All of lore.kernel.org
 help / color / mirror / Atom feed
* [patch added to the 3.12 stable tree] efi: Disable interrupts around EFI calls, not in the epilog/prolog calls
@ 2016-01-09 13:05 Jiri Slaby
  2016-01-09 13:05 ` [patch added to the 3.12 stable tree] tools: Add a "make all" rule Jiri Slaby
                   ` (11 more replies)
  0 siblings, 12 replies; 13+ messages in thread
From: Jiri Slaby @ 2016-01-09 13:05 UTC (permalink / raw)
  To: stable; +Cc: Ingo Molnar, Matt Fleming, Luis Henriques, Jiri Slaby

From: Ingo Molnar <mingo@kernel.org>

This patch has been added to the 3.12 stable tree. If you have any
objections, please let us know.

===============

commit 23a0d4e8fa6d3a1d7fb819f79bcc0a3739c30ba9 upstream.

Tapasweni Pathak reported that we do a kmalloc() in efi_call_phys_prolog()
on x86-64 while having interrupts disabled, which is a big no-no, as
kmalloc() can sleep.

Solve this by removing the irq disabling from the prolog/epilog calls
around EFI calls: it's unnecessary, as in this stage we are single
threaded in the boot thread, and we don't ever execute this from
interrupt contexts.

Reported-by: Tapasweni Pathak <tapaswenipathak@gmail.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Matt Fleming <matt.fleming@intel.com>
[ luis: backported to 3.10: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 arch/x86/platform/efi/efi.c    |  7 +++++++
 arch/x86/platform/efi/efi_32.c | 11 +++--------
 arch/x86/platform/efi/efi_64.c |  3 ---
 3 files changed, 10 insertions(+), 11 deletions(-)

diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
index f19284d87dfe..9167de031e47 100644
--- a/arch/x86/platform/efi/efi.c
+++ b/arch/x86/platform/efi/efi.c
@@ -250,12 +250,19 @@ static efi_status_t __init phys_efi_set_virtual_address_map(
 	efi_memory_desc_t *virtual_map)
 {
 	efi_status_t status;
+	unsigned long flags;
 
 	efi_call_phys_prelog();
+
+	/* Disable interrupts around EFI calls: */
+	local_irq_save(flags);
 	status = efi_call_phys4(efi_phys.set_virtual_address_map,
 				memory_map_size, descriptor_size,
 				descriptor_version, virtual_map);
+	local_irq_restore(flags);
+
 	efi_call_phys_epilog();
+
 	return status;
 }
 
diff --git a/arch/x86/platform/efi/efi_32.c b/arch/x86/platform/efi/efi_32.c
index 40e446941dd7..bebbee05e331 100644
--- a/arch/x86/platform/efi/efi_32.c
+++ b/arch/x86/platform/efi/efi_32.c
@@ -33,19 +33,16 @@
 
 /*
  * To make EFI call EFI runtime service in physical addressing mode we need
- * prelog/epilog before/after the invocation to disable interrupt, to
- * claim EFI runtime service handler exclusively and to duplicate a memory in
- * low memory space say 0 - 3G.
+ * prolog/epilog before/after the invocation to claim the EFI runtime service
+ * handler exclusively and to duplicate a memory mapping in low memory space,
+ * say 0 - 3G.
  */
 
-static unsigned long efi_rt_eflags;
 
 void efi_call_phys_prelog(void)
 {
 	struct desc_ptr gdt_descr;
 
-	local_irq_save(efi_rt_eflags);
-
 	load_cr3(initial_page_table);
 	__flush_tlb_all();
 
@@ -64,6 +61,4 @@ void efi_call_phys_epilog(void)
 
 	load_cr3(swapper_pg_dir);
 	__flush_tlb_all();
-
-	local_irq_restore(efi_rt_eflags);
 }
diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c
index 39a0e7f1f0a3..2f6c1a9734c8 100644
--- a/arch/x86/platform/efi/efi_64.c
+++ b/arch/x86/platform/efi/efi_64.c
@@ -40,7 +40,6 @@
 #include <asm/fixmap.h>
 
 static pgd_t *save_pgd __initdata;
-static unsigned long efi_flags __initdata;
 
 static void __init early_code_mapping_set_exec(int executable)
 {
@@ -66,7 +65,6 @@ void __init efi_call_phys_prelog(void)
 	int n_pgds;
 
 	early_code_mapping_set_exec(1);
-	local_irq_save(efi_flags);
 
 	n_pgds = DIV_ROUND_UP((max_pfn << PAGE_SHIFT), PGDIR_SIZE);
 	save_pgd = kmalloc(n_pgds * sizeof(pgd_t), GFP_KERNEL);
@@ -90,7 +88,6 @@ void __init efi_call_phys_epilog(void)
 		set_pgd(pgd_offset_k(pgd * PGDIR_SIZE), save_pgd[pgd]);
 	kfree(save_pgd);
 	__flush_tlb_all();
-	local_irq_restore(efi_flags);
 	early_code_mapping_set_exec(0);
 }
 
-- 
2.7.0


^ permalink raw reply related	[flat|nested] 13+ messages in thread

* [patch added to the 3.12 stable tree] tools: Add a "make all" rule
  2016-01-09 13:05 [patch added to the 3.12 stable tree] efi: Disable interrupts around EFI calls, not in the epilog/prolog calls Jiri Slaby
@ 2016-01-09 13:05 ` Jiri Slaby
  2016-01-09 13:05 ` [patch added to the 3.12 stable tree] ALSA: hda - Fix noise problems on Thinkpad T440s Jiri Slaby
                   ` (10 subsequent siblings)
  11 siblings, 0 replies; 13+ messages in thread
From: Jiri Slaby @ 2016-01-09 13:05 UTC (permalink / raw)
  To: stable
  Cc: Kamal Mostafa, Jiri Olsa, Jonathan Cameron, Pali Rohar,
	Roberta Dobrescu, Arnaldo Carvalho de Melo, Jiri Slaby

From: Kamal Mostafa <kamal@canonical.com>

This patch has been added to the 3.12 stable tree. If you have any
objections, please let us know.

===============

commit f6ba98c5dc78708cb7fd29950c4a50c4c7e88f95 upstream.

Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Acked-by: Pavel Machek <pavel@ucw.cz>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Jonathan Cameron <jic23@kernel.org>
Cc: Pali Rohar <pali.rohar@gmail.com>
Cc: Roberta Dobrescu <roberta.dobrescu@gmail.com>
Link: http://lkml.kernel.org/r/1447280736-2161-2-git-send-email-kamal@canonical.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
[ kamal: backport to 3.12-stable: build all tools for this version ]
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 tools/Makefile | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/tools/Makefile b/tools/Makefile
index 41067f304215..b82a15b92b1c 100644
--- a/tools/Makefile
+++ b/tools/Makefile
@@ -22,6 +22,10 @@ help:
 	@echo '  from the kernel command line to build and install one of'
 	@echo '  the tools above'
 	@echo ''
+	@echo '  $$ make tools/all'
+	@echo ''
+	@echo '  builds all tools.'
+	@echo ''
 	@echo '  $$ make tools/install'
 	@echo ''
 	@echo '  installs all tools.'
@@ -50,6 +54,10 @@ selftests: FORCE
 turbostat x86_energy_perf_policy: FORCE
 	$(call descend,power/x86/$@)
 
+all: cgroup cpupower firewire lguest \
+		perf selftests turbostat usb \
+		virtio vm net x86_energy_perf_policy
+
 cpupower_install:
 	$(call descend,power/$(@:_install=),install)
 
-- 
2.7.0


^ permalink raw reply related	[flat|nested] 13+ messages in thread

* [patch added to the 3.12 stable tree] ALSA: hda - Fix noise problems on Thinkpad T440s
  2016-01-09 13:05 [patch added to the 3.12 stable tree] efi: Disable interrupts around EFI calls, not in the epilog/prolog calls Jiri Slaby
  2016-01-09 13:05 ` [patch added to the 3.12 stable tree] tools: Add a "make all" rule Jiri Slaby
@ 2016-01-09 13:05 ` Jiri Slaby
  2016-01-09 13:05 ` [patch added to the 3.12 stable tree] dlm: make posix locks interruptible Jiri Slaby
                   ` (9 subsequent siblings)
  11 siblings, 0 replies; 13+ messages in thread
From: Jiri Slaby @ 2016-01-09 13:05 UTC (permalink / raw)
  To: stable; +Cc: Takashi Iwai, Jiri Slaby

From: Takashi Iwai <tiwai@suse.de>

This patch has been added to the 3.12 stable tree. If you have any
objections, please let us know.

===============

commit 9a811230481243f384b8036c6a558bfdbd961f78 upstream.

Lenovo Thinkpad T440s suffers from constant background noises, and it
seems to be a generic hardware issue on this model:
  https://forums.lenovo.com/t5/ThinkPad-T400-T500-and-newer-T/T440s-speaker-noise/td-p/1339883

As the noise comes from the analog loopback path, disabling the path
is the easy workaround.

Also, the machine gives significant cracking noises at PM suspend.  A
workaround found by trial-and-error is to disable the shutup callback
currently used for ALC269-variant.

This patch addresses these noise issues by introducing a new fixup
chain.  Although the same workaround might be applicable to other
Thinkpad models, it's applied only to T440s (17aa:220c) in this patch,
so far, just to be safe (you chicken!).  As a compromise, a new model
option string "tp440" is provided now, though, so that owners of other
Thinkpad models can test it more easily.

Bugzilla: https://bugzilla.opensuse.org/show_bug.cgi?id=958504
Reported-and-tested-by: Tim Hardeck <thardeck@suse.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 sound/pci/hda/patch_realtek.c | 22 +++++++++++++++++++++-
 1 file changed, 21 insertions(+), 1 deletion(-)

diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 73d342c8403c..1ec93efc8253 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -3637,6 +3637,18 @@ static void alc283_fixup_chromebook(struct hda_codec *codec,
 	}
 }
 
+/* additional fixup for Thinkpad T440s noise problem */
+static void alc_fixup_tpt440(struct hda_codec *codec,
+			     const struct hda_fixup *fix, int action)
+{
+	struct alc_spec *spec = codec->spec;
+
+	if (action == HDA_FIXUP_ACT_PRE_PROBE) {
+		spec->shutup = alc_no_shutup; /* reduce click noise */
+		spec->gen.mixer_nid = 0; /* reduce background noise */
+	}
+}
+
 /* mute tablet speaker pin (0x14) via dock plugging in addition */
 static void asus_tx300_automute(struct hda_codec *codec)
 {
@@ -3746,6 +3758,7 @@ enum {
 	ALC283_FIXUP_INT_MIC,
 	ALC290_FIXUP_MONO_SPEAKERS,
 	ALC292_FIXUP_TPT440_DOCK,
+	ALC292_FIXUP_TPT440,
 };
 
 static const struct hda_fixup alc269_fixups[] = {
@@ -4090,6 +4103,12 @@ static const struct hda_fixup alc269_fixups[] = {
 		.chained = true,
 		.chain_id = ALC269_FIXUP_LIMIT_INT_MIC_BOOST
 	},
+	[ALC292_FIXUP_TPT440] = {
+		.type = HDA_FIXUP_FUNC,
+		.v.func = alc_fixup_tpt440,
+		.chained = true,
+		.chain_id = ALC292_FIXUP_TPT440_DOCK,
+	},
 };
 
 static const struct snd_pci_quirk alc269_fixup_tbl[] = {
@@ -4185,7 +4204,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x17aa, 0x21fb, "Thinkpad T430s", ALC269_FIXUP_LENOVO_DOCK),
 	SND_PCI_QUIRK(0x17aa, 0x2203, "Thinkpad X230 Tablet", ALC269_FIXUP_LENOVO_DOCK),
 	SND_PCI_QUIRK(0x17aa, 0x2208, "Thinkpad T431s", ALC269_FIXUP_LENOVO_DOCK),
-	SND_PCI_QUIRK(0x17aa, 0x220c, "Thinkpad T440s", ALC292_FIXUP_TPT440_DOCK),
+	SND_PCI_QUIRK(0x17aa, 0x220c, "Thinkpad T440s", ALC292_FIXUP_TPT440),
 	SND_PCI_QUIRK(0x17aa, 0x220e, "Thinkpad T440p", ALC292_FIXUP_TPT440_DOCK),
 	SND_PCI_QUIRK(0x17aa, 0x2212, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
 	SND_PCI_QUIRK(0x17aa, 0x2214, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
@@ -4263,6 +4282,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
 	{.id = ALC269_FIXUP_DELL1_MIC_NO_PRESENCE, .name = "dell-headset-multi"},
 	{.id = ALC269_FIXUP_DELL2_MIC_NO_PRESENCE, .name = "dell-headset-dock"},
 	{.id = ALC292_FIXUP_TPT440_DOCK, .name = "tpt440-dock"},
+	{.id = ALC292_FIXUP_TPT440, .name = "tpt440"},
 	{}
 };
 
