* [PATCH 3.15 01/61] rtc: rtc-at91rm9200: fix infinite wait for ACKUPD irq
2014-06-24 15:50 [PATCH 3.15 00/61] 3.15.2-stable review Greg Kroah-Hartman
@ 2014-06-24 15:50 ` Greg Kroah-Hartman
2014-06-24 15:50 ` [PATCH 3.15 02/61] target: Fix NULL pointer dereference for XCOPY in target_put_sess_cmd Greg Kroah-Hartman
` (58 subsequent siblings)
59 siblings, 0 replies; 69+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-24 15:50 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Boris BREZILLON, Bryan Evenson,
Andrew Victor, Nicolas Ferre, Jean-Christophe Plagniol-Villard,
Alessandro Zummo, Andrew Morton, Linus Torvalds
3.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boris BREZILLON <boris.brezillon@free-electrons.com>
commit 2fe121e1f5aa3bf31b418a9790db6c400e922291 upstream.
The rtc user must wait at least 1 sec between each time/calandar update
(see atmel's datasheet chapter "Updating Time/Calendar").
Use the 1Hz interrupt to update the at91_rtc_upd_rdy flag and wait for
the at91_rtc_wait_upd_rdy event if the rtc is not ready.
This patch fixes a deadlock in an uninterruptible wait when the RTC is
updated more than once every second. AFAICT the bug is here from the
beginning, but I think we should at least backport this fix to 3.10 and
the following longterm and stable releases.
Signed-off-by: Boris BREZILLON <boris.brezillon@free-electrons.com>
Reported-by: Bryan Evenson <bevenson@melinkcorp.com>
Tested-by: Bryan Evenson <bevenson@melinkcorp.com>
Cc: Andrew Victor <linux@maxim.org.za>
Cc: Nicolas Ferre <nicolas.ferre@atmel.com>
Cc: Jean-Christophe Plagniol-Villard <plagnioj@jcrosoft.com>
Cc: Alessandro Zummo <a.zummo@towertech.it>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/rtc/rtc-at91rm9200.c | 16 ++++++++++++++--
1 file changed, 14 insertions(+), 2 deletions(-)
--- a/drivers/rtc/rtc-at91rm9200.c
+++ b/drivers/rtc/rtc-at91rm9200.c
@@ -48,6 +48,7 @@ struct at91_rtc_config {
static const struct at91_rtc_config *at91_rtc_config;
static DECLARE_COMPLETION(at91_rtc_updated);
+static DECLARE_COMPLETION(at91_rtc_upd_rdy);
static unsigned int at91_alarm_year = AT91_RTC_EPOCH;
static void __iomem *at91_rtc_regs;
static int irq;
@@ -161,6 +162,8 @@ static int at91_rtc_settime(struct devic
1900 + tm->tm_year, tm->tm_mon, tm->tm_mday,
tm->tm_hour, tm->tm_min, tm->tm_sec);
+ wait_for_completion(&at91_rtc_upd_rdy);
+
/* Stop Time/Calendar from counting */
cr = at91_rtc_read(AT91_RTC_CR);
at91_rtc_write(AT91_RTC_CR, cr | AT91_RTC_UPDCAL | AT91_RTC_UPDTIM);
@@ -183,7 +186,9 @@ static int at91_rtc_settime(struct devic
/* Restart Time/Calendar */
cr = at91_rtc_read(AT91_RTC_CR);
+ at91_rtc_write(AT91_RTC_SCCR, AT91_RTC_SECEV);
at91_rtc_write(AT91_RTC_CR, cr & ~(AT91_RTC_UPDCAL | AT91_RTC_UPDTIM));
+ at91_rtc_write_ier(AT91_RTC_SECEV);
return 0;
}
@@ -290,8 +295,10 @@ static irqreturn_t at91_rtc_interrupt(in
if (rtsr) { /* this interrupt is shared! Is it ours? */
if (rtsr & AT91_RTC_ALARM)
events |= (RTC_AF | RTC_IRQF);
- if (rtsr & AT91_RTC_SECEV)
- events |= (RTC_UF | RTC_IRQF);
+ if (rtsr & AT91_RTC_SECEV) {
+ complete(&at91_rtc_upd_rdy);
+ at91_rtc_write_idr(AT91_RTC_SECEV);
+ }
if (rtsr & AT91_RTC_ACKUPD)
complete(&at91_rtc_updated);
@@ -413,6 +420,11 @@ static int __init at91_rtc_probe(struct
return PTR_ERR(rtc);
platform_set_drvdata(pdev, rtc);
+ /* enable SECEV interrupt in order to initialize at91_rtc_upd_rdy
+ * completion.
+ */
+ at91_rtc_write_ier(AT91_RTC_SECEV);
+
dev_info(&pdev->dev, "AT91 Real Time Clock driver.\n");
return 0;
}
^ permalink raw reply [flat|nested] 69+ messages in thread* [PATCH 3.15 02/61] target: Fix NULL pointer dereference for XCOPY in target_put_sess_cmd
2014-06-24 15:50 [PATCH 3.15 00/61] 3.15.2-stable review Greg Kroah-Hartman
2014-06-24 15:50 ` [PATCH 3.15 01/61] rtc: rtc-at91rm9200: fix infinite wait for ACKUPD irq Greg Kroah-Hartman
@ 2014-06-24 15:50 ` Greg Kroah-Hartman
2014-06-24 15:50 ` [PATCH 3.15 03/61] iscsi-target: Reject mutual authentication with reflected CHAP_C Greg Kroah-Hartman
` (57 subsequent siblings)
59 siblings, 0 replies; 69+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-24 15:50 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thomas Glanzmann, Mikulas Patocka,
Nicholas Bellinger
3.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Bellinger <nab@linux-iscsi.org>
commit 0ed6e189e3f6ac3a25383ed5cc8b0ac24c9b97b7 upstream.
This patch fixes a NULL pointer dereference regression bug that was
introduced with:
commit 1e1110c43b1cda9fe77fc4a04835e460550e6b3c
Author: Mikulas Patocka <mpatocka@redhat.com>
Date: Sat May 17 06:49:22 2014 -0400
target: fix memory leak on XCOPY
Now that target_put_sess_cmd() -> kref_put_spinlock_irqsave() is
called with a valid se_cmd->cmd_kref, a NULL pointer dereference
is triggered because the XCOPY passthrough commands don't have
an associated se_session pointer.
To address this bug, go ahead and checking for a NULL se_sess pointer
within target_put_sess_cmd(), and call se_cmd->se_tfo->release_cmd()
to release the XCOPY's xcopy_pt_cmd memory.
Reported-by: Thomas Glanzmann <thomas@glanzmann.de>
Cc: Thomas Glanzmann <thomas@glanzmann.de>
Cc: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/target/target_core_transport.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -2407,6 +2407,10 @@ static void target_release_cmd_kref(stru
*/
int target_put_sess_cmd(struct se_session *se_sess, struct se_cmd *se_cmd)
{
+ if (!se_sess) {
+ se_cmd->se_tfo->release_cmd(se_cmd);
+ return 1;
+ }
return kref_put_spinlock_irqsave(&se_cmd->cmd_kref, target_release_cmd_kref,
&se_sess->sess_cmd_lock);
}
^ permalink raw reply [flat|nested] 69+ messages in thread* [PATCH 3.15 03/61] iscsi-target: Reject mutual authentication with reflected CHAP_C
2014-06-24 15:50 [PATCH 3.15 00/61] 3.15.2-stable review Greg Kroah-Hartman
2014-06-24 15:50 ` [PATCH 3.15 01/61] rtc: rtc-at91rm9200: fix infinite wait for ACKUPD irq Greg Kroah-Hartman
2014-06-24 15:50 ` [PATCH 3.15 02/61] target: Fix NULL pointer dereference for XCOPY in target_put_sess_cmd Greg Kroah-Hartman
@ 2014-06-24 15:50 ` Greg Kroah-Hartman
2014-06-24 15:50 ` [PATCH 3.15 04/61] ima: audit log files opened with O_DIRECT flag Greg Kroah-Hartman
` (56 subsequent siblings)
59 siblings, 0 replies; 69+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-24 15:50 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tejas Vaykole, Nicholas Bellinger
3.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Bellinger <nab@linux-iscsi.org>
commit 1d2b60a5545942b1376cb48c1d55843d71e3a08f upstream.
This patch adds an explicit check in chap_server_compute_md5() to ensure
the CHAP_C value received from the initiator during mutual authentication
does not match the original CHAP_C provided by the target.
This is in line with RFC-3720, section 8.2.1:
Originators MUST NOT reuse the CHAP challenge sent by the Responder
for the other direction of a bidirectional authentication.
Responders MUST check for this condition and close the iSCSI TCP
connection if it occurs.
Reported-by: Tejas Vaykole <tejas.vaykole@calsoftinc.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/target/iscsi/iscsi_target_auth.c | 10 ++++++++++
1 file changed, 10 insertions(+)
--- a/drivers/target/iscsi/iscsi_target_auth.c
+++ b/drivers/target/iscsi/iscsi_target_auth.c
@@ -314,6 +314,16 @@ static int chap_server_compute_md5(
goto out;
}
/*
+ * During mutual authentication, the CHAP_C generated by the
+ * initiator must not match the original CHAP_C generated by
+ * the target.
+ */
+ if (!memcmp(challenge_binhex, chap->challenge, CHAP_CHALLENGE_LENGTH)) {
+ pr_err("initiator CHAP_C matches target CHAP_C, failing"
+ " login attempt\n");
+ goto out;
+ }
+ /*
* Generate CHAP_N and CHAP_R for mutual authentication.
*/
tfm = crypto_alloc_hash("md5", 0, CRYPTO_ALG_ASYNC);
^ permalink raw reply [flat|nested] 69+ messages in thread* [PATCH 3.15 04/61] ima: audit log files opened with O_DIRECT flag
2014-06-24 15:50 [PATCH 3.15 00/61] 3.15.2-stable review Greg Kroah-Hartman
` (2 preceding siblings ...)
2014-06-24 15:50 ` [PATCH 3.15 03/61] iscsi-target: Reject mutual authentication with reflected CHAP_C Greg Kroah-Hartman
@ 2014-06-24 15:50 ` Greg Kroah-Hartman
2014-06-24 15:50 ` [PATCH 3.15 05/61] ima: introduce ima_kernel_read() Greg Kroah-Hartman
` (55 subsequent siblings)
59 siblings, 0 replies; 69+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-24 15:50 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Mimi Zohar, Dmitry Kasatkin
3.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mimi Zohar <zohar@linux.vnet.ibm.com>
commit f9b2a735bdddf836214b5dca74f6ca7712e5a08c upstream.
Files are measured or appraised based on the IMA policy. When a
file, in policy, is opened with the O_DIRECT flag, a deadlock
occurs.
The first attempt at resolving this lockdep temporarily removed the
O_DIRECT flag and restored it, after calculating the hash. The
second attempt introduced the O_DIRECT_HAVELOCK flag. Based on this
flag, do_blockdev_direct_IO() would skip taking the i_mutex a second
time. The third attempt, by Dmitry Kasatkin, resolves the i_mutex
locking issue, by re-introducing the IMA mutex, but uncovered
another problem. Reading a file with O_DIRECT flag set, writes
directly to userspace pages. A second patch allocates a user-space
like memory. This works for all IMA hooks, except ima_file_free(),
which is called on __fput() to recalculate the file hash.
Until this last issue is addressed, do not 'collect' the
measurement for measuring, appraising, or auditing files opened
with the O_DIRECT flag set. Based on policy, permit or deny file
access. This patch defines a new IMA policy rule option named
'permit_directio'. Policy rules could be defined, based on LSM
or other criteria, to permit specific applications to open files
with the O_DIRECT flag set.
Changelog v1:
- permit or deny file access based IMA policy rules
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Acked-by: Dmitry Kasatkin <d.kasatkin@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/ABI/testing/ima_policy | 2 +-
security/integrity/ima/ima_api.c | 10 +++++++++-
security/integrity/ima/ima_main.c | 5 ++++-
security/integrity/ima/ima_policy.c | 6 +++++-
security/integrity/integrity.h | 1 +
5 files changed, 20 insertions(+), 4 deletions(-)
--- a/Documentation/ABI/testing/ima_policy
+++ b/Documentation/ABI/testing/ima_policy
@@ -23,7 +23,7 @@ Description:
[fowner]]
lsm: [[subj_user=] [subj_role=] [subj_type=]
[obj_user=] [obj_role=] [obj_type=]]
- option: [[appraise_type=]]
+ option: [[appraise_type=]] [permit_directio]
base: func:= [BPRM_CHECK][MMAP_CHECK][FILE_CHECK][MODULE_CHECK]
mask:= [MAY_READ] [MAY_WRITE] [MAY_APPEND] [MAY_EXEC]
--- a/security/integrity/ima/ima_api.c
+++ b/security/integrity/ima/ima_api.c
@@ -199,6 +199,7 @@ int ima_collect_measurement(struct integ
struct evm_ima_xattr_data **xattr_value,
int *xattr_len)
{
+ const char *audit_cause = "failed";
struct inode *inode = file_inode(file);
const char *filename = file->f_dentry->d_name.name;
int result = 0;
@@ -213,6 +214,12 @@ int ima_collect_measurement(struct integ
if (!(iint->flags & IMA_COLLECTED)) {
u64 i_version = file_inode(file)->i_version;
+ if (file->f_flags & O_DIRECT) {
+ audit_cause = "failed(directio)";
+ result = -EACCES;
+ goto out;
+ }
+
/* use default hash algorithm */
hash.hdr.algo = ima_hash_algo;
@@ -233,9 +240,10 @@ int ima_collect_measurement(struct integ
result = -ENOMEM;
}
}
+out:
if (result)
integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode,
- filename, "collect_data", "failed",
+ filename, "collect_data", audit_cause,
result, 0);
return result;
}
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -214,8 +214,11 @@ static int process_measurement(struct fi
xattr_ptr = &xattr_value;
rc = ima_collect_measurement(iint, file, xattr_ptr, &xattr_len);
- if (rc != 0)
+ if (rc != 0) {
+ if (file->f_flags & O_DIRECT)
+ rc = (iint->flags & IMA_PERMIT_DIRECTIO) ? 0 : -EACCES;
goto out_digsig;
+ }
pathname = filename ?: ima_d_path(&file->f_path, &pathbuf);
--- a/security/integrity/ima/ima_policy.c
+++ b/security/integrity/ima/ima_policy.c
@@ -353,7 +353,7 @@ enum {
Opt_obj_user, Opt_obj_role, Opt_obj_type,
Opt_subj_user, Opt_subj_role, Opt_subj_type,
Opt_func, Opt_mask, Opt_fsmagic, Opt_uid, Opt_fowner,
- Opt_appraise_type, Opt_fsuuid
+ Opt_appraise_type, Opt_fsuuid, Opt_permit_directio
};
static match_table_t policy_tokens = {
@@ -375,6 +375,7 @@ static match_table_t policy_tokens = {
{Opt_uid, "uid=%s"},
{Opt_fowner, "fowner=%s"},
{Opt_appraise_type, "appraise_type=%s"},
+ {Opt_permit_directio, "permit_directio"},
{Opt_err, NULL}
};
@@ -622,6 +623,9 @@ static int ima_parse_rule(char *rule, st
else
result = -EINVAL;
break;
+ case Opt_permit_directio:
+ entry->flags |= IMA_PERMIT_DIRECTIO;
+ break;
case Opt_err:
ima_log_string(ab, "UNKNOWN", p);
result = -EINVAL;
--- a/security/integrity/integrity.h
+++ b/security/integrity/integrity.h
@@ -30,6 +30,7 @@
#define IMA_ACTION_FLAGS 0xff000000
#define IMA_DIGSIG 0x01000000
#define IMA_DIGSIG_REQUIRED 0x02000000
+#define IMA_PERMIT_DIRECTIO 0x04000000
#define IMA_DO_MASK (IMA_MEASURE | IMA_APPRAISE | IMA_AUDIT | \
IMA_APPRAISE_SUBMASK)
^ permalink raw reply [flat|nested] 69+ messages in thread* [PATCH 3.15 05/61] ima: introduce ima_kernel_read()
2014-06-24 15:50 [PATCH 3.15 00/61] 3.15.2-stable review Greg Kroah-Hartman
` (3 preceding siblings ...)
2014-06-24 15:50 ` [PATCH 3.15 04/61] ima: audit log files opened with O_DIRECT flag Greg Kroah-Hartman
@ 2014-06-24 15:50 ` Greg Kroah-Hartman
2014-06-24 15:50 ` [PATCH 3.15 06/61] evm: prohibit userspace writing security.evm HMAC value Greg Kroah-Hartman
` (54 subsequent siblings)
59 siblings, 0 replies; 69+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-24 15:50 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dmitry Kasatkin, Eric W. Biederman,
Mimi Zohar
3.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Kasatkin <d.kasatkin@samsung.com>
commit 0430e49b6e7c6b5e076be8fefdee089958c9adad upstream.
Commit 8aac62706 "move exit_task_namespaces() outside of exit_notify"
introduced the kernel opps since the kernel v3.10, which happens when
Apparmor and IMA-appraisal are enabled at the same time.
----------------------------------------------------------------------
[ 106.750167] BUG: unable to handle kernel NULL pointer dereference at
0000000000000018
[ 106.750221] IP: [<ffffffff811ec7da>] our_mnt+0x1a/0x30
[ 106.750241] PGD 0
[ 106.750254] Oops: 0000 [#1] SMP
[ 106.750272] Modules linked in: cuse parport_pc ppdev bnep rfcomm
bluetooth rpcsec_gss_krb5 nfsd auth_rpcgss nfs_acl nfs lockd sunrpc
fscache dm_crypt intel_rapl x86_pkg_temp_thermal intel_powerclamp
kvm_intel snd_hda_codec_hdmi kvm crct10dif_pclmul crc32_pclmul
ghash_clmulni_intel aesni_intel aes_x86_64 glue_helper lrw gf128mul
ablk_helper cryptd snd_hda_codec_realtek dcdbas snd_hda_intel
snd_hda_codec snd_hwdep snd_pcm snd_page_alloc snd_seq_midi
snd_seq_midi_event snd_rawmidi psmouse snd_seq microcode serio_raw
snd_timer snd_seq_device snd soundcore video lpc_ich coretemp mac_hid lp
parport mei_me mei nbd hid_generic e1000e usbhid ahci ptp hid libahci
pps_core
[ 106.750658] CPU: 6 PID: 1394 Comm: mysqld Not tainted 3.13.0-rc7-kds+ #15
[ 106.750673] Hardware name: Dell Inc. OptiPlex 9010/0M9KCM, BIOS A08
09/19/2012
[ 106.750689] task: ffff8800de804920 ti: ffff880400fca000 task.ti:
ffff880400fca000
[ 106.750704] RIP: 0010:[<ffffffff811ec7da>] [<ffffffff811ec7da>]
our_mnt+0x1a/0x30
[ 106.750725] RSP: 0018:ffff880400fcba60 EFLAGS: 00010286
[ 106.750738] RAX: 0000000000000000 RBX: 0000000000000100 RCX:
ffff8800d51523e7
[ 106.750764] RDX: ffffffffffffffea RSI: ffff880400fcba34 RDI:
ffff880402d20020
[ 106.750791] RBP: ffff880400fcbae0 R08: 0000000000000000 R09:
0000000000000001
[ 106.750817] R10: 0000000000000000 R11: 0000000000000001 R12:
ffff8800d5152300
[ 106.750844] R13: ffff8803eb8df510 R14: ffff880400fcbb28 R15:
ffff8800d51523e7
[ 106.750871] FS: 0000000000000000(0000) GS:ffff88040d200000(0000)
knlGS:0000000000000000
[ 106.750910] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 106.750935] CR2: 0000000000000018 CR3: 0000000001c0e000 CR4:
00000000001407e0
[ 106.750962] Stack:
[ 106.750981] ffffffff813434eb ffff880400fcbb20 ffff880400fcbb18
0000000000000000
[ 106.751037] ffff8800de804920 ffffffff8101b9b9 0001800000000000
0000000000000100
[ 106.751093] 0000010000000000 0000000000000002 000000000000000e
ffff8803eb8df500
[ 106.751149] Call Trace:
[ 106.751172] [<ffffffff813434eb>] ? aa_path_name+0x2ab/0x430
[ 106.751199] [<ffffffff8101b9b9>] ? sched_clock+0x9/0x10
[ 106.751225] [<ffffffff8134a68d>] aa_path_perm+0x7d/0x170
[ 106.751250] [<ffffffff8101b945>] ? native_sched_clock+0x15/0x80
[ 106.751276] [<ffffffff8134aa73>] aa_file_perm+0x33/0x40
[ 106.751301] [<ffffffff81348c5e>] common_file_perm+0x8e/0xb0
[ 106.751327] [<ffffffff81348d78>] apparmor_file_permission+0x18/0x20
[ 106.751355] [<ffffffff8130c853>] security_file_permission+0x23/0xa0
[ 106.751382] [<ffffffff811c77a2>] rw_verify_area+0x52/0xe0
[ 106.751407] [<ffffffff811c789d>] vfs_read+0x6d/0x170
[ 106.751432] [<ffffffff811cda31>] kernel_read+0x41/0x60
[ 106.751457] [<ffffffff8134fd45>] ima_calc_file_hash+0x225/0x280
[ 106.751483] [<ffffffff8134fb52>] ? ima_calc_file_hash+0x32/0x280
[ 106.751509] [<ffffffff8135022d>] ima_collect_measurement+0x9d/0x160
[ 106.751536] [<ffffffff810b552d>] ? trace_hardirqs_on+0xd/0x10
[ 106.751562] [<ffffffff8134f07c>] ? ima_file_free+0x6c/0xd0
[ 106.751587] [<ffffffff81352824>] ima_update_xattr+0x34/0x60
[ 106.751612] [<ffffffff8134f0d0>] ima_file_free+0xc0/0xd0
[ 106.751637] [<ffffffff811c9635>] __fput+0xd5/0x300
[ 106.751662] [<ffffffff811c98ae>] ____fput+0xe/0x10
[ 106.751687] [<ffffffff81086774>] task_work_run+0xc4/0xe0
[ 106.751712] [<ffffffff81066fad>] do_exit+0x2bd/0xa90
[ 106.751738] [<ffffffff8173c958>] ? retint_swapgs+0x13/0x1b
[ 106.751763] [<ffffffff8106780c>] do_group_exit+0x4c/0xc0
[ 106.751788] [<ffffffff81067894>] SyS_exit_group+0x14/0x20
[ 106.751814] [<ffffffff8174522d>] system_call_fastpath+0x1a/0x1f
[ 106.751839] Code: c3 0f 1f 44 00 00 55 48 89 e5 e8 22 fe ff ff 5d c3
0f 1f 44 00 00 55 65 48 8b 04 25 c0 c9 00 00 48 8b 80 28 06 00 00 48 89
e5 5d <48> 8b 40 18 48 39 87 c0 00 00 00 0f 94 c0 c3 0f 1f 80 00 00 00
[ 106.752185] RIP [<ffffffff811ec7da>] our_mnt+0x1a/0x30
[ 106.752214] RSP <ffff880400fcba60>
[ 106.752236] CR2: 0000000000000018
[ 106.752258] ---[ end trace 3c520748b4732721 ]---
----------------------------------------------------------------------
The reason for the oops is that IMA-appraisal uses "kernel_read()" when
file is closed. kernel_read() honors LSM security hook which calls
Apparmor handler, which uses current->nsproxy->mnt_ns. The 'guilty'
commit changed the order of cleanup code so that nsproxy->mnt_ns was
not already available for Apparmor.
Discussion about the issue with Al Viro and Eric W. Biederman suggested
that kernel_read() is too high-level for IMA. Another issue, except
security checking, that was identified is mandatory locking. kernel_read
honors it as well and it might prevent IMA from calculating necessary hash.
It was suggested to use simplified version of the function without security
and locking checks.
This patch introduces special version ima_kernel_read(), which skips security
and mandatory locking checking. It prevents the kernel oops to happen.
Signed-off-by: Dmitry Kasatkin <d.kasatkin@samsung.com>
Suggested-by: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
security/integrity/ima/ima_crypto.c | 32 +++++++++++++++++++++++++++++++-
1 file changed, 31 insertions(+), 1 deletion(-)
--- a/security/integrity/ima/ima_crypto.c
+++ b/security/integrity/ima/ima_crypto.c
@@ -27,6 +27,36 @@
static struct crypto_shash *ima_shash_tfm;
+/**
+ * ima_kernel_read - read file content
+ *
+ * This is a function for reading file content instead of kernel_read().
+ * It does not perform locking checks to ensure it cannot be blocked.
+ * It does not perform security checks because it is irrelevant for IMA.
+ *
+ */
+static int ima_kernel_read(struct file *file, loff_t offset,
+ char *addr, unsigned long count)
+{
+ mm_segment_t old_fs;
+ char __user *buf = addr;
+ ssize_t ret;
+
+ if (!(file->f_mode & FMODE_READ))
+ return -EBADF;
+ if (!file->f_op->read && !file->f_op->aio_read)
+ return -EINVAL;
+
+ old_fs = get_fs();
+ set_fs(get_ds());
+ if (file->f_op->read)
+ ret = file->f_op->read(file, buf, count, &offset);
+ else
+ ret = do_sync_read(file, buf, count, &offset);
+ set_fs(old_fs);
+ return ret;
+}
+
int ima_init_crypto(void)
{
long rc;
@@ -104,7 +134,7 @@ static int ima_calc_file_hash_tfm(struct
while (offset < i_size) {
int rbuf_len;
- rbuf_len = kernel_read(file, offset, rbuf, PAGE_SIZE);
+ rbuf_len = ima_kernel_read(file, offset, rbuf, PAGE_SIZE);
if (rbuf_len < 0) {
rc = rbuf_len;
break;
^ permalink raw reply [flat|nested] 69+ messages in thread* [PATCH 3.15 06/61] evm: prohibit userspace writing security.evm HMAC value
2014-06-24 15:50 [PATCH 3.15 00/61] 3.15.2-stable review Greg Kroah-Hartman
` (4 preceding siblings ...)
2014-06-24 15:50 ` [PATCH 3.15 05/61] ima: introduce ima_kernel_read() Greg Kroah-Hartman
@ 2014-06-24 15:50 ` Greg Kroah-Hartman
2014-06-24 15:50 ` [PATCH 3.15 07/61] ipv6: Fix regression caused by efe4208 in udp_v6_mcast_next() Greg Kroah-Hartman
` (53 subsequent siblings)
59 siblings, 0 replies; 69+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-24 15:50 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Mimi Zohar
3.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mimi Zohar <zohar@linux.vnet.ibm.com>
commit 2fb1c9a4f2dbc2f0bd2431c7fa64d0b5483864e4 upstream.
Calculating the 'security.evm' HMAC value requires access to the
EVM encrypted key. Only the kernel should have access to it. This
patch prevents userspace tools(eg. setfattr, cp --preserve=xattr)
from setting/modifying the 'security.evm' HMAC value directly.
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
security/integrity/evm/evm_main.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
--- a/security/integrity/evm/evm_main.c
+++ b/security/integrity/evm/evm_main.c
@@ -287,12 +287,20 @@ out:
* @xattr_value: pointer to the new extended attribute value
* @xattr_value_len: pointer to the new extended attribute value length
*
- * Updating 'security.evm' requires CAP_SYS_ADMIN privileges and that
- * the current value is valid.
+ * Before allowing the 'security.evm' protected xattr to be updated,
+ * verify the existing value is valid. As only the kernel should have
+ * access to the EVM encrypted key needed to calculate the HMAC, prevent
+ * userspace from writing HMAC value. Writing 'security.evm' requires
+ * requires CAP_SYS_ADMIN privileges.
