* [PATCH 4.4 02/96] s390/runtime instrumention: fix possible memory corruption
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
@ 2017-11-28 10:22 ` Greg Kroah-Hartman
2017-12-05 17:02 ` Ben Hutchings
2017-11-28 10:22 ` [PATCH 4.4 03/96] s390/disassembler: add missing end marker for e7 table Greg Kroah-Hartman
` (95 subsequent siblings)
96 siblings, 1 reply; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Christian Borntraeger,
Heiko Carstens, Martin Schwidefsky
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <heiko.carstens@de.ibm.com>
commit d6e646ad7cfa7034d280459b2b2546288f247144 upstream.
For PREEMPT enabled kernels the runtime instrumentation (RI) code
contains a possible use-after-free bug. If a task that makes use of RI
exits, it will execute do_exit() while still enabled for preemption.
That function will call exit_thread_runtime_instr() via
exit_thread(). If exit_thread_runtime_instr() gets preempted after the
RI control block of the task has been freed but before the pointer to
it is set to NULL, then save_ri_cb(), called from switch_to(), will
write to already freed memory.
Avoid this and simply disable preemption while freeing the control
block and setting the pointer to NULL.
Fixes: e4b8b3f33fca ("s390: add support for runtime instrumentation")
Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/kernel/runtime_instr.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/s390/kernel/runtime_instr.c
+++ b/arch/s390/kernel/runtime_instr.c
@@ -47,11 +47,13 @@ void exit_thread_runtime_instr(void)
{
struct task_struct *task = current;
+ preempt_disable();
if (!task->thread.ri_cb)
return;
disable_runtime_instr();
kfree(task->thread.ri_cb);
task->thread.ri_cb = NULL;
+ preempt_enable();
}
SYSCALL_DEFINE1(s390_runtime_instr, int, command)
@@ -62,9 +64,7 @@ SYSCALL_DEFINE1(s390_runtime_instr, int,
return -EOPNOTSUPP;
if (command == S390_RUNTIME_INSTR_STOP) {
- preempt_disable();
exit_thread_runtime_instr();
- preempt_enable();
return 0;
}
^ permalink raw reply [flat|nested] 124+ messages in thread* Re: [PATCH 4.4 02/96] s390/runtime instrumention: fix possible memory corruption
2017-11-28 10:22 ` [PATCH 4.4 02/96] s390/runtime instrumention: fix possible memory corruption Greg Kroah-Hartman
@ 2017-12-05 17:02 ` Ben Hutchings
2017-12-05 17:08 ` Greg Kroah-Hartman
0 siblings, 1 reply; 124+ messages in thread
From: Ben Hutchings @ 2017-12-05 17:02 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel
Cc: stable, Christian Borntraeger, Heiko Carstens, Martin Schwidefsky
On Tue, 2017-11-28 at 11:22 +0100, Greg Kroah-Hartman wrote:
> 4.4-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Heiko Carstens <heiko.carstens@de.ibm.com>
>
> commit d6e646ad7cfa7034d280459b2b2546288f247144 upstream.
[...]
> --- a/arch/s390/kernel/runtime_instr.c
> +++ b/arch/s390/kernel/runtime_instr.c
> @@ -47,11 +47,13 @@ void exit_thread_runtime_instr(void)
> {
> struct task_struct *task = current;
>
> + preempt_disable();
> if (!task->thread.ri_cb)
> return;
This return path now leaves preemption disabled. This seems to have
been fixed upstream by commit 8d9047f8b967 "s390/runtime
instrumentation: simplify task exit handling".
Ben.
> disable_runtime_instr();
> kfree(task->thread.ri_cb);
> task->thread.ri_cb = NULL;
> + preempt_enable();
> }
>
> SYSCALL_DEFINE1(s390_runtime_instr, int, command)
[...]
--
Ben Hutchings
Software Developer, Codethink Ltd.
^ permalink raw reply [flat|nested] 124+ messages in thread* Re: [PATCH 4.4 02/96] s390/runtime instrumention: fix possible memory corruption
2017-12-05 17:02 ` Ben Hutchings
@ 2017-12-05 17:08 ` Greg Kroah-Hartman
2017-12-05 18:15 ` Heiko Carstens
0 siblings, 1 reply; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-05 17:08 UTC (permalink / raw)
To: Ben Hutchings
Cc: linux-kernel, stable, Christian Borntraeger, Heiko Carstens,
Martin Schwidefsky
On Tue, Dec 05, 2017 at 05:02:32PM +0000, Ben Hutchings wrote:
> On Tue, 2017-11-28 at 11:22 +0100, Greg Kroah-Hartman wrote:
> > 4.4-stable review patch. If anyone has any objections, please let me know.
> >
> > ------------------
> >
> > From: Heiko Carstens <heiko.carstens@de.ibm.com>
> >
> > commit d6e646ad7cfa7034d280459b2b2546288f247144 upstream.
> [...]
> > --- a/arch/s390/kernel/runtime_instr.c
> > +++ b/arch/s390/kernel/runtime_instr.c
> > @@ -47,11 +47,13 @@ void exit_thread_runtime_instr(void)
> > {
> > struct task_struct *task = current;
> >
> > + preempt_disable();
> > if (!task->thread.ri_cb)
> > return;
>
> This return path now leaves preemption disabled. This seems to have
> been fixed upstream by commit 8d9047f8b967 "s390/runtime
> instrumentation: simplify task exit handling".
"simplify" doesn't seem to imply "fixes a bug" :)
Heiko, should I also queue this patch up?
thanks Ben for the review.
greg k-h
^ permalink raw reply [flat|nested] 124+ messages in thread* Re: [PATCH 4.4 02/96] s390/runtime instrumention: fix possible memory corruption
2017-12-05 17:08 ` Greg Kroah-Hartman
@ 2017-12-05 18:15 ` Heiko Carstens
2017-12-06 7:44 ` Greg Kroah-Hartman
0 siblings, 1 reply; 124+ messages in thread
From: Heiko Carstens @ 2017-12-05 18:15 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: Ben Hutchings, linux-kernel, stable, Christian Borntraeger,
Martin Schwidefsky
On Tue, Dec 05, 2017 at 06:08:47PM +0100, Greg Kroah-Hartman wrote:
> On Tue, Dec 05, 2017 at 05:02:32PM +0000, Ben Hutchings wrote:
> > On Tue, 2017-11-28 at 11:22 +0100, Greg Kroah-Hartman wrote:
> > > 4.4-stable review patch. If anyone has any objections, please let me know.
> > >
> > > ------------------
> > >
> > > From: Heiko Carstens <heiko.carstens@de.ibm.com>
> > >
> > > commit d6e646ad7cfa7034d280459b2b2546288f247144 upstream.
> > [...]
> > > --- a/arch/s390/kernel/runtime_instr.c
> > > +++ b/arch/s390/kernel/runtime_instr.c
> > > @@ -47,11 +47,13 @@ void exit_thread_runtime_instr(void)
> > > {
> > > struct task_struct *task = current;
> > >
> > > + preempt_disable();
> > > if (!task->thread.ri_cb)
> > > return;
> >
> > This return path now leaves preemption disabled. This seems to have
> > been fixed upstream by commit 8d9047f8b967 "s390/runtime
> > instrumentation: simplify task exit handling".
>
> "simplify" doesn't seem to imply "fixes a bug" :)
Indeed ;) That where two subsequent patches, but incorrectly split by me...
> Heiko, should I also queue this patch up?
Yes, please.
> thanks Ben for the review.
Thanks from me as well!
^ permalink raw reply [flat|nested] 124+ messages in thread* Re: [PATCH 4.4 02/96] s390/runtime instrumention: fix possible memory corruption
2017-12-05 18:15 ` Heiko Carstens
@ 2017-12-06 7:44 ` Greg Kroah-Hartman
2017-12-06 13:30 ` Heiko Carstens
2017-12-06 13:31 ` Heiko Carstens
0 siblings, 2 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-06 7:44 UTC (permalink / raw)
To: Heiko Carstens
Cc: Ben Hutchings, linux-kernel, stable, Christian Borntraeger,
Martin Schwidefsky
On Tue, Dec 05, 2017 at 07:15:34PM +0100, Heiko Carstens wrote:
> On Tue, Dec 05, 2017 at 06:08:47PM +0100, Greg Kroah-Hartman wrote:
> > On Tue, Dec 05, 2017 at 05:02:32PM +0000, Ben Hutchings wrote:
> > > On Tue, 2017-11-28 at 11:22 +0100, Greg Kroah-Hartman wrote:
> > > > 4.4-stable review patch. If anyone has any objections, please let me know.
> > > >
> > > > ------------------
> > > >
> > > > From: Heiko Carstens <heiko.carstens@de.ibm.com>
> > > >
> > > > commit d6e646ad7cfa7034d280459b2b2546288f247144 upstream.
> > > [...]
> > > > --- a/arch/s390/kernel/runtime_instr.c
> > > > +++ b/arch/s390/kernel/runtime_instr.c
> > > > @@ -47,11 +47,13 @@ void exit_thread_runtime_instr(void)
> > > > {
> > > > struct task_struct *task = current;
> > > >
> > > > + preempt_disable();
> > > > if (!task->thread.ri_cb)
> > > > return;
> > >
> > > This return path now leaves preemption disabled. This seems to have
> > > been fixed upstream by commit 8d9047f8b967 "s390/runtime
> > > instrumentation: simplify task exit handling".
> >
> > "simplify" doesn't seem to imply "fixes a bug" :)
>
> Indeed ;) That where two subsequent patches, but incorrectly split by me...
>
> > Heiko, should I also queue this patch up?
>
> Yes, please.
It doesn't apply to 4.9-stable or 4.4-stable, can you provide a working
backport?
thanks,
greg k-h
^ permalink raw reply [flat|nested] 124+ messages in thread* Re: [PATCH 4.4 02/96] s390/runtime instrumention: fix possible memory corruption
2017-12-06 7:44 ` Greg Kroah-Hartman
@ 2017-12-06 13:30 ` Heiko Carstens
2017-12-06 13:53 ` Greg Kroah-Hartman
2017-12-06 13:31 ` Heiko Carstens
1 sibling, 1 reply; 124+ messages in thread
From: Heiko Carstens @ 2017-12-06 13:30 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: Ben Hutchings, linux-kernel, stable, Christian Borntraeger,
Martin Schwidefsky
On Wed, Dec 06, 2017 at 08:44:53AM +0100, Greg Kroah-Hartman wrote:
> On Tue, Dec 05, 2017 at 07:15:34PM +0100, Heiko Carstens wrote:
> > On Tue, Dec 05, 2017 at 06:08:47PM +0100, Greg Kroah-Hartman wrote:
> > > On Tue, Dec 05, 2017 at 05:02:32PM +0000, Ben Hutchings wrote:
> > > > On Tue, 2017-11-28 at 11:22 +0100, Greg Kroah-Hartman wrote:
> > > > > 4.4-stable review patch. If anyone has any objections, please let me know.
> > > > >
> > > > > ------------------
> > > > >
> > > > > From: Heiko Carstens <heiko.carstens@de.ibm.com>
> > > > >
> > > > > commit d6e646ad7cfa7034d280459b2b2546288f247144 upstream.
> > > > [...]
> > > > > --- a/arch/s390/kernel/runtime_instr.c
> > > > > +++ b/arch/s390/kernel/runtime_instr.c
> > > > > @@ -47,11 +47,13 @@ void exit_thread_runtime_instr(void)
> > > > > {
> > > > > struct task_struct *task = current;
> > > > >
> > > > > + preempt_disable();
> > > > > if (!task->thread.ri_cb)
> > > > > return;
> > > >
> > > > This return path now leaves preemption disabled. This seems to have
> > > > been fixed upstream by commit 8d9047f8b967 "s390/runtime
> > > > instrumentation: simplify task exit handling".
> > >
> > > "simplify" doesn't seem to imply "fixes a bug" :)
> >
> > Indeed ;) That where two subsequent patches, but incorrectly split by me...
> >
> > > Heiko, should I also queue this patch up?
> >
> > Yes, please.
>
> It doesn't apply to 4.9-stable or 4.4-stable, can you provide a working
> backport?
Below is the patch against 4.4-stable:
>From e3cd188d023506d4a0045b9a2918b9fa73d4d007 Mon Sep 17 00:00:00 2001
From: Heiko Carstens <heiko.carstens@de.ibm.com>
Date: Mon, 11 Sep 2017 11:24:22 +0200
Subject: [PATCH] s390/runtime instrumentation: simplify task exit handling
commit 8d9047f8b967ce6181fd824ae922978e1b055cc0 upstream.
Free data structures required for runtime instrumentation from
arch_release_task_struct(). This allows to simplify the code a bit,
and also makes the semantics a bit easier: arch_release_task_struct()
is never called from the task that is being removed.
In addition this allows to get rid of exit_thread() in a later patch.
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
---
arch/s390/include/asm/runtime_instr.h | 4 +++-
arch/s390/kernel/process.c | 2 +-
arch/s390/kernel/runtime_instr.c | 30 +++++++++++++++---------------
3 files changed, 19 insertions(+), 17 deletions(-)
diff --git a/arch/s390/include/asm/runtime_instr.h b/arch/s390/include/asm/runtime_instr.h
index 402ad6df4897..c54a9310d814 100644
--- a/arch/s390/include/asm/runtime_instr.h
+++ b/arch/s390/include/asm/runtime_instr.h
@@ -85,6 +85,8 @@ static inline void restore_ri_cb(struct runtime_instr_cb *cb_next,
load_runtime_instr_cb(&runtime_instr_empty_cb);
}
-void exit_thread_runtime_instr(void);
+struct task_struct;
+
+void runtime_instr_release(struct task_struct *tsk);
#endif /* _RUNTIME_INSTR_H */
diff --git a/arch/s390/kernel/process.c b/arch/s390/kernel/process.c
index efa035a31b98..7bc4e4c5d5b8 100644
--- a/arch/s390/kernel/process.c
+++ b/arch/s390/kernel/process.c
@@ -72,7 +72,6 @@ extern void kernel_thread_starter(void);
*/
void exit_thread(void)
{
- exit_thread_runtime_instr();
}
void flush_thread(void)
@@ -87,6 +86,7 @@ void arch_release_task_struct(struct task_struct *tsk)
{
/* Free either the floating-point or the vector register save area */
kfree(tsk->thread.fpu.regs);
+ runtime_instr_release(tsk);
}
int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src)
diff --git a/arch/s390/kernel/runtime_instr.c b/arch/s390/kernel/runtime_instr.c
index 70cdb03d4acd..fd03a7569e10 100644
--- a/arch/s390/kernel/runtime_instr.c
+++ b/arch/s390/kernel/runtime_instr.c
@@ -18,11 +18,24 @@
/* empty control block to disable RI by loading it */
struct runtime_instr_cb runtime_instr_empty_cb;
+void runtime_instr_release(struct task_struct *tsk)
+{
+ kfree(tsk->thread.ri_cb);
+}
+
static void disable_runtime_instr(void)
{
- struct pt_regs *regs = task_pt_regs(current);
+ struct task_struct *task = current;
+ struct pt_regs *regs;
+ if (!task->thread.ri_cb)
+ return;
+ regs = task_pt_regs(task);
+ preempt_disable();
load_runtime_instr_cb(&runtime_instr_empty_cb);
+ kfree(task->thread.ri_cb);
+ task->thread.ri_cb = NULL;
+ preempt_enable();
/*
* Make sure the RI bit is deleted from the PSW. If the user did not
@@ -43,19 +56,6 @@ static void init_runtime_instr_cb(struct runtime_instr_cb *cb)
cb->valid = 1;
}
-void exit_thread_runtime_instr(void)
-{
- struct task_struct *task = current;
-
- preempt_disable();
- if (!task->thread.ri_cb)
- return;
- disable_runtime_instr();
- kfree(task->thread.ri_cb);
- task->thread.ri_cb = NULL;
- preempt_enable();
-}
-
SYSCALL_DEFINE1(s390_runtime_instr, int, command)
{
struct runtime_instr_cb *cb;
@@ -64,7 +64,7 @@ SYSCALL_DEFINE1(s390_runtime_instr, int, command)
return -EOPNOTSUPP;
if (command == S390_RUNTIME_INSTR_STOP) {
- exit_thread_runtime_instr();
+ disable_runtime_instr();
return 0;
}
--
2.13.5
^ permalink raw reply related [flat|nested] 124+ messages in thread* Re: [PATCH 4.4 02/96] s390/runtime instrumention: fix possible memory corruption
2017-12-06 13:30 ` Heiko Carstens
@ 2017-12-06 13:53 ` Greg Kroah-Hartman
0 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-06 13:53 UTC (permalink / raw)
To: Heiko Carstens
Cc: Ben Hutchings, linux-kernel, stable, Christian Borntraeger,
Martin Schwidefsky
On Wed, Dec 06, 2017 at 02:30:58PM +0100, Heiko Carstens wrote:
> On Wed, Dec 06, 2017 at 08:44:53AM +0100, Greg Kroah-Hartman wrote:
> > On Tue, Dec 05, 2017 at 07:15:34PM +0100, Heiko Carstens wrote:
> > > On Tue, Dec 05, 2017 at 06:08:47PM +0100, Greg Kroah-Hartman wrote:
> > > > On Tue, Dec 05, 2017 at 05:02:32PM +0000, Ben Hutchings wrote:
> > > > > On Tue, 2017-11-28 at 11:22 +0100, Greg Kroah-Hartman wrote:
> > > > > > 4.4-stable review patch. If anyone has any objections, please let me know.
> > > > > >
> > > > > > ------------------
> > > > > >
> > > > > > From: Heiko Carstens <heiko.carstens@de.ibm.com>
> > > > > >
> > > > > > commit d6e646ad7cfa7034d280459b2b2546288f247144 upstream.
> > > > > [...]
> > > > > > --- a/arch/s390/kernel/runtime_instr.c
> > > > > > +++ b/arch/s390/kernel/runtime_instr.c
> > > > > > @@ -47,11 +47,13 @@ void exit_thread_runtime_instr(void)
> > > > > > {
> > > > > > struct task_struct *task = current;
> > > > > >
> > > > > > + preempt_disable();
> > > > > > if (!task->thread.ri_cb)
> > > > > > return;
> > > > >
> > > > > This return path now leaves preemption disabled. This seems to have
> > > > > been fixed upstream by commit 8d9047f8b967 "s390/runtime
> > > > > instrumentation: simplify task exit handling".
> > > >
> > > > "simplify" doesn't seem to imply "fixes a bug" :)
> > >
> > > Indeed ;) That where two subsequent patches, but incorrectly split by me...
> > >
> > > > Heiko, should I also queue this patch up?
> > >
> > > Yes, please.
> >
> > It doesn't apply to 4.9-stable or 4.4-stable, can you provide a working
> > backport?
>
> Below is the patch against 4.4-stable:
This and the 4.9 patch now queued up, thanks.
greg k-h
^ permalink raw reply [flat|nested] 124+ messages in thread
* Re: [PATCH 4.4 02/96] s390/runtime instrumention: fix possible memory corruption
2017-12-06 7:44 ` Greg Kroah-Hartman
2017-12-06 13:30 ` Heiko Carstens
@ 2017-12-06 13:31 ` Heiko Carstens
1 sibling, 0 replies; 124+ messages in thread
From: Heiko Carstens @ 2017-12-06 13:31 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: Ben Hutchings, linux-kernel, stable, Christian Borntraeger,
Martin Schwidefsky
On Wed, Dec 06, 2017 at 08:44:53AM +0100, Greg Kroah-Hartman wrote:
> On Tue, Dec 05, 2017 at 07:15:34PM +0100, Heiko Carstens wrote:
> > On Tue, Dec 05, 2017 at 06:08:47PM +0100, Greg Kroah-Hartman wrote:
> > > On Tue, Dec 05, 2017 at 05:02:32PM +0000, Ben Hutchings wrote:
> > > > On Tue, 2017-11-28 at 11:22 +0100, Greg Kroah-Hartman wrote:
> > > > > 4.4-stable review patch. If anyone has any objections, please let me know.
> > > > >
> > > > > ------------------
> > > > >
> > > > > From: Heiko Carstens <heiko.carstens@de.ibm.com>
> > > > >
> > > > > commit d6e646ad7cfa7034d280459b2b2546288f247144 upstream.
> > > > [...]
> > > > > --- a/arch/s390/kernel/runtime_instr.c
> > > > > +++ b/arch/s390/kernel/runtime_instr.c
> > > > > @@ -47,11 +47,13 @@ void exit_thread_runtime_instr(void)
> > > > > {
> > > > > struct task_struct *task = current;
> > > > >
> > > > > + preempt_disable();
> > > > > if (!task->thread.ri_cb)
> > > > > return;
> > > >
> > > > This return path now leaves preemption disabled. This seems to have
> > > > been fixed upstream by commit 8d9047f8b967 "s390/runtime
> > > > instrumentation: simplify task exit handling".
> > >
> > > "simplify" doesn't seem to imply "fixes a bug" :)
> >
> > Indeed ;) That where two subsequent patches, but incorrectly split by me...
> >
> > > Heiko, should I also queue this patch up?
> >
> > Yes, please.
>
> It doesn't apply to 4.9-stable or 4.4-stable, can you provide a working
> backport?
And here the one for 4.9-stable:
>From 5d0ccf454464a0f06c637e7c2743ae610898cd47 Mon Sep 17 00:00:00 2001
From: Heiko Carstens <heiko.carstens@de.ibm.com>
Date: Mon, 11 Sep 2017 11:24:22 +0200
Subject: [PATCH] s390/runtime instrumentation: simplify task exit handling
commit 8d9047f8b967ce6181fd824ae922978e1b055cc0 upstream.
Free data structures required for runtime instrumentation from
arch_release_task_struct(). This allows to simplify the code a bit,
and also makes the semantics a bit easier: arch_release_task_struct()
is never called from the task that is being removed.
In addition this allows to get rid of exit_thread() in a later patch.
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
---
arch/s390/include/asm/runtime_instr.h | 4 +++-
arch/s390/kernel/process.c | 3 +--
arch/s390/kernel/runtime_instr.c | 30 +++++++++++++++---------------
3 files changed, 19 insertions(+), 18 deletions(-)
diff --git a/arch/s390/include/asm/runtime_instr.h b/arch/s390/include/asm/runtime_instr.h
index 402ad6df4897..c54a9310d814 100644
--- a/arch/s390/include/asm/runtime_instr.h
+++ b/arch/s390/include/asm/runtime_instr.h
@@ -85,6 +85,8 @@ static inline void restore_ri_cb(struct runtime_instr_cb *cb_next,
load_runtime_instr_cb(&runtime_instr_empty_cb);
}
-void exit_thread_runtime_instr(void);
+struct task_struct;
+
+void runtime_instr_release(struct task_struct *tsk);
#endif /* _RUNTIME_INSTR_H */
diff --git a/arch/s390/kernel/process.c b/arch/s390/kernel/process.c
index 172fe1121d99..8382fc62cde6 100644
--- a/arch/s390/kernel/process.c
+++ b/arch/s390/kernel/process.c
@@ -70,8 +70,6 @@ extern void kernel_thread_starter(void);
*/
void exit_thread(struct task_struct *tsk)
{
- if (tsk == current)
- exit_thread_runtime_instr();
}
void flush_thread(void)
@@ -84,6 +82,7 @@ void release_thread(struct task_struct *dead_task)
void arch_release_task_struct(struct task_struct *tsk)
{
+ runtime_instr_release(tsk);
}
int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src)
diff --git a/arch/s390/kernel/runtime_instr.c b/arch/s390/kernel/runtime_instr.c
index 70cdb03d4acd..fd03a7569e10 100644
--- a/arch/s390/kernel/runtime_instr.c
+++ b/arch/s390/kernel/runtime_instr.c
@@ -18,11 +18,24 @@
/* empty control block to disable RI by loading it */
struct runtime_instr_cb runtime_instr_empty_cb;
+void runtime_instr_release(struct task_struct *tsk)
+{
+ kfree(tsk->thread.ri_cb);
+}
+
static void disable_runtime_instr(void)
{
- struct pt_regs *regs = task_pt_regs(current);
+ struct task_struct *task = current;
+ struct pt_regs *regs;
+ if (!task->thread.ri_cb)
+ return;
+ regs = task_pt_regs(task);
+ preempt_disable();
load_runtime_instr_cb(&runtime_instr_empty_cb);
+ kfree(task->thread.ri_cb);
+ task->thread.ri_cb = NULL;
+ preempt_enable();
/*
* Make sure the RI bit is deleted from the PSW. If the user did not
@@ -43,19 +56,6 @@ static void init_runtime_instr_cb(struct runtime_instr_cb *cb)
cb->valid = 1;
}
-void exit_thread_runtime_instr(void)
-{
- struct task_struct *task = current;
-
- preempt_disable();
- if (!task->thread.ri_cb)
- return;
- disable_runtime_instr();
- kfree(task->thread.ri_cb);
- task->thread.ri_cb = NULL;
- preempt_enable();
-}
-
SYSCALL_DEFINE1(s390_runtime_instr, int, command)
{
struct runtime_instr_cb *cb;
@@ -64,7 +64,7 @@ SYSCALL_DEFINE1(s390_runtime_instr, int, command)
return -EOPNOTSUPP;
if (command == S390_RUNTIME_INSTR_STOP) {
- exit_thread_runtime_instr();
+ disable_runtime_instr();
return 0;
}
--
2.13.5
^ permalink raw reply related [flat|nested] 124+ messages in thread
* [PATCH 4.4 03/96] s390/disassembler: add missing end marker for e7 table
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
2017-11-28 10:22 ` [PATCH 4.4 02/96] s390/runtime instrumention: fix possible memory corruption Greg Kroah-Hartman
@ 2017-11-28 10:22 ` Greg Kroah-Hartman
2017-11-28 10:22 ` [PATCH 4.4 04/96] s390/disassembler: increase show_code buffer size Greg Kroah-Hartman
` (94 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Heiko Carstens, Martin Schwidefsky
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <heiko.carstens@de.ibm.com>
commit 5c50538752af7968f53924b22dede8ed4ce4cb3b upstream.
The e7 opcode table does not have an end marker. Hence when trying to
find an unknown e7 instruction the code will access memory behind the
table until it finds something that matches the opcode, or the kernel
crashes, whatever comes first.
This affects not only the in-kernel disassembler but also uprobes and
kprobes which refuse to set a probe on unknown instructions, and
therefore search the opcode tables to figure out if instructions are
known or not.
Fixes: 3585cb0280654 ("s390/disassembler: add vector instructions")
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/kernel/dis.c | 1 +
1 file changed, 1 insertion(+)
--- a/arch/s390/kernel/dis.c
+++ b/arch/s390/kernel/dis.c
@@ -1549,6 +1549,7 @@ static struct s390_insn opcode_e7[] = {
{ "vfsq", 0xce, INSTR_VRR_VV000MM },
{ "vfs", 0xe2, INSTR_VRR_VVV00MM },
{ "vftci", 0x4a, INSTR_VRI_VVIMM },
+ { "", 0, INSTR_INVALID }
};
static struct s390_insn opcode_eb[] = {
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 04/96] s390/disassembler: increase show_code buffer size
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
2017-11-28 10:22 ` [PATCH 4.4 02/96] s390/runtime instrumention: fix possible memory corruption Greg Kroah-Hartman
2017-11-28 10:22 ` [PATCH 4.4 03/96] s390/disassembler: add missing end marker for e7 table Greg Kroah-Hartman
@ 2017-11-28 10:22 ` Greg Kroah-Hartman
2017-11-28 10:22 ` [PATCH 4.4 05/96] ipv6: only call ip6_route_dev_notify() once for NETDEV_UNREGISTER Greg Kroah-Hartman
` (93 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Vasily Gorbik, Martin Schwidefsky
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasily Gorbik <gor@linux.vnet.ibm.com>
commit b192571d1ae375e0bbe0aa3ccfa1a3c3704454b9 upstream.
Current buffer size of 64 is too small. objdump shows that there are
instructions which would require up to 75 bytes buffer (with current
formating). 128 bytes "ought to be enough for anybody".
Also replaces 8 spaces with a single tab to reduce the memory footprint.
Fixes the following KASAN finding:
BUG: KASAN: stack-out-of-bounds in number+0x3fe/0x538
Write of size 1 at addr 000000005a4a75a0 by task bash/1282
CPU: 1 PID: 1282 Comm: bash Not tainted 4.14.0+ #215
Hardware name: IBM 2964 N96 702 (z/VM 6.4.0)
Call Trace:
([<000000000011eeb6>] show_stack+0x56/0x88)
[<0000000000e1ce1a>] dump_stack+0x15a/0x1b0
[<00000000004e2994>] print_address_description+0xf4/0x288
[<00000000004e2cf2>] kasan_report+0x13a/0x230
[<0000000000e38ae6>] number+0x3fe/0x538
[<0000000000e3dfe4>] vsnprintf+0x194/0x948
[<0000000000e3ea42>] sprintf+0xa2/0xb8
[<00000000001198dc>] print_insn+0x374/0x500
[<0000000000119346>] show_code+0x4ee/0x538
[<000000000011f234>] show_registers+0x34c/0x388
[<000000000011f2ae>] show_regs+0x3e/0xa8
[<000000000011f502>] die+0x1ea/0x2e8
[<0000000000138f0e>] do_no_context+0x106/0x168
[<0000000000139a1a>] do_protection_exception+0x4da/0x7d0
[<0000000000e55914>] pgm_check_handler+0x16c/0x1c0
[<000000000090639e>] sysrq_handle_crash+0x46/0x58
([<0000000000000007>] 0x7)
[<00000000009073fa>] __handle_sysrq+0x102/0x218
[<0000000000907c06>] write_sysrq_trigger+0xd6/0x100
[<000000000061d67a>] proc_reg_write+0xb2/0x128
[<0000000000520be6>] __vfs_write+0xee/0x368
[<0000000000521222>] vfs_write+0x21a/0x278
[<000000000052156a>] SyS_write+0xda/0x178
[<0000000000e555cc>] system_call+0xc4/0x270
The buggy address belongs to the page:
page:000003d1016929c0 count:0 mapcount:0 mapping: (null) index:0x0
flags: 0x0()
raw: 0000000000000000 0000000000000000 0000000000000000 ffffffff00000000
raw: 0000000000000100 0000000000000200 0000000000000000 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
000000005a4a7480: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1
000000005a4a7500: 00 00 00 00 00 00 00 00 f2 f2 f2 f2 00 00 00 00
>000000005a4a7580: 00 00 00 00 f3 f3 f3 f3 00 00 00 00 00 00 00 00
^
000000005a4a7600: 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 f8 f8
000000005a4a7680: f2 f2 f2 f2 f2 f2 f8 f8 f2 f2 f3 f3 f3 f3 00 00
==================================================================
Signed-off-by: Vasily Gorbik <gor@linux.vnet.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/kernel/dis.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/s390/kernel/dis.c
+++ b/arch/s390/kernel/dis.c
@@ -1962,7 +1962,7 @@ void show_code(struct pt_regs *regs)
{
char *mode = user_mode(regs) ? "User" : "Krnl";
unsigned char code[64];
- char buffer[64], *ptr;
+ char buffer[128], *ptr;
mm_segment_t old_fs;
unsigned long addr;
int start, end, opsize, hops, i;
@@ -2025,7 +2025,7 @@ void show_code(struct pt_regs *regs)
start += opsize;
printk(buffer);
ptr = buffer;
- ptr += sprintf(ptr, "\n ");
+ ptr += sprintf(ptr, "\n\t ");
hops++;
}
printk("\n");
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 05/96] ipv6: only call ip6_route_dev_notify() once for NETDEV_UNREGISTER
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (2 preceding siblings ...)
2017-11-28 10:22 ` [PATCH 4.4 04/96] s390/disassembler: increase show_code buffer size Greg Kroah-Hartman
@ 2017-11-28 10:22 ` Greg Kroah-Hartman
2017-11-28 10:22 ` [PATCH 4.4 06/96] AF_VSOCK: Shrink the area influenced by prepare_to_wait Greg Kroah-Hartman
` (92 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, jeffy, David Ahern, Cong Wang,
David S. Miller, Konstantin Khlebnikov
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: WANG Cong <xiyou.wangcong@gmail.com>
commit 76da0704507bbc51875013f6557877ab308cfd0a upstream.
In commit 242d3a49a2a1 ("ipv6: reorder ip6_route_dev_notifier after ipv6_dev_notf")
I assumed NETDEV_REGISTER and NETDEV_UNREGISTER are paired,
unfortunately, as reported by jeffy, netdev_wait_allrefs()
could rebroadcast NETDEV_UNREGISTER event until all refs are
gone.
We have to add an additional check to avoid this corner case.
For netdev_wait_allrefs() dev->reg_state is NETREG_UNREGISTERED,
for dev_change_net_namespace(), dev->reg_state is
NETREG_REGISTERED. So check for dev->reg_state != NETREG_UNREGISTERED.
Fixes: 242d3a49a2a1 ("ipv6: reorder ip6_route_dev_notifier after ipv6_dev_notf")
Reported-by: jeffy <jeffy.chen@rock-chips.com>
Cc: David Ahern <dsahern@gmail.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Acked-by: David Ahern <dsahern@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Cc: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv6/route.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -3378,7 +3378,11 @@ static int ip6_route_dev_notify(struct n
net->ipv6.ip6_blk_hole_entry->dst.dev = dev;
net->ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(dev);
#endif
- } else if (event == NETDEV_UNREGISTER) {
+ } else if (event == NETDEV_UNREGISTER &&
+ dev->reg_state != NETREG_UNREGISTERED) {
+ /* NETDEV_UNREGISTER could be fired for multiple times by
+ * netdev_wait_allrefs(). Make sure we only call this once.
+ */
in6_dev_put(net->ipv6.ip6_null_entry->rt6i_idev);
#ifdef CONFIG_IPV6_MULTIPLE_TABLES
in6_dev_put(net->ipv6.ip6_prohibit_entry->rt6i_idev);
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 06/96] AF_VSOCK: Shrink the area influenced by prepare_to_wait
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (3 preceding siblings ...)
2017-11-28 10:22 ` [PATCH 4.4 05/96] ipv6: only call ip6_route_dev_notify() once for NETDEV_UNREGISTER Greg Kroah-Hartman
@ 2017-11-28 10:22 ` Greg Kroah-Hartman
2017-11-28 10:22 ` [PATCH 4.4 07/96] vsock: use new wait API for vsock_stream_sendmsg() Greg Kroah-Hartman
` (91 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Claudio Imbrenda, David S. Miller,
Jorgen S. Hansen
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudio Imbrenda <imbrenda@linux.vnet.ibm.com>
commit f7f9b5e7f8eccfd68ffa7b8d74b07c478bb9e7f0 upstream.
When a thread is prepared for waiting by calling prepare_to_wait, sleeping
is not allowed until either the wait has taken place or finish_wait has
been called. The existing code in af_vsock imposed unnecessary no-sleep
assumptions to a broad list of backend functions.
This patch shrinks the influence of prepare_to_wait to the area where it
is strictly needed, therefore relaxing the no-sleep restriction there.
Signed-off-by: Claudio Imbrenda <imbrenda@linux.vnet.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Cc: "Jorgen S. Hansen" <jhansen@vmware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/vmw_vsock/af_vsock.c | 158 +++++++++++++++++++++++++----------------------
1 file changed, 85 insertions(+), 73 deletions(-)
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -1209,10 +1209,14 @@ static int vsock_stream_connect(struct s
if (signal_pending(current)) {
err = sock_intr_errno(timeout);
- goto out_wait_error;
+ sk->sk_state = SS_UNCONNECTED;
+ sock->state = SS_UNCONNECTED;
+ goto out_wait;
} else if (timeout == 0) {
err = -ETIMEDOUT;
- goto out_wait_error;
+ sk->sk_state = SS_UNCONNECTED;
+ sock->state = SS_UNCONNECTED;
+ goto out_wait;
}
prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
@@ -1220,20 +1224,17 @@ static int vsock_stream_connect(struct s
if (sk->sk_err) {
err = -sk->sk_err;
- goto out_wait_error;
- } else
+ sk->sk_state = SS_UNCONNECTED;
+ sock->state = SS_UNCONNECTED;
+ } else {
err = 0;
+ }
out_wait:
finish_wait(sk_sleep(sk), &wait);
out:
release_sock(sk);
return err;
-
-out_wait_error:
- sk->sk_state = SS_UNCONNECTED;
- sock->state = SS_UNCONNECTED;
- goto out_wait;
}
static int vsock_accept(struct socket *sock, struct socket *newsock, int flags)
@@ -1270,18 +1271,20 @@ static int vsock_accept(struct socket *s
listener->sk_err == 0) {
release_sock(listener);
timeout = schedule_timeout(timeout);
+ finish_wait(sk_sleep(listener), &wait);
lock_sock(listener);
if (signal_pending(current)) {
err = sock_intr_errno(timeout);
- goto out_wait;
+ goto out;
} else if (timeout == 0) {
err = -EAGAIN;
- goto out_wait;
+ goto out;
}
prepare_to_wait(sk_sleep(listener), &wait, TASK_INTERRUPTIBLE);
}
+ finish_wait(sk_sleep(listener), &wait);
if (listener->sk_err)
err = -listener->sk_err;
@@ -1301,19 +1304,15 @@ static int vsock_accept(struct socket *s
*/
if (err) {
vconnected->rejected = true;
- release_sock(connected);
- sock_put(connected);
- goto out_wait;
+ } else {
+ newsock->state = SS_CONNECTED;
+ sock_graft(connected, newsock);
}
- newsock->state = SS_CONNECTED;
- sock_graft(connected, newsock);
release_sock(connected);
sock_put(connected);
}
-out_wait:
- finish_wait(sk_sleep(listener), &wait);
out:
release_sock(listener);
return err;
@@ -1557,11 +1556,11 @@ static int vsock_stream_sendmsg(struct s
if (err < 0)
goto out;
- prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
while (total_written < len) {
ssize_t written;
+ prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
while (vsock_stream_has_space(vsk) == 0 &&
sk->sk_err == 0 &&
!(sk->sk_shutdown & SEND_SHUTDOWN) &&
@@ -1570,27 +1569,33 @@ static int vsock_stream_sendmsg(struct s
/* Don't wait for non-blocking sockets. */
if (timeout == 0) {
err = -EAGAIN;
- goto out_wait;
+ finish_wait(sk_sleep(sk), &wait);
+ goto out_err;
}
err = transport->notify_send_pre_block(vsk, &send_data);
- if (err < 0)
- goto out_wait;
+ if (err < 0) {
+ finish_wait(sk_sleep(sk), &wait);
+ goto out_err;
+ }
release_sock(sk);
timeout = schedule_timeout(timeout);
lock_sock(sk);
if (signal_pending(current)) {
err = sock_intr_errno(timeout);
- goto out_wait;
+ finish_wait(sk_sleep(sk), &wait);
+ goto out_err;
} else if (timeout == 0) {
err = -EAGAIN;
- goto out_wait;
+ finish_wait(sk_sleep(sk), &wait);
+ goto out_err;
}
prepare_to_wait(sk_sleep(sk), &wait,
TASK_INTERRUPTIBLE);
}
+ finish_wait(sk_sleep(sk), &wait);
/* These checks occur both as part of and after the loop
* conditional since we need to check before and after
@@ -1598,16 +1603,16 @@ static int vsock_stream_sendmsg(struct s
*/
if (sk->sk_err) {
err = -sk->sk_err;
- goto out_wait;
+ goto out_err;
} else if ((sk->sk_shutdown & SEND_SHUTDOWN) ||
(vsk->peer_shutdown & RCV_SHUTDOWN)) {
err = -EPIPE;
- goto out_wait;
+ goto out_err;
}
err = transport->notify_send_pre_enqueue(vsk, &send_data);
if (err < 0)
- goto out_wait;
+ goto out_err;
/* Note that enqueue will only write as many bytes as are free
* in the produce queue, so we don't need to ensure len is
@@ -1620,7 +1625,7 @@ static int vsock_stream_sendmsg(struct s
len - total_written);
if (written < 0) {
err = -ENOMEM;
- goto out_wait;
+ goto out_err;
}
total_written += written;
@@ -1628,14 +1633,13 @@ static int vsock_stream_sendmsg(struct s
err = transport->notify_send_post_enqueue(
vsk, written, &send_data);
if (err < 0)
- goto out_wait;
+ goto out_err;
}
-out_wait:
+out_err:
if (total_written > 0)
err = total_written;
- finish_wait(sk_sleep(sk), &wait);
out:
release_sock(sk);
return err;
@@ -1716,21 +1720,61 @@ vsock_stream_recvmsg(struct socket *sock
if (err < 0)
goto out;
- prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
while (1) {
- s64 ready = vsock_stream_has_data(vsk);
+ s64 ready;
- if (ready < 0) {
- /* Invalid queue pair content. XXX This should be
- * changed to a connection reset in a later change.
