* [v2.6.34-stable 001/165] net_sched: Fix qdisc_notify()
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
@ 2012-08-15 19:45 ` Paul Gortmaker
2012-08-15 19:45 ` [v2.6.34-stable 002/165] nl80211: fix overflow in ssid_len Paul Gortmaker
` (163 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:45 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Eric Dumazet, David S. Miller, Paul Gortmaker
From: Eric Dumazet <eric.dumazet@gmail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 53b0f08042f04813cd1a7473dacd3edfacb28eb3 upstream.
Ben Pfaff reported a kernel oops and provided a test program to
reproduce it.
https://kerneltrap.org/mailarchive/linux-netdev/2010/5/21/6277805
tc_fill_qdisc() should not be called for builtin qdisc, or it
dereference a NULL pointer to get device ifindex.
Fix is to always use tc_qdisc_dump_ignore() before calling
tc_fill_qdisc().
Reported-by: Ben Pfaff <blp@nicira.com>
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
net/sched/sch_api.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index 145268c..df1dbf5 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -1196,6 +1196,11 @@ nla_put_failure:
return -1;
}
+static bool tc_qdisc_dump_ignore(struct Qdisc *q)
+{
+ return (q->flags & TCQ_F_BUILTIN) ? true : false;
+}
+
static int qdisc_notify(struct sk_buff *oskb, struct nlmsghdr *n,
u32 clid, struct Qdisc *old, struct Qdisc *new)
{
@@ -1206,11 +1211,11 @@ static int qdisc_notify(struct sk_buff *oskb, struct nlmsghdr *n,
if (!skb)
return -ENOBUFS;
- if (old && old->handle) {
+ if (old && !tc_qdisc_dump_ignore(old)) {
if (tc_fill_qdisc(skb, old, clid, pid, n->nlmsg_seq, 0, RTM_DELQDISC) < 0)
goto err_out;
}
- if (new) {
+ if (new && !tc_qdisc_dump_ignore(new)) {
if (tc_fill_qdisc(skb, new, clid, pid, n->nlmsg_seq, old ? NLM_F_REPLACE : 0, RTM_NEWQDISC) < 0)
goto err_out;
}
@@ -1223,11 +1228,6 @@ err_out:
return -EINVAL;
}
-static bool tc_qdisc_dump_ignore(struct Qdisc *q)
-{
- return (q->flags & TCQ_F_BUILTIN) ? true : false;
-}
-
static int tc_dump_qdisc_root(struct Qdisc *root, struct sk_buff *skb,
struct netlink_callback *cb,
int *q_idx_p, int s_q_idx)
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 002/165] nl80211: fix overflow in ssid_len
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
2012-08-15 19:45 ` [v2.6.34-stable 001/165] net_sched: Fix qdisc_notify() Paul Gortmaker
@ 2012-08-15 19:45 ` Paul Gortmaker
2012-08-15 19:45 ` [v2.6.34-stable 003/165] fs: assign sb->s_bdi to default_backing_dev_info if the bdi is going away Paul Gortmaker
` (162 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:45 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Luciano Coelho, John W. Linville, Paul Gortmaker
From: Luciano Coelho <coelho@ti.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 57a27e1d6a3bb9ad4efeebd3a8c71156d6207536 upstream.
When one of the SSID's length passed in a scan or sched_scan request
is larger than 255, there will be an overflow in the u8 that is used
to store the length before checking. This causes the check to fail
and we overrun the buffer when copying the SSID.
Fix this by checking the nl80211 attribute length before copying it to
the struct.
This is a follow up for the previous commit
208c72f4fe44fe09577e7975ba0e7fa0278f3d03, which didn't fix the problem
entirely.
Reported-by: Ido Yariv <ido@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
[PG: 34 codebase does not have nl80211_start_sched_scan part]
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
net/wireless/nl80211.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 0ba104f..56bc9b9 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -3072,11 +3072,11 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
i = 0;
if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
- request->ssids[i].ssid_len = nla_len(attr);
- if (request->ssids[i].ssid_len > IEEE80211_MAX_SSID_LEN) {
+ if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
err = -EINVAL;
goto out_free;
}
+ request->ssids[i].ssid_len = nla_len(attr);
memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
i++;
}
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 003/165] fs: assign sb->s_bdi to default_backing_dev_info if the bdi is going away
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
2012-08-15 19:45 ` [v2.6.34-stable 001/165] net_sched: Fix qdisc_notify() Paul Gortmaker
2012-08-15 19:45 ` [v2.6.34-stable 002/165] nl80211: fix overflow in ssid_len Paul Gortmaker
@ 2012-08-15 19:45 ` Paul Gortmaker
2012-08-15 19:45 ` [v2.6.34-stable 004/165] vm: fix vm_pgoff wrap in stack expansion Paul Gortmaker
` (161 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:45 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Jens Axboe, Paul Gortmaker
From: Jens Axboe <jaxboe@fusionio.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 95f28604a65b1c40b6c6cd95e58439cd7ded3add upstream.
We don't have proper reference counting for this yet, so we run into
cases where the device is pulled and we OOPS on flushing the fs data.
This happens even though the dirty inodes have already been
migrated to the default_backing_dev_info.
Reported-by: Torsten Hilbrich <torsten.hilbrich@secunet.com>
Tested-by: Torsten Hilbrich <torsten.hilbrich@secunet.com>
Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/super.c | 2 ++
fs/sync.c | 4 ++--
mm/backing-dev.c | 2 +-
3 files changed, 5 insertions(+), 3 deletions(-)
diff --git a/fs/super.c b/fs/super.c
index 53040a6..7123fa7 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -64,6 +64,7 @@ static struct super_block *alloc_super(struct file_system_type *type)
goto out;
}
INIT_LIST_HEAD(&s->s_files);
+ s->s_bdi = &default_backing_dev_info;
INIT_LIST_HEAD(&s->s_instances);
INIT_HLIST_HEAD(&s->s_anon);
INIT_LIST_HEAD(&s->s_inodes);
@@ -962,6 +963,7 @@ vfs_kern_mount(struct file_system_type *type, int flags, const char *name, void
goto out_free_secdata;
BUG_ON(!mnt->mnt_sb);
WARN_ON(!mnt->mnt_sb->s_bdi);
+ WARN_ON(mnt->mnt_sb->s_bdi == &default_backing_dev_info);
mnt->mnt_sb->s_flags |= MS_BORN;
error = security_sb_kern_mount(mnt->mnt_sb, flags, secdata);
diff --git a/fs/sync.c b/fs/sync.c
index 92b2281..5281fb3 100644
--- a/fs/sync.c
+++ b/fs/sync.c
@@ -33,7 +33,7 @@ static int __sync_filesystem(struct super_block *sb, int wait)
* This should be safe, as we require bdi backing to actually
* write out data in the first place
*/
- if (!sb->s_bdi || sb->s_bdi == &noop_backing_dev_info)
+ if (sb->s_bdi == &noop_backing_dev_info)
return 0;
if (sb->s_qcop && sb->s_qcop->quota_sync)
@@ -110,7 +110,7 @@ restart:
spin_unlock(&sb_lock);
down_read(&sb->s_umount);
- if (!(sb->s_flags & MS_RDONLY) && sb->s_root && sb->s_bdi)
+ if (!(sb->s_flags & MS_RDONLY) && sb->s_root)
__sync_filesystem(sb, wait);
up_read(&sb->s_umount);
diff --git a/mm/backing-dev.c b/mm/backing-dev.c
index 707d0dc..7bd17d2 100644
--- a/mm/backing-dev.c
+++ b/mm/backing-dev.c
@@ -634,7 +634,7 @@ static void bdi_prune_sb(struct backing_dev_info *bdi)
spin_lock(&sb_lock);
list_for_each_entry(sb, &super_blocks, s_list) {
if (sb->s_bdi == bdi)
- sb->s_bdi = NULL;
+ sb->s_bdi = &default_backing_dev_info;
}
spin_unlock(&sb_lock);
}
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 004/165] vm: fix vm_pgoff wrap in stack expansion
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (2 preceding siblings ...)
2012-08-15 19:45 ` [v2.6.34-stable 003/165] fs: assign sb->s_bdi to default_backing_dev_info if the bdi is going away Paul Gortmaker
@ 2012-08-15 19:45 ` Paul Gortmaker
2012-08-15 19:45 ` [v2.6.34-stable 005/165] rose: Add length checks to CALL_REQUEST parsing Paul Gortmaker
` (160 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:45 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Linus Torvalds, Paul Gortmaker
From: Linus Torvalds <torvalds@linux-foundation.org>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit a626ca6a656450e9f4df91d0dda238fff23285f4 upstream.
Commit 982134ba6261 ("mm: avoid wrapping vm_pgoff in mremap()") fixed
the case of a expanding mapping causing vm_pgoff wrapping when you used
mremap. But there was another case where we expand mappings hiding in
plain sight: the automatic stack expansion.
This fixes that case too.
This one also found by Robert Święcki, using his nasty system call
fuzzer tool. Good job.
Reported-and-tested-by: Robert Święcki <robert@swiecki.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[PG: .34 doesn't have perf call via 3af9e859 (in .36); adjust accordingly]
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
mm/mmap.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/mm/mmap.c b/mm/mmap.c
index b42b469..fe9b76a 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -1784,10 +1784,13 @@ static int expand_downwards(struct vm_area_struct *vma,
size = vma->vm_end - address;
grow = (vma->vm_start - address) >> PAGE_SHIFT;
- error = acct_stack_growth(vma, size, grow);
- if (!error) {
- vma->vm_start = address;
- vma->vm_pgoff -= grow;
+ error = -ENOMEM;
+ if (grow <= vma->vm_pgoff) {
+ error = acct_stack_growth(vma, size, grow);
+ if (!error) {
+ vma->vm_start = address;
+ vma->vm_pgoff -= grow;
+ }
}
}
anon_vma_unlock(vma);
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 005/165] rose: Add length checks to CALL_REQUEST parsing
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (3 preceding siblings ...)
2012-08-15 19:45 ` [v2.6.34-stable 004/165] vm: fix vm_pgoff wrap in stack expansion Paul Gortmaker
@ 2012-08-15 19:45 ` Paul Gortmaker
2012-08-15 19:45 ` [v2.6.34-stable 006/165] drm: integer overflow in drm_mode_dirtyfb_ioctl() Paul Gortmaker
` (159 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:45 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Ben Hutchings, David S. Miller, Paul Gortmaker
From: Ben Hutchings <ben@decadent.org.uk>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit e0bccd315db0c2f919e7fcf9cb60db21d9986f52 upstream.
Define some constant offsets for CALL_REQUEST based on the description
at <http://www.techfest.com/networking/wan/x25plp.htm> and the
definition of ROSE as using 10-digit (5-byte) addresses. Use them
consistently. Validate all implicit and explicit facilities lengths.
Validate the address length byte rather than either trusting or
assuming its value.
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
include/net/rose.h | 8 ++++-
net/rose/af_rose.c | 8 ++---
net/rose/rose_loopback.c | 13 ++++++-
net/rose/rose_route.c | 20 +++++++----
net/rose/rose_subr.c | 91 ++++++++++++++++++++++++++++++------------------
5 files changed, 93 insertions(+), 47 deletions(-)
diff --git a/include/net/rose.h b/include/net/rose.h
index 5ba9f02..555dd19 100644
--- a/include/net/rose.h
+++ b/include/net/rose.h
@@ -14,6 +14,12 @@
#define ROSE_MIN_LEN 3
+#define ROSE_CALL_REQ_ADDR_LEN_OFF 3
+#define ROSE_CALL_REQ_ADDR_LEN_VAL 0xAA /* each address is 10 digits */
+#define ROSE_CALL_REQ_DEST_ADDR_OFF 4
+#define ROSE_CALL_REQ_SRC_ADDR_OFF 9
+#define ROSE_CALL_REQ_FACILITIES_OFF 14
+
#define ROSE_GFI 0x10
#define ROSE_Q_BIT 0x80
#define ROSE_D_BIT 0x40
@@ -214,7 +220,7 @@ extern void rose_requeue_frames(struct sock *);
extern int rose_validate_nr(struct sock *, unsigned short);
extern void rose_write_internal(struct sock *, int);
extern int rose_decode(struct sk_buff *, int *, int *, int *, int *, int *);
-extern int rose_parse_facilities(unsigned char *, struct rose_facilities_struct *);
+extern int rose_parse_facilities(unsigned char *, unsigned int, struct rose_facilities_struct *);
extern void rose_disconnect(struct sock *, int, int, int);
/* rose_timer.c */
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index d325c9d..547e5cd 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -985,7 +985,7 @@ int rose_rx_call_request(struct sk_buff *skb, struct net_device *dev, struct ros
struct sock *make;
struct rose_sock *make_rose;
struct rose_facilities_struct facilities;
- int n, len;
+ int n;
skb->sk = NULL; /* Initially we don't know who it's for */
@@ -994,9 +994,9 @@ int rose_rx_call_request(struct sk_buff *skb, struct net_device *dev, struct ros
*/
memset(&facilities, 0x00, sizeof(struct rose_facilities_struct));
- len = (((skb->data[3] >> 4) & 0x0F) + 1) >> 1;
- len += (((skb->data[3] >> 0) & 0x0F) + 1) >> 1;
- if (!rose_parse_facilities(skb->data + len + 4, &facilities)) {
+ if (!rose_parse_facilities(skb->data + ROSE_CALL_REQ_FACILITIES_OFF,
+ skb->len - ROSE_CALL_REQ_FACILITIES_OFF,
+ &facilities)) {
rose_transmit_clear_request(neigh, lci, ROSE_INVALID_FACILITY, 76);
return 0;
}
diff --git a/net/rose/rose_loopback.c b/net/rose/rose_loopback.c
index ae4a9d9..3444562 100644
--- a/net/rose/rose_loopback.c
+++ b/net/rose/rose_loopback.c
@@ -73,9 +73,20 @@ static void rose_loopback_timer(unsigned long param)
unsigned int lci_i, lci_o;
while ((skb = skb_dequeue(&loopback_queue)) != NULL) {
+ if (skb->len < ROSE_MIN_LEN) {
+ kfree_skb(skb);
+ continue;
+ }
lci_i = ((skb->data[0] << 8) & 0xF00) + ((skb->data[1] << 0) & 0x0FF);
frametype = skb->data[2];
- dest = (rose_address *)(skb->data + 4);
+ if (frametype == ROSE_CALL_REQUEST &&
+ (skb->len <= ROSE_CALL_REQ_FACILITIES_OFF ||
+ skb->data[ROSE_CALL_REQ_ADDR_LEN_OFF] !=
+ ROSE_CALL_REQ_ADDR_LEN_VAL)) {
+ kfree_skb(skb);
+ continue;
+ }
+ dest = (rose_address *)(skb->data + ROSE_CALL_REQ_DEST_ADDR_OFF);
lci_o = ROSE_DEFAULT_MAXVC + 1 - lci_i;
skb_reset_transport_header(skb);
diff --git a/net/rose/rose_route.c b/net/rose/rose_route.c
index cbc244a..ae3f06d 100644
--- a/net/rose/rose_route.c
+++ b/net/rose/rose_route.c
@@ -855,7 +855,7 @@ int rose_route_frame(struct sk_buff *skb, ax25_cb *ax25)
unsigned int lci, new_lci;
unsigned char cause, diagnostic;
struct net_device *dev;
- int len, res = 0;
+ int res = 0;
char buf[11];
#if 0
@@ -863,10 +863,17 @@ int rose_route_frame(struct sk_buff *skb, ax25_cb *ax25)
return res;
#endif
+ if (skb->len < ROSE_MIN_LEN)
+ return res;
frametype = skb->data[2];
lci = ((skb->data[0] << 8) & 0xF00) + ((skb->data[1] << 0) & 0x0FF);
- src_addr = (rose_address *)(skb->data + 9);
- dest_addr = (rose_address *)(skb->data + 4);
+ if (frametype == ROSE_CALL_REQUEST &&
+ (skb->len <= ROSE_CALL_REQ_FACILITIES_OFF ||
+ skb->data[ROSE_CALL_REQ_ADDR_LEN_OFF] !=
+ ROSE_CALL_REQ_ADDR_LEN_VAL))
+ return res;
+ src_addr = (rose_address *)(skb->data + ROSE_CALL_REQ_SRC_ADDR_OFF);
+ dest_addr = (rose_address *)(skb->data + ROSE_CALL_REQ_DEST_ADDR_OFF);
spin_lock_bh(&rose_neigh_list_lock);
spin_lock_bh(&rose_route_list_lock);
@@ -1004,12 +1011,11 @@ int rose_route_frame(struct sk_buff *skb, ax25_cb *ax25)
goto out;
}
- len = (((skb->data[3] >> 4) & 0x0F) + 1) >> 1;
- len += (((skb->data[3] >> 0) & 0x0F) + 1) >> 1;
-
memset(&facilities, 0x00, sizeof(struct rose_facilities_struct));
- if (!rose_parse_facilities(skb->data + len + 4, &facilities)) {
+ if (!rose_parse_facilities(skb->data + ROSE_CALL_REQ_FACILITIES_OFF,
+ skb->len - ROSE_CALL_REQ_FACILITIES_OFF,
+ &facilities)) {
rose_transmit_clear_request(rose_neigh, lci, ROSE_INVALID_FACILITY, 76);
goto out;
}
diff --git a/net/rose/rose_subr.c b/net/rose/rose_subr.c
index 174d51c..f6c71ca 100644
--- a/net/rose/rose_subr.c
+++ b/net/rose/rose_subr.c
@@ -142,7 +142,7 @@ void rose_write_internal(struct sock *sk, int frametype)
*dptr++ = ROSE_GFI | lci1;
*dptr++ = lci2;
*dptr++ = frametype;
- *dptr++ = 0xAA;
+ *dptr++ = ROSE_CALL_REQ_ADDR_LEN_VAL;
memcpy(dptr, &rose->dest_addr, ROSE_ADDR_LEN);
dptr += ROSE_ADDR_LEN;
memcpy(dptr, &rose->source_addr, ROSE_ADDR_LEN);
@@ -246,12 +246,16 @@ static int rose_parse_national(unsigned char *p, struct rose_facilities_struct *
do {
switch (*p & 0xC0) {
case 0x00:
+ if (len < 2)
+ return -1;
p += 2;
n += 2;
len -= 2;
break;
case 0x40:
+ if (len < 3)
+ return -1;
if (*p == FAC_NATIONAL_RAND)
facilities->rand = ((p[1] << 8) & 0xFF00) + ((p[2] << 0) & 0x00FF);
p += 3;
@@ -260,32 +264,48 @@ static int rose_parse_national(unsigned char *p, struct rose_facilities_struct *
break;
case 0x80:
+ if (len < 4)
+ return -1;
p += 4;
n += 4;
len -= 4;
break;
case 0xC0:
+ if (len < 2)
+ return -1;
l = p[1];
+ if (len < 2 + l)
+ return -1;
if (*p == FAC_NATIONAL_DEST_DIGI) {
if (!fac_national_digis_received) {
+ if (l < AX25_ADDR_LEN)
+ return -1;
memcpy(&facilities->source_digis[0], p + 2, AX25_ADDR_LEN);
facilities->source_ndigis = 1;
}
}
else if (*p == FAC_NATIONAL_SRC_DIGI) {
if (!fac_national_digis_received) {
+ if (l < AX25_ADDR_LEN)
+ return -1;
memcpy(&facilities->dest_digis[0], p + 2, AX25_ADDR_LEN);
facilities->dest_ndigis = 1;
}
}
else if (*p == FAC_NATIONAL_FAIL_CALL) {
+ if (l < AX25_ADDR_LEN)
+ return -1;
memcpy(&facilities->fail_call, p + 2, AX25_ADDR_LEN);
}
else if (*p == FAC_NATIONAL_FAIL_ADD) {
+ if (l < 1 + ROSE_ADDR_LEN)
+ return -1;
memcpy(&facilities->fail_addr, p + 3, ROSE_ADDR_LEN);
}
else if (*p == FAC_NATIONAL_DIGIS) {
+ if (l % AX25_ADDR_LEN)
+ return -1;
fac_national_digis_received = 1;
facilities->source_ndigis = 0;
facilities->dest_ndigis = 0;
@@ -319,24 +339,32 @@ static int rose_parse_ccitt(unsigned char *p, struct rose_facilities_struct *fac
do {
switch (*p & 0xC0) {
case 0x00:
+ if (len < 2)
+ return -1;
p += 2;
n += 2;
len -= 2;
break;
case 0x40:
+ if (len < 3)
+ return -1;
p += 3;
n += 3;
len -= 3;
break;
case 0x80:
+ if (len < 4)
+ return -1;
p += 4;
n += 4;
len -= 4;
break;
case 0xC0:
+ if (len < 2)
+ return -1;
l = p[1];
/* Prevent overflows*/
@@ -365,49 +393,44 @@ static int rose_parse_ccitt(unsigned char *p, struct rose_facilities_struct *fac
return n;
}
-int rose_parse_facilities(unsigned char *p,
+int rose_parse_facilities(unsigned char *p, unsigned packet_len,
struct rose_facilities_struct *facilities)
{
int facilities_len, len;
facilities_len = *p++;
- if (facilities_len == 0)
+ if (facilities_len == 0 || (unsigned)facilities_len > packet_len)
return 0;
- while (facilities_len > 0) {
- if (*p == 0x00) {
- facilities_len--;
- p++;
-
- switch (*p) {
- case FAC_NATIONAL: /* National */
- len = rose_parse_national(p + 1, facilities, facilities_len - 1);
- if (len < 0)
- return 0;
- facilities_len -= len + 1;
- p += len + 1;
- break;
-
- case FAC_CCITT: /* CCITT */
- len = rose_parse_ccitt(p + 1, facilities, facilities_len - 1);
- if (len < 0)
- return 0;
- facilities_len -= len + 1;
- p += len + 1;
- break;
-
- default:
- printk(KERN_DEBUG "ROSE: rose_parse_facilities - unknown facilities family %02X\n", *p);
- facilities_len--;
- p++;
- break;
- }
- } else
- break; /* Error in facilities format */
+ while (facilities_len >= 3 && *p == 0x00) {
+ facilities_len--;
+ p++;
+
+ switch (*p) {
+ case FAC_NATIONAL: /* National */
+ len = rose_parse_national(p + 1, facilities, facilities_len - 1);
+ break;
+
+ case FAC_CCITT: /* CCITT */
+ len = rose_parse_ccitt(p + 1, facilities, facilities_len - 1);
+ break;
+
+ default:
+ printk(KERN_DEBUG "ROSE: rose_parse_facilities - unknown facilities family %02X\n", *p);
+ len = 1;
+ break;
+ }
+
+ if (len < 0)
+ return 0;
+ if (WARN_ON(len >= facilities_len))
+ return 0;
+ facilities_len -= len + 1;
+ p += len + 1;
}
- return 1;
+ return facilities_len == 0;
}
static int rose_create_facilities(unsigned char *buffer, struct rose_sock *rose)
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 006/165] drm: integer overflow in drm_mode_dirtyfb_ioctl()
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (4 preceding siblings ...)
2012-08-15 19:45 ` [v2.6.34-stable 005/165] rose: Add length checks to CALL_REQUEST parsing Paul Gortmaker
@ 2012-08-15 19:45 ` Paul Gortmaker
2012-08-15 19:45 ` [v2.6.34-stable 007/165] perf: overflow/perf_count_sw_cpu_clock crashes recent kernels Paul Gortmaker
` (158 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:45 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Xi Wang, Dave Airlie, Paul Gortmaker
From: Xi Wang <xi.wang@gmail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit a5cd335165e31db9dbab636fd29895d41da55dd2 upstream.
There is a potential integer overflow in drm_mode_dirtyfb_ioctl()
if userspace passes in a large num_clips. The call to kmalloc would
allocate a small buffer, and the call to fb->funcs->dirty may result
in a memory corruption.
Reported-by: Haogang Chen <haogangchen@gmail.com>
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/gpu/drm/drm_crtc.c | 4 ++++
include/drm/drm_mode.h | 2 ++
2 files changed, 6 insertions(+)
diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
index 1a224f8..819d0dc 100644
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -1833,6 +1833,10 @@ int drm_mode_dirtyfb_ioctl(struct drm_device *dev,
}
if (num_clips && clips_ptr) {
+ if (num_clips < 0 || num_clips > DRM_MODE_FB_DIRTY_MAX_CLIPS) {
+ ret = -EINVAL;
+ goto out_err1;
+ }
clips = kzalloc(num_clips * sizeof(*clips), GFP_KERNEL);
if (!clips) {
ret = -ENOMEM;
diff --git a/include/drm/drm_mode.h b/include/drm/drm_mode.h
index c5ba163..9cf639c 100644
--- a/include/drm/drm_mode.h
+++ b/include/drm/drm_mode.h
@@ -232,6 +232,8 @@ struct drm_mode_fb_cmd {
#define DRM_MODE_FB_DIRTY_ANNOTATE_FILL 0x02
#define DRM_MODE_FB_DIRTY_FLAGS 0x03
+#define DRM_MODE_FB_DIRTY_MAX_CLIPS 256
+
/*
* Mark a region of a framebuffer as dirty.
*
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 007/165] perf: overflow/perf_count_sw_cpu_clock crashes recent kernels
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (5 preceding siblings ...)
2012-08-15 19:45 ` [v2.6.34-stable 006/165] drm: integer overflow in drm_mode_dirtyfb_ioctl() Paul Gortmaker
@ 2012-08-15 19:45 ` Paul Gortmaker
2012-08-15 19:45 ` [v2.6.34-stable 008/165] regset: Prevent null pointer reference on readonly regsets Paul Gortmaker
` (157 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:45 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Peter Zijlstra, Greg Kroah-Hartman, Paul Gortmaker
From: Peter Zijlstra <a.p.zijlstra@chello.nl>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
The below patch is for -stable only, upstream has a much larger patch
that contains the below hunk in commit a8b0ca17b80e92faab46ee7179ba9e99ccb61233
Vince found that under certain circumstances software event overflows
go wrong and deadlock. Avoid trying to delete a timer from the timer
callback.
Reported-by: Vince Weaver <vweaver1@eecs.utk.edu>
Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
[PG: backport from 2.6.32 queue, see https://lkml.org/lkml/2011/8/3/125 ]
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
kernel/perf_event.c | 8 ++------
1 file changed, 2 insertions(+), 6 deletions(-)
diff --git a/kernel/perf_event.c b/kernel/perf_event.c
index b203546..540c26b 100644
--- a/kernel/perf_event.c
+++ b/kernel/perf_event.c
@@ -3907,12 +3907,8 @@ static int __perf_event_overflow(struct perf_event *event, int nmi,
if (events && atomic_dec_and_test(&event->event_limit)) {
ret = 1;
event->pending_kill = POLL_HUP;
- if (nmi) {
- event->pending_disable = 1;
- perf_pending_queue(&event->pending,
- perf_pending_event);
- } else
- perf_event_disable(event);
+ event->pending_disable = 1;
+ perf_pending_queue(&event->pending, perf_pending_event);
}
if (event->overflow_handler)
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 008/165] regset: Prevent null pointer reference on readonly regsets
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (6 preceding siblings ...)
2012-08-15 19:45 ` [v2.6.34-stable 007/165] perf: overflow/perf_count_sw_cpu_clock crashes recent kernels Paul Gortmaker
@ 2012-08-15 19:45 ` Paul Gortmaker
2012-08-15 19:45 ` [v2.6.34-stable 009/165] ext4: fix undefined behavior in ext4_fill_flex_info() Paul Gortmaker
` (156 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:45 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: H. Peter Anvin, Linus Torvalds, Paul Gortmaker
From: "H. Peter Anvin" <hpa@zytor.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit c8e252586f8d5de906385d8cf6385fee289a825e upstream.
The regset common infrastructure assumed that regsets would always
have .get and .set methods, but not necessarily .active methods.
Unfortunately people have since written regsets without .set methods.
Rather than putting in stub functions everywhere, handle regsets with
null .get or .set methods explicitly.
Signed-off-by: H. Peter Anvin <hpa@zytor.com>
Reviewed-by: Oleg Nesterov <oleg@redhat.com>
Acked-by: Roland McGrath <roland@hack.frob.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/binfmt_elf.c | 2 +-
include/linux/regset.h | 6 ++++++
2 files changed, 7 insertions(+), 1 deletion(-)
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 535e763..c21da8a 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -1414,7 +1414,7 @@ static int fill_thread_core_info(struct elf_thread_core_info *t,
for (i = 1; i < view->n; ++i) {
const struct user_regset *regset = &view->regsets[i];
do_thread_regset_writeback(t->task, regset);
- if (regset->core_note_type &&
+ if (regset->core_note_type && regset->get &&
(!regset->active || regset->active(t->task, regset))) {
int ret;
size_t size = regset->n * regset->size;
diff --git a/include/linux/regset.h b/include/linux/regset.h
index 8abee65..5150fd1 100644
--- a/include/linux/regset.h
+++ b/include/linux/regset.h
@@ -335,6 +335,9 @@ static inline int copy_regset_to_user(struct task_struct *target,
{
const struct user_regset *regset = &view->regsets[setno];
+ if (!regset->get)
+ return -EOPNOTSUPP;
+
if (!access_ok(VERIFY_WRITE, data, size))
return -EIO;
@@ -358,6 +361,9 @@ static inline int copy_regset_from_user(struct task_struct *target,
{
const struct user_regset *regset = &view->regsets[setno];
+ if (!regset->set)
+ return -EOPNOTSUPP;
+
if (!access_ok(VERIFY_READ, data, size))
return -EIO;
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 009/165] ext4: fix undefined behavior in ext4_fill_flex_info()
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (7 preceding siblings ...)
2012-08-15 19:45 ` [v2.6.34-stable 008/165] regset: Prevent null pointer reference on readonly regsets Paul Gortmaker
@ 2012-08-15 19:45 ` Paul Gortmaker
2012-08-15 19:45 ` [v2.6.34-stable 010/165] cifs: fix possible memory corruption in CIFSFindNext Paul Gortmaker
` (155 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:45 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Xi Wang, Theodore Ts'o, Paul Gortmaker
From: Xi Wang <xi.wang@gmail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit d50f2ab6f050311dbf7b8f5501b25f0bf64a439b upstream.
Commit 503358ae01b70ce6909d19dd01287093f6b6271c ("ext4: avoid divide by
zero when trying to mount a corrupted file system") fixes CVE-2009-4307
by performing a sanity check on s_log_groups_per_flex, since it can be
set to a bogus value by an attacker.
sbi->s_log_groups_per_flex = sbi->s_es->s_log_groups_per_flex;
groups_per_flex = 1 << sbi->s_log_groups_per_flex;
if (groups_per_flex < 2) { ... }
This patch fixes two potential issues in the previous commit.
1) The sanity check might only work on architectures like PowerPC.
On x86, 5 bits are used for the shifting amount. That means, given a
large s_log_groups_per_flex value like 36, groups_per_flex = 1 << 36
is essentially 1 << 4 = 16, rather than 0. This will bypass the check,
leaving s_log_groups_per_flex and groups_per_flex inconsistent.
2) The sanity check relies on undefined behavior, i.e., oversized shift.
A standard-confirming C compiler could rewrite the check in unexpected
ways. Consider the following equivalent form, assuming groups_per_flex
is unsigned for simplicity.
groups_per_flex = 1 << sbi->s_log_groups_per_flex;
if (groups_per_flex == 0 || groups_per_flex == 1) {
We compile the code snippet using Clang 3.0 and GCC 4.6. Clang will
completely optimize away the check groups_per_flex == 0, leaving the
patched code as vulnerable as the original. GCC keeps the check, but
there is no guarantee that future versions will do the same.
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/ext4/super.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index cd35e34..6928d5a 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -1796,17 +1796,16 @@ static int ext4_fill_flex_info(struct super_block *sb)
struct ext4_group_desc *gdp = NULL;
ext4_group_t flex_group_count;
ext4_group_t flex_group;
- int groups_per_flex = 0;
+ unsigned int groups_per_flex = 0;
size_t size;
int i;
sbi->s_log_groups_per_flex = sbi->s_es->s_log_groups_per_flex;
- groups_per_flex = 1 << sbi->s_log_groups_per_flex;
-
- if (groups_per_flex < 2) {
+ if (sbi->s_log_groups_per_flex < 1 || sbi->s_log_groups_per_flex > 31) {
sbi->s_log_groups_per_flex = 0;
return 1;
}
+ groups_per_flex = 1 << sbi->s_log_groups_per_flex;
/* We allocate both existing and potentially added groups */
flex_group_count = ((sbi->s_groups_count + groups_per_flex - 1) +
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 010/165] cifs: fix possible memory corruption in CIFSFindNext
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (8 preceding siblings ...)
2012-08-15 19:45 ` [v2.6.34-stable 009/165] ext4: fix undefined behavior in ext4_fill_flex_info() Paul Gortmaker
@ 2012-08-15 19:45 ` Paul Gortmaker
2012-08-15 19:45 ` [v2.6.34-stable 011/165] cifs: fix dentry refcount leak when opening a FIFO on lookup Paul Gortmaker
` (154 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:45 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Jeff Layton, Steve French, Paul Gortmaker
From: Jeff Layton <jlayton@redhat.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 9438fabb73eb48055b58b89fc51e0bc4db22fabd upstream.
The name_len variable in CIFSFindNext is a signed int that gets set to
the resume_name_len in the cifs_search_info. The resume_name_len however
is unsigned and for some infolevels is populated directly from a 32 bit
value sent by the server.
If the server sends a very large value for this, then that value could
look negative when converted to a signed int. That would make that
value pass the PATH_MAX check later in CIFSFindNext. The name_len would
then be used as a length value for a memcpy. It would then be treated
as unsigned again, and the memcpy scribbles over a ton of memory.
Fix this by making the name_len an unsigned value in CIFSFindNext.
Reported-by: Darren Lavender <dcl@hppine99.gbr.hp.com>
Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Steve French <sfrench@us.ibm.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/cifs/cifssmb.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index 62e49ab..5171d86 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -3743,7 +3743,8 @@ int CIFSFindNext(const int xid, struct cifsTconInfo *tcon,
T2_FNEXT_RSP_PARMS *parms;
char *response_data;
int rc = 0;
- int bytes_returned, name_len;
+ int bytes_returned;
+ unsigned int name_len;
__u16 params, byte_count;
cFYI(1, ("In FindNext"));
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 011/165] cifs: fix dentry refcount leak when opening a FIFO on lookup
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (9 preceding siblings ...)
2012-08-15 19:45 ` [v2.6.34-stable 010/165] cifs: fix possible memory corruption in CIFSFindNext Paul Gortmaker
@ 2012-08-15 19:45 ` Paul Gortmaker
2012-08-15 19:45 ` [v2.6.34-stable 012/165] hfsplus: Fix potential buffer overflows Paul Gortmaker
` (153 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:45 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Jeff Layton, Steve French, Paul Gortmaker
From: Jeff Layton <jlayton@redhat.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 5bccda0ebc7c0331b81ac47d39e4b920b198b2cd upstream.
The cifs code will attempt to open files on lookup under certain
circumstances. What happens though if we find that the file we opened
was actually a FIFO or other special file?
Currently, the open filehandle just ends up being leaked leading to
a dentry refcount mismatch and oops on umount. Fix this by having the
code close the filehandle on the server if it turns out not to be a
regular file. While we're at it, change this spaghetti if statement
into a switch too.
Reported-by: CAI Qian <caiqian@redhat.com>
Tested-by: CAI Qian <caiqian@redhat.com>
Reviewed-by: Shirish Pargaonkar <shirishpargaonkar@gmail.com>
Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Steve French <smfrench@gmail.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/cifs/dir.c | 20 ++++++++++++++++++--
1 file changed, 18 insertions(+), 2 deletions(-)
diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
index ff3d891..fc79b95 100644
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -692,10 +692,26 @@ cifs_lookup(struct inode *parent_dir_inode, struct dentry *direntry,
* If either that or op not supported returned, follow
* the normal lookup.
*/
- if ((rc == 0) || (rc == -ENOENT))
+ switch (rc) {
+ case 0:
+ /*
+ * The server may allow us to open things like
+ * FIFOs, but the client isn't set up to deal
+ * with that. If it's not a regular file, just
+ * close it and proceed as if it were a normal
+ * lookup.
+ */
+ if (newInode && !S_ISREG(newInode->i_mode)) {
+ CIFSSMBClose(xid, pTcon, fileHandle);
+ break;
+ }
+ case -ENOENT:
posix_open = true;
- else if ((rc == -EINVAL) || (rc != -EOPNOTSUPP))
+ case -EOPNOTSUPP:
+ break;
+ default:
pTcon->broken_posix_open = true;
+ }
}
if (!posix_open)
rc = cifs_get_inode_info_unix(&newInode, full_path,
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 012/165] hfsplus: Fix potential buffer overflows
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (10 preceding siblings ...)
2012-08-15 19:45 ` [v2.6.34-stable 011/165] cifs: fix dentry refcount leak when opening a FIFO on lookup Paul Gortmaker
@ 2012-08-15 19:45 ` Paul Gortmaker
2012-08-15 19:45 ` [v2.6.34-stable 013/165] xfs: Fix possible memory corruption in xfs_readlink Paul Gortmaker
` (152 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:45 UTC (permalink / raw)
To: stable, linux-kernel
Cc: Greg Kroah-Hartman, Alexey Khoroshilov, Miklos Szeredi,
Sage Weil, Eugene Teo, Roman Zippel, Al Viro, Christoph Hellwig,
Alexey Dobriyan, Dave Anderson, Andrew Morton, Linus Torvalds,
Paul Gortmaker
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 6f24f892871acc47b40dd594c63606a17c714f77 upstream.
Commit ec81aecb2966 ("hfs: fix a potential buffer overflow") fixed a few
potential buffer overflows in the hfs filesystem. But as Timo Warns
pointed out, these changes also need to be made on the hfsplus
filesystem as well.
Reported-by: Timo Warns <warns@pre-sense.de>
Acked-by: WANG Cong <amwang@redhat.com>
Cc: Alexey Khoroshilov <khoroshilov@ispras.ru>
Cc: Miklos Szeredi <mszeredi@suse.cz>
Cc: Sage Weil <sage@newdream.net>
Cc: Eugene Teo <eteo@redhat.com>
Cc: Roman Zippel <zippel@linux-m68k.org>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Dave Anderson <anderson@redhat.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/hfsplus/catalog.c | 4 ++++
fs/hfsplus/dir.c | 11 +++++++++++
2 files changed, 15 insertions(+)
diff --git a/fs/hfsplus/catalog.c b/fs/hfsplus/catalog.c
index f6874ac..a0786c6 100644
--- a/fs/hfsplus/catalog.c
+++ b/fs/hfsplus/catalog.c
@@ -329,6 +329,10 @@ int hfsplus_rename_cat(u32 cnid,
err = hfs_brec_find(&src_fd);
if (err)
goto out;
+ if (src_fd.entrylength > sizeof(entry) || src_fd.entrylength < 0) {
+ err = -EIO;
+ goto out;
+ }
hfs_bnode_read(src_fd.bnode, &entry, src_fd.entryoffset,
src_fd.entrylength);
diff --git a/fs/hfsplus/dir.c b/fs/hfsplus/dir.c
index 5f40236..f4300ff7 100644
--- a/fs/hfsplus/dir.c
+++ b/fs/hfsplus/dir.c
@@ -138,6 +138,11 @@ static int hfsplus_readdir(struct file *filp, void *dirent, filldir_t filldir)
filp->f_pos++;
/* fall through */
case 1:
+ if (fd.entrylength > sizeof(entry) || fd.entrylength < 0) {
+ err = -EIO;
+ goto out;
+ }
+
hfs_bnode_read(fd.bnode, &entry, fd.entryoffset, fd.entrylength);
if (be16_to_cpu(entry.type) != HFSPLUS_FOLDER_THREAD) {
printk(KERN_ERR "hfs: bad catalog folder thread\n");
@@ -168,6 +173,12 @@ static int hfsplus_readdir(struct file *filp, void *dirent, filldir_t filldir)
err = -EIO;
goto out;
}
+
+ if (fd.entrylength > sizeof(entry) || fd.entrylength < 0) {
+ err = -EIO;
+ goto out;
+ }
+
hfs_bnode_read(fd.bnode, &entry, fd.entryoffset, fd.entrylength);
type = be16_to_cpu(entry.type);
len = HFSPLUS_MAX_STRLEN;
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 013/165] xfs: Fix possible memory corruption in xfs_readlink
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (11 preceding siblings ...)
2012-08-15 19:45 ` [v2.6.34-stable 012/165] hfsplus: Fix potential buffer overflows Paul Gortmaker
@ 2012-08-15 19:45 ` Paul Gortmaker
2012-08-17 15:38 ` Herton Ronaldo Krzesinski
2012-08-15 19:45 ` [v2.6.34-stable 014/165] KVM: Remove ability to assign a device without iommu support Paul Gortmaker
` (151 subsequent siblings)
164 siblings, 1 reply; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:45 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Carlos Maiolino, Alex Elder, Paul Gortmaker
From: Carlos Maiolino <cmaiolino@redhat.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit b52a360b2aa1c59ba9970fb0f52bbb093fcc7a24 upstream.
Fixes a possible memory corruption when the link is larger than
MAXPATHLEN and XFS_DEBUG is not enabled. This also remove the
S_ISLNK assert, since the inode mode is checked previously in
xfs_readlink_by_handle() and via VFS.
Updated to address concerns raised by Ben Hutchings about the loose
attention paid to 32- vs 64-bit values, and the lack of handling a
potentially negative pathlen value:
- Changed type of "pathlen" to be xfs_fsize_t, to match that of
ip->i_d.di_size
- Added checking for a negative pathlen to the too-long pathlen
test, and generalized the message that gets reported in that case
to reflect the change
As a result, if a negative pathlen were encountered, this function
would return EFSCORRUPTED (and would fail an assertion for a debug
build)--just as would a too-long pathlen.
Signed-off-by: Alex Elder <aelder@sgi.com>
Signed-off-by: Carlos Maiolino <cmaiolino@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
[PG: no xfs_alert in 2.6.34; use xfs_fs_cmn_err(CE_ALERT, ...) instead]
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/xfs/xfs_vnodeops.c | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
diff --git a/fs/xfs/xfs_vnodeops.c b/fs/xfs/xfs_vnodeops.c
index 4498f07..c682c5d 100644
--- a/fs/xfs/xfs_vnodeops.c
+++ b/fs/xfs/xfs_vnodeops.c
@@ -554,7 +554,7 @@ xfs_readlink(
char *link)
{
xfs_mount_t *mp = ip->i_mount;
- int pathlen;
+ xfs_fsize_t pathlen;
int error = 0;
xfs_itrace_entry(ip);
@@ -564,13 +564,19 @@ xfs_readlink(
xfs_ilock(ip, XFS_ILOCK_SHARED);
- ASSERT((ip->i_d.di_mode & S_IFMT) == S_IFLNK);
- ASSERT(ip->i_d.di_size <= MAXPATHLEN);
-
pathlen = ip->i_d.di_size;
if (!pathlen)
goto out;
+ if (pathlen < 0 || pathlen > MAXPATHLEN) {
+ xfs_fs_cmn_err(CE_ALERT, mp,
+ "%s: inode (%llu) bad symlink length (%lld)", __func__,
+ (unsigned long long) ip->i_ino, (long long) pathlen);
+ ASSERT(0);
+ return XFS_ERROR(EFSCORRUPTED);
+ }
+
+
if (ip->i_df.if_flags & XFS_IFINLINE) {
memcpy(link, ip->i_df.if_u1.if_data, pathlen);
link[pathlen] = '\0';
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* Re: [v2.6.34-stable 013/165] xfs: Fix possible memory corruption in xfs_readlink
2012-08-15 19:45 ` [v2.6.34-stable 013/165] xfs: Fix possible memory corruption in xfs_readlink Paul Gortmaker
@ 2012-08-17 15:38 ` Herton Ronaldo Krzesinski
2012-08-17 18:46 ` Paul Gortmaker
0 siblings, 1 reply; 186+ messages in thread
From: Herton Ronaldo Krzesinski @ 2012-08-17 15:38 UTC (permalink / raw)
To: Paul Gortmaker
Cc: stable, linux-kernel, Carlos Maiolino, Alex Elder, Jan Kara,
Ben Myers, Dave Chinner
On Wed, Aug 15, 2012 at 03:45:57PM -0400, Paul Gortmaker wrote:
> From: Carlos Maiolino <cmaiolino@redhat.com>
>
> -------------------
> This is a commit scheduled for the next v2.6.34 longterm release.
> http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
> If you see a problem with using this for longterm, please comment.
> -------------------
>
> commit b52a360b2aa1c59ba9970fb0f52bbb093fcc7a24 upstream.
>
> Fixes a possible memory corruption when the link is larger than
> MAXPATHLEN and XFS_DEBUG is not enabled. This also remove the
> S_ISLNK assert, since the inode mode is checked previously in
> xfs_readlink_by_handle() and via VFS.
>
> Updated to address concerns raised by Ben Hutchings about the loose
> attention paid to 32- vs 64-bit values, and the lack of handling a
> potentially negative pathlen value:
> - Changed type of "pathlen" to be xfs_fsize_t, to match that of
> ip->i_d.di_size
> - Added checking for a negative pathlen to the too-long pathlen
> test, and generalized the message that gets reported in that case
> to reflect the change
> As a result, if a negative pathlen were encountered, this function
> would return EFSCORRUPTED (and would fail an assertion for a debug
> build)--just as would a too-long pathlen.
>
> Signed-off-by: Alex Elder <aelder@sgi.com>
> Signed-off-by: Carlos Maiolino <cmaiolino@redhat.com>
> Reviewed-by: Christoph Hellwig <hch@lst.de>
> [PG: no xfs_alert in 2.6.34; use xfs_fs_cmn_err(CE_ALERT, ...) instead]
> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
[...]
commit 9b025eb3a89e041bab6698e3858706be2385d692 ("xfs: Fix missing
xfs_iunlock() on error recovery path in xfs_readlink()") addresses a
regression with this change, something to consider for inclusion too.
--
[]'s
Herton
^ permalink raw reply [flat|nested] 186+ messages in thread* Re: [v2.6.34-stable 013/165] xfs: Fix possible memory corruption in xfs_readlink
2012-08-17 15:38 ` Herton Ronaldo Krzesinski
@ 2012-08-17 18:46 ` Paul Gortmaker
2012-08-17 19:25 ` Herton Ronaldo Krzesinski
0 siblings, 1 reply; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-17 18:46 UTC (permalink / raw)
To: Herton Ronaldo Krzesinski
Cc: stable, linux-kernel, Carlos Maiolino, Alex Elder, Jan Kara,
Ben Myers, Dave Chinner
On 12-08-17 11:38 AM, Herton Ronaldo Krzesinski wrote:
> On Wed, Aug 15, 2012 at 03:45:57PM -0400, Paul Gortmaker wrote:
>> From: Carlos Maiolino <cmaiolino@redhat.com>
>>
>> -------------------
>> This is a commit scheduled for the next v2.6.34 longterm release.
>> http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
>> If you see a problem with using this for longterm, please comment.
>> -------------------
>>
>> commit b52a360b2aa1c59ba9970fb0f52bbb093fcc7a24 upstream.
>>
>> Fixes a possible memory corruption when the link is larger than
>> MAXPATHLEN and XFS_DEBUG is not enabled. This also remove the
>> S_ISLNK assert, since the inode mode is checked previously in
>> xfs_readlink_by_handle() and via VFS.
>>
>> Updated to address concerns raised by Ben Hutchings about the loose
>> attention paid to 32- vs 64-bit values, and the lack of handling a
>> potentially negative pathlen value:
>> - Changed type of "pathlen" to be xfs_fsize_t, to match that of
>> ip->i_d.di_size
>> - Added checking for a negative pathlen to the too-long pathlen
>> test, and generalized the message that gets reported in that case
>> to reflect the change
>> As a result, if a negative pathlen were encountered, this function
>> would return EFSCORRUPTED (and would fail an assertion for a debug
>> build)--just as would a too-long pathlen.
>>
>> Signed-off-by: Alex Elder <aelder@sgi.com>
>> Signed-off-by: Carlos Maiolino <cmaiolino@redhat.com>
>> Reviewed-by: Christoph Hellwig <hch@lst.de>
>> [PG: no xfs_alert in 2.6.34; use xfs_fs_cmn_err(CE_ALERT, ...) instead]
>> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
> [...]
>
> commit 9b025eb3a89e041bab6698e3858706be2385d692 ("xfs: Fix missing
> xfs_iunlock() on error recovery path in xfs_readlink()") addresses a
> regression with this change, something to consider for inclusion too.
Thanks again Herton. You've convinced me that I need to write
a script that looks for the cherry picked commit ID prefix being
mentioned anywhere in the changelog of any and all new commits
beyond it. It would be a good sanity check...
P.
>
^ permalink raw reply [flat|nested] 186+ messages in thread* Re: [v2.6.34-stable 013/165] xfs: Fix possible memory corruption in xfs_readlink
2012-08-17 18:46 ` Paul Gortmaker
@ 2012-08-17 19:25 ` Herton Ronaldo Krzesinski
0 siblings, 0 replies; 186+ messages in thread
From: Herton Ronaldo Krzesinski @ 2012-08-17 19:25 UTC (permalink / raw)
To: Paul Gortmaker
Cc: stable, linux-kernel, Carlos Maiolino, Alex Elder, Jan Kara,
Ben Myers, Dave Chinner
On Fri, Aug 17, 2012 at 02:46:46PM -0400, Paul Gortmaker wrote:
> On 12-08-17 11:38 AM, Herton Ronaldo Krzesinski wrote:
> > On Wed, Aug 15, 2012 at 03:45:57PM -0400, Paul Gortmaker wrote:
> >> From: Carlos Maiolino <cmaiolino@redhat.com>
> >>
> >> -------------------
> >> This is a commit scheduled for the next v2.6.34 longterm release.
> >> http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
> >> If you see a problem with using this for longterm, please comment.
> >> -------------------
> >>
> >> commit b52a360b2aa1c59ba9970fb0f52bbb093fcc7a24 upstream.
> >>
> >> Fixes a possible memory corruption when the link is larger than
> >> MAXPATHLEN and XFS_DEBUG is not enabled. This also remove the
> >> S_ISLNK assert, since the inode mode is checked previously in
> >> xfs_readlink_by_handle() and via VFS.
> >>
> >> Updated to address concerns raised by Ben Hutchings about the loose
> >> attention paid to 32- vs 64-bit values, and the lack of handling a
> >> potentially negative pathlen value:
> >> - Changed type of "pathlen" to be xfs_fsize_t, to match that of
> >> ip->i_d.di_size
> >> - Added checking for a negative pathlen to the too-long pathlen
> >> test, and generalized the message that gets reported in that case
> >> to reflect the change
> >> As a result, if a negative pathlen were encountered, this function
> >> would return EFSCORRUPTED (and would fail an assertion for a debug
> >> build)--just as would a too-long pathlen.
> >>
> >> Signed-off-by: Alex Elder <aelder@sgi.com>
> >> Signed-off-by: Carlos Maiolino <cmaiolino@redhat.com>
> >> Reviewed-by: Christoph Hellwig <hch@lst.de>
> >> [PG: no xfs_alert in 2.6.34; use xfs_fs_cmn_err(CE_ALERT, ...) instead]
> >> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
> > [...]
> >
> > commit 9b025eb3a89e041bab6698e3858706be2385d692 ("xfs: Fix missing
> > xfs_iunlock() on error recovery path in xfs_readlink()") addresses a
> > regression with this change, something to consider for inclusion too.
>
> Thanks again Herton. You've convinced me that I need to write
> a script that looks for the cherry picked commit ID prefix being
> mentioned anywhere in the changelog of any and all new commits
> beyond it. It would be a good sanity check...
Talking about that, I have one I did, that's what I used to check these ones
I reported, which is on git://kernel.ubuntu.com/ubuntu/kteam-tools.git
Cloning this repository the script is at stable/check-for-fixes. For
example, for 2.6.34 (also I do for other stables usually), I checkout the
2.6.34 stable branch from linux-stable repository, apply the proposed stable
patches, then run from inside the checked out tree
"check-for-fixes --base=<sha of first applied patch>^..". Any range that
git understands is accepted by --base parameter, as the script uses git
directly.
The script prints a list of upstream hashes that have some match and the
commits that reference them, related to the range given to --base argument. It
checks all upstream commits since the tree diverged from the Linus tree,
looking for commits that reference commits in the range of --base.
With the list I then go and take a closer (manual) look to see what fixes that
are needed.
The script is able to filter out things which were already applied to the
branch it's running from. But as it's like a grep, there are some false
positives, or sometimes commits which aren't applicable or just are referencing
other commits for other reasons... but it narrows down and makes easier to
detect. It's so far mostly for my personal use, so the script is not much
user-friendly or very well documented, but you may found to be useful
and don't need to implement other script doing the similar job.
>
> P.
>
> >
>
--
[]'s
Herton
^ permalink raw reply [flat|nested] 186+ messages in thread
* [v2.6.34-stable 014/165] KVM: Remove ability to assign a device without iommu support
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (12 preceding siblings ...)
2012-08-15 19:45 ` [v2.6.34-stable 013/165] xfs: Fix possible memory corruption in xfs_readlink Paul Gortmaker
@ 2012-08-15 19:45 ` Paul Gortmaker
2012-08-15 19:45 ` [v2.6.34-stable 015/165] KVM: Device assignment permission checks Paul Gortmaker
` (150 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:45 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Alex Williamson, Marcelo Tosatti, Paul Gortmaker
From: Alex Williamson <alex.williamson@redhat.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 423873736b78f549fbfa2f715f2e4de7e6c5e1e9 upstream.
This option has no users and it exposes a security hole that we
can allow devices to be assigned without iommu protection. Make
KVM_DEV_ASSIGN_ENABLE_IOMMU a mandatory option.
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
[PG: drop Documentation chunk; no api.txt file in .34 baseline]
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
virt/kvm/assigned-dev.c | 18 +++++++++---------
1 file changed, 9 insertions(+), 9 deletions(-)
diff --git a/virt/kvm/assigned-dev.c b/virt/kvm/assigned-dev.c
index 02ff2b1..1f97473 100644
--- a/virt/kvm/assigned-dev.c
+++ b/virt/kvm/assigned-dev.c
@@ -509,6 +509,9 @@ static int kvm_vm_ioctl_assign_device(struct kvm *kvm,
struct kvm_assigned_dev_kernel *match;
struct pci_dev *dev;
+ if (!(assigned_dev->flags & KVM_DEV_ASSIGN_ENABLE_IOMMU))
+ return -EINVAL;
+
mutex_lock(&kvm->lock);
idx = srcu_read_lock(&kvm->srcu);
@@ -564,16 +567,14 @@ static int kvm_vm_ioctl_assign_device(struct kvm *kvm,
list_add(&match->list, &kvm->arch.assigned_dev_head);
- if (assigned_dev->flags & KVM_DEV_ASSIGN_ENABLE_IOMMU) {
- if (!kvm->arch.iommu_domain) {
- r = kvm_iommu_map_guest(kvm);
- if (r)
- goto out_list_del;
- }
- r = kvm_assign_device(kvm, match);
+ if (!kvm->arch.iommu_domain) {
+ r = kvm_iommu_map_guest(kvm);
if (r)
goto out_list_del;
}
+ r = kvm_assign_device(kvm, match);
+ if (r)
+ goto out_list_del;
out:
srcu_read_unlock(&kvm->srcu, idx);
@@ -610,8 +611,7 @@ static int kvm_vm_ioctl_deassign_device(struct kvm *kvm,
goto out;
}
- if (match->flags & KVM_DEV_ASSIGN_ENABLE_IOMMU)
- kvm_deassign_device(kvm, match);
+ kvm_deassign_device(kvm, match);
kvm_free_assigned_device(kvm, match);
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 015/165] KVM: Device assignment permission checks
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (13 preceding siblings ...)
2012-08-15 19:45 ` [v2.6.34-stable 014/165] KVM: Remove ability to assign a device without iommu support Paul Gortmaker
@ 2012-08-15 19:45 ` Paul Gortmaker
2012-08-15 19:46 ` [v2.6.34-stable 016/165] KVM: Ensure all vcpus are consistent with in-kernel irqchip settings Paul Gortmaker
` (149 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:45 UTC (permalink / raw)
To: stable, linux-kernel
Cc: Alex Williamson, Yang Bai, Marcelo Tosatti, Paul Gortmaker
From: Alex Williamson <alex.williamson@redhat.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 3d27e23b17010c668db311140b17bbbb70c78fb9 upstream.
Only allow KVM device assignment to attach to devices which:
- Are not bridges
- Have BAR resources (assume others are special devices)
- The user has permissions to use
Assigning a bridge is a configuration error, it's not supported, and
typically doesn't result in the behavior the user is expecting anyway.
Devices without BAR resources are typically chipset components that
also don't have host drivers. We don't want users to hold such devices
captive or cause system problems by fencing them off into an iommu
domain. We determine "permission to use" by testing whether the user
has access to the PCI sysfs resource files. By default a normal user
will not have access to these files, so it provides a good indication
that an administration agent has granted the user access to the device.
[Yang Bai: add missing #include]
[avi: fix comment style]
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Yang Bai <hamo.by@gmail.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
[PG: Drop Documentation api.txt chunk; 2.6.34 doesn't have the file]
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
virt/kvm/assigned-dev.c | 75 +++++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 75 insertions(+)
diff --git a/virt/kvm/assigned-dev.c b/virt/kvm/assigned-dev.c
index 1f97473..f427ecc 100644
--- a/virt/kvm/assigned-dev.c
+++ b/virt/kvm/assigned-dev.c
@@ -17,6 +17,8 @@
#include <linux/pci.h>
#include <linux/interrupt.h>
#include <linux/slab.h>
+#include <linux/namei.h>
+#include <linux/fs.h>
#include "irq.h"
static struct kvm_assigned_dev_kernel *kvm_find_assigned_dev(struct list_head *head,
@@ -502,12 +504,73 @@ out:
return r;
}
+/*
+ * We want to test whether the caller has been granted permissions to
+ * use this device. To be able to configure and control the device,
+ * the user needs access to PCI configuration space and BAR resources.
+ * These are accessed through PCI sysfs. PCI config space is often
+ * passed to the process calling this ioctl via file descriptor, so we
+ * can't rely on access to that file. We can check for permissions
+ * on each of the BAR resource files, which is a pretty clear
+ * indicator that the user has been granted access to the device.
+ */
+static int probe_sysfs_permissions(struct pci_dev *dev)
+{
+#ifdef CONFIG_SYSFS
+ int i;
+ bool bar_found = false;
+
+ for (i = PCI_STD_RESOURCES; i <= PCI_STD_RESOURCE_END; i++) {
+ char *kpath, *syspath;
+ struct path path;
+ struct inode *inode;
+ int r;
+
+ if (!pci_resource_len(dev, i))
+ continue;
+
+ kpath = kobject_get_path(&dev->dev.kobj, GFP_KERNEL);
+ if (!kpath)
+ return -ENOMEM;
+
+ /* Per sysfs-rules, sysfs is always at /sys */
+ syspath = kasprintf(GFP_KERNEL, "/sys%s/resource%d", kpath, i);
+ kfree(kpath);
+ if (!syspath)
+ return -ENOMEM;
+
+ r = kern_path(syspath, LOOKUP_FOLLOW, &path);
+ kfree(syspath);
+ if (r)
+ return r;
+
+ inode = path.dentry->d_inode;
+
+ r = inode_permission(inode, MAY_READ | MAY_WRITE | MAY_ACCESS);
+ path_put(&path);
+ if (r)
+ return r;
+
+ bar_found = true;
+ }
+
+ /* If no resources, probably something special */
+ if (!bar_found)
+ return -EPERM;
+
+ return 0;
+#else
+ return -EINVAL; /* No way to control the device without sysfs */
+#endif
+}
+
static int kvm_vm_ioctl_assign_device(struct kvm *kvm,
struct kvm_assigned_pci_dev *assigned_dev)
{
int r = 0, idx;
struct kvm_assigned_dev_kernel *match;
struct pci_dev *dev;
+ u8 header_type;
if (!(assigned_dev->flags & KVM_DEV_ASSIGN_ENABLE_IOMMU))
return -EINVAL;
@@ -538,6 +601,18 @@ static int kvm_vm_ioctl_assign_device(struct kvm *kvm,
r = -EINVAL;
goto out_free;
}
+
+ /* Don't allow bridges to be assigned */
+ pci_read_config_byte(dev, PCI_HEADER_TYPE, &header_type);
+ if ((header_type & PCI_HEADER_TYPE) != PCI_HEADER_TYPE_NORMAL) {
+ r = -EPERM;
+ goto out_put;
+ }
+
+ r = probe_sysfs_permissions(dev);
+ if (r)
+ goto out_put;
+
if (pci_enable_device(dev)) {
printk(KERN_INFO "%s: Could not enable PCI device\n", __func__);
r = -EBUSY;
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 016/165] KVM: Ensure all vcpus are consistent with in-kernel irqchip settings
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (14 preceding siblings ...)
2012-08-15 19:45 ` [v2.6.34-stable 015/165] KVM: Device assignment permission checks Paul Gortmaker
@ 2012-08-15 19:46 ` Paul Gortmaker
2012-08-16 19:30 ` Herton Ronaldo Krzesinski
2012-08-15 19:46 ` [v2.6.34-stable 017/165] security: fix compile error in commoncap.c Paul Gortmaker
` (148 subsequent siblings)
164 siblings, 1 reply; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:46 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Avi Kivity, Michael Ellerman, Paul Gortmaker
From: Avi Kivity <avi@redhat.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 3e515705a1f46beb1c942bb8043c16f8ac7b1e9e upstream.
If some vcpus are created before KVM_CREATE_IRQCHIP, then
irqchip_in_kernel() and vcpu->arch.apic will be inconsistent, leading
to potential NULL pointer dereferences.
Fix by:
- ensuring that no vcpus are installed when KVM_CREATE_IRQCHIP is called
- ensuring that a vcpu has an apic if it is installed after KVM_CREATE_IRQCHIP
This is somewhat long winded because vcpu->arch.apic is created without
kvm->lock held.
Based on earlier patch by Michael Ellerman.
Signed-off-by: Michael Ellerman <michael@ellerman.id.au>
Signed-off-by: Avi Kivity <avi@redhat.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/ia64/kvm/kvm-ia64.c | 5 +++++
arch/x86/kvm/x86.c | 8 ++++++++
include/linux/kvm_host.h | 7 +++++++
virt/kvm/kvm_main.c | 4 ++++
4 files changed, 24 insertions(+)
diff --git a/arch/ia64/kvm/kvm-ia64.c b/arch/ia64/kvm/kvm-ia64.c
index 7f3c0a2..2b7adad 100644
--- a/arch/ia64/kvm/kvm-ia64.c
+++ b/arch/ia64/kvm/kvm-ia64.c
@@ -1179,6 +1179,11 @@ out:
#define PALE_RESET_ENTRY 0x80000000ffffffb0UL
+bool kvm_vcpu_compatible(struct kvm_vcpu *vcpu)
+{
+ return irqchip_in_kernel(vcpu->kcm) == (vcpu->arch.apic != NULL);
+}
+
int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu)
{
struct kvm_vcpu *v;
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 8ced130..c1e586d 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -2764,6 +2764,9 @@ long kvm_arch_vm_ioctl(struct file *filp,
r = -EEXIST;
if (kvm->arch.vpic)
goto create_irqchip_unlock;
+ r = -EINVAL;
+ if (atomic_read(&kvm->online_vcpus))
+ goto create_irqchip_unlock;
r = -ENOMEM;
vpic = kvm_create_pic(kvm);
if (vpic) {
@@ -5586,6 +5589,11 @@ void kvm_arch_check_processor_compat(void *rtn)
kvm_x86_ops->check_processor_compatibility(rtn);
}
+bool kvm_vcpu_compatible(struct kvm_vcpu *vcpu)
+{
+ return irqchip_in_kernel(vcpu->kvm) == (vcpu->arch.apic != NULL);
+}
+
int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu)
{
struct page *page;
diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
index 169d077..94cb72c 100644
--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
@@ -599,6 +599,13 @@ static inline bool kvm_vcpu_is_bsp(struct kvm_vcpu *vcpu)
{
return vcpu->kvm->bsp_vcpu_id == vcpu->vcpu_id;
}
+
+bool kvm_vcpu_compatible(struct kvm_vcpu *vcpu);
+
+#else
+
+static inline bool kvm_vcpu_compatible(struct kvm_vcpu *vcpu) { return true; }
+
#endif
#ifdef __KVM_HAVE_DEVICE_ASSIGNMENT
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index c82ae24..559af38 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -1322,6 +1322,10 @@ static int kvm_vm_ioctl_create_vcpu(struct kvm *kvm, u32 id)
return r;
mutex_lock(&kvm->lock);
+ if (!kvm_vcpu_compatible(vcpu)) {
+ r = -EINVAL;
+ goto unlock_vcpu_destroy;
+ }
if (atomic_read(&kvm->online_vcpus) == KVM_MAX_VCPUS) {
r = -EINVAL;
goto vcpu_destroy;
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* Re: [v2.6.34-stable 016/165] KVM: Ensure all vcpus are consistent with in-kernel irqchip settings
2012-08-15 19:46 ` [v2.6.34-stable 016/165] KVM: Ensure all vcpus are consistent with in-kernel irqchip settings Paul Gortmaker
@ 2012-08-16 19:30 ` Herton Ronaldo Krzesinski
2012-08-16 22:45 ` Paul Gortmaker
0 siblings, 1 reply; 186+ messages in thread
From: Herton Ronaldo Krzesinski @ 2012-08-16 19:30 UTC (permalink / raw)
To: Paul Gortmaker; +Cc: stable, linux-kernel, Avi Kivity, Michael Ellerman
On Wed, Aug 15, 2012 at 03:46:00PM -0400, Paul Gortmaker wrote:
> From: Avi Kivity <avi@redhat.com>
>
> -------------------
> This is a commit scheduled for the next v2.6.34 longterm release.
> http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
> If you see a problem with using this for longterm, please comment.
> -------------------
>
[...]
> diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
> index c82ae24..559af38 100644
> --- a/virt/kvm/kvm_main.c
> +++ b/virt/kvm/kvm_main.c
> @@ -1322,6 +1322,10 @@ static int kvm_vm_ioctl_create_vcpu(struct kvm *kvm, u32 id)
> return r;
>
> mutex_lock(&kvm->lock);
> + if (!kvm_vcpu_compatible(vcpu)) {
> + r = -EINVAL;
> + goto unlock_vcpu_destroy;
> + }
> if (atomic_read(&kvm->online_vcpus) == KVM_MAX_VCPUS) {
> r = -EINVAL;
> goto vcpu_destroy;
Fails to build:
linux-stable/arch/x86/kvm/../../../virt/kvm/kvm_main.c: In function 'kvm_vm_ioctl_create_vcpu':
linux-stable/arch/x86/kvm/../../../virt/kvm/kvm_main.c:1327: error: label 'unlock_vcpu_destroy' used but not defined
Looking at it, vcpu_destroy would be label name to be used instead.
--
[]'s
Herton
^ permalink raw reply [flat|nested] 186+ messages in thread* Re: [v2.6.34-stable 016/165] KVM: Ensure all vcpus are consistent with in-kernel irqchip settings
2012-08-16 19:30 ` Herton Ronaldo Krzesinski
@ 2012-08-16 22:45 ` Paul Gortmaker
0 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-16 22:45 UTC (permalink / raw)
To: Herton Ronaldo Krzesinski
Cc: stable, linux-kernel, Avi Kivity, Michael Ellerman
On 12-08-16 03:30 PM, Herton Ronaldo Krzesinski wrote:
> On Wed, Aug 15, 2012 at 03:46:00PM -0400, Paul Gortmaker wrote:
>> From: Avi Kivity <avi@redhat.com>
>>
>> -------------------
>> This is a commit scheduled for the next v2.6.34 longterm release.
>> http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
>> If you see a problem with using this for longterm, please comment.
>> -------------------
>>
> [...]
>> diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
>> index c82ae24..559af38 100644
>> --- a/virt/kvm/kvm_main.c
>> +++ b/virt/kvm/kvm_main.c
>> @@ -1322,6 +1322,10 @@ static int kvm_vm_ioctl_create_vcpu(struct kvm *kvm, u32 id)
>> return r;
>>
>> mutex_lock(&kvm->lock);
>> + if (!kvm_vcpu_compatible(vcpu)) {
>> + r = -EINVAL;
>> + goto unlock_vcpu_destroy;
>> + }
>> if (atomic_read(&kvm->online_vcpus) == KVM_MAX_VCPUS) {
>> r = -EINVAL;
>> goto vcpu_destroy;
>
> Fails to build:
>
> linux-stable/arch/x86/kvm/../../../virt/kvm/kvm_main.c: In function 'kvm_vm_ioctl_create_vcpu':
> linux-stable/arch/x86/kvm/../../../virt/kvm/kvm_main.c:1327: error: label 'unlock_vcpu_destroy' used but not defined
>
> Looking at it, vcpu_destroy would be label name to be used instead.
Thanks Herton. I'm not sure how I missed that in my allyesconfig
builds -- I must have got distracted by the noise coming from
building (or failing to) from the stuff in Documentation / samples
Re-doing x86 & x86-64 allyesconfig testing and will push the fix
once they complete.
Thanks again,
Paul.
--
>
^ permalink raw reply [flat|nested] 186+ messages in thread
* [v2.6.34-stable 017/165] security: fix compile error in commoncap.c
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (15 preceding siblings ...)
2012-08-15 19:46 ` [v2.6.34-stable 016/165] KVM: Ensure all vcpus are consistent with in-kernel irqchip settings Paul Gortmaker
@ 2012-08-15 19:46 ` Paul Gortmaker
2012-08-15 19:46 ` [v2.6.34-stable 018/165] fcaps: clear the same personality flags as suid when fcaps are used Paul Gortmaker
` (147 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:46 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Jonghwan Choi, James Morris, Paul Gortmaker
From: Jonghwan Choi <jhbird.choi@samsung.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 51b79bee627d526199b2f6a6bef8ee0c0739b6d1 upstream.
Add missing "personality.h"
security/commoncap.c: In function 'cap_bprm_set_creds':
security/commoncap.c:510: error: 'PER_CLEAR_ON_SETID' undeclared (first use in this function)
security/commoncap.c:510: error: (Each undeclared identifier is reported only once
security/commoncap.c:510: error: for each function it appears in.)
Signed-off-by: Jonghwan Choi <jhbird.choi@samsung.com>
Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: James Morris <james.l.morris@oracle.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
security/commoncap.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/security/commoncap.c b/security/commoncap.c
index 6166973..3927418 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -28,6 +28,7 @@
#include <linux/prctl.h>
#include <linux/securebits.h>
#include <linux/syslog.h>
+#include <linux/personality.h>
/*
* If a non-root user executes a setuid-root binary in
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 018/165] fcaps: clear the same personality flags as suid when fcaps are used
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (16 preceding siblings ...)
2012-08-15 19:46 ` [v2.6.34-stable 017/165] security: fix compile error in commoncap.c Paul Gortmaker
@ 2012-08-15 19:46 ` Paul Gortmaker
2012-08-15 19:46 ` [v2.6.34-stable 019/165] KEYS: Fix a NULL pointer deref in the user-defined key type Paul Gortmaker
` (146 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:46 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Eric Paris, James Morris, Paul Gortmaker
From: Eric Paris <eparis@redhat.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit d52fc5dde171f030170a6cb78034d166b13c9445 upstream.
If a process increases permissions using fcaps all of the dangerous
personality flags which are cleared for suid apps should also be cleared.
Thus programs given priviledge with fcaps will continue to have address space
randomization enabled even if the parent tried to disable it to make it
easier to attack.
Signed-off-by: Eric Paris <eparis@redhat.com>
Reviewed-by: Serge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: James Morris <james.l.morris@oracle.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
security/commoncap.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/security/commoncap.c b/security/commoncap.c
index 3927418..c325d38 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -466,6 +466,11 @@ int cap_bprm_set_creds(struct linux_binprm *bprm)
}
skip:
+ /* if we have fs caps, clear dangerous personality flags */
+ if (!cap_issubset(new->cap_permitted, old->cap_permitted))
+ bprm->per_clear |= PER_CLEAR_ON_SETID;
+
+
/* Don't let someone trace a set[ug]id/setpcap binary with the revised
* credentials unless they have the appropriate permit
*/
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 019/165] KEYS: Fix a NULL pointer deref in the user-defined key type
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (17 preceding siblings ...)
2012-08-15 19:46 ` [v2.6.34-stable 018/165] fcaps: clear the same personality flags as suid when fcaps are used Paul Gortmaker
@ 2012-08-15 19:46 ` Paul Gortmaker
2012-08-15 19:46 ` [v2.6.34-stable 020/165] locks: fix checking of fcntl_setlease argument Paul Gortmaker
` (145 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:46 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: David Howells, Linus Torvalds, Paul Gortmaker
From: David Howells <dhowells@redhat.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 9f35a33b8d06263a165efe3541d9aa0cdbd70b3b upstream.
Fix a NULL pointer deref in the user-defined key type whereby updating a
negative key into a fully instantiated key will cause an oops to occur
when the code attempts to free the non-existent old payload.
