100 , &tstamp, resolution);spin_unlock_irqrestore (&timer->lock, flags); }
Greg Kroah-Hartman
maintainerPATCH 122/200 ALSA: timer: Fix race between stop and interrupt
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit ed8b1d6d2c741ab26d60d499d7fbb7ac801f0f51 upstream.
A slave timer element also unlinks at snd_timer_stop() but it takes only slave_active_lock. When a slave is assigned to a master, however, this may become a race against the master's interrupt handling, eventually resulting in a list corruption. The actual bug could be seen with a syzkaller fuzzer test case in BugLink below.
As a fix, we need to take timeri->timer->lock when timer isn't NULL, i.e. assigned to a master, while the assignment to a master itself is protected by slave_active_lock.
--- sound/core/timer.c | 4 ++++ 1 file changed, 4 insertions(+)
sound/core/timer.c +4 -0
@@ -518,9 +518,13 @@ static int _snd_timer_stop(struct snd_tispin_unlock_irqrestore (&slave_active_lock, flags);return -EBUSY ; } +if (timeri->timer) +spin_lock (&timeri->timer->lock); timeri->flags &= ~SNDRV_TIMER_IFLG_RUNNING ;list_del_init (&timeri->ack_list);list_del_init (&timeri->active_list); +if (timeri->timer) +spin_unlock (&timeri->timer->lock);spin_unlock_irqrestore (&slave_active_lock, flags); goto __end; }
Greg Kroah-Hartman
maintainerPATCH 123/200 ALSA: hda - Add fixup for Mac Mini 7,1 model
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 2154cc0e2d4ae15132d005d17e473327c70c9a06 upstream.
Mac Mini 7,1 model with CS4208 codec reports the headphone jack detection wrongly in an inverted way. Moreover, the advertised pins for the audio input and SPDIF output have actually no jack detection.
This patch addresses these issues. The inv_jack_detect flag is set for fixing the headphone jack detection, and the pin configs for audio input and SPDIF output are marked as non-detectable.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=105161
--- sound/pci/hda/patch_cirrus.c | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+)
sound/pci/hda/patch_cirrus.c +27 -0
@@ -613,6 +613,7 @@ enum {CS4208_MAC_AUTO ,CS4208_MBA6 ,CS4208_MBP11 , +CS4208_MACMINI , CS4208_GPIO0, };
@@ -620,6 +621,7 @@ static const struct hda_model_fixup cs42 { .id = CS4208_GPIO0, .name = "gpio0" }, { .id = CS4208_MBA6, .name = "mba6" }, { .id = CS4208_MBP11, .name = "mbp11" }, + { .id = CS4208_MACMINI, .name = "macmini" }, {} };
@@ -631,6 +633,7 @@ static const struct snd_pci_quirk cs4208/* codec SSID matching */ static const struct snd_pci_quirk cs4208_mac_fixup_tbl[] = {SND_PCI_QUIRK (0x106b ,0x5e00 ,"MacBookPro 11,2" ,CS4208_MBP11 ), +SND_PCI_QUIRK (0x106b ,0x6c00 ,"MacMini 7,1" ,CS4208_MACMINI ),SND_PCI_QUIRK (0x106b ,0x7100 ,"MacBookAir 6,1" ,CS4208_MBA6 ),SND_PCI_QUIRK (0x106b ,0x7200 ,"MacBookAir 6,2" ,CS4208_MBA6 ),SND_PCI_QUIRK (0x106b ,0x7b00 ,"MacBookPro 12,1" ,CS4208_MBP11 ),
@@ -665,6 +668,24 @@ static void cs4208_fixup_mac(struct hda_snd_hda_apply_fixup (codec, action); } +/* MacMini 7,1 has the inverted jack detection */ +static void cs4208_fixup_macmini (struct hda_codec *codec, +const struct hda_fixup *fix,int action) +{ +static const struct hda_pintbl pincfgs[] = { + {0x18 ,0x00ab9150 },/* mic (audio-in) jack: disable detect */ + {0x21 ,0x004be140 },/* SPDIF: disable detect */ + { } + }; + +if (action ==HDA_FIXUP_ACT_PRE_PROBE ) { +/* HP pin (0x10) has an inverted detection */ + codec->inv_jack_detect =1 ; +/* disable the bogus Mic and SPDIF jack detections */ +snd_hda_apply_pincfgs (codec, pincfgs); + } +} +static int cs4208_spdif_sw_put (struct snd_kcontrol *kcontrol,struct snd_ctl_elem_value *ucontrol) {
@@ -708,6 +729,12 @@ static const struct hda_fixup cs4208_fix .chained = true, .chain_id = CS4208_GPIO0, }, + [CS4208_MACMINI] = { + .type = HDA_FIXUP_FUNC, + .v.func = cs4208_fixup_macmini, + .chained = true, + .chain_id = CS4208_GPIO0, + }, [CS4208_GPIO0] = { .type = HDA_FIXUP_FUNC, .v.func = cs4208_fixup_gpio0,
Greg Kroah-Hartman
maintainerPATCH 125/200 Revert "ALSA: hda - Fix noise on Gigabyte Z170X mobo"
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 6c361d10e0eb859233c71954abcd20d2d8700587 upstream.
This reverts commit 0c25ad80408e95e0a4fbaf0056950206e95f726f.
The original commit disabled the aamixer path due to the noise problem, but it turned out that some mobo with the same PCI SSID doesn't suffer from the issue, and the disabled function (analog loopback) is still demanded by users.
Since the recent commit [e7fdd52779a6: ALSA: hda - Implement loopback control switch for Realtek and other codecs], we have the dynamic mixer switch to enable/disable the aamix path, and we don't have to disable the path statically any longer. So, let's revert the disablement, so that only the user suffering from the noise problem can turn off the aamix on the fly.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=108301
--- sound/pci/hda/patch_realtek.c | 8 -------- 1 file changed, 8 deletions(-)
sound/pci/hda/patch_realtek.c +0 -8
@@ -1795,7 +1795,6 @@ enum {ALC882_FIXUP_NO_PRIMARY_HP ,ALC887_FIXUP_ASUS_BASS , ALC887_FIXUP_BASS_CHMAP, - ALC882_FIXUP_DISABLE_AAMIX, }; static void alc889_fixup_coef(struct hda_codec *codec,
@@ -1957,8 +1956,6 @@ static void alc882_fixup_no_primary_hp(sstatic void alc_fixup_bass_chmap (struct hda_codec *codec,const struct hda_fixup *fix,int action); -static void alc_fixup_disable_aamix (struct hda_codec *codec, -const struct hda_fixup *fix,int action);static const struct hda_fixup alc882_fixups[] = { [ALC882_FIXUP_ABIT_AW9D_MAX ] = {
@@ -2196,10 +2193,6 @@ static const struct hda_fixup alc882_fix .type = HDA_FIXUP_FUNC, .v.func = alc_fixup_bass_chmap, }, - [ALC882_FIXUP_DISABLE_AAMIX] = { - .type = HDA_FIXUP_FUNC, - .v.func = alc_fixup_disable_aamix, - }, }; static const struct snd_pci_quirk alc882_fixup_tbl[] = {
@@ -2267,7 +2260,6 @@ static const struct snd_pci_quirk alc882SND_PCI_QUIRK (0x1462 ,0x7350 ,"MSI-7350" ,ALC889_FIXUP_CD ),SND_PCI_QUIRK_VENDOR (0x1462 ,"MSI" ,ALC882_FIXUP_GPIO3 ),SND_PCI_QUIRK (0x1458 ,0xa002 ,"Gigabyte EP45-DS3/Z87X-UD3H" ,ALC889_FIXUP_FRONT_HP_NO_PRESENCE ), -SND_PCI_QUIRK (0x1458 ,0xa182 ,"Gigabyte Z170X-UD3" ,ALC882_FIXUP_DISABLE_AAMIX ),SND_PCI_QUIRK (0x147b ,0x107a ,"Abit AW9D-MAX" ,ALC882_FIXUP_ABIT_AW9D_MAX ),SND_PCI_QUIRK_VENDOR (0x1558 ,"Clevo laptop" ,ALC882_FIXUP_EAPD ), SND_PCI_QUIRK(0x161f, 0x2054, "Medion laptop", ALC883_FIXUP_EAPD),
Greg Kroah-Hartman
maintainerPATCH 126/200 ALSA: hda - Fix speaker output from VAIO AiO machines
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit c44d9b1181cf34e0860c72cc8a00e0c47417aac0 upstream.
Some Sony VAIO AiO models (VGC-JS4EF and VGC-JS25G, both with PCI SSID 104d:9044) need the same quirk to make the speaker working properly.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=112031
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -2231,6 +2231,7 @@ static const struct snd_pci_quirk alc882SND_PCI_QUIRK (0x104d ,0x9047 ,"Sony Vaio TT" ,ALC889_FIXUP_VAIO_TT ),SND_PCI_QUIRK (0x104d ,0x905a ,"Sony Vaio Z" ,ALC882_FIXUP_NO_PRIMARY_HP ),SND_PCI_QUIRK (0x104d ,0x9043 ,"Sony Vaio VGC-LN51JGB" ,ALC882_FIXUP_NO_PRIMARY_HP ), +SND_PCI_QUIRK (0x104d ,0x9044 ,"Sony VAIO AiO" ,ALC882_FIXUP_NO_PRIMARY_HP ),/* All Apple entries are in codec SSIDs */ SND_PCI_QUIRK(0x106b, 0x00a0, "MacBookPro 3,1", ALC889_FIXUP_MBP_VREF),
Greg Kroah-Hartman
maintainerPATCH 127/200 ALSA: hda - Fix bad dereference of jack object
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 2ebab40eb74a0225d5dfba72bfae317dd948fa2d upstream.
The hda_jack_tbl entries are managed by snd_array for allowing multiple jacks. It's good per se, but the problem is that struct hda_jack_callback keeps the hda_jack_tbl pointer. Since snd_array doesn't preserve each pointer at resizing the array, we can't keep the original pointer but have to deduce the pointer at each time via snd_array_entry() instead. Actually, this resulted in the deference to the wrong pointer on codecs that have many pins such as CS4208.
This patch replaces the pointer to the NID value as the search key. As an unexpected good side effect, this even simplifies the code, as only NID is needed in most cases.
--- sound/pci/hda/hda_generic.c | 4 ++-- sound/pci/hda/hda_jack.c | 2 +- sound/pci/hda/hda_jack.h | 2 +- sound/pci/hda/patch_ca0132.c | 5 ++++- sound/pci/hda/patch_hdmi.c | 2 +- sound/pci/hda/patch_realtek.c | 2 +- sound/pci/hda/patch_sigmatel.c | 6 +++--- 7 files changed, 13 insertions(+), 10 deletions(-)
sound/pci/hda/hda_generic.c +2 -2
@@ -4045,9 +4045,9 @@ static void pin_power_callback(struct hd struct hda_jack_callback *jack, bool on) { -if (jack && jack->tbl->nid) +if (jack && jack->nid)sync_power_state_change (codec, -set_pin_power_jack (codec, jack->tbl->nid, on)); +set_pin_power_jack (codec, jack->nid, on)); }/* callback only doing power up -- called at first */
sound/pci/hda/hda_jack.c +1 -1
@@ -259,7 +259,7 @@ snd_hda_jack_detect_enable_callback(struif (!callback)return ERR_PTR (-ENOMEM ); callback->func = func; - callback->tbl = jack; + callback->nid = jack->nid; callback->next = jack->callback; jack->callback = callback; }
sound/pci/hda/hda_jack.h +1 -1
@@ -21,7 +21,7 @@ struct hda_jack_callback;typedef void (*hda_jack_callback_fn ) (struct hda_codec *,struct hda_jack_callback *);struct hda_jack_callback { -struct hda_jack_tbl *tbl; +hda_nid_t nid;hda_jack_callback_fn func;unsigned int private_data;/* arbitrary data */ struct hda_jack_callback *next;
sound/pci/hda/patch_ca0132.c +4 -1
@@ -4427,13 +4427,16 @@ static void ca0132_process_dsp_response(static void hp_callback (struct hda_codec *codec,struct hda_jack_callback *cb) {struct ca0132_spec *spec = codec->spec; +struct hda_jack_tbl *tbl;/* Delay enabling the HP amp, to let the mic-detection * state machine run. */ cancel_delayed_work_sync (&spec->unsol_hp_work);schedule_delayed_work (&spec->unsol_hp_work,msecs_to_jiffies (500 )); - cb->tbl->block_report =1 ; + tbl =snd_hda_jack_tbl_get (codec, cb->nid); +if (tbl) + tbl->block_report =1 ; }static void amic_callback (struct hda_codec *codec,struct hda_jack_callback *cb)
sound/pci/hda/patch_hdmi.c +1 -1
@@ -1184,7 +1184,7 @@ static void check_presence_and_report(ststatic void jack_callback (struct hda_codec *codec,struct hda_jack_callback *jack) { -check_presence_and_report (codec, jack->tbl->nid); +check_presence_and_report (codec, jack->nid); }static void hdmi_intrinsic_event (struct hda_codec *codec,unsigned int res)
sound/pci/hda/patch_realtek.c +1 -1
@@ -282,7 +282,7 @@ static void alc_update_knob_master(struc uctl =kzalloc (sizeof (*uctl),GFP_KERNEL );if (!uctl)return ; - val =snd_hda_codec_read (codec, jack->tbl->nid,0 , + val =snd_hda_codec_read (codec, jack->nid,0 ,AC_VERB_GET_VOLUME_KNOB_CONTROL ,0 ); val &=HDA_AMP_VOLMASK ; uctl->value.integer.value[0 ] = val;
sound/pci/hda/patch_sigmatel.c +3 -3
@@ -493,9 +493,9 @@ static void jack_update_power(struct hdaif (!spec->num_pwrs)return ; -if (jack && jack->tbl->nid) { -stac_toggle_power_map (codec, jack->tbl->nid, -snd_hda_jack_detect (codec, jack->tbl->nid), +if (jack && jack->nid) { +stac_toggle_power_map (codec, jack->nid, +snd_hda_jack_detect (codec, jack->nid), true);return ; }
Greg Kroah-Hartman
maintainerPATCH 129/200 saa7134-alsa: Only frees registered sound cards
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mauro Carvalho Chehab <[email protected]>
commit ac75fe5d8fe4a0bf063be18fb29684405279e79e upstream.
That prevents this bug:
[ 2382.269496] BUG: unable to handle kernel NULL pointer dereference at 0000000000000540 [ 2382.270013] IP: [<ffffffffa01fe616>] snd_card_free+0x36/0x70 [snd] [ 2382.270013] PGD 0 [ 2382.270013] Oops: 0002 [#1] SMP [ 2382.270013] Modules linked in: saa7134_alsa(-) tda1004x saa7134_dvb videobuf2_dvb dvb_core tda827x tda8290 tuner saa7134 tveeprom videobuf2_dma_sg videobuf2_memops videobuf2_v4l2 videobuf2_core v4l2_common videodev media auth_rpcgss nfsv4 dns_resolver nfs lockd grace sunrpc tun bridge stp llc ebtables ip6table_filter ip6_tables nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack it87 hwmon_vid snd_hda_codec_idt snd_hda_codec_generic iTCO_wdt iTCO_vendor_support snd_hda_intel snd_hda_codec snd_hwdep snd_hda_core snd_seq pcspkr i2c_i801 snd_seq_device snd_pcm snd_timer lpc_ich snd mfd_core soundcore binfmt_misc i915 video i2c_algo_bit drm_kms_helper drm r8169 ata_generic serio_raw pata_acpi mii i2c_core [last unloaded: videobuf2_memops] [ 2382.270013] CPU: 0 PID: 4899 Comm: rmmod Not tainted 4.5.0-rc1+ #4 [ 2382.270013] Hardware name: PCCHIPS P17G/P17G, BIOS 080012 05/14/2008 [ 2382.270013] task: ffff880039c38000 ti: ffff88003c764000 task.ti: ffff88003c764000 [ 2382.270013] RIP: 0010:[<ffffffffa01fe616>] [<ffffffffa01fe616>] snd_card_free+0x36/0x70 [snd] [ 2382.270013] RSP: 0018:ffff88003c767ea0 EFLAGS: 00010286 [ 2382.270013] RAX: ffff88003c767eb8 RBX: 0000000000000000 RCX: 0000000000006260 [ 2382.270013] RDX: ffffffffa020a060 RSI: ffffffffa0206de1 RDI: ffff88003c767eb0 [ 2382.270013] RBP: ffff88003c767ed8 R08: 0000000000019960 R09: ffffffff811a5412 [ 2382.270013] R10: ffffea0000d7c200 R11: 0000000000000000 R12: ffff88003c767ea8 [ 2382.270013] R13: 00007ffe760617f7 R14: 0000000000000000 R15: 0000557625d7f1e0 [ 2382.270013] FS: 00007f80bb1c0700(0000) GS:ffff88003f400000(0000) knlGS:0000000000000000 [ 2382.270013] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b [ 2382.270013] CR2: 0000000000000540 CR3: 000000003c00f000 CR4: 00000000000006f0 [ 2382.270013] Stack: [ 2382.270013] 000000003c767ed8 ffffffff00000000 ffff880000000000 ffff88003c767eb8 [ 2382.270013] ffff88003c767eb8 ffffffffa049a890 00007ffe76060060 ffff88003c767ef0 [ 2382.270013] ffffffffa049889d ffffffffa049a500 ffff88003c767f48 ffffffff8111079c [ 2382.270013] Call Trace: [ 2382.270013] [<ffffffffa049889d>] saa7134_alsa_exit+0x1d/0x780 [saa7134_alsa] [ 2382.270013] [<ffffffff8111079c>] SyS_delete_module+0x19c/0x1f0 [ 2382.270013] [<ffffffff8170fc2e>] entry_SYSCALL_64_fastpath+0x12/0x71 [ 2382.270013] Code: 20 a0 48 c7 c6 e1 6d 20 a0 48 89 e5 41 54 53 4c 8d 65 d0 48 89 fb 48 83 ec 28 c7 45 d0 00 00 00 00 49 8d 7c 24 08 e8 7a 55 ed e0 <4c> 89 a3 40 05 00 00 48 89 df e8 eb fd ff ff 85 c0 75 1a 48 8d [ 2382.270013] RIP [<ffffffffa01fe616>] snd_card_free+0x36/0x70 [snd] [ 2382.270013] RSP <ffff88003c767ea0> [ 2382.270013] CR2: 0000000000000540
--- drivers/media/pci/saa7134/saa7134-alsa.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/media/pci/saa7134/saa7134-alsa.c +4 -1
@@ -1211,6 +1211,8 @@ static int alsa_device_init(struct saa71static int alsa_device_exit (struct saa7134_dev *dev) { +if (!snd_saa7134_cards[dev->nr]) +return 1 ;snd_card_free (snd_saa7134_cards[dev->nr]); snd_saa7134_cards[dev->nr] =NULL ;
@@ -1260,7 +1262,8 @@ static void saa7134_alsa_exit(void)int idx;for (idx =0 ; idx <SNDRV_CARDS ; idx++) { -snd_card_free (snd_saa7134_cards[idx]); +if (snd_saa7134_cards[idx]) +snd_card_free (snd_saa7134_cards[idx]); } saa7134_dmasound_init =NULL ;
Greg Kroah-Hartman
maintainerPATCH 132/200 USB: visor: fix null-deref at probe
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit cac9b50b0d75a1d50d6c056ff65c005f3224c8e0 upstream.
Fix null-pointer dereference at probe should a (malicious) Treo device lack the expected endpoints.
Specifically, the Treo port-setup hack was dereferencing the bulk-in and interrupt-in urbs without first making sure they had been allocated by core.
--- drivers/usb/serial/visor.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/usb/serial/visor.c +5 -0
@@ -544,6 +544,11 @@ static int treo_attach(struct usb_serial (serial->num_interrupt_in == 0))return 0 ; +if (serial->num_bulk_in <2 || serial->num_interrupt_in <2 ) { +dev_err (&serial->interface->dev,"missing endpoints\n" ); +return -ENODEV ; + } +/* * It appears that Treos and Kyoceras want to use the * 1st bulk in endpoint to communicate with the 2nd bulk out endpoint,
Greg Kroah-Hartman
maintainerPATCH 133/200 usb: hub: do not clear BOS field during reset device
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Du, Changbin <[email protected]>
commit d8f00cd685f5c8e0def8593e520a7fef12c22407 upstream.
In function usb_reset_and_verify_device, the old BOS descriptor may still be used before allocating a new one. (usb_unlocked_disable_lpm function uses it under the situation that it fails to disable lpm.) So we cannot set the udev->bos to NULL before that, just keep what it was. It will be overwrite when allocating a new one.
Crash log:
BUG: unable to handle kernel NULL pointer dereference at 0000000000000010 IP: [<ffffffff8171f98d>] usb_enable_link_state+0x2d/0x2f0 Call Trace: [<ffffffff8171ed5b>] ? usb_set_lpm_timeout+0x12b/0x140 [<ffffffff8171fcd1>] usb_enable_lpm+0x81/0xa0 [<ffffffff8171fdd8>] usb_disable_lpm+0xa8/0xc0 [<ffffffff8171fe1c>] usb_unlocked_disable_lpm+0x2c/0x50 [<ffffffff81723933>] usb_reset_and_verify_device+0xc3/0x710 [<ffffffff8172c4ed>] ? usb_sg_wait+0x13d/0x190 [<ffffffff81724743>] usb_reset_device+0x133/0x280 [<ffffffff8179ccd1>] usb_stor_port_reset+0x61/0x70 [<ffffffff8179cd68>] usb_stor_invoke_transport+0x88/0x520
--- drivers/usb/core/hub.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/usb/core/hub.c +5 -3
@@ -5377,7 +5377,6 @@ static int usb_reset_and_verify_device(s } bos = udev->bos; - udev->bos =NULL ;for (i =0 ; i <SET_CONFIG_TRIES ; ++i) {
@@ -5470,8 +5469,11 @@ done:usb_set_usb2_hardware_lpm (udev,1 );usb_unlocked_enable_lpm (udev);usb_enable_ltm (udev); -usb_release_bos_descriptor (udev); - udev->bos = bos; +/* release the new BOS descriptor allocated by hub_port_init() */ +if (udev->bos != bos) { +usb_release_bos_descriptor (udev); + udev->bos = bos; + }return 0 ; re_enumerate:
Greg Kroah-Hartman
maintainerPATCH 134/200 USB: serial: ftdi_sio: add support for Yaesu SCU-18 cable
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
commit e03cdf22a2727c60307be6a729233edab3bfda9c upstream.
Harald Linden reports that the ftdi_sio driver works properly for the Yaesu SCU-18 cable if the device ids are added to the driver. So let's add them.
--- drivers/usb/serial/ftdi_sio.c | 1 + drivers/usb/serial/ftdi_sio_ids.h | 1 + 2 files changed, 2 insertions(+)
drivers/usb/serial/ftdi_sio.c +1 -0
@@ -824,6 +824,7 @@ static const struct usb_device_id id_tab { USB_DEVICE(FTDI_VID, FTDI_TURTELIZER_PID), .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, { USB_DEVICE(RATOC_VENDOR_ID, RATOC_PRODUCT_ID_USB60F) }, + { USB_DEVICE(RATOC_VENDOR_ID, RATOC_PRODUCT_ID_SCU18) }, { USB_DEVICE(FTDI_VID, FTDI_REU_TINY_PID) },/* Papouch devices based on FTDI chip */
drivers/usb/serial/ftdi_sio_ids.h +1 -0
@@ -615,6 +615,7 @@*/ #define RATOC_VENDOR_ID 0x0584#define RATOC_PRODUCT_ID_USB60F 0xb020 +#define RATOC_PRODUCT_ID_SCU18 0xb03a/* * Infineon Technologies
Greg Kroah-Hartman
maintainerPATCH 136/200 USB: serial: option: Adding support for Telit LE922
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniele Palmas <[email protected]>
commit ff4e2494dc17b173468e1713fdf6237fd8578bc7 upstream.