- */
+ prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
+ ready = vsock_stream_has_data(vsk);
- err = -ENOMEM;
- goto out_wait;
- } else if (ready > 0) {
+ if (ready == 0) {
+ if (sk->sk_err != 0 ||
+ (sk->sk_shutdown & RCV_SHUTDOWN) ||
+ (vsk->peer_shutdown & SEND_SHUTDOWN)) {
+ finish_wait(sk_sleep(sk), &wait);
+ break;
+ }
+ /* Don't wait for non-blocking sockets. */
+ if (timeout == 0) {
+ err = -EAGAIN;
+ finish_wait(sk_sleep(sk), &wait);
+ break;
+ }
+
+ err = transport->notify_recv_pre_block(
+ vsk, target, &recv_data);
+ if (err < 0) {
+ finish_wait(sk_sleep(sk), &wait);
+ break;
+ }
+ release_sock(sk);
+ timeout = schedule_timeout(timeout);
+ lock_sock(sk);
+
+ if (signal_pending(current)) {
+ err = sock_intr_errno(timeout);
+ finish_wait(sk_sleep(sk), &wait);
+ break;
+ } else if (timeout == 0) {
+ err = -EAGAIN;
+ finish_wait(sk_sleep(sk), &wait);
+ break;
+ }
+ } else {
ssize_t read;
+ finish_wait(sk_sleep(sk), &wait);
+
+ if (ready < 0) {
+ /* Invalid queue pair content. XXX This should
+ * be changed to a connection reset in a later
+ * change.
+ */
+
+ err = -ENOMEM;
+ goto out;
+ }
+
err = transport->notify_recv_pre_dequeue(
vsk, target, &recv_data);
if (err < 0)
@@ -1750,42 +1794,12 @@ vsock_stream_recvmsg(struct socket *sock
vsk, target, read,
!(flags & MSG_PEEK), &recv_data);
if (err < 0)
- goto out_wait;
+ goto out;
if (read >= target || flags & MSG_PEEK)
break;
target -= read;
- } else {
- if (sk->sk_err != 0 || (sk->sk_shutdown & RCV_SHUTDOWN)
- || (vsk->peer_shutdown & SEND_SHUTDOWN)) {
- break;
- }
- /* Don't wait for non-blocking sockets. */
- if (timeout == 0) {
- err = -EAGAIN;
- break;
- }
-
- err = transport->notify_recv_pre_block(
- vsk, target, &recv_data);
- if (err < 0)
- break;
-
- release_sock(sk);
- timeout = schedule_timeout(timeout);
- lock_sock(sk);
-
- if (signal_pending(current)) {
- err = sock_intr_errno(timeout);
- break;
- } else if (timeout == 0) {
- err = -EAGAIN;
- break;
- }
-
- prepare_to_wait(sk_sleep(sk), &wait,
- TASK_INTERRUPTIBLE);
}
}
@@ -1797,8 +1811,6 @@ vsock_stream_recvmsg(struct socket *sock
if (copied > 0)
err = copied;
-out_wait:
- finish_wait(sk_sleep(sk), &wait);
out:
release_sock(sk);
return err;
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 07/96] vsock: use new wait API for vsock_stream_sendmsg()
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (4 preceding siblings ...)
2017-11-28 10:22 ` [PATCH 4.4 06/96] AF_VSOCK: Shrink the area influenced by prepare_to_wait Greg Kroah-Hartman
@ 2017-11-28 10:22 ` Greg Kroah-Hartman
2017-11-28 10:22 ` [PATCH 4.4 08/96] sched: Make resched_cpu() unconditional Greg Kroah-Hartman
` (90 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Michal Kubecek, Stefan Hajnoczi,
Jorgen Hansen, Michael S. Tsirkin, Claudio Imbrenda, Cong Wang,
David S. Miller
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: WANG Cong <xiyou.wangcong@gmail.com>
commit 499fde662f1957e3cb8d192a94a099ebe19c714b upstream.
As reported by Michal, vsock_stream_sendmsg() could still
sleep at vsock_stream_has_space() after prepare_to_wait():
vsock_stream_has_space
vmci_transport_stream_has_space
vmci_qpair_produce_free_space
qp_lock
qp_acquire_queue_mutex
mutex_lock
Just switch to the new wait API like we did for commit
d9dc8b0f8b4e ("net: fix sleeping for sk_wait_event()").
Reported-by: Michal Kubecek <mkubecek@suse.cz>
Cc: Stefan Hajnoczi <stefanha@redhat.com>
Cc: Jorgen Hansen <jhansen@vmware.com>
Cc: "Michael S. Tsirkin" <mst@redhat.com>
Cc: Claudio Imbrenda <imbrenda@linux.vnet.ibm.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Cc: "Jorgen S. Hansen" <jhansen@vmware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/vmw_vsock/af_vsock.c | 21 ++++++++-------------
1 file changed, 8 insertions(+), 13 deletions(-)
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -1512,8 +1512,7 @@ static int vsock_stream_sendmsg(struct s
long timeout;
int err;
struct vsock_transport_send_notify_data send_data;
-
- DEFINE_WAIT(wait);
+ DEFINE_WAIT_FUNC(wait, woken_wake_function);
sk = sock->sk;
vsk = vsock_sk(sk);
@@ -1556,11 +1555,10 @@ static int vsock_stream_sendmsg(struct s
if (err < 0)
goto out;
-
while (total_written < len) {
ssize_t written;
- prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
+ add_wait_queue(sk_sleep(sk), &wait);
while (vsock_stream_has_space(vsk) == 0 &&
sk->sk_err == 0 &&
!(sk->sk_shutdown & SEND_SHUTDOWN) &&
@@ -1569,33 +1567,30 @@ static int vsock_stream_sendmsg(struct s
/* Don't wait for non-blocking sockets. */
if (timeout == 0) {
err = -EAGAIN;
- finish_wait(sk_sleep(sk), &wait);
+ remove_wait_queue(sk_sleep(sk), &wait);
goto out_err;
}
err = transport->notify_send_pre_block(vsk, &send_data);
if (err < 0) {
- finish_wait(sk_sleep(sk), &wait);
+ remove_wait_queue(sk_sleep(sk), &wait);
goto out_err;
}
release_sock(sk);
- timeout = schedule_timeout(timeout);
+ timeout = wait_woken(&wait, TASK_INTERRUPTIBLE, timeout);
lock_sock(sk);
if (signal_pending(current)) {
err = sock_intr_errno(timeout);
- finish_wait(sk_sleep(sk), &wait);
+ remove_wait_queue(sk_sleep(sk), &wait);
goto out_err;
} else if (timeout == 0) {
err = -EAGAIN;
- finish_wait(sk_sleep(sk), &wait);
+ remove_wait_queue(sk_sleep(sk), &wait);
goto out_err;
}
-
- prepare_to_wait(sk_sleep(sk), &wait,
- TASK_INTERRUPTIBLE);
}
- finish_wait(sk_sleep(sk), &wait);
+ remove_wait_queue(sk_sleep(sk), &wait);
/* These checks occur both as part of and after the loop
* conditional since we need to check before and after
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 08/96] sched: Make resched_cpu() unconditional
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (5 preceding siblings ...)
2017-11-28 10:22 ` [PATCH 4.4 07/96] vsock: use new wait API for vsock_stream_sendmsg() Greg Kroah-Hartman
@ 2017-11-28 10:22 ` Greg Kroah-Hartman
2017-11-28 10:22 ` [PATCH 4.4 09/96] lib/mpi: call cond_resched() from mpi_powm() loop Greg Kroah-Hartman
` (89 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Neeraj Upadhyay, Paul E. McKenney,
Steven Rostedt (VMware), Peter Zijlstra (Intel)
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
commit 7c2102e56a3f7d85b5d8f33efbd7aecc1f36fdd8 upstream.
The current implementation of synchronize_sched_expedited() incorrectly
assumes that resched_cpu() is unconditional, which it is not. This means
that synchronize_sched_expedited() can hang when resched_cpu()'s trylock
fails as follows (analysis by Neeraj Upadhyay):
o CPU1 is waiting for expedited wait to complete:
sync_rcu_exp_select_cpus
rdp->exp_dynticks_snap & 0x1 // returns 1 for CPU5
IPI sent to CPU5
synchronize_sched_expedited_wait
ret = swait_event_timeout(rsp->expedited_wq,
sync_rcu_preempt_exp_done(rnp_root),
jiffies_stall);
expmask = 0x20, CPU 5 in idle path (in cpuidle_enter())
o CPU5 handles IPI and fails to acquire rq lock.
Handles IPI
sync_sched_exp_handler
resched_cpu
returns while failing to try lock acquire rq->lock
need_resched is not set
o CPU5 calls rcu_idle_enter() and as need_resched is not set, goes to
idle (schedule() is not called).
o CPU 1 reports RCU stall.
Given that resched_cpu() is now used only by RCU, this commit fixes the
assumption by making resched_cpu() unconditional.
Reported-by: Neeraj Upadhyay <neeraju@codeaurora.org>
Suggested-by: Neeraj Upadhyay <neeraju@codeaurora.org>
Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Acked-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/sched/core.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -600,8 +600,7 @@ void resched_cpu(int cpu)
struct rq *rq = cpu_rq(cpu);
unsigned long flags;
- if (!raw_spin_trylock_irqsave(&rq->lock, flags))
- return;
+ raw_spin_lock_irqsave(&rq->lock, flags);
resched_curr(rq);
raw_spin_unlock_irqrestore(&rq->lock, flags);
}
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 09/96] lib/mpi: call cond_resched() from mpi_powm() loop
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (6 preceding siblings ...)
2017-11-28 10:22 ` [PATCH 4.4 08/96] sched: Make resched_cpu() unconditional Greg Kroah-Hartman
@ 2017-11-28 10:22 ` Greg Kroah-Hartman
2017-11-28 10:22 ` [PATCH 4.4 10/96] x86/decoder: Add new TEST instruction pattern Greg Kroah-Hartman
` (88 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:22 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Eric Biggers, Herbert Xu
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <ebiggers@google.com>
commit 1d9ddde12e3c9bab7f3d3484eb9446315e3571ca upstream.
On a non-preemptible kernel, if KEYCTL_DH_COMPUTE is called with the
largest permitted inputs (16384 bits), the kernel spends 10+ seconds
doing modular exponentiation in mpi_powm() without rescheduling. If all
threads do it, it locks up the system. Moreover, it can cause
rcu_sched-stall warnings.
Notwithstanding the insanity of doing this calculation in kernel mode
rather than in userspace, fix it by calling cond_resched() as each bit
from the exponent is processed. It's still noninterruptible, but at
least it's preemptible now.
Do the cond_resched() once per bit rather than once per MPI limb because
each limb might still easily take 100+ milliseconds on slow CPUs.
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
lib/mpi/mpi-pow.c | 2 ++
1 file changed, 2 insertions(+)
--- a/lib/mpi/mpi-pow.c
+++ b/lib/mpi/mpi-pow.c
@@ -26,6 +26,7 @@
* however I decided to publish this code under the plain GPL.
*/
+#include <linux/sched.h>
#include <linux/string.h>
#include "mpi-internal.h"
#include "longlong.h"
@@ -256,6 +257,7 @@ int mpi_powm(MPI res, MPI base, MPI exp,
}
e <<= 1;
c--;
+ cond_resched();
}
i--;
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 10/96] x86/decoder: Add new TEST instruction pattern
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (7 preceding siblings ...)
2017-11-28 10:22 ` [PATCH 4.4 09/96] lib/mpi: call cond_resched() from mpi_powm() loop Greg Kroah-Hartman
@ 2017-11-28 10:22 ` Greg Kroah-Hartman
2017-11-28 10:22 ` [PATCH 4.4 11/96] ARM: 8722/1: mm: make STRICT_KERNEL_RWX effective for LPAE Greg Kroah-Hartman
` (87 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, kbuild test robot, Masami Hiramatsu,
H. Peter Anvin, Linus Torvalds, Peter Zijlstra, Thomas Gleixner,
Ingo Molnar
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masami Hiramatsu <mhiramat@kernel.org>
commit 12a78d43de767eaf8fb272facb7a7b6f2dc6a9df upstream.
The kbuild test robot reported this build warning:
Warning: arch/x86/tools/test_get_len found difference at <jump_table>:ffffffff8103dd2c
Warning: ffffffff8103dd82: f6 09 d8 testb $0xd8,(%rcx)
Warning: objdump says 3 bytes, but insn_get_length() says 2
Warning: decoded and checked 1569014 instructions with 1 warnings
This sequence seems to be a new instruction not in the opcode map in the Intel SDM.
The instruction sequence is "F6 09 d8", means Group3(F6), MOD(00)REG(001)RM(001), and 0xd8.
Intel SDM vol2 A.4 Table A-6 said the table index in the group is "Encoding of Bits 5,4,3 of
the ModR/M Byte (bits 2,1,0 in parenthesis)"
In that table, opcodes listed by the index REG bits as:
000 001 010 011 100 101 110 111
TEST Ib/Iz,(undefined),NOT,NEG,MUL AL/rAX,IMUL AL/rAX,DIV AL/rAX,IDIV AL/rAX
So, it seems TEST Ib is assigned to 001.
Add the new pattern.
Reported-by: kbuild test robot <fengguang.wu@intel.com>
Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/lib/x86-opcode-map.txt | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/x86/lib/x86-opcode-map.txt
+++ b/arch/x86/lib/x86-opcode-map.txt
@@ -833,7 +833,7 @@ EndTable
GrpTable: Grp3_1
0: TEST Eb,Ib
-1:
+1: TEST Eb,Ib
2: NOT Eb
3: NEG Eb
4: MUL AL,Eb
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 11/96] ARM: 8722/1: mm: make STRICT_KERNEL_RWX effective for LPAE
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (8 preceding siblings ...)
2017-11-28 10:22 ` [PATCH 4.4 10/96] x86/decoder: Add new TEST instruction pattern Greg Kroah-Hartman
@ 2017-11-28 10:22 ` Greg Kroah-Hartman
2017-11-28 10:22 ` [PATCH 4.4 12/96] ARM: 8721/1: mm: dump: check hardware RO bit " Greg Kroah-Hartman
` (86 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Philip Derrin, Neil Dick,
Laura Abbott, Kees Cook, Russell King
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Philip Derrin <philip@cog.systems>
commit 400eeffaffc7232c0ae1134fe04e14ae4fb48d8c upstream.
Currently, for ARM kernels with CONFIG_ARM_LPAE and
CONFIG_STRICT_KERNEL_RWX enabled, the 2MiB pages mapping the
kernel code and rodata are writable. They are marked read-only in
a software bit (L_PMD_SECT_RDONLY) but the hardware read-only bit
is not set (PMD_SECT_AP2).
For user mappings, the logic that propagates the software bit
to the hardware bit is in set_pmd_at(); but for the kernel,
section_update() writes the PMDs directly, skipping this logic.
The fix is to set PMD_SECT_AP2 for read-only sections in
section_update(), at the same time as L_PMD_SECT_RDONLY.
Fixes: 1e3479225acb ("ARM: 8275/1: mm: fix PMD_SECT_RDONLY undeclared compile error")
Signed-off-by: Philip Derrin <philip@cog.systems>
Reported-by: Neil Dick <neil@cog.systems>
Tested-by: Neil Dick <neil@cog.systems>
Tested-by: Laura Abbott <labbott@redhat.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/mm/init.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/arm/mm/init.c
+++ b/arch/arm/mm/init.c
@@ -611,8 +611,8 @@ static struct section_perm ro_perms[] =
.start = (unsigned long)_stext,
.end = (unsigned long)__init_begin,
#ifdef CONFIG_ARM_LPAE
- .mask = ~L_PMD_SECT_RDONLY,
- .prot = L_PMD_SECT_RDONLY,
+ .mask = ~(L_PMD_SECT_RDONLY | PMD_SECT_AP2),
+ .prot = L_PMD_SECT_RDONLY | PMD_SECT_AP2,
#else
.mask = ~(PMD_SECT_APX | PMD_SECT_AP_WRITE),
.prot = PMD_SECT_APX | PMD_SECT_AP_WRITE,
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 12/96] ARM: 8721/1: mm: dump: check hardware RO bit for LPAE
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (9 preceding siblings ...)
2017-11-28 10:22 ` [PATCH 4.4 11/96] ARM: 8722/1: mm: make STRICT_KERNEL_RWX effective for LPAE Greg Kroah-Hartman
@ 2017-11-28 10:22 ` Greg Kroah-Hartman
2017-11-28 10:22 ` [PATCH 4.4 13/96] MIPS: ralink: Fix MT7628 pinmux Greg Kroah-Hartman
` (85 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Philip Derrin, Neil Dick, Kees Cook,
Russell King
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Philip Derrin <philip@cog.systems>
commit 3b0c0c922ff4be275a8beb87ce5657d16f355b54 upstream.
When CONFIG_ARM_LPAE is set, the PMD dump relies on the software
read-only bit to determine whether a page is writable. This
concealed a bug which left the kernel text section writable
(AP2=0) while marked read-only in the software bit.
In a kernel with the AP2 bug, the dump looks like this:
---[ Kernel Mapping ]---
0xc0000000-0xc0200000 2M RW NX SHD
0xc0200000-0xc0600000 4M ro x SHD
0xc0600000-0xc0800000 2M ro NX SHD
0xc0800000-0xc4800000 64M RW NX SHD
The fix is to check that the software and hardware bits are both
set before displaying "ro". The dump then shows the true perms:
---[ Kernel Mapping ]---
0xc0000000-0xc0200000 2M RW NX SHD
0xc0200000-0xc0600000 4M RW x SHD
0xc0600000-0xc0800000 2M RW NX SHD
0xc0800000-0xc4800000 64M RW NX SHD
Fixes: ded947798469 ("ARM: 8109/1: mm: Modify pte_write and pmd_write logic for LPAE")
Signed-off-by: Philip Derrin <philip@cog.systems>
Tested-by: Neil Dick <neil@cog.systems>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/mm/dump.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/arm/mm/dump.c
+++ b/arch/arm/mm/dump.c
@@ -126,8 +126,8 @@ static const struct prot_bits section_bi
.val = PMD_SECT_USER,
.set = "USR",
}, {
- .mask = L_PMD_SECT_RDONLY,
- .val = L_PMD_SECT_RDONLY,
+ .mask = L_PMD_SECT_RDONLY | PMD_SECT_AP2,
+ .val = L_PMD_SECT_RDONLY | PMD_SECT_AP2,
.set = "ro",
.clear = "RW",
#elif __LINUX_ARM_ARCH__ >= 6
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 13/96] MIPS: ralink: Fix MT7628 pinmux
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (10 preceding siblings ...)
2017-11-28 10:22 ` [PATCH 4.4 12/96] ARM: 8721/1: mm: dump: check hardware RO bit " Greg Kroah-Hartman
@ 2017-11-28 10:22 ` Greg Kroah-Hartman
2017-11-28 10:22 ` [PATCH 4.4 14/96] MIPS: ralink: Fix typo in mt7628 pinmux function Greg Kroah-Hartman
` (84 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mathias Kresin, John Crispin,
Ralf Baechle, linux-mips, James Hogan
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Kresin <dev@kresin.me>
commit 8ef4b43cd3794d63052d85898e42424fd3b14d24 upstream.
According to the datasheet the REFCLK pin is shared with GPIO#37 and
the PERST pin is shared with GPIO#36.
Fixes: 53263a1c6852 ("MIPS: ralink: add mt7628an support")
Signed-off-by: Mathias Kresin <dev@kresin.me>
Acked-by: John Crispin <john@phrozen.org>
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/16046/
Signed-off-by: James Hogan <jhogan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/mips/ralink/mt7620.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/mips/ralink/mt7620.c
+++ b/arch/mips/ralink/mt7620.c
@@ -141,8 +141,8 @@ static struct rt2880_pmx_func i2c_grp_mt
FUNC("i2c", 0, 4, 2),
};
-static struct rt2880_pmx_func refclk_grp_mt7628[] = { FUNC("reclk", 0, 36, 1) };
-static struct rt2880_pmx_func perst_grp_mt7628[] = { FUNC("perst", 0, 37, 1) };
+static struct rt2880_pmx_func refclk_grp_mt7628[] = { FUNC("reclk", 0, 37, 1) };
+static struct rt2880_pmx_func perst_grp_mt7628[] = { FUNC("perst", 0, 36, 1) };
static struct rt2880_pmx_func wdt_grp_mt7628[] = { FUNC("wdt", 0, 38, 1) };
static struct rt2880_pmx_func spi_grp_mt7628[] = { FUNC("spi", 0, 7, 4) };
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 14/96] MIPS: ralink: Fix typo in mt7628 pinmux function
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (11 preceding siblings ...)
2017-11-28 10:22 ` [PATCH 4.4 13/96] MIPS: ralink: Fix MT7628 pinmux Greg Kroah-Hartman
@ 2017-11-28 10:22 ` Greg Kroah-Hartman
2017-11-28 10:22 ` [PATCH 4.4 15/96] ALSA: hda: Add Raven PCI ID Greg Kroah-Hartman
` (83 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mathias Kresin, John Crispin,
Ralf Baechle, linux-mips, James Hogan
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Kresin <dev@kresin.me>
commit 05a67cc258e75ac9758e6f13d26337b8be51162a upstream.
There is a typo inside the pinmux setup code. The function is called
refclk and not reclk.
Fixes: 53263a1c6852 ("MIPS: ralink: add mt7628an support")
Signed-off-by: Mathias Kresin <dev@kresin.me>
Acked-by: John Crispin <john@phrozen.org>
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/16047/
Signed-off-by: James Hogan <jhogan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/mips/ralink/mt7620.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/mips/ralink/mt7620.c
+++ b/arch/mips/ralink/mt7620.c
@@ -141,7 +141,7 @@ static struct rt2880_pmx_func i2c_grp_mt
FUNC("i2c", 0, 4, 2),
};
-static struct rt2880_pmx_func refclk_grp_mt7628[] = { FUNC("reclk", 0, 37, 1) };
+static struct rt2880_pmx_func refclk_grp_mt7628[] = { FUNC("refclk", 0, 37, 1) };
static struct rt2880_pmx_func perst_grp_mt7628[] = { FUNC("perst", 0, 36, 1) };
static struct rt2880_pmx_func wdt_grp_mt7628[] = { FUNC("wdt", 0, 38, 1) };
static struct rt2880_pmx_func spi_grp_mt7628[] = { FUNC("spi", 0, 7, 4) };
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 15/96] ALSA: hda: Add Raven PCI ID
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (12 preceding siblings ...)
2017-11-28 10:22 ` [PATCH 4.4 14/96] MIPS: ralink: Fix typo in mt7628 pinmux function Greg Kroah-Hartman
@ 2017-11-28 10:22 ` Greg Kroah-Hartman
2017-11-28 10:22 ` [PATCH 4.4 16/96] dm bufio: fix integer overflow when limiting maximum cache size Greg Kroah-Hartman
` (82 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:22 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Vijendar Mukunda, Takashi Iwai
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vijendar Mukunda <Vijendar.Mukunda@amd.com>
commit 9ceace3c9c18c67676e75141032a65a8e01f9a7a upstream.
This commit adds PCI ID for Raven platform
Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda@amd.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/hda_intel.c | 3 +++
1 file changed, 3 insertions(+)
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -2316,6 +2316,9 @@ static const struct pci_device_id azx_id
/* AMD Hudson */
{ PCI_DEVICE(0x1022, 0x780d),
.driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB },
+ /* AMD Raven */
+ { PCI_DEVICE(0x1022, 0x15e3),
+ .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB },
/* ATI HDMI */
{ PCI_DEVICE(0x1002, 0x0002),
.driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 16/96] dm bufio: fix integer overflow when limiting maximum cache size
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (13 preceding siblings ...)
2017-11-28 10:22 ` [PATCH 4.4 15/96] ALSA: hda: Add Raven PCI ID Greg Kroah-Hartman
@ 2017-11-28 10:22 ` Greg Kroah-Hartman
2017-11-28 10:22 ` [PATCH 4.4 17/96] dm: fix race between dm_get_from_kobject() and __dm_destroy() Greg Kroah-Hartman
` (81 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:22 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Eric Biggers, Mike Snitzer
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <ebiggers@google.com>
commit 74d4108d9e681dbbe4a2940ed8fdff1f6868184c upstream.
The default max_cache_size_bytes for dm-bufio is meant to be the lesser
of 25% of the size of the vmalloc area and 2% of the size of lowmem.
However, on 32-bit systems the intermediate result in the expression
(VMALLOC_END - VMALLOC_START) * DM_BUFIO_VMALLOC_PERCENT / 100
overflows, causing the wrong result to be computed. For example, on a
32-bit system where the vmalloc area is 520093696 bytes, the result is
1174405 rather than the expected 130023424, which makes the maximum
cache size much too small (far less than 2% of lowmem). This causes
severe performance problems for dm-verity users on affected systems.
Fix this by using mult_frac() to correctly multiply by a percentage. Do
this for all places in dm-bufio that multiply by a percentage. Also
replace (VMALLOC_END - VMALLOC_START) with VMALLOC_TOTAL, which contrary
to the comment is now defined in include/linux/vmalloc.h.
Depends-on: 9993bc635 ("sched/x86: Fix overflow in cyc2ns_offset")
Fixes: 95d402f057f2 ("dm: add bufio")
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-bufio.c | 15 ++++++---------
1 file changed, 6 insertions(+), 9 deletions(-)
--- a/drivers/md/dm-bufio.c
+++ b/drivers/md/dm-bufio.c
@@ -928,7 +928,8 @@ static void __get_memory_limit(struct dm
buffers = c->minimum_buffers;
*limit_buffers = buffers;
- *threshold_buffers = buffers * DM_BUFIO_WRITEBACK_PERCENT / 100;
+ *threshold_buffers = mult_frac(buffers,
+ DM_BUFIO_WRITEBACK_PERCENT, 100);
}
/*
@@ -1829,19 +1830,15 @@ static int __init dm_bufio_init(void)
memset(&dm_bufio_caches, 0, sizeof dm_bufio_caches);
memset(&dm_bufio_cache_names, 0, sizeof dm_bufio_cache_names);
- mem = (__u64)((totalram_pages - totalhigh_pages) *
- DM_BUFIO_MEMORY_PERCENT / 100) << PAGE_SHIFT;
+ mem = (__u64)mult_frac(totalram_pages - totalhigh_pages,
+ DM_BUFIO_MEMORY_PERCENT, 100) << PAGE_SHIFT;
if (mem > ULONG_MAX)
mem = ULONG_MAX;
#ifdef CONFIG_MMU
- /*
- * Get the size of vmalloc space the same way as VMALLOC_TOTAL
- * in fs/proc/internal.h
- */
- if (mem > (VMALLOC_END - VMALLOC_START) * DM_BUFIO_VMALLOC_PERCENT / 100)
- mem = (VMALLOC_END - VMALLOC_START) * DM_BUFIO_VMALLOC_PERCENT / 100;
+ if (mem > mult_frac(VMALLOC_TOTAL, DM_BUFIO_VMALLOC_PERCENT, 100))
+ mem = mult_frac(VMALLOC_TOTAL, DM_BUFIO_VMALLOC_PERCENT, 100);
#endif
dm_bufio_default_cache_size = mem;
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 17/96] dm: fix race between dm_get_from_kobject() and __dm_destroy()
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (14 preceding siblings ...)
2017-11-28 10:22 ` [PATCH 4.4 16/96] dm bufio: fix integer overflow when limiting maximum cache size Greg Kroah-Hartman
@ 2017-11-28 10:22 ` Greg Kroah-Hartman
2017-11-28 10:22 ` [PATCH 4.4 18/96] MIPS: Fix an n32 core file generation regset support regression Greg Kroah-Hartman
` (80 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:22 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Hou Tao, Mike Snitzer
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hou Tao <houtao1@huawei.com>
commit b9a41d21dceadf8104812626ef85dc56ee8a60ed upstream.
The following BUG_ON was hit when testing repeat creation and removal of
DM devices:
kernel BUG at drivers/md/dm.c:2919!
CPU: 7 PID: 750 Comm: systemd-udevd Not tainted 4.1.44
Call Trace:
[<ffffffff81649e8b>] dm_get_from_kobject+0x34/0x3a
[<ffffffff81650ef1>] dm_attr_show+0x2b/0x5e
[<ffffffff817b46d1>] ? mutex_lock+0x26/0x44
[<ffffffff811df7f5>] sysfs_kf_seq_show+0x83/0xcf
[<ffffffff811de257>] kernfs_seq_show+0x23/0x25
[<ffffffff81199118>] seq_read+0x16f/0x325
[<ffffffff811de994>] kernfs_fop_read+0x3a/0x13f
[<ffffffff8117b625>] __vfs_read+0x26/0x9d
[<ffffffff8130eb59>] ? security_file_permission+0x3c/0x44
[<ffffffff8117bdb8>] ? rw_verify_area+0x83/0xd9
[<ffffffff8117be9d>] vfs_read+0x8f/0xcf
[<ffffffff81193e34>] ? __fdget_pos+0x12/0x41
[<ffffffff8117c686>] SyS_read+0x4b/0x76
[<ffffffff817b606e>] system_call_fastpath+0x12/0x71
The bug can be easily triggered, if an extra delay (e.g. 10ms) is added
between the test of DMF_FREEING & DMF_DELETING and dm_get() in
dm_get_from_kobject().
To fix it, we need to ensure the test of DMF_FREEING & DMF_DELETING and
dm_get() are done in an atomic way, so _minor_lock is used.
The other callers of dm_get() have also been checked to be OK: some
callers invoke dm_get() under _minor_lock, some callers invoke it under
_hash_lock, and dm_start_request() invoke it after increasing
md->open_count.
Signed-off-by: Hou Tao <houtao1@huawei.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -3507,11 +3507,15 @@ struct mapped_device *dm_get_from_kobjec
md = container_of(kobj, struct mapped_device, kobj_holder.kobj);
- if (test_bit(DMF_FREEING, &md->flags) ||
- dm_deleting_md(md))
- return NULL;
-
+ spin_lock(&_minor_lock);
+ if (test_bit(DMF_FREEING, &md->flags) || dm_deleting_md(md)) {
+ md = NULL;
+ goto out;
+ }
dm_get(md);
+out:
+ spin_unlock(&_minor_lock);
+
return md;
}
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 18/96] MIPS: Fix an n32 core file generation regset support regression
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (15 preceding siblings ...)
2017-11-28 10:22 ` [PATCH 4.4 17/96] dm: fix race between dm_get_from_kobject() and __dm_destroy() Greg Kroah-Hartman
@ 2017-11-28 10:22 ` Greg Kroah-Hartman
2017-11-28 10:22 ` [PATCH 4.4 20/96] autofs: dont fail mount for transient error Greg Kroah-Hartman
` (79 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Maciej W. Rozycki, Ralf Baechle,
Djordje Todorovic, linux-mips, James Hogan
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej W. Rozycki <macro@mips.com>
commit 547da673173de51f73887377eb275304775064ad upstream.
Fix a commit 7aeb753b5353 ("MIPS: Implement task_user_regset_view.")
regression, then activated by commit 6a9c001b7ec3 ("MIPS: Switch ELF
core dumper to use regsets.)", that caused n32 processes to dump o32
core files by failing to set the EF_MIPS_ABI2 flag in the ELF core file
header's `e_flags' member:
$ file tls-core
tls-core: ELF 32-bit MSB executable, MIPS, N32 MIPS64 rel2 version 1 (SYSV), [...]
$ ./tls-core
Aborted (core dumped)
$ file core
core: ELF 32-bit MSB core file MIPS, MIPS-I version 1 (SYSV), SVR4-style
$
Previously the flag was set as the result of a:
statement placed in arch/mips/kernel/binfmt_elfn32.c, however in the
regset case, i.e. when CORE_DUMP_USE_REGSET is set, ELF_CORE_EFLAGS is
no longer used by `fill_note_info' in fs/binfmt_elf.c, and instead the
`->e_flags' member of the regset view chosen is. We have the views
defined in arch/mips/kernel/ptrace.c, however only an o32 and an n64
one, and the latter is used for n32 as well. Consequently an o32 core
file is incorrectly dumped from n32 processes (the ELF32 vs ELF64 class
is chosen elsewhere, and the 32-bit one is correctly selected for n32).
Correct the issue then by defining an n32 regset view and using it as
appropriate. Issue discovered in GDB testing.
Fixes: 7aeb753b5353 ("MIPS: Implement task_user_regset_view.")
Signed-off-by: Maciej W. Rozycki <macro@mips.com>
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: Djordje Todorovic <djordje.todorovic@rt-rk.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/17617/
Signed-off-by: James Hogan <jhogan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/mips/kernel/ptrace.c | 17 +++++++++++++++++
1 file changed, 17 insertions(+)
--- a/arch/mips/kernel/ptrace.c
+++ b/arch/mips/kernel/ptrace.c
@@ -650,6 +650,19 @@ static const struct user_regset_view use
.n = ARRAY_SIZE(mips64_regsets),
};
+#ifdef CONFIG_MIPS32_N32
+
+static const struct user_regset_view user_mipsn32_view = {
+ .name = "mipsn32",
+ .e_flags = EF_MIPS_ABI2,
+ .e_machine = ELF_ARCH,
+ .ei_osabi = ELF_OSABI,
+ .regsets = mips64_regsets,
+ .n = ARRAY_SIZE(mips64_regsets),
+};
+
+#endif /* CONFIG_MIPS32_N32 */
+
#endif /* CONFIG_64BIT */
const struct user_regset_view *task_user_regset_view(struct task_struct *task)
@@ -661,6 +674,10 @@ const struct user_regset_view *task_user
if (test_tsk_thread_flag(task, TIF_32BIT_REGS))
return &user_mips_view;
#endif
+#ifdef CONFIG_MIPS32_N32
+ if (test_tsk_thread_flag(task, TIF_32BIT_ADDR))
+ return &user_mipsn32_view;
+#endif
return &user_mips64_view;
#endif
}
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 20/96] autofs: dont fail mount for transient error
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (16 preceding siblings ...)
2017-11-28 10:22 ` [PATCH 4.4 18/96] MIPS: Fix an n32 core file generation regset support regression Greg Kroah-Hartman
@ 2017-11-28 10:22 ` Greg Kroah-Hartman
2017-12-05 21:59 ` Ben Hutchings
2017-11-28 10:22 ` [PATCH 4.4 21/96] nilfs2: fix race condition that causes file system corruption Greg Kroah-Hartman
` (78 subsequent siblings)
96 siblings, 1 reply; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, NeilBrown, Ian Kent, Andrew Morton,
Linus Torvalds
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <neilb@suse.com>
commit ecc0c469f27765ed1e2b967be0aa17cee1a60b76 upstream.
Currently if the autofs kernel module gets an error when writing to the
pipe which links to the daemon, then it marks the whole moutpoint as
catatonic, and it will stop working.
It is possible that the error is transient. This can happen if the
daemon is slow and more than 16 requests queue up. If a subsequent
process tries to queue a request, and is then signalled, the write to
the pipe will return -ERESTARTSYS and autofs will take that as total
failure.
So change the code to assess -ERESTARTSYS and -ENOMEM as transient
failures which only abort the current request, not the whole mountpoint.
It isn't a crash or a data corruption, but having autofs mountpoints
suddenly stop working is rather inconvenient.
Ian said:
: And given the problems with a half dozen (or so) user space applications
: consuming large amounts of CPU under heavy mount and umount activity this
: could happen more easily than we expect.
Link: http://lkml.kernel.org/r/87y3norvgp.fsf@notabene.neil.brown.name
Signed-off-by: NeilBrown <neilb@suse.com>
Acked-by: Ian Kent <raven@themaw.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/autofs4/waitq.c | 15 ++++++++++++++-
1 file changed, 14 insertions(+), 1 deletion(-)
--- a/fs/autofs4/waitq.c
+++ b/fs/autofs4/waitq.c
@@ -87,7 +87,8 @@ static int autofs4_write(struct autofs_s
spin_unlock_irqrestore(¤t->sighand->siglock, flags);
}
- return (bytes > 0);
+ /* if 'wr' returned 0 (impossible) we assume -EIO (safe) */
+ return bytes == 0 ? 0 : wr < 0 ? wr : -EIO;
}
static void autofs4_notify_daemon(struct autofs_sb_info *sbi,
@@ -101,6 +102,7 @@ static void autofs4_notify_daemon(struct
} pkt;
struct file *pipe = NULL;
size_t pktsz;
+ int ret;
DPRINTK("wait id = 0x%08lx, name = %.*s, type=%d",
(unsigned long) wq->wait_queue_token, wq->name.len, wq->name.name, type);
@@ -173,7 +175,18 @@ static void autofs4_notify_daemon(struct
mutex_unlock(&sbi->wq_mutex);
if (autofs4_write(sbi, pipe, &pkt, pktsz))
+ switch (ret = autofs4_write(sbi, pipe, &pkt, pktsz)) {
+ case 0:
+ break;
+ case -ENOMEM:
+ case -ERESTARTSYS:
+ /* Just fail this one */
+ autofs4_wait_release(sbi, wq->wait_queue_token, ret);
+ break;
+ default:
autofs4_catatonic_mode(sbi);
+ break;
+ }
fput(pipe);
}
^ permalink raw reply [flat|nested] 124+ messages in thread* Re: [PATCH 4.4 20/96] autofs: dont fail mount for transient error
2017-11-28 10:22 ` [PATCH 4.4 20/96] autofs: dont fail mount for transient error Greg Kroah-Hartman
@ 2017-12-05 21:59 ` Ben Hutchings
2017-12-05 22:22 ` NeilBrown
0 siblings, 1 reply; 124+ messages in thread
From: Ben Hutchings @ 2017-12-05 21:59 UTC (permalink / raw)
To: NeilBrown
Cc: stable, Ian Kent, Andrew Morton, Linus Torvalds,
Greg Kroah-Hartman, LKML
On Tue, 2017-11-28 at 11:22 +0100, Greg Kroah-Hartman wrote:
> 4.4-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: NeilBrown <neilb@suse.com>
>
> commit ecc0c469f27765ed1e2b967be0aa17cee1a60b76 upstream.
[...]
> @@ -173,7 +175,18 @@ static void autofs4_notify_daemon(struct
> mutex_unlock(&sbi->wq_mutex);
>
> if (autofs4_write(sbi, pipe, &pkt, pktsz))
> + switch (ret = autofs4_write(sbi, pipe, &pkt, pktsz)) {
I'm pretty sure the if-statement was meant to be replaced by the
switch-statement here. (This is wrong upstream, not an error in
backporting.)
Ben.
> + case 0:
> + break;
> + case -ENOMEM:
> + case -ERESTARTSYS:
> + /* Just fail this one */
> + autofs4_wait_release(sbi, wq->wait_queue_token, ret);
> + break;
> + default:
> autofs4_catatonic_mode(sbi);
> + break;
> + }
> fput(pipe);
> }
>
--
Ben Hutchings
Software Developer, Codethink Ltd.
^ permalink raw reply [flat|nested] 124+ messages in thread* Re: [PATCH 4.4 20/96] autofs: dont fail mount for transient error
2017-12-05 21:59 ` Ben Hutchings
@ 2017-12-05 22:22 ` NeilBrown
0 siblings, 0 replies; 124+ messages in thread
From: NeilBrown @ 2017-12-05 22:22 UTC (permalink / raw)
To: Ben Hutchings
Cc: stable, Ian Kent, Andrew Morton, Linus Torvalds,
Greg Kroah-Hartman, LKML
[-- Attachment #1: Type: text/plain, Size: 1157 bytes --]
On Tue, Dec 05 2017, Ben Hutchings wrote:
> On Tue, 2017-11-28 at 11:22 +0100, Greg Kroah-Hartman wrote:
>> 4.4-stable review patch. If anyone has any objections, please let me know.
>>
>> ------------------
>>
>> From: NeilBrown <neilb@suse.com>
>>
>> commit ecc0c469f27765ed1e2b967be0aa17cee1a60b76 upstream.
> [...]
>> @@ -173,7 +175,18 @@ static void autofs4_notify_daemon(struct
>> mutex_unlock(&sbi->wq_mutex);
>>
>> if (autofs4_write(sbi, pipe, &pkt, pktsz))
>> + switch (ret = autofs4_write(sbi, pipe, &pkt, pktsz)) {
>
> I'm pretty sure the if-statement was meant to be replaced by the
> switch-statement here. (This is wrong upstream, not an error in
> backporting.)
Argg yes. Thanks for the review!!!
Fix posted.
Thanks,
NeilBrown
>
> Ben.
>
>> + case 0:
>> + break;
>> + case -ENOMEM:
>> + case -ERESTARTSYS:
>> + /* Just fail this one */
>> + autofs4_wait_release(sbi, wq->wait_queue_token, ret);
>> + break;
>> + default:
>> autofs4_catatonic_mode(sbi);
>> + break;
>> + }
>> fput(pipe);
>> }
>>
>
> --
> Ben Hutchings
> Software Developer, Codethink Ltd.
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 832 bytes --]
^ permalink raw reply [flat|nested] 124+ messages in thread
* [PATCH 4.4 21/96] nilfs2: fix race condition that causes file system corruption
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (17 preceding siblings ...)
2017-11-28 10:22 ` [PATCH 4.4 20/96] autofs: dont fail mount for transient error Greg Kroah-Hartman
@ 2017-11-28 10:22 ` Greg Kroah-Hartman
2017-11-28 10:22 ` [PATCH 4.4 22/96] eCryptfs: use after free in ecryptfs_release_messaging() Greg Kroah-Hartman
` (77 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andreas Rohner, Ryusuke Konishi,
Andrew Morton, Linus Torvalds
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Rohner <andreas.rohner@gmx.net>
commit 31ccb1f7ba3cfe29631587d451cf5bb8ab593550 upstream.