This results in an oops that looks something like the following:
BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
IP: [<ffffffff81085fa1>] __call_rcu+0x11/0x13e
PGD 3391d067 PUD 3894a067 PMD 0
Oops: 0002 [#1] SMP
CPU 1
Pid: 4354, comm: keyctl Not tainted 3.1.0-fsdevel+ #1140 /DG965RY
RIP: 0010:[<ffffffff81085fa1>] [<ffffffff81085fa1>] __call_rcu+0x11/0x13e
RSP: 0018:ffff88003d591df8 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000000000006e
RDX: ffffffff8161d0c0 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff88003d591e18 R08: 0000000000000000 R09: ffffffff8152fa6c
R10: 0000000000000000 R11: 0000000000000300 R12: ffff88003b8f9538
R13: ffffffff8161d0c0 R14: ffff88003b8f9d50 R15: ffff88003c69f908
FS: 00007f97eb18c720(0000) GS:ffff88003bd00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000008 CR3: 000000003d47a000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process keyctl (pid: 4354, threadinfo ffff88003d590000, task ffff88003c78a040)
Stack:
ffff88003e0ffde0 ffff88003b8f9538 0000000000000001 ffff88003b8f9d50
ffff88003d591e28 ffffffff810860f0 ffff88003d591e68 ffffffff8117bfea
ffff88003d591e68 ffffffff00000000 ffff88003e0ffde1 ffff88003e0ffde0
Call Trace:
[<ffffffff810860f0>] call_rcu_sched+0x10/0x12
[<ffffffff8117bfea>] user_update+0x8d/0xa2
[<ffffffff8117723a>] key_create_or_update+0x236/0x270
[<ffffffff811789b1>] sys_add_key+0x123/0x17e
[<ffffffff813b84bb>] system_call_fastpath+0x16/0x1b
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Jeff Layton <jlayton@redhat.com>
Acked-by: Neil Horman <nhorman@redhat.com>
Acked-by: Steve Dickson <steved@redhat.com>
Acked-by: James Morris <jmorris@namei.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[PG: pre-3.0 kernels dont have kfree_rcu, so tweak accordingly]
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
security/keys/user_defined.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/security/keys/user_defined.c b/security/keys/user_defined.c
index e9aa079..d6781b9 100644
--- a/security/keys/user_defined.c
+++ b/security/keys/user_defined.c
@@ -119,7 +119,8 @@ int user_update(struct key *key, const void *data, size_t datalen)
key->expiry = 0;
}
- call_rcu(&zap->rcu, user_update_rcu_disposal);
+ if (zap)
+ call_rcu(&zap->rcu, user_update_rcu_disposal);
error:
return ret;
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 020/165] locks: fix checking of fcntl_setlease argument
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (18 preceding siblings ...)
2012-08-15 19:46 ` [v2.6.34-stable 019/165] KEYS: Fix a NULL pointer deref in the user-defined key type Paul Gortmaker
@ 2012-08-15 19:46 ` Paul Gortmaker
2012-08-15 19:46 ` [v2.6.34-stable 021/165] USB: ftdi_sio: add Calao reference board support Paul Gortmaker
` (144 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:46 UTC (permalink / raw)
To: stable, linux-kernel
Cc: J. Bruce Fields, J. Bruce Fields, Linus Torvalds, Paul Gortmaker
From: "J. Bruce Fields" <bfields@fieldses.org>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 0ec4f431eb56d633da3a55da67d5c4b88886ccc7 upstream.
The only checks of the long argument passed to fcntl(fd,F_SETLEASE,.)
are done after converting the long to an int. Thus some illegal values
may be let through and cause problems in later code.
[ They actually *don't* cause problems in mainline, as of Dave Jones's
commit 8d657eb3b438 "Remove easily user-triggerable BUG from
generic_setlease", but we should fix this anyway. And this patch will
be necessary to fix real bugs on earlier kernels. ]
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/locks.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/fs/locks.c b/fs/locks.c
index ab24d49..8cedfbf 100644
--- a/fs/locks.c
+++ b/fs/locks.c
@@ -291,7 +291,7 @@ static int flock_make_lock(struct file *filp, struct file_lock **lock,
return 0;
}
-static int assign_type(struct file_lock *fl, int type)
+static int assign_type(struct file_lock *fl, long type)
{
switch (type) {
case F_RDLCK:
@@ -444,7 +444,7 @@ static const struct lock_manager_operations lease_manager_ops = {
/*
* Initialize a lease, use the default lock manager operations
*/
-static int lease_init(struct file *filp, int type, struct file_lock *fl)
+static int lease_init(struct file *filp, long type, struct file_lock *fl)
{
if (assign_type(fl, type) != 0)
return -EINVAL;
@@ -462,7 +462,7 @@ static int lease_init(struct file *filp, int type, struct file_lock *fl)
}
/* Allocate a file_lock initialised to this type of lease */
-static struct file_lock *lease_alloc(struct file *filp, int type)
+static struct file_lock *lease_alloc(struct file *filp, long type)
{
struct file_lock *fl = locks_alloc_lock();
int error = -ENOMEM;
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 021/165] USB: ftdi_sio: add Calao reference board support
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (19 preceding siblings ...)
2012-08-15 19:46 ` [v2.6.34-stable 020/165] locks: fix checking of fcntl_setlease argument Paul Gortmaker
@ 2012-08-15 19:46 ` Paul Gortmaker
2012-08-15 19:46 ` [v2.6.34-stable 022/165] USB: EHCI: Do not rely on PORT_SUSPEND to stop USB resuming in ehci_bus_resume() Paul Gortmaker
` (143 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:46 UTC (permalink / raw)
To: stable, linux-kernel
Cc: Jean-Christophe PLAGNIOL-VILLARD, Gregory Hermant, Alan Cox,
Greg Kroah-Hartman, Paul Gortmaker
From: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit c96fbdd0ab97235f930ebf24b38fa42a2e3458cf upstream.
Calao use on there dev kits a FT2232 where the port 0 is used for the JTAG and
port 1 for the UART
They use the same VID and PID as FTDI Chip but they program the manufacturer
name in the eeprom
So use this information to detect it
Signed-off-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
Cc: Gregory Hermant <gregory.hermant@calao-systems.com>
Cc: Alan Cox <alan@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/usb/serial/ftdi_sio.c | 20 +++++++++++++++++++-
1 file changed, 19 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index c7e4fb8..e8bc908 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -105,6 +105,7 @@ static int ftdi_jtag_probe(struct usb_serial *serial);
static int ftdi_mtxorb_hack_setup(struct usb_serial *serial);
static int ftdi_NDI_device_setup(struct usb_serial *serial);
static int ftdi_stmclite_probe(struct usb_serial *serial);
+static int ftdi_8u2232c_probe(struct usb_serial *serial);
static void ftdi_USB_UIRT_setup(struct ftdi_private *priv);
static void ftdi_HE_TIRA1_setup(struct ftdi_private *priv);
@@ -132,6 +133,10 @@ static struct ftdi_sio_quirk ftdi_stmclite_quirk = {
.probe = ftdi_stmclite_probe,
};
+static struct ftdi_sio_quirk ftdi_8u2232c_quirk = {
+ .probe = ftdi_8u2232c_probe,
+};
+
/*
* The 8U232AM has the same API as the sio except for:
* - it can support MUCH higher baudrates; up to:
@@ -181,7 +186,8 @@ static struct usb_device_id id_table_combined [] = {
{ USB_DEVICE(FTDI_VID, FTDI_8U232AM_PID) },
{ USB_DEVICE(FTDI_VID, FTDI_8U232AM_ALT_PID) },
{ USB_DEVICE(FTDI_VID, FTDI_232RL_PID) },
- { USB_DEVICE(FTDI_VID, FTDI_8U2232C_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_8U2232C_PID) ,
+ .driver_info = (kernel_ulong_t)&ftdi_8u2232c_quirk },
{ USB_DEVICE(FTDI_VID, FTDI_4232H_PID) },
{ USB_DEVICE(FTDI_VID, FTDI_MICRO_CHAMELEON_PID) },
{ USB_DEVICE(FTDI_VID, FTDI_RELAIS_PID) },
@@ -1749,6 +1755,18 @@ static int ftdi_jtag_probe(struct usb_serial *serial)
return 0;
}
+static int ftdi_8u2232c_probe(struct usb_serial *serial)
+{
+ struct usb_device *udev = serial->dev;
+
+ dbg("%s", __func__);
+
+ if (strcmp(udev->manufacturer, "CALAO Systems") == 0)
+ return ftdi_jtag_probe(serial);
+
+ return 0;
+}
+
/*
* First and second port on STMCLiteadaptors is reserved for JTAG interface
* and the forth port for pio
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 022/165] USB: EHCI: Do not rely on PORT_SUSPEND to stop USB resuming in ehci_bus_resume().
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (20 preceding siblings ...)
2012-08-15 19:46 ` [v2.6.34-stable 021/165] USB: ftdi_sio: add Calao reference board support Paul Gortmaker
@ 2012-08-15 19:46 ` Paul Gortmaker
2012-08-15 19:46 ` [v2.6.34-stable 023/165] rt2x00: do not drop usb dev reference counter on suspend Paul Gortmaker
` (142 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:46 UTC (permalink / raw)
To: stable, linux-kernel
Cc: Wang Zhi, Alan Stern, Greg Kroah-Hartman, Paul Gortmaker
From: Wang Zhi <zhi.wang@windriver.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit d0f2fb2500b1c5fe4967eb45d8c9bc758d7aef80 upstream.
>From EHCI Spec p.28 HC should clear PORT_SUSPEND when SW clears
PORT_RESUME. In Intel Oaktrail platform, MPH (Multi-Port Host
Controller) core clears PORT_SUSPEND directly when SW sets PORT_RESUME
bit. If we rely on PORT_SUSPEND bit to stop USB resume, we will miss
the action of clearing PORT_RESUME. This will cause unexpected long
resume signal on USB bus.
Signed-off-by: Wang Zhi <zhi.wang@windriver.com>
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/usb/host/ehci-hub.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c
index ae32f02..d5ff2b0 100644
--- a/drivers/usb/host/ehci-hub.c
+++ b/drivers/usb/host/ehci-hub.c
@@ -311,7 +311,7 @@ static int ehci_bus_resume (struct usb_hcd *hcd)
u32 temp;
u32 power_okay;
int i;
- u8 resume_needed = 0;
+ unsigned long resume_needed = 0;
if (time_before (jiffies, ehci->next_statechange))
msleep(5);
@@ -384,7 +384,7 @@ static int ehci_bus_resume (struct usb_hcd *hcd)
if (test_bit(i, &ehci->bus_suspended) &&
(temp & PORT_SUSPEND)) {
temp |= PORT_RESUME;
- resume_needed = 1;
+ set_bit(i, &resume_needed);
}
ehci_writel(ehci, temp, &ehci->regs->port_status [i]);
}
@@ -399,8 +399,7 @@ static int ehci_bus_resume (struct usb_hcd *hcd)
i = HCS_N_PORTS (ehci->hcs_params);
while (i--) {
temp = ehci_readl(ehci, &ehci->regs->port_status [i]);
- if (test_bit(i, &ehci->bus_suspended) &&
- (temp & PORT_SUSPEND)) {
+ if (test_bit(i, &resume_needed)) {
temp &= ~(PORT_RWC_BITS | PORT_RESUME);
ehci_writel(ehci, temp, &ehci->regs->port_status [i]);
ehci_vdbg (ehci, "resumed port %d\n", i + 1);
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 023/165] rt2x00: do not drop usb dev reference counter on suspend
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (21 preceding siblings ...)
2012-08-15 19:46 ` [v2.6.34-stable 022/165] USB: EHCI: Do not rely on PORT_SUSPEND to stop USB resuming in ehci_bus_resume() Paul Gortmaker
@ 2012-08-15 19:46 ` Paul Gortmaker
2012-08-15 19:46 ` [v2.6.34-stable 024/165] atm: br2684: Fix oops due to skb->dev being NULL Paul Gortmaker
` (141 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:46 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Stanislaw Gruszka, John W. Linville, Paul Gortmaker
From: Stanislaw Gruszka <sgruszka@redhat.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 543cc38c8fe86deba4169977c61eb88491036837 upstream.
When hibernating ->resume may not be called by usb core, but disconnect
and probe instead, so we do not increase the counter after decreasing
it in ->supend. As a result we free memory early, and get crash when
unplugging usb dongle.
BUG: unable to handle kernel paging request at 6b6b6b9f
IP: [<c06909b0>] driver_sysfs_remove+0x10/0x30
*pdpt = 0000000034f21001 *pde = 0000000000000000
Pid: 20, comm: khubd Not tainted 3.1.0-rc1-wl+ #20 LENOVO 6369CTO/6369CTO
EIP: 0060:[<c06909b0>] EFLAGS: 00010202 CPU: 1
EIP is at driver_sysfs_remove+0x10/0x30
EAX: 6b6b6b6b EBX: f52bba34 ECX: 00000000 EDX: 6b6b6b6b
ESI: 6b6b6b6b EDI: c0a0ea20 EBP: f61c9e68 ESP: f61c9e64
DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
Process khubd (pid: 20, ti=f61c8000 task=f6138270 task.ti=f61c8000)
Call Trace:
[<c06909ef>] __device_release_driver+0x1f/0xa0
[<c0690b20>] device_release_driver+0x20/0x40
[<c068fd64>] bus_remove_device+0x84/0xe0
[<c068e12a>] ? device_remove_attrs+0x2a/0x80
[<c068e267>] device_del+0xe7/0x170
[<c06d93d4>] usb_disconnect+0xd4/0x180
[<c06d9d61>] hub_thread+0x691/0x1600
[<c0473260>] ? wake_up_bit+0x30/0x30
[<c0442a39>] ? complete+0x49/0x60
[<c06d96d0>] ? hub_disconnect+0xd0/0xd0
[<c06d96d0>] ? hub_disconnect+0xd0/0xd0
[<c0472eb4>] kthread+0x74/0x80
[<c0472e40>] ? kthread_worker_fn+0x150/0x150
[<c0809b3e>] kernel_thread_helper+0x6/0x10
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Acked-by: Ivo van Doorn <IvDoorn@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/net/wireless/rt2x00/rt2x00usb.c | 14 +-------------
1 file changed, 1 insertion(+), 13 deletions(-)
diff --git a/drivers/net/wireless/rt2x00/rt2x00usb.c b/drivers/net/wireless/rt2x00/rt2x00usb.c
index f9a7f8b..f423c65 100644
--- a/drivers/net/wireless/rt2x00/rt2x00usb.c
+++ b/drivers/net/wireless/rt2x00/rt2x00usb.c
@@ -706,18 +706,8 @@ int rt2x00usb_suspend(struct usb_interface *usb_intf, pm_message_t state)
{
struct ieee80211_hw *hw = usb_get_intfdata(usb_intf);
struct rt2x00_dev *rt2x00dev = hw->priv;
- int retval;
-
- retval = rt2x00lib_suspend(rt2x00dev, state);
- if (retval)
- return retval;
- /*
- * Decrease usbdev refcount.
- */
- usb_put_dev(interface_to_usbdev(usb_intf));
-
- return 0;
+ return rt2x00lib_suspend(rt2x00dev, state);
}
EXPORT_SYMBOL_GPL(rt2x00usb_suspend);
@@ -726,8 +716,6 @@ int rt2x00usb_resume(struct usb_interface *usb_intf)
struct ieee80211_hw *hw = usb_get_intfdata(usb_intf);
struct rt2x00_dev *rt2x00dev = hw->priv;
- usb_get_dev(interface_to_usbdev(usb_intf));
-
return rt2x00lib_resume(rt2x00dev);
}
EXPORT_SYMBOL_GPL(rt2x00usb_resume);
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 024/165] atm: br2684: Fix oops due to skb->dev being NULL
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (22 preceding siblings ...)
2012-08-15 19:46 ` [v2.6.34-stable 023/165] rt2x00: do not drop usb dev reference counter on suspend Paul Gortmaker
@ 2012-08-15 19:46 ` Paul Gortmaker
2012-08-15 19:46 ` [v2.6.34-stable 025/165] sparc: Allow handling signals when stack is corrupted Paul Gortmaker
` (140 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:46 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Daniel Schwierzeck, David S. Miller, Paul Gortmaker
From: Daniel Schwierzeck <daniel.schwierzeck@googlemail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit fbe5e29ec1886967255e76946aaf537b8cc9b81e upstream.
This oops have been already fixed with commit
27141666b69f535a4d63d7bc6d9e84ee5032f82a
atm: [br2684] Fix oops due to skb->dev being NULL
It happens that if a packet arrives in a VC between the call to open it on
the hardware and the call to change the backend to br2684, br2684_regvcc
processes the packet and oopses dereferencing skb->dev because it is
NULL before the call to br2684_push().
but have been introduced again with commit
b6211ae7f2e56837c6a4849316396d1535606e90
atm: Use SKB queue and list helpers instead of doing it by-hand.
Signed-off-by: Daniel Schwierzeck <daniel.schwierzeck@googlemail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
net/atm/br2684.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/net/atm/br2684.c b/net/atm/br2684.c
index f3bae14..e9b5677 100644
--- a/net/atm/br2684.c
+++ b/net/atm/br2684.c
@@ -522,12 +522,13 @@ static int br2684_regvcc(struct atm_vcc *atmvcc, void __user * arg)
spin_unlock_irqrestore(&rq->lock, flags);
skb_queue_walk_safe(&queue, skb, tmp) {
- struct net_device *dev = skb->dev;
+ struct net_device *dev;
+
+ br2684_push(atmvcc, skb);
+ dev = skb->dev;
dev->stats.rx_bytes -= skb->len;
dev->stats.rx_packets--;
-
- br2684_push(atmvcc, skb);
}
__module_get(THIS_MODULE);
return 0;
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 025/165] sparc: Allow handling signals when stack is corrupted.
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (23 preceding siblings ...)
2012-08-15 19:46 ` [v2.6.34-stable 024/165] atm: br2684: Fix oops due to skb->dev being NULL Paul Gortmaker
@ 2012-08-15 19:46 ` Paul Gortmaker
2012-08-15 19:46 ` [v2.6.34-stable 026/165] sparc: fix array bounds error setting up PCIC NMI trap Paul Gortmaker
` (139 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:46 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: David S. Miller, Paul Gortmaker
From: "David S. Miller" <davem@davemloft.net>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 5598473a5b40c47a8c5349dd2c2630797169cf1a upstream.
If we can't push the pending register windows onto the user's stack,
we disallow signal delivery even if the signal would be delivered on a
valid seperate signal stack.
Add a register window save area in the signal frame, and store any
unsavable windows there.
On sigreturn, if any windows are still queued up in the signal frame,
try to push them back onto the stack and if that fails we kill the
process immediately.
This allows the debug/tst-longjmp_chk2 glibc test case to pass.
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/sparc/include/asm/sigcontext.h | 14 +++
arch/sparc/kernel/Makefile | 1 +
arch/sparc/kernel/signal32.c | 184 ++++++++++++++++++++----------------
arch/sparc/kernel/signal_32.c | 172 ++++++++++++++++-----------------
arch/sparc/kernel/signal_64.c | 108 +++++++++------------
arch/sparc/kernel/sigutil.h | 9 ++
arch/sparc/kernel/sigutil_32.c | 120 +++++++++++++++++++++++
arch/sparc/kernel/sigutil_64.c | 93 ++++++++++++++++++
8 files changed, 468 insertions(+), 233 deletions(-)
create mode 100644 arch/sparc/kernel/sigutil.h
create mode 100644 arch/sparc/kernel/sigutil_32.c
create mode 100644 arch/sparc/kernel/sigutil_64.c
diff --git a/arch/sparc/include/asm/sigcontext.h b/arch/sparc/include/asm/sigcontext.h
index a1607d1..69914d7 100644
--- a/arch/sparc/include/asm/sigcontext.h
+++ b/arch/sparc/include/asm/sigcontext.h
@@ -45,6 +45,19 @@ typedef struct {
int si_mask;
} __siginfo32_t;
+#define __SIGC_MAXWIN 7
+
+typedef struct {
+ unsigned long locals[8];
+ unsigned long ins[8];
+} __siginfo_reg_window;
+
+typedef struct {
+ int wsaved;
+ __siginfo_reg_window reg_window[__SIGC_MAXWIN];
+ unsigned long rwbuf_stkptrs[__SIGC_MAXWIN];
+} __siginfo_rwin_t;
+
#ifdef CONFIG_SPARC64
typedef struct {
unsigned int si_float_regs [64];
@@ -73,6 +86,7 @@ struct sigcontext {
unsigned long ss_size;
} sigc_stack;
unsigned long sigc_mask;
+ __siginfo_rwin_t * sigc_rwin_save;
};
#else
diff --git a/arch/sparc/kernel/Makefile b/arch/sparc/kernel/Makefile
index 0c2dc1f..d493568 100644
--- a/arch/sparc/kernel/Makefile
+++ b/arch/sparc/kernel/Makefile
@@ -32,6 +32,7 @@ obj-$(CONFIG_SPARC32) += sun4m_irq.o sun4c_irq.o sun4d_irq.o
obj-y += process_$(BITS).o
obj-y += signal_$(BITS).o
+obj-y += sigutil_$(BITS).o
obj-$(CONFIG_SPARC32) += ioport.o
obj-y += setup_$(BITS).o
obj-y += idprom.o
diff --git a/arch/sparc/kernel/signal32.c b/arch/sparc/kernel/signal32.c
index 75fad42..5d92488 100644
--- a/arch/sparc/kernel/signal32.c
+++ b/arch/sparc/kernel/signal32.c
@@ -29,6 +29,8 @@
#include <asm/visasm.h>
#include <asm/compat_signal.h>
+#include "sigutil.h"
+
#define _BLOCKABLE (~(sigmask(SIGKILL) | sigmask(SIGSTOP)))
/* This magic should be in g_upper[0] for all upper parts
@@ -44,14 +46,14 @@ typedef struct {
struct signal_frame32 {
struct sparc_stackf32 ss;
__siginfo32_t info;
- /* __siginfo_fpu32_t * */ u32 fpu_save;
+ /* __siginfo_fpu_t * */ u32 fpu_save;
unsigned int insns[2];
unsigned int extramask[_COMPAT_NSIG_WORDS - 1];
unsigned int extra_size; /* Should be sizeof(siginfo_extra_v8plus_t) */
/* Only valid if (info.si_regs.psr & (PSR_VERS|PSR_IMPL)) == PSR_V8PLUS */
siginfo_extra_v8plus_t v8plus;
- __siginfo_fpu_t fpu_state;
-};
+ /* __siginfo_rwin_t * */u32 rwin_save;
+} __attribute__((aligned(8)));
typedef struct compat_siginfo{
int si_signo;
@@ -110,18 +112,14 @@ struct rt_signal_frame32 {
compat_siginfo_t info;
struct pt_regs32 regs;
compat_sigset_t mask;
- /* __siginfo_fpu32_t * */ u32 fpu_save;
+ /* __siginfo_fpu_t * */ u32 fpu_save;
unsigned int insns[2];
stack_t32 stack;
unsigned int extra_size; /* Should be sizeof(siginfo_extra_v8plus_t) */
/* Only valid if (regs.psr & (PSR_VERS|PSR_IMPL)) == PSR_V8PLUS */
siginfo_extra_v8plus_t v8plus;
- __siginfo_fpu_t fpu_state;
-};
-
-/* Align macros */
-#define SF_ALIGNEDSZ (((sizeof(struct signal_frame32) + 15) & (~15)))
-#define RT_ALIGNEDSZ (((sizeof(struct rt_signal_frame32) + 15) & (~15)))
+ /* __siginfo_rwin_t * */u32 rwin_save;
+} __attribute__((aligned(8)));
int copy_siginfo_to_user32(compat_siginfo_t __user *to, siginfo_t *from)
{
@@ -192,30 +190,13 @@ int copy_siginfo_from_user32(siginfo_t *to, compat_siginfo_t __user *from)
return 0;
}
-static int restore_fpu_state32(struct pt_regs *regs, __siginfo_fpu_t __user *fpu)
-{
- unsigned long *fpregs = current_thread_info()->fpregs;
- unsigned long fprs;
- int err;
-
- err = __get_user(fprs, &fpu->si_fprs);
- fprs_write(0);
- regs->tstate &= ~TSTATE_PEF;
- if (fprs & FPRS_DL)
- err |= copy_from_user(fpregs, &fpu->si_float_regs[0], (sizeof(unsigned int) * 32));
- if (fprs & FPRS_DU)
- err |= copy_from_user(fpregs+16, &fpu->si_float_regs[32], (sizeof(unsigned int) * 32));
- err |= __get_user(current_thread_info()->xfsr[0], &fpu->si_fsr);
- err |= __get_user(current_thread_info()->gsr[0], &fpu->si_gsr);
- current_thread_info()->fpsaved[0] |= fprs;
- return err;
-}
-
void do_sigreturn32(struct pt_regs *regs)
{
struct signal_frame32 __user *sf;
+ compat_uptr_t fpu_save;
+ compat_uptr_t rwin_save;
unsigned int psr;
- unsigned pc, npc, fpu_save;
+ unsigned pc, npc;
sigset_t set;
unsigned seta[_COMPAT_NSIG_WORDS];
int err, i;
@@ -273,8 +254,13 @@ void do_sigreturn32(struct pt_regs *regs)
pt_regs_clear_syscall(regs);
err |= __get_user(fpu_save, &sf->fpu_save);
- if (fpu_save)
- err |= restore_fpu_state32(regs, &sf->fpu_state);
+ if (!err && fpu_save)
+ err |= restore_fpu_state(regs, compat_ptr(fpu_save));
+ err |= __get_user(rwin_save, &sf->rwin_save);
+ if (!err && rwin_save) {
+ if (restore_rwin_state(compat_ptr(rwin_save)))
+ goto segv;
+ }
err |= __get_user(seta[0], &sf->info.si_mask);
err |= copy_from_user(seta+1, &sf->extramask,
(_COMPAT_NSIG_WORDS - 1) * sizeof(unsigned int));
@@ -300,7 +286,9 @@ segv:
asmlinkage void do_rt_sigreturn32(struct pt_regs *regs)
{
struct rt_signal_frame32 __user *sf;
- unsigned int psr, pc, npc, fpu_save, u_ss_sp;
+ unsigned int psr, pc, npc, u_ss_sp;
+ compat_uptr_t fpu_save;
+ compat_uptr_t rwin_save;
mm_segment_t old_fs;
sigset_t set;
compat_sigset_t seta;
@@ -359,8 +347,8 @@ asmlinkage void do_rt_sigreturn32(struct pt_regs *regs)
pt_regs_clear_syscall(regs);
err |= __get_user(fpu_save, &sf->fpu_save);
- if (fpu_save)
- err |= restore_fpu_state32(regs, &sf->fpu_state);
+ if (!err && fpu_save)
+ err |= restore_fpu_state(regs, compat_ptr(fpu_save));
err |= copy_from_user(&seta, &sf->mask, sizeof(compat_sigset_t));
err |= __get_user(u_ss_sp, &sf->stack.ss_sp);
st.ss_sp = compat_ptr(u_ss_sp);
@@ -376,6 +364,12 @@ asmlinkage void do_rt_sigreturn32(struct pt_regs *regs)
do_sigaltstack((stack_t __user *) &st, NULL, (unsigned long)sf);
set_fs(old_fs);
+ err |= __get_user(rwin_save, &sf->rwin_save);
+ if (!err && rwin_save) {
+ if (restore_rwin_state(compat_ptr(rwin_save)))
+ goto segv;
+ }
+
switch (_NSIG_WORDS) {
case 4: set.sig[3] = seta.sig[6] + (((long)seta.sig[7]) << 32);
case 3: set.sig[2] = seta.sig[4] + (((long)seta.sig[5]) << 32);
@@ -433,26 +427,6 @@ static void __user *get_sigframe(struct sigaction *sa, struct pt_regs *regs, uns
return (void __user *) sp;
}
-static int save_fpu_state32(struct pt_regs *regs, __siginfo_fpu_t __user *fpu)
-{
- unsigned long *fpregs = current_thread_info()->fpregs;
- unsigned long fprs;
- int err = 0;
-
- fprs = current_thread_info()->fpsaved[0];
- if (fprs & FPRS_DL)
- err |= copy_to_user(&fpu->si_float_regs[0], fpregs,
- (sizeof(unsigned int) * 32));
- if (fprs & FPRS_DU)
- err |= copy_to_user(&fpu->si_float_regs[32], fpregs+16,
- (sizeof(unsigned int) * 32));
- err |= __put_user(current_thread_info()->xfsr[0], &fpu->si_fsr);
- err |= __put_user(current_thread_info()->gsr[0], &fpu->si_gsr);
- err |= __put_user(fprs, &fpu->si_fprs);
-
- return err;
-}
-
/* The I-cache flush instruction only works in the primary ASI, which
* right now is the nucleus, aka. kernel space.
*
@@ -515,18 +489,23 @@ static int setup_frame32(struct k_sigaction *ka, struct pt_regs *regs,
int signo, sigset_t *oldset)
{
struct signal_frame32 __user *sf;
+ int i, err, wsaved;
+ void __user *tail;
int sigframe_size;
u32 psr;
- int i, err;
unsigned int seta[_COMPAT_NSIG_WORDS];
/* 1. Make sure everything is clean */
synchronize_user_stack();
save_and_clear_fpu();
- sigframe_size = SF_ALIGNEDSZ;
- if (!(current_thread_info()->fpsaved[0] & FPRS_FEF))
- sigframe_size -= sizeof(__siginfo_fpu_t);
+ wsaved = get_thread_wsaved();
+
+ sigframe_size = sizeof(*sf);
+ if (current_thread_info()->fpsaved[0] & FPRS_FEF)
+ sigframe_size += sizeof(__siginfo_fpu_t);
+ if (wsaved)
+ sigframe_size += sizeof(__siginfo_rwin_t);
sf = (struct signal_frame32 __user *)
get_sigframe(&ka->sa, regs, sigframe_size);
@@ -534,8 +513,7 @@ static int setup_frame32(struct k_sigaction *ka, struct pt_regs *regs,
if (invalid_frame_pointer(sf, sigframe_size))
goto sigill;
- if (get_thread_wsaved() != 0)
- goto sigill;
+ tail = (sf + 1);
/* 2. Save the current process state */
if (test_thread_flag(TIF_32BIT)) {
@@ -560,11 +538,22 @@ static int setup_frame32(struct k_sigaction *ka, struct pt_regs *regs,
&sf->v8plus.asi);
if (psr & PSR_EF) {
- err |= save_fpu_state32(regs, &sf->fpu_state);
- err |= __put_user((u64)&sf->fpu_state, &sf->fpu_save);
+ __siginfo_fpu_t __user *fp = tail;
+ tail += sizeof(*fp);
+ err |= save_fpu_state(regs, fp);
+ err |= __put_user((u64)fp, &sf->fpu_save);
} else {
err |= __put_user(0, &sf->fpu_save);
}
+ if (wsaved) {
+ __siginfo_rwin_t __user *rwp = tail;
+ tail += sizeof(*rwp);
+ err |= save_rwin_state(wsaved, rwp);
+ err |= __put_user((u64)rwp, &sf->rwin_save);
+ set_thread_wsaved(0);
+ } else {
+ err |= __put_user(0, &sf->rwin_save);
+ }
switch (_NSIG_WORDS) {
case 4: seta[7] = (oldset->sig[3] >> 32);
@@ -580,10 +569,21 @@ static int setup_frame32(struct k_sigaction *ka, struct pt_regs *regs,
err |= __copy_to_user(sf->extramask, seta + 1,
(_COMPAT_NSIG_WORDS - 1) * sizeof(unsigned int));
- err |= copy_in_user((u32 __user *)sf,
- (u32 __user *)(regs->u_regs[UREG_FP]),
- sizeof(struct reg_window32));
-
+ if (!wsaved) {
+ err |= copy_in_user((u32 __user *)sf,
+ (u32 __user *)(regs->u_regs[UREG_FP]),
+ sizeof(struct reg_window32));
+ } else {
+ struct reg_window *rp;
+
+ rp = ¤t_thread_info()->reg_window[wsaved - 1];
+ for (i = 0; i < 8; i++)
+ err |= __put_user(rp->locals[i], &sf->ss.locals[i]);
+ for (i = 0; i < 6; i++)
+ err |= __put_user(rp->ins[i], &sf->ss.ins[i]);
+ err |= __put_user(rp->ins[6], &sf->ss.fp);
+ err |= __put_user(rp->ins[7], &sf->ss.callers_pc);
+ }
if (err)
goto sigsegv;
@@ -613,7 +613,6 @@ static int setup_frame32(struct k_sigaction *ka, struct pt_regs *regs,
err |= __put_user(0x91d02010, &sf->insns[1]); /*t 0x10*/
if (err)
goto sigsegv;
-
flush_signal_insns(address);
}
return 0;
@@ -632,18 +631,23 @@ static int setup_rt_frame32(struct k_sigaction *ka, struct pt_regs *regs,
siginfo_t *info)
{
struct rt_signal_frame32 __user *sf;
+ int i, err, wsaved;
+ void __user *tail;
int sigframe_size;
u32 psr;
- int i, err;
compat_sigset_t seta;
/* 1. Make sure everything is clean */
synchronize_user_stack();
save_and_clear_fpu();
- sigframe_size = RT_ALIGNEDSZ;
- if (!(current_thread_info()->fpsaved[0] & FPRS_FEF))
- sigframe_size -= sizeof(__siginfo_fpu_t);
+ wsaved = get_thread_wsaved();
+
+ sigframe_size = sizeof(*sf);
+ if (current_thread_info()->fpsaved[0] & FPRS_FEF)
+ sigframe_size += sizeof(__siginfo_fpu_t);
+ if (wsaved)
+ sigframe_size += sizeof(__siginfo_rwin_t);
sf = (struct rt_signal_frame32 __user *)
get_sigframe(&ka->sa, regs, sigframe_size);
@@ -651,8 +655,7 @@ static int setup_rt_frame32(struct k_sigaction *ka, struct pt_regs *regs,
if (invalid_frame_pointer(sf, sigframe_size))
goto sigill;
- if (get_thread_wsaved() != 0)
- goto sigill;
+ tail = (sf + 1);
/* 2. Save the current process state */
if (test_thread_flag(TIF_32BIT)) {
@@ -677,11 +680,22 @@ static int setup_rt_frame32(struct k_sigaction *ka, struct pt_regs *regs,
&sf->v8plus.asi);
if (psr & PSR_EF) {
- err |= save_fpu_state32(regs, &sf->fpu_state);
- err |= __put_user((u64)&sf->fpu_state, &sf->fpu_save);
+ __siginfo_fpu_t __user *fp = tail;
+ tail += sizeof(*fp);
+ err |= save_fpu_state(regs, fp);
+ err |= __put_user((u64)fp, &sf->fpu_save);
} else {
err |= __put_user(0, &sf->fpu_save);
}
+ if (wsaved) {
+ __siginfo_rwin_t __user *rwp = tail;
+ tail += sizeof(*rwp);
+ err |= save_rwin_state(wsaved, rwp);
+ err |= __put_user((u64)rwp, &sf->rwin_save);
+ set_thread_wsaved(0);
+ } else {
+ err |= __put_user(0, &sf->rwin_save);
+ }
/* Update the siginfo structure. */
err |= copy_siginfo_to_user32(&sf->info, info);
@@ -703,9 +717,21 @@ static int setup_rt_frame32(struct k_sigaction *ka, struct pt_regs *regs,
}
err |= __copy_to_user(&sf->mask, &seta, sizeof(compat_sigset_t));
- err |= copy_in_user((u32 __user *)sf,
- (u32 __user *)(regs->u_regs[UREG_FP]),
- sizeof(struct reg_window32));
+ if (!wsaved) {
+ err |= copy_in_user((u32 __user *)sf,
+ (u32 __user *)(regs->u_regs[UREG_FP]),
+ sizeof(struct reg_window32));
+ } else {
+ struct reg_window *rp;
+
+ rp = ¤t_thread_info()->reg_window[wsaved - 1];
+ for (i = 0; i < 8; i++)
+ err |= __put_user(rp->locals[i], &sf->ss.locals[i]);
+ for (i = 0; i < 6; i++)
+ err |= __put_user(rp->ins[i], &sf->ss.ins[i]);
+ err |= __put_user(rp->ins[6], &sf->ss.fp);
+ err |= __put_user(rp->ins[7], &sf->ss.callers_pc);
+ }
if (err)
goto sigsegv;
diff --git a/arch/sparc/kernel/signal_32.c b/arch/sparc/kernel/signal_32.c
index 5e5c5fd..04ede8f 100644
--- a/arch/sparc/kernel/signal_32.c
+++ b/arch/sparc/kernel/signal_32.c
@@ -26,6 +26,8 @@
#include <asm/pgtable.h>
#include <asm/cacheflush.h> /* flush_sig_insns */
+#include "sigutil.h"
+
#define _BLOCKABLE (~(sigmask(SIGKILL) | sigmask(SIGSTOP)))
extern void fpsave(unsigned long *fpregs, unsigned long *fsr,
@@ -39,8 +41,8 @@ struct signal_frame {
unsigned long insns[2] __attribute__ ((aligned (8)));
unsigned int extramask[_NSIG_WORDS - 1];
unsigned int extra_size; /* Should be 0 */
- __siginfo_fpu_t fpu_state;
-};
+ __siginfo_rwin_t __user *rwin_save;
+} __attribute__((aligned(8)));
struct rt_signal_frame {
struct sparc_stackf ss;
@@ -51,8 +53,8 @@ struct rt_signal_frame {
unsigned int insns[2];
stack_t stack;
unsigned int extra_size; /* Should be 0 */
- __siginfo_fpu_t fpu_state;
-};
+ __siginfo_rwin_t __user *rwin_save;
+} __attribute__((aligned(8)));
/* Align macros */
#define SF_ALIGNEDSZ (((sizeof(struct signal_frame) + 7) & (~7)))
@@ -79,43 +81,13 @@ asmlinkage int sys_sigsuspend(old_sigset_t set)
return _sigpause_common(set);
}
-static inline int
-restore_fpu_state(struct pt_regs *regs, __siginfo_fpu_t __user *fpu)
-{
- int err;
-#ifdef CONFIG_SMP
- if (test_tsk_thread_flag(current, TIF_USEDFPU))
- regs->psr &= ~PSR_EF;
-#else
- if (current == last_task_used_math) {
- last_task_used_math = NULL;
- regs->psr &= ~PSR_EF;
- }
-#endif
- set_used_math();
- clear_tsk_thread_flag(current, TIF_USEDFPU);
-
- if (!access_ok(VERIFY_READ, fpu, sizeof(*fpu)))
- return -EFAULT;
-
- err = __copy_from_user(¤t->thread.float_regs[0], &fpu->si_float_regs[0],
- (sizeof(unsigned long) * 32));
- err |= __get_user(current->thread.fsr, &fpu->si_fsr);
- err |= __get_user(current->thread.fpqdepth, &fpu->si_fpqdepth);
- if (current->thread.fpqdepth != 0)
- err |= __copy_from_user(¤t->thread.fpqueue[0],
- &fpu->si_fpqueue[0],
- ((sizeof(unsigned long) +
- (sizeof(unsigned long *)))*16));
- return err;
-}
-
asmlinkage void do_sigreturn(struct pt_regs *regs)
{
struct signal_frame __user *sf;
unsigned long up_psr, pc, npc;
sigset_t set;
__siginfo_fpu_t __user *fpu_save;
+ __siginfo_rwin_t __user *rwin_save;
int err;
/* Always make any pending restarted system calls return -EINTR */
@@ -150,9 +122,11 @@ asmlinkage void do_sigreturn(struct pt_regs *regs)
pt_regs_clear_syscall(regs);
err |= __get_user(fpu_save, &sf->fpu_save);
-
if (fpu_save)
err |= restore_fpu_state(regs, fpu_save);
+ err |= __get_user(rwin_save, &sf->rwin_save);
+ if (rwin_save)
+ err |= restore_rwin_state(rwin_save);
/* This is pretty much atomic, no amount locking would prevent
* the races which exist anyways.
@@ -180,6 +154,7 @@ asmlinkage void do_rt_sigreturn(struct pt_regs *regs)
struct rt_signal_frame __user *sf;
unsigned int psr, pc, npc;
__siginfo_fpu_t __user *fpu_save;
+ __siginfo_rwin_t __user *rwin_save;
mm_segment_t old_fs;
sigset_t set;
stack_t st;
@@ -207,8 +182,7 @@ asmlinkage void do_rt_sigreturn(struct pt_regs *regs)
pt_regs_clear_syscall(regs);
err |= __get_user(fpu_save, &sf->fpu_save);
-
- if (fpu_save)
+ if (!err && fpu_save)
err |= restore_fpu_state(regs, fpu_save);
err |= __copy_from_user(&set, &sf->mask, sizeof(sigset_t));
@@ -228,6 +202,12 @@ asmlinkage void do_rt_sigreturn(struct pt_regs *regs)
do_sigaltstack((const stack_t __user *) &st, NULL, (unsigned long)sf);
set_fs(old_fs);
+ err |= __get_user(rwin_save, &sf->rwin_save);
+ if (!err && rwin_save) {
+ if (restore_rwin_state(rwin_save))
+ goto segv;
+ }
+
sigdelsetmask(&set, ~_BLOCKABLE);
spin_lock_irq(¤t->sighand->siglock);
current->blocked = set;
@@ -280,53 +260,23 @@ static inline void __user *get_sigframe(struct sigaction *sa, struct pt_regs *re
return (void __user *) sp;
}
-static inline int
-save_fpu_state(struct pt_regs *regs, __siginfo_fpu_t __user *fpu)
-{
- int err = 0;
-#ifdef CONFIG_SMP
- if (test_tsk_thread_flag(current, TIF_USEDFPU)) {
- put_psr(get_psr() | PSR_EF);
- fpsave(¤t->thread.float_regs[0], ¤t->thread.fsr,
- ¤t->thread.fpqueue[0], ¤t->thread.fpqdepth);
- regs->psr &= ~(PSR_EF);
- clear_tsk_thread_flag(current, TIF_USEDFPU);
- }
-#else
- if (current == last_task_used_math) {
- put_psr(get_psr() | PSR_EF);
- fpsave(¤t->thread.float_regs[0], ¤t->thread.fsr,
- ¤t->thread.fpqueue[0], ¤t->thread.fpqdepth);
- last_task_used_math = NULL;
- regs->psr &= ~(PSR_EF);
- }
-#endif
- err |= __copy_to_user(&fpu->si_float_regs[0],
- ¤t->thread.float_regs[0],
- (sizeof(unsigned long) * 32));
- err |= __put_user(current->thread.fsr, &fpu->si_fsr);
- err |= __put_user(current->thread.fpqdepth, &fpu->si_fpqdepth);
- if (current->thread.fpqdepth != 0)
- err |= __copy_to_user(&fpu->si_fpqueue[0],
- ¤t->thread.fpqueue[0],
- ((sizeof(unsigned long) +
- (sizeof(unsigned long *)))*16));
- clear_used_math();
- return err;
-}
-
static int setup_frame(struct k_sigaction *ka, struct pt_regs *regs,
int signo, sigset_t *oldset)
{
struct signal_frame __user *sf;
- int sigframe_size, err;
+ int sigframe_size, err, wsaved;
+ void __user *tail;
/* 1. Make sure everything is clean */
synchronize_user_stack();
- sigframe_size = SF_ALIGNEDSZ;
- if (!used_math())
- sigframe_size -= sizeof(__siginfo_fpu_t);
+ wsaved = current_thread_info()->w_saved;
+
+ sigframe_size = sizeof(*sf);
+ if (used_math())
+ sigframe_size += sizeof(__siginfo_fpu_t);
+ if (wsaved)
+ sigframe_size += sizeof(__siginfo_rwin_t);
sf = (struct signal_frame __user *)
get_sigframe(&ka->sa, regs, sigframe_size);
@@ -334,8 +284,7 @@ static int setup_frame(struct k_sigaction *ka, struct pt_regs *regs,
if (invalid_frame_pointer(sf, sigframe_size))
goto sigill_and_return;
- if (current_thread_info()->w_saved != 0)
- goto sigill_and_return;
+ tail = sf + 1;
/* 2. Save the current process state */
err = __copy_to_user(&sf->info.si_regs, regs, sizeof(struct pt_regs));
@@ -343,17 +292,34 @@ static int setup_frame(struct k_sigaction *ka, struct pt_regs *regs,
err |= __put_user(0, &sf->extra_size);
if (used_math()) {
- err |= save_fpu_state(regs, &sf->fpu_state);
- err |= __put_user(&sf->fpu_state, &sf->fpu_save);
+ __siginfo_fpu_t __user *fp = tail;
+ tail += sizeof(*fp);
+ err |= save_fpu_state(regs, fp);
+ err |= __put_user(fp, &sf->fpu_save);
} else {
err |= __put_user(0, &sf->fpu_save);
}
+ if (wsaved) {
+ __siginfo_rwin_t __user *rwp = tail;
+ tail += sizeof(*rwp);
+ err |= save_rwin_state(wsaved, rwp);
+ err |= __put_user(rwp, &sf->rwin_save);
+ } else {
+ err |= __put_user(0, &sf->rwin_save);
+ }
err |= __put_user(oldset->sig[0], &sf->info.si_mask);
err |= __copy_to_user(sf->extramask, &oldset->sig[1],
(_NSIG_WORDS - 1) * sizeof(unsigned int));
- err |= __copy_to_user(sf, (char *) regs->u_regs[UREG_FP],
- sizeof(struct reg_window32));
+ if (!wsaved) {
+ err |= __copy_to_user(sf, (char *) regs->u_regs[UREG_FP],
+ sizeof(struct reg_window32));
+ } else {
+ struct reg_window32 *rp;
+
+ rp = ¤t_thread_info()->reg_window[wsaved - 1];
+ err |= __copy_to_user(sf, rp, sizeof(struct reg_window32));
+ }
if (err)
goto sigsegv;
@@ -399,21 +365,24 @@ static int setup_rt_frame(struct k_sigaction *ka, struct pt_regs *regs,
int signo, sigset_t *oldset, siginfo_t *info)
{
struct rt_signal_frame __user *sf;
- int sigframe_size;
+ int sigframe_size, wsaved;
+ void __user *tail;
unsigned int psr;
int err;
synchronize_user_stack();
- sigframe_size = RT_ALIGNEDSZ;
- if (!used_math())
- sigframe_size -= sizeof(__siginfo_fpu_t);
+ wsaved = current_thread_info()->w_saved;
+ sigframe_size = sizeof(*sf);
+ if (used_math())
+ sigframe_size += sizeof(__siginfo_fpu_t);
+ if (wsaved)
+ sigframe_size += sizeof(__siginfo_rwin_t);
sf = (struct rt_signal_frame __user *)
get_sigframe(&ka->sa, regs, sigframe_size);
if (invalid_frame_pointer(sf, sigframe_size))
goto sigill;
- if (current_thread_info()->w_saved != 0)
- goto sigill;
+ tail = sf + 1;
err = __put_user(regs->pc, &sf->regs.pc);
err |= __put_user(regs->npc, &sf->regs.npc);
err |= __put_user(regs->y, &sf->regs.y);
@@ -425,11 +394,21 @@ static int setup_rt_frame(struct k_sigaction *ka, struct pt_regs *regs,
err |= __put_user(0, &sf->extra_size);
if (psr & PSR_EF) {
- err |= save_fpu_state(regs, &sf->fpu_state);
- err |= __put_user(&sf->fpu_state, &sf->fpu_save);
+ __siginfo_fpu_t *fp = tail;
+ tail += sizeof(*fp);
+ err |= save_fpu_state(regs, fp);
+ err |= __put_user(fp, &sf->fpu_save);
} else {
err |= __put_user(0, &sf->fpu_save);
}
+ if (wsaved) {
+ __siginfo_rwin_t *rwp = tail;
+ tail += sizeof(*rwp);
+ err |= save_rwin_state(wsaved, rwp);
+ err |= __put_user(rwp, &sf->rwin_save);
+ } else {
+ err |= __put_user(0, &sf->rwin_save);
+ }
err |= __copy_to_user(&sf->mask, &oldset->sig[0], sizeof(sigset_t));
/* Setup sigaltstack */
@@ -437,8 +416,15 @@ static int setup_rt_frame(struct k_sigaction *ka, struct pt_regs *regs,
err |= __put_user(sas_ss_flags(regs->u_regs[UREG_FP]), &sf->stack.ss_flags);
err |= __put_user(current->sas_ss_size, &sf->stack.ss_size);
- err |= __copy_to_user(sf, (char *) regs->u_regs[UREG_FP],
- sizeof(struct reg_window32));
+ if (!wsaved) {
+ err |= __copy_to_user(sf, (char *) regs->u_regs[UREG_FP],
+ sizeof(struct reg_window32));
+ } else {
+ struct reg_window32 *rp;
+
+ rp = ¤t_thread_info()->reg_window[wsaved - 1];
+ err |= __copy_to_user(sf, rp, sizeof(struct reg_window32));
+ }
err |= copy_siginfo_to_user(&sf->info, info);
diff --git a/arch/sparc/kernel/signal_64.c b/arch/sparc/kernel/signal_64.c
index 006fe45..47509df 100644
--- a/arch/sparc/kernel/signal_64.c
+++ b/arch/sparc/kernel/signal_64.c
@@ -34,6 +34,7 @@
#include "entry.h"
#include "systbls.h"
+#include "sigutil.h"
#define _BLOCKABLE (~(sigmask(SIGKILL) | sigmask(SIGSTOP)))
@@ -236,7 +237,7 @@ struct rt_signal_frame {
__siginfo_fpu_t __user *fpu_save;
stack_t stack;
sigset_t mask;
- __siginfo_fpu_t fpu_state;
+ __siginfo_rwin_t *rwin_save;
};
static long _sigpause_common(old_sigset_t set)
@@ -266,33 +267,12 @@ asmlinkage long sys_sigsuspend(old_sigset_t set)
return _sigpause_common(set);
}
-static inline int
-restore_fpu_state(struct pt_regs *regs, __siginfo_fpu_t __user *fpu)
-{
- unsigned long *fpregs = current_thread_info()->fpregs;
- unsigned long fprs;
- int err;
-
- err = __get_user(fprs, &fpu->si_fprs);
- fprs_write(0);
- regs->tstate &= ~TSTATE_PEF;
- if (fprs & FPRS_DL)
- err |= copy_from_user(fpregs, &fpu->si_float_regs[0],
- (sizeof(unsigned int) * 32));
- if (fprs & FPRS_DU)
- err |= copy_from_user(fpregs+16, &fpu->si_float_regs[32],
- (sizeof(unsigned int) * 32));
- err |= __get_user(current_thread_info()->xfsr[0], &fpu->si_fsr);
- err |= __get_user(current_thread_info()->gsr[0], &fpu->si_gsr);
- current_thread_info()->fpsaved[0] |= fprs;
- return err;
-}
-
void do_rt_sigreturn(struct pt_regs *regs)
{
struct rt_signal_frame __user *sf;
unsigned long tpc, tnpc, tstate;
__siginfo_fpu_t __user *fpu_save;
+ __siginfo_rwin_t __user *rwin_save;
sigset_t set;
int err;
@@ -325,8 +305,8 @@ void do_rt_sigreturn(struct pt_regs *regs)
regs->tstate |= (tstate & (TSTATE_ASI | TSTATE_ICC | TSTATE_XCC));
err |= __get_user(fpu_save, &sf->fpu_save);
- if (fpu_save)
- err |= restore_fpu_state(regs, &sf->fpu_state);
+ if (!err && fpu_save)
+ err |= restore_fpu_state(regs, fpu_save);
err |= __copy_from_user(&set, &sf->mask, sizeof(sigset_t));
err |= do_sigaltstack(&sf->stack, NULL, (unsigned long)sf);
@@ -334,6 +314,12 @@ void do_rt_sigreturn(struct pt_regs *regs)
if (err)
goto segv;
+ err |= __get_user(rwin_save, &sf->rwin_save);
+ if (!err && rwin_save) {
+ if (restore_rwin_state(rwin_save))
+ goto segv;
+ }
+
regs->tpc = tpc;
regs->tnpc = tnpc;
@@ -351,34 +337,13 @@ segv:
}
/* Checks if the fp is valid */
-static int invalid_frame_pointer(void __user *fp, int fplen)
+static int invalid_frame_pointer(void __user *fp)
{
if (((unsigned long) fp) & 15)
return 1;
return 0;
}
-static inline int
-save_fpu_state(struct pt_regs *regs, __siginfo_fpu_t __user *fpu)
-{
- unsigned long *fpregs = current_thread_info()->fpregs;
- unsigned long fprs;
- int err = 0;
-
- fprs = current_thread_info()->fpsaved[0];
- if (fprs & FPRS_DL)
- err |= copy_to_user(&fpu->si_float_regs[0], fpregs,
- (sizeof(unsigned int) * 32));
- if (fprs & FPRS_DU)
- err |= copy_to_user(&fpu->si_float_regs[32], fpregs+16,
- (sizeof(unsigned int) * 32));
- err |= __put_user(current_thread_info()->xfsr[0], &fpu->si_fsr);
- err |= __put_user(current_thread_info()->gsr[0], &fpu->si_gsr);
- err |= __put_user(fprs, &fpu->si_fprs);
-
- return err;
-}
-
static inline void __user *get_sigframe(struct k_sigaction *ka, struct pt_regs *regs, unsigned long framesize)
{
unsigned long sp = regs->u_regs[UREG_FP] + STACK_BIAS;
@@ -414,34 +379,48 @@ setup_rt_frame(struct k_sigaction *ka, struct pt_regs *regs,
int signo, sigset_t *oldset, siginfo_t *info)
{
struct rt_signal_frame __user *sf;
- int sigframe_size, err;
+ int wsaved, err, sf_size;
+ void __user *tail;
/* 1. Make sure everything is clean */
synchronize_user_stack();
save_and_clear_fpu();
- sigframe_size = sizeof(struct rt_signal_frame);
- if (!(current_thread_info()->fpsaved[0] & FPRS_FEF))
- sigframe_size -= sizeof(__siginfo_fpu_t);
+ wsaved = get_thread_wsaved();
+ sf_size = sizeof(struct rt_signal_frame);
+ if (current_thread_info()->fpsaved[0] & FPRS_FEF)
+ sf_size += sizeof(__siginfo_fpu_t);
+ if (wsaved)
+ sf_size += sizeof(__siginfo_rwin_t);
sf = (struct rt_signal_frame __user *)
- get_sigframe(ka, regs, sigframe_size);
-
- if (invalid_frame_pointer (sf, sigframe_size))
- goto sigill;
+ get_sigframe(ka, regs, sf_size);
- if (get_thread_wsaved() != 0)
+ if (invalid_frame_pointer (sf))
goto sigill;
+ tail = (sf + 1);
+
/* 2. Save the current process state */
err = copy_to_user(&sf->regs, regs, sizeof (*regs));
if (current_thread_info()->fpsaved[0] & FPRS_FEF) {
- err |= save_fpu_state(regs, &sf->fpu_state);
- err |= __put_user((u64)&sf->fpu_state, &sf->fpu_save);
+ __siginfo_fpu_t __user *fpu_save = tail;
+ tail += sizeof(__siginfo_fpu_t);
+ err |= save_fpu_state(regs, fpu_save);
+ err |= __put_user((u64)fpu_save, &sf->fpu_save);
} else {
err |= __put_user(0, &sf->fpu_save);
}
+ if (wsaved) {
+ __siginfo_rwin_t __user *rwin_save = tail;
+ tail += sizeof(__siginfo_rwin_t);
+ err |= save_rwin_state(wsaved, rwin_save);
+ err |= __put_user((u64)rwin_save, &sf->rwin_save);
+ set_thread_wsaved(0);
+ } else {
+ err |= __put_user(0, &sf->rwin_save);
+ }
/* Setup sigaltstack */
err |= __put_user(current->sas_ss_sp, &sf->stack.ss_sp);
@@ -450,10 +429,17 @@ setup_rt_frame(struct k_sigaction *ka, struct pt_regs *regs,
err |= copy_to_user(&sf->mask, oldset, sizeof(sigset_t));
- err |= copy_in_user((u64 __user *)sf,
- (u64 __user *)(regs->u_regs[UREG_FP]+STACK_BIAS),
- sizeof(struct reg_window));
+ if (!wsaved) {
+ err |= copy_in_user((u64 __user *)sf,
+ (u64 __user *)(regs->u_regs[UREG_FP] +
+ STACK_BIAS),
+ sizeof(struct reg_window));
+ } else {
+ struct reg_window *rp;
+ rp = ¤t_thread_info()->reg_window[wsaved - 1];
+ err |= copy_to_user(sf, rp, sizeof(struct reg_window));
+ }
if (info)
err |= copy_siginfo_to_user(&sf->info, info);
else {
diff --git a/arch/sparc/kernel/sigutil.h b/arch/sparc/kernel/sigutil.h
new file mode 100644
index 0000000..d223aa4
--- /dev/null
+++ b/arch/sparc/kernel/sigutil.h
@@ -0,0 +1,9 @@
+#ifndef _SIGUTIL_H
+#define _SIGUTIL_H
+
+int save_fpu_state(struct pt_regs *regs, __siginfo_fpu_t __user *fpu);
+int restore_fpu_state(struct pt_regs *regs, __siginfo_fpu_t __user *fpu);
+int save_rwin_state(int wsaved, __siginfo_rwin_t __user *rwin);
+int restore_rwin_state(__siginfo_rwin_t __user *rp);
+
+#endif /* _SIGUTIL_H */
diff --git a/arch/sparc/kernel/sigutil_32.c b/arch/sparc/kernel/sigutil_32.c
new file mode 100644
index 0000000..35c7897
--- /dev/null
+++ b/arch/sparc/kernel/sigutil_32.c
@@ -0,0 +1,120 @@
+#include <linux/kernel.h>
+#include <linux/types.h>
+#include <linux/thread_info.h>
+#include <linux/uaccess.h>
+#include <linux/sched.h>
+
+#include <asm/sigcontext.h>
+#include <asm/fpumacro.h>
+#include <asm/ptrace.h>
+
+#include "sigutil.h"
+
+int save_fpu_state(struct pt_regs *regs, __siginfo_fpu_t __user *fpu)
+{
+ int err = 0;
+#ifdef CONFIG_SMP
+ if (test_tsk_thread_flag(current, TIF_USEDFPU)) {
+ put_psr(get_psr() | PSR_EF);
+ fpsave(¤t->thread.float_regs[0], ¤t->thread.fsr,
+ ¤t->thread.fpqueue[0], ¤t->thread.fpqdepth);
+ regs->psr &= ~(PSR_EF);
+ clear_tsk_thread_flag(current, TIF_USEDFPU);
+ }
+#else
+ if (current == last_task_used_math) {
+ put_psr(get_psr() | PSR_EF);
+ fpsave(¤t->thread.float_regs[0], ¤t->thread.fsr,
+ ¤t->thread.fpqueue[0], ¤t->thread.fpqdepth);
+ last_task_used_math = NULL;
+ regs->psr &= ~(PSR_EF);
+ }
+#endif
+ err |= __copy_to_user(&fpu->si_float_regs[0],
+ ¤t->thread.float_regs[0],
+ (sizeof(unsigned long) * 32));
+ err |= __put_user(current->thread.fsr, &fpu->si_fsr);
+ err |= __put_user(current->thread.fpqdepth, &fpu->si_fpqdepth);
+ if (current->thread.fpqdepth != 0)
+ err |= __copy_to_user(&fpu->si_fpqueue[0],
+ ¤t->thread.fpqueue[0],
+ ((sizeof(unsigned long) +
+ (sizeof(unsigned long *)))*16));
+ clear_used_math();
+ return err;
+}
+
+int restore_fpu_state(struct pt_regs *regs, __siginfo_fpu_t __user *fpu)
+{
+ int err;
+#ifdef CONFIG_SMP
+ if (test_tsk_thread_flag(current, TIF_USEDFPU))
+ regs->psr &= ~PSR_EF;
+#else
+ if (current == last_task_used_math) {
+ last_task_used_math = NULL;
+ regs->psr &= ~PSR_EF;
+ }
+#endif
+ set_used_math();
+ clear_tsk_thread_flag(current, TIF_USEDFPU);
+
+ if (!access_ok(VERIFY_READ, fpu, sizeof(*fpu)))
+ return -EFAULT;
+
+ err = __copy_from_user(¤t->thread.float_regs[0], &fpu->si_float_regs[0],
+ (sizeof(unsigned long) * 32));
+ err |= __get_user(current->thread.fsr, &fpu->si_fsr);
+ err |= __get_user(current->thread.fpqdepth, &fpu->si_fpqdepth);
+ if (current->thread.fpqdepth != 0)
+ err |= __copy_from_user(¤t->thread.fpqueue[0],
+ &fpu->si_fpqueue[0],
+ ((sizeof(unsigned long) +
+ (sizeof(unsigned long *)))*16));
+ return err;
+}
+
+int save_rwin_state(int wsaved, __siginfo_rwin_t __user *rwin)
+{
+ int i, err = __put_user(wsaved, &rwin->wsaved);
+
+ for (i = 0; i < wsaved; i++) {
+ struct reg_window32 *rp;
+ unsigned long fp;
+
+ rp = ¤t_thread_info()->reg_window[i];
+ fp = current_thread_info()->rwbuf_stkptrs[i];
+ err |= copy_to_user(&rwin->reg_window[i], rp,
+ sizeof(struct reg_window32));
+ err |= __put_user(fp, &rwin->rwbuf_stkptrs[i]);
+ }
+ return err;
+}
+
+int restore_rwin_state(__siginfo_rwin_t __user *rp)
+{
+ struct thread_info *t = current_thread_info();
+ int i, wsaved, err;
+
+ __get_user(wsaved, &rp->wsaved);
+ if (wsaved > NSWINS)
+ return -EFAULT;
+
+ err = 0;
+ for (i = 0; i < wsaved; i++) {
+ err |= copy_from_user(&t->reg_window[i],
+ &rp->reg_window[i],
+ sizeof(struct reg_window32));
+ err |= __get_user(t->rwbuf_stkptrs[i],
+ &rp->rwbuf_stkptrs[i]);
+ }
+ if (err)
+ return err;
+
+ t->w_saved = wsaved;
+ synchronize_user_stack();
+ if (t->w_saved)
+ return -EFAULT;
+ return 0;
+
+}
diff --git a/arch/sparc/kernel/sigutil_64.c b/arch/sparc/kernel/sigutil_64.c
new file mode 100644
index 0000000..1abe21b
--- /dev/null
+++ b/arch/sparc/kernel/sigutil_64.c
@@ -0,0 +1,93 @@
+#include <linux/kernel.h>
+#include <linux/types.h>
+#include <linux/thread_info.h>
+#include <linux/uaccess.h>
+
+#include <asm/sigcontext.h>
+#include <asm/fpumacro.h>
+#include <asm/ptrace.h>
+
+#include "sigutil.h"
+
+int save_fpu_state(struct pt_regs *regs, __siginfo_fpu_t __user *fpu)
+{
+ unsigned long *fpregs = current_thread_info()->fpregs;
+ unsigned long fprs;
+ int err = 0;
+
+ fprs = current_thread_info()->fpsaved[0];
+ if (fprs & FPRS_DL)
+ err |= copy_to_user(&fpu->si_float_regs[0], fpregs,
+ (sizeof(unsigned int) * 32));
+ if (fprs & FPRS_DU)
+ err |= copy_to_user(&fpu->si_float_regs[32], fpregs+16,
+ (sizeof(unsigned int) * 32));
+ err |= __put_user(current_thread_info()->xfsr[0], &fpu->si_fsr);
+ err |= __put_user(current_thread_info()->gsr[0], &fpu->si_gsr);
+ err |= __put_user(fprs, &fpu->si_fprs);
+
+ return err;
+}
+
+int restore_fpu_state(struct pt_regs *regs, __siginfo_fpu_t __user *fpu)
+{
+ unsigned long *fpregs = current_thread_info()->fpregs;
+ unsigned long fprs;
+ int err;
+
+ err = __get_user(fprs, &fpu->si_fprs);
+ fprs_write(0);
+ regs->tstate &= ~TSTATE_PEF;
+ if (fprs & FPRS_DL)
+ err |= copy_from_user(fpregs, &fpu->si_float_regs[0],
+ (sizeof(unsigned int) * 32));
+ if (fprs & FPRS_DU)
+ err |= copy_from_user(fpregs+16, &fpu->si_float_regs[32],
+ (sizeof(unsigned int) * 32));
+ err |= __get_user(current_thread_info()->xfsr[0], &fpu->si_fsr);
+ err |= __get_user(current_thread_info()->gsr[0], &fpu->si_gsr);
+ current_thread_info()->fpsaved[0] |= fprs;
+ return err;
+}
+
+int save_rwin_state(int wsaved, __siginfo_rwin_t __user *rwin)
+{
+ int i, err = __put_user(wsaved, &rwin->wsaved);
+
+ for (i = 0; i < wsaved; i++) {
+ struct reg_window *rp = ¤t_thread_info()->reg_window[i];
+ unsigned long fp = current_thread_info()->rwbuf_stkptrs[i];
+
+ err |= copy_to_user(&rwin->reg_window[i], rp,
+ sizeof(struct reg_window));
+ err |= __put_user(fp, &rwin->rwbuf_stkptrs[i]);
+ }
+ return err;
+}
+
+int restore_rwin_state(__siginfo_rwin_t __user *rp)
+{
+ struct thread_info *t = current_thread_info();
+ int i, wsaved, err;
+
+ __get_user(wsaved, &rp->wsaved);
+ if (wsaved > NSWINS)
+ return -EFAULT;
+
+ err = 0;
+ for (i = 0; i < wsaved; i++) {
+ err |= copy_from_user(&t->reg_window[i],
+ &rp->reg_window[i],
+ sizeof(struct reg_window));
+ err |= __get_user(t->rwbuf_stkptrs[i],
+ &rp->rwbuf_stkptrs[i]);
+ }
+ if (err)
+ return err;
+
+ set_thread_wsaved(wsaved);
+ synchronize_user_stack();
+ if (get_thread_wsaved())
+ return -EFAULT;
+ return 0;
+}
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 026/165] sparc: fix array bounds error setting up PCIC NMI trap
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (24 preceding siblings ...)
2012-08-15 19:46 ` [v2.6.34-stable 025/165] sparc: Allow handling signals when stack is corrupted Paul Gortmaker
@ 2012-08-15 19:46 ` Paul Gortmaker
2012-08-15 19:46 ` [v2.6.34-stable 027/165] ipv6: Add GSO support on forwarding path Paul Gortmaker
` (138 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:46 UTC (permalink / raw)
To: stable, linux-kernel
Cc: Ian Campbell, Ian Campbell, David S. Miller, sparclinux, Paul Gortmaker
From: Ian Campbell <Ian.Campbell@citrix.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 4a0342ca8e8150bd47e7118a76e300692a1b6b7b upstream.
CC arch/sparc/kernel/pcic.o
arch/sparc/kernel/pcic.c: In function 'pcic_probe':
arch/sparc/kernel/pcic.c:359:33: error: array subscript is above array bounds [-Werror=array-bounds]
arch/sparc/kernel/pcic.c:359:8: error: array subscript is above array bounds [-Werror=array-bounds]
arch/sparc/kernel/pcic.c:360:33: error: array subscript is above array bounds [-Werror=array-bounds]
arch/sparc/kernel/pcic.c:360:8: error: array subscript is above array bounds [-Werror=array-bounds]
arch/sparc/kernel/pcic.c:361:33: error: array subscript is above array bounds [-Werror=array-bounds]
arch/sparc/kernel/pcic.c:361:8: error: array subscript is above array bounds [-Werror=array-bounds]
cc1: all warnings being treated as errors
I'm not particularly familiar with sparc but t_nmi (defined in head_32.S via
the TRAP_ENTRY macro) and pcic_nmi_trap_patch (defined in entry.S) both appear
to be 4 instructions long and I presume from the usage that instructions are
int sized.
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: sparclinux@vger.kernel.org
Reviewed-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/sparc/kernel/pcic.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/sparc/kernel/pcic.c b/arch/sparc/kernel/pcic.c
index d36a8d3..2479ecd 100644
--- a/arch/sparc/kernel/pcic.c
+++ b/arch/sparc/kernel/pcic.c
@@ -349,8 +349,8 @@ int __init pcic_probe(void)
strcpy(pbm->prom_name, namebuf);
{
- extern volatile int t_nmi[1];
- extern int pcic_nmi_trap_patch[1];
+ extern volatile int t_nmi[4];
+ extern int pcic_nmi_trap_patch[4];
t_nmi[0] = pcic_nmi_trap_patch[0];
t_nmi[1] = pcic_nmi_trap_patch[1];
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 027/165] ipv6: Add GSO support on forwarding path
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (25 preceding siblings ...)
2012-08-15 19:46 ` [v2.6.34-stable 026/165] sparc: fix array bounds error setting up PCIC NMI trap Paul Gortmaker
@ 2012-08-15 19:46 ` Paul Gortmaker
2012-08-15 19:46 ` [v2.6.34-stable 028/165] GRO: fix merging a paged skb after non-paged skbs Paul Gortmaker
` (137 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:46 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Herbert Xu, David S. Miller, Paul Gortmaker
From: Herbert Xu <herbert@gondor.apana.org.au>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 0aa68271510ae2b221d4b60892103837be63afe4 upstream.
Currently we disallow GSO packets on the IPv6 forward path.
This patch fixes this.
Note that I discovered that our existing GSO MTU checks (e.g.,
IPv4 forwarding) are buggy in that they skip the check altogether,
when they really should be checking gso_size + header instead.
I have also been lazy here in that I haven't bothered to segment
the GSO packet by hand before generating an ICMP message. Someone
should add that to be 100% correct.
Reported-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
net/ipv6/ip6_output.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 60daecc..2d55954 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -514,7 +514,7 @@ int ip6_forward(struct sk_buff *skb)
if (mtu < IPV6_MIN_MTU)
mtu = IPV6_MIN_MTU;
- if (skb->len > mtu) {
+ if (skb->len > mtu && !skb_is_gso(skb)) {
/* Again, force OUTPUT device used as source address */
skb->dev = dst->dev;
icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 028/165] GRO: fix merging a paged skb after non-paged skbs
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (26 preceding siblings ...)
2012-08-15 19:46 ` [v2.6.34-stable 027/165] ipv6: Add GSO support on forwarding path Paul Gortmaker
@ 2012-08-15 19:46 ` Paul Gortmaker
2012-08-15 19:46 ` [v2.6.34-stable 029/165] xen-blkfront: fix data size for xenbus_gather in blkfront_connect Paul Gortmaker
` (136 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:46 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Michal Schmidt, David S. Miller, Paul Gortmaker
From: Michal Schmidt <mschmidt@redhat.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit d1dc7abf2fafa34b0ffcd070fd59405aa9c0a4d8 upstream.
Suppose that several linear skbs of the same flow were received by GRO. They
were thus merged into one skb with a frag_list. Then a new skb of the same flow
arrives, but it is a paged skb with data starting in its frags[].
Before adding the skb to the frag_list skb_gro_receive() will of course adjust
the skb to throw away the headers. It correctly modifies the page_offset and
size of the frag, but it leaves incorrect information in the skb:
->data_len is not decreased at all.
->len is decreased only by headlen, as if no change were done to the frag.
Later in a receiving process this causes skb_copy_datagram_iovec() to return
-EFAULT and this is seen in userspace as the result of the recv() syscall.
In practice the bug can be reproduced with the sfc driver. By default the
driver uses an adaptive scheme when it switches between using
napi_gro_receive() (with skbs) and napi_gro_frags() (with pages). The bug is
reproduced when under rx load with enough successful GRO merging the driver
decides to switch from the former to the latter.
Manual control is also possible, so reproducing this is easy with netcat:
- on machine1 (with sfc): nc -l 12345 > /dev/null
- on machine2: nc machine1 12345 < /dev/zero
- on machine1:
echo 1 > /sys/module/sfc/parameters/rx_alloc_method # use skbs
echo 2 > /sys/module/sfc/parameters/rx_alloc_method # use pages
- See that nc has quit suddenly.
[v2: Modified by Eric Dumazet to avoid advancing skb->data past the end
and to use a temporary variable.]
Signed-off-by: Michal Schmidt <mschmidt@redhat.com>
Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
net/core/skbuff.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 9e7214e..7865bec 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2749,8 +2749,12 @@ int skb_gro_receive(struct sk_buff **head, struct sk_buff *skb)
merge:
if (offset > headlen) {
- skbinfo->frags[0].page_offset += offset - headlen;
- skbinfo->frags[0].size -= offset - headlen;
+ unsigned int eat = offset - headlen;
+
+ skbinfo->frags[0].page_offset += eat;
+ skbinfo->frags[0].size -= eat;
+ skb->data_len -= eat;
+ skb->len -= eat;
offset = headlen;
}
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 029/165] xen-blkfront: fix data size for xenbus_gather in blkfront_connect
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (27 preceding siblings ...)
2012-08-15 19:46 ` [v2.6.34-stable 028/165] GRO: fix merging a paged skb after non-paged skbs Paul Gortmaker
@ 2012-08-15 19:46 ` Paul Gortmaker
2012-08-15 19:46 ` [v2.6.34-stable 030/165] md/linear: avoid corrupting structure while waiting for rcu_free to complete Paul Gortmaker
` (135 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:46 UTC (permalink / raw)
To: stable, linux-kernel
Cc: Marek Marczykowski, Konrad Rzeszutek Wilk, Paul Gortmaker
From: Marek Marczykowski <marmarek@mimuw.edu.pl>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 4352b47ab7918108b389a48d2163c9a4c2aaf139 upstream.
barrier variable is int, not long. This overflow caused another variable
override: "err" (in PV code) and "binfo" (in xenlinux code -
drivers/xen/blkfront/blkfront.c). The later caused incorrect device
flags (RO/removable etc).
