* [PATCH 3.14 01/79] kvm: fix zero length mmio searching
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
@ 2015-10-18 2:04 ` Greg Kroah-Hartman
2015-10-18 2:04 ` [PATCH 3.14 02/79] scsi: fix scsi_error_handler vs. scsi_host_dev_release race Greg Kroah-Hartman
` (77 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:04 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Gleb Natapov, Paolo Bonzini,
Jason Wang, Cornelia Huck
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Wang <jasowang@redhat.com>
commit 8f4216c7d28976f7ec1b2bcbfa0a9f787133c45e upstream.
Currently, if we had a zero length mmio eventfd assigned on
KVM_MMIO_BUS. It will never be found by kvm_io_bus_cmp() since it
always compares the kvm_io_range() with the length that guest
wrote. This will cause e.g for vhost, kick will be trapped by qemu
userspace instead of vhost. Fixing this by using zero length if an
iodevice is zero length.
Cc: Gleb Natapov <gleb@kernel.org>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
virt/kvm/kvm_main.c | 19 +++++++++++++++++--
1 file changed, 17 insertions(+), 2 deletions(-)
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -2797,10 +2797,25 @@ static void kvm_io_bus_destroy(struct kv
static inline int kvm_io_bus_cmp(const struct kvm_io_range *r1,
const struct kvm_io_range *r2)
{
- if (r1->addr < r2->addr)
+ gpa_t addr1 = r1->addr;
+ gpa_t addr2 = r2->addr;
+
+ if (addr1 < addr2)
return -1;
- if (r1->addr + r1->len > r2->addr + r2->len)
+
+ /* If r2->len == 0, match the exact address. If r2->len != 0,
+ * accept any overlapping write. Any order is acceptable for
+ * overlapping ranges, because kvm_io_bus_get_first_dev ensures
+ * we process all of them.
+ */
+ if (r2->len) {
+ addr1 += r1->len;
+ addr2 += r2->len;
+ }
+
+ if (addr1 > addr2)
return 1;
+
return 0;
}
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 02/79] scsi: fix scsi_error_handler vs. scsi_host_dev_release race
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
2015-10-18 2:04 ` [PATCH 3.14 01/79] kvm: fix zero length mmio searching Greg Kroah-Hartman
@ 2015-10-18 2:04 ` Greg Kroah-Hartman
2015-10-18 2:04 ` [PATCH 3.14 03/79] iser-target: remove command with state ISTATE_REMOVE Greg Kroah-Hartman
` (76 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:04 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Michal Hocko, Dan Williams,
Hannes Reinecke, James Bottomley
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Hocko <mhocko@suse.com>
commit 537b604c8b3aa8b96fe35f87dd085816552e294c upstream.
b9d5c6b7ef57 ("[SCSI] cleanup setting task state in
scsi_error_handler()") has introduced a race between scsi_error_handler
and scsi_host_dev_release resulting in the hang when the device goes
away because scsi_error_handler might miss a wake up:
CPU0 CPU1
scsi_error_handler scsi_host_dev_release
kthread_stop()
kthread_should_stop()
test_bit(KTHREAD_SHOULD_STOP)
set_bit(KTHREAD_SHOULD_STOP)
wake_up_process()
wait_for_completion()
set_current_state(TASK_INTERRUPTIBLE)
schedule()
The most straightforward solution seems to be to invert the ordering of
the set_current_state and kthread_should_stop.
The issue has been noticed during reboot test on a 3.0 based kernel but
the current code seems to be affected in the same way.
[jejb: additional comment added]
Reported-and-debugged-by: Mike Mayer <Mike.Meyer@teradata.com>
Signed-off-by: Michal Hocko <mhocko@suse.com>
Reviewed-by: Dan Williams <dan.j.williams@intel.com>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/scsi_error.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
--- a/drivers/scsi/scsi_error.c
+++ b/drivers/scsi/scsi_error.c
@@ -2149,8 +2149,17 @@ int scsi_error_handler(void *data)
* We never actually get interrupted because kthread_run
* disables signal delivery for the created thread.
*/
- while (!kthread_should_stop()) {
+ while (true) {
+ /*
+ * The sequence in kthread_stop() sets the stop flag first
+ * then wakes the process. To avoid missed wakeups, the task
+ * should always be in a non running state before the stop
+ * flag is checked
+ */
set_current_state(TASK_INTERRUPTIBLE);
+ if (kthread_should_stop())
+ break;
+
if ((shost->host_failed == 0 && shost->host_eh_scheduled == 0) ||
shost->host_failed != shost->host_busy) {
SCSI_LOG_ERROR_RECOVERY(1,
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 03/79] iser-target: remove command with state ISTATE_REMOVE
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
2015-10-18 2:04 ` [PATCH 3.14 01/79] kvm: fix zero length mmio searching Greg Kroah-Hartman
2015-10-18 2:04 ` [PATCH 3.14 02/79] scsi: fix scsi_error_handler vs. scsi_host_dev_release race Greg Kroah-Hartman
@ 2015-10-18 2:04 ` Greg Kroah-Hartman
2015-10-18 2:04 ` [PATCH 3.14 04/79] perf tools: Fix copying of /proc/kcore Greg Kroah-Hartman
` (75 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:04 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jenny Derzhavetz, Sagi Grimberg,
Nicholas Bellinger
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jenny Derzhavetz <jennyf@mellanox.com>
commit a4c15cd957cbd728f685645de7a150df5912591a upstream.
As documented in iscsit_sequence_cmd:
/*
* Existing callers for iscsit_sequence_cmd() will silently
* ignore commands with CMDSN_LOWER_THAN_EXP, so force this
* return for CMDSN_MAXCMDSN_OVERRUN as well..
*/
We need to silently finish a command when it's in ISTATE_REMOVE.
This fixes an teardown hang we were seeing where a mis-behaved
initiator (triggered by allocation error injections) sent us a
cmdsn which was lower than expected.
Signed-off-by: Jenny Derzhavetz <jennyf@mellanox.com>
Signed-off-by: Sagi Grimberg <sagig@mellanox.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/ulp/isert/ib_isert.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -2634,9 +2634,16 @@ isert_get_dataout(struct iscsi_conn *con
static int
isert_immediate_queue(struct iscsi_conn *conn, struct iscsi_cmd *cmd, int state)
{
- int ret;
+ struct isert_cmd *isert_cmd = iscsit_priv_cmd(cmd);
+ int ret = 0;
switch (state) {
+ case ISTATE_REMOVE:
+ spin_lock_bh(&conn->cmd_lock);
+ list_del_init(&cmd->i_conn_node);
+ spin_unlock_bh(&conn->cmd_lock);
+ isert_put_cmd(isert_cmd, true);
+ break;
case ISTATE_SEND_NOPIN_WANT_RESPONSE:
ret = isert_put_nopin(cmd, conn, false);
break;
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 04/79] perf tools: Fix copying of /proc/kcore
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (2 preceding siblings ...)
2015-10-18 2:04 ` [PATCH 3.14 03/79] iser-target: remove command with state ISTATE_REMOVE Greg Kroah-Hartman
@ 2015-10-18 2:04 ` Greg Kroah-Hartman
2015-10-18 2:04 ` [PATCH 3.14 05/79] perf hists: Update the column width for the "srcline" sort key Greg Kroah-Hartman
` (74 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:04 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Adrian Hunter, Jiri Olsa,
Arnaldo Carvalho de Melo
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <adrian.hunter@intel.com>
commit b5cabbcbd157a4bf5a92dfc85134999a3b55342d upstream.
A copy of /proc/kcore containing the kernel text can be made to the
buildid cache. e.g.
perf buildid-cache -v -k /proc/kcore
To workaround objdump limitations, a copy is also made when annotating
against /proc/kcore.
The copying process stops working from libelf about v1.62 onwards (the
problem was found with v1.63).
The cause is that a call to gelf_getphdr() in kcore__add_phdr() fails
because additional validation has been added to gelf_getphdr().
The use of gelf_getphdr() is a misguided attempt to get default
initialization of the Gelf_Phdr structure. That should not be
necessary because every member of the Gelf_Phdr structure is
subsequently assigned. So just remove the call to gelf_getphdr().
Similarly, a call to gelf_getehdr() in gelf_kcore__init() can be
removed also.
Committer notes:
Note to stable@kernel.org, from Adrian in the cover letter for this
patchkit:
The "Fix copying of /proc/kcore" problem goes back to v3.13 if you think
it is important enough for stable.
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Link: http://lkml.kernel.org/r/1443089122-19082-3-git-send-email-adrian.hunter@intel.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/perf/util/symbol-elf.c | 33 ++++++++++++---------------------
1 file changed, 12 insertions(+), 21 deletions(-)
--- a/tools/perf/util/symbol-elf.c
+++ b/tools/perf/util/symbol-elf.c
@@ -1100,8 +1100,6 @@ out_close:
static int kcore__init(struct kcore *kcore, char *filename, int elfclass,
bool temp)
{
- GElf_Ehdr *ehdr;
-
kcore->elfclass = elfclass;
if (temp)
@@ -1118,9 +1116,7 @@ static int kcore__init(struct kcore *kco
if (!gelf_newehdr(kcore->elf, elfclass))
goto out_end;
- ehdr = gelf_getehdr(kcore->elf, &kcore->ehdr);
- if (!ehdr)
- goto out_end;
+ memset(&kcore->ehdr, 0, sizeof(GElf_Ehdr));
return 0;
@@ -1177,23 +1173,18 @@ static int kcore__copy_hdr(struct kcore
static int kcore__add_phdr(struct kcore *kcore, int idx, off_t offset,
u64 addr, u64 len)
{
- GElf_Phdr gphdr;
- GElf_Phdr *phdr;
-
- phdr = gelf_getphdr(kcore->elf, idx, &gphdr);
- if (!phdr)
- return -1;
-
- phdr->p_type = PT_LOAD;
- phdr->p_flags = PF_R | PF_W | PF_X;
- phdr->p_offset = offset;
- phdr->p_vaddr = addr;
- phdr->p_paddr = 0;
- phdr->p_filesz = len;
- phdr->p_memsz = len;
- phdr->p_align = page_size;
+ GElf_Phdr phdr = {
+ .p_type = PT_LOAD,
+ .p_flags = PF_R | PF_W | PF_X,
+ .p_offset = offset,
+ .p_vaddr = addr,
+ .p_paddr = 0,
+ .p_filesz = len,
+ .p_memsz = len,
+ .p_align = page_size,
+ };
- if (!gelf_update_phdr(kcore->elf, idx, phdr))
+ if (!gelf_update_phdr(kcore->elf, idx, &phdr))
return -1;
return 0;
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 05/79] perf hists: Update the column width for the "srcline" sort key
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (3 preceding siblings ...)
2015-10-18 2:04 ` [PATCH 3.14 04/79] perf tools: Fix copying of /proc/kcore Greg Kroah-Hartman
@ 2015-10-18 2:04 ` Greg Kroah-Hartman
2015-10-18 2:04 ` [PATCH 3.14 06/79] perf stat: Get correct cpu id for print_aggr Greg Kroah-Hartman
` (73 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:04 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Namhyung Kim, Andi Kleen, Jiri Olsa,
Arnaldo Carvalho de Melo
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
commit e8e6d37e73e6b950c891c780745460b87f4755b6 upstream.
When we introduce a new sort key, we need to update the
hists__calc_col_len() function accordingly, otherwise the width
will be limited to strlen(header).
We can't update it when obtaining a line value for a column (for
instance, in sort__srcline_cmp()), because we reset it all when doing a
resort (see hists__output_recalc_col_len()), so we need to, from what is
in the hist_entry fields, set each of the column widths.
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Andi Kleen <andi@firstfloor.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Fixes: 409a8be61560 ("perf tools: Add sort by src line/number")
Link: http://lkml.kernel.org/n/tip-jgbe0yx8v1gs89cslr93pvz2@git.kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/perf/util/hist.c | 3 +++
1 file changed, 3 insertions(+)
--- a/tools/perf/util/hist.c
+++ b/tools/perf/util/hist.c
@@ -160,6 +160,9 @@ void hists__calc_col_len(struct hists *h
hists__new_col_len(hists, HISTC_LOCAL_WEIGHT, 12);
hists__new_col_len(hists, HISTC_GLOBAL_WEIGHT, 12);
+ if (h->srcline)
+ hists__new_col_len(hists, HISTC_SRCLINE, strlen(h->srcline));
+
if (h->transaction)
hists__new_col_len(hists, HISTC_TRANSACTION,
hist_entry__transaction_len());
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 06/79] perf stat: Get correct cpu id for print_aggr
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (4 preceding siblings ...)
2015-10-18 2:04 ` [PATCH 3.14 05/79] perf hists: Update the column width for the "srcline" sort key Greg Kroah-Hartman
@ 2015-10-18 2:04 ` Greg Kroah-Hartman
2015-10-18 2:04 ` [PATCH 3.14 07/79] perf header: Fixup reading of HEADER_NRCPUS feature Greg Kroah-Hartman
` (72 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:04 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Kan Liang, Jiri Olsa,
Stephane Eranian, Adrian Hunter, Andi Kleen, David Ahern,
Namhyung Kim, Peter Zijlstra, Arnaldo Carvalho de Melo
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kan Liang <kan.liang@intel.com>
commit 601083cffb7cabdcc55b8195d732f0f7028570fa upstream.
print_aggr() fails to print per-core/per-socket statistics after commit
582ec0829b3d ("perf stat: Fix per-socket output bug for uncore events")
if events have differnt cpus. Because in print_aggr(), aggr_get_id needs
index (not cpu id) to find core/pkg id. Also, evsel cpu maps should be
used to get aggregated id.
Here is an example:
Counting events cycles,uncore_imc_0/cas_count_read/. (Uncore event has
cpumask 0,18)
$ perf stat -e cycles,uncore_imc_0/cas_count_read/ -C0,18 --per-core sleep 2
Without this patch, it failes to get CPU 18 result.
Performance counter stats for 'CPU(s) 0,18':
S0-C0 1 7526851 cycles
S0-C0 1 1.05 MiB uncore_imc_0/cas_count_read/
S1-C0 0 <not counted> cycles
S1-C0 0 <not counted> MiB uncore_imc_0/cas_count_read/
With this patch, it can get both CPU0 and CPU18 result.
Performance counter stats for 'CPU(s) 0,18':
S0-C0 1 6327768 cycles
S0-C0 1 0.47 MiB uncore_imc_0/cas_count_read/
S1-C0 1 330228 cycles
S1-C0 1 0.29 MiB uncore_imc_0/cas_count_read/
Signed-off-by: Kan Liang <kan.liang@intel.com>
Acked-by: Jiri Olsa <jolsa@kernel.org>
Acked-by: Stephane Eranian <eranian@google.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: David Ahern <dsahern@gmail.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Fixes: 582ec0829b3d ("perf stat: Fix per-socket output bug for uncore events")
Link: http://lkml.kernel.org/r/1435820925-51091-1-git-send-email-kan.liang@intel.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/perf/builtin-stat.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
--- a/tools/perf/builtin-stat.c
+++ b/tools/perf/builtin-stat.c
@@ -1108,7 +1108,7 @@ static void abs_printout(int cpu, int nr
static void print_aggr(char *prefix)
{
struct perf_evsel *counter;
- int cpu, cpu2, s, s2, id, nr;
+ int cpu, s, s2, id, nr;
double uval;
u64 ena, run, val;
@@ -1121,8 +1121,7 @@ static void print_aggr(char *prefix)
val = ena = run = 0;
nr = 0;
for (cpu = 0; cpu < perf_evsel__nr_cpus(counter); cpu++) {
- cpu2 = perf_evsel__cpus(counter)->map[cpu];
- s2 = aggr_get_id(evsel_list->cpus, cpu2);
+ s2 = aggr_get_id(perf_evsel__cpus(counter), cpu);
if (s2 != id)
continue;
val += counter->counts->cpu[cpu].val;
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 07/79] perf header: Fixup reading of HEADER_NRCPUS feature
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (5 preceding siblings ...)
2015-10-18 2:04 ` [PATCH 3.14 06/79] perf stat: Get correct cpu id for print_aggr Greg Kroah-Hartman
@ 2015-10-18 2:04 ` Greg Kroah-Hartman
2015-10-18 2:05 ` [PATCH 3.14 08/79] hwmon: (nct6775) Swap STEP_UP_TIME and STEP_DOWN_TIME registers for most chips Greg Kroah-Hartman
` (71 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:04 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Namhyung Kim, Adrian Hunter,
Borislav Petkov, David Ahern, Frederic Weisbecker, Jiri Olsa,
Kan Liang, Stephane Eranian, Wang Nan, Arnaldo Carvalho de Melo
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
commit caa470475d9b59eeff093ae650800d34612c4379 upstream.
The original patch introducing this header wrote the number of CPUs available
and online in one order and then swapped those values when reading, fix it.
Before:
# perf record usleep 1
# perf report --header-only | grep 'nrcpus \(online\|avail\)'
# nrcpus online : 4
# nrcpus avail : 4
# echo 0 > /sys/devices/system/cpu/cpu2/online
# perf record usleep 1
# perf report --header-only | grep 'nrcpus \(online\|avail\)'
# nrcpus online : 4
# nrcpus avail : 3
# echo 0 > /sys/devices/system/cpu/cpu1/online
# perf record usleep 1
# perf report --header-only | grep 'nrcpus \(online\|avail\)'
# nrcpus online : 4
# nrcpus avail : 2
After the fix, bringing back the CPUs online:
# perf report --header-only | grep 'nrcpus \(online\|avail\)'
# nrcpus online : 2
# nrcpus avail : 4
# echo 1 > /sys/devices/system/cpu/cpu2/online
# perf record usleep 1
# perf report --header-only | grep 'nrcpus \(online\|avail\)'
# nrcpus online : 3
# nrcpus avail : 4
# echo 1 > /sys/devices/system/cpu/cpu1/online
# perf record usleep 1
# perf report --header-only | grep 'nrcpus \(online\|avail\)'
# nrcpus online : 4
# nrcpus avail : 4
Acked-by: Namhyung Kim <namhyung@kernel.org>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Borislav Petkov <bp@suse.de>
Cc: David Ahern <dsahern@gmail.com>
Cc: Frederic Weisbecker <fweisbec@gmail.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Kan Liang <kan.liang@intel.com>
Cc: Stephane Eranian <eranian@google.com>
Cc: Wang Nan <wangnan0@huawei.com>
Fixes: fbe96f29ce4b ("perf tools: Make perf.data more self-descriptive (v8)")
Link: http://lkml.kernel.org/r/20150911153323.GP23511@kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/perf/util/header.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/tools/perf/util/header.c
+++ b/tools/perf/util/header.c
@@ -1715,7 +1715,7 @@ static int process_nrcpus(struct perf_fi
if (ph->needs_swap)
nr = bswap_32(nr);
- ph->env.nr_cpus_online = nr;
+ ph->env.nr_cpus_avail = nr;
ret = readn(fd, &nr, sizeof(nr));
if (ret != sizeof(nr))
@@ -1724,7 +1724,7 @@ static int process_nrcpus(struct perf_fi
if (ph->needs_swap)
nr = bswap_32(nr);
- ph->env.nr_cpus_avail = nr;
+ ph->env.nr_cpus_online = nr;
return 0;
}
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 08/79] hwmon: (nct6775) Swap STEP_UP_TIME and STEP_DOWN_TIME registers for most chips
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (6 preceding siblings ...)
2015-10-18 2:04 ` [PATCH 3.14 07/79] perf header: Fixup reading of HEADER_NRCPUS feature Greg Kroah-Hartman
@ 2015-10-18 2:05 ` Greg Kroah-Hartman
2015-10-18 2:05 ` [PATCH 3.14 09/79] ARM: fix Thumb2 signal handling when ARMv6 is enabled Greg Kroah-Hartman
` (70 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:05 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Grazvydas Ignotas, Jean Delvare,
Guenter Roeck
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <linux@roeck-us.net>
commit 728d29400488d54974d3317fe8a232b45fdb42ee upstream.
The STEP_UP_TIME and STEP_DOWN_TIME registers are swapped for all chips but
NCT6775.
Reported-by: Grazvydas Ignotas <notasas@gmail.com>
Reviewed-by: Jean Delvare <jdelvare@suse.de>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hwmon/nct6775.c | 16 ++++++++++------
1 file changed, 10 insertions(+), 6 deletions(-)
--- a/drivers/hwmon/nct6775.c
+++ b/drivers/hwmon/nct6775.c
@@ -350,6 +350,10 @@ static const u16 NCT6775_REG_TEMP_CRIT[A
/* NCT6776 specific data */
+/* STEP_UP_TIME and STEP_DOWN_TIME regs are swapped for all chips but NCT6775 */
+#define NCT6776_REG_FAN_STEP_UP_TIME NCT6775_REG_FAN_STEP_DOWN_TIME
+#define NCT6776_REG_FAN_STEP_DOWN_TIME NCT6775_REG_FAN_STEP_UP_TIME
+
static const s8 NCT6776_ALARM_BITS[] = {
0, 1, 2, 3, 8, 21, 20, 16, /* in0.. in7 */
17, -1, -1, -1, -1, -1, -1, /* in8..in14 */
@@ -3476,8 +3480,8 @@ static int nct6775_probe(struct platform
data->REG_FAN_PULSES = NCT6776_REG_FAN_PULSES;
data->FAN_PULSE_SHIFT = NCT6775_FAN_PULSE_SHIFT;
data->REG_FAN_TIME[0] = NCT6775_REG_FAN_STOP_TIME;
- data->REG_FAN_TIME[1] = NCT6775_REG_FAN_STEP_UP_TIME;
- data->REG_FAN_TIME[2] = NCT6775_REG_FAN_STEP_DOWN_TIME;
+ data->REG_FAN_TIME[1] = NCT6776_REG_FAN_STEP_UP_TIME;
+ data->REG_FAN_TIME[2] = NCT6776_REG_FAN_STEP_DOWN_TIME;
data->REG_TOLERANCE_H = NCT6776_REG_TOLERANCE_H;
data->REG_PWM[0] = NCT6775_REG_PWM;
data->REG_PWM[1] = NCT6775_REG_FAN_START_OUTPUT;
@@ -3548,8 +3552,8 @@ static int nct6775_probe(struct platform
data->REG_FAN_PULSES = NCT6779_REG_FAN_PULSES;
data->FAN_PULSE_SHIFT = NCT6775_FAN_PULSE_SHIFT;
data->REG_FAN_TIME[0] = NCT6775_REG_FAN_STOP_TIME;
- data->REG_FAN_TIME[1] = NCT6775_REG_FAN_STEP_UP_TIME;
- data->REG_FAN_TIME[2] = NCT6775_REG_FAN_STEP_DOWN_TIME;
+ data->REG_FAN_TIME[1] = NCT6776_REG_FAN_STEP_UP_TIME;
+ data->REG_FAN_TIME[2] = NCT6776_REG_FAN_STEP_DOWN_TIME;
data->REG_TOLERANCE_H = NCT6776_REG_TOLERANCE_H;
data->REG_PWM[0] = NCT6775_REG_PWM;
data->REG_PWM[1] = NCT6775_REG_FAN_START_OUTPUT;
@@ -3624,8 +3628,8 @@ static int nct6775_probe(struct platform
data->REG_FAN_PULSES = NCT6779_REG_FAN_PULSES;
data->FAN_PULSE_SHIFT = NCT6775_FAN_PULSE_SHIFT;
data->REG_FAN_TIME[0] = NCT6775_REG_FAN_STOP_TIME;
- data->REG_FAN_TIME[1] = NCT6775_REG_FAN_STEP_UP_TIME;
- data->REG_FAN_TIME[2] = NCT6775_REG_FAN_STEP_DOWN_TIME;
+ data->REG_FAN_TIME[1] = NCT6776_REG_FAN_STEP_UP_TIME;
+ data->REG_FAN_TIME[2] = NCT6776_REG_FAN_STEP_DOWN_TIME;
data->REG_TOLERANCE_H = NCT6776_REG_TOLERANCE_H;
data->REG_PWM[0] = NCT6775_REG_PWM;
data->REG_PWM[1] = NCT6775_REG_FAN_START_OUTPUT;
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 09/79] ARM: fix Thumb2 signal handling when ARMv6 is enabled
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (7 preceding siblings ...)
2015-10-18 2:05 ` [PATCH 3.14 08/79] hwmon: (nct6775) Swap STEP_UP_TIME and STEP_DOWN_TIME registers for most chips Greg Kroah-Hartman
@ 2015-10-18 2:05 ` Greg Kroah-Hartman
2015-10-18 2:05 ` [PATCH 3.14 10/79] ARM: 8429/1: disable GCC SRA optimization Greg Kroah-Hartman
` (69 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:05 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tony Lindgren, H. Nikolaus Schaller,
Grazvydas Ignotas, Russell King
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Russell King <rmk+kernel@arm.linux.org.uk>
commit 9b55613f42e8d40d5c9ccb8970bde6af4764b2ab upstream.
