* [PATCH 3.16.y-ckt 001/128] fuse: break infinite loop in fuse_fill_write_pages()
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
@ 2016-01-24 21:59 ` Luis Henriques
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 002/128] usb: gadget: pxa27x: fix suspend callback Luis Henriques
` (127 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 21:59 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Andrew Morton, Maxim Patlasov, Konstantin Khlebnikov,
Roman Gushchin, Miklos Szeredi, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Roman Gushchin <klamm@yandex-team.ru>
commit 3ca8138f014a913f98e6ef40e939868e1e9ea876 upstream.
I got a report about unkillable task eating CPU. Further
investigation shows, that the problem is in the fuse_fill_write_pages()
function. If iov's first segment has zero length, we get an infinite
loop, because we never reach iov_iter_advance() call.
Fix this by calling iov_iter_advance() before repeating an attempt to
copy data from userspace.
A similar problem is described in 124d3b7041f ("fix writev regression:
pan hanging unkillable and un-straceable"). If zero-length segmend
is followed by segment with invalid address,
iov_iter_fault_in_readable() checks only first segment (zero-length),
iov_iter_copy_from_user_atomic() skips it, fails at second and
returns zero -> goto again without skipping zero-length segment.
Patch calls iov_iter_advance() before goto again: we'll skip zero-length
segment at second iteraction and iov_iter_fault_in_readable() will detect
invalid address.
Special thanks to Konstantin Khlebnikov, who helped a lot with the commit
description.
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Maxim Patlasov <mpatlasov@parallels.com>
Cc: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Signed-off-by: Roman Gushchin <klamm@yandex-team.ru>
Signed-off-by: Miklos Szeredi <miklos@szeredi.hu>
Fixes: ea9b9907b82a ("fuse: implement perform_write")
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
fs/fuse/file.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index caa8d95b24e8..e2a2c14a90ee 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -1088,6 +1088,7 @@ static ssize_t fuse_fill_write_pages(struct fuse_req *req,
tmp = iov_iter_copy_from_user_atomic(page, ii, offset, bytes);
flush_dcache_page(page);
+ iov_iter_advance(ii, tmp);
if (!tmp) {
unlock_page(page);
page_cache_release(page);
@@ -1100,7 +1101,6 @@ static ssize_t fuse_fill_write_pages(struct fuse_req *req,
req->page_descs[req->num_pages].length = tmp;
req->num_pages++;
- iov_iter_advance(ii, tmp);
count += tmp;
pos += tmp;
offset += tmp;
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 002/128] usb: gadget: pxa27x: fix suspend callback
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 001/128] fuse: break infinite loop in fuse_fill_write_pages() Luis Henriques
@ 2016-01-24 21:59 ` Luis Henriques
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 003/128] iio: fix some warning messages Luis Henriques
` (126 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 21:59 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Felipe Balbi, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Felipe Balbi <balbi@ti.com>
commit 391e6dcb37857d5659b53def2f41e2f56850d33c upstream.
pxa27x disconnects pullups on suspend but doesn't
notify the gadget driver about it, so gadget driver
can't disable the endpoints it was using.
This causes problems on resume because gadget core
will think endpoints are still enabled and just
ignore the following usb_ep_enable().
Fix this problem by calling
gadget_driver->disconnect().
Tested-by: Robert Jarzmik <robert.jarzmik@free.fr>
Signed-off-by: Felipe Balbi <balbi@ti.com>
[ luis: backported to 3.16:
- file rename: drivers/usb/gadget/udc/pxa27x_udc.c ->
drivers/usb/gadget/pxa27x_udc.c ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/usb/gadget/pxa27x_udc.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/usb/gadget/pxa27x_udc.c b/drivers/usb/gadget/pxa27x_udc.c
index cdf4d678be96..a63dee15bdc7 100644
--- a/drivers/usb/gadget/pxa27x_udc.c
+++ b/drivers/usb/gadget/pxa27x_udc.c
@@ -2558,6 +2558,9 @@ static int pxa_udc_suspend(struct platform_device *_dev, pm_message_t state)
udc->pullup_resume = udc->pullup_on;
dplus_pullup(udc, 0);
+ if (udc->driver)
+ udc->driver->disconnect(&udc->gadget);
+
return 0;
}
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 003/128] iio: fix some warning messages
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 001/128] fuse: break infinite loop in fuse_fill_write_pages() Luis Henriques
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 002/128] usb: gadget: pxa27x: fix suspend callback Luis Henriques
@ 2016-01-24 21:59 ` Luis Henriques
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 004/128] USB: cp210x: Remove CP2110 ID from compatibility list Luis Henriques
` (125 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 21:59 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Dan Carpenter, Jonathan Cameron, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
commit 231bfe53c57e89857753c940192acba933cba56c upstream.
WARN_ON() only takes a condition argument. I have changed these to
WARN() instead.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/iio/industrialio-buffer.c | 2 +-
drivers/iio/industrialio-core.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
index b8af417e7b93..d495b2e82810 100644
--- a/drivers/iio/industrialio-buffer.c
+++ b/drivers/iio/industrialio-buffer.c
@@ -843,7 +843,7 @@ int iio_scan_mask_set(struct iio_dev *indio_dev,
if (trialmask == NULL)
return -ENOMEM;
if (!indio_dev->masklength) {
- WARN_ON("Trying to set scanmask prior to registering buffer\n");
+ WARN(1, "Trying to set scanmask prior to registering buffer\n");
goto err_invalid_mask;
}
bitmap_copy(trialmask, buffer->scan_mask, indio_dev->masklength);
diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c
index fa061972a2fe..7995c68c2a34 100644
--- a/drivers/iio/industrialio-core.c
+++ b/drivers/iio/industrialio-core.c
@@ -612,7 +612,7 @@ int __iio_device_attr_init(struct device_attribute *dev_attr,
break;
case IIO_SEPARATE:
if (!chan->indexed) {
- WARN_ON("Differential channels must be indexed\n");
+ WARN(1, "Differential channels must be indexed\n");
ret = -EINVAL;
goto error_free_full_postfix;
}
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 004/128] USB: cp210x: Remove CP2110 ID from compatibility list
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (2 preceding siblings ...)
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 003/128] iio: fix some warning messages Luis Henriques
@ 2016-01-24 21:59 ` Luis Henriques
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 005/128] USB: cdc_acm: Ignore Infineon Flash Loader utility Luis Henriques
` (124 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 21:59 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Konstantin Shkolnyy, Johan Hovold, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Konstantin Shkolnyy <konstantin.shkolnyy@gmail.com>
commit 7c90e610b60cd1ed6abafd806acfaedccbbe52d1 upstream.
CP2110 ID (0x10c4, 0xea80) doesn't belong here because it's a HID
and completely different from CP210x devices.
Signed-off-by: Konstantin Shkolnyy <konstantin.shkolnyy@gmail.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/usb/serial/cp210x.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index d11335d4395d..c2bdc5f2a4b1 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -132,7 +132,6 @@ static const struct usb_device_id id_table[] = {
{ USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */
{ USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */
{ USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */
- { USB_DEVICE(0x10C4, 0xEA80) }, /* Silicon Labs factory default */
{ USB_DEVICE(0x10C4, 0xEA71) }, /* Infinity GPS-MIC-1 Radio Monophone */
{ USB_DEVICE(0x10C4, 0xF001) }, /* Elan Digital Systems USBscope50 */
{ USB_DEVICE(0x10C4, 0xF002) }, /* Elan Digital Systems USBwave12 */
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 005/128] USB: cdc_acm: Ignore Infineon Flash Loader utility
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (3 preceding siblings ...)
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 004/128] USB: cp210x: Remove CP2110 ID from compatibility list Luis Henriques
@ 2016-01-24 21:59 ` Luis Henriques
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 006/128] USB: serial: Another Infineon flash loader USB ID Luis Henriques
` (123 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 21:59 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Jonas Jonsson, Johan Hovold, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Jonas Jonsson <jonas@ludd.ltu.se>
commit f33a7f72e5fc033daccbb8d4753d7c5c41a4d67b upstream.
Some modems, such as the Telit UE910, are using an Infineon Flash Loader
utility. It has two interfaces, 2/2/0 (Abstract Modem) and 10/0/0 (CDC
Data). The latter can be used as a serial interface to upgrade the
firmware of the modem. However, that isn't possible when the cdc-acm
driver takes control of the device.
The following is an explanation of the behaviour by Daniele Palmas during
discussion on linux-usb.
"This is what happens when the device is turned on (without modifying
the drivers):
[155492.352031] usb 1-3: new high-speed USB device number 27 using ehci-pci
[155492.485429] usb 1-3: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 255, changing to 11
[155492.485436] usb 1-3: New USB device found, idVendor=058b, idProduct=0041
[155492.485439] usb 1-3: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[155492.485952] cdc_acm 1-3:1.0: ttyACM0: USB ACM device
This is the flashing device that is caught by the cdc-acm driver. Once
the ttyACM appears, the application starts sending a magic string
(simple write on the file descriptor) to keep the device in flashing
mode. If this magic string is not properly received in a certain time
interval, the modem goes on in normal operative mode:
[155493.748094] usb 1-3: USB disconnect, device number 27
[155494.916025] usb 1-3: new high-speed USB device number 28 using ehci-pci
[155495.059978] usb 1-3: New USB device found, idVendor=1bc7, idProduct=0021
[155495.059983] usb 1-3: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[155495.059986] usb 1-3: Product: 6 CDC-ACM + 1 CDC-ECM
[155495.059989] usb 1-3: Manufacturer: Telit
[155495.059992] usb 1-3: SerialNumber: 359658044004697
[155495.138958] cdc_acm 1-3:1.0: ttyACM0: USB ACM device
[155495.140832] cdc_acm 1-3:1.2: ttyACM1: USB ACM device
[155495.142827] cdc_acm 1-3:1.4: ttyACM2: USB ACM device
[155495.144462] cdc_acm 1-3:1.6: ttyACM3: USB ACM device
[155495.145967] cdc_acm 1-3:1.8: ttyACM4: USB ACM device
[155495.147588] cdc_acm 1-3:1.10: ttyACM5: USB ACM device
[155495.154322] cdc_ether 1-3:1.12 wwan0: register 'cdc_ether' at usb-0000:00:1a.7-3, Mobile Broadband Network Device, 00:00:11:12:13:14
Using the cdc-acm driver, the string, though being sent in the same way
than using the usb-serial-simple driver (I can confirm that the data is
passing properly since I used an hw usb sniffer), does not make the
device to stay in flashing mode."
Signed-off-by: Jonas Jonsson <jonas@ludd.ltu.se>
Tested-by: Daniele Palmas <dnlplm@gmail.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/usb/class/cdc-acm.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 54c79f7fdaf5..f2dc4628fb05 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1856,6 +1856,11 @@ static const struct usb_device_id acm_ids[] = {
},
#endif
+ /* Exclude Infineon Flash Loader utility */
+ { USB_DEVICE(0x058b, 0x0041),
+ .driver_info = IGNORE_DEVICE,
+ },
+
/* control interfaces without any protocol set */
{ USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM,
USB_CDC_PROTO_NONE) },
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 006/128] USB: serial: Another Infineon flash loader USB ID
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (4 preceding siblings ...)
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 005/128] USB: cdc_acm: Ignore Infineon Flash Loader utility Luis Henriques
@ 2016-01-24 21:59 ` Luis Henriques
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 007/128] ext4: Fix handling of extended tv_sec Luis Henriques
` (122 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 21:59 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Jonas Jonsson, Johan Hovold, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Jonas Jonsson <jonas@ludd.ltu.se>
commit a0e80fbd56b4573de997c9a088a33abbc1121400 upstream.
The flash loader has been seen on a Telit UE910 modem. The flash loader
is a bit special, it presents both an ACM and CDC Data interface but
only the latter is useful. Unless a magic string is sent to the device
it will disappear and the regular modem device appears instead.
Signed-off-by: Jonas Jonsson <jonas@ludd.ltu.se>
Tested-by: Daniele Palmas <dnlplm@gmail.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/usb/serial/usb-serial-simple.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/usb/serial/usb-serial-simple.c b/drivers/usb/serial/usb-serial-simple.c
index e5ad1ee6cb5f..5c19d3e7b4b8 100644
--- a/drivers/usb/serial/usb-serial-simple.c
+++ b/drivers/usb/serial/usb-serial-simple.c
@@ -47,6 +47,7 @@ DEVICE(funsoft, FUNSOFT_IDS);
/* Infineon Flashloader driver */
#define FLASHLOADER_IDS() \
+ { USB_DEVICE_INTERFACE_CLASS(0x058b, 0x0041, USB_CLASS_CDC_DATA) }, \
{ USB_DEVICE(0x8087, 0x0716) }
DEVICE(flashloader, FLASHLOADER_IDS);
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 007/128] ext4: Fix handling of extended tv_sec
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (5 preceding siblings ...)
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 006/128] USB: serial: Another Infineon flash loader USB ID Luis Henriques
@ 2016-01-24 21:59 ` Luis Henriques
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 008/128] jbd2: Fix unreclaimed pages after truncate in data=journal mode Luis Henriques
` (121 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 21:59 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: David Turner, Theodore Ts'o, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: David Turner <novalis@novalis.org>
commit a4dad1ae24f850410c4e60f22823cba1289b8d52 upstream.
In ext4, the bottom two bits of {a,c,m}time_extra are used to extend
the {a,c,m}time fields, deferring the year 2038 problem to the year
2446.
When decoding these extended fields, for times whose bottom 32 bits
would represent a negative number, sign extension causes the 64-bit
extended timestamp to be negative as well, which is not what's
intended. This patch corrects that issue, so that the only negative
{a,c,m}times are those between 1901 and 1970 (as per 32-bit signed
timestamps).
Some older kernels might have written pre-1970 dates with 1,1 in the
extra bits. This patch treats those incorrectly-encoded dates as
pre-1970, instead of post-2311, until kernel 4.20 is released.
Hopefully by then e2fsck will have fixed up the bad data.
Also add a comment explaining the encoding of ext4's extra {a,c,m}time
bits.
Signed-off-by: David Turner <novalis@novalis.org>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Reported-by: Mark Harris <mh8928@yahoo.com>
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=23732
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
fs/ext4/ext4.h | 51 ++++++++++++++++++++++++++++++++++++++++++++-------
1 file changed, 44 insertions(+), 7 deletions(-)
diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index e00dc9772402..0798c0bfe57b 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -26,6 +26,7 @@
#include <linux/seqlock.h>
#include <linux/mutex.h>
#include <linux/timer.h>
+#include <linux/version.h>
#include <linux/wait.h>
#include <linux/blockgroup_lock.h>
#include <linux/percpu_counter.h>
@@ -727,19 +728,55 @@ struct move_extent {
<= (EXT4_GOOD_OLD_INODE_SIZE + \
(einode)->i_extra_isize)) \
+/*
+ * We use an encoding that preserves the times for extra epoch "00":
+ *
+ * extra msb of adjust for signed
+ * epoch 32-bit 32-bit tv_sec to
+ * bits time decoded 64-bit tv_sec 64-bit tv_sec valid time range
+ * 0 0 1 -0x80000000..-0x00000001 0x000000000 1901-12-13..1969-12-31
+ * 0 0 0 0x000000000..0x07fffffff 0x000000000 1970-01-01..2038-01-19
+ * 0 1 1 0x080000000..0x0ffffffff 0x100000000 2038-01-19..2106-02-07
+ * 0 1 0 0x100000000..0x17fffffff 0x100000000 2106-02-07..2174-02-25
+ * 1 0 1 0x180000000..0x1ffffffff 0x200000000 2174-02-25..2242-03-16
+ * 1 0 0 0x200000000..0x27fffffff 0x200000000 2242-03-16..2310-04-04
+ * 1 1 1 0x280000000..0x2ffffffff 0x300000000 2310-04-04..2378-04-22
+ * 1 1 0 0x300000000..0x37fffffff 0x300000000 2378-04-22..2446-05-10
+ *
+ * Note that previous versions of the kernel on 64-bit systems would
+ * incorrectly use extra epoch bits 1,1 for dates between 1901 and
+ * 1970. e2fsck will correct this, assuming that it is run on the
+ * affected filesystem before 2242.
+ */
+
static inline __le32 ext4_encode_extra_time(struct timespec *time)
{
- return cpu_to_le32((sizeof(time->tv_sec) > 4 ?
- (time->tv_sec >> 32) & EXT4_EPOCH_MASK : 0) |
- ((time->tv_nsec << EXT4_EPOCH_BITS) & EXT4_NSEC_MASK));
+ u32 extra = sizeof(time->tv_sec) > 4 ?
+ ((time->tv_sec - (s32)time->tv_sec) >> 32) & EXT4_EPOCH_MASK : 0;
+ return cpu_to_le32(extra | (time->tv_nsec << EXT4_EPOCH_BITS));
}
static inline void ext4_decode_extra_time(struct timespec *time, __le32 extra)
{
- if (sizeof(time->tv_sec) > 4)
- time->tv_sec |= (__u64)(le32_to_cpu(extra) & EXT4_EPOCH_MASK)
- << 32;
- time->tv_nsec = (le32_to_cpu(extra) & EXT4_NSEC_MASK) >> EXT4_EPOCH_BITS;
+ if (unlikely(sizeof(time->tv_sec) > 4 &&
+ (extra & cpu_to_le32(EXT4_EPOCH_MASK)))) {
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4,20,0)
+ /* Handle legacy encoding of pre-1970 dates with epoch
+ * bits 1,1. We assume that by kernel version 4.20,
+ * everyone will have run fsck over the affected
+ * filesystems to correct the problem. (This
+ * backwards compatibility may be removed before this
+ * time, at the discretion of the ext4 developers.)
+ */
+ u64 extra_bits = le32_to_cpu(extra) & EXT4_EPOCH_MASK;
+ if (extra_bits == 3 && ((time->tv_sec) & 0x80000000) != 0)
+ extra_bits = 0;
+ time->tv_sec += extra_bits << 32;
+#else
+ time->tv_sec += (u64)(le32_to_cpu(extra) & EXT4_EPOCH_MASK) << 32;
+#endif
+ }
+ time->tv_nsec = (le32_to_cpu(extra) & EXT4_NSEC_MASK) >> EXT4_EPOCH_BITS;
}
#define EXT4_INODE_SET_XTIME(xtime, inode, raw_inode) \
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 008/128] jbd2: Fix unreclaimed pages after truncate in data=journal mode
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (6 preceding siblings ...)
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 007/128] ext4: Fix handling of extended tv_sec Luis Henriques
@ 2016-01-24 21:59 ` Luis Henriques
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 009/128] drm/ttm: Fixed a read/write lock imbalance Luis Henriques
` (120 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 21:59 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Jan Kara, Theodore Ts'o, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Jan Kara <jack@suse.cz>
commit bc23f0c8d7ccd8d924c4e70ce311288cb3e61ea8 upstream.
Ted and Namjae have reported that truncated pages don't get timely
reclaimed after being truncated in data=journal mode. The following test
triggers the issue easily:
for (i = 0; i < 1000; i++) {
pwrite(fd, buf, 1024*1024, 0);
fsync(fd);
fsync(fd);
ftruncate(fd, 0);
}
The reason is that journal_unmap_buffer() finds that truncated buffers
are not journalled (jh->b_transaction == NULL), they are part of
checkpoint list of a transaction (jh->b_cp_transaction != NULL) and have
been already written out (!buffer_dirty(bh)). We clean such buffers but
we leave them in the checkpoint list. Since checkpoint transaction holds
a reference to the journal head, these buffers cannot be released until
the checkpoint transaction is cleaned up. And at that point we don't
call release_buffer_page() anymore so pages detached from mapping are
lingering in the system waiting for reclaim to find them and free them.
Fix the problem by removing buffers from transaction checkpoint lists
when journal_unmap_buffer() finds out they don't have to be there
anymore.
Reported-and-tested-by: Namjae Jeon <namjae.jeon@samsung.com>
Fixes: de1b794130b130e77ffa975bb58cb843744f9ae5
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
fs/jbd2/transaction.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
index 99ebbd72a064..77303ba0c270 100644
--- a/fs/jbd2/transaction.c
+++ b/fs/jbd2/transaction.c
@@ -2064,6 +2064,7 @@ static int journal_unmap_buffer(journal_t *journal, struct buffer_head *bh,
if (!buffer_dirty(bh)) {
/* bdflush has written it. We can drop it now */
+ __jbd2_journal_remove_checkpoint(jh);
goto zap_buffer;
}
@@ -2093,6 +2094,7 @@ static int journal_unmap_buffer(journal_t *journal, struct buffer_head *bh,
/* The orphan record's transaction has
* committed. We can cleanse this buffer */
clear_buffer_jbddirty(bh);
+ __jbd2_journal_remove_checkpoint(jh);
goto zap_buffer;
}
}
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 009/128] drm/ttm: Fixed a read/write lock imbalance
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (7 preceding siblings ...)
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 008/128] jbd2: Fix unreclaimed pages after truncate in data=journal mode Luis Henriques
@ 2016-01-24 21:59 ` Luis Henriques
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 010/128] AHCI: Fix softreset failed issue of Port Multiplier Luis Henriques
` (119 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 21:59 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Thomas Hellstrom, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Thomas Hellstrom <thellstrom@vmware.com>
commit 025af189fb44250206dd8a32fa4a682392af3301 upstream.
In ttm_write_lock(), the uninterruptible path should call
__ttm_write_lock() not __ttm_read_lock(). This fixes a vmwgfx hang
on F23 start up.
syeh: Extracted this from one of Thomas' internal patches.
Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
Reviewed-by: Sinclair Yeh <syeh@vmware.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/gpu/drm/ttm/ttm_lock.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/ttm/ttm_lock.c b/drivers/gpu/drm/ttm/ttm_lock.c
index 6a954544727f..f154fb1929bd 100644
--- a/drivers/gpu/drm/ttm/ttm_lock.c
+++ b/drivers/gpu/drm/ttm/ttm_lock.c
@@ -180,7 +180,7 @@ int ttm_write_lock(struct ttm_lock *lock, bool interruptible)
spin_unlock(&lock->lock);
}
} else
- wait_event(lock->queue, __ttm_read_lock(lock));
+ wait_event(lock->queue, __ttm_write_lock(lock));
return ret;
}
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 010/128] AHCI: Fix softreset failed issue of Port Multiplier
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (8 preceding siblings ...)
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 009/128] drm/ttm: Fixed a read/write lock imbalance Luis Henriques
@ 2016-01-24 21:59 ` Luis Henriques
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 011/128] sata_sil: disable trim Luis Henriques
` (118 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 21:59 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Xiangliang Yu, Tejun Heo, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Xiangliang Yu <Xiangliang.Yu@amd.com>
commit 023113d24ef9e1d2b44cb2446872b17e2b01d8b1 upstream.
Current code doesn't update port value of Port Multiplier(PM) when
sending FIS of softreset to device, command will fail if FBS is
enabled.
There are two ways to fix the issue: the first is to disable FBS
before sending softreset command to PM device and the second is
to update port value of PM when sending command.
For the first way, i can't find any related rule in AHCI Spec. The
second way can avoid disabling FBS and has better performance.
Signed-off-by: Xiangliang Yu <Xiangliang.Yu@amd.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/ata/libahci.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
index 86c3c24b835f..a0bfdcfafd92 100644
--- a/drivers/ata/libahci.c
+++ b/drivers/ata/libahci.c
@@ -1271,6 +1271,15 @@ static int ahci_exec_polled_cmd(struct ata_port *ap, int pmp,
ata_tf_to_fis(tf, pmp, is_cmd, fis);
ahci_fill_cmd_slot(pp, 0, cmd_fis_len | flags | (pmp << 12));
+ /* set port value for softreset of Port Multiplier */
+ if (pp->fbs_enabled && pp->fbs_last_dev != pmp) {
+ tmp = readl(port_mmio + PORT_FBS);
+ tmp &= ~(PORT_FBS_DEV_MASK | PORT_FBS_DEC);
+ tmp |= pmp << PORT_FBS_DEV_OFFSET;
+ writel(tmp, port_mmio + PORT_FBS);
+ pp->fbs_last_dev = pmp;
+ }
+
/* issue & wait */
writel(1, port_mmio + PORT_CMD_ISSUE);
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 011/128] sata_sil: disable trim
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (9 preceding siblings ...)
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 010/128] AHCI: Fix softreset failed issue of Port Multiplier Luis Henriques
@ 2016-01-24 21:59 ` Luis Henriques
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 012/128] usb-storage: Fix scsi-sd failure "Invalid field in cdb" for USB adapter JMicron Luis Henriques
` (117 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 21:59 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Mikulas Patocka, Tejun Heo, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Mikulas Patocka <mpatocka@redhat.com>
commit d98f1cd0a3b70ea91f1dfda3ac36c3b2e1a4d5e2 upstream.
When I connect an Intel SSD to SATA SIL controller (PCI ID 1095:3114), any
TRIM command results in I/O errors being reported in the log. There is
other similar error reported with TRIM and the SIL controller:
https://bugs.centos.org/view.php?id=5880
Apparently the controller doesn't support TRIM commands. This patch
disables TRIM support on the SATA SIL controller.
ata7.00: exception Emask 0x0 SAct 0x0 SErr 0x0 action 0x0
ata7.00: BMDMA2 stat 0x50001
ata7.00: failed command: DATA SET MANAGEMENT
ata7.00: cmd 06/01:01:00:00:00/00:00:00:00:00/a0 tag 0 dma 512 out
res 51/04:01:00:00:00/00:00:00:00:00/a0 Emask 0x1 (device error)
ata7.00: status: { DRDY ERR }
ata7.00: error: { ABRT }
ata7.00: device reported invalid CHS sector 0
sd 8:0:0:0: [sdb] tag#0 FAILED Result: hostbyte=DID_OK driverbyte=DRIVER_SENSE
sd 8:0:0:0: [sdb] tag#0 Sense Key : Illegal Request [current] [descriptor]
sd 8:0:0:0: [sdb] tag#0 Add. Sense: Unaligned write command
sd 8:0:0:0: [sdb] tag#0 CDB: Write same(16) 93 08 00 00 00 00 00 21 95 88 00 20 00 00 00 00
blk_update_request: I/O error, dev sdb, sector 2200968
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/ata/sata_sil.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/ata/sata_sil.c b/drivers/ata/sata_sil.c
index 40b76b2d18c6..1fd6873d28c3 100644
--- a/drivers/ata/sata_sil.c
+++ b/drivers/ata/sata_sil.c
@@ -630,6 +630,9 @@ static void sil_dev_config(struct ata_device *dev)
unsigned int n, quirks = 0;
unsigned char model_num[ATA_ID_PROD_LEN + 1];
+ /* This controller doesn't support trim */
+ dev->horkage |= ATA_HORKAGE_NOTRIM;
+
ata_id_c_string(dev->id, model_num, ATA_ID_PROD, sizeof(model_num));
for (n = 0; sil_blacklist[n].product; n++)
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 012/128] usb-storage: Fix scsi-sd failure "Invalid field in cdb" for USB adapter JMicron
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (10 preceding siblings ...)
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 011/128] sata_sil: disable trim Luis Henriques
@ 2016-01-24 21:59 ` Luis Henriques
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 013/128] staging: lustre: echo_copy.._lsm() dereferences userland pointers directly Luis Henriques
` (116 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 21:59 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Dmitry Katsubo, Greg Kroah-Hartman, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Dmitry Katsubo <dmitry.katsubo@gmail.com>
commit 9fa62b1a31c96715aef34f25000e882ed4ac4876 upstream.
The patch extends the family of SATA-to-USB JMicron adapters that need
FUA to be disabled and applies the same policy for uas driver.
See details in http://unix.stackexchange.com/questions/237204/
Signed-off-by: Dmitry Katsubo <dmitry.katsubo@gmail.com>
Tested-by: Dmitry Katsubo <dmitry.katsubo@gmail.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/usb/storage/uas.c | 4 ++++
drivers/usb/storage/unusual_devs.h | 2 +-
drivers/usb/storage/unusual_uas.h | 2 +-
3 files changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c
index 22b3b92ceda2..46aeebde72b9 100644
--- a/drivers/usb/storage/uas.c
+++ b/drivers/usb/storage/uas.c
@@ -973,6 +973,10 @@ static int uas_slave_configure(struct scsi_device *sdev)
if (devinfo->flags & US_FL_NO_REPORT_OPCODES)
sdev->no_report_opcodes = 1;
+ /* A few buggy USB-ATA bridges don't understand FUA */
+ if (devinfo->flags & US_FL_BROKEN_FUA)
+ sdev->broken_fua = 1;
+
scsi_set_tag_type(sdev, MSG_ORDERED_TAG);
scsi_activate_tcq(sdev, devinfo->qdepth - 2);
return 0;
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index 092de140ef1e..8a49c47657f4 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -1968,7 +1968,7 @@ UNUSUAL_DEV( 0x14cd, 0x6600, 0x0201, 0x0201,
US_FL_IGNORE_RESIDUE ),
/* Reported by Michael Büsch <m@bues.ch> */
-UNUSUAL_DEV( 0x152d, 0x0567, 0x0114, 0x0114,
+UNUSUAL_DEV( 0x152d, 0x0567, 0x0114, 0x0116,
"JMicron",
"USB to ATA/ATAPI Bridge",
USB_SC_DEVICE, USB_PR_DEVICE, NULL,
diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
index 30ec9be3b198..ac2f9d491419 100644
--- a/drivers/usb/storage/unusual_uas.h
+++ b/drivers/usb/storage/unusual_uas.h
@@ -122,7 +122,7 @@ UNUSUAL_DEV(0x152d, 0x0567, 0x0000, 0x9999,
"JMicron",
"JMS567",
USB_SC_DEVICE, USB_PR_DEVICE, NULL,
- US_FL_NO_REPORT_OPCODES),
+ US_FL_BROKEN_FUA | US_FL_NO_REPORT_OPCODES),
/* Reported-by: Hans de Goede <hdegoede@redhat.com> */
UNUSUAL_DEV(0x2109, 0x0711, 0x0000, 0x9999,
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 013/128] staging: lustre: echo_copy.._lsm() dereferences userland pointers directly
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (11 preceding siblings ...)
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 012/128] usb-storage: Fix scsi-sd failure "Invalid field in cdb" for USB adapter JMicron Luis Henriques
@ 2016-01-24 21:59 ` Luis Henriques
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 014/128] irqchip/versatile-fpga: Fix PCI IRQ mapping on Versatile PB Luis Henriques
` (115 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 21:59 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Al Viro, Greg Kroah-Hartman, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Al Viro <viro@ZenIV.linux.org.uk>
commit 9225c0b7b976dd9ceac2b80727a60d8fcb906a62 upstream.
missing get_user()
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/staging/lustre/lustre/obdecho/echo_client.c | 20 +++++++++++---------
1 file changed, 11 insertions(+), 9 deletions(-)
diff --git a/drivers/staging/lustre/lustre/obdecho/echo_client.c b/drivers/staging/lustre/lustre/obdecho/echo_client.c
index cdc46719bbd4..95c0bdb45d2a 100644
--- a/drivers/staging/lustre/lustre/obdecho/echo_client.c
+++ b/drivers/staging/lustre/lustre/obdecho/echo_client.c
@@ -1380,6 +1380,7 @@ static int
echo_copyout_lsm (struct lov_stripe_md *lsm, void *_ulsm, int ulsm_nob)
{
struct lov_stripe_md *ulsm = _ulsm;
+ struct lov_oinfo **p;
int nob, i;
nob = offsetof (struct lov_stripe_md, lsm_oinfo[lsm->lsm_stripe_count]);
@@ -1389,9 +1390,10 @@ echo_copyout_lsm (struct lov_stripe_md *lsm, void *_ulsm, int ulsm_nob)
if (copy_to_user (ulsm, lsm, sizeof(*ulsm)))
return (-EFAULT);
- for (i = 0; i < lsm->lsm_stripe_count; i++) {
- if (copy_to_user (ulsm->lsm_oinfo[i], lsm->lsm_oinfo[i],
- sizeof(lsm->lsm_oinfo[0])))
+ for (i = 0, p = lsm->lsm_oinfo; i < lsm->lsm_stripe_count; i++, p++) {
+ struct lov_oinfo __user *up;
+ if (get_user(up, ulsm->lsm_oinfo + i) ||
+ copy_to_user(up, *p, sizeof(struct lov_oinfo)))
return (-EFAULT);
}
return 0;
@@ -1399,9 +1401,10 @@ echo_copyout_lsm (struct lov_stripe_md *lsm, void *_ulsm, int ulsm_nob)
static int
echo_copyin_lsm (struct echo_device *ed, struct lov_stripe_md *lsm,
- void *ulsm, int ulsm_nob)
+ struct lov_stripe_md __user *ulsm, int ulsm_nob)
{
struct echo_client_obd *ec = ed->ed_ec;
+ struct lov_oinfo **p;
int i;
if (ulsm_nob < sizeof (*lsm))
@@ -1417,11 +1420,10 @@ echo_copyin_lsm (struct echo_device *ed, struct lov_stripe_md *lsm,
return (-EINVAL);
- for (i = 0; i < lsm->lsm_stripe_count; i++) {
- if (copy_from_user(lsm->lsm_oinfo[i],
- ((struct lov_stripe_md *)ulsm)-> \
- lsm_oinfo[i],
- sizeof(lsm->lsm_oinfo[0])))
+ for (i = 0, p = lsm->lsm_oinfo; i < lsm->lsm_stripe_count; i++, p++) {
+ struct lov_oinfo __user *up;
+ if (get_user(up, ulsm->lsm_oinfo + i) ||
+ copy_from_user(*p, up, sizeof(struct lov_oinfo)))
return (-EFAULT);
}
return (0);
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 014/128] irqchip/versatile-fpga: Fix PCI IRQ mapping on Versatile PB
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (12 preceding siblings ...)
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 013/128] staging: lustre: echo_copy.._lsm() dereferences userland pointers directly Luis Henriques
@ 2016-01-24 21:59 ` Luis Henriques
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 015/128] usb: core : hub: Fix BOS 'NULL pointer' kernel panic Luis Henriques
` (114 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 21:59 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Guillaume Delbergue, Arnd Bergmann, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Guillaume Delbergue <guillaume.delbergue@greensocs.com>
commit d5d4fdd86f5759924fe54efa793e22eccf508db6 upstream.
This patch is specifically for PCI support on the Versatile PB board using
a DT. Currently, the dynamic IRQ mapping is broken when using DTs. For
example, on QEMU, the SCSI driver is unable to request the IRQ. To fix
this issue, this patch replaces the current dynamic mechanism with a
static value as is done in the non-DT case.
Signed-off-by: Guillaume Delbergue <guillaume.delbergue@greensocs.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/irqchip/irq-versatile-fpga.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/irqchip/irq-versatile-fpga.c b/drivers/irqchip/irq-versatile-fpga.c
index 3ae2bb8d9cf2..21a44b168d46 100644
--- a/drivers/irqchip/irq-versatile-fpga.c
+++ b/drivers/irqchip/irq-versatile-fpga.c
@@ -204,7 +204,12 @@ int __init fpga_irq_of_init(struct device_node *node,
if (!parent_irq)
parent_irq = -1;
+#ifdef CONFIG_ARCH_VERSATILE
+ fpga_irq_init(base, node->name, IRQ_SIC_START, parent_irq, valid_mask,
+ node);
+#else
fpga_irq_init(base, node->name, 0, parent_irq, valid_mask, node);
+#endif
writel(clear_mask, base + IRQ_ENABLE_CLEAR);
writel(clear_mask, base + FIQ_ENABLE_CLEAR);
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 015/128] usb: core : hub: Fix BOS 'NULL pointer' kernel panic
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (13 preceding siblings ...)
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 014/128] irqchip/versatile-fpga: Fix PCI IRQ mapping on Versatile PB Luis Henriques
@ 2016-01-24 21:59 ` Luis Henriques
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 016/128] USB: whci-hcd: add check for dma mapping error Luis Henriques
` (113 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 21:59 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Hans Yang, Greg Kroah-Hartman, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Hans Yang <hansy@nvidia.com>
commit 464ad8c43a9ead98c2b0eaed86bea727f2ad106e upstream.
When a USB 3.0 mass storage device is disconnected in transporting
state, storage device driver may handle it as a transport error and
reset the device by invoking usb_reset_and_verify_device()
and following could happen:
in usb_reset_and_verify_device():
udev->bos = NULL;
For U1/U2 enabled devices, driver will disable LPM, and in some
conditions:
from usb_unlocked_disable_lpm()
--> usb_disable_lpm()
--> usb_enable_lpm()
udev->bos->ss_cap->bU1devExitLat;
And it causes 'NULL pointer' and 'kernel panic':
[ 157.976257] Unable to handle kernel NULL pointer dereference
at virtual address 00000010
...
[ 158.026400] PC is at usb_enable_link_state+0x34/0x2e0
[ 158.031442] LR is at usb_enable_lpm+0x98/0xac
...
[ 158.137368] [<ffffffc0006a1cac>] usb_enable_link_state+0x34/0x2e0
[ 158.143451] [<ffffffc0006a1fec>] usb_enable_lpm+0x94/0xac
[ 158.148840] [<ffffffc0006a20e8>] usb_disable_lpm+0xa8/0xb4
...
[ 158.214954] Kernel panic - not syncing: Fatal exception
This commit moves 'udev->bos = NULL' behind usb_unlocked_disable_lpm()
to prevent from NULL pointer access.
Issue can be reproduced by following setup:
1) A SS pen drive behind a SS hub connected to the host.
2) Transporting data between the pen drive and the host.
3) Abruptly disconnect hub and pen drive from host.
4) With a chance it crashes.
Signed-off-by: Hans Yang <hansy@nvidia.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/usb/core/hub.c | 15 ++++++++-------
1 file changed, 8 insertions(+), 7 deletions(-)
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 962fdf5c621b..882acb2a0b48 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -5347,9 +5347,6 @@ static int usb_reset_and_verify_device(struct usb_device *udev)
if (udev->usb2_hw_lpm_enabled == 1)
usb_set_usb2_hardware_lpm(udev, 0);
- bos = udev->bos;
- udev->bos = NULL;
-
/* Disable LPM and LTM while we reset the device and reinstall the alt
* settings. Device-initiated LPM settings, and system exit latency
* settings are cleared when the device is reset, so we have to set
@@ -5358,15 +5355,18 @@ static int usb_reset_and_verify_device(struct usb_device *udev)
ret = usb_unlocked_disable_lpm(udev);
if (ret) {
dev_err(&udev->dev, "%s Failed to disable LPM\n.", __func__);
- goto re_enumerate;
+ goto re_enumerate_no_bos;
}
ret = usb_disable_ltm(udev);
if (ret) {
dev_err(&udev->dev, "%s Failed to disable LTM\n.",
__func__);
- goto re_enumerate;
+ goto re_enumerate_no_bos;
}
+ bos = udev->bos;
+ udev->bos = NULL;
+
for (i = 0; i < SET_CONFIG_TRIES; ++i) {
/* ep0 maxpacket size may change; let the HCD know about it.
@@ -5463,10 +5463,11 @@ done:
return 0;
re_enumerate:
- /* LPM state doesn't matter when we're about to destroy the device. */
- hub_port_logical_disconnect(parent_hub, port1);
usb_release_bos_descriptor(udev);
udev->bos = bos;
+re_enumerate_no_bos:
+ /* LPM state doesn't matter when we're about to destroy the device. */
+ hub_port_logical_disconnect(parent_hub, port1);
return -ENODEV;
}
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 016/128] USB: whci-hcd: add check for dma mapping error
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (14 preceding siblings ...)
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 015/128] usb: core : hub: Fix BOS 'NULL pointer' kernel panic Luis Henriques
@ 2016-01-24 21:59 ` Luis Henriques
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 017/128] usb: Use the USB_SS_MULT() macro to decode burst multiplier for log message Luis Henriques
` (112 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 21:59 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Alexey Khoroshilov, Greg Kroah-Hartman, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Alexey Khoroshilov <khoroshilov@ispras.ru>
commit f9fa1887dcf26bd346665a6ae3d3f53dec54cba1 upstream.
qset_fill_page_list() do not check for dma mapping errors.
Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/usb/host/whci/qset.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/usb/host/whci/qset.c b/drivers/usb/host/whci/qset.c
index dc31c425ce01..9f1c0538b211 100644
--- a/drivers/usb/host/whci/qset.c
+++ b/drivers/usb/host/whci/qset.c
@@ -377,6 +377,10 @@ static int qset_fill_page_list(struct whc *whc, struct whc_std *std, gfp_t mem_f
if (std->pl_virt == NULL)
return -ENOMEM;
std->dma_addr = dma_map_single(whc->wusbhc.dev, std->pl_virt, pl_len, DMA_TO_DEVICE);
+ if (dma_mapping_error(whc->wusbhc.dev, std->dma_addr)) {
+ kfree(std->pl_virt);
+ return -EFAULT;
+ }
for (p = 0; p < std->num_pointers; p++) {
std->pl_virt[p].buf_ptr = cpu_to_le64(dma_addr);
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 017/128] usb: Use the USB_SS_MULT() macro to decode burst multiplier for log message
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (15 preceding siblings ...)
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 016/128] USB: whci-hcd: add check for dma mapping error Luis Henriques
@ 2016-01-24 21:59 ` Luis Henriques
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 018/128] dm btree: fix leak of bufio-backed block in btree_split_sibling error path Luis Henriques
` (111 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 21:59 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Ben Hutchings, Greg Kroah-Hartman, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Ben Hutchings <ben@decadent.org.uk>
commit 5377adb092664d336ac212499961cac5e8728794 upstream.
usb_parse_ss_endpoint_companion() now decodes the burst multiplier
correctly in order to check that it's <= 3, but still uses the wrong
expression if warning that it's > 3.
Fixes: ff30cbc8da42 ("usb: Use the USB_SS_MULT() macro to get the ...")
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/usb/core/config.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
index b9ddf0c1ffe5..894894f2ff93 100644
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -115,7 +115,8 @@ static void usb_parse_ss_endpoint_companion(struct device *ddev, int cfgno,
USB_SS_MULT(desc->bmAttributes) > 3) {
dev_warn(ddev, "Isoc endpoint has Mult of %d in "
"config %d interface %d altsetting %d ep %d: "
- "setting to 3\n", desc->bmAttributes + 1,
+ "setting to 3\n",
+ USB_SS_MULT(desc->bmAttributes),
cfgno, inum, asnum, ep->desc.bEndpointAddress);
ep->ss_ep_comp.bmAttributes = 2;
}
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 018/128] dm btree: fix leak of bufio-backed block in btree_split_sibling error path
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (16 preceding siblings ...)
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 017/128] usb: Use the USB_SS_MULT() macro to decode burst multiplier for log message Luis Henriques
@ 2016-01-24 21:59 ` Luis Henriques
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 019/128] SCSI: Fix NULL pointer dereference in runtime PM Luis Henriques
` (110 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 21:59 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Mike Snitzer, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Mike Snitzer <snitzer@redhat.com>
commit 30ce6e1cc5a0f781d60227e9096c86e188d2c2bd upstream.
The block allocated at the start of btree_split_sibling() is never
released if later insert_at() fails.
Fix this by releasing the previously allocated bufio block using
unlock_block().
Reported-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/md/persistent-data/dm-btree.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/md/persistent-data/dm-btree.c b/drivers/md/persistent-data/dm-btree.c
index d6e47033b5e0..7ba85e2b146b 100644
--- a/drivers/md/persistent-data/dm-btree.c
+++ b/drivers/md/persistent-data/dm-btree.c
@@ -471,8 +471,10 @@ static int btree_split_sibling(struct shadow_spine *s, dm_block_t root,
r = insert_at(sizeof(__le64), pn, parent_index + 1,
le64_to_cpu(rn->keys[0]), &location);
- if (r)
+ if (r) {
+ unlock_block(s->info, right);
return r;
+ }
if (key < le64_to_cpu(rn->keys[0])) {
unlock_block(s->info, right);
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 019/128] SCSI: Fix NULL pointer dereference in runtime PM
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (17 preceding siblings ...)
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 018/128] dm btree: fix leak of bufio-backed block in btree_split_sibling error path Luis Henriques
@ 2016-01-24 21:59 ` Luis Henriques
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 020/128] perf: Fix PERF_EVENT_IOC_PERIOD deadlock Luis Henriques
` (109 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 21:59 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Ken Xue, Xiangliang Yu, James E . J . Bottomley, Jens Axboe,
Michael Terry, Jens Axboe, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Ken Xue <ken.xue@amd.com>
commit 4fd41a8552afc01054d9d9fc7f1a63c324867d27 upstream.
The routines in scsi_pm.c assume that if a runtime-PM callback is
invoked for a SCSI device, it can only mean that the device's driver
has asked the block layer to handle the runtime power management (by
calling blk_pm_runtime_init(), which among other things sets q->dev).
However, this assumption turns out to be wrong for things like the ses
driver. Normally ses devices are not allowed to do runtime PM, but
userspace can override this setting. If this happens, the kernel gets
a NULL pointer dereference when blk_post_runtime_resume() tries to use
the uninitialized q->dev pointer.
This patch fixes the problem by checking q->dev in block layer before
handle runtime PM. Since ses doesn't define any PM callbacks and call
blk_pm_runtime_init(), the crash won't occur.
This fixes Bugzilla #101371.
https://bugzilla.kernel.org/show_bug.cgi?id=101371
More discussion can be found from below link.
http://marc.info/?l=linux-scsi&m=144163730531875&w=2
Signed-off-by: Ken Xue <Ken.Xue@amd.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Cc: Xiangliang Yu <Xiangliang.Yu@amd.com>
Cc: James E.J. Bottomley <JBottomley@odin.com>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: Michael Terry <Michael.terry@canonical.com>
Signed-off-by: Jens Axboe <axboe@fb.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
block/blk-core.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/block/blk-core.c b/block/blk-core.c
index 72a4cdaa083c..0b4831a556fc 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -3214,6 +3214,9 @@ int blk_pre_runtime_suspend(struct request_queue *q)
{
int ret = 0;
+ if (!q->dev)
+ return ret;
+
spin_lock_irq(q->queue_lock);
if (q->nr_pending) {
ret = -EBUSY;
@@ -3241,6 +3244,9 @@ EXPORT_SYMBOL(blk_pre_runtime_suspend);
*/
void blk_post_runtime_suspend(struct request_queue *q, int err)
{
+ if (!q->dev)
+ return;
+
spin_lock_irq(q->queue_lock);
if (!err) {
q->rpm_status = RPM_SUSPENDED;
@@ -3265,6 +3271,9 @@ EXPORT_SYMBOL(blk_post_runtime_suspend);
*/
void blk_pre_runtime_resume(struct request_queue *q)
{
+ if (!q->dev)
+ return;
+
spin_lock_irq(q->queue_lock);
q->rpm_status = RPM_RESUMING;
spin_unlock_irq(q->queue_lock);
@@ -3287,6 +3296,9 @@ EXPORT_SYMBOL(blk_pre_runtime_resume);
*/
void blk_post_runtime_resume(struct request_queue *q, int err)
{
+ if (!q->dev)
+ return;
+
spin_lock_irq(q->queue_lock);
if (!err) {
q->rpm_status = RPM_ACTIVE;
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 020/128] perf: Fix PERF_EVENT_IOC_PERIOD deadlock
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (18 preceding siblings ...)
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 019/128] SCSI: Fix NULL pointer dereference in runtime PM Luis Henriques
@ 2016-01-24 21:59 ` Luis Henriques
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 021/128] usb: xhci: fix config fail of FS hub behind a HS hub with MTT Luis Henriques
` (108 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 21:59 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Peter Zijlstra, Alexander Potapenko, Arnaldo Carvalho de Melo,
Arnaldo Carvalho de Melo, Eric Dumazet, Jiri Olsa,
Kostya Serebryany, Linus Torvalds, Sasha Levin, Stephane Eranian,
Thomas Gleixner, Vince Weaver, Ingo Molnar, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Peter Zijlstra <peterz@infradead.org>
commit 642c2d671ceff40e9453203ea0c66e991e11e249 upstream.
Dmitry reported a fairly silly recursive lock deadlock for
PERF_EVENT_IOC_PERIOD, fix this by explicitly doing the inactive part of
__perf_event_period() instead of calling that function.
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Alexander Potapenko <glider@google.com>
Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Kostya Serebryany <kcc@google.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Sasha Levin <sasha.levin@oracle.com>
Cc: Stephane Eranian <eranian@google.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Vince Weaver <vincent.weaver@maine.edu>
Fixes: c7999c6f3fed ("perf: Fix PERF_EVENT_IOC_PERIOD migration race")
Link: http://lkml.kernel.org/r/20151130115615.GJ17308@twins.programming.kicks-ass.net
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
kernel/events/core.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 259b9fdb6ba4..db2f2cfb58e3 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -3692,7 +3692,14 @@ retry:
goto retry;
}
- __perf_event_period(&pe);
+ if (event->attr.freq) {
+ event->attr.sample_freq = value;
+ } else {
+ event->attr.sample_period = value;
+ event->hw.sample_period = value;
+ }
+
+ local64_set(&event->hw.period_left, 0);
raw_spin_unlock_irq(&ctx->lock);
return 0;
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 021/128] usb: xhci: fix config fail of FS hub behind a HS hub with MTT
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (19 preceding siblings ...)