Signed-off-by: Marek Marczykowski <marmarek@mimuw.edu.pl>
Acked-by: Ian Campbell <Ian.Campbell@citrix.com>
[v1: Changed title]
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/block/xen-blkfront.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index 82ed403..5d5e1ea 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -890,7 +890,7 @@ static void blkfront_connect(struct blkfront_info *info)
}
err = xenbus_gather(XBT_NIL, info->xbdev->otherend,
- "feature-barrier", "%lu", &info->feature_barrier,
+ "feature-barrier", "%d", &info->feature_barrier,
NULL);
if (err)
info->feature_barrier = 0;
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 030/165] md/linear: avoid corrupting structure while waiting for rcu_free to complete.
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (28 preceding siblings ...)
2012-08-15 19:46 ` [v2.6.34-stable 029/165] xen-blkfront: fix data size for xenbus_gather in blkfront_connect Paul Gortmaker
@ 2012-08-15 19:46 ` Paul Gortmaker
2012-08-15 19:46 ` [v2.6.34-stable 031/165] powerpc/pci: Check devices status property when scanning OF tree Paul Gortmaker
` (134 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:46 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: NeilBrown, Paul Gortmaker
From: NeilBrown <neilb@suse.de>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 1b6afa17581027218088a18a9ceda600e0ddba7a upstream.
I don't know what I was thinking putting 'rcu' after a dynamically
sized array! The array could still be in use when we call rcu_free()
(That is the point) so we mustn't corrupt it.
Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/md/linear.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/md/linear.h b/drivers/md/linear.h
index 0ce29b6..2f2da05 100644
--- a/drivers/md/linear.h
+++ b/drivers/md/linear.h
@@ -10,9 +10,9 @@ typedef struct dev_info dev_info_t;
struct linear_private_data
{
+ struct rcu_head rcu;
sector_t array_sectors;
dev_info_t disks[0];
- struct rcu_head rcu;
};
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 031/165] powerpc/pci: Check devices status property when scanning OF tree
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (29 preceding siblings ...)
2012-08-15 19:46 ` [v2.6.34-stable 030/165] md/linear: avoid corrupting structure while waiting for rcu_free to complete Paul Gortmaker
@ 2012-08-15 19:46 ` Paul Gortmaker
2012-08-15 19:46 ` [v2.6.34-stable 032/165] xen: x86_32: do not enable iterrupts when returning from exception in interrupt context Paul Gortmaker
` (133 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:46 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Sonny Rao, Benjamin Herrenschmidt, Paul Gortmaker
From: Sonny Rao <sonnyrao@us.ibm.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 5b339bdf164d8aee394609768f7e2e4415b0252a upstream.
We ran into an issue where it looks like we're not properly ignoring a
pci device with a non-good status property when we walk the device tree
and instanciate the Linux side PCI devices.
However, the EEH init code does look for the property and disables EEH
on these devices. This leaves us in an inconsistent where we are poking
at a supposedly bad piece of hardware and RTAS will block our config
cycles because EEH isn't enabled anyway.
Signed-of-by: Sonny Rao <sonnyrao@linux.vnet.ibm.com>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/powerpc/kernel/pci_of_scan.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/arch/powerpc/kernel/pci_of_scan.c b/arch/powerpc/kernel/pci_of_scan.c
index cd11d5c..6ddb795f 100644
--- a/arch/powerpc/kernel/pci_of_scan.c
+++ b/arch/powerpc/kernel/pci_of_scan.c
@@ -310,6 +310,8 @@ static void __devinit __of_scan_bus(struct device_node *node,
/* Scan direct children */
for_each_child_of_node(node, child) {
pr_debug(" * %s\n", child->full_name);
+ if (!of_device_is_available(child))
+ continue;
reg = of_get_property(child, "reg", ®len);
if (reg == NULL || reglen < 20)
continue;
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 032/165] xen: x86_32: do not enable iterrupts when returning from exception in interrupt context
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (30 preceding siblings ...)
2012-08-15 19:46 ` [v2.6.34-stable 031/165] powerpc/pci: Check devices status property when scanning OF tree Paul Gortmaker
@ 2012-08-15 19:46 ` Paul Gortmaker
2012-08-15 19:46 ` [v2.6.34-stable 033/165] xen/smp: Warn user why they keel over - nosmp or noapic and what to use instead Paul Gortmaker
` (132 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:46 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Igor Mammedov, Konrad Rzeszutek Wilk, Paul Gortmaker
From: Igor Mammedov <imammedo@redhat.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit d198d499148a0c64a41b3aba9e7dd43772832b91 upstream.
If vmalloc page_fault happens inside of interrupt handler with interrupts
disabled then on exit path from exception handler when there is no pending
interrupts, the following code (arch/x86/xen/xen-asm_32.S:112):
cmpw $0x0001, XEN_vcpu_info_pending(%eax)
sete XEN_vcpu_info_mask(%eax)
will enable interrupts even if they has been previously disabled according to
eflags from the bounce frame (arch/x86/xen/xen-asm_32.S:99)
testb $X86_EFLAGS_IF>>8, 8+1+ESP_OFFSET(%esp)
setz XEN_vcpu_info_mask(%eax)
Solution is in setting XEN_vcpu_info_mask only when it should be set
according to
cmpw $0x0001, XEN_vcpu_info_pending(%eax)
but not clearing it if there isn't any pending events.
Reproducer for bug is attached to RHBZ 707552
Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Acked-by: Jeremy Fitzhardinge <jeremy@goop.org>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/x86/xen/xen-asm_32.S | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/arch/x86/xen/xen-asm_32.S b/arch/x86/xen/xen-asm_32.S
index 22a2093..b040b0e 100644
--- a/arch/x86/xen/xen-asm_32.S
+++ b/arch/x86/xen/xen-asm_32.S
@@ -113,11 +113,13 @@ xen_iret_start_crit:
/*
* If there's something pending, mask events again so we can
- * jump back into xen_hypervisor_callback
+ * jump back into xen_hypervisor_callback. Otherwise do not
+ * touch XEN_vcpu_info_mask.
*/
- sete XEN_vcpu_info_mask(%eax)
+ jne 1f
+ movb $1, XEN_vcpu_info_mask(%eax)
- popl %eax
+1: popl %eax
/*
* From this point on the registers are restored and the stack
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 033/165] xen/smp: Warn user why they keel over - nosmp or noapic and what to use instead.
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (31 preceding siblings ...)
2012-08-15 19:46 ` [v2.6.34-stable 032/165] xen: x86_32: do not enable iterrupts when returning from exception in interrupt context Paul Gortmaker
@ 2012-08-15 19:46 ` Paul Gortmaker
2012-08-15 19:46 ` [v2.6.34-stable 034/165] ARM: davinci: da850 EVM: read mac address from SPI flash Paul Gortmaker
` (131 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:46 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Konrad Rzeszutek Wilk, Paul Gortmaker
From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit ed467e69f16e6b480e2face7bc5963834d025f91 upstream.
We have hit a couple of customer bugs where they would like to
use those parameters to run an UP kernel - but both of those
options turn of important sources of interrupt information so
we end up not being able to boot. The correct way is to
pass in 'dom0_max_vcpus=1' on the Xen hypervisor line and
the kernel will patch itself to be a UP kernel.
Fixes bug: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=637308
Acked-by: Ian Campbell <Ian.Campbell@eu.citrix.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/x86/xen/smp.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c
index d2dfbf5..9aac865 100644
--- a/arch/x86/xen/smp.c
+++ b/arch/x86/xen/smp.c
@@ -31,6 +31,7 @@
#include <xen/page.h>
#include <xen/events.h>
+#include <xen/hvc-console.h>
#include "xen-ops.h"
#include "mmu.h"
@@ -181,6 +182,15 @@ static void __init xen_smp_prepare_cpus(unsigned int max_cpus)
{
unsigned cpu;
+ if (skip_ioapic_setup) {
+ char *m = (max_cpus == 0) ?
+ "The nosmp parameter is incompatible with Xen; " \
+ "use Xen dom0_max_vcpus=1 parameter" :
+ "The noapic parameter is incompatible with Xen";
+
+ xen_raw_printk(m);
+ panic(m);
+ }
xen_init_lock_cpu(0);
smp_store_cpu_info(0);
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 034/165] ARM: davinci: da850 EVM: read mac address from SPI flash
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (32 preceding siblings ...)
2012-08-15 19:46 ` [v2.6.34-stable 033/165] xen/smp: Warn user why they keel over - nosmp or noapic and what to use instead Paul Gortmaker
@ 2012-08-15 19:46 ` Paul Gortmaker
2012-08-15 19:46 ` [v2.6.34-stable 035/165] md: Fix handling for devices from 2TB to 4TB in 0.90 metadata Paul Gortmaker
` (130 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:46 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Rajashekhara, Sudhakar, Sekhar Nori, Paul Gortmaker
From: "Rajashekhara, Sudhakar" <sudhakar.raj@ti.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 810198bc9c109489dfadc57131c5183ce6ad2d7d upstream.
DA850/OMAP-L138 EMAC driver uses random mac address instead of
a fixed one because the mac address is not stuffed into EMAC
platform data.
This patch provides a function which reads the mac address
stored in SPI flash (registered as MTD device) and populates the
EMAC platform data. The function which reads the mac address is
registered as a callback which gets called upon addition of MTD
device.
NOTE: In case the MAC address stored in SPI flash is erased, follow
the instructions at [1] to restore it.
[1] http://processors.wiki.ti.com/index.php/GSG:_OMAP-L138_DVEVM_Additional_Procedures#Restoring_MAC_address_on_SPI_Flash
Modifications in v2:
Guarded registering the mtd_notifier only when MTD is enabled.
Earlier this was handled using mtd_has_partitions() call, but
this has been removed in Linux v3.0.
Modifications in v3:
a. Guarded da850_evm_m25p80_notify_add() function and
da850evm_spi_notifier structure with CONFIG_MTD macros.
b. Renamed da850_evm_register_mtd_user() function to
da850_evm_setup_mac_addr() and removed the struct mtd_notifier
argument to this function.
c. Passed the da850evm_spi_notifier structure to register_mtd_user()
function.
Modifications in v4:
Moved the da850_evm_setup_mac_addr() function within the first
CONFIG_MTD ifdef construct.
Signed-off-by: Rajashekhara, Sudhakar <sudhakar.raj@ti.com>
Signed-off-by: Sekhar Nori <nsekhar@ti.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/arm/mach-davinci/board-da850-evm.c | 28 ++++++++++++++++++++++++++++
1 file changed, 28 insertions(+)
diff --git a/arch/arm/mach-davinci/board-da850-evm.c b/arch/arm/mach-davinci/board-da850-evm.c
index 411284d..cc4e5cb 100644
--- a/arch/arm/mach-davinci/board-da850-evm.c
+++ b/arch/arm/mach-davinci/board-da850-evm.c
@@ -44,6 +44,32 @@
#define DA850_MII_MDIO_CLKEN_PIN GPIO_TO_PIN(2, 6)
+#ifdef CONFIG_MTD
+static void da850_evm_m25p80_notify_add(struct mtd_info *mtd)
+{
+ char *mac_addr = davinci_soc_info.emac_pdata->mac_addr;
+ size_t retlen;
+
+ if (!strcmp(mtd->name, "MAC-Address")) {
+ mtd->read(mtd, 0, ETH_ALEN, &retlen, mac_addr);
+ if (retlen == ETH_ALEN)
+ pr_info("Read MAC addr from SPI Flash: %pM\n",
+ mac_addr);
+ }
+}
+
+static struct mtd_notifier da850evm_spi_notifier = {
+ .add = da850_evm_m25p80_notify_add,
+};
+
+static void da850_evm_setup_mac_addr(void)
+{
+ register_mtd_user(&da850evm_spi_notifier);
+}
+#else
+static void da850_evm_setup_mac_addr(void) { }
+#endif
+
static struct mtd_partition da850_evm_norflash_partition[] = {
{
.name = "bootloaders + env",
@@ -726,6 +752,8 @@ static __init void da850_evm_init(void)
if (ret)
pr_warning("da850_evm_init: suspend registration failed: %d\n",
ret);
+
+ da850_evm_setup_mac_addr();
}
#ifdef CONFIG_SERIAL_8250_CONSOLE
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 035/165] md: Fix handling for devices from 2TB to 4TB in 0.90 metadata.
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (33 preceding siblings ...)
2012-08-15 19:46 ` [v2.6.34-stable 034/165] ARM: davinci: da850 EVM: read mac address from SPI flash Paul Gortmaker
@ 2012-08-15 19:46 ` Paul Gortmaker
2012-08-15 20:46 ` NeilBrown
2012-08-15 19:46 ` [v2.6.34-stable 036/165] net/9p: fix client code to fail more gracefully on protocol error Paul Gortmaker
` (129 subsequent siblings)
164 siblings, 1 reply; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:46 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: NeilBrown, Paul Gortmaker
From: NeilBrown <neilb@suse.de>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 27a7b260f71439c40546b43588448faac01adb93 upstream.
0.90 metadata uses an unsigned 32bit number to count the number of
kilobytes used from each device.
This should allow up to 4TB per device.
However we multiply this by 2 (to get sectors) before casting to a
larger type, so sizes above 2TB get truncated.
Also we allow rdev->sectors to be larger than 4TB, so it is possible
for the array to be resized larger than the metadata can handle.
So make sure rdev->sectors never exceeds 4TB when 0.90 metadata is in
used.
Also the sanity check at the end of super_90_load should include level
1 as it used ->size too. (RAID0 and Linear don't use ->size at all).
Reported-by: Pim Zandbergen <P.Zandbergen@macroscoop.nl>
Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/md/md.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/drivers/md/md.c b/drivers/md/md.c
index d26df7f..4788c82 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -985,8 +985,11 @@ static int super_90_load(mdk_rdev_t *rdev, mdk_rdev_t *refdev, int minor_version
ret = 0;
}
rdev->sectors = rdev->sb_start;
+ /* Limit to 4TB as metadata cannot record more than that */
+ if (rdev->sectors >= (2ULL << 32))
+ rdev->sectors = (2ULL << 32) - 2;
- if (rdev->sectors < sb->size * 2 && sb->level > 1)
+ if (rdev->sectors < ((sector_t)sb->size) * 2 && sb->level >= 1)
/* "this cannot possibly happen" ... */
ret = -EINVAL;
@@ -1021,7 +1024,7 @@ static int super_90_validate(mddev_t *mddev, mdk_rdev_t *rdev)
mddev->clevel[0] = 0;
mddev->layout = sb->layout;
mddev->raid_disks = sb->raid_disks;
- mddev->dev_sectors = sb->size * 2;
+ mddev->dev_sectors = ((sector_t)sb->size) * 2;
mddev->events = ev1;
mddev->bitmap_info.offset = 0;
mddev->bitmap_info.default_offset = MD_SB_BYTES >> 9;
@@ -1260,6 +1263,11 @@ super_90_rdev_size_change(mdk_rdev_t *rdev, sector_t num_sectors)
rdev->sb_start = calc_dev_sboffset(rdev->bdev);
if (!num_sectors || num_sectors > rdev->sb_start)
num_sectors = rdev->sb_start;
+ /* Limit to 4TB as metadata cannot record more than that.
+ * 4TB == 2^32 KB, or 2*2^32 sectors.
+ */
+ if (num_sectors >= (2ULL << 32))
+ num_sectors = (2ULL << 32) - 2;
md_super_write(rdev->mddev, rdev, rdev->sb_start, rdev->sb_size,
rdev->sb_page);
md_super_wait(rdev->mddev);
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* Re: [v2.6.34-stable 035/165] md: Fix handling for devices from 2TB to 4TB in 0.90 metadata.
2012-08-15 19:46 ` [v2.6.34-stable 035/165] md: Fix handling for devices from 2TB to 4TB in 0.90 metadata Paul Gortmaker
@ 2012-08-15 20:46 ` NeilBrown
2012-08-15 20:52 ` Paul Gortmaker
2012-08-16 4:24 ` Ben Hutchings
0 siblings, 2 replies; 186+ messages in thread
From: NeilBrown @ 2012-08-15 20:46 UTC (permalink / raw)
To: Paul Gortmaker; +Cc: stable, linux-kernel
[-- Attachment #1: Type: text/plain, Size: 3460 bytes --]
On Wed, 15 Aug 2012 15:46:19 -0400 Paul Gortmaker
<paul.gortmaker@windriver.com> wrote:
> From: NeilBrown <neilb@suse.de>
>
> -------------------
> This is a commit scheduled for the next v2.6.34 longterm release.
> http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
> If you see a problem with using this for longterm, please comment.
This patch fixes one problem but unfortunately introduces another.
The patch for that 'other' should get sent to linus in the next day or so
after it has had a chance to sit in -next for a bit.
It can be found at:
http://neil.brown.name/git?p=md;a=commitdiff;h=30b798a352052b07c924956dda4ce720b00af711
you could either add that patch, or drop this patch until the next cycle.
Thanks,
NeilBrown
> -------------------
>
> commit 27a7b260f71439c40546b43588448faac01adb93 upstream.
>
> 0.90 metadata uses an unsigned 32bit number to count the number of
> kilobytes used from each device.
> This should allow up to 4TB per device.
> However we multiply this by 2 (to get sectors) before casting to a
> larger type, so sizes above 2TB get truncated.
>
> Also we allow rdev->sectors to be larger than 4TB, so it is possible
> for the array to be resized larger than the metadata can handle.
> So make sure rdev->sectors never exceeds 4TB when 0.90 metadata is in
> used.
>
> Also the sanity check at the end of super_90_load should include level
> 1 as it used ->size too. (RAID0 and Linear don't use ->size at all).
>
> Reported-by: Pim Zandbergen <P.Zandbergen@macroscoop.nl>
> Signed-off-by: NeilBrown <neilb@suse.de>
> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
> ---
> drivers/md/md.c | 12 ++++++++++--
> 1 file changed, 10 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/md/md.c b/drivers/md/md.c
> index d26df7f..4788c82 100644
> --- a/drivers/md/md.c
> +++ b/drivers/md/md.c
> @@ -985,8 +985,11 @@ static int super_90_load(mdk_rdev_t *rdev, mdk_rdev_t *refdev, int minor_version
> ret = 0;
> }
> rdev->sectors = rdev->sb_start;
> + /* Limit to 4TB as metadata cannot record more than that */
> + if (rdev->sectors >= (2ULL << 32))
> + rdev->sectors = (2ULL << 32) - 2;
>
> - if (rdev->sectors < sb->size * 2 && sb->level > 1)
> + if (rdev->sectors < ((sector_t)sb->size) * 2 && sb->level >= 1)
> /* "this cannot possibly happen" ... */
> ret = -EINVAL;
>
> @@ -1021,7 +1024,7 @@ static int super_90_validate(mddev_t *mddev, mdk_rdev_t *rdev)
> mddev->clevel[0] = 0;
> mddev->layout = sb->layout;
> mddev->raid_disks = sb->raid_disks;
> - mddev->dev_sectors = sb->size * 2;
> + mddev->dev_sectors = ((sector_t)sb->size) * 2;
> mddev->events = ev1;
> mddev->bitmap_info.offset = 0;
> mddev->bitmap_info.default_offset = MD_SB_BYTES >> 9;
> @@ -1260,6 +1263,11 @@ super_90_rdev_size_change(mdk_rdev_t *rdev, sector_t num_sectors)
> rdev->sb_start = calc_dev_sboffset(rdev->bdev);
> if (!num_sectors || num_sectors > rdev->sb_start)
> num_sectors = rdev->sb_start;
> + /* Limit to 4TB as metadata cannot record more than that.
> + * 4TB == 2^32 KB, or 2*2^32 sectors.
> + */
> + if (num_sectors >= (2ULL << 32))
> + num_sectors = (2ULL << 32) - 2;
> md_super_write(rdev->mddev, rdev, rdev->sb_start, rdev->sb_size,
> rdev->sb_page);
> md_super_wait(rdev->mddev);
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 828 bytes --]
^ permalink raw reply [flat|nested] 186+ messages in thread
* Re: [v2.6.34-stable 035/165] md: Fix handling for devices from 2TB to 4TB in 0.90 metadata.
2012-08-15 20:46 ` NeilBrown
@ 2012-08-15 20:52 ` Paul Gortmaker
2012-08-16 4:24 ` Ben Hutchings
1 sibling, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 20:52 UTC (permalink / raw)
To: NeilBrown; +Cc: stable, linux-kernel
On 12-08-15 04:46 PM, NeilBrown wrote:
> On Wed, 15 Aug 2012 15:46:19 -0400 Paul Gortmaker
> <paul.gortmaker@windriver.com> wrote:
>
>> From: NeilBrown <neilb@suse.de>
>>
>> -------------------
>> This is a commit scheduled for the next v2.6.34 longterm release.
>> http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
>> If you see a problem with using this for longterm, please comment.
>
> This patch fixes one problem but unfortunately introduces another.
> The patch for that 'other' should get sent to linus in the next day or so
> after it has had a chance to sit in -next for a bit.
>
> It can be found at:
> http://neil.brown.name/git?p=md;a=commitdiff;h=30b798a352052b07c924956dda4ce720b00af711
>
> you could either add that patch, or drop this patch until the next cycle.
Thanks for the review Neil, I'll postpone this off until the next
cycle, and then add both in.
Paul.
--
>
> Thanks,
> NeilBrown
>
>> -------------------
>>
>> commit 27a7b260f71439c40546b43588448faac01adb93 upstream.
>>
>> 0.90 metadata uses an unsigned 32bit number to count the number of
>> kilobytes used from each device.
>> This should allow up to 4TB per device.
>> However we multiply this by 2 (to get sectors) before casting to a
>> larger type, so sizes above 2TB get truncated.
>>
>> Also we allow rdev->sectors to be larger than 4TB, so it is possible
>> for the array to be resized larger than the metadata can handle.
>> So make sure rdev->sectors never exceeds 4TB when 0.90 metadata is in
>> used.
>>
>> Also the sanity check at the end of super_90_load should include level
>> 1 as it used ->size too. (RAID0 and Linear don't use ->size at all).
>>
>> Reported-by: Pim Zandbergen <P.Zandbergen@macroscoop.nl>
>> Signed-off-by: NeilBrown <neilb@suse.de>
>> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
>> ---
>> drivers/md/md.c | 12 ++++++++++--
>> 1 file changed, 10 insertions(+), 2 deletions(-)
>>
>> diff --git a/drivers/md/md.c b/drivers/md/md.c
>> index d26df7f..4788c82 100644
>> --- a/drivers/md/md.c
>> +++ b/drivers/md/md.c
>> @@ -985,8 +985,11 @@ static int super_90_load(mdk_rdev_t *rdev, mdk_rdev_t *refdev, int minor_version
>> ret = 0;
>> }
>> rdev->sectors = rdev->sb_start;
>> + /* Limit to 4TB as metadata cannot record more than that */
>> + if (rdev->sectors >= (2ULL << 32))
>> + rdev->sectors = (2ULL << 32) - 2;
>>
>> - if (rdev->sectors < sb->size * 2 && sb->level > 1)
>> + if (rdev->sectors < ((sector_t)sb->size) * 2 && sb->level >= 1)
>> /* "this cannot possibly happen" ... */
>> ret = -EINVAL;
>>
>> @@ -1021,7 +1024,7 @@ static int super_90_validate(mddev_t *mddev, mdk_rdev_t *rdev)
>> mddev->clevel[0] = 0;
>> mddev->layout = sb->layout;
>> mddev->raid_disks = sb->raid_disks;
>> - mddev->dev_sectors = sb->size * 2;
>> + mddev->dev_sectors = ((sector_t)sb->size) * 2;
>> mddev->events = ev1;
>> mddev->bitmap_info.offset = 0;
>> mddev->bitmap_info.default_offset = MD_SB_BYTES >> 9;
>> @@ -1260,6 +1263,11 @@ super_90_rdev_size_change(mdk_rdev_t *rdev, sector_t num_sectors)
>> rdev->sb_start = calc_dev_sboffset(rdev->bdev);
>> if (!num_sectors || num_sectors > rdev->sb_start)
>> num_sectors = rdev->sb_start;
>> + /* Limit to 4TB as metadata cannot record more than that.
>> + * 4TB == 2^32 KB, or 2*2^32 sectors.
>> + */
>> + if (num_sectors >= (2ULL << 32))
>> + num_sectors = (2ULL << 32) - 2;
>> md_super_write(rdev->mddev, rdev, rdev->sb_start, rdev->sb_size,
>> rdev->sb_page);
>> md_super_wait(rdev->mddev);
>
^ permalink raw reply [flat|nested] 186+ messages in thread
* Re: [v2.6.34-stable 035/165] md: Fix handling for devices from 2TB to 4TB in 0.90 metadata.
2012-08-15 20:46 ` NeilBrown
2012-08-15 20:52 ` Paul Gortmaker
@ 2012-08-16 4:24 ` Ben Hutchings
2012-08-16 6:47 ` NeilBrown
1 sibling, 1 reply; 186+ messages in thread
From: Ben Hutchings @ 2012-08-16 4:24 UTC (permalink / raw)
To: NeilBrown; +Cc: Paul Gortmaker, stable, linux-kernel
[-- Attachment #1: Type: text/plain, Size: 1183 bytes --]
On Thu, 2012-08-16 at 06:46 +1000, NeilBrown wrote:
> On Wed, 15 Aug 2012 15:46:19 -0400 Paul Gortmaker
> <paul.gortmaker@windriver.com> wrote:
>
> > From: NeilBrown <neilb@suse.de>
> >
> > -------------------
> > This is a commit scheduled for the next v2.6.34 longterm release.
> > http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
> > If you see a problem with using this for longterm, please comment.
>
> This patch fixes one problem but unfortunately introduces another.
> The patch for that 'other' should get sent to linus in the next day or so
> after it has had a chance to sit in -next for a bit.
>
> It can be found at:
> http://neil.brown.name/git?p=md;a=commitdiff;h=30b798a352052b07c924956dda4ce720b00af711
>
> you could either add that patch, or drop this patch until the next cycle.
[...]
This was already backported to 2.6.32, 2.6.33 and 3.0. So please change
the last sentence of the commit message for your following fix; it will
be needed for all active stable series.
Ben.
--
Ben Hutchings
I say we take off; nuke the site from orbit. It's the only way to be sure.
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 828 bytes --]
^ permalink raw reply [flat|nested] 186+ messages in thread
* Re: [v2.6.34-stable 035/165] md: Fix handling for devices from 2TB to 4TB in 0.90 metadata.
2012-08-16 4:24 ` Ben Hutchings
@ 2012-08-16 6:47 ` NeilBrown
0 siblings, 0 replies; 186+ messages in thread
From: NeilBrown @ 2012-08-16 6:47 UTC (permalink / raw)
To: Ben Hutchings; +Cc: Paul Gortmaker, stable, linux-kernel
[-- Attachment #1: Type: text/plain, Size: 1643 bytes --]
On Thu, 16 Aug 2012 05:24:33 +0100 Ben Hutchings <ben@decadent.org.uk> wrote:
> On Thu, 2012-08-16 at 06:46 +1000, NeilBrown wrote:
> > On Wed, 15 Aug 2012 15:46:19 -0400 Paul Gortmaker
> > <paul.gortmaker@windriver.com> wrote:
> >
> > > From: NeilBrown <neilb@suse.de>
> > >
> > > -------------------
> > > This is a commit scheduled for the next v2.6.34 longterm release.
> > > http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
> > > If you see a problem with using this for longterm, please comment.
> >
> > This patch fixes one problem but unfortunately introduces another.
> > The patch for that 'other' should get sent to linus in the next day or so
> > after it has had a chance to sit in -next for a bit.
> >
> > It can be found at:
> > http://neil.brown.name/git?p=md;a=commitdiff;h=30b798a352052b07c924956dda4ce720b00af711
> >
> > you could either add that patch, or drop this patch until the next cycle.
> [...]
>
> This was already backported to 2.6.32, 2.6.33 and 3.0. So please change
> the last sentence of the commit message for your following fix; it will
> be needed for all active stable series.
>
I had been wondering about that. You've convinced me. It now reads:
This bug was introduced in 3.1 and is suitable for any stable kernels
from then onwards.
As the offending commit was tagged for 'stable', any stable kernel
that it was applied to should also get this patch. That includes
at least 2.6.32, 2.6.33 and 3.0. (Thanks to Ben Hutchings for
providing that list).
Thanks,
NeilBrown
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 828 bytes --]
^ permalink raw reply [flat|nested] 186+ messages in thread
* [v2.6.34-stable 036/165] net/9p: fix client code to fail more gracefully on protocol error
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (34 preceding siblings ...)
2012-08-15 19:46 ` [v2.6.34-stable 035/165] md: Fix handling for devices from 2TB to 4TB in 0.90 metadata Paul Gortmaker
@ 2012-08-15 19:46 ` Paul Gortmaker
2012-08-15 19:46 ` [v2.6.34-stable 037/165] fs/9p: Fid is not valid after a failed clunk Paul Gortmaker
` (128 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:46 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Eric Van Hensbergen, Paul Gortmaker
From: Eric Van Hensbergen <ericvh@gmail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit b85f7d92d7bd7e3298159e8b1eed8cb8cbbb0348 upstream.
There was a BUG_ON to protect against a bad id which could be dealt with
more gracefully.
Reported-by: Natalie Orlin <norlin@us.ibm.com>
Signed-off-by: Eric Van Hensbergen <ericvh@gmail.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
net/9p/client.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/9p/client.c b/net/9p/client.c
index 0aa79fa..583fd03 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -272,7 +272,8 @@ struct p9_req_t *p9_tag_lookup(struct p9_client *c, u16 tag)
* buffer to read the data into */
tag++;
- BUG_ON(tag >= c->max_tag);
+ if(tag >= c->max_tag)
+ return NULL;
row = tag / P9_ROW_MAXTAG;
col = tag % P9_ROW_MAXTAG;
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 037/165] fs/9p: Fid is not valid after a failed clunk.
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (35 preceding siblings ...)
2012-08-15 19:46 ` [v2.6.34-stable 036/165] net/9p: fix client code to fail more gracefully on protocol error Paul Gortmaker
@ 2012-08-15 19:46 ` Paul Gortmaker
2012-08-15 19:46 ` [v2.6.34-stable 038/165] net/9p: Fix the msize calculation Paul Gortmaker
` (127 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:46 UTC (permalink / raw)
To: stable, linux-kernel
Cc: Aneesh Kumar K.V, Eric Van Hensbergen, Paul Gortmaker
From: "Aneesh Kumar K.V" <aneesh.kumar@linux.vnet.ibm.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 5034990e28efb2d232ee82443a9edd62defd17ba upstream.
free the fid even in case of failed clunk.
Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
Signed-off-by: Eric Van Hensbergen <ericvh@gmail.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
net/9p/client.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/net/9p/client.c b/net/9p/client.c
index 583fd03..bd30c3b 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -1114,9 +1114,11 @@ int p9_client_clunk(struct p9_fid *fid)
P9_DPRINTK(P9_DEBUG_9P, "<<< RCLUNK fid %d\n", fid->fid);
p9_free_req(clnt, req);
- p9_fid_destroy(fid);
-
error:
+ /*
+ * Fid is not valid even after a failed clunk
+ */
+ p9_fid_destroy(fid);
return err;
}
EXPORT_SYMBOL(p9_client_clunk);
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 038/165] net/9p: Fix the msize calculation.
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (36 preceding siblings ...)
2012-08-15 19:46 ` [v2.6.34-stable 037/165] fs/9p: Fid is not valid after a failed clunk Paul Gortmaker
@ 2012-08-15 19:46 ` Paul Gortmaker
2012-08-15 19:46 ` [v2.6.34-stable 039/165] irda: fix smsc-ircc2 section mismatch warning Paul Gortmaker
` (126 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:46 UTC (permalink / raw)
To: stable, linux-kernel
Cc: Venkateswararao Jujjuri (JV),
Aneesh Kumar K.V, Eric Van Hensbergen, Paul Gortmaker
From: "Venkateswararao Jujjuri (JV)" <jvrao@linux.vnet.ibm.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit c9ffb05ca5b5098d6ea468c909dd384d90da7d54 upstream.
msize represents the maximum PDU size that includes P9_IOHDRSZ.
Signed-off-by: Venkateswararao Jujjuri "<jvrao@linux.vnet.ibm.com>
Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
Signed-off-by: Eric Van Hensbergen <ericvh@gmail.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
net/9p/client.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/9p/client.c b/net/9p/client.c
index bd30c3b..1a1e6d5 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -775,8 +775,8 @@ struct p9_client *p9_client_create(const char *dev_name, char *options)
if (err)
goto destroy_fidpool;
- if ((clnt->msize+P9_IOHDRSZ) > clnt->trans_mod->maxsize)
- clnt->msize = clnt->trans_mod->maxsize-P9_IOHDRSZ;
+ if (clnt->msize > clnt->trans_mod->maxsize)
+ clnt->msize = clnt->trans_mod->maxsize;
err = p9_client_version(clnt);
if (err)
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 039/165] irda: fix smsc-ircc2 section mismatch warning
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (37 preceding siblings ...)
2012-08-15 19:46 ` [v2.6.34-stable 038/165] net/9p: Fix the msize calculation Paul Gortmaker
@ 2012-08-15 19:46 ` Paul Gortmaker
2012-08-15 19:46 ` [v2.6.34-stable 040/165] qla2xxx: Correct inadvertent loop state transitions during port-update handling Paul Gortmaker
` (125 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:46 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Randy Dunlap, David S. Miller, Paul Gortmaker
From: Randy Dunlap <randy.dunlap@oracle.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit f470e5ae34d68880a38aa79ee5c102ebc2a1aef6 upstream.
Fix section mismatch warning:
WARNING: drivers/net/irda/smsc-ircc2.o(.devinit.text+0x1a7): Section mismatch in reference from the function smsc_ircc_pnp_probe() to the function .init.text:smsc_ircc_open()
Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/net/irda/smsc-ircc2.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/irda/smsc-ircc2.c b/drivers/net/irda/smsc-ircc2.c
index 6af84d8..ab971f9 100644
--- a/drivers/net/irda/smsc-ircc2.c
+++ b/drivers/net/irda/smsc-ircc2.c
@@ -515,7 +515,7 @@ static const struct net_device_ops smsc_ircc_netdev_ops = {
* Try to open driver instance
*
*/
-static int __init smsc_ircc_open(unsigned int fir_base, unsigned int sir_base, u8 dma, u8 irq)
+static int __devinit smsc_ircc_open(unsigned int fir_base, unsigned int sir_base, u8 dma, u8 irq)
{
struct smsc_ircc_cb *self;
struct net_device *dev;
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 040/165] qla2xxx: Correct inadvertent loop state transitions during port-update handling.
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (38 preceding siblings ...)
2012-08-15 19:46 ` [v2.6.34-stable 039/165] irda: fix smsc-ircc2 section mismatch warning Paul Gortmaker
@ 2012-08-15 19:46 ` Paul Gortmaker
2012-08-15 19:46 ` [v2.6.34-stable 041/165] e1000: Fix driver to be used on PA RISC C8000 workstations Paul Gortmaker
` (124 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:46 UTC (permalink / raw)
To: stable, linux-kernel
Cc: Andrew Vasquez, Chad Dupuis, James Bottomley, Paul Gortmaker
From: Andrew Vasquez <andrew.vasquez@qlogic.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 58b48576966ed0afd3f63ef17480ec12748a7119 upstream.
Transitioning to a LOOP_UPDATE loop-state could cause the driver
to miss normal link/target processing. LOOP_UPDATE is a crufty
artifact leftover from at time the driver performed it's own
internal command-queuing. Safely remove this state.
Signed-off-by: Andrew Vasquez <andrew.vasquez@qlogic.com>
Signed-off-by: Chad Dupuis <chad.dupuis@qlogic.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/scsi/qla2xxx/qla_init.c | 3 ---
drivers/scsi/qla2xxx/qla_isr.c | 1 -
2 files changed, 4 deletions(-)
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index 4229bb4..8e23aa2 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -3497,15 +3497,12 @@ qla2x00_loop_resync(scsi_qla_host_t *vha)
req = vha->req;
rsp = req->rsp;
- atomic_set(&vha->loop_state, LOOP_UPDATE);
clear_bit(ISP_ABORT_RETRY, &vha->dpc_flags);
if (vha->flags.online) {
if (!(rval = qla2x00_fw_ready(vha))) {
/* Wait at most MAX_TARGET RSCNs for a stable link. */
wait_time = 256;
do {
- atomic_set(&vha->loop_state, LOOP_UPDATE);
-
/* Issue a marker after FW becomes ready. */
qla2x00_marker(vha, req, rsp, 0, 0,
MK_SYNC_ALL);
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index db539b0..0266b78 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -724,7 +724,6 @@ skip_rio:
vha->flags.rscn_queue_overflow = 1;
}
- atomic_set(&vha->loop_state, LOOP_UPDATE);
atomic_set(&vha->loop_down_timer, 0);
vha->flags.management_server_logged_in = 0;
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 041/165] e1000: Fix driver to be used on PA RISC C8000 workstations
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (39 preceding siblings ...)
2012-08-15 19:46 ` [v2.6.34-stable 040/165] qla2xxx: Correct inadvertent loop state transitions during port-update handling Paul Gortmaker
@ 2012-08-15 19:46 ` Paul Gortmaker
2012-08-15 19:46 ` [v2.6.34-stable 042/165] ASoC: Fix reporting of partial jack updates Paul Gortmaker
` (123 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:46 UTC (permalink / raw)
To: stable, linux-kernel
Cc: Jeff Kirsher, Guy Martin, Rolf Eike Beer, Matt Turner,
David S. Miller, Paul Gortmaker
From: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit e2faeec2de9e2c73958e6ea6065dde1e8cd6f3a2 upstream.
The checksum field in the EEPROM on HPPA is really not a
checksum but a signature (0x16d6). So allow 0x16d6 as the
matching checksum on HPPA systems.
This issue is present on longterm/stable kernels, I have
verified that this patch is applicable back to at least
2.6.32.y kernels.
v2- changed ifdef to use CONFIG_PARISC instead of __hppa__
CC: Guy Martin <gmsoft@tuxicoman.be>
CC: Rolf Eike Beer <eike-kernel@sf-tec.de>
CC: Matt Turner <mattst88@gmail.com>
Reported-by: Mikulas Patocka <mikulas@artax.kerlin.mff.cuni.cz>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Acked-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/net/e1000/e1000_hw.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/net/e1000/e1000_hw.c b/drivers/net/e1000/e1000_hw.c
index 8d7d87f..0d82be0 100644
--- a/drivers/net/e1000/e1000_hw.c
+++ b/drivers/net/e1000/e1000_hw.c
@@ -3842,6 +3842,12 @@ s32 e1000_validate_eeprom_checksum(struct e1000_hw *hw)
checksum += eeprom_data;
}
+#ifdef CONFIG_PARISC
+ /* This is a signature and not a checksum on HP c8000 */
+ if ((hw->subsystem_vendor_id == 0x103C) && (eeprom_data == 0x16d6))
+ return E1000_SUCCESS;
+
+#endif
if (checksum == (u16) EEPROM_SUM)
return E1000_SUCCESS;
else {
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 042/165] ASoC: Fix reporting of partial jack updates
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (40 preceding siblings ...)
2012-08-15 19:46 ` [v2.6.34-stable 041/165] e1000: Fix driver to be used on PA RISC C8000 workstations Paul Gortmaker
@ 2012-08-15 19:46 ` Paul Gortmaker
2012-08-15 19:46 ` [v2.6.34-stable 043/165] ALSA: HDA: Cirrus - fix "Surround Speaker" volume control name Paul Gortmaker
` (122 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:46 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Mark Brown, Paul Gortmaker
From: Mark Brown <broonie@opensource.wolfsonmicro.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 747da0f80e566500421bd7760b2e050fea3fde5e upstream.
We need to report the entire jack state to the core jack code, not just
the bits that were being updated by the caller, otherwise the status
reported by other detection methods will be omitted from the state seen
by userspace.
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Acked-by: Liam Girdwood <lrg@ti.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
sound/soc/soc-jack.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/soc/soc-jack.c b/sound/soc/soc-jack.c
index 3c07a94..f097755 100644
--- a/sound/soc/soc-jack.c
+++ b/sound/soc/soc-jack.c
@@ -95,7 +95,7 @@ void snd_soc_jack_report(struct snd_soc_jack *jack, int status, int mask)
snd_soc_dapm_sync(codec);
- snd_jack_report(jack->jack, status);
+ snd_jack_report(jack->jack, jack->status);
out:
mutex_unlock(&codec->mutex);
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 043/165] ALSA: HDA: Cirrus - fix "Surround Speaker" volume control name
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (41 preceding siblings ...)
2012-08-15 19:46 ` [v2.6.34-stable 042/165] ASoC: Fix reporting of partial jack updates Paul Gortmaker
@ 2012-08-15 19:46 ` Paul Gortmaker
2012-08-15 19:46 ` [v2.6.34-stable 044/165] b43: Fix beacon problem in ad-hoc mode Paul Gortmaker
` (121 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:46 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: David Henningsson, Takashi Iwai, Paul Gortmaker
From: David Henningsson <david.henningsson@canonical.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 2e1210bc3d065a6e26ff5fef228a9a7e08921d2c upstream.
This patch fixes "Surround Speaker Playback Volume" being cut off.
(Commit b4dabfc452a10 was probably meant to fix this, but it fixed
only the "Switch" name, not the "Volume" name.)
Signed-off-by: David Henningsson <david.henningsson@canonical.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
sound/pci/hda/patch_cirrus.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c
index 5f08464..71855e3 100644
--- a/sound/pci/hda/patch_cirrus.c
+++ b/sound/pci/hda/patch_cirrus.c
@@ -510,7 +510,7 @@ static int add_volume(struct hda_codec *codec, const char *name,
int index, unsigned int pval, int dir,
struct snd_kcontrol **kctlp)
{
- char tmp[32];
+ char tmp[44];
struct snd_kcontrol_new knew =
HDA_CODEC_VOLUME_IDX(tmp, index, 0, 0, HDA_OUTPUT);
knew.private_value = pval;
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 044/165] b43: Fix beacon problem in ad-hoc mode
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (42 preceding siblings ...)
2012-08-15 19:46 ` [v2.6.34-stable 043/165] ALSA: HDA: Cirrus - fix "Surround Speaker" volume control name Paul Gortmaker
@ 2012-08-15 19:46 ` Paul Gortmaker
2012-08-15 19:46 ` [v2.6.34-stable 045/165] wireless: Reset beacon_found while updating regulatory Paul Gortmaker
` (120 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:46 UTC (permalink / raw)
To: stable, linux-kernel
Cc: Manual Munz, Larry Finger, John W. Linville, Paul Gortmaker
From: Manual Munz <freifunk@somakoma.de>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 8c23516fbb209ccf8f8c36268311c721faff29ee upstream.
In ad-hoc mode, driver b43 does not issue beacons.
Signed-off-by: Manual Munz <freifunk@somakoma.de>
Tested-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/net/wireless/b43/main.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index 9a374ef..1f230b8 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -1538,7 +1538,8 @@ static void handle_irq_beacon(struct b43_wldev *dev)
u32 cmd, beacon0_valid, beacon1_valid;
if (!b43_is_mode(wl, NL80211_IFTYPE_AP) &&
- !b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
+ !b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) &&
+ !b43_is_mode(wl, NL80211_IFTYPE_ADHOC))
return;
/* This is the bottom half of the asynchronous beacon update. */
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 045/165] wireless: Reset beacon_found while updating regulatory
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (43 preceding siblings ...)
2012-08-15 19:46 ` [v2.6.34-stable 044/165] b43: Fix beacon problem in ad-hoc mode Paul Gortmaker
@ 2012-08-15 19:46 ` Paul Gortmaker
2012-08-15 19:46 ` [v2.6.34-stable 046/165] USB: PL2303: correctly handle baudrates above 115200 Paul Gortmaker
` (119 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:46 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Rajkumar Manoharan, John W. Linville, Paul Gortmaker
From: Rajkumar Manoharan <rmanohar@qca.qualcomm.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit aa3d7eef398dd4f29045e9889b817d5161afe03e upstream.
During the association, the regulatory is updated by country IE
that reaps the previously found beacons. The impact is that
after a STA disconnects *or* when for any reason a regulatory
domain change happens the beacon hint flag is not cleared
therefore preventing future beacon hints to be learned.
This is important as a regulatory domain change or a restore
of regulatory settings would set back the passive scan and no-ibss
flags on the channel. This is the right place to do this given that
it covers any regulatory domain change.
Reviewed-by: Luis R. Rodriguez <mcgrof@gmail.com>
Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com>
Acked-by: Luis R. Rodriguez <mcgrof@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
net/wireless/reg.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 422da20..3ed40f7 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -1302,6 +1302,7 @@ static void handle_channel(struct wiphy *wiphy, enum ieee80211_band band,
return;
}
+ chan->beacon_found = false;
chan->flags = flags | bw_flags | map_regdom_flags(reg_rule->flags);
chan->max_antenna_gain = min(chan->orig_mag,
(int) MBI_TO_DBI(power_rule->max_antenna_gain));
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 046/165] USB: PL2303: correctly handle baudrates above 115200
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (44 preceding siblings ...)
2012-08-15 19:46 ` [v2.6.34-stable 045/165] wireless: Reset beacon_found while updating regulatory Paul Gortmaker
@ 2012-08-15 19:46 ` Paul Gortmaker
2012-08-15 19:46 ` [v2.6.34-stable 047/165] ASIX: Add AX88772B USB ID Paul Gortmaker
` (118 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:46 UTC (permalink / raw)
To: stable, linux-kernel
Cc: Michał Sroczyński, Greg Kroah-Hartman, Paul Gortmaker
From: Michał Sroczyński <msroczyn@gmail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 8d48fdf689fed2c73c493e5146d1463689246442 upstream.
PL2303: correctly handle baudrates above 115200
Signed-off-by: Michal Sroczynski <msroczyn@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/usb/serial/pl2303.c | 26 ++++++++++++++++++++++----
1 file changed, 22 insertions(+), 4 deletions(-)
diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
index 4b357d6..9f49375 100644
--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -616,10 +616,28 @@ static void pl2303_set_termios(struct tty_struct *tty,
baud = 6000000;
}
dbg("%s - baud set = %d", __func__, baud);
- buf[0] = baud & 0xff;
- buf[1] = (baud >> 8) & 0xff;
- buf[2] = (baud >> 16) & 0xff;
- buf[3] = (baud >> 24) & 0xff;
+ if (baud <= 115200) {
+ buf[0] = baud & 0xff;
+ buf[1] = (baud >> 8) & 0xff;
+ buf[2] = (baud >> 16) & 0xff;
+ buf[3] = (baud >> 24) & 0xff;
+ } else {
+ /* apparently the formula for higher speeds is:
+ * baudrate = 12M * 32 / (2^buf[1]) / buf[0]
+ */
+ unsigned tmp = 12*1000*1000*32 / baud;
+ buf[3] = 0x80;
+ buf[2] = 0;
+ buf[1] = (tmp >= 256);
+ while (tmp >= 256) {
+ tmp >>= 2;
+ buf[1] <<= 1;
+ }
+ if (tmp > 256) {
+ tmp %= 256;
+ }
+ buf[0] = tmp;
+ }
}
/* For reference buf[4]=0 is 1 stop bits */
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 047/165] ASIX: Add AX88772B USB ID
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (45 preceding siblings ...)
2012-08-15 19:46 ` [v2.6.34-stable 046/165] USB: PL2303: correctly handle baudrates above 115200 Paul Gortmaker
@ 2012-08-15 19:46 ` Paul Gortmaker
2012-08-15 19:46 ` [v2.6.34-stable 048/165] hvc_console: Improve tty/console put_chars handling Paul Gortmaker
` (117 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:46 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Marek Vasut, David S. Miller, Paul Gortmaker
From: Marek Vasut <marek.vasut@gmail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 308859097831831a979f2e82cbeef0a94f438080 upstream.
This device can be found in Acer Iconia TAB W500 tablet dock.
Signed-off-by: Marek Vasut <marek.vasut@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/net/usb/asix.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/net/usb/asix.c b/drivers/net/usb/asix.c
index 35f56fc..60e882f 100644
--- a/drivers/net/usb/asix.c
+++ b/drivers/net/usb/asix.c
@@ -1473,6 +1473,10 @@ static const struct usb_device_id products [] = {
USB_DEVICE (0x04f1, 0x3008),
.driver_info = (unsigned long) &ax8817x_info,
}, {
+ // ASIX AX88772B 10/100
+ USB_DEVICE (0x0b95, 0x772b),
+ .driver_info = (unsigned long) &ax88772_info,
+}, {
// ASIX AX88772 10/100
USB_DEVICE (0x0b95, 0x7720),
.driver_info = (unsigned long) &ax88772_info,
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 048/165] hvc_console: Improve tty/console put_chars handling
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (46 preceding siblings ...)
2012-08-15 19:46 ` [v2.6.34-stable 047/165] ASIX: Add AX88772B USB ID Paul Gortmaker
@ 2012-08-15 19:46 ` Paul Gortmaker
2012-08-15 19:46 ` [v2.6.34-stable 049/165] TPM: Call tpm_transmit with correct size Paul Gortmaker
` (116 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:46 UTC (permalink / raw)
To: stable, linux-kernel
Cc: Hendrik Brueckner, Benjamin Herrenschmidt, Paul Gortmaker
From: Hendrik Brueckner <brueckner@linux.vnet.ibm.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 8c2381af0d3ef62a681dac5a141b6dabb27bf2e1 upstream.
Currently, the hvc_console_print() function drops console output if the
hvc backend's put_chars() returns 0. This patch changes this behavior
to allow a retry through returning -EAGAIN.
This change also affects the hvc_push() function. Both functions are
changed to handle -EAGAIN and to retry the put_chars() operation.
If a hvc backend returns -EAGAIN, the retry handling differs:
- hvc_console_print() spins to write the complete console output.
- hvc_push() behaves the same way as for returning 0.
Now hvc backends can indirectly control the way how console output is
handled through the hvc console layer.
Signed-off-by: Hendrik Brueckner <brueckner@linux.vnet.ibm.com>
Acked-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
[PG: map drivers/tty/hvc/ --> drivers/char for v2.6.34 baseline]
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/char/hvc_console.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/drivers/char/hvc_console.c b/drivers/char/hvc_console.c
index 35cca4c..8417efe 100644
--- a/drivers/char/hvc_console.c
+++ b/drivers/char/hvc_console.c
@@ -163,8 +163,10 @@ static void hvc_console_print(struct console *co, const char *b,
} else {
r = cons_ops[index]->put_chars(vtermnos[index], c, i);
if (r <= 0) {
- /* throw away chars on error */
- i = 0;
+ /* throw away characters on error
+ * but spin in case of -EAGAIN */
+ if (r != -EAGAIN)
+ i = 0;
} else if (r > 0) {
i -= r;
if (i > 0)
@@ -448,7 +450,7 @@ static int hvc_push(struct hvc_struct *hp)
n = hp->ops->put_chars(hp->vtermno, hp->outbuf, hp->n_outbuf);
if (n <= 0) {
- if (n == 0) {
+ if (n == 0 || n == -EAGAIN) {
hp->do_wakeup = 1;
return 0;
}
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 049/165] TPM: Call tpm_transmit with correct size
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (47 preceding siblings ...)
2012-08-15 19:46 ` [v2.6.34-stable 048/165] hvc_console: Improve tty/console put_chars handling Paul Gortmaker
@ 2012-08-15 19:46 ` Paul Gortmaker
2012-08-15 19:46 ` [v2.6.34-stable 050/165] TPM: Zero buffer after copying to userspace Paul Gortmaker
` (115 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:46 UTC (permalink / raw)
To: stable, linux-kernel
Cc: Peter Huewe, Rajiv Andrade, James Morris, Paul Gortmaker
From: Peter Huewe <huewe.external.infineon@googlemail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 6b07d30aca7e52f2881b8c8c20c8a2cd28e8b3d3 upstream.
This patch changes the call of tpm_transmit by supplying the size of the
userspace buffer instead of TPM_BUFSIZE.
This got assigned CVE-2011-1161.
[The first hunk didn't make sense given one could expect
way less data than TPM_BUFSIZE, so added tpm_transmit boundary
check over bufsiz instead
The last parameter of tpm_transmit() reflects the amount
of data expected from the device, and not the buffer size
being supplied to it. It isn't ideal to parse it directly,
so we just set it to the maximum the input buffer can handle
and let the userspace API to do such job.]
Signed-off-by: Rajiv Andrade <srajiv@linux.vnet.ibm.com>
Signed-off-by: James Morris <jmorris@namei.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/char/tpm/tpm.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
index 7f95fec..f39e5ee 100644
--- a/drivers/char/tpm/tpm.c
+++ b/drivers/char/tpm/tpm.c
@@ -375,6 +375,9 @@ static ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,
u32 count, ordinal;
unsigned long stop;
+ if (bufsiz > TPM_BUFSIZE)
+ bufsiz = TPM_BUFSIZE;
+
count = be32_to_cpu(*((__be32 *) (buf + 2)));
ordinal = be32_to_cpu(*((__be32 *) (buf + 6)));
if (count == 0)
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 050/165] TPM: Zero buffer after copying to userspace
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (48 preceding siblings ...)
2012-08-15 19:46 ` [v2.6.34-stable 049/165] TPM: Call tpm_transmit with correct size Paul Gortmaker
@ 2012-08-15 19:46 ` Paul Gortmaker
2012-08-17 15:48 ` Herton Ronaldo Krzesinski
2012-08-15 19:46 ` [v2.6.34-stable 051/165] libiscsi_tcp: fix LLD data allocation Paul Gortmaker
` (114 subsequent siblings)
164 siblings, 1 reply; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:46 UTC (permalink / raw)
To: stable, linux-kernel
Cc: Peter Huewe, Rajiv Andrade, James Morris, Paul Gortmaker
From: Peter Huewe <huewe.external.infineon@googlemail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 3321c07ae5068568cd61ac9f4ba749006a7185c9 upstream.
Since the buffer might contain security related data it might be a good idea to
zero the buffer after we have copied it to userspace.
This got assigned CVE-2011-1162.
Signed-off-by: Rajiv Andrade <srajiv@linux.vnet.ibm.com>
Signed-off-by: James Morris <jmorris@namei.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/char/tpm/tpm.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
index f39e5ee..9fe4683 100644
--- a/drivers/char/tpm/tpm.c
+++ b/drivers/char/tpm/tpm.c
@@ -1031,6 +1031,7 @@ ssize_t tpm_read(struct file *file, char __user *buf,
{
struct tpm_chip *chip = file->private_data;
ssize_t ret_size;
+ int rc;
del_singleshot_timer_sync(&chip->user_read_timer);
flush_scheduled_work();
@@ -1041,8 +1042,11 @@ ssize_t tpm_read(struct file *file, char __user *buf,
ret_size = size;
mutex_lock(&chip->buffer_mutex);
- if (copy_to_user(buf, chip->data_buffer, ret_size))
+ rc = copy_to_user(buf, chip->data_buffer, ret_size);
+ memset(chip->data_buffer, 0, ret_size);
+ if (rc)
ret_size = -EFAULT;
+
mutex_unlock(&chip->buffer_mutex);
}
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* Re: [v2.6.34-stable 050/165] TPM: Zero buffer after copying to userspace
2012-08-15 19:46 ` [v2.6.34-stable 050/165] TPM: Zero buffer after copying to userspace Paul Gortmaker
@ 2012-08-17 15:48 ` Herton Ronaldo Krzesinski
2012-08-17 18:27 ` Paul Gortmaker
0 siblings, 1 reply; 186+ messages in thread
From: Herton Ronaldo Krzesinski @ 2012-08-17 15:48 UTC (permalink / raw)
To: Paul Gortmaker
Cc: stable, linux-kernel, Peter Huewe, Rajiv Andrade, James Morris,
Tim Gardner, Seth Forshee, Debora Velarde, Marcel Selhorst,
tpmdd-devel
On Wed, Aug 15, 2012 at 03:46:34PM -0400, Paul Gortmaker wrote:
> From: Peter Huewe <huewe.external.infineon@googlemail.com>
>
> -------------------
> This is a commit scheduled for the next v2.6.34 longterm release.
> http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
> If you see a problem with using this for longterm, please comment.
> -------------------
>
> commit 3321c07ae5068568cd61ac9f4ba749006a7185c9 upstream.
>
> Since the buffer might contain security related data it might be a good idea to
> zero the buffer after we have copied it to userspace.
>
> This got assigned CVE-2011-1162.
>
> Signed-off-by: Rajiv Andrade <srajiv@linux.vnet.ibm.com>
> Signed-off-by: James Morris <jmorris@namei.org>
> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
[...]
commit 3ab1aff89477dafb1aaeafe8c8669114a02b7226 ("TPM: Zero buffer whole
after copying to userspace") is something to consider to be applied
after this, either with this update or later 2.6.34 update. It
complements this change, just fyi.
--
[]'s
Herton
^ permalink raw reply [flat|nested] 186+ messages in thread* Re: [v2.6.34-stable 050/165] TPM: Zero buffer after copying to userspace
2012-08-17 15:48 ` Herton Ronaldo Krzesinski
@ 2012-08-17 18:27 ` Paul Gortmaker
0 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-17 18:27 UTC (permalink / raw)
To: Herton Ronaldo Krzesinski
Cc: stable, linux-kernel, Peter Huewe, Rajiv Andrade, James Morris,
Tim Gardner, Seth Forshee, Debora Velarde, Marcel Selhorst,
tpmdd-devel
On 12-08-17 11:48 AM, Herton Ronaldo Krzesinski wrote:
> On Wed, Aug 15, 2012 at 03:46:34PM -0400, Paul Gortmaker wrote:
>> From: Peter Huewe <huewe.external.infineon@googlemail.com>
>>
>> -------------------
>> This is a commit scheduled for the next v2.6.34 longterm release.
>> http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
>> If you see a problem with using this for longterm, please comment.
>> -------------------
>>
>> commit 3321c07ae5068568cd61ac9f4ba749006a7185c9 upstream.
>>
>> Since the buffer might contain security related data it might be a good idea to
>> zero the buffer after we have copied it to userspace.
>>
>> This got assigned CVE-2011-1162.
>>
>> Signed-off-by: Rajiv Andrade <srajiv@linux.vnet.ibm.com>
>> Signed-off-by: James Morris <jmorris@namei.org>
>> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
> [...]
>
> commit 3ab1aff89477dafb1aaeafe8c8669114a02b7226 ("TPM: Zero buffer whole
> after copying to userspace") is something to consider to be applied
> after this, either with this update or later 2.6.34 update. It
> complements this change, just fyi.
Agreed. I see no reason to not queue this.
Thanks,
Paul.
--
>
^ permalink raw reply [flat|nested] 186+ messages in thread
* [v2.6.34-stable 051/165] libiscsi_tcp: fix LLD data allocation
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (49 preceding siblings ...)
2012-08-15 19:46 ` [v2.6.34-stable 050/165] TPM: Zero buffer after copying to userspace Paul Gortmaker
@ 2012-08-15 19:46 ` Paul Gortmaker
2012-08-15 19:46 ` [v2.6.34-stable 052/165] cnic: Improve NETDEV_UP event handling Paul Gortmaker
` (113 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:46 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Mike Christie, James Bottomley, Paul Gortmaker
From: Mike Christie <michaelc@cs.wisc.edu>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 74dcd0ec735ba9c5bef254b2f6e53068cf3f9ff0 upstream.
Have libiscsi_tcp have upper layers allocate the LLD data
along with the iscsi_cls_conn struct, so it is refcounted.
Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/scsi/libiscsi_tcp.c | 14 +++-----------
1 file changed, 3 insertions(+), 11 deletions(-)
diff --git a/drivers/scsi/libiscsi_tcp.c b/drivers/scsi/libiscsi_tcp.c
index 5c92620..b90bb2a 100644
--- a/drivers/scsi/libiscsi_tcp.c
+++ b/drivers/scsi/libiscsi_tcp.c
@@ -1073,7 +1073,8 @@ iscsi_tcp_conn_setup(struct iscsi_cls_session *cls_session, int dd_data_size,
struct iscsi_cls_conn *cls_conn;
struct iscsi_tcp_conn *tcp_conn;
- cls_conn = iscsi_conn_setup(cls_session, sizeof(*tcp_conn), conn_idx);
+ cls_conn = iscsi_conn_setup(cls_session,
+ sizeof(*tcp_conn) + dd_data_size, conn_idx);
if (!cls_conn)
return NULL;
conn = cls_conn->dd_data;
@@ -1085,22 +1086,13 @@ iscsi_tcp_conn_setup(struct iscsi_cls_session *cls_session, int dd_data_size,
tcp_conn = conn->dd_data;
tcp_conn->iscsi_conn = conn;
-
- tcp_conn->dd_data = kzalloc(dd_data_size, GFP_KERNEL);
- if (!tcp_conn->dd_data) {
- iscsi_conn_teardown(cls_conn);
- return NULL;
- }
+ tcp_conn->dd_data = conn->dd_data + sizeof(*tcp_conn);
return cls_conn;
}
EXPORT_SYMBOL_GPL(iscsi_tcp_conn_setup);
void iscsi_tcp_conn_teardown(struct iscsi_cls_conn *cls_conn)
{
- struct iscsi_conn *conn = cls_conn->dd_data;
- struct iscsi_tcp_conn *tcp_conn = conn->dd_data;
-
- kfree(tcp_conn->dd_data);
iscsi_conn_teardown(cls_conn);
}
EXPORT_SYMBOL_GPL(iscsi_tcp_conn_teardown);
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 052/165] cnic: Improve NETDEV_UP event handling
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (50 preceding siblings ...)
2012-08-15 19:46 ` [v2.6.34-stable 051/165] libiscsi_tcp: fix LLD data allocation Paul Gortmaker
@ 2012-08-15 19:46 ` Paul Gortmaker
2012-08-15 19:46 ` [v2.6.34-stable 053/165] ALSA: hda/realtek - Avoid bogus HP-pin assignment Paul Gortmaker
` (112 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:46 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Michael Chan, David S. Miller, Paul Gortmaker
From: Michael Chan <mchan@broadcom.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit db1d350fcb156b58f66a67680617077bcacfe6fc upstream.
During NETDEV_UP, we use symbol_get() to get the net driver's cnic
probe function. This sometimes doesn't work if NETDEV_UP happens
right after NETDEV_REGISTER and the net driver is still running module
init code. As a result, the cnic device may not be discovered. We
fix this by probing on all NETDEV events if the device's netif_running
state is up.
Signed-off-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/net/cnic.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/cnic.c b/drivers/net/cnic.c
index 4b451a7..49242ac 100644
--- a/drivers/net/cnic.c
+++ b/drivers/net/cnic.c
@@ -4528,7 +4528,7 @@ static int cnic_netdev_event(struct notifier_block *this, unsigned long event,
dev = cnic_from_netdev(netdev);
- if (!dev && (event == NETDEV_REGISTER || event == NETDEV_UP)) {
+ if (!dev && (event == NETDEV_REGISTER || netif_running(netdev))) {
/* Check for the hot-plug device */
dev = is_cnic_dev(netdev);
if (dev) {
@@ -4544,7 +4544,7 @@ static int cnic_netdev_event(struct notifier_block *this, unsigned long event,
else if (event == NETDEV_UNREGISTER)
cnic_ulp_exit(dev);
- if (event == NETDEV_UP) {
+ if (event == NETDEV_UP || (new_dev && netif_running(netdev))) {
if (cnic_register_netdev(dev) != 0) {
cnic_put(dev);
goto done;
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 053/165] ALSA: hda/realtek - Avoid bogus HP-pin assignment
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (51 preceding siblings ...)
2012-08-15 19:46 ` [v2.6.34-stable 052/165] cnic: Improve NETDEV_UP event handling Paul Gortmaker
@ 2012-08-15 19:46 ` Paul Gortmaker
2012-08-15 19:46 ` [v2.6.34-stable 054/165] 3w-9xxx: fix iommu_iova leak Paul Gortmaker
` (111 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:46 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Takashi Iwai, Paul Gortmaker
From: Takashi Iwai <tiwai@suse.de>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 5fe6e0151dbd969f5fbcd94d05c968b76d76952b upstream.
When the headphone pin is assigned as primary output to line_out_pins[],
the automatic HP-pin assignment by ASSID must be suppressed. Otherwise
a wrong pin might be assigned to the headphone and breaks the auto-mute.
Reference: https://bugzilla.novell.com/show_bug.cgi?id=716104
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
sound/pci/hda/patch_realtek.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index d388680..2c71de1 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -1336,7 +1336,9 @@ do_sku:
* 15 : 1 --> enable the function "Mute internal speaker
* when the external headphone out jack is plugged"
*/
- if (!spec->autocfg.hp_pins[0]) {
+ if (!spec->autocfg.hp_pins[0] &&
+ !(spec->autocfg.line_out_pins[0] &&
+ spec->autocfg.line_out_type == AUTO_PIN_HP_OUT)) {
hda_nid_t nid;
tmp = (ass >> 11) & 0x3; /* HP to chassis */
if (tmp == 0)
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 054/165] 3w-9xxx: fix iommu_iova leak
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (52 preceding siblings ...)
2012-08-15 19:46 ` [v2.6.34-stable 053/165] ALSA: hda/realtek - Avoid bogus HP-pin assignment Paul Gortmaker
@ 2012-08-15 19:46 ` Paul Gortmaker
2012-08-15 19:46 ` [v2.6.34-stable 055/165] aacraid: reset should disable MSI interrupt Paul Gortmaker
` (110 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:46 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: James Bottomley, Paul Gortmaker
From: James Bottomley <JBottomley@Parallels.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 96067723e46b0dd24ae7b934085ab4eff4d26a1b upstream.
Following reports on the list, it looks like the 3e-9xxx driver will leak dma
mappings every time we get a transient queueing error back from the card.
This is because it maps the sg list in the routine that sends the command, but
doesn't unmap again in the transient failure path (even though the command is
sent back to the block layer). Fix by unmapping before returning the status.
Reported-by: Chris Boot <bootc@bootc.net>
Tested-by: Chris Boot <bootc@bootc.net>
Acked-by: Adam Radford <aradford@gmail.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/scsi/3w-9xxx.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/scsi/3w-9xxx.c b/drivers/scsi/3w-9xxx.c
index e9788f5..3499131 100644
--- a/drivers/scsi/3w-9xxx.c
+++ b/drivers/scsi/3w-9xxx.c
@@ -1794,10 +1794,12 @@ static int twa_scsi_queue(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_cmnd
switch (retval) {
case SCSI_MLQUEUE_HOST_BUSY:
twa_free_request_id(tw_dev, request_id);
+ twa_unmap_scsi_data(tw_dev, request_id);
break;
case 1:
tw_dev->state[request_id] = TW_S_COMPLETED;
twa_free_request_id(tw_dev, request_id);
+ twa_unmap_scsi_data(tw_dev, request_id);
SCpnt->result = (DID_ERROR << 16);
done(SCpnt);
retval = 0;
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 055/165] aacraid: reset should disable MSI interrupt
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (53 preceding siblings ...)
2012-08-15 19:46 ` [v2.6.34-stable 054/165] 3w-9xxx: fix iommu_iova leak Paul Gortmaker
@ 2012-08-15 19:46 ` Paul Gortmaker
2012-08-15 19:46 ` [v2.6.34-stable 056/165] libsas: fix failure to revalidate domain for anything but the first expander child Paul Gortmaker
` (109 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:46 UTC (permalink / raw)
To: stable, linux-kernel
Cc: Vasily Averin, Vasily Averin, James Bottomley, Paul Gortmaker
From: Vasily Averin <vvs@parallels.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit d0efab26f89506387a1bde898556660e06d7eb15 upstream.
scsi reset on hardware with enabled MSI interrupts generates WARNING message
[11027.798722] aacraid: Host adapter abort request (0,0,0,0)
[11027.798814] aacraid: Host adapter reset request. SCSI hang ?
[11087.762237] aacraid: SCSI bus appears hung
[11135.082543] ------------[ cut here ]------------
[11135.082646] WARNING: at drivers/pci/msi.c:658 pci_enable_msi_block+0x251/0x290()
Signed-off-by: Vasily Averin <vvs@sw.ru>
Acked-by: Mark Salyzyn <mark_salyzyn@us.xyratex.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/scsi/aacraid/commsup.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/scsi/aacraid/commsup.c b/drivers/scsi/aacraid/commsup.c
index 94d2954..2cb663f 100644
--- a/drivers/scsi/aacraid/commsup.c
+++ b/drivers/scsi/aacraid/commsup.c
@@ -1242,6 +1242,8 @@ static int _aac_reset_adapter(struct aac_dev *aac, int forced)
kfree(aac->queues);
aac->queues = NULL;
free_irq(aac->pdev->irq, aac);
+ if (aac->msi)
+ pci_disable_msi(aac->pdev);
kfree(aac->fsa_dev);
aac->fsa_dev = NULL;
quirks = aac_get_driver_ident(index)->quirks;
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 056/165] libsas: fix failure to revalidate domain for anything but the first expander child.
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (54 preceding siblings ...)
2012-08-15 19:46 ` [v2.6.34-stable 055/165] aacraid: reset should disable MSI interrupt Paul Gortmaker
@ 2012-08-15 19:46 ` Paul Gortmaker
2012-08-15 19:46 ` [v2.6.34-stable 057/165] cfg80211: Fix validation of AKM suites Paul Gortmaker
` (108 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:46 UTC (permalink / raw)
To: stable, linux-kernel
Cc: Mark Salyzyn, Mark Salyzyn, James Bottomley, Paul Gortmaker
From: Mark Salyzyn <mark_salyzyn@us.xyratex.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 24926dadc41cc566e974022b0e66231b82c6375f upstream.
In an enclosure model where there are chaining expanders to a large body
of storage, it was discovered that libsas, responding to a broadcast
event change, would only revalidate the domain of first child expander
in the list.
The issue is that the pointer value to the discovered source device was
used to break out of the loop, rather than the content of the pointer.
This still remains non-compliant as the revalidate domain code is
supposed to loop through all child expanders, and not stop at the first
one it finds that reports a change count. However, the design of this
routine does not allow multiple device discoveries and that would be a
more complicated set of patches reserved for another day. We are fixing
the glaring bug rather than refactoring the code.
Signed-off-by: Mark Salyzyn <msalyzyn@us.xyratex.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/scsi/libsas/sas_expander.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c
index fbf0a09..46acf74 100644
--- a/drivers/scsi/libsas/sas_expander.c
+++ b/drivers/scsi/libsas/sas_expander.c
@@ -1713,7 +1713,7 @@ static int sas_find_bcast_dev(struct domain_device *dev,
list_for_each_entry(ch, &ex->children, siblings) {
if (ch->dev_type == EDGE_DEV || ch->dev_type == FANOUT_DEV) {
res = sas_find_bcast_dev(ch, src_dev);
- if (src_dev)
+ if (*src_dev)
return res;
}
}
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 057/165] cfg80211: Fix validation of AKM suites
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (55 preceding siblings ...)
2012-08-15 19:46 ` [v2.6.34-stable 056/165] libsas: fix failure to revalidate domain for anything but the first expander child Paul Gortmaker
@ 2012-08-15 19:46 ` Paul Gortmaker
2012-08-15 19:46 ` [v2.6.34-stable 058/165] libsas: fix panic when single phy is disabled on a wide port Paul Gortmaker
` (107 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:46 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Jouni Malinen, John W. Linville, Paul Gortmaker
From: Jouni Malinen <jouni@qca.qualcomm.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 1b9ca0272ffae212e726380f66777b30a56ed7a5 upstream.
Incorrect variable was used in validating the akm_suites array from
NL80211_ATTR_AKM_SUITES. In addition, there was no explicit
validation of the array length (we only have room for
NL80211_MAX_NR_AKM_SUITES).
This can result in a buffer write overflow for stack variables with
arbitrary data from user space. The nl80211 commands using the affected
functionality require GENL_ADMIN_PERM, so this is only exposed to admin
users.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
net/wireless/nl80211.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 56bc9b9..fde82a8 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -3537,9 +3537,12 @@ static int nl80211_crypto_settings(struct genl_info *info,
if (len % sizeof(u32))
return -EINVAL;
+ if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
+ return -EINVAL;
+
memcpy(settings->akm_suites, data, len);
- for (i = 0; i < settings->n_ciphers_pairwise; i++)
+ for (i = 0; i < settings->n_akm_suites; i++)
if (!nl80211_valid_akm_suite(settings->akm_suites[i]))
return -EINVAL;
}
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 058/165] libsas: fix panic when single phy is disabled on a wide port
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (56 preceding siblings ...)
2012-08-15 19:46 ` [v2.6.34-stable 057/165] cfg80211: Fix validation of AKM suites Paul Gortmaker
@ 2012-08-15 19:46 ` Paul Gortmaker
2012-08-15 19:46 ` [v2.6.34-stable 059/165] ahci: Enable SB600 64bit DMA on Asus M3A Paul Gortmaker
` (106 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:46 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Mark Salyzyn, James Bottomley, Paul Gortmaker
From: Mark Salyzyn <mark_salyzyn@us.xyratex.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit a73914c35b05d80f8ce78288e10056c91090b666 upstream.