*/
int evm_inode_setxattr(struct dentry *dentry, const char *xattr_name,
const void *xattr_value, size_t xattr_value_len)
{
+ const struct evm_ima_xattr_data *xattr_data = xattr_value;
+
+ if ((strcmp(xattr_name, XATTR_NAME_EVM) == 0)
+ && (xattr_data->type == EVM_XATTR_HMAC))
+ return -EPERM;
return evm_protect_xattr(dentry, xattr_name, xattr_value,
xattr_value_len);
}
^ permalink raw reply [flat|nested] 69+ messages in thread* [PATCH 3.15 07/61] ipv6: Fix regression caused by efe4208 in udp_v6_mcast_next()
2014-06-24 15:50 [PATCH 3.15 00/61] 3.15.2-stable review Greg Kroah-Hartman
` (5 preceding siblings ...)
2014-06-24 15:50 ` [PATCH 3.15 06/61] evm: prohibit userspace writing security.evm HMAC value Greg Kroah-Hartman
@ 2014-06-24 15:50 ` Greg Kroah-Hartman
2014-06-24 15:50 ` [PATCH 3.15 08/61] net: tunnels - enable module autoloading Greg Kroah-Hartman
` (52 subsequent siblings)
59 siblings, 0 replies; 69+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-24 15:50 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sven Wegener, Eric Dumazet, David S. Miller
3.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Wegener <sven.wegener@stealer.net>
[ Upstream commit 3bfdc59a6c24608ed23e903f670aaf5f58c7a6f3 ]
Commit efe4208 ("ipv6: make lookups simpler and faster") introduced a
regression in udp_v6_mcast_next(), resulting in multicast packets not
reaching the destination sockets under certain conditions.
The packet's IPv6 addresses are wrongly compared to the IPv6 addresses
from the function's socket argument, which indicates the starting point
for looping, instead of the loop variable. If the addresses from the
first socket do not match the packet's addresses, no socket in the list
will match.
Signed-off-by: Sven Wegener <sven.wegener@stealer.net>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv6/udp.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -716,15 +716,15 @@ static struct sock *udp_v6_mcast_next(st
if (inet->inet_dport != rmt_port)
continue;
}
- if (!ipv6_addr_any(&sk->sk_v6_daddr) &&
- !ipv6_addr_equal(&sk->sk_v6_daddr, rmt_addr))
+ if (!ipv6_addr_any(&s->sk_v6_daddr) &&
+ !ipv6_addr_equal(&s->sk_v6_daddr, rmt_addr))
continue;
if (s->sk_bound_dev_if && s->sk_bound_dev_if != dif)
continue;
- if (!ipv6_addr_any(&sk->sk_v6_rcv_saddr)) {
- if (!ipv6_addr_equal(&sk->sk_v6_rcv_saddr, loc_addr))
+ if (!ipv6_addr_any(&s->sk_v6_rcv_saddr)) {
+ if (!ipv6_addr_equal(&s->sk_v6_rcv_saddr, loc_addr))
continue;
}
if (!inet6_mc_check(s, loc_addr, rmt_addr))
^ permalink raw reply [flat|nested] 69+ messages in thread* [PATCH 3.15 08/61] net: tunnels - enable module autoloading
2014-06-24 15:50 [PATCH 3.15 00/61] 3.15.2-stable review Greg Kroah-Hartman
` (6 preceding siblings ...)
2014-06-24 15:50 ` [PATCH 3.15 07/61] ipv6: Fix regression caused by efe4208 in udp_v6_mcast_next() Greg Kroah-Hartman
@ 2014-06-24 15:50 ` Greg Kroah-Hartman
2014-06-24 15:50 ` [PATCH 3.15 09/61] sh_eth: use RNC mode for packet reception Greg Kroah-Hartman
` (51 subsequent siblings)
59 siblings, 0 replies; 69+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-24 15:50 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Tom Gundersen, David S. Miller
3.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tom Gundersen <teg@jklm.no>
[ Upstream commit f98f89a0104454f35a62d681683c844f6dbf4043 ]
Enable the module alias hookup to allow tunnel modules to be autoloaded on demand.
This is in line with how most other netdev kinds work, and will allow userspace
to create tunnels without having CAP_SYS_MODULE.
Signed-off-by: Tom Gundersen <teg@jklm.no>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/ipip.c | 1 +
net/ipv6/ip6_tunnel.c | 1 +
net/ipv6/sit.c | 1 +
3 files changed, 3 insertions(+)
--- a/net/ipv4/ipip.c
+++ b/net/ipv4/ipip.c
@@ -486,4 +486,5 @@ static void __exit ipip_fini(void)
module_init(ipip_init);
module_exit(ipip_fini);
MODULE_LICENSE("GPL");
+MODULE_ALIAS_RTNL_LINK("ipip");
MODULE_ALIAS_NETDEV("tunl0");
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -61,6 +61,7 @@
MODULE_AUTHOR("Ville Nuorvala");
MODULE_DESCRIPTION("IPv6 tunneling device");
MODULE_LICENSE("GPL");
+MODULE_ALIAS_RTNL_LINK("ip6tnl");
MODULE_ALIAS_NETDEV("ip6tnl0");
#ifdef IP6_TNL_DEBUG
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -1828,4 +1828,5 @@ xfrm_tunnel_failed:
module_init(sit_init);
module_exit(sit_cleanup);
MODULE_LICENSE("GPL");
+MODULE_ALIAS_RTNL_LINK("sit");
MODULE_ALIAS_NETDEV("sit0");
^ permalink raw reply [flat|nested] 69+ messages in thread* [PATCH 3.15 09/61] sh_eth: use RNC mode for packet reception
2014-06-24 15:50 [PATCH 3.15 00/61] 3.15.2-stable review Greg Kroah-Hartman
` (7 preceding siblings ...)
2014-06-24 15:50 ` [PATCH 3.15 08/61] net: tunnels - enable module autoloading Greg Kroah-Hartman
@ 2014-06-24 15:50 ` Greg Kroah-Hartman
2014-06-24 15:50 ` [PATCH 3.15 10/61] sh_eth: fix SH7619/771x support Greg Kroah-Hartman
` (50 subsequent siblings)
59 siblings, 0 replies; 69+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-24 15:50 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sergei Shtylyov, Ben Dooks,
Yoshihiro Shimoda, Simon Horman, David S. Miller
3.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Dooks <ben.dooks@codethink.co.uk>
[ Upstream commit 530aa2d0d9d55ab2775d47621ddf4b5b15bc1110 ]
The current behaviour of the sh_eth driver is not to use the RNC bit
for the receive ring. This means that every packet recieved is not only
generating an IRQ but it also stops the receive ring DMA as well until
the driver re-enables it after unloading the packet.
This means that a number of the following errors are generated due to
the receive packet FIFO overflowing due to nowhere to put packets:
net eth0: Receive FIFO Overflow
Since feedback from Yoshihiro Shimoda shows that every supported LSI
for this driver should have the bit enabled it seems the best way is
to remove the RMCR default value from the per-system data and just
write it when initialising the RMCR value. This is discussed in
the message (http://www.spinics.net/lists/netdev/msg284912.html).
I have tested the RMCR_RNC configuration with NFS root filesystem and
the driver has not failed yet. There are further test reports from
Sergei Shtylov and others for both the R8A7790 and R8A7791.
There is also feedback fron Cao Minh Hiep[1] which reports the
same issue in (http://comments.gmane.org/gmane.linux.network/316285)
showing this fixes issues with losing UDP datagrams under iperf.
Tested-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
Signed-off-by: Ben Dooks <ben.dooks@codethink.co.uk>
Acked-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Acked-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/renesas/sh_eth.c | 11 ++---------
drivers/net/ethernet/renesas/sh_eth.h | 2 --
2 files changed, 2 insertions(+), 11 deletions(-)
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -546,7 +546,6 @@ static struct sh_eth_cpu_data sh7757_dat
.register_type = SH_ETH_REG_FAST_SH4,
.eesipr_value = DMAC_M_RFRMER | DMAC_M_ECI | 0x003fffff,
- .rmcr_value = RMCR_RNC,
.tx_check = EESR_FTC | EESR_CND | EESR_DLC | EESR_CD | EESR_RTO,
.eesr_err_check = EESR_TWB | EESR_TABT | EESR_RABT | EESR_RFE |
@@ -624,7 +623,6 @@ static struct sh_eth_cpu_data sh7757_dat
EESR_RFE | EESR_RDE | EESR_RFRMER | EESR_TFE |
EESR_TDE | EESR_ECI,
.fdr_value = 0x0000072f,
- .rmcr_value = RMCR_RNC,
.irq_flags = IRQF_SHARED,
.apr = 1,
@@ -752,7 +750,6 @@ static struct sh_eth_cpu_data r8a7740_da
EESR_RFE | EESR_RDE | EESR_RFRMER | EESR_TFE |
EESR_TDE | EESR_ECI,
.fdr_value = 0x0000070f,
- .rmcr_value = RMCR_RNC,
.apr = 1,
.mpr = 1,
@@ -784,7 +781,6 @@ static struct sh_eth_cpu_data r7s72100_d
EESR_RFE | EESR_RDE | EESR_RFRMER | EESR_TFE |
EESR_TDE | EESR_ECI,
.fdr_value = 0x0000070f,
- .rmcr_value = RMCR_RNC,
.no_psr = 1,
.apr = 1,
@@ -833,9 +829,6 @@ static void sh_eth_set_default_cpu_data(
if (!cd->fdr_value)
cd->fdr_value = DEFAULT_FDR_INIT;
- if (!cd->rmcr_value)
- cd->rmcr_value = DEFAULT_RMCR_VALUE;
-
if (!cd->tx_check)
cd->tx_check = DEFAULT_TX_CHECK;
@@ -1287,8 +1280,8 @@ static int sh_eth_dev_init(struct net_de
sh_eth_write(ndev, mdp->cd->fdr_value, FDR);
sh_eth_write(ndev, 0, TFTR);
- /* Frame recv control */
- sh_eth_write(ndev, mdp->cd->rmcr_value, RMCR);
+ /* Frame recv control (enable multiple-packets per rx irq) */
+ sh_eth_write(ndev, RMCR_RNC, RMCR);
sh_eth_write(ndev, DESC_I_RINT8 | DESC_I_RINT5 | DESC_I_TINT2, TRSCER);
--- a/drivers/net/ethernet/renesas/sh_eth.h
+++ b/drivers/net/ethernet/renesas/sh_eth.h
@@ -319,7 +319,6 @@ enum TD_STS_BIT {
enum RMCR_BIT {
RMCR_RNC = 0x00000001,
};
-#define DEFAULT_RMCR_VALUE 0x00000000
/* ECMR */
enum FELIC_MODE_BIT {
@@ -466,7 +465,6 @@ struct sh_eth_cpu_data {
unsigned long fdr_value;
unsigned long fcftr_value;
unsigned long rpadir_value;
- unsigned long rmcr_value;
/* interrupt checking mask */
unsigned long tx_check;
^ permalink raw reply [flat|nested] 69+ messages in thread* [PATCH 3.15 10/61] sh_eth: fix SH7619/771x support
2014-06-24 15:50 [PATCH 3.15 00/61] 3.15.2-stable review Greg Kroah-Hartman
` (8 preceding siblings ...)
2014-06-24 15:50 ` [PATCH 3.15 09/61] sh_eth: use RNC mode for packet reception Greg Kroah-Hartman
@ 2014-06-24 15:50 ` Greg Kroah-Hartman
2014-06-24 15:50 ` [PATCH 3.15 11/61] net: filter: fix typo in sparc BPF JIT Greg Kroah-Hartman
` (49 subsequent siblings)
59 siblings, 0 replies; 69+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-24 15:50 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sergei Shtylyov, Yoshihiro Shimoda,
David S. Miller
3.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
[ Upstream commit d8b0426af5b67973585712c9af36b86f6ea97815 ]
Commit 4a55530f38e4 (net: sh_eth: modify the definitions of register) managed
to leave out the E-DMAC register entries in sh_eth_offset_fast_sh3_sh2[], thus
totally breaking SH7619/771x support. Add the missing entries using the data
from before that commit.
Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
Acked-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/renesas/sh_eth.c | 21 +++++++++++++++++++++
1 file changed, 21 insertions(+)
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -307,6 +307,27 @@ static const u16 sh_eth_offset_fast_sh4[
};
static const u16 sh_eth_offset_fast_sh3_sh2[SH_ETH_MAX_REGISTER_OFFSET] = {
+ [EDMR] = 0x0000,
+ [EDTRR] = 0x0004,
+ [EDRRR] = 0x0008,
+ [TDLAR] = 0x000c,
+ [RDLAR] = 0x0010,
+ [EESR] = 0x0014,
+ [EESIPR] = 0x0018,
+ [TRSCER] = 0x001c,
+ [RMFCR] = 0x0020,
+ [TFTR] = 0x0024,
+ [FDR] = 0x0028,
+ [RMCR] = 0x002c,
+ [EDOCR] = 0x0030,
+ [FCFTR] = 0x0034,
+ [RPADIR] = 0x0038,
+ [TRIMD] = 0x003c,
+ [RBWAR] = 0x0040,
+ [RDFAR] = 0x0044,
+ [TBRAR] = 0x004c,
+ [TDFAR] = 0x0050,
+
[ECMR] = 0x0160,
[ECSR] = 0x0164,
[ECSIPR] = 0x0168,
^ permalink raw reply [flat|nested] 69+ messages in thread* [PATCH 3.15 11/61] net: filter: fix typo in sparc BPF JIT
2014-06-24 15:50 [PATCH 3.15 00/61] 3.15.2-stable review Greg Kroah-Hartman
` (9 preceding siblings ...)
2014-06-24 15:50 ` [PATCH 3.15 10/61] sh_eth: fix SH7619/771x support Greg Kroah-Hartman
@ 2014-06-24 15:50 ` Greg Kroah-Hartman
2014-06-24 15:50 ` [PATCH 3.15 12/61] net: filter: fix sparc32 typo Greg Kroah-Hartman
` (48 subsequent siblings)
59 siblings, 0 replies; 69+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-24 15:50 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alexei Starovoitov, David S. Miller
3.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexei Starovoitov <ast@plumgrid.com>
[ Upstream commit 569810d1e3278907264f5b115281fca3f0038d53 ]
fix typo in sparc codegen for SKF_AD_IFINDEX and SKF_AD_HATYPE
classic BPF extensions
Fixes: 2809a2087cc4 ("net: filter: Just In Time compiler for sparc")
Signed-off-by: Alexei Starovoitov <ast@plumgrid.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/sparc/net/bpf_jit_comp.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/arch/sparc/net/bpf_jit_comp.c
+++ b/arch/sparc/net/bpf_jit_comp.c
@@ -83,9 +83,9 @@ static void bpf_flush_icache(void *start
#define BNE (F2(0, 2) | CONDNE)
#ifdef CONFIG_SPARC64
-#define BNE_PTR (F2(0, 1) | CONDNE | (2 << 20))
+#define BE_PTR (F2(0, 1) | CONDE | (2 << 20))
#else
-#define BNE_PTR BNE
+#define BE_PTR BNE
#endif
#define SETHI(K, REG) \
@@ -600,7 +600,7 @@ void bpf_jit_compile(struct sk_filter *f
case BPF_S_ANC_IFINDEX:
emit_skb_loadptr(dev, r_A);
emit_cmpi(r_A, 0);
- emit_branch(BNE_PTR, cleanup_addr + 4);
+ emit_branch(BE_PTR, cleanup_addr + 4);
emit_nop();
emit_load32(r_A, struct net_device, ifindex, r_A);
break;
@@ -613,7 +613,7 @@ void bpf_jit_compile(struct sk_filter *f
case BPF_S_ANC_HATYPE:
emit_skb_loadptr(dev, r_A);
emit_cmpi(r_A, 0);
- emit_branch(BNE_PTR, cleanup_addr + 4);
+ emit_branch(BE_PTR, cleanup_addr + 4);
emit_nop();
emit_load16(r_A, struct net_device, type, r_A);
break;
^ permalink raw reply [flat|nested] 69+ messages in thread* [PATCH 3.15 12/61] net: filter: fix sparc32 typo
2014-06-24 15:50 [PATCH 3.15 00/61] 3.15.2-stable review Greg Kroah-Hartman
` (10 preceding siblings ...)
2014-06-24 15:50 ` [PATCH 3.15 11/61] net: filter: fix typo in sparc BPF JIT Greg Kroah-Hartman
@ 2014-06-24 15:50 ` Greg Kroah-Hartman
2014-06-24 15:50 ` [PATCH 3.15 14/61] net: force a list_del() in unregister_netdevice_many() Greg Kroah-Hartman
` (47 subsequent siblings)
59 siblings, 0 replies; 69+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-24 15:50 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alexei Starovoitov, David S. Miller
3.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexei Starovoitov <ast@plumgrid.com>
[ Upstream commit 588f5d629b3369aba88f52217d1c473a28fa7723 ]
Fixes: 569810d1e327 ("net: filter: fix typo in sparc BPF JIT")
Signed-off-by: Alexei Starovoitov <ast@plumgrid.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/sparc/net/bpf_jit_comp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/sparc/net/bpf_jit_comp.c
+++ b/arch/sparc/net/bpf_jit_comp.c
@@ -85,7 +85,7 @@ static void bpf_flush_icache(void *start
#ifdef CONFIG_SPARC64
#define BE_PTR (F2(0, 1) | CONDE | (2 << 20))
#else
-#define BE_PTR BNE
+#define BE_PTR BE
#endif
#define SETHI(K, REG) \
^ permalink raw reply [flat|nested] 69+ messages in thread* [PATCH 3.15 14/61] net: force a list_del() in unregister_netdevice_many()
2014-06-24 15:50 [PATCH 3.15 00/61] 3.15.2-stable review Greg Kroah-Hartman
` (11 preceding siblings ...)
2014-06-24 15:50 ` [PATCH 3.15 12/61] net: filter: fix sparc32 typo Greg Kroah-Hartman
@ 2014-06-24 15:50 ` Greg Kroah-Hartman
2014-06-24 15:50 ` [PATCH 3.15 15/61] ipip, sit: fix ipv4_{update_pmtu,redirect} calls Greg Kroah-Hartman
` (46 subsequent siblings)
59 siblings, 0 replies; 69+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-24 15:50 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Eric Dumazet, David S. Miller
3.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 87757a917b0b3c0787e0563c679762152be81312 ]
unregister_netdevice_many() API is error prone and we had too
many bugs because of dangling LIST_HEAD on stacks.
See commit f87e6f47933e3e ("net: dont leave active on stack LIST_HEAD")
In fact, instead of making sure no caller leaves an active list_head,
just force a list_del() in the callee. No one seems to need to access
the list after unregister_netdevice_many()
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/macvlan.c | 1 -
net/core/dev.c | 5 ++++-
net/core/rtnetlink.c | 1 -
net/mac80211/iface.c | 1 -
4 files changed, 4 insertions(+), 4 deletions(-)
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -1036,7 +1036,6 @@ static int macvlan_device_event(struct n
list_for_each_entry_safe(vlan, next, &port->vlans, list)
vlan->dev->rtnl_link_ops->dellink(vlan->dev, &list_kill);
unregister_netdevice_many(&list_kill);
- list_del(&list_kill);
break;
case NETDEV_PRE_TYPE_CHANGE:
/* Forbid underlaying device to change its type. */
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -6613,6 +6613,9 @@ EXPORT_SYMBOL(unregister_netdevice_queue
/**
* unregister_netdevice_many - unregister many devices
* @head: list of devices
+ *
+ * Note: As most callers use a stack allocated list_head,
+ * we force a list_del() to make sure stack wont be corrupted later.
*/
void unregister_netdevice_many(struct list_head *head)
{
@@ -6622,6 +6625,7 @@ void unregister_netdevice_many(struct li
rollback_registered_many(head);
list_for_each_entry(dev, head, unreg_list)
net_set_todo(dev);
+ list_del(head);
}
}
EXPORT_SYMBOL(unregister_netdevice_many);
@@ -7077,7 +7081,6 @@ static void __net_exit default_device_ex
}
}
unregister_netdevice_many(&dev_kill_list);
- list_del(&dev_kill_list);
rtnl_unlock();
}
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1744,7 +1744,6 @@ static int rtnl_dellink(struct sk_buff *
ops->dellink(dev, &list_kill);
unregister_netdevice_many(&list_kill);
- list_del(&list_kill);
return 0;
}
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -1758,7 +1758,6 @@ void ieee80211_remove_interfaces(struct
}
mutex_unlock(&local->iflist_mtx);
unregister_netdevice_many(&unreg_list);
- list_del(&unreg_list);
list_for_each_entry_safe(sdata, tmp, &wdev_list, list) {
list_del(&sdata->list);
^ permalink raw reply [flat|nested] 69+ messages in thread* [PATCH 3.15 15/61] ipip, sit: fix ipv4_{update_pmtu,redirect} calls
2014-06-24 15:50 [PATCH 3.15 00/61] 3.15.2-stable review Greg Kroah-Hartman
` (12 preceding siblings ...)
2014-06-24 15:50 ` [PATCH 3.15 14/61] net: force a list_del() in unregister_netdevice_many() Greg Kroah-Hartman
@ 2014-06-24 15:50 ` Greg Kroah-Hartman
2014-06-24 15:50 ` [PATCH 3.15 16/61] sfc: PIO:Restrict to 64bit arch and use 64-bit writes Greg Kroah-Hartman
` (45 subsequent siblings)
59 siblings, 0 replies; 69+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-24 15:50 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dmitry Popov, David S. Miller
3.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Popov <ixaphire@qrator.net>
[ Upstream commit 2346829e641b804ece9ac9298136b56d9567c278 ]
ipv4_{update_pmtu,redirect} were called with tunnel's ifindex (t->dev is a
tunnel netdevice). It caused wrong route lookup and failure of pmtu update or
redirect. We should use the same ifindex that we use in ip_route_output_* in
*tunnel_xmit code. It is t->parms.link .
Signed-off-by: Dmitry Popov <ixaphire@qrator.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/ipip.c | 4 ++--
net/ipv6/sit.c | 4 ++--
2 files changed, 4 insertions(+), 4 deletions(-)
--- a/net/ipv4/ipip.c
+++ b/net/ipv4/ipip.c
@@ -149,13 +149,13 @@ static int ipip_err(struct sk_buff *skb,
if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED) {
ipv4_update_pmtu(skb, dev_net(skb->dev), info,
- t->dev->ifindex, 0, IPPROTO_IPIP, 0);
+ t->parms.link, 0, IPPROTO_IPIP, 0);
err = 0;
goto out;
}
if (type == ICMP_REDIRECT) {
- ipv4_redirect(skb, dev_net(skb->dev), t->dev->ifindex, 0,
+ ipv4_redirect(skb, dev_net(skb->dev), t->parms.link, 0,
IPPROTO_IPIP, 0);
err = 0;
goto out;
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -560,12 +560,12 @@ static int ipip6_err(struct sk_buff *skb
if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED) {
ipv4_update_pmtu(skb, dev_net(skb->dev), info,
- t->dev->ifindex, 0, IPPROTO_IPV6, 0);
+ t->parms.link, 0, IPPROTO_IPV6, 0);
err = 0;
goto out;
}
if (type == ICMP_REDIRECT) {
- ipv4_redirect(skb, dev_net(skb->dev), t->dev->ifindex, 0,
+ ipv4_redirect(skb, dev_net(skb->dev), t->parms.link, 0,
IPPROTO_IPV6, 0);
err = 0;
goto out;
^ permalink raw reply [flat|nested] 69+ messages in thread* [PATCH 3.15 16/61] sfc: PIO:Restrict to 64bit arch and use 64-bit writes.
2014-06-24 15:50 [PATCH 3.15 00/61] 3.15.2-stable review Greg Kroah-Hartman
` (13 preceding siblings ...)
2014-06-24 15:50 ` [PATCH 3.15 15/61] ipip, sit: fix ipv4_{update_pmtu,redirect} calls Greg Kroah-Hartman
@ 2014-06-24 15:50 ` Greg Kroah-Hartman
2014-06-24 15:51 ` [PATCH 3.15 17/61] ipv4: fix a race in ip4_datagram_release_cb() Greg Kroah-Hartman
` (44 subsequent siblings)
59 siblings, 0 replies; 69+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-24 15:50 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Shradha Shah, David S. Miller
3.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jon Cooper <jcooper@solarflare.com>
[ Upstream commit daf37b556e437ec1ea1a597dcfeff338068380e1 ]
Fixes:ee45fd92c739
("sfc: Use TX PIO for sufficiently small packets")
The linux net driver uses memcpy_toio() in order to copy into
the PIO buffers.
Even on a 64bit machine this causes 32bit accesses to a write-
combined memory region.
There are hardware limitations that mean that only 64bit
naturally aligned accesses are safe in all cases.
Due to being write-combined memory region two 32bit accesses
may be coalesced to form a 64bit non 64bit aligned access.
Solution was to open-code the memory copy routines using pointers
and to only enable PIO for x86_64 machines.
Not tested on platforms other than x86_64 because this patch
disables the PIO feature on other platforms.
Compile-tested on x86 to ensure that works.
The WARN_ON_ONCE() code in the previous version of this patch
has been moved into the internal sfc debug driver as the
assertion was unnecessary in the upstream kernel code.
This bug fix applies to v3.13 and v3.14 stable branches.
Signed-off-by: Shradha Shah <sshah@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/sfc/io.h | 7 +++++++
drivers/net/ethernet/sfc/tx.c | 22 +++++++++++++++++-----
2 files changed, 24 insertions(+), 5 deletions(-)
--- a/drivers/net/ethernet/sfc/io.h
+++ b/drivers/net/ethernet/sfc/io.h
@@ -66,10 +66,17 @@
#define EFX_USE_QWORD_IO 1
#endif
+/* Hardware issue requires that only 64-bit naturally aligned writes
+ * are seen by hardware. Its not strictly necessary to restrict to
+ * x86_64 arch, but done for safety since unusual write combining behaviour
+ * can break PIO.
+ */
+#ifdef CONFIG_X86_64
/* PIO is a win only if write-combining is possible */
#ifdef ARCH_HAS_IOREMAP_WC
#define EFX_USE_PIO 1
#endif
+#endif
#ifdef EFX_USE_QWORD_IO
static inline void _efx_writeq(struct efx_nic *efx, __le64 value,
--- a/drivers/net/ethernet/sfc/tx.c
+++ b/drivers/net/ethernet/sfc/tx.c
@@ -189,6 +189,18 @@ struct efx_short_copy_buffer {
u8 buf[L1_CACHE_BYTES];
};
+/* Copy in explicit 64-bit writes. */
+static void efx_memcpy_64(void __iomem *dest, void *src, size_t len)
+{
+ u64 *src64 = src;
+ u64 __iomem *dest64 = dest;
+ size_t l64 = len / 8;
+ size_t i;
+
+ for (i = 0; i < l64; i++)
+ writeq(src64[i], &dest64[i]);
+}
+
/* Copy to PIO, respecting that writes to PIO buffers must be dword aligned.
* Advances piobuf pointer. Leaves additional data in the copy buffer.