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 020/128] perf: Fix PERF_EVENT_IOC_PERIOD deadlock Luis Henriques
@ 2016-01-24 21:59 ` Luis Henriques
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 022/128] ALSA: rme96: Fix unexpected volume reset after rate changes Luis Henriques
` (107 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 21:59 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Chunfeng Yun, Mathias Nyman, Greg Kroah-Hartman, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Chunfeng Yun <chunfeng.yun@mediatek.com>
commit 096b110a3dd3c868e4610937c80d2e3f3357c1a9 upstream.
if a full speed hub connects to a high speed hub which
supports MTT, the MTT field of its slot context will be set
to 1 when xHCI driver setups an xHCI virtual device in
xhci_setup_addressable_virt_dev(); once usb core fetch its
hub descriptor, and need to update the xHC's internal data
structures for the device, the HUB field of its slot context
will be set to 1 too, meanwhile MTT is also set before,
this will cause configure endpoint command fail, so in the
case, we should clear MTT to 0 for full speed hub according
to section 6.2.2
Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/usb/host/xhci.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index ddece5ecd6fb..20209e870a99 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -4758,8 +4758,16 @@ int xhci_update_hub_device(struct usb_hcd *hcd, struct usb_device *hdev,
ctrl_ctx->add_flags |= cpu_to_le32(SLOT_FLAG);
slot_ctx = xhci_get_slot_ctx(xhci, config_cmd->in_ctx);
slot_ctx->dev_info |= cpu_to_le32(DEV_HUB);
+ /*
+ * refer to section 6.2.2: MTT should be 0 for full speed hub,
+ * but it may be already set to 1 when setup an xHCI virtual
+ * device, so clear it anyway.
+ */
if (tt->multi)
slot_ctx->dev_info |= cpu_to_le32(DEV_MTT);
+ else if (hdev->speed == USB_SPEED_FULL)
+ slot_ctx->dev_info &= cpu_to_le32(~DEV_MTT);
+
if (xhci->hci_version > 0x95) {
xhci_dbg(xhci, "xHCI version %x needs hub "
"TT think time and number of ports\n",
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 022/128] ALSA: rme96: Fix unexpected volume reset after rate changes
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (20 preceding siblings ...)
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 021/128] usb: xhci: fix config fail of FS hub behind a HS hub with MTT Luis Henriques
@ 2016-01-24 21:59 ` Luis Henriques
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 023/128] ALSA: hda - Add inverted dmic for Packard Bell DOTS Luis Henriques
` (106 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 21:59 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Takashi Iwai, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Takashi Iwai <tiwai@suse.de>
commit a74a821624c0c75388a193337babd17a8c02c740 upstream.
rme96 driver needs to reset DAC depending on the sample rate, and this
results in resetting to the max volume suddenly. It's because of the
missing call of snd_rme96_apply_dac_volume().
However, calling this function right after the DAC reset still may not
work, and we need some delay before this call. Since the DAC reset
and the procedure after that are performed in the spinlock, we delay
the DAC volume restore at the end after the spinlock.
Reported-and-tested-by: Sylvain LABOISNE <maeda1@free.fr>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
sound/pci/rme96.c | 41 ++++++++++++++++++++++++++---------------
1 file changed, 26 insertions(+), 15 deletions(-)
diff --git a/sound/pci/rme96.c b/sound/pci/rme96.c
index 76169929770d..bde4c7330f30 100644
--- a/sound/pci/rme96.c
+++ b/sound/pci/rme96.c
@@ -742,10 +742,11 @@ snd_rme96_playback_setrate(struct rme96 *rme96,
{
/* change to/from double-speed: reset the DAC (if available) */
snd_rme96_reset_dac(rme96);
+ return 1; /* need to restore volume */
} else {
writel(rme96->wcreg, rme96->iobase + RME96_IO_CONTROL_REGISTER);
+ return 0;
}
- return 0;
}
static int
@@ -983,6 +984,7 @@ snd_rme96_playback_hw_params(struct snd_pcm_substream *substream,
struct rme96 *rme96 = snd_pcm_substream_chip(substream);
struct snd_pcm_runtime *runtime = substream->runtime;
int err, rate, dummy;
+ bool apply_dac_volume = false;
runtime->dma_area = (void __force *)(rme96->iobase +
RME96_IO_PLAY_BUFFER);
@@ -996,24 +998,26 @@ snd_rme96_playback_hw_params(struct snd_pcm_substream *substream,
{
/* slave clock */
if ((int)params_rate(params) != rate) {
- spin_unlock_irq(&rme96->lock);
- return -EIO;
- }
- } else if ((err = snd_rme96_playback_setrate(rme96, params_rate(params))) < 0) {
- spin_unlock_irq(&rme96->lock);
- return err;
- }
- if ((err = snd_rme96_playback_setformat(rme96, params_format(params))) < 0) {
- spin_unlock_irq(&rme96->lock);
- return err;
+ err = -EIO;
+ goto error;
+ }
+ } else {
+ err = snd_rme96_playback_setrate(rme96, params_rate(params));
+ if (err < 0)
+ goto error;
+ apply_dac_volume = err > 0; /* need to restore volume later? */
}
+
+ err = snd_rme96_playback_setformat(rme96, params_format(params));
+ if (err < 0)
+ goto error;
snd_rme96_setframelog(rme96, params_channels(params), 1);
if (rme96->capture_periodsize != 0) {
if (params_period_size(params) << rme96->playback_frlog !=
rme96->capture_periodsize)
{
- spin_unlock_irq(&rme96->lock);
- return -EBUSY;
+ err = -EBUSY;
+ goto error;
}
}
rme96->playback_periodsize =
@@ -1024,9 +1028,16 @@ snd_rme96_playback_hw_params(struct snd_pcm_substream *substream,
rme96->wcreg &= ~(RME96_WCR_PRO | RME96_WCR_DOLBY | RME96_WCR_EMP);
writel(rme96->wcreg |= rme96->wcreg_spdif_stream, rme96->iobase + RME96_IO_CONTROL_REGISTER);
}
+
+ err = 0;
+ error:
spin_unlock_irq(&rme96->lock);
-
- return 0;
+ if (apply_dac_volume) {
+ usleep_range(3000, 10000);
+ snd_rme96_apply_dac_volume(rme96);
+ }
+
+ return err;
}
static int
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 023/128] ALSA: hda - Add inverted dmic for Packard Bell DOTS
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (21 preceding siblings ...)
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 022/128] ALSA: rme96: Fix unexpected volume reset after rate changes Luis Henriques
@ 2016-01-24 21:59 ` Luis Henriques
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 024/128] virtio: fix memory leak of virtio ida cache layers Luis Henriques
` (105 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 21:59 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: David Henningsson, Takashi Iwai, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: David Henningsson <david.henningsson@canonical.com>
commit 02f6ff90400d055f08b0ba0b5f0707630b6faed7 upstream.
On the internal mic of the Packard Bell DOTS, one channel
has an inverted signal. Add a quirk to fix this up.
BugLink: https://bugs.launchpad.net/bugs/1523232
Signed-off-by: David Henningsson <david.henningsson@canonical.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
sound/pci/hda/patch_realtek.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index a9bbfefb9d4a..e17824fff61d 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -6002,6 +6002,7 @@ static const struct hda_fixup alc662_fixups[] = {
static const struct snd_pci_quirk alc662_fixup_tbl[] = {
SND_PCI_QUIRK(0x1019, 0x9087, "ECS", ALC662_FIXUP_ASUS_MODE2),
SND_PCI_QUIRK(0x1025, 0x022f, "Acer Aspire One", ALC662_FIXUP_INV_DMIC),
+ SND_PCI_QUIRK(0x1025, 0x0241, "Packard Bell DOTS", ALC662_FIXUP_INV_DMIC),
SND_PCI_QUIRK(0x1025, 0x0308, "Acer Aspire 8942G", ALC662_FIXUP_ASPIRE),
SND_PCI_QUIRK(0x1025, 0x031c, "Gateway NV79", ALC662_FIXUP_SKU_IGNORE),
SND_PCI_QUIRK(0x1025, 0x0349, "eMachines eM250", ALC662_FIXUP_INV_DMIC),
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 024/128] virtio: fix memory leak of virtio ida cache layers
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (22 preceding siblings ...)
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 023/128] ALSA: hda - Add inverted dmic for Packard Bell DOTS Luis Henriques
@ 2016-01-24 21:59 ` Luis Henriques
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 025/128] nfs4: limit callback decoding to received bytes Luis Henriques
` (104 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 21:59 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Suman Anna, Michael S . Tsirkin, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Suman Anna <s-anna@ti.com>
commit c13f99b7e945dad5273a8b7ee230f4d1f22d3354 upstream.
The virtio core uses a static ida named virtio_index_ida for
assigning index numbers to virtio devices during registration.
The ida core may allocate some internal idr cache layers and
an ida bitmap upon any ida allocation, and all these layers are
truely freed only upon the ida destruction. The virtio_index_ida
is not destroyed at present, leading to a memory leak when using
the virtio core as a module and atleast one virtio device is
registered and unregistered.
Fix this by invoking ida_destroy() in the virtio core module
exit.
Signed-off-by: Suman Anna <s-anna@ti.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/virtio/virtio.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/virtio/virtio.c b/drivers/virtio/virtio.c
index fed0ce198ae3..64eba4f51f71 100644
--- a/drivers/virtio/virtio.c
+++ b/drivers/virtio/virtio.c
@@ -249,6 +249,7 @@ static int virtio_init(void)
static void __exit virtio_exit(void)
{
bus_unregister(&virtio_bus);
+ ida_destroy(&virtio_index_ida);
}
core_initcall(virtio_init);
module_exit(virtio_exit);
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 025/128] nfs4: limit callback decoding to received bytes
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (23 preceding siblings ...)
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 024/128] virtio: fix memory leak of virtio ida cache layers Luis Henriques
@ 2016-01-24 21:59 ` Luis Henriques
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 026/128] SUNRPC: Fix callback channel Luis Henriques
` (103 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 21:59 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Benjamin Coddington, Trond Myklebust, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Benjamin Coddington <bcodding@redhat.com>
commit 38b7631fbe42e6e247e9fc9879f961b14a687e3b upstream.
A truncated cb_compound request will cause the client to decode null or
data from a previous callback for nfs4.1 backchannel case, or uninitialized
data for the nfs4.0 case. This is because the path through
svc_process_common() advances the request's iov_base and decrements iov_len
without adjusting the overall xdr_buf's len field. That causes
xdr_init_decode() to set up the xdr_stream with an incorrect length in
nfs4_callback_compound().
Fixing this for the nfs4.1 backchannel case first requires setting the
correct iov_len and page_len based on the length of received data in the
same manner as the nfs4.0 case.
Then the request's xdr_buf length can be adjusted for both cases based upon
the remaining iov_len and page_len.
Signed-off-by: Benjamin Coddington <bcodding@redhat.com>
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
fs/nfs/callback_xdr.c | 7 +++++--
net/sunrpc/backchannel_rqst.c | 8 ++++++++
net/sunrpc/svc.c | 1 +
3 files changed, 14 insertions(+), 2 deletions(-)
diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c
index 02f8d09e119f..1e366354a193 100644
--- a/fs/nfs/callback_xdr.c
+++ b/fs/nfs/callback_xdr.c
@@ -76,7 +76,8 @@ static __be32 *read_buf(struct xdr_stream *xdr, int nbytes)
p = xdr_inline_decode(xdr, nbytes);
if (unlikely(p == NULL))
- printk(KERN_WARNING "NFS: NFSv4 callback reply buffer overflowed!\n");
+ printk(KERN_WARNING "NFS: NFSv4 callback reply buffer overflowed "
+ "or truncated request.\n");
return p;
}
@@ -892,6 +893,7 @@ static __be32 nfs4_callback_compound(struct svc_rqst *rqstp, void *argp, void *r
struct cb_compound_hdr_arg hdr_arg = { 0 };
struct cb_compound_hdr_res hdr_res = { NULL };
struct xdr_stream xdr_in, xdr_out;
+ struct xdr_buf *rq_arg = &rqstp->rq_arg;
__be32 *p, status;
struct cb_process_state cps = {
.drc_status = 0,
@@ -903,7 +905,8 @@ static __be32 nfs4_callback_compound(struct svc_rqst *rqstp, void *argp, void *r
dprintk("%s: start\n", __func__);
- xdr_init_decode(&xdr_in, &rqstp->rq_arg, rqstp->rq_arg.head[0].iov_base);
+ rq_arg->len = rq_arg->head[0].iov_len + rq_arg->page_len;
+ xdr_init_decode(&xdr_in, rq_arg, rq_arg->head[0].iov_base);
p = (__be32*)((char *)rqstp->rq_res.head[0].iov_base + rqstp->rq_res.head[0].iov_len);
xdr_init_encode(&xdr_out, &rqstp->rq_res, p);
diff --git a/net/sunrpc/backchannel_rqst.c b/net/sunrpc/backchannel_rqst.c
index ca9ff71134f9..d7b049be631e 100644
--- a/net/sunrpc/backchannel_rqst.c
+++ b/net/sunrpc/backchannel_rqst.c
@@ -308,11 +308,19 @@ void xprt_complete_bc_request(struct rpc_rqst *req, uint32_t copied)
{
struct rpc_xprt *xprt = req->rq_xprt;
struct svc_serv *bc_serv = xprt->bc_serv;
+ struct xdr_buf *rq_rcv_buf = &req->rq_rcv_buf;
spin_lock(&xprt->bc_pa_lock);
list_del(&req->rq_bc_pa_list);
spin_unlock(&xprt->bc_pa_lock);
+ if (copied <= rq_rcv_buf->head[0].iov_len) {
+ rq_rcv_buf->head[0].iov_len = copied;
+ rq_rcv_buf->page_len = 0;
+ } else {
+ rq_rcv_buf->page_len = copied - rq_rcv_buf->head[0].iov_len;
+ }
+
req->rq_private_buf.len = copied;
set_bit(RPC_BC_PA_IN_USE, &req->rq_bc_pa_state);
diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
index 5de6801cd924..5597f6b85ea5 100644
--- a/net/sunrpc/svc.c
+++ b/net/sunrpc/svc.c
@@ -1358,6 +1358,7 @@ bc_svc_process(struct svc_serv *serv, struct rpc_rqst *req,
memcpy(&rqstp->rq_addr, &req->rq_xprt->addr, rqstp->rq_addrlen);
memcpy(&rqstp->rq_arg, &req->rq_rcv_buf, sizeof(rqstp->rq_arg));
memcpy(&rqstp->rq_res, &req->rq_snd_buf, sizeof(rqstp->rq_res));
+ rqstp->rq_arg.len = req->rq_private_buf.len;
/* reset result send buffer "put" position */
resv->iov_len = 0;
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 026/128] SUNRPC: Fix callback channel
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (24 preceding siblings ...)
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 025/128] nfs4: limit callback decoding to received bytes Luis Henriques
@ 2016-01-24 21:59 ` Luis Henriques
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 027/128] IB/srp: Fix possible send queue overflow Luis Henriques
` (102 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 21:59 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Benjamin Coddington, Trond Myklebust, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Trond Myklebust <trond.myklebust@primarydata.com>
commit 756b9b37cfb2e3dc76b2e43a8c097402ac736e07 upstream.
The NFSv4.1 callback channel is currently broken because the receive
message will keep shrinking because the backchannel receive buffer size
never gets reset.
The easiest solution to this problem is instead of changing the receive
buffer, to rather adjust the copied request.
Fixes: 38b7631fbe42 ("nfs4: limit callback decoding to received bytes")
Cc: Benjamin Coddington <bcodding@redhat.com>
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
fs/nfs/callback_xdr.c | 7 ++-----
net/sunrpc/backchannel_rqst.c | 8 --------
net/sunrpc/svc.c | 12 ++++++++++++
3 files changed, 14 insertions(+), 13 deletions(-)
diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c
index 1e366354a193..02f8d09e119f 100644
--- a/fs/nfs/callback_xdr.c
+++ b/fs/nfs/callback_xdr.c
@@ -76,8 +76,7 @@ static __be32 *read_buf(struct xdr_stream *xdr, int nbytes)
p = xdr_inline_decode(xdr, nbytes);
if (unlikely(p == NULL))
- printk(KERN_WARNING "NFS: NFSv4 callback reply buffer overflowed "
- "or truncated request.\n");
+ printk(KERN_WARNING "NFS: NFSv4 callback reply buffer overflowed!\n");
return p;
}
@@ -893,7 +892,6 @@ static __be32 nfs4_callback_compound(struct svc_rqst *rqstp, void *argp, void *r
struct cb_compound_hdr_arg hdr_arg = { 0 };
struct cb_compound_hdr_res hdr_res = { NULL };
struct xdr_stream xdr_in, xdr_out;
- struct xdr_buf *rq_arg = &rqstp->rq_arg;
__be32 *p, status;
struct cb_process_state cps = {
.drc_status = 0,
@@ -905,8 +903,7 @@ static __be32 nfs4_callback_compound(struct svc_rqst *rqstp, void *argp, void *r
dprintk("%s: start\n", __func__);
- rq_arg->len = rq_arg->head[0].iov_len + rq_arg->page_len;
- xdr_init_decode(&xdr_in, rq_arg, rq_arg->head[0].iov_base);
+ xdr_init_decode(&xdr_in, &rqstp->rq_arg, rqstp->rq_arg.head[0].iov_base);
p = (__be32*)((char *)rqstp->rq_res.head[0].iov_base + rqstp->rq_res.head[0].iov_len);
xdr_init_encode(&xdr_out, &rqstp->rq_res, p);
diff --git a/net/sunrpc/backchannel_rqst.c b/net/sunrpc/backchannel_rqst.c
index d7b049be631e..ca9ff71134f9 100644
--- a/net/sunrpc/backchannel_rqst.c
+++ b/net/sunrpc/backchannel_rqst.c
@@ -308,19 +308,11 @@ void xprt_complete_bc_request(struct rpc_rqst *req, uint32_t copied)
{
struct rpc_xprt *xprt = req->rq_xprt;
struct svc_serv *bc_serv = xprt->bc_serv;
- struct xdr_buf *rq_rcv_buf = &req->rq_rcv_buf;
spin_lock(&xprt->bc_pa_lock);
list_del(&req->rq_bc_pa_list);
spin_unlock(&xprt->bc_pa_lock);
- if (copied <= rq_rcv_buf->head[0].iov_len) {
- rq_rcv_buf->head[0].iov_len = copied;
- rq_rcv_buf->page_len = 0;
- } else {
- rq_rcv_buf->page_len = copied - rq_rcv_buf->head[0].iov_len;
- }
-
req->rq_private_buf.len = copied;
set_bit(RPC_BC_PA_IN_USE, &req->rq_bc_pa_state);
diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
index 5597f6b85ea5..78c809c1f819 100644
--- a/net/sunrpc/svc.c
+++ b/net/sunrpc/svc.c
@@ -1358,7 +1358,19 @@ bc_svc_process(struct svc_serv *serv, struct rpc_rqst *req,
memcpy(&rqstp->rq_addr, &req->rq_xprt->addr, rqstp->rq_addrlen);
memcpy(&rqstp->rq_arg, &req->rq_rcv_buf, sizeof(rqstp->rq_arg));
memcpy(&rqstp->rq_res, &req->rq_snd_buf, sizeof(rqstp->rq_res));
+
+ /* Adjust the argument buffer length */
rqstp->rq_arg.len = req->rq_private_buf.len;
+ if (rqstp->rq_arg.len <= rqstp->rq_arg.head[0].iov_len) {
+ rqstp->rq_arg.head[0].iov_len = rqstp->rq_arg.len;
+ rqstp->rq_arg.page_len = 0;
+ } else if (rqstp->rq_arg.len <= rqstp->rq_arg.head[0].iov_len +
+ rqstp->rq_arg.page_len)
+ rqstp->rq_arg.page_len = rqstp->rq_arg.len -
+ rqstp->rq_arg.head[0].iov_len;
+ else
+ rqstp->rq_arg.len = rqstp->rq_arg.head[0].iov_len +
+ rqstp->rq_arg.page_len;
/* reset result send buffer "put" position */
resv->iov_len = 0;
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 027/128] IB/srp: Fix possible send queue overflow
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (25 preceding siblings ...)
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 026/128] SUNRPC: Fix callback channel Luis Henriques
@ 2016-01-24 21:59 ` Luis Henriques
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 028/128] ALSA: hda - Fixing speaker noise on the two latest thinkpad models Luis Henriques
` (101 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 21:59 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Sagi Grimberg, Doug Ledford, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Sagi Grimberg <sagig@mellanox.com>
commit 09c0c0bea500a9ad362589990ee316c9b2482f44 upstream.
When using work request based memory registration (fast_reg)
we must reserve SQ entries for registration and invalidation
in addition to send operations. Each IO consumes 3 SQ entries
(registration, send, invalidation) so we need to allocate 3x
larger send-queue instead of 2x.
Signed-off-by: Sagi Grimberg <sagig@mellanox.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Doug Ledford <dledford@redhat.com>
[ luis: backported to 3.16:
- change function srp_create_target_ib() instead of srp_create_ch_ib()
- adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/infiniband/ulp/srp/ib_srp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
index 767000811cf9..36876960f97e 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -451,7 +451,7 @@ static int srp_create_target_ib(struct srp_target_port *target)
struct ib_qp *qp;
struct ib_fmr_pool *fmr_pool = NULL;
struct srp_fr_pool *fr_pool = NULL;
- const int m = 1 + dev->use_fast_reg;
+ const int m = dev->use_fast_reg ? 3 : 1;
int ret;
init_attr = kzalloc(sizeof *init_attr, GFP_KERNEL);
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 028/128] ALSA: hda - Fixing speaker noise on the two latest thinkpad models
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (26 preceding siblings ...)
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 027/128] IB/srp: Fix possible send queue overflow Luis Henriques
@ 2016-01-24 21:59 ` Luis Henriques
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 029/128] 9p: ->evict_inode() should kick out ->i_data, not ->i_mapping Luis Henriques
` (100 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 21:59 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Hui Wang, Takashi Iwai, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Hui Wang <hui.wang@canonical.com>
commit 23adc192b862b69ad80a40bd5206e337f41264ac upstream.
We have two latest thinkpad laptop models which are all based on the
Intel skylake platforms, and all of them have the codec alc293 on
them. When the machines boot to the desktop, an greeting dialogue
shows up with the notification sound. But on these two models, there
is noise with the notification sound. We have 3 SKUs for each of
the models, all of them have this problem.
So far, this problem is only specific to these two thinkpad models,
we did not find this problem on the old thinkpad models with the
codec alc293 or alc292.
A workaround for this problem is disabling the aamix.
BugLink: https://bugs.launchpad.net/bugs/1523517
Signed-off-by: Hui Wang <hui.wang@canonical.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
sound/pci/hda/patch_realtek.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index e17824fff61d..e3a98869b1b6 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -4327,6 +4327,7 @@ enum {
ALC292_FIXUP_TPT440_DOCK2,
ALC275_FIXUP_DELL_XPS,
ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE,
+ ALC293_FIXUP_LENOVO_SPK_NOISE,
};
static const struct hda_fixup alc269_fixups[] = {
@@ -4801,6 +4802,12 @@ static const struct hda_fixup alc269_fixups[] = {
.chained = true,
.chain_id = ALC255_FIXUP_DELL1_MIC_NO_PRESENCE
},
+ [ALC293_FIXUP_LENOVO_SPK_NOISE] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc_fixup_disable_aamix,
+ .chained = true,
+ .chain_id = ALC269_FIXUP_THINKPAD_ACPI
+ },
};
static const struct snd_pci_quirk alc269_fixup_tbl[] = {
@@ -4962,6 +4969,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
SND_PCI_QUIRK(0x17aa, 0x2215, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
SND_PCI_QUIRK(0x17aa, 0x2223, "ThinkPad T550", ALC292_FIXUP_TPT440_DOCK),
SND_PCI_QUIRK(0x17aa, 0x2226, "ThinkPad X250", ALC292_FIXUP_TPT440_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x2233, "Thinkpad", ALC293_FIXUP_LENOVO_SPK_NOISE),
SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC),
SND_PCI_QUIRK(0x17aa, 0x3978, "IdeaPad Y410P", ALC269_FIXUP_NO_SHUTUP),
SND_PCI_QUIRK(0x17aa, 0x5013, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
@@ -4970,6 +4978,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
SND_PCI_QUIRK(0x17aa, 0x5034, "Thinkpad T450", ALC292_FIXUP_TPT440_DOCK),
SND_PCI_QUIRK(0x17aa, 0x5036, "Thinkpad T450s", ALC292_FIXUP_TPT440_DOCK),
SND_PCI_QUIRK(0x17aa, 0x503c, "Thinkpad L450", ALC292_FIXUP_TPT440_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x504b, "Thinkpad", ALC293_FIXUP_LENOVO_SPK_NOISE),
SND_PCI_QUIRK(0x17aa, 0x5109, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
SND_PCI_QUIRK(0x17aa, 0x3bf8, "Quanta FL1", ALC269_FIXUP_PCM_44K),
SND_PCI_QUIRK(0x17aa, 0x9e54, "LENOVO NB", ALC269_FIXUP_LENOVO_EAPD),
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 029/128] 9p: ->evict_inode() should kick out ->i_data, not ->i_mapping
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (27 preceding siblings ...)
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 028/128] ALSA: hda - Fixing speaker noise on the two latest thinkpad models Luis Henriques
@ 2016-01-24 21:59 ` Luis Henriques
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 030/128] radeon/cik: Fix GFX IB test on Big-Endian Luis Henriques
` (99 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 21:59 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Al Viro, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Al Viro <viro@zeniv.linux.org.uk>
commit 4ad78628445d26e5e9487b2e8f23274ad7b0f5d3 upstream.
For block devices the pagecache is associated with the inode
on bdevfs, not with the aliasing ones on the mountable filesystems.
The latter have its own ->i_data empty and ->i_mapping pointing
to the (unique per major/minor) bdevfs inode. That guarantees
cache coherence between all block device inodes with the same
device number.
Eviction of an alias inode has no business trying to evict the
pages belonging to bdevfs one; moreover, ->i_mapping is only
safe to access when the thing is opened. At the time of
->evict_inode() the victim is definitely *not* opened. We are
about to kill the address space embedded into struct inode
(inode->i_data) and that's what we need to empty of any pages.
9p instance tries to empty inode->i_mapping instead, which is
both unsafe and bogus - if we have several device nodes with
the same device number in different places, closing one of them
should not try to empty the (shared) page cache.
Fortunately, other instances in the tree are OK; they are
evicting from &inode->i_data instead, as 9p one should.
Reported-by: "Suzuki K. Poulose" <Suzuki.Poulose@arm.com>
Tested-by: "Suzuki K. Poulose" <Suzuki.Poulose@arm.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
fs/9p/vfs_inode.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
index 509459d71ed0..bdfcea010c9f 100644
--- a/fs/9p/vfs_inode.c
+++ b/fs/9p/vfs_inode.c
@@ -451,9 +451,9 @@ void v9fs_evict_inode(struct inode *inode)
{
struct v9fs_inode *v9inode = V9FS_I(inode);
- truncate_inode_pages_final(inode->i_mapping);
+ truncate_inode_pages_final(&inode->i_data);
clear_inode(inode);
- filemap_fdatawrite(inode->i_mapping);
+ filemap_fdatawrite(&inode->i_data);
v9fs_cache_inode_put_cookie(inode);
/* clunk the fid stashed in writeback_fid */
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 030/128] radeon/cik: Fix GFX IB test on Big-Endian
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (28 preceding siblings ...)
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 029/128] 9p: ->evict_inode() should kick out ->i_data, not ->i_mapping Luis Henriques
@ 2016-01-24 21:59 ` Luis Henriques
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 031/128] radeon: Fix VCE ring test for Big-Endian systems Luis Henriques
` (98 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 21:59 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Oded Gabbay, Alex Deucher, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Oded Gabbay <oded.gabbay@gmail.com>
commit 5f3e226f511ec98d70c970f09cdb4ec46511cc5e upstream.
This patch makes the IB test on the GFX ring pass for CI-based cards
installed in Big-Endian machines.
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Oded Gabbay <oded.gabbay@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/gpu/drm/radeon/cik.c | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)
diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
index 19c9925b17ed..4db031e92628 100644
--- a/drivers/gpu/drm/radeon/cik.c
+++ b/drivers/gpu/drm/radeon/cik.c
@@ -3854,11 +3854,7 @@ void cik_ring_ib_execute(struct radeon_device *rdev, struct radeon_ib *ib)
(ib->vm ? (ib->vm->id << 24) : 0);
radeon_ring_write(ring, header);
- radeon_ring_write(ring,
-#ifdef __BIG_ENDIAN
- (2 << 0) |
-#endif
- (ib->gpu_addr & 0xFFFFFFFC));
+ radeon_ring_write(ring, (ib->gpu_addr & 0xFFFFFFFC));
radeon_ring_write(ring, upper_32_bits(ib->gpu_addr) & 0xFFFF);
radeon_ring_write(ring, control);
}
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 031/128] radeon: Fix VCE ring test for Big-Endian systems
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (29 preceding siblings ...)
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 030/128] radeon/cik: Fix GFX IB test on Big-Endian Luis Henriques
@ 2016-01-24 21:59 ` Luis Henriques
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 032/128] radeon: Fix VCE IB test on " Luis Henriques
` (97 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 21:59 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Oded Gabbay, Alex Deucher, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Oded Gabbay <oded.gabbay@gmail.com>
commit 687f4b98d1f4e27508f7ad4bcce787c1ba58b289 upstream.
This patch fixes the VCE ring test when running on Big-Endian machines.
Every write to the ring needs to be translated to little-endian.
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Oded Gabbay <oded.gabbay@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/gpu/drm/radeon/radeon_vce.c | 32 ++++++++++++++++----------------
1 file changed, 16 insertions(+), 16 deletions(-)
diff --git a/drivers/gpu/drm/radeon/radeon_vce.c b/drivers/gpu/drm/radeon/radeon_vce.c
index 2944637b8b44..252868f1bcda 100644
--- a/drivers/gpu/drm/radeon/radeon_vce.c
+++ b/drivers/gpu/drm/radeon/radeon_vce.c
@@ -679,12 +679,12 @@ bool radeon_vce_semaphore_emit(struct radeon_device *rdev,
{
uint64_t addr = semaphore->gpu_addr;
- radeon_ring_write(ring, VCE_CMD_SEMAPHORE);
- radeon_ring_write(ring, (addr >> 3) & 0x000FFFFF);
- radeon_ring_write(ring, (addr >> 23) & 0x000FFFFF);
- radeon_ring_write(ring, 0x01003000 | (emit_wait ? 1 : 0));
+ radeon_ring_write(ring, cpu_to_le32(VCE_CMD_SEMAPHORE));
+ radeon_ring_write(ring, cpu_to_le32((addr >> 3) & 0x000FFFFF));
+ radeon_ring_write(ring, cpu_to_le32((addr >> 23) & 0x000FFFFF));
+ radeon_ring_write(ring, cpu_to_le32(0x01003000 | (emit_wait ? 1 : 0)));
if (!emit_wait)
- radeon_ring_write(ring, VCE_CMD_END);
+ radeon_ring_write(ring, cpu_to_le32(VCE_CMD_END));
return true;
}
@@ -699,10 +699,10 @@ bool radeon_vce_semaphore_emit(struct radeon_device *rdev,
void radeon_vce_ib_execute(struct radeon_device *rdev, struct radeon_ib *ib)
{
struct radeon_ring *ring = &rdev->ring[ib->ring];
- radeon_ring_write(ring, VCE_CMD_IB);
- radeon_ring_write(ring, ib->gpu_addr);
- radeon_ring_write(ring, upper_32_bits(ib->gpu_addr));
- radeon_ring_write(ring, ib->length_dw);
+ radeon_ring_write(ring, cpu_to_le32(VCE_CMD_IB));
+ radeon_ring_write(ring, cpu_to_le32(ib->gpu_addr));
+ radeon_ring_write(ring, cpu_to_le32(upper_32_bits(ib->gpu_addr)));
+ radeon_ring_write(ring, cpu_to_le32(ib->length_dw));
}
/**
@@ -718,12 +718,12 @@ void radeon_vce_fence_emit(struct radeon_device *rdev,
struct radeon_ring *ring = &rdev->ring[fence->ring];
uint64_t addr = rdev->fence_drv[fence->ring].gpu_addr;
- radeon_ring_write(ring, VCE_CMD_FENCE);
- radeon_ring_write(ring, addr);
- radeon_ring_write(ring, upper_32_bits(addr));
- radeon_ring_write(ring, fence->seq);
- radeon_ring_write(ring, VCE_CMD_TRAP);
- radeon_ring_write(ring, VCE_CMD_END);
+ radeon_ring_write(ring, cpu_to_le32(VCE_CMD_FENCE));
+ radeon_ring_write(ring, cpu_to_le32(addr));
+ radeon_ring_write(ring, cpu_to_le32(upper_32_bits(addr)));
+ radeon_ring_write(ring, cpu_to_le32(fence->seq));
+ radeon_ring_write(ring, cpu_to_le32(VCE_CMD_TRAP));
+ radeon_ring_write(ring, cpu_to_le32(VCE_CMD_END));
}
/**
@@ -745,7 +745,7 @@ int radeon_vce_ring_test(struct radeon_device *rdev, struct radeon_ring *ring)
ring->idx, r);
return r;
}
- radeon_ring_write(ring, VCE_CMD_END);
+ radeon_ring_write(ring, cpu_to_le32(VCE_CMD_END));
radeon_ring_unlock_commit(rdev, ring);
for (i = 0; i < rdev->usec_timeout; i++) {
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 032/128] radeon: Fix VCE IB test on Big-Endian systems
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (30 preceding siblings ...)
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 031/128] radeon: Fix VCE ring test for Big-Endian systems Luis Henriques
@ 2016-01-24 21:59 ` Luis Henriques
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 033/128] ALSA: hda - Fix noise problems on Thinkpad T440s Luis Henriques
` (96 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 21:59 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Oded Gabbay, Alex Deucher, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Oded Gabbay <oded.gabbay@gmail.com>
commit 361c32d39087e7caa99e629c0d7fb00643cb2190 upstream.
This patch makes the VCE IB test pass on Big-Endian systems. It converts
to little-endian the contents of the VCE message.
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Oded Gabbay <oded.gabbay@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/gpu/drm/radeon/radeon_vce.c | 68 ++++++++++++++++++-------------------
1 file changed, 34 insertions(+), 34 deletions(-)
diff --git a/drivers/gpu/drm/radeon/radeon_vce.c b/drivers/gpu/drm/radeon/radeon_vce.c
index 252868f1bcda..1405251af5fb 100644
--- a/drivers/gpu/drm/radeon/radeon_vce.c
+++ b/drivers/gpu/drm/radeon/radeon_vce.c
@@ -342,31 +342,31 @@ int radeon_vce_get_create_msg(struct radeon_device *rdev, int ring,
/* stitch together an VCE create msg */
ib.length_dw = 0;
- ib.ptr[ib.length_dw++] = 0x0000000c; /* len */
- ib.ptr[ib.length_dw++] = 0x00000001; /* session cmd */
- ib.ptr[ib.length_dw++] = handle;
-
- ib.ptr[ib.length_dw++] = 0x00000030; /* len */
- ib.ptr[ib.length_dw++] = 0x01000001; /* create cmd */
- ib.ptr[ib.length_dw++] = 0x00000000;
- ib.ptr[ib.length_dw++] = 0x00000042;
- ib.ptr[ib.length_dw++] = 0x0000000a;
- ib.ptr[ib.length_dw++] = 0x00000001;
- ib.ptr[ib.length_dw++] = 0x00000080;
- ib.ptr[ib.length_dw++] = 0x00000060;
- ib.ptr[ib.length_dw++] = 0x00000100;
- ib.ptr[ib.length_dw++] = 0x00000100;
- ib.ptr[ib.length_dw++] = 0x0000000c;
- ib.ptr[ib.length_dw++] = 0x00000000;
-
- ib.ptr[ib.length_dw++] = 0x00000014; /* len */
- ib.ptr[ib.length_dw++] = 0x05000005; /* feedback buffer */
- ib.ptr[ib.length_dw++] = upper_32_bits(dummy);
- ib.ptr[ib.length_dw++] = dummy;
- ib.ptr[ib.length_dw++] = 0x00000001;
+ ib.ptr[ib.length_dw++] = cpu_to_le32(0x0000000c); /* len */
+ ib.ptr[ib.length_dw++] = cpu_to_le32(0x00000001); /* session cmd */
+ ib.ptr[ib.length_dw++] = cpu_to_le32(handle);
+
+ ib.ptr[ib.length_dw++] = cpu_to_le32(0x00000030); /* len */
+ ib.ptr[ib.length_dw++] = cpu_to_le32(0x01000001); /* create cmd */
+ ib.ptr[ib.length_dw++] = cpu_to_le32(0x00000000);
+ ib.ptr[ib.length_dw++] = cpu_to_le32(0x00000042);
+ ib.ptr[ib.length_dw++] = cpu_to_le32(0x0000000a);
+ ib.ptr[ib.length_dw++] = cpu_to_le32(0x00000001);
+ ib.ptr[ib.length_dw++] = cpu_to_le32(0x00000080);
+ ib.ptr[ib.length_dw++] = cpu_to_le32(0x00000060);
+ ib.ptr[ib.length_dw++] = cpu_to_le32(0x00000100);
+ ib.ptr[ib.length_dw++] = cpu_to_le32(0x00000100);
+ ib.ptr[ib.length_dw++] = cpu_to_le32(0x0000000c);
+ ib.ptr[ib.length_dw++] = cpu_to_le32(0x00000000);
+
+ ib.ptr[ib.length_dw++] = cpu_to_le32(0x00000014); /* len */
+ ib.ptr[ib.length_dw++] = cpu_to_le32(0x05000005); /* feedback buffer */
+ ib.ptr[ib.length_dw++] = cpu_to_le32(upper_32_bits(dummy));
+ ib.ptr[ib.length_dw++] = cpu_to_le32(dummy);
+ ib.ptr[ib.length_dw++] = cpu_to_le32(0x00000001);
for (i = ib.length_dw; i < ib_size_dw; ++i)
- ib.ptr[i] = 0x0;
+ ib.ptr[i] = cpu_to_le32(0x0);
r = radeon_ib_schedule(rdev, &ib, NULL);
if (r) {
@@ -409,21 +409,21 @@ int radeon_vce_get_destroy_msg(struct radeon_device *rdev, int ring,
/* stitch together an VCE destroy msg */
ib.length_dw = 0;
- ib.ptr[ib.length_dw++] = 0x0000000c; /* len */
- ib.ptr[ib.length_dw++] = 0x00000001; /* session cmd */
- ib.ptr[ib.length_dw++] = handle;
+ ib.ptr[ib.length_dw++] = cpu_to_le32(0x0000000c); /* len */
+ ib.ptr[ib.length_dw++] = cpu_to_le32(0x00000001); /* session cmd */
+ ib.ptr[ib.length_dw++] = cpu_to_le32(handle);
- ib.ptr[ib.length_dw++] = 0x00000014; /* len */
- ib.ptr[ib.length_dw++] = 0x05000005; /* feedback buffer */
- ib.ptr[ib.length_dw++] = upper_32_bits(dummy);
- ib.ptr[ib.length_dw++] = dummy;
- ib.ptr[ib.length_dw++] = 0x00000001;
+ ib.ptr[ib.length_dw++] = cpu_to_le32(0x00000014); /* len */
+ ib.ptr[ib.length_dw++] = cpu_to_le32(0x05000005); /* feedback buffer */
+ ib.ptr[ib.length_dw++] = cpu_to_le32(upper_32_bits(dummy));
+ ib.ptr[ib.length_dw++] = cpu_to_le32(dummy);
+ ib.ptr[ib.length_dw++] = cpu_to_le32(0x00000001);
- ib.ptr[ib.length_dw++] = 0x00000008; /* len */
- ib.ptr[ib.length_dw++] = 0x02000001; /* destroy cmd */
+ ib.ptr[ib.length_dw++] = cpu_to_le32(0x00000008); /* len */
+ ib.ptr[ib.length_dw++] = cpu_to_le32(0x02000001); /* destroy cmd */
for (i = ib.length_dw; i < ib_size_dw; ++i)
- ib.ptr[i] = 0x0;
+ ib.ptr[i] = cpu_to_le32(0x0);
r = radeon_ib_schedule(rdev, &ib, NULL);
if (r) {
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 033/128] ALSA: hda - Fix noise problems on Thinkpad T440s
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (31 preceding siblings ...)
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 032/128] radeon: Fix VCE IB test on " Luis Henriques
@ 2016-01-24 21:59 ` Luis Henriques
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 034/128] dm thin metadata: fix bug when taking a metadata snapshot Luis Henriques
` (95 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 21:59 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Takashi Iwai, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Takashi Iwai <tiwai@suse.de>
commit 9a811230481243f384b8036c6a558bfdbd961f78 upstream.
Lenovo Thinkpad T440s suffers from constant background noises, and it
seems to be a generic hardware issue on this model:
https://forums.lenovo.com/t5/ThinkPad-T400-T500-and-newer-T/T440s-speaker-noise/td-p/1339883
As the noise comes from the analog loopback path, disabling the path
is the easy workaround.
Also, the machine gives significant cracking noises at PM suspend. A
workaround found by trial-and-error is to disable the shutup callback
currently used for ALC269-variant.
This patch addresses these noise issues by introducing a new fixup
chain. Although the same workaround might be applicable to other
Thinkpad models, it's applied only to T440s (17aa:220c) in this patch,
so far, just to be safe (you chicken!). As a compromise, a new model
option string "tp440" is provided now, though, so that owners of other
Thinkpad models can test it more easily.
Bugzilla: https://bugzilla.opensuse.org/show_bug.cgi?id=958504
Reported-and-tested-by: Tim Hardeck <thardeck@suse.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
sound/pci/hda/patch_realtek.c | 22 +++++++++++++++++++++-
1 file changed, 21 insertions(+), 1 deletion(-)
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index e3a98869b1b6..148957ca1d04 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -4029,6 +4029,18 @@ static void alc_fixup_disable_aamix(struct hda_codec *codec,
}
}
+/* additional fixup for Thinkpad T440s noise problem */
+static void alc_fixup_tpt440(struct hda_codec *codec,
+ const struct hda_fixup *fix, int action)
+{
+ struct alc_spec *spec = codec->spec;
+
+ if (action == HDA_FIXUP_ACT_PRE_PROBE) {
+ spec->shutup = alc_no_shutup; /* reduce click noise */
+ spec->gen.mixer_nid = 0; /* reduce background noise */
+ }
+}
+
static unsigned int alc_power_filter_xps13(struct hda_codec *codec,
hda_nid_t nid,
unsigned int power_state)
@@ -4325,6 +4337,7 @@ enum {
ALC293_FIXUP_DELL1_MIC_NO_PRESENCE,
ALC292_FIXUP_TPT440_DOCK,
ALC292_FIXUP_TPT440_DOCK2,
+ ALC292_FIXUP_TPT440,
ALC275_FIXUP_DELL_XPS,
ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE,
ALC293_FIXUP_LENOVO_SPK_NOISE,
@@ -4780,6 +4793,12 @@ static const struct hda_fixup alc269_fixups[] = {
.chained = true,
.chain_id = ALC269_FIXUP_LIMIT_INT_MIC_BOOST
},
+ [ALC292_FIXUP_TPT440] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc_fixup_tpt440,
+ .chained = true,
+ .chain_id = ALC292_FIXUP_TPT440_DOCK,
+ },
[ALC275_FIXUP_DELL_XPS] = {
.type = HDA_FIXUP_VERBS,
.v.verbs = (const struct hda_verb[]) {
@@ -4961,7 +4980,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
SND_PCI_QUIRK(0x17aa, 0x21fb, "Thinkpad T430s", ALC269_FIXUP_LENOVO_DOCK),
SND_PCI_QUIRK(0x17aa, 0x2203, "Thinkpad X230 Tablet", ALC269_FIXUP_LENOVO_DOCK),
SND_PCI_QUIRK(0x17aa, 0x2208, "Thinkpad T431s", ALC269_FIXUP_LENOVO_DOCK),
- SND_PCI_QUIRK(0x17aa, 0x220c, "Thinkpad T440s", ALC292_FIXUP_TPT440_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x220c, "Thinkpad T440s", ALC292_FIXUP_TPT440),
SND_PCI_QUIRK(0x17aa, 0x220e, "Thinkpad T440p", ALC292_FIXUP_TPT440_DOCK),
SND_PCI_QUIRK(0x17aa, 0x2210, "Thinkpad T540p", ALC292_FIXUP_TPT440_DOCK),
SND_PCI_QUIRK(0x17aa, 0x2212, "Thinkpad T440", ALC292_FIXUP_TPT440_DOCK),
@@ -5050,6 +5069,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
{.id = ALC283_FIXUP_CHROME_BOOK, .name = "alc283-dac-wcaps"},
{.id = ALC283_FIXUP_SENSE_COMBO_JACK, .name = "alc283-sense-combo"},
{.id = ALC292_FIXUP_TPT440_DOCK, .name = "tpt440-dock"},
+ {.id = ALC292_FIXUP_TPT440, .name = "tpt440"},
{}
};
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 034/128] dm thin metadata: fix bug when taking a metadata snapshot
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (32 preceding siblings ...)
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 033/128] ALSA: hda - Fix noise problems on Thinkpad T440s Luis Henriques
@ 2016-01-24 21:59 ` Luis Henriques
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 035/128] dm space map metadata: fix ref counting bug when bootstrapping a new space map Luis Henriques
` (94 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 21:59 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Joe Thornber, Mike Snitzer, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Joe Thornber <ejt@redhat.com>
commit 49e99fc717f624aa75ca755d6e7bc029efd3f0e9 upstream.
When you take a metadata snapshot the btree roots for the mapping and
details tree need to have their reference counts incremented so they
persist for the lifetime of the metadata snap.
The roots being incremented were those currently written in the
superblock, which could possibly be out of date if concurrent IO is
triggering new mappings, breaking of sharing, etc.
Fix this by performing a commit with the metadata lock held while taking
a metadata snapshot.
Signed-off-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/md/dm-thin-metadata.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c
index 3412b86e79fd..7768de60f699 100644
--- a/drivers/md/dm-thin-metadata.c
+++ b/drivers/md/dm-thin-metadata.c
@@ -1205,6 +1205,12 @@ static int __reserve_metadata_snap(struct dm_pool_metadata *pmd)
dm_block_t held_root;
/*
+ * We commit to ensure the btree roots which we increment in a
+ * moment are up to date.
+ */
+ __commit_transaction(pmd);
+
+ /*
* Copy the superblock.
*/
dm_sm_inc_block(pmd->metadata_sm, THIN_SUPERBLOCK_LOCATION);
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 035/128] dm space map metadata: fix ref counting bug when bootstrapping a new space map
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (33 preceding siblings ...)
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 034/128] dm thin metadata: fix bug when taking a metadata snapshot Luis Henriques
@ 2016-01-24 21:59 ` Luis Henriques
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 036/128] ipmi: move timer init to before irq is setup Luis Henriques
` (93 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 21:59 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Joe Thornber, Mike Snitzer, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Joe Thornber <ejt@redhat.com>
commit 50dd842ad83b43bed71790efb31cfb2f6c05c9c1 upstream.
When applying block operations (BOPs) do not remove them from the
uncommitted BOP ring-buffer until after they've been applied -- in case
we recurse.
Also, perform BOP_INC operation, in dm_sm_metadata_create() and
sm_metadata_extend(), in terms of the uncommitted BOP ring-buffer rather
than using direct calls to sm_ll_inc().
Signed-off-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/md/persistent-data/dm-space-map-metadata.c | 32 +++++++++++++++-------
1 file changed, 22 insertions(+), 10 deletions(-)
diff --git a/drivers/md/persistent-data/dm-space-map-metadata.c b/drivers/md/persistent-data/dm-space-map-metadata.c
index 199c9ccd1f5d..8ec5ac5b9d63 100644
--- a/drivers/md/persistent-data/dm-space-map-metadata.c
+++ b/drivers/md/persistent-data/dm-space-map-metadata.c
@@ -136,7 +136,7 @@ static int brb_push(struct bop_ring_buffer *brb,
return 0;
}
-static int brb_pop(struct bop_ring_buffer *brb, struct block_op *result)
+static int brb_peek(struct bop_ring_buffer *brb, struct block_op *result)
{
struct block_op *bop;
@@ -147,6 +147,17 @@ static int brb_pop(struct bop_ring_buffer *brb, struct block_op *result)
result->type = bop->type;
result->block = bop->block;
+ return 0;
+}
+
+static int brb_pop(struct bop_ring_buffer *brb)
+{
+ struct block_op *bop;
+
+ if (brb_empty(brb))
+ return -ENODATA;
+
+ bop = brb->bops + brb->begin;
brb->begin = brb_next(brb, brb->begin);
return 0;
@@ -211,7 +222,7 @@ static int apply_bops(struct sm_metadata *smm)
while (!brb_empty(&smm->uncommitted)) {
struct block_op bop;
- r = brb_pop(&smm->uncommitted, &bop);
+ r = brb_peek(&smm->uncommitted, &bop);
if (r) {
DMERR("bug in bop ring buffer");
break;
@@ -220,6 +231,8 @@ static int apply_bops(struct sm_metadata *smm)
r = commit_bop(smm, &bop);
if (r)
break;
+
+ brb_pop(&smm->uncommitted);
}
return r;
@@ -681,7 +694,6 @@ static struct dm_space_map bootstrap_ops = {
static int sm_metadata_extend(struct dm_space_map *sm, dm_block_t extra_blocks)
{
int r, i;
- enum allocation_event ev;
struct sm_metadata *smm = container_of(sm, struct sm_metadata, sm);
dm_block_t old_len = smm->ll.nr_blocks;
@@ -703,11 +715,12 @@ static int sm_metadata_extend(struct dm_space_map *sm, dm_block_t extra_blocks)
* allocate any new blocks.
