* [PATCH 3.18 001/108] staging: iio: adc: ad7280a: handle error from __ad7280_read32()
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
@ 2019-02-18 13:42 ` Greg Kroah-Hartman
2019-02-18 13:42 ` [PATCH 3.18 002/108] ARM: 8808/1: kexec:offline panic_smp_self_stop CPU Greg Kroah-Hartman
` (109 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:42 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Slawomir Stepien, Jonathan Cameron,
Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 0559ef7fde67bc6c83c6eb6329dbd6649528263e ]
Inside __ad7280_read32(), the spi_sync_transfer() can fail with negative
error code. This change will ensure that this error is being passed up
in the call stack, so it can be handled.
Signed-off-by: Slawomir Stepien <sst@poczta.fm>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/iio/adc/ad7280a.c | 17 +++++++++++++----
1 file changed, 13 insertions(+), 4 deletions(-)
diff --git a/drivers/staging/iio/adc/ad7280a.c b/drivers/staging/iio/adc/ad7280a.c
index d215edf66af2..0ad4af5d0ae4 100644
--- a/drivers/staging/iio/adc/ad7280a.c
+++ b/drivers/staging/iio/adc/ad7280a.c
@@ -250,7 +250,9 @@ static int ad7280_read(struct ad7280_state *st, unsigned devaddr,
if (ret)
return ret;
- __ad7280_read32(st, &tmp);
+ ret = __ad7280_read32(st, &tmp);
+ if (ret)
+ return ret;
if (ad7280_check_crc(st, tmp))
return -EIO;
@@ -288,7 +290,9 @@ static int ad7280_read_channel(struct ad7280_state *st, unsigned devaddr,
ad7280_delay(st);
- __ad7280_read32(st, &tmp);
+ ret = __ad7280_read32(st, &tmp);
+ if (ret)
+ return ret;
if (ad7280_check_crc(st, tmp))
return -EIO;
@@ -321,7 +325,9 @@ static int ad7280_read_all_channels(struct ad7280_state *st, unsigned cnt,
ad7280_delay(st);
for (i = 0; i < cnt; i++) {
- __ad7280_read32(st, &tmp);
+ ret = __ad7280_read32(st, &tmp);
+ if (ret)
+ return ret;
if (ad7280_check_crc(st, tmp))
return -EIO;
@@ -364,7 +370,10 @@ static int ad7280_chain_setup(struct ad7280_state *st)
return ret;
for (n = 0; n <= AD7280A_MAX_CHAIN; n++) {
- __ad7280_read32(st, &val);
+ ret = __ad7280_read32(st, &val);
+ if (ret)
+ return ret;
+
if (val == 0)
return n - 1;
--
2.19.1
^ permalink raw reply related [flat|nested] 113+ messages in thread* [PATCH 3.18 002/108] ARM: 8808/1: kexec:offline panic_smp_self_stop CPU
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
2019-02-18 13:42 ` [PATCH 3.18 001/108] staging: iio: adc: ad7280a: handle error from __ad7280_read32() Greg Kroah-Hartman
@ 2019-02-18 13:42 ` Greg Kroah-Hartman
2019-02-18 13:42 ` [PATCH 3.18 003/108] dlm: Dont swamp the CPU with callbacks queued during recovery Greg Kroah-Hartman
` (108 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:42 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Yufen Wang, Russell King, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 82c08c3e7f171aa7f579b231d0abbc1d62e91974 ]
In case panic() and panic() called at the same time on different CPUS.
For example:
CPU 0:
panic()
__crash_kexec
machine_crash_shutdown
crash_smp_send_stop
machine_kexec
BUG_ON(num_online_cpus() > 1);
CPU 1:
panic()
local_irq_disable
panic_smp_self_stop
If CPU 1 calls panic_smp_self_stop() before crash_smp_send_stop(), kdump
fails. CPU1 can't receive the ipi irq, CPU1 will be always online.
To fix this problem, this patch split out the panic_smp_self_stop()
and add set_cpu_online(smp_processor_id(), false).
Signed-off-by: Yufen Wang <wangyufen@huawei.com>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/kernel/smp.c | 15 +++++++++++++++
1 file changed, 15 insertions(+)
diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c
index a8e32aaf0383..bae65844ff03 100644
--- a/arch/arm/kernel/smp.c
+++ b/arch/arm/kernel/smp.c
@@ -658,6 +658,21 @@ void smp_send_stop(void)
pr_warn("SMP: failed to stop secondary CPUs\n");
}
+/* In case panic() and panic() called at the same time on CPU1 and CPU2,
+ * and CPU 1 calls panic_smp_self_stop() before crash_smp_send_stop()
+ * CPU1 can't receive the ipi irqs from CPU2, CPU1 will be always online,
+ * kdump fails. So split out the panic_smp_self_stop() and add
+ * set_cpu_online(smp_processor_id(), false).
+ */
+void panic_smp_self_stop(void)
+{
+ pr_debug("CPU %u will stop doing anything useful since another CPU has paniced\n",
+ smp_processor_id());
+ set_cpu_online(smp_processor_id(), false);
+ while (1)
+ cpu_relax();
+}
+
/*
* not supported here
*/
--
2.19.1
^ permalink raw reply related [flat|nested] 113+ messages in thread* [PATCH 3.18 003/108] dlm: Dont swamp the CPU with callbacks queued during recovery
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
2019-02-18 13:42 ` [PATCH 3.18 001/108] staging: iio: adc: ad7280a: handle error from __ad7280_read32() Greg Kroah-Hartman
2019-02-18 13:42 ` [PATCH 3.18 002/108] ARM: 8808/1: kexec:offline panic_smp_self_stop CPU Greg Kroah-Hartman
@ 2019-02-18 13:42 ` Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 3.18 004/108] x86/PCI: Fix Broadcom CNB20LE unintended sign extension (redux) Greg Kroah-Hartman
` (107 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:42 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Bob Peterson, David Teigland, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 216f0efd19b9cc32207934fd1b87a45f2c4c593e ]
Before this patch, recovery would cause all callbacks to be delayed,
put on a queue, and afterward they were all queued to the callback
work queue. This patch does the same thing, but occasionally takes
a break after 25 of them so it won't swamp the CPU at the expense
of other RT processes like corosync.
Signed-off-by: Bob Peterson <rpeterso@redhat.com>
Signed-off-by: David Teigland <teigland@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/dlm/ast.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/fs/dlm/ast.c b/fs/dlm/ast.c
index dcea1e37a1b7..f18619bc2e09 100644
--- a/fs/dlm/ast.c
+++ b/fs/dlm/ast.c
@@ -290,6 +290,8 @@ void dlm_callback_suspend(struct dlm_ls *ls)
flush_workqueue(ls->ls_callback_wq);
}
+#define MAX_CB_QUEUE 25
+
void dlm_callback_resume(struct dlm_ls *ls)
{
struct dlm_lkb *lkb, *safe;
@@ -300,15 +302,23 @@ void dlm_callback_resume(struct dlm_ls *ls)
if (!ls->ls_callback_wq)
return;
+more:
mutex_lock(&ls->ls_cb_mutex);
list_for_each_entry_safe(lkb, safe, &ls->ls_cb_delay, lkb_cb_list) {
list_del_init(&lkb->lkb_cb_list);
queue_work(ls->ls_callback_wq, &lkb->lkb_cb_work);
count++;
+ if (count == MAX_CB_QUEUE)
+ break;
}
mutex_unlock(&ls->ls_cb_mutex);
if (count)
log_rinfo(ls, "dlm_callback_resume %d", count);
+ if (count == MAX_CB_QUEUE) {
+ count = 0;
+ cond_resched();
+ goto more;
+ }
}
--
2.19.1
^ permalink raw reply related [flat|nested] 113+ messages in thread* [PATCH 3.18 004/108] x86/PCI: Fix Broadcom CNB20LE unintended sign extension (redux)
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (2 preceding siblings ...)
2019-02-18 13:42 ` [PATCH 3.18 003/108] dlm: Dont swamp the CPU with callbacks queued during recovery Greg Kroah-Hartman
@ 2019-02-18 13:43 ` Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 3.18 005/108] powerpc/pseries: add of_node_put() in dlpar_detach_node() Greg Kroah-Hartman
` (106 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:43 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Colin Ian King, Bjorn Helgaas, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 53bb565fc5439f2c8c57a786feea5946804aa3e9 ]
In the expression "word1 << 16", word1 starts as u16, but is promoted to a
signed int, then sign-extended to resource_size_t, which is probably not
what was intended. Cast to resource_size_t to avoid the sign extension.
This fixes an identical issue as fixed by commit 0b2d70764bb3 ("x86/PCI:
Fix Broadcom CNB20LE unintended sign extension") back in 2014.
Detected by CoverityScan, CID#138749, 138750 ("Unintended sign extension")
Fixes: 3f6ea84a3035 ("PCI: read memory ranges out of Broadcom CNB20LE host bridge")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Bjorn Helgaas <helgaas@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/pci/broadcom_bus.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/x86/pci/broadcom_bus.c b/arch/x86/pci/broadcom_bus.c
index 526536c81ddc..ca1e8e6dccc8 100644
--- a/arch/x86/pci/broadcom_bus.c
+++ b/arch/x86/pci/broadcom_bus.c
@@ -50,8 +50,8 @@ static void __init cnb20le_res(u8 bus, u8 slot, u8 func)
word1 = read_pci_config_16(bus, slot, func, 0xc0);
word2 = read_pci_config_16(bus, slot, func, 0xc2);
if (word1 != word2) {
- res.start = (word1 << 16) | 0x0000;
- res.end = (word2 << 16) | 0xffff;
+ res.start = ((resource_size_t) word1 << 16) | 0x0000;
+ res.end = ((resource_size_t) word2 << 16) | 0xffff;
res.flags = IORESOURCE_MEM;
update_res(info, res.start, res.end, res.flags, 0);
}
--
2.19.1
^ permalink raw reply related [flat|nested] 113+ messages in thread* [PATCH 3.18 005/108] powerpc/pseries: add of_node_put() in dlpar_detach_node()
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (3 preceding siblings ...)
2019-02-18 13:43 ` [PATCH 3.18 004/108] x86/PCI: Fix Broadcom CNB20LE unintended sign extension (redux) Greg Kroah-Hartman
@ 2019-02-18 13:43 ` Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 3.18 006/108] serial: fsl_lpuart: clear parity enable bit when disable parity Greg Kroah-Hartman
` (105 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:43 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alan Tull, Michael Ellerman,
Frank Rowand, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 5b3f5c408d8cc59b87e47f1ab9803dbd006e4a91 ]
The previous commit, "of: overlay: add missing of_node_get() in
__of_attach_node_sysfs" added a missing of_node_get() to
__of_attach_node_sysfs(). This results in a refcount imbalance
for nodes attached with dlpar_attach_node(). The calling sequence
from dlpar_attach_node() to __of_attach_node_sysfs() is:
dlpar_attach_node()
of_attach_node()
__of_attach_node_sysfs()
For more detailed description of the node refcount, see
commit 68baf692c435 ("powerpc/pseries: Fix of_node_put() underflow
during DLPAR remove").
Tested-by: Alan Tull <atull@kernel.org>
Acked-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Frank Rowand <frank.rowand@sony.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/platforms/pseries/dlpar.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/arch/powerpc/platforms/pseries/dlpar.c b/arch/powerpc/platforms/pseries/dlpar.c
index 80d175dca68e..85bd29475987 100644
--- a/arch/powerpc/platforms/pseries/dlpar.c
+++ b/arch/powerpc/platforms/pseries/dlpar.c
@@ -299,6 +299,8 @@ int dlpar_detach_node(struct device_node *dn)
if (rc)
return rc;
+ of_node_put(dn);
+
return 0;
}
--
2.19.1
^ permalink raw reply related [flat|nested] 113+ messages in thread* [PATCH 3.18 006/108] serial: fsl_lpuart: clear parity enable bit when disable parity
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (4 preceding siblings ...)
2019-02-18 13:43 ` [PATCH 3.18 005/108] powerpc/pseries: add of_node_put() in dlpar_detach_node() Greg Kroah-Hartman
@ 2019-02-18 13:43 ` Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 3.18 007/108] staging:iio:ad2s90: Make probe handle spi_setup failure Greg Kroah-Hartman
` (104 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:43 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Andy Duan,
Fabio Estevam, Uwe Kleine-König, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 397bd9211fe014b347ca8f95a8f4e1017bac1aeb ]
Current driver only enable parity enable bit and never clear it
when user set the termios. The fix clear the parity enable bit when
PARENB flag is not set in termios->c_cflag.
Cc: Lukas Wunner <lukas@wunner.de>
Signed-off-by: Andy Duan <fugang.duan@nxp.com>
Reviewed-by: Fabio Estevam <festevam@gmail.com>
Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/serial/fsl_lpuart.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
index 92b7a5bf7c4d..839e65da4d3f 100644
--- a/drivers/tty/serial/fsl_lpuart.c
+++ b/drivers/tty/serial/fsl_lpuart.c
@@ -1284,6 +1284,8 @@ lpuart_set_termios(struct uart_port *port, struct ktermios *termios,
else
cr1 &= ~UARTCR1_PT;
}
+ } else {
+ cr1 &= ~UARTCR1_PE;
}
/* ask the core to calculate the divisor */
@@ -1419,6 +1421,8 @@ lpuart32_set_termios(struct uart_port *port, struct ktermios *termios,
else
ctrl &= ~UARTCTRL_PT;
}
+ } else {
+ ctrl &= ~UARTCTRL_PE;
}
/* ask the core to calculate the divisor */
--
2.19.1
^ permalink raw reply related [flat|nested] 113+ messages in thread* [PATCH 3.18 007/108] staging:iio:ad2s90: Make probe handle spi_setup failure
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (5 preceding siblings ...)
2019-02-18 13:43 ` [PATCH 3.18 006/108] serial: fsl_lpuart: clear parity enable bit when disable parity Greg Kroah-Hartman
@ 2019-02-18 13:43 ` Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 3.18 008/108] staging: iio: ad7780: update voltage on read Greg Kroah-Hartman
` (103 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:43 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Matheus Tavares, Jonathan Cameron,
Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit b3a3eafeef769c6982e15f83631dcbf8d1794efb ]
Previously, ad2s90_probe ignored the return code from spi_setup, not
handling its possible failure. This patch makes ad2s90_probe check if
the code is an error code and, if so, do the following:
- Call dev_err with an appropriate error message.
- Return the spi_setup's error code.
Note: The 'return ret' statement could be out of the 'if' block, but
this whole block will be moved up in the function in the patch:
'staging:iio:ad2s90: Move device registration to the end of probe'.
Signed-off-by: Matheus Tavares <matheus.bernardino@usp.br>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/iio/resolver/ad2s90.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/staging/iio/resolver/ad2s90.c b/drivers/staging/iio/resolver/ad2s90.c
index e24c5890652f..c0cee97bd0f1 100644
--- a/drivers/staging/iio/resolver/ad2s90.c
+++ b/drivers/staging/iio/resolver/ad2s90.c
@@ -86,7 +86,12 @@ static int ad2s90_probe(struct spi_device *spi)
/* need 600ns between CS and the first falling edge of SCLK */
spi->max_speed_hz = 830000;
spi->mode = SPI_MODE_3;
- spi_setup(spi);
+ ret = spi_setup(spi);
+
+ if (ret < 0) {
+ dev_err(&spi->dev, "spi_setup failed!\n");
+ return ret;
+ }
return 0;
}
--
2.19.1
^ permalink raw reply related [flat|nested] 113+ messages in thread* [PATCH 3.18 008/108] staging: iio: ad7780: update voltage on read
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (6 preceding siblings ...)
2019-02-18 13:43 ` [PATCH 3.18 007/108] staging:iio:ad2s90: Make probe handle spi_setup failure Greg Kroah-Hartman
@ 2019-02-18 13:43 ` Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 3.18 009/108] ARM: OMAP2+: hwmod: Fix some section annotations Greg Kroah-Hartman
` (102 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:43 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Renato Lui Geh, Alexandru Ardelean,
Jonathan Cameron, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 336650c785b62c3bea7c8cf6061c933a90241f67 ]
The ad7780 driver previously did not read the correct device output, as
it read an outdated value set at initialization. It now updates its
voltage on read.
Signed-off-by: Renato Lui Geh <renatogeh@gmail.com>
Acked-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/iio/adc/ad7780.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/staging/iio/adc/ad7780.c b/drivers/staging/iio/adc/ad7780.c
index 273add3ed63f..5a3072740326 100644
--- a/drivers/staging/iio/adc/ad7780.c
+++ b/drivers/staging/iio/adc/ad7780.c
@@ -90,12 +90,16 @@ static int ad7780_read_raw(struct iio_dev *indio_dev,
long m)
{
struct ad7780_state *st = iio_priv(indio_dev);
+ int voltage_uv;
switch (m) {
case IIO_CHAN_INFO_RAW:
return ad_sigma_delta_single_conversion(indio_dev, chan, val);
case IIO_CHAN_INFO_SCALE:
- *val = st->int_vref_mv * st->gain;
+ voltage_uv = regulator_get_voltage(st->reg);
+ if (voltage_uv < 0)
+ return voltage_uv;
+ *val = (voltage_uv / 1000) * st->gain;
*val2 = chan->scan_type.realbits - 1;
return IIO_VAL_FRACTIONAL_LOG2;
case IIO_CHAN_INFO_OFFSET:
--
2.19.1
^ permalink raw reply related [flat|nested] 113+ messages in thread* [PATCH 3.18 009/108] ARM: OMAP2+: hwmod: Fix some section annotations
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (7 preceding siblings ...)
2019-02-18 13:43 ` [PATCH 3.18 008/108] staging: iio: ad7780: update voltage on read Greg Kroah-Hartman
@ 2019-02-18 13:43 ` Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 3.18 010/108] modpost: validate symbol names also in find_elf_symbol Greg Kroah-Hartman
` (101 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:43 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Nathan Chancellor, Tony Lindgren,
Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit c10b26abeb53cabc1e6271a167d3f3d396ce0218 ]
When building the kernel with Clang, the following section mismatch
warnings appears:
WARNING: vmlinux.o(.text+0x2d398): Section mismatch in reference from
the function _setup() to the function .init.text:_setup_iclk_autoidle()
The function _setup() references
the function __init _setup_iclk_autoidle().
This is often because _setup lacks a __init
annotation or the annotation of _setup_iclk_autoidle is wrong.
WARNING: vmlinux.o(.text+0x2d3a0): Section mismatch in reference from
the function _setup() to the function .init.text:_setup_reset()
The function _setup() references
the function __init _setup_reset().
This is often because _setup lacks a __init
annotation or the annotation of _setup_reset is wrong.
WARNING: vmlinux.o(.text+0x2d408): Section mismatch in reference from
the function _setup() to the function .init.text:_setup_postsetup()
The function _setup() references
the function __init _setup_postsetup().
This is often because _setup lacks a __init
annotation or the annotation of _setup_postsetup is wrong.
_setup is used in omap_hwmod_allocate_module, which isn't marked __init
and looks like it shouldn't be, meaning to fix these warnings, those
functions must be moved out of the init section, which this patch does.
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/mach-omap2/omap_hwmod.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c
index e67ffbc9ec40..0e17fa4ca419 100644
--- a/arch/arm/mach-omap2/omap_hwmod.c
+++ b/arch/arm/mach-omap2/omap_hwmod.c
@@ -2578,7 +2578,7 @@ static int __init _init(struct omap_hwmod *oh, void *data)
* a stub; implementing this properly requires iclk autoidle usecounting in
* the clock code. No return value.
*/
-static void __init _setup_iclk_autoidle(struct omap_hwmod *oh)
+static void _setup_iclk_autoidle(struct omap_hwmod *oh)
{
struct omap_hwmod_ocp_if *os;
struct list_head *p;
@@ -2613,7 +2613,7 @@ static void __init _setup_iclk_autoidle(struct omap_hwmod *oh)
* reset. Returns 0 upon success or a negative error code upon
* failure.
*/
-static int __init _setup_reset(struct omap_hwmod *oh)
+static int _setup_reset(struct omap_hwmod *oh)
{
int r;
@@ -2674,7 +2674,7 @@ static int __init _setup_reset(struct omap_hwmod *oh)
*
* No return value.
*/
-static void __init _setup_postsetup(struct omap_hwmod *oh)
+static void _setup_postsetup(struct omap_hwmod *oh)
{
u8 postsetup_state;
--
2.19.1
^ permalink raw reply related [flat|nested] 113+ messages in thread* [PATCH 3.18 010/108] modpost: validate symbol names also in find_elf_symbol
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (8 preceding siblings ...)
2019-02-18 13:43 ` [PATCH 3.18 009/108] ARM: OMAP2+: hwmod: Fix some section annotations Greg Kroah-Hartman
@ 2019-02-18 13:43 ` Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 3.18 011/108] perf tools: Add Hygon Dhyana support Greg Kroah-Hartman
` (100 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:43 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sami Tolvanen, Masahiro Yamada, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 5818c683a619c534c113e1f66d24f636defc29bc ]
If an ARM mapping symbol shares an address with a valid symbol,
find_elf_symbol can currently return the mapping symbol instead, as the
symbol is not validated. This can result in confusing warnings:
WARNING: vmlinux.o(.text+0x18f4028): Section mismatch in reference
from the function set_reset_devices() to the variable .init.text:$x.0
This change adds a call to is_valid_name to find_elf_symbol, similarly
to how it's already used in find_elf_symbol2.
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
scripts/mod/modpost.c | 50 ++++++++++++++++++++++---------------------
1 file changed, 26 insertions(+), 24 deletions(-)
diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
index 9c06b5d62e90..2ff9ed878f9d 100644
--- a/scripts/mod/modpost.c
+++ b/scripts/mod/modpost.c
@@ -1134,6 +1134,30 @@ static int secref_whitelist(const struct sectioncheck *mismatch,
return 1;
}
+static inline int is_arm_mapping_symbol(const char *str)
+{
+ return str[0] == '$' && strchr("axtd", str[1])
+ && (str[2] == '\0' || str[2] == '.');
+}
+
+/*
+ * If there's no name there, ignore it; likewise, ignore it if it's
+ * one of the magic symbols emitted used by current ARM tools.
+ *
+ * Otherwise if find_symbols_between() returns those symbols, they'll
+ * fail the whitelist tests and cause lots of false alarms ... fixable
+ * only by merging __exit and __init sections into __text, bloating
+ * the kernel (which is especially evil on embedded platforms).
+ */
+static inline int is_valid_name(struct elf_info *elf, Elf_Sym *sym)
+{
+ const char *name = elf->strtab + sym->st_name;
+
+ if (!name || !strlen(name))
+ return 0;
+ return !is_arm_mapping_symbol(name);
+}
+
/**
* Find symbol based on relocation record info.
* In some cases the symbol supplied is a valid symbol so
@@ -1159,6 +1183,8 @@ static Elf_Sym *find_elf_symbol(struct elf_info *elf, Elf64_Sword addr,
continue;
if (ELF_ST_TYPE(sym->st_info) == STT_SECTION)
continue;
+ if (!is_valid_name(elf, sym))
+ continue;
if (sym->st_value == addr)
return sym;
/* Find a symbol nearby - addr are maybe negative */
@@ -1177,30 +1203,6 @@ static Elf_Sym *find_elf_symbol(struct elf_info *elf, Elf64_Sword addr,
return NULL;
}
-static inline int is_arm_mapping_symbol(const char *str)
-{
- return str[0] == '$' && strchr("axtd", str[1])
- && (str[2] == '\0' || str[2] == '.');
-}
-
-/*
- * If there's no name there, ignore it; likewise, ignore it if it's
- * one of the magic symbols emitted used by current ARM tools.
- *
- * Otherwise if find_symbols_between() returns those symbols, they'll
- * fail the whitelist tests and cause lots of false alarms ... fixable
- * only by merging __exit and __init sections into __text, bloating
- * the kernel (which is especially evil on embedded platforms).
- */
-static inline int is_valid_name(struct elf_info *elf, Elf_Sym *sym)
-{
- const char *name = elf->strtab + sym->st_name;
-
- if (!name || !strlen(name))
- return 0;
- return !is_arm_mapping_symbol(name);
-}
-
/*
* Find symbols before or equal addr and after addr - in the section sec.
* If we find two symbols with equal offset prefer one with a valid name.
--
2.19.1
^ permalink raw reply related [flat|nested] 113+ messages in thread* [PATCH 3.18 011/108] perf tools: Add Hygon Dhyana support
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (9 preceding siblings ...)
2019-02-18 13:43 ` [PATCH 3.18 010/108] modpost: validate symbol names also in find_elf_symbol Greg Kroah-Hartman
@ 2019-02-18 13:43 ` Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 3.18 012/108] soc/tegra: Dont leak device tree node reference Greg Kroah-Hartman
` (99 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:43 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Pu Wen, Borislav Petkov,
Alexander Shishkin, Jiri Olsa, Namhyung Kim, Peter Zijlstra,
Thomas Gleixner, Arnaldo Carvalho de Melo, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 4787eff3fa88f62fede6ed7afa06477ae6bf984d ]
The tool perf is useful for the performance analysis on the Hygon Dhyana
platform. But right now there is no Hygon support for it to analyze the
KVM guest os data. So add Hygon Dhyana support to it by checking vendor
string to share the code path of AMD.
Signed-off-by: Pu Wen <puwen@hygon.cn>
Acked-by: Borislav Petkov <bp@suse.de>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/1542008451-31735-1-git-send-email-puwen@hygon.cn
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/arch/x86/util/kvm-stat.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/perf/arch/x86/util/kvm-stat.c b/tools/perf/arch/x86/util/kvm-stat.c
index 14e4e668fad7..f97696a418cc 100644
--- a/tools/perf/arch/x86/util/kvm-stat.c
+++ b/tools/perf/arch/x86/util/kvm-stat.c
@@ -146,7 +146,7 @@ int cpu_isa_init(struct perf_kvm_stat *kvm, const char *cpuid)
if (strstr(cpuid, "Intel")) {
kvm->exit_reasons = vmx_exit_reasons;
kvm->exit_reasons_isa = "VMX";
- } else if (strstr(cpuid, "AMD")) {
+ } else if (strstr(cpuid, "AMD") || strstr(cpuid, "Hygon")) {
kvm->exit_reasons = svm_exit_reasons;
kvm->exit_reasons_isa = "SVM";
} else
--
2.19.1
^ permalink raw reply related [flat|nested] 113+ messages in thread* [PATCH 3.18 012/108] soc/tegra: Dont leak device tree node reference
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (10 preceding siblings ...)
2019-02-18 13:43 ` [PATCH 3.18 011/108] perf tools: Add Hygon Dhyana support Greg Kroah-Hartman
@ 2019-02-18 13:43 ` Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 3.18 013/108] f2fs: move dir data flush to write checkpoint process Greg Kroah-Hartman
` (98 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:43 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Yangtao Li, Jon Hunter,
Thierry Reding, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 9eb40fa2cd2d1f6829e7b49bb22692f754b9cfe0 ]
of_find_node_by_path() acquires a reference to the node returned by it
and that reference needs to be dropped by its caller. soc_is_tegra()
doesn't do that, so fix it.
Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
Acked-by: Jon Hunter <jonathanh@nvidia.com>
[treding: slightly rewrite to avoid inline comparison]
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/tegra/common.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/soc/tegra/common.c b/drivers/soc/tegra/common.c
index a71cb74f3674..04323ade15dd 100644
--- a/drivers/soc/tegra/common.c
+++ b/drivers/soc/tegra/common.c
@@ -20,11 +20,15 @@ static const struct of_device_id tegra_machine_match[] = {
bool soc_is_tegra(void)
{
+ const struct of_device_id *match;
struct device_node *root;
root = of_find_node_by_path("/");
if (!root)
return false;
- return of_match_node(tegra_machine_match, root) != NULL;
+ match = of_match_node(tegra_machine_match, root);
+ of_node_put(root);
+
+ return match != NULL;
}
--
2.19.1
^ permalink raw reply related [flat|nested] 113+ messages in thread* [PATCH 3.18 013/108] f2fs: move dir data flush to write checkpoint process
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (11 preceding siblings ...)
2019-02-18 13:43 ` [PATCH 3.18 012/108] soc/tegra: Dont leak device tree node reference Greg Kroah-Hartman
@ 2019-02-18 13:43 ` Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 3.18 014/108] nfsd4: fix crash on writing v4_end_grace before nfsd startup Greg Kroah-Hartman
` (97 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:43 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Yunlei He, Jaegeuk Kim, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit b61ac5b720146c619c7cdf17eff2551b934399e5 ]
This patch move dir data flush to write checkpoint process, by
doing this, it may reduce some time for dir fsync.
pre:
-f2fs_do_sync_file enter
-file_write_and_wait_range <- flush & wait
-write_checkpoint
-do_checkpoint <- wait all
-f2fs_do_sync_file exit
now:
-f2fs_do_sync_file enter
-write_checkpoint
-block_operations <- flush dir & no wait
-do_checkpoint <- wait all
-f2fs_do_sync_file exit
Signed-off-by: Yunlei He <heyunlei@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/file.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
index 8e68bb64f835..c4ba75acc6e2 100644
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -153,6 +153,9 @@ int f2fs_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
trace_f2fs_sync_file_enter(inode);
+ if (S_ISDIR(inode->i_mode))
+ goto go_write;
+
/* if fdatasync is triggered, let's do in-place-update */
if (get_dirty_pages(inode) <= SM_I(sbi)->min_fsync_blocks)
set_inode_flag(fi, FI_NEED_IPU);
--
2.19.1
^ permalink raw reply related [flat|nested] 113+ messages in thread* [PATCH 3.18 014/108] nfsd4: fix crash on writing v4_end_grace before nfsd startup
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (12 preceding siblings ...)
2019-02-18 13:43 ` [PATCH 3.18 013/108] f2fs: move dir data flush to write checkpoint process Greg Kroah-Hartman
@ 2019-02-18 13:43 ` Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 3.18 015/108] arm64: ftrace: dont adjust the LR value Greg Kroah-Hartman
` (96 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:43 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Anatoly Trosinenko, J. Bruce Fields,
Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 62a063b8e7d1db684db3f207261a466fa3194e72 ]
Anatoly Trosinenko reports that this:
1) Checkout fresh master Linux branch (tested with commit e195ca6cb)
2) Copy x84_64-config-4.14 to .config, then enable NFS server v4 and build
3) From `kvm-xfstests shell`:
results in NULL dereference in locks_end_grace.
Check that nfsd has been started before trying to end the grace period.
Reported-by: Anatoly Trosinenko <anatoly.trosinenko@gmail.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfsd/nfsctl.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
index ca73ca79a0ee..0e8574af298b 100644
--- a/fs/nfsd/nfsctl.c
+++ b/fs/nfsd/nfsctl.c
@@ -1110,6 +1110,8 @@ static ssize_t write_v4_end_grace(struct file *file, char *buf, size_t size)
case 'Y':
case 'y':
case '1':
+ if (nn->nfsd_serv)
+ return -EBUSY;
nfsd4_end_grace(nn);
break;
default:
--
2.19.1
^ permalink raw reply related [flat|nested] 113+ messages in thread* [PATCH 3.18 015/108] arm64: ftrace: dont adjust the LR value
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (13 preceding siblings ...)
2019-02-18 13:43 ` [PATCH 3.18 014/108] nfsd4: fix crash on writing v4_end_grace before nfsd startup Greg Kroah-Hartman
@ 2019-02-18 13:43 ` Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 3.18 016/108] media: DaVinci-VPBE: fix error handling in vpbe_initialize() Greg Kroah-Hartman
` (95 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:43 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mark Rutland, AKASHI Takahiro,
Ard Biesheuvel, Catalin Marinas, Torsten Duwe, Will Deacon,
Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 6e803e2e6e367db9a0d6ecae1bd24bb5752011bd ]
The core ftrace code requires that when it is handed the PC of an
instrumented function, this PC is the address of the instrumented
instruction. This is necessary so that the core ftrace code can identify
the specific instrumentation site. Since the instrumented function will
be a BL, the address of the instrumented function is LR - 4 at entry to
the ftrace code.
This fixup is applied in the mcount_get_pc and mcount_get_pc0 helpers,
which acquire the PC of the instrumented function.
The mcount_get_lr helper is used to acquire the LR of the instrumented
function, whose value does not require this adjustment, and cannot be
adjusted to anything meaningful. No adjustment of this value is made on
other architectures, including arm. However, arm64 adjusts this value by
4.
This patch brings arm64 in line with other architectures and removes the
adjustment of the LR value.
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Cc: AKASHI Takahiro <takahiro.akashi@linaro.org>
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Torsten Duwe <duwe@suse.de>
Cc: Will Deacon <will.deacon@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/kernel/entry-ftrace.S | 1 -
1 file changed, 1 deletion(-)
diff --git a/arch/arm64/kernel/entry-ftrace.S b/arch/arm64/kernel/entry-ftrace.S
index c85a02b6cca0..b3fdbba80d4b 100644
--- a/arch/arm64/kernel/entry-ftrace.S
+++ b/arch/arm64/kernel/entry-ftrace.S
@@ -78,7 +78,6 @@
.macro mcount_get_lr reg
ldr \reg, [x29]
ldr \reg, [\reg, #8]
- mcount_adjust_addr \reg, \reg
.endm
.macro mcount_get_lr_addr reg
--
2.19.1
^ permalink raw reply related [flat|nested] 113+ messages in thread* [PATCH 3.18 016/108] media: DaVinci-VPBE: fix error handling in vpbe_initialize()
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (14 preceding siblings ...)
2019-02-18 13:43 ` [PATCH 3.18 015/108] arm64: ftrace: dont adjust the LR value Greg Kroah-Hartman
@ 2019-02-18 13:43 ` Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 3.18 017/108] smack: fix access permissions for keyring Greg Kroah-Hartman
` (94 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:43 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alexey Khoroshilov, Hans Verkuil,
Mauro Carvalho Chehab, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit aa35dc3c71950e3fec3e230c06c27c0fbd0067f8 ]
If vpbe_set_default_output() or vpbe_set_default_mode() fails,
vpbe_initialize() returns error code without releasing resources.