-- 
2.7.0


^ permalink raw reply related	[flat|nested] 13+ messages in thread

* [patch added to the 3.12 stable tree] dlm: make posix locks interruptible
  2016-01-09 13:05 [patch added to the 3.12 stable tree] efi: Disable interrupts around EFI calls, not in the epilog/prolog calls Jiri Slaby
  2016-01-09 13:05 ` [patch added to the 3.12 stable tree] tools: Add a "make all" rule Jiri Slaby
  2016-01-09 13:05 ` [patch added to the 3.12 stable tree] ALSA: hda - Fix noise problems on Thinkpad T440s Jiri Slaby
@ 2016-01-09 13:05 ` Jiri Slaby
  2016-01-09 13:05 ` [patch added to the 3.12 stable tree] PCI: Drop "setting latency timer" messages Jiri Slaby
                   ` (8 subsequent siblings)
  11 siblings, 0 replies; 13+ messages in thread
From: Jiri Slaby @ 2016-01-09 13:05 UTC (permalink / raw)
  To: stable; +Cc: Eric Ren, David Teigland, Jiri Slaby

From: Eric Ren <zren@suse.com>

This patch has been added to the 3.12 stable tree. If you have any
objections, please let us know.

===============

commit a6b1533e9a57d76cd3d9b7649d29ac604b1874b8 upstream.

Replace wait_event_killable with wait_event_interruptible
so that a program waiting for a posix lock can be
interrupted by a signal.  With the killable version,
a program was not interruptible by a signal if it
had a signal handler set for it, overriding the default
action of terminating the process.

Signed-off-by: Eric Ren <zren@suse.com>
Signed-off-by: David Teigland <teigland@redhat.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 fs/dlm/plock.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/dlm/plock.c b/fs/dlm/plock.c
index f704458ea5f5..a6d999418de4 100644
--- a/fs/dlm/plock.c
+++ b/fs/dlm/plock.c
@@ -145,7 +145,7 @@ int dlm_posix_lock(dlm_lockspace_t *lockspace, u64 number, struct file *file,
 	send_op(op);
 
 	if (xop->callback == NULL) {
-		rv = wait_event_killable(recv_wq, (op->done != 0));
+		rv = wait_event_interruptible(recv_wq, (op->done != 0));
 		if (rv == -ERESTARTSYS) {
 			log_debug(ls, "dlm_posix_lock: wait killed %llx",
 				  (unsigned long long)number);
-- 
2.7.0


^ permalink raw reply related	[flat|nested] 13+ messages in thread

* [patch added to the 3.12 stable tree] PCI: Drop "setting latency timer" messages
  2016-01-09 13:05 [patch added to the 3.12 stable tree] efi: Disable interrupts around EFI calls, not in the epilog/prolog calls Jiri Slaby
                   ` (2 preceding siblings ...)
  2016-01-09 13:05 ` [patch added to the 3.12 stable tree] dlm: make posix locks interruptible Jiri Slaby
@ 2016-01-09 13:05 ` Jiri Slaby
  2016-01-09 13:05 ` [patch added to the 3.12 stable tree] ipv4: Don't increase PMTU with Datagram Too Big message Jiri Slaby
                   ` (7 subsequent siblings)
  11 siblings, 0 replies; 13+ messages in thread
From: Jiri Slaby @ 2016-01-09 13:05 UTC (permalink / raw)
  To: stable; +Cc: Bjorn Helgaas, Jiri Slaby

From: Bjorn Helgaas <bhelgaas@google.com>

This patch has been added to the 3.12 stable tree. If you have any
objections, please let us know.

===============

commit a006482b67a96c16dfefc558e36863c51e1829bf upstream.

This message isn't useful any more, so drop it.

Reference: https://bugzilla.kernel.org/show_bug.cgi?id=60636
Reported-by: Oleksil Shevchuk <alxchk@gmail.com>
Reference: http://lkml.kernel.org/r/CALCETrWkr53ZjqdN3t7rTTfr=+ZKZXJoYsuBcwPf0kN_33GfAw@mail.gmail.com
Reported-by: Andy Lutomirski <luto@amacapital.net>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 drivers/pci/pci.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 2d163544fa51..1e480a898d28 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -2871,7 +2871,7 @@ void __weak pcibios_set_master(struct pci_dev *dev)
 		lat = pcibios_max_latency;
 	else
 		return;
-	dev_printk(KERN_DEBUG, &dev->dev, "setting latency timer to %d\n", lat);
+
 	pci_write_config_byte(dev, PCI_LATENCY_TIMER, lat);
 }
 
-- 
2.7.0


^ permalink raw reply related	[flat|nested] 13+ messages in thread

* [patch added to the 3.12 stable tree] ipv4: Don't increase PMTU with Datagram Too Big message.
  2016-01-09 13:05 [patch added to the 3.12 stable tree] efi: Disable interrupts around EFI calls, not in the epilog/prolog calls Jiri Slaby
                   ` (3 preceding siblings ...)
  2016-01-09 13:05 ` [patch added to the 3.12 stable tree] PCI: Drop "setting latency timer" messages Jiri Slaby
@ 2016-01-09 13:05 ` Jiri Slaby
  2016-01-09 13:05 ` [patch added to the 3.12 stable tree] route: Use ipv4_mtu instead of raw rt_pmtu Jiri Slaby
                   ` (6 subsequent siblings)
  11 siblings, 0 replies; 13+ messages in thread
From: Jiri Slaby @ 2016-01-09 13:05 UTC (permalink / raw)
  To: stable; +Cc: Li Wei, David S . Miller, Jiri Slaby

From: Li Wei <lw@cn.fujitsu.com>

This patch has been added to the 3.12 stable tree. If you have any
objections, please let us know.