*/
do {
- for (i = old_len; !r && i < smm->begin; i++) {
- r = sm_ll_inc(&smm->ll, i, &ev);
- if (r)
- goto out;
- }
+ for (i = old_len; !r && i < smm->begin; i++)
+ r = add_bop(smm, BOP_INC, i);
+
+ if (r)
+ goto out;
+
old_len = smm->begin;
r = apply_bops(smm);
@@ -752,7 +765,6 @@ int dm_sm_metadata_create(struct dm_space_map *sm,
{
int r;
dm_block_t i;
- enum allocation_event ev;
struct sm_metadata *smm = container_of(sm, struct sm_metadata, sm);
smm->begin = superblock + 1;
@@ -780,7 +792,7 @@ int dm_sm_metadata_create(struct dm_space_map *sm,
* allocated blocks that they were built from.
*/
for (i = superblock; !r && i < smm->begin; i++)
- r = sm_ll_inc(&smm->ll, i, &ev);
+ r = add_bop(smm, BOP_INC, i);
if (r)
return r;
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 036/128] ipmi: move timer init to before irq is setup
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (34 preceding siblings ...)
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 035/128] dm space map metadata: fix ref counting bug when bootstrapping a new space map Luis Henriques
@ 2016-01-24 21:59 ` Luis Henriques
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 037/128] dm btree: fix bufio buffer leaks in dm_btree_del() error path Luis Henriques
` (92 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 21:59 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Jan Stancek, Tony Camuso, Corey Minyard, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Jan Stancek <jstancek@redhat.com>
commit 27f972d3e00b50639deb4cc1392afaeb08d3cecc upstream.
We encountered a panic on boot in ipmi_si on a dell per320 due to an
uninitialized timer as follows.
static int smi_start_processing(void *send_info,
ipmi_smi_t intf)
{
/* Try to claim any interrupts. */
if (new_smi->irq_setup)
new_smi->irq_setup(new_smi);
--> IRQ arrives here and irq handler tries to modify uninitialized timer
which triggers BUG_ON(!timer->function) in __mod_timer().
Call Trace:
<IRQ>
[<ffffffffa0532617>] start_new_msg+0x47/0x80 [ipmi_si]
[<ffffffffa053269e>] start_check_enables+0x4e/0x60 [ipmi_si]
[<ffffffffa0532bd8>] smi_event_handler+0x1e8/0x640 [ipmi_si]
[<ffffffff810f5584>] ? __rcu_process_callbacks+0x54/0x350
[<ffffffffa053327c>] si_irq_handler+0x3c/0x60 [ipmi_si]
[<ffffffff810efaf0>] handle_IRQ_event+0x60/0x170
[<ffffffff810f245e>] handle_edge_irq+0xde/0x180
[<ffffffff8100fc59>] handle_irq+0x49/0xa0
[<ffffffff8154643c>] do_IRQ+0x6c/0xf0
[<ffffffff8100ba53>] ret_from_intr+0x0/0x11
/* Set up the timer that drives the interface. */
setup_timer(&new_smi->si_timer, smi_timeout, (long)new_smi);
The following patch fixes the problem.
To: Openipmi-developer@lists.sourceforge.net
To: Corey Minyard <minyard@acm.org>
CC: linux-kernel@vger.kernel.org
Signed-off-by: Jan Stancek <jstancek@redhat.com>
Signed-off-by: Tony Camuso <tcamuso@redhat.com>
Signed-off-by: Corey Minyard <cminyard@mvista.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/char/ipmi/ipmi_si_intf.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
index 5d665680ae33..d89137a0224f 100644
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -1176,14 +1176,14 @@ static int smi_start_processing(void *send_info,
new_smi->intf = intf;
- /* Try to claim any interrupts. */
- if (new_smi->irq_setup)
- new_smi->irq_setup(new_smi);
-
/* Set up the timer that drives the interface. */
setup_timer(&new_smi->si_timer, smi_timeout, (long)new_smi);
smi_mod_timer(new_smi, jiffies + SI_TIMEOUT_JIFFIES);
+ /* Try to claim any interrupts. */
+ if (new_smi->irq_setup)
+ new_smi->irq_setup(new_smi);
+
/*
* Check if the user forcefully enabled the daemon.
*/
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 037/128] dm btree: fix bufio buffer leaks in dm_btree_del() error path
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (35 preceding siblings ...)
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 036/128] ipmi: move timer init to before irq is setup Luis Henriques
@ 2016-01-24 21:59 ` Luis Henriques
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 038/128] vgaarb: fix signal handling in vga_get() Luis Henriques
` (91 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 21:59 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Joe Thornber, Mike Snitzer, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Joe Thornber <ejt@redhat.com>
commit ed8b45a3679eb49069b094c0711b30833f27c734 upstream.
If dm_btree_del()'s call to push_frame() fails, e.g. due to
btree_node_validator finding invalid metadata, the dm_btree_del() error
path must unlock all frames (which have active dm-bufio buffers) that
were pushed onto the del_stack.
Otherwise, dm_bufio_client_destroy() will BUG_ON() because dm-bufio
buffers have leaked, e.g.:
device-mapper: bufio: leaked buffer 3, hold count 1, list 0
Signed-off-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/md/persistent-data/dm-btree.c | 16 +++++++++++++++-
1 file changed, 15 insertions(+), 1 deletion(-)
diff --git a/drivers/md/persistent-data/dm-btree.c b/drivers/md/persistent-data/dm-btree.c
index 7ba85e2b146b..7b4bb1f09b01 100644
--- a/drivers/md/persistent-data/dm-btree.c
+++ b/drivers/md/persistent-data/dm-btree.c
@@ -250,6 +250,16 @@ static void pop_frame(struct del_stack *s)
dm_tm_unlock(s->tm, f->b);
}
+static void unlock_all_frames(struct del_stack *s)
+{
+ struct frame *f;
+
+ while (unprocessed_frames(s)) {
+ f = s->spine + s->top--;
+ dm_tm_unlock(s->tm, f->b);
+ }
+}
+
int dm_btree_del(struct dm_btree_info *info, dm_block_t root)
{
int r;
@@ -306,9 +316,13 @@ int dm_btree_del(struct dm_btree_info *info, dm_block_t root)
pop_frame(s);
}
}
-
out:
+ if (r) {
+ /* cleanup all frames of del_stack */
+ unlock_all_frames(s);
+ }
kfree(s);
+
return r;
}
EXPORT_SYMBOL_GPL(dm_btree_del);
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 038/128] vgaarb: fix signal handling in vga_get()
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (36 preceding siblings ...)
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 037/128] dm btree: fix bufio buffer leaks in dm_btree_del() error path Luis Henriques
@ 2016-01-24 21:59 ` Luis Henriques
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 039/128] xhci: fix usb2 resume timing and races Luis Henriques
` (90 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 21:59 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Kirill A . Shutemov, Dave Airlie, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: "Kirill A. Shutemov" <kirill@shutemov.name>
commit 9f5bd30818c42c6c36a51f93b4df75a2ea2bd85e upstream.
There are few defects in vga_get() related to signal hadning:
- we shouldn't check for pending signals for TASK_UNINTERRUPTIBLE
case;
- if we found pending signal we must remove ourself from wait queue
and change task state back to running;
- -ERESTARTSYS is more appropriate, I guess.
Signed-off-by: Kirill A. Shutemov <kirill@shutemov.name>
Reviewed-by: David Herrmann <dh.herrmann@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/gpu/vga/vgaarb.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/vga/vgaarb.c b/drivers/gpu/vga/vgaarb.c
index 366641d0483f..5b9eccd3e9ff 100644
--- a/drivers/gpu/vga/vgaarb.c
+++ b/drivers/gpu/vga/vgaarb.c
@@ -393,8 +393,10 @@ int vga_get(struct pci_dev *pdev, unsigned int rsrc, int interruptible)
set_current_state(interruptible ?
TASK_INTERRUPTIBLE :
TASK_UNINTERRUPTIBLE);
- if (signal_pending(current)) {
- rc = -EINTR;
+ if (interruptible && signal_pending(current)) {
+ __set_current_state(TASK_RUNNING);
+ remove_wait_queue(&vga_wait_queue, &wait);
+ rc = -ERESTARTSYS;
break;
}
schedule();
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 039/128] xhci: fix usb2 resume timing and races.
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (37 preceding siblings ...)
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 038/128] vgaarb: fix signal handling in vga_get() Luis Henriques
@ 2016-01-24 21:59 ` Luis Henriques
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 040/128] USB: add quirk for devices with broken LPM Luis Henriques
` (89 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 21:59 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Mathias Nyman, Greg Kroah-Hartman, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Mathias Nyman <mathias.nyman@linux.intel.com>
commit f69115fdbc1ac0718e7d19ad3caa3da2ecfe1c96 upstream.
According to USB 2 specs ports need to signal resume for at least 20ms,
in practice even longer, before moving to U0 state.
Both host and devices can initiate resume.
On device initiated resume, a port status interrupt with the port in resume
state in issued. The interrupt handler tags a resume_done[port]
timestamp with current time + USB_RESUME_TIMEOUT, and kick roothub timer.
Root hub timer requests for port status, finds the port in resume state,
checks if resume_done[port] timestamp passed, and set port to U0 state.
On host initiated resume, current code sets the port to resume state,
sleep 20ms, and finally sets the port to U0 state. This should also
be changed to work in a similar way as the device initiated resume, with
timestamp tagging, but that is not yet tested and will be a separate
fix later.
There are a few issues with this approach
1. A host initiated resume will also generate a resume event. The event
handler will find the port in resume state, believe it's a device
initiated resume, and act accordingly.
2. A port status request might cut the resume signalling short if a
get_port_status request is handled during the host resume signalling.
The port will be found in resume state. The timestamp is not set leading
to time_after_eq(jiffies, timestamp) returning true, as timestamp = 0.
get_port_status will proceed with moving the port to U0.
3. If an error, or anything else happens to the port during device
initiated resume signalling it will leave all the device resume
parameters hanging uncleared, preventing further suspend, returning
-EBUSY, and cause the pm thread to busyloop trying to enter suspend.
Fix this by using the existing resuming_ports bitfield to indicate that
resume signalling timing is taken care of.
Check if the resume_done[port] is set before using it for timestamp
comparison, and also clear out any resume signalling related variables
if port is not in U0 or Resume state
This issue was discovered when a PM thread busylooped, trying to runtime
suspend the xhci USB 2 roothub on a Dell XPS
Reported-by: Daniel J Blueman <daniel@quora.org>
Tested-by: Daniel J Blueman <daniel@quora.org>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/usb/host/xhci-hub.c | 47 +++++++++++++++++++++++++++++++++++++++-----
drivers/usb/host/xhci-ring.c | 3 ++-
2 files changed, 44 insertions(+), 6 deletions(-)
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index 625fdd8b3537..69a70f880429 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -609,8 +609,30 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
if ((raw_port_status & PORT_RESET) ||
!(raw_port_status & PORT_PE))
return 0xffffffff;
- if (time_after_eq(jiffies,
- bus_state->resume_done[wIndex])) {
+ /* did port event handler already start resume timing? */
+ if (!bus_state->resume_done[wIndex]) {
+ /* If not, maybe we are in a host initated resume? */
+ if (test_bit(wIndex, &bus_state->resuming_ports)) {
+ /* Host initated resume doesn't time the resume
+ * signalling using resume_done[].
+ * It manually sets RESUME state, sleeps 20ms
+ * and sets U0 state. This should probably be
+ * changed, but not right now.
+ */
+ } else {
+ /* port resume was discovered now and here,
+ * start resume timing
+ */
+ unsigned long timeout = jiffies +
+ msecs_to_jiffies(USB_RESUME_TIMEOUT);
+
+ set_bit(wIndex, &bus_state->resuming_ports);
+ bus_state->resume_done[wIndex] = timeout;
+ mod_timer(&hcd->rh_timer, timeout);
+ }
+ /* Has resume been signalled for USB_RESUME_TIME yet? */
+ } else if (time_after_eq(jiffies,
+ bus_state->resume_done[wIndex])) {
int time_left;
xhci_dbg(xhci, "Resume USB2 port %d\n",
@@ -651,13 +673,26 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
} else {
/*
* The resume has been signaling for less than
- * 20ms. Report the port status as SUSPEND,
- * let the usbcore check port status again
- * and clear resume signaling later.
+ * USB_RESUME_TIME. Report the port status as SUSPEND,
+ * let the usbcore check port status again and clear
+ * resume signaling later.
*/
status |= USB_PORT_STAT_SUSPEND;
}
}
+ /*
+ * Clear stale usb2 resume signalling variables in case port changed
+ * state during resume signalling. For example on error
+ */
+ if ((bus_state->resume_done[wIndex] ||
+ test_bit(wIndex, &bus_state->resuming_ports)) &&
+ (raw_port_status & PORT_PLS_MASK) != XDEV_U3 &&
+ (raw_port_status & PORT_PLS_MASK) != XDEV_RESUME) {
+ bus_state->resume_done[wIndex] = 0;
+ clear_bit(wIndex, &bus_state->resuming_ports);
+ }
+
+
if ((raw_port_status & PORT_PLS_MASK) == XDEV_U0 &&
(raw_port_status & PORT_POWER)) {
if (bus_state->suspended_ports & (1 << wIndex)) {
@@ -991,6 +1026,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
if ((temp & PORT_PE) == 0)
goto error;
+ set_bit(wIndex, &bus_state->resuming_ports);
xhci_set_link_state(xhci, port_array, wIndex,
XDEV_RESUME);
spin_unlock_irqrestore(&xhci->lock, flags);
@@ -998,6 +1034,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
spin_lock_irqsave(&xhci->lock, flags);
xhci_set_link_state(xhci, port_array, wIndex,
XDEV_U0);
+ clear_bit(wIndex, &bus_state->resuming_ports);
}
bus_state->port_c_suspend |= 1 << wIndex;
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 93cbefdacd31..22c9bca66569 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1620,7 +1620,8 @@ static void handle_port_status(struct xhci_hcd *xhci,
*/
bogus_port_status = true;
goto cleanup;
- } else {
+ } else if (!test_bit(faked_port_index,
+ &bus_state->resuming_ports)) {
xhci_dbg(xhci, "resume HS port %d\n", port_id);
bus_state->resume_done[faked_port_index] = jiffies +
msecs_to_jiffies(USB_RESUME_TIMEOUT);
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 040/128] USB: add quirk for devices with broken LPM
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (38 preceding siblings ...)
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 039/128] xhci: fix usb2 resume timing and races Luis Henriques
@ 2016-01-24 21:59 ` Luis Henriques
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 041/128] parisc iommu: fix panic due to trying to allocate too large region Luis Henriques
` (88 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 21:59 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Alan Stern, Greg Kroah-Hartman, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Alan Stern <stern@rowland.harvard.edu>
commit ad87e03213b552a5c33d5e1e7a19a73768397010 upstream.
Some USB device / host controller combinations seem to have problems
with Link Power Management. For example, Steinar found that his xHCI
controller wouldn't handle bandwidth calculations correctly for two
video cards simultaneously when LPM was enabled, even though the bus
had plenty of bandwidth available.
This patch introduces a new quirk flag for devices that should remain
disabled for LPM, and creates quirk entries for Steinar's devices.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-by: Steinar H. Gunderson <sgunderson@bigfoot.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/usb/core/hub.c | 7 ++++++-
drivers/usb/core/quirks.c | 6 ++++++
include/linux/usb/quirks.h | 3 +++
3 files changed, 15 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 882acb2a0b48..a1e577777a02 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -128,6 +128,10 @@ struct usb_hub *usb_hub_to_struct_hub(struct usb_device *hdev)
int usb_device_supports_lpm(struct usb_device *udev)
{
+ /* Some devices have trouble with LPM */
+ if (udev->quirks & USB_QUIRK_NO_LPM)
+ return 0;
+
/* USB 2.1 (and greater) devices indicate LPM support through
* their USB 2.0 Extended Capabilities BOS descriptor.
*/
@@ -4479,6 +4483,8 @@ hub_port_init (struct usb_hub *hub, struct usb_device *udev, int port1,
goto fail;
}
+ usb_detect_quirks(udev);
+
if (udev->wusb == 0 && le16_to_cpu(udev->descriptor.bcdUSB) >= 0x0201) {
retval = usb_get_bos_descriptor(udev);
if (!retval) {
@@ -4674,7 +4680,6 @@ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus,
if (status < 0)
goto loop;
- usb_detect_quirks(udev);
if (udev->quirks & USB_QUIRK_DELAY_INIT)
msleep(1000);
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index 2b978ad9d9ef..0e8e656a045f 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -188,6 +188,12 @@ static const struct usb_device_id usb_quirk_list[] = {
/* USB3503 */
{ USB_DEVICE(0x0424, 0x3503), .driver_info = USB_QUIRK_RESET_RESUME },
+ /* Blackmagic Design Intensity Shuttle */
+ { USB_DEVICE(0x1edb, 0xbd3b), .driver_info = USB_QUIRK_NO_LPM },
+
+ /* Blackmagic Design UltraStudio SDI */
+ { USB_DEVICE(0x1edb, 0xbd4f), .driver_info = USB_QUIRK_NO_LPM },
+
{ } /* terminating entry must be last */
};
diff --git a/include/linux/usb/quirks.h b/include/linux/usb/quirks.h
index 4a185a0f6242..8f4f2214652f 100644
--- a/include/linux/usb/quirks.h
+++ b/include/linux/usb/quirks.h
@@ -47,4 +47,7 @@
/* device can't handle device_qualifier descriptor requests */
#define USB_QUIRK_DEVICE_QUALIFIER 0x00000100
+/* device can't handle Link Power Management */
+#define USB_QUIRK_NO_LPM BIT(10)
+
#endif /* __LINUX_USB_QUIRKS_H */
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 041/128] parisc iommu: fix panic due to trying to allocate too large region
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (39 preceding siblings ...)
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 040/128] USB: add quirk for devices with broken LPM Luis Henriques
@ 2016-01-24 21:59 ` Luis Henriques
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 042/128] mm: hugetlb: fix hugepage memory leak caused by wrong reserve count Luis Henriques
` (87 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 21:59 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Mikulas Patocka, Helge Deller, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Mikulas Patocka <mpatocka@redhat.com>
commit e46e31a3696ae2d66f32c207df3969613726e636 upstream.
When using the Promise TX2+ SATA controller on PA-RISC, the system often
crashes with kernel panic, for example just writing data with the dd
utility will make it crash.
Kernel panic - not syncing: drivers/parisc/sba_iommu.c: I/O MMU @ 000000000000a000 is out of mapping resources
CPU: 0 PID: 18442 Comm: mkspadfs Not tainted 4.4.0-rc2 #2
Backtrace:
[<000000004021497c>] show_stack+0x14/0x20
[<0000000040410bf0>] dump_stack+0x88/0x100
[<000000004023978c>] panic+0x124/0x360
[<0000000040452c18>] sba_alloc_range+0x698/0x6a0
[<0000000040453150>] sba_map_sg+0x260/0x5b8
[<000000000c18dbb4>] ata_qc_issue+0x264/0x4a8 [libata]
[<000000000c19535c>] ata_scsi_translate+0xe4/0x220 [libata]
[<000000000c19a93c>] ata_scsi_queuecmd+0xbc/0x320 [libata]
[<0000000040499bbc>] scsi_dispatch_cmd+0xfc/0x130
[<000000004049da34>] scsi_request_fn+0x6e4/0x970
[<00000000403e95a8>] __blk_run_queue+0x40/0x60
[<00000000403e9d8c>] blk_run_queue+0x3c/0x68
[<000000004049a534>] scsi_run_queue+0x2a4/0x360
[<000000004049be68>] scsi_end_request+0x1a8/0x238
[<000000004049de84>] scsi_io_completion+0xfc/0x688
[<0000000040493c74>] scsi_finish_command+0x17c/0x1d0
The cause of the crash is not exhaustion of the IOMMU space, there is
plenty of free pages. The function sba_alloc_range is called with size
0x11000, thus the pages_needed variable is 0x11. The function
sba_search_bitmap is called with bits_wanted 0x11 and boundary size is
0x10 (because dma_get_seg_boundary(dev) returns 0xffff).
The function sba_search_bitmap attempts to allocate 17 pages that must not
cross 16-page boundary - it can't satisfy this requirement
(iommu_is_span_boundary always returns true) and fails even if there are
many free entries in the IOMMU space.
How did it happen that we try to allocate 17 pages that don't cross
16-page boundary? The cause is in the function iommu_coalesce_chunks. This
function tries to coalesce adjacent entries in the scatterlist. The
function does several checks if it may coalesce one entry with the next,
one of those checks is this:
if (startsg->length + dma_len > max_seg_size)
break;
When it finishes coalescing adjacent entries, it allocates the mapping:
sg_dma_len(contig_sg) = dma_len;
dma_len = ALIGN(dma_len + dma_offset, IOVP_SIZE);
sg_dma_address(contig_sg) =
PIDE_FLAG
| (iommu_alloc_range(ioc, dev, dma_len) << IOVP_SHIFT)
| dma_offset;
It is possible that (startsg->length + dma_len > max_seg_size) is false
(we are just near the 0x10000 max_seg_size boundary), so the funcion
decides to coalesce this entry with the next entry. When the coalescing
succeeds, the function performs
dma_len = ALIGN(dma_len + dma_offset, IOVP_SIZE);
And now, because of non-zero dma_offset, dma_len is greater than 0x10000.
iommu_alloc_range (a pointer to sba_alloc_range) is called and it attempts
to allocate 17 pages for a device that must not cross 16-page boundary.
To fix the bug, we must make sure that dma_len after addition of
dma_offset and alignment doesn't cross the segment boundary. I.e. change
if (startsg->length + dma_len > max_seg_size)
break;
to
if (ALIGN(dma_len + dma_offset + startsg->length, IOVP_SIZE) > max_seg_size)
break;
This patch makes this change (it precalculates max_seg_boundary at the
beginning of the function iommu_coalesce_chunks). I also added a check
that the mapping length doesn't exceed dma_get_seg_boundary(dev) (it is
not needed for Promise TX2+ SATA, but it may be needed for other devices
that have dma_get_seg_boundary lower than dma_get_max_seg_size).
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/parisc/iommu-helpers.h | 15 ++++++++-------
1 file changed, 8 insertions(+), 7 deletions(-)
diff --git a/drivers/parisc/iommu-helpers.h b/drivers/parisc/iommu-helpers.h
index 8c33491b21fe..c6aa38883466 100644
--- a/drivers/parisc/iommu-helpers.h
+++ b/drivers/parisc/iommu-helpers.h
@@ -104,7 +104,11 @@ iommu_coalesce_chunks(struct ioc *ioc, struct device *dev,
struct scatterlist *contig_sg; /* contig chunk head */
unsigned long dma_offset, dma_len; /* start/len of DMA stream */
unsigned int n_mappings = 0;
- unsigned int max_seg_size = dma_get_max_seg_size(dev);
+ unsigned int max_seg_size = min(dma_get_max_seg_size(dev),
+ (unsigned)DMA_CHUNK_SIZE);
+ unsigned int max_seg_boundary = dma_get_seg_boundary(dev) + 1;
+ if (max_seg_boundary) /* check if the addition above didn't overflow */
+ max_seg_size = min(max_seg_size, max_seg_boundary);
while (nents > 0) {
@@ -139,14 +143,11 @@ iommu_coalesce_chunks(struct ioc *ioc, struct device *dev,
/*
** First make sure current dma stream won't
- ** exceed DMA_CHUNK_SIZE if we coalesce the
+ ** exceed max_seg_size if we coalesce the
** next entry.
*/
- if(unlikely(ALIGN(dma_len + dma_offset + startsg->length,
- IOVP_SIZE) > DMA_CHUNK_SIZE))
- break;
-
- if (startsg->length + dma_len > max_seg_size)
+ if (unlikely(ALIGN(dma_len + dma_offset + startsg->length, IOVP_SIZE) >
+ max_seg_size))
break;
/*
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 042/128] mm: hugetlb: fix hugepage memory leak caused by wrong reserve count
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (40 preceding siblings ...)
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 041/128] parisc iommu: fix panic due to trying to allocate too large region Luis Henriques
@ 2016-01-24 21:59 ` Luis Henriques
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 043/128] mm, vmstat: allow WQ concurrency to discover memory reclaim doesn't make any progress Luis Henriques
` (86 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 21:59 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Naoya Horiguchi, David Rientjes, Dave Hansen, Mel Gorman,
Joonsoo Kim, Hillf Danton, Mike Kravetz, Andrew Morton,
Linus Torvalds, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
commit a88c769548047b21f76fd71e04b6a3300ff17160 upstream.
When dequeue_huge_page_vma() in alloc_huge_page() fails, we fall back on
alloc_buddy_huge_page() to directly create a hugepage from the buddy
allocator.
In that case, however, if alloc_buddy_huge_page() succeeds we don't
decrement h->resv_huge_pages, which means that successful
hugetlb_fault() returns without releasing the reserve count. As a
result, subsequent hugetlb_fault() might fail despite that there are
still free hugepages.
This patch simply adds decrementing code on that code path.
I reproduced this problem when testing v4.3 kernel in the following situation:
- the test machine/VM is a NUMA system,
- hugepage overcommiting is enabled,
- most of hugepages are allocated and there's only one free hugepage
which is on node 0 (for example),
- another program, which calls set_mempolicy(MPOL_BIND) to bind itself to
node 1, tries to allocate a hugepage,
- the allocation should fail but the reserve count is still hold.
Signed-off-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Cc: David Rientjes <rientjes@google.com>
Cc: Dave Hansen <dave.hansen@intel.com>
Cc: Mel Gorman <mgorman@suse.de>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Hillf Danton <hillf.zj@alibaba-inc.com>
Cc: Mike Kravetz <mike.kravetz@oracle.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[ luis: backported to 3.16:
- use 'chg' instead of 'gbl_chg'
- adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
mm/hugetlb.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index f3111955b701..b247049b534a 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -1398,7 +1398,10 @@ static struct page *alloc_huge_page(struct vm_area_struct *vma,
page = alloc_buddy_huge_page(h, NUMA_NO_NODE);
if (!page)
goto out_uncharge_cgroup;
-
+ if (!avoid_reserve && vma_has_reserves(vma, chg)) {
+ SetPagePrivate(page);
+ h->resv_huge_pages--;
+ }
spin_lock(&hugetlb_lock);
list_move(&page->lru, &h->hugepage_activelist);
/* Fall through */
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 043/128] mm, vmstat: allow WQ concurrency to discover memory reclaim doesn't make any progress
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (41 preceding siblings ...)
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 042/128] mm: hugetlb: fix hugepage memory leak caused by wrong reserve count Luis Henriques
@ 2016-01-24 21:59 ` Luis Henriques
2016-01-24 22:14 ` Ben Hutchings
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 044/128] mm: hugetlb: call huge_pte_alloc() only if ptep is null Luis Henriques
` (85 subsequent siblings)
128 siblings, 1 reply; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 21:59 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Michal Hocko, Tejun Heo, Cristopher Lameter, Joonsoo Kim,
Arkadiusz Miskiewicz, Andrew Morton, Linus Torvalds,
Ben Hutchings, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Michal Hocko <mhocko@suse.com>
commit 373ccbe5927034b55bdc80b0f8b54d6e13fe8d12 upstream.
Tetsuo Handa has reported that the system might basically livelock in
OOM condition without triggering the OOM killer.
The issue is caused by internal dependency of the direct reclaim on
vmstat counter updates (via zone_reclaimable) which are performed from
the workqueue context. If all the current workers get assigned to an
allocation request, though, they will be looping inside the allocator
trying to reclaim memory but zone_reclaimable can see stalled numbers so
it will consider a zone reclaimable even though it has been scanned way
too much. WQ concurrency logic will not consider this situation as a
congested workqueue because it relies that worker would have to sleep in
such a situation. This also means that it doesn't try to spawn new
workers or invoke the rescuer thread if the one is assigned to the
queue.
In order to fix this issue we need to do two things. First we have to
let wq concurrency code know that we are in trouble so we have to do a
short sleep. In order to prevent from issues handled by 0e093d99763e
("writeback: do not sleep on the congestion queue if there are no
congested BDIs or if significant congestion is not being encountered in
the current zone") we limit the sleep only to worker threads which are
the ones of the interest anyway.
The second thing to do is to create a dedicated workqueue for vmstat and
mark it WQ_MEM_RECLAIM to note it participates in the reclaim and to
have a spare worker thread for it.
Signed-off-by: Michal Hocko <mhocko@suse.com>
Reported-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Cc: Tejun Heo <tj@kernel.org>
Cc: Cristopher Lameter <clameter@sgi.com>
Cc: Joonsoo Kim <js1304@gmail.com>
Cc: Arkadiusz Miskiewicz <arekm@maven.pl>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Ben Hutchings <ben@decadent.org.uk>
[ luis: backported to 3.16, based on Ben's backport to 3.2:
- use schedule_delayed_work instead of queue_delayed_work_on function
vmstat_update()
- change start_cpu_timer() instead of vmstat_shepherd()
- adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
mm/backing-dev.c | 19 ++++++++++++++++---
mm/vmstat.c | 6 ++++--
2 files changed, 20 insertions(+), 5 deletions(-)
diff --git a/mm/backing-dev.c b/mm/backing-dev.c
index 1706cbbdf5f0..035be81fb150 100644
--- a/mm/backing-dev.c
+++ b/mm/backing-dev.c
@@ -611,8 +611,9 @@ EXPORT_SYMBOL(congestion_wait);
* jiffies for either a BDI to exit congestion of the given @sync queue
* or a write to complete.
*
- * In the absence of zone congestion, cond_resched() is called to yield
- * the processor if necessary but otherwise does not sleep.
+ * In the absence of zone congestion, a short sleep or a cond_resched is
+ * performed to yield the processor and to allow other subsystems to make
+ * a forward progress.
*
* The return value is 0 if the sleep is for the full timeout. Otherwise,
* it is the number of jiffies that were still remaining when the function
@@ -632,7 +633,19 @@ long wait_iff_congested(struct zone *zone, int sync, long timeout)
*/
if (atomic_read(&nr_bdi_congested[sync]) == 0 ||
!zone_is_reclaim_congested(zone)) {
- cond_resched();
+
+ /*
+ * Memory allocation/reclaim might be called from a WQ
+ * context and the current implementation of the WQ
+ * concurrency control doesn't recognize that a particular
+ * WQ is congested if the worker thread is looping without
+ * ever sleeping. Therefore we have to do a short sleep
+ * here rather than calling cond_resched().
+ */
+ if (current->flags & PF_WQ_WORKER)
+ schedule_timeout(1);
+ else
+ cond_resched();
/* In case we scheduled, work out time remaining */
ret = timeout - (jiffies - start);
diff --git a/mm/vmstat.c b/mm/vmstat.c
index b37bd49bfd55..7e913ba2b9e0 100644
--- a/mm/vmstat.c
+++ b/mm/vmstat.c
@@ -1226,13 +1226,14 @@ static const struct file_operations proc_vmstat_file_operations = {
#endif /* CONFIG_PROC_FS */
#ifdef CONFIG_SMP
+static struct workqueue_struct *vmstat_wq;
static DEFINE_PER_CPU(struct delayed_work, vmstat_work);
int sysctl_stat_interval __read_mostly = HZ;
static void vmstat_update(struct work_struct *w)
{
refresh_cpu_vm_stats();
- schedule_delayed_work(this_cpu_ptr(&vmstat_work),
+ queue_delayed_work(vmstat_wq, this_cpu_ptr(&vmstat_work),
round_jiffies_relative(sysctl_stat_interval));
}
@@ -1241,7 +1242,7 @@ static void start_cpu_timer(int cpu)
struct delayed_work *work = &per_cpu(vmstat_work, cpu);
INIT_DEFERRABLE_WORK(work, vmstat_update);
- schedule_delayed_work_on(cpu, work, __round_jiffies_relative(HZ, cpu));
+ queue_delayed_work_on(cpu, vmstat_wq, work, __round_jiffies_relative(HZ, cpu));
}
static void vmstat_cpu_dead(int node)
@@ -1312,6 +1313,7 @@ static int __init setup_vmstat(void)
node_set_state(cpu_to_node(cpu), N_CPU);
}
cpu_notifier_register_done();
+ vmstat_wq = alloc_workqueue("vmstat", WQ_FREEZABLE|WQ_MEM_RECLAIM, 0);
#endif
#ifdef CONFIG_PROC_FS
proc_create("buddyinfo", S_IRUGO, NULL, &fragmentation_file_operations);
^ permalink raw reply related [flat|nested] 136+ messages in thread* Re: [PATCH 3.16.y-ckt 043/128] mm, vmstat: allow WQ concurrency to discover memory reclaim doesn't make any progress
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 043/128] mm, vmstat: allow WQ concurrency to discover memory reclaim doesn't make any progress Luis Henriques
@ 2016-01-24 22:14 ` Ben Hutchings
2016-01-25 10:53 ` Luis Henriques
0 siblings, 1 reply; 136+ messages in thread
From: Ben Hutchings @ 2016-01-24 22:14 UTC (permalink / raw)
To: Luis Henriques, linux-kernel, stable, kernel-team
Cc: Michal Hocko, Tejun Heo, Cristopher Lameter, Joonsoo Kim,
Arkadiusz Miskiewicz, Andrew Morton, Linus Torvalds
[-- Attachment #1: Type: text/plain, Size: 730 bytes --]
On Sun, 2016-01-24 at 21:59 +0000, Luis Henriques wrote:
> 3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
>
> ---8<------------------------------------------------------------
>
> From: Michal Hocko <mhocko@suse.com>
>
> commit 373ccbe5927034b55bdc80b0f8b54d6e13fe8d12 upstream.
[...]
> [ luis: backported to 3.16, based on Ben's backport to 3.2:
> - use schedule_delayed_work instead of queue_delayed_work_on function
> vmstat_update()
[...]
You're (correctly) changing it to use queue_delayed_work(), not
schedule_delayed_work() as it previously did.
Ben.
--
Ben Hutchings
Time is nature's way of making sure that everything doesn't happen at once.
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 811 bytes --]
^ permalink raw reply [flat|nested] 136+ messages in thread
* Re: [PATCH 3.16.y-ckt 043/128] mm, vmstat: allow WQ concurrency to discover memory reclaim doesn't make any progress
2016-01-24 22:14 ` Ben Hutchings
@ 2016-01-25 10:53 ` Luis Henriques
0 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-25 10:53 UTC (permalink / raw)
To: Ben Hutchings
Cc: linux-kernel, stable, kernel-team, Michal Hocko, Tejun Heo,
Cristopher Lameter, Joonsoo Kim, Arkadiusz Miskiewicz,
Andrew Morton, Linus Torvalds
On Sun, Jan 24, 2016 at 10:14:37PM +0000, Ben Hutchings wrote:
> On Sun, 2016-01-24 at 21:59 +0000, Luis Henriques wrote:
> > 3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
> >
> > ---8<------------------------------------------------------------
> >
> > From: Michal Hocko <mhocko@suse.com>
> >
> > commit 373ccbe5927034b55bdc80b0f8b54d6e13fe8d12 upstream.
> [...]
> > [ luis: backported to 3.16, based on Ben's backport to 3.2:
> > - use schedule_delayed_work instead of queue_delayed_work_on function
> > vmstat_update()
> [...]
>
> You're (correctly) changing it to use queue_delayed_work(), not
> schedule_delayed_work() as it previously did.
>
Ups, that's correct. I'll fix this note. Thanks Ben.
Cheers,
--
Luís
> Ben.
>
> --
> Ben Hutchings
> Time is nature's way of making sure that everything doesn't happen at once.
^ permalink raw reply [flat|nested] 136+ messages in thread
* Re: [PATCH 3.16.y-ckt 043/128] mm, vmstat: allow WQ concurrency to discover memory reclaim doesn't make any progress
@ 2016-01-25 10:53 ` Luis Henriques
0 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-25 10:53 UTC (permalink / raw)
To: Ben Hutchings
Cc: linux-kernel, stable, kernel-team, Michal Hocko, Tejun Heo,
Cristopher Lameter, Joonsoo Kim, Arkadiusz Miskiewicz,
Andrew Morton, Linus Torvalds
On Sun, Jan 24, 2016 at 10:14:37PM +0000, Ben Hutchings wrote:
> On Sun, 2016-01-24 at 21:59 +0000, Luis Henriques wrote:
> > 3.16.7-ckt23 -stable review patch.��If anyone has any objections, please let me know.
> >
> > ---8<------------------------------------------------------------
> >
> > From: Michal Hocko <mhocko@suse.com>
> >
> > commit 373ccbe5927034b55bdc80b0f8b54d6e13fe8d12 upstream.
> [...]
> > [ luis: backported to 3.16, based on Ben's backport to 3.2:
> > � - use schedule_delayed_work instead of queue_delayed_work_on function
> > ����vmstat_update()
> [...]
>
> You're (correctly) changing it to use queue_delayed_work(), not
> schedule_delayed_work() as it previously did.
>
Ups, that's correct. I'll fix this note. Thanks Ben.
Cheers,
--
Lu�s
> Ben.
>
> --
> Ben Hutchings
> Time is nature's way of making sure that everything doesn't happen at once.
^ permalink raw reply [flat|nested] 136+ messages in thread
* [PATCH 3.16.y-ckt 044/128] mm: hugetlb: call huge_pte_alloc() only if ptep is null
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (42 preceding siblings ...)
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 043/128] mm, vmstat: allow WQ concurrency to discover memory reclaim doesn't make any progress Luis Henriques
@ 2016-01-24 21:59 ` Luis Henriques
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 045/128] drivers/base/memory.c: prohibit offlining of memory blocks with missing sections Luis Henriques
` (84 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 21:59 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Naoya Horiguchi, Hugh Dickins, Dave Hansen, Mel Gorman,
Joonsoo Kim, Mike Kravetz, Andrew Morton, Linus Torvalds,
Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
commit 0d777df5d8953293be090d9ab5a355db893e8357 upstream.
Currently at the beginning of hugetlb_fault(), we call huge_pte_offset()
and check whether the obtained *ptep is a migration/hwpoison entry or
not. And if not, then we get to call huge_pte_alloc(). This is racy
because the *ptep could turn into migration/hwpoison entry after the
huge_pte_offset() check. This race results in BUG_ON in
huge_pte_alloc().
We don't have to call huge_pte_alloc() when the huge_pte_offset()
returns non-NULL, so let's fix this bug with moving the code into else
block.
Note that the *ptep could turn into a migration/hwpoison entry after
this block, but that's not a problem because we have another
!pte_present check later (we never go into hugetlb_no_page() in that
case.)
Fixes: 290408d4a250 ("hugetlb: hugepage migration core")
Signed-off-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Acked-by: Hillf Danton <hillf.zj@alibaba-inc.com>
Acked-by: David Rientjes <rientjes@google.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Dave Hansen <dave.hansen@intel.com>
Cc: Mel Gorman <mgorman@suse.de>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Mike Kravetz <mike.kravetz@oracle.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
mm/hugetlb.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index b247049b534a..c83332d80152 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -3170,12 +3170,12 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
} else if (unlikely(is_hugetlb_entry_hwpoisoned(entry)))
return VM_FAULT_HWPOISON_LARGE |
VM_FAULT_SET_HINDEX(hstate_index(h));
+ } else {
+ ptep = huge_pte_alloc(mm, address, huge_page_size(h));
+ if (!ptep)
+ return VM_FAULT_OOM;
}
- ptep = huge_pte_alloc(mm, address, huge_page_size(h));
- if (!ptep)
- return VM_FAULT_OOM;
-
mapping = vma->vm_file->f_mapping;
idx = vma_hugecache_offset(h, vma, address);
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 045/128] drivers/base/memory.c: prohibit offlining of memory blocks with missing sections
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (43 preceding siblings ...)
2016-01-24 21:59 ` [PATCH 3.16.y-ckt 044/128] mm: hugetlb: call huge_pte_alloc() only if ptep is null Luis Henriques
@ 2016-01-24 22:00 ` Luis Henriques
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 046/128] ocfs2: fix SGID not inherited issue Luis Henriques
` (83 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:00 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Seth Jennings, Daniel J Blueman, Yinghai Lu, Greg KH,
Russ Anderson, Andrew Morton, Linus Torvalds, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Seth Jennings <sjennings@variantweb.net>
commit 26bbe7ef6d5cdc7ec08cba6d433fca4060f258f3 upstream.
Commit bdee237c0343 ("x86: mm: Use 2GB memory block size on large-memory
x86-64 systems") and 982792c782ef ("x86, mm: probe memory block size for
generic x86 64bit") introduced large block sizes for x86. This made it
possible to have multiple sections per memory block where previously,
there was a only every one section per block.
Since blocks consist of contiguous ranges of section, there can be holes
in the blocks where sections are not present. If one attempts to
offline such a block, a crash occurs since the code is not designed to
deal with this.
This patch is a quick fix to gaurd against the crash by not allowing
blocks with non-present sections to be offlined.
Addresses https://bugzilla.kernel.org/show_bug.cgi?id=107781
Signed-off-by: Seth Jennings <sjennings@variantweb.net>
Reported-by: Andrew Banman <abanman@sgi.com>
Cc: Daniel J Blueman <daniel@numascale.com>
Cc: Yinghai Lu <yinghai@kernel.org>
Cc: Greg KH <greg@kroah.com>
Cc: Russ Anderson <rja@sgi.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/base/memory.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/base/memory.c b/drivers/base/memory.c
index 89f752dd8465..0b5c02ab1ef0 100644
--- a/drivers/base/memory.c
+++ b/drivers/base/memory.c
@@ -301,6 +301,10 @@ static int memory_subsys_offline(struct device *dev)
if (mem->state == MEM_OFFLINE)
return 0;
+ /* Can't offline block with non-present sections */
+ if (mem->section_count != sections_per_block)
+ return -EINVAL;
+
return memory_block_change_state(mem, MEM_OFFLINE, MEM_ONLINE);
}
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 046/128] ocfs2: fix SGID not inherited issue
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (44 preceding siblings ...)
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 045/128] drivers/base/memory.c: prohibit offlining of memory blocks with missing sections Luis Henriques
@ 2016-01-24 22:00 ` Luis Henriques
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 047/128] sh64: fix __NR_fgetxattr Luis Henriques
` (82 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:00 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Junxiao Bi, Mark Fasheh, Joel Becker, Andrew Morton,
Linus Torvalds, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Junxiao Bi <junxiao.bi@oracle.com>
commit 854ee2e944b4daf795e32562a7d2f9e90ab5a6a8 upstream.
Commit 8f1eb48758aa ("ocfs2: fix umask ignored issue") introduced an
issue, SGID of sub dir was not inherited from its parents dir. It is
because SGID is set into "inode->i_mode" in ocfs2_get_init_inode(), but
is overwritten by "mode" which don't have SGID set later.
Fixes: 8f1eb48758aa ("ocfs2: fix umask ignored issue")
Signed-off-by: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Mark Fasheh <mfasheh@suse.de>
Cc: Joel Becker <jlbec@evilplan.org>
Acked-by: Srinivas Eeda <srinivas.eeda@oracle.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
fs/ocfs2/namei.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c
index dbf21ca69ee8..e2f3a6c5224f 100644
--- a/fs/ocfs2/namei.c
+++ b/fs/ocfs2/namei.c
@@ -356,13 +356,11 @@ static int ocfs2_mknod(struct inode *dir,
goto leave;
}
- status = posix_acl_create(dir, &mode, &default_acl, &acl);
+ status = posix_acl_create(dir, &inode->i_mode, &default_acl, &acl);
if (status) {
mlog_errno(status);
goto leave;
}
- /* update inode->i_mode after mask with "umask". */
- inode->i_mode = mode;
handle = ocfs2_start_trans(osb, ocfs2_mknod_credits(osb->sb,
S_ISDIR(mode),
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 047/128] sh64: fix __NR_fgetxattr
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (45 preceding siblings ...)
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 046/128] ocfs2: fix SGID not inherited issue Luis Henriques
@ 2016-01-24 22:00 ` Luis Henriques
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 048/128] usb: musb: USB_TI_CPPI41_DMA requires dmaengine support Luis Henriques
` (81 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:00 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Dmitry V . Levin, Andrew Morton, Linus Torvalds, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: "Dmitry V. Levin" <ldv@altlinux.org>
commit 2d33fa1059da4c8e816627a688d950b613ec0474 upstream.
According to arch/sh/kernel/syscalls_64.S and common sense, __NR_fgetxattr
has to be defined to 259, but it doesn't. Instead, it's defined to 269,
which is of course used by another syscall, __NR_sched_setaffinity in this
case.
This bug was found by strace test suite.
Signed-off-by: Dmitry V. Levin <ldv@altlinux.org>
Acked-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
arch/sh/include/uapi/asm/unistd_64.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/sh/include/uapi/asm/unistd_64.h b/arch/sh/include/uapi/asm/unistd_64.h
index e6820c86e8c7..47ebd5b5ed55 100644
--- a/arch/sh/include/uapi/asm/unistd_64.h
+++ b/arch/sh/include/uapi/asm/unistd_64.h
@@ -278,7 +278,7 @@
#define __NR_fsetxattr 256
#define __NR_getxattr 257
#define __NR_lgetxattr 258
-#define __NR_fgetxattr 269
+#define __NR_fgetxattr 259
#define __NR_listxattr 260
#define __NR_llistxattr 261
#define __NR_flistxattr 262
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 048/128] usb: musb: USB_TI_CPPI41_DMA requires dmaengine support
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (46 preceding siblings ...)
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 047/128] sh64: fix __NR_fgetxattr Luis Henriques
@ 2016-01-24 22:00 ` Luis Henriques
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 049/128] efi: Disable interrupts around EFI calls, not in the epilog/prolog calls Luis Henriques
` (80 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:00 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Arnd Bergmann, Felipe Balbi, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Arnd Bergmann <arnd@arndb.de>
commit 183e53e8ddf4165c3763181682189362d6b403f7 upstream.
The CPPI-4.1 driver selects TI_CPPI41, which is a dmaengine
driver and that may not be available when CONFIG_DMADEVICES
is not set:
warning: (USB_TI_CPPI41_DMA) selects TI_CPPI41 which has unmet direct dependencies (DMADEVICES && ARCH_OMAP)
This adds an extra dependency to avoid generating warnings in randconfig
builds. Ideally we'd remove the 'select' statement, but that has the
potential to break defconfig files.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Fixes: 411dd19c682d ("usb: musb: Kconfig: Select the DMA driver if DMA mode of MUSB is enabled")
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/usb/musb/Kconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/usb/musb/Kconfig b/drivers/usb/musb/Kconfig
index 06cc5d6ea681..dbc56eb5eee4 100644
--- a/drivers/usb/musb/Kconfig
+++ b/drivers/usb/musb/Kconfig
@@ -140,7 +140,7 @@ config USB_TI_CPPI_DMA
config USB_TI_CPPI41_DMA
bool 'TI CPPI 4.1 (AM335x)'
- depends on ARCH_OMAP
+ depends on ARCH_OMAP && DMADEVICES
select TI_CPPI41
config USB_TUSB_OMAP_DMA
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 049/128] efi: Disable interrupts around EFI calls, not in the epilog/prolog calls
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (47 preceding siblings ...)
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 048/128] usb: musb: USB_TI_CPPI41_DMA requires dmaengine support Luis Henriques
@ 2016-01-24 22:00 ` Luis Henriques
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 050/128] MIPS: uaccess: Take EVA into account in __copy_from_user() Luis Henriques
` (79 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:00 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Ingo Molnar, Matt Fleming, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Ingo Molnar <mingo@kernel.org>
commit 23a0d4e8fa6d3a1d7fb819f79bcc0a3739c30ba9 upstream.
Tapasweni Pathak reported that we do a kmalloc() in efi_call_phys_prolog()
on x86-64 while having interrupts disabled, which is a big no-no, as
kmalloc() can sleep.
Solve this by removing the irq disabling from the prolog/epilog calls
around EFI calls: it's unnecessary, as in this stage we are single
threaded in the boot thread, and we don't ever execute this from
interrupt contexts.
Reported-by: Tapasweni Pathak <tapaswenipathak@gmail.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Matt Fleming <matt.fleming@intel.com>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
arch/x86/platform/efi/efi.c | 7 +++++++
arch/x86/platform/efi/efi_32.c | 11 +++--------
arch/x86/platform/efi/efi_64.c | 3 ---
3 files changed, 10 insertions(+), 11 deletions(-)
diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
index 5bbb477f5c2a..09c8ac286cd5 100644
--- a/arch/x86/platform/efi/efi.c
+++ b/arch/x86/platform/efi/efi.c
@@ -236,12 +236,19 @@ static efi_status_t __init phys_efi_set_virtual_address_map(
efi_memory_desc_t *virtual_map)
{
efi_status_t status;
+ unsigned long flags;
efi_call_phys_prelog();
+
+ /* Disable interrupts around EFI calls: */
+ local_irq_save(flags);
status = efi_call_phys(efi_phys.set_virtual_address_map,
memory_map_size, descriptor_size,
descriptor_version, virtual_map);
+ local_irq_restore(flags);
+
efi_call_phys_epilog();
+
return status;
}
diff --git a/arch/x86/platform/efi/efi_32.c b/arch/x86/platform/efi/efi_32.c
index 9ee3491e31fb..be4e7eb41674 100644
--- a/arch/x86/platform/efi/efi_32.c
+++ b/arch/x86/platform/efi/efi_32.c
@@ -33,11 +33,10 @@
/*
* To make EFI call EFI runtime service in physical addressing mode we need
- * prelog/epilog before/after the invocation to disable interrupt, to
- * claim EFI runtime service handler exclusively and to duplicate a memory in
- * low memory space say 0 - 3G.