This patch adds support for two PIDs of LE922.
--- drivers/usb/serial/option.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
drivers/usb/serial/option.c +16 -0
@@ -271,6 +271,8 @@ static void option_instat_callback(struc#define TELIT_PRODUCT_CC864_SINGLE 0x1006#define TELIT_PRODUCT_DE910_DUAL 0x1010#define TELIT_PRODUCT_UE910_V2 0x1012 +#define TELIT_PRODUCT_LE922_USBCFG0 0x1042 +#define TELIT_PRODUCT_LE922_USBCFG3 0x1043#define TELIT_PRODUCT_LE920 0x1200#define TELIT_PRODUCT_LE910 0x1201
@@ -623,6 +625,16 @@ static const struct option_blacklist_inf .reserved = BIT(8) | BIT(10) | BIT(11), }; +static const struct option_blacklist_info telit_le922_blacklist_usbcfg0 = { + .sendsetup =BIT (2 ), + .reserved =BIT (0 ) |BIT (1 ) |BIT (3 ), +}; + +static const struct option_blacklist_info telit_le922_blacklist_usbcfg3 = { + .sendsetup =BIT (0 ), + .reserved =BIT (1 ) |BIT (2 ) |BIT (3 ), +}; +static const struct usb_device_id option_ids[] = { {USB_DEVICE (OPTION_VENDOR_ID ,OPTION_PRODUCT_COLT ) }, {USB_DEVICE (OPTION_VENDOR_ID ,OPTION_PRODUCT_RICOLA ) },
@@ -1172,6 +1184,10 @@ static const struct usb_device_id option { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_CC864_SINGLE) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_DE910_DUAL) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UE910_V2) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG0), + .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg0 }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG3), + .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910), .driver_info = (kernel_ulong_t)&telit_le910_blacklist }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920),
Greg Kroah-Hartman
maintainerPATCH 137/200 USB: option: fix Cinterion AHxx enumeration
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Ernberg <[email protected]>
commit 4152b387da81617c80cb2946b2d56e3958906b3e upstream.
In certain kernel configurations where the cdc_ether and option drivers are compiled as modules there can occur a race condition in enumeration. This causes the option driver to enumerate the ethernet(wwan) interface as usb-serial interfaces.
usb-devices output for the modem:
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 5 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=1e2d ProdID=0055 Rev=00.00 S: Manufacturer=Cinterion S: Product=AHx C: #Ifs= 6 Cfg#= 1 Atr=e0 MxPwr=10mA I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option I: If#= 4 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether I: If#= 5 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether
--- drivers/usb/serial/option.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/serial/option.c +1 -1
@@ -1707,7 +1707,7 @@ static const struct usb_device_id option { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_EU3_P) }, { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PH8), .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, - { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX) }, + { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX, 0xff) }, { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PLXX), .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) },
Greg Kroah-Hartman
maintainerPATCH 138/200 usb: cdc-acm: handle unlinked urb in acm read callback
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lu Baolu <[email protected]>
commit 19454462acb1bdef80542061bdc9b410e4ed1ff6 upstream.
In current acm driver, the bulk-in callback function ignores the URBs unlinked in usb core.
This causes unexpected data loss in some cases. For example, runtime suspend entry will unlinked all urbs and set urb->status to -ENOENT even those urbs might have data not processed yet. Hence, data loss occurs.
This patch lets bulk-in callback function handle unlinked urbs to avoid data loss.
--- drivers/usb/class/cdc-acm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/usb/class/cdc-acm.c +2 -1
@@ -428,7 +428,8 @@ static void acm_read_bulk_callback(strucset_bit (rb->index, &acm->read_urbs_free);dev_dbg (&acm->data->dev,"%s - non-zero urb status: %d\n" , __func__, status); -return ; +if ((status != -ENOENT ) || (urb->actual_length ==0 )) +return ; }usb_mark_last_busy (acm->dev);
Greg Kroah-Hartman
maintainerPATCH 139/200 usb: cdc-acm: send zero packet for intel 7260 modem
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lu Baolu <[email protected]>
commit ffdb1e369a73b380fce95b05f8498d92c43842b4 upstream.
For Intel 7260 modem, it is needed for host side to send zero packet if the BULK OUT size is equal to USB endpoint max packet length. Otherwise, modem side may still wait for more data and cannot give response to host side.
--- drivers/usb/class/cdc-acm.c | 6 ++++++ drivers/usb/class/cdc-acm.h | 1 + 2 files changed, 7 insertions(+)
drivers/usb/class/cdc-acm.c +6 -0
@@ -1405,6 +1405,8 @@ made_compressed_probe:usb_sndbulkpipe (usb_dev, epwrite->bEndpointAddress), NULL, acm->writesize, acm_write_bulk, snd); snd->urb->transfer_flags |=URB_NO_TRANSFER_DMA_MAP ; +if (quirks &SEND_ZERO_PACKET ) + snd->urb->transfer_flags |=URB_ZERO_PACKET ; snd->instance = acm; }
@@ -1862,6 +1864,10 @@ static const struct usb_device_id acm_id { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM, USB_CDC_ACM_PROTO_AT_CDMA) }, + { USB_DEVICE(0x1519, 0x0452), /* Intel 7260 modem */ + .driver_info = SEND_ZERO_PACKET, + }, + { } };
drivers/usb/class/cdc-acm.h +1 -0
@@ -134,3 +134,4 @@ struct acm {#define IGNORE_DEVICE BIT(5)#define QUIRK_CONTROL_LINE_STATE BIT(6)#define CLEAR_HALT_CONDITIONS BIT(7) +#define SEND_ZERO_PACKET BIT(8)
Greg Kroah-Hartman
maintainerPATCH 141/200 usb: xhci: handle both SSIC ports in PME stuck quirk
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lu Baolu <[email protected]>
commit fa89537783cb442263fa5a14df6c7693eaf32f11 upstream.
Commit abce329c27b3 ("xhci: Workaround to get D3 working in Intel xHCI") adds a workaround for a limitation of PME storm caused by SSIC port in some Intel SoCs. This commit only handled one SSIC port, while there are actually two SSIC ports in the chips. This patch handles both SSIC ports. Without this fix, users still see PME storm.
--- drivers/usb/host/xhci-pci.c | 48 ++++++++++++++++++++++++++------------------ 1 file changed, 29 insertions(+), 19 deletions(-)
drivers/usb/host/xhci-pci.c +29 -19
@@ -28,7 +28,9 @@#include "xhci.h" #include "xhci-trace.h" -#define PORT2_SSIC_CONFIG_REG2 0x883c +#define SSIC_PORT_NUM 2 +#define SSIC_PORT_CFG2 0x880c +#define SSIC_PORT_CFG2_OFFSET 0x30#define PROG_DONE (1 << 30)#define SSIC_PORT_UNUSED (1 << 31)
@@ -316,28 +318,36 @@ static void xhci_pme_quirk(struct usb_hcstruct pci_dev *pdev =to_pci_dev (hcd->self.controller);u32 val;void __iomem *reg; +int i;if (pdev->vendor ==PCI_VENDOR_ID_INTEL && pdev->device ==PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI ) { - reg = (void __iomem *) xhci->cap_regs +PORT2_SSIC_CONFIG_REG2 ; - -/* Notify SSIC that SSIC profile programming is not done */ - val =readl (reg) & ~PROG_DONE ; -writel (val, reg); - -/* Mark SSIC port as unused(suspend) or used(resume) */ - val =readl (reg); -if (suspend) - val |=SSIC_PORT_UNUSED ; -else - val &= ~SSIC_PORT_UNUSED ; -writel (val, reg); - -/* Notify SSIC that SSIC profile programming is done */ - val =readl (reg) |PROG_DONE ; -writel (val, reg); -readl (reg); +for (i =0 ; i <SSIC_PORT_NUM ; i++) { + reg = (void __iomem *) xhci->cap_regs + +SSIC_PORT_CFG2 + + i *SSIC_PORT_CFG2_OFFSET ; + +/* +* Notify SSIC that SSIC profile programming +* is not done. +*/ + val =readl (reg) & ~PROG_DONE ; +writel (val, reg); + +/* Mark SSIC port as unused(suspend) or used(resume) */ + val =readl (reg); +if (suspend) + val |=SSIC_PORT_UNUSED ; +else + val &= ~SSIC_PORT_UNUSED ; +writel (val, reg); + +/* Notify SSIC that SSIC profile programming is done */ + val =readl (reg) |PROG_DONE ; +writel (val, reg); +readl (reg); + } } reg = (void __iomem *) xhci->cap_regs +0x80a4 ;
Greg Kroah-Hartman
maintainerPATCH 142/200 usb: xhci: apply XHCI_PME_STUCK_QUIRK to Intel Broxton-M platforms
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lu Baolu <[email protected]>
commit ccc04afb72cddbdf7c0e1c17e92886405a71b754 upstream.
Intel Broxton M was verifed to require XHCI_PME_STUCK_QUIRK quirk as well.
--- drivers/usb/host/xhci-pci.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/host/xhci-pci.c +3 -1
@@ -47,6 +47,7 @@#define PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI 0x22b5#define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_XHCI 0xa12f#define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI 0x9d2f +#define PCI_DEVICE_ID_INTEL_BROXTON_M_XHCI 0x0aa8static const char hcd_name[] ="xhci_hcd" ;
@@ -154,7 +155,8 @@ static void xhci_pci_quirks(struct devicif (pdev->vendor ==PCI_VENDOR_ID_INTEL && (pdev->device ==PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI || pdev->device ==PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_XHCI || - pdev->device ==PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI )) { + pdev->device ==PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI || + pdev->device ==PCI_DEVICE_ID_INTEL_BROXTON_M_XHCI )) { xhci->quirks |=XHCI_PME_STUCK_QUIRK ; } if (pdev->vendor == PCI_VENDOR_ID_ETRON &&
Greg Kroah-Hartman
maintainerPATCH 143/200 n_tty: Fix poll() after buffer-limited eof push read
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Hurley <[email protected]>
commit ac8f3bf8832a405cc6e4dccb1d26d5cb2994d234 upstream.
commit 40d5e0905a03 ("n_tty: Fix EOF push handling") fixed EOF push for reads. However, that approach still allows a condition mismatch between poll() and read(), where poll() returns POLLIN but read() blocks. This state can happen when a previous read() returned because the user buffer was full and the next character was an EOF not at the beginning of the line. While the next read() will properly identify the condition and advance the read buffer tail without improperly indicating an EOF file condition (ie., read() will not mistakenly return 0), poll() will mistakenly indicate POLLIN.
Although a possible solution would be to peek at the input buffer in n_tty_poll(), the better solution in this patch is to eat the EOF during the previous read() (ie., fix the problem by eliminating the condition).
The current canon line buffer copy limits the scan for next end-of-line to the smaller of either,
a. the remaining user buffer size
b. completed lines in the input buffer
When the remaining user buffer size is exactly one less than the end-of-line marked by EOF push, the EOF is not scanned nor skipped but left for subsequent reads. In the example below, the scan index 'eol' has stopped at the EOF because it is past the scan limit of 5 (not because it has found the next set bit in read_flags)
user buffer [*nr = 5] _ _ _ _ _
read_flags 0 0 0 0 0 1
input buffer h e l l o [EOF]
^ ^
/ /
tail eol
result: found = 0, tail += 5, *nr += 5
Instead, allow the scan to peek ahead 1 byte (while still limiting the scan to completed lines in the input buffer). For the example above,
result: found = 1, tail += 6, *nr += 5
Because the scan limit is now bumped +1 byte, when the scan is completed, the tail advance and the user buffer copy limit is re-clamped to *nr when EOF is _not_ found.
--- drivers/tty/n_tty.c | 22 +++++++++------------- 1 file changed, 9 insertions(+), 13 deletions(-)
drivers/tty/n_tty.c +9 -13
@@ -2058,13 +2058,13 @@ static int canon_copy_from_read_buf(strusize_t eol;size_t tail;int ret, found =0 ; -bool eof_push =0 ;/* N.B. avoid overrun if nr == 0 */ - n =min (*nr,smp_load_acquire (&ldata->canon_head) - ldata->read_tail); -if (!n) +if (!*nr)return 0 ; + n =min (*nr +1 ,smp_load_acquire (&ldata->canon_head) - ldata->read_tail); + tail = ldata->read_tail & (N_TTY_BUF_SIZE -1 ); size =min_t (size_t, tail + n,N_TTY_BUF_SIZE );
@@ -2085,12 +2085,11 @@ static int canon_copy_from_read_buf(stru n = eol - tail;if (n >N_TTY_BUF_SIZE ) n +=N_TTY_BUF_SIZE ; - n += found; - c = n; + c = n + found; -if (found && !ldata->push &&read_buf (ldata, eol) == __DISABLED_CHAR) { - n--; - eof_push = !n && ldata->read_tail != ldata->line_start; +if (!found ||read_buf (ldata, eol) != __DISABLED_CHAR) { + c =min (*nr, c); + n = c; } n_tty_trace("%s: eol:%zu found:%d n:%zu c:%zu size:%zu more:%zu\n",
@@ -2120,7 +2119,7 @@ static int canon_copy_from_read_buf(stru ldata->push =0 ;tty_audit_push (tty); } -return eof_push ? -EAGAIN :0 ; +return 0 ; } extern ssize_t redirected_tty_write(struct file *, const char __user *,
@@ -2299,10 +2298,7 @@ static ssize_t n_tty_read(struct tty_strif (ldata->icanon && !L_EXTPROC (tty)) { retval =canon_copy_from_read_buf (tty, &b, &nr); -if (retval == -EAGAIN ) { - retval =0 ; -continue ; - }else if (retval) +if (retval)break ; }else {int uncopied;
Greg Kroah-Hartman
maintainerPATCH 144/200 n_tty: Fix unsafe reference to "other" ldisc
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Hurley <[email protected]>
commit 6d27a63caad3f13e96cf065d2d96828c2006be6b upstream.
Although n_tty_check_unthrottle() has a valid ldisc reference (since the tty core gets the ldisc ref in tty_read() before calling the line discipline read() method), it does not have a valid ldisc reference to the "other" pty of a pty pair. Since getting an ldisc reference for tty->link essentially open-codes tty_wakeup(), just replace with the equivalent tty_wakeup().
--- drivers/tty/n_tty.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-)
drivers/tty/n_tty.c +2 -5
@@ -258,16 +258,13 @@ static void n_tty_check_throttle(structstatic void n_tty_check_unthrottle (struct tty_struct *tty) { -if (tty->driver->type ==TTY_DRIVER_TYPE_PTY && - tty->link->ldisc->ops->write_wakeup == n_tty_write_wakeup) { +if (tty->driver->type ==TTY_DRIVER_TYPE_PTY ) {if (chars_in_buffer (tty) >TTY_THRESHOLD_UNTHROTTLE )return ;if (!tty->count)return ;n_tty_kick_worker (tty); -n_tty_write_wakeup (tty->link); -if (waitqueue_active (&tty->link->write_wait)) -wake_up_interruptible_poll (&tty->link->write_wait,POLLOUT ); +tty_wakeup (tty->link);return ; }
Greg Kroah-Hartman
maintainerPATCH 145/200 tty: Fix GPF in flush_to_ldisc()
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Hurley <[email protected]>
commit 9ce119f318ba1a07c29149301f1544b6c4bea52a upstream.
A line discipline which does not define a receive_buf() method can can cause a GPF if data is ever received [1]. Oddly, this was known to the author of n_tracesink in 2011, but never fixed.
[1] GPF report
BUG: unable to handle kernel NULL pointer dereference at (null)
IP: [< (null)>] (null)
PGD 3752d067 PUD 37a7b067 PMD 0
Oops: 0010 [#1] SMP KASAN
Modules linked in:
CPU: 2 PID: 148 Comm: kworker/u10:2 Not tainted 4.4.0-rc2+ #51
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
Workqueue: events_unbound flush_to_ldisc
task: ffff88006da94440 ti: ffff88006db60000 task.ti: ffff88006db60000
RIP: 0010:[<0000000000000000>] [< (null)>] (null)
RSP: 0018:ffff88006db67b50 EFLAGS: 00010246
RAX: 0000000000000102 RBX: ffff88003ab32f88 RCX: 0000000000000102
RDX: 0000000000000000 RSI: ffff88003ab330a6 RDI: ffff88003aabd388
RBP: ffff88006db67c48 R08: ffff88003ab32f9c R09: ffff88003ab31fb0
R10: ffff88003ab32fa8 R11: 0000000000000000 R12: dffffc0000000000
R13: ffff88006db67c20 R14: ffffffff863df820 R15: ffff88003ab31fb8
FS: 0000000000000000(0000) GS:ffff88006dc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 0000000000000000 CR3: 0000000037938000 CR4: 00000000000006e0
Stack:
ffffffff829f46f1 ffff88006da94bf8 ffff88006da94bf8 0000000000000000
ffff88003ab31fb0 ffff88003aabd438 ffff88003ab31ff8 ffff88006430fd90
ffff88003ab32f9c ffffed0007557a87 1ffff1000db6cf78 ffff88003ab32078
Call Trace:
[<ffffffff8127cf91>] process_one_work+0x8f1/0x17a0 kernel/workqueue.c:2030
[<ffffffff8127df14>] worker_thread+0xd4/0x1180 kernel/workqueue.c:2162
[<ffffffff8128faaf>] kthread+0x1cf/0x270 drivers/block/aoe/aoecmd.c:1302
[<ffffffff852a7c2f>] ret_from_fork+0x3f/0x70 arch/x86/entry/entry_64.S:468
Code: Bad RIP value.
RIP [< (null)>] (null)
RSP <ffff88006db67b50>
CR2: 0000000000000000
---[ end trace a587f8947e54d6ea ]------ drivers/tty/tty_buffer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/tty/tty_buffer.c +1 -1
@@ -450,7 +450,7 @@ receive_buf(struct tty_struct *tty, stru count = disc->ops->receive_buf2 (tty, p, f, count); else { count =min_t (int, count, tty->receive_room); -if (count) +if (count && disc->ops->receive_buf) disc->ops->receive_buf (tty, p, f, count); }return count;
Greg Kroah-Hartman
maintainerPATCH 147/200 tty: Fix unsafe ldisc reference via ioctl(TIOCGETD)
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Hurley <[email protected]>
commit 5c17c861a357e9458001f021a7afa7aab9937439 upstream.
ioctl(TIOCGETD) retrieves the line discipline id directly from the ldisc because the line discipline id (c_line) in termios is untrustworthy; userspace may have set termios via ioctl(TCSETS*) without actually changing the line discipline via ioctl(TIOCSETD).
However, directly accessing the current ldisc via tty->ldisc is unsafe; the ldisc ptr dereferenced may be stale if the line discipline is changing via ioctl(TIOCSETD) or hangup.
Wait for the line discipline reference (just like read() or write()) to retrieve the "current" line discipline id.
--- drivers/tty/tty_io.c | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-)
drivers/tty/tty_io.c +23 -1
@@ -2658,6 +2658,28 @@ static int tiocsetd(struct tty_struct *t }/** +* tiocgetd - get line discipline +* @tty: tty device +* @p: pointer to user data +* +* Retrieves the line discipline id directly from the ldisc. +* +* Locking: waits for ldisc reference (in case the line discipline +* is changing or the tty is being hungup) +*/ + +static int tiocgetd (struct tty_struct *tty,int __user *p) +{ +struct tty_ldisc *ld; +int ret; + + ld =tty_ldisc_ref_wait (tty); + ret =put_user (ld->ops->num, p); +tty_ldisc_deref (ld); +return ret; +} + +/** * send_break - performed time break * @tty: device to break on * @duration: timeout in mS
@@ -2883,7 +2905,7 @@ long tty_ioctl(struct file *file, unsigncase TIOCGSID :return tiocgsid (tty, real_tty, p);case TIOCGETD : -return put_user (tty->ldisc->ops->num, (int __user *)p); +return tiocgetd (tty, p);case TIOCSETD :return tiocsetd (tty, p);case TIOCVHANGUP :
Greg Kroah-Hartman
maintainerPATCH 148/200 iommu/io-pgtable-arm: Ensure we free the final level on teardown
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Will Deacon <[email protected]>
commit 12c2ab09571e8aae3a87da2a4a452632a5fac1e5 upstream.
When tearing down page tables, we return early for the final level since we know that we won't have any table pointers to follow. Unfortunately, this also means that we forget to free the final level, so we end up leaking memory.
Fix the issue by always freeing the current level, but just don't bother to iterate over the ptes if we're at the final level.
--- drivers/iommu/io-pgtable-arm.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
drivers/iommu/io-pgtable-arm.c +6 -5
@@ -405,17 +405,18 @@ static void __arm_lpae_free_pgtable(struarm_lpae_iopte *start, *end;unsigned long table_size; -/* Only leaf entries at the last level */ -if (lvl ==ARM_LPAE_MAX_LEVELS -1 ) -return ; -if (lvl ==ARM_LPAE_START_LVL (data)) table_size = data->pgd_size;else table_size =1UL << data->pg_shift; start = ptep; - end = (void *)ptep + table_size; + +/* Only leaf entries at the last level */ +if (lvl ==ARM_LPAE_MAX_LEVELS -1 ) + end = ptep; +else + end = (void *)ptep + table_size;while (ptep != end) {arm_lpae_iopte pte = *ptep++;
Greg Kroah-Hartman
maintainerPATCH 149/200 arm64: mm: use correct mapping granularity under DEBUG_RODATA
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ard Biesheuvel <[email protected]>
commit 4fee9f364b9b99f76732f2a6fd6df679a237fa74 upstream.
When booting a 64k pages kernel that is built with CONFIG_DEBUG_RODATA and resides at an offset that is not a multiple of 512 MB, the rounding that occurs in __map_memblock() and fixup_executable() results in incorrect regions being mapped.
The following snippet from /sys/kernel/debug/kernel_page_tables shows how, when the kernel is loaded 2 MB above the base of DRAM at 0x40000000, the first 2 MB of memory (which may be inaccessible from non-secure EL1 or just reserved by the firmware) is inadvertently mapped into the end of the module region.
---[ Modules start ]---
0xfffffdffffe00000-0xfffffe0000000000 2M RW NX ... UXN MEM/NORMAL
---[ Modules end ]---
---[ Kernel Mapping ]---
0xfffffe0000000000-0xfffffe0000090000 576K RW NX ... UXN MEM/NORMAL
0xfffffe0000090000-0xfffffe0000200000 1472K ro x ... UXN MEM/NORMAL 0xfffffe0000200000-0xfffffe0000800000 6M ro x ... UXN MEM/NORMAL 0xfffffe0000800000-0xfffffe0000810000 64K ro x ... UXN MEM/NORMAL
0xfffffe0000810000-0xfffffe0000a00000 1984K RW NX ... UXN MEM/NORMAL 0xfffffe0000a00000-0xfffffe00ffe00000 4084M RW NX ... UXN MEM/NORMAL
The same issue is likely to occur on 16k pages kernels whose load address is not a multiple of 32 MB (i.e., SECTION_SIZE). So round to SWAPPER_BLOCK_SIZE instead of SECTION_SIZE.