There is a race condition between nilfs_dirty_inode() and
nilfs_set_file_dirty().
When a file is opened, nilfs_dirty_inode() is called to update the
access timestamp in the inode. It calls __nilfs_mark_inode_dirty() in a
separate transaction. __nilfs_mark_inode_dirty() caches the ifile
buffer_head in the i_bh field of the inode info structure and marks it
as dirty.
After some data was written to the file in another transaction, the
function nilfs_set_file_dirty() is called, which adds the inode to the
ns_dirty_files list.
Then the segment construction calls nilfs_segctor_collect_dirty_files(),
which goes through the ns_dirty_files list and checks the i_bh field.
If there is a cached buffer_head in i_bh it is not marked as dirty
again.
Since nilfs_dirty_inode() and nilfs_set_file_dirty() use separate
transactions, it is possible that a segment construction that writes out
the ifile occurs in-between the two. If this happens the inode is not
on the ns_dirty_files list, but its ifile block is still marked as dirty
and written out.
In the next segment construction, the data for the file is written out
and nilfs_bmap_propagate() updates the b-tree. Eventually the bmap root
is written into the i_bh block, which is not dirty, because it was
written out in another segment construction.
As a result the bmap update can be lost, which leads to file system
corruption. Either the virtual block address points to an unallocated
DAT block, or the DAT entry will be reused for something different.
The error can remain undetected for a long time. A typical error
message would be one of the "bad btree" errors or a warning that a DAT
entry could not be found.
This bug can be reproduced reliably by a simple benchmark that creates
and overwrites millions of 4k files.
Link: http://lkml.kernel.org/r/1509367935-3086-2-git-send-email-konishi.ryusuke@lab.ntt.co.jp
Signed-off-by: Andreas Rohner <andreas.rohner@gmx.net>
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
Tested-by: Andreas Rohner <andreas.rohner@gmx.net>
Tested-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nilfs2/segment.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/fs/nilfs2/segment.c
+++ b/fs/nilfs2/segment.c
@@ -1945,8 +1945,6 @@ static int nilfs_segctor_collect_dirty_f
"failed to get inode block.\n");
return err;
}
- mark_buffer_dirty(ibh);
- nilfs_mdt_mark_dirty(ifile);
spin_lock(&nilfs->ns_inode_lock);
if (likely(!ii->i_bh))
ii->i_bh = ibh;
@@ -1955,6 +1953,10 @@ static int nilfs_segctor_collect_dirty_f
goto retry;
}
+ // Always redirty the buffer to avoid race condition
+ mark_buffer_dirty(ii->i_bh);
+ nilfs_mdt_mark_dirty(ifile);
+
clear_bit(NILFS_I_QUEUED, &ii->i_state);
set_bit(NILFS_I_BUSY, &ii->i_state);
list_move_tail(&ii->i_dirty, &sci->sc_dirty_files);
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 22/96] eCryptfs: use after free in ecryptfs_release_messaging()
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (18 preceding siblings ...)
2017-11-28 10:22 ` [PATCH 4.4 21/96] nilfs2: fix race condition that causes file system corruption Greg Kroah-Hartman
@ 2017-11-28 10:22 ` Greg Kroah-Hartman
2017-11-28 10:22 ` [PATCH 4.4 23/96] bcache: check ca->alloc_thread initialized before wake up it Greg Kroah-Hartman
` (76 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:22 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Tyler Hicks
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
commit db86be3a12d0b6e5c5b51c2ab2a48f06329cb590 upstream.
We're freeing the list iterator so we should be using the _safe()
version of hlist_for_each_entry().
Fixes: 88b4a07e6610 ("[PATCH] eCryptfs: Public key transport mechanism")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ecryptfs/messaging.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/fs/ecryptfs/messaging.c
+++ b/fs/ecryptfs/messaging.c
@@ -442,15 +442,16 @@ void ecryptfs_release_messaging(void)
}
if (ecryptfs_daemon_hash) {
struct ecryptfs_daemon *daemon;
+ struct hlist_node *n;
int i;
mutex_lock(&ecryptfs_daemon_hash_mux);
for (i = 0; i < (1 << ecryptfs_hash_bits); i++) {
int rc;
- hlist_for_each_entry(daemon,
- &ecryptfs_daemon_hash[i],
- euid_chain) {
+ hlist_for_each_entry_safe(daemon, n,
+ &ecryptfs_daemon_hash[i],
+ euid_chain) {
rc = ecryptfs_exorcise_daemon(daemon);
if (rc)
printk(KERN_ERR "%s: Error whilst "
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 23/96] bcache: check ca->alloc_thread initialized before wake up it
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (19 preceding siblings ...)
2017-11-28 10:22 ` [PATCH 4.4 22/96] eCryptfs: use after free in ecryptfs_release_messaging() Greg Kroah-Hartman
@ 2017-11-28 10:22 ` Greg Kroah-Hartman
2017-11-28 10:22 ` [PATCH 4.4 24/96] isofs: fix timestamps beyond 2027 Greg Kroah-Hartman
` (75 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Coly Li, Jorg Bornschein,
Kent Overstreet, Michael Lyle, Jens Axboe
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Coly Li <colyli@suse.de>
commit 91af8300d9c1d7c6b6a2fd754109e08d4798b8d8 upstream.
In bcache code, sysfs entries are created before all resources get
allocated, e.g. allocation thread of a cache set.
There is posibility for NULL pointer deference if a resource is accessed
but which is not initialized yet. Indeed Jorg Bornschein catches one on
cache set allocation thread and gets a kernel oops.
The reason for this bug is, when bch_bucket_alloc() is called during
cache set registration and attaching, ca->alloc_thread is not properly
allocated and initialized yet, call wake_up_process() on ca->alloc_thread
triggers NULL pointer deference failure. A simple and fast fix is, before
waking up ca->alloc_thread, checking whether it is allocated, and only
wake up ca->alloc_thread when it is not NULL.
Signed-off-by: Coly Li <colyli@suse.de>
Reported-by: Jorg Bornschein <jb@capsec.org>
Cc: Kent Overstreet <kent.overstreet@gmail.com>
Reviewed-by: Michael Lyle <mlyle@lyle.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/bcache/alloc.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/md/bcache/alloc.c
+++ b/drivers/md/bcache/alloc.c
@@ -406,7 +406,8 @@ long bch_bucket_alloc(struct cache *ca,
finish_wait(&ca->set->bucket_wait, &w);
out:
- wake_up_process(ca->alloc_thread);
+ if (ca->alloc_thread)
+ wake_up_process(ca->alloc_thread);
trace_bcache_alloc(ca, reserve);
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 24/96] isofs: fix timestamps beyond 2027
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (20 preceding siblings ...)
2017-11-28 10:22 ` [PATCH 4.4 23/96] bcache: check ca->alloc_thread initialized before wake up it Greg Kroah-Hartman
@ 2017-11-28 10:22 ` Greg Kroah-Hartman
2017-11-28 10:22 ` [PATCH 4.4 25/96] NFS: Fix typo in nomigration mount option Greg Kroah-Hartman
` (74 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:22 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Jan Kara
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <arnd@arndb.de>
commit 34be4dbf87fc3e474a842305394534216d428f5d upstream.
isofs uses a 'char' variable to load the number of years since
1900 for an inode timestamp. On architectures that use a signed
char type by default, this results in an invalid date for
anything beyond 2027.
This changes the function argument to a 'u8' array, which
is defined the same way on all architectures, and unambiguously
lets us use years until 2155.
This should be backported to all kernels that might still be
in use by that date.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/isofs/isofs.h | 2 +-
fs/isofs/rock.h | 2 +-
fs/isofs/util.c | 2 +-
3 files changed, 3 insertions(+), 3 deletions(-)
--- a/fs/isofs/isofs.h
+++ b/fs/isofs/isofs.h
@@ -103,7 +103,7 @@ static inline unsigned int isonum_733(ch
/* Ignore bigendian datum due to broken mastering programs */
return get_unaligned_le32(p);
}
-extern int iso_date(char *, int);
+extern int iso_date(u8 *, int);
struct inode; /* To make gcc happy */
--- a/fs/isofs/rock.h
+++ b/fs/isofs/rock.h
@@ -65,7 +65,7 @@ struct RR_PL_s {
};
struct stamp {
- char time[7];
+ __u8 time[7]; /* actually 6 unsigned, 1 signed */
} __attribute__ ((packed));
struct RR_TF_s {
--- a/fs/isofs/util.c
+++ b/fs/isofs/util.c
@@ -15,7 +15,7 @@
* to GMT. Thus we should always be correct.
*/
-int iso_date(char * p, int flag)
+int iso_date(u8 *p, int flag)
{
int year, month, day, hour, minute, second, tz;
int crtime;
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 25/96] NFS: Fix typo in nomigration mount option
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (21 preceding siblings ...)
2017-11-28 10:22 ` [PATCH 4.4 24/96] isofs: fix timestamps beyond 2027 Greg Kroah-Hartman
@ 2017-11-28 10:22 ` Greg Kroah-Hartman
2017-11-28 10:22 ` [PATCH 4.4 26/96] nfs: Fix ugly referral attributes Greg Kroah-Hartman
` (73 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:22 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Joshua Watt, Anna Schumaker
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joshua Watt <jpewhacker@gmail.com>
commit f02fee227e5f21981152850744a6084ff3fa94ee upstream.
The option was incorrectly masking off all other options.
Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/super.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -1322,7 +1322,7 @@ static int nfs_parse_mount_options(char
mnt->options |= NFS_OPTION_MIGRATION;
break;
case Opt_nomigration:
- mnt->options &= NFS_OPTION_MIGRATION;
+ mnt->options &= ~NFS_OPTION_MIGRATION;
break;
/*
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 26/96] nfs: Fix ugly referral attributes
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (22 preceding siblings ...)
2017-11-28 10:22 ` [PATCH 4.4 25/96] NFS: Fix typo in nomigration mount option Greg Kroah-Hartman
@ 2017-11-28 10:22 ` Greg Kroah-Hartman
2017-11-28 10:22 ` [PATCH 4.4 27/96] nfsd: deal with revoked delegations appropriately Greg Kroah-Hartman
` (72 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Pradeep Thomas, Chuck Lever, Anna Schumaker
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <chuck.lever@oracle.com>
commit c05cefcc72416a37eba5a2b35f0704ed758a9145 upstream.
Before traversing a referral and performing a mount, the mounted-on
directory looks strange:
dr-xr-xr-x. 2 4294967294 4294967294 0 Dec 31 1969 dir.0
nfs4_get_referral is wiping out any cached attributes with what was
returned via GETATTR(fs_locations), but the bit mask for that
operation does not request any file attributes.
Retrieve owner and timestamp information so that the memcpy in
nfs4_get_referral fills in more attributes.
Changes since v1:
- Don't request attributes that the client unconditionally replaces
- Request only MOUNTED_ON_FILEID or FILEID attribute, not both
- encode_fs_locations() doesn't use the third bitmask word
Fixes: 6b97fd3da1ea ("NFSv4: Follow a referral")
Suggested-by: Pradeep Thomas <pradeepthomas@gmail.com>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/nfs4proc.c | 18 ++++++++----------
1 file changed, 8 insertions(+), 10 deletions(-)
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -242,15 +242,12 @@ const u32 nfs4_fsinfo_bitmap[3] = { FATT
};
const u32 nfs4_fs_locations_bitmap[3] = {
- FATTR4_WORD0_TYPE
- | FATTR4_WORD0_CHANGE
+ FATTR4_WORD0_CHANGE
| FATTR4_WORD0_SIZE
| FATTR4_WORD0_FSID
| FATTR4_WORD0_FILEID
| FATTR4_WORD0_FS_LOCATIONS,
- FATTR4_WORD1_MODE
- | FATTR4_WORD1_NUMLINKS
- | FATTR4_WORD1_OWNER
+ FATTR4_WORD1_OWNER
| FATTR4_WORD1_OWNER_GROUP
| FATTR4_WORD1_RAWDEV
| FATTR4_WORD1_SPACE_USED
@@ -6351,9 +6348,7 @@ static int _nfs4_proc_fs_locations(struc
struct page *page)
{
struct nfs_server *server = NFS_SERVER(dir);
- u32 bitmask[3] = {
- [0] = FATTR4_WORD0_FSID | FATTR4_WORD0_FS_LOCATIONS,
- };
+ u32 bitmask[3];
struct nfs4_fs_locations_arg args = {
.dir_fh = NFS_FH(dir),
.name = name,
@@ -6372,12 +6367,15 @@ static int _nfs4_proc_fs_locations(struc
dprintk("%s: start\n", __func__);
+ bitmask[0] = nfs4_fattr_bitmap[0] | FATTR4_WORD0_FS_LOCATIONS;
+ bitmask[1] = nfs4_fattr_bitmap[1];
+
/* Ask for the fileid of the absent filesystem if mounted_on_fileid
* is not supported */
if (NFS_SERVER(dir)->attr_bitmask[1] & FATTR4_WORD1_MOUNTED_ON_FILEID)
- bitmask[1] |= FATTR4_WORD1_MOUNTED_ON_FILEID;
+ bitmask[0] &= ~FATTR4_WORD0_FILEID;
else
- bitmask[0] |= FATTR4_WORD0_FILEID;
+ bitmask[1] &= ~FATTR4_WORD1_MOUNTED_ON_FILEID;
nfs_fattr_init(&fs_locations->fattr);
fs_locations->server = server;
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 27/96] nfsd: deal with revoked delegations appropriately
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (23 preceding siblings ...)
2017-11-28 10:22 ` [PATCH 4.4 26/96] nfs: Fix ugly referral attributes Greg Kroah-Hartman
@ 2017-11-28 10:22 ` Greg Kroah-Hartman
2017-11-28 10:22 ` [PATCH 4.4 28/96] rtlwifi: rtl8192ee: Fix memory leak when loading firmware Greg Kroah-Hartman
` (71 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andrew Elble, Trond Myklebust,
J. Bruce Fields
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Elble <aweits@rit.edu>
commit 95da1b3a5aded124dd1bda1e3cdb876184813140 upstream.
If a delegation has been revoked by the server, operations using that
delegation should error out with NFS4ERR_DELEG_REVOKED in the >4.1
case, and NFS4ERR_BAD_STATEID otherwise.
The server needs NFSv4.1 clients to explicitly free revoked delegations.
If the server returns NFS4ERR_DELEG_REVOKED, the client will do that;
otherwise it may just forget about the delegation and be unable to
recover when it later sees SEQ4_STATUS_RECALLABLE_STATE_REVOKED set on a
SEQUENCE reply. That can cause the Linux 4.1 client to loop in its
stage manager.
Signed-off-by: Andrew Elble <aweits@rit.edu>
Reviewed-by: Trond Myklebust <trond.myklebust@primarydata.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4state.c | 25 ++++++++++++++++++++++++-
1 file changed, 24 insertions(+), 1 deletion(-)
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -3829,7 +3829,8 @@ static struct nfs4_delegation *find_dele
{
struct nfs4_stid *ret;
- ret = find_stateid_by_type(cl, s, NFS4_DELEG_STID);
+ ret = find_stateid_by_type(cl, s,
+ NFS4_DELEG_STID|NFS4_REVOKED_DELEG_STID);
if (!ret)
return NULL;
return delegstateid(ret);
@@ -3852,6 +3853,12 @@ nfs4_check_deleg(struct nfs4_client *cl,
deleg = find_deleg_stateid(cl, &open->op_delegate_stateid);
if (deleg == NULL)
goto out;
+ if (deleg->dl_stid.sc_type == NFS4_REVOKED_DELEG_STID) {
+ nfs4_put_stid(&deleg->dl_stid);
+ if (cl->cl_minorversion)
+ status = nfserr_deleg_revoked;
+ goto out;
+ }
flags = share_access_to_flags(open->op_share_access);
status = nfs4_check_delegmode(deleg, flags);
if (status) {
@@ -4696,6 +4703,16 @@ nfsd4_lookup_stateid(struct nfsd4_compou
struct nfs4_stid **s, struct nfsd_net *nn)
{
__be32 status;
+ bool return_revoked = false;
+
+ /*
+ * only return revoked delegations if explicitly asked.
+ * otherwise we report revoked or bad_stateid status.
+ */
+ if (typemask & NFS4_REVOKED_DELEG_STID)
+ return_revoked = true;
+ else if (typemask & NFS4_DELEG_STID)
+ typemask |= NFS4_REVOKED_DELEG_STID;
if (ZERO_STATEID(stateid) || ONE_STATEID(stateid))
return nfserr_bad_stateid;
@@ -4710,6 +4727,12 @@ nfsd4_lookup_stateid(struct nfsd4_compou
*s = find_stateid_by_type(cstate->clp, stateid, typemask);
if (!*s)
return nfserr_bad_stateid;
+ if (((*s)->sc_type == NFS4_REVOKED_DELEG_STID) && !return_revoked) {
+ nfs4_put_stid(*s);
+ if (cstate->minorversion)
+ return nfserr_deleg_revoked;
+ return nfserr_bad_stateid;
+ }
return nfs_ok;
}
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 28/96] rtlwifi: rtl8192ee: Fix memory leak when loading firmware
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (24 preceding siblings ...)
2017-11-28 10:22 ` [PATCH 4.4 27/96] nfsd: deal with revoked delegations appropriately Greg Kroah-Hartman
@ 2017-11-28 10:22 ` Greg Kroah-Hartman
2017-11-28 10:22 ` [PATCH 4.4 29/96] rtlwifi: fix uninitialized rtlhal->last_suspend_sec time Greg Kroah-Hartman
` (70 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:22 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Larry Finger, Kalle Valo
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Larry Finger <Larry.Finger@lwfinger.net>
commit 519ce2f933fa14acf69d5c8cabcc18711943d629 upstream.
In routine rtl92ee_set_fw_rsvdpagepkt(), the driver allocates an skb, but
never calls rtl_cmd_send_packet(), which will free the buffer. All other
rtlwifi drivers perform this operation correctly.
This problem has been in the driver since it was included in the kernel.
Fortunately, each firmware load only leaks 4 buffers, which likely
explains why it has not previously been detected.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/realtek/rtlwifi/rtl8192ee/fw.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/fw.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/fw.c
@@ -664,7 +664,7 @@ void rtl92ee_set_fw_rsvdpagepkt(struct i
struct rtl_priv *rtlpriv = rtl_priv(hw);
struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
struct sk_buff *skb = NULL;
-
+ bool rtstatus;
u32 totalpacketlen;
u8 u1rsvdpageloc[5] = { 0 };
bool b_dlok = false;
@@ -727,7 +727,9 @@ void rtl92ee_set_fw_rsvdpagepkt(struct i
memcpy((u8 *)skb_put(skb, totalpacketlen),
&reserved_page_packet, totalpacketlen);
- b_dlok = true;
+ rtstatus = rtl_cmd_send_packet(hw, skb);
+ if (rtstatus)
+ b_dlok = true;
if (b_dlok) {
RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD ,
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 29/96] rtlwifi: fix uninitialized rtlhal->last_suspend_sec time
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (25 preceding siblings ...)
2017-11-28 10:22 ` [PATCH 4.4 28/96] rtlwifi: rtl8192ee: Fix memory leak when loading firmware Greg Kroah-Hartman
@ 2017-11-28 10:22 ` Greg Kroah-Hartman
2017-11-28 10:22 ` [PATCH 4.4 30/96] ata: fixes kernel crash while tracing ata_eh_link_autopsy event Greg Kroah-Hartman
` (69 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Larry Finger, Kalle Valo
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <arnd@arndb.de>
commit 3f2a162fab15aee243178b5308bb5d1206fc4043 upstream.
We set rtlhal->last_suspend_sec to an uninitialized stack variable,
but unfortunately gcc never warned about this, I only found it
while working on another patch. I opened a gcc bug for this.
Presumably the value of rtlhal->last_suspend_sec is not all that
important, but it does get used, so we probably want the
patch backported to stable kernels.
Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=82839
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c
@@ -1377,6 +1377,7 @@ static void _rtl8821ae_get_wakeup_reason
ppsc->wakeup_reason = 0;
+ do_gettimeofday(&ts);
rtlhal->last_suspend_sec = ts.tv_sec;
switch (fw_reason) {
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 30/96] ata: fixes kernel crash while tracing ata_eh_link_autopsy event
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (26 preceding siblings ...)
2017-11-28 10:22 ` [PATCH 4.4 29/96] rtlwifi: fix uninitialized rtlhal->last_suspend_sec time Greg Kroah-Hartman
@ 2017-11-28 10:22 ` Greg Kroah-Hartman
2017-11-28 10:22 ` [PATCH 4.4 31/96] ext4: fix interaction between i_size, fallocate, and delalloc after a crash Greg Kroah-Hartman
` (68 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:22 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Rameshwar Prasad Sahu, Tejun Heo
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rameshwar Prasad Sahu <rsahu@apm.com>
commit f1601113ddc0339a745e702f4fb1ca37d4875e65 upstream.
When tracing ata link error event, the kernel crashes when the disk is
removed due to NULL pointer access by trace_ata_eh_link_autopsy API.
This occurs as the dev is NULL when the disk disappeared. This patch
fixes this crash by calling trace_ata_eh_link_autopsy only if "dev"
is not NULL.
v2 changes:
Removed direct passing "link" pointer instead of "dev" in trace API.
Signed-off-by: Rameshwar Prasad Sahu <rsahu@apm.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Fixes: 255c03d15a29 ("libata: Add tracepoints")
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/ata/libata-eh.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -2245,8 +2245,8 @@ static void ata_eh_link_autopsy(struct a
if (dev->flags & ATA_DFLAG_DUBIOUS_XFER)
eflags |= ATA_EFLAG_DUBIOUS_XFER;
ehc->i.action |= ata_eh_speed_down(dev, eflags, all_err_mask);
+ trace_ata_eh_link_autopsy(dev, ehc->i.action, all_err_mask);
}
- trace_ata_eh_link_autopsy(dev, ehc->i.action, all_err_mask);
DPRINTK("EXIT\n");
}
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 31/96] ext4: fix interaction between i_size, fallocate, and delalloc after a crash
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (27 preceding siblings ...)
2017-11-28 10:22 ` [PATCH 4.4 30/96] ata: fixes kernel crash while tracing ata_eh_link_autopsy event Greg Kroah-Hartman
@ 2017-11-28 10:22 ` Greg Kroah-Hartman
2017-11-28 10:22 ` [PATCH 4.4 32/96] ALSA: pcm: update tstamp only if audio_tstamp changed Greg Kroah-Hartman
` (67 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:22 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Theodore Tso, Amir Goldstein
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Theodore Ts'o <tytso@mit.edu>
commit 51e3ae81ec58e95f10a98ef3dd6d7bce5d8e35a2 upstream.
If there are pending writes subject to delayed allocation, then i_size
will show size after the writes have completed, while i_disksize
contains the value of i_size on the disk (since the writes have not
been persisted to disk).
If fallocate(2) is called with the FALLOC_FL_KEEP_SIZE flag, either
with or without the FALLOC_FL_ZERO_RANGE flag set, and the new size
after the fallocate(2) is between i_size and i_disksize, then after a
crash, if a journal commit has resulted in the changes made by the
fallocate() call to be persisted after a crash, but the delayed
allocation write has not resolved itself, i_size would not be updated,
and this would cause the following e2fsck complaint:
Inode 12, end of extent exceeds allowed value
(logical block 33, physical block 33441, len 7)
This can only take place on a sparse file, where the fallocate(2) call
is allocating blocks in a range which is before a pending delayed
allocation write which is extending i_size. Since this situation is
quite rare, and the window in which the crash must take place is
typically < 30 seconds, in practice this condition will rarely happen.
Nevertheless, it can be triggered in testing, and in particular by
xfstests generic/456.
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Reported-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext4/extents.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -4818,7 +4818,8 @@ static long ext4_zero_range(struct file
}
if (!(mode & FALLOC_FL_KEEP_SIZE) &&
- offset + len > i_size_read(inode)) {
+ (offset + len > i_size_read(inode) ||
+ offset + len > EXT4_I(inode)->i_disksize)) {
new_size = offset + len;
ret = inode_newsize_ok(inode, new_size);
if (ret)
@@ -4994,7 +4995,8 @@ long ext4_fallocate(struct file *file, i
}
if (!(mode & FALLOC_FL_KEEP_SIZE) &&
- offset + len > i_size_read(inode)) {
+ (offset + len > i_size_read(inode) ||
+ offset + len > EXT4_I(inode)->i_disksize)) {
new_size = offset + len;
ret = inode_newsize_ok(inode, new_size);
if (ret)
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 32/96] ALSA: pcm: update tstamp only if audio_tstamp changed
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (28 preceding siblings ...)
2017-11-28 10:22 ` [PATCH 4.4 31/96] ext4: fix interaction between i_size, fallocate, and delalloc after a crash Greg Kroah-Hartman
@ 2017-11-28 10:22 ` Greg Kroah-Hartman
2017-11-28 10:22 ` [PATCH 4.4 33/96] ALSA: usb-audio: Add sanity checks to FE parser Greg Kroah-Hartman
` (66 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Pierre-Louis Bossart,
Henrik Eriksson, Takashi Iwai
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Henrik Eriksson <henrik.eriksson@axis.com>
commit 20e3f985bb875fea4f86b04eba4b6cc29bfd6b71 upstream.
commit 3179f6200188 ("ALSA: core: add .get_time_info") had a side effect
of changing the behaviour of the PCM runtime tstamp. Prior to this
change tstamp was not updated by snd_pcm_update_hw_ptr0() unless the
hw_ptr had moved, after this change tstamp was always updated.
For an application using alsa-lib, doing snd_pcm_readi() followed by
snd_pcm_status() to estimate the age of the read samples by subtracting
status->avail * [sample rate] from status->tstamp this change degraded
the accuracy of the estimate on devices where the pcm hw does not
provide a granular hw_ptr, e.g., devices using
soc-generic-dmaengine-pcm.c and a dma-engine with residue_granularity
DMA_RESIDUE_GRANULARITY_DESCRIPTOR. The accuracy of the estimate
depended on the latency between the PCM hw completing a period and the
driver called snd_pcm_period_elapsed() to notify ALSA core, typically
determined by interrupt handling latency. After the change the accuracy
of the estimate depended on the latency between the PCM hw completing a
period and the application calling snd_pcm_status(), determined by the
scheduling of the application process. The maximum error of the
estimate is one period length in both cases, but the error average and
variance is smaller when it depends on interrupt latency.
Instead of always updating tstamp, update it only if audio_tstamp
changed.
Fixes: 3179f6200188 ("ALSA: core: add .get_time_info")
Suggested-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Signed-off-by: Henrik Eriksson <henrik.eriksson@axis.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/core/pcm_lib.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/sound/core/pcm_lib.c
+++ b/sound/core/pcm_lib.c
@@ -264,8 +264,10 @@ static void update_audio_tstamp(struct s
runtime->rate);
*audio_tstamp = ns_to_timespec(audio_nsecs);
}
- runtime->status->audio_tstamp = *audio_tstamp;
- runtime->status->tstamp = *curr_tstamp;
+ if (!timespec_equal(&runtime->status->audio_tstamp, audio_tstamp)) {
+ runtime->status->audio_tstamp = *audio_tstamp;
+ runtime->status->tstamp = *curr_tstamp;
+ }
/*
* re-take a driver timestamp to let apps detect if the reference tstamp
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 33/96] ALSA: usb-audio: Add sanity checks to FE parser
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (29 preceding siblings ...)
2017-11-28 10:22 ` [PATCH 4.4 32/96] ALSA: pcm: update tstamp only if audio_tstamp changed Greg Kroah-Hartman
@ 2017-11-28 10:22 ` Greg Kroah-Hartman
2017-11-28 10:22 ` [PATCH 4.4 34/96] ALSA: usb-audio: Fix potential out-of-bound access at parsing SU Greg Kroah-Hartman
` (65 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:22 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Andrey Konovalov, Takashi Iwai
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit d937cd6790a2bef2d07b500487646bd794c039bb upstream.
When the usb-audio descriptor contains the malformed feature unit
description with a too short length, the driver may access
out-of-bounds. Add a sanity check of the header size at the beginning
of parse_audio_feature_unit().
Fixes: 23caaf19b11e ("ALSA: usb-mixer: Add support for Audio Class v2.0")
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/usb/mixer.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -1397,6 +1397,12 @@ static int parse_audio_feature_unit(stru
__u8 *bmaControls;
if (state->mixer->protocol == UAC_VERSION_1) {
+ if (hdr->bLength < 7) {
+ usb_audio_err(state->chip,
+ "unit %u: invalid UAC_FEATURE_UNIT descriptor\n",
+ unitid);
+ return -EINVAL;
+ }
csize = hdr->bControlSize;
if (!csize) {
usb_audio_dbg(state->chip,
@@ -1414,6 +1420,12 @@ static int parse_audio_feature_unit(stru
}
} else {
struct uac2_feature_unit_descriptor *ftr = _ftr;
+ if (hdr->bLength < 6) {
+ usb_audio_err(state->chip,
+ "unit %u: invalid UAC_FEATURE_UNIT descriptor\n",
+ unitid);
+ return -EINVAL;
+ }
csize = 4;
channels = (hdr->bLength - 6) / 4 - 1;
bmaControls = ftr->bmaControls;
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 34/96] ALSA: usb-audio: Fix potential out-of-bound access at parsing SU
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (30 preceding siblings ...)
2017-11-28 10:22 ` [PATCH 4.4 33/96] ALSA: usb-audio: Add sanity checks to FE parser Greg Kroah-Hartman
@ 2017-11-28 10:22 ` Greg Kroah-Hartman
2017-11-28 10:22 ` [PATCH 4.4 35/96] ALSA: usb-audio: Add sanity checks in v2 clock parsers Greg Kroah-Hartman
` (64 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:22 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Iwai
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit f658f17b5e0e339935dca23e77e0f3cad591926b upstream.
The usb-audio driver may trigger an out-of-bound access at parsing a
malformed selector unit, as it checks the header length only after
evaluating bNrInPins field, which can be already above the given
length. Fix it by adding the length check beforehand.
Fixes: 99fc86450c43 ("ALSA: usb-mixer: parse descriptors with structs")
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/usb/mixer.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -2026,7 +2026,8 @@ static int parse_audio_selector_unit(str
const struct usbmix_name_map *map;
char **namelist;
- if (!desc->bNrInPins || desc->bLength < 5 + desc->bNrInPins) {
+ if (desc->bLength < 5 || !desc->bNrInPins ||
+ desc->bLength < 5 + desc->bNrInPins) {
usb_audio_err(state->chip,
"invalid SELECTOR UNIT descriptor %d\n", unitid);
return -EINVAL;
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 35/96] ALSA: usb-audio: Add sanity checks in v2 clock parsers
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (31 preceding siblings ...)
2017-11-28 10:22 ` [PATCH 4.4 34/96] ALSA: usb-audio: Fix potential out-of-bound access at parsing SU Greg Kroah-Hartman
@ 2017-11-28 10:22 ` Greg Kroah-Hartman
2017-11-28 10:22 ` [PATCH 4.4 36/96] ALSA: timer: Remove kernel warning at compat ioctl error paths Greg Kroah-Hartman
` (63 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:22 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Andrey Konovalov, Takashi Iwai
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit 0a62d6c966956d77397c32836a5bbfe3af786fc1 upstream.
The helper functions to parse and look for the clock source, selector
and multiplier unit may return the descriptor with a too short length
than required, while there is no sanity check in the caller side.
Add some sanity checks in the parsers, at least, to guarantee the
given descriptor size, for avoiding the potential crashes.
Fixes: 79f920fbff56 ("ALSA: usb-audio: parse clock topology of UAC2 devices")
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/usb/clock.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
--- a/sound/usb/clock.c
+++ b/sound/usb/clock.c
@@ -43,7 +43,7 @@ static struct uac_clock_source_descripto
while ((cs = snd_usb_find_csint_desc(ctrl_iface->extra,
ctrl_iface->extralen,
cs, UAC2_CLOCK_SOURCE))) {
- if (cs->bClockID == clock_id)
+ if (cs->bLength >= sizeof(*cs) && cs->bClockID == clock_id)
return cs;
}
@@ -59,8 +59,11 @@ static struct uac_clock_selector_descrip
while ((cs = snd_usb_find_csint_desc(ctrl_iface->extra,
ctrl_iface->extralen,
cs, UAC2_CLOCK_SELECTOR))) {
- if (cs->bClockID == clock_id)
+ if (cs->bLength >= sizeof(*cs) && cs->bClockID == clock_id) {
+ if (cs->bLength < 5 + cs->bNrInPins)
+ return NULL;
return cs;
+ }
}
return NULL;
@@ -75,7 +78,7 @@ static struct uac_clock_multiplier_descr
while ((cs = snd_usb_find_csint_desc(ctrl_iface->extra,
ctrl_iface->extralen,
cs, UAC2_CLOCK_MULTIPLIER))) {
- if (cs->bClockID == clock_id)
+ if (cs->bLength >= sizeof(*cs) && cs->bClockID == clock_id)
return cs;
}
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 36/96] ALSA: timer: Remove kernel warning at compat ioctl error paths
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (32 preceding siblings ...)
2017-11-28 10:22 ` [PATCH 4.4 35/96] ALSA: usb-audio: Add sanity checks in v2 clock parsers Greg Kroah-Hartman
@ 2017-11-28 10:22 ` Greg Kroah-Hartman
2017-11-28 10:22 ` [PATCH 4.4 37/96] ALSA: hda/realtek - Fix ALC700 family no sound issue Greg Kroah-Hartman
` (62 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:22 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, syzbot, Takashi Iwai
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit 3d4e8303f2c747c8540a0a0126d0151514f6468b upstream.
Some timer compat ioctls have NULL checks of timer instance with
snd_BUG_ON() that bring up WARN_ON() when the debug option is set.
Actually the condition can be met in the normal situation and it's
confusing and bad to spew kernel warnings with stack trace there.
Let's remove snd_BUG_ON() invocation and replace with the simple
checks. Also, correct the error code to EBADFD to follow the native
ioctl error handling.
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/core/timer_compat.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
--- a/sound/core/timer_compat.c
+++ b/sound/core/timer_compat.c
@@ -40,11 +40,11 @@ static int snd_timer_user_info_compat(st
struct snd_timer *t;
tu = file->private_data;
- if (snd_BUG_ON(!tu->timeri))
- return -ENXIO;
+ if (!tu->timeri)
+ return -EBADFD;
t = tu->timeri->timer;
- if (snd_BUG_ON(!t))
- return -ENXIO;
+ if (!t)
+ return -EBADFD;
memset(&info, 0, sizeof(info));
info.card = t->card ? t->card->number : -1;
if (t->hw.flags & SNDRV_TIMER_HW_SLAVE)
@@ -73,8 +73,8 @@ static int snd_timer_user_status_compat(
struct snd_timer_status32 status;
tu = file->private_data;
- if (snd_BUG_ON(!tu->timeri))
- return -ENXIO;
+ if (!tu->timeri)
+ return -EBADFD;
memset(&status, 0, sizeof(status));
status.tstamp.tv_sec = tu->tstamp.tv_sec;
status.tstamp.tv_nsec = tu->tstamp.tv_nsec;
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 37/96] ALSA: hda/realtek - Fix ALC700 family no sound issue
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (33 preceding siblings ...)
2017-11-28 10:22 ` [PATCH 4.4 36/96] ALSA: timer: Remove kernel warning at compat ioctl error paths Greg Kroah-Hartman
@ 2017-11-28 10:22 ` Greg Kroah-Hartman
2017-11-28 10:22 ` [PATCH 4.4 38/96] fix a page leak in vhost_scsi_iov_to_sgl() error recovery Greg Kroah-Hartman
` (61 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:22 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Kailang Yang, Takashi Iwai
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kailang Yang <kailang@realtek.com>
commit 2d7fe6185722b0817bb345f62ab06b76a7b26542 upstream.
It maybe the typo for ALC700 support patch.
To fix the bit value on this patch.
Fixes: 6fbae35a3170 ("ALSA: hda/realtek - Add support for new codecs ALC700/ALC701/ALC703")
Signed-off-by: Kailang Yang <kailang@realtek.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/patch_realtek.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -6254,7 +6254,7 @@ static int patch_alc269(struct hda_codec
case 0x10ec0703:
spec->codec_variant = ALC269_TYPE_ALC700;
spec->gen.mixer_nid = 0; /* ALC700 does not have any loopback mixer path */
- alc_update_coef_idx(codec, 0x4a, 0, 1 << 15); /* Combo jack auto trigger control */
+ alc_update_coef_idx(codec, 0x4a, 1 << 15, 0); /* Combo jack auto trigger control */
break;
}
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 38/96] fix a page leak in vhost_scsi_iov_to_sgl() error recovery
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (34 preceding siblings ...)
2017-11-28 10:22 ` [PATCH 4.4 37/96] ALSA: hda/realtek - Fix ALC700 family no sound issue Greg Kroah-Hartman
@ 2017-11-28 10:22 ` Greg Kroah-Hartman
2017-11-28 10:22 ` [PATCH 4.4 39/96] fs/9p: Compare qid.path in v9fs_test_inode Greg Kroah-Hartman
` (60 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:22 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Al Viro
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <viro@zeniv.linux.org.uk>
commit 11d49e9d089ccec81be87c2386dfdd010d7f7f6e upstream.
we are advancing sg as we go, so the pages we need to drop in
case of error are *before* the current sg.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/vhost/scsi.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/vhost/scsi.c
+++ b/drivers/vhost/scsi.c
@@ -703,6 +703,7 @@ vhost_scsi_iov_to_sgl(struct vhost_scsi_
struct scatterlist *sg, int sg_count)
{
size_t off = iter->iov_offset;
+ struct scatterlist *p = sg;
int i, ret;
for (i = 0; i < iter->nr_segs; i++) {
@@ -711,8 +712,8 @@ vhost_scsi_iov_to_sgl(struct vhost_scsi_
ret = vhost_scsi_map_to_sgl(cmd, base, len, sg, write);
if (ret < 0) {
- for (i = 0; i < sg_count; i++) {
- struct page *page = sg_page(&sg[i]);
+ while (p < sg) {
+ struct page *page = sg_page(p++);
if (page)
put_page(page);
}
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 39/96] fs/9p: Compare qid.path in v9fs_test_inode
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (35 preceding siblings ...)
2017-11-28 10:22 ` [PATCH 4.4 38/96] fix a page leak in vhost_scsi_iov_to_sgl() error recovery Greg Kroah-Hartman
@ 2017-11-28 10:22 ` Greg Kroah-Hartman
2017-11-28 10:22 ` [PATCH 4.4 40/96] iscsi-target: Fix non-immediate TMR reference leak Greg Kroah-Hartman
` (59 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Latchesar Ionkov, Tuomas Tynkkynen, Al Viro
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tuomas Tynkkynen <tuomas@tuxera.com>
commit 8ee031631546cf2f7859cc69593bd60bbdd70b46 upstream.
Commit fd2421f54423 ("fs/9p: When doing inode lookup compare qid details
and inode mode bits.") transformed v9fs_qid_iget() to use iget5_locked()
instead of iget_locked(). However, the test() callback is not checking
fid.path at all, which means that a lookup in the inode cache can now
accidentally locate a completely wrong inode from the same inode hash
bucket if the other fields (qid.type and qid.version) match.
Fixes: fd2421f54423 ("fs/9p: When doing inode lookup compare qid details and inode mode bits.")
Reviewed-by: Latchesar Ionkov <lucho@ionkov.net>
Signed-off-by: Tuomas Tynkkynen <tuomas@tuxera.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/9p/vfs_inode.c | 3 +++
fs/9p/vfs_inode_dotl.c | 3 +++
2 files changed, 6 insertions(+)
--- a/fs/9p/vfs_inode.c
+++ b/fs/9p/vfs_inode.c
@@ -483,6 +483,9 @@ static int v9fs_test_inode(struct inode
if (v9inode->qid.type != st->qid.type)
return 0;
+
+ if (v9inode->qid.path != st->qid.path)
+ return 0;
return 1;
}
--- a/fs/9p/vfs_inode_dotl.c
+++ b/fs/9p/vfs_inode_dotl.c
@@ -87,6 +87,9 @@ static int v9fs_test_inode_dotl(struct i
if (v9inode->qid.type != st->qid.type)
return 0;
+
+ if (v9inode->qid.path != st->qid.path)
+ return 0;
return 1;
}
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 40/96] iscsi-target: Fix non-immediate TMR reference leak
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (36 preceding siblings ...)
2017-11-28 10:22 ` [PATCH 4.4 39/96] fs/9p: Compare qid.path in v9fs_test_inode Greg Kroah-Hartman
@ 2017-11-28 10:22 ` Greg Kroah-Hartman
2017-11-28 10:22 ` [PATCH 4.4 41/96] target: Fix QUEUE_FULL + SCSI task attribute handling Greg Kroah-Hartman
` (58 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mike Christie, Hannes Reinecke,
Nicholas Bellinger
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Bellinger <nab@linux-iscsi.org>
commit 3fc9fb13a4b2576aeab86c62fd64eb29ab68659c upstream.
This patch fixes a se_cmd->cmd_kref reference leak that can
occur when a non immediate TMR is proceeded our of command
sequence number order, and CMDSN_LOWER_THAN_EXP is returned
by iscsit_sequence_cmd().