When a wide port is being utilized to a target, if one disables only one
of the
phys, we get an OS crash:
BUG: unable to handle kernel NULL pointer dereference at
0000000000000238
IP: [<ffffffff814ca9b1>] mutex_lock+0x21/0x50
PGD 4103f5067 PUD 41dba9067 PMD 0
Oops: 0002 [#1] SMP
last sysfs file: /sys/bus/pci/slots/5/address
CPU 0
Modules linked in: pm8001(U) ses enclosure fuse nfsd exportfs autofs4
ipmi_devintf ipmi_si ipmi_msghandler nfs lockd fscache nfs_acl
auth_rpcgss 8021q fcoe libfcoe garp libfc scsi_transport_fc stp scsi_tgt
llc sunrpc cpufreq_ondemand acpi_cpufreq freq_table ipv6 sr_mod cdrom
dm_mirror dm_region_hash dm_log uinput sg i2c_i801 i2c_core iTCO_wdt
iTCO_vendor_support e1000e mlx4_ib ib_mad ib_core mlx4_en mlx4_core ext3
jbd mbcache sd_mod crc_t10dif usb_storage ata_generic pata_acpi ata_piix
libsas(U) scsi_transport_sas dm_mod [last unloaded: pm8001]
Modules linked in: pm8001(U) ses enclosure fuse nfsd exportfs autofs4
ipmi_devintf ipmi_si ipmi_msghandler nfs lockd fscache nfs_acl
auth_rpcgss 8021q fcoe libfcoe garp libfc scsi_transport_fc stp scsi_tgt
llc sunrpc cpufreq_ondemand acpi_cpufreq freq_table ipv6 sr_mod cdrom
dm_mirror dm_region_hash dm_log uinput sg i2c_i801 i2c_core iTCO_wdt
iTCO_vendor_support e1000e mlx4_ib ib_mad ib_core mlx4_en mlx4_core ext3
jbd mbcache sd_mod crc_t10dif usb_storage ata_generic pata_acpi ata_piix
libsas(U) scsi_transport_sas dm_mod [last unloaded: pm8001]
Pid: 5146, comm: scsi_wq_5 Not tainted
2.6.32-71.29.1.el6.lustre.7.x86_64 #1 Storage Server
RIP: 0010:[<ffffffff814ca9b1>] [<ffffffff814ca9b1>]
mutex_lock+0x21/0x50
RSP: 0018:ffff8803e4e33d30 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000238 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffff8803e664c800 RDI: 0000000000000238
RBP: ffff8803e4e33d40 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000
R13: 0000000000000238 R14: ffff88041acb7200 R15: ffff88041c51ada0
FS: 0000000000000000(0000) GS:ffff880028200000(0000)
knlGS:0000000000000000
CS: 0010 DS: 0018 ES: 0018 CR0: 000000008005003b
CR2: 0000000000000238 CR3: 0000000410143000 CR4: 00000000000006f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process scsi_wq_5 (pid: 5146, threadinfo ffff8803e4e32000, task
ffff8803e4e294a0)
Stack:
ffff8803e664c800 0000000000000000 ffff8803e4e33d70 ffffffffa001f06e
<0> ffff8803e4e33d60 ffff88041c51ada0 ffff88041acb7200 ffff88041bc0aa00
<0> ffff8803e4e33d90 ffffffffa0032b6c 0000000000000014 ffff88041acb7200
Call Trace:
[<ffffffffa001f06e>] sas_port_delete_phy+0x2e/0xa0 [scsi_transport_sas]
[<ffffffffa0032b6c>] sas_unregister_devs_sas_addr+0xac/0xe0 [libsas]
[<ffffffffa0034914>] sas_ex_revalidate_domain+0x204/0x330 [libsas]
[<ffffffffa00307f0>] ? sas_revalidate_domain+0x0/0x90 [libsas]
[<ffffffffa0030855>] sas_revalidate_domain+0x65/0x90 [libsas]
[<ffffffff8108c7d0>] worker_thread+0x170/0x2a0
[<ffffffff81091ea0>] ? autoremove_wake_function+0x0/0x40
[<ffffffff8108c660>] ? worker_thread+0x0/0x2a0
[<ffffffff81091b36>] kthread+0x96/0xa0
[<ffffffff810141ca>] child_rip+0xa/0x20
[<ffffffff81091aa0>] ? kthread+0x0/0xa0
[<ffffffff810141c0>] ? child_rip+0x0/0x20
Code: ff ff 85 c0 75 ed eb d6 66 90 55 48 89 e5 48 83 ec 10 48 89 1c 24
4c 89 64 24 08 0f 1f 44 00 00 48 89 fb e8 92 f4 ff ff 48 89 df <f0> ff
0f 79 05 e8 25 00 00 00 65 48 8b 04 25 08 cc 00 00 48 2d
RIP [<ffffffff814ca9b1>] mutex_lock+0x21/0x50
RSP <ffff8803e4e33d30>
CR2: 0000000000000238
The following patch is admittedly a band-aid, and does not solve the
root cause, but it still is a good candidate for hardening as a pointer
check before reference.
Signed-off-by: Mark Salyzyn <mark_salyzyn@us.xyratex.com>
Tested-by: Jack Wang <jack_wang@usish.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/scsi/libsas/sas_expander.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c
index 46acf74..7107bbc 100644
--- a/drivers/scsi/libsas/sas_expander.c
+++ b/drivers/scsi/libsas/sas_expander.c
@@ -1758,10 +1758,12 @@ static void sas_unregister_devs_sas_addr(struct domain_device *parent,
sas_disable_routing(parent, phy->attached_sas_addr);
}
memset(phy->attached_sas_addr, 0, SAS_ADDR_SIZE);
- sas_port_delete_phy(phy->port, phy->phy);
- if (phy->port->num_phys == 0)
- sas_port_delete(phy->port);
- phy->port = NULL;
+ if (phy->port) {
+ sas_port_delete_phy(phy->port, phy->phy);
+ if (phy->port->num_phys == 0)
+ sas_port_delete(phy->port);
+ phy->port = NULL;
+ }
}
static int sas_discover_bfs_by_root_level(struct domain_device *root,
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 059/165] ahci: Enable SB600 64bit DMA on Asus M3A
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (57 preceding siblings ...)
2012-08-15 19:46 ` [v2.6.34-stable 058/165] libsas: fix panic when single phy is disabled on a wide port Paul Gortmaker
@ 2012-08-15 19:46 ` Paul Gortmaker
2012-08-15 19:46 ` [v2.6.34-stable 060/165] HID: usbhid: Add support for SiGma Micro chip Paul Gortmaker
` (105 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:46 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Mark Nelson, Jeff Garzik, Paul Gortmaker
From: Mark Nelson <mdnelson8@gmail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 3c4aa91f21f65b7b40bdfb015eacbcb8453ccae2 upstream.
Like e65cc194f7628ecaa02462f22f42fb09b50dcd49 this patch enables 64bit DMA
for the AHCI SATA controller of a board that has the SB600 southbridge. In
this case though we're enabling 64bit DMA for the Asus M3A motherboard. It
is a new enough board that all of the BIOS releases since the initial
release (0301 from 2007-10-22) work correctly with 64bit DMA enabled.
Signed-off-by: Mark Nelson <mdnelson8@gmail.com>
Signed-off-by: Jeff Garzik <jgarzik@pobox.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/ata/ahci.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 9215998..a5b1fd9 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -2981,6 +2981,18 @@ static bool ahci_sb600_enable_64bit(struct pci_dev *pdev)
DMI_MATCH(DMI_BOARD_NAME, "MS-7376"),
},
},
+ /*
+ * All BIOS versions for the Asus M3A support 64bit DMA.
+ * (all release versions from 0301 to 1206 were tested)
+ */
+ {
+ .ident = "ASUS M3A",
+ .matches = {
+ DMI_MATCH(DMI_BOARD_VENDOR,
+ "ASUSTeK Computer INC."),
+ DMI_MATCH(DMI_BOARD_NAME, "M3A"),
+ },
+ },
{ }
};
const struct dmi_system_id *match;
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 060/165] HID: usbhid: Add support for SiGma Micro chip
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (58 preceding siblings ...)
2012-08-15 19:46 ` [v2.6.34-stable 059/165] ahci: Enable SB600 64bit DMA on Asus M3A Paul Gortmaker
@ 2012-08-15 19:46 ` Paul Gortmaker
2012-08-15 19:46 ` [v2.6.34-stable 061/165] hwmon: (w83627ehf) Properly report thermal diode sensors Paul Gortmaker
` (104 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:46 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Jeremiah Matthey, Jiri Kosina, Paul Gortmaker
From: Jeremiah Matthey <sprg86@gmail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit f5e4282586dc0c9dab8c7d32e6c43aa07f68586b upstream.
Patch to add SiGma Micro-based keyboards (1c4f:0002) to hid-quirks.
These keyboards dont seem to allow the records to be initialized, and hence a
timeout occurs when the usbhid driver attempts to initialize them. The patch
just adds the signature for these keyboards to the hid-quirks list with the
setting HID_QUIRK_NO_INIT_REPORTS. This removes the 5-10 second wait for the
timeout to occur.
Signed-off-by: Jeremiah Matthey <sprg86@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/hid/hid-ids.h | 3 +++
drivers/hid/usbhid/hid-quirks.c | 1 +
2 files changed, 4 insertions(+)
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index fe054d6..459b457 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -417,6 +417,9 @@
#define USB_VENDOR_ID_SAMSUNG 0x0419
#define USB_DEVICE_ID_SAMSUNG_IR_REMOTE 0x0001
+#define USB_VENDOR_ID_SIGMA_MICRO 0x1c4f
+#define USB_DEVICE_ID_SIGMA_MICRO_KEYBOARD 0x0002
+
#define USB_VENDOR_ID_SONY 0x054c
#define USB_DEVICE_ID_SONY_VAIO_VGX_MOUSE 0x024b
#define USB_DEVICE_ID_SONY_PS3_CONTROLLER 0x0268
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index 1152f9b..894c1a2 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -71,6 +71,7 @@ static const struct hid_blacklist {
{ USB_VENDOR_ID_WISEGROUP_LTD, USB_DEVICE_ID_SMARTJOY_DUAL_PLUS, HID_QUIRK_NOGET | HID_QUIRK_MULTI_INPUT },
{ USB_VENDOR_ID_WISEGROUP_LTD2, USB_DEVICE_ID_SMARTJOY_DUAL_PLUS, HID_QUIRK_NOGET | HID_QUIRK_MULTI_INPUT },
+ { USB_VENDOR_ID_SIGMA_MICRO, USB_DEVICE_ID_SIGMA_MICRO_KEYBOARD, HID_QUIRK_NO_INIT_REPORTS },
{ 0, 0 }
};
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 061/165] hwmon: (w83627ehf) Properly report thermal diode sensors
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (59 preceding siblings ...)
2012-08-15 19:46 ` [v2.6.34-stable 060/165] HID: usbhid: Add support for SiGma Micro chip Paul Gortmaker
@ 2012-08-15 19:46 ` Paul Gortmaker
2012-08-15 19:46 ` [v2.6.34-stable 062/165] x25: Prevent skb overreads when checking call user data Paul Gortmaker
` (103 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:46 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Jean Delvare, Guenter Roeck, Paul Gortmaker
From: Jean Delvare <khali@linux-fr.org>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit bf164c58e58328c40ebc597a8ac00cc6840f9703 upstream.
The w83627ehf driver is improperly reporting thermal diode sensors as
type 2, instead of 3. This caused "sensors" and possibly other
monitoring tools to report these sensors as "transistor" instead of
"thermal diode".
Furthermore, diode subtype selection (CPU vs. external) is only
supported by the original W83627EHF/EHG. All later models only support
CPU diode type, and some (NCT6776F) don't even have the register in
question so we should avoid reading from it.
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Guenter Roeck <guenter.roeck@ericsson.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/hwmon/w83627ehf.c | 15 +++++++++++----
1 file changed, 11 insertions(+), 4 deletions(-)
diff --git a/drivers/hwmon/w83627ehf.c b/drivers/hwmon/w83627ehf.c
index dc53e61..4473207 100644
--- a/drivers/hwmon/w83627ehf.c
+++ b/drivers/hwmon/w83627ehf.c
@@ -1284,7 +1284,8 @@ static void w83627ehf_device_remove_files(struct device *dev)
}
/* Get the monitoring functions started */
-static inline void __devinit w83627ehf_init_device(struct w83627ehf_data *data)
+static inline void __devinit w83627ehf_init_device(struct w83627ehf_data *data,
+ enum kinds kind)
{
int i;
u8 tmp, diode;
@@ -1313,10 +1314,16 @@ static inline void __devinit w83627ehf_init_device(struct w83627ehf_data *data)
w83627ehf_write_value(data, W83627EHF_REG_VBAT, tmp | 0x01);
/* Get thermal sensor types */
- diode = w83627ehf_read_value(data, W83627EHF_REG_DIODE);
+ switch (kind) {
+ case w83627ehf:
+ diode = w83627ehf_read_value(data, W83627EHF_REG_DIODE);
+ break;
+ default:
+ diode = 0x70;
+ }
for (i = 0; i < 3; i++) {
if ((tmp & (0x02 << i)))
- data->temp_type[i] = (diode & (0x10 << i)) ? 1 : 2;
+ data->temp_type[i] = (diode & (0x10 << i)) ? 1 : 3;
else
data->temp_type[i] = 4; /* thermistor */
}
@@ -1364,7 +1371,7 @@ static int __devinit w83627ehf_probe(struct platform_device *pdev)
}
/* Initialize the chip */
- w83627ehf_init_device(data);
+ w83627ehf_init_device(data, sio_data->kind);
data->vrm = vid_which_vrm();
superio_enter(sio_data->sioreg);
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 062/165] x25: Prevent skb overreads when checking call user data
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (60 preceding siblings ...)
2012-08-15 19:46 ` [v2.6.34-stable 061/165] hwmon: (w83627ehf) Properly report thermal diode sensors Paul Gortmaker
@ 2012-08-15 19:46 ` Paul Gortmaker
2012-08-15 19:46 ` [v2.6.34-stable 063/165] staging: quatech_usb2: Potential lost wakeup scenario in TIOCMIWAIT Paul Gortmaker
` (102 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:46 UTC (permalink / raw)
To: stable, linux-kernel
Cc: Matthew Daley, Eric Dumazet, Andrew Hendry, David S. Miller,
Paul Gortmaker
From: Matthew Daley <mattjd@gmail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 7f81e25befdfb3272345a2e775f520e1d515fa20 upstream.
x25_find_listener does not check that the amount of call user data given
in the skb is big enough in per-socket comparisons, hence buffer
overreads may occur. Fix this by adding a check.
Signed-off-by: Matthew Daley <mattjd@gmail.com>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Andrew Hendry <andrew.hendry@gmail.com>
Acked-by: Andrew Hendry <andrew.hendry@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
net/x25/af_x25.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index 36e84e1..3117b9e 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -296,7 +296,8 @@ static struct sock *x25_find_listener(struct x25_address *addr,
* Found a listening socket, now check the incoming
* call user data vs this sockets call user data
*/
- if(skb->len > 0 && x25_sk(s)->cudmatchlength > 0) {
+ if (x25_sk(s)->cudmatchlength > 0 &&
+ skb->len >= x25_sk(s)->cudmatchlength) {
if((memcmp(x25_sk(s)->calluserdata.cuddata,
skb->data,
x25_sk(s)->cudmatchlength)) == 0) {
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 063/165] staging: quatech_usb2: Potential lost wakeup scenario in TIOCMIWAIT
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (61 preceding siblings ...)
2012-08-15 19:46 ` [v2.6.34-stable 062/165] x25: Prevent skb overreads when checking call user data Paul Gortmaker
@ 2012-08-15 19:46 ` Paul Gortmaker
2012-08-15 19:46 ` [v2.6.34-stable 064/165] USB: qcserial: add device ID for "HP un2430 Mobile Broadband Module" Paul Gortmaker
` (101 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:46 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Kautuk Consul, Greg Kroah-Hartman, Paul Gortmaker
From: Kautuk Consul <consul.kautuk@gmail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit e8df1674d383d2ecc6efa8d7dba74c03aafdfdd7 upstream.
If the usermode app does an ioctl over this serial device by
using TIOCMIWAIT, then the code will wait by setting the current
task state to TASK_INTERRUPTIBLE and then calling schedule().
This will be woken up by the qt2_process_modem_status on URB
completion when the port_extra->shadowMSR is set to the new
modem status.
However, this could result in a lost wakeup scenario due to a race
in the logic in the qt2_ioctl(TIOCMIWAIT) loop and the URB completion
for new modem status in qt2_process_modem_status.
Due to this, the usermode app's task will continue to sleep despite a
change in the modem status.
Signed-off-by: Kautuk Consul <consul.kautuk@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/staging/quatech_usb2/quatech_usb2.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/drivers/staging/quatech_usb2/quatech_usb2.c b/drivers/staging/quatech_usb2/quatech_usb2.c
index 1561f74..3ca3c2a 100644
--- a/drivers/staging/quatech_usb2/quatech_usb2.c
+++ b/drivers/staging/quatech_usb2/quatech_usb2.c
@@ -921,9 +921,10 @@ static int qt2_ioctl(struct tty_struct *tty, struct file *file,
dbg("%s() port %d, cmd == TIOCMIWAIT enter",
__func__, port->number);
prev_msr_value = port_extra->shadowMSR & QT2_SERIAL_MSR_MASK;
+ barrier();
+ __set_current_state(TASK_INTERRUPTIBLE);
while (1) {
add_wait_queue(&port_extra->wait, &wait);
- set_current_state(TASK_INTERRUPTIBLE);
schedule();
dbg("%s(): port %d, cmd == TIOCMIWAIT here\n",
__func__, port->number);
@@ -931,9 +932,12 @@ static int qt2_ioctl(struct tty_struct *tty, struct file *file,
/* see if a signal woke us up */
if (signal_pending(current))
return -ERESTARTSYS;
+ set_current_state(TASK_INTERRUPTIBLE);
msr_value = port_extra->shadowMSR & QT2_SERIAL_MSR_MASK;
- if (msr_value == prev_msr_value)
+ if (msr_value == prev_msr_value) {
+ __set_current_state(TASK_RUNNING);
return -EIO; /* no change - error */
+ }
if ((arg & TIOCM_RNG &&
((prev_msr_value & QT2_SERIAL_MSR_RI) ==
(msr_value & QT2_SERIAL_MSR_RI))) ||
@@ -946,6 +950,7 @@ static int qt2_ioctl(struct tty_struct *tty, struct file *file,
(arg & TIOCM_CTS &&
((prev_msr_value & QT2_SERIAL_MSR_CTS) ==
(msr_value & QT2_SERIAL_MSR_CTS)))) {
+ __set_current_state(TASK_RUNNING);
return 0;
}
} /* end inifinite while */
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 064/165] USB: qcserial: add device ID for "HP un2430 Mobile Broadband Module"
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (62 preceding siblings ...)
2012-08-15 19:46 ` [v2.6.34-stable 063/165] staging: quatech_usb2: Potential lost wakeup scenario in TIOCMIWAIT Paul Gortmaker
@ 2012-08-15 19:46 ` Paul Gortmaker
2012-08-15 19:46 ` [v2.6.34-stable 065/165] xhci-mem.c: Check for ring->first_seg != NULL Paul Gortmaker
` (100 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:46 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Rigbert Hamisch, Greg Kroah-Hartman, Paul Gortmaker
From: Rigbert Hamisch <rigbert@gmx.de>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 1bfac90d1b8e63a4d44158c3445d8fda3fb6d5eb upstream.
add device ID for "HP un2430 Mobile Broadband Module"
Signed-off-by: Rigbert Hamisch <rigbert@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/usb/serial/qcserial.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
index 225fc88..7facae0 100644
--- a/drivers/usb/serial/qcserial.c
+++ b/drivers/usb/serial/qcserial.c
@@ -26,6 +26,7 @@ static const struct usb_device_id id_table[] = {
{USB_DEVICE(0x05c6, 0x9212)}, /* Acer Gobi Modem Device */
{USB_DEVICE(0x03f0, 0x1f1d)}, /* HP un2400 Gobi Modem Device */
{USB_DEVICE(0x03f0, 0x201d)}, /* HP un2400 Gobi QDL Device */
+ {USB_DEVICE(0x03f0, 0x371d)}, /* HP un2430 Mobile Broadband Module */
{USB_DEVICE(0x04da, 0x250d)}, /* Panasonic Gobi Modem device */
{USB_DEVICE(0x04da, 0x250c)}, /* Panasonic Gobi QDL device */
{USB_DEVICE(0x413c, 0x8172)}, /* Dell Gobi Modem device */
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 065/165] xhci-mem.c: Check for ring->first_seg != NULL
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (63 preceding siblings ...)
2012-08-15 19:46 ` [v2.6.34-stable 064/165] USB: qcserial: add device ID for "HP un2430 Mobile Broadband Module" Paul Gortmaker
@ 2012-08-15 19:46 ` Paul Gortmaker
2012-08-15 19:46 ` [v2.6.34-stable 066/165] ipr: Always initiate hard reset in kdump kernel Paul Gortmaker
` (99 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:46 UTC (permalink / raw)
To: stable, linux-kernel
Cc: Kautuk Consul, Sarah Sharp, Greg Kroah-Hartman, Paul Gortmaker
From: Kautuk Consul <consul.kautuk@gmail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 0e6c7f746ea99089fb3263709075c20485a479ae upstream.
There are 2 situations wherein the xhci_ring* might not get freed:
- When xhci_ring_alloc() -> xhci_segment_alloc() returns NULL and
we goto the fail: label in xhci_ring_alloc. In this case, the ring
will not get kfreed.
- When the num_segs argument to xhci_ring_alloc is passed as 0 and
we try to free the rung after that.
( This doesn't really happen as of now in the code but we seem to
be entertaining num_segs=0 in xhci_ring_alloc )
This should be backported to kernels as old as 2.6.31.
Signed-off-by: Kautuk Consul <consul.kautuk@gmail.com>
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/usb/host/xhci-mem.c | 22 ++++++++++++----------
1 file changed, 12 insertions(+), 10 deletions(-)
diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index 727ac40..31cf540 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -111,18 +111,20 @@ void xhci_ring_free(struct xhci_hcd *xhci, struct xhci_ring *ring)
struct xhci_segment *seg;
struct xhci_segment *first_seg;
- if (!ring || !ring->first_seg)
+ if (!ring)
return;
- first_seg = ring->first_seg;
- seg = first_seg->next;
- xhci_dbg(xhci, "Freeing ring at %p\n", ring);
- while (seg != first_seg) {
- struct xhci_segment *next = seg->next;
- xhci_segment_free(xhci, seg);
- seg = next;
+ if (ring->first_seg) {
+ first_seg = ring->first_seg;
+ seg = first_seg->next;
+ xhci_dbg(xhci, "Freeing ring at %p\n", ring);
+ while (seg != first_seg) {
+ struct xhci_segment *next = seg->next;
+ xhci_segment_free(xhci, seg);
+ seg = next;
+ }
+ xhci_segment_free(xhci, first_seg);
+ ring->first_seg = NULL;
}
- xhci_segment_free(xhci, first_seg);
- ring->first_seg = NULL;
kfree(ring);
}
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 066/165] ipr: Always initiate hard reset in kdump kernel
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (64 preceding siblings ...)
2012-08-15 19:46 ` [v2.6.34-stable 065/165] xhci-mem.c: Check for ring->first_seg != NULL Paul Gortmaker
@ 2012-08-15 19:46 ` Paul Gortmaker
2012-08-15 19:46 ` [v2.6.34-stable 067/165] libsas: set sas_address and device type of rphy Paul Gortmaker
` (98 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:46 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Anton Blanchard, James Bottomley, Paul Gortmaker
From: Anton Blanchard <anton@samba.org>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 5d7c20b7fa5c6ca19e871b4050e321c99d32bd43 upstream.
During kdump testing I noticed timeouts when initialising each IPR
adapter. While the driver has logic to detect an adapter in an
indeterminate state, it wasn't triggering and each adapter went
through a 5 minute timeout before finally going operational.
Some analysis showed the needs_hard_reset flag wasn't getting set.
We can check the reset_devices kernel parameter which is set by
kdump and force a full reset. This fixes the problem.
Signed-off-by: Anton Blanchard <anton@samba.org>
Acked-by: Brian King <brking@linux.vnet.ibm.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/scsi/ipr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
index 520461b..771eb42 100644
--- a/drivers/scsi/ipr.c
+++ b/drivers/scsi/ipr.c
@@ -8543,7 +8543,7 @@ static int __devinit ipr_probe_ioa(struct pci_dev *pdev,
uproc = readl(ioa_cfg->regs.sense_uproc_interrupt_reg32);
if ((mask & IPR_PCII_HRRQ_UPDATED) == 0 || (uproc & IPR_UPROCI_RESET_ALERT))
ioa_cfg->needs_hard_reset = 1;
- if (interrupts & IPR_PCII_ERROR_INTERRUPTS)
+ if ((interrupts & IPR_PCII_ERROR_INTERRUPTS) || reset_devices)
ioa_cfg->needs_hard_reset = 1;
if (interrupts & IPR_PCII_IOA_UNIT_CHECKED)
ioa_cfg->ioa_unit_checked = 1;
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 067/165] libsas: set sas_address and device type of rphy
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (65 preceding siblings ...)
2012-08-15 19:46 ` [v2.6.34-stable 066/165] ipr: Always initiate hard reset in kdump kernel Paul Gortmaker
@ 2012-08-15 19:46 ` Paul Gortmaker
2012-08-15 19:46 ` [v2.6.34-stable 068/165] ALSA: HDA: Add new revision for ALC662 Paul Gortmaker
` (97 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:46 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Jack Wang, James Bottomley, Paul Gortmaker
From: Jack Wang <jack_wang@usish.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit bb041a0e9c31229071b6e56e1d0d8374af0d2038 upstream.
Libsas forget to set the sas_address and device type of rphy lead to file
under /sys/class/sas_x show wrong value, fix that.
Signed-off-by: Jack Wang <jack_wang@usish.com>
Tested-by: Crystal Yu <crystal_yu@usish.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/scsi/libsas/sas_expander.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c
index 7107bbc..4ee42bb 100644
--- a/drivers/scsi/libsas/sas_expander.c
+++ b/drivers/scsi/libsas/sas_expander.c
@@ -199,6 +199,8 @@ static void sas_set_ex_phy(struct domain_device *dev, int phy_id,
phy->virtual = dr->virtual;
phy->last_da_index = -1;
+ phy->phy->identify.sas_address = SAS_ADDR(phy->attached_sas_addr);
+ phy->phy->identify.device_type = phy->attached_dev_type;
phy->phy->identify.initiator_port_protocols = phy->attached_iproto;
phy->phy->identify.target_port_protocols = phy->attached_tproto;
phy->phy->identify.phy_identifier = phy_id;
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 068/165] ALSA: HDA: Add new revision for ALC662
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (66 preceding siblings ...)
2012-08-15 19:46 ` [v2.6.34-stable 067/165] libsas: set sas_address and device type of rphy Paul Gortmaker
@ 2012-08-15 19:46 ` Paul Gortmaker
2012-08-15 19:46 ` [v2.6.34-stable 069/165] x86: Fix compilation bug in kprobes' twobyte_is_boostable Paul Gortmaker
` (96 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:46 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: David Henningsson, Takashi Iwai, Paul Gortmaker
From: David Henningsson <david.henningsson@canonical.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit cc667a72d471e79fd8e5e291ea115923cf44dca0 upstream.
The revision 0x100300 was found for ALC662. It seems to work well
with patch_alc662.
BugLink: http://bugs.launchpad.net/bugs/877373
Tested-by: Shengyao Xue <Shengyao.xue@canonical.com>
Signed-off-by: David Henningsson <david.henningsson@canonical.com>
Acked-by: Kailang Yang <kailang@realtek.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
sound/pci/hda/patch_realtek.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 2c71de1..94f1a80 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -18657,6 +18657,8 @@ static struct hda_codec_preset snd_hda_preset_realtek[] = {
.patch = patch_alc882 },
{ .id = 0x10ec0662, .rev = 0x100101, .name = "ALC662 rev1",
.patch = patch_alc662 },
+ { .id = 0x10ec0662, .rev = 0x100300, .name = "ALC662 rev3",
+ .patch = patch_alc662 },
{ .id = 0x10ec0663, .name = "ALC663", .patch = patch_alc662 },
{ .id = 0x10ec0665, .name = "ALC665", .patch = patch_alc662 },
{ .id = 0x10ec0670, .name = "ALC670", .patch = patch_alc662 },
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 069/165] x86: Fix compilation bug in kprobes' twobyte_is_boostable
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (67 preceding siblings ...)
2012-08-15 19:46 ` [v2.6.34-stable 068/165] ALSA: HDA: Add new revision for ALC662 Paul Gortmaker
@ 2012-08-15 19:46 ` Paul Gortmaker
2012-08-15 19:46 ` [v2.6.34-stable 070/165] epoll: fix spurious lockdep warnings Paul Gortmaker
` (95 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:46 UTC (permalink / raw)
To: stable, linux-kernel
Cc: Josh Stone, Masami Hiramatsu, Jakub Jelinek, Linus Torvalds,
Paul Gortmaker
From: Josh Stone <jistone@redhat.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 315eb8a2a1b7f335d40ceeeb11b9e067475eb881 upstream.
When compiling an i386_defconfig kernel with gcc-4.6.1-9.fc15.i686, I
noticed a warning about the asm operand for test_bit in kprobes'
can_boost. I discovered that this caused only the first long of
twobyte_is_boostable[] to be output.
Jakub filed and fixed gcc PR50571 to correct the warning and this output
issue. But to solve it for less current gcc, we can make kprobes'
twobyte_is_boostable[] non-const, and it won't be optimized out.
Before:
CC arch/x86/kernel/kprobes.o
In file included from include/linux/bitops.h:22:0,
from include/linux/kernel.h:17,
from [...]/arch/x86/include/asm/percpu.h:44,
from [...]/arch/x86/include/asm/current.h:5,
from [...]/arch/x86/include/asm/processor.h:15,
from [...]/arch/x86/include/asm/atomic.h:6,
from include/linux/atomic.h:4,
from include/linux/mutex.h:18,
from include/linux/notifier.h:13,
from include/linux/kprobes.h:34,
from arch/x86/kernel/kprobes.c:43:
[...]/arch/x86/include/asm/bitops.h: In function ‘can_boost.part.1’:
[...]/arch/x86/include/asm/bitops.h:319:2: warning: use of memory input
without lvalue in asm operand 1 is deprecated [enabled by default]
$ objdump -rd arch/x86/kernel/kprobes.o | grep -A1 -w bt
551: 0f a3 05 00 00 00 00 bt %eax,0x0
554: R_386_32 .rodata.cst4
$ objdump -s -j .rodata.cst4 -j .data arch/x86/kernel/kprobes.o
arch/x86/kernel/kprobes.o: file format elf32-i386
Contents of section .data:
0000 48000000 00000000 00000000 00000000 H...............
Contents of section .rodata.cst4:
0000 4c030000 L...
Only a single long of twobyte_is_boostable[] is in the object file.
After, without the const on twobyte_is_boostable:
$ objdump -rd arch/x86/kernel/kprobes.o | grep -A1 -w bt
551: 0f a3 05 20 00 00 00 bt %eax,0x20
554: R_386_32 .data
$ objdump -s -j .rodata.cst4 -j .data arch/x86/kernel/kprobes.o
arch/x86/kernel/kprobes.o: file format elf32-i386
Contents of section .data:
0000 48000000 00000000 00000000 00000000 H...............
0010 00000000 00000000 00000000 00000000 ................
0020 4c030000 0f000200 ffff0000 ffcff0c0 L...............
0030 0000ffff 3bbbfff8 03ff2ebb 26bb2e77 ....;.......&..w
Now all 32 bytes are output into .data instead.
Signed-off-by: Josh Stone <jistone@redhat.com>
Cc: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
Cc: Jakub Jelinek <jakub@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/x86/kernel/kprobes.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/arch/x86/kernel/kprobes.c b/arch/x86/kernel/kprobes.c
index ac4ed92..9619315 100644
--- a/arch/x86/kernel/kprobes.c
+++ b/arch/x86/kernel/kprobes.c
@@ -75,8 +75,10 @@ DEFINE_PER_CPU(struct kprobe_ctlblk, kprobe_ctlblk);
/*
* Undefined/reserved opcodes, conditional jump, Opcode Extension
* Groups, and some special opcodes can not boost.
+ * This is non-const to keep gcc from statically optimizing it out, as
+ * variable_test_bit makes gcc think only *(unsigned long*) is used.
*/
-static const u32 twobyte_is_boostable[256 / 32] = {
+static u32 twobyte_is_boostable[256 / 32] = {
/* 0 1 2 3 4 5 6 7 8 9 a b c d e f */
/* ---------------------------------------------- */
W(0x00, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0, 0, 0, 0, 0, 0) | /* 00 */
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 070/165] epoll: fix spurious lockdep warnings
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (68 preceding siblings ...)
2012-08-15 19:46 ` [v2.6.34-stable 069/165] x86: Fix compilation bug in kprobes' twobyte_is_boostable Paul Gortmaker
@ 2012-08-15 19:46 ` Paul Gortmaker
2012-08-15 19:46 ` [v2.6.34-stable 071/165] usbmon vs. tcpdump: fix dropped packet count Paul Gortmaker
` (94 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:46 UTC (permalink / raw)
To: stable, linux-kernel
Cc: Nelson Elhage, Dave Jones, Davide Libenzi, Andrew Morton,
Linus Torvalds, Paul Gortmaker
From: Nelson Elhage <nelhage@nelhage.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit d8805e633e054c816c47cb6e727c81f156d9253d upstream.
epoll can acquire recursively acquire ep->mtx on multiple "struct
eventpoll"s at once in the case where one epoll fd is monitoring another
epoll fd. This is perfectly OK, since we're careful about the lock
ordering, but it causes spurious lockdep warnings. Annotate the recursion
using mutex_lock_nested, and add a comment explaining the nesting rules
for good measure.
Recent versions of systemd are triggering this, and it can also be
demonstrated with the following trivial test program:
--------------------8<--------------------
int main(void) {
int e1, e2;
struct epoll_event evt = {
.events = EPOLLIN
};
e1 = epoll_create1(0);
e2 = epoll_create1(0);
epoll_ctl(e1, EPOLL_CTL_ADD, e2, &evt);
return 0;
}
--------------------8<--------------------
Reported-by: Paul Bolle <pebolle@tiscali.nl>
Tested-by: Paul Bolle <pebolle@tiscali.nl>
Signed-off-by: Nelson Elhage <nelhage@nelhage.com>
Acked-by: Jason Baron <jbaron@redhat.com>
Cc: Dave Jones <davej@redhat.com>
Cc: Davide Libenzi <davidel@xmailserver.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/eventpoll.c | 25 ++++++++++++++++++-------
1 file changed, 18 insertions(+), 7 deletions(-)
diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index 85c5a9f..34ca5ca 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -70,6 +70,15 @@
* simultaneous inserts (A into B and B into A) from racing and
* constructing a cycle without either insert observing that it is
* going to.
+ * It is necessary to acquire multiple "ep->mtx"es at once in the
+ * case when one epoll fd is added to another. In this case, we
+ * always acquire the locks in the order of nesting (i.e. after
+ * epoll_ctl(e1, EPOLL_CTL_ADD, e2), e1->mtx will always be acquired
+ * before e2->mtx). Since we disallow cycles of epoll file
+ * descriptors, this ensures that the mutexes are well-ordered. In
+ * order to communicate this nesting to lockdep, when walking a tree
+ * of epoll file descriptors, we use the current recursion depth as
+ * the lockdep subkey.
* It is possible to drop the "ep->mtx" and to use the global
* mutex "epmutex" (together with "ep->lock") to have it working,
* but having "ep->mtx" will make the interface more scalable.
@@ -454,13 +463,15 @@ static void ep_unregister_pollwait(struct eventpoll *ep, struct epitem *epi)
* @ep: Pointer to the epoll private data structure.
* @sproc: Pointer to the scan callback.
* @priv: Private opaque data passed to the @sproc callback.
+ * @depth: The current depth of recursive f_op->poll calls.
*
* Returns: The same integer error code returned by the @sproc callback.
*/
static int ep_scan_ready_list(struct eventpoll *ep,
int (*sproc)(struct eventpoll *,
struct list_head *, void *),
- void *priv)
+ void *priv,
+ int depth)
{
int error, pwake = 0;
unsigned long flags;
@@ -471,7 +482,7 @@ static int ep_scan_ready_list(struct eventpoll *ep,
* We need to lock this because we could be hit by
* eventpoll_release_file() and epoll_ctl().
*/
- mutex_lock(&ep->mtx);
+ mutex_lock_nested(&ep->mtx, depth);
/*
* Steal the ready list, and re-init the original one to the
@@ -660,7 +671,7 @@ static int ep_read_events_proc(struct eventpoll *ep, struct list_head *head,
static int ep_poll_readyevents_proc(void *priv, void *cookie, int call_nests)
{
- return ep_scan_ready_list(priv, ep_read_events_proc, NULL);
+ return ep_scan_ready_list(priv, ep_read_events_proc, NULL, call_nests + 1);
}
static unsigned int ep_eventpoll_poll(struct file *file, poll_table *wait)
@@ -726,7 +737,7 @@ void eventpoll_release_file(struct file *file)
ep = epi->ep;
list_del_init(&epi->fllink);
- mutex_lock(&ep->mtx);
+ mutex_lock_nested(&ep->mtx, 0);
ep_remove(ep, epi);
mutex_unlock(&ep->mtx);
}
@@ -1123,7 +1134,7 @@ static int ep_send_events(struct eventpoll *ep,
esed.maxevents = maxevents;
esed.events = events;
- return ep_scan_ready_list(ep, ep_send_events_proc, &esed);
+ return ep_scan_ready_list(ep, ep_send_events_proc, &esed, 0);
}
static int ep_poll(struct eventpoll *ep, struct epoll_event __user *events,
@@ -1218,7 +1229,7 @@ static int ep_loop_check_proc(void *priv, void *cookie, int call_nests)
struct rb_node *rbp;
struct epitem *epi;
- mutex_lock(&ep->mtx);
+ mutex_lock_nested(&ep->mtx, call_nests + 1);
for (rbp = rb_first(&ep->rbr); rbp; rbp = rb_next(rbp)) {
epi = rb_entry(rbp, struct epitem, rbn);
if (unlikely(is_file_epoll(epi->ffd.file))) {
@@ -1360,7 +1371,7 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
}
- mutex_lock(&ep->mtx);
+ mutex_lock_nested(&ep->mtx, 0);
/*
* Try to lookup the file inside our RB tree, Since we grabbed "mtx"
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 071/165] usbmon vs. tcpdump: fix dropped packet count
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (69 preceding siblings ...)
2012-08-15 19:46 ` [v2.6.34-stable 070/165] epoll: fix spurious lockdep warnings Paul Gortmaker
@ 2012-08-15 19:46 ` Paul Gortmaker
2012-08-15 19:46 ` [v2.6.34-stable 072/165] USB: storage: Use normalized sense when emulating autosense Paul Gortmaker
` (93 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:46 UTC (permalink / raw)
To: stable, linux-kernel
Cc: Johannes Stezenbach, Greg Kroah-Hartman, Paul Gortmaker
From: Johannes Stezenbach <js@sig21.net>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 236c448cb6e7f82096101e1ace4b77f8b38f82c8 upstream.
Report the number of dropped packets instead of zero
when using the binary usbmon interface with tcpdump.
# tcpdump -i usbmon1 -w dump
tcpdump: listening on usbmon1, link-type USB_LINUX_MMAPPED (USB with padded Linux header), capture size 65535 bytes
^C2155 packets captured
2155 packets received by filter
1019 packets dropped by kernel
Signed-off-by: Johannes Stezenbach <js@sig21.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/usb/mon/mon_bin.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/usb/mon/mon_bin.c b/drivers/usb/mon/mon_bin.c
index 6ee9d76..45f9705 100644
--- a/drivers/usb/mon/mon_bin.c
+++ b/drivers/usb/mon/mon_bin.c
@@ -1080,7 +1080,7 @@ static int mon_bin_ioctl(struct inode *inode, struct file *file,
nevents = mon_bin_queued(rp);
sp = (struct mon_bin_stats __user *)arg;
- if (put_user(rp->cnt_lost, &sp->dropped))
+ if (put_user(ndropped, &sp->dropped))
return -EFAULT;
if (put_user(nevents, &sp->queued))
return -EFAULT;
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 072/165] USB: storage: Use normalized sense when emulating autosense
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (70 preceding siblings ...)
2012-08-15 19:46 ` [v2.6.34-stable 071/165] usbmon vs. tcpdump: fix dropped packet count Paul Gortmaker
@ 2012-08-15 19:46 ` Paul Gortmaker
2012-08-15 19:46 ` [v2.6.34-stable 073/165] USB: pid_ns: ensure pid is not freed during kill_pid_info_as_uid Paul Gortmaker
` (92 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:46 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Luben Tuikov, Greg Kroah-Hartman, Paul Gortmaker
From: Luben Tuikov <ltuikov@yahoo.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit e16da02fcdf1c5e824432f88abf42623dafdf191 upstream.
This patch solves two things:
1) Enables autosense emulation code to correctly
interpret descriptor format sense data, and
2) Fixes a bug whereby the autosense emulation
code would overwrite descriptor format sense data
with SENSE KEY HARDWARE ERROR in fixed format, to
incorrectly look like this:
Oct 21 14:11:07 localhost kernel: sd 7:0:0:0: [sdc] Sense Key : Recovered Error [current] [descriptor]
Oct 21 14:11:07 localhost kernel: Descriptor sense data with sense descriptors (in hex):
Oct 21 14:11:07 localhost kernel: 72 01 04 1d 00 00 00 0e 09 0c 00 00 00 00 00 00
Oct 21 14:11:07 localhost kernel: 00 4f 00 c2 00 50
Oct 21 14:11:07 localhost kernel: sd 7:0:0:0: [sdc] ASC=0x4 ASCQ=0x1d
Signed-off-by: Luben Tuikov <ltuikov@yahoo.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Acked-by: Matthew Dharm <mdharm-usb@one-eyed-alien.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/usb/storage/transport.c | 34 +++++++++++++++++++---------------
1 file changed, 19 insertions(+), 15 deletions(-)
diff --git a/drivers/usb/storage/transport.c b/drivers/usb/storage/transport.c
index f253ede..0ea5426 100644
--- a/drivers/usb/storage/transport.c
+++ b/drivers/usb/storage/transport.c
@@ -695,6 +695,9 @@ void usb_stor_invoke_transport(struct scsi_cmnd *srb, struct us_data *us)
int temp_result;
struct scsi_eh_save ses;
int sense_size = US_SENSE_SIZE;
+ struct scsi_sense_hdr sshdr;
+ const u8 *scdd;
+ u8 fm_ili;
/* device supports and needs bigger sense buffer */
if (us->fflags & US_FL_SANE_SENSE)
@@ -778,32 +781,30 @@ Retry_Sense:
srb->sense_buffer[7] = (US_SENSE_SIZE - 8);
}
+ scsi_normalize_sense(srb->sense_buffer, SCSI_SENSE_BUFFERSIZE,
+ &sshdr);
+
US_DEBUGP("-- Result from auto-sense is %d\n", temp_result);
US_DEBUGP("-- code: 0x%x, key: 0x%x, ASC: 0x%x, ASCQ: 0x%x\n",
- srb->sense_buffer[0],
- srb->sense_buffer[2] & 0xf,
- srb->sense_buffer[12],
- srb->sense_buffer[13]);
+ sshdr.response_code, sshdr.sense_key,
+ sshdr.asc, sshdr.ascq);
#ifdef CONFIG_USB_STORAGE_DEBUG
- usb_stor_show_sense(
- srb->sense_buffer[2] & 0xf,
- srb->sense_buffer[12],
- srb->sense_buffer[13]);
+ usb_stor_show_sense(sshdr.sense_key, sshdr.asc, sshdr.ascq);
#endif
/* set the result so the higher layers expect this data */
srb->result = SAM_STAT_CHECK_CONDITION;
+ scdd = scsi_sense_desc_find(srb->sense_buffer,
+ SCSI_SENSE_BUFFERSIZE, 4);
+ fm_ili = (scdd ? scdd[3] : srb->sense_buffer[2]) & 0xA0;
+
/* We often get empty sense data. This could indicate that
* everything worked or that there was an unspecified
* problem. We have to decide which.
*/
- if ( /* Filemark 0, ignore EOM, ILI 0, no sense */
- (srb->sense_buffer[2] & 0xaf) == 0 &&
- /* No ASC or ASCQ */
- srb->sense_buffer[12] == 0 &&
- srb->sense_buffer[13] == 0) {
-
+ if (sshdr.sense_key == 0 && sshdr.asc == 0 && sshdr.ascq == 0 &&
+ fm_ili == 0) {
/* If things are really okay, then let's show that.
* Zero out the sense buffer so the higher layers
* won't realize we did an unsolicited auto-sense.
@@ -818,7 +819,10 @@ Retry_Sense:
*/
} else {
srb->result = DID_ERROR << 16;
- srb->sense_buffer[2] = HARDWARE_ERROR;
+ if ((sshdr.response_code & 0x72) == 0x72)
+ srb->sense_buffer[1] = HARDWARE_ERROR;
+ else
+ srb->sense_buffer[2] = HARDWARE_ERROR;
}
}
}
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 073/165] USB: pid_ns: ensure pid is not freed during kill_pid_info_as_uid
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (71 preceding siblings ...)
2012-08-15 19:46 ` [v2.6.34-stable 072/165] USB: storage: Use normalized sense when emulating autosense Paul Gortmaker
@ 2012-08-15 19:46 ` Paul Gortmaker
2012-08-15 19:46 ` [v2.6.34-stable 074/165] usb: cdc-acm: Owen SI-30 support Paul Gortmaker
` (91 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:46 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Serge Hallyn, Greg Kroah-Hartman, Paul Gortmaker
From: Serge Hallyn <serge.hallyn@canonical.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit aec01c5895051849ed842dc5b8794017a7751f28 upstream.
Alan Stern points out that after spin_unlock(&ps->lock) there is no
guarantee that ps->pid won't be freed. Since kill_pid_info_as_uid() is
called after the spin_unlock(), the pid passed to it must be pinned.
Reported-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Serge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/usb/core/devio.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index 6088192..85a4967 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -409,7 +409,7 @@ static void async_completed(struct urb *urb)
sinfo.si_errno = as->status;
sinfo.si_code = SI_ASYNCIO;
sinfo.si_addr = as->userurb;
- pid = as->pid;
+ pid = get_pid(as->pid);
uid = as->uid;
euid = as->euid;
secid = as->secid;
@@ -424,9 +424,11 @@ static void async_completed(struct urb *urb)
cancel_bulk_urbs(ps, as->bulk_addr);
spin_unlock(&ps->lock);
- if (signr)
+ if (signr) {
kill_pid_info_as_uid(sinfo.si_signo, &sinfo, pid, uid,
euid, secid);
+ put_pid(pid);
+ }
wake_up(&ps->wait);
}
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 074/165] usb: cdc-acm: Owen SI-30 support
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (72 preceding siblings ...)
2012-08-15 19:46 ` [v2.6.34-stable 073/165] USB: pid_ns: ensure pid is not freed during kill_pid_info_as_uid Paul Gortmaker
@ 2012-08-15 19:46 ` Paul Gortmaker
2012-08-15 19:46 ` [v2.6.34-stable 075/165] USB: add RESET_RESUME for webcams shown to be quirky Paul Gortmaker
` (90 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:46 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Denis Pershin, Greg Kroah-Hartman, Paul Gortmaker
From: Denis Pershin <dyp@perchine.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 65e52f41fa944cef2e6d4222b8c54f46cc575214 upstream.
here is the patch to support Owen SI-30 device.
This is a pulse counter controller.
http://www.owen.ru/en/catalog/93788515
usb-drivers output:
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 4 Spd=12 MxCh= 0
D: Ver= 2.00 Cls=02(commc) Sub=00 Prot=00 MxPS= 8 #Cfgs= 1
P: Vendor=03eb ProdID=0030 Rev=01.01
C: #Ifs= 2 Cfg#= 1 Atr=c0 MxPwr=0mA
I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=02 Prot=00 Driver=cdc_acm
I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_acm
This patch is installed on my home system which receives data from this
controller connected to cold water counter.
Signed-off-by: Denis Pershin <dyp@perchine.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/usb/class/cdc-acm.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index e907cfd..db34eb4 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1623,6 +1623,9 @@ static const struct usb_device_id acm_ids[] = {
{ NOKIA_PCSUITE_ACM_INFO(0x03cd), }, /* Nokia C7 */
{ SAMSUNG_PCSUITE_ACM_INFO(0x6651), }, /* Samsung GTi8510 (INNOV8) */
+ /* Support for Owen devices */
+ { USB_DEVICE(0x03eb, 0x0030), }, /* Owen SI30 */
+
/* NOTE: non-Nokia COMM/ACM/0xff is likely MSFT RNDIS... NOT a modem! */
/* Support Lego NXT using pbLua firmware */
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 075/165] USB: add RESET_RESUME for webcams shown to be quirky
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (73 preceding siblings ...)
2012-08-15 19:46 ` [v2.6.34-stable 074/165] usb: cdc-acm: Owen SI-30 support Paul Gortmaker
@ 2012-08-15 19:46 ` Paul Gortmaker
2012-08-15 19:47 ` [v2.6.34-stable 076/165] USB: pl2303: add id for SMART device Paul Gortmaker
` (89 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:46 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Oliver Neukum, Greg Kroah-Hartman, Paul Gortmaker
From: Oliver Neukum <oneukum@suse.de>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 2394d67e446bf616a0885167d5f0d397bdacfdfc upstream.
The new runtime PM code has shown that many webcams suffer
from a race condition that may crash them upon resume.
Runtime PM is especially prone to show the problem because
it retains power to the cameras at all times. However
system suspension may also crash the devices and retain
power to the devices.
The only way to solve this problem without races is in
usbcore with the RESET_RESUME quirk.
Signed-off-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/usb/core/quirks.c | 21 +++++++++++++++++++++
1 file changed, 21 insertions(+)
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index 99f2d61..241a0d6 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -38,6 +38,24 @@ static const struct usb_device_id usb_quirk_list[] = {
/* Creative SB Audigy 2 NX */
{ USB_DEVICE(0x041e, 0x3020), .driver_info = USB_QUIRK_RESET_RESUME },
+ /* Logitech Webcam C200 */
+ { USB_DEVICE(0x046d, 0x0802), .driver_info = USB_QUIRK_RESET_RESUME },
+
+ /* Logitech Webcam C250 */
+ { USB_DEVICE(0x046d, 0x0804), .driver_info = USB_QUIRK_RESET_RESUME },
+
+ /* Logitech Webcam B/C500 */
+ { USB_DEVICE(0x046d, 0x0807), .driver_info = USB_QUIRK_RESET_RESUME },
+
+ /* Logitech Webcam Pro 9000 */
+ { USB_DEVICE(0x046d, 0x0809), .driver_info = USB_QUIRK_RESET_RESUME },
+
+ /* Logitech Webcam C310 */
+ { USB_DEVICE(0x046d, 0x081b), .driver_info = USB_QUIRK_RESET_RESUME },
+
+ /* Logitech Webcam C270 */
+ { USB_DEVICE(0x046d, 0x0825), .driver_info = USB_QUIRK_RESET_RESUME },
+
/* Philips PSC805 audio device */
{ USB_DEVICE(0x0471, 0x0155), .driver_info = USB_QUIRK_RESET_RESUME },
@@ -66,6 +84,9 @@ static const struct usb_device_id usb_quirk_list[] = {
{ USB_DEVICE(0x06a3, 0x0006), .driver_info =
USB_QUIRK_CONFIG_INTF_STRINGS },
+ /* Guillemot Webcam Hercules Dualpix Exchange*/
+ { USB_DEVICE(0x06f8, 0x0804), .driver_info = USB_QUIRK_RESET_RESUME },
+
/* M-Systems Flash Disk Pioneers */
{ USB_DEVICE(0x08ec, 0x1000), .driver_info = USB_QUIRK_RESET_RESUME },
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 076/165] USB: pl2303: add id for SMART device
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (74 preceding siblings ...)
2012-08-15 19:46 ` [v2.6.34-stable 075/165] USB: add RESET_RESUME for webcams shown to be quirky Paul Gortmaker
@ 2012-08-15 19:47 ` Paul Gortmaker
2012-08-15 19:47 ` [v2.6.34-stable 077/165] USB: ftdi_sio: add PID for Sony Ericsson Urban Paul Gortmaker
` (88 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:47 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Eric Benoit, Greg Kroah-Hartman, Paul Gortmaker
From: Eric Benoit <eric@ecks.ca>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 598f0b703506da841d3459dc0c48506be14d1778 upstream.
Add vendor and product ID for the SMART USB to serial adapter. These
were meant to be used with their SMART Board whiteboards, but can be
re-purposed for other tasks. Tested and working (at at least 9600 bps).
Signed-off-by: Eric Benoit <eric@ecks.ca>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/usb/serial/pl2303.c | 1 +
drivers/usb/serial/pl2303.h | 4 ++++
2 files changed, 5 insertions(+)
diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
index 9f49375..e42ee9b 100644
--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -102,6 +102,7 @@ static const struct usb_device_id id_table[] = {
{ USB_DEVICE(SANWA_VENDOR_ID, SANWA_PRODUCT_ID) },
{ USB_DEVICE(ADLINK_VENDOR_ID, ADLINK_ND6530_PRODUCT_ID) },
{ USB_DEVICE(WINCHIPHEAD_VENDOR_ID, WINCHIPHEAD_USBSER_PRODUCT_ID) },
+ { USB_DEVICE(SMART_VENDOR_ID, SMART_PRODUCT_ID) },
{ } /* Terminating entry */
};
diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
index ca0d237..450a4a7 100644
--- a/drivers/usb/serial/pl2303.h
+++ b/drivers/usb/serial/pl2303.h
@@ -148,3 +148,7 @@
/* WinChipHead USB->RS 232 adapter */
#define WINCHIPHEAD_VENDOR_ID 0x4348
#define WINCHIPHEAD_USBSER_PRODUCT_ID 0x5523
+
+/* SMART USB Serial Adapter */
+#define SMART_VENDOR_ID 0x0b8c
+#define SMART_PRODUCT_ID 0x2303
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 077/165] USB: ftdi_sio: add PID for Sony Ericsson Urban
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (75 preceding siblings ...)
2012-08-15 19:47 ` [v2.6.34-stable 076/165] USB: pl2303: add id for SMART device Paul Gortmaker
@ 2012-08-15 19:47 ` Paul Gortmaker
2012-08-15 19:47 ` [v2.6.34-stable 078/165] USB: ftdi_sio: Support TI/Luminary Micro Stellaris BD-ICDI Board Paul Gortmaker
` (87 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:47 UTC (permalink / raw)
To: stable, linux-kernel
Cc: Hakan Kvist, Oskar Andero, Greg Kroah-Hartman, Paul Gortmaker
From: Hakan Kvist <hakan.kvist@sonyericsson.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 74bdf22b5c3858b06af46f19d05c23e76c40a3bb upstream.
Add PID 0xfc8a, 0xfc8b for device Sony Ericsson Urban
Signed-off-by: Hakan Kvist <hakan.kvist@sonyericsson.com>
Signed-off-by: Oskar Andero <oskar.andero@sonyericsson.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/usb/serial/ftdi_sio.c | 2 ++
drivers/usb/serial/ftdi_sio_ids.h | 6 ++++--
2 files changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index e8bc908..27cd4a1 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -209,6 +209,8 @@ static struct usb_device_id id_table_combined [] = {
{ USB_DEVICE(FTDI_VID, FTDI_XF_640_PID) },
{ USB_DEVICE(FTDI_VID, FTDI_XF_642_PID) },
{ USB_DEVICE(FTDI_VID, FTDI_DSS20_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_URBAN_0_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_URBAN_1_PID) },
{ USB_DEVICE(FTDI_NF_RIC_VID, FTDI_NF_RIC_PID) },
{ USB_DEVICE(FTDI_VID, FTDI_VNHCPCUSB_D_PID) },
{ USB_DEVICE(FTDI_VID, FTDI_MTXORB_0_PID) },
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index a73443f..7d7f138 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -419,9 +419,11 @@
#define PROTEGO_SPECIAL_4 0xFC73 /* special/unknown device */
/*
- * DSS-20 Sync Station for Sony Ericsson P800
+ * Sony Ericsson product ids
*/
-#define FTDI_DSS20_PID 0xFC82
+#define FTDI_DSS20_PID 0xFC82 /* DSS-20 Sync Station for Sony Ericsson P800 */
+#define FTDI_URBAN_0_PID 0xFC8A /* Sony Ericsson Urban, uart #0 */
+#define FTDI_URBAN_1_PID 0xFC8B /* Sony Ericsson Urban, uart #1 */
/* www.irtrans.de device */
#define FTDI_IRTRANS_PID 0xFC60 /* Product Id */
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 078/165] USB: ftdi_sio: Support TI/Luminary Micro Stellaris BD-ICDI Board
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (76 preceding siblings ...)
2012-08-15 19:47 ` [v2.6.34-stable 077/165] USB: ftdi_sio: add PID for Sony Ericsson Urban Paul Gortmaker
@ 2012-08-15 19:47 ` Paul Gortmaker
2012-08-15 19:47 ` [v2.6.34-stable 079/165] QE/FHCI: fixed the CONTROL bug Paul Gortmaker
` (86 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:47 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Peter Stuge, Greg Kroah-Hartman, Paul Gortmaker
From: Peter Stuge <peter@stuge.se>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 3687f641307eeff6f7fe31a88dc39db88e89238b upstream.
Some Stellaris evaluation kits have the JTAG/SWD FTDI chip onboard,
and some, like EK-LM3S9B90, come with a separate In-Circuit Debugger
Interface Board. The ICDI board can also be used stand-alone, for
other boards and chips than the kit it came with. The ICDI has both
old style 20-pin JTAG connector and new style JTAG/SWD 10-pin 1.27mm
pitch connector.
Tested with EK-LM3S9B90, where the BD-ICDI board is included.
Signed-off-by: Peter Stuge <peter@stuge.se>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/usb/serial/ftdi_sio.c | 2 ++
drivers/usb/serial/ftdi_sio_ids.h | 1 +
2 files changed, 3 insertions(+)
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 27cd4a1..90dfdb1 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -748,6 +748,8 @@ static struct usb_device_id id_table_combined [] = {
.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
{ USB_DEVICE(FTDI_VID, LMI_LM3S_EVAL_BOARD_PID),
.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+ { USB_DEVICE(FTDI_VID, LMI_LM3S_ICDI_BOARD_PID),
+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
{ USB_DEVICE(FTDI_VID, FTDI_TURTELIZER_PID),
.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
{ USB_DEVICE(RATOC_VENDOR_ID, RATOC_PRODUCT_ID_USB60F) },
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index 7d7f138..1167732 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -53,6 +53,7 @@
/* FTDI 2332C Dual channel device, side A=245 FIFO (JTAG), Side B=RS232 UART */
#define LMI_LM3S_DEVEL_BOARD_PID 0xbcd8
#define LMI_LM3S_EVAL_BOARD_PID 0xbcd9
+#define LMI_LM3S_ICDI_BOARD_PID 0xbcda
#define FTDI_TURTELIZER_PID 0xBDC8 /* JTAG/RS-232 adapter by egnite GmbH */
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 079/165] QE/FHCI: fixed the CONTROL bug
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (77 preceding siblings ...)
2012-08-15 19:47 ` [v2.6.34-stable 078/165] USB: ftdi_sio: Support TI/Luminary Micro Stellaris BD-ICDI Board Paul Gortmaker
@ 2012-08-15 19:47 ` Paul Gortmaker
2012-08-15 19:47 ` [v2.6.34-stable 080/165] Update email address for stable patch submission Paul Gortmaker
` (85 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:47 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Jerry Huang, Greg Kroah-Hartman, Paul Gortmaker
From: Jerry Huang <r66093@freescale.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 273d23574f9dacd9c63c80e7d63639a669aad441 upstream.
For USB CONTROL transaction, when the data length is zero,
the IN package is needed to finish this transaction in status stage.
Signed-off-by: Jerry Huang <r66093@freescale.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/usb/host/fhci-sched.c | 19 +++++++++++++++----
1 file changed, 15 insertions(+), 4 deletions(-)
diff --git a/drivers/usb/host/fhci-sched.c b/drivers/usb/host/fhci-sched.c
index ff43747..b13d78a 100644
--- a/drivers/usb/host/fhci-sched.c
+++ b/drivers/usb/host/fhci-sched.c
@@ -1,7 +1,7 @@
/*
* Freescale QUICC Engine USB Host Controller Driver
*
- * Copyright (c) Freescale Semicondutor, Inc. 2006.
+ * Copyright (c) Freescale Semicondutor, Inc. 2006, 2011.
* Shlomi Gridish <gridish@freescale.com>
* Jerry Huang <Chang-Ming.Huang@freescale.com>
* Copyright (c) Logic Product Development, Inc. 2007
@@ -810,9 +810,11 @@ void fhci_queue_urb(struct fhci_hcd *fhci, struct urb *urb)
ed->dev_addr = usb_pipedevice(urb->pipe);
ed->max_pkt_size = usb_maxpacket(urb->dev, urb->pipe,
usb_pipeout(urb->pipe));
+ /* setup stage */
td = fhci_td_fill(fhci, urb, urb_priv, ed, cnt++, FHCI_TA_SETUP,
USB_TD_TOGGLE_DATA0, urb->setup_packet, 8, 0, 0, true);
+ /* data stage */
if (data_len > 0) {
td = fhci_td_fill(fhci, urb, urb_priv, ed, cnt++,
usb_pipeout(urb->pipe) ? FHCI_TA_OUT :
@@ -820,9 +822,18 @@ void fhci_queue_urb(struct fhci_hcd *fhci, struct urb *urb)
USB_TD_TOGGLE_DATA1, data, data_len, 0, 0,
true);
}
- td = fhci_td_fill(fhci, urb, urb_priv, ed, cnt++,
- usb_pipeout(urb->pipe) ? FHCI_TA_IN : FHCI_TA_OUT,
- USB_TD_TOGGLE_DATA1, data, 0, 0, 0, true);
+
+ /* status stage */
+ if (data_len > 0)
+ td = fhci_td_fill(fhci, urb, urb_priv, ed, cnt++,
+ (usb_pipeout(urb->pipe) ? FHCI_TA_IN :
+ FHCI_TA_OUT),
+ USB_TD_TOGGLE_DATA1, data, 0, 0, 0, true);
+ else
+ td = fhci_td_fill(fhci, urb, urb_priv, ed, cnt++,
+ FHCI_TA_IN,
+ USB_TD_TOGGLE_DATA1, data, 0, 0, 0, true);
+
urb_state = US_CTRL_SETUP;
break;
case FHCI_TF_ISO:
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 080/165] Update email address for stable patch submission
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (78 preceding siblings ...)
2012-08-15 19:47 ` [v2.6.34-stable 079/165] QE/FHCI: fixed the CONTROL bug Paul Gortmaker
@ 2012-08-15 19:47 ` Paul Gortmaker
2012-08-15 19:47 ` [v2.6.34-stable 081/165] kobj_uevent: Ignore if some listeners cannot handle message Paul Gortmaker
` (84 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:47 UTC (permalink / raw)
To: stable, linux-kernel
Cc: Josh Boyer, stable, Greg Kroah-Hartman, Paul Gortmaker
From: Josh Boyer <jwboyer@redhat.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 5fa224295f0e0358c8bc0e5390702338df889def upstream.
The stable@kernel.org email address has been replaced with the
stable@vger.kernel.org mailing list. Change the stable kernel rules to
reference the new list instead of the semi-defunct email alias.
CC: <stable@kernel.org>
CC: <stable@vger.kernel.org>
Signed-off-by: Josh Boyer <jwboyer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
Documentation/stable_kernel_rules.txt | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/Documentation/stable_kernel_rules.txt b/Documentation/stable_kernel_rules.txt
index e213f45..21fd05c 100644
--- a/Documentation/stable_kernel_rules.txt
+++ b/Documentation/stable_kernel_rules.txt
@@ -24,10 +24,10 @@ Rules on what kind of patches are accepted, and which ones are not, into the
Procedure for submitting patches to the -stable tree:
- Send the patch, after verifying that it follows the above rules, to
- stable@kernel.org. You must note the upstream commit ID in the changelog
- of your submission.
+ stable@vger.kernel.org. You must note the upstream commit ID in the
+ changelog of your submission.
- To have the patch automatically included in the stable tree, add the tag
- Cc: stable@kernel.org
+ Cc: stable@vger.kernel.org
in the sign-off area. Once the patch is merged it will be applied to
the stable tree without anything else needing to be done by the author
or subsystem maintainer.
@@ -35,10 +35,10 @@ Procedure for submitting patches to the -stable tree:
cherry-picked than this can be specified in the following format in
the sign-off area:
- Cc: <stable@kernel.org> # .32.x: a1f84a3: sched: Check for idle
- Cc: <stable@kernel.org> # .32.x: 1b9508f: sched: Rate-limit newidle
- Cc: <stable@kernel.org> # .32.x: fd21073: sched: Fix affinity logic
- Cc: <stable@kernel.org> # .32.x
+ Cc: <stable@vger.kernel.org> # .32.x: a1f84a3: sched: Check for idle
+ Cc: <stable@vger.kernel.org> # .32.x: 1b9508f: sched: Rate-limit newidle
+ Cc: <stable@vger.kernel.org> # .32.x: fd21073: sched: Fix affinity logic
+ Cc: <stable@vger.kernel.org> # .32.x
Signed-off-by: Ingo Molnar <mingo@elte.hu>
The tag sequence has the meaning of:
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 081/165] kobj_uevent: Ignore if some listeners cannot handle message
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (79 preceding siblings ...)
2012-08-15 19:47 ` [v2.6.34-stable 080/165] Update email address for stable patch submission Paul Gortmaker
@ 2012-08-15 19:47 ` Paul Gortmaker
2012-08-15 19:47 ` [v2.6.34-stable 082/165] kmod: prevent kmod_loop_msg overflow in __request_module() Paul Gortmaker
` (83 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:47 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Milan Broz, Greg Kroah-Hartman, Paul Gortmaker
From: Milan Broz <mbroz@redhat.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit ebf4127cd677e9781b450e44dfaaa1cc595efcaa upstream.
kobject_uevent() uses a multicast socket and should ignore
if one of listeners cannot handle messages or nobody is
listening at all.
Easily reproducible when a process in system is cloned
with CLONE_NEWNET flag.
(See also http://article.gmane.org/gmane.linux.kernel.device-mapper.dm-crypt/5256)
Signed-off-by: Milan Broz <mbroz@redhat.com>
Acked-by: Kay Sievers <kay.sievers@vrfy.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
lib/kobject_uevent.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/lib/kobject_uevent.c b/lib/kobject_uevent.c
index 7b48d44..0273ead 100644
--- a/lib/kobject_uevent.c
+++ b/lib/kobject_uevent.c
@@ -236,7 +236,7 @@ int kobject_uevent_env(struct kobject *kobj, enum kobject_action action,
retval = netlink_broadcast(uevent_sock, skb, 0, 1,
GFP_KERNEL);
/* ENOBUFS should be handled in userspace */
- if (retval == -ENOBUFS)
+ if (retval == -ENOBUFS || retval == -ESRCH)
retval = 0;
} else
retval = -ENOMEM;
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 082/165] kmod: prevent kmod_loop_msg overflow in __request_module()
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (80 preceding siblings ...)
2012-08-15 19:47 ` [v2.6.34-stable 081/165] kobj_uevent: Ignore if some listeners cannot handle message Paul Gortmaker
@ 2012-08-15 19:47 ` Paul Gortmaker
2012-08-15 19:47 ` [v2.6.34-stable 083/165] time: Change jiffies_to_clock_t() argument type to unsigned long Paul Gortmaker
` (82 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:47 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Jiri Kosina, Rusty Russell, Paul Gortmaker
From: Jiri Kosina <jkosina@suse.cz>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 37252db6aa576c34fd794a5a54fb32d7a8b3a07a upstream.
Due to post-increment in condition of kmod_loop_msg in __request_module(),
the system log can be spammed by much more than 5 instances of the 'runaway
loop' message if the number of events triggering it makes the kmod_loop_msg
to overflow.
Fix that by making sure we never increment it past the threshold.
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
kernel/kmod.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/kernel/kmod.c b/kernel/kmod.c
index bf0e231..f50a996 100644
--- a/kernel/kmod.c
+++ b/kernel/kmod.c
@@ -106,10 +106,12 @@ int __request_module(bool wait, const char *fmt, ...)
atomic_inc(&kmod_concurrent);
if (atomic_read(&kmod_concurrent) > max_modprobes) {
/* We may be blaming an innocent here, but unlikely */
- if (kmod_loop_msg++ < 5)
+ if (kmod_loop_msg < 5) {
printk(KERN_ERR
"request_module: runaway loop modprobe %s\n",
module_name);
+ kmod_loop_msg++;
+ }
atomic_dec(&kmod_concurrent);
return -ENOMEM;
}
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 083/165] time: Change jiffies_to_clock_t() argument type to unsigned long
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (81 preceding siblings ...)
2012-08-15 19:47 ` [v2.6.34-stable 082/165] kmod: prevent kmod_loop_msg overflow in __request_module() Paul Gortmaker
@ 2012-08-15 19:47 ` Paul Gortmaker
2012-08-15 19:47 ` [v2.6.34-stable 084/165] nfsd4: Remove check for a 32-bit cookie in nfsd4_readdir() Paul Gortmaker
` (81 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:47 UTC (permalink / raw)
To: stable, linux-kernel
Cc: hank, John Stultz, Andrew Morton, Thomas Gleixner, Ingo Molnar,
Paul Gortmaker
From: hank <pyu@redhat.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit cbbc719fccdb8cbd87350a05c0d33167c9b79365 upstream.
The parameter's origin type is long. On an i386 architecture, it can
easily be larger than 0x80000000, causing this function to convert it
to a sign-extended u64 type.
Change the type to unsigned long so we get the correct result.
Signed-off-by: hank <pyu@redhat.com>
Cc: John Stultz <john.stultz@linaro.org>
[ build fix ]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
include/linux/jiffies.h | 2 +-
kernel/time.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/include/linux/jiffies.h b/include/linux/jiffies.h
index 6811f4b..284c13d 100644
--- a/include/linux/jiffies.h
+++ b/include/linux/jiffies.h
@@ -303,7 +303,7 @@ extern void jiffies_to_timespec(const unsigned long jiffies,
extern unsigned long timeval_to_jiffies(const struct timeval *value);
extern void jiffies_to_timeval(const unsigned long jiffies,
struct timeval *value);
-extern clock_t jiffies_to_clock_t(long x);
+extern clock_t jiffies_to_clock_t(unsigned long x);
extern unsigned long clock_t_to_jiffies(unsigned long x);
extern u64 jiffies_64_to_clock_t(u64 x);
extern u64 nsec_to_clock_t(u64 x);
diff --git a/kernel/time.c b/kernel/time.c
index 656dccf..82e83b0 100644
--- a/kernel/time.c
+++ b/kernel/time.c
@@ -592,7 +592,7 @@ EXPORT_SYMBOL(jiffies_to_timeval);
/*
* Convert jiffies/jiffies_64 to clock_t and back.
*/
-clock_t jiffies_to_clock_t(long x)
+clock_t jiffies_to_clock_t(unsigned long x)
{
#if (TICK_NSEC % (NSEC_PER_SEC / USER_HZ)) == 0
# if HZ < USER_HZ
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 084/165] nfsd4: Remove check for a 32-bit cookie in nfsd4_readdir()
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (82 preceding siblings ...)
2012-08-15 19:47 ` [v2.6.34-stable 083/165] time: Change jiffies_to_clock_t() argument type to unsigned long Paul Gortmaker
@ 2012-08-15 19:47 ` Paul Gortmaker
2012-08-15 19:47 ` [v2.6.34-stable 085/165] nfsd4: ignore WANT bits in open downgrade Paul Gortmaker
` (80 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:47 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Bernd Schubert, J. Bruce Fields, Paul Gortmaker
From: Bernd Schubert <bernd.schubert@itwm.fraunhofer.de>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 832023bffb4b493f230be901f681020caf3ed1f8 upstream.
Fan Yong <yong.fan@whamcloud.com> noticed setting
FMODE_32bithash wouldn't work with nfsd v4, as
nfsd4_readdir() checks for 32 bit cookies. However, according to RFC 3530
cookies have a 64 bit type and cookies are also defined as u64 in
'struct nfsd4_readdir'. So remove the test for >32-bit values.