*/
@@ -198,7 +210,7 @@ static void efx_memcpy_toio_aligned(stru
{
int block_len = len & ~(sizeof(copy_buf->buf) - 1);
- memcpy_toio(*piobuf, data, block_len);
+ efx_memcpy_64(*piobuf, data, block_len);
*piobuf += block_len;
len -= block_len;
@@ -230,7 +242,7 @@ static void efx_memcpy_toio_aligned_cb(s
if (copy_buf->used < sizeof(copy_buf->buf))
return;
- memcpy_toio(*piobuf, copy_buf->buf, sizeof(copy_buf->buf));
+ efx_memcpy_64(*piobuf, copy_buf->buf, sizeof(copy_buf->buf));
*piobuf += sizeof(copy_buf->buf);
data += copy_to_buf;
len -= copy_to_buf;
@@ -245,7 +257,7 @@ static void efx_flush_copy_buffer(struct
{
/* if there's anything in it, write the whole buffer, including junk */
if (copy_buf->used)
- memcpy_toio(piobuf, copy_buf->buf, sizeof(copy_buf->buf));
+ efx_memcpy_64(piobuf, copy_buf->buf, sizeof(copy_buf->buf));
}
/* Traverse skb structure and copy fragments in to PIO buffer.
@@ -304,8 +316,8 @@ efx_enqueue_skb_pio(struct efx_tx_queue
*/
BUILD_BUG_ON(L1_CACHE_BYTES >
SKB_DATA_ALIGN(sizeof(struct skb_shared_info)));
- memcpy_toio(tx_queue->piobuf, skb->data,
- ALIGN(skb->len, L1_CACHE_BYTES));
+ efx_memcpy_64(tx_queue->piobuf, skb->data,
+ ALIGN(skb->len, L1_CACHE_BYTES));
}
EFX_POPULATE_QWORD_5(buffer->option,
^ permalink raw reply [flat|nested] 69+ messages in thread* [PATCH 3.15 17/61] ipv4: fix a race in ip4_datagram_release_cb()
2014-06-24 15:50 [PATCH 3.15 00/61] 3.15.2-stable review Greg Kroah-Hartman
` (14 preceding siblings ...)
2014-06-24 15:50 ` [PATCH 3.15 16/61] sfc: PIO:Restrict to 64bit arch and use 64-bit writes Greg Kroah-Hartman
@ 2014-06-24 15:51 ` Greg Kroah-Hartman
2014-06-24 15:51 ` [PATCH 3.15 18/61] sctp: Fix sk_ack_backlog wrap-around problem Greg Kroah-Hartman
` (43 subsequent siblings)
59 siblings, 0 replies; 69+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-24 15:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alexey Preobrazhensky, dormando,
Eric Dumazet, Steffen Klassert, David S. Miller
3.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 9709674e68646cee5a24e3000b3558d25412203a ]
Alexey gave a AddressSanitizer[1] report that finally gave a good hint
at where was the origin of various problems already reported by Dormando
in the past [2]
Problem comes from the fact that UDP can have a lockless TX path, and
concurrent threads can manipulate sk_dst_cache, while another thread,
is holding socket lock and calls __sk_dst_set() in
ip4_datagram_release_cb() (this was added in linux-3.8)
It seems that all we need to do is to use sk_dst_check() and
sk_dst_set() so that all the writers hold same spinlock
(sk->sk_dst_lock) to prevent corruptions.
TCP stack do not need this protection, as all sk_dst_cache writers hold
the socket lock.
[1]
https://code.google.com/p/address-sanitizer/wiki/AddressSanitizerForKernel
AddressSanitizer: heap-use-after-free in ipv4_dst_check
Read of size 2 by thread T15453:
[<ffffffff817daa3a>] ipv4_dst_check+0x1a/0x90 ./net/ipv4/route.c:1116
[<ffffffff8175b789>] __sk_dst_check+0x89/0xe0 ./net/core/sock.c:531
[<ffffffff81830a36>] ip4_datagram_release_cb+0x46/0x390 ??:0
[<ffffffff8175eaea>] release_sock+0x17a/0x230 ./net/core/sock.c:2413
[<ffffffff81830882>] ip4_datagram_connect+0x462/0x5d0 ??:0
[<ffffffff81846d06>] inet_dgram_connect+0x76/0xd0 ./net/ipv4/af_inet.c:534
[<ffffffff817580ac>] SYSC_connect+0x15c/0x1c0 ./net/socket.c:1701
[<ffffffff817596ce>] SyS_connect+0xe/0x10 ./net/socket.c:1682
[<ffffffff818b0a29>] system_call_fastpath+0x16/0x1b
./arch/x86/kernel/entry_64.S:629
Freed by thread T15455:
[<ffffffff8178d9b8>] dst_destroy+0xa8/0x160 ./net/core/dst.c:251
[<ffffffff8178de25>] dst_release+0x45/0x80 ./net/core/dst.c:280
[<ffffffff818304c1>] ip4_datagram_connect+0xa1/0x5d0 ??:0
[<ffffffff81846d06>] inet_dgram_connect+0x76/0xd0 ./net/ipv4/af_inet.c:534
[<ffffffff817580ac>] SYSC_connect+0x15c/0x1c0 ./net/socket.c:1701
[<ffffffff817596ce>] SyS_connect+0xe/0x10 ./net/socket.c:1682
[<ffffffff818b0a29>] system_call_fastpath+0x16/0x1b
./arch/x86/kernel/entry_64.S:629
Allocated by thread T15453:
[<ffffffff8178d291>] dst_alloc+0x81/0x2b0 ./net/core/dst.c:171
[<ffffffff817db3b7>] rt_dst_alloc+0x47/0x50 ./net/ipv4/route.c:1406
[< inlined >] __ip_route_output_key+0x3e8/0xf70
__mkroute_output ./net/ipv4/route.c:1939
[<ffffffff817dde08>] __ip_route_output_key+0x3e8/0xf70 ./net/ipv4/route.c:2161
[<ffffffff817deb34>] ip_route_output_flow+0x14/0x30 ./net/ipv4/route.c:2249
[<ffffffff81830737>] ip4_datagram_connect+0x317/0x5d0 ??:0
[<ffffffff81846d06>] inet_dgram_connect+0x76/0xd0 ./net/ipv4/af_inet.c:534
[<ffffffff817580ac>] SYSC_connect+0x15c/0x1c0 ./net/socket.c:1701
[<ffffffff817596ce>] SyS_connect+0xe/0x10 ./net/socket.c:1682
[<ffffffff818b0a29>] system_call_fastpath+0x16/0x1b
./arch/x86/kernel/entry_64.S:629
[2]
<4>[196727.311203] general protection fault: 0000 [#1] SMP
<4>[196727.311224] Modules linked in: xt_TEE xt_dscp xt_DSCP macvlan bridge coretemp crc32_pclmul ghash_clmulni_intel gpio_ich microcode ipmi_watchdog ipmi_devintf sb_edac edac_core lpc_ich mfd_core tpm_tis tpm tpm_bios ipmi_si ipmi_msghandler isci igb libsas i2c_algo_bit ixgbe ptp pps_core mdio
<4>[196727.311333] CPU: 17 PID: 0 Comm: swapper/17 Not tainted 3.10.26 #1
<4>[196727.311344] Hardware name: Supermicro X9DRi-LN4+/X9DR3-LN4+/X9DRi-LN4+/X9DR3-LN4+, BIOS 3.0 07/05/2013
<4>[196727.311364] task: ffff885e6f069700 ti: ffff885e6f072000 task.ti: ffff885e6f072000
<4>[196727.311377] RIP: 0010:[<ffffffff815f8c7f>] [<ffffffff815f8c7f>] ipv4_dst_destroy+0x4f/0x80
<4>[196727.311399] RSP: 0018:ffff885effd23a70 EFLAGS: 00010282
<4>[196727.311409] RAX: dead000000200200 RBX: ffff8854c398ecc0 RCX: 0000000000000040
<4>[196727.311423] RDX: dead000000100100 RSI: dead000000100100 RDI: dead000000200200
<4>[196727.311437] RBP: ffff885effd23a80 R08: ffffffff815fd9e0 R09: ffff885d5a590800
<4>[196727.311451] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
<4>[196727.311464] R13: ffffffff81c8c280 R14: 0000000000000000 R15: ffff880e85ee16ce
<4>[196727.311510] FS: 0000000000000000(0000) GS:ffff885effd20000(0000) knlGS:0000000000000000
<4>[196727.311554] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
<4>[196727.311581] CR2: 00007a46751eb000 CR3: 0000005e65688000 CR4: 00000000000407e0
<4>[196727.311625] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
<4>[196727.311669] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
<4>[196727.311713] Stack:
<4>[196727.311733] ffff8854c398ecc0 ffff8854c398ecc0 ffff885effd23ab0 ffffffff815b7f42
<4>[196727.311784] ffff88be6595bc00 ffff8854c398ecc0 0000000000000000 ffff8854c398ecc0
<4>[196727.311834] ffff885effd23ad0 ffffffff815b86c6 ffff885d5a590800 ffff8816827821c0
<4>[196727.311885] Call Trace:
<4>[196727.311907] <IRQ>
<4>[196727.311912] [<ffffffff815b7f42>] dst_destroy+0x32/0xe0
<4>[196727.311959] [<ffffffff815b86c6>] dst_release+0x56/0x80
<4>[196727.311986] [<ffffffff81620bd5>] tcp_v4_do_rcv+0x2a5/0x4a0
<4>[196727.312013] [<ffffffff81622b5a>] tcp_v4_rcv+0x7da/0x820
<4>[196727.312041] [<ffffffff815fd9e0>] ? ip_rcv_finish+0x360/0x360
<4>[196727.312070] [<ffffffff815de02d>] ? nf_hook_slow+0x7d/0x150
<4>[196727.312097] [<ffffffff815fd9e0>] ? ip_rcv_finish+0x360/0x360
<4>[196727.312125] [<ffffffff815fda92>] ip_local_deliver_finish+0xb2/0x230
<4>[196727.312154] [<ffffffff815fdd9a>] ip_local_deliver+0x4a/0x90
<4>[196727.312183] [<ffffffff815fd799>] ip_rcv_finish+0x119/0x360
<4>[196727.312212] [<ffffffff815fe00b>] ip_rcv+0x22b/0x340
<4>[196727.312242] [<ffffffffa0339680>] ? macvlan_broadcast+0x160/0x160 [macvlan]
<4>[196727.312275] [<ffffffff815b0c62>] __netif_receive_skb_core+0x512/0x640
<4>[196727.312308] [<ffffffff811427fb>] ? kmem_cache_alloc+0x13b/0x150
<4>[196727.312338] [<ffffffff815b0db1>] __netif_receive_skb+0x21/0x70
<4>[196727.312368] [<ffffffff815b0fa1>] netif_receive_skb+0x31/0xa0
<4>[196727.312397] [<ffffffff815b1ae8>] napi_gro_receive+0xe8/0x140
<4>[196727.312433] [<ffffffffa00274f1>] ixgbe_poll+0x551/0x11f0 [ixgbe]
<4>[196727.312463] [<ffffffff815fe00b>] ? ip_rcv+0x22b/0x340
<4>[196727.312491] [<ffffffff815b1691>] net_rx_action+0x111/0x210
<4>[196727.312521] [<ffffffff815b0db1>] ? __netif_receive_skb+0x21/0x70
<4>[196727.312552] [<ffffffff810519d0>] __do_softirq+0xd0/0x270
<4>[196727.312583] [<ffffffff816cef3c>] call_softirq+0x1c/0x30
<4>[196727.312613] [<ffffffff81004205>] do_softirq+0x55/0x90
<4>[196727.312640] [<ffffffff81051c85>] irq_exit+0x55/0x60
<4>[196727.312668] [<ffffffff816cf5c3>] do_IRQ+0x63/0xe0
<4>[196727.312696] [<ffffffff816c5aaa>] common_interrupt+0x6a/0x6a
<4>[196727.312722] <EOI>
<1>[196727.313071] RIP [<ffffffff815f8c7f>] ipv4_dst_destroy+0x4f/0x80
<4>[196727.313100] RSP <ffff885effd23a70>
<4>[196727.313377] ---[ end trace 64b3f14fae0f2e29 ]---
<0>[196727.380908] Kernel panic - not syncing: Fatal exception in interrupt
Reported-by: Alexey Preobrazhensky <preobr@google.com>
Reported-by: dormando <dormando@rydia.ne>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Fixes: 8141ed9fcedb2 ("ipv4: Add a socket release callback for datagram sockets")
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/datagram.c | 20 +++++++++++++++-----
1 file changed, 15 insertions(+), 5 deletions(-)
--- a/net/ipv4/datagram.c
+++ b/net/ipv4/datagram.c
@@ -86,18 +86,26 @@ out:
}
EXPORT_SYMBOL(ip4_datagram_connect);
+/* Because UDP xmit path can manipulate sk_dst_cache without holding
+ * socket lock, we need to use sk_dst_set() here,
+ * even if we own the socket lock.
+ */
void ip4_datagram_release_cb(struct sock *sk)
{
const struct inet_sock *inet = inet_sk(sk);
const struct ip_options_rcu *inet_opt;
__be32 daddr = inet->inet_daddr;
+ struct dst_entry *dst;
struct flowi4 fl4;
struct rtable *rt;
- if (! __sk_dst_get(sk) || __sk_dst_check(sk, 0))
- return;
-
rcu_read_lock();
+
+ dst = __sk_dst_get(sk);
+ if (!dst || !dst->obsolete || dst->ops->check(dst, 0)) {
+ rcu_read_unlock();
+ return;
+ }
inet_opt = rcu_dereference(inet->inet_opt);
if (inet_opt && inet_opt->opt.srr)
daddr = inet_opt->opt.faddr;
@@ -105,8 +113,10 @@ void ip4_datagram_release_cb(struct sock
inet->inet_saddr, inet->inet_dport,
inet->inet_sport, sk->sk_protocol,
RT_CONN_FLAGS(sk), sk->sk_bound_dev_if);
- if (!IS_ERR(rt))
- __sk_dst_set(sk, &rt->dst);
+
+ dst = !IS_ERR(rt) ? &rt->dst : NULL;
+ sk_dst_set(sk, dst);
+
rcu_read_unlock();
}
EXPORT_SYMBOL_GPL(ip4_datagram_release_cb);
^ permalink raw reply [flat|nested] 69+ messages in thread* [PATCH 3.15 18/61] sctp: Fix sk_ack_backlog wrap-around problem
2014-06-24 15:50 [PATCH 3.15 00/61] 3.15.2-stable review Greg Kroah-Hartman
` (15 preceding siblings ...)
2014-06-24 15:51 ` [PATCH 3.15 17/61] ipv4: fix a race in ip4_datagram_release_cb() Greg Kroah-Hartman
@ 2014-06-24 15:51 ` Greg Kroah-Hartman
2014-06-24 15:51 ` [PATCH 3.15 19/61] rtnetlink: fix userspace API breakage for iproute2 < v3.9.0 Greg Kroah-Hartman
` (42 subsequent siblings)
59 siblings, 0 replies; 69+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-24 15:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Xufeng Zhang, Daniel Borkmann,
Vlad Yasevich, David S. Miller
3.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xufeng Zhang <xufeng.zhang@windriver.com>
[ Upstream commit d3217b15a19a4779c39b212358a5c71d725822ee ]
Consider the scenario:
For a TCP-style socket, while processing the COOKIE_ECHO chunk in
sctp_sf_do_5_1D_ce(), after it has passed a series of sanity check,
a new association would be created in sctp_unpack_cookie(), but afterwards,
some processing maybe failed, and sctp_association_free() will be called to
free the previously allocated association, in sctp_association_free(),
sk_ack_backlog value is decremented for this socket, since the initial
value for sk_ack_backlog is 0, after the decrement, it will be 65535,
a wrap-around problem happens, and if we want to establish new associations
afterward in the same socket, ABORT would be triggered since sctp deem the
accept queue as full.
Fix this issue by only decrementing sk_ack_backlog for associations in
the endpoint's list.
Fix-suggested-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: Xufeng Zhang <xufeng.zhang@windriver.com>
Acked-by: Daniel Borkmann <dborkman@redhat.com>
Acked-by: Vlad Yasevich <vyasevich@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sctp/associola.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -330,7 +330,7 @@ void sctp_association_free(struct sctp_a
/* Only real associations count against the endpoint, so
* don't bother for if this is a temporary association.
*/
- if (!asoc->temp) {
+ if (!list_empty(&asoc->asocs)) {
list_del(&asoc->asocs);
/* Decrement the backlog value for a TCP-style listening
^ permalink raw reply [flat|nested] 69+ messages in thread* [PATCH 3.15 19/61] rtnetlink: fix userspace API breakage for iproute2 < v3.9.0
2014-06-24 15:50 [PATCH 3.15 00/61] 3.15.2-stable review Greg Kroah-Hartman
` (16 preceding siblings ...)
2014-06-24 15:51 ` [PATCH 3.15 18/61] sctp: Fix sk_ack_backlog wrap-around problem Greg Kroah-Hartman
@ 2014-06-24 15:51 ` Greg Kroah-Hartman
2014-06-24 15:51 ` [PATCH 3.15 20/61] vxlan: use dev->needed_headroom instead of dev->hard_header_len Greg Kroah-Hartman
` (41 subsequent siblings)
59 siblings, 0 replies; 69+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-24 15:51 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Michal Schmidt, David S. Miller
3.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Schmidt <mschmidt@redhat.com>
[ Upstream commit e5eca6d41f53db48edd8cf88a3f59d2c30227f8e ]
When running RHEL6 userspace on a current upstream kernel, "ip link"
fails to show VF information.
The reason is a kernel<->userspace API change introduced by commit
88c5b5ce5cb57 ("rtnetlink: Call nlmsg_parse() with correct header length"),
after which the kernel does not see iproute2's IFLA_EXT_MASK attribute
in the netlink request.
iproute2 adjusted for the API change in its commit 63338dca4513
("libnetlink: Use ifinfomsg instead of rtgenmsg in rtnl_wilddump_req_filter").
The problem has been noticed before:
http://marc.info/?l=linux-netdev&m=136692296022182&w=2
(Subject: Re: getting VF link info seems to be broken in 3.9-rc8)
We can do better than tell those with old userspace to upgrade. We can
recognize the old iproute2 in the kernel by checking the netlink message
length. Even when including the IFLA_EXT_MASK attribute, its netlink
message is shorter than struct ifinfomsg.
With this patch "ip link" shows VF information in both old and new
iproute2 versions.
Signed-off-by: Michal Schmidt <mschmidt@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/core/rtnetlink.c | 22 ++++++++++++++++++----
1 file changed, 18 insertions(+), 4 deletions(-)
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1234,6 +1234,7 @@ static int rtnl_dump_ifinfo(struct sk_bu
struct nlattr *tb[IFLA_MAX+1];
u32 ext_filter_mask = 0;
int err;
+ int hdrlen;
s_h = cb->args[0];
s_idx = cb->args[1];
@@ -1241,8 +1242,17 @@ static int rtnl_dump_ifinfo(struct sk_bu
rcu_read_lock();
cb->seq = net->dev_base_seq;
- if (nlmsg_parse(cb->nlh, sizeof(struct ifinfomsg), tb, IFLA_MAX,
- ifla_policy) >= 0) {
+ /* A hack to preserve kernel<->userspace interface.
+ * The correct header is ifinfomsg. It is consistent with rtnl_getlink.
+ * However, before Linux v3.9 the code here assumed rtgenmsg and that's
+ * what iproute2 < v3.9.0 used.
+ * We can detect the old iproute2. Even including the IFLA_EXT_MASK
+ * attribute, its netlink message is shorter than struct ifinfomsg.
+ */
+ hdrlen = nlmsg_len(cb->nlh) < sizeof(struct ifinfomsg) ?
+ sizeof(struct rtgenmsg) : sizeof(struct ifinfomsg);
+
+ if (nlmsg_parse(cb->nlh, hdrlen, tb, IFLA_MAX, ifla_policy) >= 0) {
if (tb[IFLA_EXT_MASK])
ext_filter_mask = nla_get_u32(tb[IFLA_EXT_MASK]);
@@ -2094,9 +2104,13 @@ static u16 rtnl_calcit(struct sk_buff *s
struct nlattr *tb[IFLA_MAX+1];
u32 ext_filter_mask = 0;
u16 min_ifinfo_dump_size = 0;
+ int hdrlen;
+
+ /* Same kernel<->userspace interface hack as in rtnl_dump_ifinfo. */
+ hdrlen = nlmsg_len(nlh) < sizeof(struct ifinfomsg) ?
+ sizeof(struct rtgenmsg) : sizeof(struct ifinfomsg);
- if (nlmsg_parse(nlh, sizeof(struct ifinfomsg), tb, IFLA_MAX,
- ifla_policy) >= 0) {
+ if (nlmsg_parse(nlh, hdrlen, tb, IFLA_MAX, ifla_policy) >= 0) {
if (tb[IFLA_EXT_MASK])
ext_filter_mask = nla_get_u32(tb[IFLA_EXT_MASK]);
}
^ permalink raw reply [flat|nested] 69+ messages in thread* [PATCH 3.15 20/61] vxlan: use dev->needed_headroom instead of dev->hard_header_len
2014-06-24 15:50 [PATCH 3.15 00/61] 3.15.2-stable review Greg Kroah-Hartman
` (17 preceding siblings ...)
2014-06-24 15:51 ` [PATCH 3.15 19/61] rtnetlink: fix userspace API breakage for iproute2 < v3.9.0 Greg Kroah-Hartman
@ 2014-06-24 15:51 ` Greg Kroah-Hartman
2014-06-24 15:51 ` [PATCH 3.15 21/61] udp: ipv4: do not waste time in __udp4_lib_mcast_demux_lookup Greg Kroah-Hartman
` (40 subsequent siblings)
59 siblings, 0 replies; 69+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-24 15:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, David S. Miller, stephen hemminger,
Pravin B Shelar, Cong Wang, Cong Wang
3.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cong Wang <cwang@twopensource.com>
[ Upstream commit 2853af6a2ea1a8ed09b09dd4fb578e7f435e8d34 ]
When we mirror packets from a vxlan tunnel to other device,
the mirror device should see the same packets (that is, without
outer header). Because vxlan tunnel sets dev->hard_header_len,
tcf_mirred() resets mac header back to outer mac, the mirror device
actually sees packets with outer headers
Vxlan tunnel should set dev->needed_headroom instead of
dev->hard_header_len, like what other ip tunnels do. This fixes
the above problem.
Cc: "David S. Miller" <davem@davemloft.net>
Cc: stephen hemminger <stephen@networkplumber.org>
Cc: Pravin B Shelar <pshelar@nicira.com>
Signed-off-by: Cong Wang <cwang@twopensource.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/vxlan.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -2275,9 +2275,9 @@ static void vxlan_setup(struct net_devic
eth_hw_addr_random(dev);
ether_setup(dev);
if (vxlan->default_dst.remote_ip.sa.sa_family == AF_INET6)
- dev->hard_header_len = ETH_HLEN + VXLAN6_HEADROOM;
+ dev->needed_headroom = ETH_HLEN + VXLAN6_HEADROOM;
else
- dev->hard_header_len = ETH_HLEN + VXLAN_HEADROOM;
+ dev->needed_headroom = ETH_HLEN + VXLAN_HEADROOM;
dev->netdev_ops = &vxlan_netdev_ops;
dev->destructor = free_netdev;
@@ -2660,8 +2660,7 @@ static int vxlan_newlink(struct net *net
if (!tb[IFLA_MTU])
dev->mtu = lowerdev->mtu - (use_ipv6 ? VXLAN6_HEADROOM : VXLAN_HEADROOM);
- /* update header length based on lower device */
- dev->hard_header_len = lowerdev->hard_header_len +
+ dev->needed_headroom = lowerdev->hard_header_len +
(use_ipv6 ? VXLAN6_HEADROOM : VXLAN_HEADROOM);
} else if (use_ipv6)
vxlan->flags |= VXLAN_F_IPV6;
^ permalink raw reply [flat|nested] 69+ messages in thread* [PATCH 3.15 21/61] udp: ipv4: do not waste time in __udp4_lib_mcast_demux_lookup
2014-06-24 15:50 [PATCH 3.15 00/61] 3.15.2-stable review Greg Kroah-Hartman
` (18 preceding siblings ...)
2014-06-24 15:51 ` [PATCH 3.15 20/61] vxlan: use dev->needed_headroom instead of dev->hard_header_len Greg Kroah-Hartman
@ 2014-06-24 15:51 ` Greg Kroah-Hartman
2014-06-24 15:51 ` [PATCH 3.15 22/61] ARM: at91: fix at91_sysirq_mask_rtc for sam9x5 SoCs Greg Kroah-Hartman
` (39 subsequent siblings)
59 siblings, 0 replies; 69+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-24 15:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Eric Dumazet, David Held,
Shawn Bohrer, David S. Miller
3.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 63c6f81cdde58c41da62a8d8a209592e42a0203e ]
Its too easy to add thousand of UDP sockets on a particular bucket,
and slow down an innocent multicast receiver.
Early demux is supposed to be an optimization, we should avoid spending
too much time in it.
It is interesting to note __udp4_lib_demux_lookup() only tries to
match first socket in the chain.
10 is the threshold we already have in __udp4_lib_lookup() to switch
to secondary hash.
Fixes: 421b3885bf6d5 ("udp: ipv4: Add udp early demux")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: David Held <drheld@google.com>
Cc: Shawn Bohrer <sbohrer@rgmadvisors.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/udp.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1834,6 +1834,10 @@ static struct sock *__udp4_lib_mcast_dem
unsigned int count, slot = udp_hashfn(net, hnum, udp_table.mask);
struct udp_hslot *hslot = &udp_table.hash[slot];
+ /* Do not bother scanning a too big list */
+ if (hslot->count > 10)
+ return NULL;
+
rcu_read_lock();
begin:
count = 0;
^ permalink raw reply [flat|nested] 69+ messages in thread* [PATCH 3.15 22/61] ARM: at91: fix at91_sysirq_mask_rtc for sam9x5 SoCs
2014-06-24 15:50 [PATCH 3.15 00/61] 3.15.2-stable review Greg Kroah-Hartman
` (19 preceding siblings ...)
2014-06-24 15:51 ` [PATCH 3.15 21/61] udp: ipv4: do not waste time in __udp4_lib_mcast_demux_lookup Greg Kroah-Hartman
@ 2014-06-24 15:51 ` Greg Kroah-Hartman
2014-06-24 15:51 ` [PATCH 3.15 23/61] KVM: lapic: sync highest ISR to hardware apic on EOI Greg Kroah-Hartman
` (38 subsequent siblings)
59 siblings, 0 replies; 69+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-24 15:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Boris BREZILLON, Bryan Evenson,
Johan Hovold, Nicolas Ferre, Andrew Victor,
Jean-Christophe Plagniol-Villard, Alessandro Zummo, Mark Roszko,
Andrew Morton, Linus Torvalds
3.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boris BREZILLON <boris.brezillon@free-electrons.com>
commit 9dcc87fec8947308e0111c65dcd881e6aa5b1673 upstream.
sam9x5 SoCs have the following errata:
"RTC: Interrupt Mask Register cannot be used
Interrupt Mask Register read always returns 0."
Hence we should not rely on what IMR claims about already masked IRQs
and just disable all IRQs.