===============

commit 3cdaa5be9e81a914e633a6be7b7d2ef75b528562 upstream.

RFC 1191 said, "a host MUST not increase its estimate of the Path
MTU in response to the contents of a Datagram Too Big message."

Signed-off-by: Li Wei <lw@cn.fujitsu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 net/ipv4/route.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index bd5f3461d1ce..fe0c761a8fce 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -988,6 +988,9 @@ static void __ip_rt_update_pmtu(struct rtable *rt, struct flowi4 *fl4, u32 mtu)
 	if (dst->dev->mtu < mtu)
 		return;
 
+	if (rt->rt_pmtu && rt->rt_pmtu < mtu)
+		return;
+
 	if (mtu < ip_rt_min_pmtu)
 		mtu = ip_rt_min_pmtu;
 
-- 
2.7.0


^ permalink raw reply related	[flat|nested] 13+ messages in thread

* [patch added to the 3.12 stable tree] route: Use ipv4_mtu instead of raw rt_pmtu
  2016-01-09 13:05 [patch added to the 3.12 stable tree] efi: Disable interrupts around EFI calls, not in the epilog/prolog calls Jiri Slaby
                   ` (4 preceding siblings ...)
  2016-01-09 13:05 ` [patch added to the 3.12 stable tree] ipv4: Don't increase PMTU with Datagram Too Big message Jiri Slaby
@ 2016-01-09 13:05 ` Jiri Slaby
  2016-01-09 13:05 ` [patch added to the 3.12 stable tree] SUNRPC: Fix oops when trace sunrpc_task events in nfs client Jiri Slaby
                   ` (5 subsequent siblings)
  11 siblings, 0 replies; 13+ messages in thread
From: Jiri Slaby @ 2016-01-09 13:05 UTC (permalink / raw)
  To: stable; +Cc: Herbert Xu, David S . Miller, Jiri Slaby

From: Herbert Xu <herbert@gondor.apana.org.au>

This patch has been added to the 3.12 stable tree. If you have any
objections, please let us know.

===============

commit cb6ccf09d6b94bec4def1ac5cf4678d12b216474 upstream.

The commit 3cdaa5be9e81a914e633a6be7b7d2ef75b528562 ("ipv4: Don't
increase PMTU with Datagram Too Big message") broke PMTU in cases
where the rt_pmtu value has expired but is smaller than the new
PMTU value.

This obsolete rt_pmtu then prevents the new PMTU value from being
installed.

Fixes: 3cdaa5be9e81 ("ipv4: Don't increase PMTU with Datagram Too Big message")
Reported-by: Gerd v. Egidy <gerd.von.egidy@intra2net.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 net/ipv4/route.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index fe0c761a8fce..54874e4767de 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -985,10 +985,7 @@ static void __ip_rt_update_pmtu(struct rtable *rt, struct flowi4 *fl4, u32 mtu)
 	if (dst_metric_locked(dst, RTAX_MTU))
 		return;
 
-	if (dst->dev->mtu < mtu)
-		return;
-
-	if (rt->rt_pmtu && rt->rt_pmtu < mtu)
+	if (ipv4_mtu(dst) < mtu)
 		return;
 
 	if (mtu < ip_rt_min_pmtu)
-- 
2.7.0


^ permalink raw reply related	[flat|nested] 13+ messages in thread

* [patch added to the 3.12 stable tree] SUNRPC: Fix oops when trace sunrpc_task events in nfs client
  2016-01-09 13:05 [patch added to the 3.12 stable tree] efi: Disable interrupts around EFI calls, not in the epilog/prolog calls Jiri Slaby
                   ` (5 preceding siblings ...)
  2016-01-09 13:05 ` [patch added to the 3.12 stable tree] route: Use ipv4_mtu instead of raw rt_pmtu Jiri Slaby
@ 2016-01-09 13:05 ` Jiri Slaby
  2016-01-09 13:05 ` [patch added to the 3.12 stable tree] ring-buffer: Always run per-cpu ring buffer resize with schedule_work_on() Jiri Slaby
                   ` (4 subsequent siblings)
  11 siblings, 0 replies; 13+ messages in thread
From: Jiri Slaby @ 2016-01-09 13:05 UTC (permalink / raw)
  To: stable; +Cc: Ditang Chen, Trond Myklebust, Jiri Slaby

From: Ditang Chen <chendt.fnst@cn.fujitsu.com>

This patch has been added to the 3.12 stable tree. If you have any
objections, please let us know.

===============

commit 2ca310fc4160ed0420da65534a21ae77b24326a8 upstream.

When tracking sunrpc_task events in nfs client, the clnt pointer may be NULL.