Signed-off-by: Bernd Schubert <bernd.schubert@itwm.fraunhofer.de>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/nfsd/nfs4proc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index 5046e8b..3b9fcb2 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -678,7 +678,7 @@ nfsd4_readdir(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
readdir->rd_bmval[1] &= nfsd_suppattrs1(cstate->minorversion);
readdir->rd_bmval[2] &= nfsd_suppattrs2(cstate->minorversion);
- if ((cookie > ~(u32)0) || (cookie == 1) || (cookie == 2) ||
+ if ((cookie == 1) || (cookie == 2) ||
(cookie == 0 && memcmp(readdir->rd_verf.data, zeroverf.data, NFS4_VERIFIER_SIZE)))
return nfserr_bad_cookie;
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 085/165] nfsd4: ignore WANT bits in open downgrade
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (83 preceding siblings ...)
2012-08-15 19:47 ` [v2.6.34-stable 084/165] nfsd4: Remove check for a 32-bit cookie in nfsd4_readdir() Paul Gortmaker
@ 2012-08-15 19:47 ` Paul Gortmaker
2012-08-15 19:47 ` [v2.6.34-stable 086/165] ASoC: wm8940: Properly set codec->dapm.bias_level Paul Gortmaker
` (79 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:47 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: J. Bruce Fields, Paul Gortmaker
From: "J. Bruce Fields" <bfields@redhat.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit c30e92df30d7d5fe65262fbce5d1b7de675fe34e upstream.
We don't use WANT bits yet--and sending them can probably trigger a
BUG() further down.
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/nfsd/nfs4state.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index 6a8feda..aa76339 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -3065,6 +3065,8 @@ nfsd4_open_downgrade(struct svc_rqst *rqstp,
if (!access_valid(od->od_share_access, cstate->minorversion)
|| !deny_valid(od->od_share_deny))
return nfserr_inval;
+ /* We don't yet support WANT bits: */
+ od->od_share_access &= NFS4_SHARE_ACCESS_MASK;
nfs4_lock_state();
if ((status = nfs4_preprocess_seqid_op(cstate,
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 086/165] ASoC: wm8940: Properly set codec->dapm.bias_level
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (84 preceding siblings ...)
2012-08-15 19:47 ` [v2.6.34-stable 085/165] nfsd4: ignore WANT bits in open downgrade Paul Gortmaker
@ 2012-08-15 19:47 ` Paul Gortmaker
2012-08-15 19:47 ` [v2.6.34-stable 087/165] ASoC: ak4642: fixup cache register table Paul Gortmaker
` (78 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:47 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Axel Lin, Mark Brown, Paul Gortmaker
From: Axel Lin <axel.lin@gmail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 5927f94700e860ae27ff24e7f3bc9e4f7b9922eb upstream.
Reported-by: Chris Paulson-Ellis <chris@edesix.com>
Signed-off-by: Axel Lin <axel.lin@gmail.com>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
[PG: in .34 it uses codec->bias_level and not codec->dapm.bias_level]
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
sound/soc/codecs/wm8940.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/sound/soc/codecs/wm8940.c b/sound/soc/codecs/wm8940.c
index 0c04b47..0dab4fe 100644
--- a/sound/soc/codecs/wm8940.c
+++ b/sound/soc/codecs/wm8940.c
@@ -473,6 +473,8 @@ static int wm8940_set_bias_level(struct snd_soc_codec *codec,
break;
}
+ codec->bias_level = level;
+
return ret;
}
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 087/165] ASoC: ak4642: fixup cache register table
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (85 preceding siblings ...)
2012-08-15 19:47 ` [v2.6.34-stable 086/165] ASoC: wm8940: Properly set codec->dapm.bias_level Paul Gortmaker
@ 2012-08-15 19:47 ` Paul Gortmaker
2012-08-15 19:47 ` [v2.6.34-stable 088/165] ASoC: ak4535: " Paul Gortmaker
` (77 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:47 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Kuninori Morimoto, Mark Brown, Paul Gortmaker
From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 19b115e523208a926813751aac8934cf3fc6085e upstream.
ak4642 register was 8bit, but cache table was defined as 16bit.
ak4642 doesn't work correctry without this patch.
Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
sound/soc/codecs/ak4642.c | 22 +++++++++++-----------
1 file changed, 11 insertions(+), 11 deletions(-)
diff --git a/sound/soc/codecs/ak4642.c b/sound/soc/codecs/ak4642.c
index 729859c..858d476 100644
--- a/sound/soc/codecs/ak4642.c
+++ b/sound/soc/codecs/ak4642.c
@@ -94,17 +94,17 @@ static struct snd_soc_codec *ak4642_codec;
/*
* ak4642 register cache
*/
-static const u16 ak4642_reg[AK4642_CACHEREGNUM] = {
- 0x0000, 0x0000, 0x0001, 0x0000,
- 0x0002, 0x0000, 0x0000, 0x0000,
- 0x00e1, 0x00e1, 0x0018, 0x0000,
- 0x00e1, 0x0018, 0x0011, 0x0008,
- 0x0000, 0x0000, 0x0000, 0x0000,
- 0x0000, 0x0000, 0x0000, 0x0000,
- 0x0000, 0x0000, 0x0000, 0x0000,
- 0x0000, 0x0000, 0x0000, 0x0000,
- 0x0000, 0x0000, 0x0000, 0x0000,
- 0x0000,
+static const u8 ak4642_reg[AK4642_CACHEREGNUM] = {
+ 0x00, 0x00, 0x01, 0x00,
+ 0x02, 0x00, 0x00, 0x00,
+ 0xe1, 0xe1, 0x18, 0x00,
+ 0xe1, 0x18, 0x11, 0x08,
+ 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00,
+ 0x00,
};
/*
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 088/165] ASoC: ak4535: fixup cache register table
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (86 preceding siblings ...)
2012-08-15 19:47 ` [v2.6.34-stable 087/165] ASoC: ak4642: fixup cache register table Paul Gortmaker
@ 2012-08-15 19:47 ` Paul Gortmaker
2012-08-15 19:47 ` [v2.6.34-stable 089/165] KVM: s390: check cpu_id prior to using it Paul Gortmaker
` (76 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:47 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Axel Lin, Mark Brown, Paul Gortmaker
From: Axel Lin <axel.lin@gmail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 7c04241acbdaf97f1448dcccd27ea0fcd1a57684 upstream.
ak4535_reg should be 8bit, but cache table is defined as 16bit.
Signed-off-by: Axel Lin <axel.lin@gmail.com>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
sound/soc/codecs/ak4535.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/sound/soc/codecs/ak4535.c b/sound/soc/codecs/ak4535.c
index 352d1d0..133d8f5 100644
--- a/sound/soc/codecs/ak4535.c
+++ b/sound/soc/codecs/ak4535.c
@@ -41,11 +41,11 @@ struct ak4535_priv {
/*
* ak4535 register cache
*/
-static const u16 ak4535_reg[AK4535_CACHEREGNUM] = {
- 0x0000, 0x0080, 0x0000, 0x0003,
- 0x0002, 0x0000, 0x0011, 0x0001,
- 0x0000, 0x0040, 0x0036, 0x0010,
- 0x0000, 0x0000, 0x0057, 0x0000,
+static const u8 ak4535_reg[AK4535_CACHEREGNUM] = {
+ 0x00, 0x80, 0x00, 0x03,
+ 0x02, 0x00, 0x11, 0x01,
+ 0x00, 0x40, 0x36, 0x10,
+ 0x00, 0x00, 0x57, 0x00,
};
/*
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 089/165] KVM: s390: check cpu_id prior to using it
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (87 preceding siblings ...)
2012-08-15 19:47 ` [v2.6.34-stable 088/165] ASoC: ak4535: " Paul Gortmaker
@ 2012-08-15 19:47 ` Paul Gortmaker
2012-08-15 19:47 ` [v2.6.34-stable 090/165] [S390] ccwgroup: move attributes to attribute group Paul Gortmaker
` (75 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:47 UTC (permalink / raw)
To: stable, linux-kernel
Cc: Carsten Otte, Christian Borntraeger, Marcelo Tosatti, Paul Gortmaker
From: Carsten Otte <cotte@de.ibm.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 4d47555a80495657161a7e71ec3014ff2021e450 upstream.
We use the cpu id provided by userspace as array index here. Thus we
clearly need to check it first. Ooops.
CC: <stable@vger.kernel.org>
Signed-off-by: Carsten Otte <cotte@de.ibm.com>
Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/s390/kvm/kvm-s390.c | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
index ee7c713..a6015d1 100644
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -311,11 +311,17 @@ int kvm_arch_vcpu_setup(struct kvm_vcpu *vcpu)
struct kvm_vcpu *kvm_arch_vcpu_create(struct kvm *kvm,
unsigned int id)
{
- struct kvm_vcpu *vcpu = kzalloc(sizeof(struct kvm_vcpu), GFP_KERNEL);
- int rc = -ENOMEM;
+ struct kvm_vcpu *vcpu;
+ int rc = -EINVAL;
+
+ if (id >= KVM_MAX_VCPUS)
+ goto out;
+
+ rc = -ENOMEM;
+ vcpu = kzalloc(sizeof(struct kvm_vcpu), GFP_KERNEL);
if (!vcpu)
- goto out_nomem;
+ goto out;
vcpu->arch.sie_block = (struct kvm_s390_sie_block *)
get_zeroed_page(GFP_KERNEL);
@@ -350,7 +356,7 @@ out_free_sie_block:
free_page((unsigned long)(vcpu->arch.sie_block));
out_free_cpu:
kfree(vcpu);
-out_nomem:
+out:
return ERR_PTR(rc);
}
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 090/165] [S390] ccwgroup: move attributes to attribute group
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (88 preceding siblings ...)
2012-08-15 19:47 ` [v2.6.34-stable 089/165] KVM: s390: check cpu_id prior to using it Paul Gortmaker
@ 2012-08-15 19:47 ` Paul Gortmaker
2012-08-15 19:47 ` [v2.6.34-stable 091/165] iommu/amd: Fix wrong shift direction Paul Gortmaker
` (74 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:47 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Sebastian Ott, Martin Schwidefsky, Paul Gortmaker
From: Sebastian Ott <sebott@linux.vnet.ibm.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit dbdf1afcaaabe83dea15a3cb9b9013e73ae3b1ad upstream.
Put sysfs attributes of ccwgroup devices in an attribute group to
ensure that these attributes are actually present when userspace
is notified via uevents.
Signed-off-by: Sebastian Ott <sebott@linux.vnet.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/s390/cio/ccwgroup.c | 42 ++++++++++++++++++++++--------------------
1 file changed, 22 insertions(+), 20 deletions(-)
diff --git a/drivers/s390/cio/ccwgroup.c b/drivers/s390/cio/ccwgroup.c
index 5f97ea2..fcedb92 100644
--- a/drivers/s390/cio/ccwgroup.c
+++ b/drivers/s390/cio/ccwgroup.c
@@ -66,6 +66,12 @@ __ccwgroup_remove_symlinks(struct ccwgroup_device *gdev)
}
+static ssize_t ccwgroup_online_store(struct device *dev,
+ struct device_attribute *attr,
+ const char *buf, size_t count);
+static ssize_t ccwgroup_online_show(struct device *dev,
+ struct device_attribute *attr,
+ char *buf);
/*
* Provide an 'ungroup' attribute so the user can remove group devices no
* longer needed or accidentially created. Saves memory :)
@@ -112,6 +118,20 @@ out:
}
static DEVICE_ATTR(ungroup, 0200, NULL, ccwgroup_ungroup_store);
+static DEVICE_ATTR(online, 0644, ccwgroup_online_show, ccwgroup_online_store);
+
+static struct attribute *ccwgroup_attrs[] = {
+ &dev_attr_online.attr,
+ &dev_attr_ungroup.attr,
+ NULL,
+};
+static struct attribute_group ccwgroup_attr_group = {
+ .attrs = ccwgroup_attrs,
+};
+static const struct attribute_group *ccwgroup_attr_groups[] = {
+ &ccwgroup_attr_group,
+ NULL,
+};
static void
ccwgroup_release (struct device *dev)
@@ -280,25 +300,17 @@ int ccwgroup_create_from_string(struct device *root, unsigned int creator_id,
}
dev_set_name(&gdev->dev, "%s", dev_name(&gdev->cdev[0]->dev));
-
+ gdev->dev.groups = ccwgroup_attr_groups;
rc = device_add(&gdev->dev);
if (rc)
goto error;
get_device(&gdev->dev);
- rc = device_create_file(&gdev->dev, &dev_attr_ungroup);
-
- if (rc) {
- device_unregister(&gdev->dev);
- goto error;
- }
-
rc = __ccwgroup_create_symlinks(gdev);
if (!rc) {
mutex_unlock(&gdev->reg_mutex);
put_device(&gdev->dev);
return 0;
}
- device_remove_file(&gdev->dev, &dev_attr_ungroup);
device_unregister(&gdev->dev);
error:
for (i = 0; i < num_devices; i++)
@@ -408,7 +420,7 @@ ccwgroup_online_store (struct device *dev, struct device_attribute *attr, const
int ret;
if (!dev->driver)
- return -ENODEV;
+ return -EINVAL;
gdev = to_ccwgroupdev(dev);
gdrv = to_ccwgroupdrv(dev->driver);
@@ -441,8 +453,6 @@ ccwgroup_online_show (struct device *dev, struct device_attribute *attr, char *b
return sprintf(buf, online ? "1\n" : "0\n");
}
-static DEVICE_ATTR(online, 0644, ccwgroup_online_show, ccwgroup_online_store);
-
static int
ccwgroup_probe (struct device *dev)
{
@@ -454,12 +464,7 @@ ccwgroup_probe (struct device *dev)
gdev = to_ccwgroupdev(dev);
gdrv = to_ccwgroupdrv(dev->driver);
- if ((ret = device_create_file(dev, &dev_attr_online)))
- return ret;
-
ret = gdrv->probe ? gdrv->probe(gdev) : -ENODEV;
- if (ret)
- device_remove_file(dev, &dev_attr_online);
return ret;
}
@@ -470,9 +475,6 @@ ccwgroup_remove (struct device *dev)
struct ccwgroup_device *gdev;
struct ccwgroup_driver *gdrv;
- device_remove_file(dev, &dev_attr_online);
- device_remove_file(dev, &dev_attr_ungroup);
-
if (!dev->driver)
return 0;
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 091/165] iommu/amd: Fix wrong shift direction
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (89 preceding siblings ...)
2012-08-15 19:47 ` [v2.6.34-stable 090/165] [S390] ccwgroup: move attributes to attribute group Paul Gortmaker
@ 2012-08-15 19:47 ` Paul Gortmaker
2012-08-15 19:47 ` [v2.6.34-stable 092/165] carminefb: Fix module parameters permissions Paul Gortmaker
` (73 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:47 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Joerg Roedel, Paul Gortmaker
From: Joerg Roedel <joerg.roedel@amd.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit fcd0861db1cf4e6ed99f60a815b7b72c2ed36ea4 upstream.
The shift direction was wrong because the function takes a
page number and i is the address is the loop.
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
[PG: drivers/iommu/ was arch/x86/kernel/ in 2.6.34 context]
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/x86/kernel/amd_iommu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/x86/kernel/amd_iommu.c b/arch/x86/kernel/amd_iommu.c
index 1aae617..74ce61d 100644
--- a/arch/x86/kernel/amd_iommu.c
+++ b/arch/x86/kernel/amd_iommu.c
@@ -1046,7 +1046,7 @@ static int alloc_new_range(struct dma_ops_domain *dma_dom,
if (!pte || !IOMMU_PTE_PRESENT(*pte))
continue;
- dma_ops_reserve_addresses(dma_dom, i << PAGE_SHIFT, 1);
+ dma_ops_reserve_addresses(dma_dom, i >> PAGE_SHIFT, 1);
}
update_domain(&dma_dom->domain);
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 092/165] carminefb: Fix module parameters permissions
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (90 preceding siblings ...)
2012-08-15 19:47 ` [v2.6.34-stable 091/165] iommu/amd: Fix wrong shift direction Paul Gortmaker
@ 2012-08-15 19:47 ` Paul Gortmaker
2012-08-15 19:47 ` [v2.6.34-stable 093/165] uvcvideo: Set alternate setting 0 on resume if the bus has been reset Paul Gortmaker
` (72 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:47 UTC (permalink / raw)
To: stable, linux-kernel
Cc: Jean Delvare, Paul Mundt, Sebastian Siewior, Paul Gortmaker
From: Jean Delvare <jdelvare@suse.de>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit c84c14224bbca6ec60d5851fcc87be0e34df2f44 upstream.
The third parameter of module_param is supposed to be an octal value.
The missing leading "0" causes the following:
$ ls -l /sys/module/carminefb/parameters/
total 0
-rw-rwxr-- 1 root root 4096 Jul 8 08:55 fb_displays
-rw-rwxr-- 1 root root 4096 Jul 8 08:55 fb_mode
-rw-rwxr-- 1 root root 4096 Jul 8 08:55 fb_mode_str
After fixing the perm parameter, we get the expected:
$ ls -l /sys/module/carminefb/parameters/
total 0
-r--r--r-- 1 root root 4096 Jul 8 08:56 fb_displays
-r--r--r-- 1 root root 4096 Jul 8 08:56 fb_mode
-r--r--r-- 1 root root 4096 Jul 8 08:56 fb_mode_str
Signed-off-by: Jean Delvare <jdelvare@suse.de>
Cc: Paul Mundt <lethal@linux-sh.org>
Cc: Sebastian Siewior <bigeasy@linutronix.de>
Signed-off-by: Paul Mundt <lethal@linux-sh.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/video/carminefb.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/video/carminefb.c b/drivers/video/carminefb.c
index d8345fc..96b52a4 100644
--- a/drivers/video/carminefb.c
+++ b/drivers/video/carminefb.c
@@ -32,11 +32,11 @@
#define CARMINEFB_DEFAULT_VIDEO_MODE 1
static unsigned int fb_mode = CARMINEFB_DEFAULT_VIDEO_MODE;
-module_param(fb_mode, uint, 444);
+module_param(fb_mode, uint, 0444);
MODULE_PARM_DESC(fb_mode, "Initial video mode as integer.");
static char *fb_mode_str;
-module_param(fb_mode_str, charp, 444);
+module_param(fb_mode_str, charp, 0444);
MODULE_PARM_DESC(fb_mode_str, "Initial video mode in characters.");
/*
@@ -46,7 +46,7 @@ MODULE_PARM_DESC(fb_mode_str, "Initial video mode in characters.");
* 0b010 Display 1
*/
static int fb_displays = CARMINE_USE_DISPLAY0 | CARMINE_USE_DISPLAY1;
-module_param(fb_displays, int, 444);
+module_param(fb_displays, int, 0444);
MODULE_PARM_DESC(fb_displays, "Bit mode, which displays are used");
struct carmine_hw {
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 093/165] uvcvideo: Set alternate setting 0 on resume if the bus has been reset
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (91 preceding siblings ...)
2012-08-15 19:47 ` [v2.6.34-stable 092/165] carminefb: Fix module parameters permissions Paul Gortmaker
@ 2012-08-15 19:47 ` Paul Gortmaker
2012-08-15 19:47 ` [v2.6.34-stable 094/165] tuner_xc2028: Allow selection of the frequency adjustment code for XC3028 Paul Gortmaker
` (71 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:47 UTC (permalink / raw)
To: stable, linux-kernel
Cc: Ming Lei, Ming Lei, Laurent Pinchart, Mauro Carvalho Chehab,
Paul Gortmaker
From: Ming Lei <tom.leiming@gmail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit d59a7b1dbce8b972ec2dc9fcaaae0bfa23687423 upstream.
If the bus has been reset on resume, set the alternate setting to 0.
This should be the default value, but some devices crash or otherwise
misbehave if they don't receive a SET_INTERFACE request before any other
video control request.
Microdia's 0c45:6437 camera has been found to require this change or it
will stop sending video data after resume.
uvc_video.c]
Signed-off-by: Ming Lei <ming.lei@canonical.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/media/video/uvc/uvc_driver.c | 2 +-
drivers/media/video/uvc/uvc_video.c | 10 +++++++++-
drivers/media/video/uvc/uvcvideo.h | 2 +-
3 files changed, 11 insertions(+), 3 deletions(-)
diff --git a/drivers/media/video/uvc/uvc_driver.c b/drivers/media/video/uvc/uvc_driver.c
index 838b56f..590b817 100644
--- a/drivers/media/video/uvc/uvc_driver.c
+++ b/drivers/media/video/uvc/uvc_driver.c
@@ -1885,7 +1885,7 @@ static int __uvc_resume(struct usb_interface *intf, int reset)
list_for_each_entry(stream, &dev->streams, list) {
if (stream->intf == intf)
- return uvc_video_resume(stream);
+ return uvc_video_resume(stream, reset);
}
uvc_trace(UVC_TRACE_SUSPEND, "Resume: video streaming USB interface "
diff --git a/drivers/media/video/uvc/uvc_video.c b/drivers/media/video/uvc/uvc_video.c
index 687c970..a96f9ea 100644
--- a/drivers/media/video/uvc/uvc_video.c
+++ b/drivers/media/video/uvc/uvc_video.c
@@ -1056,10 +1056,18 @@ int uvc_video_suspend(struct uvc_streaming *stream)
* buffers, making sure userspace applications are notified of the problem
* instead of waiting forever.
*/
-int uvc_video_resume(struct uvc_streaming *stream)
+int uvc_video_resume(struct uvc_streaming *stream, int reset)
{
int ret;
+ /* If the bus has been reset on resume, set the alternate setting to 0.
+ * This should be the default value, but some devices crash or otherwise
+ * misbehave if they don't receive a SET_INTERFACE request before any
+ * other video control request.
+ */
+ if (reset)
+ usb_set_interface(stream->dev->udev, stream->intfnum, 0);
+
stream->frozen = 0;
ret = uvc_commit_video(stream, &stream->ctrl);
diff --git a/drivers/media/video/uvc/uvcvideo.h b/drivers/media/video/uvc/uvcvideo.h
index d1f8840..1180ec7 100644
--- a/drivers/media/video/uvc/uvcvideo.h
+++ b/drivers/media/video/uvc/uvcvideo.h
@@ -596,7 +596,7 @@ extern const struct v4l2_file_operations uvc_fops;
/* Video */
extern int uvc_video_init(struct uvc_streaming *stream);
extern int uvc_video_suspend(struct uvc_streaming *stream);
-extern int uvc_video_resume(struct uvc_streaming *stream);
+extern int uvc_video_resume(struct uvc_streaming *stream, int reset);
extern int uvc_video_enable(struct uvc_streaming *stream, int enable);
extern int uvc_probe_video(struct uvc_streaming *stream,
struct uvc_streaming_control *probe);
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 094/165] tuner_xc2028: Allow selection of the frequency adjustment code for XC3028
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (92 preceding siblings ...)
2012-08-15 19:47 ` [v2.6.34-stable 093/165] uvcvideo: Set alternate setting 0 on resume if the bus has been reset Paul Gortmaker
@ 2012-08-15 19:47 ` Paul Gortmaker
2012-08-15 19:47 ` [v2.6.34-stable 095/165] plat-mxc: iomux-v3.h: implicitly enable pull-up/down when that's desired Paul Gortmaker
` (70 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:47 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Mauro Carvalho Chehab, Paul Gortmaker
From: Mauro Carvalho Chehab <mchehab@redhat.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 9bed77ee2fb46b74782d0d9d14b92e9d07f3df6e upstream.
This device is not using the proper demod IF. Instead of using the
IF macro, it is specifying a IF frequency. This doesn't work, as xc3028
needs to load an specific SCODE for the tuner. In this case, there's
no IF table for 5 MHz.
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/media/video/cx23885/cx23885-dvb.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/video/cx23885/cx23885-dvb.c b/drivers/media/video/cx23885/cx23885-dvb.c
index 939079d..3f85b6c 100644
--- a/drivers/media/video/cx23885/cx23885-dvb.c
+++ b/drivers/media/video/cx23885/cx23885-dvb.c
@@ -747,7 +747,7 @@ static int dvb_register(struct cx23885_tsport *port)
static struct xc2028_ctrl ctl = {
.fname = XC3028L_DEFAULT_FIRMWARE,
.max_len = 64,
- .demod = 5000,
+ .demod = XC3028_FE_DIBCOM52,
/* This is true for all demods with
v36 firmware? */
.type = XC2028_D2633,
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 095/165] plat-mxc: iomux-v3.h: implicitly enable pull-up/down when that's desired
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (93 preceding siblings ...)
2012-08-15 19:47 ` [v2.6.34-stable 094/165] tuner_xc2028: Allow selection of the frequency adjustment code for XC3028 Paul Gortmaker
@ 2012-08-15 19:47 ` Paul Gortmaker
2012-08-15 19:47 ` [v2.6.34-stable 096/165] um: fix ubd cow size Paul Gortmaker
` (69 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:47 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Paul Fertser, Sascha Hauer, Paul Gortmaker
From: Paul Fertser <fercerpav@gmail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 6571534b600b8ca1936ff5630b9e0947f21faf16 upstream.
To configure pads during the initialisation a set of special constants
is used, e.g.
#define MX25_PAD_FEC_MDIO__FEC_MDIO IOMUX_PAD(0x3c4, 0x1cc, 0x10, 0, 0, PAD_CTL_HYS | PAD_CTL_PUS_22K_UP)
The problem is that no pull-up/down is getting activated unless both
PAD_CTL_PUE (pull-up enable) and PAD_CTL_PKE (pull/keeper module
enable) set. This is clearly stated in the i.MX25 datasheet and is
confirmed by the measurements on hardware. This leads to some rather
hard to understand bugs such as misdetecting an absent ethernet PHY (a
real bug i had), unstable data transfer etc. This might affect mx25,
mx35, mx50, mx51 and mx53 SoCs.
It's reasonable to expect that if the pullup value is specified, the
intention was to have it actually active, so we implicitly add the
needed bits.
Signed-off-by: Paul Fertser <fercerpav@gmail.com>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/arm/plat-mxc/include/mach/iomux-v3.h | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/arch/arm/plat-mxc/include/mach/iomux-v3.h b/arch/arm/plat-mxc/include/mach/iomux-v3.h
index f2f73d3..1f0b102 100644
--- a/arch/arm/plat-mxc/include/mach/iomux-v3.h
+++ b/arch/arm/plat-mxc/include/mach/iomux-v3.h
@@ -73,11 +73,11 @@ struct pad_desc {
#define PAD_CTL_HYS (1 << 8)
#define PAD_CTL_PKE (1 << 7)
-#define PAD_CTL_PUE (1 << 6)
-#define PAD_CTL_PUS_100K_DOWN (0 << 4)
-#define PAD_CTL_PUS_47K_UP (1 << 4)
-#define PAD_CTL_PUS_100K_UP (2 << 4)
-#define PAD_CTL_PUS_22K_UP (3 << 4)
+#define PAD_CTL_PUE (1 << 6 | PAD_CTL_PKE)
+#define PAD_CTL_PUS_100K_DOWN (0 << 4 | PAD_CTL_PUE)
+#define PAD_CTL_PUS_47K_UP (1 << 4 | PAD_CTL_PUE)
+#define PAD_CTL_PUS_100K_UP (2 << 4 | PAD_CTL_PUE)
+#define PAD_CTL_PUS_22K_UP (3 << 4 | PAD_CTL_PUE)
#define PAD_CTL_ODE (1 << 3)
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 096/165] um: fix ubd cow size
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (94 preceding siblings ...)
2012-08-15 19:47 ` [v2.6.34-stable 095/165] plat-mxc: iomux-v3.h: implicitly enable pull-up/down when that's desired Paul Gortmaker
@ 2012-08-15 19:47 ` Paul Gortmaker
2012-08-15 19:47 ` [v2.6.34-stable 097/165] xen/timer: Missing IRQF_NO_SUSPEND in timer code broke suspend Paul Gortmaker
` (68 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:47 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Richard Weinberger, Paul Gortmaker
From: Richard Weinberger <richard@nod.at>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 8535639810e578960233ad39def3ac2157b0c3ec upstream.
ubd_file_size() cannot use ubd_dev->cow.file because at this time
ubd_dev->cow.file is not initialized.
Therefore, ubd_file_size() will always report a wrong disk size when
COW files are used.
Reading from /dev/ubd* would crash the kernel.
We have to read the correct disk size from the COW file's backing
file.
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/um/drivers/ubd_kern.c | 31 ++++++++++++++++++++++++++++++-
1 file changed, 30 insertions(+), 1 deletion(-)
diff --git a/arch/um/drivers/ubd_kern.c b/arch/um/drivers/ubd_kern.c
index 3d63b83..1cbad01 100644
--- a/arch/um/drivers/ubd_kern.c
+++ b/arch/um/drivers/ubd_kern.c
@@ -511,8 +511,37 @@ __uml_exitcall(kill_io_thread);
static inline int ubd_file_size(struct ubd *ubd_dev, __u64 *size_out)
{
char *file;
+ int fd;
+ int err;
+
+ __u32 version;
+ __u32 align;
+ char *backing_file;
+ time_t mtime;
+ unsigned long long size;
+ int sector_size;
+ int bitmap_offset;
+
+ if (ubd_dev->file && ubd_dev->cow.file) {
+ file = ubd_dev->cow.file;
+
+ goto out;
+ }
- file = ubd_dev->cow.file ? ubd_dev->cow.file : ubd_dev->file;
+ fd = os_open_file(ubd_dev->file, global_openflags, 0);
+ if (fd < 0)
+ return fd;
+
+ err = read_cow_header(file_reader, &fd, &version, &backing_file, \
+ &mtime, &size, §or_size, &align, &bitmap_offset);
+ os_close_file(fd);
+
+ if(err == -EINVAL)
+ file = ubd_dev->file;
+ else
+ file = backing_file;
+
+out:
return os_file_size(file, size_out);
}
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 097/165] xen/timer: Missing IRQF_NO_SUSPEND in timer code broke suspend.
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (95 preceding siblings ...)
2012-08-15 19:47 ` [v2.6.34-stable 096/165] um: fix ubd cow size Paul Gortmaker
@ 2012-08-15 19:47 ` Paul Gortmaker
2012-08-15 19:47 ` [v2.6.34-stable 098/165] thinkpad-acpi: module autoloading for newer Lenovo ThinkPads Paul Gortmaker
` (67 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:47 UTC (permalink / raw)
To: stable, linux-kernel
Cc: Ian Campbell, Ian Campbell, Konrad Rzeszutek Wilk, Paul Gortmaker
From: Ian Campbell <Ian.Campbell@citrix.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit f611f2da99420abc973c32cdbddbf5c365d0a20c upstream.
The patches missed an indirect use of IRQF_NO_SUSPEND pulled in via
IRQF_TIMER. The following patch fixes the issue.
With this fixlet PV guest migration works just fine. I also booted the
entire series as a dom0 kernel and it appeared fine.
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/x86/xen/time.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/arch/x86/xen/time.c b/arch/x86/xen/time.c
index a05bda6..fb2b388 100644
--- a/arch/x86/xen/time.c
+++ b/arch/x86/xen/time.c
@@ -396,7 +396,9 @@ void xen_setup_timer(int cpu)
name = "<timer kasprintf failed>";
irq = bind_virq_to_irqhandler(VIRQ_TIMER, cpu, xen_timer_interrupt,
- IRQF_DISABLED|IRQF_PERCPU|IRQF_NOBALANCING|IRQF_TIMER,
+ IRQF_DISABLED|IRQF_PERCPU|
+ IRQF_NOBALANCING|IRQF_TIMER|
+ IRQF_FORCE_RESUME,
name, NULL);
evt = &per_cpu(xen_clock_events, cpu);
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 098/165] thinkpad-acpi: module autoloading for newer Lenovo ThinkPads.
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (96 preceding siblings ...)
2012-08-15 19:47 ` [v2.6.34-stable 097/165] xen/timer: Missing IRQF_NO_SUSPEND in timer code broke suspend Paul Gortmaker
@ 2012-08-15 19:47 ` Paul Gortmaker
2012-08-15 19:47 ` [v2.6.34-stable 099/165] scm: lower SCM_MAX_FD Paul Gortmaker
` (66 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:47 UTC (permalink / raw)
To: stable, linux-kernel
Cc: Manoj Iyer, Andy Lutomirski, Matthew Garrett, Paul Gortmaker
From: Manoj Iyer <manoj.iyer@canonical.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 9fbdaeb4f4dd14a0caa9fc35c496d5440c251a3a upstream.
The newer Lenovo ThinkPads have HKEY HID of LEN0068 instead
of IBM0068. Added new HID so that thinkpad_acpi module will
auto load on these newer Lenovo ThinkPads.
Acked-by: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
Signed-off-by: Manoj Iyer <manoj.iyer@canonical.com>
Signed-off-by: Andy Lutomirski <luto@mit.edu>
Signed-off-by: Matthew Garrett <mjg@redhat.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/platform/x86/thinkpad_acpi.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
index 63290b3..73d6ddc 100644
--- a/drivers/platform/x86/thinkpad_acpi.c
+++ b/drivers/platform/x86/thinkpad_acpi.c
@@ -123,7 +123,8 @@ enum {
};
/* ACPI HIDs */
-#define TPACPI_ACPI_HKEY_HID "IBM0068"
+#define TPACPI_ACPI_IBM_HKEY_HID "IBM0068"
+#define TPACPI_ACPI_LENOVO_HKEY_HID "LEN0068"
/* Input IDs */
#define TPACPI_HKEY_INPUT_PRODUCT 0x5054 /* "TP" */
@@ -3850,7 +3851,8 @@ errexit:
}
static const struct acpi_device_id ibm_htk_device_ids[] = {
- {TPACPI_ACPI_HKEY_HID, 0},
+ {TPACPI_ACPI_IBM_HKEY_HID, 0},
+ {TPACPI_ACPI_LENOVO_HKEY_HID, 0},
{"", 0},
};
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 099/165] scm: lower SCM_MAX_FD
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (97 preceding siblings ...)
2012-08-15 19:47 ` [v2.6.34-stable 098/165] thinkpad-acpi: module autoloading for newer Lenovo ThinkPads Paul Gortmaker
@ 2012-08-15 19:47 ` Paul Gortmaker
2012-08-15 19:47 ` [v2.6.34-stable 100/165] deal with races in /proc/*/{syscall,stack,personality} Paul Gortmaker
` (65 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:47 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Eric Dumazet, David S. Miller, Paul Gortmaker
From: Eric Dumazet <eric.dumazet@gmail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit bba14de98753cb6599a2dae0e520714b2153522d upstream.
Lower SCM_MAX_FD from 255 to 253 so that allocations for scm_fp_list are
halved. (commit f8d570a4 added two pointers in this structure)
scm_fp_dup() should not copy whole structure (and trigger kmemcheck
warnings), but only the used part. While we are at it, only allocate
needed size.
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
include/net/scm.h | 5 +++--
net/core/scm.c | 10 ++++++----
2 files changed, 9 insertions(+), 6 deletions(-)
diff --git a/include/net/scm.h b/include/net/scm.h
index 8360e47..8b5cccd 100644
--- a/include/net/scm.h
+++ b/include/net/scm.h
@@ -10,11 +10,12 @@
/* Well, we should have at least one descriptor open
* to accept passed FDs 8)
*/
-#define SCM_MAX_FD 255
+#define SCM_MAX_FD 253
struct scm_fp_list {
struct list_head list;
- int count;
+ short count;
+ short max;
struct file *fp[SCM_MAX_FD];
};
diff --git a/net/core/scm.c b/net/core/scm.c
index b88f6f9..ddc0448 100644
--- a/net/core/scm.c
+++ b/net/core/scm.c
@@ -79,10 +79,11 @@ static int scm_fp_copy(struct cmsghdr *cmsg, struct scm_fp_list **fplp)
return -ENOMEM;
*fplp = fpl;
fpl->count = 0;
+ fpl->max = SCM_MAX_FD;
}
fpp = &fpl->fp[fpl->count];
- if (fpl->count + num > SCM_MAX_FD)
+ if (fpl->count + num > fpl->max)
return -EINVAL;
/*
@@ -303,11 +304,12 @@ struct scm_fp_list *scm_fp_dup(struct scm_fp_list *fpl)
if (!fpl)
return NULL;
- new_fpl = kmalloc(sizeof(*fpl), GFP_KERNEL);
+ new_fpl = kmemdup(fpl, offsetof(struct scm_fp_list, fp[fpl->count]),
+ GFP_KERNEL);
if (new_fpl) {
- for (i=fpl->count-1; i>=0; i--)
+ for (i = 0; i < fpl->count; i++)
get_file(fpl->fp[i]);
- memcpy(new_fpl, fpl, sizeof(*fpl));
+ new_fpl->max = new_fpl->count;
}
return new_fpl;
}
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 100/165] deal with races in /proc/*/{syscall,stack,personality}
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (98 preceding siblings ...)
2012-08-15 19:47 ` [v2.6.34-stable 099/165] scm: lower SCM_MAX_FD Paul Gortmaker
@ 2012-08-15 19:47 ` Paul Gortmaker
2012-08-15 19:47 ` [v2.6.34-stable 101/165] NLM: Don't hang forever on NLM unlock requests Paul Gortmaker
` (64 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:47 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Al Viro, Paul Gortmaker
From: Al Viro <viro@zeniv.linux.org.uk>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit a9712bc12c40c172e393f85a9b2ba8db4bf59509 upstream.
All of those are rw-r--r-- and all are broken for suid - if you open
a file before the target does suid-root exec, you'll be still able
to access it. For personality it's not a big deal, but for syscall
and stack it's a real problem.
Fix: check that task is tracable for you at the time of read().
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
[PG: in .34 cred_guard_mutex is in task, not task->signal]
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/proc/base.c | 69 ++++++++++++++++++++++++++++++++++++++++++----------------
1 file changed, 50 insertions(+), 19 deletions(-)
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 08741b0..16af014 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -329,6 +329,23 @@ static int proc_pid_wchan(struct task_struct *task, char *buffer)
}
#endif /* CONFIG_KALLSYMS */
+static int lock_trace(struct task_struct *task)
+{
+ int err = mutex_lock_killable(&task->cred_guard_mutex);
+ if (err)
+ return err;
+ if (!ptrace_may_access(task, PTRACE_MODE_ATTACH)) {
+ mutex_unlock(&task->cred_guard_mutex);
+ return -EPERM;
+ }
+ return 0;
+}
+
+static void unlock_trace(struct task_struct *task)
+{
+ mutex_unlock(&task->cred_guard_mutex);
+}
+
#ifdef CONFIG_STACKTRACE
#define MAX_STACK_TRACE_DEPTH 64
@@ -338,6 +355,7 @@ static int proc_pid_stack(struct seq_file *m, struct pid_namespace *ns,
{
struct stack_trace trace;
unsigned long *entries;
+ int err;
int i;
entries = kmalloc(MAX_STACK_TRACE_DEPTH * sizeof(*entries), GFP_KERNEL);
@@ -348,15 +366,20 @@ static int proc_pid_stack(struct seq_file *m, struct pid_namespace *ns,
trace.max_entries = MAX_STACK_TRACE_DEPTH;
trace.entries = entries;
trace.skip = 0;
- save_stack_trace_tsk(task, &trace);
- for (i = 0; i < trace.nr_entries; i++) {
- seq_printf(m, "[<%p>] %pS\n",
- (void *)entries[i], (void *)entries[i]);
+ err = lock_trace(task);
+ if (!err) {
+ save_stack_trace_tsk(task, &trace);
+
+ for (i = 0; i < trace.nr_entries; i++) {
+ seq_printf(m, "[<%p>] %pS\n",
+ (void *)entries[i], (void *)entries[i]);
+ }
+ unlock_trace(task);
}
kfree(entries);
- return 0;
+ return err;
}
#endif
@@ -528,18 +551,22 @@ static int proc_pid_syscall(struct task_struct *task, char *buffer)
{
long nr;
unsigned long args[6], sp, pc;
+ int res = lock_trace(task);
+ if (res)
+ return res;
if (task_current_syscall(task, &nr, args, 6, &sp, &pc))
- return sprintf(buffer, "running\n");
-
- if (nr < 0)
- return sprintf(buffer, "%ld 0x%lx 0x%lx\n", nr, sp, pc);
-
- return sprintf(buffer,
+ res = sprintf(buffer, "running\n");
+ else if (nr < 0)
+ res = sprintf(buffer, "%ld 0x%lx 0x%lx\n", nr, sp, pc);
+ else
+ res = sprintf(buffer,
"%ld 0x%lx 0x%lx 0x%lx 0x%lx 0x%lx 0x%lx 0x%lx 0x%lx\n",
nr,
args[0], args[1], args[2], args[3], args[4], args[5],
sp, pc);
+ unlock_trace(task);
+ return res;
}
#endif /* CONFIG_HAVE_ARCH_TRACEHOOK */
@@ -2561,8 +2588,12 @@ static int proc_tgid_io_accounting(struct task_struct *task, char *buffer)
static int proc_pid_personality(struct seq_file *m, struct pid_namespace *ns,
struct pid *pid, struct task_struct *task)
{
- seq_printf(m, "%08x\n", task->personality);
- return 0;
+ int err = lock_trace(task);
+ if (!err) {
+ seq_printf(m, "%08x\n", task->personality);
+ unlock_trace(task);
+ }
+ return err;
}
/*
@@ -2581,14 +2612,14 @@ static const struct pid_entry tgid_base_stuff[] = {
REG("environ", S_IRUSR, proc_environ_operations),
INF("auxv", S_IRUSR, proc_pid_auxv),
ONE("status", S_IRUGO, proc_pid_status),
- ONE("personality", S_IRUSR, proc_pid_personality),
+ ONE("personality", S_IRUGO, proc_pid_personality),
INF("limits", S_IRUSR, proc_pid_limits),
#ifdef CONFIG_SCHED_DEBUG
REG("sched", S_IRUGO|S_IWUSR, proc_pid_sched_operations),
#endif
REG("comm", S_IRUGO|S_IWUSR, proc_pid_set_comm_operations),
#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
- INF("syscall", S_IRUSR, proc_pid_syscall),
+ INF("syscall", S_IRUGO, proc_pid_syscall),
#endif
INF("cmdline", S_IRUGO, proc_pid_cmdline),
ONE("stat", S_IRUGO, proc_tgid_stat),
@@ -2616,7 +2647,7 @@ static const struct pid_entry tgid_base_stuff[] = {
INF("wchan", S_IRUGO, proc_pid_wchan),
#endif
#ifdef CONFIG_STACKTRACE
- ONE("stack", S_IRUSR, proc_pid_stack),
+ ONE("stack", S_IRUGO, proc_pid_stack),
#endif
#ifdef CONFIG_SCHEDSTATS
INF("schedstat", S_IRUGO, proc_pid_schedstat),
@@ -2921,14 +2952,14 @@ static const struct pid_entry tid_base_stuff[] = {
REG("environ", S_IRUSR, proc_environ_operations),
INF("auxv", S_IRUSR, proc_pid_auxv),
ONE("status", S_IRUGO, proc_pid_status),
- ONE("personality", S_IRUSR, proc_pid_personality),
+ ONE("personality", S_IRUGO, proc_pid_personality),
INF("limits", S_IRUSR, proc_pid_limits),
#ifdef CONFIG_SCHED_DEBUG
REG("sched", S_IRUGO|S_IWUSR, proc_pid_sched_operations),
#endif
REG("comm", S_IRUGO|S_IWUSR, proc_pid_set_comm_operations),
#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
- INF("syscall", S_IRUSR, proc_pid_syscall),
+ INF("syscall", S_IRUGO, proc_pid_syscall),
#endif
INF("cmdline", S_IRUGO, proc_pid_cmdline),
ONE("stat", S_IRUGO, proc_tid_stat),
@@ -2955,7 +2986,7 @@ static const struct pid_entry tid_base_stuff[] = {
INF("wchan", S_IRUGO, proc_pid_wchan),
#endif
#ifdef CONFIG_STACKTRACE
- ONE("stack", S_IRUSR, proc_pid_stack),
+ ONE("stack", S_IRUGO, proc_pid_stack),
#endif
#ifdef CONFIG_SCHEDSTATS
INF("schedstat", S_IRUGO, proc_pid_schedstat),
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 101/165] NLM: Don't hang forever on NLM unlock requests
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (99 preceding siblings ...)
2012-08-15 19:47 ` [v2.6.34-stable 100/165] deal with races in /proc/*/{syscall,stack,personality} Paul Gortmaker
@ 2012-08-15 19:47 ` Paul Gortmaker
2012-08-15 19:47 ` [v2.6.34-stable 102/165] Bluetooth: l2cap and rfcomm: fix 1 byte infoleak to userspace Paul Gortmaker
` (63 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:47 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Trond Myklebust, Paul Gortmaker
From: Trond Myklebust <Trond.Myklebust@netapp.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 0b760113a3a155269a3fba93a409c640031dd68f upstream.
If the NLM daemon is killed on the NFS server, we can currently end up
hanging forever on an 'unlock' request, instead of aborting. Basically,
if the rpcbind request fails, or the server keeps returning garbage, we
really want to quit instead of retrying.
Tested-by: Vasily Averin <vvs@sw.ru>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
[PG: struct rpc_task in sched.h slightly different layout vs. v3.0]
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/lockd/clntproc.c | 8 +++++++-
include/linux/sunrpc/sched.h | 1 +
net/sunrpc/clnt.c | 3 +++
net/sunrpc/sched.c | 1 +
4 files changed, 12 insertions(+), 1 deletion(-)
diff --git a/fs/lockd/clntproc.c b/fs/lockd/clntproc.c
index 7932c39..f4ef9d1 100644
--- a/fs/lockd/clntproc.c
+++ b/fs/lockd/clntproc.c
@@ -710,7 +710,13 @@ static void nlmclnt_unlock_callback(struct rpc_task *task, void *data)
if (task->tk_status < 0) {
dprintk("lockd: unlock failed (err = %d)\n", -task->tk_status);
- goto retry_rebind;
+ switch (task->tk_status) {
+ case -EACCES:
+ case -EIO:
+ goto die;
+ default:
+ goto retry_rebind;
+ }
}
if (status == NLM_LCK_DENIED_GRACE_PERIOD) {
rpc_delay(task, NLMCLNT_GRACE_WAIT);
diff --git a/include/linux/sunrpc/sched.h b/include/linux/sunrpc/sched.h
index 7bc7fd5..f2338ca 100644
--- a/include/linux/sunrpc/sched.h
+++ b/include/linux/sunrpc/sched.h
@@ -55,6 +55,7 @@ struct rpc_task {
struct rpc_message tk_msg; /* RPC call info */
__u8 tk_garb_retry;
__u8 tk_cred_retry;
+ __u8 tk_rebind_retry;
/*
* callback to be executed after waking up
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index 0ad7828..018903c 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -1053,6 +1053,9 @@ call_bind_status(struct rpc_task *task)
status = -EOPNOTSUPP;
break;
}
+ if (task->tk_rebind_retry == 0)
+ break;
+ task->tk_rebind_retry--;
rpc_delay(task, 3*HZ);
goto retry_timeout;
case -ETIMEDOUT:
diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
index 416ca5e..e961e06 100644
--- a/net/sunrpc/sched.c
+++ b/net/sunrpc/sched.c
@@ -799,6 +799,7 @@ static void rpc_init_task(struct rpc_task *task, const struct rpc_task_setup *ta
/* Initialize retry counters */
task->tk_garb_retry = 2;
task->tk_cred_retry = 2;
+ task->tk_rebind_retry = 2;
task->tk_priority = task_setup_data->priority - RPC_PRIORITY_LOW;
task->tk_owner = current->tgid;
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 102/165] Bluetooth: l2cap and rfcomm: fix 1 byte infoleak to userspace.
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (100 preceding siblings ...)
2012-08-15 19:47 ` [v2.6.34-stable 101/165] NLM: Don't hang forever on NLM unlock requests Paul Gortmaker
@ 2012-08-15 19:47 ` Paul Gortmaker
2012-08-15 19:47 ` [v2.6.34-stable 103/165] vm: fix vm_pgoff wrap in upward expansion Paul Gortmaker
` (62 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:47 UTC (permalink / raw)
To: stable, linux-kernel
Cc: Filip Palian, Filip Palian, Gustavo F. Padovan, Paul Gortmaker
From: Filip Palian <s3810@pjwstk.edu.pl>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 8d03e971cf403305217b8e62db3a2e5ad2d6263f upstream.
Structures "l2cap_conninfo" and "rfcomm_conninfo" have one padding
byte each. This byte in "cinfo" is copied to userspace uninitialized.
Signed-off-by: Filip Palian <filip.palian@pjwstk.edu.pl>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
[PG: l2cap_sock.c chunk is in l2cap.c in a 2.6.34 context/baseline]
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
net/bluetooth/l2cap.c | 1 +
net/bluetooth/rfcomm/sock.c | 1 +
2 files changed, 2 insertions(+)
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index b21e319..0b6cf87 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -1898,6 +1898,7 @@ static int l2cap_sock_getsockopt_old(struct socket *sock, int optname, char __us
break;
}
+ memset(&cinfo, 0, sizeof(cinfo));
cinfo.hci_handle = l2cap_pi(sk)->conn->hcon->handle;
memcpy(cinfo.dev_class, l2cap_pi(sk)->conn->hcon->dev_class, 3);
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index 8ed3c37..b045bbb 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -882,6 +882,7 @@ static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname, char __u
l2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk;
+ memset(&cinfo, 0, sizeof(cinfo));
cinfo.hci_handle = l2cap_pi(l2cap_sk)->conn->hcon->handle;
memcpy(cinfo.dev_class, l2cap_pi(l2cap_sk)->conn->hcon->dev_class, 3);
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 103/165] vm: fix vm_pgoff wrap in upward expansion
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (101 preceding siblings ...)
2012-08-15 19:47 ` [v2.6.34-stable 102/165] Bluetooth: l2cap and rfcomm: fix 1 byte infoleak to userspace Paul Gortmaker
@ 2012-08-15 19:47 ` Paul Gortmaker
2012-08-15 19:47 ` [v2.6.34-stable 104/165] drivers/net/rionet.c: fix ethernet address macros for LE platforms Paul Gortmaker
` (61 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:47 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Hugh Dickins, Linus Torvalds, Paul Gortmaker
From: Hugh Dickins <hughd@google.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 42c36f63ac1366ab0ecc2d5717821362c259f517 upstream.
Commit a626ca6a6564 ("vm: fix vm_pgoff wrap in stack expansion") fixed
the case of an expanding mapping causing vm_pgoff wrapping when you had
downward stack expansion. But there was another case where IA64 and
PA-RISC expand mappings: upward expansion.
This fixes that case too.
Signed-off-by: Hugh Dickins <hughd@google.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[PG: .34 doesn't have perf call via 3af9e859 (in .36); adjust accordingly]
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
mm/mmap.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/mm/mmap.c b/mm/mmap.c
index fe9b76a..053c540 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -1740,9 +1740,12 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
size = address - vma->vm_start;
grow = (address - vma->vm_end) >> PAGE_SHIFT;
- error = acct_stack_growth(vma, size, grow);
- if (!error)
- vma->vm_end = address;
+ error = -ENOMEM;
+ if (vma->vm_pgoff + (size >> PAGE_SHIFT) >= vma->vm_pgoff) {
+ error = acct_stack_growth(vma, size, grow);
+ if (!error)
+ vma->vm_end = address;
+ }
}
anon_vma_unlock(vma);
return error;
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 104/165] drivers/net/rionet.c: fix ethernet address macros for LE platforms
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (102 preceding siblings ...)
2012-08-15 19:47 ` [v2.6.34-stable 103/165] vm: fix vm_pgoff wrap in upward expansion Paul Gortmaker
@ 2012-08-15 19:47 ` Paul Gortmaker
2012-08-15 19:47 ` [v2.6.34-stable 105/165] ext2,ext3,ext4: don't inherit APPEND_FL or IMMUTABLE_FL for new inodes Paul Gortmaker
` (60 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:47 UTC (permalink / raw)
To: stable, linux-kernel
Cc: Alexandre Bounine, Chul Kim, Kumar Gala, Matt Porter, Li Yang,
Andrew Morton, Linus Torvalds, Paul Gortmaker
From: Alexandre Bounine <alexandre.bounine@idt.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit e0c87bd95e8dad455c23bc56513af8dcb1737e55 upstream.
Modify Ethernet addess macros to be compatible with BE/LE platforms
Signed-off-by: Alexandre Bounine <alexandre.bounine@idt.com>
Cc: Chul Kim <chul.kim@idt.com>
Cc: Kumar Gala <galak@kernel.crashing.org>
Cc: Matt Porter <mporter@kernel.crashing.org>
Cc: Li Yang <leoli@freescale.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/net/rionet.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/rionet.c b/drivers/net/rionet.c
index 07eb884..0f6cbc8 100644
--- a/drivers/net/rionet.c
+++ b/drivers/net/rionet.c
@@ -88,8 +88,8 @@ static struct rio_dev **rionet_active;
#define dev_rionet_capable(dev) \
is_rionet_capable(dev->pef, dev->src_ops, dev->dst_ops)
-#define RIONET_MAC_MATCH(x) (*(u32 *)x == 0x00010001)
-#define RIONET_GET_DESTID(x) (*(u16 *)(x + 4))
+#define RIONET_MAC_MATCH(x) (!memcmp((x), "\00\01\00\01", 4))
+#define RIONET_GET_DESTID(x) ((*((u8 *)x + 4) << 8) | *((u8 *)x + 5))
static int rionet_rx_clean(struct net_device *ndev)
{
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 105/165] ext2,ext3,ext4: don't inherit APPEND_FL or IMMUTABLE_FL for new inodes
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (103 preceding siblings ...)
2012-08-15 19:47 ` [v2.6.34-stable 104/165] drivers/net/rionet.c: fix ethernet address macros for LE platforms Paul Gortmaker
@ 2012-08-15 19:47 ` Paul Gortmaker
2012-08-15 19:47 ` [v2.6.34-stable 106/165] USB: Serial: Add device ID for Sierra Wireless MC8305 Paul Gortmaker
` (59 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:47 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Theodore Ts'o, Paul Gortmaker
From: Theodore Ts'o <tytso@mit.edu>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 1cd9f0976aa4606db8d6e3dc3edd0aca8019372a upstream.
This doesn't make much sense, and it exposes a bug in the kernel where
attempts to create a new file in an append-only directory using
O_CREAT will fail (but still leave a zero-length file). This was
discovered when xfstests #79 was generalized so it could run on all
file systems.
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/ext4/ext4.h | 3 +--
include/linux/ext2_fs.h | 4 ++--
include/linux/ext3_fs.h | 4 ++--
3 files changed, 5 insertions(+), 6 deletions(-)
diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index 650ef37..f842e7d 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -302,8 +302,7 @@ struct flex_groups {
/* Flags that should be inherited by new inodes from their parent. */
#define EXT4_FL_INHERITED (EXT4_SECRM_FL | EXT4_UNRM_FL | EXT4_COMPR_FL |\
- EXT4_SYNC_FL | EXT4_IMMUTABLE_FL | EXT4_APPEND_FL |\
- EXT4_NODUMP_FL | EXT4_NOATIME_FL |\
+ EXT4_SYNC_FL | EXT4_NODUMP_FL | EXT4_NOATIME_FL |\
EXT4_NOCOMPR_FL | EXT4_JOURNAL_DATA_FL |\
EXT4_NOTAIL_FL | EXT4_DIRSYNC_FL)
diff --git a/include/linux/ext2_fs.h b/include/linux/ext2_fs.h
index 2dfa707..0bfcb76 100644
--- a/include/linux/ext2_fs.h
+++ b/include/linux/ext2_fs.h
@@ -196,8 +196,8 @@ struct ext2_group_desc
/* Flags that should be inherited by new inodes from their parent. */
#define EXT2_FL_INHERITED (EXT2_SECRM_FL | EXT2_UNRM_FL | EXT2_COMPR_FL |\
- EXT2_SYNC_FL | EXT2_IMMUTABLE_FL | EXT2_APPEND_FL |\
- EXT2_NODUMP_FL | EXT2_NOATIME_FL | EXT2_COMPRBLK_FL|\
+ EXT2_SYNC_FL | EXT2_NODUMP_FL |\
+ EXT2_NOATIME_FL | EXT2_COMPRBLK_FL |\
EXT2_NOCOMP_FL | EXT2_JOURNAL_DATA_FL |\
EXT2_NOTAIL_FL | EXT2_DIRSYNC_FL)
diff --git a/include/linux/ext3_fs.h b/include/linux/ext3_fs.h
index 5f494b4..2d861bc 100644
--- a/include/linux/ext3_fs.h
+++ b/include/linux/ext3_fs.h
@@ -180,8 +180,8 @@ struct ext3_group_desc
/* Flags that should be inherited by new inodes from their parent. */
#define EXT3_FL_INHERITED (EXT3_SECRM_FL | EXT3_UNRM_FL | EXT3_COMPR_FL |\
- EXT3_SYNC_FL | EXT3_IMMUTABLE_FL | EXT3_APPEND_FL |\
- EXT3_NODUMP_FL | EXT3_NOATIME_FL | EXT3_COMPRBLK_FL|\
+ EXT3_SYNC_FL | EXT3_NODUMP_FL |\
+ EXT3_NOATIME_FL | EXT3_COMPRBLK_FL |\
EXT3_NOCOMPR_FL | EXT3_JOURNAL_DATA_FL |\
EXT3_NOTAIL_FL | EXT3_DIRSYNC_FL)
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 106/165] USB: Serial: Add device ID for Sierra Wireless MC8305
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (104 preceding siblings ...)
2012-08-15 19:47 ` [v2.6.34-stable 105/165] ext2,ext3,ext4: don't inherit APPEND_FL or IMMUTABLE_FL for new inodes Paul Gortmaker
@ 2012-08-15 19:47 ` Paul Gortmaker
2012-08-15 19:47 ` [v2.6.34-stable 107/165] USB: Serial: Add PID(0xF7C0) to FTDI SIO driver for a zeitcontrol-device Paul Gortmaker
` (58 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:47 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Florian Echtler, Greg Kroah-Hartman, Paul Gortmaker
From: Florian Echtler <floe@butterbrot.org>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 2f1def2695c223b2aa325e5e47d0d64200a45d23 upstream.
A new device ID pair is added for Sierra Wireless MC8305.
Signed-off-by: Florian Echtler <floe@butterbrot.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/usb/serial/qcserial.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
index 7facae0..6869b52 100644
--- a/drivers/usb/serial/qcserial.c
+++ b/drivers/usb/serial/qcserial.c
@@ -76,6 +76,7 @@ static const struct usb_device_id id_table[] = {
{USB_DEVICE(0x1199, 0x9008)}, /* Sierra Wireless Gobi 2000 Modem device (VT773) */
{USB_DEVICE(0x1199, 0x9009)}, /* Sierra Wireless Gobi 2000 Modem device (VT773) */
{USB_DEVICE(0x1199, 0x900a)}, /* Sierra Wireless Gobi 2000 Modem device (VT773) */
+ {USB_DEVICE(0x1199, 0x9011)}, /* Sierra Wireless Gobi 2000 Modem device (MC8305) */
{USB_DEVICE(0x16d8, 0x8001)}, /* CMDTech Gobi 2000 QDL device (VU922) */
{USB_DEVICE(0x16d8, 0x8002)}, /* CMDTech Gobi 2000 Modem device (VU922) */
{ } /* Terminating entry */
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 107/165] USB: Serial: Add PID(0xF7C0) to FTDI SIO driver for a zeitcontrol-device
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (105 preceding siblings ...)
2012-08-15 19:47 ` [v2.6.34-stable 106/165] USB: Serial: Add device ID for Sierra Wireless MC8305 Paul Gortmaker
@ 2012-08-15 19:47 ` Paul Gortmaker
2012-08-15 19:47 ` [v2.6.34-stable 108/165] ACPI/AC: prevent OOPS on some boxes due to missing check power_supply_register() return value check Paul Gortmaker
` (57 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:47 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Artur Zimmer, Greg Kroah-Hartman, Paul Gortmaker
From: Artur Zimmer <artur128@3dzimmer.de>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit ce7e9065958191e6b7ca49d7ed0e1099c486d198 upstream.
Here is a patch for a new PID (zeitcontrol-device mifare-reader FT232BL(like FT232BM but lead free)).
Signed-off-by: Artur Zimmer <artur128@3dzimmer.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/usb/serial/ftdi_sio.c | 1 +
drivers/usb/serial/ftdi_sio_ids.h | 6 ++++++
2 files changed, 7 insertions(+)
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 90dfdb1..24dc63c 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -160,6 +160,7 @@ static struct ftdi_sio_quirk ftdi_8u2232c_quirk = {
* /sys/bus/usb/ftdi_sio/new_id, then send patch/report!
*/
static struct usb_device_id id_table_combined [] = {
+ { USB_DEVICE(FTDI_VID, FTDI_ZEITCONTROL_TAGTRACE_MIFARE_PID) },
{ USB_DEVICE(FTDI_VID, FTDI_CTI_MINI_PID) },
{ USB_DEVICE(FTDI_VID, FTDI_CTI_NANO_PID) },
{ USB_DEVICE(FTDI_VID, FTDI_AMC232_PID) },
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index 1167732..c4670e5 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -1166,3 +1166,9 @@
#define FTDI_CTI_MINI_PID 0xF608
/* USB-Nano-485*/
#define FTDI_CTI_NANO_PID 0xF60B
+
+/*
+ * ZeitControl cardsystems GmbH rfid-readers http://zeitconrol.de
+ */
+/* TagTracer MIFARE*/
+#define FTDI_ZEITCONTROL_TAGTRACE_MIFARE_PID 0xF7C0
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 108/165] ACPI/AC: prevent OOPS on some boxes due to missing check power_supply_register() return value check
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (106 preceding siblings ...)
2012-08-15 19:47 ` [v2.6.34-stable 107/165] USB: Serial: Add PID(0xF7C0) to FTDI SIO driver for a zeitcontrol-device Paul Gortmaker
@ 2012-08-15 19:47 ` Paul Gortmaker
2012-08-15 19:47 ` [v2.6.34-stable 109/165] ntp: Fix leap-second hrtimer livelock Paul Gortmaker
` (56 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:47 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Lan Tianyu, Len Brown, Paul Gortmaker
From: Lan Tianyu <tianyu.lan@intel.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit f197ac13f6eeb351b31250b9ab7d0da17434ea36 upstream.
In the ac.c, power_supply_register()'s return value is not checked.
As a result, the driver's add() ops may return success
even though the device failed to initialize.
For example, some BIOS may describe two ACADs in the same DSDT.
The second ACAD device will fail to register,
but ACPI driver's add() ops returns sucessfully.
The ACPI device will receive ACPI notification and cause OOPS.
https://bugzilla.redhat.com/show_bug.cgi?id=772730
Signed-off-by: Lan Tianyu <tianyu.lan@intel.com>
Cc: stable@vger.kernel.org
Signed-off-by: Len Brown <len.brown@intel.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/acpi/ac.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/acpi/ac.c b/drivers/acpi/ac.c
index 56205a0..4ea5daf 100644
--- a/drivers/acpi/ac.c
+++ b/drivers/acpi/ac.c
@@ -288,7 +288,9 @@ static int acpi_ac_add(struct acpi_device *device)
ac->charger.properties = ac_props;
ac->charger.num_properties = ARRAY_SIZE(ac_props);
ac->charger.get_property = get_ac_property;
- power_supply_register(&ac->device->dev, &ac->charger);
+ result = power_supply_register(&ac->device->dev, &ac->charger);
+ if (result)
+ goto end;
#endif
printk(KERN_INFO PREFIX "%s [%s] (%s)\n",
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 109/165] ntp: Fix leap-second hrtimer livelock
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (107 preceding siblings ...)
2012-08-15 19:47 ` [v2.6.34-stable 108/165] ACPI/AC: prevent OOPS on some boxes due to missing check power_supply_register() return value check Paul Gortmaker
@ 2012-08-15 19:47 ` Paul Gortmaker
2012-08-17 16:17 ` Herton Ronaldo Krzesinski
2012-08-15 19:47 ` [v2.6.34-stable 110/165] ntp: Correct TAI offset during leap second Paul Gortmaker
` (55 subsequent siblings)
164 siblings, 1 reply; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:47 UTC (permalink / raw)
To: stable, linux-kernel
Cc: John Stultz, Sasha Levin, Thomas Gleixner, Prarit Bhargava,
Paul Gortmaker
From: John Stultz <john.stultz@linaro.org>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 6b43ae8a619d17c4935c3320d2ef9e92bdeed05d upstream.
This should have been backported when it was commited, but I
mistook the problem as requiring the ntp_lock changes
that landed in 3.4 in order for it to occur.
Unfortunately the same issue can happen (with only one cpu)
as follows:
do_adjtimex()
write_seqlock_irq(&xtime_lock);
process_adjtimex_modes()
process_adj_status()
ntp_start_leap_timer()
hrtimer_start()
hrtimer_reprogram()
tick_program_event()
clockevents_program_event()
ktime_get()
seq = req_seqbegin(xtime_lock); [DEADLOCK]
This deadlock will no always occur, as it requires the
leap_timer to force a hrtimer_reprogram which only happens
if its set and there's no sooner timer to expire.
NOTE: This patch, being faithful to the original commit,
introduces a bug (we don't update wall_to_monotonic),
which will be resovled by backporting a following fix.
Original commit message below:
Since commit 7dffa3c673fbcf835cd7be80bb4aec8ad3f51168 the ntp
subsystem has used an hrtimer for triggering the leapsecond
adjustment. However, this can cause a potential livelock.
Thomas diagnosed this as the following pattern:
CPU 0 CPU 1
do_adjtimex()
spin_lock_irq(&ntp_lock);
process_adjtimex_modes(); timer_interrupt()
process_adj_status(); do_timer()
ntp_start_leap_timer(); write_lock(&xtime_lock);
hrtimer_start(); update_wall_time();
hrtimer_reprogram(); ntp_tick_length()
tick_program_event() spin_lock(&ntp_lock);
clockevents_program_event()
ktime_get()
seq = req_seqbegin(xtime_lock);
This patch tries to avoid the problem by reverting back to not using
an hrtimer to inject leapseconds, and instead we handle the leapsecond
processing in the second_overflow() function.
The downside to this change is that on systems that support highres
timers, the leap second processing will occur on a HZ tick boundary,
(ie: ~1-10ms, depending on HZ) after the leap second instead of
possibly sooner (~34us in my tests w/ x86_64 lapic).
This patch applies on top of tip/timers/core.
CC: Sasha Levin <levinsasha928@gmail.com>
CC: Thomas Gleixner <tglx@linutronix.de>
Reported-by: Sasha Levin <levinsasha928@gmail.com>
Diagnoised-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Sasha Levin <levinsasha928@gmail.com>
Cc: Prarit Bhargava <prarit@redhat.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Linux Kernel <linux-kernel@vger.kernel.org>
Signed-off-by: John Stultz <john.stultz@linaro.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
include/linux/timex.h | 2 +-
kernel/time/ntp.c | 122 +++++++++++++++-------------------------------
kernel/time/timekeeping.c | 12 ++---
3 files changed, 44 insertions(+), 92 deletions(-)
diff --git a/include/linux/timex.h b/include/linux/timex.h
index 7a082b3..5674a08 100644
--- a/include/linux/timex.h
+++ b/include/linux/timex.h
@@ -267,7 +267,7 @@ static inline int ntp_synced(void)
/* Returns how long ticks are at present, in ns / 2^NTP_SCALE_SHIFT. */
extern u64 tick_length;
-extern void second_overflow(void);
+extern int second_overflow(unsigned long secs);
extern void update_ntp_one_tick(void);
extern int do_adjtimex(struct timex *);
diff --git a/kernel/time/ntp.c b/kernel/time/ntp.c
index 7c0f180..2522ab8 100644
--- a/kernel/time/ntp.c
+++ b/kernel/time/ntp.c
@@ -28,8 +28,6 @@ unsigned long tick_nsec;
u64 tick_length;
static u64 tick_length_base;
-static struct hrtimer leap_timer;
-
#define MAX_TICKADJ 500LL /* usecs */
#define MAX_TICKADJ_SCALED \
(((MAX_TICKADJ * NSEC_PER_USEC) << NTP_SCALE_SHIFT) / NTP_INTERVAL_FREQ)
@@ -180,60 +178,60 @@ void ntp_clear(void)
}
/*
- * Leap second processing. If in leap-insert state at the end of the
- * day, the system clock is set back one second; if in leap-delete
- * state, the system clock is set ahead one second.
+ * this routine handles the overflow of the microsecond field
+ *
+ * The tricky bits of code to handle the accurate clock support
+ * were provided by Dave Mills (Mills@UDEL.EDU) of NTP fame.
+ * They were originally developed for SUN and DEC kernels.
+ * All the kudos should go to Dave for this stuff.
+ *
+ * Also handles leap second processing, and returns leap offset
*/
-static enum hrtimer_restart ntp_leap_second(struct hrtimer *timer)
+int second_overflow(unsigned long secs)
{
- enum hrtimer_restart res = HRTIMER_NORESTART;
-
- write_seqlock(&xtime_lock);
+ int leap = 0;
+ s64 delta;
+ /*
+ * Leap second processing. If in leap-insert state at the end of the
+ * day, the system clock is set back one second; if in leap-delete
+ * state, the system clock is set ahead one second.
+ */
switch (time_state) {
case TIME_OK:
+ if (time_status & STA_INS)
+ time_state = TIME_INS;
+ else if (time_status & STA_DEL)
+ time_state = TIME_DEL;
break;
case TIME_INS:
- timekeeping_leap_insert(-1);
- time_state = TIME_OOP;
- printk(KERN_NOTICE
- "Clock: inserting leap second 23:59:60 UTC\n");
- hrtimer_add_expires_ns(&leap_timer, NSEC_PER_SEC);
- res = HRTIMER_RESTART;
+ if (secs % 86400 == 0) {
+ leap = -1;
+ time_state = TIME_OOP;
+ printk(KERN_NOTICE
+ "Clock: inserting leap second 23:59:60 UTC\n");
+ }
break;
case TIME_DEL:
- timekeeping_leap_insert(1);
- time_tai--;
- time_state = TIME_WAIT;
- printk(KERN_NOTICE
- "Clock: deleting leap second 23:59:59 UTC\n");
+ if ((secs + 1) % 86400 == 0) {
+ leap = 1;
+ time_tai--;
+ time_state = TIME_WAIT;
+ printk(KERN_NOTICE
+ "Clock: deleting leap second 23:59:59 UTC\n");
+ }
break;
case TIME_OOP:
time_tai++;
time_state = TIME_WAIT;
- /* fall through */
+ break;
+
case TIME_WAIT:
if (!(time_status & (STA_INS | STA_DEL)))
time_state = TIME_OK;
break;
}
- write_sequnlock(&xtime_lock);
-
- return res;
-}
-
-/*
- * this routine handles the overflow of the microsecond field
- *
- * The tricky bits of code to handle the accurate clock support
- * were provided by Dave Mills (Mills@UDEL.EDU) of NTP fame.
- * They were originally developed for SUN and DEC kernels.
- * All the kudos should go to Dave for this stuff.
- */
-void second_overflow(void)
-{
- s64 delta;
/* Bump the maxerror field */
time_maxerror += MAXFREQ / NSEC_PER_USEC;
@@ -253,23 +251,25 @@ void second_overflow(void)
tick_length += delta;
if (!time_adjust)
- return;
+ goto out;
if (time_adjust > MAX_TICKADJ) {
time_adjust -= MAX_TICKADJ;
tick_length += MAX_TICKADJ_SCALED;
- return;
+ goto out;
}
if (time_adjust < -MAX_TICKADJ) {
time_adjust += MAX_TICKADJ;
tick_length -= MAX_TICKADJ_SCALED;
- return;
+ goto out;
}
tick_length += (s64)(time_adjust * NSEC_PER_USEC / NTP_INTERVAL_FREQ)
<< NTP_SCALE_SHIFT;
time_adjust = 0;
+out:
+ return leap;
}
#ifdef CONFIG_GENERIC_CMOS_UPDATE
@@ -331,27 +331,6 @@ static void notify_cmos_timer(void)
static inline void notify_cmos_timer(void) { }
#endif
-/*
- * Start the leap seconds timer:
- */
-static inline void ntp_start_leap_timer(struct timespec *ts)
-{
- long now = ts->tv_sec;
-
- if (time_status & STA_INS) {
- time_state = TIME_INS;
- now += 86400 - now % 86400;
- hrtimer_start(&leap_timer, ktime_set(now, 0), HRTIMER_MODE_ABS);
-
- return;
- }
-
- if (time_status & STA_DEL) {
- time_state = TIME_DEL;
- now += 86400 - (now + 1) % 86400;
- hrtimer_start(&leap_timer, ktime_set(now, 0), HRTIMER_MODE_ABS);
- }
-}
/*
* Propagate a new txc->status value into the NTP state:
@@ -374,22 +353,6 @@ static inline void process_adj_status(struct timex *txc, struct timespec *ts)
time_status &= STA_RONLY;
time_status |= txc->status & ~STA_RONLY;
- switch (time_state) {
- case TIME_OK:
- ntp_start_leap_timer(ts);
- break;
- case TIME_INS:
- case TIME_DEL:
- time_state = TIME_OK;
- ntp_start_leap_timer(ts);
- case TIME_WAIT:
- if (!(time_status & (STA_INS | STA_DEL)))
- time_state = TIME_OK;
- break;
- case TIME_OOP:
- hrtimer_restart(&leap_timer);
- break;
- }
}
/*
* Called with the xtime lock held, so we can access and modify
@@ -469,9 +432,6 @@ int do_adjtimex(struct timex *txc)
(txc->tick < 900000/USER_HZ ||
txc->tick > 1100000/USER_HZ))
return -EINVAL;
-
- if (txc->modes & ADJ_STATUS && time_state != TIME_OK)
- hrtimer_cancel(&leap_timer);
}
getnstimeofday(&ts);
@@ -549,6 +509,4 @@ __setup("ntp_tick_adj=", ntp_tick_adj_setup);
void __init ntp_init(void)
{
ntp_clear();
- hrtimer_init(&leap_timer, CLOCK_REALTIME, HRTIMER_MODE_ABS);
- leap_timer.function = ntp_leap_second;
}
diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
index 268020d..df1e939 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -176,14 +176,6 @@ void update_xtime_cache(u64 nsec)
timespec_add_ns(&xtime_cache, nsec);
}
-/* must hold xtime_lock */
-void timekeeping_leap_insert(int leapsecond)
-{
- xtime.tv_sec += leapsecond;
- wall_to_monotonic.tv_sec -= leapsecond;
- update_vsyscall(&xtime, timekeeper.clock, timekeeper.mult);
-}
-
#ifdef CONFIG_GENERIC_TIME
/**
@@ -762,9 +754,11 @@ static cycle_t logarithmic_accumulation(cycle_t offset, int shift)
timekeeper.xtime_nsec += timekeeper.xtime_interval << shift;
while (timekeeper.xtime_nsec >= nsecps) {
+ int leap;
timekeeper.xtime_nsec -= nsecps;
xtime.tv_sec++;
- second_overflow();
+ leap = second_overflow(xtime.tv_sec);
+ xtime.tv_sec += leap;
}
/* Accumulate into raw time */
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* Re: [v2.6.34-stable 109/165] ntp: Fix leap-second hrtimer livelock
2012-08-15 19:47 ` [v2.6.34-stable 109/165] ntp: Fix leap-second hrtimer livelock Paul Gortmaker
@ 2012-08-17 16:17 ` Herton Ronaldo Krzesinski
2012-08-17 16:43 ` John Stultz
2012-08-17 18:35 ` Paul Gortmaker
0 siblings, 2 replies; 186+ messages in thread
From: Herton Ronaldo Krzesinski @ 2012-08-17 16:17 UTC (permalink / raw)
To: Paul Gortmaker
Cc: stable, linux-kernel, John Stultz, Sasha Levin, Thomas Gleixner,
Prarit Bhargava, Willy Tarreau, Richard Cochran, Peter Zijlstra,
Ingo Molnar, Ben Hutchings
On Wed, Aug 15, 2012 at 03:47:33PM -0400, Paul Gortmaker wrote:
> From: John Stultz <john.stultz@linaro.org>
>
> -------------------
> This is a commit scheduled for the next v2.6.34 longterm release.