--- arch/arm64/mm/mmu.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
arch/arm64/mm/mmu.c +7 -6
@@ -301,6 +301,7 @@ static void create_mapping_late(phys_add }#ifdef CONFIG_DEBUG_RODATA +#define SWAPPER_BLOCK_SIZE (PAGE_SHIFT == 12 ? SECTION_SIZE : PAGE_SIZE)static void __init __map_memblock (phys_addr_t start,phys_addr_t end) {/*
@@ -308,8 +309,8 @@ static void __init __map_memblock(phys_a* for now. This will get more fine grained later once all memory * is mapped */ -unsigned long kernel_x_start =round_down (__pa (_stext),SECTION_SIZE ); -unsigned long kernel_x_end =round_up (__pa (__init_end),SECTION_SIZE ); +unsigned long kernel_x_start =round_down (__pa (_stext),SWAPPER_BLOCK_SIZE ); +unsigned long kernel_x_end =round_up (__pa (__init_end),SWAPPER_BLOCK_SIZE );if (end < kernel_x_start) { create_mapping(start, __phys_to_virt(start),
@@ -397,18 +398,18 @@ void __init fixup_executable(void) {#ifdef CONFIG_DEBUG_RODATA /* now that we are actually fully mapped, make the start/end more fine grained */ -if (!IS_ALIGNED ((unsigned long )_stext,SECTION_SIZE )) { +if (!IS_ALIGNED ((unsigned long )_stext,SWAPPER_BLOCK_SIZE )) {unsigned long aligned_start =round_down (__pa (_stext), -SECTION_SIZE ); +SWAPPER_BLOCK_SIZE );create_mapping (aligned_start,__phys_to_virt (aligned_start),__pa (_stext) - aligned_start,PAGE_KERNEL ); } -if (!IS_ALIGNED ((unsigned long )__init_end,SECTION_SIZE )) { +if (!IS_ALIGNED ((unsigned long )__init_end,SWAPPER_BLOCK_SIZE )) {unsigned long aligned_end =round_up (__pa (__init_end), -SECTION_SIZE ); +SWAPPER_BLOCK_SIZE );create_mapping (__pa (__init_end), (unsigned long )__init_end, aligned_end -__pa (__init_end),PAGE_KERNEL );
Greg Kroah-Hartman
maintainerPATCH 152/200 ext2, ext4: warn when mounting with dax enabled
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Williams <[email protected]>
commit ef83b6e8f40bb24b92ad73b5889732346e54a793 upstream.
Similar to XFS warn when mounting DAX while it is still considered under development. Also, aspects of the DAX implementation, for example synchronization against multiple faults and faults causing block allocation, depend on the correct implementation in the filesystem. The maturity of a given DAX implementation is filesystem specific.
--- fs/ext2/super.c | 2 ++ fs/ext4/super.c | 6 +++++- 2 files changed, 7 insertions(+), 1 deletion(-)
fs/ext2/super.c +2 -0
@@ -566,6 +566,8 @@ static int parse_options(char *options,/* Fall through */ case Opt_dax:#ifdef CONFIG_FS_DAX +ext2_msg (sb,KERN_WARNING , +"DAX enabled. Warning: EXPERIMENTAL, use at your own risk" );set_opt (sbi->s_mount_opt,DAX );#else ext2_msg (sb,KERN_INFO ,"dax option not supported" );
fs/ext4/super.c +5 -1
@@ -1664,8 +1664,12 @@ static int handle_mount_opt(struct super } sbi->s_jquota_fmt = m->mount_opt;#endif -#ifndef CONFIG_FS_DAX }else if (token == Opt_dax) { +#ifdef CONFIG_FS_DAX +ext4_msg (sb,KERN_WARNING , +"DAX enabled. Warning: EXPERIMENTAL, use at your own risk" ); + sbi->s_mount_opt |= m->mount_opt; +#else ext4_msg (sb,KERN_INFO ,"dax option not supported" );return -1 ;#endif
Greg Kroah-Hartman
maintainerPATCH 153/200 ext4: Fix handling of extended tv_sec
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Turner <[email protected]>
commit a4dad1ae24f850410c4e60f22823cba1289b8d52 upstream.
In ext4, the bottom two bits of {a,c,m}time_extra are used to extend the {a,c,m}time fields, deferring the year 2038 problem to the year 2446.
When decoding these extended fields, for times whose bottom 32 bits would represent a negative number, sign extension causes the 64-bit extended timestamp to be negative as well, which is not what's intended. This patch corrects that issue, so that the only negative {a,c,m}times are those between 1901 and 1970 (as per 32-bit signed timestamps).
Some older kernels might have written pre-1970 dates with 1,1 in the extra bits. This patch treats those incorrectly-encoded dates as pre-1970, instead of post-2311, until kernel 4.20 is released. Hopefully by then e2fsck will have fixed up the bad data.
Also add a comment explaining the encoding of ext4's extra {a,c,m}time bits.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=23732
--- fs/ext4/ext4.h | 51 ++++++++++++++++++++++++++++++++++++++++++++------- 1 file changed, 44 insertions(+), 7 deletions(-)
fs/ext4/ext4.h +44 -7
@@ -26,6 +26,7 @@#include <linux/seqlock.h> #include <linux/mutex.h> #include <linux/timer.h> +#include <linux/version.h> #include <linux/wait.h> #include <linux/blockgroup_lock.h> #include <linux/percpu_counter.h>
@@ -723,19 +724,55 @@ struct move_extent { <= (EXT4_GOOD_OLD_INODE_SIZE + \ (einode)->i_extra_isize)) \ +/* +* We use an encoding that preserves the times for extra epoch "00": +* +* extra msb of adjust for signed +* epoch 32-bit 32-bit tv_sec to +* bits time decoded 64-bit tv_sec 64-bit tv_sec valid time range +* 0 0 1 -0x80000000..-0x00000001 0x000000000 1901-12-13..1969-12-31 +* 0 0 0 0x000000000..0x07fffffff 0x000000000 1970-01-01..2038-01-19 +* 0 1 1 0x080000000..0x0ffffffff 0x100000000 2038-01-19..2106-02-07 +* 0 1 0 0x100000000..0x17fffffff 0x100000000 2106-02-07..2174-02-25 +* 1 0 1 0x180000000..0x1ffffffff 0x200000000 2174-02-25..2242-03-16 +* 1 0 0 0x200000000..0x27fffffff 0x200000000 2242-03-16..2310-04-04 +* 1 1 1 0x280000000..0x2ffffffff 0x300000000 2310-04-04..2378-04-22 +* 1 1 0 0x300000000..0x37fffffff 0x300000000 2378-04-22..2446-05-10 +* +* Note that previous versions of the kernel on 64-bit systems would +* incorrectly use extra epoch bits 1,1 for dates between 1901 and +* 1970. e2fsck will correct this, assuming that it is run on the +* affected filesystem before 2242. +*/ +static inline __le32 ext4_encode_extra_time (struct timespec *time) { -return cpu_to_le32 ((sizeof (time->tv_sec) >4 ? - (time->tv_sec >>32 ) &EXT4_EPOCH_MASK :0 ) | - ((time->tv_nsec <<EXT4_EPOCH_BITS ) &EXT4_NSEC_MASK )); +u32 extra =sizeof (time->tv_sec) >4 ? + ((time->tv_sec - (s32 )time->tv_sec) >>32 ) &EXT4_EPOCH_MASK :0 ; +return cpu_to_le32 (extra | (time->tv_nsec <<EXT4_EPOCH_BITS )); }static inline void ext4_decode_extra_time (struct timespec *time,__le32 extra) { -if (sizeof (time->tv_sec) >4 ) - time->tv_sec |= (__u64)(le32_to_cpu (extra) &EXT4_EPOCH_MASK ) - <<32 ; - time->tv_nsec = (le32_to_cpu (extra) &EXT4_NSEC_MASK ) >>EXT4_EPOCH_BITS ; +if (unlikely (sizeof (time->tv_sec) >4 && + (extra &cpu_to_le32 (EXT4_EPOCH_MASK )))) { +#if LINUX_VERSION_CODE <KERNEL_VERSION (4 ,20 ,0 ) +/* Handle legacy encoding of pre-1970 dates with epoch +* bits 1,1. We assume that by kernel version 4.20, +* everyone will have run fsck over the affected +* filesystems to correct the problem. (This +* backwards compatibility may be removed before this +* time, at the discretion of the ext4 developers.) +*/ +u64 extra_bits =le32_to_cpu (extra) &EXT4_EPOCH_MASK ; +if (extra_bits ==3 && ((time->tv_sec) &0x80000000 ) !=0 ) + extra_bits =0 ; + time->tv_sec += extra_bits <<32 ; +#else + time->tv_sec += (u64)(le32_to_cpu (extra) &EXT4_EPOCH_MASK ) <<32 ; +#endif + } + time->tv_nsec = (le32_to_cpu (extra) &EXT4_NSEC_MASK ) >>EXT4_EPOCH_BITS ; }#define EXT4_INODE_SET_XTIME (xtime, inode, raw_inode) \
Greg Kroah-Hartman
maintainerPATCH 154/200 ext4: fix an endianness bug in ext4_encrypted_zeroout()
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
commit e2c9e0b28e146c9a3bce21408f3c02e24ac7ac31 upstream.
ex->ee_block is not host-endian (note that accesses of other fields of *ex right next to that line go through the helpers that do proper conversion from little-endian to host-endian; it might make sense to add similar for ->ee_block to avoid reintroducing that kind of bugs...)
--- fs/ext4/crypto.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ext4/crypto.c +1 -1
@@ -408,7 +408,7 @@ int ext4_encrypted_zeroout(struct inodestruct ext4_crypto_ctx *ctx;struct page *ciphertext_page =NULL ;struct bio *bio; -ext4_lblk_t lblk = ex->ee_block; +ext4_lblk_t lblk =le32_to_cpu (ex->ee_block);ext4_fsblk_t pblk =ext4_ext_pblock (ex);unsigned int len =ext4_ext_get_actual_len (ex);int ret, err =0 ;
Greg Kroah-Hartman
maintainerPATCH 155/200 ext4: fix an endianness bug in ext4_encrypted_follow_link()
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
commit 5a1c7f47da9b32d0671e776b0f388095b7f91e2e upstream.
applying le32_to_cpu() to 16bit value is a bad idea...
--- fs/ext4/symlink.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ext4/symlink.c +1 -1
@@ -52,7 +52,7 @@ static const char *ext4_encrypted_follow/* Symlink is encrypted */ sd = (struct ext4_encrypted_symlink_data *)caddr; cstr.name = sd->encrypted_path; - cstr.len =le32_to_cpu (sd->len); + cstr.len =le16_to_cpu (sd->len);if ((cstr.len +sizeof (struct ext4_encrypted_symlink_data ) -1 ) > max_size) {
Greg Kroah-Hartman
maintainerPATCH 156/200 sched: Fix crash in sched_init_numa()
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Raghavendra K T <[email protected]>
commit 9c03ee147193645be4c186d3688232fa438c57c7 upstream.
The following PowerPC commit:
c118baf80256 ("arch/powerpc/mm/numa.c: do not allocate bootmem memory for non existing nodes")
avoids allocating bootmem memory for non existent nodes.
But when DEBUG_PER_CPU_MAPS=y is enabled, my powerNV system failed to boot because in sched_init_numa(), cpumask_or() operation was done on unallocated nodes.
Fix that by making cpumask_or() operation only on existing nodes.
[ Tested with and w/o DEBUG_PER_CPU_MAPS=y on x86 and PowerPC. ]
--- kernel/sched/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/sched/core.c +1 -1
@@ -6678,7 +6678,7 @@ static void sched_init_numa(void) sched_domains_numa_masks[i][j] = mask; -for (k =0 ; k < nr_node_ids; k++) { +for_each_node (k) {if (node_distance (j, k) > sched_domains_numa_distance[i])continue ;
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to [email protected]. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"[email protected]"> [email protected] </a>
Greg Kroah-Hartman
maintainerPATCH 160/200 crypto: af_alg - Add nokey compatibility path
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
commit 37766586c965d63758ad542325a96d5384f4a8c9 upstream.
This patch adds a compatibility path to support old applications that do acept(2) before setkey.
--- crypto/af_alg.c | 13 ++++++++++++- include/crypto/if_alg.h | 2 ++ 2 files changed, 14 insertions(+), 1 deletion(-)
crypto/af_alg.c +12 -1
@@ -76,6 +76,8 @@ int af_alg_register_type(const struct af goto unlock; type->ops->owner =THIS_MODULE ; +if (type->ops_nokey) + type->ops_nokey->owner =THIS_MODULE ; node->type = type;list_add (&node->list, &alg_types); err =0 ;
@@ -267,6 +269,7 @@ int af_alg_accept(struct sock *sk, strucconst struct af_alg_type *type;struct sock *sk2;int err; +bool nokey;lock_sock (sk); type = ask->type;
@@ -285,12 +288,17 @@ int af_alg_accept(struct sock *sk, strucsecurity_sk_clone (sk, sk2); err = type->accept (ask->private, sk2); + + nokey = err == -ENOKEY ; +if (nokey && type->accept_nokey) + err = type->accept_nokey (ask->private, sk2); +if (err) goto unlock; sk2->sk_family =PF_ALG ; -if (!ask->refcnt++) +if (nokey || !ask->refcnt++)sock_hold (sk);alg_sk (sk2)->parent = sk;alg_sk (sk2)->type = type;
@@ -298,6 +306,9 @@ int af_alg_accept(struct sock *sk, struc newsock->ops = type->ops; newsock->state =SS_CONNECTED ; +if (nokey) + newsock->ops = type->ops_nokey; + err =0 ; unlock:
include/crypto/if_alg.h +2 -0
@@ -52,9 +52,11 @@ struct af_alg_type {void (*release)(void *private);int (*setkey)(void *private,const u8 *key,unsigned int keylen);int (*accept)(void *private,struct sock *sk); +int (*accept_nokey)(void *private,struct sock *sk);int (*setauthsize)(void *private,unsigned int authsize);struct proto_ops *ops; +struct proto_ops *ops_nokey;struct module *owner;char name[14 ]; };
Greg Kroah-Hartman
maintainerPATCH 161/200 crypto: algif_skcipher - Add nokey compatibility path
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
commit a0fa2d037129a9849918a92d91b79ed6c7bd2818 upstream.
This patch adds a compatibility path to support old applications that do acept(2) before setkey.
--- crypto/algif_skcipher.c | 149 ++++++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 144 insertions(+), 5 deletions(-)
crypto/algif_skcipher.c +144 -5
@@ -753,6 +753,99 @@ static struct proto_ops algif_skcipher_o .poll = skcipher_poll, }; +static int skcipher_check_key (struct socket *sock) +{ +int err; +struct sock *psk; +struct alg_sock *pask; +struct skcipher_tfm *tfm; +struct sock *sk = sock->sk; +struct alg_sock *ask =alg_sk (sk); + +if (ask->refcnt) +return 0 ; + + psk = ask->parent; + pask =alg_sk (ask->parent); + tfm = pask->private; + + err = -ENOKEY ; +lock_sock (psk); +if (!tfm->has_key) + goto unlock; + +if (!pask->refcnt++) +sock_hold (psk); + + ask->refcnt =1 ; +sock_put (psk); + + err =0 ; + +unlock: +release_sock (psk); + +return err; +} + +static int skcipher_sendmsg_nokey (struct socket *sock,struct msghdr *msg, +size_t size) +{ +int err; + + err =skcipher_check_key (sock); +if (err) +return err; + +return skcipher_sendmsg (sock, msg, size); +} + +static ssize_t skcipher_sendpage_nokey (struct socket *sock,struct page *page, +int offset,size_t size,int flags) +{ +int err; + + err =skcipher_check_key (sock); +if (err) +return err; + +return skcipher_sendpage (sock, page, offset, size, flags); +} + +static int skcipher_recvmsg_nokey (struct socket *sock,struct msghdr *msg, +size_t ignored,int flags) +{ +int err; + + err =skcipher_check_key (sock); +if (err) +return err; + +return skcipher_recvmsg (sock, msg, ignored, flags); +} + +static struct proto_ops algif_skcipher_ops_nokey = { + .family =PF_ALG , + + .connect = sock_no_connect, + .socketpair = sock_no_socketpair, + .getname = sock_no_getname, + .ioctl = sock_no_ioctl, + .listen = sock_no_listen, + .shutdown = sock_no_shutdown, + .getsockopt = sock_no_getsockopt, + .mmap = sock_no_mmap, + .bind = sock_no_bind, + .accept = sock_no_accept, + .setsockopt = sock_no_setsockopt, + + .release = af_alg_release, + .sendmsg = skcipher_sendmsg_nokey, + .sendpage = skcipher_sendpage_nokey, + .recvmsg = skcipher_recvmsg_nokey, + .poll = skcipher_poll, +}; +static void *skcipher_bind (const char *name,u32 type,u32 mask) {struct skcipher_tfm *tfm;
@@ -802,7 +895,7 @@ static void skcipher_wait(struct sock *smsleep (100 ); } -static void skcipher_sock_destruct (struct sock *sk) +static void skcipher_sock_destruct_common (struct sock *sk) {struct alg_sock *ask =alg_sk (sk);struct skcipher_ctx *ctx = ask->private;
@@ -814,10 +907,33 @@ static void skcipher_sock_destruct(strucskcipher_free_sgl (sk);sock_kzfree_s (sk, ctx->iv,crypto_skcipher_ivsize (tfm));sock_kfree_s (sk, ctx, ctx->len); +} + +static void skcipher_sock_destruct (struct sock *sk) +{ +skcipher_sock_destruct_common (sk);af_alg_release_parent (sk); } -static int skcipher_accept_parent (void *private,struct sock *sk) +static void skcipher_release_parent_nokey (struct sock *sk) +{ +struct alg_sock *ask =alg_sk (sk); + +if (!ask->refcnt) { +sock_put (ask->parent); +return ; + } + +af_alg_release_parent (sk); +} + +static void skcipher_sock_destruct_nokey (struct sock *sk) +{ +skcipher_sock_destruct_common (sk); +skcipher_release_parent_nokey (sk); +} + +static int skcipher_accept_parent_common (void *private,struct sock *sk) {struct skcipher_ctx *ctx;struct alg_sock *ask =alg_sk (sk);
@@ -825,9 +941,6 @@ static int skcipher_accept_parent(void *struct crypto_skcipher *skcipher = tfm->skcipher;unsigned int len =sizeof (*ctx) +crypto_skcipher_reqsize (skcipher); -if (!tfm->has_key) -return -ENOKEY ; - ctx =sock_kmalloc (sk, len,GFP_KERNEL );if (!ctx)return -ENOMEM ;
@@ -861,12 +974,38 @@ static int skcipher_accept_parent(void *return 0 ; } +static int skcipher_accept_parent (void *private,struct sock *sk) +{ +struct skcipher_tfm *tfm = private; + +if (!tfm->has_key) +return -ENOKEY ; + +return skcipher_accept_parent_common (private, sk); +} + +static int skcipher_accept_parent_nokey (void *private,struct sock *sk) +{ +int err; + + err =skcipher_accept_parent_common (private, sk); +if (err) + goto out; + + sk->sk_destruct = skcipher_sock_destruct_nokey; + +out: +return err; +} +static const struct af_alg_type algif_type_skcipher = { .bind = skcipher_bind, .release = skcipher_release, .setkey = skcipher_setkey, .accept = skcipher_accept_parent, + .accept_nokey = skcipher_accept_parent_nokey, .ops = &algif_skcipher_ops, + .ops_nokey = &algif_skcipher_ops_nokey, .name ="skcipher" , .owner =THIS_MODULE };
Greg Kroah-Hartman
maintainerPATCH 164/200 crypto: skcipher - Add crypto_skcipher_has_setkey
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
commit a1383cd86a062fc798899ab20f0ec2116cce39cb upstream.
This patch adds a way for skcipher users to determine whether a key is required by a transform.
--- crypto/skcipher.c | 2 ++ include/crypto/skcipher.h | 7 +++++++ 2 files changed, 9 insertions(+)
crypto/skcipher.c +2 -0
@@ -118,6 +118,7 @@ int crypto_init_skcipher_ops_blkcipher(s skcipher->decrypt = skcipher_decrypt_blkcipher; skcipher->ivsize =crypto_blkcipher_ivsize (blkcipher); + skcipher->has_setkey = calg->cra_blkcipher.max_keysize;return 0 ; }
@@ -210,6 +211,7 @@ int crypto_init_skcipher_ops_ablkcipher( skcipher->ivsize =crypto_ablkcipher_ivsize (ablkcipher); skcipher->reqsize =crypto_ablkcipher_reqsize (ablkcipher) +sizeof (struct ablkcipher_request ); + skcipher->has_setkey = calg->cra_ablkcipher.max_keysize;return 0 ; }
include/crypto/skcipher.h +7 -0
@@ -61,6 +61,8 @@ struct crypto_skcipher {unsigned int ivsize;unsigned int reqsize; +bool has_setkey; +struct crypto_tfm base; };
@@ -305,6 +307,11 @@ static inline int crypto_skcipher_setkeyreturn tfm->setkey (tfm, key, keylen); } +static inline bool crypto_skcipher_has_setkey (struct crypto_skcipher *tfm) +{ +return tfm->has_setkey; +} +/** * crypto_skcipher_reqtfm() - obtain cipher handle from request * @req: skcipher_request out of which the cipher handle is to be obtained
Greg Kroah-Hartman
maintainerPATCH 166/200 AHCI: Fix softreset failed issue of Port Multiplier
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiangliang Yu <[email protected]>
commit 023113d24ef9e1d2b44cb2446872b17e2b01d8b1 upstream.
Current code doesn't update port value of Port Multiplier(PM) when sending FIS of softreset to device, command will fail if FBS is enabled.
There are two ways to fix the issue: the first is to disable FBS before sending softreset command to PM device and the second is to update port value of PM when sending command.
For the first way, i can't find any related rule in AHCI Spec. The second way can avoid disabling FBS and has better performance.
--- drivers/ata/libahci.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/ata/libahci.c +9 -0
@@ -1266,6 +1266,15 @@ static int ahci_exec_polled_cmd(struct aata_tf_to_fis (tf, pmp, is_cmd, fis);ahci_fill_cmd_slot (pp,0 , cmd_fis_len | flags | (pmp <<12 )); +/* set port value for softreset of Port Multiplier */ +if (pp->fbs_enabled && pp->fbs_last_dev != pmp) { + tmp =readl (port_mmio +PORT_FBS ); + tmp &= ~(PORT_FBS_DEV_MASK |PORT_FBS_DEC ); + tmp |= pmp <<PORT_FBS_DEV_OFFSET ; +writel (tmp, port_mmio +PORT_FBS ); + pp->fbs_last_dev = pmp; + } +/* issue & wait */ writel (1 , port_mmio +PORT_CMD_ISSUE );
Greg Kroah-Hartman
maintainerPATCH 168/200 ahci: Intel DNV device IDs SATA
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandra Yates <[email protected]>
commit 342decff2b846b46fa61eb5ee40986fab79a9a32 upstream.
Adding Intel codename DNV platform device IDs for SATA.
--- drivers/ata/ahci.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+)
drivers/ata/ahci.c +20 -0
@@ -264,6 +264,26 @@ static const struct pci_device_id ahci_p { PCI_VDEVICE(INTEL, 0x3b2b), board_ahci }, /* PCH RAID */ { PCI_VDEVICE(INTEL, 0x3b2c), board_ahci }, /* PCH RAID */ { PCI_VDEVICE(INTEL, 0x3b2f), board_ahci }, /* PCH AHCI */ + { PCI_VDEVICE(INTEL, 0x19b0), board_ahci }, /* DNV AHCI */ + { PCI_VDEVICE(INTEL, 0x19b1), board_ahci }, /* DNV AHCI */ + { PCI_VDEVICE(INTEL, 0x19b2), board_ahci }, /* DNV AHCI */ + { PCI_VDEVICE(INTEL, 0x19b3), board_ahci }, /* DNV AHCI */ + { PCI_VDEVICE(INTEL, 0x19b4), board_ahci }, /* DNV AHCI */ + { PCI_VDEVICE(INTEL, 0x19b5), board_ahci }, /* DNV AHCI */ + { PCI_VDEVICE(INTEL, 0x19b6), board_ahci }, /* DNV AHCI */ + { PCI_VDEVICE(INTEL, 0x19b7), board_ahci }, /* DNV AHCI */ + { PCI_VDEVICE(INTEL, 0x19bE), board_ahci }, /* DNV AHCI */ + { PCI_VDEVICE(INTEL, 0x19bF), board_ahci }, /* DNV AHCI */ + { PCI_VDEVICE(INTEL, 0x19c0), board_ahci }, /* DNV AHCI */ + { PCI_VDEVICE(INTEL, 0x19c1), board_ahci }, /* DNV AHCI */ + { PCI_VDEVICE(INTEL, 0x19c2), board_ahci }, /* DNV AHCI */ + { PCI_VDEVICE(INTEL, 0x19c3), board_ahci }, /* DNV AHCI */ + { PCI_VDEVICE(INTEL, 0x19c4), board_ahci }, /* DNV AHCI */ + { PCI_VDEVICE(INTEL, 0x19c5), board_ahci }, /* DNV AHCI */ + { PCI_VDEVICE(INTEL, 0x19c6), board_ahci }, /* DNV AHCI */ + { PCI_VDEVICE(INTEL, 0x19c7), board_ahci }, /* DNV AHCI */ + { PCI_VDEVICE(INTEL, 0x19cE), board_ahci }, /* DNV AHCI */ + { PCI_VDEVICE(INTEL, 0x19cF), board_ahci }, /* DNV AHCI */ { PCI_VDEVICE(INTEL, 0x1c02), board_ahci }, /* CPT AHCI */ { PCI_VDEVICE(INTEL, 0x1c03), board_ahci }, /* CPT AHCI */ { PCI_VDEVICE(INTEL, 0x1c04), board_ahci }, /* CPT RAID */
Greg Kroah-Hartman
maintainerPATCH 170/200 crypto: algif_hash - Remove custom release parent function
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
commit f1d84af1835846a5a2b827382c5848faf2bb0e75 upstream.