To address this bug, call target_put_sess_cmd() during this
special case following what iscsit_process_scsi_cmd() does
upon CMDSN_LOWER_THAN_EXP.
Cc: Mike Christie <mchristi@redhat.com>
Cc: Hannes Reinecke <hare@suse.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/target/iscsi/iscsi_target.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -1923,12 +1923,14 @@ attach:
if (!(hdr->opcode & ISCSI_OP_IMMEDIATE)) {
int cmdsn_ret = iscsit_sequence_cmd(conn, cmd, buf, hdr->cmdsn);
- if (cmdsn_ret == CMDSN_HIGHER_THAN_EXP)
+ if (cmdsn_ret == CMDSN_HIGHER_THAN_EXP) {
out_of_order_cmdsn = 1;
- else if (cmdsn_ret == CMDSN_LOWER_THAN_EXP)
+ } else if (cmdsn_ret == CMDSN_LOWER_THAN_EXP) {
+ target_put_sess_cmd(&cmd->se_cmd);
return 0;
- else if (cmdsn_ret == CMDSN_ERROR_CANNOT_RECOVER)
+ } else if (cmdsn_ret == CMDSN_ERROR_CANNOT_RECOVER) {
return -1;
+ }
}
iscsit_ack_from_expstatsn(conn, be32_to_cpu(hdr->exp_statsn));
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 41/96] target: Fix QUEUE_FULL + SCSI task attribute handling
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (37 preceding siblings ...)
2017-11-28 10:22 ` [PATCH 4.4 40/96] iscsi-target: Fix non-immediate TMR reference leak Greg Kroah-Hartman
@ 2017-11-28 10:22 ` Greg Kroah-Hartman
2017-11-28 10:22 ` [PATCH 4.4 42/96] KVM: nVMX: set IDTR and GDTR limits when loading L1 host state Greg Kroah-Hartman
` (57 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Michael Cyr, Bryant G. Ly,
Mike Christie, Hannes Reinecke, Nicholas Bellinger
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Bellinger <nab@linux-iscsi.org>
commit 1c79df1f349fb6050016cea4ef1dfbc3853a5685 upstream.
This patch fixes a bug during QUEUE_FULL where transport_complete_qf()
calls transport_complete_task_attr() after it's already been invoked
by target_complete_ok_work() or transport_generic_request_failure()
during initial completion, preceeding QUEUE_FULL.
This will result in se_device->simple_cmds, se_device->dev_cur_ordered_id
and/or se_device->dev_ordered_sync being updated multiple times for
a single se_cmd.
To address this bug, clear SCF_TASK_ATTR_SET after the first call
to transport_complete_task_attr(), and avoid updating SCSI task
attribute related counters for any subsequent calls.
Also, when a se_cmd is deferred due to ordered tags and executed
via target_restart_delayed_cmds(), set CMD_T_SENT before execution
matching what target_execute_cmd() does.
Cc: Michael Cyr <mikecyr@linux.vnet.ibm.com>
Cc: Bryant G. Ly <bryantly@linux.vnet.ibm.com>
Cc: Mike Christie <mchristi@redhat.com>
Cc: Hannes Reinecke <hare@suse.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/target/target_core_transport.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -1970,6 +1970,8 @@ static void target_restart_delayed_cmds(
list_del(&cmd->se_delayed_node);
spin_unlock(&dev->delayed_cmd_lock);
+ cmd->transport_state |= CMD_T_SENT;
+
__target_execute_cmd(cmd, true);
if (cmd->sam_task_attr == TCM_ORDERED_TAG)
@@ -2007,6 +2009,8 @@ static void transport_complete_task_attr
pr_debug("Incremented dev_cur_ordered_id: %u for ORDERED\n",
dev->dev_cur_ordered_id);
}
+ cmd->se_cmd_flags &= ~SCF_TASK_ATTR_SET;
+
restart:
target_restart_delayed_cmds(dev);
}
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 42/96] KVM: nVMX: set IDTR and GDTR limits when loading L1 host state
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (38 preceding siblings ...)
2017-11-28 10:22 ` [PATCH 4.4 41/96] target: Fix QUEUE_FULL + SCSI task attribute handling Greg Kroah-Hartman
@ 2017-11-28 10:22 ` Greg Kroah-Hartman
2017-11-28 10:22 ` [PATCH 4.4 44/96] SUNRPC: Fix tracepoint storage issues with svc_recv and svc_rqst_status Greg Kroah-Hartman
` (56 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:22 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ladi Prosek, Paolo Bonzini
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ladi Prosek <lprosek@redhat.com>
commit 21f2d551183847bc7fbe8d866151d00cdad18752 upstream.
Intel SDM 27.5.2 Loading Host Segment and Descriptor-Table Registers:
"The GDTR and IDTR limits are each set to FFFFH."
Signed-off-by: Ladi Prosek <lprosek@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/vmx.c | 2 ++
1 file changed, 2 insertions(+)
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -10394,6 +10394,8 @@ static void load_vmcs12_host_state(struc
vmcs_writel(GUEST_SYSENTER_EIP, vmcs12->host_ia32_sysenter_eip);
vmcs_writel(GUEST_IDTR_BASE, vmcs12->host_idtr_base);
vmcs_writel(GUEST_GDTR_BASE, vmcs12->host_gdtr_base);
+ vmcs_write32(GUEST_IDTR_LIMIT, 0xFFFF);
+ vmcs_write32(GUEST_GDTR_LIMIT, 0xFFFF);
/* If not VM_EXIT_CLEAR_BNDCFGS, the L2 value propagates to L1. */
if (vmcs12->vm_exit_controls & VM_EXIT_CLEAR_BNDCFGS)
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 44/96] SUNRPC: Fix tracepoint storage issues with svc_recv and svc_rqst_status
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (39 preceding siblings ...)
2017-11-28 10:22 ` [PATCH 4.4 42/96] KVM: nVMX: set IDTR and GDTR limits when loading L1 host state Greg Kroah-Hartman
@ 2017-11-28 10:22 ` Greg Kroah-Hartman
2017-11-28 10:22 ` [PATCH 4.4 45/96] clk: ti: dra7-atl-clock: Fix of_node reference counting Greg Kroah-Hartman
` (55 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:22 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Trond Myklebust, J. Bruce Fields
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <trond.myklebust@primarydata.com>
commit e9d4bf219c83d09579bc62512fea2ca10f025d93 upstream.
There is no guarantee that either the request or the svc_xprt exist
by the time we get round to printing the trace message.
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/trace/events/sunrpc.h | 17 ++++++++++-------
1 file changed, 10 insertions(+), 7 deletions(-)
--- a/include/trace/events/sunrpc.h
+++ b/include/trace/events/sunrpc.h
@@ -455,20 +455,22 @@ TRACE_EVENT(svc_recv,
TP_ARGS(rqst, status),
TP_STRUCT__entry(
- __field(struct sockaddr *, addr)
__field(__be32, xid)
__field(int, status)
__field(unsigned long, flags)
+ __dynamic_array(unsigned char, addr, rqst->rq_addrlen)
),
TP_fast_assign(
- __entry->addr = (struct sockaddr *)&rqst->rq_addr;
__entry->xid = status > 0 ? rqst->rq_xid : 0;
__entry->status = status;
__entry->flags = rqst->rq_flags;
+ memcpy(__get_dynamic_array(addr),
+ &rqst->rq_addr, rqst->rq_addrlen);
),
- TP_printk("addr=%pIScp xid=0x%x status=%d flags=%s", __entry->addr,
+ TP_printk("addr=%pIScp xid=0x%x status=%d flags=%s",
+ (struct sockaddr *)__get_dynamic_array(addr),
be32_to_cpu(__entry->xid), __entry->status,
show_rqstp_flags(__entry->flags))
);
@@ -480,22 +482,23 @@ DECLARE_EVENT_CLASS(svc_rqst_status,
TP_ARGS(rqst, status),
TP_STRUCT__entry(
- __field(struct sockaddr *, addr)
__field(__be32, xid)
- __field(int, dropme)
__field(int, status)
__field(unsigned long, flags)
+ __dynamic_array(unsigned char, addr, rqst->rq_addrlen)
),
TP_fast_assign(
- __entry->addr = (struct sockaddr *)&rqst->rq_addr;
__entry->xid = rqst->rq_xid;
__entry->status = status;
__entry->flags = rqst->rq_flags;
+ memcpy(__get_dynamic_array(addr),
+ &rqst->rq_addr, rqst->rq_addrlen);
),
TP_printk("addr=%pIScp rq_xid=0x%x status=%d flags=%s",
- __entry->addr, be32_to_cpu(__entry->xid),
+ (struct sockaddr *)__get_dynamic_array(addr),
+ be32_to_cpu(__entry->xid),
__entry->status, show_rqstp_flags(__entry->flags))
);
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 45/96] clk: ti: dra7-atl-clock: Fix of_node reference counting
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (40 preceding siblings ...)
2017-11-28 10:22 ` [PATCH 4.4 44/96] SUNRPC: Fix tracepoint storage issues with svc_recv and svc_rqst_status Greg Kroah-Hartman
@ 2017-11-28 10:22 ` Greg Kroah-Hartman
2017-11-28 10:22 ` [PATCH 4.4 46/96] clk: ti: dra7-atl-clock: fix child-node lookups Greg Kroah-Hartman
` (54 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Peter Ujfalusi, Nishanth Menon, Stephen Boyd
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <peter.ujfalusi@ti.com>
commit 660e1551939931657808d47838a3f443c0e83fd0 upstream.
of_find_node_by_name() will call of_node_put() on the node so we need to
get it first to avoid warnings.
The cfg_node needs to be put after we have finished processing the
properties.
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
Tested-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/clk/ti/clk-dra7-atl.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/clk/ti/clk-dra7-atl.c
+++ b/drivers/clk/ti/clk-dra7-atl.c
@@ -265,6 +265,7 @@ static int of_dra7_atl_clk_probe(struct
/* Get configuration for the ATL instances */
snprintf(prop, sizeof(prop), "atl%u", i);
+ of_node_get(node);
cfg_node = of_find_node_by_name(node, prop);
if (cfg_node) {
ret = of_property_read_u32(cfg_node, "bws",
@@ -278,6 +279,7 @@ static int of_dra7_atl_clk_probe(struct
atl_write(cinfo, DRA7_ATL_AWSMUX_REG(i),
cdesc->aws);
}
+ of_node_put(cfg_node);
}
cdesc->probed = true;
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 46/96] clk: ti: dra7-atl-clock: fix child-node lookups
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (41 preceding siblings ...)
2017-11-28 10:22 ` [PATCH 4.4 45/96] clk: ti: dra7-atl-clock: Fix of_node reference counting Greg Kroah-Hartman
@ 2017-11-28 10:22 ` Greg Kroah-Hartman
2017-11-28 10:22 ` [PATCH 4.4 47/96] libnvdimm, namespace: fix label initialization to use valid seq numbers Greg Kroah-Hartman
` (53 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Peter Ujfalusi, Johan Hovold, Stephen Boyd
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 33ec6dbc5a02677509d97fe36cd2105753f0f0ea upstream.
Fix child node-lookup during probe, which ended up searching the whole
device tree depth-first starting at parent rather than just matching on
its children.
Note that the original premature free of the parent node has already
been fixed separately, but that fix was apparently never backported to
stable.
Fixes: 9ac33b0ce81f ("CLK: TI: Driver for DRA7 ATL (Audio Tracking Logic)")
Fixes: 660e15519399 ("clk: ti: dra7-atl-clock: Fix of_node reference counting")
Cc: Peter Ujfalusi <peter.ujfalusi@ti.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Acked-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/clk/ti/clk-dra7-atl.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/clk/ti/clk-dra7-atl.c
+++ b/drivers/clk/ti/clk-dra7-atl.c
@@ -265,8 +265,7 @@ static int of_dra7_atl_clk_probe(struct
/* Get configuration for the ATL instances */
snprintf(prop, sizeof(prop), "atl%u", i);
- of_node_get(node);
- cfg_node = of_find_node_by_name(node, prop);
+ cfg_node = of_get_child_by_name(node, prop);
if (cfg_node) {
ret = of_property_read_u32(cfg_node, "bws",
&cdesc->bws);
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 47/96] libnvdimm, namespace: fix label initialization to use valid seq numbers
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (42 preceding siblings ...)
2017-11-28 10:22 ` [PATCH 4.4 46/96] clk: ti: dra7-atl-clock: fix child-node lookups Greg Kroah-Hartman
@ 2017-11-28 10:22 ` Greg Kroah-Hartman
2017-11-28 10:22 ` [PATCH 4.4 48/96] libnvdimm, namespace: make resource attribute only readable by root Greg Kroah-Hartman
` (52 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:22 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Juston Li, Dan Williams
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Williams <dan.j.williams@intel.com>
commit b18d4b8a25af6fe83d7692191d6ff962ea611c4f upstream.
The set of valid sequence numbers is {1,2,3}. The specification
indicates that an implementation should consider 0 a sign of a critical
error:
UEFI 2.7: 13.19 NVDIMM Label Protocol
Software never writes the sequence number 00, so a correctly
check-summed Index Block with this sequence number probably indicates a
critical error. When software discovers this case it treats it as an
invalid Index Block indication.
While the expectation is that the invalid block is just thrown away, the
Robustness Principle says we should fix this to make both sequence
numbers valid.
Fixes: f524bf271a5c ("libnvdimm: write pmem label set")
Reported-by: Juston Li <juston.li@intel.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvdimm/label.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/nvdimm/label.c
+++ b/drivers/nvdimm/label.c
@@ -823,7 +823,7 @@ static int init_labels(struct nd_mapping
nsindex = to_namespace_index(ndd, 0);
memset(nsindex, 0, ndd->nsarea.config_size);
for (i = 0; i < 2; i++) {
- int rc = nd_label_write_index(ndd, i, i*2, ND_NSINDEX_INIT);
+ int rc = nd_label_write_index(ndd, i, 3 - i, ND_NSINDEX_INIT);
if (rc)
return rc;
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 48/96] libnvdimm, namespace: make resource attribute only readable by root
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (43 preceding siblings ...)
2017-11-28 10:22 ` [PATCH 4.4 47/96] libnvdimm, namespace: fix label initialization to use valid seq numbers Greg Kroah-Hartman
@ 2017-11-28 10:22 ` Greg Kroah-Hartman
2017-11-28 10:22 ` [PATCH 4.4 49/96] IB/srpt: Do not accept invalid initiator port names Greg Kroah-Hartman
` (51 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:22 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dave Hansen, Dan Williams
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Williams <dan.j.williams@intel.com>
commit c1fb3542074fd0c4d901d778bd52455111e4eb6f upstream.
For the same reason that /proc/iomem returns 0's for non-root readers
and acpi tables are root-only, make the 'resource' attribute for
namespace devices only readable by root. Otherwise we disclose physical
address information.
Fixes: bf9bccc14c05 ("libnvdimm: pmem label sets and namespace instantiation")
Reported-by: Dave Hansen <dave.hansen@linux.intel.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvdimm/namespace_devs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/nvdimm/namespace_devs.c
+++ b/drivers/nvdimm/namespace_devs.c
@@ -1305,7 +1305,7 @@ static umode_t namespace_visible(struct
if (a == &dev_attr_resource.attr) {
if (is_namespace_blk(dev))
return 0;
- return a->mode;
+ return 0400;
}
if (is_namespace_pmem(dev) || is_namespace_blk(dev)) {
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 49/96] IB/srpt: Do not accept invalid initiator port names
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (44 preceding siblings ...)
2017-11-28 10:22 ` [PATCH 4.4 48/96] libnvdimm, namespace: make resource attribute only readable by root Greg Kroah-Hartman
@ 2017-11-28 10:22 ` Greg Kroah-Hartman
2017-11-28 10:22 ` [PATCH 4.4 50/96] IB/srp: Avoid that a cable pull can trigger a kernel crash Greg Kroah-Hartman
` (50 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:22 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Bart Van Assche, Doug Ledford
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <bart.vanassche@wdc.com>
commit c70ca38960399a63d5c048b7b700612ea321d17e upstream.
Make srpt_parse_i_port_id() return a negative value if hex2bin()
fails.
Fixes: commit a42d985bd5b2 ("ib_srpt: Initial SRP Target merge for v3.3-rc1")
Signed-off-by: Bart Van Assche <bart.vanassche@wdc.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/ulp/srpt/ib_srpt.c | 9 ++++-----
1 file changed, 4 insertions(+), 5 deletions(-)
--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
+++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
@@ -3425,7 +3425,7 @@ static int srpt_parse_i_port_id(u8 i_por
{
const char *p;
unsigned len, count, leading_zero_bytes;
- int ret, rc;
+ int ret;
p = name;
if (strncasecmp(p, "0x", 2) == 0)
@@ -3437,10 +3437,9 @@ static int srpt_parse_i_port_id(u8 i_por
count = min(len / 2, 16U);
leading_zero_bytes = 16 - count;
memset(i_port_id, 0, leading_zero_bytes);
- rc = hex2bin(i_port_id + leading_zero_bytes, p, count);
- if (rc < 0)
- pr_debug("hex2bin failed for srpt_parse_i_port_id: %d\n", rc);
- ret = 0;
+ ret = hex2bin(i_port_id + leading_zero_bytes, p, count);
+ if (ret < 0)
+ pr_debug("hex2bin failed for srpt_parse_i_port_id: %d\n", ret);
out:
return ret;
}
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 50/96] IB/srp: Avoid that a cable pull can trigger a kernel crash
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (45 preceding siblings ...)
2017-11-28 10:22 ` [PATCH 4.4 49/96] IB/srpt: Do not accept invalid initiator port names Greg Kroah-Hartman
@ 2017-11-28 10:22 ` Greg Kroah-Hartman
2017-11-28 10:23 ` [PATCH 4.4 51/96] NFC: fix device-allocation error return Greg Kroah-Hartman
` (49 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Bart Van Assche, Sagi Grimberg, Doug Ledford
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <bart.vanassche@wdc.com>
commit 8a0d18c62121d3c554a83eb96e2752861d84d937 upstream.
This patch fixes the following kernel crash:
general protection fault: 0000 [#1] PREEMPT SMP
Workqueue: ib_mad2 timeout_sends [ib_core]
Call Trace:
ib_sa_path_rec_callback+0x1c4/0x1d0 [ib_core]
send_handler+0xb2/0xd0 [ib_core]
timeout_sends+0x14d/0x220 [ib_core]
process_one_work+0x200/0x630
worker_thread+0x4e/0x3b0
kthread+0x113/0x150
Fixes: commit aef9ec39c47f ("IB: Add SCSI RDMA Protocol (SRP) initiator")
Signed-off-by: Bart Van Assche <bart.vanassche@wdc.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/ulp/srp/ib_srp.c | 25 +++++++++++++++++++------
1 file changed, 19 insertions(+), 6 deletions(-)
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -670,12 +670,19 @@ static void srp_path_rec_completion(int
static int srp_lookup_path(struct srp_rdma_ch *ch)
{
struct srp_target_port *target = ch->target;
- int ret;
+ int ret = -ENODEV;
ch->path.numb_path = 1;
init_completion(&ch->done);
+ /*
+ * Avoid that the SCSI host can be removed by srp_remove_target()
+ * before srp_path_rec_completion() is called.
+ */
+ if (!scsi_host_get(target->scsi_host))
+ goto out;
+
ch->path_query_id = ib_sa_path_rec_get(&srp_sa_client,
target->srp_host->srp_dev->dev,
target->srp_host->port,
@@ -689,18 +696,24 @@ static int srp_lookup_path(struct srp_rd
GFP_KERNEL,
srp_path_rec_completion,
ch, &ch->path_query);
- if (ch->path_query_id < 0)
- return ch->path_query_id;
+ ret = ch->path_query_id;
+ if (ret < 0)
+ goto put;
ret = wait_for_completion_interruptible(&ch->done);
if (ret < 0)
- return ret;
+ goto put;
- if (ch->status < 0)
+ ret = ch->status;
+ if (ret < 0)
shost_printk(KERN_WARNING, target->scsi_host,
PFX "Path record query failed\n");
- return ch->status;
+put:
+ scsi_host_put(target->scsi_host);
+
+out:
+ return ret;
}
static int srp_send_req(struct srp_rdma_ch *ch, bool multich)
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 51/96] NFC: fix device-allocation error return
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (46 preceding siblings ...)
2017-11-28 10:22 ` [PATCH 4.4 50/96] IB/srp: Avoid that a cable pull can trigger a kernel crash Greg Kroah-Hartman
@ 2017-11-28 10:23 ` Greg Kroah-Hartman
2017-11-28 10:23 ` [PATCH 4.4 52/96] i40e: Use smp_rmb rather than read_barrier_depends Greg Kroah-Hartman
` (48 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Johan Hovold, Samuel Ortiz
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit c45e3e4c5b134b081e8af362109905427967eb19 upstream.
A recent change fixing NFC device allocation itself introduced an
error-handling bug by returning an error pointer in case device-id
allocation failed. This is clearly broken as the callers still expected
NULL to be returned on errors as detected by Dan's static checker.
Fix this up by returning NULL in the event that we've run out of memory
when allocating a new device id.
Note that the offending commit is marked for stable (3.8) so this fix
needs to be backported along with it.
Fixes: 20777bc57c34 ("NFC: fix broken device allocation")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/nfc/core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/nfc/core.c
+++ b/net/nfc/core.c
@@ -1093,7 +1093,7 @@ struct nfc_dev *nfc_allocate_device(stru
err_free_dev:
kfree(dev);
- return ERR_PTR(rc);
+ return NULL;
}
EXPORT_SYMBOL(nfc_allocate_device);
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 52/96] i40e: Use smp_rmb rather than read_barrier_depends
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (47 preceding siblings ...)
2017-11-28 10:23 ` [PATCH 4.4 51/96] NFC: fix device-allocation error return Greg Kroah-Hartman
@ 2017-11-28 10:23 ` Greg Kroah-Hartman
2017-11-28 10:23 ` [PATCH 4.4 53/96] igb: " Greg Kroah-Hartman
` (47 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Brian King, Jesse Brandeburg,
Andrew Bowers, Jeff Kirsher
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian King <brking@linux.vnet.ibm.com>
commit 52c6912fde0133981ee50ba08808f257829c4c93 upstream.
The original issue being fixed in this patch was seen with the ixgbe
driver, but the same issue exists with i40e as well, as the code is
very similar. read_barrier_depends is not sufficient to ensure
loads following it are not speculatively loaded out of order
by the CPU, which can result in stale data being loaded, causing
potential system crashes.
Signed-off-by: Brian King <brking@linux.vnet.ibm.com>
Acked-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/intel/i40e/i40e_main.c | 2 +-
drivers/net/ethernet/intel/i40e/i40e_txrx.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -3595,7 +3595,7 @@ static bool i40e_clean_fdir_tx_irq(struc
break;
/* prevent any other reads prior to eop_desc */
- read_barrier_depends();
+ smp_rmb();
/* if the descriptor isn't done, no work yet to do */
if (!(eop_desc->cmd_type_offset_bsz &
--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
@@ -663,7 +663,7 @@ static bool i40e_clean_tx_irq(struct i40
break;
/* prevent any other reads prior to eop_desc */
- read_barrier_depends();
+ smp_rmb();
/* we have caught up to head, no work left to do */
if (tx_head == tx_desc)
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 53/96] igb: Use smp_rmb rather than read_barrier_depends
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (48 preceding siblings ...)
2017-11-28 10:23 ` [PATCH 4.4 52/96] i40e: Use smp_rmb rather than read_barrier_depends Greg Kroah-Hartman
@ 2017-11-28 10:23 ` Greg Kroah-Hartman
2017-11-28 10:23 ` [PATCH 4.4 54/96] igbvf: " Greg Kroah-Hartman
` (46 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Brian King, Jesse Brandeburg,
Aaron Brown, Jeff Kirsher
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian King <brking@linux.vnet.ibm.com>
commit c4cb99185b4cc96c0a1c70104dc21ae14d7e7f28 upstream.
The original issue being fixed in this patch was seen with the ixgbe
driver, but the same issue exists with igb as well, as the code is
very similar. read_barrier_depends is not sufficient to ensure
loads following it are not speculatively loaded out of order
by the CPU, which can result in stale data being loaded, causing
potential system crashes.
Signed-off-by: Brian King <brking@linux.vnet.ibm.com>
Acked-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
Tested-by: Aaron Brown <aaron.f.brown@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/intel/igb/igb_main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -6433,7 +6433,7 @@ static bool igb_clean_tx_irq(struct igb_
break;
/* prevent any other reads prior to eop_desc */
- read_barrier_depends();
+ smp_rmb();
/* if DD is not set pending work has not been completed */
if (!(eop_desc->wb.status & cpu_to_le32(E1000_TXD_STAT_DD)))
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 54/96] igbvf: Use smp_rmb rather than read_barrier_depends
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (49 preceding siblings ...)
2017-11-28 10:23 ` [PATCH 4.4 53/96] igb: " Greg Kroah-Hartman
@ 2017-11-28 10:23 ` Greg Kroah-Hartman
2017-11-28 10:23 ` [PATCH 4.4 55/96] ixgbevf: " Greg Kroah-Hartman
` (45 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Brian King, Jesse Brandeburg,
Aaron Brown, Jeff Kirsher
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian King <brking@linux.vnet.ibm.com>
commit 1e1f9ca546556e508d021545861f6b5fc75a95fe upstream.
The original issue being fixed in this patch was seen with the ixgbe
driver, but the same issue exists with igbvf as well, as the code is
very similar. read_barrier_depends is not sufficient to ensure
loads following it are not speculatively loaded out of order
by the CPU, which can result in stale data being loaded, causing
potential system crashes.
Signed-off-by: Brian King <brking@linux.vnet.ibm.com>
Acked-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
Tested-by: Aaron Brown <aaron.f.brown@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/intel/igbvf/netdev.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/ethernet/intel/igbvf/netdev.c
+++ b/drivers/net/ethernet/intel/igbvf/netdev.c
@@ -809,7 +809,7 @@ static bool igbvf_clean_tx_irq(struct ig
break;
/* prevent any other reads prior to eop_desc */
- read_barrier_depends();
+ smp_rmb();
/* if DD is not set pending work has not been completed */
if (!(eop_desc->wb.status & cpu_to_le32(E1000_TXD_STAT_DD)))
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 55/96] ixgbevf: Use smp_rmb rather than read_barrier_depends
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (50 preceding siblings ...)
2017-11-28 10:23 ` [PATCH 4.4 54/96] igbvf: " Greg Kroah-Hartman
@ 2017-11-28 10:23 ` Greg Kroah-Hartman
2017-11-28 10:23 ` [PATCH 4.4 56/96] i40evf: " Greg Kroah-Hartman
` (44 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Brian King, Jesse Brandeburg,
Andrew Bowers, Jeff Kirsher
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian King <brking@linux.vnet.ibm.com>
commit ae0c585d93dfaf923d2c7eb44b2c3ab92854ea9b upstream.
The original issue being fixed in this patch was seen with the ixgbe
driver, but the same issue exists with ixgbevf as well, as the code is
very similar. read_barrier_depends is not sufficient to ensure
loads following it are not speculatively loaded out of order
by the CPU, which can result in stale data being loaded, causing
potential system crashes.
Signed-off-by: Brian King <brking@linux.vnet.ibm.com>
Acked-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
+++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
@@ -312,7 +312,7 @@ static bool ixgbevf_clean_tx_irq(struct
break;
/* prevent any other reads prior to eop_desc */
- read_barrier_depends();
+ smp_rmb();
/* if DD is not set pending work has not been completed */
if (!(eop_desc->wb.status & cpu_to_le32(IXGBE_TXD_STAT_DD)))
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 56/96] i40evf: Use smp_rmb rather than read_barrier_depends
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (51 preceding siblings ...)
2017-11-28 10:23 ` [PATCH 4.4 55/96] ixgbevf: " Greg Kroah-Hartman
@ 2017-11-28 10:23 ` Greg Kroah-Hartman
2017-11-28 10:23 ` [PATCH 4.4 57/96] fm10k: " Greg Kroah-Hartman
` (43 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Brian King, Jesse Brandeburg,
Andrew Bowers, Jeff Kirsher
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian King <brking@linux.vnet.ibm.com>
commit f72271e2a0ae4277d53c4053f5eed8bb346ba38a upstream.
The original issue being fixed in this patch was seen with the ixgbe
driver, but the same issue exists with i40evf as well, as the code is
very similar. read_barrier_depends is not sufficient to ensure
loads following it are not speculatively loaded out of order
by the CPU, which can result in stale data being loaded, causing
potential system crashes.
Signed-off-by: Brian King <brking@linux.vnet.ibm.com>
Acked-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/intel/i40evf/i40e_txrx.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
+++ b/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
@@ -172,7 +172,7 @@ static bool i40e_clean_tx_irq(struct i40
break;
/* prevent any other reads prior to eop_desc */
- read_barrier_depends();
+ smp_rmb();
/* we have caught up to head, no work left to do */
if (tx_head == tx_desc)
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 57/96] fm10k: Use smp_rmb rather than read_barrier_depends
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (52 preceding siblings ...)
2017-11-28 10:23 ` [PATCH 4.4 56/96] i40evf: " Greg Kroah-Hartman
@ 2017-11-28 10:23 ` Greg Kroah-Hartman
2017-11-28 10:23 ` [PATCH 4.4 58/96] ixgbe: Fix skb list corruption on Power systems Greg Kroah-Hartman
` (42 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Brian King, Jesse Brandeburg, Jeff Kirsher
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian King <brking@linux.vnet.ibm.com>
commit 7b8edcc685b5e2c3c37aa13dc50a88e84a5bfef8 upstream.
The original issue being fixed in this patch was seen with the ixgbe
driver, but the same issue exists with fm10k as well, as the code is
very similar. read_barrier_depends is not sufficient to ensure
loads following it are not speculatively loaded out of order
by the CPU, which can result in stale data being loaded, causing
potential system crashes.
Signed-off-by: Brian King <brking@linux.vnet.ibm.com>
Acked-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/intel/fm10k/fm10k_main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/ethernet/intel/fm10k/fm10k_main.c
+++ b/drivers/net/ethernet/intel/fm10k/fm10k_main.c
@@ -1226,7 +1226,7 @@ static bool fm10k_clean_tx_irq(struct fm
break;
/* prevent any other reads prior to eop_desc */
- read_barrier_depends();
+ smp_rmb();
/* if DD is not set pending work has not been completed */
if (!(eop_desc->flags & FM10K_TXD_FLAG_DONE))
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 58/96] ixgbe: Fix skb list corruption on Power systems
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (53 preceding siblings ...)
2017-11-28 10:23 ` [PATCH 4.4 57/96] fm10k: " Greg Kroah-Hartman
@ 2017-11-28 10:23 ` Greg Kroah-Hartman
2017-11-28 10:23 ` [PATCH 4.4 59/96] parisc: Fix validity check of pointer size argument in new CAS implementation Greg Kroah-Hartman
` (41 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Brian King, Jesse Brandeburg,
Andrew Bowers, Jeff Kirsher
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian King <brking@linux.vnet.ibm.com>
commit 0a9a17e3bb4564caf4bfe2a6783ae1287667d188 upstream.
This patch fixes an issue seen on Power systems with ixgbe which results
in skb list corruption and an eventual kernel oops. The following is what
was observed:
CPU 1 CPU2
============================ ============================
1: ixgbe_xmit_frame_ring ixgbe_clean_tx_irq
2: first->skb = skb eop_desc = tx_buffer->next_to_watch
3: ixgbe_tx_map read_barrier_depends()
4: wmb check adapter written status bit
5: first->next_to_watch = tx_desc napi_consume_skb(tx_buffer->skb ..);
6: writel(i, tx_ring->tail);
The read_barrier_depends is insufficient to ensure that tx_buffer->skb does not
get loaded prior to tx_buffer->next_to_watch, which then results in loading
a stale skb pointer. This patch replaces the read_barrier_depends with
smp_rmb to ensure loads are ordered with respect to the load of
tx_buffer->next_to_watch.
Signed-off-by: Brian King <brking@linux.vnet.ibm.com>
Acked-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -1114,7 +1114,7 @@ static bool ixgbe_clean_tx_irq(struct ix
break;
/* prevent any other reads prior to eop_desc */
- read_barrier_depends();
+ smp_rmb();
/* if DD is not set pending work has not been completed */
if (!(eop_desc->wb.status & cpu_to_le32(IXGBE_TXD_STAT_DD)))
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 59/96] parisc: Fix validity check of pointer size argument in new CAS implementation
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (54 preceding siblings ...)
2017-11-28 10:23 ` [PATCH 4.4 58/96] ixgbe: Fix skb list corruption on Power systems Greg Kroah-Hartman
@ 2017-11-28 10:23 ` Greg Kroah-Hartman
2017-11-28 10:23 ` [PATCH 4.4 60/96] powerpc/signal: Properly handle return value from uprobe_deny_signal() Greg Kroah-Hartman
` (40 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:23 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, John David Anglin, Helge Deller
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: John David Anglin <dave.anglin@bell.net>
commit 05f016d2ca7a4fab99d5d5472168506ddf95e74f upstream.
As noted by Christoph Biedl, passing a pointer size of 4 in the new CAS
implementation causes a kernel crash. The attached patch corrects the
off by one error in the argument validity check.
In reviewing the code, I noticed that we only perform word operations
with the pointer size argument. The subi instruction intentionally uses
a word condition on 64-bit kernels. Nullification was used instead of a
cmpib instruction as the branch should never be taken. The shlw
pseudo-operation generates a depw,z instruction and it clears the target
before doing a shift left word deposit. Thus, we don't need to clip the
upper 32 bits of this argument on 64-bit kernels.
Tested with a gcc testsuite run with a 64-bit kernel. The gcc atomic
code in libgcc is the only direct user of the new CAS implementation
that I am aware of.
Signed-off-by: John David Anglin <dave.anglin@bell.net>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/parisc/kernel/syscall.S | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/arch/parisc/kernel/syscall.S
+++ b/arch/parisc/kernel/syscall.S
@@ -688,15 +688,15 @@ cas_action:
/* ELF32 Process entry path */
lws_compare_and_swap_2:
#ifdef CONFIG_64BIT
- /* Clip the input registers */
+ /* Clip the input registers. We don't need to clip %r23 as we
+ only use it for word operations */
depdi 0, 31, 32, %r26
depdi 0, 31, 32, %r25
depdi 0, 31, 32, %r24
- depdi 0, 31, 32, %r23
#endif
/* Check the validity of the size pointer */
- subi,>>= 4, %r23, %r0
+ subi,>>= 3, %r23, %r0
b,n lws_exit_nosys
/* Jump to the functions which will load the old and new values into
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 60/96] powerpc/signal: Properly handle return value from uprobe_deny_signal()
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (55 preceding siblings ...)
2017-11-28 10:23 ` [PATCH 4.4 59/96] parisc: Fix validity check of pointer size argument in new CAS implementation Greg Kroah-Hartman
@ 2017-11-28 10:23 ` Greg Kroah-Hartman
2017-11-28 10:23 ` [PATCH 4.4 61/96] media: Dont do DMA on stack for firmware upload in the AS102 driver Greg Kroah-Hartman
` (39 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Anton Blanchard, Naveen N. Rao,
Michael Ellerman
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
commit 46725b17f1c6c815a41429259b3f070c01e71bc1 upstream.
When a uprobe is installed on an instruction that we currently do not
emulate, we copy the instruction into a xol buffer and single step
that instruction. If that instruction generates a fault, we abort the
single stepping before invoking the signal handler. Once the signal
handler is done, the uprobe trap is hit again since the instruction is
retried and the process repeats.
We use uprobe_deny_signal() to detect if the xol instruction triggered
a signal. If so, we clear TIF_SIGPENDING and set TIF_UPROBE so that the
signal is not handled until after the single stepping is aborted. In
this case, uprobe_deny_signal() returns true and get_signal() ends up
returning 0. However, in do_signal(), we are not looking at the return
value, but depending on ksig.sig for further action, all with an
uninitialized ksig that is not touched in this scenario. Fix the same
by initializing ksig.sig to 0.
Fixes: 129b69df9c90 ("powerpc: Use get_signal() signal_setup_done()")
Reported-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/kernel/signal.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/powerpc/kernel/signal.c
+++ b/arch/powerpc/kernel/signal.c
@@ -102,7 +102,7 @@ static void check_syscall_restart(struct
static void do_signal(struct pt_regs *regs)
{
sigset_t *oldset = sigmask_to_save();
- struct ksignal ksig;
+ struct ksignal ksig = { .sig = 0 };
int ret;
int is32 = is_32bit_task();
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 61/96] media: Dont do DMA on stack for firmware upload in the AS102 driver
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (56 preceding siblings ...)
2017-11-28 10:23 ` [PATCH 4.4 60/96] powerpc/signal: Properly handle return value from uprobe_deny_signal() Greg Kroah-Hartman
@ 2017-11-28 10:23 ` Greg Kroah-Hartman
2017-11-28 10:23 ` [PATCH 4.4 62/96] media: rc: check for integer overflow Greg Kroah-Hartman
` (38 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Michele Baldessari, Mauro Carvalho Chehab
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michele Baldessari <michele@acksyn.org>
commit b3120d2cc447ee77b9d69bf4ad7b452c9adb4d39 upstream.
