3.14.61-stable review
Greg Kroah-Hartman
maintainercover 3.14.61-stable review
This is the start of the stable review cycle for the 3.14.61 release. There are 76 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Tue Feb 16 22:22:01 UTC 2016. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v3.x/stable-review/patch-3.14.61-rc1.gz
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 3.14.61-rc1
Maciej W. Rozycki <[email protected]>
binfmt_elf: Don't clobber passed executable's file header
Kinglong Mee <[email protected]>
FS-Cache: Don't override netfs's primary_index if registering failed
Kinglong Mee <[email protected]>
FS-Cache: Increase reference of parent after registering, netfs success
Mathias Krause <[email protected]>
crypto: user - lock crypto_alg_list on alg dump
Ryan Ware <[email protected]>
EVM: Use crypto_memneq() for digest comparisons
Wang, Rui Y <[email protected]>
crypto: algif_hash - wait for crypto_ahash_init() to complete
Alexandra Yates <[email protected]>
ahci: Intel DNV device IDs SATA
Tejun Heo <[email protected]>
libata: disable forced PORTS_IMPL for >= AHCI 1.3
Xiangliang Yu <[email protected]>
AHCI: Fix softreset failed issue of Port Multiplier
Herbert Xu <[email protected]>
crypto: af_alg - Fix socket double-free when accept fails
Herbert Xu <[email protected]>
crypto: af_alg - Disallow bind/setkey/... after accept(2)
David Turner <[email protected]>
ext4: Fix handling of extended tv_sec
Mathias Nyman <[email protected]>
xhci: fix usb2 resume timing and races.
Peter Hurley <[email protected]>
tty: Fix unsafe ldisc reference via ioctl(TIOCGETD)
Peter Hurley <[email protected]>
tty: Fix GPF in flush_to_ldisc()
John Ernberg <[email protected]>
USB: option: fix Cinterion AHxx enumeration
Daniele Palmas <[email protected]>
USB: serial: option: Adding support for Telit LE922
Peter Dedecker <[email protected]>
USB: cp210x: add ID for IAI USB to RS485 adaptor
Greg Kroah-Hartman <[email protected]>
USB: serial: ftdi_sio: add support for Yaesu SCU-18 cable
Du, Changbin <[email protected]>
usb: hub: do not clear BOS field during reset device
Johan Hovold <[email protected]>
USB: visor: fix null-deref at probe
Vladis Dronov <[email protected]>
USB: serial: visor: fix crash on detecting device without write_urbs
Mauro Carvalho Chehab <[email protected]>
saa7134-alsa: Only frees registered sound cards
Takashi Iwai <[email protected]>
ALSA: dummy: Implement timer backend switching more safely
Takashi Iwai <[email protected]>
ALSA: hda - Fix speaker output from VAIO AiO machines
David Henningsson <[email protected]>
ALSA: hda - Fix static checker warning in patch_hdmi.c
Takashi Iwai <[email protected]>
ALSA: hda - Add fixup for Mac Mini 7,1 model
Takashi Iwai <[email protected]>
ALSA: timer: Fix race between stop and interrupt
Takashi Iwai <[email protected]>
ALSA: timer: Fix wrong instance passed to slave callbacks
Takashi Iwai <[email protected]>
ALSA: timer: Fix link corruption due to double start or stop
Takashi Iwai <[email protected]>
ALSA: timer: Fix leftover link at closing
Takashi Iwai <[email protected]>
ALSA: timer: Code cleanup
Takashi Iwai <[email protected]>
ALSA: seq: Fix lockdep warnings due to double mutex locks
Takashi Iwai <[email protected]>
ALSA: seq: Fix race at closing in virmidi driver
Takashi Iwai <[email protected]>
ALSA: seq: Fix yet another races among ALSA timer accesses
Vinod Koul <[email protected]>
ASoC: dpcm: fix the BE state on hw_free
Takashi Iwai <[email protected]>
ALSA: pcm: Fix potential deadlock in OSS emulation
Takashi Iwai <[email protected]>
ALSA: rawmidi: Fix race at copying & updating the position
Takashi Iwai <[email protected]>
ALSA: rawmidi: Remove kernel WARNING for NULL user-space buffer check
Takashi Iwai <[email protected]>
ALSA: seq: Fix incorrect sanity check at snd_seq_oss_synth_cleanup()
Takashi Iwai <[email protected]>
ALSA: dummy: Disable switching timer backend via sysfs
Takashi Iwai <[email protected]>
ALSA: compress: Disable GET_CODEC_CAPS ioctl for some architectures
Andrey Konovalov <[email protected]>
ALSA: usb-audio: avoid freeing umidi object twice
Guillaume Fougnies <[email protected]>
ALSA: usb-audio: Fix TEAC UD-501/UD-503/NT-503 usb delay
Al Viro <[email protected]>
fix sysvfs symlinks
Tiffany Lin <[email protected]>
media: vb2 dma-contig: Fully cache synchronise buffers in prepare and finish
Andrzej Hajda <[email protected]>
v4l2-compat-ioctl32: fix alignment for ARM64
Helge Deller <[email protected]>
parisc: Fix __ARCH_SI_PREAMBLE_SIZE
Helge Deller <[email protected]>
parisc: Fix syscall restarts
Helge Deller <[email protected]>
parisc: Drop unused MADV_xxxK_PAGES flags from asm/mman.h
Andy Leiserson <[email protected]>
fix calculation of meta_bg descriptor backups
Jan Kara <[email protected]>
jbd2: Fix unreclaimed pages after truncate in data=journal mode
Qiu Peiyang <[email protected]>
tracing: Fix setting of start_index in find_next()
Christoph Biedl <[email protected]>
PCI: Fix minimum allocation address overwrite
Boris BREZILLON <[email protected]>
mtd: mtdpart: fix add_mtd_partitions error path
Hon Ching \(Vicky\) Lo <[email protected]>
vTPM: fix memory allocation flag for rtce buffer at kernel boot
Uri Mashiach <[email protected]>
wlcore/wl12xx: spi: fix NULL pointer dereference (Oops)
Uri Mashiach <[email protected]>
wlcore/wl12xx: spi: fix oops on firmware load
Johan Hovold <[email protected]>
spi: fix parent-device reference leak
Vignesh R <[email protected]>
spi: ti-qspi: Fix data corruption seen on r/w stress test
David Mosberger-Tang <[email protected]>
spi: atmel: Fix DMA-setup for transfers with more than 8 bits per word
Mauricio Faria de Oliveira <[email protected]>
Revert "dm mpath: fix stalls when handling invalid ioctls"
Dmitry V. Levin <[email protected]>
sh64: fix __NR_fgetxattr
xuejiufei <[email protected]>
ocfs2/dlm: clear refmap bit of recovery lock while doing local recovery cleanup
xuejiufei <[email protected]>
ocfs2/dlm: ignore cleaning the migration mle that is inuse
Junxiao Bi <[email protected]>
ocfs2: fix SGID not inherited issue
Richard Weinberger <[email protected]>
kernel/signal.c: unexport sigsuspend()
OGAWA Hirofumi <[email protected]>
fat: fix fake_offset handling on error path
Arnd Bergmann <[email protected]>
remoteproc: avoid stack overflow in debugfs file
Oleg Nesterov <[email protected]>
proc: actually make proc_fd_permission() thread-friendly
Ioan-Adrian Ratiu <[email protected]>
HID: usbhid: fix recursive deadlock
Seth Jennings <[email protected]>
drivers/base/memory.c: prohibit offlining of memory blocks with missing sections
Mike Snitzer <[email protected]>
dm btree: fix leak of bufio-backed block in btree_split_sibling error path
Herbert Xu <[email protected]>
crypto: algif_hash - Only export and import on sockets with data
libin <[email protected]>
recordmcount: Fix endianness handling bug for nop_mcount
Greg Kroah-Hartman <[email protected]>
xhci: fix placement of call to usb_disabled()
-------------
Diffstat:
Makefile | 4 +- arch/parisc/include/uapi/asm/mman.h | 10 -- arch/parisc/include/uapi/asm/siginfo.h | 4 + arch/parisc/kernel/signal.c | 64 +++++-- arch/sh/include/uapi/asm/unistd_64.h | 2 +- crypto/af_alg.c | 39 ++++- crypto/algif_hash.c | 16 +- crypto/crypto_user.c | 6 +- drivers/ata/ahci.c | 20 +++ drivers/ata/libahci.c | 13 +- drivers/base/memory.c | 4 + drivers/char/tpm/tpm_ibmvtpm.c | 2 +- drivers/hid/usbhid/hid-core.c | 4 +- drivers/md/dm-mpath.c | 7 +- drivers/md/persistent-data/dm-btree.c | 4 +- drivers/media/pci/saa7134/saa7134-alsa.c | 5 +- drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 9 +- drivers/media/v4l2-core/videobuf2-dma-contig.c | 5 +- drivers/mtd/mtdpart.c | 4 +- drivers/net/wireless/ti/wlcore/io.h | 10 +- drivers/net/wireless/ti/wlcore/spi.c | 10 +- drivers/pci/bus.c | 6 +- drivers/remoteproc/remoteproc_debugfs.c | 2 +- drivers/spi/spi-atmel.c | 3 +- drivers/spi/spi-ti-qspi.c | 3 +- drivers/spi/spi.c | 2 +- drivers/tty/tty_buffer.c | 2 +- drivers/tty/tty_io.c | 24 ++- drivers/usb/core/hub.c | 8 +- drivers/usb/host/xhci-hub.c | 45 ++++- drivers/usb/host/xhci-ring.c | 3 +- drivers/usb/host/xhci.c | 6 +- drivers/usb/serial/cp210x.c | 1 + drivers/usb/serial/ftdi_sio.c | 1 + drivers/usb/serial/ftdi_sio_ids.h | 1 + drivers/usb/serial/option.c | 18 +- drivers/usb/serial/visor.c | 11 +- fs/binfmt_elf.c | 10 +- fs/ext4/ext4.h | 51 +++++- fs/ext4/resize.c | 4 +- fs/fat/dir.c | 16 +- fs/fscache/netfs.c | 38 ++-- fs/jbd2/transaction.c | 2 + fs/ocfs2/dlm/dlmmaster.c | 26 +-- fs/ocfs2/dlm/dlmrecovery.c | 2 + fs/ocfs2/namei.c | 4 +- fs/proc/fd.c | 14 +- fs/sysv/inode.c | 10 +- include/crypto/if_alg.h | 8 +- include/linux/signal.h | 1 - kernel/signal.c | 2 +- kernel/trace/trace_printk.c | 1 + scripts/recordmcount.h | 2 +- security/integrity/evm/evm_main.c | 3 +- sound/core/compress_offload.c | 11 ++ sound/core/oss/pcm_oss.c | 21 ++- sound/core/rawmidi.c | 36 ++-- sound/core/seq/oss/seq_oss_synth.c | 2 +- sound/core/seq/seq_clientmgr.c | 3 + sound/core/seq/seq_ports.c | 233 ++++++++++++++----------- sound/core/seq/seq_timer.c | 87 ++++++--- sound/core/seq/seq_virmidi.c | 6 +- sound/core/timer.c | 64 ++++--- sound/drivers/dummy.c | 35 ++-- sound/pci/hda/patch_cirrus.c | 27 +++ sound/pci/hda/patch_hdmi.c | 3 +- sound/pci/hda/patch_realtek.c | 1 + sound/soc/soc-pcm.c | 3 +- sound/usb/midi.c | 1 - sound/usb/quirks.c | 14 +- 70 files changed, 777 insertions(+), 342 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 2/76 recordmcount: Fix endianness handling bug for nop_mcount
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: libin <[email protected]>
commit c84da8b9ad3761eef43811181c7e896e9834b26b upstream.
In nop_mcount, shdr->sh_offset and welp->r_offset should handle endianness properly, otherwise it will trigger Segmentation fault if the recordmcount main and file.o have different endianness.
--- scripts/recordmcount.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
scripts/recordmcount.h +1 -1
@@ -377,7 +377,7 @@ static void nop_mcount(Elf_Shdr const *cif (mcountsym ==Elf_r_sym (relp) && !is_fake_mcount (relp)) {if (make_nop) - ret =make_nop ((void *)ehdr, shdr->sh_offset + relp->r_offset); + ret =make_nop ((void *)ehdr,_w (shdr->sh_offset) +_w (relp->r_offset));if (warn_on_notrace_sect && !once) {printf ("Section %s has mcount callers being ignored\n" , txtname);
Greg Kroah-Hartman
maintainerPATCH 8/76 remoteproc: avoid stack overflow in debugfs file
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
commit 92792e48e2ae6051af30468a87994b5432da2f06 upstream.
Recent gcc versions warn about reading from a negative offset of an on-stack array:
drivers/remoteproc/remoteproc_debugfs.c: In function 'rproc_recovery_write':drivers/remoteproc/remoteproc_debugfs.c:167:9: warning: 'buf[4294967295u]' may be used uninitialized in this function [-Wmaybe-uninitialized]
I don't see anything in sys_write() that prevents us from being called with a zero 'count' argument, so we should add an extra check in rproc_recovery_write() to prevent the access and avoid the warning.
--- drivers/remoteproc/remoteproc_debugfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/remoteproc/remoteproc_debugfs.c +1 -1
@@ -156,7 +156,7 @@ rproc_recovery_write(struct file *filp,char buf[10 ];int ret; -if (count >sizeof (buf)) +if (count <1 || count >sizeof (buf))return count; ret =copy_from_user (buf, user_buf, count);
Greg Kroah-Hartman
maintainerPATCH 11/76 ocfs2: fix SGID not inherited issue
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junxiao Bi <[email protected]>
commit 854ee2e944b4daf795e32562a7d2f9e90ab5a6a8 upstream.
Commit 8f1eb48758aa ("ocfs2: fix umask ignored issue") introduced an issue, SGID of sub dir was not inherited from its parents dir. It is because SGID is set into "inode->i_mode" in ocfs2_get_init_inode(), but is overwritten by "mode" which don't have SGID set later.
--- fs/ocfs2/namei.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
fs/ocfs2/namei.c +1 -3
@@ -340,13 +340,11 @@ static int ocfs2_mknod(struct inode *dir goto leave; } - status =posix_acl_create (dir, &mode, &default_acl, &acl); + status =posix_acl_create (dir, &inode->i_mode, &default_acl, &acl);if (status) {mlog_errno (status); goto leave; } -/* update inode->i_mode after mask with "umask". */ - inode->i_mode = mode; handle = ocfs2_start_trans(osb, ocfs2_mknod_credits(osb->sb, S_ISDIR(mode),
Greg Kroah-Hartman
maintainerPATCH 13/76 ocfs2/dlm: clear refmap bit of recovery lock while doing local recovery cleanup
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: xuejiufei <[email protected]>
commit c95a51807b730e4681e2ecbdfd669ca52601959e upstream.
When recovery master down, dlm_do_local_recovery_cleanup() only remove the $RECOVERY lock owned by dead node, but do not clear the refmap bit. Which will make umount thread falling in dead loop migrating $RECOVERY to the dead node.
--- fs/ocfs2/dlm/dlmrecovery.c | 2 ++ 1 file changed, 2 insertions(+)
fs/ocfs2/dlm/dlmrecovery.c +2 -0
@@ -2332,6 +2332,8 @@ static void dlm_do_local_recovery_cleanubreak ; } } +dlm_lockres_clear_refmap_bit (dlm, res, + dead_node);spin_unlock (&res->spinlock);continue ; }
Greg Kroah-Hartman
maintainerPATCH 14/76 sh64: fix __NR_fgetxattr
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry V. Levin <[email protected]>
commit 2d33fa1059da4c8e816627a688d950b613ec0474 upstream.
According to arch/sh/kernel/syscalls_64.S and common sense, __NR_fgetxattr has to be defined to 259, but it doesn't. Instead, it's defined to 269, which is of course used by another syscall, __NR_sched_setaffinity in this case.
This bug was found by strace test suite.
--- arch/sh/include/uapi/asm/unistd_64.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/sh/include/uapi/asm/unistd_64.h +1 -1
@@ -278,7 +278,7 @@#define __NR_fsetxattr 256#define __NR_getxattr 257#define __NR_lgetxattr 258 -#define __NR_fgetxattr 269 +#define __NR_fgetxattr 259#define __NR_listxattr 260#define __NR_llistxattr 261#define __NR_flistxattr 262
Greg Kroah-Hartman
maintainerPATCH 15/76 Revert "dm mpath: fix stalls when handling invalid ioctls"
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mauricio Faria de Oliveira <[email protected]>
commit 47796938c46b943d157ac8a6f9ed4e3b98b83cf4 upstream.
This reverts commit a1989b330093578ea5470bea0a00f940c444c466.
That commit introduced a regression at least for the case of the SG_IO ioctl() running without CAP_SYS_RAWIO capability (e.g., unprivileged users) when there are no active paths: the ioctl() fails with the ENOTTY errno immediately rather than blocking due to queue_if_no_path until a path becomes active, for example.
That case happens to be exercised by QEMU KVM guests with 'scsi-block' devices (qemu "-device scsi-block" [1], libvirt "<disk type='block' device='lun'>" [2]) from multipath devices; which leads to SCSI/filesystem errors in such a guest.
More general scenarios can hit that regression too. The following demonstration employs a SG_IO ioctl() with a standard SCSI INQUIRY command for this objective (some output & user changes omitted for brevity and comments added for clarity).
Reverting that commit restores normal operation (queueing) in failing scenarios; tested on linux-next (next-20151022).
1) Test-case is based on sg_simple0 [3] (just SG_IO; remove SG_GET_VERSION_NUM)
$ cat sg_simple0.c
... see [3] ...
$ sed '/SG_GET_VERSION_NUM/,/}/d' sg_simple0.c > sgio_inquiry.c
$ gcc sgio_inquiry.c -o sgio_inquiry2) The ioctl() works fine with active paths present.
# multipath -l 85ag56
85ag56 (...) dm-19 IBM ,2145
size=60G features='1 queue_if_no_path' hwhandler='0' wp=rw
|-+- policy='service-time 0' prio=0 status=active
| |- 8:0:11:0 sdz 65:144 active undef running
| `- 9:0:9:0 sdbf 67:144 active undef running
`-+- policy='service-time 0' prio=0 status=enabled
|- 8:0:12:0 sdae 65:224 active undef running
`- 9:0:12:0 sdbo 68:32 active undef running $ ./sgio_inquiry /dev/mapper/85ag56
Some of the INQUIRY command's response:
IBM 2145 0000
INQUIRY duration=0 millisecs, resid=03) The ioctl() fails with ENOTTY errno with _no_ active paths present, for unprivileged users (rather than blocking due to queue_if_no_path).
# for path in $(multipath -l 85ag56 | grep -o 'sd[a-z]\+'); \
do multipathd -k"fail path $path"; done # multipath -l 85ag56
85ag56 (...) dm-19 IBM ,2145
size=60G features='1 queue_if_no_path' hwhandler='0' wp=rw
|-+- policy='service-time 0' prio=0 status=enabled
| |- 8:0:11:0 sdz 65:144 failed undef running
| `- 9:0:9:0 sdbf 67:144 failed undef running
`-+- policy='service-time 0' prio=0 status=enabled
|- 8:0:12:0 sdae 65:224 failed undef running
`- 9:0:12:0 sdbo 68:32 failed undef running $ ./sgio_inquiry /dev/mapper/85ag56
sg_simple0: Inquiry SG_IO ioctl error: Inappropriate ioctl for device4) dmesg shows that scsi_verify_blk_ioctl() failed for SG_IO (0x2285); it returns -ENOIOCTLCMD, later replaced with -ENOTTY in vfs_ioctl().
$ dmesg
<...>
[] device-mapper: multipath: Failing path 65:144.
[] device-mapper: multipath: Failing path 67:144.
[] device-mapper: multipath: Failing path 65:224.
[] device-mapper: multipath: Failing path 68:32.
[] sgio_inquiry: sending ioctl 2285 to a partition!5) The ioctl() only works if the SYS_CAP_RAWIO capability is present (then queueing happens -- in this example, queue_if_no_path is set); this is due to a conditional check in scsi_verify_blk_ioctl().
# capsh --drop=cap_sys_rawio -- -c './sgio_inquiry /dev/mapper/85ag56'
sg_simple0: Inquiry SG_IO ioctl error: Inappropriate ioctl for device # ./sgio_inquiry /dev/mapper/85ag56 &
[1] 72830 # cat /proc/72830/stack
[<c00000171c0df700>] 0xc00000171c0df700
[<c000000000015934>] __switch_to+0x204/0x350
[<c000000000152d4c>] msleep+0x5c/0x80
[<c00000000077dfb0>] dm_blk_ioctl+0x70/0x170
[<c000000000487c40>] blkdev_ioctl+0x2b0/0x9b0
[<c0000000003128e4>] block_ioctl+0x64/0xd0
[<c0000000002dd3b0>] do_vfs_ioctl+0x490/0x780
[<c0000000002dd774>] SyS_ioctl+0xd4/0xf0
[<c000000000009358>] system_call+0x38/0xd06) This is the function call chain exercised in this analysis:
SYSCALL_DEFINE3(ioctl, <...>) @ fs/ioctl.c
-> do_vfs_ioctl()
-> vfs_ioctl()
...
error = filp->f_op->unlocked_ioctl(filp, cmd, arg);
...
-> dm_blk_ioctl() @ drivers/md/dm.c
-> multipath_ioctl() @ drivers/md/dm-mpath.c
...
(bdev = NULL, due to no active paths)
...
if (!bdev || <...>) {
int err = scsi_verify_blk_ioctl(NULL, cmd);
if (err)
r = err;
}
...