This patch removes the custom release parent function as the generic af_alg_release_parent now works for nokey sockets too.
--- crypto/algif_hash.c | 43 +++---------------------------------------- 1 file changed, 3 insertions(+), 40 deletions(-)
crypto/algif_hash.c +3 -40
@@ -384,7 +384,7 @@ static int hash_setkey(void *private, coreturn err; } -static void hash_sock_destruct_common (struct sock *sk) +static void hash_sock_destruct (struct sock *sk) {struct alg_sock *ask =alg_sk (sk);struct hash_ctx *ctx = ask->private;
@@ -392,33 +392,10 @@ static void hash_sock_destruct_common(stsock_kzfree_s (sk, ctx->result,crypto_ahash_digestsize (crypto_ahash_reqtfm (&ctx->req)));sock_kfree_s (sk, ctx, ctx->len); -} - -static void hash_sock_destruct (struct sock *sk) -{ -hash_sock_destruct_common (sk); -af_alg_release_parent (sk); -} - -static void hash_release_parent_nokey (struct sock *sk) -{ -struct alg_sock *ask =alg_sk (sk); - -if (!ask->refcnt) { -sock_put (ask->parent); -return ; - } -af_alg_release_parent (sk); } -static void hash_sock_destruct_nokey (struct sock *sk) -{ -hash_sock_destruct_common (sk); -hash_release_parent_nokey (sk); -} - -static int hash_accept_parent_common (void *private,struct sock *sk) +static int hash_accept_parent_nokey (void *private,struct sock *sk) {struct hash_ctx *ctx;struct alg_sock *ask =alg_sk (sk);
@@ -461,21 +438,7 @@ static int hash_accept_parent(void *privif (!tfm->has_key &&crypto_ahash_has_setkey (tfm->hash))return -ENOKEY ; -return hash_accept_parent_common (private, sk); -} - -static int hash_accept_parent_nokey (void *private,struct sock *sk) -{ -int err; - - err =hash_accept_parent_common (private, sk); -if (err) - goto out; - - sk->sk_destruct = hash_sock_destruct_nokey; - -out: -return err; +return hash_accept_parent_nokey (private, sk); }static const struct af_alg_type algif_type_hash = {
Greg Kroah-Hartman
maintainerPATCH 172/200 crypto: af_alg - Forbid bind(2) when nokey child sockets are present
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
commit a6a48c565f6f112c6983e2a02b1602189ed6e26e upstream.
This patch forbids the calling of bind(2) when there are child sockets created by accept(2) in existence, even if they are created on the nokey path.
This is needed as those child sockets have references to the tfm object which bind(2) will destroy.
--- crypto/af_alg.c | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-)
crypto/af_alg.c +7 -9
@@ -130,19 +130,16 @@ EXPORT_SYMBOL_GPL(af_alg_release);void af_alg_release_parent (struct sock *sk) {struct alg_sock *ask =alg_sk (sk); -bool last; +unsigned int nokey = ask->nokey_refcnt; +bool last = nokey && !ask->refcnt; sk = ask->parent; - -if (ask->nokey_refcnt && !ask->refcnt) { -sock_put (sk); -return ; - } - ask =alg_sk (sk);lock_sock (sk); - last = !--ask->refcnt; + ask->nokey_refcnt -= nokey; +if (!last) + last = !--ask->refcnt;release_sock (sk);if (last)
@@ -188,7 +185,7 @@ static int alg_bind(struct socket *sock, err = -EBUSY ;lock_sock (sk); -if (ask->refcnt) +if (ask->refcnt | ask->nokey_refcnt) goto unlock;swap (ask->type, type);
@@ -306,6 +303,7 @@ int af_alg_accept(struct sock *sk, strucif (nokey || !ask->refcnt++)sock_hold (sk); + ask->nokey_refcnt += nokey;alg_sk (sk2)->parent = sk;alg_sk (sk2)->type = type;alg_sk (sk2)->nokey_refcnt = nokey;
Greg Kroah-Hartman
maintainerPATCH 174/200 crypto: algif_skcipher - Fix race condition in skcipher_check_key
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
commit 1822793a523e5d5730b19cc21160ff1717421bc8 upstream.
We need to lock the child socket in skcipher_check_key as otherwise two simultaneous calls can cause the parent socket to be freed.
--- crypto/algif_skcipher.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
crypto/algif_skcipher.c +6 -3
@@ -755,22 +755,23 @@ static struct proto_ops algif_skcipher_ostatic int skcipher_check_key (struct socket *sock) { -int err; +int err =0 ;struct sock *psk;struct alg_sock *pask;struct skcipher_tfm *tfm;struct sock *sk = sock->sk;struct alg_sock *ask =alg_sk (sk); +lock_sock (sk);if (ask->refcnt) -return 0 ; + goto unlock_child; psk = ask->parent; pask =alg_sk (ask->parent); tfm = pask->private; err = -ENOKEY ; -lock_sock (psk); +lock_sock_nested (psk,SINGLE_DEPTH_NESTING );if (!tfm->has_key) goto unlock;
@@ -784,6 +785,8 @@ static int skcipher_check_key(struct soc unlock:release_sock (psk); +unlock_child: +release_sock (sk);return err; }
Greg Kroah-Hartman
maintainerPATCH 175/200 crypto: crc32c - Fix crc32c soft dependency
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jean Delvare <[email protected]>
commit fd7f6727102a1ccf6b4c1dfcc631f9b546526b26 upstream.
I don't think it makes sense for a module to have a soft dependency on itself. This seems quite cyclic by nature and I can't see what purpose it could serve.
OTOH libcrc32c calls crypto_alloc_shash("crc32c", 0, 0) so it pretty much assumes that some incarnation of the "crc32c" hash algorithm has been loaded. Therefore it makes sense to have the soft dependency there (as crc-t10dif does.)
--- crypto/crc32c_generic.c | 1 - lib/libcrc32c.c | 1 + 2 files changed, 1 insertion(+), 1 deletion(-)
crypto/crc32c_generic.c +0 -1
@@ -172,4 +172,3 @@ MODULE_DESCRIPTION("CRC32c (Castagnoli)MODULE_LICENSE ("GPL" );MODULE_ALIAS_CRYPTO ("crc32c" );MODULE_ALIAS_CRYPTO ("crc32c-generic" ); -MODULE_SOFTDEP ("pre: crc32c" );
lib/libcrc32c.c +1 -0
@@ -74,3 +74,4 @@ module_exit(libcrc32c_mod_fini);MODULE_AUTHOR ("Clay Haapala <[email protected]>" );MODULE_DESCRIPTION ("CRC32c (Castagnoli) calculations" );MODULE_LICENSE ("GPL" ); +MODULE_SOFTDEP ("pre: crc32c" );
Greg Kroah-Hartman
maintainerPATCH 180/200 crypto: shash - Fix has_key setting
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
commit 00420a65fa2beb3206090ead86942484df2275f3 upstream.
The has_key logic is wrong for shash algorithms as they always have a setkey function. So we should instead be testing against shash_no_setkey.
--- crypto/shash.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
crypto/shash.c +3 -4
@@ -354,11 +354,10 @@ int crypto_init_shash_ops_async(struct c crt->final = shash_async_final; crt->finup = shash_async_finup; crt->digest = shash_async_digest; + crt->setkey = shash_async_setkey; + + crt->has_setkey = alg->setkey != shash_no_setkey; -if (alg->setkey) { - crt->setkey = shash_async_setkey; - crt->has_setkey = true; - }if (alg->export) crt->export = shash_async_export;if (alg->import)
Greg Kroah-Hartman
maintainerPATCH 181/200 crypto: algif_hash - wait for crypto_ahash_init() to complete
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang, Rui Y <[email protected]>
commit fe09786178f9df713a4b2dd6b93c0a722346bf5e upstream.
hash_sendmsg/sendpage() need to wait for the completion of crypto_ahash_init() otherwise it can cause panic.
--- crypto/algif_hash.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
crypto/algif_hash.c +3 -1
@@ -54,7 +54,8 @@ static int hash_sendmsg(struct socket *slock_sock (sk);if (!ctx->more) { - err =crypto_ahash_init (&ctx->req); + err =af_alg_wait_for_completion (crypto_ahash_init (&ctx->req), + &ctx->completion);if (err) goto unlock; }
@@ -125,6 +126,7 @@ static ssize_t hash_sendpage(struct sock }else {if (!ctx->more) { err =crypto_ahash_init (&ctx->req); + err =af_alg_wait_for_completion (err, &ctx->completion);if (err) goto unlock; }
Greg Kroah-Hartman
maintainerPATCH 183/200 crypto: user - lock crypto_alg_list on alg dump
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Krause <[email protected]>
commit 63e41ebc6630f39422d87f8a4bade1e793f37a01 upstream.
We miss to take the crypto_alg_sem semaphore when traversing the crypto_alg_list for CRYPTO_MSG_GETALG dumps. This allows a race with crypto_unregister_alg() removing algorithms from the list while we're still traversing it, thereby leading to a use-after-free as show below:
[ 3482.071639] general protection fault: 0000 [#1] SMP [ 3482.075639] Modules linked in: aes_x86_64 glue_helper lrw ablk_helper cryptd gf128mul ipv6 pcspkr serio_raw virtio_net microcode virtio_pci virtio_ring virtio sr_mod cdrom [last unloaded: aesni_intel] [ 3482.075639] CPU: 1 PID: 11065 Comm: crconf Not tainted 4.3.4-grsec+ #126 [ 3482.075639] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140531_083030-gandalf 04/01/2014 [ 3482.075639] task: ffff88001cd41a40 ti: ffff88001cd422c8 task.ti: ffff88001cd422c8 [ 3482.075639] RIP: 0010:[<ffffffff93722bd3>] [<ffffffff93722bd3>] strncpy+0x13/0x30 [ 3482.075639] RSP: 0018:ffff88001f713b60 EFLAGS: 00010202 [ 3482.075639] RAX: ffff88001f6c4430 RBX: ffff88001f6c43a0 RCX: ffff88001f6c4430 [ 3482.075639] RDX: 0000000000000040 RSI: fefefefefefeff16 RDI: ffff88001f6c4430 [ 3482.075639] RBP: ffff88001f713b60 R08: ffff88001f6c4470 R09: ffff88001f6c4480 [ 3482.075639] R10: 0000000000000002 R11: 0000000000000246 R12: ffff88001ce2aa28 [ 3482.075639] R13: ffff880000093700 R14: ffff88001f5e4bf8 R15: 0000000000003b20 [ 3482.075639] FS: 0000033826fa2700(0000) GS:ffff88001e900000(0000) knlGS:0000000000000000 [ 3482.075639] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 3482.075639] CR2: ffffffffff600400 CR3: 00000000139ec000 CR4: 00000000001606f0 [ 3482.075639] Stack: [ 3482.075639] ffff88001f713bd8 ffffffff936ccd00 ffff88001e5c4200 ffff880000093700 [ 3482.075639] ffff88001f713bd0 ffffffff938ef4bf 0000000000000000 0000000000003b20 [ 3482.075639] ffff88001f5e4bf8 ffff88001f5e4848 0000000000000000 0000000000003b20 [ 3482.075639] Call Trace: [ 3482.075639] [<ffffffff936ccd00>] crypto_report_alg+0xc0/0x3e0 [ 3482.075639] [<ffffffff938ef4bf>] ? __alloc_skb+0x16f/0x300 [ 3482.075639] [<ffffffff936cd08a>] crypto_dump_report+0x6a/0x90 [ 3482.075639] [<ffffffff93935707>] netlink_dump+0x147/0x2e0 [ 3482.075639] [<ffffffff93935f99>] __netlink_dump_start+0x159/0x190 [ 3482.075639] [<ffffffff936ccb13>] crypto_user_rcv_msg+0xc3/0x130 [ 3482.075639] [<ffffffff936cd020>] ? crypto_report_alg+0x3e0/0x3e0 [ 3482.075639] [<ffffffff936cc4b0>] ? alg_test_crc32c+0x120/0x120 [ 3482.075639] [<ffffffff93933145>] ? __netlink_lookup+0xd5/0x120 [ 3482.075639] [<ffffffff936cca50>] ? crypto_add_alg+0x1d0/0x1d0 [ 3482.075639] [<ffffffff93938141>] netlink_rcv_skb+0xe1/0x130 [ 3482.075639] [<ffffffff936cc4f8>] crypto_netlink_rcv+0x28/0x40 [ 3482.075639] [<ffffffff939375a8>] netlink_unicast+0x108/0x180 [ 3482.075639] [<ffffffff93937c21>] netlink_sendmsg+0x541/0x770 [ 3482.075639] [<ffffffff938e31e1>] sock_sendmsg+0x21/0x40 [ 3482.075639] [<ffffffff938e4763>] SyS_sendto+0xf3/0x130 [ 3482.075639] [<ffffffff93444203>] ? bad_area_nosemaphore+0x13/0x20 [ 3482.075639] [<ffffffff93444470>] ? __do_page_fault+0x80/0x3a0 [ 3482.075639] [<ffffffff939d80cb>] entry_SYSCALL_64_fastpath+0x12/0x6e [ 3482.075639] Code: 88 4a ff 75 ed 5d 48 0f ba 2c 24 3f c3 66 66 2e 0f 1f 84 00 00 00 00 00 55 48 85 d2 48 89 f8 48 89 f9 4c 8d 04 17 48 89 e5 74 15 <0f> b6 16 80 fa 01 88 11 48 83 de ff 48 83 c1 01 4c 39 c1 75 eb [ 3482.075639] RIP [<ffffffff93722bd3>] strncpy+0x13/0x30
To trigger the race run the following loops simultaneously for a while:
$ while : ; do modprobe aesni-intel; rmmod aesni-intel; done $ while : ; do crconf show all > /dev/null; done
Fix the race by taking the crypto_alg_sem read lock, thereby preventing crypto_unregister_alg() from modifying the algorithm list during the dump.
This bug has been detected by the PaX memory sanitize feature.
--- crypto/crypto_user.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
crypto/crypto_user.c +5 -1
@@ -499,6 +499,7 @@ static int crypto_user_rcv_msg(struct skif (link->dump ==NULL )return -EINVAL ; +down_read (&crypto_alg_sem);list_for_each_entry (alg, &crypto_alg_list, cra_list) dump_alloc +=CRYPTO_REPORT_MAXSIZE ;
@@ -508,8 +509,11 @@ static int crypto_user_rcv_msg(struct sk .done = link->done, .min_dump_alloc = dump_alloc, }; -return netlink_dump_start (crypto_nlsk, skb, nlh, &c); + err =netlink_dump_start (crypto_nlsk, skb, nlh, &c); } +up_read (&crypto_alg_sem); + +return err; } err = nlmsg_parse(nlh, crypto_msg_min[type], attrs, CRYPTOCFGA_MAX,
Greg Kroah-Hartman
maintainerPATCH 186/200 crypto: algif_skcipher - Do not set MAY_BACKLOG on the async path
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
commit dad41997063723eaf5f77bc2015606a5a9bce320 upstream.
The async path cannot use MAY_BACKLOG because it is not meant to block, which is what MAY_BACKLOG does. On the other hand, both the sync and async paths can make use of MAY_SLEEP.
--- crypto/algif_skcipher.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
crypto/algif_skcipher.c +3 -2
@@ -536,7 +536,7 @@ static int skcipher_recvmsg_async(structsg_init_table (sreq->tsg, tx_nents);memcpy (iv, ctx->iv, ivsize);skcipher_request_set_tfm (req, tfm); -skcipher_request_set_callback (req,CRYPTO_TFM_REQ_MAY_BACKLOG , +skcipher_request_set_callback (req,CRYPTO_TFM_REQ_MAY_SLEEP , skcipher_async_cb, sreq);while (iov_iter_count (&msg->msg_iter)) {
@@ -950,7 +950,8 @@ static int skcipher_accept_parent_nokey( ask->private = ctx;skcipher_request_set_tfm (&ctx->req, skcipher); -skcipher_request_set_callback (&ctx->req,CRYPTO_TFM_REQ_MAY_BACKLOG , +skcipher_request_set_callback (&ctx->req,CRYPTO_TFM_REQ_MAY_SLEEP | +CRYPTO_TFM_REQ_MAY_BACKLOG , af_alg_complete, &ctx->completion); sk->sk_destruct = skcipher_sock_destruct;
Greg Kroah-Hartman
maintainerPATCH 187/200 crypto: marvell/cesa - fix test in mv_cesa_dev_dma_init()
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boris BREZILLON <[email protected]>
commit 8a3978ad55fb4c0564d285fb2f6cdee2313fce01 upstream.
We are checking twice if dma->cache_pool is not NULL but are never testing dma->padding_pool value.
--- drivers/crypto/marvell/cesa.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/crypto/marvell/cesa.c +1 -1
@@ -306,7 +306,7 @@ static int mv_cesa_dev_dma_init(struct mreturn -ENOMEM ; dma->padding_pool =dmam_pool_create ("cesa_padding" , dev,72 ,1 ,0 ); -if (!dma->cache_pool) +if (!dma->padding_pool)return -ENOMEM ; cesa->dma = dma;
Greg Kroah-Hartman
maintainerPATCH 188/200 FS-Cache: Increase reference of parent after registering, netfs success
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kinglong Mee <[email protected]>
commit 86108c2e34a26e4bec3c6ddb23390bf8cedcf391 upstream.
If netfs exist, fscache should not increase the reference of parent's usage and n_children, otherwise, never be decreased.
v2: thanks David's suggest,
move increasing reference of parent if success use kmem_cache_free() freeing primary_index directly
v3: don't move "netfs->primary_index->parent = &fscache_fsdef_index;"
--- fs/fscache/netfs.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
fs/fscache/netfs.c +4 -5
@@ -47,9 +47,6 @@ int __fscache_register_netfs(struct fsca netfs->primary_index->netfs_data = netfs; netfs->primary_index->flags =1 <<FSCACHE_COOKIE_ENABLED ; -atomic_inc (&netfs->primary_index->parent->usage); -atomic_inc (&netfs->primary_index->parent->n_children); -spin_lock_init (&netfs->primary_index->lock);INIT_HLIST_HEAD (&netfs->primary_index->backing_objects);
@@ -62,6 +59,9 @@ int __fscache_register_netfs(struct fsca goto already_registered; } +atomic_inc (&netfs->primary_index->parent->usage); +atomic_inc (&netfs->primary_index->parent->n_children); +list_add (&netfs->link, &fscache_netfs_list); ret =0 ;
@@ -71,8 +71,7 @@ already_registered:up_write (&fscache_addremove_sem);if (ret <0 ) { - netfs->primary_index->parent =NULL ; -__fscache_cookie_put (netfs->primary_index); +kmem_cache_free (fscache_cookie_jar, netfs->primary_index); netfs->primary_index =NULL ; }
Greg Kroah-Hartman
maintainerPATCH 190/200 FS-Cache: Handle a write to the page immediately beyond the EOF marker
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <[email protected]>
commit 102f4d900c9c8f5ed89ae4746d493fe3ebd7ba64 upstream.
Handle a write being requested to the page immediately beyond the EOF marker on a cache object. Currently this gets an assertion failure in CacheFiles because the EOF marker is used there to encode information about a partial page at the EOF - which could lead to an unknown blank spot in the file if we extend the file over it.
The problem is actually in fscache where we check the index of the page being written against store_limit. store_limit is set to the number of pages that we're allowed to store by fscache_set_store_limit() - which means it's one more than the index of the last page we're allowed to store. The problem is that we permit writing to a page with an index _equal_ to the store limit - when we should reject that case.
Whilst we're at it, change the triggered assertion in CacheFiles to just return -ENOBUFS instead.
The assertion failure looks something like this:
CacheFiles: Assertion failed
1000 < 7b1 is false
------------[ cut here ]------------ kernel BUG at fs/cachefiles/rdwr.c:962! ... RIP: 0010:[<ffffffffa02c9e83>] [<ffffffffa02c9e83>] cachefiles_write_page+0x273/0x2d0 [cachefiles]
--- fs/cachefiles/rdwr.c | 67 ++++++++++++++++++++++++++++----------------------- fs/fscache/page.c | 2 - 2 files changed, 38 insertions(+), 31 deletions(-)
fs/cachefiles/rdwr.c +37 -30
@@ -905,6 +905,15 @@ int cachefiles_write_page(struct fscache cache =container_of (object->fscache.cache, struct cachefiles_cache, cache); + pos = (loff_t )page->index <<PAGE_SHIFT ; + +/* We mustn't write more data than we have, so we have to beware of a +* partial page at EOF. +*/ + eof = object->fscache.store_limit_l; +if (pos >= eof) + goto error; +/* write the page to the backing filesystem and let it store it in its * own time */ path.mnt = cache->mnt;
@@ -912,40 +921,38 @@ int cachefiles_write_page(struct fscache file =dentry_open (&path,O_RDWR |O_LARGEFILE , cache->cache_cred);if (IS_ERR (file)) { ret =PTR_ERR (file); - }else { - pos = (loff_t ) page->index <<PAGE_SHIFT ; - -/* we mustn't write more data than we have, so we have -* to beware of a partial page at EOF */ - eof = object->fscache.store_limit_l; - len =PAGE_SIZE ; -if (eof & ~PAGE_MASK ) { - ASSERTCMP(pos, <, eof); -if (eof - pos <PAGE_SIZE ) { -_debug ("cut short %llx to %llx" , - pos, eof); - len = eof - pos; - ASSERTCMP(pos + len, ==, eof); - } - } - - data =kmap (page); - ret =__kernel_write (file, data, len, &pos); -kunmap (page); -if (ret != len) - ret = -EIO ; -fput (file); + goto error_2; } -if (ret <0 ) { -if (ret == -EIO ) -cachefiles_io_error_obj ( - object,"Write page to backing file failed" ); - ret = -ENOBUFS ; + len =PAGE_SIZE ; +if (eof & ~PAGE_MASK ) { +if (eof - pos <PAGE_SIZE ) { +_debug ("cut short %llx to %llx" , + pos, eof); + len = eof - pos; + ASSERTCMP(pos + len, ==, eof); + } } -_leave (" = %d" , ret); -return ret; + data =kmap (page); + ret =__kernel_write (file, data, len, &pos); +kunmap (page); +fput (file); +if (ret != len) + goto error_eio; + +_leave (" = 0" ); +return 0 ; + +error_eio: + ret = -EIO ; +error_2: +if (ret == -EIO ) +cachefiles_io_error_obj (object, +"Write page to backing file failed" ); +error: +_leave (" = -ENOBUFS [%d]" , ret); +return -ENOBUFS ; }/*
fs/fscache/page.c +1 -1
@@ -816,7 +816,7 @@ static void fscache_write_op(struct fsca goto superseded; page = results[0 ];_debug ("gang %d [%lx]" , n, page->index); -if (page->index > op->store_limit) { +if (page->index >= op->store_limit) {fscache_stat (&fscache_n_store_pages_over_limit); goto superseded; }
Greg Kroah-Hartman
maintainerPATCH 198/200 zsmalloc: fix migrate_zspage-zs_free race condition
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junil Lee <[email protected]>
commit c102f07ca0b04f2cb49cfc161c83f6239d17f491 upstream.
record_obj() in migrate_zspage() does not preserve handle's HANDLE_PIN_BIT, set by find_aloced_obj()->trypin_tag(), and implicitly (accidentally) un-pins the handle, while migrate_zspage() still performs an explicit unpin_tag() on the that handle. This additional explicit unpin_tag() introduces a race condition with zs_free(), which can pin that handle by this time, so the handle becomes un-pinned.