[  139.269266] BUG: unable to handle kernel NULL pointer dereference at 0000000000000004
[  139.269915] IP: [<ffffffffa026f216>] ftrace_raw_event_rpc_task_running+0x86/0xf0 [sunrpc]
[  139.269915] PGD 1d293067 PUD 1d294067 PMD 0
[  139.269915] Oops: 0000 [#1] SMP
[  139.269915] Modules linked in: nfsv4 dns_resolver nfs lockd sunrpc fscache sg ppdev e1000
serio_raw pcspkr parport_pc parport i2c_piix4 i2c_core microcode xfs libcrc32c sd_mod sr_mod
cdrom ata_generic crc_t10dif crct10dif_common pata_acpi ahci libahci ata_piix libata dm_mirror
dm_region_hash dm_log dm_mod
[  139.269915] CPU: 0 PID: 59 Comm: kworker/0:2 Not tainted 3.10.0-84.el7.x86_64 #1
[  139.269915] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
[  139.269915] Workqueue: rpciod rpc_async_schedule [sunrpc]
[  139.269915] task: ffff88001b598000 ti: ffff88001b632000 task.ti: ffff88001b632000
[  139.269915] RIP: 0010:[<ffffffffa026f216>]  [<ffffffffa026f216>] ftrace_raw_event_rpc_task_running+0x86/0xf0 [sunrpc]
[  139.269915] RSP: 0018:ffff88001b633d70  EFLAGS: 00010206
[  139.269915] RAX: ffff88001dfc5338 RBX: ffff88001cc37a00 RCX: ffff88001dfc5334
[  139.269915] RDX: ffff88001dfc5338 RSI: 0000000000000000 RDI: ffff88001dfc533c
[  139.269915] RBP: ffff88001b633db0 R08: 000000000000002c R09: 000000000000000a
[  139.269915] R10: 0000000000062180 R11: 00000020759fb9dc R12: ffffffffa0292c20
[  139.269915] R13: ffff88001dfc5334 R14: 0000000000000000 R15: 0000000000000000
[  139.269915] FS:  0000000000000000(0000) GS:ffff88001fc00000(0000) knlGS:0000000000000000
[  139.269915] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[  139.269915] CR2: 0000000000000004 CR3: 000000001d290000 CR4: 00000000000006f0
[  139.269915] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  139.269915] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[  139.269915] Stack:
[  139.269915]  000000001b633d98 0000000000000246 ffff88001df1dc00 ffff88001cc37a00
[  139.269915]  ffff88001bc35e60 0000000000000000 ffff88001ffa0a48 ffff88001bc35ee0
[  139.269915]  ffff88001b633e08 ffffffffa02704b5 0000000000010000 ffff88001cc37a70
[  139.269915] Call Trace:
[  139.269915]  [<ffffffffa02704b5>] __rpc_execute+0x1d5/0x400 [sunrpc]
[  139.269915]  [<ffffffffa0270706>] rpc_async_schedule+0x26/0x30 [sunrpc]
[  139.269915]  [<ffffffff8107867b>] process_one_work+0x17b/0x460
[  139.269915]  [<ffffffff8107942b>] worker_thread+0x11b/0x400
[  139.269915]  [<ffffffff81079310>] ? rescuer_thread+0x3e0/0x3e0
[  139.269915]  [<ffffffff8107fc80>] kthread+0xc0/0xd0
[  139.269915]  [<ffffffff8107fbc0>] ? kthread_create_on_node+0x110/0x110
[  139.269915]  [<ffffffff815d122c>] ret_from_fork+0x7c/0xb0
[  139.269915]  [<ffffffff8107fbc0>] ? kthread_create_on_node+0x110/0x110
[  139.269915] Code: 4c 8b 45 c8 48 8d 7d d0 89 4d c4 41 89 c9 b9 28 00 00 00 e8 9d b4 e9
e0 48 85 c0 49 89 c5 74 a2 48 89 c7 e8 9d 3f e9 e0 48 89 c2 <41> 8b 46 04 48 8b 7d d0 4c
89 e9 4c 89 e6 89 42 0c 0f b7 83 d4
[  139.269915] RIP  [<ffffffffa026f216>] ftrace_raw_event_rpc_task_running+0x86/0xf0 [sunrpc]
[  139.269915]  RSP <ffff88001b633d70>
[  139.269915] CR2: 0000000000000004
[  140.946406] ---[ end trace ba486328b98d7622 ]---

Signed-off-by: Ditang Chen <chendt.fnst@cn.fujitsu.com>
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 include/trace/events/sunrpc.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/trace/events/sunrpc.h b/include/trace/events/sunrpc.h
index d51d16c7afd8..3646fa31ade9 100644
--- a/include/trace/events/sunrpc.h
+++ b/include/trace/events/sunrpc.h
@@ -83,7 +83,7 @@ DECLARE_EVENT_CLASS(rpc_task_running,
 		),
 
 	TP_fast_assign(
-		__entry->client_id = clnt->cl_clid;
+		__entry->client_id = clnt ? clnt->cl_clid : -1;
 		__entry->task_id = task->tk_pid;
 		__entry->action = action;
 		__entry->runstate = task->tk_runstate;
@@ -91,7 +91,7 @@ DECLARE_EVENT_CLASS(rpc_task_running,
 		__entry->flags = task->tk_flags;
 		),
 
-	TP_printk("task:%u@%u flags=%4.4x state=%4.4lx status=%d action=%pf",
+	TP_printk("task:%u@%d flags=%4.4x state=%4.4lx status=%d action=%pf",
 		__entry->task_id, __entry->client_id,
 		__entry->flags,
 		__entry->runstate,
-- 
2.7.0


^ permalink raw reply related	[flat|nested] 13+ messages in thread

* [patch added to the 3.12 stable tree] ring-buffer: Always run per-cpu ring buffer resize with schedule_work_on()
  2016-01-09 13:05 [patch added to the 3.12 stable tree] efi: Disable interrupts around EFI calls, not in the epilog/prolog calls Jiri Slaby
                   ` (6 preceding siblings ...)
  2016-01-09 13:05 ` [patch added to the 3.12 stable tree] SUNRPC: Fix oops when trace sunrpc_task events in nfs client Jiri Slaby
@ 2016-01-09 13:05 ` Jiri Slaby
  2016-01-09 13:05 ` [patch added to the 3.12 stable tree] drm/i915: Fix SRC_COPY width on 830/845g Jiri Slaby
                   ` (3 subsequent siblings)
  11 siblings, 0 replies; 13+ messages in thread
From: Jiri Slaby @ 2016-01-09 13:05 UTC (permalink / raw)
  To: stable; +Cc: Corey Minyard, Steven Rostedt, Jiri Slaby

From: Corey Minyard <cminyard@mvista.com>

This patch has been added to the 3.12 stable tree. If you have any
objections, please let us know.

===============

commit 021c5b34452d52e51664f09b98cd50c5495e74b6 upstream.

The code for resizing the trace ring buffers has to run the per-cpu
resize on the CPU itself.  The code was using preempt_off() and
running the code for the current CPU directly, otherwise calling
schedule_work_on().