-> scsi_verify_blk_ioctl() @ block/scsi_ioctl.c
...
if (bd && bd == bd->bd_contains) // not taken (bd = NULL)
return 0;
...
if (capable(CAP_SYS_RAWIO)) // not taken (unprivileged user)
return 0;
...
printk_ratelimited(KERN_WARNING
"%s: sending ioctl %x to a partition!\n" <...>);
return -ENOIOCTLCMD;
<-
...
return r ? : <...>
<-
...
if (error == -ENOIOCTLCMD)
error = -ENOTTY;
out:
return error;
...Links:
[1] http://git.qemu.org/?p=qemu.git;a=commit;h=336a6915bc7089fb20fea4ba99972ad9a97c5f52
[2] https://libvirt.org/formatdomain.html#elementsDisks (see 'disk' -> 'device')
[3] http://tldp.org/HOWTO/SCSI-Generic-HOWTO/pexample.html (Revision 1.2, 2002-05-03)
--- drivers/md/dm-mpath.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-)
drivers/md/dm-mpath.c +2 -5
@@ -1626,11 +1626,8 @@ static int multipath_ioctl(struct dm_tar/* * Only pass ioctls through if the device sizes match exactly. */ -if (!bdev || ti->len !=i_size_read (bdev->bd_inode) >>SECTOR_SHIFT ) { -int err =scsi_verify_blk_ioctl (NULL , cmd); -if (err) - r = err; - } +if (!r && ti->len !=i_size_read (bdev->bd_inode) >>SECTOR_SHIFT ) + r =scsi_verify_blk_ioctl (NULL , cmd);if (r == -ENOTCONN && !fatal_signal_pending (current))queue_work (kmultipathd, &m->process_queued_ios);
Greg Kroah-Hartman
maintainerPATCH 16/76 spi: atmel: Fix DMA-setup for transfers with more than 8 bits per word
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Mosberger-Tang <[email protected]>
commit 06515f83908d038d9e12ffa3dcca27a1b67f2de0 upstream.
The DMA-slave configuration depends on the whether <= 8 or > 8 bits are transferred per word, so we need to call atmel_spi_dma_slave_config() with the correct value.
--- drivers/spi/spi-atmel.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/spi/spi-atmel.c +2 -1
@@ -593,7 +593,8 @@ static int atmel_spi_next_xfer_dma_submi *plen = len; -if (atmel_spi_dma_slave_config (as, &slave_config,8 )) +if (atmel_spi_dma_slave_config (as, &slave_config, + xfer->bits_per_word)) goto err_exit;/* Send both scatterlists */
Greg Kroah-Hartman
maintainerPATCH 17/76 spi: ti-qspi: Fix data corruption seen on r/w stress test
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vignesh R <[email protected]>
commit bc27a53928981662079aa243915b443370294a03 upstream.
Writing invalid command to QSPI_SPI_CMD_REG will terminate current transfer and de-assert the chip select. This has to be done before calling spi_finalize_current_message(). Because spi_finalize_current_message() will mark the end of current message transfer and schedule the next transfer. If the chipselect is not de-asserted before calling spi_finalize_current_message() then the next transfer will overlap with the previous transfer leading to data corruption.__spi_pump_message() can be called either from kthread worker context or directly from the calling process's context. It is possible that these two calls can race against each other. But race is serialized by checking whether master->cur_msg == NULL (pointer to msg being handled by transfer_one() at present). The master->cur_msg is set to NULL when spi_finalize_current_message() is called on that message, which means calling spi_finalize_current_message() allows __spi_sync() to pump next message in calling process context.
Now if spi-ti-qspi calls spi_finalize_current_message() before we terminate transfer at hardware side, if __spi_pump_message() is called from process context then the successive transactions can overlap.
Fix this by moving writing invalid command to QSPI_SPI_CMD_REG to before calling spi_finalize_current_message() call.
--- drivers/spi/spi-ti-qspi.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/spi/spi-ti-qspi.c +1 -2
@@ -364,11 +364,10 @@ static int ti_qspi_start_transfer_one(stmutex_unlock (&qspi->list_lock); +ti_qspi_write (qspi, qspi->cmd |QSPI_INVAL ,QSPI_SPI_CMD_REG ); m->status = status;spi_finalize_current_message (master); -ti_qspi_write (qspi, qspi->cmd |QSPI_INVAL ,QSPI_SPI_CMD_REG ); -return status; }
Greg Kroah-Hartman
maintainerPATCH 19/76 wlcore/wl12xx: spi: fix oops on firmware load
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uri Mashiach <[email protected]>
commit 9b2761cb72dc41e1948c8a5512b4efd384eda130 upstream.
The maximum chunks used by the function is (SPI_AGGR_BUFFER_SIZE / WSPI_MAX_CHUNK_SIZE + 1).
The original commands array had space for (SPI_AGGR_BUFFER_SIZE / WSPI_MAX_CHUNK_SIZE) commands. When the last chunk is used (len > 4 * WSPI_MAX_CHUNK_SIZE), the last command is stored outside the bounds of the commands array.
Oops 5 (page fault) is generated during current wl1271 firmware load attempt:
root@debian-armhf:~# ifconfig wlan0 up [ 294.312399] Unable to handle kernel paging request at virtual address 00203fc4 [ 294.320173] pgd = de528000 [ 294.323028] [00203fc4] *pgd=00000000 [ 294.326916] Internal error: Oops: 5 [#1] SMP ARM [ 294.331789] Modules linked in: bnep rfcomm bluetooth ipv6 arc4 wl12xx wlcore mac80211 musb_dsps cfg80211 musb_hdrc usbcore usb_common wlcore_spi omap_rng rng_core musb_am335x omap_wdt cpufreq_dt thermal_sys hwmon [ 294.351838] CPU: 0 PID: 1827 Comm: ifconfig Not tainted 4.2.0-00002-g3e9ad27-dirty #78 [ 294.360154] Hardware name: Generic AM33XX (Flattened Device Tree) [ 294.366557] task: dc9d6d40 ti: de550000 task.ti: de550000 [ 294.372236] PC is at __spi_validate+0xa8/0x2ac [ 294.376902] LR is at __spi_sync+0x78/0x210 [ 294.381200] pc : [<c049c760>] lr : [<c049ebe0>] psr: 60000013 [ 294.381200] sp : de551998 ip : de5519d8 fp : 00200000 [ 294.393242] r10: de551c8c r9 : de5519d8 r8 : de3a9000 [ 294.398730] r7 : de3a9258 r6 : de3a9400 r5 : de551a48 r4 : 00203fbc [ 294.405577] r3 : 00000000 r2 : 00000000 r1 : 00000000 r0 : de3a9000 [ 294.412420] Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user [ 294.419918] Control: 10c5387d Table: 9e528019 DAC: 00000015 [ 294.425954] Process ifconfig (pid: 1827, stack limit = 0xde550218) [ 294.432437] Stack: (0xde551998 to 0xde552000)
...
[ 294.883613] [<c049c760>] (__spi_validate) from [<c049ebe0>] (__spi_sync+0x78/0x210) [ 294.891670] [<c049ebe0>] (__spi_sync) from [<bf036598>] (wl12xx_spi_raw_write+0xfc/0x148 [wlcore_spi]) [ 294.901661] [<bf036598>] (wl12xx_spi_raw_write [wlcore_spi]) from [<bf21c694>] (wlcore_boot_upload_firmware+0x1ec/0x458 [wlcore]) [ 294.914038] [<bf21c694>] (wlcore_boot_upload_firmware [wlcore]) from [<bf24532c>] (wl12xx_boot+0xc10/0xfac [wl12xx]) [ 294.925161] [<bf24532c>] (wl12xx_boot [wl12xx]) from [<bf20d5cc>] (wl1271_op_add_interface+0x5b0/0x910 [wlcore]) [ 294.936364] [<bf20d5cc>] (wl1271_op_add_interface [wlcore]) from [<bf15c4ac>] (ieee80211_do_open+0x44c/0xf7c [mac80211]) [ 294.947963] [<bf15c4ac>] (ieee80211_do_open [mac80211]) from [<c0537978>] (__dev_open+0xa8/0x110) [ 294.957307] [<c0537978>] (__dev_open) from [<c0537bf8>] (__dev_change_flags+0x88/0x148) [ 294.965713] [<c0537bf8>] (__dev_change_flags) from [<c0537cd0>] (dev_change_flags+0x18/0x48) [ 294.974576] [<c0537cd0>] (dev_change_flags) from [<c05a55a0>] (devinet_ioctl+0x6b4/0x7d0) [ 294.983191] [<c05a55a0>] (devinet_ioctl) from [<c0517040>] (sock_ioctl+0x1e4/0x2bc) [ 294.991244] [<c0517040>] (sock_ioctl) from [<c017d378>] (do_vfs_ioctl+0x420/0x6b0) [ 294.999208] [<c017d378>] (do_vfs_ioctl) from [<c017d674>] (SyS_ioctl+0x6c/0x7c) [ 295.006880] [<c017d674>] (SyS_ioctl) from [<c000f4c0>] (ret_fast_syscall+0x0/0x54) [ 295.014835] Code: e1550004 e2444034 0a00007d e5953018 (e5942008) [ 295.021544] ---[ end trace 66ed188198f4e24e ]---
--- drivers/net/wireless/ti/wlcore/spi.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/net/wireless/ti/wlcore/spi.c +7 -3
@@ -72,7 +72,10 @@*/ #define SPI_AGGR_BUFFER_SIZE (4 * PAGE_SIZE) -#define WSPI_MAX_NUM_OF_CHUNKS (SPI_AGGR_BUFFER_SIZE / WSPI_MAX_CHUNK_SIZE) +/* Maximum number of SPI write chunks */ +#define WSPI_MAX_NUM_OF_CHUNKS \ + ((SPI_AGGR_BUFFER_SIZE / WSPI_MAX_CHUNK_SIZE) + 1) +struct wl12xx_spi_glue {struct device *dev;
@@ -270,9 +273,10 @@ static int __must_check wl12xx_spi_raw_w void *buf, size_t len, bool fixed) {struct wl12xx_spi_glue *glue =dev_get_drvdata (child->parent); -struct spi_transfer t[2 * (WSPI_MAX_NUM_OF_CHUNKS +1 )]; +/* SPI write buffers - 2 for each chunk */ +struct spi_transfer t[2 *WSPI_MAX_NUM_OF_CHUNKS ];struct spi_message m; -u32 commands[WSPI_MAX_NUM_OF_CHUNKS ]; +u32 commands[WSPI_MAX_NUM_OF_CHUNKS ];/* 1 command per chunk */ u32 *cmd;u32 chunk_len;int i;
Greg Kroah-Hartman
maintainerPATCH 20/76 wlcore/wl12xx: spi: fix NULL pointer dereference (Oops)
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uri Mashiach <[email protected]>
commit e47301b06d5a65678690f04c2248fd181db1e59a upstream.
Fix the below Oops when trying to modprobe wlcore_spi. The oops occurs because the wl1271_power_{off,on}() function doesn't check the power() function pointer.
[ 23.401447] Unable to handle kernel NULL pointer dereference at virtual address 00000000 [ 23.409954] pgd = c0004000 [ 23.412922] [00000000] *pgd=00000000 [ 23.416693] Internal error: Oops: 80000007 [#1] SMP ARM [ 23.422168] Modules linked in: wl12xx wlcore mac80211 cfg80211
musb_dsps musb_hdrc usbcore usb_common snd_soc_simple_card evdev joydev omap_rng wlcore_spi snd_soc_tlv320aic23_i2c rng_core snd_soc_tlv320aic23 c_can_platform c_can can_dev snd_soc_davinci_mcasp snd_soc_edma snd_soc_omap omap_wdt musb_am335x cpufreq_dt thermal_sys hwmon
[ 23.453253] CPU: 0 PID: 36 Comm: kworker/0:2 Not tainted 4.2.0-00002-g951efee-dirty #233 [ 23.461720] Hardware name: Generic AM33XX (Flattened Device Tree) [ 23.468123] Workqueue: events request_firmware_work_func [ 23.473690] task: de32efc0 ti: de4ee000 task.ti: de4ee000 [ 23.479341] PC is at 0x0 [ 23.482112] LR is at wl12xx_set_power_on+0x28/0x124 [wlcore] [ 23.488074] pc : [<00000000>] lr : [<bf2581f0>] psr: 60000013 [ 23.488074] sp : de4efe50 ip : 00000002 fp : 00000000 [ 23.500162] r10: de7cdd00 r9 : dc848800 r8 : bf27af00 [ 23.505663] r7 : bf27a1a8 r6 : dcbd8a80 r5 : dce0e2e0 r4 : dce0d2e0 [ 23.512536] r3 : 00000000 r2 : 00000000 r1 : 00000001 r0 : dc848810 [ 23.519412] Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment kernel [ 23.527109] Control: 10c5387d Table: 9cb78019 DAC: 00000015 [ 23.533160] Process kworker/0:2 (pid: 36, stack limit = 0xde4ee218) [ 23.539760] Stack: (0xde4efe50 to 0xde4f0000)
[...]
[ 23.665030] [<bf2581f0>] (wl12xx_set_power_on [wlcore]) from [<bf25f7ac>] (wlcore_nvs_cb+0x118/0xa4c [wlcore]) [ 23.675604] [<bf25f7ac>] (wlcore_nvs_cb [wlcore]) from [<c04387ec>] (request_firmware_work_func+0x30/0x58) [ 23.685784] [<c04387ec>] (request_firmware_work_func) from [<c0058e2c>] (process_one_work+0x1b4/0x4b4) [ 23.695591] [<c0058e2c>] (process_one_work) from [<c0059168>] (worker_thread+0x3c/0x4a4) [ 23.704124] [<c0059168>] (worker_thread) from [<c005ee68>] (kthread+0xd4/0xf0) [ 23.711747] [<c005ee68>] (kthread) from [<c000f598>] (ret_from_fork+0x14/0x3c) [ 23.719357] Code: bad PC value [ 23.722760] ---[ end trace 981be8510db9b3a9 ]---
Prevent oops by validationg power() pointer value before calling the function.
--- drivers/net/wireless/ti/wlcore/io.h | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/net/wireless/ti/wlcore/io.h +7 -3
@@ -203,19 +203,23 @@ static inline int __must_check wlcore_wrstatic inline void wl1271_power_off (struct wl1271 *wl) { -int ret; +int ret =0 ;if (!test_bit (WL1271_FLAG_GPIO_POWER , &wl->flags))return ; - ret = wl->if_ops->power (wl->dev, false); +if (wl->if_ops->power) + ret = wl->if_ops->power (wl->dev, false);if (!ret)clear_bit (WL1271_FLAG_GPIO_POWER , &wl->flags); }static inline int wl1271_power_on (struct wl1271 *wl) { -int ret = wl->if_ops->power (wl->dev, true); +int ret =0 ; + +if (wl->if_ops->power) + ret = wl->if_ops->power (wl->dev, true);if (ret ==0 )set_bit (WL1271_FLAG_GPIO_POWER , &wl->flags);
Greg Kroah-Hartman
maintainerPATCH 21/76 vTPM: fix memory allocation flag for rtce buffer at kernel boot
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hon Ching \(Vicky\) Lo <[email protected]>
commit 60ecd86c4d985750efa0ea3d8610972b09951715 upstream.
At ibm vtpm initialzation, tpm_ibmvtpm_probe() registers its interrupt handler, ibmvtpm_interrupt, which calls ibmvtpm_crq_process to allocate memory for rtce buffer. The current code uses 'GFP_KERNEL' as the type of kernel memory allocation, which resulted a warning at kernel/lockdep.c. This patch uses 'GFP_ATOMIC' instead so that the allocation is high-priority and does not sleep.
--- drivers/char/tpm/tpm_ibmvtpm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/char/tpm/tpm_ibmvtpm.c +1 -1
@@ -490,7 +490,7 @@ static void ibmvtpm_crq_process(struct i } ibmvtpm->rtce_size =be16_to_cpu (crq->len); ibmvtpm->rtce_buf =kmalloc (ibmvtpm->rtce_size, -GFP_KERNEL ); +GFP_ATOMIC );if (!ibmvtpm->rtce_buf) {dev_err (ibmvtpm->dev,"Failed to allocate memory for rtce buffer\n" );return ;
Greg Kroah-Hartman
maintainerPATCH 22/76 mtd: mtdpart: fix add_mtd_partitions error path
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boris BREZILLON <[email protected]>
commit e5bae86797141e4a95e42d825f737cb36d7b8c37 upstream.
If we fail to allocate a partition structure in the middle of the partition creation process, the already allocated partitions are never removed, which means they are still present in the partition list and their resources are never freed.
--- drivers/mtd/mtdpart.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/mtd/mtdpart.c +3 -1
@@ -635,8 +635,10 @@ int add_mtd_partitions(struct mtd_info *for (i =0 ; i < nbparts; i++) { slave =allocate_partition (master, parts + i, i, cur_offset); -if (IS_ERR (slave)) +if (IS_ERR (slave)) { +del_mtd_partitions (master);return PTR_ERR (slave); + }mutex_lock (&mtd_partitions_mutex);list_add (&slave->list, &mtd_partitions);
Greg Kroah-Hartman
maintainerPATCH 23/76 PCI: Fix minimum allocation address overwrite
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Biedl <[email protected]>
commit 3460baa620685c20f5ee19afb6d99d26150c382c upstream.
Commit 36e097a8a297 ("PCI: Split out bridge window override of minimum allocation address") claimed to do no functional changes but unfortunately
did: The "min" variable is altered. At least the AVM A1 PCMCIA adapter was no longer detected, breaking ISDN operation.
Use a local copy of "min" to restore the previous behaviour.
--- drivers/pci/bus.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/pci/bus.c +4 -2
@@ -147,6 +147,8 @@ static int pci_bus_alloc_from_region(str type_mask |=IORESOURCE_IO |IORESOURCE_MEM ;pci_bus_for_each_resource (bus, r, i) { +resource_size_t min_used = min; +if (!r)continue ;
@@ -170,12 +172,12 @@ static int pci_bus_alloc_from_region(str* overrides "min". */ if (avail.start) - min = avail.start; + min_used = avail.start; max = avail.end;/* Ok, try it out.. */ - ret =allocate_resource (r, res, size, min, max, + ret =allocate_resource (r, res, size, min_used, max, align, alignf, alignf_data);if (ret ==0 )return 0 ;
Greg Kroah-Hartman
maintainerPATCH 24/76 tracing: Fix setting of start_index in find_next()
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qiu Peiyang <[email protected]>
commit f36d1be2930ede0a1947686e1126ffda5d5ee1bb upstream.
When we do cat /sys/kernel/debug/tracing/printk_formats, we hit kernel panic at t_show.
general protection fault: 0000 [#1] PREEMPT SMP CPU: 0 PID: 2957 Comm: sh Tainted: G W O 3.14.55-x86_64-01062-gd4acdc7 #2 RIP: 0010:[<ffffffff811375b2>] [<ffffffff811375b2>] t_show+0x22/0xe0 RSP: 0000:ffff88002b4ebe80 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000004 RDX: 0000000000000004 RSI: ffffffff81fd26a6 RDI: ffff880032f9f7b1 RBP: ffff88002b4ebe98 R08: 0000000000001000 R09: 000000000000ffec R10: 0000000000000000 R11: 000000000000000f R12: ffff880004d9b6c0 R13: 7365725f6d706400 R14: ffff880004d9b6c0 R15: ffffffff82020570 FS: 0000000000000000(0000) GS:ffff88003aa00000(0063) knlGS:00000000f776bc40 CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 CR2: 00000000f6c02ff0 CR3: 000000002c2b3000 CR4: 00000000001007f0 Call Trace: [<ffffffff811dc076>] seq_read+0x2f6/0x3e0 [<ffffffff811b749b>] vfs_read+0x9b/0x160 [<ffffffff811b7f69>] SyS_read+0x49/0xb0 [<ffffffff81a3a4b9>] ia32_do_call+0x13/0x13 ---[ end trace 5bd9eb630614861e ]--- Kernel panic - not syncing: Fatal exception
When the first time find_next calls find_next_mod_format, it should iterate the trace_bprintk_fmt_list to find the first print format of the module. However in current code, start_index is smaller than *pos at first, and code will not iterate the list. Latter container_of will get the wrong address with former v, which will cause mod_fmt be a meaningless object and so is the returned mod_fmt->fmt.
This patch will fix it by correcting the start_index. After fixed, when the first time calls find_next_mod_format, start_index will be equal to *pos, and code will iterate the trace_bprintk_fmt_list to get the right module printk format, so is the returned mod_fmt->fmt.
--- kernel/trace/trace_printk.c | 1 + 1 file changed, 1 insertion(+)
kernel/trace/trace_printk.c +1 -0
@@ -269,6 +269,7 @@ static const char **find_next(void *v, lif (*pos < last_index + start_index)return __start___tracepoint_str + (*pos - last_index); + start_index += last_index;return find_next_mod_format (start_index, v, fmt, pos); }
Greg Kroah-Hartman
maintainerPATCH 27/76 parisc: Drop unused MADV_xxxK_PAGES flags from asm/mman.h
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Helge Deller <[email protected]>
commit dcbf0d299c00ed4f82ea8d6e359ad88a5182f9b8 upstream.
Drop the MADV_xxK_PAGES flags, which were never used and were from a proposed API which was never integrated into the generic Linux kernel code.
--- arch/parisc/include/uapi/asm/mman.h | 10 ---------- 1 file changed, 10 deletions(-)
arch/parisc/include/uapi/asm/mman.h +0 -10
@@ -46,16 +46,6 @@#define MADV_DONTFORK 10/* don't inherit across fork */ #define MADV_DOFORK 11/* do inherit across fork */ -/* The range 12-64 is reserved for page size specification. */ -#define MADV_4K_PAGES 12/* Use 4K pages */ -#define MADV_16K_PAGES 14/* Use 16K pages */ -#define MADV_64K_PAGES 16/* Use 64K pages */ -#define MADV_256K_PAGES 18/* Use 256K pages */ -#define MADV_1M_PAGES 20/* Use 1 Megabyte pages */ -#define MADV_4M_PAGES 22/* Use 4 Megabyte pages */ -#define MADV_16M_PAGES 24/* Use 16 Megabyte pages */ -#define MADV_64M_PAGES 26/* Use 64 Megabyte pages */ -#define MADV_MERGEABLE 65/* KSM may merge identical pages */ #define MADV_UNMERGEABLE 66/* KSM may not merge identical pages */
Greg Kroah-Hartman
maintainerPATCH 28/76 parisc: Fix syscall restarts
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Helge Deller <[email protected]>
commit 71a71fb5374a23be36a91981b5614590b9e722c3 upstream.
On parisc syscalls which are interrupted by signals sometimes failed to restart and instead returned -ENOSYS which in the worst case lead to userspace crashes.
A similiar problem existed on MIPS and was fixed by commit e967ef02 ("MIPS: Fix restart of indirect syscalls").
On parisc the current syscall restart code assumes that all syscall callers load the syscall number in the delay slot of the ble instruction. That's how it is e.g. done in the unistd.h header file:
ble 0x100(%sr2, %r0) ldi #syscall_nr, %r20
Because of that assumption the current code never restored %r20 before returning to userspace.
