4.9.30-stable review
Subsystems (3)
Greg Kroah-Hartman
maintainercover 4.9.30-stable review
This is the start of the stable review cycle for the 4.9.30 release. There are 164 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu May 25 20:08:20 UTC 2017. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.30-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.9.30-rc1
Chris Wilson <[email protected]>
drm/i915/gvt: Disable access to stolen memory as a guest
Julius Werner <[email protected]>
drivers: char: mem: Check for address space wraparound with mmap()
J. Bruce Fields <[email protected]>
nfsd: encoders mustn't use unitialized values in error cases
Ari Kauppi <[email protected]>
nfsd: fix undefined behavior in nfsd4_layout_verify
Benjamin Coddington <[email protected]>
NFS: Use GFP_NOIO for two allocations in writeback
Fred Isaman <[email protected]>
NFS: Fix use after free in write error path
Trond Myklebust <[email protected]>
NFSv4: Fix a hang in OPEN related to server reboot
Mario Kleiner <[email protected]>
drm/edid: Add 10 bpc quirk for LGD 764 panel in HP zBook 17 G2
Alexander Couzens <[email protected]>
mtd: nand: add ooblayout for old hamming layout
Roger Quadros <[email protected]>
mtd: nand: omap2: Fix partition creation via cmdline mtdparts
Simon Baatz <[email protected]>
mtd: nand: orion: fix clk handling
Lukas Wunner <[email protected]>
PCI: Freeze PME scan before suspending devices
David Woodhouse <[email protected]>
PCI: Only allow WC mmap on prefetchable resources
David Woodhouse <[email protected]>
PCI: Fix another sanity check bug in /proc/pci mmap
David Woodhouse <[email protected]>
PCI: Fix pci_mmap_fits() for HAVE_PCI_RESOURCE_TO_USER platforms
K. Y. Srinivasan <[email protected]>
PCI: hv: Specify CPU_AFFINITY_ALL for MSI affinity when >= 32 CPUs
K. Y. Srinivasan <[email protected]>
PCI: hv: Allocate interrupt descriptors with GFP_ATOMIC
Thomas Gleixner <[email protected]>
tracing/kprobes: Enforce kprobes teardown after testing
Masami Hiramatsu <[email protected]>
um: Fix to call read_initrd after init_bootmem
Al Viro <[email protected]>
osf_wait4(): fix infoleak
Huacai Chen <[email protected]>
MIPS: Loongson-3: Select MIPS_L1_CACHE_SHIFT_6
Jon Derrick <[email protected]>
nvme: unmap CMB and remove sysfs file in reset path
Thomas Gleixner <[email protected]>
genirq: Fix chained interrupt data ordering
Johan Hovold <[email protected]>
uwb: fix device quirk on big-endian hosts
Daniel Micay <[email protected]>
stackprotector: Increase the per-task stack canary's random range from 32 bits to 64 bits on 64-bit platforms
James Hogan <[email protected]>
metag/uaccess: Check access_ok in strncpy_from_user
James Hogan <[email protected]>
metag/uaccess: Fix access_ok()
KarimAllah Ahmed <[email protected]>
iommu/vt-d: Flush the IOTLB to get rid of the initial kdump mappings
Malcolm Priestley <[email protected]>
staging: rtl8192e: GetTs Fix invalid TID 7 warning.
Malcolm Priestley <[email protected]>
staging: rtl8192e: rtl92e_get_eeprom_size Fix read size of EPROM_CMD.
Malcolm Priestley <[email protected]>
staging: rtl8192e: fix 2 byte alignment of register BSSIDR.
Malcolm Priestley <[email protected]>
staging: rtl8192e: rtl92e_fill_tx_desc fix write to mapped out memory.
Kristina Martsenko <[email protected]>
arm64: documentation: document tagged pointer stack constraints
Mark Rutland <[email protected]>
arm64: uaccess: ensure extension of access_ok() addr
Mark Rutland <[email protected]>
arm64: armv8_deprecated: ensure extension of addr
Mark Rutland <[email protected]>
arm64: ensure extension of smp_store_release value
Mark Rutland <[email protected]>
arm64: xchg: hazard against entire exchange variable
Daniel Lezcano <[email protected]>
arm64: dts: hi6220: Reset the mmc hosts
Leonard Crestez <[email protected]>
ARM: dts: imx6sx-sdb: Remove OPP override
Ludovic Desroches <[email protected]>
ARM: dts: at91: sama5d3_xplained: not all ADC channels are available
Ludovic Desroches <[email protected]>
ARM: dts: at91: sama5d3_xplained: fix ADC vref
Vladimir Murzin <[email protected]>
ARM: 8670/1: V7M: Do not corrupt vector table around v7m_invalidate_l1 call
Ard Biesheuvel <[email protected]>
ARM: 8662/1: module: split core and init PLT sections
Zhichao Huang <[email protected]>
KVM: arm: plug potential guest hardware debug leakage
Marc Zyngier <[email protected]>
KVM: arm/arm64: vgic-v3: Do not use Active+Pending state for a HW interrupt
Marc Zyngier <[email protected]>
KVM: arm/arm64: vgic-v2: Do not use Active+Pending state for a HW interrupt
Marc Zyngier <[email protected]>
arm: KVM: Do not use stack-protector to compile HYP code
Marc Zyngier <[email protected]>
arm64: KVM: Do not use stack-protector to compile EL2 code
Michael Neuling <[email protected]>
powerpc/tm: Fix FP and VMX register corruption
LiuHailong <[email protected]>
powerpc/64e: Fix hang when debugging programs with relocated kernel
Alexey Kardashevskiy <[email protected]>
powerpc/iommu: Do not call PageTransHuge() on tail pages
Tyrel Datwyler <[email protected]>
powerpc/pseries: Fix of_node_put() underflow during DLPAR remove
Mahesh Salgaonkar <[email protected]>
powerpc/book3s/mce: Move add_taint() later in virtual mode
Russell Currey <[email protected]>
powerpc/eeh: Avoid use after free in eeh_handle_special_event()
David Gibson <[email protected]>
powerpc/mm: Ensure IRQs are off in switch_mm()
Johan Hovold <[email protected]>
cx231xx-cards: fix NULL-deref at probe
Johan Hovold <[email protected]>
cx231xx-audio: fix NULL-deref at probe
Johan Hovold <[email protected]>
cx231xx-audio: fix init error path
Alyssa Milburn <[email protected]>
dw2102: limit messages to buffer size
Alyssa Milburn <[email protected]>
digitv: limit messages to buffer size
Daniel Scheller <[email protected]>
dvb-frontends/cxd2841er: define symbol_rate_min/max in T/C fe-ops
Alyssa Milburn <[email protected]>
zr364xx: enforce minimum size when reading header
Johan Hovold <[email protected]>
dib0700: fix NULL-deref at probe
Marek Szyprowski <[email protected]>
s5p-mfc: Fix unbalanced call to clock management
Johan Hovold <[email protected]>
gspca: konica: add missing endpoint sanity check
Marek Szyprowski <[email protected]>
s5p-mfc: Fix race between interrupt routine and device functions
Srinivas Pandruvada <[email protected]>
iio: hid-sensor: Store restore poll and hysteresis on S3
Matt Ranostay <[email protected]>
iio: proximity: as3935: fix as3935_write
Dan Carpenter <[email protected]>
ipx: call ipxitf_put() in ioctl error path
Johan Hovold <[email protected]>
USB: hub: fix non-SS hub-descriptor handling
Johan Hovold <[email protected]>
USB: hub: fix SS hub-descriptor handling
Johan Hovold <[email protected]>
USB: serial: io_ti: fix div-by-zero in set_termios
Johan Hovold <[email protected]>
USB: serial: mct_u232: fix big-endian baud-rate handling
Bjørn Mork <[email protected]>
USB: serial: qcserial: add more Lenovo EM74xx device IDs
Daniele Palmas <[email protected]>
usb: serial: option: add Telit ME910 support
Johan Hovold <[email protected]>
USB: iowarrior: fix info ioctl on big-endian hosts
Tony Lindgren <[email protected]>
usb: musb: Fix trying to suspend while active for OTG configurations
Peter Ujfalusi <[email protected]>
usb: musb: tusb6010_omap: Do not reset the other direction's packet size
Thinh Nguyen <[email protected]>
usb: dwc3: gadget: Prevent losing events in event cache
Ben Hutchings <[email protected]>
dvb-usb-dibusb-mc-common: Add MODULE_LICENSE
Alyssa Milburn <[email protected]>
ttusb2: limit messages to buffer size
Johan Hovold <[email protected]>
mceusb: fix NULL-deref at probe
Johan Hovold <[email protected]>
usbvision: fix NULL-deref at probe
Johan Hovold <[email protected]>
net: irda: irda-usb: fix firmware name on big-endian hosts
Peter Chen <[email protected]>
usb: host: xhci-mem: allocate zeroed Scratchpad Buffer
Mathias Nyman <[email protected]>
xhci: apply PME_STUCK_QUIRK and MISSING_CAS quirk for Denverton
Thomas Petazzoni <[email protected]>
usb: host: xhci-plat: propagate return value of platform_get_irq()
Matthias Lange <[email protected]>
xhci: remove GFP_DMA flag from allocation
Toshi Kani <[email protected]>
libnvdimm: fix clear length of nvdimm_forget_poison()
Eric Biggers <[email protected]>
fscrypt: avoid collisions when presenting long encrypted filenames
Jaegeuk Kim <[email protected]>
f2fs: check entire encrypted bigname when finding a dentry
Johan Hovold <[email protected]>
USB: chaoskey: fix Alea quirk on big-endian hosts
Andrey Korolyov <[email protected]>
USB: serial: ftdi_sio: add Olimex ARM-USB-TINY(H) PIDs
Anthony Mallet <[email protected]>
USB: serial: ftdi_sio: fix setting latency for unprivileged users
Kirill Tkhai <[email protected]>
pid_ns: Fix race between setns'ed fork() and zap_pid_ns_processes()
Eric W. Biederman <[email protected]>
pid_ns: Sleep in TASK_INTERRUPTIBLE in zap_pid_ns_processes
Michael J. Ruhl <[email protected]>
IB/hfi1: Fix a subcontext memory leak
Michael J. Ruhl <[email protected]>
IB/hfi1: Return an error on memory allocation failure
Andreas Klinger <[email protected]>
IIO: bmp280-core.c: fix error in humidity calculation
Pavel Roskin <[email protected]>
iio: dac: ad7303: fix channel description
Bryant G. Ly <[email protected]>
ibmvscsis: Do not send aborted task response
Johan Hovold <[email protected]>
of: fdt: add missing allocation-failure check
Tyrel Datwyler <[email protected]>
of: fix "/cpus" reference leak in of_numa_parse_cpu_nodes()
Rob Herring <[email protected]>
of: fix sparse warning in of_pci_range_parser_one
Takashi Iwai <[email protected]>
proc: Fix unbalanced hard link numbers
Vaibhav Jain <[email protected]>
cxl: Route eeh events to all drivers in cxl_pci_error_detected()
Vaibhav Jain <[email protected]>
cxl: Force context lock during EEH flow
Gerd Hoffmann <[email protected]>
ohci-pci: add qemu quirk
Tobias Herzog <[email protected]>
cdc-acm: fix possible invalid access when processing notification
David Rivshin <[email protected]>
gpio: omap: return error if requested debounce time is not possible
Ben Skeggs <[email protected]>
drm/nouveau/tmr: handle races with hw when updating the next alarm time
Ben Skeggs <[email protected]>
drm/nouveau/tmr: avoid processing completed alarms when adding a new one
Ben Skeggs <[email protected]>
drm/nouveau/tmr: fix corruption of the pending list when rescheduling an alarm
Ben Skeggs <[email protected]>
drm/nouveau/tmr: ack interrupt before processing alarms
Ben Skeggs <[email protected]>
drm/nouveau/therm: remove ineffective workarounds for alarm bugs
Mario Kleiner <[email protected]>
drm/amdgpu: Add missing lb_vblank_lead_lines setup to DCE-6 path.
Mario Kleiner <[email protected]>
drm/amdgpu: Avoid overflows/divide-by-zero in latency_watermark calculations.
Mario Kleiner <[email protected]>
drm/amdgpu: Make display watermark calculations more accurate
Johan Hovold <[email protected]>
ath9k_htc: fix NULL-deref at probe
Dmitry Tunin <[email protected]>
ath9k_htc: Add support of AirTies 1eda:2315 AR9271 device
Martin Schwidefsky <[email protected]>
s390/cputime: fix incorrect system time
Michael Holzheu <[email protected]>
s390/kdump: Add final note
Richard Cochran <[email protected]>
regulator: tps65023: Fix inverted core enable logic.
Wadim Egorov <[email protected]>
regulator: rk808: Fix RK818 LDO2
Linus Torvalds <[email protected]>
x86: fix 32-bit case of __get_user_asm_u64()
Wanpeng Li <[email protected]>
KVM: X86: Fix read out-of-bounds vulnerability in kvm pio emulation
Wanpeng Li <[email protected]>
KVM: x86: Fix potential preemption when get the current kvmclock timestamp
Wanpeng Li <[email protected]>
KVM: x86: Fix load damaged SSEx MXCSR register
Daniel Glöckner <[email protected]>
ima: accept previously set IMA_NEW_FILE
Brian Norris <[email protected]>
mwifiex: pcie: fix cmd_buf use-after-free in remove/reset
Brian Norris <[email protected]>
mwifiex: MAC randomization should not be persistent
Larry Finger <[email protected]>
rtlwifi: rtl8821ae: setup 8812ae RFE according to device type
NeilBrown <[email protected]>
md: MD_CLOSING needs to be cleared after called md_set_readonly or do_md_stop
Dennis Yang <[email protected]>
md: update slab_cache before releasing new stripes when stripes resizing
Joe Thornber <[email protected]>
dm space map disk: fix some book keeping in the disk space map
Joe Thornber <[email protected]>
dm thin metadata: call precommit before saving the roots
Mikulas Patocka <[email protected]>
dm bufio: make the parameter "retain_bytes" unsigned long
Mike Snitzer <[email protected]>
dm cache metadata: fail operations if fail_io mode has been established
Bart Van Assche <[email protected]>
dm mpath: split and rename activate_path() to prepare for its expanded use
Mikulas Patocka <[email protected]>
dm bufio: check new buffer allocation watermark every 30 seconds
Mikulas Patocka <[email protected]>
dm bufio: avoid a possible ABBA deadlock
Mikulas Patocka <[email protected]>
dm raid: select the Kconfig option CONFIG_MD_RAID0
Vinothkumar Raja <[email protected]>
dm btree: fix for dm_btree_find_lowest_key()
Paolo Abeni <[email protected]>
infiniband: call ipv6 route lookup via the stub interface
Sagi Grimberg <[email protected]>
mlx5: Fix mlx5_ib_map_mr_sg mr length
Alexander Sverdlin <[email protected]>
ASoC: cs4271: configure reset GPIO as output
Jerry Snitselaar <[email protected]>
tpm_crb: check for bad response size
Nayna Jain <[email protected]>
tpm: add sleep only for retry in i2c_nuvoton_write_status()
Nayna Jain <[email protected]>
tpm: msleep() delays - replace with usleep_range() in i2c nuvoton driver
Peter Huewe <[email protected]>
tpm_tis_spi: Add small delay after last transfer
Peter Huewe <[email protected]>
tpm_tis_spi: Remove limitation of transfers to MAX_SPI_FRAMESIZE bytes
Peter Huewe <[email protected]>
tpm_tis_spi: Check correct byte for wait state indicator
Peter Huewe <[email protected]>
tpm_tis_spi: Abort transfer when too many wait states are signaled
Peter Huewe <[email protected]>
tpm_tis_spi: Use single function to transfer data
Amir Goldstein <[email protected]>
fanotify: don't expose EOPENSTALE to userspace
Marc Dietrich <[email protected]>
ARM: tegra: paz00: Mark panel regulator as enabled on boot
Jeeja KP <[email protected]>
ALSA: hda: Fix cpu lockup when stopping the cmd dmas
Alexander Steffen <[email protected]>
tpm_tis_core: Choose appropriate timeout for reading burstcount
Vamsi Krishna Samavedam <[email protected]>
USB: core: replace %p with %pK
Willy Tarreau <[email protected]>
char: lp: fix possible integer overflow in lp_setup()
Johan Hovold <[email protected]>
watchdog: pcwd_usb: fix NULL-deref at probe
Alan Stern <[email protected]>
USB: ene_usb6250: fix DMA to the stack
Maksim Salau <[email protected]>
usb: misc: legousbtower: Fix memory leak
Maksim Salau <[email protected]>
usb: misc: legousbtower: Fix buffers on stack
-------------
Diffstat:
Documentation/arm64/tagged-pointers.txt | 62 ++++++-- Makefile | 4 +- arch/alpha/kernel/osf_sys.c | 6 +- arch/arm/boot/dts/at91-sama5d3_xplained.dts | 5 +- arch/arm/boot/dts/imx6sx-sdb.dts | 17 --- arch/arm/boot/dts/tegra20-paz00.dts | 1 + arch/arm/include/asm/kvm_coproc.h | 3 +- arch/arm/include/asm/module.h | 9 +- arch/arm/kernel/module-plts.c | 87 +++++++---- arch/arm/kernel/module.lds | 1 + arch/arm/kvm/coproc.c | 77 +++++++--- arch/arm/kvm/handle_exit.c | 4 +- arch/arm/kvm/hyp/Makefile | 2 + arch/arm/kvm/hyp/switch.c | 4 +- arch/arm/mm/proc-v7m.S | 4 +- arch/arm64/boot/dts/hisilicon/hi6220.dtsi | 3 + arch/arm64/include/asm/barrier.h | 20 ++- arch/arm64/include/asm/cmpxchg.h | 2 +- arch/arm64/include/asm/uaccess.h | 3 +- arch/arm64/kernel/armv8_deprecated.c | 3 +- arch/arm64/kvm/hyp/Makefile | 2 + arch/metag/include/asm/uaccess.h | 49 ++++--- arch/mips/Kconfig | 1 + arch/powerpc/include/asm/mmu_context.h | 17 ++- arch/powerpc/kernel/eeh_driver.c | 19 ++- arch/powerpc/kernel/exceptions-64e.S | 12 ++ arch/powerpc/kernel/mce.c | 2 + arch/powerpc/kernel/process.c | 19 +++ arch/powerpc/kernel/traps.c | 4 +- arch/powerpc/mm/mmu_context_iommu.c | 4 +- arch/powerpc/platforms/pseries/dlpar.c | 1 - arch/s390/kernel/crash_dump.c | 15 ++ arch/s390/kernel/entry.S | 21 ++- arch/um/kernel/initrd.c | 4 +- arch/um/kernel/um_arch.c | 6 + arch/x86/include/asm/uaccess.h | 6 +- arch/x86/kernel/fpu/init.c | 1 + arch/x86/kvm/x86.c | 43 ++++-- drivers/char/lp.c | 6 +- drivers/char/mem.c | 5 + drivers/char/tpm/tpm_crb.c | 3 +- drivers/char/tpm/tpm_i2c_nuvoton.c | 24 ++-- drivers/char/tpm/tpm_tis_core.c | 6 +- drivers/char/tpm/tpm_tis_spi.c | 160 +++++++++------------ drivers/gpio/gpio-omap.c | 23 ++- drivers/gpu/drm/amd/amdgpu/dce_v10_0.c | 29 ++-- drivers/gpu/drm/amd/amdgpu/dce_v11_0.c | 29 ++-- drivers/gpu/drm/amd/amdgpu/dce_v6_0.c | 36 ++--- drivers/gpu/drm/amd/amdgpu/dce_v8_0.c | 29 ++-- drivers/gpu/drm/drm_edid.c | 8 ++ drivers/gpu/drm/i915/i915_gem_stolen.c | 5 + drivers/gpu/drm/nouveau/nvkm/subdev/therm/base.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/therm/fan.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/therm/fantog.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/therm/temp.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c | 59 +++++--- drivers/gpu/drm/nouveau/nvkm/subdev/timer/nv04.c | 2 +- .../iio/common/hid-sensors/hid-sensor-attributes.c | 26 +++- .../iio/common/hid-sensors/hid-sensor-trigger.c | 20 ++- drivers/iio/dac/ad7303.c | 6 +- drivers/iio/pressure/bmp280-core.c | 11 +- drivers/iio/proximity/as3935.c | 3 +- drivers/infiniband/core/addr.c | 4 +- drivers/infiniband/hw/hfi1/file_ops.c | 5 +- drivers/infiniband/hw/hfi1/init.c | 1 + drivers/infiniband/hw/hfi1/user_exp_rcv.c | 32 +++-- drivers/infiniband/hw/hfi1/user_exp_rcv.h | 1 + drivers/infiniband/hw/mlx5/mr.c | 2 +- drivers/iommu/intel-iommu.c | 5 +- drivers/md/Kconfig | 1 + drivers/md/dm-bufio.c | 35 +++-- drivers/md/dm-cache-metadata.c | 12 +- drivers/md/dm-mpath.c | 17 ++- drivers/md/dm-thin-metadata.c | 4 +- drivers/md/md.c | 5 + drivers/md/persistent-data/dm-btree.c | 8 +- drivers/md/persistent-data/dm-space-map-disk.c | 15 +- drivers/md/raid5.c | 6 +- drivers/media/dvb-frontends/cxd2841er.c | 4 +- drivers/media/platform/s5p-mfc/s5p_mfc.c | 13 +- drivers/media/rc/mceusb.c | 4 +- drivers/media/usb/cx231xx/cx231xx-audio.c | 42 ++++-- drivers/media/usb/cx231xx/cx231xx-cards.c | 45 +++++- drivers/media/usb/dvb-usb/dib0700_core.c | 3 + drivers/media/usb/dvb-usb/dibusb-mc-common.c | 2 + drivers/media/usb/dvb-usb/digitv.c | 3 + drivers/media/usb/dvb-usb/dw2102.c | 54 +++++++ drivers/media/usb/dvb-usb/ttusb2.c | 19 +++ drivers/media/usb/gspca/konica.c | 3 + drivers/media/usb/usbvision/usbvision-video.c | 9 +- drivers/media/usb/zr364xx/zr364xx.c | 8 ++ drivers/misc/cxl/pci.c | 34 +++-- drivers/mtd/nand/nand_base.c | 70 ++++++++- drivers/mtd/nand/omap2.c | 9 ++ drivers/mtd/nand/orion_nand.c | 42 +++--- drivers/net/irda/irda-usb.c | 2 +- drivers/net/wireless/ath/ath9k/hif_usb.c | 4 + drivers/net/wireless/marvell/mwifiex/cfg80211.c | 4 +- drivers/net/wireless/marvell/mwifiex/pcie.c | 7 + .../net/wireless/realtek/rtlwifi/rtl8821ae/phy.c | 122 +++++++++++++--- .../net/wireless/realtek/rtlwifi/rtl8821ae/reg.h | 1 + drivers/nvdimm/bus.c | 5 +- drivers/nvme/host/pci.c | 7 +- drivers/of/address.c | 2 +- drivers/of/fdt.c | 3 + drivers/of/of_numa.c | 2 + drivers/pci/host/pci-hyperv.c | 13 +- drivers/pci/pci-sysfs.c | 10 +- drivers/pci/pci.c | 9 +- drivers/pci/proc.c | 21 ++- drivers/regulator/rk808-regulator.c | 2 +- drivers/regulator/tps65023-regulator.c | 3 +- drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c | 114 +++++++++++---- drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.h | 2 + drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c | 24 ++-- drivers/staging/rtl8192e/rtl819x_TSProc.c | 15 +- drivers/usb/class/cdc-acm.c | 13 +- drivers/usb/core/devio.c | 14 +- drivers/usb/core/hcd.c | 4 +- drivers/usb/core/hub.c | 19 ++- drivers/usb/core/urb.c | 2 +- drivers/usb/dwc3/gadget.c | 9 ++ drivers/usb/host/ohci-hcd.c | 3 +- drivers/usb/host/ohci-pci.c | 16 +++ drivers/usb/host/ohci.h | 1 + drivers/usb/host/xhci-mem.c | 4 +- drivers/usb/host/xhci-pci.c | 7 +- drivers/usb/host/xhci-plat.c | 2 +- drivers/usb/misc/chaoskey.c | 2 +- drivers/usb/misc/iowarrior.c | 2 +- drivers/usb/misc/legousbtower.c | 38 +++-- drivers/usb/musb/musb_host.c | 9 +- drivers/usb/musb/tusb6010_omap.c | 13 +- drivers/usb/serial/ftdi_sio.c | 10 +- drivers/usb/serial/ftdi_sio_ids.h | 2 + drivers/usb/serial/io_ti.c | 5 +- drivers/usb/serial/mct_u232.c | 2 +- drivers/usb/serial/option.c | 8 ++ drivers/usb/serial/qcserial.c | 2 + drivers/usb/storage/ene_ub6250.c | 90 +++++++----- drivers/uwb/i1480/dfu/usb.c | 5 +- drivers/watchdog/pcwd_usb.c | 3 + fs/crypto/fname.c | 2 +- fs/ext4/namei.c | 4 +- fs/f2fs/dir.c | 37 ++--- fs/f2fs/f2fs.h | 3 +- fs/f2fs/hash.c | 7 +- fs/f2fs/inline.c | 4 +- fs/nfs/nfs4proc.c | 4 +- fs/nfs/pagelist.c | 15 +- fs/nfs/write.c | 2 +- fs/nfsd/nfs4proc.c | 3 +- fs/nfsd/nfs4xdr.c | 8 +- fs/notify/fanotify/fanotify_user.c | 26 ++-- fs/proc/generic.c | 1 + include/linux/hid-sensor-hub.h | 2 + include/linux/kprobes.h | 4 +- kernel/fork.c | 10 +- kernel/irq/chip.c | 2 +- kernel/kprobes.c | 2 +- kernel/pid_namespace.c | 2 +- kernel/trace/trace_kprobe.c | 5 + net/ipx/af_ipx.c | 5 +- security/integrity/ima/ima_appraise.c | 5 +- sound/hda/hdac_controller.c | 4 + sound/soc/codecs/cs4271.c | 2 +- virt/kvm/arm/vgic/vgic-v2.c | 7 + virt/kvm/arm/vgic/vgic-v3.c | 7 + 168 files changed, 1665 insertions(+), 723 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/164 usb: misc: legousbtower: Fix buffers on stack
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maksim Salau <[email protected]>
commit 942a48730faf149ccbf3e12ac718aee120bb3529 upstream.
Allocate buffers on HEAP instead of STACK for local structures that are to be received using usb_control_msg().
--- drivers/usb/misc/legousbtower.c | 37 +++++++++++++++++++++++++++---------- 1 file changed, 27 insertions(+), 10 deletions(-)
drivers/usb/misc/legousbtower.c +27 -10
@@ -317,9 +317,16 @@ static int tower_open (struct inode *inoint subminor;int retval =0 ;struct usb_interface *interface; -struct tower_reset_reply reset_reply; +struct tower_reset_reply *reset_reply;int result; + reset_reply =kmalloc (sizeof (*reset_reply),GFP_KERNEL ); + +if (!reset_reply) { + retval = -ENOMEM ; + goto exit; + } +nonseekable_open (inode, file); subminor =iminor (inode);
@@ -364,8 +371,8 @@ static int tower_open (struct inode *inoUSB_TYPE_VENDOR |USB_DIR_IN |USB_RECIP_DEVICE ,0 ,0 , - &reset_reply, -sizeof (reset_reply), + reset_reply, +sizeof (*reset_reply), 1000);if (result <0 ) { dev_err(&dev->udev->dev,
@@ -406,6 +413,7 @@ unlock_exit:mutex_unlock (&dev->lock); exit: +kfree (reset_reply);return retval; }
@@ -808,7 +816,7 @@ static int tower_probe (struct usb_interstruct lego_usb_tower *dev =NULL ;struct usb_host_interface *iface_desc;struct usb_endpoint_descriptor * endpoint; -struct tower_get_version_reply get_version_reply; +struct tower_get_version_reply *get_version_reply =NULL ;int i;int retval = -ENOMEM ;int result;
@@ -886,6 +894,13 @@ static int tower_probe (struct usb_inter dev->interrupt_in_interval = interrupt_in_interval ? interrupt_in_interval : dev->interrupt_in_endpoint->bInterval; dev->interrupt_out_interval = interrupt_out_interval ? interrupt_out_interval : dev->interrupt_out_endpoint->bInterval; + get_version_reply =kmalloc (sizeof (*get_version_reply),GFP_KERNEL ); + +if (!get_version_reply) { + retval = -ENOMEM ; + goto error; + } +/* get the firmware version and log it */ result = usb_control_msg (udev, usb_rcvctrlpipe(udev, 0),
@@ -893,18 +908,19 @@ static int tower_probe (struct usb_interUSB_TYPE_VENDOR |USB_DIR_IN |USB_RECIP_DEVICE ,0 ,0 , - &get_version_reply, -sizeof (get_version_reply), + get_version_reply, +sizeof (*get_version_reply), 1000);if (result <0 ) {dev_err (idev,"LEGO USB Tower get version control request failed\n" ); retval = result; goto error; } -dev_info (&interface->dev,"LEGO USB Tower firmware version is %d.%d " -"build %d\n" , get_version_reply.major, - get_version_reply.minor, -le16_to_cpu (get_version_reply.build_no)); +dev_info (&interface->dev, +"LEGO USB Tower firmware version is %d.%d build %d\n" , + get_version_reply->major, + get_version_reply->minor, +le16_to_cpu (get_version_reply->build_no));/* we can register the device now, as it is ready */ usb_set_intfdata (interface, dev);
@@ -928,6 +944,7 @@ exit:return retval; error: +kfree (get_version_reply);tower_delete (dev);return retval; }
Greg Kroah-Hartman
maintainerPATCH 2/164 usb: misc: legousbtower: Fix memory leak
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maksim Salau <[email protected]>
commit 0bd193d62b4270a2a7a09da43ad1034c7ca5b3d3 upstream.
get_version_reply is not freed if function returns with success.
--- drivers/usb/misc/legousbtower.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/misc/legousbtower.c +1 -0
@@ -941,6 +941,7 @@ static int tower_probe (struct usb_inter USB_MAJOR, dev->minor); exit: +kfree (get_version_reply);return retval; error:
Greg Kroah-Hartman
maintainerPATCH 3/164 USB: ene_usb6250: fix DMA to the stack
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <[email protected]>
commit 628c2893d44876ddd11602400c70606ade62e129 upstream.
The ene_usb6250 sub-driver in usb-storage does USB I/O to buffers on the stack, which doesn't work with vmapped stacks. This patch fixes the problem by allocating a separate 512-byte buffer at probe time and using it for all of the offending I/O operations.
--- drivers/usb/storage/ene_ub6250.c | 90 +++++++++++++++++++++++---------------- 1 file changed, 55 insertions(+), 35 deletions(-)
drivers/usb/storage/ene_ub6250.c +55 -35
@@ -446,6 +446,10 @@ struct ms_lib_ctrl {#define SD_BLOCK_LEN 9struct ene_ub6250_info { + +/* I/O bounce buffer */ +u8 *bbuf; +/* for 6250 code */ struct SD_STATUS SD_Status;struct MS_STATUS MS_Status;
@@ -493,8 +497,11 @@ static int ene_load_bincode(struct us_dastatic void ene_ub6250_info_destructor (void *extra) { +struct ene_ub6250_info *info = (struct ene_ub6250_info *) extra; +if (!extra)return ; +kfree (info->bbuf); }static int ene_send_scsi_cmd (struct us_data *us,u8 fDir,void *buf,int use_sg)
@@ -860,8 +867,9 @@ static int ms_read_readpage(struct us_da u8 PageNum, u32 *PageBuf, struct ms_lib_type_extdat *ExtraDat) { struct bulk_cb_wrap *bcb = (struct bulk_cb_wrap *) us->iobuf; +struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra; +u8 *bbuf = info->bbuf;int result; -u8 ExtBuf[4 ];u32 bn = PhyBlockAddr *0x20 + PageNum; result =ene_load_bincode (us,MS_RW_PATTERN );
@@ -901,7 +909,7 @@ static int ms_read_readpage(struct us_da bcb->CDB[2 ] = (unsigned char )(PhyBlockAddr>>16 ); bcb->CDB[6 ] =0x01 ; - result =ene_send_scsi_cmd (us,FDIR_READ , &ExtBuf,0 ); + result =ene_send_scsi_cmd (us,FDIR_READ , bbuf,0 );if (result !=USB_STOR_XFER_GOOD )return USB_STOR_TRANSPORT_ERROR ;
@@ -910,9 +918,9 @@ static int ms_read_readpage(struct us_da ExtraDat->status0 =0x10 ;/* Not yet,fireware support */ ExtraDat->status1 =0x00 ;/* Not yet,fireware support */ - ExtraDat->ovrflg = ExtBuf[0 ]; - ExtraDat->mngflg = ExtBuf[1 ]; - ExtraDat->logadr =memstick_logaddr (ExtBuf[2 ], ExtBuf[3 ]); + ExtraDat->ovrflg = bbuf[0 ]; + ExtraDat->mngflg = bbuf[1 ]; + ExtraDat->logadr =memstick_logaddr (bbuf[2 ], bbuf[3 ]);return USB_STOR_TRANSPORT_GOOD ; }
@@ -1332,8 +1340,9 @@ static int ms_lib_read_extra(struct us_d u8 PageNum, struct ms_lib_type_extdat *ExtraDat) { struct bulk_cb_wrap *bcb = (struct bulk_cb_wrap *) us->iobuf; +struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra; +u8 *bbuf = info->bbuf;int result; -u8 ExtBuf[4 ];memset (bcb,0 ,sizeof (struct bulk_cb_wrap )); bcb->Signature =cpu_to_le32 (US_BULK_CB_SIGN );
@@ -1347,7 +1356,7 @@ static int ms_lib_read_extra(struct us_d bcb->CDB[2 ] = (unsigned char )(PhyBlock>>16 ); bcb->CDB[6 ] =0x01 ; - result =ene_send_scsi_cmd (us,FDIR_READ , &ExtBuf,0 ); + result =ene_send_scsi_cmd (us,FDIR_READ , bbuf,0 );if (result !=USB_STOR_XFER_GOOD )return USB_STOR_TRANSPORT_ERROR ;
@@ -1355,9 +1364,9 @@ static int ms_lib_read_extra(struct us_d ExtraDat->intr =0x80 ;/* Not yet, waiting for fireware support */ ExtraDat->status0 =0x10 ;/* Not yet, waiting for fireware support */ ExtraDat->status1 =0x00 ;/* Not yet, waiting for fireware support */ - ExtraDat->ovrflg = ExtBuf[0 ]; - ExtraDat->mngflg = ExtBuf[1 ]; - ExtraDat->logadr =memstick_logaddr (ExtBuf[2 ], ExtBuf[3 ]); + ExtraDat->ovrflg = bbuf[0 ]; + ExtraDat->mngflg = bbuf[1 ]; + ExtraDat->logadr =memstick_logaddr (bbuf[2 ], bbuf[3 ]);return USB_STOR_TRANSPORT_GOOD ; }
@@ -1558,9 +1567,9 @@ static int ms_lib_scan_logicalblocknumbeu16 PhyBlock, newblk, i;u16 LogStart, LogEnde;struct ms_lib_type_extdat extdat; -u8 buf[0x200 ];u32 count =0 , index =0 ;struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra; +u8 *bbuf = info->bbuf;for (PhyBlock =0 ; PhyBlock < info->MS_Lib.NumberOfPhyBlock;) {ms_lib_phy_to_log_range (PhyBlock, &LogStart, &LogEnde);
@@ -1574,14 +1583,16 @@ static int ms_lib_scan_logicalblocknumbe }if (count == PhyBlock) { -ms_lib_read_extrablock (us, PhyBlock,0 ,0x80 , &buf); +ms_lib_read_extrablock (us, PhyBlock,0 ,0x80 , + bbuf); count +=0x80 ; } index = (PhyBlock %0x80 ) *4 ; - extdat.ovrflg = buf[index]; - extdat.mngflg = buf[index+1 ]; - extdat.logadr =memstick_logaddr (buf[index+2 ], buf[index+3 ]); + extdat.ovrflg = bbuf[index]; + extdat.mngflg = bbuf[index+1 ]; + extdat.logadr =memstick_logaddr (bbuf[index+2 ], + bbuf[index+3 ]);if ((extdat.ovrflg &MS_REG_OVR_BKST ) !=MS_REG_OVR_BKST_OK ) {ms_lib_setacquired_errorblock (us, PhyBlock);
@@ -2064,9 +2075,9 @@ static int ene_ms_init(struct us_data *u {struct bulk_cb_wrap *bcb = (struct bulk_cb_wrap *) us->iobuf;int result; -u8 buf[0x200 ];u16 MSP_BlockSize, MSP_UserAreaBlocks;struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra; +u8 *bbuf = info->bbuf;printk (KERN_INFO "transport --- ENE_MSInit\n" );
@@ -2085,13 +2096,13 @@ static int ene_ms_init(struct us_data *u bcb->CDB[0 ] =0xF1 ; bcb->CDB[1 ] =0x01 ; - result =ene_send_scsi_cmd (us,FDIR_READ , &buf,0 ); + result =ene_send_scsi_cmd (us,FDIR_READ , bbuf,0 );if (result !=USB_STOR_XFER_GOOD ) {printk (KERN_ERR "Execution MS Init Code Fail !!\n" );return USB_STOR_TRANSPORT_ERROR ; }/* the same part to test ENE */ - info->MS_Status = *(struct MS_STATUS *)&buf[0 ]; + info->MS_Status = *(struct MS_STATUS *) bbuf;if (info->MS_Status.Insert && info->MS_Status.Ready) {printk (KERN_INFO "Insert = %x\n" , info->MS_Status.Insert);
@@ -2100,15 +2111,15 @@ static int ene_ms_init(struct us_data *uprintk (KERN_INFO "IsMSPHG = %x\n" , info->MS_Status.IsMSPHG);printk (KERN_INFO "WtP= %x\n" , info->MS_Status.WtP);if (info->MS_Status.IsMSPro) { - MSP_BlockSize = (buf[6 ] <<8 ) | buf[7 ]; - MSP_UserAreaBlocks = (buf[10 ] <<8 ) | buf[11 ]; + MSP_BlockSize = (bbuf[6 ] <<8 ) | bbuf[7 ]; + MSP_UserAreaBlocks = (bbuf[10 ] <<8 ) | bbuf[11 ]; info->MSP_TotalBlock = MSP_BlockSize * MSP_UserAreaBlocks; }else {ms_card_init (us);/* Card is MS (to ms.c)*/ }usb_stor_dbg (us,"MS Init Code OK !!\n" ); }else { -usb_stor_dbg (us,"MS Card Not Ready --- %x\n" , buf[0 ]); +usb_stor_dbg (us,"MS Card Not Ready --- %x\n" , bbuf[0 ]);return USB_STOR_TRANSPORT_ERROR ; }
@@ -2118,9 +2129,9 @@ static int ene_ms_init(struct us_data *ustatic int ene_sd_init (struct us_data *us) {int result; -u8 buf[0x200 ];struct bulk_cb_wrap *bcb = (struct bulk_cb_wrap *) us->iobuf;struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra; +u8 *bbuf = info->bbuf;usb_stor_dbg (us,"transport --- ENE_SDInit\n" );/* SD Init Part-1 */
@@ -2154,17 +2165,17 @@ static int ene_sd_init(struct us_data *u bcb->Flags =US_BULK_FLAG_IN ; bcb->CDB[0 ] =0xF1 ; - result =ene_send_scsi_cmd (us,FDIR_READ , &buf,0 ); + result =ene_send_scsi_cmd (us,FDIR_READ , bbuf,0 );if (result !=USB_STOR_XFER_GOOD ) {usb_stor_dbg (us,"Execution SD Init Code Fail !!\n" );return USB_STOR_TRANSPORT_ERROR ; } - info->SD_Status = *(struct SD_STATUS *)&buf[0 ]; + info->SD_Status = *(struct SD_STATUS *) bbuf;if (info->SD_Status.Insert && info->SD_Status.Ready) {struct SD_STATUS *s = &info->SD_Status; -ene_get_card_status (us, (unsigned char *)&buf); +ene_get_card_status (us, bbuf);usb_stor_dbg (us,"Insert = %x\n" , s->Insert);usb_stor_dbg (us,"Ready = %x\n" , s->Ready);usb_stor_dbg (us,"IsMMC = %x\n" , s->IsMMC);
@@ -2172,7 +2183,7 @@ static int ene_sd_init(struct us_data *uusb_stor_dbg (us,"HiSpeed = %x\n" , s->HiSpeed);usb_stor_dbg (us,"WtP = %x\n" , s->WtP); }else { -usb_stor_dbg (us,"SD Card Not Ready --- %x\n" , buf[0 ]); +usb_stor_dbg (us,"SD Card Not Ready --- %x\n" , bbuf[0 ]);return USB_STOR_TRANSPORT_ERROR ; }return USB_STOR_TRANSPORT_GOOD ;
@@ -2182,13 +2193,15 @@ static int ene_sd_init(struct us_data *ustatic int ene_init (struct us_data *us) {int result; -u8 misc_reg03 =0 ; +u8 misc_reg03;struct ene_ub6250_info *info = (struct ene_ub6250_info *)(us->extra); +u8 *bbuf = info->bbuf; - result =ene_get_card_type (us,REG_CARD_STATUS , &misc_reg03); + result =ene_get_card_type (us,REG_CARD_STATUS , bbuf);if (result !=USB_STOR_XFER_GOOD )return USB_STOR_TRANSPORT_ERROR ; + misc_reg03 = bbuf[0 ];if (misc_reg03 &0x01 ) {if (!info->SD_Status.Ready) { result =ene_sd_init (us);
@@ -2305,8 +2318,9 @@ static int ene_ub6250_probe(struct usb_i const struct usb_device_id *id) {int result; -u8 misc_reg03 =0 ; +u8 misc_reg03;struct us_data *us; +struct ene_ub6250_info *info; result = usb_stor_probe1(&us, intf, id, (id - ene_ub6250_usb_ids) + ene_ub6250_unusual_dev_list,
@@ -2315,11 +2329,16 @@ static int ene_ub6250_probe(struct usb_ireturn result;/* FIXME: where should the code alloc extra buf ? */ -if (!us->extra) { - us->extra =kzalloc (sizeof (struct ene_ub6250_info ),GFP_KERNEL ); -if (!us->extra) -return -ENOMEM ; - us->extra_destructor = ene_ub6250_info_destructor; + us->extra =kzalloc (sizeof (struct ene_ub6250_info ),GFP_KERNEL ); +if (!us->extra) +return -ENOMEM ; + us->extra_destructor = ene_ub6250_info_destructor; + + info = (struct ene_ub6250_info *)(us->extra); + info->bbuf =kmalloc (512 ,GFP_KERNEL ); +if (!info->bbuf) { +kfree (us->extra); +return -ENOMEM ; } us->transport_name ="ene_ub6250" ;
@@ -2331,12 +2350,13 @@ static int ene_ub6250_probe(struct usb_ireturn result;/* probe card type */ - result =ene_get_card_type (us,REG_CARD_STATUS , &misc_reg03); + result =ene_get_card_type (us,REG_CARD_STATUS , info->bbuf);if (result !=USB_STOR_XFER_GOOD ) {usb_stor_disconnect (intf);return USB_STOR_TRANSPORT_ERROR ; } + misc_reg03 = info->bbuf[0 ];if (!(misc_reg03 &0x01 )) {pr_info ("ums_eneub6250: This driver only supports SD/MS cards. " "It does not support SM cards.\n" );
Greg Kroah-Hartman
maintainerPATCH 4/164 watchdog: pcwd_usb: fix NULL-deref at probe
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 46c319b848268dab3f0e7c4a5b6e9146d3bca8a4 upstream.
Make sure to check the number of endpoints to avoid dereferencing a NULL-pointer should a malicious device lack endpoints.
--- drivers/watchdog/pcwd_usb.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/watchdog/pcwd_usb.c +3 -0
@@ -630,6 +630,9 @@ static int usb_pcwd_probe(struct usb_intreturn -ENODEV ; } +if (iface_desc->desc.bNumEndpoints <1 ) +return -ENODEV ; +/* check out the endpoint: it has to be Interrupt & IN */ endpoint = &iface_desc->endpoint[0 ].desc;
Greg Kroah-Hartman
maintainerPATCH 5/164 char: lp: fix possible integer overflow in lp_setup()
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Willy Tarreau <[email protected]>
commit 3e21f4af170bebf47c187c1ff8bf155583c9f3b1 upstream.
The lp_setup() code doesn't apply any bounds checking when passing "lp=none", and only in this case, resulting in an overflow of the parport_nr[] array. All versions in Git history are affected.
--- drivers/char/lp.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/char/lp.c +5 -1
@@ -859,7 +859,11 @@ static int __init lp_setup (char *str) }else if (!strcmp (str,"auto" )) { parport_nr[0 ] =LP_PARPORT_AUTO ; }else if (!strcmp (str,"none" )) { - parport_nr[parport_ptr++] =LP_PARPORT_NONE ; +if (parport_ptr <LP_NO ) + parport_nr[parport_ptr++] =LP_PARPORT_NONE ; +else +printk (KERN_INFO "lp: too many ports, %s ignored.\n" , + str); }else if (!strcmp (str,"reset" )) { reset =1 ; }
Greg Kroah-Hartman
maintainerPATCH 6/164 USB: core: replace %p with %pK
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vamsi Krishna Samavedam <[email protected]>
commit 2f964780c03b73de269b08d12aff96a9618d13f3 upstream.