Signed-off-by: Boris BREZILLON <boris.brezillon@free-electrons.com>
Reported-by: Bryan Evenson <bevenson@melinkcorp.com>
Reviewed-by: Johan Hovold <johan@hovold.com>
Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Cc: Bryan Evenson <bevenson@melinkcorp.com>
Cc: Andrew Victor <linux@maxim.org.za>
Cc: Jean-Christophe Plagniol-Villard <plagnioj@jcrosoft.com>
Cc: Alessandro Zummo <a.zummo@towertech.it>
Cc: Mark Roszko <mark.roszko@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/mach-at91/sysirq_mask.c | 22 +++++++++++++---------
1 file changed, 13 insertions(+), 9 deletions(-)
--- a/arch/arm/mach-at91/sysirq_mask.c
+++ b/arch/arm/mach-at91/sysirq_mask.c
@@ -25,24 +25,28 @@
#include "generic.h"
-#define AT91_RTC_IDR 0x24 /* Interrupt Disable Register */
-#define AT91_RTC_IMR 0x28 /* Interrupt Mask Register */
+#define AT91_RTC_IDR 0x24 /* Interrupt Disable Register */
+#define AT91_RTC_IMR 0x28 /* Interrupt Mask Register */
+#define AT91_RTC_IRQ_MASK 0x1f /* Available IRQs mask */
void __init at91_sysirq_mask_rtc(u32 rtc_base)
{
void __iomem *base;
- u32 mask;
base = ioremap(rtc_base, 64);
if (!base)
return;
- mask = readl_relaxed(base + AT91_RTC_IMR);
- if (mask) {
- pr_info("AT91: Disabling rtc irq\n");
- writel_relaxed(mask, base + AT91_RTC_IDR);
- (void)readl_relaxed(base + AT91_RTC_IMR); /* flush */
- }
+ /*
+ * sam9x5 SoCs have the following errata:
+ * "RTC: Interrupt Mask Register cannot be used
+ * Interrupt Mask Register read always returns 0."
+ *
+ * Hence we're not relying on IMR values to disable
+ * interrupts.
+ */
+ writel_relaxed(AT91_RTC_IRQ_MASK, base + AT91_RTC_IDR);
+ (void)readl_relaxed(base + AT91_RTC_IMR); /* flush */
iounmap(base);
}
^ permalink raw reply [flat|nested] 69+ messages in thread* [PATCH 3.15 23/61] KVM: lapic: sync highest ISR to hardware apic on EOI
2014-06-24 15:50 [PATCH 3.15 00/61] 3.15.2-stable review Greg Kroah-Hartman
` (20 preceding siblings ...)
2014-06-24 15:51 ` [PATCH 3.15 22/61] ARM: at91: fix at91_sysirq_mask_rtc for sam9x5 SoCs Greg Kroah-Hartman
@ 2014-06-24 15:51 ` Greg Kroah-Hartman
2014-06-24 15:51 ` [PATCH 3.15 24/61] KVM: s390: Drop pending interrupts on guest exit Greg Kroah-Hartman
` (37 subsequent siblings)
59 siblings, 0 replies; 69+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-24 15:51 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Yang Zhang, Paolo Bonzini
3.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Bonzini <pbonzini@redhat.com>
commit fc57ac2c9ca8109ea97fcc594f4be436944230cc upstream.
When Hyper-V enlightenments are in effect, Windows prefers to issue an
Hyper-V MSR write to issue an EOI rather than an x2apic MSR write.
The Hyper-V MSR write is not handled by the processor, and besides
being slower, this also causes bugs with APIC virtualization. The
reason is that on EOI the processor will modify the highest in-service
interrupt (SVI) field of the VMCS, as explained in section 29.1.4 of
the SDM; every other step in EOI virtualization is already done by
apic_send_eoi or on VM entry, but this one is missing.
We need to do the same, and be careful not to muck with the isr_count
and highest_isr_cache fields that are unused when virtual interrupt
delivery is enabled.
Reviewed-by: Yang Zhang <yang.z.zhang@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/lapic.c | 62 +++++++++++++++++++++++++++++++++++----------------
1 file changed, 43 insertions(+), 19 deletions(-)
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -360,6 +360,8 @@ static inline void apic_clear_irr(int ve
static inline void apic_set_isr(int vec, struct kvm_lapic *apic)
{
+ /* Note that we never get here with APIC virtualization enabled. */
+
if (!__apic_test_and_set_vector(vec, apic->regs + APIC_ISR))
++apic->isr_count;
BUG_ON(apic->isr_count > MAX_APIC_VECTOR);
@@ -371,12 +373,48 @@ static inline void apic_set_isr(int vec,
apic->highest_isr_cache = vec;
}
+static inline int apic_find_highest_isr(struct kvm_lapic *apic)
+{
+ int result;
+
+ /*
+ * Note that isr_count is always 1, and highest_isr_cache
+ * is always -1, with APIC virtualization enabled.
+ */
+ if (!apic->isr_count)
+ return -1;
+ if (likely(apic->highest_isr_cache != -1))
+ return apic->highest_isr_cache;
+
+ result = find_highest_vector(apic->regs + APIC_ISR);
+ ASSERT(result == -1 || result >= 16);
+
+ return result;
+}
+
static inline void apic_clear_isr(int vec, struct kvm_lapic *apic)
{
- if (__apic_test_and_clear_vector(vec, apic->regs + APIC_ISR))
+ struct kvm_vcpu *vcpu;
+ if (!__apic_test_and_clear_vector(vec, apic->regs + APIC_ISR))
+ return;
+
+ vcpu = apic->vcpu;
+
+ /*
+ * We do get here for APIC virtualization enabled if the guest
+ * uses the Hyper-V APIC enlightenment. In this case we may need
+ * to trigger a new interrupt delivery by writing the SVI field;
+ * on the other hand isr_count and highest_isr_cache are unused
+ * and must be left alone.
+ */
+ if (unlikely(kvm_apic_vid_enabled(vcpu->kvm)))
+ kvm_x86_ops->hwapic_isr_update(vcpu->kvm,
+ apic_find_highest_isr(apic));
+ else {
--apic->isr_count;
- BUG_ON(apic->isr_count < 0);
- apic->highest_isr_cache = -1;
+ BUG_ON(apic->isr_count < 0);
+ apic->highest_isr_cache = -1;
+ }
}
int kvm_lapic_find_highest_irr(struct kvm_vcpu *vcpu)
@@ -456,22 +494,6 @@ static void pv_eoi_clr_pending(struct kv
__clear_bit(KVM_APIC_PV_EOI_PENDING, &vcpu->arch.apic_attention);
}
-static inline int apic_find_highest_isr(struct kvm_lapic *apic)
-{
- int result;
-
- /* Note that isr_count is always 1 with vid enabled */
- if (!apic->isr_count)
- return -1;
- if (likely(apic->highest_isr_cache != -1))
- return apic->highest_isr_cache;
-
- result = find_highest_vector(apic->regs + APIC_ISR);
- ASSERT(result == -1 || result >= 16);
-
- return result;
-}
-
void kvm_apic_update_tmr(struct kvm_vcpu *vcpu, u32 *tmr)
{
struct kvm_lapic *apic = vcpu->arch.apic;
@@ -1605,6 +1627,8 @@ int kvm_get_apic_interrupt(struct kvm_vc
int vector = kvm_apic_has_interrupt(vcpu);
struct kvm_lapic *apic = vcpu->arch.apic;
+ /* Note that we never get here with APIC virtualization enabled. */
+
if (vector == -1)
return -1;
^ permalink raw reply [flat|nested] 69+ messages in thread* [PATCH 3.15 24/61] KVM: s390: Drop pending interrupts on guest exit
2014-06-24 15:50 [PATCH 3.15 00/61] 3.15.2-stable review Greg Kroah-Hartman
` (21 preceding siblings ...)
2014-06-24 15:51 ` [PATCH 3.15 23/61] KVM: lapic: sync highest ISR to hardware apic on EOI Greg Kroah-Hartman
@ 2014-06-24 15:51 ` Greg Kroah-Hartman
2014-06-24 15:51 ` [PATCH 3.15 25/61] MIPS: KVM: Allocate at least 16KB for exception handlers Greg Kroah-Hartman
` (36 subsequent siblings)
59 siblings, 0 replies; 69+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-24 15:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Christian Borntraeger, Thomas Huth
3.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Borntraeger <borntraeger@de.ibm.com>
commit 67335e63c9ef59e97b45a08b4a6a93767762031d upstream.
On hard exits (abort, sigkill) we have have some kvm_s390_interrupt_info
structures hanging around. Delete those on exit to avoid memory leaks.
Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/kvm/interrupt.c | 4 ++--
arch/s390/kvm/kvm-s390.c | 2 ++
arch/s390/kvm/kvm-s390.h | 1 +
3 files changed, 5 insertions(+), 2 deletions(-)
--- a/arch/s390/kvm/interrupt.c
+++ b/arch/s390/kvm/interrupt.c
@@ -900,7 +900,7 @@ int kvm_s390_inject_vcpu(struct kvm_vcpu
return 0;
}
-static void clear_floating_interrupts(struct kvm *kvm)
+void kvm_s390_clear_float_irqs(struct kvm *kvm)
{
struct kvm_s390_float_interrupt *fi;
struct kvm_s390_interrupt_info *n, *inti = NULL;
@@ -1246,7 +1246,7 @@ static int flic_set_attr(struct kvm_devi
break;
case KVM_DEV_FLIC_CLEAR_IRQS:
r = 0;
- clear_floating_interrupts(dev->kvm);
+ kvm_s390_clear_float_irqs(dev->kvm);
break;
case KVM_DEV_FLIC_APF_ENABLE:
dev->kvm->arch.gmap->pfault_enabled = 1;
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -322,6 +322,7 @@ void kvm_arch_vcpu_destroy(struct kvm_vc
{
VCPU_EVENT(vcpu, 3, "%s", "free cpu");
trace_kvm_s390_destroy_vcpu(vcpu->vcpu_id);
+ kvm_s390_clear_local_irqs(vcpu);
kvm_clear_async_pf_completion_queue(vcpu);
if (!kvm_is_ucontrol(vcpu->kvm)) {
clear_bit(63 - vcpu->vcpu_id,
@@ -372,6 +373,7 @@ void kvm_arch_destroy_vm(struct kvm *kvm
if (!kvm_is_ucontrol(kvm))
gmap_free(kvm->arch.gmap);
kvm_s390_destroy_adapters(kvm);
+ kvm_s390_clear_float_irqs(kvm);
}
/* Section: vcpu related */
--- a/arch/s390/kvm/kvm-s390.h
+++ b/arch/s390/kvm/kvm-s390.h
@@ -130,6 +130,7 @@ void kvm_s390_tasklet(unsigned long parm
void kvm_s390_deliver_pending_interrupts(struct kvm_vcpu *vcpu);
void kvm_s390_deliver_pending_machine_checks(struct kvm_vcpu *vcpu);
void kvm_s390_clear_local_irqs(struct kvm_vcpu *vcpu);
+void kvm_s390_clear_float_irqs(struct kvm *kvm);
int __must_check kvm_s390_inject_vm(struct kvm *kvm,
struct kvm_s390_interrupt *s390int);
int __must_check kvm_s390_inject_vcpu(struct kvm_vcpu *vcpu,
^ permalink raw reply [flat|nested] 69+ messages in thread* [PATCH 3.15 25/61] MIPS: KVM: Allocate at least 16KB for exception handlers
2014-06-24 15:50 [PATCH 3.15 00/61] 3.15.2-stable review Greg Kroah-Hartman
` (22 preceding siblings ...)
2014-06-24 15:51 ` [PATCH 3.15 24/61] KVM: s390: Drop pending interrupts on guest exit Greg Kroah-Hartman
@ 2014-06-24 15:51 ` Greg Kroah-Hartman
2014-06-24 15:51 ` [PATCH 3.15 26/61] USB: cdc-acm: fix write and suspend race Greg Kroah-Hartman
` (35 subsequent siblings)
59 siblings, 0 replies; 69+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-24 15:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, James Hogan, Paolo Bonzini,
Gleb Natapov, kvm, Ralf Baechle, linux-mips, Sanjay Lal
3.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Hogan <james.hogan@imgtec.com>
commit 7006e2dfda9adfa40251093604db76d7e44263b3 upstream.
Each MIPS KVM guest has its own copy of the KVM exception vector. This
contains the TLB refill exception handler at offset 0x000, the general
exception handler at offset 0x180, and interrupt exception handlers at
offset 0x200 in case Cause_IV=1. A common handler is copied to offset
0x2000 and offset 0x3000 is used for temporarily storing k1 during entry
from guest.
However the amount of memory allocated for this purpose is calculated as
0x200 rounded up to the next page boundary, which is insufficient if 4KB
pages are in use. This can lead to the common handler at offset 0x2000
being overwritten and infinitely recursive exceptions on the next exit
from the guest.
Increase the minimum size from 0x200 to 0x4000 to cover the full use of
the page.
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Gleb Natapov <gleb@kernel.org>
Cc: kvm@vger.kernel.org
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: linux-mips@linux-mips.org
Cc: Sanjay Lal <sanjayl@kymasys.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/mips/kvm/kvm_mips.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/mips/kvm/kvm_mips.c
+++ b/arch/mips/kvm/kvm_mips.c
@@ -304,7 +304,7 @@ struct kvm_vcpu *kvm_arch_vcpu_create(st
if (cpu_has_veic || cpu_has_vint) {
size = 0x200 + VECTORSPACING * 64;
} else {
- size = 0x200;
+ size = 0x4000;
}
/* Save Linux EBASE */
^ permalink raw reply [flat|nested] 69+ messages in thread* [PATCH 3.15 26/61] USB: cdc-acm: fix write and suspend race
2014-06-24 15:50 [PATCH 3.15 00/61] 3.15.2-stable review Greg Kroah-Hartman
` (23 preceding siblings ...)
2014-06-24 15:51 ` [PATCH 3.15 25/61] MIPS: KVM: Allocate at least 16KB for exception handlers Greg Kroah-Hartman
@ 2014-06-24 15:51 ` Greg Kroah-Hartman
2014-06-24 15:51 ` [PATCH 3.15 27/61] USB: cdc-acm: fix write and resume race Greg Kroah-Hartman
` (34 subsequent siblings)
59 siblings, 0 replies; 69+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-24 15:51 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold
3.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <jhovold@gmail.com>
commit 5a345c20c17d87099224a4be12e69e5bd7023dca upstream.
Fix race between write() and suspend() which could lead to writes being
dropped (or I/O while suspended) if the device is runtime suspended
while a write request is being processed.
Specifically, suspend() releases the write_lock after determining the
device is idle but before incrementing the susp_count, thus leaving a
window where a concurrent write() can submit an urb.
Fixes: 11ea859d64b6 ("USB: additional power savings for cdc-acm devices
that support remote wakeup")
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/class/cdc-acm.c | 15 ++++++---------
1 file changed, 6 insertions(+), 9 deletions(-)
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1514,18 +1514,15 @@ static int acm_suspend(struct usb_interf
struct acm *acm = usb_get_intfdata(intf);
int cnt;
+ spin_lock_irq(&acm->read_lock);
+ spin_lock(&acm->write_lock);
if (PMSG_IS_AUTO(message)) {
- int b;
-
- spin_lock_irq(&acm->write_lock);
- b = acm->transmitting;
- spin_unlock_irq(&acm->write_lock);
- if (b)
+ if (acm->transmitting) {
+ spin_unlock(&acm->write_lock);
+ spin_unlock_irq(&acm->read_lock);
return -EBUSY;
+ }
}
-
- spin_lock_irq(&acm->read_lock);
- spin_lock(&acm->write_lock);
cnt = acm->susp_count++;
spin_unlock(&acm->write_lock);
spin_unlock_irq(&acm->read_lock);
^ permalink raw reply [flat|nested] 69+ messages in thread* [PATCH 3.15 27/61] USB: cdc-acm: fix write and resume race
2014-06-24 15:50 [PATCH 3.15 00/61] 3.15.2-stable review Greg Kroah-Hartman
` (24 preceding siblings ...)
2014-06-24 15:51 ` [PATCH 3.15 26/61] USB: cdc-acm: fix write and suspend race Greg Kroah-Hartman
@ 2014-06-24 15:51 ` Greg Kroah-Hartman
2014-06-24 15:51 ` [PATCH 3.15 28/61] USB: cdc-acm: fix broken runtime suspend Greg Kroah-Hartman
` (33 subsequent siblings)
59 siblings, 0 replies; 69+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-24 15:51 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold
3.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <jhovold@gmail.com>
commit e144ed28bed10684f9aaec6325ed974d53f76110 upstream.
Fix race between write() and resume() due to improper locking that could
lead to writes being reordered.
Resume must be done atomically and susp_count be protected by the
write_lock in order to prevent racing with write(). This could otherwise
lead to writes being reordered if write() grabs the write_lock after
susp_count is decremented, but before the delayed urb is submitted.
Fixes: 11ea859d64b6 ("USB: additional power savings for cdc-acm devices
that support remote wakeup")
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/class/cdc-acm.c | 23 +++++++++--------------
1 file changed, 9 insertions(+), 14 deletions(-)
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1541,27 +1541,20 @@ static int acm_resume(struct usb_interfa
struct acm *acm = usb_get_intfdata(intf);
struct acm_wb *wb;
int rv = 0;
- int cnt;
spin_lock_irq(&acm->read_lock);
- acm->susp_count -= 1;
- cnt = acm->susp_count;
- spin_unlock_irq(&acm->read_lock);
+ spin_lock(&acm->write_lock);
- if (cnt)
- return 0;
+ if (--acm->susp_count)
+ goto out;
if (test_bit(ASYNCB_INITIALIZED, &acm->port.flags)) {
- rv = usb_submit_urb(acm->ctrlurb, GFP_NOIO);
+ rv = usb_submit_urb(acm->ctrlurb, GFP_ATOMIC);
- spin_lock_irq(&acm->write_lock);
if (acm->delayed_wb) {
wb = acm->delayed_wb;
acm->delayed_wb = NULL;
- spin_unlock_irq(&acm->write_lock);
acm_start_wb(acm, wb);
- } else {
- spin_unlock_irq(&acm->write_lock);
}
/*
@@ -1569,12 +1562,14 @@ static int acm_resume(struct usb_interfa
* do the write path at all cost
*/
if (rv < 0)
- goto err_out;
+ goto out;
- rv = acm_submit_read_urbs(acm, GFP_NOIO);
+ rv = acm_submit_read_urbs(acm, GFP_ATOMIC);
}
+out:
+ spin_unlock(&acm->write_lock);
+ spin_unlock_irq(&acm->read_lock);
-err_out:
return rv;
}
^ permalink raw reply [flat|nested] 69+ messages in thread* [PATCH 3.15 28/61] USB: cdc-acm: fix broken runtime suspend
2014-06-24 15:50 [PATCH 3.15 00/61] 3.15.2-stable review Greg Kroah-Hartman
` (25 preceding siblings ...)
2014-06-24 15:51 ` [PATCH 3.15 27/61] USB: cdc-acm: fix write and resume race Greg Kroah-Hartman
@ 2014-06-24 15:51 ` Greg Kroah-Hartman
2014-06-24 15:51 ` [PATCH 3.15 29/61] USB: cdc-acm: fix runtime PM for control messages Greg Kroah-Hartman
` (32 subsequent siblings)
59 siblings, 0 replies; 69+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-24 15:51 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Xiao Jin, Johan Hovold
3.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <jhovold@gmail.com>
commit 140cb81ac8c625942a1d695875932c615767a526 upstream.
The current ACM runtime-suspend implementation is broken in several
ways:
Firstly, it buffers only the first write request being made while
suspended -- any further writes are silently dropped.
Secondly, writes being dropped also leak write urbs, which are never
reclaimed (until the device is unbound).
Thirdly, even the single buffered write is not cleared at shutdown
(which may happen before the device is resumed), something which can
lead to another urb leak as well as a PM usage-counter leak.
Fix this by implementing a delayed-write queue using urb anchors and
making sure to discard the queue properly at shutdown.
Fixes: 11ea859d64b6 ("USB: additional power savings for cdc-acm devices
that support remote wakeup")
Reported-by: Xiao Jin <jin.xiao@intel.com>
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/class/cdc-acm.c | 32 ++++++++++++++++++++++----------
drivers/usb/class/cdc-acm.h | 2 +-
2 files changed, 23 insertions(+), 11 deletions(-)
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -573,6 +573,8 @@ static void acm_port_destruct(struct tty
static void acm_port_shutdown(struct tty_port *port)
{
struct acm *acm = container_of(port, struct acm, port);
+ struct urb *urb;
+ struct acm_wb *wb;
int i;
dev_dbg(&acm->control->dev, "%s\n", __func__);
@@ -581,6 +583,16 @@ static void acm_port_shutdown(struct tty
if (!acm->disconnected) {
usb_autopm_get_interface(acm->control);
acm_set_control(acm, acm->ctrlout = 0);
+
+ for (;;) {
+ urb = usb_get_from_anchor(&acm->delayed);
+ if (!urb)
+ break;
+ wb = urb->context;
+ wb->use = 0;
+ usb_autopm_put_interface_async(acm->control);
+ }
+
usb_kill_urb(acm->ctrlurb);
for (i = 0; i < ACM_NW; i++)
usb_kill_urb(acm->wb[i].urb);
@@ -648,12 +660,9 @@ static int acm_tty_write(struct tty_stru
usb_autopm_get_interface_async(acm->control);
if (acm->susp_count) {
- if (!acm->delayed_wb)
- acm->delayed_wb = wb;
- else
- usb_autopm_put_interface_async(acm->control);
+ usb_anchor_urb(wb->urb, &acm->delayed);
spin_unlock_irqrestore(&acm->write_lock, flags);
- return count; /* A white lie */
+ return count;
}
usb_mark_last_busy(acm->dev);
@@ -1269,6 +1278,7 @@ made_compressed_probe:
acm->bInterval = epread->bInterval;
tty_port_init(&acm->port);
acm->port.ops = &acm_port_ops;
+ init_usb_anchor(&acm->delayed);
buf = usb_alloc_coherent(usb_dev, ctrlsize, GFP_KERNEL, &acm->ctrl_dma);
if (!buf) {
@@ -1539,7 +1549,7 @@ static int acm_suspend(struct usb_interf
static int acm_resume(struct usb_interface *intf)
{
struct acm *acm = usb_get_intfdata(intf);
- struct acm_wb *wb;
+ struct urb *urb;
int rv = 0;
spin_lock_irq(&acm->read_lock);
@@ -1551,10 +1561,12 @@ static int acm_resume(struct usb_interfa
if (test_bit(ASYNCB_INITIALIZED, &acm->port.flags)) {
rv = usb_submit_urb(acm->ctrlurb, GFP_ATOMIC);
- if (acm->delayed_wb) {
- wb = acm->delayed_wb;
- acm->delayed_wb = NULL;
- acm_start_wb(acm, wb);
+ for (;;) {
+ urb = usb_get_from_anchor(&acm->delayed);
+ if (!urb)
+ break;
+
+ acm_start_wb(acm, urb->context);
}
/*
--- a/drivers/usb/class/cdc-acm.h
+++ b/drivers/usb/class/cdc-acm.h
@@ -120,7 +120,7 @@ struct acm {
unsigned int throttled:1; /* actually throttled */
unsigned int throttle_req:1; /* throttle requested */
u8 bInterval;
- struct acm_wb *delayed_wb; /* write queued for a device about to be woken */
+ struct usb_anchor delayed; /* writes queued for a device about to be woken */
};
#define CDC_DATA_INTERFACE_TYPE 0x0a
^ permalink raw reply [flat|nested] 69+ messages in thread* [PATCH 3.15 29/61] USB: cdc-acm: fix runtime PM for control messages
2014-06-24 15:50 [PATCH 3.15 00/61] 3.15.2-stable review Greg Kroah-Hartman
` (26 preceding siblings ...)
2014-06-24 15:51 ` [PATCH 3.15 28/61] USB: cdc-acm: fix broken runtime suspend Greg Kroah-Hartman
@ 2014-06-24 15:51 ` Greg Kroah-Hartman
2014-06-24 15:51 ` [PATCH 3.15 30/61] USB: cdc-acm: fix shutdown and suspend race Greg Kroah-Hartman
` (31 subsequent siblings)
59 siblings, 0 replies; 69+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-24 15:51 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold
3.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <jhovold@gmail.com>
commit bae3f4c53585e9a170da9436e0f06919874bda9a upstream.
Fix runtime PM handling of control messages by adding the required PM
counter operations.
Fixes: 11ea859d64b6 ("USB: additional power savings for cdc-acm devices
that support remote wakeup")
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/class/cdc-acm.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -122,13 +122,23 @@ static void acm_release_minor(struct acm
static int acm_ctrl_msg(struct acm *acm, int request, int value,
void *buf, int len)
{
- int retval = usb_control_msg(acm->dev, usb_sndctrlpipe(acm->dev, 0),
+ int retval;
+
+ retval = usb_autopm_get_interface(acm->control);
+ if (retval)
+ return retval;
+
+ retval = usb_control_msg(acm->dev, usb_sndctrlpipe(acm->dev, 0),
request, USB_RT_ACM, value,
acm->control->altsetting[0].desc.bInterfaceNumber,
buf, len, 5000);
+
dev_dbg(&acm->control->dev,
"%s - rq 0x%02x, val %#x, len %#x, result %d\n",
__func__, request, value, len, retval);
+
+ usb_autopm_put_interface(acm->control);
+
return retval < 0 ? retval : 0;
}
^ permalink raw reply [flat|nested] 69+ messages in thread* [PATCH 3.15 30/61] USB: cdc-acm: fix shutdown and suspend race
2014-06-24 15:50 [PATCH 3.15 00/61] 3.15.2-stable review Greg Kroah-Hartman
` (27 preceding siblings ...)
2014-06-24 15:51 ` [PATCH 3.15 29/61] USB: cdc-acm: fix runtime PM for control messages Greg Kroah-Hartman
@ 2014-06-24 15:51 ` Greg Kroah-Hartman
2014-06-24 15:51 ` [PATCH 3.15 31/61] USB: cdc-acm: fix potential urb leak and PM imbalance in write Greg Kroah-Hartman
` (30 subsequent siblings)
59 siblings, 0 replies; 69+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-24 15:51 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold
3.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <jhovold@gmail.com>
commit ed797074031a37bb9bf4a70952fffc606b77274d upstream.
We should stop I/O unconditionally at suspend rather than rely on the
tty-port initialised flag (which is set prior to stopping I/O during
shutdown) in order to prevent suspend returning with URBs still active.
Fixes: 11ea859d64b6 ("USB: additional power savings for cdc-acm devices
that support remote wakeup")
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/class/cdc-acm.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1550,8 +1550,7 @@ static int acm_suspend(struct usb_interf
if (cnt)
return 0;
- if (test_bit(ASYNCB_INITIALIZED, &acm->port.flags))
- stop_data_traffic(acm);
+ stop_data_traffic(acm);
return 0;
}
^ permalink raw reply [flat|nested] 69+ messages in thread* [PATCH 3.15 31/61] USB: cdc-acm: fix potential urb leak and PM imbalance in write
2014-06-24 15:50 [PATCH 3.15 00/61] 3.15.2-stable review Greg Kroah-Hartman
` (28 preceding siblings ...)
2014-06-24 15:51 ` [PATCH 3.15 30/61] USB: cdc-acm: fix shutdown and suspend race Greg Kroah-Hartman
@ 2014-06-24 15:51 ` Greg Kroah-Hartman
2014-06-24 15:51 ` [PATCH 3.15 32/61] USB: cdc-acm: fix open and suspend race Greg Kroah-Hartman
` (29 subsequent siblings)
59 siblings, 0 replies; 69+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-24 15:51 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold
3.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <jhovold@gmail.com>
commit 183a45087d126d126e8dd1d9b2602fc129dff9ad upstream.
Make sure to check return value of autopm get in write() in order to
avoid urb leak and PM counter imbalance on errors.