This assumption is at least not true for code which uses the glibc syscall() function, which instead uses this syntax:
ble 0x100(%sr2, %r0) copy regX, %r20
where regX depend on how the compiler optimizes the code and register usage.
This patch fixes this problem by adding code to analyze how the syscall number is loaded in the delay branch and - if needed - copy the syscall number to regX prior returning to userspace for the syscall restart.
--- arch/parisc/kernel/signal.c | 64 +++++++++++++++++++++++++++++++++++--------- 1 file changed, 52 insertions(+), 12 deletions(-)
arch/parisc/kernel/signal.c +52 -12
@@ -442,6 +442,55 @@ handle_signal(unsigned long sig, siginfo regs->gr[28]); } +/* +* Check how the syscall number gets loaded into %r20 within +* the delay branch in userspace and adjust as needed. +*/ + +static void check_syscallno_in_delay_branch (struct pt_regs *regs) +{ +u32 opcode, source_reg; +u32 __user *uaddr; +int err; + +/* Usually we don't have to restore %r20 (the system call number) +* because it gets loaded in the delay slot of the branch external +* instruction via the ldi instruction. +* In some cases a register-to-register copy instruction might have +* been used instead, in which case we need to copy the syscall +* number into the source register before returning to userspace. +*/ + +/* A syscall is just a branch, so all we have to do is fiddle the +* return pointer so that the ble instruction gets executed again. +*/ + regs->gr[31 ] -=8 ;/* delayed branching */ + +/* Get assembler opcode of code in delay branch */ + uaddr = (unsigned int *) ((regs->gr[31 ] & ~3 ) +4 ); + err =get_user (opcode, uaddr); +if (err) +return ; + +/* Check if delay branch uses "ldi int,%r20" */ +if ((opcode &0xffff0000 ) ==0x34140000 ) +return ;/* everything ok, just return */ + +/* Check if delay branch uses "nop" */ +if (opcode ==INSN_NOP ) +return ; + +/* Check if delay branch uses "copy %rX,%r20" */ +if ((opcode &0xffe0ffff ) ==0x08000254 ) { + source_reg = (opcode >>16 ) &31 ; + regs->gr[source_reg] = regs->gr[20 ]; +return ; + } + +pr_warn ("syscall restart: %s (pid %d): unexpected opcode 0x%08x\n" , + current->comm,task_pid_nr (current), opcode); +} +static inline void syscall_restart (struct pt_regs *regs,struct k_sigaction *ka) {
@@ -464,10 +513,7 @@ syscall_restart(struct pt_regs *regs, st }/* fallthrough */ case -ERESTARTNOINTR : -/* A syscall is just a branch, so all -* we have to do is fiddle the return pointer. -*/ - regs->gr[31 ] -=8 ;/* delayed branching */ +check_syscallno_in_delay_branch (regs);break ; } }
@@ -516,15 +562,9 @@ insert_restart_trampoline(struct pt_regs }case -ERESTARTNOHAND :case -ERESTARTSYS : -case -ERESTARTNOINTR : { -/* Hooray for delayed branching. We don't -* have to restore %r20 (the system call -* number) because it gets loaded in the delay -* slot of the branch external instruction. -*/ - regs->gr[31 ] -=8 ; +case -ERESTARTNOINTR : +check_syscallno_in_delay_branch (regs);return ; - }default :break ; }
Greg Kroah-Hartman
maintainerPATCH 31/76 media: vb2 dma-contig: Fully cache synchronise buffers in prepare and finish
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tiffany Lin <[email protected]>
commit d9a985883fa32453d099d6293188c11d75cef1fa upstream.
In videobuf2 dma-contig memory type the prepare and finish ops, instead of passing the number of entries in the original scatterlist as the "nents" parameter to dma_sync_sg_for_device() and dma_sync_sg_for_cpu(), the value returned by dma_map_sg() was used. Albeit this has been suggested in comments of some implementations (which have since been corrected), this is wrong.
--- drivers/media/v4l2-core/videobuf2-dma-contig.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/media/v4l2-core/videobuf2-dma-contig.c +3 -2
@@ -117,7 +117,8 @@ static void vb2_dc_prepare(void *buf_priif (!sgt || buf->db_attach)return ; -dma_sync_sg_for_device (buf->dev, sgt->sgl, sgt->nents, buf->dma_dir); +dma_sync_sg_for_device (buf->dev, sgt->sgl, sgt->orig_nents, + buf->dma_dir); }static void vb2_dc_finish (void *buf_priv)
@@ -129,7 +130,7 @@ static void vb2_dc_finish(void *buf_privif (!sgt || buf->db_attach)return ; -dma_sync_sg_for_cpu (buf->dev, sgt->sgl, sgt->nents, buf->dma_dir); +dma_sync_sg_for_cpu (buf->dev, sgt->sgl, sgt->orig_nents, buf->dma_dir); }/*********************************************/
Greg Kroah-Hartman
maintainerPATCH 32/76 fix sysvfs symlinks
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
commit 0ebf7f10d67a70e120f365018f1c5fce9ddc567d upstream.
The thing got broken back in 2002 - sysvfs does *not* have inline symlinks; even short ones have bodies stored in the first block of file. sysv_symlink() handles that correctly; unfortunately, attempting to look an existing symlink up will end up confusing them for inline symlinks, and interpret the block number containing the body as the body itself.
Nobody has noticed until now, which says something about the level of testing sysvfs gets ;-/
--- fs/sysv/inode.c | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-)
fs/sysv/inode.c +2 -8
@@ -161,14 +161,8 @@ void sysv_set_inode(struct inode *inode, inode->i_fop = &sysv_dir_operations; inode->i_mapping->a_ops = &sysv_aops; }else if (S_ISLNK (inode->i_mode)) { -if (inode->i_blocks) { - inode->i_op = &sysv_symlink_inode_operations; - inode->i_mapping->a_ops = &sysv_aops; - }else { - inode->i_op = &sysv_fast_symlink_inode_operations; -nd_terminate_link (SYSV_I (inode)->i_data, inode->i_size, -sizeof (SYSV_I (inode)->i_data) -1 ); - } + inode->i_op = &sysv_symlink_inode_operations; + inode->i_mapping->a_ops = &sysv_aops; }else init_special_inode (inode, inode->i_mode, rdev); }
Greg Kroah-Hartman
maintainerPATCH 34/76 ALSA: usb-audio: avoid freeing umidi object twice
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrey Konovalov <[email protected]>
commit 07d86ca93db7e5cdf4743564d98292042ec21af7 upstream.
The 'umidi' object will be free'd on the error path by snd_usbmidi_free() when tearing down the rawmidi interface. So we shouldn't try to free it in snd_usbmidi_create() after having registered the rawmidi interface.
Found by KASAN.
--- sound/usb/midi.c | 1 - 1 file changed, 1 deletion(-)
sound/usb/midi.c +0 -1
@@ -2365,7 +2365,6 @@ int snd_usbmidi_create(struct snd_card *else err =snd_usbmidi_create_endpoints (umidi, endpoints);if (err <0 ) { -snd_usbmidi_free (umidi);return err; }
Greg Kroah-Hartman
maintainerPATCH 35/76 ALSA: compress: Disable GET_CODEC_CAPS ioctl for some architectures
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 462b3f161beb62eeb290f4ec52f5ead29a2f8ac7 upstream.
Some architectures like PowerPC can handle the maximum struct size in an ioctl only up to 13 bits, and struct snd_compr_codec_caps used by SNDRV_COMPRESS_GET_CODEC_CAPS ioctl overflows this limit. This problem was revealed recently by a powerpc change, as it's now treated as a fatal build error.
This patch is a stop-gap for that: for architectures with less than 14 bit ioctl struct size, get rid of the handling of the relevant ioctl. We should provide an alternative equivalent ioctl code later, but for now just paper over it. Luckily, the compress API hasn't been used on such architectures, so the impact must be effectively zero.
--- sound/core/compress_offload.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
sound/core/compress_offload.c +11 -0
@@ -44,6 +44,13 @@#include <sound/compress_offload.h> #include <sound/compress_driver.h> +/* struct snd_compr_codec_caps overflows the ioctl bit size for some +* architectures, so we need to disable the relevant ioctls. +*/ +#if _IOC_SIZEBITS <14 +#define COMPR_CODEC_CAPS_OVERFLOW +#endif +/* TODO: * - add substream support for multiple devices in case of * SND_DYNAMIC_MINORS is not used
@@ -438,6 +445,7 @@ out:return retval; } +#ifndef COMPR_CODEC_CAPS_OVERFLOW static int snd_compr_get_codec_caps (struct snd_compr_stream *stream,unsigned long arg) {
@@ -461,6 +469,7 @@ out:kfree (caps);return retval; } +#endif /* !COMPR_CODEC_CAPS_OVERFLOW */ /* revisit this with snd_pcm_preallocate_xxx */ static int snd_compr_allocate_buffer(struct snd_compr_stream *stream,
@@ -799,9 +808,11 @@ static long snd_compr_ioctl(struct filecase _IOC_NR (SNDRV_COMPRESS_GET_CAPS ): retval =snd_compr_get_caps (stream, arg);break ; +#ifndef COMPR_CODEC_CAPS_OVERFLOW case _IOC_NR (SNDRV_COMPRESS_GET_CODEC_CAPS ): retval =snd_compr_get_codec_caps (stream, arg);break ; +#endif case _IOC_NR (SNDRV_COMPRESS_SET_PARAMS ): retval =snd_compr_set_params (stream, arg);break ;
Greg Kroah-Hartman
maintainerPATCH 36/76 ALSA: dummy: Disable switching timer backend via sysfs
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 7ee96216c31aabe1eb42fb91ff50dae9fcd014b2 upstream.
ALSA dummy driver can switch the timer backend between system timer and hrtimer via its hrtimer module option. This can be also switched dynamically via sysfs, but it may lead to a memory corruption when switching is done while a PCM stream is running; the stream instance for the newly switched timer method tries to access the memory that was allocated by another timer method although the sizes differ.
As the simplest fix, this patch just disables the switch via sysfs by dropping the writable bit.
--- sound/drivers/dummy.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/drivers/dummy.c +1 -1
@@ -87,7 +87,7 @@ MODULE_PARM_DESC(pcm_substreams, "PCM sumodule_param (fake_buffer, bool,0444 );MODULE_PARM_DESC (fake_buffer,"Fake buffer allocations." );#ifdef CONFIG_HIGH_RES_TIMERS -module_param (hrtimer, bool,0644 ); +module_param (hrtimer, bool,0444 );MODULE_PARM_DESC (hrtimer,"Use hrtimer as the timer source." );#endif
Greg Kroah-Hartman
maintainerPATCH 37/76 ALSA: seq: Fix incorrect sanity check at snd_seq_oss_synth_cleanup()
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 599151336638d57b98d92338aa59c048e3a3e97d upstream.
ALSA sequencer OSS emulation code has a sanity check for currently opened devices, but there is a thinko there, eventually it spews warnings and skips the operation wrongly like:
WARNING: CPU: 1 PID: 7573 at sound/core/seq/oss/seq_oss_synth.c:311
Fix this off-by-one error.
--- sound/core/seq/oss/seq_oss_synth.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/core/seq/oss/seq_oss_synth.c +1 -1
@@ -310,7 +310,7 @@ snd_seq_oss_synth_cleanup(struct seq_ossstruct seq_oss_synth *rec;struct seq_oss_synthinfo *info; -if (snd_BUG_ON (dp->max_synthdev >=SNDRV_SEQ_OSS_MAX_SYNTH_DEVS )) +if (snd_BUG_ON (dp->max_synthdev >SNDRV_SEQ_OSS_MAX_SYNTH_DEVS ))return ;for (i =0 ; i < dp->max_synthdev; i++) { info = &dp->synths[i];
Greg Kroah-Hartman
maintainerPATCH 39/76 ALSA: rawmidi: Fix race at copying & updating the position
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 81f577542af15640cbcb6ef68baa4caa610cbbfc upstream.
The rawmidi read and write functions manage runtime stream status such as runtime->appl_ptr and runtime->avail. These point where to copy the new data and how many bytes have been copied (or to be read). The problem is that rawmidi read/write call copy_from_user() or copy_to_user(), and the runtime spinlock is temporarily unlocked and relocked while copying user-space. Since the current code advances and updates the runtime status after the spin unlock/relock, the copy and the update may be asynchronous, and eventually runtime->avail might go to a negative value when many concurrent accesses are done. This may lead to memory corruption in the end.
For fixing this race, in this patch, the status update code is performed in the same lock before the temporary unlock. Also, the spinlock is now taken more widely in snd_rawmidi_kernel_read1() for protecting more properly during the whole operation.
--- sound/core/rawmidi.c | 34 ++++++++++++++++++++++------------ 1 file changed, 22 insertions(+), 12 deletions(-)
sound/core/rawmidi.c +22 -12
@@ -934,31 +934,36 @@ static long snd_rawmidi_kernel_read1(strunsigned long flags;long result =0 , count1;struct snd_rawmidi_runtime *runtime = substream->runtime; +unsigned long appl_ptr; +spin_lock_irqsave (&runtime->lock, flags);while (count >0 && runtime->avail) { count1 = runtime->buffer_size - runtime->appl_ptr;if (count1 > count) count1 = count; -spin_lock_irqsave (&runtime->lock, flags);if (count1 > (int )runtime->avail) count1 = runtime->avail; + +/* update runtime->appl_ptr before unlocking for userbuf */ + appl_ptr = runtime->appl_ptr; + runtime->appl_ptr += count1; + runtime->appl_ptr %= runtime->buffer_size; + runtime->avail -= count1; +if (kernelbuf) -memcpy (kernelbuf + result, runtime->buffer + runtime->appl_ptr, count1); +memcpy (kernelbuf + result, runtime->buffer + appl_ptr, count1);if (userbuf) {spin_unlock_irqrestore (&runtime->lock, flags);if (copy_to_user (userbuf + result, - runtime->buffer + runtime->appl_ptr, count1)) { + runtime->buffer + appl_ptr, count1)) {return result >0 ? result : -EFAULT ; }spin_lock_irqsave (&runtime->lock, flags); } - runtime->appl_ptr += count1; - runtime->appl_ptr %= runtime->buffer_size; - runtime->avail -= count1; -spin_unlock_irqrestore (&runtime->lock, flags); result += count1; count -= count1; } +spin_unlock_irqrestore (&runtime->lock, flags);return result; }
@@ -1161,6 +1166,7 @@ static long snd_rawmidi_kernel_write1(stunsigned long flags;long count1, result;struct snd_rawmidi_runtime *runtime = substream->runtime; +unsigned long appl_ptr;if (!kernelbuf && !userbuf)return -EINVAL ;
@@ -1181,12 +1187,19 @@ static long snd_rawmidi_kernel_write1(st count1 = count;if (count1 > (long )runtime->avail) count1 = runtime->avail; + +/* update runtime->appl_ptr before unlocking for userbuf */ + appl_ptr = runtime->appl_ptr; + runtime->appl_ptr += count1; + runtime->appl_ptr %= runtime->buffer_size; + runtime->avail -= count1; +if (kernelbuf) -memcpy (runtime->buffer + runtime->appl_ptr, +memcpy (runtime->buffer + appl_ptr, kernelbuf + result, count1);else if (userbuf) {spin_unlock_irqrestore (&runtime->lock, flags); -if (copy_from_user (runtime->buffer + runtime->appl_ptr, +if (copy_from_user (runtime->buffer + appl_ptr, userbuf + result, count1)) {spin_lock_irqsave (&runtime->lock, flags); result = result >0 ? result : -EFAULT ;
@@ -1194,9 +1207,6 @@ static long snd_rawmidi_kernel_write1(st }spin_lock_irqsave (&runtime->lock, flags); } - runtime->appl_ptr += count1; - runtime->appl_ptr %= runtime->buffer_size; - runtime->avail -= count1; result += count1; count -= count1; }
Greg Kroah-Hartman
maintainerPATCH 40/76 ALSA: pcm: Fix potential deadlock in OSS emulation
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit b248371628aad599a48540962f6b85a21a8a0c3f upstream.
There are potential deadlocks in PCM OSS emulation code while accessing read/write and mmap concurrently. This comes from the infamous mmap_sem usage in copy_from/to_user(). Namely,
snd_pcm_oss_write() ->
&runtime->oss.params_lock ->
copy_to_user() ->
&mm->mmap_sem
mmap() ->
&mm->mmap_sem ->
snd_pcm_oss_mmap() ->
&runtime->oss.params_lockSince we can't avoid taking params_lock from mmap code path, use trylock variant and aborts with -EAGAIN as a workaround of this AB/BA deadlock.
--- sound/core/oss/pcm_oss.c | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-)
sound/core/oss/pcm_oss.c +15 -6
@@ -834,7 +834,8 @@ static int choose_rate(struct snd_pcm_sureturn snd_pcm_hw_param_near (substream, params,SNDRV_PCM_HW_PARAM_RATE , best_rate,NULL ); } -static int snd_pcm_oss_change_params (struct snd_pcm_substream *substream) +static int snd_pcm_oss_change_params (struct snd_pcm_substream *substream, +bool trylock) {struct snd_pcm_runtime *runtime = substream->runtime;struct snd_pcm_hw_params *params, *sparams;
@@ -848,7 +849,10 @@ static int snd_pcm_oss_change_params(strstruct snd_mask sformat_mask;struct snd_mask mask; -if (mutex_lock_interruptible (&runtime->oss.params_lock)) +if (trylock) { +if (!(mutex_trylock (&runtime->oss.params_lock))) +return -EAGAIN ; + }else if (mutex_lock_interruptible (&runtime->oss.params_lock))return -EINTR ; sw_params =kmalloc (sizeof (*sw_params),GFP_KERNEL ); params =kmalloc (sizeof (*params),GFP_KERNEL );
@@ -1091,7 +1095,7 @@ static int snd_pcm_oss_get_active_substrif (asubstream ==NULL ) asubstream = substream;if (substream->runtime->oss.params) { - err =snd_pcm_oss_change_params (substream); + err =snd_pcm_oss_change_params (substream, false);if (err <0 )return err; }
@@ -1130,7 +1134,7 @@ static int snd_pcm_oss_make_ready(structreturn 0 ; runtime = substream->runtime;if (runtime->oss.params) { - err =snd_pcm_oss_change_params (substream); + err =snd_pcm_oss_change_params (substream, false);if (err <0 )return err; }
@@ -2168,7 +2172,7 @@ static int snd_pcm_oss_get_space(struct runtime = substream->runtime;if (runtime->oss.params && - (err =snd_pcm_oss_change_params (substream)) <0 ) + (err =snd_pcm_oss_change_params (substream, false)) <0 )return err; info.fragsize = runtime->oss.period_bytes;
@@ -2804,7 +2808,12 @@ static int snd_pcm_oss_mmap(struct filereturn -EIO ;if (runtime->oss.params) { -if ((err =snd_pcm_oss_change_params (substream)) <0 ) +/* use mutex_trylock() for params_lock for avoiding a deadlock +* between mmap_sem and params_lock taken by +* copy_from/to_user() in snd_pcm_oss_write/read() +*/ + err =snd_pcm_oss_change_params (substream, true); +if (err <0 )return err; }#ifdef CONFIG_SND_PCM_OSS_PLUGINS
Greg Kroah-Hartman
maintainerPATCH 41/76 ASoC: dpcm: fix the BE state on hw_free
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vinod Koul <[email protected]>
commit 5e82d2be6ee53275c72e964507518d7964c82753 upstream.
While performing hw_free, DPCM checks the BE state but leaves out the suspend state. The suspend state needs to be checked as well, as we might be suspended and then usermode closes rather than resuming the audio stream.
This was found by a stress testing of system with playback in loop and killed after few seconds running in background and second script running suspend-resume test in loop
--- sound/soc/soc-pcm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
sound/soc/soc-pcm.c +2 -1
@@ -1404,7 +1404,8 @@ int dpcm_be_dai_hw_free(struct snd_soc_p (be->dpcm[stream].state !=SND_SOC_DPCM_STATE_PREPARE ) && (be->dpcm[stream].state !=SND_SOC_DPCM_STATE_HW_FREE ) && (be->dpcm[stream].state !=SND_SOC_DPCM_STATE_PAUSED ) && - (be->dpcm[stream].state != SND_SOC_DPCM_STATE_STOP)) + (be->dpcm[stream].state !=SND_SOC_DPCM_STATE_STOP ) && + (be->dpcm[stream].state != SND_SOC_DPCM_STATE_SUSPEND)) continue; dev_dbg(be->dev, "ASoC: hw_free BE %s\n",
Greg Kroah-Hartman
maintainerPATCH 42/76 ALSA: seq: Fix yet another races among ALSA timer accesses
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 2cdc7b636d55cbcf42e1e6c8accd85e62d3e9ae8 upstream.
ALSA sequencer may open/close and control ALSA timer instance dynamically either via sequencer events or direct ioctls. These are done mostly asynchronously, and it may call still some timer action like snd_timer_start() while another is calling snd_timer_close(). Since the instance gets removed by snd_timer_close(), it may lead to a use-after-free.
This patch tries to address such a race by protecting each snd_timer_*() call via the existing spinlock and also by avoiding the access to timer during close call.