The patch adds error handling for that case.
Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/davinci/vpbe.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/media/platform/davinci/vpbe.c b/drivers/media/platform/davinci/vpbe.c
index 33b9660b7f77..40d462cac5ec 100644
--- a/drivers/media/platform/davinci/vpbe.c
+++ b/drivers/media/platform/davinci/vpbe.c
@@ -740,7 +740,7 @@ static int vpbe_initialize(struct device *dev, struct vpbe_device *vpbe_dev)
if (ret) {
v4l2_err(&vpbe_dev->v4l2_dev, "Failed to set default output %s",
def_output);
- return ret;
+ goto fail_kfree_amp;
}
printk(KERN_NOTICE "Setting default mode to %s\n", def_mode);
@@ -748,12 +748,15 @@ static int vpbe_initialize(struct device *dev, struct vpbe_device *vpbe_dev)
if (ret) {
v4l2_err(&vpbe_dev->v4l2_dev, "Failed to set default mode %s",
def_mode);
- return ret;
+ goto fail_kfree_amp;
}
vpbe_dev->initialized = 1;
/* TBD handling of bootargs for default output and mode */
return 0;
+fail_kfree_amp:
+ mutex_lock(&vpbe_dev->lock);
+ kfree(vpbe_dev->amp);
fail_kfree_encoders:
kfree(vpbe_dev->encoders);
fail_dev_unregister:
--
2.19.1
^ permalink raw reply related [flat|nested] 113+ messages in thread* [PATCH 3.18 017/108] smack: fix access permissions for keyring
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (15 preceding siblings ...)
2019-02-18 13:43 ` [PATCH 3.18 016/108] media: DaVinci-VPBE: fix error handling in vpbe_initialize() Greg Kroah-Hartman
@ 2019-02-18 13:43 ` Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 3.18 018/108] usb: hub: delay hub autosuspend if USB3 port is still link training Greg Kroah-Hartman
` (93 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:43 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Zoran Markovic, Casey Schaufler,
James Morris, Serge E. Hallyn, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 5b841bfab695e3b8ae793172a9ff7990f99cc3e2 ]
Function smack_key_permission() only issues smack requests for the
following operations:
- KEY_NEED_READ (issues MAY_READ)
- KEY_NEED_WRITE (issues MAY_WRITE)
- KEY_NEED_LINK (issues MAY_WRITE)
- KEY_NEED_SETATTR (issues MAY_WRITE)
A blank smack request is issued in all other cases, resulting in
smack access being granted if there is any rule defined between
subject and object, or denied with -EACCES otherwise.
Request MAY_READ access for KEY_NEED_SEARCH and KEY_NEED_VIEW.
Fix the logic in the unlikely case when both MAY_READ and
MAY_WRITE are needed. Validate access permission field for valid
contents.
Signed-off-by: Zoran Markovic <zmarkovic@sierrawireless.com>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Cc: Casey Schaufler <casey@schaufler-ca.com>
Cc: James Morris <jmorris@namei.org>
Cc: "Serge E. Hallyn" <serge@hallyn.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/smack/smack_lsm.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 59350f6b7e8d..e36976ed38e4 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -3847,6 +3847,12 @@ static int smack_key_permission(key_ref_t key_ref,
int request = 0;
int rc;
+ /*
+ * Validate requested permissions
+ */
+ if (perm & ~KEY_NEED_ALL)
+ return -EINVAL;
+
keyp = key_ref_to_ptr(key_ref);
if (keyp == NULL)
return -EINVAL;
@@ -3866,10 +3872,10 @@ static int smack_key_permission(key_ref_t key_ref,
ad.a.u.key_struct.key = keyp->serial;
ad.a.u.key_struct.key_desc = keyp->description;
#endif
- if (perm & KEY_NEED_READ)
- request = MAY_READ;
+ if (perm & (KEY_NEED_READ | KEY_NEED_SEARCH | KEY_NEED_VIEW))
+ request |= MAY_READ;
if (perm & (KEY_NEED_WRITE | KEY_NEED_LINK | KEY_NEED_SETATTR))
- request = MAY_WRITE;
+ request |= MAY_WRITE;
rc = smk_access(tkp, keyp->security, request, &ad);
rc = smk_bu_note("key access", tkp, keyp->security, request, rc);
return rc;
--
2.19.1
^ permalink raw reply related [flat|nested] 113+ messages in thread* [PATCH 3.18 018/108] usb: hub: delay hub autosuspend if USB3 port is still link training
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (16 preceding siblings ...)
2019-02-18 13:43 ` [PATCH 3.18 017/108] smack: fix access permissions for keyring Greg Kroah-Hartman
@ 2019-02-18 13:43 ` Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 3.18 019/108] timekeeping: Use proper seqcount initializer Greg Kroah-Hartman
` (92 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:43 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mathias Nyman, Alan Stern, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit e86108940e541febf35813402ff29fa6f4a9ac0b ]
When initializing a hub we want to give a USB3 port in link training
the same debounce delay time before autosuspening the hub as already
trained, connected enabled ports.
USB3 ports won't reach the enabled state with "current connect status" and
"connect status change" bits set until the USB3 link training finishes.
Catching the port in link training (polling) and adding the debounce delay
prevents unnecessary failed attempts to autosuspend the hub.
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/core/hub.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 19cc2c03906d..adf8dea1f6f3 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -1117,6 +1117,16 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
USB_PORT_FEAT_ENABLE);
}
+ /*
+ * Add debounce if USB3 link is in polling/link training state.
+ * Link will automatically transition to Enabled state after
+ * link training completes.
+ */
+ if (hub_is_superspeed(hdev) &&
+ ((portstatus & USB_PORT_STAT_LINK_STATE) ==
+ USB_SS_PORT_LS_POLLING))
+ need_debounce_delay = true;
+
/* Clear status-change flags; we'll debounce later */
if (portchange & USB_PORT_STAT_C_CONNECTION) {
need_debounce_delay = true;
--
2.19.1
^ permalink raw reply related [flat|nested] 113+ messages in thread* [PATCH 3.18 019/108] timekeeping: Use proper seqcount initializer
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (17 preceding siblings ...)
2019-02-18 13:43 ` [PATCH 3.18 018/108] usb: hub: delay hub autosuspend if USB3 port is still link training Greg Kroah-Hartman
@ 2019-02-18 13:43 ` Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 3.18 020/108] ARM: dts: Fix OMAP4430 SDP Ethernet startup Greg Kroah-Hartman
` (91 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:43 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Bart Van Assche, Thomas Gleixner,
peterz, tj, johannes.berg, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit ce10a5b3954f2514af726beb78ed8d7350c5e41c ]
tk_core.seq is initialized open coded, but that misses to initialize the
lockdep map when lockdep is enabled. Lockdep splats involving tk_core seq
consequently lack a name and are hard to read.
Use the proper initializer which takes care of the lockdep map
initialization.
[ tglx: Massaged changelog ]
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: peterz@infradead.org
Cc: tj@kernel.org
Cc: johannes.berg@intel.com
Link: https://lkml.kernel.org/r/20181128234325.110011-12-bvanassche@acm.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/time/timekeeping.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
index 70e3e6ae06d2..05397615d048 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -39,7 +39,9 @@
static struct {
seqcount_t seq;
struct timekeeper timekeeper;
-} tk_core ____cacheline_aligned;
+} tk_core ____cacheline_aligned = {
+ .seq = SEQCNT_ZERO(tk_core.seq),
+};
static DEFINE_RAW_SPINLOCK(timekeeper_lock);
static struct timekeeper shadow_timekeeper;
--
2.19.1
^ permalink raw reply related [flat|nested] 113+ messages in thread* [PATCH 3.18 020/108] ARM: dts: Fix OMAP4430 SDP Ethernet startup
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (18 preceding siblings ...)
2019-02-18 13:43 ` [PATCH 3.18 019/108] timekeeping: Use proper seqcount initializer Greg Kroah-Hartman
@ 2019-02-18 13:43 ` Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 3.18 021/108] mips: bpf: fix encoding bug for mm_srlv32_op Greg Kroah-Hartman
` (90 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:43 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Russell King, Peter Ujfalusi,
Tony Lindgren, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 84fb6c7feb1494ebb7d1ec8b95cfb7ada0264465 ]
It was noticed that unbinding and rebinding the KSZ8851 ethernet
resulted in the driver reporting "failed to read device ID" at probe.
Probing the reset line with a 'scope while repeatedly attempting to
bind the driver in a shell loop revealed that the KSZ8851 RSTN pin is
constantly held at zero, meaning the device is held in reset, and
does not respond on the SPI bus.
Experimentation with the startup delay on the regulator set to 50ms
shows that the reset is positively released after 20ms.
Schematics for this board are not available, and the traces are buried
in the inner layers of the board which makes tracing where the RSTN pin
extremely difficult. We can only guess that the RSTN pin is wired to a
reset generator chip driven off the ethernet supply, which fits the
observed behaviour.
Include this delay in the regulator startup delay - effectively
treating the reset as a "supply stable" indicator.
This can not be modelled as a delay in the KSZ8851 driver since the
reset generation is board specific - if the RSTN pin had been wired to
a GPIO, reset could be released earlier via the already provided support
in the KSZ8851 driver.
This also got confirmed by Peter Ujfalusi <peter.ujfalusi@ti.com> based
on Blaze schematics that should be very close to SDP4430:
TPS22902YFPR is used as the regulator switch (gpio48 controlled):
Convert arm boot_lock to raw The VOUT is routed to TPS3808G01DBV.
(SCH Note: Threshold set at 90%. Vsense: 0.405V).
According to the TPS3808 data sheet the RESET delay time when Ct is
open (this is the case in the schema): MIN/TYP/MAX: 12/20/28 ms.
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Reviewed-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
[tony@atomide.com: updated with notes from schematics from Peter]
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/omap4-sdp.dts | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/arm/boot/dts/omap4-sdp.dts b/arch/arm/boot/dts/omap4-sdp.dts
index 3e1da43068f6..4669854614c3 100644
--- a/arch/arm/boot/dts/omap4-sdp.dts
+++ b/arch/arm/boot/dts/omap4-sdp.dts
@@ -33,6 +33,7 @@
gpio = <&gpio2 16 0>; /* gpio line 48 */
enable-active-high;
regulator-boot-on;
+ startup-delay-us = <25000>;
};
vbat: fixedregulator-vbat {
--
2.19.1
^ permalink raw reply related [flat|nested] 113+ messages in thread* [PATCH 3.18 021/108] mips: bpf: fix encoding bug for mm_srlv32_op
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (19 preceding siblings ...)
2019-02-18 13:43 ` [PATCH 3.18 020/108] ARM: dts: Fix OMAP4430 SDP Ethernet startup Greg Kroah-Hartman
@ 2019-02-18 13:43 ` Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 3.18 022/108] sata_rcar: fix deferred probing Greg Kroah-Hartman
` (89 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:43 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Markos Chandras, Paul Burton,
linux-mips, Jakub Kicinski, Song Liu, Jiong Wang,
Alexei Starovoitov, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 17f6c83fb5ebf7db4fcc94a5be4c22d5a7bfe428 ]
For micro-mips, srlv inside POOL32A encoding space should use 0x50
sub-opcode, NOT 0x90.
Some early version ISA doc describes the encoding as 0x90 for both srlv and
srav, this looks to me was a typo. I checked Binutils libopcode
implementation which is using 0x50 for srlv and 0x90 for srav.
v1->v2:
- Keep mm_srlv32_op sorted by value.
Fixes: f31318fdf324 ("MIPS: uasm: Add srlv uasm instruction")
Cc: Markos Chandras <markos.chandras@imgtec.com>
Cc: Paul Burton <paul.burton@mips.com>
Cc: linux-mips@vger.kernel.org
Acked-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Acked-by: Song Liu <songliubraving@fb.com>
Signed-off-by: Jiong Wang <jiong.wang@netronome.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/include/uapi/asm/inst.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/mips/include/uapi/asm/inst.h b/arch/mips/include/uapi/asm/inst.h
index 4bfdb9d4c186..3eb4d6177266 100644
--- a/arch/mips/include/uapi/asm/inst.h
+++ b/arch/mips/include/uapi/asm/inst.h
@@ -262,8 +262,8 @@ enum mm_32a_minor_op {
mm_ext_op = 0x02c,
mm_pool32axf_op = 0x03c,
mm_srl32_op = 0x040,
+ mm_srlv32_op = 0x050,
mm_sra_op = 0x080,
- mm_srlv32_op = 0x090,
mm_rotr_op = 0x0c0,
mm_lwxs_op = 0x118,
mm_addu32_op = 0x150,
--
2.19.1
^ permalink raw reply related [flat|nested] 113+ messages in thread* [PATCH 3.18 022/108] sata_rcar: fix deferred probing
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (20 preceding siblings ...)
2019-02-18 13:43 ` [PATCH 3.18 021/108] mips: bpf: fix encoding bug for mm_srlv32_op Greg Kroah-Hartman
@ 2019-02-18 13:43 ` Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 3.18 023/108] clk: imx6sl: ensure MMDC CH0 handshake is bypassed Greg Kroah-Hartman
` (88 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:43 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Simon Horman, Geert Uytterhoeven,
Sergei Shtylyov, Jens Axboe, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 9f83cfdb1ace3ef268ecc6fda50058d2ec37d603 ]
The driver overrides the error codes returned by platform_get_irq() to
-EINVAL, so if it returns -EPROBE_DEFER, the driver would fail the probe
permanently instead of the deferred probing. Switch to propagating the
error code upstream, still checking/overriding IRQ0 as libata regards it
as "no IRQ" (thus polling) anyway...
Fixes: 9ec36cafe43b ("of/irq: do irq resolution in platform_get_irq")
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ata/sata_rcar.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/ata/sata_rcar.c b/drivers/ata/sata_rcar.c
index ea1fbc1d4c5f..e7e259a6c732 100644
--- a/drivers/ata/sata_rcar.c
+++ b/drivers/ata/sata_rcar.c
@@ -879,7 +879,9 @@ static int sata_rcar_probe(struct platform_device *pdev)
int ret = 0;
irq = platform_get_irq(pdev, 0);
- if (irq <= 0)
+ if (irq < 0)
+ return irq;
+ if (!irq)
return -EINVAL;
priv = devm_kzalloc(&pdev->dev, sizeof(struct sata_rcar_priv),
--
2.19.1
^ permalink raw reply related [flat|nested] 113+ messages in thread* [PATCH 3.18 023/108] clk: imx6sl: ensure MMDC CH0 handshake is bypassed
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (21 preceding siblings ...)
2019-02-18 13:43 ` [PATCH 3.18 022/108] sata_rcar: fix deferred probing Greg Kroah-Hartman
@ 2019-02-18 13:43 ` Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 3.18 024/108] cpuidle: big.LITTLE: fix refcount leak Greg Kroah-Hartman
` (87 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:43 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Anson Huang, Stephen Boyd, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 0efcc2c0fd2001a83240a8c3d71f67770484917e ]
Same as other i.MX6 SoCs, ensure unused MMDC channel's
handshake is bypassed, this is to make sure no request
signal will be generated when periphe_clk_sel is changed
or SRC warm reset is triggered.
Signed-off-by: Anson Huang <Anson.Huang@nxp.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/mach-imx/clk-imx6sl.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/arch/arm/mach-imx/clk-imx6sl.c b/arch/arm/mach-imx/clk-imx6sl.c
index e982ebe10814..a99af8bd0571 100644
--- a/arch/arm/mach-imx/clk-imx6sl.c
+++ b/arch/arm/mach-imx/clk-imx6sl.c
@@ -18,6 +18,8 @@
#include "clk.h"
#include "common.h"
+#define CCDR 0x4
+#define BM_CCM_CCDR_MMDC_CH0_MASK (1 << 17)
#define CCSR 0xc
#define BM_CCSR_PLL1_SW_CLK_SEL (1 << 2)
#define CACRR 0x10
@@ -410,6 +412,10 @@ static void __init imx6sl_clocks_init(struct device_node *ccm_node)
clks[IMX6SL_CLK_USDHC3] = imx_clk_gate2("usdhc3", "usdhc3_podf", base + 0x80, 6);
clks[IMX6SL_CLK_USDHC4] = imx_clk_gate2("usdhc4", "usdhc4_podf", base + 0x80, 8);
+ /* Ensure the MMDC CH0 handshake is bypassed */
+ writel_relaxed(readl_relaxed(base + CCDR) |
+ BM_CCM_CCDR_MMDC_CH0_MASK, base + CCDR);
+
imx_check_clocks(clks, ARRAY_SIZE(clks));
clk_data.clks = clks;
--
2.19.1
^ permalink raw reply related [flat|nested] 113+ messages in thread* [PATCH 3.18 024/108] cpuidle: big.LITTLE: fix refcount leak
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (22 preceding siblings ...)
2019-02-18 13:43 ` [PATCH 3.18 023/108] clk: imx6sl: ensure MMDC CH0 handshake is bypassed Greg Kroah-Hartman
@ 2019-02-18 13:43 ` Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 3.18 025/108] udf: Fix BUG on corrupted inode Greg Kroah-Hartman
` (86 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:43 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Yangtao Li, Daniel Lezcano,
Rafael J. Wysocki, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 9456823c842f346c74265fcd98d008d87a7eb6f5 ]
of_find_node_by_path() acquires a reference to the node
returned by it and that reference needs to be dropped by its caller.
bl_idle_init() doesn't do that, so fix it.
Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
Acked-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cpuidle/cpuidle-big_little.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/cpuidle/cpuidle-big_little.c b/drivers/cpuidle/cpuidle-big_little.c
index fbc00a1d3c48..355dc3d9cb35 100644
--- a/drivers/cpuidle/cpuidle-big_little.c
+++ b/drivers/cpuidle/cpuidle-big_little.c
@@ -175,6 +175,7 @@ static int __init bl_idle_init(void)
{
int ret;
struct device_node *root = of_find_node_by_path("/");
+ const struct of_device_id *match_id;
if (!root)
return -ENODEV;
@@ -182,7 +183,11 @@ static int __init bl_idle_init(void)
/*
* Initialize the driver just for a compliant set of machines
*/
- if (!of_match_node(compatible_machine_match, root))
+ match_id = of_match_node(compatible_machine_match, root);
+
+ of_node_put(root);
+
+ if (!match_id)
return -ENODEV;
/*
* For now the differentiation between little and big cores
--
2.19.1
^ permalink raw reply related [flat|nested] 113+ messages in thread* [PATCH 3.18 025/108] udf: Fix BUG on corrupted inode
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (23 preceding siblings ...)
2019-02-18 13:43 ` [PATCH 3.18 024/108] cpuidle: big.LITTLE: fix refcount leak Greg Kroah-Hartman
@ 2019-02-18 13:43 ` Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 3.18 026/108] ARM: pxa: avoid section mismatch warning Greg Kroah-Hartman
` (85 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:43 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Anatoly Trosinenko, Jan Kara, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit d288d95842f1503414b7eebce3773bac3390457e ]
When inode is corrupted so that extent type is invalid, some functions
(such as udf_truncate_extents()) will just BUG. Check that extent type
is valid when loading the inode to memory.
Reported-by: Anatoly Trosinenko <anatoly.trosinenko@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/udf/inode.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/fs/udf/inode.c b/fs/udf/inode.c
index 0c1ca254d616..00c2caff1743 100644
--- a/fs/udf/inode.c
+++ b/fs/udf/inode.c
@@ -1366,6 +1366,12 @@ reread:
iinfo->i_alloc_type = le16_to_cpu(fe->icbTag.flags) &
ICBTAG_FLAG_AD_MASK;
+ if (iinfo->i_alloc_type != ICBTAG_FLAG_AD_SHORT &&
+ iinfo->i_alloc_type != ICBTAG_FLAG_AD_LONG &&
+ iinfo->i_alloc_type != ICBTAG_FLAG_AD_IN_ICB) {
+ ret = -EIO;
+ goto out;
+ }
iinfo->i_unique = 0;
iinfo->i_lenEAttr = 0;
iinfo->i_lenExtents = 0;
--
2.19.1
^ permalink raw reply related [flat|nested] 113+ messages in thread* [PATCH 3.18 026/108] ARM: pxa: avoid section mismatch warning
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (24 preceding siblings ...)
2019-02-18 13:43 ` [PATCH 3.18 025/108] udf: Fix BUG on corrupted inode Greg Kroah-Hartman
@ 2019-02-18 13:43 ` Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 3.18 027/108] ASoC: fsl: Fix SND_SOC_EUKREA_TLV320 build error on i.MX8M Greg Kroah-Hartman
` (84 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:43 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Olof Johansson, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 88af3209aa0881aa5ffd99664b6080a4be5f24e5 ]
WARNING: vmlinux.o(.text+0x19f90): Section mismatch in reference from the function littleton_init_lcd() to the function .init.text:pxa_set_fb_info()
The function littleton_init_lcd() references
the function __init pxa_set_fb_info().
This is often because littleton_init_lcd lacks a __init
annotation or the annotation of pxa_set_fb_info is wrong.
WARNING: vmlinux.o(.text+0xf824): Section mismatch in reference from the function zeus_register_ohci() to the function .init.text:pxa_set_ohci_info()
The function zeus_register_ohci() references
the function __init pxa_set_ohci_info().
This is often because zeus_register_ohci lacks a __init
annotation or the annotation of pxa_set_ohci_info is wrong.
WARNING: vmlinux.o(.text+0xf95c): Section mismatch in reference from the function cm_x300_init_u2d() to the function .init.text:pxa3xx_set_u2d_info()
The function cm_x300_init_u2d() references
the function __init pxa3xx_set_u2d_info().
This is often because cm_x300_init_u2d lacks a __init
annotation or the annotation of pxa3xx_set_u2d_info is wrong.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Olof Johansson <olof@lixom.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/mach-pxa/cm-x300.c | 2 +-
arch/arm/mach-pxa/littleton.c | 2 +-
arch/arm/mach-pxa/zeus.c | 2 +-
3 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/arch/arm/mach-pxa/cm-x300.c b/arch/arm/mach-pxa/cm-x300.c
index 4d3588d26c2a..8d44c3d7a750 100644
--- a/arch/arm/mach-pxa/cm-x300.c
+++ b/arch/arm/mach-pxa/cm-x300.c
@@ -542,7 +542,7 @@ static struct pxa3xx_u2d_platform_data cm_x300_u2d_platform_data = {
.exit = cm_x300_u2d_exit,
};
-static void cm_x300_init_u2d(void)
+static void __init cm_x300_init_u2d(void)
{
pxa3xx_set_u2d_info(&cm_x300_u2d_platform_data);
}
diff --git a/arch/arm/mach-pxa/littleton.c b/arch/arm/mach-pxa/littleton.c
index 5d665588c7eb..05aa7071efd6 100644
--- a/arch/arm/mach-pxa/littleton.c
+++ b/arch/arm/mach-pxa/littleton.c
@@ -183,7 +183,7 @@ static struct pxafb_mach_info littleton_lcd_info = {
.lcd_conn = LCD_COLOR_TFT_16BPP,
};
-static void littleton_init_lcd(void)
+static void __init littleton_init_lcd(void)
{
pxa_set_fb_info(NULL, &littleton_lcd_info);
}
diff --git a/arch/arm/mach-pxa/zeus.c b/arch/arm/mach-pxa/zeus.c
index 205f9bf3821e..cfb2851dc519 100644
--- a/arch/arm/mach-pxa/zeus.c
+++ b/arch/arm/mach-pxa/zeus.c
@@ -556,7 +556,7 @@ static struct pxaohci_platform_data zeus_ohci_platform_data = {
.flags = ENABLE_PORT_ALL | POWER_SENSE_LOW,
};
-static void zeus_register_ohci(void)
+static void __init zeus_register_ohci(void)
{
/* Port 2 is shared between host and client interface. */
UP2OCR = UP2OCR_HXOE | UP2OCR_HXS | UP2OCR_DMPDE | UP2OCR_DPPDE;
--
2.19.1
^ permalink raw reply related [flat|nested] 113+ messages in thread* [PATCH 3.18 027/108] ASoC: fsl: Fix SND_SOC_EUKREA_TLV320 build error on i.MX8M
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (25 preceding siblings ...)
2019-02-18 13:43 ` [PATCH 3.18 026/108] ARM: pxa: avoid section mismatch warning Greg Kroah-Hartman
@ 2019-02-18 13:43 ` Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 3.18 028/108] memstick: Prevent memstick host from getting runtime suspended during card detection Greg Kroah-Hartman
` (83 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:43 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, kbuild test robot, Fabio Estevam,
Shawn Guo, Mark Brown, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit add6883619a9e3bf9658eaff1a547354131bbcd9 ]
eukrea-tlv320.c machine driver runs on non-DT platforms
and include <asm/mach-types.h> header file in order to be able
to use some machine_is_eukrea_xxx() macros.
Building it for ARM64 causes the following build error:
sound/soc/fsl/eukrea-tlv320.c:28:10: fatal error: asm/mach-types.h: No such file or directory
Avoid this error by not allowing to build the SND_SOC_EUKREA_TLV320
driver when ARM64 is selected.
This is needed in preparation for the i.MX8M support.
Reported-by: kbuild test robot <lkp@intel.com>
Signed-off-by: Fabio Estevam <festevam@gmail.com>
Acked-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/fsl/Kconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/soc/fsl/Kconfig b/sound/soc/fsl/Kconfig
index 081e406b3713..009d1893901b 100644
--- a/sound/soc/fsl/Kconfig
+++ b/sound/soc/fsl/Kconfig
@@ -219,7 +219,7 @@ config SND_SOC_PHYCORE_AC97
config SND_SOC_EUKREA_TLV320
tristate "Eukrea TLV320"
- depends on ARCH_MXC && I2C
+ depends on ARCH_MXC && !ARM64 && I2C
select SND_SOC_TLV320AIC23_I2C
select SND_SOC_IMX_AUDMUX
select SND_SOC_IMX_SSI
--
2.19.1
^ permalink raw reply related [flat|nested] 113+ messages in thread* [PATCH 3.18 028/108] memstick: Prevent memstick host from getting runtime suspended during card detection
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (26 preceding siblings ...)
2019-02-18 13:43 ` [PATCH 3.18 027/108] ASoC: fsl: Fix SND_SOC_EUKREA_TLV320 build error on i.MX8M Greg Kroah-Hartman
@ 2019-02-18 13:43 ` Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 3.18 029/108] arm64: KVM: Skip MMIO insn after emulation Greg Kroah-Hartman
` (82 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:43 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Kai-Heng Feng, Oleksandr Natalenko,
Ulf Hansson, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit e03e303edf1c63e6dd455ccd568c74e93ef3ba8c ]
We can use MEMSTICK_POWER_{ON,OFF} along with pm_runtime_{get,put}
helpers to let memstick host support runtime pm.
The rpm count may go down to zero before the memstick host powers on, so
the host can be runtime suspended.
So before doing card detection, increment the rpm count to avoid the
host gets runtime suspended. Balance the rpm count after card detection
is done.
Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Tested-by: Oleksandr Natalenko <oleksandr@natalenko.name>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/memstick/core/memstick.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/memstick/core/memstick.c b/drivers/memstick/core/memstick.c
index a0547dbf9806..4d673a626db4 100644
--- a/drivers/memstick/core/memstick.c
+++ b/drivers/memstick/core/memstick.c
@@ -18,6 +18,7 @@
#include <linux/delay.h>
#include <linux/slab.h>
#include <linux/module.h>
+#include <linux/pm_runtime.h>
#define DRIVER_NAME "memstick"
@@ -436,6 +437,7 @@ static void memstick_check(struct work_struct *work)
struct memstick_dev *card;
dev_dbg(&host->dev, "memstick_check started\n");
+ pm_runtime_get_noresume(host->dev.parent);
mutex_lock(&host->lock);
if (!host->card) {
if (memstick_power_on(host))
@@ -479,6 +481,7 @@ out_power_off:
host->set_param(host, MEMSTICK_POWER, MEMSTICK_POWER_OFF);
mutex_unlock(&host->lock);
+ pm_runtime_put(host->dev.parent);
dev_dbg(&host->dev, "memstick_check finished\n");
}
--
2.19.1
^ permalink raw reply related [flat|nested] 113+ messages in thread* [PATCH 3.18 029/108] arm64: KVM: Skip MMIO insn after emulation
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (27 preceding siblings ...)
2019-02-18 13:43 ` [PATCH 3.18 028/108] memstick: Prevent memstick host from getting runtime suspended during card detection Greg Kroah-Hartman
@ 2019-02-18 13:43 ` Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 3.18 030/108] powerpc/uaccess: fix warning/error with access_ok() Greg Kroah-Hartman
` (81 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:43 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Peter Maydell, Alex Bennée,
Christoffer Dall, Mark Rutland, Marc Zyngier, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 0d640732dbebed0f10f18526de21652931f0b2f2 ]
When we emulate an MMIO instruction, we advance the CPU state within
decode_hsr(), before emulating the instruction effects.
Having this logic in decode_hsr() is opaque, and advancing the state
before emulation is problematic. It gets in the way of applying
consistent single-step logic, and it prevents us from being able to fail
an MMIO instruction with a synchronous exception.
Clean this up by only advancing the CPU state *after* the effects of the
instruction are emulated.
Cc: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Christoffer Dall <christoffer.dall@arm.com>
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/kvm/mmio.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/arch/arm/kvm/mmio.c b/arch/arm/kvm/mmio.c
index 4cb5a93182e9..c215bb4423ac 100644
--- a/arch/arm/kvm/mmio.c
+++ b/arch/arm/kvm/mmio.c
@@ -118,6 +118,12 @@ int kvm_handle_mmio_return(struct kvm_vcpu *vcpu, struct kvm_run *run)
*vcpu_reg(vcpu, vcpu->arch.mmio_decode.rt) = data;
}
+ /*
+ * The MMIO instruction is emulated and should not be re-executed
+ * in the guest.
+ */
+ kvm_skip_instr(vcpu, kvm_vcpu_trap_il_is32bit(vcpu));
+
return 0;
}
@@ -154,11 +160,6 @@ static int decode_hsr(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa,
vcpu->arch.mmio_decode.sign_extend = sign_extend;
vcpu->arch.mmio_decode.rt = rt;
- /*
- * The MMIO instruction is emulated and should not be re-executed
- * in the guest.
- */
- kvm_skip_instr(vcpu, kvm_vcpu_trap_il_is32bit(vcpu));
return 0;
}
--
2.19.1
^ permalink raw reply related [flat|nested] 113+ messages in thread* [PATCH 3.18 030/108] powerpc/uaccess: fix warning/error with access_ok()
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (28 preceding siblings ...)
2019-02-18 13:43 ` [PATCH 3.18 029/108] arm64: KVM: Skip MMIO insn after emulation Greg Kroah-Hartman
@ 2019-02-18 13:43 ` Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 3.18 031/108] xfrm6_tunnel: Fix spi check in __xfrm6_tunnel_alloc_spi Greg Kroah-Hartman
` (80 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:43 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Christophe Leroy, Michael Ellerman,
Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 05a4ab823983d9136a460b7b5e0d49ee709a6f86 ]
With the following piece of code, the following compilation warning
is encountered:
if (_IOC_DIR(ioc) != _IOC_NONE) {
int verify = _IOC_DIR(ioc) & _IOC_READ ? VERIFY_WRITE : VERIFY_READ;
if (!access_ok(verify, ioarg, _IOC_SIZE(ioc))) {
drivers/platform/test/dev.c: In function 'my_ioctl':
drivers/platform/test/dev.c:219:7: warning: unused variable 'verify' [-Wunused-variable]
int verify = _IOC_DIR(ioc) & _IOC_READ ? VERIFY_WRITE : VERIFY_READ;
This patch fixes it by referencing 'type' in the macro allthough
doing nothing with it.
Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/include/asm/uaccess.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/powerpc/include/asm/uaccess.h b/arch/powerpc/include/asm/uaccess.h
index 46c486599645..1bb8cc3fbbf1 100644
--- a/arch/powerpc/include/asm/uaccess.h
+++ b/arch/powerpc/include/asm/uaccess.h
@@ -59,7 +59,7 @@
#endif
#define access_ok(type, addr, size) \
- (__chk_user_ptr(addr), \
+ (__chk_user_ptr(addr), (void)(type), \
__access_ok((__force unsigned long)(addr), (size), get_fs()))
/*
--
2.19.1
^ permalink raw reply related [flat|nested] 113+ messages in thread* [PATCH 3.18 031/108] xfrm6_tunnel: Fix spi check in __xfrm6_tunnel_alloc_spi
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (29 preceding siblings ...)
2019-02-18 13:43 ` [PATCH 3.18 030/108] powerpc/uaccess: fix warning/error with access_ok() Greg Kroah-Hartman
@ 2019-02-18 13:43 ` Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 3.18 032/108] drbd: narrow rcu_read_lock in drbd_sync_handshake Greg Kroah-Hartman
` (79 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:43 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, YueHaibing, Steffen Klassert, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit fa89a4593b927b3f59c3b69379f31d3b22272e4e ]
gcc warn this:
net/ipv6/xfrm6_tunnel.c:143 __xfrm6_tunnel_alloc_spi() warn:
always true condition '(spi <= 4294967295) => (0-u32max <= u32max)'
'spi' is u32, which always not greater than XFRM6_TUNNEL_SPI_MAX
because of wrap around. So the second forloop will never reach.
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/xfrm6_tunnel.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/ipv6/xfrm6_tunnel.c b/net/ipv6/xfrm6_tunnel.c
index 5743044cd660..56b72cada346 100644
--- a/net/ipv6/xfrm6_tunnel.c
+++ b/net/ipv6/xfrm6_tunnel.c
@@ -144,6 +144,9 @@ static u32 __xfrm6_tunnel_alloc_spi(struct net *net, xfrm_address_t *saddr)
index = __xfrm6_tunnel_spi_check(net, spi);
if (index >= 0)
goto alloc_spi;
+
+ if (spi == XFRM6_TUNNEL_SPI_MAX)
+ break;
}
for (spi = XFRM6_TUNNEL_SPI_MIN; spi < xfrm6_tn->spi; spi++) {
index = __xfrm6_tunnel_spi_check(net, spi);
--
2.19.1
^ permalink raw reply related [flat|nested] 113+ messages in thread* [PATCH 3.18 032/108] drbd: narrow rcu_read_lock in drbd_sync_handshake
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (30 preceding siblings ...)