At least on RT this could result in the following:

|BUG: sleeping function called from invalid context at kernel/rtmutex.c:673
|in_atomic(): 1, irqs_disabled(): 0, pid: 607, name: bash
|3 locks held by bash/607:
|CPU: 0 PID: 607 Comm: bash Not tainted 3.12.15-rt25+ #124
|(rt_spin_lock+0x28/0x68)
|(free_hot_cold_page+0x84/0x3b8)
|(free_buffer_page+0x14/0x20)
|(rb_update_pages+0x280/0x338)
|(ring_buffer_resize+0x32c/0x3dc)
|(free_snapshot+0x18/0x38)
|(tracing_set_tracer+0x27c/0x2ac)

probably via
|cd /sys/kernel/debug/tracing/
|echo 1 > events/enable ; sleep 2
|echo 1024 > buffer_size_kb

If we just always use schedule_work_on(), there's no need for the
preempt_off().  So do that.

Link: http://lkml.kernel.org/p/1405537633-31518-1-git-send-email-cminyard@mvista.com

Reported-by: Stanislav Meduna <stano@meduna.org>
Signed-off-by: Corey Minyard <cminyard@mvista.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 kernel/trace/ring_buffer.c | 24 ++++--------------------
 1 file changed, 4 insertions(+), 20 deletions(-)

diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 469af802d14e..d6b35d3a232c 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -1700,22 +1700,14 @@ int ring_buffer_resize(struct ring_buffer *buffer, unsigned long size,
 			if (!cpu_buffer->nr_pages_to_update)
 				continue;
 
-			/* The update must run on the CPU that is being updated. */
-			preempt_disable();
-			if (cpu == smp_processor_id() || !cpu_online(cpu)) {
+			/* Can't run something on an offline CPU. */
+			if (!cpu_online(cpu)) {
 				rb_update_pages(cpu_buffer);
 				cpu_buffer->nr_pages_to_update = 0;
 			} else {
-				/*
-				 * Can not disable preemption for schedule_work_on()
-				 * on PREEMPT_RT.
-				 */
-				preempt_enable();
 				schedule_work_on(cpu,
 						&cpu_buffer->update_pages_work);
-				preempt_disable();
 			}
-			preempt_enable();
 		}
 
 		/* wait for all the updates to complete */
@@ -1753,22 +1745,14 @@ int ring_buffer_resize(struct ring_buffer *buffer, unsigned long size,
 
 		get_online_cpus();
 
-		preempt_disable();
-		/* The update must run on the CPU that is being updated. */
-		if (cpu_id == smp_processor_id() || !cpu_online(cpu_id))
+		/* Can't run something on an offline CPU. */
+		if (!cpu_online(cpu_id))
 			rb_update_pages(cpu_buffer);
 		else {
-			/*
-			 * Can not disable preemption for schedule_work_on()
-			 * on PREEMPT_RT.
-			 */
-			preempt_enable();
 			schedule_work_on(cpu_id,
 					 &cpu_buffer->update_pages_work);
 			wait_for_completion(&cpu_buffer->update_done);
-			preempt_disable();
 		}
-		preempt_enable();
 
 		cpu_buffer->nr_pages_to_update = 0;
 		put_online_cpus();
-- 
2.7.0


^ permalink raw reply related	[flat|nested] 13+ messages in thread

* [patch added to the 3.12 stable tree] drm/i915: Fix SRC_COPY width on 830/845g
  2016-01-09 13:05 [patch added to the 3.12 stable tree] efi: Disable interrupts around EFI calls, not in the epilog/prolog calls Jiri Slaby
                   ` (7 preceding siblings ...)
  2016-01-09 13:05 ` [patch added to the 3.12 stable tree] ring-buffer: Always run per-cpu ring buffer resize with schedule_work_on() Jiri Slaby
@ 2016-01-09 13:05 ` Jiri Slaby
  2016-01-09 13:05 ` [patch added to the 3.12 stable tree] lpfc: Fix null ndlp dereference in target_reset_handler Jiri Slaby
                   ` (2 subsequent siblings)
  11 siblings, 0 replies; 13+ messages in thread
From: Jiri Slaby @ 2016-01-09 13:05 UTC (permalink / raw)
  To: stable; +Cc: Chris Wilson, Thomas Richter, Jani Nikula, Jiri Slaby

From: Chris Wilson <chris@chris-wilson.co.uk>

This patch has been added to the 3.12 stable tree. If you have any
objections, please let us know.

===============

commit 611a7a4fd8b5fb6b25ab1f8bdcde61800a7feacf upstream.

One small change I forgot to make in

commit c4d69da167fa967749aeb70bc0e94a457e5d00c1
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date:   Mon Sep 8 14:25:41 2014 +0100

    drm/i915: Evict CS TLBs between batches

was to update the copy width for the compact BLT copy instruction.

Reported-by: Thomas Richter <thor@math.tu-berlin.de>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Thomas Richter <thor@math.tu-berlin.de>
Cc: Jani Nikula <jani.nikula@intel.com>
Tested-by: Thomas Richter <thor@math.tu-berlin.de>
Acked-by: Daniel Vetter <daniel@ffwll.ch>
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 drivers/gpu/drm/i915/intel_ringbuffer.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
index 4e51ce2bbb85..83780190cdd7 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
@@ -1125,7 +1125,7 @@ i830_dispatch_execbuffer(struct intel_ring_buffer *ring,
 		 */
 		intel_ring_emit(ring, SRC_COPY_BLT_CMD | BLT_WRITE_RGBA);
 		intel_ring_emit(ring, BLT_DEPTH_32 | BLT_ROP_SRC_COPY | 4096);
-		intel_ring_emit(ring, DIV_ROUND_UP(len, 4096) << 16 | 1024);
+		intel_ring_emit(ring, DIV_ROUND_UP(len, 4096) << 16 | 4096);
 		intel_ring_emit(ring, cs_offset);
 		intel_ring_emit(ring, 4096);
 		intel_ring_emit(ring, offset);
-- 
2.7.0


^ permalink raw reply related	[flat|nested] 13+ messages in thread

* [patch added to the 3.12 stable tree] lpfc: Fix null ndlp dereference in target_reset_handler
  2016-01-09 13:05 [patch added to the 3.12 stable tree] efi: Disable interrupts around EFI calls, not in the epilog/prolog calls Jiri Slaby
                   ` (8 preceding siblings ...)
  2016-01-09 13:05 ` [patch added to the 3.12 stable tree] drm/i915: Fix SRC_COPY width on 830/845g Jiri Slaby
@ 2016-01-09 13:05 ` Jiri Slaby
  2016-01-09 13:05 ` [patch added to the 3.12 stable tree] block: Always check queue limits for cloned requests Jiri Slaby
  2016-01-09 13:05 ` [patch added to the 3.12 stable tree] Input: aiptek - fix crash on detecting device without endpoints Jiri Slaby
  11 siblings, 0 replies; 13+ messages in thread
From: Jiri Slaby @ 2016-01-09 13:05 UTC (permalink / raw)
  To: stable; +Cc: James Smart, Dick Kennedy, James Bottomley, Jiri Slaby

From: James Smart <james.smart@emulex.com>

This patch has been added to the 3.12 stable tree. If you have any
objections, please let us know.