--- sound/core/seq/seq_timer.c | 87 ++++++++++++++++++++++++++++++++++----------- 1 file changed, 67 insertions(+), 20 deletions(-)
sound/core/seq/seq_timer.c +67 -20
@@ -92,6 +92,9 @@ void snd_seq_timer_delete(struct snd_seqvoid snd_seq_timer_defaults (struct snd_seq_timer * tmr) { +unsigned long flags; + +spin_lock_irqsave (&tmr->lock, flags);/* setup defaults */ tmr->ppq =96 ;/* 96 PPQ */ tmr->tempo =500000 ;/* 120 BPM */
@@ -107,21 +110,25 @@ void snd_seq_timer_defaults(struct snd_s tmr->preferred_resolution = seq_default_timer_resolution; tmr->skew = tmr->skew_base =SKEW_BASE ; +spin_unlock_irqrestore (&tmr->lock, flags); } -void snd_seq_timer_reset (struct snd_seq_timer * tmr) +static void seq_timer_reset (struct snd_seq_timer *tmr) { -unsigned long flags; - -spin_lock_irqsave (&tmr->lock, flags); -/* reset time & songposition */ tmr->cur_time.tv_sec =0 ; tmr->cur_time.tv_nsec =0 ; tmr->tick.cur_tick =0 ; tmr->tick.fraction =0 ; +} + +void snd_seq_timer_reset (struct snd_seq_timer *tmr) +{ +unsigned long flags; +spin_lock_irqsave (&tmr->lock, flags); +seq_timer_reset (tmr);spin_unlock_irqrestore (&tmr->lock, flags); }
@@ -140,8 +147,11 @@ static void snd_seq_timer_interrupt(stru tmr = q->timer;if (tmr ==NULL )return ; -if (!tmr->running) +spin_lock_irqsave (&tmr->lock, flags); +if (!tmr->running) { +spin_unlock_irqrestore (&tmr->lock, flags);return ; + } resolution *= ticks;if (tmr->skew != tmr->skew_base) {
@@ -150,8 +160,6 @@ static void snd_seq_timer_interrupt(stru (((resolution &0xffff ) * tmr->skew) >>16 ); } -spin_lock_irqsave (&tmr->lock, flags); -/* update timer */ snd_seq_inc_time_nsec (&tmr->cur_time, resolution);
@@ -298,26 +306,30 @@ int snd_seq_timer_open(struct snd_seq_qu t->callback = snd_seq_timer_interrupt; t->callback_data = q; t->flags |=SNDRV_TIMER_IFLG_AUTO ; +spin_lock_irq (&tmr->lock); tmr->timeri = t; +spin_unlock_irq (&tmr->lock);return 0 ; }int snd_seq_timer_close (struct snd_seq_queue *q) {struct snd_seq_timer *tmr; +struct snd_timer_instance *t; tmr = q->timer;if (snd_BUG_ON (!tmr))return -EINVAL ; -if (tmr->timeri) { -snd_timer_stop (tmr->timeri); -snd_timer_close (tmr->timeri); - tmr->timeri =NULL ; - } +spin_lock_irq (&tmr->lock); + t = tmr->timeri; + tmr->timeri =NULL ; +spin_unlock_irq (&tmr->lock); +if (t) +snd_timer_close (t);return 0 ; } -int snd_seq_timer_stop (struct snd_seq_timer * tmr) +static int seq_timer_stop (struct snd_seq_timer *tmr) {if (! tmr->timeri)return -EINVAL ;
@@ -328,6 +340,17 @@ int snd_seq_timer_stop(struct snd_seq_tireturn 0 ; } +int snd_seq_timer_stop (struct snd_seq_timer *tmr) +{ +unsigned long flags; +int err; + +spin_lock_irqsave (&tmr->lock, flags); + err =seq_timer_stop (tmr); +spin_unlock_irqrestore (&tmr->lock, flags); +return err; +} +static int initialize_timer (struct snd_seq_timer *tmr) {struct snd_timer *t;
@@ -360,13 +383,13 @@ static int initialize_timer(struct snd_sreturn 0 ; } -int snd_seq_timer_start (struct snd_seq_timer * tmr) +static int seq_timer_start (struct snd_seq_timer *tmr) {if (! tmr->timeri)return -EINVAL ;if (tmr->running) -snd_seq_timer_stop (tmr); -snd_seq_timer_reset (tmr); +seq_timer_stop (tmr); +seq_timer_reset (tmr);if (initialize_timer (tmr) <0 )return -EINVAL ;snd_timer_start (tmr->timeri, tmr->ticks);
@@ -375,14 +398,25 @@ int snd_seq_timer_start(struct snd_seq_treturn 0 ; } -int snd_seq_timer_continue (struct snd_seq_timer * tmr) +int snd_seq_timer_start (struct snd_seq_timer *tmr) +{ +unsigned long flags; +int err; + +spin_lock_irqsave (&tmr->lock, flags); + err =seq_timer_start (tmr); +spin_unlock_irqrestore (&tmr->lock, flags); +return err; +} + +static int seq_timer_continue (struct snd_seq_timer *tmr) {if (! tmr->timeri)return -EINVAL ;if (tmr->running)return -EBUSY ;if (! tmr->initialized) { -snd_seq_timer_reset (tmr); +seq_timer_reset (tmr);if (initialize_timer (tmr) <0 )return -EINVAL ; }
@@ -392,11 +426,24 @@ int snd_seq_timer_continue(struct snd_sereturn 0 ; } +int snd_seq_timer_continue (struct snd_seq_timer *tmr) +{ +unsigned long flags; +int err; + +spin_lock_irqsave (&tmr->lock, flags); + err =seq_timer_continue (tmr); +spin_unlock_irqrestore (&tmr->lock, flags); +return err; +} +/* return current 'real' time. use timeofday() to get better granularity. */ snd_seq_real_time_t snd_seq_timer_get_cur_time (struct snd_seq_timer *tmr) {snd_seq_real_time_t cur_time; +unsigned long flags; +spin_lock_irqsave (&tmr->lock, flags); cur_time = tmr->cur_time;if (tmr->running) {struct timeval tm;
@@ -412,7 +459,7 @@ snd_seq_real_time_t snd_seq_timer_get_cu }snd_seq_sanity_real_time (&cur_time); } - +spin_unlock_irqrestore (&tmr->lock, flags);return cur_time; }
Greg Kroah-Hartman
maintainerPATCH 44/76 ALSA: seq: Fix lockdep warnings due to double mutex locks
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 7f0973e973cd74aa40747c9d38844560cd184ee8 upstream.
The port subscription code uses double mutex locks for source and destination ports, and this may become racy once when wrongly set up. It leads to lockdep warning splat, typically triggered by fuzzer like syzkaller, although the actual deadlock hasn't been seen, so far.
This patch simplifies the handling by reducing to two single locks, so that no lockdep warning will be trigger any longer.
By splitting to two actions, a still-in-progress element shall be added in one list while handling another. For ignoring this element, a new check is added in deliver_to_subscribers().
Along with it, the code to add/remove the subscribers list element was cleaned up and refactored.
--- sound/core/seq/seq_clientmgr.c | 3 sound/core/seq/seq_ports.c | 235 ++++++++++++++++++++++------------------- 2 files changed, 134 insertions(+), 104 deletions(-)
sound/core/seq/seq_clientmgr.c +3 -0
@@ -678,6 +678,9 @@ static int deliver_to_subscribers(structelse down_read (&grp->list_mutex);list_for_each_entry (subs, &grp->list_head, src_list) { +/* both ports ready? */ +if (atomic_read (&subs->ref_count) !=2 ) +continue ; event->dest = subs->info.dest;if (subs->info.flags &SNDRV_SEQ_PORT_SUBS_TIMESTAMP )/* convert time according to flag with subscription */
sound/core/seq/seq_ports.c +131 -104
320 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 45/76 ALSA: timer: Code cleanup
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit c3b1681375dc6e71d89a3ae00cc3ce9e775a8917 upstream.
This is a minor code cleanup without any functional changes:
- Kill keep_flag argument from _snd_timer_stop(), as all callers pass only it false.
- Remove redundant NULL check in _snd_timer_stop().
--- sound/core/timer.c | 28 +++++++++++----------------- 1 file changed, 11 insertions(+), 17 deletions(-)
sound/core/timer.c +11 -17
@@ -300,8 +300,7 @@ int snd_timer_open(struct snd_timer_instreturn 0 ; } -static int _snd_timer_stop (struct snd_timer_instance *timeri, -int keep_flag,int event); +static int _snd_timer_stop (struct snd_timer_instance *timeri,int event);/* * close a timer instance
@@ -343,7 +342,7 @@ int snd_timer_close(struct snd_timer_insspin_unlock_irq (&timer->lock);mutex_lock (®ister_mutex);list_del (&timeri->open_list); -if (timer &&list_empty (&timer->open_list_head) && +if (list_empty (&timer->open_list_head) && timer->hw.close) timer->hw.close (timer);/* remove slave links */
@@ -483,8 +482,7 @@ int snd_timer_start(struct snd_timer_insreturn result; } -static int _snd_timer_stop (struct snd_timer_instance * timeri, -int keep_flag,int event) +static int _snd_timer_stop (struct snd_timer_instance *timeri,int event) {struct snd_timer *timer;unsigned long flags;
@@ -493,13 +491,11 @@ static int _snd_timer_stop(struct snd_tireturn -ENXIO ;if (timeri->flags &SNDRV_TIMER_IFLG_SLAVE ) { -if (!keep_flag) { -spin_lock_irqsave (&slave_active_lock, flags); - timeri->flags &= ~SNDRV_TIMER_IFLG_RUNNING ; -list_del_init (&timeri->ack_list); -list_del_init (&timeri->active_list); -spin_unlock_irqrestore (&slave_active_lock, flags); - } +spin_lock_irqsave (&slave_active_lock, flags); + timeri->flags &= ~SNDRV_TIMER_IFLG_RUNNING ; +list_del_init (&timeri->ack_list); +list_del_init (&timeri->active_list); +spin_unlock_irqrestore (&slave_active_lock, flags); goto __end; } timer = timeri->timer;
@@ -520,9 +516,7 @@ static int _snd_timer_stop(struct snd_ti } } } -if (!keep_flag) - timeri->flags &= - ~(SNDRV_TIMER_IFLG_RUNNING |SNDRV_TIMER_IFLG_START ); + timeri->flags &= ~(SNDRV_TIMER_IFLG_RUNNING |SNDRV_TIMER_IFLG_START );spin_unlock_irqrestore (&timer->lock, flags); __end:if (event !=SNDRV_TIMER_EVENT_RESOLUTION )
@@ -541,7 +535,7 @@ int snd_timer_stop(struct snd_timer_instunsigned long flags;int err; - err =_snd_timer_stop (timeri,0 ,SNDRV_TIMER_EVENT_STOP ); + err =_snd_timer_stop (timeri,SNDRV_TIMER_EVENT_STOP );if (err <0 )return err; timer = timeri->timer;
@@ -585,7 +579,7 @@ int snd_timer_continue(struct snd_timer_*/ int snd_timer_pause (struct snd_timer_instance * timeri) { -return _snd_timer_stop (timeri,0 ,SNDRV_TIMER_EVENT_PAUSE ); +return _snd_timer_stop (timeri,SNDRV_TIMER_EVENT_PAUSE ); }/*
Greg Kroah-Hartman
maintainerPATCH 46/76 ALSA: timer: Fix leftover link at closing
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 094fd3be87b0f102589e2d5c3fa5d06b7e20496d upstream.
In ALSA timer core, the active timer instance is managed in active_list linked list. Each element is added / removed dynamically at timer start, stop and in timer interrupt. The problem is that snd_timer_interrupt() has a thinko and leaves the element in active_list when it's the last opened element. This eventually leads to list corruption or use-after-free error.
This hasn't been revealed because we used to delete the list forcibly in snd_timer_stop() in the past. However, the recent fix avoids the double-stop behavior (in commit [f784beb75ce8: ALSA: timer: Fix link corruption due to double start or stop]), and this leak hits reality.
This patch fixes the link management in snd_timer_interrupt(). Now it simply unlinks no matter which stream is.
--- sound/core/timer.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/core/timer.c +2 -2
@@ -696,8 +696,8 @@ void snd_timer_interrupt(struct snd_time ti->cticks = ti->ticks; }else { ti->flags &= ~SNDRV_TIMER_IFLG_RUNNING ; -if (--timer->running) -list_del_init (&ti->active_list); + --timer->running; +list_del_init (&ti->active_list); }if ((timer->hw.flags &SNDRV_TIMER_HW_TASKLET ) || (ti->flags &SNDRV_TIMER_IFLG_FAST ))
Greg Kroah-Hartman
maintainerPATCH 47/76 ALSA: timer: Fix link corruption due to double start or stop
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit f784beb75ce82f4136f8a0960d3ee872f7109e09 upstream.
Although ALSA timer code got hardening for races, it still causes use-after-free error. This is however rather a corrupted linked list, not actually the concurrent accesses. Namely, when timer start is triggered twice, list_add_tail() is called twice, too. This ends up with the link corruption and triggers KASAN error.
The simplest fix would be replacing list_add_tail() with list_move_tail(), but fundamentally it's the problem that we don't check the double start/stop correctly. So, the right fix here is to add the proper checks to snd_timer_start() and snd_timer_stop() (and their variants).
--- sound/core/timer.c | 30 ++++++++++++++++++++++++++++-- 1 file changed, 28 insertions(+), 2 deletions(-)
sound/core/timer.c +28 -2
@@ -443,6 +443,10 @@ static int snd_timer_start_slave(structunsigned long flags;spin_lock_irqsave (&slave_active_lock, flags); +if (timeri->flags &SNDRV_TIMER_IFLG_RUNNING ) { +spin_unlock_irqrestore (&slave_active_lock, flags); +return -EBUSY ; + } timeri->flags |=SNDRV_TIMER_IFLG_RUNNING ;if (timeri->master && timeri->timer) {spin_lock (&timeri->timer->lock);
@@ -467,18 +471,26 @@ int snd_timer_start(struct snd_timer_insreturn -EINVAL ;if (timeri->flags &SNDRV_TIMER_IFLG_SLAVE ) { result =snd_timer_start_slave (timeri); -snd_timer_notify1 (timeri,SNDRV_TIMER_EVENT_START ); +if (result >=0 ) +snd_timer_notify1 (timeri,SNDRV_TIMER_EVENT_START );return result; } timer = timeri->timer;if (timer ==NULL )return -EINVAL ;spin_lock_irqsave (&timer->lock, flags); +if (timeri->flags & (SNDRV_TIMER_IFLG_RUNNING | +SNDRV_TIMER_IFLG_START )) { + result = -EBUSY ; + goto unlock; + } timeri->ticks = timeri->cticks = ticks; timeri->pticks =0 ; result =snd_timer_start1 (timer, timeri, ticks); + unlock:spin_unlock_irqrestore (&timer->lock, flags); -snd_timer_notify1 (timeri,SNDRV_TIMER_EVENT_START ); +if (result >=0 ) +snd_timer_notify1 (timeri,SNDRV_TIMER_EVENT_START );return result; }
@@ -492,6 +504,10 @@ static int _snd_timer_stop(struct snd_tiif (timeri->flags &SNDRV_TIMER_IFLG_SLAVE ) {spin_lock_irqsave (&slave_active_lock, flags); +if (!(timeri->flags &SNDRV_TIMER_IFLG_RUNNING )) { +spin_unlock_irqrestore (&slave_active_lock, flags); +return -EBUSY ; + } timeri->flags &= ~SNDRV_TIMER_IFLG_RUNNING ;list_del_init (&timeri->ack_list);list_del_init (&timeri->active_list);
@@ -502,6 +518,11 @@ static int _snd_timer_stop(struct snd_tiif (!timer)return -EINVAL ;spin_lock_irqsave (&timer->lock, flags); +if (!(timeri->flags & (SNDRV_TIMER_IFLG_RUNNING | +SNDRV_TIMER_IFLG_START ))) { +spin_unlock_irqrestore (&timer->lock, flags); +return -EBUSY ; + }list_del_init (&timeri->ack_list);list_del_init (&timeri->active_list); if ((timeri->flags & SNDRV_TIMER_IFLG_RUNNING) &&
@@ -565,10 +586,15 @@ int snd_timer_continue(struct snd_timer_if (! timer)return -EINVAL ;spin_lock_irqsave (&timer->lock, flags); +if (timeri->flags &SNDRV_TIMER_IFLG_RUNNING ) { + result = -EBUSY ; + goto unlock; + }if (!timeri->cticks) timeri->cticks =1 ; timeri->pticks =0 ; result =snd_timer_start1 (timer, timeri, timer->sticks); + unlock:spin_unlock_irqrestore (&timer->lock, flags);snd_timer_notify1 (timeri,SNDRV_TIMER_EVENT_CONTINUE );return result;
Greg Kroah-Hartman
maintainerPATCH 48/76 ALSA: timer: Fix wrong instance passed to slave callbacks
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 117159f0b9d392fb433a7871426fad50317f06f7 upstream.
In snd_timer_notify1(), the wrong timer instance was passed for slave ccallback function. This leads to the access to the wrong data when an incompatible master is handled (e.g. the master is the sequencer timer and the slave is a user timer), as spotted by syzkaller fuzzer.
This patch fixes that wrong assignment.
--- sound/core/timer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/core/timer.c +1 -1
@@ -414,7 +414,7 @@ static void snd_timer_notify1(struct sndspin_lock_irqsave (&timer->lock, flags);list_for_each_entry (ts, &ti->slave_active_head, active_list)if (ts->ccallback) - ts->ccallback (ti, event +100 , &tstamp, resolution); + ts->ccallback (ts, event +100 , &tstamp, resolution);spin_unlock_irqrestore (&timer->lock, flags); }
Greg Kroah-Hartman
maintainerPATCH 51/76 ALSA: hda - Fix static checker warning in patch_hdmi.c
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Henningsson <[email protected]>
commit 360a8245680053619205a3ae10e6bfe624a5da1d upstream.
The static checker warning is:
sound/pci/hda/patch_hdmi.c:460 hdmi_eld_ctl_get() error: __memcpy() 'eld->eld_buffer' too small (256 vs 512)
I have a hard time figuring out if this can ever cause an information leak (I don't think so), but nonetheless it does not hurt to increase the robustness of the code.
--- sound/pci/hda/patch_hdmi.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
sound/pci/hda/patch_hdmi.c +2 -1
@@ -426,7 +426,8 @@ static int hdmi_eld_ctl_get(struct snd_k eld = &per_pin->sink_eld;mutex_lock (&per_pin->lock); -if (eld->eld_size >ARRAY_SIZE (ucontrol->value.bytes.data)) { +if (eld->eld_size >ARRAY_SIZE (ucontrol->value.bytes.data) || + eld->eld_size >ELD_MAX_SIZE ) {mutex_unlock (&per_pin->lock);snd_BUG ();return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 54/76 saa7134-alsa: Only frees registered sound cards
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mauro Carvalho Chehab <[email protected]>
commit ac75fe5d8fe4a0bf063be18fb29684405279e79e upstream.
That prevents this bug:
[ 2382.269496] BUG: unable to handle kernel NULL pointer dereference at 0000000000000540 [ 2382.270013] IP: [<ffffffffa01fe616>] snd_card_free+0x36/0x70 [snd] [ 2382.270013] PGD 0 [ 2382.270013] Oops: 0002 [#1] SMP [ 2382.270013] Modules linked in: saa7134_alsa(-) tda1004x saa7134_dvb videobuf2_dvb dvb_core tda827x tda8290 tuner saa7134 tveeprom videobuf2_dma_sg videobuf2_memops videobuf2_v4l2 videobuf2_core v4l2_common videodev media auth_rpcgss nfsv4 dns_resolver nfs lockd grace sunrpc tun bridge stp llc ebtables ip6table_filter ip6_tables nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack it87 hwmon_vid snd_hda_codec_idt snd_hda_codec_generic iTCO_wdt iTCO_vendor_support snd_hda_intel snd_hda_codec snd_hwdep snd_hda_core snd_seq pcspkr i2c_i801 snd_seq_device snd_pcm snd_timer lpc_ich snd mfd_core soundcore binfmt_misc i915 video i2c_algo_bit drm_kms_helper drm r8169 ata_generic serio_raw pata_acpi mii i2c_core [last unloaded: videobuf2_memops] [ 2382.270013] CPU: 0 PID: 4899 Comm: rmmod Not tainted 4.5.0-rc1+ #4 [ 2382.270013] Hardware name: PCCHIPS P17G/P17G, BIOS 080012 05/14/2008 [ 2382.270013] task: ffff880039c38000 ti: ffff88003c764000 task.ti: ffff88003c764000 [ 2382.270013] RIP: 0010:[<ffffffffa01fe616>] [<ffffffffa01fe616>] snd_card_free+0x36/0x70 [snd] [ 2382.270013] RSP: 0018:ffff88003c767ea0 EFLAGS: 00010286 [ 2382.270013] RAX: ffff88003c767eb8 RBX: 0000000000000000 RCX: 0000000000006260 [ 2382.270013] RDX: ffffffffa020a060 RSI: ffffffffa0206de1 RDI: ffff88003c767eb0 [ 2382.270013] RBP: ffff88003c767ed8 R08: 0000000000019960 R09: ffffffff811a5412 [ 2382.270013] R10: ffffea0000d7c200 R11: 0000000000000000 R12: ffff88003c767ea8 [ 2382.270013] R13: 00007ffe760617f7 R14: 0000000000000000 R15: 0000557625d7f1e0 [ 2382.270013] FS: 00007f80bb1c0700(0000) GS:ffff88003f400000(0000) knlGS:0000000000000000 [ 2382.270013] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b [ 2382.270013] CR2: 0000000000000540 CR3: 000000003c00f000 CR4: 00000000000006f0 [ 2382.270013] Stack: [ 2382.270013] 000000003c767ed8 ffffffff00000000 ffff880000000000 ffff88003c767eb8 [ 2382.270013] ffff88003c767eb8 ffffffffa049a890 00007ffe76060060 ffff88003c767ef0 [ 2382.270013] ffffffffa049889d ffffffffa049a500 ffff88003c767f48 ffffffff8111079c [ 2382.270013] Call Trace: [ 2382.270013] [<ffffffffa049889d>] saa7134_alsa_exit+0x1d/0x780 [saa7134_alsa] [ 2382.270013] [<ffffffff8111079c>] SyS_delete_module+0x19c/0x1f0 [ 2382.270013] [<ffffffff8170fc2e>] entry_SYSCALL_64_fastpath+0x12/0x71 [ 2382.270013] Code: 20 a0 48 c7 c6 e1 6d 20 a0 48 89 e5 41 54 53 4c 8d 65 d0 48 89 fb 48 83 ec 28 c7 45 d0 00 00 00 00 49 8d 7c 24 08 e8 7a 55 ed e0 <4c> 89 a3 40 05 00 00 48 89 df e8 eb fd ff ff 85 c0 75 1a 48 8d [ 2382.270013] RIP [<ffffffffa01fe616>] snd_card_free+0x36/0x70 [snd] [ 2382.270013] RSP <ffff88003c767ea0> [ 2382.270013] CR2: 0000000000000540
--- drivers/media/pci/saa7134/saa7134-alsa.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/media/pci/saa7134/saa7134-alsa.c +4 -1
@@ -1145,6 +1145,8 @@ static int alsa_device_init(struct saa71static int alsa_device_exit (struct saa7134_dev *dev) { +if (!snd_saa7134_cards[dev->nr]) +return 1 ;snd_card_free (snd_saa7134_cards[dev->nr]); snd_saa7134_cards[dev->nr] =NULL ;
@@ -1194,7 +1196,8 @@ static void saa7134_alsa_exit(void)int idx;for (idx =0 ; idx <SNDRV_CARDS ; idx++) { -snd_card_free (snd_saa7134_cards[idx]); +if (snd_saa7134_cards[idx]) +snd_card_free (snd_saa7134_cards[idx]); } saa7134_dmasound_init =NULL ;
Greg Kroah-Hartman
maintainerPATCH 55/76 USB: serial: visor: fix crash on detecting device without write_urbs
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladis Dronov <[email protected]>
commit cb3232138e37129e88240a98a1d2aba2187ff57c upstream.