When a kernel is built covering ARMv6 to ARMv7, we omit to clear the
IT state when entering a signal handler. This can cause the first
few instructions to be conditionally executed depending on the parent
context.
In any case, the original test for >= ARMv7 is broken - ARMv6 can have
Thumb-2 support as well, and an ARMv6T2 specific build would omit this
code too.
Relax the test back to ARMv6 or greater. This results in us always
clearing the IT state bits in the PSR, even on CPUs where these bits
are reserved. However, they're reserved for the IT state, so this
should cause no harm.
Fixes: d71e1352e240 ("Clear the IT state when invoking a Thumb-2 signal handler")
Acked-by: Tony Lindgren <tony@atomide.com>
Tested-by: H. Nikolaus Schaller <hns@goldelico.com>
Tested-by: Grazvydas Ignotas <notasas@gmail.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/kernel/signal.c | 15 ++++++++++-----
1 file changed, 10 insertions(+), 5 deletions(-)
--- a/arch/arm/kernel/signal.c
+++ b/arch/arm/kernel/signal.c
@@ -353,12 +353,17 @@ setup_return(struct pt_regs *regs, struc
*/
thumb = handler & 1;
-#if __LINUX_ARM_ARCH__ >= 7
+#if __LINUX_ARM_ARCH__ >= 6
/*
- * Clear the If-Then Thumb-2 execution state
- * ARM spec requires this to be all 000s in ARM mode
- * Snapdragon S4/Krait misbehaves on a Thumb=>ARM
- * signal transition without this.
+ * Clear the If-Then Thumb-2 execution state. ARM spec
+ * requires this to be all 000s in ARM mode. Snapdragon
+ * S4/Krait misbehaves on a Thumb=>ARM signal transition
+ * without this.
+ *
+ * We must do this whenever we are running on a Thumb-2
+ * capable CPU, which includes ARMv6T2. However, we elect
+ * to do this whenever we're on an ARMv6 or later CPU for
+ * simplicity.
*/
cpsr &= ~PSR_IT_MASK;
#endif
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 10/79] ARM: 8429/1: disable GCC SRA optimization
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (8 preceding siblings ...)
2015-10-18 2:05 ` [PATCH 3.14 09/79] ARM: fix Thumb2 signal handling when ARMv6 is enabled Greg Kroah-Hartman
@ 2015-10-18 2:05 ` Greg Kroah-Hartman
2015-10-18 2:05 ` [PATCH 3.14 11/79] windfarm: decrement client count when unregistering Greg Kroah-Hartman
` (68 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:05 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Nicolas Pitre, Ard Biesheuvel, Russell King
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
commit a077224fd35b2f7fbc93f14cf67074fc792fbac2 upstream.
While working on the 32-bit ARM port of UEFI, I noticed a strange
corruption in the kernel log. The following snprintf() statement
(in drivers/firmware/efi/efi.c:efi_md_typeattr_format())
snprintf(pos, size, "|%3s|%2s|%2s|%2s|%3s|%2s|%2s|%2s|%2s]",
was producing the following output in the log:
| | | | | |WB|WT|WC|UC]
| | | | | |WB|WT|WC|UC]
| | | | | |WB|WT|WC|UC]
|RUN| | | | |WB|WT|WC|UC]*
|RUN| | | | |WB|WT|WC|UC]*
| | | | | |WB|WT|WC|UC]
|RUN| | | | |WB|WT|WC|UC]*
| | | | | |WB|WT|WC|UC]
|RUN| | | | | | | |UC]
|RUN| | | | | | | |UC]
As it turns out, this is caused by incorrect code being emitted for
the string() function in lib/vsprintf.c. The following code
if (!(spec.flags & LEFT)) {
while (len < spec.field_width--) {
if (buf < end)
*buf = ' ';
++buf;
}
}
for (i = 0; i < len; ++i) {
if (buf < end)
*buf = *s;
++buf; ++s;
}
while (len < spec.field_width--) {
if (buf < end)
*buf = ' ';
++buf;
}
when called with len == 0, triggers an issue in the GCC SRA optimization
pass (Scalar Replacement of Aggregates), which handles promotion of signed
struct members incorrectly. This is a known but as yet unresolved issue.
(https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65932). In this particular
case, it is causing the second while loop to be executed erroneously a
single time, causing the additional space characters to be printed.
So disable the optimization by passing -fno-ipa-sra.
Acked-by: Nicolas Pitre <nico@linaro.org>
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/Makefile | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/arch/arm/Makefile
+++ b/arch/arm/Makefile
@@ -52,6 +52,14 @@ endif
comma = ,
+#
+# The Scalar Replacement of Aggregates (SRA) optimization pass in GCC 4.9 and
+# later may result in code being generated that handles signed short and signed
+# char struct members incorrectly. So disable it.
+# (https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65932)
+#
+KBUILD_CFLAGS += $(call cc-option,-fno-ipa-sra)
+
# This selects which instruction set is used.
# Note that GCC does not numerically define an architecture version
# macro, but instead defines a whole series of macros which makes
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 11/79] windfarm: decrement client count when unregistering
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (9 preceding siblings ...)
2015-10-18 2:05 ` [PATCH 3.14 10/79] ARM: 8429/1: disable GCC SRA optimization Greg Kroah-Hartman
@ 2015-10-18 2:05 ` Greg Kroah-Hartman
2015-10-18 2:05 ` [PATCH 3.14 12/79] ARM: dts: omap5-uevm.dts: fix i2c5 pinctrl offsets Greg Kroah-Hartman
` (67 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:05 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Paul Bolle, Michael Ellerman
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Bolle <pebolle@tiscali.nl>
commit fe2b592173ff0274e70dc44d1d28c19bb995aa7c upstream.
wf_unregister_client() increments the client count when a client
unregisters. That is obviously incorrect. Decrement that client count
instead.
Fixes: 75722d3992f5 ("[PATCH] ppc64: Thermal control for SMU based machines")
Signed-off-by: Paul Bolle <pebolle@tiscali.nl>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/macintosh/windfarm_core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/macintosh/windfarm_core.c
+++ b/drivers/macintosh/windfarm_core.c
@@ -435,7 +435,7 @@ int wf_unregister_client(struct notifier
{
mutex_lock(&wf_lock);
blocking_notifier_chain_unregister(&wf_client_list, nb);
- wf_client_count++;
+ wf_client_count--;
if (wf_client_count == 0)
wf_stop_thread();
mutex_unlock(&wf_lock);
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 12/79] ARM: dts: omap5-uevm.dts: fix i2c5 pinctrl offsets
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (10 preceding siblings ...)
2015-10-18 2:05 ` [PATCH 3.14 11/79] windfarm: decrement client count when unregistering Greg Kroah-Hartman
@ 2015-10-18 2:05 ` Greg Kroah-Hartman
2015-10-18 2:05 ` [PATCH 3.14 13/79] dmaengine: dw: properly read DWC_PARAMS register Greg Kroah-Hartman
` (66 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:05 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Grazvydas Ignotas, Tony Lindgren
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Grazvydas Ignotas <notasas@gmail.com>
commit 1dbdad75074d16c3e3005180f81a01cdc04a7872 upstream.
The i2c5 pinctrl offsets are wrong. If the bootloader doesn't set the
pins up, communication with tca6424a doesn't work (controller timeouts)
and it is not possible to enable HDMI.
Fixes: 9be495c42609 ("ARM: dts: omap5-evm: Add I2c pinctrl data")
Signed-off-by: Grazvydas Ignotas <notasas@gmail.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/boot/dts/omap5-uevm.dts | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/arm/boot/dts/omap5-uevm.dts
+++ b/arch/arm/boot/dts/omap5-uevm.dts
@@ -111,8 +111,8 @@
i2c5_pins: pinmux_i2c5_pins {
pinctrl-single,pins = <
- 0x184 (PIN_INPUT | MUX_MODE0) /* i2c5_scl */
- 0x186 (PIN_INPUT | MUX_MODE0) /* i2c5_sda */
+ 0x186 (PIN_INPUT | MUX_MODE0) /* i2c5_scl */
+ 0x188 (PIN_INPUT | MUX_MODE0) /* i2c5_sda */
>;
};
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 13/79] dmaengine: dw: properly read DWC_PARAMS register
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (11 preceding siblings ...)
2015-10-18 2:05 ` [PATCH 3.14 12/79] ARM: dts: omap5-uevm.dts: fix i2c5 pinctrl offsets Greg Kroah-Hartman
@ 2015-10-18 2:05 ` Greg Kroah-Hartman
2015-10-18 2:05 ` [PATCH 3.14 14/79] x86/apic: Serialize LVTT and TSC_DEADLINE writes Greg Kroah-Hartman
` (65 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:05 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, yitian.bu, Andy Shevchenko, Vinod Koul
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
commit 6bea0f6d1c47b07be88dfd93f013ae05fcb3d8bf upstream.
In case we have less than maximum allowed channels (8) and autoconfiguration is
enabled the DWC_PARAMS read is wrong because it uses different arithmetic to
what is needed for channel priority setup.
Re-do the caclulations properly. This now works on AVR32 board well.
Fixes: fed2574b3c9f (dw_dmac: introduce software emulation of LLP transfers)
Cc: yitian.bu@tangramtek.com
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/dma/dw/core.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/dma/dw/core.c
+++ b/drivers/dma/dw/core.c
@@ -1561,7 +1561,6 @@ int dw_dma_probe(struct dw_dma_chip *chi
INIT_LIST_HEAD(&dw->dma.channels);
for (i = 0; i < nr_channels; i++) {
struct dw_dma_chan *dwc = &dw->chan[i];
- int r = nr_channels - i - 1;
dwc->chan.device = &dw->dma;
dma_cookie_init(&dwc->chan);
@@ -1573,7 +1572,7 @@ int dw_dma_probe(struct dw_dma_chip *chi
/* 7 is highest priority & 0 is lowest. */
if (pdata->chan_priority == CHAN_PRIORITY_ASCENDING)
- dwc->priority = r;
+ dwc->priority = nr_channels - i - 1;
else
dwc->priority = i;
@@ -1593,6 +1592,7 @@ int dw_dma_probe(struct dw_dma_chip *chi
/* Hardware configuration */
if (autocfg) {
unsigned int dwc_params;
+ unsigned int r = DW_DMA_MAX_NR_CHANNELS - i - 1;
void __iomem *addr = chip->regs + r * sizeof(u32);
dwc_params = dma_read_byaddr(addr, DWC_PARAMS);
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 14/79] x86/apic: Serialize LVTT and TSC_DEADLINE writes
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (12 preceding siblings ...)
2015-10-18 2:05 ` [PATCH 3.14 13/79] dmaengine: dw: properly read DWC_PARAMS register Greg Kroah-Hartman
@ 2015-10-18 2:05 ` Greg Kroah-Hartman
2015-10-18 2:05 ` [PATCH 3.14 15/79] x86/platform: Fix Geode LX timekeeping in the generic x86 build Greg Kroah-Hartman
` (64 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:05 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Shaohua Li, Ingo Molnar, Kernel-team,
lenb, fenghua.yu, Andi Kleen, H. Peter Anvin, Thomas Gleixner
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shaohua Li <shli@fb.com>
commit 5d7c631d926b59aa16f3c56eaeb83f1036c81dc7 upstream.
The APIC LVTT register is MMIO mapped but the TSC_DEADLINE register is an
MSR. The write to the TSC_DEADLINE MSR is not serializing, so it's not
guaranteed that the write to LVTT has reached the APIC before the
TSC_DEADLINE MSR is written. In such a case the write to the MSR is
ignored and as a consequence the local timer interrupt never fires.
The SDM decribes this issue for xAPIC and x2APIC modes. The
serialization methods recommended by the SDM differ.
xAPIC:
"1. Memory-mapped write to LVT Timer Register, setting bits 18:17 to 10b.
2. WRMSR to the IA32_TSC_DEADLINE MSR a value much larger than current time-stamp counter.
3. If RDMSR of the IA32_TSC_DEADLINE MSR returns zero, go to step 2.
4. WRMSR to the IA32_TSC_DEADLINE MSR the desired deadline."
x2APIC:
"To allow for efficient access to the APIC registers in x2APIC mode,
the serializing semantics of WRMSR are relaxed when writing to the
APIC registers. Thus, system software should not use 'WRMSR to APIC
registers in x2APIC mode' as a serializing instruction. Read and write
accesses to the APIC registers will occur in program order. A WRMSR to
an APIC register may complete before all preceding stores are globally
visible; software can prevent this by inserting a serializing
instruction, an SFENCE, or an MFENCE before the WRMSR."
The xAPIC method is to just wait for the memory mapped write to hit
the LVTT by checking whether the MSR write has reached the hardware.
There is no reason why a proper MFENCE after the memory mapped write would
not do the same. Andi Kleen confirmed that MFENCE is sufficient for the
xAPIC case as well.
Issue MFENCE before writing to the TSC_DEADLINE MSR. This can be done
unconditionally as all CPUs which have TSC_DEADLINE also have MFENCE
support.
[ tglx: Massaged the changelog ]
Signed-off-by: Shaohua Li <shli@fb.com>
Reviewed-by: Ingo Molnar <mingo@kernel.org>
Cc: <Kernel-team@fb.com>
Cc: <lenb@kernel.org>
Cc: <fenghua.yu@intel.com>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Link: http://lkml.kernel.org/r/20150909041352.GA2059853@devbig257.prn2.facebook.com
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/apic/apic.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/arch/x86/kernel/apic/apic.c
+++ b/arch/x86/kernel/apic/apic.c
@@ -359,6 +359,13 @@ static void __setup_APIC_LVTT(unsigned i
apic_write(APIC_LVTT, lvtt_value);
if (lvtt_value & APIC_LVT_TIMER_TSCDEADLINE) {
+ /*
+ * See Intel SDM: TSC-Deadline Mode chapter. In xAPIC mode,
+ * writing to the APIC LVTT and TSC_DEADLINE MSR isn't serialized.
+ * According to Intel, MFENCE can do the serialization here.
+ */
+ asm volatile("mfence" : : : "memory");
+
printk_once(KERN_DEBUG "TSC deadline timer enabled\n");
return;
}
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 15/79] x86/platform: Fix Geode LX timekeeping in the generic x86 build
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (13 preceding siblings ...)
2015-10-18 2:05 ` [PATCH 3.14 14/79] x86/apic: Serialize LVTT and TSC_DEADLINE writes Greg Kroah-Hartman
@ 2015-10-18 2:05 ` Greg Kroah-Hartman
2015-10-18 2:05 ` [PATCH 3.14 16/79] x86/paravirt: Replace the paravirt nop with a bona fide empty function Greg Kroah-Hartman
` (63 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:05 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, David Woodhouse, Andres Salomon,
Linus Torvalds, Marcelo Tosatti, Peter Zijlstra, Thomas Gleixner,
Ingo Molnar
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Woodhouse <dwmw2@infradead.org>
commit 03da3ff1cfcd7774c8780d2547ba0d995f7dc03d upstream.
In 2007, commit 07190a08eef36 ("Mark TSC on GeodeLX reliable")
bypassed verification of the TSC on Geode LX. However, this code
(now in the check_system_tsc_reliable() function in
arch/x86/kernel/tsc.c) was only present if CONFIG_MGEODE_LX was
set.
OpenWRT has recently started building its generic Geode target
for Geode GX, not LX, to include support for additional
platforms. This broke the timekeeping on LX-based devices,
because the TSC wasn't marked as reliable:
https://dev.openwrt.org/ticket/20531
By adding a runtime check on is_geode_lx(), we can also include
the fix if CONFIG_MGEODEGX1 or CONFIG_X86_GENERIC are set, thus
fixing the problem.
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Cc: Andres Salomon <dilinger@queued.net>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Marcelo Tosatti <marcelo@kvack.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/1442409003.131189.87.camel@infradead.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/tsc.c | 17 ++++++++++-------
1 file changed, 10 insertions(+), 7 deletions(-)
--- a/arch/x86/kernel/tsc.c
+++ b/arch/x86/kernel/tsc.c
@@ -21,6 +21,7 @@
#include <asm/hypervisor.h>
#include <asm/nmi.h>
#include <asm/x86_init.h>
+#include <asm/geode.h>
unsigned int __read_mostly cpu_khz; /* TSC clocks / usec, not used here */
EXPORT_SYMBOL(cpu_khz);
@@ -1011,15 +1012,17 @@ EXPORT_SYMBOL_GPL(mark_tsc_unstable);
static void __init check_system_tsc_reliable(void)
{
-#ifdef CONFIG_MGEODE_LX
- /* RTSC counts during suspend */
+#if defined(CONFIG_MGEODEGX1) || defined(CONFIG_MGEODE_LX) || defined(CONFIG_X86_GENERIC)
+ if (is_geode_lx()) {
+ /* RTSC counts during suspend */
#define RTSC_SUSP 0x100
- unsigned long res_low, res_high;
+ unsigned long res_low, res_high;
- rdmsr_safe(MSR_GEODE_BUSCONT_CONF0, &res_low, &res_high);
- /* Geode_LX - the OLPC CPU has a very reliable TSC */
- if (res_low & RTSC_SUSP)
- tsc_clocksource_reliable = 1;
+ rdmsr_safe(MSR_GEODE_BUSCONT_CONF0, &res_low, &res_high);
+ /* Geode_LX - the OLPC CPU has a very reliable TSC */
+ if (res_low & RTSC_SUSP)
+ tsc_clocksource_reliable = 1;
+ }
#endif
if (boot_cpu_has(X86_FEATURE_TSC_RELIABLE))
tsc_clocksource_reliable = 1;
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 16/79] x86/paravirt: Replace the paravirt nop with a bona fide empty function
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (14 preceding siblings ...)
2015-10-18 2:05 ` [PATCH 3.14 15/79] x86/platform: Fix Geode LX timekeeping in the generic x86 build Greg Kroah-Hartman
@ 2015-10-18 2:05 ` Greg Kroah-Hartman
2015-10-18 2:05 ` [PATCH 3.14 17/79] x86/nmi/64: Fix a paravirt stack-clobbering bug in the NMI code Greg Kroah-Hartman
` (62 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:05 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Andy Lutomirski, Thomas Gleixner
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Lutomirski <luto@kernel.org>
commit fc57a7c68020dcf954428869eafd934c0ab1536f upstream.
PARAVIRT_ADJUST_EXCEPTION_FRAME generates this code (using nmi as an
example, trimmed for readability):
ff 15 00 00 00 00 callq *0x0(%rip) # 2796 <nmi+0x6>
2792: R_X86_64_PC32 pv_irq_ops+0x2c
That's a call through a function pointer to regular C function that
does nothing on native boots, but that function isn't protected
against kprobes, isn't marked notrace, and is certainly not
guaranteed to preserve any registers if the compiler is feeling
perverse. This is bad news for a CLBR_NONE operation.
Of course, if everything works correctly, once paravirt ops are
patched, it gets nopped out, but what if we hit this code before
paravirt ops are patched in? This can potentially cause breakage
that is very difficult to debug.
A more subtle failure is possible here, too: if _paravirt_nop uses
the stack at all (even just to push RBP), it will overwrite the "NMI
executing" variable if it's called in the NMI prologue.
The Xen case, perhaps surprisingly, is fine, because it's already
written in asm.
Fix all of the cases that default to paravirt_nop (including
adjust_exception_frame) with a big hammer: replace paravirt_nop with
an asm function that is just a ret instruction.
The Xen case may have other problems, so document them.
This is part of a fix for some random crashes that Sasha saw.
Reported-and-tested-by: Sasha Levin <sasha.levin@oracle.com>
Signed-off-by: Andy Lutomirski <luto@kernel.org>
Link: http://lkml.kernel.org/r/8f5d2ba295f9d73751c33d97fda03e0495d9ade0.1442791737.git.luto@kernel.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/entry_64.S | 11 +++++++++++
arch/x86/kernel/paravirt.c | 16 ++++++++++++----
2 files changed, 23 insertions(+), 4 deletions(-)
--- a/arch/x86/kernel/entry_64.S
+++ b/arch/x86/kernel/entry_64.S
@@ -1684,7 +1684,18 @@ END(error_exit)
/* runs on exception stack */
ENTRY(nmi)
INTR_FRAME
+ /*
+ * Fix up the exception frame if we're on Xen.
+ * PARAVIRT_ADJUST_EXCEPTION_FRAME is guaranteed to push at most
+ * one value to the stack on native, so it may clobber the rdx
+ * scratch slot, but it won't clobber any of the important
+ * slots past it.
+ *
+ * Xen is a different story, because the Xen frame itself overlaps
+ * the "NMI executing" variable.
+ */
PARAVIRT_ADJUST_EXCEPTION_FRAME
+
/*
* We allow breakpoints in NMIs. If a breakpoint occurs, then
* the iretq it performs will take us out of NMI context.
--- a/arch/x86/kernel/paravirt.c
+++ b/arch/x86/kernel/paravirt.c
@@ -40,10 +40,18 @@
#include <asm/timer.h>
#include <asm/special_insns.h>
-/* nop stub */
-void _paravirt_nop(void)
-{
-}
+/*
+ * nop stub, which must not clobber anything *including the stack* to
+ * avoid confusing the entry prologues.
+ */
+extern void _paravirt_nop(void);
+asm (".pushsection .entry.text, \"ax\"\n"
+ ".global _paravirt_nop\n"
+ "_paravirt_nop:\n\t"
+ "ret\n\t"
+ ".size _paravirt_nop, . - _paravirt_nop\n\t"
+ ".type _paravirt_nop, @function\n\t"
+ ".popsection");
/* identity function, which can be inlined */
u32 _paravirt_ident_32(u32 x)
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 17/79] x86/nmi/64: Fix a paravirt stack-clobbering bug in the NMI code
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (15 preceding siblings ...)
2015-10-18 2:05 ` [PATCH 3.14 16/79] x86/paravirt: Replace the paravirt nop with a bona fide empty function Greg Kroah-Hartman
@ 2015-10-18 2:05 ` Greg Kroah-Hartman
2015-10-18 2:05 ` [PATCH 3.14 18/79] Use WARN_ON_ONCE for missing X86_FEATURE_NRIPS Greg Kroah-Hartman
` (61 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:05 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Andy Lutomirski, Thomas Gleixner
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Lutomirski <luto@kernel.org>
commit 83c133cf11fb0e68a51681447e372489f052d40e upstream.
The NMI entry code that switches to the normal kernel stack needs to
be very careful not to clobber any extra stack slots on the NMI
stack. The code is fine under the assumption that SWAPGS is just a
normal instruction, but that assumption isn't really true. Use
SWAPGS_UNSAFE_STACK instead.
This is part of a fix for some random crashes that Sasha saw.
Fixes: 9b6e6a8334d5 ("x86/nmi/64: Switch stacks on userspace NMI entry")
Reported-and-tested-by: Sasha Levin <sasha.levin@oracle.com>
Signed-off-by: Andy Lutomirski <luto@kernel.org>
Link: http://lkml.kernel.org/r/974bc40edffdb5c2950a5c4977f821a446b76178.1442791737.git.luto@kernel.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/entry_64.S | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/arch/x86/kernel/entry_64.S
+++ b/arch/x86/kernel/entry_64.S
@@ -1747,8 +1747,11 @@ ENTRY(nmi)
* we don't want to enable interrupts, because then we'll end
* up in an awkward situation in which IRQs are on but NMIs
* are off.
+ *
+ * We also must not push anything to the stack before switching
+ * stacks lest we corrupt the "NMI executing" variable.
*/
- SWAPGS
+ SWAPGS_UNSAFE_STACK
cld
movq %rsp, %rdx
movq PER_CPU_VAR(kernel_stack), %rsp
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 18/79] Use WARN_ON_ONCE for missing X86_FEATURE_NRIPS
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (16 preceding siblings ...)
2015-10-18 2:05 ` [PATCH 3.14 17/79] x86/nmi/64: Fix a paravirt stack-clobbering bug in the NMI code Greg Kroah-Hartman
@ 2015-10-18 2:05 ` Greg Kroah-Hartman
2015-10-18 2:05 ` [PATCH 3.14 19/79] x86/efi: Fix boot crash by mapping EFI memmap entries bottom-up at runtime, instead of top-down Greg Kroah-Hartman
` (60 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:05 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dirk Mueller, Paolo Bonzini
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: =?UTF-8?q?Dirk=20M=C3=BCller?= <dmueller@suse.com>
commit d2922422c48df93f3edff7d872ee4f3191fefb08 upstream.
The cpu feature flags are not ever going to change, so warning
everytime can cause a lot of kernel log spam
(in our case more than 10GB/hour).