+ * prolog/epilog before/after the invocation to claim the EFI runtime service
+ * handler exclusively and to duplicate a memory mapping in low memory space,
+ * say 0 - 3G.
*/
-static unsigned long efi_rt_eflags;
void efi_sync_low_kernel_mappings(void) {}
void __init efi_dump_pagetable(void) {}
@@ -59,8 +58,6 @@ void efi_call_phys_prelog(void)
{
struct desc_ptr gdt_descr;
- local_irq_save(efi_rt_eflags);
-
load_cr3(initial_page_table);
__flush_tlb_all();
@@ -79,8 +76,6 @@ void efi_call_phys_epilog(void)
load_cr3(swapper_pg_dir);
__flush_tlb_all();
-
- local_irq_restore(efi_rt_eflags);
}
void __init efi_runtime_mkexec(void)
diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c
index 290d397e1dd9..8139b4858403 100644
--- a/arch/x86/platform/efi/efi_64.c
+++ b/arch/x86/platform/efi/efi_64.c
@@ -42,7 +42,6 @@
#include <asm/time.h>
static pgd_t *save_pgd __initdata;
-static unsigned long efi_flags __initdata;
/*
* We allocate runtime services regions bottom-up, starting from -4G, i.e.
@@ -89,7 +88,6 @@ void __init efi_call_phys_prelog(void)
return;
early_code_mapping_set_exec(1);
- local_irq_save(efi_flags);
n_pgds = DIV_ROUND_UP((max_pfn << PAGE_SHIFT), PGDIR_SIZE);
save_pgd = kmalloc(n_pgds * sizeof(pgd_t), GFP_KERNEL);
@@ -117,7 +115,6 @@ void __init efi_call_phys_epilog(void)
set_pgd(pgd_offset_k(pgd * PGDIR_SIZE), save_pgd[pgd]);
kfree(save_pgd);
__flush_tlb_all();
- local_irq_restore(efi_flags);
early_code_mapping_set_exec(0);
}
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 050/128] MIPS: uaccess: Take EVA into account in __copy_from_user()
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (48 preceding siblings ...)
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 049/128] efi: Disable interrupts around EFI calls, not in the epilog/prolog calls Luis Henriques
@ 2016-01-24 22:00 ` Luis Henriques
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 051/128] MIPS: uaccess: Take EVA into account in [__]clear_user Luis Henriques
` (78 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:00 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: James Hogan, Markos Chandras, Paul Burton, Leonid Yegoshin,
linux-mips, Ralf Baechle, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: James Hogan <james.hogan@imgtec.com>
commit 6f06a2c45d8d714ea3b11a360b4a7191e52acaa4 upstream.
When EVA is in use, __copy_from_user() was unconditionally using the EVA
instructions to read the user address space, however this can also be
used for kernel access. If the address isn't a valid user address it
will cause an address error or TLB exception, and if it is then user
memory may be read instead of kernel memory.
For example in the following stack trace from Linux v3.10 (changes since
then will prevent this particular one still happening) kernel_sendmsg()
set the user address limit to KERNEL_DS, and tcp_sendmsg() goes on to
use __copy_from_user() with a kernel address in KSeg0.
[<8002d434>] __copy_fromuser_common+0x10c/0x254
[<805710e0>] tcp_sendmsg+0x5f4/0xf00
[<804e8e3c>] sock_sendmsg+0x78/0xa0
[<804e8f28>] kernel_sendmsg+0x24/0x38
[<804ee0f8>] sock_no_sendpage+0x70/0x7c
[<8017c820>] pipe_to_sendpage+0x80/0x98
[<8017c6b0>] splice_from_pipe_feed+0xa8/0x198
[<8017cc54>] __splice_from_pipe+0x4c/0x8c
[<8017e844>] splice_from_pipe+0x58/0x78
[<8017e884>] generic_splice_sendpage+0x20/0x2c
[<8017d690>] do_splice_from+0xb4/0x110
[<8017d710>] direct_splice_actor+0x24/0x30
[<8017d394>] splice_direct_to_actor+0xd8/0x208
[<8017d51c>] do_splice_direct+0x58/0x7c
[<8014eaf4>] do_sendfile+0x1dc/0x39c
[<8014f82c>] SyS_sendfile+0x90/0xf8
Add the eva_kernel_access() check in __copy_from_user() like the one in
copy_from_user().
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Cc: Markos Chandras <markos.chandras@imgtec.com>
Cc: Paul Burton <paul.burton@imgtec.com>
Cc: Leonid Yegoshin <leonid.yegoshin@imgtec.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/10843/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
[james.hogan@imgtec.com: backport]
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
arch/mips/include/asm/uaccess.h | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/arch/mips/include/asm/uaccess.h b/arch/mips/include/asm/uaccess.h
index b9ab717e3619..81d4d7e012ca 100644
--- a/arch/mips/include/asm/uaccess.h
+++ b/arch/mips/include/asm/uaccess.h
@@ -1092,9 +1092,15 @@ extern size_t __copy_in_user_eva(void *__to, const void *__from, size_t __n);
__cu_to = (to); \
__cu_from = (from); \
__cu_len = (n); \
- might_fault(); \
- __cu_len = __invoke_copy_from_user(__cu_to, __cu_from, \
- __cu_len); \
+ if (segment_eq(get_fs(), get_ds())) { \
+ __cu_len = __invoke_copy_from_kernel(__cu_to, \
+ __cu_from, \
+ __cu_len); \
+ } else { \
+ might_fault(); \
+ __cu_len = __invoke_copy_from_user(__cu_to, __cu_from, \
+ __cu_len); \
+ } \
__cu_len; \
})
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 051/128] MIPS: uaccess: Take EVA into account in [__]clear_user
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (49 preceding siblings ...)
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 050/128] MIPS: uaccess: Take EVA into account in __copy_from_user() Luis Henriques
@ 2016-01-24 22:00 ` Luis Henriques
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 052/128] tools: Add a "make all" rule Luis Henriques
` (77 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:00 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: James Hogan, Markos Chandras, Paul Burton, Leonid Yegoshin,
linux-mips, Ralf Baechle, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: James Hogan <james.hogan@imgtec.com>
commit d6a428fb583738ad685c91a684748cdee7b2a05f upstream.
__clear_user() (and clear_user() which uses it), always access the user
mode address space, which results in EVA store instructions when EVA is
enabled even if the current user address limit is KERNEL_DS.
Fix this by adding a new symbol __bzero_kernel for the normal kernel
address space bzero in EVA mode, and call that from __clear_user() if
eva_kernel_access().
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Cc: Markos Chandras <markos.chandras@imgtec.com>
Cc: Paul Burton <paul.burton@imgtec.com>
Cc: Leonid Yegoshin <leonid.yegoshin@imgtec.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/10844/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
[james.hogan@imgtec.com: backport]
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
arch/mips/include/asm/uaccess.h | 32 ++++++++++++++++++++++----------
arch/mips/kernel/mips_ksyms.c | 2 ++
arch/mips/lib/memset.S | 2 ++
3 files changed, 26 insertions(+), 10 deletions(-)
diff --git a/arch/mips/include/asm/uaccess.h b/arch/mips/include/asm/uaccess.h
index 81d4d7e012ca..681331257bac 100644
--- a/arch/mips/include/asm/uaccess.h
+++ b/arch/mips/include/asm/uaccess.h
@@ -1204,16 +1204,28 @@ __clear_user(void __user *addr, __kernel_size_t size)
{
__kernel_size_t res;
- might_fault();
- __asm__ __volatile__(
- "move\t$4, %1\n\t"
- "move\t$5, $0\n\t"
- "move\t$6, %2\n\t"
- __MODULE_JAL(__bzero)
- "move\t%0, $6"
- : "=r" (res)
- : "r" (addr), "r" (size)
- : "$4", "$5", "$6", __UA_t0, __UA_t1, "$31");
+ if (config_enabled(CONFIG_EVA) && segment_eq(get_fs(), get_ds())) {
+ __asm__ __volatile__(
+ "move\t$4, %1\n\t"
+ "move\t$5, $0\n\t"
+ "move\t$6, %2\n\t"
+ __MODULE_JAL(__bzero_kernel)
+ "move\t%0, $6"
+ : "=r" (res)
+ : "r" (addr), "r" (size)
+ : "$4", "$5", "$6", __UA_t0, __UA_t1, "$31");
+ } else {
+ might_fault();
+ __asm__ __volatile__(
+ "move\t$4, %1\n\t"
+ "move\t$5, $0\n\t"
+ "move\t$6, %2\n\t"
+ __MODULE_JAL(__bzero)
+ "move\t%0, $6"
+ : "=r" (res)
+ : "r" (addr), "r" (size)
+ : "$4", "$5", "$6", __UA_t0, __UA_t1, "$31");
+ }
return res;
}
diff --git a/arch/mips/kernel/mips_ksyms.c b/arch/mips/kernel/mips_ksyms.c
index 1b2452e2be67..c1e152a27b17 100644
--- a/arch/mips/kernel/mips_ksyms.c
+++ b/arch/mips/kernel/mips_ksyms.c
@@ -17,6 +17,7 @@
#include <asm/fpu.h>
#include <asm/msa.h>
+extern void *__bzero_kernel(void *__s, size_t __count);
extern void *__bzero(void *__s, size_t __count);
extern long __strncpy_from_kernel_nocheck_asm(char *__to,
const char *__from, long __len);
@@ -66,6 +67,7 @@ EXPORT_SYMBOL(__copy_from_user_eva);
EXPORT_SYMBOL(__copy_in_user_eva);
EXPORT_SYMBOL(__copy_to_user_eva);
EXPORT_SYMBOL(__copy_user_inatomic_eva);
+EXPORT_SYMBOL(__bzero_kernel);
#endif
EXPORT_SYMBOL(__bzero);
EXPORT_SYMBOL(__strncpy_from_kernel_nocheck_asm);
diff --git a/arch/mips/lib/memset.S b/arch/mips/lib/memset.S
index 7b0e5462ca51..fd83406ceccc 100644
--- a/arch/mips/lib/memset.S
+++ b/arch/mips/lib/memset.S
@@ -238,6 +238,8 @@ LEAF(memset)
1:
#ifndef CONFIG_EVA
FEXPORT(__bzero)
+#else
+FEXPORT(__bzero_kernel)
#endif
__BUILD_BZERO LEGACY_MODE
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 052/128] tools: Add a "make all" rule
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (50 preceding siblings ...)
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 051/128] MIPS: uaccess: Take EVA into account in [__]clear_user Luis Henriques
@ 2016-01-24 22:00 ` Luis Henriques
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 053/128] i2c: mv64xxx: The n clockdiv factor is 0 based on sunxi SoCs Luis Henriques
` (76 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:00 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Kamal Mostafa, Jiri Olsa, Jonathan Cameron, Pali Rohar,
Roberta Dobrescu, Arnaldo Carvalho de Melo, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Kamal Mostafa <kamal@canonical.com>
commit f6ba98c5dc78708cb7fd29950c4a50c4c7e88f95 upstream.
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Acked-by: Pavel Machek <pavel@ucw.cz>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Jonathan Cameron <jic23@kernel.org>
Cc: Pali Rohar <pali.rohar@gmail.com>
Cc: Roberta Dobrescu <roberta.dobrescu@gmail.com>
Link: http://lkml.kernel.org/r/1447280736-2161-2-git-send-email-kamal@canonical.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
[ kamal: backport to 3.16-stable: build all tools for this version ]
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
tools/Makefile | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/tools/Makefile b/tools/Makefile
index 9a617adc6675..f0fd70a5bd68 100644
--- a/tools/Makefile
+++ b/tools/Makefile
@@ -25,6 +25,10 @@ help:
@echo ' from the kernel command line to build and install one of'
@echo ' the tools above'
@echo ''
+ @echo ' $$ make tools/all'
+ @echo ''
+ @echo ' builds all tools.'
+ @echo ''
@echo ' $$ make tools/install'
@echo ''
@echo ' installs all tools.'
@@ -62,6 +66,11 @@ turbostat x86_energy_perf_policy: FORCE
tmon: FORCE
$(call descend,thermal/$@)
+all: acpi cgroup cpupower hv firewire lguest \
+ perf selftests turbostat usb \
+ virtio vm net x86_energy_perf_policy \
+ tmon
+
acpi_install:
$(call descend,power/$(@:_install=),install)
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 053/128] i2c: mv64xxx: The n clockdiv factor is 0 based on sunxi SoCs
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (51 preceding siblings ...)
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 052/128] tools: Add a "make all" rule Luis Henriques
@ 2016-01-24 22:00 ` Luis Henriques
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 054/128] xen/events/fifo: Consume unprocessed events when a CPU dies Luis Henriques
` (75 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:00 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Hans de Goede, Wolfram Sang, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Hans de Goede <hdegoede@redhat.com>
commit bba61f50f76574ca5b84b310925be7c2e8e64275 upstream.
According to the datasheets the n factor for dividing the tclk is
2 to the power n on Allwinner SoCs, not 2 to the power n + 1 as it is
on other mv64xxx implementations.
I've contacted Allwinner about this and they have confirmed that the
datasheet is correct.
This commit fixes the clk-divider calculations for Allwinner SoCs
accordingly.
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Acked-by: Maxime Ripard <maxime.ripard@free-electrons.com>
Tested-by: Olliver Schinagl <oliver@schinagl.nl>
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/i2c/busses/i2c-mv64xxx.c | 27 ++++++++++++++++++---------
1 file changed, 18 insertions(+), 9 deletions(-)
diff --git a/drivers/i2c/busses/i2c-mv64xxx.c b/drivers/i2c/busses/i2c-mv64xxx.c
index 8cc08d4f5f40..82e43656825a 100644
--- a/drivers/i2c/busses/i2c-mv64xxx.c
+++ b/drivers/i2c/busses/i2c-mv64xxx.c
@@ -146,6 +146,8 @@ struct mv64xxx_i2c_data {
bool errata_delay;
struct reset_control *rstc;
bool irq_clear_inverted;
+ /* Clk div is 2 to the power n, not 2 to the power n + 1 */
+ bool clk_n_base_0;
};
static struct mv64xxx_i2c_regs mv64xxx_i2c_regs_mv64xxx = {
@@ -757,25 +759,29 @@ MODULE_DEVICE_TABLE(of, mv64xxx_i2c_of_match_table);
#ifdef CONFIG_OF
#ifdef CONFIG_HAVE_CLK
static int
-mv64xxx_calc_freq(const int tclk, const int n, const int m)
+mv64xxx_calc_freq(struct mv64xxx_i2c_data *drv_data,
+ const int tclk, const int n, const int m)
{
- return tclk / (10 * (m + 1) * (2 << n));
+ if (drv_data->clk_n_base_0)
+ return tclk / (10 * (m + 1) * (1 << n));
+ else
+ return tclk / (10 * (m + 1) * (2 << n));
}
static bool
-mv64xxx_find_baud_factors(const u32 req_freq, const u32 tclk, u32 *best_n,
- u32 *best_m)
+mv64xxx_find_baud_factors(struct mv64xxx_i2c_data *drv_data,
+ const u32 req_freq, const u32 tclk)
{
int freq, delta, best_delta = INT_MAX;
int m, n;
for (n = 0; n <= 7; n++)
for (m = 0; m <= 15; m++) {
- freq = mv64xxx_calc_freq(tclk, n, m);
+ freq = mv64xxx_calc_freq(drv_data, tclk, n, m);
delta = req_freq - freq;
if (delta >= 0 && delta < best_delta) {
- *best_m = m;
- *best_n = n;
+ drv_data->freq_m = m;
+ drv_data->freq_n = n;
best_delta = delta;
}
if (best_delta == 0)
@@ -813,8 +819,11 @@ mv64xxx_of_config(struct mv64xxx_i2c_data *drv_data,
if (of_property_read_u32(np, "clock-frequency", &bus_freq))
bus_freq = 100000; /* 100kHz by default */
- if (!mv64xxx_find_baud_factors(bus_freq, tclk,
- &drv_data->freq_n, &drv_data->freq_m)) {
+ if (of_device_is_compatible(np, "allwinner,sun4i-a10-i2c") ||
+ of_device_is_compatible(np, "allwinner,sun6i-a31-i2c"))
+ drv_data->clk_n_base_0 = true;
+
+ if (!mv64xxx_find_baud_factors(drv_data, bus_freq, tclk)) {
rc = -EINVAL;
goto out;
}
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 054/128] xen/events/fifo: Consume unprocessed events when a CPU dies
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (52 preceding siblings ...)
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 053/128] i2c: mv64xxx: The n clockdiv factor is 0 based on sunxi SoCs Luis Henriques
@ 2016-01-24 22:00 ` Luis Henriques
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 055/128] video: fbdev: fsl: Fix kernel crash when diu_ops is not implemented Luis Henriques
` (74 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:00 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Ross Lagerwall, David Vrabel, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Ross Lagerwall <ross.lagerwall@citrix.com>
commit 3de88d622fd68bd4dbee0f80168218b23f798fd0 upstream.
When a CPU is offlined, there may be unprocessed events on a port for
that CPU. If the port is subsequently reused on a different CPU, it
could be in an unexpected state with the link bit set, resulting in
interrupts being missed. Fix this by consuming any unprocessed events
for a particular CPU when that CPU dies.
Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com>
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/xen/events/events_fifo.c | 23 ++++++++++++++++++-----
1 file changed, 18 insertions(+), 5 deletions(-)
diff --git a/drivers/xen/events/events_fifo.c b/drivers/xen/events/events_fifo.c
index 48dcb2e97b90..e208af22b182 100644
--- a/drivers/xen/events/events_fifo.c
+++ b/drivers/xen/events/events_fifo.c
@@ -281,7 +281,8 @@ static void handle_irq_for_port(unsigned port)
static void consume_one_event(unsigned cpu,
struct evtchn_fifo_control_block *control_block,
- unsigned priority, unsigned long *ready)
+ unsigned priority, unsigned long *ready,
+ bool drop)
{
struct evtchn_fifo_queue *q = &per_cpu(cpu_queue, cpu);
uint32_t head;
@@ -313,13 +314,17 @@ static void consume_one_event(unsigned cpu,
if (head == 0)
clear_bit(priority, ready);
- if (evtchn_fifo_is_pending(port) && !evtchn_fifo_is_masked(port))
- handle_irq_for_port(port);
+ if (evtchn_fifo_is_pending(port) && !evtchn_fifo_is_masked(port)) {
+ if (unlikely(drop))
+ pr_warn("Dropping pending event for port %u\n", port);
+ else
+ handle_irq_for_port(port);
+ }
q->head[priority] = head;
}
-static void evtchn_fifo_handle_events(unsigned cpu)
+static void __evtchn_fifo_handle_events(unsigned cpu, bool drop)
{
struct evtchn_fifo_control_block *control_block;
unsigned long ready;
@@ -331,11 +336,16 @@ static void evtchn_fifo_handle_events(unsigned cpu)
while (ready) {
q = find_first_bit(BM(&ready), EVTCHN_FIFO_MAX_QUEUES);
- consume_one_event(cpu, control_block, q, &ready);
+ consume_one_event(cpu, control_block, q, &ready, drop);
ready |= xchg(&control_block->ready, 0);
}
}
+static void evtchn_fifo_handle_events(unsigned cpu)
+{
+ __evtchn_fifo_handle_events(cpu, false);
+}
+
static void evtchn_fifo_resume(void)
{
unsigned cpu;
@@ -420,6 +430,9 @@ static int evtchn_fifo_cpu_notification(struct notifier_block *self,
if (!per_cpu(cpu_control_block, cpu))
ret = evtchn_fifo_alloc_control_block(cpu);
break;
+ case CPU_DEAD:
+ __evtchn_fifo_handle_events(cpu, true);
+ break;
default:
break;
}
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 055/128] video: fbdev: fsl: Fix kernel crash when diu_ops is not implemented
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (53 preceding siblings ...)
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 054/128] xen/events/fifo: Consume unprocessed events when a CPU dies Luis Henriques
@ 2016-01-24 22:00 ` Luis Henriques
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 056/128] crypto: skcipher - Copy iv from desc even for 0-len walks Luis Henriques
` (73 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:00 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Wang Dongsheng, Tomi Valkeinen, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Wang Dongsheng <dongsheng.wang@freescale.com>
commit acfc1cc13fe5bc6d7a10afa624f1e560850ddad3 upstream.
If diu_ops is not implemented on platform, kernel will access a NULL
pointer. We need to check this pointer in DIU initialization.
Signed-off-by: Wang Dongsheng <dongsheng.wang@freescale.com>
Acked-by: Timur Tabi <timur@tabi.org>
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/video/fbdev/fsl-diu-fb.c | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
diff --git a/drivers/video/fbdev/fsl-diu-fb.c b/drivers/video/fbdev/fsl-diu-fb.c
index e8758b9c3bcc..7b1fa06f4b72 100644
--- a/drivers/video/fbdev/fsl-diu-fb.c
+++ b/drivers/video/fbdev/fsl-diu-fb.c
@@ -479,7 +479,10 @@ static enum fsl_diu_monitor_port fsl_diu_name_to_port(const char *s)
port = FSL_DIU_PORT_DLVDS;
}
- return diu_ops.valid_monitor_port(port);
+ if (diu_ops.valid_monitor_port)
+ port = diu_ops.valid_monitor_port(port);
+
+ return port;
}
/*
@@ -1909,6 +1912,14 @@ static int __init fsl_diu_init(void)
#else
monitor_port = fsl_diu_name_to_port(monitor_string);
#endif
+
+ /*
+ * Must to verify set_pixel_clock. If not implement on platform,
+ * then that means that there is no platform support for the DIU.
+ */
+ if (!diu_ops.set_pixel_clock)
+ return -ENODEV;
+
pr_info("Freescale Display Interface Unit (DIU) framebuffer driver\n");
#ifdef CONFIG_NOT_COHERENT_CACHE
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 056/128] crypto: skcipher - Copy iv from desc even for 0-len walks
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (54 preceding siblings ...)
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 055/128] video: fbdev: fsl: Fix kernel crash when diu_ops is not implemented Luis Henriques
@ 2016-01-24 22:00 ` Luis Henriques
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 057/128] rfkill: copy the name into the rfkill struct Luis Henriques
` (72 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:00 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Jason A . Donenfeld, Herbert Xu, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: "Jason A. Donenfeld" <Jason@zx2c4.com>
commit 70d906bc17500edfa9bdd8c8b7e59618c7911613 upstream.
Some ciphers actually support encrypting zero length plaintexts. For
example, many AEAD modes support this. The resulting ciphertext for
those winds up being only the authentication tag, which is a result of
the key, the iv, the additional data, and the fact that the plaintext
had zero length. The blkcipher constructors won't copy the IV to the
right place, however, when using a zero length input, resulting in
some significant problems when ciphers call their initialization
routines, only to find that the ->iv parameter is uninitialized. One
such example of this would be using chacha20poly1305 with a zero length
input, which then calls chacha20, which calls the key setup routine,
which eventually OOPSes due to the uninitialized ->iv member.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
crypto/ablkcipher.c | 2 +-
crypto/blkcipher.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/crypto/ablkcipher.c b/crypto/ablkcipher.c
index 520729d898fe..f02fdbefb2c6 100644
--- a/crypto/ablkcipher.c
+++ b/crypto/ablkcipher.c
@@ -276,12 +276,12 @@ static int ablkcipher_walk_first(struct ablkcipher_request *req,
if (WARN_ON_ONCE(in_irq()))
return -EDEADLK;
+ walk->iv = req->info;
walk->nbytes = walk->total;
if (unlikely(!walk->total))
return 0;
walk->iv_buffer = NULL;
- walk->iv = req->info;
if (unlikely(((unsigned long)walk->iv & alignmask))) {
int err = ablkcipher_copy_iv(walk, tfm, alignmask);
if (err)
diff --git a/crypto/blkcipher.c b/crypto/blkcipher.c
index 0122bec38564..7180cb2fe026 100644
--- a/crypto/blkcipher.c
+++ b/crypto/blkcipher.c
@@ -325,12 +325,12 @@ static int blkcipher_walk_first(struct blkcipher_desc *desc,
if (WARN_ON_ONCE(in_irq()))
return -EDEADLK;
+ walk->iv = desc->info;
walk->nbytes = walk->total;
if (unlikely(!walk->total))
return 0;
walk->buffer = NULL;
- walk->iv = desc->info;
if (unlikely(((unsigned long)walk->iv & walk->alignmask))) {
int err = blkcipher_copy_iv(walk);
if (err)
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 057/128] rfkill: copy the name into the rfkill struct
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (55 preceding siblings ...)
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 056/128] crypto: skcipher - Copy iv from desc even for 0-len walks Luis Henriques
@ 2016-01-24 22:00 ` Luis Henriques
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 058/128] ses: Fix problems with simple enclosures Luis Henriques
` (71 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:00 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Johannes Berg, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Johannes Berg <johannes.berg@intel.com>
commit b7bb110008607a915298bf0f47d25886ecb94477 upstream.
Some users of rfkill, like NFC and cfg80211, use a dynamic name when
allocating rfkill, in those cases dev_name(). Therefore, the pointer
passed to rfkill_alloc() might not be valid forever, I specifically
found the case that the rfkill name was quite obviously an invalid
pointer (or at least garbage) when the wiphy had been renamed.
Fix this by making a copy of the rfkill name in rfkill_alloc().
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
net/rfkill/core.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/net/rfkill/core.c b/net/rfkill/core.c
index b3b16c070a7f..5307a99c1838 100644
--- a/net/rfkill/core.c
+++ b/net/rfkill/core.c
@@ -49,7 +49,6 @@
struct rfkill {
spinlock_t lock;
- const char *name;
enum rfkill_type type;
unsigned long state;
@@ -73,6 +72,7 @@ struct rfkill {
struct delayed_work poll_work;
struct work_struct uevent_work;
struct work_struct sync_work;
+ char name[];
};
#define to_rfkill(d) container_of(d, struct rfkill, dev)
@@ -862,14 +862,14 @@ struct rfkill * __must_check rfkill_alloc(const char *name,
if (WARN_ON(type == RFKILL_TYPE_ALL || type >= NUM_RFKILL_TYPES))
return NULL;
- rfkill = kzalloc(sizeof(*rfkill), GFP_KERNEL);
+ rfkill = kzalloc(sizeof(*rfkill) + strlen(name) + 1, GFP_KERNEL);
if (!rfkill)
return NULL;
spin_lock_init(&rfkill->lock);
INIT_LIST_HEAD(&rfkill->node);
rfkill->type = type;
- rfkill->name = name;
+ strcpy(rfkill->name, name);
rfkill->ops = ops;
rfkill->data = ops_data;
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 058/128] ses: Fix problems with simple enclosures
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (56 preceding siblings ...)
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 057/128] rfkill: copy the name into the rfkill struct Luis Henriques
@ 2016-01-24 22:00 ` Luis Henriques
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 059/128] Revert "SCSI: Fix NULL pointer dereference in runtime PM" Luis Henriques
` (70 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:00 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: James Bottomley, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: James Bottomley <James.Bottomley@HansenPartnership.com>
commit 3417c1b5cb1fdc10261dbed42b05cc93166a78fd upstream.
Simple enclosure implementations (mostly USB) are allowed to return only
page 8 to every diagnostic query. That really confuses our
implementation because we assume the return is the page we asked for and
end up doing incorrect offsets based on bogus information leading to
accesses outside of allocated ranges. Fix that by checking the page
code of the return and giving an error if it isn't the one we asked for.
This should fix reported bugs with USB storage by simply refusing to
attach to enclosures that behave like this. It's also good defensive
practise now that we're starting to see more USB enclosures.
Reported-by: Andrea Gelmini <andrea.gelmini@gelma.net>
Reviewed-by: Ewan D. Milne <emilne@redhat.com>
Reviewed-by: Tomas Henzl <thenzl@redhat.com>
Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/scsi/ses.c | 20 +++++++++++++++++++-
1 file changed, 19 insertions(+), 1 deletion(-)
diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c
index 80bfece1a2de..20e4335e550b 100644
--- a/drivers/scsi/ses.c
+++ b/drivers/scsi/ses.c
@@ -71,6 +71,7 @@ static int ses_probe(struct device *dev)
static int ses_recv_diag(struct scsi_device *sdev, int page_code,
void *buf, int bufflen)
{
+ int ret;
unsigned char cmd[] = {
RECEIVE_DIAGNOSTIC,
1, /* Set PCV bit */
@@ -79,9 +80,26 @@ static int ses_recv_diag(struct scsi_device *sdev, int page_code,
bufflen & 0xff,
0
};
+ unsigned char recv_page_code;
- return scsi_execute_req(sdev, cmd, DMA_FROM_DEVICE, buf, bufflen,
+ ret = scsi_execute_req(sdev, cmd, DMA_FROM_DEVICE, buf, bufflen,
NULL, SES_TIMEOUT, SES_RETRIES, NULL);
+ if (unlikely(!ret))
+ return ret;
+
+ recv_page_code = ((unsigned char *)buf)[0];
+
+ if (likely(recv_page_code == page_code))
+ return ret;
+
+ /* successful diagnostic but wrong page code. This happens to some
+ * USB devices, just print a message and pretend there was an error */
+
+ sdev_printk(KERN_ERR, sdev,
+ "Wrong diagnostic page; asked for %d got %u\n",
+ page_code, recv_page_code);
+
+ return -EINVAL;
}
static int ses_send_diag(struct scsi_device *sdev, int page_code,
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 059/128] Revert "SCSI: Fix NULL pointer dereference in runtime PM"
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (57 preceding siblings ...)
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 058/128] ses: Fix problems with simple enclosures Luis Henriques
@ 2016-01-24 22:00 ` Luis Henriques
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 060/128] ses: fix additional element traversal bug Luis Henriques
` (69 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:00 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Ken Xue, Xiangliang Yu, James E . J . Bottomley, Jens Axboe,
Michael Terry, Martin K . Petersen, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Ken Xue <ken.xue@amd.com>
commit 1c69d3b6eb73e466ecbb8edaf1bc7fd585b288da upstream.
This reverts commit 49718f0fb8c9 ("SCSI: Fix NULL pointer dereference in
runtime PM")
The old commit may lead to a issue that blk_{pre|post}_runtime_suspend and
blk_{pre|post}_runtime_resume may not be called in pairs.
Take sr device as example, when sr device goes to runtime suspend,
blk_{pre|post}_runtime_suspend will be called since sr device defined
pm->runtime_suspend. But blk_{pre|post}_runtime_resume will not be called
since sr device doesn't have pm->runtime_resume. so, sr device can not
resume correctly anymore.
More discussion can be found from below link.
http://marc.info/?l=linux-scsi&m=144163730531875&w=2
Signed-off-by: Ken Xue <Ken.Xue@amd.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Cc: Xiangliang Yu <Xiangliang.Yu@amd.com>
Cc: James E.J. Bottomley <JBottomley@odin.com>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: Michael Terry <Michael.terry@canonical.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/scsi/scsi_pm.c | 20 ++++++++++----------
1 file changed, 10 insertions(+), 10 deletions(-)
diff --git a/drivers/scsi/scsi_pm.c b/drivers/scsi/scsi_pm.c
index a2dcf6a54ec6..75320dad9677 100644
--- a/drivers/scsi/scsi_pm.c
+++ b/drivers/scsi/scsi_pm.c
@@ -221,13 +221,13 @@ static int sdev_runtime_suspend(struct device *dev)
struct scsi_device *sdev = to_scsi_device(dev);
int err = 0;
- if (pm && pm->runtime_suspend) {
- err = blk_pre_runtime_suspend(sdev->request_queue);
- if (err)
- return err;
+ err = blk_pre_runtime_suspend(sdev->request_queue);
+ if (err)
+ return err;
+ if (pm && pm->runtime_suspend)
err = pm->runtime_suspend(dev);
- blk_post_runtime_suspend(sdev->request_queue, err);
- }
+ blk_post_runtime_suspend(sdev->request_queue, err);
+
return err;
}
@@ -250,11 +250,11 @@ static int sdev_runtime_resume(struct device *dev)
const struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL;
int err = 0;
- if (pm && pm->runtime_resume) {
- blk_pre_runtime_resume(sdev->request_queue);
+ blk_pre_runtime_resume(sdev->request_queue);
+ if (pm && pm->runtime_resume)
err = pm->runtime_resume(dev);
- blk_post_runtime_resume(sdev->request_queue, err);
- }
+ blk_post_runtime_resume(sdev->request_queue, err);
+
return err;
}
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 060/128] ses: fix additional element traversal bug
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (58 preceding siblings ...)
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 059/128] Revert "SCSI: Fix NULL pointer dereference in runtime PM" Luis Henriques
@ 2016-01-24 22:00 ` Luis Henriques
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 061/128] powercap / RAPL: fix BIOS lock check Luis Henriques
` (68 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:00 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: James Bottomley, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: James Bottomley <James.Bottomley@HansenPartnership.com>
commit 5e1033561da1152c57b97ee84371dba2b3d64c25 upstream.
KASAN found that our additional element processing scripts drop off
the end of the VPD page into unallocated space. The reason is that
not every element has additional information but our traversal
routines think they do, leading to them expecting far more additional
information than is present. Fix this by adding a gate to the
traversal routine so that it only processes elements that are expected
to have additional information (list is in SES-2 section 6.1.13.1:
Additional Element Status diagnostic page overview)
Reported-by: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
Tested-by: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/scsi/ses.c | 10 +++++++++-
include/linux/enclosure.h | 4 ++++
2 files changed, 13 insertions(+), 1 deletion(-)
diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c
index 20e4335e550b..6465f8edf713 100644
--- a/drivers/scsi/ses.c
+++ b/drivers/scsi/ses.c
@@ -455,7 +455,15 @@ static void ses_enclosure_data_process(struct enclosure_device *edev,
if (desc_ptr)
desc_ptr += len;
- if (addl_desc_ptr)
+ if (addl_desc_ptr &&
+ /* only find additional descriptions for specific devices */
+ (type_ptr[0] == ENCLOSURE_COMPONENT_DEVICE ||
+ type_ptr[0] == ENCLOSURE_COMPONENT_ARRAY_DEVICE ||
+ type_ptr[0] == ENCLOSURE_COMPONENT_SAS_EXPANDER ||
+ /* these elements are optional */
+ type_ptr[0] == ENCLOSURE_COMPONENT_SCSI_TARGET_PORT ||
+ type_ptr[0] == ENCLOSURE_COMPONENT_SCSI_INITIATOR_PORT ||
+ type_ptr[0] == ENCLOSURE_COMPONENT_CONTROLLER_ELECTRONICS))
addl_desc_ptr += addl_desc_ptr[1] + 2;
}
diff --git a/include/linux/enclosure.h b/include/linux/enclosure.h
index 9a33c5f7e126..f6c229e2bffa 100644
--- a/include/linux/enclosure.h
+++ b/include/linux/enclosure.h
@@ -29,7 +29,11 @@
/* A few generic types ... taken from ses-2 */
enum enclosure_component_type {
ENCLOSURE_COMPONENT_DEVICE = 0x01,
+ ENCLOSURE_COMPONENT_CONTROLLER_ELECTRONICS = 0x07,
+ ENCLOSURE_COMPONENT_SCSI_TARGET_PORT = 0x14,
+ ENCLOSURE_COMPONENT_SCSI_INITIATOR_PORT = 0x15,
ENCLOSURE_COMPONENT_ARRAY_DEVICE = 0x17,
+ ENCLOSURE_COMPONENT_SAS_EXPANDER = 0x18,
};
/* ses-2 common element status */
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 061/128] powercap / RAPL: fix BIOS lock check
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (59 preceding siblings ...)
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 060/128] ses: fix additional element traversal bug Luis Henriques
@ 2016-01-24 22:00 ` Luis Henriques
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 062/128] n_tty: Fix poll() after buffer-limited eof push read Luis Henriques
` (67 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:00 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Prarit Bhargava, Rafael J . Wysocki, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Prarit Bhargava <prarit@redhat.com>
commit 79a21dbfae3cd40d5a801778071a9967b79c2c20 upstream.
Intel RAPL initialized on several systems where the BIOS lock bit (msr
0x610, bit 63) was set. This occured because the return value of
rapl_read_data_raw() was being checked, rather than the value of the variable
passed in, locked.
This patch properly implments the rapl_read_data_raw() call to check the
variable locked, and now the Intel RAPL driver outputs the warning:
intel_rapl: RAPL package 0 domain package locked by BIOS
and does not initialize for the package.
Signed-off-by: Prarit Bhargava <prarit@redhat.com>
Acked-by: Jacob Pan <jacob.jun.pan@linux.intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/powercap/intel_rapl.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/powercap/intel_rapl.c b/drivers/powercap/intel_rapl.c
index a362dcc20ec0..ccb6768a352b 100644
--- a/drivers/powercap/intel_rapl.c
+++ b/drivers/powercap/intel_rapl.c
@@ -1191,10 +1191,13 @@ static int rapl_detect_domains(struct rapl_package *rp, int cpu)
for (rd = rp->domains; rd < rp->domains + rp->nr_domains; rd++) {
/* check if the domain is locked by BIOS */
- if (rapl_read_data_raw(rd, FW_LOCK, false, &locked)) {
+ ret = rapl_read_data_raw(rd, FW_LOCK, false, &locked);
+ if (ret)
+ return ret;
+ if (locked) {
pr_info("RAPL package %d domain %s locked by BIOS\n",
rp->id, rd->name);
- rd->state |= DOMAIN_STATE_BIOS_LOCKED;
+ rd->state |= DOMAIN_STATE_BIOS_LOCKED;
}
}
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 062/128] n_tty: Fix poll() after buffer-limited eof push read
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (60 preceding siblings ...)
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 061/128] powercap / RAPL: fix BIOS lock check Luis Henriques
@ 2016-01-24 22:00 ` Luis Henriques
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 063/128] tty: Fix GPF in flush_to_ldisc() Luis Henriques
` (66 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:00 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Peter Hurley, Greg Kroah-Hartman, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Peter Hurley <peter@hurleysoftware.com>
commit ac8f3bf8832a405cc6e4dccb1d26d5cb2994d234 upstream.
commit 40d5e0905a03 ("n_tty: Fix EOF push handling") fixed EOF push
for reads. However, that approach still allows a condition mismatch
between poll() and read(), where poll() returns POLLIN but read()
blocks. This state can happen when a previous read() returned because
the user buffer was full and the next character was an EOF not at the
beginning of the line. While the next read() will properly identify
the condition and advance the read buffer tail without improperly
indicating an EOF file condition (ie., read() will not mistakenly
return 0), poll() will mistakenly indicate POLLIN.
Although a possible solution would be to peek at the input buffer
in n_tty_poll(), the better solution in this patch is to eat the
EOF during the previous read() (ie., fix the problem by eliminating
the condition).
The current canon line buffer copy limits the scan for next end-of-line
to the smaller of either,
a. the remaining user buffer size
b. completed lines in the input buffer
When the remaining user buffer size is exactly one less than the
end-of-line marked by EOF push, the EOF is not scanned nor skipped
but left for subsequent reads. In the example below, the scan
index 'eol' has stopped at the EOF because it is past the scan
limit of 5 (not because it has found the next set bit in read_flags)
user buffer [*nr = 5] _ _ _ _ _
read_flags 0 0 0 0 0 1
input buffer h e l l o [EOF]
^ ^
/ /
tail eol
result: found = 0, tail += 5, *nr += 5
Instead, allow the scan to peek ahead 1 byte (while still limiting the
scan to completed lines in the input buffer). For the example above,
result: found = 1, tail += 6, *nr += 5
Because the scan limit is now bumped +1 byte, when the scan is
completed, the tail advance and the user buffer copy limit is
re-clamped to *nr when EOF is _not_ found.
Fixes: 40d5e0905a03 ("n_tty: Fix EOF push handling")
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/tty/n_tty.c | 22 +++++++++-------------
1 file changed, 9 insertions(+), 13 deletions(-)
diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
index 29de4bfe5c70..d239fdba29d6 100644
--- a/drivers/tty/n_tty.c
+++ b/drivers/tty/n_tty.c
@@ -2048,13 +2048,13 @@ static int canon_copy_from_read_buf(struct tty_struct *tty,
size_t eol;
size_t tail;
int ret, found = 0;
- bool eof_push = 0;
/* N.B. avoid overrun if nr == 0 */
- n = min(*nr, read_cnt(ldata));
- if (!n)
+ if (!*nr)
return 0;
+ n = min(*nr + 1, read_cnt(ldata));
+
tail = ldata->read_tail & (N_TTY_BUF_SIZE - 1);
size = min_t(size_t, tail + n, N_TTY_BUF_SIZE);
@@ -2075,12 +2075,11 @@ static int canon_copy_from_read_buf(struct tty_struct *tty,
n = eol - tail;
if (n > 4096)
n += 4096;
- n += found;
- c = n;
+ c = n + found;
- if (found && !ldata->push && read_buf(ldata, eol) == __DISABLED_CHAR) {
- n--;
- eof_push = !n && ldata->read_tail != ldata->line_start;
+ if (!found || read_buf(ldata, eol) != __DISABLED_CHAR) {
+ c = min(*nr, c);
+ n = c;
}
n_tty_trace("%s: eol:%zu found:%d n:%zu c:%zu size:%zu more:%zu\n",
@@ -2111,7 +2110,7 @@ static int canon_copy_from_read_buf(struct tty_struct *tty,
ldata->push = 0;
tty_audit_push(tty);
}
- return eof_push ? -EAGAIN : 0;
+ return 0;
}
extern ssize_t redirected_tty_write(struct file *, const char __user *,
@@ -2299,10 +2298,7 @@ static ssize_t n_tty_read(struct tty_struct *tty, struct file *file,
if (ldata->icanon && !L_EXTPROC(tty)) {
retval = canon_copy_from_read_buf(tty, &b, &nr);
- if (retval == -EAGAIN) {
- retval = 0;
- continue;
- } else if (retval)
+ if (retval)
break;
} else {
int uncopied;
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 063/128] tty: Fix GPF in flush_to_ldisc()
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (61 preceding siblings ...)
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 062/128] n_tty: Fix poll() after buffer-limited eof push read Luis Henriques
@ 2016-01-24 22:00 ` Luis Henriques
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 064/128] ALSA: usb-audio: Add a more accurate volume quirk for AudioQuest DragonFly Luis Henriques
` (65 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:00 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Peter Hurley, Greg Kroah-Hartman, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Peter Hurley <peter@hurleysoftware.com>
commit 9ce119f318ba1a07c29149301f1544b6c4bea52a upstream.
A line discipline which does not define a receive_buf() method can
can cause a GPF if data is ever received [1]. Oddly, this was known
to the author of n_tracesink in 2011, but never fixed.
[1] GPF report
BUG: unable to handle kernel NULL pointer dereference at (null)
IP: [< (null)>] (null)
PGD 3752d067 PUD 37a7b067 PMD 0
Oops: 0010 [#1] SMP KASAN
Modules linked in:
CPU: 2 PID: 148 Comm: kworker/u10:2 Not tainted 4.4.0-rc2+ #51
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
Workqueue: events_unbound flush_to_ldisc
task: ffff88006da94440 ti: ffff88006db60000 task.ti: ffff88006db60000
RIP: 0010:[<0000000000000000>] [< (null)>] (null)
RSP: 0018:ffff88006db67b50 EFLAGS: 00010246
RAX: 0000000000000102 RBX: ffff88003ab32f88 RCX: 0000000000000102
RDX: 0000000000000000 RSI: ffff88003ab330a6 RDI: ffff88003aabd388
RBP: ffff88006db67c48 R08: ffff88003ab32f9c R09: ffff88003ab31fb0
R10: ffff88003ab32fa8 R11: 0000000000000000 R12: dffffc0000000000
R13: ffff88006db67c20 R14: ffffffff863df820 R15: ffff88003ab31fb8
FS: 0000000000000000(0000) GS:ffff88006dc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 0000000000000000 CR3: 0000000037938000 CR4: 00000000000006e0
Stack:
ffffffff829f46f1 ffff88006da94bf8 ffff88006da94bf8 0000000000000000
ffff88003ab31fb0 ffff88003aabd438 ffff88003ab31ff8 ffff88006430fd90
ffff88003ab32f9c ffffed0007557a87 1ffff1000db6cf78 ffff88003ab32078
Call Trace:
[<ffffffff8127cf91>] process_one_work+0x8f1/0x17a0 kernel/workqueue.c:2030
[<ffffffff8127df14>] worker_thread+0xd4/0x1180 kernel/workqueue.c:2162
[<ffffffff8128faaf>] kthread+0x1cf/0x270 drivers/block/aoe/aoecmd.c:1302
[<ffffffff852a7c2f>] ret_from_fork+0x3f/0x70 arch/x86/entry/entry_64.S:468
Code: Bad RIP value.
RIP [< (null)>] (null)
RSP <ffff88006db67b50>
CR2: 0000000000000000
---[ end trace a587f8947e54d6ea ]---
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/tty/tty_buffer.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/tty/tty_buffer.c b/drivers/tty/tty_buffer.c
index 143deb62467d..12446e9a4435 100644
--- a/drivers/tty/tty_buffer.c
+++ b/drivers/tty/tty_buffer.c
@@ -411,7 +411,7 @@ receive_buf(struct tty_struct *tty, struct tty_buffer *head, int count)
count = disc->ops->receive_buf2(tty, p, f, count);
else {
count = min_t(int, count, tty->receive_room);
- if (count)
+ if (count && disc->ops->receive_buf)
disc->ops->receive_buf(tty, p, f, count);
}
head->read += count;
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 064/128] ALSA: usb-audio: Add a more accurate volume quirk for AudioQuest DragonFly
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (62 preceding siblings ...)
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 063/128] tty: Fix GPF in flush_to_ldisc() Luis Henriques
@ 2016-01-24 22:00 ` Luis Henriques
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 065/128] ARM: 8471/1: need to save/restore arm register(r11) when it is corrupted Luis Henriques
` (64 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:00 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Anssi Hannula, Takashi Iwai, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Anssi Hannula <anssi.hannula@iki.fi>
commit 42e3121d90f42e57f6dbd6083dff2f57b3ec7daa upstream.
AudioQuest DragonFly DAC reports a volume control range of 0..50
(0x0000..0x0032) which in USB Audio means a range of 0 .. 0.2dB, which
is obviously incorrect and would cause software using the dB information
in e.g. volume sliders to have a massive volume difference in 100..102%
range.
Commit 2d1cb7f658fb ("ALSA: usb-audio: add dB range mapping for some
devices") added a dB range mapping for it with range 0..50 dB.
However, the actual volume mapping seems to be neither linear volume nor
linear dB scale, but instead quite close to the cubic mapping e.g.
alsamixer uses, with a range of approx. -53...0 dB.
Replace the previous quirk with a custom dB mapping based on some basic
output measurements, using a 10-item range TLV (which will still fit in
alsa-lib MAX_TLV_RANGE_SIZE).
Tested on AudioQuest DragonFly HW v1.2. The quirk is only applied if the
range is 0..50, so if this gets fixed/changed in later HW revisions it
will no longer be applied.
v2: incorporated Takashi Iwai's suggestion for the quirk application
method
Signed-off-by: Anssi Hannula <anssi.hannula@iki.fi>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
sound/usb/mixer.c | 2 ++
sound/usb/mixer_maps.c | 12 ------------
sound/usb/mixer_quirks.c | 37 +++++++++++++++++++++++++++++++++++++
sound/usb/mixer_quirks.h | 4 ++++
4 files changed, 43 insertions(+), 12 deletions(-)
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 1550e15e9179..21c60eff920e 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -1334,6 +1334,8 @@ static void build_feature_ctl(struct mixer_build *state, void *raw_desc,
}
}
+ snd_usb_mixer_fu_apply_quirk(state->mixer, cval, unitid, kctl);
+
range = (cval->max - cval->min) / cval->res;
/*
* Are there devices with volume range more than 255? I use a bit more
diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c
index 9a3e1076a5b1..e89789a9baed 100644
--- a/sound/usb/mixer_maps.c
+++ b/sound/usb/mixer_maps.c
@@ -343,13 +343,6 @@ static struct usbmix_name_map bose_companion5_map[] = {
{ 0 } /* terminator */
};
-/* Dragonfly DAC 1.2, the dB conversion factor is 1 instead of 256 */
-static struct usbmix_dB_map dragonfly_1_2_dB = {0, 5000};
-static struct usbmix_name_map dragonfly_1_2_map[] = {
- { 7, NULL, .dB = &dragonfly_1_2_dB },
- { 0 } /* terminator */
-};
-
/*
* Control map entries
*/
@@ -461,11 +454,6 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = {
.id = USB_ID(0x05a7, 0x1020),
.map = bose_companion5_map,
},
- {
- /* Dragonfly DAC 1.2 */
- .id = USB_ID(0x21b4, 0x0081),
- .map = dragonfly_1_2_map,
- },
{ 0 } /* terminator */
};
diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
index 9484d02d5f2c..614f33e63c3a 100644
--- a/sound/usb/mixer_quirks.c
+++ b/sound/usb/mixer_quirks.c
@@ -37,6 +37,7 @@
#include <sound/control.h>
#include <sound/hwdep.h>
#include <sound/info.h>
+#include <sound/tlv.h>
#include "usbaudio.h"
#include "mixer.h"
@@ -1711,3 +1712,39 @@ void snd_usb_mixer_rc_memory_change(struct usb_mixer_interface *mixer,
}
}
+static void snd_dragonfly_quirk_db_scale(struct usb_mixer_interface *mixer,
+ struct snd_kcontrol *kctl)
+{
+ /* Approximation using 10 ranges based on output measurement on hw v1.2.