The visor driver crashes in clie_5_attach() when a specially crafted USB device without bulk-out endpoint is detected. This fix adds a check that the device has proper configuration expected by the driver.
--- drivers/usb/serial/visor.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/usb/serial/visor.c +4 -2
@@ -597,8 +597,10 @@ static int clie_5_attach(struct usb_seri*/ /* some sanity check */ -if (serial->num_ports <2 ) -return -1 ; +if (serial->num_bulk_out <2 ) { +dev_err (&serial->interface->dev,"missing bulk out endpoints\n" ); +return -ENODEV ; + }/* port 0 now uses the modified endpoint Address */ port = serial->port[0 ];
Greg Kroah-Hartman
maintainerPATCH 56/76 USB: visor: fix null-deref at probe
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit cac9b50b0d75a1d50d6c056ff65c005f3224c8e0 upstream.
Fix null-pointer dereference at probe should a (malicious) Treo device lack the expected endpoints.
Specifically, the Treo port-setup hack was dereferencing the bulk-in and interrupt-in urbs without first making sure they had been allocated by core.
--- drivers/usb/serial/visor.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/usb/serial/visor.c +5 -0
@@ -544,6 +544,11 @@ static int treo_attach(struct usb_serial (serial->num_interrupt_in == 0))return 0 ; +if (serial->num_bulk_in <2 || serial->num_interrupt_in <2 ) { +dev_err (&serial->interface->dev,"missing endpoints\n" ); +return -ENODEV ; + } +/* * It appears that Treos and Kyoceras want to use the * 1st bulk in endpoint to communicate with the 2nd bulk out endpoint,
Greg Kroah-Hartman
maintainerPATCH 57/76 usb: hub: do not clear BOS field during reset device
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Du, Changbin <[email protected]>
commit d8f00cd685f5c8e0def8593e520a7fef12c22407 upstream.
In function usb_reset_and_verify_device, the old BOS descriptor may still be used before allocating a new one. (usb_unlocked_disable_lpm function uses it under the situation that it fails to disable lpm.) So we cannot set the udev->bos to NULL before that, just keep what it was. It will be overwrite when allocating a new one.
Crash log:
BUG: unable to handle kernel NULL pointer dereference at 0000000000000010 IP: [<ffffffff8171f98d>] usb_enable_link_state+0x2d/0x2f0 Call Trace: [<ffffffff8171ed5b>] ? usb_set_lpm_timeout+0x12b/0x140 [<ffffffff8171fcd1>] usb_enable_lpm+0x81/0xa0 [<ffffffff8171fdd8>] usb_disable_lpm+0xa8/0xc0 [<ffffffff8171fe1c>] usb_unlocked_disable_lpm+0x2c/0x50 [<ffffffff81723933>] usb_reset_and_verify_device+0xc3/0x710 [<ffffffff8172c4ed>] ? usb_sg_wait+0x13d/0x190 [<ffffffff81724743>] usb_reset_device+0x133/0x280 [<ffffffff8179ccd1>] usb_stor_port_reset+0x61/0x70 [<ffffffff8179cd68>] usb_stor_invoke_transport+0x88/0x520
--- drivers/usb/core/hub.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/usb/core/hub.c +5 -3
@@ -5225,7 +5225,6 @@ static int usb_reset_and_verify_device(susb_set_usb2_hardware_lpm (udev,0 ); bos = udev->bos; - udev->bos =NULL ;/* Disable LPM and LTM while we reset the device and reinstall the alt * settings. Device-initiated LPM settings, and system exit latency
@@ -5334,8 +5333,11 @@ done:usb_set_usb2_hardware_lpm (udev,1 );usb_unlocked_enable_lpm (udev);usb_enable_ltm (udev); -usb_release_bos_descriptor (udev); - udev->bos = bos; +/* release the new BOS descriptor allocated by hub_port_init() */ +if (udev->bos != bos) { +usb_release_bos_descriptor (udev); + udev->bos = bos; + }return 0 ; re_enumerate:
Greg Kroah-Hartman
maintainerPATCH 60/76 USB: serial: option: Adding support for Telit LE922
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniele Palmas <[email protected]>
commit ff4e2494dc17b173468e1713fdf6237fd8578bc7 upstream.
This patch adds support for two PIDs of LE922.
--- drivers/usb/serial/option.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
drivers/usb/serial/option.c +16 -0
@@ -269,6 +269,8 @@ static void option_instat_callback(struc#define TELIT_PRODUCT_CC864_SINGLE 0x1006#define TELIT_PRODUCT_DE910_DUAL 0x1010#define TELIT_PRODUCT_UE910_V2 0x1012 +#define TELIT_PRODUCT_LE922_USBCFG0 0x1042 +#define TELIT_PRODUCT_LE922_USBCFG3 0x1043#define TELIT_PRODUCT_LE920 0x1200#define TELIT_PRODUCT_LE910 0x1201
@@ -623,6 +625,16 @@ static const struct option_blacklist_inf .reserved = BIT(1) | BIT(5), }; +static const struct option_blacklist_info telit_le922_blacklist_usbcfg0 = { + .sendsetup =BIT (2 ), + .reserved =BIT (0 ) |BIT (1 ) |BIT (3 ), +}; + +static const struct option_blacklist_info telit_le922_blacklist_usbcfg3 = { + .sendsetup =BIT (0 ), + .reserved =BIT (1 ) |BIT (2 ) |BIT (3 ), +}; +static const struct usb_device_id option_ids[] = { {USB_DEVICE (OPTION_VENDOR_ID ,OPTION_PRODUCT_COLT ) }, {USB_DEVICE (OPTION_VENDOR_ID ,OPTION_PRODUCT_RICOLA ) },
@@ -1168,6 +1180,10 @@ static const struct usb_device_id option { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_CC864_SINGLE) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_DE910_DUAL) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UE910_V2) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG0), + .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg0 }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG3), + .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910), .driver_info = (kernel_ulong_t)&telit_le910_blacklist }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920),
Greg Kroah-Hartman
maintainerPATCH 61/76 USB: option: fix Cinterion AHxx enumeration
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Ernberg <[email protected]>
commit 4152b387da81617c80cb2946b2d56e3958906b3e upstream.
In certain kernel configurations where the cdc_ether and option drivers are compiled as modules there can occur a race condition in enumeration. This causes the option driver to enumerate the ethernet(wwan) interface as usb-serial interfaces.
usb-devices output for the modem:
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 5 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=1e2d ProdID=0055 Rev=00.00 S: Manufacturer=Cinterion S: Product=AHx C: #Ifs= 6 Cfg#= 1 Atr=e0 MxPwr=10mA I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option I: If#= 4 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether I: If#= 5 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether
--- drivers/usb/serial/option.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/serial/option.c +1 -1
@@ -1695,7 +1695,7 @@ static const struct usb_device_id option { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_EU3_P) }, { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PH8), .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, - { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX) }, + { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX, 0xff) }, { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PLXX), .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) },
Greg Kroah-Hartman
maintainerPATCH 62/76 tty: Fix GPF in flush_to_ldisc()
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Hurley <[email protected]>
commit 9ce119f318ba1a07c29149301f1544b6c4bea52a upstream.
A line discipline which does not define a receive_buf() method can can cause a GPF if data is ever received [1]. Oddly, this was known to the author of n_tracesink in 2011, but never fixed.
[1] GPF report
BUG: unable to handle kernel NULL pointer dereference at (null)
IP: [< (null)>] (null)
PGD 3752d067 PUD 37a7b067 PMD 0
Oops: 0010 [#1] SMP KASAN
Modules linked in:
CPU: 2 PID: 148 Comm: kworker/u10:2 Not tainted 4.4.0-rc2+ #51
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
Workqueue: events_unbound flush_to_ldisc
task: ffff88006da94440 ti: ffff88006db60000 task.ti: ffff88006db60000
RIP: 0010:[<0000000000000000>] [< (null)>] (null)
RSP: 0018:ffff88006db67b50 EFLAGS: 00010246
RAX: 0000000000000102 RBX: ffff88003ab32f88 RCX: 0000000000000102
RDX: 0000000000000000 RSI: ffff88003ab330a6 RDI: ffff88003aabd388
RBP: ffff88006db67c48 R08: ffff88003ab32f9c R09: ffff88003ab31fb0
R10: ffff88003ab32fa8 R11: 0000000000000000 R12: dffffc0000000000
R13: ffff88006db67c20 R14: ffffffff863df820 R15: ffff88003ab31fb8
FS: 0000000000000000(0000) GS:ffff88006dc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 0000000000000000 CR3: 0000000037938000 CR4: 00000000000006e0
Stack:
ffffffff829f46f1 ffff88006da94bf8 ffff88006da94bf8 0000000000000000
ffff88003ab31fb0 ffff88003aabd438 ffff88003ab31ff8 ffff88006430fd90
ffff88003ab32f9c ffffed0007557a87 1ffff1000db6cf78 ffff88003ab32078
Call Trace:
[<ffffffff8127cf91>] process_one_work+0x8f1/0x17a0 kernel/workqueue.c:2030
[<ffffffff8127df14>] worker_thread+0xd4/0x1180 kernel/workqueue.c:2162
[<ffffffff8128faaf>] kthread+0x1cf/0x270 drivers/block/aoe/aoecmd.c:1302
[<ffffffff852a7c2f>] ret_from_fork+0x3f/0x70 arch/x86/entry/entry_64.S:468
Code: Bad RIP value.
RIP [< (null)>] (null)
RSP <ffff88006db67b50>
CR2: 0000000000000000
---[ end trace a587f8947e54d6ea ]------ drivers/tty/tty_buffer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/tty/tty_buffer.c +1 -1
@@ -411,7 +411,7 @@ receive_buf(struct tty_struct *tty, stru count = disc->ops->receive_buf2 (tty, p, f, count); else { count =min_t (int, count, tty->receive_room); -if (count) +if (count && disc->ops->receive_buf) disc->ops->receive_buf (tty, p, f, count); } head->read += count;
Greg Kroah-Hartman
maintainerPATCH 63/76 tty: Fix unsafe ldisc reference via ioctl(TIOCGETD)
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Hurley <[email protected]>
commit 5c17c861a357e9458001f021a7afa7aab9937439 upstream.
ioctl(TIOCGETD) retrieves the line discipline id directly from the ldisc because the line discipline id (c_line) in termios is untrustworthy; userspace may have set termios via ioctl(TCSETS*) without actually changing the line discipline via ioctl(TIOCSETD).
However, directly accessing the current ldisc via tty->ldisc is unsafe; the ldisc ptr dereferenced may be stale if the line discipline is changing via ioctl(TIOCSETD) or hangup.
Wait for the line discipline reference (just like read() or write()) to retrieve the "current" line discipline id.
--- drivers/tty/tty_io.c | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-)
drivers/tty/tty_io.c +23 -1
@@ -2581,6 +2581,28 @@ static int tiocsetd(struct tty_struct *t }/** +* tiocgetd - get line discipline +* @tty: tty device +* @p: pointer to user data +* +* Retrieves the line discipline id directly from the ldisc. +* +* Locking: waits for ldisc reference (in case the line discipline +* is changing or the tty is being hungup) +*/ + +static int tiocgetd (struct tty_struct *tty,int __user *p) +{ +struct tty_ldisc *ld; +int ret; + + ld =tty_ldisc_ref_wait (tty); + ret =put_user (ld->ops->num, p); +tty_ldisc_deref (ld); +return ret; +} + +/** * send_break - performed time break * @tty: device to break on * @duration: timeout in mS
@@ -2794,7 +2816,7 @@ long tty_ioctl(struct file *file, unsigncase TIOCGSID :return tiocgsid (tty, real_tty, p);case TIOCGETD : -return put_user (tty->ldisc->ops->num, (int __user *)p); +return tiocgetd (tty, p);case TIOCSETD :return tiocsetd (tty, p);case TIOCVHANGUP :
Greg Kroah-Hartman
maintainerPATCH 64/76 xhci: fix usb2 resume timing and races.
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <[email protected]>
commit f69115fdbc1ac0718e7d19ad3caa3da2ecfe1c96 upstream.
According to USB 2 specs ports need to signal resume for at least 20ms, in practice even longer, before moving to U0 state.
Both host and devices can initiate resume.
On device initiated resume, a port status interrupt with the port in resume state in issued. The interrupt handler tags a resume_done[port] timestamp with current time + USB_RESUME_TIMEOUT, and kick roothub timer. Root hub timer requests for port status, finds the port in resume state, checks if resume_done[port] timestamp passed, and set port to U0 state.
On host initiated resume, current code sets the port to resume state, sleep 20ms, and finally sets the port to U0 state. This should also be changed to work in a similar way as the device initiated resume, with timestamp tagging, but that is not yet tested and will be a separate fix later.
There are a few issues with this approach
1. A host initiated resume will also generate a resume event. The event handler will find the port in resume state, believe it's a device initiated resume, and act accordingly.
2. A port status request might cut the resume signalling short if a get_port_status request is handled during the host resume signalling. The port will be found in resume state. The timestamp is not set leading to time_after_eq(jiffies, timestamp) returning true, as timestamp = 0. get_port_status will proceed with moving the port to U0.
3. If an error, or anything else happens to the port during device initiated resume signalling it will leave all the device resume parameters hanging uncleared, preventing further suspend, returning -EBUSY, and cause the pm thread to busyloop trying to enter suspend.
Fix this by using the existing resuming_ports bitfield to indicate that resume signalling timing is taken care of.
Check if the resume_done[port] is set before using it for timestamp comparison, and also clear out any resume signalling related variables if port is not in U0 or Resume state
This issue was discovered when a PM thread busylooped, trying to runtime suspend the xhci USB 2 roothub on a Dell XPS
--- drivers/usb/host/xhci-hub.c | 45 ++++++++++++++++++++++++++++++++++++++----- drivers/usb/host/xhci-ring.c | 3 +- 2 files changed, 42 insertions(+), 6 deletions(-)
drivers/usb/host/xhci-hub.c +40 -5
@@ -612,8 +612,30 @@ static u32 xhci_get_port_status(struct uif ((raw_port_status &PORT_RESET ) || !(raw_port_status &PORT_PE ))return 0xffffffff ; -if (time_after_eq (jiffies, - bus_state->resume_done[wIndex])) { +/* did port event handler already start resume timing? */ +if (!bus_state->resume_done[wIndex]) { +/* If not, maybe we are in a host initated resume? */ +if (test_bit (wIndex, &bus_state->resuming_ports)) { +/* Host initated resume doesn't time the resume +* signalling using resume_done[]. +* It manually sets RESUME state, sleeps 20ms +* and sets U0 state. This should probably be +* changed, but not right now. +*/ + }else { +/* port resume was discovered now and here, +* start resume timing +*/ +unsigned long timeout = jiffies + +msecs_to_jiffies (USB_RESUME_TIMEOUT ); + +set_bit (wIndex, &bus_state->resuming_ports); + bus_state->resume_done[wIndex] = timeout; +mod_timer (&hcd->rh_timer, timeout); + } +/* Has resume been signalled for USB_RESUME_TIME yet? */ + }else if (time_after_eq (jiffies, + bus_state->resume_done[wIndex])) {int time_left; xhci_dbg(xhci, "Resume USB2 port %d\n",
@@ -654,13 +676,24 @@ static u32 xhci_get_port_status(struct u }else {/* * The resume has been signaling for less than -* 20ms. Report the port status as SUSPEND, -* let the usbcore check port status again -* and clear resume signaling later. +* USB_RESUME_TIME. Report the port status as SUSPEND, +* let the usbcore check port status again and clear +* resume signaling later. */ status |=USB_PORT_STAT_SUSPEND ; } } +/* +* Clear stale usb2 resume signalling variables in case port changed +* state during resume signalling. For example on error +*/ +if ((bus_state->resume_done[wIndex] || +test_bit (wIndex, &bus_state->resuming_ports)) && + (raw_port_status &PORT_PLS_MASK ) !=XDEV_U3 && + (raw_port_status &PORT_PLS_MASK ) !=XDEV_RESUME ) { + bus_state->resume_done[wIndex] =0 ; +clear_bit (wIndex, &bus_state->resuming_ports); + }if ((raw_port_status &PORT_PLS_MASK ) ==XDEV_U0 && (raw_port_status &PORT_POWER ) && (bus_state->suspended_ports & (1 << wIndex))) {
@@ -989,6 +1022,7 @@ int xhci_hub_control(struct usb_hcd *hcdif ((temp &PORT_PE ) ==0 ) goto error; +set_bit (wIndex, &bus_state->resuming_ports);xhci_set_link_state (xhci, port_array, wIndex,XDEV_RESUME );spin_unlock_irqrestore (&xhci->lock, flags);
@@ -996,6 +1030,7 @@ int xhci_hub_control(struct usb_hcd *hcdspin_lock_irqsave (&xhci->lock, flags);xhci_set_link_state (xhci, port_array, wIndex,XDEV_U0 ); +clear_bit (wIndex, &bus_state->resuming_ports); } bus_state->port_c_suspend |=1 << wIndex;
drivers/usb/host/xhci-ring.c +2 -1
@@ -1768,7 +1768,8 @@ static void handle_port_status(struct xh*/ bogus_port_status = true; goto cleanup; - }else { + }else if (!test_bit (faked_port_index, + &bus_state->resuming_ports)) {xhci_dbg (xhci,"resume HS port %d\n" , port_id); bus_state->resume_done[faked_port_index] = jiffies +msecs_to_jiffies (USB_RESUME_TIMEOUT );
Greg Kroah-Hartman
maintainerPATCH 65/76 ext4: Fix handling of extended tv_sec
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Turner <[email protected]>
commit a4dad1ae24f850410c4e60f22823cba1289b8d52 upstream.
In ext4, the bottom two bits of {a,c,m}time_extra are used to extend the {a,c,m}time fields, deferring the year 2038 problem to the year 2446.
When decoding these extended fields, for times whose bottom 32 bits would represent a negative number, sign extension causes the 64-bit extended timestamp to be negative as well, which is not what's intended. This patch corrects that issue, so that the only negative {a,c,m}times are those between 1901 and 1970 (as per 32-bit signed timestamps).
Some older kernels might have written pre-1970 dates with 1,1 in the extra bits. This patch treats those incorrectly-encoded dates as pre-1970, instead of post-2311, until kernel 4.20 is released. Hopefully by then e2fsck will have fixed up the bad data.
Also add a comment explaining the encoding of ext4's extra {a,c,m}time bits.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=23732
--- fs/ext4/ext4.h | 51 ++++++++++++++++++++++++++++++++++++++++++++------- 1 file changed, 44 insertions(+), 7 deletions(-)
fs/ext4/ext4.h +44 -7
@@ -26,6 +26,7 @@#include <linux/seqlock.h> #include <linux/mutex.h> #include <linux/timer.h> +#include <linux/version.h> #include <linux/wait.h> #include <linux/blockgroup_lock.h> #include <linux/percpu_counter.h>
@@ -724,19 +725,55 @@ struct move_extent { <= (EXT4_GOOD_OLD_INODE_SIZE + \ (einode)->i_extra_isize)) \ +/* +* We use an encoding that preserves the times for extra epoch "00": +* +* extra msb of adjust for signed +* epoch 32-bit 32-bit tv_sec to +* bits time decoded 64-bit tv_sec 64-bit tv_sec valid time range +* 0 0 1 -0x80000000..-0x00000001 0x000000000 1901-12-13..1969-12-31 +* 0 0 0 0x000000000..0x07fffffff 0x000000000 1970-01-01..2038-01-19 +* 0 1 1 0x080000000..0x0ffffffff 0x100000000 2038-01-19..2106-02-07 +* 0 1 0 0x100000000..0x17fffffff 0x100000000 2106-02-07..2174-02-25 +* 1 0 1 0x180000000..0x1ffffffff 0x200000000 2174-02-25..2242-03-16 +* 1 0 0 0x200000000..0x27fffffff 0x200000000 2242-03-16..2310-04-04 +* 1 1 1 0x280000000..0x2ffffffff 0x300000000 2310-04-04..2378-04-22 +* 1 1 0 0x300000000..0x37fffffff 0x300000000 2378-04-22..2446-05-10 +* +* Note that previous versions of the kernel on 64-bit systems would +* incorrectly use extra epoch bits 1,1 for dates between 1901 and +* 1970. e2fsck will correct this, assuming that it is run on the +* affected filesystem before 2242. +*/ +static inline __le32 ext4_encode_extra_time (struct timespec *time) { -return cpu_to_le32 ((sizeof (time->tv_sec) >4 ? - (time->tv_sec >>32 ) &EXT4_EPOCH_MASK :0 ) | - ((time->tv_nsec <<EXT4_EPOCH_BITS ) &EXT4_NSEC_MASK )); +u32 extra =sizeof (time->tv_sec) >4 ? + ((time->tv_sec - (s32 )time->tv_sec) >>32 ) &EXT4_EPOCH_MASK :0 ; +return cpu_to_le32 (extra | (time->tv_nsec <<EXT4_EPOCH_BITS )); }static inline void ext4_decode_extra_time (struct timespec *time,__le32 extra) { -if (sizeof (time->tv_sec) >4 ) - time->tv_sec |= (__u64)(le32_to_cpu (extra) &EXT4_EPOCH_MASK ) - <<32 ; - time->tv_nsec = (le32_to_cpu (extra) &EXT4_NSEC_MASK ) >>EXT4_EPOCH_BITS ; +if (unlikely (sizeof (time->tv_sec) >4 && + (extra &cpu_to_le32 (EXT4_EPOCH_MASK )))) { +#if LINUX_VERSION_CODE <KERNEL_VERSION (4 ,20 ,0 ) +/* Handle legacy encoding of pre-1970 dates with epoch +* bits 1,1. We assume that by kernel version 4.20, +* everyone will have run fsck over the affected +* filesystems to correct the problem. (This +* backwards compatibility may be removed before this +* time, at the discretion of the ext4 developers.) +*/ +u64 extra_bits =le32_to_cpu (extra) &EXT4_EPOCH_MASK ; +if (extra_bits ==3 && ((time->tv_sec) &0x80000000 ) !=0 ) + extra_bits =0 ; + time->tv_sec += extra_bits <<32 ; +#else + time->tv_sec += (u64)(le32_to_cpu (extra) &EXT4_EPOCH_MASK ) <<32 ; +#endif + } + time->tv_nsec = (le32_to_cpu (extra) &EXT4_NSEC_MASK ) >>EXT4_EPOCH_BITS ; }#define EXT4_INODE_SET_XTIME (xtime, inode, raw_inode) \
Greg Kroah-Hartman
maintainerPATCH 66/76 crypto: af_alg - Disallow bind/setkey/... after accept(2)
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
commit c840ac6af3f8713a71b4d2363419145760bd6044 upstream.