2019-02-18 13:43 ` [PATCH 3.18 031/108] xfrm6_tunnel: Fix spi check in __xfrm6_tunnel_alloc_spi Greg Kroah-Hartman
@ 2019-02-18 13:43 ` Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 3.18 033/108] drbd: disconnect, if the wrong UUIDs are attached on a connected peer Greg Kroah-Hartman
` (78 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:43 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jia-Ju Bai, Lars Ellenberg,
Roland Kammerer, Jens Axboe, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit d29e89e34952a9ad02c77109c71a80043544296e ]
So far there was the possibility that we called
genlmsg_new(GFP_NOIO)/mutex_lock() while holding an rcu_read_lock().
This included cases like:
drbd_sync_handshake (acquire the RCU lock)
drbd_asb_recover_1p
drbd_khelper
drbd_bcast_event
genlmsg_new(GFP_NOIO) --> may sleep
drbd_sync_handshake (acquire the RCU lock)
drbd_asb_recover_1p
drbd_khelper
notify_helper
genlmsg_new(GFP_NOIO) --> may sleep
drbd_sync_handshake (acquire the RCU lock)
drbd_asb_recover_1p
drbd_khelper
notify_helper
mutex_lock --> may sleep
While using GFP_ATOMIC whould have been possible in the first two cases,
the real fix is to narrow the rcu_read_lock.
Reported-by: Jia-Ju Bai <baijiaju1990@163.com>
Reviewed-by: Lars Ellenberg <lars.ellenberg@linbit.com>
Signed-off-by: Roland Kammerer <roland.kammerer@linbit.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/block/drbd/drbd_receiver.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c
index 6960fb064731..4f18ec5198fb 100644
--- a/drivers/block/drbd/drbd_receiver.c
+++ b/drivers/block/drbd/drbd_receiver.c
@@ -3125,7 +3125,7 @@ static enum drbd_conns drbd_sync_handshake(struct drbd_peer_device *peer_device,
enum drbd_conns rv = C_MASK;
enum drbd_disk_state mydisk;
struct net_conf *nc;
- int hg, rule_nr, rr_conflict, tentative;
+ int hg, rule_nr, rr_conflict, tentative, always_asbp;
mydisk = device->state.disk;
if (mydisk == D_NEGOTIATING)
@@ -3167,8 +3167,12 @@ static enum drbd_conns drbd_sync_handshake(struct drbd_peer_device *peer_device,
rcu_read_lock();
nc = rcu_dereference(peer_device->connection->net_conf);
+ always_asbp = nc->always_asbp;
+ rr_conflict = nc->rr_conflict;
+ tentative = nc->tentative;
+ rcu_read_unlock();
- if (hg == 100 || (hg == -100 && nc->always_asbp)) {
+ if (hg == 100 || (hg == -100 && always_asbp)) {
int pcount = (device->state.role == R_PRIMARY)
+ (peer_role == R_PRIMARY);
int forced = (hg == -100);
@@ -3207,9 +3211,6 @@ static enum drbd_conns drbd_sync_handshake(struct drbd_peer_device *peer_device,
"Sync from %s node\n",
(hg < 0) ? "peer" : "this");
}
- rr_conflict = nc->rr_conflict;
- tentative = nc->tentative;
- rcu_read_unlock();
if (hg == -100) {
/* FIXME this log message is not correct if we end up here
--
2.19.1
^ permalink raw reply related [flat|nested] 113+ messages in thread* [PATCH 3.18 033/108] drbd: disconnect, if the wrong UUIDs are attached on a connected peer
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (31 preceding siblings ...)
2019-02-18 13:43 ` [PATCH 3.18 032/108] drbd: narrow rcu_read_lock in drbd_sync_handshake Greg Kroah-Hartman
@ 2019-02-18 13:43 ` Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 3.18 034/108] drbd: skip spurious timeout (ping-timeo) when failing promote Greg Kroah-Hartman
` (77 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:43 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lars Ellenberg, Jens Axboe, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit b17b59602b6dcf8f97a7dc7bc489a48388d7063a ]
With "on-no-data-accessible suspend-io", DRBD requires the next attach
or connect to be to the very same data generation uuid tag it lost last.
If we first lost connection to the peer,
then later lost connection to our own disk,
we would usually refuse to re-connect to the peer,
because it presents the wrong data set.
However, if the peer first connects without a disk,
and then attached its disk, we accepted that same wrong data set,
which would be "unexpected" by any user of that DRBD
and cause "undefined results" (read: very likely data corruption).
The fix is to forcefully disconnect as soon as we notice that the peer
attached to the "wrong" dataset.
Signed-off-by: Lars Ellenberg <lars.ellenberg@linbit.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/block/drbd/drbd_receiver.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c
index 4f18ec5198fb..6b2b278bb2b7 100644
--- a/drivers/block/drbd/drbd_receiver.c
+++ b/drivers/block/drbd/drbd_receiver.c
@@ -3889,7 +3889,7 @@ static int receive_uuids(struct drbd_connection *connection, struct packet_info
kfree(device->p_uuid);
device->p_uuid = p_uuid;
- if (device->state.conn < C_CONNECTED &&
+ if ((device->state.conn < C_CONNECTED || device->state.pdsk == D_DISKLESS) &&
device->state.disk < D_INCONSISTENT &&
device->state.role == R_PRIMARY &&
(device->ed_uuid & ~((u64)1)) != (p_uuid[UI_CURRENT] & ~((u64)1))) {
--
2.19.1
^ permalink raw reply related [flat|nested] 113+ messages in thread* [PATCH 3.18 034/108] drbd: skip spurious timeout (ping-timeo) when failing promote
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (32 preceding siblings ...)
2019-02-18 13:43 ` [PATCH 3.18 033/108] drbd: disconnect, if the wrong UUIDs are attached on a connected peer Greg Kroah-Hartman
@ 2019-02-18 13:43 ` Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 3.18 035/108] drbd: Avoid Clang warning about pointless switch statment Greg Kroah-Hartman
` (76 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:43 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lars Ellenberg, Jens Axboe, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 9848b6ddd8c92305252f94592c5e278574e7a6ac ]
If you try to promote a Secondary while connected to a Primary
and allow-two-primaries is NOT set, we will wait for "ping-timeout"
to give this node a chance to detect a dead primary,
in case the cluster manager noticed faster than we did.
But if we then are *still* connected to a Primary,
we fail (after an additional timeout of ping-timout).
This change skips the spurious second timeout.
Most people won't notice really,
since "ping-timeout" by default is half a second.
But in some installations, ping-timeout may be 10 or 20 seconds or more,
and spuriously delaying the error return becomes annoying.
Signed-off-by: Lars Ellenberg <lars.ellenberg@linbit.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/block/drbd/drbd_nl.c | 15 ++++++++-------
1 file changed, 8 insertions(+), 7 deletions(-)
diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c
index 1cd47df44bda..591d309b005e 100644
--- a/drivers/block/drbd/drbd_nl.c
+++ b/drivers/block/drbd/drbd_nl.c
@@ -632,14 +632,15 @@ drbd_set_role(struct drbd_device *const device, enum drbd_role new_role, int for
if (rv == SS_TWO_PRIMARIES) {
/* Maybe the peer is detected as dead very soon...
retry at most once more in this case. */
- int timeo;
- rcu_read_lock();
- nc = rcu_dereference(connection->net_conf);
- timeo = nc ? (nc->ping_timeo + 1) * HZ / 10 : 1;
- rcu_read_unlock();
- schedule_timeout_interruptible(timeo);
- if (try < max_tries)
+ if (try < max_tries) {
+ int timeo;
try = max_tries - 1;
+ rcu_read_lock();
+ nc = rcu_dereference(connection->net_conf);
+ timeo = nc ? (nc->ping_timeo + 1) * HZ / 10 : 1;
+ rcu_read_unlock();
+ schedule_timeout_interruptible(timeo);
+ }
continue;
}
if (rv < SS_SUCCESS) {
--
2.19.1
^ permalink raw reply related [flat|nested] 113+ messages in thread* [PATCH 3.18 035/108] drbd: Avoid Clang warning about pointless switch statment
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (33 preceding siblings ...)
2019-02-18 13:43 ` [PATCH 3.18 034/108] drbd: skip spurious timeout (ping-timeo) when failing promote Greg Kroah-Hartman
@ 2019-02-18 13:43 ` Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 3.18 036/108] video: clps711x-fb: release disp device node in probe() Greg Kroah-Hartman
` (75 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:43 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lars Ellenberg, Nathan Chancellor,
Jens Axboe, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit a52c5a16cf19d8a85831bb1b915a221dd4ffae3c ]
There are several warnings from Clang about no case statement matching
the constant 0:
In file included from drivers/block/drbd/drbd_receiver.c:48:
In file included from drivers/block/drbd/drbd_int.h:48:
In file included from ./include/linux/drbd_genl_api.h:54:
In file included from ./include/linux/genl_magic_struct.h:236:
./include/linux/drbd_genl.h:321:1: warning: no case matching constant
switch condition '0'
GENL_struct(DRBD_NLA_HELPER, 24, drbd_helper_info,
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
./include/linux/genl_magic_struct.h:220:10: note: expanded from macro
'GENL_struct'
switch (0) {
^
Silence this warning by adding a 'case 0:' statement. Additionally,
adjust the alignment of the statements in the ct_assert_unique macro to
avoid a checkpatch warning.
This solution was originally sent by Arnd Bergmann with a default case
statement: https://lore.kernel.org/patchwork/patch/756723/
Link: https://github.com/ClangBuiltLinux/linux/issues/43
Suggested-by: Lars Ellenberg <lars.ellenberg@linbit.com>
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/genl_magic_struct.h | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/include/linux/genl_magic_struct.h b/include/linux/genl_magic_struct.h
index eecd19b37001..250e9be65e74 100644
--- a/include/linux/genl_magic_struct.h
+++ b/include/linux/genl_magic_struct.h
@@ -185,6 +185,7 @@ static inline void ct_assert_unique_operations(void)
{
switch (0) {
#include GENL_MAGIC_INCLUDE_FILE
+ case 0:
;
}
}
@@ -203,6 +204,7 @@ static inline void ct_assert_unique_top_level_attributes(void)
{
switch (0) {
#include GENL_MAGIC_INCLUDE_FILE
+ case 0:
;
}
}
@@ -212,7 +214,8 @@ static inline void ct_assert_unique_top_level_attributes(void)
static inline void ct_assert_unique_ ## s_name ## _attributes(void) \
{ \
switch (0) { \
- s_fields \
+ s_fields \
+ case 0: \
; \
} \
}
--
2.19.1
^ permalink raw reply related [flat|nested] 113+ messages in thread* [PATCH 3.18 036/108] video: clps711x-fb: release disp device node in probe()
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (34 preceding siblings ...)
2019-02-18 13:43 ` [PATCH 3.18 035/108] drbd: Avoid Clang warning about pointless switch statment Greg Kroah-Hartman
@ 2019-02-18 13:43 ` Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 3.18 037/108] fbdev: fbmem: behave better with small rotated displays and many CPUs Greg Kroah-Hartman
` (74 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:43 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alexey Khoroshilov, Alexander Shiyan,
Bartlomiej Zolnierkiewicz, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit fdac751355cd76e049f628afe6acb8ff4b1399f7 ]
clps711x_fb_probe() increments refcnt of disp device node by
of_parse_phandle() and leaves it undecremented on both
successful and error paths.
Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Cc: Alexander Shiyan <shc_work@mail.ru>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/video/fbdev/clps711x-fb.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/video/fbdev/clps711x-fb.c b/drivers/video/fbdev/clps711x-fb.c
index 49a7bb4ef02f..dd8fd28d6132 100644
--- a/drivers/video/fbdev/clps711x-fb.c
+++ b/drivers/video/fbdev/clps711x-fb.c
@@ -287,14 +287,17 @@ static int clps711x_fb_probe(struct platform_device *pdev)
}
ret = of_get_fb_videomode(disp, &cfb->mode, OF_USE_NATIVE_MODE);
- if (ret)
+ if (ret) {
+ of_node_put(disp);
goto out_fb_release;
+ }
of_property_read_u32(disp, "ac-prescale", &cfb->ac_prescale);
cfb->cmap_invert = of_property_read_bool(disp, "cmap-invert");
ret = of_property_read_u32(disp, "bits-per-pixel",
&info->var.bits_per_pixel);
+ of_node_put(disp);
if (ret)
goto out_fb_release;
--
2.19.1
^ permalink raw reply related [flat|nested] 113+ messages in thread* [PATCH 3.18 037/108] fbdev: fbmem: behave better with small rotated displays and many CPUs
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (35 preceding siblings ...)
2019-02-18 13:43 ` [PATCH 3.18 036/108] video: clps711x-fb: release disp device node in probe() Greg Kroah-Hartman
@ 2019-02-18 13:43 ` Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 3.18 038/108] igb: Fix an issue that PME is not enabled during runtime suspend Greg Kroah-Hartman
` (73 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:43 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Peter Rosin, Tomi Valkeinen,
Fabian Frederick, Geert Uytterhoeven, Geoff Levand,
James Simmons, Bartlomiej Zolnierkiewicz, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit f75df8d4b4fabfad7e3cba2debfad12741c6fde7 ]
Blitting an image with "negative" offsets is not working since there
is no clipping. It hopefully just crashes. For the bootup logo, there
is protection so that blitting does not happen as the image is drawn
further and further to the right (ROTATE_UR) or further and further
down (ROTATE_CW). There is however no protection when drawing in the
opposite directions (ROTATE_UD and ROTATE_CCW).
Add back this protection.
The regression is 20-odd years old but the mindless warning-killing
mentality displayed in commit 34bdb666f4b2 ("fbdev: fbmem: remove
positive test on unsigned values") is also to blame, methinks.
Fixes: 448d479747b8 ("fbdev: fb_do_show_logo() updates")
Signed-off-by: Peter Rosin <peda@axentia.se>
Cc: Tomi Valkeinen <tomi.valkeinen@ti.com>
Cc: Fabian Frederick <ffrederick@users.sourceforge.net>
Cc: Geert Uytterhoeven <geert+renesas@glider.be>
cc: Geoff Levand <geoff@infradead.org>
Cc: James Simmons <jsimmons@users.sf.net>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/video/fbdev/core/fbmem.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c
index 8a29ec5992fd..ea2bd6208a2f 100644
--- a/drivers/video/fbdev/core/fbmem.c
+++ b/drivers/video/fbdev/core/fbmem.c
@@ -433,7 +433,9 @@ static void fb_do_show_logo(struct fb_info *info, struct fb_image *image,
image->dx += image->width + 8;
}
} else if (rotate == FB_ROTATE_UD) {
- for (x = 0; x < num; x++) {
+ u32 dx = image->dx;
+
+ for (x = 0; x < num && image->dx <= dx; x++) {
info->fbops->fb_imageblit(info, image);
image->dx -= image->width + 8;
}
@@ -445,7 +447,9 @@ static void fb_do_show_logo(struct fb_info *info, struct fb_image *image,
image->dy += image->height + 8;
}
} else if (rotate == FB_ROTATE_CCW) {
- for (x = 0; x < num; x++) {
+ u32 dy = image->dy;
+
+ for (x = 0; x < num && image->dy <= dy; x++) {
info->fbops->fb_imageblit(info, image);
image->dy -= image->height + 8;
}
--
2.19.1
^ permalink raw reply related [flat|nested] 113+ messages in thread* [PATCH 3.18 038/108] igb: Fix an issue that PME is not enabled during runtime suspend
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (36 preceding siblings ...)
2019-02-18 13:43 ` [PATCH 3.18 037/108] fbdev: fbmem: behave better with small rotated displays and many CPUs Greg Kroah-Hartman
@ 2019-02-18 13:43 ` Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 3.18 039/108] fbdev: fbcon: Fix unregister crash when more than one framebuffer Greg Kroah-Hartman
` (72 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:43 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Kai-Heng Feng, Aaron Brown,
Jeff Kirsher, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 1fb3a7a75e2efcc83ef21f2434069cddd6fae6f5 ]
I210 ethernet card doesn't wakeup when a cable gets plugged. It's
because its PME is not set.
Since commit 42eca2302146 ("PCI: Don't touch card regs after runtime
suspend D3"), if the PCI state is saved, pci_pm_runtime_suspend() stops
calling pci_finish_runtime_suspend(), which enables the PCI PME.
To fix the issue, let's not to save PCI states when it's runtime
suspend, to let the PCI subsystem enables PME.
Fixes: 42eca2302146 ("PCI: Don't touch card regs after runtime suspend D3")
Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Tested-by: Aaron Brown <aaron.f.brown@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/intel/igb/igb_main.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index b73c896ed184..390d96ae4147 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -7351,9 +7351,11 @@ static int __igb_shutdown(struct pci_dev *pdev, bool *enable_wake,
rtnl_unlock();
#ifdef CONFIG_PM
- retval = pci_save_state(pdev);
- if (retval)
- return retval;
+ if (!runtime) {
+ retval = pci_save_state(pdev);
+ if (retval)
+ return retval;
+ }
#endif
status = rd32(E1000_STATUS);
--
2.19.1
^ permalink raw reply related [flat|nested] 113+ messages in thread* [PATCH 3.18 039/108] fbdev: fbcon: Fix unregister crash when more than one framebuffer
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (37 preceding siblings ...)
2019-02-18 13:43 ` [PATCH 3.18 038/108] igb: Fix an issue that PME is not enabled during runtime suspend Greg Kroah-Hartman
@ 2019-02-18 13:43 ` Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 3.18 040/108] NFS: nfs_compare_mount_options always compare auth flavors Greg Kroah-Hartman
` (71 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:43 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Noralf Trønnes, Mikulas Patocka,
Daniel Vetter, Bartlomiej Zolnierkiewicz, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 2122b40580dd9d0620398739c773d07a7b7939d0 ]
When unregistering fbdev using unregister_framebuffer(), any bound
console will unbind automatically. This is working fine if this is the
only framebuffer, resulting in a switch to the dummy console. However if
there is a fb0 and I unregister fb1 having a bound console, I eventually
get a crash. The fastest way for me to trigger the crash is to do a
reboot, resulting in this splat:
[ 76.478825] WARNING: CPU: 0 PID: 527 at linux/kernel/workqueue.c:1442 __queue_work+0x2d4/0x41c
[ 76.478849] Modules linked in: raspberrypi_hwmon gpio_backlight backlight bcm2835_rng rng_core [last unloaded: tinydrm]
[ 76.478916] CPU: 0 PID: 527 Comm: systemd-udevd Not tainted 4.20.0-rc4+ #4
[ 76.478933] Hardware name: BCM2835
[ 76.478949] Backtrace:
[ 76.478995] [<c010d388>] (dump_backtrace) from [<c010d670>] (show_stack+0x20/0x24)
[ 76.479022] r6:00000000 r5:c0bc73be r4:00000000 r3:6fb5bf81
[ 76.479060] [<c010d650>] (show_stack) from [<c08e82f4>] (dump_stack+0x20/0x28)
[ 76.479102] [<c08e82d4>] (dump_stack) from [<c0120070>] (__warn+0xec/0x12c)
[ 76.479134] [<c011ff84>] (__warn) from [<c01201e4>] (warn_slowpath_null+0x4c/0x58)
[ 76.479165] r9:c0eb6944 r8:00000001 r7:c0e927f8 r6:c0bc73be r5:000005a2 r4:c0139e84
[ 76.479197] [<c0120198>] (warn_slowpath_null) from [<c0139e84>] (__queue_work+0x2d4/0x41c)
[ 76.479222] r6:d7666a00 r5:c0e918ee r4:dbc4e700
[ 76.479251] [<c0139bb0>] (__queue_work) from [<c013a02c>] (queue_work_on+0x60/0x88)
[ 76.479281] r10:c0496bf8 r9:00000100 r8:c0e92ae0 r7:00000001 r6:d9403700 r5:d7666a00
[ 76.479298] r4:20000113
[ 76.479348] [<c0139fcc>] (queue_work_on) from [<c0496c28>] (cursor_timer_handler+0x30/0x54)
[ 76.479374] r7:d8a8fabc r6:c0e08088 r5:d8afdc5c r4:d8a8fabc
[ 76.479413] [<c0496bf8>] (cursor_timer_handler) from [<c0178744>] (call_timer_fn+0x100/0x230)
[ 76.479435] r4:c0e9192f r3:d758a340
[ 76.479465] [<c0178644>] (call_timer_fn) from [<c0178980>] (expire_timers+0x10c/0x12c)
[ 76.479495] r10:40000000 r9:c0e9192f r8:c0e92ae0 r7:d8afdccc r6:c0e19280 r5:c0496bf8
[ 76.479513] r4:d8a8fabc
[ 76.479541] [<c0178874>] (expire_timers) from [<c0179630>] (run_timer_softirq+0xa8/0x184)
[ 76.479570] r9:00000001 r8:c0e19280 r7:00000000 r6:c0e08088 r5:c0e1a3e0 r4:c0e19280
[ 76.479603] [<c0179588>] (run_timer_softirq) from [<c0102404>] (__do_softirq+0x1ac/0x3fc)
[ 76.479632] r10:c0e91680 r9:d8afc020 r8:0000000a r7:00000100 r6:00000001 r5:00000002
[ 76.479650] r4:c0eb65ec
[ 76.479686] [<c0102258>] (__do_softirq) from [<c0124d10>] (irq_exit+0xe8/0x168)
[ 76.479716] r10:d8d1a9b0 r9:d8afc000 r8:00000001 r7:d949c000 r6:00000000 r5:c0e8b3f0
[ 76.479734] r4:00000000
[ 76.479764] [<c0124c28>] (irq_exit) from [<c016b72c>] (__handle_domain_irq+0x94/0xb0)
[ 76.479793] [<c016b698>] (__handle_domain_irq) from [<c01021dc>] (bcm2835_handle_irq+0x3c/0x48)
[ 76.479823] r8:d8afdebc r7:d8afddfc r6:ffffffff r5:c0e089f8 r4:d8afddc8 r3:d8afddc8
[ 76.479851] [<c01021a0>] (bcm2835_handle_irq) from [<c01019f0>] (__irq_svc+0x70/0x98)
The problem is in the console rebinding in fbcon_fb_unbind(). It uses the
virtual console index as the new framebuffer index to bind the console(s)
to. The correct way is to use the con2fb_map lookup table to find the
framebuffer index.
Fixes: cfafca8067c6 ("fbdev: fbcon: console unregistration from unregister_framebuffer")
Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
Reviewed-by: Mikulas Patocka <mpatocka@redhat.com>
Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/video/console/fbcon.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c
index eb976ee3a02f..614d3209d465 100644
--- a/drivers/video/console/fbcon.c
+++ b/drivers/video/console/fbcon.c
@@ -3018,7 +3018,7 @@ static int fbcon_fb_unbind(int idx)
for (i = first_fb_vc; i <= last_fb_vc; i++) {
if (con2fb_map[i] != idx &&
con2fb_map[i] != -1) {
- new_idx = i;
+ new_idx = con2fb_map[i];
break;
}
}
--
2.19.1
^ permalink raw reply related [flat|nested] 113+ messages in thread* [PATCH 3.18 040/108] NFS: nfs_compare_mount_options always compare auth flavors.
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (38 preceding siblings ...)
2019-02-18 13:43 ` [PATCH 3.18 039/108] fbdev: fbcon: Fix unregister crash when more than one framebuffer Greg Kroah-Hartman
@ 2019-02-18 13:43 ` Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 3.18 041/108] hwmon: (lm80) fix a missing check of the status of SMBus read Greg Kroah-Hartman
` (70 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:43 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Chris Perl, Anna Schumaker, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 594d1644cd59447f4fceb592448d5cd09eb09b5e ]
This patch removes the check from nfs_compare_mount_options to see if a
`sec' option was passed for the current mount before comparing auth
flavors and instead just always compares auth flavors.
Consider the following scenario:
You have a server with the address 192.168.1.1 and two exports /export/a
and /export/b. The first export supports `sys' and `krb5' security, the
second just `sys'.
Assume you start with no mounts from the server.
The following results in EIOs being returned as the kernel nfs client
incorrectly thinks it can share the underlying `struct nfs_server's:
$ mkdir /tmp/{a,b}
$ sudo mount -t nfs -o vers=3,sec=krb5 192.168.1.1:/export/a /tmp/a
$ sudo mount -t nfs -o vers=3 192.168.1.1:/export/b /tmp/b
$ df >/dev/null
df: ‘/tmp/b’: Input/output error
Signed-off-by: Chris Perl <cperl@janestreet.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfs/super.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index dbdc2d2f91cf..655ac3a196e4 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -2376,8 +2376,7 @@ static int nfs_compare_mount_options(const struct super_block *s, const struct n
goto Ebusy;
if (a->acdirmax != b->acdirmax)
goto Ebusy;
- if (b->auth_info.flavor_len > 0 &&
- clnt_a->cl_auth->au_flavor != clnt_b->cl_auth->au_flavor)
+ if (clnt_a->cl_auth->au_flavor != clnt_b->cl_auth->au_flavor)
goto Ebusy;
return 1;
Ebusy:
--
2.19.1
^ permalink raw reply related [flat|nested] 113+ messages in thread* [PATCH 3.18 041/108] hwmon: (lm80) fix a missing check of the status of SMBus read
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (39 preceding siblings ...)
2019-02-18 13:43 ` [PATCH 3.18 040/108] NFS: nfs_compare_mount_options always compare auth flavors Greg Kroah-Hartman
@ 2019-02-18 13:43 ` Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 3.18 042/108] hwmon: (lm80) fix a missing check of bus read in lm80 probe Greg Kroah-Hartman
` (69 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:43 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Kangjie Lu, Guenter Roeck, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit c9c63915519b1def7043b184680f33c24cd49d7b ]
If lm80_read_value() fails, it returns a negative number instead of the
correct read data. Therefore, we should avoid using the data if it
fails.
The fix checks if lm80_read_value() fails, and if so, returns with the
error number.
Signed-off-by: Kangjie Lu <kjlu@umn.edu>
[groeck: One variable for return values is enough]
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwmon/lm80.c | 15 ++++++++++-----
1 file changed, 10 insertions(+), 5 deletions(-)
diff --git a/drivers/hwmon/lm80.c b/drivers/hwmon/lm80.c
index 4bcd9b882948..47ddae6b7038 100644
--- a/drivers/hwmon/lm80.c
+++ b/drivers/hwmon/lm80.c
@@ -360,9 +360,11 @@ static ssize_t set_fan_div(struct device *dev, struct device_attribute *attr,
struct i2c_client *client = data->client;
unsigned long min, val;
u8 reg;
- int err = kstrtoul(buf, 10, &val);
- if (err < 0)
- return err;
+ int rv;
+
+ rv = kstrtoul(buf, 10, &val);
+ if (rv < 0)
+ return rv;
/* Save fan_min */
mutex_lock(&data->update_lock);
@@ -390,8 +392,11 @@ static ssize_t set_fan_div(struct device *dev, struct device_attribute *attr,
return -EINVAL;
}
- reg = (lm80_read_value(client, LM80_REG_FANDIV) &
- ~(3 << (2 * (nr + 1)))) | (data->fan_div[nr] << (2 * (nr + 1)));
+ rv = lm80_read_value(client, LM80_REG_FANDIV);
+ if (rv < 0)
+ return rv;
+ reg = (rv & ~(3 << (2 * (nr + 1))))
+ | (data->fan_div[nr] << (2 * (nr + 1)));
lm80_write_value(client, LM80_REG_FANDIV, reg);
/* Restore fan_min */
--
2.19.1
^ permalink raw reply related [flat|nested] 113+ messages in thread* [PATCH 3.18 042/108] hwmon: (lm80) fix a missing check of bus read in lm80 probe
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (40 preceding siblings ...)
2019-02-18 13:43 ` [PATCH 3.18 041/108] hwmon: (lm80) fix a missing check of the status of SMBus read Greg Kroah-Hartman
@ 2019-02-18 13:43 ` Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 3.18 043/108] crypto: ux500 - Use proper enum in cryp_set_dma_transfer Greg Kroah-Hartman
` (68 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:43 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Kangjie Lu, Guenter Roeck, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 9aa3aa15f4c2f74f47afd6c5db4b420fadf3f315 ]
In lm80_probe(), if lm80_read_value() fails, it returns a negative
error number which is stored to data->fan[f_min] and will be further
used. We should avoid using the data if the read fails.
The fix checks if lm80_read_value() fails, and if so, returns with the
error number.
Signed-off-by: Kangjie Lu <kjlu@umn.edu>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwmon/lm80.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/drivers/hwmon/lm80.c b/drivers/hwmon/lm80.c
index 47ddae6b7038..cb6606a0470d 100644
--- a/drivers/hwmon/lm80.c
+++ b/drivers/hwmon/lm80.c
@@ -628,6 +628,7 @@ static int lm80_probe(struct i2c_client *client,
struct device *dev = &client->dev;
struct device *hwmon_dev;
struct lm80_data *data;
+ int rv;
data = devm_kzalloc(dev, sizeof(struct lm80_data), GFP_KERNEL);
if (!data)
@@ -640,8 +641,14 @@ static int lm80_probe(struct i2c_client *client,
lm80_init_client(client);
/* A few vars need to be filled upon startup */
- data->fan[f_min][0] = lm80_read_value(client, LM80_REG_FAN_MIN(1));
- data->fan[f_min][1] = lm80_read_value(client, LM80_REG_FAN_MIN(2));
+ rv = lm80_read_value(client, LM80_REG_FAN_MIN(1));
+ if (rv < 0)
+ return rv;
+ data->fan[f_min][0] = rv;
+ rv = lm80_read_value(client, LM80_REG_FAN_MIN(2));
+ if (rv < 0)
+ return rv;
+ data->fan[f_min][1] = rv;
hwmon_dev = devm_hwmon_device_register_with_groups(dev, client->name,
data, lm80_groups);
--
2.19.1
^ permalink raw reply related [flat|nested] 113+ messages in thread* [PATCH 3.18 043/108] crypto: ux500 - Use proper enum in cryp_set_dma_transfer
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (41 preceding siblings ...)
2019-02-18 13:43 ` [PATCH 3.18 042/108] hwmon: (lm80) fix a missing check of bus read in lm80 probe Greg Kroah-Hartman
@ 2019-02-18 13:43 ` Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 3.18 044/108] crypto: ux500 - Use proper enum in hash_set_dma_transfer Greg Kroah-Hartman
` (67 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:43 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Nathan Chancellor, Nick Desaulniers,
Herbert Xu, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 9d880c5945c748d8edcac30965f3349a602158c4 ]
Clang warns when one enumerated type is implicitly converted to another:
drivers/crypto/ux500/cryp/cryp_core.c:559:5: warning: implicit
conversion from enumeration type 'enum dma_data_direction' to different
enumeration type 'enum dma_transfer_direction' [-Wenum-conversion]
direction, DMA_CTRL_ACK);
^~~~~~~~~
drivers/crypto/ux500/cryp/cryp_core.c:583:5: warning: implicit
conversion from enumeration type 'enum dma_data_direction' to different
enumeration type 'enum dma_transfer_direction' [-Wenum-conversion]
direction,
^~~~~~~~~
2 warnings generated.
dmaengine_prep_slave_sg expects an enum from dma_transfer_direction.
Because we know the value of the dma_data_direction enum from the
switch statement, we can just use the proper value from
dma_transfer_direction so there is no more conversion.
DMA_TO_DEVICE = DMA_MEM_TO_DEV = 1
DMA_FROM_DEVICE = DMA_DEV_TO_MEM = 2
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/ux500/cryp/cryp_core.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/crypto/ux500/cryp/cryp_core.c b/drivers/crypto/ux500/cryp/cryp_core.c
index e4cea7c45142..3897bfe41c8b 100644
--- a/drivers/crypto/ux500/cryp/cryp_core.c
+++ b/drivers/crypto/ux500/cryp/cryp_core.c
@@ -555,7 +555,7 @@ static int cryp_set_dma_transfer(struct cryp_ctx *ctx,
desc = dmaengine_prep_slave_sg(channel,
ctx->device->dma.sg_src,
ctx->device->dma.sg_src_len,
- direction, DMA_CTRL_ACK);
+ DMA_MEM_TO_DEV, DMA_CTRL_ACK);
break;
case DMA_FROM_DEVICE:
@@ -579,7 +579,7 @@ static int cryp_set_dma_transfer(struct cryp_ctx *ctx,
desc = dmaengine_prep_slave_sg(channel,
ctx->device->dma.sg_dst,
ctx->device->dma.sg_dst_len,
- direction,
+ DMA_DEV_TO_MEM,
DMA_CTRL_ACK |
DMA_PREP_INTERRUPT);
--
2.19.1
^ permalink raw reply related [flat|nested] 113+ messages in thread* [PATCH 3.18 044/108] crypto: ux500 - Use proper enum in hash_set_dma_transfer
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (42 preceding siblings ...)
2019-02-18 13:43 ` [PATCH 3.18 043/108] crypto: ux500 - Use proper enum in cryp_set_dma_transfer Greg Kroah-Hartman
@ 2019-02-18 13:43 ` Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 3.18 045/108] cifs: check ntwrk_buf_start for NULL before dereferencing it Greg Kroah-Hartman
` (66 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:43 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Nathan Chancellor, Nick Desaulniers,
Herbert Xu, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 5ac93f808338f4dd465402e91869702eb87db241 ]
Clang warns when one enumerated type is implicitly converted to another:
drivers/crypto/ux500/hash/hash_core.c:169:4: warning: implicit
conversion from enumeration type 'enum dma_data_direction' to different
enumeration type 'enum dma_transfer_direction' [-Wenum-conversion]
direction, DMA_CTRL_ACK | DMA_PREP_INTERRUPT);
^~~~~~~~~
1 warning generated.
dmaengine_prep_slave_sg expects an enum from dma_transfer_direction.