+ * This seems close to the cubic mapping e.g. alsamixer uses. */
+ static const DECLARE_TLV_DB_RANGE(scale,
+ 0, 1, TLV_DB_MINMAX_ITEM(-5300, -4970),
+ 2, 5, TLV_DB_MINMAX_ITEM(-4710, -4160),
+ 6, 7, TLV_DB_MINMAX_ITEM(-3884, -3710),
+ 8, 14, TLV_DB_MINMAX_ITEM(-3443, -2560),
+ 15, 16, TLV_DB_MINMAX_ITEM(-2475, -2324),
+ 17, 19, TLV_DB_MINMAX_ITEM(-2228, -2031),
+ 20, 26, TLV_DB_MINMAX_ITEM(-1910, -1393),
+ 27, 31, TLV_DB_MINMAX_ITEM(-1322, -1032),
+ 32, 40, TLV_DB_MINMAX_ITEM(-968, -490),
+ 41, 50, TLV_DB_MINMAX_ITEM(-441, 0),
+ );
+
+ usb_audio_info(mixer->chip, "applying DragonFly dB scale quirk\n");
+ kctl->tlv.p = scale;
+ kctl->vd[0].access |= SNDRV_CTL_ELEM_ACCESS_TLV_READ;
+ kctl->vd[0].access &= ~SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK;
+}
+
+void snd_usb_mixer_fu_apply_quirk(struct usb_mixer_interface *mixer,
+ struct usb_mixer_elem_info *cval, int unitid,
+ struct snd_kcontrol *kctl)
+{
+ switch (mixer->chip->usb_id) {
+ case USB_ID(0x21b4, 0x0081): /* AudioQuest DragonFly */
+ if (unitid == 7 && cval->min == 0 && cval->max == 50)
+ snd_dragonfly_quirk_db_scale(mixer, kctl);
+ break;
+ }
+}
+
diff --git a/sound/usb/mixer_quirks.h b/sound/usb/mixer_quirks.h
index bdbfab093816..177c329cd4dd 100644
--- a/sound/usb/mixer_quirks.h
+++ b/sound/usb/mixer_quirks.h
@@ -9,5 +9,9 @@ void snd_emuusb_set_samplerate(struct snd_usb_audio *chip,
void snd_usb_mixer_rc_memory_change(struct usb_mixer_interface *mixer,
int unitid);
+void snd_usb_mixer_fu_apply_quirk(struct usb_mixer_interface *mixer,
+ struct usb_mixer_elem_info *cval, int unitid,
+ struct snd_kcontrol *kctl);
+
#endif /* SND_USB_MIXER_QUIRKS_H */
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 065/128] ARM: 8471/1: need to save/restore arm register(r11) when it is corrupted
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (63 preceding siblings ...)
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 064/128] ALSA: usb-audio: Add a more accurate volume quirk for AudioQuest DragonFly Luis Henriques
@ 2016-01-24 22:00 ` Luis Henriques
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 066/128] ALSA: hda - Add a fixup for Thinkpad X1 Carbon 2nd Luis Henriques
` (63 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:00 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Anson Huang, Russell King, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Anson Huang <Anson.Huang@freescale.com>
commit fa0708b320f6da4c1104fe56e01b7abf66fd16ad upstream.
In cpu_v7_do_suspend routine, r11 is used while it is NOT
saved/restored, different compiler may have different usage
of ARM general registers, so it may cause issues during
calling cpu_v7_do_suspend.
We meet kernel fault occurs when using GCC 4.8.3, r11 contains
valid value before calling into cpu_v7_do_suspend, but when returned
from this routine, r11 is corrupted and lead to kernel fault.
Doing save/restore for those corrupted registers is a must in
assemble code.
Signed-off-by: Anson Huang <Anson.Huang@freescale.com>
Reviewed-by: Nicolas Pitre <nico@linaro.org>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
arch/arm/mm/proc-v7.S | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm/mm/proc-v7.S b/arch/arm/mm/proc-v7.S
index 0eba0d1fd65a..ce9444e9d001 100644
--- a/arch/arm/mm/proc-v7.S
+++ b/arch/arm/mm/proc-v7.S
@@ -95,7 +95,7 @@ ENDPROC(cpu_v7_dcache_clean_area)
.equ cpu_v7_suspend_size, 4 * 9
#ifdef CONFIG_ARM_CPU_SUSPEND
ENTRY(cpu_v7_do_suspend)
- stmfd sp!, {r4 - r10, lr}
+ stmfd sp!, {r4 - r11, lr}
mrc p15, 0, r4, c13, c0, 0 @ FCSE/PID
mrc p15, 0, r5, c13, c0, 3 @ User r/o thread ID
stmia r0!, {r4 - r5}
@@ -112,7 +112,7 @@ ENTRY(cpu_v7_do_suspend)
mrc p15, 0, r9, c1, c0, 1 @ Auxiliary control register
mrc p15, 0, r10, c1, c0, 2 @ Co-processor access control
stmia r0, {r5 - r11}
- ldmfd sp!, {r4 - r10, pc}
+ ldmfd sp!, {r4 - r11, pc}
ENDPROC(cpu_v7_do_suspend)
ENTRY(cpu_v7_do_resume)
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 066/128] ALSA: hda - Add a fixup for Thinkpad X1 Carbon 2nd
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (64 preceding siblings ...)
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 065/128] ARM: 8471/1: need to save/restore arm register(r11) when it is corrupted Luis Henriques
@ 2016-01-24 22:00 ` Luis Henriques
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 067/128] spi: fix parent-device reference leak Luis Henriques
` (62 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:00 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Takashi Iwai, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Takashi Iwai <tiwai@suse.de>
commit b6903c0ed9f0bcbbe88f67f7ed43d1721cbc6235 upstream.
Apply the same fixup for Thinkpad with dock to Thinkpad X1 Carbon 2nd,
too. This reduces the annoying loud cracking noise problem, as well
as the support of missing docking port.
Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=958439
Reported-and-tested-by: Benjamin Poirier <bpoirier@suse.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
sound/pci/hda/patch_realtek.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 148957ca1d04..34806487e54f 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -4986,6 +4986,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
SND_PCI_QUIRK(0x17aa, 0x2212, "Thinkpad T440", ALC292_FIXUP_TPT440_DOCK),
SND_PCI_QUIRK(0x17aa, 0x2214, "Thinkpad X240", ALC292_FIXUP_TPT440_DOCK),
SND_PCI_QUIRK(0x17aa, 0x2215, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+ SND_PCI_QUIRK(0x17aa, 0x2218, "Thinkpad X1 Carbon 2nd", ALC292_FIXUP_TPT440_DOCK),
SND_PCI_QUIRK(0x17aa, 0x2223, "ThinkPad T550", ALC292_FIXUP_TPT440_DOCK),
SND_PCI_QUIRK(0x17aa, 0x2226, "ThinkPad X250", ALC292_FIXUP_TPT440_DOCK),
SND_PCI_QUIRK(0x17aa, 0x2233, "Thinkpad", ALC293_FIXUP_LENOVO_SPK_NOISE),
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 067/128] spi: fix parent-device reference leak
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (65 preceding siblings ...)
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 066/128] ALSA: hda - Add a fixup for Thinkpad X1 Carbon 2nd Luis Henriques
@ 2016-01-24 22:00 ` Luis Henriques
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 068/128] dma-debug: Fix dma_debug_entry offset calculation Luis Henriques
` (61 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:00 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Johan Hovold, Mark Brown, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Johan Hovold <johan@kernel.org>
commit 157f38f993919b648187ba341bfb05d0e91ad2f6 upstream.
Fix parent-device reference leak due to SPI-core taking an unnecessary
reference to the parent when allocating the master structure, a
reference that was never released.
Note that driver core takes its own reference to the parent when the
master device is registered.
Fixes: 49dce689ad4e ("spi doesn't need class_device")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/spi/spi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index 8f2c442eb1e1..f8e4ca6be300 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -1475,7 +1475,7 @@ struct spi_master *spi_alloc_master(struct device *dev, unsigned size)
master->bus_num = -1;
master->num_chipselect = 1;
master->dev.class = &spi_master_class;
- master->dev.parent = get_device(dev);
+ master->dev.parent = dev;
spi_master_set_devdata(master, &master[1]);
return master;
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 068/128] dma-debug: Fix dma_debug_entry offset calculation
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (66 preceding siblings ...)
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 067/128] spi: fix parent-device reference leak Luis Henriques
@ 2016-01-24 22:00 ` Luis Henriques
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 069/128] ARC: dw2 unwind: Reinstante unwinding out of modules Luis Henriques
` (60 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:00 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Daniel Mentz, Dan Williams, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Daniel Mentz <danielmentz@google.com>
commit 0354aec19ce3d355c6213b0434064efc25c9b22c upstream.
dma-debug uses struct dma_debug_entry to keep track of dma coherent
memory allocation requests. The virtual address is converted into a pfn
and an offset. Previously, the offset was calculated using an incorrect
bit mask. As a result, we saw incorrect error messages from dma-debug
like the following:
"DMA-API: exceeded 7 overlapping mappings of cacheline 0x03e00000"
Cacheline 0x03e00000 does not exist on our platform.
Fixes: 0abdd7a81b7e ("dma-debug: introduce debug_dma_assert_idle()")
Signed-off-by: Daniel Mentz <danielmentz@google.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
lib/dma-debug.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/lib/dma-debug.c b/lib/dma-debug.c
index 98f2d7e91a91..1c741f900028 100644
--- a/lib/dma-debug.c
+++ b/lib/dma-debug.c
@@ -1440,7 +1440,7 @@ void debug_dma_alloc_coherent(struct device *dev, size_t size,
entry->type = dma_debug_coherent;
entry->dev = dev;
entry->pfn = page_to_pfn(virt_to_page(virt));
- entry->offset = (size_t) virt & PAGE_MASK;
+ entry->offset = (size_t) virt & ~PAGE_MASK;
entry->size = size;
entry->dev_addr = dma_addr;
entry->direction = DMA_BIDIRECTIONAL;
@@ -1456,7 +1456,7 @@ void debug_dma_free_coherent(struct device *dev, size_t size,
.type = dma_debug_coherent,
.dev = dev,
.pfn = page_to_pfn(virt_to_page(virt)),
- .offset = (size_t) virt & PAGE_MASK,
+ .offset = (size_t) virt & ~PAGE_MASK,
.dev_addr = addr,
.size = size,
.direction = DMA_BIDIRECTIONAL,
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 069/128] ARC: dw2 unwind: Reinstante unwinding out of modules
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (67 preceding siblings ...)
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 068/128] dma-debug: Fix dma_debug_entry offset calculation Luis Henriques
@ 2016-01-24 22:00 ` Luis Henriques
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 070/128] ARC: dw2 unwind: Ignore CIE version !=1 gracefully instead of bailing Luis Henriques
` (59 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:00 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Vineet Gupta, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Vineet Gupta <vgupta@synopsys.com>
commit bc79c9a7216562a2035d2f64f73626613c1300d0 upstream.
The fix which removed linear searching of dwarf (because binary lookup
data always exists) missed out on the fact that modules don't get the
binary lookup tables info. This caused unwinding out of modules to stop
working.
So add binary lookup header setup (equivalent of eh_frame_hdr setup) to
modules as well.
While at it, confine the header setup to within unwinder code,
reducing one API exposed out of unwinder code.
Fixes: 2e22502c080f ARC: dw2 unwind: Remove falllback linear search thru FDE entries
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
arch/arc/include/asm/unwind.h | 4 ----
arch/arc/kernel/setup.c | 1 -
arch/arc/kernel/unwind.c | 40 ++++++++++++++++++++++++++--------------
3 files changed, 26 insertions(+), 19 deletions(-)
diff --git a/arch/arc/include/asm/unwind.h b/arch/arc/include/asm/unwind.h
index 7ca628b6ee2a..c11a25bb8158 100644
--- a/arch/arc/include/asm/unwind.h
+++ b/arch/arc/include/asm/unwind.h
@@ -112,7 +112,6 @@ struct unwind_frame_info {
extern int arc_unwind(struct unwind_frame_info *frame);
extern void arc_unwind_init(void);
-extern void arc_unwind_setup(void);
extern void *unwind_add_table(struct module *module, const void *table_start,
unsigned long table_size);
extern void unwind_remove_table(void *handle, int init_only);
@@ -152,9 +151,6 @@ static inline void arc_unwind_init(void)
{
}
-static inline void arc_unwind_setup(void)
-{
-}
#define unwind_add_table(a, b, c)
#define unwind_remove_table(a, b)
diff --git a/arch/arc/kernel/setup.c b/arch/arc/kernel/setup.c
index 119dddb752b2..cfae438520af 100644
--- a/arch/arc/kernel/setup.c
+++ b/arch/arc/kernel/setup.c
@@ -380,7 +380,6 @@ void __init setup_arch(char **cmdline_p)
#endif
arc_unwind_init();
- arc_unwind_setup();
}
static int __init customize_machine(void)
diff --git a/arch/arc/kernel/unwind.c b/arch/arc/kernel/unwind.c
index 2d6a36ea8aaf..5c1d071ccc9a 100644
--- a/arch/arc/kernel/unwind.c
+++ b/arch/arc/kernel/unwind.c
@@ -170,6 +170,23 @@ static struct unwind_table *find_table(unsigned long pc)
static unsigned long read_pointer(const u8 **pLoc,
const void *end, signed ptrType);
+static void init_unwind_hdr(struct unwind_table *table,
+ void *(*alloc) (unsigned long));
+
+/*
+ * wrappers for header alloc (vs. calling one vs. other at call site)
+ * to elide section mismatches warnings
+ */
+static void *__init unw_hdr_alloc_early(unsigned long sz)
+{
+ return __alloc_bootmem_nopanic(sz, sizeof(unsigned int),
+ MAX_DMA_ADDRESS);
+}
+
+static void *unw_hdr_alloc(unsigned long sz)
+{
+ return kmalloc(sz, GFP_KERNEL);
+}
static void init_unwind_table(struct unwind_table *table, const char *name,
const void *core_start, unsigned long core_size,
@@ -209,6 +226,8 @@ void __init arc_unwind_init(void)
__start_unwind, __end_unwind - __start_unwind,
NULL, 0);
/*__start_unwind_hdr, __end_unwind_hdr - __start_unwind_hdr);*/
+
+ init_unwind_hdr(&root_table, unw_hdr_alloc_early);
}
static const u32 bad_cie, not_fde;
@@ -241,8 +260,8 @@ static void swap_eh_frame_hdr_table_entries(void *p1, void *p2, int size)
e2->fde = v;
}
-static void __init setup_unwind_table(struct unwind_table *table,
- void *(*alloc) (unsigned long))
+static void init_unwind_hdr(struct unwind_table *table,
+ void *(*alloc) (unsigned long))
{
const u8 *ptr;
unsigned long tableSize = table->size, hdrSize;
@@ -300,9 +319,11 @@ static void __init setup_unwind_table(struct unwind_table *table,
hdrSize = 4 + sizeof(unsigned long) + sizeof(unsigned int)
+ 2 * n * sizeof(unsigned long);
+
header = alloc(hdrSize);
if (!header)
return;
+
header->version = 1;
header->eh_frame_ptr_enc = DW_EH_PE_abs | DW_EH_PE_native;
header->fde_count_enc = DW_EH_PE_abs | DW_EH_PE_data4;
@@ -342,18 +363,6 @@ static void __init setup_unwind_table(struct unwind_table *table,
table->header = (const void *)header;
}
-static void *__init balloc(unsigned long sz)
-{
- return __alloc_bootmem_nopanic(sz,
- sizeof(unsigned int),
- __pa(MAX_DMA_ADDRESS));
-}
-
-void __init arc_unwind_setup(void)
-{
- setup_unwind_table(&root_table, balloc);
-}
-
#ifdef CONFIG_MODULES
static struct unwind_table *last_table;
@@ -377,6 +386,8 @@ void *unwind_add_table(struct module *module, const void *table_start,
table_start, table_size,
NULL, 0);
+ init_unwind_hdr(table, unw_hdr_alloc);
+
#ifdef UNWIND_DEBUG
unw_debug("Table added for [%s] %lx %lx\n",
module->name, table->core.pc, table->core.range);
@@ -439,6 +450,7 @@ void unwind_remove_table(void *handle, int init_only)
info.init_only = init_only;
unlink_table(&info); /* XXX: SMP */
+ kfree(table->header);
kfree(table);
}
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 070/128] ARC: dw2 unwind: Ignore CIE version !=1 gracefully instead of bailing
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (68 preceding siblings ...)
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 069/128] ARC: dw2 unwind: Reinstante unwinding out of modules Luis Henriques
@ 2016-01-24 22:00 ` Luis Henriques
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 071/128] powerpc/powernv: Fix the overflow of OPAL message notifiers head array Luis Henriques
` (58 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:00 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Vineet Gupta, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Vineet Gupta <vgupta@synopsys.com>
commit 323f41f9e7d0cb5b1d1586aded6682855f1e646d upstream.
ARC dwarf unwinder only supports CIE version == 1
The boot time dwarf sanitizer (part of binary lookup table constructor)
would simply bail if it saw CIE version == 3, rendering unwinder with a
NULL lookup table.
It seems libgcc linked with kernel does have such entries.
With fallback linear search removed, and a NULL binary lookup table,
unwinder fails to generate any stack trace.
So allow graceful ignoring of unsupported CIE entries.
This problem was initially seen in Alexey's setup (and not mine) as he
was using buildroot built toolchain (libgcc) which doesn't get built with
CFLAGS_FOR_TARGET="-gdwarf-2 which is my default
Fixes STAR 9000985048: "kernel unwinder broken with stock tools"
Fixes: 2e22502c080f ARC: dw2 unwind: Remove falllback linear search thru FDE entries
Reported-by Alexey Brodkin <abrodkin@synopsys.com>
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
arch/arc/kernel/unwind.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
diff --git a/arch/arc/kernel/unwind.c b/arch/arc/kernel/unwind.c
index 5c1d071ccc9a..9bfbd0a01b95 100644
--- a/arch/arc/kernel/unwind.c
+++ b/arch/arc/kernel/unwind.c
@@ -293,13 +293,13 @@ static void init_unwind_hdr(struct unwind_table *table,
const u32 *cie = cie_for_fde(fde, table);
signed ptrType;
- if (cie == ¬_fde)
+ if (cie == ¬_fde) /* only process FDE here */
continue;
if (cie == NULL || cie == &bad_cie)
- return;
+ continue; /* say FDE->CIE.version != 1 */
ptrType = fde_pointer_type(cie);
if (ptrType < 0)
- return;
+ continue;
ptr = (const u8 *)(fde + 2);
if (!read_pointer(&ptr, (const u8 *)(fde + 1) + *fde,
@@ -343,6 +343,10 @@ static void init_unwind_hdr(struct unwind_table *table,
if (fde[1] == 0xffffffff)
continue; /* this is a CIE */
+
+ if (*(u8 *)(cie + 2) != 1)
+ continue; /* FDE->CIE.version not supported */
+
ptr = (const u8 *)(fde + 2);
header->table[n].start = read_pointer(&ptr,
(const u8 *)(fde + 1) +
@@ -519,7 +523,8 @@ static const u32 *cie_for_fde(const u32 *fde, const struct unwind_table *table)
if (*cie <= sizeof(*cie) + 4 || *cie >= fde[1] - sizeof(*fde)
|| (*cie & (sizeof(*cie) - 1))
- || (cie[1] != 0xffffffff))
+ || (cie[1] != 0xffffffff)
+ || ( *(u8 *)(cie + 2) != 1)) /* version 1 supported */
return NULL; /* this is not a (valid) CIE */
return cie;
}
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 071/128] powerpc/powernv: Fix the overflow of OPAL message notifiers head array
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (69 preceding siblings ...)
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 070/128] ARC: dw2 unwind: Ignore CIE version !=1 gracefully instead of bailing Luis Henriques
@ 2016-01-24 22:00 ` Luis Henriques
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 072/128] powerpc/powernv: pr_warn_once on unsupported OPAL_MSG type Luis Henriques
` (57 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:00 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Neelesh Gupta, Benjamin Herrenschmidt, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Neelesh Gupta <neelegup@linux.vnet.ibm.com>
commit 792f96e9a769b799a2944e9369e4ea1e467135b2 upstream.
Fixes the condition check of incoming message type which can
otherwise shoot beyond the message notifiers head array.
Signed-off-by: Neelesh Gupta <neelegup@linux.vnet.ibm.com>
Reviewed-by: Vasant Hegde <hegdevasant@linux.vnet.ibm.com>
Reviewed-by: Anshuman Khandual <khandual@linux.vnet.ibm.com>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
arch/powerpc/platforms/powernv/opal.c | 12 ++++--------
1 file changed, 4 insertions(+), 8 deletions(-)
diff --git a/arch/powerpc/platforms/powernv/opal.c b/arch/powerpc/platforms/powernv/opal.c
index 199975613fe9..d5e5794db989 100644
--- a/arch/powerpc/platforms/powernv/opal.c
+++ b/arch/powerpc/platforms/powernv/opal.c
@@ -286,16 +286,12 @@ void opal_notifier_disable(void)
int opal_message_notifier_register(enum OpalMessageType msg_type,
struct notifier_block *nb)
{
- if (!nb) {
- pr_warning("%s: Invalid argument (%p)\n",
- __func__, nb);
- return -EINVAL;
- }
- if (msg_type > OPAL_MSG_TYPE_MAX) {
- pr_warning("%s: Invalid message type argument (%d)\n",
+ if (!nb || msg_type >= OPAL_MSG_TYPE_MAX) {
+ pr_warning("%s: Invalid arguments, msg_type:%d\n",
__func__, msg_type);
return -EINVAL;
}
+
return atomic_notifier_chain_register(
&opal_msg_notifier_head[msg_type], nb);
}
@@ -332,7 +328,7 @@ static void opal_handle_message(void)
type = be32_to_cpu(msg.msg_type);
/* Sanity check */
- if (type > OPAL_MSG_TYPE_MAX) {
+ if (type >= OPAL_MSG_TYPE_MAX) {
pr_warning("%s: Unknown message type: %u\n", __func__, type);
return;
}
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 072/128] powerpc/powernv: pr_warn_once on unsupported OPAL_MSG type
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (70 preceding siblings ...)
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 071/128] powerpc/powernv: Fix the overflow of OPAL message notifiers head array Luis Henriques
@ 2016-01-24 22:00 ` Luis Henriques
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 073/128] xen: Add RING_COPY_REQUEST() Luis Henriques
` (56 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:00 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Stewart Smith, Michael Ellerman, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Stewart Smith <stewart@linux.vnet.ibm.com>
commit 98da62b716a3b24ab8e77453c9a8a954124c18cd upstream.
When running on newer OPAL firmware that supports sending extra
OPAL_MSG types, we would print a warning on *every* message received.
This could be a problem for kernels that don't support OPAL_MSG_OCC
on machines that are running real close to thermal limits and the
OCC is throttling the chip. For a kernel that is paying attention to
the message queue, we could get these notifications quite often.
Conceivably, future message types could also come fairly often,
and printing that we didn't understand them 10,000 times provides
no further information than printing them once.
Signed-off-by: Stewart Smith <stewart@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
arch/powerpc/platforms/powernv/opal.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/powerpc/platforms/powernv/opal.c b/arch/powerpc/platforms/powernv/opal.c
index d5e5794db989..0fa7178d36dc 100644
--- a/arch/powerpc/platforms/powernv/opal.c
+++ b/arch/powerpc/platforms/powernv/opal.c
@@ -329,7 +329,7 @@ static void opal_handle_message(void)
/* Sanity check */
if (type >= OPAL_MSG_TYPE_MAX) {
- pr_warning("%s: Unknown message type: %u\n", __func__, type);
+ pr_warn_once("%s: Unknown message type: %u\n", __func__, type);
return;
}
opal_message_do_notify(type, (void *)&msg);
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 073/128] xen: Add RING_COPY_REQUEST()
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (71 preceding siblings ...)
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 072/128] powerpc/powernv: pr_warn_once on unsupported OPAL_MSG type Luis Henriques
@ 2016-01-24 22:00 ` Luis Henriques
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 074/128] xen-netback: don't use last request to determine minimum Tx credit Luis Henriques
` (55 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:00 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: David Vrabel, Konrad Rzeszutek Wilk, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: David Vrabel <david.vrabel@citrix.com>
commit 454d5d882c7e412b840e3c99010fe81a9862f6fb upstream.
Using RING_GET_REQUEST() on a shared ring is easy to use incorrectly
(i.e., by not considering that the other end may alter the data in the
shared ring while it is being inspected). Safe usage of a request
generally requires taking a local copy.
Provide a RING_COPY_REQUEST() macro to use instead of
RING_GET_REQUEST() and an open-coded memcpy(). This takes care of
ensuring that the copy is done correctly regardless of any possible
compiler optimizations.
Use a volatile source to prevent the compiler from reordering or
omitting the copy.
This is part of XSA155.
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
include/xen/interface/io/ring.h | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/include/xen/interface/io/ring.h b/include/xen/interface/io/ring.h
index 7d28aff605c7..7dc685b4057d 100644
--- a/include/xen/interface/io/ring.h
+++ b/include/xen/interface/io/ring.h
@@ -181,6 +181,20 @@ struct __name##_back_ring { \
#define RING_GET_REQUEST(_r, _idx) \
(&((_r)->sring->ring[((_idx) & (RING_SIZE(_r) - 1))].req))
+/*
+ * Get a local copy of a request.
+ *
+ * Use this in preference to RING_GET_REQUEST() so all processing is
+ * done on a local copy that cannot be modified by the other end.
+ *
+ * Note that https://gcc.gnu.org/bugzilla/show_bug.cgi?id=58145 may cause this
+ * to be ineffective where _req is a struct which consists of only bitfields.
+ */
+#define RING_COPY_REQUEST(_r, _idx, _req) do { \
+ /* Use volatile to force the copy into _req. */ \
+ *(_req) = *(volatile typeof(_req))RING_GET_REQUEST(_r, _idx); \
+} while (0)
+
#define RING_GET_RESPONSE(_r, _idx) \
(&((_r)->sring->ring[((_idx) & (RING_SIZE(_r) - 1))].rsp))
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 074/128] xen-netback: don't use last request to determine minimum Tx credit
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (72 preceding siblings ...)
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 073/128] xen: Add RING_COPY_REQUEST() Luis Henriques
@ 2016-01-24 22:00 ` Luis Henriques
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 075/128] xen-netback: use RING_COPY_REQUEST() throughout Luis Henriques
` (54 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:00 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: David Vrabel, Konrad Rzeszutek Wilk, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: David Vrabel <david.vrabel@citrix.com>
commit 0f589967a73f1f30ab4ac4dd9ce0bb399b4d6357 upstream.
The last from guest transmitted request gives no indication about the
minimum amount of credit that the guest might need to send a packet
since the last packet might have been a small one.
Instead allow for the worst case 128 KiB packet.
This is part of XSA155.
Reviewed-by: Wei Liu <wei.liu2@citrix.com>
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/net/xen-netback/netback.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index 09e4f4ef4eb8..70e73907db0d 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -755,9 +755,7 @@ static void tx_add_credit(struct xenvif_queue *queue)
* Allow a burst big enough to transmit a jumbo packet of up to 128kB.
* Otherwise the interface can seize up due to insufficient credit.
*/
- max_burst = RING_GET_REQUEST(&queue->tx, queue->tx.req_cons)->size;
- max_burst = min(max_burst, 131072UL);
- max_burst = max(max_burst, queue->credit_bytes);
+ max_burst = max(131072UL, queue->credit_bytes);
/* Take care that adding a new chunk of credit doesn't wrap to zero. */
max_credit = queue->remaining_credit + queue->credit_bytes;
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 075/128] xen-netback: use RING_COPY_REQUEST() throughout
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (73 preceding siblings ...)
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 074/128] xen-netback: don't use last request to determine minimum Tx credit Luis Henriques
@ 2016-01-24 22:00 ` Luis Henriques
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 076/128] xen-blkback: only read request operation from shared ring once Luis Henriques
` (53 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:00 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: David Vrabel, Konrad Rzeszutek Wilk, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: David Vrabel <david.vrabel@citrix.com>
commit 68a33bfd8403e4e22847165d149823a2e0e67c9c upstream.
Instead of open-coding memcpy()s and directly accessing Tx and Rx
requests, use the new RING_COPY_REQUEST() that ensures the local copy
is correct.
This is more than is strictly necessary for guest Rx requests since
only the id and gref fields are used and it is harmless if the
frontend modifies these.
This is part of XSA155.
Reviewed-by: Wei Liu <wei.liu2@citrix.com>
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/net/xen-netback/netback.c | 30 ++++++++++++++----------------
1 file changed, 14 insertions(+), 16 deletions(-)
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index 70e73907db0d..0c1574212162 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -221,18 +221,18 @@ static struct xenvif_rx_meta *get_next_rx_buffer(struct xenvif_queue *queue,
struct netrx_pending_operations *npo)
{
struct xenvif_rx_meta *meta;
- struct xen_netif_rx_request *req;
+ struct xen_netif_rx_request req;
- req = RING_GET_REQUEST(&queue->rx, queue->rx.req_cons++);
+ RING_COPY_REQUEST(&queue->rx, queue->rx.req_cons++, &req);
meta = npo->meta + npo->meta_prod++;
meta->gso_type = XEN_NETIF_GSO_TYPE_NONE;
meta->gso_size = 0;
meta->size = 0;
- meta->id = req->id;
+ meta->id = req.id;
npo->copy_off = 0;
- npo->copy_gref = req->gref;
+ npo->copy_gref = req.gref;
return meta;
}
@@ -390,7 +390,7 @@ static int xenvif_gop_skb(struct sk_buff *skb,
struct xenvif *vif = netdev_priv(skb->dev);
int nr_frags = skb_shinfo(skb)->nr_frags;
int i;
- struct xen_netif_rx_request *req;
+ struct xen_netif_rx_request req;
struct xenvif_rx_meta *meta;
unsigned char *data;
int head = 1;
@@ -411,15 +411,15 @@ static int xenvif_gop_skb(struct sk_buff *skb,
/* Set up a GSO prefix descriptor, if necessary */
if ((1 << gso_type) & vif->gso_prefix_mask) {
- req = RING_GET_REQUEST(&queue->rx, queue->rx.req_cons++);
+ RING_COPY_REQUEST(&queue->rx, queue->rx.req_cons++, &req);
meta = npo->meta + npo->meta_prod++;
meta->gso_type = gso_type;
meta->gso_size = skb_shinfo(skb)->gso_size;
meta->size = 0;
- meta->id = req->id;
+ meta->id = req.id;
}
- req = RING_GET_REQUEST(&queue->rx, queue->rx.req_cons++);
+ RING_COPY_REQUEST(&queue->rx, queue->rx.req_cons++, &req);
meta = npo->meta + npo->meta_prod++;
if ((1 << gso_type) & vif->gso_mask) {
@@ -431,9 +431,9 @@ static int xenvif_gop_skb(struct sk_buff *skb,
}
meta->size = 0;
- meta->id = req->id;
+ meta->id = req.id;
npo->copy_off = 0;
- npo->copy_gref = req->gref;
+ npo->copy_gref = req.gref;
data = skb->data;
while (data < skb_tail_pointer(skb)) {
@@ -784,7 +784,7 @@ static void xenvif_tx_err(struct xenvif_queue *queue,
spin_unlock_irqrestore(&queue->response_lock, flags);
if (cons == end)
break;
- txp = RING_GET_REQUEST(&queue->tx, cons++);
+ RING_COPY_REQUEST(&queue->tx, cons++, txp);
} while (1);
queue->tx.req_cons = cons;
}
@@ -851,8 +851,7 @@ static int xenvif_count_requests(struct xenvif_queue *queue,
if (drop_err)
txp = &dropped_tx;
- memcpy(txp, RING_GET_REQUEST(&queue->tx, cons + slots),
- sizeof(*txp));
+ RING_COPY_REQUEST(&queue->tx, cons + slots, txp);
/* If the guest submitted a frame >= 64 KiB then
* first->size overflowed and following slots will
@@ -1204,8 +1203,7 @@ static int xenvif_get_extras(struct xenvif_queue *queue,
return -EBADR;
}
- memcpy(&extra, RING_GET_REQUEST(&queue->tx, cons),
- sizeof(extra));
+ RING_COPY_REQUEST(&queue->tx, cons, &extra);
if (unlikely(!extra.type ||
extra.type >= XEN_NETIF_EXTRA_TYPE_MAX)) {
queue->tx.req_cons = ++cons;
@@ -1341,7 +1339,7 @@ static void xenvif_tx_build_gops(struct xenvif_queue *queue,
idx = queue->tx.req_cons;
rmb(); /* Ensure that we see the request before we copy it. */
- memcpy(&txreq, RING_GET_REQUEST(&queue->tx, idx), sizeof(txreq));
+ RING_COPY_REQUEST(&queue->tx, idx, &txreq);
/* Credit-based scheduling. */
if (txreq.size > queue->remaining_credit &&
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 076/128] xen-blkback: only read request operation from shared ring once
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (74 preceding siblings ...)
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 075/128] xen-netback: use RING_COPY_REQUEST() throughout Luis Henriques
@ 2016-01-24 22:00 ` Luis Henriques
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 077/128] xen-blkback: read from indirect descriptors only once Luis Henriques
` (52 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:00 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Roger Pau Monné,
David Vrabel, Konrad Rzeszutek Wilk, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: =?UTF-8?q?Roger=20Pau=20Monn=C3=A9?= <roger.pau@citrix.com>
commit 1f13d75ccb806260079e0679d55d9253e370ec8a upstream.
A compiler may load a switch statement value multiple times, which could
be bad when the value is in memory shared with the frontend.
When converting a non-native request to a native one, ensure that
src->operation is only loaded once by using READ_ONCE().
This is part of XSA155.
Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
[ luis: backported to 3.16:
- replaced READ_ONCE() by ACCESS_ONCE() ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/block/xen-blkback/common.h | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/block/xen-blkback/common.h b/drivers/block/xen-blkback/common.h
index f65b807e3236..ef64f59921a7 100644
--- a/drivers/block/xen-blkback/common.h
+++ b/drivers/block/xen-blkback/common.h
@@ -391,8 +391,8 @@ static inline void blkif_get_x86_32_req(struct blkif_request *dst,
struct blkif_x86_32_request *src)
{
int i, n = BLKIF_MAX_SEGMENTS_PER_REQUEST, j;
- dst->operation = src->operation;
- switch (src->operation) {
+ dst->operation = ACCESS_ONCE(src->operation);
+ switch (dst->operation) {
case BLKIF_OP_READ:
case BLKIF_OP_WRITE:
case BLKIF_OP_WRITE_BARRIER:
@@ -439,8 +439,8 @@ static inline void blkif_get_x86_64_req(struct blkif_request *dst,
struct blkif_x86_64_request *src)
{
int i, n = BLKIF_MAX_SEGMENTS_PER_REQUEST, j;
- dst->operation = src->operation;
- switch (src->operation) {
+ dst->operation = ACCESS_ONCE(src->operation);
+ switch (dst->operation) {
case BLKIF_OP_READ:
case BLKIF_OP_WRITE:
case BLKIF_OP_WRITE_BARRIER:
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 077/128] xen-blkback: read from indirect descriptors only once
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (75 preceding siblings ...)
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 076/128] xen-blkback: only read request operation from shared ring once Luis Henriques
@ 2016-01-24 22:00 ` Luis Henriques
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 078/128] xen/pciback: Save xen_pci_op commands before processing it Luis Henriques
` (51 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:00 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Roger Pau Monné,
David Vrabel, Konrad Rzeszutek Wilk, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: =?UTF-8?q?Roger=20Pau=20Monn=C3=A9?= <roger.pau@citrix.com>
commit 18779149101c0dd43ded43669ae2a92d21b6f9cb upstream.
Since indirect descriptors are in memory shared with the frontend, the
frontend could alter the first_sect and last_sect values after they have
been validated but before they are recorded in the request. This may
result in I/O requests that overflow the foreign page, possibly
overwriting local pages when the I/O request is executed.
When parsing indirect descriptors, only read first_sect and last_sect
once.
This is part of XSA155.
Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
[ luis: backported to 3.16:
- Use ACCESS_ONCE instead of READ_ONCE
- Use PAGE_SIZE instead of XEN_PAGE_SIZE ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/block/xen-blkback/blkback.c | 15 ++++++++++-----
1 file changed, 10 insertions(+), 5 deletions(-)
diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c
index 02004e101678..c42c22e778d8 100644
--- a/drivers/block/xen-blkback/blkback.c
+++ b/drivers/block/xen-blkback/blkback.c
@@ -861,6 +861,8 @@ static int xen_blkbk_parse_indirect(struct blkif_request *req,
goto unmap;
for (n = 0, i = 0; n < nseg; n++) {
+ uint8_t first_sect, last_sect;
+
if ((n % SEGS_PER_INDIRECT_FRAME) == 0) {
/* Map indirect segments */
if (segments)
@@ -868,15 +870,18 @@ static int xen_blkbk_parse_indirect(struct blkif_request *req,
segments = kmap_atomic(pages[n/SEGS_PER_INDIRECT_FRAME]->page);
}
i = n % SEGS_PER_INDIRECT_FRAME;
+
pending_req->segments[n]->gref = segments[i].gref;
- seg[n].nsec = segments[i].last_sect -
- segments[i].first_sect + 1;
- seg[n].offset = (segments[i].first_sect << 9);
- if ((segments[i].last_sect >= (PAGE_SIZE >> 9)) ||
- (segments[i].last_sect < segments[i].first_sect)) {
+
+ first_sect = ACCESS_ONCE(segments[i].first_sect);
+ last_sect = ACCESS_ONCE(segments[i].last_sect);
+ if (last_sect >= (PAGE_SIZE >> 9) || last_sect < first_sect) {
rc = -EINVAL;
goto unmap;
}
+
+ seg[n].nsec = last_sect - first_sect + 1;
+ seg[n].offset = first_sect << 9;
preq->nr_sects += seg[n].nsec;
}
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 078/128] xen/pciback: Save xen_pci_op commands before processing it
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (76 preceding siblings ...)
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 077/128] xen-blkback: read from indirect descriptors only once Luis Henriques
@ 2016-01-24 22:00 ` Luis Henriques
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 079/128] xen/pciback: Return error on XEN_PCI_OP_enable_msi when device has MSI or MSI-X enabled Luis Henriques
` (50 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:00 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Jan Beulich, David Vrabel, Konrad Rzeszutek Wilk, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
commit 8135cf8b092723dbfcc611fe6fdcb3a36c9951c5 upstream.
Double fetch vulnerabilities that happen when a variable is
fetched twice from shared memory but a security check is only
performed the first time.
The xen_pcibk_do_op function performs a switch statements on the op->cmd
value which is stored in shared memory. Interestingly this can result
in a double fetch vulnerability depending on the performed compiler
optimization.
This patch fixes it by saving the xen_pci_op command before
processing it. We also use 'barrier' to make sure that the
compiler does not perform any optimization.
This is part of XSA155.
Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Jan Beulich <JBeulich@suse.com>
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/xen/xen-pciback/pciback.h | 1 +
drivers/xen/xen-pciback/pciback_ops.c | 15 ++++++++++++++-
2 files changed, 15 insertions(+), 1 deletion(-)
diff --git a/drivers/xen/xen-pciback/pciback.h b/drivers/xen/xen-pciback/pciback.h
index f72af87640e0..560b3ecbcba8 100644
--- a/drivers/xen/xen-pciback/pciback.h
+++ b/drivers/xen/xen-pciback/pciback.h
@@ -37,6 +37,7 @@ struct xen_pcibk_device {
struct xen_pci_sharedinfo *sh_info;
unsigned long flags;
struct work_struct op_work;
+ struct xen_pci_op op;
};
struct xen_pcibk_dev_data {
diff --git a/drivers/xen/xen-pciback/pciback_ops.c b/drivers/xen/xen-pciback/pciback_ops.c
index c4a0666de6f5..a0e0e3ed4905 100644
--- a/drivers/xen/xen-pciback/pciback_ops.c
+++ b/drivers/xen/xen-pciback/pciback_ops.c
@@ -298,9 +298,11 @@ void xen_pcibk_do_op(struct work_struct *data)
container_of(data, struct xen_pcibk_device, op_work);
struct pci_dev *dev;
struct xen_pcibk_dev_data *dev_data = NULL;
- struct xen_pci_op *op = &pdev->sh_info->op;
+ struct xen_pci_op *op = &pdev->op;
int test_intx = 0;
+ *op = pdev->sh_info->op;
+ barrier();
dev = xen_pcibk_get_pci_dev(pdev, op->domain, op->bus, op->devfn);
if (dev == NULL)
@@ -342,6 +344,17 @@ void xen_pcibk_do_op(struct work_struct *data)
if ((dev_data->enable_intx != test_intx))
xen_pcibk_control_isr(dev, 0 /* no reset */);
}
+ pdev->sh_info->op.err = op->err;
+ pdev->sh_info->op.value = op->value;
+#ifdef CONFIG_PCI_MSI
+ if (op->cmd == XEN_PCI_OP_enable_msix && op->err == 0) {
+ unsigned int i;
+
+ for (i = 0; i < op->value; i++)
+ pdev->sh_info->op.msix_entries[i].vector =
+ op->msix_entries[i].vector;
+ }
+#endif
/* Tell the driver domain that we're done. */
wmb();
clear_bit(_XEN_PCIF_active, (unsigned long *)&pdev->sh_info->flags);
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 079/128] xen/pciback: Return error on XEN_PCI_OP_enable_msi when device has MSI or MSI-X enabled
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (77 preceding siblings ...)
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 078/128] xen/pciback: Save xen_pci_op commands before processing it Luis Henriques
@ 2016-01-24 22:00 ` Luis Henriques
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 080/128] xen/pciback: Return error on XEN_PCI_OP_enable_msix " Luis Henriques
` (49 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:00 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Konrad Rzeszutek Wilk, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
commit 56441f3c8e5bd45aab10dd9f8c505dd4bec03b0d upstream.
The guest sequence of:
a) XEN_PCI_OP_enable_msi
b) XEN_PCI_OP_enable_msi
c) XEN_PCI_OP_disable_msi
results in hitting an BUG_ON condition in the msi.c code.
The MSI code uses an dev->msi_list to which it adds MSI entries.
Under the above conditions an BUG_ON() can be hit. The device
passed in the guest MUST have MSI capability.
The a) adds the entry to the dev->msi_list and sets msi_enabled.
The b) adds a second entry but adding in to SysFS fails (duplicate entry)
and deletes all of the entries from msi_list and returns (with msi_enabled
is still set). c) pci_disable_msi passes the msi_enabled checks and hits:
BUG_ON(list_empty(dev_to_msi_list(&dev->dev)));
and blows up.
The patch adds a simple check in the XEN_PCI_OP_enable_msi to guard
against that. The check for msix_enabled is not stricly neccessary.
This is part of XSA-157.
Reviewed-by: David Vrabel <david.vrabel@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/xen/xen-pciback/pciback_ops.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/xen/xen-pciback/pciback_ops.c b/drivers/xen/xen-pciback/pciback_ops.c
index a0e0e3ed4905..8bfb87c1a9f3 100644
--- a/drivers/xen/xen-pciback/pciback_ops.c
+++ b/drivers/xen/xen-pciback/pciback_ops.c
@@ -144,7 +144,12 @@ int xen_pcibk_enable_msi(struct xen_pcibk_device *pdev,
if (unlikely(verbose_request))
printk(KERN_DEBUG DRV_NAME ": %s: enable MSI\n", pci_name(dev));
- status = pci_enable_msi(dev);
+ if (dev->msi_enabled)
+ status = -EALREADY;
+ else if (dev->msix_enabled)
+ status = -ENXIO;
+ else
+ status = pci_enable_msi(dev);
if (status) {
pr_warn_ratelimited("%s: error enabling MSI for guest %u: err %d\n",
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 080/128] xen/pciback: Return error on XEN_PCI_OP_enable_msix when device has MSI or MSI-X enabled
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (78 preceding siblings ...)
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 079/128] xen/pciback: Return error on XEN_PCI_OP_enable_msi when device has MSI or MSI-X enabled Luis Henriques
@ 2016-01-24 22:00 ` Luis Henriques
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 081/128] xen/pciback: Do not install an IRQ handler for MSI interrupts Luis Henriques
` (48 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:00 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Konrad Rzeszutek Wilk, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
commit 5e0ce1455c09dd61d029b8ad45d82e1ac0b6c4c9 upstream.
The guest sequence of:
a) XEN_PCI_OP_enable_msix
b) XEN_PCI_OP_enable_msix
results in hitting an NULL pointer due to using freed pointers.
The device passed in the guest MUST have MSI-X capability.
The a) constructs and SysFS representation of MSI and MSI groups.
The b) adds a second set of them but adding in to SysFS fails (duplicate entry).
'populate_msi_sysfs' frees the newly allocated msi_irq_groups (note that
in a) pdev->msi_irq_groups is still set) and also free's ALL of the
MSI-X entries of the device (the ones allocated in step a) and b)).
The unwind code: 'free_msi_irqs' deletes all the entries and tries to
delete the pdev->msi_irq_groups (which hasn't been set to NULL).
However the pointers in the SysFS are already freed and we hit an
NULL pointer further on when 'strlen' is attempted on a freed pointer.
The patch adds a simple check in the XEN_PCI_OP_enable_msix to guard
against that. The check for msi_enabled is not stricly neccessary.
This is part of XSA-157
Reviewed-by: David Vrabel <david.vrabel@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/xen/xen-pciback/pciback_ops.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/xen/xen-pciback/pciback_ops.c b/drivers/xen/xen-pciback/pciback_ops.c
index 8bfb87c1a9f3..029f33ddb8bf 100644
--- a/drivers/xen/xen-pciback/pciback_ops.c
+++ b/drivers/xen/xen-pciback/pciback_ops.c
@@ -206,9 +206,16 @@ int xen_pcibk_enable_msix(struct xen_pcibk_device *pdev,
if (unlikely(verbose_request))
printk(KERN_DEBUG DRV_NAME ": %s: enable MSI-X\n",
pci_name(dev));
+
if (op->value > SH_INFO_MAX_VEC)
return -EINVAL;
+ if (dev->msix_enabled)
+ return -EALREADY;
+
+ if (dev->msi_enabled)
+ return -ENXIO;
+
entries = kmalloc(op->value * sizeof(*entries), GFP_KERNEL);
if (entries == NULL)
return -ENOMEM;
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 081/128] xen/pciback: Do not install an IRQ handler for MSI interrupts.
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (79 preceding siblings ...)
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 080/128] xen/pciback: Return error on XEN_PCI_OP_enable_msix " Luis Henriques
@ 2016-01-24 22:00 ` Luis Henriques
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 082/128] xen/pciback: For XEN_PCI_OP_disable_msi[|x] only disable if device has MSI(X) enabled Luis Henriques
` (47 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:00 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Konrad Rzeszutek Wilk, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
commit a396f3a210c3a61e94d6b87ec05a75d0be2a60d0 upstream.
Otherwise an guest can subvert the generic MSI code to trigger
an BUG_ON condition during MSI interrupt freeing:
for (i = 0; i < entry->nvec_used; i++)
BUG_ON(irq_has_action(entry->irq + i));
Xen PCI backed installs an IRQ handler (request_irq) for
the dev->irq whenever the guest writes PCI_COMMAND_MEMORY
(or PCI_COMMAND_IO) to the PCI_COMMAND register. This is
done in case the device has legacy interrupts the GSI line
is shared by the backend devices.
To subvert the backend the guest needs to make the backend
to change the dev->irq from the GSI to the MSI interrupt line,
make the backend allocate an interrupt handler, and then command
the backend to free the MSI interrupt and hit the BUG_ON.
Since the backend only calls 'request_irq' when the guest
writes to the PCI_COMMAND register the guest needs to call
XEN_PCI_OP_enable_msi before any other operation. This will
cause the generic MSI code to setup an MSI entry and
populate dev->irq with the new PIRQ value.
Then the guest can write to PCI_COMMAND PCI_COMMAND_MEMORY
and cause the backend to setup an IRQ handler for dev->irq
(which instead of the GSI value has the MSI pirq). See
'xen_pcibk_control_isr'.
Then the guest disables the MSI: XEN_PCI_OP_disable_msi
which ends up triggering the BUG_ON condition in 'free_msi_irqs'
as there is an IRQ handler for the entry->irq (dev->irq).
Note that this cannot be done using MSI-X as the generic
code does not over-write dev->irq with the MSI-X PIRQ values.
The patch inhibits setting up the IRQ handler if MSI or
MSI-X (for symmetry reasons) code had been called successfully.
P.S.
Xen PCIBack when it sets up the device for the guest consumption
ends up writting 0 to the PCI_COMMAND (see xen_pcibk_reset_device).