Fixes: 11ea859d64b6 ("USB: additional power savings for cdc-acm devices
that support remote wakeup")
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/class/cdc-acm.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -668,7 +668,13 @@ static int acm_tty_write(struct tty_stru
memcpy(wb->buf, buf, count);
wb->len = count;
- usb_autopm_get_interface_async(acm->control);
+ stat = usb_autopm_get_interface_async(acm->control);
+ if (stat) {
+ wb->use = 0;
+ spin_unlock_irqrestore(&acm->write_lock, flags);
+ return stat;
+ }
+
if (acm->susp_count) {
usb_anchor_urb(wb->urb, &acm->delayed);
spin_unlock_irqrestore(&acm->write_lock, flags);
^ permalink raw reply [flat|nested] 69+ messages in thread* [PATCH 3.15 32/61] USB: cdc-acm: fix open and suspend race
2014-06-24 15:50 [PATCH 3.15 00/61] 3.15.2-stable review Greg Kroah-Hartman
` (29 preceding siblings ...)
2014-06-24 15:51 ` [PATCH 3.15 31/61] USB: cdc-acm: fix potential urb leak and PM imbalance in write Greg Kroah-Hartman
@ 2014-06-24 15:51 ` Greg Kroah-Hartman
2014-06-24 15:51 ` [PATCH 3.15 33/61] USB: cdc-acm: fix failed open not being detected Greg Kroah-Hartman
` (28 subsequent siblings)
59 siblings, 0 replies; 69+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-24 15:51 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold
3.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <jhovold@gmail.com>
commit 703df3297fb1950b0aa53e656108eb936d3f21d9 upstream.
We must not do the usb_autopm_put_interface() before submitting the read
urbs or we might end up doing I/O to a suspended device.
Fixes: 088c64f81284 ("USB: cdc-acm: re-write read processing")
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/class/cdc-acm.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -528,19 +528,15 @@ static int acm_port_activate(struct tty_
if (usb_submit_urb(acm->ctrlurb, GFP_KERNEL)) {
dev_err(&acm->control->dev,
"%s - usb_submit_urb(ctrl irq) failed\n", __func__);
- usb_autopm_put_interface(acm->control);
goto error_submit_urb;
}
acm->ctrlout = ACM_CTRL_DTR | ACM_CTRL_RTS;
if (acm_set_control(acm, acm->ctrlout) < 0 &&
(acm->ctrl_caps & USB_CDC_CAP_LINE)) {
- usb_autopm_put_interface(acm->control);
goto error_set_control;
}
- usb_autopm_put_interface(acm->control);
-
/*
* Unthrottle device in case the TTY was closed while throttled.
*/
@@ -552,6 +548,8 @@ static int acm_port_activate(struct tty_
if (acm_submit_read_urbs(acm, GFP_KERNEL))
goto error_submit_read_urbs;
+ usb_autopm_put_interface(acm->control);
+
mutex_unlock(&acm->mutex);
return 0;
@@ -562,6 +560,7 @@ error_submit_read_urbs:
error_set_control:
usb_kill_urb(acm->ctrlurb);
error_submit_urb:
+ usb_autopm_put_interface(acm->control);
error_get_interface:
disconnected:
mutex_unlock(&acm->mutex);
^ permalink raw reply [flat|nested] 69+ messages in thread* [PATCH 3.15 33/61] USB: cdc-acm: fix failed open not being detected
2014-06-24 15:50 [PATCH 3.15 00/61] 3.15.2-stable review Greg Kroah-Hartman
` (30 preceding siblings ...)
2014-06-24 15:51 ` [PATCH 3.15 32/61] USB: cdc-acm: fix open and suspend race Greg Kroah-Hartman
@ 2014-06-24 15:51 ` Greg Kroah-Hartman
2014-06-24 15:51 ` [PATCH 3.15 34/61] USB: cdc-acm: fix I/O after failed open Greg Kroah-Hartman
` (27 subsequent siblings)
59 siblings, 0 replies; 69+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-24 15:51 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold
3.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <jhovold@gmail.com>
commit 8727bf689a77a79816065e23a7a58a474ad544f9 upstream.
Fix errors during open not being returned to userspace. Specifically,
failed control-line manipulations or control or read urb submissions
would not be detected.
Fixes: 7fb57a019f94 ("USB: cdc-acm: Fix potential deadlock (lockdep
warning)")
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/class/cdc-acm.c | 14 ++++++++------
1 file changed, 8 insertions(+), 6 deletions(-)
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -525,17 +525,17 @@ static int acm_port_activate(struct tty_
acm->control->needs_remote_wakeup = 1;
acm->ctrlurb->dev = acm->dev;
- if (usb_submit_urb(acm->ctrlurb, GFP_KERNEL)) {
+ retval = usb_submit_urb(acm->ctrlurb, GFP_KERNEL);
+ if (retval) {
dev_err(&acm->control->dev,
"%s - usb_submit_urb(ctrl irq) failed\n", __func__);
goto error_submit_urb;
}
acm->ctrlout = ACM_CTRL_DTR | ACM_CTRL_RTS;
- if (acm_set_control(acm, acm->ctrlout) < 0 &&
- (acm->ctrl_caps & USB_CDC_CAP_LINE)) {
+ retval = acm_set_control(acm, acm->ctrlout);
+ if (retval < 0 && (acm->ctrl_caps & USB_CDC_CAP_LINE))
goto error_set_control;
- }
/*
* Unthrottle device in case the TTY was closed while throttled.
@@ -545,7 +545,8 @@ static int acm_port_activate(struct tty_
acm->throttle_req = 0;
spin_unlock_irq(&acm->read_lock);
- if (acm_submit_read_urbs(acm, GFP_KERNEL))
+ retval = acm_submit_read_urbs(acm, GFP_KERNEL);
+ if (retval)
goto error_submit_read_urbs;
usb_autopm_put_interface(acm->control);
@@ -564,7 +565,8 @@ error_submit_urb:
error_get_interface:
disconnected:
mutex_unlock(&acm->mutex);
- return retval;
+
+ return usb_translate_errors(retval);
}
static void acm_port_destruct(struct tty_port *port)
^ permalink raw reply [flat|nested] 69+ messages in thread* [PATCH 3.15 34/61] USB: cdc-acm: fix I/O after failed open
2014-06-24 15:50 [PATCH 3.15 00/61] 3.15.2-stable review Greg Kroah-Hartman
` (31 preceding siblings ...)
2014-06-24 15:51 ` [PATCH 3.15 33/61] USB: cdc-acm: fix failed open not being detected Greg Kroah-Hartman
@ 2014-06-24 15:51 ` Greg Kroah-Hartman
2014-06-24 15:51 ` [PATCH 3.15 35/61] USB: cdc-acm: fix runtime PM imbalance at shutdown Greg Kroah-Hartman
` (26 subsequent siblings)
59 siblings, 0 replies; 69+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-24 15:51 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold
3.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <jhovold@gmail.com>
commit e4c36076c2a6195ec62c35b03c3fde84d0087dc8 upstream.
Make sure to kill any already submitted read urbs on read-urb submission
failures in open in order to prevent doing I/O for a closed port.
Fixes: 088c64f81284 ("USB: cdc-acm: re-write read processing")
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/class/cdc-acm.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -506,6 +506,7 @@ static int acm_port_activate(struct tty_
{
struct acm *acm = container_of(port, struct acm, port);
int retval = -ENODEV;
+ int i;
dev_dbg(&acm->control->dev, "%s\n", __func__);
@@ -556,6 +557,8 @@ static int acm_port_activate(struct tty_
return 0;
error_submit_read_urbs:
+ for (i = 0; i < acm->rx_buflimit; i++)
+ usb_kill_urb(acm->read_urbs[i]);
acm->ctrlout = 0;
acm_set_control(acm, acm->ctrlout);
error_set_control:
^ permalink raw reply [flat|nested] 69+ messages in thread* [PATCH 3.15 35/61] USB: cdc-acm: fix runtime PM imbalance at shutdown
2014-06-24 15:50 [PATCH 3.15 00/61] 3.15.2-stable review Greg Kroah-Hartman
` (32 preceding siblings ...)
2014-06-24 15:51 ` [PATCH 3.15 34/61] USB: cdc-acm: fix I/O after failed open Greg Kroah-Hartman
@ 2014-06-24 15:51 ` Greg Kroah-Hartman
2014-06-24 15:51 ` [PATCH 3.15 36/61] Drivers: hv: balloon: Ensure pressure reports are posted regularly Greg Kroah-Hartman
` (25 subsequent siblings)
59 siblings, 0 replies; 69+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-24 15:51 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold
3.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <jhovold@gmail.com>
commit 5292afa657d0e790b7479ad8eef9450c1e040b3d upstream.
Make sure only to decrement the PM counters if they were actually
incremented.
Note that the USB PM counter, but not necessarily the driver core PM
counter, is reset when the interface is unbound.
Fixes: 11ea859d64b6 ("USB: additional power savings for cdc-acm devices
that support remote wakeup")
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/class/cdc-acm.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -590,12 +590,13 @@ static void acm_port_shutdown(struct tty
struct urb *urb;
struct acm_wb *wb;
int i;
+ int pm_err;
dev_dbg(&acm->control->dev, "%s\n", __func__);
mutex_lock(&acm->mutex);
if (!acm->disconnected) {
- usb_autopm_get_interface(acm->control);
+ pm_err = usb_autopm_get_interface(acm->control);
acm_set_control(acm, acm->ctrlout = 0);
for (;;) {
@@ -613,7 +614,8 @@ static void acm_port_shutdown(struct tty
for (i = 0; i < acm->rx_buflimit; i++)
usb_kill_urb(acm->read_urbs[i]);
acm->control->needs_remote_wakeup = 0;
- usb_autopm_put_interface(acm->control);
+ if (!pm_err)
+ usb_autopm_put_interface(acm->control);
}
mutex_unlock(&acm->mutex);
}
^ permalink raw reply [flat|nested] 69+ messages in thread* [PATCH 3.15 36/61] Drivers: hv: balloon: Ensure pressure reports are posted regularly
2014-06-24 15:50 [PATCH 3.15 00/61] 3.15.2-stable review Greg Kroah-Hartman
` (33 preceding siblings ...)
2014-06-24 15:51 ` [PATCH 3.15 35/61] USB: cdc-acm: fix runtime PM imbalance at shutdown Greg Kroah-Hartman
@ 2014-06-24 15:51 ` Greg Kroah-Hartman
2014-06-24 15:51 ` [PATCH 3.15 38/61] ASoC: dapm: Make sure to always update the DAPM graph in _put_volsw() Greg Kroah-Hartman
` (24 subsequent siblings)
59 siblings, 0 replies; 69+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-24 15:51 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, K. Y. Srinivasan
3.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: "K. Y. Srinivasan" <kys@microsoft.com>
commit ae339336dc950b9b05e7ccd3565dd3e8781c06d9 upstream.
The current code posts periodic memory pressure status from a dedicated thread.
Under some conditions, especially when we are releasing a lot of memory into
the guest, we may not send timely pressure reports back to the host. Fix this
issue by reporting pressure in all contexts that can be active in this driver.
Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hv/hv_balloon.c | 29 ++++++++++++++++++++++++++---
1 file changed, 26 insertions(+), 3 deletions(-)
--- a/drivers/hv/hv_balloon.c
+++ b/drivers/hv/hv_balloon.c
@@ -19,6 +19,7 @@
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
#include <linux/kernel.h>
+#include <linux/jiffies.h>
#include <linux/mman.h>
#include <linux/delay.h>
#include <linux/init.h>
@@ -459,6 +460,11 @@ static bool do_hot_add;
*/
static uint pressure_report_delay = 45;
+/*
+ * The last time we posted a pressure report to host.
+ */
+static unsigned long last_post_time;
+
module_param(hot_add, bool, (S_IRUGO | S_IWUSR));
MODULE_PARM_DESC(hot_add, "If set attempt memory hot_add");
@@ -542,6 +548,7 @@ struct hv_dynmem_device {
static struct hv_dynmem_device dm_device;
+static void post_status(struct hv_dynmem_device *dm);
#ifdef CONFIG_MEMORY_HOTPLUG
static void hv_bring_pgs_online(unsigned long start_pfn, unsigned long size)
@@ -612,7 +619,7 @@ static void hv_mem_hot_add(unsigned long
* have not been "onlined" within the allowed time.
*/
wait_for_completion_timeout(&dm_device.ol_waitevent, 5*HZ);
-
+ post_status(&dm_device);
}
return;
@@ -951,11 +958,17 @@ static void post_status(struct hv_dynmem
{
struct dm_status status;
struct sysinfo val;
+ unsigned long now = jiffies;
+ unsigned long last_post = last_post_time;
if (pressure_report_delay > 0) {
--pressure_report_delay;
return;
}
+
+ if (!time_after(now, (last_post_time + HZ)))
+ return;
+
si_meminfo(&val);
memset(&status, 0, sizeof(struct dm_status));
status.hdr.type = DM_STATUS_REPORT;
@@ -983,6 +996,14 @@ static void post_status(struct hv_dynmem
if (status.hdr.trans_id != atomic_read(&trans_id))
return;
+ /*
+ * If the last post time that we sampled has changed,
+ * we have raced, don't post the status.
+ */
+ if (last_post != last_post_time)
+ return;
+
+ last_post_time = jiffies;
vmbus_sendpacket(dm->dev->channel, &status,
sizeof(struct dm_status),
(unsigned long)NULL,
@@ -1117,7 +1138,7 @@ static void balloon_up(struct work_struc
if (ret == -EAGAIN)
msleep(20);
-
+ post_status(&dm_device);
} while (ret == -EAGAIN);
if (ret) {
@@ -1144,8 +1165,10 @@ static void balloon_down(struct hv_dynme
struct dm_unballoon_response resp;
int i;
- for (i = 0; i < range_count; i++)
+ for (i = 0; i < range_count; i++) {
free_balloon_pages(dm, &range_array[i]);
+ post_status(&dm_device);
+ }
if (req->more_pages == 1)
return;
^ permalink raw reply [flat|nested] 69+ messages in thread* [PATCH 3.15 38/61] ASoC: dapm: Make sure to always update the DAPM graph in _put_volsw()
2014-06-24 15:50 [PATCH 3.15 00/61] 3.15.2-stable review Greg Kroah-Hartman
` (34 preceding siblings ...)
2014-06-24 15:51 ` [PATCH 3.15 36/61] Drivers: hv: balloon: Ensure pressure reports are posted regularly Greg Kroah-Hartman
@ 2014-06-24 15:51 ` Greg Kroah-Hartman
2014-06-24 15:51 ` [PATCH 3.15 39/61] ASoC: max98090: Fix reset at resume time Greg Kroah-Hartman
` (23 subsequent siblings)
59 siblings, 0 replies; 69+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-24 15:51 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Lars-Peter Clausen, Mark Brown
3.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lars-Peter Clausen <lars@metafoo.de>
commit c9e065c27fe9b81e5d6e7681d77a24f7b9616675 upstream.
When using auto-muted controls it may happen that the register value will not
change when changing a control from enabled to disabled (since the control might
be physically disabled due to the auto-muting). We have to make sure to still
update the DAPM graph and disconnect the mixer input.
Fixes: commit 5729507 ("ASoC: dapm: Implement mixer input auto-disable")
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Mark Brown <broonie@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/soc-dapm.c | 23 ++++++++++-------------
1 file changed, 10 insertions(+), 13 deletions(-)
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -2857,22 +2857,19 @@ int snd_soc_dapm_put_volsw(struct snd_kc
mutex_lock_nested(&card->dapm_mutex, SND_SOC_DAPM_CLASS_RUNTIME);
change = dapm_kcontrol_set_value(kcontrol, val);
-
- if (reg != SND_SOC_NOPM) {
- mask = mask << shift;
- val = val << shift;
-
- change = snd_soc_test_bits(codec, reg, mask, val);
- }
-
if (change) {
if (reg != SND_SOC_NOPM) {
- update.kcontrol = kcontrol;
- update.reg = reg;
- update.mask = mask;
- update.val = val;
+ mask = mask << shift;
+ val = val << shift;
+
+ if (snd_soc_test_bits(codec, reg, mask, val)) {
+ update.kcontrol = kcontrol;
+ update.reg = reg;
+ update.mask = mask;
+ update.val = val;
+ card->update = &update;
+ }
- card->update = &update;
}
ret = soc_dapm_mixer_update_power(card, kcontrol, connect);
^ permalink raw reply [flat|nested] 69+ messages in thread* [PATCH 3.15 39/61] ASoC: max98090: Fix reset at resume time
2014-06-24 15:50 [PATCH 3.15 00/61] 3.15.2-stable review Greg Kroah-Hartman
` (35 preceding siblings ...)
2014-06-24 15:51 ` [PATCH 3.15 38/61] ASoC: dapm: Make sure to always update the DAPM graph in _put_volsw() Greg Kroah-Hartman
@ 2014-06-24 15:51 ` Greg Kroah-Hartman
2014-06-24 15:51 ` [PATCH 3.15 40/61] ASoC: tlv320aci3x: Fix custom snd_soc_dapm_put_volsw_aic3x() function Greg Kroah-Hartman
` (22 subsequent siblings)
59 siblings, 0 replies; 69+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-24 15:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Liam Girdwood, Jarkko Nikula, Mark Brown
3.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liam Girdwood <liam.r.girdwood@linux.intel.com>
commit 25b4ab430f8e166c9b63f4db28e7e812d5a59396 upstream.
Reset needs to wait 20ms before other codec IO is performed. This wait
was not being performed. Fix this by making sure the reset register is not
restored with the cache, but use the manual reset method in resume with
the wait.
Signed-off-by: Liam Girdwood <liam.r.girdwood@linux.intel.com>
Signed-off-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/codecs/max98090.c | 3 +++
1 file changed, 3 insertions(+)
--- a/sound/soc/codecs/max98090.c
+++ b/sound/soc/codecs/max98090.c
@@ -255,6 +255,7 @@ static struct reg_default max98090_reg[]
static bool max98090_volatile_register(struct device *dev, unsigned int reg)
{
switch (reg) {
+ case M98090_REG_SOFTWARE_RESET:
case M98090_REG_DEVICE_STATUS:
case M98090_REG_JACK_STATUS:
case M98090_REG_REVISION_ID:
@@ -2373,6 +2374,8 @@ static int max98090_runtime_resume(struc
regcache_cache_only(max98090->regmap, false);
+ max98090_reset(max98090);
+
regcache_sync(max98090->regmap);
return 0;
^ permalink raw reply [flat|nested] 69+ messages in thread* [PATCH 3.15 40/61] ASoC: tlv320aci3x: Fix custom snd_soc_dapm_put_volsw_aic3x() function
2014-06-24 15:50 [PATCH 3.15 00/61] 3.15.2-stable review Greg Kroah-Hartman
` (36 preceding siblings ...)
2014-06-24 15:51 ` [PATCH 3.15 39/61] ASoC: max98090: Fix reset at resume time Greg Kroah-Hartman
@ 2014-06-24 15:51 ` Greg Kroah-Hartman
2014-06-24 15:51 ` [PATCH 3.15 41/61] iio:adc:max1363 incorrect resolutions for max11604, max11605, max11610 and max11611 Greg Kroah-Hartman
` (21 subsequent siblings)
59 siblings, 0 replies; 69+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-24 15:51 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Peter Ujfalusi, Mark Brown
3.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <peter.ujfalusi@ti.com>
commit e6c111fac4464e3f4bf7b3802b517dafc80f8e0f upstream.
For some unknown reason the parameters for snd_soc_test_bits() were in wrong
order:
It was:
snd_soc_test_bits(codec, val, mask, reg); /* WRONG!!! */
while it should be:
snd_soc_test_bits(codec, reg, mask, val);
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/codecs/tlv320aic3x.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/sound/soc/codecs/tlv320aic3x.c
+++ b/sound/soc/codecs/tlv320aic3x.c
@@ -169,7 +169,7 @@ static int snd_soc_dapm_put_volsw_aic3x(
mask <<= shift;
val <<= shift;
- change = snd_soc_test_bits(codec, val, mask, reg);
+ change = snd_soc_test_bits(codec, reg, mask, val);
if (change) {
update.kcontrol = kcontrol;
update.reg = reg;
^ permalink raw reply [flat|nested] 69+ messages in thread* [PATCH 3.15 41/61] iio:adc:max1363 incorrect resolutions for max11604, max11605, max11610 and max11611.
2014-06-24 15:50 [PATCH 3.15 00/61] 3.15.2-stable review Greg Kroah-Hartman
` (37 preceding siblings ...)
2014-06-24 15:51 ` [PATCH 3.15 40/61] ASoC: tlv320aci3x: Fix custom snd_soc_dapm_put_volsw_aic3x() function Greg Kroah-Hartman
@ 2014-06-24 15:51 ` Greg Kroah-Hartman
2014-06-24 15:51 ` [PATCH 3.15 42/61] staging: iio: tsl2x7x_core: fix proximity treshold Greg Kroah-Hartman
` (20 subsequent siblings)
59 siblings, 0 replies; 69+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-24 15:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Erik Habbinga, Jonathan Cameron,
Hartmut Knaack
3.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonathan Cameron <jic23@kernel.org>
commit a91a73c8b39a6b8bcc53fafa5372c65387c81233 upstream.
Reported-by: Erik Habbinga <Erik.Habbinga@schneider-electric.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Acked-by: Hartmut Knaack <knaack.h@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/adc/max1363.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
--- a/drivers/iio/adc/max1363.c
+++ b/drivers/iio/adc/max1363.c
@@ -1252,8 +1252,8 @@ static const struct max1363_chip_info ma
.num_modes = ARRAY_SIZE(max1238_mode_list),
.default_mode = s0to11,
.info = &max1238_info,
- .channels = max1238_channels,
- .num_channels = ARRAY_SIZE(max1238_channels),
+ .channels = max1038_channels,
+ .num_channels = ARRAY_SIZE(max1038_channels),
},
[max11605] = {
.bits = 8,
@@ -1262,8 +1262,8 @@ static const struct max1363_chip_info ma
.num_modes = ARRAY_SIZE(max1238_mode_list),
.default_mode = s0to11,
.info = &max1238_info,
- .channels = max1238_channels,
- .num_channels = ARRAY_SIZE(max1238_channels),
+ .channels = max1038_channels,
+ .num_channels = ARRAY_SIZE(max1038_channels),
},
[max11606] = {
.bits = 10,
@@ -1312,8 +1312,8 @@ static const struct max1363_chip_info ma
.num_modes = ARRAY_SIZE(max1238_mode_list),
.default_mode = s0to11,
.info = &max1238_info,
- .channels = max1238_channels,
- .num_channels = ARRAY_SIZE(max1238_channels),
+ .channels = max1138_channels,
+ .num_channels = ARRAY_SIZE(max1138_channels),
},
[max11611] = {
.bits = 10,
@@ -1322,8 +1322,8 @@ static const struct max1363_chip_info ma
.num_modes = ARRAY_SIZE(max1238_mode_list),
.default_mode = s0to11,
.info = &max1238_info,
- .channels = max1238_channels,
- .num_channels = ARRAY_SIZE(max1238_channels),
+ .channels = max1138_channels,
+ .num_channels = ARRAY_SIZE(max1138_channels),
},
[max11612] = {
.bits = 12,
^ permalink raw reply [flat|nested] 69+ messages in thread* [PATCH 3.15 42/61] staging: iio: tsl2x7x_core: fix proximity treshold
2014-06-24 15:50 [PATCH 3.15 00/61] 3.15.2-stable review Greg Kroah-Hartman
` (38 preceding siblings ...)
2014-06-24 15:51 ` [PATCH 3.15 41/61] iio:adc:max1363 incorrect resolutions for max11604, max11605, max11610 and max11611 Greg Kroah-Hartman
@ 2014-06-24 15:51 ` Greg Kroah-Hartman
2014-06-24 15:51 ` [PATCH 3.15 43/61] iio: adc: checking for NULL instead of IS_ERR() in probe Greg Kroah-Hartman
` (19 subsequent siblings)
59 siblings, 0 replies; 69+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-24 15:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mario Schuknecht, Jonathan Cameron
3.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Schuknecht <mario.schuknecht@dresearch-fe.de>
commit c404618cd06dad771495fe1cf9d5a63b5664f65f upstream.
Consider high byte of proximity min and max treshold in function
'tsl2x7x_chip_on'. So far, the high byte was not set.
Signed-off-by: Mario Schuknecht <mario.schuknecht@dresearch-fe.de>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/iio/light/tsl2x7x_core.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/drivers/staging/iio/light/tsl2x7x_core.c
+++ b/drivers/staging/iio/light/tsl2x7x_core.c
@@ -667,9 +667,13 @@ static int tsl2x7x_chip_on(struct iio_de
chip->tsl2x7x_config[TSL2X7X_PRX_COUNT] =
chip->tsl2x7x_settings.prox_pulse_count;
chip->tsl2x7x_config[TSL2X7X_PRX_MINTHRESHLO] =
- chip->tsl2x7x_settings.prox_thres_low;
+ (chip->tsl2x7x_settings.prox_thres_low) & 0xFF;
+ chip->tsl2x7x_config[TSL2X7X_PRX_MINTHRESHHI] =
+ (chip->tsl2x7x_settings.prox_thres_low >> 8) & 0xFF;
chip->tsl2x7x_config[TSL2X7X_PRX_MAXTHRESHLO] =
- chip->tsl2x7x_settings.prox_thres_high;
+ (chip->tsl2x7x_settings.prox_thres_high) & 0xFF;
+ chip->tsl2x7x_config[TSL2X7X_PRX_MAXTHRESHHI] =
+ (chip->tsl2x7x_settings.prox_thres_high >> 8) & 0xFF;
/* and make sure we're not already on */
if (chip->tsl2x7x_chip_status == TSL2X7X_CHIP_WORKING) {
^ permalink raw reply [flat|nested] 69+ messages in thread* [PATCH 3.15 43/61] iio: adc: checking for NULL instead of IS_ERR() in probe
2014-06-24 15:50 [PATCH 3.15 00/61] 3.15.2-stable review Greg Kroah-Hartman
` (39 preceding siblings ...)
2014-06-24 15:51 ` [PATCH 3.15 42/61] staging: iio: tsl2x7x_core: fix proximity treshold Greg Kroah-Hartman
@ 2014-06-24 15:51 ` Greg Kroah-Hartman
2014-06-24 15:51 ` [PATCH 3.15 44/61] iio: mxs-lradc: fix divider Greg Kroah-Hartman
` (18 subsequent siblings)
59 siblings, 0 replies; 69+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-24 15:51 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Jonathan Cameron
3.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
commit e94f62e79f7f63a68574ee5e76c19837ec12f3db upstream.
mcb_request_mem() returns an ERR_PTR(), it doesn't return NULL.
Fixes: 74aeac4da66f ('iio: adc: Add MEN 16z188 ADC driver')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/adc/men_z188_adc.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/iio/adc/men_z188_adc.c
+++ b/drivers/iio/adc/men_z188_adc.c
@@ -121,8 +121,8 @@ static int men_z188_probe(struct mcb_dev
indio_dev->num_channels = ARRAY_SIZE(z188_adc_iio_channels);
mem = mcb_request_mem(dev, "z188-adc");
- if (!mem)
- return -ENOMEM;
+ if (IS_ERR(mem))
+ return PTR_ERR(mem);
adc->base = ioremap(mem->start, resource_size(mem));
if (adc->base == NULL)
^ permalink raw reply [flat|nested] 69+ messages in thread* [PATCH 3.15 44/61] iio: mxs-lradc: fix divider
2014-06-24 15:50 [PATCH 3.15 00/61] 3.15.2-stable review Greg Kroah-Hartman
` (40 preceding siblings ...)