Each af_alg parent socket obtained by socket(2) corresponds to a tfm object once bind(2) has succeeded. An accept(2) call on that parent socket creates a context which then uses the tfm object.
Therefore as long as any child sockets created by accept(2) exist the parent socket must not be modified or freed.
This patch guarantees this by using locks and a reference count on the parent socket. Any attempt to modify the parent socket will fail with EBUSY.
--- crypto/af_alg.c | 35 ++++++++++++++++++++++++++++++++--- include/crypto/if_alg.h | 8 +++----- 2 files changed, 35 insertions(+), 8 deletions(-)
crypto/af_alg.c +32 -3
@@ -125,6 +125,23 @@ int af_alg_release(struct socket *sock) }EXPORT_SYMBOL_GPL (af_alg_release); +void af_alg_release_parent (struct sock *sk) +{ +struct alg_sock *ask =alg_sk (sk); +bool last; + + sk = ask->parent; + ask =alg_sk (sk); + +lock_sock (sk); + last = !--ask->refcnt; +release_sock (sk); + +if (last) +sock_put (sk); +} +EXPORT_SYMBOL_GPL (af_alg_release_parent); +static int alg_bind (struct socket *sock,struct sockaddr *uaddr,int addr_len) {struct sock *sk = sock->sk;
@@ -132,6 +149,7 @@ static int alg_bind(struct socket *sock,struct sockaddr_alg *sa = (void *)uaddr;const struct af_alg_type *type;void *private; +int err;if (sock->state ==SS_CONNECTED )return -EINVAL ;
@@ -157,16 +175,22 @@ static int alg_bind(struct socket *sock,return PTR_ERR (private); } + err = -EBUSY ;lock_sock (sk); +if (ask->refcnt) + goto unlock;swap (ask->type, type);swap (ask->private, private); + err =0 ; + +unlock:release_sock (sk);alg_do_release (type, private); -return 0 ; +return err; } static int alg_setkey(struct sock *sk, char __user *ukey,
@@ -199,11 +223,15 @@ static int alg_setsockopt(struct socketstruct sock *sk = sock->sk;struct alg_sock *ask =alg_sk (sk);const struct af_alg_type *type; -int err = -ENOPROTOOPT ; +int err = -EBUSY ;lock_sock (sk); +if (ask->refcnt) + goto unlock; + type = ask->type; + err = -ENOPROTOOPT ;if (level !=SOL_ALG || !type) goto unlock;
@@ -254,7 +282,8 @@ int af_alg_accept(struct sock *sk, struc sk2->sk_family =PF_ALG ; -sock_hold (sk); +if (!ask->refcnt++) +sock_hold (sk);alg_sk (sk2)->parent = sk;alg_sk (sk2)->type = type;
include/crypto/if_alg.h +3 -5
@@ -30,6 +30,8 @@ struct alg_sock {struct sock *parent; +unsigned int refcnt; +const struct af_alg_type *type;void *private; };
@@ -64,6 +66,7 @@ int af_alg_register_type(const struct afint af_alg_unregister_type (const struct af_alg_type *type);int af_alg_release (struct socket *sock); +void af_alg_release_parent (struct sock *sk);int af_alg_accept (struct sock *sk,struct socket *newsock); int af_alg_make_sg(struct af_alg_sgl *sgl, void __user *addr, int len,
@@ -80,11 +83,6 @@ static inline struct alg_sock *alg_sk(streturn (struct alg_sock *)sk; } -static inline void af_alg_release_parent (struct sock *sk) -{ -sock_put (alg_sk (sk)->parent); -} -static inline void af_alg_init_completion (struct af_alg_completion *completion) {init_completion (&completion->completion);
Greg Kroah-Hartman
maintainerPATCH 68/76 AHCI: Fix softreset failed issue of Port Multiplier
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiangliang Yu <[email protected]>
commit 023113d24ef9e1d2b44cb2446872b17e2b01d8b1 upstream.
Current code doesn't update port value of Port Multiplier(PM) when sending FIS of softreset to device, command will fail if FBS is enabled.
There are two ways to fix the issue: the first is to disable FBS before sending softreset command to PM device and the second is to update port value of PM when sending command.
For the first way, i can't find any related rule in AHCI Spec. The second way can avoid disabling FBS and has better performance.
--- drivers/ata/libahci.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/ata/libahci.c +9 -0
@@ -1253,6 +1253,15 @@ static int ahci_exec_polled_cmd(struct aata_tf_to_fis (tf, pmp, is_cmd, fis);ahci_fill_cmd_slot (pp,0 , cmd_fis_len | flags | (pmp <<12 )); +/* set port value for softreset of Port Multiplier */ +if (pp->fbs_enabled && pp->fbs_last_dev != pmp) { + tmp =readl (port_mmio +PORT_FBS ); + tmp &= ~(PORT_FBS_DEV_MASK |PORT_FBS_DEC ); + tmp |= pmp <<PORT_FBS_DEV_OFFSET ; +writel (tmp, port_mmio +PORT_FBS ); + pp->fbs_last_dev = pmp; + } +/* issue & wait */ writel (1 , port_mmio +PORT_CMD_ISSUE );
Greg Kroah-Hartman
maintainerPATCH 69/76 libata: disable forced PORTS_IMPL for >= AHCI 1.3
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <[email protected]>
commit 566d1827df2ef0cbe921d3d6946ac3007b1a6938 upstream.
Some early controllers incorrectly reported zero ports in PORTS_IMPL register and the ahci driver fabricates PORTS_IMPL from the number of ports in those cases. This hasn't mattered but with the new nvme controllers there are cases where zero PORTS_IMPL is valid and should be honored.
Disable the workaround for >= AHCI 1.3.
--- drivers/ata/libahci.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/ata/libahci.c +2 -2
@@ -487,8 +487,8 @@ void ahci_save_initial_config(struct dev } } -/* fabricate port_map from cap.nr_ports */ -if (!port_map) { +/* fabricate port_map from cap.nr_ports for < AHCI 1.3 */ +if (!port_map && vers <0x10300 ) { port_map = (1 <<ahci_nr_ports (cap)) -1 ;dev_warn (dev,"forcing PORTS_IMPL to 0x%x\n" , port_map);
Greg Kroah-Hartman
maintainerPATCH 70/76 ahci: Intel DNV device IDs SATA
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandra Yates <[email protected]>
commit 342decff2b846b46fa61eb5ee40986fab79a9a32 upstream.
Adding Intel codename DNV platform device IDs for SATA.
--- drivers/ata/ahci.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+)
drivers/ata/ahci.c +20 -0
@@ -249,6 +249,26 @@ static const struct pci_device_id ahci_p { PCI_VDEVICE(INTEL, 0x3b2b), board_ahci }, /* PCH RAID */ { PCI_VDEVICE(INTEL, 0x3b2c), board_ahci }, /* PCH RAID */ { PCI_VDEVICE(INTEL, 0x3b2f), board_ahci }, /* PCH AHCI */ + { PCI_VDEVICE(INTEL, 0x19b0), board_ahci }, /* DNV AHCI */ + { PCI_VDEVICE(INTEL, 0x19b1), board_ahci }, /* DNV AHCI */ + { PCI_VDEVICE(INTEL, 0x19b2), board_ahci }, /* DNV AHCI */ + { PCI_VDEVICE(INTEL, 0x19b3), board_ahci }, /* DNV AHCI */ + { PCI_VDEVICE(INTEL, 0x19b4), board_ahci }, /* DNV AHCI */ + { PCI_VDEVICE(INTEL, 0x19b5), board_ahci }, /* DNV AHCI */ + { PCI_VDEVICE(INTEL, 0x19b6), board_ahci }, /* DNV AHCI */ + { PCI_VDEVICE(INTEL, 0x19b7), board_ahci }, /* DNV AHCI */ + { PCI_VDEVICE(INTEL, 0x19bE), board_ahci }, /* DNV AHCI */ + { PCI_VDEVICE(INTEL, 0x19bF), board_ahci }, /* DNV AHCI */ + { PCI_VDEVICE(INTEL, 0x19c0), board_ahci }, /* DNV AHCI */ + { PCI_VDEVICE(INTEL, 0x19c1), board_ahci }, /* DNV AHCI */ + { PCI_VDEVICE(INTEL, 0x19c2), board_ahci }, /* DNV AHCI */ + { PCI_VDEVICE(INTEL, 0x19c3), board_ahci }, /* DNV AHCI */ + { PCI_VDEVICE(INTEL, 0x19c4), board_ahci }, /* DNV AHCI */ + { PCI_VDEVICE(INTEL, 0x19c5), board_ahci }, /* DNV AHCI */ + { PCI_VDEVICE(INTEL, 0x19c6), board_ahci }, /* DNV AHCI */ + { PCI_VDEVICE(INTEL, 0x19c7), board_ahci }, /* DNV AHCI */ + { PCI_VDEVICE(INTEL, 0x19cE), board_ahci }, /* DNV AHCI */ + { PCI_VDEVICE(INTEL, 0x19cF), board_ahci }, /* DNV AHCI */ { PCI_VDEVICE(INTEL, 0x1c02), board_ahci }, /* CPT AHCI */ { PCI_VDEVICE(INTEL, 0x1c03), board_ahci }, /* CPT AHCI */ { PCI_VDEVICE(INTEL, 0x1c04), board_ahci }, /* CPT RAID */
Greg Kroah-Hartman
maintainerPATCH 72/76 EVM: Use crypto_memneq() for digest comparisons
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryan Ware <[email protected]>
commit 613317bd212c585c20796c10afe5daaa95d4b0a1 upstream.
This patch fixes vulnerability CVE-2016-2085. The problem exists because the vm_verify_hmac() function includes a use of memcmp(). Unfortunately, this allows timing side channel attacks; specifically a MAC forgery complexity drop from 2^128 to 2^12. This patch changes the memcmp() to the cryptographically safe crypto_memneq().
--- security/integrity/evm/evm_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
security/integrity/evm/evm_main.c +2 -1
@@ -22,6 +22,7 @@#include <linux/evm.h> #include <linux/magic.h> #include <crypto/hash.h> +#include <crypto/algapi.h> #include "evm.h" int evm_initialized;
@@ -133,7 +134,7 @@ static enum integrity_status evm_verify_ xattr_value_len, calc.digest);if (rc)break ; - rc =memcmp (xattr_data->digest, calc.digest, + rc =crypto_memneq (xattr_data->digest, calc.digest,sizeof (calc.digest));if (rc) rc = -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 74/76 FS-Cache: Increase reference of parent after registering, netfs success
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kinglong Mee <[email protected]>
commit 86108c2e34a26e4bec3c6ddb23390bf8cedcf391 upstream.
If netfs exist, fscache should not increase the reference of parent's usage and n_children, otherwise, never be decreased.
v2: thanks David's suggest,
move increasing reference of parent if success use kmem_cache_free() freeing primary_index directly
v3: don't move "netfs->primary_index->parent = &fscache_fsdef_index;"
--- fs/fscache/netfs.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
fs/fscache/netfs.c +4 -5
@@ -47,9 +47,6 @@ int __fscache_register_netfs(struct fsca netfs->primary_index->netfs_data = netfs; netfs->primary_index->flags =1 <<FSCACHE_COOKIE_ENABLED ; -atomic_inc (&netfs->primary_index->parent->usage); -atomic_inc (&netfs->primary_index->parent->n_children); -spin_lock_init (&netfs->primary_index->lock);INIT_HLIST_HEAD (&netfs->primary_index->backing_objects);
@@ -62,6 +59,9 @@ int __fscache_register_netfs(struct fsca goto already_registered; } +atomic_inc (&netfs->primary_index->parent->usage); +atomic_inc (&netfs->primary_index->parent->n_children); +list_add (&netfs->link, &fscache_netfs_list); ret =0 ;
@@ -72,8 +72,7 @@ already_registered:up_write (&fscache_addremove_sem);if (ret <0 ) { - netfs->primary_index->parent =NULL ; -__fscache_cookie_put (netfs->primary_index); +kmem_cache_free (fscache_cookie_jar, netfs->primary_index); netfs->primary_index =NULL ; }
Greg Kroah-Hartman
maintainerPATCH 75/76 FS-Cache: Dont override netfss primary_index if registering failed
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kinglong Mee <[email protected]>
commit b130ed5998e62879a66bad08931a2b5e832da95c upstream.
Only override netfs->primary_index when registering success.
--- fs/fscache/netfs.c | 37 ++++++++++++++++++------------------- 1 file changed, 18 insertions(+), 19 deletions(-)
fs/fscache/netfs.c +18 -19
@@ -22,6 +22,7 @@ static LIST_HEAD(fscache_netfs_list);int __fscache_register_netfs (struct fscache_netfs *netfs) {struct fscache_netfs *ptr; +struct fscache_cookie *cookie;int ret;_enter ("{%s}" , netfs->name);
@@ -29,26 +30,25 @@ int __fscache_register_netfs(struct fscaINIT_LIST_HEAD (&netfs->link);/* allocate a cookie for the primary index */ - netfs->primary_index = -kmem_cache_zalloc (fscache_cookie_jar,GFP_KERNEL ); + cookie =kmem_cache_zalloc (fscache_cookie_jar,GFP_KERNEL ); -if (!netfs->primary_index) { +if (!cookie) {_leave (" = -ENOMEM" );return -ENOMEM ; }/* initialise the primary index cookie */ -atomic_set (&netfs->primary_index->usage,1 ); -atomic_set (&netfs->primary_index->n_children,0 ); -atomic_set (&netfs->primary_index->n_active,1 ); - - netfs->primary_index->def = &fscache_fsdef_netfs_def; - netfs->primary_index->parent = &fscache_fsdef_index; - netfs->primary_index->netfs_data = netfs; - netfs->primary_index->flags =1 <<FSCACHE_COOKIE_ENABLED ; +atomic_set (&cookie->usage,1 ); +atomic_set (&cookie->n_children,0 ); +atomic_set (&cookie->n_active,1 ); + + cookie->def = &fscache_fsdef_netfs_def; + cookie->parent = &fscache_fsdef_index; + cookie->netfs_data = netfs; + cookie->flags =1 <<FSCACHE_COOKIE_ENABLED ; -spin_lock_init (&netfs->primary_index->lock); -INIT_HLIST_HEAD (&netfs->primary_index->backing_objects); +spin_lock_init (&cookie->lock); +INIT_HLIST_HEAD (&cookie->backing_objects);/* check the netfs type is not already present */ down_write (&fscache_addremove_sem);
@@ -59,9 +59,10 @@ int __fscache_register_netfs(struct fsca goto already_registered; } -atomic_inc (&netfs->primary_index->parent->usage); -atomic_inc (&netfs->primary_index->parent->n_children); +atomic_inc (&cookie->parent->usage); +atomic_inc (&cookie->parent->n_children); + netfs->primary_index = cookie;list_add (&netfs->link, &fscache_netfs_list); ret =0 ;
@@ -71,10 +72,8 @@ int __fscache_register_netfs(struct fsca already_registered:up_write (&fscache_addremove_sem); -if (ret <0 ) { -kmem_cache_free (fscache_cookie_jar, netfs->primary_index); - netfs->primary_index =NULL ; - } +if (ret <0 ) +kmem_cache_free (fscache_cookie_jar, cookie);_leave (" = %d" , ret);return ret;
Greg Kroah-Hartman
maintainerPATCH 76/76 binfmt_elf: Dont clobber passed executables file header
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej W. Rozycki <[email protected]>
commit b582ef5c53040c5feef4c96a8f9585b6831e2441 upstream.
Do not clobber the buffer space passed from search_binary_handler' and originally preloaded by prepare_binprm' with the executable's file header by overwriting it with its interpreter's file header. Instead keep the buffer space intact and directly use the data structure locally allocated for the interpreter's file header, fixing a bug introduced in 2.1.14 with loadable module support (linux-mips.org commit beb11695 [Import of Linux/MIPS 2.1.14], predating kernel.org repo's history). Adjust the amount of data read from the interpreter's file accordingly.
This was not an issue before loadable module support, because back then `load_elf_binary' was executed only once for a given ELF executable, whether the function succeeded or failed.
With loadable module support supported and enabled, upon a failure of `load_elf_binary' -- which may for example be caused by architecture code rejecting an executable due to a missing hardware feature requested in the file header -- a module load is attempted and then the function reexecuted by `search_binary_handler'. With the executable's file header replaced with its interpreter's file header the executable can then be erroneously accepted in this subsequent attempt.
--- fs/binfmt_elf.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
fs/binfmt_elf.c +5 -5
@@ -679,16 +679,16 @@ static int load_elf_binary(struct linux_*/ would_dump (bprm, interpreter); - retval =kernel_read (interpreter,0 , bprm->buf, -BINPRM_BUF_SIZE ); -if (retval !=BINPRM_BUF_SIZE ) { +/* Get the exec headers */ + retval =kernel_read (interpreter,0 , + (void *)&loc->interp_elf_ex, +sizeof (loc->interp_elf_ex)); +if (retval !=sizeof (loc->interp_elf_ex)) {if (retval >=0 ) retval = -EIO ; goto out_free_dentry; } -/* Get the exec headers */ - loc->interp_elf_ex = *((struct elfhdr *)bprm->buf);break ; } elf_ppnt++;
Greg Kroah-Hartman
maintainerPATCH 1/76 xhci: fix placement of call to usb_disabled()
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
In the backport of 1eaf35e4dd592c59041bc1ed3248c46326da1f5f, the call to usb_disabled() was too late, after we had already done some allocation. Move that call to the top of the function instead, making the logic match what is intended and is in the original patch.
--- drivers/usb/host/xhci.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/usb/host/xhci.c +3 -3
@@ -4866,6 +4866,9 @@ static int __init xhci_hcd_init(void) {int retval; +if (usb_disabled ()) +return -ENODEV ; + retval =xhci_register_pci ();if (retval <0 ) {pr_debug ("Problem registering PCI driver.\n" );
@@ -4894,9 +4897,6 @@ static int __init xhci_hcd_init(void)/* xhci_run_regs has eight fields and embeds 128 xhci_intr_regs */ BUILD_BUG_ON (sizeof (struct xhci_run_regs ) != (8 +8 *128 )*32 /8 ); -if (usb_disabled ()) -return -ENODEV ; -return 0 ; unreg_pci:xhci_unregister_pci ();
Greg Kroah-Hartman
maintainerPATCH 10/76 kernel/signal.c: unexport sigsuspend()
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Weinberger <[email protected]>
commit 9d8a765211335cfdad464b90fb19f546af5706ae upstream.
sigsuspend() is nowhere used except in signal.c itself, so we can mark it static do not pollute the global namespace.
But this patch is more than a boring cleanup patch, it fixes a real issue on UserModeLinux. UML has a special console driver to display ttys using xterm, or other terminal emulators, on the host side. Vegard reported that sometimes UML is unable to spawn a xterm and he's facing the following warning:
WARNING: CPU: 0 PID: 908 at include/linux/thread_info.h:128 sigsuspend+0xab/0xc0()
It turned out that this warning makes absolutely no sense as the UML xterm code calls sigsuspend() on the host side, at least it tries. But as the kernel itself offers a sigsuspend() symbol the linker choose this one instead of the glibc wrapper. Interestingly this code used to work since ever but always blocked signals on the wrong side. Some recent kernel change made the WARN_ON() trigger and uncovered the bug.
It is a wonderful example of how much works by chance on computers. :-)
--- include/linux/signal.h | 1 - kernel/signal.c | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-)
include/linux/signal.h +0 -1
@@ -247,7 +247,6 @@ extern int sigprocmask(int, sigset_t *,extern void set_current_blocked (sigset_t *);extern void __set_current_blocked (const sigset_t *);extern int show_unhandled_signals; -extern int sigsuspend (sigset_t *);struct sigaction {#ifndef __ARCH_HAS_IRIX_SIGACTION
kernel/signal.c +1 -1
@@ -3550,7 +3550,7 @@ SYSCALL_DEFINE0(pause)#endif -int sigsuspend (sigset_t *set) +static int sigsuspend (sigset_t *set) { current->saved_sigmask = current->blocked;set_current_blocked (set);
Greg Kroah-Hartman
maintainerPATCH 12/76 ocfs2/dlm: ignore cleaning the migration mle that is inuse
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: xuejiufei <[email protected]>
commit bef5502de074b6f6fa647b94b73155d675694420 upstream.
We have found that migration source will trigger a BUG that the refcount of mle is already zero before put when the target is down during migration. The situation is as follows:
dlm_migrate_lockres
dlm_add_migration_mle
dlm_mark_lockres_migrating
dlm_get_mle_inuse
<<<<<< Now the refcount of the mle is 2. dlm_send_one_lockres and wait for the target to become the new master.
<<<<<< o2hb detect the target down and clean the migration mle. Now the refcount is 1.
dlm_migrate_lockres woken, and put the mle twice when found the target goes down which trigger the BUG with the following message:
"ERROR: bad mle: ".