XSA-120 addendum patch removed that - however when upstreaming said
addendum we found that it caused issues with qemu upstream. That
has now been fixed in qemu upstream.
This is part of XSA-157
Reviewed-by: David Vrabel <david.vrabel@citrix.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/xen/xen-pciback/pciback_ops.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/xen/xen-pciback/pciback_ops.c b/drivers/xen/xen-pciback/pciback_ops.c
index 029f33ddb8bf..d0696ce31e9b 100644
--- a/drivers/xen/xen-pciback/pciback_ops.c
+++ b/drivers/xen/xen-pciback/pciback_ops.c
@@ -70,6 +70,13 @@ static void xen_pcibk_control_isr(struct pci_dev *dev, int reset)
enable ? "enable" : "disable");
if (enable) {
+ /*
+ * The MSI or MSI-X should not have an IRQ handler. Otherwise
+ * if the guest terminates we BUG_ON in free_msi_irqs.
+ */
+ if (dev->msi_enabled || dev->msix_enabled)
+ goto out;
+
rc = request_irq(dev_data->irq,
xen_pcibk_guest_interrupt, IRQF_SHARED,
dev_data->irq_name, dev);
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 082/128] xen/pciback: For XEN_PCI_OP_disable_msi[|x] only disable if device has MSI(X) enabled.
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (80 preceding siblings ...)
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 081/128] xen/pciback: Do not install an IRQ handler for MSI interrupts Luis Henriques
@ 2016-01-24 22:00 ` Luis Henriques
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 083/128] xen/pciback: Don't allow MSI-X ops if PCI_COMMAND_MEMORY is not set Luis Henriques
` (46 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:00 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Konrad Rzeszutek Wilk, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
commit 7cfb905b9638982862f0331b36ccaaca5d383b49 upstream.
Otherwise just continue on, returning the same values as
previously (return of 0, and op->result has the PIRQ value).
This does not change the behavior of XEN_PCI_OP_disable_msi[|x].
The pci_disable_msi or pci_disable_msix have the checks for
msi_enabled or msix_enabled so they will error out immediately.
However the guest can still call these operations and cause
us to disable the 'ack_intr'. That means the backend IRQ handler
for the legacy interrupt will not respond to interrupts anymore.
This will lead to (if the device is causing an interrupt storm)
for the Linux generic code to disable the interrupt line.
Naturally this will only happen if the device in question
is plugged in on the motherboard on shared level interrupt GSI.
This is part of XSA-157
Reviewed-by: David Vrabel <david.vrabel@citrix.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/xen/xen-pciback/pciback_ops.c | 33 ++++++++++++++++++++-------------
1 file changed, 20 insertions(+), 13 deletions(-)
diff --git a/drivers/xen/xen-pciback/pciback_ops.c b/drivers/xen/xen-pciback/pciback_ops.c
index d0696ce31e9b..4ee5fc080483 100644
--- a/drivers/xen/xen-pciback/pciback_ops.c
+++ b/drivers/xen/xen-pciback/pciback_ops.c
@@ -185,20 +185,23 @@ static
int xen_pcibk_disable_msi(struct xen_pcibk_device *pdev,
struct pci_dev *dev, struct xen_pci_op *op)
{
- struct xen_pcibk_dev_data *dev_data;
-
if (unlikely(verbose_request))
printk(KERN_DEBUG DRV_NAME ": %s: disable MSI\n",
pci_name(dev));
- pci_disable_msi(dev);
+ if (dev->msi_enabled) {
+ struct xen_pcibk_dev_data *dev_data;
+
+ pci_disable_msi(dev);
+
+ dev_data = pci_get_drvdata(dev);
+ if (dev_data)
+ dev_data->ack_intr = 1;
+ }
op->value = dev->irq ? xen_pirq_from_irq(dev->irq) : 0;
if (unlikely(verbose_request))
printk(KERN_DEBUG DRV_NAME ": %s: MSI: %d\n", pci_name(dev),
op->value);
- dev_data = pci_get_drvdata(dev);
- if (dev_data)
- dev_data->ack_intr = 1;
return 0;
}
@@ -264,23 +267,27 @@ static
int xen_pcibk_disable_msix(struct xen_pcibk_device *pdev,
struct pci_dev *dev, struct xen_pci_op *op)
{
- struct xen_pcibk_dev_data *dev_data;
if (unlikely(verbose_request))
printk(KERN_DEBUG DRV_NAME ": %s: disable MSI-X\n",
pci_name(dev));
- pci_disable_msix(dev);
+ if (dev->msix_enabled) {
+ struct xen_pcibk_dev_data *dev_data;
+
+ pci_disable_msix(dev);
+
+ dev_data = pci_get_drvdata(dev);
+ if (dev_data)
+ dev_data->ack_intr = 1;
+ }
/*
* SR-IOV devices (which don't have any legacy IRQ) have
* an undefined IRQ value of zero.
*/
op->value = dev->irq ? xen_pirq_from_irq(dev->irq) : 0;
if (unlikely(verbose_request))
- printk(KERN_DEBUG DRV_NAME ": %s: MSI-X: %d\n", pci_name(dev),
- op->value);
- dev_data = pci_get_drvdata(dev);
- if (dev_data)
- dev_data->ack_intr = 1;
+ printk(KERN_DEBUG DRV_NAME ": %s: MSI-X: %d\n",
+ pci_name(dev), op->value);
return 0;
}
#endif
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 083/128] xen/pciback: Don't allow MSI-X ops if PCI_COMMAND_MEMORY is not set.
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (81 preceding siblings ...)
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 082/128] xen/pciback: For XEN_PCI_OP_disable_msi[|x] only disable if device has MSI(X) enabled Luis Henriques
@ 2016-01-24 22:00 ` Luis Henriques
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 084/128] USB: ipaq.c: fix a timeout loop Luis Henriques
` (45 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:00 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Konrad Rzeszutek Wilk, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
commit 408fb0e5aa7fda0059db282ff58c3b2a4278baa0 upstream.
commit f598282f51 ("PCI: Fix the NIU MSI-X problem in a better way")
teaches us that dealing with MSI-X can be troublesome.
Further checks in the MSI-X architecture shows that if the
PCI_COMMAND_MEMORY bit is turned of in the PCI_COMMAND we
may not be able to access the BAR (since they are memory regions).
Since the MSI-X tables are located in there.. that can lead
to us causing PCIe errors. Inhibit us performing any
operation on the MSI-X unless the MEMORY bit is set.
Note that Xen hypervisor with:
"x86/MSI-X: access MSI-X table only after having enabled MSI-X"
will return:
xen_pciback: 0000:0a:00.1: error -6 enabling MSI-X for guest 3!
When the generic MSI code tries to setup the PIRQ without
MEMORY bit set. Which means with later versions of Xen
(4.6) this patch is not neccessary.
This is part of XSA-157
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/xen/xen-pciback/pciback_ops.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/xen/xen-pciback/pciback_ops.c b/drivers/xen/xen-pciback/pciback_ops.c
index 4ee5fc080483..73dafdc494aa 100644
--- a/drivers/xen/xen-pciback/pciback_ops.c
+++ b/drivers/xen/xen-pciback/pciback_ops.c
@@ -212,6 +212,7 @@ int xen_pcibk_enable_msix(struct xen_pcibk_device *pdev,
struct xen_pcibk_dev_data *dev_data;
int i, result;
struct msix_entry *entries;
+ u16 cmd;
if (unlikely(verbose_request))
printk(KERN_DEBUG DRV_NAME ": %s: enable MSI-X\n",
@@ -223,7 +224,12 @@ int xen_pcibk_enable_msix(struct xen_pcibk_device *pdev,
if (dev->msix_enabled)
return -EALREADY;
- if (dev->msi_enabled)
+ /*
+ * PCI_COMMAND_MEMORY must be enabled, otherwise we may not be able
+ * to access the BARs where the MSI-X entries reside.
+ */
+ pci_read_config_word(dev, PCI_COMMAND, &cmd);
+ if (dev->msi_enabled || !(cmd & PCI_COMMAND_MEMORY))
return -ENXIO;
entries = kmalloc(op->value * sizeof(*entries), GFP_KERNEL);
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 084/128] USB: ipaq.c: fix a timeout loop
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (82 preceding siblings ...)
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 083/128] xen/pciback: Don't allow MSI-X ops if PCI_COMMAND_MEMORY is not set Luis Henriques
@ 2016-01-24 22:00 ` Luis Henriques
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 085/128] USB: fix invalid memory access in hub_activate() Luis Henriques
` (44 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:00 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Dan Carpenter, Greg Kroah-Hartman, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
commit abdc9a3b4bac97add99e1d77dc6d28623afe682b upstream.
The code expects the loop to end with "retries" set to zero but, because
it is a post-op, it will end set to -1. I have fixed this by moving the
decrement inside the loop.
Fixes: 014aa2a3c32e ('USB: ipaq: minor ipaq_open() cleanup.')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/usb/serial/ipaq.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/serial/ipaq.c b/drivers/usb/serial/ipaq.c
index f51a5d52c0ed..ec1b8f2c1183 100644
--- a/drivers/usb/serial/ipaq.c
+++ b/drivers/usb/serial/ipaq.c
@@ -531,7 +531,8 @@ static int ipaq_open(struct tty_struct *tty,
* through. Since this has a reasonably high failure rate, we retry
* several times.
*/
- while (retries--) {
+ while (retries) {
+ retries--;
result = usb_control_msg(serial->dev,
usb_sndctrlpipe(serial->dev, 0), 0x22, 0x21,
0x1, 0, NULL, 0, 100);
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 085/128] USB: fix invalid memory access in hub_activate()
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (83 preceding siblings ...)
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 084/128] USB: ipaq.c: fix a timeout loop Luis Henriques
@ 2016-01-24 22:00 ` Luis Henriques
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 086/128] pinctrl: bcm2835: Fix initial value for direction_output Luis Henriques
` (43 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:00 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Alan Stern, Greg Kroah-Hartman, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Alan Stern <stern@rowland.harvard.edu>
commit e50293ef9775c5f1cf3fcc093037dd6a8c5684ea upstream.
Commit 8520f38099cc ("USB: change hub initialization sleeps to
delayed_work") changed the hub_activate() routine to make part of it
run in a workqueue. However, the commit failed to take a reference to
the usb_hub structure or to lock the hub interface while doing so. As
a result, if a hub is plugged in and quickly unplugged before the work
routine can run, the routine will try to access memory that has been
deallocated. Or, if the hub is unplugged while the routine is
running, the memory may be deallocated while it is in active use.
This patch fixes the problem by taking a reference to the usb_hub at
the start of hub_activate() and releasing it at the end (when the work
is finished), and by locking the hub interface while the work routine
is running. It also adds a check at the start of the routine to see
if the hub has already been disconnected, in which nothing should be
done.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-by: Alexandru Cornea <alexandru.cornea@intel.com>
Tested-by: Alexandru Cornea <alexandru.cornea@intel.com>
Fixes: 8520f38099cc ("USB: change hub initialization sleeps to delayed_work")
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ luis: backported to 3.16:
- Added forward declaration of hub_release() which mainline had with commit
32a6958998c5 ("usb: hub: convert khubd into workqueue") ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/usb/core/hub.c | 23 ++++++++++++++++++++---
1 file changed, 20 insertions(+), 3 deletions(-)
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index a1e577777a02..673d426de13f 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -104,6 +104,7 @@ EXPORT_SYMBOL_GPL(ehci_cf_port_reset_rwsem);
#define HUB_DEBOUNCE_STEP 25
#define HUB_DEBOUNCE_STABLE 100
+static void hub_release(struct kref *kref);
static int usb_reset_and_verify_device(struct usb_device *udev);
static inline char *portspeed(struct usb_hub *hub, int portstatus)
@@ -1027,10 +1028,20 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
unsigned delay;
/* Continue a partial initialization */
- if (type == HUB_INIT2)
- goto init2;
- if (type == HUB_INIT3)
+ if (type == HUB_INIT2 || type == HUB_INIT3) {
+ device_lock(hub->intfdev);
+
+ /* Was the hub disconnected while we were waiting? */
+ if (hub->disconnected) {
+ device_unlock(hub->intfdev);
+ kref_put(&hub->kref, hub_release);
+ return;
+ }
+ if (type == HUB_INIT2)
+ goto init2;
goto init3;
+ }
+ kref_get(&hub->kref);
/* The superspeed hub except for root hub has to use Hub Depth
* value as an offset into the route string to locate the bits
@@ -1228,6 +1239,7 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
queue_delayed_work(system_power_efficient_wq,
&hub->init_work,
msecs_to_jiffies(delay));
+ device_unlock(hub->intfdev);
return; /* Continues at init3: below */
} else {
msleep(delay);
@@ -1249,6 +1261,11 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
/* Allow autosuspend if it was suppressed */
if (type <= HUB_INIT3)
usb_autopm_put_interface_async(to_usb_interface(hub->intfdev));
+
+ if (type == HUB_INIT2 || type == HUB_INIT3)
+ device_unlock(hub->intfdev);
+
+ kref_put(&hub->kref, hub_release);
}
/* Implement the continuations for the delays above */
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 086/128] pinctrl: bcm2835: Fix initial value for direction_output
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (84 preceding siblings ...)
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 085/128] USB: fix invalid memory access in hub_activate() Luis Henriques
@ 2016-01-24 22:00 ` Luis Henriques
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 087/128] net: phy: mdio-mux: Check return value of mdiobus_alloc() Luis Henriques
` (42 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:00 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Stefan Wahren, Linus Walleij, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Stefan Wahren <stefan.wahren@i2se.com>
commit 4c02cba18cc9de672a554ddda4f23dec8cb4b48e upstream.
Currently the provided initial value for bcm2835_gpio_direction_output
has no effect. So fix this issue by changing the value before
changing the GPIO direction. As a result we need to move the function below
bcm2835_gpio_set.
Suggested-by: Martin Sperl <kernel@martin.sperl.org>
Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
Acked-by: Eric Anholt <eric@anholt.net>
Acked-by: Stephen Warren <swarren@wwwdotorg.org>
Fixes: e1b2dc70cd5b ("pinctrl: add bcm2835 driver")
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
[ luis: backported to 3.16:
- file rename: drivers/pinctrl/bcm/pinctrl-bcm2835.c ->
drivers/pinctrl/pinctrl-bcm2835.c ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/pinctrl/pinctrl-bcm2835.c | 13 +++++++------
1 file changed, 7 insertions(+), 6 deletions(-)
diff --git a/drivers/pinctrl/pinctrl-bcm2835.c b/drivers/pinctrl/pinctrl-bcm2835.c
index 3d907de9bc91..1ad7caf08b6c 100644
--- a/drivers/pinctrl/pinctrl-bcm2835.c
+++ b/drivers/pinctrl/pinctrl-bcm2835.c
@@ -352,12 +352,6 @@ static int bcm2835_gpio_get(struct gpio_chip *chip, unsigned offset)
return bcm2835_gpio_get_bit(pc, GPLEV0, offset);
}
-static int bcm2835_gpio_direction_output(struct gpio_chip *chip,
- unsigned offset, int value)
-{
- return pinctrl_gpio_direction_output(chip->base + offset);
-}
-
static void bcm2835_gpio_set(struct gpio_chip *chip, unsigned offset, int value)
{
struct bcm2835_pinctrl *pc = dev_get_drvdata(chip->dev);
@@ -365,6 +359,13 @@ static void bcm2835_gpio_set(struct gpio_chip *chip, unsigned offset, int value)
bcm2835_gpio_set_bit(pc, value ? GPSET0 : GPCLR0, offset);
}
+static int bcm2835_gpio_direction_output(struct gpio_chip *chip,
+ unsigned offset, int value)
+{
+ bcm2835_gpio_set(chip, offset, value);
+ return pinctrl_gpio_direction_output(chip->base + offset);
+}
+
static int bcm2835_gpio_to_irq(struct gpio_chip *chip, unsigned offset)
{
struct bcm2835_pinctrl *pc = dev_get_drvdata(chip->dev);
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 087/128] net: phy: mdio-mux: Check return value of mdiobus_alloc()
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (85 preceding siblings ...)
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 086/128] pinctrl: bcm2835: Fix initial value for direction_output Luis Henriques
@ 2016-01-24 22:00 ` Luis Henriques
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 088/128] sh_eth: fix TX buffer byte-swapping Luis Henriques
` (41 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:00 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Tobias Klauser, David S . Miller, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Tobias Klauser <tklauser@distanz.ch>
commit 20b08e1a793d898f0f13040d5418ee0955f678cf upstream.
mdiobus_alloc() might return NULL, but its return value is not
checked in mdio_mux_init(). This could potentially lead to a NULL
pointer dereference. Fix it by checking the return value
Fixes: 0ca2997d1452 ("netdev/of/phy: Add MDIO bus multiplexer support.")
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/net/phy/mdio-mux.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/net/phy/mdio-mux.c b/drivers/net/phy/mdio-mux.c
index 4d4d25efc1e1..ac8a82371f3b 100644
--- a/drivers/net/phy/mdio-mux.c
+++ b/drivers/net/phy/mdio-mux.c
@@ -148,9 +148,14 @@ int mdio_mux_init(struct device *dev,
}
cb->bus_number = v;
cb->parent = pb;
+
cb->mii_bus = mdiobus_alloc();
+ if (!cb->mii_bus) {
+ ret_val = -ENOMEM;
+ of_node_put(child_bus_node);
+ break;
+ }
cb->mii_bus->priv = cb;
-
cb->mii_bus->irq = cb->phy_irq;
cb->mii_bus->name = "mdio_mux";
snprintf(cb->mii_bus->id, MII_BUS_ID_SIZE, "%x.%x",
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 088/128] sh_eth: fix TX buffer byte-swapping
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (86 preceding siblings ...)
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 087/128] net: phy: mdio-mux: Check return value of mdiobus_alloc() Luis Henriques
@ 2016-01-24 22:00 ` Luis Henriques
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 089/128] mISDN: fix a loop count Luis Henriques
` (40 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:00 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Sergei Shtylyov, David S . Miller, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
commit 3e2309937f1e5d538ff13da5fb8de41196927c61 upstream.
For the little-endian SH771x kernels the driver has to byte-swap the RX/TX
buffers, however yet unset physcial address from the TX descriptor is used
to call sh_eth_soft_swap(). Use 'skb->data' instead...
Fixes: 31fcb99d9958 ("net: sh_eth: remove __flush_purge_region")
Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/net/ethernet/renesas/sh_eth.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index d11546c2e902..64bb1edb5ef7 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -2115,8 +2115,7 @@ static int sh_eth_start_xmit(struct sk_buff *skb, struct net_device *ndev)
txdesc = &mdp->tx_ring[entry];
/* soft swap. */
if (!mdp->cd->hw_swap)
- sh_eth_soft_swap(phys_to_virt(ALIGN(txdesc->addr, 4)),
- skb->len + 2);
+ sh_eth_soft_swap(PTR_ALIGN(skb->data, 4), skb->len + 2);
txdesc->addr = dma_map_single(&ndev->dev, skb->data, skb->len,
DMA_TO_DEVICE);
if (skb->len < ETH_ZLEN)
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 089/128] mISDN: fix a loop count
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (87 preceding siblings ...)
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 088/128] sh_eth: fix TX buffer byte-swapping Luis Henriques
@ 2016-01-24 22:00 ` Luis Henriques
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 090/128] amd-xgbe: fix a couple timeout loops Luis Henriques
` (39 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:00 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Dan Carpenter, David S . Miller, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
commit 40d24c4d8a7430aa4dfd7a665fa3faf3b05b673f upstream.
There are two issue here.
1) cnt starts as maxloop + 1 so all these loops iterate one more time
than intended.
2) At the end of the loop we test for "if (maxloop && !cnt)" but for
the first two loops, we end with cnt equal to -1. Changing this to
a pre-op means we end with cnt set to 0.
Fixes: cae86d4a4e56 ('mISDN: Add driver for Infineon ISDN chipset family')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/isdn/hardware/mISDN/mISDNipac.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/drivers/isdn/hardware/mISDN/mISDNipac.c b/drivers/isdn/hardware/mISDN/mISDNipac.c
index ccd7d851be26..92cf6fcd20ac 100644
--- a/drivers/isdn/hardware/mISDN/mISDNipac.c
+++ b/drivers/isdn/hardware/mISDN/mISDNipac.c
@@ -1164,7 +1164,7 @@ mISDNipac_irq(struct ipac_hw *ipac, int maxloop)
if (ipac->type & IPAC_TYPE_IPACX) {
ista = ReadIPAC(ipac, ISACX_ISTA);
- while (ista && cnt--) {
+ while (ista && --cnt) {
pr_debug("%s: ISTA %02x\n", ipac->name, ista);
if (ista & IPACX__ICA)
ipac_irq(&ipac->hscx[0], ista);
@@ -1176,7 +1176,7 @@ mISDNipac_irq(struct ipac_hw *ipac, int maxloop)
}
} else if (ipac->type & IPAC_TYPE_IPAC) {
ista = ReadIPAC(ipac, IPAC_ISTA);
- while (ista && cnt--) {
+ while (ista && --cnt) {
pr_debug("%s: ISTA %02x\n", ipac->name, ista);
if (ista & (IPAC__ICD | IPAC__EXD)) {
istad = ReadISAC(isac, ISAC_ISTA);
@@ -1194,7 +1194,7 @@ mISDNipac_irq(struct ipac_hw *ipac, int maxloop)
ista = ReadIPAC(ipac, IPAC_ISTA);
}
} else if (ipac->type & IPAC_TYPE_HSCX) {
- while (cnt) {
+ while (--cnt) {
ista = ReadIPAC(ipac, IPAC_ISTAB + ipac->hscx[1].off);
pr_debug("%s: B2 ISTA %02x\n", ipac->name, ista);
if (ista)
@@ -1205,7 +1205,6 @@ mISDNipac_irq(struct ipac_hw *ipac, int maxloop)
mISDNisac_irq(isac, istad);
if (0 == (ista | istad))
break;
- cnt--;
}
}
if (cnt > maxloop) /* only for ISAC/HSCX without PCI IRQ test */
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 090/128] amd-xgbe: fix a couple timeout loops
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (88 preceding siblings ...)
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 089/128] mISDN: fix a loop count Luis Henriques
@ 2016-01-24 22:00 ` Luis Henriques
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 091/128] qlcnic: fix a timeout loop Luis Henriques
` (38 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:00 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Dan Carpenter, David S . Miller, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
commit c7557e6a56510ff6636d40ad4ff64a3ef7d9e197 upstream.
At the end of the loop we test "if (!count)" but because "count--" is
a post-op then the loop will end with count set to -1. I have fixed
this by changing it to --count.
Fixes: c5aa9e3b8156 ('amd-xgbe: Initial AMD 10GbE platform driver')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/net/ethernet/amd/xgbe/xgbe-dev.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-dev.c b/drivers/net/ethernet/amd/xgbe/xgbe-dev.c
index 002293b0819d..7038ff66807b 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-dev.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-dev.c
@@ -1296,7 +1296,7 @@ static int xgbe_exit(struct xgbe_prv_data *pdata)
usleep_range(10, 15);
/* Poll Until Poll Condition */
- while (count-- && XGMAC_IOREAD_BITS(pdata, DMA_MR, SWR))
+ while (--count && XGMAC_IOREAD_BITS(pdata, DMA_MR, SWR))
usleep_range(500, 600);
if (!count)
@@ -1317,7 +1317,7 @@ static int xgbe_flush_tx_queues(struct xgbe_prv_data *pdata)
/* Poll Until Poll Condition */
for (i = 0; i < pdata->hw_feat.tx_q_cnt; i++) {
count = 2000;
- while (count-- && XGMAC_MTL_IOREAD_BITS(pdata, i,
+ while (--count && XGMAC_MTL_IOREAD_BITS(pdata, i,
MTL_Q_TQOMR, FTQ))
usleep_range(500, 600);
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 091/128] qlcnic: fix a timeout loop
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (89 preceding siblings ...)
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 090/128] amd-xgbe: fix a couple timeout loops Luis Henriques
@ 2016-01-24 22:00 ` Luis Henriques
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 092/128] ser_gigaset: fix deallocation of platform device structure Luis Henriques
` (37 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:00 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Dan Carpenter, David S . Miller, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
commit 389e4e04ad2d4887c7bdd7c01a93d3dfa5c14a06 upstream.
The problem here is that at the end of the loop we test for if
idc->vnic_wait_limit is zero, but since idc->vnic_wait_limit-- is a
post-op, it actually ends up set to (u8)-1. I have fixed this by
moving the decrement inside the loop.
Fixes: 486a5bc77a4a ('qlcnic: Add support for 83xx suspend and resume.')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_vnic.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_vnic.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_vnic.c
index be7d7a62cc0d..b1a452f291ee 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_vnic.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_vnic.c
@@ -246,7 +246,8 @@ int qlcnic_83xx_check_vnic_state(struct qlcnic_adapter *adapter)
u32 state;
state = QLCRDX(ahw, QLC_83XX_VNIC_STATE);
- while (state != QLCNIC_DEV_NPAR_OPER && idc->vnic_wait_limit--) {
+ while (state != QLCNIC_DEV_NPAR_OPER && idc->vnic_wait_limit) {
+ idc->vnic_wait_limit--;
msleep(1000);
state = QLCRDX(ahw, QLC_83XX_VNIC_STATE);
}
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 092/128] ser_gigaset: fix deallocation of platform device structure
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (90 preceding siblings ...)
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 091/128] qlcnic: fix a timeout loop Luis Henriques
@ 2016-01-24 22:00 ` Luis Henriques
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 093/128] net: fix warnings in 'make htmldocs' by moving macro definition out of field declaration Luis Henriques
` (36 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:00 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Tilman Schmidt, Paul Bolle, David S . Miller, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Tilman Schmidt <tilman@imap.cc>
commit 4c5e354a974214dfb44cd23fa0429327693bc3ea upstream.
When shutting down the device, the struct ser_cardstate must not be
kfree()d immediately after the call to platform_device_unregister()
since the embedded struct platform_device is still in use.
Move the kfree() call to the release method instead.
Signed-off-by: Tilman Schmidt <tilman@imap.cc>
Fixes: 2869b23e4b95 ("drivers/isdn/gigaset: new M101 driver (v2)")
Reported-by: Sasha Levin <sasha.levin@oracle.com>
Signed-off-by: Paul Bolle <pebolle@tiscali.nl>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/isdn/gigaset/ser-gigaset.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/drivers/isdn/gigaset/ser-gigaset.c b/drivers/isdn/gigaset/ser-gigaset.c
index 3ac9c4194814..0ebb52b0336d 100644
--- a/drivers/isdn/gigaset/ser-gigaset.c
+++ b/drivers/isdn/gigaset/ser-gigaset.c
@@ -370,19 +370,23 @@ static void gigaset_freecshw(struct cardstate *cs)
tasklet_kill(&cs->write_tasklet);
if (!cs->hw.ser)
return;
- dev_set_drvdata(&cs->hw.ser->dev.dev, NULL);
platform_device_unregister(&cs->hw.ser->dev);
- kfree(cs->hw.ser);
- cs->hw.ser = NULL;
}
static void gigaset_device_release(struct device *dev)
{
struct platform_device *pdev = to_platform_device(dev);
+ struct cardstate *cs = dev_get_drvdata(dev);
/* adapted from platform_device_release() in drivers/base/platform.c */
kfree(dev->platform_data);
kfree(pdev->resource);
+
+ if (!cs)
+ return;
+ dev_set_drvdata(dev, NULL);
+ kfree(cs->hw.ser);
+ cs->hw.ser = NULL;
}
/*
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 093/128] net: fix warnings in 'make htmldocs' by moving macro definition out of field declaration
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (91 preceding siblings ...)
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 092/128] ser_gigaset: fix deallocation of platform device structure Luis Henriques
@ 2016-01-24 22:00 ` Luis Henriques
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 094/128] include/linux/mmdebug.h: should include linux/bug.h Luis Henriques
` (35 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:00 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Hannes Frederic Sowa, David S . Miller, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Hannes Frederic Sowa <hannes@stressinduktion.org>
commit 7bbadd2d1009575dad675afc16650ebb5aa10612 upstream.
Docbook does not like the definition of macros inside a field declaration
and adds a warning. Move the definition out.
Fixes: 79462ad02e86180 ("net: add validation for the socket syscall protocol argument")
Reported-by: kbuild test robot <lkp@intel.com>
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
include/net/sock.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/net/sock.h b/include/net/sock.h
index dd06b32abea3..2b2960fcc878 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -376,8 +376,8 @@ struct sock {
sk_no_check_rx : 1,
sk_userlocks : 4,
sk_protocol : 8,
-#define SK_PROTOCOL_MAX U8_MAX
sk_type : 16;
+#define SK_PROTOCOL_MAX U8_MAX
kmemcheck_bitfield_end(flags);
int sk_wmem_queued;
gfp_t sk_allocation;
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 094/128] include/linux/mmdebug.h: should include linux/bug.h
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (92 preceding siblings ...)
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 093/128] net: fix warnings in 'make htmldocs' by moving macro definition out of field declaration Luis Henriques
@ 2016-01-24 22:00 ` Luis Henriques
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 095/128] drm/i915: Fix SRC_COPY width on 830/845g Luis Henriques
` (34 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:00 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: James Morse, Andrew Morton, Linus Torvalds, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: James Morse <james.morse@arm.com>
commit 1d5cda4076d930d6d52088ed2c7753f7c564cbd7 upstream.
mmdebug.h uses BUILD_BUG_ON_INVALID(), assuming someone else included
linux/bug.h. Include it ourselves.
This saves build-failures such as:
arch/arm64/include/asm/pgtable.h: In function 'set_pte_at':
arch/arm64/include/asm/pgtable.h:281:3: error: implicit declaration of function 'BUILD_BUG_ON_INVALID' [-Werror=implicit-function-declaration]
VM_WARN_ONCE(!pte_young(pte),
Fixes: 02602a18c32d7 ("bug: completely remove code generated by disabled VM_BUG_ON()")
Signed-off-by: James Morse <james.morse@arm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
include/linux/mmdebug.h | 1 +
1 file changed, 1 insertion(+)
diff --git a/include/linux/mmdebug.h b/include/linux/mmdebug.h
index edd82a105220..e23860eb29c1 100644
--- a/include/linux/mmdebug.h
+++ b/include/linux/mmdebug.h
@@ -1,6 +1,7 @@
#ifndef LINUX_MM_DEBUG_H
#define LINUX_MM_DEBUG_H 1
+#include <linux/bug.h>
#include <linux/stringify.h>
struct page;
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 095/128] drm/i915: Fix SRC_COPY width on 830/845g
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (93 preceding siblings ...)
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 094/128] include/linux/mmdebug.h: should include linux/bug.h Luis Henriques
@ 2016-01-24 22:00 ` Luis Henriques
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 096/128] vmstat: allocate vmstat_wq before it is used Luis Henriques
` (33 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:00 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Chris Wilson, Thomas Richter, Jani Nikula, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Chris Wilson <chris@chris-wilson.co.uk>
commit 611a7a4fd8b5fb6b25ab1f8bdcde61800a7feacf upstream.
One small change I forgot to make in
commit c4d69da167fa967749aeb70bc0e94a457e5d00c1
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date: Mon Sep 8 14:25:41 2014 +0100
drm/i915: Evict CS TLBs between batches
was to update the copy width for the compact BLT copy instruction.
Reported-by: Thomas Richter <thor@math.tu-berlin.de>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Thomas Richter <thor@math.tu-berlin.de>
Cc: Jani Nikula <jani.nikula@intel.com>
Tested-by: Thomas Richter <thor@math.tu-berlin.de>
Acked-by: Daniel Vetter <daniel@ffwll.ch>
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/gpu/drm/i915/intel_ringbuffer.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
index 6a7a35acdfa7..b849fde1ea74 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
@@ -1284,7 +1284,7 @@ i830_dispatch_execbuffer(struct intel_engine_cs *ring,
*/
intel_ring_emit(ring, SRC_COPY_BLT_CMD | BLT_WRITE_RGBA);
intel_ring_emit(ring, BLT_DEPTH_32 | BLT_ROP_SRC_COPY | 4096);
- intel_ring_emit(ring, DIV_ROUND_UP(len, 4096) << 16 | 1024);
+ intel_ring_emit(ring, DIV_ROUND_UP(len, 4096) << 16 | 4096);
intel_ring_emit(ring, cs_offset);
intel_ring_emit(ring, 4096);
intel_ring_emit(ring, offset);
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 096/128] vmstat: allocate vmstat_wq before it is used
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (94 preceding siblings ...)
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 095/128] drm/i915: Fix SRC_COPY width on 830/845g Luis Henriques
@ 2016-01-24 22:00 ` Luis Henriques
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 097/128] KVM: PPC: Book3S HV: Prohibit setting illegal transaction state in MSR Luis Henriques
` (32 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:00 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Michal Hocko, Andrew Morton, Linus Torvalds, Ben Hutchings,
Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Michal Hocko <mhocko@suse.com>
commit 751e5f5c753e8d447bcf89f9e96b9616ac081628 upstream.
kernel test robot has reported the following crash:
BUG: unable to handle kernel NULL pointer dereference at 00000100
IP: [<c1074df6>] __queue_work+0x26/0x390
*pdpt = 0000000000000000 *pde = f000ff53f000ff53 *pde = f000ff53f000ff53
Oops: 0000 [#1] PREEMPT PREEMPT SMP SMP
CPU: 0 PID: 24 Comm: kworker/0:1 Not tainted 4.4.0-rc4-00139-g373ccbe #1
Workqueue: events vmstat_shepherd
task: cb684600 ti: cb7ba000 task.ti: cb7ba000
EIP: 0060:[<c1074df6>] EFLAGS: 00010046 CPU: 0
EIP is at __queue_work+0x26/0x390
EAX: 00000046 EBX: cbb37800 ECX: cbb37800 EDX: 00000000
ESI: 00000000 EDI: 00000000 EBP: cb7bbe68 ESP: cb7bbe38
DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
CR0: 8005003b CR2: 00000100 CR3: 01fd5000 CR4: 000006b0
Stack:
Call Trace:
__queue_delayed_work+0xa1/0x160
queue_delayed_work_on+0x36/0x60
vmstat_shepherd+0xad/0xf0
process_one_work+0x1aa/0x4c0
worker_thread+0x41/0x440
kthread+0xb0/0xd0
ret_from_kernel_thread+0x21/0x40
The reason is that start_shepherd_timer schedules the shepherd work item
which uses vmstat_wq (vmstat_shepherd) before setup_vmstat allocates
that workqueue so if the further initialization takes more than HZ we
might end up scheduling on a NULL vmstat_wq. This is really unlikely
but not impossible.
Fixes: 373ccbe59270 ("mm, vmstat: allow WQ concurrency to discover memory reclaim doesn't make any progress")
Reported-by: kernel test robot <ying.huang@linux.intel.com>
Signed-off-by: Michal Hocko <mhocko@suse.com>
Tested-by: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Cc: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Ben Hutchings <ben@decadent.org.uk>
[ luis: backported to 3.16: based on Ben's backport to 3.2:
- as with 3.2, there's a similar race but with the CPU hotplug code ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
mm/vmstat.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/mm/vmstat.c b/mm/vmstat.c
index 7e913ba2b9e0..038f9418b234 100644
--- a/mm/vmstat.c
+++ b/mm/vmstat.c
@@ -1305,6 +1305,8 @@ static int __init setup_vmstat(void)
#ifdef CONFIG_SMP
int cpu;
+ vmstat_wq = alloc_workqueue("vmstat", WQ_FREEZABLE|WQ_MEM_RECLAIM, 0);
+
cpu_notifier_register_begin();
__register_cpu_notifier(&vmstat_notifier);
@@ -1313,7 +1315,6 @@ static int __init setup_vmstat(void)
node_set_state(cpu_to_node(cpu), N_CPU);
}
cpu_notifier_register_done();
- vmstat_wq = alloc_workqueue("vmstat", WQ_FREEZABLE|WQ_MEM_RECLAIM, 0);
#endif
#ifdef CONFIG_PROC_FS
proc_create("buddyinfo", S_IRUGO, NULL, &fragmentation_file_operations);
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 097/128] KVM: PPC: Book3S HV: Prohibit setting illegal transaction state in MSR
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (95 preceding siblings ...)
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 096/128] vmstat: allocate vmstat_wq before it is used Luis Henriques
@ 2016-01-24 22:00 ` Luis Henriques
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 098/128] ASoC: wm8974: set cache type for regmap Luis Henriques
` (31 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:00 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Paul Mackerras, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Paul Mackerras <paulus@ozlabs.org>
commit c20875a3e638e4a03e099b343ec798edd1af5cc6 upstream.
Currently it is possible for userspace (e.g. QEMU) to set a value
for the MSR for a guest VCPU which has both of the TS bits set,
which is an illegal combination. The result of this is that when
we execute a hrfid (hypervisor return from interrupt doubleword)
instruction to enter the guest, the CPU will take a TM Bad Thing
type of program interrupt (vector 0x700).
Now, if PR KVM is configured in the kernel along with HV KVM, we
actually handle this without crashing the host or giving hypervisor
privilege to the guest; instead what happens is that we deliver a
program interrupt to the guest, with SRR0 reflecting the address
of the hrfid instruction and SRR1 containing the MSR value at that
point. If PR KVM is not configured in the kernel, then we try to
run the host's program interrupt handler with the MMU set to the
guest context, which almost certainly causes a host crash.
This closes the hole by making kvmppc_set_msr_hv() check for the
illegal combination and force the TS field to a safe value (00,
meaning non-transactional).
Signed-off-by: Paul Mackerras <paulus@samba.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
arch/powerpc/kvm/book3s_hv.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
index 0f3a19237444..89d4ebd8152b 100644
--- a/arch/powerpc/kvm/book3s_hv.c
+++ b/arch/powerpc/kvm/book3s_hv.c
@@ -166,6 +166,12 @@ static void kvmppc_core_vcpu_put_hv(struct kvm_vcpu *vcpu)
static void kvmppc_set_msr_hv(struct kvm_vcpu *vcpu, u64 msr)
{
+ /*
+ * Check for illegal transactional state bit combination
+ * and if we find it, force the TS field to a safe state.
+ */
+ if ((msr & MSR_TS_MASK) == MSR_TS_MASK)
+ msr &= ~MSR_TS_MASK;
vcpu->arch.shregs.msr = msr;
kvmppc_end_cede(vcpu);
}
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 098/128] ASoC: wm8974: set cache type for regmap
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (96 preceding siblings ...)
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 097/128] KVM: PPC: Book3S HV: Prohibit setting illegal transaction state in MSR Luis Henriques
@ 2016-01-24 22:00 ` Luis Henriques
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 099/128] ARM: dts: imx6: Fix Ethernet PHY mode on Ventana boards Luis Henriques
` (30 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:00 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Mans Rullgard, Mark Brown, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Mans Rullgard <mans@mansr.com>
commit 1ea5998afe903384ddc16391d4c023cd4c867bea upstream.
Attempting to use this codec driver triggers a BUG() in regcache_sync()
since no cache type is set. The register map of this device is fairly
small and has few holes so a flat cache is suitable.
Signed-off-by: Mans Rullgard <mans@mansr.com>
Acked-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
sound/soc/codecs/wm8974.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/sound/soc/codecs/wm8974.c b/sound/soc/codecs/wm8974.c
index 0627c56fa44e..c2248db97fc4 100644
--- a/sound/soc/codecs/wm8974.c
+++ b/sound/soc/codecs/wm8974.c
@@ -587,6 +587,7 @@ static const struct regmap_config wm8974_regmap = {
.max_register = WM8974_MONOMIX,
.reg_defaults = wm8974_reg_defaults,
.num_reg_defaults = ARRAY_SIZE(wm8974_reg_defaults),
+ .cache_type = REGCACHE_FLAT,
};
static int wm8974_probe(struct snd_soc_codec *codec)
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 099/128] ARM: dts: imx6: Fix Ethernet PHY mode on Ventana boards
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (97 preceding siblings ...)
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 098/128] ASoC: wm8974: set cache type for regmap Luis Henriques
@ 2016-01-24 22:00 ` Luis Henriques
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 100/128] scripts: recordmcount: break hardlinks Luis Henriques
` (29 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:00 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Krzysztof Hałasa, Shawn Guo, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: =?UTF-8?q?Krzysztof=20Ha=C5=82asa?= <khalasa@piap.pl>
commit 3a35e470bc6bc4ce34c19c410ebbe4e3bbf0bafe upstream.
Gateworks Ventana boards seem to need "RGMII-ID" (internal delay)
PHY mode, instead of simple "RGMII", for their Marvell 88E1510
transceiver. Otherwise, the Ethernet MAC doesn't work with Marvell PHY
driver (TX doesn't seem to work correctly).
Tested on GW5400 rev. C.
This bug affects ARM Fedora 23.
Signed-off-by: Krzysztof Hałasa <khalasa@piap.pl>
Acked-by: Tim Harvey <tharvey@gateworks.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
arch/arm/boot/dts/imx6q-gw5400-a.dts | 2 +-
arch/arm/boot/dts/imx6qdl-gw51xx.dtsi | 2 +-
arch/arm/boot/dts/imx6qdl-gw52xx.dtsi | 2 +-
arch/arm/boot/dts/imx6qdl-gw53xx.dtsi | 2 +-
arch/arm/boot/dts/imx6qdl-gw54xx.dtsi | 2 +-
5 files changed, 5 insertions(+), 5 deletions(-)
diff --git a/arch/arm/boot/dts/imx6q-gw5400-a.dts b/arch/arm/boot/dts/imx6q-gw5400-a.dts
index 3689eaa58826..5e59ed27513d 100644
--- a/arch/arm/boot/dts/imx6q-gw5400-a.dts
+++ b/arch/arm/boot/dts/imx6q-gw5400-a.dts
@@ -152,7 +152,7 @@
&fec {
pinctrl-names = "default";
pinctrl-0 = <&pinctrl_enet>;
- phy-mode = "rgmii";
+ phy-mode = "rgmii-id";
phy-reset-gpios = <&gpio1 30 0>;
status = "okay";
};
diff --git a/arch/arm/boot/dts/imx6qdl-gw51xx.dtsi b/arch/arm/boot/dts/imx6qdl-gw51xx.dtsi
index 0db15af41cb1..1ad3d9ec799b 100644
--- a/arch/arm/boot/dts/imx6qdl-gw51xx.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-gw51xx.dtsi
@@ -90,7 +90,7 @@
&fec {
pinctrl-names = "default";
pinctrl-0 = <&pinctrl_enet>;
- phy-mode = "rgmii";
+ phy-mode = "rgmii-id";
phy-reset-gpios = <&gpio1 30 0>;
status = "okay";
};
diff --git a/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi b/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi
index 744c8a2d81f6..1c8c333bd1fb 100644
--- a/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi
@@ -144,7 +144,7 @@
&fec {
pinctrl-names = "default";
pinctrl-0 = <&pinctrl_enet>;
- phy-mode = "rgmii";
+ phy-mode = "rgmii-id";
phy-reset-gpios = <&gpio1 30 0>;
status = "okay";
};
diff --git a/arch/arm/boot/dts/imx6qdl-gw53xx.dtsi b/arch/arm/boot/dts/imx6qdl-gw53xx.dtsi
index adf150c1be90..1000d1403255 100644
--- a/arch/arm/boot/dts/imx6qdl-gw53xx.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-gw53xx.dtsi
@@ -153,7 +153,7 @@
&fec {
pinctrl-names = "default";
pinctrl-0 = <&pinctrl_enet>;
- phy-mode = "rgmii";
+ phy-mode = "rgmii-id";
phy-reset-gpios = <&gpio1 30 0>;
status = "okay";
};
diff --git a/arch/arm/boot/dts/imx6qdl-gw54xx.dtsi b/arch/arm/boot/dts/imx6qdl-gw54xx.dtsi
index 698d3063b295..f993f5194135 100644
--- a/arch/arm/boot/dts/imx6qdl-gw54xx.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-gw54xx.dtsi
@@ -143,7 +143,7 @@
&fec {
pinctrl-names = "default";
pinctrl-0 = <&pinctrl_enet>;
- phy-mode = "rgmii";
+ phy-mode = "rgmii-id";
phy-reset-gpios = <&gpio1 30 0>;
status = "okay";
};
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 100/128] scripts: recordmcount: break hardlinks
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (98 preceding siblings ...)
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 099/128] ARM: dts: imx6: Fix Ethernet PHY mode on Ventana boards Luis Henriques
@ 2016-01-24 22:00 ` Luis Henriques
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 101/128] ftrace/scripts: Have recordmcount copy the object file Luis Henriques
` (28 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:00 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Russell King, Steven Rostedt, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Russell King <rmk+kernel@arm.linux.org.uk>
commit dd39a26538e37f6c6131e829a4a510787e43c783 upstream.
recordmcount edits the file in-place, which can cause problems when
using ccache in hardlink mode. Arrange for recordmcount to break a
hardlinked object.
Link: http://lkml.kernel.org/r/E1a7MVT-0000et-62@rmk-PC.arm.linux.org.uk
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
scripts/recordmcount.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/scripts/recordmcount.c b/scripts/recordmcount.c
index 650ecc83d7d7..26f0cd2c8e9a 100644
--- a/scripts/recordmcount.c
+++ b/scripts/recordmcount.c
@@ -194,6 +194,20 @@ static void *mmap_file(char const *fname)
addr = umalloc(sb.st_size);
uread(fd_map, addr, sb.st_size);
}
+ if (sb.st_nlink != 1) {
+ /* file is hard-linked, break the hard link */
+ close(fd_map);
+ if (unlink(fname) < 0) {
+ perror(fname);
+ fail_file();
+ }
+ fd_map = open(fname, O_RDWR | O_CREAT, sb.st_mode);
+ if (fd_map < 0) {
+ perror(fname);
+ fail_file();
+ }
+ uwrite(fd_map, addr, sb.st_size);
+ }
return addr;
}
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 101/128] ftrace/scripts: Have recordmcount copy the object file
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (99 preceding siblings ...)
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 100/128] scripts: recordmcount: break hardlinks Luis Henriques
@ 2016-01-24 22:00 ` Luis Henriques
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 102/128] ALSA: hda - Set SKL+ hda controller power at freeze() and thaw() Luis Henriques
` (27 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:00 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Steven Rostedt, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>
commit a50bd43935586420fb75f4558369eb08566fac5e upstream.
Russell King found that he had weird side effects when compiling the kernel
with hard linked ccache. The reason was that recordmcount modified the
kernel in place via mmap, and when a file gets modified twice by
recordmcount, it will complain about it. To fix this issue, Russell wrote a
patch that checked if the file was hard linked more than once and would
unlink it if it was.
Linus Torvalds was not happy with the fact that recordmcount does this in
place modification. Instead of doing the unlink only if the file has two or
more hard links, it does the unlink all the time. In otherwords, it always
does a copy if it changed something. That is, it does the write out if a
change was made.