Schematically, it goes like this:
CPU0 CPU1
migrate_zspage
find_alloced_obj
trypin_tag
set HANDLE_PIN_BIT zs_free()
pin_tag()
obj_malloc() -- new object, no tag
record_obj() -- remove HANDLE_PIN_BIT set HANDLE_PIN_BIT
unpin_tag() -- remove zs_free's HANDLE_PIN_BIT
The race condition may result in a NULL pointer dereference:
Unable to handle kernel NULL pointer dereference at virtual address 00000000
CPU: 0 PID: 19001 Comm: CookieMonsterCl Tainted:
PC is at get_zspage_mapping+0x0/0x24
LR is at obj_free.isra.22+0x64/0x128
Call trace:
get_zspage_mapping+0x0/0x24
zs_free+0x88/0x114
zram_free_page+0x64/0xcc
zram_slot_free_notify+0x90/0x108
swap_entry_free+0x278/0x294
free_swap_and_cache+0x38/0x11c
unmap_single_vma+0x480/0x5c8
unmap_vmas+0x44/0x60
exit_mmap+0x50/0x110
mmput+0x58/0xe0
do_exit+0x320/0x8dc
do_group_exit+0x44/0xa8
get_signal+0x538/0x580
do_signal+0x98/0x4b8
do_notify_resume+0x14/0x5cThis patch keeps the lock bit in migration path and update value atomically.
--- mm/zsmalloc.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-)
mm/zsmalloc.c +13 -1
@@ -304,7 +304,12 @@ static void free_handle(struct zs_pool *static void record_obj (unsigned long handle,unsigned long obj) { - *(unsigned long *)handle = obj; +/* +* lsb of @obj represents handle lock while other bits +* represent object value the handle is pointing so +* updating shouldn't do store tearing. +*/ +WRITE_ONCE (*(unsigned long *)handle, obj); }/* zpool driver */
@@ -1629,6 +1634,13 @@ static int migrate_zspage(struct zs_pool free_obj =obj_malloc (d_page, class, handle);zs_object_copy (free_obj, used_obj, class); index++; +/* +* record_obj updates handle's value to free_obj and it will +* invalidate lock bit(ie, HANDLE_PIN_BIT) of handle, which +* breaks synchronization using pin_tag(e,g, zs_free) so +* let's keep the lock bit. +*/ + free_obj |=BIT (HANDLE_PIN_BIT );record_obj (handle, free_obj);unpin_tag (handle);obj_free (pool, class, used_obj);
Greg Kroah-Hartman
maintainerPATCH 199/200 fs/pipe.c: return error code rather than 0 in pipe_write()
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
commit 6ae08069939f17422835448acae76bda8d96b16a upstream.
pipe_write() would return 0 if it failed to merge the beginning of the data to write with the last, partially filled pipe buffer. It should return an error code instead. Userspace programs could be confused by write() returning 0 when called with a nonzero 'count'.
The EFAULT error case was a regression from f0d1bec9d5 ("new helper:copy_page_from_iter()"), while the ops->confirm() error case was a much older bug.
Test program:
#include <assert.h>
#include <errno.h>
#include <unistd.h>
int main(void)
{
int fd[2];
char data[1] = {0};
assert(0 == pipe(fd));
assert(1 == write(fd[1], data, 1));
/* prior to this patch, write() returned 0 here */
assert(-1 == write(fd[1], NULL, 1));
assert(errno == EFAULT);
}--- fs/pipe.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
fs/pipe.c +4 -5
@@ -366,18 +366,17 @@ pipe_write(struct kiocb *iocb, struct ioint offset = buf->offset + buf->len;if (ops->can_merge && offset + chars <=PAGE_SIZE ) { -int error = ops->confirm (pipe, buf); -if (error) + ret = ops->confirm (pipe, buf); +if (ret) goto out; ret =copy_page_from_iter (buf->page, offset, chars, from);if (unlikely (ret < chars)) { - error = -EFAULT ; + ret = -EFAULT ; goto out; } do_wakeup =1 ; - buf->len += chars; - ret = chars; + buf->len += ret;if (!iov_iter_count (from)) goto out; }
Greg Kroah-Hartman
maintainerPATCH 200/200 binfmt_elf: Dont clobber passed executables file header
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej W. Rozycki <[email protected]>
commit b582ef5c53040c5feef4c96a8f9585b6831e2441 upstream.
Do not clobber the buffer space passed from search_binary_handler' and originally preloaded by prepare_binprm' with the executable's file header by overwriting it with its interpreter's file header. Instead keep the buffer space intact and directly use the data structure locally allocated for the interpreter's file header, fixing a bug introduced in 2.1.14 with loadable module support (linux-mips.org commit beb11695 [Import of Linux/MIPS 2.1.14], predating kernel.org repo's history). Adjust the amount of data read from the interpreter's file accordingly.
This was not an issue before loadable module support, because back then `load_elf_binary' was executed only once for a given ELF executable, whether the function succeeded or failed.
With loadable module support supported and enabled, upon a failure of `load_elf_binary' -- which may for example be caused by architecture code rejecting an executable due to a missing hardware feature requested in the file header -- a module load is attempted and then the function reexecuted by `search_binary_handler'. With the executable's file header replaced with its interpreter's file header the executable can then be erroneously accepted in this subsequent attempt.
--- fs/binfmt_elf.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
fs/binfmt_elf.c +5 -5
@@ -759,16 +759,16 @@ static int load_elf_binary(struct linux_*/ would_dump (bprm, interpreter); - retval =kernel_read (interpreter,0 , bprm->buf, -BINPRM_BUF_SIZE ); -if (retval !=BINPRM_BUF_SIZE ) { +/* Get the exec headers */ + retval =kernel_read (interpreter,0 , + (void *)&loc->interp_elf_ex, +sizeof (loc->interp_elf_ex)); +if (retval !=sizeof (loc->interp_elf_ex)) {if (retval >=0 ) retval = -EIO ; goto out_free_dentry; } -/* Get the exec headers */ - loc->interp_elf_ex = *((struct elfhdr *)bprm->buf);break ; } elf_ppnt++;
Greg Kroah-Hartman
maintainerPATCH 1/200 crypto: crc32c-pclmul - use .rodata instead of .rotata
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolas Iooss <[email protected]>
commit 97bce7e0b58dfc7d159ded329f57961868fb060b upstream.
Module crc32c-intel uses a special read-only data section named .rotata. This section is defined for K_table, and its name seems to be a spelling mistake for .rodata.
--- arch/x86/crypto/crc32c-pcl-intel-asm_64.S | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/crypto/crc32c-pcl-intel-asm_64.S +1 -1
@@ -330,7 +330,7 @@ ENDPROC(crc_pcl) ## PCLMULQDQ tables ## Table is 128 entries x 2 words (8 bytes) each ################################################################ -.section .rotata, "a", %progbits +.section .rodata, "a", %progbits .align 8 K_table: .long 0x493c7d27, 0x00000001
Greg Kroah-Hartman
maintainerPATCH 10/200 crypto: sun4i-ss - add missing statesize
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: LABBE Corentin <[email protected]>
commit 4f9ea86604e3ba64edd2817795798168fbb3c1a6 upstream.
sun4i-ss implementaton of md5/sha1 is via ahash algorithms. Commit 8996eafdcbad ("crypto: ahash - ensure statesize is non-zero") made impossible to load them without giving statesize. This patch specifiy statesize for sha1 and md5.
--- drivers/crypto/sunxi-ss/sun4i-ss-core.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/crypto/sunxi-ss/sun4i-ss-core.c +2 -0
@@ -39,6 +39,7 @@ static struct sun4i_ss_alg_template ss_a .import = sun4i_hash_import_md5, .halg = { .digestsize = MD5_DIGEST_SIZE, + .statesize = sizeof(struct md5_state), .base = { .cra_name = "md5", .cra_driver_name = "md5-sun4i-ss",
@@ -66,6 +67,7 @@ static struct sun4i_ss_alg_template ss_a .import = sun4i_hash_import_sha1, .halg = { .digestsize = SHA1_DIGEST_SIZE, + .statesize = sizeof(struct sha1_state), .base = { .cra_name = "sha1", .cra_driver_name = "sha1-sun4i-ss",
Greg Kroah-Hartman
maintainerPATCH 11/200 block: Always check queue limits for cloned requests
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hannes Reinecke <[email protected]>
commit bf4e6b4e757488dee1b6a581f49c7ac34cd217f8 upstream.
When a cloned request is retried on other queues it always needs to be checked against the queue limits of that queue. Otherwise the calculations for nr_phys_segments might be wrong, leading to a crash in scsi_init_sgtable().
To clarify this the patch renames blk_rq_check_limits() to blk_cloned_rq_check_limits() and removes the symbol export, as the new function should only be used for cloned requests and never exported.
--- block/blk-core.c | 21 +++++++-------------- include/linux/blkdev.h | 1 - 2 files changed, 7 insertions(+), 15 deletions(-)
block/blk-core.c +7 -14
@@ -2023,7 +2023,8 @@ void submit_bio(int rw, struct bio *bio)EXPORT_SYMBOL (submit_bio);/** -* blk_rq_check_limits - Helper function to check a request for the queue limit +* blk_cloned_rq_check_limits - Helper function to check a cloned request +* for new the queue limits * @q: the queue * @rq: the request being checked *
@@ -2034,20 +2035,13 @@ EXPORT_SYMBOL(submit_bio);* after it is inserted to @q, it should be checked against @q before * the insertion using this generic function. * -* This function should also be useful for request stacking drivers -* in some cases below, so export this function. * Request stacking drivers like request-based dm may change the queue -* limits while requests are in the queue (e.g. dm's table swapping). -* Such request stacking drivers should check those requests against -* the new queue limits again when they dispatch those requests, -* although such checkings are also done against the old queue limits -* when submitting requests. +* limits when retrying requests on other queues. Those requests need +* to be checked against the new queue limits again during dispatch. */ -int blk_rq_check_limits (struct request_queue *q,struct request *rq) +static int blk_cloned_rq_check_limits (struct request_queue *q, +struct request *rq) { -if (!rq_mergeable (rq)) -return 0 ; -if (blk_rq_sectors (rq) >blk_queue_get_max_sectors (q, rq->cmd_flags)) {printk (KERN_ERR "%s: over max size limit.\n" , __func__);return -EIO ;
@@ -2067,7 +2061,6 @@ int blk_rq_check_limits(struct request_qreturn 0 ; } -EXPORT_SYMBOL_GPL (blk_rq_check_limits);/** * blk_insert_cloned_request - Helper for stacking drivers to submit a request
@@ -2079,7 +2072,7 @@ int blk_insert_cloned_request(struct requnsigned long flags;int where =ELEVATOR_INSERT_BACK ; -if (blk_rq_check_limits (q, rq)) +if (blk_cloned_rq_check_limits (q, rq))return -EIO ; if (rq->rq_disk &&
include/linux/blkdev.h +0 -1
@@ -767,7 +767,6 @@ extern void blk_rq_set_block_pc(struct rextern void blk_requeue_request (struct request_queue *,struct request *);extern void blk_add_request_payload (struct request *rq,struct page *page,unsigned int len); -extern int blk_rq_check_limits (struct request_queue *q,struct request *rq);extern int blk_lld_busy (struct request_queue *q); extern int blk_rq_prep_clone(struct request *rq, struct request *rq_src, struct bio_set *bs, gfp_t gfp_mask,
Greg Kroah-Hartman
maintainerPATCH 15/200 NFSv4.1/pnfs: Fixup an lo->plh_block_lgets imbalance in layoutreturn
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
commit 1a093ceb053832c25b92f3cf26b957543c7baf9b upstream.
Since commit 2d8ae84fbc32, nothing is bumping lo->plh_block_lgets in the layoutreturn path, so it should not be touched in nfs4_layoutreturn_release either.
--- fs/nfs/nfs4proc.c | 1 - 1 file changed, 1 deletion(-)
fs/nfs/nfs4proc.c +0 -1
@@ -8060,7 +8060,6 @@ static void nfs4_layoutreturn_release(vopnfs_set_layout_stateid (lo, &lrp->res.stateid, true);pnfs_mark_matching_lsegs_invalid (lo, &freeme, &lrp->args.range);pnfs_clear_layoutreturn_waitbit (lo); - lo->plh_block_lgets--;spin_unlock (&lo->plh_inode->i_lock);pnfs_free_lseg_list (&freeme);pnfs_put_layout_hdr (lrp->args.layout);
Greg Kroah-Hartman
maintainerPATCH 16/200 ocfs2: NFS hangs in __ocfs2_cluster_lock due to race with ocfs2_unblock_lock
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tariq Saeed <[email protected]>
commit b1b1e15ef6b80facf76d6757649dfd7295eda29f upstream.
NFS on a 2 node ocfs2 cluster each node exporting dir. The lock causing the hang is the global bit map inode lock. Node 1 is master, has the lock granted in PR mode; Node 2 is in the converting list (PR -> EX). There are no holders of the lock on the master node so it should downconvert to NL and grant EX to node 2 but that does not happen. BLOCKED + QUEUED in lock res are set and it is on osb blocked list. Threads are waiting in __ocfs2_cluster_lock on BLOCKED. One thread wants EX, rest want PR. So it is as though the downconvert thread needs to be kicked to complete the conv.
The hang is caused by an EX req coming into __ocfs2_cluster_lock on the heels of a PR req after it sets BUSY (drops l_lock, releasing EX thread), forcing the incoming EX to wait on BUSY without doing anything. PR has called ocfs2_dlm_lock, which sets the node 1 lock from NL -> PR, queues ast.
At this time, upconvert (PR ->EX) arrives from node 2, finds conflict with node 1 lock in PR, so the lock res is put on dlm thread's dirty listt.
After ret from ocf2_dlm_lock, PR thread now waits behind EX on BUSY till awoken by ast.
Now it is dlm_thread that serially runs dlm_shuffle_lists, ast, bast, in that order. dlm_shuffle_lists ques a bast on behalf of node 2 (which will be run by dlm_thread right after the ast). ast does its part, sets UPCONVERT_FINISHING, clears BUSY and wakes its waiters. Next, dlm_thread runs bast. It sets BLOCKED and kicks dc thread. dc thread runs ocfs2_unblock_lock, but since UPCONVERT_FINISHING set, skips doing anything and reques.
Inside of __ocfs2_cluster_lock, since EX has been waiting on BUSY ahead of PR, it wakes up first, finds BLOCKED set and skips doing anything but clearing UPCONVERT_FINISHING (which was actually "meant" for the PR thread), and this time waits on BLOCKED. Next, the PR thread comes out of wait but since UPCONVERT_FINISHING is not set, it skips updating the l_ro_holders and goes straight to wait on BLOCKED. So there, we have a hang! Threads in __ocfs2_cluster_lock wait on BLOCKED, lock res in osb blocked list. Only when dc thread is awoken, it will run ocfs2_unblock_lock and things will unhang.
One way to fix this is to wake the dc thread on the flag after clearing UPCONVERT_FINISHING
Orabug: 20933419
--- fs/ocfs2/dlmglue.c | 6 ++++++ 1 file changed, 6 insertions(+)
fs/ocfs2/dlmglue.c +6 -0
@@ -1390,6 +1390,7 @@ static int __ocfs2_cluster_lock(struct ounsigned int gen;int noqueue_attempted =0 ;int dlm_locked =0 ; +int kick_dc =0 ;if (!(lockres->l_flags &OCFS2_LOCK_INITIALIZED )) {mlog_errno (-EINVAL );
@@ -1524,7 +1525,12 @@ update_holders: unlock:lockres_clear_flags (lockres,OCFS2_LOCK_UPCONVERT_FINISHING ); +/* ocfs2_unblock_lock reques on seeing OCFS2_LOCK_UPCONVERT_FINISHING */ + kick_dc = (lockres->l_flags &OCFS2_LOCK_BLOCKED ); +spin_unlock_irqrestore (&lockres->l_lock, flags); +if (kick_dc) +ocfs2_wake_downconvert_thread (osb); out:/* * This is helping work around a lock inversion between the page lock
Greg Kroah-Hartman
maintainerPATCH 17/200 HID: usbhid: fix recursive deadlock
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ioan-Adrian Ratiu <[email protected]>
commit e470127e9606b1fa151c4184243e61296d1e0c0f upstream.
The critical section protected by usbhid->lock in hid_ctrl() is too big and because of this it causes a recursive deadlock. "Too big" means the case statement and the call to hid_input_report() do not need to be protected by the spinlock (no URB operations are done inside them).
The deadlock happens because in certain rare cases drivers try to grab the lock while handling the ctrl irq which grabs the lock before them as described above. For example newer wacom tablets like 056a:033c try to reschedule proximity reads from wacom_intuos_schedule_prox_event() calling hid_hw_request() -> usbhid_request() -> usbhid_submit_report() which tries to grab the usbhid lock already held by hid_ctrl().
There are two ways to get out of this deadlock:
1. Make the drivers work "around" the ctrl critical region, in the wacom case for ex. by delaying the scheduling of the proximity read request itself to a workqueue.
2. Shrink the critical region so the usbhid lock protects only the instructions which modify usbhid state, calling hid_input_report() with the spinlock unlocked, allowing the device driver to grab the lock first, finish and then grab the lock afterwards in hid_ctrl().
This patch implements the 2nd solution.
--- drivers/hid/usbhid/hid-core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/hid/usbhid/hid-core.c +2 -2
@@ -477,8 +477,6 @@ static void hid_ctrl(struct urb *urb)struct usbhid_device *usbhid = hid->driver_data;int unplug =0 , status = urb->status; -spin_lock (&usbhid->lock); -switch (status) {case 0 :/* success */ if (usbhid->ctrl[usbhid->ctrltail].dir ==USB_DIR_IN )
@@ -498,6 +496,8 @@ static void hid_ctrl(struct urb *urb)hid_warn (urb->dev,"ctrl urb status %d received\n" , status); } +spin_lock (&usbhid->lock); +if (unplug) { usbhid->ctrltail = usbhid->ctrlhead; }else {
Greg Kroah-Hartman
maintainerPATCH 2/200 crypto: caam - fix non-block aligned hash calculation
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Russell King <[email protected]>
commit c7556ff7e3e4f2747583bcc787f12ec9460ec3a6 upstream.
caam does not properly calculate the size of the retained state when non-block aligned hashes are requested - it uses the wrong buffer sizes, which results in errors such as:
caam_jr 2102000.jr1: 40000501: DECO: desc idx 5: SGT Length Error. The descriptor is trying to read more data than is contained in the SGT table.
We end up here with:
in_len 0x46 blocksize 0x40 last_bufsize 0x0 next_bufsize 0x6 to_hash 0x40 ctx_len 0x28 nbytes 0x20
which results in a job descriptor of:
jobdesc@889: ed03d918: b0861c08 3daa0080 f1400000 3d03d938 jobdesc@889: ed03d928: 00000068 f8400000 3cde2a40 00000028
where the word at 0xed03d928 is the expected data size (0x68), and a scatterlist containing:
sg@892: ed03d938: 00000000 3cde2a40 00000028 00000000 sg@892: ed03d948: 00000000 3d03d100 00000006 00000000 sg@892: ed03d958: 00000000 7e8aa700 40000020 00000000
0x68 comes from 0x28 (the context size) plus the "in_len" rounded down to a block size (0x40). in_len comes from 0x26 bytes of unhashed data from the previous operation, plus the 0x20 bytes from the latest operation.
The fixed version would create:
sg@892: ed03d938: 00000000 3cde2a40 00000028 00000000 sg@892: ed03d948: 00000000 3d03d100 00000026 00000000 sg@892: ed03d958: 00000000 7e8aa700 40000020 00000000
which replaces the 0x06 length with the correct 0x26 bytes of previously unhashed data.
This fixes a previous commit which erroneously "fixed" this due to a DMA-API bug report; that commit indicates that the bug was caused via a test_ahash_pnum() function in the tcrypt module. No such function has ever existed in the mainline kernel. Given that the change in this commit has been tested with DMA API debug enabled and shows no issue, I can only conclude that test_ahash_pnum() was triggering that bad behaviour by CAAM.
--- drivers/crypto/caam/caamhash.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/crypto/caam/caamhash.c +1 -1
@@ -829,7 +829,7 @@ static int ahash_update_ctx(struct ahash state->buf_dma =try_buf_map_to_sec4_sg (jrdev, edesc->sec4_sg +1 , buf, state->buf_dma, - *next_buflen, *buflen); + *buflen, last_buflen);if (src_nents) { src_map_to_sec4_sg(jrdev, req->src, src_nents,
Greg Kroah-Hartman
maintainerPATCH 20/200 remoteproc: avoid stack overflow in debugfs file
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
commit 92792e48e2ae6051af30468a87994b5432da2f06 upstream.
Recent gcc versions warn about reading from a negative offset of an on-stack array:
drivers/remoteproc/remoteproc_debugfs.c: In function 'rproc_recovery_write':drivers/remoteproc/remoteproc_debugfs.c:167:9: warning: 'buf[4294967295u]' may be used uninitialized in this function [-Wmaybe-uninitialized]
I don't see anything in sys_write() that prevents us from being called with a zero 'count' argument, so we should add an extra check in rproc_recovery_write() to prevent the access and avoid the warning.
--- drivers/remoteproc/remoteproc_debugfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/remoteproc/remoteproc_debugfs.c +1 -1
@@ -156,7 +156,7 @@ rproc_recovery_write(struct file *filp,char buf[10 ];int ret; -if (count >sizeof (buf)) +if (count <1 || count >sizeof (buf))return count; ret =copy_from_user (buf, user_buf, count);
Greg Kroah-Hartman
maintainerPATCH 28/200 mm, vmstat: allow WQ concurrency to discover memory reclaim doesnt make any progress
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Hocko <[email protected]>
commit 373ccbe5927034b55bdc80b0f8b54d6e13fe8d12 upstream.
Tetsuo Handa has reported that the system might basically livelock in OOM condition without triggering the OOM killer.
The issue is caused by internal dependency of the direct reclaim on vmstat counter updates (via zone_reclaimable) which are performed from the workqueue context. If all the current workers get assigned to an allocation request, though, they will be looping inside the allocator trying to reclaim memory but zone_reclaimable can see stalled numbers so it will consider a zone reclaimable even though it has been scanned way too much. WQ concurrency logic will not consider this situation as a congested workqueue because it relies that worker would have to sleep in such a situation. This also means that it doesn't try to spawn new workers or invoke the rescuer thread if the one is assigned to the queue.
In order to fix this issue we need to do two things. First we have to let wq concurrency code know that we are in trouble so we have to do a short sleep. In order to prevent from issues handled by 0e093d99763e ("writeback: do not sleep on the congestion queue if there are no congested BDIs or if significant congestion is not being encountered in the current zone") we limit the sleep only to worker threads which are the ones of the interest anyway.
The second thing to do is to create a dedicated workqueue for vmstat and mark it WQ_MEM_RECLAIM to note it participates in the reclaim and to have a spare worker thread for it.