> http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
> If you see a problem with using this for longterm, please comment.
> -------------------
>
> commit 6b43ae8a619d17c4935c3320d2ef9e92bdeed05d upstream.
>
> This should have been backported when it was commited, but I
> mistook the problem as requiring the ntp_lock changes
> that landed in 3.4 in order for it to occur.
>
> Unfortunately the same issue can happen (with only one cpu)
> as follows:
> do_adjtimex()
> write_seqlock_irq(&xtime_lock);
> process_adjtimex_modes()
> process_adj_status()
> ntp_start_leap_timer()
> hrtimer_start()
> hrtimer_reprogram()
> tick_program_event()
> clockevents_program_event()
> ktime_get()
> seq = req_seqbegin(xtime_lock); [DEADLOCK]
>
> This deadlock will no always occur, as it requires the
> leap_timer to force a hrtimer_reprogram which only happens
> if its set and there's no sooner timer to expire.
[...]
I remember this came through the leapsecond deadlock & hrtimer/futex
issue fixes. But I noted now commit 6b1859dba01c7d512b72d77e3fd7da8354235189
("ntp: Fix STA_INS/DEL clearing bug") was not included, and its changelog
says it fixes a problem introduced with this. Wouldn't it be worth/right to
also include it in 2.6.34? I didn't test etc., just detected through the
changelog/description but would expect it would be affected too. I also
noted it is missing from 3.2.y and 2.6.32.y stables, and perhaps should be
scheduled for inclusion in their cases too.
--
[]'s
Herton
^ permalink raw reply [flat|nested] 186+ messages in thread* Re: [v2.6.34-stable 109/165] ntp: Fix leap-second hrtimer livelock
2012-08-17 16:17 ` Herton Ronaldo Krzesinski
@ 2012-08-17 16:43 ` John Stultz
2012-08-17 21:13 ` Willy Tarreau
2012-08-17 18:35 ` Paul Gortmaker
1 sibling, 1 reply; 186+ messages in thread
From: John Stultz @ 2012-08-17 16:43 UTC (permalink / raw)
To: Herton Ronaldo Krzesinski
Cc: Paul Gortmaker, stable, linux-kernel, Sasha Levin,
Thomas Gleixner, Prarit Bhargava, Willy Tarreau, Richard Cochran,
Peter Zijlstra, Ingo Molnar, Ben Hutchings
On 08/17/2012 09:17 AM, Herton Ronaldo Krzesinski wrote:
> On Wed, Aug 15, 2012 at 03:47:33PM -0400, Paul Gortmaker wrote:
>> From: John Stultz <john.stultz@linaro.org>
>>
>> -------------------
>> This is a commit scheduled for the next v2.6.34 longterm release.
>> http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
>> If you see a problem with using this for longterm, please comment.
>> -------------------
>>
>> commit 6b43ae8a619d17c4935c3320d2ef9e92bdeed05d upstream.
>>
>> This should have been backported when it was commited, but I
>> mistook the problem as requiring the ntp_lock changes
>> that landed in 3.4 in order for it to occur.
>>
>> Unfortunately the same issue can happen (with only one cpu)
>> as follows:
>> do_adjtimex()
>> write_seqlock_irq(&xtime_lock);
>> process_adjtimex_modes()
>> process_adj_status()
>> ntp_start_leap_timer()
>> hrtimer_start()
>> hrtimer_reprogram()
>> tick_program_event()
>> clockevents_program_event()
>> ktime_get()
>> seq = req_seqbegin(xtime_lock); [DEADLOCK]
>>
>> This deadlock will no always occur, as it requires the
>> leap_timer to force a hrtimer_reprogram which only happens
>> if its set and there's no sooner timer to expire.
> [...]
>
> I remember this came through the leapsecond deadlock & hrtimer/futex
> issue fixes. But I noted now commit 6b1859dba01c7d512b72d77e3fd7da8354235189
> ("ntp: Fix STA_INS/DEL clearing bug") was not included, and its changelog
> says it fixes a problem introduced with this. Wouldn't it be worth/right to
> also include it in 2.6.34? I didn't test etc., just detected through the
> changelog/description but would expect it would be affected too. I also
> noted it is missing from 3.2.y and 2.6.32.y stables, and perhaps should be
> scheduled for inclusion in their cases too.
Yes. I also have another change pending in -tip that I've marked for
stable. Once that lands I'm planning on reviewing the current stable
trees to check that they have all the needed changes.
thanks
-john
^ permalink raw reply [flat|nested] 186+ messages in thread* Re: [v2.6.34-stable 109/165] ntp: Fix leap-second hrtimer livelock
2012-08-17 16:43 ` John Stultz
@ 2012-08-17 21:13 ` Willy Tarreau
0 siblings, 0 replies; 186+ messages in thread
From: Willy Tarreau @ 2012-08-17 21:13 UTC (permalink / raw)
To: John Stultz
Cc: Herton Ronaldo Krzesinski, Paul Gortmaker, stable, linux-kernel,
Sasha Levin, Thomas Gleixner, Prarit Bhargava, Richard Cochran,
Peter Zijlstra, Ingo Molnar, Ben Hutchings
On Fri, Aug 17, 2012 at 09:43:37AM -0700, John Stultz wrote:
> I also have another change pending in -tip that I've marked for
> stable. Once that lands I'm planning on reviewing the current stable
> trees to check that they have all the needed changes.
John, for the record, I have already queued your whole 2.6.32 patchset
as well as the aforementionned fix (ntp-Fix-STA_INS-DEL-clearing-bug).
Thanks,
Willy
^ permalink raw reply [flat|nested] 186+ messages in thread
* Re: [v2.6.34-stable 109/165] ntp: Fix leap-second hrtimer livelock
2012-08-17 16:17 ` Herton Ronaldo Krzesinski
2012-08-17 16:43 ` John Stultz
@ 2012-08-17 18:35 ` Paul Gortmaker
1 sibling, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-17 18:35 UTC (permalink / raw)
To: Herton Ronaldo Krzesinski
Cc: stable, linux-kernel, John Stultz, Sasha Levin, Thomas Gleixner,
Prarit Bhargava, Willy Tarreau, Richard Cochran, Peter Zijlstra,
Ingo Molnar, Ben Hutchings
On 12-08-17 12:17 PM, Herton Ronaldo Krzesinski wrote:
> On Wed, Aug 15, 2012 at 03:47:33PM -0400, Paul Gortmaker wrote:
>> From: John Stultz <john.stultz@linaro.org>
>>
>> -------------------
>> This is a commit scheduled for the next v2.6.34 longterm release.
>> http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
>> If you see a problem with using this for longterm, please comment.
>> -------------------
>>
>> commit 6b43ae8a619d17c4935c3320d2ef9e92bdeed05d upstream.
>>
>> This should have been backported when it was commited, but I
>> mistook the problem as requiring the ntp_lock changes
>> that landed in 3.4 in order for it to occur.
>>
>> Unfortunately the same issue can happen (with only one cpu)
>> as follows:
>> do_adjtimex()
>> write_seqlock_irq(&xtime_lock);
>> process_adjtimex_modes()
>> process_adj_status()
>> ntp_start_leap_timer()
>> hrtimer_start()
>> hrtimer_reprogram()
>> tick_program_event()
>> clockevents_program_event()
>> ktime_get()
>> seq = req_seqbegin(xtime_lock); [DEADLOCK]
>>
>> This deadlock will no always occur, as it requires the
>> leap_timer to force a hrtimer_reprogram which only happens
>> if its set and there's no sooner timer to expire.
> [...]
>
> I remember this came through the leapsecond deadlock & hrtimer/futex
> issue fixes. But I noted now commit 6b1859dba01c7d512b72d77e3fd7da8354235189
> ("ntp: Fix STA_INS/DEL clearing bug") was not included, and its changelog
> says it fixes a problem introduced with this. Wouldn't it be worth/right to
> also include it in 2.6.34? I didn't test etc., just detected through the
> changelog/description but would expect it would be affected too. I also
> noted it is missing from 3.2.y and 2.6.32.y stables, and perhaps should be
> scheduled for inclusion in their cases too.
>
Thanks again Herton. I've queued this and I'll keep an eye out for the
pending -tip commit from John.
Paul.
^ permalink raw reply [flat|nested] 186+ messages in thread
* [v2.6.34-stable 110/165] ntp: Correct TAI offset during leap second
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (108 preceding siblings ...)
2012-08-15 19:47 ` [v2.6.34-stable 109/165] ntp: Fix leap-second hrtimer livelock Paul Gortmaker
@ 2012-08-15 19:47 ` Paul Gortmaker
2012-08-15 19:47 ` [v2.6.34-stable 111/165] timekeeping: Fix CLOCK_MONOTONIC inconsistency during leapsecond Paul Gortmaker
` (54 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:47 UTC (permalink / raw)
To: stable, linux-kernel
Cc: Richard Cochran, Prarit Bhargava, Thomas Gleixner, John Stultz,
Paul Gortmaker
From: Richard Cochran <richardcochran@gmail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit dd48d708ff3e917f6d6b6c2b696c3f18c019feed upstream.
When repeating a UTC time value during a leap second (when the UTC
time should be 23:59:60), the TAI timescale should not stop. The kernel
NTP code increments the TAI offset one second too late. This patch fixes
the issue by incrementing the offset during the leap second itself.
Signed-off-by: Richard Cochran <richardcochran@gmail.com>
Cc: Prarit Bhargava <prarit@redhat.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Linux Kernel <linux-kernel@vger.kernel.org>
Signed-off-by: John Stultz <john.stultz@linaro.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
kernel/time/ntp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/time/ntp.c b/kernel/time/ntp.c
index 2522ab8..ec08c06 100644
--- a/kernel/time/ntp.c
+++ b/kernel/time/ntp.c
@@ -208,6 +208,7 @@ int second_overflow(unsigned long secs)
if (secs % 86400 == 0) {
leap = -1;
time_state = TIME_OOP;
+ time_tai++;
printk(KERN_NOTICE
"Clock: inserting leap second 23:59:60 UTC\n");
}
@@ -222,7 +223,6 @@ int second_overflow(unsigned long secs)
}
break;
case TIME_OOP:
- time_tai++;
time_state = TIME_WAIT;
break;
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 111/165] timekeeping: Fix CLOCK_MONOTONIC inconsistency during leapsecond
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (109 preceding siblings ...)
2012-08-15 19:47 ` [v2.6.34-stable 110/165] ntp: Correct TAI offset during leap second Paul Gortmaker
@ 2012-08-15 19:47 ` Paul Gortmaker
2012-08-15 19:47 ` [v2.6.34-stable 112/165] time: Move common updates to a function Paul Gortmaker
` (53 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:47 UTC (permalink / raw)
To: stable, linux-kernel
Cc: John Stultz, stable, Thomas Gleixner, Prarit Bhargava,
John Stultz, Paul Gortmaker
From: John Stultz <john.stultz@linaro.org>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit fad0c66c4bb836d57a5f125ecd38bed653ca863a upstream.
which resolves a bug the previous commit.
Commit 6b43ae8a61 (ntp: Fix leap-second hrtimer livelock) broke the
leapsecond update of CLOCK_MONOTONIC. The missing leapsecond update to
wall_to_monotonic causes discontinuities in CLOCK_MONOTONIC.
Adjust wall_to_monotonic when NTP inserted a leapsecond.
Reported-by: Richard Cochran <richardcochran@gmail.com>
Signed-off-by: John Stultz <john.stultz@linaro.org>
Tested-by: Richard Cochran <richardcochran@gmail.com>
Cc: stable@kernel.org
Link: http://lkml.kernel.org/r/1338400497-12420-1-git-send-email-john.stultz@linaro.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Prarit Bhargava <prarit@redhat.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Linux Kernel <linux-kernel@vger.kernel.org>
Signed-off-by: John Stultz <johnstul@us.ibm.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
kernel/time/timekeeping.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
index df1e939..f8d4877 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -759,6 +759,7 @@ static cycle_t logarithmic_accumulation(cycle_t offset, int shift)
xtime.tv_sec++;
leap = second_overflow(xtime.tv_sec);
xtime.tv_sec += leap;
+ wall_to_monotonic.tv_sec -= leap;
}
/* Accumulate into raw time */
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 112/165] time: Move common updates to a function
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (110 preceding siblings ...)
2012-08-15 19:47 ` [v2.6.34-stable 111/165] timekeeping: Fix CLOCK_MONOTONIC inconsistency during leapsecond Paul Gortmaker
@ 2012-08-15 19:47 ` Paul Gortmaker
2012-08-15 19:47 ` [v2.6.34-stable 113/165] hrtimer: Provide clock_was_set_delayed() Paul Gortmaker
` (52 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:47 UTC (permalink / raw)
To: stable, linux-kernel
Cc: Thomas Gleixner, Eric Dumazet, Richard Cochran, Prarit Bhargava,
John Stultz, Paul Gortmaker
From: Thomas Gleixner <tglx@linutronix.de>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit cc06268c6a87db156af2daed6e96a936b955cc82 upstream.
While not a bugfix itself, it allows following fixes to backport
in a more straightforward manner.
CC: Thomas Gleixner <tglx@linutronix.de>
CC: Eric Dumazet <eric.dumazet@gmail.com>
CC: Richard Cochran <richardcochran@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Prarit Bhargava <prarit@redhat.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Linux Kernel <linux-kernel@vger.kernel.org>
Signed-off-by: John Stultz <john.stultz@linaro.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
kernel/time/timekeeping.c | 20 ++++++++++++++------
1 file changed, 14 insertions(+), 6 deletions(-)
diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
index f8d4877..adfa89d 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -166,6 +166,18 @@ static struct timespec total_sleep_time;
*/
struct timespec raw_time;
+/* must hold write on xtime_lock */
+static void timekeeping_update(bool clearntp)
+{
+ if (clearntp) {
+ timekeeper.ntp_error = 0;
+ ntp_clear();
+ }
+ update_vsyscall(&xtime, timekeeper.clock, timekeeper.mult);
+}
+
+
+
/* flag for if timekeeping is suspended */
int __read_mostly timekeeping_suspended;
@@ -330,10 +342,7 @@ int do_settimeofday(struct timespec *tv)
update_xtime_cache(0);
- timekeeper.ntp_error = 0;
- ntp_clear();
-
- update_vsyscall(&xtime, timekeeper.clock, timekeeper.mult);
+ timekeeping_update(true);
write_sequnlock_irqrestore(&xtime_lock, flags);
@@ -858,8 +867,7 @@ void update_wall_time(void)
nsecs = clocksource_cyc2ns(offset, timekeeper.mult, timekeeper.shift);
update_xtime_cache(nsecs);
- /* check to see if there is a new clocksource to use */
- update_vsyscall(&xtime, timekeeper.clock, timekeeper.mult);
+ timekeeping_update(false);
}
/**
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 113/165] hrtimer: Provide clock_was_set_delayed()
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (111 preceding siblings ...)
2012-08-15 19:47 ` [v2.6.34-stable 112/165] time: Move common updates to a function Paul Gortmaker
@ 2012-08-15 19:47 ` Paul Gortmaker
2012-08-15 19:47 ` [v2.6.34-stable 114/165] timekeeping: Fix leapsecond triggered load spike issue Paul Gortmaker
` (51 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:47 UTC (permalink / raw)
To: stable, linux-kernel
Cc: John Stultz, Thomas Gleixner, Prarit Bhargava, Paul Gortmaker
From: John Stultz <johnstul@us.ibm.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit f55a6faa384304c89cfef162768e88374d3312cb upstream.
clock_was_set() cannot be called from hard interrupt context because
it calls on_each_cpu().
For fixing the widely reported leap seconds issue it is necessary to
call it from hard interrupt context, i.e. the timer tick code, which
does the timekeeping updates.
Provide a new function which denotes it in the hrtimer cpu base
structure of the cpu on which it is called and raise the hrtimer
softirq. We then execute the clock_was_set() notificiation from
softirq context in run_hrtimer_softirq(). The hrtimer softirq is
rarely used, so polling the flag there is not a performance issue.
[ tglx: Made it depend on CONFIG_HIGH_RES_TIMERS. We really should get
rid of all this ifdeffery ASAP ]
Signed-off-by: John Stultz <johnstul@us.ibm.com>
Reported-by: Jan Engelhardt <jengelh@inai.de>
Reviewed-by: Ingo Molnar <mingo@kernel.org>
Acked-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Acked-by: Prarit Bhargava <prarit@redhat.com>
Cc: stable@vger.kernel.org
Link: http://lkml.kernel.org/r/1341960205-56738-2-git-send-email-johnstul@us.ibm.com
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Prarit Bhargava <prarit@redhat.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Linux Kernel <linux-kernel@vger.kernel.org>
Signed-off-by: John Stultz <johnstul@us.ibm.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
include/linux/hrtimer.h | 7 +++++++
kernel/hrtimer.c | 20 ++++++++++++++++++++
2 files changed, 27 insertions(+)
diff --git a/include/linux/hrtimer.h b/include/linux/hrtimer.h
index 5d86fb2..0325598 100644
--- a/include/linux/hrtimer.h
+++ b/include/linux/hrtimer.h
@@ -159,6 +159,7 @@ struct hrtimer_clock_base {
* and timers
* @clock_base: array of clock bases for this cpu
* @curr_timer: the timer which is executing a callback right now
+ * @clock_was_set: Indicates that clock was set from irq context.
* @expires_next: absolute time of the next event which was scheduled
* via clock_set_next_event()
* @hres_active: State of high resolution mode
@@ -171,6 +172,7 @@ struct hrtimer_clock_base {
struct hrtimer_cpu_base {
raw_spinlock_t lock;
struct hrtimer_clock_base clock_base[HRTIMER_MAX_CLOCK_BASES];
+ unsigned int clock_was_set;
#ifdef CONFIG_HIGH_RES_TIMERS
ktime_t expires_next;
int hres_active;
@@ -280,6 +282,8 @@ extern void hrtimer_peek_ahead_timers(void);
# define MONOTONIC_RES_NSEC HIGH_RES_NSEC
# define KTIME_MONOTONIC_RES KTIME_HIGH_RES
+extern void clock_was_set_delayed(void);
+
#else
# define MONOTONIC_RES_NSEC LOW_RES_NSEC
@@ -308,6 +312,9 @@ static inline int hrtimer_is_hres_active(struct hrtimer *timer)
{
return 0;
}
+
+static inline void clock_was_set_delayed(void) { }
+
#endif
extern ktime_t ktime_get(void);
diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
index 3c727aa..dc41268 100644
--- a/kernel/hrtimer.c
+++ b/kernel/hrtimer.c
@@ -738,6 +738,19 @@ static int hrtimer_switch_to_hres(void)
return 1;
}
+/*
+ * Called from timekeeping code to reprogramm the hrtimer interrupt
+ * device. If called from the timer interrupt context we defer it to
+ * softirq context.
+ */
+void clock_was_set_delayed(void)
+{
+ struct hrtimer_cpu_base *cpu_base = &__get_cpu_var(hrtimer_bases);
+
+ cpu_base->clock_was_set = 1;
+ __raise_softirq_irqoff(HRTIMER_SOFTIRQ);
+}
+
#else
static inline int hrtimer_hres_active(void) { return 0; }
@@ -1409,6 +1422,13 @@ void hrtimer_peek_ahead_timers(void)
static void run_hrtimer_softirq(struct softirq_action *h)
{
+ struct hrtimer_cpu_base *cpu_base = &__get_cpu_var(hrtimer_bases);
+
+ if (cpu_base->clock_was_set) {
+ cpu_base->clock_was_set = 0;
+ clock_was_set();
+ }
+
hrtimer_peek_ahead_timers();
}
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 114/165] timekeeping: Fix leapsecond triggered load spike issue
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (112 preceding siblings ...)
2012-08-15 19:47 ` [v2.6.34-stable 113/165] hrtimer: Provide clock_was_set_delayed() Paul Gortmaker
@ 2012-08-15 19:47 ` Paul Gortmaker
2012-08-15 19:47 ` [v2.6.34-stable 115/165] timekeeping: Maintain ktime_t based offsets for hrtimers Paul Gortmaker
` (50 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:47 UTC (permalink / raw)
To: stable, linux-kernel
Cc: John Stultz, Thomas Gleixner, Prarit Bhargava, Paul Gortmaker
From: John Stultz <johnstul@us.ibm.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 4873fa070ae84a4115f0b3c9dfabc224f1bc7c51 upstream.
The timekeeping code misses an update of the hrtimer subsystem after a
leap second happened. Due to that timers based on CLOCK_REALTIME are
either expiring a second early or late depending on whether a leap
second has been inserted or deleted until an operation is initiated
which causes that update. Unless the update happens by some other
means this discrepancy between the timekeeping and the hrtimer data
stays forever and timers are expired either early or late.
The reported immediate workaround - $ data -s "`date`" - is causing a
call to clock_was_set() which updates the hrtimer data structures.
See: http://www.sheeri.com/content/mysql-and-leap-second-high-cpu-and-fix
Add the missing clock_was_set() call to update_wall_time() in case of
a leap second event. The actual update is deferred to softirq context
as the necessary smp function call cannot be invoked from hard
interrupt context.
Signed-off-by: John Stultz <johnstul@us.ibm.com>
Reported-by: Jan Engelhardt <jengelh@inai.de>
Reviewed-by: Ingo Molnar <mingo@kernel.org>
Acked-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Acked-by: Prarit Bhargava <prarit@redhat.com>
Cc: stable@vger.kernel.org
Link: http://lkml.kernel.org/r/1341960205-56738-3-git-send-email-johnstul@us.ibm.com
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Prarit Bhargava <prarit@redhat.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Linux Kernel <linux-kernel@vger.kernel.org>
Signed-off-by: John Stultz <johnstul@us.ibm.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
kernel/time/timekeeping.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
index adfa89d..634c9ee 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -769,6 +769,8 @@ static cycle_t logarithmic_accumulation(cycle_t offset, int shift)
leap = second_overflow(xtime.tv_sec);
xtime.tv_sec += leap;
wall_to_monotonic.tv_sec -= leap;
+ if (leap)
+ clock_was_set_delayed();
}
/* Accumulate into raw time */
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 115/165] timekeeping: Maintain ktime_t based offsets for hrtimers
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (113 preceding siblings ...)
2012-08-15 19:47 ` [v2.6.34-stable 114/165] timekeeping: Fix leapsecond triggered load spike issue Paul Gortmaker
@ 2012-08-15 19:47 ` Paul Gortmaker
2012-08-15 19:47 ` [v2.6.34-stable 116/165] hrtimers: Move lock held region in hrtimer_interrupt() Paul Gortmaker
` (49 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:47 UTC (permalink / raw)
To: stable, linux-kernel
Cc: Thomas Gleixner, John Stultz, Prarit Bhargava, Paul Gortmaker
From: Thomas Gleixner <tglx@linutronix.de>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 5b9fe759a678e05be4937ddf03d50e950207c1c0 upstream.
We need to update the hrtimer clock offsets from the hrtimer interrupt
context. To avoid conversions from timespec to ktime_t maintain a
ktime_t based representation of those offsets in the timekeeper. This
puts the conversion overhead into the code which updates the
underlying offsets and provides fast accessible values in the hrtimer
interrupt.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: John Stultz <johnstul@us.ibm.com>
Reviewed-by: Ingo Molnar <mingo@kernel.org>
Acked-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Acked-by: Prarit Bhargava <prarit@redhat.com>
Cc: stable@vger.kernel.org
Link: http://lkml.kernel.org/r/1341960205-56738-4-git-send-email-johnstul@us.ibm.com
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Prarit Bhargava <prarit@redhat.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Linux Kernel <linux-kernel@vger.kernel.org>
Signed-off-by: John Stultz <johnstul@us.ibm.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
kernel/time/timekeeping.c | 25 ++++++++++++++++++++++++-
1 file changed, 24 insertions(+), 1 deletion(-)
diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
index 634c9ee..3d443b4 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -161,18 +161,34 @@ struct timespec xtime __attribute__ ((aligned (16)));
struct timespec wall_to_monotonic __attribute__ ((aligned (16)));
static struct timespec total_sleep_time;
+/* Offset clock monotonic -> clock realtime */
+static ktime_t offs_real;
+
+/* Offset clock monotonic -> clock boottime */
+static ktime_t offs_boot;
+
/*
* The raw monotonic time for the CLOCK_MONOTONIC_RAW posix clock.
*/
struct timespec raw_time;
/* must hold write on xtime_lock */
+static void update_rt_offset(void)
+{
+ struct timespec tmp, *wtm = &wall_to_monotonic;
+
+ set_normalized_timespec(&tmp, -wtm->tv_sec, -wtm->tv_nsec);
+ offs_real = timespec_to_ktime(tmp);
+}
+
+/* must hold write on xtime_lock */
static void timekeeping_update(bool clearntp)
{
if (clearntp) {
timekeeper.ntp_error = 0;
ntp_clear();
}
+ update_rt_offset();
update_vsyscall(&xtime, timekeeper.clock, timekeeper.mult);
}
@@ -565,6 +581,7 @@ void __init timekeeping_init(void)
set_normalized_timespec(&wall_to_monotonic,
-boot.tv_sec, -boot.tv_nsec);
update_xtime_cache(0);
+ update_rt_offset();
total_sleep_time.tv_sec = 0;
total_sleep_time.tv_nsec = 0;
write_sequnlock_irqrestore(&xtime_lock, flags);
@@ -573,6 +590,12 @@ void __init timekeeping_init(void)
/* time in seconds when suspend began */
static struct timespec timekeeping_suspend_time;
+static void update_sleep_time(struct timespec t)
+{
+ total_sleep_time = t;
+ offs_boot = timespec_to_ktime(t);
+}
+
/**
* timekeeping_resume - Resumes the generic timekeeping subsystem.
* @dev: unused
@@ -596,7 +619,7 @@ static int timekeeping_resume(struct sys_device *dev)
ts = timespec_sub(ts, timekeeping_suspend_time);
xtime = timespec_add_safe(xtime, ts);
wall_to_monotonic = timespec_sub(wall_to_monotonic, ts);
- total_sleep_time = timespec_add_safe(total_sleep_time, ts);
+ update_sleep_time(timespec_add_safe(total_sleep_time, ts));
}
update_xtime_cache(0);
/* re-base the last cycle value */
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 116/165] hrtimers: Move lock held region in hrtimer_interrupt()
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (114 preceding siblings ...)
2012-08-15 19:47 ` [v2.6.34-stable 115/165] timekeeping: Maintain ktime_t based offsets for hrtimers Paul Gortmaker
@ 2012-08-15 19:47 ` Paul Gortmaker
2012-08-15 19:47 ` [v2.6.34-stable 117/165] timekeeping: Provide hrtimer update function Paul Gortmaker
` (48 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:47 UTC (permalink / raw)
To: stable, linux-kernel
Cc: Thomas Gleixner, John Stultz, Prarit Bhargava, Paul Gortmaker
From: Thomas Gleixner <tglx@linutronix.de>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 196951e91262fccda81147d2bcf7fdab08668b40 upstream.
We need to update the base offsets from this code and we need to do
that under base->lock. Move the lock held region around the
ktime_get() calls. The ktime_get() calls are going to be replaced with
a function which gets the time and the offsets atomically.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Ingo Molnar <mingo@kernel.org>
Acked-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Acked-by: Prarit Bhargava <prarit@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: John Stultz <johnstul@us.ibm.com>
Link: http://lkml.kernel.org/r/1341960205-56738-6-git-send-email-johnstul@us.ibm.com
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Prarit Bhargava <prarit@redhat.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Linux Kernel <linux-kernel@vger.kernel.org>
Signed-off-by: John Stultz <johnstul@us.ibm.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
kernel/hrtimer.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
index dc41268..039db35 100644
--- a/kernel/hrtimer.c
+++ b/kernel/hrtimer.c
@@ -1279,11 +1279,10 @@ void hrtimer_interrupt(struct clock_event_device *dev)
cpu_base->nr_events++;
dev->next_event.tv64 = KTIME_MAX;
+ raw_spin_lock(&cpu_base->lock);
entry_time = now = ktime_get();
retry:
expires_next.tv64 = KTIME_MAX;
-
- raw_spin_lock(&cpu_base->lock);
/*
* We set expires_next to KTIME_MAX here with cpu_base->lock
* held to prevent that a timer is enqueued in our queue via
@@ -1358,6 +1357,7 @@ retry:
* interrupt routine. We give it 3 attempts to avoid
* overreacting on some spurious event.
*/
+ raw_spin_lock(&cpu_base->lock);
now = ktime_get();
cpu_base->nr_retries++;
if (++retries < 3)
@@ -1370,6 +1370,7 @@ retry:
*/
cpu_base->nr_hangs++;
cpu_base->hang_detected = 1;
+ raw_spin_unlock(&cpu_base->lock);
delta = ktime_sub(now, entry_time);
if (delta.tv64 > cpu_base->max_hang_time.tv64)
cpu_base->max_hang_time = delta;
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 117/165] timekeeping: Provide hrtimer update function
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (115 preceding siblings ...)
2012-08-15 19:47 ` [v2.6.34-stable 116/165] hrtimers: Move lock held region in hrtimer_interrupt() Paul Gortmaker
@ 2012-08-15 19:47 ` Paul Gortmaker
2012-08-15 19:47 ` [v2.6.34-stable 118/165] hrtimer: Update hrtimer base offsets each hrtimer_interrupt Paul Gortmaker
` (47 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:47 UTC (permalink / raw)
To: stable, linux-kernel
Cc: Thomas Gleixner, John Stultz, Prarit Bhargava, Paul Gortmaker
From: Thomas Gleixner <tglx@linutronix.de>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit f6c06abfb3972ad4914cef57d8348fcb2932bc3b upstream.
To finally fix the infamous leap second issue and other race windows
caused by functions which change the offsets between the various time
bases (CLOCK_MONOTONIC, CLOCK_REALTIME and CLOCK_BOOTTIME) we need a
function which atomically gets the current monotonic time and updates
the offsets of CLOCK_REALTIME and CLOCK_BOOTTIME with minimalistic
overhead. The previous patch which provides ktime_t offsets allows us
to make this function almost as cheap as ktime_get() which is going to
be replaced in hrtimer_interrupt().
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Ingo Molnar <mingo@kernel.org>
Acked-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Acked-by: Prarit Bhargava <prarit@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: John Stultz <johnstul@us.ibm.com>
Link: http://lkml.kernel.org/r/1341960205-56738-7-git-send-email-johnstul@us.ibm.com
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Prarit Bhargava <prarit@redhat.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Linux Kernel <linux-kernel@vger.kernel.org>
Signed-off-by: John Stultz <johnstul@us.ibm.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
include/linux/hrtimer.h | 2 +-
kernel/time/timekeeping.c | 32 ++++++++++++++++++++++++++++++++
2 files changed, 33 insertions(+), 1 deletion(-)
diff --git a/include/linux/hrtimer.h b/include/linux/hrtimer.h
index 0325598..887d1e7 100644
--- a/include/linux/hrtimer.h
+++ b/include/linux/hrtimer.h
@@ -319,7 +319,7 @@ static inline void clock_was_set_delayed(void) { }
extern ktime_t ktime_get(void);
extern ktime_t ktime_get_real(void);
-
+extern ktime_t ktime_get_update_offsets(ktime_t *offs_real);
DECLARE_PER_CPU(struct tick_device, tick_cpu_device);
diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
index 3d443b4..0b4f6d1 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -969,3 +969,35 @@ struct timespec get_monotonic_coarse(void)
now.tv_nsec + mono.tv_nsec);
return now;
}
+
+#ifdef CONFIG_HIGH_RES_TIMERS
+/**
+ * ktime_get_update_offsets - hrtimer helper
+ * @real: pointer to storage for monotonic -> realtime offset
+ *
+ * Returns current monotonic time and updates the offsets
+ * Called from hrtimer_interupt() or retrigger_next_event()
+ */
+ktime_t ktime_get_update_offsets(ktime_t *real)
+{
+ ktime_t now;
+ unsigned int seq;
+ u64 secs, nsecs;
+
+ do {
+ seq = read_seqbegin(&xtime_lock);
+
+ secs = xtime.tv_sec;
+ nsecs = xtime.tv_nsec;
+ nsecs += timekeeping_get_ns();
+ /* If arch requires, add in gettimeoffset() */
+ nsecs += arch_gettimeoffset();
+
+ *real = offs_real;
+ } while (read_seqretry(&xtime_lock, seq));
+
+ now = ktime_add_ns(ktime_set(secs, 0), nsecs);
+ now = ktime_sub(now, *real);
+ return now;
+}
+#endif
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 118/165] hrtimer: Update hrtimer base offsets each hrtimer_interrupt
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (116 preceding siblings ...)
2012-08-15 19:47 ` [v2.6.34-stable 117/165] timekeeping: Provide hrtimer update function Paul Gortmaker
@ 2012-08-15 19:47 ` Paul Gortmaker
2012-08-15 19:47 ` [v2.6.34-stable 119/165] timekeeping: Add missing update call in timekeeping_resume() Paul Gortmaker
` (46 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:47 UTC (permalink / raw)
To: stable, linux-kernel
Cc: John Stultz, Thomas Gleixner, Prarit Bhargava, Paul Gortmaker
From: John Stultz <johnstul@us.ibm.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 5baefd6d84163443215f4a99f6a20f054ef11236 upstream.
The update of the hrtimer base offsets on all cpus cannot be made
atomically from the timekeeper.lock held and interrupt disabled region
as smp function calls are not allowed there.
clock_was_set(), which enforces the update on all cpus, is called
either from preemptible process context in case of do_settimeofday()
or from the softirq context when the offset modification happened in
the timer interrupt itself due to a leap second.
In both cases there is a race window for an hrtimer interrupt between
dropping timekeeper lock, enabling interrupts and clock_was_set()
issuing the updates. Any interrupt which arrives in that window will
see the new time but operate on stale offsets.
So we need to make sure that an hrtimer interrupt always sees a
consistent state of time and offsets.
ktime_get_update_offsets() allows us to get the current monotonic time
and update the per cpu hrtimer base offsets from hrtimer_interrupt()
to capture a consistent state of monotonic time and the offsets. The
function replaces the existing ktime_get() calls in hrtimer_interrupt().
The overhead of the new function vs. ktime_get() is minimal as it just
adds two store operations.
This ensures that any changes to realtime or boottime offsets are
noticed and stored into the per-cpu hrtimer base structures, prior to
any hrtimer expiration and guarantees that timers are not expired early.
Signed-off-by: John Stultz <johnstul@us.ibm.com>
Reviewed-by: Ingo Molnar <mingo@kernel.org>
Acked-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Acked-by: Prarit Bhargava <prarit@redhat.com>
Cc: stable@vger.kernel.org
Link: http://lkml.kernel.org/r/1341960205-56738-8-git-send-email-johnstul@us.ibm.com
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Prarit Bhargava <prarit@redhat.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Linux Kernel <linux-kernel@vger.kernel.org>
Signed-off-by: John Stultz <johnstul@us.ibm.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
kernel/hrtimer.c | 27 ++++++++++++---------------
1 file changed, 12 insertions(+), 15 deletions(-)
diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
index 039db35..6b6835f 100644
--- a/kernel/hrtimer.c
+++ b/kernel/hrtimer.c
@@ -603,6 +603,12 @@ static int hrtimer_reprogram(struct hrtimer *timer,
return res;
}
+static inline ktime_t hrtimer_update_base(struct hrtimer_cpu_base *base)
+{
+ ktime_t *offs_real = &base->clock_base[CLOCK_REALTIME].offset;
+
+ return ktime_get_update_offsets(offs_real);
+}
/*
* Retrigger next event is called after clock was set
@@ -612,26 +618,15 @@ static int hrtimer_reprogram(struct hrtimer *timer,
static void retrigger_next_event(void *arg)
{
struct hrtimer_cpu_base *base;
- struct timespec realtime_offset;
- unsigned long seq;
if (!hrtimer_hres_active())
return;
- do {
- seq = read_seqbegin(&xtime_lock);
- set_normalized_timespec(&realtime_offset,
- -wall_to_monotonic.tv_sec,
- -wall_to_monotonic.tv_nsec);
- } while (read_seqretry(&xtime_lock, seq));
-
base = &__get_cpu_var(hrtimer_bases);
/* Adjust CLOCK_REALTIME offset */
raw_spin_lock(&base->lock);
- base->clock_base[CLOCK_REALTIME].offset =
- timespec_to_ktime(realtime_offset);
-
+ hrtimer_update_base(base);
hrtimer_force_reprogram(base, 0);
raw_spin_unlock(&base->lock);
}
@@ -731,7 +726,6 @@ static int hrtimer_switch_to_hres(void)
base->clock_base[CLOCK_MONOTONIC].resolution = KTIME_HIGH_RES;
tick_setup_sched_timer();
-
/* "Retrigger" the interrupt to get things going */
retrigger_next_event(NULL);
local_irq_restore(flags);
@@ -1280,7 +1274,7 @@ void hrtimer_interrupt(struct clock_event_device *dev)
dev->next_event.tv64 = KTIME_MAX;
raw_spin_lock(&cpu_base->lock);
- entry_time = now = ktime_get();
+ entry_time = now = hrtimer_update_base(cpu_base);
retry:
expires_next.tv64 = KTIME_MAX;
/*
@@ -1356,9 +1350,12 @@ retry:
* We need to prevent that we loop forever in the hrtimer
* interrupt routine. We give it 3 attempts to avoid
* overreacting on some spurious event.
+ *
+ * Acquire base lock for updating the offsets and retrieving
+ * the current time.
*/
raw_spin_lock(&cpu_base->lock);
- now = ktime_get();
+ now = hrtimer_update_base(cpu_base);
cpu_base->nr_retries++;
if (++retries < 3)
goto retry;
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 119/165] timekeeping: Add missing update call in timekeeping_resume()
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (117 preceding siblings ...)
2012-08-15 19:47 ` [v2.6.34-stable 118/165] hrtimer: Update hrtimer base offsets each hrtimer_interrupt Paul Gortmaker
@ 2012-08-15 19:47 ` Paul Gortmaker
2012-08-15 19:47 ` [v2.6.34-stable 120/165] [SCSI] st: fix race in st_scsi_execute_end Paul Gortmaker
` (45 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:47 UTC (permalink / raw)
To: stable, linux-kernel
Cc: Thomas Gleixner, Linux PM list, John Stultz, Ingo Molnar,
Prarit Bhargava, Linus Torvalds, Paul Gortmaker
From: Thomas Gleixner <tglx@linutronix.de>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 3e997130bd2e8c6f5aaa49d6e3161d4d29b43ab0 upstream.
The leap second rework unearthed another issue of inconsistent data.
On timekeeping_resume() the timekeeper data is updated, but nothing
calls timekeeping_update(), so now the update code in the timer
interrupt sees stale values.
This has been the case before those changes, but then the timer
interrupt was using stale data as well so this went unnoticed for quite
some time.
Add the missing update call, so all the data is consistent everywhere.
Reported-by: Andreas Schwab <schwab@linux-m68k.org>
Reported-and-tested-by: "Rafael J. Wysocki" <rjw@sisk.pl>
Reported-and-tested-by: Martin Steigerwald <Martin@lichtvoll.de>
Cc: LKML <linux-kernel@vger.kernel.org>
Cc: Linux PM list <linux-pm@vger.kernel.org>
Cc: John Stultz <johnstul@us.ibm.com>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>,
Cc: Prarit Bhargava <prarit@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: John Stultz <johnstul@us.ibm.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Prarit Bhargava <prarit@redhat.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Linux Kernel <linux-kernel@vger.kernel.org>
Signed-off-by: John Stultz <johnstul@us.ibm.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
kernel/time/timekeeping.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
index 0b4f6d1..156fd67 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -626,6 +626,7 @@ static int timekeeping_resume(struct sys_device *dev)
timekeeper.clock->cycle_last = timekeeper.clock->read(timekeeper.clock);
timekeeper.ntp_error = 0;
timekeeping_suspended = 0;
+ timekeeping_update(false);
write_sequnlock_irqrestore(&xtime_lock, flags);
touch_softlockup_watchdog();
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 120/165] [SCSI] st: fix race in st_scsi_execute_end
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (118 preceding siblings ...)
2012-08-15 19:47 ` [v2.6.34-stable 119/165] timekeeping: Add missing update call in timekeeping_resume() Paul Gortmaker
@ 2012-08-15 19:47 ` Paul Gortmaker
2012-08-15 19:47 ` [v2.6.34-stable 121/165] [SCSI] Make scsi_free_queue() kill pending SCSI commands Paul Gortmaker
` (44 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:47 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Petr Uzel, James Bottomley, Paul Gortmaker
From: Petr Uzel <petr.uzel@suse.cz>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit c68bf8eeaa57c852e74adcf597237be149eef830 upstream.
The call to complete() in st_scsi_execute_end() wakes up sleeping thread
in write_behind_check(), which frees the st_request, thus invalidating
the pointer to the associated bio structure, which is then passed to the
blk_rq_unmap_user(). Fix by storing pointer to bio structure into
temporary local variable.
This bug is present since at least linux-2.6.32.
Signed-off-by: Petr Uzel <petr.uzel@suse.cz>
Reported-by: Juergen Groß <juergen.gross@ts.fujitsu.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Acked-by: Kai Mäkisara <kai.makisara@kolumbus.fi>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/scsi/st.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
index 3ea1a71..516ca15 100644
--- a/drivers/scsi/st.c
+++ b/drivers/scsi/st.c
@@ -462,14 +462,16 @@ static void st_scsi_execute_end(struct request *req, int uptodate)
{
struct st_request *SRpnt = req->end_io_data;
struct scsi_tape *STp = SRpnt->stp;
+ struct bio *tmp;
STp->buffer->cmdstat.midlevel_result = SRpnt->result = req->errors;
STp->buffer->cmdstat.residual = req->resid_len;
+ tmp = SRpnt->bio;
if (SRpnt->waiting)
complete(SRpnt->waiting);
- blk_rq_unmap_user(SRpnt->bio);
+ blk_rq_unmap_user(tmp);
__blk_put_request(req->q, req);
}
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 121/165] [SCSI] Make scsi_free_queue() kill pending SCSI commands
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (119 preceding siblings ...)
2012-08-15 19:47 ` [v2.6.34-stable 120/165] [SCSI] st: fix race in st_scsi_execute_end Paul Gortmaker
@ 2012-08-15 19:47 ` Paul Gortmaker
2012-08-15 19:47 ` [v2.6.34-stable 122/165] NFS/sunrpc: don't use a credential with extra groups Paul Gortmaker
` (43 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:47 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Bart Van Assche, James Bottomley, Paul Gortmaker
From: Bart Van Assche <bvanassche@acm.org>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 3308511c93e6ad0d3c58984ecd6e5e57f96b12c8 upstream.
Make sure that SCSI device removal via scsi_remove_host() does finish
all pending SCSI commands. Currently that's not the case and hence
removal of a SCSI host during I/O can cause a deadlock. See also
"blkdev_issue_discard() hangs forever if underlying storage device is
removed" (http://bugzilla.kernel.org/show_bug.cgi?id=40472). See also
http://lkml.org/lkml/2011/8/27/6.
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/scsi/hosts.c | 9 ++++++---
drivers/scsi/scsi_lib.c | 9 +++++++++
2 files changed, 15 insertions(+), 3 deletions(-)
diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c
index 6660fa9..cdd904d 100644
--- a/drivers/scsi/hosts.c
+++ b/drivers/scsi/hosts.c
@@ -280,6 +280,7 @@ static void scsi_host_dev_release(struct device *dev)
{
struct Scsi_Host *shost = dev_to_shost(dev);
struct device *parent = dev->parent;
+ struct request_queue *q;
scsi_proc_hostdir_rm(shost->hostt);
@@ -287,9 +288,11 @@ static void scsi_host_dev_release(struct device *dev)
kthread_stop(shost->ehandler);
if (shost->work_q)
destroy_workqueue(shost->work_q);
- if (shost->uspace_req_q) {
- kfree(shost->uspace_req_q->queuedata);
- scsi_free_queue(shost->uspace_req_q);
+ q = shost->uspace_req_q;
+ if (q) {
+ kfree(q->queuedata);
+ q->queuedata = NULL;
+ scsi_free_queue(q);
}
scsi_destroy_command_freelist(shost);
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index 725f3cd..9f240f4 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -1676,6 +1676,15 @@ struct request_queue *scsi_alloc_queue(struct scsi_device *sdev)
void scsi_free_queue(struct request_queue *q)
{
+ unsigned long flags;
+
+ WARN_ON(q->queuedata);
+
+ /* cause scsi_request_fn() to kill all non-finished requests */
+ spin_lock_irqsave(q->queue_lock, flags);
+ q->request_fn(q);
+ spin_unlock_irqrestore(q->queue_lock, flags);
+
blk_cleanup_queue(q);
}
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 122/165] NFS/sunrpc: don't use a credential with extra groups.
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (120 preceding siblings ...)
2012-08-15 19:47 ` [v2.6.34-stable 121/165] [SCSI] Make scsi_free_queue() kill pending SCSI commands Paul Gortmaker
@ 2012-08-15 19:47 ` Paul Gortmaker
2012-08-15 19:47 ` [v2.6.34-stable 123/165] netlink: validate NLA_MSECS length Paul Gortmaker
` (42 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:47 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: NeilBrown, Trond Myklebust, Paul Gortmaker
From: NeilBrown <neilb@suse.de>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit dc6f55e9f8dac4b6479be67c5c9128ad37bb491f upstream.
The sunrpc layer keeps a cache of recently used credentials and
'unx_match' is used to find the credential which matches the current
process.
However unx_match allows a match when the cached credential has extra
groups at the end of uc_gids list which are not in the process group list.
So if a process with a list of (say) 4 group accesses a file and gains
access because of the last group in the list, then another process
with the same uid and gid, and a gid list being the first tree of the
gids of the original process tries to access the file, it will be
granted access even though it shouldn't as the wrong rpc credential
will be used.
Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
net/sunrpc/auth_unix.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/sunrpc/auth_unix.c b/net/sunrpc/auth_unix.c
index aac2f8b..c16f25d 100644
--- a/net/sunrpc/auth_unix.c
+++ b/net/sunrpc/auth_unix.c
@@ -130,6 +130,9 @@ unx_match(struct auth_cred *acred, struct rpc_cred *rcred, int flags)
for (i = 0; i < groups ; i++)
if (cred->uc_gids[i] != GROUP_AT(acred->group_info, i))
return 0;
+ if (groups < NFS_NGROUPS &&
+ cred->uc_gids[groups] != NOGROUP)
+ return 0;
return 1;
}
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 123/165] netlink: validate NLA_MSECS length
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (121 preceding siblings ...)
2012-08-15 19:47 ` [v2.6.34-stable 122/165] NFS/sunrpc: don't use a credential with extra groups Paul Gortmaker
@ 2012-08-15 19:47 ` Paul Gortmaker
2012-08-15 19:47 ` [v2.6.34-stable 124/165] mtd: mtdchar: add missing initializer on raw write Paul Gortmaker
` (41 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:47 UTC (permalink / raw)
To: stable, linux-kernel
Cc: Johannes Berg, Thomas Graf, David S. Miller, Paul Gortmaker
From: Johannes Berg <johannes.berg@intel.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit c30bc94758ae2a38a5eb31767c1985c0aae0950b upstream.
L2TP for example uses NLA_MSECS like this:
policy:
[L2TP_ATTR_RECV_TIMEOUT] = { .type = NLA_MSECS, },
code:
if (info->attrs[L2TP_ATTR_RECV_TIMEOUT])
cfg.reorder_timeout = nla_get_msecs(info->attrs[L2TP_ATTR_RECV_TIMEOUT]);
As nla_get_msecs() is essentially nla_get_u64() plus the
conversion to a HZ-based value, this will not properly
reject attributes from userspace that aren't long enough
and might overrun the message.
Add NLA_MSECS to the attribute minlen array to check the
size properly.
Cc: Thomas Graf <tgraf@suug.ch>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
lib/nlattr.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/lib/nlattr.c b/lib/nlattr.c
index c4706eb..109d4fe 100644
--- a/lib/nlattr.c
+++ b/lib/nlattr.c
@@ -20,6 +20,7 @@ static u16 nla_attr_minlen[NLA_TYPE_MAX+1] __read_mostly = {
[NLA_U16] = sizeof(u16),
[NLA_U32] = sizeof(u32),
[NLA_U64] = sizeof(u64),
+ [NLA_MSECS] = sizeof(u64),
[NLA_NESTED] = NLA_HDRLEN,
};
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 124/165] mtd: mtdchar: add missing initializer on raw write
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (122 preceding siblings ...)
2012-08-15 19:47 ` [v2.6.34-stable 123/165] netlink: validate NLA_MSECS length Paul Gortmaker
@ 2012-08-15 19:47 ` Paul Gortmaker
2012-08-15 19:47 ` [v2.6.34-stable 125/165] PM / Suspend: Off by one in pm_suspend() Paul Gortmaker
` (40 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:47 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Peter Wippich, Artem Bityutskiy, Paul Gortmaker
From: Peter Wippich <pewi@gw-instruments.de>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit bf5140817b2d65faac9b32fc9057a097044ac35b upstream.
On writes in MODE_RAW the mtd_oob_ops struct is not sufficiently
initialized which may cause nandwrite to fail. With this patch
it is possible to write raw nand/oob data without additional ECC
(either for testing or when some sectors need different oob layout
e.g. bootloader) like
nandwrite -n -r -o /dev/mtd0 <myfile>
Signed-off-by: Peter Wippich <pewi@gw-instruments.de>
Tested-by: Ricard Wanderlof <ricardw@axis.com>
Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/mtd/mtdchar.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
index 5b081cb..726a1b8 100644
--- a/drivers/mtd/mtdchar.c
+++ b/drivers/mtd/mtdchar.c
@@ -290,6 +290,7 @@ static ssize_t mtd_write(struct file *file, const char __user *buf, size_t count
ops.mode = MTD_OOB_RAW;
ops.datbuf = kbuf;
ops.oobbuf = NULL;
+ ops.ooboffs = 0;
ops.len = len;
ret = mtd->write_oob(mtd, *ppos, &ops);
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 125/165] PM / Suspend: Off by one in pm_suspend()
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (123 preceding siblings ...)
2012-08-15 19:47 ` [v2.6.34-stable 124/165] mtd: mtdchar: add missing initializer on raw write Paul Gortmaker
@ 2012-08-15 19:47 ` Paul Gortmaker
2012-08-15 19:47 ` [v2.6.34-stable 126/165] hfs: add sanity check for file name length Paul Gortmaker
` (39 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:47 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Dan Carpenter, Rafael J. Wysocki, Paul Gortmaker
From: Dan Carpenter <dan.carpenter@oracle.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 528f7ce6e439edeac38f6b3f8561f1be129b5e91 upstream.
In enter_state() we use "state" as an offset for the pm_states[]
array. The pm_states[] array only has PM_SUSPEND_MAX elements so
this test is off by one.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
kernel/power/suspend.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/power/suspend.c b/kernel/power/suspend.c
index 56e7dbb..7d4ae3b 100644
--- a/kernel/power/suspend.c
+++ b/kernel/power/suspend.c
@@ -297,7 +297,7 @@ int enter_state(suspend_state_t state)
*/
int pm_suspend(suspend_state_t state)
{
- if (state > PM_SUSPEND_ON && state <= PM_SUSPEND_MAX)
+ if (state > PM_SUSPEND_ON && state < PM_SUSPEND_MAX)
return enter_state(state);
return -EINVAL;
}
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 126/165] hfs: add sanity check for file name length
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (124 preceding siblings ...)
2012-08-15 19:47 ` [v2.6.34-stable 125/165] PM / Suspend: Off by one in pm_suspend() Paul Gortmaker
@ 2012-08-15 19:47 ` Paul Gortmaker
2012-08-15 19:47 ` [v2.6.34-stable 127/165] kbuild: Add extra gcc checks Paul Gortmaker
` (38 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:47 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Dan Carpenter, Linus Torvalds, Paul Gortmaker
From: Dan Carpenter <dan.carpenter@oracle.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit bc5b8a9003132ae44559edd63a1623b7b99dfb68 upstream.
On a corrupted file system the ->len field could be wrong leading to
a buffer overflow.
Reported-and-acked-by: Clement LECIGNE <clement.lecigne@netasq.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/hfs/trans.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/fs/hfs/trans.c b/fs/hfs/trans.c
index e673a88..b1ce4c7 100644
--- a/fs/hfs/trans.c
+++ b/fs/hfs/trans.c
@@ -40,6 +40,8 @@ int hfs_mac2asc(struct super_block *sb, char *out, const struct hfs_name *in)
src = in->name;
srclen = in->len;
+ if (srclen > HFS_NAMELEN)
+ srclen = HFS_NAMELEN;
dst = out;
dstlen = HFS_MAX_NAMELEN;
if (nls_io) {
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 127/165] kbuild: Add extra gcc checks
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (125 preceding siblings ...)
2012-08-15 19:47 ` [v2.6.34-stable 126/165] hfs: add sanity check for file name length Paul Gortmaker
@ 2012-08-15 19:47 ` Paul Gortmaker
2012-08-15 19:47 ` [v2.6.34-stable 128/165] kbuild: implement several W= levels Paul Gortmaker
` (37 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:47 UTC (permalink / raw)
To: stable, linux-kernel
Cc: Borislav Petkov, Michal Marek, linux-kbuild, Paul Gortmaker
From: Borislav Petkov <bp@alien8.de>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 4a5838ad9d2d4f7354a310982483f4c76aa0abeb upstream.
Add a 'W=1' Makefile switch which adds additional checking per build
object.
The idea behind this option is targeted at developers who, in the
process of writing their code, want to do the occasional
make W=1 [target.o]
and let gcc do more extensive code checking for them. Then, they
could eyeball the output for valid gcc warnings about various
bugs/discrepancies which are not reported during the normal build
process.
For more background information and a use case, read through this
thread: http://marc.info/?l=kernel-janitors&m=129802065918147&w=2
Cc: Michal Marek <mmarek@suse.cz>
Cc: linux-kbuild@vger.kernel.org
Acked-by: Sam Ravnborg <sam@ravnborg.org>
Acked-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Borislav Petkov <bp@alien8.de>
Signed-off-by: Michal Marek <mmarek@suse.cz>
[PG: used for 2.6.34 to better control new compilers on older code]
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
Documentation/kbuild/kbuild.txt | 5 +++++
Makefile | 5 +++++
scripts/Makefile.build | 35 ++++++++++++++++++++++++++++++++++-
3 files changed, 44 insertions(+), 1 deletion(-)
diff --git a/Documentation/kbuild/kbuild.txt b/Documentation/kbuild/kbuild.txt
index 6f8c1ca..6c35f63 100644
--- a/Documentation/kbuild/kbuild.txt
+++ b/Documentation/kbuild/kbuild.txt
@@ -162,3 +162,8 @@ For tags/TAGS/cscope targets, you can specify more than one arch
to be included in the databases, separated by blank space. E.g.:
$ make ALLSOURCE_ARCHS="x86 mips arm" tags
+
+KBUILD_ENABLE_EXTRA_GCC_CHECKS
+--------------------------------------------------
+If enabled over the make command line with "W=1", it turns on additional
+gcc -W... options for more extensive build-time checking.
diff --git a/Makefile b/Makefile
index eb9038f..e922e609 100644
--- a/Makefile
+++ b/Makefile
@@ -102,6 +102,10 @@ ifeq ("$(origin O)", "command line")
KBUILD_OUTPUT := $(O)
endif
+ifeq ("$(origin W)", "command line")
+ export KBUILD_ENABLE_EXTRA_GCC_CHECKS := 1
+endif
+
# That's our default target when none is given on the command line
PHONY := _all
_all:
@@ -1291,6 +1295,7 @@ help:
@echo ' make O=dir [targets] Locate all output files in "dir", including .config'
@echo ' make C=1 [targets] Check all c source with $$CHECK (sparse by default)'
@echo ' make C=2 [targets] Force check of all c source with $$CHECK'
+ @echo ' make W=1 [targets] Enable extra gcc checks'
@echo ''
@echo 'Execute "make" or "make all" to build all targets marked with [*] '
@echo 'For further info see the ./README file'
diff --git a/scripts/Makefile.build b/scripts/Makefile.build
index 0b94d2f..bd9d518 100644
--- a/scripts/Makefile.build
+++ b/scripts/Makefile.build
@@ -49,6 +49,40 @@ ifeq ($(KBUILD_NOPEDANTIC),)
$(error CFLAGS was changed in "$(kbuild-file)". Fix it to use EXTRA_CFLAGS)
endif
endif
+
+#
+# make W=1 settings
+#
+# $(call cc-option... ) handles gcc -W.. options which
+# are not supported by all versions of the compiler
+ifdef KBUILD_ENABLE_EXTRA_GCC_CHECKS
+KBUILD_EXTRA_WARNINGS := -Wextra
+KBUILD_EXTRA_WARNINGS += -Wunused -Wno-unused-parameter
+KBUILD_EXTRA_WARNINGS += -Waggregate-return
+KBUILD_EXTRA_WARNINGS += -Wbad-function-cast
+KBUILD_EXTRA_WARNINGS += -Wcast-qual
+KBUILD_EXTRA_WARNINGS += -Wcast-align
+KBUILD_EXTRA_WARNINGS += -Wconversion
+KBUILD_EXTRA_WARNINGS += -Wdisabled-optimization
+KBUILD_EXTRA_WARNINGS += -Wlogical-op
+KBUILD_EXTRA_WARNINGS += -Wmissing-declarations
+KBUILD_EXTRA_WARNINGS += -Wmissing-format-attribute
+KBUILD_EXTRA_WARNINGS += $(call cc-option, -Wmissing-include-dirs,)
+KBUILD_EXTRA_WARNINGS += -Wmissing-prototypes
+KBUILD_EXTRA_WARNINGS += -Wnested-externs
+KBUILD_EXTRA_WARNINGS += -Wold-style-definition
+KBUILD_EXTRA_WARNINGS += $(call cc-option, -Woverlength-strings,)
+KBUILD_EXTRA_WARNINGS += -Wpacked
+KBUILD_EXTRA_WARNINGS += -Wpacked-bitfield-compat
+KBUILD_EXTRA_WARNINGS += -Wpadded
+KBUILD_EXTRA_WARNINGS += -Wpointer-arith
+KBUILD_EXTRA_WARNINGS += -Wredundant-decls
+KBUILD_EXTRA_WARNINGS += -Wshadow
+KBUILD_EXTRA_WARNINGS += -Wswitch-default
+KBUILD_EXTRA_WARNINGS += $(call cc-option, -Wvla,)
+KBUILD_CFLAGS += $(KBUILD_EXTRA_WARNINGS)
+endif
+
include scripts/Makefile.lib
ifdef host-progs
@@ -384,7 +418,6 @@ ifneq ($(cmd_files),)
include $(cmd_files)
endif
-
# Declare the contents of the .PHONY variable as phony. We keep that
# information in a variable se we can use it in if_changed and friends.
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 128/165] kbuild: implement several W= levels
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (126 preceding siblings ...)
2012-08-15 19:47 ` [v2.6.34-stable 127/165] kbuild: Add extra gcc checks Paul Gortmaker
@ 2012-08-15 19:47 ` Paul Gortmaker
2012-08-15 19:47 ` [v2.6.34-stable 129/165] kbuild: Disable -Wunused-but-set-variable for gcc 4.6.0 Paul Gortmaker
` (36 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:47 UTC (permalink / raw)
To: stable, linux-kernel
Cc: Sam Ravnborg, Borislav Petkov, Dave Jones, Geert Uytterhoeven,
Michal Marek, Paul Gortmaker
From: Sam Ravnborg <sam@ravnborg.org>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 28bc20dccadc610c56e27255aeef2938141a0cd3 upstream.
Building a kernel with "make W=1" produces far too much noise to be
useful.
Divide the warning options in three groups:
W=1 - warnings that may be relevant and does not occur too often
W=2 - warnings that occur quite often but may still be relevant
W=3 - the more obscure warnings, can most likely be ignored
When building the whole kernel, those levels produce:
W=1 - 4859 warnings
W=2 - 1394 warnings
W=3 - 86666 warnings
respectively. Warnings have been counted with Geert's script at
http://www.kernel.org/pub/linux/kernel/people/geert/linux-log/linux-log-summary.pl
Many warnings occur from .h files so fixing one file may have a nice
effect on the total number of warnings.
With these changes I am actually tempted to try W=1 now and then.
Previously there was just too much noise.
Borislav:
- make the W= levels exclusive
- move very noisy and making little sense for the kernel warnings to W=3
- drop -Woverlength-strings due to useless warning message
- copy explanatory text for the different warning levels to 'make help'
- recount warnings per level
Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: Borislav Petkov <bp@alien8.de>
Cc: Dave Jones <davej@redhat.com>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Michal Marek <mmarek@suse.cz>
[PG: used for 2.6.34 to better control new compilers on older code]
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
Makefile | 8 +++++--
scripts/Makefile.build | 65 +++++++++++++++++++++++++++++---------------------
2 files changed, 44 insertions(+), 29 deletions(-)
diff --git a/Makefile b/Makefile
index e922e609..25a8f63 100644
--- a/Makefile
+++ b/Makefile
@@ -103,7 +103,7 @@ ifeq ("$(origin O)", "command line")
endif
ifeq ("$(origin W)", "command line")
- export KBUILD_ENABLE_EXTRA_GCC_CHECKS := 1
+ export KBUILD_ENABLE_EXTRA_GCC_CHECKS := $(W)
endif
# That's our default target when none is given on the command line
@@ -1295,7 +1295,11 @@ help:
@echo ' make O=dir [targets] Locate all output files in "dir", including .config'
@echo ' make C=1 [targets] Check all c source with $$CHECK (sparse by default)'
@echo ' make C=2 [targets] Force check of all c source with $$CHECK'
- @echo ' make W=1 [targets] Enable extra gcc checks'
+ @echo ' make W=n [targets] Enable extra gcc checks, n=1,2,3 where'
+ @echo ' 1: warnings which may be relevant and do not occur too often'
+ @echo ' 2: warnings which occur quite often but may still be relevant'
+ @echo ' 3: more obscure warnings, can most likely be ignored'
+
@echo ''
@echo 'Execute "make" or "make all" to build all targets marked with [*] '
@echo 'For further info see the ./README file'
diff --git a/scripts/Makefile.build b/scripts/Makefile.build
index bd9d518..f9a413b 100644
--- a/scripts/Makefile.build
+++ b/scripts/Makefile.build
@@ -51,36 +51,47 @@ ifeq ($(KBUILD_NOPEDANTIC),)
endif
#
-# make W=1 settings
+# make W=... settings
#
-# $(call cc-option... ) handles gcc -W.. options which
+# W=1 - warnings that may be relevant and does not occur too often
+# W=2 - warnings that occur quite often but may still be relevant
+# W=3 - the more obscure warnings, can most likely be ignored
+#
+# $(call cc-option, -W...) handles gcc -W.. options which
# are not supported by all versions of the compiler
ifdef KBUILD_ENABLE_EXTRA_GCC_CHECKS
-KBUILD_EXTRA_WARNINGS := -Wextra
-KBUILD_EXTRA_WARNINGS += -Wunused -Wno-unused-parameter
-KBUILD_EXTRA_WARNINGS += -Waggregate-return
-KBUILD_EXTRA_WARNINGS += -Wbad-function-cast
-KBUILD_EXTRA_WARNINGS += -Wcast-qual
-KBUILD_EXTRA_WARNINGS += -Wcast-align
-KBUILD_EXTRA_WARNINGS += -Wconversion
-KBUILD_EXTRA_WARNINGS += -Wdisabled-optimization
-KBUILD_EXTRA_WARNINGS += -Wlogical-op
-KBUILD_EXTRA_WARNINGS += -Wmissing-declarations
-KBUILD_EXTRA_WARNINGS += -Wmissing-format-attribute
-KBUILD_EXTRA_WARNINGS += $(call cc-option, -Wmissing-include-dirs,)
-KBUILD_EXTRA_WARNINGS += -Wmissing-prototypes
-KBUILD_EXTRA_WARNINGS += -Wnested-externs
-KBUILD_EXTRA_WARNINGS += -Wold-style-definition
-KBUILD_EXTRA_WARNINGS += $(call cc-option, -Woverlength-strings,)
-KBUILD_EXTRA_WARNINGS += -Wpacked
-KBUILD_EXTRA_WARNINGS += -Wpacked-bitfield-compat
-KBUILD_EXTRA_WARNINGS += -Wpadded
-KBUILD_EXTRA_WARNINGS += -Wpointer-arith
-KBUILD_EXTRA_WARNINGS += -Wredundant-decls
-KBUILD_EXTRA_WARNINGS += -Wshadow
-KBUILD_EXTRA_WARNINGS += -Wswitch-default
-KBUILD_EXTRA_WARNINGS += $(call cc-option, -Wvla,)
-KBUILD_CFLAGS += $(KBUILD_EXTRA_WARNINGS)
+warning-1 := -Wextra -Wunused -Wno-unused-parameter
+warning-1 += -Wmissing-declarations
+warning-1 += -Wmissing-format-attribute
+warning-1 += -Wmissing-prototypes
+warning-1 += -Wold-style-definition
+warning-1 += $(call cc-option, -Wmissing-include-dirs)
+
+warning-2 := -Waggregate-return
+warning-2 += -Wcast-align
+warning-2 += -Wdisabled-optimization
+warning-2 += -Wnested-externs
+warning-2 += -Wshadow
+warning-2 += $(call cc-option, -Wlogical-op)
+
+warning-3 := -Wbad-function-cast
+warning-3 += -Wcast-qual
+warning-3 += -Wconversion
+warning-3 += -Wpacked
+warning-3 += -Wpadded
+warning-3 += -Wpointer-arith
+warning-3 += -Wredundant-decls
+warning-3 += -Wswitch-default
+warning-3 += $(call cc-option, -Wpacked-bitfield-compat)
+warning-3 += $(call cc-option, -Wvla)
+
+warning := $(warning-$(KBUILD_ENABLE_EXTRA_GCC_CHECKS))
+
+ifeq ("$(warning)","")
+ $(error W=$(KBUILD_ENABLE_EXTRA_GCC_CHECKS) is unknown)
+endif
+
+KBUILD_CFLAGS += $(warning)
endif
include scripts/Makefile.lib
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 129/165] kbuild: Disable -Wunused-but-set-variable for gcc 4.6.0
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (127 preceding siblings ...)
2012-08-15 19:47 ` [v2.6.34-stable 128/165] kbuild: implement several W= levels Paul Gortmaker
@ 2012-08-15 19:47 ` Paul Gortmaker
2012-08-15 19:47 ` [v2.6.34-stable 130/165] md/raid5: abort any pending parity operations when array fails Paul Gortmaker
` (35 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:47 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Dave Jones, Michal Marek, Paul Gortmaker
From: Dave Jones <davej@redhat.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit af0e5d565d2fffcd97d1e2d89669d627cc04e8b8 upstream.
Disable the new -Wunused-but-set-variable that was added in gcc 4.6.0
It produces more false positives than useful warnings.
This can still be enabled using W=1
Signed-off-by: Dave Jones <davej@redhat.com>
Acked-by: Sam Ravnborg <sam@ravnborg.org>
Tested-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: Michal Marek <mmarek@suse.cz>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
Makefile | 4 ++++
scripts/Makefile.build | 1 +
2 files changed, 5 insertions(+)
diff --git a/Makefile b/Makefile
index 25a8f63..e9fafd0 100644
--- a/Makefile
+++ b/Makefile
@@ -547,6 +547,10 @@ ifndef CONFIG_CC_STACKPROTECTOR
KBUILD_CFLAGS += $(call cc-option, -fno-stack-protector)
endif
+# This warning generated too much noise in a regular build.
+# Use make W=1 to enable this warning (see scripts/Makefile.build)
+KBUILD_CFLAGS += $(call cc-option, -Wno-unused-but-set-variable)
+
ifdef CONFIG_FRAME_POINTER
KBUILD_CFLAGS += -fno-omit-frame-pointer -fno-optimize-sibling-calls
else
diff --git a/scripts/Makefile.build b/scripts/Makefile.build
index f9a413b..4e82824 100644
--- a/scripts/Makefile.build
+++ b/scripts/Makefile.build
@@ -66,6 +66,7 @@ warning-1 += -Wmissing-format-attribute
warning-1 += -Wmissing-prototypes
warning-1 += -Wold-style-definition
warning-1 += $(call cc-option, -Wmissing-include-dirs)
+warning-1 += $(call cc-option, -Wunused-but-set-variable)
warning-2 := -Waggregate-return
warning-2 += -Wcast-align
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 130/165] md/raid5: abort any pending parity operations when array fails.
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (128 preceding siblings ...)
2012-08-15 19:47 ` [v2.6.34-stable 129/165] kbuild: Disable -Wunused-but-set-variable for gcc 4.6.0 Paul Gortmaker
@ 2012-08-15 19:47 ` Paul Gortmaker
2012-08-15 19:47 ` [v2.6.34-stable 131/165] [media] Remove the old V4L1 v4lgrab.c file Paul Gortmaker
` (34 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:47 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: NeilBrown, Greg Kroah-Hartman, Paul Gortmaker
From: NeilBrown <neilb@suse.de>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 9a3f530f39f4490eaa18b02719fb74ce5f4d2d86 upstream.
When the number of failed devices exceeds the allowed number
we must abort any active parity operations (checks or updates) as they
are no longer meaningful, and can lead to a BUG_ON in
handle_parity_checks6.
This bug was introduce by commit 6c0069c0ae9659e3a91b68eaed06a5c6c37f45c8
in 2.6.29.
Reported-by: Manish Katiyar <mkatiyar@gmail.com>
Tested-by: Manish Katiyar <mkatiyar@gmail.com>
Acked-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
[PG: use 2.6.32.49 backport since raid5.c @ 9a3f530f/v3.2 differs more]
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/md/raid5.c | 32 ++++++++++++++++++++------------
1 file changed, 20 insertions(+), 12 deletions(-)
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index dc3e4fc..2936c3b 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -3040,12 +3040,16 @@ static void handle_stripe5(struct stripe_head *sh)
/* check if the array has lost two devices and, if so, some requests might
* need to be failed
*/
- if (s.failed > 1 && s.to_read+s.to_write+s.written)
- handle_failed_stripe(conf, sh, &s, disks, &return_bi);
- if (s.failed > 1 && s.syncing) {
- md_done_sync(conf->mddev, STRIPE_SECTORS,0);
- clear_bit(STRIPE_SYNCING, &sh->state);
- s.syncing = 0;
+ if (s.failed > 1) {
+ sh->check_state = 0;
+ sh->reconstruct_state = 0;
+ if (s.to_read+s.to_write+s.written)
+ handle_failed_stripe(conf, sh, &s, disks, &return_bi);
+ if (s.syncing) {
+ md_done_sync(conf->mddev, STRIPE_SECTORS,0);
+ clear_bit(STRIPE_SYNCING, &sh->state);
+ s.syncing = 0;
+ }
}
/* might be able to return some write requests if the parity block
@@ -3323,12 +3327,16 @@ static void handle_stripe6(struct stripe_head *sh)
/* check if the array has lost >2 devices and, if so, some requests
* might need to be failed
*/
- if (s.failed > 2 && s.to_read+s.to_write+s.written)
- handle_failed_stripe(conf, sh, &s, disks, &return_bi);
- if (s.failed > 2 && s.syncing) {
- md_done_sync(conf->mddev, STRIPE_SECTORS,0);
- clear_bit(STRIPE_SYNCING, &sh->state);
- s.syncing = 0;
+ if (s.failed > 2) {
+ sh->check_state = 0;
+ sh->reconstruct_state = 0;
+ if (s.to_read+s.to_write+s.written)
+ handle_failed_stripe(conf, sh, &s, disks, &return_bi);
+ if (s.syncing) {
+ md_done_sync(conf->mddev, STRIPE_SECTORS,0);
+ clear_bit(STRIPE_SYNCING, &sh->state);
+ s.syncing = 0;
+ }
}
/*
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 131/165] [media] Remove the old V4L1 v4lgrab.c file
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (129 preceding siblings ...)