Firmware load on AS102 is using the stack which is not allowed any
longer. We currently fail with:
kernel: transfer buffer not dma capable
kernel: ------------[ cut here ]------------
kernel: WARNING: CPU: 0 PID: 598 at drivers/usb/core/hcd.c:1595 usb_hcd_map_urb_for_dma+0x41d/0x620
kernel: Modules linked in: amd64_edac_mod(-) edac_mce_amd as102_fe dvb_as102(+) kvm_amd kvm snd_hda_codec_realtek dvb_core snd_hda_codec_generic snd_hda_codec_hdmi snd_hda_intel snd_hda_codec irqbypass crct10dif_pclmul crc32_pclmul snd_hda_core snd_hwdep snd_seq ghash_clmulni_intel sp5100_tco fam15h_power wmi k10temp i2c_piix4 snd_seq_device snd_pcm snd_timer parport_pc parport tpm_infineon snd tpm_tis soundcore tpm_tis_core tpm shpchp acpi_cpufreq xfs libcrc32c amdgpu amdkfd amd_iommu_v2 radeon hid_logitech_hidpp i2c_algo_bit drm_kms_helper crc32c_intel ttm drm r8169 mii hid_logitech_dj
kernel: CPU: 0 PID: 598 Comm: systemd-udevd Not tainted 4.13.10-200.fc26.x86_64 #1
kernel: Hardware name: ASUS All Series/AM1I-A, BIOS 0505 03/13/2014
kernel: task: ffff979933b24c80 task.stack: ffffaf83413a4000
kernel: RIP: 0010:usb_hcd_map_urb_for_dma+0x41d/0x620
systemd-fsck[659]: /dev/sda2: clean, 49/128016 files, 268609/512000 blocks
kernel: RSP: 0018:ffffaf83413a7728 EFLAGS: 00010282
systemd-udevd[604]: link_config: autonegotiation is unset or enabled, the speed and duplex are not writable.
kernel: RAX: 000000000000001f RBX: ffff979930bce780 RCX: 0000000000000000
kernel: RDX: 0000000000000000 RSI: ffff97993ec0e118 RDI: ffff97993ec0e118
kernel: RBP: ffffaf83413a7768 R08: 000000000000039a R09: 0000000000000000
kernel: R10: 0000000000000001 R11: 00000000ffffffff R12: 00000000fffffff5
kernel: R13: 0000000001400000 R14: 0000000000000001 R15: ffff979930806800
kernel: FS: 00007effaca5c8c0(0000) GS:ffff97993ec00000(0000) knlGS:0000000000000000
kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
kernel: CR2: 00007effa9fca962 CR3: 0000000233089000 CR4: 00000000000406f0
kernel: Call Trace:
kernel: usb_hcd_submit_urb+0x493/0xb40
kernel: ? page_cache_tree_insert+0x100/0x100
kernel: ? xfs_iunlock+0xd5/0x100 [xfs]
kernel: ? xfs_file_buffered_aio_read+0x57/0xc0 [xfs]
kernel: usb_submit_urb+0x22d/0x560
kernel: usb_start_wait_urb+0x6e/0x180
kernel: usb_bulk_msg+0xb8/0x160
kernel: as102_send_ep1+0x49/0xe0 [dvb_as102]
kernel: ? devres_add+0x3f/0x50
kernel: as102_firmware_upload.isra.0+0x1dc/0x210 [dvb_as102]
kernel: as102_fw_upload+0xb6/0x1f0 [dvb_as102]
kernel: as102_dvb_register+0x2af/0x2d0 [dvb_as102]
kernel: as102_usb_probe+0x1f3/0x260 [dvb_as102]
kernel: usb_probe_interface+0x124/0x300
kernel: driver_probe_device+0x2ff/0x450
kernel: __driver_attach+0xa4/0xe0
kernel: ? driver_probe_device+0x450/0x450
kernel: bus_for_each_dev+0x6e/0xb0
kernel: driver_attach+0x1e/0x20
kernel: bus_add_driver+0x1c7/0x270
kernel: driver_register+0x60/0xe0
kernel: usb_register_driver+0x81/0x150
kernel: ? 0xffffffffc0807000
kernel: as102_usb_driver_init+0x1e/0x1000 [dvb_as102]
kernel: do_one_initcall+0x50/0x190
kernel: ? __vunmap+0x81/0xb0
kernel: ? kfree+0x154/0x170
kernel: ? kmem_cache_alloc_trace+0x15f/0x1c0
kernel: ? do_init_module+0x27/0x1e9
kernel: do_init_module+0x5f/0x1e9
kernel: load_module+0x2602/0x2c30
kernel: SYSC_init_module+0x170/0x1a0
kernel: ? SYSC_init_module+0x170/0x1a0
kernel: SyS_init_module+0xe/0x10
kernel: do_syscall_64+0x67/0x140
kernel: entry_SYSCALL64_slow_path+0x25/0x25
kernel: RIP: 0033:0x7effab6cf3ea
kernel: RSP: 002b:00007fff5cfcbbc8 EFLAGS: 00000246 ORIG_RAX: 00000000000000af
kernel: RAX: ffffffffffffffda RBX: 00005569e0b83760 RCX: 00007effab6cf3ea
kernel: RDX: 00007effac2099c5 RSI: 0000000000009a13 RDI: 00005569e0b98c50
kernel: RBP: 00007effac2099c5 R08: 00005569e0b83ed0 R09: 0000000000001d80
kernel: R10: 00007effab98db00 R11: 0000000000000246 R12: 00005569e0b98c50
kernel: R13: 00005569e0b81c60 R14: 0000000000020000 R15: 00005569dfadfdf7
kernel: Code: 48 39 c8 73 30 80 3d 59 60 9d 00 00 41 bc f5 ff ff ff 0f 85 26 ff ff ff 48 c7 c7 b8 6b d0 92 c6 05 3f 60 9d 00 01 e8 24 3d ad ff <0f> ff 8b 53 64 e9 09 ff ff ff 65 48 8b 0c 25 00 d3 00 00 48 8b
kernel: ---[ end trace c4cae366180e70ec ]---
kernel: as10x_usb: error during firmware upload part1
Let's allocate the the structure dynamically so we can get the firmware
loaded correctly:
[ 14.243057] as10x_usb: firmware: as102_data1_st.hex loaded with success
[ 14.500777] as10x_usb: firmware: as102_data2_st.hex loaded with success
Signed-off-by: Michele Baldessari <michele@acksyn.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/as102/as102_fw.c | 28 +++++++++++++++++-----------
1 file changed, 17 insertions(+), 11 deletions(-)
--- a/drivers/media/usb/as102/as102_fw.c
+++ b/drivers/media/usb/as102/as102_fw.c
@@ -101,18 +101,23 @@ static int as102_firmware_upload(struct
unsigned char *cmd,
const struct firmware *firmware) {
- struct as10x_fw_pkt_t fw_pkt;
+ struct as10x_fw_pkt_t *fw_pkt;
int total_read_bytes = 0, errno = 0;
unsigned char addr_has_changed = 0;
+ fw_pkt = kmalloc(sizeof(*fw_pkt), GFP_KERNEL);
+ if (!fw_pkt)
+ return -ENOMEM;
+
+
for (total_read_bytes = 0; total_read_bytes < firmware->size; ) {
int read_bytes = 0, data_len = 0;
/* parse intel hex line */
read_bytes = parse_hex_line(
(u8 *) (firmware->data + total_read_bytes),
- fw_pkt.raw.address,
- fw_pkt.raw.data,
+ fw_pkt->raw.address,
+ fw_pkt->raw.data,
&data_len,
&addr_has_changed);
@@ -122,28 +127,28 @@ static int as102_firmware_upload(struct
/* detect the end of file */
total_read_bytes += read_bytes;
if (total_read_bytes == firmware->size) {
- fw_pkt.u.request[0] = 0x00;
- fw_pkt.u.request[1] = 0x03;
+ fw_pkt->u.request[0] = 0x00;
+ fw_pkt->u.request[1] = 0x03;
/* send EOF command */
errno = bus_adap->ops->upload_fw_pkt(bus_adap,
(uint8_t *)
- &fw_pkt, 2, 0);
+ fw_pkt, 2, 0);
if (errno < 0)
goto error;
} else {
if (!addr_has_changed) {
/* prepare command to send */
- fw_pkt.u.request[0] = 0x00;
- fw_pkt.u.request[1] = 0x01;
+ fw_pkt->u.request[0] = 0x00;
+ fw_pkt->u.request[1] = 0x01;
- data_len += sizeof(fw_pkt.u.request);
- data_len += sizeof(fw_pkt.raw.address);
+ data_len += sizeof(fw_pkt->u.request);
+ data_len += sizeof(fw_pkt->raw.address);
/* send cmd to device */
errno = bus_adap->ops->upload_fw_pkt(bus_adap,
(uint8_t *)
- &fw_pkt,
+ fw_pkt,
data_len,
0);
if (errno < 0)
@@ -152,6 +157,7 @@ static int as102_firmware_upload(struct
}
}
error:
+ kfree(fw_pkt);
return (errno == 0) ? total_read_bytes : errno;
}
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 62/96] media: rc: check for integer overflow
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (57 preceding siblings ...)
2017-11-28 10:23 ` [PATCH 4.4 61/96] media: Dont do DMA on stack for firmware upload in the AS102 driver Greg Kroah-Hartman
@ 2017-11-28 10:23 ` Greg Kroah-Hartman
2017-11-28 10:23 ` [PATCH 4.4 63/96] [media] cx231xx-cards: fix NULL-deref on missing association descriptor Greg Kroah-Hartman
` (37 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sean Young, Mauro Carvalho Chehab
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Young <sean@mess.org>
commit 3e45067f94bbd61dec0619b1c32744eb0de480c8 upstream.
The ioctl LIRC_SET_REC_TIMEOUT would set a timeout of 704ns if called
with a timeout of 4294968us.
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/rc/ir-lirc-codec.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
--- a/drivers/media/rc/ir-lirc-codec.c
+++ b/drivers/media/rc/ir-lirc-codec.c
@@ -286,11 +286,14 @@ static long ir_lirc_ioctl(struct file *f
if (!dev->max_timeout)
return -ENOSYS;
+ /* Check for multiply overflow */
+ if (val > U32_MAX / 1000)
+ return -EINVAL;
+
tmp = val * 1000;
- if (tmp < dev->min_timeout ||
- tmp > dev->max_timeout)
- return -EINVAL;
+ if (tmp < dev->min_timeout || tmp > dev->max_timeout)
+ return -EINVAL;
dev->timeout = tmp;
break;
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 63/96] [media] cx231xx-cards: fix NULL-deref on missing association descriptor
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (58 preceding siblings ...)
2017-11-28 10:23 ` [PATCH 4.4 62/96] media: rc: check for integer overflow Greg Kroah-Hartman
@ 2017-11-28 10:23 ` Greg Kroah-Hartman
2017-11-28 10:23 ` [PATCH 4.4 64/96] media: v4l2-ctrl: Fix flags field on Control events Greg Kroah-Hartman
` (36 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andrey Konovalov, Johan Hovold,
Hans Verkuil, Mauro Carvalho Chehab
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 6c3b047fa2d2286d5e438bcb470c7b1a49f415f6 upstream.
Make sure to check that we actually have an Interface Association
Descriptor before dereferencing it during probe to avoid dereferencing a
NULL-pointer.
Fixes: e0d3bafd0258 ("V4L/DVB (10954): Add cx231xx USB driver")
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/cx231xx/cx231xx-cards.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/media/usb/cx231xx/cx231xx-cards.c
+++ b/drivers/media/usb/cx231xx/cx231xx-cards.c
@@ -1672,7 +1672,7 @@ static int cx231xx_usb_probe(struct usb_
nr = dev->devno;
assoc_desc = udev->actconfig->intf_assoc[0];
- if (assoc_desc->bFirstInterface != ifnum) {
+ if (!assoc_desc || assoc_desc->bFirstInterface != ifnum) {
dev_err(d, "Not found matching IAD interface\n");
retval = -ENODEV;
goto err_if;
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 64/96] media: v4l2-ctrl: Fix flags field on Control events
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (59 preceding siblings ...)
2017-11-28 10:23 ` [PATCH 4.4 63/96] [media] cx231xx-cards: fix NULL-deref on missing association descriptor Greg Kroah-Hartman
@ 2017-11-28 10:23 ` Greg Kroah-Hartman
2017-11-28 10:23 ` [PATCH 4.4 65/96] sched/rt: Simplify the IPI based RT balancing logic Greg Kroah-Hartman
` (35 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dimitrios Katsaros,
Ricardo Ribalda Delgado, Hans Verkuil, Mauro Carvalho Chehab
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Ribalda Delgado <ricardo.ribalda@gmail.com>
commit 9cac9d2fb2fe0e0cadacdb94415b3fe49e3f724f upstream.
VIDIOC_DQEVENT and VIDIOC_QUERY_EXT_CTRL should give the same output for
the control flags field.
This patch creates a new function user_flags(), that calculates the user
exported flags value (which is different than the kernel internal flags
structure). This function is then used by all the code that exports the
internal flags to userspace.
Reported-by: Dimitrios Katsaros <patcherwork@gmail.com>
Signed-off-by: Ricardo Ribalda Delgado <ricardo.ribalda@gmail.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/v4l2-core/v4l2-ctrls.c | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)
--- a/drivers/media/v4l2-core/v4l2-ctrls.c
+++ b/drivers/media/v4l2-core/v4l2-ctrls.c
@@ -1200,6 +1200,16 @@ void v4l2_ctrl_fill(u32 id, const char *
}
EXPORT_SYMBOL(v4l2_ctrl_fill);
+static u32 user_flags(const struct v4l2_ctrl *ctrl)
+{
+ u32 flags = ctrl->flags;
+
+ if (ctrl->is_ptr)
+ flags |= V4L2_CTRL_FLAG_HAS_PAYLOAD;
+
+ return flags;
+}
+
static void fill_event(struct v4l2_event *ev, struct v4l2_ctrl *ctrl, u32 changes)
{
memset(ev->reserved, 0, sizeof(ev->reserved));
@@ -1207,7 +1217,7 @@ static void fill_event(struct v4l2_event
ev->id = ctrl->id;
ev->u.ctrl.changes = changes;
ev->u.ctrl.type = ctrl->type;
- ev->u.ctrl.flags = ctrl->flags;
+ ev->u.ctrl.flags = user_flags(ctrl);
if (ctrl->is_ptr)
ev->u.ctrl.value64 = 0;
else
@@ -2536,10 +2546,8 @@ int v4l2_query_ext_ctrl(struct v4l2_ctrl
else
qc->id = ctrl->id;
strlcpy(qc->name, ctrl->name, sizeof(qc->name));
- qc->flags = ctrl->flags;
+ qc->flags = user_flags(ctrl);
qc->type = ctrl->type;
- if (ctrl->is_ptr)
- qc->flags |= V4L2_CTRL_FLAG_HAS_PAYLOAD;
qc->elem_size = ctrl->elem_size;
qc->elems = ctrl->elems;
qc->nr_of_dims = ctrl->nr_of_dims;
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 65/96] sched/rt: Simplify the IPI based RT balancing logic
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (60 preceding siblings ...)
2017-11-28 10:23 ` [PATCH 4.4 64/96] media: v4l2-ctrl: Fix flags field on Control events Greg Kroah-Hartman
@ 2017-11-28 10:23 ` Greg Kroah-Hartman
2017-11-28 10:23 ` [PATCH 4.4 66/96] fscrypt: lock mutex before checking for bounce page pool Greg Kroah-Hartman
` (34 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Steven Rostedt (VMware),
Peter Zijlstra (Intel),
Clark Williams, Daniel Bristot de Oliveira, John Kacur,
Linus Torvalds, Mike Galbraith, Scott Wood, Thomas Gleixner,
Ingo Molnar
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt (Red Hat) <rostedt@goodmis.org>
commit 4bdced5c9a2922521e325896a7bbbf0132c94e56 upstream.
When a CPU lowers its priority (schedules out a high priority task for a
lower priority one), a check is made to see if any other CPU has overloaded
RT tasks (more than one). It checks the rto_mask to determine this and if so
it will request to pull one of those tasks to itself if the non running RT
task is of higher priority than the new priority of the next task to run on
the current CPU.
When we deal with large number of CPUs, the original pull logic suffered
from large lock contention on a single CPU run queue, which caused a huge
latency across all CPUs. This was caused by only having one CPU having
overloaded RT tasks and a bunch of other CPUs lowering their priority. To
solve this issue, commit:
b6366f048e0c ("sched/rt: Use IPI to trigger RT task push migration instead of pulling")
changed the way to request a pull. Instead of grabbing the lock of the
overloaded CPU's runqueue, it simply sent an IPI to that CPU to do the work.
Although the IPI logic worked very well in removing the large latency build
up, it still could suffer from a large number of IPIs being sent to a single
CPU. On a 80 CPU box, I measured over 200us of processing IPIs. Worse yet,
when I tested this on a 120 CPU box, with a stress test that had lots of
RT tasks scheduling on all CPUs, it actually triggered the hard lockup
detector! One CPU had so many IPIs sent to it, and due to the restart
mechanism that is triggered when the source run queue has a priority status
change, the CPU spent minutes! processing the IPIs.
Thinking about this further, I realized there's no reason for each run queue
to send its own IPI. As all CPUs with overloaded tasks must be scanned
regardless if there's one or many CPUs lowering their priority, because
there's no current way to find the CPU with the highest priority task that
can schedule to one of these CPUs, there really only needs to be one IPI
being sent around at a time.
This greatly simplifies the code!
The new approach is to have each root domain have its own irq work, as the
rto_mask is per root domain. The root domain has the following fields
attached to it:
rto_push_work - the irq work to process each CPU set in rto_mask
rto_lock - the lock to protect some of the other rto fields
rto_loop_start - an atomic that keeps contention down on rto_lock
the first CPU scheduling in a lower priority task
is the one to kick off the process.
rto_loop_next - an atomic that gets incremented for each CPU that
schedules in a lower priority task.
rto_loop - a variable protected by rto_lock that is used to
compare against rto_loop_next
rto_cpu - The cpu to send the next IPI to, also protected by
the rto_lock.
When a CPU schedules in a lower priority task and wants to make sure
overloaded CPUs know about it. It increments the rto_loop_next. Then it
atomically sets rto_loop_start with a cmpxchg. If the old value is not "0",
then it is done, as another CPU is kicking off the IPI loop. If the old
value is "0", then it will take the rto_lock to synchronize with a possible
IPI being sent around to the overloaded CPUs.
If rto_cpu is greater than or equal to nr_cpu_ids, then there's either no
IPI being sent around, or one is about to finish. Then rto_cpu is set to the
first CPU in rto_mask and an IPI is sent to that CPU. If there's no CPUs set
in rto_mask, then there's nothing to be done.
When the CPU receives the IPI, it will first try to push any RT tasks that is
queued on the CPU but can't run because a higher priority RT task is
currently running on that CPU.
Then it takes the rto_lock and looks for the next CPU in the rto_mask. If it
finds one, it simply sends an IPI to that CPU and the process continues.
If there's no more CPUs in the rto_mask, then rto_loop is compared with
rto_loop_next. If they match, everything is done and the process is over. If
they do not match, then a CPU scheduled in a lower priority task as the IPI
was being passed around, and the process needs to start again. The first CPU
in rto_mask is sent the IPI.
This change removes this duplication of work in the IPI logic, and greatly
lowers the latency caused by the IPIs. This removed the lockup happening on
the 120 CPU machine. It also simplifies the code tremendously. What else
could anyone ask for?
Thanks to Peter Zijlstra for simplifying the rto_loop_start atomic logic and
supplying me with the rto_start_trylock() and rto_start_unlock() helper
functions.
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Clark Williams <williams@redhat.com>
Cc: Daniel Bristot de Oliveira <bristot@redhat.com>
Cc: John Kacur <jkacur@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Mike Galbraith <efault@gmx.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Scott Wood <swood@redhat.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/20170424114732.1aac6dc4@gandalf.local.home
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/sched/core.c | 6 +
kernel/sched/rt.c | 235 ++++++++++++++++++++++++---------------------------
kernel/sched/sched.h | 24 +++--
3 files changed, 138 insertions(+), 127 deletions(-)
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -5907,6 +5907,12 @@ static int init_rootdomain(struct root_d
if (!zalloc_cpumask_var(&rd->rto_mask, GFP_KERNEL))
goto free_dlo_mask;
+#ifdef HAVE_RT_PUSH_IPI
+ rd->rto_cpu = -1;
+ raw_spin_lock_init(&rd->rto_lock);
+ init_irq_work(&rd->rto_push_work, rto_push_irq_work_func);
+#endif
+
init_dl_bw(&rd->dl_bw);
if (cpudl_init(&rd->cpudl) != 0)
goto free_dlo_mask;
--- a/kernel/sched/rt.c
+++ b/kernel/sched/rt.c
@@ -64,10 +64,6 @@ static void start_rt_bandwidth(struct rt
raw_spin_unlock(&rt_b->rt_runtime_lock);
}
-#if defined(CONFIG_SMP) && defined(HAVE_RT_PUSH_IPI)
-static void push_irq_work_func(struct irq_work *work);
-#endif
-
void init_rt_rq(struct rt_rq *rt_rq)
{
struct rt_prio_array *array;
@@ -87,13 +83,6 @@ void init_rt_rq(struct rt_rq *rt_rq)
rt_rq->rt_nr_migratory = 0;
rt_rq->overloaded = 0;
plist_head_init(&rt_rq->pushable_tasks);
-
-#ifdef HAVE_RT_PUSH_IPI
- rt_rq->push_flags = 0;
- rt_rq->push_cpu = nr_cpu_ids;
- raw_spin_lock_init(&rt_rq->push_lock);
- init_irq_work(&rt_rq->push_work, push_irq_work_func);
-#endif
#endif /* CONFIG_SMP */
/* We start is dequeued state, because no RT tasks are queued */
rt_rq->rt_queued = 0;
@@ -1802,160 +1791,166 @@ static void push_rt_tasks(struct rq *rq)
}
#ifdef HAVE_RT_PUSH_IPI
+
/*
- * The search for the next cpu always starts at rq->cpu and ends
- * when we reach rq->cpu again. It will never return rq->cpu.
- * This returns the next cpu to check, or nr_cpu_ids if the loop
- * is complete.
+ * When a high priority task schedules out from a CPU and a lower priority
+ * task is scheduled in, a check is made to see if there's any RT tasks
+ * on other CPUs that are waiting to run because a higher priority RT task
+ * is currently running on its CPU. In this case, the CPU with multiple RT
+ * tasks queued on it (overloaded) needs to be notified that a CPU has opened
+ * up that may be able to run one of its non-running queued RT tasks.
+ *
+ * All CPUs with overloaded RT tasks need to be notified as there is currently
+ * no way to know which of these CPUs have the highest priority task waiting
+ * to run. Instead of trying to take a spinlock on each of these CPUs,
+ * which has shown to cause large latency when done on machines with many
+ * CPUs, sending an IPI to the CPUs to have them push off the overloaded
+ * RT tasks waiting to run.
+ *
+ * Just sending an IPI to each of the CPUs is also an issue, as on large
+ * count CPU machines, this can cause an IPI storm on a CPU, especially
+ * if its the only CPU with multiple RT tasks queued, and a large number
+ * of CPUs scheduling a lower priority task at the same time.
+ *
+ * Each root domain has its own irq work function that can iterate over
+ * all CPUs with RT overloaded tasks. Since all CPUs with overloaded RT
+ * tassk must be checked if there's one or many CPUs that are lowering
+ * their priority, there's a single irq work iterator that will try to
+ * push off RT tasks that are waiting to run.
+ *
+ * When a CPU schedules a lower priority task, it will kick off the
+ * irq work iterator that will jump to each CPU with overloaded RT tasks.
+ * As it only takes the first CPU that schedules a lower priority task
+ * to start the process, the rto_start variable is incremented and if
+ * the atomic result is one, then that CPU will try to take the rto_lock.
+ * This prevents high contention on the lock as the process handles all
+ * CPUs scheduling lower priority tasks.
+ *
+ * All CPUs that are scheduling a lower priority task will increment the
+ * rt_loop_next variable. This will make sure that the irq work iterator
+ * checks all RT overloaded CPUs whenever a CPU schedules a new lower
+ * priority task, even if the iterator is in the middle of a scan. Incrementing
+ * the rt_loop_next will cause the iterator to perform another scan.
*
- * rq->rt.push_cpu holds the last cpu returned by this function,
- * or if this is the first instance, it must hold rq->cpu.
*/
static int rto_next_cpu(struct rq *rq)
{
- int prev_cpu = rq->rt.push_cpu;
+ struct root_domain *rd = rq->rd;
+ int next;
int cpu;
- cpu = cpumask_next(prev_cpu, rq->rd->rto_mask);
-
/*
- * If the previous cpu is less than the rq's CPU, then it already
- * passed the end of the mask, and has started from the beginning.
- * We end if the next CPU is greater or equal to rq's CPU.
+ * When starting the IPI RT pushing, the rto_cpu is set to -1,
+ * rt_next_cpu() will simply return the first CPU found in
+ * the rto_mask.
+ *
+ * If rto_next_cpu() is called with rto_cpu is a valid cpu, it
+ * will return the next CPU found in the rto_mask.
+ *
+ * If there are no more CPUs left in the rto_mask, then a check is made
+ * against rto_loop and rto_loop_next. rto_loop is only updated with
+ * the rto_lock held, but any CPU may increment the rto_loop_next
+ * without any locking.
*/
- if (prev_cpu < rq->cpu) {
- if (cpu >= rq->cpu)
- return nr_cpu_ids;
+ for (;;) {
- } else if (cpu >= nr_cpu_ids) {
- /*
- * We passed the end of the mask, start at the beginning.
- * If the result is greater or equal to the rq's CPU, then
- * the loop is finished.
- */
- cpu = cpumask_first(rq->rd->rto_mask);
- if (cpu >= rq->cpu)
- return nr_cpu_ids;
- }
- rq->rt.push_cpu = cpu;
+ /* When rto_cpu is -1 this acts like cpumask_first() */
+ cpu = cpumask_next(rd->rto_cpu, rd->rto_mask);
- /* Return cpu to let the caller know if the loop is finished or not */
- return cpu;
-}
+ rd->rto_cpu = cpu;
-static int find_next_push_cpu(struct rq *rq)
-{
- struct rq *next_rq;
- int cpu;
+ if (cpu < nr_cpu_ids)
+ return cpu;
- while (1) {
- cpu = rto_next_cpu(rq);
- if (cpu >= nr_cpu_ids)
- break;
- next_rq = cpu_rq(cpu);
+ rd->rto_cpu = -1;
+
+ /*
+ * ACQUIRE ensures we see the @rto_mask changes
+ * made prior to the @next value observed.
+ *
+ * Matches WMB in rt_set_overload().
+ */
+ next = atomic_read_acquire(&rd->rto_loop_next);
- /* Make sure the next rq can push to this rq */
- if (next_rq->rt.highest_prio.next < rq->rt.highest_prio.curr)
+ if (rd->rto_loop == next)
break;
+
+ rd->rto_loop = next;
}
- return cpu;
+ return -1;
}
-#define RT_PUSH_IPI_EXECUTING 1
-#define RT_PUSH_IPI_RESTART 2
+static inline bool rto_start_trylock(atomic_t *v)
+{
+ return !atomic_cmpxchg_acquire(v, 0, 1);
+}
-static void tell_cpu_to_push(struct rq *rq)
+static inline void rto_start_unlock(atomic_t *v)
{
- int cpu;
+ atomic_set_release(v, 0);
+}
- if (rq->rt.push_flags & RT_PUSH_IPI_EXECUTING) {
- raw_spin_lock(&rq->rt.push_lock);
- /* Make sure it's still executing */
- if (rq->rt.push_flags & RT_PUSH_IPI_EXECUTING) {
- /*
- * Tell the IPI to restart the loop as things have
- * changed since it started.
- */
- rq->rt.push_flags |= RT_PUSH_IPI_RESTART;
- raw_spin_unlock(&rq->rt.push_lock);
- return;
- }
- raw_spin_unlock(&rq->rt.push_lock);
- }
+static void tell_cpu_to_push(struct rq *rq)
+{
+ int cpu = -1;
- /* When here, there's no IPI going around */
+ /* Keep the loop going if the IPI is currently active */
+ atomic_inc(&rq->rd->rto_loop_next);
- rq->rt.push_cpu = rq->cpu;
- cpu = find_next_push_cpu(rq);
- if (cpu >= nr_cpu_ids)
+ /* Only one CPU can initiate a loop at a time */
+ if (!rto_start_trylock(&rq->rd->rto_loop_start))
return;
- rq->rt.push_flags = RT_PUSH_IPI_EXECUTING;
+ raw_spin_lock(&rq->rd->rto_lock);
+
+ /*
+ * The rto_cpu is updated under the lock, if it has a valid cpu
+ * then the IPI is still running and will continue due to the
+ * update to loop_next, and nothing needs to be done here.
+ * Otherwise it is finishing up and an ipi needs to be sent.
+ */
+ if (rq->rd->rto_cpu < 0)
+ cpu = rto_next_cpu(rq);
+
+ raw_spin_unlock(&rq->rd->rto_lock);
- irq_work_queue_on(&rq->rt.push_work, cpu);
+ rto_start_unlock(&rq->rd->rto_loop_start);
+
+ if (cpu >= 0)
+ irq_work_queue_on(&rq->rd->rto_push_work, cpu);
}
/* Called from hardirq context */
-static void try_to_push_tasks(void *arg)
+void rto_push_irq_work_func(struct irq_work *work)
{
- struct rt_rq *rt_rq = arg;
- struct rq *rq, *src_rq;
- int this_cpu;
+ struct rq *rq;
int cpu;
- this_cpu = rt_rq->push_cpu;
+ rq = this_rq();
- /* Paranoid check */
- BUG_ON(this_cpu != smp_processor_id());
-
- rq = cpu_rq(this_cpu);
- src_rq = rq_of_rt_rq(rt_rq);
-
-again:
+ /*
+ * We do not need to grab the lock to check for has_pushable_tasks.
+ * When it gets updated, a check is made if a push is possible.
+ */
if (has_pushable_tasks(rq)) {
raw_spin_lock(&rq->lock);
- push_rt_task(rq);
+ push_rt_tasks(rq);
raw_spin_unlock(&rq->lock);
}
- /* Pass the IPI to the next rt overloaded queue */
- raw_spin_lock(&rt_rq->push_lock);
- /*
- * If the source queue changed since the IPI went out,
- * we need to restart the search from that CPU again.
- */
- if (rt_rq->push_flags & RT_PUSH_IPI_RESTART) {
- rt_rq->push_flags &= ~RT_PUSH_IPI_RESTART;
- rt_rq->push_cpu = src_rq->cpu;
- }
+ raw_spin_lock(&rq->rd->rto_lock);
- cpu = find_next_push_cpu(src_rq);
+ /* Pass the IPI to the next rt overloaded queue */
+ cpu = rto_next_cpu(rq);
- if (cpu >= nr_cpu_ids)
- rt_rq->push_flags &= ~RT_PUSH_IPI_EXECUTING;
- raw_spin_unlock(&rt_rq->push_lock);
+ raw_spin_unlock(&rq->rd->rto_lock);
- if (cpu >= nr_cpu_ids)
+ if (cpu < 0)
return;
- /*
- * It is possible that a restart caused this CPU to be
- * chosen again. Don't bother with an IPI, just see if we
- * have more to push.
- */
- if (unlikely(cpu == rq->cpu))
- goto again;
-
/* Try the next RT overloaded CPU */
- irq_work_queue_on(&rt_rq->push_work, cpu);
-}
-
-static void push_irq_work_func(struct irq_work *work)
-{
- struct rt_rq *rt_rq = container_of(work, struct rt_rq, push_work);
-
- try_to_push_tasks(rt_rq);
+ irq_work_queue_on(&rq->rd->rto_push_work, cpu);
}
#endif /* HAVE_RT_PUSH_IPI */
--- a/kernel/sched/sched.h
+++ b/kernel/sched/sched.h
@@ -429,7 +429,7 @@ static inline int rt_bandwidth_enabled(v
}
/* RT IPI pull logic requires IRQ_WORK */
-#ifdef CONFIG_IRQ_WORK
+#if defined(CONFIG_IRQ_WORK) && defined(CONFIG_SMP)
# define HAVE_RT_PUSH_IPI
#endif
@@ -450,12 +450,6 @@ struct rt_rq {
unsigned long rt_nr_total;
int overloaded;
struct plist_head pushable_tasks;
-#ifdef HAVE_RT_PUSH_IPI
- int push_flags;
- int push_cpu;
- struct irq_work push_work;
- raw_spinlock_t push_lock;
-#endif
#endif /* CONFIG_SMP */
int rt_queued;
@@ -537,6 +531,19 @@ struct root_domain {
struct dl_bw dl_bw;
struct cpudl cpudl;
+#ifdef HAVE_RT_PUSH_IPI
+ /*
+ * For IPI pull requests, loop across the rto_mask.
+ */
+ struct irq_work rto_push_work;
+ raw_spinlock_t rto_lock;
+ /* These are only updated and read within rto_lock */
+ int rto_loop;
+ int rto_cpu;
+ /* These atomics are updated outside of a lock */
+ atomic_t rto_loop_next;
+ atomic_t rto_loop_start;
+#endif
/*
* The "RT overload" flag: it gets set if a CPU has more than
* one runnable RT task.
@@ -547,6 +554,9 @@ struct root_domain {
extern struct root_domain def_root_domain;
+#ifdef HAVE_RT_PUSH_IPI
+extern void rto_push_irq_work_func(struct irq_work *work);
+#endif
#endif /* CONFIG_SMP */
/*
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 66/96] fscrypt: lock mutex before checking for bounce page pool
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (61 preceding siblings ...)
2017-11-28 10:23 ` [PATCH 4.4 65/96] sched/rt: Simplify the IPI based RT balancing logic Greg Kroah-Hartman
@ 2017-11-28 10:23 ` Greg Kroah-Hartman
2017-11-28 10:23 ` [PATCH 4.4 67/96] net/9p: Switch to wait_event_killable() Greg Kroah-Hartman
` (33 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:23 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Eric Biggers, Theodore Tso
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <ebiggers@google.com>
commit a0b3bc855374c50b5ea85273553485af48caf2f7 upstream.
fscrypt_initialize(), which allocates the global bounce page pool when
an encrypted file is first accessed, uses "double-checked locking" to
try to avoid locking fscrypt_init_mutex. However, it doesn't use any
memory barriers, so it's theoretically possible for a thread to observe
a bounce page pool which has not been fully initialized. This is a
classic bug with "double-checked locking".
While "only a theoretical issue" in the latest kernel, in pre-4.8
kernels the pointer that was checked was not even the last to be
initialized, so it was easily possible for a crash (NULL pointer
dereference) to happen. This was changed only incidentally by the large
refactor to use fs/crypto/.
Solve both problems in a trivial way that can easily be backported: just
always take the mutex. It's theoretically less efficient, but it
shouldn't be noticeable in practice as the mutex is only acquired very
briefly once per encrypted file.
Later I'd like to make this use a helper macro like DO_ONCE(). However,
DO_ONCE() runs in atomic context, so we'd need to add a new macro that
allows blocking.
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext4/crypto_key.c | 8 +++-----
1 file changed, 3 insertions(+), 5 deletions(-)
--- a/fs/ext4/crypto_key.c
+++ b/fs/ext4/crypto_key.c
@@ -129,11 +129,9 @@ int ext4_get_encryption_info(struct inod
if (ei->i_crypt_info)
return 0;
- if (!ext4_read_workqueue) {
- res = ext4_init_crypto();
- if (res)
- return res;
- }
+ res = ext4_init_crypto();
+ if (res)
+ return res;
res = ext4_xattr_get(inode, EXT4_XATTR_INDEX_ENCRYPTION,
EXT4_XATTR_NAME_ENCRYPTION_CONTEXT,
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 67/96] net/9p: Switch to wait_event_killable()
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (62 preceding siblings ...)
2017-11-28 10:23 ` [PATCH 4.4 66/96] fscrypt: lock mutex before checking for bounce page pool Greg Kroah-Hartman
@ 2017-11-28 10:23 ` Greg Kroah-Hartman
2017-11-28 10:23 ` [PATCH 4.4 68/96] PM / OPP: Add missing of_node_put(np) Greg Kroah-Hartman
` (32 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:23 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Tuomas Tynkkynen, Al Viro
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tuomas Tynkkynen <tuomas@tuxera.com>
commit 9523feac272ccad2ad8186ba4fcc89103754de52 upstream.
Because userspace gets Very Unhappy when calls like stat() and execve()
return -EINTR on 9p filesystem mounts. For instance, when bash is
looking in PATH for things to execute and some SIGCHLD interrupts
stat(), bash can throw a spurious 'command not found' since it doesn't
retry the stat().
In practice, hitting the problem is rare and needs a really
slow/bogged down 9p server.
Signed-off-by: Tuomas Tynkkynen <tuomas@tuxera.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/9p/client.c | 3 +--
net/9p/trans_virtio.c | 13 ++++++-------
2 files changed, 7 insertions(+), 9 deletions(-)
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -749,8 +749,7 @@ p9_client_rpc(struct p9_client *c, int8_
}
again:
/* Wait for the response */
- err = wait_event_interruptible(*req->wq,
- req->status >= REQ_STATUS_RCVD);
+ err = wait_event_killable(*req->wq, req->status >= REQ_STATUS_RCVD);
/*
* Make sure our req is coherent with regard to updates in other
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -290,8 +290,8 @@ req_retry:
if (err == -ENOSPC) {
chan->ring_bufs_avail = 0;
spin_unlock_irqrestore(&chan->lock, flags);
- err = wait_event_interruptible(*chan->vc_wq,
- chan->ring_bufs_avail);
+ err = wait_event_killable(*chan->vc_wq,
+ chan->ring_bufs_avail);
if (err == -ERESTARTSYS)
return err;
@@ -331,7 +331,7 @@ static int p9_get_mapped_pages(struct vi
* Other zc request to finish here
*/
if (atomic_read(&vp_pinned) >= chan->p9_max_pages) {
- err = wait_event_interruptible(vp_wq,
+ err = wait_event_killable(vp_wq,
(atomic_read(&vp_pinned) < chan->p9_max_pages));
if (err == -ERESTARTSYS)
return err;
@@ -475,8 +475,8 @@ req_retry_pinned:
if (err == -ENOSPC) {
chan->ring_bufs_avail = 0;
spin_unlock_irqrestore(&chan->lock, flags);
- err = wait_event_interruptible(*chan->vc_wq,
- chan->ring_bufs_avail);
+ err = wait_event_killable(*chan->vc_wq,
+ chan->ring_bufs_avail);
if (err == -ERESTARTSYS)
goto err_out;
@@ -493,8 +493,7 @@ req_retry_pinned:
virtqueue_kick(chan->vq);
spin_unlock_irqrestore(&chan->lock, flags);
p9_debug(P9_DEBUG_TRANS, "virtio request kicked\n");
- err = wait_event_interruptible(*req->wq,
- req->status >= REQ_STATUS_RCVD);
+ err = wait_event_killable(*req->wq, req->status >= REQ_STATUS_RCVD);
/*
* Non kernel buffers are pinned, unpin them
*/
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 68/96] PM / OPP: Add missing of_node_put(np)
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (63 preceding siblings ...)
2017-11-28 10:23 ` [PATCH 4.4 67/96] net/9p: Switch to wait_event_killable() Greg Kroah-Hartman
@ 2017-11-28 10:23 ` Greg Kroah-Hartman
2017-11-28 10:23 ` [PATCH 4.4 69/96] e1000e: Fix error path in link detection Greg Kroah-Hartman
` (31 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tobias Jordan, Viresh Kumar,
Stephen Boyd, Rafael J. Wysocki
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tobias Jordan <Tobias.Jordan@elektrobit.com>
commit 7978db344719dab1e56d05e6fc04aaaddcde0a5e upstream.
The for_each_available_child_of_node() loop in _of_add_opp_table_v2()
doesn't drop the reference to "np" on errors. Fix that.
Fixes: 274659029c9d (PM / OPP: Add support to parse "operating-points-v2" bindings)
Signed-off-by: Tobias Jordan <Tobias.Jordan@elektrobit.com>
[ VK: Improved commit log. ]
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Reviewed-by: Stephen Boyd <sboyd@codeaurora.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/base/power/opp/core.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/base/power/opp/core.c
+++ b/drivers/base/power/opp/core.c
@@ -1205,6 +1205,7 @@ static int _of_add_opp_table_v2(struct d
if (ret) {
dev_err(dev, "%s: Failed to add OPP, %d\n", __func__,
ret);
+ of_node_put(np);
goto free_table;
}
}
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 69/96] e1000e: Fix error path in link detection
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (64 preceding siblings ...)
2017-11-28 10:23 ` [PATCH 4.4 68/96] PM / OPP: Add missing of_node_put(np) Greg Kroah-Hartman
@ 2017-11-28 10:23 ` Greg Kroah-Hartman
2017-11-28 10:23 ` [PATCH 4.4 70/96] e1000e: Fix return value test Greg Kroah-Hartman
` (30 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Benjamin Poirier, Aaron Brown,
Jeff Kirsher, Amit Pundir
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Poirier <bpoirier@suse.com>
commit c4c40e51f9c32c6dd8adf606624c930a1c4d9bbb upstream.
In case of error from e1e_rphy(), the loop will exit early and "success"
will be set to true erroneously.
Signed-off-by: Benjamin Poirier <bpoirier@suse.com>
Tested-by: Aaron Brown <aaron.f.brown@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/intel/e1000e/phy.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/drivers/net/ethernet/intel/e1000e/phy.c
+++ b/drivers/net/ethernet/intel/e1000e/phy.c
@@ -1744,6 +1744,7 @@ s32 e1000e_phy_has_link_generic(struct e
s32 ret_val = 0;
u16 i, phy_status;
+ *success = false;
for (i = 0; i < iterations; i++) {
/* Some PHYs require the MII_BMSR register to be read
* twice due to the link bit being sticky. No harm doing
@@ -1763,16 +1764,16 @@ s32 e1000e_phy_has_link_generic(struct e
ret_val = e1e_rphy(hw, MII_BMSR, &phy_status);
if (ret_val)
break;
- if (phy_status & BMSR_LSTATUS)
+ if (phy_status & BMSR_LSTATUS) {
+ *success = true;
break;
+ }
if (usec_interval >= 1000)
msleep(usec_interval / 1000);
else
udelay(usec_interval);
}
- *success = (i < iterations);
-
return ret_val;
}
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 70/96] e1000e: Fix return value test
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (65 preceding siblings ...)
2017-11-28 10:23 ` [PATCH 4.4 69/96] e1000e: Fix error path in link detection Greg Kroah-Hartman
@ 2017-11-28 10:23 ` Greg Kroah-Hartman
2017-11-28 10:23 ` [PATCH 4.4 71/96] e1000e: Separate signaling for link check/link up Greg Kroah-Hartman
` (29 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Benjamin Poirier, Aaron Brown,
Jeff Kirsher, Amit Pundir
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Poirier <bpoirier@suse.com>
commit d3509f8bc7b0560044c15f0e3ecfde1d9af757a6 upstream.
All the helpers return -E1000_ERR_PHY.
Signed-off-by: Benjamin Poirier <bpoirier@suse.com>
Tested-by: Aaron Brown <aaron.f.brown@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/intel/e1000e/netdev.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -5035,7 +5035,7 @@ static bool e1000e_has_link(struct e1000
break;
}
- if ((ret_val == E1000_ERR_PHY) && (hw->phy.type == e1000_phy_igp_3) &&
+ if ((ret_val == -E1000_ERR_PHY) && (hw->phy.type == e1000_phy_igp_3) &&
(er32(CTRL) & E1000_PHY_CTRL_GBE_DISABLE)) {
/* See e1000_kmrn_lock_loss_workaround_ich8lan() */
e_info("Gigabit has been disabled, downgrading speed\n");
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 71/96] e1000e: Separate signaling for link check/link up
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (66 preceding siblings ...)
2017-11-28 10:23 ` [PATCH 4.4 70/96] e1000e: Fix return value test Greg Kroah-Hartman
@ 2017-11-28 10:23 ` Greg Kroah-Hartman
2017-12-07 20:02 ` Ben Hutchings
2017-11-28 10:23 ` [PATCH 4.4 72/96] RDS: RDMA: return appropriate error on rdma map failures Greg Kroah-Hartman
` (28 subsequent siblings)
96 siblings, 1 reply; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lennart Sorensen, Benjamin Poirier,
Aaron Brown, Jeff Kirsher, Amit Pundir
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Poirier <bpoirier@suse.com>
commit 19110cfbb34d4af0cdfe14cd243f3b09dc95b013 upstream.
Lennart reported the following race condition:
\ e1000_watchdog_task
\ e1000e_has_link
\ hw->mac.ops.check_for_link() === e1000e_check_for_copper_link
/* link is up */
mac->get_link_status = false;
/* interrupt */
\ e1000_msix_other
hw->mac.get_link_status = true;
link_active = !hw->mac.get_link_status
/* link_active is false, wrongly */
This problem arises because the single flag get_link_status is used to
signal two different states: link status needs checking and link status is
down.