Format specifier %p can leak kernel addresses while not valuing the kptr_restrict system settings. When kptr_restrict is set to (1), kernel pointers printed using the %pK format specifier will be replaced with Zeros. Debugging Note : &pK prints only Zeros as address. If you need actual address information, write 0 to kptr_restrict.
echo 0 > /proc/sys/kernel/kptr_restrict
[Found by poking around in a random vendor kernel tree, it would be nice if someone would actually send these types of patches upstream - gkh]
--- drivers/usb/core/devio.c | 14 +++++++------- drivers/usb/core/hcd.c | 4 ++-- drivers/usb/core/urb.c | 2 +- 3 files changed, 10 insertions(+), 10 deletions(-)
drivers/usb/core/devio.c +7 -7
@@ -481,11 +481,11 @@ static void snoop_urb(struct usb_deviceif (userurb) {/* Async */ if (when ==SUBMIT ) -dev_info (&udev->dev,"userurb %p, ep%d %s-%s, " +dev_info (&udev->dev,"userurb %pK, ep%d %s-%s, " "length %u\n" , userurb, ep, t, d, length);else -dev_info (&udev->dev,"userurb %p, ep%d %s-%s, " +dev_info (&udev->dev,"userurb %pK, ep%d %s-%s, " "actual_length %u status %d\n" , userurb, ep, t, d, length, timeout_or_status);
@@ -1905,7 +1905,7 @@ static int proc_reapurb(struct usb_dev_sif (as) {int retval; -snoop (&ps->dev->dev,"reap %p\n" , as->userurb); +snoop (&ps->dev->dev,"reap %pK\n" , as->userurb); retval =processcompl (as, (void __user *__user *)arg);free_async (as);return retval;
@@ -1922,7 +1922,7 @@ static int proc_reapurbnonblock(struct u as =async_getcompleted (ps);if (as) { -snoop (&ps->dev->dev,"reap %p\n" , as->userurb); +snoop (&ps->dev->dev,"reap %pK\n" , as->userurb); retval =processcompl (as, (void __user *__user *)arg);free_async (as); }else {
@@ -2053,7 +2053,7 @@ static int proc_reapurb_compat(struct usif (as) {int retval; -snoop (&ps->dev->dev,"reap %p\n" , as->userurb); +snoop (&ps->dev->dev,"reap %pK\n" , as->userurb); retval =processcompl_compat (as, (void __user *__user *)arg);free_async (as);return retval;
@@ -2070,7 +2070,7 @@ static int proc_reapurbnonblock_compat(s as =async_getcompleted (ps);if (as) { -snoop (&ps->dev->dev,"reap %p\n" , as->userurb); +snoop (&ps->dev->dev,"reap %pK\n" , as->userurb); retval =processcompl_compat (as, (void __user *__user *)arg);free_async (as); }else {
@@ -2499,7 +2499,7 @@ static long usbdev_do_ioctl(struct file#endif case USBDEVFS_DISCARDURB : -snoop (&dev->dev,"%s: DISCARDURB %p\n" , __func__, p); +snoop (&dev->dev,"%s: DISCARDURB %pK\n" , __func__, p); ret =proc_unlinkurb (ps, p);break ;
drivers/usb/core/hcd.c +2 -2
@@ -1722,7 +1722,7 @@ int usb_hcd_unlink_urb (struct urb *urb,if (retval ==0 ) retval = -EINPROGRESS ;else if (retval != -EIDRM && retval != -EBUSY ) -dev_dbg (&udev->dev,"hcd_unlink_urb %p fail %d\n" , +dev_dbg (&udev->dev,"hcd_unlink_urb %pK fail %d\n" , urb, retval);usb_put_dev (udev); }
@@ -1889,7 +1889,7 @@ rescan:/* kick hcd */ unlink1 (hcd, urb, -ESHUTDOWN ); dev_dbg (hcd->self.controller, - "shutdown urb %p ep%d%s%s\n", + "shutdown urb %pK ep%d%s%s\n", urb, usb_endpoint_num(&ep->desc), is_in ? "in" : "out", ({ char *s;
drivers/usb/core/urb.c +1 -1
@@ -333,7 +333,7 @@ int usb_submit_urb(struct urb *urb, gfp_if (!urb || !urb->complete)return -EINVAL ;if (urb->hcpriv) { -WARN_ONCE (1 ,"URB %p submitted while active\n" , urb); +WARN_ONCE (1 ,"URB %pK submitted while active\n" , urb);return -EBUSY ; }
Greg Kroah-Hartman
maintainerPATCH 7/164 tpm_tis_core: Choose appropriate timeout for reading burstcount
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Steffen <[email protected]>
commit 302a6ad7fc77146191126a1f3e2c5d724fd72416 upstream.
TIS v1.3 for TPM 1.2 and PTP for TPM 2.0 disagree about which timeout value applies to reading a valid burstcount. It is TIMEOUT_D according to TIS, but TIMEOUT_A according to PTP, so choose the appropriate value depending on whether we deal with a TPM 1.2 or a TPM 2.0.
This is important since according to the PTP TIMEOUT_D is much smaller than TIMEOUT_A. So the previous implementation could run into timeouts with a TPM 2.0, even though the TPM was behaving perfectly fine.
During tpm2_probe TIMEOUT_D will be used even with a TPM 2.0, because TPM_CHIP_FLAG_TPM2 is not yet set. This is fine, since the timeout values will only be changed afterwards by tpm_get_timeouts. Until then TIS_TIMEOUT_D_MAX applies, which is large enough.
--- drivers/char/tpm/tpm_tis_core.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/char/tpm/tpm_tis_core.c +4 -2
@@ -160,8 +160,10 @@ static int get_burstcount(struct tpm_chiu32 value;/* wait for burstcount */ -/* which timeout value, spec has 2 answers (c & d) */ - stop = jiffies + chip->timeout_d; +if (chip->flags &TPM_CHIP_FLAG_TPM2 ) + stop = jiffies + chip->timeout_a; +else + stop = jiffies + chip->timeout_d; do { rc = tpm_tis_read32(priv, TPM_STS(priv->locality), &value); if (rc < 0)
Greg Kroah-Hartman
maintainerPATCH 8/164 ALSA: hda: Fix cpu lockup when stopping the cmd dmas
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeeja KP <[email protected]>
commit 960013762df0a214b57f2fce655422fb52bdfd2c upstream.
Using jiffies in hdac_wait_for_cmd_dmas() to determine when to time out when interrupts are off (snd_hdac_bus_stop_cmd_io()/spin_lock_irq()) causes hard lockup so unlock while waiting using jiffies.
---<-snip->---
<0>[ 1211.603046] NMI watchdog: Watchdog detected hard LOCKUP on cpu 3 <4>[ 1211.603047] Modules linked in: snd_hda_intel i915 vgem <4>[ 1211.603053] irq event stamp: 13366 <4>[ 1211.603053] hardirqs last enabled at (13365): ... <4>[ 1211.603059] Call Trace: <4>[ 1211.603059] ? delay_tsc+0x3d/0xc0 <4>[ 1211.603059] __delay+0xa/0x10 <4>[ 1211.603060] __const_udelay+0x31/0x40 <4>[ 1211.603060] snd_hdac_bus_stop_cmd_io+0x96/0xe0 [snd_hda_core] <4>[ 1211.603060] ? azx_dev_disconnect+0x20/0x20 [snd_hda_intel] <4>[ 1211.603061] snd_hdac_bus_stop_chip+0xb1/0x100 [snd_hda_core] <4>[ 1211.603061] azx_stop_chip+0x9/0x10 [snd_hda_codec] <4>[ 1211.603061] azx_suspend+0x72/0x220 [snd_hda_intel] <4>[ 1211.603061] pci_pm_suspend+0x71/0x140 <4>[ 1211.603062] dpm_run_callback+0x6f/0x330 <4>[ 1211.603062] ? pci_pm_freeze+0xe0/0xe0 <4>[ 1211.603062] __device_suspend+0xf9/0x370 <4>[ 1211.603062] ? dpm_watchdog_set+0x60/0x60 <4>[ 1211.603063] async_suspend+0x1a/0x90 <4>[ 1211.603063] async_run_entry_fn+0x34/0x160 <4>[ 1211.603063] process_one_work+0x1f4/0x6d0 <4>[ 1211.603063] ? process_one_work+0x16e/0x6d0 <4>[ 1211.603064] worker_thread+0x49/0x4a0 <4>[ 1211.603064] kthread+0x107/0x140 <4>[ 1211.603064] ? process_one_work+0x6d0/0x6d0 <4>[ 1211.603065] ? kthread_create_on_node+0x40/0x40 <4>[ 1211.603065] ret_from_fork+0x2e/0x40
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=100419
--- sound/hda/hdac_controller.c | 4 ++++ 1 file changed, 4 insertions(+)
sound/hda/hdac_controller.c +4 -0
@@ -106,7 +106,11 @@ void snd_hdac_bus_stop_cmd_io(struct hda/* disable ringbuffer DMAs */ snd_hdac_chip_writeb (bus,RIRBCTL ,0 );snd_hdac_chip_writeb (bus,CORBCTL ,0 ); +spin_unlock_irq (&bus->reg_lock); +hdac_wait_for_cmd_dmas (bus); + +spin_lock_irq (&bus->reg_lock);/* disable unsolicited responses */ snd_hdac_chip_updatel (bus,GCTL ,AZX_GCTL_UNSOL ,0 );spin_unlock_irq (&bus->reg_lock);
Greg Kroah-Hartman
maintainerPATCH 9/164 ARM: tegra: paz00: Mark panel regulator as enabled on boot
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Dietrich <[email protected]>
commit 0c18927f51f4d390abdcf385bff5f995407ee732 upstream.
Current U-Boot enables the display already. Marking the regulator as enabled on boot fixes sporadic panel initialization failures.
--- arch/arm/boot/dts/tegra20-paz00.dts | 1 + 1 file changed, 1 insertion(+)
arch/arm/boot/dts/tegra20-paz00.dts +1 -0
@@ -569,6 +569,7 @@ regulator-name = "+3VS,vdd_pnl"; regulator-min-microvolt = <3300000>; regulator-max-microvolt = <3300000>; + regulator-boot-on; gpio = <&gpio TEGRA_GPIO(A, 4) GPIO_ACTIVE_HIGH>; enable-active-high; };
Greg Kroah-Hartman
maintainerPATCH 10/164 fanotify: dont expose EOPENSTALE to userspace
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amir Goldstein <[email protected]>
commit 4ff33aafd32e084f5ee7faa54ba06e95f8b1b8af upstream.
When delivering an event to userspace for a file on an NFS share, if the file is deleted on server side before user reads the event, user will not get the event.
If the event queue contained several events, the stale event is quietly dropped and read() returns to user with events read so far in the buffer.
If the event queue contains a single stale event or if the stale event is a permission event, read() returns to user with the kernel internal error code 518 (EOPENSTALE), which is not a POSIX error code.
Check the internal return value -EOPENSTALE in fanotify_read(), just the same as it is checked in path_openat() and drop the event in the cases that it is not already dropped.
This is a reproducer from Marko Rauhamaa:
Just take the example program listed under "man fanotify" ("fantest") and follow these steps:
==============================================================
NFS Server NFS Client(1) NFS Client(2)
==============================================================
# echo foo >/nfsshare/bar.txt
# cat /nfsshare/bar.txt
foo
# ./fantest /nfsshare Press enter key to terminate. Listening for events.
# rm -f /nfsshare/bar.txt
# cat /nfsshare/bar.txt
read: Unknown error 518
cat: /nfsshare/bar.txt: Operation not permitted
==============================================================
where NFS Client (1) and (2) are two terminal sessions on a single NFS Client machine.
--- fs/notify/fanotify/fanotify_user.c | 26 ++++++++++++++++++-------- 1 file changed, 18 insertions(+), 8 deletions(-)
fs/notify/fanotify/fanotify_user.c +18 -8
@@ -294,27 +294,37 @@ static ssize_t fanotify_read(struct file } ret =copy_event_to_user (group, kevent, buf); +if (unlikely (ret == -EOPENSTALE )) { +/* +* We cannot report events with stale fd so drop it. +* Setting ret to 0 will continue the event loop and +* do the right thing if there are no more events to +* read (i.e. return bytes read, -EAGAIN or wait). +*/ + ret =0 ; + } +/* * Permission events get queued to wait for response. Other * events can be destroyed now. */ if (!(kevent->mask &FAN_ALL_PERM_EVENTS )) {fsnotify_destroy_event (group, kevent); -if (ret <0 ) -break ; }else {#ifdef CONFIG_FANOTIFY_ACCESS_PERMISSIONS -if (ret <0 ) { +if (ret <=0 ) {FANOTIFY_PE (kevent)->response =FAN_DENY ;wake_up (&group->fanotify_data.access_waitq); -break ; + }else { +spin_lock (&group->notification_lock); +list_add_tail (&kevent->list, + &group->fanotify_data.access_list); +spin_unlock (&group->notification_lock); } -spin_lock (&group->notification_lock); -list_add_tail (&kevent->list, - &group->fanotify_data.access_list); -spin_unlock (&group->notification_lock);#endif } +if (ret <0 ) +break ; buf += ret; count -= ret; }
Greg Kroah-Hartman
maintainerPATCH 11/164 tpm_tis_spi: Use single function to transfer data
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Huewe <[email protected]>
commit f848f2143ae42dc0918400039257a893835254d1 upstream.
The algorithm for sending data to the TPM is mostly identical to the algorithm for receiving data from the TPM, so a single function is sufficient to handle both cases.
This is a prequisite for all the other fixes, so we don't have to fix everything twice (send/receive)
v2: u16 instead of u8 for the length.
--- drivers/char/tpm/tpm_tis_spi.c | 87 +++++++++++------------------------------ 1 file changed, 24 insertions(+), 63 deletions(-)
drivers/char/tpm/tpm_tis_spi.c +24 -63
@@ -48,8 +48,8 @@ struct tpm_tis_spi_phy {struct tpm_tis_data priv;struct spi_device *spi_device; -u8 tx_buf[MAX_SPI_FRAMESIZE +4 ]; -u8 rx_buf[MAX_SPI_FRAMESIZE +4 ]; +u8 tx_buf[4 ]; +u8 rx_buf[4 ]; };static inline struct tpm_tis_spi_phy *to_tpm_tis_spi_phy (struct tpm_tis_data *data)
@@ -57,8 +57,8 @@ static inline struct tpm_tis_spi_phy *to return container_of(data, struct tpm_tis_spi_phy, priv); } -static int tpm_tis_spi_read_bytes (struct tpm_tis_data *data,u32 addr, -u16 len,u8 *result) +static int tpm_tis_spi_transfer (struct tpm_tis_data *data,u32 addr,u16 len, +u8 *buffer,u8 direction) {struct tpm_tis_spi_phy *phy =to_tpm_tis_spi_phy (data);int ret, i;
@@ -67,17 +67,17 @@ static int tpm_tis_spi_read_bytes(struct .tx_buf = phy->tx_buf, .rx_buf = phy->rx_buf, .len = 4, + .cs_change = 1, };if (len >MAX_SPI_FRAMESIZE )return -ENOMEM ; - phy->tx_buf[0 ] =0x80 | (len -1 ); + phy->tx_buf[0 ] = direction | (len -1 ); phy->tx_buf[1 ] =0xd4 ; - phy->tx_buf[2 ] = (addr >>8 ) &0xFF ; - phy->tx_buf[3 ] = addr &0xFF ; + phy->tx_buf[2 ] = addr >>8 ; + phy->tx_buf[3 ] = addr; - spi_xfer.cs_change =1 ;spi_message_init (&m);spi_message_add_tail (&spi_xfer, &m);
@@ -86,7 +86,7 @@ static int tpm_tis_spi_read_bytes(structif (ret <0 ) goto exit; -memset (phy->tx_buf,0 , len); + phy->tx_buf[0 ] =0 ;/* According to TCG PTP specification, if there is no TPM present at * all, then the design has a weak pull-up on MISO. If a TPM is not
@@ -104,7 +104,14 @@ static int tpm_tis_spi_read_bytes(struct spi_xfer.cs_change =0 ; spi_xfer.len = len; - spi_xfer.rx_buf = result; + +if (direction) { + spi_xfer.tx_buf =NULL ; + spi_xfer.rx_buf = buffer; + }else { + spi_xfer.tx_buf = buffer; + spi_xfer.rx_buf =NULL ; + }spi_message_init (&m);spi_message_add_tail (&spi_xfer, &m);
@@ -115,62 +122,16 @@ exit:return ret; } +static int tpm_tis_spi_read_bytes (struct tpm_tis_data *data,u32 addr, +u16 len,u8 *result) +{ +return tpm_tis_spi_transfer (data, addr, len, result,0x80 ); +} +static int tpm_tis_spi_write_bytes (struct tpm_tis_data *data,u32 addr,u16 len,u8 *value) { -struct tpm_tis_spi_phy *phy =to_tpm_tis_spi_phy (data); -int ret, i; -struct spi_message m; -struct spi_transfer spi_xfer = { - .tx_buf = phy->tx_buf, - .rx_buf = phy->rx_buf, - .len =4 , - }; - -if (len >MAX_SPI_FRAMESIZE ) -return -ENOMEM ; - - phy->tx_buf[0 ] = len -1 ; - phy->tx_buf[1 ] =0xd4 ; - phy->tx_buf[2 ] = (addr >>8 ) &0xFF ; - phy->tx_buf[3 ] = addr &0xFF ; - - spi_xfer.cs_change =1 ; -spi_message_init (&m); -spi_message_add_tail (&spi_xfer, &m); - -spi_bus_lock (phy->spi_device->master); - ret =spi_sync_locked (phy->spi_device, &m); -if (ret <0 ) - goto exit; - -memset (phy->tx_buf,0 , len); - -/* According to TCG PTP specification, if there is no TPM present at -* all, then the design has a weak pull-up on MISO. If a TPM is not -* present, a pull-up on MISO means that the SB controller sees a 1, -* and will latch in 0xFF on the read. -*/ -for (i =0 ; (phy->rx_buf[0 ] &0x01 ) ==0 && i <TPM_RETRY ; i++) { - spi_xfer.len =1 ; -spi_message_init (&m); -spi_message_add_tail (&spi_xfer, &m); - ret =spi_sync_locked (phy->spi_device, &m); -if (ret <0 ) - goto exit; - } - - spi_xfer.len = len; - spi_xfer.tx_buf = value; - spi_xfer.cs_change =0 ; - spi_xfer.tx_buf = value; -spi_message_init (&m); -spi_message_add_tail (&spi_xfer, &m); - ret =spi_sync_locked (phy->spi_device, &m); - -exit: -spi_bus_unlock (phy->spi_device->master); -return ret; +return tpm_tis_spi_transfer (data, addr, len, value,0 ); }static int tpm_tis_spi_read16 (struct tpm_tis_data *data,u32 addr,u16 *result)
Greg Kroah-Hartman
maintainerPATCH 12/164 tpm_tis_spi: Abort transfer when too many wait states are signaled
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Huewe <[email protected]>
commit 975094ddc369a32f27210248bdd9bbd153061b00 upstream.
Abort the transfer with ETIMEDOUT when the TPM signals more than TPM_RETRY wait states. Continuing with the transfer in this state will only lead to arbitrary failures in other parts of the code.
--- drivers/char/tpm/tpm_tis_spi.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/char/tpm/tpm_tis_spi.c +5 -0
@@ -102,6 +102,11 @@ static int tpm_tis_spi_transfer(struct t goto exit; } +if (i ==TPM_RETRY ) { + ret = -ETIMEDOUT ; + goto exit; + } + spi_xfer.cs_change =0 ; spi_xfer.len = len;
Greg Kroah-Hartman
maintainerPATCH 13/164 tpm_tis_spi: Check correct byte for wait state indicator
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Huewe <[email protected]>
commit e110cc69dc2ad679d6d478df636b99b14e6fbbc9 upstream.
Wait states are signaled in the last byte received from the TPM in response to the header, not the first byte. Check rx_buf[3] instead of rx_buf[0].
--- drivers/char/tpm/tpm_tis_spi.c | 34 +++++++++++++++++----------------- 1 file changed, 17 insertions(+), 17 deletions(-)
drivers/char/tpm/tpm_tis_spi.c +17 -17
@@ -86,25 +86,25 @@ static int tpm_tis_spi_transfer(struct tif (ret <0 ) goto exit; - phy->tx_buf[0 ] =0 ; +if ((phy->rx_buf[3 ] &0x01 ) ==0 ) { +// handle SPI wait states + phy->tx_buf[0 ] =0 ; -/* According to TCG PTP specification, if there is no TPM present at -* all, then the design has a weak pull-up on MISO. If a TPM is not -* present, a pull-up on MISO means that the SB controller sees a 1, -* and will latch in 0xFF on the read. -*/ -for (i =0 ; (phy->rx_buf[0 ] &0x01 ) ==0 && i <TPM_RETRY ; i++) { - spi_xfer.len =1 ; -spi_message_init (&m); -spi_message_add_tail (&spi_xfer, &m); - ret =spi_sync_locked (phy->spi_device, &m); -if (ret <0 ) - goto exit; - } +for (i =0 ; i <TPM_RETRY ; i++) { + spi_xfer.len =1 ; +spi_message_init (&m); +spi_message_add_tail (&spi_xfer, &m); + ret =spi_sync_locked (phy->spi_device, &m); +if (ret <0 ) + goto exit; +if (phy->rx_buf[0 ] &0x01 ) +break ; + } -if (i ==TPM_RETRY ) { - ret = -ETIMEDOUT ; - goto exit; +if (i ==TPM_RETRY ) { + ret = -ETIMEDOUT ; + goto exit; + } } spi_xfer.cs_change =0 ;
Greg Kroah-Hartman
maintainerPATCH 14/164 tpm_tis_spi: Remove limitation of transfers to MAX_SPI_FRAMESIZE bytes
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Huewe <[email protected]>
commit 591e48c26ced7c455751eef27fb5963e902c2137 upstream.
Limiting transfers to MAX_SPI_FRAMESIZE was not expected by the upper layers, as tpm_tis has no such limitation. Add a loop to hide that limitation.
v2: Moved scope of spi_message to the top as requested by Jarkko
--- drivers/char/tpm/tpm_tis_spi.c | 109 ++++++++++++++++++++++------------------- 1 file changed, 59 insertions(+), 50 deletions(-)
drivers/char/tpm/tpm_tis_spi.c +59 -50
@@ -61,67 +61,76 @@ static int tpm_tis_spi_transfer(struct t u8 *buffer, u8 direction) {struct tpm_tis_spi_phy *phy =to_tpm_tis_spi_phy (data); -int ret, i; +int ret =0 ; +int i;struct spi_message m; -struct spi_transfer spi_xfer = { - .tx_buf = phy->tx_buf, - .rx_buf = phy->rx_buf, - .len =4 , - .cs_change =1 , - }; - -if (len >MAX_SPI_FRAMESIZE ) -return -ENOMEM ; - - phy->tx_buf[0 ] = direction | (len -1 ); - phy->tx_buf[1 ] =0xd4 ; - phy->tx_buf[2 ] = addr >>8 ; - phy->tx_buf[3 ] = addr; - -spi_message_init (&m); -spi_message_add_tail (&spi_xfer, &m); +struct spi_transfer spi_xfer; +u8 transfer_len;spi_bus_lock (phy->spi_device->master); - ret =spi_sync_locked (phy->spi_device, &m); -if (ret <0 ) - goto exit; - -if ((phy->rx_buf[3 ] &0x01 ) ==0 ) { -// handle SPI wait states - phy->tx_buf[0 ] =0 ; - -for (i =0 ; i <TPM_RETRY ; i++) { - spi_xfer.len =1 ; -spi_message_init (&m); -spi_message_add_tail (&spi_xfer, &m); - ret =spi_sync_locked (phy->spi_device, &m); -if (ret <0 ) + +while (len) { + transfer_len =min_t (u16, len,MAX_SPI_FRAMESIZE ); + + phy->tx_buf[0 ] = direction | (transfer_len -1 ); + phy->tx_buf[1 ] =0xd4 ; + phy->tx_buf[2 ] = addr >>8 ; + phy->tx_buf[3 ] = addr; + +memset (&spi_xfer,0 ,sizeof (spi_xfer)); + spi_xfer.tx_buf = phy->tx_buf; + spi_xfer.rx_buf = phy->rx_buf; + spi_xfer.len =4 ; + spi_xfer.cs_change =1 ; + +spi_message_init (&m); +spi_message_add_tail (&spi_xfer, &m); + ret =spi_sync_locked (phy->spi_device, &m); +if (ret <0 ) + goto exit; + +if ((phy->rx_buf[3 ] &0x01 ) ==0 ) { +// handle SPI wait states + phy->tx_buf[0 ] =0 ; + +for (i =0 ; i <TPM_RETRY ; i++) { + spi_xfer.len =1 ; +spi_message_init (&m); +spi_message_add_tail (&spi_xfer, &m); + ret =spi_sync_locked (phy->spi_device, &m); +if (ret <0 ) + goto exit; +if (phy->rx_buf[0 ] &0x01 ) +break ; + } + +if (i ==TPM_RETRY ) { + ret = -ETIMEDOUT ; goto exit; -if (phy->rx_buf[0 ] &0x01 ) -break ; + } } -if (i ==TPM_RETRY ) { - ret = -ETIMEDOUT ; - goto exit; + spi_xfer.cs_change =0 ; + spi_xfer.len = transfer_len; + +if (direction) { + spi_xfer.tx_buf =NULL ; + spi_xfer.rx_buf = buffer; + }else { + spi_xfer.tx_buf = buffer; + spi_xfer.rx_buf =NULL ; } - } - spi_xfer.cs_change =0 ; - spi_xfer.len = len; +spi_message_init (&m); +spi_message_add_tail (&spi_xfer, &m); + ret =spi_sync_locked (phy->spi_device, &m); +if (ret <0 ) + goto exit; -if (direction) { - spi_xfer.tx_buf =NULL ; - spi_xfer.rx_buf = buffer; - }else { - spi_xfer.tx_buf = buffer; - spi_xfer.rx_buf =NULL ; + len -= transfer_len; + buffer += transfer_len; } -spi_message_init (&m); -spi_message_add_tail (&spi_xfer, &m); - ret =spi_sync_locked (phy->spi_device, &m); - exit:spi_bus_unlock (phy->spi_device->master);return ret;
Greg Kroah-Hartman
maintainerPATCH 15/164 tpm_tis_spi: Add small delay after last transfer
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Huewe <[email protected]>
commit 5cc0101d1f88500f8901d01b035af743215d4c3a upstream.
Testing the implementation with a Raspberry Pi 2 showed that under some circumstances its SPI master erroneously releases the CS line before the transfer is complete, i.e. before the end of the last clock. In this case the TPM ignores the transfer and misses for example the GO command. The driver is unable to detect this communication problem and will wait for a command response that is never going to arrive, timing out eventually.
As a workaround, the small delay ensures that the CS line is held long enough, even with a faulty SPI master. Other SPI masters are not affected, except for a negligible performance penalty.
--- drivers/char/tpm/tpm_tis_spi.c | 1 + 1 file changed, 1 insertion(+)
drivers/char/tpm/tpm_tis_spi.c +1 -0
@@ -112,6 +112,7 @@ static int tpm_tis_spi_transfer(struct t spi_xfer.cs_change =0 ; spi_xfer.len = transfer_len; + spi_xfer.delay_usecs =5 ;if (direction) { spi_xfer.tx_buf =NULL ;
Greg Kroah-Hartman
maintainerPATCH 16/164 tpm: msleep() delays - replace with usleep_range() in i2c nuvoton driver
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nayna Jain <[email protected]>
commit a233a0289cf9a96ef9b42c730a7621ccbf9a6f98 upstream.
Commit 500462a9de65 "timers: Switch to a non-cascading wheel" replaced the 'classic' timer wheel, which aimed for near 'exact' expiry of the timers. Their analysis was that the vast majority of timeout timers are used as safeguards, not as real timers, and are cancelled or rearmed before expiration. The only exception noted to this were networking timers with a small expiry time.
Not included in the analysis was the TPM polling timer, which resulted in a longer normal delay and, every so often, a very long delay. The non-cascading wheel delay is based on CONFIG_HZ. For a description of the different rings and their delays, refer to the comments in kernel/time/timer.c.
Below are the delays given for rings 0 - 2, which explains the longer "normal" delays and the very, long delays as seen on systems with CONFIG_HZ 250.
* HZ 1000 steps
* Level Offset Granularity Range
* 0 0 1 ms 0 ms - 63 ms * 1 64 8 ms 64 ms - 511 ms * 2 128 64 ms 512 ms - 4095 ms (512ms - ~4s)
* HZ 250
* Level Offset Granularity Range
* 0 0 4 ms 0 ms - 255 ms * 1 64 32 ms 256 ms - 2047 ms (256ms - ~2s) * 2 128 256 ms 2048 ms - 16383 ms (~2s - ~16s)
Below is a comparison of extending the TPM with 1000 measurements, using msleep() vs. usleep_delay() when configured for 1000 hz vs. 250 hz, before and after commit 500462a9de65.
linux-4.7 | msleep() usleep_range()
1000 hz: 0m44.628s | 1m34.497s 29.243s
250 hz: 1m28.510s | 4m49.269s 32.386s
linux-4.7 | min-max (msleep) min-max (usleep_range)
1000 hz: 0:017 - 2:760s | 0:015 - 3:967s 0:014 - 0:418s
250 hz: 0:028 - 1:954s | 0:040 - 4:096s 0:016 - 0:816s
This patch replaces the msleep() with usleep_range() calls in the i2c nuvoton driver with a consistent max range value.
--- drivers/char/tpm/tpm_i2c_nuvoton.c | 23 +++++++++++++++-------- 1 file changed, 15 insertions(+), 8 deletions(-)
drivers/char/tpm/tpm_i2c_nuvoton.c +15 -8
@@ -49,9 +49,10 @@*/ #define TPM_I2C_MAX_BUF_SIZE 32#define TPM_I2C_RETRY_COUNT 32 -#define TPM_I2C_BUS_DELAY 1/* msec */ -#define TPM_I2C_RETRY_DELAY_SHORT 2/* msec */ -#define TPM_I2C_RETRY_DELAY_LONG 10/* msec */ +#define TPM_I2C_BUS_DELAY 1000/* usec */ +#define TPM_I2C_RETRY_DELAY_SHORT (2 * 1000)/* usec */ +#define TPM_I2C_RETRY_DELAY_LONG (10 * 1000)/* usec */ +#define TPM_I2C_DELAY_RANGE 300/* usec */ #define OF_IS_TPM2 ((void *)1)#define I2C_IS_TPM2 1
@@ -123,7 +124,8 @@ static s32 i2c_nuvoton_write_status(stru/* this causes the current command to be aborted */ for (i =0 , status =-1 ; i <TPM_I2C_RETRY_COUNT && status <0 ; i++) { status =i2c_nuvoton_write_buf (client,TPM_STS ,1 , &data); -msleep (TPM_I2C_BUS_DELAY ); +usleep_range (TPM_I2C_BUS_DELAY ,TPM_I2C_BUS_DELAY + +TPM_I2C_DELAY_RANGE ); }return status; }
@@ -160,7 +162,8 @@ static int i2c_nuvoton_get_burstcount(st burst_count =min_t (u8,TPM_I2C_MAX_BUF_SIZE , data);break ; } -msleep (TPM_I2C_BUS_DELAY ); +usleep_range (TPM_I2C_BUS_DELAY ,TPM_I2C_BUS_DELAY + +TPM_I2C_DELAY_RANGE ); }while (time_before (jiffies, stop));return burst_count;
@@ -203,13 +206,17 @@ static int i2c_nuvoton_wait_for_stat(strreturn 0 ;/* use polling to wait for the event */ - ten_msec = jiffies +msecs_to_jiffies (TPM_I2C_RETRY_DELAY_LONG ); + ten_msec = jiffies +usecs_to_jiffies (TPM_I2C_RETRY_DELAY_LONG ); stop = jiffies + timeout; do { if (time_before(jiffies, ten_msec)) - msleep(TPM_I2C_RETRY_DELAY_SHORT); + usleep_range(TPM_I2C_RETRY_DELAY_SHORT, + TPM_I2C_RETRY_DELAY_SHORT + + TPM_I2C_DELAY_RANGE); else - msleep(TPM_I2C_RETRY_DELAY_LONG); + usleep_range(TPM_I2C_RETRY_DELAY_LONG, + TPM_I2C_RETRY_DELAY_LONG + + TPM_I2C_DELAY_RANGE); status_valid = i2c_nuvoton_check_status(chip, mask, value); if (status_valid)
Greg Kroah-Hartman
maintainerPATCH 17/164 tpm: add sleep only for retry in i2c_nuvoton_write_status()
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nayna Jain <[email protected]>
commit 0afb7118ae021e80ecf70f5a3336e0935505518a upstream.
Currently, there is an unnecessary 1 msec delay added in i2c_nuvoton_write_status() for the successful case. This function is called multiple times during send() and recv(), which implies adding multiple extra delays for every TPM operation.
This patch calls usleep_range() only if retry is to be done.
--- drivers/char/tpm/tpm_i2c_nuvoton.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/char/tpm/tpm_i2c_nuvoton.c +3 -2
@@ -124,8 +124,9 @@ static s32 i2c_nuvoton_write_status(stru/* this causes the current command to be aborted */ for (i =0 , status =-1 ; i <TPM_I2C_RETRY_COUNT && status <0 ; i++) { status =i2c_nuvoton_write_buf (client,TPM_STS ,1 , &data); -usleep_range (TPM_I2C_BUS_DELAY ,TPM_I2C_BUS_DELAY - +TPM_I2C_DELAY_RANGE ); +if (status <0 ) +usleep_range (TPM_I2C_BUS_DELAY ,TPM_I2C_BUS_DELAY + +TPM_I2C_DELAY_RANGE ); }return status; }
Greg Kroah-Hartman
maintainerPATCH 18/164 tpm_crb: check for bad response size
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerry Snitselaar <[email protected]>
commit 8569defde8057258835c51ce01a33de82e14b148 upstream.
Make sure size of response buffer is at least 6 bytes, or we will underflow and pass large size_t to memcpy_fromio(). This was encountered while testing earlier version of locality patchset.
--- drivers/char/tpm/tpm_crb.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/char/tpm/tpm_crb.c +1 -2
@@ -111,8 +111,7 @@ static int crb_recv(struct tpm_chip *chimemcpy_fromio (buf, priv->rsp,6 ); expected =be32_to_cpup ((__be32 *) &buf[2 ]); - -if (expected > count) +if (expected > count || expected <6 )return -EIO ;memcpy_fromio (&buf[6 ], &priv->rsp[6 ], expected -6 );
Greg Kroah-Hartman
maintainerPATCH 19/164 ASoC: cs4271: configure reset GPIO as output
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Sverdlin <[email protected]>
commit 49b2e27ab9f66b0a22c21980ad8118a4038324ae upstream.
During reset "refactoring" the output configuration was lost. This commit repairs sound on EDB93XX boards.
--- sound/soc/codecs/cs4271.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/codecs/cs4271.c +1 -1
@@ -498,7 +498,7 @@ static int cs4271_reset(struct snd_soc_cstruct cs4271_private *cs4271 =snd_soc_codec_get_drvdata (codec);if (gpio_is_valid (cs4271->gpio_nreset)) { -gpio_set_value (cs4271->gpio_nreset,0 ); +gpio_direction_output (cs4271->gpio_nreset,0 );mdelay (1 );gpio_set_value (cs4271->gpio_nreset,1 );mdelay (1 );
Greg Kroah-Hartman
maintainerPATCH 20/164 mlx5: Fix mlx5_ib_map_mr_sg mr length
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sagi Grimberg <[email protected]>
commit 0a49f2c31c3efbeb0de3e4b5598764887f629be2 upstream.
In case we got an initial sg_offset, we need to
account for it in the mr length.
--- drivers/infiniband/hw/mlx5/mr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/mlx5/mr.c +1 -1
@@ -1828,7 +1828,7 @@ mlx5_ib_sg_to_klms(struct mlx5_ib_mr *mr klms[i].va =cpu_to_be64 (sg_dma_address (sg) + sg_offset); klms[i].bcount =cpu_to_be32 (sg_dma_len (sg) - sg_offset); klms[i].key =cpu_to_be32 (lkey); - mr->ibmr.length +=sg_dma_len (sg); + mr->ibmr.length +=sg_dma_len (sg) - sg_offset; sg_offset =0 ; }
Greg Kroah-Hartman
maintainerPATCH 21/164 infiniband: call ipv6 route lookup via the stub interface
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <[email protected]>
commit eea40b8f624f25cbc02d55f2d93203f60cee9341 upstream.
The infiniband address handle can be triggered to resolve an ipv6 address in response to MAD packets, regardless of the ipv6 module being disabled via the kernel command line argument.
That will cause a call into the ipv6 routing code, which is not initialized, and a conseguent oops.
This commit addresses the above issue replacing the direct lookup call with an indirect one via the ipv6 stub, which is properly initialized according to the ipv6 status (e.g. if ipv6 is disabled, the routing lookup fails gracefully)
--- drivers/infiniband/core/addr.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/infiniband/core/addr.c +2 -2
@@ -444,8 +444,8 @@ static int addr6_resolve(struct sockaddr fl6.saddr = src_in->sin6_addr; fl6.flowi6_oif = addr->bound_dev_if; - dst =ip6_route_output (addr->net,NULL , &fl6); -if ((ret = dst->error)) + ret = ipv6_stub->ipv6_dst_lookup (addr->net,NULL , &dst, &fl6); +if (ret <0 ) goto put; rt = (struct rt6_info *)dst;
Greg Kroah-Hartman
maintainerPATCH 22/164 dm btree: fix for dm_btree_find_lowest_key()
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vinothkumar Raja <[email protected]>
commit 7d1fedb6e96a960aa91e4ff70714c3fb09195a5a upstream.
dm_btree_find_lowest_key() is giving incorrect results. find_key() traverses the btree correctly for finding the highest key, but there is an error in the way it traverses the btree for retrieving the lowest key. dm_btree_find_lowest_key() fetches the first key of the rightmost block of the btree instead of fetching the first key from the leftmost block.
Fix this by conditionally passing the correct parameter to value64() based on the @find_highest flag.
--- drivers/md/persistent-data/dm-btree.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/md/persistent-data/dm-btree.c +6 -2
@@ -897,8 +897,12 @@ static int find_key(struct ro_spine *s,else *result_key =le64_to_cpu (ro_node (s)->keys[0 ]); -if (next_block || flags &INTERNAL_NODE ) - block =value64 (ro_node (s), i); +if (next_block || flags &INTERNAL_NODE ) { +if (find_highest) + block =value64 (ro_node (s), i); +else + block =value64 (ro_node (s),0 ); + } }while (flags &INTERNAL_NODE );
Greg Kroah-Hartman
maintainerPATCH 23/164 dm raid: select the Kconfig option CONFIG_MD_RAID0
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <[email protected]>
commit 7b81ef8b14f80033e4a4168d199a0f5fd79b9426 upstream.
Since the commit 0cf4503174c1 ("dm raid: add support for the MD RAID0 personality"), the dm-raid subsystem can activate a RAID-0 array. Therefore, add MD_RAID0 to the dependencies of DM_RAID, so that MD_RAID0 will be selected when DM_RAID is selected.
--- drivers/md/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/md/Kconfig +1 -0
@@ -357,6 +357,7 @@ config DM_LOG_USERSPACE config DM_RAID tristate "RAID 1/4/5/6/10 target" depends on BLK_DEV_DM + select MD_RAID0 select MD_RAID1 select MD_RAID10 select MD_RAID456
Greg Kroah-Hartman
maintainerPATCH 24/164 dm bufio: avoid a possible ABBA deadlock
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <[email protected]>
commit 1b0fb5a5b2dc0dddcfa575060441a7176ba7ac37 upstream.
__get_memory_limit() tests if dm_bufio_cache_size changed and calls __cache_size_refresh() if it did. It takes dm_bufio_clients_lock while it already holds the client lock. However, lock ordering is violated because in cleanup_old_buffers() dm_bufio_clients_lock is taken before the client lock.
This results in a possible deadlock and lockdep engine warning.
Fix this deadlock by changing mutex_lock() to mutex_trylock(). If the lock can't be taken, it will be re-checked next time when a new buffer is allocated.
Also add "unlikely" to the if condition, so that the optimizer assumes that the condition is false.
--- drivers/md/dm-bufio.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/md/dm-bufio.c +5 -4
@@ -923,10 +923,11 @@ static void __get_memory_limit(struct dm {unsigned long buffers; -if (ACCESS_ONCE (dm_bufio_cache_size) != dm_bufio_cache_size_latch) { -mutex_lock (&dm_bufio_clients_lock); -__cache_size_refresh (); -mutex_unlock (&dm_bufio_clients_lock); +if (unlikely (ACCESS_ONCE (dm_bufio_cache_size) != dm_bufio_cache_size_latch)) { +if (mutex_trylock (&dm_bufio_clients_lock)) { +__cache_size_refresh (); +mutex_unlock (&dm_bufio_clients_lock); + } } buffers = dm_bufio_cache_size_per_client >>
Greg Kroah-Hartman
maintainerPATCH 25/164 dm bufio: check new buffer allocation watermark every 30 seconds
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <[email protected]>
commit 390020ad2af9ca04844c4f3b1f299ad8746d84c8 upstream.
dm-bufio checks a watermark when it allocates a new buffer in __bufio_new(). However, it doesn't check the watermark when the user changes /sys/module/dm_bufio/parameters/max_cache_size_bytes.
This may result in a problem - if the watermark is high enough so that all possible buffers are allocated and if the user lowers the value of "max_cache_size_bytes", the watermark will never be checked against the new value because no new buffer would be allocated.
To fix this, change __evict_old_buffers() so that it checks the watermark. __evict_old_buffers() is called every 30 seconds, so if the user reduces "max_cache_size_bytes", dm-bufio will react to this change within 30 seconds and decrease memory consumption.
Depends-on: 1b0fb5a5b2 ("dm bufio: avoid a possible ABBA deadlock")
--- drivers/md/dm-bufio.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/md/dm-bufio.c +10 -0
@@ -1782,9 +1782,17 @@ static void __evict_old_buffers(struct dstruct dm_buffer *b, *tmp;unsigned retain_target =get_retain_buffers (c);unsigned count; +LIST_HEAD (write_list);dm_bufio_lock (c); +__check_watermark (c, &write_list); +if (unlikely (!list_empty (&write_list))) { +dm_bufio_unlock (c); +__flush_write_list (&write_list); +dm_bufio_lock (c); + } + count = c->n_buffers[LIST_CLEAN ] + c->n_buffers[LIST_DIRTY ];list_for_each_entry_safe_reverse (b, tmp, &c->lru[LIST_CLEAN ], lru_list) {if (count <= retain_target)
@@ -1809,6 +1817,8 @@ static void cleanup_old_buffers(void)mutex_lock (&dm_bufio_clients_lock); +__cache_size_refresh (); +list_for_each_entry (c, &dm_bufio_all_clients, client_list)__evict_old_buffers (c, max_age_hz);
Greg Kroah-Hartman
maintainerPATCH 26/164 dm mpath: split and rename activate_path() to prepare for its expanded use
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <[email protected]>
commit 89bfce763e43fa4897e0d3af6b29ed909df64cfd upstream.
activate_path() is renamed to activate_path_work() which now calls activate_or_offline_path(). activate_or_offline_path() will be used by the next commit.
--- drivers/md/dm-mpath.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-)
drivers/md/dm-mpath.c +12 -5
@@ -119,7 +119,8 @@ static struct kmem_cache *_mpio_cache;static struct workqueue_struct *kmultipathd, *kmpath_handlerd;static void trigger_event (struct work_struct *work); -static void activate_path (struct work_struct *work); +static void activate_or_offline_path (struct pgpath *pgpath); +static void activate_path_work (struct work_struct *work);static void process_queued_bios (struct work_struct *work);/*-----------------------------------------------
@@ -144,7 +145,7 @@ static struct pgpath *alloc_pgpath(void)if (pgpath) { pgpath->is_active = true; -INIT_DELAYED_WORK (&pgpath->activate_path, activate_path); +INIT_DELAYED_WORK (&pgpath->activate_path, activate_path_work); }return pgpath;
@@ -1515,10 +1516,8 @@ out:spin_unlock_irqrestore (&m->lock, flags); } -static void activate_path (struct work_struct *work) +static void activate_or_offline_path (struct pgpath *pgpath) { -struct pgpath *pgpath = - container_of(work, struct pgpath, activate_path.work);struct request_queue *q =bdev_get_queue (pgpath->path.dev->bdev);if (pgpath->is_active && !blk_queue_dying (q))
@@ -1527,6 +1526,14 @@ static void activate_path(struct work_stpg_init_done (pgpath,SCSI_DH_DEV_OFFLINED ); } +static void activate_path_work (struct work_struct *work) +{ +struct pgpath *pgpath = + container_of(work, struct pgpath, activate_path.work); + +activate_or_offline_path (pgpath); +} +static int noretry_error (int error) {switch (error) {
Greg Kroah-Hartman
maintainerPATCH 27/164 dm cache metadata: fail operations if fail_io mode has been established
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Snitzer <[email protected]>
commit 10add84e276432d9dd8044679a1028dd4084117e upstream.
Otherwise it is possible to trigger crashes due to the metadata being inaccessible yet these methods don't safely account for that possibility without these checks.