We know that the only direction supported by this function is
DMA_TO_DEVICE because of the check at the top of this function so we can
just use the equivalent value from dma_transfer_direction.
DMA_TO_DEVICE = DMA_MEM_TO_DEV = 1
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/ux500/hash/hash_core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/crypto/ux500/hash/hash_core.c b/drivers/crypto/ux500/hash/hash_core.c
index 3ff21c3e9ab2..48614b33e30e 100644
--- a/drivers/crypto/ux500/hash/hash_core.c
+++ b/drivers/crypto/ux500/hash/hash_core.c
@@ -181,7 +181,7 @@ static int hash_set_dma_transfer(struct hash_ctx *ctx, struct scatterlist *sg,
__func__);
desc = dmaengine_prep_slave_sg(channel,
ctx->device->dma.sg, ctx->device->dma.sg_len,
- direction, DMA_CTRL_ACK | DMA_PREP_INTERRUPT);
+ DMA_MEM_TO_DEV, DMA_CTRL_ACK | DMA_PREP_INTERRUPT);
if (!desc) {
dev_err(ctx->device->dev,
"%s: device_prep_slave_sg() failed!\n", __func__);
--
2.19.1
^ permalink raw reply related [flat|nested] 113+ messages in thread* [PATCH 3.18 045/108] cifs: check ntwrk_buf_start for NULL before dereferencing it
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (43 preceding siblings ...)
2019-02-18 13:43 ` [PATCH 3.18 044/108] crypto: ux500 - Use proper enum in hash_set_dma_transfer Greg Kroah-Hartman
@ 2019-02-18 13:43 ` Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 3.18 046/108] um: Avoid marking pages with "changed protection" Greg Kroah-Hartman
` (65 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:43 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ronnie Sahlberg, Steve French, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 59a63e479ce36a3f24444c3a36efe82b78e4a8e0 ]
RHBZ: 1021460
There is an issue where when multiple threads open/close the same directory
ntwrk_buf_start might end up being NULL, causing the call to smbCalcSize
later to oops with a NULL deref.
The real bug is why this happens and why this can become NULL for an
open cfile, which should not be allowed.
This patch tries to avoid a oops until the time when we fix the underlying
issue.
Signed-off-by: Ronnie Sahlberg <lsahlber@redhat.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/cifs/readdir.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
index 707d8cf95348..116985335cc1 100644
--- a/fs/cifs/readdir.c
+++ b/fs/cifs/readdir.c
@@ -645,7 +645,14 @@ find_cifs_entry(const unsigned int xid, struct cifs_tcon *tcon, loff_t pos,
/* scan and find it */
int i;
char *cur_ent;
- char *end_of_smb = cfile->srch_inf.ntwrk_buf_start +
+ char *end_of_smb;
+
+ if (cfile->srch_inf.ntwrk_buf_start == NULL) {
+ cifs_dbg(VFS, "ntwrk_buf_start is NULL during readdir\n");
+ return -EIO;
+ }
+
+ end_of_smb = cfile->srch_inf.ntwrk_buf_start +
server->ops->calc_smb_size(
cfile->srch_inf.ntwrk_buf_start);
--
2.19.1
^ permalink raw reply related [flat|nested] 113+ messages in thread* [PATCH 3.18 046/108] um: Avoid marking pages with "changed protection"
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (44 preceding siblings ...)
2019-02-18 13:43 ` [PATCH 3.18 045/108] cifs: check ntwrk_buf_start for NULL before dereferencing it Greg Kroah-Hartman
@ 2019-02-18 13:43 ` Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 3.18 047/108] niu: fix missing checks of niu_pci_eeprom_read Greg Kroah-Hartman
` (64 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:43 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Anton Ivanov, Richard Weinberger,
Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 8892d8545f2d0342b9c550defbfb165db237044b ]
Changing protection is a very high cost operation in UML
because in addition to an extra syscall it also interrupts
mmap merge sequences generated by the tlb.
While the condition is not particularly common it is worth
avoiding.
Signed-off-by: Anton Ivanov <anton.ivanov@cambridgegreys.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/um/include/asm/pgtable.h | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/arch/um/include/asm/pgtable.h b/arch/um/include/asm/pgtable.h
index bf974f712af7..e75fa226f08a 100644
--- a/arch/um/include/asm/pgtable.h
+++ b/arch/um/include/asm/pgtable.h
@@ -210,12 +210,17 @@ static inline pte_t pte_mkold(pte_t pte)
static inline pte_t pte_wrprotect(pte_t pte)
{
- pte_clear_bits(pte, _PAGE_RW);
+ if (likely(pte_get_bits(pte, _PAGE_RW)))
+ pte_clear_bits(pte, _PAGE_RW);
+ else
+ return pte;
return(pte_mknewprot(pte));
}
static inline pte_t pte_mkread(pte_t pte)
{
+ if (unlikely(pte_get_bits(pte, _PAGE_USER)))
+ return pte;
pte_set_bits(pte, _PAGE_USER);
return(pte_mknewprot(pte));
}
@@ -234,6 +239,8 @@ static inline pte_t pte_mkyoung(pte_t pte)
static inline pte_t pte_mkwrite(pte_t pte)
{
+ if (unlikely(pte_get_bits(pte, _PAGE_RW)))
+ return pte;
pte_set_bits(pte, _PAGE_RW);
return(pte_mknewprot(pte));
}
--
2.19.1
^ permalink raw reply related [flat|nested] 113+ messages in thread* [PATCH 3.18 047/108] niu: fix missing checks of niu_pci_eeprom_read
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (45 preceding siblings ...)
2019-02-18 13:43 ` [PATCH 3.18 046/108] um: Avoid marking pages with "changed protection" Greg Kroah-Hartman
@ 2019-02-18 13:43 ` Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 3.18 048/108] scripts/decode_stacktrace: only strip base path when a prefix of the path Greg Kroah-Hartman
` (63 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:43 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Kangjie Lu, Shannon Nelson,
David S. Miller, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 26fd962bde0b15e54234fe762d86bc0349df1de4 ]
niu_pci_eeprom_read() may fail, so we should check its return value
before using the read data.
Signed-off-by: Kangjie Lu <kjlu@umn.edu>
Acked-by: Shannon Nelson <shannon.lee.nelson@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/sun/niu.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/sun/niu.c b/drivers/net/ethernet/sun/niu.c
index 68738aa8e218..e87bded39781 100644
--- a/drivers/net/ethernet/sun/niu.c
+++ b/drivers/net/ethernet/sun/niu.c
@@ -8131,6 +8131,8 @@ static int niu_pci_vpd_scan_props(struct niu *np, u32 start, u32 end)
start += 3;
prop_len = niu_pci_eeprom_read(np, start + 4);
+ if (prop_len < 0)
+ return prop_len;
err = niu_pci_vpd_get_propname(np, start + 5, namebuf, 64);
if (err < 0)
return err;
@@ -8175,8 +8177,12 @@ static int niu_pci_vpd_scan_props(struct niu *np, u32 start, u32 end)
netif_printk(np, probe, KERN_DEBUG, np->dev,
"VPD_SCAN: Reading in property [%s] len[%d]\n",
namebuf, prop_len);
- for (i = 0; i < prop_len; i++)
- *prop_buf++ = niu_pci_eeprom_read(np, off + i);
+ for (i = 0; i < prop_len; i++) {
+ err = niu_pci_eeprom_read(np, off + i);
+ if (err >= 0)
+ *prop_buf = err;
+ ++prop_buf;
+ }
}
start += len;
--
2.19.1
^ permalink raw reply related [flat|nested] 113+ messages in thread* [PATCH 3.18 048/108] scripts/decode_stacktrace: only strip base path when a prefix of the path
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (46 preceding siblings ...)
2019-02-18 13:43 ` [PATCH 3.18 047/108] niu: fix missing checks of niu_pci_eeprom_read Greg Kroah-Hartman
@ 2019-02-18 13:43 ` Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 3.18 049/108] ocfs2: dont clear bh uptodate for block read Greg Kroah-Hartman
` (62 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:43 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Marc Zyngier, Will Deacon,
Andrew Morton, Linus Torvalds, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 67a28de47faa83585dd644bd4c31e5a1d9346c50 ]
Running something like:
decodecode vmlinux .
leads to interested results where not only the leading "." gets stripped
from the displayed paths, but also anywhere in the string, displaying
something like:
kvm_vcpu_check_block (arch/arm64/kvm/virt/kvm/kvm_mainc:2141)
which doesn't help further processing.
Fix it by only stripping the base path if it is a prefix of the path.
Link: http://lkml.kernel.org/r/20181210174659.31054-3-marc.zyngier@arm.com
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Cc: Will Deacon <will.deacon@arm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
scripts/decode_stacktrace.sh | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/scripts/decode_stacktrace.sh b/scripts/decode_stacktrace.sh
index 515c4c00e957..aa4b57abd1b5 100755
--- a/scripts/decode_stacktrace.sh
+++ b/scripts/decode_stacktrace.sh
@@ -61,7 +61,7 @@ parse_symbol() {
fi
# Strip out the base of the path
- code=${code//$basepath/""}
+ code=${code//^$basepath/""}
# In the case of inlines, move everything to same line
code=${code//$'\n'/' '}
--
2.19.1
^ permalink raw reply related [flat|nested] 113+ messages in thread* [PATCH 3.18 049/108] ocfs2: dont clear bh uptodate for block read
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (47 preceding siblings ...)
2019-02-18 13:43 ` [PATCH 3.18 048/108] scripts/decode_stacktrace: only strip base path when a prefix of the path Greg Kroah-Hartman
@ 2019-02-18 13:43 ` Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 3.18 050/108] isdn: hisax: hfc_pci: Fix a possible concurrency use-after-free bug in HFCPCI_l1hw() Greg Kroah-Hartman
` (61 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:43 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Junxiao Bi, Changwei Ge, Yiwen Jiang,
Joel Becker, Joseph Qi, Jun Piao, Mark Fasheh, Andrew Morton,
Linus Torvalds, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 70306d9dce75abde855cefaf32b3f71eed8602a3 ]
For sync io read in ocfs2_read_blocks_sync(), first clear bh uptodate flag
and submit the io, second wait io done, last check whether bh uptodate, if
not return io error.
If two sync io for the same bh were issued, it could be the first io done
and set uptodate flag, but just before check that flag, the second io came
in and cleared uptodate, then ocfs2_read_blocks_sync() for the first io
will return IO error.
Indeed it's not necessary to clear uptodate flag, as the io end handler
end_buffer_read_sync() will set or clear it based on io succeed or failed.
The following message was found from a nfs server but the underlying
storage returned no error.
[4106438.567376] (nfsd,7146,3):ocfs2_get_suballoc_slot_bit:2780 ERROR: read block 1238823695 failed -5
[4106438.567569] (nfsd,7146,3):ocfs2_get_suballoc_slot_bit:2812 ERROR: status = -5
[4106438.567611] (nfsd,7146,3):ocfs2_test_inode_bit:2894 ERROR: get alloc slot and bit failed -5
[4106438.567643] (nfsd,7146,3):ocfs2_test_inode_bit:2932 ERROR: status = -5
[4106438.567675] (nfsd,7146,3):ocfs2_get_dentry:94 ERROR: test inode bit failed -5
Same issue in non sync read ocfs2_read_blocks(), fixed it as well.
Link: http://lkml.kernel.org/r/20181121020023.3034-4-junxiao.bi@oracle.com
Signed-off-by: Junxiao Bi <junxiao.bi@oracle.com>
Reviewed-by: Changwei Ge <ge.changwei@h3c.com>
Reviewed-by: Yiwen Jiang <jiangyiwen@huawei.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Joseph Qi <jiangqi903@gmail.com>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Mark Fasheh <mfasheh@versity.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ocfs2/buffer_head_io.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/fs/ocfs2/buffer_head_io.c b/fs/ocfs2/buffer_head_io.c
index d6eab71abe1f..30d65259bc61 100644
--- a/fs/ocfs2/buffer_head_io.c
+++ b/fs/ocfs2/buffer_head_io.c
@@ -146,7 +146,6 @@ int ocfs2_read_blocks_sync(struct ocfs2_super *osb, u64 block,
BUG();
}
- clear_buffer_uptodate(bh);
get_bh(bh); /* for end_buffer_read_sync() */
bh->b_end_io = end_buffer_read_sync;
submit_bh(READ, bh);
@@ -300,7 +299,6 @@ int ocfs2_read_blocks(struct ocfs2_caching_info *ci, u64 block, int nr,
continue;
}
- clear_buffer_uptodate(bh);
get_bh(bh); /* for end_buffer_read_sync() */
if (validate)
set_buffer_needs_validate(bh);
--
2.19.1
^ permalink raw reply related [flat|nested] 113+ messages in thread* [PATCH 3.18 050/108] isdn: hisax: hfc_pci: Fix a possible concurrency use-after-free bug in HFCPCI_l1hw()
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (48 preceding siblings ...)
2019-02-18 13:43 ` [PATCH 3.18 049/108] ocfs2: dont clear bh uptodate for block read Greg Kroah-Hartman
@ 2019-02-18 13:43 ` Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 3.18 051/108] gdrom: fix a memory leak bug Greg Kroah-Hartman
` (60 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:43 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jia-Ju Bai, David S. Miller, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 7418e6520f22a2e35815122fa5a53d5bbfa2c10f ]
In drivers/isdn/hisax/hfc_pci.c, the functions hfcpci_interrupt() and
HFCPCI_l1hw() may be concurrently executed.
HFCPCI_l1hw()
line 1173: if (!cs->tx_skb)
hfcpci_interrupt()
line 942: spin_lock_irqsave();
line 1066: dev_kfree_skb_irq(cs->tx_skb);
Thus, a possible concurrency use-after-free bug may occur
in HFCPCI_l1hw().
To fix these bugs, the calls to spin_lock_irqsave() and
spin_unlock_irqrestore() are added in HFCPCI_l1hw(), to protect the
access to cs->tx_skb.
Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/isdn/hisax/hfc_pci.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/isdn/hisax/hfc_pci.c b/drivers/isdn/hisax/hfc_pci.c
index 4a4825528188..3d58437638c8 100644
--- a/drivers/isdn/hisax/hfc_pci.c
+++ b/drivers/isdn/hisax/hfc_pci.c
@@ -1169,11 +1169,13 @@ HFCPCI_l1hw(struct PStack *st, int pr, void *arg)
if (cs->debug & L1_DEB_LAPD)
debugl1(cs, "-> PH_REQUEST_PULL");
#endif
+ spin_lock_irqsave(&cs->lock, flags);
if (!cs->tx_skb) {
test_and_clear_bit(FLG_L1_PULL_REQ, &st->l1.Flags);
st->l1.l1l2(st, PH_PULL | CONFIRM, NULL);
} else
test_and_set_bit(FLG_L1_PULL_REQ, &st->l1.Flags);
+ spin_unlock_irqrestore(&cs->lock, flags);
break;
case (HW_RESET | REQUEST):
spin_lock_irqsave(&cs->lock, flags);
--
2.19.1
^ permalink raw reply related [flat|nested] 113+ messages in thread* [PATCH 3.18 051/108] gdrom: fix a memory leak bug
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (49 preceding siblings ...)
2019-02-18 13:43 ` [PATCH 3.18 050/108] isdn: hisax: hfc_pci: Fix a possible concurrency use-after-free bug in HFCPCI_l1hw() Greg Kroah-Hartman
@ 2019-02-18 13:43 ` Greg Kroah-Hartman
2019-02-18 13:43 ` Greg Kroah-Hartman
` (59 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:43 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Wenwen Wang, Jens Axboe, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 093c48213ee37c3c3ff1cf5ac1aa2a9d8bc66017 ]
In probe_gdrom(), the buffer pointed by 'gd.cd_info' is allocated through
kzalloc() and is used to hold the information of the gdrom device. To
register and unregister the device, the pointer 'gd.cd_info' is passed to
the functions register_cdrom() and unregister_cdrom(), respectively.
However, this buffer is not freed after it is used, which can cause a
memory leak bug.
This patch simply frees the buffer 'gd.cd_info' in exit_gdrom() to fix the
above issue.
Signed-off-by: Wenwen Wang <wang6495@umn.edu>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cdrom/gdrom.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/cdrom/gdrom.c b/drivers/cdrom/gdrom.c
index e2808fefbb78..1852d19d0d7b 100644
--- a/drivers/cdrom/gdrom.c
+++ b/drivers/cdrom/gdrom.c
@@ -882,6 +882,7 @@ static void __exit exit_gdrom(void)
platform_device_unregister(pd);
platform_driver_unregister(&gdrom_driver);
kfree(gd.toc);
+ kfree(gd.cd_info);
}
module_init(init_gdrom);
--
2.19.1
^ permalink raw reply related [flat|nested] 113+ messages in thread* [PATCH 3.18 052/108] block/swim3: Fix -EBUSY error when re-opening device after unmount
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
@ 2019-02-18 13:43 ` Greg Kroah-Hartman
2019-02-18 13:42 ` [PATCH 3.18 002/108] ARM: 8808/1: kexec:offline panic_smp_self_stop CPU Greg Kroah-Hartman
` (109 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:43 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, linuxppc-dev, Finn Thain, Jens Axboe,
Sasha Levin, Stan Johnson
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 296dcc40f2f2e402facf7cd26cf3f2c8f4b17d47 ]
When the block device is opened with FMODE_EXCL, ref_count is set to -1.
This value doesn't get reset when the device is closed which means the
device cannot be opened again. Fix this by checking for refcount <= 0
in the release method.
Reported-and-tested-by: Stan Johnson <userm57@yahoo.com>
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: linuxppc-dev@lists.ozlabs.org
Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/block/swim3.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/block/swim3.c b/drivers/block/swim3.c
index 523ee8fd4c15..eaf1336623aa 100644
--- a/drivers/block/swim3.c
+++ b/drivers/block/swim3.c
@@ -1027,7 +1027,11 @@ static void floppy_release(struct gendisk *disk, fmode_t mode)
struct swim3 __iomem *sw = fs->swim3;
mutex_lock(&swim3_mutex);
- if (fs->ref_count > 0 && --fs->ref_count == 0) {
+ if (fs->ref_count > 0)
+ --fs->ref_count;
+ else if (fs->ref_count == -1)
+ fs->ref_count = 0;
+ if (fs->ref_count == 0) {
swim3_action(fs, MOTOR_OFF);
out_8(&sw->control_bic, 0xff);
swim3_select(fs, RELAX);
--
2.19.1
^ permalink raw reply related [flat|nested] 113+ messages in thread* [PATCH 3.18 052/108] block/swim3: Fix -EBUSY error when re-opening device after unmount
@ 2019-02-18 13:43 ` Greg Kroah-Hartman
0 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:43 UTC (permalink / raw)
To: linux-kernel
Cc: Jens Axboe, Sasha Levin, Stan Johnson, Greg Kroah-Hartman,
Finn Thain, stable, linuxppc-dev
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 296dcc40f2f2e402facf7cd26cf3f2c8f4b17d47 ]
When the block device is opened with FMODE_EXCL, ref_count is set to -1.
This value doesn't get reset when the device is closed which means the
device cannot be opened again. Fix this by checking for refcount <= 0
in the release method.
Reported-and-tested-by: Stan Johnson <userm57@yahoo.com>
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: linuxppc-dev@lists.ozlabs.org
Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/block/swim3.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/block/swim3.c b/drivers/block/swim3.c
index 523ee8fd4c15..eaf1336623aa 100644
--- a/drivers/block/swim3.c
+++ b/drivers/block/swim3.c
@@ -1027,7 +1027,11 @@ static void floppy_release(struct gendisk *disk, fmode_t mode)
struct swim3 __iomem *sw = fs->swim3;
mutex_lock(&swim3_mutex);
- if (fs->ref_count > 0 && --fs->ref_count == 0) {
+ if (fs->ref_count > 0)
+ --fs->ref_count;
+ else if (fs->ref_count == -1)
+ fs->ref_count = 0;
+ if (fs->ref_count == 0) {
swim3_action(fs, MOTOR_OFF);
out_8(&sw->control_bic, 0xff);
swim3_select(fs, RELAX);
--
2.19.1
^ permalink raw reply related [flat|nested] 113+ messages in thread
* [PATCH 3.18 053/108] kernel/hung_task.c: break RCU locks based on jiffies
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (51 preceding siblings ...)
2019-02-18 13:43 ` Greg Kroah-Hartman
@ 2019-02-18 13:43 ` Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 3.18 054/108] fs/epoll: drop ovflist branch prediction Greg Kroah-Hartman
` (57 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:43 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tetsuo Handa, Paul E. McKenney,
Petr Mladek, Sergey Senozhatsky, Dmitry Vyukov,
Rafael J. Wysocki, Vitaly Kuznetsov, Andrew Morton,
Linus Torvalds, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 304ae42739b108305f8d7b3eb3c1aec7c2b643a9 ]
check_hung_uninterruptible_tasks() is currently calling rcu_lock_break()
for every 1024 threads. But check_hung_task() is very slow if printk()
was called, and is very fast otherwise.
If many threads within some 1024 threads called printk(), the RCU grace
period might be extended enough to trigger RCU stall warnings.
Therefore, calling rcu_lock_break() for every some fixed jiffies will be
safer.
Link: http://lkml.kernel.org/r/1544800658-11423-1-git-send-email-penguin-kernel@I-love.SAKURA.ne.jp
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Acked-by: Paul E. McKenney <paulmck@linux.ibm.com>
Cc: Petr Mladek <pmladek@suse.com>
Cc: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
Cc: Vitaly Kuznetsov <vkuznets@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/hung_task.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/kernel/hung_task.c b/kernel/hung_task.c
index 06db12434d72..eda60beeac7d 100644
--- a/kernel/hung_task.c
+++ b/kernel/hung_task.c
@@ -30,7 +30,7 @@ int __read_mostly sysctl_hung_task_check_count = PID_MAX_LIMIT;
* is disabled during the critical section. It also controls the size of
* the RCU grace period. So it needs to be upper-bound.
*/
-#define HUNG_TASK_BATCHING 1024
+#define HUNG_TASK_LOCK_BREAK (HZ / 10)
/*
* Zero means infinite timeout - no checking done:
@@ -158,7 +158,7 @@ static bool rcu_lock_break(struct task_struct *g, struct task_struct *t)
static void check_hung_uninterruptible_tasks(unsigned long timeout)
{
int max_count = sysctl_hung_task_check_count;
- int batch_count = HUNG_TASK_BATCHING;
+ unsigned long last_break = jiffies;
struct task_struct *g, *t;
/*
@@ -172,10 +172,10 @@ static void check_hung_uninterruptible_tasks(unsigned long timeout)
do_each_thread(g, t) {
if (!max_count--)
goto unlock;
- if (!--batch_count) {
- batch_count = HUNG_TASK_BATCHING;
+ if (time_after(jiffies, last_break + HUNG_TASK_LOCK_BREAK)) {
if (!rcu_lock_break(g, t))
goto unlock;
+ last_break = jiffies;
}
/* use "==" to skip the TASK_KILLABLE tasks waiting on NFS */
if (t->state == TASK_UNINTERRUPTIBLE)
--
2.19.1
^ permalink raw reply related [flat|nested] 113+ messages in thread* [PATCH 3.18 054/108] fs/epoll: drop ovflist branch prediction
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (52 preceding siblings ...)
2019-02-18 13:43 ` [PATCH 3.18 053/108] kernel/hung_task.c: break RCU locks based on jiffies Greg Kroah-Hartman
@ 2019-02-18 13:43 ` Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 3.18 055/108] exec: load_script: dont blindly truncate shebang string Greg Kroah-Hartman
` (56 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:43 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Davidlohr Bueso, Andrew Morton,
Al Viro, Jason Baron, Linus Torvalds, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 76699a67f3041ff4c7af6d6ee9be2bfbf1ffb671 ]
The ep->ovflist is a secondary ready-list to temporarily store events
that might occur when doing sproc without holding the ep->wq.lock. This
accounts for every time we check for ready events and also send events
back to userspace; both callbacks, particularly the latter because of
copy_to_user, can account for a non-trivial time.
As such, the unlikely() check to see if the pointer is being used, seems
both misleading and sub-optimal. In fact, we go to an awful lot of
trouble to sync both lists, and populating the ovflist is far from an
uncommon scenario.
For example, profiling a concurrent epoll_wait(2) benchmark, with
CONFIG_PROFILE_ANNOTATED_BRANCHES shows that for a two threads a 33%
incorrect rate was seen; and when incrementally increasing the number of
epoll instances (which is used, for example for multiple queuing load
balancing models), up to a 90% incorrect rate was seen.
Similarly, by deleting the prediction, 3% throughput boost was seen
across incremental threads.
Link: http://lkml.kernel.org/r/20181108051006.18751-4-dave@stgolabs.net
Signed-off-by: Davidlohr Bueso <dbueso@suse.de>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Jason Baron <jbaron@akamai.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/eventpoll.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index 2b5285c40b40..8e50ef617d85 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -1037,7 +1037,7 @@ static int ep_poll_callback(wait_queue_t *wait, unsigned mode, int sync, void *k
* semantics). All the events that happen during that period of time are
* chained in ep->ovflist and requeued later on.
*/
- if (unlikely(ep->ovflist != EP_UNACTIVE_PTR)) {
+ if (ep->ovflist != EP_UNACTIVE_PTR) {
if (epi->next == EP_UNACTIVE_PTR) {
epi->next = ep->ovflist;
ep->ovflist = epi;
--
2.19.1
^ permalink raw reply related [flat|nested] 113+ messages in thread* [PATCH 3.18 055/108] exec: load_script: dont blindly truncate shebang string
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (53 preceding siblings ...)
2019-02-18 13:43 ` [PATCH 3.18 054/108] fs/epoll: drop ovflist branch prediction Greg Kroah-Hartman
@ 2019-02-18 13:43 ` Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 3.18 056/108] thermal: hwmon: inline helpers when CONFIG_THERMAL_HWMON is not set Greg Kroah-Hartman
` (55 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:43 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Oleg Nesterov, Kees Cook,
Michal Hocko, Ben Woodard, Eric W. Biederman, Andrew Morton,
Linus Torvalds, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 8099b047ecc431518b9bb6bdbba3549bbecdc343 ]
load_script() simply truncates bprm->buf and this is very wrong if the
length of shebang string exceeds BINPRM_BUF_SIZE-2. This can silently
truncate i_arg or (worse) we can execute the wrong binary if buf[2:126]
happens to be the valid executable path.
Change load_script() to return ENOEXEC if it can't find '\n' or zero in
bprm->buf. Note that '\0' can come from either
prepare_binprm()->memset() or from kernel_read(), we do not care.
Link: http://lkml.kernel.org/r/20181112160931.GA28463@redhat.com
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Acked-by: Kees Cook <keescook@chromium.org>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Ben Woodard <woodard@redhat.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/binfmt_script.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/fs/binfmt_script.c b/fs/binfmt_script.c
index 5027a3e14922..f62e45df2d38 100644
--- a/fs/binfmt_script.c
+++ b/fs/binfmt_script.c
@@ -33,10 +33,14 @@ static int load_script(struct linux_binprm *bprm)
fput(bprm->file);
bprm->file = NULL;
- bprm->buf[BINPRM_BUF_SIZE - 1] = '\0';
- if ((cp = strchr(bprm->buf, '\n')) == NULL)
- cp = bprm->buf+BINPRM_BUF_SIZE-1;
+ for (cp = bprm->buf+2;; cp++) {
+ if (cp >= bprm->buf + BINPRM_BUF_SIZE)
+ return -ENOEXEC;
+ if (!*cp || (*cp == '\n'))
+ break;
+ }
*cp = '\0';
+
while (cp > bprm->buf) {
cp--;
if ((*cp == ' ') || (*cp == '\t'))
--
2.19.1
^ permalink raw reply related [flat|nested] 113+ messages in thread* [PATCH 3.18 056/108] thermal: hwmon: inline helpers when CONFIG_THERMAL_HWMON is not set
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (54 preceding siblings ...)
2019-02-18 13:43 ` [PATCH 3.18 055/108] exec: load_script: dont blindly truncate shebang string Greg Kroah-Hartman
@ 2019-02-18 13:43 ` Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 3.18 057/108] dccp: fool proof ccid_hc_[rt]x_parse_options() Greg Kroah-Hartman
` (54 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:43 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Eduardo Valentin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eduardo Valentin <edubezval@gmail.com>
commit 03334ba8b425b2ad275c8f390cf83c7b081c3095 upstream.
Avoid warnings like this:
thermal_hwmon.h:29:1: warning: ‘thermal_remove_hwmon_sysfs’ defined but not used [-Wunused-function]
thermal_remove_hwmon_sysfs(struct thermal_zone_device *tz)
Fixes: 0dd88793aacd ("thermal: hwmon: move hwmon support to single file")
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Eduardo Valentin <edubezval@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/thermal/thermal_hwmon.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/thermal/thermal_hwmon.h
+++ b/drivers/thermal/thermal_hwmon.h
@@ -34,13 +34,13 @@
int thermal_add_hwmon_sysfs(struct thermal_zone_device *tz);
void thermal_remove_hwmon_sysfs(struct thermal_zone_device *tz);
#else
-static int
+static inline int
thermal_add_hwmon_sysfs(struct thermal_zone_device *tz)
{
return 0;
}
-static void
+static inline void
thermal_remove_hwmon_sysfs(struct thermal_zone_device *tz)
{
}
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 3.18 057/108] dccp: fool proof ccid_hc_[rt]x_parse_options()
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (55 preceding siblings ...)
2019-02-18 13:43 ` [PATCH 3.18 056/108] thermal: hwmon: inline helpers when CONFIG_THERMAL_HWMON is not set Greg Kroah-Hartman
@ 2019-02-18 13:43 ` Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 3.18 058/108] skge: potential memory corruption in skge_get_regs() Greg Kroah-Hartman
` (53 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:43 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Eric Dumazet, syzbot, Gerrit Renker,
David S. Miller
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 9b1f19d810e92d6cdc68455fbc22d9f961a58ce1 ]
Similarly to commit 276bdb82dedb ("dccp: check ccid before dereferencing")
it is wise to test for a NULL ccid.
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 16 Comm: ksoftirqd/1 Not tainted 5.0.0-rc3+ #37
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:ccid_hc_tx_parse_options net/dccp/ccid.h:205 [inline]
RIP: 0010:dccp_parse_options+0x8d9/0x12b0 net/dccp/options.c:233
Code: c5 0f b6 75 b3 80 38 00 0f 85 d6 08 00 00 48 b9 00 00 00 00 00 fc ff df 48 8b 45 b8 4c 8b b8 f8 07 00 00 4c 89 f8 48 c1 e8 03 <80> 3c 08 00 0f 85 95 08 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b
kobject: 'loop5' (0000000080f78fc1): kobject_uevent_env
RSP: 0018:ffff8880a94df0b8 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff8880858ac723 RCX: dffffc0000000000
RDX: 0000000000000100 RSI: 0000000000000007 RDI: 0000000000000001
RBP: ffff8880a94df140 R08: 0000000000000001 R09: ffff888061b83a80
R10: ffffed100c370752 R11: ffff888061b83a97 R12: 0000000000000026
R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f0defa33518 CR3: 000000008db5e000 CR4: 00000000001406e0
kobject: 'loop5' (0000000080f78fc1): fill_kobj_path: path = '/devices/virtual/block/loop5'
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
dccp_rcv_state_process+0x2b6/0x1af6 net/dccp/input.c:654
dccp_v4_do_rcv+0x100/0x190 net/dccp/ipv4.c:688
sk_backlog_rcv include/net/sock.h:936 [inline]
__sk_receive_skb+0x3a9/0xea0 net/core/sock.c:473
dccp_v4_rcv+0x10cb/0x1f80 net/dccp/ipv4.c:880
ip_protocol_deliver_rcu+0xb6/0xa20 net/ipv4/ip_input.c:208
ip_local_deliver_finish+0x23b/0x390 net/ipv4/ip_input.c:234
NF_HOOK include/linux/netfilter.h:289 [inline]
NF_HOOK include/linux/netfilter.h:283 [inline]
ip_local_deliver+0x1f0/0x740 net/ipv4/ip_input.c:255
dst_input include/net/dst.h:450 [inline]
ip_rcv_finish+0x1f4/0x2f0 net/ipv4/ip_input.c:414
NF_HOOK include/linux/netfilter.h:289 [inline]
NF_HOOK include/linux/netfilter.h:283 [inline]
ip_rcv+0xed/0x620 net/ipv4/ip_input.c:524
__netif_receive_skb_one_core+0x160/0x210 net/core/dev.c:4973
__netif_receive_skb+0x2c/0x1c0 net/core/dev.c:5083
process_backlog+0x206/0x750 net/core/dev.c:5923
napi_poll net/core/dev.c:6346 [inline]
net_rx_action+0x76d/0x1930 net/core/dev.c:6412
__do_softirq+0x30b/0xb11 kernel/softirq.c:292
run_ksoftirqd kernel/softirq.c:654 [inline]
run_ksoftirqd+0x8e/0x110 kernel/softirq.c:646
smpboot_thread_fn+0x6ab/0xa10 kernel/smpboot.c:164
kthread+0x357/0x430 kernel/kthread.c:246
ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352
Modules linked in:
---[ end trace 58a0ba03bea2c376 ]---
RIP: 0010:ccid_hc_tx_parse_options net/dccp/ccid.h:205 [inline]
RIP: 0010:dccp_parse_options+0x8d9/0x12b0 net/dccp/options.c:233
Code: c5 0f b6 75 b3 80 38 00 0f 85 d6 08 00 00 48 b9 00 00 00 00 00 fc ff df 48 8b 45 b8 4c 8b b8 f8 07 00 00 4c 89 f8 48 c1 e8 03 <80> 3c 08 00 0f 85 95 08 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b
RSP: 0018:ffff8880a94df0b8 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff8880858ac723 RCX: dffffc0000000000
RDX: 0000000000000100 RSI: 0000000000000007 RDI: 0000000000000001
RBP: ffff8880a94df140 R08: 0000000000000001 R09: ffff888061b83a80
R10: ffffed100c370752 R11: ffff888061b83a97 R12: 0000000000000026
R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f0defa33518 CR3: 0000000009871000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Cc: Gerrit Renker <gerrit@erg.abdn.ac.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/dccp/ccid.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/net/dccp/ccid.h
+++ b/net/dccp/ccid.h
@@ -202,7 +202,7 @@ static inline void ccid_hc_tx_packet_rec
static inline int ccid_hc_tx_parse_options(struct ccid *ccid, struct sock *sk,
u8 pkt, u8 opt, u8 *val, u8 len)
{
- if (ccid->ccid_ops->ccid_hc_tx_parse_options == NULL)
+ if (!ccid || !ccid->ccid_ops->ccid_hc_tx_parse_options)
return 0;
return ccid->ccid_ops->ccid_hc_tx_parse_options(sk, pkt, opt, val, len);
}
@@ -214,7 +214,7 @@ static inline int ccid_hc_tx_parse_optio
static inline int ccid_hc_rx_parse_options(struct ccid *ccid, struct sock *sk,
u8 pkt, u8 opt, u8 *val, u8 len)
{
- if (ccid->ccid_ops->ccid_hc_rx_parse_options == NULL)
+ if (!ccid || !ccid->ccid_ops->ccid_hc_rx_parse_options)
return 0;
return ccid->ccid_ops->ccid_hc_rx_parse_options(sk, pkt, opt, val, len);
}
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 3.18 058/108] skge: potential memory corruption in skge_get_regs()
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (56 preceding siblings ...)