Avoid the problem by using the return value of .check_for_link to signal
the link status to e1000e_has_link().
Reported-by: Lennart Sorensen <lsorense@csclub.uwaterloo.ca>
Signed-off-by: Benjamin Poirier <bpoirier@suse.com>
Tested-by: Aaron Brown <aaron.f.brown@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/intel/e1000e/mac.c | 11 ++++++++---
drivers/net/ethernet/intel/e1000e/netdev.c | 2 +-
2 files changed, 9 insertions(+), 4 deletions(-)
--- a/drivers/net/ethernet/intel/e1000e/mac.c
+++ b/drivers/net/ethernet/intel/e1000e/mac.c
@@ -410,6 +410,9 @@ void e1000e_clear_hw_cntrs_base(struct e
* Checks to see of the link status of the hardware has changed. If a
* change in link status has been detected, then we read the PHY registers
* to get the current speed/duplex if link exists.
+ *
+ * Returns a negative error code (-E1000_ERR_*) or 0 (link down) or 1 (link
+ * up).
**/
s32 e1000e_check_for_copper_link(struct e1000_hw *hw)
{
@@ -423,7 +426,7 @@ s32 e1000e_check_for_copper_link(struct
* Change or Rx Sequence Error interrupt.
*/
if (!mac->get_link_status)
- return 0;
+ return 1;
/* First we want to see if the MII Status Register reports
* link. If so, then we want to get the current speed/duplex
@@ -461,10 +464,12 @@ s32 e1000e_check_for_copper_link(struct
* different link partner.
*/
ret_val = e1000e_config_fc_after_link_up(hw);
- if (ret_val)
+ if (ret_val) {
e_dbg("Error configuring flow control\n");
+ return ret_val;
+ }
- return ret_val;
+ return 1;
}
/**
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -5017,7 +5017,7 @@ static bool e1000e_has_link(struct e1000
case e1000_media_type_copper:
if (hw->mac.get_link_status) {
ret_val = hw->mac.ops.check_for_link(hw);
- link_active = !hw->mac.get_link_status;
+ link_active = ret_val > 0;
} else {
link_active = true;
}
^ permalink raw reply [flat|nested] 124+ messages in thread* Re: [PATCH 4.4 71/96] e1000e: Separate signaling for link check/link up
2017-11-28 10:23 ` [PATCH 4.4 71/96] e1000e: Separate signaling for link check/link up Greg Kroah-Hartman
@ 2017-12-07 20:02 ` Ben Hutchings
2017-12-08 8:34 ` Benjamin Poirier
0 siblings, 1 reply; 124+ messages in thread
From: Ben Hutchings @ 2017-12-07 20:02 UTC (permalink / raw)
To: Benjamin Poirier, Jeff Kirsher
Cc: stable, Lennart Sorensen, Aaron Brown, Amit Pundir,
Greg Kroah-Hartman, LKML
On Tue, 2017-11-28 at 11:23 +0100, Greg Kroah-Hartman wrote:
> 4.4-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Benjamin Poirier <bpoirier@suse.com>
>
> commit 19110cfbb34d4af0cdfe14cd243f3b09dc95b013 upstream.
[...]
> --- a/drivers/net/ethernet/intel/e1000e/mac.c
> +++ b/drivers/net/ethernet/intel/e1000e/mac.c
> @@ -410,6 +410,9 @@ void e1000e_clear_hw_cntrs_base(struct e
> * Checks to see of the link status of the hardware has changed. If a
> * change in link status has been detected, then we read the PHY registers
> * to get the current speed/duplex if link exists.
> + *
> + * Returns a negative error code (-E1000_ERR_*) or 0 (link down) or 1 (link
> + * up).
> **/
> s32 e1000e_check_for_copper_link(struct e1000_hw *hw)
> {
[...]
> --- a/drivers/net/ethernet/intel/e1000e/netdev.c
> +++ b/drivers/net/ethernet/intel/e1000e/netdev.c
> @@ -5017,7 +5017,7 @@ static bool e1000e_has_link(struct e1000
> > case e1000_media_type_copper:
> > if (hw->mac.get_link_status) {
> > ret_val = hw->mac.ops.check_for_link(hw);
> > - link_active = !hw->mac.get_link_status;
> > + link_active = ret_val > 0;
> > } else {
> > link_active = true;
> > }
As this change in e1000e_has_link() is conditional only on the media
type, doesn't e1000_check_for_copper_link_ich8lan() also need to be
changed to return 1 for link up?
Ben.
--
Ben Hutchings
Software Developer, Codethink Ltd.
^ permalink raw reply [flat|nested] 124+ messages in thread* Re: [PATCH 4.4 71/96] e1000e: Separate signaling for link check/link up
2017-12-07 20:02 ` Ben Hutchings
@ 2017-12-08 8:34 ` Benjamin Poirier
2017-12-08 10:45 ` Christian Hesse
0 siblings, 1 reply; 124+ messages in thread
From: Benjamin Poirier @ 2017-12-08 8:34 UTC (permalink / raw)
To: Ben Hutchings
Cc: Gabriel C, Christian Hesse, Jeff Kirsher, stable,
Lennart Sorensen, Aaron Brown, Amit Pundir, Greg Kroah-Hartman,
LKML
On 2017/12/07 20:02, Ben Hutchings wrote:
> On Tue, 2017-11-28 at 11:23 +0100, Greg Kroah-Hartman wrote:
> > 4.4-stable review patch. If anyone has any objections, please let me know.
> >
> > ------------------
> >
> > From: Benjamin Poirier <bpoirier@suse.com>
> >
> > commit 19110cfbb34d4af0cdfe14cd243f3b09dc95b013 upstream.
> [...]
> > --- a/drivers/net/ethernet/intel/e1000e/mac.c
> > +++ b/drivers/net/ethernet/intel/e1000e/mac.c
> > @@ -410,6 +410,9 @@ void e1000e_clear_hw_cntrs_base(struct e
> > * Checks to see of the link status of the hardware has changed. If a
> > * change in link status has been detected, then we read the PHY registers
> > * to get the current speed/duplex if link exists.
> > + *
> > + * Returns a negative error code (-E1000_ERR_*) or 0 (link down) or 1 (link
> > + * up).
> > **/
> > s32 e1000e_check_for_copper_link(struct e1000_hw *hw)
> > {
> [...]
> > --- a/drivers/net/ethernet/intel/e1000e/netdev.c
> > +++ b/drivers/net/ethernet/intel/e1000e/netdev.c
> > @@ -5017,7 +5017,7 @@ static bool e1000e_has_link(struct e1000
> > > case e1000_media_type_copper:
> > > if (hw->mac.get_link_status) {
> > > ret_val = hw->mac.ops.check_for_link(hw);
> > > - link_active = !hw->mac.get_link_status;
> > > + link_active = ret_val > 0;
> > > } else {
> > > link_active = true;
> > > }
>
> As this change in e1000e_has_link() is conditional only on the media
> type, doesn't e1000_check_for_copper_link_ich8lan() also need to be
> changed to return 1 for link up?
You're right. I looked at it again, in the commit log I wrote that
"hw->mac.ops.check_for_link(hw) === e1000e_check_for_copper_link" which
is true for the race condition reported (because that's the function in
use on adapters that have msix vectors mac.type == e1000_82574) but not
generally true. The other check_for_link callback needs to be adjusted
likewise.
However, I happen to have a I218-LM (e1000_pch_lpt) so I tested 4.14.3
and this error only delays link up, it doesn't prevent it.
e1000_check_for_copper_link_ich8lan() sets mac->get_link_status = false;
and on the next watchdog execution, we fall in the second branch of the
following e1000e_has_link code:
case e1000_media_type_copper:
if (hw->mac.get_link_status) {
ret_val = hw->mac.ops.check_for_link(hw);
link_active = ret_val > 0;
} else {
link_active = true;
OTOH, there are multiple reports in
https://bugzilla.kernel.org/show_bug.cgi?id=198047
that reverting 830466993daf ("e1000e: Separate signaling for link
check/link up") fixes the issue so there's something I'm missing.
Gabriel and Christian, can you test the following patch?
diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c
index d6d4ed7acf03..31277d3bb7dc 100644
--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c
+++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c
@@ -1367,6 +1367,9 @@ static s32 e1000_disable_ulp_lpt_lp(struct e1000_hw *hw, bool force)
* Checks to see of the link status of the hardware has changed. If a
* change in link status has been detected, then we read the PHY registers
* to get the current speed/duplex if link exists.
+ *
+ * Returns a negative error code (-E1000_ERR_*) or 0 (link down) or 1 (link
+ * up).
**/
static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
{
@@ -1382,7 +1385,7 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
* Change or Rx Sequence Error interrupt.
*/
if (!mac->get_link_status)
- return 0;
+ return 1;
/* First we want to see if the MII Status Register reports
* link. If so, then we want to get the current speed/duplex
@@ -1613,10 +1616,12 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
* different link partner.
*/
ret_val = e1000e_config_fc_after_link_up(hw);
- if (ret_val)
+ if (ret_val) {
e_dbg("Error configuring flow control\n");
+ return ret_val;
+ }
- return ret_val;
+ return 1;
}
static s32 e1000_get_variants_ich8lan(struct e1000_adapter *adapter)
--
2.15.1
^ permalink raw reply related [flat|nested] 124+ messages in thread* Re: [PATCH 4.4 71/96] e1000e: Separate signaling for link check/link up
2017-12-08 8:34 ` Benjamin Poirier
@ 2017-12-08 10:45 ` Christian Hesse
2017-12-11 7:26 ` [PATCH] e1000e: Fix e1000_check_for_copper_link_ich8lan return value Benjamin Poirier
0 siblings, 1 reply; 124+ messages in thread
From: Christian Hesse @ 2017-12-08 10:45 UTC (permalink / raw)
To: Benjamin Poirier
Cc: Ben Hutchings, Gabriel C, Jeff Kirsher, stable, Lennart Sorensen,
Aaron Brown, Amit Pundir, Greg Kroah-Hartman, LKML
[-- Attachment #1: Type: text/plain, Size: 3293 bytes --]
Benjamin Poirier <bpoirier@suse.com> on Fri, 2017/12/08 17:34:
> On 2017/12/07 20:02, Ben Hutchings wrote:
> > On Tue, 2017-11-28 at 11:23 +0100, Greg Kroah-Hartman wrote:
> > > 4.4-stable review patch. If anyone has any objections, please let me
> > > know.
> > >
> > > ------------------
> > >
> > > From: Benjamin Poirier <bpoirier@suse.com>
> > >
> > > commit 19110cfbb34d4af0cdfe14cd243f3b09dc95b013 upstream.
> > [...]
> > > --- a/drivers/net/ethernet/intel/e1000e/mac.c
> > > +++ b/drivers/net/ethernet/intel/e1000e/mac.c
> > > @@ -410,6 +410,9 @@ void e1000e_clear_hw_cntrs_base(struct e
> > > * Checks to see of the link status of the hardware has changed. If a
> > > * change in link status has been detected, then we read the PHY
> > > registers
> > > * to get the current speed/duplex if link exists.
> > > + *
> > > + * Returns a negative error code (-E1000_ERR_*) or 0 (link down) or 1
> > > (link
> > > + * up).
> > > **/
> > > s32 e1000e_check_for_copper_link(struct e1000_hw *hw)
> > > {
> > [...]
> > > --- a/drivers/net/ethernet/intel/e1000e/netdev.c
> > > +++ b/drivers/net/ethernet/intel/e1000e/netdev.c
> > > @@ -5017,7 +5017,7 @@ static bool e1000e_has_link(struct e1000
> > > > case e1000_media_type_copper:
> > > > if (hw->mac.get_link_status) {
> > > > ret_val = hw->mac.ops.check_for_link(hw);
> > > > - link_active = !hw->mac.get_link_status;
> > > > + link_active = ret_val > 0;
> > > > } else {
> > > > link_active = true;
> > > > }
> >
> > As this change in e1000e_has_link() is conditional only on the media
> > type, doesn't e1000_check_for_copper_link_ich8lan() also need to be
> > changed to return 1 for link up?
>
> You're right. I looked at it again, in the commit log I wrote that
> "hw->mac.ops.check_for_link(hw) === e1000e_check_for_copper_link" which
> is true for the race condition reported (because that's the function in
> use on adapters that have msix vectors mac.type == e1000_82574) but not
> generally true. The other check_for_link callback needs to be adjusted
> likewise.
>
> However, I happen to have a I218-LM (e1000_pch_lpt) so I tested 4.14.3
> and this error only delays link up, it doesn't prevent it.
> e1000_check_for_copper_link_ich8lan() sets mac->get_link_status = false;
> and on the next watchdog execution, we fall in the second branch of the
> following e1000e_has_link code:
>
> case e1000_media_type_copper:
> if (hw->mac.get_link_status) {
> ret_val = hw->mac.ops.check_for_link(hw);
> link_active = ret_val > 0;
> } else {
> link_active = true;
>
> OTOH, there are multiple reports in
> https://bugzilla.kernel.org/show_bug.cgi?id=198047
> that reverting 830466993daf ("e1000e: Separate signaling for link
> check/link up") fixes the issue so there's something I'm missing.
>
> Gabriel and Christian, can you test the following patch?
With this patch applied my connection is up and running again. Thanks!
--
main(a){char*c=/* Schoene Gruesse */"B?IJj;MEH"
"CX:;",b;for(a/* Best regards my address: */=0;b=c[a++];)
putchar(b-1/(/* Chris cc -ox -xc - && ./x */b/42*2-3)*42);}
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH] e1000e: Fix e1000_check_for_copper_link_ich8lan return value.
2017-12-08 10:45 ` Christian Hesse
@ 2017-12-11 7:26 ` Benjamin Poirier
2017-12-21 6:57 ` [Intel-wired-lan] " Neftin, Sasha
0 siblings, 1 reply; 124+ messages in thread
From: Benjamin Poirier @ 2017-12-11 7:26 UTC (permalink / raw)
To: Jeff Kirsher
Cc: Ben Hutchings, Christian Hesse, Gabriel C, intel-wired-lan,
netdev, linux-kernel, stable
e1000e_check_for_copper_link() and e1000_check_for_copper_link_ich8lan()
are the two functions that may be assigned to mac.ops.check_for_link when
phy.media_type == e1000_media_type_copper. Commit 19110cfbb34d ("e1000e:
Separate signaling for link check/link up") changed the meaning of the
return value of check_for_link for copper media but only adjusted the first
function. This patch adjusts the second function likewise.
Reported-by: Christian Hesse <list@eworm.de>
Reported-by: Gabriel C <nix.or.die@gmail.com>
Link: https://bugzilla.kernel.org/show_bug.cgi?id=198047
Fixes: 19110cfbb34d ("e1000e: Separate signaling for link check/link up")
Tested-by: Christian Hesse <list@eworm.de>
Signed-off-by: Benjamin Poirier <bpoirier@suse.com>
---
drivers/net/ethernet/intel/e1000e/ich8lan.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c
index d6d4ed7acf03..31277d3bb7dc 100644
--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c
+++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c
@@ -1367,6 +1367,9 @@ static s32 e1000_disable_ulp_lpt_lp(struct e1000_hw *hw, bool force)
* Checks to see of the link status of the hardware has changed. If a
* change in link status has been detected, then we read the PHY registers
* to get the current speed/duplex if link exists.
+ *
+ * Returns a negative error code (-E1000_ERR_*) or 0 (link down) or 1 (link
+ * up).
**/
static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
{
@@ -1382,7 +1385,7 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
* Change or Rx Sequence Error interrupt.
*/
if (!mac->get_link_status)
- return 0;
+ return 1;
/* First we want to see if the MII Status Register reports
* link. If so, then we want to get the current speed/duplex
@@ -1613,10 +1616,12 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
* different link partner.
*/
ret_val = e1000e_config_fc_after_link_up(hw);
- if (ret_val)
+ if (ret_val) {
e_dbg("Error configuring flow control\n");
+ return ret_val;
+ }
- return ret_val;
+ return 1;
}
static s32 e1000_get_variants_ich8lan(struct e1000_adapter *adapter)
--
2.15.1
^ permalink raw reply related [flat|nested] 124+ messages in thread* Re: [Intel-wired-lan] [PATCH] e1000e: Fix e1000_check_for_copper_link_ich8lan return value.
2017-12-11 7:26 ` [PATCH] e1000e: Fix e1000_check_for_copper_link_ich8lan return value Benjamin Poirier
@ 2017-12-21 6:57 ` Neftin, Sasha
2017-12-22 22:00 ` Brown, Aaron F
0 siblings, 1 reply; 124+ messages in thread
From: Neftin, Sasha @ 2017-12-21 6:57 UTC (permalink / raw)
To: Benjamin Poirier, Jeff Kirsher
Cc: Ben Hutchings, Gabriel C, netdev, Christian Hesse, stable,
linux-kernel, intel-wired-lan
On 11/12/2017 9:26, Benjamin Poirier wrote:
> e1000e_check_for_copper_link() and e1000_check_for_copper_link_ich8lan()
> are the two functions that may be assigned to mac.ops.check_for_link when
> phy.media_type == e1000_media_type_copper. Commit 19110cfbb34d ("e1000e:
> Separate signaling for link check/link up") changed the meaning of the
> return value of check_for_link for copper media but only adjusted the first
> function. This patch adjusts the second function likewise.
>
> Reported-by: Christian Hesse <list@eworm.de>
> Reported-by: Gabriel C <nix.or.die@gmail.com>
> Link: https://bugzilla.kernel.org/show_bug.cgi?id=198047
> Fixes: 19110cfbb34d ("e1000e: Separate signaling for link check/link up")
> Tested-by: Christian Hesse <list@eworm.de>
> Signed-off-by: Benjamin Poirier <bpoirier@suse.com>
> ---
> drivers/net/ethernet/intel/e1000e/ich8lan.c | 11 ++++++++---
> 1 file changed, 8 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c
> index d6d4ed7acf03..31277d3bb7dc 100644
> --- a/drivers/net/ethernet/intel/e1000e/ich8lan.c
> +++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c
> @@ -1367,6 +1367,9 @@ static s32 e1000_disable_ulp_lpt_lp(struct e1000_hw *hw, bool force)
> * Checks to see of the link status of the hardware has changed. If a
> * change in link status has been detected, then we read the PHY registers
> * to get the current speed/duplex if link exists.
> + *
> + * Returns a negative error code (-E1000_ERR_*) or 0 (link down) or 1 (link
> + * up).
> **/
> static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
> {
> @@ -1382,7 +1385,7 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
> * Change or Rx Sequence Error interrupt.
> */
> if (!mac->get_link_status)
> - return 0;
> + return 1;
>
> /* First we want to see if the MII Status Register reports
> * link. If so, then we want to get the current speed/duplex
> @@ -1613,10 +1616,12 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
> * different link partner.
> */
> ret_val = e1000e_config_fc_after_link_up(hw);
> - if (ret_val)
> + if (ret_val) {
> e_dbg("Error configuring flow control\n");
> + return ret_val;
> + }
>
> - return ret_val;
> + return 1;
> }
>
> static s32 e1000_get_variants_ich8lan(struct e1000_adapter *adapter)
Acked by sasha.neftin@intel.com
^ permalink raw reply [flat|nested] 124+ messages in thread* RE: [Intel-wired-lan] [PATCH] e1000e: Fix e1000_check_for_copper_link_ich8lan return value.
2017-12-21 6:57 ` [Intel-wired-lan] " Neftin, Sasha
@ 2017-12-22 22:00 ` Brown, Aaron F
0 siblings, 0 replies; 124+ messages in thread
From: Brown, Aaron F @ 2017-12-22 22:00 UTC (permalink / raw)
To: Neftin, Sasha, Benjamin Poirier, Kirsher, Jeffrey T
Cc: Ben Hutchings, Gabriel C, netdev, Christian Hesse, stable,
linux-kernel, intel-wired-lan
> From: Intel-wired-lan [mailto:intel-wired-lan-bounces@osuosl.org] On
> Behalf Of Neftin, Sasha
> Sent: Wednesday, December 20, 2017 10:57 PM
> To: Benjamin Poirier <bpoirier@suse.com>; Kirsher, Jeffrey T
> <jeffrey.t.kirsher@intel.com>
> Cc: Ben Hutchings <ben.hutchings@codethink.co.uk>; Gabriel C
> <nix.or.die@gmail.com>; netdev@vger.kernel.org; Christian Hesse
> <list@eworm.de>; stable@vger.kernel.org; linux-kernel@vger.kernel.org;
> intel-wired-lan@lists.osuosl.org
> Subject: Re: [Intel-wired-lan] [PATCH] e1000e: Fix
> e1000_check_for_copper_link_ich8lan return value.
>
> On 11/12/2017 9:26, Benjamin Poirier wrote:
> > e1000e_check_for_copper_link() and
> e1000_check_for_copper_link_ich8lan()
> > are the two functions that may be assigned to mac.ops.check_for_link
> when
> > phy.media_type == e1000_media_type_copper. Commit 19110cfbb34d
> ("e1000e:
> > Separate signaling for link check/link up") changed the meaning of the
> > return value of check_for_link for copper media but only adjusted the first
> > function. This patch adjusts the second function likewise.
> >
> > Reported-by: Christian Hesse <list@eworm.de>
> > Reported-by: Gabriel C <nix.or.die@gmail.com>
> > Link: https://bugzilla.kernel.org/show_bug.cgi?id=198047
> > Fixes: 19110cfbb34d ("e1000e: Separate signaling for link check/link up")
> > Tested-by: Christian Hesse <list@eworm.de>
> > Signed-off-by: Benjamin Poirier <bpoirier@suse.com>
> > ---
> > drivers/net/ethernet/intel/e1000e/ich8lan.c | 11 ++++++++---
> > 1 file changed, 8 insertions(+), 3 deletions(-)
> >
Tested-by: Aaron Brown <aaron.f.brown@intel.com>
> Acked by sasha.neftin@intel.com
>
> _______________________________________________
> Intel-wired-lan mailing list
> Intel-wired-lan@osuosl.org
> https://lists.osuosl.org/mailman/listinfo/intel-wired-lan
^ permalink raw reply [flat|nested] 124+ messages in thread
* [PATCH 4.4 72/96] RDS: RDMA: return appropriate error on rdma map failures
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (67 preceding siblings ...)
2017-11-28 10:23 ` [PATCH 4.4 71/96] e1000e: Separate signaling for link check/link up Greg Kroah-Hartman
@ 2017-11-28 10:23 ` Greg Kroah-Hartman
2017-11-28 10:23 ` [PATCH 4.4 73/96] PCI: Apply _HPX settings only to relevant devices Greg Kroah-Hartman
` (27 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:23 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Santosh Shilimkar, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Santosh Shilimkar <santosh.shilimkar@oracle.com>
[ Upstream commit 584a8279a44a800dea5a5c1e9d53a002e03016b4 ]
The first message to a remote node should prompt a new
connection even if it is RDMA operation. For RDMA operation
the MR mapping can fail because connections is not yet up.
Since the connection establishment is asynchronous,
we make sure the map failure because of unavailable
connection reach to the user by appropriate error code.
Before returning to the user, lets trigger the connection
so that its ready for the next retry.
Signed-off-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/rds/send.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
--- a/net/rds/send.c
+++ b/net/rds/send.c
@@ -959,6 +959,11 @@ static int rds_cmsg_send(struct rds_sock
ret = rds_cmsg_rdma_map(rs, rm, cmsg);
if (!ret)
*allocated_mr = 1;
+ else if (ret == -ENODEV)
+ /* Accommodate the get_mr() case which can fail
+ * if connection isn't established yet.
+ */
+ ret = -EAGAIN;
break;
case RDS_CMSG_ATOMIC_CSWP:
case RDS_CMSG_ATOMIC_FADD:
@@ -1072,8 +1077,12 @@ int rds_sendmsg(struct socket *sock, str
/* Parse any control messages the user may have included. */
ret = rds_cmsg_send(rs, rm, msg, &allocated_mr);
- if (ret)
+ if (ret) {
+ /* Trigger connection so that its ready for the next retry */
+ if (ret == -EAGAIN)
+ rds_conn_connect_if_down(conn);
goto out;
+ }
if (rm->rdma.op_active && !conn->c_trans->xmit_rdma) {
printk_ratelimited(KERN_NOTICE "rdma_op %p conn xmit_rdma %p\n",
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 73/96] PCI: Apply _HPX settings only to relevant devices
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (68 preceding siblings ...)
2017-11-28 10:23 ` [PATCH 4.4 72/96] RDS: RDMA: return appropriate error on rdma map failures Greg Kroah-Hartman
@ 2017-11-28 10:23 ` Greg Kroah-Hartman
2017-11-28 10:23 ` [PATCH 4.4 74/96] dmaengine: zx: set DMA_CYCLIC cap_mask bit Greg Kroah-Hartman
` (26 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:23 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Bjorn Helgaas, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bjorn Helgaas <bhelgaas@google.com>
[ Upstream commit 977509f7c5c6fb992ffcdf4291051af343b91645 ]
Previously we didn't check the type of device before trying to apply Type 1
(PCI-X) or Type 2 (PCIe) Setting Records from _HPX.
We don't support PCI-X Setting Records, so this was harmless, but the
warning was useless.
We do support PCIe Setting Records, and we didn't check whether a device
was PCIe before applying settings. I don't think anything bad happened on
non-PCIe devices because pcie_capability_clear_and_set_word(),
pcie_cap_has_lnkctl(), etc., would fail before doing any harm. But it's
ugly to depend on those internals.
Check the device type before attempting to apply Type 1 and Type 2 Setting
Records (Type 0 records are applicable to PCI, PCI-X, and PCIe devices).
A side benefit is that this prevents useless "not supported" warnings when
a BIOS supplies a Type 1 (PCI-X) Setting Record and we try to apply it to
every single device:
pci 0000:00:00.0: PCI-X settings not supported
After this patch, we'll get the warning only when a BIOS supplies a Type 1
record and we have a PCI-X device to which it should be applied.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=187731
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/probe.c | 15 +++++++++++++--
1 file changed, 13 insertions(+), 2 deletions(-)
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -1414,8 +1414,16 @@ static void program_hpp_type0(struct pci
static void program_hpp_type1(struct pci_dev *dev, struct hpp_type1 *hpp)
{
- if (hpp)
- dev_warn(&dev->dev, "PCI-X settings not supported\n");
+ int pos;
+
+ if (!hpp)
+ return;
+
+ pos = pci_find_capability(dev, PCI_CAP_ID_PCIX);
+ if (!pos)
+ return;
+
+ dev_warn(&dev->dev, "PCI-X settings not supported\n");
}
static bool pcie_root_rcb_set(struct pci_dev *dev)
@@ -1441,6 +1449,9 @@ static void program_hpp_type2(struct pci
if (!hpp)
return;
+ if (!pci_is_pcie(dev))
+ return;
+
if (hpp->revision > 1) {
dev_warn(&dev->dev, "PCIe settings rev %d not supported\n",
hpp->revision);
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 74/96] dmaengine: zx: set DMA_CYCLIC cap_mask bit
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (69 preceding siblings ...)
2017-11-28 10:23 ` [PATCH 4.4 73/96] PCI: Apply _HPX settings only to relevant devices Greg Kroah-Hartman
@ 2017-11-28 10:23 ` Greg Kroah-Hartman
2017-11-28 10:23 ` [PATCH 4.4 75/96] net: Allow IP_MULTICAST_IF to set index to L3 slave Greg Kroah-Hartman
` (25 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Shawn Guo, Jun Nie, Vinod Koul, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shawn Guo <shawn.guo@linaro.org>
[ Upstream commit fc318d64f3d91e15babac00e08354b1beb650b57 ]
The zx_dma driver supports cyclic transfer mode. Let's set DMA_CYCLIC
cap_mask bit to make that clear, and avoid unnecessary failure when
clients request channel via dma_request_chan_by_mask() with DMA_CYCLIC
bit set in mask.
Signed-off-by: Shawn Guo <shawn.guo@linaro.org>
Reviewed-by: Jun Nie <jun.nie@linaro.org>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/dma/zx296702_dma.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/dma/zx296702_dma.c
+++ b/drivers/dma/zx296702_dma.c
@@ -813,6 +813,7 @@ static int zx_dma_probe(struct platform_
INIT_LIST_HEAD(&d->slave.channels);
dma_cap_set(DMA_SLAVE, d->slave.cap_mask);
dma_cap_set(DMA_MEMCPY, d->slave.cap_mask);
+ dma_cap_set(DMA_CYCLIC, d->slave.cap_mask);
dma_cap_set(DMA_PRIVATE, d->slave.cap_mask);
d->slave.dev = &op->dev;
d->slave.device_free_chan_resources = zx_dma_free_chan_resources;
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 75/96] net: Allow IP_MULTICAST_IF to set index to L3 slave
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (70 preceding siblings ...)
2017-11-28 10:23 ` [PATCH 4.4 74/96] dmaengine: zx: set DMA_CYCLIC cap_mask bit Greg Kroah-Hartman
@ 2017-11-28 10:23 ` Greg Kroah-Hartman
2017-11-28 10:23 ` [PATCH 4.4 76/96] net: 3com: typhoon: typhoon_init_one: make return values more specific Greg Kroah-Hartman
` (24 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Darwin Dingel, David Ahern,
David S. Miller, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Ahern <dsa@cumulusnetworks.com>
[ Upstream commit 7bb387c5ab12aeac3d5eea28686489ff46b53ca9 ]
IP_MULTICAST_IF fails if sk_bound_dev_if is already set and the new index
does not match it. e.g.,
ntpd[15381]: setsockopt IP_MULTICAST_IF 192.168.1.23 fails: Invalid argument
Relax the check in setsockopt to allow setting mc_index to an L3 slave if
sk_bound_dev_if points to an L3 master.
Make a similar change for IPv6. In this case change the device lookup to
take the rcu_read_lock avoiding a refcnt. The rcu lock is also needed for
the lookup of a potential L3 master device.
This really only silences a setsockopt failure since uses of mc_index are
secondary to sk_bound_dev_if if it is set. In both cases, if either index
is an L3 slave or master, lookups are directed to the same FIB table so
relaxing the check at setsockopt time causes no harm.
Patch is based on a suggested change by Darwin for a problem noted in
their code base.
Suggested-by: Darwin Dingel <darwin.dingel@alliedtelesis.co.nz>
Signed-off-by: David Ahern <dsa@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/ip_sockglue.c | 7 ++++++-
net/ipv6/ipv6_sockglue.c | 16 ++++++++++++----
2 files changed, 18 insertions(+), 5 deletions(-)
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -808,6 +808,7 @@ static int do_ip_setsockopt(struct sock
{
struct ip_mreqn mreq;
struct net_device *dev = NULL;
+ int midx;
if (sk->sk_type == SOCK_STREAM)
goto e_inval;
@@ -852,11 +853,15 @@ static int do_ip_setsockopt(struct sock
err = -EADDRNOTAVAIL;
if (!dev)
break;
+
+ midx = l3mdev_master_ifindex(dev);
+
dev_put(dev);
err = -EINVAL;
if (sk->sk_bound_dev_if &&
- mreq.imr_ifindex != sk->sk_bound_dev_if)
+ mreq.imr_ifindex != sk->sk_bound_dev_if &&
+ (!midx || midx != sk->sk_bound_dev_if))
break;
inet->mc_index = mreq.imr_ifindex;
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -583,16 +583,24 @@ done:
if (val) {
struct net_device *dev;
+ int midx;
- if (sk->sk_bound_dev_if && sk->sk_bound_dev_if != val)
- goto e_inval;
+ rcu_read_lock();
- dev = dev_get_by_index(net, val);
+ dev = dev_get_by_index_rcu(net, val);
if (!dev) {
+ rcu_read_unlock();
retv = -ENODEV;
break;
}
- dev_put(dev);
+ midx = l3mdev_master_ifindex_rcu(dev);
+
+ rcu_read_unlock();
+
+ if (sk->sk_bound_dev_if &&
+ sk->sk_bound_dev_if != val &&
+ (!midx || midx != sk->sk_bound_dev_if))
+ goto e_inval;
}
np->mcast_oif = val;
retv = 0;
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 76/96] net: 3com: typhoon: typhoon_init_one: make return values more specific
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (71 preceding siblings ...)
2017-11-28 10:23 ` [PATCH 4.4 75/96] net: Allow IP_MULTICAST_IF to set index to L3 slave Greg Kroah-Hartman
@ 2017-11-28 10:23 ` Greg Kroah-Hartman
2017-11-28 10:23 ` [PATCH 4.4 77/96] net: 3com: typhoon: typhoon_init_one: fix incorrect return values Greg Kroah-Hartman
` (23 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thomas Preisner, Milan Stephan,
David S. Miller, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Preisner <thomas.preisner+linux@fau.de>
[ Upstream commit 6b6bbb5922a4b1d4b58125a572da91010295fba3 ]
In some cases the return value of a failing function is not being used
and the function typhoon_init_one() returns another negative error code
instead.
Signed-off-by: Thomas Preisner <thomas.preisner+linux@fau.de>
Signed-off-by: Milan Stephan <milan.stephan+linux@fau.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/3com/typhoon.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
--- a/drivers/net/ethernet/3com/typhoon.c
+++ b/drivers/net/ethernet/3com/typhoon.c
@@ -2366,9 +2366,9 @@ typhoon_init_one(struct pci_dev *pdev, c
* 4) Get the hardware address.
* 5) Put the card to sleep.
*/
- if (typhoon_reset(ioaddr, WaitSleep) < 0) {
+ err = typhoon_reset(ioaddr, WaitSleep);
+ if (err < 0) {
err_msg = "could not reset 3XP";
- err = -EIO;
goto error_out_dma;
}
@@ -2382,16 +2382,16 @@ typhoon_init_one(struct pci_dev *pdev, c
typhoon_init_interface(tp);
typhoon_init_rings(tp);
- if(typhoon_boot_3XP(tp, TYPHOON_STATUS_WAITING_FOR_HOST) < 0) {
+ err = typhoon_boot_3XP(tp, TYPHOON_STATUS_WAITING_FOR_HOST);
+ if (err < 0) {
err_msg = "cannot boot 3XP sleep image";
- err = -EIO;
goto error_out_reset;
}
INIT_COMMAND_WITH_RESPONSE(&xp_cmd, TYPHOON_CMD_READ_MAC_ADDRESS);
- if(typhoon_issue_command(tp, 1, &xp_cmd, 1, xp_resp) < 0) {
+ err = typhoon_issue_command(tp, 1, &xp_cmd, 1, xp_resp);
+ if (err < 0) {
err_msg = "cannot read MAC address";
- err = -EIO;
goto error_out_reset;
}
@@ -2424,9 +2424,9 @@ typhoon_init_one(struct pci_dev *pdev, c
if(xp_resp[0].numDesc != 0)
tp->capabilities |= TYPHOON_WAKEUP_NEEDS_RESET;
- if(typhoon_sleep(tp, PCI_D3hot, 0) < 0) {
+ err = typhoon_sleep(tp, PCI_D3hot, 0);
+ if (err < 0) {
err_msg = "cannot put adapter to sleep";
- err = -EIO;
goto error_out_reset;
}
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 77/96] net: 3com: typhoon: typhoon_init_one: fix incorrect return values
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (72 preceding siblings ...)
2017-11-28 10:23 ` [PATCH 4.4 76/96] net: 3com: typhoon: typhoon_init_one: make return values more specific Greg Kroah-Hartman
@ 2017-11-28 10:23 ` Greg Kroah-Hartman
2017-11-28 10:23 ` [PATCH 4.4 78/96] drm/armada: Fix compile fail Greg Kroah-Hartman
` (22 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Pan Bian, Thomas Preisner,
Milan Stephan, David S. Miller, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Preisner <thomas.preisner+linux@fau.de>
[ Upstream commit 107fded7bf616ad6f46823d98b8ed6405d7adf2d ]
In a few cases the err-variable is not set to a negative error code if a
function call in typhoon_init_one() fails and thus 0 is returned
instead.
It may be better to set err to the appropriate negative error
code before returning.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=188841
Reported-by: Pan Bian <bianpan2016@163.com>
Signed-off-by: Thomas Preisner <thomas.preisner+linux@fau.de>
Signed-off-by: Milan Stephan <milan.stephan+linux@fau.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/3com/typhoon.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
--- a/drivers/net/ethernet/3com/typhoon.c
+++ b/drivers/net/ethernet/3com/typhoon.c
@@ -2398,8 +2398,9 @@ typhoon_init_one(struct pci_dev *pdev, c
*(__be16 *)&dev->dev_addr[0] = htons(le16_to_cpu(xp_resp[0].parm1));
*(__be32 *)&dev->dev_addr[2] = htonl(le32_to_cpu(xp_resp[0].parm2));
- if(!is_valid_ether_addr(dev->dev_addr)) {
+ if (!is_valid_ether_addr(dev->dev_addr)) {
err_msg = "Could not obtain valid ethernet address, aborting";
+ err = -EIO;
goto error_out_reset;
}
@@ -2407,7 +2408,8 @@ typhoon_init_one(struct pci_dev *pdev, c
* later when we print out the version reported.
*/
INIT_COMMAND_WITH_RESPONSE(&xp_cmd, TYPHOON_CMD_READ_VERSIONS);
- if(typhoon_issue_command(tp, 1, &xp_cmd, 3, xp_resp) < 0) {
+ err = typhoon_issue_command(tp, 1, &xp_cmd, 3, xp_resp);
+ if (err < 0) {
err_msg = "Could not get Sleep Image version";
goto error_out_reset;
}
@@ -2449,7 +2451,8 @@ typhoon_init_one(struct pci_dev *pdev, c
dev->features = dev->hw_features |
NETIF_F_HW_VLAN_CTAG_RX | NETIF_F_RXCSUM;
- if(register_netdev(dev) < 0) {
+ err = register_netdev(dev);
+ if (err < 0) {
err_msg = "unable to register netdev";
goto error_out_reset;
}
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 78/96] drm/armada: Fix compile fail
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (73 preceding siblings ...)
2017-11-28 10:23 ` [PATCH 4.4 77/96] net: 3com: typhoon: typhoon_init_one: fix incorrect return values Greg Kroah-Hartman
@ 2017-11-28 10:23 ` Greg Kroah-Hartman
2017-12-07 20:16 ` Ben Hutchings
2017-11-28 10:23 ` [PATCH 4.4 79/96] ath10k: fix incorrect txpower set by P2P_DEVICE interface Greg Kroah-Hartman
` (21 subsequent siblings)
96 siblings, 1 reply; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Russell King, Chris Wilson,
Daniel Vetter, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Vetter <daniel.vetter@ffwll.ch>
[ Upstream commit 7357f89954b6d005df6ab8929759e78d7d9a80f9 ]
I reported the include issue for tracepoints a while ago, but nothing
seems to have happened. Now it bit us, since the drm_mm_print
conversion was broken for armada. Fix it, so I can re-enable armada
in the drm-misc build configs.
v2: Rebase just the compile fix on top of Chris' build fix.
Cc: Russell King <rmk+kernel@armlinux.org.uk>
Cc: Chris Wilson <chris@chris-wilson.co.uk>
Acked: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/1483115932-19584-1-git-send-email-daniel.vetter@ffwll.ch
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/armada/Makefile | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/gpu/drm/armada/Makefile
+++ b/drivers/gpu/drm/armada/Makefile
@@ -4,3 +4,5 @@ armada-y += armada_510.o
armada-$(CONFIG_DEBUG_FS) += armada_debugfs.o
obj-$(CONFIG_DRM_ARMADA) := armada.o
+
+CFLAGS_armada_trace.o := -I$(src)
^ permalink raw reply [flat|nested] 124+ messages in thread* Re: [PATCH 4.4 78/96] drm/armada: Fix compile fail
2017-11-28 10:23 ` [PATCH 4.4 78/96] drm/armada: Fix compile fail Greg Kroah-Hartman
@ 2017-12-07 20:16 ` Ben Hutchings
2017-12-09 5:39 ` alexander.levin
0 siblings, 1 reply; 124+ messages in thread
From: Ben Hutchings @ 2017-12-07 20:16 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel
Cc: stable, Russell King, Chris Wilson, Daniel Vetter, Sasha Levin
On Tue, 2017-11-28 at 11:23 +0100, Greg Kroah-Hartman wrote:
> 4.4-stable review patch. If anyone has any objections, please let me
> know.
>
> ------------------
>
> From: Daniel Vetter <daniel.vetter@ffwll.ch>
>
>
> [ Upstream commit 7357f89954b6d005df6ab8929759e78d7d9a80f9 ]
[...]
> --- a/drivers/gpu/drm/armada/Makefile
> +++ b/drivers/gpu/drm/armada/Makefile
> @@ -4,3 +4,5 @@ armada-y += armada_510.o
> armada-$(CONFIG_DEBUG_FS) += armada_debugfs.o
>
> obj-$(CONFIG_DRM_ARMADA) := armada.o
> +
> +CFLAGS_armada_trace.o := -I$(src)
The armada_trace.c source file was added in 4.10, so this makes no
sense in the 4.4 and 4.9 branches.
Ben.
--
Ben Hutchings
Software Developer, Codethink Ltd.