--- drivers/md/dm-cache-metadata.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
drivers/md/dm-cache-metadata.c +8 -4
@@ -1383,17 +1383,19 @@ void dm_cache_metadata_set_stats(structint dm_cache_commit (struct dm_cache_metadata *cmd,bool clean_shutdown) { -int r; +int r = -EINVAL ;flags_mutator mutator = (clean_shutdown ? set_clean_shutdown : clear_clean_shutdown);WRITE_LOCK (cmd); +if (cmd->fail_io) + goto out; + r =__commit_transaction (cmd, mutator);if (r) goto out; r =__begin_transaction (cmd); - out:WRITE_UNLOCK (cmd);return r;
@@ -1405,7 +1407,8 @@ int dm_cache_get_free_metadata_block_couint r = -EINVAL ;READ_LOCK (cmd); - r =dm_sm_get_nr_free (cmd->metadata_sm, result); +if (!cmd->fail_io) + r =dm_sm_get_nr_free (cmd->metadata_sm, result);READ_UNLOCK (cmd);return r;
@@ -1417,7 +1420,8 @@ int dm_cache_get_metadata_dev_size(strucint r = -EINVAL ;READ_LOCK (cmd); - r =dm_sm_get_nr_blocks (cmd->metadata_sm, result); +if (!cmd->fail_io) + r =dm_sm_get_nr_blocks (cmd->metadata_sm, result);READ_UNLOCK (cmd);return r;
Greg Kroah-Hartman
maintainerPATCH 28/164 dm bufio: make the parameter "retain_bytes" unsigned long
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <[email protected]>
commit 13840d38016203f0095cd547b90352812d24b787 upstream.
Change the type of the parameter "retain_bytes" from unsigned to unsigned long, so that on 64-bit machines the user can set more than 4GiB of data to be retained.
Also, change the type of the variable "count" in the function "__evict_old_buffers" to unsigned long. The assignment "count = c->n_buffers[LIST_CLEAN] + c->n_buffers[LIST_DIRTY];" could result in unsigned long to unsigned overflow and that could result in buffers not being freed when they should.
While at it, avoid division in get_retain_buffers(). Division is slow, we can change it to shift because we have precalculated the log2 of block size.
--- drivers/md/dm-bufio.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/md/dm-bufio.c +8 -8
@@ -215,7 +215,7 @@ static DEFINE_SPINLOCK(param_spinlock);* Buffers are freed after this timeout */ static unsigned dm_bufio_max_age =DM_BUFIO_DEFAULT_AGE_SECS ; -static unsigned dm_bufio_retain_bytes =DM_BUFIO_DEFAULT_RETAIN_BYTES ; +static unsigned long dm_bufio_retain_bytes =DM_BUFIO_DEFAULT_RETAIN_BYTES ;static unsigned long dm_bufio_peak_allocated;static unsigned long dm_bufio_allocated_kmem_cache;
@@ -1541,10 +1541,10 @@ static bool __try_evict_buffer(struct dmreturn true; } -static unsigned get_retain_buffers (struct dm_bufio_client *c) +static unsigned long get_retain_buffers (struct dm_bufio_client *c) { -unsigned retain_bytes =ACCESS_ONCE (dm_bufio_retain_bytes); -return retain_bytes / c->block_size; +unsigned long retain_bytes =ACCESS_ONCE (dm_bufio_retain_bytes); +return retain_bytes >> (c->sectors_per_block_bits +SECTOR_SHIFT ); } static unsigned long __scan(struct dm_bufio_client *c, unsigned long nr_to_scan,
@@ -1554,7 +1554,7 @@ static unsigned long __scan(struct dm_bustruct dm_buffer *b, *tmp;unsigned long freed =0 ;unsigned long count = nr_to_scan; -unsigned retain_target =get_retain_buffers (c); +unsigned long retain_target =get_retain_buffers (c);for (l =0 ; l <LIST_SIZE ; l++) {list_for_each_entry_safe_reverse (b, tmp, &c->lru[l], lru_list) {
@@ -1780,8 +1780,8 @@ static bool older_than(struct dm_bufferstatic void __evict_old_buffers (struct dm_bufio_client *c,unsigned long age_hz) {struct dm_buffer *b, *tmp; -unsigned retain_target =get_retain_buffers (c); -unsigned count; +unsigned long retain_target =get_retain_buffers (c); +unsigned long count;LIST_HEAD (write_list);dm_bufio_lock (c);
@@ -1941,7 +1941,7 @@ MODULE_PARM_DESC(max_cache_size_bytes, "module_param_named (max_age_seconds, dm_bufio_max_age, uint,S_IRUGO |S_IWUSR );MODULE_PARM_DESC (max_age_seconds,"Max age of a buffer in seconds" ); -module_param_named (retain_bytes, dm_bufio_retain_bytes, uint,S_IRUGO |S_IWUSR ); +module_param_named (retain_bytes, dm_bufio_retain_bytes, ulong,S_IRUGO |S_IWUSR );MODULE_PARM_DESC (retain_bytes,"Try to keep at least this many bytes cached in memory" );module_param_named (peak_allocated_bytes, dm_bufio_peak_allocated, ulong,S_IRUGO |S_IWUSR );
Greg Kroah-Hartman
maintainerPATCH 29/164 dm thin metadata: call precommit before saving the roots
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Thornber <[email protected]>
commit 91bcdb92d39711d1adb40c26b653b7978d93eb98 upstream.
These calls were the wrong way round in __write_initial_superblock.
--- drivers/md/dm-thin-metadata.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/md/dm-thin-metadata.c +2 -2
@@ -485,11 +485,11 @@ static int __write_initial_superblock(stif (r <0 )return r; - r =save_sm_roots (pmd); + r =dm_tm_pre_commit (pmd->tm);if (r <0 )return r; - r =dm_tm_pre_commit (pmd->tm); + r =save_sm_roots (pmd);if (r <0 )return r;
Greg Kroah-Hartman
maintainerPATCH 30/164 dm space map disk: fix some book keeping in the disk space map
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Thornber <[email protected]>
commit 0377a07c7a035e0d033cd8b29f0cb15244c0916a upstream.
When decrementing the reference count for a block, the free count wasn't being updated if the reference count went to zero.
--- drivers/md/persistent-data/dm-space-map-disk.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-)
drivers/md/persistent-data/dm-space-map-disk.c +14 -1
@@ -142,10 +142,23 @@ static int sm_disk_inc_block(struct dm_sstatic int sm_disk_dec_block (struct dm_space_map *sm,dm_block_t b) { +int r; +uint32_t old_count;enum allocation_event ev; struct sm_disk *smd = container_of(sm, struct sm_disk, sm); -return sm_ll_dec (&smd->ll, b, &ev); + r =sm_ll_dec (&smd->ll, b, &ev); +if (!r && (ev ==SM_FREE )) { +/* +* It's only free if it's also free in the last +* transaction. +*/ + r =sm_ll_lookup (&smd->old_ll, b, &old_count); +if (!r && !old_count) + smd->nr_allocated_this_transaction--; + } + +return r; }static int sm_disk_new_block (struct dm_space_map *sm,dm_block_t *b)
Greg Kroah-Hartman
maintainerPATCH 31/164 md: update slab_cache before releasing new stripes when stripes resizing
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dennis Yang <[email protected]>
commit 583da48e388f472e8818d9bb60ef6a1d40ee9f9d upstream.
When growing raid5 device on machine with small memory, there is chance that mdadm will be killed and the following bug report can be observed. The same bug could also be reproduced in linux-4.10.6.
[57600.075774] BUG: unable to handle kernel NULL pointer dereference at (null) [57600.083796] IP: [<ffffffff81a6aa87>] _raw_spin_lock+0x7/0x20 [57600.110378] PGD 421cf067 PUD 4442d067 PMD 0 [57600.114678] Oops: 0002 [#1] SMP [57600.180799] CPU: 1 PID: 25990 Comm: mdadm Tainted: P O 4.2.8 #1 [57600.187849] Hardware name: To be filled by O.E.M. To be filled by O.E.M./MAHOBAY, BIOS QV05AR66 03/06/2013 [57600.197490] task: ffff880044e47240 ti: ffff880043070000 task.ti: ffff880043070000 [57600.204963] RIP: 0010:[<ffffffff81a6aa87>] [<ffffffff81a6aa87>] _raw_spin_lock+0x7/0x20 [57600.213057] RSP: 0018:ffff880043073810 EFLAGS: 00010046 [57600.218359] RAX: 0000000000000000 RBX: 000000000000000c RCX: ffff88011e296dd0 [57600.225486] RDX: 0000000000000001 RSI: ffffe8ffffcb46c0 RDI: 0000000000000000 [57600.232613] RBP: ffff880043073878 R08: ffff88011e5f8170 R09: 0000000000000282 [57600.239739] R10: 0000000000000005 R11: 28f5c28f5c28f5c3 R12: ffff880043073838 [57600.246872] R13: ffffe8ffffcb46c0 R14: 0000000000000000 R15: ffff8800b9706a00 [57600.253999] FS: 00007f576106c700(0000) GS:ffff88011e280000(0000) knlGS:0000000000000000 [57600.262078] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [57600.267817] CR2: 0000000000000000 CR3: 00000000428fe000 CR4: 00000000001406e0 [57600.274942] Stack: [57600.276949] ffffffff8114ee35 ffff880043073868 0000000000000282 000000000000eb3f [57600.284383] ffffffff81119043 ffff880043073838 ffff880043073838 ffff88003e197b98 [57600.291820] ffffe8ffffcb46c0 ffff88003e197360 0000000000000286 ffff880043073968 [57600.299254] Call Trace: [57600.301698] [<ffffffff8114ee35>] ? cache_flusharray+0x35/0xe0 [57600.307523] [<ffffffff81119043>] ? __page_cache_release+0x23/0x110 [57600.313779] [<ffffffff8114eb53>] kmem_cache_free+0x63/0xc0 [57600.319344] [<ffffffff81579942>] drop_one_stripe+0x62/0x90 [57600.324915] [<ffffffff81579b5b>] raid5_cache_scan+0x8b/0xb0 [57600.330563] [<ffffffff8111b98a>] shrink_slab.part.36+0x19a/0x250 [57600.336650] [<ffffffff8111e38c>] shrink_zone+0x23c/0x250 [57600.342039] [<ffffffff8111e4f3>] do_try_to_free_pages+0x153/0x420 [57600.348210] [<ffffffff8111e851>] try_to_free_pages+0x91/0xa0 [57600.353959] [<ffffffff811145b1>] __alloc_pages_nodemask+0x4d1/0x8b0 [57600.360303] [<ffffffff8157a30b>] check_reshape+0x62b/0x770 [57600.365866] [<ffffffff8157a4a5>] raid5_check_reshape+0x55/0xa0 [57600.371778] [<ffffffff81583df7>] update_raid_disks+0xc7/0x110 [57600.377604] [<ffffffff81592b73>] md_ioctl+0xd83/0x1b10 [57600.382827] [<ffffffff81385380>] blkdev_ioctl+0x170/0x690 [57600.388307] [<ffffffff81195238>] block_ioctl+0x38/0x40 [57600.393525] [<ffffffff811731c5>] do_vfs_ioctl+0x2b5/0x480 [57600.399010] [<ffffffff8115e07b>] ? vfs_write+0x14b/0x1f0 [57600.404400] [<ffffffff811733cc>] SyS_ioctl+0x3c/0x70 [57600.409447] [<ffffffff81a6ad97>] entry_SYSCALL_64_fastpath+0x12/0x6a [57600.415875] Code: 00 00 00 00 55 48 89 e5 8b 07 85 c0 74 04 31 c0 5d c3 ba 01 00 00 00 f0 0f b1 17 85 c0 75 ef b0 01 5d c3 90 31 c0 ba 01 00 00 00 <f0> 0f b1 17 85 c0 75 01 c3 55 89 c6 48 89 e5 e8 85 d1 63 ff 5d [57600.435460] RIP [<ffffffff81a6aa87>] _raw_spin_lock+0x7/0x20 [57600.441208] RSP <ffff880043073810> [57600.444690] CR2: 0000000000000000 [57600.448000] ---[ end trace cbc6b5cc4bf9831d ]---
The problem is that resize_stripes() releases new stripe_heads before assigning new slab cache to conf->slab_cache. If the shrinker function raid5_cache_scan() gets called after resize_stripes() starting releasing new stripes but right before new slab cache being assigned, it is possible that these new stripe_heads will be freed with the old slab_cache which was already been destoryed and that triggers this bug.
--- drivers/md/raid5.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/md/raid5.c +4 -2
@@ -2253,6 +2253,10 @@ static int resize_stripes(struct r5conf err = -ENOMEM ;mutex_unlock (&conf->cache_size_mutex); + + conf->slab_cache = sc; + conf->active_name =1 -conf->active_name; +/* Step 4, return new stripes to service */ while (!list_empty (&newstripes)) { nsh = list_entry(newstripes.next, struct stripe_head, lru);
@@ -2270,8 +2274,6 @@ static int resize_stripes(struct r5conf }/* critical section pass, GFP_NOIO no longer needed */ - conf->slab_cache = sc; - conf->active_name =1 -conf->active_name;if (!err) conf->pool_size = newsize;return err;
Greg Kroah-Hartman
maintainerPATCH 32/164 md: MD_CLOSING needs to be cleared after called md_set_readonly or do_md_stop
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <[email protected]>
commit 065e519e71b2c1f41936cce75b46b5ab34adb588 upstream.
if called md_set_readonly and set MD_CLOSING bit, the mddev cannot be opened any more due to the MD_CLOING bit wasn't cleared. Thus it needs to be cleared in md_ioctl after any call to md_set_readonly() or do_md_stop().
--- drivers/md/md.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/md/md.c +5 -0
@@ -6752,6 +6752,7 @@ static int md_ioctl(struct block_devicevoid __user *argp = (void __user *)arg;struct mddev *mddev =NULL ;int ro; +bool did_set_md_closing = false;if (!md_ioctl_valid (cmd))return -ENOTTY ;
@@ -6841,7 +6842,9 @@ static int md_ioctl(struct block_device err = -EBUSY ; goto out; } +WARN_ON_ONCE (test_bit (MD_CLOSING , &mddev->flags));set_bit (MD_CLOSING , &mddev->flags); + did_set_md_closing = true;mutex_unlock (&mddev->open_mutex);sync_blockdev (bdev); }
@@ -7041,6 +7044,8 @@ unlock: mddev->hold_active =0 ;mddev_unlock (mddev); out: +if (did_set_md_closing) +clear_bit (MD_CLOSING , &mddev->flags);return err; }#ifdef CONFIG_COMPAT
Greg Kroah-Hartman
maintainerPATCH 33/164 rtlwifi: rtl8821ae: setup 8812ae RFE according to device type
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Larry Finger <[email protected]>
commit 46cfa2148e7371c537efff1a1c693e58f523089d upstream.
Current channel switch implementation sets 8812ae RFE reg value assuming that device always has type 2.
Extend possible RFE types set and write corresponding reg values.
Source for new code is
http://dlcdnet.asus.com/pub/ASUS/wireless/PCE-AC51/DR_PCE_AC51_20232801152016.zip
--- drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c | 122 ++++++++++++++++--- drivers/net/wireless/realtek/rtlwifi/rtl8821ae/reg.h | 1 2 files changed, 107 insertions(+), 16 deletions(-)
drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c +106 -16
@@ -359,6 +359,107 @@ bool rtl8821ae_phy_rf_config(struct ieeereturn rtl8821ae_phy_rf6052_config (hw); } +static void _rtl8812ae_phy_set_rfe_reg_24g (struct ieee80211_hw *hw) +{ +struct rtl_priv *rtlpriv =rtl_priv (hw); +struct rtl_hal *rtlhal =rtl_hal (rtl_priv (hw)); +u8 tmp; + +switch (rtlhal->rfe_type) { +case 3 : +rtl_set_bbreg (hw,RA_RFE_PINMUX ,BMASKDWORD ,0x54337770 ); +rtl_set_bbreg (hw,RB_RFE_PINMUX ,BMASKDWORD ,0x54337770 ); +rtl_set_bbreg (hw,RA_RFE_INV ,BMASKRFEINV ,0x010 ); +rtl_set_bbreg (hw,RB_RFE_INV ,BMASKRFEINV ,0x010 ); +rtl_set_bbreg (hw,0x900 ,0x00000303 ,0x1 ); +break ; +case 4 : +rtl_set_bbreg (hw,RA_RFE_PINMUX ,BMASKDWORD ,0x77777777 ); +rtl_set_bbreg (hw,RB_RFE_PINMUX ,BMASKDWORD ,0x77777777 ); +rtl_set_bbreg (hw,RA_RFE_INV ,BMASKRFEINV ,0x001 ); +rtl_set_bbreg (hw,RB_RFE_INV ,BMASKRFEINV ,0x001 ); +break ; +case 5 : +rtl_write_byte (rtlpriv,RA_RFE_PINMUX +2 ,0x77 ); +rtl_set_bbreg (hw,RB_RFE_PINMUX ,BMASKDWORD ,0x77777777 ); + tmp =rtl_read_byte (rtlpriv,RA_RFE_INV +3 ); +rtl_write_byte (rtlpriv,RA_RFE_INV +3 , tmp & ~0x1 ); +rtl_set_bbreg (hw,RB_RFE_INV ,BMASKRFEINV ,0x000 ); +break ; +case 1 : +if (rtlpriv->btcoexist.bt_coexistence) { +rtl_set_bbreg (hw,RA_RFE_PINMUX ,0xffffff ,0x777777 ); +rtl_set_bbreg (hw,RB_RFE_PINMUX ,BMASKDWORD , +0x77777777 ); +rtl_set_bbreg (hw,RA_RFE_INV ,0x33f00000 ,0x000 ); +rtl_set_bbreg (hw,RB_RFE_INV ,BMASKRFEINV ,0x000 ); +break ; + } +case 0 : +case 2 : +default : +rtl_set_bbreg (hw,RA_RFE_PINMUX ,BMASKDWORD ,0x77777777 ); +rtl_set_bbreg (hw,RB_RFE_PINMUX ,BMASKDWORD ,0x77777777 ); +rtl_set_bbreg (hw,RA_RFE_INV ,BMASKRFEINV ,0x000 ); +rtl_set_bbreg (hw,RB_RFE_INV ,BMASKRFEINV ,0x000 ); +break ; + } +} + +static void _rtl8812ae_phy_set_rfe_reg_5g (struct ieee80211_hw *hw) +{ +struct rtl_priv *rtlpriv =rtl_priv (hw); +struct rtl_hal *rtlhal =rtl_hal (rtl_priv (hw)); +u8 tmp; + +switch (rtlhal->rfe_type) { +case 0 : +rtl_set_bbreg (hw,RA_RFE_PINMUX ,BMASKDWORD ,0x77337717 ); +rtl_set_bbreg (hw,RB_RFE_PINMUX ,BMASKDWORD ,0x77337717 ); +rtl_set_bbreg (hw,RA_RFE_INV ,BMASKRFEINV ,0x010 ); +rtl_set_bbreg (hw,RB_RFE_INV ,BMASKRFEINV ,0x010 ); +break ; +case 1 : +if (rtlpriv->btcoexist.bt_coexistence) { +rtl_set_bbreg (hw,RA_RFE_PINMUX ,0xffffff ,0x337717 ); +rtl_set_bbreg (hw,RB_RFE_PINMUX ,BMASKDWORD , +0x77337717 ); +rtl_set_bbreg (hw,RA_RFE_INV ,0x33f00000 ,0x000 ); +rtl_set_bbreg (hw,RB_RFE_INV ,BMASKRFEINV ,0x000 ); + }else { +rtl_set_bbreg (hw,RA_RFE_PINMUX ,BMASKDWORD , +0x77337717 ); +rtl_set_bbreg (hw,RB_RFE_PINMUX ,BMASKDWORD , +0x77337717 ); +rtl_set_bbreg (hw,RA_RFE_INV ,BMASKRFEINV ,0x000 ); +rtl_set_bbreg (hw,RB_RFE_INV ,BMASKRFEINV ,0x000 ); + } +break ; +case 3 : +rtl_set_bbreg (hw,RA_RFE_PINMUX ,BMASKDWORD ,0x54337717 ); +rtl_set_bbreg (hw,RB_RFE_PINMUX ,BMASKDWORD ,0x54337717 ); +rtl_set_bbreg (hw,RA_RFE_INV ,BMASKRFEINV ,0x010 ); +rtl_set_bbreg (hw,RB_RFE_INV ,BMASKRFEINV ,0x010 ); +rtl_set_bbreg (hw,0x900 ,0x00000303 ,0x1 ); +break ; +case 5 : +rtl_write_byte (rtlpriv,RA_RFE_PINMUX +2 ,0x33 ); +rtl_set_bbreg (hw,RB_RFE_PINMUX ,BMASKDWORD ,0x77337777 ); + tmp =rtl_read_byte (rtlpriv,RA_RFE_INV +3 ); +rtl_write_byte (rtlpriv,RA_RFE_INV +3 , tmp |0x1 ); +rtl_set_bbreg (hw,RB_RFE_INV ,BMASKRFEINV ,0x010 ); +break ; +case 2 : +case 4 : +default : +rtl_set_bbreg (hw,RA_RFE_PINMUX ,BMASKDWORD ,0x77337777 ); +rtl_set_bbreg (hw,RB_RFE_PINMUX ,BMASKDWORD ,0x77337777 ); +rtl_set_bbreg (hw,RA_RFE_INV ,BMASKRFEINV ,0x010 ); +rtl_set_bbreg (hw,RB_RFE_INV ,BMASKRFEINV ,0x010 ); +break ; + } +} +u32 phy_get_tx_swing_8812A (struct ieee80211_hw *hw,u8 band,u8 rf_path) {
@@ -553,14 +654,9 @@ void rtl8821ae_phy_switch_wirelessband(s/* 0x82C[1:0] = 2b'00 */ rtl_set_bbreg (hw,0x82c ,0x3 ,0 ); } -if (rtlhal->hw_type ==HARDWARE_TYPE_RTL8812AE ) { -rtl_set_bbreg (hw,RA_RFE_PINMUX ,BMASKDWORD , -0x77777777 ); -rtl_set_bbreg (hw,RB_RFE_PINMUX ,BMASKDWORD , -0x77777777 ); -rtl_set_bbreg (hw,RA_RFE_INV ,0x3ff00000 ,0x000 ); -rtl_set_bbreg (hw,RB_RFE_INV ,0x3ff00000 ,0x000 ); - } + +if (rtlhal->hw_type ==HARDWARE_TYPE_RTL8812AE ) +_rtl8812ae_phy_set_rfe_reg_24g (hw);rtl_set_bbreg (hw,RTXPATH ,0xf0 ,0x1 );rtl_set_bbreg (hw,RCCK_RX ,0x0f000000 ,0x1 );
@@ -615,14 +711,8 @@ void rtl8821ae_phy_switch_wirelessband(s/* 0x82C[1:0] = 2'b00 */ rtl_set_bbreg (hw,0x82c ,0x3 ,1 ); -if (rtlhal->hw_type ==HARDWARE_TYPE_RTL8812AE ) { -rtl_set_bbreg (hw,RA_RFE_PINMUX ,BMASKDWORD , -0x77337777 ); -rtl_set_bbreg (hw,RB_RFE_PINMUX ,BMASKDWORD , -0x77337777 ); -rtl_set_bbreg (hw,RA_RFE_INV ,0x3ff00000 ,0x010 ); -rtl_set_bbreg (hw,RB_RFE_INV ,0x3ff00000 ,0x010 ); - } +if (rtlhal->hw_type ==HARDWARE_TYPE_RTL8812AE ) +_rtl8812ae_phy_set_rfe_reg_5g (hw);rtl_set_bbreg (hw,RTXPATH ,0xf0 ,0 );rtl_set_bbreg (hw,RCCK_RX ,0x0f000000 ,0xf );
drivers/net/wireless/realtek/rtlwifi/rtl8821ae/reg.h +1 -0
@@ -2424,6 +2424,7 @@#define BMASKH4BITS 0xf0000000#define BMASKOFDM_D 0xffc00000#define BMASKCCK 0x3f3f3f3f +#define BMASKRFEINV 0x3ff00000#define BRFREGOFFSETMASK 0xfffff
Greg Kroah-Hartman
maintainerPATCH 34/164 mwifiex: MAC randomization should not be persistent
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Norris <[email protected]>
commit 7e2f18f06408ff56d7f75e68de8064777137b319 upstream.
nl80211 provides the NL80211_SCAN_FLAG_RANDOM_ADDR for every scan request that should be randomized; the absence of such a flag means we should not randomize. However, mwifiex was stashing the latest randomization request and *always* using it for future scans, even those that didn't set the flag.
Let's zero out the randomization info whenever we get a scan request without NL80211_SCAN_FLAG_RANDOM_ADDR. I'd prefer to remove priv->random_mac entirely (and plumb the randomization MAC properly through the call sequence), but the spaghetti is a little difficult to unravel here for me.
--- drivers/net/wireless/marvell/mwifiex/cfg80211.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/wireless/marvell/mwifiex/cfg80211.c +3 -1
@@ -2512,9 +2512,11 @@ mwifiex_cfg80211_scan(struct wiphy *wiph priv->random_mac[i] |=get_random_int () & ~(request->mac_addr_mask[i]); } +ether_addr_copy (user_scan_cfg->random_mac, priv->random_mac); + }else { +eth_zero_addr (priv->random_mac); } -ether_addr_copy (user_scan_cfg->random_mac, priv->random_mac); user_scan_cfg->num_ssids = request->n_ssids; user_scan_cfg->ssid_list = request->ssids;
Greg Kroah-Hartman
maintainerPATCH 35/164 mwifiex: pcie: fix cmd_buf use-after-free in remove/reset
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Norris <[email protected]>
commit 3c8cb9ad032d737b874e402c59eb51e3c991a144 upstream.
Command buffers (skb's) are allocated by the main driver, and freed upon the last use. That last use is often in mwifiex_free_cmd_buffer(). In the meantime, if the command buffer gets used by the PCI driver, we map it as DMA-able, and store the mapping information in the 'cb' memory.
However, if a command was in-flight when resetting the device (and therefore was still mapped), we don't get a chance to unmap this memory until after the core has cleaned up its command handling.
Let's keep a refcount within the PCI driver, so we ensure the memory only gets freed after we've finished unmapping it.
Noticed by KASAN when forcing a reset via:
echo 1 > /sys/bus/pci/.../reset
The same code path can presumably be exercised in remove() and shutdown().
[ 205.390377] mwifiex_pcie 0000:01:00.0: info: shutdown mwifiex... [ 205.400393] ================================================================== [ 205.407719] BUG: KASAN: use-after-free in mwifiex_unmap_pci_memory.isra.14+0x4c/0x100 [mwifiex_pcie] at addr ffffffc0ad471b28 [ 205.419040] Read of size 16 by task bash/1913 [ 205.423421] ============================================================================= [ 205.431625] BUG skbuff_head_cache (Tainted: G B ): kasan: bad access detected [ 205.439815] ----------------------------------------------------------------------------- [ 205.439815] [ 205.449534] INFO: Allocated in __build_skb+0x48/0x114 age=1311 cpu=4 pid=1913 [ 205.456709] alloc_debug_processing+0x124/0x178 [ 205.461282] ___slab_alloc.constprop.58+0x528/0x608 [ 205.466196] __slab_alloc.isra.54.constprop.57+0x44/0x54 [ 205.471542] kmem_cache_alloc+0xcc/0x278 [ 205.475497] __build_skb+0x48/0x114 [ 205.479019] __netdev_alloc_skb+0xe0/0x170 [ 205.483244] mwifiex_alloc_cmd_buffer+0x68/0xdc [mwifiex] [ 205.488759] mwifiex_init_fw+0x40/0x6cc [mwifiex] [ 205.493584] _mwifiex_fw_dpc+0x158/0x520 [mwifiex] [ 205.498491] mwifiex_reinit_sw+0x2c4/0x398 [mwifiex] [ 205.503510] mwifiex_pcie_reset_notify+0x114/0x15c [mwifiex_pcie] [ 205.509643] pci_reset_notify+0x5c/0x6c [ 205.513519] pci_reset_function+0x6c/0x7c [ 205.517567] reset_store+0x68/0x98 [ 205.521003] dev_attr_store+0x54/0x60 [ 205.524705] sysfs_kf_write+0x9c/0xb0 [ 205.528413] INFO: Freed in __kfree_skb+0xb0/0xbc age=131 cpu=4 pid=1913 [ 205.535064] free_debug_processing+0x264/0x370 [ 205.539550] __slab_free+0x84/0x40c [ 205.543075] kmem_cache_free+0x1c8/0x2a0 [ 205.547030] __kfree_skb+0xb0/0xbc [ 205.550465] consume_skb+0x164/0x178 [ 205.554079] __dev_kfree_skb_any+0x58/0x64 [ 205.558304] mwifiex_free_cmd_buffer+0xa0/0x158 [mwifiex] [ 205.563817] mwifiex_shutdown_drv+0x578/0x5c4 [mwifiex] [ 205.569164] mwifiex_shutdown_sw+0x178/0x310 [mwifiex] [ 205.574353] mwifiex_pcie_reset_notify+0xd4/0x15c [mwifiex_pcie] [ 205.580398] pci_reset_notify+0x5c/0x6c [ 205.584274] pci_dev_save_and_disable+0x24/0x6c [ 205.588837] pci_reset_function+0x30/0x7c [ 205.592885] reset_store+0x68/0x98 [ 205.596324] dev_attr_store+0x54/0x60 [ 205.600017] sysfs_kf_write+0x9c/0xb0 ... [ 205.800488] Call trace: [ 205.802980] [<ffffffc00020a69c>] dump_backtrace+0x0/0x190 [ 205.808415] [<ffffffc00020a96c>] show_stack+0x20/0x28 [ 205.813506] [<ffffffc0005d020c>] dump_stack+0xa4/0xcc [ 205.818598] [<ffffffc0003be44c>] print_trailer+0x158/0x168 [ 205.824120] [<ffffffc0003be5f0>] object_err+0x4c/0x5c [ 205.829210] [<ffffffc0003c45bc>] kasan_report+0x334/0x500 [ 205.834641] [<ffffffc0003c3994>] check_memory_region+0x20/0x14c [ 205.840593] [<ffffffc0003c3b14>] __asan_loadN+0x14/0x1c [ 205.845879] [<ffffffbffc46171c>] mwifiex_unmap_pci_memory.isra.14+0x4c/0x100 [mwifiex_pcie] [ 205.854282] [<ffffffbffc461864>] mwifiex_pcie_delete_cmdrsp_buf+0x94/0xa8 [mwifiex_pcie] [ 205.862421] [<ffffffbffc462028>] mwifiex_pcie_free_buffers+0x11c/0x158 [mwifiex_pcie] [ 205.870302] [<ffffffbffc4620d4>] mwifiex_pcie_down_dev+0x70/0x80 [mwifiex_pcie] [ 205.877736] [<ffffffbffc1397a8>] mwifiex_shutdown_sw+0x190/0x310 [mwifiex] [ 205.884658] [<ffffffbffc4606b4>] mwifiex_pcie_reset_notify+0xd4/0x15c [mwifiex_pcie] [ 205.892446] [<ffffffc000635f54>] pci_reset_notify+0x5c/0x6c [ 205.898048] [<ffffffc00063a044>] pci_dev_save_and_disable+0x24/0x6c [ 205.904350] [<ffffffc00063cf0c>] pci_reset_function+0x30/0x7c [ 205.910134] [<ffffffc000641118>] reset_store+0x68/0x98 [ 205.915312] [<ffffffc000771588>] dev_attr_store+0x54/0x60 [ 205.920750] [<ffffffc00046f53c>] sysfs_kf_write+0x9c/0xb0 [ 205.926182] [<ffffffc00046dfb0>] kernfs_fop_write+0x184/0x1f8 [ 205.931963] [<ffffffc0003d64f4>] __vfs_write+0x6c/0x17c [ 205.937221] [<ffffffc0003d7164>] vfs_write+0xf0/0x1c4 [ 205.942310] [<ffffffc0003d7da0>] SyS_write+0x78/0xd8 [ 205.947312] [<ffffffc000204634>] el0_svc_naked+0x24/0x28 ... [ 205.998268] ==================================================================
This bug has been around in different forms for a while. It was sort of noticed in commit 955ab095c51a ("mwifiex: Do not kfree cmd buf while unregistering PCIe"), but it just fixed the double-free, without acknowledging the potential for use-after-free.
--- drivers/net/wireless/marvell/mwifiex/pcie.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/net/wireless/marvell/mwifiex/pcie.c +7 -0
@@ -995,6 +995,7 @@ static int mwifiex_pcie_delete_cmdrsp_buif (card && card->cmd_buf) {mwifiex_unmap_pci_memory (adapter, card->cmd_buf,PCI_DMA_TODEVICE ); +dev_kfree_skb_any (card->cmd_buf); }return 0 ; }
@@ -1561,6 +1562,11 @@ mwifiex_pcie_send_cmd(struct mwifiex_adareturn -1 ; card->cmd_buf = skb; +/* +* Need to keep a reference, since core driver might free up this +* buffer before we've unmapped it. +*/ +skb_get (skb);/* To send a command, the driver will: 1. Write the 64bit physical address of the data buffer to
@@ -1658,6 +1664,7 @@ static int mwifiex_pcie_process_cmd_compif (card->cmd_buf) {mwifiex_unmap_pci_memory (adapter, card->cmd_buf,PCI_DMA_TODEVICE ); +dev_kfree_skb_any (card->cmd_buf); card->cmd_buf =NULL ; }
Greg Kroah-Hartman
maintainerPATCH 40/164 x86: fix 32-bit case of __get_user_asm_u64()
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Torvalds <[email protected]>
commit 33c9e9729033387ef0521324c62e7eba529294af upstream.
The code to fetch a 64-bit value from user space was entirely buggered, and has been since the code was merged in early 2016 in commit b2f680380ddf ("x86/mm/32: Add support for 64-bit __get_user() on 32-bit kernels").
Happily the buggered routine is almost certainly entirely unused, since the normal way to access user space memory is just with the non-inlined "get_user()", and the inlined version didn't even historically exist.
The normal "get_user()" case is handled by external hand-written asm in arch/x86/lib/getuser.S that doesn't have either of these issues.
There were two independent bugs in __get_user_asm_u64():
- it still did the STAC/CLAC user space access marking, even though that is now done by the wrapper macros, see commit 11f1a4b9755f ("x86: reorganize SMAP handling in user space accesses").
This didn't result in a semantic error, it just means that the inlined optimized version was hugely less efficient than the allegedly slower standard version, since the CLAC/STAC overhead is quite high on modern Intel CPU's.
- the double register %eax/%edx was marked as an output, but the %eax part of it was touched early in the asm, and could thus clobber other inputs to the asm that gcc didn't expect it to touch.
In particular, that meant that the generated code could look like this:
mov (%eax),%eax
mov 0x4(%eax),%edxwhere the load of %edx obviously was _supposed_ to be from the 32-bit word that followed the source of %eax, but because %eax was overwritten by the first instruction, the source of %edx was basically random garbage.
The fixes are trivial: remove the extraneous STAC/CLAC entries, and mark the 64-bit output as early-clobber to let gcc know that no inputs should alias with the output register.
--- arch/x86/include/asm/uaccess.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/x86/include/asm/uaccess.h +3 -3
@@ -315,10 +315,10 @@ do { \#define __get_user_asm_u64 (x, ptr, retval, errret) \ ({ \ __typeof__(ptr) __ptr = (ptr); \ - asm volatile(ASM_STAC "\n" \ + asm volatile("\n" \ "1: movl %2,%%eax\n" \ "2: movl %3,%%edx\n" \ - "3: " ASM_CLAC "\n" \ + "3:\n" \ ".section .fixup,\"ax\"\n" \ "4: mov %4,%0\n" \ " xorl %%eax,%%eax\n" \
@@ -327,7 +327,7 @@ do { \".previous\n" \ _ASM_EXTABLE(1b, 4b) \_ASM_EXTABLE (2b ,4b ) \ - : "=r" (retval), "=A"(x) \ + : "=r" (retval), "=&A"(x) \: " m" (__m(__ptr)), " m" __m(((u32 *)(__ptr)) + 1), \ "i" (errret), "0" (retval)); \ })
Greg Kroah-Hartman
maintainerPATCH 41/164 regulator: rk808: Fix RK818 LDO2
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wadim Egorov <[email protected]>
commit 75f88115391156b3f0fecbbae76bf870c89bcab8 upstream.
Set the correct voltage select register for LDO2.
--- drivers/regulator/rk808-regulator.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/regulator/rk808-regulator.c +1 -1
@@ -520,7 +520,7 @@ static const struct regulator_desc rk818 RK818_LDO1_ON_VSEL_REG, RK818_LDO_VSEL_MASK, RK818_LDO_EN_REG, BIT(0), 400),RK8XX_DESC (RK818_ID_LDO2 ,"LDO_REG2" ,"vcc6" ,1800 ,3400 ,100 , -RK818_LDO1_ON_VSEL_REG ,RK818_LDO_VSEL_MASK ,RK818_LDO_EN_REG , +RK818_LDO2_ON_VSEL_REG ,RK818_LDO_VSEL_MASK ,RK818_LDO_EN_REG , BIT(1), 400), { .name = "LDO_REG3",
Greg Kroah-Hartman
maintainerPATCH 42/164 regulator: tps65023: Fix inverted core enable logic.
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Cochran <[email protected]>
commit c90722b54a4f5e21ac59301ed9a6dbaa439bdb16 upstream.
Commit 43530b69d758328d3ffe6ab98fd640463e8e3667 ("regulator: Use regmap_read/write(), regmap_update_bits functions directly") intended to replace working inline helper functions with standard regmap calls. However, it also inverted the set/clear logic of the "CORE ADJ Allowed" bit. That patch was clearly never tested, since without that bit cleared, the core VDCDC1 voltage output does not react to I2C configuration changes.
This patch fixes the issue by clearing the bit as in the original, correct implementation. Note for stable back porting that, due to subsequent driver churn, this patch will not apply on every kernel version.
--- drivers/regulator/tps65023-regulator.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/regulator/tps65023-regulator.c +1 -2
@@ -311,8 +311,7 @@ static int tps_65023_probe(struct i2c_cl/* Enable setting output voltage by I2C */ regmap_update_bits (tps->regmap,TPS65023_REG_CON_CTRL2 , -TPS65023_REG_CTRL2_CORE_ADJ , -TPS65023_REG_CTRL2_CORE_ADJ ); +TPS65023_REG_CTRL2_CORE_ADJ ,0 );return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 43/164 s390/kdump: Add final note
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Holzheu <[email protected]>
commit dcc00b79fc3d076832f7240de8870f492629b171 upstream.
Since linux v3.14 with commit 38dfac843cb6d7be1 ("vmcore: prevent PT_NOTE p_memsz overflow during header update") on s390 we get the following message in the kdump kernel:
Warning: Exceeded p_memsz, dropping PT_NOTE entry n_namesz=0x6b6b6b6b, n_descsz=0x6b6b6b6b
The reason for this is that we don't create a final zero note in the ELF header which the proc/vmcore code uses to find out the end of the notes section (see also kernel/kexec_core.c:final_note()).
It still worked on s390 by chance because we (most of the time?) have the byte pattern 0x6b6b6b6b after the notes section which also makes the notes parsing code stop in update_note_header_size_elf64() because 0x6b6b6b6b is interpreded as note size:
if ((real_sz + sz) > max_sz) {
pr_warn("Warning: Exceeded p_memsz, dropping P ...);
break;
}So fix this and add the missing final note to the ELF header. We don't have to adjust the memory size for ELF header ("alloc_size") because the new ELF note still fits into the 0x1000 base memory.
--- arch/s390/kernel/crash_dump.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
arch/s390/kernel/crash_dump.c +15 -0
@@ -427,6 +427,20 @@ static void *nt_vmcoreinfo(void *ptr) }/* +* Initialize final note (needed for /proc/vmcore code) +*/ +static void *nt_final (void *ptr) +{ +Elf64_Nhdr *note; + + note = (Elf64_Nhdr *) ptr; + note->n_namesz =0 ; + note->n_descsz =0 ; + note->n_type =0 ; +return PTR_ADD (ptr,sizeof (Elf64_Nhdr)); +} + +/* * Initialize ELF header (new kernel) */ static void *ehdr_init (Elf64_Ehdr *ehdr,int mem_chunk_cnt)
@@ -513,6 +527,7 @@ static void *notes_init(Elf64_Phdr *phdrif (sa->prefix !=0 ) ptr =fill_cpu_elf_notes (ptr, cpu++, sa); ptr =nt_vmcoreinfo (ptr); + ptr =nt_final (ptr);memset (phdr,0 ,sizeof (*phdr)); phdr->p_type =PT_NOTE ; phdr->p_offset = notes_offset;
Greg Kroah-Hartman
maintainerPATCH 44/164 s390/cputime: fix incorrect system time
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Schwidefsky <[email protected]>
commit 07a63cbe8bcb6ba72fb989dcab1ec55ec6c36c7e upstream.
git commit c5328901aa1db134 "[S390] entry[64].S improvements" removed the update of the exit_timer lowcore field from the critical section cleanup of the .Lsysc_restore/.Lsysc_done and .Lio_restore/.Lio_done blocks. If the PSW is updated by the critical section cleanup to point to user space again, the interrupt entry code will do a vtime calculation after the cleanup completed with an exit_timer value which has *not* been updated. Due to this incorrect system time deltas are calculated.
If an interrupt occured with an old PSW between .Lsysc_restore/.Lsysc_done or .Lio_restore/.Lio_done update __LC_EXIT_TIMER with the system entry time of the interrupt.
--- arch/s390/kernel/entry.S | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-)
arch/s390/kernel/entry.S +18 -3
@@ -321,6 +321,7 @@ ENTRY(system_call) lg %r14,__LC_VDSO_PER_CPU lmg %r0,%r10,__PT_R0(%r11) mvc __LC_RETURN_PSW(16),__PT_PSW(%r11) +.Lsysc_exit_timer: stpt __LC_EXIT_TIMER mvc __VDSO_ECTG_BASE(16,%r14),__LC_EXIT_TIMER lmg %r11,%r15,__PT_R11(%r11)
@@ -606,6 +607,7 @@ ENTRY(io_int_handler) lg %r14,__LC_VDSO_PER_CPU lmg %r0,%r10,__PT_R0(%r11) mvc __LC_RETURN_PSW(16),__PT_PSW(%r11) +.Lio_exit_timer: stpt __LC_EXIT_TIMER mvc __VDSO_ECTG_BASE(16,%r14),__LC_EXIT_TIMER lmg %r11,%r15,__PT_R11(%r11)
@@ -1135,15 +1137,23 @@ cleanup_critical: br %r14 .Lcleanup_sysc_restore: + # check if stpt has been executed clg %r9,BASED(.Lcleanup_sysc_restore_insn) + jh 0f + mvc __LC_EXIT_TIMER(8),__LC_ASYNC_ENTER_TIMER + cghi %r11,__LC_SAVE_AREA_ASYNC je 0f + mvc __LC_EXIT_TIMER(8),__LC_MCCK_ENTER_TIMER +0: clg %r9,BASED(.Lcleanup_sysc_restore_insn+8) + je 1f lg %r9,24(%r11) # get saved pointer to pt_regs mvc __LC_RETURN_PSW(16),__PT_PSW(%r9) mvc 0(64,%r11),__PT_R8(%r9) lmg %r0,%r7,__PT_R0(%r9) -0: lmg %r8,%r9,__LC_RETURN_PSW +1: lmg %r8,%r9,__LC_RETURN_PSW br %r14 .Lcleanup_sysc_restore_insn: + .quad .Lsysc_exit_timer .quad .Lsysc_done - 4 .Lcleanup_io_tif:
@@ -1151,15 +1161,20 @@ cleanup_critical: br %r14 .Lcleanup_io_restore: + # check if stpt has been executed clg %r9,BASED(.Lcleanup_io_restore_insn) - je 0f + jh 0f + mvc __LC_EXIT_TIMER(8),__LC_MCCK_ENTER_TIMER +0: clg %r9,BASED(.Lcleanup_io_restore_insn+8) + je 1f lg %r9,24(%r11) # get saved r11 pointer to pt_regs mvc __LC_RETURN_PSW(16),__PT_PSW(%r9) mvc 0(64,%r11),__PT_R8(%r9) lmg %r0,%r7,__PT_R0(%r9) -0: lmg %r8,%r9,__LC_RETURN_PSW +1: lmg %r8,%r9,__LC_RETURN_PSW br %r14 .Lcleanup_io_restore_insn: + .quad .Lio_exit_timer .quad .Lio_done - 4 .Lcleanup_idle:
Greg Kroah-Hartman
maintainerPATCH 45/164 ath9k_htc: Add support of AirTies 1eda:2315 AR9271 device
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Tunin <[email protected]>
commit 16ff1fb0e32f76a5d285a6f23b82d21aa52813c6 upstream.
T: Bus=01 Lev=02 Prnt=02 Port=02 Cnt=01 Dev#= 7 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ff(vend.) Sub=ff Prot=ff MxPS=64 #Cfgs= 1 P: Vendor=1eda ProdID=2315 Rev=01.08 S: Manufacturer=ATHEROS S: Product=USB2.0 WLAN S: SerialNumber=12345 C: #Ifs= 1 Cfg#= 1 Atr=80 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 6 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none)
--- drivers/net/wireless/ath/ath9k/hif_usb.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/ath/ath9k/hif_usb.c +1 -0
@@ -37,6 +37,7 @@ static struct usb_device_id ath9k_hif_us { USB_DEVICE(0x0cf3, 0xb002) }, /* Ubiquiti WifiStation */ { USB_DEVICE(0x057c, 0x8403) }, /* AVM FRITZ!WLAN 11N v2 USB */ { USB_DEVICE(0x0471, 0x209e) }, /* Philips (or NXP) PTA01 */ + { USB_DEVICE(0x1eda, 0x2315) }, /* AirTies */ { USB_DEVICE(0x0cf3, 0x7015), .driver_info = AR9287_USB }, /* Atheros */
Greg Kroah-Hartman
maintainerPATCH 46/164 ath9k_htc: fix NULL-deref at probe
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit ebeb36670ecac36c179b5fb5d5c88ff03ba191ec upstream.
Make sure to check the number of endpoints to avoid dereferencing a NULL-pointer or accessing memory beyond the endpoint array should a malicious device lack the expected endpoints.