The warning seems to only occur when nested virtualization is
enabled, so it's probably triggered by a KVM bug. This is a
sensible and safe change anyway, and the KVM bug fix might not
be suitable for stable releases anyway.
Signed-off-by: Dirk Mueller <dmueller@suse.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/svm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -496,7 +496,7 @@ static void skip_emulated_instruction(st
struct vcpu_svm *svm = to_svm(vcpu);
if (svm->vmcb->control.next_rip != 0) {
- WARN_ON(!static_cpu_has(X86_FEATURE_NRIPS));
+ WARN_ON_ONCE(!static_cpu_has(X86_FEATURE_NRIPS));
svm->next_rip = svm->vmcb->control.next_rip;
}
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 19/79] x86/efi: Fix boot crash by mapping EFI memmap entries bottom-up at runtime, instead of top-down
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (17 preceding siblings ...)
2015-10-18 2:05 ` [PATCH 3.14 18/79] Use WARN_ON_ONCE for missing X86_FEATURE_NRIPS Greg Kroah-Hartman
@ 2015-10-18 2:05 ` Greg Kroah-Hartman
2015-10-18 2:05 ` [PATCH 3.14 20/79] x86/mm: Set NX on gap between __ex_table and rodata Greg Kroah-Hartman
` (59 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:05 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ard Biesheuvel, Matt Fleming,
Borislav Petkov, Chun-Yi, Dave Young, H. Peter Anvin,
James Bottomley, Leif Lindholm, Linus Torvalds, Matthew Garrett,
Mike Galbraith, Peter Jones, Peter Zijlstra, Thomas Gleixner,
Ingo Molnar
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Fleming <matt.fleming@intel.com>
commit a5caa209ba9c29c6421292e7879d2387a2ef39c9 upstream.
Beginning with UEFI v2.5 EFI_PROPERTIES_TABLE was introduced
that signals that the firmware PE/COFF loader supports splitting
code and data sections of PE/COFF images into separate EFI
memory map entries. This allows the kernel to map those regions
with strict memory protections, e.g. EFI_MEMORY_RO for code,
EFI_MEMORY_XP for data, etc.
Unfortunately, an unwritten requirement of this new feature is
that the regions need to be mapped with the same offsets
relative to each other as observed in the EFI memory map. If
this is not done crashes like this may occur,
BUG: unable to handle kernel paging request at fffffffefe6086dd
IP: [<fffffffefe6086dd>] 0xfffffffefe6086dd
Call Trace:
[<ffffffff8104c90e>] efi_call+0x7e/0x100
[<ffffffff81602091>] ? virt_efi_set_variable+0x61/0x90
[<ffffffff8104c583>] efi_delete_dummy_variable+0x63/0x70
[<ffffffff81f4e4aa>] efi_enter_virtual_mode+0x383/0x392
[<ffffffff81f37e1b>] start_kernel+0x38a/0x417
[<ffffffff81f37495>] x86_64_start_reservations+0x2a/0x2c
[<ffffffff81f37582>] x86_64_start_kernel+0xeb/0xef
Here 0xfffffffefe6086dd refers to an address the firmware
expects to be mapped but which the OS never claimed was mapped.
The issue is that included in these regions are relative
addresses to other regions which were emitted by the firmware
toolchain before the "splitting" of sections occurred at
runtime.
Needless to say, we don't satisfy this unwritten requirement on
x86_64 and instead map the EFI memory map entries in reverse
order. The above crash is almost certainly triggerable with any
kernel newer than v3.13 because that's when we rewrote the EFI
runtime region mapping code, in commit d2f7cbe7b26a ("x86/efi:
Runtime services virtual mapping"). For kernel versions before
v3.13 things may work by pure luck depending on the
fragmentation of the kernel virtual address space at the time we
map the EFI regions.
Instead of mapping the EFI memory map entries in reverse order,
where entry N has a higher virtual address than entry N+1, map
them in the same order as they appear in the EFI memory map to
preserve this relative offset between regions.
This patch has been kept as small as possible with the intention
that it should be applied aggressively to stable and
distribution kernels. It is very much a bugfix rather than
support for a new feature, since when EFI_PROPERTIES_TABLE is
enabled we must map things as outlined above to even boot - we
have no way of asking the firmware not to split the code/data
regions.
In fact, this patch doesn't even make use of the more strict
memory protections available in UEFI v2.5. That will come later.
Suggested-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Reported-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Matt Fleming <matt.fleming@intel.com>
Cc: Borislav Petkov <bp@suse.de>
Cc: Chun-Yi <jlee@suse.com>
Cc: Dave Young <dyoung@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: James Bottomley <JBottomley@Odin.com>
Cc: Lee, Chun-Yi <jlee@suse.com>
Cc: Leif Lindholm <leif.lindholm@linaro.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Matthew Garrett <mjg59@srcf.ucam.org>
Cc: Mike Galbraith <efault@gmx.de>
Cc: Peter Jones <pjones@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: linux-kernel@vger.kernel.org
Link: http://lkml.kernel.org/r/1443218539-7610-2-git-send-email-matt@codeblueprint.co.uk
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/platform/efi/efi.c | 67 +++++++++++++++++++++++++++++++++++++++++++-
1 file changed, 66 insertions(+), 1 deletion(-)
--- a/arch/x86/platform/efi/efi.c
+++ b/arch/x86/platform/efi/efi.c
@@ -961,6 +961,70 @@ out:
}
/*
+ * Iterate the EFI memory map in reverse order because the regions
+ * will be mapped top-down. The end result is the same as if we had
+ * mapped things forward, but doesn't require us to change the
+ * existing implementation of efi_map_region().
+ */
+static inline void *efi_map_next_entry_reverse(void *entry)
+{
+ /* Initial call */
+ if (!entry)
+ return memmap.map_end - memmap.desc_size;
+
+ entry -= memmap.desc_size;
+ if (entry < memmap.map)
+ return NULL;
+
+ return entry;
+}
+
+/*
+ * efi_map_next_entry - Return the next EFI memory map descriptor
+ * @entry: Previous EFI memory map descriptor
+ *
+ * This is a helper function to iterate over the EFI memory map, which
+ * we do in different orders depending on the current configuration.
+ *
+ * To begin traversing the memory map @entry must be %NULL.
+ *
+ * Returns %NULL when we reach the end of the memory map.
+ */
+static void *efi_map_next_entry(void *entry)
+{
+ if (!efi_enabled(EFI_OLD_MEMMAP) && efi_enabled(EFI_64BIT)) {
+ /*
+ * Starting in UEFI v2.5 the EFI_PROPERTIES_TABLE
+ * config table feature requires us to map all entries
+ * in the same order as they appear in the EFI memory
+ * map. That is to say, entry N must have a lower
+ * virtual address than entry N+1. This is because the
+ * firmware toolchain leaves relative references in
+ * the code/data sections, which are split and become
+ * separate EFI memory regions. Mapping things
+ * out-of-order leads to the firmware accessing
+ * unmapped addresses.
+ *
+ * Since we need to map things this way whether or not
+ * the kernel actually makes use of
+ * EFI_PROPERTIES_TABLE, let's just switch to this
+ * scheme by default for 64-bit.
+ */
+ return efi_map_next_entry_reverse(entry);
+ }
+
+ /* Initial call */
+ if (!entry)
+ return memmap.map;
+
+ entry += memmap.desc_size;
+ if (entry >= memmap.map_end)
+ return NULL;
+
+ return entry;
+}
+
+/*
* Map the efi memory ranges of the runtime services and update new_mmap with
* virtual addresses.
*/
@@ -970,7 +1034,8 @@ static void * __init efi_map_regions(int
unsigned long left = 0;
efi_memory_desc_t *md;
- for (p = memmap.map; p < memmap.map_end; p += memmap.desc_size) {
+ p = NULL;
+ while ((p = efi_map_next_entry(p))) {
md = p;
if (!(md->attribute & EFI_MEMORY_RUNTIME)) {
#ifdef CONFIG_X86_64
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 20/79] x86/mm: Set NX on gap between __ex_table and rodata
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (18 preceding siblings ...)
2015-10-18 2:05 ` [PATCH 3.14 19/79] x86/efi: Fix boot crash by mapping EFI memmap entries bottom-up at runtime, instead of top-down Greg Kroah-Hartman
@ 2015-10-18 2:05 ` Greg Kroah-Hartman
2015-10-18 2:05 ` [PATCH 3.14 21/79] x86/xen: Support kexec/kdump in HVM guests by doing a soft reset Greg Kroah-Hartman
` (58 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:05 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Stephen Smalley, Kees Cook,
Linus Torvalds, Mike Galbraith, Peter Zijlstra, Thomas Gleixner,
Ingo Molnar
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Smalley <sds@tycho.nsa.gov>
commit ab76f7b4ab2397ffdd2f1eb07c55697d19991d10 upstream.
Unused space between the end of __ex_table and the start of
rodata can be left W+x in the kernel page tables. Extend the
setting of the NX bit to cover this gap by starting from
text_end rather than rodata_start.
Before:
---[ High Kernel Mapping ]---
0xffffffff80000000-0xffffffff81000000 16M pmd
0xffffffff81000000-0xffffffff81600000 6M ro PSE GLB x pmd
0xffffffff81600000-0xffffffff81754000 1360K ro GLB x pte
0xffffffff81754000-0xffffffff81800000 688K RW GLB x pte
0xffffffff81800000-0xffffffff81a00000 2M ro PSE GLB NX pmd
0xffffffff81a00000-0xffffffff81b3b000 1260K ro GLB NX pte
0xffffffff81b3b000-0xffffffff82000000 4884K RW GLB NX pte
0xffffffff82000000-0xffffffff82200000 2M RW PSE GLB NX pmd
0xffffffff82200000-0xffffffffa0000000 478M pmd
After:
---[ High Kernel Mapping ]---
0xffffffff80000000-0xffffffff81000000 16M pmd
0xffffffff81000000-0xffffffff81600000 6M ro PSE GLB x pmd
0xffffffff81600000-0xffffffff81754000 1360K ro GLB x pte
0xffffffff81754000-0xffffffff81800000 688K RW GLB NX pte
0xffffffff81800000-0xffffffff81a00000 2M ro PSE GLB NX pmd
0xffffffff81a00000-0xffffffff81b3b000 1260K ro GLB NX pte
0xffffffff81b3b000-0xffffffff82000000 4884K RW GLB NX pte
0xffffffff82000000-0xffffffff82200000 2M RW PSE GLB NX pmd
0xffffffff82200000-0xffffffffa0000000 478M pmd
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Acked-by: Kees Cook <keescook@chromium.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Mike Galbraith <efault@gmx.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: linux-kernel@vger.kernel.org
Link: http://lkml.kernel.org/r/1443704662-3138-1-git-send-email-sds@tycho.nsa.gov
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/mm/init_64.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/x86/mm/init_64.c
+++ b/arch/x86/mm/init_64.c
@@ -1131,7 +1131,7 @@ void mark_rodata_ro(void)
* has been zapped already via cleanup_highmem().
*/
all_end = roundup((unsigned long)_brk_end, PMD_SIZE);
- set_memory_nx(rodata_start, (all_end - rodata_start) >> PAGE_SHIFT);
+ set_memory_nx(text_end, (all_end - text_end) >> PAGE_SHIFT);
rodata_test();
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 21/79] x86/xen: Support kexec/kdump in HVM guests by doing a soft reset
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (19 preceding siblings ...)
2015-10-18 2:05 ` [PATCH 3.14 20/79] x86/mm: Set NX on gap between __ex_table and rodata Greg Kroah-Hartman
@ 2015-10-18 2:05 ` Greg Kroah-Hartman
2015-10-18 2:05 ` [PATCH 3.14 22/79] sched/core: Fix TASK_DEAD race in finish_task_switch() Greg Kroah-Hartman
` (57 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:05 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Vitaly Kuznetsov, David Vrabel
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vitaly Kuznetsov <vkuznets@redhat.com>
commit 0b34a166f291d255755be46e43ed5497cdd194f2 upstream.
Currently there is a number of issues preventing PVHVM Xen guests from
doing successful kexec/kdump:
- Bound event channels.
- Registered vcpu_info.
- PIRQ/emuirq mappings.
- shared_info frame after XENMAPSPACE_shared_info operation.
- Active grant mappings.
Basically, newly booted kernel stumbles upon already set up Xen
interfaces and there is no way to reestablish them. In Xen-4.7 a new
feature called 'soft reset' is coming. A guest performing kexec/kdump
operation is supposed to call SCHEDOP_shutdown hypercall with
SHUTDOWN_soft_reset reason before jumping to new kernel. Hypervisor
(with some help from toolstack) will do full domain cleanup (but
keeping its memory and vCPU contexts intact) returning the guest to
the state it had when it was first booted and thus allowing it to
start over.
Doing SHUTDOWN_soft_reset on Xen hypervisors which don't support it is
probably OK as by default all unknown shutdown reasons cause domain
destroy with a message in toolstack log: 'Unknown shutdown reason code
5. Destroying domain.' which gives a clue to what the problem is and
eliminates false expectations.
Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/xen/enlighten.c | 23 +++++++++++++++++++++++
include/xen/interface/sched.h | 8 ++++++++
2 files changed, 31 insertions(+)
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -33,6 +33,10 @@
#include <linux/memblock.h>
#include <linux/edd.h>
+#ifdef CONFIG_KEXEC_CORE
+#include <linux/kexec.h>
+#endif
+
#include <xen/xen.h>
#include <xen/events.h>
#include <xen/interface/xen.h>
@@ -1844,6 +1848,21 @@ static struct notifier_block xen_hvm_cpu
.notifier_call = xen_hvm_cpu_notify,
};
+#ifdef CONFIG_KEXEC_CORE
+static void xen_hvm_shutdown(void)
+{
+ native_machine_shutdown();
+ if (kexec_in_progress)
+ xen_reboot(SHUTDOWN_soft_reset);
+}
+
+static void xen_hvm_crash_shutdown(struct pt_regs *regs)
+{
+ native_machine_crash_shutdown(regs);
+ xen_reboot(SHUTDOWN_soft_reset);
+}
+#endif
+
static void __init xen_hvm_guest_init(void)
{
init_hvm_pv_info();
@@ -1860,6 +1879,10 @@ static void __init xen_hvm_guest_init(vo
x86_init.irqs.intr_init = xen_init_IRQ;
xen_hvm_init_time_ops();
xen_hvm_init_mmu_ops();
+#ifdef CONFIG_KEXEC_CORE
+ machine_ops.shutdown = xen_hvm_shutdown;
+ machine_ops.crash_shutdown = xen_hvm_crash_shutdown;
+#endif
}
static uint32_t __init xen_hvm_platform(void)
--- a/include/xen/interface/sched.h
+++ b/include/xen/interface/sched.h
@@ -107,5 +107,13 @@ struct sched_watchdog {
#define SHUTDOWN_suspend 2 /* Clean up, save suspend info, kill. */
#define SHUTDOWN_crash 3 /* Tell controller we've crashed. */
#define SHUTDOWN_watchdog 4 /* Restart because watchdog time expired. */
+/*
+ * Domain asked to perform 'soft reset' for it. The expected behavior is to
+ * reset internal Xen state for the domain returning it to the point where it
+ * was created but leaving the domain's memory contents and vCPU contexts
+ * intact. This will allow the domain to start over and set up all Xen specific
+ * interfaces again.
+ */
+#define SHUTDOWN_soft_reset 5
#endif /* __XEN_PUBLIC_SCHED_H__ */
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 22/79] sched/core: Fix TASK_DEAD race in finish_task_switch()
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (20 preceding siblings ...)
2015-10-18 2:05 ` [PATCH 3.14 21/79] x86/xen: Support kexec/kdump in HVM guests by doing a soft reset Greg Kroah-Hartman
@ 2015-10-18 2:05 ` Greg Kroah-Hartman
2015-10-18 2:05 ` [PATCH 3.14 23/79] spi: Fix documentation of spi_alloc_master() Greg Kroah-Hartman
` (56 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:05 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Oleg Nesterov, Peter Zijlstra (Intel),
Linus Torvalds, Thomas Gleixner, manfred, will.deacon,
Ingo Molnar
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <peterz@infradead.org>
commit 95913d97914f44db2b81271c2e2ebd4d2ac2df83 upstream.
So the problem this patch is trying to address is as follows:
CPU0 CPU1
context_switch(A, B)
ttwu(A)
LOCK A->pi_lock
A->on_cpu == 0
finish_task_switch(A)
prev_state = A->state <-.
WMB |
A->on_cpu = 0; |
UNLOCK rq0->lock |
| context_switch(C, A)
`-- A->state = TASK_DEAD
prev_state == TASK_DEAD
put_task_struct(A)
context_switch(A, C)
finish_task_switch(A)
A->state == TASK_DEAD
put_task_struct(A)
The argument being that the WMB will allow the load of A->state on CPU0
to cross over and observe CPU1's store of A->state, which will then
result in a double-drop and use-after-free.
Now the comment states (and this was true once upon a long time ago)
that we need to observe A->state while holding rq->lock because that
will order us against the wakeup; however the wakeup will not in fact
acquire (that) rq->lock; it takes A->pi_lock these days.
We can obviously fix this by upgrading the WMB to an MB, but that is
expensive, so we'd rather avoid that.
The alternative this patch takes is: smp_store_release(&A->on_cpu, 0),
which avoids the MB on some archs, but not important ones like ARM.
Reported-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: linux-kernel@vger.kernel.org
Cc: manfred@colorfullife.com
Cc: will.deacon@arm.com
Fixes: e4a52bcb9a18 ("sched: Remove rq->lock from the first half of ttwu()")
Link: http://lkml.kernel.org/r/20150929124509.GG3816@twins.programming.kicks-ass.net
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/sched/core.c | 10 +++++-----
kernel/sched/sched.h | 5 +++--
2 files changed, 8 insertions(+), 7 deletions(-)
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -2136,11 +2136,11 @@ static void finish_task_switch(struct rq
* If a task dies, then it sets TASK_DEAD in tsk->state and calls
* schedule one last time. The schedule call will never return, and
* the scheduled task must drop that reference.
- * The test for TASK_DEAD must occur while the runqueue locks are
- * still held, otherwise prev could be scheduled on another cpu, die
- * there before we look at prev->state, and then the reference would
- * be dropped twice.
- * Manfred Spraul <manfred@colorfullife.com>
+ *
+ * We must observe prev->state before clearing prev->on_cpu (in
+ * finish_lock_switch), otherwise a concurrent wakeup can get prev
+ * running on another CPU and we could rave with its RUNNING -> DEAD
+ * transition, resulting in a double drop.
*/
prev_state = prev->state;
vtime_task_switch(prev);
--- a/kernel/sched/sched.h
+++ b/kernel/sched/sched.h
@@ -994,9 +994,10 @@ static inline void finish_lock_switch(st
* After ->on_cpu is cleared, the task can be moved to a different CPU.
* We must ensure this doesn't happen until the switch is completely
* finished.
+ *
+ * Pairs with the control dependency and rmb in try_to_wake_up().
*/
- smp_wmb();
- prev->on_cpu = 0;
+ smp_store_release(&prev->on_cpu, 0);
#endif
#ifdef CONFIG_DEBUG_SPINLOCK
/* this is a valid case when another task releases the spinlock */
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 23/79] spi: Fix documentation of spi_alloc_master()
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (21 preceding siblings ...)
2015-10-18 2:05 ` [PATCH 3.14 22/79] sched/core: Fix TASK_DEAD race in finish_task_switch() Greg Kroah-Hartman
@ 2015-10-18 2:05 ` Greg Kroah-Hartman
2015-10-18 2:05 ` [PATCH 3.14 24/79] spi: spi-pxa2xx: Check status register to determine if SSSR_TINT is disabled Greg Kroah-Hartman
` (55 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:05 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Guenter Roeck, Alexey Klimov, Mark Brown
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <linux@roeck-us.net>
commit a394d635193b641f2c86ead5ada5b115d57c51f8 upstream.
Actually, spi_master_put() after spi_alloc_master() must _not_ be followed
by kfree(). The memory is already freed with the call to spi_master_put()
through spi_master_class, which registers a release function. Calling both
spi_master_put() and kfree() results in often nasty (and delayed) crashes
elsewhere in the kernel, often in the networking stack.
This reverts commit eb4af0f5349235df2e4a5057a72fc8962d00308a.
Link to patch and concerns: https://lkml.org/lkml/2012/9/3/269
or
http://lkml.iu.edu/hypermail/linux/kernel/1209.0/00790.html
Alexey Klimov: This revert becomes valid after
94c69f765f1b4a658d96905ec59928e3e3e07e6a when spi-imx.c
has been fixed and there is no need to call kfree() so comment
for spi_alloc_master() should be fixed.
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Alexey Klimov <alexey.klimov@linaro.org>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -1251,8 +1251,7 @@ static struct class spi_master_class = {
*
* The caller is responsible for assigning the bus number and initializing
* the master's methods before calling spi_register_master(); and (after errors
- * adding the device) calling spi_master_put() and kfree() to prevent a memory
- * leak.
+ * adding the device) calling spi_master_put() to prevent a memory leak.
*/
struct spi_master *spi_alloc_master(struct device *dev, unsigned size)
{
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 24/79] spi: spi-pxa2xx: Check status register to determine if SSSR_TINT is disabled
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (22 preceding siblings ...)
2015-10-18 2:05 ` [PATCH 3.14 23/79] spi: Fix documentation of spi_alloc_master() Greg Kroah-Hartman
@ 2015-10-18 2:05 ` Greg Kroah-Hartman
2015-10-18 2:05 ` [PATCH 3.14 25/79] mm: hugetlbfs: skip shared VMAs when unmapping private pages to satisfy a fault Greg Kroah-Hartman
` (54 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:05 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tan, Jui Nee, Jarkko Nikula, Mark Brown
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Tan, Jui Nee" <jui.nee.tan@intel.com>
commit 02bc933ebb59208f42c2e6305b2c17fd306f695d upstream.
On Intel Baytrail, there is case when interrupt handler get called, no SPI
message is captured. The RX FIFO is indeed empty when RX timeout pending
interrupt (SSSR_TINT) happens.
Use the BIOS version where both HSUART and SPI are on the same IRQ. Both
drivers are using IRQF_SHARED when calling the request_irq function. When
running two separate and independent SPI and HSUART application that
generate data traffic on both components, user will see messages like
below on the console:
pxa2xx-spi pxa2xx-spi.0: bad message state in interrupt handler
This commit will fix this by first checking Receiver Time-out Interrupt,
if it is disabled, ignore the request and return without servicing.
Signed-off-by: Tan, Jui Nee <jui.nee.tan@intel.com>
Acked-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-pxa2xx.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/spi/spi-pxa2xx.c
+++ b/drivers/spi/spi-pxa2xx.c
@@ -562,6 +562,10 @@ static irqreturn_t ssp_int(int irq, void
if (!(sccr1_reg & SSCR1_TIE))
mask &= ~SSSR_TFS;
+ /* Ignore RX timeout interrupt if it is disabled */
+ if (!(sccr1_reg & SSCR1_TINTE))
+ mask &= ~SSSR_TINT;
+
if (!(status & mask))
return IRQ_NONE;
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 25/79] mm: hugetlbfs: skip shared VMAs when unmapping private pages to satisfy a fault
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (23 preceding siblings ...)
2015-10-18 2:05 ` [PATCH 3.14 24/79] spi: spi-pxa2xx: Check status register to determine if SSSR_TINT is disabled Greg Kroah-Hartman
@ 2015-10-18 2:05 ` Greg Kroah-Hartman
2015-10-18 2:05 ` [PATCH 3.14 26/79] ALSA: synth: Fix conflicting OSS device registration on AWE32 Greg Kroah-Hartman
` (53 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:05 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mel Gorman, SunDong, Michal Hocko,
Andrea Arcangeli, Hugh Dickins, Naoya Horiguchi, David Rientjes,
Andrew Morton, Linus Torvalds
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mel Gorman <mgorman@techsingularity.net>
commit 2f84a8990ebbe235c59716896e017c6b2ca1200f upstream.
SunDong reported the following on
https://bugzilla.kernel.org/show_bug.cgi?id=103841
I think I find a linux bug, I have the test cases is constructed. I
can stable recurring problems in fedora22(4.0.4) kernel version,
arch for x86_64. I construct transparent huge page, when the parent
and child process with MAP_SHARE, MAP_PRIVATE way to access the same
huge page area, it has the opportunity to lead to huge page copy on
write failure, and then it will munmap the child corresponding mmap
area, but then the child mmap area with VM_MAYSHARE attributes, child
process munmap this area can trigger VM_BUG_ON in set_vma_resv_flags
functions (vma - > vm_flags & VM_MAYSHARE).