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
scripts/recordmcount.c | 145 +++++++++++++++++++++++++++++++++++++------------
1 file changed, 110 insertions(+), 35 deletions(-)
diff --git a/scripts/recordmcount.c b/scripts/recordmcount.c
index 26f0cd2c8e9a..d6e6cc43d8af 100644
--- a/scripts/recordmcount.c
+++ b/scripts/recordmcount.c
@@ -47,12 +47,17 @@
static int fd_map; /* File descriptor for file being modified. */
static int mmap_failed; /* Boolean flag. */
-static void *ehdr_curr; /* current ElfXX_Ehdr * for resource cleanup */
static char gpfx; /* prefix for global symbol name (sometimes '_') */
static struct stat sb; /* Remember .st_size, etc. */
static jmp_buf jmpenv; /* setjmp/longjmp per-file error escape */
static const char *altmcount; /* alternate mcount symbol name */
static int warn_on_notrace_sect; /* warn when section has mcount not being recorded */
+static void *file_map; /* pointer of the mapped file */
+static void *file_end; /* pointer to the end of the mapped file */
+static int file_updated; /* flag to state file was changed */
+static void *file_ptr; /* current file pointer location */
+static void *file_append; /* added to the end of the file */
+static size_t file_append_size; /* how much is added to end of file */
/* setjmp() return values */
enum {
@@ -66,10 +71,14 @@ static void
cleanup(void)
{
if (!mmap_failed)
- munmap(ehdr_curr, sb.st_size);
+ munmap(file_map, sb.st_size);
else
- free(ehdr_curr);
- close(fd_map);
+ free(file_map);
+ file_map = NULL;
+ free(file_append);
+ file_append = NULL;
+ file_append_size = 0;
+ file_updated = 0;
}
static void __attribute__((noreturn))
@@ -91,12 +100,22 @@ succeed_file(void)
static off_t
ulseek(int const fd, off_t const offset, int const whence)
{
- off_t const w = lseek(fd, offset, whence);
- if (w == (off_t)-1) {
- perror("lseek");
+ switch (whence) {
+ case SEEK_SET:
+ file_ptr = file_map + offset;
+ break;
+ case SEEK_CUR:
+ file_ptr += offset;
+ break;
+ case SEEK_END:
+ file_ptr = file_map + (sb.st_size - offset);
+ break;
+ }
+ if (file_ptr < file_map) {
+ fprintf(stderr, "lseek: seek before file\n");
fail_file();
}
- return w;
+ return file_ptr - file_map;
}
static size_t
@@ -113,12 +132,38 @@ uread(int const fd, void *const buf, size_t const count)
static size_t
uwrite(int const fd, void const *const buf, size_t const count)
{
- size_t const n = write(fd, buf, count);
- if (n != count) {
- perror("write");
- fail_file();
+ size_t cnt = count;
+ off_t idx = 0;
+
+ file_updated = 1;
+
+ if (file_ptr + count >= file_end) {
+ off_t aoffset = (file_ptr + count) - file_end;
+
+ if (aoffset > file_append_size) {
+ file_append = realloc(file_append, aoffset);
+ file_append_size = aoffset;
+ }
+ if (!file_append) {
+ perror("write");
+ fail_file();
+ }
+ if (file_ptr < file_end) {
+ cnt = file_end - file_ptr;
+ } else {
+ cnt = 0;
+ idx = aoffset - count;
+ }
}
- return n;
+
+ if (cnt)
+ memcpy(file_ptr, buf, cnt);
+
+ if (cnt < count)
+ memcpy(file_append + idx, buf + cnt, count - cnt);
+
+ file_ptr += count;
+ return count;
}
static void *
@@ -175,9 +220,7 @@ static int make_nop_x86(void *map, size_t const offset)
*/
static void *mmap_file(char const *fname)
{
- void *addr;
-
- fd_map = open(fname, O_RDWR);
+ fd_map = open(fname, O_RDONLY);
if (fd_map < 0 || fstat(fd_map, &sb) < 0) {
perror(fname);
fail_file();
@@ -186,29 +229,58 @@ static void *mmap_file(char const *fname)
fprintf(stderr, "not a regular file: %s\n", fname);
fail_file();
}
- addr = mmap(0, sb.st_size, PROT_READ|PROT_WRITE, MAP_PRIVATE,
- fd_map, 0);
+ file_map = mmap(0, sb.st_size, PROT_READ|PROT_WRITE, MAP_PRIVATE,
+ fd_map, 0);
mmap_failed = 0;
- if (addr == MAP_FAILED) {
+ if (file_map == MAP_FAILED) {
mmap_failed = 1;
- addr = umalloc(sb.st_size);
- uread(fd_map, addr, sb.st_size);
+ file_map = umalloc(sb.st_size);
+ uread(fd_map, file_map, sb.st_size);
}
- if (sb.st_nlink != 1) {
- /* file is hard-linked, break the hard link */
- close(fd_map);
- if (unlink(fname) < 0) {
- perror(fname);
- fail_file();
- }
- fd_map = open(fname, O_RDWR | O_CREAT, sb.st_mode);
- if (fd_map < 0) {
- perror(fname);
+ close(fd_map);
+
+ file_end = file_map + sb.st_size;
+
+ return file_map;
+}
+
+static void write_file(const char *fname)
+{
+ char tmp_file[strlen(fname) + 4];
+ size_t n;
+
+ if (!file_updated)
+ return;
+
+ sprintf(tmp_file, "%s.rc", fname);
+
+ /*
+ * After reading the entire file into memory, delete it
+ * and write it back, to prevent weird side effects of modifying
+ * an object file in place.
+ */
+ fd_map = open(tmp_file, O_WRONLY | O_TRUNC | O_CREAT, sb.st_mode);
+ if (fd_map < 0) {
+ perror(fname);
+ fail_file();
+ }
+ n = write(fd_map, file_map, sb.st_size);
+ if (n != sb.st_size) {
+ perror("write");
+ fail_file();
+ }
+ if (file_append_size) {
+ n = write(fd_map, file_append, file_append_size);
+ if (n != file_append_size) {
+ perror("write");
fail_file();
}
- uwrite(fd_map, addr, sb.st_size);
}
- return addr;
+ close(fd_map);
+ if (rename(tmp_file, fname) < 0) {
+ perror(fname);
+ fail_file();
+ }
}
/* w8rev, w8nat, ...: Handle endianness. */
@@ -315,7 +387,6 @@ do_file(char const *const fname)
Elf32_Ehdr *const ehdr = mmap_file(fname);
unsigned int reltype = 0;
- ehdr_curr = ehdr;
w = w4nat;
w2 = w2nat;
w8 = w8nat;
@@ -435,6 +506,7 @@ do_file(char const *const fname)
}
} /* end switch */
+ write_file(fname);
cleanup();
}
@@ -487,11 +559,14 @@ main(int argc, char *argv[])
case SJ_SETJMP: /* normal sequence */
/* Avoid problems if early cleanup() */
fd_map = -1;
- ehdr_curr = NULL;
mmap_failed = 1;
+ file_map = NULL;
+ file_ptr = NULL;
+ file_updated = 0;
do_file(file);
break;
case SJ_FAIL: /* error in do_file or below */
+ sprintf("%s: failed\n", file);
++n_error;
break;
case SJ_SUCCEED: /* premature success */
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 102/128] ALSA: hda - Set SKL+ hda controller power at freeze() and thaw()
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (100 preceding siblings ...)
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 101/128] ftrace/scripts: Have recordmcount copy the object file Luis Henriques
@ 2016-01-24 22:00 ` Luis Henriques
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 103/128] s390/dis: Fix handling of format specifiers Luis Henriques
` (26 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:00 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Xiong Zhang, Takashi Iwai, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Xiong Zhang <xiong.y.zhang@intel.com>
commit 3e6db33aaf1d42a30339f831ec4850570d6cc7a3 upstream.
It takes three minutes to enter into hibernation on some OEM SKL
machines and we see many codec spurious response after thaw() opertion.
This is because HDA is still in D0 state after freeze() call and
pci_pm_freeze/pci_pm_freeze_noirq() don't set D3 hot in pci_bus driver.
It seems bios still access HDA when system enter into freeze state,
HDA will receive codec response interrupt immediately after thaw() call.
Because of this unexpected interrupt, HDA enter into a abnormal
state and slow down the system enter into hibernation.
In this patch, we put HDA into D3 hot state in azx_freeze_noirq() and
put HDA into D0 state in azx_thaw_noirq().
V2: Only apply this fix to SKL+
Fix compile error when CONFIG_PM_SLEEP isn't defined
[Yet another fix for CONFIG_PM_SLEEP ifdef and the additional comment
by tiwai]
Signed-off-by: Xiong Zhang <xiong.y.zhang@intel.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
sound/pci/hda/hda_intel.c | 34 ++++++++++++++++++++++++++++++++++
1 file changed, 34 insertions(+)
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index d4268a2bbca7..2f523b08f576 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -663,6 +663,36 @@ static int azx_resume(struct device *dev)
}
#endif /* CONFIG_PM_SLEEP || SUPPORT_VGA_SWITCHEROO */
+#ifdef CONFIG_PM_SLEEP
+/* put codec down to D3 at hibernation for Intel SKL+;
+ * otherwise BIOS may still access the codec and screw up the driver
+ */
+#define IS_SKL(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0xa170)
+#define IS_SKL_LP(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0x9d70)
+#define IS_BXT(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0x5a98)
+#define IS_SKL_PLUS(pci) (IS_SKL(pci) || IS_SKL_LP(pci) || IS_BXT(pci))
+
+static int azx_freeze_noirq(struct device *dev)
+{
+ struct pci_dev *pci = to_pci_dev(dev);
+
+ if (IS_SKL_PLUS(pci))
+ pci_set_power_state(pci, PCI_D3hot);
+
+ return 0;
+}
+
+static int azx_thaw_noirq(struct device *dev)
+{
+ struct pci_dev *pci = to_pci_dev(dev);
+
+ if (IS_SKL_PLUS(pci))
+ pci_set_power_state(pci, PCI_D0);
+
+ return 0;
+}
+#endif /* CONFIG_PM_SLEEP */
+
#ifdef CONFIG_PM_RUNTIME
static int azx_runtime_suspend(struct device *dev)
{
@@ -748,6 +778,10 @@ static int azx_runtime_idle(struct device *dev)
#ifdef CONFIG_PM
static const struct dev_pm_ops azx_pm = {
SET_SYSTEM_SLEEP_PM_OPS(azx_suspend, azx_resume)
+#ifdef CONFIG_PM_SLEEP
+ .freeze_noirq = azx_freeze_noirq,
+ .thaw_noirq = azx_thaw_noirq,
+#endif
SET_RUNTIME_PM_OPS(azx_runtime_suspend, azx_runtime_resume, azx_runtime_idle)
};
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 103/128] s390/dis: Fix handling of format specifiers
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (101 preceding siblings ...)
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 102/128] ALSA: hda - Set SKL+ hda controller power at freeze() and thaw() Luis Henriques
@ 2016-01-24 22:00 ` Luis Henriques
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 104/128] parisc: Fix syscall restarts Luis Henriques
` (25 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:00 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Michael Holzheu, Martin Schwidefsky, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Michael Holzheu <holzheu@linux.vnet.ibm.com>
commit 272fa59ccb4fc802af28b1d699c2463db6a71bf7 upstream.
The print_insn() function returns strings like "lghi %r1,0". To escape the
'%' character in sprintf() a second '%' is used. For example "lghi %%r1,0"
is converted into "lghi %r1,0".
After print_insn() the output string is passed to printk(). Because format
specifiers like "%r" or "%f" are ignored by printk() this works by chance
most of the time. But for instructions with control registers like
"lctl %c6,%c6,780" this fails because printk() interprets "%c" as
character format specifier.
Fix this problem and escape the '%' characters twice.
For example "lctl %%%%c6,%%%%c6,780" is then converted by sprintf()
into "lctl %%c6,%%c6,780" and by printk() into "lctl %c6,%c6,780".
Signed-off-by: Michael Holzheu <holzheu@linux.vnet.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
[ luis: backported to 3.16:
- drop condition with OPERAND_VR introduced only with commit
3585cb028065 ("s390/disassembler: add vector instructions") ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
arch/s390/kernel/dis.c | 15 +++++++++++----
1 file changed, 11 insertions(+), 4 deletions(-)
diff --git a/arch/s390/kernel/dis.c b/arch/s390/kernel/dis.c
index 993efe6a887c..3d942314818b 100644
--- a/arch/s390/kernel/dis.c
+++ b/arch/s390/kernel/dis.c
@@ -1726,14 +1726,21 @@ static int print_insn(char *buffer, unsigned char *code, unsigned long addr)
}
if (separator)
ptr += sprintf(ptr, "%c", separator);
+ /*
+ * Use four '%' characters below because of the
+ * following two conversions:
+ *
+ * 1) sprintf: %%%%r -> %%r
+ * 2) printk : %%r -> %r
+ */
if (operand->flags & OPERAND_GPR)
- ptr += sprintf(ptr, "%%r%i", value);
+ ptr += sprintf(ptr, "%%%%r%i", value);
else if (operand->flags & OPERAND_FPR)
- ptr += sprintf(ptr, "%%f%i", value);
+ ptr += sprintf(ptr, "%%%%f%i", value);
else if (operand->flags & OPERAND_AR)
- ptr += sprintf(ptr, "%%a%i", value);
+ ptr += sprintf(ptr, "%%%%a%i", value);
else if (operand->flags & OPERAND_CR)
- ptr += sprintf(ptr, "%%c%i", value);
+ ptr += sprintf(ptr, "%%%%c%i", value);
else if (operand->flags & OPERAND_PCREL)
ptr += sprintf(ptr, "%lx", (signed int) value
+ addr);
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 104/128] parisc: Fix syscall restarts
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (102 preceding siblings ...)
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 103/128] s390/dis: Fix handling of format specifiers Luis Henriques
@ 2016-01-24 22:00 ` Luis Henriques
2016-01-24 22:01 ` [PATCH 3.16.y-ckt 105/128] ALSA: hda/realtek - Fix silent headphone output on MacPro 4,1 (v2) Luis Henriques
` (24 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:00 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Helge Deller, Mathieu Desnoyers, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Helge Deller <deller@gmx.de>
commit 71a71fb5374a23be36a91981b5614590b9e722c3 upstream.
On parisc syscalls which are interrupted by signals sometimes failed to
restart and instead returned -ENOSYS which in the worst case lead to
userspace crashes.
A similiar problem existed on MIPS and was fixed by commit e967ef02
("MIPS: Fix restart of indirect syscalls").
On parisc the current syscall restart code assumes that all syscall
callers load the syscall number in the delay slot of the ble
instruction. That's how it is e.g. done in the unistd.h header file:
ble 0x100(%sr2, %r0)
ldi #syscall_nr, %r20
Because of that assumption the current code never restored %r20 before
returning to userspace.
This assumption is at least not true for code which uses the glibc
syscall() function, which instead uses this syntax:
ble 0x100(%sr2, %r0)
copy regX, %r20
where regX depend on how the compiler optimizes the code and register
usage.
This patch fixes this problem by adding code to analyze how the syscall
number is loaded in the delay branch and - if needed - copy the syscall
number to regX prior returning to userspace for the syscall restart.
Signed-off-by: Helge Deller <deller@gmx.de>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
arch/parisc/kernel/signal.c | 64 ++++++++++++++++++++++++++++++++++++---------
1 file changed, 52 insertions(+), 12 deletions(-)
diff --git a/arch/parisc/kernel/signal.c b/arch/parisc/kernel/signal.c
index 1cba8f29bb49..78bb6dd88e03 100644
--- a/arch/parisc/kernel/signal.c
+++ b/arch/parisc/kernel/signal.c
@@ -442,6 +442,55 @@ handle_signal(unsigned long sig, siginfo_t *info, struct k_sigaction *ka,
regs->gr[28]);
}
+/*
+ * Check how the syscall number gets loaded into %r20 within
+ * the delay branch in userspace and adjust as needed.
+ */
+
+static void check_syscallno_in_delay_branch(struct pt_regs *regs)
+{
+ u32 opcode, source_reg;
+ u32 __user *uaddr;
+ int err;
+
+ /* Usually we don't have to restore %r20 (the system call number)
+ * because it gets loaded in the delay slot of the branch external
+ * instruction via the ldi instruction.
+ * In some cases a register-to-register copy instruction might have
+ * been used instead, in which case we need to copy the syscall
+ * number into the source register before returning to userspace.
+ */
+
+ /* A syscall is just a branch, so all we have to do is fiddle the
+ * return pointer so that the ble instruction gets executed again.
+ */
+ regs->gr[31] -= 8; /* delayed branching */
+
+ /* Get assembler opcode of code in delay branch */
+ uaddr = (unsigned int *) ((regs->gr[31] & ~3) + 4);
+ err = get_user(opcode, uaddr);
+ if (err)
+ return;
+
+ /* Check if delay branch uses "ldi int,%r20" */
+ if ((opcode & 0xffff0000) == 0x34140000)
+ return; /* everything ok, just return */
+
+ /* Check if delay branch uses "nop" */
+ if (opcode == INSN_NOP)
+ return;
+
+ /* Check if delay branch uses "copy %rX,%r20" */
+ if ((opcode & 0xffe0ffff) == 0x08000254) {
+ source_reg = (opcode >> 16) & 31;
+ regs->gr[source_reg] = regs->gr[20];
+ return;
+ }
+
+ pr_warn("syscall restart: %s (pid %d): unexpected opcode 0x%08x\n",
+ current->comm, task_pid_nr(current), opcode);
+}
+
static inline void
syscall_restart(struct pt_regs *regs, struct k_sigaction *ka)
{
@@ -464,10 +513,7 @@ syscall_restart(struct pt_regs *regs, struct k_sigaction *ka)
}
/* fallthrough */
case -ERESTARTNOINTR:
- /* A syscall is just a branch, so all
- * we have to do is fiddle the return pointer.
- */
- regs->gr[31] -= 8; /* delayed branching */
+ check_syscallno_in_delay_branch(regs);
break;
}
}
@@ -516,15 +562,9 @@ insert_restart_trampoline(struct pt_regs *regs)
}
case -ERESTARTNOHAND:
case -ERESTARTSYS:
- case -ERESTARTNOINTR: {
- /* Hooray for delayed branching. We don't
- * have to restore %r20 (the system call
- * number) because it gets loaded in the delay
- * slot of the branch external instruction.
- */
- regs->gr[31] -= 8;
+ case -ERESTARTNOINTR:
+ check_syscallno_in_delay_branch(regs);
return;
- }
default:
break;
}
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 105/128] ALSA: hda/realtek - Fix silent headphone output on MacPro 4,1 (v2)
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (103 preceding siblings ...)
2016-01-24 22:00 ` [PATCH 3.16.y-ckt 104/128] parisc: Fix syscall restarts Luis Henriques
@ 2016-01-24 22:01 ` Luis Henriques
2016-01-24 22:01 ` [PATCH 3.16.y-ckt 106/128] MIPS: uaccess: Fix strlen_user with EVA Luis Henriques
` (23 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:01 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Mario Kleiner, Takashi Iwai, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Mario Kleiner <mario.kleiner.de@gmail.com>
commit 9f660a1c43890c2cdd1f423fd73654e7ca08fe56 upstream.
Without this patch, internal speaker and line-out work,
but front headphone output jack stays silent on the
Mac Pro 4,1.
This code path also gets executed on the MacPro 5,1 due
to identical codec SSID, but i don't know if it has any
positive or adverse effects there or not.
(v2) Implement feedback from Takashi Iwai: Reuse
alc889_fixup_mbp_vref and just add a new nid
0x19 for the MacPro 4,1.
Signed-off-by: Mario Kleiner <mario.kleiner.de@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
sound/pci/hda/patch_realtek.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 34806487e54f..9131899af1d8 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -1844,6 +1844,7 @@ enum {
ALC889_FIXUP_MBA11_VREF,
ALC889_FIXUP_MBA21_VREF,
ALC889_FIXUP_MP11_VREF,
+ ALC889_FIXUP_MP41_VREF,
ALC882_FIXUP_INV_DMIC,
ALC882_FIXUP_NO_PRIMARY_HP,
ALC887_FIXUP_ASUS_BASS,
@@ -1932,7 +1933,7 @@ static void alc889_fixup_mbp_vref(struct hda_codec *codec,
const struct hda_fixup *fix, int action)
{
struct alc_spec *spec = codec->spec;
- static hda_nid_t nids[2] = { 0x14, 0x15 };
+ static hda_nid_t nids[3] = { 0x14, 0x15, 0x19 };
int i;
if (action != HDA_FIXUP_ACT_INIT)
@@ -2222,6 +2223,12 @@ static const struct hda_fixup alc882_fixups[] = {
.chained = true,
.chain_id = ALC885_FIXUP_MACPRO_GPIO,
},
+ [ALC889_FIXUP_MP41_VREF] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc889_fixup_mbp_vref,
+ .chained = true,
+ .chain_id = ALC885_FIXUP_MACPRO_GPIO,
+ },
[ALC882_FIXUP_INV_DMIC] = {
.type = HDA_FIXUP_FUNC,
.v.func = alc_fixup_inv_dmic_0x12,
@@ -2304,7 +2311,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
SND_PCI_QUIRK(0x106b, 0x3f00, "Macbook 5,1", ALC889_FIXUP_IMAC91_VREF),
SND_PCI_QUIRK(0x106b, 0x4000, "MacbookPro 5,1", ALC889_FIXUP_IMAC91_VREF),
SND_PCI_QUIRK(0x106b, 0x4100, "Macmini 3,1", ALC889_FIXUP_IMAC91_VREF),
- SND_PCI_QUIRK(0x106b, 0x4200, "Mac Pro 5,1", ALC885_FIXUP_MACPRO_GPIO),
+ SND_PCI_QUIRK(0x106b, 0x4200, "Mac Pro 4,1/5,1", ALC889_FIXUP_MP41_VREF),
SND_PCI_QUIRK(0x106b, 0x4300, "iMac 9,1", ALC889_FIXUP_IMAC91_VREF),
SND_PCI_QUIRK(0x106b, 0x4600, "MacbookPro 5,2", ALC889_FIXUP_IMAC91_VREF),
SND_PCI_QUIRK(0x106b, 0x4900, "iMac 9,1 Aluminum", ALC889_FIXUP_IMAC91_VREF),
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 106/128] MIPS: uaccess: Fix strlen_user with EVA
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (104 preceding siblings ...)
2016-01-24 22:01 ` [PATCH 3.16.y-ckt 105/128] ALSA: hda/realtek - Fix silent headphone output on MacPro 4,1 (v2) Luis Henriques
@ 2016-01-24 22:01 ` Luis Henriques
2016-01-24 22:01 ` [PATCH 3.16.y-ckt 107/128] [PATCH] arm: fix handling of F_OFD_... in oabi_fcntl64() Luis Henriques
` (22 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:01 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: James Hogan, Markos Chandras, Paul Burton, Leonid Yegoshin,
linux-mips, Ralf Baechle, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: James Hogan <james.hogan@imgtec.com>
commit 5dc62fdd8383afbd2faca6b6e6ea1052b45b0124 upstream.
The strlen_user() function calls __strlen_kernel_asm in both branches of
the eva_kernel_access() conditional. For EVA it should be calling
__strlen_user_eva for user accesses, otherwise it will load from the
kernel address space instead of the user address space, and the access
checking will likely be ineffective at preventing it due to EVA's
overlapping user and kernel address spaces.
This was found after extending the test_user_copy module to cover user
string access functions, which gave the following error with EVA:
test_user_copy: illegal strlen_user passed
Fortunately the use of strlen_user() has been all but eradicated from
the mainline kernel, so only out of tree modules could be affected.
Fixes: e3a9b07a9caf ("MIPS: asm: uaccess: Add EVA support for str*_user operations")
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Cc: Markos Chandras <markos.chandras@imgtec.com>
Cc: Paul Burton <paul.burton@imgtec.com>
Cc: Leonid Yegoshin <leonid.yegoshin@imgtec.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/10842/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
arch/mips/include/asm/uaccess.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/mips/include/asm/uaccess.h b/arch/mips/include/asm/uaccess.h
index 681331257bac..16e0ea6b99d8 100644
--- a/arch/mips/include/asm/uaccess.h
+++ b/arch/mips/include/asm/uaccess.h
@@ -1397,7 +1397,7 @@ static inline long strlen_user(const char __user *s)
might_fault();
__asm__ __volatile__(
"move\t$4, %1\n\t"
- __MODULE_JAL(__strlen_kernel_asm)
+ __MODULE_JAL(__strlen_user_asm)
"move\t%0, $2"
: "=r" (res)
: "r" (s)
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 107/128] [PATCH] arm: fix handling of F_OFD_... in oabi_fcntl64()
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (105 preceding siblings ...)
2016-01-24 22:01 ` [PATCH 3.16.y-ckt 106/128] MIPS: uaccess: Fix strlen_user with EVA Luis Henriques
@ 2016-01-24 22:01 ` Luis Henriques
2016-01-24 22:01 ` [PATCH 3.16.y-ckt 108/128] ocfs2: fix BUG when calculate new backup super Luis Henriques
` (21 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:01 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Al Viro, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Al Viro <viro@zeniv.linux.org.uk>
commit 76cc404bfdc0d419c720de4daaf2584542734f42 upstream.
Reviewed-by: Jeff Layton <jeff.layton@primarydata.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
arch/arm/kernel/sys_oabi-compat.c | 73 ++++++++++++++++++++-------------------
1 file changed, 37 insertions(+), 36 deletions(-)
diff --git a/arch/arm/kernel/sys_oabi-compat.c b/arch/arm/kernel/sys_oabi-compat.c
index e90a3148f385..eb821e7b80f9 100644
--- a/arch/arm/kernel/sys_oabi-compat.c
+++ b/arch/arm/kernel/sys_oabi-compat.c
@@ -193,15 +193,44 @@ struct oabi_flock64 {
pid_t l_pid;
} __attribute__ ((packed,aligned(4)));
-asmlinkage long sys_oabi_fcntl64(unsigned int fd, unsigned int cmd,
+static long do_locks(unsigned int fd, unsigned int cmd,
unsigned long arg)
{
- struct oabi_flock64 user;
struct flock64 kernel;
- mm_segment_t fs = USER_DS; /* initialized to kill a warning */
- unsigned long local_arg = arg;
- int ret;
+ struct oabi_flock64 user;
+ mm_segment_t fs;
+ long ret;
+
+ if (copy_from_user(&user, (struct oabi_flock64 __user *)arg,
+ sizeof(user)))
+ return -EFAULT;
+ kernel.l_type = user.l_type;
+ kernel.l_whence = user.l_whence;
+ kernel.l_start = user.l_start;
+ kernel.l_len = user.l_len;
+ kernel.l_pid = user.l_pid;
+
+ fs = get_fs();
+ set_fs(KERNEL_DS);
+ ret = sys_fcntl64(fd, cmd, (unsigned long)&kernel);
+ set_fs(fs);
+
+ if (!ret && (cmd == F_GETLK64 || cmd == F_OFD_GETLK)) {
+ user.l_type = kernel.l_type;
+ user.l_whence = kernel.l_whence;
+ user.l_start = kernel.l_start;
+ user.l_len = kernel.l_len;
+ user.l_pid = kernel.l_pid;
+ if (copy_to_user((struct oabi_flock64 __user *)arg,
+ &user, sizeof(user)))
+ ret = -EFAULT;
+ }
+ return ret;
+}
+asmlinkage long sys_oabi_fcntl64(unsigned int fd, unsigned int cmd,
+ unsigned long arg)
+{
switch (cmd) {
case F_OFD_GETLK:
case F_OFD_SETLK:
@@ -209,39 +238,11 @@ asmlinkage long sys_oabi_fcntl64(unsigned int fd, unsigned int cmd,
case F_GETLK64:
case F_SETLK64:
case F_SETLKW64:
- if (copy_from_user(&user, (struct oabi_flock64 __user *)arg,
- sizeof(user)))
- return -EFAULT;
- kernel.l_type = user.l_type;
- kernel.l_whence = user.l_whence;
- kernel.l_start = user.l_start;
- kernel.l_len = user.l_len;
- kernel.l_pid = user.l_pid;
- local_arg = (unsigned long)&kernel;
- fs = get_fs();
- set_fs(KERNEL_DS);
- }
-
- ret = sys_fcntl64(fd, cmd, local_arg);
+ return do_locks(fd, cmd, arg);
- switch (cmd) {
- case F_GETLK64:
- if (!ret) {
- user.l_type = kernel.l_type;
- user.l_whence = kernel.l_whence;
- user.l_start = kernel.l_start;
- user.l_len = kernel.l_len;
- user.l_pid = kernel.l_pid;
- if (copy_to_user((struct oabi_flock64 __user *)arg,
- &user, sizeof(user)))
- ret = -EFAULT;
- }
- case F_SETLK64:
- case F_SETLKW64:
- set_fs(fs);
+ default:
+ return sys_fcntl64(fd, cmd, arg);
}
-
- return ret;
}
struct oabi_epoll_event {
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 108/128] ocfs2: fix BUG when calculate new backup super
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (106 preceding siblings ...)
2016-01-24 22:01 ` [PATCH 3.16.y-ckt 107/128] [PATCH] arm: fix handling of F_OFD_... in oabi_fcntl64() Luis Henriques
@ 2016-01-24 22:01 ` Luis Henriques
2016-01-24 22:01 ` [PATCH 3.16.y-ckt 109/128] mm/memory_hotplug.c: check for missing sections in test_pages_in_a_zone() Luis Henriques
` (20 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:01 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Joseph Qi, Mark Fasheh, Joel Becker, Andrew Morton,
Linus Torvalds, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Joseph Qi <joseph.qi@huawei.com>
commit 5c9ee4cbf2a945271f25b89b137f2c03bbc3be33 upstream.
When resizing, it firstly extends the last gd. Once it should backup
super in the gd, it calculates new backup super and update the
corresponding value.
But it currently doesn't consider the situation that the backup super is
already done. And in this case, it still sets the bit in gd bitmap and
then decrease from bg_free_bits_count, which leads to a corrupted gd and
trigger the BUG in ocfs2_block_group_set_bits:
BUG_ON(le16_to_cpu(bg->bg_free_bits_count) < num_bits);
So check whether the backup super is done and then do the updates.
Signed-off-by: Joseph Qi <joseph.qi@huawei.com>
Reviewed-by: Jiufei Xue <xuejiufei@huawei.com>
Reviewed-by: Yiwen Jiang <jiangyiwen@huawei.com>
Cc: Mark Fasheh <mfasheh@suse.de>
Cc: Joel Becker <jlbec@evilplan.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
fs/ocfs2/resize.c | 15 ++++++++++++---
1 file changed, 12 insertions(+), 3 deletions(-)
diff --git a/fs/ocfs2/resize.c b/fs/ocfs2/resize.c
index d5da6f624142..79b8021302b3 100644
--- a/fs/ocfs2/resize.c
+++ b/fs/ocfs2/resize.c
@@ -54,11 +54,12 @@
static u16 ocfs2_calc_new_backup_super(struct inode *inode,
struct ocfs2_group_desc *gd,
u16 cl_cpg,
+ u16 old_bg_clusters,
int set)
{
int i;
u16 backups = 0;
- u32 cluster;
+ u32 cluster, lgd_cluster;
u64 blkno, gd_blkno, lgd_blkno = le64_to_cpu(gd->bg_blkno);
for (i = 0; i < OCFS2_MAX_BACKUP_SUPERBLOCKS; i++) {
@@ -71,6 +72,12 @@ static u16 ocfs2_calc_new_backup_super(struct inode *inode,
else if (gd_blkno > lgd_blkno)
break;
+ /* check if already done backup super */
+ lgd_cluster = ocfs2_blocks_to_clusters(inode->i_sb, lgd_blkno);
+ lgd_cluster += old_bg_clusters;
+ if (lgd_cluster >= cluster)
+ continue;
+
if (set)
ocfs2_set_bit(cluster % cl_cpg,
(unsigned long *)gd->bg_bitmap);
@@ -99,6 +106,7 @@ static int ocfs2_update_last_group_and_inode(handle_t *handle,
u16 chain, num_bits, backups = 0;
u16 cl_bpc = le16_to_cpu(cl->cl_bpc);
u16 cl_cpg = le16_to_cpu(cl->cl_cpg);
+ u16 old_bg_clusters;
trace_ocfs2_update_last_group_and_inode(new_clusters,
first_new_cluster);
@@ -112,6 +120,7 @@ static int ocfs2_update_last_group_and_inode(handle_t *handle,
group = (struct ocfs2_group_desc *)group_bh->b_data;
+ old_bg_clusters = le16_to_cpu(group->bg_bits) / cl_bpc;
/* update the group first. */
num_bits = new_clusters * cl_bpc;
le16_add_cpu(&group->bg_bits, num_bits);
@@ -125,7 +134,7 @@ static int ocfs2_update_last_group_and_inode(handle_t *handle,
OCFS2_FEATURE_COMPAT_BACKUP_SB)) {
backups = ocfs2_calc_new_backup_super(bm_inode,
group,
- cl_cpg, 1);
+ cl_cpg, old_bg_clusters, 1);
le16_add_cpu(&group->bg_free_bits_count, -1 * backups);
}
@@ -163,7 +172,7 @@ out_rollback:
if (ret < 0) {
ocfs2_calc_new_backup_super(bm_inode,
group,
- cl_cpg, 0);
+ cl_cpg, old_bg_clusters, 0);
le16_add_cpu(&group->bg_free_bits_count, backups);
le16_add_cpu(&group->bg_bits, -1 * num_bits);
le16_add_cpu(&group->bg_free_bits_count, -1 * num_bits);
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 109/128] mm/memory_hotplug.c: check for missing sections in test_pages_in_a_zone()
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (107 preceding siblings ...)
2016-01-24 22:01 ` [PATCH 3.16.y-ckt 108/128] ocfs2: fix BUG when calculate new backup super Luis Henriques
@ 2016-01-24 22:01 ` Luis Henriques
2016-01-24 22:01 ` [PATCH 3.16.y-ckt 110/128] net/mlx4_en: Remove dependency between timestamping capability and service_task Luis Henriques
` (19 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:01 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Andrew Banman, Russ Anderson, Alex Thorlton, Yinghai Lu, Greg KH,
Seth Jennings, Andrew Morton, Linus Torvalds, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Andrew Banman <abanman@sgi.com>
commit 5f0f2887f4de9508dcf438deab28f1de8070c271 upstream.
test_pages_in_a_zone() does not account for the possibility of missing
sections in the given pfn range. pfn_valid_within always returns 1 when
CONFIG_HOLES_IN_ZONE is not set, allowing invalid pfns from missing
sections to pass the test, leading to a kernel oops.
Wrap an additional pfn loop with PAGES_PER_SECTION granularity to check
for missing sections before proceeding into the zone-check code.
This also prevents a crash from offlining memory devices with missing
sections. Despite this, it may be a good idea to keep the related patch
'[PATCH 3/3] drivers: memory: prohibit offlining of memory blocks with
missing sections' because missing sections in a memory block may lead to
other problems not covered by the scope of this fix.
Signed-off-by: Andrew Banman <abanman@sgi.com>
Acked-by: Alex Thorlton <athorlton@sgi.com>
Cc: Russ Anderson <rja@sgi.com>
Cc: Alex Thorlton <athorlton@sgi.com>
Cc: Yinghai Lu <yinghai@kernel.org>
Cc: Greg KH <greg@kroah.com>
Cc: Seth Jennings <sjennings@variantweb.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
mm/memory_hotplug.c | 31 +++++++++++++++++++------------
1 file changed, 19 insertions(+), 12 deletions(-)
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index 2c38c4fe9631..4ec1d4d7521a 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -1308,23 +1308,30 @@ int is_mem_section_removable(unsigned long start_pfn, unsigned long nr_pages)
*/
static int test_pages_in_a_zone(unsigned long start_pfn, unsigned long end_pfn)
{
- unsigned long pfn;
+ unsigned long pfn, sec_end_pfn;
struct zone *zone = NULL;
struct page *page;
int i;
- for (pfn = start_pfn;
+ for (pfn = start_pfn, sec_end_pfn = SECTION_ALIGN_UP(start_pfn);
pfn < end_pfn;
- pfn += MAX_ORDER_NR_PAGES) {
- i = 0;
- /* This is just a CONFIG_HOLES_IN_ZONE check.*/
- while ((i < MAX_ORDER_NR_PAGES) && !pfn_valid_within(pfn + i))
- i++;
- if (i == MAX_ORDER_NR_PAGES)
+ pfn = sec_end_pfn + 1, sec_end_pfn += PAGES_PER_SECTION) {
+ /* Make sure the memory section is present first */
+ if (!present_section_nr(pfn_to_section_nr(pfn)))
continue;
- page = pfn_to_page(pfn + i);
- if (zone && page_zone(page) != zone)
- return 0;
- zone = page_zone(page);
+ for (; pfn < sec_end_pfn && pfn < end_pfn;
+ pfn += MAX_ORDER_NR_PAGES) {
+ i = 0;
+ /* This is just a CONFIG_HOLES_IN_ZONE check.*/
+ while ((i < MAX_ORDER_NR_PAGES) &&
+ !pfn_valid_within(pfn + i))
+ i++;
+ if (i == MAX_ORDER_NR_PAGES)
+ continue;
+ page = pfn_to_page(pfn + i);
+ if (zone && page_zone(page) != zone)
+ return 0;
+ zone = page_zone(page);
+ }
}
return 1;
}
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 110/128] net/mlx4_en: Remove dependency between timestamping capability and service_task
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (108 preceding siblings ...)
2016-01-24 22:01 ` [PATCH 3.16.y-ckt 109/128] mm/memory_hotplug.c: check for missing sections in test_pages_in_a_zone() Luis Henriques
@ 2016-01-24 22:01 ` Luis Henriques
2016-01-24 22:01 ` [PATCH 3.16.y-ckt 111/128] net/mlx4_en: Fix HW timestamp init issue upon system startup Luis Henriques
` (18 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:01 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Eugenia Emantayev, Eran Ben Elisha, Or Gerlitz, David S . Miller,
Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Eugenia Emantayev <eugenia@mellanox.com>
commit fc9f5ea9b4ecbe9b7839c92f0a54261809c723d3 upstream.
Service task is responsible for other tasks in addition to timestamping
overflow check. Launch it even if timestamping is not supported by device.
Fixes: 07841f9d94c1 ('net/mlx4_en: Schedule napi when RX buffers allocation fails')
Signed-off-by: Eugenia Emantayev <eugenia@mellanox.com>
Signed-off-by: Eran Ben Elisha <eranbe@mellanox.com>
Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index 8be0c179e25d..3e663928b51e 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -2655,9 +2655,8 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port,
}
queue_delayed_work(mdev->workqueue, &priv->stats_task, STATS_DELAY);
- if (mdev->dev->caps.flags2 & MLX4_DEV_CAP_FLAG2_TS)
- queue_delayed_work(mdev->workqueue, &priv->service_task,
- SERVICE_TASK_DELAY);
+ queue_delayed_work(mdev->workqueue, &priv->service_task,
+ SERVICE_TASK_DELAY);
err = register_netdev(dev);
if (err) {
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 111/128] net/mlx4_en: Fix HW timestamp init issue upon system startup
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (109 preceding siblings ...)
2016-01-24 22:01 ` [PATCH 3.16.y-ckt 110/128] net/mlx4_en: Remove dependency between timestamping capability and service_task Luis Henriques
@ 2016-01-24 22:01 ` Luis Henriques
2016-01-24 22:01 ` [PATCH 3.16.y-ckt 112/128] ipv6/addrlabel: fix ip6addrlbl_get() Luis Henriques
` (17 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:01 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Eugenia Emantayev, Marina Varshaver, Eran Ben Elisha, Or Gerlitz,
David S . Miller, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Eugenia Emantayev <eugenia@mellanox.com>
commit 90683061dd50b0d70f01466c2d694f4e928a86f3 upstream.
mlx4_en_init_timestamp was called before creation of netdev and port
init, thus used uninitialized values. Specifically - NIC frequency was
incorrect causing wrong calculations and later wrong HW timestamps.
Fixes: 1ec4864b1017 ('net/mlx4_en: Fixed crash when port type is changed')
Signed-off-by: Eugenia Emantayev <eugenia@mellanox.com>
Signed-off-by: Marina Varshaver <marinav@mellanox.com>
Signed-off-by: Eran Ben Elisha <eranbe@mellanox.com>
Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/net/ethernet/mellanox/mlx4/en_clock.c | 7 +++++++
drivers/net/ethernet/mellanox/mlx4/en_main.c | 7 -------
drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 7 +++++++
3 files changed, 14 insertions(+), 7 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_clock.c b/drivers/net/ethernet/mellanox/mlx4/en_clock.c
index 57dda95b67d8..74ed9f8fd267 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_clock.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_clock.c
@@ -291,6 +291,13 @@ void mlx4_en_init_timestamp(struct mlx4_en_dev *mdev)
unsigned long flags;
u64 ns;
+ /* mlx4_en_init_timestamp is called for each netdev.
+ * mdev->ptp_clock is common for all ports, skip initialization if
+ * was done for other port.
+ */
+ if (mdev->ptp_clock)
+ return;
+
rwlock_init(&mdev->clock_lock);
memset(&mdev->cycles, 0, sizeof(mdev->cycles));
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_main.c b/drivers/net/ethernet/mellanox/mlx4/en_main.c
index f953c1d7eae6..80af090463eb 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_main.c
@@ -206,9 +206,6 @@ static void mlx4_en_remove(struct mlx4_dev *dev, void *endev_ptr)
if (mdev->pndev[i])
mlx4_en_destroy_netdev(mdev->pndev[i]);
- if (mdev->dev->caps.flags2 & MLX4_DEV_CAP_FLAG2_TS)
- mlx4_en_remove_timestamp(mdev);
-
flush_workqueue(mdev->workqueue);
destroy_workqueue(mdev->workqueue);
(void) mlx4_mr_free(dev, &mdev->mr);
@@ -276,10 +273,6 @@ static void *mlx4_en_add(struct mlx4_dev *dev)
mlx4_foreach_port(i, dev, MLX4_PORT_TYPE_ETH)
mdev->port_cnt++;
- /* Initialize time stamp mechanism */
- if (mdev->dev->caps.flags2 & MLX4_DEV_CAP_FLAG2_TS)
- mlx4_en_init_timestamp(mdev);
-
/* Set default number of RX rings*/
mlx4_en_set_num_rx_rings(mdev);
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index 3e663928b51e..bf3878823c96 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -2091,6 +2091,9 @@ void mlx4_en_destroy_netdev(struct net_device *dev)
/* flush any pending task for this netdev */
flush_workqueue(mdev->workqueue);
+ if (mdev->dev->caps.flags2 & MLX4_DEV_CAP_FLAG2_TS)
+ mlx4_en_remove_timestamp(mdev);
+
/* Detach the netdev so tasks would not attempt to access it */
mutex_lock(&mdev->state_lock);
mdev->pndev[priv->port] = NULL;
@@ -2655,6 +2658,10 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port,
}
queue_delayed_work(mdev->workqueue, &priv->stats_task, STATS_DELAY);
+ /* Initialize time stamp mechanism */
+ if (mdev->dev->caps.flags2 & MLX4_DEV_CAP_FLAG2_TS)
+ mlx4_en_init_timestamp(mdev);
+
queue_delayed_work(mdev->workqueue, &priv->service_task,
SERVICE_TASK_DELAY);
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 112/128] ipv6/addrlabel: fix ip6addrlbl_get()
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (110 preceding siblings ...)
2016-01-24 22:01 ` [PATCH 3.16.y-ckt 111/128] net/mlx4_en: Fix HW timestamp init issue upon system startup Luis Henriques
@ 2016-01-24 22:01 ` Luis Henriques
2016-01-24 22:01 ` [PATCH 3.16.y-ckt 113/128] qlcnic: fix a loop exit condition better Luis Henriques
` (16 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:01 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Andrey Ryabinin, David S . Miller, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Andrey Ryabinin <aryabinin@virtuozzo.com>
commit e459dfeeb64008b2d23bdf600f03b3605dbb8152 upstream.
ip6addrlbl_get() has never worked. If ip6addrlbl_hold() succeeded,
ip6addrlbl_get() will exit with '-ESRCH'. If ip6addrlbl_hold() failed,
ip6addrlbl_get() will use about to be free ip6addrlbl_entry pointer.
Fix this by inverting ip6addrlbl_hold() check.
Fixes: 2a8cc6c89039 ("[IPV6] ADDRCONF: Support RFC3484 configurable address selection policy table.")
Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
Reviewed-by: Cong Wang <cwang@twopensource.com>
Acked-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
net/ipv6/addrlabel.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/ipv6/addrlabel.c b/net/ipv6/addrlabel.c
index 731e1e1722d9..eb525d5908c3 100644
--- a/net/ipv6/addrlabel.c
+++ b/net/ipv6/addrlabel.c
@@ -558,7 +558,7 @@ static int ip6addrlbl_get(struct sk_buff *in_skb, struct nlmsghdr *nlh)
rcu_read_lock();
p = __ipv6_addr_label(net, addr, ipv6_addr_type(addr), ifal->ifal_index);
- if (p && ip6addrlbl_hold(p))
+ if (p && !ip6addrlbl_hold(p))
p = NULL;
lseq = ip6addrlbl_table.seq;
rcu_read_unlock();
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 113/128] qlcnic: fix a loop exit condition better
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (111 preceding siblings ...)
2016-01-24 22:01 ` [PATCH 3.16.y-ckt 112/128] ipv6/addrlabel: fix ip6addrlbl_get() Luis Henriques
@ 2016-01-24 22:01 ` Luis Henriques
2016-01-24 22:01 ` [PATCH 3.16.y-ckt 114/128] genirq: Prevent chip buslock deadlock Luis Henriques
` (15 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:01 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Dan Carpenter, David S . Miller, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
commit 3358a5c0c1578fa215f90a0e750579cd6258ddd9 upstream.
In the original code, if we succeeded on the last iteration through the
loop then we still returned failure.
Fixes: 389e4e04ad2d ('qlcnic: fix a timeout loop')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_vnic.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_vnic.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_vnic.c
index b1a452f291ee..34906750b7e7 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_vnic.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_vnic.c
@@ -252,7 +252,7 @@ int qlcnic_83xx_check_vnic_state(struct qlcnic_adapter *adapter)
state = QLCRDX(ahw, QLC_83XX_VNIC_STATE);
}
- if (!idc->vnic_wait_limit) {
+ if (state != QLCNIC_DEV_NPAR_OPER) {
dev_err(&adapter->pdev->dev,
"vNIC mode not operational, state check timed out.\n");
return -EIO;
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 114/128] genirq: Prevent chip buslock deadlock
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (112 preceding siblings ...)
2016-01-24 22:01 ` [PATCH 3.16.y-ckt 113/128] qlcnic: fix a loop exit condition better Luis Henriques
@ 2016-01-24 22:01 ` Luis Henriques
2016-01-24 22:01 ` [PATCH 3.16.y-ckt 115/128] ftrace/scripts: Fix incorrect use of sprintf in recordmcount Luis Henriques
` (14 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:01 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Thomas Gleixner, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Thomas Gleixner <tglx@linutronix.de>
commit abc7e40c81d113ef4bacb556f0a77ca63ac81d85 upstream.
If a interrupt chip utilizes chip->buslock then free_irq() can
deadlock in the following way:
CPU0 CPU1
interrupt(X) (Shared or spurious)
free_irq(X) interrupt_thread(X)
chip_bus_lock(X)
irq_finalize_oneshot(X)
chip_bus_lock(X)
synchronize_irq(X)
synchronize_irq() waits for the interrupt thread to complete,
i.e. forever.
Solution is simple: Drop chip_bus_lock() before calling
synchronize_irq() as we do with the irq_desc lock. There is nothing to
be protected after the point where irq_desc lock has been released.
This adds chip_bus_lock/unlock() to the remove_irq() code path, but
that's actually correct in the case where remove_irq() is called on
such an interrupt. The current users of remove_irq() are not affected
as none of those interrupts is on a chip which requires buslock.
Reported-by: Fredrik Markström <fredrik.markstrom@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
kernel/irq/manage.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index 3dc6a61bf06a..efd80f0af47f 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -1311,6 +1311,7 @@ static struct irqaction *__free_irq(unsigned int irq, void *dev_id)
if (!desc)
return NULL;
+ chip_bus_lock(desc);
raw_spin_lock_irqsave(&desc->lock, flags);
/*
@@ -1324,7 +1325,7 @@ static struct irqaction *__free_irq(unsigned int irq, void *dev_id)
if (!action) {
WARN(1, "Trying to free already-free IRQ %d\n", irq);
raw_spin_unlock_irqrestore(&desc->lock, flags);
-
+ chip_bus_sync_unlock(desc);
return NULL;
}
@@ -1349,6 +1350,7 @@ static struct irqaction *__free_irq(unsigned int irq, void *dev_id)
#endif
raw_spin_unlock_irqrestore(&desc->lock, flags);
+ chip_bus_sync_unlock(desc);
unregister_handler_proc(irq, action);
@@ -1422,9 +1424,7 @@ void free_irq(unsigned int irq, void *dev_id)
desc->affinity_notify = NULL;
#endif
- chip_bus_lock(desc);
kfree(__free_irq(irq, dev_id));
- chip_bus_sync_unlock(desc);
}
EXPORT_SYMBOL(free_irq);
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 115/128] ftrace/scripts: Fix incorrect use of sprintf in recordmcount
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (113 preceding siblings ...)
2016-01-24 22:01 ` [PATCH 3.16.y-ckt 114/128] genirq: Prevent chip buslock deadlock Luis Henriques
@ 2016-01-24 22:01 ` Luis Henriques
2016-01-24 22:01 ` [PATCH 3.16.y-ckt 116/128] tracing: Fix setting of start_index in find_next() Luis Henriques
` (13 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:01 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Li Bin, Russell King, Will Deacon, Colin Ian King,
Steven Rostedt, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Colin Ian King <colin.king@canonical.com>
commit 713a3e4de707fab49d5aa4bceb77db1058572a7b upstream.
Fix build warning:
scripts/recordmcount.c:589:4: warning: format not a string
literal and no format arguments [-Wformat-security]
sprintf("%s: failed\n", file);
Fixes: a50bd43935586 ("ftrace/scripts: Have recordmcount copy the object file")
Link: http://lkml.kernel.org/r/1451516801-16951-1-git-send-email-colin.king@canonical.com
Cc: Li Bin <huawei.libin@huawei.com>
Cc: Russell King <rmk+kernel@arm.linux.org.uk>
Cc: Will Deacon <will.deacon@arm.com>
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
scripts/recordmcount.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/scripts/recordmcount.c b/scripts/recordmcount.c
index d6e6cc43d8af..56f497b27c49 100644
--- a/scripts/recordmcount.c
+++ b/scripts/recordmcount.c
@@ -566,7 +566,7 @@ main(int argc, char *argv[])
do_file(file);
break;
case SJ_FAIL: /* error in do_file or below */
- sprintf("%s: failed\n", file);
+ fprintf(stderr, "%s: failed\n", file);
++n_error;
break;
case SJ_SUCCEED: /* premature success */
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 116/128] tracing: Fix setting of start_index in find_next()
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (114 preceding siblings ...)
2016-01-24 22:01 ` [PATCH 3.16.y-ckt 115/128] ftrace/scripts: Fix incorrect use of sprintf in recordmcount Luis Henriques
@ 2016-01-24 22:01 ` Luis Henriques
2016-01-24 22:01 ` [PATCH 3.16.y-ckt 117/128] dts: vt8500: Add SDHC node to DTS file for WM8650 Luis Henriques
` (12 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:01 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Qiu Peiyang, Steven Rostedt, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Qiu Peiyang <peiyangx.qiu@intel.com>
commit f36d1be2930ede0a1947686e1126ffda5d5ee1bb upstream.