--- drivers/net/wireless/ath/ath9k/hif_usb.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/wireless/ath/ath9k/hif_usb.c +3 -0
@@ -1219,6 +1219,9 @@ static int send_eject_command(struct usbu8 bulk_out_ep;int r; +if (iface_desc->desc.bNumEndpoints <2 ) +return -ENODEV ; +/* Find bulk out endpoint */ for (r =1 ; r >=0 ; r--) { endpoint = &iface_desc->endpoint[r].desc;
Greg Kroah-Hartman
maintainerPATCH 47/164 drm/amdgpu: Make display watermark calculations more accurate
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Kleiner <[email protected]>
commit d63c277dc672e0c568481af043359420fa9d4736 upstream.
Avoid big roundoff errors in scanline/hactive durations for high pixel clocks, especially for >= 500 Mhz, and thereby program more accurate display fifo watermarks.
Implemented here for DCE 6,8,10,11. Successfully tested on DCE 10 with AMD R9 380 Tonga.
--- drivers/gpu/drm/amd/amdgpu/dce_v10_0.c | 10 +++++----- drivers/gpu/drm/amd/amdgpu/dce_v11_0.c | 10 +++++----- drivers/gpu/drm/amd/amdgpu/dce_v6_0.c | 10 +++++----- drivers/gpu/drm/amd/amdgpu/dce_v8_0.c | 10 +++++----- 4 files changed, 20 insertions(+), 20 deletions(-)
drivers/gpu/drm/amd/amdgpu/dce_v10_0.c +5 -5
@@ -1297,14 +1297,14 @@ static void dce_v10_0_program_watermarks {struct drm_display_mode *mode = &amdgpu_crtc->base.mode;struct dce10_wm_params wm_low, wm_high; -u32 pixel_period; +u32 active_time;u32 line_time =0 ;u32 latency_watermark_a =0 , latency_watermark_b =0 ;u32 tmp, wm_mask, lb_vblank_lead_lines =0 ;if (amdgpu_crtc->base.enabled && num_heads && mode) { - pixel_period =1000000 / (u32 )mode->clock; - line_time =min ((u32 )mode->crtc_htotal * pixel_period, (u32 )65535 ); + active_time =1000000UL * (u32 )mode->crtc_hdisplay / (u32 )mode->clock; + line_time =min ((u32) (1000000UL * (u32 )mode->crtc_htotal / (u32 )mode->clock), (u32 )65535 );/* watermark for high clocks */ if (adev->pm.dpm_enabled) {
@@ -1319,7 +1319,7 @@ static void dce_v10_0_program_watermarks wm_high.disp_clk = mode->clock; wm_high.src_width = mode->crtc_hdisplay; - wm_high.active_time = mode->crtc_hdisplay * pixel_period; + wm_high.active_time = active_time; wm_high.blank_time = line_time - wm_high.active_time; wm_high.interlaced = false;if (mode->flags &DRM_MODE_FLAG_INTERLACE )
@@ -1358,7 +1358,7 @@ static void dce_v10_0_program_watermarks wm_low.disp_clk = mode->clock; wm_low.src_width = mode->crtc_hdisplay; - wm_low.active_time = mode->crtc_hdisplay * pixel_period; + wm_low.active_time = active_time; wm_low.blank_time = line_time - wm_low.active_time; wm_low.interlaced = false;if (mode->flags &DRM_MODE_FLAG_INTERLACE )
drivers/gpu/drm/amd/amdgpu/dce_v11_0.c +5 -5
@@ -1264,14 +1264,14 @@ static void dce_v11_0_program_watermarks {struct drm_display_mode *mode = &amdgpu_crtc->base.mode;struct dce10_wm_params wm_low, wm_high; -u32 pixel_period; +u32 active_time;u32 line_time =0 ;u32 latency_watermark_a =0 , latency_watermark_b =0 ;u32 tmp, wm_mask, lb_vblank_lead_lines =0 ;if (amdgpu_crtc->base.enabled && num_heads && mode) { - pixel_period =1000000 / (u32 )mode->clock; - line_time =min ((u32 )mode->crtc_htotal * pixel_period, (u32 )65535 ); + active_time =1000000UL * (u32 )mode->crtc_hdisplay / (u32 )mode->clock; + line_time =min ((u32) (1000000UL * (u32 )mode->crtc_htotal / (u32 )mode->clock), (u32 )65535 );/* watermark for high clocks */ if (adev->pm.dpm_enabled) {
@@ -1286,7 +1286,7 @@ static void dce_v11_0_program_watermarks wm_high.disp_clk = mode->clock; wm_high.src_width = mode->crtc_hdisplay; - wm_high.active_time = mode->crtc_hdisplay * pixel_period; + wm_high.active_time = active_time; wm_high.blank_time = line_time - wm_high.active_time; wm_high.interlaced = false;if (mode->flags &DRM_MODE_FLAG_INTERLACE )
@@ -1325,7 +1325,7 @@ static void dce_v11_0_program_watermarks wm_low.disp_clk = mode->clock; wm_low.src_width = mode->crtc_hdisplay; - wm_low.active_time = mode->crtc_hdisplay * pixel_period; + wm_low.active_time = active_time; wm_low.blank_time = line_time - wm_low.active_time; wm_low.interlaced = false;if (mode->flags &DRM_MODE_FLAG_INTERLACE )
drivers/gpu/drm/amd/amdgpu/dce_v6_0.c +5 -5
@@ -1057,7 +1057,7 @@ static void dce_v6_0_program_watermarks(struct drm_display_mode *mode = &amdgpu_crtc->base.mode;struct dce6_wm_params wm_low, wm_high;u32 dram_channels; -u32 pixel_period; +u32 active_time;u32 line_time =0 ;u32 latency_watermark_a =0 , latency_watermark_b =0 ;u32 priority_a_mark =0 , priority_b_mark =0 ;
@@ -1067,8 +1067,8 @@ static void dce_v6_0_program_watermarks(fixed20_12 a, b, c;if (amdgpu_crtc->base.enabled && num_heads && mode) { - pixel_period =1000000 / (u32 )mode->clock; - line_time =min ((u32 )mode->crtc_htotal * pixel_period, (u32 )65535 ); + active_time =1000000UL * (u32 )mode->crtc_hdisplay / (u32 )mode->clock; + line_time =min ((u32) (1000000UL * (u32 )mode->crtc_htotal / (u32 )mode->clock), (u32 )65535 ); priority_a_cnt =0 ; priority_b_cnt =0 ;
@@ -1087,7 +1087,7 @@ static void dce_v6_0_program_watermarks( wm_high.disp_clk = mode->clock; wm_high.src_width = mode->crtc_hdisplay; - wm_high.active_time = mode->crtc_hdisplay * pixel_period; + wm_high.active_time = active_time; wm_high.blank_time = line_time - wm_high.active_time; wm_high.interlaced = false;if (mode->flags &DRM_MODE_FLAG_INTERLACE )
@@ -1114,7 +1114,7 @@ static void dce_v6_0_program_watermarks( wm_low.disp_clk = mode->clock; wm_low.src_width = mode->crtc_hdisplay; - wm_low.active_time = mode->crtc_hdisplay * pixel_period; + wm_low.active_time = active_time; wm_low.blank_time = line_time - wm_low.active_time; wm_low.interlaced = false;if (mode->flags &DRM_MODE_FLAG_INTERLACE )
drivers/gpu/drm/amd/amdgpu/dce_v8_0.c +5 -5
@@ -1218,14 +1218,14 @@ static void dce_v8_0_program_watermarks( {struct drm_display_mode *mode = &amdgpu_crtc->base.mode;struct dce8_wm_params wm_low, wm_high; -u32 pixel_period; +u32 active_time;u32 line_time =0 ;u32 latency_watermark_a =0 , latency_watermark_b =0 ;u32 tmp, wm_mask, lb_vblank_lead_lines =0 ;if (amdgpu_crtc->base.enabled && num_heads && mode) { - pixel_period =1000000 / (u32 )mode->clock; - line_time =min ((u32 )mode->crtc_htotal * pixel_period, (u32 )65535 ); + active_time =1000000UL * (u32 )mode->crtc_hdisplay / (u32 )mode->clock; + line_time =min ((u32) (1000000UL * (u32 )mode->crtc_htotal / (u32 )mode->clock), (u32 )65535 );/* watermark for high clocks */ if (adev->pm.dpm_enabled) {
@@ -1240,7 +1240,7 @@ static void dce_v8_0_program_watermarks( wm_high.disp_clk = mode->clock; wm_high.src_width = mode->crtc_hdisplay; - wm_high.active_time = mode->crtc_hdisplay * pixel_period; + wm_high.active_time = active_time; wm_high.blank_time = line_time - wm_high.active_time; wm_high.interlaced = false;if (mode->flags &DRM_MODE_FLAG_INTERLACE )
@@ -1279,7 +1279,7 @@ static void dce_v8_0_program_watermarks( wm_low.disp_clk = mode->clock; wm_low.src_width = mode->crtc_hdisplay; - wm_low.active_time = mode->crtc_hdisplay * pixel_period; + wm_low.active_time = active_time; wm_low.blank_time = line_time - wm_low.active_time; wm_low.interlaced = false;if (mode->flags &DRM_MODE_FLAG_INTERLACE )
Greg Kroah-Hartman
maintainerPATCH 48/164 drm/amdgpu: Avoid overflows/divide-by-zero in latency_watermark calculations.
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Kleiner <[email protected]>
commit e190ed1ea7458e446230de4113cc5d53b8dc4ec8 upstream.
At dot clocks > approx. 250 Mhz, some of these calcs will overflow and cause miscalculation of latency watermarks, and for some overflows also divide-by-zero driver crash ("divide error: 0000 [#1] PREEMPT SMP" in "dce_v10_0_latency_watermark+0x12d/0x190").
This zero-divide happened, e.g., on AMD Tonga Pro under DCE-10, on a Displayport panel when trying to set a video mode of 2560x1440 at 165 Hz vrefresh with a dot clock of 635.540 Mhz.
Refine calculations to avoid the overflows.
Tested for DCE-10 with R9 380 Tonga + ASUS ROG PG279 panel.
--- drivers/gpu/drm/amd/amdgpu/dce_v10_0.c | 19 +++---------------- drivers/gpu/drm/amd/amdgpu/dce_v11_0.c | 19 +++---------------- drivers/gpu/drm/amd/amdgpu/dce_v6_0.c | 19 +++---------------- drivers/gpu/drm/amd/amdgpu/dce_v8_0.c | 19 +++---------------- 4 files changed, 12 insertions(+), 64 deletions(-)
drivers/gpu/drm/amd/amdgpu/dce_v10_0.c +3 -16
@@ -1173,23 +1173,10 @@ static u32 dce_v10_0_latency_watermark(s a.full =dfixed_const (available_bandwidth); b.full =dfixed_const (wm->num_heads); a.full =dfixed_div (a, b); + tmp =div_u64 ((u64 ) dmif_size * (u64 ) wm->disp_clk, mc_latency +512 ); + tmp =min (dfixed_trunc (a), tmp); - b.full =dfixed_const (mc_latency +512 ); - c.full =dfixed_const (wm->disp_clk); - b.full =dfixed_div (b, c); - - c.full =dfixed_const (dmif_size); - b.full =dfixed_div (c, b); - - tmp =min (dfixed_trunc (a),dfixed_trunc (b)); - - b.full =dfixed_const (1000 ); - c.full =dfixed_const (wm->disp_clk); - b.full =dfixed_div (c, b); - c.full =dfixed_const (wm->bytes_per_pixel); - b.full =dfixed_mul (b, c); - - lb_fill_bw =min (tmp,dfixed_trunc (b)); + lb_fill_bw =min (tmp, wm->disp_clk * wm->bytes_per_pixel /1000 ); a.full =dfixed_const (max_src_lines_per_dst_line * wm->src_width * wm->bytes_per_pixel); b.full =dfixed_const (1000 );
drivers/gpu/drm/amd/amdgpu/dce_v11_0.c +3 -16
@@ -1140,23 +1140,10 @@ static u32 dce_v11_0_latency_watermark(s a.full =dfixed_const (available_bandwidth); b.full =dfixed_const (wm->num_heads); a.full =dfixed_div (a, b); + tmp =div_u64 ((u64 ) dmif_size * (u64 ) wm->disp_clk, mc_latency +512 ); + tmp =min (dfixed_trunc (a), tmp); - b.full =dfixed_const (mc_latency +512 ); - c.full =dfixed_const (wm->disp_clk); - b.full =dfixed_div (b, c); - - c.full =dfixed_const (dmif_size); - b.full =dfixed_div (c, b); - - tmp =min (dfixed_trunc (a),dfixed_trunc (b)); - - b.full =dfixed_const (1000 ); - c.full =dfixed_const (wm->disp_clk); - b.full =dfixed_div (c, b); - c.full =dfixed_const (wm->bytes_per_pixel); - b.full =dfixed_mul (b, c); - - lb_fill_bw =min (tmp,dfixed_trunc (b)); + lb_fill_bw =min (tmp, wm->disp_clk * wm->bytes_per_pixel /1000 ); a.full =dfixed_const (max_src_lines_per_dst_line * wm->src_width * wm->bytes_per_pixel); b.full =dfixed_const (1000 );
drivers/gpu/drm/amd/amdgpu/dce_v6_0.c +3 -16
@@ -932,23 +932,10 @@ static u32 dce_v6_0_latency_watermark(st a.full =dfixed_const (available_bandwidth); b.full =dfixed_const (wm->num_heads); a.full =dfixed_div (a, b); + tmp =div_u64 ((u64 ) dmif_size * (u64 ) wm->disp_clk, mc_latency +512 ); + tmp =min (dfixed_trunc (a), tmp); - b.full =dfixed_const (mc_latency +512 ); - c.full =dfixed_const (wm->disp_clk); - b.full =dfixed_div (b, c); - - c.full =dfixed_const (dmif_size); - b.full =dfixed_div (c, b); - - tmp =min (dfixed_trunc (a),dfixed_trunc (b)); - - b.full =dfixed_const (1000 ); - c.full =dfixed_const (wm->disp_clk); - b.full =dfixed_div (c, b); - c.full =dfixed_const (wm->bytes_per_pixel); - b.full =dfixed_mul (b, c); - - lb_fill_bw =min (tmp,dfixed_trunc (b)); + lb_fill_bw =min (tmp, wm->disp_clk * wm->bytes_per_pixel /1000 ); a.full =dfixed_const (max_src_lines_per_dst_line * wm->src_width * wm->bytes_per_pixel); b.full =dfixed_const (1000 );
drivers/gpu/drm/amd/amdgpu/dce_v8_0.c +3 -16
@@ -1094,23 +1094,10 @@ static u32 dce_v8_0_latency_watermark(st a.full =dfixed_const (available_bandwidth); b.full =dfixed_const (wm->num_heads); a.full =dfixed_div (a, b); + tmp =div_u64 ((u64 ) dmif_size * (u64 ) wm->disp_clk, mc_latency +512 ); + tmp =min (dfixed_trunc (a), tmp); - b.full =dfixed_const (mc_latency +512 ); - c.full =dfixed_const (wm->disp_clk); - b.full =dfixed_div (b, c); - - c.full =dfixed_const (dmif_size); - b.full =dfixed_div (c, b); - - tmp =min (dfixed_trunc (a),dfixed_trunc (b)); - - b.full =dfixed_const (1000 ); - c.full =dfixed_const (wm->disp_clk); - b.full =dfixed_div (c, b); - c.full =dfixed_const (wm->bytes_per_pixel); - b.full =dfixed_mul (b, c); - - lb_fill_bw =min (tmp,dfixed_trunc (b)); + lb_fill_bw =min (tmp, wm->disp_clk * wm->bytes_per_pixel /1000 ); a.full =dfixed_const (max_src_lines_per_dst_line * wm->src_width * wm->bytes_per_pixel); b.full =dfixed_const (1000 );
Greg Kroah-Hartman
maintainerPATCH 49/164 drm/amdgpu: Add missing lb_vblank_lead_lines setup to DCE-6 path.
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Kleiner <[email protected]>
commit effaf848b957fbf72a3b6a1ad87f5e031eda0b75 upstream.
This apparently got lost when implementing the new DCE-6 support and would cause failures in pageflip scheduling and timestamping.
--- drivers/gpu/drm/amd/amdgpu/dce_v6_0.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/dce_v6_0.c +6 -1
@@ -1050,7 +1050,7 @@ static void dce_v6_0_program_watermarks(u32 priority_a_mark =0 , priority_b_mark =0 ;u32 priority_a_cnt =PRIORITY_OFF ;u32 priority_b_cnt =PRIORITY_OFF ; -u32 tmp, arb_control3; +u32 tmp, arb_control3, lb_vblank_lead_lines =0 ;fixed20_12 a, b, c;if (amdgpu_crtc->base.enabled && num_heads && mode) {
@@ -1162,6 +1162,8 @@ static void dce_v6_0_program_watermarks( c.full =dfixed_div (c, a); priority_b_mark =dfixed_trunc (c); priority_b_cnt |= priority_b_mark &PRIORITY_MARK_MASK ; + + lb_vblank_lead_lines =DIV_ROUND_UP (lb_size, mode->crtc_hdisplay); }/* select wm A */
@@ -1191,6 +1193,9 @@ static void dce_v6_0_program_watermarks(/* save values for DPM */ amdgpu_crtc->line_time = line_time; amdgpu_crtc->wm_high = latency_watermark_a; + +/* Save number of lines the linebuffer leads before the scanout */ + amdgpu_crtc->lb_vblank_lead_lines = lb_vblank_lead_lines; }/* watermark setup */
Greg Kroah-Hartman
maintainerPATCH 50/164 drm/nouveau/therm: remove ineffective workarounds for alarm bugs
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Skeggs <[email protected]>
commit e4311ee51d1e2676001b2d8fcefd92bdd79aad85 upstream.
These were ineffective due to touching the list without the alarm lock, but should no longer be required.
--- drivers/gpu/drm/nouveau/nvkm/subdev/therm/base.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/therm/fan.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/therm/fantog.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/therm/temp.c | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-)
drivers/gpu/drm/nouveau/nvkm/subdev/therm/base.c +1 -1
@@ -130,7 +130,7 @@ nvkm_therm_update(struct nvkm_therm *the poll = false; } -if (list_empty (&therm->alarm.head) && poll) +if (poll)nvkm_timer_alarm (tmr,1000000000ULL , &therm->alarm);spin_unlock_irqrestore (&therm->lock, flags);
drivers/gpu/drm/nouveau/nvkm/subdev/therm/fan.c +1 -1
@@ -83,7 +83,7 @@ nvkm_fan_update(struct nvkm_fan *fan, bospin_unlock_irqrestore (&fan->lock, flags);/* schedule next fan update, if not at target speed already */ -if (list_empty (&fan->alarm.head) && target != duty) { +if (target != duty) {u16 bump_period = fan->bios.bump_period;u16 slow_down_period = fan->bios.slow_down_period;u64 delay;
drivers/gpu/drm/nouveau/nvkm/subdev/therm/fantog.c +1 -1
@@ -53,7 +53,7 @@ nvkm_fantog_update(struct nvkm_fantog *f duty = !nvkm_gpio_get (gpio,0 ,DCB_GPIO_FAN ,0xff );nvkm_gpio_set (gpio,0 ,DCB_GPIO_FAN ,0xff , duty); -if (list_empty (&fan->alarm.head) && percent != (duty *100 )) { +if (percent != (duty *100 )) {u64 next_change = (percent * fan->period_us) /100 ;if (!duty) next_change = fan->period_us - next_change;
drivers/gpu/drm/nouveau/nvkm/subdev/therm/temp.c +1 -1
@@ -185,7 +185,7 @@ alarm_timer_callback(struct nvkm_alarm *spin_unlock_irqrestore (&therm->sensor.alarm_program_lock, flags);/* schedule the next poll in one second */ -if (therm->func->temp_get (therm) >=0 &&list_empty (&alarm->head)) +if (therm->func->temp_get (therm) >=0 )nvkm_timer_alarm (tmr,1000000000ULL , alarm); }
Greg Kroah-Hartman
maintainerPATCH 51/164 drm/nouveau/tmr: ack interrupt before processing alarms
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Skeggs <[email protected]>
commit 3733bd8b407211739e72d051e5f30ad82a52c4bc upstream.
Fixes a race where we can miss an alarm that triggers while we're already processing previous alarms.
--- drivers/gpu/drm/nouveau/nvkm/subdev/timer/nv04.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/nouveau/nvkm/subdev/timer/nv04.c +1 -1
@@ -76,8 +76,8 @@ nv04_timer_intr(struct nvkm_timer *tmr)u32 stat =nvkm_rd32 (device,NV04_PTIMER_INTR_0 );if (stat &0x00000001 ) { -nvkm_timer_alarm_trigger (tmr);nvkm_wr32 (device,NV04_PTIMER_INTR_0 ,0x00000001 ); +nvkm_timer_alarm_trigger (tmr); stat &= ~0x00000001 ; }
Greg Kroah-Hartman
maintainerPATCH 52/164 drm/nouveau/tmr: fix corruption of the pending list when rescheduling an alarm
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Skeggs <[email protected]>
commit 9fc64667ee48c9a25e7dca1a6bcb6906fec5bcc5 upstream.
At least therm/fantog "attempts" to work around this issue, which could lead to corruption of the pending alarm list.
Fix it properly by not updating the timestamp without the lock held, or trying to add an already pending alarm to the pending alarm list....
--- drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-)
drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c +10 -7
@@ -65,14 +65,17 @@ nvkm_timer_alarm(struct nvkm_timer *tmr,struct nvkm_alarm *list;unsigned long flags; - alarm->timestamp =nvkm_timer_read (tmr) + nsec; - -/* append new alarm to list, in soonest-alarm-first order */ +/* Remove alarm from pending list. +* +* This both protects against the corruption of the list, +* and implements alarm rescheduling/cancellation. +*/ spin_lock_irqsave (&tmr->lock, flags); -if (!nsec) { -if (!list_empty (&alarm->head)) -list_del (&alarm->head); - }else { +list_del_init (&alarm->head); + +if (nsec) { +/* Insert into pending list, ordered earliest to latest. */ + alarm->timestamp =nvkm_timer_read (tmr) + nsec;list_for_each_entry (list, &tmr->alarms, head) {if (list->timestamp > alarm->timestamp)break ;
Greg Kroah-Hartman
maintainerPATCH 53/164 drm/nouveau/tmr: avoid processing completed alarms when adding a new one
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Skeggs <[email protected]>
commit 330bdf62fe6a6c5b99a647f7bf7157107c9348b3 upstream.
The idea here was to avoid having to "manually" program the HW if there's a new earliest alarm. This was lazy and bad, as it leads to loads of fun races between inter-related callers (ie. therm).
Turns out, it's not so difficult after all. Go figure ;)
--- drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-)
drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c +13 -3
@@ -80,12 +80,22 @@ nvkm_timer_alarm(struct nvkm_timer *tmr,if (list->timestamp > alarm->timestamp)break ; } +list_add_tail (&alarm->head, &list->head); + +/* Update HW if this is now the earliest alarm. */ + list =list_first_entry (&tmr->alarms,typeof (*list), head); +if (list == alarm) { + tmr->func->alarm_init (tmr, alarm->timestamp); +/* This shouldn't happen if callers aren't stupid. +* +* Worst case scenario is that it'll take roughly +* 4 seconds for the next alarm to trigger. +*/ +WARN_ON (alarm->timestamp <=nvkm_timer_read (tmr)); + } }spin_unlock_irqrestore (&tmr->lock, flags); - -/* process pending alarms */ -nvkm_timer_alarm_trigger (tmr); }void
Greg Kroah-Hartman
maintainerPATCH 54/164 drm/nouveau/tmr: handle races with hw when updating the next alarm time
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Skeggs <[email protected]>
commit 1b0f84380b10ee97f7d2dd191294de9017e94d1d upstream.
If the time to the next alarm is short enough, we could race with HW and end up with an ~4 second delay until it triggers.
Fix this by checking again after we update HW.
--- drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c | 26 ++++++++++++++--------- 1 file changed, 16 insertions(+), 10 deletions(-)
drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c +16 -10
@@ -36,23 +36,29 @@ nvkm_timer_alarm_trigger(struct nvkm_timunsigned long flags;LIST_HEAD (exec); -/* move any due alarms off the pending list */ +/* Process pending alarms. */ spin_lock_irqsave (&tmr->lock, flags);list_for_each_entry_safe (alarm, atemp, &tmr->alarms, head) { -if (alarm->timestamp <=nvkm_timer_read (tmr)) -list_move_tail (&alarm->head, &exec); +/* Have we hit the earliest alarm that hasn't gone off? */ +if (alarm->timestamp >nvkm_timer_read (tmr)) { +/* Schedule it. If we didn't race, we're done. */ + tmr->func->alarm_init (tmr, alarm->timestamp); +if (alarm->timestamp >nvkm_timer_read (tmr)) +break ; + } + +/* Move to completed list. We'll drop the lock before +* executing the callback so it can reschedule itself. +*/ +list_move_tail (&alarm->head, &exec); } -/* reschedule interrupt for next alarm time */ -if (!list_empty (&tmr->alarms)) { - alarm =list_first_entry (&tmr->alarms,typeof (*alarm), head); - tmr->func->alarm_init (tmr, alarm->timestamp); - }else { +/* Shut down interrupt if no more pending alarms. */ +if (list_empty (&tmr->alarms)) tmr->func->alarm_fini (tmr); - }spin_unlock_irqrestore (&tmr->lock, flags); -/* execute any pending alarm handlers */ +/* Execute completed callbacks. */ list_for_each_entry_safe (alarm, atemp, &exec, head) {list_del_init (&alarm->head); alarm->func (alarm);
Greg Kroah-Hartman
maintainerPATCH 55/164 gpio: omap: return error if requested debounce time is not possible
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Rivshin <[email protected]>
commit 83977443938122baeed28dc9f078db3da9855f7c upstream.
omap_gpio_debounce() does not validate that the requested debounce is within a range it can handle. Instead it lets the register value wrap silently, and always returns success.
This can lead to all sorts of unexpected behavior, such as gpio_keys asking for a too-long debounce, but getting a very short debounce in practice.
Fix this by returning -EINVAL if the requested value does not fit into the register field. If there is no debounce clock available at all, return -ENOTSUPP.
--- drivers/gpio/gpio-omap.c | 23 +++++++++++++++++------ 1 file changed, 17 insertions(+), 6 deletions(-)
drivers/gpio/gpio-omap.c +17 -6
@@ -208,9 +208,11 @@ static inline void omap_gpio_dbck_disabl* OMAP's debounce time is in 31us steps * <debounce time> = (GPIO_DEBOUNCINGTIME[7:0].DEBOUNCETIME + 1) x 31 * so we need to convert and round up to the closest unit. +* +* Return: 0 on success, negative error otherwise. */ -static void omap2_set_gpio_debounce (struct gpio_bank *bank,unsigned offset, -unsigned debounce) +static int omap2_set_gpio_debounce (struct gpio_bank *bank,unsigned offset, +unsigned debounce) {void __iomem *reg;u32 val;
@@ -218,11 +220,12 @@ static void omap2_set_gpio_debounce(strubool enable = !!debounce;if (!bank->dbck_flag) -return ; +return -ENOTSUPP ;if (enable) { debounce =DIV_ROUND_UP (debounce,31 ) -1 ; - debounce &=OMAP4_GPIO_DEBOUNCINGTIME_MASK ; +if ((debounce &OMAP4_GPIO_DEBOUNCINGTIME_MASK ) != debounce) +return -EINVAL ; } l =BIT (offset);
@@ -255,6 +258,8 @@ static void omap2_set_gpio_debounce(stru bank->context.debounce = debounce; bank->context.debounce_en = val; } + +return 0 ; }/**
@@ -964,14 +969,20 @@ static int omap_gpio_debounce(struct gpi {struct gpio_bank *bank;unsigned long flags; +int ret; bank =gpiochip_get_data (chip);raw_spin_lock_irqsave (&bank->lock, flags); -omap2_set_gpio_debounce (bank, offset, debounce); + ret =omap2_set_gpio_debounce (bank, offset, debounce);raw_spin_unlock_irqrestore (&bank->lock, flags); -return 0 ; +if (ret) +dev_info (chip->parent, +"Could not set line %u debounce to %u microseconds (%d)" , + offset, debounce, ret); + +return ret; }static void omap_gpio_set (struct gpio_chip *chip,unsigned offset,int value)
Greg Kroah-Hartman
maintainerPATCH 56/164 cdc-acm: fix possible invalid access when processing notification
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tobias Herzog <[email protected]>
commit 1bb9914e1730417d530de9ed37e59efdc647146b upstream.
Notifications may only be 8 bytes long. Accessing the 9th and 10th byte of unimplemented/unknown notifications may be insecure. Also check the length of known notifications before accessing anything behind the 8th byte.
--- drivers/usb/class/cdc-acm.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
drivers/usb/class/cdc-acm.c +9 -4
@@ -311,6 +311,12 @@ static void acm_ctrl_irq(struct urb *urbbreak ;case USB_CDC_NOTIFY_SERIAL_STATE : +if (le16_to_cpu (dr->wLength) !=2 ) { +dev_dbg (&acm->control->dev, +"%s - malformed serial state\n" , __func__); +break ; + } + newctrl =get_unaligned_le16 (data);if (!acm->clocal && (acm->ctrlin & ~newctrl &ACM_CTRL_DCD )) {
@@ -347,11 +353,10 @@ static void acm_ctrl_irq(struct urb *urbdefault :dev_dbg (&acm->control->dev, -"%s - unknown notification %d received: index %d " -"len %d data0 %d data1 %d\n" , +"%s - unknown notification %d received: index %d len %d\n" , __func__, - dr->bNotificationType, dr->wIndex, - dr->wLength, data[0 ], data[1 ]); + dr->bNotificationType, dr->wIndex, dr->wLength); +break ; } exit:
Greg Kroah-Hartman
maintainerPATCH 57/164 ohci-pci: add qemu quirk
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gerd Hoffmann <[email protected]>
commit 21a60f6e65181cad64fd66ccc8080d413721ba27 upstream.
On a loaded virtualization host (dozen guests booting at the same time) it may happen that the ohci controller emulation doesn't manage to do timely frame processing, with the result that the io watchdog fires and considers the controller being dead, even though it's only the emulation being unusual slow due to the load peak.
So, add a quirk for qemu and don't use the watchdog in case we figure we are running on emulated ohci. The virtual ohci controller masquerades as apple ohci controller, but we can identify it by subsystem id.
--- drivers/usb/host/ohci-hcd.c | 3 ++- drivers/usb/host/ohci-pci.c | 16 ++++++++++++++++ drivers/usb/host/ohci.h | 1 + 3 files changed, 19 insertions(+), 1 deletion(-)
drivers/usb/host/ohci-hcd.c +2 -1
@@ -231,7 +231,8 @@ static int ohci_urb_enqueue (/* Start up the I/O watchdog timer, if it's not running */ if (!timer_pending (&ohci->io_watchdog) && -list_empty (&ohci->eds_in_use)) { +list_empty (&ohci->eds_in_use) && + !(ohci->flags &OHCI_QUIRK_QEMU )) { ohci->prev_frame_no =ohci_frame_no (ohci);mod_timer (&ohci->io_watchdog, jiffies +IO_WATCHDOG_DELAY );
drivers/usb/host/ohci-pci.c +16 -0
@@ -164,6 +164,15 @@ static int ohci_quirk_amd700(struct usb_return 0 ; } +static int ohci_quirk_qemu (struct usb_hcd *hcd) +{ +struct ohci_hcd *ohci =hcd_to_ohci (hcd); + + ohci->flags |=OHCI_QUIRK_QEMU ; +ohci_dbg (ohci,"enabled qemu quirk\n" ); +return 0 ; +} +/* List of quirks for OHCI */ static const struct pci_device_id ohci_pci_quirks[] = { {
@@ -214,6 +223,13 @@ static const struct pci_device_id ohci_p PCI_DEVICE(PCI_VENDOR_ID_ATI, 0x4399), .driver_data = (unsigned long)ohci_quirk_amd700, }, + { + .vendor = PCI_VENDOR_ID_APPLE, + .device = 0x003f, + .subvendor = PCI_SUBVENDOR_ID_REDHAT_QUMRANET, + .subdevice = PCI_SUBDEVICE_ID_QEMU, + .driver_data = (unsigned long)ohci_quirk_qemu, + },/* FIXME for some of the early AMD 760 southbridges, OHCI * won't work at all. blacklist them.
drivers/usb/host/ohci.h +1 -0
@@ -418,6 +418,7 @@ struct ohci_hcd {#define OHCI_QUIRK_AMD_PLL 0x200/* AMD PLL quirk*/ #define OHCI_QUIRK_AMD_PREFETCH 0x400/* pre-fetch for ISO transfer */ #define OHCI_QUIRK_GLOBAL_SUSPEND 0x800/* must suspend ports */ +#define OHCI_QUIRK_QEMU 0x1000/* relax timing expectations */ // there are also chip quirks/bugs in init logic
Greg Kroah-Hartman
maintainerPATCH 58/164 cxl: Force context lock during EEH flow
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vaibhav Jain <[email protected]>
commit ea9a26d117cf0637c71d3e0076f4a124bf5859df upstream.
During an eeh event when the cxl card is fenced and card sysfs attr perst_reloads_same_image is set following warning message is seen in the kernel logs:
Adapter context unlocked with 0 active contexts
------------[ cut here ]------------ WARNING: CPU: 12 PID: 627 at ../drivers/misc/cxl/main.c:325 cxl_adapter_context_unlock+0x60/0x80 [cxl]
Even though this warning is harmless, it clutters the kernel log during an eeh event. This warning is triggered as the EEH callback cxl_pci_error_detected doesn't obtain a context-lock before forcibly detaching all active context and when context-lock is released during call to cxl_configure_adapter from cxl_pci_slot_reset, a warning in cxl_adapter_context_unlock is triggered.
To fix this warning, we acquire the adapter context-lock via cxl_adapter_context_lock() in the eeh callback cxl_pci_error_detected() once all the virtual AFU PHBs are notified and their contexts detached. The context-lock is released in cxl_pci_slot_reset() after the adapter is successfully reconfigured and before the we call the slot_reset callback on slice attached device-drivers.
--- drivers/misc/cxl/pci.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-)
drivers/misc/cxl/pci.c +17 -2
@@ -1496,8 +1496,6 @@ static int cxl_configure_adapter(structif ((rc =cxl_native_register_psl_err_irq (adapter))) goto err; -/* Release the context lock as adapter is configured */ -cxl_adapter_context_unlock (adapter);return 0 ; err:
@@ -1596,6 +1594,9 @@ static struct cxl *cxl_pci_init_adapter(if ((rc =cxl_sysfs_adapter_add (adapter))) goto err_put1; +/* Release the context lock as adapter is configured */ +cxl_adapter_context_unlock (adapter); +return adapter; err_put1:
@@ -1893,6 +1894,13 @@ static pci_ers_result_t cxl_pci_error_de cxl_ops->afu_deactivate_mode (afu, afu->current_mode);pci_deconfigure_afu (afu); } + +/* should take the context lock here */ +if (cxl_adapter_context_lock (adapter) !=0 ) +dev_warn (&adapter->dev, +"Couldn't take context lock with %d active-contexts\n" , +atomic_read (&adapter->contexts_num)); +cxl_deconfigure_adapter (adapter);return result;
@@ -1911,6 +1919,13 @@ static pci_ers_result_t cxl_pci_slot_resif (cxl_configure_adapter (adapter, pdev)) goto err; +/* +* Unlock context activation for the adapter. Ideally this should be +* done in cxl_pci_resume but cxlflash module tries to activate the +* master context as part of slot_reset callback. +*/ +cxl_adapter_context_unlock (adapter); +for (i =0 ; i < adapter->slices; i++) { afu = adapter->afu[i];
Greg Kroah-Hartman
maintainerPATCH 59/164 cxl: Route eeh events to all drivers in cxl_pci_error_detected()
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vaibhav Jain <[email protected]>
commit 4f58f0bf155e87dda31a3088b1e107fa9dd79f0e upstream.
Fix a boundary condition where in some cases an eeh event that results in card reset isn't passed on to a driver attached to the virtual PCI device associated with a slice. This will happen in case when a slice attached device driver returns a value other than PCI_ERS_RESULT_NEED_RESET from the eeh error_detected() callback. This would result in an early return from cxl_pci_error_detected() and other drivers attached to other AFUs on the card wont be notified.
The patch fixes this by making sure that all slice attached device-drivers are notified and the return values from error_detected() callback are aggregated in a scheme where request for 'disconnect' trumps all and 'none' trumps 'need_reset'.
--- drivers/misc/cxl/pci.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)
drivers/misc/cxl/pci.c +9 -6
@@ -1779,7 +1779,7 @@ static pci_ers_result_t cxl_pci_error_de {struct cxl *adapter =pci_get_drvdata (pdev);struct cxl_afu *afu; -pci_ers_result_t result =PCI_ERS_RESULT_NEED_RESET ; +pci_ers_result_t result =PCI_ERS_RESULT_NEED_RESET , afu_result;int i;/* At this point, we could still have an interrupt pending.
@@ -1884,15 +1884,18 @@ static pci_ers_result_t cxl_pci_error_defor (i =0 ; i < adapter->slices; i++) { afu = adapter->afu[i]; - result =cxl_vphb_error_detected (afu, state); - -/* Only continue if everyone agrees on NEED_RESET */ -if (result !=PCI_ERS_RESULT_NEED_RESET ) -return result; + afu_result =cxl_vphb_error_detected (afu, state);cxl_context_detach_all (afu); cxl_ops->afu_deactivate_mode (afu, afu->current_mode);pci_deconfigure_afu (afu); + +/* Disconnect trumps all, NONE trumps NEED_RESET */ +if (afu_result ==PCI_ERS_RESULT_DISCONNECT ) + result =PCI_ERS_RESULT_DISCONNECT ; +else if ((afu_result ==PCI_ERS_RESULT_NONE ) && + (result ==PCI_ERS_RESULT_NEED_RESET )) + result =PCI_ERS_RESULT_NONE ; }/* should take the context lock here */
Greg Kroah-Hartman
maintainerPATCH 60/164 proc: Fix unbalanced hard link numbers
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit d66bb1607e2d8d384e53f3d93db5c18483c8c4f7 upstream.
proc_create_mount_point() forgot to increase the parent's nlink, and it resulted in unbalanced hard link numbers, e.g. /proc/fs shows one less than expected.
--- fs/proc/generic.c | 1 + 1 file changed, 1 insertion(+)
fs/proc/generic.c +1 -0
@@ -471,6 +471,7 @@ struct proc_dir_entry *proc_create_mount ent->data =NULL ; ent->proc_fops =NULL ; ent->proc_iops =NULL ; + parent->nlink++;if (proc_register (parent, ent) <0 ) {kfree (ent); parent->nlink--;
Greg Kroah-Hartman
maintainerPATCH 61/164 of: fix sparse warning in of_pci_range_parser_one
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Herring <[email protected]>
commit eb3100365791b06242b8bb5c3c2854ba41dabfbc upstream.
sparse gives the following warning for 'pci_space':
../drivers/of/address.c:266:26: warning: incorrect type in assignment (different base types)../drivers/of/address.c:266:26: expected unsigned int [unsigned] [usertype] pci_space../drivers/of/address.c:266:26: got restricted __be32 const [usertype] <noident>
It appears that pci_space is only ever accessed on powerpc, so the endian swap is often not needed.
--- drivers/of/address.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/of/address.c +1 -1
@@ -263,7 +263,7 @@ struct of_pci_range *of_pci_range_parserif (!parser->range || parser->range + parser->np > parser->end)return NULL ; - range->pci_space = parser->range[0 ]; + range->pci_space =be32_to_cpup (parser->range); range->flags =of_bus_pci_get_flags (parser->range); range->pci_addr =of_read_number (parser->range +1 , ns); range->cpu_addr = of_translate_address(parser->node,
Greg Kroah-Hartman
maintainerPATCH 62/164 of: fix "/cpus" reference leak in of_numa_parse_cpu_nodes()
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tyrel Datwyler <[email protected]>
commit b8475cbee5ab2eac05f9cd5dbcc94c453d3cbf10 upstream.
The call to of_find_node_by_path("/cpus") returns the cpus device_node with its reference count incremented. There is no matching of_node_put() call in of_numa_parse_cpu_nodes() which results in a leaked reference to the "/cpus" node.
This patch adds an of_node_put() to release the reference.
--- drivers/of/of_numa.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/of/of_numa.c +2 -0
@@ -57,6 +57,8 @@ static void __init of_numa_parse_cpu_nodelse node_set (nid, numa_nodes_parsed); } + +of_node_put (cpus); }static int __init of_numa_parse_memory_nodes (void )
Greg Kroah-Hartman
maintainerPATCH 63/164 of: fdt: add missing allocation-failure check
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 49e67dd17649b60b4d54966e18ec9c80198227f0 upstream.
The memory allocator passed to __unflatten_device_tree() (e.g. a wrapped kzalloc) can fail so add the missing sanity check to avoid dereferencing a NULL pointer.
--- drivers/of/fdt.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/of/fdt.c +3 -0
@@ -505,6 +505,9 @@ static void *__unflatten_device_tree(con/* Allocate memory for the expanded device tree */ mem =dt_alloc (size +4 , __alignof__(struct device_node )); +if (!mem) +return NULL ; +memset (mem,0 , size); *(__be32 *)(mem + size) =cpu_to_be32 (0xdeadbeef );
Greg Kroah-Hartman
maintainerPATCH 64/164 ibmvscsis: Do not send aborted task response
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryant G. Ly <[email protected]>
commit 25e78531268e9240fc594ce76587601b873d37c9 upstream.
The driver is sending a response to the actual scsi op that was aborted by an abort task TM, while LIO is sending a response to the abort task TM.
ibmvscsis_tgt does not send the response to the client until release_cmd time. The reason for this was because if we did it at queue_status time, then the client would be free to reuse the tag for that command, but we're still using the tag until the command is released at release_cmd time, so we chose to delay sending the response until then. That then caused this issue, because release_cmd is always called, even if queue_status is not.
SCSI spec says that the initiator that sends the abort task TM NEVER gets a response to the aborted op and with the current code it will send a response. Thus this fix will remove that response if the CMD_T_ABORTED && !CMD_T_TAS.
Another case with a small timing window is the case where if LIO sends a TMR_DOES_NOT_EXIST, and the release_cmd callback is called for the TMR Abort cmd before the release_cmd for the (attemped) aborted cmd, then we need to ensure that we send the response for the (attempted) abort cmd to the client before we send the response for the TMR Abort cmd.
--- drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c | 120 +++++++++++++++++++++++-------- drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.h | 2 2 files changed, 94 insertions(+), 28 deletions(-)
drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c +92 -28
@@ -1169,6 +1169,7 @@ static struct ibmvscsis_cmd *ibmvscsis_g cmd =list_first_entry_or_null (&vscsi->free_cmd, struct ibmvscsis_cmd, list);if (cmd) { + cmd->flags &= ~(DELAY_SEND );list_del (&cmd->list); cmd->iue = iue; cmd->type =UNSET_TYPE ;
@@ -1748,45 +1749,79 @@ static void srp_snd_msg_failed(struct scstatic void ibmvscsis_send_messages (struct scsi_info *vscsi) {u64 msg_hi =0 ; -/* note do not attmempt to access the IU_data_ptr with this pointer +/* note do not attempt to access the IU_data_ptr with this pointer * it is not valid */ struct viosrp_crq *crq = (struct viosrp_crq *)&msg_hi;struct ibmvscsis_cmd *cmd, *nxt;struct iu_entry *iue;long rc =ADAPT_SUCCESS ; +bool retry = false;if (!(vscsi->flags &RESPONSE_Q_DOWN )) { -list_for_each_entry_safe (cmd, nxt, &vscsi->waiting_rsp, list) { - iue = cmd->iue; - - crq->valid =VALID_CMD_RESP_EL ; - crq->format = cmd->rsp.format; - -if (cmd->flags &CMD_FAST_FAIL ) - crq->status =VIOSRP_ADAPTER_FAIL ; - - crq->IU_length =cpu_to_be16 (cmd->rsp.len); +do { + retry = false; +list_for_each_entry_safe (cmd, nxt, &vscsi->waiting_rsp, + list) { +/* +* Check to make sure abort cmd gets processed +* prior to the abort tmr cmd +*/ +if (cmd->flags &DELAY_SEND ) +continue ; - rc =h_send_crq (vscsi->dma_dev->unit_address, -be64_to_cpu (msg_hi), -be64_to_cpu (cmd->rsp.tag)); +if (cmd->abort_cmd) { + retry = true; + cmd->abort_cmd->flags &= ~(DELAY_SEND ); + } -pr_debug ("send_messages: cmd %p, tag 0x%llx, rc %ld\n" , - cmd,be64_to_cpu (cmd->rsp.tag), rc); +/* +* If CMD_T_ABORTED w/o CMD_T_TAS scenarios and +* the case where LIO issued a +* ABORT_TASK: Sending TMR_TASK_DOES_NOT_EXIST +* case then we dont send a response, since it +* was already done. +*/ +if (cmd->se_cmd.transport_state &CMD_T_ABORTED && + !(cmd->se_cmd.transport_state &CMD_T_TAS )) { +list_del (&cmd->list); +ibmvscsis_free_cmd_resources (vscsi, + cmd); + }else { + iue = cmd->iue; + + crq->valid =VALID_CMD_RESP_EL ; + crq->format = cmd->rsp.format; + +if (cmd->flags &CMD_FAST_FAIL ) + crq->status =VIOSRP_ADAPTER_FAIL ; + + crq->IU_length =cpu_to_be16 (cmd->rsp.len); + + rc =h_send_crq (vscsi->dma_dev->unit_address, +be64_to_cpu (msg_hi), +be64_to_cpu (cmd->rsp.tag)); -/* if all ok free up the command element resources */ -if (rc ==H_SUCCESS ) { -/* some movement has occurred */ - vscsi->rsp_q_timer.timer_pops =0 ; -list_del (&cmd->list); +pr_debug ("send_messages: cmd %p, tag 0x%llx, rc %ld\n" , + cmd,be64_to_cpu (cmd->rsp.tag), rc); -ibmvscsis_free_cmd_resources (vscsi, cmd); - }else { -srp_snd_msg_failed (vscsi, rc); -break ; +/* if all ok free up the command +* element resources +*/ +if (rc ==H_SUCCESS ) { +/* some movement has occurred */ + vscsi->rsp_q_timer.timer_pops =0 ; +list_del (&cmd->list); + +ibmvscsis_free_cmd_resources (vscsi, + cmd); + }else { +srp_snd_msg_failed (vscsi, rc); +break ; + } + } } - } + }while (retry);if (!rc) {/*
@@ -2707,6 +2742,7 @@ static int ibmvscsis_alloc_cmds(struct sfor (i =0 , cmd = (struct ibmvscsis_cmd *)vscsi->cmd_pool; i < num; i++, cmd++) { + cmd->abort_cmd =NULL ; cmd->adapter = vscsi;INIT_WORK (&cmd->work, ibmvscsis_scheduler);list_add_tail (&cmd->list, &vscsi->free_cmd);
@@ -3578,9 +3614,20 @@ static int ibmvscsis_write_pending(struc { struct ibmvscsis_cmd *cmd = container_of(se_cmd, struct ibmvscsis_cmd, se_cmd); +struct scsi_info *vscsi = cmd->adapter;struct iu_entry *iue = cmd->iue;int rc; +/* +* If CLIENT_FAILED OR RESPONSE_Q_DOWN, then just return success +* since LIO can't do anything about it, and we dont want to +* attempt an srp_transfer_data. +*/ +if ((vscsi->flags & (CLIENT_FAILED |RESPONSE_Q_DOWN ))) { +pr_err ("write_pending failed since: %d\n" , vscsi->flags); +return 0 ; + } + rc =srp_transfer_data (cmd, &vio_iu (iue)->srp.cmd, ibmvscsis_rdma,1 ,1 );if (rc) {
@@ -3659,11 +3706,28 @@ static void ibmvscsis_queue_tm_rsp(struc struct ibmvscsis_cmd *cmd = container_of(se_cmd, struct ibmvscsis_cmd, se_cmd);struct scsi_info *vscsi = cmd->adapter; +struct ibmvscsis_cmd *cmd_itr; +struct iu_entry *iue = iue = cmd->iue; +struct srp_tsk_mgmt *srp_tsk = &vio_iu (iue)->srp.tsk_mgmt; +u64 tag_to_abort =be64_to_cpu (srp_tsk->task_tag);uint len;pr_debug ("queue_tm_rsp %p, status %d\n" , se_cmd, (int )se_cmd->se_tmr_req->response); +if (srp_tsk->tsk_mgmt_func ==SRP_TSK_ABORT_TASK && + cmd->se_cmd.se_tmr_req->response ==TMR_TASK_DOES_NOT_EXIST ) { +spin_lock_bh (&vscsi->intr_lock); +list_for_each_entry (cmd_itr, &vscsi->active_q, list) { +if (tag_to_abort == cmd_itr->se_cmd.tag) { + cmd_itr->abort_cmd = cmd; + cmd->flags |=DELAY_SEND ; +break ; + } + } +spin_unlock_bh (&vscsi->intr_lock); + } +srp_build_response (vscsi, cmd, &len); cmd->rsp.format =SRP_FORMAT ; cmd->rsp.len = len;
@@ -3671,8 +3735,8 @@ static void ibmvscsis_queue_tm_rsp(strucstatic void ibmvscsis_aborted_task (struct se_cmd *se_cmd) { -/* TBD: What (if anything) should we do here? */ -pr_debug ("ibmvscsis_aborted_task %p\n" , se_cmd); +pr_debug ("ibmvscsis_aborted_task %p task_tag: %llu\n" , + se_cmd, se_cmd->tag); } static struct se_wwn *ibmvscsis_make_tport(struct target_fabric_configfs *tf,
drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.h +2 -0
@@ -167,10 +167,12 @@ struct ibmvscsis_cmd {struct iu_rsp rsp;struct work_struct work;struct scsi_info *adapter; +struct ibmvscsis_cmd *abort_cmd;/* Sense buffer that will be mapped into outgoing status */ unsigned char sense_buf[TRANSPORT_SENSE_BUFFER ];u64 init_time;#define CMD_FAST_FAIL BIT(0) +#define DELAY_SEND BIT(1)u32 flags;char type; };
Greg Kroah-Hartman
maintainerPATCH 65/164 iio: dac: ad7303: fix channel description
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Roskin <[email protected]>
commit ce420fd4251809b4c3119b3b20c8b13bd8eba150 upstream.
realbits, storagebits and shift should be numbers, not ASCII characters.
--- drivers/iio/dac/ad7303.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/iio/dac/ad7303.c +3 -3
@@ -184,9 +184,9 @@ static const struct iio_chan_spec_ext_in .address = (chan), \ .scan_type = { \ .sign = 'u', \ - .realbits = '8', \ - .storagebits = '8', \ - .shift = '0', \ + .realbits = 8, \ + .storagebits = 8, \ + .shift = 0, \ }, \ .ext_info = ad7303_ext_info, \ }
Greg Kroah-Hartman
maintainerPATCH 66/164 IIO: bmp280-core.c: fix error in humidity calculation
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Klinger <[email protected]>
commit ed3730c435f1a9f9559ed7762035d22d8a95adfe upstream.
While calculating the compensation of the humidity there are negative values interpreted as unsigned because of unsigned variables used. These values as well as the constants need to be casted to signed as indicated by the documentation of the sensor.
--- drivers/iio/pressure/bmp280-core.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
drivers/iio/pressure/bmp280-core.c +6 -5
@@ -175,11 +175,12 @@ static u32 bmp280_compensate_humidity(st }H6 =sign_extend32 (tmp,7 ); - var = ((s32 )data->t_fine) -76800 ; - var = ((((adc_humidity <<14 ) - (H4 <<20 ) - (H5 * var)) +16384 ) >>15 ) - * (((((((var *H6 ) >>10 ) * (((var *H3 ) >>11 ) +32768 )) >>10 ) - +2097152 ) *H2 +8192 ) >>14 ); - var -= ((((var >>15 ) * (var >>15 )) >>7 ) *H1 ) >>4 ; + var = ((s32 )data->t_fine) - (s32 )76800 ; + var = ((((adc_humidity <<14 ) - (H4 <<20 ) - (H5 * var)) + + (s32 )16384 ) >>15 ) * (((((((var *H6 ) >>10 ) + * (((var * (s32 )H3 ) >>11 ) + (s32 )32768 )) >>10 ) + + (s32 )2097152 ) *H2 +8192 ) >>14 ); + var -= ((((var >>15 ) * (var >>15 )) >>7 ) * (s32 )H1 ) >>4 ;return var >>12 ; };
Greg Kroah-Hartman
maintainerPATCH 67/164 IB/hfi1: Return an error on memory allocation failure
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael J. Ruhl <[email protected]>
commit 94679061dcdddbafcf24e3bfb526e54dedcc2f2f upstream.
If the eager buffer allocation fails, it is necessary to return an error code.
--- drivers/infiniband/hw/hfi1/init.c | 1 + 1 file changed, 1 insertion(+)
drivers/infiniband/hw/hfi1/init.c +1 -0
@@ -1757,6 +1757,7 @@ int hfi1_setup_eagerbufs(struct hfi1_ctx !HFI1_CAP_KGET_MASK(rcd->flags, MULTI_PKT_EGR)) {dd_dev_err (dd,"ctxt%u: Failed to allocate eager buffers\n" , rcd->ctxt); + ret = -ENOMEM ; goto bail_rcvegrbuf_phys; }
Greg Kroah-Hartman
maintainerPATCH 68/164 IB/hfi1: Fix a subcontext memory leak
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael J. Ruhl <[email protected]>
commit 224d71f910102c966cdcd782c97e096d5e26e4da upstream.
The only context that frees user_exp_rcv data structures is the last context closed (from a sub-context set). This leaks the allocations from the other sub-contexts. Separate the common frees from the specific frees and call them at the appropriate time.
Using KEDR to check for memory leaks we get:
Before test:
[leak_check] Possible leaks: 25
After test:
[leak_check] Possible leaks: 31 (6 leaked data structures)
After patch applied (before and after test have the same value)
[leak_check] Possible leaks: 25
Each leak is 192 + 13440 + 6720 = 20352 bytes per sub-context.
--- drivers/infiniband/hw/hfi1/file_ops.c | 5 +++- drivers/infiniband/hw/hfi1/user_exp_rcv.c | 32 ++++++++++++++++-------------- drivers/infiniband/hw/hfi1/user_exp_rcv.h | 1 3 files changed, 23 insertions(+), 15 deletions(-)
drivers/infiniband/hw/hfi1/file_ops.c +4 -1
@@ -751,6 +751,9 @@ static int hfi1_file_close(struct inode/* release the cpu */ hfi1_put_proc_affinity (fdata->rec_cpu_num); +/* clean up rcv side */ +hfi1_user_exp_rcv_free (fdata); +/* * Clear any left over, unhandled events so the next process that * gets this context doesn't get confused.
@@ -790,7 +793,7 @@ static int hfi1_file_close(struct inode dd->rcd[uctxt->ctxt] =NULL ; -hfi1_user_exp_rcv_free (fdata); +hfi1_user_exp_rcv_grp_free (uctxt);hfi1_clear_ctxt_pkey (dd, uctxt->ctxt); uctxt->rcvwait_to =0 ;
drivers/infiniband/hw/hfi1/user_exp_rcv.c +18 -14
@@ -250,36 +250,40 @@ done:return ret; } +void hfi1_user_exp_rcv_grp_free (struct hfi1_ctxtdata *uctxt) +{ +struct tid_group *grp, *gptr; + +list_for_each_entry_safe (grp, gptr, &uctxt->tid_group_list.list, + list) { +list_del_init (&grp->list); +kfree (grp); + } +hfi1_clear_tids (uctxt); +} +int hfi1_user_exp_rcv_free (struct hfi1_filedata *fd) {struct hfi1_ctxtdata *uctxt = fd->uctxt; -struct tid_group *grp, *gptr; -if (!test_bit (HFI1_CTXT_SETUP_DONE , &uctxt->event_flags)) -return 0 ;/* * The notifier would have been removed when the process'es mm * was freed. */ -if (fd->handler) +if (fd->handler) {hfi1_mmu_rb_unregister (fd->handler); - -kfree (fd->invalid_tids); - -if (!uctxt->cnt) { + }else {if (!EXP_TID_SET_EMPTY (uctxt->tid_full_list))unlock_exp_tids (uctxt, &uctxt->tid_full_list, fd);if (!EXP_TID_SET_EMPTY (uctxt->tid_used_list))unlock_exp_tids (uctxt, &uctxt->tid_used_list, fd); -list_for_each_entry_safe (grp, gptr, &uctxt->tid_group_list.list, - list) { -list_del_init (&grp->list); -kfree (grp); - } -hfi1_clear_tids (uctxt); } +kfree (fd->invalid_tids); + fd->invalid_tids =NULL ; +kfree (fd->entry_to_rb); + fd->entry_to_rb =NULL ;return 0 ; }
drivers/infiniband/hw/hfi1/user_exp_rcv.h +1 -0
@@ -70,6 +70,7 @@ (tid) |=EXP_TID_SET (field, (value)); \ }while (0 ) +void hfi1_user_exp_rcv_grp_free(struct hfi1_ctxtdata *uctxt);int hfi1_user_exp_rcv_init (struct file *);int hfi1_user_exp_rcv_free (struct hfi1_filedata *);int hfi1_user_exp_rcv_setup (struct file *,struct hfi1_tid_info *);
Greg Kroah-Hartman
maintainerPATCH 69/164 pid_ns: Sleep in TASK_INTERRUPTIBLE in zap_pid_ns_processes
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric W. Biederman <[email protected]>
commit b9a985db98961ae1ba0be169f19df1c567e4ffe0 upstream.
The code can potentially sleep for an indefinite amount of time in zap_pid_ns_processes triggering the hung task timeout, and increasing the system average. This is undesirable. Sleep with a task state of TASK_INTERRUPTIBLE instead of TASK_UNINTERRUPTIBLE to remove these undesirable side effects.
Apparently under heavy load this has been allowing Chrome to trigger the hung time task timeout error and cause ChromeOS to reboot.
--- kernel/pid_namespace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/pid_namespace.c +1 -1
@@ -274,7 +274,7 @@ void zap_pid_ns_processes(struct pid_nam* if reparented. */ for (;;) { -set_current_state (TASK_UNINTERRUPTIBLE ); +set_current_state (TASK_INTERRUPTIBLE );if (pid_ns->nr_hashed == init_pids)break ;schedule ();
Greg Kroah-Hartman
maintainerPATCH 70/164 pid_ns: Fix race between setnsed fork() and zap_pid_ns_processes()
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kirill Tkhai <[email protected]>
commit 3fd37226216620c1a468afa999739d5016fbc349 upstream.
Imagine we have a pid namespace and a task from its parent's pid_ns, which made setns() to the pid namespace. The task is doing fork(), while the pid namespace's child reaper is dying. We have the race between them:
Task from parent pid_ns Child reaper copy_process() .. alloc_pid() .. .. zap_pid_ns_processes() .. disable_pid_allocation() .. read_lock(&tasklist_lock) .. iterate over pids in pid_ns .. kill tasks linked to pids .. read_unlock(&tasklist_lock) write_lock_irq(&tasklist_lock); .. attach_pid(p, PIDTYPE_PID); .. .. ..
So, just created task p won't receive SIGKILL signal, and the pid namespace will be in contradictory state. Only manual kill will help there, but does the userspace care about this? I suppose, the most users just inject a task into a pid namespace and wait a SIGCHLD from it.
The patch fixes the problem. It simply checks for (pid_ns->nr_hashed & PIDNS_HASH_ADDING) in copy_process(). We do it under the tasklist_lock, and can't skip PIDNS_HASH_ADDING as noted by Oleg:
"zap_pid_ns_processes() does disable_pid_allocation() and then takes tasklist_lock to kill the whole namespace. Given that copy_process() checks PIDNS_HASH_ADDING under write_lock(tasklist) they can't race;
if copy_process() takes this lock first, the new child will be killed, otherwise copy_process() can't miss
the change in ->nr_hashed."
If allocation is disabled, we just return -ENOMEM
like it's made for such cases in alloc_pid().
v2: Do not move disable_pid_allocation(), do not introduce a new variable in copy_process() and simplify the patch as suggested by Oleg Nesterov. Account the problem with double irq enabling found by Eric W. Biederman.
--- kernel/fork.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
kernel/fork.c +6 -2
@@ -1773,11 +1773,13 @@ static __latent_entropy struct task_stru*/ recalc_sigpending ();if (signal_pending (current)) { -spin_unlock (¤t->sighand->siglock); -write_unlock_irq (&tasklist_lock); retval = -ERESTARTNOINTR ; goto bad_fork_cancel_cgroup; } +if (unlikely (!(ns_of_pid (pid)->nr_hashed &PIDNS_HASH_ADDING ))) { + retval = -ENOMEM ; + goto bad_fork_cancel_cgroup; + }if (likely (p->pid)) {ptrace_init_task (p, (clone_flags &CLONE_PTRACE ) || trace);
@@ -1828,6 +1830,8 @@ static __latent_entropy struct task_strureturn p; bad_fork_cancel_cgroup: +spin_unlock (¤t->sighand->siglock); +write_unlock_irq (&tasklist_lock);cgroup_cancel_fork (p); bad_fork_free_pid:threadgroup_change_end (current);
Greg Kroah-Hartman
maintainerPATCH 71/164 USB: serial: ftdi_sio: fix setting latency for unprivileged users
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anthony Mallet <[email protected]>
commit bb246681b3ed0967489a7401ad528c1aaa1a4c2e upstream.
Commit 557aaa7ffab6 ("ft232: support the ASYNC_LOW_LATENCY flag") enables unprivileged users to set the FTDI latency timer, but there was a logic flaw that skipped sending the corresponding USB control message to the device.
Specifically, the device latency timer would not be updated until next open, something which was later also inadvertently broken by commit c19db4c9e49a ("USB: ftdi_sio: set device latency timeout at port probe").
A recent commit c6dce2626606 ("USB: serial: ftdi_sio: fix extreme low-latency setting") disabled the low-latency mode by default so we now need this fix to allow unprivileged users to again enable it.
--- drivers/usb/serial/ftdi_sio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/serial/ftdi_sio.c +1 -1
@@ -1508,9 +1508,9 @@ static int set_serial_info(struct tty_st (new_serial.flags & ASYNC_FLAGS)); priv->custom_divisor = new_serial.custom_divisor; +check_and_exit:write_latency_timer (port); -check_and_exit:if ((old_priv.flags &ASYNC_SPD_MASK ) != (priv->flags &ASYNC_SPD_MASK )) {if ((priv->flags &ASYNC_SPD_MASK ) ==ASYNC_SPD_HI )
Greg Kroah-Hartman
maintainerPATCH 72/164 USB: serial: ftdi_sio: add Olimex ARM-USB-TINY(H) PIDs
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrey Korolyov <[email protected]>
commit 5f63424ab7daac840df2b12dd5bcc5b38d50f779 upstream.
This patch adds support for recognition of ARM-USB-TINY(H) devices which are almost identical to ARM-USB-OCD(H) but lacking separate barrel jack and serial console.
By suggestion from Johan Hovold it is possible to replace ftdi_jtag_quirk with a bit more generic construction. Since all Olimex-ARM debuggers has exactly two ports, we could safely always use only second port within the debugger family.
--- drivers/usb/serial/ftdi_sio.c | 8 ++++---- drivers/usb/serial/ftdi_sio_ids.h | 2 ++ 2 files changed, 6 insertions(+), 4 deletions(-)
drivers/usb/serial/ftdi_sio.c +4 -4
@@ -809,10 +809,10 @@ static const struct usb_device_id id_tab { USB_DEVICE(FTDI_VID, FTDI_PROPOX_ISPCABLEIII_PID) }, { USB_DEVICE(FTDI_VID, CYBER_CORTEX_AV_PID), .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(OLIMEX_VID, OLIMEX_ARM_USB_OCD_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(OLIMEX_VID, OLIMEX_ARM_USB_OCD_H_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE_INTERFACE_NUMBER(OLIMEX_VID, OLIMEX_ARM_USB_OCD_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(OLIMEX_VID, OLIMEX_ARM_USB_OCD_H_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(OLIMEX_VID, OLIMEX_ARM_USB_TINY_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(OLIMEX_VID, OLIMEX_ARM_USB_TINY_H_PID, 1) }, { USB_DEVICE(FIC_VID, FIC_NEO1973_DEBUG_PID), .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, { USB_DEVICE(FTDI_VID, FTDI_OOCDLINK_PID),
drivers/usb/serial/ftdi_sio_ids.h +2 -0
@@ -882,6 +882,8 @@/* Olimex */ #define OLIMEX_VID 0x15BA#define OLIMEX_ARM_USB_OCD_PID 0x0003 +#define OLIMEX_ARM_USB_TINY_PID 0x0004 +#define OLIMEX_ARM_USB_TINY_H_PID 0x002a#define OLIMEX_ARM_USB_OCD_H_PID 0x002b/*
Greg Kroah-Hartman
maintainerPATCH 73/164 USB: chaoskey: fix Alea quirk on big-endian hosts
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 63afd5cc78775018ea2dec4004428dafa5283e93 upstream.
Add missing endianness conversion when applying the Alea timeout quirk.
Found using sparse:
warning: restricted __le16 degrades to integer
--- drivers/usb/misc/chaoskey.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/misc/chaoskey.c +1 -1
@@ -194,7 +194,7 @@ static int chaoskey_probe(struct usb_int dev->in_ep = in_ep; -if (udev->descriptor.idVendor !=ALEA_VENDOR_ID ) +if (le16_to_cpu (udev->descriptor.idVendor) !=ALEA_VENDOR_ID ) dev->reads_started =1 ; dev->size = size;
Greg Kroah-Hartman
maintainerPATCH 74/164 f2fs: check entire encrypted bigname when finding a dentry
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jaegeuk Kim <[email protected]>
commit 6332cd32c8290a80e929fc044dc5bdba77396e33 upstream.
If user has no key under an encrypted dir, fscrypt gives digested dentries. Previously, when looking up a dentry, f2fs only checks its hash value with first 4 bytes of the digested dentry, which didn't handle hash collisions fully. This patch enhances to check entire dentry bytes likewise ext4.
Eric reported how to reproduce this issue by:
# seq -f "edir/abcdefghijklmnopqrstuvwxyz012345%.0f" 100000 | xargs touch # find edir -type f | xargs stat -c %i | sort | uniq | wc -l 100000 # sync # echo 3 > /proc/sys/vm/drop_caches # keyctl new_session # find edir -type f | xargs stat -c %i | sort | uniq | wc -l 99999
(fixed f2fs_dentry_hash() to work even when the hash is 0)
--- fs/f2fs/dir.c | 37 +++++++++++++++++++++---------------- fs/f2fs/f2fs.h | 3 ++- fs/f2fs/hash.c | 7 ++++++- fs/f2fs/inline.c | 4 ++-- 4 files changed, 31 insertions(+), 20 deletions(-)
fs/f2fs/dir.c +21 -16
@@ -130,19 +130,29 @@ struct f2fs_dir_entry *find_target_dentrcontinue ; } -/* encrypted case */ +if (de->hash_code != namehash) + goto not_match; + de_name.name = d->filename[bit_pos]; de_name.len =le16_to_cpu (de->name_len); -/* show encrypted name */ -if (fname->hash) { -if (de->hash_code == fname->hash) - goto found; - }else if (de_name.len == name->len && - de->hash_code == namehash && - !memcmp (de_name.name, name->name, name->len)) +#ifdef CONFIG_F2FS_FS_ENCRYPTION +if (unlikely (!name->name)) { +if (fname->usr_fname->name[0 ] =='_' ) { +if (de_name.len >=16 && + !memcmp (de_name.name + de_name.len -16 , + fname->crypto_buf.name +8 ,16 )) + goto found; + goto not_match; + } + name->name = fname->crypto_buf.name; + name->len = fname->crypto_buf.len; + } +#endif +if (de_name.len == name->len && + !memcmp (de_name.name, name->name, name->len)) goto found; - +not_match:if (max_slots && max_len > *max_slots) *max_slots = max_len; max_len =0 ;
@@ -170,12 +180,7 @@ static struct f2fs_dir_entry *find_in_lestruct f2fs_dir_entry *de =NULL ;bool room = false;int max_slots; -f2fs_hash_t namehash; - -if (fname->hash) - namehash =cpu_to_le32 (fname->hash); -else - namehash =f2fs_dentry_hash (&name); +f2fs_hash_t namehash =f2fs_dentry_hash (&name, fname); nbucket =dir_buckets (level,F2FS_I (dir)->i_dir_level); nblock =bucket_blocks (level);
@@ -539,7 +544,7 @@ int f2fs_add_regular_entry(struct inode level =0 ; slots =GET_DENTRY_SLOTS (new_name->len); - dentry_hash =f2fs_dentry_hash (new_name); + dentry_hash =f2fs_dentry_hash (new_name,NULL ); current_depth =F2FS_I (dir)->i_current_depth;if (F2FS_I (dir)->chash == dentry_hash) {
fs/f2fs/f2fs.h +2 -1
@@ -2016,7 +2016,8 @@ int sanity_check_ckpt(struct f2fs_sb_inf/* * hash.c */ -f2fs_hash_t f2fs_dentry_hash (const struct qstr *); +f2fs_hash_t f2fs_dentry_hash (const struct qstr *name_info, +struct fscrypt_name *fname);/* * node.c
fs/f2fs/hash.c +6 -1
@@ -70,7 +70,8 @@ static void str2hashbuf(const unsigned c *buf++ = pad; } -f2fs_hash_t f2fs_dentry_hash (const struct qstr *name_info) +f2fs_hash_t f2fs_dentry_hash (const struct qstr *name_info, +struct fscrypt_name *fname) {__u32 hash;f2fs_hash_t f2fs_hash;
@@ -79,6 +80,10 @@ f2fs_hash_t f2fs_dentry_hash(const strucconst unsigned char *name = name_info->name;size_t len = name_info->len; +/* encrypted bigname case */ +if (fname && !fname->disk_name.name) +return cpu_to_le32 (fname->hash); +if (is_dot_dotdot (name_info))return 0 ;
fs/f2fs/inline.c +2 -2
@@ -294,7 +294,7 @@ struct f2fs_dir_entry *find_in_inline_direturn NULL ; } - namehash =f2fs_dentry_hash (&name); + namehash =f2fs_dentry_hash (&name, fname); inline_dentry =inline_data_addr (ipage);
@@ -531,7 +531,7 @@ int f2fs_add_inline_entry(struct inode *f2fs_wait_on_page_writeback (ipage,NODE , true); - name_hash =f2fs_dentry_hash (new_name); + name_hash =f2fs_dentry_hash (new_name,NULL );make_dentry_ptr (NULL , &d, (void *)dentry_blk,2 );f2fs_update_dentry (ino, mode, &d, new_name, name_hash, bit_pos);
Greg Kroah-Hartman
maintainerPATCH 75/164 fscrypt: avoid collisions when presenting long encrypted filenames
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
commit 6b06cdee81d68a8a829ad8e8d0f31d6836744af9 upstream.
When accessing an encrypted directory without the key, userspace must operate on filenames derived from the ciphertext names, which contain arbitrary bytes. Since we must support filenames as long as NAME_MAX, we can't always just base64-encode the ciphertext, since that may make it too long. Currently, this is solved by presenting long names in an abbreviated form containing any needed filesystem-specific hashes (e.g. to identify a directory block), then the last 16 bytes of ciphertext. This needs to be sufficient to identify the actual name on lookup.
However, there is a bug. It seems to have been assumed that due to the use of a CBC (ciphertext block chaining)-based encryption mode, the last 16 bytes (i.e. the AES block size) of ciphertext would depend on the full plaintext, preventing collisions. However, we actually use CBC with ciphertext stealing (CTS), which handles the last two blocks specially, causing them to appear "flipped". Thus, it's actually the second-to-last block which depends on the full plaintext.
This caused long filenames that differ only near the end of their plaintexts to, when observed without the key, point to the wrong inode and be undeletable. For example, with ext4:
# echo pass | e4crypt add_key -p 16 edir/
# seq -f "edir/abcdefghijklmnopqrstuvwxyz012345%.0f" 100000 | xargs touch
# find edir/ -type f | xargs stat -c %i | sort | uniq | wc -l
100000
# sync
# echo 3 > /proc/sys/vm/drop_caches
# keyctl new_session
# find edir/ -type f | xargs stat -c %i | sort | uniq | wc -l
2004
# rm -rf edir/
rm: cannot remove 'edir/_A7nNFi3rhkEQlJ6P,hdzluhODKOeWx5V': Structure needs cleaning
...To fix this, when presenting long encrypted filenames, encode the second-to-last block of ciphertext rather than the last 16 bytes.
Although it would be nice to solve this without depending on a specific encryption mode, that would mean doing a cryptographic hash like SHA-256 which would be much less efficient. This way is sufficient for now, and it's still compatible with encryption modes like HEH which are strong pseudorandom permutations. Also, changing the presented names is still allowed at any time because they are only provided to allow applications to do things like delete encrypted directories. They're not designed to be used to persistently identify files --- which would be hard to do anyway, given that they're encrypted after all.
For ease of backports, this patch only makes the minimal fix to both ext4 and f2fs. It leaves ubifs as-is, since ubifs doesn't compare the ciphertext block yet. Follow-on patches will clean things up properly and make the filesystems use a shared helper function.
--- fs/crypto/fname.c | 2 +- fs/ext4/namei.c | 4 ++-- fs/f2fs/dir.c | 4 ++-- 3 files changed, 5 insertions(+), 5 deletions(-)
fs/crypto/fname.c +1 -1
@@ -300,7 +300,7 @@ int fscrypt_fname_disk_to_usr(struct ino }else {memset (buf,0 ,8 ); } -memcpy (buf +8 , iname->name + iname->len -16 ,16 ); +memcpy (buf +8 , iname->name + ((iname->len -17 ) & ~15 ),16 ); oname->name[0 ] ='_' ; oname->len =1 +digest_encode (buf,24 , oname->name +1 );return 0 ;
fs/ext4/namei.c +2 -2
@@ -1255,9 +1255,9 @@ static inline int ext4_match(struct ext4if (unlikely (!name)) {if (fname->usr_fname->name[0 ] =='_' ) {int ret; -if (de->name_len <16 ) +if (de->name_len <=32 )return 0 ; - ret =memcmp (de->name + de->name_len -16 , + ret =memcmp (de->name + ((de->name_len -17 ) & ~15 ), fname->crypto_buf.name +8 ,16 );return (ret ==0 ) ?1 :0 ; }
fs/f2fs/dir.c +2 -2
@@ -139,8 +139,8 @@ struct f2fs_dir_entry *find_target_dentr#ifdef CONFIG_F2FS_FS_ENCRYPTION if (unlikely (!name->name)) {if (fname->usr_fname->name[0 ] =='_' ) { -if (de_name.len >=16 && - !memcmp (de_name.name + de_name.len -16 , +if (de_name.len >32 && + !memcmp (de_name.name + ((de_name.len -17 ) & ~15 ), fname->crypto_buf.name +8 ,16 )) goto found; goto not_match;
Greg Kroah-Hartman
maintainerPATCH 76/164 libnvdimm: fix clear length of nvdimm_forget_poison()
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Toshi Kani <[email protected]>
commit 8d13c0290655b883df9083a2a0af0d782bc38aef upstream.
ND_CMD_CLEAR_ERROR command returns 'clear_err.cleared', the length of error actually cleared, which may be smaller than its requested 'len'.
Change nvdimm_clear_poison() to call nvdimm_forget_poison() with 'clear_err.cleared' when this value is valid.
--- drivers/nvdimm/bus.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/nvdimm/bus.c +4 -1
@@ -218,7 +218,10 @@ long nvdimm_clear_poison(struct device *if (cmd_rc <0 )return cmd_rc; -nvdimm_clear_from_poison_list (nvdimm_bus, phys, len); +if (clear_err.cleared >0 ) +nvdimm_clear_from_poison_list (nvdimm_bus, phys, + clear_err.cleared); +return clear_err.cleared; }EXPORT_SYMBOL_GPL (nvdimm_clear_poison);
Greg Kroah-Hartman
maintainerPATCH 77/164 xhci: remove GFP_DMA flag from allocation
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthias Lange <[email protected]>
commit 5db851cf20857c5504b146046e97cb7781f2a743 upstream.
There is no reason to restrict allocations to the first 16MB ISA DMA addresses.
It is causing problems in a virtualization setup with enabled IOMMU (x86_64). The result is that USB is not working in the VM.
--- drivers/usb/host/xhci-mem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/host/xhci-mem.c +1 -1
@@ -56,7 +56,7 @@ static struct xhci_segment *xhci_segment }if (max_packet) { - seg->bounce_buf =kzalloc (max_packet, flags |GFP_DMA ); + seg->bounce_buf =kzalloc (max_packet, flags);if (!seg->bounce_buf) {dma_pool_free (xhci->segment_pool, seg->trbs, dma);kfree (seg);
Greg Kroah-Hartman
maintainerPATCH 78/164 usb: host: xhci-plat: propagate return value of platform_get_irq()
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Petazzoni <[email protected]>
commit 4b148d5144d64ee135b8924350cb0b3a7fd21150 upstream.
platform_get_irq() returns an error code, but the xhci-plat driver ignores it and always returns -ENODEV. This is not correct, and prevents -EPROBE_DEFER from being propagated properly.
--- drivers/usb/host/xhci-plat.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/host/xhci-plat.c +1 -1
@@ -153,7 +153,7 @@ static int xhci_plat_probe(struct platfo irq =platform_get_irq (pdev,0 );if (irq <0 ) -return -ENODEV ; +return irq;/* Try to set 64-bit DMA first */ if (WARN_ON (!pdev->dev.dma_mask))
Greg Kroah-Hartman
maintainerPATCH 79/164 xhci: apply PME_STUCK_QUIRK and MISSING_CAS quirk for Denverton
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <[email protected]>
commit a0c16630d35a874e82bdf2088f58ecaca1024315 upstream.
Intel Denverton microserver is Atom based and need the PME and CAS quirks as well.
--- drivers/usb/host/xhci-pci.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/usb/host/xhci-pci.c +5 -2
@@ -52,6 +52,7 @@#define PCI_DEVICE_ID_INTEL_BROXTON_M_XHCI 0x0aa8#define PCI_DEVICE_ID_INTEL_BROXTON_B_XHCI 0x1aa8#define PCI_DEVICE_ID_INTEL_APL_XHCI 0x5aa8 +#define PCI_DEVICE_ID_INTEL_DNV_XHCI 0x19d0static const char hcd_name[] ="xhci_hcd" ;
@@ -166,7 +167,8 @@ static void xhci_pci_quirks(struct devic pdev->device ==PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI || pdev->device ==PCI_DEVICE_ID_INTEL_BROXTON_M_XHCI || pdev->device ==PCI_DEVICE_ID_INTEL_BROXTON_B_XHCI || - pdev->device == PCI_DEVICE_ID_INTEL_APL_XHCI)) { + pdev->device ==PCI_DEVICE_ID_INTEL_APL_XHCI || + pdev->device == PCI_DEVICE_ID_INTEL_DNV_XHCI)) { xhci->quirks |= XHCI_PME_STUCK_QUIRK; } if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
@@ -175,7 +177,8 @@ static void xhci_pci_quirks(struct devic }if (pdev->vendor ==PCI_VENDOR_ID_INTEL && (pdev->device ==PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI || - pdev->device ==PCI_DEVICE_ID_INTEL_APL_XHCI )) + pdev->device ==PCI_DEVICE_ID_INTEL_APL_XHCI || + pdev->device ==PCI_DEVICE_ID_INTEL_DNV_XHCI )) xhci->quirks |=XHCI_MISSING_CAS ; if (pdev->vendor == PCI_VENDOR_ID_ETRON &&
Greg Kroah-Hartman
maintainerPATCH 80/164 usb: host: xhci-mem: allocate zeroed Scratchpad Buffer
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Chen <[email protected]>
commit 7480d912d549f414e0ce39331870899e89a5598c upstream.
According to xHCI ch4.20 Scratchpad Buffers, the Scratchpad Buffer needs to be zeroed.
...
The following operations take place to allocate Scratchpad Buffers to the xHC:
...
b. Software clears the Scratchpad Buffer to '0'
--- drivers/usb/host/xhci-mem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/host/xhci-mem.c +1 -1
@@ -1721,7 +1721,7 @@ static int scratchpad_alloc(struct xhci_ xhci->dcbaa->dev_context_ptrs[0 ] =cpu_to_le64 (xhci->scratchpad->sp_dma);for (i =0 ; i < num_sp; i++) {dma_addr_t dma; -void *buf =dma_alloc_coherent (dev, xhci->page_size, &dma, +void *buf =dma_zalloc_coherent (dev, xhci->page_size, &dma, flags);if (!buf) goto fail_sp5;
Greg Kroah-Hartman
maintainerPATCH 81/164 net: irda: irda-usb: fix firmware name on big-endian hosts
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 75cf067953d5ee543b3bda90bbfcbee5e1f94ae8 upstream.
Add missing endianness conversion when using the USB device-descriptor bcdDevice field to construct a firmware file name.
--- drivers/net/irda/irda-usb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/irda/irda-usb.c +1 -1
@@ -1077,7 +1077,7 @@ static int stir421x_patch_device(struct* are "42101001.sb" or "42101002.sb" */ sprintf (stir421x_fw_name,"4210%4X.sb" , - self->usbdev->descriptor.bcdDevice); +le16_to_cpu (self->usbdev->descriptor.bcdDevice)); ret =request_firmware (&fw, stir421x_fw_name, &self->usbdev->dev);if (ret <0 )return ret;
Greg Kroah-Hartman
maintainerPATCH 82/164 usbvision: fix NULL-deref at probe
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit eacb975b48272f54532b62f515a3cf7eefa35123 upstream.
Make sure to check the number of endpoints to avoid dereferencing a NULL-pointer or accessing memory beyond the endpoint array should a malicious device lack the expected endpoints.
modification")
--- drivers/media/usb/usbvision/usbvision-video.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/media/usb/usbvision/usbvision-video.c +8 -1
@@ -1506,7 +1506,14 @@ static int usbvision_probe(struct usb_in }for (i =0 ; i < usbvision->num_alt; i++) { -u16 tmp =le16_to_cpu (uif->altsetting[i].endpoint[1 ].desc. +u16 tmp; + +if (uif->altsetting[i].desc.bNumEndpoints <2 ) { + ret = -ENODEV ; + goto err_pkt; + } + + tmp =le16_to_cpu (uif->altsetting[i].endpoint[1 ].desc. wMaxPacketSize); usbvision->alt_max_pkt_size[i] = (tmp &0x07ff ) * (((tmp &0x1800 ) >>11 ) +1 );
Greg Kroah-Hartman
maintainerPATCH 83/164 mceusb: fix NULL-deref at probe
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 03eb2a557ed552e920a0942b774aaf931596eec1 upstream.
Make sure to check for the required out endpoint to avoid dereferencing a NULL-pointer in mce_request_packet should a malicious device lack such an endpoint. Note that this path is hit during probe.
--- drivers/media/rc/mceusb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/media/rc/mceusb.c +2 -2
@@ -1332,8 +1332,8 @@ static int mceusb_dev_probe(struct usb_i } } } -if (ep_in ==NULL ) { -dev_dbg (&intf->dev,"inbound and/or endpoint not found" ); +if (!ep_in || !ep_out) { +dev_dbg (&intf->dev,"required endpoints not found\n" );return -ENODEV ; }
Greg Kroah-Hartman
maintainerPATCH 84/164 ttusb2: limit messages to buffer size
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alyssa Milburn <[email protected]>
commit a12b8ab8c5ff7ccd7b107a564743507c850a441d upstream.
Otherwise ttusb2_i2c_xfer can read or write beyond the end of static and heap buffers.
--- drivers/media/usb/dvb-usb/ttusb2.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+)
drivers/media/usb/dvb-usb/ttusb2.c +19 -0
@@ -78,6 +78,9 @@ static int ttusb2_msg(struct dvb_usb_devu8 *s, *r =NULL ;int ret =0 ; +if (4 + rlen >64 ) +return -EIO ; + s =kzalloc (wlen+4 ,GFP_KERNEL );if (!s)return -ENOMEM ;
@@ -381,6 +384,22 @@ static int ttusb2_i2c_xfer(struct i2c_ad write_read = i+1 < num && (msg[i+1 ].flags &I2C_M_RD ); read = msg[i].flags &I2C_M_RD ; +if (3 + msg[i].len >sizeof (obuf)) { +err ("i2c wr len=%d too high" , msg[i].len); +break ; + } +if (write_read) { +if (3 + msg[i+1 ].len >sizeof (ibuf)) { +err ("i2c rd len=%d too high" , msg[i+1 ].len); +break ; + } + }else if (read) { +if (3 + msg[i].len >sizeof (ibuf)) { +err ("i2c rd len=%d too high" , msg[i].len); +break ; + } + } + obuf[0 ] = (msg[i].addr <<1 ) | (write_read | read);if (read) obuf[1 ] =0 ;
Greg Kroah-Hartman
maintainerPATCH 85/164 dvb-usb-dibusb-mc-common: Add MODULE_LICENSE
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <[email protected]>
commit bf05b65a9fe5f6a6dd3e72cab2aacd8b5b96e41d upstream.
dvb-usb-dibusb-mc-common is licensed under GPLv2, and if we don't say so then it won't even load since it needs a GPL-only symbol.
--- drivers/media/usb/dvb-usb/dibusb-mc-common.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/media/usb/dvb-usb/dibusb-mc-common.c +2 -0
@@ -12,6 +12,8 @@#include <linux/kconfig.h> #include "dibusb.h" +MODULE_LICENSE ("GPL" ); +/* 3000MC/P stuff */ // Config Adjacent channels Perf -cal22 static struct dibx000_agc_config dib3000p_mt2060_agc_config = {
Greg Kroah-Hartman
maintainerPATCH 86/164 usb: dwc3: gadget: Prevent losing events in event cache
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thinh Nguyen <[email protected]>
commit d325a1de49d61ee11aca58a529571c91ecea7879 upstream.
The dwc3 driver can overwite its previous events if its top-half IRQ handler (TH) gets invoked again before processing the events in the cache. We see this as a hang in the file transfer and the host will attempt to reset the device. TH gets the event count and deasserts the interrupt line by writing DWC3_GEVNTSIZ_INTMASK to DWC3_GEVNTSIZ. If there's a new event coming between reading the event count and interrupt deassertion, dwc3 will lose previous pending events. More generally, we will see 0 event count, which should not affect anything.
This shouldn't be possible in the current dwc3 implementation. However, through testing and reading the PCIe trace, the TH occasionally still gets invoked one more time after HW interrupt deassertion. (With PCIe legacy interrupts, TH is called repeatedly as long as the interrupt line is asserted). We suspect that there is a small detection delay in the SW.
To avoid this issue, Check DWC3_EVENT_PENDING flag to determine if the events are processed in the bottom-half IRQ handler. If not, return IRQ_HANDLED and don't process new event.
--- drivers/usb/dwc3/gadget.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/usb/dwc3/gadget.c +9 -0
@@ -2856,6 +2856,15 @@ static irqreturn_t dwc3_check_event_buf(return IRQ_HANDLED ; } +/* +* With PCIe legacy interrupt, test shows that top-half irq handler can +* be called again after HW interrupt deassertion. Check if bottom-half +* irq event handler completes before caching new event to prevent +* losing events. +*/ +if (evt->flags &DWC3_EVENT_PENDING ) +return IRQ_HANDLED ; + count =dwc3_readl (dwc->regs,DWC3_GEVNTCOUNT (0 )); count &=DWC3_GEVNTCOUNT_MASK ;if (!count)
Greg Kroah-Hartman
maintainerPATCH 87/164 usb: musb: tusb6010_omap: Do not reset the other directions packet size
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <[email protected]>
commit 6df2b42f7c040d57d9ecb67244e04e905ab87ac6 upstream.
We have one register for each EP to set the maximum packet size for both TX and RX.
If for example an RX programming would happen before the previous TX transfer finishes we would reset the TX packet side.
To fix this issue, only modify the TX or RX part of the register.
--- drivers/usb/musb/tusb6010_omap.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
drivers/usb/musb/tusb6010_omap.c +9 -4
@@ -220,6 +220,7 @@ static int tusb_omap_dma_program(structu32 dma_remaining;int src_burst, dst_burst;u16 csr; +u32 psize;int ch;s8 dmareq;s8 sync_dev;
@@ -391,15 +392,19 @@ static int tusb_omap_dma_program(structif (chdat->tx) {/* Send transfer_packet_sz packets at a time */ -musb_writel (ep_conf,TUSB_EP_MAX_PACKET_SIZE_OFFSET , - chdat->transfer_packet_sz); + psize =musb_readl (ep_conf,TUSB_EP_MAX_PACKET_SIZE_OFFSET ); + psize &= ~0x7ff ; + psize |= chdat->transfer_packet_sz; +musb_writel (ep_conf,TUSB_EP_MAX_PACKET_SIZE_OFFSET , psize);musb_writel (ep_conf,TUSB_EP_TX_OFFSET ,TUSB_EP_CONFIG_XFR_SIZE (chdat->transfer_len)); }else {/* Receive transfer_packet_sz packets at a time */ -musb_writel (ep_conf,TUSB_EP_MAX_PACKET_SIZE_OFFSET , - chdat->transfer_packet_sz <<16 ); + psize =musb_readl (ep_conf,TUSB_EP_MAX_PACKET_SIZE_OFFSET ); + psize &= ~(0x7ff <<16 ); + psize |= (chdat->transfer_packet_sz <<16 ); +musb_writel (ep_conf,TUSB_EP_MAX_PACKET_SIZE_OFFSET , psize);musb_writel (ep_conf,TUSB_EP_RX_OFFSET ,TUSB_EP_CONFIG_XFR_SIZE (chdat->transfer_len));
Greg Kroah-Hartman
maintainerPATCH 88/164 usb: musb: Fix trying to suspend while active for OTG configurations
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Lindgren <[email protected]>
commit 3c50ffef25855a9d9e4b07b02d756a8cdd653069 upstream.
Commit d8e5f0eca1e8 ("usb: musb: Fix hardirq-safe hardirq-unsafe lock order error") caused a regression where musb keeps trying to enable host mode with no cable connected. This seems to be caused by the fact that now phy is enabled earlier, and we are wrongly trying to force USB host mode on an OTG port. The errors we are getting are "trying to suspend as a_idle while active".
For ports configured as OTG, we should not need to do anything to try to force USB host mode on it's OTG port. Trying to force host mode in this case just seems to completely confuse the musb state machine.
Let's fix the issue by making musb_host_setup() attempt to force the mode only if port_mode is configured for host mode.