There were a number of problems with the report (e.g. it's hugetlbfs that
triggers this, not transparent huge pages) but it was fundamentally
correct in that a VM_BUG_ON in set_vma_resv_flags() can be triggered that
looks like this
vma ffff8804651fd0d0 start 00007fc474e00000 end 00007fc475e00000
next ffff8804651fd018 prev ffff8804651fd188 mm ffff88046b1b1800
prot 8000000000000027 anon_vma (null) vm_ops ffffffff8182a7a0
pgoff 0 file ffff88106bdb9800 private_data (null)
flags: 0x84400fb(read|write|shared|mayread|maywrite|mayexec|mayshare|dontexpand|hugetlb)
------------
kernel BUG at mm/hugetlb.c:462!
SMP
Modules linked in: xt_pkttype xt_LOG xt_limit [..]
CPU: 38 PID: 26839 Comm: map Not tainted 4.0.4-default #1
Hardware name: Dell Inc. PowerEdge R810/0TT6JF, BIOS 2.7.4 04/26/2012
set_vma_resv_flags+0x2d/0x30
The VM_BUG_ON is correct because private and shared mappings have
different reservation accounting but the warning clearly shows that the
VMA is shared.
When a private COW fails to allocate a new page then only the process
that created the VMA gets the page -- all the children unmap the page.
If the children access that data in the future then they get killed.
The problem is that the same file is mapped shared and private. During
the COW, the allocation fails, the VMAs are traversed to unmap the other
private pages but a shared VMA is found and the bug is triggered. This
patch identifies such VMAs and skips them.
Signed-off-by: Mel Gorman <mgorman@techsingularity.net>
Reported-by: SunDong <sund_sky@126.com>
Reviewed-by: Michal Hocko <mhocko@suse.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Cc: David Rientjes <rientjes@google.com>
Reviewed-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/hugetlb.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -2615,6 +2615,14 @@ static int unmap_ref_private(struct mm_s
continue;
/*
+ * Shared VMAs have their own reserves and do not affect
+ * MAP_PRIVATE accounting but it is possible that a shared
+ * VMA is using the same page so check and skip such VMAs.
+ */
+ if (iter_vma->vm_flags & VM_MAYSHARE)
+ continue;
+
+ /*
* Unmap the page from other VMAs without their own reserves.
* They get marked to be SIGKILLed if they fault in these
* areas. This is because a future no-page fault on this VMA
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 26/79] ALSA: synth: Fix conflicting OSS device registration on AWE32
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (24 preceding siblings ...)
2015-10-18 2:05 ` [PATCH 3.14 25/79] mm: hugetlbfs: skip shared VMAs when unmapping private pages to satisfy a fault Greg Kroah-Hartman
@ 2015-10-18 2:05 ` Greg Kroah-Hartman
2015-10-18 2:05 ` [PATCH 3.14 27/79] ALSA: hda - Apply SPDIF pin ctl to MacBookPro 12,1 Greg Kroah-Hartman
` (52 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:05 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Iwai
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit 225db5762dc1a35b26850477ffa06e5cd0097243 upstream.
When OSS emulation is loaded on ISA SB AWE32 chip, we get now kernel
warnings like:
WARNING: CPU: 0 PID: 2791 at fs/sysfs/dir.c:31 sysfs_warn_dup+0x51/0x80()
sysfs: cannot create duplicate filename '/devices/isa/sbawe.0/sound/card0/seq-oss-0-0'
It's because both emux synth and opl3 drivers try to register their
OSS device object with the same static index number 0. This hasn't
been a big problem until the recent rewrite of device management code
(that exposes sysfs at the same time), but it's been an obvious bug.
This patch works around it just by using a different index number of
emux synth object. There can be a more elegant way to fix, but it's
enough for now, as this code won't be touched so often, in anyway.
Reported-and-tested-by: Michael Shell <list1@michaelshell.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/synth/emux/emux_oss.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/sound/synth/emux/emux_oss.c
+++ b/sound/synth/emux/emux_oss.c
@@ -69,7 +69,8 @@ snd_emux_init_seq_oss(struct snd_emux *e
struct snd_seq_oss_reg *arg;
struct snd_seq_device *dev;
- if (snd_seq_device_new(emu->card, 0, SNDRV_SEQ_DEV_ID_OSS,
+ /* using device#1 here for avoiding conflicts with OPL3 */
+ if (snd_seq_device_new(emu->card, 1, SNDRV_SEQ_DEV_ID_OSS,
sizeof(struct snd_seq_oss_reg), &dev) < 0)
return;
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 27/79] ALSA: hda - Apply SPDIF pin ctl to MacBookPro 12,1
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (25 preceding siblings ...)
2015-10-18 2:05 ` [PATCH 3.14 26/79] ALSA: synth: Fix conflicting OSS device registration on AWE32 Greg Kroah-Hartman
@ 2015-10-18 2:05 ` Greg Kroah-Hartman
2015-10-18 2:05 ` [PATCH 3.14 28/79] ASoC: pxa: pxa2xx-ac97: fix dma requestor lines Greg Kroah-Hartman
` (51 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:05 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, John Flatness, Takashi Iwai
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Flatness <john@zerocrates.org>
commit e8ff581f7ac2bc3b8886094b7ca635dcc4d1b0e9 upstream.
The MacBookPro 12,1 has the same setup as the 11 for controlling the
status of the optical audio light. Simply apply the existing workaround
to the subsystem ID for the 12,1.
[sorted the fixup entry by tiwai]
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=105401
Signed-off-by: John Flatness <john@zerocrates.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/patch_cirrus.c | 1 +
1 file changed, 1 insertion(+)
--- a/sound/pci/hda/patch_cirrus.c
+++ b/sound/pci/hda/patch_cirrus.c
@@ -637,6 +637,7 @@ static const struct snd_pci_quirk cs4208
SND_PCI_QUIRK(0x106b, 0x5e00, "MacBookPro 11,2", CS4208_MBP11),
SND_PCI_QUIRK(0x106b, 0x7100, "MacBookAir 6,1", CS4208_MBA6),
SND_PCI_QUIRK(0x106b, 0x7200, "MacBookAir 6,2", CS4208_MBA6),
+ SND_PCI_QUIRK(0x106b, 0x7b00, "MacBookPro 12,1", CS4208_MBP11),
{} /* terminator */
};
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 28/79] ASoC: pxa: pxa2xx-ac97: fix dma requestor lines
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (26 preceding siblings ...)
2015-10-18 2:05 ` [PATCH 3.14 27/79] ALSA: hda - Apply SPDIF pin ctl to MacBookPro 12,1 Greg Kroah-Hartman
@ 2015-10-18 2:05 ` Greg Kroah-Hartman
2015-10-18 2:05 ` [PATCH 3.14 29/79] ASoC: fix broken pxa SoC support Greg Kroah-Hartman
` (50 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:05 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Robert Jarzmik, Mark Brown
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robert Jarzmik <robert.jarzmik@free.fr>
commit 8811191fdf7ed02ee07cb8469428158572d355a2 upstream.
PCM receive and transmit DMA requestor lines were reverted, breaking the
PCM playback interface for PXA platforms using the sound/soc/ variant
instead of the sound/arm variant.
The commit below shows the inversion in the requestor lines.
Fixes: d65a14587a9b ("ASoC: pxa: use snd_dmaengine_dai_dma_data")
Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/pxa/pxa2xx-ac97.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/sound/soc/pxa/pxa2xx-ac97.c
+++ b/sound/soc/pxa/pxa2xx-ac97.c
@@ -49,7 +49,7 @@ static struct snd_ac97_bus_ops pxa2xx_ac
.reset = pxa2xx_ac97_cold_reset,
};
-static unsigned long pxa2xx_ac97_pcm_stereo_in_req = 12;
+static unsigned long pxa2xx_ac97_pcm_stereo_in_req = 11;
static struct snd_dmaengine_dai_dma_data pxa2xx_ac97_pcm_stereo_in = {
.addr = __PREG(PCDR),
.addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES,
@@ -57,7 +57,7 @@ static struct snd_dmaengine_dai_dma_data
.filter_data = &pxa2xx_ac97_pcm_stereo_in_req,
};
-static unsigned long pxa2xx_ac97_pcm_stereo_out_req = 11;
+static unsigned long pxa2xx_ac97_pcm_stereo_out_req = 12;
static struct snd_dmaengine_dai_dma_data pxa2xx_ac97_pcm_stereo_out = {
.addr = __PREG(PCDR),
.addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES,
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 29/79] ASoC: fix broken pxa SoC support
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (27 preceding siblings ...)
2015-10-18 2:05 ` [PATCH 3.14 28/79] ASoC: pxa: pxa2xx-ac97: fix dma requestor lines Greg Kroah-Hartman
@ 2015-10-18 2:05 ` Greg Kroah-Hartman
2015-10-18 2:05 ` [PATCH 3.14 30/79] ASoC: dwc: correct irq clear method Greg Kroah-Hartman
` (49 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:05 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Robert Jarzmik, Mark Brown
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robert Jarzmik <robert.jarzmik@free.fr>
commit 3c8f7710c1c44fb650bc29b6ef78ed8b60cfaa28 upstream.
The previous fix of pxa library support, which was introduced to fix the
library dependency, broke the previous SoC behavior, where a machine
code binding pxa2xx-ac97 with a coded relied on :
- sound/soc/pxa/pxa2xx-ac97.c
- sound/soc/codecs/XXX.c
For example, the mioa701_wm9713.c machine code is currently broken. The
"select ARM" statement wrongly selects the soc/arm/pxa2xx-ac97 for
compilation, as per an unfortunate fate SND_PXA2XX_AC97 is both declared
in sound/arm/Kconfig and sound/soc/pxa/Kconfig.
Fix this by ensuring that SND_PXA2XX_SOC correctly triggers the correct
pxa2xx-ac97 compilation.
Fixes: 846172dfe33c ("ASoC: fix SND_PXA2XX_LIB Kconfig warning")
Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/arm/Kconfig | 15 ++++++++-------
sound/soc/pxa/Kconfig | 2 --
2 files changed, 8 insertions(+), 9 deletions(-)
--- a/sound/arm/Kconfig
+++ b/sound/arm/Kconfig
@@ -9,6 +9,14 @@ menuconfig SND_ARM
Drivers that are implemented on ASoC can be found in
"ALSA for SoC audio support" section.
+config SND_PXA2XX_LIB
+ tristate
+ select SND_AC97_CODEC if SND_PXA2XX_LIB_AC97
+ select SND_DMAENGINE_PCM
+
+config SND_PXA2XX_LIB_AC97
+ bool
+
if SND_ARM
config SND_ARMAACI
@@ -21,13 +29,6 @@ config SND_PXA2XX_PCM
tristate
select SND_PCM
-config SND_PXA2XX_LIB
- tristate
- select SND_AC97_CODEC if SND_PXA2XX_LIB_AC97
-
-config SND_PXA2XX_LIB_AC97
- bool
-
config SND_PXA2XX_AC97
tristate "AC97 driver for the Intel PXA2xx chip"
depends on ARCH_PXA
--- a/sound/soc/pxa/Kconfig
+++ b/sound/soc/pxa/Kconfig
@@ -1,7 +1,6 @@
config SND_PXA2XX_SOC
tristate "SoC Audio for the Intel PXA2xx chip"
depends on ARCH_PXA
- select SND_ARM
select SND_PXA2XX_LIB
help
Say Y or M if you want to add support for codecs attached to
@@ -24,7 +23,6 @@ config SND_PXA2XX_AC97
config SND_PXA2XX_SOC_AC97
tristate
select AC97_BUS
- select SND_ARM
select SND_PXA2XX_LIB_AC97
select SND_SOC_AC97_BUS
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 30/79] ASoC: dwc: correct irq clear method
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (28 preceding siblings ...)
2015-10-18 2:05 ` [PATCH 3.14 29/79] ASoC: fix broken pxa SoC support Greg Kroah-Hartman
@ 2015-10-18 2:05 ` Greg Kroah-Hartman
2015-10-18 2:05 ` [PATCH 3.14 31/79] btrfs: skip waiting on ordered range for special files Greg Kroah-Hartman
` (48 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:05 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Yitian Bu, Mark Brown
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yitian Bu <buyitian@gmail.com>
commit 4873867e5f2bd90faad861dd94865099fc3140f3 upstream.
from Designware I2S datasheet, tx/rx XRUN irq is cleared by
reading register TOR/ROR, rather than by writing into them.
Signed-off-by: Yitian Bu <yitian.bu@tangramtek.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/dwc/designware_i2s.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/sound/soc/dwc/designware_i2s.c
+++ b/sound/soc/dwc/designware_i2s.c
@@ -100,10 +100,10 @@ static inline void i2s_clear_irqs(struct
if (stream == SNDRV_PCM_STREAM_PLAYBACK) {
for (i = 0; i < 4; i++)
- i2s_write_reg(dev->i2s_base, TOR(i), 0);
+ i2s_read_reg(dev->i2s_base, TOR(i));
} else {
for (i = 0; i < 4; i++)
- i2s_write_reg(dev->i2s_base, ROR(i), 0);
+ i2s_read_reg(dev->i2s_base, ROR(i));
}
}
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 31/79] btrfs: skip waiting on ordered range for special files
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (29 preceding siblings ...)
2015-10-18 2:05 ` [PATCH 3.14 30/79] ASoC: dwc: correct irq clear method Greg Kroah-Hartman
@ 2015-10-18 2:05 ` Greg Kroah-Hartman
2015-10-18 2:05 ` [PATCH 3.14 32/79] Btrfs: fix read corruption of compressed and shared extents Greg Kroah-Hartman
` (47 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:05 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Christoph Biedl, Jeff Mahoney, Filipe Manana
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Mahoney <jeffm@suse.com>
commit a30e577c96f59b1e1678ea5462432b09bf7d5cbc upstream.
In btrfs_evict_inode, we properly truncate the page cache for evicted
inodes but then we call btrfs_wait_ordered_range for every inode as well.
It's the right thing to do for regular files but results in incorrect
behavior for device inodes for block devices.
filemap_fdatawrite_range gets called with inode->i_mapping which gets
resolved to the block device inode before getting passed to
wbc_attach_fdatawrite_inode and ultimately to inode_to_bdi. What happens
next depends on whether there's an open file handle associated with the
inode. If there is, we write to the block device, which is unexpected
behavior. If there isn't, we through normally and inode->i_data is used.
We can also end up racing against open/close which can result in crashes
when i_mapping points to a block device inode that has been closed.
Since there can't be any page cache associated with special file inodes,
it's safe to skip the btrfs_wait_ordered_range call entirely and avoid
the problem.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=100911
Tested-by: Christoph Biedl <linux-kernel.bfrz@manchmal.in-ulm.de>
Signed-off-by: Jeff Mahoney <jeffm@suse.com>
Reviewed-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/btrfs/inode.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -4668,7 +4668,8 @@ void btrfs_evict_inode(struct inode *ino
goto no_delete;
}
/* do we really want it for ->i_nlink > 0 and zero btrfs_root_refs? */
- btrfs_wait_ordered_range(inode, 0, (u64)-1);
+ if (!special_file(inode->i_mode))
+ btrfs_wait_ordered_range(inode, 0, (u64)-1);
if (root->fs_info->log_root_recovering) {
BUG_ON(test_bit(BTRFS_INODE_HAS_ORPHAN_ITEM,
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 32/79] Btrfs: fix read corruption of compressed and shared extents
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (30 preceding siblings ...)
2015-10-18 2:05 ` [PATCH 3.14 31/79] btrfs: skip waiting on ordered range for special files Greg Kroah-Hartman
@ 2015-10-18 2:05 ` Greg Kroah-Hartman
2015-10-18 2:05 ` [PATCH 3.14 33/79] Btrfs: update fix for " Greg Kroah-Hartman
` (46 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:05 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Filipe Manana, Qu Wenruo, Liu Bo
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <fdmanana@suse.com>
commit 005efedf2c7d0a270ffbe28d8997b03844f3e3e7 upstream.
If a file has a range pointing to a compressed extent, followed by
another range that points to the same compressed extent and a read
operation attempts to read both ranges (either completely or part of
them), the pages that correspond to the second range are incorrectly
filled with zeroes.
Consider the following example:
File layout
[0 - 8K] [8K - 24K]
| |
| |
points to extent X, points to extent X,
offset 4K, length of 8K offset 0, length 16K
[extent X, compressed length = 4K uncompressed length = 16K]
If a readpages() call spans the 2 ranges, a single bio to read the extent
is submitted - extent_io.c:submit_extent_page() would only create a new
bio to cover the second range pointing to the extent if the extent it
points to had a different logical address than the extent associated with
the first range. This has a consequence of the compressed read end io
handler (compression.c:end_compressed_bio_read()) finish once the extent
is decompressed into the pages covering the first range, leaving the
remaining pages (belonging to the second range) filled with zeroes (done
by compression.c:btrfs_clear_biovec_end()).
So fix this by submitting the current bio whenever we find a range
pointing to a compressed extent that was preceded by a range with a
different extent map. This is the simplest solution for this corner
case. Making the end io callback populate both ranges (or more, if we
have multiple pointing to the same extent) is a much more complex
solution since each bio is tightly coupled with a single extent map and
the extent maps associated to the ranges pointing to the shared extent
can have different offsets and lengths.
The following test case for fstests triggers the issue:
seq=`basename $0`
seqres=$RESULT_DIR/$seq
echo "QA output created by $seq"
tmp=/tmp/$$
status=1 # failure is the default!
trap "_cleanup; exit \$status" 0 1 2 3 15
_cleanup()
{
rm -f $tmp.*
}
# get standard environment, filters and checks
. ./common/rc
. ./common/filter
# real QA test starts here
_need_to_be_root
_supported_fs btrfs
_supported_os Linux
_require_scratch
_require_cloner
rm -f $seqres.full
test_clone_and_read_compressed_extent()
{
local mount_opts=$1
_scratch_mkfs >>$seqres.full 2>&1
_scratch_mount $mount_opts
# Create a test file with a single extent that is compressed (the
# data we write into it is highly compressible no matter which
# compression algorithm is used, zlib or lzo).
$XFS_IO_PROG -f -c "pwrite -S 0xaa 0K 4K" \
-c "pwrite -S 0xbb 4K 8K" \
-c "pwrite -S 0xcc 12K 4K" \
$SCRATCH_MNT/foo | _filter_xfs_io
# Now clone our extent into an adjacent offset.
$CLONER_PROG -s $((4 * 1024)) -d $((16 * 1024)) -l $((8 * 1024)) \
$SCRATCH_MNT/foo $SCRATCH_MNT/foo
# Same as before but for this file we clone the extent into a lower
# file offset.
$XFS_IO_PROG -f -c "pwrite -S 0xaa 8K 4K" \
-c "pwrite -S 0xbb 12K 8K" \
-c "pwrite -S 0xcc 20K 4K" \
$SCRATCH_MNT/bar | _filter_xfs_io
$CLONER_PROG -s $((12 * 1024)) -d 0 -l $((8 * 1024)) \
$SCRATCH_MNT/bar $SCRATCH_MNT/bar
echo "File digests before unmounting filesystem:"
md5sum $SCRATCH_MNT/foo | _filter_scratch
md5sum $SCRATCH_MNT/bar | _filter_scratch
# Evicting the inode or clearing the page cache before reading
# again the file would also trigger the bug - reads were returning
# all bytes in the range corresponding to the second reference to
# the extent with a value of 0, but the correct data was persisted
# (it was a bug exclusively in the read path). The issue happened
# only if the same readpages() call targeted pages belonging to the
# first and second ranges that point to the same compressed extent.
_scratch_remount
echo "File digests after mounting filesystem again:"
# Must match the same digests we got before.
md5sum $SCRATCH_MNT/foo | _filter_scratch
md5sum $SCRATCH_MNT/bar | _filter_scratch
}
echo -e "\nTesting with zlib compression..."
test_clone_and_read_compressed_extent "-o compress=zlib"
_scratch_unmount
echo -e "\nTesting with lzo compression..."
test_clone_and_read_compressed_extent "-o compress=lzo"
status=0
exit
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: Qu Wenruo<quwenruo@cn.fujitsu.com>
Reviewed-by: Liu Bo <bo.li.liu@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/btrfs/extent_io.c | 65 ++++++++++++++++++++++++++++++++++++++++++++-------
1 file changed, 57 insertions(+), 8 deletions(-)
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -2681,7 +2681,8 @@ static int submit_extent_page(int rw, st
bio_end_io_t end_io_func,
int mirror_num,
unsigned long prev_bio_flags,
- unsigned long bio_flags)
+ unsigned long bio_flags,
+ bool force_bio_submit)
{
int ret = 0;
struct bio *bio;
@@ -2699,6 +2700,7 @@ static int submit_extent_page(int rw, st
contig = bio_end_sector(bio) == sector;
if (prev_bio_flags != bio_flags || !contig ||
+ force_bio_submit ||
merge_bio(rw, tree, page, offset, page_size, bio, bio_flags) ||
bio_add_page(bio, page, page_size, offset) < page_size) {
ret = submit_one_bio(rw, bio, mirror_num,
@@ -2790,7 +2792,8 @@ static int __do_readpage(struct extent_i
get_extent_t *get_extent,
struct extent_map **em_cached,
struct bio **bio, int mirror_num,
- unsigned long *bio_flags, int rw)
+ unsigned long *bio_flags, int rw,
+ u64 *prev_em_start)
{
struct inode *inode = page->mapping->host;
u64 start = page_offset(page);
@@ -2838,6 +2841,7 @@ static int __do_readpage(struct extent_i
}
while (cur <= end) {
unsigned long pnr = (last_byte >> PAGE_CACHE_SHIFT) + 1;
+ bool force_bio_submit = false;
if (cur >= last_byte) {
char *userpage;
@@ -2888,6 +2892,49 @@ static int __do_readpage(struct extent_i
block_start = em->block_start;
if (test_bit(EXTENT_FLAG_PREALLOC, &em->flags))
block_start = EXTENT_MAP_HOLE;
+
+ /*
+ * If we have a file range that points to a compressed extent
+ * and it's followed by a consecutive file range that points to
+ * to the same compressed extent (possibly with a different
+ * offset and/or length, so it either points to the whole extent
+ * or only part of it), we must make sure we do not submit a
+ * single bio to populate the pages for the 2 ranges because
+ * this makes the compressed extent read zero out the pages
+ * belonging to the 2nd range. Imagine the following scenario:
+ *
+ * File layout
+ * [0 - 8K] [8K - 24K]
+ * | |
+ * | |
+ * points to extent X, points to extent X,
+ * offset 4K, length of 8K offset 0, length 16K
+ *
+ * [extent X, compressed length = 4K uncompressed length = 16K]
+ *
+ * If the bio to read the compressed extent covers both ranges,
+ * it will decompress extent X into the pages belonging to the
+ * first range and then it will stop, zeroing out the remaining
+ * pages that belong to the other range that points to extent X.
+ * So here we make sure we submit 2 bios, one for the first
+ * range and another one for the third range. Both will target
+ * the same physical extent from disk, but we can't currently
+ * make the compressed bio endio callback populate the pages
+ * for both ranges because each compressed bio is tightly
+ * coupled with a single extent map, and each range can have
+ * an extent map with a different offset value relative to the
+ * uncompressed data of our extent and different lengths. This
+ * is a corner case so we prioritize correctness over
+ * non-optimal behavior (submitting 2 bios for the same extent).
+ */
+ if (test_bit(EXTENT_FLAG_COMPRESSED, &em->flags) &&
+ prev_em_start && *prev_em_start != (u64)-1 &&
+ *prev_em_start != em->orig_start)
+ force_bio_submit = true;
+
+ if (prev_em_start)
+ *prev_em_start = em->orig_start;
+
free_extent_map(em);
em = NULL;
@@ -2937,7 +2984,8 @@ static int __do_readpage(struct extent_i
bdev, bio, pnr,
end_bio_extent_readpage, mirror_num,
*bio_flags,
- this_bio_flag);
+ this_bio_flag,
+ force_bio_submit);
if (!ret) {
nr++;
*bio_flags = this_bio_flag;
@@ -2969,6 +3017,7 @@ static inline void __do_contiguous_readp
struct inode *inode;
struct btrfs_ordered_extent *ordered;
int index;
+ u64 prev_em_start = (u64)-1;
inode = pages[0]->mapping->host;
while (1) {
@@ -2984,7 +3033,7 @@ static inline void __do_contiguous_readp
for (index = 0; index < nr_pages; index++) {
__do_readpage(tree, pages[index], get_extent, em_cached, bio,
- mirror_num, bio_flags, rw);
+ mirror_num, bio_flags, rw, &prev_em_start);
page_cache_release(pages[index]);
}
}
@@ -3052,7 +3101,7 @@ static int __extent_read_full_page(struc
}
ret = __do_readpage(tree, page, get_extent, NULL, bio, mirror_num,
- bio_flags, rw);
+ bio_flags, rw, NULL);
return ret;
}
@@ -3078,7 +3127,7 @@ int extent_read_full_page_nolock(struct
int ret;
ret = __do_readpage(tree, page, get_extent, NULL, &bio, mirror_num,
- &bio_flags, READ);
+ &bio_flags, READ, NULL);
if (bio)
ret = submit_one_bio(READ, bio, mirror_num, bio_flags);
return ret;
@@ -3347,7 +3396,7 @@ static int __extent_writepage(struct pag
sector, iosize, pg_offset,
bdev, &epd->bio, max_nr,
end_bio_extent_writepage,
- 0, 0, 0);
+ 0, 0, 0, false);
if (ret)
SetPageError(page);
}
@@ -3516,7 +3565,7 @@ static int write_one_eb(struct extent_bu
ret = submit_extent_page(rw, tree, p, offset >> 9,
PAGE_CACHE_SIZE, 0, bdev, &epd->bio,
-1, end_bio_extent_buffer_writepage,
- 0, epd->bio_flags, bio_flags);
+ 0, epd->bio_flags, bio_flags, false);
epd->bio_flags = bio_flags;
if (ret) {
set_bit(EXTENT_BUFFER_IOERR, &eb->bflags);
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 33/79] Btrfs: update fix for read corruption of compressed and shared extents
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (31 preceding siblings ...)