--- mm/backing-dev.c | 19 ++++++++++++++++--- mm/vmstat.c | 6 ++++-- 2 files changed, 20 insertions(+), 5 deletions(-)
mm/backing-dev.c +16 -3
@@ -957,8 +957,9 @@ EXPORT_SYMBOL(congestion_wait);* jiffies for either a BDI to exit congestion of the given @sync queue * or a write to complete. * -* In the absence of zone congestion, cond_resched() is called to yield -* the processor if necessary but otherwise does not sleep. +* In the absence of zone congestion, a short sleep or a cond_resched is +* performed to yield the processor and to allow other subsystems to make +* a forward progress. * * The return value is 0 if the sleep is for the full timeout. Otherwise, * it is the number of jiffies that were still remaining when the function
@@ -978,7 +979,19 @@ long wait_iff_congested(struct zone *zon*/ if (atomic_read (&nr_wb_congested[sync]) ==0 || !test_bit (ZONE_CONGESTED , &zone->flags)) { -cond_resched (); + +/* +* Memory allocation/reclaim might be called from a WQ +* context and the current implementation of the WQ +* concurrency control doesn't recognize that a particular +* WQ is congested if the worker thread is looping without +* ever sleeping. Therefore we have to do a short sleep +* here rather than calling cond_resched(). +*/ +if (current->flags &PF_WQ_WORKER ) +schedule_timeout (1 ); +else +cond_resched ();/* In case we scheduled, work out time remaining */ ret = timeout - (jiffies - start);
mm/vmstat.c +4 -2
@@ -1357,6 +1357,7 @@ static const struct file_operations proc#endif /* CONFIG_PROC_FS */ #ifdef CONFIG_SMP +static struct workqueue_struct *vmstat_wq; static DEFINE_PER_CPU(struct delayed_work, vmstat_work);int sysctl_stat_interval__read_mostly =HZ ;static cpumask_var_t cpu_stat_off;
@@ -1369,7 +1370,7 @@ static void vmstat_update(struct work_st* to occur in the future. Keep on running the * update worker thread. */ -schedule_delayed_work_on (smp_processor_id (), +queue_delayed_work_on (smp_processor_id (), vmstat_wq,this_cpu_ptr (&vmstat_work),round_jiffies_relative (sysctl_stat_interval)); }else {
@@ -1438,7 +1439,7 @@ static void vmstat_shepherd(struct work_if (need_update (cpu) &&cpumask_test_and_clear_cpu (cpu, cpu_stat_off)) -schedule_delayed_work_on (cpu, +queue_delayed_work_on (cpu, vmstat_wq, &per_cpu (vmstat_work, cpu),0 );put_online_cpus ();
@@ -1527,6 +1528,7 @@ static int __init setup_vmstat(void)start_shepherd_timer ();cpu_notifier_register_done (); + vmstat_wq =alloc_workqueue ("vmstat" ,WQ_FREEZABLE |WQ_MEM_RECLAIM ,0 );#endif #ifdef CONFIG_PROC_FS proc_create ("buddyinfo" ,S_IRUGO ,NULL , &fragmentation_file_operations);
Greg Kroah-Hartman
maintainerPATCH 32/200 kernel/signal.c: unexport sigsuspend()
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Weinberger <[email protected]>
commit 9d8a765211335cfdad464b90fb19f546af5706ae upstream.
sigsuspend() is nowhere used except in signal.c itself, so we can mark it static do not pollute the global namespace.
But this patch is more than a boring cleanup patch, it fixes a real issue on UserModeLinux. UML has a special console driver to display ttys using xterm, or other terminal emulators, on the host side. Vegard reported that sometimes UML is unable to spawn a xterm and he's facing the following warning:
WARNING: CPU: 0 PID: 908 at include/linux/thread_info.h:128 sigsuspend+0xab/0xc0()
It turned out that this warning makes absolutely no sense as the UML xterm code calls sigsuspend() on the host side, at least it tries. But as the kernel itself offers a sigsuspend() symbol the linker choose this one instead of the glibc wrapper. Interestingly this code used to work since ever but always blocked signals on the wrong side. Some recent kernel change made the WARN_ON() trigger and uncovered the bug.
It is a wonderful example of how much works by chance on computers. :-)
--- include/linux/signal.h | 1 - kernel/signal.c | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-)
include/linux/signal.h +0 -1
@@ -239,7 +239,6 @@ extern int sigprocmask(int, sigset_t *,extern void set_current_blocked (sigset_t *);extern void __set_current_blocked (const sigset_t *);extern int show_unhandled_signals; -extern int sigsuspend (sigset_t *);struct sigaction {#ifndef __ARCH_HAS_IRIX_SIGACTION
kernel/signal.c +1 -1
@@ -3552,7 +3552,7 @@ SYSCALL_DEFINE0(pause)#endif -int sigsuspend (sigset_t *set) +static int sigsuspend (sigset_t *set) { current->saved_sigmask = current->blocked;set_current_blocked (set);
Greg Kroah-Hartman
maintainerPATCH 35/200 ocfs2: fix BUG when calculate new backup super
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joseph Qi <[email protected]>
commit 5c9ee4cbf2a945271f25b89b137f2c03bbc3be33 upstream.
When resizing, it firstly extends the last gd. Once it should backup super in the gd, it calculates new backup super and update the corresponding value.
But it currently doesn't consider the situation that the backup super is already done. And in this case, it still sets the bit in gd bitmap and then decrease from bg_free_bits_count, which leads to a corrupted gd and trigger the BUG in ocfs2_block_group_set_bits:
BUG_ON(le16_to_cpu(bg->bg_free_bits_count) < num_bits);
So check whether the backup super is done and then do the updates.
--- fs/ocfs2/resize.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-)
fs/ocfs2/resize.c +12 -3
@@ -54,11 +54,12 @@static u16 ocfs2_calc_new_backup_super (struct inode *inode,struct ocfs2_group_desc *gd,u16 cl_cpg, +u16 old_bg_clusters,int set) {int i;u16 backups =0 ; -u32 cluster; +u32 cluster, lgd_cluster;u64 blkno, gd_blkno, lgd_blkno =le64_to_cpu (gd->bg_blkno);for (i =0 ; i <OCFS2_MAX_BACKUP_SUPERBLOCKS ; i++) {
@@ -71,6 +72,12 @@ static u16 ocfs2_calc_new_backup_super(selse if (gd_blkno > lgd_blkno)break ; +/* check if already done backup super */ + lgd_cluster =ocfs2_blocks_to_clusters (inode->i_sb, lgd_blkno); + lgd_cluster += old_bg_clusters; +if (lgd_cluster >= cluster) +continue ; +if (set)ocfs2_set_bit (cluster % cl_cpg, (unsigned long *)gd->bg_bitmap);
@@ -99,6 +106,7 @@ static int ocfs2_update_last_group_and_iu16 chain, num_bits, backups =0 ;u16 cl_bpc =le16_to_cpu (cl->cl_bpc);u16 cl_cpg =le16_to_cpu (cl->cl_cpg); +u16 old_bg_clusters;trace_ocfs2_update_last_group_and_inode (new_clusters, first_new_cluster);
@@ -112,6 +120,7 @@ static int ocfs2_update_last_group_and_i group = (struct ocfs2_group_desc *)group_bh->b_data; + old_bg_clusters =le16_to_cpu (group->bg_bits) / cl_bpc;/* update the group first. */ num_bits = new_clusters * cl_bpc;le16_add_cpu (&group->bg_bits, num_bits);
@@ -125,7 +134,7 @@ static int ocfs2_update_last_group_and_i OCFS2_FEATURE_COMPAT_BACKUP_SB)) { backups =ocfs2_calc_new_backup_super (bm_inode, group, - cl_cpg,1 ); + cl_cpg, old_bg_clusters,1 );le16_add_cpu (&group->bg_free_bits_count,-1 * backups); }
@@ -163,7 +172,7 @@ out_rollback:if (ret <0 ) {ocfs2_calc_new_backup_super (bm_inode, group, - cl_cpg,0 ); + cl_cpg, old_bg_clusters,0 );le16_add_cpu (&group->bg_free_bits_count, backups);le16_add_cpu (&group->bg_bits,-1 * num_bits);le16_add_cpu (&group->bg_free_bits_count,-1 * num_bits);
Greg Kroah-Hartman
maintainerPATCH 36/200 ocfs2/dlm: ignore cleaning the migration mle that is inuse
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: xuejiufei <[email protected]>
commit bef5502de074b6f6fa647b94b73155d675694420 upstream.
We have found that migration source will trigger a BUG that the refcount of mle is already zero before put when the target is down during migration. The situation is as follows:
dlm_migrate_lockres
dlm_add_migration_mle
dlm_mark_lockres_migrating
dlm_get_mle_inuse
<<<<<< Now the refcount of the mle is 2. dlm_send_one_lockres and wait for the target to become the new master.
<<<<<< o2hb detect the target down and clean the migration mle. Now the refcount is 1.
dlm_migrate_lockres woken, and put the mle twice when found the target goes down which trigger the BUG with the following message:
"ERROR: bad mle: ".
--- fs/ocfs2/dlm/dlmmaster.c | 26 +++++++++++++++----------- 1 file changed, 15 insertions(+), 11 deletions(-)
fs/ocfs2/dlm/dlmmaster.c +15 -11
@@ -2519,6 +2519,11 @@ static int dlm_migrate_lockres(struct dlspin_lock (&dlm->master_lock); ret =dlm_add_migration_mle (dlm, res, mle, &oldmle, name, namelen, target, dlm->node_num); +/* get an extra reference on the mle. +* otherwise the assert_master from the new +* master will destroy this. +*/ +dlm_get_mle_inuse (mle);spin_unlock (&dlm->master_lock);spin_unlock (&dlm->spinlock);
@@ -2554,6 +2559,7 @@ fail:if (mle_added) {dlm_mle_detach_hb_events (dlm, mle);dlm_put_mle (mle); +dlm_put_mle_inuse (mle); }else if (mle) {kmem_cache_free (dlm_mle_cache, mle); mle =NULL ;
@@ -2571,17 +2577,6 @@ fail:* ensure that all assert_master work is flushed. */ flush_workqueue (dlm->dlm_worker); -/* get an extra reference on the mle. -* otherwise the assert_master from the new -* master will destroy this. -* also, make sure that all callers of dlm_get_mle -* take both dlm->spinlock and dlm->master_lock */ -spin_lock (&dlm->spinlock); -spin_lock (&dlm->master_lock); -dlm_get_mle_inuse (mle); -spin_unlock (&dlm->master_lock); -spin_unlock (&dlm->spinlock); -/* notify new node and send all lock state */ /* call send_one_lockres with migration flag. * this serves as notice to the target node that a
@@ -3310,6 +3305,15 @@ top: mle->new_master != dead_node)continue ; +if (mle->new_master == dead_node && mle->inuse) { +mlog (ML_NOTICE ,"%s: target %u died during " +"migration from %u, the MLE is " +"still keep used, ignore it!\n" , + dlm->name, dead_node, + mle->master); +continue ; + } +/* If we have reached this point, this mle needs to be * removed from the list and freed. */ dlm_clean_migration_mle (dlm, mle);
Greg Kroah-Hartman
maintainerPATCH 37/200 ocfs2/dlm: clear refmap bit of recovery lock while doing local recovery cleanup
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: xuejiufei <[email protected]>
commit c95a51807b730e4681e2ecbdfd669ca52601959e upstream.
When recovery master down, dlm_do_local_recovery_cleanup() only remove the $RECOVERY lock owned by dead node, but do not clear the refmap bit. Which will make umount thread falling in dead loop migrating $RECOVERY to the dead node.
--- fs/ocfs2/dlm/dlmrecovery.c | 2 ++ 1 file changed, 2 insertions(+)
fs/ocfs2/dlm/dlmrecovery.c +2 -0
@@ -2360,6 +2360,8 @@ static void dlm_do_local_recovery_cleanubreak ; } } +dlm_lockres_clear_refmap_bit (dlm, res, + dead_node);spin_unlock (&res->spinlock);continue ; }
Greg Kroah-Hartman
maintainerPATCH 39/200 dm: initialize non-blk-mq queue data before queue is used
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <[email protected]>
commit ad5f498f610fa3fd8bd265139098bc1405cd2783 upstream.
Commit bfebd1cdb497a57757c83f5fbf1a29931591e2a4 ("dm: add full blk-mq support to request-based DM") moves the initialization of the fields backing_dev_info.congested_fn, backing_dev_info.congested_data and queuedata from the function dm_init_md_queue (that is called when the device is created) to dm_init_old_md_queue (that is called after the device type is determined).
There is no locking when accessing these variables, thus it is possible for other parts of the kernel to briefly see this data in a transient state (e.g. queue->backing_dev_info.congested_fn initialized and md->queue->backing_dev_info.congested_data uninitialized, resulting in passing an incorrect parameter to the function dm_any_congested).
This queue data is left initialized for blk-mq devices even though they that don't use it.
--- drivers/md/dm.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/md/dm.c +7 -3
@@ -2198,6 +2198,13 @@ static void dm_init_md_queue(struct mapp* This queue is new, so no concurrency on the queue_flags. */ queue_flag_clear_unlocked (QUEUE_FLAG_STACKABLE , md->queue); + +/* +* Initialize data that will only be used by a non-blk-mq DM queue +* - must do so here (in alloc_dev callchain) before queue is used +*/ + md->queue->queuedata = md; + md->queue->backing_dev_info.congested_data = md; }static void dm_init_old_md_queue (struct mapped_device *md)
@@ -2208,10 +2215,7 @@ static void dm_init_old_md_queue(struct/* * Initialize aspects of queue that aren't relevant for blk-mq */ - md->queue->queuedata = md; md->queue->backing_dev_info.congested_fn = dm_any_congested; - md->queue->backing_dev_info.congested_data = md; -blk_queue_bounce_limit (md->queue,BLK_BOUNCE_ANY ); }
Greg Kroah-Hartman
maintainerPATCH 4/200 crypto: algif_hash - Only export and import on sockets with data
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
commit 4afa5f9617927453ac04b24b584f6c718dfb4f45 upstream.
The hash_accept call fails to work on sockets that have not received any data. For some algorithm implementations it may cause crashes.
This patch fixes this by ensuring that we only export and import on sockets that have received data.
--- crypto/algif_hash.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
crypto/algif_hash.c +10 -2
@@ -181,9 +181,14 @@ static int hash_accept(struct socket *sostruct sock *sk2;struct alg_sock *ask2;struct hash_ctx *ctx2; +bool more;int err; - err =crypto_ahash_export (req, state); +lock_sock (sk); + more = ctx->more; + err = more ?crypto_ahash_export (req, state) :0 ; +release_sock (sk); +if (err)return err;
@@ -194,7 +199,10 @@ static int hash_accept(struct socket *so sk2 = newsock->sk; ask2 =alg_sk (sk2); ctx2 = ask2->private; - ctx2->more =1 ; + ctx2->more = more; + +if (!more) +return err; err =crypto_ahash_import (&ctx2->req, state);if (err) {
Greg Kroah-Hartman
maintainerPATCH 40/200 Revert "dm mpath: fix stalls when handling invalid ioctls"
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mauricio Faria de Oliveira <[email protected]>
commit 47796938c46b943d157ac8a6f9ed4e3b98b83cf4 upstream.
This reverts commit a1989b330093578ea5470bea0a00f940c444c466.
That commit introduced a regression at least for the case of the SG_IO ioctl() running without CAP_SYS_RAWIO capability (e.g., unprivileged users) when there are no active paths: the ioctl() fails with the ENOTTY errno immediately rather than blocking due to queue_if_no_path until a path becomes active, for example.
That case happens to be exercised by QEMU KVM guests with 'scsi-block' devices (qemu "-device scsi-block" [1], libvirt "<disk type='block' device='lun'>" [2]) from multipath devices; which leads to SCSI/filesystem errors in such a guest.
More general scenarios can hit that regression too. The following demonstration employs a SG_IO ioctl() with a standard SCSI INQUIRY command for this objective (some output & user changes omitted for brevity and comments added for clarity).
Reverting that commit restores normal operation (queueing) in failing scenarios; tested on linux-next (next-20151022).
1) Test-case is based on sg_simple0 [3] (just SG_IO; remove SG_GET_VERSION_NUM)
$ cat sg_simple0.c
... see [3] ...
$ sed '/SG_GET_VERSION_NUM/,/}/d' sg_simple0.c > sgio_inquiry.c
$ gcc sgio_inquiry.c -o sgio_inquiry2) The ioctl() works fine with active paths present.
# multipath -l 85ag56
85ag56 (...) dm-19 IBM ,2145
size=60G features='1 queue_if_no_path' hwhandler='0' wp=rw
|-+- policy='service-time 0' prio=0 status=active
| |- 8:0:11:0 sdz 65:144 active undef running
| `- 9:0:9:0 sdbf 67:144 active undef running
`-+- policy='service-time 0' prio=0 status=enabled
|- 8:0:12:0 sdae 65:224 active undef running
`- 9:0:12:0 sdbo 68:32 active undef running $ ./sgio_inquiry /dev/mapper/85ag56
Some of the INQUIRY command's response:
IBM 2145 0000
INQUIRY duration=0 millisecs, resid=03) The ioctl() fails with ENOTTY errno with _no_ active paths present, for unprivileged users (rather than blocking due to queue_if_no_path).
# for path in $(multipath -l 85ag56 | grep -o 'sd[a-z]\+'); \
do multipathd -k"fail path $path"; done # multipath -l 85ag56
85ag56 (...) dm-19 IBM ,2145
size=60G features='1 queue_if_no_path' hwhandler='0' wp=rw
|-+- policy='service-time 0' prio=0 status=enabled
| |- 8:0:11:0 sdz 65:144 failed undef running
| `- 9:0:9:0 sdbf 67:144 failed undef running
`-+- policy='service-time 0' prio=0 status=enabled
|- 8:0:12:0 sdae 65:224 failed undef running
`- 9:0:12:0 sdbo 68:32 failed undef running $ ./sgio_inquiry /dev/mapper/85ag56
sg_simple0: Inquiry SG_IO ioctl error: Inappropriate ioctl for device4) dmesg shows that scsi_verify_blk_ioctl() failed for SG_IO (0x2285); it returns -ENOIOCTLCMD, later replaced with -ENOTTY in vfs_ioctl().
$ dmesg
<...>
[] device-mapper: multipath: Failing path 65:144.
[] device-mapper: multipath: Failing path 67:144.
[] device-mapper: multipath: Failing path 65:224.
[] device-mapper: multipath: Failing path 68:32.
[] sgio_inquiry: sending ioctl 2285 to a partition!5) The ioctl() only works if the SYS_CAP_RAWIO capability is present (then queueing happens -- in this example, queue_if_no_path is set); this is due to a conditional check in scsi_verify_blk_ioctl().
# capsh --drop=cap_sys_rawio -- -c './sgio_inquiry /dev/mapper/85ag56'
sg_simple0: Inquiry SG_IO ioctl error: Inappropriate ioctl for device # ./sgio_inquiry /dev/mapper/85ag56 &
[1] 72830 # cat /proc/72830/stack
[<c00000171c0df700>] 0xc00000171c0df700
[<c000000000015934>] __switch_to+0x204/0x350
[<c000000000152d4c>] msleep+0x5c/0x80
[<c00000000077dfb0>] dm_blk_ioctl+0x70/0x170
[<c000000000487c40>] blkdev_ioctl+0x2b0/0x9b0
[<c0000000003128e4>] block_ioctl+0x64/0xd0
[<c0000000002dd3b0>] do_vfs_ioctl+0x490/0x780
[<c0000000002dd774>] SyS_ioctl+0xd4/0xf0
[<c000000000009358>] system_call+0x38/0xd06) This is the function call chain exercised in this analysis:
SYSCALL_DEFINE3(ioctl, <...>) @ fs/ioctl.c
-> do_vfs_ioctl()
-> vfs_ioctl()
...
error = filp->f_op->unlocked_ioctl(filp, cmd, arg);
...
-> dm_blk_ioctl() @ drivers/md/dm.c
-> multipath_ioctl() @ drivers/md/dm-mpath.c
...
(bdev = NULL, due to no active paths)
...
if (!bdev || <...>) {
int err = scsi_verify_blk_ioctl(NULL, cmd);
if (err)
r = err;
}
...
-> scsi_verify_blk_ioctl() @ block/scsi_ioctl.c
...
if (bd && bd == bd->bd_contains) // not taken (bd = NULL)
return 0;
...
if (capable(CAP_SYS_RAWIO)) // not taken (unprivileged user)
return 0;
...
printk_ratelimited(KERN_WARNING
"%s: sending ioctl %x to a partition!\n" <...>);
return -ENOIOCTLCMD;
<-
...
return r ? : <...>
<-
...
if (error == -ENOIOCTLCMD)
error = -ENOTTY;
out:
return error;
...Links:
[1] http://git.qemu.org/?p=qemu.git;a=commit;h=336a6915bc7089fb20fea4ba99972ad9a97c5f52
[2] https://libvirt.org/formatdomain.html#elementsDisks (see 'disk' -> 'device')
[3] http://tldp.org/HOWTO/SCSI-Generic-HOWTO/pexample.html (Revision 1.2, 2002-05-03)
--- drivers/md/dm-mpath.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-)
drivers/md/dm-mpath.c +2 -5
@@ -1569,11 +1569,8 @@ static int multipath_ioctl(struct dm_tar/* * Only pass ioctls through if the device sizes match exactly. */ -if (!bdev || ti->len !=i_size_read (bdev->bd_inode) >>SECTOR_SHIFT ) { -int err =scsi_verify_blk_ioctl (NULL , cmd); -if (err) - r = err; - } +if (!r && ti->len !=i_size_read (bdev->bd_inode) >>SECTOR_SHIFT ) + r =scsi_verify_blk_ioctl (NULL , cmd);if (r == -ENOTCONN && !fatal_signal_pending (current)) {spin_lock_irqsave (&m->lock, flags);
Greg Kroah-Hartman
maintainerPATCH 42/200 spi: atmel: Fix DMA-setup for transfers with more than 8 bits per word
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Mosberger-Tang <[email protected]>
commit 06515f83908d038d9e12ffa3dcca27a1b67f2de0 upstream.
The DMA-slave configuration depends on the whether <= 8 or > 8 bits are transferred per word, so we need to call atmel_spi_dma_slave_config() with the correct value.
--- drivers/spi/spi-atmel.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/spi/spi-atmel.c +2 -1
@@ -773,7 +773,8 @@ static int atmel_spi_next_xfer_dma_submi *plen = len; -if (atmel_spi_dma_slave_config (as, &slave_config,8 )) +if (atmel_spi_dma_slave_config (as, &slave_config, + xfer->bits_per_word)) goto err_exit;/* Send both scatterlists */
Greg Kroah-Hartman
maintainerPATCH 6/200 crypto: nx - Fix timing leak in GCM and CCM decryption
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Gstir <[email protected]>
commit cb8affb55c7e64816f3effcd9b2fc3268c016fac upstream.
Using non-constant time memcmp() makes the verification of the authentication tag in the decrypt path vulnerable to timing attacks. Fix this by using crypto_memneq() instead.
--- drivers/crypto/nx/nx-aes-ccm.c | 2 +- drivers/crypto/nx/nx-aes-gcm.c | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-)
drivers/crypto/nx/nx-aes-ccm.c +1 -1
@@ -409,7 +409,7 @@ static int ccm_nx_decrypt(struct aead_re processed += to_process; }while (processed < nbytes); - rc =memcmp (csbcpb->cpb.aes_ccm.out_pat_or_mac, priv->oauth_tag, + rc =crypto_memneq (csbcpb->cpb.aes_ccm.out_pat_or_mac, priv->oauth_tag, authsize) ? -EBADMSG :0 ; out:spin_unlock_irqrestore (&nx_ctx->lock, irq_flags);
drivers/crypto/nx/nx-aes-gcm.c +2 -1
@@ -21,6 +21,7 @@#include <crypto/internal/aead.h> #include <crypto/aes.h> +#include <crypto/algapi.h> #include <crypto/scatterwalk.h> #include <linux/module.h> #include <linux/types.h>
@@ -418,7 +419,7 @@ mac: itag, req->src, req->assoclen + nbytes,crypto_aead_authsize (crypto_aead_reqtfm (req)), SCATTERWALK_FROM_SG); - rc =memcmp (itag, otag, + rc =crypto_memneq (itag, otag,crypto_aead_authsize (crypto_aead_reqtfm (req))) ? -EBADMSG :0 ; }
Greg Kroah-Hartman
maintainerPATCH 58/200 mtd: ubi: dont leak e if schedule_erase() fails
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Siewior <[email protected]>
commit 6b238de189f69dc77d660d4cce62eed15547f4c3 upstream.