^ permalink raw reply [flat|nested] 124+ messages in thread
* Re: [PATCH 4.4 78/96] drm/armada: Fix compile fail
2017-12-07 20:16 ` Ben Hutchings
@ 2017-12-09 5:39 ` alexander.levin
0 siblings, 0 replies; 124+ messages in thread
From: alexander.levin @ 2017-12-09 5:39 UTC (permalink / raw)
To: Ben Hutchings
Cc: Greg Kroah-Hartman, linux-kernel, stable, Russell King,
Chris Wilson, Daniel Vetter
On Thu, Dec 07, 2017 at 08:16:05PM +0000, Ben Hutchings wrote:
>On Tue, 2017-11-28 at 11:23 +0100, Greg Kroah-Hartman wrote:
>> 4.4-stable review patch. If anyone has any objections, please let me
>> know.
>>
>> ------------------
>>
>> From: Daniel Vetter <daniel.vetter@ffwll.ch>
>>
>>
>> [ Upstream commit 7357f89954b6d005df6ab8929759e78d7d9a80f9 ]
>[...]
>> --- a/drivers/gpu/drm/armada/Makefile
>> +++ b/drivers/gpu/drm/armada/Makefile
>> @@ -4,3 +4,5 @@ armada-y += armada_510.o
>> armada-$(CONFIG_DEBUG_FS) += armada_debugfs.o
>>
>> obj-$(CONFIG_DRM_ARMADA) := armada.o
>> +
>> +CFLAGS_armada_trace.o := -I$(src)
>
>The armada_trace.c source file was added in 4.10, so this makes no
>sense in the 4.4 and 4.9 branches.
I'll revert it for 4.4 and 4.9, thanks Ben!
--
Thanks,
Sasha
^ permalink raw reply [flat|nested] 124+ messages in thread
* [PATCH 4.4 79/96] ath10k: fix incorrect txpower set by P2P_DEVICE interface
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (74 preceding siblings ...)
2017-11-28 10:23 ` [PATCH 4.4 78/96] drm/armada: Fix compile fail Greg Kroah-Hartman
@ 2017-11-28 10:23 ` Greg Kroah-Hartman
2017-11-28 10:23 ` [PATCH 4.4 80/96] ath10k: ignore configuring the incorrect board_id Greg Kroah-Hartman
` (20 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ryan Hsu, Kalle Valo, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryan Hsu <ryanhsu@qca.qualcomm.com>
[ Upstream commit 88407beb1b1462f706a1950a355fd086e1c450b6 ]
Ath10k reports the phy capability that supports P2P_DEVICE interface.
When we use the P2P supported wpa_supplicant to start connection, it'll
create two interfaces, one is wlan0 (vdev_id=0) and one is P2P_DEVICE
p2p-dev-wlan0 which is for p2p control channel (vdev_id=1).
ath10k_pci mac vdev create 0 (add interface) type 2 subtype 0
ath10k_add_interface: vdev_id: 0, txpower: 0, bss_power: 0
...
ath10k_pci mac vdev create 1 (add interface) type 2 subtype 1
ath10k_add_interface: vdev_id: 1, txpower: 0, bss_power: 0
And the txpower in per vif bss_conf will only be set to valid tx power when
the interface is assigned with channel_ctx.
But this P2P_DEVICE interface will never be used for any connection, so
that the uninitialized bss_conf.txpower=0 is assinged to the
arvif->txpower when interface created.
Since the txpower configuration is firmware per physical interface.
So the smallest txpower of all vifs will be the one limit the tx power
of the physical device, that causing the low txpower issue on other
active interfaces.
wlan0: Limiting TX power to 21 (24 - 3) dBm
ath10k_pci mac vdev_id 0 txpower 21
ath10k_mac_txpower_recalc: vdev_id: 1, txpower: 0
ath10k_mac_txpower_recalc: vdev_id: 0, txpower: 21
ath10k_pci mac txpower 0
This issue only happens when we use the wpa_supplicant that supports
P2P or if we use the iw tool to create the control P2P_DEVICE interface.
Signed-off-by: Ryan Hsu <ryanhsu@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/ath/ath10k/mac.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -4180,7 +4180,8 @@ static int ath10k_mac_txpower_recalc(str
lockdep_assert_held(&ar->conf_mutex);
list_for_each_entry(arvif, &ar->arvifs, list) {
- WARN_ON(arvif->txpower < 0);
+ if (arvif->txpower <= 0)
+ continue;
if (txpower == -1)
txpower = arvif->txpower;
@@ -4188,8 +4189,8 @@ static int ath10k_mac_txpower_recalc(str
txpower = min(txpower, arvif->txpower);
}
- if (WARN_ON(txpower == -1))
- return -EINVAL;
+ if (txpower == -1)
+ return 0;
ret = ath10k_mac_txpower_setup(ar, txpower);
if (ret) {
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 80/96] ath10k: ignore configuring the incorrect board_id
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (75 preceding siblings ...)
2017-11-28 10:23 ` [PATCH 4.4 79/96] ath10k: fix incorrect txpower set by P2P_DEVICE interface Greg Kroah-Hartman
@ 2017-11-28 10:23 ` Greg Kroah-Hartman
2017-11-28 10:23 ` [PATCH 4.4 81/96] ath10k: fix potential memory leak in ath10k_wmi_tlv_op_pull_fw_stats() Greg Kroah-Hartman
` (19 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ryan Hsu, Kalle Valo, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryan Hsu <ryanhsu@qca.qualcomm.com>
[ Upstream commit d2e202c06ca42d353d95df12437740921a6d05b5 ]
With command to get board_id from otp, in the case of following
boot get otp board id result 0x00000000 board_id 0 chip_id 0
boot using board name 'bus=pci,bmi-chip-id=0,bmi-board-id=0"
...
failed to fetch board data for bus=pci,bmi-chip-id=0,bmi-board-id=0 from
ath10k/QCA6174/hw3.0/board-2.bin
The invalid board_id=0 will be used as index to search in the board-2.bin.
Ignore the case with board_id=0, as it means the otp is not carrying
the board id information.
Signed-off-by: Ryan Hsu <ryanhsu@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/ath/ath10k/core.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/drivers/net/wireless/ath/ath10k/core.c
+++ b/drivers/net/wireless/ath/ath10k/core.c
@@ -548,8 +548,11 @@ static int ath10k_core_get_board_id_from
"boot get otp board id result 0x%08x board_id %d chip_id %d\n",
result, board_id, chip_id);
- if ((result & ATH10K_BMI_BOARD_ID_STATUS_MASK) != 0)
+ if ((result & ATH10K_BMI_BOARD_ID_STATUS_MASK) != 0 ||
+ (board_id == 0)) {
+ ath10k_warn(ar, "board id is not exist in otp, ignore it\n");
return -EOPNOTSUPP;
+ }
ar->id.bmi_ids_valid = true;
ar->id.bmi_board_id = board_id;
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 81/96] ath10k: fix potential memory leak in ath10k_wmi_tlv_op_pull_fw_stats()
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (76 preceding siblings ...)
2017-11-28 10:23 ` [PATCH 4.4 80/96] ath10k: ignore configuring the incorrect board_id Greg Kroah-Hartman
@ 2017-11-28 10:23 ` Greg Kroah-Hartman
2017-11-28 10:23 ` [PATCH 4.4 82/96] ath10k: set CTS protection VDEV param only if VDEV is up Greg Kroah-Hartman
` (18 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Christian Lamparter, Kalle Valo, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Lamparter <chunkeey@googlemail.com>
[ Upstream commit 097e46d2ae90265d1afe141ba6208ba598b79e01 ]
ath10k_wmi_tlv_op_pull_fw_stats() uses tb = ath10k_wmi_tlv_parse_alloc(...)
function, which allocates memory. If any of the three error-paths are
taken, this tb needs to be freed.
Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/ath/ath10k/wmi-tlv.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
--- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c
+++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
@@ -1105,8 +1105,10 @@ static int ath10k_wmi_tlv_op_pull_fw_sta
struct ath10k_fw_stats_pdev *dst;
src = data;
- if (data_len < sizeof(*src))
+ if (data_len < sizeof(*src)) {
+ kfree(tb);
return -EPROTO;
+ }
data += sizeof(*src);
data_len -= sizeof(*src);
@@ -1126,8 +1128,10 @@ static int ath10k_wmi_tlv_op_pull_fw_sta
struct ath10k_fw_stats_vdev *dst;
src = data;
- if (data_len < sizeof(*src))
+ if (data_len < sizeof(*src)) {
+ kfree(tb);
return -EPROTO;
+ }
data += sizeof(*src);
data_len -= sizeof(*src);
@@ -1145,8 +1149,10 @@ static int ath10k_wmi_tlv_op_pull_fw_sta
struct ath10k_fw_stats_peer *dst;
src = data;
- if (data_len < sizeof(*src))
+ if (data_len < sizeof(*src)) {
+ kfree(tb);
return -EPROTO;
+ }
data += sizeof(*src);
data_len -= sizeof(*src);
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 82/96] ath10k: set CTS protection VDEV param only if VDEV is up
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (77 preceding siblings ...)
2017-11-28 10:23 ` [PATCH 4.4 81/96] ath10k: fix potential memory leak in ath10k_wmi_tlv_op_pull_fw_stats() Greg Kroah-Hartman
@ 2017-11-28 10:23 ` Greg Kroah-Hartman
2017-11-28 10:23 ` [PATCH 4.4 83/96] ALSA: hda - Apply ALC269_FIXUP_NO_SHUTUP on HDA_FIXUP_ACT_PROBE Greg Kroah-Hartman
` (17 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Bartosz Markowski, Kalle Valo, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartosz Markowski <bartosz.markowski@tieto.com>
[ Upstream commit 7cfe0455ee1218add152e986b89b4bb8dbeafcdd ]
The cts protection vdev parameter, in new QCA9377 TF2.0 firmware,
requires bss peer to be created for the STATION vdev type.
bss peer is being allocated by the firmware after vdev_start/_up commands.
mac80211 may call the cts protection setup at any time, so the
we needs to track the situation and defer the cts configuration
to prevent firmware asserts, like below:
[00]: 0x05020001 0x000015B3 0x0099ACE2 0x00955B31
[04]: 0x0099ACE2 0x00060730 0x00000004 0x00000000
[08]: 0x0044C754 0x00412C10 0x00000000 0x00409C54
[12]: 0x00000009 0x00000000 0x00952F6C 0x00952F77
[16]: 0x00952CC4 0x00910712 0x00000000 0x00000000
[20]: 0x4099ACE2 0x0040E858 0x00421254 0x004127F4
[24]: 0x8099B9B2 0x0040E8B8 0x00000000 0xC099ACE2
[28]: 0x800B75CB 0x0040E8F8 0x00000007 0x00005008
[32]: 0x809B048A 0x0040E958 0x00000010 0x00433B10
[36]: 0x809AFBBC 0x0040E9A8 0x0042BB74 0x0042BBBC
[40]: 0x8091D252 0x0040E9C8 0x0042BBBC 0x00000001
[44]: 0x809FFA45 0x0040EA78 0x0043D3E4 0x0042C2C8
[48]: 0x809FCEF4 0x0040EA98 0x0043D3E4 0x00000001
[52]: 0x80911210 0x0040EAE8 0x00000010 0x004041D0
[56]: 0x80911154 0x0040EB28 0x00400000 0x00000000
Signed-off-by: Bartosz Markowski <bartosz.markowski@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/ath/ath10k/mac.c | 51 ++++++++++++++++++++++++++++------
1 file changed, 43 insertions(+), 8 deletions(-)
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -1127,6 +1127,36 @@ static int ath10k_monitor_recalc(struct
return ath10k_monitor_stop(ar);
}
+static bool ath10k_mac_can_set_cts_prot(struct ath10k_vif *arvif)
+{
+ struct ath10k *ar = arvif->ar;
+
+ lockdep_assert_held(&ar->conf_mutex);
+
+ if (!arvif->is_started) {
+ ath10k_dbg(ar, ATH10K_DBG_MAC, "defer cts setup, vdev is not ready yet\n");
+ return false;
+ }
+
+ return true;
+}
+
+static int ath10k_mac_set_cts_prot(struct ath10k_vif *arvif)
+{
+ struct ath10k *ar = arvif->ar;
+ u32 vdev_param;
+
+ lockdep_assert_held(&ar->conf_mutex);
+
+ vdev_param = ar->wmi.vdev_param->protection_mode;
+
+ ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vdev %d cts_protection %d\n",
+ arvif->vdev_id, arvif->use_cts_prot);
+
+ return ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param,
+ arvif->use_cts_prot ? 1 : 0);
+}
+
static int ath10k_recalc_rtscts_prot(struct ath10k_vif *arvif)
{
struct ath10k *ar = arvif->ar;
@@ -4788,20 +4818,18 @@ static void ath10k_bss_info_changed(stru
if (changed & BSS_CHANGED_ERP_CTS_PROT) {
arvif->use_cts_prot = info->use_cts_prot;
- ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vdev %d cts_prot %d\n",
- arvif->vdev_id, info->use_cts_prot);
ret = ath10k_recalc_rtscts_prot(arvif);
if (ret)
ath10k_warn(ar, "failed to recalculate rts/cts prot for vdev %d: %d\n",
arvif->vdev_id, ret);
- vdev_param = ar->wmi.vdev_param->protection_mode;
- ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param,
- info->use_cts_prot ? 1 : 0);
- if (ret)
- ath10k_warn(ar, "failed to set protection mode %d on vdev %i: %d\n",
- info->use_cts_prot, arvif->vdev_id, ret);
+ if (ath10k_mac_can_set_cts_prot(arvif)) {
+ ret = ath10k_mac_set_cts_prot(arvif);
+ if (ret)
+ ath10k_warn(ar, "failed to set cts protection for vdev %d: %d\n",
+ arvif->vdev_id, ret);
+ }
}
if (changed & BSS_CHANGED_ERP_SLOT) {
@@ -6713,6 +6741,13 @@ ath10k_mac_op_assign_vif_chanctx(struct
arvif->is_up = true;
}
+ if (ath10k_mac_can_set_cts_prot(arvif)) {
+ ret = ath10k_mac_set_cts_prot(arvif);
+ if (ret)
+ ath10k_warn(ar, "failed to set cts protection for vdev %d: %d\n",
+ arvif->vdev_id, ret);
+ }
+
mutex_unlock(&ar->conf_mutex);
return 0;
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 83/96] ALSA: hda - Apply ALC269_FIXUP_NO_SHUTUP on HDA_FIXUP_ACT_PROBE
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (78 preceding siblings ...)
2017-11-28 10:23 ` [PATCH 4.4 82/96] ath10k: set CTS protection VDEV param only if VDEV is up Greg Kroah-Hartman
@ 2017-11-28 10:23 ` Greg Kroah-Hartman
2017-11-28 10:23 ` [PATCH 4.4 84/96] drm: Apply range restriction after color adjustment when allocation Greg Kroah-Hartman
` (16 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Gabriele Mazzotta, Takashi Iwai, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gabriele Mazzotta <gabriele.mzt@gmail.com>
[ Upstream commit 972aa2c708703c21f14eb958b37e82aae2530e44 ]
Setting shutup when the action is HDA_FIXUP_ACT_PRE_PROBE might
not have the desired effect since it could be overridden by
another more generic shutup function. Prevent this by setting
the more specific shutup function on HDA_FIXUP_ACT_PROBE.
Signed-off-by: Gabriele Mazzotta <gabriele.mzt@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/patch_realtek.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -4404,7 +4404,7 @@ static void alc_no_shutup(struct hda_cod
static void alc_fixup_no_shutup(struct hda_codec *codec,
const struct hda_fixup *fix, int action)
{
- if (action == HDA_FIXUP_ACT_PRE_PROBE) {
+ if (action == HDA_FIXUP_ACT_PROBE) {
struct alc_spec *spec = codec->spec;
spec->shutup = alc_no_shutup;
}
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 84/96] drm: Apply range restriction after color adjustment when allocation
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (79 preceding siblings ...)
2017-11-28 10:23 ` [PATCH 4.4 83/96] ALSA: hda - Apply ALC269_FIXUP_NO_SHUTUP on HDA_FIXUP_ACT_PROBE Greg Kroah-Hartman
@ 2017-11-28 10:23 ` Greg Kroah-Hartman
2017-11-28 10:23 ` [PATCH 4.4 85/96] mac80211: Remove invalid flag operations in mesh TSF synchronization Greg Kroah-Hartman
` (15 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Chris Wilson, Joonas Lahtinen,
Daniel Vetter, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Wilson <chris@chris-wilson.co.uk>
[ Upstream commit 3db93756b501e5f0a3951c79cfa9ed43c26d3455 ]
mm->color_adjust() compares the hole with its neighbouring nodes. They
only abutt before we restrict the hole, so we have to apply color_adjust
before we apply the range restriction.
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Reviewed-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/20161222083641.2691-36-chris@chris-wilson.co.uk
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/drm_mm.c | 16 ++++++----------
1 file changed, 6 insertions(+), 10 deletions(-)
--- a/drivers/gpu/drm/drm_mm.c
+++ b/drivers/gpu/drm/drm_mm.c
@@ -262,14 +262,12 @@ static void drm_mm_insert_helper_range(s
BUG_ON(!hole_node->hole_follows || node->allocated);
- if (adj_start < start)
- adj_start = start;
- if (adj_end > end)
- adj_end = end;
-
if (mm->color_adjust)
mm->color_adjust(hole_node, color, &adj_start, &adj_end);
+ adj_start = max(adj_start, start);
+ adj_end = min(adj_end, end);
+
if (flags & DRM_MM_CREATE_TOP)
adj_start = adj_end - size;
@@ -475,17 +473,15 @@ static struct drm_mm_node *drm_mm_search
flags & DRM_MM_SEARCH_BELOW) {
u64 hole_size = adj_end - adj_start;
- if (adj_start < start)
- adj_start = start;
- if (adj_end > end)
- adj_end = end;
-
if (mm->color_adjust) {
mm->color_adjust(entry, color, &adj_start, &adj_end);
if (adj_end <= adj_start)
continue;
}
+ adj_start = max(adj_start, start);
+ adj_end = min(adj_end, end);
+
if (!check_free_hole(adj_start, adj_end, size, alignment))
continue;
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 85/96] mac80211: Remove invalid flag operations in mesh TSF synchronization
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (80 preceding siblings ...)
2017-11-28 10:23 ` [PATCH 4.4 84/96] drm: Apply range restriction after color adjustment when allocation Greg Kroah-Hartman
@ 2017-11-28 10:23 ` Greg Kroah-Hartman
2017-11-28 10:23 ` [PATCH 4.4 86/96] mac80211: Suppress NEW_PEER_CANDIDATE event if no room Greg Kroah-Hartman
` (14 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Masashi Honma, Johannes Berg, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masashi Honma <masashi.honma@gmail.com>
[ Upstream commit 76f43b4c0a9337af22827d78de4f2b8fd5328489 ]
mesh_sync_offset_adjust_tbtt() implements Extensible synchronization
framework ([1] 13.13.2 Extensible synchronization framework). It shall
not operate the flag "TBTT Adjusting subfield" ([1] 8.4.2.100.8 Mesh
Capability), since it is used only for MBCA ([1] 13.13.4 Mesh beacon
collision avoidance, see 13.13.4.4.3 TBTT scanning and adjustment
procedures for detail). So this patch remove the flag operations.
[1] IEEE Std 802.11 2012
Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
[remove adjusting_tbtt entirely, since it's now unused]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mac80211/ieee80211_i.h | 1 -
net/mac80211/mesh.c | 3 ---
net/mac80211/mesh_sync.c | 11 -----------
3 files changed, 15 deletions(-)
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -682,7 +682,6 @@ struct ieee80211_if_mesh {
const struct ieee80211_mesh_sync_ops *sync_ops;
s64 sync_offset_clockdrift_max;
spinlock_t sync_offset_lock;
- bool adjusting_tbtt;
/* mesh power save */
enum nl80211_mesh_power_mode nonpeer_pm;
int ps_peers_light_sleep;
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -295,8 +295,6 @@ int mesh_add_meshconf_ie(struct ieee8021
/* Mesh PS mode. See IEEE802.11-2012 8.4.2.100.8 */
*pos |= ifmsh->ps_peers_deep_sleep ?
IEEE80211_MESHCONF_CAPAB_POWER_SAVE_LEVEL : 0x00;
- *pos++ |= ifmsh->adjusting_tbtt ?
- IEEE80211_MESHCONF_CAPAB_TBTT_ADJUSTING : 0x00;
*pos++ = 0x00;
return 0;
@@ -866,7 +864,6 @@ int ieee80211_start_mesh(struct ieee8021
ifmsh->mesh_cc_id = 0; /* Disabled */
/* register sync ops from extensible synchronization framework */
ifmsh->sync_ops = ieee80211_mesh_sync_ops_get(ifmsh->mesh_sp_id);
- ifmsh->adjusting_tbtt = false;
ifmsh->sync_offset_clockdrift_max = 0;
set_bit(MESH_WORK_HOUSEKEEPING, &ifmsh->wrkq_flags);
ieee80211_mesh_root_setup(ifmsh);
--- a/net/mac80211/mesh_sync.c
+++ b/net/mac80211/mesh_sync.c
@@ -119,7 +119,6 @@ static void mesh_sync_offset_rx_bcn_pres
*/
if (elems->mesh_config && mesh_peer_tbtt_adjusting(elems)) {
- clear_sta_flag(sta, WLAN_STA_TOFFSET_KNOWN);
msync_dbg(sdata, "STA %pM : is adjusting TBTT\n",
sta->sta.addr);
goto no_sync;
@@ -168,11 +167,9 @@ static void mesh_sync_offset_adjust_tbtt
struct beacon_data *beacon)
{
struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
- u8 cap;
WARN_ON(ifmsh->mesh_sp_id != IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET);
WARN_ON(!rcu_read_lock_held());
- cap = beacon->meshconf->meshconf_cap;
spin_lock_bh(&ifmsh->sync_offset_lock);
@@ -186,21 +183,13 @@ static void mesh_sync_offset_adjust_tbtt
"TBTT : kicking off TBTT adjustment with clockdrift_max=%lld\n",
ifmsh->sync_offset_clockdrift_max);
set_bit(MESH_WORK_DRIFT_ADJUST, &ifmsh->wrkq_flags);
-
- ifmsh->adjusting_tbtt = true;
} else {
msync_dbg(sdata,
"TBTT : max clockdrift=%lld; too small to adjust\n",
(long long)ifmsh->sync_offset_clockdrift_max);
ifmsh->sync_offset_clockdrift_max = 0;
-
- ifmsh->adjusting_tbtt = false;
}
spin_unlock_bh(&ifmsh->sync_offset_lock);
-
- beacon->meshconf->meshconf_cap = ifmsh->adjusting_tbtt ?
- IEEE80211_MESHCONF_CAPAB_TBTT_ADJUSTING | cap :
- ~IEEE80211_MESHCONF_CAPAB_TBTT_ADJUSTING & cap;
}
static const struct sync_method sync_methods[] = {
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 86/96] mac80211: Suppress NEW_PEER_CANDIDATE event if no room
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (81 preceding siblings ...)
2017-11-28 10:23 ` [PATCH 4.4 85/96] mac80211: Remove invalid flag operations in mesh TSF synchronization Greg Kroah-Hartman
@ 2017-11-28 10:23 ` Greg Kroah-Hartman
2017-11-28 10:23 ` [PATCH 4.4 87/96] iio: light: fix improper return value Greg Kroah-Hartman
` (13 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Masashi Honma, Johannes Berg, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masashi Honma <masashi.honma@gmail.com>
[ Upstream commit 11197d006bcfabf0173a7820a163fcaac420d10e ]
Previously, kernel sends NEW_PEER_CANDIDATE event to user land even if
the found peer does not have any room to accept other peer. This causes
continuous connection trials.
Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mac80211/mesh_plink.c | 14 ++++++++------
1 file changed, 8 insertions(+), 6 deletions(-)
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -495,12 +495,14 @@ mesh_sta_info_alloc(struct ieee80211_sub
/* Userspace handles station allocation */
if (sdata->u.mesh.user_mpm ||
- sdata->u.mesh.security & IEEE80211_MESH_SEC_AUTHED)
- cfg80211_notify_new_peer_candidate(sdata->dev, addr,
- elems->ie_start,
- elems->total_len,
- GFP_KERNEL);
- else
+ sdata->u.mesh.security & IEEE80211_MESH_SEC_AUTHED) {
+ if (mesh_peer_accepts_plinks(elems) &&
+ mesh_plink_availables(sdata))
+ cfg80211_notify_new_peer_candidate(sdata->dev, addr,
+ elems->ie_start,
+ elems->total_len,
+ GFP_KERNEL);
+ } else
sta = __mesh_sta_info_alloc(sdata, addr);
return sta;
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 87/96] iio: light: fix improper return value
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (82 preceding siblings ...)
2017-11-28 10:23 ` [PATCH 4.4 86/96] mac80211: Suppress NEW_PEER_CANDIDATE event if no room Greg Kroah-Hartman
@ 2017-11-28 10:23 ` Greg Kroah-Hartman
2017-11-28 10:23 ` [PATCH 4.4 88/96] staging: iio: cdc: " Greg Kroah-Hartman
` (12 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Pan Bian, Jonathan Cameron, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pan Bian <bianpan2016@163.com>
[ Upstream commit db4e5376d058af8924fafd0520a0942d92538d0e ]
In function cm3232_reg_init(), it returns 0 even if the last call to
i2c_smbus_write_byte_data() returns a negative value (indicates error).
As a result, the return value may be inconsistent with the execution
status, and the caller of cm3232_reg_init() will not be able to detect
the error. This patch fixes the bug.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=188641
Signed-off-by: Pan Bian <bianpan2016@163.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/light/cm3232.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/iio/light/cm3232.c
+++ b/drivers/iio/light/cm3232.c
@@ -119,7 +119,7 @@ static int cm3232_reg_init(struct cm3232
if (ret < 0)
dev_err(&chip->client->dev, "Error writing reg_cmd\n");
- return 0;
+ return ret;
}
/**
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 88/96] staging: iio: cdc: fix improper return value
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (83 preceding siblings ...)
2017-11-28 10:23 ` [PATCH 4.4 87/96] iio: light: fix improper return value Greg Kroah-Hartman
@ 2017-11-28 10:23 ` Greg Kroah-Hartman
2017-11-28 10:23 ` [PATCH 4.4 89/96] spi: SPI_FSL_DSPI should depend on HAS_DMA Greg Kroah-Hartman
` (11 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Pan Bian, Jonathan Cameron, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pan Bian <bianpan2016@163.com>
[ Upstream commit 91ca1a8c584f55857b1f6ab20a1d3a1ce7a559bb ]
At the end of function ad7150_write_event_config(), directly returns 0.
As a result, the errors will be ignored by the callers. It may be better
to return variable "ret".
Signed-off-by: Pan Bian <bianpan2016@163.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/iio/cdc/ad7150.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/staging/iio/cdc/ad7150.c
+++ b/drivers/staging/iio/cdc/ad7150.c
@@ -272,7 +272,7 @@ static int ad7150_write_event_config(str
error_ret:
mutex_unlock(&chip->state_lock);
- return 0;
+ return ret;
}
static int ad7150_read_event_value(struct iio_dev *indio_dev,
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 89/96] spi: SPI_FSL_DSPI should depend on HAS_DMA
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (84 preceding siblings ...)
2017-11-28 10:23 ` [PATCH 4.4 88/96] staging: iio: cdc: " Greg Kroah-Hartman
@ 2017-11-28 10:23 ` Greg Kroah-Hartman
2017-12-07 20:41 ` Ben Hutchings
2017-11-28 10:23 ` [PATCH 4.4 90/96] netfilter: nft_queue: use raw_smp_processor_id() Greg Kroah-Hartman
` (10 subsequent siblings)
96 siblings, 1 reply; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Mark Brown, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <geert@linux-m68k.org>
[ Upstream commit dadab2d4e3cf708ceba22ecddd94aedfecb39199 ]
If NO_DMA=y:
ERROR: "bad_dma_ops" [drivers/spi/spi-fsl-dspi.ko] undefined!
Add a dependency on HAS_DMA to fix this.
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/Kconfig | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/spi/Kconfig
+++ b/drivers/spi/Kconfig
@@ -315,6 +315,7 @@ config SPI_FSL_SPI
config SPI_FSL_DSPI
tristate "Freescale DSPI controller"
select REGMAP_MMIO
+ depends on HAS_DMA
depends on SOC_VF610 || SOC_LS1021A || ARCH_LAYERSCAPE || COMPILE_TEST
help
This enables support for the Freescale DSPI controller in master
^ permalink raw reply [flat|nested] 124+ messages in thread* Re: [PATCH 4.4 89/96] spi: SPI_FSL_DSPI should depend on HAS_DMA
2017-11-28 10:23 ` [PATCH 4.4 89/96] spi: SPI_FSL_DSPI should depend on HAS_DMA Greg Kroah-Hartman
@ 2017-12-07 20:41 ` Ben Hutchings
2017-12-09 5:40 ` alexander.levin
0 siblings, 1 reply; 124+ messages in thread
From: Ben Hutchings @ 2017-12-07 20:41 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel
Cc: stable, Geert Uytterhoeven, Mark Brown, Sasha Levin
On Tue, 2017-11-28 at 11:23 +0100, Greg Kroah-Hartman wrote:
> 4.4-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Geert Uytterhoeven <geert@linux-m68k.org>
>
>
> [ Upstream commit dadab2d4e3cf708ceba22ecddd94aedfecb39199 ]
>
> If NO_DMA=y:
>
> ERROR: "bad_dma_ops" [drivers/spi/spi-fsl-dspi.ko] undefined!
>
> Add a dependency on HAS_DMA to fix this.
[...]
This driver did not use DMA before 4.10, so I think this should be
reverted in the 4.4 and 4.9 branches.
Ben.
--
Ben Hutchings
Software Developer, Codethink Ltd.
^ permalink raw reply [flat|nested] 124+ messages in thread
* Re: [PATCH 4.4 89/96] spi: SPI_FSL_DSPI should depend on HAS_DMA
2017-12-07 20:41 ` Ben Hutchings
@ 2017-12-09 5:40 ` alexander.levin
0 siblings, 0 replies; 124+ messages in thread
From: alexander.levin @ 2017-12-09 5:40 UTC (permalink / raw)
To: Ben Hutchings
Cc: Greg Kroah-Hartman, linux-kernel, stable, Geert Uytterhoeven, Mark Brown
On Thu, Dec 07, 2017 at 08:41:14PM +0000, Ben Hutchings wrote:
>On Tue, 2017-11-28 at 11:23 +0100, Greg Kroah-Hartman wrote:
>> 4.4-stable review patch. If anyone has any objections, please let me know.
>>
>> ------------------
>>
>> From: Geert Uytterhoeven <geert@linux-m68k.org>
>>
>>
>> [ Upstream commit dadab2d4e3cf708ceba22ecddd94aedfecb39199 ]
>>
>> If NO_DMA=y:
>>
>> ERROR: "bad_dma_ops" [drivers/spi/spi-fsl-dspi.ko] undefined!
>>
>> Add a dependency on HAS_DMA to fix this.
>[...]
>
>This driver did not use DMA before 4.10, so I think this should be
>reverted in the 4.4 and 4.9 branches.
I'll revert it for 4.4 and 4.9, thanks Ben!
--
Thanks,
Sasha
^ permalink raw reply [flat|nested] 124+ messages in thread
* [PATCH 4.4 90/96] netfilter: nft_queue: use raw_smp_processor_id()
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (85 preceding siblings ...)
2017-11-28 10:23 ` [PATCH 4.4 89/96] spi: SPI_FSL_DSPI should depend on HAS_DMA Greg Kroah-Hartman
@ 2017-11-28 10:23 ` Greg Kroah-Hartman
2017-11-28 10:23 ` [PATCH 4.4 91/96] netfilter: nf_tables: fix oob access Greg Kroah-Hartman
` (9 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:23 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Pablo Neira Ayuso, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <pablo@netfilter.org>
[ Upstream commit c2e756ff9e699865d294cdc112acfc36419cf5cc ]
Using smp_processor_id() causes splats with PREEMPT_RCU:
[19379.552780] BUG: using smp_processor_id() in preemptible [00000000] code: ping/32389
[19379.552793] caller is debug_smp_processor_id+0x17/0x19
[...]
[19379.552823] Call Trace:
[19379.552832] [<ffffffff81274e9e>] dump_stack+0x67/0x90
[19379.552837] [<ffffffff8129a4d4>] check_preemption_disabled+0xe5/0xf5
[19379.552842] [<ffffffff8129a4fb>] debug_smp_processor_id+0x17/0x19
[19379.552849] [<ffffffffa07c42dd>] nft_queue_eval+0x35/0x20c [nft_queue]
No need to disable preemption since we only fetch the numeric value, so
let's use raw_smp_processor_id() instead.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/nft_queue.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/netfilter/nft_queue.c
+++ b/net/netfilter/nft_queue.c
@@ -37,7 +37,7 @@ static void nft_queue_eval(const struct
if (priv->queues_total > 1) {
if (priv->flags & NFT_QUEUE_FLAG_CPU_FANOUT) {
- int cpu = smp_processor_id();
+ int cpu = raw_smp_processor_id();
queue = priv->queuenum + cpu % priv->queues_total;
} else {
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 91/96] netfilter: nf_tables: fix oob access
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (86 preceding siblings ...)
2017-11-28 10:23 ` [PATCH 4.4 90/96] netfilter: nft_queue: use raw_smp_processor_id() Greg Kroah-Hartman
@ 2017-11-28 10:23 ` Greg Kroah-Hartman
2017-11-28 10:23 ` [PATCH 4.4 92/96] ASoC: rsnd: dont double free kctrl Greg Kroah-Hartman
` (8 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Florian Westphal, Pablo Neira Ayuso,
Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <fw@strlen.de>
[ Upstream commit 3e38df136e453aa69eb4472108ebce2fb00b1ba6 ]
BUG: KASAN: slab-out-of-bounds in nf_tables_rule_destroy+0xf1/0x130 at addr ffff88006a4c35c8
Read of size 8 by task nft/1607
When we've destroyed last valid expr, nft_expr_next() returns an invalid expr.
We must not dereference it unless it passes != nft_expr_last() check.
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/nf_tables_api.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -1996,7 +1996,7 @@ static void nf_tables_rule_destroy(const
* is called on error from nf_tables_newrule().
*/
expr = nft_expr_first(rule);
- while (expr->ops && expr != nft_expr_last(rule)) {
+ while (expr != nft_expr_last(rule) && expr->ops) {
nf_tables_expr_destroy(ctx, expr);
expr = nft_expr_next(expr);
}
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 92/96] ASoC: rsnd: dont double free kctrl
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (87 preceding siblings ...)
2017-11-28 10:23 ` [PATCH 4.4 91/96] netfilter: nf_tables: fix oob access Greg Kroah-Hartman
@ 2017-11-28 10:23 ` Greg Kroah-Hartman
2017-11-28 10:23 ` [PATCH 4.4 93/96] btrfs: return the actual error value from from btrfs_uuid_tree_iterate Greg Kroah-Hartman
` (7 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Colin Ian King, Kuninori Morimoto,
Mark Brown, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Colin Ian King <colin.king@canonical.com>
[ Upstream commit 0ea617a298dcdc2251b4e10f83ac3f3e627b66e3 ]
On an error, snd_ctl_add already free's kctrl, so calling snd_ctl_free_one
to free it again leads to a double free error. Fix this by removing
the extraneous snd_ctl_free_one call.
Issue found using static analysis with CoverityScan, CID 1372908
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Acked-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/sh/rcar/core.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
--- a/sound/soc/sh/rcar/core.c
+++ b/sound/soc/sh/rcar/core.c
@@ -1049,10 +1049,8 @@ static int __rsnd_kctrl_new(struct rsnd_
return -ENOMEM;
ret = snd_ctl_add(card, kctrl);
- if (ret < 0) {
- snd_ctl_free_one(kctrl);
+ if (ret < 0)
return ret;
- }
cfg->update = update;
cfg->card = card;
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 93/96] btrfs: return the actual error value from from btrfs_uuid_tree_iterate
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (88 preceding siblings ...)
2017-11-28 10:23 ` [PATCH 4.4 92/96] ASoC: rsnd: dont double free kctrl Greg Kroah-Hartman
@ 2017-11-28 10:23 ` Greg Kroah-Hartman
2017-11-28 10:23 ` [PATCH 4.4 94/96] ASoC: wm_adsp: Dont overrun firmware file buffer when reading region data Greg Kroah-Hartman
` (6 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Pan Bian, Omar Sandoval,
David Sterba, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pan Bian <bianpan2016@163.com>
[ Upstream commit 73ba39ab9307340dc98ec3622891314bbc09cc2e ]
In function btrfs_uuid_tree_iterate(), errno is assigned to variable ret
on errors. However, it directly returns 0. It may be better to return
ret. This patch also removes the warning, because the caller already
prints a warning.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=188731
Signed-off-by: Pan Bian <bianpan2016@163.com>
Reviewed-by: Omar Sandoval <osandov@fb.com>
[ edited subject ]
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/btrfs/uuid-tree.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
--- a/fs/btrfs/uuid-tree.c
+++ b/fs/btrfs/uuid-tree.c
@@ -348,7 +348,5 @@ skip:
out:
btrfs_free_path(path);
- if (ret)
- btrfs_warn(fs_info, "btrfs_uuid_tree_iterate failed %d", ret);
- return 0;
+ return ret;
}
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 94/96] ASoC: wm_adsp: Dont overrun firmware file buffer when reading region data
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (89 preceding siblings ...)
2017-11-28 10:23 ` [PATCH 4.4 93/96] btrfs: return the actual error value from from btrfs_uuid_tree_iterate Greg Kroah-Hartman
@ 2017-11-28 10:23 ` Greg Kroah-Hartman
2017-11-28 10:23 ` [PATCH 4.4 95/96] s390/kbuild: enable modversions for symbols exported from asm Greg Kroah-Hartman
` (5 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Richard Fitzgerald, Mark Brown, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Fitzgerald <rf@opensource.wolfsonmicro.com>
[ Upstream commit 1cab2a84f470e15ecc8e5143bfe9398c6e888032 ]
Protect against corrupt firmware files by ensuring that the length we
get for the data in a region actually lies within the available firmware
file data buffer.
Signed-off-by: Richard Fitzgerald <rf@opensource.wolfsonmicro.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/codecs/wm_adsp.c | 25 ++++++++++++++++++++++++-
1 file changed, 24 insertions(+), 1 deletion(-)
--- a/sound/soc/codecs/wm_adsp.c
+++ b/sound/soc/codecs/wm_adsp.c
@@ -1060,7 +1060,7 @@ static int wm_adsp_load(struct wm_adsp *
const struct wmfw_region *region;
const struct wm_adsp_region *mem;
const char *region_name;
- char *file, *text;
+ char *file, *text = NULL;
struct wm_adsp_buf *buf;
unsigned int reg;
int regions = 0;
@@ -1221,10 +1221,21 @@ static int wm_adsp_load(struct wm_adsp *
regions, le32_to_cpu(region->len), offset,
region_name);
+ if ((pos + le32_to_cpu(region->len) + sizeof(*region)) >
+ firmware->size) {
+ adsp_err(dsp,
+ "%s.%d: %s region len %d bytes exceeds file length %zu\n",
+ file, regions, region_name,
+ le32_to_cpu(region->len), firmware->size);
+ ret = -EINVAL;
+ goto out_fw;
+ }
+
if (text) {
memcpy(text, region->data, le32_to_cpu(region->len));
adsp_info(dsp, "%s: %s\n", file, text);
kfree(text);
+ text = NULL;
}
if (reg) {
@@ -1269,6 +1280,7 @@ out_fw:
regmap_async_complete(regmap);
wm_adsp_buf_free(&buf_list);
release_firmware(firmware);
+ kfree(text);
out:
kfree(file);
@@ -1730,6 +1742,17 @@ static int wm_adsp_load_coeff(struct wm_
}
if (reg) {
+ if ((pos + le32_to_cpu(blk->len) + sizeof(*blk)) >
+ firmware->size) {
+ adsp_err(dsp,
+ "%s.%d: %s region len %d bytes exceeds file length %zu\n",
+ file, blocks, region_name,
+ le32_to_cpu(blk->len),
+ firmware->size);
+ ret = -EINVAL;
+ goto out_fw;
+ }
+
buf = wm_adsp_buf_alloc(blk->data,
le32_to_cpu(blk->len),
&buf_list);
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 95/96] s390/kbuild: enable modversions for symbols exported from asm
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (90 preceding siblings ...)
2017-11-28 10:23 ` [PATCH 4.4 94/96] ASoC: wm_adsp: Dont overrun firmware file buffer when reading region data Greg Kroah-Hartman
@ 2017-11-28 10:23 ` Greg Kroah-Hartman
2017-12-07 21:21 ` Ben Hutchings
2017-11-28 10:23 ` [PATCH 4.4 96/96] xen: xenbus driver must not accept invalid transaction ids Greg Kroah-Hartman
` (4 subsequent siblings)
96 siblings, 1 reply; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Heiko Carstens, Martin Schwidefsky,
Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <heiko.carstens@de.ibm.com>
[ Upstream commit cabab3f9f5ca077535080b3252e6168935b914af ]
s390 version of commit 334bb7738764 ("x86/kbuild: enable modversions
for symbols exported from asm") so we get also rid of all these
warnings:
WARNING: EXPORT symbol "_mcount" [vmlinux] version generation failed, symbol will not be versioned.