2019-02-18 13:43 ` [PATCH 3.18 057/108] dccp: fool proof ccid_hc_[rt]x_parse_options() Greg Kroah-Hartman
@ 2019-02-18 13:43 ` Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 3.18 059/108] net: systemport: Fix WoL with password after deep sleep Greg Kroah-Hartman
` (52 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:43 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dan Carpenter, David S. Miller
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
[ Upstream commit 294c149a209c6196c2de85f512b52ef50f519949 ]
The "p" buffer is 0x4000 bytes long. B3_RI_WTO_R1 is 0x190. The value
of "regs->len" is in the 1-0x4000 range. The bug here is that
"regs->len - B3_RI_WTO_R1" can be a negative value which would lead to
memory corruption and an abrupt crash.
Fixes: c3f8be961808 ("[PATCH] skge: expand ethtool debug register dump")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/marvell/skge.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/net/ethernet/marvell/skge.c
+++ b/drivers/net/ethernet/marvell/skge.c
@@ -152,8 +152,10 @@ static void skge_get_regs(struct net_dev
memset(p, 0, regs->len);
memcpy_fromio(p, io, B3_RAM_ADDR);
- memcpy_fromio(p + B3_RI_WTO_R1, io + B3_RI_WTO_R1,
- regs->len - B3_RI_WTO_R1);
+ if (regs->len > B3_RI_WTO_R1) {
+ memcpy_fromio(p + B3_RI_WTO_R1, io + B3_RI_WTO_R1,
+ regs->len - B3_RI_WTO_R1);
+ }
}
/* Wake on Lan only supported on Yukon chips with rev 1 or above */
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 3.18 059/108] net: systemport: Fix WoL with password after deep sleep
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (57 preceding siblings ...)
2019-02-18 13:43 ` [PATCH 3.18 058/108] skge: potential memory corruption in skge_get_regs() Greg Kroah-Hartman
@ 2019-02-18 13:43 ` Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 3.18 060/108] net: dsa: slave: Dont propagate flag changes on down slave interfaces Greg Kroah-Hartman
` (51 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:43 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Florian Fainelli, David S. Miller
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Fainelli <f.fainelli@gmail.com>
[ Upstream commit 8dfb8d2cceb76b74ad5b58cc65c75994329b4d5e ]
Broadcom STB chips support a deep sleep mode where all register
contents are lost. Because we were stashing the MagicPacket password
into some of these registers a suspend into that deep sleep then a
resumption would not lead to being able to wake-up from MagicPacket with
password again.
Fix this by keeping a software copy of the password and program it
during suspend.
Fixes: 83e82f4c706b ("net: systemport: add Wake-on-LAN support")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/broadcom/bcmsysport.c | 25 ++++++++++---------------
drivers/net/ethernet/broadcom/bcmsysport.h | 2 ++
2 files changed, 12 insertions(+), 15 deletions(-)
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -397,7 +397,6 @@ static void bcm_sysport_get_wol(struct n
struct ethtool_wolinfo *wol)
{
struct bcm_sysport_priv *priv = netdev_priv(dev);
- u32 reg;
wol->supported = WAKE_MAGIC | WAKE_MAGICSECURE;
wol->wolopts = priv->wolopts;
@@ -405,11 +404,7 @@ static void bcm_sysport_get_wol(struct n
if (!(priv->wolopts & WAKE_MAGICSECURE))
return;
- /* Return the programmed SecureOn password */
- reg = umac_readl(priv, UMAC_PSW_MS);
- put_unaligned_be16(reg, &wol->sopass[0]);
- reg = umac_readl(priv, UMAC_PSW_LS);
- put_unaligned_be32(reg, &wol->sopass[2]);
+ memcpy(wol->sopass, priv->sopass, sizeof(priv->sopass));
}
static int bcm_sysport_set_wol(struct net_device *dev,
@@ -425,13 +420,8 @@ static int bcm_sysport_set_wol(struct ne
if (wol->wolopts & ~supported)
return -EINVAL;
- /* Program the SecureOn password */
- if (wol->wolopts & WAKE_MAGICSECURE) {
- umac_writel(priv, get_unaligned_be16(&wol->sopass[0]),
- UMAC_PSW_MS);
- umac_writel(priv, get_unaligned_be32(&wol->sopass[2]),
- UMAC_PSW_LS);
- }
+ if (wol->wolopts & WAKE_MAGICSECURE)
+ memcpy(priv->sopass, wol->sopass, sizeof(priv->sopass));
/* Flag the device and relevant IRQ as wakeup capable */
if (wol->wolopts) {
@@ -1760,12 +1750,17 @@ static int bcm_sysport_suspend_to_wol(st
unsigned int timeout = 1000;
u32 reg;
- /* Password has already been programmed */
reg = umac_readl(priv, UMAC_MPD_CTRL);
reg |= MPD_EN;
reg &= ~PSW_EN;
- if (priv->wolopts & WAKE_MAGICSECURE)
+ if (priv->wolopts & WAKE_MAGICSECURE) {
+ /* Program the SecureOn password */
+ umac_writel(priv, get_unaligned_be16(&priv->sopass[0]),
+ UMAC_PSW_MS);
+ umac_writel(priv, get_unaligned_be32(&priv->sopass[2]),
+ UMAC_PSW_LS);
reg |= PSW_EN;
+ }
umac_writel(priv, reg, UMAC_MPD_CTRL);
/* Make sure RBUF entered WoL mode as result */
--- a/drivers/net/ethernet/broadcom/bcmsysport.h
+++ b/drivers/net/ethernet/broadcom/bcmsysport.h
@@ -11,6 +11,7 @@
#ifndef __BCM_SYSPORT_H
#define __BCM_SYSPORT_H
+#include <linux/ethtool.h>
#include <linux/if_vlan.h>
/* Receive/transmit descriptor format */
@@ -679,6 +680,7 @@ struct bcm_sysport_priv {
unsigned int crc_fwd:1;
u16 rev;
u32 wolopts;
+ u8 sopass[SOPASS_MAX];
unsigned int wol_irq_disabled:1;
/* MIB related fields */
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 3.18 060/108] net: dsa: slave: Dont propagate flag changes on down slave interfaces
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (58 preceding siblings ...)
2019-02-18 13:43 ` [PATCH 3.18 059/108] net: systemport: Fix WoL with password after deep sleep Greg Kroah-Hartman
@ 2019-02-18 13:43 ` Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 3.18 061/108] enic: fix checksum validation for IPv6 Greg Kroah-Hartman
` (50 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:43 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Rundong Ge, David S. Miller
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rundong Ge <rdong.ge@gmail.com>
[ Upstream commit 17ab4f61b8cd6f9c38e9d0b935d86d73b5d0d2b5 ]
The unbalance of master's promiscuity or allmulti will happen after ifdown
and ifup a slave interface which is in a bridge.
When we ifdown a slave interface , both the 'dsa_slave_close' and
'dsa_slave_change_rx_flags' will clear the master's flags. The flags
of master will be decrease twice.
In the other hand, if we ifup the slave interface again, since the
slave's flags were cleared the 'dsa_slave_open' won't set the master's
flag, only 'dsa_slave_change_rx_flags' that triggered by 'br_add_if'
will set the master's flags. The flags of master is increase once.
Only propagating flag changes when a slave interface is up makes
sure this does not happen. The 'vlan_dev_change_rx_flags' had the
same problem and was fixed, and changes here follows that fix.
Fixes: 91da11f870f0 ("net: Distributed Switch Architecture protocol support")
Signed-off-by: Rundong Ge <rdong.ge@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/dsa/slave.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
--- a/net/dsa/slave.c
+++ b/net/dsa/slave.c
@@ -140,10 +140,14 @@ static void dsa_slave_change_rx_flags(st
struct dsa_slave_priv *p = netdev_priv(dev);
struct net_device *master = p->parent->dst->master_netdev;
- if (change & IFF_ALLMULTI)
- dev_set_allmulti(master, dev->flags & IFF_ALLMULTI ? 1 : -1);
- if (change & IFF_PROMISC)
- dev_set_promiscuity(master, dev->flags & IFF_PROMISC ? 1 : -1);
+ if (dev->flags & IFF_UP) {
+ if (change & IFF_ALLMULTI)
+ dev_set_allmulti(master,
+ dev->flags & IFF_ALLMULTI ? 1 : -1);
+ if (change & IFF_PROMISC)
+ dev_set_promiscuity(master,
+ dev->flags & IFF_PROMISC ? 1 : -1);
+ }
}
static void dsa_slave_set_rx_mode(struct net_device *dev)
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 3.18 061/108] enic: fix checksum validation for IPv6
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (59 preceding siblings ...)
2019-02-18 13:43 ` [PATCH 3.18 060/108] net: dsa: slave: Dont propagate flag changes on down slave interfaces Greg Kroah-Hartman
@ 2019-02-18 13:43 ` Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 3.18 062/108] ALSA: compress: Fix stop handling on compressed capture streams Greg Kroah-Hartman
` (49 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:43 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Govindarajulu Varadarajan, David S. Miller
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Govindarajulu Varadarajan <gvaradar@cisco.com>
[ Upstream commit 7596175e99b3d4bce28022193efd954c201a782a ]
In case of IPv6 pkts, ipv4_csum_ok is 0. Because of this, driver does
not set skb->ip_summed. So IPv6 rx checksum is not offloaded.
Signed-off-by: Govindarajulu Varadarajan <gvaradar@cisco.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/cisco/enic/enic_main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/ethernet/cisco/enic/enic_main.c
+++ b/drivers/net/ethernet/cisco/enic/enic_main.c
@@ -1065,7 +1065,7 @@ static void enic_rq_indicate_buf(struct
* CHECSUM_UNNECESSARY.
*/
if ((netdev->features & NETIF_F_RXCSUM) && tcp_udp_csum_ok &&
- ipv4_csum_ok)
+ (ipv4_csum_ok || ipv6))
skb->ip_summed = CHECKSUM_UNNECESSARY;
if (vlan_stripped)
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 3.18 062/108] ALSA: compress: Fix stop handling on compressed capture streams
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (60 preceding siblings ...)
2019-02-18 13:43 ` [PATCH 3.18 061/108] enic: fix checksum validation for IPv6 Greg Kroah-Hartman
@ 2019-02-18 13:43 ` Greg Kroah-Hartman
2019-02-18 13:43 ` [PATCH 3.18 063/108] fuse: call pipe_buf_release() under pipe lock Greg Kroah-Hartman
` (48 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:43 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Charles Keepax, Takashi Iwai
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Keepax <ckeepax@opensource.cirrus.com>
commit 4f2ab5e1d13d6aa77c55f4914659784efd776eb4 upstream.
It is normal user behaviour to start, stop, then start a stream
again without closing it. Currently this works for compressed
playback streams but not capture ones.
The states on a compressed capture stream go directly from OPEN to
PREPARED, unlike a playback stream which moves to SETUP and waits
for a write of data before moving to PREPARED. Currently however,
when a stop is sent the state is set to SETUP for both types of
streams. This leaves a capture stream in the situation where a new
start can't be sent as that requires the state to be PREPARED and
a new set_params can't be sent as that requires the state to be
OPEN. The only option being to close the stream, and then reopen.
Correct this issues by allowing snd_compr_drain_notify to set the
state depending on the stream direction, as we already do in
set_params.
Fixes: 49bb6402f1aa ("ALSA: compress_core: Add support for capture streams")
Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/sound/compress_driver.h | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/include/sound/compress_driver.h
+++ b/include/sound/compress_driver.h
@@ -176,7 +176,11 @@ static inline void snd_compr_drain_notif
if (snd_BUG_ON(!stream))
return;
- stream->runtime->state = SNDRV_PCM_STATE_SETUP;
+ if (stream->direction == SND_COMPRESS_PLAYBACK)
+ stream->runtime->state = SNDRV_PCM_STATE_SETUP;
+ else
+ stream->runtime->state = SNDRV_PCM_STATE_PREPARED;
+
wake_up(&stream->runtime->sleep);
}
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 3.18 063/108] fuse: call pipe_buf_release() under pipe lock
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (61 preceding siblings ...)
2019-02-18 13:43 ` [PATCH 3.18 062/108] ALSA: compress: Fix stop handling on compressed capture streams Greg Kroah-Hartman
@ 2019-02-18 13:43 ` Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 3.18 064/108] fuse: decrement NR_WRITEBACK_TEMP on the right page Greg Kroah-Hartman
` (47 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:43 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jann Horn, Miklos Szeredi
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jann Horn <jannh@google.com>
commit 9509941e9c534920ccc4771ae70bd6cbbe79df1c upstream.
Some of the pipe_buf_release() handlers seem to assume that the pipe is
locked - in particular, anon_pipe_buf_release() accesses pipe->tmp_page
without taking any extra locks. From a glance through the callers of
pipe_buf_release(), it looks like FUSE is the only one that calls
pipe_buf_release() without having the pipe locked.
This bug should only lead to a memory leak, nothing terrible.
Fixes: dd3bb14f44a6 ("fuse: support splice() writing to fuse device")
Cc: stable@vger.kernel.org
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/fuse/dev.c | 3 +++
1 file changed, 3 insertions(+)
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -1971,10 +1971,13 @@ static ssize_t fuse_dev_splice_write(str
ret = fuse_dev_do_write(fc, &cs, len);
+ pipe_lock(pipe);
for (idx = 0; idx < nbuf; idx++) {
struct pipe_buffer *buf = &bufs[idx];
buf->ops->release(pipe, buf);
}
+ pipe_unlock(pipe);
+
out:
kfree(bufs);
return ret;
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 3.18 064/108] fuse: decrement NR_WRITEBACK_TEMP on the right page
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (62 preceding siblings ...)
2019-02-18 13:43 ` [PATCH 3.18 063/108] fuse: call pipe_buf_release() under pipe lock Greg Kroah-Hartman
@ 2019-02-18 13:44 ` Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 3.18 065/108] fuse: handle zero sized retrieve correctly Greg Kroah-Hartman
` (46 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:44 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Miklos Szeredi
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miklos Szeredi <mszeredi@redhat.com>
commit a2ebba824106dabe79937a9f29a875f837e1b6d4 upstream.
NR_WRITEBACK_TEMP is accounted on the temporary page in the request, not
the page cache page.
Fixes: 8b284dc47291 ("fuse: writepages: handle same page rewrites")
Cc: <stable@vger.kernel.org> # v3.13
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/fuse/file.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -1844,7 +1844,7 @@ static bool fuse_writepage_in_flight(str
spin_unlock(&fc->lock);
dec_bdi_stat(bdi, BDI_WRITEBACK);
- dec_zone_page_state(page, NR_WRITEBACK_TEMP);
+ dec_zone_page_state(new_req->pages[0], NR_WRITEBACK_TEMP);
bdi_writeout_inc(bdi);
fuse_writepage_free(fc, new_req);
fuse_request_free(new_req);
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 3.18 065/108] fuse: handle zero sized retrieve correctly
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (63 preceding siblings ...)
2019-02-18 13:44 ` [PATCH 3.18 064/108] fuse: decrement NR_WRITEBACK_TEMP on the right page Greg Kroah-Hartman
@ 2019-02-18 13:44 ` Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 3.18 066/108] dmaengine: imx-dma: fix wrong callback invoke Greg Kroah-Hartman
` (45 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot+c1e36d30ee3416289cc0, Miklos Szeredi
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miklos Szeredi <mszeredi@redhat.com>
commit 97e1532ef81acb31c30f9e75bf00306c33a77812 upstream.
Dereferencing req->page_descs[0] will Oops if req->max_pages is zero.
Reported-by: syzbot+c1e36d30ee3416289cc0@syzkaller.appspotmail.com
Tested-by: syzbot+c1e36d30ee3416289cc0@syzkaller.appspotmail.com
Fixes: b2430d7567a3 ("fuse: add per-page descriptor <offset, length> to fuse_req")
Cc: <stable@vger.kernel.org> # v3.9
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/fuse/dev.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -1645,7 +1645,6 @@ static int fuse_retrieve(struct fuse_con
req->in.h.nodeid = outarg->nodeid;
req->in.numargs = 2;
req->in.argpages = 1;
- req->page_descs[0].offset = offset;
req->end = fuse_retrieve_end;
index = outarg->offset >> PAGE_CACHE_SHIFT;
@@ -1660,6 +1659,7 @@ static int fuse_retrieve(struct fuse_con
this_num = min_t(unsigned, num, PAGE_CACHE_SIZE - offset);
req->pages[req->num_pages] = page;
+ req->page_descs[req->num_pages].offset = offset;
req->page_descs[req->num_pages].length = this_num;
req->num_pages++;
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 3.18 066/108] dmaengine: imx-dma: fix wrong callback invoke
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (64 preceding siblings ...)
2019-02-18 13:44 ` [PATCH 3.18 065/108] fuse: handle zero sized retrieve correctly Greg Kroah-Hartman
@ 2019-02-18 13:44 ` Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 3.18 067/108] usb: phy: am335x: fix race condition in _probe Greg Kroah-Hartman
` (44 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:44 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Leonid Iziumtsev, Vinod Koul
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leonid Iziumtsev <leonid.iziumtsev@gmail.com>
commit 341198eda723c8c1cddbb006a89ad9e362502ea2 upstream.
Once the "ld_queue" list is not empty, next descriptor will migrate
into "ld_active" list. The "desc" variable will be overwritten
during that transition. And later the dmaengine_desc_get_callback_invoke()
will use it as an argument. As result we invoke wrong callback.
That behaviour was in place since:
commit fcaaba6c7136 ("dmaengine: imx-dma: fix callback path in tasklet").
But after commit 4cd13c21b207 ("softirq: Let ksoftirqd do its job")
things got worse, since possible delay between tasklet_schedule()
from DMA irq handler and actual tasklet function execution got bigger.
And that gave more time for new DMA request to be submitted and
to be put into "ld_queue" list.
It has been noticed that DMA issue is causing problems for "mxc-mmc"
driver. While stressing the system with heavy network traffic and
writing/reading to/from sd card simultaneously the timeout may happen:
10013000.sdhci: mxcmci_watchdog: read time out (status = 0x30004900)
That often lead to file system corruption.
Signed-off-by: Leonid Iziumtsev <leonid.iziumtsev@gmail.com>
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/dma/imx-dma.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/drivers/dma/imx-dma.c
+++ b/drivers/dma/imx-dma.c
@@ -624,7 +624,7 @@ static void imxdma_tasklet(unsigned long
{
struct imxdma_channel *imxdmac = (void *)data;
struct imxdma_engine *imxdma = imxdmac->imxdma;
- struct imxdma_desc *desc;
+ struct imxdma_desc *desc, *next_desc;
unsigned long flags;
spin_lock_irqsave(&imxdma->lock, flags);
@@ -654,10 +654,10 @@ static void imxdma_tasklet(unsigned long
list_move_tail(imxdmac->ld_active.next, &imxdmac->ld_free);
if (!list_empty(&imxdmac->ld_queue)) {
- desc = list_first_entry(&imxdmac->ld_queue, struct imxdma_desc,
- node);
+ next_desc = list_first_entry(&imxdmac->ld_queue,
+ struct imxdma_desc, node);
list_move_tail(imxdmac->ld_queue.next, &imxdmac->ld_active);
- if (imxdma_xfer_desc(desc) < 0)
+ if (imxdma_xfer_desc(next_desc) < 0)
dev_warn(imxdma->dev, "%s: channel: %d couldn't xfer desc\n",
__func__, imxdmac->channel);
}
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 3.18 067/108] usb: phy: am335x: fix race condition in _probe
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (65 preceding siblings ...)
2019-02-18 13:44 ` [PATCH 3.18 066/108] dmaengine: imx-dma: fix wrong callback invoke Greg Kroah-Hartman
@ 2019-02-18 13:44 ` Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 3.18 068/108] usb: gadget: udc: net2272: Fix bitwise and boolean operations Greg Kroah-Hartman
` (43 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:44 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Bin Liu, Felipe Balbi
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bin Liu <b-liu@ti.com>
commit a53469a68eb886e84dd8b69a1458a623d3591793 upstream.
power off the phy should be done before populate the phy. Otherwise,
am335x_init() could be called by the phy owner to power on the phy first,
then am335x_phy_probe() turns off the phy again without the caller knowing
it.
Fixes: 2fc711d76352 ("usb: phy: am335x: Enable USB remote wakeup using PHY wakeup")
Cc: stable@vger.kernel.org # v3.18+
Signed-off-by: Bin Liu <b-liu@ti.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/phy/phy-am335x.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
--- a/drivers/usb/phy/phy-am335x.c
+++ b/drivers/usb/phy/phy-am335x.c
@@ -56,9 +56,6 @@ static int am335x_phy_probe(struct platf
if (ret)
return ret;
- ret = usb_add_phy_dev(&am_phy->usb_phy_gen.phy);
- if (ret)
- return ret;
am_phy->usb_phy_gen.phy.init = am335x_init;
am_phy->usb_phy_gen.phy.shutdown = am335x_shutdown;
@@ -77,7 +74,7 @@ static int am335x_phy_probe(struct platf
device_set_wakeup_enable(dev, false);
phy_ctrl_power(am_phy->phy_ctrl, am_phy->id, false);
- return 0;
+ return usb_add_phy_dev(&am_phy->usb_phy_gen.phy);
}
static int am335x_phy_remove(struct platform_device *pdev)
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 3.18 068/108] usb: gadget: udc: net2272: Fix bitwise and boolean operations
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (66 preceding siblings ...)
2019-02-18 13:44 ` [PATCH 3.18 067/108] usb: phy: am335x: fix race condition in _probe Greg Kroah-Hartman
@ 2019-02-18 13:44 ` Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 3.18 069/108] scsi: aic94xx: fix module loading Greg Kroah-Hartman
` (42 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Gustavo A. R. Silva, Felipe Balbi
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gustavo A. R. Silva <gustavo@embeddedor.com>
commit 07c69f1148da7de3978686d3af9263325d9d60bd upstream.
(!x & y) strikes again.
Fix bitwise and boolean operations by enclosing the expression:
intcsr & (1 << NET2272_PCI_IRQ)
in parentheses, before applying the boolean operator '!'.
Notice that this code has been there since 2011. So, it would
be helpful if someone can double-check this.
This issue was detected with the help of Coccinelle.
Fixes: ceb80363b2ec ("USB: net2272: driver for PLX NET2272 USB device controller")
Cc: stable@vger.kernel.org
Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/udc/net2272.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/gadget/udc/net2272.c
+++ b/drivers/usb/gadget/udc/net2272.c
@@ -2072,7 +2072,7 @@ static irqreturn_t net2272_irq(int irq,
#if defined(PLX_PCI_RDK2)
/* see if PCI int for us by checking irqstat */
intcsr = readl(dev->rdk2.fpga_base_addr + RDK2_IRQSTAT);
- if (!intcsr & (1 << NET2272_PCI_IRQ)) {
+ if (!(intcsr & (1 << NET2272_PCI_IRQ))) {
spin_unlock(&dev->lock);
return IRQ_NONE;
}
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 3.18 069/108] scsi: aic94xx: fix module loading
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (67 preceding siblings ...)
2019-02-18 13:44 ` [PATCH 3.18 068/108] usb: gadget: udc: net2272: Fix bitwise and boolean operations Greg Kroah-Hartman
@ 2019-02-18 13:44 ` Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 3.18 070/108] KVM: x86: work around leak of uninitialized stack contents (CVE-2019-7222) Greg Kroah-Hartman
` (41 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, James Bottomley, Martin K. Petersen
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Bottomley <James.Bottomley@HansenPartnership.com>
commit 42caa0edabd6a0a392ec36a5f0943924e4954311 upstream.
The aic94xx driver is currently failing to load with errors like
sysfs: cannot create duplicate filename '/devices/pci0000:00/0000:00:03.0/0000:02:00.3/0000:07:02.0/revision'
Because the PCI code had recently added a file named 'revision' to every
PCI device. Fix this by renaming the aic94xx revision file to
aic_revision. This is safe to do for us because as far as I can tell,
there's nothing in userspace relying on the current aic94xx revision file
so it can be renamed without breaking anything.
Fixes: 702ed3be1b1b (PCI: Create revision file in sysfs)
Cc: stable@vger.kernel.org
Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/aic94xx/aic94xx_init.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/drivers/scsi/aic94xx/aic94xx_init.c
+++ b/drivers/scsi/aic94xx/aic94xx_init.c
@@ -294,7 +294,7 @@ static ssize_t asd_show_dev_rev(struct d
return snprintf(buf, PAGE_SIZE, "%s\n",
asd_dev_rev[asd_ha->revision_id]);
}
-static DEVICE_ATTR(revision, S_IRUGO, asd_show_dev_rev, NULL);
+static DEVICE_ATTR(aic_revision, S_IRUGO, asd_show_dev_rev, NULL);
static ssize_t asd_show_dev_bios_build(struct device *dev,
struct device_attribute *attr,char *buf)
@@ -491,7 +491,7 @@ static int asd_create_dev_attrs(struct a
{
int err;
- err = device_create_file(&asd_ha->pcidev->dev, &dev_attr_revision);
+ err = device_create_file(&asd_ha->pcidev->dev, &dev_attr_aic_revision);
if (err)
return err;
@@ -513,13 +513,13 @@ err_update_bios:
err_biosb:
device_remove_file(&asd_ha->pcidev->dev, &dev_attr_bios_build);
err_rev:
- device_remove_file(&asd_ha->pcidev->dev, &dev_attr_revision);
+ device_remove_file(&asd_ha->pcidev->dev, &dev_attr_aic_revision);
return err;
}
static void asd_remove_dev_attrs(struct asd_ha_struct *asd_ha)
{
- device_remove_file(&asd_ha->pcidev->dev, &dev_attr_revision);
+ device_remove_file(&asd_ha->pcidev->dev, &dev_attr_aic_revision);
device_remove_file(&asd_ha->pcidev->dev, &dev_attr_bios_build);
device_remove_file(&asd_ha->pcidev->dev, &dev_attr_pcba_sn);
device_remove_file(&asd_ha->pcidev->dev, &dev_attr_update_bios);
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 3.18 070/108] KVM: x86: work around leak of uninitialized stack contents (CVE-2019-7222)
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (68 preceding siblings ...)
2019-02-18 13:44 ` [PATCH 3.18 069/108] scsi: aic94xx: fix module loading Greg Kroah-Hartman
@ 2019-02-18 13:44 ` Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 3.18 071/108] KVM: nVMX: unconditionally cancel preemption timer in free_nested (CVE-2019-7221) Greg Kroah-Hartman
` (40 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Felix Wilhelm, stable, Paolo Bonzini
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Bonzini <pbonzini@redhat.com>
commit 353c0956a618a07ba4bbe7ad00ff29fe70e8412a upstream.
Bugzilla: 1671930
Emulation of certain instructions (VMXON, VMCLEAR, VMPTRLD, VMWRITE with
memory operand, INVEPT, INVVPID) can incorrectly inject a page fault
when passed an operand that points to an MMIO address. The page fault
will use uninitialized kernel stack memory as the CR2 and error code.
The right behavior would be to abort the VM with a KVM_EXIT_INTERNAL_ERROR
exit to userspace; however, it is not an easy fix, so for now just
ensure that the error code and CR2 are zero.
Embargoed until Feb 7th 2019.
Reported-by: Felix Wilhelm <fwilhelm@google.com>
Cc: stable@kernel.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/x86.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -4279,6 +4279,13 @@ int kvm_read_guest_virt(struct x86_emula
struct kvm_vcpu *vcpu = emul_to_vcpu(ctxt);
u32 access = (kvm_x86_ops->get_cpl(vcpu) == 3) ? PFERR_USER_MASK : 0;
+ /*
+ * FIXME: this should call handle_emulation_failure if X86EMUL_IO_NEEDED
+ * is returned, but our callers are not ready for that and they blindly
+ * call kvm_inject_page_fault. Ensure that they at least do not leak
+ * uninitialized kernel stack memory into cr2 and error code.
+ */
+ memset(exception, 0, sizeof(*exception));
return kvm_read_guest_virt_helper(addr, val, bytes, vcpu, access,
exception);
}
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 3.18 071/108] KVM: nVMX: unconditionally cancel preemption timer in free_nested (CVE-2019-7221)
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (69 preceding siblings ...)
2019-02-18 13:44 ` [PATCH 3.18 070/108] KVM: x86: work around leak of uninitialized stack contents (CVE-2019-7222) Greg Kroah-Hartman
@ 2019-02-18 13:44 ` Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 3.18 072/108] perf/x86/intel/uncore: Add Node ID mask Greg Kroah-Hartman
` (39 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Peter Shier, Jim Mattson,
Felix Wilhelm, stable, Paolo Bonzini
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Shier <pshier@google.com>
commit ecec76885bcfe3294685dc363fd1273df0d5d65f upstream.
Bugzilla: 1671904
There are multiple code paths where an hrtimer may have been started to
emulate an L1 VMX preemption timer that can result in a call to free_nested
without an intervening L2 exit where the hrtimer is normally
cancelled. Unconditionally cancel in free_nested to cover all cases.
Embargoed until Feb 7th 2019.
Signed-off-by: Peter Shier <pshier@google.com>
Reported-by: Jim Mattson <jmattson@google.com>
Reviewed-by: Jim Mattson <jmattson@google.com>
Reported-by: Felix Wilhelm <fwilhelm@google.com>
Cc: stable@kernel.org
Message-Id: <20181011184646.154065-1-pshier@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/vmx.c | 1 +
1 file changed, 1 insertion(+)
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -6295,6 +6295,7 @@ static void free_nested(struct vcpu_vmx
if (!vmx->nested.vmxon)
return;
+ hrtimer_cancel(&vmx->nested.preemption_timer);
vmx->nested.vmxon = false;
nested_release_vmcs12(vmx);
if (enable_shadow_vmcs)
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 3.18 072/108] perf/x86/intel/uncore: Add Node ID mask
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (70 preceding siblings ...)
2019-02-18 13:44 ` [PATCH 3.18 071/108] KVM: nVMX: unconditionally cancel preemption timer in free_nested (CVE-2019-7221) Greg Kroah-Hartman
@ 2019-02-18 13:44 ` Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 3.18 073/108] perf/core: Dont WARN() for impossible ring-buffer sizes Greg Kroah-Hartman
` (38 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Song Liu, Kan Liang,
Peter Zijlstra (Intel),
Alexander Shishkin, Arnaldo Carvalho de Melo, Jiri Olsa,
Linus Torvalds, Thomas Gleixner, Ingo Molnar
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kan Liang <kan.liang@linux.intel.com>
commit 9e63a7894fd302082cf3627fe90844421a6cbe7f upstream.
Some PCI uncore PMUs cannot be registered on an 8-socket system (HPE
Superdome Flex).
To understand which Socket the PCI uncore PMUs belongs to, perf retrieves
the local Node ID of the uncore device from CPUNODEID(0xC0) of the PCI
configuration space, and the mapping between Socket ID and Node ID from
GIDNIDMAP(0xD4). The Socket ID can be calculated accordingly.
The local Node ID is only available at bit 2:0, but current code doesn't
mask it. If a BIOS doesn't clear the rest of the bits, an incorrect Node ID
will be fetched.
Filter the Node ID by adding a mask.
Reported-by: Song Liu <songliubraving@fb.com>
Tested-by: Song Liu <songliubraving@fb.com>
Signed-off-by: Kan Liang <kan.liang@linux.intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: <stable@vger.kernel.org> # v3.7+
Fixes: 7c94ee2e0917 ("perf/x86: Add Intel Nehalem and Sandy Bridge-EP uncore support")
Link: https://lkml.kernel.org/r/1548600794-33162-1-git-send-email-kan.liang@linux.intel.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/cpu/perf_event_intel_uncore_snbep.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/arch/x86/kernel/cpu/perf_event_intel_uncore_snbep.c
+++ b/arch/x86/kernel/cpu/perf_event_intel_uncore_snbep.c
@@ -1077,6 +1077,8 @@ static struct pci_driver snbep_uncore_pc
.id_table = snbep_uncore_pci_ids,
};
+#define NODE_ID_MASK 0x7
+
/*
* build pci bus to socket mapping
*/
@@ -1097,7 +1099,7 @@ static int snbep_pci2phy_map_init(int de
err = pci_read_config_dword(ubox_dev, 0x40, &config);
if (err)
break;
- nodeid = config;
+ nodeid = config & NODE_ID_MASK;
/* get the Node ID mapping */
err = pci_read_config_dword(ubox_dev, 0x54, &config);
if (err)
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 3.18 073/108] perf/core: Dont WARN() for impossible ring-buffer sizes
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (71 preceding siblings ...)