--- fs/ocfs2/dlm/dlmmaster.c | 26 +++++++++++++++----------- 1 file changed, 15 insertions(+), 11 deletions(-)
fs/ocfs2/dlm/dlmmaster.c +15 -11
@@ -2459,6 +2459,11 @@ static int dlm_migrate_lockres(struct dlspin_lock (&dlm->master_lock); ret =dlm_add_migration_mle (dlm, res, mle, &oldmle, name, namelen, target, dlm->node_num); +/* get an extra reference on the mle. +* otherwise the assert_master from the new +* master will destroy this. +*/ +dlm_get_mle_inuse (mle);spin_unlock (&dlm->master_lock);spin_unlock (&dlm->spinlock);
@@ -2494,6 +2499,7 @@ fail:if (mle_added) {dlm_mle_detach_hb_events (dlm, mle);dlm_put_mle (mle); +dlm_put_mle_inuse (mle); }else if (mle) {kmem_cache_free (dlm_mle_cache, mle); mle =NULL ;
@@ -2511,17 +2517,6 @@ fail:* ensure that all assert_master work is flushed. */ flush_workqueue (dlm->dlm_worker); -/* get an extra reference on the mle. -* otherwise the assert_master from the new -* master will destroy this. -* also, make sure that all callers of dlm_get_mle -* take both dlm->spinlock and dlm->master_lock */ -spin_lock (&dlm->spinlock); -spin_lock (&dlm->master_lock); -dlm_get_mle_inuse (mle); -spin_unlock (&dlm->master_lock); -spin_unlock (&dlm->spinlock); -/* notify new node and send all lock state */ /* call send_one_lockres with migration flag. * this serves as notice to the target node that a
@@ -3246,6 +3241,15 @@ top: mle->new_master != dead_node)continue ; +if (mle->new_master == dead_node && mle->inuse) { +mlog (ML_NOTICE ,"%s: target %u died during " +"migration from %u, the MLE is " +"still keep used, ignore it!\n" , + dlm->name, dead_node, + mle->master); +continue ; + } +/* If we have reached this point, this mle needs to be * removed from the list and freed. */ dlm_clean_migration_mle (dlm, mle);
Greg Kroah-Hartman
maintainerPATCH 18/76 spi: fix parent-device reference leak
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 157f38f993919b648187ba341bfb05d0e91ad2f6 upstream.
Fix parent-device reference leak due to SPI-core taking an unnecessary reference to the parent when allocating the master structure, a reference that was never released.
Note that driver core takes its own reference to the parent when the master device is registered.
--- drivers/spi/spi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/spi/spi.c +1 -1
@@ -1268,7 +1268,7 @@ struct spi_master *spi_alloc_master(stru master->bus_num =-1 ; master->num_chipselect =1 ; master->dev.class = &spi_master_class; - master->dev.parent =get_device (dev); + master->dev.parent = dev;spi_master_set_devdata (master, &master[1 ]);return master;
Greg Kroah-Hartman
maintainerPATCH 25/76 jbd2: Fix unreclaimed pages after truncate in data=journal mode
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
commit bc23f0c8d7ccd8d924c4e70ce311288cb3e61ea8 upstream.
Ted and Namjae have reported that truncated pages don't get timely reclaimed after being truncated in data=journal mode. The following test triggers the issue easily:
for (i = 0; i < 1000; i++) {
pwrite(fd, buf, 1024*1024, 0);
fsync(fd);
fsync(fd);
ftruncate(fd, 0);
}The reason is that journal_unmap_buffer() finds that truncated buffers are not journalled (jh->b_transaction == NULL), they are part of checkpoint list of a transaction (jh->b_cp_transaction != NULL) and have been already written out (!buffer_dirty(bh)). We clean such buffers but we leave them in the checkpoint list. Since checkpoint transaction holds a reference to the journal head, these buffers cannot be released until the checkpoint transaction is cleaned up. And at that point we don't call release_buffer_page() anymore so pages detached from mapping are lingering in the system waiting for reclaim to find them and free them.
Fix the problem by removing buffers from transaction checkpoint lists when journal_unmap_buffer() finds out they don't have to be there anymore.
--- fs/jbd2/transaction.c | 2 ++ 1 file changed, 2 insertions(+)
fs/jbd2/transaction.c +2 -0
@@ -2066,6 +2066,7 @@ static int journal_unmap_buffer(journal_if (!buffer_dirty (bh)) {/* bdflush has written it. We can drop it now */ +__jbd2_journal_remove_checkpoint (jh); goto zap_buffer; }
@@ -2095,6 +2096,7 @@ static int journal_unmap_buffer(journal_/* The orphan record's transaction has * committed. We can cleanse this buffer */ clear_buffer_jbddirty (bh); +__jbd2_journal_remove_checkpoint (jh); goto zap_buffer; } }
Greg Kroah-Hartman
maintainerPATCH 26/76 fix calculation of meta_bg descriptor backups
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Leiserson <[email protected]>
commit 904dad4742d211b7a8910e92695c0fa957483836 upstream.
"group" is the group where the backup will be placed, and is initialized to zero in the declaration. This meant that backups for meta_bg descriptors were erroneously written to the backup block group descriptors in groups 1 and (desc_per_block-1).
Reproduction information:
mke2fs -Fq -t ext4 -b 1024 -O ^resize_inode /tmp/foo.img 16G truncate -s 24G /tmp/foo.img
losetup /dev/loop0 /tmp/foo.img
mount /dev/loop0 /mnt
resize2fs /dev/loop0
umount /dev/loop0
dd if=/dev/zero of=/dev/loop0 bs=1024 count=2 e2fsck -fy /dev/loop0
losetup -d /dev/loop0
--- fs/ext4/resize.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/ext4/resize.c +2 -2
@@ -1030,7 +1030,7 @@ exit_free:* do not copy the full number of backups at this time. The resize * which changed s_groups_count will backup again. */ -static void update_backups (struct super_block *sb,int blk_off,char *data, +static void update_backups (struct super_block *sb,sector_t blk_off,char *data,int size,int meta_bg) {struct ext4_sb_info *sbi =EXT4_SB (sb);
@@ -1055,7 +1055,7 @@ static void update_backups(struct super_ group =ext4_list_backups (sb, &three, &five, &seven); last = sbi->s_groups_count; }else { - group =ext4_meta_bg_first_group (sb, group) +1 ; + group =ext4_get_group_number (sb, blk_off) +1 ; last = (ext4_group_t)(group +EXT4_DESC_PER_BLOCK (sb) -2 ); }
Greg Kroah-Hartman
maintainerPATCH 29/76 parisc: Fix __ARCH_SI_PREAMBLE_SIZE
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Helge Deller <[email protected]>
commit e60fc5aa608eb38b47ba4ee058f306f739eb70a0 upstream.
On a 64bit kernel build the compiler aligns the _sifields union in the struct siginfo_t on a 64bit address. The __ARCH_SI_PREAMBLE_SIZE define compensates for this alignment and thus fixes the wait testcase of the strace package.
The symptoms of a wrong __ARCH_SI_PREAMBLE_SIZE value is that _sigchld.si_stime variable is missed to be copied and thus after a copy_siginfo() will have uninitialized values.
--- arch/parisc/include/uapi/asm/siginfo.h | 4 ++++ 1 file changed, 4 insertions(+)
arch/parisc/include/uapi/asm/siginfo.h +4 -0
@@ -1,6 +1,10 @@#ifndef _PARISC_SIGINFO_H#define _PARISC_SIGINFO_H +#if defined(__LP64__) +#define __ARCH_SI_PREAMBLE_SIZE (4 * sizeof(int)) +#endif +#include <asm-generic/siginfo.h> #undef NSIGTRAP
Greg Kroah-Hartman
maintainerPATCH 3/76 crypto: algif_hash - Only export and import on sockets with data
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
commit 4afa5f9617927453ac04b24b584f6c718dfb4f45 upstream.
The hash_accept call fails to work on sockets that have not received any data. For some algorithm implementations it may cause crashes.
This patch fixes this by ensuring that we only export and import on sockets that have received data.
--- crypto/algif_hash.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
crypto/algif_hash.c +10 -2
@@ -192,9 +192,14 @@ static int hash_accept(struct socket *sostruct sock *sk2;struct alg_sock *ask2;struct hash_ctx *ctx2; +bool more;int err; - err =crypto_ahash_export (req, state); +lock_sock (sk); + more = ctx->more; + err = more ?crypto_ahash_export (req, state) :0 ; +release_sock (sk); +if (err)return err;
@@ -205,7 +210,10 @@ static int hash_accept(struct socket *so sk2 = newsock->sk; ask2 =alg_sk (sk2); ctx2 = ask2->private; - ctx2->more =1 ; + ctx2->more = more; + +if (!more) +return err; err =crypto_ahash_import (&ctx2->req, state);if (err) {
Greg Kroah-Hartman
maintainerPATCH 30/76 v4l2-compat-ioctl32: fix alignment for ARM64
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrzej Hajda <[email protected]>
commit 655e9780ab913a3a06d4a164d55e3b755524186d upstream.
Alignment/padding rules on AMD64 and ARM64 differs. To allow properly match compatible ioctls on ARM64 kernels without breaking AMD64 some fields should be aligned using compat_s64 type and in one case struct should be unpacked.
--- drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/media/v4l2-core/v4l2-compat-ioctl32.c +5 -4
@@ -264,7 +264,7 @@ static int put_v4l2_create32(struct v4l2struct v4l2_standard32 {__u32 index; -__u32 id[2 ];/* __u64 would get the alignment wrong */ +compat_u64 id;__u8 name[24 ];struct v4l2_fract frameperiod;/* Frames, not fields */ __u32 framelines;
@@ -284,7 +284,7 @@ static int put_v4l2_standard32(struct v4 { if (!access_ok(VERIFY_WRITE, up, sizeof(struct v4l2_standard32)) || put_user(kp->index, &up->index) || - copy_to_user(up->id, &kp->id, sizeof(__u64)) || + put_user(kp->id, &up->id) || copy_to_user(up->name, kp->name, 24) || copy_to_user(&up->frameperiod, &kp->frameperiod, sizeof(kp->frameperiod)) || put_user(kp->framelines, &up->framelines) ||
@@ -576,10 +576,10 @@ struct v4l2_input32 {__u32 type;/* Type of input */ __u32 audioset;/* Associated audios (bitfield) */ __u32 tuner;/* Associated tuner */ -v4l2_std_id std; +compat_u64 std;__u32 status;__u32 reserved[4 ]; -} __attribute__ ((packed)); +};/* The 64-bit v4l2_input struct has extra padding at the end of the struct. Otherwise it is identical to the 32-bit version. */
@@ -719,6 +719,7 @@ static int put_v4l2_ext_controls32(strucstruct v4l2_event32 {__u32 type;union { +compat_s64 value64;__u8 data[64 ]; } u;__u32 pending;
Greg Kroah-Hartman
maintainerPATCH 33/76 ALSA: usb-audio: Fix TEAC UD-501/UD-503/NT-503 usb delay
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guillaume Fougnies <[email protected]>
commit 5a4ff9ec8d6edd2ab1cfe8ce6a080d6e57cbea9a upstream.
TEAC UD-501/UD-503/NT-503 fail to switch properly between different rate/format. Similar to 'Playback Design', this patch corrects the invalid clock source error for TEAC products and avoids complete freeze of the usb interface of 503 series.
--- sound/usb/quirks.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-)
sound/usb/quirks.c +13 -1
@@ -1128,8 +1128,12 @@ void snd_usb_set_interface_quirk(struct* "Playback Design" products need a 50ms delay after setting the * USB interface. */ -if (le16_to_cpu (dev->descriptor.idVendor) ==0x23ba ) +switch (le16_to_cpu (dev->descriptor.idVendor)) { +case 0x23ba :/* Playback Design */ +case 0x0644 :/* TEAC Corp. */ mdelay (50 ); +break ; + } } void snd_usb_ctl_msg_quirk(struct usb_device *dev, unsigned int pipe,
@@ -1144,6 +1148,14 @@ void snd_usb_ctl_msg_quirk(struct usb_de (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS)mdelay (20 ); +/* +* "TEAC Corp." products need a 20ms delay after each +* class compliant request +*/ +if ((le16_to_cpu (dev->descriptor.idVendor) ==0x0644 ) && + (requesttype &USB_TYPE_MASK ) ==USB_TYPE_CLASS ) +mdelay (20 ); +/* Marantz/Denon devices with USB DAC functionality need a delay * after each class compliant request */
Greg Kroah-Hartman
maintainerPATCH 38/76 ALSA: rawmidi: Remove kernel WARNING for NULL user-space buffer check
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit cc85f7a634cfaf9f0713c6aa06d08817424db37a upstream.
NULL user-space buffer can be passed even in a normal path, thus it's not good to spew a kernel warning with stack trace at each time. Just drop snd_BUG_ON() macro usage there.
--- sound/core/rawmidi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/core/rawmidi.c +1 -1
@@ -1162,7 +1162,7 @@ static long snd_rawmidi_kernel_write1(stlong count1, result;struct snd_rawmidi_runtime *runtime = substream->runtime; -if (snd_BUG_ON (!kernelbuf && !userbuf)) +if (!kernelbuf && !userbuf)return -EINVAL ;if (snd_BUG_ON (!runtime->buffer))return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 4/76 dm btree: fix leak of bufio-backed block in btree_split_sibling error path
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Snitzer <[email protected]>
commit 30ce6e1cc5a0f781d60227e9096c86e188d2c2bd upstream.
The block allocated at the start of btree_split_sibling() is never released if later insert_at() fails.
Fix this by releasing the previously allocated bufio block using unlock_block().
--- drivers/md/persistent-data/dm-btree.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/md/persistent-data/dm-btree.c +3 -1
@@ -471,8 +471,10 @@ static int btree_split_sibling(struct sh r =insert_at (sizeof (__le64), pn, parent_index +1 ,le64_to_cpu (rn->keys[0 ]), &location); -if (r) +if (r) { +unlock_block (s->info, right);return r; + }if (key <le64_to_cpu (rn->keys[0 ])) {unlock_block (s->info, right);
Greg Kroah-Hartman
maintainerPATCH 43/76 ALSA: seq: Fix race at closing in virmidi driver
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 2d1b5c08366acd46c35a2e9aba5d650cb5bf5c19 upstream.
The virmidi driver has an open race at closing its assigned rawmidi device, and this may lead to use-after-free in snd_seq_deliver_single_event().
Plug the hole by properly protecting the linked list deletion and calling in the right order in snd_virmidi_input_close().
--- sound/core/seq/seq_virmidi.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
sound/core/seq/seq_virmidi.c +5 -1
@@ -254,9 +254,13 @@ static int snd_virmidi_output_open(struc*/ static int snd_virmidi_input_close (struct snd_rawmidi_substream *substream) { +struct snd_virmidi_dev *rdev = substream->rmidi->private_data;struct snd_virmidi *vmidi = substream->runtime->private_data; -snd_midi_event_free (vmidi->parser); + +write_lock_irq (&rdev->filelist_lock);list_del (&vmidi->list); +write_unlock_irq (&rdev->filelist_lock); +snd_midi_event_free (vmidi->parser); substream->runtime->private_data =NULL ;kfree (vmidi);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 5/76 drivers/base/memory.c: prohibit offlining of memory blocks with missing sections
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seth Jennings <[email protected]>
commit 26bbe7ef6d5cdc7ec08cba6d433fca4060f258f3 upstream.
Commit bdee237c0343 ("x86: mm: Use 2GB memory block size on large-memory x86-64 systems") and 982792c782ef ("x86, mm: probe memory block size for generic x86 64bit") introduced large block sizes for x86. This made it possible to have multiple sections per memory block where previously, there was a only every one section per block.
Since blocks consist of contiguous ranges of section, there can be holes in the blocks where sections are not present. If one attempts to offline such a block, a crash occurs since the code is not designed to deal with this.
This patch is a quick fix to gaurd against the crash by not allowing blocks with non-present sections to be offlined.
Addresses https://bugzilla.kernel.org/show_bug.cgi?id=107781
--- drivers/base/memory.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/base/memory.c +4 -0
@@ -311,6 +311,10 @@ static int memory_subsys_offline(structif (mem->state ==MEM_OFFLINE )return 0 ; +/* Can't offline block with non-present sections */ +if (mem->section_count != sections_per_block) +return -EINVAL ; +return memory_block_change_state (mem,MEM_OFFLINE ,MEM_ONLINE ); }
Greg Kroah-Hartman
maintainerPATCH 6/76 HID: usbhid: fix recursive deadlock
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ioan-Adrian Ratiu <[email protected]>
commit e470127e9606b1fa151c4184243e61296d1e0c0f upstream.
The critical section protected by usbhid->lock in hid_ctrl() is too big and because of this it causes a recursive deadlock. "Too big" means the case statement and the call to hid_input_report() do not need to be protected by the spinlock (no URB operations are done inside them).
The deadlock happens because in certain rare cases drivers try to grab the lock while handling the ctrl irq which grabs the lock before them as described above. For example newer wacom tablets like 056a:033c try to reschedule proximity reads from wacom_intuos_schedule_prox_event() calling hid_hw_request() -> usbhid_request() -> usbhid_submit_report() which tries to grab the usbhid lock already held by hid_ctrl().
There are two ways to get out of this deadlock:
1. Make the drivers work "around" the ctrl critical region, in the wacom case for ex. by delaying the scheduling of the proximity read request itself to a workqueue.
2. Shrink the critical region so the usbhid lock protects only the instructions which modify usbhid state, calling hid_input_report() with the spinlock unlocked, allowing the device driver to grab the lock first, finish and then grab the lock afterwards in hid_ctrl().
This patch implements the 2nd solution.
--- drivers/hid/usbhid/hid-core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/hid/usbhid/hid-core.c +2 -2
@@ -492,8 +492,6 @@ static void hid_ctrl(struct urb *urb)struct usbhid_device *usbhid = hid->driver_data;int unplug =0 , status = urb->status; -spin_lock (&usbhid->lock); -switch (status) {case 0 :/* success */ if (usbhid->ctrl[usbhid->ctrltail].dir ==USB_DIR_IN )
@@ -513,6 +511,8 @@ static void hid_ctrl(struct urb *urb)hid_warn (urb->dev,"ctrl urb status %d received\n" , status); } +spin_lock (&usbhid->lock); +if (unplug) { usbhid->ctrltail = usbhid->ctrlhead; }else {
Greg Kroah-Hartman
maintainerPATCH 7/76 proc: actually make proc_fd_permission() thread-friendly
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleg Nesterov <[email protected]>
commit 54708d2858e79a2bdda10bf8a20c80eb96c20613 upstream.
The commit 96d0df79f264 ("proc: make proc_fd_permission() thread-friendly") fixed the access to /proc/self/fd from sub-threads, but introduced another
problem: a sub-thread can't access /proc/<tid>/fd/ or /proc/thread-self/fd if generic_permission() fails.
Change proc_fd_permission() to check same_thread_group(pid_task(), current).
--- fs/proc/fd.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)
fs/proc/fd.c +11 -3
@@ -283,11 +283,19 @@ static struct dentry *proc_lookupfd(stru*/ int proc_fd_permission (struct inode *inode,int mask) { -int rv =generic_permission (inode, mask); +struct task_struct *p; +int rv; + + rv =generic_permission (inode, mask);if (rv ==0 ) -return 0 ; -if (task_tgid (current) ==proc_pid (inode)) +return rv; + +rcu_read_lock (); + p =pid_task (proc_pid (inode),PIDTYPE_PID ); +if (p &&same_thread_group (p, current)) rv =0 ; +rcu_read_unlock (); +return rv; }
Greg Kroah-Hartman
maintainerPATCH 9/76 fat: fix fake_offset handling on error path
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: OGAWA Hirofumi <[email protected]>
commit 928a477102c4fc6739883415b66987207e3502f4 upstream.
For the root directory, . and .. are faked (using dir_emit_dots()) and ctx->pos is reset from 2 to 0.
A corrupted root directory could cause fat_get_entry() to fail, but ->iterate() (fat_readdir()) reports progress to the VFS (with ctx->pos rewound to 0), so any following calls to ->iterate() continue to return the same entries again and again.
The result is that userspace will never see the end of the directory, causing e.g. 'ls' to hang in a getdents() loop.
--- fs/fat/dir.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-)
fs/fat/dir.c +11 -5
@@ -614,9 +614,9 @@ parse_record:int status =fat_parse_long (inode, &cpos, &bh, &de, &unicode, &nr_slots);if (status <0 ) { - ctx->pos = cpos; + bh =NULL ; ret = status; - goto out; + goto end_of_dir; }else if (status ==PARSE_INVALID ) goto record_end;else if (status ==PARSE_NOT_LONGNAME )
@@ -658,8 +658,9 @@ parse_record: fill_len = short_len; start_filldir: -if (!fake_offset) - ctx->pos = cpos - (nr_slots +1 ) *sizeof (struct msdos_dir_entry ); + ctx->pos = cpos - (nr_slots +1 ) *sizeof (struct msdos_dir_entry ); +if (fake_offset && ctx->pos <2 ) + ctx->pos =2 ;if (!memcmp (de->name,MSDOS_DOT ,MSDOS_NAME )) {if (!dir_emit_dot (file, ctx))
@@ -685,14 +686,19 @@ record_end: fake_offset =0 ; ctx->pos = cpos; goto get_new; + end_of_dir: - ctx->pos = cpos; +if (fake_offset && cpos <2 ) + ctx->pos =2 ; +else + ctx->pos = cpos; fill_failed:brelse (bh);if (unicode)__putname (unicode); out:mutex_unlock (&sbi->s_lock); +return ret; }
Greg Kroah-Hartman
maintainerPATCH 50/76 ALSA: hda - Add fixup for Mac Mini 7,1 model
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 2154cc0e2d4ae15132d005d17e473327c70c9a06 upstream.
Mac Mini 7,1 model with CS4208 codec reports the headphone jack detection wrongly in an inverted way. Moreover, the advertised pins for the audio input and SPDIF output have actually no jack detection.