2014-06-24 15:51 ` [PATCH 3.15 43/61] iio: adc: checking for NULL instead of IS_ERR() in probe Greg Kroah-Hartman
@ 2014-06-24 15:51 ` Greg Kroah-Hartman
2014-06-24 15:51 ` [PATCH 3.15 45/61] iio: adc: at91: signedness bug in at91_adc_get_trigger_value_by_name() Greg Kroah-Hartman
` (17 subsequent siblings)
59 siblings, 0 replies; 69+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-24 15:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Robert Hodaszi, Alexandre Belloni,
Marek Vasut, Jonathan Cameron
3.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robert Hodaszi <robert.hodaszi@digi.com>
commit 19bc4981a213d0c5b0e1e8b08815c0b26f01ec54 upstream.
All channels' single measurement are happening on CH 0. So enabling / disabling
the divider once is not enough, because it has impact on all channels.
Set only a flag, then check this on each measurement, and enable / disable the
divider as required.
Signed-off-by: Robert Hodaszi <robert.hodaszi@digi.com>
Acked-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
Acked-by: Marek Vasut <marex@denx.de>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/iio/adc/mxs-lradc.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
--- a/drivers/staging/iio/adc/mxs-lradc.c
+++ b/drivers/staging/iio/adc/mxs-lradc.c
@@ -846,6 +846,14 @@ static int mxs_lradc_read_single(struct
LRADC_CTRL1);
mxs_lradc_reg_clear(lradc, 0xff, LRADC_CTRL0);
+ /* Enable / disable the divider per requirement */
+ if (test_bit(chan, &lradc->is_divided))
+ mxs_lradc_reg_set(lradc, 1 << LRADC_CTRL2_DIVIDE_BY_TWO_OFFSET,
+ LRADC_CTRL2);
+ else
+ mxs_lradc_reg_clear(lradc,
+ 1 << LRADC_CTRL2_DIVIDE_BY_TWO_OFFSET, LRADC_CTRL2);
+
/* Clean the slot's previous content, then set new one. */
mxs_lradc_reg_clear(lradc, LRADC_CTRL4_LRADCSELECT_MASK(0),
LRADC_CTRL4);
@@ -961,15 +969,11 @@ static int mxs_lradc_write_raw(struct ii
if (val == scale_avail[MXS_LRADC_DIV_DISABLED].integer &&
val2 == scale_avail[MXS_LRADC_DIV_DISABLED].nano) {
/* divider by two disabled */
- writel(1 << LRADC_CTRL2_DIVIDE_BY_TWO_OFFSET,
- lradc->base + LRADC_CTRL2 + STMP_OFFSET_REG_CLR);
clear_bit(chan->channel, &lradc->is_divided);
ret = 0;
} else if (val == scale_avail[MXS_LRADC_DIV_ENABLED].integer &&
val2 == scale_avail[MXS_LRADC_DIV_ENABLED].nano) {
/* divider by two enabled */
- writel(1 << LRADC_CTRL2_DIVIDE_BY_TWO_OFFSET,
- lradc->base + LRADC_CTRL2 + STMP_OFFSET_REG_SET);
set_bit(chan->channel, &lradc->is_divided);
ret = 0;
}
^ permalink raw reply [flat|nested] 69+ messages in thread* [PATCH 3.15 45/61] iio: adc: at91: signedness bug in at91_adc_get_trigger_value_by_name()
2014-06-24 15:50 [PATCH 3.15 00/61] 3.15.2-stable review Greg Kroah-Hartman
` (41 preceding siblings ...)
2014-06-24 15:51 ` [PATCH 3.15 44/61] iio: mxs-lradc: fix divider Greg Kroah-Hartman
@ 2014-06-24 15:51 ` Greg Kroah-Hartman
2014-06-24 15:51 ` [PATCH 3.15 46/61] iio: Fix endianness issue in ak8975_read_axis() Greg Kroah-Hartman
` (16 subsequent siblings)
59 siblings, 0 replies; 69+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-24 15:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Alexandre Belloni,
Jonathan Cameron
3.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
commit 4f3bcd878f1d3c730fe00f619b7260c6125d49eb upstream.
at91_adc_get_trigger_value_by_name() was returning -ENOMEM truncated to
a positive u8 and that doesn't work. I've changed it to int and
refactored it to preserve the error code.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
Tested-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/adc/at91_adc.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
--- a/drivers/iio/adc/at91_adc.c
+++ b/drivers/iio/adc/at91_adc.c
@@ -322,12 +322,11 @@ static int at91_adc_channel_init(struct
return idev->num_channels;
}
-static u8 at91_adc_get_trigger_value_by_name(struct iio_dev *idev,
+static int at91_adc_get_trigger_value_by_name(struct iio_dev *idev,
struct at91_adc_trigger *triggers,
const char *trigger_name)
{
struct at91_adc_state *st = iio_priv(idev);
- u8 value = 0;
int i;
for (i = 0; i < st->trigger_number; i++) {
@@ -340,15 +339,16 @@ static u8 at91_adc_get_trigger_value_by_
return -ENOMEM;
if (strcmp(trigger_name, name) == 0) {
- value = triggers[i].value;
kfree(name);
- break;
+ if (triggers[i].value == 0)
+ return -EINVAL;
+ return triggers[i].value;
}
kfree(name);
}
- return value;
+ return -EINVAL;
}
static int at91_adc_configure_trigger(struct iio_trigger *trig, bool state)
@@ -358,14 +358,14 @@ static int at91_adc_configure_trigger(st
struct iio_buffer *buffer = idev->buffer;
struct at91_adc_reg_desc *reg = st->registers;
u32 status = at91_adc_readl(st, reg->trigger_register);
- u8 value;
+ int value;
u8 bit;
value = at91_adc_get_trigger_value_by_name(idev,
st->trigger_list,
idev->trig->name);
- if (value == 0)
- return -EINVAL;
+ if (value < 0)
+ return value;
if (state) {
st->buffer = kmalloc(idev->scan_bytes, GFP_KERNEL);
^ permalink raw reply [flat|nested] 69+ messages in thread* [PATCH 3.15 46/61] iio: Fix endianness issue in ak8975_read_axis()
2014-06-24 15:50 [PATCH 3.15 00/61] 3.15.2-stable review Greg Kroah-Hartman
` (42 preceding siblings ...)
2014-06-24 15:51 ` [PATCH 3.15 45/61] iio: adc: at91: signedness bug in at91_adc_get_trigger_value_by_name() Greg Kroah-Hartman
@ 2014-06-24 15:51 ` Greg Kroah-Hartman
2014-06-24 15:51 ` [PATCH 3.15 48/61] lzo: properly check for overruns Greg Kroah-Hartman
` (15 subsequent siblings)
59 siblings, 0 replies; 69+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-24 15:51 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Peter Meerwald, Jonathan Cameron
3.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Meerwald <pmeerw@pmeerw.net>
commit 8ba42fb7b17649c9ab5b5e79d4e90370a0b4645e upstream.
i2c_smbus_read_word_data() does host endian conversion already,
no need for le16_to_cpu()
Signed-off-by: Peter Meerwald <pmeerw@pmeerw.net>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/magnetometer/ak8975.c | 9 +--------
1 file changed, 1 insertion(+), 8 deletions(-)
--- a/drivers/iio/magnetometer/ak8975.c
+++ b/drivers/iio/magnetometer/ak8975.c
@@ -352,8 +352,6 @@ static int ak8975_read_axis(struct iio_d
{
struct ak8975_data *data = iio_priv(indio_dev);
struct i2c_client *client = data->client;
- u16 meas_reg;
- s16 raw;
int ret;
mutex_lock(&data->lock);
@@ -401,16 +399,11 @@ static int ak8975_read_axis(struct iio_d
dev_err(&client->dev, "Read axis data fails\n");
goto exit;
}
- meas_reg = ret;
mutex_unlock(&data->lock);
- /* Endian conversion of the measured values. */
- raw = (s16) (le16_to_cpu(meas_reg));
-
/* Clamp to valid range. */
- raw = clamp_t(s16, raw, -4096, 4095);
- *val = raw;
+ *val = clamp_t(s16, ret, -4096, 4095);
return IIO_VAL_INT;
exit:
^ permalink raw reply [flat|nested] 69+ messages in thread* [PATCH 3.15 48/61] lzo: properly check for overruns
2014-06-24 15:50 [PATCH 3.15 00/61] 3.15.2-stable review Greg Kroah-Hartman
` (43 preceding siblings ...)
2014-06-24 15:51 ` [PATCH 3.15 46/61] iio: Fix endianness issue in ak8975_read_axis() Greg Kroah-Hartman
@ 2014-06-24 15:51 ` Greg Kroah-Hartman
2014-06-24 15:51 ` [PATCH 3.15 49/61] lz4: ensure length does not wrap Greg Kroah-Hartman
` (14 subsequent siblings)
59 siblings, 0 replies; 69+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-24 15:51 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Don A. Bailey
3.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 206a81c18401c0cde6e579164f752c4b147324ce upstream.
The lzo decompressor can, if given some really crazy data, possibly
overrun some variable types. Modify the checking logic to properly
detect overruns before they happen.
Reported-by: "Don A. Bailey" <donb@securitymouse.com>
Tested-by: "Don A. Bailey" <donb@securitymouse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
lib/lzo/lzo1x_decompress_safe.c | 62 ++++++++++++++++++++++++++--------------
1 file changed, 41 insertions(+), 21 deletions(-)
--- a/lib/lzo/lzo1x_decompress_safe.c
+++ b/lib/lzo/lzo1x_decompress_safe.c
@@ -19,11 +19,31 @@
#include <linux/lzo.h>
#include "lzodefs.h"
-#define HAVE_IP(x) ((size_t)(ip_end - ip) >= (size_t)(x))
-#define HAVE_OP(x) ((size_t)(op_end - op) >= (size_t)(x))
-#define NEED_IP(x) if (!HAVE_IP(x)) goto input_overrun
-#define NEED_OP(x) if (!HAVE_OP(x)) goto output_overrun
-#define TEST_LB(m_pos) if ((m_pos) < out) goto lookbehind_overrun
+#define HAVE_IP(t, x) \
+ (((size_t)(ip_end - ip) >= (size_t)(t + x)) && \
+ (((t + x) >= t) && ((t + x) >= x)))
+
+#define HAVE_OP(t, x) \
+ (((size_t)(op_end - op) >= (size_t)(t + x)) && \
+ (((t + x) >= t) && ((t + x) >= x)))
+
+#define NEED_IP(t, x) \
+ do { \
+ if (!HAVE_IP(t, x)) \
+ goto input_overrun; \
+ } while (0)
+
+#define NEED_OP(t, x) \
+ do { \
+ if (!HAVE_OP(t, x)) \
+ goto output_overrun; \
+ } while (0)
+
+#define TEST_LB(m_pos) \
+ do { \
+ if ((m_pos) < out) \
+ goto lookbehind_overrun; \
+ } while (0)
int lzo1x_decompress_safe(const unsigned char *in, size_t in_len,
unsigned char *out, size_t *out_len)
@@ -58,14 +78,14 @@ int lzo1x_decompress_safe(const unsigned
while (unlikely(*ip == 0)) {
t += 255;
ip++;
- NEED_IP(1);
+ NEED_IP(1, 0);
}
t += 15 + *ip++;
}
t += 3;
copy_literal_run:
#if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
- if (likely(HAVE_IP(t + 15) && HAVE_OP(t + 15))) {
+ if (likely(HAVE_IP(t, 15) && HAVE_OP(t, 15))) {
const unsigned char *ie = ip + t;
unsigned char *oe = op + t;
do {
@@ -81,8 +101,8 @@ copy_literal_run:
} else
#endif
{
- NEED_OP(t);
- NEED_IP(t + 3);
+ NEED_OP(t, 0);
+ NEED_IP(t, 3);
do {
*op++ = *ip++;
} while (--t > 0);
@@ -95,7 +115,7 @@ copy_literal_run:
m_pos -= t >> 2;
m_pos -= *ip++ << 2;
TEST_LB(m_pos);
- NEED_OP(2);
+ NEED_OP(2, 0);
op[0] = m_pos[0];
op[1] = m_pos[1];
op += 2;
@@ -119,10 +139,10 @@ copy_literal_run:
while (unlikely(*ip == 0)) {
t += 255;
ip++;
- NEED_IP(1);
+ NEED_IP(1, 0);
}
t += 31 + *ip++;
- NEED_IP(2);
+ NEED_IP(2, 0);
}
m_pos = op - 1;
next = get_unaligned_le16(ip);
@@ -137,10 +157,10 @@ copy_literal_run:
while (unlikely(*ip == 0)) {
t += 255;
ip++;
- NEED_IP(1);
+ NEED_IP(1, 0);
}
t += 7 + *ip++;
- NEED_IP(2);
+ NEED_IP(2, 0);
}
next = get_unaligned_le16(ip);
ip += 2;
@@ -154,7 +174,7 @@ copy_literal_run:
#if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
if (op - m_pos >= 8) {
unsigned char *oe = op + t;
- if (likely(HAVE_OP(t + 15))) {
+ if (likely(HAVE_OP(t, 15))) {
do {
COPY8(op, m_pos);
op += 8;
@@ -164,7 +184,7 @@ copy_literal_run:
m_pos += 8;
} while (op < oe);
op = oe;
- if (HAVE_IP(6)) {
+ if (HAVE_IP(6, 0)) {
state = next;
COPY4(op, ip);
op += next;
@@ -172,7 +192,7 @@ copy_literal_run:
continue;
}
} else {
- NEED_OP(t);
+ NEED_OP(t, 0);
do {
*op++ = *m_pos++;
} while (op < oe);
@@ -181,7 +201,7 @@ copy_literal_run:
#endif
{
unsigned char *oe = op + t;
- NEED_OP(t);
+ NEED_OP(t, 0);
op[0] = m_pos[0];
op[1] = m_pos[1];
op += 2;
@@ -194,15 +214,15 @@ match_next:
state = next;
t = next;
#if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
- if (likely(HAVE_IP(6) && HAVE_OP(4))) {
+ if (likely(HAVE_IP(6, 0) && HAVE_OP(4, 0))) {
COPY4(op, ip);
op += t;
ip += t;
} else
#endif
{
- NEED_IP(t + 3);
- NEED_OP(t);
+ NEED_IP(t, 3);
+ NEED_OP(t, 0);
while (t > 0) {
*op++ = *ip++;
t--;
^ permalink raw reply [flat|nested] 69+ messages in thread* [PATCH 3.15 49/61] lz4: ensure length does not wrap
2014-06-24 15:50 [PATCH 3.15 00/61] 3.15.2-stable review Greg Kroah-Hartman
` (44 preceding siblings ...)
2014-06-24 15:51 ` [PATCH 3.15 48/61] lzo: properly check for overruns Greg Kroah-Hartman
@ 2014-06-24 15:51 ` Greg Kroah-Hartman
[not found] ` <CAFkuX4tQoRhsS2A5iJNWyMELs=sLhNx-m5Uq38R7fjSmGHfvvQ@mail.gmail.com>
2014-06-24 15:51 ` [PATCH 3.15 50/61] ALSA: compress: Cancel the optimization of compiler and fix the size of struct for all platform Greg Kroah-Hartman
` (13 subsequent siblings)
59 siblings, 1 reply; 69+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-24 15:51 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Don A. Bailey
3.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 206204a1162b995e2185275167b22468c00d6b36 upstream.
Given some pathologically compressed data, lz4 could possibly decide to
wrap a few internal variables, causing unknown things to happen. Catch
this before the wrapping happens and abort the decompression.
Reported-by: "Don A. Bailey" <donb@securitymouse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
lib/lz4/lz4_decompress.c | 2 ++
1 file changed, 2 insertions(+)
--- a/lib/lz4/lz4_decompress.c
+++ b/lib/lz4/lz4_decompress.c
@@ -72,6 +72,8 @@ static int lz4_uncompress(const char *so
len = *ip++;
for (; len == 255; length += 255)
len = *ip++;
+ if (unlikely(length > (size_t)(length + len)))
+ goto _output_error;
length += len;
}
^ permalink raw reply [flat|nested] 69+ messages in thread* [PATCH 3.15 50/61] ALSA: compress: Cancel the optimization of compiler and fix the size of struct for all platform.
2014-06-24 15:50 [PATCH 3.15 00/61] 3.15.2-stable review Greg Kroah-Hartman
` (45 preceding siblings ...)
2014-06-24 15:51 ` [PATCH 3.15 49/61] lz4: ensure length does not wrap Greg Kroah-Hartman
@ 2014-06-24 15:51 ` Greg Kroah-Hartman
2014-06-24 15:51 ` [PATCH 3.15 51/61] ALSA: hda/realtek - Add support of ALC891 codec Greg Kroah-Hartman
` (12 subsequent siblings)
59 siblings, 0 replies; 69+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-24 15:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Zhang Dongxing, xiaoming wang,
Vinod Koul, Takashi Iwai
3.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Wang, Xiaoming" <xiaoming.wang@intel.com>
commit 2bd0ae464a6cf7363bbf72c8545e0aa43caa57f0 upstream.
Cancel the optimization of compiler for struct snd_compr_avail
which size will be 0x1c in 32bit kernel while 0x20 in 64bit
kernel under the optimizer. That will make compaction between
32bit and 64bit. So add packed to fix the size of struct
snd_compr_avail to 0x1c for all platform.
Signed-off-by: Zhang Dongxing <dongxing.zhang@intel.com>
Signed-off-by: xiaoming wang <xiaoming.wang@intel.com>
Acked-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/uapi/sound/compress_offload.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/include/uapi/sound/compress_offload.h
+++ b/include/uapi/sound/compress_offload.h
@@ -80,7 +80,7 @@ struct snd_compr_tstamp {
struct snd_compr_avail {
__u64 avail;
struct snd_compr_tstamp tstamp;
-};
+} __attribute__((packed));
enum snd_compr_direction {
SND_COMPRESS_PLAYBACK = 0,
^ permalink raw reply [flat|nested] 69+ messages in thread* [PATCH 3.15 51/61] ALSA: hda/realtek - Add support of ALC891 codec
2014-06-24 15:50 [PATCH 3.15 00/61] 3.15.2-stable review Greg Kroah-Hartman
` (46 preceding siblings ...)
2014-06-24 15:51 ` [PATCH 3.15 50/61] ALSA: compress: Cancel the optimization of compiler and fix the size of struct for all platform Greg Kroah-Hartman
@ 2014-06-24 15:51 ` Greg Kroah-Hartman
2014-06-24 15:51 ` [PATCH 3.15 52/61] ALSA: hda/realtek - Add more entry for enable HP mute led Greg Kroah-Hartman
` (11 subsequent siblings)
59 siblings, 0 replies; 69+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-24 15:51 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Kailang Yang, Takashi Iwai
3.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kailang Yang <kailang@realtek.com>
commit b6c5fbad16aa5026f508093a8d651c25e1cb6179 upstream.
New codec support for ALC891.
Signed-off-by: Kailang Yang <kailang@realtek.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/patch_realtek.c | 1 +
1 file changed, 1 insertion(+)
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -5809,6 +5809,7 @@ static const struct hda_codec_preset snd
{ .id = 0x10ec0670, .name = "ALC670", .patch = patch_alc662 },
{ .id = 0x10ec0671, .name = "ALC671", .patch = patch_alc662 },
{ .id = 0x10ec0680, .name = "ALC680", .patch = patch_alc680 },
+ { .id = 0x10ec0867, .name = "ALC891", .patch = patch_alc882 },
{ .id = 0x10ec0880, .name = "ALC880", .patch = patch_alc880 },
{ .id = 0x10ec0882, .name = "ALC882", .patch = patch_alc882 },
{ .id = 0x10ec0883, .name = "ALC883", .patch = patch_alc882 },
^ permalink raw reply [flat|nested] 69+ messages in thread* [PATCH 3.15 52/61] ALSA: hda/realtek - Add more entry for enable HP mute led
2014-06-24 15:50 [PATCH 3.15 00/61] 3.15.2-stable review Greg Kroah-Hartman
` (47 preceding siblings ...)
2014-06-24 15:51 ` [PATCH 3.15 51/61] ALSA: hda/realtek - Add support of ALC891 codec Greg Kroah-Hartman
@ 2014-06-24 15:51 ` Greg Kroah-Hartman
2014-06-24 15:51 ` [PATCH 3.15 53/61] ALSA: hda - verify pin:converter connection on unsol event for HSW and VLV Greg Kroah-Hartman
` (10 subsequent siblings)
59 siblings, 0 replies; 69+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-24 15:51 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Kailang Yang, Takashi Iwai
3.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kailang Yang <kailang@realtek.com>
commit 8a02b164d4bfac108bfe37e98108bff1e062bd3d upstream.
More HP machine need mute led support.
Signed-off-by: Kailang Yang <kailang@realtek.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/patch_realtek.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -4633,14 +4633,24 @@ static const struct snd_pci_quirk alc269
SND_PCI_QUIRK(0x103c, 0x1983, "HP Pavilion", ALC269_FIXUP_HP_MUTE_LED_MIC1),
SND_PCI_QUIRK(0x103c, 0x218b, "HP", ALC269_FIXUP_LIMIT_INT_MIC_BOOST_MUTE_LED),
/* ALC282 */
+ SND_PCI_QUIRK(0x103c, 0x220d, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ SND_PCI_QUIRK(0x103c, 0x220e, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
SND_PCI_QUIRK(0x103c, 0x220f, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ SND_PCI_QUIRK(0x103c, 0x2210, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ SND_PCI_QUIRK(0x103c, 0x2211, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ SND_PCI_QUIRK(0x103c, 0x2212, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
SND_PCI_QUIRK(0x103c, 0x2213, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ SND_PCI_QUIRK(0x103c, 0x2214, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
SND_PCI_QUIRK(0x103c, 0x2266, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
SND_PCI_QUIRK(0x103c, 0x2267, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
SND_PCI_QUIRK(0x103c, 0x2268, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
SND_PCI_QUIRK(0x103c, 0x2269, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
SND_PCI_QUIRK(0x103c, 0x226a, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
SND_PCI_QUIRK(0x103c, 0x226b, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ SND_PCI_QUIRK(0x103c, 0x226c, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ SND_PCI_QUIRK(0x103c, 0x226d, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ SND_PCI_QUIRK(0x103c, 0x226e, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ SND_PCI_QUIRK(0x103c, 0x226f, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
SND_PCI_QUIRK(0x103c, 0x227a, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
SND_PCI_QUIRK(0x103c, 0x227b, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
SND_PCI_QUIRK(0x103c, 0x229e, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
@@ -4680,6 +4690,10 @@ static const struct snd_pci_quirk alc269
SND_PCI_QUIRK(0x103c, 0x22c8, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
SND_PCI_QUIRK(0x103c, 0x22c3, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
SND_PCI_QUIRK(0x103c, 0x22c4, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ SND_PCI_QUIRK(0x103c, 0x2334, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ SND_PCI_QUIRK(0x103c, 0x2335, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ SND_PCI_QUIRK(0x103c, 0x2336, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ SND_PCI_QUIRK(0x103c, 0x2337, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
SND_PCI_QUIRK_VENDOR(0x103c, "HP", ALC269_FIXUP_HP_MUTE_LED),
SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300),
SND_PCI_QUIRK(0x1043, 0x106d, "Asus K53BE", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
^ permalink raw reply [flat|nested] 69+ messages in thread* [PATCH 3.15 53/61] ALSA: hda - verify pin:converter connection on unsol event for HSW and VLV
2014-06-24 15:50 [PATCH 3.15 00/61] 3.15.2-stable review Greg Kroah-Hartman
` (48 preceding siblings ...)
2014-06-24 15:51 ` [PATCH 3.15 52/61] ALSA: hda/realtek - Add more entry for enable HP mute led Greg Kroah-Hartman
@ 2014-06-24 15:51 ` Greg Kroah-Hartman
2014-06-24 15:51 ` [PATCH 3.15 55/61] ALSA: control: Protect user controls against concurrent access Greg Kroah-Hartman
` (9 subsequent siblings)
59 siblings, 0 replies; 69+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-24 15:51 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Mengdong Lin, Takashi Iwai
3.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mengdong Lin <mengdong.lin@intel.com>
commit b4f75aea553a2146bbdd159c397a2ac42cbb9902 upstream.
This patch will verify the pin's coverter selection for an active stream
when an unsol event reports this pin becomes available again after a display
mode change or hot-plug event.
For Haswell+ and Valleyview: display mode change or hot-plug can change the
transcoder:port connection and make all the involved audio pins share the 1st
converter. So the stream using 1st convertor will flow to multiple pins
but active streams using other converters will fail. This workaround
is to assure the pin selects the right conveter and an assigned converter is
not shared by other unused pins.
Signed-off-by: Mengdong Lin <mengdong.lin@intel.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/patch_hdmi.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
--- a/sound/pci/hda/patch_hdmi.c
+++ b/sound/pci/hda/patch_hdmi.c
@@ -1598,10 +1598,18 @@ static bool hdmi_present_sense(struct hd
* Re-setup pin and infoframe. This is needed e.g. when
* - sink is first plugged-in (infoframe is not set up if !monitor_present)
* - transcoder can change during stream playback on Haswell
+ * and this can make HW reset converter selection on a pin.
*/
- if (eld->eld_valid && !old_eld_valid && per_pin->setup)
+ if (eld->eld_valid && !old_eld_valid && per_pin->setup) {
+ if (is_haswell_plus(codec) || is_valleyview(codec)) {
+ intel_verify_pin_cvt_connect(codec, per_pin);
+ intel_not_share_assigned_cvt(codec, pin_nid,
+ per_pin->mux_idx);
+ }
+
hdmi_setup_audio_infoframe(codec, per_pin,
per_pin->non_pcm);
+ }
}
if (eld_changed)
^ permalink raw reply [flat|nested] 69+ messages in thread* [PATCH 3.15 55/61] ALSA: control: Protect user controls against concurrent access
2014-06-24 15:50 [PATCH 3.15 00/61] 3.15.2-stable review Greg Kroah-Hartman
` (49 preceding siblings ...)
2014-06-24 15:51 ` [PATCH 3.15 53/61] ALSA: hda - verify pin:converter connection on unsol event for HSW and VLV Greg Kroah-Hartman
@ 2014-06-24 15:51 ` Greg Kroah-Hartman
2014-06-24 15:51 ` [PATCH 3.15 56/61] ALSA: control: Fix replacing user controls Greg Kroah-Hartman
` (8 subsequent siblings)
59 siblings, 0 replies; 69+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-24 15:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lars-Peter Clausen, Jaroslav Kysela,
Takashi Iwai
3.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lars-Peter Clausen <lars@metafoo.de>
commit 07f4d9d74a04aa7c72c5dae0ef97565f28f17b92 upstream.
The user-control put and get handlers as well as the tlv do not protect against
concurrent access from multiple threads. Since the state of the control is not
updated atomically it is possible that either two write operations or a write
and a read operation race against each other. Both can lead to arbitrary memory
disclosure. This patch introduces a new lock that protects user-controls from
concurrent access. Since applications typically access controls sequentially
than in parallel a single lock per card should be fine.