2019-02-18 13:44 ` [PATCH 3.18 072/108] perf/x86/intel/uncore: Add Node ID mask Greg Kroah-Hartman
@ 2019-02-18 13:44 ` Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 3.18 074/108] perf tests evsel-tp-sched: Fix bitwise operator Greg Kroah-Hartman
` (37 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Julien Thierry, Mark Rutland,
Peter Zijlstra (Intel),
Alexander Shishkin, Arnaldo Carvalho de Melo, Jiri Olsa,
Linus Torvalds, Namhyung Kim, Thomas Gleixner, Ingo Molnar
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <mark.rutland@arm.com>
commit 9dff0aa95a324e262ffb03f425d00e4751f3294e upstream.
The perf tool uses /proc/sys/kernel/perf_event_mlock_kb to determine how
large its ringbuffer mmap should be. This can be configured to arbitrary
values, which can be larger than the maximum possible allocation from
kmalloc.
When this is configured to a suitably large value (e.g. thanks to the
perf fuzzer), attempting to use perf record triggers a WARN_ON_ONCE() in
__alloc_pages_nodemask():
WARNING: CPU: 2 PID: 5666 at mm/page_alloc.c:4511 __alloc_pages_nodemask+0x3f8/0xbc8
Let's avoid this by checking that the requested allocation is possible
before calling kzalloc.
Reported-by: Julien Thierry <julien.thierry@arm.com>
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Julien Thierry <julien.thierry@arm.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: <stable@vger.kernel.org>
Link: https://lkml.kernel.org/r/20190110142745.25495-1-mark.rutland@arm.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/events/ring_buffer.c | 3 +++
1 file changed, 3 insertions(+)
--- a/kernel/events/ring_buffer.c
+++ b/kernel/events/ring_buffer.c
@@ -282,6 +282,9 @@ struct ring_buffer *rb_alloc(int nr_page
size = sizeof(struct ring_buffer);
size += nr_pages * sizeof(void *);
+ if (order_base_2(size) >= MAX_ORDER)
+ goto fail;
+
rb = kzalloc(size, GFP_KERNEL);
if (!rb)
goto fail;
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 3.18 074/108] perf tests evsel-tp-sched: Fix bitwise operator
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (72 preceding siblings ...)
2019-02-18 13:44 ` [PATCH 3.18 073/108] perf/core: Dont WARN() for impossible ring-buffer sizes Greg Kroah-Hartman
@ 2019-02-18 13:44 ` Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 3.18 075/108] mtd: rawnand: gpmi: fix MX28 bus master lockup problem Greg Kroah-Hartman
` (36 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Gustavo A. R. Silva, Jiri Olsa,
Alexander Shishkin, Namhyung Kim, Peter Zijlstra,
Arnaldo Carvalho de Melo
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gustavo A. R. Silva <gustavo@embeddedor.com>
commit 489338a717a0dfbbd5a3fabccf172b78f0ac9015 upstream.
Notice that the use of the bitwise OR operator '|' always leads to true
in this particular case, which seems a bit suspicious due to the context
in which this expression is being used.
Fix this by using bitwise AND operator '&' instead.
This bug was detected with the help of Coccinelle.
Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
Acked-by: Jiri Olsa <jolsa@kernel.org>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: stable@vger.kernel.org
Fixes: 6a6cd11d4e57 ("perf test: Add test for the sched tracepoint format fields")
Link: http://lkml.kernel.org/r/20190122233439.GA5868@embeddedor
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/perf/tests/evsel-tp-sched.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/tools/perf/tests/evsel-tp-sched.c
+++ b/tools/perf/tests/evsel-tp-sched.c
@@ -15,7 +15,7 @@ static int perf_evsel__test_field(struct
return -1;
}
- is_signed = !!(field->flags | FIELD_IS_SIGNED);
+ is_signed = !!(field->flags & FIELD_IS_SIGNED);
if (should_be_signed && !is_signed) {
pr_debug("%s: \"%s\" signedness(%d) is wrong, should be %d\n",
evsel->name, name, is_signed, should_be_signed);
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 3.18 075/108] mtd: rawnand: gpmi: fix MX28 bus master lockup problem
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (73 preceding siblings ...)
2019-02-18 13:44 ` [PATCH 3.18 074/108] perf tests evsel-tp-sched: Fix bitwise operator Greg Kroah-Hartman
@ 2019-02-18 13:44 ` Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 3.18 076/108] signal: Always notice exiting tasks Greg Kroah-Hartman
` (35 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Manfred Schlaegl, Martin Kepplinger,
Miquel Raynal, Fabio Estevam, Han Xu, Boris Brezillon
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Kepplinger <martin.kepplinger@ginzinger.com>
commit d5d27fd9826b59979b184ec288e4812abac0e988 upstream.
Disable BCH soft reset according to MX23 erratum #2847 ("BCH soft
reset may cause bus master lock up") for MX28 too. It has the same
problem.
Observed problem: once per 100,000+ MX28 reboots NAND read failed on
DMA timeout errors:
[ 1.770823] UBI: attaching mtd3 to ubi0
[ 2.768088] gpmi_nand: DMA timeout, last DMA :1
[ 3.958087] gpmi_nand: BCH timeout, last DMA :1
[ 4.156033] gpmi_nand: Error in ECC-based read: -110
[ 4.161136] UBI warning: ubi_io_read: error -110 while reading 64
bytes from PEB 0:0, read only 0 bytes, retry
[ 4.171283] step 1 error
[ 4.173846] gpmi_nand: Chip: 0, Error -1
Without BCH soft reset we successfully executed 1,000,000 MX28 reboots.
I have a quote from NXP regarding this problem, from July 18th 2016:
"As the i.MX23 and i.MX28 are of the same generation, they share many
characteristics. Unfortunately, also the erratas may be shared.
In case of the documented erratas and the workarounds, you can also
apply the workaround solution of one device on the other one. This have
been reported, but I’m afraid that there are not an estimated date for
updating the Errata documents.
Please accept our apologies for any inconveniences this may cause."
Fixes: 6f2a6a52560a ("mtd: nand: gpmi: reset BCH earlier, too, to avoid NAND startup problems")
Cc: stable@vger.kernel.org
Signed-off-by: Manfred Schlaegl <manfred.schlaegl@ginzinger.com>
Signed-off-by: Martin Kepplinger <martin.kepplinger@ginzinger.com>
Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
Reviewed-by: Fabio Estevam <festevam@gmail.com>
Acked-by: Han Xu <han.xu@nxp.com>
Signed-off-by: Boris Brezillon <bbrezillon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/nand/gpmi-nand/gpmi-lib.c | 15 +++++++--------
1 file changed, 7 insertions(+), 8 deletions(-)
--- a/drivers/mtd/nand/gpmi-nand/gpmi-lib.c
+++ b/drivers/mtd/nand/gpmi-nand/gpmi-lib.c
@@ -168,9 +168,10 @@ int gpmi_init(struct gpmi_nand_data *thi
/*
* Reset BCH here, too. We got failures otherwise :(
- * See later BCH reset for explanation of MX23 handling
+ * See later BCH reset for explanation of MX23 and MX28 handling
*/
- ret = gpmi_reset_block(r->bch_regs, GPMI_IS_MX23(this));
+ ret = gpmi_reset_block(r->bch_regs,
+ GPMI_IS_MX23(this) || GPMI_IS_MX28(this));
if (ret)
goto err_out;
@@ -274,13 +275,11 @@ int bch_set_geometry(struct gpmi_nand_da
/*
* Due to erratum #2847 of the MX23, the BCH cannot be soft reset on this
- * chip, otherwise it will lock up. So we skip resetting BCH on the MX23.
- * On the other hand, the MX28 needs the reset, because one case has been
- * seen where the BCH produced ECC errors constantly after 10000
- * consecutive reboots. The latter case has not been seen on the MX23
- * yet, still we don't know if it could happen there as well.
+ * chip, otherwise it will lock up. So we skip resetting BCH on the MX23
+ * and MX28.
*/
- ret = gpmi_reset_block(r->bch_regs, GPMI_IS_MX23(this));
+ ret = gpmi_reset_block(r->bch_regs,
+ GPMI_IS_MX23(this) || GPMI_IS_MX28(this));
if (ret)
goto err_out;
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 3.18 076/108] signal: Always notice exiting tasks
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (74 preceding siblings ...)
2019-02-18 13:44 ` [PATCH 3.18 075/108] mtd: rawnand: gpmi: fix MX28 bus master lockup problem Greg Kroah-Hartman
@ 2019-02-18 13:44 ` Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 3.18 077/108] signal: Better detection of synchronous signals Greg Kroah-Hartman
` (34 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:44 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dmitry Vyukov, Eric W. Biederman
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric W. Biederman <ebiederm@xmission.com>
commit 35634ffa1751b6efd8cf75010b509dcb0263e29b upstream.
Recently syzkaller was able to create unkillablle processes by
creating a timer that is delivered as a thread local signal on SIGHUP,
and receiving SIGHUP SA_NODEFERER. Ultimately causing a loop
failing to deliver SIGHUP but always trying.
Upon examination it turns out part of the problem is actually most of
the solution. Since 2.5 signal delivery has found all fatal signals,
marked the signal group for death, and queued SIGKILL in every threads
thread queue relying on signal->group_exit_code to preserve the
information of which was the actual fatal signal.
The conversion of all fatal signals to SIGKILL results in the
synchronous signal heuristic in next_signal kicking in and preferring
SIGHUP to SIGKILL. Which is especially problematic as all
fatal signals have already been transformed into SIGKILL.
Instead of dequeueing signals and depending upon SIGKILL to
be the first signal dequeued, first test if the signal group
has already been marked for death. This guarantees that
nothing in the signal queue can prevent a process that needs
to exit from exiting.
Cc: stable@vger.kernel.org
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Ref: ebf5ebe31d2c ("[PATCH] signal-fixes-2.5.59-A4")
History Tree: https://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/signal.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -2241,6 +2241,11 @@ relock:
goto relock;
}
+ /* Has this task already been marked for death? */
+ ksig->info.si_signo = signr = SIGKILL;
+ if (signal_group_exit(signal))
+ goto fatal;
+
for (;;) {
struct k_sigaction *ka;
@@ -2336,6 +2341,7 @@ relock:
continue;
}
+ fatal:
spin_unlock_irq(&sighand->siglock);
/*
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 3.18 077/108] signal: Better detection of synchronous signals
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (75 preceding siblings ...)
2019-02-18 13:44 ` [PATCH 3.18 076/108] signal: Always notice exiting tasks Greg Kroah-Hartman
@ 2019-02-18 13:44 ` Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 3.18 078/108] misc: vexpress: Off by one in vexpress_syscfg_exec() Greg Kroah-Hartman
` (33 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:44 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dmitry Vyukov, Eric W. Biederman
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric W. Biederman <ebiederm@xmission.com>
commit 7146db3317c67b517258cb5e1b08af387da0618b upstream.
Recently syzkaller was able to create unkillablle processes by
creating a timer that is delivered as a thread local signal on SIGHUP,
and receiving SIGHUP SA_NODEFERER. Ultimately causing a loop failing
to deliver SIGHUP but always trying.
When the stack overflows delivery of SIGHUP fails and force_sigsegv is
called. Unfortunately because SIGSEGV is numerically higher than
SIGHUP next_signal tries again to deliver a SIGHUP.
>From a quality of implementation standpoint attempting to deliver the
timer SIGHUP signal is wrong. We should attempt to deliver the
synchronous SIGSEGV signal we just forced.
We can make that happening in a fairly straight forward manner by
instead of just looking at the signal number we also look at the
si_code. In particular for exceptions (aka synchronous signals) the
si_code is always greater than 0.
That still has the potential to pick up a number of asynchronous
signals as in a few cases the same si_codes that are used
for synchronous signals are also used for asynchronous signals,
and SI_KERNEL is also included in the list of possible si_codes.
Still the heuristic is much better and timer signals are definitely
excluded. Which is enough to prevent all known ways for someone
sending a process signals fast enough to cause unexpected and
arguably incorrect behavior.
Cc: stable@vger.kernel.org
Fixes: a27341cd5fcb ("Prioritize synchronous signals over 'normal' signals")
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/signal.c | 52 +++++++++++++++++++++++++++++++++++++++++++++++++++-
1 file changed, 51 insertions(+), 1 deletion(-)
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -686,6 +686,48 @@ int dequeue_signal(struct task_struct *t
return signr;
}
+static int dequeue_synchronous_signal(siginfo_t *info)
+{
+ struct task_struct *tsk = current;
+ struct sigpending *pending = &tsk->pending;
+ struct sigqueue *q, *sync = NULL;
+
+ /*
+ * Might a synchronous signal be in the queue?
+ */
+ if (!((pending->signal.sig[0] & ~tsk->blocked.sig[0]) & SYNCHRONOUS_MASK))
+ return 0;
+
+ /*
+ * Return the first synchronous signal in the queue.
+ */
+ list_for_each_entry(q, &pending->list, list) {
+ /* Synchronous signals have a postive si_code */
+ if ((q->info.si_code > SI_USER) &&
+ (sigmask(q->info.si_signo) & SYNCHRONOUS_MASK)) {
+ sync = q;
+ goto next;
+ }
+ }
+ return 0;
+next:
+ /*
+ * Check if there is another siginfo for the same signal.
+ */
+ list_for_each_entry_continue(q, &pending->list, list) {
+ if (q->info.si_signo == sync->info.si_signo)
+ goto still_pending;
+ }
+
+ sigdelset(&pending->signal, sync->info.si_signo);
+ recalc_sigpending();
+still_pending:
+ list_del_init(&sync->list);
+ copy_siginfo(info, &sync->info);
+ __sigqueue_free(sync);
+ return info->si_signo;
+}
+
/*
* Tell a process that it has a new active signal..
*
@@ -2259,7 +2301,15 @@ relock:
goto relock;
}
- signr = dequeue_signal(current, ¤t->blocked, &ksig->info);
+ /*
+ * Signals generated by the execution of an instruction
+ * need to be delivered before any other pending signals
+ * so that the instruction pointer in the signal stack
+ * frame points to the faulting instruction.
+ */
+ signr = dequeue_synchronous_signal(&ksig->info);
+ if (!signr)
+ signr = dequeue_signal(current, ¤t->blocked, &ksig->info);
if (!signr)
break; /* will return 0 */
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 3.18 078/108] misc: vexpress: Off by one in vexpress_syscfg_exec()
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (76 preceding siblings ...)
2019-02-18 13:44 ` [PATCH 3.18 077/108] signal: Better detection of synchronous signals Greg Kroah-Hartman
@ 2019-02-18 13:44 ` Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 3.18 079/108] debugfs: fix debugfs_rename parameter checking Greg Kroah-Hartman
` (32 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:44 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Sudeep Holla
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
commit f8a70d8b889f180e6860cb1f85fed43d37844c5a upstream.
The > comparison should be >= to prevent reading beyond the end of the
func->template[] array.
(The func->template array is allocated in vexpress_syscfg_regmap_init()
and it has func->num_templates elements.)
Fixes: 974cc7b93441 ("mfd: vexpress: Define the device as MFD cells")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Sudeep Holla <sudeep.holla@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/misc/vexpress-syscfg.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/misc/vexpress-syscfg.c
+++ b/drivers/misc/vexpress-syscfg.c
@@ -61,7 +61,7 @@ static int vexpress_syscfg_exec(struct v
int tries;
long timeout;
- if (WARN_ON(index > func->num_templates))
+ if (WARN_ON(index >= func->num_templates))
return -EINVAL;
command = readl(syscfg->base + SYS_CFGCTRL);
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 3.18 079/108] debugfs: fix debugfs_rename parameter checking
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (77 preceding siblings ...)
2019-02-18 13:44 ` [PATCH 3.18 078/108] misc: vexpress: Off by one in vexpress_syscfg_exec() Greg Kroah-Hartman
@ 2019-02-18 13:44 ` Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 3.18 080/108] MIPS: OCTEON: dont set octeon_dma_bar_type if PCI is disabled Greg Kroah-Hartman
` (31 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:44 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit d88c93f090f708c18195553b352b9f205e65418f upstream.
debugfs_rename() needs to check that the dentries passed into it really
are valid, as sometimes they are not (i.e. if the return value of
another debugfs call is passed into this one.) So fix this up by
properly checking if the two parent directories are errors (they are
allowed to be NULL), and if the dentry to rename is not NULL or an
error.
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/debugfs/inode.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/fs/debugfs/inode.c
+++ b/fs/debugfs/inode.c
@@ -622,6 +622,13 @@ struct dentry *debugfs_rename(struct den
struct dentry *dentry = NULL, *trap;
struct name_snapshot old_name;
+ if (IS_ERR(old_dir))
+ return old_dir;
+ if (IS_ERR(new_dir))
+ return new_dir;
+ if (IS_ERR_OR_NULL(old_dentry))
+ return old_dentry;
+
trap = lock_rename(new_dir, old_dir);
/* Source or destination directories don't exist? */
if (!old_dir->d_inode || !new_dir->d_inode)
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 3.18 080/108] MIPS: OCTEON: dont set octeon_dma_bar_type if PCI is disabled
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (78 preceding siblings ...)
2019-02-18 13:44 ` [PATCH 3.18 079/108] debugfs: fix debugfs_rename parameter checking Greg Kroah-Hartman
@ 2019-02-18 13:44 ` Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 3.18 081/108] ARM: iop32x/n2100: fix PCI IRQ mapping Greg Kroah-Hartman
` (30 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Aaro Koskinen, Paul Burton, linux-mips
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aaro Koskinen <aaro.koskinen@iki.fi>
commit dcf300a69ac307053dfb35c2e33972e754a98bce upstream.
Don't set octeon_dma_bar_type if PCI is disabled. This avoids creation
of the MSI irqchip later on, and saves a bit of memory.
Signed-off-by: Aaro Koskinen <aaro.koskinen@iki.fi>
Signed-off-by: Paul Burton <paul.burton@mips.com>
Fixes: a214720cbf50 ("Disable MSI also when pcie-octeon.pcie_disable on")
Cc: stable@vger.kernel.org # v3.3+
Cc: linux-mips@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/mips/pci/pci-octeon.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
--- a/arch/mips/pci/pci-octeon.c
+++ b/arch/mips/pci/pci-octeon.c
@@ -571,6 +571,11 @@ static int __init octeon_pci_setup(void)
if (octeon_has_feature(OCTEON_FEATURE_PCIE))
return 0;
+ if (!octeon_is_pci_host()) {
+ pr_notice("Not in host mode, PCI Controller not initialized\n");
+ return 0;
+ }
+
/* Point pcibios_map_irq() to the PCI version of it */
octeon_pcibios_map_irq = octeon_pci_pcibios_map_irq;
@@ -582,11 +587,6 @@ static int __init octeon_pci_setup(void)
else
octeon_dma_bar_type = OCTEON_DMA_BAR_TYPE_BIG;
- if (!octeon_is_pci_host()) {
- pr_notice("Not in host mode, PCI Controller not initialized\n");
- return 0;
- }
-
/* PCI I/O and PCI MEM values */
set_io_port_base(OCTEON_PCI_IOSPACE_BASE);
ioport_resource.start = 0;
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 3.18 081/108] ARM: iop32x/n2100: fix PCI IRQ mapping
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (79 preceding siblings ...)
2019-02-18 13:44 ` [PATCH 3.18 080/108] MIPS: OCTEON: dont set octeon_dma_bar_type if PCI is disabled Greg Kroah-Hartman
@ 2019-02-18 13:44 ` Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 3.18 082/108] drm/modes: Prevent division by zero htotal Greg Kroah-Hartman
` (29 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:44 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Russell King, Arnd Bergmann
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Russell King <rmk+kernel@armlinux.org.uk>
commit db4090920ba2d61a5827a23e441447926a02ffee upstream.
Booting 4.20 on a TheCUS N2100 results in a kernel oops while probing
PCI, due to n2100_pci_map_irq() having been discarded during boot.
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Cc: stable@vger.kernel.org # 2.6.18+
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/mach-iop32x/n2100.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/arch/arm/mach-iop32x/n2100.c
+++ b/arch/arm/mach-iop32x/n2100.c
@@ -75,8 +75,7 @@ void __init n2100_map_io(void)
/*
* N2100 PCI.
*/
-static int __init
-n2100_pci_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
+static int n2100_pci_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
{
int irq;
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 3.18 082/108] drm/modes: Prevent division by zero htotal
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (80 preceding siblings ...)
2019-02-18 13:44 ` [PATCH 3.18 081/108] ARM: iop32x/n2100: fix PCI IRQ mapping Greg Kroah-Hartman
@ 2019-02-18 13:44 ` Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 3.18 083/108] drm/vmwgfx: Fix setting of dma masks Greg Kroah-Hartman
` (28 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tina Zhang, Adam Jackson,
Dave Airlie, Daniel Vetter, Daniel Vetter
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tina Zhang <tina.zhang@intel.com>
commit a2fcd5c84f7a7825e028381b10182439067aa90d upstream.
This patch prevents division by zero htotal.
In a follow-up mail Tina writes:
> > How did you manage to get here with htotal == 0? This needs backtraces (or if
> > this is just about static checkers, a mention of that).
> > -Daniel
>
> In GVT-g, we are trying to enable a virtual display w/o setting timings for a pipe
> (a.k.a htotal=0), then we met the following kernel panic:
>
> [ 32.832048] divide error: 0000 [#1] SMP PTI
> [ 32.833614] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.18.0-rc4-sriov+ #33
> [ 32.834438] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.10.1-0-g8891697-dirty-20180511_165818-tinazhang-linux-1 04/01/2014
> [ 32.835901] RIP: 0010:drm_mode_hsync+0x1e/0x40
> [ 32.836004] Code: 31 c0 c3 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 8b 87 d8 00 00 00 85 c0 75 22 8b 4f 68 85 c9 78 1b 69 47 58 e8 03 00 00 99 <f7> f9 b9 d3 4d 62 10 05 f4 01 00 00 f7 e1 89 d0 c1 e8 06 f3 c3 66
> [ 32.836004] RSP: 0000:ffffc900000ebb90 EFLAGS: 00010206
> [ 32.836004] RAX: 0000000000000000 RBX: ffff88001c67c8a0 RCX: 0000000000000000
> [ 32.836004] RDX: 0000000000000000 RSI: ffff88001c67c000 RDI: ffff88001c67c8a0
> [ 32.836004] RBP: ffff88001c7d03a0 R08: ffff88001c67c8a0 R09: ffff88001c7d0330
> [ 32.836004] R10: ffffffff822c3a98 R11: 0000000000000001 R12: ffff88001c67c000
> [ 32.836004] R13: ffff88001c7d0370 R14: ffffffff8207eb78 R15: ffff88001c67c800
> [ 32.836004] FS: 0000000000000000(0000) GS:ffff88001da00000(0000) knlGS:0000000000000000
> [ 32.836004] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 32.836004] CR2: 0000000000000000 CR3: 000000000220a000 CR4: 00000000000006f0
> [ 32.836004] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> [ 32.836004] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> [ 32.836004] Call Trace:
> [ 32.836004] intel_mode_from_pipe_config+0x72/0x90
> [ 32.836004] intel_modeset_setup_hw_state+0x569/0xf90
> [ 32.836004] intel_modeset_init+0x905/0x1db0
> [ 32.836004] i915_driver_load+0xb8c/0x1120
> [ 32.836004] i915_pci_probe+0x4d/0xb0
> [ 32.836004] local_pci_probe+0x44/0xa0
> [ 32.836004] ? pci_assign_irq+0x27/0x130
> [ 32.836004] pci_device_probe+0x102/0x1c0
> [ 32.836004] driver_probe_device+0x2b8/0x480
> [ 32.836004] __driver_attach+0x109/0x110
> [ 32.836004] ? driver_probe_device+0x480/0x480
> [ 32.836004] bus_for_each_dev+0x67/0xc0
> [ 32.836004] ? klist_add_tail+0x3b/0x70
> [ 32.836004] bus_add_driver+0x1e8/0x260
> [ 32.836004] driver_register+0x5b/0xe0
> [ 32.836004] ? mipi_dsi_bus_init+0x11/0x11
> [ 32.836004] do_one_initcall+0x4d/0x1eb
> [ 32.836004] kernel_init_freeable+0x197/0x237
> [ 32.836004] ? rest_init+0xd0/0xd0
> [ 32.836004] kernel_init+0xa/0x110
> [ 32.836004] ret_from_fork+0x35/0x40
> [ 32.836004] Modules linked in:
> [ 32.859183] ---[ end trace 525608b0ed0e8665 ]---
> [ 32.859722] RIP: 0010:drm_mode_hsync+0x1e/0x40
> [ 32.860287] Code: 31 c0 c3 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 8b 87 d8 00 00 00 85 c0 75 22 8b 4f 68 85 c9 78 1b 69 47 58 e8 03 00 00 99 <f7> f9 b9 d3 4d 62 10 05 f4 01 00 00 f7 e1 89 d0 c1 e8 06 f3 c3 66
> [ 32.862680] RSP: 0000:ffffc900000ebb90 EFLAGS: 00010206
> [ 32.863309] RAX: 0000000000000000 RBX: ffff88001c67c8a0 RCX: 0000000000000000
> [ 32.864182] RDX: 0000000000000000 RSI: ffff88001c67c000 RDI: ffff88001c67c8a0
> [ 32.865206] RBP: ffff88001c7d03a0 R08: ffff88001c67c8a0 R09: ffff88001c7d0330
> [ 32.866359] R10: ffffffff822c3a98 R11: 0000000000000001 R12: ffff88001c67c000
> [ 32.867213] R13: ffff88001c7d0370 R14: ffffffff8207eb78 R15: ffff88001c67c800
> [ 32.868075] FS: 0000000000000000(0000) GS:ffff88001da00000(0000) knlGS:0000000000000000
> [ 32.868983] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 32.869659] CR2: 0000000000000000 CR3: 000000000220a000 CR4: 00000000000006f0
> [ 32.870599] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> [ 32.871598] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> [ 32.872549] Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b
>
> Since drm_mode_hsync() has the logic to check mode->htotal, I just extend it to cover the case htotal==0.
Signed-off-by: Tina Zhang <tina.zhang@intel.com>
Cc: Adam Jackson <ajax@redhat.com>
Cc: Dave Airlie <airlied@redhat.com>
Cc: Daniel Vetter <daniel@ffwll.ch>
[danvet: Add additional explanations + cc: stable.]
Cc: stable@vger.kernel.org
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/1548228539-3061-1-git-send-email-tina.zhang@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/drm_modes.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/drm_modes.c
+++ b/drivers/gpu/drm/drm_modes.c
@@ -682,7 +682,7 @@ int drm_mode_hsync(const struct drm_disp
if (mode->hsync)
return mode->hsync;
- if (mode->htotal < 0)
+ if (mode->htotal <= 0)
return 0;
calc_val = (mode->clock * 1000) / mode->htotal; /* hsync in Hz */
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 3.18 083/108] drm/vmwgfx: Fix setting of dma masks
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (81 preceding siblings ...)
2019-02-18 13:44 ` [PATCH 3.18 082/108] drm/modes: Prevent division by zero htotal Greg Kroah-Hartman
@ 2019-02-18 13:44 ` Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 3.18 084/108] drm/vmwgfx: Return error code from vmw_execbuf_copy_fence_user Greg Kroah-Hartman
` (27 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:44 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Thomas Hellstrom, Deepak Rawat
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Hellstrom <thellstrom@vmware.com>
commit 4cbfa1e6c09e98450aab3240e5119b0ab2c9795b upstream.
Previously we set only the dma mask and not the coherent mask. Fix that.
Also, for clarity, make sure both are initially set to 64 bits.
Cc: <stable@vger.kernel.org>
Fixes: 0d00c488f3de: ("drm/vmwgfx: Fix the driver for large dma addresses")
Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
Reviewed-by: Deepak Rawat <drawat@vmware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
@@ -562,13 +562,16 @@ out_fixup:
static int vmw_dma_masks(struct vmw_private *dev_priv)
{
struct drm_device *dev = dev_priv->dev;
+ int ret = 0;
- if (intel_iommu_enabled &&
+ ret = dma_set_mask_and_coherent(dev->dev, DMA_BIT_MASK(64));
+ if (dev_priv->map_mode != vmw_dma_phys &&
(sizeof(unsigned long) == 4 || vmw_restrict_dma_mask)) {
DRM_INFO("Restricting DMA addresses to 44 bits.\n");
- return dma_set_mask(dev->dev, DMA_BIT_MASK(44));
+ return dma_set_mask_and_coherent(dev->dev, DMA_BIT_MASK(44));
}
- return 0;
+
+ return ret;
}
#else
static int vmw_dma_masks(struct vmw_private *dev_priv)
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 3.18 084/108] drm/vmwgfx: Return error code from vmw_execbuf_copy_fence_user
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (82 preceding siblings ...)
2019-02-18 13:44 ` [PATCH 3.18 083/108] drm/vmwgfx: Fix setting of dma masks Greg Kroah-Hartman
@ 2019-02-18 13:44 ` Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 3.18 085/108] HID: debug: fix the ring buffer implementation Greg Kroah-Hartman
` (26 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:44 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Thomas Hellstrom, Deepak Rawat
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Hellstrom <thellstrom@vmware.com>
commit 728354c005c36eaf44b6e5552372b67e60d17f56 upstream.
The function was unconditionally returning 0, and a caller would have to
rely on the returned fence pointer being NULL to detect errors. However,
the function vmw_execbuf_copy_fence_user() would expect a non-zero error
code in that case and would BUG otherwise.
So make sure we return a proper non-zero error code if the fence pointer
returned is NULL.
Cc: <stable@vger.kernel.org>
Fixes: ae2a104058e2: ("vmwgfx: Implement fence objects")
Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
Reviewed-by: Deepak Rawat <drawat@vmware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
@@ -2346,7 +2346,7 @@ int vmw_execbuf_fence_commands(struct dr
*p_fence = NULL;
}
- return 0;
+ return ret;
}
/**
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 3.18 085/108] HID: debug: fix the ring buffer implementation
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (83 preceding siblings ...)
2019-02-18 13:44 ` [PATCH 3.18 084/108] drm/vmwgfx: Return error code from vmw_execbuf_copy_fence_user Greg Kroah-Hartman
@ 2019-02-18 13:44 ` Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 3.18 086/108] libceph: avoid KEEPALIVE_PENDING races in ceph_con_keepalive() Greg Kroah-Hartman
` (25 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Vladis Dronov, Oleg Nesterov,
Benjamin Tissoires
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladis Dronov <vdronov@redhat.com>
commit 13054abbaa4f1fd4e6f3b4b63439ec033b4c8035 upstream.
Ring buffer implementation in hid_debug_event() and hid_debug_events_read()
is strange allowing lost or corrupted data. After commit 717adfdaf147
("HID: debug: check length before copy_to_user()") it is possible to enter
an infinite loop in hid_debug_events_read() by providing 0 as count, this
locks up a system. Fix this by rewriting the ring buffer implementation
with kfifo and simplify the code.
This fixes CVE-2019-3819.
v2: fix an execution logic and add a comment
v3: use __set_current_state() instead of set_current_state()
Backport to v3.18: some (tree-wide) patches are missing in v3.18 so
cherry-pick relevant pieces from:
* 6396bb221514 ("treewide: kzalloc() -> kcalloc()")
* a9a08845e9ac ("vfs: do bulk POLL* -> EPOLL* replacement")
* 92529623d242 ("HID: debug: improve hid_debug_event()")
* 174cd4b1e5fb ("sched/headers: Prepare to move signal wakeup & sigpending
methods from <linux/sched.h> into <linux/sched/signal.h>")
* 8fec02a73e31 ("HID: debug: fix error handling in hid_debug_events_read()")
Link: https://bugzilla.redhat.com/show_bug.cgi?id=1669187
Cc: stable@vger.kernel.org # v4.18+
Fixes: cd667ce24796 ("HID: use debugfs for events/reports dumping")
Fixes: 717adfdaf147 ("HID: debug: check length before copy_to_user()")
Signed-off-by: Vladis Dronov <vdronov@redhat.com>
Reviewed-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-debug.c | 121 ++++++++++++++++++----------------------------
include/linux/hid-debug.h | 9 +--
2 files changed, 52 insertions(+), 78 deletions(-)
--- a/drivers/hid/hid-debug.c
+++ b/drivers/hid/hid-debug.c
@@ -30,6 +30,7 @@
#include <linux/debugfs.h>
#include <linux/seq_file.h>
+#include <linux/kfifo.h>
#include <linux/sched.h>
#include <linux/export.h>
#include <linux/slab.h>
@@ -454,7 +455,7 @@ static char *resolv_usage_page(unsigned
char *buf = NULL;
if (!f) {
- buf = kzalloc(sizeof(char) * HID_DEBUG_BUFSIZE, GFP_ATOMIC);
+ buf = kzalloc(HID_DEBUG_BUFSIZE, GFP_ATOMIC);
if (!buf)
return ERR_PTR(-ENOMEM);
}
@@ -658,17 +659,12 @@ EXPORT_SYMBOL_GPL(hid_dump_device);
/* enqueue string to 'events' ring buffer */
void hid_debug_event(struct hid_device *hdev, char *buf)
{
- int i;
struct hid_debug_list *list;
unsigned long flags;
spin_lock_irqsave(&hdev->debug_list_lock, flags);
- list_for_each_entry(list, &hdev->debug_list, node) {
- for (i = 0; i < strlen(buf); i++)
- list->hid_debug_buf[(list->tail + i) % HID_DEBUG_BUFSIZE] =
- buf[i];
- list->tail = (list->tail + i) % HID_DEBUG_BUFSIZE;
- }
+ list_for_each_entry(list, &hdev->debug_list, node)
+ kfifo_in(&list->hid_debug_fifo, buf, strlen(buf));
spin_unlock_irqrestore(&hdev->debug_list_lock, flags);
wake_up_interruptible(&hdev->debug_wait);
@@ -719,8 +715,7 @@ void hid_dump_input(struct hid_device *h
hid_debug_event(hdev, buf);
kfree(buf);
- wake_up_interruptible(&hdev->debug_wait);
-
+ wake_up_interruptible(&hdev->debug_wait);
}
EXPORT_SYMBOL_GPL(hid_dump_input);
@@ -1085,8 +1080,8 @@ static int hid_debug_events_open(struct
goto out;
}
- if (!(list->hid_debug_buf = kzalloc(sizeof(char) * HID_DEBUG_BUFSIZE, GFP_KERNEL))) {
- err = -ENOMEM;
+ err = kfifo_alloc(&list->hid_debug_fifo, HID_DEBUG_FIFOSIZE, GFP_KERNEL);
+ if (err) {
kfree(list);
goto out;
}
@@ -1106,76 +1101,57 @@ static ssize_t hid_debug_events_read(str
size_t count, loff_t *ppos)
{
struct hid_debug_list *list = file->private_data;
- int ret = 0, len;
+ int ret = 0, copied;
DECLARE_WAITQUEUE(wait, current);
mutex_lock(&list->read_mutex);
- while (ret == 0) {
- if (list->head == list->tail) {
- add_wait_queue(&list->hdev->debug_wait, &wait);
- set_current_state(TASK_INTERRUPTIBLE);
-
- while (list->head == list->tail) {
- if (file->f_flags & O_NONBLOCK) {
- ret = -EAGAIN;
- break;
- }
- if (signal_pending(current)) {
- ret = -ERESTARTSYS;
- break;
- }
-
- if (!list->hdev || !list->hdev->debug) {
- ret = -EIO;
- break;
- }
-
- /* allow O_NONBLOCK from other threads */
- mutex_unlock(&list->read_mutex);
- schedule();
- mutex_lock(&list->read_mutex);
- set_current_state(TASK_INTERRUPTIBLE);
+ if (kfifo_is_empty(&list->hid_debug_fifo)) {
+ add_wait_queue(&list->hdev->debug_wait, &wait);
+ set_current_state(TASK_INTERRUPTIBLE);
+
+ while (kfifo_is_empty(&list->hid_debug_fifo)) {
+ if (file->f_flags & O_NONBLOCK) {
+ ret = -EAGAIN;
+ break;
}
- set_current_state(TASK_RUNNING);
- remove_wait_queue(&list->hdev->debug_wait, &wait);
- }
-
- if (ret)
- goto out;
-
- /* pass the ringbuffer contents to userspace */
-copy_rest:
- if (list->tail == list->head)
- goto out;
- if (list->tail > list->head) {
- len = list->tail - list->head;
- if (len > count)
- len = count;
-
- if (copy_to_user(buffer + ret, &list->hid_debug_buf[list->head], len)) {
- ret = -EFAULT;
- goto out;
+ if (signal_pending(current)) {
+ ret = -ERESTARTSYS;
+ break;
}
- ret += len;
- list->head += len;
- } else {
- len = HID_DEBUG_BUFSIZE - list->head;
- if (len > count)
- len = count;
- if (copy_to_user(buffer, &list->hid_debug_buf[list->head], len)) {
- ret = -EFAULT;
+ /* if list->hdev is NULL we cannot remove_wait_queue().