--- drivers/usb/musb/musb_host.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/usb/musb/musb_host.c +5 -4
@@ -2780,10 +2780,11 @@ int musb_host_setup(struct musb *musb, iint ret;struct usb_hcd *hcd = musb->hcd; -MUSB_HST_MODE (musb); - musb->xceiv->otg->default_a =1 ; - musb->xceiv->otg->state =OTG_STATE_A_IDLE ; - +if (musb->port_mode ==MUSB_PORT_MODE_HOST ) { +MUSB_HST_MODE (musb); + musb->xceiv->otg->default_a =1 ; + musb->xceiv->otg->state =OTG_STATE_A_IDLE ; + }otg_set_host (musb->xceiv->otg, &hcd->self); hcd->self.otg_port =1 ; musb->xceiv->otg->host = &hcd->self;
Greg Kroah-Hartman
maintainerPATCH 89/164 USB: iowarrior: fix info ioctl on big-endian hosts
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit dd5ca753fa92fb736b1395db892bd29f78e6d408 upstream.
Drop erroneous le16_to_cpu when returning the USB device speed which is already in host byte order.
Found using sparse:
warning: cast to restricted __le16
--- drivers/usb/misc/iowarrior.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/misc/iowarrior.c +1 -1
@@ -554,7 +554,7 @@ static long iowarrior_ioctl(struct file info.revision =le16_to_cpu (dev->udev->descriptor.bcdDevice);/* 0==UNKNOWN, 1==LOW(usb1.1) ,2=FULL(usb1.1), 3=HIGH(usb2.0) */ - info.speed =le16_to_cpu (dev->udev->speed); + info.speed = dev->udev->speed; info.if_num = dev->interface->cur_altsetting->desc.bInterfaceNumber; info.report_size = dev->report_size;
Greg Kroah-Hartman
maintainerPATCH 90/164 usb: serial: option: add Telit ME910 support
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniele Palmas <[email protected]>
commit 40dd46048c155b8f0683f468c950a1c107f77a7c upstream.
This patch adds support for Telit ME910 PID 0x1100.
--- drivers/usb/serial/option.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/usb/serial/option.c +8 -0
@@ -281,6 +281,7 @@ static void option_instat_callback(struc#define TELIT_PRODUCT_LE922_USBCFG0 0x1042#define TELIT_PRODUCT_LE922_USBCFG3 0x1043#define TELIT_PRODUCT_LE922_USBCFG5 0x1045 +#define TELIT_PRODUCT_ME910 0x1100#define TELIT_PRODUCT_LE920 0x1200#define TELIT_PRODUCT_LE910 0x1201#define TELIT_PRODUCT_LE910_USBCFG4 0x1206
@@ -640,6 +641,11 @@ static const struct option_blacklist_inf .reserved = BIT(5) | BIT(6), }; +static const struct option_blacklist_info telit_me910_blacklist = { + .sendsetup =BIT (0 ), + .reserved =BIT (1 ) |BIT (3 ), +}; +static const struct option_blacklist_info telit_le910_blacklist = { .sendsetup =BIT (0 ), .reserved =BIT (1 ) |BIT (2 ),
@@ -1235,6 +1241,8 @@ static const struct usb_device_id option .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG5, 0xff), .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg0 }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910), + .driver_info = (kernel_ulong_t)&telit_me910_blacklist }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910), .driver_info = (kernel_ulong_t)&telit_le910_blacklist }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910_USBCFG4),
Greg Kroah-Hartman
maintainerPATCH 92/164 USB: serial: mct_u232: fix big-endian baud-rate handling
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 26cede343656c0bc2c33cdc783771282405c7fb2 upstream.
Drop erroneous cpu_to_le32 when setting the baud rate, something which corrupted the divisor on big-endian hosts.
Found using sparse:
warning: incorrect type in argument 1 (different base types)
expected unsigned int [unsigned] [usertype] val got restricted __le32 [usertype] <noident>
--- drivers/usb/serial/mct_u232.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/serial/mct_u232.c +1 -1
@@ -189,7 +189,7 @@ static int mct_u232_set_baud_rate(structreturn -ENOMEM ; divisor =mct_u232_calculate_baud_rate (serial, value, &speed); -put_unaligned_le32 (cpu_to_le32 (divisor), buf); +put_unaligned_le32 (divisor, buf); rc = usb_control_msg(serial->dev, usb_sndctrlpipe(serial->dev, 0), MCT_U232_SET_BAUD_RATE_REQUEST, MCT_U232_SET_REQUEST_TYPE,
Greg Kroah-Hartman
maintainerPATCH 93/164 USB: serial: io_ti: fix div-by-zero in set_termios
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 6aeb75e6adfaed16e58780309613a578fe1ee90b upstream.
Fix a division-by-zero in set_termios when debugging is enabled and a high-enough speed has been requested so that the divisor value becomes zero.
Instead of just fixing the offending debug statement, cap the baud rate at the base as a zero divisor value also appears to crash the firmware.
--- drivers/usb/serial/io_ti.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/usb/serial/io_ti.c +4 -1
@@ -2349,8 +2349,11 @@ static void change_port_settings(structif (!baud) {/* pick a default, any default... */ baud =9600 ; - }else + }else { +/* Avoid a zero divisor. */ + baud =min (baud,461550 );tty_encode_baud_rate (tty, baud, baud); + } edge_port->baud_rate = baud; config->wBaudRate = (__u16)((461550L + baud/2 ) / baud);
Greg Kroah-Hartman
maintainerPATCH 94/164 USB: hub: fix SS hub-descriptor handling
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 2c25a2c818023df64463aac3288a9f969491e507 upstream.
A SuperSpeed hub descriptor does not have any variable-length fields so bail out when reading a short descriptor.
This avoids parsing and leaking two bytes of uninitialised slab data through sysfs removable-attributes.
--- drivers/usb/core/hub.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/usb/core/hub.c +6 -2
@@ -378,8 +378,12 @@ static int get_hub_descriptor(struct usbUSB_REQ_GET_DESCRIPTOR ,USB_DIR_IN |USB_RT_HUB , dtype <<8 ,0 , data, size, USB_CTRL_GET_TIMEOUT); -if (ret >= (USB_DT_HUB_NONVAR_SIZE +2 )) +if (hub_is_superspeed (hdev)) { +if (ret == size) +return ret; + }else if (ret >= (USB_DT_HUB_NONVAR_SIZE +2 )) {return ret; + } }return -EINVAL ; }
@@ -1319,7 +1323,7 @@ static int hub_configure(struct usb_hub/* Request the entire hub descriptor. * hub->descriptor can handle USB_MAXCHILDREN ports, -* but the hub can/will return fewer bytes here. +* but a (non-SS) hub can/will return fewer bytes here. */ ret =get_hub_descriptor (hdev, hub->descriptor);if (ret <0 ) {
Greg Kroah-Hartman
maintainerPATCH 95/164 USB: hub: fix non-SS hub-descriptor handling
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit bec444cd1c94c48df409a35ad4e5b143c245c3f7 upstream.
Add missing sanity check on the non-SuperSpeed hub-descriptor length in order to avoid parsing and leaking two bytes of uninitialised slab data through sysfs removable-attributes (or a compound-device debug statement).
Note that we only make sure that the DeviceRemovable field is always present (and specifically ignore the unused PortPwrCtrlMask field) in order to continue support any hubs with non-compliant descriptors. As a further safeguard, the descriptor buffer is also cleared.
--- drivers/usb/core/hub.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
drivers/usb/core/hub.c +9 -4
@@ -360,7 +360,8 @@ static void usb_set_lpm_parameters(struc }/* USB 2.0 spec Section 11.24.4.5 */ -static int get_hub_descriptor (struct usb_device *hdev,void *data) +static int get_hub_descriptor (struct usb_device *hdev, +struct usb_hub_descriptor *desc) {int i, ret, size;unsigned dtype;
@@ -376,12 +377,16 @@ static int get_hub_descriptor(struct usbfor (i =0 ; i <3 ; i++) { ret =usb_control_msg (hdev,usb_rcvctrlpipe (hdev,0 ),USB_REQ_GET_DESCRIPTOR ,USB_DIR_IN |USB_RT_HUB , - dtype <<8 ,0 , data, size, + dtype <<8 ,0 , desc, size,USB_CTRL_GET_TIMEOUT );if (hub_is_superspeed (hdev)) {if (ret == size)return ret; - }else if (ret >= (USB_DT_HUB_NONVAR_SIZE +2 )) { + }else if (ret >=USB_DT_HUB_NONVAR_SIZE +2 ) { +/* Make sure we have the DeviceRemovable field. */ + size =USB_DT_HUB_NONVAR_SIZE + desc->bNbrPorts /8 +1 ; +if (ret < size) +return -EMSGSIZE ;return ret; } }
@@ -1315,7 +1320,7 @@ static int hub_configure(struct usb_hub }mutex_init (&hub->status_mutex); - hub->descriptor =kmalloc (sizeof (*hub->descriptor),GFP_KERNEL ); + hub->descriptor =kzalloc (sizeof (*hub->descriptor),GFP_KERNEL );if (!hub->descriptor) { ret = -ENOMEM ; goto fail;
Greg Kroah-Hartman
maintainerPATCH 97/164 iio: proximity: as3935: fix as3935_write
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Ranostay <[email protected]>
commit 84ca8e364acb26aba3292bc113ca8ed4335380fd upstream.
AS3935_WRITE_DATA macro bit is incorrect and the actual write sequence is two leading zeros.
--- drivers/iio/proximity/as3935.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/iio/proximity/as3935.c +1 -2
@@ -50,7 +50,6 @@#define AS3935_TUNE_CAP 0x08#define AS3935_CALIBRATE 0x3D -#define AS3935_WRITE_DATA BIT(15)#define AS3935_READ_DATA BIT(14)#define AS3935_ADDRESS (x) ((x) << 8)
@@ -105,7 +104,7 @@ static int as3935_write(struct as3935_st {u8 *buf = st->buf; - buf[0 ] = (AS3935_WRITE_DATA |AS3935_ADDRESS (reg)) >>8 ; + buf[0 ] =AS3935_ADDRESS (reg) >>8 ; buf[1 ] = val;return spi_write (st->spi, buf,2 );
Greg Kroah-Hartman
maintainerPATCH 98/164 iio: hid-sensor: Store restore poll and hysteresis on S3
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Pandruvada <[email protected]>
commit 5d9854eaea776441b38a9a45b4e6879524c4f48c upstream.
This change undo the change done by 'commit 3bec24747446 ("iio: hid-sensor-trigger: Change get poll value function order to avoid sensor properties losing after resume from S3")' as this breaks some USB/i2c sensor hubs.
Instead of relying on HW for restoring poll and hysteresis, driver stores and restores on resume (S3). In this way user space modified settings are not lost for any kind of sensor hub behavior.
In this change, whenever user space modifies sampling frequency or hysteresis driver will get the feature value from the hub and store in the per device hid_sensor_common data structure. On resume callback from S3, system will set the feature to sensor hub, if user space ever modified the feature value.
--- drivers/iio/common/hid-sensors/hid-sensor-attributes.c | 26 +++++++++++++++-- drivers/iio/common/hid-sensors/hid-sensor-trigger.c | 20 +++++++++++-- include/linux/hid-sensor-hub.h | 2 + 3 files changed, 43 insertions(+), 5 deletions(-)
drivers/iio/common/hid-sensors/hid-sensor-attributes.c +24 -2
@@ -217,7 +217,15 @@ int hid_sensor_write_samp_freq_value(strif (ret <0 || value <0 ) ret = -EINVAL ; -return ret; + ret =sensor_hub_get_feature (st->hsdev, + st->poll.report_id, + st->poll.index,sizeof (value), &value); +if (ret <0 || value <0 ) +return -EINVAL ; + + st->poll_interval = value; + +return 0 ; }EXPORT_SYMBOL (hid_sensor_write_samp_freq_value);
@@ -259,7 +267,16 @@ int hid_sensor_write_raw_hyst_value(struif (ret <0 || value <0 ) ret = -EINVAL ; -return ret; + ret =sensor_hub_get_feature (st->hsdev, + st->sensitivity.report_id, + st->sensitivity.index,sizeof (value), + &value); +if (ret <0 || value <0 ) +return -EINVAL ; + + st->raw_hystersis = value; + +return 0 ; }EXPORT_SYMBOL (hid_sensor_write_raw_hyst_value);
@@ -355,6 +372,9 @@ int hid_sensor_get_reporting_interval(st/* Default unit of measure is milliseconds */ if (st->poll.units ==0 ) st->poll.units =HID_USAGE_SENSOR_UNITS_MILLISECOND ; + + st->poll_interval =-1 ; +return 0 ; }
@@ -377,6 +397,8 @@ int hid_sensor_parse_common_attributes(sHID_USAGE_SENSOR_PROY_POWER_STATE , &st->power_state); + st->raw_hystersis =-1 ; + sensor_hub_input_get_attribute_info(hsdev, HID_FEATURE_REPORT, usage_id, HID_USAGE_SENSOR_PROP_SENSITIVITY_ABS,
drivers/iio/common/hid-sensors/hid-sensor-trigger.c +17 -3
@@ -51,6 +51,8 @@ static int _hid_sensor_power_state(struc st->report_state.report_id, st->report_state.index, HID_USAGE_SENSOR_PROP_REPORTING_STATE_ALL_EVENTS_ENUM); + + poll_value =hid_sensor_read_poll_value (st); }else {int val;
@@ -87,9 +89,7 @@ static int _hid_sensor_power_state(strucsensor_hub_get_feature (st->hsdev, st->power_state.report_id, st->power_state.index,sizeof (state_val), &state_val); -if (state) - poll_value =hid_sensor_read_poll_value (st); -if (poll_value >0 ) +if (state && poll_value)msleep_interruptible (poll_value *2 );return 0 ;
@@ -127,6 +127,20 @@ static void hid_sensor_set_power_work(ststruct hid_sensor_common *attrb =container_of (work, struct hid_sensor_common, work); + +if (attrb->poll_interval >=0 ) +sensor_hub_set_feature (attrb->hsdev, attrb->poll.report_id, + attrb->poll.index, +sizeof (attrb->poll_interval), + &attrb->poll_interval); + +if (attrb->raw_hystersis >=0 ) +sensor_hub_set_feature (attrb->hsdev, + attrb->sensitivity.report_id, + attrb->sensitivity.index, +sizeof (attrb->raw_hystersis), + &attrb->raw_hystersis); +_hid_sensor_power_state (attrb, true); }
include/linux/hid-sensor-hub.h +2 -0
@@ -231,6 +231,8 @@ struct hid_sensor_common {unsigned usage_id;atomic_t data_ready;atomic_t user_requested_state; +int poll_interval; +int raw_hystersis;struct iio_trigger *trigger;struct hid_sensor_hub_attribute_info poll;struct hid_sensor_hub_attribute_info report_state;
Greg Kroah-Hartman
maintainerPATCH 99/164 s5p-mfc: Fix race between interrupt routine and device functions
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Szyprowski <[email protected]>
commit 0c32b8ec02832df167e16ad659cb11dc148f2ddf upstream.
Interrupt routine must wake process waiting for given interrupt AFTER updating driver's internal structures and contexts. Doing it in-between is a serious bug. This patch moves all calls to the wake() function to the end of the interrupt processing block to avoid potential and real races, especially on multi-core platforms. This also fixes following issue reported from clock core (clocks were disabled in interrupt after being unprepared from the other place in the driver, the stack trace however points to the different place than s5p_mfc driver because of the race):
WARNING: CPU: 1 PID: 18 at drivers/clk/clk.c:544 clk_core_unprepare+0xc8/0x108 Modules linked in: CPU: 1 PID: 18 Comm: kworker/1:0 Not tainted 4.10.0-next-20170223-00070-g04e18bc99ab9-dirty #2154 Hardware name: SAMSUNG EXYNOS (Flattened Device Tree) Workqueue: pm pm_runtime_work [<c010d8b0>] (unwind_backtrace) from [<c010a534>] (show_stack+0x10/0x14) [<c010a534>] (show_stack) from [<c033292c>] (dump_stack+0x74/0x94) [<c033292c>] (dump_stack) from [<c011cef4>] (__warn+0xd4/0x100) [<c011cef4>] (__warn) from [<c011cf40>] (warn_slowpath_null+0x20/0x28) [<c011cf40>] (warn_slowpath_null) from [<c0387a84>] (clk_core_unprepare+0xc8/0x108) [<c0387a84>] (clk_core_unprepare) from [<c0389d84>] (clk_unprepare+0x24/0x2c) [<c0389d84>] (clk_unprepare) from [<c03d4660>] (exynos_sysmmu_suspend+0x48/0x60) [<c03d4660>] (exynos_sysmmu_suspend) from [<c042b9b0>] (pm_generic_runtime_suspend+0x2c/0x38) [<c042b9b0>] (pm_generic_runtime_suspend) from [<c0437580>] (genpd_runtime_suspend+0x94/0x220) [<c0437580>] (genpd_runtime_suspend) from [<c042e240>] (__rpm_callback+0x134/0x208) [<c042e240>] (__rpm_callback) from [<c042e334>] (rpm_callback+0x20/0x80) [<c042e334>] (rpm_callback) from [<c042d3b8>] (rpm_suspend+0xdc/0x458) [<c042d3b8>] (rpm_suspend) from [<c042ea24>] (pm_runtime_work+0x80/0x90) [<c042ea24>] (pm_runtime_work) from [<c01322c4>] (process_one_work+0x120/0x318) [<c01322c4>] (process_one_work) from [<c0132520>] (worker_thread+0x2c/0x4ac) [<c0132520>] (worker_thread) from [<c0137ab0>] (kthread+0xfc/0x134) [<c0137ab0>] (kthread) from [<c0107978>] (ret_from_fork+0x14/0x3c) ---[ end trace 1ead49a7bb83f0d8 ]---
--- drivers/media/platform/s5p-mfc/s5p_mfc.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-)
drivers/media/platform/s5p-mfc/s5p_mfc.c +4 -8
@@ -663,9 +663,9 @@ static irqreturn_t s5p_mfc_irq(int irq,break ; }s5p_mfc_hw_call (dev->mfc_ops, clear_int_flags, dev); -wake_up_ctx (ctx, reason, err);WARN_ON (test_and_clear_bit (0 , &dev->hw_lock) ==0 );s5p_mfc_clock_off (); +wake_up_ctx (ctx, reason, err);s5p_mfc_hw_call (dev->mfc_ops, try_run, dev); }else {s5p_mfc_handle_frame (ctx, reason, err);
@@ -679,15 +679,11 @@ static irqreturn_t s5p_mfc_irq(int irq,case S5P_MFC_R2H_CMD_OPEN_INSTANCE_RET : ctx->inst_no =s5p_mfc_hw_call (dev->mfc_ops, get_inst_no, dev); ctx->state =MFCINST_GOT_INST ; -clear_work_bit (ctx); -wake_up (&ctx->queue); goto irq_cleanup_hw;case S5P_MFC_R2H_CMD_CLOSE_INSTANCE_RET : -clear_work_bit (ctx); ctx->inst_no =MFC_NO_INSTANCE_SET ; ctx->state =MFCINST_FREE ; -wake_up (&ctx->queue); goto irq_cleanup_hw;case S5P_MFC_R2H_CMD_SYS_INIT_RET :
@@ -697,9 +693,9 @@ static irqreturn_t s5p_mfc_irq(int irq,if (ctx)clear_work_bit (ctx);s5p_mfc_hw_call (dev->mfc_ops, clear_int_flags, dev); -wake_up_dev (dev, reason, err);clear_bit (0 , &dev->hw_lock);clear_bit (0 , &dev->enter_suspend); +wake_up_dev (dev, reason, err);break ;case S5P_MFC_R2H_CMD_INIT_BUFFERS_RET :
@@ -714,9 +710,7 @@ static irqreturn_t s5p_mfc_irq(int irq,break ;case S5P_MFC_R2H_CMD_DPB_FLUSH_RET : -clear_work_bit (ctx); ctx->state =MFCINST_RUNNING ; -wake_up (&ctx->queue); goto irq_cleanup_hw;default :
@@ -735,6 +729,8 @@ irq_cleanup_hw:mfc_err ("Failed to unlock hw\n" );s5p_mfc_clock_off (); +clear_work_bit (ctx); +wake_up (&ctx->queue);s5p_mfc_hw_call (dev->mfc_ops, try_run, dev);spin_unlock (&dev->irqlock);
Greg Kroah-Hartman
maintainerPATCH 100/164 gspca: konica: add missing endpoint sanity check
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit aa58fedb8c7b6cf2f05941d238495f9e2f29655c upstream.
Make sure to check the number of endpoints to avoid accessing memory beyond the endpoint array should a device lack the expected endpoints.
Note that, as far as I can tell, the gspca framework has already made sure there is at least one endpoint in the current alternate setting so there should be no risk for a NULL-pointer dereference here.
konica chipset using cams")
--- drivers/media/usb/gspca/konica.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/media/usb/gspca/konica.c +3 -0
@@ -188,6 +188,9 @@ static int sd_start(struct gspca_dev *gsreturn -EIO ; } +if (alt->desc.bNumEndpoints <2 ) +return -ENODEV ; + packet_size =le16_to_cpu (alt->endpoint[0 ].desc.wMaxPacketSize); n = gspca_dev->cam.cam_mode[gspca_dev->curr_mode].priv;
Greg Kroah-Hartman
maintainerPATCH 101/164 s5p-mfc: Fix unbalanced call to clock management
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Szyprowski <[email protected]>
commit a5cb00eb4223458250b55daf03ac7ea5f424d601 upstream.
Clock should be turned off after calling s5p_mfc_init_hw() from the watchdog worker, like it is already done in the s5p_mfc_open() which also calls this function.
--- drivers/media/platform/s5p-mfc/s5p_mfc.c | 1 + 1 file changed, 1 insertion(+)
drivers/media/platform/s5p-mfc/s5p_mfc.c +1 -0
@@ -206,6 +206,7 @@ static void s5p_mfc_watchdog_worker(stru }s5p_mfc_clock_on (); ret =s5p_mfc_init_hw (dev); +s5p_mfc_clock_off ();if (ret)mfc_err ("Failed to reinit FW\n" ); }
Greg Kroah-Hartman
maintainerPATCH 102/164 dib0700: fix NULL-deref at probe
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit d5823511c0f8719a39e72ede1bce65411ac653b7 upstream.
Make sure to check the number of endpoints to avoid dereferencing a NULL-pointer should a malicious device lack endpoints.
Nova-TD")
--- drivers/media/usb/dvb-usb/dib0700_core.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/media/usb/dvb-usb/dib0700_core.c +3 -0
@@ -812,6 +812,9 @@ int dib0700_rc_setup(struct dvb_usb_devi/* Starting in firmware 1.20, the RC info is provided on a bulk pipe */ +if (intf->altsetting[0 ].desc.bNumEndpoints < rc_ep +1 ) +return -ENODEV ; + purb =usb_alloc_urb (0 ,GFP_KERNEL );if (purb ==NULL )return -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 103/164 zr364xx: enforce minimum size when reading header
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alyssa Milburn <[email protected]>
commit ee0fe833d96793853335844b6d99fb76bd12cbeb upstream.
This code copies actual_length-128 bytes from the header, which will underflow if the received buffer is too small.
--- drivers/media/usb/zr364xx/zr364xx.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/media/usb/zr364xx/zr364xx.c +8 -0
@@ -604,6 +604,14 @@ static int zr364xx_read_video_callback(s ptr = pdest = frm->lpvbits;if (frm->ulState ==ZR364XX_READ_IDLE ) { +if (purb->actual_length <128 ) { +/* header incomplete */ +dev_info (&cam->udev->dev, +"%s: buffer (%d bytes) too small to hold jpeg header. Discarding.\n" , + __func__, purb->actual_length); +return -EINVAL ; + } + frm->ulState =ZR364XX_READ_FRAME ; frm->cur_size =0 ;
Greg Kroah-Hartman
maintainerPATCH 104/164 dvb-frontends/cxd2841er: define symbol_rate_min/max in T/C fe-ops
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Scheller <[email protected]>
commit 158f0328af86a99d64073851967a02694bff987d upstream.
Fixes "w_scan -f c" complaining with
This dvb driver is *buggy*: the symbol rate limits are undefined - please report to linuxtv.org)
--- drivers/media/dvb-frontends/cxd2841er.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/media/dvb-frontends/cxd2841er.c +3 -1
@@ -3852,7 +3852,9 @@ static struct dvb_frontend_ops cxd2841eFE_CAN_MUTE_TS | FE_CAN_2G_MODULATION, .frequency_min = 42000000, - .frequency_max =1002000000 + .frequency_max = 1002000000, + .symbol_rate_min = 870000, + .symbol_rate_max =11700000 }, .init = cxd2841er_init_tc, .sleep = cxd2841er_sleep_tc,
Greg Kroah-Hartman
maintainerPATCH 105/164 digitv: limit messages to buffer size
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alyssa Milburn <[email protected]>
commit 821117dc21083a99dd99174c10848d70ff43de29 upstream.
Return an error rather than memcpy()ing beyond the end of the buffer. Internal callers use appropriate sizes, but digitv_i2c_xfer may not.
--- drivers/media/usb/dvb-usb/digitv.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/media/usb/dvb-usb/digitv.c +3 -0
@@ -33,6 +33,9 @@ static int digitv_ctrl_msg(struct dvb_us wo = (rbuf ==NULL || rlen ==0 );/* write-only */ +if (wlen >4 || rlen >4 ) +return -EIO ; +memset (st->sndbuf,0 ,7 );memset (st->rcvbuf,0 ,7 );
Greg Kroah-Hartman
maintainerPATCH 106/164 dw2102: limit messages to buffer size
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alyssa Milburn <[email protected]>
commit 950e252cb469f323740d78e4907843acef89eedb upstream.
Otherwise the i2c transfer functions can read or write beyond the end of stack or heap buffers.
--- drivers/media/usb/dvb-usb/dw2102.c | 54 +++++++++++++++++++++++++++++++++++++ 1 file changed, 54 insertions(+)
drivers/media/usb/dvb-usb/dw2102.c +54 -0
@@ -205,6 +205,20 @@ static int dw2102_serit_i2c_transfer(strswitch (num) {case 2 : +if (msg[0 ].len !=1 ) { +warn ("i2c rd: len=%d is not 1!\n" , + msg[0 ].len); + num = -EOPNOTSUPP ; +break ; + } + +if (2 + msg[1 ].len >sizeof (buf6)) { +warn ("i2c rd: len=%d is too big!\n" , + msg[1 ].len); + num = -EOPNOTSUPP ; +break ; + } +/* read si2109 register by number */ buf6[0 ] = msg[0 ].addr <<1 ; buf6[1 ] = msg[0 ].len;
@@ -220,6 +234,13 @@ static int dw2102_serit_i2c_transfer(strcase 1 :switch (msg[0 ].addr) {case 0x68 : +if (2 + msg[0 ].len >sizeof (buf6)) { +warn ("i2c wr: len=%d is too big!\n" , + msg[0 ].len); + num = -EOPNOTSUPP ; +break ; + } +/* write to si2109 register */ buf6[0 ] = msg[0 ].addr <<1 ; buf6[1 ] = msg[0 ].len;
@@ -263,6 +284,13 @@ static int dw2102_earda_i2c_transfer(str/* first write first register number */ u8 ibuf[MAX_XFER_SIZE ], obuf[3 ]; +if (2 + msg[0 ].len !=sizeof (obuf)) { +warn ("i2c rd: len=%d is not 1!\n" , + msg[0 ].len); + ret = -EOPNOTSUPP ; + goto unlock; + } +if (2 + msg[1 ].len >sizeof (ibuf)) {warn ("i2c rd: len=%d is too big!\n" , msg[1 ].len);
@@ -463,6 +491,12 @@ static int dw3101_i2c_transfer(struct i2/* first write first register number */ u8 ibuf[MAX_XFER_SIZE ], obuf[3 ]; +if (2 + msg[0 ].len !=sizeof (obuf)) { +warn ("i2c rd: len=%d is not 1!\n" , + msg[0 ].len); + ret = -EOPNOTSUPP ; + goto unlock; + }if (2 + msg[1 ].len >sizeof (ibuf)) {warn ("i2c rd: len=%d is too big!\n" , msg[1 ].len);
@@ -697,6 +731,13 @@ static int su3000_i2c_transfer(struct i2 msg[0 ].buf[0 ] = state->data[1 ];break ;default : +if (3 + msg[0 ].len >sizeof (state->data)) { +warn ("i2c wr: len=%d is too big!\n" , + msg[0 ].len); + num = -EOPNOTSUPP ; +break ; + } +/* always i2c write*/ state->data[0 ] =0x08 ; state->data[1 ] = msg[0 ].addr;
@@ -712,6 +753,19 @@ static int su3000_i2c_transfer(struct i2break ;case 2 :/* always i2c read */ +if (4 + msg[0 ].len >sizeof (state->data)) { +warn ("i2c rd: len=%d is too big!\n" , + msg[0 ].len); + num = -EOPNOTSUPP ; +break ; + } +if (1 + msg[1 ].len >sizeof (state->data)) { +warn ("i2c rd: len=%d is too big!\n" , + msg[1 ].len); + num = -EOPNOTSUPP ; +break ; + } + state->data[0 ] =0x09 ; state->data[1 ] = msg[0 ].len; state->data[2 ] = msg[1 ].len;
Greg Kroah-Hartman
maintainerPATCH 107/164 cx231xx-audio: fix init error path
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit fff1abc4d54e469140a699612b4db8d6397bfcba upstream.
Make sure to release the snd_card also on a late allocation error.
--- drivers/media/usb/cx231xx/cx231xx-audio.c | 25 ++++++++++++++----------- 1 file changed, 14 insertions(+), 11 deletions(-)
drivers/media/usb/cx231xx/cx231xx-audio.c +14 -11
@@ -674,10 +674,8 @@ static int cx231xx_audio_init(struct cx2spin_lock_init (&adev->slock); err =snd_pcm_new (card,"Cx231xx Audio" ,0 ,0 ,1 , &pcm); -if (err <0 ) { -snd_card_free (card); -return err; - } +if (err <0 ) + goto err_free_card;snd_pcm_set_ops (pcm,SNDRV_PCM_STREAM_CAPTURE , &snd_cx231xx_pcm_capture);
@@ -691,10 +689,9 @@ static int cx231xx_audio_init(struct cx2INIT_WORK (&dev->wq_trigger, audio_trigger); err =snd_card_register (card); -if (err <0 ) { -snd_card_free (card); -return err; - } +if (err <0 ) + goto err_free_card; + adev->sndcard = card; adev->udev = dev->udev;
@@ -713,9 +710,10 @@ static int cx231xx_audio_init(struct cx2"audio EndPoint Addr 0x%x, Alternate settings: %i\n" , adev->end_point_addr, adev->num_alt); adev->alt_max_pkt_size =kmalloc (32 * adev->num_alt,GFP_KERNEL ); - -if (adev->alt_max_pkt_size ==NULL ) -return -ENOMEM ; +if (!adev->alt_max_pkt_size) { + err = -ENOMEM ; + goto err_free_card; + }for (i =0 ; i < adev->num_alt; i++) { u16 tmp =
@@ -729,6 +727,11 @@ static int cx231xx_audio_init(struct cx2 }return 0 ; + +err_free_card: +snd_card_free (card); + +return err; }static int cx231xx_audio_fini (struct cx231xx *dev)
Greg Kroah-Hartman
maintainerPATCH 108/164 cx231xx-audio: fix NULL-deref at probe
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 65f921647f4c89a2068478c89691f39b309b58f7 upstream.
Make sure to check the number of endpoints to avoid dereferencing a NULL-pointer or accessing memory beyond the endpoint array should a malicious device lack the expected endpoints.
--- drivers/media/usb/cx231xx/cx231xx-audio.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-)
drivers/media/usb/cx231xx/cx231xx-audio.c +15 -2
@@ -701,6 +701,11 @@ static int cx231xx_audio_init(struct cx2 hs_config_info[0 ].interface_info. audio_index + 1]; +if (uif->altsetting[0 ].desc.bNumEndpoints < isoc_pipe +1 ) { + err = -ENODEV ; + goto err_free_card; + } + adev->end_point_addr = uif->altsetting[0 ].endpoint[isoc_pipe].desc. bEndpointAddress;
@@ -716,8 +721,14 @@ static int cx231xx_audio_init(struct cx2 }for (i =0 ; i < adev->num_alt; i++) { -u16 tmp = -le16_to_cpu (uif->altsetting[i].endpoint[isoc_pipe].desc. +u16 tmp; + +if (uif->altsetting[i].desc.bNumEndpoints < isoc_pipe +1 ) { + err = -ENODEV ; + goto err_free_pkt_size; + } + + tmp =le16_to_cpu (uif->altsetting[i].endpoint[isoc_pipe].desc. wMaxPacketSize); adev->alt_max_pkt_size[i] = (tmp &0x07ff ) * (((tmp &0x1800 ) >>11 ) +1 );
@@ -728,6 +739,8 @@ static int cx231xx_audio_init(struct cx2return 0 ; +err_free_pkt_size: +kfree (adev->alt_max_pkt_size); err_free_card:snd_card_free (card);
Greg Kroah-Hartman
maintainerPATCH 109/164 cx231xx-cards: fix NULL-deref at probe
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 0cd273bb5e4d1828efaaa8dfd11b7928131ed149 upstream.
Make sure to check the number of endpoints to avoid dereferencing a NULL-pointer or accessing memory beyond the endpoint array should a malicious device lack the expected endpoints.
--- drivers/media/usb/cx231xx/cx231xx-cards.c | 45 ++++++++++++++++++++++++++---- 1 file changed, 40 insertions(+), 5 deletions(-)
drivers/media/usb/cx231xx/cx231xx-cards.c +40 -5
@@ -1397,6 +1397,9 @@ static int cx231xx_init_v4l2(struct cx23 uif = udev->actconfig->interface[idx]; +if (uif->altsetting[0 ].desc.bNumEndpoints < isoc_pipe +1 ) +return -ENODEV ; + dev->video_mode.end_point_addr = uif->altsetting[0 ].endpoint[isoc_pipe].desc.bEndpointAddress; dev->video_mode.num_alt = uif->num_altsetting;
@@ -1410,7 +1413,12 @@ static int cx231xx_init_v4l2(struct cx23return -ENOMEM ;for (i =0 ; i < dev->video_mode.num_alt; i++) { -u16 tmp =le16_to_cpu (uif->altsetting[i].endpoint[isoc_pipe].desc.wMaxPacketSize); +u16 tmp; + +if (uif->altsetting[i].desc.bNumEndpoints < isoc_pipe +1 ) +return -ENODEV ; + + tmp =le16_to_cpu (uif->altsetting[i].endpoint[isoc_pipe].desc.wMaxPacketSize); dev->video_mode.alt_max_pkt_size[i] = (tmp &0x07ff ) * (((tmp &0x1800 ) >>11 ) +1 ); dev_dbg(dev->dev, "Alternate setting %i, max size= %i\n", i,
@@ -1427,6 +1435,9 @@ static int cx231xx_init_v4l2(struct cx23 } uif = udev->actconfig->interface[idx]; +if (uif->altsetting[0 ].desc.bNumEndpoints < isoc_pipe +1 ) +return -ENODEV ; + dev->vbi_mode.end_point_addr = uif->altsetting[0 ].endpoint[isoc_pipe].desc. bEndpointAddress;
@@ -1443,8 +1454,12 @@ static int cx231xx_init_v4l2(struct cx23return -ENOMEM ;for (i =0 ; i < dev->vbi_mode.num_alt; i++) { -u16 tmp = -le16_to_cpu (uif->altsetting[i].endpoint[isoc_pipe]. +u16 tmp; + +if (uif->altsetting[i].desc.bNumEndpoints < isoc_pipe +1 ) +return -ENODEV ; + + tmp =le16_to_cpu (uif->altsetting[i].endpoint[isoc_pipe]. desc.wMaxPacketSize); dev->vbi_mode.alt_max_pkt_size[i] = (tmp &0x07ff ) * (((tmp &0x1800 ) >>11 ) +1 );
@@ -1464,6 +1479,9 @@ static int cx231xx_init_v4l2(struct cx23 } uif = udev->actconfig->interface[idx]; +if (uif->altsetting[0 ].desc.bNumEndpoints < isoc_pipe +1 ) +return -ENODEV ; + dev->sliced_cc_mode.end_point_addr = uif->altsetting[0 ].endpoint[isoc_pipe].desc. bEndpointAddress;
@@ -1478,7 +1496,12 @@ static int cx231xx_init_v4l2(struct cx23return -ENOMEM ;for (i =0 ; i < dev->sliced_cc_mode.num_alt; i++) { -u16 tmp =le16_to_cpu (uif->altsetting[i].endpoint[isoc_pipe]. +u16 tmp; + +if (uif->altsetting[i].desc.bNumEndpoints < isoc_pipe +1 ) +return -ENODEV ; + + tmp =le16_to_cpu (uif->altsetting[i].endpoint[isoc_pipe]. desc.wMaxPacketSize); dev->sliced_cc_mode.alt_max_pkt_size[i] = (tmp &0x07ff ) * (((tmp &0x1800 ) >>11 ) +1 );
@@ -1647,6 +1670,11 @@ static int cx231xx_usb_probe(struct usb_ } uif = udev->actconfig->interface[idx]; +if (uif->altsetting[0 ].desc.bNumEndpoints < isoc_pipe +1 ) { + retval = -ENODEV ; + goto err_video_alt; + } + dev->ts1_mode.end_point_addr = uif->altsetting[0 ].endpoint[isoc_pipe]. desc.bEndpointAddress;
@@ -1664,7 +1692,14 @@ static int cx231xx_usb_probe(struct usb_ }for (i =0 ; i < dev->ts1_mode.num_alt; i++) { -u16 tmp =le16_to_cpu (uif->altsetting[i]. +u16 tmp; + +if (uif->altsetting[i].desc.bNumEndpoints < isoc_pipe +1 ) { + retval = -ENODEV ; + goto err_video_alt; + } + + tmp =le16_to_cpu (uif->altsetting[i]. endpoint[isoc_pipe].desc. wMaxPacketSize); dev->ts1_mode.alt_max_pkt_size[i] =
Greg Kroah-Hartman
maintainerPATCH 110/164 powerpc/mm: Ensure IRQs are off in switch_mm()
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Gibson <[email protected]>
commit 9765ad134a00a01cbcc69c78ff6defbfad209bc5 upstream.
powerpc expects IRQs to already be (soft) disabled when switch_mm() is called, as made clear in the commit message of 9c1e105238c4 ("powerpc: Allow perf_counters to access user memory at interrupt time").
Aside from any race conditions that might exist between switch_mm() and an IRQ, there is also an unconditional hard_irq_disable() in switch_slb(). If that isn't followed at some point by an IRQ enable then interrupts will remain disabled until we return to userspace.
It is true that when switch_mm() is called from the scheduler IRQs are off, but not when it's called by use_mm(). Looking closer we see that last year in commit f98db6013c55 ("sched/core: Add switch_mm_irqs_off() and use it in the scheduler") this was made more explicit by the addition of switch_mm_irqs_off() which is now called by the scheduler, vs switch_mm() which is used by use_mm().
Arguably it is a bug in use_mm() to call switch_mm() in a different context than it expects, but fixing that will take time.
This was discovered recently when vhost started throwing warnings such as:
BUG: sleeping function called from invalid context at kernel/mutex.c:578
in_atomic(): 0, irqs_disabled(): 1, pid: 10768, name: vhost-10760
no locks held by vhost-10760/10768.
irq event stamp: 10
hardirqs last enabled at (9): _raw_spin_unlock_irq+0x40/0x80
hardirqs last disabled at (10): switch_slb+0x2e4/0x490
softirqs last enabled at (0): copy_process+0x5e8/0x1260
softirqs last disabled at (0): (null)
Call Trace:
show_stack+0x88/0x390 (unreliable)
dump_stack+0x30/0x44
__might_sleep+0x1c4/0x2d0
mutex_lock_nested+0x74/0x5c0
cgroup_attach_task_all+0x5c/0x180
vhost_attach_cgroups_work+0x58/0x80 [vhost]
vhost_worker+0x24c/0x3d0 [vhost]
kthread+0xec/0x100
ret_from_kernel_thread+0x5c/0xd4Prior to commit 04b96e5528ca ("vhost: lockless enqueuing") (Aug 2016) the vhost_worker() would do a spin_unlock_irq() not long after calling use_mm(), which had the effect of reenabling IRQs. Since that commit removed the locking in vhost_worker() the body of the vhost_worker() loop now runs with interrupts off causing the warnings.
This patch addresses the problem by making the powerpc code mirror the x86 code, ie. we disable interrupts in switch_mm(), and optimise the scheduler case by defining switch_mm_irqs_off().
--- arch/powerpc/include/asm/mmu_context.h | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-)
arch/powerpc/include/asm/mmu_context.h +15 -2
@@ -70,8 +70,9 @@ extern void drop_cop(unsigned long acop,* switch_mm is the entry point called from the architecture independent * code in kernel/sched/core.c */ -static inline void switch_mm (struct mm_struct *prev,struct mm_struct *next, -struct task_struct *tsk) +static inline void switch_mm_irqs_off (struct mm_struct *prev, +struct mm_struct *next, +struct task_struct *tsk) {/* Mark this context has been used on the new CPU */ if (!cpumask_test_cpu (smp_processor_id (),mm_cpumask (next)))
@@ -110,6 +111,18 @@ static inline void switch_mm(struct mm_sswitch_mmu_context (prev, next, tsk); } +static inline void switch_mm (struct mm_struct *prev,struct mm_struct *next, +struct task_struct *tsk) +{ +unsigned long flags; + +local_irq_save (flags); +switch_mm_irqs_off (prev, next, tsk); +local_irq_restore (flags); +} +#define switch_mm_irqs_off switch_mm_irqs_off + +#define deactivate_mm (tsk,mm) do { } while (0)/*
Greg Kroah-Hartman
maintainerPATCH 111/164 powerpc/eeh: Avoid use after free in eeh_handle_special_event()
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Russell Currey <[email protected]>
commit daeba2956f32f91f3493788ff6ee02fb1b2f02fa upstream.
eeh_handle_special_event() is called when an EEH event is detected but can't be narrowed down to a specific PE. This function looks through every PE to find one in an erroneous state, then calls the regular event handler eeh_handle_normal_event() once it knows which PE has an error.
However, if eeh_handle_normal_event() found that the PE cannot possibly be recovered, it will free it, rendering the passed PE stale.
This leads to a use after free in eeh_handle_special_event() as it attempts to clear the "recovering" state on the PE after eeh_handle_normal_event() returns.
Thus, make sure the PE is valid when attempting to clear state in eeh_handle_special_event().
--- arch/powerpc/kernel/eeh_driver.c | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-)
arch/powerpc/kernel/eeh_driver.c +15 -4
@@ -724,7 +724,7 @@ static int eeh_reset_device(struct eeh_p*/ #define MAX_WAIT_FOR_RECOVERY 300 -static void eeh_handle_normal_event (struct eeh_pe *pe) +static bool eeh_handle_normal_event (struct eeh_pe *pe) {struct pci_bus *frozen_bus;struct eeh_dev *edev, *tmp;
@@ -736,7 +736,7 @@ static void eeh_handle_normal_event(struif (!frozen_bus) {pr_err ("%s: Cannot find PCI bus for PHB#%d-PE#%x\n" , __func__, pe->phb->global_number, pe->addr); -return ; +return false; }eeh_pe_update_time_stamp (pe);
@@ -870,7 +870,7 @@ static void eeh_handle_normal_event(strupr_info ("EEH: Notify device driver to resume\n" );eeh_pe_dev_traverse (pe, eeh_report_resume,NULL ); -return ; +return false; excess_failures:/*
@@ -915,8 +915,12 @@ perm_error:pci_lock_rescan_remove ();pci_hp_remove_devices (frozen_bus);pci_unlock_rescan_remove (); + +/* The passed PE should no longer be used */ +return true; } } +return false; }static void eeh_handle_special_event (void )
@@ -982,7 +986,14 @@ static void eeh_handle_special_event(voi*/ if (rc ==EEH_NEXT_ERR_FROZEN_PE || rc ==EEH_NEXT_ERR_FENCED_PHB ) { -eeh_handle_normal_event (pe); +/* +* eeh_handle_normal_event() can make the PE stale if it +* determines that the PE cannot possibly be recovered. +* Don't modify the PE state if that's the case. +*/ +if (eeh_handle_normal_event (pe)) +continue ; +eeh_pe_state_clear (pe,EEH_PE_RECOVERING ); }else {pci_lock_rescan_remove ();
Greg Kroah-Hartman
maintainerPATCH 112/164 powerpc/book3s/mce: Move add_taint() later in virtual mode
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mahesh Salgaonkar <[email protected]>
commit d93b0ac01a9ce276ec39644be47001873d3d183c upstream.
machine_check_early() gets called in real mode. The very first time when add_taint() is called, it prints a warning which ends up calling opal call (that uses OPAL_CALL wrapper) for writing it to console. If we get a very first machine check while we are in opal we are doomed. OPAL_CALL overwrites the PACASAVEDMSR in r13 and in this case when we are done with MCE handling the original opal call will use this new MSR on it's way back to opal_return. This usually leads to unexpected behaviour or the kernel to panic. Instead move the add_taint() call later in the virtual mode where it is safe to call.
This is broken with current FW level. We got lucky so far for not getting very first MCE hit while in OPAL. But easily reproducible on Mambo.