If __erase_worker() fails to erase the EB and schedule_erase() fails as well to do anything about it then we go RO. But that is not a reason to leak the e argument here. Therefore clean up e.
--- drivers/mtd/ubi/wl.c | 1 + 1 file changed, 1 insertion(+)
drivers/mtd/ubi/wl.c +1 -0
@@ -1060,6 +1060,7 @@ static int __erase_worker(struct ubi_dev/* Re-schedule the LEB for erasure */ err1 =schedule_erase (ubi, e, vol_id, lnum,0 );if (err1) { +wl_entry_destroy (ubi, e); err = err1; goto out_ro; }
Greg Kroah-Hartman
maintainerPATCH 63/200 PCI: Fix minimum allocation address overwrite
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Biedl <[email protected]>
commit 3460baa620685c20f5ee19afb6d99d26150c382c upstream.
Commit 36e097a8a297 ("PCI: Split out bridge window override of minimum allocation address") claimed to do no functional changes but unfortunately
did: The "min" variable is altered. At least the AVM A1 PCMCIA adapter was no longer detected, breaking ISDN operation.
Use a local copy of "min" to restore the previous behaviour.
--- drivers/pci/bus.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/pci/bus.c +4 -2
@@ -140,6 +140,8 @@ static int pci_bus_alloc_from_region(str type_mask |=IORESOURCE_TYPE_BITS ;pci_bus_for_each_resource (bus, r, i) { +resource_size_t min_used = min; +if (!r)continue ;
@@ -163,12 +165,12 @@ static int pci_bus_alloc_from_region(str* overrides "min". */ if (avail.start) - min = avail.start; + min_used = avail.start; max = avail.end;/* Ok, try it out.. */ - ret =allocate_resource (r, res, size, min, max, + ret =allocate_resource (r, res, size, min_used, max, align, alignf, alignf_data);if (ret ==0 )return 0 ;
Greg Kroah-Hartman
maintainerPATCH 66/200 tracing/stacktrace: Show entire trace if passed in function not found
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt <[email protected]>
commit 6ccd83714a009ee301b50c15f6c3a5dc1f30164c upstream.
When a max stack trace is discovered, the stack dump is saved. In order to not record the overhead of the stack tracer, the ip of the traced function is looked for within the dump. The trace is started from the location of that function. But if for some reason the ip is not found, the entire stack trace is then truncated. That's not very useful. Instead, print everything if the ip of the traced function is not found within the trace.
This issue showed up on s390.
--- kernel/trace/trace_stack.c | 7 +++++++ 1 file changed, 7 insertions(+)
kernel/trace/trace_stack.c +7 -0
@@ -120,6 +120,13 @@ check_stack(unsigned long ip, unsigned l }/* +* Some archs may not have the passed in ip in the dump. +* If that happens, we need to show everything. +*/ +if (i == stack_trace_max.nr_entries) + i =0 ; + +/* * Now find where in the stack these are. */ x =0 ;
Greg Kroah-Hartman
maintainerPATCH 70/200 jbd2: fix null committed data return in undo_access
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junxiao Bi <[email protected]>
commit 087ffd4eae9929afd06f6a709861df3c3508492a upstream.
introduced jbd2_write_access_granted() to improve write|undo_access speed, but missed to check the status of b_committed_data which caused a kernel panic on ocfs2.
[ 6538.405938] ------------[ cut here ]------------ [ 6538.406686] kernel BUG at fs/ocfs2/suballoc.c:2400! [ 6538.406686] invalid opcode: 0000 [#1] SMP [ 6538.406686] Modules linked in: ocfs2 nfsd lockd grace nfs_acl auth_rpcgss sunrpc autofs4 ocfs2_dlmfs ocfs2_stack_o2cb ocfs2_dlm ocfs2_nodemanager ocfs2_stackglue configfs sd_mod sg ip6t_REJECT nf_reject_ipv6 nf_conntrack_ipv6 nf_defrag_ipv6 xt_state nf_conntrack ip6table_filter ip6_tables be2iscsi iscsi_boot_sysfs bnx2i cnic uio cxgb4i cxgb4 cxgb3i libcxgbi cxgb3 mdio ib_iser rdma_cm ib_cm iw_cm ib_sa ib_mad ib_core ib_addr ipv6 iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi ppdev xen_kbdfront xen_netfront xen_fbfront parport_pc parport pcspkr i2c_piix4 acpi_cpufreq ext4 jbd2 mbcache xen_blkfront floppy pata_acpi ata_generic ata_piix cirrus ttm drm_kms_helper drm fb_sys_fops sysimgblt sysfillrect i2c_core syscopyarea dm_mirror dm_region_hash dm_log dm_mod [ 6538.406686] CPU: 1 PID: 16265 Comm: mmap_truncate Not tainted 4.3.0 #1 [ 6538.406686] Hardware name: Xen HVM domU, BIOS 4.3.1OVM 05/14/2014 [ 6538.406686] task: ffff88007c2bab00 ti: ffff880075b78000 task.ti: ffff880075b78000 [ 6538.406686] RIP: 0010:[<ffffffffa06a286b>] [<ffffffffa06a286b>] ocfs2_block_group_clear_bits+0x23b/0x250 [ocfs2] [ 6538.406686] RSP: 0018:ffff880075b7b7f8 EFLAGS: 00010246 [ 6538.406686] RAX: ffff8800760c5b40 RBX: ffff88006c06a000 RCX: ffffffffa06e6df0 [ 6538.406686] RDX: 0000000000000000 RSI: ffff88007a6f6ea0 RDI: ffff88007a760430 [ 6538.406686] RBP: ffff880075b7b878 R08: 0000000000000002 R09: 0000000000000001 [ 6538.406686] R10: ffffffffa06769be R11: 0000000000000000 R12: 0000000000000001 [ 6538.406686] R13: ffffffffa06a1750 R14: 0000000000000001 R15: ffff88007a6f6ea0 [ 6538.406686] FS: 00007f17fde30720(0000) GS:ffff88007f040000(0000) knlGS:0000000000000000 [ 6538.406686] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 6538.406686] CR2: 0000000000601730 CR3: 000000007aea0000 CR4: 00000000000406e0 [ 6538.406686] Stack: [ 6538.406686] ffff88007c2bb5b0 ffff880075b7b8e0 ffff88007a7604b0 ffff88006c640800 [ 6538.406686] ffff88007a7604b0 ffff880075d77390 0000000075b7b878 ffffffffa06a309d [ 6538.406686] ffff880075d752d8 ffff880075b7b990 ffff880075b7b898 0000000000000000 [ 6538.406686] Call Trace: [ 6538.406686] [<ffffffffa06a309d>] ? ocfs2_read_group_descriptor+0x6d/0xa0 [ocfs2] [ 6538.406686] [<ffffffffa06a3654>] _ocfs2_free_suballoc_bits+0xe4/0x320 [ocfs2] [ 6538.406686] [<ffffffffa06a1750>] ? ocfs2_put_slot+0xf0/0xf0 [ocfs2] [ 6538.406686] [<ffffffffa06a397e>] _ocfs2_free_clusters+0xee/0x210 [ocfs2] [ 6538.406686] [<ffffffffa06a1750>] ? ocfs2_put_slot+0xf0/0xf0 [ocfs2] [ 6538.406686] [<ffffffffa06a1750>] ? ocfs2_put_slot+0xf0/0xf0 [ocfs2] [ 6538.406686] [<ffffffffa0682d50>] ? ocfs2_extend_trans+0x50/0x1a0 [ocfs2] [ 6538.406686] [<ffffffffa06a3ad5>] ocfs2_free_clusters+0x15/0x20 [ocfs2] [ 6538.406686] [<ffffffffa065072c>] ocfs2_replay_truncate_records+0xfc/0x290 [ocfs2] [ 6538.406686] [<ffffffffa06843ac>] ? ocfs2_start_trans+0xec/0x1d0 [ocfs2] [ 6538.406686] [<ffffffffa0654600>] __ocfs2_flush_truncate_log+0x140/0x2d0 [ocfs2] [ 6538.406686] [<ffffffffa0654394>] ? ocfs2_reserve_blocks_for_rec_trunc.clone.0+0x44/0x170 [ocfs2] [ 6538.406686] [<ffffffffa065acd4>] ocfs2_remove_btree_range+0x374/0x630 [ocfs2] [ 6538.406686] [<ffffffffa017486b>] ? jbd2_journal_stop+0x25b/0x470 [jbd2] [ 6538.406686] [<ffffffffa065d5b5>] ocfs2_commit_truncate+0x305/0x670 [ocfs2] [ 6538.406686] [<ffffffffa0683430>] ? ocfs2_journal_access_eb+0x20/0x20 [ocfs2] [ 6538.406686] [<ffffffffa067adb7>] ocfs2_truncate_file+0x297/0x380 [ocfs2] [ 6538.406686] [<ffffffffa01759e4>] ? jbd2_journal_begin_ordered_truncate+0x64/0xc0 [jbd2] [ 6538.406686] [<ffffffffa067c7a2>] ocfs2_setattr+0x572/0x860 [ocfs2] [ 6538.406686] [<ffffffff810e4a3f>] ? current_fs_time+0x3f/0x50 [ 6538.406686] [<ffffffff812124b7>] notify_change+0x1d7/0x340 [ 6538.406686] [<ffffffff8121abf9>] ? generic_getxattr+0x79/0x80 [ 6538.406686] [<ffffffff811f5876>] do_truncate+0x66/0x90 [ 6538.406686] [<ffffffff81120e30>] ? __audit_syscall_entry+0xb0/0x110 [ 6538.406686] [<ffffffff811f5bb3>] do_sys_ftruncate.clone.0+0xf3/0x120 [ 6538.406686] [<ffffffff811f5bee>] SyS_ftruncate+0xe/0x10 [ 6538.406686] [<ffffffff816aa2ae>] entry_SYSCALL_64_fastpath+0x12/0x71 [ 6538.406686] Code: 28 48 81 ee b0 04 00 00 48 8b 92 50 fb ff ff 48 8b 80 b0 03 00 00 48 39 90 88 00 00 00 0f 84 30 fe ff ff 0f 0b eb fe 0f 0b eb fe <0f> 0b 0f 1f 00 eb fb 66 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 [ 6538.406686] RIP [<ffffffffa06a286b>] ocfs2_block_group_clear_bits+0x23b/0x250 [ocfs2] [ 6538.406686] RSP <ffff880075b7b7f8> [ 6538.691128] ---[ end trace 31cd7011d6770d7e ]--- [ 6538.694492] Kernel panic - not syncing: Fatal exception [ 6538.695484] Kernel Offset: disabled
--- fs/jbd2/transaction.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
fs/jbd2/transaction.c +7 -3
@@ -1009,7 +1009,8 @@ out: }/* Fast check whether buffer is already attached to the required transaction */ -static bool jbd2_write_access_granted (handle_t *handle,struct buffer_head *bh) +static bool jbd2_write_access_granted (handle_t *handle,struct buffer_head *bh, +bool undo) {struct journal_head *jh;bool ret = false;
@@ -1036,6 +1037,9 @@ static bool jbd2_write_access_granted(ha jh =READ_ONCE (bh->b_private);if (!jh) goto out; +/* For undo access buffer must have data copied */ +if (undo && !jh->b_committed_data) + goto out;if (jh->b_transaction != handle->h_transaction && jh->b_next_transaction != handle->h_transaction) goto out;
@@ -1073,7 +1077,7 @@ int jbd2_journal_get_write_access(handlestruct journal_head *jh;int rc; -if (jbd2_write_access_granted (handle, bh)) +if (jbd2_write_access_granted (handle, bh, false))return 0 ; jh =jbd2_journal_add_journal_head (bh);
@@ -1210,7 +1214,7 @@ int jbd2_journal_get_undo_access(handle_char *committed_data =NULL ;JBUFFER_TRACE (jh,"entry" ); -if (jbd2_write_access_granted (handle, bh)) +if (jbd2_write_access_granted (handle, bh, true))return 0 ; jh =jbd2_journal_add_journal_head (bh);
Greg Kroah-Hartman
maintainerPATCH 71/200 fix calculation of meta_bg descriptor backups
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Leiserson <[email protected]>
commit 904dad4742d211b7a8910e92695c0fa957483836 upstream.
"group" is the group where the backup will be placed, and is initialized to zero in the declaration. This meant that backups for meta_bg descriptors were erroneously written to the backup block group descriptors in groups 1 and (desc_per_block-1).
Reproduction information:
mke2fs -Fq -t ext4 -b 1024 -O ^resize_inode /tmp/foo.img 16G truncate -s 24G /tmp/foo.img
losetup /dev/loop0 /tmp/foo.img
mount /dev/loop0 /mnt
resize2fs /dev/loop0
umount /dev/loop0
dd if=/dev/zero of=/dev/loop0 bs=1024 count=2 e2fsck -fy /dev/loop0
losetup -d /dev/loop0
--- fs/ext4/resize.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/ext4/resize.c +2 -2
@@ -1040,7 +1040,7 @@ exit_free:* do not copy the full number of backups at this time. The resize * which changed s_groups_count will backup again. */ -static void update_backups (struct super_block *sb,int blk_off,char *data, +static void update_backups (struct super_block *sb,sector_t blk_off,char *data,int size,int meta_bg) {struct ext4_sb_info *sbi =EXT4_SB (sb);
@@ -1065,7 +1065,7 @@ static void update_backups(struct super_ group =ext4_list_backups (sb, &three, &five, &seven); last = sbi->s_groups_count; }else { - group =ext4_meta_bg_first_group (sb, group) +1 ; + group =ext4_get_group_number (sb, blk_off) +1 ; last = (ext4_group_t)(group +EXT4_DESC_PER_BLOCK (sb) -2 ); }
Greg Kroah-Hartman
maintainerPATCH 73/200 parisc: Fixes and cleanups in kernel uapi header files
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Helge Deller <[email protected]>
commit d0cf62fb63f760e98244d31396b3b58f3a1e326b upstream.
This patch fixes some bugs and partly cleans up the parisc uapi header files to what glibc defined:
- compat_semid64_ds was wrong and did not take the endianess into account
- ipc64_perm exported userspace types which broke building userspace packages on debian (e.g. trinity)
- ipc64_perm needs to use a 32bit mode_t on 64bit kernel
- msqid64_ds and semid64_ds needs unsigned longs for various struct members
- shmid64_ds exported size_t instead of __kernel_size_t
And finally add some compile-time checks for the sizes of those structs to avoid future breakage.
Runtime-tested with the Linux Test Project (LTP) testsuite.
--- arch/parisc/include/asm/compat.h | 4 ++-- arch/parisc/include/uapi/asm/ipcbuf.h | 19 ++++++++++++------- arch/parisc/include/uapi/asm/msgbuf.h | 10 +++++----- arch/parisc/include/uapi/asm/posix_types.h | 2 ++ arch/parisc/include/uapi/asm/sembuf.h | 6 +++--- arch/parisc/include/uapi/asm/shmbuf.h | 8 ++++---- arch/parisc/mm/init.c | 16 ++++++++++++++++ 7 files changed, 44 insertions(+), 21 deletions(-)
arch/parisc/include/asm/compat.h +2 -2
@@ -206,10 +206,10 @@ struct compat_ipc64_perm {struct compat_semid64_ds {struct compat_ipc64_perm sem_perm; -compat_time_t sem_otime;unsigned int __unused1; -compat_time_t sem_ctime; +compat_time_t sem_otime;unsigned int __unused2; +compat_time_t sem_ctime;compat_ulong_t sem_nsems;compat_ulong_t __unused3;compat_ulong_t __unused4;
arch/parisc/include/uapi/asm/ipcbuf.h +12 -7
@@ -1,6 +1,9 @@#ifndef __PARISC_IPCBUF_H__#define __PARISC_IPCBUF_H__ +#include <asm/bitsperlong.h> +#include <linux/posix_types.h> +/* * The ipc64_perm structure for PA-RISC is almost identical to * kern_ipc_perm as we have always had 32-bit UIDs and GIDs in the kernel.
@@ -10,16 +13,18 @@struct ipc64_perm { -key_t key; -uid_t uid; -gid_t gid; -uid_t cuid; -gid_t cgid; +__kernel_key_t key; +__kernel_uid_t uid; +__kernel_gid_t gid; +__kernel_uid_t cuid; +__kernel_gid_t cgid; +#if __BITS_PER_LONG !=64 unsigned short int __pad1; -mode_t mode; +#endif +__kernel_mode_t mode;unsigned short int __pad2;unsigned short int seq; -unsigned int __pad3; +unsigned int __pad3;unsigned long long int __unused1;unsigned long long int __unused2; };
arch/parisc/include/uapi/asm/msgbuf.h +5 -5
@@ -27,13 +27,13 @@ struct msqid64_ds {unsigned int __pad3;#endif __kernel_time_t msg_ctime;/* last change time */ -unsigned int msg_cbytes;/* current number of bytes on queue */ -unsigned int msg_qnum;/* number of messages in queue */ -unsigned int msg_qbytes;/* max number of bytes on queue */ +unsigned long msg_cbytes;/* current number of bytes on queue */ +unsigned long msg_qnum;/* number of messages in queue */ +unsigned long msg_qbytes;/* max number of bytes on queue */ __kernel_pid_t msg_lspid;/* pid of last msgsnd */ __kernel_pid_t msg_lrpid;/* last receive pid */ -unsigned int __unused1; - unsigned int __unused2; +unsigned long __unused1; + unsigned long __unused2; };#endif /* _PARISC_MSGBUF_H */
arch/parisc/include/uapi/asm/posix_types.h +2 -0
@@ -7,8 +7,10 @@* assume GCC is being used. */ +#ifndef __LP64__typedef unsigned short __kernel_mode_t ;#define __kernel_mode_t __kernel_mode_t +#endif typedef unsigned short __kernel_ipc_pid_t ;#define __kernel_ipc_pid_t __kernel_ipc_pid_t
arch/parisc/include/uapi/asm/sembuf.h +3 -3
@@ -23,9 +23,9 @@ struct semid64_ds {unsigned int __pad2;#endif __kernel_time_t sem_ctime;/* last change time */ -unsigned int sem_nsems;/* no. of semaphores in array */ -unsigned int __unused1; - unsigned int __unused2; +unsigned long sem_nsems;/* no. of semaphores in array */ +unsigned long __unused1; + unsigned long __unused2; };#endif /* _PARISC_SEMBUF_H */
arch/parisc/include/uapi/asm/shmbuf.h +4 -4
@@ -30,12 +30,12 @@ struct shmid64_ds {#if __BITS_PER_LONG !=64 unsigned int __pad4;#endif -size_t shm_segsz;/* size of segment (bytes) */ +__kernel_size_t shm_segsz;/* size of segment (bytes) */ __kernel_pid_t shm_cpid;/* pid of creator */ __kernel_pid_t shm_lpid;/* pid of last operator */ -unsigned int shm_nattch;/* no. of current attaches */ -unsigned int __unused1; -unsigned int __unused2; +unsigned long shm_nattch;/* no. of current attaches */ +unsigned long __unused1; +unsigned long __unused2; };struct shminfo64 {
arch/parisc/mm/init.c +16 -0
@@ -23,6 +23,7 @@#include <linux/unistd.h> #include <linux/nodemask.h> /* for node_online_map */ #include <linux/pagemap.h> /* for release_pages and page_cache_release */ +#include <linux/compat.h> #include <asm/pgalloc.h> #include <asm/pgtable.h>
@@ -30,6 +31,7 @@#include <asm/pdc_chassis.h> #include <asm/mmzone.h> #include <asm/sections.h> +#include <asm/msgbuf.h> extern int data_start;extern void parisc_kernel_start (void );/* Kernel entry point in head.S */
@@ -590,6 +592,20 @@ unsigned long pcxl_dma_start __read_mostvoid __init mem_init (void ) { +/* Do sanity checks on IPC (compat) structures */ +BUILD_BUG_ON (sizeof (struct ipc64_perm ) !=48 ); +#ifndef CONFIG_64BIT +BUILD_BUG_ON (sizeof (struct semid64_ds ) !=80 ); +BUILD_BUG_ON (sizeof (struct msqid64_ds ) !=104 ); +BUILD_BUG_ON (sizeof (struct shmid64_ds ) !=104 ); +#endif +#ifdef CONFIG_COMPAT +BUILD_BUG_ON (sizeof (struct compat_ipc64_perm ) !=sizeof (struct ipc64_perm )); +BUILD_BUG_ON (sizeof (struct compat_semid64_ds ) !=80 ); +BUILD_BUG_ON (sizeof (struct compat_msqid64_ds ) !=104 ); +BUILD_BUG_ON (sizeof (struct compat_shmid64_ds ) !=104 ); +#endif +/* Do sanity checks on page table constants */ BUILD_BUG_ON (PTE_ENTRY_SIZE !=sizeof (pte_t));BUILD_BUG_ON (PMD_ENTRY_SIZE !=sizeof (pmd_t));
Greg Kroah-Hartman
maintainerPATCH 79/200 i2c: at91: fix write transfers by clearing pending interrupt first
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cyrille Pitchen <[email protected]>
commit 6f6ddbb09d2a5baded0e23add3ad2d9e9417ab30 upstream.
In some cases a NACK interrupt may be pending in the Status Register (SR) as a result of a previous transfer. However at91_do_twi_transfer() did not read the SR to clear pending interruptions before starting a new transfer. Hence a NACK interrupt rose as soon as it was enabled again at the I2C controller level, resulting in a wrong sequence of operations and strange patterns of behaviour on the I2C bus, such as a clock stretch followed by a restart of the transfer.
This first issue occurred with both DMA and PIO write transfers.
Also when a NACK error was detected during a PIO write transfer, the interrupt handler used to wrongly start a new transfer by writing into the Transmit Holding Register (THR). Then the I2C slave was likely to reply with a second NACK.
This second issue is fixed in atmel_twi_interrupt() by handling the TXRDY status bit only if both the TXCOMP and NACK status bits are cleared.
Tested with a at24 eeprom on sama5d36ek board running a linux-4.1-at91 kernel image. Adapted to linux-next.