2015-10-18 2:05 ` [PATCH 3.14 32/79] Btrfs: fix read corruption of compressed and shared extents Greg Kroah-Hartman
@ 2015-10-18 2:05 ` Greg Kroah-Hartman
2015-10-18 2:05 ` [PATCH 3.14 34/79] dm btree: add ref counting ops for the leaves of top level btrees Greg Kroah-Hartman
` (45 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:05 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Filipe Manana, Timofey Titovets
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <fdmanana@suse.com>
commit 808f80b46790f27e145c72112189d6a3be2bc884 upstream.
My previous fix in commit 005efedf2c7d ("Btrfs: fix read corruption of
compressed and shared extents") was effective only if the compressed
extents cover a file range with a length that is not a multiple of 16
pages. That's because the detection of when we reached a different range
of the file that shares the same compressed extent as the previously
processed range was done at extent_io.c:__do_contiguous_readpages(),
which covers subranges with a length up to 16 pages, because
extent_readpages() groups the pages in clusters no larger than 16 pages.
So fix this by tracking the start of the previously processed file
range's extent map at extent_readpages().
The following test case for fstests reproduces the issue:
seq=`basename $0`
seqres=$RESULT_DIR/$seq
echo "QA output created by $seq"
tmp=/tmp/$$
status=1 # failure is the default!
trap "_cleanup; exit \$status" 0 1 2 3 15
_cleanup()
{
rm -f $tmp.*
}
# get standard environment, filters and checks
. ./common/rc
. ./common/filter
# real QA test starts here
_need_to_be_root
_supported_fs btrfs
_supported_os Linux
_require_scratch
_require_cloner
rm -f $seqres.full
test_clone_and_read_compressed_extent()
{
local mount_opts=$1
_scratch_mkfs >>$seqres.full 2>&1
_scratch_mount $mount_opts
# Create our test file with a single extent of 64Kb that is going to
# be compressed no matter which compression algo is used (zlib/lzo).
$XFS_IO_PROG -f -c "pwrite -S 0xaa 0K 64K" \
$SCRATCH_MNT/foo | _filter_xfs_io
# Now clone the compressed extent into an adjacent file offset.
$CLONER_PROG -s 0 -d $((64 * 1024)) -l $((64 * 1024)) \
$SCRATCH_MNT/foo $SCRATCH_MNT/foo
echo "File digest before unmount:"
md5sum $SCRATCH_MNT/foo | _filter_scratch
# Remount the fs or clear the page cache to trigger the bug in
# btrfs. Because the extent has an uncompressed length that is a
# multiple of 16 pages, all the pages belonging to the second range
# of the file (64K to 128K), which points to the same extent as the
# first range (0K to 64K), had their contents full of zeroes instead
# of the byte 0xaa. This was a bug exclusively in the read path of
# compressed extents, the correct data was stored on disk, btrfs
# just failed to fill in the pages correctly.
_scratch_remount
echo "File digest after remount:"
# Must match the digest we got before.
md5sum $SCRATCH_MNT/foo | _filter_scratch
}
echo -e "\nTesting with zlib compression..."
test_clone_and_read_compressed_extent "-o compress=zlib"
_scratch_unmount
echo -e "\nTesting with lzo compression..."
test_clone_and_read_compressed_extent "-o compress=lzo"
status=0
exit
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Tested-by: Timofey Titovets <nefelim4ag@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/btrfs/extent_io.c | 19 +++++++++++--------
1 file changed, 11 insertions(+), 8 deletions(-)
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -3012,12 +3012,12 @@ static inline void __do_contiguous_readp
get_extent_t *get_extent,
struct extent_map **em_cached,
struct bio **bio, int mirror_num,
- unsigned long *bio_flags, int rw)
+ unsigned long *bio_flags, int rw,
+ u64 *prev_em_start)
{
struct inode *inode;
struct btrfs_ordered_extent *ordered;
int index;
- u64 prev_em_start = (u64)-1;
inode = pages[0]->mapping->host;
while (1) {
@@ -3033,7 +3033,7 @@ static inline void __do_contiguous_readp
for (index = 0; index < nr_pages; index++) {
__do_readpage(tree, pages[index], get_extent, em_cached, bio,
- mirror_num, bio_flags, rw, &prev_em_start);
+ mirror_num, bio_flags, rw, prev_em_start);
page_cache_release(pages[index]);
}
}
@@ -3043,7 +3043,8 @@ static void __extent_readpages(struct ex
int nr_pages, get_extent_t *get_extent,
struct extent_map **em_cached,
struct bio **bio, int mirror_num,
- unsigned long *bio_flags, int rw)
+ unsigned long *bio_flags, int rw,
+ u64 *prev_em_start)
{
u64 start = 0;
u64 end = 0;
@@ -3064,7 +3065,7 @@ static void __extent_readpages(struct ex
index - first_index, start,
end, get_extent, em_cached,
bio, mirror_num, bio_flags,
- rw);
+ rw, prev_em_start);
start = page_start;
end = start + PAGE_CACHE_SIZE - 1;
first_index = index;
@@ -3075,7 +3076,8 @@ static void __extent_readpages(struct ex
__do_contiguous_readpages(tree, &pages[first_index],
index - first_index, start,
end, get_extent, em_cached, bio,
- mirror_num, bio_flags, rw);
+ mirror_num, bio_flags, rw,
+ prev_em_start);
}
static int __extent_read_full_page(struct extent_io_tree *tree,
@@ -3967,6 +3969,7 @@ int extent_readpages(struct extent_io_tr
struct page *page;
struct extent_map *em_cached = NULL;
int nr = 0;
+ u64 prev_em_start = (u64)-1;
for (page_idx = 0; page_idx < nr_pages; page_idx++) {
page = list_entry(pages->prev, struct page, lru);
@@ -3983,12 +3986,12 @@ int extent_readpages(struct extent_io_tr
if (nr < ARRAY_SIZE(pagepool))
continue;
__extent_readpages(tree, pagepool, nr, get_extent, &em_cached,
- &bio, 0, &bio_flags, READ);
+ &bio, 0, &bio_flags, READ, &prev_em_start);
nr = 0;
}
if (nr)
__extent_readpages(tree, pagepool, nr, get_extent, &em_cached,
- &bio, 0, &bio_flags, READ);
+ &bio, 0, &bio_flags, READ, &prev_em_start);
if (em_cached)
free_extent_map(em_cached);
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 34/79] dm btree: add ref counting ops for the leaves of top level btrees
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (32 preceding siblings ...)
2015-10-18 2:05 ` [PATCH 3.14 33/79] Btrfs: update fix for " Greg Kroah-Hartman
@ 2015-10-18 2:05 ` Greg Kroah-Hartman
2015-10-18 2:05 ` [PATCH 3.14 35/79] staging: ion: fix corruption of ion_import_dma_buf Greg Kroah-Hartman
` (44 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:05 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Joe Thornber, Mike Snitzer
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Thornber <ejt@redhat.com>
commit b0dc3c8bc157c60b1d470163882be8c13e1950af upstream.
When using nested btrees, the top leaves of the top levels contain
block addresses for the root of the next tree down. If we shadow a
shared leaf node the leaf values (sub tree roots) should be incremented
accordingly.
This is only an issue if there is metadata sharing in the top levels.
Which only occurs if metadata snapshots are being used (as is possible
with dm-thinp). And could result in a block from the thinp metadata
snap being reused early, thus corrupting the thinp metadata snap.
Signed-off-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/persistent-data/dm-btree-internal.h | 6 ++++
drivers/md/persistent-data/dm-btree-remove.c | 12 ++------
drivers/md/persistent-data/dm-btree-spine.c | 37 +++++++++++++++++++++++++
drivers/md/persistent-data/dm-btree.c | 7 ----
4 files changed, 47 insertions(+), 15 deletions(-)
--- a/drivers/md/persistent-data/dm-btree-internal.h
+++ b/drivers/md/persistent-data/dm-btree-internal.h
@@ -138,4 +138,10 @@ int lower_bound(struct btree_node *n, ui
extern struct dm_block_validator btree_node_validator;
+/*
+ * Value type for upper levels of multi-level btrees.
+ */
+extern void init_le64_type(struct dm_transaction_manager *tm,
+ struct dm_btree_value_type *vt);
+
#endif /* DM_BTREE_INTERNAL_H */
--- a/drivers/md/persistent-data/dm-btree-remove.c
+++ b/drivers/md/persistent-data/dm-btree-remove.c
@@ -544,14 +544,6 @@ static int remove_raw(struct shadow_spin
return r;
}
-static struct dm_btree_value_type le64_type = {
- .context = NULL,
- .size = sizeof(__le64),
- .inc = NULL,
- .dec = NULL,
- .equal = NULL
-};
-
int dm_btree_remove(struct dm_btree_info *info, dm_block_t root,
uint64_t *keys, dm_block_t *new_root)
{
@@ -559,12 +551,14 @@ int dm_btree_remove(struct dm_btree_info
int index = 0, r = 0;
struct shadow_spine spine;
struct btree_node *n;
+ struct dm_btree_value_type le64_vt;
+ init_le64_type(info->tm, &le64_vt);
init_shadow_spine(&spine, info);
for (level = 0; level < info->levels; level++) {
r = remove_raw(&spine, info,
(level == last_level ?
- &info->value_type : &le64_type),
+ &info->value_type : &le64_vt),
root, keys[level], (unsigned *)&index);
if (r < 0)
break;
--- a/drivers/md/persistent-data/dm-btree-spine.c
+++ b/drivers/md/persistent-data/dm-btree-spine.c
@@ -249,3 +249,40 @@ int shadow_root(struct shadow_spine *s)
{
return s->root;
}
+
+static void le64_inc(void *context, const void *value_le)
+{
+ struct dm_transaction_manager *tm = context;
+ __le64 v_le;
+
+ memcpy(&v_le, value_le, sizeof(v_le));
+ dm_tm_inc(tm, le64_to_cpu(v_le));
+}
+
+static void le64_dec(void *context, const void *value_le)
+{
+ struct dm_transaction_manager *tm = context;
+ __le64 v_le;
+
+ memcpy(&v_le, value_le, sizeof(v_le));
+ dm_tm_dec(tm, le64_to_cpu(v_le));
+}
+
+static int le64_equal(void *context, const void *value1_le, const void *value2_le)
+{
+ __le64 v1_le, v2_le;
+
+ memcpy(&v1_le, value1_le, sizeof(v1_le));
+ memcpy(&v2_le, value2_le, sizeof(v2_le));
+ return v1_le == v2_le;
+}
+
+void init_le64_type(struct dm_transaction_manager *tm,
+ struct dm_btree_value_type *vt)
+{
+ vt->context = tm;
+ vt->size = sizeof(__le64);
+ vt->inc = le64_inc;
+ vt->dec = le64_dec;
+ vt->equal = le64_equal;
+}
--- a/drivers/md/persistent-data/dm-btree.c
+++ b/drivers/md/persistent-data/dm-btree.c
@@ -667,12 +667,7 @@ static int insert(struct dm_btree_info *
struct btree_node *n;
struct dm_btree_value_type le64_type;
- le64_type.context = NULL;
- le64_type.size = sizeof(__le64);
- le64_type.inc = NULL;
- le64_type.dec = NULL;
- le64_type.equal = NULL;
-
+ init_le64_type(info->tm, &le64_type);
init_shadow_spine(&spine, info);
for (level = 0; level < (info->levels - 1); level++) {
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 35/79] staging: ion: fix corruption of ion_import_dma_buf
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (33 preceding siblings ...)
2015-10-18 2:05 ` [PATCH 3.14 34/79] dm btree: add ref counting ops for the leaves of top level btrees Greg Kroah-Hartman
@ 2015-10-18 2:05 ` Greg Kroah-Hartman
2015-10-18 2:05 ` [PATCH 3.14 36/79] USB: option: add ZTE PIDs Greg Kroah-Hartman
` (43 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:05 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Shawn Lin, Laura Abbott
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shawn Lin <shawn.lin@rock-chips.com>
commit 6fa92e2bcf6390e64895b12761e851c452d87bd8 upstream.
we found this issue but still exit in lastest kernel. Simply
keep ion_handle_create under mutex_lock to avoid this race.
WARNING: CPU: 2 PID: 2648 at drivers/staging/android/ion/ion.c:512 ion_handle_add+0xb4/0xc0()
ion_handle_add: buffer already found.
Modules linked in: iwlmvm iwlwifi mac80211 cfg80211 compat
CPU: 2 PID: 2648 Comm: TimedEventQueue Tainted: G W 3.14.0 #7
00000000 00000000 9a3efd2c 80faf273 9a3efd6c 9a3efd5c 80935dc9 811d7fd3
9a3efd88 00000a58 812208a0 00000200 80e128d4 80e128d4 8d4ae00c a8cd8600
a8cd8094 9a3efd74 80935e0e 00000009 9a3efd6c 811d7fd3 9a3efd88 9a3efd9c
Call Trace:
[<80faf273>] dump_stack+0x48/0x69
[<80935dc9>] warn_slowpath_common+0x79/0x90
[<80e128d4>] ? ion_handle_add+0xb4/0xc0
[<80e128d4>] ? ion_handle_add+0xb4/0xc0
[<80935e0e>] warn_slowpath_fmt+0x2e/0x30
[<80e128d4>] ion_handle_add+0xb4/0xc0
[<80e144cc>] ion_import_dma_buf+0x8c/0x110
[<80c517c4>] reg_init+0x364/0x7d0
[<80993363>] ? futex_wait+0x123/0x210
[<80992e0e>] ? get_futex_key+0x16e/0x1e0
[<8099308f>] ? futex_wake+0x5f/0x120
[<80c51e19>] vpu_service_ioctl+0x1e9/0x500
[<80994aec>] ? do_futex+0xec/0x8e0
[<80971080>] ? prepare_to_wait_event+0xc0/0xc0
[<80c51c30>] ? reg_init+0x7d0/0x7d0
[<80a22562>] do_vfs_ioctl+0x2d2/0x4c0
[<80b198ad>] ? inode_has_perm.isra.41+0x2d/0x40
[<80b199cf>] ? file_has_perm+0x7f/0x90
[<80b1a5f7>] ? selinux_file_ioctl+0x47/0xf0
[<80a227a8>] SyS_ioctl+0x58/0x80
[<80fb45e8>] syscall_call+0x7/0x7
[<80fb0000>] ? mmc_do_calc_max_discard+0xab/0xe4
Fixes: 83271f626 ("ion: hold reference to handle...")
Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
Reviewed-by: Laura Abbott <labbott@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/android/ion/ion.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/staging/android/ion/ion.c
+++ b/drivers/staging/android/ion/ion.c
@@ -1119,13 +1119,13 @@ struct ion_handle *ion_import_dma_buf(st
mutex_unlock(&client->lock);
goto end;
}
- mutex_unlock(&client->lock);
handle = ion_handle_create(client, buffer);
- if (IS_ERR(handle))
+ if (IS_ERR(handle)) {
+ mutex_unlock(&client->lock);
goto end;
+ }
- mutex_lock(&client->lock);
ret = ion_handle_add(client, handle);
mutex_unlock(&client->lock);
if (ret) {
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 36/79] USB: option: add ZTE PIDs
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (34 preceding siblings ...)
2015-10-18 2:05 ` [PATCH 3.14 35/79] staging: ion: fix corruption of ion_import_dma_buf Greg Kroah-Hartman
@ 2015-10-18 2:05 ` Greg Kroah-Hartman
2015-10-18 2:05 ` [PATCH 3.14 37/79] dm raid: fix round up of default region size Greg Kroah-Hartman
` (42 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:05 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Liu.Zhao, Johan Hovold
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Liu.Zhao" <lzsos369@163.com>
commit 19ab6bc5674a30fdb6a2436b068d19a3c17dc73e upstream.
This is intended to add ZTE device PIDs on kernel.
Signed-off-by: Liu.Zhao <lzsos369@163.com>
[johan: sort the new entries ]
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/option.c | 24 ++++++++++++++++++++++++
1 file changed, 24 insertions(+)
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -276,6 +276,10 @@ static void option_instat_callback(struc
#define ZTE_PRODUCT_MF622 0x0001
#define ZTE_PRODUCT_MF628 0x0015
#define ZTE_PRODUCT_MF626 0x0031
+#define ZTE_PRODUCT_ZM8620_X 0x0396
+#define ZTE_PRODUCT_ME3620_MBIM 0x0426
+#define ZTE_PRODUCT_ME3620_X 0x1432
+#define ZTE_PRODUCT_ME3620_L 0x1433
#define ZTE_PRODUCT_AC2726 0xfff1
#define ZTE_PRODUCT_CDMA_TECH 0xfffe
#define ZTE_PRODUCT_AC8710T 0xffff
@@ -549,6 +553,18 @@ static const struct option_blacklist_inf
.sendsetup = BIT(1) | BIT(2) | BIT(3),
};
+static const struct option_blacklist_info zte_me3620_mbim_blacklist = {
+ .reserved = BIT(2) | BIT(3) | BIT(4),
+};
+
+static const struct option_blacklist_info zte_me3620_xl_blacklist = {
+ .reserved = BIT(3) | BIT(4) | BIT(5),
+};
+
+static const struct option_blacklist_info zte_zm8620_x_blacklist = {
+ .reserved = BIT(3) | BIT(4) | BIT(5),
+};
+
static const struct option_blacklist_info huawei_cdc12_blacklist = {
.reserved = BIT(1) | BIT(2),
};
@@ -1579,6 +1595,14 @@ static const struct usb_device_id option
.driver_info = (kernel_ulong_t)&zte_ad3812_z_blacklist },
{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MC2716, 0xff, 0xff, 0xff),
.driver_info = (kernel_ulong_t)&zte_mc2716_z_blacklist },
+ { USB_DEVICE(ZTE_VENDOR_ID, ZTE_PRODUCT_ME3620_L),
+ .driver_info = (kernel_ulong_t)&zte_me3620_xl_blacklist },
+ { USB_DEVICE(ZTE_VENDOR_ID, ZTE_PRODUCT_ME3620_MBIM),
+ .driver_info = (kernel_ulong_t)&zte_me3620_mbim_blacklist },
+ { USB_DEVICE(ZTE_VENDOR_ID, ZTE_PRODUCT_ME3620_X),
+ .driver_info = (kernel_ulong_t)&zte_me3620_xl_blacklist },
+ { USB_DEVICE(ZTE_VENDOR_ID, ZTE_PRODUCT_ZM8620_X),
+ .driver_info = (kernel_ulong_t)&zte_zm8620_x_blacklist },
{ USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x02, 0x01) },
{ USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x02, 0x05) },
{ USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x86, 0x10) },
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 37/79] dm raid: fix round up of default region size
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (35 preceding siblings ...)
2015-10-18 2:05 ` [PATCH 3.14 36/79] USB: option: add ZTE PIDs Greg Kroah-Hartman
@ 2015-10-18 2:05 ` Greg Kroah-Hartman
2015-10-18 2:05 ` [PATCH 3.14 38/79] netfilter: nf_conntrack: Support expectations in different zones Greg Kroah-Hartman
` (41 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:05 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Mikulas Patocka, Mike Snitzer
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <mpatocka@redhat.com>
commit 042745ee53a0a7c1f5aff191a4a24213c6dcfb52 upstream.
Commit 3a0f9aaee028 ("dm raid: round region_size to power of two")
intended to make sure that the default region size is a power of two.
However, the logic in that commit is incorrect and sets the variable
region_size to 0 or 1, depending on whether min_region_size is a power
of two.
Fix this logic, using roundup_pow_of_two(), so that region_size is
properly rounded up to the next power of two.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Fixes: 3a0f9aaee028 ("dm raid: round region_size to power of two")
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-raid.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/md/dm-raid.c
+++ b/drivers/md/dm-raid.c
@@ -325,8 +325,7 @@ static int validate_region_size(struct r
*/
if (min_region_size > (1 << 13)) {
/* If not a power of 2, make it the next power of 2 */
- if (min_region_size & (min_region_size - 1))
- region_size = 1 << fls(region_size);
+ region_size = roundup_pow_of_two(min_region_size);
DMINFO("Choosing default region size of %lu sectors",
region_size);
} else {
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 38/79] netfilter: nf_conntrack: Support expectations in different zones
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (36 preceding siblings ...)
2015-10-18 2:05 ` [PATCH 3.14 37/79] dm raid: fix round up of default region size Greg Kroah-Hartman
@ 2015-10-18 2:05 ` Greg Kroah-Hartman
2015-10-18 2:05 ` [PATCH 3.14 39/79] netfilter: ctnetlink: put back references to master ct and expect objects Greg Kroah-Hartman
` (40 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:05 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Joe Stringer, Pablo Neira Ayuso
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Stringer <joestringer@nicira.com>
commit 4b31814d20cbe5cd4ccf18089751e77a04afe4f2 upstream.
When zones were originally introduced, the expectation functions were
all extended to perform lookup using the zone. However, insertion was
not modified to check the zone. This means that two expectations which
are intended to apply for different connections that have the same tuple
but exist in different zones cannot both be tracked.
Fixes: 5d0aa2ccd4 (netfilter: nf_conntrack: add support for "conntrack zones")
Signed-off-by: Joe Stringer <joestringer@nicira.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/nf_conntrack_expect.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -202,7 +202,8 @@ static inline int expect_clash(const str
a->mask.src.u3.all[count] & b->mask.src.u3.all[count];
}
- return nf_ct_tuple_mask_cmp(&a->tuple, &b->tuple, &intersect_mask);
+ return nf_ct_tuple_mask_cmp(&a->tuple, &b->tuple, &intersect_mask) &&
+ nf_ct_zone(a->master) == nf_ct_zone(b->master);
}
static inline int expect_matches(const struct nf_conntrack_expect *a,
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 39/79] netfilter: ctnetlink: put back references to master ct and expect objects
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (37 preceding siblings ...)
2015-10-18 2:05 ` [PATCH 3.14 38/79] netfilter: nf_conntrack: Support expectations in different zones Greg Kroah-Hartman
@ 2015-10-18 2:05 ` Greg Kroah-Hartman
2015-10-18 2:05 ` [PATCH 3.14 40/79] netfilter: nft_compat: skip family comparison in case of NFPROTO_UNSPEC Greg Kroah-Hartman
` (39 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:05 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Tim Wiess, Pablo Neira Ayuso
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <pablo@netfilter.org>
commit 95dd8653de658143770cb0e55a58d2aab97c79d2 upstream.
We have to put back the references to the master conntrack and the expectation
that we just created, otherwise we'll leak them.
Fixes: 0ef71ee1a5b9 ("netfilter: ctnetlink: refactor ctnetlink_create_expect")
Reported-by: Tim Wiess <Tim.Wiess@watchguard.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/nf_conntrack_netlink.c | 5 -----
1 file changed, 5 deletions(-)
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -2927,11 +2927,6 @@ ctnetlink_create_expect(struct net *net,
}
err = nf_ct_expect_related_report(exp, portid, report);
- if (err < 0)
- goto err_exp;
-
- return 0;
-err_exp:
nf_ct_expect_put(exp);
err_ct:
nf_ct_put(ct);
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 40/79] netfilter: nft_compat: skip family comparison in case of NFPROTO_UNSPEC
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (38 preceding siblings ...)