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Jaroslav Kysela <perex@perex.cz>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/sound/core.h | 2 ++
sound/core/control.c | 31 +++++++++++++++++++++++++------
sound/core/init.c | 1 +
3 files changed, 28 insertions(+), 6 deletions(-)
--- a/include/sound/core.h
+++ b/include/sound/core.h
@@ -116,6 +116,8 @@ struct snd_card {
int user_ctl_count; /* count of all user controls */
struct list_head controls; /* all controls for this card */
struct list_head ctl_files; /* active control files */
+ struct mutex user_ctl_lock; /* protects user controls against
+ concurrent access */
struct snd_info_entry *proc_root; /* root for soundcard specific files */
struct snd_info_entry *proc_id; /* the card id */
--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -991,6 +991,7 @@ static int snd_ctl_elem_unlock(struct sn
struct user_element {
struct snd_ctl_elem_info info;
+ struct snd_card *card;
void *elem_data; /* element data */
unsigned long elem_data_size; /* size of element data in bytes */
void *tlv_data; /* TLV data */
@@ -1034,7 +1035,9 @@ static int snd_ctl_elem_user_get(struct
{
struct user_element *ue = kcontrol->private_data;
+ mutex_lock(&ue->card->user_ctl_lock);
memcpy(&ucontrol->value, ue->elem_data, ue->elem_data_size);
+ mutex_unlock(&ue->card->user_ctl_lock);
return 0;
}
@@ -1043,10 +1046,12 @@ static int snd_ctl_elem_user_put(struct
{
int change;
struct user_element *ue = kcontrol->private_data;
-
+
+ mutex_lock(&ue->card->user_ctl_lock);
change = memcmp(&ucontrol->value, ue->elem_data, ue->elem_data_size) != 0;
if (change)
memcpy(ue->elem_data, &ucontrol->value, ue->elem_data_size);
+ mutex_unlock(&ue->card->user_ctl_lock);
return change;
}
@@ -1066,19 +1071,32 @@ static int snd_ctl_elem_user_tlv(struct
new_data = memdup_user(tlv, size);
if (IS_ERR(new_data))
return PTR_ERR(new_data);
+ mutex_lock(&ue->card->user_ctl_lock);
change = ue->tlv_data_size != size;
if (!change)
change = memcmp(ue->tlv_data, new_data, size);
kfree(ue->tlv_data);
ue->tlv_data = new_data;
ue->tlv_data_size = size;
+ mutex_unlock(&ue->card->user_ctl_lock);
} else {
- if (! ue->tlv_data_size || ! ue->tlv_data)
- return -ENXIO;
- if (size < ue->tlv_data_size)
- return -ENOSPC;
+ int ret = 0;
+
+ mutex_lock(&ue->card->user_ctl_lock);
+ if (!ue->tlv_data_size || !ue->tlv_data) {
+ ret = -ENXIO;
+ goto err_unlock;
+ }
+ if (size < ue->tlv_data_size) {
+ ret = -ENOSPC;
+ goto err_unlock;
+ }
if (copy_to_user(tlv, ue->tlv_data, ue->tlv_data_size))
- return -EFAULT;
+ ret = -EFAULT;
+err_unlock:
+ mutex_unlock(&ue->card->user_ctl_lock);
+ if (ret)
+ return ret;
}
return change;
}
@@ -1210,6 +1228,7 @@ static int snd_ctl_elem_add(struct snd_c
ue = kzalloc(sizeof(struct user_element) + private_size, GFP_KERNEL);
if (ue == NULL)
return -ENOMEM;
+ ue->card = card;
ue->info = *info;
ue->info.access = 0;
ue->elem_data = (char *)ue + sizeof(*ue);
--- a/sound/core/init.c
+++ b/sound/core/init.c
@@ -232,6 +232,7 @@ int snd_card_new(struct device *parent,
INIT_LIST_HEAD(&card->devices);
init_rwsem(&card->controls_rwsem);
rwlock_init(&card->ctl_files_rwlock);
+ mutex_init(&card->user_ctl_lock);
INIT_LIST_HEAD(&card->controls);
INIT_LIST_HEAD(&card->ctl_files);
spin_lock_init(&card->files_lock);
^ permalink raw reply [flat|nested] 69+ messages in thread* [PATCH 3.15 56/61] ALSA: control: Fix replacing user controls
2014-06-24 15:50 [PATCH 3.15 00/61] 3.15.2-stable review Greg Kroah-Hartman
` (50 preceding siblings ...)
2014-06-24 15:51 ` [PATCH 3.15 55/61] ALSA: control: Protect user controls against concurrent access Greg Kroah-Hartman
@ 2014-06-24 15:51 ` Greg Kroah-Hartman
2014-06-24 15:51 ` [PATCH 3.15 57/61] ALSA: control: Dont access controls outside of protected regions Greg Kroah-Hartman
` (7 subsequent siblings)
59 siblings, 0 replies; 69+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-24 15:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lars-Peter Clausen, Jaroslav Kysela,
Takashi Iwai
3.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lars-Peter Clausen <lars@metafoo.de>
commit 82262a46627bebb0febcc26664746c25cef08563 upstream.
There are two issues with the current implementation for replacing user
controls. The first is that the code does not check if the control is actually a
user control and neither does it check if the control is owned by the process
that tries to remove it. That allows userspace applications to remove arbitrary
controls, which can cause a user after free if a for example a driver does not
expect a control to be removed from under its feed.
The second issue is that on one hand when a control is replaced the
user_ctl_count limit is not checked and on the other hand the user_ctl_count is
increased (even though the number of user controls does not change). This allows
userspace, once the user_ctl_count limit as been reached, to repeatedly replace
a control until user_ctl_count overflows. Once that happens new controls can be
added effectively bypassing the user_ctl_count limit.
Both issues can be fixed by instead of open-coding the removal of the control
that is to be replaced to use snd_ctl_remove_user_ctl(). This function does
proper permission checks as well as decrements user_ctl_count after the control
has been removed.
Note that by using snd_ctl_remove_user_ctl() the check which returns -EBUSY at
beginning of the function if the control already exists is removed. This is not
a problem though since the check is quite useless, because the lock that is
protecting the control list is released between the check and before adding the
new control to the list, which means that it is possible that a different
control with the same settings is added to the list after the check. Luckily
there is another check that is done while holding the lock in snd_ctl_add(), so
we'll rely on that to make sure that the same control is not added twice.
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Jaroslav Kysela <perex@perex.cz>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/core/control.c | 25 +++++++++----------------
1 file changed, 9 insertions(+), 16 deletions(-)
--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -1154,8 +1154,6 @@ static int snd_ctl_elem_add(struct snd_c
struct user_element *ue;
int idx, err;
- if (!replace && card->user_ctl_count >= MAX_USER_CONTROLS)
- return -ENOMEM;
if (info->count < 1)
return -EINVAL;
access = info->access == 0 ? SNDRV_CTL_ELEM_ACCESS_READWRITE :
@@ -1164,21 +1162,16 @@ static int snd_ctl_elem_add(struct snd_c
SNDRV_CTL_ELEM_ACCESS_TLV_READWRITE));
info->id.numid = 0;
memset(&kctl, 0, sizeof(kctl));
- down_write(&card->controls_rwsem);
- _kctl = snd_ctl_find_id(card, &info->id);
- err = 0;
- if (_kctl) {
- if (replace)
- err = snd_ctl_remove(card, _kctl);
- else
- err = -EBUSY;
- } else {
- if (replace)
- err = -ENOENT;
+
+ if (replace) {
+ err = snd_ctl_remove_user_ctl(file, &info->id);
+ if (err)
+ return err;
}
- up_write(&card->controls_rwsem);
- if (err < 0)
- return err;
+
+ if (card->user_ctl_count >= MAX_USER_CONTROLS)
+ return -ENOMEM;
+
memcpy(&kctl.id, &info->id, sizeof(info->id));
kctl.count = info->owner ? info->owner : 1;
access |= SNDRV_CTL_ELEM_ACCESS_USER;
^ permalink raw reply [flat|nested] 69+ messages in thread* [PATCH 3.15 57/61] ALSA: control: Dont access controls outside of protected regions
2014-06-24 15:50 [PATCH 3.15 00/61] 3.15.2-stable review Greg Kroah-Hartman
` (51 preceding siblings ...)
2014-06-24 15:51 ` [PATCH 3.15 56/61] ALSA: control: Fix replacing user controls Greg Kroah-Hartman
@ 2014-06-24 15:51 ` Greg Kroah-Hartman
2014-06-24 15:51 ` [PATCH 3.15 58/61] ALSA: control: Handle numid overflow Greg Kroah-Hartman
` (6 subsequent siblings)
59 siblings, 0 replies; 69+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-24 15:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lars-Peter Clausen, Jaroslav Kysela,
Takashi Iwai
3.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lars-Peter Clausen <lars@metafoo.de>
commit fd9f26e4eca5d08a27d12c0933fceef76ed9663d upstream.
A control that is visible on the card->controls list can be freed at any time.
This means we must not access any of its memory while not holding the
controls_rw_lock. Otherwise we risk a use after free access.
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Jaroslav Kysela <perex@perex.cz>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/core/control.c | 15 ++++++++++-----
1 file changed, 10 insertions(+), 5 deletions(-)
--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -330,6 +330,7 @@ int snd_ctl_add(struct snd_card *card, s
{
struct snd_ctl_elem_id id;
unsigned int idx;
+ unsigned int count;
int err = -EINVAL;
if (! kcontrol)
@@ -358,8 +359,9 @@ int snd_ctl_add(struct snd_card *card, s
card->controls_count += kcontrol->count;
kcontrol->id.numid = card->last_numid + 1;
card->last_numid += kcontrol->count;
+ count = kcontrol->count;
up_write(&card->controls_rwsem);
- for (idx = 0; idx < kcontrol->count; idx++, id.index++, id.numid++)
+ for (idx = 0; idx < count; idx++, id.index++, id.numid++)
snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_ADD, &id);
return 0;
@@ -388,6 +390,7 @@ int snd_ctl_replace(struct snd_card *car
bool add_on_replace)
{
struct snd_ctl_elem_id id;
+ unsigned int count;
unsigned int idx;
struct snd_kcontrol *old;
int ret;
@@ -423,8 +426,9 @@ add:
card->controls_count += kcontrol->count;
kcontrol->id.numid = card->last_numid + 1;
card->last_numid += kcontrol->count;
+ count = kcontrol->count;
up_write(&card->controls_rwsem);
- for (idx = 0; idx < kcontrol->count; idx++, id.index++, id.numid++)
+ for (idx = 0; idx < count; idx++, id.index++, id.numid++)
snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_ADD, &id);
return 0;
@@ -897,9 +901,9 @@ static int snd_ctl_elem_write(struct snd
result = kctl->put(kctl, control);
}
if (result > 0) {
+ struct snd_ctl_elem_id id = control->id;
up_read(&card->controls_rwsem);
- snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
- &control->id);
+ snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE, &id);
return 0;
}
}
@@ -1333,8 +1337,9 @@ static int snd_ctl_tlv_ioctl(struct snd_
}
err = kctl->tlv.c(kctl, op_flag, tlv.length, _tlv->tlv);
if (err > 0) {
+ struct snd_ctl_elem_id id = kctl->id;
up_read(&card->controls_rwsem);
- snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_TLV, &kctl->id);
+ snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_TLV, &id);
return 0;
}
} else {
^ permalink raw reply [flat|nested] 69+ messages in thread* [PATCH 3.15 58/61] ALSA: control: Handle numid overflow
2014-06-24 15:50 [PATCH 3.15 00/61] 3.15.2-stable review Greg Kroah-Hartman
` (52 preceding siblings ...)
2014-06-24 15:51 ` [PATCH 3.15 57/61] ALSA: control: Dont access controls outside of protected regions Greg Kroah-Hartman
@ 2014-06-24 15:51 ` Greg Kroah-Hartman
2014-06-24 15:51 ` [PATCH 3.15 59/61] ALSA: control: Make sure that id->index does not overflow Greg Kroah-Hartman
` (5 subsequent siblings)
59 siblings, 0 replies; 69+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-24 15:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lars-Peter Clausen, Jaroslav Kysela,
Takashi Iwai
3.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lars-Peter Clausen <lars@metafoo.de>
commit ac902c112d90a89e59916f751c2745f4dbdbb4bd upstream.
Each control gets automatically assigned its numids when the control is created.
The allocation is done by incrementing the numid by the amount of allocated
numids per allocation. This means that excessive creation and destruction of
controls (e.g. via SNDRV_CTL_IOCTL_ELEM_ADD/REMOVE) can cause the id to
eventually overflow. Currently when this happens for the control that caused the
overflow kctl->id.numid + kctl->count will also over flow causing it to be
smaller than kctl->id.numid. Most of the code assumes that this is something
that can not happen, so we need to make sure that it won't happen
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Jaroslav Kysela <perex@perex.cz>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/core/control.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -288,6 +288,10 @@ static bool snd_ctl_remove_numid_conflic
{
struct snd_kcontrol *kctl;
+ /* Make sure that the ids assigned to the control do not wrap around */
+ if (card->last_numid >= UINT_MAX - count)
+ card->last_numid = 0;
+
list_for_each_entry(kctl, &card->controls, list) {
if (kctl->id.numid < card->last_numid + 1 + count &&
kctl->id.numid + kctl->count > card->last_numid + 1) {
^ permalink raw reply [flat|nested] 69+ messages in thread* [PATCH 3.15 59/61] ALSA: control: Make sure that id->index does not overflow
2014-06-24 15:50 [PATCH 3.15 00/61] 3.15.2-stable review Greg Kroah-Hartman
` (53 preceding siblings ...)
2014-06-24 15:51 ` [PATCH 3.15 58/61] ALSA: control: Handle numid overflow Greg Kroah-Hartman
@ 2014-06-24 15:51 ` Greg Kroah-Hartman
2014-06-24 15:51 ` [PATCH 3.15 60/61] tmpfs: ZERO_RANGE and COLLAPSE_RANGE not currently supported Greg Kroah-Hartman
` (4 subsequent siblings)
59 siblings, 0 replies; 69+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-24 15:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lars-Peter Clausen, Jaroslav Kysela,
Takashi Iwai
3.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lars-Peter Clausen <lars@metafoo.de>
commit 883a1d49f0d77d30012f114b2e19fc141beb3e8e upstream.
The ALSA control code expects that the range of assigned indices to a control is
continuous and does not overflow. Currently there are no checks to enforce this.
If a control with a overflowing index range is created that control becomes
effectively inaccessible and unremovable since snd_ctl_find_id() will not be
able to find it. This patch adds a check that makes sure that controls with a
overflowing index range can not be created.
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Jaroslav Kysela <perex@perex.cz>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/core/control.c | 3 +++
1 file changed, 3 insertions(+)
--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -342,6 +342,9 @@ int snd_ctl_add(struct snd_card *card, s
if (snd_BUG_ON(!card || !kcontrol->info))
goto error;
id = kcontrol->id;
+ if (id.index > UINT_MAX - kcontrol->count)
+ goto error;
+
down_write(&card->controls_rwsem);
if (snd_ctl_find_id(card, &id)) {
up_write(&card->controls_rwsem);
^ permalink raw reply [flat|nested] 69+ messages in thread* [PATCH 3.15 60/61] tmpfs: ZERO_RANGE and COLLAPSE_RANGE not currently supported
2014-06-24 15:50 [PATCH 3.15 00/61] 3.15.2-stable review Greg Kroah-Hartman
` (54 preceding siblings ...)
2014-06-24 15:51 ` [PATCH 3.15 59/61] ALSA: control: Make sure that id->index does not overflow Greg Kroah-Hartman
@ 2014-06-24 15:51 ` Greg Kroah-Hartman
2014-06-24 15:51 ` [PATCH 3.15 61/61] slab: fix oops when reading /proc/slab_allocators Greg Kroah-Hartman
` (3 subsequent siblings)
59 siblings, 0 replies; 69+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-24 15:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hugh Dickins, Lukas Czerner,
Andrew Morton, Linus Torvalds
3.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hugh Dickins <hughd@google.com>
commit 13ace4d0d9db40e10ecd66dfda14e297571be813 upstream.
I was well aware of FALLOC_FL_ZERO_RANGE and FALLOC_FL_COLLAPSE_RANGE
support being added to fallocate(); but didn't realize until now that I
had been too stupid to future-proof shmem_fallocate() against new
additions. -EOPNOTSUPP instead of going on to ordinary fallocation.
Signed-off-by: Hugh Dickins <hughd@google.com>
Reviewed-by: Lukas Czerner <lczerner@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/shmem.c | 3 +++
1 file changed, 3 insertions(+)
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -1728,6 +1728,9 @@ static long shmem_fallocate(struct file
pgoff_t start, index, end;
int error;
+ if (mode & ~(FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE))
+ return -EOPNOTSUPP;
+
mutex_lock(&inode->i_mutex);
if (mode & FALLOC_FL_PUNCH_HOLE) {
^ permalink raw reply [flat|nested] 69+ messages in thread* [PATCH 3.15 61/61] slab: fix oops when reading /proc/slab_allocators
2014-06-24 15:50 [PATCH 3.15 00/61] 3.15.2-stable review Greg Kroah-Hartman
` (55 preceding siblings ...)
2014-06-24 15:51 ` [PATCH 3.15 60/61] tmpfs: ZERO_RANGE and COLLAPSE_RANGE not currently supported Greg Kroah-Hartman
@ 2014-06-24 15:51 ` Greg Kroah-Hartman
2014-06-24 19:50 ` [PATCH 3.15 00/61] 3.15.2-stable review Shuah Khan
` (2 subsequent siblings)
59 siblings, 0 replies; 69+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-24 15:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Joonsoo Kim, Dave Jones,
Tetsuo Handa, Vladimir Davydov, Christoph Lameter, Pekka Enberg,
David Rientjes, Andrew Morton, Linus Torvalds
3.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joonsoo Kim <iamjoonsoo.kim@lge.com>
commit 03787301420376ae41fbaf4267f4a6253d152ac5 upstream.
Commit b1cb0982bdd6 ("change the management method of free objects of
the slab") introduced a bug on slab leak detector
('/proc/slab_allocators'). This detector works like as following
decription.
1. traverse all objects on all the slabs.
2. determine whether it is active or not.
3. if active, print who allocate this object.
but that commit changed the way how to manage free objects, so the logic
determining whether it is active or not is also changed. In before, we
regard object in cpu caches as inactive one, but, with this commit, we
mistakenly regard object in cpu caches as active one.
This intoduces kernel oops if DEBUG_PAGEALLOC is enabled. If
DEBUG_PAGEALLOC is enabled, kernel_map_pages() is used to detect who
corrupt free memory in the slab. It unmaps page table mapping if object
is free and map it if object is active. When slab leak detector check
object in cpu caches, it mistakenly think this object active so try to
access object memory to retrieve caller of allocation. At this point,
page table mapping to this object doesn't exist, so oops occurs.
Following is oops message reported from Dave.
It blew up when something tried to read /proc/slab_allocators
(Just cat it, and you should see the oops below)
Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
Modules linked in:
[snip...]
CPU: 1 PID: 9386 Comm: trinity-c33 Not tainted 3.14.0-rc5+ #131
task: ffff8801aa46e890 ti: ffff880076924000 task.ti: ffff880076924000
RIP: 0010:[<ffffffffaa1a8f4a>] [<ffffffffaa1a8f4a>] handle_slab+0x8a/0x180
RSP: 0018:ffff880076925de0 EFLAGS: 00010002
RAX: 0000000000001000 RBX: 0000000000000000 RCX: 000000005ce85ce7
RDX: ffffea00079be100 RSI: 0000000000001000 RDI: ffff880107458000
RBP: ffff880076925e18 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 000000000000000f R12: ffff8801e6f84000
R13: ffffea00079be100 R14: ffff880107458000 R15: ffff88022bb8d2c0
FS: 00007fb769e45740(0000) GS:ffff88024d040000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff8801e6f84ff8 CR3: 00000000a22db000 CR4: 00000000001407e0
DR0: 0000000002695000 DR1: 0000000002695000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000070602
Call Trace:
leaks_show+0xce/0x240
seq_read+0x28e/0x490
proc_reg_read+0x3d/0x80
vfs_read+0x9b/0x160
SyS_read+0x58/0xb0
tracesys+0xd4/0xd9
Code: f5 00 00 00 0f 1f 44 00 00 48 63 c8 44 3b 0c 8a 0f 84 e3 00 00 00 83 c0 01 44 39 c0 72 eb 41 f6 47 1a 01 0f 84 e9 00 00 00 89 f0 <4d> 8b 4c 04 f8 4d 85 c9 0f 84 88 00 00 00 49 8b 7e 08 4d 8d 46
RIP handle_slab+0x8a/0x180
To fix the problem, I introduce an object status buffer on each slab.
With this, we can track object status precisely, so slab leak detector
would not access active object and no kernel oops would occur. Memory
overhead caused by this fix is only imposed to CONFIG_DEBUG_SLAB_LEAK
which is mainly used for debugging, so memory overhead isn't big
problem.
Signed-off-by: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Reported-by: Dave Jones <davej@redhat.com>
Reported-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Reviewed-by: Vladimir Davydov <vdavydov@parallels.com>
Cc: Christoph Lameter <cl@linux.com>
Cc: Pekka Enberg <penberg@kernel.org>
Cc: David Rientjes <rientjes@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/slab.c | 90 ++++++++++++++++++++++++++++++++++++++++++++++++--------------
1 file changed, 71 insertions(+), 19 deletions(-)
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -386,6 +386,39 @@ static void **dbg_userword(struct kmem_c
#endif
+#define OBJECT_FREE (0)
+#define OBJECT_ACTIVE (1)
+
+#ifdef CONFIG_DEBUG_SLAB_LEAK
+
+static void set_obj_status(struct page *page, int idx, int val)
+{
+ int freelist_size;
+ char *status;
+ struct kmem_cache *cachep = page->slab_cache;
+
+ freelist_size = cachep->num * sizeof(freelist_idx_t);
+ status = (char *)page->freelist + freelist_size;
+ status[idx] = val;
+}
+
+static inline unsigned int get_obj_status(struct page *page, int idx)
+{
+ int freelist_size;
+ char *status;
+ struct kmem_cache *cachep = page->slab_cache;
+
+ freelist_size = cachep->num * sizeof(freelist_idx_t);
+ status = (char *)page->freelist + freelist_size;
+
+ return status[idx];
+}
+
+#else
+static inline void set_obj_status(struct page *page, int idx, int val) {}
+
+#endif
+
/*
* Do not go above this order unless 0 objects fit into the slab or
* overridden on the command line.
@@ -576,12 +609,30 @@ static inline struct array_cache *cpu_ca
return cachep->array[smp_processor_id()];
}
+static size_t calculate_freelist_size(int nr_objs, size_t align)
+{
+ size_t freelist_size;
+
+ freelist_size = nr_objs * sizeof(freelist_idx_t);
+ if (IS_ENABLED(CONFIG_DEBUG_SLAB_LEAK))
+ freelist_size += nr_objs * sizeof(char);
+
+ if (align)
+ freelist_size = ALIGN(freelist_size, align);
+
+ return freelist_size;
+}
+
static int calculate_nr_objs(size_t slab_size, size_t buffer_size,
size_t idx_size, size_t align)
{
int nr_objs;
+ size_t remained_size;
size_t freelist_size;
+ int extra_space = 0;
+ if (IS_ENABLED(CONFIG_DEBUG_SLAB_LEAK))
+ extra_space = sizeof(char);
/*
* Ignore padding for the initial guess. The padding
* is at most @align-1 bytes, and @buffer_size is at
@@ -590,14 +641,15 @@ static int calculate_nr_objs(size_t slab
* into the memory allocation when taking the padding
* into account.
*/
- nr_objs = slab_size / (buffer_size + idx_size);
+ nr_objs = slab_size / (buffer_size + idx_size + extra_space);
/*
* This calculated number will be either the right
* amount, or one greater than what we want.
*/
- freelist_size = slab_size - nr_objs * buffer_size;
- if (freelist_size < ALIGN(nr_objs * idx_size, align))
+ remained_size = slab_size - nr_objs * buffer_size;
+ freelist_size = calculate_freelist_size(nr_objs, align);
+ if (remained_size < freelist_size)
nr_objs--;
return nr_objs;
@@ -635,7 +687,7 @@ static void cache_estimate(unsigned long
} else {
nr_objs = calculate_nr_objs(slab_size, buffer_size,
sizeof(freelist_idx_t), align);
- mgmt_size = ALIGN(nr_objs * sizeof(freelist_idx_t), align);
+ mgmt_size = calculate_freelist_size(nr_objs, align);
}
*num = nr_objs;
*left_over = slab_size - nr_objs*buffer_size - mgmt_size;
@@ -2032,13 +2084,16 @@ static size_t calculate_slab_order(struc
break;
if (flags & CFLGS_OFF_SLAB) {
+ size_t freelist_size_per_obj = sizeof(freelist_idx_t);
/*
* Max number of objs-per-slab for caches which
* use off-slab slabs. Needed to avoid a possible
* looping condition in cache_grow().
*/
+ if (IS_ENABLED(CONFIG_DEBUG_SLAB_LEAK))
+ freelist_size_per_obj += sizeof(char);
offslab_limit = size;
- offslab_limit /= sizeof(freelist_idx_t);
+ offslab_limit /= freelist_size_per_obj;
if (num > offslab_limit)
break;
@@ -2285,8 +2340,7 @@ __kmem_cache_create (struct kmem_cache *
if (!cachep->num)
return -E2BIG;
- freelist_size =
- ALIGN(cachep->num * sizeof(freelist_idx_t), cachep->align);
+ freelist_size = calculate_freelist_size(cachep->num, cachep->align);
/*
* If the slab has been placed off-slab, and we have enough space then
@@ -2299,7 +2353,7 @@ __kmem_cache_create (struct kmem_cache *
if (flags & CFLGS_OFF_SLAB) {
/* really off slab. No need for manual alignment */
- freelist_size = cachep->num * sizeof(freelist_idx_t);
+ freelist_size = calculate_freelist_size(cachep->num, 0);
#ifdef CONFIG_PAGE_POISONING
/* If we're going to use the generic kernel_map_pages()
@@ -2625,6 +2679,7 @@ static void cache_init_objs(struct kmem_
if (cachep->ctor)
cachep->ctor(objp);
#endif
+ set_obj_status(page, i, OBJECT_FREE);
set_free_obj(page, i, i);
}
}
@@ -2833,6 +2888,7 @@ static void *cache_free_debugcheck(struc
BUG_ON(objnr >= cachep->num);
BUG_ON(objp != index_to_obj(cachep, page, objnr));
+ set_obj_status(page, objnr, OBJECT_FREE);
if (cachep->flags & SLAB_POISON) {
#ifdef CONFIG_DEBUG_PAGEALLOC
if ((cachep->size % PAGE_SIZE)==0 && OFF_SLAB(cachep)) {
@@ -2966,6 +3022,8 @@ static inline void cache_alloc_debugchec
static void *cache_alloc_debugcheck_after(struct kmem_cache *cachep,
gfp_t flags, void *objp, unsigned long caller)
{
+ struct page *page;
+
if (!objp)
return objp;
if (cachep->flags & SLAB_POISON) {
@@ -2996,6 +3054,9 @@ static void *cache_alloc_debugcheck_afte
*dbg_redzone1(cachep, objp) = RED_ACTIVE;
*dbg_redzone2(cachep, objp) = RED_ACTIVE;
}
+
+ page = virt_to_head_page(objp);
+ set_obj_status(page, obj_to_index(cachep, page, objp), OBJECT_ACTIVE);
objp += obj_offset(cachep);
if (cachep->ctor && cachep->flags & SLAB_POISON)
cachep->ctor(objp);
@@ -4232,21 +4293,12 @@ static void handle_slab(unsigned long *n
struct page *page)
{
void *p;
- int i, j;
+ int i;
if (n[0] == n[1])
return;
for (i = 0, p = page->s_mem; i < c->num; i++, p += c->size) {
- bool active = true;
-
- for (j = page->active; j < c->num; j++) {
- /* Skip freed item */
- if (get_free_obj(page, j) == i) {
- active = false;
- break;
- }
- }
- if (!active)
+ if (get_obj_status(page, i) != OBJECT_ACTIVE)
continue;
if (!add_caller(n, (unsigned long)*dbg_userword(c, p)))
^ permalink raw reply [flat|nested] 69+ messages in thread* Re: [PATCH 3.15 00/61] 3.15.2-stable review
2014-06-24 15:50 [PATCH 3.15 00/61] 3.15.2-stable review Greg Kroah-Hartman
` (56 preceding siblings ...)