--- drivers/i2c/busses/i2c-at91.c | 58 ++++++++++++++++++++++++++++++++++++------ 1 file changed, 50 insertions(+), 8 deletions(-)
drivers/i2c/busses/i2c-at91.c +50 -8
@@ -465,19 +465,57 @@ static irqreturn_t atmel_twi_interrupt(iif (!irqstatus)return IRQ_NONE ; -else if (irqstatus &AT91_TWI_RXRDY ) -at91_twi_read_next_byte (dev); -else if (irqstatus &AT91_TWI_TXRDY ) -at91_twi_write_next_byte (dev); - -/* catch error flags */ - dev->transfer_status |= status; +/* +* When a NACK condition is detected, the I2C controller sets the NACK, +* TXCOMP and TXRDY bits all together in the Status Register (SR). +* +* 1 - Handling NACK errors with CPU write transfer. +* +* In such case, we should not write the next byte into the Transmit +* Holding Register (THR) otherwise the I2C controller would start a new +* transfer and the I2C slave is likely to reply by another NACK. +* +* 2 - Handling NACK errors with DMA write transfer. +* +* By setting the TXRDY bit in the SR, the I2C controller also triggers +* the DMA controller to write the next data into the THR. Then the +* result depends on the hardware version of the I2C controller. +* +* 2a - Without support of the Alternative Command mode. +* +* This is the worst case: the DMA controller is triggered to write the +* next data into the THR, hence starting a new transfer: the I2C slave +* is likely to reply by another NACK. +* Concurrently, this interrupt handler is likely to be called to manage +* the first NACK before the I2C controller detects the second NACK and +* sets once again the NACK bit into the SR. +* When handling the first NACK, this interrupt handler disables the I2C +* controller interruptions, especially the NACK interrupt. +* Hence, the NACK bit is pending into the SR. This is why we should +* read the SR to clear all pending interrupts at the beginning of +* at91_do_twi_transfer() before actually starting a new transfer. +* +* 2b - With support of the Alternative Command mode. +* +* When a NACK condition is detected, the I2C controller also locks the +* THR (and sets the LOCK bit in the SR): even though the DMA controller +* is triggered by the TXRDY bit to write the next data into the THR, +* this data actually won't go on the I2C bus hence a second NACK is not +* generated. +*/ if (irqstatus & (AT91_TWI_TXCOMP |AT91_TWI_NACK )) {at91_disable_twi_interrupts (dev);complete (&dev->cmd_complete); + }else if (irqstatus &AT91_TWI_RXRDY ) { +at91_twi_read_next_byte (dev); + }else if (irqstatus &AT91_TWI_TXRDY ) { +at91_twi_write_next_byte (dev); } +/* catch error flags */ + dev->transfer_status |= status; +return IRQ_HANDLED ; }
@@ -487,6 +525,7 @@ static int at91_do_twi_transfer(struct aunsigned long time_left;bool has_unre_flag = dev->pdata->has_unre_flag;bool has_alt_cmd = dev->pdata->has_alt_cmd; +unsigned sr;/* * WARNING: the TXCOMP bit in the Status Register is NOT a clear on
@@ -537,6 +576,9 @@ static int at91_do_twi_transfer(struct areinit_completion (&dev->cmd_complete); dev->transfer_status =0 ; +/* Clear pending interrupts, such as NACK. */ + sr =at91_twi_read (dev,AT91_TWI_SR ); +if (dev->fifo_size) {unsigned fifo_mr =at91_twi_read (dev,AT91_TWI_FMR );
@@ -558,7 +600,7 @@ static int at91_do_twi_transfer(struct a }else if (dev->msg->flags &I2C_M_RD ) {unsigned start_flags =AT91_TWI_START ; -if (at91_twi_read (dev,AT91_TWI_SR ) &AT91_TWI_RXRDY ) { +if (sr &AT91_TWI_RXRDY ) {dev_err (dev->dev,"RXRDY still set!" );at91_twi_read (dev,AT91_TWI_RHR ); }
Greg Kroah-Hartman
maintainerPATCH 82/200 media: i2c: Dont export ir-kbd-i2c module alias
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Javier Martinez Canillas <[email protected]>
commit 329d88da4df9a96da43018aceabd3a06e6a7e7ae upstream.
This is a partial revert of commit ed8d1cf07cb16d ("[media] Export I2C module alias information in missing drivers") that exported the module aliases for the I2C drivers that were missing to make autoload to work.
But there is a bug report [0] that auto load of the ir-kbd-i2c driver cause the Hauppauge HD-PVR driver to not behave correctly.
This is a hdpvr latent bug that was just exposed by ir-kbd-i2c module autoloading working and will also happen if the I2C driver is built-in or a user calls modprobe to load the module and register the driver.
But there is a regression experimented by users so until the real bug is fixed, let's not export the module alias for the ir-kbd-i2c driver even when this just masks the actual issue.
[0]: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=810726
--- drivers/media/i2c/ir-kbd-i2c.c | 1 - 1 file changed, 1 deletion(-)
drivers/media/i2c/ir-kbd-i2c.c +0 -1
@@ -478,7 +478,6 @@ static const struct i2c_device_id ir_kbd { "ir_rx_z8f0811_hdpvr", 0 }, { } }; -MODULE_DEVICE_TABLE(i2c, ir_kbd_id); static struct i2c_driver ir_kbd_driver = { .driver = {
Greg Kroah-Hartman
maintainerPATCH 86/200 vivid: Fix iteration in driver removal path
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ezequiel Garcia <[email protected]>
commit a5d42b8c3b3ddccd88dc1c70957177d31a6699fb upstream.
When the diver is removed and all the resources are deallocated, we should be iterating through the created devices only.
Currently, the iteration ends when vivid_devs[i] is NULL. Since the array contains VIVID_MAX_DEVS elements, it will oops if n_devs=VIVID_MAX_DEVS because in that case, no element is NULL.
--- drivers/media/platform/vivid/vivid-core.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/media/platform/vivid/vivid-core.c +4 -1
@@ -1341,8 +1341,11 @@ static int vivid_remove(struct platform_struct vivid_dev *dev;unsigned i; -for (i =0 ; vivid_devs[i]; i++) { + +for (i =0 ; i < n_devs; i++) { dev = vivid_devs[i]; +if (!dev) +continue ;if (dev->has_vid_cap) { v4l2_info(&dev->v4l2_dev, "unregistering %s\n",
Greg Kroah-Hartman
maintainerPATCH 87/200 v4l2-compat-ioctl32: fix alignment for ARM64
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrzej Hajda <[email protected]>
commit 655e9780ab913a3a06d4a164d55e3b755524186d upstream.
Alignment/padding rules on AMD64 and ARM64 differs. To allow properly match compatible ioctls on ARM64 kernels without breaking AMD64 some fields should be aligned using compat_s64 type and in one case struct should be unpacked.
--- drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/media/v4l2-core/v4l2-compat-ioctl32.c +5 -4
@@ -266,7 +266,7 @@ static int put_v4l2_create32(struct v4l2struct v4l2_standard32 {__u32 index; -__u32 id[2 ];/* __u64 would get the alignment wrong */ +compat_u64 id;__u8 name[24 ];struct v4l2_fract frameperiod;/* Frames, not fields */ __u32 framelines;
@@ -286,7 +286,7 @@ static int put_v4l2_standard32(struct v4 { if (!access_ok(VERIFY_WRITE, up, sizeof(struct v4l2_standard32)) || put_user(kp->index, &up->index) || - copy_to_user(up->id, &kp->id, sizeof(__u64)) || + put_user(kp->id, &up->id) || copy_to_user(up->name, kp->name, 24) || copy_to_user(&up->frameperiod, &kp->frameperiod, sizeof(kp->frameperiod)) || put_user(kp->framelines, &up->framelines) ||
@@ -587,10 +587,10 @@ struct v4l2_input32 {__u32 type;/* Type of input */ __u32 audioset;/* Associated audios (bitfield) */ __u32 tuner;/* Associated tuner */ -v4l2_std_id std; +compat_u64 std;__u32 status;__u32 reserved[4 ]; -} __attribute__ ((packed)); +};/* The 64-bit v4l2_input struct has extra padding at the end of the struct. Otherwise it is identical to the 32-bit version. */
@@ -738,6 +738,7 @@ static int put_v4l2_ext_controls32(strucstruct v4l2_event32 {__u32 type;union { +compat_s64 value64;__u8 data[64 ]; } u;__u32 pending;
Greg Kroah-Hartman
maintainerPATCH 88/200 c8sectpfe: Remove select on CONFIG_FW_LOADER_USER_HELPER_FALLBACK
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 79f5b6ae960d380c829fb67d5dadcd1d025d2775 upstream.
c8sectpfe driver selects CONFIG_FW_LOADER_USER_HELPER_FALLBACK by some reason, but this option is known to be harmful, leading to minutes of stalls at boot time. The option was intended for only compatibility for an old exotic system that mandates the udev interaction, and not a thing a driver selects by itself. Let's remove it.
--- drivers/media/platform/sti/c8sectpfe/Kconfig | 1 - 1 file changed, 1 deletion(-)
drivers/media/platform/sti/c8sectpfe/Kconfig +0 -1
@@ -3,7 +3,6 @@ config DVB_C8SECTPFE depends on PINCTRL && DVB_CORE && I2C depends on ARCH_STI || ARCH_MULTIPLATFORM || COMPILE_TEST select FW_LOADER - select FW_LOADER_USER_HELPER_FALLBACK select DEBUG_FS select DVB_LNBP21 if MEDIA_SUBDRV_AUTOSELECT select DVB_STV090x if MEDIA_SUBDRV_AUTOSELECT
Greg Kroah-Hartman
maintainerPATCH 50/200 tpm_tis: free irq after probing
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Wilck <[email protected]>
commit 2aef9da60bfdeb68dbcd4f114c098cbaa841b4ee upstream.
Release IRQs used for probing only. Otherwise the TPM will end up with all IRQs 3-15 assigned.
--- drivers/char/tpm/tpm_tis.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/char/tpm/tpm_tis.c +2 -0
@@ -805,6 +805,8 @@ static int tpm_tis_init(struct device *diowrite32 (intmask, chip->vendor.iobase +TPM_INT_ENABLE (chip->vendor.locality)); + +devm_free_irq (dev, i, chip); } }if (chip->vendor.irq) {
Greg Kroah-Hartman
maintainerPATCH 95/200 mm: memcontrol: fix possible memcg leak due to interrupted reclaim
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Davydov <[email protected]>
commit 6df38689e0e9a07ff4f42c06b302e203b33667e9 upstream.
Memory cgroup reclaim can be interrupted with mem_cgroup_iter_break() once enough pages have been reclaimed, in which case, in contrast to a full round-trip over a cgroup sub-tree, the current position stored in mem_cgroup_reclaim_iter of the target cgroup does not get invalidated and so is left holding the reference to the last scanned cgroup. If the target cgroup does not get scanned again (we might have just reclaimed the last page or all processes might exit and free their memory voluntary), we will leak it, because there is nobody to put the reference held by the iterator.
The problem is easy to reproduce by running the following command sequence in a loop:
mkdir /sys/fs/cgroup/memory/test
echo 100M > /sys/fs/cgroup/memory/test/memory.limit_in_bytes echo $$ > /sys/fs/cgroup/memory/test/cgroup.procs memhog 150M
echo $$ > /sys/fs/cgroup/memory/cgroup.procs
rmdir test
The cgroups generated by it will never get freed.
This patch fixes this issue by making mem_cgroup_iter avoid taking reference to the current position. In order not to hit use-after-free bug while running reclaim in parallel with cgroup deletion, we make use of ->css_released cgroup callback to clear references to the dying cgroup in all reclaim iterators that might refer to it. This callback is called right before scheduling rcu work which will free css, so if we access iter->position from rcu read section, we might be sure it won't go away under us.
--- mm/memcontrol.c | 60 ++++++++++++++++++++++++++++++++++++++++++-------------- 1 file changed, 46 insertions(+), 14 deletions(-)
mm/memcontrol.c +46 -14
@@ -902,14 +902,20 @@ struct mem_cgroup *mem_cgroup_iter(strucif (prev && reclaim->generation != iter->generation) goto out_unlock; -do { +while (1 ) { pos =READ_ONCE (iter->position); +if (!pos ||css_tryget (&pos->css)) +break ;/* -* A racing update may change the position and -* put the last reference, hence css_tryget(), -* or retry to see the updated position. +* css reference reached zero, so iter->position will +* be cleared by ->css_released. However, we should not +* rely on this happening soon, because ->css_released +* is called from a work queue, and by busy-waiting we +* might block it. So we clear iter->position right +* away. */ - }while (pos && !css_tryget (&pos->css)); + (void )cmpxchg (&iter->position, pos,NULL ); + } }if (pos)
@@ -955,17 +961,13 @@ struct mem_cgroup *mem_cgroup_iter(struc }if (reclaim) { -if (cmpxchg (&iter->position, pos, memcg) == pos) { -if (memcg) -css_get (&memcg->css); -if (pos) -css_put (&pos->css); - } -/* -* pairs with css_tryget when dereferencing iter->position -* above. +* The position could have already been updated by a competing +* thread, so check that the value hasn't changed since we read +* it to avoid reclaiming from the same cgroup twice. */ + (void )cmpxchg (&iter->position, pos, memcg); +if (pos)css_put (&pos->css);
@@ -998,6 +1000,28 @@ void mem_cgroup_iter_break(struct mem_cgcss_put (&prev->css); } +static void invalidate_reclaim_iterators (struct mem_cgroup *dead_memcg) +{ +struct mem_cgroup *memcg = dead_memcg; +struct mem_cgroup_reclaim_iter *iter; +struct mem_cgroup_per_zone *mz; +int nid, zid; +int i; + +while ((memcg =parent_mem_cgroup (memcg))) { +for_each_node (nid) { +for (zid =0 ; zid <MAX_NR_ZONES ; zid++) { + mz = &memcg->nodeinfo[nid]->zoneinfo[zid]; +for (i =0 ; i <=DEF_PRIORITY ; i++) { + iter = &mz->iter[i]; +cmpxchg (&iter->position, + dead_memcg,NULL ); + } + } + } + } +} +/* * Iteration constructs for visiting all cgroups (under a tree). If * loops are exited prematurely (break), mem_cgroup_iter_break() must
@@ -4360,6 +4384,13 @@ static void mem_cgroup_css_offline(strucwb_memcg_offline (memcg); } +static void mem_cgroup_css_released (struct cgroup_subsys_state *css) +{ +struct mem_cgroup *memcg =mem_cgroup_from_css (css); + +invalidate_reclaim_iterators (memcg); +} +static void mem_cgroup_css_free (struct cgroup_subsys_state *css) {struct mem_cgroup *memcg =mem_cgroup_from_css (css);
@@ -5216,6 +5247,7 @@ struct cgroup_subsys memory_cgrp_subsys .css_alloc = mem_cgroup_css_alloc, .css_online = mem_cgroup_css_online, .css_offline = mem_cgroup_css_offline, + .css_released = mem_cgroup_css_released, .css_free = mem_cgroup_css_free, .css_reset = mem_cgroup_css_reset, .can_attach = mem_cgroup_can_attach,
Greg Kroah-Hartman
maintainerPATCH 104/200 ALSA: bebob: Use a signed return type for get_formation_index
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lucas Tanure <[email protected]>
commit 07905298e4d5777eb58516cdc242f7ac1ca387a2 upstream.
The return type "unsigned int" was used by the get_formation_index function
despite of the aspect that it will eventually return a negative error code.
So, change to signed int and get index by reference in the parameters.
Done with the help of Coccinelle.
[Fix the missing braces suggested by Julia Lawall -- tiwai]
--- sound/firewire/bebob/bebob_stream.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-)
sound/firewire/bebob/bebob_stream.c +9 -5
@@ -47,14 +47,16 @@ static const unsigned int bridgeco_freq_ [6] = 0x07, }; -static unsigned int -get_formation_index (unsigned int rate) +static int +get_formation_index (unsigned int rate,unsigned int *index) {unsigned int i;for (i =0 ; i <ARRAY_SIZE (snd_bebob_rate_table); i++) { -if (snd_bebob_rate_table[i] == rate) -return i; +if (snd_bebob_rate_table[i] == rate) { + *index = i; +return 0 ; + } }return -EINVAL ; }
@@ -424,7 +426,9 @@ make_both_connections(struct snd_bebob * goto end;/* confirm params for both streams */ - index =get_formation_index (rate); + err =get_formation_index (rate, &index); +if (err <0 ) + goto end; pcm_channels = bebob->tx_stream_formations[index].pcm; midi_channels = bebob->tx_stream_formations[index].midi; amdtp_stream_set_parameters(&bebob->tx_stream,
Greg Kroah-Hartman
maintainerPATCH 96/200 md/raid10: fix data corruption and crash during resync
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Artur Paszkiewicz <[email protected]>
commit cc57858831e3e9678291de730c4b4d2e52a19f59 upstream.
The commit c31df25f20e3 ("md/raid10: make sync_request_write() call bio_copy_data()") replaced manual data copying with bio_copy_data() but it doesn't work as intended. The source bio (fbio) is already processed, so its bvec_iter has bi_size == 0 and bi_idx == bi_vcnt. Because of this, bio_copy_data() either does not copy anything, or worse, copies data from the ->bi_next bio if it is set. This causes wrong data to be written to drives during resync and sometimes lockups/crashes in bio_copy_data():
[ 517.338478] NMI watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [md126_raid10:3319] [ 517.347324] Modules linked in: raid10 xt_CHECKSUM ipt_MASQUERADE nf_nat_masquerade_ipv4 tun ip6t_rpfilter ip6t_REJECT nf_reject_ipv6 ipt_REJECT nf_reject_ipv4 xt_conntrack ebtable_nat ebtable_broute bridge stp llc ebtable_filter ebtables ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 ip6table_mangle ip6table_security ip6table_raw ip6table_filter ip6_tables iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack iptable_mangle iptable_security iptable_raw iptable_filter ip_tables x86_pkg_temp_thermal coretemp kvm_intel kvm crct10dif_pclmul crc32_pclmul cryptd shpchp pcspkr ipmi_si ipmi_msghandler tpm_crb acpi_power_meter acpi_cpufreq ext4 mbcache jbd2 sr_mod cdrom sd_mod e1000e ax88179_178a usbnet mii ahci ata_generic crc32c_intel libahci ptp pata_acpi libata pps_core wmi sunrpc dm_mirror dm_region_hash dm_log dm_mod [ 517.440555] CPU: 0 PID: 3319 Comm: md126_raid10 Not tainted 4.3.0-rc6+ #1 [ 517.448384] Hardware name: Intel Corporation PURLEY/PURLEY, BIOS PLYDCRB1.86B.0055.D14.1509221924 09/22/2015 [ 517.459768] task: ffff880153773980 ti: ffff880150df8000 task.ti: ffff880150df8000 [ 517.468529] RIP: 0010:[<ffffffff812e1888>] [<ffffffff812e1888>] bio_copy_data+0xc8/0x3c0 [ 517.478164] RSP: 0018:ffff880150dfbc98 EFLAGS: 00000246 [ 517.484341] RAX: ffff880169356688 RBX: 0000000000001000 RCX: 0000000000000000 [ 517.492558] RDX: 0000000000000000 RSI: ffffea0001ac2980 RDI: ffffea0000d835c0 [ 517.500773] RBP: ffff880150dfbd08 R08: 0000000000000001 R09: ffff880153773980 [ 517.508987] R10: ffff880169356600 R11: 0000000000001000 R12: 0000000000010000 [ 517.517199] R13: 000000000000e000 R14: 0000000000000000 R15: 0000000000001000 [ 517.525412] FS: 0000000000000000(0000) GS:ffff880174a00000(0000) knlGS:0000000000000000 [ 517.534844] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 517.541507] CR2: 00007f8a044d5fed CR3: 0000000169504000 CR4: 00000000001406f0 [ 517.549722] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 517.557929] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 517.566144] Stack: [ 517.568626] ffff880174a16bc0 ffff880153773980 ffff880169356600 0000000000000000 [ 517.577659] 0000000000000001 0000000000000001 ffff880153773980 ffff88016a61a800 [ 517.586715] ffff880150dfbcf8 0000000000000001 ffff88016dd209e0 0000000000001000 [ 517.595773] Call Trace: [ 517.598747] [<ffffffffa043ef95>] raid10d+0xfc5/0x1690 [raid10] [ 517.605610] [<ffffffff816697ae>] ? __schedule+0x29e/0x8e2 [ 517.611987] [<ffffffff814ff206>] md_thread+0x106/0x140 [ 517.618072] [<ffffffff810c1d80>] ? wait_woken+0x80/0x80 [ 517.624252] [<ffffffff814ff100>] ? super_1_load+0x520/0x520 [ 517.630817] [<ffffffff8109ef89>] kthread+0xc9/0xe0 [ 517.636506] [<ffffffff8109eec0>] ? flush_kthread_worker+0x70/0x70 [ 517.643653] [<ffffffff8166d99f>] ret_from_fork+0x3f/0x70 [ 517.649929] [<ffffffff8109eec0>] ? flush_kthread_worker+0x70/0x70
--- drivers/md/raid10.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/md/raid10.c +3 -1
@@ -1944,6 +1944,8 @@ static void sync_request_write(struct md first = i; fbio = r10_bio->devs[i].bio; + fbio->bi_iter.bi_size = r10_bio->sectors <<9 ; + fbio->bi_iter.bi_idx =0 ; vcnt = (r10_bio->sectors + (PAGE_SIZE >>9 ) -1 ) >> (PAGE_SHIFT -9 );/* now find blocks with errors */
@@ -1987,7 +1989,7 @@ static void sync_request_write(struct mdbio_reset (tbio); tbio->bi_vcnt = vcnt; - tbio->bi_iter.bi_size = r10_bio->sectors <<9 ; + tbio->bi_iter.bi_size = fbio->bi_iter.bi_size; tbio->bi_rw =WRITE ; tbio->bi_private = r10_bio; tbio->bi_iter.bi_sector = r10_bio->devs[i].addr;
Greg Kroah-Hartman
maintainerPATCH 112/200 ALSA: pcm: Fix potential deadlock in OSS emulation
In reply to Greg Kroah-Hartman4.3-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit b248371628aad599a48540962f6b85a21a8a0c3f upstream.
There are potential deadlocks in PCM OSS emulation code while accessing read/write and mmap concurrently. This comes from the infamous mmap_sem usage in copy_from/to_user(). Namely,
snd_pcm_oss_write() ->
&runtime->oss.params_lock ->
copy_to_user() ->
&mm->mmap_sem
mmap() ->
&mm->mmap_sem ->
snd_pcm_oss_mmap() ->
&runtime->oss.params_lockSince we can't avoid taking params_lock from mmap code path, use trylock variant and aborts with -EAGAIN as a workaround of this AB/BA deadlock.
--- sound/core/oss/pcm_oss.c | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-)
sound/core/oss/pcm_oss.c +15 -6
@@ -834,7 +834,8 @@ static int choose_rate(struct snd_pcm_sureturn snd_pcm_hw_param_near (substream, params,SNDRV_PCM_HW_PARAM_RATE , best_rate,NULL ); } -static int snd_pcm_oss_change_params (struct snd_pcm_substream *substream) +static int snd_pcm_oss_change_params (struct snd_pcm_substream *substream, +bool trylock) {struct snd_pcm_runtime *runtime = substream->runtime;struct snd_pcm_hw_params *params, *sparams;
@@ -848,7 +849,10 @@ static int snd_pcm_oss_change_params(strstruct snd_mask sformat_mask;struct snd_mask mask; -if (mutex_lock_interruptible (&runtime->oss.params_lock)) +if (trylock) { +if (!(mutex_trylock (&runtime->oss.params_lock))) +return -EAGAIN ; + }else if (mutex_lock_interruptible (&runtime->oss.params_lock))return -EINTR ; sw_params =kmalloc (sizeof (*sw_params),GFP_KERNEL ); params =kmalloc (sizeof (*params),GFP_KERNEL );
@@ -1092,7 +1096,7 @@ static int snd_pcm_oss_get_active_substrif (asubstream ==NULL ) asubstream = substream;if (substream->runtime->oss.params) { - err =snd_pcm_oss_change_params (substream); + err =snd_pcm_oss_change_params (substream, false);if (err <0 )return err; }
@@ -1132,7 +1136,7 @@ static int snd_pcm_oss_make_ready(structreturn 0 ; runtime = substream->runtime;if (runtime->oss.params) { - err =snd_pcm_oss_change_params (substream); + err =snd_pcm_oss_change_params (substream, false);if (err <0 )return err; }
@@ -2163,7 +2167,7 @@ static int snd_pcm_oss_get_space(struct runtime = substream->runtime;if (runtime->oss.params && - (err =snd_pcm_oss_change_params (substream)) <0 ) + (err =snd_pcm_oss_change_params (substream, false)) <0 )return err; info.fragsize = runtime->oss.period_bytes;
@@ -2800,7 +2804,12 @@ static int snd_pcm_oss_mmap(struct filereturn -EIO ;if (runtime->oss.params) { -if ((err =snd_pcm_oss_change_params (substream)) <0 ) +/* use mutex_trylock() for params_lock for avoiding a deadlock +* between mmap_sem and params_lock taken by +* copy_from/to_user() in snd_pcm_oss_write/read() +*/ + err =snd_pcm_oss_change_params (substream, true); +if (err <0 )return err; }#ifdef CONFIG_SND_PCM_OSS_PLUGINS