2015-10-18 2:05 ` [PATCH 3.14 39/79] netfilter: ctnetlink: put back references to master ct and expect objects Greg Kroah-Hartman
@ 2015-10-18 2:05 ` Greg Kroah-Hartman
2015-10-18 2:05 ` [PATCH 3.14 41/79] disabling oplocks/leases via module parm enable_oplocks broken for SMB3 Greg Kroah-Hartman
` (38 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:05 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Pablo Neira Ayuso
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <pablo@netfilter.org>
commit ba378ca9c04a5fc1b2cf0f0274a9d02eb3d1bad9 upstream.
Fix lookup of existing match/target structures in the corresponding list
by skipping the family check if NFPROTO_UNSPEC is used.
This is resulting in the allocation and insertion of one match/target
structure for each use of them. So this not only bloats memory
consumption but also severely affects the time to reload the ruleset
from the iptables-compat utility.
After this patch, iptables-compat-restore and iptables-compat take
almost the same time to reload large rulesets.
Fixes: 0ca743a55991 ("netfilter: nf_tables: add compatibility layer for x_tables")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/nft_compat.c | 24 ++++++++++++++++++------
1 file changed, 18 insertions(+), 6 deletions(-)
--- a/net/netfilter/nft_compat.c
+++ b/net/netfilter/nft_compat.c
@@ -594,6 +594,13 @@ struct nft_xt {
static struct nft_expr_type nft_match_type;
+static bool nft_match_cmp(const struct xt_match *match,
+ const char *name, u32 rev, u32 family)
+{
+ return strcmp(match->name, name) == 0 && match->revision == rev &&
+ (match->family == NFPROTO_UNSPEC || match->family == family);
+}
+
static const struct nft_expr_ops *
nft_match_select_ops(const struct nft_ctx *ctx,
const struct nlattr * const tb[])
@@ -601,7 +608,7 @@ nft_match_select_ops(const struct nft_ct
struct nft_xt *nft_match;
struct xt_match *match;
char *mt_name;
- __u32 rev, family;
+ u32 rev, family;
if (tb[NFTA_MATCH_NAME] == NULL ||
tb[NFTA_MATCH_REV] == NULL ||
@@ -616,8 +623,7 @@ nft_match_select_ops(const struct nft_ct
list_for_each_entry(nft_match, &nft_match_list, head) {
struct xt_match *match = nft_match->ops.data;
- if (strcmp(match->name, mt_name) == 0 &&
- match->revision == rev && match->family == family) {
+ if (nft_match_cmp(match, mt_name, rev, family)) {
if (!try_module_get(match->me))
return ERR_PTR(-ENOENT);
@@ -669,6 +675,13 @@ static LIST_HEAD(nft_target_list);
static struct nft_expr_type nft_target_type;
+static bool nft_target_cmp(const struct xt_target *tg,
+ const char *name, u32 rev, u32 family)
+{
+ return strcmp(tg->name, name) == 0 && tg->revision == rev &&
+ (tg->family == NFPROTO_UNSPEC || tg->family == family);
+}
+
static const struct nft_expr_ops *
nft_target_select_ops(const struct nft_ctx *ctx,
const struct nlattr * const tb[])
@@ -676,7 +689,7 @@ nft_target_select_ops(const struct nft_c
struct nft_xt *nft_target;
struct xt_target *target;
char *tg_name;
- __u32 rev, family;
+ u32 rev, family;
if (tb[NFTA_TARGET_NAME] == NULL ||
tb[NFTA_TARGET_REV] == NULL ||
@@ -691,8 +704,7 @@ nft_target_select_ops(const struct nft_c
list_for_each_entry(nft_target, &nft_target_list, head) {
struct xt_target *target = nft_target->ops.data;
- if (strcmp(target->name, tg_name) == 0 &&
- target->revision == rev && target->family == family) {
+ if (nft_target_cmp(target, tg_name, rev, family)) {
if (!try_module_get(target->me))
return ERR_PTR(-ENOENT);
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 41/79] disabling oplocks/leases via module parm enable_oplocks broken for SMB3
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (39 preceding siblings ...)
2015-10-18 2:05 ` [PATCH 3.14 40/79] netfilter: nft_compat: skip family comparison in case of NFPROTO_UNSPEC Greg Kroah-Hartman
@ 2015-10-18 2:05 ` Greg Kroah-Hartman
2015-10-18 2:05 ` [PATCH 3.14 42/79] drm/qxl: only report first monitor as connected if we have no state Greg Kroah-Hartman
` (37 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:05 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Steve French, Chandrika Srinivasan
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steve French <smfrench@gmail.com>
commit e0ddde9d44e37fbc21ce893553094ecf1a633ab5 upstream.
leases (oplocks) were always requested for SMB2/SMB3 even when oplocks
disabled in the cifs.ko module.
Signed-off-by: Steve French <steve.french@primarydata.com>
Reviewed-by: Chandrika Srinivasan <chandrika.srinivasan@citrix.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/cifs/smb2ops.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -49,9 +49,13 @@ change_conf(struct TCP_Server_Info *serv
break;
default:
server->echoes = true;
- server->oplocks = true;
+ if (enable_oplocks) {
+ server->oplocks = true;
+ server->oplock_credits = 1;
+ } else
+ server->oplocks = false;
+
server->echo_credits = 1;
- server->oplock_credits = 1;
}
server->credits -= server->echo_credits + server->oplock_credits;
return 0;
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 42/79] drm/qxl: only report first monitor as connected if we have no state
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (40 preceding siblings ...)
2015-10-18 2:05 ` [PATCH 3.14 41/79] disabling oplocks/leases via module parm enable_oplocks broken for SMB3 Greg Kroah-Hartman
@ 2015-10-18 2:05 ` Greg Kroah-Hartman
2016-05-27 11:06 ` Jiri Slaby
2015-10-18 2:05 ` [PATCH 3.14 44/79] drm: Reject DRI1 hw lock ioctl functions for kms drivers Greg Kroah-Hartman
` (36 subsequent siblings)
78 siblings, 1 reply; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:05 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dave Airlie
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Airlie <airlied@redhat.com>
commit 69e5d3f893e19613486f300fd6e631810338aa4b upstream.
If the server isn't new enough to give us state, report the first
monitor as always connected, otherwise believe the server side.
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/qxl/qxl_display.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
--- a/drivers/gpu/drm/qxl/qxl_display.c
+++ b/drivers/gpu/drm/qxl/qxl_display.c
@@ -816,13 +816,15 @@ static enum drm_connector_status qxl_con
drm_connector_to_qxl_output(connector);
struct drm_device *ddev = connector->dev;
struct qxl_device *qdev = ddev->dev_private;
- int connected;
+ bool connected = false;
/* The first monitor is always connected */
- connected = (output->index == 0) ||
- (qdev->client_monitors_config &&
- qdev->client_monitors_config->count > output->index &&
- qxl_head_enabled(&qdev->client_monitors_config->heads[output->index]));
+ if (!qdev->client_monitors_config) {
+ if (output->index == 0)
+ connected = true;
+ } else
+ connected = qdev->client_monitors_config->count > output->index &&
+ qxl_head_enabled(&qdev->client_monitors_config->heads[output->index]);
DRM_DEBUG("#%d connected: %d\n", output->index, connected);
if (!connected)
^ permalink raw reply [flat|nested] 88+ messages in thread* Re: [PATCH 3.14 42/79] drm/qxl: only report first monitor as connected if we have no state
2015-10-18 2:05 ` [PATCH 3.14 42/79] drm/qxl: only report first monitor as connected if we have no state Greg Kroah-Hartman
@ 2016-05-27 11:06 ` Jiri Slaby
2016-05-27 11:13 ` Jiri Slaby
2016-08-14 14:51 ` Greg Kroah-Hartman
0 siblings, 2 replies; 88+ messages in thread
From: Jiri Slaby @ 2016-05-27 11:06 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel; +Cc: stable, Dave Airlie
On 10/18/2015, 04:05 AM, Greg Kroah-Hartman wrote:
> 3.14-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Dave Airlie <airlied@redhat.com>
>
> commit 69e5d3f893e19613486f300fd6e631810338aa4b upstream.
>
> If the server isn't new enough to give us state, report the first
> monitor as always connected, otherwise believe the server side.
Hi,
I've got a bug report, that this commit breaks 3.12-stable:
===============
While testing KDE5 packages which will be landing in Package Hub for
SP1, we found a issue with qxl drm driver in kernel.
When booting SLES (or SLED) 12 SP1, in a libvirt KVM environment, with
QXL as video driver, KDE5 plasma was not rendered on screen, you could
only see mouse cursor.
Booting with nomodeset=1 or qxl.modeset=0 fixes the issue.
===============
Does it make sense? Is 3.12 missing some prerequisite? Or should we just
revert the commit in 3.12? And what about 3.14, 4.1?
Thanks.
> Signed-off-by: Dave Airlie <airlied@redhat.com>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
>
> ---
> drivers/gpu/drm/qxl/qxl_display.c | 12 +++++++-----
> 1 file changed, 7 insertions(+), 5 deletions(-)
>
> --- a/drivers/gpu/drm/qxl/qxl_display.c
> +++ b/drivers/gpu/drm/qxl/qxl_display.c
> @@ -816,13 +816,15 @@ static enum drm_connector_status qxl_con
> drm_connector_to_qxl_output(connector);
> struct drm_device *ddev = connector->dev;
> struct qxl_device *qdev = ddev->dev_private;
> - int connected;
> + bool connected = false;
>
> /* The first monitor is always connected */
> - connected = (output->index == 0) ||
> - (qdev->client_monitors_config &&
> - qdev->client_monitors_config->count > output->index &&
> - qxl_head_enabled(&qdev->client_monitors_config->heads[output->index]));
> + if (!qdev->client_monitors_config) {
> + if (output->index == 0)
> + connected = true;
> + } else
> + connected = qdev->client_monitors_config->count > output->index &&
> + qxl_head_enabled(&qdev->client_monitors_config->heads[output->index]);
>
> DRM_DEBUG("#%d connected: %d\n", output->index, connected);
> if (!connected)
--
js
suse labs
^ permalink raw reply [flat|nested] 88+ messages in thread* Re: [PATCH 3.14 42/79] drm/qxl: only report first monitor as connected if we have no state
2016-05-27 11:06 ` Jiri Slaby
@ 2016-05-27 11:13 ` Jiri Slaby
2016-08-14 14:51 ` Greg Kroah-Hartman
1 sibling, 0 replies; 88+ messages in thread
From: Jiri Slaby @ 2016-05-27 11:13 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel; +Cc: stable, Dave Airlie
On 05/27/2016, 01:06 PM, Jiri Slaby wrote:
> On 10/18/2015, 04:05 AM, Greg Kroah-Hartman wrote:
>> 3.14-stable review patch. If anyone has any objections, please let me know.
>>
>> ------------------
>>
>> From: Dave Airlie <airlied@redhat.com>
>>
>> commit 69e5d3f893e19613486f300fd6e631810338aa4b upstream.
>>
>> If the server isn't new enough to give us state, report the first
>> monitor as always connected, otherwise believe the server side.
>
> Hi,
>
> I've got a bug report, that this commit breaks 3.12-stable:
> ===============
> While testing KDE5 packages which will be landing in Package Hub for
> SP1, we found a issue with qxl drm driver in kernel.
>
> When booting SLES (or SLED) 12 SP1, in a libvirt KVM environment, with
> QXL as video driver, KDE5 plasma was not rendered on screen, you could
> only see mouse cursor.
>
> Booting with nomodeset=1 or qxl.modeset=0 fixes the issue.
> ===============
>
> Does it make sense? Is 3.12 missing some prerequisite? Or should we just
> revert the commit in 3.12? And what about 3.14, 4.1?
Also, I am attaching xrandr outputs:
(bad) xrandr
Screen 0: minimum 320 x 200, current 1024 x 768, maximum 8192 x 8192
Virtual-0 disconnected primary 1024x768+0+0 0mm x 0mm
Virtual-1 disconnected
Virtual-2 disconnected
Virtual-3 disconnected
1024x768 (0x47) 63.5MHz
h: width 1024 start 1072 end 1176 total 1328 skew 0 clock
47.8KHz
v: height 768 start 771 end 775 total 798 clock
59.9Hz
(good) xrandr
Screen 0: minimum 320 x 200, current 1024 x 768, maximum 8192 x 8192
Virtual-0 connected primary 1024x768+0+0 0mm x 0mm
1024x768 59.9*+
0x0 0.0 +
1920x1200 59.9
1920x1080 60.0
1600x1200 59.9
1680x1050 60.0
1400x1050 60.0
1280x1024 59.9
1440x900 59.9
1280x960 59.9
1280x854 59.9
1280x800 59.8
1280x720 59.9
1152x768 59.8
800x600 59.9
848x480 59.7
720x480 59.7
640x480 59.4
Virtual-1 disconnected
Virtual-2 disconnected
Virtual-3 disconnected
> Thanks.
>
>> Signed-off-by: Dave Airlie <airlied@redhat.com>
>> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
>>
>> ---
>> drivers/gpu/drm/qxl/qxl_display.c | 12 +++++++-----
>> 1 file changed, 7 insertions(+), 5 deletions(-)
>>
>> --- a/drivers/gpu/drm/qxl/qxl_display.c
>> +++ b/drivers/gpu/drm/qxl/qxl_display.c
>> @@ -816,13 +816,15 @@ static enum drm_connector_status qxl_con
>> drm_connector_to_qxl_output(connector);
>> struct drm_device *ddev = connector->dev;
>> struct qxl_device *qdev = ddev->dev_private;
>> - int connected;
>> + bool connected = false;
>>
>> /* The first monitor is always connected */
>> - connected = (output->index == 0) ||
>> - (qdev->client_monitors_config &&
>> - qdev->client_monitors_config->count > output->index &&
>> - qxl_head_enabled(&qdev->client_monitors_config->heads[output->index]));
>> + if (!qdev->client_monitors_config) {
>> + if (output->index == 0)
>> + connected = true;
>> + } else
>> + connected = qdev->client_monitors_config->count > output->index &&
>> + qxl_head_enabled(&qdev->client_monitors_config->heads[output->index]);
>>
>> DRM_DEBUG("#%d connected: %d\n", output->index, connected);
>> if (!connected)
>
>
>
--
js
suse labs
^ permalink raw reply [flat|nested] 88+ messages in thread* Re: [PATCH 3.14 42/79] drm/qxl: only report first monitor as connected if we have no state
2016-05-27 11:06 ` Jiri Slaby
2016-05-27 11:13 ` Jiri Slaby
@ 2016-08-14 14:51 ` Greg Kroah-Hartman
2016-08-16 8:21 ` Jiri Slaby
1 sibling, 1 reply; 88+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-14 14:51 UTC (permalink / raw)
To: Jiri Slaby; +Cc: linux-kernel, stable, Dave Airlie
On Fri, May 27, 2016 at 01:06:24PM +0200, Jiri Slaby wrote:
> On 10/18/2015, 04:05 AM, Greg Kroah-Hartman wrote:
> > 3.14-stable review patch. If anyone has any objections, please let me know.
> >
> > ------------------
> >
> > From: Dave Airlie <airlied@redhat.com>
> >
> > commit 69e5d3f893e19613486f300fd6e631810338aa4b upstream.
> >
> > If the server isn't new enough to give us state, report the first
> > monitor as always connected, otherwise believe the server side.
>
> Hi,
>
> I've got a bug report, that this commit breaks 3.12-stable:
> ===============
> While testing KDE5 packages which will be landing in Package Hub for
> SP1, we found a issue with qxl drm driver in kernel.
>
> When booting SLES (or SLED) 12 SP1, in a libvirt KVM environment, with
> QXL as video driver, KDE5 plasma was not rendered on screen, you could
> only see mouse cursor.
>
> Booting with nomodeset=1 or qxl.modeset=0 fixes the issue.
> ===============
>
> Does it make sense? Is 3.12 missing some prerequisite? Or should we just
> revert the commit in 3.12? And what about 3.14, 4.1?
What ever happened to this? Did you revert this in 3.12-stable?
thanks,
greg k-h
^ permalink raw reply [flat|nested] 88+ messages in thread
* Re: [PATCH 3.14 42/79] drm/qxl: only report first monitor as connected if we have no state
2016-08-14 14:51 ` Greg Kroah-Hartman
@ 2016-08-16 8:21 ` Jiri Slaby
0 siblings, 0 replies; 88+ messages in thread
From: Jiri Slaby @ 2016-08-16 8:21 UTC (permalink / raw)
To: Greg Kroah-Hartman; +Cc: linux-kernel, stable, Dave Airlie
On 08/14/2016, 04:51 PM, Greg Kroah-Hartman wrote:
> On Fri, May 27, 2016 at 01:06:24PM +0200, Jiri Slaby wrote:
>> On 10/18/2015, 04:05 AM, Greg Kroah-Hartman wrote:
>>> 3.14-stable review patch. If anyone has any objections, please let me know.
>>>
>>> ------------------
>>>
>>> From: Dave Airlie <airlied@redhat.com>
>>>
>>> commit 69e5d3f893e19613486f300fd6e631810338aa4b upstream.
>>>
>>> If the server isn't new enough to give us state, report the first
>>> monitor as always connected, otherwise believe the server side.
>>
>> Hi,
>>
>> I've got a bug report, that this commit breaks 3.12-stable:
>> ===============
>> While testing KDE5 packages which will be landing in Package Hub for
>> SP1, we found a issue with qxl drm driver in kernel.
>>
>> When booting SLES (or SLED) 12 SP1, in a libvirt KVM environment, with
>> QXL as video driver, KDE5 plasma was not rendered on screen, you could
>> only see mouse cursor.
>>
>> Booting with nomodeset=1 or qxl.modeset=0 fixes the issue.
>> ===============
>>
>> Does it make sense? Is 3.12 missing some prerequisite? Or should we just
>> revert the commit in 3.12? And what about 3.14, 4.1?
>
> What ever happened to this? Did you revert this in 3.12-stable?
I forgot about this completely, so I took no action back then. Neither
was this reverted in SLE. Neither I saw any other report since then. And
given it was released in Nov 2015, perhaps, I won't do anything with
that, assuming this was kvm issue or something.
thanks,
--
js
suse labs
^ permalink raw reply [flat|nested] 88+ messages in thread
* [PATCH 3.14 44/79] drm: Reject DRI1 hw lock ioctl functions for kms drivers
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (41 preceding siblings ...)
2015-10-18 2:05 ` [PATCH 3.14 42/79] drm/qxl: only report first monitor as connected if we have no state Greg Kroah-Hartman
@ 2015-10-18 2:05 ` Greg Kroah-Hartman
2015-10-18 2:05 ` [PATCH 3.14 45/79] USB: whiteheat: fix potential null-deref at probe Greg Kroah-Hartman
` (35 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:05 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Peter Antoine, Daniel Vetter
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Vetter <daniel.vetter@ffwll.ch>
commit da168d81b44898404d281d5dbe70154ab5f117c1 upstream.
I've done some extensive history digging across libdrm, mesa and
xf86-video-{intel,nouveau,ati}. The only potential user of this with
kms drivers I could find was ttmtest, which once used drmGetLock
still. But that mistake was quickly fixed up. Even the intel xvmc
library (which otherwise was really good with using dri1 stuff in kms
mode) managed to never take the hw lock for dri2 (and hence kms).
Hence it should be save to unconditionally disallow this.
Cc: Peter Antoine <peter.antoine@intel.com>
Reviewed-by: Peter Antoine <peter.antoine@intel.com>
Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/drm_lock.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/gpu/drm/drm_lock.c
+++ b/drivers/gpu/drm/drm_lock.c
@@ -58,6 +58,9 @@ int drm_lock(struct drm_device *dev, voi
struct drm_master *master = file_priv->master;
int ret = 0;
+ if (drm_core_check_feature(dev, DRIVER_MODESET))
+ return -EINVAL;
+
++file_priv->lock_count;
if (lock->context == DRM_KERNEL_CONTEXT) {
@@ -150,6 +153,9 @@ int drm_unlock(struct drm_device *dev, v
struct drm_lock *lock = data;
struct drm_master *master = file_priv->master;
+ if (drm_core_check_feature(dev, DRIVER_MODESET))
+ return -EINVAL;
+
if (lock->context == DRM_KERNEL_CONTEXT) {
DRM_ERROR("Process %d using kernel context %d\n",
task_pid_nr(current), lock->context);
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 45/79] USB: whiteheat: fix potential null-deref at probe
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (42 preceding siblings ...)
2015-10-18 2:05 ` [PATCH 3.14 44/79] drm: Reject DRI1 hw lock ioctl functions for kms drivers Greg Kroah-Hartman
@ 2015-10-18 2:05 ` Greg Kroah-Hartman
2015-10-18 2:05 ` [PATCH 3.14 46/79] usb: xhci: Clear XHCI_STATE_DYING on start Greg Kroah-Hartman
` (34 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:05 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Moein Ghasemzadeh, Johan Hovold
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit cbb4be652d374f64661137756b8f357a1827d6a4 upstream.
Fix potential null-pointer dereference at probe by making sure that the
required endpoints are present.
The whiteheat driver assumes there are at least five pairs of bulk
endpoints, of which the final pair is used for the "command port". An
attempt to bind to an interface with fewer bulk endpoints would
currently lead to an oops.
Fixes CVE-2015-5257.
Reported-by: Moein Ghasemzadeh <moein@istuary.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/whiteheat.c | 31 +++++++++++++++++++++++++++++++
1 file changed, 31 insertions(+)
--- a/drivers/usb/serial/whiteheat.c
+++ b/drivers/usb/serial/whiteheat.c
@@ -80,6 +80,8 @@ static int whiteheat_firmware_download(
static int whiteheat_firmware_attach(struct usb_serial *serial);
/* function prototypes for the Connect Tech WhiteHEAT serial converter */
+static int whiteheat_probe(struct usb_serial *serial,
+ const struct usb_device_id *id);
static int whiteheat_attach(struct usb_serial *serial);
static void whiteheat_release(struct usb_serial *serial);
static int whiteheat_port_probe(struct usb_serial_port *port);
@@ -116,6 +118,7 @@ static struct usb_serial_driver whitehea
.description = "Connect Tech - WhiteHEAT",
.id_table = id_table_std,
.num_ports = 4,
+ .probe = whiteheat_probe,
.attach = whiteheat_attach,
.release = whiteheat_release,
.port_probe = whiteheat_port_probe,
@@ -217,6 +220,34 @@ static int whiteheat_firmware_attach(str
/*****************************************************************************
* Connect Tech's White Heat serial driver functions
*****************************************************************************/
+
+static int whiteheat_probe(struct usb_serial *serial,
+ const struct usb_device_id *id)
+{
+ struct usb_host_interface *iface_desc;
+ struct usb_endpoint_descriptor *endpoint;
+ size_t num_bulk_in = 0;
+ size_t num_bulk_out = 0;
+ size_t min_num_bulk;
+ unsigned int i;
+
+ iface_desc = serial->interface->cur_altsetting;
+
+ for (i = 0; i < iface_desc->desc.bNumEndpoints; i++) {
+ endpoint = &iface_desc->endpoint[i].desc;
+ if (usb_endpoint_is_bulk_in(endpoint))
+ ++num_bulk_in;
+ if (usb_endpoint_is_bulk_out(endpoint))
+ ++num_bulk_out;
+ }
+
+ min_num_bulk = COMMAND_PORT + 1;
+ if (num_bulk_in < min_num_bulk || num_bulk_out < min_num_bulk)
+ return -ENODEV;
+
+ return 0;
+}
+
static int whiteheat_attach(struct usb_serial *serial)
{
struct usb_serial_port *command_port;
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 46/79] usb: xhci: Clear XHCI_STATE_DYING on start
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (43 preceding siblings ...)
2015-10-18 2:05 ` [PATCH 3.14 45/79] USB: whiteheat: fix potential null-deref at probe Greg Kroah-Hartman
@ 2015-10-18 2:05 ` Greg Kroah-Hartman
2015-10-18 2:05 ` [PATCH 3.14 47/79] xhci: change xhci 1.0 only restrictions to support xhci 1.1 Greg Kroah-Hartman
` (33 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:05 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Roger Quadros, Mathias Nyman
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roger Quadros <rogerq@ti.com>
commit e5bfeab0ad515b4f6df39fe716603e9dc6d3dfd0 upstream.
For whatever reason if XHCI died in the previous instant
then it will never recover on the next xhci_start unless we
clear the DYING flag.
Signed-off-by: Roger Quadros <rogerq@ti.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -147,7 +147,8 @@ static int xhci_start(struct xhci_hcd *x
"waited %u microseconds.\n",
XHCI_MAX_HALT_USEC);
if (!ret)
- xhci->xhc_state &= ~XHCI_STATE_HALTED;
+ xhci->xhc_state &= ~(XHCI_STATE_HALTED | XHCI_STATE_DYING);
+
return ret;
}
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 47/79] xhci: change xhci 1.0 only restrictions to support xhci 1.1
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (44 preceding siblings ...)