When we do cat /sys/kernel/debug/tracing/printk_formats, we hit kernel
panic at t_show.
general protection fault: 0000 [#1] PREEMPT SMP
CPU: 0 PID: 2957 Comm: sh Tainted: G W O 3.14.55-x86_64-01062-gd4acdc7 #2
RIP: 0010:[<ffffffff811375b2>]
[<ffffffff811375b2>] t_show+0x22/0xe0
RSP: 0000:ffff88002b4ebe80 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000004
RDX: 0000000000000004 RSI: ffffffff81fd26a6 RDI: ffff880032f9f7b1
RBP: ffff88002b4ebe98 R08: 0000000000001000 R09: 000000000000ffec
R10: 0000000000000000 R11: 000000000000000f R12: ffff880004d9b6c0
R13: 7365725f6d706400 R14: ffff880004d9b6c0 R15: ffffffff82020570
FS: 0000000000000000(0000) GS:ffff88003aa00000(0063) knlGS:00000000f776bc40
CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00000000f6c02ff0 CR3: 000000002c2b3000 CR4: 00000000001007f0
Call Trace:
[<ffffffff811dc076>] seq_read+0x2f6/0x3e0
[<ffffffff811b749b>] vfs_read+0x9b/0x160
[<ffffffff811b7f69>] SyS_read+0x49/0xb0
[<ffffffff81a3a4b9>] ia32_do_call+0x13/0x13
---[ end trace 5bd9eb630614861e ]---
Kernel panic - not syncing: Fatal exception
When the first time find_next calls find_next_mod_format, it should
iterate the trace_bprintk_fmt_list to find the first print format of
the module. However in current code, start_index is smaller than *pos
at first, and code will not iterate the list. Latter container_of will
get the wrong address with former v, which will cause mod_fmt be a
meaningless object and so is the returned mod_fmt->fmt.
This patch will fix it by correcting the start_index. After fixed,
when the first time calls find_next_mod_format, start_index will be
equal to *pos, and code will iterate the trace_bprintk_fmt_list to
get the right module printk format, so is the returned mod_fmt->fmt.
Link: http://lkml.kernel.org/r/5684B900.9000309@intel.com
Fixes: 102c9323c35a8 "tracing: Add __tracepoint_string() to export string pointers"
Signed-off-by: Qiu Peiyang <peiyangx.qiu@intel.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
kernel/trace/trace_printk.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/kernel/trace/trace_printk.c b/kernel/trace/trace_printk.c
index 2900817ba65c..7c8cef653166 100644
--- a/kernel/trace/trace_printk.c
+++ b/kernel/trace/trace_printk.c
@@ -269,6 +269,7 @@ static const char **find_next(void *v, loff_t *pos)
if (*pos < last_index + start_index)
return __start___tracepoint_str + (*pos - last_index);
+ start_index += last_index;
return find_next_mod_format(start_index, v, fmt, pos);
}
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 117/128] dts: vt8500: Add SDHC node to DTS file for WM8650
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (115 preceding siblings ...)
2016-01-24 22:01 ` [PATCH 3.16.y-ckt 116/128] tracing: Fix setting of start_index in find_next() Luis Henriques
@ 2016-01-24 22:01 ` Luis Henriques
2016-01-24 22:01 ` [PATCH 3.16.y-ckt 118/128] x86/mce: Ensure offline CPUs don't participate in rendezvous process Luis Henriques
` (11 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:01 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Roman Volkov, Arnd Bergmann, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Roman Volkov <rvolkov@v1ros.org>
commit 0f090bf14e51e7eefb71d9d1c545807f8b627986 upstream.
Since WM8650 has the same 'WMT' SDHC controller as WM8505, and the driver
is already in the kernel, this node enables the controller support for
WM8650
Signed-off-by: Roman Volkov <rvolkov@v1ros.org>
Reviewed-by: Alexey Charkov <alchark@gmail.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
arch/arm/boot/dts/wm8650.dtsi | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/arch/arm/boot/dts/wm8650.dtsi b/arch/arm/boot/dts/wm8650.dtsi
index b1c59a766a13..e12213d16693 100644
--- a/arch/arm/boot/dts/wm8650.dtsi
+++ b/arch/arm/boot/dts/wm8650.dtsi
@@ -187,6 +187,15 @@
interrupts = <43>;
};
+ sdhc@d800a000 {
+ compatible = "wm,wm8505-sdhc";
+ reg = <0xd800a000 0x400>;
+ interrupts = <20>, <21>;
+ clocks = <&clksdhc>;
+ bus-width = <4>;
+ sdon-inverted;
+ };
+
fb: fb@d8050800 {
compatible = "wm,wm8505-fb";
reg = <0xd8050800 0x200>;
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 118/128] x86/mce: Ensure offline CPUs don't participate in rendezvous process
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (116 preceding siblings ...)
2016-01-24 22:01 ` [PATCH 3.16.y-ckt 117/128] dts: vt8500: Add SDHC node to DTS file for WM8650 Luis Henriques
@ 2016-01-24 22:01 ` Luis Henriques
2016-01-24 22:01 ` [PATCH 3.16.y-ckt 119/128] ASoC: arizona: Fix bclk for sample rates that are multiple of 4kHz Luis Henriques
` (10 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:01 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Ashok Raj, Borislav Petkov, H . Peter Anvin, Linus Torvalds,
Peter Zijlstra, Thomas Gleixner, linux-edac, Ingo Molnar,
Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Ashok Raj <ashok.raj@intel.com>
commit d90167a941f62860f35eb960e1012aa2d30e7e94 upstream.
Intel's MCA implementation broadcasts MCEs to all CPUs on the
node. This poses a problem for offlined CPUs which cannot
participate in the rendezvous process:
Kernel panic - not syncing: Timeout: Not all CPUs entered broadcast exception handler
Kernel Offset: disabled
Rebooting in 100 seconds..
More specifically, Linux does a soft offline of a CPU when
writing a 0 to /sys/devices/system/cpu/cpuX/online, which
doesn't prevent the #MC exception from being broadcasted to that
CPU.
Ensure that offline CPUs don't participate in the MCE rendezvous
and clear the RIP valid status bit so that a second MCE won't
cause a shutdown.
Without the patch, mce_start() will increment mce_callin and
wait for all CPUs. Offlined CPUs should avoid participating in
the rendezvous process altogether.
Signed-off-by: Ashok Raj <ashok.raj@intel.com>
[ Massage commit message. ]
Signed-off-by: Borislav Petkov <bp@suse.de>
Reviewed-by: Tony Luck <tony.luck@intel.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: linux-edac <linux-edac@vger.kernel.org>
Link: http://lkml.kernel.org/r/1449742346-21470-2-git-send-email-bp@alien8.de
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
arch/x86/kernel/cpu/mcheck/mce.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
index 5648b506f3ae..8ae7e3f27b1b 100644
--- a/arch/x86/kernel/cpu/mcheck/mce.c
+++ b/arch/x86/kernel/cpu/mcheck/mce.c
@@ -1042,6 +1042,17 @@ void do_machine_check(struct pt_regs *regs, long error_code)
DECLARE_BITMAP(valid_banks, MAX_NR_BANKS);
char *msg = "Unknown";
+ /* If this CPU is offline, just bail out. */
+ if (cpu_is_offline(smp_processor_id())) {
+ u64 mcgstatus;
+
+ mcgstatus = mce_rdmsrl(MSR_IA32_MCG_STATUS);
+ if (mcgstatus & MCG_STATUS_RIPV) {
+ mce_wrmsrl(MSR_IA32_MCG_STATUS, 0);
+ return;
+ }
+ }
+
this_cpu_inc(mce_exception_count);
if (!cfg->banks)
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 119/128] ASoC: arizona: Fix bclk for sample rates that are multiple of 4kHz
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (117 preceding siblings ...)
2016-01-24 22:01 ` [PATCH 3.16.y-ckt 118/128] x86/mce: Ensure offline CPUs don't participate in rendezvous process Luis Henriques
@ 2016-01-24 22:01 ` Luis Henriques
2016-01-24 22:01 ` [PATCH 3.16.y-ckt 120/128] async_tx: use GFP_NOWAIT rather than GFP_IO Luis Henriques
` (9 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:01 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Nikesh Oswal, Charles Keepax, Mark Brown, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Nikesh Oswal <Nikesh.Oswal@cirrus.com>
commit e73694d871867cae8471d2350ce89acb38bc2b63 upstream.
For a sample rate of 12kHz the bclk was taken from the 44.1kHz table as
we test for a multiple of 8kHz. This patch fixes this issue by testing
for multiples of 4kHz instead.
Signed-off-by: Nikesh Oswal <Nikesh.Oswal@cirrus.com>
Signed-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
sound/soc/codecs/arizona.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/soc/codecs/arizona.c b/sound/soc/codecs/arizona.c
index 29e198f57d4c..131fc593a4e8 100644
--- a/sound/soc/codecs/arizona.c
+++ b/sound/soc/codecs/arizona.c
@@ -1188,7 +1188,7 @@ static int arizona_hw_params(struct snd_pcm_substream *substream,
int chan_limit = arizona->pdata.max_channels_clocked[dai->id - 1];
int bclk, lrclk, wl, frame, bclk_target;
- if (params_rate(params) % 8000)
+ if (params_rate(params) % 4000)
rates = &arizona_44k1_bclk_rates[0];
else
rates = &arizona_48k_bclk_rates[0];
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 120/128] async_tx: use GFP_NOWAIT rather than GFP_IO
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (118 preceding siblings ...)
2016-01-24 22:01 ` [PATCH 3.16.y-ckt 119/128] ASoC: arizona: Fix bclk for sample rates that are multiple of 4kHz Luis Henriques
@ 2016-01-24 22:01 ` Luis Henriques
2016-01-24 22:01 ` [PATCH 3.16.y-ckt 121/128] ftrace/module: Call clean up function when module init fails early Luis Henriques
` (8 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:01 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: NeilBrown, Vinod Koul, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: NeilBrown <neilb@suse.com>
commit b02bab6b0f928d49dbfb03e1e4e9dd43647623d7 upstream.
These async_XX functions are called from md/raid5 in an atomic
section, between get_cpu() and put_cpu(), so they must not sleep.
So use GFP_NOWAIT rather than GFP_IO.
Dan Williams writes: Longer term async_tx needs to be merged into md
directly as we can allocate this unmap data statically per-stripe
rather than per request.
Fixed: 7476bd79fc01 ("async_pq: convert to dmaengine_unmap_data")
Reported-and-tested-by: Stanislav Samsonov <slava@annapurnalabs.com>
Acked-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: NeilBrown <neilb@suse.com>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
crypto/async_tx/async_memcpy.c | 2 +-
crypto/async_tx/async_pq.c | 4 ++--
crypto/async_tx/async_raid6_recov.c | 4 ++--
crypto/async_tx/async_xor.c | 4 ++--
4 files changed, 7 insertions(+), 7 deletions(-)
diff --git a/crypto/async_tx/async_memcpy.c b/crypto/async_tx/async_memcpy.c
index f8c0b8dbeb75..88bc8e6b2a54 100644
--- a/crypto/async_tx/async_memcpy.c
+++ b/crypto/async_tx/async_memcpy.c
@@ -53,7 +53,7 @@ async_memcpy(struct page *dest, struct page *src, unsigned int dest_offset,
struct dmaengine_unmap_data *unmap = NULL;
if (device)
- unmap = dmaengine_get_unmap_data(device->dev, 2, GFP_NOIO);
+ unmap = dmaengine_get_unmap_data(device->dev, 2, GFP_NOWAIT);
if (unmap && is_dma_copy_aligned(device, src_offset, dest_offset, len)) {
unsigned long dma_prep_flags = 0;
diff --git a/crypto/async_tx/async_pq.c b/crypto/async_tx/async_pq.c
index d05327caf69d..7eb264e65267 100644
--- a/crypto/async_tx/async_pq.c
+++ b/crypto/async_tx/async_pq.c
@@ -176,7 +176,7 @@ async_gen_syndrome(struct page **blocks, unsigned int offset, int disks,
BUG_ON(disks > 255 || !(P(blocks, disks) || Q(blocks, disks)));
if (device)
- unmap = dmaengine_get_unmap_data(device->dev, disks, GFP_NOIO);
+ unmap = dmaengine_get_unmap_data(device->dev, disks, GFP_NOWAIT);
if (unmap &&
(src_cnt <= dma_maxpq(device, 0) ||
@@ -294,7 +294,7 @@ async_syndrome_val(struct page **blocks, unsigned int offset, int disks,
BUG_ON(disks < 4);
if (device)
- unmap = dmaengine_get_unmap_data(device->dev, disks, GFP_NOIO);
+ unmap = dmaengine_get_unmap_data(device->dev, disks, GFP_NOWAIT);
if (unmap && disks <= dma_maxpq(device, 0) &&
is_dma_pq_aligned(device, offset, 0, len)) {
diff --git a/crypto/async_tx/async_raid6_recov.c b/crypto/async_tx/async_raid6_recov.c
index 934a84981495..8fab6275ea1f 100644
--- a/crypto/async_tx/async_raid6_recov.c
+++ b/crypto/async_tx/async_raid6_recov.c
@@ -41,7 +41,7 @@ async_sum_product(struct page *dest, struct page **srcs, unsigned char *coef,
u8 *a, *b, *c;
if (dma)
- unmap = dmaengine_get_unmap_data(dma->dev, 3, GFP_NOIO);
+ unmap = dmaengine_get_unmap_data(dma->dev, 3, GFP_NOWAIT);
if (unmap) {
struct device *dev = dma->dev;
@@ -105,7 +105,7 @@ async_mult(struct page *dest, struct page *src, u8 coef, size_t len,
u8 *d, *s;
if (dma)
- unmap = dmaengine_get_unmap_data(dma->dev, 3, GFP_NOIO);
+ unmap = dmaengine_get_unmap_data(dma->dev, 3, GFP_NOWAIT);
if (unmap) {
dma_addr_t dma_dest[2];
diff --git a/crypto/async_tx/async_xor.c b/crypto/async_tx/async_xor.c
index e1bce26cd4f9..da75777f2b3f 100644
--- a/crypto/async_tx/async_xor.c
+++ b/crypto/async_tx/async_xor.c
@@ -182,7 +182,7 @@ async_xor(struct page *dest, struct page **src_list, unsigned int offset,
BUG_ON(src_cnt <= 1);
if (device)
- unmap = dmaengine_get_unmap_data(device->dev, src_cnt+1, GFP_NOIO);
+ unmap = dmaengine_get_unmap_data(device->dev, src_cnt+1, GFP_NOWAIT);
if (unmap && is_dma_xor_aligned(device, offset, 0, len)) {
struct dma_async_tx_descriptor *tx;
@@ -278,7 +278,7 @@ async_xor_val(struct page *dest, struct page **src_list, unsigned int offset,
BUG_ON(src_cnt <= 1);
if (device)
- unmap = dmaengine_get_unmap_data(device->dev, src_cnt, GFP_NOIO);
+ unmap = dmaengine_get_unmap_data(device->dev, src_cnt, GFP_NOWAIT);
if (unmap && src_cnt <= device->max_xor &&
is_dma_xor_aligned(device, offset, 0, len)) {
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 121/128] ftrace/module: Call clean up function when module init fails early
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (119 preceding siblings ...)
2016-01-24 22:01 ` [PATCH 3.16.y-ckt 120/128] async_tx: use GFP_NOWAIT rather than GFP_IO Luis Henriques
@ 2016-01-24 22:01 ` Luis Henriques
2016-01-24 22:01 ` [PATCH 3.16.y-ckt 122/128] ASoC: Use nested lock for snd_soc_dapm_mutex_lock Luis Henriques
` (7 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:01 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Steven Rostedt, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>
commit 049fb9bd416077b3622d317a45796be4f2431df3 upstream.
If the module init code fails after calling ftrace_module_init() and before
calling do_init_module(), we can suffer from a memory leak. This is because
ftrace_module_init() allocates pages to store the locations that ftrace
hooks are placed in the module text. If do_init_module() fails, it still
calls the MODULE_GOING notifiers which will tell ftrace to do a clean up of
the pages it allocated for the module. But if load_module() fails before
then, the pages allocated by ftrace_module_init() will never be freed.
Call ftrace_release_mod() on the module if load_module() fails before
getting to do_init_module().
Link: http://lkml.kernel.org/r/567CEA31.1070507@intel.com
Reported-by: "Qiu, PeiyangX" <peiyangx.qiu@intel.com>
Fixes: a949ae560a511 "ftrace/module: Hardcode ftrace_module_init() call into load_module()"
Acked-by: Rusty Russell <rusty@rustcorp.com.au>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
include/linux/ftrace.h | 1 +
kernel/module.c | 6 ++++++
2 files changed, 7 insertions(+)
diff --git a/include/linux/ftrace.h b/include/linux/ftrace.h
index 721de254ba7a..c314fe2e0f46 100644
--- a/include/linux/ftrace.h
+++ b/include/linux/ftrace.h
@@ -541,6 +541,7 @@ extern int ftrace_arch_read_dyn_info(char *buf, int size);
extern int skip_trace(unsigned long ip);
extern void ftrace_module_init(struct module *mod);
+extern void ftrace_release_mod(struct module *mod);
extern void ftrace_disable_daemon(void);
extern void ftrace_enable_daemon(void);
diff --git a/kernel/module.c b/kernel/module.c
index ed4d3b7ec58a..365b0a9d87b3 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -3339,6 +3339,12 @@ static int load_module(struct load_info *info, const char __user *uargs,
wake_up_all(&module_wq);
mutex_unlock(&module_mutex);
free_module:
+ /*
+ * Ftrace needs to clean up what it initialized.
+ * This does nothing if ftrace_module_init() wasn't called,
+ * but it must be called outside of module_mutex.
+ */
+ ftrace_release_mod(mod);
module_deallocate(mod, info);
free_copy:
free_copy(info);
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 122/128] ASoC: Use nested lock for snd_soc_dapm_mutex_lock
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (120 preceding siblings ...)
2016-01-24 22:01 ` [PATCH 3.16.y-ckt 121/128] ftrace/module: Call clean up function when module init fails early Luis Henriques
@ 2016-01-24 22:01 ` Luis Henriques
2016-01-24 22:01 ` [PATCH 3.16.y-ckt 123/128] net: filter: make JITs zero A for SKF_AD_ALU_XOR_X Luis Henriques
` (6 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:01 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Charles Keepax, Mark Brown, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
commit 783513eec3209542fcd6ac0cbcb030b3c17a4827 upstream.
snd_soc_dapm_mutex_lock currently uses the un-nested call which can
cause lockdep warnings when called from control handlers (a relatively
common usage) and using modules. As creating the control causes a
potential mutex inversion with the handler, creating the control will
take the controls_rwsem under the dapm_mutex and accessing the control
will take the dapm_mutex under controls_rwsem.
All the users look like they want to be using the runtime class of the
lock anyway, so this patch just changes snd_soc_dapm_mutex_lock to use
the nested call, with the SND_SOC_DAPM_CLASS_RUNTIME class.
Fixes: f6d5e586b416 ("ASoC: dapm: Add helpers to lock/unlock DAPM mutex")
Signed-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
include/sound/soc.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/sound/soc.h b/include/sound/soc.h
index a34d34649195..4dc6904ebbf9 100644
--- a/include/sound/soc.h
+++ b/include/sound/soc.h
@@ -1390,7 +1390,7 @@ extern const struct dev_pm_ops snd_soc_pm_ops;
/* Helper functions */
static inline void snd_soc_dapm_mutex_lock(struct snd_soc_dapm_context *dapm)
{
- mutex_lock(&dapm->card->dapm_mutex);
+ mutex_lock_nested(&dapm->card->dapm_mutex, SND_SOC_DAPM_CLASS_RUNTIME);
}
static inline void snd_soc_dapm_mutex_unlock(struct snd_soc_dapm_context *dapm)
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 123/128] net: filter: make JITs zero A for SKF_AD_ALU_XOR_X
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (121 preceding siblings ...)
2016-01-24 22:01 ` [PATCH 3.16.y-ckt 122/128] ASoC: Use nested lock for snd_soc_dapm_mutex_lock Luis Henriques
@ 2016-01-24 22:01 ` Luis Henriques
2016-01-24 22:01 ` [PATCH 3.16.y-ckt 124/128] net: possible use after free in dst_release Luis Henriques
` (5 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:01 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Rabin Vincent, David S . Miller, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Rabin Vincent <rabin@rab.in>
commit 55795ef5469290f89f04e12e662ded604909e462 upstream.
The SKF_AD_ALU_XOR_X ancillary is not like the other ancillary data
instructions since it XORs A with X while all the others replace A with
some loaded value. All the BPF JITs fail to clear A if this is used as
the first instruction in a filter. This was found using american fuzzy
lop.
Add a helper to determine if A needs to be cleared given the first
instruction in a filter, and use this in the JITs. Except for ARM, the
rest have only been compile-tested.
Fixes: 3480593131e0 ("net: filter: get rid of BPF_S_* enum")
Signed-off-by: Rabin Vincent <rabin@rab.in>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
arch/arm/net/bpf_jit_32.c | 16 +---------------
arch/mips/net/bpf_jit.c | 16 +---------------
arch/powerpc/net/bpf_jit_comp.c | 13 ++-----------
arch/sparc/net/bpf_jit_comp.c | 17 ++---------------
include/linux/filter.h | 19 +++++++++++++++++++
5 files changed, 25 insertions(+), 56 deletions(-)
diff --git a/arch/arm/net/bpf_jit_32.c b/arch/arm/net/bpf_jit_32.c
index 75ee31c95ff3..4a7fe29635ea 100644
--- a/arch/arm/net/bpf_jit_32.c
+++ b/arch/arm/net/bpf_jit_32.c
@@ -161,23 +161,9 @@ static inline int mem_words_used(struct jit_ctx *ctx)
return fls(ctx->seen & SEEN_MEM);
}
-static inline bool is_load_to_a(u16 inst)
-{
- switch (inst) {
- case BPF_LD | BPF_W | BPF_LEN:
- case BPF_LD | BPF_W | BPF_ABS:
- case BPF_LD | BPF_H | BPF_ABS:
- case BPF_LD | BPF_B | BPF_ABS:
- return true;
- default:
- return false;
- }
-}
-
static void build_prologue(struct jit_ctx *ctx)
{
u16 reg_set = saved_regs(ctx);
- u16 first_inst = ctx->skf->insns[0].code;
u16 off;
#ifdef CONFIG_FRAME_POINTER
@@ -207,7 +193,7 @@ static void build_prologue(struct jit_ctx *ctx)
emit(ARM_MOV_I(r_X, 0), ctx);
/* do not leak kernel data to userspace */
- if ((first_inst != (BPF_RET | BPF_K)) && !(is_load_to_a(first_inst)))
+ if (bpf_needs_clear_a(&ctx->skf->insns[0]))
emit(ARM_MOV_I(r_A, 0), ctx);
/* stack space for the BPF_MEM words */
diff --git a/arch/mips/net/bpf_jit.c b/arch/mips/net/bpf_jit.c
index 965f1c116cc5..32751a0bba58 100644
--- a/arch/mips/net/bpf_jit.c
+++ b/arch/mips/net/bpf_jit.c
@@ -566,19 +566,6 @@ static inline u16 align_sp(unsigned int num)
return num;
}
-static bool is_load_to_a(u16 inst)
-{
- switch (inst) {
- case BPF_LD | BPF_W | BPF_LEN:
- case BPF_LD | BPF_W | BPF_ABS:
- case BPF_LD | BPF_H | BPF_ABS:
- case BPF_LD | BPF_B | BPF_ABS:
- return true;
- default:
- return false;
- }
-}
-
static void save_bpf_jit_regs(struct jit_ctx *ctx, unsigned offset)
{
int i = 0, real_off = 0;
@@ -703,7 +690,6 @@ static unsigned int get_stack_depth(struct jit_ctx *ctx)
static void build_prologue(struct jit_ctx *ctx)
{
- u16 first_inst = ctx->skf->insns[0].code;
int sp_off;
/* Calculate the total offset for the stack pointer */
@@ -717,7 +703,7 @@ static void build_prologue(struct jit_ctx *ctx)
emit_jit_reg_move(r_X, r_zero, ctx);
/* Do not leak kernel data to userspace */
- if ((first_inst != (BPF_RET | BPF_K)) && !(is_load_to_a(first_inst)))
+ if (bpf_needs_clear_a(&ctx->skf->insns[0]))
emit_jit_reg_move(r_A, r_zero, ctx);
}
diff --git a/arch/powerpc/net/bpf_jit_comp.c b/arch/powerpc/net/bpf_jit_comp.c
index 82e82cadcde5..6a1c7ecfdd2c 100644
--- a/arch/powerpc/net/bpf_jit_comp.c
+++ b/arch/powerpc/net/bpf_jit_comp.c
@@ -78,18 +78,9 @@ static void bpf_jit_build_prologue(struct sk_filter *fp, u32 *image,
PPC_LI(r_X, 0);
}
- switch (filter[0].code) {
- case BPF_RET | BPF_K:
- case BPF_LD | BPF_W | BPF_LEN:
- case BPF_LD | BPF_W | BPF_ABS:
- case BPF_LD | BPF_H | BPF_ABS:
- case BPF_LD | BPF_B | BPF_ABS:
- /* first instruction sets A register (or is RET 'constant') */
- break;
- default:
- /* make sure we dont leak kernel information to user */
+ /* make sure we dont leak kernel information to user */
+ if (bpf_needs_clear_a(&filter[0]))
PPC_LI(r_A, 0);
- }
}
static void bpf_jit_build_epilogue(u32 *image, struct codegen_context *ctx)
diff --git a/arch/sparc/net/bpf_jit_comp.c b/arch/sparc/net/bpf_jit_comp.c
index 8d4152f94c5a..ae966f86dcec 100644
--- a/arch/sparc/net/bpf_jit_comp.c
+++ b/arch/sparc/net/bpf_jit_comp.c
@@ -420,22 +420,9 @@ void bpf_jit_compile(struct sk_filter *fp)
}
emit_reg_move(O7, r_saved_O7);
- switch (filter[0].code) {
- case BPF_RET | BPF_K:
- case BPF_LD | BPF_W | BPF_LEN:
- case BPF_LD | BPF_W | BPF_ABS:
- case BPF_LD | BPF_H | BPF_ABS:
- case BPF_LD | BPF_B | BPF_ABS:
- /* The first instruction sets the A register (or is
- * a "RET 'constant'")
- */
- break;
- default:
- /* Make sure we dont leak kernel information to the
- * user.
- */
+ /* Make sure we dont leak kernel information to the user. */
+ if (bpf_needs_clear_a(&filter[0]))
emit_clear(r_A); /* A = 0 */
- }
for (i = 0; i < flen; i++) {
unsigned int K = filter[i].k;
diff --git a/include/linux/filter.h b/include/linux/filter.h
index a7e3c48d73a7..02f857260bcb 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -373,6 +373,25 @@ void bpf_int_jit_compile(struct sk_filter *fp);
#define BPF_ANC BIT(15)
+static inline bool bpf_needs_clear_a(const struct sock_filter *first)
+{
+ switch (first->code) {
+ case BPF_RET | BPF_K:
+ case BPF_LD | BPF_W | BPF_LEN:
+ return false;
+
+ case BPF_LD | BPF_W | BPF_ABS:
+ case BPF_LD | BPF_H | BPF_ABS:
+ case BPF_LD | BPF_B | BPF_ABS:
+ if (first->k == SKF_AD_OFF + SKF_AD_ALU_XOR_X)
+ return true;
+ return false;
+
+ default:
+ return true;
+ }
+}
+
static inline u16 bpf_anc_helper(const struct sock_filter *ftest)
{
BUG_ON(ftest->code & BPF_ANC);
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 124/128] net: possible use after free in dst_release
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (122 preceding siblings ...)
2016-01-24 22:01 ` [PATCH 3.16.y-ckt 123/128] net: filter: make JITs zero A for SKF_AD_ALU_XOR_X Luis Henriques
@ 2016-01-24 22:01 ` Luis Henriques
2016-01-24 22:01 ` [PATCH 3.16.y-ckt 125/128] kvm: x86: only channel 0 of the i8254 is linked to the HPET Luis Henriques
` (4 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:01 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Francesco Ruggeri, David S . Miller, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Francesco Ruggeri <fruggeri@aristanetworks.com>
commit 07a5d38453599052aff0877b16bb9c1585f08609 upstream.
dst_release should not access dst->flags after decrementing
__refcnt to 0. The dst_entry may be in dst_busy_list and
dst_gc_task may dst_destroy it before dst_release gets a chance
to access dst->flags.
Fixes: d69bbf88c8d0 ("net: fix a race in dst_release()")
Fixes: 27b75c95f10d ("net: avoid RCU for NOCACHE dst")
Signed-off-by: Francesco Ruggeri <fruggeri@arista.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
net/core/dst.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/core/dst.c b/net/core/dst.c
index a80e92346b9b..57746a18c957 100644
--- a/net/core/dst.c
+++ b/net/core/dst.c
@@ -282,10 +282,11 @@ void dst_release(struct dst_entry *dst)
{
if (dst) {
int newrefcnt;
+ unsigned short nocache = dst->flags & DST_NOCACHE;
newrefcnt = atomic_dec_return(&dst->__refcnt);
WARN_ON(newrefcnt < 0);
- if (!newrefcnt && unlikely(dst->flags & DST_NOCACHE))
+ if (!newrefcnt && unlikely(nocache))
call_rcu(&dst->rcu_head, dst_destroy_rcu);
}
}
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 125/128] kvm: x86: only channel 0 of the i8254 is linked to the HPET
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (123 preceding siblings ...)
2016-01-24 22:01 ` [PATCH 3.16.y-ckt 124/128] net: possible use after free in dst_release Luis Henriques
@ 2016-01-24 22:01 ` Luis Henriques
2016-01-24 22:01 ` [PATCH 3.16.y-ckt 126/128] firmware: dmi_scan: Fix UUID endianness for SMBIOS >= 2.6 Luis Henriques
` (3 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:01 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Paolo Bonzini, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Paolo Bonzini <pbonzini@redhat.com>
commit e5e57e7a03b1cdcb98e4aed135def2a08cbf3257 upstream.
While setting the KVM PIT counters in 'kvm_pit_load_count', if
'hpet_legacy_start' is set, the function disables the timer on
channel[0], instead of the respective index 'channel'. This is
because channels 1-3 are not linked to the HPET. Fix the caller
to only activate the special HPET processing for channel 0.
Reported-by: P J P <pjp@fedoraproject.org>
Fixes: 0185604c2d82c560dab2f2933a18f797e74ab5a8
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
arch/x86/kvm/i8254.c | 1 +
arch/x86/kvm/x86.c | 3 ++-
2 files changed, 3 insertions(+), 1 deletion(-)
diff --git a/arch/x86/kvm/i8254.c b/arch/x86/kvm/i8254.c
index 1406ffde3e35..f2006e65a238 100644
--- a/arch/x86/kvm/i8254.c
+++ b/arch/x86/kvm/i8254.c
@@ -418,6 +418,7 @@ void kvm_pit_load_count(struct kvm *kvm, int channel, u32 val, int hpet_legacy_s
u8 saved_mode;
if (hpet_legacy_start) {
/* save existing mode for later reenablement */
+ WARN_ON(channel != 0);
saved_mode = kvm->arch.vpit->pit_state.channels[0].mode;
kvm->arch.vpit->pit_state.channels[0].mode = 0xff; /* disable timer */
pit_load_count(kvm, channel, val);
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index e336615e0aae..14bd5c079ca3 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -3596,7 +3596,8 @@ static int kvm_vm_ioctl_set_pit2(struct kvm *kvm, struct kvm_pit_state2 *ps)
sizeof(kvm->arch.vpit->pit_state.channels));
kvm->arch.vpit->pit_state.flags = ps->flags;
for (i = 0; i < 3; i++)
- kvm_pit_load_count(kvm, i, kvm->arch.vpit->pit_state.channels[i].count, start);
+ kvm_pit_load_count(kvm, i, kvm->arch.vpit->pit_state.channels[i].count,
+ start && i == 0);
mutex_unlock(&kvm->arch.vpit->pit_state.lock);
return r;
}
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 126/128] firmware: dmi_scan: Fix UUID endianness for SMBIOS >= 2.6
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (124 preceding siblings ...)
2016-01-24 22:01 ` [PATCH 3.16.y-ckt 125/128] kvm: x86: only channel 0 of the i8254 is linked to the HPET Luis Henriques
@ 2016-01-24 22:01 ` Luis Henriques
2016-01-24 22:01 ` [PATCH 3.16.y-ckt 127/128] udp: properly support MSG_PEEK with truncated buffers Luis Henriques
` (2 subsequent siblings)
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:01 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Andrea Arcangeli, Jean Delvare, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Andrea Arcangeli <aarcange@redhat.com>
commit ff4319dc7cd58c92b389960e375038335d157a60 upstream.
The dmi_ver wasn't updated correctly before the dmi_decode method run
to save the uuid.
That resulted in "dmidecode -s system-uuid" and
/sys/class/dmi/id/product_uuid disagreeing. The latter was buggy and
this fixes it.
Reported-by: Federico Simoncelli <fsimonce@redhat.com>
Fixes: 9f9c9cbb6057 ("drivers/firmware/dmi_scan.c: fetch dmi version from SMBIOS if it exists")
Fixes: 79bae42d51a5 ("dmi_scan: refactor dmi_scan_machine(), {smbios,dmi}_present()")
Signed-off-by: Andrea Arcangeli <aarcange@redhat.com>
Signed-off-by: Jean Delvare <jdelvare@suse.de>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/firmware/dmi_scan.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
index 35286fe52823..48142b88e672 100644
--- a/drivers/firmware/dmi_scan.c
+++ b/drivers/firmware/dmi_scan.c
@@ -493,6 +493,7 @@ static int __init dmi_present(const u8 *buf)
dmi_ver = smbios_ver;
else
dmi_ver = (buf[14] & 0xF0) << 4 | (buf[14] & 0x0F);
+ dmi_ver <<= 8;
dmi_num = (buf[13] << 8) | buf[12];
dmi_len = (buf[7] << 8) | buf[6];
dmi_base = (buf[11] << 24) | (buf[10] << 16) |
@@ -501,10 +502,10 @@ static int __init dmi_present(const u8 *buf)
if (dmi_walk_early(dmi_decode) == 0) {
if (smbios_ver) {
pr_info("SMBIOS %d.%d present.\n",
- dmi_ver >> 8, dmi_ver & 0xFF);
+ dmi_ver >> 16, (dmi_ver >> 8) & 0xFF);
} else {
pr_info("Legacy DMI %d.%d present.\n",
- dmi_ver >> 8, dmi_ver & 0xFF);
+ dmi_ver >> 16, (dmi_ver >> 8) & 0xFF);
}
dmi_format_ids(dmi_ids_string, sizeof(dmi_ids_string));
printk(KERN_DEBUG "DMI: %s\n", dmi_ids_string);
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 127/128] udp: properly support MSG_PEEK with truncated buffers
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (125 preceding siblings ...)
2016-01-24 22:01 ` [PATCH 3.16.y-ckt 126/128] firmware: dmi_scan: Fix UUID endianness for SMBIOS >= 2.6 Luis Henriques
@ 2016-01-24 22:01 ` Luis Henriques
2016-01-25 1:41 ` Ben Hutchings
2016-01-24 22:01 ` [PATCH 3.16.y-ckt 128/128] KEYS: Fix keyring ref leak in join_session_keyring() Luis Henriques
2016-01-25 10:56 ` [PATCH 3.16.y-ckt 129/129] Revert "[stable-only] net: add length argument to skb_copy_and_csum_datagram_iovec" Luis Henriques
128 siblings, 1 reply; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:01 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Eric Dumazet, David S . Miller, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Eric Dumazet <edumazet@google.com>
commit 197c949e7798fbf28cfadc69d9ca0c2abbf93191 upstream.
Backport of this upstream commit into stable kernels :
89c22d8c3b27 ("net: Fix skb csum races when peeking")
exposed a bug in udp stack vs MSG_PEEK support, when user provides
a buffer smaller than skb payload.
In this case,
skb_copy_and_csum_datagram_iovec(skb, sizeof(struct udphdr),
msg->msg_iov);
returns -EFAULT.
This bug does not happen in upstream kernels since Al Viro did a great
job to replace this into :
skb_copy_and_csum_datagram_msg(skb, sizeof(struct udphdr), msg);
This variant is safe vs short buffers.
For the time being, instead reverting Herbert Xu patch and add back
skb->ip_summed invalid changes, simply store the result of
udp_lib_checksum_complete() so that we avoid computing the checksum a
second time, and avoid the problematic
skb_copy_and_csum_datagram_iovec() call.
This patch can be applied on recent kernels as it avoids a double
checksumming, then backported to stable kernels as a bug fix.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
net/ipv4/udp.c | 6 ++++--
net/ipv6/udp.c | 6 ++++--
2 files changed, 8 insertions(+), 4 deletions(-)
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 4b9e4aba11b0..c57fa4c74c94 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1272,6 +1272,7 @@ int udp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
int peeked, off = 0;
int err;
int is_udplite = IS_UDPLITE(sk);
+ bool checksum_valid = false;
bool slow;
if (flags & MSG_ERRQUEUE)
@@ -1297,11 +1298,12 @@ try_again:
*/
if (copied < ulen || UDP_SKB_CB(skb)->partial_cov) {
- if (udp_lib_checksum_complete(skb))
+ checksum_valid = !udp_lib_checksum_complete(skb);
+ if (!checksum_valid)
goto csum_copy_err;
}
- if (skb_csum_unnecessary(skb))
+ if (checksum_valid || skb_csum_unnecessary(skb))
err = skb_copy_datagram_iovec(skb, sizeof(struct udphdr),
msg->msg_iov, copied);
else {
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index eb38829d8919..e432f8eb3c60 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -389,6 +389,7 @@ int udpv6_recvmsg(struct kiocb *iocb, struct sock *sk,
int peeked, off = 0;
int err;
int is_udplite = IS_UDPLITE(sk);
+ bool checksum_valid = false;
int is_udp4;
bool slow;
@@ -420,11 +421,12 @@ try_again:
*/
if (copied < ulen || UDP_SKB_CB(skb)->partial_cov) {
- if (udp_lib_checksum_complete(skb))
+ checksum_valid = !udp_lib_checksum_complete(skb);
+ if (!checksum_valid)
goto csum_copy_err;
}
- if (skb_csum_unnecessary(skb))
+ if (checksum_valid || skb_csum_unnecessary(skb))
err = skb_copy_datagram_iovec(skb, sizeof(struct udphdr),
msg->msg_iov, copied);
else {
^ permalink raw reply related [flat|nested] 136+ messages in thread* Re: [PATCH 3.16.y-ckt 127/128] udp: properly support MSG_PEEK with truncated buffers
2016-01-24 22:01 ` [PATCH 3.16.y-ckt 127/128] udp: properly support MSG_PEEK with truncated buffers Luis Henriques
@ 2016-01-25 1:41 ` Ben Hutchings
2016-01-25 10:54 ` Luis Henriques
0 siblings, 1 reply; 136+ messages in thread
From: Ben Hutchings @ 2016-01-25 1:41 UTC (permalink / raw)
To: Luis Henriques, linux-kernel, stable, kernel-team
Cc: Eric Dumazet, David S . Miller
[-- Attachment #1: Type: text/plain, Size: 616 bytes --]
On Sun, 2016-01-24 at 22:01 +0000, Luis Henriques wrote:
> 3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
>
> ---8<------------------------------------------------------------
>
> From: Eric Dumazet <edumazet@google.com>
>
> commit 197c949e7798fbf28cfadc69d9ca0c2abbf93191 upstream.
[...]
Please also revert commit fa89ae5548ed282f0ceb4660b3b93e4e2ee875f3
which was the previous attempt to fix this.
Ben.
--
Ben Hutchings
Klipstein's 4th Law of Prototyping and Production:
A fail-safe circuit will destroy others.
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 811 bytes --]
^ permalink raw reply [flat|nested] 136+ messages in thread* Re: [PATCH 3.16.y-ckt 127/128] udp: properly support MSG_PEEK with truncated buffers
2016-01-25 1:41 ` Ben Hutchings
@ 2016-01-25 10:54 ` Luis Henriques
0 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-25 10:54 UTC (permalink / raw)
To: Ben Hutchings
Cc: linux-kernel, stable, kernel-team, Eric Dumazet, David S . Miller
On Mon, Jan 25, 2016 at 01:41:23AM +0000, Ben Hutchings wrote:
> On Sun, 2016-01-24 at 22:01 +0000, Luis Henriques wrote:
> > 3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
> >
> > ---8<------------------------------------------------------------
> >
> > From: Eric Dumazet <edumazet@google.com>
> >
> > commit 197c949e7798fbf28cfadc69d9ca0c2abbf93191 upstream.
> [...]
>
> Please also revert commit fa89ae5548ed282f0ceb4660b3b93e4e2ee875f3
> which was the previous attempt to fix this.
>
Thanks, I'll add that revert to 3.16.7-ckt23 as well.
Cheers,
--
Luís
> Ben.
>
> --
> Ben Hutchings
> Klipstein's 4th Law of Prototyping and Production:
> A fail-safe circuit will destroy others.
^ permalink raw reply [flat|nested] 136+ messages in thread
* Re: [PATCH 3.16.y-ckt 127/128] udp: properly support MSG_PEEK with truncated buffers
@ 2016-01-25 10:54 ` Luis Henriques
0 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-25 10:54 UTC (permalink / raw)
To: Ben Hutchings
Cc: linux-kernel, stable, kernel-team, Eric Dumazet, David S . Miller
On Mon, Jan 25, 2016 at 01:41:23AM +0000, Ben Hutchings wrote:
> On Sun, 2016-01-24 at 22:01 +0000, Luis Henriques wrote:
> > 3.16.7-ckt23 -stable review patch.��If anyone has any objections, please let me know.
> >
> > ---8<------------------------------------------------------------
> >
> > From: Eric Dumazet <edumazet@google.com>
> >
> > commit 197c949e7798fbf28cfadc69d9ca0c2abbf93191 upstream.
> [...]
>
> Please also revert commit�fa89ae5548ed282f0ceb4660b3b93e4e2ee875f3
> which was the previous attempt to fix this.
>
Thanks, I'll add that revert to 3.16.7-ckt23 as well.
Cheers,
--
Lu�s
> Ben.
>
> --
> Ben Hutchings
> Klipstein's 4th Law of Prototyping and Production:
> A fail-safe circuit will destroy others.
^ permalink raw reply [flat|nested] 136+ messages in thread
* [PATCH 3.16.y-ckt 128/128] KEYS: Fix keyring ref leak in join_session_keyring()
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (126 preceding siblings ...)
2016-01-24 22:01 ` [PATCH 3.16.y-ckt 127/128] udp: properly support MSG_PEEK with truncated buffers Luis Henriques
@ 2016-01-24 22:01 ` Luis Henriques
2016-01-25 10:56 ` [PATCH 3.16.y-ckt 129/129] Revert "[stable-only] net: add length argument to skb_copy_and_csum_datagram_iovec" Luis Henriques
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-24 22:01 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: David Howells, James Morris, Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Yevgeny Pats <yevgeny@perception-point.io>
commit 23567fd052a9abb6d67fe8e7a9ccdd9800a540f2 upstream.
This fixes CVE-2016-0728.
If a thread is asked to join as a session keyring the keyring that's already
set as its session, we leak a keyring reference.
This can be tested with the following program:
#include <stddef.h>
#include <stdio.h>
#include <sys/types.h>
#include <keyutils.h>
int main(int argc, const char *argv[])
{
int i = 0;
key_serial_t serial;
serial = keyctl(KEYCTL_JOIN_SESSION_KEYRING,
"leaked-keyring");
if (serial < 0) {
perror("keyctl");
return -1;
}
if (keyctl(KEYCTL_SETPERM, serial,
KEY_POS_ALL | KEY_USR_ALL) < 0) {
perror("keyctl");
return -1;
}
for (i = 0; i < 100; i++) {
serial = keyctl(KEYCTL_JOIN_SESSION_KEYRING,
"leaked-keyring");
if (serial < 0) {
perror("keyctl");
return -1;
}
}
return 0;
}
If, after the program has run, there something like the following line in
/proc/keys:
3f3d898f I--Q--- 100 perm 3f3f0000 0 0 keyring leaked-keyring: empty
with a usage count of 100 * the number of times the program has been run,
then the kernel is malfunctioning. If leaked-keyring has zero usages or
has been garbage collected, then the problem is fixed.
Reported-by: Yevgeny Pats <yevgeny@perception-point.io>
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Don Zickus <dzickus@redhat.com>
Acked-by: Prarit Bhargava <prarit@redhat.com>
Acked-by: Jarod Wilson <jarod@redhat.com>
Signed-off-by: James Morris <james.l.morris@oracle.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
security/keys/process_keys.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
index 0cf8a130a267..4e56371f239f 100644
--- a/security/keys/process_keys.c
+++ b/security/keys/process_keys.c
@@ -793,6 +793,7 @@ long join_session_keyring(const char *name)
ret = PTR_ERR(keyring);
goto error2;
} else if (keyring == new->session_keyring) {
+ key_put(keyring);
ret = 0;
goto error2;
}
^ permalink raw reply related [flat|nested] 136+ messages in thread* [PATCH 3.16.y-ckt 129/129] Revert "[stable-only] net: add length argument to skb_copy_and_csum_datagram_iovec"
2016-01-24 21:59 [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques
` (127 preceding siblings ...)
2016-01-24 22:01 ` [PATCH 3.16.y-ckt 128/128] KEYS: Fix keyring ref leak in join_session_keyring() Luis Henriques
@ 2016-01-25 10:56 ` Luis Henriques
128 siblings, 0 replies; 136+ messages in thread
From: Luis Henriques @ 2016-01-25 10:56 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Luis Henriques
3.16.7-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Luis Henriques <luis.henriques@canonical.com>
This reverts commit fa89ae5548ed282f0ceb4660b3b93e4e2ee875f3.
As reported by Michal Kubecek, the backport of commit 89c22d8c3b27
("net: Fix skb csum races when peeking") exposed an upstream bug.
It is being reverted and replaced by a better fix.
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
include/linux/skbuff.h | 2 +-
net/core/datagram.c | 6 +-----
net/ipv4/tcp_input.c | 2 +-
net/ipv4/udp.c | 2 +-
net/ipv6/raw.c | 2 +-
net/ipv6/udp.c | 3 +--
6 files changed, 6 insertions(+), 11 deletions(-)
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 94038f93f145..010bc80be91c 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -2525,7 +2525,7 @@ unsigned int datagram_poll(struct file *file, struct socket *sock,
int skb_copy_datagram_iovec(const struct sk_buff *from, int offset,
struct iovec *to, int size);
int skb_copy_and_csum_datagram_iovec(struct sk_buff *skb, int hlen,
- struct iovec *iov, int len);
+ struct iovec *iov);
int skb_copy_datagram_from_iovec(struct sk_buff *skb, int offset,
const struct iovec *from, int from_offset,
int len);
diff --git a/net/core/datagram.c b/net/core/datagram.c
index 169f742d1464..3c69a464595e 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -818,7 +818,6 @@ EXPORT_SYMBOL(__skb_checksum_complete);
* @skb: skbuff
* @hlen: hardware length
* @iov: io vector
- * @len: amount of data to copy from skb to iov
*
* Caller _must_ check that skb will fit to this iovec.
*
@@ -828,14 +827,11 @@ EXPORT_SYMBOL(__skb_checksum_complete);
* can be modified!
*/
int skb_copy_and_csum_datagram_iovec(struct sk_buff *skb,
- int hlen, struct iovec *iov, int len)
+ int hlen, struct iovec *iov)
{
__wsum csum;
int chunk = skb->len - hlen;
- if (chunk > len)
- chunk = len;
-
if (!chunk)
return 0;
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 43404d3f9da8..036615125532 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -4903,7 +4903,7 @@ static int tcp_copy_to_iovec(struct sock *sk, struct sk_buff *skb, int hlen)
err = skb_copy_datagram_iovec(skb, hlen, tp->ucopy.iov, chunk);
else
err = skb_copy_and_csum_datagram_iovec(skb, hlen,
- tp->ucopy.iov, chunk);
+ tp->ucopy.iov);
if (!err) {
tp->ucopy.len -= chunk;
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 4b9e4aba11b0..10c1530ba978 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1307,7 +1307,7 @@ try_again:
else {
err = skb_copy_and_csum_datagram_iovec(skb,
sizeof(struct udphdr),
- msg->msg_iov, copied);
+ msg->msg_iov);
if (err == -EINVAL)
goto csum_copy_err;
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index a652fdb6bd5d..1463757e8682 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -492,7 +492,7 @@ static int rawv6_recvmsg(struct kiocb *iocb, struct sock *sk,
goto csum_copy_err;
err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
} else {
- err = skb_copy_and_csum_datagram_iovec(skb, 0, msg->msg_iov, copied);
+ err = skb_copy_and_csum_datagram_iovec(skb, 0, msg->msg_iov);
if (err == -EINVAL)
goto csum_copy_err;
}
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index eb38829d8919..f94b850511e3 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -428,8 +428,7 @@ try_again:
err = skb_copy_datagram_iovec(skb, sizeof(struct udphdr),
msg->msg_iov, copied);
else {
- err = skb_copy_and_csum_datagram_iovec(skb, sizeof(struct udphdr),
- msg->msg_iov, copied);
+ err = skb_copy_and_csum_datagram_iovec(skb, sizeof(struct udphdr), msg->msg_iov);
if (err == -EINVAL)
goto csum_copy_err;
}
^ permalink raw reply related [flat|nested] 136+ messages in thread