+ * if list->hdev->debug is 0 then hid_debug_unregister()
+ * was already called and list->hdev is being destroyed.
+ * if we add remove_wait_queue() here we can hit a race.
+ */
+ if (!list->hdev || !list->hdev->debug) {
+ ret = -EIO;
+ set_current_state(TASK_RUNNING);
goto out;
}
- list->head = 0;
- ret += len;
- count -= len;
- if (count > 0)
- goto copy_rest;
+
+ /* allow O_NONBLOCK from other threads */
+ mutex_unlock(&list->read_mutex);
+ schedule();
+ mutex_lock(&list->read_mutex);
+ set_current_state(TASK_INTERRUPTIBLE);
}
+ __set_current_state(TASK_RUNNING);
+ remove_wait_queue(&list->hdev->debug_wait, &wait);
+
+ if (ret)
+ goto out;
}
+
+ /* pass the fifo content to userspace, locking is not needed with only
+ * one concurrent reader and one concurrent writer
+ */
+ ret = kfifo_to_user(&list->hid_debug_fifo, buffer, count, &copied);
+ if (ret)
+ goto out;
+ ret = copied;
out:
mutex_unlock(&list->read_mutex);
return ret;
@@ -1186,7 +1162,7 @@ static unsigned int hid_debug_events_pol
struct hid_debug_list *list = file->private_data;
poll_wait(file, &list->hdev->debug_wait, wait);
- if (list->head != list->tail)
+ if (!kfifo_is_empty(&list->hid_debug_fifo))
return POLLIN | POLLRDNORM;
if (!list->hdev->debug)
return POLLERR | POLLHUP;
@@ -1201,7 +1177,7 @@ static int hid_debug_events_release(stru
spin_lock_irqsave(&list->hdev->debug_list_lock, flags);
list_del(&list->node);
spin_unlock_irqrestore(&list->hdev->debug_list_lock, flags);
- kfree(list->hid_debug_buf);
+ kfifo_free(&list->hid_debug_fifo);
kfree(list);
return 0;
@@ -1252,4 +1228,3 @@ void hid_debug_exit(void)
{
debugfs_remove_recursive(hid_debug_root);
}
-
--- a/include/linux/hid-debug.h
+++ b/include/linux/hid-debug.h
@@ -24,7 +24,10 @@
#ifdef CONFIG_DEBUG_FS
+#include <linux/kfifo.h>
+
#define HID_DEBUG_BUFSIZE 512
+#define HID_DEBUG_FIFOSIZE 512
void hid_dump_input(struct hid_device *, struct hid_usage *, __s32);
void hid_dump_report(struct hid_device *, int , u8 *, int);
@@ -37,11 +40,8 @@ void hid_debug_init(void);
void hid_debug_exit(void);
void hid_debug_event(struct hid_device *, char *);
-
struct hid_debug_list {
- char *hid_debug_buf;
- int head;
- int tail;
+ DECLARE_KFIFO_PTR(hid_debug_fifo, char);
struct fasync_struct *fasync;
struct hid_device *hdev;
struct list_head node;
@@ -64,4 +64,3 @@ struct hid_debug_list {
#endif
#endif
-
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 3.18 086/108] libceph: avoid KEEPALIVE_PENDING races in ceph_con_keepalive()
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (84 preceding siblings ...)
2019-02-18 13:44 ` [PATCH 3.18 085/108] HID: debug: fix the ring buffer implementation Greg Kroah-Hartman
@ 2019-02-18 13:44 ` Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 3.18 087/108] xfrm: refine validation of template and selector families Greg Kroah-Hartman
` (24 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot+acdeb633f6211ccdf886,
Ilya Dryomov, Myungho Jung
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilya Dryomov <idryomov@gmail.com>
commit 4aac9228d16458cedcfd90c7fb37211cf3653ac3 upstream.
con_fault() can transition the connection into STANDBY right after
ceph_con_keepalive() clears STANDBY in clear_standby():
libceph user thread ceph-msgr worker
ceph_con_keepalive()
mutex_lock(&con->mutex)
clear_standby(con)
mutex_unlock(&con->mutex)
mutex_lock(&con->mutex)
con_fault()
...
if KEEPALIVE_PENDING isn't set
set state to STANDBY
...
mutex_unlock(&con->mutex)
set KEEPALIVE_PENDING
set WRITE_PENDING
This triggers warnings in clear_standby() when either ceph_con_send()
or ceph_con_keepalive() get to clearing STANDBY next time.
I don't see a reason to condition queue_con() call on the previous
value of KEEPALIVE_PENDING, so move the setting of KEEPALIVE_PENDING
into the critical section -- unlike WRITE_PENDING, KEEPALIVE_PENDING
could have been a non-atomic flag.
Reported-by: syzbot+acdeb633f6211ccdf886@syzkaller.appspotmail.com
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Tested-by: Myungho Jung <mhjungk@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ceph/messenger.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -3068,9 +3068,10 @@ void ceph_con_keepalive(struct ceph_conn
dout("con_keepalive %p\n", con);
mutex_lock(&con->mutex);
clear_standby(con);
+ con_flag_set(con, CON_FLAG_KEEPALIVE_PENDING);
mutex_unlock(&con->mutex);
- if (con_flag_test_and_set(con, CON_FLAG_KEEPALIVE_PENDING) == 0 &&
- con_flag_test_and_set(con, CON_FLAG_WRITE_PENDING) == 0)
+
+ if (con_flag_test_and_set(con, CON_FLAG_WRITE_PENDING) == 0)
queue_con(con);
}
EXPORT_SYMBOL(ceph_con_keepalive);
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 3.18 087/108] xfrm: refine validation of template and selector families
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (85 preceding siblings ...)
2019-02-18 13:44 ` [PATCH 3.18 086/108] libceph: avoid KEEPALIVE_PENDING races in ceph_con_keepalive() Greg Kroah-Hartman
@ 2019-02-18 13:44 ` Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 3.18 088/108] batman-adv: Avoid WARN on net_device without parent in netns Greg Kroah-Hartman
` (23 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, 3ntr0py1337, Daniel Borkmann,
Florian Westphal, Steffen Klassert
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <fw@strlen.de>
commit 35e6103861a3a970de6c84688c6e7a1f65b164ca upstream.
The check assumes that in transport mode, the first templates family
must match the address family of the policy selector.
Syzkaller managed to build a template using MODE_ROUTEOPTIMIZATION,
with ipv4-in-ipv6 chain, leading to following splat:
BUG: KASAN: stack-out-of-bounds in xfrm_state_find+0x1db/0x1854
Read of size 4 at addr ffff888063e57aa0 by task a.out/2050
xfrm_state_find+0x1db/0x1854
xfrm_tmpl_resolve+0x100/0x1d0
xfrm_resolve_and_create_bundle+0x108/0x1000 [..]
Problem is that addresses point into flowi4 struct, but xfrm_state_find
treats them as being ipv6 because it uses templ->encap_family is used
(AF_INET6 in case of reproducer) rather than family (AF_INET).
This patch inverts the logic: Enforce 'template family must match
selector' EXCEPT for tunnel and BEET mode.
In BEET and Tunnel mode, xfrm_tmpl_resolve_one will have remote/local
address pointers changed to point at the addresses found in the template,
rather than the flowi ones, so no oob read will occur.
Reported-by: 3ntr0py1337@gmail.com
Reported-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/xfrm/xfrm_user.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -1377,10 +1377,15 @@ static int validate_tmpl(int nr, struct
if (!ut[i].family)
ut[i].family = family;
- if ((ut[i].mode == XFRM_MODE_TRANSPORT) &&
- (ut[i].family != prev_family))
- return -EINVAL;
-
+ switch (ut[i].mode) {
+ case XFRM_MODE_TUNNEL:
+ case XFRM_MODE_BEET:
+ break;
+ default:
+ if (ut[i].family != prev_family)
+ return -EINVAL;
+ break;
+ }
if (ut[i].mode >= XFRM_MODE_MAX)
return -EINVAL;
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 3.18 088/108] batman-adv: Avoid WARN on net_device without parent in netns
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (86 preceding siblings ...)
2019-02-18 13:44 ` [PATCH 3.18 087/108] xfrm: refine validation of template and selector families Greg Kroah-Hartman
@ 2019-02-18 13:44 ` Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 3.18 089/108] batman-adv: Force mac header to start of data on xmit Greg Kroah-Hartman
` (22 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot+c764de0fcfadca9a8595,
Dmitry Vyukov, Sven Eckelmann, Simon Wunderlich
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <sven@narfation.org>
commit 955d3411a17f590364238bd0d3329b61f20c1cd2 upstream.
It is not allowed to use WARN* helpers on potential incorrect input from
the user or transient problems because systems configured as panic_on_warn
will reboot due to such a problem.
A NULL return value of __dev_get_by_index can be caused by various problems
which can either be related to the system configuration or problems
(incorrectly returned network namespaces) in other (virtual) net_device
drivers. batman-adv should not cause a (harmful) WARN in this situation and
instead only report it via a simple message.
Fixes: b7eddd0b3950 ("batman-adv: prevent using any virtual device created on batman-adv as hard-interface")
Reported-by: syzbot+c764de0fcfadca9a8595@syzkaller.appspotmail.com
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/batman-adv/hard-interface.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/net/batman-adv/hard-interface.c
+++ b/net/batman-adv/hard-interface.c
@@ -89,8 +89,10 @@ static bool batadv_is_on_batman_iface(co
/* recurse over the parent device */
parent_dev = __dev_get_by_index(&init_net, net_dev->iflink);
/* if we got a NULL parent_dev there is something broken.. */
- if (WARN(!parent_dev, "Cannot find parent device"))
+ if (!parent_dev) {
+ pr_err("Cannot find parent device\n");
return false;
+ }
ret = batadv_is_on_batman_iface(parent_dev);
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 3.18 089/108] batman-adv: Force mac header to start of data on xmit
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (87 preceding siblings ...)
2019-02-18 13:44 ` [PATCH 3.18 088/108] batman-adv: Avoid WARN on net_device without parent in netns Greg Kroah-Hartman
@ 2019-02-18 13:44 ` Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 3.18 090/108] usb: host: ehci-msm: fix handling platform_get_irq result Greg Kroah-Hartman
` (21 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot+9d7405c7faa390e60b4e,
syzbot+7d20bc3f1ddddc0f9079, Sven Eckelmann, Simon Wunderlich
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <sven@narfation.org>
commit 9114daa825fc3f335f9bea3313ce667090187280 upstream.
The caller of ndo_start_xmit may not already have called
skb_reset_mac_header. The returned value of skb_mac_header/eth_hdr
therefore can be in the wrong position and even outside the current skbuff.
This for example happens when the user binds to the device using a
PF_PACKET-SOCK_RAW with enabled qdisc-bypass:
int opt = 4;
setsockopt(sock, SOL_PACKET, PACKET_QDISC_BYPASS, &opt, sizeof(opt));
Since eth_hdr is used all over the codebase, the batadv_interface_tx
function must always take care of resetting it.
Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol")
Reported-by: syzbot+9d7405c7faa390e60b4e@syzkaller.appspotmail.com
Reported-by: syzbot+7d20bc3f1ddddc0f9079@syzkaller.appspotmail.com
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/batman-adv/soft-interface.c | 2 ++
1 file changed, 2 insertions(+)
--- a/net/batman-adv/soft-interface.c
+++ b/net/batman-adv/soft-interface.c
@@ -180,6 +180,8 @@ static int batadv_interface_tx(struct sk
soft_iface->trans_start = jiffies;
vid = batadv_get_vid(skb, 0);
+
+ skb_reset_mac_header(skb);
ethhdr = eth_hdr(skb);
switch (ntohs(ethhdr->h_proto)) {
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 3.18 090/108] usb: host: ehci-msm: fix handling platform_get_irq result
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (88 preceding siblings ...)
2019-02-18 13:44 ` [PATCH 3.18 089/108] batman-adv: Force mac header to start of data on xmit Greg Kroah-Hartman
@ 2019-02-18 13:44 ` Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 3.18 091/108] Revert "exec: load_script: dont blindly truncate shebang string" Greg Kroah-Hartman
` (20 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:44 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Andrzej Hajda, Alan Stern
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrzej Hajda <a.hajda@samsung.com>
commit 0c43e9d835b003d862a5f76e3affcc1f973fb3c0 upstream.
The function can return negative values.
The problem has been detected using proposed semantic patch
scripts/coccinelle/tests/unsigned_lesser_than_zero.cocci [1].
[1]: http://permalink.gmane.org/gmane.linux.kernel/2038576
Signed-off-by: Andrzej Hajda <a.hajda@samsung.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/ehci-msm.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/usb/host/ehci-msm.c
+++ b/drivers/usb/host/ehci-msm.c
@@ -80,12 +80,12 @@ static int ehci_msm_probe(struct platfor
return -ENOMEM;
}
- hcd->irq = platform_get_irq(pdev, 0);
- if (hcd->irq < 0) {
+ ret = platform_get_irq(pdev, 0);
+ if (ret < 0) {
dev_err(&pdev->dev, "Unable to get IRQ resource\n");
- ret = hcd->irq;
goto put_hcd;
}
+ hcd->irq = ret;
res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
if (!res) {
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 3.18 091/108] Revert "exec: load_script: dont blindly truncate shebang string"
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (89 preceding siblings ...)
2019-02-18 13:44 ` [PATCH 3.18 090/108] usb: host: ehci-msm: fix handling platform_get_irq result Greg Kroah-Hartman
@ 2019-02-18 13:44 ` Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 3.18 092/108] ARM: dts: da850-evm: Correct the sound card name Greg Kroah-Hartman
` (19 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Samuel Dionne-Riel, Kees Cook,
Oleg Nesterov, Linus Torvalds
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Torvalds <torvalds@linux-foundation.org>
commit cb5b020a8d38f77209d0472a0fea755299a8ec78 upstream.
This reverts commit 8099b047ecc431518b9bb6bdbba3549bbecdc343.
It turns out that people do actually depend on the shebang string being
truncated, and on the fact that an interpreter (like perl) will often
just re-interpret it entirely to get the full argument list.
Reported-by: Samuel Dionne-Riel <samuel@dionne-riel.com>
Acked-by: Kees Cook <keescook@chromium.org>
Cc: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/binfmt_script.c | 10 +++-------
1 file changed, 3 insertions(+), 7 deletions(-)
--- a/fs/binfmt_script.c
+++ b/fs/binfmt_script.c
@@ -33,14 +33,10 @@ static int load_script(struct linux_binp
fput(bprm->file);
bprm->file = NULL;
- for (cp = bprm->buf+2;; cp++) {
- if (cp >= bprm->buf + BINPRM_BUF_SIZE)
- return -ENOEXEC;
- if (!*cp || (*cp == '\n'))
- break;
- }
+ bprm->buf[BINPRM_BUF_SIZE - 1] = '\0';
+ if ((cp = strchr(bprm->buf, '\n')) == NULL)
+ cp = bprm->buf+BINPRM_BUF_SIZE-1;
*cp = '\0';
-
while (cp > bprm->buf) {
cp--;
if ((*cp == ' ') || (*cp == '\t'))
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 3.18 092/108] ARM: dts: da850-evm: Correct the sound card name
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (90 preceding siblings ...)
2019-02-18 13:44 ` [PATCH 3.18 091/108] Revert "exec: load_script: dont blindly truncate shebang string" Greg Kroah-Hartman
@ 2019-02-18 13:44 ` Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 3.18 093/108] ARM: dts: kirkwood: Fix polarity of GPIO fan lines Greg Kroah-Hartman
` (18 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Peter Ujfalusi, Sekhar Nori, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 7fca69d4e43fa1ae9cb4f652772c132dc5a659c6 ]
To avoid the following error:
asoc-simple-card sound: ASoC: Failed to create card debugfs directory
Which is because the card name contains '/' character, which can not be
used in file or directory names.
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
Signed-off-by: Sekhar Nori <nsekhar@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/da850-evm.dts | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/boot/dts/da850-evm.dts b/arch/arm/boot/dts/da850-evm.dts
index 4f935ad9f27b..505ea30c9cb2 100644
--- a/arch/arm/boot/dts/da850-evm.dts
+++ b/arch/arm/boot/dts/da850-evm.dts
@@ -146,7 +146,7 @@
sound {
compatible = "simple-audio-card";
- simple-audio-card,name = "DA850/OMAP-L138 EVM";
+ simple-audio-card,name = "DA850-OMAPL138 EVM";
simple-audio-card,widgets =
"Line", "Line In",
"Line", "Line Out";
--
2.19.1
^ permalink raw reply related [flat|nested] 113+ messages in thread* [PATCH 3.18 093/108] ARM: dts: kirkwood: Fix polarity of GPIO fan lines
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (91 preceding siblings ...)
2019-02-18 13:44 ` [PATCH 3.18 092/108] ARM: dts: da850-evm: Correct the sound card name Greg Kroah-Hartman
@ 2019-02-18 13:44 ` Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 3.18 094/108] gpio: pl061: handle failed allocations Greg Kroah-Hartman
` (17 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jamie Lentin, Guenter Roeck,
Jason Cooper, Andrew Lunn, Gregory Clement,
Sebastian Hesselbarth, Julien DAscenzio, Linus Walleij,
Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit b5f034845e70916fd33e172fad5ad530a29c10ab ]
These two lines are active high, not active low. The bug was
found when we changed the kernel to respect the polarity defined
in the device tree.
Fixes: 1b90e06b1429 ("ARM: kirkwood: Use devicetree to define DNS-32[05] fan")
Cc: Jamie Lentin <jm@lentin.co.uk>
Cc: Guenter Roeck <linux@roeck-us.net>
Cc: Jason Cooper <jason@lakedaemon.net>
Cc: Andrew Lunn <andrew@lunn.ch>
Cc: Gregory Clement <gregory.clement@bootlin.com>
Cc: Sebastian Hesselbarth <sebastian.hesselbarth@gmail.com>
Cc: Julien D'Ascenzio <jdascenzio@posteo.net>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Tested-by: Jamie Lentin <jm@lentin.co.uk>
Reported-by: Julien D'Ascenzio <jdascenzio@posteo.net>
Tested-by: Julien D'Ascenzio <jdascenzio@posteo.net>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/kirkwood-dnskw.dtsi | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm/boot/dts/kirkwood-dnskw.dtsi b/arch/arm/boot/dts/kirkwood-dnskw.dtsi
index 113dcf056dcf..1b2dacfa6132 100644
--- a/arch/arm/boot/dts/kirkwood-dnskw.dtsi
+++ b/arch/arm/boot/dts/kirkwood-dnskw.dtsi
@@ -35,8 +35,8 @@
compatible = "gpio-fan";
pinctrl-0 = <&pmx_fan_high_speed &pmx_fan_low_speed>;
pinctrl-names = "default";
- gpios = <&gpio1 14 GPIO_ACTIVE_LOW
- &gpio1 13 GPIO_ACTIVE_LOW>;
+ gpios = <&gpio1 14 GPIO_ACTIVE_HIGH
+ &gpio1 13 GPIO_ACTIVE_HIGH>;
gpio-fan,speed-map = <0 0
3000 1
6000 2>;
--
2.19.1
^ permalink raw reply related [flat|nested] 113+ messages in thread* [PATCH 3.18 094/108] gpio: pl061: handle failed allocations
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (92 preceding siblings ...)
2019-02-18 13:44 ` [PATCH 3.18 093/108] ARM: dts: kirkwood: Fix polarity of GPIO fan lines Greg Kroah-Hartman
@ 2019-02-18 13:44 ` Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 3.18 095/108] cifs: Limit memory used by lock request calls to a page Greg Kroah-Hartman
` (16 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Nicholas Mc Guire, Linus Walleij,
Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit df209c43a0e8258e096fb722dfbdae4f0dd13fde ]
devm_kzalloc(), devm_kstrdup() and devm_kasprintf() all can
fail internal allocation and return NULL. Using any of the assigned
objects without checking is not safe. As this is early in the boot
phase and these allocations really should not fail, any failure here
is probably an indication of a more serious issue so it makes little
sense to try and rollback the previous allocated resources or try to
continue; but rather the probe function is simply exited with -ENOMEM.
Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org>
Fixes: 684284b64aae ("ARM: integrator: add MMCI device to IM-PD1")
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/mach-integrator/impd1.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/arch/arm/mach-integrator/impd1.c b/arch/arm/mach-integrator/impd1.c
index 38b0da300dd5..423a88ff908c 100644
--- a/arch/arm/mach-integrator/impd1.c
+++ b/arch/arm/mach-integrator/impd1.c
@@ -394,7 +394,11 @@ static int __init_refok impd1_probe(struct lm_device *dev)
sizeof(*lookup) + 3 * sizeof(struct gpiod_lookup),
GFP_KERNEL);
chipname = devm_kstrdup(&dev->dev, devname, GFP_KERNEL);
- mmciname = kasprintf(GFP_KERNEL, "lm%x:00700", dev->id);
+ mmciname = devm_kasprintf(&dev->dev, GFP_KERNEL,
+ "lm%x:00700", dev->id);
+ if (!lookup || !chipname || !mmciname)
+ return -ENOMEM;
+
lookup->dev_id = mmciname;
/*
* Offsets on GPIO block 1:
--
2.19.1
^ permalink raw reply related [flat|nested] 113+ messages in thread* [PATCH 3.18 095/108] cifs: Limit memory used by lock request calls to a page
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (93 preceding siblings ...)
2019-02-18 13:44 ` [PATCH 3.18 094/108] gpio: pl061: handle failed allocations Greg Kroah-Hartman
@ 2019-02-18 13:44 ` Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 3.18 096/108] perf/core: Fix impossible ring-buffer sizes warning Greg Kroah-Hartman
` (15 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ross Lagerwall, Steve French, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 92a8109e4d3a34fb6b115c9098b51767dc933444 ]
The code tries to allocate a contiguous buffer with a size supplied by
the server (maxBuf). This could fail if memory is fragmented since it
results in high order allocations for commonly used server
implementations. It is also wasteful since there are probably
few locks in the usual case. Limit the buffer to be no larger than a
page to avoid memory allocation failures due to fragmentation.
Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/cifs/file.c | 8 ++++++++
fs/cifs/smb2file.c | 4 ++++
2 files changed, 12 insertions(+)
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -1075,6 +1075,10 @@ cifs_push_mandatory_locks(struct cifsFil
return -EINVAL;
}
+ BUILD_BUG_ON(sizeof(struct smb_hdr) + sizeof(LOCKING_ANDX_RANGE) >
+ PAGE_SIZE);
+ max_buf = min_t(unsigned int, max_buf - sizeof(struct smb_hdr),
+ PAGE_SIZE);
max_num = (max_buf - sizeof(struct smb_hdr)) /
sizeof(LOCKING_ANDX_RANGE);
buf = kzalloc(max_num * sizeof(LOCKING_ANDX_RANGE), GFP_KERNEL);
@@ -1410,6 +1414,10 @@ cifs_unlock_range(struct cifsFileInfo *c
if (max_buf < (sizeof(struct smb_hdr) + sizeof(LOCKING_ANDX_RANGE)))
return -EINVAL;
+ BUILD_BUG_ON(sizeof(struct smb_hdr) + sizeof(LOCKING_ANDX_RANGE) >
+ PAGE_SIZE);
+ max_buf = min_t(unsigned int, max_buf - sizeof(struct smb_hdr),
+ PAGE_SIZE);
max_num = (max_buf - sizeof(struct smb_hdr)) /
sizeof(LOCKING_ANDX_RANGE);
buf = kzalloc(max_num * sizeof(LOCKING_ANDX_RANGE), GFP_KERNEL);
--- a/fs/cifs/smb2file.c
+++ b/fs/cifs/smb2file.c
@@ -110,6 +110,8 @@ smb2_unlock_range(struct cifsFileInfo *c
if (max_buf < sizeof(struct smb2_lock_element))
return -EINVAL;
+ BUILD_BUG_ON(sizeof(struct smb2_lock_element) > PAGE_SIZE);
+ max_buf = min_t(unsigned int, max_buf, PAGE_SIZE);
max_num = max_buf / sizeof(struct smb2_lock_element);
buf = kzalloc(max_num * sizeof(struct smb2_lock_element), GFP_KERNEL);
if (!buf)
@@ -246,6 +248,8 @@ smb2_push_mandatory_locks(struct cifsFil
return -EINVAL;
}
+ BUILD_BUG_ON(sizeof(struct smb2_lock_element) > PAGE_SIZE);
+ max_buf = min_t(unsigned int, max_buf, PAGE_SIZE);
max_num = max_buf / sizeof(struct smb2_lock_element);
buf = kzalloc(max_num * sizeof(struct smb2_lock_element), GFP_KERNEL);
if (!buf) {
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 3.18 096/108] perf/core: Fix impossible ring-buffer sizes warning
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (94 preceding siblings ...)
2019-02-18 13:44 ` [PATCH 3.18 095/108] cifs: Limit memory used by lock request calls to a page Greg Kroah-Hartman
@ 2019-02-18 13:44 ` Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 3.18 097/108] ALSA: usb-audio: Fix implicit fb endpoint setup by quirk Greg Kroah-Hartman
` (14 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jin, Yao, Julien Thierry,
Mark Rutland, Alexander Shishkin, Arnaldo Carvalho de Melo,
Jiri Olsa, Linus Torvalds, Namhyung Kim, Peter Zijlstra,
Thomas Gleixner, Ingo Molnar, Borislav Petkov
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ingo Molnar <mingo@kernel.org>
commit 528871b456026e6127d95b1b2bd8e3a003dc1614 upstream.
The following commit:
9dff0aa95a32 ("perf/core: Don't WARN() for impossible ring-buffer sizes")
results in perf recording failures with larger mmap areas:
root@skl:/tmp# perf record -g -a
failed to mmap with 12 (Cannot allocate memory)
The root cause is that the following condition is buggy:
if (order_base_2(size) >= MAX_ORDER)
goto fail;
The problem is that @size is in bytes and MAX_ORDER is in pages,
so the right test is:
if (order_base_2(size) >= PAGE_SHIFT+MAX_ORDER)
goto fail;
Fix it.
Reported-by: "Jin, Yao" <yao.jin@linux.intel.com>
Bisected-by: Borislav Petkov <bp@alien8.de>
Analyzed-by: Peter Zijlstra <peterz@infradead.org>
Cc: Julien Thierry <julien.thierry@arm.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: <stable@vger.kernel.org>
Fixes: 9dff0aa95a32 ("perf/core: Don't WARN() for impossible ring-buffer sizes")
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/events/ring_buffer.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/kernel/events/ring_buffer.c
+++ b/kernel/events/ring_buffer.c
@@ -282,7 +282,7 @@ struct ring_buffer *rb_alloc(int nr_page
size = sizeof(struct ring_buffer);
size += nr_pages * sizeof(void *);
- if (order_base_2(size) >= MAX_ORDER)
+ if (order_base_2(size) >= PAGE_SHIFT+MAX_ORDER)
goto fail;
rb = kzalloc(size, GFP_KERNEL);
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 3.18 097/108] ALSA: usb-audio: Fix implicit fb endpoint setup by quirk
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (95 preceding siblings ...)
2019-02-18 13:44 ` [PATCH 3.18 096/108] perf/core: Fix impossible ring-buffer sizes warning Greg Kroah-Hartman
@ 2019-02-18 13:44 ` Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 3.18 098/108] Input: bma150 - register input device after setting private data Greg Kroah-Hartman
` (13 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:44 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Manuel Reinhardt, Takashi Iwai
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manuel Reinhardt <manuel.rhdt@gmail.com>
commit 2bc16b9f3223d049b57202ee702fcb5b9b507019 upstream.
The commit a60945fd08e4 ("ALSA: usb-audio: move implicit fb quirks to
separate function") introduced an error in the handling of quirks for
implicit feedback endpoints. This commit fixes this.
If a quirk successfully sets up an implicit feedback endpoint, usb-audio
no longer tries to find the implicit fb endpoint itself.
Fixes: a60945fd08e4 ("ALSA: usb-audio: move implicit fb quirks to separate function")
Signed-off-by: Manuel Reinhardt <manuel.rhdt@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/usb/pcm.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
--- a/sound/usb/pcm.c
+++ b/sound/usb/pcm.c
@@ -311,6 +311,9 @@ static int search_roland_implicit_fb(str
return 0;
}
+/* Setup an implicit feedback endpoint from a quirk. Returns 0 if no quirk
+ * applies. Returns 1 if a quirk was found.
+ */
static int set_sync_ep_implicit_fb_quirk(struct snd_usb_substream *subs,
struct usb_device *dev,
struct usb_interface_descriptor *altsd,
@@ -370,7 +373,7 @@ add_sync_ep:
subs->data_endpoint->sync_master = subs->sync_endpoint;
- return 0;
+ return 1;
}
static int set_sync_endpoint(struct snd_usb_substream *subs,
@@ -395,6 +398,10 @@ static int set_sync_endpoint(struct snd_
if (err < 0)
return err;
+ /* endpoint set by quirk */
+ if (err > 0)
+ return 0;
+
if (altsd->bNumEndpoints < 2)
return 0;
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 3.18 098/108] Input: bma150 - register input device after setting private data
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (96 preceding siblings ...)
2019-02-18 13:44 ` [PATCH 3.18 097/108] ALSA: usb-audio: Fix implicit fb endpoint setup by quirk Greg Kroah-Hartman
@ 2019-02-18 13:44 ` Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 3.18 099/108] Input: elantech - enable 3rd button support on Fujitsu CELSIUS H780 Greg Kroah-Hartman
` (12 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jonathan Bakker, Paweł Chmiel,
Dmitry Torokhov
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonathan Bakker <xc-racer2@live.ca>
commit 90cc55f067f6ca0e64e5e52883ece47d8af7b67b upstream.