2015-10-18 2:05 ` [PATCH 3.14 46/79] usb: xhci: Clear XHCI_STATE_DYING on start Greg Kroah-Hartman
@ 2015-10-18 2:05 ` Greg Kroah-Hartman
2015-10-18 2:05 ` [PATCH 3.14 48/79] usb: xhci: Add support for URB_ZERO_PACKET to bulk/sg transfers Greg Kroah-Hartman
` (32 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:05 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Mathias Nyman
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <mathias.nyman@linux.intel.com>
commit dca7794539eff04b786fb6907186989e5eaaa9c2 upstream.
Some changes between xhci 0.96 and xhci 1.0 specifications forced us to
check the hci version in code, some of these checks were implemented as
hci_version == 1.0, which will not work with new xhci 1.1 controllers.
xhci 1.1 behaves similar to xhci 1.0 in these cases, so change these
checks to hci_version >= 1.0
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci-mem.c | 6 +++---
drivers/usb/host/xhci-ring.c | 4 ++--
2 files changed, 5 insertions(+), 5 deletions(-)
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -1402,10 +1402,10 @@ int xhci_endpoint_init(struct xhci_hcd *
* use Event Data TRBs, and we don't chain in a link TRB on short
* transfers, we're basically dividing by 1.
*
- * xHCI 1.0 specification indicates that the Average TRB Length should
- * be set to 8 for control endpoints.
+ * xHCI 1.0 and 1.1 specification indicates that the Average TRB Length
+ * should be set to 8 for control endpoints.
*/
- if (usb_endpoint_xfer_control(&ep->desc) && xhci->hci_version == 0x100)
+ if (usb_endpoint_xfer_control(&ep->desc) && xhci->hci_version >= 0x100)
ep_ctx->tx_info |= cpu_to_le32(AVG_TRB_LENGTH_FOR_EP(8));
else
ep_ctx->tx_info |=
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -3567,8 +3567,8 @@ int xhci_queue_ctrl_tx(struct xhci_hcd *
if (start_cycle == 0)
field |= 0x1;
- /* xHCI 1.0 6.4.1.2.1: Transfer Type field */
- if (xhci->hci_version == 0x100) {
+ /* xHCI 1.0/1.1 6.4.1.2.1: Transfer Type field */
+ if (xhci->hci_version >= 0x100) {
if (urb->transfer_buffer_length > 0) {
if (setup->bRequestType & USB_DIR_IN)
field |= TRB_TX_TYPE(TRB_DATA_IN);
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 48/79] usb: xhci: Add support for URB_ZERO_PACKET to bulk/sg transfers
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (45 preceding siblings ...)
2015-10-18 2:05 ` [PATCH 3.14 47/79] xhci: change xhci 1.0 only restrictions to support xhci 1.1 Greg Kroah-Hartman
@ 2015-10-18 2:05 ` Greg Kroah-Hartman
2015-10-18 2:05 ` [PATCH 3.14 49/79] Initialize msg/shm IPC objects before doing ipc_addid() Greg Kroah-Hartman
` (31 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:05 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Reyad Attiyat, Mathias Nyman, Oliver Neukum
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Reyad Attiyat <reyad.attiyat@gmail.com>
commit 4758dcd19a7d9ba9610b38fecb93f65f56f86346 upstream.
This commit checks for the URB_ZERO_PACKET flag and creates an extra
zero-length td if the urb transfer length is a multiple of the endpoint's
max packet length.
Signed-off-by: Reyad Attiyat <reyad.attiyat@gmail.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Cc: Oliver Neukum <oneukum@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci-ring.c | 66 +++++++++++++++++++++++++++++++++----------
drivers/usb/host/xhci.c | 5 +++
2 files changed, 57 insertions(+), 14 deletions(-)
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -3223,9 +3223,11 @@ static int queue_bulk_sg_tx(struct xhci_
struct xhci_td *td;
struct scatterlist *sg;
int num_sgs;
- int trb_buff_len, this_sg_len, running_total;
+ int trb_buff_len, this_sg_len, running_total, ret;
unsigned int total_packet_count;
+ bool zero_length_needed;
bool first_trb;
+ int last_trb_num;
u64 addr;
bool more_trbs_coming;
@@ -3241,13 +3243,27 @@ static int queue_bulk_sg_tx(struct xhci_
total_packet_count = DIV_ROUND_UP(urb->transfer_buffer_length,
usb_endpoint_maxp(&urb->ep->desc));
- trb_buff_len = prepare_transfer(xhci, xhci->devs[slot_id],
+ ret = prepare_transfer(xhci, xhci->devs[slot_id],
ep_index, urb->stream_id,
num_trbs, urb, 0, mem_flags);
- if (trb_buff_len < 0)
- return trb_buff_len;
+ if (ret < 0)
+ return ret;
urb_priv = urb->hcpriv;
+
+ /* Deal with URB_ZERO_PACKET - need one more td/trb */
+ zero_length_needed = urb->transfer_flags & URB_ZERO_PACKET &&
+ urb_priv->length == 2;
+ if (zero_length_needed) {
+ num_trbs++;
+ xhci_dbg(xhci, "Creating zero length td.\n");
+ ret = prepare_transfer(xhci, xhci->devs[slot_id],
+ ep_index, urb->stream_id,
+ 1, urb, 1, mem_flags);
+ if (ret < 0)
+ return ret;
+ }
+
td = urb_priv->td[0];
/*
@@ -3277,6 +3293,7 @@ static int queue_bulk_sg_tx(struct xhci_
trb_buff_len = urb->transfer_buffer_length;
first_trb = true;
+ last_trb_num = zero_length_needed ? 2 : 1;
/* Queue the first TRB, even if it's zero-length */
do {
u32 field = 0;
@@ -3294,12 +3311,15 @@ static int queue_bulk_sg_tx(struct xhci_
/* Chain all the TRBs together; clear the chain bit in the last
* TRB to indicate it's the last TRB in the chain.
*/
- if (num_trbs > 1) {
+ if (num_trbs > last_trb_num) {
field |= TRB_CHAIN;
- } else {
- /* FIXME - add check for ZERO_PACKET flag before this */
+ } else if (num_trbs == last_trb_num) {
td->last_trb = ep_ring->enqueue;
field |= TRB_IOC;
+ } else if (zero_length_needed && num_trbs == 1) {
+ trb_buff_len = 0;
+ urb_priv->td[1]->last_trb = ep_ring->enqueue;
+ field |= TRB_IOC;
}
/* Only set interrupt on short packet for IN endpoints */
@@ -3361,7 +3381,7 @@ static int queue_bulk_sg_tx(struct xhci_
if (running_total + trb_buff_len > urb->transfer_buffer_length)
trb_buff_len =
urb->transfer_buffer_length - running_total;
- } while (running_total < urb->transfer_buffer_length);
+ } while (num_trbs > 0);
check_trb_math(urb, num_trbs, running_total);
giveback_first_trb(xhci, slot_id, ep_index, urb->stream_id,
@@ -3379,7 +3399,9 @@ int xhci_queue_bulk_tx(struct xhci_hcd *
int num_trbs;
struct xhci_generic_trb *start_trb;
bool first_trb;
+ int last_trb_num;
bool more_trbs_coming;
+ bool zero_length_needed;
int start_cycle;
u32 field, length_field;
@@ -3410,7 +3432,6 @@ int xhci_queue_bulk_tx(struct xhci_hcd *
num_trbs++;
running_total += TRB_MAX_BUFF_SIZE;
}
- /* FIXME: this doesn't deal with URB_ZERO_PACKET - need one more */
ret = prepare_transfer(xhci, xhci->devs[slot_id],
ep_index, urb->stream_id,
@@ -3419,6 +3440,20 @@ int xhci_queue_bulk_tx(struct xhci_hcd *
return ret;
urb_priv = urb->hcpriv;
+
+ /* Deal with URB_ZERO_PACKET - need one more td/trb */
+ zero_length_needed = urb->transfer_flags & URB_ZERO_PACKET &&
+ urb_priv->length == 2;
+ if (zero_length_needed) {
+ num_trbs++;
+ xhci_dbg(xhci, "Creating zero length td.\n");
+ ret = prepare_transfer(xhci, xhci->devs[slot_id],
+ ep_index, urb->stream_id,
+ 1, urb, 1, mem_flags);
+ if (ret < 0)
+ return ret;
+ }
+
td = urb_priv->td[0];
/*
@@ -3440,7 +3475,7 @@ int xhci_queue_bulk_tx(struct xhci_hcd *
trb_buff_len = urb->transfer_buffer_length;
first_trb = true;
-
+ last_trb_num = zero_length_needed ? 2 : 1;
/* Queue the first TRB, even if it's zero-length */
do {
u32 remainder = 0;
@@ -3457,12 +3492,15 @@ int xhci_queue_bulk_tx(struct xhci_hcd *
/* Chain all the TRBs together; clear the chain bit in the last
* TRB to indicate it's the last TRB in the chain.
*/
- if (num_trbs > 1) {
+ if (num_trbs > last_trb_num) {
field |= TRB_CHAIN;
- } else {
- /* FIXME - add check for ZERO_PACKET flag before this */
+ } else if (num_trbs == last_trb_num) {
td->last_trb = ep_ring->enqueue;
field |= TRB_IOC;
+ } else if (zero_length_needed && num_trbs == 1) {
+ trb_buff_len = 0;
+ urb_priv->td[1]->last_trb = ep_ring->enqueue;
+ field |= TRB_IOC;
}
/* Only set interrupt on short packet for IN endpoints */
@@ -3500,7 +3538,7 @@ int xhci_queue_bulk_tx(struct xhci_hcd *
trb_buff_len = urb->transfer_buffer_length - running_total;
if (trb_buff_len > TRB_MAX_BUFF_SIZE)
trb_buff_len = TRB_MAX_BUFF_SIZE;
- } while (running_total < urb->transfer_buffer_length);
+ } while (num_trbs > 0);
check_trb_math(urb, num_trbs, running_total);
giveback_first_trb(xhci, slot_id, ep_index, urb->stream_id,
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -1320,6 +1320,11 @@ int xhci_urb_enqueue(struct usb_hcd *hcd
if (usb_endpoint_xfer_isoc(&urb->ep->desc))
size = urb->number_of_packets;
+ else if (usb_endpoint_is_bulk_out(&urb->ep->desc) &&
+ urb->transfer_buffer_length > 0 &&
+ urb->transfer_flags & URB_ZERO_PACKET &&
+ !(urb->transfer_buffer_length % usb_endpoint_maxp(&urb->ep->desc)))
+ size = 2;
else
size = 1;
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 49/79] Initialize msg/shm IPC objects before doing ipc_addid()
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (46 preceding siblings ...)
2015-10-18 2:05 ` [PATCH 3.14 48/79] usb: xhci: Add support for URB_ZERO_PACKET to bulk/sg transfers Greg Kroah-Hartman
@ 2015-10-18 2:05 ` Greg Kroah-Hartman
2015-10-18 2:05 ` [PATCH 3.14 50/79] ipvs: do not use random local source address for tunnels Greg Kroah-Hartman
` (30 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:05 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dmitry Vyukov, Manfred Spraul,
Davidlohr Bueso, Linus Torvalds
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Torvalds <torvalds@linux-foundation.org>
commit b9a532277938798b53178d5a66af6e2915cb27cf upstream.
As reported by Dmitry Vyukov, we really shouldn't do ipc_addid() before
having initialized the IPC object state. Yes, we initialize the IPC
object in a locked state, but with all the lockless RCU lookup work,
that IPC object lock no longer means that the state cannot be seen.
We already did this for the IPC semaphore code (see commit e8577d1f0329:
"ipc/sem.c: fully initialize sem_array before making it visible") but we
clearly forgot about msg and shm.
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Cc: Manfred Spraul <manfred@colorfullife.com>
Cc: Davidlohr Bueso <dbueso@suse.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
ipc/msg.c | 14 +++++++-------
ipc/shm.c | 12 ++++++------
ipc/util.c | 8 ++++----
3 files changed, 17 insertions(+), 17 deletions(-)
--- a/ipc/msg.c
+++ b/ipc/msg.c
@@ -202,13 +202,6 @@ static int newque(struct ipc_namespace *
return retval;
}
- /* ipc_addid() locks msq upon success. */
- id = ipc_addid(&msg_ids(ns), &msq->q_perm, ns->msg_ctlmni);
- if (id < 0) {
- ipc_rcu_putref(msq, msg_rcu_free);
- return id;
- }
-
msq->q_stime = msq->q_rtime = 0;
msq->q_ctime = get_seconds();
msq->q_cbytes = msq->q_qnum = 0;
@@ -218,6 +211,13 @@ static int newque(struct ipc_namespace *
INIT_LIST_HEAD(&msq->q_receivers);
INIT_LIST_HEAD(&msq->q_senders);
+ /* ipc_addid() locks msq upon success. */
+ id = ipc_addid(&msg_ids(ns), &msq->q_perm, ns->msg_ctlmni);
+ if (id < 0) {
+ ipc_rcu_putref(msq, msg_rcu_free);
+ return id;
+ }
+
ipc_unlock_object(&msq->q_perm);
rcu_read_unlock();
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -543,12 +543,6 @@ static int newseg(struct ipc_namespace *
if (IS_ERR(file))
goto no_file;
- id = ipc_addid(&shm_ids(ns), &shp->shm_perm, ns->shm_ctlmni);
- if (id < 0) {
- error = id;
- goto no_id;
- }
-
shp->shm_cprid = task_tgid_vnr(current);
shp->shm_lprid = 0;
shp->shm_atim = shp->shm_dtim = 0;
@@ -558,6 +552,12 @@ static int newseg(struct ipc_namespace *
shp->shm_file = file;
shp->shm_creator = current;
+ id = ipc_addid(&shm_ids(ns), &shp->shm_perm, ns->shm_ctlmni);
+ if (id < 0) {
+ error = id;
+ goto no_id;
+ }
+
/*
* shmid gets reported as "inode#" in /proc/pid/maps.
* proc-ps tools use this. Changing this will break them.
--- a/ipc/util.c
+++ b/ipc/util.c
@@ -277,6 +277,10 @@ int ipc_addid(struct ipc_ids *ids, struc
rcu_read_lock();
spin_lock(&new->lock);
+ current_euid_egid(&euid, &egid);
+ new->cuid = new->uid = euid;
+ new->gid = new->cgid = egid;
+
id = idr_alloc(&ids->ipcs_idr, new,
(next_id < 0) ? 0 : ipcid_to_idx(next_id), 0,
GFP_NOWAIT);
@@ -289,10 +293,6 @@ int ipc_addid(struct ipc_ids *ids, struc
ids->in_use++;
- current_euid_egid(&euid, &egid);
- new->cuid = new->uid = euid;
- new->gid = new->cgid = egid;
-
if (next_id < 0) {
new->seq = ids->seq++;
if (ids->seq > IPCID_SEQ_MAX)
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 50/79] ipvs: do not use random local source address for tunnels
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (47 preceding siblings ...)
2015-10-18 2:05 ` [PATCH 3.14 49/79] Initialize msg/shm IPC objects before doing ipc_addid() Greg Kroah-Hartman
@ 2015-10-18 2:05 ` Greg Kroah-Hartman
2015-10-18 2:05 ` [PATCH 3.14 51/79] ipvs: fix crash with sync protocol v0 and FTP Greg Kroah-Hartman
` (29 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:05 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Michael Vallaly, Julian Anastasov,
Simon Horman
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julian Anastasov <ja@ssi.bg>
commit 4754957f04f5f368792a0eb7dab0ae89fb93dcfd upstream.
Michael Vallaly reports about wrong source address used
in rare cases for tunneled traffic. Looks like
__ip_vs_get_out_rt in 3.10+ is providing uninitialized
dest_dst->dst_saddr.ip because ip_vs_dest_dst_alloc uses
kmalloc. While we retry after seeing EINVAL from routing
for data that does not look like valid local address, it
still succeeded when this memory was previously used from
other dests and with different local addresses. As result,
we can use valid local address that is not suitable for
our real server.
Fix it by providing 0.0.0.0 every time our cache is refreshed.
By this way we will get preferred source address from routing.
Reported-by: Michael Vallaly <lvs@nolatency.com>
Fixes: 026ace060dfe ("ipvs: optimize dst usage for real server")
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Simon Horman <horms@verge.net.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/ipvs/ip_vs_xmit.c | 1 -
1 file changed, 1 deletion(-)
--- a/net/netfilter/ipvs/ip_vs_xmit.c
+++ b/net/netfilter/ipvs/ip_vs_xmit.c
@@ -129,7 +129,6 @@ static struct rtable *do_output_route4(s
memset(&fl4, 0, sizeof(fl4));
fl4.daddr = daddr;
- fl4.saddr = (rt_mode & IP_VS_RT_MODE_CONNECT) ? *saddr : 0;
fl4.flowi4_flags = (rt_mode & IP_VS_RT_MODE_KNOWN_NH) ?
FLOWI_FLAG_KNOWN_NH : 0;
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 51/79] ipvs: fix crash with sync protocol v0 and FTP
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (48 preceding siblings ...)
2015-10-18 2:05 ` [PATCH 3.14 50/79] ipvs: do not use random local source address for tunnels Greg Kroah-Hartman
@ 2015-10-18 2:05 ` Greg Kroah-Hartman
2015-10-18 2:05 ` [PATCH 3.14 52/79] cifs: use server timestamp for ntlmv2 authentication Greg Kroah-Hartman
` (28 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:05 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Julian Anastasov, Simon Horman
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julian Anastasov <ja@ssi.bg>
commit 56184858d1fc95c46723436b455cb7261cd8be6f upstream.
Fix crash in 3.5+ if FTP is used after switching
sync_version to 0.
Fixes: 749c42b620a9 ("ipvs: reduce sync rate with time thresholds")
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Simon Horman <horms@verge.net.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/ipvs/ip_vs_sync.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/netfilter/ipvs/ip_vs_sync.c
+++ b/net/netfilter/ipvs/ip_vs_sync.c
@@ -612,7 +612,7 @@ static void ip_vs_sync_conn_v0(struct ne
pkts = atomic_add_return(1, &cp->in_pkts);
else
pkts = sysctl_sync_threshold(ipvs);
- ip_vs_sync_conn(net, cp->control, pkts);
+ ip_vs_sync_conn(net, cp, pkts);
}
}
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 52/79] cifs: use server timestamp for ntlmv2 authentication
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (49 preceding siblings ...)
2015-10-18 2:05 ` [PATCH 3.14 51/79] ipvs: fix crash with sync protocol v0 and FTP Greg Kroah-Hartman
@ 2015-10-18 2:05 ` Greg Kroah-Hartman
2015-10-18 2:05 ` [PATCH 3.14 53/79] mtd: pxa3xx_nand: add a default chunk size Greg Kroah-Hartman
` (27 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:05 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Namjae Jeon, Peter Seiderer, Steve French
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Seiderer <ps.report@gmx.net>
commit 98ce94c8df762d413b3ecb849e2b966b21606d04 upstream.
Linux cifs mount with ntlmssp against an Mac OS X (Yosemite
10.10.5) share fails in case the clocks differ more than +/-2h:
digest-service: digest-request: od failed with 2 proto=ntlmv2
digest-service: digest-request: kdc failed with -1561745592 proto=ntlmv2
Fix this by (re-)using the given server timestamp for the
ntlmv2 authentication (as Windows 7 does).
A related problem was also reported earlier by Namjae Jaen (see below):
Windows machine has extended security feature which refuse to allow
authentication when there is time difference between server time and
client time when ntlmv2 negotiation is used. This problem is prevalent
in embedded enviornment where system time is set to default 1970.
Modern servers send the server timestamp in the TargetInfo Av_Pair
structure in the challenge message [see MS-NLMP 2.2.2.1]
In [MS-NLMP 3.1.5.1.2] it is explicitly mentioned that the client must
use the server provided timestamp if present OR current time if it is
not
Reported-by: Namjae Jeon <namjae.jeon@samsung.com>
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Steve French <smfrench@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/cifs/cifsencrypt.c | 53 ++++++++++++++++++++++++++++++++++++++++++++++++--
1 file changed, 51 insertions(+), 2 deletions(-)
--- a/fs/cifs/cifsencrypt.c
+++ b/fs/cifs/cifsencrypt.c
@@ -441,6 +441,48 @@ find_domain_name(struct cifs_ses *ses, c
return 0;
}
+/* Server has provided av pairs/target info in the type 2 challenge
+ * packet and we have plucked it and stored within smb session.
+ * We parse that blob here to find the server given timestamp
+ * as part of ntlmv2 authentication (or local current time as
+ * default in case of failure)
+ */
+static __le64
+find_timestamp(struct cifs_ses *ses)
+{
+ unsigned int attrsize;
+ unsigned int type;
+ unsigned int onesize = sizeof(struct ntlmssp2_name);
+ unsigned char *blobptr;
+ unsigned char *blobend;
+ struct ntlmssp2_name *attrptr;
+
+ if (!ses->auth_key.len || !ses->auth_key.response)
+ return 0;
+
+ blobptr = ses->auth_key.response;
+ blobend = blobptr + ses->auth_key.len;
+
+ while (blobptr + onesize < blobend) {
+ attrptr = (struct ntlmssp2_name *) blobptr;
+ type = le16_to_cpu(attrptr->type);
+ if (type == NTLMSSP_AV_EOL)
+ break;
+ blobptr += 2; /* advance attr type */
+ attrsize = le16_to_cpu(attrptr->length);
+ blobptr += 2; /* advance attr size */
+ if (blobptr + attrsize > blobend)
+ break;
+ if (type == NTLMSSP_AV_TIMESTAMP) {
+ if (attrsize == sizeof(u64))
+ return *((__le64 *)blobptr);
+ }
+ blobptr += attrsize; /* advance attr value */
+ }
+
+ return cpu_to_le64(cifs_UnixTimeToNT(CURRENT_TIME));
+}
+
static int calc_ntlmv2_hash(struct cifs_ses *ses, char *ntlmv2_hash,
const struct nls_table *nls_cp)
{
@@ -637,6 +679,7 @@ setup_ntlmv2_rsp(struct cifs_ses *ses, c
struct ntlmv2_resp *ntlmv2;
char ntlmv2_hash[16];
unsigned char *tiblob = NULL; /* target info blob */
+ __le64 rsp_timestamp;
if (ses->server->negflavor == CIFS_NEGFLAVOR_EXTENDED) {
if (!ses->domainName) {
@@ -655,6 +698,12 @@ setup_ntlmv2_rsp(struct cifs_ses *ses, c
}
}
+ /* Must be within 5 minutes of the server (or in range +/-2h
+ * in case of Mac OS X), so simply carry over server timestamp
+ * (as Windows 7 does)
+ */
+ rsp_timestamp = find_timestamp(ses);
+
baselen = CIFS_SESS_KEY_SIZE + sizeof(struct ntlmv2_resp);
tilen = ses->auth_key.len;
tiblob = ses->auth_key.response;
@@ -671,8 +720,8 @@ setup_ntlmv2_rsp(struct cifs_ses *ses, c
(ses->auth_key.response + CIFS_SESS_KEY_SIZE);
ntlmv2->blob_signature = cpu_to_le32(0x00000101);
ntlmv2->reserved = 0;
- /* Must be within 5 minutes of the server */
- ntlmv2->time = cpu_to_le64(cifs_UnixTimeToNT(CURRENT_TIME));
+ ntlmv2->time = rsp_timestamp;
+
get_random_bytes(&ntlmv2->client_chal, sizeof(ntlmv2->client_chal));
ntlmv2->reserved2 = 0;
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 53/79] mtd: pxa3xx_nand: add a default chunk size
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (50 preceding siblings ...)
2015-10-18 2:05 ` [PATCH 3.14 52/79] cifs: use server timestamp for ntlmv2 authentication Greg Kroah-Hartman
@ 2015-10-18 2:05 ` Greg Kroah-Hartman
2015-10-18 2:05 ` [PATCH 3.14 54/79] regmap: debugfs: Ensure we dont underflow when printing access masks Greg Kroah-Hartman
` (26 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:05 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Antoine Tenart, Brian Norris
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: =?UTF-8?q?Antoine=20T=C3=A9nart?= <antoine.tenart@free-electrons.com>
commit bc3e00f04cc1fe033a289c2fc2e5c73c0168d360 upstream.
When keeping the configuration set by the bootloader (by using
the marvell,nand-keep-config property), the pxa3xx_nand_detect_config()
function is called and set the chunk size to 512 as a default value if
NDCR_PAGE_SZ is not set.
In the other case, when not keeping the bootloader configuration, no
chunk size is set. Fix this by adding a default chunk size of 512.