--- arch/powerpc/kernel/mce.c | 2 ++ arch/powerpc/kernel/traps.c | 4 ++-- 2 files changed, 4 insertions(+), 2 deletions(-)
arch/powerpc/kernel/mce.c +2 -0
@@ -205,6 +205,8 @@ static void machine_check_process_queued {int index; +add_taint (TAINT_MACHINE_CHECK ,LOCKDEP_NOW_UNRELIABLE ); +/* * For now just print it to console. * TODO: log this error event to FSP or nvram.
arch/powerpc/kernel/traps.c +2 -2
@@ -302,8 +302,6 @@ long machine_check_early(struct pt_regs__this_cpu_inc (irq_stat.mce_exceptions); -add_taint (TAINT_MACHINE_CHECK ,LOCKDEP_NOW_UNRELIABLE ); -if (cur_cpu_spec && cur_cpu_spec->machine_check_early) handled = cur_cpu_spec->machine_check_early (regs);return handled;
@@ -737,6 +735,8 @@ void machine_check_exception(struct pt_r__this_cpu_inc (irq_stat.mce_exceptions); +add_taint (TAINT_MACHINE_CHECK ,LOCKDEP_NOW_UNRELIABLE ); +/* See if any machine dependent calls. In theory, we would want * to call the CPU first, and call the ppc_md. one if the CPU * one returns a positive number. However there is existing code
Greg Kroah-Hartman
maintainerPATCH 113/164 powerpc/pseries: Fix of_node_put() underflow during DLPAR remove
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tyrel Datwyler <[email protected]>
commit 68baf692c435339e6295cb470ea5545cbc28160e upstream.
Historically struct device_node references were tracked using a kref embedded as a struct field. Commit 75b57ecf9d1d ("of: Make device nodes kobjects so they show up in sysfs") (Mar 2014) refactored device_nodes to be kobjects such that the device tree could by more simply exposed to userspace using sysfs.
Commit 0829f6d1f69e ("of: device_node kobject lifecycle fixes") (Mar 2014) followed up these changes to better control the kobject lifecycle and in particular the referecne counting via of_node_get(), of_node_put(), and of_node_init().
A result of this second commit was that it introduced an of_node_put() call when a dynamic node is detached, in of_node_remove(), that removes the initial kobj reference created by of_node_init().
Traditionally as the original dynamic device node user the pseries code had assumed responsibilty for releasing this final reference in its platform specific DLPAR detach code.
This patch fixes a refcount underflow introduced by commit 0829f6d1f6, and recently exposed by the upstreaming of the recount API.
Messages like the following are no longer seen in the kernel log with this patch following DLPAR remove operations of cpus and pci devices.
rpadlpar_io: slot PHB 72 removed
refcount_t: underflow; use-after-free.
------------[ cut here ]------------ WARNING: CPU: 5 PID: 3335 at lib/refcount.c:128 refcount_sub_and_test+0xf4/0x110
--- arch/powerpc/platforms/pseries/dlpar.c | 1 - 1 file changed, 1 deletion(-)
arch/powerpc/platforms/pseries/dlpar.c +0 -1
@@ -288,7 +288,6 @@ int dlpar_detach_node(struct device_nodeif (rc)return rc; -of_node_put (dn);/* Must decrement the refcount */ return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 114/164 powerpc/iommu: Do not call PageTransHuge() on tail pages
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Kardashevskiy <[email protected]>
commit e889e96e98e8da97bd39e46b7253615eabe14397 upstream.
The CMA pages migration code does not support compound pages at the moment so it performs few tests before proceeding to actual page migration.
One of the tests - PageTransHuge() - has VM_BUG_ON_PAGE(PageTail()) as it is designed to be called on head pages only. Since we also test for PageCompound(), and it contains PageTail() and PageHead(), we can simplify the check by leaving just PageCompound() and therefore avoid possible VM_BUG_ON_PAGE.
--- arch/powerpc/mm/mmu_context_iommu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/powerpc/mm/mmu_context_iommu.c +2 -2
@@ -81,7 +81,7 @@ struct page *new_iommu_non_cma_page(strugfp_t gfp_mask =GFP_USER ;struct page *new_page; -if (PageHuge (page) ||PageTransHuge (page) ||PageCompound (page)) +if (PageCompound (page))return NULL ;if (PageHighMem (page))
@@ -100,7 +100,7 @@ static int mm_iommu_move_page_from_cma(sLIST_HEAD (cma_migrate_pages);/* Ignore huge pages for now */ -if (PageHuge (page) ||PageTransHuge (page) ||PageCompound (page)) +if (PageCompound (page))return -EBUSY ;lru_add_drain ();
Greg Kroah-Hartman
maintainerPATCH 115/164 powerpc/64e: Fix hang when debugging programs with relocated kernel
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: LiuHailong <[email protected]>
commit fd615f69a18a9d4aa5ef02a1dc83f319f75da8e7 upstream.
Debug interrupts can be taken during interrupt entry, since interrupt entry does not automatically turn them off. The kernel will check whether the faulting instruction is between [interrupt_base_book3e, __end_interrupts], and if so clear MSR[DE] and return.
However, when the kernel is built with CONFIG_RELOCATABLE, it can't use LOAD_REG_IMMEDIATE(r14,interrupt_base_book3e) and LOAD_REG_IMMEDIATE(r15,__end_interrupts), as they ignore relocation. Thus, if the kernel is actually running at a different address than it was built at, the address comparison will fail, and the exception entry code will hang at kernel_dbg_exc.
r2(toc) is also not usable here, as r2 still holds data from the interrupted context, so LOAD_REG_ADDR() doesn't work either. So we use the *name@got* to get the EV of two labels directly.
Test programs test.c shows as follows:
int main(int argc, char *argv[])
{
if (access("/proc/sys/kernel/perf_event_paranoid", F_OK) == -1)
printf("Kernel doesn't have perf_event support\n");
}Steps to reproduce the bug, for example:
1) ./gdb ./test
2) (gdb) b access
3) (gdb) r
4) (gdb) s
[scottwood: cleaned up commit message, and specified bad behavior
as a hang rather than an oops to correspond to mainline kernel behavior]
--- arch/powerpc/kernel/exceptions-64e.S | 12 ++++++++++++ 1 file changed, 12 insertions(+)
arch/powerpc/kernel/exceptions-64e.S +12 -0
@@ -735,8 +735,14 @@ END_FTR_SECTION_IFSET(CPU_FTR_ALTIVEC) andis. r15,r14,(DBSR_IC|DBSR_BT)@h beq+ 1f +#ifdef CONFIG_RELOCATABLE + ld r15,PACATOC(r13) + ld r14,interrupt_base_book3e@got(r15) + ld r15,__end_interrupts@got(r15) +#else LOAD_REG_IMMEDIATE(r14,interrupt_base_book3e) LOAD_REG_IMMEDIATE(r15,__end_interrupts) +#endif cmpld cr0,r10,r14 cmpld cr1,r10,r15 blt+ cr0,1f
@@ -799,8 +805,14 @@ kernel_dbg_exc: andis. r15,r14,(DBSR_IC|DBSR_BT)@h beq+ 1f +#ifdef CONFIG_RELOCATABLE + ld r15,PACATOC(r13) + ld r14,interrupt_base_book3e@got(r15) + ld r15,__end_interrupts@got(r15) +#else LOAD_REG_IMMEDIATE(r14,interrupt_base_book3e) LOAD_REG_IMMEDIATE(r15,__end_interrupts) +#endif cmpld cr0,r10,r14 cmpld cr1,r10,r15 blt+ cr0,1f
Greg Kroah-Hartman
maintainerPATCH 116/164 powerpc/tm: Fix FP and VMX register corruption
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Neuling <[email protected]>
commit f48e91e87e67b56bef63393d1a02c6e22c1d7078 upstream.
In commit dc3106690b20 ("powerpc: tm: Always use fp_state and vr_state to store live registers"), a section of code was removed that copied the current state to checkpointed state. That code should not have been removed.
When an FP (Floating Point) unavailable is taken inside a transaction, we need to abort the transaction. This is because at the time of the tbegin, the FP state is bogus so the state stored in the checkpointed registers is incorrect. To fix this, we treclaim (to get the checkpointed GPRs) and then copy the thread_struct FP live state into the checkpointed state. We then trecheckpoint so that the FP state is correctly restored into the CPU.
The copying of the FP registers from live to checkpointed is what was missing.
This simplifies the logic slightly from the original patch. tm_reclaim_thread() will now always write the checkpointed FP state. Either the checkpointed FP state will be written as part of the actual treclaim (in tm.S), or it'll be a copy of the live state. Which one we use is based on MSR[FP] from userspace.
Similarly for VMX.
--- arch/powerpc/kernel/process.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+)
arch/powerpc/kernel/process.c +19 -0
@@ -839,6 +839,25 @@ static void tm_reclaim_thread(struct thrif (!MSR_TM_SUSPENDED (mfmsr ()))return ; +/* +* If we are in a transaction and FP is off then we can't have +* used FP inside that transaction. Hence the checkpointed +* state is the same as the live state. We need to copy the +* live state to the checkpointed state so that when the +* transaction is restored, the checkpointed state is correct +* and the aborted transaction sees the correct state. We use +* ckpt_regs.msr here as that's what tm_reclaim will use to +* determine if it's going to write the checkpointed state or +* not. So either this will write the checkpointed registers, +* or reclaim will. Similarly for VMX. +*/ +if ((thr->ckpt_regs.msr &MSR_FP ) ==0 ) +memcpy (&thr->ckfp_state, &thr->fp_state, +sizeof (struct thread_fp_state )); +if ((thr->ckpt_regs.msr &MSR_VEC ) ==0 ) +memcpy (&thr->ckvr_state, &thr->vr_state, +sizeof (struct thread_vr_state )); +giveup_all (container_of(thr ,struct task_struct ,thread ));tm_reclaim (thr, thr->ckpt_regs.msr, cause);
Greg Kroah-Hartman
maintainerPATCH 117/164 arm64: KVM: Do not use stack-protector to compile EL2 code
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Zyngier <[email protected]>
commit cde13b5dad60471886a3bccb4f4134c647c4a9dc upstream.
We like living dangerously. Nothing explicitely forbids stack-protector to be used in the EL2 code, while distributions routinely compile their kernel with it. We're just lucky that no code actually triggers the instrumentation.
Let's not try our luck for much longer, and disable stack-protector for code living at EL2.
--- arch/arm64/kvm/hyp/Makefile | 2 ++ 1 file changed, 2 insertions(+)
arch/arm64/kvm/hyp/Makefile +2 -0
@@ -2,6 +2,8 @@ # Makefile for Kernel-based Virtual Machine module, HYP part # +ccflags-y += -fno-stack-protector + KVM=../../../../virt/kvm obj-$(CONFIG_KVM_ARM_HOST) += $(KVM)/arm/hyp/vgic-v2-sr.o
Greg Kroah-Hartman
maintainerPATCH 118/164 arm: KVM: Do not use stack-protector to compile HYP code
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Zyngier <[email protected]>
commit 501ad27c67ed0b90df465f23d33e9aed64058a47 upstream.
We like living dangerously. Nothing explicitely forbids stack-protector to be used in the HYP code, while distributions routinely compile their kernel with it. We're just lucky that no code actually triggers the instrumentation.
Let's not try our luck for much longer, and disable stack-protector for code living at HYP.
--- arch/arm/kvm/hyp/Makefile | 2 ++ 1 file changed, 2 insertions(+)
arch/arm/kvm/hyp/Makefile +2 -0
@@ -2,6 +2,8 @@ # Makefile for Kernel-based Virtual Machine module, HYP part # +ccflags-y += -fno-stack-protector + KVM=../../../../virt/kvm obj-$(CONFIG_KVM_ARM_HOST) += $(KVM)/arm/hyp/vgic-v2-sr.o
Greg Kroah-Hartman
maintainerPATCH 119/164 KVM: arm/arm64: vgic-v2: Do not use Active+Pending state for a HW interrupt
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Zyngier <[email protected]>
commit ddf42d068f8802de122bb7efdfcb3179336053f1 upstream.
When an interrupt is injected with the HW bit set (indicating that deactivation should be propagated to the physical distributor), special care must be taken so that we never mark the corresponding LR with the Active+Pending state (as the pending state is kept in the physycal distributor).
--- virt/kvm/arm/vgic/vgic-v2.c | 7 +++++++ 1 file changed, 7 insertions(+)
virt/kvm/arm/vgic/vgic-v2.c +7 -0
@@ -168,6 +168,13 @@ void vgic_v2_populate_lr(struct kvm_vcpuif (irq->hw) { val |=GICH_LR_HW ; val |= irq->hwintid <<GICH_LR_PHYSID_CPUID_SHIFT ; +/* +* Never set pending+active on a HW interrupt, as the +* pending state is kept at the physical distributor +* level. +*/ +if (irq->active &&irq_is_pending (irq)) + val &= ~GICH_LR_PENDING_BIT ; }else {if (irq->config ==VGIC_CONFIG_LEVEL ) val |=GICH_LR_EOI ;
Greg Kroah-Hartman
maintainerPATCH 120/164 KVM: arm/arm64: vgic-v3: Do not use Active+Pending state for a HW interrupt
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Zyngier <[email protected]>
commit 3d6e77ad1489650afa20da92bb589c8778baa8da upstream.
When an interrupt is injected with the HW bit set (indicating that deactivation should be propagated to the physical distributor), special care must be taken so that we never mark the corresponding LR with the Active+Pending state (as the pending state is kept in the physycal distributor).
--- virt/kvm/arm/vgic/vgic-v3.c | 7 +++++++ 1 file changed, 7 insertions(+)
virt/kvm/arm/vgic/vgic-v3.c +7 -0
@@ -151,6 +151,13 @@ void vgic_v3_populate_lr(struct kvm_vcpuif (irq->hw) { val |=ICH_LR_HW ; val |= ((u64 )irq->hwintid) <<ICH_LR_PHYS_ID_SHIFT ; +/* +* Never set pending+active on a HW interrupt, as the +* pending state is kept at the physical distributor +* level. +*/ +if (irq->active &&irq_is_pending (irq)) + val &= ~ICH_LR_PENDING_BIT ; }else {if (irq->config ==VGIC_CONFIG_LEVEL ) val |=ICH_LR_EOI ;
Greg Kroah-Hartman
maintainerPATCH 122/164 ARM: 8662/1: module: split core and init PLT sections
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ard Biesheuvel <[email protected]>
commit b7ede5a1f5905ac394cc8e61712a13e3c5cb7b8f upstream.
Since commit 35fa91eed817 ("ARM: kernel: merge core and init PLTs"), the ARM module PLT code allocates all PLT entries in a single core section, since the overhead of having a separate init PLT section is not justified by the small number of PLT entries usually required for init code.
However, the core and init module regions are allocated independently, and there is a corner case where the core region may be allocated from the VMALLOC region if the dedicated module region is exhausted, but the init region, being much smaller, can still be allocated from the module region. This puts the PLT entries out of reach of the relocated branch instructions, defeating the whole purpose of PLTs.
So split the core and init PLT regions, and name the latter ".init.plt" so it gets allocated along with (and sufficiently close to) the .init sections that it serves. Also, given that init PLT entries may need to be emitted for branches that target the core module, modify the logic that disregards defined symbols to only disregard symbols that are defined in the same section.
--- arch/arm/include/asm/module.h | 9 +++- arch/arm/kernel/module-plts.c | 85 +++++++++++++++++++++++++++++------------- arch/arm/kernel/module.lds | 1 3 files changed, 67 insertions(+), 28 deletions(-)
arch/arm/include/asm/module.h +7 -2
@@ -18,13 +18,18 @@ enum { };#endif +struct mod_plt_sec { +struct elf32_shdr *plt; +int plt_count; +}; +struct mod_arch_specific {#ifdef CONFIG_ARM_UNWIND struct unwind_table *unwind[ARM_SEC_MAX ];#endif #ifdef CONFIG_ARM_MODULE_PLTS -struct elf32_shdr *plt; -int plt_count; +struct mod_plt_sec core; +struct mod_plt_sec init;#endif };
arch/arm/kernel/module-plts.c +59 -26
153 lines not on this page · raw message
arch/arm/kernel/module.lds +1 -0
@@ -1,3 +1,4 @@ SECTIONS { .plt : { BYTE(0) } + .init.plt : { BYTE(0) } }
Greg Kroah-Hartman
maintainerPATCH 123/164 ARM: 8670/1: V7M: Do not corrupt vector table around v7m_invalidate_l1 call
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Murzin <[email protected]>
commit 6d80594936914e798b1b54b3bfe4bd68d8418966 upstream.
We save/restore registers around v7m_invalidate_l1 to address pointed by r12, which is vector table, so the first eight entries are overwritten with a garbage. We already have stack setup at that stage, so use it to save/restore register.
--- arch/arm/mm/proc-v7m.S | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/mm/proc-v7m.S +2 -2
@@ -147,10 +147,10 @@ __v7m_setup_cont: @ Configure caches (if implemented) teq r8, #0 - stmneia r12, {r0-r6, lr} @ v7m_invalidate_l1 touches r0-r6 + stmneia sp, {r0-r6, lr} @ v7m_invalidate_l1 touches r0-r6 blne v7m_invalidate_l1 teq r8, #0 @ re-evalutae condition - ldmneia r12, {r0-r6, lr} + ldmneia sp, {r0-r6, lr} @ Configure the System Control Register to ensure 8-byte stack alignment @ Note the STKALIGN bit is either RW or RAO.
Greg Kroah-Hartman
maintainerPATCH 124/164 ARM: dts: at91: sama5d3_xplained: fix ADC vref
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ludovic Desroches <[email protected]>
commit 9cdd31e5913c1f86dce7e201b086155b3f24896b upstream.
The voltage reference for the ADC is not 3V but 3.3V since it is connected to VDDANA.
--- arch/arm/boot/dts/at91-sama5d3_xplained.dts | 1 + 1 file changed, 1 insertion(+)
arch/arm/boot/dts/at91-sama5d3_xplained.dts +1 -0
@@ -162,6 +162,7 @@ }; adc0: adc@f8018000 { + atmel,adc-vref = <3300>; pinctrl-0 = < &pinctrl_adc0_adtrg &pinctrl_adc0_ad0
Greg Kroah-Hartman
maintainerPATCH 125/164 ARM: dts: at91: sama5d3_xplained: not all ADC channels are available
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ludovic Desroches <[email protected]>
commit d3df1ec06353e51fc44563d2e7e18d42811af290 upstream.
Remove ADC channels that are not available by default on the sama5d3_xplained board (resistor not populated) in order to not create confusion.
--- arch/arm/boot/dts/at91-sama5d3_xplained.dts | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
arch/arm/boot/dts/at91-sama5d3_xplained.dts +1 -3
@@ -163,9 +163,9 @@ adc0: adc@f8018000 { atmel,adc-vref = <3300>; + atmel,adc-channels-used = <0xfe>; pinctrl-0 = < &pinctrl_adc0_adtrg - &pinctrl_adc0_ad0 &pinctrl_adc0_ad1 &pinctrl_adc0_ad2 &pinctrl_adc0_ad3
@@ -173,8 +173,6 @@ &pinctrl_adc0_ad5 &pinctrl_adc0_ad6 &pinctrl_adc0_ad7 - &pinctrl_adc0_ad8 - &pinctrl_adc0_ad9 >; status = "okay"; };
Greg Kroah-Hartman
maintainerPATCH 126/164 ARM: dts: imx6sx-sdb: Remove OPP override
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leonard Crestez <[email protected]>
commit d8581c7c8be172dac156a19d261f988a72ce596f upstream.
The board file for imx6sx-sdb overrides cpufreq operating points to use higher voltages. This is done because the board has a shared rail for VDD_ARM_IN and VDD_SOC_IN and when using LDO bypass the shared voltage needs to be a value suitable for both ARM and SOC.
This only applies to LDO bypass mode, a feature not present in upstream. When LDOs are enabled the effect is to use higher voltages than necessary for no good reason.
Setting these higher voltages can make some boards fail to boot with ugly semi-random crashes reminiscent of memory corruption. These failures only happen on board rev. C, rev. B is reported to still work.
--- arch/arm/boot/dts/imx6sx-sdb.dts | 17 ----------------- 1 file changed, 17 deletions(-)
arch/arm/boot/dts/imx6sx-sdb.dts +0 -17
@@ -12,23 +12,6 @@ model = "Freescale i.MX6 SoloX SDB RevB Board"; }; -&cpu0 { - operating-points = < - /* kHz uV */ - 996000 1250000 - 792000 1175000 - 396000 1175000 - 198000 1175000 - >; - fsl,soc-operating-points = < - /* ARM kHz SOC uV */ - 996000 1250000 - 792000 1175000 - 396000 1175000 - 198000 1175000 - >; -}; - &i2c1 { clock-frequency = <100000>; pinctrl-names = "default";
Greg Kroah-Hartman
maintainerPATCH 127/164 arm64: dts: hi6220: Reset the mmc hosts
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Lezcano <[email protected]>
commit 0fbdf9953b41c28845fe8d05007ff09634ee3000 upstream.
The MMC hosts could be left in an unconsistent or uninitialized state from the firmware. Instead of assuming, the firmware did the right things, let's reset the host controllers.
This change fixes a bug when the mmc2/sdio is initialized leading to a hung task:
[ 242.704294] INFO: task kworker/7:1:675 blocked for more than 120 seconds. [ 242.711129] Not tainted 4.9.0-rc8-00017-gcf0251f #3 [ 242.716571] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 242.724435] kworker/7:1 D 0 675 2 0x00000000 [ 242.729973] Workqueue: events_freezable mmc_rescan [ 242.734796] Call trace: [ 242.737269] [<ffff00000808611c>] __switch_to+0xa8/0xb4 [ 242.742437] [<ffff000008d07c04>] __schedule+0x1c0/0x67c [ 242.747689] [<ffff000008d08254>] schedule+0x40/0xa0 [ 242.752594] [<ffff000008d0b284>] schedule_timeout+0x1c4/0x35c [ 242.758366] [<ffff000008d08e38>] wait_for_common+0xd0/0x15c [ 242.763964] [<ffff000008d09008>] wait_for_completion+0x28/0x34 [ 242.769825] [<ffff000008a1a9f4>] mmc_wait_for_req_done+0x40/0x124 [ 242.775949] [<ffff000008a1ab98>] mmc_wait_for_req+0xc0/0xf8 [ 242.781549] [<ffff000008a1ac3c>] mmc_wait_for_cmd+0x6c/0x84 [ 242.787149] [<ffff000008a26610>] mmc_io_rw_direct_host+0x9c/0x114 [ 242.793270] [<ffff000008a26aa0>] sdio_reset+0x34/0x7c [ 242.798347] [<ffff000008a1d46c>] mmc_rescan+0x2fc/0x360
[ ... ]
--- arch/arm64/boot/dts/hisilicon/hi6220.dtsi | 3 +++ 1 file changed, 3 insertions(+)
arch/arm64/boot/dts/hisilicon/hi6220.dtsi +3 -0
@@ -772,6 +772,7 @@ clocks = <&sys_ctrl 2>, <&sys_ctrl 1>; clock-names = "ciu", "biu"; resets = <&sys_ctrl PERIPH_RSTDIS0_MMC0>; + reset-names = "reset"; bus-width = <0x8>; vmmc-supply = <&ldo19>; pinctrl-names = "default";
@@ -795,6 +796,7 @@ clocks = <&sys_ctrl 4>, <&sys_ctrl 3>; clock-names = "ciu", "biu"; resets = <&sys_ctrl PERIPH_RSTDIS0_MMC1>; + reset-names = "reset"; vqmmc-supply = <&ldo7>; vmmc-supply = <&ldo10>; bus-width = <0x4>;
@@ -813,6 +815,7 @@ clocks = <&sys_ctrl HI6220_MMC2_CIUCLK>, <&sys_ctrl HI6220_MMC2_CLK>; clock-names = "ciu", "biu"; resets = <&sys_ctrl PERIPH_RSTDIS0_MMC2>; + reset-names = "reset"; bus-width = <0x4>; broken-cd; pinctrl-names = "default", "idle";
Greg Kroah-Hartman
maintainerPATCH 128/164 arm64: xchg: hazard against entire exchange variable
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <[email protected]>
commit fee960bed5e857eb126c4e56dd9ff85938356579 upstream.
The inline assembly in __XCHG_CASE() uses a +Q constraint to hazard against other accesses to the memory location being exchanged. However, the pointer passed to the constraint is a u8 pointer, and thus the hazard only applies to the first byte of the location.
GCC can take advantage of this, assuming that other portions of the location are unchanged, as demonstrated with the following test case:
union u {
unsigned long l;
unsigned int i[2];
};unsigned long update_char_hazard(union u *u)
{
unsigned int a, b;
a = u->i[1];
asm ("str %1, %0" : "+Q" (*(char *)&u->l) : "r" (0UL));
b = u->i[1];
return a ^ b;
}unsigned long update_long_hazard(union u *u)
{
unsigned int a, b;
a = u->i[1];
asm ("str %1, %0" : "+Q" (*(long *)&u->l) : "r" (0UL));
b = u->i[1];
return a ^ b;
}The linaro 15.08 GCC 5.1.1 toolchain compiles the above as follows when using -O2 or above:
0000000000000000 <update_char_hazard>:
0: d2800001 mov x1, #0x0 // #0
4: f9000001 str x1, [x0]
8: d2800000 mov x0, #0x0 // #0
c: d65f03c0 ret
0000000000000010 <update_long_hazard>:
10: b9400401 ldr w1, [x0,#4]
14: d2800002 mov x2, #0x0 // #0
18: f9000002 str x2, [x0]
1c: b9400400 ldr w0, [x0,#4]
20: 4a000020 eor w0, w1, w0
24: d65f03c0 ret
This patch fixes the issue by passing an unsigned long pointer into the +Q constraint, as we do for our cmpxchg code. This may hazard against more than is necessary, but this is better than missing a necessary hazard.
--- arch/arm64/include/asm/cmpxchg.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/include/asm/cmpxchg.h +1 -1
@@ -46,7 +46,7 @@ static inline unsigned long __xchg_case_ " swp" #acq_lse #rel #sz "\t%" #w "3, %" #w "0, %2\n" \ __nops(3) \ " " #nop_lse) \ - : "=&r" (ret), "=&r" (tmp), "+Q" (*(u8 *)ptr) \ + : "=&r" (ret), "=&r" (tmp), "+Q" (*(unsigned long *)ptr) \ : "r" (x) \ : cl); \ \
Greg Kroah-Hartman
maintainerPATCH 129/164 arm64: ensure extension of smp_store_release value
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <[email protected]>
commit 994870bead4ab19087a79492400a5478e2906196 upstream.
When an inline assembly operand's type is narrower than the register it is allocated to, the least significant bits of the register (up to the operand type's width) are valid, and any other bits are permitted to contain any arbitrary value. This aligns with the AAPCS64 parameter passing rules.
Our __smp_store_release() implementation does not account for this, and implicitly assumes that operands have been zero-extended to the width of the type being stored to. Thus, we may store unknown values to memory when the value type is narrower than the pointer type (e.g. when storing a char to a long).
This patch fixes the issue by casting the value operand to the same width as the pointer operand in all cases, which ensures that the value is zero-extended as we expect. We use the same union trickery as __smp_load_acquire and {READ,WRITE}_ONCE() to avoid GCC complaining that pointers are potentially cast to narrower width integers in unreachable paths.
A whitespace issue at the top of __smp_store_release() is also corrected.
No changes are necessary for __smp_load_acquire(). Load instructions implicitly clear any upper bits of the register, and the compiler will only consider the least significant bits of the register as valid regardless.
--- arch/arm64/include/asm/barrier.h | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-)
arch/arm64/include/asm/barrier.h +15 -5
@@ -42,25 +42,35 @@#define __smp_rmb () dmb(ishld)#define __smp_wmb () dmb(ishst) -#define __smp_store_release (p, v) \ +#define __smp_store_release (p, v) \ do { \ + union { typeof(*p) __val; char __c[1]; } __u = \ + { .__val = (__force typeof(*p)) (v) }; \ compiletime_assert_atomic_type(*p); \ switch (sizeof(*p)) { \ case 1: \ asm volatile ("stlrb %w1, %0" \ - : "=Q" (*p) : "r" (v) : "memory"); \ + : "=Q" (*p) \ + : "r" (*(__u8 *)__u.__c) \ + : "memory"); \ break; \ case 2: \ asm volatile ("stlrh %w1, %0" \ - : "=Q" (*p) : "r" (v) : "memory"); \ + : "=Q" (*p) \ + : "r" (*(__u16 *)__u.__c) \ + : "memory"); \ break; \ case 4: \ asm volatile ("stlr %w1, %0" \ - : "=Q" (*p) : "r" (v) : "memory"); \ + : "=Q" (*p) \ + : "r" (*(__u32 *)__u.__c) \ + : "memory"); \ break; \ case 8: \ asm volatile ("stlr %1, %0" \ - : "=Q" (*p) : "r" (v) : "memory"); \ + : "=Q" (*p) \ + : "r" (*(__u64 *)__u.__c) \ + : "memory"); \ break; \ } \ } while (0)
Greg Kroah-Hartman
maintainerPATCH 130/164 arm64: armv8_deprecated: ensure extension of addr
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <[email protected]>
commit 55de49f9aa17b0b2b144dd2af587177b9aadf429 upstream.
Our compat swp emulation holds the compat user address in an unsigned int, which it passes to __user_swpX_asm(). When a 32-bit value is passed in a register, the upper 32 bits of the register are unknown, and we must extend the value to 64 bits before we can use it as a base address.
This patch casts the address to unsigned long to ensure it has been suitably extended, avoiding the potential issue, and silencing a related warning from clang.
--- arch/arm64/kernel/armv8_deprecated.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/arm64/kernel/armv8_deprecated.c +2 -1
@@ -309,7 +309,8 @@ static void __init register_insn_emulatiALTERNATIVE ("nop" ,SET_PSTATE_PAN (1 ),ARM64_HAS_PAN , \CONFIG_ARM64_PAN ) \ : "=&r" (res), "+r" (data), "=&r" (temp), "=&r" (temp2) \ -: " r" (addr), " i" (-EAGAIN), " i" (-EFAULT), \ +: " r" ((unsigned long)addr), " i" (-EAGAIN), \ +" i" (-EFAULT), \ " i" (__SWP_LL_SC_LOOPS) \ : "memory")
Greg Kroah-Hartman
maintainerPATCH 131/164 arm64: uaccess: ensure extension of access_ok() addr
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <[email protected]>
commit a06040d7a791a9177581dcf7293941bd92400856 upstream.
Our access_ok() simply hands its arguments over to __range_ok(), which implicitly assummes that the addr parameter is 64 bits wide. This isn't necessarily true for compat code, which might pass down a 32-bit address parameter.
In these cases, we don't have a guarantee that the address has been zero extended to 64 bits, and the upper bits of the register may contain unknown values, potentially resulting in a suprious failure.
Avoid this by explicitly casting the addr parameter to an unsigned long (as is done on other architectures), ensuring that the parameter is widened appropriately.
--- arch/arm64/include/asm/uaccess.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/arm64/include/asm/uaccess.h +2 -1
@@ -93,11 +93,12 @@ static inline void set_fs(mm_segment_t f*/ #define __range_ok (addr, size) \ ({ \ + unsigned long __addr = (unsigned long __force)(addr); \ unsigned long flag, roksum; \ __chk_user_ptr(addr); \ asm("adds %1, %1, %3; ccmp %1, %4, #2, cc; cset %0, ls" \ : "=&r" (flag), "=&r" (roksum) \ - : "1" (addr), "Ir" (size), \ + : "1" (__addr), "Ir" (size), \ "r" (current_thread_info()->addr_limit) \ : "cc"); \ flag; \
Greg Kroah-Hartman
maintainerPATCH 132/164 arm64: documentation: document tagged pointer stack constraints
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kristina Martsenko <[email protected]>
commit f0e421b1bf7af97f026e1bb8bfe4c5a7a8c08f42 upstream.
Some kernel features don't currently work if a task puts a non-zero address tag in its stack pointer, frame pointer, or frame record entries (FP, LR).
For example, with a tagged stack pointer, the kernel can't deliver signals to the process, and the task is killed instead. As another example, with a tagged frame pointer or frame records, perf fails to generate call graphs or resolve symbols.
For now, just document these limitations, instead of finding and fixing everything that doesn't work, as it's not known if anyone needs to use tags in these places anyway.
In addition, as requested by Dave Martin, generalize the limitations into a general kernel address tag policy, and refactor tagged-pointers.txt to include it.
--- Documentation/arm64/tagged-pointers.txt | 66 +++++++++++++++++++++++--------- 1 file changed, 49 insertions(+), 17 deletions(-)
Documentation/arm64/tagged-pointers.txt +49 -17
@@ -11,24 +11,56 @@ in AArch64 Linux. The kernel configures the translation tables so that translations made via TTBR0 (i.e. userspace mappings) have the top byte (bits 63:56) of the virtual address ignored by the translation hardware. This frees up -this byte for application use, with the following caveats: +this byte for application use. - (1) The kernel requires that all user addresses passed to EL1 - are tagged with tag 0x00. This means that any syscall - parameters containing user virtual addresses *must* have - their top byte cleared before trapping to the kernel. - - (2) Non-zero tags are not preserved when delivering signals. - This means that signal handlers in applications making use - of tags cannot rely on the tag information for user virtual - addresses being maintained for fields inside siginfo_t. - One exception to this rule is for signals raised in response - to watchpoint debug exceptions, where the tag information - will be preserved. - - (3) Special care should be taken when using tagged pointers, - since it is likely that C compilers will not hazard two - virtual addresses differing only in the upper byte. + +Passing tagged addresses to the kernel +-------------------------------------- + +All interpretation of userspace memory addresses by the kernel assumes +an address tag of 0x00. + +This includes, but is not limited to, addresses found in: + + - pointer arguments to system calls, including pointers in structures + passed to system calls, + + - the stack pointer (sp), e.g. when interpreting it to deliver a + signal, + + - the frame pointer (x29) and frame records, e.g. when interpreting + them to generate a backtrace or call graph. + +Using non-zero address tags in any of these locations may result in an +error code being returned, a (fatal) signal being raised, or other modes +of failure. + +For these reasons, passing non-zero address tags to the kernel via +system calls is forbidden, and using a non-zero address tag for sp is +strongly discouraged. + +Programs maintaining a frame pointer and frame records that use non-zero +address tags may suffer impaired or inaccurate debug and profiling +visibility. + + +Preserving tags +--------------- + +Non-zero tags are not preserved when delivering signals. This means that +signal handlers in applications making use of tags cannot rely on the +tag information for user virtual addresses being maintained for fields +inside siginfo_t. One exception to this rule is for signals raised in +response to watchpoint debug exceptions, where the tag information will +be preserved. The architecture prevents the use of a tagged PC, so the upper byte will be set to a sign-extension of bit 55 on exception return. + + +Other considerations +-------------------- + +Special care should be taken when using tagged pointers, since it is +likely that C compilers will not hazard two virtual addresses differing +only in the upper byte.
Greg Kroah-Hartman
maintainerPATCH 133/164 staging: rtl8192e: rtl92e_fill_tx_desc fix write to mapped out memory.
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Malcolm Priestley <[email protected]>
commit baabd567f87be05330faa5140f72a91960e7405a upstream.
The driver attempts to alter memory that is mapped to PCI device.
This is because tx_fwinfo_8190pci points to skb->data
Move the pci_map_single to when completed buffer is ready to be mapped with psdec is empty to drop on mapping error.
--- drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c +9 -4
@@ -1184,8 +1184,7 @@ void rtl92e_fill_tx_desc(struct net_dev struct cb_desc *cb_desc, struct sk_buff *skb) { struct r8192_priv *priv = rtllib_priv(dev); -dma_addr_t mapping =pci_map_single (priv->pdev, skb->data, skb->len, -PCI_DMA_TODEVICE ); +dma_addr_t mapping;struct tx_fwinfo_8190pci *pTxFwInfo; pTxFwInfo = (struct tx_fwinfo_8190pci *)skb->data;
@@ -1196,8 +1195,6 @@ void rtl92e_fill_tx_desc(struct net_dev pTxFwInfo->Short =_rtl92e_query_is_short (pTxFwInfo->TxHT, pTxFwInfo->TxRate, cb_desc); -if (pci_dma_mapping_error (priv->pdev, mapping)) -netdev_err (dev,"%s(): DMA Mapping error\n" , __func__);if (cb_desc->bAMPDUEnable) { pTxFwInfo->AllowAggregation =1 ; pTxFwInfo->RxMF = cb_desc->ampdu_factor;
@@ -1232,6 +1229,14 @@ void rtl92e_fill_tx_desc(struct net_dev }memset ((u8 *)pdesc,0 ,12 ); + + mapping =pci_map_single (priv->pdev, skb->data, skb->len, +PCI_DMA_TODEVICE ); +if (pci_dma_mapping_error (priv->pdev, mapping)) { +netdev_err (dev,"%s(): DMA Mapping error\n" , __func__); +return ; + } + pdesc->LINIP =0 ; pdesc->CmdInit =1 ; pdesc->Offset =sizeof (struct tx_fwinfo_8190pci ) +8 ;
Greg Kroah-Hartman
maintainerPATCH 134/164 staging: rtl8192e: fix 2 byte alignment of register BSSIDR.
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Malcolm Priestley <[email protected]>
commit 867510bde14e7b7fc6dd0f50b48f6753cfbd227a upstream.
BSSIDR has two byte alignment on PCI ioremap correct the write by swapping to 16 bits first.
This fixes a problem that the device associates fail because the filter is not set correctly.
--- drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c +5 -4
@@ -97,8 +97,9 @@ void rtl92e_set_reg(struct net_device *dswitch (variable) {case HW_VAR_BSSID : -rtl92e_writel (dev,BSSIDR , ((u32 *)(val))[0 ]); -rtl92e_writew (dev,BSSIDR +2 , ((u16 *)(val+2 ))[0 ]); +/* BSSIDR 2 byte alignment */ +rtl92e_writew (dev,BSSIDR , *(u16 *)val); +rtl92e_writel (dev,BSSIDR +2 , *(u32 *)(val +2 ));break ;case HW_VAR_MEDIA_STATUS :
@@ -963,8 +964,8 @@ static void _rtl92e_net_update(struct nertl92e_config_rate (dev, &rate_config); priv->dot11CurrentPreambleMode =PREAMBLE_AUTO ; priv->basic_rate = rate_config &=0x15f ; -rtl92e_writel (dev,BSSIDR , ((u32 *)net->bssid)[0 ]); -rtl92e_writew (dev,BSSIDR +4 , ((u16 *)net->bssid)[2 ]); +rtl92e_writew (dev,BSSIDR , *(u16 *)net->bssid); +rtl92e_writel (dev,BSSIDR +2 , *(u32 *)(net->bssid +2 ));if (priv->rtllib->iw_mode ==IW_MODE_ADHOC ) {rtl92e_writew (dev,ATIMWND ,2 );
Greg Kroah-Hartman
maintainerPATCH 135/164 staging: rtl8192e: rtl92e_get_eeprom_size Fix read size of EPROM_CMD.
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Malcolm Priestley <[email protected]>
commit 90be652c9f157d44b9c2803f902a8839796c090d upstream.
EPROM_CMD is 2 byte aligned on PCI map so calling with rtl92e_readl will return invalid data so use rtl92e_readw.
The device is unable to select the right eeprom type.
--- drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c +1 -1
@@ -627,7 +627,7 @@ void rtl92e_get_eeprom_size(struct net_dstruct r8192_priv *priv =rtllib_priv (dev);RT_TRACE (COMP_INIT ,"===========>%s()\n" , __func__); - curCR =rtl92e_readl (dev,EPROM_CMD ); + curCR =rtl92e_readw (dev,EPROM_CMD );RT_TRACE (COMP_INIT ,"read from Reg Cmd9346CR(%x):%x\n" ,EPROM_CMD , curCR); priv->epromtype = (curCR & EPROM_CMD_9356SEL) ? EEPROM_93C56 :
Greg Kroah-Hartman
maintainerPATCH 136/164 staging: rtl8192e: GetTs Fix invalid TID 7 warning.
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Malcolm Priestley <[email protected]>
commit 95d93e271d920dfda369d4740b1cc1061d41fe7f upstream.
TID 7 is a valid value for QoS IEEE 802.11e.
The switch statement that follows states 7 is valid.
Remove function IsACValid and use the default case to filter invalid TIDs.
--- drivers/staging/rtl8192e/rtl819x_TSProc.c | 15 ++++----------- 1 file changed, 4 insertions(+), 11 deletions(-)
drivers/staging/rtl8192e/rtl819x_TSProc.c +4 -11
@@ -306,11 +306,6 @@ static void MakeTSEntry(struct ts_common pTsCommonInfo->TClasNum = TCLAS_Num; } -static bool IsACValid (unsigned int tid) -{ -return tid <7 ; -} -bool GetTs (struct rtllib_device *ieee,struct ts_common_info **ppTS,u8 *Addr,u8 TID ,enum tr_select TxRxSelect,bool bAddNewTs) {
@@ -328,12 +323,6 @@ bool GetTs(struct rtllib_device *ieee, sif (ieee->current_network.qos_data.supported ==0 ) {UP =0 ; }else { -if (!IsACValid (TID )) { -netdev_warn (ieee->dev,"%s(): TID(%d) is not valid\n" , - __func__,TID ); -return false; - } -switch (TID ) {case 0 :case 3 :
@@ -351,6 +340,10 @@ bool GetTs(struct rtllib_device *ieee, scase 7 :UP =7 ;break ; +default : +netdev_warn (ieee->dev,"%s(): TID(%d) is not valid\n" , + __func__,TID ); +return false; } }
Greg Kroah-Hartman
maintainerPATCH 137/164 iommu/vt-d: Flush the IOTLB to get rid of the initial kdump mappings
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: KarimAllah Ahmed <[email protected]>
commit f73a7eee900e95404b61408a23a1df5c5811704c upstream.
Ever since commit 091d42e43d ("iommu/vt-d: Copy translation tables from old kernel") the kdump kernel copies the IOMMU context tables from the previous kernel. Each device mappings will be destroyed once the driver for the respective device takes over.
This unfortunately breaks the workflow of mapping and unmapping a new context to the IOMMU. The mapping function assumes that either:
1) Unmapping did the proper IOMMU flushing and it only ever flush if the IOMMU unit supports caching invalid entries.
2) The system just booted and the initialization code took care of flushing all IOMMU caches.
This assumption is not true for the kdump kernel since the context tables have been copied from the previous kernel and translations could have been cached ever since. So make sure to flush the IOTLB as well when we destroy these old copied mappings.
--- drivers/iommu/intel-iommu.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/iommu/intel-iommu.c +4 -1
@@ -2049,11 +2049,14 @@ static int domain_context_mapping_one(stif (context_copied (context)) {u16 did_old =context_domain_id (context); -if (did_old >=0 && did_old <cap_ndoms (iommu->cap)) +if (did_old >=0 && did_old <cap_ndoms (iommu->cap)) { iommu->flush.flush_context (iommu, did_old, (((u16 )bus) <<8 ) | devfn,DMA_CCMD_MASK_NOBIT ,DMA_CCMD_DEVICE_INVL ); + iommu->flush.flush_iotlb (iommu, did_old,0 ,0 , +DMA_TLB_DSI_FLUSH ); + } } pgd = domain->pgd;
Greg Kroah-Hartman
maintainerPATCH 138/164 metag/uaccess: Fix access_ok()
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Hogan <[email protected]>
commit 8a8b56638bcac4e64cccc88bf95a0f9f4b19a2fb upstream.
The __user_bad() macro used by access_ok() has a few corner cases noticed by Al Viro where it doesn't behave correctly:
- The kernel range check has off by 1 errors which permit access to the first and last byte of the kernel mapped range.
- The kernel range check ends at LINCORE_BASE rather than META_MEMORY_LIMIT, which is ineffective when the kernel is in global space (an extremely uncommon configuration).
There are a couple of other shortcomings here too:
- Access to the whole of the other address space is permitted (i.e. the global half of the address space when the kernel is in local space). This isn't ideal as it could theoretically still contain privileged mappings set up by the bootloader.
- The size argument is unused, permitting user copies which start on valid pages at the end of the user address range and cross the boundary into the kernel address space (e.g. addr = 0x3ffffff0, size
Quoted 1 line
0x10).
It isn't very convenient to add size checks when disallowing certain regions, and it seems far safer to be sure and explicit about what userland is able to access, so invert the logic to allow certain regions instead, and fix the off by 1 errors and missing size checks. This also allows the get_fs() == KERNEL_DS check to be more easily optimised into the user address range case.
We now have 3 such allowed regions:
- The user address range (incorporating the get_fs() == KERNEL_DS check).
- NULL (some kernel code expects this to work, and we'll always catch the fault anyway).
- The core code memory region.
--- arch/metag/include/asm/uaccess.h | 40 +++++++++++++++++++++++---------------- 1 file changed, 24 insertions(+), 16 deletions(-)
arch/metag/include/asm/uaccess.h +24 -16
@@ -28,24 +28,32 @@#define segment_eq (a, b) ((a).seg == (b).seg) -#define __kernel_ok (segment_eq(get_fs(), KERNEL_DS)) -/* -* Explicitly allow NULL pointers here. Parts of the kernel such -* as readv/writev use access_ok to validate pointers, but want -* to allow NULL pointers for various reasons. NULL pointers are -* safe to allow through because the first page is not mappable on -* Meta. -* -* We also wish to avoid letting user code access the system area -* and the kernel half of the address space. -*/ -#define __user_bad (addr, size) (((addr) > 0 && (addr) < META_MEMORY_BASE) || \ - ((addr) > PAGE_OFFSET && \ - (addr) < LINCORE_BASE)) -static inline int __access_ok (unsigned long addr,unsigned long size) { -return __kernel_ok || !__user_bad (addr, size); +/* +* Allow access to the user mapped memory area, but not the system area +* before it. The check extends to the top of the address space when +* kernel access is allowed (there's no real reason to user copy to the +* system area in any case). +*/ +if (likely (addr >=META_MEMORY_BASE && addr <get_fs ().seg && + size <=get_fs ().seg - addr)) +return true; +/* +* Explicitly allow NULL pointers here. Parts of the kernel such +* as readv/writev use access_ok to validate pointers, but want +* to allow NULL pointers for various reasons. NULL pointers are +* safe to allow through because the first page is not mappable on +* Meta. +*/ +if (!addr) +return true; +/* Allow access to core code memory area... */ +if (addr >=LINCORE_CODE_BASE && addr <=LINCORE_CODE_LIMIT && + size <=LINCORE_CODE_LIMIT +1 - addr) +return true; +/* ... but no other areas. */ +return false; }#define access_ok (type, addr, size) __access_ok((unsigned long)(addr), \
Greg Kroah-Hartman
maintainerPATCH 139/164 metag/uaccess: Check access_ok in strncpy_from_user
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Hogan <[email protected]>
commit 3a158a62da0673db918b53ac1440845a5b64fd90 upstream.