===============

Signed-off-by: Dick Kennedy <dick.kennedy@emulex.com>
Signed-off-by: James Smart <james.smart@emulex.com>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
Acked-by: Johannes Thumshirn <jthumshirn@suse.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 drivers/scsi/lpfc/lpfc_scsi.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c
index ed7759980c47..1d01ed6f8dd2 100644
--- a/drivers/scsi/lpfc/lpfc_scsi.c
+++ b/drivers/scsi/lpfc/lpfc_scsi.c
@@ -5264,7 +5264,15 @@ lpfc_target_reset_handler(struct scsi_cmnd *cmnd)
 	if (status == FAILED) {
 		lpfc_printf_vlog(vport, KERN_ERR, LOG_FCP,
 			"0722 Target Reset rport failure: rdata x%p\n", rdata);
-		return FAILED;
+		if (pnode) {
+			spin_lock_irq(shost->host_lock);
+			pnode->nlp_flag &= ~NLP_NPR_ADISC;
+			pnode->nlp_fcp_info &= ~NLP_FCP_2_DEVICE;
+			spin_unlock_irq(shost->host_lock);
+		}
+		lpfc_reset_flush_io_context(vport, tgt_id, lun_id,
+					    LPFC_CTX_TGT);
+		return FAST_IO_FAIL;
 	}
 
 	scsi_event.event_type = FC_REG_SCSI_EVENT;
-- 
2.7.0


^ permalink raw reply related	[flat|nested] 13+ messages in thread

* [patch added to the 3.12 stable tree] block: Always check queue limits for cloned requests
  2016-01-09 13:05 [patch added to the 3.12 stable tree] efi: Disable interrupts around EFI calls, not in the epilog/prolog calls Jiri Slaby
                   ` (9 preceding siblings ...)
  2016-01-09 13:05 ` [patch added to the 3.12 stable tree] lpfc: Fix null ndlp dereference in target_reset_handler Jiri Slaby
@ 2016-01-09 13:05 ` Jiri Slaby
  2016-01-09 13:05 ` [patch added to the 3.12 stable tree] Input: aiptek - fix crash on detecting device without endpoints Jiri Slaby
  11 siblings, 0 replies; 13+ messages in thread
From: Jiri Slaby @ 2016-01-09 13:05 UTC (permalink / raw)
  To: stable
  Cc: Hannes Reinecke, Mike Snitzer, Ewan Milne, Jeff Moyer,
	Jens Axboe, Jiri Slaby

From: Hannes Reinecke <hare@suse.de>

This patch has been added to the 3.12 stable tree. If you have any
objections, please let us know.

===============

commit bf4e6b4e757488dee1b6a581f49c7ac34cd217f8 upstream.

When a cloned request is retried on other queues it always needs
to be checked against the queue limits of that queue.
Otherwise the calculations for nr_phys_segments might be wrong,
leading to a crash in scsi_init_sgtable().

To clarify this the patch renames blk_rq_check_limits()
to blk_cloned_rq_check_limits() and removes the symbol
export, as the new function should only be used for
cloned requests and never exported.

Cc: Mike Snitzer <snitzer@redhat.com>
Cc: Ewan Milne <emilne@redhat.com>
Cc: Jeff Moyer <jmoyer@redhat.com>
Signed-off-by: Hannes Reinecke <hare@suse.de>
Fixes: e2a60da74 ("block: Clean up special command handling logic")
Acked-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Jens Axboe <axboe@fb.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 block/blk-core.c       | 21 +++++++--------------
 include/linux/blkdev.h |  1 -
 2 files changed, 7 insertions(+), 15 deletions(-)

diff --git a/block/blk-core.c b/block/blk-core.c
index bf214ae98937..de352508333f 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -1893,7 +1893,8 @@ void submit_bio(int rw, struct bio *bio)
 EXPORT_SYMBOL(submit_bio);
 
 /**
- * blk_rq_check_limits - Helper function to check a request for the queue limit
+ * blk_cloned_rq_check_limits - Helper function to check a cloned request
+ *                              for new the queue limits
  * @q:  the queue
  * @rq: the request being checked
  *
@@ -1904,20 +1905,13 @@ EXPORT_SYMBOL(submit_bio);
  *    after it is inserted to @q, it should be checked against @q before
  *    the insertion using this generic function.
  *
- *    This function should also be useful for request stacking drivers
- *    in some cases below, so export this function.
  *    Request stacking drivers like request-based dm may change the queue
- *    limits while requests are in the queue (e.g. dm's table swapping).
- *    Such request stacking drivers should check those requests agaist
- *    the new queue limits again when they dispatch those requests,
- *    although such checkings are also done against the old queue limits
- *    when submitting requests.
+ *    limits when retrying requests on other queues. Those requests need
+ *    to be checked against the new queue limits again during dispatch.
  */
-int blk_rq_check_limits(struct request_queue *q, struct request *rq)
+static int blk_cloned_rq_check_limits(struct request_queue *q,
+				      struct request *rq)
 {
-	if (!rq_mergeable(rq))
-		return 0;
-
 	if (blk_rq_sectors(rq) > blk_queue_get_max_sectors(q, rq->cmd_flags)) {
 		printk(KERN_ERR "%s: over max size limit.\n", __func__);
 		return -EIO;
@@ -1937,7 +1931,6 @@ int blk_rq_check_limits(struct request_queue *q, struct request *rq)
 
 	return 0;
 }
-EXPORT_SYMBOL_GPL(blk_rq_check_limits);
 