2012-08-15 19:47 ` [v2.6.34-stable 130/165] md/raid5: abort any pending parity operations when array fails Paul Gortmaker
@ 2012-08-15 19:47 ` Paul Gortmaker
2012-08-15 19:47 ` [v2.6.34-stable 132/165] drm/i915: Sanity check pread/pwrite Paul Gortmaker
` (33 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:47 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Mauro Carvalho Chehab, Paul Gortmaker
From: Mauro Carvalho Chehab <mchehab@redhat.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 55fe25b418640fad04190103274841b2c907bacd upstream.
This example file uses the old V4L1 API. It also doesn't use libv4l.
So, it is completely obsolete. A good example already exists at
v4l-utils (v4l2grab.c):
http://git.linuxtv.org/v4l-utils.git
Reviewed-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
Documentation/Makefile | 2 +-
Documentation/video4linux/Makefile | 8 --
Documentation/video4linux/v4lgrab.c | 201 ------------------------------------
3 files changed, 1 insertion(+), 210 deletions(-)
delete mode 100644 Documentation/video4linux/Makefile
delete mode 100644 Documentation/video4linux/v4lgrab.c
diff --git a/Documentation/Makefile b/Documentation/Makefile
index 6fc7ea1..9b4bc5c 100644
--- a/Documentation/Makefile
+++ b/Documentation/Makefile
@@ -1,3 +1,3 @@
obj-m := DocBook/ accounting/ auxdisplay/ connector/ \
filesystems/ filesystems/configfs/ ia64/ laptops/ networking/ \
- pcmcia/ spi/ timers/ video4linux/ vm/ watchdog/src/
+ pcmcia/ spi/ timers/ vm/ watchdog/src/
diff --git a/Documentation/video4linux/Makefile b/Documentation/video4linux/Makefile
deleted file mode 100644
index 1ed0e98..0000000
--- a/Documentation/video4linux/Makefile
+++ /dev/null
@@ -1,8 +0,0 @@
-# kbuild trick to avoid linker error. Can be omitted if a module is built.
-obj- := dummy.o
-
-# List of programs to build
-hostprogs-y := v4lgrab
-
-# Tell kbuild to always build the programs
-always := $(hostprogs-y)
diff --git a/Documentation/video4linux/v4lgrab.c b/Documentation/video4linux/v4lgrab.c
deleted file mode 100644
index c8ded17..0000000
--- a/Documentation/video4linux/v4lgrab.c
+++ /dev/null
@@ -1,201 +0,0 @@
-/* Simple Video4Linux image grabber. */
-/*
- * Video4Linux Driver Test/Example Framegrabbing Program
- *
- * Compile with:
- * gcc -s -Wall -Wstrict-prototypes v4lgrab.c -o v4lgrab
- * Use as:
- * v4lgrab >image.ppm
- *
- * Copyright (C) 1998-05-03, Phil Blundell <philb@gnu.org>
- * Copied from http://www.tazenda.demon.co.uk/phil/vgrabber.c
- * with minor modifications (Dave Forrest, drf5n@virginia.edu).
- *
- *
- * For some cameras you may need to pre-load libv4l to perform
- * the necessary decompression, e.g.:
- *
- * export LD_PRELOAD=/usr/lib/libv4l/v4l1compat.so
- * ./v4lgrab >image.ppm
- *
- * see http://hansdegoede.livejournal.com/3636.html for details.
- *
- */
-
-#include <unistd.h>
-#include <sys/types.h>
-#include <sys/stat.h>
-#include <fcntl.h>
-#include <stdio.h>
-#include <sys/ioctl.h>
-#include <stdlib.h>
-
-#include <linux/types.h>
-#include <linux/videodev.h>
-
-#define VIDEO_DEV "/dev/video0"
-
-/* Stole this from tvset.c */
-
-#define READ_VIDEO_PIXEL(buf, format, depth, r, g, b) \
-{ \
- switch (format) \
- { \
- case VIDEO_PALETTE_GREY: \
- switch (depth) \
- { \
- case 4: \
- case 6: \
- case 8: \
- (r) = (g) = (b) = (*buf++ << 8);\
- break; \
- \
- case 16: \
- (r) = (g) = (b) = \
- *((unsigned short *) buf); \
- buf += 2; \
- break; \
- } \
- break; \
- \
- \
- case VIDEO_PALETTE_RGB565: \
- { \
- unsigned short tmp = *(unsigned short *)buf; \
- (r) = tmp&0xF800; \
- (g) = (tmp<<5)&0xFC00; \
- (b) = (tmp<<11)&0xF800; \
- buf += 2; \
- } \
- break; \
- \
- case VIDEO_PALETTE_RGB555: \
- (r) = (buf[0]&0xF8)<<8; \
- (g) = ((buf[0] << 5 | buf[1] >> 3)&0xF8)<<8; \
- (b) = ((buf[1] << 2 ) & 0xF8)<<8; \
- buf += 2; \
- break; \
- \
- case VIDEO_PALETTE_RGB24: \
- (r) = buf[0] << 8; (g) = buf[1] << 8; \
- (b) = buf[2] << 8; \
- buf += 3; \
- break; \
- \
- default: \
- fprintf(stderr, \
- "Format %d not yet supported\n", \
- format); \
- } \
-}
-
-static int get_brightness_adj(unsigned char *image, long size, int *brightness) {
- long i, tot = 0;
- for (i=0;i<size*3;i++)
- tot += image[i];
- *brightness = (128 - tot/(size*3))/3;
- return !((tot/(size*3)) >= 126 && (tot/(size*3)) <= 130);
-}
-
-int main(int argc, char ** argv)
-{
- int fd = open(VIDEO_DEV, O_RDONLY), f;
- struct video_capability cap;
- struct video_window win;
- struct video_picture vpic;
-
- unsigned char *buffer, *src;
- int bpp = 24, r = 0, g = 0, b = 0;
- unsigned int i, src_depth = 16;
-
- if (fd < 0) {
- perror(VIDEO_DEV);
- exit(1);
- }
-
- if (ioctl(fd, VIDIOCGCAP, &cap) < 0) {
- perror("VIDIOGCAP");
- fprintf(stderr, "(" VIDEO_DEV " not a video4linux device?)\n");
- close(fd);
- exit(1);
- }
-
- if (ioctl(fd, VIDIOCGWIN, &win) < 0) {
- perror("VIDIOCGWIN");
- close(fd);
- exit(1);
- }
-
- if (ioctl(fd, VIDIOCGPICT, &vpic) < 0) {
- perror("VIDIOCGPICT");
- close(fd);
- exit(1);
- }
-
- if (cap.type & VID_TYPE_MONOCHROME) {
- vpic.depth=8;
- vpic.palette=VIDEO_PALETTE_GREY; /* 8bit grey */
- if(ioctl(fd, VIDIOCSPICT, &vpic) < 0) {
- vpic.depth=6;
- if(ioctl(fd, VIDIOCSPICT, &vpic) < 0) {
- vpic.depth=4;
- if(ioctl(fd, VIDIOCSPICT, &vpic) < 0) {
- fprintf(stderr, "Unable to find a supported capture format.\n");
- close(fd);
- exit(1);
- }
- }
- }
- } else {
- vpic.depth=24;
- vpic.palette=VIDEO_PALETTE_RGB24;
-
- if(ioctl(fd, VIDIOCSPICT, &vpic) < 0) {
- vpic.palette=VIDEO_PALETTE_RGB565;
- vpic.depth=16;
-
- if(ioctl(fd, VIDIOCSPICT, &vpic)==-1) {
- vpic.palette=VIDEO_PALETTE_RGB555;
- vpic.depth=15;
-
- if(ioctl(fd, VIDIOCSPICT, &vpic)==-1) {
- fprintf(stderr, "Unable to find a supported capture format.\n");
- return -1;
- }
- }
- }
- }
-
- buffer = malloc(win.width * win.height * bpp);
- if (!buffer) {
- fprintf(stderr, "Out of memory.\n");
- exit(1);
- }
-
- do {
- int newbright;
- read(fd, buffer, win.width * win.height * bpp);
- f = get_brightness_adj(buffer, win.width * win.height, &newbright);
- if (f) {
- vpic.brightness += (newbright << 8);
- if(ioctl(fd, VIDIOCSPICT, &vpic)==-1) {
- perror("VIDIOSPICT");
- break;
- }
- }
- } while (f);
-
- fprintf(stdout, "P6\n%d %d 255\n", win.width, win.height);
-
- src = buffer;
-
- for (i = 0; i < win.width * win.height; i++) {
- READ_VIDEO_PIXEL(src, vpic.palette, src_depth, r, g, b);
- fputc(r>>8, stdout);
- fputc(g>>8, stdout);
- fputc(b>>8, stdout);
- }
-
- close(fd);
- return 0;
-}
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 132/165] drm/i915: Sanity check pread/pwrite
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (130 preceding siblings ...)
2012-08-15 19:47 ` [v2.6.34-stable 131/165] [media] Remove the old V4L1 v4lgrab.c file Paul Gortmaker
@ 2012-08-15 19:47 ` Paul Gortmaker
2012-08-15 19:47 ` [v2.6.34-stable 133/165] drm/i915: Rephrase pwrite bounds checking to avoid any potential overflow Paul Gortmaker
` (32 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:47 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Chris Wilson, Paul Gortmaker
From: Chris Wilson <chris@chris-wilson.co.uk>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit ce9d419dbecc292cc3e06e8b1d6d123d3fa813a4 upstream.
Move the access control up from the fast paths, which are no longer
universally taken first, up into the caller. This then duplicates some
sanity checking along the slow paths, but is much simpler.
Tracked as CVE-2010-2962.
Reported-by: Kees Cook <kees@ubuntu.com>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/gpu/drm/i915/i915_gem.c | 28 ++++++++++++++++++++--------
1 file changed, 20 insertions(+), 8 deletions(-)
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index e07722a..fd51c36 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -487,8 +487,15 @@ i915_gem_pread_ioctl(struct drm_device *dev, void *data,
*/
if (args->offset > obj->size || args->size > obj->size ||
args->offset + args->size > obj->size) {
- drm_gem_object_unreference_unlocked(obj);
- return -EINVAL;
+ ret = -EINVAL;
+ goto err;
+ }
+
+ if (!access_ok(VERIFY_WRITE,
+ (char __user *)(uintptr_t)args->data_ptr,
+ args->size)) {
+ ret = -EFAULT;
+ goto err;
}
if (i915_gem_object_needs_bit17_swizzle(obj)) {
@@ -500,8 +507,8 @@ i915_gem_pread_ioctl(struct drm_device *dev, void *data,
file_priv);
}
+err:
drm_gem_object_unreference_unlocked(obj);
-
return ret;
}
@@ -591,8 +598,6 @@ i915_gem_gtt_pwrite_fast(struct drm_device *dev, struct drm_gem_object *obj,
user_data = (char __user *) (uintptr_t) args->data_ptr;
remain = args->size;
- if (!access_ok(VERIFY_READ, user_data, remain))
- return -EFAULT;
mutex_lock(&dev->struct_mutex);
@@ -960,8 +965,15 @@ i915_gem_pwrite_ioctl(struct drm_device *dev, void *data,
*/
if (args->offset > obj->size || args->size > obj->size ||
args->offset + args->size > obj->size) {
- drm_gem_object_unreference_unlocked(obj);
- return -EINVAL;
+ ret = -EINVAL;
+ goto err;
+ }
+
+ if (!access_ok(VERIFY_READ,
+ (char __user *)(uintptr_t)args->data_ptr,
+ args->size)) {
+ ret = -EFAULT;
+ goto err;
}
/* We can only do the GTT pwrite on untiled buffers, as otherwise
@@ -994,8 +1006,8 @@ i915_gem_pwrite_ioctl(struct drm_device *dev, void *data,
DRM_INFO("pwrite failed %d\n", ret);
#endif
+err:
drm_gem_object_unreference_unlocked(obj);
-
return ret;
}
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 133/165] drm/i915: Rephrase pwrite bounds checking to avoid any potential overflow
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (131 preceding siblings ...)
2012-08-15 19:47 ` [v2.6.34-stable 132/165] drm/i915: Sanity check pread/pwrite Paul Gortmaker
@ 2012-08-15 19:47 ` Paul Gortmaker
2012-08-15 19:47 ` [v2.6.34-stable 134/165] mm: avoid null pointer access in vm_struct via /proc/vmallocinfo Paul Gortmaker
` (31 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:47 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Chris Wilson, Paul Gortmaker
From: Chris Wilson <chris@chris-wilson.co.uk>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 7dcd2499deab8f10011713c40bc2f309c9b65077 upstream.
... and do the same for pread.
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/gpu/drm/i915/i915_gem.c | 16 ++++------------
1 file changed, 4 insertions(+), 12 deletions(-)
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index fd51c36..82d798b 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -481,12 +481,8 @@ i915_gem_pread_ioctl(struct drm_device *dev, void *data,
return -EBADF;
obj_priv = to_intel_bo(obj);
- /* Bounds check source.
- *
- * XXX: This could use review for overflow issues...
- */
- if (args->offset > obj->size || args->size > obj->size ||
- args->offset + args->size > obj->size) {
+ /* Bounds check source. */
+ if (args->offset > obj->size || args->size > obj->size - args->offset) {
ret = -EINVAL;
goto err;
}
@@ -959,12 +955,8 @@ i915_gem_pwrite_ioctl(struct drm_device *dev, void *data,
return -EBADF;
obj_priv = to_intel_bo(obj);
- /* Bounds check destination.
- *
- * XXX: This could use review for overflow issues...
- */
- if (args->offset > obj->size || args->size > obj->size ||
- args->offset + args->size > obj->size) {
+ /* Bounds check destination. */
+ if (args->offset > obj->size || args->size > obj->size - args->offset) {
ret = -EINVAL;
goto err;
}
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 134/165] mm: avoid null pointer access in vm_struct via /proc/vmallocinfo
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (132 preceding siblings ...)
2012-08-15 19:47 ` [v2.6.34-stable 133/165] drm/i915: Rephrase pwrite bounds checking to avoid any potential overflow Paul Gortmaker
@ 2012-08-15 19:47 ` Paul Gortmaker
2012-08-17 15:22 ` Herton Ronaldo Krzesinski
2012-08-15 19:47 ` [v2.6.34-stable 135/165] kbuild: Fix passing -Wno-* options to gcc 4.4+ Paul Gortmaker
` (30 subsequent siblings)
164 siblings, 1 reply; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:47 UTC (permalink / raw)
To: stable, linux-kernel
Cc: Mitsuo Hayasaka, Andrew Morton, David Rientjes, Namhyung Kim,
Paul E. McKenney, Jeremy Fitzhardinge, Linus Torvalds,
Paul Gortmaker
From: Mitsuo Hayasaka <mitsuo.hayasaka.hu@hitachi.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit f5252e009d5b87071a919221e4f6624184005368 upstream.
The /proc/vmallocinfo shows information about vmalloc allocations in
vmlist that is a linklist of vm_struct. It, however, may access pages
field of vm_struct where a page was not allocated. This results in a null
pointer access and leads to a kernel panic.
Why this happens: In __vmalloc_node_range() called from vmalloc(), newly
allocated vm_struct is added to vmlist at __get_vm_area_node() and then,
some fields of vm_struct such as nr_pages and pages are set at
__vmalloc_area_node(). In other words, it is added to vmlist before it is
fully initialized. At the same time, when the /proc/vmallocinfo is read,
it accesses the pages field of vm_struct according to the nr_pages field
at show_numa_info(). Thus, a null pointer access happens.
The patch adds the newly allocated vm_struct to the vmlist *after* it is
fully initialized. So, it can avoid accessing the pages field with
unallocated page when show_numa_info() is called.
Signed-off-by: Mitsuo Hayasaka <mitsuo.hayasaka.hu@hitachi.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: David Rientjes <rientjes@google.com>
Cc: Namhyung Kim <namhyung@gmail.com>
Cc: "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>
Cc: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[PG: .34 has VMALLOC_START/END vs. start/end in f5252e009d5]
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
include/linux/vmalloc.h | 1 +
mm/vmalloc.c | 66 ++++++++++++++++++++++++++++++++++++-------------
2 files changed, 50 insertions(+), 17 deletions(-)
diff --git a/include/linux/vmalloc.h b/include/linux/vmalloc.h
index 227c2a5..346df02 100644
--- a/include/linux/vmalloc.h
+++ b/include/linux/vmalloc.h
@@ -13,6 +13,7 @@ struct vm_area_struct; /* vma defining user mapping in mm_types.h */
#define VM_MAP 0x00000004 /* vmap()ed pages */
#define VM_USERMAP 0x00000008 /* suitable for remap_vmalloc_range */
#define VM_VPAGES 0x00000010 /* buffer for pages was vmalloc'ed */
+#define VM_UNLIST 0x00000020 /* vm_struct is not listed in vmlist */
/* bits [20..32] reserved for arch specific ioremap internals */
/*
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index d44abdd..3843789 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -1204,18 +1204,22 @@ EXPORT_SYMBOL_GPL(map_vm_area);
DEFINE_RWLOCK(vmlist_lock);
struct vm_struct *vmlist;
-static void insert_vmalloc_vm(struct vm_struct *vm, struct vmap_area *va,
+static void setup_vmalloc_vm(struct vm_struct *vm, struct vmap_area *va,
unsigned long flags, void *caller)
{
- struct vm_struct *tmp, **p;
-
vm->flags = flags;
vm->addr = (void *)va->va_start;
vm->size = va->va_end - va->va_start;
vm->caller = caller;
va->private = vm;
va->flags |= VM_VM_AREA;
+}
+
+static void insert_vmalloc_vmlist(struct vm_struct *vm)
+{
+ struct vm_struct *tmp, **p;
+ vm->flags &= ~VM_UNLIST;
write_lock(&vmlist_lock);
for (p = &vmlist; (tmp = *p) != NULL; p = &tmp->next) {
if (tmp->addr >= vm->addr)
@@ -1226,6 +1230,13 @@ static void insert_vmalloc_vm(struct vm_struct *vm, struct vmap_area *va,
write_unlock(&vmlist_lock);
}
+static void insert_vmalloc_vm(struct vm_struct *vm, struct vmap_area *va,
+ unsigned long flags, void *caller)
+{
+ setup_vmalloc_vm(vm, va, flags, caller);
+ insert_vmalloc_vmlist(vm);
+}
+
static struct vm_struct *__get_vm_area_node(unsigned long size,
unsigned long align, unsigned long flags, unsigned long start,
unsigned long end, int node, gfp_t gfp_mask, void *caller)
@@ -1264,7 +1275,18 @@ static struct vm_struct *__get_vm_area_node(unsigned long size,
return NULL;
}
- insert_vmalloc_vm(area, va, flags, caller);
+ /*
+ * When this function is called from __vmalloc_node_range,
+ * we do not add vm_struct to vmlist here to avoid
+ * accessing uninitialized members of vm_struct such as
+ * pages and nr_pages fields. They will be set later.
+ * To distinguish it from others, we use a VM_UNLIST flag.
+ */
+ if (flags & VM_UNLIST)
+ setup_vmalloc_vm(area, va, flags, caller);
+ else
+ insert_vmalloc_vm(area, va, flags, caller);
+
return area;
}
@@ -1339,17 +1361,20 @@ struct vm_struct *remove_vm_area(const void *addr)
va = find_vmap_area((unsigned long)addr);
if (va && va->flags & VM_VM_AREA) {
struct vm_struct *vm = va->private;
- struct vm_struct *tmp, **p;
- /*
- * remove from list and disallow access to this vm_struct
- * before unmap. (address range confliction is maintained by
- * vmap.)
- */
- write_lock(&vmlist_lock);
- for (p = &vmlist; (tmp = *p) != vm; p = &tmp->next)
- ;
- *p = tmp->next;
- write_unlock(&vmlist_lock);
+
+ if (!(vm->flags & VM_UNLIST)) {
+ struct vm_struct *tmp, **p;
+ /*
+ * remove from list and disallow access to
+ * this vm_struct before unmap. (address range
+ * confliction is maintained by vmap.)
+ */
+ write_lock(&vmlist_lock);
+ for (p = &vmlist; (tmp = *p) != vm; p = &tmp->next)
+ ;
+ *p = tmp->next;
+ write_unlock(&vmlist_lock);
+ }
vmap_debug_free_range(va->va_start, va->va_end);
free_unmap_vmap_area(va);
@@ -1568,8 +1593,9 @@ static void *__vmalloc_node(unsigned long size, unsigned long align,
if (!size || (size >> PAGE_SHIFT) > totalram_pages)
return NULL;
- area = __get_vm_area_node(size, align, VM_ALLOC, VMALLOC_START,
- VMALLOC_END, node, gfp_mask, caller);
+ area = __get_vm_area_node(size, align, VM_ALLOC | VM_UNLIST,
+ VMALLOC_START, VMALLOC_END, node,
+ gfp_mask, caller);
if (!area)
return NULL;
@@ -1577,6 +1603,12 @@ static void *__vmalloc_node(unsigned long size, unsigned long align,
addr = __vmalloc_area_node(area, gfp_mask, prot, node, caller);
/*
+ * In this function, newly allocated vm_struct is not added
+ * to vmlist at __get_vm_area_node(). so, it is added here.
+ */
+ insert_vmalloc_vmlist(area);
+
+ /*
* A ref_count = 3 is needed because the vm_struct and vmap_area
* structures allocated in the __get_vm_area_node() function contain
* references to the virtual address of the vmalloc'ed block.
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* Re: [v2.6.34-stable 134/165] mm: avoid null pointer access in vm_struct via /proc/vmallocinfo
2012-08-15 19:47 ` [v2.6.34-stable 134/165] mm: avoid null pointer access in vm_struct via /proc/vmallocinfo Paul Gortmaker
@ 2012-08-17 15:22 ` Herton Ronaldo Krzesinski
2012-08-17 18:26 ` Paul Gortmaker
0 siblings, 1 reply; 186+ messages in thread
From: Herton Ronaldo Krzesinski @ 2012-08-17 15:22 UTC (permalink / raw)
To: Paul Gortmaker
Cc: stable, linux-kernel, Mitsuo Hayasaka, Andrew Morton,
David Rientjes, Namhyung Kim, Paul E. McKenney,
Jeremy Fitzhardinge, Linus Torvalds, Mel Gorman, Luciano Chavez,
Rik van Riel
On Wed, Aug 15, 2012 at 03:47:58PM -0400, Paul Gortmaker wrote:
> From: Mitsuo Hayasaka <mitsuo.hayasaka.hu@hitachi.com>
>
> -------------------
> This is a commit scheduled for the next v2.6.34 longterm release.
> http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
> If you see a problem with using this for longterm, please comment.
> -------------------
>
> commit f5252e009d5b87071a919221e4f6624184005368 upstream.
>
> The /proc/vmallocinfo shows information about vmalloc allocations in
> vmlist that is a linklist of vm_struct. It, however, may access pages
> field of vm_struct where a page was not allocated. This results in a null
> pointer access and leads to a kernel panic.
>
> Why this happens: In __vmalloc_node_range() called from vmalloc(), newly
> allocated vm_struct is added to vmlist at __get_vm_area_node() and then,
> some fields of vm_struct such as nr_pages and pages are set at
> __vmalloc_area_node(). In other words, it is added to vmlist before it is
> fully initialized. At the same time, when the /proc/vmallocinfo is read,
> it accesses the pages field of vm_struct according to the nr_pages field
> at show_numa_info(). Thus, a null pointer access happens.
>
> The patch adds the newly allocated vm_struct to the vmlist *after* it is
> fully initialized. So, it can avoid accessing the pages field with
> unallocated page when show_numa_info() is called.
>
> Signed-off-by: Mitsuo Hayasaka <mitsuo.hayasaka.hu@hitachi.com>
> Cc: Andrew Morton <akpm@linux-foundation.org>
> Cc: David Rientjes <rientjes@google.com>
> Cc: Namhyung Kim <namhyung@gmail.com>
> Cc: "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>
> Cc: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
> [PG: .34 has VMALLOC_START/END vs. start/end in f5252e009d5]
> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
[...]
commit 1368edf0647ac112d8cfa6ce47257dc950c50f5c ("mm: vmalloc: check for
page allocation failure before vmlist insertion") addresses a regression
on this change, something to consider for inclusion in this stable
update as well.
--
[]'s
Herton
^ permalink raw reply [flat|nested] 186+ messages in thread* Re: [v2.6.34-stable 134/165] mm: avoid null pointer access in vm_struct via /proc/vmallocinfo
2012-08-17 15:22 ` Herton Ronaldo Krzesinski
@ 2012-08-17 18:26 ` Paul Gortmaker
2012-08-17 21:02 ` Willy Tarreau
0 siblings, 1 reply; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-17 18:26 UTC (permalink / raw)
To: Herton Ronaldo Krzesinski
Cc: stable, linux-kernel, Mitsuo Hayasaka, Andrew Morton,
David Rientjes, Namhyung Kim, Paul E. McKenney,
Jeremy Fitzhardinge, Linus Torvalds, Mel Gorman, Luciano Chavez,
Rik van Riel, Willy Tarreau
On 12-08-17 11:22 AM, Herton Ronaldo Krzesinski wrote:
> On Wed, Aug 15, 2012 at 03:47:58PM -0400, Paul Gortmaker wrote:
>> From: Mitsuo Hayasaka <mitsuo.hayasaka.hu@hitachi.com>
>>
>> -------------------
>> This is a commit scheduled for the next v2.6.34 longterm release.
>> http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
>> If you see a problem with using this for longterm, please comment.
>> -------------------
>>
>> commit f5252e009d5b87071a919221e4f6624184005368 upstream.
>>
>> The /proc/vmallocinfo shows information about vmalloc allocations in
>> vmlist that is a linklist of vm_struct. It, however, may access pages
>> field of vm_struct where a page was not allocated. This results in a null
>> pointer access and leads to a kernel panic.
>>
>> Why this happens: In __vmalloc_node_range() called from vmalloc(), newly
>> allocated vm_struct is added to vmlist at __get_vm_area_node() and then,
>> some fields of vm_struct such as nr_pages and pages are set at
>> __vmalloc_area_node(). In other words, it is added to vmlist before it is
>> fully initialized. At the same time, when the /proc/vmallocinfo is read,
>> it accesses the pages field of vm_struct according to the nr_pages field
>> at show_numa_info(). Thus, a null pointer access happens.
>>
>> The patch adds the newly allocated vm_struct to the vmlist *after* it is
>> fully initialized. So, it can avoid accessing the pages field with
>> unallocated page when show_numa_info() is called.
>>
>> Signed-off-by: Mitsuo Hayasaka <mitsuo.hayasaka.hu@hitachi.com>
>> Cc: Andrew Morton <akpm@linux-foundation.org>
>> Cc: David Rientjes <rientjes@google.com>
>> Cc: Namhyung Kim <namhyung@gmail.com>
>> Cc: "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>
>> Cc: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
>> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
>> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
>> [PG: .34 has VMALLOC_START/END vs. start/end in f5252e009d5]
>> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
> [...]
>
> commit 1368edf0647ac112d8cfa6ce47257dc950c50f5c ("mm: vmalloc: check for
> page allocation failure before vmlist insertion") addresses a regression
> on this change, something to consider for inclusion in this stable
> update as well.
Thanks Herton.
I've added Willy to CC, since v2.6.32.49 added f5252e but does
not have 1368edf0 yet in any 2.6.32.x
Paul.
--
>
^ permalink raw reply [flat|nested] 186+ messages in thread* Re: [v2.6.34-stable 134/165] mm: avoid null pointer access in vm_struct via /proc/vmallocinfo
2012-08-17 18:26 ` Paul Gortmaker
@ 2012-08-17 21:02 ` Willy Tarreau
0 siblings, 0 replies; 186+ messages in thread
From: Willy Tarreau @ 2012-08-17 21:02 UTC (permalink / raw)
To: Paul Gortmaker
Cc: Herton Ronaldo Krzesinski, stable, linux-kernel, Mitsuo Hayasaka,
Andrew Morton, David Rientjes, Namhyung Kim, Paul E. McKenney,
Jeremy Fitzhardinge, Linus Torvalds, Mel Gorman, Luciano Chavez,
Rik van Riel
On Fri, Aug 17, 2012 at 02:26:15PM -0400, Paul Gortmaker wrote:
> On 12-08-17 11:22 AM, Herton Ronaldo Krzesinski wrote:
> > On Wed, Aug 15, 2012 at 03:47:58PM -0400, Paul Gortmaker wrote:
> >> From: Mitsuo Hayasaka <mitsuo.hayasaka.hu@hitachi.com>
> >>
> >> -------------------
> >> This is a commit scheduled for the next v2.6.34 longterm release.
> >> http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
> >> If you see a problem with using this for longterm, please comment.
> >> -------------------
> >>
> >> commit f5252e009d5b87071a919221e4f6624184005368 upstream.
> >>
> >> The /proc/vmallocinfo shows information about vmalloc allocations in
> >> vmlist that is a linklist of vm_struct. It, however, may access pages
> >> field of vm_struct where a page was not allocated. This results in a null
> >> pointer access and leads to a kernel panic.
> >>
> >> Why this happens: In __vmalloc_node_range() called from vmalloc(), newly
> >> allocated vm_struct is added to vmlist at __get_vm_area_node() and then,
> >> some fields of vm_struct such as nr_pages and pages are set at
> >> __vmalloc_area_node(). In other words, it is added to vmlist before it is
> >> fully initialized. At the same time, when the /proc/vmallocinfo is read,
> >> it accesses the pages field of vm_struct according to the nr_pages field
> >> at show_numa_info(). Thus, a null pointer access happens.
> >>
> >> The patch adds the newly allocated vm_struct to the vmlist *after* it is
> >> fully initialized. So, it can avoid accessing the pages field with
> >> unallocated page when show_numa_info() is called.
> >>
> >> Signed-off-by: Mitsuo Hayasaka <mitsuo.hayasaka.hu@hitachi.com>
> >> Cc: Andrew Morton <akpm@linux-foundation.org>
> >> Cc: David Rientjes <rientjes@google.com>
> >> Cc: Namhyung Kim <namhyung@gmail.com>
> >> Cc: "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>
> >> Cc: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
> >> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
> >> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
> >> [PG: .34 has VMALLOC_START/END vs. start/end in f5252e009d5]
> >> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
> > [...]
> >
> > commit 1368edf0647ac112d8cfa6ce47257dc950c50f5c ("mm: vmalloc: check for
> > page allocation failure before vmlist insertion") addresses a regression
> > on this change, something to consider for inclusion in this stable
> > update as well.
>
> Thanks Herton.
>
> I've added Willy to CC, since v2.6.32.49 added f5252e but does
> not have 1368edf0 yet in any 2.6.32.x
Thank you Paul, much appreciated.
Queued for .60.
Willy
^ permalink raw reply [flat|nested] 186+ messages in thread
* [v2.6.34-stable 135/165] kbuild: Fix passing -Wno-* options to gcc 4.4+
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (133 preceding siblings ...)
2012-08-15 19:47 ` [v2.6.34-stable 134/165] mm: avoid null pointer access in vm_struct via /proc/vmallocinfo Paul Gortmaker
@ 2012-08-15 19:47 ` Paul Gortmaker
2012-08-15 19:48 ` [v2.6.34-stable 136/165] USB: serial: pl2303: rm duplicate id Paul Gortmaker
` (29 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:47 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Michal Marek, Paul Gortmaker
From: Michal Marek <mmarek@suse.cz>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 8417da6f2128008c431c7d130af6cd3d9079922e upstream.
Starting with 4.4, gcc will happily accept -Wno-<anything> in the
cc-option test and complain later when compiling a file that has some
other warning. This rather unexpected behavior is intentional as per
http://gcc.gnu.org/PR28322, so work around it by testing for support of
the opposite option (without the no-). Introduce a new Makefile function
cc-disable-warning that does this and update two uses of cc-option in
the toplevel Makefile.
Reported-and-tested-by: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: Michal Marek <mmarek@suse.cz>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
Documentation/kbuild/makefiles.txt | 12 ++++++++++++
Makefile | 4 ++--
scripts/Kbuild.include | 5 +++++
3 files changed, 19 insertions(+), 2 deletions(-)
diff --git a/Documentation/kbuild/makefiles.txt b/Documentation/kbuild/makefiles.txt
index 71c602d..ab8689b 100644
--- a/Documentation/kbuild/makefiles.txt
+++ b/Documentation/kbuild/makefiles.txt
@@ -502,6 +502,18 @@ more details, with real examples.
gcc >= 3.00. For gcc < 3.00, -malign-functions=4 is used.
Note: cc-option-align uses KBUILD_CFLAGS for $(CC) options
+ cc-disable-warning
+ cc-disable-warning checks if gcc supports a given warning and returns
+ the commandline switch to disable it. This special function is needed,
+ because gcc 4.4 and later accept any unknown -Wno-* option and only
+ warn about it if there is another warning in the source file.
+
+ Example:
+ KBUILD_CFLAGS += $(call cc-disable-warning, unused-but-set-variable)
+
+ In the above example, -Wno-unused-but-set-variable will be added to
+ KBUILD_CFLAGS only if gcc really accepts it.
+
cc-version
cc-version returns a numerical version of the $(CC) compiler version.
The format is <major><minor> where both are two digits. So for example
diff --git a/Makefile b/Makefile
index e9fafd0..92da473 100644
--- a/Makefile
+++ b/Makefile
@@ -549,7 +549,7 @@ endif
# This warning generated too much noise in a regular build.
# Use make W=1 to enable this warning (see scripts/Makefile.build)
-KBUILD_CFLAGS += $(call cc-option, -Wno-unused-but-set-variable)
+KBUILD_CFLAGS += $(call cc-disable-warning, unused-but-set-variable)
ifdef CONFIG_FRAME_POINTER
KBUILD_CFLAGS += -fno-omit-frame-pointer -fno-optimize-sibling-calls
@@ -579,7 +579,7 @@ CHECKFLAGS += $(NOSTDINC_FLAGS)
KBUILD_CFLAGS += $(call cc-option,-Wdeclaration-after-statement,)
# disable pointer signed / unsigned warnings in gcc 4.0
-KBUILD_CFLAGS += $(call cc-option,-Wno-pointer-sign,)
+KBUILD_CFLAGS += $(call cc-disable-warning, pointer-sign)
# disable invalid "can't wrap" optimizations for signed / pointers
KBUILD_CFLAGS += $(call cc-option,-fno-strict-overflow)
diff --git a/scripts/Kbuild.include b/scripts/Kbuild.include
index ed2773e..ba25c44 100644
--- a/scripts/Kbuild.include
+++ b/scripts/Kbuild.include
@@ -118,6 +118,11 @@ cc-option-yn = $(call try-run,\
cc-option-align = $(subst -functions=0,,\
$(call cc-option,-falign-functions=0,-malign-functions=0))
+# cc-disable-warning
+# Usage: cflags-y += $(call cc-disable-warning,unused-but-set-variable)
+cc-disable-warning = $(call try-run,\
+ $(CC) $(KBUILD_CPPFLAGS) $(KBUILD_CFLAGS) -W$(strip $(1)) -c -xc /dev/null -o "$$TMP",-Wno-$(strip $(1)))
+
# cc-version
# Usage gcc-ver := $(call cc-version)
cc-version = $(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-version.sh $(CC))
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 136/165] USB: serial: pl2303: rm duplicate id
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (134 preceding siblings ...)
2012-08-15 19:47 ` [v2.6.34-stable 135/165] kbuild: Fix passing -Wno-* options to gcc 4.4+ Paul Gortmaker
@ 2012-08-15 19:48 ` Paul Gortmaker
2012-08-15 19:48 ` [v2.6.34-stable 137/165] USB: Fix Corruption issue in USB ftdi driver ftdi_sio.c Paul Gortmaker
` (28 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:48 UTC (permalink / raw)
To: stable, linux-kernel
Cc: wangyanqing, Wang YanQing, Greg Kroah-Hartman, Paul Gortmaker
From: wangyanqing <udknight@gmail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 0c16595539b612fe948559433dda08ff96a8bdc7 upstream.
I get report from customer that his usb-serial
converter doesn't work well,it sometimes work,
but sometimes it doesn't.
The usb-serial converter's id:
vendor_id product_id
0x4348 0x5523
Then I search the usb-serial codes, and there are
two drivers announce support this device, pl2303
and ch341, commit 026dfaf1 cause it. Through many
times to test, ch341 works well with this device,
and pl2303 doesn't work quite often(it just work quite little).
ch341 works well with this device, so we doesn't
need pl2303 to support.I try to revert 026dfaf1 first,
but it failed. So I prepare this patch by hand to revert it.
Signed-off-by: Wang YanQing <Udknight@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/usb/serial/pl2303.c | 1 -
drivers/usb/serial/pl2303.h | 4 ----
2 files changed, 5 deletions(-)
diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
index e42ee9b..95ca261 100644
--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -101,7 +101,6 @@ static const struct usb_device_id id_table[] = {
{ USB_DEVICE(SONY_VENDOR_ID, SONY_QN3USB_PRODUCT_ID) },
{ USB_DEVICE(SANWA_VENDOR_ID, SANWA_PRODUCT_ID) },
{ USB_DEVICE(ADLINK_VENDOR_ID, ADLINK_ND6530_PRODUCT_ID) },
- { USB_DEVICE(WINCHIPHEAD_VENDOR_ID, WINCHIPHEAD_USBSER_PRODUCT_ID) },
{ USB_DEVICE(SMART_VENDOR_ID, SMART_PRODUCT_ID) },
{ } /* Terminating entry */
};
diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
index 450a4a7..8dbdb46 100644
--- a/drivers/usb/serial/pl2303.h
+++ b/drivers/usb/serial/pl2303.h
@@ -145,10 +145,6 @@
#define ADLINK_VENDOR_ID 0x0b63
#define ADLINK_ND6530_PRODUCT_ID 0x6530
-/* WinChipHead USB->RS 232 adapter */
-#define WINCHIPHEAD_VENDOR_ID 0x4348
-#define WINCHIPHEAD_USBSER_PRODUCT_ID 0x5523
-
/* SMART USB Serial Adapter */
#define SMART_VENDOR_ID 0x0b8c
#define SMART_PRODUCT_ID 0x2303
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 137/165] USB: Fix Corruption issue in USB ftdi driver ftdi_sio.c
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (135 preceding siblings ...)
2012-08-15 19:48 ` [v2.6.34-stable 136/165] USB: serial: pl2303: rm duplicate id Paul Gortmaker
@ 2012-08-15 19:48 ` Paul Gortmaker
2012-08-17 14:36 ` Herton Ronaldo Krzesinski
2012-08-15 19:48 ` [v2.6.34-stable 138/165] usb-storage: Accept 8020i-protocol commands longer than 12 bytes Paul Gortmaker
` (27 subsequent siblings)
164 siblings, 1 reply; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:48 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Andrew Worsley, Greg Kroah-Hartman, Paul Gortmaker
From: Andrew Worsley <amworsley@gmail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit b1ffb4c851f185e9051ba837c16d9b84ef688d26 upstream.
Fix for ftdi_set_termios() glitching output
ftdi_set_termios() is constantly setting the baud rate, data bits and parity
unnecessarily on every call, . When called while characters are being
transmitted can cause the FTDI chip to corrupt the serial port bit stream
output by stalling the output half a bit during the output of a character.
Simple fix by skipping this setting if the baud rate/data bits/parity are
unchanged.
Signed-off-by: Andrew Worsley <amworsley@gmail.com>
----
I had a brief run with strace on the getty and it was doing ioctl()s on
each call but it didn't look relavant to the problem. I think the issue is
that XON/XOFF flow control was being implmented via hardware - for the ixoff
to allow the user to use XON/XOFF to control output. Unfortunately it would
send 3 Control URBs updating all of the settings after each piece of input
I am trying to work around the issue of gmail messing with the tab/spacing
by submitting via SMTP via gmail which I believe should fix the issue.
The patch is against v3.2-rc2 and compiles - but no additional testing in
this kernel has been done.
Thanks
Andrew
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/usb/serial/ftdi_sio.c | 14 +++++++++++---
1 file changed, 11 insertions(+), 3 deletions(-)
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 24dc63c..7367f4b 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -2332,13 +2332,19 @@ static void ftdi_set_termios(struct tty_struct *tty,
cflag = termios->c_cflag;
- /* FIXME -For this cut I don't care if the line is really changing or
- not - so just do the change regardless - should be able to
- compare old_termios and tty->termios */
+ if (old_termios->c_cflag == termios->c_cflag
+ && old_termios->c_ispeed == termios->c_ispeed
+ && old_termios->c_ospeed == termios->c_ospeed)
+ goto no_c_cflag_changes;
+
/* NOTE These routines can get interrupted by
ftdi_sio_read_bulk_callback - need to examine what this means -
don't see any problems yet */
+ if ((old_termios->c_cflag & (CSIZE|PARODD|PARENB|CMSPAR|CSTOPB)) ==
+ (termios->c_cflag & (CSIZE|PARODD|PARENB|CMSPAR|CSTOPB)))
+ goto no_data_parity_stop_changes;
+
/* Set number of data bits, parity, stop bits */
urb_value = 0;
@@ -2379,6 +2385,7 @@ static void ftdi_set_termios(struct tty_struct *tty,
}
/* Now do the baudrate */
+no_data_parity_stop_changes:
if ((cflag & CBAUD) == B0) {
/* Disable flow control */
if (usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
@@ -2406,6 +2413,7 @@ static void ftdi_set_termios(struct tty_struct *tty,
/* Set flow control */
/* Note device also supports DTR/CD (ugh) and Xon/Xoff in hardware */
+no_c_cflag_changes:
if (cflag & CRTSCTS) {
dbg("%s Setting to CRTSCTS flow control", __func__);
if (usb_control_msg(dev,
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* Re: [v2.6.34-stable 137/165] USB: Fix Corruption issue in USB ftdi driver ftdi_sio.c
2012-08-15 19:48 ` [v2.6.34-stable 137/165] USB: Fix Corruption issue in USB ftdi driver ftdi_sio.c Paul Gortmaker
@ 2012-08-17 14:36 ` Herton Ronaldo Krzesinski
2012-08-17 15:12 ` Paul Gortmaker
0 siblings, 1 reply; 186+ messages in thread
From: Herton Ronaldo Krzesinski @ 2012-08-17 14:36 UTC (permalink / raw)
To: Paul Gortmaker
Cc: stable, linux-kernel, Andrew Worsley, Greg Kroah-Hartman,
Johan Hovold, Roland Ramthun
On Wed, Aug 15, 2012 at 03:48:01PM -0400, Paul Gortmaker wrote:
> From: Andrew Worsley <amworsley@gmail.com>
>
> -------------------
> This is a commit scheduled for the next v2.6.34 longterm release.
> http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
> If you see a problem with using this for longterm, please comment.
> -------------------
>
> commit b1ffb4c851f185e9051ba837c16d9b84ef688d26 upstream.
>
> Fix for ftdi_set_termios() glitching output
>
> ftdi_set_termios() is constantly setting the baud rate, data bits and parity
> unnecessarily on every call, . When called while characters are being
> transmitted can cause the FTDI chip to corrupt the serial port bit stream
> output by stalling the output half a bit during the output of a character.
> Simple fix by skipping this setting if the baud rate/data bits/parity are
> unchanged.
>
> Signed-off-by: Andrew Worsley <amworsley@gmail.com>
[...]
commit 108e02b12921078a59dcacd048079ece48a4a983 ("USB: ftdi_sio: fix
initial baud rate") says it addresses a regression on this change,
something to consider for inclusion with this update.
--
[]'s
Herton
^ permalink raw reply [flat|nested] 186+ messages in thread* Re: [v2.6.34-stable 137/165] USB: Fix Corruption issue in USB ftdi driver ftdi_sio.c
2012-08-17 14:36 ` Herton Ronaldo Krzesinski
@ 2012-08-17 15:12 ` Paul Gortmaker
0 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-17 15:12 UTC (permalink / raw)
To: Herton Ronaldo Krzesinski
Cc: stable, linux-kernel, Andrew Worsley, Greg Kroah-Hartman,
Johan Hovold, Roland Ramthun
On 12-08-17 10:36 AM, Herton Ronaldo Krzesinski wrote:
>> commit b1ffb4c851f185e9051ba837c16d9b84ef688d26 upstream.
>> >
>> > Fix for ftdi_set_termios() glitching output
>> >
>> > ftdi_set_termios() is constantly setting the baud rate, data bits and parity
>> > unnecessarily on every call, . When called while characters are being
>> > transmitted can cause the FTDI chip to corrupt the serial port bit stream
>> > output by stalling the output half a bit during the output of a character.
>> > Simple fix by skipping this setting if the baud rate/data bits/parity are
>> > unchanged.
>> >
>> > Signed-off-by: Andrew Worsley <amworsley@gmail.com>
> [...]
>
> commit 108e02b12921078a59dcacd048079ece48a4a983 ("USB: ftdi_sio: fix
> initial baud rate") says it addresses a regression on this change,
> something to consider for inclusion with this update.
Thanks Herton, I've queued this and pushed it to 34-longterm-queue.
Paul.
--
^ permalink raw reply [flat|nested] 186+ messages in thread
* [v2.6.34-stable 138/165] usb-storage: Accept 8020i-protocol commands longer than 12 bytes
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (136 preceding siblings ...)
2012-08-15 19:48 ` [v2.6.34-stable 137/165] USB: Fix Corruption issue in USB ftdi driver ftdi_sio.c Paul Gortmaker
@ 2012-08-15 19:48 ` Paul Gortmaker
2012-08-15 19:48 ` [v2.6.34-stable 139/165] USB: add quirk for Logitech C600 web cam Paul Gortmaker
` (26 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:48 UTC (permalink / raw)
To: stable, linux-kernel
Cc: Alan Stern, Matthew Dharm, Greg Kroah-Hartman, Paul Gortmaker
From: Alan Stern <stern@rowland.harvard.edu>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 2f640bf4c94324aeaa1b6385c10aab8c5ad1e1cf upstream.
The 8020i protocol (also 8070i and QIC-157) uses 12-byte commands;
shorter commands must be padded. Simon Detheridge reports that his
3-TB USB disk drive claims to use the 8020i protocol (which is
normally meant for ATAPI devices like CD drives), and because of its
large size, the disk drive requires the use of 16-byte commands.
However the usb_stor_pad12_command() routine in usb-storage always
sets the command length to 12, making the drive impossible to use.
Since the SFF-8020i specification allows for 16-byte commands in
future extensions, we may as well accept them. This patch (as1490)
changes usb_stor_pad12_command() to leave commands larger than 12
bytes alone rather than truncating them.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Tested-by: Simon Detheridge <simon@widgit.com>
CC: Matthew Dharm <mdharm-usb@one-eyed-alien.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/usb/storage/protocol.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/drivers/usb/storage/protocol.c b/drivers/usb/storage/protocol.c
index fc310f7..0fded39 100644
--- a/drivers/usb/storage/protocol.c
+++ b/drivers/usb/storage/protocol.c
@@ -58,7 +58,9 @@
void usb_stor_pad12_command(struct scsi_cmnd *srb, struct us_data *us)
{
- /* Pad the SCSI command with zeros out to 12 bytes
+ /*
+ * Pad the SCSI command with zeros out to 12 bytes. If the
+ * command already is 12 bytes or longer, leave it alone.
*
* NOTE: This only works because a scsi_cmnd struct field contains
* a unsigned char cmnd[16], so we know we have storage available
@@ -66,9 +68,6 @@ void usb_stor_pad12_command(struct scsi_cmnd *srb, struct us_data *us)
for (; srb->cmd_len<12; srb->cmd_len++)
srb->cmnd[srb->cmd_len] = 0;
- /* set command length to 12 bytes */
- srb->cmd_len = 12;
-
/* send the command to the transport layer */
usb_stor_invoke_transport(srb, us);
}
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 139/165] USB: add quirk for Logitech C600 web cam
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (137 preceding siblings ...)
2012-08-15 19:48 ` [v2.6.34-stable 138/165] usb-storage: Accept 8020i-protocol commands longer than 12 bytes Paul Gortmaker
@ 2012-08-15 19:48 ` Paul Gortmaker
2012-08-15 19:48 ` [v2.6.34-stable 140/165] USB: quirks: adding more quirky webcams to avoid squeaky audio Paul Gortmaker
` (25 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:48 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Josh Boyer, Greg Kroah-Hartman, Paul Gortmaker
From: Josh Boyer <jwboyer@redhat.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 60c71ca972a2dd3fd9d0165b405361c8ad48349b upstream.
We've had another report of the "chipmunk" sound on a Logitech C600 webcam.
This patch resolves the issue.
Signed-off-by: Josh Boyer <jwboyer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/usb/core/quirks.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index 241a0d6..f1b7442 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -47,6 +47,9 @@ static const struct usb_device_id usb_quirk_list[] = {
/* Logitech Webcam B/C500 */
{ USB_DEVICE(0x046d, 0x0807), .driver_info = USB_QUIRK_RESET_RESUME },
+ /* Logitech Webcam C600 */
+ { USB_DEVICE(0x046d, 0x0808), .driver_info = USB_QUIRK_RESET_RESUME },
+
/* Logitech Webcam Pro 9000 */
{ USB_DEVICE(0x046d, 0x0809), .driver_info = USB_QUIRK_RESET_RESUME },
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 140/165] USB: quirks: adding more quirky webcams to avoid squeaky audio
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (138 preceding siblings ...)
2012-08-15 19:48 ` [v2.6.34-stable 139/165] USB: add quirk for Logitech C600 web cam Paul Gortmaker
@ 2012-08-15 19:48 ` Paul Gortmaker
2012-08-15 19:48 ` [v2.6.34-stable 141/165] random: simplify fips mode Paul Gortmaker
` (24 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:48 UTC (permalink / raw)
To: stable, linux-kernel
Cc: sordna, Oliver Neukum, Greg Kroah-Hartman, Paul Gortmaker
From: sordna <sordna@gmail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 0d145d7d4a241c321c832a810bb6edad18e2217b upstream.
The following patch contains additional affected webcam models, on top of the
patches commited to linux-next 2394d67e446bf616a0885167d5f0d397bdacfdfc
and 5b253d88cc6c65a23cefc457a5a4ef139913c5fc
Signed-off-by: sordna <sordna@gmail.com>
Cc: Oliver Neukum <oliver@neukum.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/usb/core/quirks.c | 24 ++++++++++++++++++++++++
1 file changed, 24 insertions(+)
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index f1b7442..9774dfc 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -53,12 +53,36 @@ static const struct usb_device_id usb_quirk_list[] = {
/* Logitech Webcam Pro 9000 */
{ USB_DEVICE(0x046d, 0x0809), .driver_info = USB_QUIRK_RESET_RESUME },
+ /* Logitech Webcam C905 */
+ { USB_DEVICE(0x046d, 0x080a), .driver_info = USB_QUIRK_RESET_RESUME },
+
+ /* Logitech Webcam C210 */
+ { USB_DEVICE(0x046d, 0x0819), .driver_info = USB_QUIRK_RESET_RESUME },
+
+ /* Logitech Webcam C260 */
+ { USB_DEVICE(0x046d, 0x081a), .driver_info = USB_QUIRK_RESET_RESUME },
+
/* Logitech Webcam C310 */
{ USB_DEVICE(0x046d, 0x081b), .driver_info = USB_QUIRK_RESET_RESUME },
+ /* Logitech Webcam C910 */
+ { USB_DEVICE(0x046d, 0x0821), .driver_info = USB_QUIRK_RESET_RESUME },
+
+ /* Logitech Webcam C160 */
+ { USB_DEVICE(0x046d, 0x0824), .driver_info = USB_QUIRK_RESET_RESUME },
+
/* Logitech Webcam C270 */
{ USB_DEVICE(0x046d, 0x0825), .driver_info = USB_QUIRK_RESET_RESUME },
+ /* Logitech Quickcam Pro 9000 */
+ { USB_DEVICE(0x046d, 0x0990), .driver_info = USB_QUIRK_RESET_RESUME },
+
+ /* Logitech Quickcam E3500 */
+ { USB_DEVICE(0x046d, 0x09a4), .driver_info = USB_QUIRK_RESET_RESUME },
+
+ /* Logitech Quickcam Vision Pro */
+ { USB_DEVICE(0x046d, 0x09a6), .driver_info = USB_QUIRK_RESET_RESUME },
+
/* Philips PSC805 audio device */
{ USB_DEVICE(0x0471, 0x0155), .driver_info = USB_QUIRK_RESET_RESUME },
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 141/165] random: simplify fips mode
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (139 preceding siblings ...)
2012-08-15 19:48 ` [v2.6.34-stable 140/165] USB: quirks: adding more quirky webcams to avoid squeaky audio Paul Gortmaker
@ 2012-08-15 19:48 ` Paul Gortmaker
2012-08-15 19:48 ` [v2.6.34-stable 142/165] x86, cpu: Add CPU flags for F16C and RDRND Paul Gortmaker
` (23 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:48 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Matt Mackall, Herbert Xu, Paul Gortmaker
From: Matt Mackall <mpm@selenic.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit e954bc91bdd4bb08b8325478c5004b24a23a3522 upstream.
Rather than dynamically allocate 10 bytes, move it to static allocation.
This saves space and avoids the need for error checking.
Signed-off-by: Matt Mackall <mpm@selenic.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
[PG: adding this simplifies required updates to random for .34 stable]
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/char/random.c | 10 +++-------
1 file changed, 3 insertions(+), 7 deletions(-)
diff --git a/drivers/char/random.c b/drivers/char/random.c
index ccdadd9..1e07bbe 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -257,6 +257,7 @@
#define INPUT_POOL_WORDS 128
#define OUTPUT_POOL_WORDS 32
#define SEC_XFER_SIZE 512
+#define EXTRACT_SIZE 10
/*
* The minimum number of bits of entropy before we wake up a read on
@@ -414,7 +415,7 @@ struct entropy_store {
unsigned add_ptr;
int entropy_count;
int input_rotate;
- __u8 *last_data;
+ __u8 last_data[EXTRACT_SIZE];
};
static __u32 input_pool_data[INPUT_POOL_WORDS];
@@ -714,8 +715,6 @@ void add_disk_randomness(struct gendisk *disk)
}
#endif
-#define EXTRACT_SIZE 10
-
/*********************************************************************
*
* Entropy extraction routines
@@ -862,7 +861,7 @@ static ssize_t extract_entropy(struct entropy_store *r, void *buf,
while (nbytes) {
extract_buf(r, tmp);
- if (r->last_data) {
+ if (fips_enabled) {
spin_lock_irqsave(&r->lock, flags);
if (!memcmp(tmp, r->last_data, EXTRACT_SIZE))
panic("Hardware RNG duplicated output!\n");
@@ -951,9 +950,6 @@ static void init_std_data(struct entropy_store *r)
now = ktime_get_real();
mix_pool_bytes(r, &now, sizeof(now));
mix_pool_bytes(r, utsname(), sizeof(*(utsname())));
- /* Enable continuous test in fips mode */
- if (fips_enabled)
- r->last_data = kmalloc(EXTRACT_SIZE, GFP_KERNEL);
}
static int rand_initialize(void)
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 142/165] x86, cpu: Add CPU flags for F16C and RDRND
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (140 preceding siblings ...)
2012-08-15 19:48 ` [v2.6.34-stable 141/165] random: simplify fips mode Paul Gortmaker
@ 2012-08-15 19:48 ` Paul Gortmaker
2012-08-15 19:48 ` [v2.6.34-stable 143/165] x86, cpufeature: Update CPU feature RDRND to RDRAND Paul Gortmaker
` (22 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:48 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: H. Peter Anvin, Paul Gortmaker
From: "H. Peter Anvin" <hpa@zytor.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 24da9c26f3050aee9314ec09930a24c80fe76352 upstream.
Add support for the newly documented F16C (16-bit floating point
conversions) and RDRND (RDRAND instruction) CPU feature flags.
Signed-off-by: H. Peter Anvin <hpa@zytor.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/x86/include/asm/cpufeature.h | 2 ++
1 file changed, 2 insertions(+)
diff --git a/arch/x86/include/asm/cpufeature.h b/arch/x86/include/asm/cpufeature.h
index 5d06401..0cfa2fb 100644
--- a/arch/x86/include/asm/cpufeature.h
+++ b/arch/x86/include/asm/cpufeature.h
@@ -124,6 +124,8 @@
#define X86_FEATURE_XSAVE (4*32+26) /* XSAVE/XRSTOR/XSETBV/XGETBV */
#define X86_FEATURE_OSXSAVE (4*32+27) /* "" XSAVE enabled in the OS */
#define X86_FEATURE_AVX (4*32+28) /* Advanced Vector Extensions */
+#define X86_FEATURE_F16C (4*32+29) /* 16-bit fp conversions */
+#define X86_FEATURE_RDRND (4*32+30) /* The RDRAND instruction */
#define X86_FEATURE_HYPERVISOR (4*32+31) /* Running on a hypervisor */
/* VIA/Cyrix/Centaur-defined CPU features, CPUID level 0xC0000001, word 5 */
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 143/165] x86, cpufeature: Update CPU feature RDRND to RDRAND
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (141 preceding siblings ...)
2012-08-15 19:48 ` [v2.6.34-stable 142/165] x86, cpu: Add CPU flags for F16C and RDRND Paul Gortmaker
@ 2012-08-15 19:48 ` Paul Gortmaker
2012-08-15 19:48 ` [v2.6.34-stable 144/165] random: Add support for architectural random hooks Paul Gortmaker
` (21 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:48 UTC (permalink / raw)
To: stable, linux-kernel
Cc: Kees Cook, H. Peter Anvin, Fenghua Yu, Paul Gortmaker
From: Kees Cook <kees.cook@canonical.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 7ccafc5f75c87853f3c49845d5a884f2376e03ce upstream.
The Intel manual changed the name of the CPUID bit to match the
instruction name. We should follow suit for sanity's sake. (See Intel SDM
Volume 2, Table 3-20 "Feature Information Returned in the ECX Register".)
[ hpa: we can only do this at this time because there are currently no CPUs
with this feature on the market, hence this is pre-hardware enabling.
However, Cc:'ing stable so that stable can present a consistent ABI. ]
Signed-off-by: Kees Cook <kees.cook@canonical.com>
Link: http://lkml.kernel.org/r/20110524232926.GA27728@outflux.net
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Cc: Fenghua Yu <fenghua.yu@intel.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/x86/include/asm/cpufeature.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/x86/include/asm/cpufeature.h b/arch/x86/include/asm/cpufeature.h
index 0cfa2fb..d79434e 100644
--- a/arch/x86/include/asm/cpufeature.h
+++ b/arch/x86/include/asm/cpufeature.h
@@ -125,7 +125,7 @@
#define X86_FEATURE_OSXSAVE (4*32+27) /* "" XSAVE enabled in the OS */
#define X86_FEATURE_AVX (4*32+28) /* Advanced Vector Extensions */
#define X86_FEATURE_F16C (4*32+29) /* 16-bit fp conversions */
-#define X86_FEATURE_RDRND (4*32+30) /* The RDRAND instruction */
+#define X86_FEATURE_RDRAND (4*32+30) /* The RDRAND instruction */
#define X86_FEATURE_HYPERVISOR (4*32+31) /* Running on a hypervisor */
/* VIA/Cyrix/Centaur-defined CPU features, CPUID level 0xC0000001, word 5 */
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 144/165] random: Add support for architectural random hooks
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (142 preceding siblings ...)
2012-08-15 19:48 ` [v2.6.34-stable 143/165] x86, cpufeature: Update CPU feature RDRND to RDRAND Paul Gortmaker
@ 2012-08-15 19:48 ` Paul Gortmaker
2012-08-15 19:48 ` [v2.6.34-stable 145/165] x86, random: Architectural inlines to get random integers with RDRAND Paul Gortmaker
` (20 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:48 UTC (permalink / raw)
To: stable, linux-kernel
Cc: H. Peter Anvin, H. Peter Anvin, Fenghua Yu, Matt Mackall,
Herbert Xu, Theodore Ts'o, Paul Gortmaker
From: "H. Peter Anvin" <hpa@zytor.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 63d77173266c1791f1553e9e8ccea65dc87c4485 upstream.
Add support for architecture-specific hooks into the kernel-directed
random number generator interfaces. This patchset does not use the
architecture random number generator interfaces for the
userspace-directed interfaces (/dev/random and /dev/urandom), thus
eliminating the need to distinguish between them based on a pool
pointer.
Changes in version 3:
- Moved the hooks from extract_entropy() to get_random_bytes().
- Changes the hooks to inlines.
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Cc: Fenghua Yu <fenghua.yu@intel.com>
Cc: Matt Mackall <mpm@selenic.com>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Cc: "Theodore Ts'o" <tytso@mit.edu>
[PG: .34 already had "unsigned int ret" in get_random_int, so the
diffstat here is slightly smaller than that of 63d7717. ]
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/char/random.c | 23 +++++++++++++++++++++--
include/linux/random.h | 13 +++++++++++++
2 files changed, 34 insertions(+), 2 deletions(-)
diff --git a/drivers/char/random.c b/drivers/char/random.c
index 1e07bbe..6da0696 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -925,7 +925,21 @@ static ssize_t extract_entropy_user(struct entropy_store *r, void __user *buf,
*/
void get_random_bytes(void *buf, int nbytes)
{
- extract_entropy(&nonblocking_pool, buf, nbytes, 0, 0);
+ char *p = buf;
+
+ while (nbytes) {
+ unsigned long v;
+ int chunk = min(nbytes, (int)sizeof(unsigned long));
+
+ if (!arch_get_random_long(&v))
+ break;
+
+ memcpy(buf, &v, chunk);
+ p += chunk;
+ nbytes -= chunk;
+ }
+
+ extract_entropy(&nonblocking_pool, p, nbytes, 0, 0);
}
EXPORT_SYMBOL(get_random_bytes);
@@ -1309,9 +1323,14 @@ late_initcall(random_int_secret_init);
DEFINE_PER_CPU(__u32 [MD5_DIGEST_WORDS], get_random_int_hash);
unsigned int get_random_int(void)
{
- __u32 *hash = get_cpu_var(get_random_int_hash);
+ __u32 *hash;
unsigned int ret;
+ if (arch_get_random_int(&ret))
+ return ret;
+
+ hash = get_cpu_var(get_random_int_hash);
+
hash[0] += current->pid + jiffies + get_cycles();
md5_transform(hash, random_int_secret);
ret = hash[0];
diff --git a/include/linux/random.h b/include/linux/random.h
index 2948046..0bf2936 100644
--- a/include/linux/random.h
+++ b/include/linux/random.h
@@ -63,6 +63,19 @@ unsigned long randomize_range(unsigned long start, unsigned long end, unsigned l
u32 random32(void);
void srandom32(u32 seed);
+#ifdef CONFIG_ARCH_RANDOM
+# include <asm/archrandom.h>
+#else
+static inline int arch_get_random_long(unsigned long *v)
+{
+ return 0;
+}
+static inline int arch_get_random_int(unsigned int *v)
+{
+ return 0;
+}
+#endif
+
#endif /* __KERNEL___ */
#endif /* _LINUX_RANDOM_H */
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 145/165] x86, random: Architectural inlines to get random integers with RDRAND
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (143 preceding siblings ...)
2012-08-15 19:48 ` [v2.6.34-stable 144/165] random: Add support for architectural random hooks Paul Gortmaker
@ 2012-08-15 19:48 ` Paul Gortmaker
2012-08-15 19:48 ` [v2.6.34-stable 146/165] fix typo/thinko in get_random_bytes() Paul Gortmaker
` (19 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:48 UTC (permalink / raw)
To: stable, linux-kernel
Cc: H. Peter Anvin, H. Peter Anvin, Matt Mackall, Herbert Xu,
Theodore Ts'o, Paul Gortmaker
From: "H. Peter Anvin" <hpa@zytor.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 628c6246d47b85f5357298601df2444d7f4dd3fd upstream.
Architectural inlines to get random ints and longs using the RDRAND
instruction.
Intel has introduced a new RDRAND instruction, a Digital Random Number
Generator (DRNG), which is functionally an high bandwidth entropy
source, cryptographic whitener, and integrity monitor all built into
hardware. This enables RDRAND to be used directly, bypassing the
kernel random number pool.
For technical documentation, see:
http://software.intel.com/en-us/articles/download-the-latest-bull-mountain-software-implementation-guide/
In this patch, this is *only* used for the nonblocking random number
pool. RDRAND is a nonblocking source, similar to our /dev/urandom,
and is therefore not a direct replacement for /dev/random. The
architectural hooks presented in the previous patch only feed the
kernel internal users, which only use the nonblocking pool, and so
this is not a problem.
Since this instruction is available in userspace, there is no reason
to have a /dev/hw_rng device driver for the purpose of feeding rngd.
This is especially so since RDRAND is a nonblocking source, and needs
additional whitening and reduction (see the above technical
documentation for details) in order to be of "pure entropy source"
quality.
The CONFIG_EXPERT compile-time option can be used to disable this use
of RDRAND.
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Originally-by: Fenghua Yu <fenghua.yu@intel.com>
Cc: Matt Mackall <mpm@selenic.com>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Cc: "Theodore Ts'o" <tytso@mit.edu>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/x86/Kconfig | 9 +++++
arch/x86/include/asm/archrandom.h | 73 +++++++++++++++++++++++++++++++++++++++
2 files changed, 82 insertions(+)
create mode 100644 arch/x86/include/asm/archrandom.h
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index b99909c..0a813f8 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -1460,6 +1460,15 @@ config ARCH_USES_PG_UNCACHED
def_bool y
depends on X86_PAT
+config ARCH_RANDOM
+ def_bool y
+ prompt "x86 architectural random number generator" if EXPERT
+ ---help---
+ Enable the x86 architectural RDRAND instruction
+ (Intel Bull Mountain technology) to generate random numbers.
+ If supported, this is a high bandwidth, cryptographically
+ secure hardware random number generator.
+
config EFI
bool "EFI runtime service support"
depends on ACPI
diff --git a/arch/x86/include/asm/archrandom.h b/arch/x86/include/asm/archrandom.h
new file mode 100644
index 0000000..b7b5bc0
--- /dev/null
+++ b/arch/x86/include/asm/archrandom.h
@@ -0,0 +1,73 @@
+/*
+ * This file is part of the Linux kernel.
+ *
+ * Copyright (c) 2011, Intel Corporation
+ * Authors: Fenghua Yu <fenghua.yu@intel.com>,
+ * H. Peter Anvin <hpa@linux.intel.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#ifndef ASM_X86_ARCHRANDOM_H
+#define ASM_X86_ARCHRANDOM_H
+
+#include <asm/processor.h>
+#include <asm/cpufeature.h>
+#include <asm/alternative.h>
+#include <asm/nops.h>
+
+#define RDRAND_RETRY_LOOPS 10
+
+#define RDRAND_INT ".byte 0x0f,0xc7,0xf0"
+#ifdef CONFIG_X86_64
+# define RDRAND_LONG ".byte 0x48,0x0f,0xc7,0xf0"
+#else
+# define RDRAND_LONG RDRAND_INT
+#endif
+
+#ifdef CONFIG_ARCH_RANDOM
+
+#define GET_RANDOM(name, type, rdrand, nop) \
+static inline int name(type *v) \
+{ \
+ int ok; \
+ alternative_io("movl $0, %0\n\t" \
+ nop, \
+ "\n1: " rdrand "\n\t" \
+ "jc 2f\n\t" \
+ "decl %0\n\t" \
+ "jnz 1b\n\t" \
+ "2:", \
+ X86_FEATURE_RDRAND, \
+ ASM_OUTPUT2("=r" (ok), "=a" (*v)), \
+ "0" (RDRAND_RETRY_LOOPS)); \
+ return ok; \
+}
+
+#ifdef CONFIG_X86_64
+
+GET_RANDOM(arch_get_random_long, unsigned long, RDRAND_LONG, ASM_NOP5);
+GET_RANDOM(arch_get_random_int, unsigned int, RDRAND_INT, ASM_NOP4);
+
+#else
+
+GET_RANDOM(arch_get_random_long, unsigned long, RDRAND_LONG, ASM_NOP3);
+GET_RANDOM(arch_get_random_int, unsigned int, RDRAND_INT, ASM_NOP3);
+
+#endif /* CONFIG_X86_64 */
+
+#endif /* CONFIG_ARCH_RANDOM */
+
+#endif /* ASM_X86_ARCHRANDOM_H */
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 146/165] fix typo/thinko in get_random_bytes()
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (144 preceding siblings ...)
2012-08-15 19:48 ` [v2.6.34-stable 145/165] x86, random: Architectural inlines to get random integers with RDRAND Paul Gortmaker
@ 2012-08-15 19:48 ` Paul Gortmaker
2012-08-15 19:48 ` [v2.6.34-stable 147/165] random: Use arch_get_random_int instead of cycle counter if avail Paul Gortmaker
` (18 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:48 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Luck, Tony, Linus Torvalds, Paul Gortmaker
From: "Luck, Tony" <tony.luck@intel.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit bd29e568a4cb6465f6e5ec7c1c1f3ae7d99cbec1 upstream.
If there is an architecture-specific random number generator we use it
to acquire randomness one "long" at a time. We should put these random
words into consecutive words in the result buffer - not just overwrite
the first word again and again.
Signed-off-by: Tony Luck <tony.luck@intel.com>
Acked-by: H. Peter Anvin <hpa@zytor.com>
Acked-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/char/random.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/char/random.c b/drivers/char/random.c
index 6da0696..df4eb6d 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -934,7 +934,7 @@ void get_random_bytes(void *buf, int nbytes)
if (!arch_get_random_long(&v))
break;
- memcpy(buf, &v, chunk);
+ memcpy(p, &v, chunk);
p += chunk;
nbytes -= chunk;
}
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 147/165] random: Use arch_get_random_int instead of cycle counter if avail
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (145 preceding siblings ...)
2012-08-15 19:48 ` [v2.6.34-stable 146/165] fix typo/thinko in get_random_bytes() Paul Gortmaker
@ 2012-08-15 19:48 ` Paul Gortmaker
2012-08-15 19:48 ` [v2.6.34-stable 148/165] random: Use arch-specific RNG to initialize the entropy store Paul Gortmaker
` (17 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:48 UTC (permalink / raw)
To: stable, linux-kernel
Cc: Linus Torvalds, Matt Mackall, Tony Luck, Eric Dumazet,
H. Peter Anvin, Paul Gortmaker
From: Linus Torvalds <torvalds@linux-foundation.org>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit cf833d0b9937874b50ef2867c4e8badfd64948ce upstream.
We still don't use rdrand in /dev/random, which just seems stupid. We
accept the *cycle*counter* as a random input, but we don't accept
rdrand? That's just broken.
Sure, people can do things in user space (write to /dev/random, use
rdrand in addition to /dev/random themselves etc etc), but that
*still* seems to be a particularly stupid reason for saying "we
shouldn't bother to try to do better in /dev/random".
And even if somebody really doesn't trust rdrand as a source of random
bytes, it seems singularly stupid to trust the cycle counter *more*.
So I'd suggest the attached patch. I'm not going to even bother
arguing that we should add more bits to the entropy estimate, because
that's not the point - I don't care if /dev/random fills up slowly or
not, I think it's just stupid to not use the bits we can get from
rdrand and mix them into the strong randomness pool.
Link: http://lkml.kernel.org/r/CA%2B55aFwn59N1=m651QAyTy-1gO1noGbK18zwKDwvwqnravA84A@mail.gmail.com
Acked-by: "David S. Miller" <davem@davemloft.net>
Acked-by: "Theodore Ts'o" <tytso@mit.edu>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Cc: Matt Mackall <mpm@selenic.com>
Cc: Tony Luck <tony.luck@intel.com>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/char/random.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/char/random.c b/drivers/char/random.c
index df4eb6d..ed86cae 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -617,8 +617,8 @@ static struct timer_rand_state input_timer_state;
static void add_timer_randomness(struct timer_rand_state *state, unsigned num)
{
struct {
- cycles_t cycles;
long jiffies;
+ unsigned cycles;
unsigned num;
} sample;
long delta, delta2, delta3;
@@ -630,7 +630,11 @@ static void add_timer_randomness(struct timer_rand_state *state, unsigned num)
goto out;
sample.jiffies = jiffies;
- sample.cycles = get_cycles();
+
+ /* Use arch random value, fall back to cycles */
+ if (!arch_get_random_int(&sample.cycles))
+ sample.cycles = get_cycles();
+
sample.num = num;
mix_pool_bytes(&input_pool, &sample, sizeof(sample));
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 148/165] random: Use arch-specific RNG to initialize the entropy store
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (146 preceding siblings ...)