Otherwise we introduce a race condition where userspace can request input
before we're ready leading to null pointer dereference such as
input: bma150 as /devices/platform/i2c-gpio-2/i2c-5/5-0038/input/input3
Unable to handle kernel NULL pointer dereference at virtual address 00000018
pgd = (ptrval)
[00000018] *pgd=55dac831, *pte=00000000, *ppte=00000000
Internal error: Oops: 17 [#1] PREEMPT ARM
Modules linked in: bma150 input_polldev [last unloaded: bma150]
CPU: 0 PID: 2870 Comm: accelerometer Not tainted 5.0.0-rc3-dirty #46
Hardware name: Samsung S5PC110/S5PV210-based board
PC is at input_event+0x8/0x60
LR is at bma150_report_xyz+0x9c/0xe0 [bma150]
pc : [<80450f70>] lr : [<7f0a614c>] psr: 800d0013
sp : a4c1fd78 ip : 00000081 fp : 00020000
r10: 00000000 r9 : a5e2944c r8 : a7455000
r7 : 00000016 r6 : 00000101 r5 : a7617940 r4 : 80909048
r3 : fffffff2 r2 : 00000000 r1 : 00000003 r0 : 00000000
Flags: Nzcv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none
Control: 10c5387d Table: 54e34019 DAC: 00000051
Process accelerometer (pid: 2870, stack limit = 0x(ptrval))
Stackck: (0xa4c1fd78 to 0xa4c20000)
fd60: fffffff3 fc813f6c
fd80: 40410581 d7530ce3 a5e2817c a7617f00 a5e29404 a5e2817c 00000000 7f008324
fda0: a5e28000 8044f59c a5fdd9d0 a5e2945c a46a4a00 a5e29668 a7455000 80454f10
fdc0: 80909048 a5e29668 a5fdd9d0 a46a4a00 806316d0 00000000 a46a4a00 801df5f0
fde0: 00000000 d7530ce3 a4c1fec0 a46a4a00 00000000 a5fdd9d0 a46a4a08 801df53c
fe00: 00000000 801d74bc a4c1fec0 00000000 a4c1ff70 00000000 a7038da8 00000000
fe20: a46a4a00 801e91fc a411bbe0 801f2e88 00000004 00000000 80909048 00000041
fe40: 00000000 00020000 00000000 dead4ead a6a88da0 00000000 ffffe000 806fcae8
fe60: a4c1fec8 00000000 80909048 00000002 a5fdd9d0 a7660110 a411bab0 00000001
fe80: dead4ead ffffffff ffffffff a4c1fe8c a4c1fe8c d7530ce3 20000013 80909048
fea0: 80909048 a4c1ff70 00000001 fffff000 a4c1e000 00000005 00026038 801eabd8
fec0: a7660110 a411bab0 b9394901 00000006 a696201b 76fb3000 00000000 a7039720
fee0: a5fdd9d0 00000101 00000002 00000096 00000000 00000000 00000000 a4c1ff00
ff00: a6b310f4 805cb174 a6b310f4 00000010 00000fe0 00000010 a4c1e000 d7530ce3
ff20: 00000003 a5f41400 a5f41424 00000000 a6962000 00000000 00000003 00000002
ff40: ffffff9c 000a0000 80909048 d7530ce3 a6962000 00000003 80909048 ffffff9c
ff60: a6962000 801d890c 00000000 00000000 00020000 a7590000 00000004 00000100
ff80: 00000001 d7530ce3 000288b8 00026320 000288b8 00000005 80101204 a4c1e000
ffa0: 00000005 80101000 000288b8 00026320 000288b8 000a0000 00000000 00000000
ffc0: 000288b8 00026320 000288b8 00000005 7eef3bac 000264e8 00028ad8 00026038
ffe0: 00000005 7eef3300 76f76e91 76f78546 800d0030 000288b8 00000000 00000000
[<80450f70>] (input_event) from [<a5e2817c>] (0xa5e2817c)
Code: e1a08148 eaffffa8 e351001f 812fff1e (e590c018)
---[ end trace 1c691ee85f2ff243 ]---
Signed-off-by: Jonathan Bakker <xc-racer2@live.ca>
Signed-off-by: Paweł Chmiel <pawel.mikolaj.chmiel@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/misc/bma150.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
--- a/drivers/input/misc/bma150.c
+++ b/drivers/input/misc/bma150.c
@@ -483,13 +483,14 @@ static int bma150_register_input_device(
idev->close = bma150_irq_close;
input_set_drvdata(idev, bma150);
+ bma150->input = idev;
+
error = input_register_device(idev);
if (error) {
input_free_device(idev);
return error;
}
- bma150->input = idev;
return 0;
}
@@ -512,15 +513,15 @@ static int bma150_register_polled_device
bma150_init_input_device(bma150, ipoll_dev->input);
+ bma150->input_polled = ipoll_dev;
+ bma150->input = ipoll_dev->input;
+
error = input_register_polled_device(ipoll_dev);
if (error) {
input_free_polled_device(ipoll_dev);
return error;
}
- bma150->input_polled = ipoll_dev;
- bma150->input = ipoll_dev->input;
-
return 0;
}
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 3.18 099/108] Input: elantech - enable 3rd button support on Fujitsu CELSIUS H780
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (97 preceding siblings ...)
2019-02-18 13:44 ` [PATCH 3.18 098/108] Input: bma150 - register input device after setting private data Greg Kroah-Hartman
@ 2019-02-18 13:44 ` Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 3.18 100/108] alpha: fix page fault handling for r16-r18 targets Greg Kroah-Hartman
` (11 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:44 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Matti Kurkela, Dmitry Torokhov
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matti Kurkela <Matti.Kurkela@iki.fi>
commit e8b22d0a329f0fb5c7ef95406872d268f01ee3b1 upstream.
Like Fujitsu CELSIUS H760, the H780 also has a three-button Elantech
touchpad, but the driver needs to be told so to enable the middle touchpad
button.
The elantech_dmi_force_crc_enabled quirk was not necessary with the H780.
Also document the fw_version and caps values detected for both H760 and
H780 models.
Signed-off-by: Matti Kurkela <Matti.Kurkela@iki.fi>
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/mouse/elantech.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -1114,6 +1114,8 @@ static int elantech_get_resolution_v4(st
* Asus UX31 0x361f00 20, 15, 0e clickpad
* Asus UX32VD 0x361f02 00, 15, 0e clickpad
* Avatar AVIU-145A2 0x361f00 ? clickpad
+ * Fujitsu CELSIUS H760 0x570f02 40, 14, 0c 3 hw buttons (**)
+ * Fujitsu CELSIUS H780 0x5d0f02 41, 16, 0d 3 hw buttons (**)
* Fujitsu LIFEBOOK E544 0x470f00 d0, 12, 09 2 hw buttons
* Fujitsu LIFEBOOK E547 0x470f00 50, 12, 09 2 hw buttons
* Fujitsu LIFEBOOK E554 0x570f01 40, 14, 0c 2 hw buttons
@@ -1156,6 +1158,13 @@ static const struct dmi_system_id elante
DMI_MATCH(DMI_PRODUCT_NAME, "CELSIUS H730"),
},
},
+ {
+ /* Fujitsu H780 also has a middle button */
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "CELSIUS H780"),
+ },
+ },
#endif
{ }
};
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 3.18 100/108] alpha: fix page fault handling for r16-r18 targets
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (98 preceding siblings ...)
2019-02-18 13:44 ` [PATCH 3.18 099/108] Input: elantech - enable 3rd button support on Fujitsu CELSIUS H780 Greg Kroah-Hartman
@ 2019-02-18 13:44 ` Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 3.18 101/108] alpha: Fix Eiger NR_IRQS to 128 Greg Kroah-Hartman
` (10 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Richard Henderson, Ivan Kokshaysky,
linux-alpha, Sergei Trofimovich, Matt Turner, Dmitry V. Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergei Trofimovich <slyfox@gentoo.org>
commit 491af60ffb848b59e82f7c9145833222e0bf27a5 upstream.
Fix page fault handling code to fixup r16-r18 registers.
Before the patch code had off-by-two registers bug.
This bug caused overwriting of ps,pc,gp registers instead
of fixing intended r16,r17,r18 (see `struct pt_regs`).
More details:
Initially Dmitry noticed a kernel bug as a failure
on strace test suite. Test passes unmapped userspace
pointer to io_submit:
```c
#include <err.h>
#include <unistd.h>
#include <sys/mman.h>
#include <asm/unistd.h>
int main(void)
{
unsigned long ctx = 0;
if (syscall(__NR_io_setup, 1, &ctx))
err(1, "io_setup");
const size_t page_size = sysconf(_SC_PAGESIZE);
const size_t size = page_size * 2;
void *ptr = mmap(NULL, size, PROT_READ | PROT_WRITE,
MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
if (MAP_FAILED == ptr)
err(1, "mmap(%zu)", size);
if (munmap(ptr, size))
err(1, "munmap");
syscall(__NR_io_submit, ctx, 1, ptr + page_size);
syscall(__NR_io_destroy, ctx);
return 0;
}
```
Running this test causes kernel to crash when handling page fault:
```
Unable to handle kernel paging request at virtual address ffffffffffff9468
CPU 3
aio(26027): Oops 0
pc = [<fffffc00004eddf8>] ra = [<fffffc00004edd5c>] ps = 0000 Not tainted
pc is at sys_io_submit+0x108/0x200
ra is at sys_io_submit+0x6c/0x200
v0 = fffffc00c58e6300 t0 = fffffffffffffff2 t1 = 000002000025e000
t2 = fffffc01f159fef8 t3 = fffffc0001009640 t4 = fffffc0000e0f6e0
t5 = 0000020001002e9e t6 = 4c41564e49452031 t7 = fffffc01f159c000
s0 = 0000000000000002 s1 = 000002000025e000 s2 = 0000000000000000
s3 = 0000000000000000 s4 = 0000000000000000 s5 = fffffffffffffff2
s6 = fffffc00c58e6300
a0 = fffffc00c58e6300 a1 = 0000000000000000 a2 = 000002000025e000
a3 = 00000200001ac260 a4 = 00000200001ac1e8 a5 = 0000000000000001
t8 = 0000000000000008 t9 = 000000011f8bce30 t10= 00000200001ac440
t11= 0000000000000000 pv = fffffc00006fd320 at = 0000000000000000
gp = 0000000000000000 sp = 00000000265fd174
Disabling lock debugging due to kernel taint
Trace:
[<fffffc0000311404>] entSys+0xa4/0xc0
```
Here `gp` has invalid value. `gp is s overwritten by a fixup for the
following page fault handler in `io_submit` syscall handler:
```
__se_sys_io_submit
...
ldq a1,0(t1)
bne t0,4280 <__se_sys_io_submit+0x180>
```
After a page fault `t0` should contain -EFALUT and `a1` is 0.
Instead `gp` was overwritten in place of `a1`.
This happens due to a off-by-two bug in `dpf_reg()` for `r16-r18`
(aka `a0-a2`).
I think the bug went unnoticed for a long time as `gp` is one
of scratch registers. Any kernel function call would re-calculate `gp`.
Dmitry tracked down the bug origin back to 2.1.32 kernel version
where trap_a{0,1,2} fields were inserted into struct pt_regs.
And even before that `dpf_reg()` contained off-by-one error.
Cc: Richard Henderson <rth@twiddle.net>
Cc: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
Cc: linux-alpha@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Reported-and-reviewed-by: "Dmitry V. Levin" <ldv@altlinux.org>
Cc: stable@vger.kernel.org # v2.1.32+
Bug: https://bugs.gentoo.org/672040
Signed-off-by: Sergei Trofimovich <slyfox@gentoo.org>
Signed-off-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/alpha/mm/fault.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/alpha/mm/fault.c
+++ b/arch/alpha/mm/fault.c
@@ -78,7 +78,7 @@ __load_new_mm_context(struct mm_struct *
/* Macro for exception fixup code to access integer registers. */
#define dpf_reg(r) \
(((unsigned long *)regs)[(r) <= 8 ? (r) : (r) <= 15 ? (r)-16 : \
- (r) <= 18 ? (r)+8 : (r)-10])
+ (r) <= 18 ? (r)+10 : (r)-10])
asmlinkage void
do_page_fault(unsigned long address, unsigned long mmcsr,
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 3.18 101/108] alpha: Fix Eiger NR_IRQS to 128
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (99 preceding siblings ...)
2019-02-18 13:44 ` [PATCH 3.18 100/108] alpha: fix page fault handling for r16-r18 targets Greg Kroah-Hartman
@ 2019-02-18 13:44 ` Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 3.18 102/108] tracing/uprobes: Fix output for multiple string arguments Greg Kroah-Hartman
` (9 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:44 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Meelis Roos, Matt Turner
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Meelis Roos <mroos@linux.ee>
commit bfc913682464f45bc4d6044084e370f9048de9d5 upstream.
Eiger machine vector definition has nr_irqs 128, and working 2.6.26
boot shows SCSI getting IRQ-s 64 and 65. Current kernel boot fails
because Symbios SCSI fails to request IRQ-s and does not find the disks.
It has been broken at least since 3.18 - the earliest I could test with
my gcc-5.
The headers have moved around and possibly another order of defines has
worked in the past - but since 128 seems to be correct and used, fix
arch/alpha/include/asm/irq.h to have NR_IRQS=128 for Eiger.
This fixes 4.19-rc7 boot on my Force Flexor A264 (Eiger subarch).
Cc: stable@vger.kernel.org # v3.18+
Signed-off-by: Meelis Roos <mroos@linux.ee>
Signed-off-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/alpha/include/asm/irq.h | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/arch/alpha/include/asm/irq.h
+++ b/arch/alpha/include/asm/irq.h
@@ -55,15 +55,15 @@
#elif defined(CONFIG_ALPHA_DP264) || \
defined(CONFIG_ALPHA_LYNX) || \
- defined(CONFIG_ALPHA_SHARK) || \
- defined(CONFIG_ALPHA_EIGER)
+ defined(CONFIG_ALPHA_SHARK)
# define NR_IRQS 64
#elif defined(CONFIG_ALPHA_TITAN)
#define NR_IRQS 80
#elif defined(CONFIG_ALPHA_RAWHIDE) || \
- defined(CONFIG_ALPHA_TAKARA)
+ defined(CONFIG_ALPHA_TAKARA) || \
+ defined(CONFIG_ALPHA_EIGER)
# define NR_IRQS 128
#elif defined(CONFIG_ALPHA_WILDFIRE)
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 3.18 102/108] tracing/uprobes: Fix output for multiple string arguments
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (100 preceding siblings ...)
2019-02-18 13:44 ` [PATCH 3.18 101/108] alpha: Fix Eiger NR_IRQS to 128 Greg Kroah-Hartman
@ 2019-02-18 13:44 ` Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 3.18 103/108] signal: Restore the stop PTRACE_EVENT_EXIT Greg Kroah-Hartman
` (8 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ingo Molnar, Masami Hiramatsu,
Andreas Ziegler, Steven Rostedt (VMware)
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Ziegler <andreas.ziegler@fau.de>
commit 0722069a5374b904ec1a67f91249f90e1cfae259 upstream.
When printing multiple uprobe arguments as strings the output for the
earlier arguments would also include all later string arguments.
This is best explained in an example:
Consider adding a uprobe to a function receiving two strings as
parameters which is at offset 0xa0 in strlib.so and we want to print
both parameters when the uprobe is hit (on x86_64):
$ echo 'p:func /lib/strlib.so:0xa0 +0(%di):string +0(%si):string' > \
/sys/kernel/debug/tracing/uprobe_events
When the function is called as func("foo", "bar") and we hit the probe,
the trace file shows a line like the following:
[...] func: (0x7f7e683706a0) arg1="foobar" arg2="bar"
Note the extra "bar" printed as part of arg1. This behaviour stacks up
for additional string arguments.
The strings are stored in a dynamically growing part of the uprobe
buffer by fetch_store_string() after copying them from userspace via
strncpy_from_user(). The return value of strncpy_from_user() is then
directly used as the required size for the string. However, this does
not take the terminating null byte into account as the documentation
for strncpy_from_user() cleary states that it "[...] returns the
length of the string (not including the trailing NUL)" even though the
null byte will be copied to the destination.
Therefore, subsequent calls to fetch_store_string() will overwrite
the terminating null byte of the most recently fetched string with
the first character of the current string, leading to the
"accumulation" of strings in earlier arguments in the output.
Fix this by incrementing the return value of strncpy_from_user() by
one if we did not hit the maximum buffer size.
Link: http://lkml.kernel.org/r/20190116141629.5752-1-andreas.ziegler@fau.de
Cc: Ingo Molnar <mingo@redhat.com>
Cc: stable@vger.kernel.org
Fixes: 5baaa59ef09e ("tracing/probes: Implement 'memory' fetch method for uprobes")
Acked-by: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Andreas Ziegler <andreas.ziegler@fau.de>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/trace_uprobe.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
--- a/kernel/trace/trace_uprobe.c
+++ b/kernel/trace/trace_uprobe.c
@@ -150,7 +150,14 @@ static void FETCH_FUNC_NAME(memory, stri
ret = strncpy_from_user(dst, src, maxlen);
if (ret == maxlen)
- dst[--ret] = '\0';
+ dst[ret - 1] = '\0';
+ else if (ret >= 0)
+ /*
+ * Include the terminating null byte. In this case it
+ * was copied by strncpy_from_user but not accounted
+ * for in ret.
+ */
+ ret++;
if (ret < 0) { /* Failed to fetch string */
((u8 *)get_rloc_data(dest))[0] = '\0';
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 3.18 103/108] signal: Restore the stop PTRACE_EVENT_EXIT
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (101 preceding siblings ...)
2019-02-18 13:44 ` [PATCH 3.18 102/108] tracing/uprobes: Fix output for multiple string arguments Greg Kroah-Hartman
@ 2019-02-18 13:44 ` Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 3.18 104/108] x86/a.out: Clear the dump structure initially Greg Kroah-Hartman
` (7 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Oleg Nesterov, Ivan Delalande,
Eric W. Biederman
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric W. Biederman <ebiederm@xmission.com>
commit cf43a757fd49442bc38f76088b70c2299eed2c2f upstream.
In the middle of do_exit() there is there is a call
"ptrace_event(PTRACE_EVENT_EXIT, code);" That call places the process
in TACKED_TRACED aka "(TASK_WAKEKILL | __TASK_TRACED)" and waits for
for the debugger to release the task or SIGKILL to be delivered.
Skipping past dequeue_signal when we know a fatal signal has already
been delivered resulted in SIGKILL remaining pending and
TIF_SIGPENDING remaining set. This in turn caused the
scheduler to not sleep in PTACE_EVENT_EXIT as it figured
a fatal signal was pending. This also caused ptrace_freeze_traced
in ptrace_check_attach to fail because it left a per thread
SIGKILL pending which is what fatal_signal_pending tests for.
This difference in signal state caused strace to report
strace: Exit of unknown pid NNNNN ignored
Therefore update the signal handling state like dequeue_signal
would when removing a per thread SIGKILL, by removing SIGKILL
from the per thread signal mask and clearing TIF_SIGPENDING.
Acked-by: Oleg Nesterov <oleg@redhat.com>
Reported-by: Oleg Nesterov <oleg@redhat.com>
Reported-by: Ivan Delalande <colona@arista.com>
Cc: stable@vger.kernel.org
Fixes: 35634ffa1751 ("signal: Always notice exiting tasks")
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/signal.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -2284,9 +2284,12 @@ relock:
}
/* Has this task already been marked for death? */
- ksig->info.si_signo = signr = SIGKILL;
- if (signal_group_exit(signal))
+ if (signal_group_exit(signal)) {
+ ksig->info.si_signo = signr = SIGKILL;
+ sigdelset(¤t->pending.signal, SIGKILL);
+ recalc_sigpending();
goto fatal;
+ }
for (;;) {
struct k_sigaction *ka;
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 3.18 104/108] x86/a.out: Clear the dump structure initially
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (102 preceding siblings ...)
2019-02-18 13:44 ` [PATCH 3.18 103/108] signal: Restore the stop PTRACE_EVENT_EXIT Greg Kroah-Hartman
@ 2019-02-18 13:44 ` Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 3.18 105/108] smsc95xx: Use skb_cow_head to deal with cloned skbs Greg Kroah-Hartman
` (6 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Borislav Petkov, Derek Robson,
Linus Torvalds, Michael Matz, x86
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Borislav Petkov <bp@suse.de>
commit 10970e1b4be9c74fce8ab6e3c34a7d718f063f2c upstream.
dump_thread32() in aout_core_dump() does not clear the user32 structure
allocated on the stack as the first thing on function entry.
As a result, the dump.u_comm, dump.u_ar0 and dump.signal which get
assigned before the clearing, get overwritten.
Rename that function to fill_dump() to make it clear what it does and
call it first thing.
This was caught while staring at a patch by Derek Robson
<robsonde@gmail.com>.
Signed-off-by: Borislav Petkov <bp@suse.de>
Cc: Derek Robson <robsonde@gmail.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Michael Matz <matz@suse.de>
Cc: x86@kernel.org
Cc: <stable@vger.kernel.org>
Link: https://lkml.kernel.org/r/20190202005512.3144-1-robsonde@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/ia32/ia32_aout.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/arch/x86/ia32/ia32_aout.c
+++ b/arch/x86/ia32/ia32_aout.c
@@ -50,7 +50,7 @@ static unsigned long get_dr(int n)
/*
* fill in the user structure for a core dump..
*/
-static void dump_thread32(struct pt_regs *regs, struct user32 *dump)
+static void fill_dump(struct pt_regs *regs, struct user32 *dump)
{
u32 fs, gs;
memset(dump, 0, sizeof(*dump));
@@ -156,10 +156,12 @@ static int aout_core_dump(struct coredum
fs = get_fs();
set_fs(KERNEL_DS);
has_dumped = 1;
+
+ fill_dump(cprm->regs, &dump);
+
strncpy(dump.u_comm, current->comm, sizeof(current->comm));
dump.u_ar0 = offsetof(struct user32, regs);
dump.signal = cprm->siginfo->si_signo;
- dump_thread32(cprm->regs, &dump);
/*
* If the size of the dump file exceeds the rlimit, then see
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 3.18 105/108] smsc95xx: Use skb_cow_head to deal with cloned skbs
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (103 preceding siblings ...)
2019-02-18 13:44 ` [PATCH 3.18 104/108] x86/a.out: Clear the dump structure initially Greg Kroah-Hartman
@ 2019-02-18 13:44 ` Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 3.18 106/108] kaweth: use skb_cow_head() " Greg Kroah-Hartman
` (5 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, James Hughes, Eric Dumazet,
Woojung Huh, David S. Miller, Linus Walleij
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Hughes <james.hughes@raspberrypi.org>
commit e9156cd26a495a18706e796f02a81fee41ec14f4 upstream.
The driver was failing to check that the SKB wasn't cloned
before adding checksum data.
Replace existing handling to extend/copy the header buffer
with skb_cow_head.
Signed-off-by: James Hughes <james.hughes@raspberrypi.org>
Acked-by: Eric Dumazet <edumazet@google.com>
Acked-by: Woojung Huh <Woojung.Huh@microchip.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/usb/smsc95xx.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
--- a/drivers/net/usb/smsc95xx.c
+++ b/drivers/net/usb/smsc95xx.c
@@ -1841,13 +1841,13 @@ static struct sk_buff *smsc95xx_tx_fixup
/* We do not advertise SG, so skbs should be already linearized */
BUG_ON(skb_shinfo(skb)->nr_frags);
- if (skb_headroom(skb) < overhead) {
- struct sk_buff *skb2 = skb_copy_expand(skb,
- overhead, 0, flags);
+ /* Make writable and expand header space by overhead if required */
+ if (skb_cow_head(skb, overhead)) {
+ /* Must deallocate here as returning NULL to indicate error
+ * means the skb won't be deallocated in the caller.
+ */
dev_kfree_skb_any(skb);
- skb = skb2;
- if (!skb)
- return NULL;
+ return NULL;
}
if (csum) {
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 3.18 106/108] kaweth: use skb_cow_head() to deal with cloned skbs
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (104 preceding siblings ...)
2019-02-18 13:44 ` [PATCH 3.18 105/108] smsc95xx: Use skb_cow_head to deal with cloned skbs Greg Kroah-Hartman
@ 2019-02-18 13:44 ` Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 3.18 107/108] usb: dwc2: Remove unnecessary kfree Greg Kroah-Hartman
` (4 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Eric Dumazet, James Hughes,
David S. Miller, Linus Walleij
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
commit 39fba7835aacda65284a86e611774cbba71dac20 upstream.
We can use skb_cow_head() to properly deal with clones,
especially the ones coming from TCP stack that allow their head being
modified. This avoids a copy.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: James Hughes <james.hughes@raspberrypi.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/usb/kaweth.c | 18 ++++++------------
1 file changed, 6 insertions(+), 12 deletions(-)
--- a/drivers/net/usb/kaweth.c
+++ b/drivers/net/usb/kaweth.c
@@ -812,18 +812,12 @@ static netdev_tx_t kaweth_start_xmit(str
}
/* We now decide whether we can put our special header into the sk_buff */
- if (skb_cloned(skb) || skb_headroom(skb) < 2) {
- /* no such luck - we make our own */
- struct sk_buff *copied_skb;
- copied_skb = skb_copy_expand(skb, 2, 0, GFP_ATOMIC);
- dev_kfree_skb_irq(skb);
- skb = copied_skb;
- if (!copied_skb) {
- kaweth->stats.tx_errors++;
- netif_start_queue(net);
- spin_unlock_irq(&kaweth->device_lock);
- return NETDEV_TX_OK;
- }
+ if (skb_cow_head(skb, 2)) {
+ kaweth->stats.tx_errors++;
+ netif_start_queue(net);
+ spin_unlock_irq(&kaweth->device_lock);
+ dev_kfree_skb_any(skb);
+ return NETDEV_TX_OK;
}
private_header = (__le16 *)__skb_push(skb, 2);
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 3.18 107/108] usb: dwc2: Remove unnecessary kfree
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (105 preceding siblings ...)
2019-02-18 13:44 ` [PATCH 3.18 106/108] kaweth: use skb_cow_head() " Greg Kroah-Hartman
@ 2019-02-18 13:44 ` Greg Kroah-Hartman
2019-02-18 13:44 ` [PATCH 3.18 108/108] pinctrl: msm: fix gpio-hog related boot issues Greg Kroah-Hartman
` (3 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, John Youn, Felipe Balbi, Linus Walleij
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Youn <johnyoun@synopsys.com>
commit cd4b1e34655d46950c065d9284b596cd8d7b28cd upstream.
This shouldn't be freed by the HCD as it is owned by the core and
allocated with devm_kzalloc.
Signed-off-by: John Youn <johnyoun@synopsys.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/dwc2/hcd.c | 1 -
1 file changed, 1 deletion(-)
--- a/drivers/usb/dwc2/hcd.c
+++ b/drivers/usb/dwc2/hcd.c
@@ -2953,7 +2953,6 @@ error3:
error2:
usb_put_hcd(hcd);
error1:
- kfree(hsotg->core_params);
#ifdef CONFIG_USB_DWC2_TRACK_MISSED_SOFS
kfree(hsotg->last_frame_num_array);
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 3.18 108/108] pinctrl: msm: fix gpio-hog related boot issues
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (106 preceding siblings ...)
2019-02-18 13:44 ` [PATCH 3.18 107/108] usb: dwc2: Remove unnecessary kfree Greg Kroah-Hartman
@ 2019-02-18 13:44 ` Greg Kroah-Hartman
2019-02-18 19:19 ` [PATCH 3.18 000/108] 3.18.135-stable review kernelci.org bot
` (2 subsequent siblings)
110 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2019-02-18 13:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sven Eckelmann, Bjorn Andersson,
Christian Lamparter, Linus Walleij, Amit Pundir
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Lamparter <chunkeey@gmail.com>
commit a86caa9ba5d70696ceb35d1d39caa20d8b641387 upstream.
Sven Eckelmann reported an issue with the current IPQ4019 pinctrl.
Setting up any gpio-hog in the device-tree for his device would
"kill the bootup completely":
| [ 0.477838] msm_serial 78af000.serial: could not find pctldev for node /soc/pinctrl@1000000/serial_pinmux, deferring probe
| [ 0.499828] spi_qup 78b5000.spi: could not find pctldev for node /soc/pinctrl@1000000/spi_0_pinmux, deferring probe
| [ 1.298883] requesting hog GPIO enable USB2 power (chip 1000000.pinctrl, offset 58) failed, -517
| [ 1.299609] gpiochip_add_data: GPIOs 0..99 (1000000.pinctrl) failed to register
| [ 1.308589] ipq4019-pinctrl 1000000.pinctrl: Failed register gpiochip
| [ 1.316586] msm_serial 78af000.serial: could not find pctldev for node /soc/pinctrl@1000000/serial_pinmux, deferring probe
| [ 1.322415] spi_qup 78b5000.spi: could not find pctldev for node /soc/pinctrl@1000000/spi_0_pinmux, deferri
This was also verified on a RT-AC58U (IPQ4018) which would
no longer boot, if a gpio-hog was specified. (Tried forcing
the USB LED PIN (GPIO0) to high.).
The problem is that Pinctrl+GPIO registration is currently
peformed in the following order in pinctrl-msm.c:
1. pinctrl_register()
2. gpiochip_add()
3. gpiochip_add_pin_range()
The actual error code -517 == -EPROBE_DEFER is coming from
pinctrl_get_device_gpio_range(), which is called through:
gpiochip_add
of_gpiochip_add
of_gpiochip_scan_gpios
gpiod_hog
gpiochip_request_own_desc
__gpiod_request
chip->request
gpiochip_generic_request
pinctrl_gpio_request
pinctrl_get_device_gpio_range
pinctrl_get_device_gpio_range() is unable to find any valid
pin ranges, since nothing has been added to the pinctrldev_list yet.
so the range can't be found, and the operation fails with -EPROBE_DEFER.
This patch fixes the issue by adding the "gpio-ranges" property to
the pinctrl device node of all upstream Qcom SoC. The pin ranges are
then added by the gpio core.
In order to remain compatible with older, existing DTs (and ACPI)
a check for the "gpio-ranges" property has been added to
msm_gpio_init(). This prevents the driver of adding the same entry
to the pinctrldev_list twice.
Reported-by: Sven Eckelmann <sven.eckelmann@openmesh.com>
Tested-by: Sven Eckelmann <sven.eckelmann@openmesh.com> [ipq4019]
Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pinctrl/qcom/pinctrl-msm.c | 23 ++++++++++++++++++-----
1 file changed, 18 insertions(+), 5 deletions(-)
--- a/drivers/pinctrl/qcom/pinctrl-msm.c
+++ b/drivers/pinctrl/qcom/pinctrl-msm.c
@@ -825,11 +825,24 @@ static int msm_gpio_init(struct msm_pinc
return ret;
}
- ret = gpiochip_add_pin_range(&pctrl->chip, dev_name(pctrl->dev), 0, 0, chip->ngpio);
- if (ret) {
- dev_err(pctrl->dev, "Failed to add pin range\n");
- gpiochip_remove(&pctrl->chip);
- return ret;
+ /*
+ * For DeviceTree-supported systems, the gpio core checks the
+ * pinctrl's device node for the "gpio-ranges" property.
+ * If it is present, it takes care of adding the pin ranges
+ * for the driver. In this case the driver can skip ahead.
+ *
+ * In order to remain compatible with older, existing DeviceTree
+ * files which don't set the "gpio-ranges" property or systems that
+ * utilize ACPI the driver has to call gpiochip_add_pin_range().
+ */
+ if (!of_property_read_bool(pctrl->dev->of_node, "gpio-ranges")) {
+ ret = gpiochip_add_pin_range(&pctrl->chip,
+ dev_name(pctrl->dev), 0, 0, chip->ngpio);
+ if (ret) {
+ dev_err(pctrl->dev, "Failed to add pin range\n");
+ gpiochip_remove(&pctrl->chip);
+ return ret;
+ }
}
ret = gpiochip_irqchip_add(chip,
^ permalink raw reply [flat|nested] 113+ messages in thread* Re: [PATCH 3.18 000/108] 3.18.135-stable review
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (107 preceding siblings ...)
2019-02-18 13:44 ` [PATCH 3.18 108/108] pinctrl: msm: fix gpio-hog related boot issues Greg Kroah-Hartman
@ 2019-02-18 19:19 ` kernelci.org bot
2019-02-19 16:53 ` Guenter Roeck
2019-02-20 0:18 ` shuah
110 siblings, 0 replies; 113+ messages in thread
From: kernelci.org bot @ 2019-02-18 19:19 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel
Cc: Greg Kroah-Hartman, torvalds, akpm, linux, shuah, patches,
ben.hutchings, lkft-triage, stable
stable-rc/linux-3.18.y boot: 48 boots: 0 failed, 46 passed with 2 offline (v3.18.134-109-gcc973ee706b3)
Full Boot Summary: https://kernelci.org/boot/all/job/stable-rc/branch/linux-3.18.y/kernel/v3.18.134-109-gcc973ee706b3/
Full Build Summary: https://kernelci.org/build/stable-rc/branch/linux-3.18.y/kernel/v3.18.134-109-gcc973ee706b3/
Tree: stable-rc
Branch: linux-3.18.y
Git Describe: v3.18.134-109-gcc973ee706b3
Git Commit: cc973ee706b35e690d95035f00eda7063b1f927c
Git URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
Tested: 19 unique boards, 11 SoC families, 11 builds out of 185
Offline Platforms:
arm:
multi_v7_defconfig:
gcc-7
tegra20-iris-512: 1 offline lab
tegra_defconfig:
gcc-7
tegra20-iris-512: 1 offline lab
---
For more info write to <info@kernelci.org>
^ permalink raw reply [flat|nested] 113+ messages in thread* Re: [PATCH 3.18 000/108] 3.18.135-stable review
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (108 preceding siblings ...)
2019-02-18 19:19 ` [PATCH 3.18 000/108] 3.18.135-stable review kernelci.org bot
@ 2019-02-19 16:53 ` Guenter Roeck
2019-02-20 0:18 ` shuah
110 siblings, 0 replies; 113+ messages in thread
From: Guenter Roeck @ 2019-02-19 16:53 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel
Cc: torvalds, akpm, shuah, patches, ben.hutchings, lkft-triage, stable
On 2/18/19 5:42 AM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 3.18.135 release.
> There are 108 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed Feb 20 13:34:47 UTC 2019.
> Anything received after that time might be too late.
>
Build results:
total: 155 pass: 155 fail: 0
Qemu test results:
total: 226 pass: 226 fail: 0
Guenter
^ permalink raw reply [flat|nested] 113+ messages in thread* Re: [PATCH 3.18 000/108] 3.18.135-stable review
2019-02-18 13:42 [PATCH 3.18 000/108] 3.18.135-stable review Greg Kroah-Hartman
` (109 preceding siblings ...)
2019-02-19 16:53 ` Guenter Roeck
@ 2019-02-20 0:18 ` shuah
110 siblings, 0 replies; 113+ messages in thread
From: shuah @ 2019-02-20 0:18 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel
Cc: torvalds, akpm, linux, patches, ben.hutchings, lkft-triage,
stable, shuah
On 2/18/19 6:42 AM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 3.18.135 release.
> There are 108 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed Feb 20 13:34:47 UTC 2019.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v3.x/stable-review/patch-3.18.135-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-3.18.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
Compiled and booted on my test system. No demesg regressions.
thanks,
-- Shuah
^ permalink raw reply [flat|nested] 113+ messages in thread