WARNING: EXPORT symbol "memcpy" [vmlinux] version generation failed, symbol will not be versioned.
WARNING: EXPORT symbol "memmove" [vmlinux] version generation failed, symbol will not be versioned.
WARNING: EXPORT symbol "memset" [vmlinux] version generation failed, symbol will not be versioned.
WARNING: EXPORT symbol "save_fpu_regs" [vmlinux] version generation failed, symbol will not be versioned.
WARNING: EXPORT symbol "sie64a" [vmlinux] version generation failed, symbol will not be versioned.
WARNING: EXPORT symbol "sie_exit" [vmlinux] version generation failed, symbol will not be versioned.
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/include/asm/asm-prototypes.h | 8 ++++++++
1 file changed, 8 insertions(+)
create mode 100644 arch/s390/include/asm/asm-prototypes.h
--- /dev/null
+++ b/arch/s390/include/asm/asm-prototypes.h
@@ -0,0 +1,8 @@
+#ifndef _ASM_S390_PROTOTYPES_H
+
+#include <linux/kvm_host.h>
+#include <linux/ftrace.h>
+#include <asm/fpu/api.h>
+#include <asm-generic/asm-prototypes.h>
+
+#endif /* _ASM_S390_PROTOTYPES_H */
^ permalink raw reply [flat|nested] 124+ messages in thread* Re: [PATCH 4.4 95/96] s390/kbuild: enable modversions for symbols exported from asm
2017-11-28 10:23 ` [PATCH 4.4 95/96] s390/kbuild: enable modversions for symbols exported from asm Greg Kroah-Hartman
@ 2017-12-07 21:21 ` Ben Hutchings
2017-12-09 5:40 ` alexander.levin
0 siblings, 1 reply; 124+ messages in thread
From: Ben Hutchings @ 2017-12-07 21:21 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel
Cc: stable, Heiko Carstens, Martin Schwidefsky, Sasha Levin
On Tue, 2017-11-28 at 11:23 +0100, Greg Kroah-Hartman wrote:
> 4.4-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Heiko Carstens <heiko.carstens@de.ibm.com>
>
>
> [ Upstream commit cabab3f9f5ca077535080b3252e6168935b914af ]
>
> s390 version of commit 334bb7738764 ("x86/kbuild: enable modversions
> for symbols exported from asm") so we get also rid of all these
> warnings:
[...]
This was only needed for 4.9. Please revert it on the 3.18 and 4.4
branches.
Ben.
--
Ben Hutchings
Software Developer, Codethink Ltd.
^ permalink raw reply [flat|nested] 124+ messages in thread* Re: [PATCH 4.4 95/96] s390/kbuild: enable modversions for symbols exported from asm
2017-12-07 21:21 ` Ben Hutchings
@ 2017-12-09 5:40 ` alexander.levin
0 siblings, 0 replies; 124+ messages in thread
From: alexander.levin @ 2017-12-09 5:40 UTC (permalink / raw)
To: Ben Hutchings
Cc: Greg Kroah-Hartman, linux-kernel, stable, Heiko Carstens,
Martin Schwidefsky
On Thu, Dec 07, 2017 at 09:21:10PM +0000, Ben Hutchings wrote:
>On Tue, 2017-11-28 at 11:23 +0100, Greg Kroah-Hartman wrote:
>> 4.4-stable review patch. If anyone has any objections, please let me know.
>>
>> ------------------
>>
>> From: Heiko Carstens <heiko.carstens@de.ibm.com>
>>
>>
>> [ Upstream commit cabab3f9f5ca077535080b3252e6168935b914af ]
>>
>> s390 version of commit 334bb7738764 ("x86/kbuild: enable modversions
>> for symbols exported from asm") so we get also rid of all these
>> warnings:
>[...]
>
>This was only needed for 4.9. Please revert it on the 3.18 and 4.4
>branches.
I'll revert it for 4.4 and 3.18, thanks Ben!
--
Thanks,
Sasha
^ permalink raw reply [flat|nested] 124+ messages in thread
* [PATCH 4.4 96/96] xen: xenbus driver must not accept invalid transaction ids
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (91 preceding siblings ...)
2017-11-28 10:23 ` [PATCH 4.4 95/96] s390/kbuild: enable modversions for symbols exported from asm Greg Kroah-Hartman
@ 2017-11-28 10:23 ` Greg Kroah-Hartman
2017-11-28 17:26 ` [PATCH 4.4 00/96] 4.4.103-stable review Naresh Kamboju
` (3 subsequent siblings)
96 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-28 10:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Juergen Gross, Boris Ostrovsky, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Juergen Gross <jgross@suse.com>
[ Upstream commit 639b08810d6ad74ded2c5f6e233c4fcb9d147168 ]
When accessing Xenstore in a transaction the user is specifying a
transaction id which he normally obtained from Xenstore when starting
the transaction. Xenstore is validating a transaction id against all
known transaction ids of the connection the request came in. As all
requests of a domain not being the one where Xenstore lives share
one connection, validation of transaction ids of different users of
Xenstore in that domain should be done by the kernel of that domain
being the multiplexer between the Xenstore users in that domain and
Xenstore.
In order to prohibit one Xenstore user "hijacking" a transaction from
another user the xenbus driver has to verify a given transaction id
against all known transaction ids of the user before forwarding it to
Xenstore.
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/xen/xenbus/xenbus_dev_frontend.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/xen/xenbus/xenbus_dev_frontend.c
+++ b/drivers/xen/xenbus/xenbus_dev_frontend.c
@@ -316,7 +316,7 @@ static int xenbus_write_transaction(unsi
rc = -ENOMEM;
goto out;
}
- } else if (msg_type == XS_TRANSACTION_END) {
+ } else if (u->u.msg.tx_id != 0) {
list_for_each_entry(trans, &u->transactions, list)
if (trans->handle.id == u->u.msg.tx_id)
break;
^ permalink raw reply [flat|nested] 124+ messages in thread* Re: [PATCH 4.4 00/96] 4.4.103-stable review
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (92 preceding siblings ...)
2017-11-28 10:23 ` [PATCH 4.4 96/96] xen: xenbus driver must not accept invalid transaction ids Greg Kroah-Hartman
@ 2017-11-28 17:26 ` Naresh Kamboju
2017-11-29 8:07 ` Greg Kroah-Hartman
2017-11-28 18:27 ` Nathan Chancellor
` (2 subsequent siblings)
96 siblings, 1 reply; 124+ messages in thread
From: Naresh Kamboju @ 2017-11-28 17:26 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, torvalds, akpm, Guenter Roeck, Shuah Khan, patches,
Ben Hutchings, lkft-triage, linux- stable, Tom Gall
On 28 November 2017 at 15:52, Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
> This is the start of the stable review cycle for the 4.4.103 release.
> There are 96 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu Nov 30 10:04:41 UTC 2017.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.103-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm and x86_64.
Also as per usual the HiKey results are reported separate because the
platform support isn’t in tree.
Summary
------------------------------------------------------------------------
kernel: 4.4.103-rc1
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git branch: linux-4.4.y
git commit: 6accf2fa2e82811a1cbafa97ecdfd2fa489d7ebd
git describe: v4.4.102-97-g6accf2fa2e82
Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-4.4-oe/build/v4.4.102-97-g6accf2fa2e82
No regressions (compared to build v4.4.102-66-ge654be777072)
Boards, architectures and test suites:
-------------------------------------
juno-r2 - arm64
* boot - pass: 20
* kselftest - fail: 2, skip: 24, pass: 27
* libhugetlbfs - skip: 1, pass: 90
* ltp-cap_bounds-tests - pass: 2
* ltp-containers-tests - skip: 36, pass: 28
* ltp-fcntl-locktests-tests - pass: 2
* ltp-filecaps-tests - pass: 2
* ltp-fs-tests - pass: 60
* ltp-fs_bind-tests - pass: 2
* ltp-fs_perms_simple-tests - pass: 19
* ltp-fsx-tests - pass: 2
* ltp-hugetlb-tests - pass: 22
* ltp-io-tests - pass: 3
* ltp-ipc-tests - pass: 9
* ltp-math-tests - pass: 11
* ltp-nptl-tests - pass: 2
* ltp-pty-tests - pass: 4
* ltp-sched-tests - pass: 10
* ltp-securebits-tests - pass: 4
* ltp-syscalls-tests - skip: 159, pass: 936
* ltp-timers-tests - pass: 12
x15 - arm
* boot - pass: 20
* kselftest - fail: 1, skip: 27, pass: 26
* libhugetlbfs - skip: 1, pass: 87
* ltp-cap_bounds-tests - pass: 2
* ltp-containers-tests - pass: 64
* ltp-fcntl-locktests-tests - pass: 2
* ltp-filecaps-tests - pass: 2
* ltp-fs-tests - pass: 60
* ltp-fs_bind-tests - pass: 2
* ltp-fs_perms_simple-tests - pass: 19
* ltp-fsx-tests - pass: 2
* ltp-hugetlb-tests - skip: 2, pass: 20
* ltp-io-tests - pass: 3
* ltp-ipc-tests - pass: 9
* ltp-math-tests - pass: 11
* ltp-nptl-tests - pass: 2
* ltp-pty-tests - pass: 4
* ltp-sched-tests - skip: 1, pass: 13
* ltp-securebits-tests - pass: 4
* ltp-syscalls-tests - skip: 67, pass: 1035
* ltp-timers-tests - pass: 12
x86_64
* boot - pass: 20
* kselftest - fail: 1, skip: 29, pass: 37
* libhugetlbfs - skip: 1, pass: 76
* ltp-cap_bounds-tests - pass: 2
* ltp-containers-tests - pass: 64
* ltp-fcntl-locktests-tests - pass: 2
* ltp-filecaps-tests - pass: 2
* ltp-fs-tests - skip: 1, pass: 61
* ltp-fs_bind-tests - pass: 2
* ltp-fs_perms_simple-tests - pass: 19
* ltp-fsx-tests - pass: 2
* ltp-hugetlb-tests - pass: 22
* ltp-io-tests - pass: 3
* ltp-ipc-tests - pass: 9
* ltp-math-tests - pass: 11
* ltp-nptl-tests - pass: 2
* ltp-pty-tests - pass: 4
* ltp-sched-tests - skip: 1, pass: 9
* ltp-securebits-tests - pass: 4
* ltp-syscalls-tests - skip: 164, pass: 956
* ltp-timers-tests - pass: 12
And the hikey results.
Summary
------------------------------------------------------------------------
kernel: 4.4.103-rc1
git repo: https://git.linaro.org/lkft/arm64-stable-rc.git
git tag: 4.4.103-rc1-hikey-20171128-63
git commit: dc04bfd57d766ead22b7550dfb0f1f6c2d5c703b
git describe: 4.4.103-rc1-hikey-20171128-63
Test details: https://qa-reports.linaro.org/lkft/linaro-hikey-stable-rc-4.4-oe/build/4.4.103-rc1-hikey-20171128-63
No regressions (compared to build 4.4.103-rc1-hikey-20171127-62)
Boards, architectures and test suites:
-------------------------------------
hi6220-hikey - arm64
* boot - pass: 20
* kselftest - skip: 30, pass: 25
* libhugetlbfs - skip: 1, pass: 90
* ltp-cap_bounds-tests - pass: 2
* ltp-containers-tests - skip: 36, pass: 28
* ltp-fcntl-locktests-tests - pass: 2
* ltp-filecaps-tests - pass: 2
* ltp-fs-tests - pass: 60
* ltp-fs_bind-tests - pass: 2
* ltp-fs_perms_simple-tests - pass: 19
* ltp-fsx-tests - pass: 2
* ltp-hugetlb-tests - skip: 1, pass: 21
* ltp-io-tests - pass: 3
* ltp-ipc-tests - pass: 9
* ltp-math-tests - pass: 11
* ltp-nptl-tests - pass: 2
* ltp-pty-tests - pass: 4
* ltp-sched-tests - pass: 14
* ltp-securebits-tests - pass: 4
* ltp-syscalls-tests - skip: 124, pass: 979
* ltp-timers-tests - pass: 12
Documentation - https://collaborate.linaro.org/display/LKFT/Email+Reports
Signed-off-by: Naresh Kamboju <naresh.kamboju@linaro.org>
^ permalink raw reply [flat|nested] 124+ messages in thread* Re: [PATCH 4.4 00/96] 4.4.103-stable review
2017-11-28 17:26 ` [PATCH 4.4 00/96] 4.4.103-stable review Naresh Kamboju
@ 2017-11-29 8:07 ` Greg Kroah-Hartman
2017-11-29 9:53 ` Naresh Kamboju
0 siblings, 1 reply; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-29 8:07 UTC (permalink / raw)
To: Naresh Kamboju
Cc: linux-kernel, torvalds, akpm, Guenter Roeck, Shuah Khan, patches,
Ben Hutchings, lkft-triage, linux- stable, Tom Gall
On Tue, Nov 28, 2017 at 10:56:45PM +0530, Naresh Kamboju wrote:
> On 28 November 2017 at 15:52, Greg Kroah-Hartman
> <gregkh@linuxfoundation.org> wrote:
> > This is the start of the stable review cycle for the 4.4.103 release.
> > There are 96 patches in this series, all will be posted as a response
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
> >
> > Responses should be made by Thu Nov 30 10:04:41 UTC 2017.
> > Anything received after that time might be too late.
> >
> > The whole patch series can be found in one patch at:
> > kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.103-rc1.gz
> > or in the git tree and branch at:
> > git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
> > and the diffstat can be found below.
> >
> > thanks,
> >
> > greg k-h
>
> Results from Linaro’s test farm.
> No regressions on arm64, arm and x86_64.
Thanks for testing.
> Also as per usual the HiKey results are reported separate because the
> platform support isn’t in tree.
Reported separate where?
greg k-h
^ permalink raw reply [flat|nested] 124+ messages in thread
* Re: [PATCH 4.4 00/96] 4.4.103-stable review
2017-11-29 8:07 ` Greg Kroah-Hartman
@ 2017-11-29 9:53 ` Naresh Kamboju
2017-11-29 10:36 ` Greg Kroah-Hartman
0 siblings, 1 reply; 124+ messages in thread
From: Naresh Kamboju @ 2017-11-29 9:53 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, torvalds, akpm, Guenter Roeck, Shuah Khan, patches,
Ben Hutchings, lkft-triage, linux- stable, Tom Gall
On 29 November 2017 at 13:37, Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
> On Tue, Nov 28, 2017 at 10:56:45PM +0530, Naresh Kamboju wrote:
>> On 28 November 2017 at 15:52, Greg Kroah-Hartman
>> <gregkh@linuxfoundation.org> wrote:
>> > This is the start of the stable review cycle for the 4.4.103 release.
>> > There are 96 patches in this series, all will be posted as a response
>> > to this one. If anyone has any issues with these being applied, please
>> > let me know.
>> >
>> > Responses should be made by Thu Nov 30 10:04:41 UTC 2017.
>> > Anything received after that time might be too late.
>> >
>> > The whole patch series can be found in one patch at:
>> > kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.103-rc1.gz
>> > or in the git tree and branch at:
>> > git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
>> > and the diffstat can be found below.
>> >
>> > thanks,
>> >
>> > greg k-h
>>
>> Results from Linaro’s test farm.
>> No regressions on arm64, arm and x86_64.
>
> Thanks for testing.
>
>> Also as per usual the HiKey results are reported separate because the
>> platform support isn’t in tree.
>
> Reported separate where?
Hikey report is in the bottom of the email (you get to see different summary)
- Naresh
>
> greg k-h
^ permalink raw reply [flat|nested] 124+ messages in thread
* Re: [PATCH 4.4 00/96] 4.4.103-stable review
2017-11-29 9:53 ` Naresh Kamboju
@ 2017-11-29 10:36 ` Greg Kroah-Hartman
2017-11-29 13:51 ` Naresh Kamboju
0 siblings, 1 reply; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-29 10:36 UTC (permalink / raw)
To: Naresh Kamboju
Cc: linux-kernel, torvalds, akpm, Guenter Roeck, Shuah Khan, patches,
Ben Hutchings, lkft-triage, linux- stable, Tom Gall
On Wed, Nov 29, 2017 at 03:23:27PM +0530, Naresh Kamboju wrote:
> On 29 November 2017 at 13:37, Greg Kroah-Hartman
> <gregkh@linuxfoundation.org> wrote:
> > On Tue, Nov 28, 2017 at 10:56:45PM +0530, Naresh Kamboju wrote:
> >> On 28 November 2017 at 15:52, Greg Kroah-Hartman
> >> <gregkh@linuxfoundation.org> wrote:
> >> > This is the start of the stable review cycle for the 4.4.103 release.
> >> > There are 96 patches in this series, all will be posted as a response
> >> > to this one. If anyone has any issues with these being applied, please
> >> > let me know.
> >> >
> >> > Responses should be made by Thu Nov 30 10:04:41 UTC 2017.
> >> > Anything received after that time might be too late.
> >> >
> >> > The whole patch series can be found in one patch at:
> >> > kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.103-rc1.gz
> >> > or in the git tree and branch at:
> >> > git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
> >> > and the diffstat can be found below.
> >> >
> >> > thanks,
> >> >
> >> > greg k-h
> >>
> >> Results from Linaro’s test farm.
> >> No regressions on arm64, arm and x86_64.
> >
> > Thanks for testing.
> >
> >> Also as per usual the HiKey results are reported separate because the
> >> platform support isn’t in tree.
> >
> > Reported separate where?
>
> Hikey report is in the bottom of the email (you get to see different summary)
I never scroll down beyond this line, because I didn't know there was
more down there. Hint, put what you want to have read up at the top to
make it easier to understand at a glance...
greg k-h
^ permalink raw reply [flat|nested] 124+ messages in thread
* Re: [PATCH 4.4 00/96] 4.4.103-stable review
2017-11-29 10:36 ` Greg Kroah-Hartman
@ 2017-11-29 13:51 ` Naresh Kamboju
0 siblings, 0 replies; 124+ messages in thread
From: Naresh Kamboju @ 2017-11-29 13:51 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, torvalds, akpm, Guenter Roeck, Shuah Khan, patches,
Ben Hutchings, lkft-triage, linux- stable, Tom Gall
On 29 November 2017 at 16:06, Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
> On Wed, Nov 29, 2017 at 03:23:27PM +0530, Naresh Kamboju wrote:
>> On 29 November 2017 at 13:37, Greg Kroah-Hartman
>> <gregkh@linuxfoundation.org> wrote:
>> > On Tue, Nov 28, 2017 at 10:56:45PM +0530, Naresh Kamboju wrote:
>> >> On 28 November 2017 at 15:52, Greg Kroah-Hartman
>> >> <gregkh@linuxfoundation.org> wrote:
>> >> > This is the start of the stable review cycle for the 4.4.103 release.
>> >> > There are 96 patches in this series, all will be posted as a response
>> >> > to this one. If anyone has any issues with these being applied, please
>> >> > let me know.
>> >> >
>> >> > Responses should be made by Thu Nov 30 10:04:41 UTC 2017.
>> >> > Anything received after that time might be too late.
>> >> >
>> >> > The whole patch series can be found in one patch at:
>> >> > kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.103-rc1.gz
>> >> > or in the git tree and branch at:
>> >> > git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
>> >> > and the diffstat can be found below.
>> >> >
>> >> > thanks,
>> >> >
>> >> > greg k-h
>> >>
>> >> Results from Linaro’s test farm.
>> >> No regressions on arm64, arm and x86_64.
>> >
>> > Thanks for testing.
>> >
>> >> Also as per usual the HiKey results are reported separate because the
>> >> platform support isn’t in tree.
>> >
>> > Reported separate where?
>>
>> Hikey report is in the bottom of the email (you get to see different summary)
>
> I never scroll down beyond this line, because I didn't know there was
> more down there. Hint, put what you want to have read up at the top to
> make it easier to understand at a glance...
Thanks for your comments.
I will address that next time.
- Naresh
>
> greg k-h
^ permalink raw reply [flat|nested] 124+ messages in thread
* Re: [PATCH 4.4 00/96] 4.4.103-stable review
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (93 preceding siblings ...)
2017-11-28 17:26 ` [PATCH 4.4 00/96] 4.4.103-stable review Naresh Kamboju
@ 2017-11-28 18:27 ` Nathan Chancellor
2017-11-29 8:07 ` Greg Kroah-Hartman
2017-11-28 19:46 ` Shuah Khan
2017-11-28 21:51 ` Guenter Roeck
96 siblings, 1 reply; 124+ messages in thread
From: Nathan Chancellor @ 2017-11-28 18:27 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, torvalds, akpm, linux, shuahkh, patches,
ben.hutchings, lkft-triage, stable
On Tue, Nov 28, 2017 at 11:22:09AM +0100, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.4.103 release.
> There are 96 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu Nov 30 10:04:41 UTC 2017.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.103-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
> -------------
> Pseudo-Shortlog of commits:
>
> Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Linux 4.4.103-rc1
>
> Juergen Gross <jgross@suse.com>
> xen: xenbus driver must not accept invalid transaction ids
>
> Heiko Carstens <heiko.carstens@de.ibm.com>
> s390/kbuild: enable modversions for symbols exported from asm
>
> Richard Fitzgerald <rf@opensource.wolfsonmicro.com>
> ASoC: wm_adsp: Don't overrun firmware file buffer when reading region data
>
> Pan Bian <bianpan2016@163.com>
> btrfs: return the actual error value from from btrfs_uuid_tree_iterate
>
> Colin Ian King <colin.king@canonical.com>
> ASoC: rsnd: don't double free kctrl
>
> Florian Westphal <fw@strlen.de>
> netfilter: nf_tables: fix oob access
>
> Pablo Neira Ayuso <pablo@netfilter.org>
> netfilter: nft_queue: use raw_smp_processor_id()
>
> Geert Uytterhoeven <geert@linux-m68k.org>
> spi: SPI_FSL_DSPI should depend on HAS_DMA
>
> Pan Bian <bianpan2016@163.com>
> staging: iio: cdc: fix improper return value
>
> Pan Bian <bianpan2016@163.com>
> iio: light: fix improper return value
>
> Masashi Honma <masashi.honma@gmail.com>
> mac80211: Suppress NEW_PEER_CANDIDATE event if no room
>
> Masashi Honma <masashi.honma@gmail.com>
> mac80211: Remove invalid flag operations in mesh TSF synchronization
>
> Chris Wilson <chris@chris-wilson.co.uk>
> drm: Apply range restriction after color adjustment when allocation
>
> Gabriele Mazzotta <gabriele.mzt@gmail.com>
> ALSA: hda - Apply ALC269_FIXUP_NO_SHUTUP on HDA_FIXUP_ACT_PROBE
>
> Bartosz Markowski <bartosz.markowski@tieto.com>
> ath10k: set CTS protection VDEV param only if VDEV is up
>
> Christian Lamparter <chunkeey@googlemail.com>
> ath10k: fix potential memory leak in ath10k_wmi_tlv_op_pull_fw_stats()
>
> Ryan Hsu <ryanhsu@qca.qualcomm.com>
> ath10k: ignore configuring the incorrect board_id
>
> Ryan Hsu <ryanhsu@qca.qualcomm.com>
> ath10k: fix incorrect txpower set by P2P_DEVICE interface
>
> Daniel Vetter <daniel.vetter@ffwll.ch>
> drm/armada: Fix compile fail
>
> Thomas Preisner <thomas.preisner+linux@fau.de>
> net: 3com: typhoon: typhoon_init_one: fix incorrect return values
>
> Thomas Preisner <thomas.preisner+linux@fau.de>
> net: 3com: typhoon: typhoon_init_one: make return values more specific
>
> David Ahern <dsa@cumulusnetworks.com>
> net: Allow IP_MULTICAST_IF to set index to L3 slave
>
> Shawn Guo <shawn.guo@linaro.org>
> dmaengine: zx: set DMA_CYCLIC cap_mask bit
>
> Bjorn Helgaas <bhelgaas@google.com>
> PCI: Apply _HPX settings only to relevant devices
>
> Santosh Shilimkar <santosh.shilimkar@oracle.com>
> RDS: RDMA: return appropriate error on rdma map failures
>
> Benjamin Poirier <bpoirier@suse.com>
> e1000e: Separate signaling for link check/link up
>
> Benjamin Poirier <bpoirier@suse.com>
> e1000e: Fix return value test
>
> Benjamin Poirier <bpoirier@suse.com>
> e1000e: Fix error path in link detection
>
> Tobias Jordan <Tobias.Jordan@elektrobit.com>
> PM / OPP: Add missing of_node_put(np)
>
> Tuomas Tynkkynen <tuomas@tuxera.com>
> net/9p: Switch to wait_event_killable()
>
> Eric Biggers <ebiggers@google.com>
> fscrypt: lock mutex before checking for bounce page pool
>
> Steven Rostedt (Red Hat) <rostedt@goodmis.org>
> sched/rt: Simplify the IPI based RT balancing logic
>
> Ricardo Ribalda Delgado <ricardo.ribalda@gmail.com>
> media: v4l2-ctrl: Fix flags field on Control events
>
> Johan Hovold <johan@kernel.org>
> cx231xx-cards: fix NULL-deref on missing association descriptor
>
> Sean Young <sean@mess.org>
> media: rc: check for integer overflow
>
> Michele Baldessari <michele@acksyn.org>
> media: Don't do DMA on stack for firmware upload in the AS102 driver
>
> Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
> powerpc/signal: Properly handle return value from uprobe_deny_signal()
>
> John David Anglin <dave.anglin@bell.net>
> parisc: Fix validity check of pointer size argument in new CAS implementation
>
> Brian King <brking@linux.vnet.ibm.com>
> ixgbe: Fix skb list corruption on Power systems
>
> Brian King <brking@linux.vnet.ibm.com>
> fm10k: Use smp_rmb rather than read_barrier_depends
>
> Brian King <brking@linux.vnet.ibm.com>
> i40evf: Use smp_rmb rather than read_barrier_depends
>
> Brian King <brking@linux.vnet.ibm.com>
> ixgbevf: Use smp_rmb rather than read_barrier_depends
>
> Brian King <brking@linux.vnet.ibm.com>
> igbvf: Use smp_rmb rather than read_barrier_depends
>
> Brian King <brking@linux.vnet.ibm.com>
> igb: Use smp_rmb rather than read_barrier_depends
>
> Brian King <brking@linux.vnet.ibm.com>
> i40e: Use smp_rmb rather than read_barrier_depends
>
> Johan Hovold <johan@kernel.org>
> NFC: fix device-allocation error return
>
> Bart Van Assche <bart.vanassche@wdc.com>
> IB/srp: Avoid that a cable pull can trigger a kernel crash
>
> Bart Van Assche <bart.vanassche@wdc.com>
> IB/srpt: Do not accept invalid initiator port names
>
> Dan Williams <dan.j.williams@intel.com>
> libnvdimm, namespace: make 'resource' attribute only readable by root
>
> Dan Williams <dan.j.williams@intel.com>
> libnvdimm, namespace: fix label initialization to use valid seq numbers
>
> Johan Hovold <johan@kernel.org>
> clk: ti: dra7-atl-clock: fix child-node lookups
>
> Peter Ujfalusi <peter.ujfalusi@ti.com>
> clk: ti: dra7-atl-clock: Fix of_node reference counting
>
> Trond Myklebust <trond.myklebust@primarydata.com>
> SUNRPC: Fix tracepoint storage issues with svc_recv and svc_rqst_status
>
> Paolo Bonzini <pbonzini@redhat.com>
> KVM: SVM: obey guest PAT
>
> Ladi Prosek <lprosek@redhat.com>
> KVM: nVMX: set IDTR and GDTR limits when loading L1 host state
>
> Nicholas Bellinger <nab@linux-iscsi.org>
> target: Fix QUEUE_FULL + SCSI task attribute handling
>
> Nicholas Bellinger <nab@linux-iscsi.org>
> iscsi-target: Fix non-immediate TMR reference leak
>
> Tuomas Tynkkynen <tuomas@tuxera.com>
> fs/9p: Compare qid.path in v9fs_test_inode
>
> Al Viro <viro@zeniv.linux.org.uk>
> fix a page leak in vhost_scsi_iov_to_sgl() error recovery
>
> Kailang Yang <kailang@realtek.com>
> ALSA: hda/realtek - Fix ALC700 family no sound issue
>
> Takashi Iwai <tiwai@suse.de>
> ALSA: timer: Remove kernel warning at compat ioctl error paths
>
> Takashi Iwai <tiwai@suse.de>
> ALSA: usb-audio: Add sanity checks in v2 clock parsers
>
> Takashi Iwai <tiwai@suse.de>
> ALSA: usb-audio: Fix potential out-of-bound access at parsing SU
>
> Takashi Iwai <tiwai@suse.de>
> ALSA: usb-audio: Add sanity checks to FE parser
>
> Henrik Eriksson <henrik.eriksson@axis.com>
> ALSA: pcm: update tstamp only if audio_tstamp changed
>
> Theodore Ts'o <tytso@mit.edu>
> ext4: fix interaction between i_size, fallocate, and delalloc after a crash
>
> Rameshwar Prasad Sahu <rsahu@apm.com>
> ata: fixes kernel crash while tracing ata_eh_link_autopsy event
>
> Arnd Bergmann <arnd@arndb.de>
> rtlwifi: fix uninitialized rtlhal->last_suspend_sec time
>
> Larry Finger <Larry.Finger@lwfinger.net>
> rtlwifi: rtl8192ee: Fix memory leak when loading firmware
>
> Andrew Elble <aweits@rit.edu>
> nfsd: deal with revoked delegations appropriately
>
> Chuck Lever <chuck.lever@oracle.com>
> nfs: Fix ugly referral attributes
>
> Joshua Watt <jpewhacker@gmail.com>
> NFS: Fix typo in nomigration mount option
>
> Arnd Bergmann <arnd@arndb.de>
> isofs: fix timestamps beyond 2027
>
> Coly Li <colyli@suse.de>
> bcache: check ca->alloc_thread initialized before wake up it
>
> Dan Carpenter <dan.carpenter@oracle.com>
> eCryptfs: use after free in ecryptfs_release_messaging()
>
> Andreas Rohner <andreas.rohner@gmx.net>
> nilfs2: fix race condition that causes file system corruption
>
> NeilBrown <neilb@suse.com>
> autofs: don't fail mount for transient error
>
> Mirko Parthey <mirko.parthey@web.de>
> MIPS: BCM47XX: Fix LED inversion for WRT54GSv1
>
> Maciej W. Rozycki <macro@mips.com>
> MIPS: Fix an n32 core file generation regset support regression
>
> Hou Tao <houtao1@huawei.com>
> dm: fix race between dm_get_from_kobject() and __dm_destroy()
>
> Eric Biggers <ebiggers@google.com>
> dm bufio: fix integer overflow when limiting maximum cache size
>
> Vijendar Mukunda <Vijendar.Mukunda@amd.com>
> ALSA: hda: Add Raven PCI ID
>
> Mathias Kresin <dev@kresin.me>
> MIPS: ralink: Fix typo in mt7628 pinmux function
>
> Mathias Kresin <dev@kresin.me>
> MIPS: ralink: Fix MT7628 pinmux
>
> Philip Derrin <philip@cog.systems>
> ARM: 8721/1: mm: dump: check hardware RO bit for LPAE
>
> Philip Derrin <philip@cog.systems>
> ARM: 8722/1: mm: make STRICT_KERNEL_RWX effective for LPAE
>
> Masami Hiramatsu <mhiramat@kernel.org>
> x86/decoder: Add new TEST instruction pattern
>
> Eric Biggers <ebiggers@google.com>
> lib/mpi: call cond_resched() from mpi_powm() loop
>
> Paul E. McKenney <paulmck@linux.vnet.ibm.com>
> sched: Make resched_cpu() unconditional
>
> WANG Cong <xiyou.wangcong@gmail.com>
> vsock: use new wait API for vsock_stream_sendmsg()
>
> Claudio Imbrenda <imbrenda@linux.vnet.ibm.com>
> AF_VSOCK: Shrink the area influenced by prepare_to_wait
>
> WANG Cong <xiyou.wangcong@gmail.com>
> ipv6: only call ip6_route_dev_notify() once for NETDEV_UNREGISTER
>
> Vasily Gorbik <gor@linux.vnet.ibm.com>
> s390/disassembler: increase show_code buffer size
>
> Heiko Carstens <heiko.carstens@de.ibm.com>
> s390/disassembler: add missing end marker for e7 table
>
> Heiko Carstens <heiko.carstens@de.ibm.com>
> s390/runtime instrumention: fix possible memory corruption
>
> Heiko Carstens <heiko.carstens@de.ibm.com>
> s390: fix transactional execution control register handling
>
>
> -------------
>
> Diffstat:
>
> Makefile | 4 +-
> arch/arm/mm/dump.c | 4 +-
> arch/arm/mm/init.c | 4 +-
> arch/mips/bcm47xx/leds.c | 2 +-
> arch/mips/kernel/ptrace.c | 17 ++
> arch/mips/ralink/mt7620.c | 4 +-
> arch/parisc/kernel/syscall.S | 6 +-
> arch/powerpc/kernel/signal.c | 2 +-
> arch/s390/include/asm/asm-prototypes.h | 8 +
> arch/s390/include/asm/switch_to.h | 2 +-
> arch/s390/kernel/dis.c | 5 +-
> arch/s390/kernel/early.c | 4 +-
> arch/s390/kernel/process.c | 1 +
> arch/s390/kernel/runtime_instr.c | 4 +-
> arch/x86/kvm/svm.c | 7 +
> arch/x86/kvm/vmx.c | 2 +
> arch/x86/lib/x86-opcode-map.txt | 2 +-
> drivers/ata/libata-eh.c | 2 +-
> drivers/base/power/opp/core.c | 1 +
> drivers/clk/ti/clk-dra7-atl.c | 3 +-
> drivers/dma/zx296702_dma.c | 1 +
> drivers/gpu/drm/armada/Makefile | 2 +
> drivers/gpu/drm/drm_mm.c | 16 +-
> drivers/iio/light/cm3232.c | 2 +-
> drivers/infiniband/ulp/srp/ib_srp.c | 25 ++-
> drivers/infiniband/ulp/srpt/ib_srpt.c | 9 +-
> drivers/md/bcache/alloc.c | 3 +-
> drivers/md/dm-bufio.c | 15 +-
> drivers/md/dm.c | 12 +-
> drivers/media/rc/ir-lirc-codec.c | 9 +-
> drivers/media/usb/as102/as102_fw.c | 28 ++-
> drivers/media/usb/cx231xx/cx231xx-cards.c | 2 +-
> drivers/media/v4l2-core/v4l2-ctrls.c | 16 +-
> drivers/net/ethernet/3com/typhoon.c | 25 ++-
> drivers/net/ethernet/intel/e1000e/mac.c | 11 +-
> drivers/net/ethernet/intel/e1000e/netdev.c | 4 +-
> drivers/net/ethernet/intel/e1000e/phy.c | 7 +-
> drivers/net/ethernet/intel/fm10k/fm10k_main.c | 2 +-
> drivers/net/ethernet/intel/i40e/i40e_main.c | 2 +-
> drivers/net/ethernet/intel/i40e/i40e_txrx.c | 2 +-
> drivers/net/ethernet/intel/i40evf/i40e_txrx.c | 2 +-
> drivers/net/ethernet/intel/igb/igb_main.c | 2 +-
> drivers/net/ethernet/intel/igbvf/netdev.c | 2 +-
> drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 2 +-
> drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c | 2 +-
> drivers/net/wireless/ath/ath10k/core.c | 5 +-
> drivers/net/wireless/ath/ath10k/mac.c | 58 ++++-
> drivers/net/wireless/ath/ath10k/wmi-tlv.c | 12 +-
> .../net/wireless/realtek/rtlwifi/rtl8192ee/fw.c | 6 +-
> .../net/wireless/realtek/rtlwifi/rtl8821ae/hw.c | 1 +
> drivers/nvdimm/label.c | 2 +-
> drivers/nvdimm/namespace_devs.c | 2 +-
> drivers/pci/probe.c | 15 +-
> drivers/spi/Kconfig | 1 +
> drivers/staging/iio/cdc/ad7150.c | 2 +-
> drivers/target/iscsi/iscsi_target.c | 8 +-
> drivers/target/target_core_transport.c | 4 +
> drivers/vhost/scsi.c | 5 +-
> drivers/xen/xenbus/xenbus_dev_frontend.c | 2 +-
> fs/9p/vfs_inode.c | 3 +
> fs/9p/vfs_inode_dotl.c | 3 +
> fs/autofs4/waitq.c | 15 +-
> fs/btrfs/uuid-tree.c | 4 +-
> fs/ecryptfs/messaging.c | 7 +-
> fs/ext4/crypto_key.c | 8 +-
> fs/ext4/extents.c | 6 +-
> fs/isofs/isofs.h | 2 +-
> fs/isofs/rock.h | 2 +-
> fs/isofs/util.c | 2 +-
> fs/nfs/nfs4proc.c | 18 +-
> fs/nfs/super.c | 2 +-
> fs/nfsd/nfs4state.c | 25 ++-
> fs/nilfs2/segment.c | 6 +-
> include/trace/events/sunrpc.h | 17 +-
> kernel/sched/core.c | 9 +-
> kernel/sched/rt.c | 235 ++++++++++-----------
> kernel/sched/sched.h | 24 ++-
> lib/mpi/mpi-pow.c | 2 +
> net/9p/client.c | 3 +-
> net/9p/trans_virtio.c | 13 +-
> net/ipv4/ip_sockglue.c | 7 +-
> net/ipv6/ipv6_sockglue.c | 16 +-
> net/ipv6/route.c | 6 +-
> net/mac80211/ieee80211_i.h | 1 -
> net/mac80211/mesh.c | 3 -
> net/mac80211/mesh_plink.c | 14 +-
> net/mac80211/mesh_sync.c | 11 -
> net/netfilter/nf_tables_api.c | 2 +-
> net/netfilter/nft_queue.c | 2 +-
> net/nfc/core.c | 2 +-
> net/rds/send.c | 11 +-
> net/vmw_vsock/af_vsock.c | 167 ++++++++-------
> sound/core/pcm_lib.c | 6 +-
> sound/core/timer_compat.c | 12 +-
> sound/pci/hda/hda_intel.c | 3 +
> sound/pci/hda/patch_realtek.c | 4 +-
> sound/soc/codecs/wm_adsp.c | 25 ++-
> sound/soc/sh/rcar/core.c | 4 +-
> sound/usb/clock.c | 9 +-
> sound/usb/mixer.c | 15 +-
> 100 files changed, 699 insertions(+), 437 deletions(-)
>
>
Merged, compiled, and flashed on my Pixel 2 XL and OnePlus 5. No
initial issues noticed in general usage or dmesg.
^ permalink raw reply [flat|nested] 124+ messages in thread* Re: [PATCH 4.4 00/96] 4.4.103-stable review
2017-11-28 18:27 ` Nathan Chancellor
@ 2017-11-29 8:07 ` Greg Kroah-Hartman
0 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-11-29 8:07 UTC (permalink / raw)
To: Nathan Chancellor
Cc: linux-kernel, torvalds, akpm, linux, shuahkh, patches,
ben.hutchings, lkft-triage, stable
On Tue, Nov 28, 2017 at 11:27:24AM -0700, Nathan Chancellor wrote:
> Merged, compiled, and flashed on my Pixel 2 XL and OnePlus 5. No
> initial issues noticed in general usage or dmesg.
Wonderful, thanks for testing and letting me know.
greg k-h
^ permalink raw reply [flat|nested] 124+ messages in thread
* Re: [PATCH 4.4 00/96] 4.4.103-stable review
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (94 preceding siblings ...)
2017-11-28 18:27 ` Nathan Chancellor
@ 2017-11-28 19:46 ` Shuah Khan
2017-11-28 21:51 ` Guenter Roeck
96 siblings, 0 replies; 124+ messages in thread
From: Shuah Khan @ 2017-11-28 19:46 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel
Cc: torvalds, akpm, linux, patches, ben.hutchings, lkft-triage,
stable, Shuah Khan
On 11/28/2017 03:22 AM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.4.103 release.
> There are 96 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu Nov 30 10:04:41 UTC 2017.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.103-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
^ permalink raw reply [flat|nested] 124+ messages in thread* Re: [PATCH 4.4 00/96] 4.4.103-stable review
2017-11-28 10:22 [PATCH 4.4 00/96] 4.4.103-stable review Greg Kroah-Hartman
` (95 preceding siblings ...)
2017-11-28 19:46 ` Shuah Khan
@ 2017-11-28 21:51 ` Guenter Roeck
96 siblings, 0 replies; 124+ messages in thread
From: Guenter Roeck @ 2017-11-28 21:51 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, torvalds, akpm, shuahkh, patches, ben.hutchings,
lkft-triage, stable
On Tue, Nov 28, 2017 at 11:22:09AM +0100, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.4.103 release.
> There are 96 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu Nov 30 10:04:41 UTC 2017.
> Anything received after that time might be too late.
>
Build results:
total: 145 pass: 145 fail: 0
Qemu test results:
total: 116 pass: 116 fail: 0
Details are available at http://kerneltests.org/builders.
Guenter
^ permalink raw reply [flat|nested] 124+ messages in thread