2012-08-15 19:48 ` [v2.6.34-stable 147/165] random: Use arch_get_random_int instead of cycle counter if avail Paul Gortmaker
@ 2012-08-15 19:48 ` Paul Gortmaker
2012-08-15 19:48 ` [v2.6.34-stable 149/165] random: Adjust the number of loops when initializing Paul Gortmaker
` (16 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:48 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Theodore Ts'o, H. Peter Anvin, Paul Gortmaker
From: Theodore Ts'o <tytso@mit.edu>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 3e88bdff1c65145f7ba297ccec69c774afe4c785 upstream.
If there is an architecture-specific random number generator (such as
RDRAND for Intel architectures), use it to initialize /dev/random's
entropy stores. Even in the worst case, if RDRAND is something like
AES(NSA_KEY, counter++), it won't hurt, and it will definitely help
against any other adversaries.
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Link: http://lkml.kernel.org/r/1324589281-31931-1-git-send-email-tytso@mit.edu
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/char/random.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/char/random.c b/drivers/char/random.c
index ed86cae..4874f55 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -958,6 +958,7 @@ EXPORT_SYMBOL(get_random_bytes);
*/
static void init_std_data(struct entropy_store *r)
{
+ int i;
ktime_t now;
unsigned long flags;
@@ -967,6 +968,11 @@ static void init_std_data(struct entropy_store *r)
now = ktime_get_real();
mix_pool_bytes(r, &now, sizeof(now));
+ for (i = r->poolinfo->poolwords; i; i--) {
+ if (!arch_get_random_long(&flags))
+ break;
+ mix_pool_bytes(r, &flags, sizeof(flags));
+ }
mix_pool_bytes(r, utsname(), sizeof(*(utsname())));
}
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 149/165] random: Adjust the number of loops when initializing
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (147 preceding siblings ...)
2012-08-15 19:48 ` [v2.6.34-stable 148/165] random: Use arch-specific RNG to initialize the entropy store Paul Gortmaker
@ 2012-08-15 19:48 ` Paul Gortmaker
2012-08-15 19:48 ` [v2.6.34-stable 150/165] drivers/char/random.c: fix boot id uniqueness race Paul Gortmaker
` (15 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:48 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: H. Peter Anvin, Theodore Ts'o, Paul Gortmaker
From: "H. Peter Anvin" <hpa@linux.intel.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 2dac8e54f988ab58525505d7ef982493374433c3 upstream.
When we are initializing using arch_get_random_long() we only need to
loop enough times to touch all the bytes in the buffer; using
poolwords for that does twice the number of operations necessary on a
64-bit machine, since in the random number generator code "word" means
32 bits.
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Cc: "Theodore Ts'o" <tytso@mit.edu>
Link: http://lkml.kernel.org/r/1324589281-31931-1-git-send-email-tytso@mit.edu
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/char/random.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/char/random.c b/drivers/char/random.c
index 4874f55..fce764d 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -968,7 +968,7 @@ static void init_std_data(struct entropy_store *r)
now = ktime_get_real();
mix_pool_bytes(r, &now, sizeof(now));
- for (i = r->poolinfo->poolwords; i; i--) {
+ for (i = r->poolinfo->POOLBYTES; i > 0; i -= sizeof flags) {
if (!arch_get_random_long(&flags))
break;
mix_pool_bytes(r, &flags, sizeof(flags));
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 150/165] drivers/char/random.c: fix boot id uniqueness race
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (148 preceding siblings ...)
2012-08-15 19:48 ` [v2.6.34-stable 149/165] random: Adjust the number of loops when initializing Paul Gortmaker
@ 2012-08-15 19:48 ` Paul Gortmaker
2012-08-15 19:48 ` [v2.6.34-stable 151/165] random: make 'add_interrupt_randomness()' do something sane Paul Gortmaker
` (14 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:48 UTC (permalink / raw)
To: stable, linux-kernel
Cc: Mathieu Desnoyers, Theodore Ts'o, Matt Mackall, Eric Dumazet,
Greg Kroah-Hartman, Andrew Morton, Linus Torvalds,
Paul Gortmaker
From: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 44e4360fa3384850d65dd36fb4e6e5f2f112709b upstream.
/proc/sys/kernel/random/boot_id can be read concurrently by userspace
processes. If two (or more) user-space processes concurrently read
boot_id when sysctl_bootid is not yet assigned, a race can occur making
boot_id differ between the reads. Because the whole point of the boot id
is to be unique across a kernel execution, fix this by protecting this
operation with a spinlock.
Given that this operation is not frequently used, hitting the spinlock
on each call should not be an issue.
Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Cc: "Theodore Ts'o" <tytso@mit.edu>
Cc: Matt Mackall <mpm@selenic.com>
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Greg Kroah-Hartman <greg@kroah.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/char/random.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
diff --git a/drivers/char/random.c b/drivers/char/random.c
index fce764d..1b3544d 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -1251,10 +1251,15 @@ static int proc_do_uuid(ctl_table *table, int write,
uuid = table->data;
if (!uuid) {
uuid = tmp_uuid;
- uuid[8] = 0;
- }
- if (uuid[8] == 0)
generate_random_uuid(uuid);
+ } else {
+ static DEFINE_SPINLOCK(bootid_spinlock);
+
+ spin_lock(&bootid_spinlock);
+ if (!uuid[8])
+ generate_random_uuid(uuid);
+ spin_unlock(&bootid_spinlock);
+ }
sprintf(buf, "%pU", uuid);
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 151/165] random: make 'add_interrupt_randomness()' do something sane
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (149 preceding siblings ...)
2012-08-15 19:48 ` [v2.6.34-stable 150/165] drivers/char/random.c: fix boot id uniqueness race Paul Gortmaker
@ 2012-08-15 19:48 ` Paul Gortmaker
2012-08-15 19:48 ` [v2.6.34-stable 152/165] random: use lockless techniques in the interrupt path Paul Gortmaker
` (13 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:48 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Theodore Ts'o, Linus Torvalds, Paul Gortmaker
From: Theodore Ts'o <tytso@mit.edu>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 775f4b297b780601e61787b766f306ed3e1d23eb upstream.
We've been moving away from add_interrupt_randomness() for various
reasons: it's too expensive to do on every interrupt, and flooding the
CPU with interrupts could theoretically cause bogus floods of entropy
from a somewhat externally controllable source.
This solves both problems by limiting the actual randomness addition
to just once a second or after 64 interrupts, whicever comes first.
During that time, the interrupt cycle data is buffered up in a per-cpu
pool. Also, we make sure the the nonblocking pool used by urandom is
initialized before we start feeding the normal input pool. This
assures that /dev/urandom is returning unpredictable data as soon as
possible.
(Based on an original patch by Linus, but significantly modified by
tytso.)
Tested-by: Eric Wustrow <ewust@umich.edu>
Reported-by: Eric Wustrow <ewust@umich.edu>
Reported-by: Nadia Heninger <nadiah@cs.ucsd.edu>
Reported-by: Zakir Durumeric <zakir@umich.edu>
Reported-by: J. Alex Halderman <jhalderm@umich.edu>.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
[PG: minor adjustment required since .34 doesn't have f9e4989eb8
which renames "status" to "random" in kernel/irq/handle.c ]
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/char/random.c | 103 ++++++++++++++++++++++++++++++++++++++--------
drivers/mfd/ab3100-core.c | 2 -
include/linux/random.h | 2 +-
kernel/irq/handle.c | 7 ++--
4 files changed, 90 insertions(+), 24 deletions(-)
diff --git a/drivers/char/random.c b/drivers/char/random.c
index 1b3544d..a104af3 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -127,18 +127,14 @@
*
* void add_input_randomness(unsigned int type, unsigned int code,
* unsigned int value);
- * void add_interrupt_randomness(int irq);
+ * void add_interrupt_randomness(int irq, int irq_flags);
*
* add_input_randomness() uses the input layer interrupt timing, as well as
* the event type information from the hardware.
*
- * add_interrupt_randomness() uses the inter-interrupt timing as random
- * inputs to the entropy pool. Note that not all interrupts are good
- * sources of randomness! For example, the timer interrupts is not a
- * good choice, because the periodicity of the interrupts is too
- * regular, and hence predictable to an attacker. Disk interrupts are
- * a better measure, since the timing of the disk interrupts are more
- * unpredictable.
+ * add_interrupt_randomness() uses the interrupt timing as random
+ * inputs to the entropy pool. Using the cycle counters and the irq source
+ * as inputs, it feeds the randomness roughly once a second.
*
* All of these routines try to estimate how many bits of randomness a
* particular randomness source. They do this by keeping track of the
@@ -241,6 +237,7 @@
#include <linux/percpu.h>
#include <linux/cryptohash.h>
#include <linux/fips.h>
+#include <linux/ptrace.h>
#ifdef CONFIG_GENERIC_HARDIRQS
# include <linux/irq.h>
@@ -249,6 +246,7 @@
#include <asm/processor.h>
#include <asm/uaccess.h>
#include <asm/irq.h>
+#include <asm/irq_regs.h>
#include <asm/io.h>
/*
@@ -414,7 +412,9 @@ struct entropy_store {
spinlock_t lock;
unsigned add_ptr;
int entropy_count;
+ int entropy_total;
int input_rotate;
+ unsigned int initialized:1;
__u8 last_data[EXTRACT_SIZE];
};
@@ -447,6 +447,10 @@ static struct entropy_store nonblocking_pool = {
.pool = nonblocking_pool_data
};
+static __u32 const twist_table[8] = {
+ 0x00000000, 0x3b6e20c8, 0x76dc4190, 0x4db26158,
+ 0xedb88320, 0xd6d6a3e8, 0x9b64c2b0, 0xa00ae278 };
+
/*
* This function adds bytes into the entropy "pool". It does not
* update the entropy estimate. The caller should call
@@ -460,9 +464,6 @@ static struct entropy_store nonblocking_pool = {
static void mix_pool_bytes_extract(struct entropy_store *r, const void *in,
int nbytes, __u8 out[64])
{
- static __u32 const twist_table[8] = {
- 0x00000000, 0x3b6e20c8, 0x76dc4190, 0x4db26158,
- 0xedb88320, 0xd6d6a3e8, 0x9b64c2b0, 0xa00ae278 };
unsigned long i, j, tap1, tap2, tap3, tap4, tap5;
int input_rotate;
int wordmask = r->poolinfo->poolwords - 1;
@@ -521,6 +522,36 @@ static void mix_pool_bytes(struct entropy_store *r, const void *in, int bytes)
mix_pool_bytes_extract(r, in, bytes, NULL);
}
+struct fast_pool {
+ __u32 pool[4];
+ unsigned long last;
+ unsigned short count;
+ unsigned char rotate;
+ unsigned char last_timer_intr;
+};
+
+/*
+ * This is a fast mixing routine used by the interrupt randomness
+ * collector. It's hardcoded for an 128 bit pool and assumes that any
+ * locks that might be needed are taken by the caller.
+ */
+static void fast_mix(struct fast_pool *f, const void *in, int nbytes)
+{
+ const char *bytes = in;
+ __u32 w;
+ unsigned i = f->count;
+ unsigned input_rotate = f->rotate;
+
+ while (nbytes--) {
+ w = rol32(*bytes++, input_rotate & 31) ^ f->pool[i & 3] ^
+ f->pool[(i + 1) & 3];
+ f->pool[i & 3] = (w >> 3) ^ twist_table[w & 7];
+ input_rotate += (i++ & 3) ? 7 : 14;
+ }
+ f->count = i;
+ f->rotate = input_rotate;
+}
+
/*
* Credit (or debit) the entropy store with n bits of entropy
*/
@@ -544,6 +575,12 @@ static void credit_entropy_bits(struct entropy_store *r, int nbits)
entropy_count = r->poolinfo->POOLBITS;
r->entropy_count = entropy_count;
+ if (!r->initialized && nbits > 0) {
+ r->entropy_total += nbits;
+ if (r->entropy_total > 128)
+ r->initialized = 1;
+ }
+
/* should we wake readers? */
if (r == &input_pool && entropy_count >= random_read_wakeup_thresh) {
wake_up_interruptible(&random_read_wait);
@@ -693,17 +730,48 @@ void add_input_randomness(unsigned int type, unsigned int code,
}
EXPORT_SYMBOL_GPL(add_input_randomness);
-void add_interrupt_randomness(int irq)
+static DEFINE_PER_CPU(struct fast_pool, irq_randomness);
+
+void add_interrupt_randomness(int irq, int irq_flags)
{
- struct timer_rand_state *state;
+ struct entropy_store *r;
+ struct fast_pool *fast_pool = &__get_cpu_var(irq_randomness);
+ struct pt_regs *regs = get_irq_regs();
+ unsigned long now = jiffies;
+ __u32 input[4], cycles = get_cycles();
+
+ input[0] = cycles ^ jiffies;
+ input[1] = irq;
+ if (regs) {
+ __u64 ip = instruction_pointer(regs);
+ input[2] = ip;
+ input[3] = ip >> 32;
+ }
- state = get_timer_rand_state(irq);
+ fast_mix(fast_pool, input, sizeof(input));
- if (state == NULL)
+ if ((fast_pool->count & 1023) &&
+ !time_after(now, fast_pool->last + HZ))
return;
- DEBUG_ENT("irq event %d\n", irq);
- add_timer_randomness(state, 0x100 + irq);
+ fast_pool->last = now;
+
+ r = nonblocking_pool.initialized ? &input_pool : &nonblocking_pool;
+ mix_pool_bytes(r, &fast_pool->pool, sizeof(fast_pool->pool));
+ /*
+ * If we don't have a valid cycle counter, and we see
+ * back-to-back timer interrupts, then skip giving credit for
+ * any entropy.
+ */
+ if (cycles == 0) {
+ if (irq_flags & __IRQF_TIMER) {
+ if (fast_pool->last_timer_intr)
+ return;
+ fast_pool->last_timer_intr = 1;
+ } else
+ fast_pool->last_timer_intr = 0;
+ }
+ credit_entropy_bits(r, 1);
}
#ifdef CONFIG_BLOCK
@@ -964,6 +1032,7 @@ static void init_std_data(struct entropy_store *r)
spin_lock_irqsave(&r->lock, flags);
r->entropy_count = 0;
+ r->entropy_total = 0;
spin_unlock_irqrestore(&r->lock, flags);
now = ktime_get_real();
diff --git a/drivers/mfd/ab3100-core.c b/drivers/mfd/ab3100-core.c
index 4267a4d..2a193dc 100644
--- a/drivers/mfd/ab3100-core.c
+++ b/drivers/mfd/ab3100-core.c
@@ -378,8 +378,6 @@ static irqreturn_t ab3100_irq_handler(int irq, void *data)
u32 fatevent;
int err;
- add_interrupt_randomness(irq);
-
err = ab3100_get_register_page_interruptible(ab3100, AB3100_EVENTA1,
event_regs, 3);
if (err)
diff --git a/include/linux/random.h b/include/linux/random.h
index 0bf2936..8a85602 100644
--- a/include/linux/random.h
+++ b/include/linux/random.h
@@ -48,7 +48,7 @@ extern void rand_initialize_irq(int irq);
extern void add_input_randomness(unsigned int type, unsigned int code,
unsigned int value);
-extern void add_interrupt_randomness(int irq);
+extern void add_interrupt_randomness(int irq, int irq_flags);
extern void get_random_bytes(void *buf, int nbytes);
void generate_random_uuid(unsigned char uuid_out[16]);
diff --git a/kernel/irq/handle.c b/kernel/irq/handle.c
index 76d5a67..86bcf10 100644
--- a/kernel/irq/handle.c
+++ b/kernel/irq/handle.c
@@ -368,7 +368,7 @@ static void warn_no_thread(unsigned int irq, struct irqaction *action)
irqreturn_t handle_IRQ_event(unsigned int irq, struct irqaction *action)
{
irqreturn_t ret, retval = IRQ_NONE;
- unsigned int status = 0;
+ unsigned int flags = 0;
if (!(action->flags & IRQF_DISABLED))
local_irq_enable_in_hardirq();
@@ -411,7 +411,7 @@ irqreturn_t handle_IRQ_event(unsigned int irq, struct irqaction *action)
/* Fall through to add to randomness */
case IRQ_HANDLED:
- status |= action->flags;
+ flags |= action->flags;
break;
default:
@@ -422,8 +422,7 @@ irqreturn_t handle_IRQ_event(unsigned int irq, struct irqaction *action)
action = action->next;
} while (action);
- if (status & IRQF_SAMPLE_RANDOM)
- add_interrupt_randomness(irq);
+ add_interrupt_randomness(irq, flags);
local_irq_disable();
return retval;
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 152/165] random: use lockless techniques in the interrupt path
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (150 preceding siblings ...)
2012-08-15 19:48 ` [v2.6.34-stable 151/165] random: make 'add_interrupt_randomness()' do something sane Paul Gortmaker
@ 2012-08-15 19:48 ` Paul Gortmaker
2012-08-15 19:48 ` [v2.6.34-stable 153/165] random: create add_device_randomness() interface Paul Gortmaker
` (12 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:48 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Theodore Ts'o, Paul Gortmaker
From: Theodore Ts'o <tytso@mit.edu>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 902c098a3663de3fa18639efbb71b6080f0bcd3c upstream.
The real-time Linux folks don't like add_interrupt_randomness() taking
a spinlock since it is called in the low-level interrupt routine.
This also allows us to reduce the overhead in the fast path, for the
random driver, which is the interrupt collection path.
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/char/random.c | 78 +++++++++++++++++++++++++--------------------------
1 file changed, 39 insertions(+), 39 deletions(-)
diff --git a/drivers/char/random.c b/drivers/char/random.c
index a104af3..3cfaf87 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -411,9 +411,9 @@ struct entropy_store {
/* read-write data: */
spinlock_t lock;
unsigned add_ptr;
+ unsigned input_rotate;
int entropy_count;
int entropy_total;
- int input_rotate;
unsigned int initialized:1;
__u8 last_data[EXTRACT_SIZE];
};
@@ -461,26 +461,24 @@ static __u32 const twist_table[8] = {
* it's cheap to do so and helps slightly in the expected case where
* the entropy is concentrated in the low-order bits.
*/
-static void mix_pool_bytes_extract(struct entropy_store *r, const void *in,
- int nbytes, __u8 out[64])
+static void __mix_pool_bytes(struct entropy_store *r, const void *in,
+ int nbytes, __u8 out[64])
{
unsigned long i, j, tap1, tap2, tap3, tap4, tap5;
int input_rotate;
int wordmask = r->poolinfo->poolwords - 1;
const char *bytes = in;
__u32 w;
- unsigned long flags;
- /* Taps are constant, so we can load them without holding r->lock. */
tap1 = r->poolinfo->tap1;
tap2 = r->poolinfo->tap2;
tap3 = r->poolinfo->tap3;
tap4 = r->poolinfo->tap4;
tap5 = r->poolinfo->tap5;
- spin_lock_irqsave(&r->lock, flags);
- input_rotate = r->input_rotate;
- i = r->add_ptr;
+ smp_rmb();
+ input_rotate = ACCESS_ONCE(r->input_rotate);
+ i = ACCESS_ONCE(r->add_ptr);
/* mix one byte at a time to simplify size handling and churn faster */
while (nbytes--) {
@@ -507,19 +505,23 @@ static void mix_pool_bytes_extract(struct entropy_store *r, const void *in,
input_rotate += i ? 7 : 14;
}
- r->input_rotate = input_rotate;
- r->add_ptr = i;
+ ACCESS_ONCE(r->input_rotate) = input_rotate;
+ ACCESS_ONCE(r->add_ptr) = i;
+ smp_wmb();
if (out)
for (j = 0; j < 16; j++)
((__u32 *)out)[j] = r->pool[(i - j) & wordmask];
-
- spin_unlock_irqrestore(&r->lock, flags);
}
-static void mix_pool_bytes(struct entropy_store *r, const void *in, int bytes)
+static void mix_pool_bytes(struct entropy_store *r, const void *in,
+ int nbytes, __u8 out[64])
{
- mix_pool_bytes_extract(r, in, bytes, NULL);
+ unsigned long flags;
+
+ spin_lock_irqsave(&r->lock, flags);
+ __mix_pool_bytes(r, in, nbytes, out);
+ spin_unlock_irqrestore(&r->lock, flags);
}
struct fast_pool {
@@ -557,23 +559,22 @@ static void fast_mix(struct fast_pool *f, const void *in, int nbytes)
*/
static void credit_entropy_bits(struct entropy_store *r, int nbits)
{
- unsigned long flags;
- int entropy_count;
+ int entropy_count, orig;
if (!nbits)
return;
- spin_lock_irqsave(&r->lock, flags);
-
DEBUG_ENT("added %d entropy credits to %s\n", nbits, r->name);
- entropy_count = r->entropy_count;
+retry:
+ entropy_count = orig = ACCESS_ONCE(r->entropy_count);
entropy_count += nbits;
if (entropy_count < 0) {
DEBUG_ENT("negative entropy/overflow\n");
entropy_count = 0;
} else if (entropy_count > r->poolinfo->POOLBITS)
entropy_count = r->poolinfo->POOLBITS;
- r->entropy_count = entropy_count;
+ if (cmpxchg(&r->entropy_count, orig, entropy_count) != orig)
+ goto retry;
if (!r->initialized && nbits > 0) {
r->entropy_total += nbits;
@@ -586,7 +587,6 @@ static void credit_entropy_bits(struct entropy_store *r, int nbits)
wake_up_interruptible(&random_read_wait);
kill_fasync(&fasync, SIGIO, POLL_IN);
}
- spin_unlock_irqrestore(&r->lock, flags);
}
/*********************************************************************
@@ -673,7 +673,7 @@ static void add_timer_randomness(struct timer_rand_state *state, unsigned num)
sample.cycles = get_cycles();
sample.num = num;
- mix_pool_bytes(&input_pool, &sample, sizeof(sample));
+ mix_pool_bytes(&input_pool, &sample, sizeof(sample), NULL);
/*
* Calculate number of bits of randomness we probably added.
@@ -757,7 +757,7 @@ void add_interrupt_randomness(int irq, int irq_flags)
fast_pool->last = now;
r = nonblocking_pool.initialized ? &input_pool : &nonblocking_pool;
- mix_pool_bytes(r, &fast_pool->pool, sizeof(fast_pool->pool));
+ __mix_pool_bytes(r, &fast_pool->pool, sizeof(fast_pool->pool), NULL);
/*
* If we don't have a valid cycle counter, and we see
* back-to-back timer interrupts, then skip giving credit for
@@ -822,7 +822,7 @@ static void xfer_secondary_pool(struct entropy_store *r, size_t nbytes)
bytes = extract_entropy(r->pull, tmp, bytes,
random_read_wakeup_thresh / 8, rsvd);
- mix_pool_bytes(r, tmp, bytes);
+ mix_pool_bytes(r, tmp, bytes, NULL);
credit_entropy_bits(r, bytes*8);
}
}
@@ -883,9 +883,11 @@ static void extract_buf(struct entropy_store *r, __u8 *out)
int i;
__u32 hash[5], workspace[SHA_WORKSPACE_WORDS];
__u8 extract[64];
+ unsigned long flags;
/* Generate a hash across the pool, 16 words (512 bits) at a time */
sha_init(hash);
+ spin_lock_irqsave(&r->lock, flags);
for (i = 0; i < r->poolinfo->poolwords; i += 16)
sha_transform(hash, (__u8 *)(r->pool + i), workspace);
@@ -898,7 +900,8 @@ static void extract_buf(struct entropy_store *r, __u8 *out)
* brute-forcing the feedback as hard as brute-forcing the
* hash.
*/
- mix_pool_bytes_extract(r, hash, sizeof(hash), extract);
+ __mix_pool_bytes(r, hash, sizeof(hash), extract);
+ spin_unlock_irqrestore(&r->lock, flags);
/*
* To avoid duplicates, we atomically extract a portion of the
@@ -921,11 +924,10 @@ static void extract_buf(struct entropy_store *r, __u8 *out)
}
static ssize_t extract_entropy(struct entropy_store *r, void *buf,
- size_t nbytes, int min, int reserved)
+ size_t nbytes, int min, int reserved)
{
ssize_t ret = 0, i;
__u8 tmp[EXTRACT_SIZE];
- unsigned long flags;
xfer_secondary_pool(r, nbytes);
nbytes = account(r, nbytes, min, reserved);
@@ -934,6 +936,8 @@ static ssize_t extract_entropy(struct entropy_store *r, void *buf,
extract_buf(r, tmp);
if (fips_enabled) {
+ unsigned long flags;
+
spin_lock_irqsave(&r->lock, flags);
if (!memcmp(tmp, r->last_data, EXTRACT_SIZE))
panic("Hardware RNG duplicated output!\n");
@@ -1027,22 +1031,18 @@ EXPORT_SYMBOL(get_random_bytes);
static void init_std_data(struct entropy_store *r)
{
int i;
- ktime_t now;
- unsigned long flags;
+ ktime_t now = ktime_get_real();
+ unsigned long rv;
- spin_lock_irqsave(&r->lock, flags);
r->entropy_count = 0;
r->entropy_total = 0;
- spin_unlock_irqrestore(&r->lock, flags);
-
- now = ktime_get_real();
- mix_pool_bytes(r, &now, sizeof(now));
- for (i = r->poolinfo->POOLBYTES; i > 0; i -= sizeof flags) {
- if (!arch_get_random_long(&flags))
+ mix_pool_bytes(r, &now, sizeof(now), NULL);
+ for (i = r->poolinfo->POOLBYTES; i > 0; i -= sizeof(rv)) {
+ if (!arch_get_random_long(&rv))
break;
- mix_pool_bytes(r, &flags, sizeof(flags));
+ mix_pool_bytes(r, &rv, sizeof(rv), NULL);
}
- mix_pool_bytes(r, utsname(), sizeof(*(utsname())));
+ mix_pool_bytes(r, utsname(), sizeof(*(utsname())), NULL);
}
static int rand_initialize(void)
@@ -1179,7 +1179,7 @@ write_pool(struct entropy_store *r, const char __user *buffer, size_t count)
count -= bytes;
p += bytes;
- mix_pool_bytes(r, buf, bytes);
+ mix_pool_bytes(r, buf, bytes, NULL);
cond_resched();
}
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 153/165] random: create add_device_randomness() interface
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (151 preceding siblings ...)
2012-08-15 19:48 ` [v2.6.34-stable 152/165] random: use lockless techniques in the interrupt path Paul Gortmaker
@ 2012-08-15 19:48 ` Paul Gortmaker
2012-08-15 19:48 ` [v2.6.34-stable 154/165] random: use the arch-specific rng in xfer_secondary_pool Paul Gortmaker
` (11 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:48 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Linus Torvalds, Theodore Ts'o, Paul Gortmaker
From: Linus Torvalds <torvalds@linux-foundation.org>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit a2080a67abe9e314f9e9c2cc3a4a176e8a8f8793 upstream.
Add a new interface, add_device_randomness() for adding data to the
random pool that is likely to differ between two devices (or possibly
even per boot). This would be things like MAC addresses or serial
numbers, or the read-out of the RTC. This does *not* add any actual
entropy to the pool, but it initializes the pool to different values
for devices that might otherwise be identical and have very little
entropy available to them (particularly common in the embedded world).
[ Modified by tytso to mix in a timestamp, since there may be some
variability caused by the time needed to detect/configure the hardware
in question. ]
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/char/random.c | 28 ++++++++++++++++++++++++++++
include/linux/random.h | 1 +
2 files changed, 29 insertions(+)
diff --git a/drivers/char/random.c b/drivers/char/random.c
index 3cfaf87..0c85b69 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -125,10 +125,19 @@
* The current exported interfaces for gathering environmental noise
* from the devices are:
*
+ * void add_device_randomness(const void *buf, unsigned int size);
* void add_input_randomness(unsigned int type, unsigned int code,
* unsigned int value);
* void add_interrupt_randomness(int irq, int irq_flags);
*
+ * add_device_randomness() is for adding data to the random pool that
+ * is likely to differ between two devices (or possibly even per boot).
+ * This would be things like MAC addresses or serial numbers, or the
+ * read-out of the RTC. This does *not* add any actual entropy to the
+ * pool, but it initializes the pool to different values for devices
+ * that might otherwise be identical and have very little entropy
+ * available to them (particularly common in the embedded world).
+ *
* add_input_randomness() uses the input layer interrupt timing, as well as
* the event type information from the hardware.
*
@@ -639,6 +648,25 @@ static void set_timer_rand_state(unsigned int irq,
}
#endif
+/*
+ * Add device- or boot-specific data to the input and nonblocking
+ * pools to help initialize them to unique values.
+ *
+ * None of this adds any entropy, it is meant to avoid the
+ * problem of the nonblocking pool having similar initial state
+ * across largely identical devices.
+ */
+void add_device_randomness(const void *buf, unsigned int size)
+{
+ unsigned long time = get_cycles() ^ jiffies;
+
+ mix_pool_bytes(&input_pool, buf, size, NULL);
+ mix_pool_bytes(&input_pool, &time, sizeof(time), NULL);
+ mix_pool_bytes(&nonblocking_pool, buf, size, NULL);
+ mix_pool_bytes(&nonblocking_pool, &time, sizeof(time), NULL);
+}
+EXPORT_SYMBOL(add_device_randomness);
+
static struct timer_rand_state input_timer_state;
/*
diff --git a/include/linux/random.h b/include/linux/random.h
index 8a85602..7451093 100644
--- a/include/linux/random.h
+++ b/include/linux/random.h
@@ -46,6 +46,7 @@ struct rand_pool_info {
extern void rand_initialize_irq(int irq);
+extern void add_device_randomness(const void *, unsigned int);
extern void add_input_randomness(unsigned int type, unsigned int code,
unsigned int value);
extern void add_interrupt_randomness(int irq, int irq_flags);
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 154/165] random: use the arch-specific rng in xfer_secondary_pool
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (152 preceding siblings ...)
2012-08-15 19:48 ` [v2.6.34-stable 153/165] random: create add_device_randomness() interface Paul Gortmaker
@ 2012-08-15 19:48 ` Paul Gortmaker
2012-08-15 19:48 ` [v2.6.34-stable 155/165] random: add new get_random_bytes_arch() function Paul Gortmaker
` (10 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:48 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Theodore Ts'o, Paul Gortmaker
From: Theodore Ts'o <tytso@mit.edu>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit e6d4947b12e8ad947add1032dd754803c6004824 upstream.
If the CPU supports a hardware random number generator, use it in
xfer_secondary_pool(), where it will significantly improve things and
where we can afford it.
Also, remove the use of the arch-specific rng in
add_timer_randomness(), since the call is significantly slower than
get_cycles(), and we're much better off using it in
xfer_secondary_pool() anyway.
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/char/random.c | 25 ++++++++++++++++---------
1 file changed, 16 insertions(+), 9 deletions(-)
diff --git a/drivers/char/random.c b/drivers/char/random.c
index 0c85b69..f41a9f3 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -247,6 +247,7 @@
#include <linux/cryptohash.h>
#include <linux/fips.h>
#include <linux/ptrace.h>
+#include <linux/kmemcheck.h>
#ifdef CONFIG_GENERIC_HARDIRQS
# include <linux/irq.h>
@@ -695,11 +696,7 @@ static void add_timer_randomness(struct timer_rand_state *state, unsigned num)
goto out;
sample.jiffies = jiffies;
-
- /* Use arch random value, fall back to cycles */
- if (!arch_get_random_int(&sample.cycles))
- sample.cycles = get_cycles();
-
+ sample.cycles = get_cycles();
sample.num = num;
mix_pool_bytes(&input_pool, &sample, sizeof(sample), NULL);
@@ -831,7 +828,11 @@ static ssize_t extract_entropy(struct entropy_store *r, void *buf,
*/
static void xfer_secondary_pool(struct entropy_store *r, size_t nbytes)
{
- __u32 tmp[OUTPUT_POOL_WORDS];
+ union {
+ __u32 tmp[OUTPUT_POOL_WORDS];
+ long hwrand[4];
+ } u;
+ int i;
if (r->pull && r->entropy_count < nbytes * 8 &&
r->entropy_count < r->poolinfo->POOLBITS) {
@@ -842,17 +843,23 @@ static void xfer_secondary_pool(struct entropy_store *r, size_t nbytes)
/* pull at least as many as BYTES as wakeup BITS */
bytes = max_t(int, bytes, random_read_wakeup_thresh / 8);
/* but never more than the buffer size */
- bytes = min_t(int, bytes, sizeof(tmp));
+ bytes = min_t(int, bytes, sizeof(u.tmp));
DEBUG_ENT("going to reseed %s with %d bits "
"(%d of %d requested)\n",
r->name, bytes * 8, nbytes * 8, r->entropy_count);
- bytes = extract_entropy(r->pull, tmp, bytes,
+ bytes = extract_entropy(r->pull, u.tmp, bytes,
random_read_wakeup_thresh / 8, rsvd);
- mix_pool_bytes(r, tmp, bytes, NULL);
+ mix_pool_bytes(r, u.tmp, bytes, NULL);
credit_entropy_bits(r, bytes*8);
}
+ kmemcheck_mark_initialized(&u.hwrand, sizeof(u.hwrand));
+ for (i = 0; i < 4; i++)
+ if (arch_get_random_long(&u.hwrand[i]))
+ break;
+ if (i)
+ mix_pool_bytes(r, &u.hwrand, sizeof(u.hwrand), 0);
}
/*
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 155/165] random: add new get_random_bytes_arch() function
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (153 preceding siblings ...)
2012-08-15 19:48 ` [v2.6.34-stable 154/165] random: use the arch-specific rng in xfer_secondary_pool Paul Gortmaker
@ 2012-08-15 19:48 ` Paul Gortmaker
2012-08-15 19:48 ` [v2.6.34-stable 156/165] random: add tracepoints for easier debugging and verification Paul Gortmaker
` (9 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:48 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Theodore Ts'o, Paul Gortmaker
From: Theodore Ts'o <tytso@mit.edu>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit c2557a303ab6712bb6e09447df828c557c710ac9 upstream.
Create a new function, get_random_bytes_arch() which will use the
architecture-specific hardware random number generator if it is
present. Change get_random_bytes() to not use the HW RNG, even if it
is avaiable.
The reason for this is that the hw random number generator is fast (if
it is present), but it requires that we trust the hardware
manufacturer to have not put in a back door. (For example, an
increasing counter encrypted by an AES key known to the NSA.)
It's unlikely that Intel (for example) was paid off by the US
Government to do this, but it's impossible for them to prove otherwise
--- especially since Bull Mountain is documented to use AES as a
whitener. Hence, the output of an evil, trojan-horse version of
RDRAND is statistically indistinguishable from an RDRAND implemented
to the specifications claimed by Intel. Short of using a tunnelling
electronic microscope to reverse engineer an Ivy Bridge chip and
disassembling and analyzing the CPU microcode, there's no way for us
to tell for sure.
Since users of get_random_bytes() in the Linux kernel need to be able
to support hardware systems where the HW RNG is not present, most
time-sensitive users of this interface have already created their own
cryptographic RNG interface which uses get_random_bytes() as a seed.
So it's much better to use the HW RNG to improve the existing random
number generator, by mixing in any entropy returned by the HW RNG into
/dev/random's entropy pool, but to always _use_ /dev/random's entropy
pool.
This way we get almost of the benefits of the HW RNG without any
potential liabilities. The only benefits we forgo is the
speed/performance enhancements --- and generic kernel code can't
depend on depend on get_random_bytes() having the speed of a HW RNG
anyway.
For those places that really want access to the arch-specific HW RNG,
if it is available, we provide get_random_bytes_arch().
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/char/random.c | 27 +++++++++++++++++++++++----
include/linux/random.h | 1 +
2 files changed, 24 insertions(+), 4 deletions(-)
diff --git a/drivers/char/random.c b/drivers/char/random.c
index f41a9f3..8dc4c16 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -1031,11 +1031,28 @@ static ssize_t extract_entropy_user(struct entropy_store *r, void __user *buf,
/*
* This function is the exported kernel interface. It returns some
- * number of good random numbers, suitable for seeding TCP sequence
- * numbers, etc.
+ * number of good random numbers, suitable for key generation, seeding
+ * TCP sequence numbers, etc. It does not use the hw random number
+ * generator, if available; use get_random_bytes_arch() for that.
*/
void get_random_bytes(void *buf, int nbytes)
{
+ extract_entropy(&nonblocking_pool, buf, nbytes, 0, 0);
+}
+EXPORT_SYMBOL(get_random_bytes);
+
+/*
+ * This function will use the architecture-specific hardware random
+ * number generator if it is available. The arch-specific hw RNG will
+ * almost certainly be faster than what we can do in software, but it
+ * is impossible to verify that it is implemented securely (as
+ * opposed, to, say, the AES encryption of a sequence number using a
+ * key known by the NSA). So it's useful if we need the speed, but
+ * only if we're willing to trust the hardware manufacturer not to
+ * have put in a back door.
+ */
+void get_random_bytes_arch(void *buf, int nbytes)
+{
char *p = buf;
while (nbytes) {
@@ -1050,9 +1067,11 @@ void get_random_bytes(void *buf, int nbytes)
nbytes -= chunk;
}
- extract_entropy(&nonblocking_pool, p, nbytes, 0, 0);
+ if (nbytes)
+ extract_entropy(&nonblocking_pool, p, nbytes, 0, 0);
}
-EXPORT_SYMBOL(get_random_bytes);
+EXPORT_SYMBOL(get_random_bytes_arch);
+
/*
* init_std_data - initialize pool with system data
diff --git a/include/linux/random.h b/include/linux/random.h
index 7451093..5a376bc 100644
--- a/include/linux/random.h
+++ b/include/linux/random.h
@@ -52,6 +52,7 @@ extern void add_input_randomness(unsigned int type, unsigned int code,
extern void add_interrupt_randomness(int irq, int irq_flags);
extern void get_random_bytes(void *buf, int nbytes);
+extern void get_random_bytes_arch(void *buf, int nbytes);
void generate_random_uuid(unsigned char uuid_out[16]);
#ifndef MODULE
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 156/165] random: add tracepoints for easier debugging and verification
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (154 preceding siblings ...)
2012-08-15 19:48 ` [v2.6.34-stable 155/165] random: add new get_random_bytes_arch() function Paul Gortmaker
@ 2012-08-15 19:48 ` Paul Gortmaker
2012-08-15 19:48 ` [v2.6.34-stable 157/165] random: mix in architectural randomness in extract_buf() Paul Gortmaker
` (8 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:48 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Theodore Ts'o, Paul Gortmaker
From: Theodore Ts'o <tytso@mit.edu>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 00ce1db1a634746040ace24c09a4e3a7949a3145 upstream.
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/char/random.c | 26 ++++++--
include/trace/events/random.h | 134 ++++++++++++++++++++++++++++++++++++++++++
2 files changed, 156 insertions(+), 4 deletions(-)
create mode 100644 include/trace/events/random.h
diff --git a/drivers/char/random.c b/drivers/char/random.c
index 8dc4c16..78e107f 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -259,6 +259,9 @@
#include <asm/irq_regs.h>
#include <asm/io.h>
+#define CREATE_TRACE_POINTS
+#include <trace/events/random.h>
+
/*
* Configuration information
*/
@@ -471,8 +474,8 @@ static __u32 const twist_table[8] = {
* it's cheap to do so and helps slightly in the expected case where
* the entropy is concentrated in the low-order bits.
*/
-static void __mix_pool_bytes(struct entropy_store *r, const void *in,
- int nbytes, __u8 out[64])
+static void _mix_pool_bytes(struct entropy_store *r, const void *in,
+ int nbytes, __u8 out[64])
{
unsigned long i, j, tap1, tap2, tap3, tap4, tap5;
int input_rotate;
@@ -524,13 +527,21 @@ static void __mix_pool_bytes(struct entropy_store *r, const void *in,
((__u32 *)out)[j] = r->pool[(i - j) & wordmask];
}
-static void mix_pool_bytes(struct entropy_store *r, const void *in,
+static void __mix_pool_bytes(struct entropy_store *r, const void *in,
int nbytes, __u8 out[64])
{
+ trace_mix_pool_bytes_nolock(r->name, nbytes, _RET_IP_);
+ _mix_pool_bytes(r, in, nbytes, out);
+}
+
+static void mix_pool_bytes(struct entropy_store *r, const void *in,
+ int nbytes, __u8 out[64])
+{
unsigned long flags;
+ trace_mix_pool_bytes(r->name, nbytes, _RET_IP_);
spin_lock_irqsave(&r->lock, flags);
- __mix_pool_bytes(r, in, nbytes, out);
+ _mix_pool_bytes(r, in, nbytes, out);
spin_unlock_irqrestore(&r->lock, flags);
}
@@ -578,6 +589,7 @@ static void credit_entropy_bits(struct entropy_store *r, int nbits)
retry:
entropy_count = orig = ACCESS_ONCE(r->entropy_count);
entropy_count += nbits;
+
if (entropy_count < 0) {
DEBUG_ENT("negative entropy/overflow\n");
entropy_count = 0;
@@ -592,6 +604,9 @@ retry:
r->initialized = 1;
}
+ trace_credit_entropy_bits(r->name, nbits, entropy_count,
+ r->entropy_total, _RET_IP_);
+
/* should we wake readers? */
if (r == &input_pool && entropy_count >= random_read_wakeup_thresh) {
wake_up_interruptible(&random_read_wait);
@@ -964,6 +979,7 @@ static ssize_t extract_entropy(struct entropy_store *r, void *buf,
ssize_t ret = 0, i;
__u8 tmp[EXTRACT_SIZE];
+ trace_extract_entropy(r->name, nbytes, r->entropy_count, _RET_IP_);
xfer_secondary_pool(r, nbytes);
nbytes = account(r, nbytes, min, reserved);
@@ -998,6 +1014,7 @@ static ssize_t extract_entropy_user(struct entropy_store *r, void __user *buf,
ssize_t ret = 0, i;
__u8 tmp[EXTRACT_SIZE];
+ trace_extract_entropy_user(r->name, nbytes, r->entropy_count, _RET_IP_);
xfer_secondary_pool(r, nbytes);
nbytes = account(r, nbytes, 0, 0);
@@ -1055,6 +1072,7 @@ void get_random_bytes_arch(void *buf, int nbytes)
{
char *p = buf;
+ trace_get_random_bytes(nbytes, _RET_IP_);
while (nbytes) {
unsigned long v;
int chunk = min(nbytes, (int)sizeof(unsigned long));
diff --git a/include/trace/events/random.h b/include/trace/events/random.h
new file mode 100644
index 0000000..422df19
--- /dev/null
+++ b/include/trace/events/random.h
@@ -0,0 +1,134 @@
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM random
+
+#if !defined(_TRACE_RANDOM_H) || defined(TRACE_HEADER_MULTI_READ)
+#define _TRACE_RANDOM_H
+
+#include <linux/writeback.h>
+#include <linux/tracepoint.h>
+
+DECLARE_EVENT_CLASS(random__mix_pool_bytes,
+ TP_PROTO(const char *pool_name, int bytes, unsigned long IP),
+
+ TP_ARGS(pool_name, bytes, IP),
+
+ TP_STRUCT__entry(
+ __field( const char *, pool_name )
+ __field( int, bytes )
+ __field(unsigned long, IP )
+ ),
+
+ TP_fast_assign(
+ __entry->pool_name = pool_name;
+ __entry->bytes = bytes;
+ __entry->IP = IP;
+ ),
+
+ TP_printk("%s pool: bytes %d caller %pF",
+ __entry->pool_name, __entry->bytes, (void *)__entry->IP)
+);
+
+DEFINE_EVENT(random__mix_pool_bytes, mix_pool_bytes,
+ TP_PROTO(const char *pool_name, int bytes, unsigned long IP),
+
+ TP_ARGS(pool_name, bytes, IP)
+);
+
+DEFINE_EVENT(random__mix_pool_bytes, mix_pool_bytes_nolock,
+ TP_PROTO(const char *pool_name, int bytes, unsigned long IP),
+
+ TP_ARGS(pool_name, bytes, IP)
+);
+
+TRACE_EVENT(credit_entropy_bits,
+ TP_PROTO(const char *pool_name, int bits, int entropy_count,
+ int entropy_total, unsigned long IP),
+
+ TP_ARGS(pool_name, bits, entropy_count, entropy_total, IP),
+
+ TP_STRUCT__entry(
+ __field( const char *, pool_name )
+ __field( int, bits )
+ __field( int, entropy_count )
+ __field( int, entropy_total )
+ __field(unsigned long, IP )
+ ),
+
+ TP_fast_assign(
+ __entry->pool_name = pool_name;
+ __entry->bits = bits;
+ __entry->entropy_count = entropy_count;
+ __entry->entropy_total = entropy_total;
+ __entry->IP = IP;
+ ),
+
+ TP_printk("%s pool: bits %d entropy_count %d entropy_total %d "
+ "caller %pF", __entry->pool_name, __entry->bits,
+ __entry->entropy_count, __entry->entropy_total,
+ (void *)__entry->IP)
+);
+
+TRACE_EVENT(get_random_bytes,
+ TP_PROTO(int nbytes, unsigned long IP),
+
+ TP_ARGS(nbytes, IP),
+
+ TP_STRUCT__entry(
+ __field( int, nbytes )
+ __field(unsigned long, IP )
+ ),
+
+ TP_fast_assign(
+ __entry->nbytes = nbytes;
+ __entry->IP = IP;
+ ),
+
+ TP_printk("nbytes %d caller %pF", __entry->nbytes, (void *)__entry->IP)
+);
+
+DECLARE_EVENT_CLASS(random__extract_entropy,
+ TP_PROTO(const char *pool_name, int nbytes, int entropy_count,
+ unsigned long IP),
+
+ TP_ARGS(pool_name, nbytes, entropy_count, IP),
+
+ TP_STRUCT__entry(
+ __field( const char *, pool_name )
+ __field( int, nbytes )
+ __field( int, entropy_count )
+ __field(unsigned long, IP )
+ ),
+
+ TP_fast_assign(
+ __entry->pool_name = pool_name;
+ __entry->nbytes = nbytes;
+ __entry->entropy_count = entropy_count;
+ __entry->IP = IP;
+ ),
+
+ TP_printk("%s pool: nbytes %d entropy_count %d caller %pF",
+ __entry->pool_name, __entry->nbytes, __entry->entropy_count,
+ (void *)__entry->IP)
+);
+
+
+DEFINE_EVENT(random__extract_entropy, extract_entropy,
+ TP_PROTO(const char *pool_name, int nbytes, int entropy_count,
+ unsigned long IP),
+
+ TP_ARGS(pool_name, nbytes, entropy_count, IP)
+);
+
+DEFINE_EVENT(random__extract_entropy, extract_entropy_user,
+ TP_PROTO(const char *pool_name, int nbytes, int entropy_count,
+ unsigned long IP),
+
+ TP_ARGS(pool_name, nbytes, entropy_count, IP)
+);
+
+
+
+#endif /* _TRACE_RANDOM_H */
+
+/* This part must be outside protection */
+#include <trace/define_trace.h>
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 157/165] random: mix in architectural randomness in extract_buf()
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (155 preceding siblings ...)
2012-08-15 19:48 ` [v2.6.34-stable 156/165] random: add tracepoints for easier debugging and verification Paul Gortmaker
@ 2012-08-15 19:48 ` Paul Gortmaker
2012-08-15 19:48 ` [v2.6.34-stable 158/165] MAINTAINERS: Theodore Ts'o is taking over the random driver Paul Gortmaker
` (7 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:48 UTC (permalink / raw)
To: stable, linux-kernel
Cc: H. Peter Anvin, DJ Johnston, Theodore Ts'o, Paul Gortmaker
From: "H. Peter Anvin" <hpa@linux.intel.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit d2e7c96af1e54b507ae2a6a7dd2baf588417a7e5 upstream.
Mix in any architectural randomness in extract_buf() instead of
xfer_secondary_buf(). This allows us to mix in more architectural
randomness, and it also makes xfer_secondary_buf() faster, moving a
tiny bit of additional CPU overhead to process which is extracting the
randomness.
[ Commit description modified by tytso to remove an extended
advertisement for the RDRAND instruction. ]
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Acked-by: Ingo Molnar <mingo@kernel.org>
Cc: DJ Johnston <dj.johnston@intel.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/char/random.c | 56 +++++++++++++++++++++++++++++----------------------
1 file changed, 32 insertions(+), 24 deletions(-)
diff --git a/drivers/char/random.c b/drivers/char/random.c
index 78e107f..14f1f23 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -270,6 +270,8 @@
#define SEC_XFER_SIZE 512
#define EXTRACT_SIZE 10
+#define LONGS(x) (((x) + sizeof(unsigned long) - 1)/sizeof(unsigned long))
+
/*
* The minimum number of bits of entropy before we wake up a read on
* /dev/random. Should be enough to do a significant reseed.
@@ -843,11 +845,7 @@ static ssize_t extract_entropy(struct entropy_store *r, void *buf,
*/
static void xfer_secondary_pool(struct entropy_store *r, size_t nbytes)
{
- union {
- __u32 tmp[OUTPUT_POOL_WORDS];
- long hwrand[4];
- } u;
- int i;
+ __u32 tmp[OUTPUT_POOL_WORDS];
if (r->pull && r->entropy_count < nbytes * 8 &&
r->entropy_count < r->poolinfo->POOLBITS) {
@@ -858,23 +856,17 @@ static void xfer_secondary_pool(struct entropy_store *r, size_t nbytes)
/* pull at least as many as BYTES as wakeup BITS */
bytes = max_t(int, bytes, random_read_wakeup_thresh / 8);
/* but never more than the buffer size */
- bytes = min_t(int, bytes, sizeof(u.tmp));
+ bytes = min_t(int, bytes, sizeof(tmp));
DEBUG_ENT("going to reseed %s with %d bits "
"(%d of %d requested)\n",
r->name, bytes * 8, nbytes * 8, r->entropy_count);
- bytes = extract_entropy(r->pull, u.tmp, bytes,
+ bytes = extract_entropy(r->pull, tmp, bytes,
random_read_wakeup_thresh / 8, rsvd);
- mix_pool_bytes(r, u.tmp, bytes, NULL);
+ mix_pool_bytes(r, tmp, bytes, NULL);
credit_entropy_bits(r, bytes*8);
}
- kmemcheck_mark_initialized(&u.hwrand, sizeof(u.hwrand));
- for (i = 0; i < 4; i++)
- if (arch_get_random_long(&u.hwrand[i]))
- break;
- if (i)
- mix_pool_bytes(r, &u.hwrand, sizeof(u.hwrand), 0);
}
/*
@@ -931,15 +923,19 @@ static size_t account(struct entropy_store *r, size_t nbytes, int min,
static void extract_buf(struct entropy_store *r, __u8 *out)
{
int i;
- __u32 hash[5], workspace[SHA_WORKSPACE_WORDS];
+ union {
+ __u32 w[5];
+ unsigned long l[LONGS(EXTRACT_SIZE)];
+ } hash;
+ __u32 workspace[SHA_WORKSPACE_WORDS];
__u8 extract[64];
unsigned long flags;
/* Generate a hash across the pool, 16 words (512 bits) at a time */
- sha_init(hash);
+ sha_init(hash.w);
spin_lock_irqsave(&r->lock, flags);
for (i = 0; i < r->poolinfo->poolwords; i += 16)
- sha_transform(hash, (__u8 *)(r->pool + i), workspace);
+ sha_transform(hash.w, (__u8 *)(r->pool + i), workspace);
/*
* We mix the hash back into the pool to prevent backtracking
@@ -950,14 +946,14 @@ static void extract_buf(struct entropy_store *r, __u8 *out)
* brute-forcing the feedback as hard as brute-forcing the
* hash.
*/
- __mix_pool_bytes(r, hash, sizeof(hash), extract);
+ __mix_pool_bytes(r, hash.w, sizeof(hash.w), extract);
spin_unlock_irqrestore(&r->lock, flags);
/*
* To avoid duplicates, we atomically extract a portion of the
* pool while mixing, and hash one final time.
*/
- sha_transform(hash, extract, workspace);
+ sha_transform(hash.w, extract, workspace);
memset(extract, 0, sizeof(extract));
memset(workspace, 0, sizeof(workspace));
@@ -966,11 +962,23 @@ static void extract_buf(struct entropy_store *r, __u8 *out)
* pattern, we fold it in half. Thus, we always feed back
* twice as much data as we output.
*/
- hash[0] ^= hash[3];
- hash[1] ^= hash[4];
- hash[2] ^= rol32(hash[2], 16);
- memcpy(out, hash, EXTRACT_SIZE);
- memset(hash, 0, sizeof(hash));
+ hash.w[0] ^= hash.w[3];
+ hash.w[1] ^= hash.w[4];
+ hash.w[2] ^= rol32(hash.w[2], 16);
+
+ /*
+ * If we have a architectural hardware random number
+ * generator, mix that in, too.
+ */
+ for (i = 0; i < LONGS(EXTRACT_SIZE); i++) {
+ unsigned long v;
+ if (!arch_get_random_long(&v))
+ break;
+ hash.l[i] ^= v;
+ }
+
+ memcpy(out, &hash, EXTRACT_SIZE);
+ memset(&hash, 0, sizeof(hash));
}
static ssize_t extract_entropy(struct entropy_store *r, void *buf,
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 158/165] MAINTAINERS: Theodore Ts'o is taking over the random driver
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (156 preceding siblings ...)
2012-08-15 19:48 ` [v2.6.34-stable 157/165] random: mix in architectural randomness in extract_buf() Paul Gortmaker
@ 2012-08-15 19:48 ` Paul Gortmaker
2012-08-15 19:48 ` [v2.6.34-stable 159/165] usb: feed USB device information to the /dev/random driver Paul Gortmaker
` (6 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:48 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Theodore Ts'o, Matt Mackall, Paul Gortmaker
From: Theodore Ts'o <tytso@mit.edu>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 330e0a01d54c2b8606c56816f99af6ebc58ec92c upstream.
Matt Mackall stepped down as the /dev/random driver maintainer last
year, so Theodore Ts'o is taking back the /dev/random driver.
Cc: Matt Mackall <mpm@selenic.com>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
MAINTAINERS | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/MAINTAINERS b/MAINTAINERS
index 52bec00..de13f3e 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -4644,7 +4644,7 @@ F: Documentation/blockdev/ramdisk.txt
F: drivers/block/brd.c
RANDOM NUMBER DRIVER
-M: Matt Mackall <mpm@selenic.com>
+M: Theodore Ts'o" <tytso@mit.edu>
S: Maintained
F: drivers/char/random.c
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 159/165] usb: feed USB device information to the /dev/random driver
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (157 preceding siblings ...)
2012-08-15 19:48 ` [v2.6.34-stable 158/165] MAINTAINERS: Theodore Ts'o is taking over the random driver Paul Gortmaker
@ 2012-08-15 19:48 ` Paul Gortmaker
2012-08-15 19:48 ` [v2.6.34-stable 160/165] net: feed /dev/random with the MAC address when registering a device Paul Gortmaker
` (5 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:48 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Theodore Ts'o, Linus Torvalds, Paul Gortmaker
From: Theodore Ts'o <tytso@mit.edu>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit b04b3156a20d395a7faa8eed98698d1e17a36000 upstream.
Send the USB device's serial, product, and manufacturer strings to the
/dev/random driver to help seed its pools.
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Acked-by: Greg KH <greg@kroah.com>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/usb/core/hub.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 40815d0..953269f 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -23,6 +23,7 @@
#include <linux/mutex.h>
#include <linux/freezer.h>
#include <linux/pm_runtime.h>
+#include <linux/random.h>
#include <asm/uaccess.h>
#include <asm/byteorder.h>
@@ -1827,6 +1828,14 @@ int usb_new_device(struct usb_device *udev)
/* Tell the world! */
announce_device(udev);
+ if (udev->serial)
+ add_device_randomness(udev->serial, strlen(udev->serial));
+ if (udev->product)
+ add_device_randomness(udev->product, strlen(udev->product));
+ if (udev->manufacturer)
+ add_device_randomness(udev->manufacturer,
+ strlen(udev->manufacturer));
+
device_enable_async_suspend(&udev->dev);
/* Register the device. The device driver is responsible
* for configuring the device and invoking the add-device
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 160/165] net: feed /dev/random with the MAC address when registering a device
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (158 preceding siblings ...)
2012-08-15 19:48 ` [v2.6.34-stable 159/165] usb: feed USB device information to the /dev/random driver Paul Gortmaker
@ 2012-08-15 19:48 ` Paul Gortmaker
2012-08-15 19:48 ` [v2.6.34-stable 161/165] random: remove rand_initialize_irq() Paul Gortmaker
` (4 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:48 UTC (permalink / raw)
To: stable, linux-kernel
Cc: Theodore Ts'o, David Miller, Linus Torvalds, Paul Gortmaker
From: Theodore Ts'o <tytso@mit.edu>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 7bf2357524408b97fec58344caf7397f8140c3fd upstream.
Cc: David Miller <davem@davemloft.net>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
net/core/dev.c | 3 +++
net/core/rtnetlink.c | 1 +
2 files changed, 4 insertions(+)
diff --git a/net/core/dev.c b/net/core/dev.c
index bcd5f6e..7daff00 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1177,6 +1177,7 @@ static int __dev_open(struct net_device *dev)
* Wakeup transmit queue engine
*/
dev_activate(dev);
+ add_device_randomness(dev->dev_addr, dev->addr_len);
}
return ret;
@@ -4492,6 +4493,7 @@ int dev_set_mac_address(struct net_device *dev, struct sockaddr *sa)
err = ops->ndo_set_mac_address(dev, sa);
if (!err)
call_netdevice_notifiers(NETDEV_CHANGEADDR, dev);
+ add_device_randomness(dev->dev_addr, dev->addr_len);
return err;
}
EXPORT_SYMBOL(dev_set_mac_address);
@@ -5141,6 +5143,7 @@ int register_netdevice(struct net_device *dev)
dev_init_scheduler(dev);
dev_hold(dev);
list_netdevice(dev);
+ add_device_randomness(dev->dev_addr, dev->addr_len);
/* Notify protocols, that a new device appeared. */
ret = call_netdevice_notifiers(NETDEV_REGISTER, dev);
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 31e85d3..835f38c 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -974,6 +974,7 @@ static int do_setlink(struct net_device *dev, struct ifinfomsg *ifm,
goto errout;
send_addr_notify = 1;
modified = 1;
+ add_device_randomness(dev->dev_addr, dev->addr_len);
}
if (tb[IFLA_MTU]) {
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 161/165] random: remove rand_initialize_irq()
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (159 preceding siblings ...)
2012-08-15 19:48 ` [v2.6.34-stable 160/165] net: feed /dev/random with the MAC address when registering a device Paul Gortmaker
@ 2012-08-15 19:48 ` Paul Gortmaker
2012-08-15 19:48 ` [v2.6.34-stable 162/165] random: Add comment to random_initialize() Paul Gortmaker
` (3 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:48 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Theodore Ts'o, Sedat Dilek, Paul Gortmaker
From: Theodore Ts'o <tytso@mit.edu>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit c5857ccf293968348e5eb4ebedc68074de3dcda6 upstream.
With the new interrupt sampling system, we are no longer using the
timer_rand_state structure in the irq descriptor, so we can stop
initializing it now.
[ Merged in fixes from Sedat to find some last missing references to
rand_initialize_irq() ]
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Signed-off-by: Sedat Dilek <sedat.dilek@gmail.com>
[PG: in .34 the irqdesc.h content is in irq.h instead.]
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/ia64/kernel/irq_ia64.c | 1 -
drivers/char/random.c | 55 ---------------------------------------------
drivers/mfd/ab3100-core.c | 3 ---
include/linux/irq.h | 1 -
include/linux/random.h | 2 --
kernel/irq/manage.c | 17 --------------
6 files changed, 79 deletions(-)
diff --git a/arch/ia64/kernel/irq_ia64.c b/arch/ia64/kernel/irq_ia64.c
index 6404793..73a3f5b 100644
--- a/arch/ia64/kernel/irq_ia64.c
+++ b/arch/ia64/kernel/irq_ia64.c
@@ -23,7 +23,6 @@
#include <linux/ioport.h>
#include <linux/kernel_stat.h>
#include <linux/ptrace.h>
-#include <linux/random.h> /* for rand_initialize_irq() */
#include <linux/signal.h>
#include <linux/smp.h>
#include <linux/threads.h>
diff --git a/drivers/char/random.c b/drivers/char/random.c
index 14f1f23..1644b8e 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -629,43 +629,6 @@ struct timer_rand_state {
unsigned dont_count_entropy:1;
};
-#ifndef CONFIG_GENERIC_HARDIRQS
-
-static struct timer_rand_state *irq_timer_state[NR_IRQS];
-
-static struct timer_rand_state *get_timer_rand_state(unsigned int irq)
-{
- return irq_timer_state[irq];
-}
-
-static void set_timer_rand_state(unsigned int irq,
- struct timer_rand_state *state)
-{
- irq_timer_state[irq] = state;
-}
-
-#else
-
-static struct timer_rand_state *get_timer_rand_state(unsigned int irq)
-{
- struct irq_desc *desc;
-
- desc = irq_to_desc(irq);
-
- return desc->timer_rand_state;
-}
-
-static void set_timer_rand_state(unsigned int irq,
- struct timer_rand_state *state)
-{
- struct irq_desc *desc;
-
- desc = irq_to_desc(irq);
-
- desc->timer_rand_state = state;
-}
-#endif
-
/*
* Add device- or boot-specific data to the input and nonblocking
* pools to help initialize them to unique values.
@@ -1134,24 +1097,6 @@ static int rand_initialize(void)
}
module_init(rand_initialize);
-void rand_initialize_irq(int irq)
-{
- struct timer_rand_state *state;
-
- state = get_timer_rand_state(irq);
-
- if (state)
- return;
-
- /*
- * If kzalloc returns null, we just won't use that entropy
- * source.
- */
- state = kzalloc(sizeof(struct timer_rand_state), GFP_KERNEL);
- if (state)
- set_timer_rand_state(irq, state);
-}
-
#ifdef CONFIG_BLOCK
void rand_initialize_disk(struct gendisk *disk)
{
diff --git a/drivers/mfd/ab3100-core.c b/drivers/mfd/ab3100-core.c
index 2a193dc..5b7f5a90 100644
--- a/drivers/mfd/ab3100-core.c
+++ b/drivers/mfd/ab3100-core.c
@@ -890,9 +890,6 @@ static int __init ab3100_probe(struct i2c_client *client,
err = request_threaded_irq(client->irq, NULL, ab3100_irq_handler,
IRQF_ONESHOT, "ab3100-core", ab3100);
- /* This real unpredictable IRQ is of course sampled for entropy */
- rand_initialize_irq(client->irq);
-
if (err)
goto exit_no_irq;
diff --git a/include/linux/irq.h b/include/linux/irq.h
index 707ab12..7c2e4bf 100644
--- a/include/linux/irq.h
+++ b/include/linux/irq.h
@@ -174,7 +174,6 @@ struct irq_2_iommu;
*/
struct irq_desc {
unsigned int irq;
- struct timer_rand_state *timer_rand_state;
unsigned int *kstat_irqs;
#ifdef CONFIG_INTR_REMAP
struct irq_2_iommu *irq_2_iommu;
diff --git a/include/linux/random.h b/include/linux/random.h
index 5a376bc..1864957 100644
--- a/include/linux/random.h
+++ b/include/linux/random.h
@@ -44,8 +44,6 @@ struct rand_pool_info {
#ifdef __KERNEL__
-extern void rand_initialize_irq(int irq);
-
extern void add_device_randomness(const void *, unsigned int);
extern void add_input_randomness(unsigned int type, unsigned int code,
unsigned int value);
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index 46f10b1..9080985 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -652,22 +652,6 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new)
if (desc->chip == &no_irq_chip)
return -ENOSYS;
- /*
- * Some drivers like serial.c use request_irq() heavily,
- * so we have to be careful not to interfere with a
- * running system.
- */
- if (new->flags & IRQF_SAMPLE_RANDOM) {
- /*
- * This function might sleep, we want to call it first,
- * outside of the atomic block.
- * Yes, this might clear the entropy pool if the wrong
- * driver is attempted to be loaded, without actually
- * installing a new handler, but is this really a problem,
- * only the sysadmin is able to do this.
- */
- rand_initialize_irq(irq);
- }
/* Oneshot interrupts are not allowed with shared */
if ((new->flags & IRQF_ONESHOT) && (new->flags & IRQF_SHARED))
@@ -1040,7 +1024,6 @@ EXPORT_SYMBOL(free_irq);
*
* IRQF_SHARED Interrupt is shared
* IRQF_DISABLED Disable local interrupts while processing
- * IRQF_SAMPLE_RANDOM The interrupt can be used for entropy
* IRQF_TRIGGER_* Specify active edge(s) or level
*
*/
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 162/165] random: Add comment to random_initialize()
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (160 preceding siblings ...)
2012-08-15 19:48 ` [v2.6.34-stable 161/165] random: remove rand_initialize_irq() Paul Gortmaker
@ 2012-08-15 19:48 ` Paul Gortmaker
2012-08-15 19:48 ` [v2.6.34-stable 163/165] rtc: wm831x: Feed the write counter into device_add_randomness() Paul Gortmaker
` (2 subsequent siblings)
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:48 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Tony Luck, Theodore Ts'o, Paul Gortmaker
From: Tony Luck <tony.luck@intel.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit cbc96b7594b5691d61eba2db8b2ea723645be9ca upstream.
Many platforms have per-machine instance data (serial numbers,
asset tags, etc.) squirreled away in areas that are accessed
during early system bringup. Mixing this data into the random
pools has a very high value in providing better random data,
so we should allow (and even encourage) architecture code to
call add_device_randomness() from the setup_arch() paths.
However, this limits our options for internal structure of
the random driver since random_initialize() is not called
until long after setup_arch().
Add a big fat comment to rand_initialize() spelling out
this requirement.
Suggested-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Tony Luck <tony.luck@intel.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/char/random.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/char/random.c b/drivers/char/random.c
index 1644b8e..7e19406 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -1088,6 +1088,16 @@ static void init_std_data(struct entropy_store *r)
mix_pool_bytes(r, utsname(), sizeof(*(utsname())), NULL);
}
+/*
+ * Note that setup_arch() may call add_device_randomness()
+ * long before we get here. This allows seeding of the pools
+ * with some platform dependent data very early in the boot
+ * process. But it limits our options here. We must use
+ * statically allocated structures that already have all
+ * initializations complete at compile time. We should also
+ * take care not to overwrite the precious per platform data
+ * we were given.
+ */
static int rand_initialize(void)
{
init_std_data(&input_pool);
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 163/165] rtc: wm831x: Feed the write counter into device_add_randomness()
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (161 preceding siblings ...)
2012-08-15 19:48 ` [v2.6.34-stable 162/165] random: Add comment to random_initialize() Paul Gortmaker
@ 2012-08-15 19:48 ` Paul Gortmaker
2012-08-15 19:48 ` [v2.6.34-stable 164/165] mfd: wm831x: Feed the device UUID " Paul Gortmaker
2012-08-15 19:48 ` [v2.6.34-stable 165/165] dmi: Feed DMI table to /dev/random driver Paul Gortmaker
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:48 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Mark Brown, Theodore Ts'o, Paul Gortmaker
From: Mark Brown <broonie@opensource.wolfsonmicro.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 9dccf55f4cb011a7552a8a2749a580662f5ed8ed upstream.
The tamper evident features of the RTC include the "write counter" which
is a pseudo-random number regenerated whenever we set the RTC. Since this
value is unpredictable it should provide some useful seeding to the random
number generator.
Only do this on boot since the goal is to seed the pool rather than add
useful entropy.
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/rtc/rtc-wm831x.c | 24 +++++++++++++++++++++++-
1 file changed, 23 insertions(+), 1 deletion(-)
diff --git a/drivers/rtc/rtc-wm831x.c b/drivers/rtc/rtc-wm831x.c
index b16cfe5..dce35ed 100644
--- a/drivers/rtc/rtc-wm831x.c
+++ b/drivers/rtc/rtc-wm831x.c
@@ -24,7 +24,7 @@
#include <linux/mfd/wm831x/core.h>
#include <linux/delay.h>
#include <linux/platform_device.h>
-
+#include <linux/random.h>
/*
* R16416 (0x4020) - RTC Write Counter
@@ -96,6 +96,26 @@ struct wm831x_rtc {
unsigned int alarm_enabled:1;
};
+static void wm831x_rtc_add_randomness(struct wm831x *wm831x)
+{
+ int ret;
+ u16 reg;
+
+ /*
+ * The write counter contains a pseudo-random number which is
+ * regenerated every time we set the RTC so it should be a
+ * useful per-system source of entropy.
+ */
+ ret = wm831x_reg_read(wm831x, WM831X_RTC_WRITE_COUNTER);
+ if (ret >= 0) {
+ reg = ret;
+ add_device_randomness(®, sizeof(reg));
+ } else {
+ dev_warn(wm831x->dev, "Failed to read RTC write counter: %d\n",
+ ret);
+ }
+}
+
/*
* Read current time and date in RTC
*/
@@ -465,6 +485,8 @@ static int wm831x_rtc_probe(struct platform_device *pdev)
alm_irq, ret);
}
+ wm831x_rtc_add_randomness(wm831x);
+
return 0;
err:
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 164/165] mfd: wm831x: Feed the device UUID into device_add_randomness()
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (162 preceding siblings ...)
2012-08-15 19:48 ` [v2.6.34-stable 163/165] rtc: wm831x: Feed the write counter into device_add_randomness() Paul Gortmaker
@ 2012-08-15 19:48 ` Paul Gortmaker
2012-08-15 19:48 ` [v2.6.34-stable 165/165] dmi: Feed DMI table to /dev/random driver Paul Gortmaker
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:48 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Mark Brown, Theodore Ts'o, Paul Gortmaker
From: Mark Brown <broonie@opensource.wolfsonmicro.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit 27130f0cc3ab97560384da437e4621fc4e94f21c upstream.
wm831x devices contain a unique ID value. Feed this into the newly added
device_add_randomness() to add some per device seed data to the pool.
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/mfd/wm831x-otp.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/mfd/wm831x-otp.c b/drivers/mfd/wm831x-otp.c
index f742745..b90f3e0 100644
--- a/drivers/mfd/wm831x-otp.c
+++ b/drivers/mfd/wm831x-otp.c
@@ -18,6 +18,7 @@
#include <linux/bcd.h>
#include <linux/delay.h>
#include <linux/mfd/core.h>
+#include <linux/random.h>
#include <linux/mfd/wm831x/core.h>
#include <linux/mfd/wm831x/otp.h>
@@ -66,6 +67,7 @@ static DEVICE_ATTR(unique_id, 0444, wm831x_unique_id_show, NULL);
int wm831x_otp_init(struct wm831x *wm831x)
{
+ char uuid[WM831X_UNIQUE_ID_LEN];
int ret;
ret = device_create_file(wm831x->dev, &dev_attr_unique_id);
@@ -73,6 +75,12 @@ int wm831x_otp_init(struct wm831x *wm831x)
dev_err(wm831x->dev, "Unique ID attribute not created: %d\n",
ret);
+ ret = wm831x_unique_id_read(wm831x, uuid);
+ if (ret == 0)
+ add_device_randomness(uuid, sizeof(uuid));
+ else
+ dev_err(wm831x->dev, "Failed to read UUID: %d\n", ret);
+
return ret;
}
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread* [v2.6.34-stable 165/165] dmi: Feed DMI table to /dev/random driver
2012-08-15 19:45 [v2.6.34-stable 000/165] v2.6.34.13 longterm review Paul Gortmaker
` (163 preceding siblings ...)
2012-08-15 19:48 ` [v2.6.34-stable 164/165] mfd: wm831x: Feed the device UUID " Paul Gortmaker
@ 2012-08-15 19:48 ` Paul Gortmaker
164 siblings, 0 replies; 186+ messages in thread
From: Paul Gortmaker @ 2012-08-15 19:48 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: Tony Luck, Theodore Ts'o, Paul Gortmaker
From: Tony Luck <tony.luck@intel.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
If you see a problem with using this for longterm, please comment.
-------------------
commit d114a33387472555188f142ed8e98acdb8181c6d upstream.
Send the entire DMI (SMBIOS) table to the /dev/random driver to
help seed its pools.
Signed-off-by: Tony Luck <tony.luck@intel.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/firmware/dmi_scan.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
index d464672..1816d92 100644
--- a/drivers/firmware/dmi_scan.c
+++ b/drivers/firmware/dmi_scan.c
@@ -5,6 +5,7 @@
#include <linux/dmi.h>
#include <linux/efi.h>
#include <linux/bootmem.h>
+#include <linux/random.h>
#include <asm/dmi.h>
/*
@@ -110,6 +111,8 @@ static int __init dmi_walk_early(void (*decode)(const struct dmi_header *,
dmi_table(buf, dmi_len, dmi_num, decode, NULL);
+ add_device_randomness(buf, dmi_len);
+
dmi_iounmap(buf, dmi_len);
return 0;
}
--
1.7.12.rc2
^ permalink raw reply related [flat|nested] 186+ messages in thread