This patch addresses these issues. The inv_jack_detect flag is set for fixing the headphone jack detection, and the pin configs for audio input and SPDIF output are marked as non-detectable.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=105161
--- sound/pci/hda/patch_cirrus.c | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+)
sound/pci/hda/patch_cirrus.c +27 -0
@@ -617,6 +617,7 @@ enum {CS4208_MAC_AUTO ,CS4208_MBA6 ,CS4208_MBP11 , +CS4208_MACMINI , CS4208_GPIO0, };
@@ -624,6 +625,7 @@ static const struct hda_model_fixup cs42 { .id = CS4208_GPIO0, .name = "gpio0" }, { .id = CS4208_MBA6, .name = "mba6" }, { .id = CS4208_MBP11, .name = "mbp11" }, + { .id = CS4208_MACMINI, .name = "macmini" }, {} };
@@ -635,6 +637,7 @@ static const struct snd_pci_quirk cs4208/* codec SSID matching */ static const struct snd_pci_quirk cs4208_mac_fixup_tbl[] = {SND_PCI_QUIRK (0x106b ,0x5e00 ,"MacBookPro 11,2" ,CS4208_MBP11 ), +SND_PCI_QUIRK (0x106b ,0x6c00 ,"MacMini 7,1" ,CS4208_MACMINI ),SND_PCI_QUIRK (0x106b ,0x7100 ,"MacBookAir 6,1" ,CS4208_MBA6 ),SND_PCI_QUIRK (0x106b ,0x7200 ,"MacBookAir 6,2" ,CS4208_MBA6 ),SND_PCI_QUIRK (0x106b ,0x7b00 ,"MacBookPro 12,1" ,CS4208_MBP11 ),
@@ -667,6 +670,24 @@ static void cs4208_fixup_mac(struct hda_snd_hda_apply_fixup (codec, action); } +/* MacMini 7,1 has the inverted jack detection */ +static void cs4208_fixup_macmini (struct hda_codec *codec, +const struct hda_fixup *fix,int action) +{ +static const struct hda_pintbl pincfgs[] = { + {0x18 ,0x00ab9150 },/* mic (audio-in) jack: disable detect */ + {0x21 ,0x004be140 },/* SPDIF: disable detect */ + { } + }; + +if (action ==HDA_FIXUP_ACT_PRE_PROBE ) { +/* HP pin (0x10) has an inverted detection */ + codec->inv_jack_detect =1 ; +/* disable the bogus Mic and SPDIF jack detections */ +snd_hda_apply_pincfgs (codec, pincfgs); + } +} +static int cs4208_spdif_sw_put (struct snd_kcontrol *kcontrol,struct snd_ctl_elem_value *ucontrol) {
@@ -710,6 +731,12 @@ static const struct hda_fixup cs4208_fix .chained = true, .chain_id = CS4208_GPIO0, }, + [CS4208_MACMINI] = { + .type = HDA_FIXUP_FUNC, + .v.func = cs4208_fixup_macmini, + .chained = true, + .chain_id = CS4208_GPIO0, + }, [CS4208_GPIO0] = { .type = HDA_FIXUP_FUNC, .v.func = cs4208_fixup_gpio0,
Greg Kroah-Hartman
maintainerPATCH 59/76 USB: cp210x: add ID for IAI USB to RS485 adaptor
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Dedecker <[email protected]>
commit f487c54ddd544e1c9172cd510954f697b77b76e3 upstream.
Added the USB serial console device ID for IAI Corp. RCB-CV-USB USB to RS485 adaptor.
--- drivers/usb/serial/cp210x.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/serial/cp210x.c +1 -0
@@ -98,6 +98,7 @@ static const struct usb_device_id id_tab { USB_DEVICE(0x10C4, 0x81AC) }, /* MSD Dash Hawk */ { USB_DEVICE(0x10C4, 0x81AD) }, /* INSYS USB Modem */ { USB_DEVICE(0x10C4, 0x81C8) }, /* Lipowsky Industrie Elektronik GmbH, Baby-JTAG */ + { USB_DEVICE(0x10C4, 0x81D7) }, /* IAI Corp. RCB-CV-USB USB to RS485 Adaptor */ { USB_DEVICE(0x10C4, 0x81E2) }, /* Lipowsky Industrie Elektronik GmbH, Baby-LIN */ { USB_DEVICE(0x10C4, 0x81E7) }, /* Aerocomm Radio */ { USB_DEVICE(0x10C4, 0x81E8) }, /* Zephyr Bioharness */
Greg Kroah-Hartman
maintainerPATCH 67/76 crypto: af_alg - Fix socket double-free when accept fails
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
commit a383292c86663bbc31ac62cc0c04fc77504636a6 upstream.
When we fail an accept(2) call we will end up freeing the socket twice, once due to the direct sk_free call and once again through newsock.
This patch fixes this by removing the sk_free call.
--- crypto/af_alg.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
crypto/af_alg.c +1 -3
@@ -275,10 +275,8 @@ int af_alg_accept(struct sock *sk, strucsecurity_sk_clone (sk, sk2); err = type->accept (ask->private, sk2); -if (err) { -sk_free (sk2); +if (err) goto unlock; - } sk2->sk_family =PF_ALG ;
Greg Kroah-Hartman
maintainerPATCH 71/76 crypto: algif_hash - wait for crypto_ahash_init() to complete
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang, Rui Y <[email protected]>
commit fe09786178f9df713a4b2dd6b93c0a722346bf5e upstream.
hash_sendmsg/sendpage() need to wait for the completion of crypto_ahash_init() otherwise it can cause panic.
--- crypto/algif_hash.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
crypto/algif_hash.c +3 -1
@@ -51,7 +51,8 @@ static int hash_sendmsg(struct kiocb *unlock_sock (sk);if (!ctx->more) { - err =crypto_ahash_init (&ctx->req); + err =af_alg_wait_for_completion (crypto_ahash_init (&ctx->req), + &ctx->completion);if (err) goto unlock; }
@@ -131,6 +132,7 @@ static ssize_t hash_sendpage(struct sock }else {if (!ctx->more) { err =crypto_ahash_init (&ctx->req); + err =af_alg_wait_for_completion (err, &ctx->completion);if (err) goto unlock; }
Greg Kroah-Hartman
maintainerPATCH 73/76 crypto: user - lock crypto_alg_list on alg dump
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Krause <[email protected]>
commit 63e41ebc6630f39422d87f8a4bade1e793f37a01 upstream.
We miss to take the crypto_alg_sem semaphore when traversing the crypto_alg_list for CRYPTO_MSG_GETALG dumps. This allows a race with crypto_unregister_alg() removing algorithms from the list while we're still traversing it, thereby leading to a use-after-free as show below:
[ 3482.071639] general protection fault: 0000 [#1] SMP [ 3482.075639] Modules linked in: aes_x86_64 glue_helper lrw ablk_helper cryptd gf128mul ipv6 pcspkr serio_raw virtio_net microcode virtio_pci virtio_ring virtio sr_mod cdrom [last unloaded: aesni_intel] [ 3482.075639] CPU: 1 PID: 11065 Comm: crconf Not tainted 4.3.4-grsec+ #126 [ 3482.075639] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140531_083030-gandalf 04/01/2014 [ 3482.075639] task: ffff88001cd41a40 ti: ffff88001cd422c8 task.ti: ffff88001cd422c8 [ 3482.075639] RIP: 0010:[<ffffffff93722bd3>] [<ffffffff93722bd3>] strncpy+0x13/0x30 [ 3482.075639] RSP: 0018:ffff88001f713b60 EFLAGS: 00010202 [ 3482.075639] RAX: ffff88001f6c4430 RBX: ffff88001f6c43a0 RCX: ffff88001f6c4430 [ 3482.075639] RDX: 0000000000000040 RSI: fefefefefefeff16 RDI: ffff88001f6c4430 [ 3482.075639] RBP: ffff88001f713b60 R08: ffff88001f6c4470 R09: ffff88001f6c4480 [ 3482.075639] R10: 0000000000000002 R11: 0000000000000246 R12: ffff88001ce2aa28 [ 3482.075639] R13: ffff880000093700 R14: ffff88001f5e4bf8 R15: 0000000000003b20 [ 3482.075639] FS: 0000033826fa2700(0000) GS:ffff88001e900000(0000) knlGS:0000000000000000 [ 3482.075639] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 3482.075639] CR2: ffffffffff600400 CR3: 00000000139ec000 CR4: 00000000001606f0 [ 3482.075639] Stack: [ 3482.075639] ffff88001f713bd8 ffffffff936ccd00 ffff88001e5c4200 ffff880000093700 [ 3482.075639] ffff88001f713bd0 ffffffff938ef4bf 0000000000000000 0000000000003b20 [ 3482.075639] ffff88001f5e4bf8 ffff88001f5e4848 0000000000000000 0000000000003b20 [ 3482.075639] Call Trace: [ 3482.075639] [<ffffffff936ccd00>] crypto_report_alg+0xc0/0x3e0 [ 3482.075639] [<ffffffff938ef4bf>] ? __alloc_skb+0x16f/0x300 [ 3482.075639] [<ffffffff936cd08a>] crypto_dump_report+0x6a/0x90 [ 3482.075639] [<ffffffff93935707>] netlink_dump+0x147/0x2e0 [ 3482.075639] [<ffffffff93935f99>] __netlink_dump_start+0x159/0x190 [ 3482.075639] [<ffffffff936ccb13>] crypto_user_rcv_msg+0xc3/0x130 [ 3482.075639] [<ffffffff936cd020>] ? crypto_report_alg+0x3e0/0x3e0 [ 3482.075639] [<ffffffff936cc4b0>] ? alg_test_crc32c+0x120/0x120 [ 3482.075639] [<ffffffff93933145>] ? __netlink_lookup+0xd5/0x120 [ 3482.075639] [<ffffffff936cca50>] ? crypto_add_alg+0x1d0/0x1d0 [ 3482.075639] [<ffffffff93938141>] netlink_rcv_skb+0xe1/0x130 [ 3482.075639] [<ffffffff936cc4f8>] crypto_netlink_rcv+0x28/0x40 [ 3482.075639] [<ffffffff939375a8>] netlink_unicast+0x108/0x180 [ 3482.075639] [<ffffffff93937c21>] netlink_sendmsg+0x541/0x770 [ 3482.075639] [<ffffffff938e31e1>] sock_sendmsg+0x21/0x40 [ 3482.075639] [<ffffffff938e4763>] SyS_sendto+0xf3/0x130 [ 3482.075639] [<ffffffff93444203>] ? bad_area_nosemaphore+0x13/0x20 [ 3482.075639] [<ffffffff93444470>] ? __do_page_fault+0x80/0x3a0 [ 3482.075639] [<ffffffff939d80cb>] entry_SYSCALL_64_fastpath+0x12/0x6e [ 3482.075639] Code: 88 4a ff 75 ed 5d 48 0f ba 2c 24 3f c3 66 66 2e 0f 1f 84 00 00 00 00 00 55 48 85 d2 48 89 f8 48 89 f9 4c 8d 04 17 48 89 e5 74 15 <0f> b6 16 80 fa 01 88 11 48 83 de ff 48 83 c1 01 4c 39 c1 75 eb [ 3482.075639] RIP [<ffffffff93722bd3>] strncpy+0x13/0x30
To trigger the race run the following loops simultaneously for a while:
$ while : ; do modprobe aesni-intel; rmmod aesni-intel; done $ while : ; do crconf show all > /dev/null; done
Fix the race by taking the crypto_alg_sem read lock, thereby preventing crypto_unregister_alg() from modifying the algorithm list during the dump.
This bug has been detected by the PaX memory sanitize feature.
--- crypto/crypto_user.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
crypto/crypto_user.c +5 -1
@@ -477,6 +477,7 @@ static int crypto_user_rcv_msg(struct skif (link->dump ==NULL )return -EINVAL ; +down_read (&crypto_alg_sem);list_for_each_entry (alg, &crypto_alg_list, cra_list) dump_alloc +=CRYPTO_REPORT_MAXSIZE ;
@@ -486,8 +487,11 @@ static int crypto_user_rcv_msg(struct sk .done = link->done, .min_dump_alloc = dump_alloc, }; -return netlink_dump_start (crypto_nlsk, skb, nlh, &c); + err =netlink_dump_start (crypto_nlsk, skb, nlh, &c); } +up_read (&crypto_alg_sem); + +return err; } err = nlmsg_parse(nlh, crypto_msg_min[type], attrs, CRYPTOCFGA_MAX,
Greg Kroah-Hartman
maintainerPATCH 52/76 ALSA: hda - Fix speaker output from VAIO AiO machines
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit c44d9b1181cf34e0860c72cc8a00e0c47417aac0 upstream.
Some Sony VAIO AiO models (VGC-JS4EF and VGC-JS25G, both with PCI SSID 104d:9044) need the same quirk to make the speaker working properly.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=112031
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -2266,6 +2266,7 @@ static const struct snd_pci_quirk alc882SND_PCI_QUIRK (0x104d ,0x9047 ,"Sony Vaio TT" ,ALC889_FIXUP_VAIO_TT ),SND_PCI_QUIRK (0x104d ,0x905a ,"Sony Vaio Z" ,ALC882_FIXUP_NO_PRIMARY_HP ),SND_PCI_QUIRK (0x104d ,0x9043 ,"Sony Vaio VGC-LN51JGB" ,ALC882_FIXUP_NO_PRIMARY_HP ), +SND_PCI_QUIRK (0x104d ,0x9044 ,"Sony VAIO AiO" ,ALC882_FIXUP_NO_PRIMARY_HP ),/* All Apple entries are in codec SSIDs */ SND_PCI_QUIRK(0x106b, 0x00a0, "MacBookPro 3,1", ALC889_FIXUP_MBP_VREF),
Greg Kroah-Hartman
maintainerPATCH 53/76 ALSA: dummy: Implement timer backend switching more safely
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit ddce57a6f0a2d8d1bfacfa77f06043bc760403c2 upstream.
Currently the selected timer backend is referred at any moment from the running PCM callbacks. When the backend is switched, it's possible to lead to inconsistency from the running backend. This was pointed by syzkaller fuzzer, and the commit [7ee96216c31a: ALSA:
dummy: Disable switching timer backend via sysfs] disabled the dynamic switching for avoiding the crash.
This patch improves the handling of timer backend switching. It keeps the reference to the selected backend during the whole operation of an opened stream so that it won't be changed by other streams.
Together with this change, the hrtimer parameter is reenabled as writable now.
NOTE: this patch also turned out to fix the still remaining race. Namely, ops was still replaced dynamically at dummy_pcm_open:
static int dummy_pcm_open(struct snd_pcm_substream *substream)
{
....
dummy->timer_ops = &dummy_systimer_ops;
if (hrtimer)
dummy->timer_ops = &dummy_hrtimer_ops;Since dummy->timer_ops is common among all streams, and when the replacement happens during accesses of other streams, it may lead to a crash. This was actually triggered by syzkaller fuzzer and KASAN.
This patch rewrites the code not to use the ops shared by all streams any longer, too.
--- sound/drivers/dummy.c | 37 +++++++++++++++++++------------------ 1 file changed, 19 insertions(+), 18 deletions(-)
sound/drivers/dummy.c +19 -18
@@ -87,7 +87,7 @@ MODULE_PARM_DESC(pcm_substreams, "PCM sumodule_param (fake_buffer, bool,0444 );MODULE_PARM_DESC (fake_buffer,"Fake buffer allocations." );#ifdef CONFIG_HIGH_RES_TIMERS -module_param (hrtimer, bool,0444 ); +module_param (hrtimer, bool,0644 );MODULE_PARM_DESC (hrtimer,"Use hrtimer as the timer source." );#endif
@@ -109,6 +109,9 @@ struct dummy_timer_ops {snd_pcm_uframes_t (*pointer)(struct snd_pcm_substream *); }; +#define get_dummy_ops (substream) \ + (*(const struct dummy_timer_ops **)(substream)->runtime->private_data) +struct dummy_model {const char *name;int (*playback_constraints)(struct snd_pcm_runtime *runtime);
@@ -137,7 +140,6 @@ struct snd_dummy {int iobox;struct snd_kcontrol *cd_volume_ctl;struct snd_kcontrol *cd_switch_ctl; -const struct dummy_timer_ops *timer_ops; };/*
@@ -231,6 +233,8 @@ struct dummy_model *dummy_models[] = {*/ struct dummy_systimer_pcm { +/* ops must be the first item */ +const struct dummy_timer_ops *timer_ops;spinlock_t lock;struct timer_list timer;unsigned long base_time;
@@ -368,6 +372,8 @@ static struct dummy_timer_ops dummy_syst*/ struct dummy_hrtimer_pcm { +/* ops must be the first item */ +const struct dummy_timer_ops *timer_ops;ktime_t base_time;ktime_t period_time;atomic_t running;
@@ -494,31 +500,25 @@ static struct dummy_timer_ops dummy_hrtistatic int dummy_pcm_trigger (struct snd_pcm_substream *substream,int cmd) { -struct snd_dummy *dummy =snd_pcm_substream_chip (substream); -switch (cmd) {case SNDRV_PCM_TRIGGER_START :case SNDRV_PCM_TRIGGER_RESUME : -return dummy->timer_ops->start (substream); +return get_dummy_ops (substream)->start (substream);case SNDRV_PCM_TRIGGER_STOP :case SNDRV_PCM_TRIGGER_SUSPEND : -return dummy->timer_ops->stop (substream); +return get_dummy_ops (substream)->stop (substream); }return -EINVAL ; }static int dummy_pcm_prepare (struct snd_pcm_substream *substream) { -struct snd_dummy *dummy =snd_pcm_substream_chip (substream); - -return dummy->timer_ops->prepare (substream); +return get_dummy_ops (substream)->prepare (substream); }static snd_pcm_uframes_t dummy_pcm_pointer (struct snd_pcm_substream *substream) { -struct snd_dummy *dummy =snd_pcm_substream_chip (substream); - -return dummy->timer_ops->pointer (substream); +return get_dummy_ops (substream)->pointer (substream); }static struct snd_pcm_hardware dummy_pcm_hardware = {
@@ -564,17 +564,19 @@ static int dummy_pcm_open(struct snd_pcmstruct snd_dummy *dummy =snd_pcm_substream_chip (substream);struct dummy_model *model = dummy->model;struct snd_pcm_runtime *runtime = substream->runtime; +const struct dummy_timer_ops *ops;int err; - dummy->timer_ops = &dummy_systimer_ops; + ops = &dummy_systimer_ops;#ifdef CONFIG_HIGH_RES_TIMERS if (hrtimer) - dummy->timer_ops = &dummy_hrtimer_ops; + ops = &dummy_hrtimer_ops;#endif - err = dummy->timer_ops->create (substream); + err = ops->create (substream);if (err <0 )return err; +get_dummy_ops (substream) = ops; runtime->hw = dummy->pcm_hw;if (substream->pcm->device &1 ) {
@@ -596,7 +598,7 @@ static int dummy_pcm_open(struct snd_pcm err = model->capture_constraints (substream->runtime); }if (err <0 ) { - dummy->timer_ops->free (substream); +get_dummy_ops (substream)->free (substream);return err; }return 0 ;
@@ -604,8 +606,7 @@ static int dummy_pcm_open(struct snd_pcmstatic int dummy_pcm_close (struct snd_pcm_substream *substream) { -struct snd_dummy *dummy =snd_pcm_substream_chip (substream); - dummy->timer_ops->free (substream); +get_dummy_ops (substream)->free (substream);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 58/76 USB: serial: ftdi_sio: add support for Yaesu SCU-18 cable
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
commit e03cdf22a2727c60307be6a729233edab3bfda9c upstream.
Harald Linden reports that the ftdi_sio driver works properly for the Yaesu SCU-18 cable if the device ids are added to the driver. So let's add them.
--- drivers/usb/serial/ftdi_sio.c | 1 + drivers/usb/serial/ftdi_sio_ids.h | 1 + 2 files changed, 2 insertions(+)
drivers/usb/serial/ftdi_sio.c +1 -0
@@ -837,6 +837,7 @@ static const struct usb_device_id id_tab { USB_DEVICE(FTDI_VID, FTDI_TURTELIZER_PID), .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, { USB_DEVICE(RATOC_VENDOR_ID, RATOC_PRODUCT_ID_USB60F) }, + { USB_DEVICE(RATOC_VENDOR_ID, RATOC_PRODUCT_ID_SCU18) }, { USB_DEVICE(FTDI_VID, FTDI_REU_TINY_PID) },/* Papouch devices based on FTDI chip */
drivers/usb/serial/ftdi_sio_ids.h +1 -0
@@ -615,6 +615,7 @@*/ #define RATOC_VENDOR_ID 0x0584#define RATOC_PRODUCT_ID_USB60F 0xb020 +#define RATOC_PRODUCT_ID_SCU18 0xb03a/* * Infineon Technologies
Greg Kroah-Hartman
maintainerPATCH 49/76 ALSA: timer: Fix race between stop and interrupt
In reply to Greg Kroah-Hartman3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit ed8b1d6d2c741ab26d60d499d7fbb7ac801f0f51 upstream.
A slave timer element also unlinks at snd_timer_stop() but it takes only slave_active_lock. When a slave is assigned to a master, however, this may become a race against the master's interrupt handling, eventually resulting in a list corruption. The actual bug could be seen with a syzkaller fuzzer test case in BugLink below.
As a fix, we need to take timeri->timer->lock when timer isn't NULL, i.e. assigned to a master, while the assignment to a master itself is protected by slave_active_lock.
--- sound/core/timer.c | 4 ++++ 1 file changed, 4 insertions(+)
sound/core/timer.c +4 -0
@@ -508,9 +508,13 @@ static int _snd_timer_stop(struct snd_tispin_unlock_irqrestore (&slave_active_lock, flags);return -EBUSY ; } +if (timeri->timer) +spin_lock (&timeri->timer->lock); timeri->flags &= ~SNDRV_TIMER_IFLG_RUNNING ;list_del_init (&timeri->ack_list);list_del_init (&timeri->active_list); +if (timeri->timer) +spin_unlock (&timeri->timer->lock);spin_unlock_irqrestore (&slave_active_lock, flags); goto __end; }
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 3.14.61 release. There are 76 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Tue Feb 16 22:22:01 UTC 2016. Anything received after that time might be too late.
Build results:
total: 128 pass: 128 fail: 0 Qemu test results: total: 83 pass: 83 fail: 0
Details are available at http://kerneltests.org/builders.
Guenter
Quoted 5 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 3.14.61 release. There are 76 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Quoted 7 lines
Responses should be made by Tue Feb 16 22:22:01 UTC 2016. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v3.x/stable-review/patch-3.14.61-rc1.gzand the diffstat can be found below.
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
Signature · 5 lines
Shuah Khan Sr. Linux Kernel Developer Open Source Innovation Group Samsung Research America (Silicon Valley) [email protected] | (970) 217-8978
Greg Kroah-Hartman
maintainerQuoted 9 lines · Shuah Khan
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 3.14.61 release. There are 76 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Tue Feb 16 22:22:01 UTC 2016. Anything received after that time might be too late.
Quoted 6 lines
Quoted 4 lines
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v3.x/stable-review/patch-3.14.61-rc1.gzand the diffstat can be found below.
Compiled and booted on my test system. No dmesg regressions.
Thanks for testing all of these and letting me know.
greg k-h
Greg Kroah-Hartman
maintainerQuoted 10 lines · Guenter Roeck
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 3.14.61 release. There are 76 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Tue Feb 16 22:22:01 UTC 2016. Anything received after that time might be too late.
Quoted 6 lines
Build results:
total: 128 pass: 128 fail: 0 Qemu test results: total: 83 pass: 83 fail: 0Details are available at http://kerneltests.org/builders.
Thanks for testing all of these and letting me know.
greg k-h