 /**
  * blk_insert_cloned_request - Helper for stacking drivers to submit a request
@@ -1949,7 +1942,7 @@ int blk_insert_cloned_request(struct request_queue *q, struct request *rq)
 	unsigned long flags;
 	int where = ELEVATOR_INSERT_BACK;
 
-	if (blk_rq_check_limits(q, rq))
+	if (blk_cloned_rq_check_limits(q, rq))
 		return -EIO;
 
 	if (rq->rq_disk &&
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index b1056783c105..e66eba43d702 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -740,7 +740,6 @@ extern struct request *blk_make_request(struct request_queue *, struct bio *,
 extern void blk_requeue_request(struct request_queue *, struct request *);
 extern void blk_add_request_payload(struct request *rq, struct page *page,
 		unsigned int len);
-extern int blk_rq_check_limits(struct request_queue *q, struct request *rq);
 extern int blk_lld_busy(struct request_queue *q);
 extern int blk_rq_prep_clone(struct request *rq, struct request *rq_src,
 			     struct bio_set *bs, gfp_t gfp_mask,
-- 
2.7.0


^ permalink raw reply related	[flat|nested] 13+ messages in thread

* [patch added to the 3.12 stable tree] Input: aiptek - fix crash on detecting device without endpoints
  2016-01-09 13:05 [patch added to the 3.12 stable tree] efi: Disable interrupts around EFI calls, not in the epilog/prolog calls Jiri Slaby
                   ` (10 preceding siblings ...)
  2016-01-09 13:05 ` [patch added to the 3.12 stable tree] block: Always check queue limits for cloned requests Jiri Slaby
@ 2016-01-09 13:05 ` Jiri Slaby
  11 siblings, 0 replies; 13+ messages in thread
From: Jiri Slaby @ 2016-01-09 13:05 UTC (permalink / raw)
  To: stable; +Cc: Vladis Dronov, Dmitry Torokhov, Jiri Slaby

From: Vladis Dronov <vdronov@redhat.com>

This patch has been added to the 3.12 stable tree. If you have any
objections, please let us know.

===============

commit 8e20cf2bce122ce9262d6034ee5d5b76fbb92f96 upstream.

The aiptek driver crashes in aiptek_probe() when a specially crafted USB
device without endpoints is detected. This fix adds a check that the device
has proper configuration expected by the driver. Also an error return value
is changed to more matching one in one of the error paths.

Reported-by: Ralf Spenneberg <ralf@spenneberg.net>
Signed-off-by: Vladis Dronov <vdronov@redhat.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 drivers/input/tablet/aiptek.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/input/tablet/aiptek.c b/drivers/input/tablet/aiptek.c
index ee83c3904ee8..fcf9aa1eb167 100644
--- a/drivers/input/tablet/aiptek.c
+++ b/drivers/input/tablet/aiptek.c
@@ -1820,6 +1820,14 @@ aiptek_probe(struct usb_interface *intf, const struct usb_device_id *id)
 	input_set_abs_params(inputdev, ABS_TILT_Y, AIPTEK_TILT_MIN, AIPTEK_TILT_MAX, 0, 0);
 	input_set_abs_params(inputdev, ABS_WHEEL, AIPTEK_WHEEL_MIN, AIPTEK_WHEEL_MAX - 1, 0, 0);
 
+	/* Verify that a device really has an endpoint */
+	if (intf->altsetting[0].desc.bNumEndpoints < 1) {
+		dev_err(&intf->dev,
+			"interface has %d endpoints, but must have minimum 1\n",
+			intf->altsetting[0].desc.bNumEndpoints);
+		err = -EINVAL;
+		goto fail3;
+	}
 	endpoint = &intf->altsetting[0].endpoint[0].desc;
 
 	/* Go set up our URB, which is called when the tablet receives
@@ -1862,6 +1870,7 @@ aiptek_probe(struct usb_interface *intf, const struct usb_device_id *id)
 	if (i == ARRAY_SIZE(speeds)) {
 		dev_info(&intf->dev,
 			 "Aiptek tried all speeds, no sane response\n");
+		err = -EINVAL;
 		goto fail3;
 	}
 
-- 
2.7.0


^ permalink raw reply related	[flat|nested] 13+ messages in thread

end of thread, other threads:[~2016-01-09 13:05 UTC | newest]

Thread overview: 13+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-01-09 13:05 [patch added to the 3.12 stable tree] efi: Disable interrupts around EFI calls, not in the epilog/prolog calls Jiri Slaby
2016-01-09 13:05 ` [patch added to the 3.12 stable tree] tools: Add a "make all" rule Jiri Slaby
2016-01-09 13:05 ` [patch added to the 3.12 stable tree] ALSA: hda - Fix noise problems on Thinkpad T440s Jiri Slaby
2016-01-09 13:05 ` [patch added to the 3.12 stable tree] dlm: make posix locks interruptible Jiri Slaby
2016-01-09 13:05 ` [patch added to the 3.12 stable tree] PCI: Drop "setting latency timer" messages Jiri Slaby
2016-01-09 13:05 ` [patch added to the 3.12 stable tree] ipv4: Don't increase PMTU with Datagram Too Big message Jiri Slaby
2016-01-09 13:05 ` [patch added to the 3.12 stable tree] route: Use ipv4_mtu instead of raw rt_pmtu Jiri Slaby
2016-01-09 13:05 ` [patch added to the 3.12 stable tree] SUNRPC: Fix oops when trace sunrpc_task events in nfs client Jiri Slaby
2016-01-09 13:05 ` [patch added to the 3.12 stable tree] ring-buffer: Always run per-cpu ring buffer resize with schedule_work_on() Jiri Slaby
2016-01-09 13:05 ` [patch added to the 3.12 stable tree] drm/i915: Fix SRC_COPY width on 830/845g Jiri Slaby
2016-01-09 13:05 ` [patch added to the 3.12 stable tree] lpfc: Fix null ndlp dereference in target_reset_handler Jiri Slaby
2016-01-09 13:05 ` [patch added to the 3.12 stable tree] block: Always check queue limits for cloned requests Jiri Slaby
2016-01-09 13:05 ` [patch added to the 3.12 stable tree] Input: aiptek - fix crash on detecting device without endpoints Jiri Slaby

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.