The metag implementation of strncpy_from_user() doesn't validate the src pointer, which could allow reading of arbitrary kernel memory. Add a short access_ok() check to prevent that.
Its still possible for it to read across the user/kernel boundary, but it will invariably reach a NUL character after only 9 bytes, leaking only a static kernel address being loaded into D0Re0 at the beginning of __start, which is acceptable for the immediate fix.
--- arch/metag/include/asm/uaccess.h | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
arch/metag/include/asm/uaccess.h +7 -2
@@ -194,8 +194,13 @@ do {extern long __must_check __strncpy_from_user (char *dst,const char __user *src,long count); -#define strncpy_from_user (dst, src, count) __strncpy_from_user(dst, src, count) - +static inline long +strncpy_from_user (char *dst,const char __user *src,long count) +{ +if (!access_ok (VERIFY_READ , src,1 )) +return -EFAULT ; +return __strncpy_from_user (dst, src, count); +}/* * Return the size of a string (including the ending 0) *
Greg Kroah-Hartman
maintainerPATCH 140/164 stackprotector: Increase the per-task stack canarys random range from 32 bits to 64 bits on 64-bit platforms
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Micay <[email protected]>
commit 5ea30e4e58040cfd6434c2f33dc3ea76e2c15b05 upstream.
The stack canary is an 'unsigned long' and should be fully initialized to random data rather than only 32 bits of random data.
--- kernel/fork.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/fork.c +1 -1
@@ -521,7 +521,7 @@ static struct task_struct *dup_task_struset_task_stack_end_magic (tsk);#ifdef CONFIG_CC_STACKPROTECTOR - tsk->stack_canary =get_random_int (); + tsk->stack_canary =get_random_long ();#endif /*
Greg Kroah-Hartman
maintainerPATCH 141/164 uwb: fix device quirk on big-endian hosts
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 41318a2b82f5d5fe1fb408f6d6e0b22aa557111d upstream.
Add missing endianness conversion when using the USB device-descriptor idProduct field to apply a hardware quirk.
--- drivers/uwb/i1480/dfu/usb.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/uwb/i1480/dfu/usb.c +3 -2
@@ -341,6 +341,7 @@ error_submit_ep1:static int i1480_usb_probe (struct usb_interface *iface,const struct usb_device_id *id) { +struct usb_device *udev =interface_to_usbdev (iface);struct i1480_usb *i1480_usb;struct i1480 *i1480;struct device *dev = &iface->dev;
@@ -352,8 +353,8 @@ int i1480_usb_probe(struct usb_interface iface->cur_altsetting->desc.bInterfaceNumber); goto error; } -if (iface->num_altsetting >1 - &&interface_to_usbdev (iface)->descriptor.idProduct ==0xbabe ) { +if (iface->num_altsetting >1 && +le16_to_cpu (udev->descriptor.idProduct) ==0xbabe ) {/* Need altsetting #1 [HW QUIRK] or EP1 won't work */ result =usb_set_interface (interface_to_usbdev (iface),0 ,1 );if (result <0 )
Greg Kroah-Hartman
maintainerPATCH 142/164 genirq: Fix chained interrupt data ordering
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <[email protected]>
commit 2c4569ca26986d18243f282dd727da27e9adae4c upstream.
irq_set_chained_handler_and_data() sets up the chained interrupt and then stores the handler data.
That's racy against an immediate interrupt which gets handled before the store of the handler data happened. The handler will dereference a NULL pointer and crash.
Cure it by storing handler data before installing the chained handler.
--- kernel/irq/chip.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/irq/chip.c +1 -1
@@ -877,8 +877,8 @@ irq_set_chained_handler_and_data(unsigneif (!desc)return ; -__irq_do_set_handler (desc, handle,1 ,NULL ); desc->irq_common_data.handler_data = data; +__irq_do_set_handler (desc, handle,1 ,NULL );irq_put_desc_busunlock (desc, flags); }
Greg Kroah-Hartman
maintainerPATCH 143/164 nvme: unmap CMB and remove sysfs file in reset path
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jon Derrick <[email protected]>
commit f63572dff1421b6ca6abce71d46e03411e605c94 upstream.
CMB doesn't get unmapped until removal while getting remapped on every reset. Add the unmapping and sysfs file removal to the reset path in nvme_pci_disable to match the mapping path in nvme_pci_enable.
--- drivers/nvme/host/pci.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/nvme/host/pci.c +6 -1
@@ -1384,6 +1384,11 @@ static inline void nvme_release_cmb(struif (dev->cmb) {iounmap (dev->cmb); dev->cmb =NULL ; +if (dev->cmbsz) { +sysfs_remove_file_from_group (&dev->ctrl.device->kobj, + &dev_attr_cmb.attr,NULL ); + dev->cmbsz =0 ; + } } }
@@ -1655,6 +1660,7 @@ static void nvme_pci_disable(struct nvme {struct pci_dev *pdev =to_pci_dev (dev->dev); +nvme_release_cmb (dev);pci_free_irq_vectors (pdev);if (pci_is_enabled (pdev)) {
@@ -1993,7 +1999,6 @@ static void nvme_remove(struct pci_dev *nvme_dev_disable (dev, true);nvme_dev_remove_admin (dev);nvme_free_queues (dev,0 ); -nvme_release_cmb (dev);nvme_release_prp_pools (dev);nvme_dev_unmap (dev);nvme_put_ctrl (&dev->ctrl);
Greg Kroah-Hartman
maintainerPATCH 144/164 MIPS: Loongson-3: Select MIPS_L1_CACHE_SHIFT_6
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <[email protected]>
commit 17c99d9421695a0e0de18bf1e7091d859e20ec1d upstream.
Some newer Loongson-3 have 64 bytes cache lines, so select MIPS_L1_CACHE_SHIFT_6.
Patchwork: https://patchwork.linux-mips.org/patch/15755/
--- arch/mips/Kconfig | 1 + 1 file changed, 1 insertion(+)
arch/mips/Kconfig +1 -0
@@ -1368,6 +1368,7 @@ config CPU_LOONGSON3 select WEAK_ORDERING select WEAK_REORDERING_BEYOND_LLSC select MIPS_PGD_C0_CONTEXT + select MIPS_L1_CACHE_SHIFT_6 select GPIOLIB help The Loongson 3 processor implements the MIPS64R2 instruction
Greg Kroah-Hartman
maintainerPATCH 145/164 osf_wait4(): fix infoleak
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
commit a8c39544a6eb2093c04afd5005b6192bd0e880c6 upstream.
failing sys_wait4() won't fill struct rusage...
--- arch/alpha/kernel/osf_sys.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
arch/alpha/kernel/osf_sys.c +4 -2
@@ -1188,8 +1188,10 @@ SYSCALL_DEFINE4(osf_wait4, pid_t, pid, iif (!access_ok (VERIFY_WRITE , ur,sizeof (*ur)))return -EFAULT ; - err =0 ; - err |=put_user (status, ustatus); + err =put_user (status, ustatus); +if (ret <0 ) +return err ? err : ret; + err |=__put_user (r.ru_utime.tv_sec, &ur->ru_utime.tv_sec); err |=__put_user (r.ru_utime.tv_usec, &ur->ru_utime.tv_usec); err |=__put_user (r.ru_stime.tv_sec, &ur->ru_stime.tv_sec);
Greg Kroah-Hartman
maintainerPATCH 146/164 um: Fix to call read_initrd after init_bootmem
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masami Hiramatsu <[email protected]>
commit 5b4236e17cc1bd9fa14b2b0c7a4ae632d41f2e20 upstream.
Since read_initrd() invokes alloc_bootmem() for allocating memory to load initrd image, it must be called after init_bootmem.
This makes read_initrd() called directly from setup_arch() after init_bootmem() and mem_total_pages().
--- arch/um/kernel/initrd.c | 4 +--- arch/um/kernel/um_arch.c | 6 ++++++ 2 files changed, 7 insertions(+), 3 deletions(-)
arch/um/kernel/initrd.c +1 -3
@@ -14,7 +14,7 @@static char *initrd__initdata =NULL ;static int load_initrd (char *filename,void *buf,int size); -static int __init read_initrd (void ) +int __init read_initrd (void ) {void *area;long long size;
@@ -46,8 +46,6 @@ static int __init read_initrd(void)return 0 ; } -__uml_postsetup (read_initrd); -static int __init uml_initrd_setup (char *line,int *add) { initrd = line;
arch/um/kernel/um_arch.c +6 -0
@@ -336,11 +336,17 @@ int __init linux_main(int argc, char **areturn start_uml (); } +int __init __weak read_initrd (void ) +{ +return 0 ; +} +void __init setup_arch (char **cmdline_p) {stack_protections ((unsigned long ) &init_thread_info);setup_physmem (uml_physmem, uml_reserved, physmem_size, highmem);mem_total_pages (physmem_size, iomem_size, highmem); +read_initrd ();paging_init ();strlcpy (boot_command_line, command_line,COMMAND_LINE_SIZE );
Greg Kroah-Hartman
maintainerPATCH 147/164 tracing/kprobes: Enforce kprobes teardown after testing
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <[email protected]>
commit 30e7d894c1478c88d50ce94ddcdbd7f9763d9cdd upstream.
Enabling the tracer selftest triggers occasionally the warning in text_poke(), which warns when the to be modified page is not marked reserved.
The reason is that the tracer selftest installs kprobes on functions marked __init for testing. These probes are removed after the tests, but that removal schedules the delayed kprobes_optimizer work, which will do the actual text poke. If the work is executed after the init text is freed, then the warning triggers. The bug can be reproduced reliably when the work delay is increased.
Flush the optimizer work and wait for the optimizing/unoptimizing lists to become empty before returning from the kprobes tracer selftest. That ensures that all operations which were queued due to the probes removal have completed.
--- include/linux/kprobes.h | 4 +++- kernel/kprobes.c | 2 +- kernel/trace/trace_kprobe.c | 5 +++++ 3 files changed, 9 insertions(+), 2 deletions(-)
include/linux/kprobes.h +3 -1
@@ -330,7 +330,9 @@ extern int proc_kprobes_optimization_han int write, void __user *buffer, size_t *length, loff_t *ppos);#endif - +extern void wait_for_kprobe_optimizer (void ); +#else +static inline void wait_for_kprobe_optimizer (void ) { }#endif /* CONFIG_OPTPROBES */ #ifdef CONFIG_KPROBES_ON_FTRACE extern void kprobe_ftrace_handler(unsigned long ip, unsigned long parent_ip,
kernel/kprobes.c +1 -1
@@ -563,7 +563,7 @@ static void kprobe_optimizer(struct work }/* Wait for completing optimization and unoptimization */ -static void wait_for_kprobe_optimizer (void ) +void wait_for_kprobe_optimizer (void ) {mutex_lock (&kprobe_mutex);
kernel/trace/trace_kprobe.c +5 -0
@@ -1484,6 +1484,11 @@ static __init int kprobe_trace_self_test end:release_all_trace_kprobes (); +/* +* Wait for the optimizer work to finish. Otherwise it might fiddle +* with probes in already freed __init text. +*/ +wait_for_kprobe_optimizer ();if (warn)pr_cont ("NG: Some tests are failed. Please check them.\n" );else
Greg Kroah-Hartman
maintainerPATCH 148/164 PCI: hv: Allocate interrupt descriptors with GFP_ATOMIC
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: K. Y. Srinivasan <[email protected]>
commit 59c58ceeea9cdc6144d7b0303753e6bd26d87455 upstream.
The memory allocation here needs to be non-blocking. Fix the issue.
--- drivers/pci/host/pci-hyperv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pci/host/pci-hyperv.c +1 -1
@@ -868,7 +868,7 @@ static void hv_compose_msi_msg(struct irhv_int_desc_free (hpdev, int_desc); } - int_desc =kzalloc (sizeof (*int_desc),GFP_KERNEL ); + int_desc =kzalloc (sizeof (*int_desc),GFP_ATOMIC );if (!int_desc) goto drop_reference;
Greg Kroah-Hartman
maintainerPATCH 149/164 PCI: hv: Specify CPU_AFFINITY_ALL for MSI affinity when >= 32 CPUs
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: K. Y. Srinivasan <[email protected]>
commit 433fcf6b7b31f1f233dd50aeb9d066a0f6ed4b9d upstream.
When we have 32 or more CPUs in the affinity mask, we should use a special constant to specify that to the host. Fix this issue.
--- drivers/pci/host/pci-hyperv.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
drivers/pci/host/pci-hyperv.c +8 -3
@@ -72,6 +72,7 @@ enum { PCI_PROTOCOL_VERSION_CURRENT = PCI_PROTOCOL_VERSION_1_1 }; +#define CPU_AFFINITY_ALL -1ULL#define PCI_CONFIG_MMIO_LENGTH 0x2000#define CFG_PAGE_OFFSET 0x1000#define CFG_PAGE_SIZE (PCI_CONFIG_MMIO_LENGTH - CFG_PAGE_OFFSET)
@@ -889,9 +890,13 @@ static void hv_compose_msi_msg(struct ir* processors because Hyper-V only supports 64 in a guest. */ affinity =irq_data_get_affinity_mask (data); -for_each_cpu_and (cpu, affinity, cpu_online_mask) { - int_pkt->int_desc.cpu_mask |= - (1ULL <<vmbus_cpu_number_to_vp_number (cpu)); +if (cpumask_weight (affinity) >=32 ) { + int_pkt->int_desc.cpu_mask =CPU_AFFINITY_ALL ; + }else { +for_each_cpu_and (cpu, affinity, cpu_online_mask) { + int_pkt->int_desc.cpu_mask |= + (1ULL <<vmbus_cpu_number_to_vp_number (cpu)); + } } ret = vmbus_sendpacket(hpdev->hbus->hdev->channel, int_pkt,
Greg Kroah-Hartman
maintainerPATCH 150/164 PCI: Fix pci_mmap_fits() for HAVE_PCI_RESOURCE_TO_USER platforms
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Woodhouse <[email protected]>
commit 6bccc7f426abd640f08d8c75fb22f99483f201b4 upstream.
In the PCI_MMAP_PROCFS case when the address being passed by the user is a 'user visible' resource address based on the bus window, and not the actual contents of the resource, that's what we need to be checking it against.
--- drivers/pci/pci-sysfs.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/pci/pci-sysfs.c +7 -3
@@ -974,15 +974,19 @@ void pci_remove_legacy_files(struct pci_int pci_mmap_fits (struct pci_dev *pdev,int resno,struct vm_area_struct *vma,enum pci_mmap_api mmap_api) { -unsigned long nr, start, size, pci_start; +unsigned long nr, start, size; +resource_size_t pci_start =0 , pci_end;if (pci_resource_len (pdev, resno) ==0 )return 0 ; nr =vma_pages (vma); start = vma->vm_pgoff; size = ((pci_resource_len (pdev, resno) -1 ) >>PAGE_SHIFT ) +1 ; - pci_start = (mmap_api ==PCI_MMAP_PROCFS ) ? -pci_resource_start (pdev, resno) >>PAGE_SHIFT :0 ; +if (mmap_api ==PCI_MMAP_PROCFS ) { +pci_resource_to_user (pdev, resno, &pdev->resource[resno], + &pci_start, &pci_end); + pci_start >>=PAGE_SHIFT ; + }if (start >= pci_start && start < pci_start + size && start + nr <= pci_start + size)return 1 ;
Greg Kroah-Hartman
maintainerPATCH 151/164 PCI: Fix another sanity check bug in /proc/pci mmap
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Woodhouse <[email protected]>
commit 17caf56731311c9596e7d38a70c88fcb6afa6a1b upstream.
Don't match MMIO maps with I/O BARs and vice versa.
--- drivers/pci/proc.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/pci/proc.c +8 -2
@@ -231,14 +231,20 @@ static int proc_bus_pci_mmap(struct file {struct pci_dev *dev =PDE_DATA (file_inode (file));struct pci_filp_private *fpriv = file->private_data; -int i, ret, write_combine; +int i, ret, write_combine, res_bit;if (!capable (CAP_SYS_RAWIO ))return -EPERM ; +if (fpriv->mmap_state == pci_mmap_io) + res_bit =IORESOURCE_IO ; +else + res_bit =IORESOURCE_MEM ; +/* Make sure the caller is mapping a real resource for this device */ for (i =0 ; i <PCI_ROM_RESOURCE ; i++) { -if (pci_mmap_fits (dev, i, vma,PCI_MMAP_PROCFS )) +if (dev->resource[i].flags & res_bit && +pci_mmap_fits (dev, i, vma,PCI_MMAP_PROCFS ))break ; }
Greg Kroah-Hartman
maintainerPATCH 152/164 PCI: Only allow WC mmap on prefetchable resources
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Woodhouse <[email protected]>
commit cef4d02305a06be581bb7f4353446717a1b319ec upstream.
The /proc/bus/pci mmap interface allows the user to specify whether they want WC or not. Don't let them do so on non-prefetchable BARs.
--- drivers/pci/proc.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
drivers/pci/proc.c +8 -5
@@ -231,7 +231,7 @@ static int proc_bus_pci_mmap(struct file {struct pci_dev *dev =PDE_DATA (file_inode (file));struct pci_filp_private *fpriv = file->private_data; -int i, ret, write_combine, res_bit; +int i, ret, write_combine =0 , res_bit;if (!capable (CAP_SYS_RAWIO ))return -EPERM ;
@@ -251,10 +251,13 @@ static int proc_bus_pci_mmap(struct fileif (i >=PCI_ROM_RESOURCE )return -ENODEV ; -if (fpriv->mmap_state == pci_mmap_mem) - write_combine = fpriv->write_combine; -else - write_combine =0 ; +if (fpriv->mmap_state == pci_mmap_mem && + fpriv->write_combine) { +if (dev->resource[i].flags &IORESOURCE_PREFETCH ) + write_combine =1 ; +else +return -EINVAL ; + } ret =pci_mmap_page_range (dev, vma, fpriv->mmap_state, write_combine);if (ret <0 )
Greg Kroah-Hartman
maintainerPATCH 154/164 mtd: nand: orion: fix clk handling
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Simon Baatz <[email protected]>
commit 675b11d94ce9baa5eb365a51b35d2793f77c8ab8 upstream.
The clk handling in orion_nand.c had two problems:
- In the probe function, clk_put() was called for an enabled clock, which violates the API (see documentation for clk_put() in include/linux/clk.h)
- In the error path of the probe function, clk_put() could be called twice for the same clock.
In order to clean this up, use the managed function devm_clk_get() and store the pointer to the clk in the driver data.
--- drivers/mtd/nand/orion_nand.c | 42 +++++++++++++++++++++--------------------- 1 file changed, 21 insertions(+), 21 deletions(-)
drivers/mtd/nand/orion_nand.c +21 -21
@@ -23,6 +23,11 @@#include <asm/sizes.h> #include <linux/platform_data/mtd-orion_nand.h> +struct orion_nand_info { +struct nand_chip chip; +struct clk *clk; +}; +static void orion_nand_cmd_ctrl (struct mtd_info *mtd,int cmd,unsigned int ctrl) {struct nand_chip *nc =mtd_to_nand (mtd);
@@ -75,20 +80,21 @@ static void orion_nand_read_buf(struct mstatic int __init orion_nand_probe (struct platform_device *pdev) { +struct orion_nand_info *info;struct mtd_info *mtd;struct nand_chip *nc;struct orion_nand_data *board;struct resource *res; -struct clk *clk;void __iomem *io_base;int ret =0 ;u32 val =0 ; - nc =devm_kzalloc (&pdev->dev, -sizeof (struct nand_chip ), + info =devm_kzalloc (&pdev->dev, +sizeof (struct orion_nand_info ),GFP_KERNEL ); -if (!nc) +if (!info)return -ENOMEM ; + nc = &info->chip; mtd =nand_to_mtd (nc); res =platform_get_resource (pdev,IORESOURCE_MEM ,0 );
@@ -145,15 +151,13 @@ static int __init orion_nand_probe(strucif (board->dev_ready) nc->dev_ready = board->dev_ready; -platform_set_drvdata (pdev, mtd); +platform_set_drvdata (pdev, info);/* Not all platforms can gate the clock, so it is not an error if the clock does not exists. */ - clk =clk_get (&pdev->dev,NULL ); -if (!IS_ERR (clk)) { -clk_prepare_enable (clk); -clk_put (clk); - } + info->clk =devm_clk_get (&pdev->dev,NULL ); +if (!IS_ERR (info->clk)) +clk_prepare_enable (info->clk);if (nand_scan (mtd,1 )) { ret = -ENXIO ;
@@ -170,26 +174,22 @@ static int __init orion_nand_probe(strucreturn 0 ; no_dev: -if (!IS_ERR (clk)) { -clk_disable_unprepare (clk); -clk_put (clk); - } +if (!IS_ERR (info->clk)) +clk_disable_unprepare (info->clk);return ret; }static int orion_nand_remove (struct platform_device *pdev) { -struct mtd_info *mtd =platform_get_drvdata (pdev); -struct clk *clk; +struct orion_nand_info *info =platform_get_drvdata (pdev); +struct nand_chip *chip = &info->chip; +struct mtd_info *mtd =nand_to_mtd (chip);nand_release (mtd); - clk =clk_get (&pdev->dev,NULL ); -if (!IS_ERR (clk)) { -clk_disable_unprepare (clk); -clk_put (clk); - } +if (!IS_ERR (info->clk)) +clk_disable_unprepare (info->clk);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 155/164 mtd: nand: omap2: Fix partition creation via cmdline mtdparts
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roger Quadros <[email protected]>
commit 2d283ede59869159f4bb84ae689258c5caffce54 upstream.
commit c9711ec5250b ("mtd: nand: omap: Clean up device tree support") caused the parent device name to be changed from "omap2-nand.0" to "<base address>.nand" (e.g. 30000000.nand on omap3 platforms). This caused mtd->name to be changed as well. This breaks partition creation via mtdparts passed by u-boot as it uses "omap2-nand.0" for the mtd-id.
Fix this by explicitly setting the mtd->name to "omap2-nand.<CS number>" if it isn't already set by nand_set_flash_node(). CS number is the NAND controller instance ID.
--- drivers/mtd/nand/omap2.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/mtd/nand/omap2.c +9 -0
@@ -1856,6 +1856,15 @@ static int omap_nand_probe(struct platfo nand_chip->ecc.priv =NULL ;nand_set_flash_node (nand_chip, dev->of_node); +if (!mtd->name) { + mtd->name =devm_kasprintf (&pdev->dev,GFP_KERNEL , +"omap2-nand.%d" , info->gpmc_cs); +if (!mtd->name) { +dev_err (&pdev->dev,"Failed to set MTD name\n" ); +return -ENOMEM ; + } + } + res =platform_get_resource (pdev,IORESOURCE_MEM ,0 ); nand_chip->IO_ADDR_R =devm_ioremap_resource (&pdev->dev, res);if (IS_ERR (nand_chip->IO_ADDR_R))
Greg Kroah-Hartman
maintainerPATCH 156/164 mtd: nand: add ooblayout for old hamming layout
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Couzens <[email protected]>
commit 6a623e07694437ad09f382a13f76cffc32239a7f upstream.
The old 1-bit hamming layout requires ECC data to be placed at a fixed offset, and not necessarily at the end of the OOB area. Add this old layout back in order to fix legacy setups.
--- drivers/mtd/nand/nand_base.c | 70 ++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 69 insertions(+), 1 deletion(-)
drivers/mtd/nand/nand_base.c +69 -1
@@ -138,6 +138,74 @@ const struct mtd_ooblayout_ops nand_oobl };EXPORT_SYMBOL_GPL (nand_ooblayout_lp_ops); +/* +* Support the old "large page" layout used for 1-bit Hamming ECC where ECC +* are placed at a fixed offset. +*/ +static int nand_ooblayout_ecc_lp_hamming (struct mtd_info *mtd,int section, +struct mtd_oob_region *oobregion) +{ +struct nand_chip *chip =mtd_to_nand (mtd); +struct nand_ecc_ctrl *ecc = &chip->ecc; + +if (section) +return -ERANGE ; + +switch (mtd->oobsize) { +case 64 : + oobregion->offset =40 ; +break ; +case 128 : + oobregion->offset =80 ; +break ; +default : +return -EINVAL ; + } + + oobregion->length = ecc->total; +if (oobregion->offset + oobregion->length > mtd->oobsize) +return -ERANGE ; + +return 0 ; +} + +static int nand_ooblayout_free_lp_hamming (struct mtd_info *mtd,int section, +struct mtd_oob_region *oobregion) +{ +struct nand_chip *chip =mtd_to_nand (mtd); +struct nand_ecc_ctrl *ecc = &chip->ecc; +int ecc_offset =0 ; + +if (section <0 || section >1 ) +return -ERANGE ; + +switch (mtd->oobsize) { +case 64 : + ecc_offset =40 ; +break ; +case 128 : + ecc_offset =80 ; +break ; +default : +return -EINVAL ; + } + +if (section ==0 ) { + oobregion->offset =2 ; + oobregion->length = ecc_offset -2 ; + }else { + oobregion->offset = ecc_offset + ecc->total; + oobregion->length = mtd->oobsize - oobregion->offset; + } + +return 0 ; +} + +const struct mtd_ooblayout_ops nand_ooblayout_lp_hamming_ops = { + .ecc = nand_ooblayout_ecc_lp_hamming, + .free = nand_ooblayout_free_lp_hamming, +}; +static int check_offs_len (struct mtd_info *mtd,loff_t ofs,uint64_t len) {
@@ -4565,7 +4633,7 @@ int nand_scan_tail(struct mtd_info *mtd)break ;case 64 :case 128 : -mtd_set_ooblayout (mtd, &nand_ooblayout_lp_ops); +mtd_set_ooblayout (mtd, &nand_ooblayout_lp_hamming_ops);break ;default : WARN(1, "No oob scheme defined for oobsize %d\n",
Greg Kroah-Hartman
maintainerPATCH 157/164 drm/edid: Add 10 bpc quirk for LGD 764 panel in HP zBook 17 G2
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Kleiner <[email protected]>
commit e345da82bd6bdfa8492f80b3ce4370acfd868d95 upstream.
The builtin eDP panel in the HP zBook 17 G2 supports 10 bpc, as advertised by the Laptops product specs and verified via injecting a fixed edid + photometer measurements, but edid reports unknown depth, so drivers fall back to 6 bpc.
Add a quirk to get the full 10 bpc.
--- drivers/gpu/drm/drm_edid.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/gpu/drm/drm_edid.c +8 -0
@@ -76,6 +76,8 @@#define EDID_QUIRK_FORCE_12BPC (1 << 9)/* Force 6bpc */ #define EDID_QUIRK_FORCE_6BPC (1 << 10) +/* Force 10bpc */ +#define EDID_QUIRK_FORCE_10BPC (1 << 11)struct detailed_mode_closure {struct drm_connector *connector;
@@ -118,6 +120,9 @@ static const struct edid_quirk { {"FCM" ,13600 ,EDID_QUIRK_PREFER_LARGE_75 | EDID_QUIRK_DETAILED_IN_CM }, +/* LGD panel of HP zBook 17 G2, eDP 10 bpc, but reports unknown bpc */ + { "LGD", 764, EDID_QUIRK_FORCE_10BPC }, +/* LG Philips LCD LP154W01-A5 */ { "LPL", 0, EDID_QUIRK_DETAILED_USE_MAXIMUM_SIZE }, { "LPL", 0x2a00, EDID_QUIRK_DETAILED_USE_MAXIMUM_SIZE },
@@ -4105,6 +4110,9 @@ int drm_add_edid_modes(struct drm_connecif (quirks &EDID_QUIRK_FORCE_8BPC ) connector->display_info.bpc =8 ; +if (quirks &EDID_QUIRK_FORCE_10BPC ) + connector->display_info.bpc =10 ; +if (quirks &EDID_QUIRK_FORCE_12BPC ) connector->display_info.bpc =12 ;
Greg Kroah-Hartman
maintainerPATCH 158/164 NFSv4: Fix a hang in OPEN related to server reboot
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
commit 56e0d71ef12f026d96213e45a662bde6bbff4676 upstream.
If the server fails to return the attributes as part of an OPEN reply, and then reboots, we can end up hanging. The reason is that the client attempts to send a GETATTR in order to pick up the missing OPEN call, but fails to release the slot first, causing reboot recovery to deadlock.
--- fs/nfs/nfs4proc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/nfs/nfs4proc.c +3 -1
@@ -2385,8 +2385,10 @@ static int _nfs4_proc_open(struct nfs4_oif (status !=0 )return status; } -if (!(o_res->f_attr->valid &NFS_ATTR_FATTR )) +if (!(o_res->f_attr->valid &NFS_ATTR_FATTR )) { +nfs4_sequence_free_slot (&o_res->seq_res);nfs4_proc_getattr (server, &o_res->fh, o_res->f_attr, o_res->f_label); + }return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 159/164 NFS: Fix use after free in write error path
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fred Isaman <[email protected]>
commit 1f84ccdf37d0db3a70714d02d51b0b6d45887fb8 upstream.
--- fs/nfs/write.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/nfs/write.c +1 -1
@@ -548,9 +548,9 @@ static void nfs_write_error_remove_page( {nfs_unlock_request (req);nfs_end_page_writeback (req); -nfs_release_request (req);generic_error_remove_page (page_file_mapping (req->wb_page), req->wb_page); +nfs_release_request (req); }/*
Greg Kroah-Hartman
maintainerPATCH 160/164 NFS: Use GFP_NOIO for two allocations in writeback
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Coddington <[email protected]>
commit ae97aa524ef495b6276fd26f5d5449fb22975d7c upstream.
Prevent a deadlock that can occur if we wait on allocations that try to write back our pages.
--- fs/nfs/pagelist.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
fs/nfs/pagelist.c +11 -4
@@ -29,13 +29,14 @@static struct kmem_cache *nfs_page_cachep;static const struct rpc_call_ops nfs_pgio_common_ops; -static bool nfs_pgarray_set (struct nfs_page_array *p,unsigned int pagecount) +static bool nfs_pgarray_set (struct nfs_page_array *p,unsigned int pagecount, +gfp_t gfp_flags) { p->npages = pagecount;if (pagecount <=ARRAY_SIZE (p->page_array)) p->pagevec = p->page_array;else { - p->pagevec =kcalloc (pagecount,sizeof (struct page *),GFP_KERNEL ); + p->pagevec =kcalloc (pagecount,sizeof (struct page *), gfp_flags);if (!p->pagevec) p->npages =0 ; }
@@ -681,6 +682,7 @@ void nfs_pageio_init(struct nfs_pageio_d {struct nfs_pgio_mirror *new;int i; +gfp_t gfp_flags =GFP_KERNEL ; desc->pg_moreio =0 ; desc->pg_inode = inode;
@@ -700,8 +702,10 @@ void nfs_pageio_init(struct nfs_pageio_dif (pg_ops->pg_get_mirror_count) {/* until we have a request, we don't have an lseg and no * idea how many mirrors there will be */ +if (desc->pg_rw_ops->rw_mode ==FMODE_WRITE ) + gfp_flags =GFP_NOIO ; new =kcalloc (NFS_PAGEIO_DESCRIPTOR_MIRROR_MAX , -sizeof (struct nfs_pgio_mirror ),GFP_KERNEL ); +sizeof (struct nfs_pgio_mirror ), gfp_flags); desc->pg_mirrors_dynamic = new; desc->pg_mirrors = new;
@@ -755,9 +759,12 @@ int nfs_generic_pgio(struct nfs_pageio_dstruct list_head *head = &mirror->pg_list;struct nfs_commit_info cinfo;unsigned int pagecount, pageused; +gfp_t gfp_flags =GFP_KERNEL ; pagecount =nfs_page_array_len (mirror->pg_base, mirror->pg_count); -if (!nfs_pgarray_set (&hdr->page_array, pagecount)) { +if (desc->pg_rw_ops->rw_mode ==FMODE_WRITE ) + gfp_flags =GFP_NOIO ; +if (!nfs_pgarray_set (&hdr->page_array, pagecount, gfp_flags)) {nfs_pgio_error (hdr); desc->pg_error = -ENOMEM ;return desc->pg_error;
Greg Kroah-Hartman
maintainerPATCH 161/164 nfsd: fix undefined behavior in nfsd4_layout_verify
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ari Kauppi <[email protected]>
commit b550a32e60a4941994b437a8d662432a486235a5 upstream.
UBSAN: Undefined behaviour in fs/nfsd/nfs4proc.c:1262:34 shift exponent 128 is too large for 32-bit type 'int'
Depending on compiler+architecture, this may cause the check for layout_type to succeed for overly large values (which seems to be the case with amd64). The large value will be later used in de-referencing nfsd4_layout_ops for function pointers.
--- fs/nfsd/nfs4proc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/nfsd/nfs4proc.c +2 -1
@@ -1273,7 +1273,8 @@ nfsd4_layout_verify(struct svc_export *ereturn NULL ; } -if (!(exp->ex_layout_types & (1 << layout_type))) { +if (layout_type >=LAYOUT_TYPE_MAX || + !(exp->ex_layout_types & (1 << layout_type))) {dprintk ("%s: layout type %d not supported\n" , __func__, layout_type);return NULL ;
Greg Kroah-Hartman
maintainerPATCH 162/164 nfsd: encoders mustnt use unitialized values in error cases
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: J. Bruce Fields <[email protected]>
commit f961e3f2acae94b727380c0b74e2d3954d0edf79 upstream.
In error cases, lgp->lg_layout_type may be out of bounds; so we shouldn't be using it until after the check of nfserr.
This was seen to crash nfsd threads when the server receives a LAYOUTGET request with a large layout type.
GETDEVICEINFO has the same problem.
--- fs/nfsd/nfs4xdr.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
fs/nfsd/nfs4xdr.c +4 -4
@@ -4081,8 +4081,7 @@ nfsd4_encode_getdeviceinfo(struct nfsd4_ struct nfsd4_getdeviceinfo *gdev) {struct xdr_stream *xdr = &resp->xdr; -const struct nfsd4_layout_ops *ops = - nfsd4_layout_ops[gdev->gd_layout_type]; +const struct nfsd4_layout_ops *ops;u32 starting_len = xdr->buf->len, needed_len;__be32 *p;
@@ -4099,6 +4098,7 @@ nfsd4_encode_getdeviceinfo(struct nfsd4_/* If maxcount is 0 then just update notifications */ if (gdev->gd_maxcount !=0 ) { + ops = nfsd4_layout_ops[gdev->gd_layout_type]; nfserr = ops->encode_getdeviceinfo (xdr, gdev);if (nfserr) {/*
@@ -4151,8 +4151,7 @@ nfsd4_encode_layoutget(struct nfsd4_comp struct nfsd4_layoutget *lgp) {struct xdr_stream *xdr = &resp->xdr; -const struct nfsd4_layout_ops *ops = - nfsd4_layout_ops[lgp->lg_layout_type]; +const struct nfsd4_layout_ops *ops;__be32 *p;dprintk ("%s: err %d\n" , __func__, nfserr);
@@ -4175,6 +4174,7 @@ nfsd4_encode_layoutget(struct nfsd4_comp *p++ =cpu_to_be32 (lgp->lg_seg.iomode); *p++ =cpu_to_be32 (lgp->lg_layout_type); + ops = nfsd4_layout_ops[lgp->lg_layout_type]; nfserr = ops->encode_layoutget (xdr, lgp); out:kfree (lgp->lg_content);
Greg Kroah-Hartman
maintainerPATCH 163/164 drivers: char: mem: Check for address space wraparound with mmap()
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julius Werner <[email protected]>
commit b299cde245b0b76c977f4291162cf668e087b408 upstream.
/dev/mem currently allows mmap() mappings that wrap around the end of the physical address space, which should probably be illegal. It circumvents the existing STRICT_DEVMEM permission check because the loop immediately terminates (as the start address is already higher than the end address). On the x86_64 architecture it will then cause a panic (from the BUG(start >= end) in arch/x86/mm/pat.c:reserve_memtype()).
This patch adds an explicit check to make sure offset + size will not wrap around in the physical address type.
--- drivers/char/mem.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/char/mem.c +5 -0
@@ -340,6 +340,11 @@ static const struct vm_operations_structstatic int mmap_mem (struct file *file,struct vm_area_struct *vma) {size_t size = vma->vm_end - vma->vm_start; +phys_addr_t offset = (phys_addr_t )vma->vm_pgoff <<PAGE_SHIFT ; + +/* It's illegal to wrap around the end of the physical address space. */ +if (offset + (phys_addr_t )size < offset) +return -EINVAL ;if (!valid_mmap_phys_addr_range (vma->vm_pgoff, size))return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 164/164 drm/i915/gvt: Disable access to stolen memory as a guest
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Wilson <[email protected]>
commit 04a68a35ce6d7b54749989f943993020f48fed62 upstream.
Explicitly disable stolen memory when running as a guest in a virtual machine, since the memory is not mediated between clients and reserved entirely for the host. The actual size should be reported as zero, but like every other quirk we want to tell the user what is happening.
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=99028
--- drivers/gpu/drm/i915/i915_gem_stolen.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/gpu/drm/i915/i915_gem_stolen.c +5 -0
@@ -420,6 +420,11 @@ int i915_gem_init_stolen(struct drm_devireturn 0 ; } +if (intel_vgpu_active (dev_priv)) { +DRM_INFO ("iGVT-g active, disabling use of stolen memory\n" ); +return 0 ; + } +#ifdef CONFIG_INTEL_IOMMU if (intel_iommu_gfx_mapped &&INTEL_INFO (dev)->gen <8 ) {DRM_INFO ("DMAR active, disabling use of stolen memory\n" );
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.9.30 release. There are 164 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu May 25 20:08:20 UTC 2017. Anything received after that time might be too late.
Early feedback:
Building arm:axm55xx_defconfig ... failed
--------------
Error log:/opt/buildbot/slave/stable-queue-4.9/build/arch/arm/kvm/../../../virt/kvm/arm/vgic/vgic-v2.c: In function 'vgic_v2_populate_lr':/opt/buildbot/slave/stable-queue-4.9/build/arch/arm/kvm/../../../virt/kvm/arm/vgic/vgic-v2.c:176:3: error: implicit declaration of function 'irq_is_pending' [-Werror=implicit-function-declaration]
if (irq->active && irq_is_pending(irq))
^/opt/buildbot/slave/stable-queue-4.9/build/arch/arm/kvm/../../../virt/kvm/arm/vgic/vgic-v3.c: In function 'vgic_v3_populate_lr':/opt/buildbot/slave/stable-queue-4.9/build/arch/arm/kvm/../../../virt/kvm/arm/vgic/vgic-v3.c:159:3: error: implicit declaration of function 'irq_is_pending'
Building arm64:allmodconfig ... failed
--------------
Error log:arch/arm64/Makefile:23: ld does not support --fix-cortex-a53-843419; kernel may be susceptible to erratumarch/arm64/Makefile:36: LSE atomics not supported by binutils/opt/buildbot/slave/stable-queue-4.9/build/arch/arm64/kvm/../../../virt/kvm/arm/vgic/vgic-v2.c: In function ‘vgic_v2_populate_lr’:/opt/buildbot/slave/stable-queue-4.9/build/arch/arm64/kvm/../../../virt/kvm/arm/vgic/vgic-v2.c:176:22: error: implicit declaration of function ‘irq_is_pending’ [-Werror=implicit-function-declaration]
if (irq->active && irq_is_pending(irq))
^
cc1: some warnings being treated as errors
make[2]: *** [arch/arm64/kvm/../../../virt/kvm/arm/vgic/vgic-v2.o] Error 1
make[2]: *** Waiting for unfinished jobs.... /opt/buildbot/slave/stable-queue-4.9/build/arch/arm64/kvm/../../../virt/kvm/arm/vgic/vgic-v3.c: In function ‘vgic_v3_populate_lr’:/opt/buildbot/slave/stable-queue-4.9/build/arch/arm64/kvm/../../../virt/kvm/arm/vgic/vgic-v3.c:159:22: error: implicit declaration of function ‘irq_is_pending’
Guenter
Greg Kroah-Hartman
maintainerQuoted 30 lines · Guenter Roeck
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.9.30 release. There are 164 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu May 25 20:08:20 UTC 2017. Anything received after that time might be too late.
Early feedback:
Building arm:axm55xx_defconfig ... failed
--------------
Error log:/opt/buildbot/slave/stable-queue-4.9/build/arch/arm/kvm/../../../virt/kvm/arm/vgic/vgic-v2.c: In function 'vgic_v2_populate_lr':/opt/buildbot/slave/stable-queue-4.9/build/arch/arm/kvm/../../../virt/kvm/arm/vgic/vgic-v2.c:176:3: error: implicit declaration of function 'irq_is_pending' [-Werror=implicit-function-declaration]
if (irq->active&&irq_is_pending(irq))
^/opt/buildbot/slave/stable-queue-4.9/build/arch/arm/kvm/../../../virt/kvm/arm/vgic/vgic-v3.c: In function 'vgic_v3_populate_lr':/opt/buildbot/slave/stable-queue-4.9/build/arch/arm/kvm/../../../virt/kvm/arm/vgic/vgic-v3.c:159:3: error: implicit declaration of function 'irq_is_pending'Building arm64:allmodconfig ... failed
--------------
Error log:arch/arm64/Makefile:23: ld does not support --fix-cortex-a53-843419; kernel may be susceptible to erratumarch/arm64/Makefile:36: LSE atomics not supported by binutils/opt/buildbot/slave/stable-queue-4.9/build/arch/arm64/kvm/../../../virt/kvm/arm/vgic/vgic-v2.c: In function ‘vgic_v2_populate_lr’:/opt/buildbot/slave/stable-queue-4.9/build/arch/arm64/kvm/../../../virt/kvm/arm/vgic/vgic-v2.c:176:22: error: implicit declaration of function ‘irq_is_pending’ [-Werror=implicit-function-declaration]
if (irq->active&&irq_is_pending(irq))
Quoted 1 line
^
Hm, looks like one of the kvm patches is calling this, let me dig...
Greg Kroah-Hartman
maintainerQuoted 30 lines · Guenter Roeck
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.9.30 release. There are 164 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu May 25 20:08:20 UTC 2017. Anything received after that time might be too late.
Early feedback:
Building arm:axm55xx_defconfig ... failed
--------------
Error log:/opt/buildbot/slave/stable-queue-4.9/build/arch/arm/kvm/../../../virt/kvm/arm/vgic/vgic-v2.c: In function 'vgic_v2_populate_lr':/opt/buildbot/slave/stable-queue-4.9/build/arch/arm/kvm/../../../virt/kvm/arm/vgic/vgic-v2.c:176:3: error: implicit declaration of function 'irq_is_pending' [-Werror=implicit-function-declaration]
if (irq->active&&irq_is_pending(irq))
^/opt/buildbot/slave/stable-queue-4.9/build/arch/arm/kvm/../../../virt/kvm/arm/vgic/vgic-v3.c: In function 'vgic_v3_populate_lr':/opt/buildbot/slave/stable-queue-4.9/build/arch/arm/kvm/../../../virt/kvm/arm/vgic/vgic-v3.c:159:3: error: implicit declaration of function 'irq_is_pending'Building arm64:allmodconfig ... failed
--------------
Error log:arch/arm64/Makefile:23: ld does not support --fix-cortex-a53-843419; kernel may be susceptible to erratumarch/arm64/Makefile:36: LSE atomics not supported by binutils/opt/buildbot/slave/stable-queue-4.9/build/arch/arm64/kvm/../../../virt/kvm/arm/vgic/vgic-v2.c: In function ‘vgic_v2_populate_lr’:/opt/buildbot/slave/stable-queue-4.9/build/arch/arm64/kvm/../../../virt/kvm/arm/vgic/vgic-v2.c:176:22: error: implicit declaration of function ‘irq_is_pending’ [-Werror=implicit-function-declaration]
if (irq->active&&irq_is_pending(irq))
Quoted 6 lines
^cc1: some warnings being treated as errors
make[2]: *** [arch/arm64/kvm/../../../virt/kvm/arm/vgic/vgic-v2.o] Error 1
make[2]: *** Waiting for unfinished jobs..../opt/buildbot/slave/stable-queue-4.9/build/arch/arm64/kvm/../../../virt/kvm/arm/vgic/vgic-v3.c: In function ‘vgic_v3_populate_lr’:/opt/buildbot/slave/stable-queue-4.9/build/arch/arm64/kvm/../../../virt/kvm/arm/vgic/vgic-v3.c:159:22: error: implicit declaration of function ‘irq_is_pending’
Now found and dropped 2 patches that were causing this. Should be all clean now, thanks for finding this.
greg k-h
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.9.30 release. There are 164 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu May 25 20:08:20 UTC 2017. Anything received after that time might be too late.
Note: This set of results is for v4.9.29-163-g6cdd061.
Build results:
total: 145 pass: 145 fail: 0
Qemu test results:
total: 122 pass: 122 fail: 0Details are available at http://kerneltests.org/builders.
Guenter
Greg Kroah-Hartman
maintainerQuoted 9 lines · Guenter Roeck
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.9.30 release. There are 164 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu May 25 20:08:20 UTC 2017. Anything received after that time might be too late.
Quoted 8 lines
Note: This set of results is for v4.9.29-163-g6cdd061.
Build results:
total: 145 pass: 145 fail: 0 Qemu test results: total: 122 pass: 122 fail: 0Details are available at http://kerneltests.org/builders.
Wonderful, thanks for testing all of these (twice a for some of these), and letting me know they pass.
greg k-h