2014-06-24 15:51 ` [PATCH 3.15 61/61] slab: fix oops when reading /proc/slab_allocators Greg Kroah-Hartman
@ 2014-06-24 19:50 ` Shuah Khan
2014-06-24 19:58 ` Greg Kroah-Hartman
2014-06-25 9:00 ` Satoru Takeuchi
2014-06-24 23:31 ` Guenter Roeck
2014-06-25 14:20 ` Benjamin LaHaise
59 siblings, 2 replies; 69+ messages in thread
From: Shuah Khan @ 2014-06-24 19:50 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel
Cc: torvalds, akpm, linux, satoru.takeuchi, stable, Shuah Khan
On 06/24/2014 09:50 AM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 3.15.2 release.
> There are 61 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu Jun 26 15:49:36 UTC 2014.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> kernel.org/pub/linux/kernel/v3.0/stable-review/patch-3.15.2-rc1.gz
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
Compiled and booted on my test system. No dmesg regressions.
-- Shuah
--
Shuah Khan
Senior Linux Kernel Developer - Open Source Group
Samsung Research America(Silicon Valley)
shuah.kh@samsung.com | (970) 672-0658
^ permalink raw reply [flat|nested] 69+ messages in thread* Re: [PATCH 3.15 00/61] 3.15.2-stable review
2014-06-24 19:50 ` [PATCH 3.15 00/61] 3.15.2-stable review Shuah Khan
@ 2014-06-24 19:58 ` Greg Kroah-Hartman
2014-06-25 9:00 ` Satoru Takeuchi
1 sibling, 0 replies; 69+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-24 19:58 UTC (permalink / raw)
To: Shuah Khan; +Cc: linux-kernel, torvalds, akpm, linux, satoru.takeuchi, stable
On Tue, Jun 24, 2014 at 01:50:54PM -0600, Shuah Khan wrote:
> On 06/24/2014 09:50 AM, Greg Kroah-Hartman wrote:
> >This is the start of the stable review cycle for the 3.15.2 release.
> >There are 61 patches in this series, all will be posted as a response
> >to this one. If anyone has any issues with these being applied, please
> >let me know.
> >
> >Responses should be made by Thu Jun 26 15:49:36 UTC 2014.
> >Anything received after that time might be too late.
> >
> >The whole patch series can be found in one patch at:
> > kernel.org/pub/linux/kernel/v3.0/stable-review/patch-3.15.2-rc1.gz
> >and the diffstat can be found below.
> >
> >thanks,
> >
> >greg k-h
> >
>
> Compiled and booted on my test system. No dmesg regressions.
Thanks for testing all 4 of these and letting me know.
greg k-h
^ permalink raw reply [flat|nested] 69+ messages in thread
* Re: [PATCH 3.15 00/61] 3.15.2-stable review
2014-06-24 19:50 ` [PATCH 3.15 00/61] 3.15.2-stable review Shuah Khan
2014-06-24 19:58 ` Greg Kroah-Hartman
@ 2014-06-25 9:00 ` Satoru Takeuchi
2014-06-26 19:09 ` Greg Kroah-Hartman
1 sibling, 1 reply; 69+ messages in thread
From: Satoru Takeuchi @ 2014-06-25 9:00 UTC (permalink / raw)
To: shuah.kh
Cc: Greg Kroah-Hartman, linux-kernel, torvalds, akpm, linux,
satoru.takeuchi, stable
At Tue, 24 Jun 2014 13:50:54 -0600,
Shuah Khan wrote:
>
> On 06/24/2014 09:50 AM, Greg Kroah-Hartman wrote:
> > This is the start of the stable review cycle for the 3.15.2 release.
> > There are 61 patches in this series, all will be posted as a response
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
> >
> > Responses should be made by Thu Jun 26 15:49:36 UTC 2014.
> > Anything received after that time might be too late.
> >
> > The whole patch series can be found in one patch at:
> > kernel.org/pub/linux/kernel/v3.0/stable-review/patch-3.15.2-rc1.gz
> > and the diffstat can be found below.
> >
> > thanks,
> >
> > greg k-h
> >
>
> Compiled and booted on my test system. No dmesg regressions.
All 3.15.2-rc1, 3.14.9-rc1, 3.10.45-rc1, and 3.4.95-rc1 passed my test.
- Test Cases:
- Build this kernel.
- Boot this kernel.
- Build the latest mainline kernel with this kernel.
- Test Tool:
https://github.com/satoru-takeuchi/test-linux-stable
- Test Result (kernel .config, ktest config and test log):
http://satoru-takeuchi.org/test-linux-stable/results/<version>-<test datetime>.tar.xz
- Build Environment:
- OS: Debian Jessy x86_64
- CPU: Intel(R) Core(TM) i5-2400 CPU @ 3.10GHz x 4
- memory: 8GB
- Test Target Environment:
- Debian Jessy x86_64 (KVM guest on the Build Environment)
- # of vCPU: 2
- memory: 2GB
Satoru
>
> -- Shuah
>
> --
> Shuah Khan
> Senior Linux Kernel Developer - Open Source Group
> Samsung Research America(Silicon Valley)
> shuah.kh@samsung.com | (970) 672-0658
^ permalink raw reply [flat|nested] 69+ messages in thread
* Re: [PATCH 3.15 00/61] 3.15.2-stable review
2014-06-25 9:00 ` Satoru Takeuchi
@ 2014-06-26 19:09 ` Greg Kroah-Hartman
0 siblings, 0 replies; 69+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-26 19:09 UTC (permalink / raw)
To: Satoru Takeuchi; +Cc: shuah.kh, linux-kernel, torvalds, akpm, linux, stable
On Wed, Jun 25, 2014 at 06:00:54PM +0900, Satoru Takeuchi wrote:
> At Tue, 24 Jun 2014 13:50:54 -0600,
> Shuah Khan wrote:
> >
> > On 06/24/2014 09:50 AM, Greg Kroah-Hartman wrote:
> > > This is the start of the stable review cycle for the 3.15.2 release.
> > > There are 61 patches in this series, all will be posted as a response
> > > to this one. If anyone has any issues with these being applied, please
> > > let me know.
> > >
> > > Responses should be made by Thu Jun 26 15:49:36 UTC 2014.
> > > Anything received after that time might be too late.
> > >
> > > The whole patch series can be found in one patch at:
> > > kernel.org/pub/linux/kernel/v3.0/stable-review/patch-3.15.2-rc1.gz
> > > and the diffstat can be found below.
> > >
> > > thanks,
> > >
> > > greg k-h
> > >
> >
> > Compiled and booted on my test system. No dmesg regressions.
>
> All 3.15.2-rc1, 3.14.9-rc1, 3.10.45-rc1, and 3.4.95-rc1 passed my test.
>
> - Test Cases:
> - Build this kernel.
> - Boot this kernel.
> - Build the latest mainline kernel with this kernel.
>
> - Test Tool:
> https://github.com/satoru-takeuchi/test-linux-stable
>
> - Test Result (kernel .config, ktest config and test log):
> http://satoru-takeuchi.org/test-linux-stable/results/<version>-<test datetime>.tar.xz
>
> - Build Environment:
> - OS: Debian Jessy x86_64
> - CPU: Intel(R) Core(TM) i5-2400 CPU @ 3.10GHz x 4
> - memory: 8GB
>
> - Test Target Environment:
> - Debian Jessy x86_64 (KVM guest on the Build Environment)
> - # of vCPU: 2
> - memory: 2GB
Thanks for testing all of these and letting me know.
greg k-h
^ permalink raw reply [flat|nested] 69+ messages in thread
* Re: [PATCH 3.15 00/61] 3.15.2-stable review
2014-06-24 15:50 [PATCH 3.15 00/61] 3.15.2-stable review Greg Kroah-Hartman
` (57 preceding siblings ...)
2014-06-24 19:50 ` [PATCH 3.15 00/61] 3.15.2-stable review Shuah Khan
@ 2014-06-24 23:31 ` Guenter Roeck
2014-06-26 19:09 ` Greg Kroah-Hartman
2014-06-25 14:20 ` Benjamin LaHaise
59 siblings, 1 reply; 69+ messages in thread
From: Guenter Roeck @ 2014-06-24 23:31 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel
Cc: torvalds, akpm, satoru.takeuchi, shuah.kh, stable
On 06/24/2014 08:50 AM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 3.15.2 release.
> There are 61 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu Jun 26 15:49:36 UTC 2014.
> Anything received after that time might be too late.
>
Build results:
total: 144 pass: 136 skipped: 5 fail: 3
Failed builds:
powerpc:allmodconfig (binutils 2.23)
powerpc:allmodconfig (binutils 2.24)
unicore32:defconfig
Qemu tests all passed.
Results are as expected. Again, unicore32:defconfig would be an easy fix if so desired.
Details are available at http://server.roeck-us.net:8010/builders.
Guenter
^ permalink raw reply [flat|nested] 69+ messages in thread* Re: [PATCH 3.15 00/61] 3.15.2-stable review
2014-06-24 23:31 ` Guenter Roeck
@ 2014-06-26 19:09 ` Greg Kroah-Hartman
2014-06-26 20:34 ` Guenter Roeck
0 siblings, 1 reply; 69+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-26 19:09 UTC (permalink / raw)
To: Guenter Roeck
Cc: linux-kernel, torvalds, akpm, satoru.takeuchi, shuah.kh, stable
On Tue, Jun 24, 2014 at 04:31:00PM -0700, Guenter Roeck wrote:
> On 06/24/2014 08:50 AM, Greg Kroah-Hartman wrote:
> >This is the start of the stable review cycle for the 3.15.2 release.
> >There are 61 patches in this series, all will be posted as a response
> >to this one. If anyone has any issues with these being applied, please
> >let me know.
> >
> >Responses should be made by Thu Jun 26 15:49:36 UTC 2014.
> >Anything received after that time might be too late.
> >
>
> Build results:
> total: 144 pass: 136 skipped: 5 fail: 3
> Failed builds:
> powerpc:allmodconfig (binutils 2.23)
> powerpc:allmodconfig (binutils 2.24)
> unicore32:defconfig
>
> Qemu tests all passed.
>
> Results are as expected. Again, unicore32:defconfig would be an easy fix if so desired.
Thanks for testing all of these.
As the maintainer of the architecture doesn't seem to care about
unicore32, I don't see the need to spend any time / effort on it either
:(
thanks,
greg k-h
^ permalink raw reply [flat|nested] 69+ messages in thread
* Re: [PATCH 3.15 00/61] 3.15.2-stable review
2014-06-26 19:09 ` Greg Kroah-Hartman
@ 2014-06-26 20:34 ` Guenter Roeck
0 siblings, 0 replies; 69+ messages in thread
From: Guenter Roeck @ 2014-06-26 20:34 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, torvalds, akpm, satoru.takeuchi, shuah.kh, stable
On Thu, Jun 26, 2014 at 03:09:13PM -0400, Greg Kroah-Hartman wrote:
> On Tue, Jun 24, 2014 at 04:31:00PM -0700, Guenter Roeck wrote:
> > On 06/24/2014 08:50 AM, Greg Kroah-Hartman wrote:
> > >This is the start of the stable review cycle for the 3.15.2 release.
> > >There are 61 patches in this series, all will be posted as a response
> > >to this one. If anyone has any issues with these being applied, please
> > >let me know.
> > >
> > >Responses should be made by Thu Jun 26 15:49:36 UTC 2014.
> > >Anything received after that time might be too late.
> > >
> >
> > Build results:
> > total: 144 pass: 136 skipped: 5 fail: 3
> > Failed builds:
> > powerpc:allmodconfig (binutils 2.23)
> > powerpc:allmodconfig (binutils 2.24)
> > unicore32:defconfig
> >
> > Qemu tests all passed.
> >
> > Results are as expected. Again, unicore32:defconfig would be an easy fix if so desired.
>
> Thanks for testing all of these.
>
> As the maintainer of the architecture doesn't seem to care about
> unicore32, I don't see the need to spend any time / effort on it either
> :(
>
Well, at least it's building in mainline now. Of course, in a sense
you are right, it wasn't the maintainer providing the fixes.
Guenter
^ permalink raw reply [flat|nested] 69+ messages in thread
* Re: [PATCH 3.15 00/61] 3.15.2-stable review
2014-06-24 15:50 [PATCH 3.15 00/61] 3.15.2-stable review Greg Kroah-Hartman
` (58 preceding siblings ...)
2014-06-24 23:31 ` Guenter Roeck
@ 2014-06-25 14:20 ` Benjamin LaHaise
2014-06-25 14:27 ` Josh Boyer
2014-06-26 19:09 ` Greg Kroah-Hartman
59 siblings, 2 replies; 69+ messages in thread
From: Benjamin LaHaise @ 2014-06-25 14:20 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, torvalds, akpm, linux, satoru.takeuchi, shuah.kh, stable
Hi Greg,
On Tue, Jun 24, 2014 at 11:50:43AM -0400, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 3.15.2 release.
> There are 61 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
You'll probably want to include the fixes for CVE-2014-0206 -- these are
edfbbf388f293d70bf4b7c0bc38774d05e6f711a and
f8567a3845ac05bb28f3c1b478ef752762bd39ef .
-ben
> Responses should be made by Thu Jun 26 15:49:36 UTC 2014.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> kernel.org/pub/linux/kernel/v3.0/stable-review/patch-3.15.2-rc1.gz
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
> -------------
> Pseudo-Shortlog of commits:
>
> Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Linux 3.15.2-rc1
>
> Joonsoo Kim <iamjoonsoo.kim@lge.com>
> slab: fix oops when reading /proc/slab_allocators
>
> Hugh Dickins <hughd@google.com>
> tmpfs: ZERO_RANGE and COLLAPSE_RANGE not currently supported
>
> Lars-Peter Clausen <lars@metafoo.de>
> ALSA: control: Make sure that id->index does not overflow
>
> Lars-Peter Clausen <lars@metafoo.de>
> ALSA: control: Handle numid overflow
>
> Lars-Peter Clausen <lars@metafoo.de>
> ALSA: control: Don't access controls outside of protected regions
>
> Lars-Peter Clausen <lars@metafoo.de>
> ALSA: control: Fix replacing user controls
>
> Lars-Peter Clausen <lars@metafoo.de>
> ALSA: control: Protect user controls against concurrent access
>
> David Henningsson <david.henningsson@canonical.com>
> ALSA: hda - Add quirk for external mic on Lifebook U904
>
> Mengdong Lin <mengdong.lin@intel.com>
> ALSA: hda - verify pin:converter connection on unsol event for HSW and VLV
>
> Kailang Yang <kailang@realtek.com>
> ALSA: hda/realtek - Add more entry for enable HP mute led
>
> Kailang Yang <kailang@realtek.com>
> ALSA: hda/realtek - Add support of ALC891 codec
>
> Wang, Xiaoming <xiaoming.wang@intel.com>
> ALSA: compress: Cancel the optimization of compiler and fix the size of struct for all platform.
>
> Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> lz4: ensure length does not wrap
>
> Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> lzo: properly check for overruns
>
> Peter Meerwald <pmeerw@pmeerw.net>
> iio: Fix two mpl3115 issues in measurement conversion
>
> Peter Meerwald <pmeerw@pmeerw.net>
> iio: Fix endianness issue in ak8975_read_axis()
>
> Dan Carpenter <dan.carpenter@oracle.com>
> iio: adc: at91: signedness bug in at91_adc_get_trigger_value_by_name()
>
> Robert Hodaszi <robert.hodaszi@digi.com>
> iio: mxs-lradc: fix divider
>
> Dan Carpenter <dan.carpenter@oracle.com>
> iio: adc: checking for NULL instead of IS_ERR() in probe
>
> Mario Schuknecht <mario.schuknecht@dresearch-fe.de>
> staging: iio: tsl2x7x_core: fix proximity treshold
>
> Jonathan Cameron <jic23@kernel.org>
> iio:adc:max1363 incorrect resolutions for max11604, max11605, max11610 and max11611.
>
> Peter Ujfalusi <peter.ujfalusi@ti.com>
> ASoC: tlv320aci3x: Fix custom snd_soc_dapm_put_volsw_aic3x() function
>
> Liam Girdwood <liam.r.girdwood@linux.intel.com>
> ASoC: max98090: Fix reset at resume time
>
> Lars-Peter Clausen <lars@metafoo.de>
> ASoC: dapm: Make sure to always update the DAPM graph in _put_volsw()
>
> Radim Krčmář <rkrcmar@redhat.com>
> hv: use correct order when freeing monitor_pages
>
> K. Y. Srinivasan <kys@microsoft.com>
> Drivers: hv: balloon: Ensure pressure reports are posted regularly
>
> Johan Hovold <jhovold@gmail.com>
> USB: cdc-acm: fix runtime PM imbalance at shutdown
>
> Johan Hovold <jhovold@gmail.com>
> USB: cdc-acm: fix I/O after failed open
>
> Johan Hovold <jhovold@gmail.com>
> USB: cdc-acm: fix failed open not being detected
>
> Johan Hovold <jhovold@gmail.com>
> USB: cdc-acm: fix open and suspend race
>
> Johan Hovold <jhovold@gmail.com>
> USB: cdc-acm: fix potential urb leak and PM imbalance in write
>
> Johan Hovold <jhovold@gmail.com>
> USB: cdc-acm: fix shutdown and suspend race
>
> Johan Hovold <jhovold@gmail.com>
> USB: cdc-acm: fix runtime PM for control messages
>
> Johan Hovold <jhovold@gmail.com>
> USB: cdc-acm: fix broken runtime suspend
>
> Johan Hovold <jhovold@gmail.com>
> USB: cdc-acm: fix write and resume race
>
> Johan Hovold <jhovold@gmail.com>
> USB: cdc-acm: fix write and suspend race
>
> James Hogan <james.hogan@imgtec.com>
> MIPS: KVM: Allocate at least 16KB for exception handlers
>
> Christian Borntraeger <borntraeger@de.ibm.com>
> KVM: s390: Drop pending interrupts on guest exit
>
> Paolo Bonzini <pbonzini@redhat.com>
> KVM: lapic: sync highest ISR to hardware apic on EOI
>
> Boris BREZILLON <boris.brezillon@free-electrons.com>
> ARM: at91: fix at91_sysirq_mask_rtc for sam9x5 SoCs
>
> Eric Dumazet <edumazet@google.com>
> udp: ipv4: do not waste time in __udp4_lib_mcast_demux_lookup
>
> Cong Wang <cwang@twopensource.com>
> vxlan: use dev->needed_headroom instead of dev->hard_header_len
>
> Michal Schmidt <mschmidt@redhat.com>
> rtnetlink: fix userspace API breakage for iproute2 < v3.9.0
>
> Xufeng Zhang <xufeng.zhang@windriver.com>
> sctp: Fix sk_ack_backlog wrap-around problem
>
> Eric Dumazet <edumazet@google.com>
> ipv4: fix a race in ip4_datagram_release_cb()
>
> Jon Cooper <jcooper@solarflare.com>
> sfc: PIO:Restrict to 64bit arch and use 64-bit writes.
>
> Dmitry Popov <ixaphire@qrator.net>
> ipip, sit: fix ipv4_{update_pmtu,redirect} calls
>
> Eric Dumazet <edumazet@google.com>
> net: force a list_del() in unregister_netdevice_many()
>
> Bjørn Mork <bjorn@mork.no>
> net: qmi_wwan: add Olivetti Olicard modems
>
> Alexei Starovoitov <ast@plumgrid.com>
> net: filter: fix sparc32 typo
>
> Alexei Starovoitov <ast@plumgrid.com>
> net: filter: fix typo in sparc BPF JIT
>
> Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
> sh_eth: fix SH7619/771x support
>
> Ben Dooks <ben.dooks@codethink.co.uk>
> sh_eth: use RNC mode for packet reception
>
> Tom Gundersen <teg@jklm.no>
> net: tunnels - enable module autoloading
>
> Sven Wegener <sven.wegener@stealer.net>
> ipv6: Fix regression caused by efe4208 in udp_v6_mcast_next()
>
> Mimi Zohar <zohar@linux.vnet.ibm.com>
> evm: prohibit userspace writing 'security.evm' HMAC value
>
> Dmitry Kasatkin <d.kasatkin@samsung.com>
> ima: introduce ima_kernel_read()
>
> Mimi Zohar <zohar@linux.vnet.ibm.com>
> ima: audit log files opened with O_DIRECT flag
>
> Nicholas Bellinger <nab@linux-iscsi.org>
> iscsi-target: Reject mutual authentication with reflected CHAP_C
>
> Nicholas Bellinger <nab@linux-iscsi.org>
> target: Fix NULL pointer dereference for XCOPY in target_put_sess_cmd
>
> Boris BREZILLON <boris.brezillon@free-electrons.com>
> rtc: rtc-at91rm9200: fix infinite wait for ACKUPD irq
>
>
> -------------
>
> Diffstat:
>
> Documentation/ABI/testing/ima_policy | 2 +-
> Makefile | 4 +-
> arch/arm/mach-at91/sysirq_mask.c | 22 +++---
> arch/mips/kvm/kvm_mips.c | 2 +-
> arch/s390/kvm/interrupt.c | 4 +-
> arch/s390/kvm/kvm-s390.c | 2 +
> arch/s390/kvm/kvm-s390.h | 1 +
> arch/sparc/net/bpf_jit_comp.c | 8 +-
> arch/x86/kvm/lapic.c | 62 ++++++++++-----
> drivers/hv/connection.c | 4 +-
> drivers/hv/hv_balloon.c | 29 ++++++-
> drivers/iio/adc/at91_adc.c | 16 ++--
> drivers/iio/adc/max1363.c | 16 ++--
> drivers/iio/adc/men_z188_adc.c | 4 +-
> drivers/iio/magnetometer/ak8975.c | 9 +--
> drivers/iio/pressure/mpl3115.c | 6 +-
> drivers/net/ethernet/renesas/sh_eth.c | 32 +++++---
> drivers/net/ethernet/renesas/sh_eth.h | 2 -
> drivers/net/ethernet/sfc/io.h | 7 ++
> drivers/net/ethernet/sfc/tx.c | 22 ++++--
> drivers/net/macvlan.c | 1 -
> drivers/net/usb/qmi_wwan.c | 7 +-
> drivers/net/vxlan.c | 7 +-
> drivers/rtc/rtc-at91rm9200.c | 16 +++-
> drivers/staging/iio/adc/mxs-lradc.c | 12 ++-
> drivers/staging/iio/light/tsl2x7x_core.c | 8 +-
> drivers/target/iscsi/iscsi_target_auth.c | 10 +++
> drivers/target/target_core_transport.c | 4 +
> drivers/usb/class/cdc-acm.c | 125 ++++++++++++++++++-------------
> drivers/usb/class/cdc-acm.h | 2 +-
> include/sound/core.h | 2 +
> include/uapi/sound/compress_offload.h | 2 +-
> lib/lz4/lz4_decompress.c | 2 +
> lib/lzo/lzo1x_decompress_safe.c | 62 +++++++++------
> mm/shmem.c | 3 +
> mm/slab.c | 90 +++++++++++++++++-----
> net/core/dev.c | 5 +-
> net/core/rtnetlink.c | 23 ++++--
> net/ipv4/datagram.c | 20 +++--
> net/ipv4/ipip.c | 5 +-
> net/ipv4/udp.c | 4 +
> net/ipv6/ip6_tunnel.c | 1 +
> net/ipv6/sit.c | 5 +-
> net/ipv6/udp.c | 8 +-
> net/mac80211/iface.c | 1 -
> net/sctp/associola.c | 2 +-
> security/integrity/evm/evm_main.c | 12 ++-
> security/integrity/ima/ima_api.c | 10 ++-
> security/integrity/ima/ima_crypto.c | 32 +++++++-
> security/integrity/ima/ima_main.c | 5 +-
> security/integrity/ima/ima_policy.c | 6 +-
> security/integrity/integrity.h | 1 +
> sound/core/control.c | 78 ++++++++++++-------
> sound/core/init.c | 1 +
> sound/pci/hda/patch_hdmi.c | 10 ++-
> sound/pci/hda/patch_realtek.c | 24 ++++++
> sound/soc/codecs/max98090.c | 3 +
> sound/soc/codecs/tlv320aic3x.c | 2 +-
> sound/soc/soc-dapm.c | 23 +++---
> 59 files changed, 625 insertions(+), 263 deletions(-)
>
>
> --
> To unsubscribe from this list: send the line "unsubscribe stable" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
--
"Thought is the essence of where you are now."
^ permalink raw reply [flat|nested] 69+ messages in thread* Re: [PATCH 3.15 00/61] 3.15.2-stable review
2014-06-25 14:20 ` Benjamin LaHaise
@ 2014-06-25 14:27 ` Josh Boyer
2014-06-26 19:09 ` Greg Kroah-Hartman
1 sibling, 0 replies; 69+ messages in thread
From: Josh Boyer @ 2014-06-25 14:27 UTC (permalink / raw)
To: Benjamin LaHaise
Cc: Greg Kroah-Hartman, Linux-Kernel@Vger. Kernel. Org,
Linus Torvalds, Andrew Morton, Guenter Roeck, satoru.takeuchi,
shuah.kh, stable, security
On Wed, Jun 25, 2014 at 10:20 AM, Benjamin LaHaise <bcrl@kvack.org> wrote:
> Hi Greg,
>
> On Tue, Jun 24, 2014 at 11:50:43AM -0400, Greg Kroah-Hartman wrote:
>> This is the start of the stable review cycle for the 3.15.2 release.
>> There are 61 patches in this series, all will be posted as a response
>> to this one. If anyone has any issues with these being applied, please
>> let me know.
>
> You'll probably want to include the fixes for CVE-2014-0206 -- these are
> edfbbf388f293d70bf4b7c0bc38774d05e6f711a and
> f8567a3845ac05bb28f3c1b478ef752762bd39ef .
FWIW, they should cherry-pick cleanly on top of 3.15.1 and 3.14.8.
I've not tried anything older yet.
josh
^ permalink raw reply [flat|nested] 69+ messages in thread
* Re: [PATCH 3.15 00/61] 3.15.2-stable review
2014-06-25 14:20 ` Benjamin LaHaise
2014-06-25 14:27 ` Josh Boyer
@ 2014-06-26 19:09 ` Greg Kroah-Hartman
1 sibling, 0 replies; 69+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-26 19:09 UTC (permalink / raw)
To: Benjamin LaHaise
Cc: linux-kernel, torvalds, akpm, linux, satoru.takeuchi, shuah.kh, stable
On Wed, Jun 25, 2014 at 10:20:43AM -0400, Benjamin LaHaise wrote:
> Hi Greg,
>
> On Tue, Jun 24, 2014 at 11:50:43AM -0400, Greg Kroah-Hartman wrote:
> > This is the start of the stable review cycle for the 3.15.2 release.
> > There are 61 patches in this series, all will be posted as a response
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
>
> You'll probably want to include the fixes for CVE-2014-0206 -- these are
> edfbbf388f293d70bf4b7c0bc38774d05e6f711a and
> f8567a3845ac05bb28f3c1b478ef752762bd39ef .
I'll get them in the next release in a few days, thanks.
greg k-h
^ permalink raw reply [flat|nested] 69+ messages in thread