Fixes: 70ed85232a93 ("mtd: nand: pxa3xx: Introduce multiple page I/O
support")
Signed-off-by: Antoine Tenart <antoine.tenart@free-electrons.com>
Acked-by: Robert Jarzmik <robert.jarzmik@free>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/nand/pxa3xx_nand.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/mtd/nand/pxa3xx_nand.c
+++ b/drivers/mtd/nand/pxa3xx_nand.c
@@ -1463,6 +1463,9 @@ static int pxa3xx_nand_scan(struct mtd_i
if (pdata->keep_config && !pxa3xx_nand_detect_config(info))
goto KEEP_CONFIG;
+ /* Set a default chunk size */
+ info->chunk_size = 512;
+
ret = pxa3xx_nand_sensing(info);
if (ret) {
dev_info(&info->pdev->dev, "There is no chip on cs %d!\n",
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 54/79] regmap: debugfs: Ensure we dont underflow when printing access masks
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (51 preceding siblings ...)
2015-10-18 2:05 ` [PATCH 3.14 53/79] mtd: pxa3xx_nand: add a default chunk size Greg Kroah-Hartman
@ 2015-10-18 2:05 ` Greg Kroah-Hartman
2015-10-18 2:05 ` [PATCH 3.14 55/79] regmap: debugfs: Dont bother actually printing when calculating max length Greg Kroah-Hartman
` (25 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:05 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Rasmus Villemoes, Mark Brown
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Brown <broonie@kernel.org>
commit b763ec17ac762470eec5be8ebcc43e4f8b2c2b82 upstream.
If a read is attempted which is smaller than the line length then we may
underflow the subtraction we're doing with the unsigned size_t type so
move some of the calculation to be additions on the right hand side
instead in order to avoid this.
Reported-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Signed-off-by: Mark Brown <broonie@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/base/regmap/regmap-debugfs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/base/regmap/regmap-debugfs.c
+++ b/drivers/base/regmap/regmap-debugfs.c
@@ -432,7 +432,7 @@ static ssize_t regmap_access_read_file(s
/* If we're in the region the user is trying to read */
if (p >= *ppos) {
/* ...but not beyond it */
- if (buf_pos >= count - 1 - tot_len)
+ if (buf_pos + tot_len + 1 >= count)
break;
/* Format the register */
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 55/79] regmap: debugfs: Dont bother actually printing when calculating max length
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (52 preceding siblings ...)
2015-10-18 2:05 ` [PATCH 3.14 54/79] regmap: debugfs: Ensure we dont underflow when printing access masks Greg Kroah-Hartman
@ 2015-10-18 2:05 ` Greg Kroah-Hartman
2015-10-18 2:05 ` [PATCH 3.14 56/79] security: fix typo in security_task_prctl Greg Kroah-Hartman
` (24 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:05 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Rasmus Villemoes, Mark Brown
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Brown <broonie@kernel.org>
commit 176fc2d5770a0990eebff903ba680d2edd32e718 upstream.
The in kernel snprintf() will conveniently return the actual length of
the printed string even if not given an output beffer at all so just do
that rather than relying on the user to pass in a suitable buffer,
ensuring that we don't need to worry if the buffer was truncated due to
the size of the buffer passed in.
Reported-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/base/regmap/regmap-debugfs.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/base/regmap/regmap-debugfs.c
+++ b/drivers/base/regmap/regmap-debugfs.c
@@ -32,8 +32,7 @@ static DEFINE_MUTEX(regmap_debugfs_early
/* Calculate the length of a fixed format */
static size_t regmap_calc_reg_len(int max_val, char *buf, size_t buf_size)
{
- snprintf(buf, buf_size, "%x", max_val);
- return strlen(buf);
+ return snprintf(NULL, 0, "%x", max_val);
}
static ssize_t regmap_name_read_file(struct file *file,
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 56/79] security: fix typo in security_task_prctl
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (53 preceding siblings ...)
2015-10-18 2:05 ` [PATCH 3.14 55/79] regmap: debugfs: Dont bother actually printing when calculating max length Greg Kroah-Hartman
@ 2015-10-18 2:05 ` Greg Kroah-Hartman
2015-10-18 2:05 ` [PATCH 3.14 57/79] usb: Use the USB_SS_MULT() macro to get the burst multiplier Greg Kroah-Hartman
` (23 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:05 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jann Horn, Andy Lutomirski, Linus Torvalds
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jann Horn <jann@thejh.net>
commit b7f76ea2ef6739ee484a165ffbac98deb855d3d3 upstream.
Signed-off-by: Jann Horn <jann@thejh.net>
Reviewed-by: Andy Lutomirski <luto@kernel.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/security.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -2452,7 +2452,7 @@ static inline int security_task_prctl(in
unsigned long arg4,
unsigned long arg5)
{
- return cap_task_prctl(option, arg2, arg3, arg3, arg5);
+ return cap_task_prctl(option, arg2, arg3, arg4, arg5);
}
static inline void security_task_to_inode(struct task_struct *p, struct inode *inode)
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 57/79] usb: Use the USB_SS_MULT() macro to get the burst multiplier.
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (54 preceding siblings ...)
2015-10-18 2:05 ` [PATCH 3.14 56/79] security: fix typo in security_task_prctl Greg Kroah-Hartman
@ 2015-10-18 2:05 ` Greg Kroah-Hartman
2015-10-18 2:05 ` [PATCH 3.14 58/79] usb: Add device quirk for Logitech PTZ cameras Greg Kroah-Hartman
` (22 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:05 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Mathias Nyman
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <mathias.nyman@linux.intel.com>
commit ff30cbc8da425754e8ab96904db1d295bd034f27 upstream.
Bits 1:0 of the bmAttributes are used for the burst multiplier.
The rest of the bits used to be reserved (zero), but USB3.1 takes bit 7
into use.
Use the existing USB_SS_MULT() macro instead to make sure the mult value
and hence max packet calculations are correct for USB3.1 devices.
Note that burst multiplier in bmAttributes is zero based and that
the USB_SS_MULT() macro adds one.
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/core/config.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -113,7 +113,7 @@ static void usb_parse_ss_endpoint_compan
cfgno, inum, asnum, ep->desc.bEndpointAddress);
ep->ss_ep_comp.bmAttributes = 16;
} else if (usb_endpoint_xfer_isoc(&ep->desc) &&
- desc->bmAttributes > 2) {
+ USB_SS_MULT(desc->bmAttributes) > 3) {
dev_warn(ddev, "Isoc endpoint has Mult of %d in "
"config %d interface %d altsetting %d ep %d: "
"setting to 3\n", desc->bmAttributes + 1,
@@ -122,7 +122,8 @@ static void usb_parse_ss_endpoint_compan
}
if (usb_endpoint_xfer_isoc(&ep->desc))
- max_tx = (desc->bMaxBurst + 1) * (desc->bmAttributes + 1) *
+ max_tx = (desc->bMaxBurst + 1) *
+ (USB_SS_MULT(desc->bmAttributes)) *
usb_endpoint_maxp(&ep->desc);
else if (usb_endpoint_xfer_int(&ep->desc))
max_tx = usb_endpoint_maxp(&ep->desc) *
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 58/79] usb: Add device quirk for Logitech PTZ cameras
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (55 preceding siblings ...)
2015-10-18 2:05 ` [PATCH 3.14 57/79] usb: Use the USB_SS_MULT() macro to get the burst multiplier Greg Kroah-Hartman
@ 2015-10-18 2:05 ` Greg Kroah-Hartman
2015-10-18 2:05 ` [PATCH 3.14 59/79] USB: Add reset-resume quirk for two Plantronics usb headphones Greg Kroah-Hartman
` (21 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:05 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Vincent Palatin
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vincent Palatin <vpalatin@chromium.org>
commit 72194739f54607bbf8cfded159627a2015381557 upstream.
Add a device quirk for the Logitech PTZ Pro Camera and its sibling the
ConferenceCam CC3000e Camera.
This fixes the failed camera enumeration on some boot, particularly on
machines with fast CPU.
Tested by connecting a Logitech PTZ Pro Camera to a machine with a
Haswell Core i7-4600U CPU @ 2.10GHz, and doing thousands of reboot cycles
while recording the kernel logs and taking camera picture after each boot.
Before the patch, more than 7% of the boots show some enumeration transfer
failures and in a few of them, the kernel is giving up before actually
enumerating the webcam. After the patch, the enumeration has been correct
on every reboot.
Signed-off-by: Vincent Palatin <vpalatin@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/core/quirks.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -54,6 +54,13 @@ static const struct usb_device_id usb_qu
{ USB_DEVICE(0x046d, 0x082d), .driver_info = USB_QUIRK_DELAY_INIT },
{ USB_DEVICE(0x046d, 0x0843), .driver_info = USB_QUIRK_DELAY_INIT },
+ /* Logitech ConferenceCam CC3000e */
+ { USB_DEVICE(0x046d, 0x0847), .driver_info = USB_QUIRK_DELAY_INIT },
+ { USB_DEVICE(0x046d, 0x0848), .driver_info = USB_QUIRK_DELAY_INIT },
+
+ /* Logitech PTZ Pro Camera */
+ { USB_DEVICE(0x046d, 0x0853), .driver_info = USB_QUIRK_DELAY_INIT },
+
/* Logitech Quickcam Fusion */
{ USB_DEVICE(0x046d, 0x08c1), .driver_info = USB_QUIRK_RESET_RESUME },
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 59/79] USB: Add reset-resume quirk for two Plantronics usb headphones.
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (56 preceding siblings ...)
2015-10-18 2:05 ` [PATCH 3.14 58/79] usb: Add device quirk for Logitech PTZ cameras Greg Kroah-Hartman
@ 2015-10-18 2:05 ` Greg Kroah-Hartman
2015-10-18 2:05 ` [PATCH 3.14 60/79] MIPS: dma-default: Fix 32-bit fall back to GFP_DMA Greg Kroah-Hartman
` (20 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:05 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Yao-Wen Mao
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yao-Wen Mao <yaowen@google.com>
commit 8484bf2981b3d006426ac052a3642c9ce1d8d980 upstream.
These two headphones need a reset-resume quirk to properly resume to
original volume level.
Signed-off-by: Yao-Wen Mao <yaowen@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/core/quirks.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -85,6 +85,12 @@ static const struct usb_device_id usb_qu
/* Philips PSC805 audio device */
{ USB_DEVICE(0x0471, 0x0155), .driver_info = USB_QUIRK_RESET_RESUME },
+ /* Plantronic Audio 655 DSP */
+ { USB_DEVICE(0x047f, 0xc008), .driver_info = USB_QUIRK_RESET_RESUME },
+
+ /* Plantronic Audio 648 USB */
+ { USB_DEVICE(0x047f, 0xc013), .driver_info = USB_QUIRK_RESET_RESUME },
+
/* Artisman Watchdog Dongle */
{ USB_DEVICE(0x04b4, 0x0526), .driver_info =
USB_QUIRK_CONFIG_INTF_STRINGS },
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 60/79] MIPS: dma-default: Fix 32-bit fall back to GFP_DMA
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (57 preceding siblings ...)
2015-10-18 2:05 ` [PATCH 3.14 59/79] USB: Add reset-resume quirk for two Plantronics usb headphones Greg Kroah-Hartman
@ 2015-10-18 2:05 ` Greg Kroah-Hartman
2015-10-18 2:05 ` [PATCH 3.14 61/79] arch,hexagon: Convert smp_mb__*() Greg Kroah-Hartman
` (19 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:05 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, James Hogan, Ralf Baechle, linux-mips
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Hogan <james.hogan@imgtec.com>
commit 53960059d56ecef67d4ddd546731623641a3d2d1 upstream.
If there is a DMA zone (usually 24bit = 16MB I believe), but no DMA32
zone, as is the case for some 32-bit kernels, then massage_gfp_flags()
will cause DMA memory allocated for devices with a 32..63-bit
coherent_dma_mask to fall back to using __GFP_DMA, even though there may
only be 32-bits of physical address available anyway.
Correct that case to compare against a mask the size of phys_addr_t
instead of always using a 64-bit mask.
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Fixes: a2e715a86c6d ("MIPS: DMA: Fix computation of DMA flags from device's coherent_dma_mask.")
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/9610/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/mips/mm/dma-default.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/mips/mm/dma-default.c
+++ b/arch/mips/mm/dma-default.c
@@ -94,7 +94,7 @@ static gfp_t massage_gfp_flags(const str
else
#endif
#if defined(CONFIG_ZONE_DMA) && !defined(CONFIG_ZONE_DMA32)
- if (dev->coherent_dma_mask < DMA_BIT_MASK(64))
+ if (dev->coherent_dma_mask < DMA_BIT_MASK(sizeof(phys_addr_t) * 8))
dma_flag = __GFP_DMA;
else
#endif
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 61/79] arch,hexagon: Convert smp_mb__*()
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (58 preceding siblings ...)
2015-10-18 2:05 ` [PATCH 3.14 60/79] MIPS: dma-default: Fix 32-bit fall back to GFP_DMA Greg Kroah-Hartman
@ 2015-10-18 2:05 ` Greg Kroah-Hartman
2015-10-18 2:05 ` [PATCH 3.14 62/79] staging: comedi: usbduxsigma: dont clobber ai_timer in command test Greg Kroah-Hartman
` (18 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:05 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Peter Zijlstra, Paul E. McKenney,
Linus Torvalds, Richard Kuo, Vineet Gupta, linux-hexagon,
Ingo Molnar
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <peterz@infradead.org>
commit 94cf42f823bc904305b0ee93a09bcd51ba380497 upstream.
Hexagon uses asm-gemeric/barrier.h and its smp_mb() is barrier().
Therefore we can use the default implementation that uses smp_mb().
Signed-off-by: Peter Zijlstra <peterz@infradead.org>
Acked-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Link: http://lkml.kernel.org/n/tip-87irqrrbgizeojjfdqhypud3@git.kernel.org
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Richard Kuo <rkuo@codeaurora.org>
Cc: Vineet Gupta <vgupta@synopsys.com>
Cc: linux-hexagon@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/hexagon/include/asm/atomic.h | 6 +-----
arch/hexagon/include/asm/bitops.h | 4 +---
2 files changed, 2 insertions(+), 8 deletions(-)
--- a/arch/hexagon/include/asm/atomic.h
+++ b/arch/hexagon/include/asm/atomic.h
@@ -24,6 +24,7 @@
#include <linux/types.h>
#include <asm/cmpxchg.h>
+#include <asm/barrier.h>
#define ATOMIC_INIT(i) { (i) }
#define atomic_set(v, i) ((v)->counter = (i))
@@ -163,9 +164,4 @@ static inline int __atomic_add_unless(at
#define atomic_inc_return(v) (atomic_add_return(1, v))
#define atomic_dec_return(v) (atomic_sub_return(1, v))
-#define smp_mb__before_atomic_dec() barrier()
-#define smp_mb__after_atomic_dec() barrier()
-#define smp_mb__before_atomic_inc() barrier()
-#define smp_mb__after_atomic_inc() barrier()
-
#endif
--- a/arch/hexagon/include/asm/bitops.h
+++ b/arch/hexagon/include/asm/bitops.h
@@ -25,12 +25,10 @@
#include <linux/compiler.h>
#include <asm/byteorder.h>
#include <asm/atomic.h>
+#include <asm/barrier.h>
#ifdef __KERNEL__
-#define smp_mb__before_clear_bit() barrier()
-#define smp_mb__after_clear_bit() barrier()
-
/*
* The offset calculations for these are based on BITS_PER_LONG == 32
* (i.e. I get to shift by #5-2 (32 bits per long, 4 bytes per access),
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 62/79] staging: comedi: usbduxsigma: dont clobber ai_timer in command test
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (59 preceding siblings ...)
2015-10-18 2:05 ` [PATCH 3.14 61/79] arch,hexagon: Convert smp_mb__*() Greg Kroah-Hartman
@ 2015-10-18 2:05 ` Greg Kroah-Hartman
2015-10-18 2:05 ` [PATCH 3.14 63/79] staging: comedi: usbduxsigma: dont clobber ao_timer " Greg Kroah-Hartman
` (17 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:05 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ian Abbott, Bernd Porr, H Hartley Sweeten
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Abbott <abbotti@mev.co.uk>
commit 423b24c37dd5794a674c74b0ed56392003a69891 upstream.
`devpriv->ai_timer` is used while an asynchronous command is running on
the AI subdevice. It also gets modified by the subdevice's `cmdtest`
handler for checking new asynchronous commands
(`usbduxsigma_ai_cmdtest()`), which is not correct as it's allowed to
check new commands while an old command is still running. Fix it by
moving the code which sets up `devpriv->ai_timer` and
`devpriv->ai_interval` into the subdevice's `cmd` handler,
`usbduxsigma_ai_cmd()`.
Note that the removed code in `usbduxsigma_ai_cmdtest()` checked that
`devpriv->ai_timer` did not end up less than than 1, but that could not
happen because `cmd->scan_begin_arg` had already been checked to be at
least the minimum required value (at least when `cmd->scan_begin_src ==
TRIG_TIMER`, which had also been checked to be the case).
Fixes: b986be8527c7 ("staging: comedi: usbduxsigma: tidy up analog input command support)
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Reviewed-by: Bernd Porr <mail@berndporr.me.uk>
Reviewed-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/comedi/drivers/usbduxsigma.c | 58 ++++++++++++---------------
1 file changed, 27 insertions(+), 31 deletions(-)
--- a/drivers/staging/comedi/drivers/usbduxsigma.c
+++ b/drivers/staging/comedi/drivers/usbduxsigma.c
@@ -575,37 +575,6 @@ static int usbduxsigma_ai_cmdtest(struct
if (err)
return 3;
- /* Step 4: fix up any arguments */
-
- if (high_speed) {
- /*
- * every 2 channels get a time window of 125us. Thus, if we
- * sample all 16 channels we need 1ms. If we sample only one
- * channel we need only 125us
- */
- devpriv->ai_interval = interval;
- devpriv->ai_timer = cmd->scan_begin_arg / (125000 * interval);
- } else {
- /* interval always 1ms */
- devpriv->ai_interval = 1;
- devpriv->ai_timer = cmd->scan_begin_arg / 1000000;
- }
- if (devpriv->ai_timer < 1)
- err |= -EINVAL;
-
- if (cmd->stop_src == TRIG_COUNT) {
- /* data arrives as one packet */
- devpriv->ai_sample_count = cmd->stop_arg;
- devpriv->ai_continuous = 0;
- } else {
- /* continuous acquisition */
- devpriv->ai_continuous = 1;
- devpriv->ai_sample_count = 0;
- }
-
- if (err)
- return 4;
-
return 0;
}
@@ -704,6 +673,33 @@ static int usbduxsigma_ai_cmd(struct com
/* set current channel of the running acquisition to zero */
s->async->cur_chan = 0;
+
+ if (devpriv->high_speed) {
+ /*
+ * every 2 channels get a time window of 125us. Thus, if we
+ * sample all 16 channels we need 1ms. If we sample only one
+ * channel we need only 125us
+ */
+ unsigned int interval = usbduxsigma_chans_to_interval(len);
+
+ devpriv->ai_interval = interval;
+ devpriv->ai_timer = cmd->scan_begin_arg / (125000 * interval);
+ } else {
+ /* interval always 1ms */
+ devpriv->ai_interval = 1;
+ devpriv->ai_timer = cmd->scan_begin_arg / 1000000;
+ }
+
+ if (cmd->stop_src == TRIG_COUNT) {
+ /* data arrives as one packet */
+ devpriv->ai_sample_count = cmd->stop_arg;
+ devpriv->ai_continuous = 0;
+ } else {
+ /* continuous acquisition */
+ devpriv->ai_continuous = 1;
+ devpriv->ai_sample_count = 0;
+ }
+
for (i = 0; i < len; i++) {
unsigned int chan = CR_CHAN(cmd->chanlist[i]);
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 63/79] staging: comedi: usbduxsigma: dont clobber ao_timer in command test
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (60 preceding siblings ...)
2015-10-18 2:05 ` [PATCH 3.14 62/79] staging: comedi: usbduxsigma: dont clobber ai_timer in command test Greg Kroah-Hartman
@ 2015-10-18 2:05 ` Greg Kroah-Hartman
2015-10-18 2:05 ` [PATCH 3.14 64/79] md: flush ->event_work before stopping array Greg Kroah-Hartman
` (16 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:05 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ian Abbott, Bernd Porr, H Hartley Sweeten
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Abbott <abbotti@mev.co.uk>
commit c04a1f17803e0d3eeada586ca34a6b436959bc20 upstream.
`devpriv->ao_timer` is used while an asynchronous command is running on
the AO subdevice. It also gets modified by the subdevice's `cmdtest`
handler for checking new asynchronous commands,
`usbduxsigma_ao_cmdtest()`, which is not correct as it's allowed to
check new commands while an old command is still running. Fix it by
moving the code which sets up `devpriv->ao_timer` into the subdevice's
`cmd` handler, `usbduxsigma_ao_cmd()`.
Note that the removed code in `usbduxsigma_ao_cmdtest()` checked that
`devpriv->ao_timer` did not end up less that 1, but that could not
happen due because `cmd->scan_begin_arg` or `cmd->convert_arg` had
already been range-checked.
Also note that we tested the `high_speed` variable in the old code, but
that is currently always 0 and means that we always use "scan" timing
(`cmd->scan_begin_src == TRIG_TIMER` and `cmd->convert_src == TRIG_NOW`)
and never "convert" (individual sample) timing (`cmd->scan_begin_src ==
TRIG_FOLLOW` and `cmd->convert_src == TRIG_TIMER`). The moved code
tests `cmd->convert_src` instead to decide whether "scan" or "convert"
timing is being used, although currently only "scan" timing is
supported.
Fixes: fb1ef622e7a3 ("staging: comedi: usbduxsigma: tidy up analog output command support")
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Reviewed-by: Bernd Porr <mail@berndporr.me.uk>
Reviewed-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/comedi/drivers/usbduxsigma.c | 41 +++++++++++----------------
1 file changed, 17 insertions(+), 24 deletions(-)
--- a/drivers/staging/comedi/drivers/usbduxsigma.c
+++ b/drivers/staging/comedi/drivers/usbduxsigma.c
@@ -951,10 +951,24 @@ static int usbduxsigma_ao_cmdtest(struct
if (err)
return 3;
- /* Step 4: fix up any arguments */
+ return 0;
+}
+
+static int usbduxsigma_ao_cmd(struct comedi_device *dev,
+ struct comedi_subdevice *s)
+{
+ struct usbduxsigma_private *devpriv = dev->private;
+ struct comedi_cmd *cmd = &s->async->cmd;
+ int ret;
+ int i;
+
+ down(&devpriv->sem);
+
+ /* set current channel of the running acquisition to zero */
+ s->async->cur_chan = 0;
/* we count in timer steps */
- if (high_speed) {
+ if (cmd->convert_src == TRIG_TIMER) {
/* timing of the conversion itself: every 125 us */
devpriv->ao_timer = cmd->convert_arg / 125000;
} else {
@@ -964,12 +978,9 @@ static int usbduxsigma_ao_cmdtest(struct
*/
devpriv->ao_timer = cmd->scan_begin_arg / 1000000;
}
- if (devpriv->ao_timer < 1)
- err |= -EINVAL;
-
if (cmd->stop_src == TRIG_COUNT) {
/* not continuous, use counter */
- if (high_speed) {
+ if (cmd->convert_src == TRIG_TIMER) {
/* high speed also scans everything at once */
devpriv->ao_sample_count = cmd->stop_arg *
cmd->scan_end_arg;
@@ -988,24 +999,6 @@ static int usbduxsigma_ao_cmdtest(struct
devpriv->ao_sample_count = 0;
}
- if (err)
- return 4;
-
- return 0;
-}
-
-static int usbduxsigma_ao_cmd(struct comedi_device *dev,
- struct comedi_subdevice *s)
-{
- struct usbduxsigma_private *devpriv = dev->private;
- struct comedi_cmd *cmd = &s->async->cmd;
- int ret;
- int i;
-
- down(&devpriv->sem);
-
- /* set current channel of the running acquisition to zero */
- s->async->cur_chan = 0;
for (i = 0; i < cmd->chanlist_len; ++i)
devpriv->ao_chanlist[i] = CR_CHAN(cmd->chanlist[i]);
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 64/79] md: flush ->event_work before stopping array.
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (61 preceding siblings ...)
2015-10-18 2:05 ` [PATCH 3.14 63/79] staging: comedi: usbduxsigma: dont clobber ao_timer " Greg Kroah-Hartman
@ 2015-10-18 2:05 ` Greg Kroah-Hartman
2015-10-18 2:05 ` [PATCH 3.14 65/79] powerpc/MSI: Fix race condition in tearing down MSI interrupts Greg Kroah-Hartman
` (15 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:05 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Heinz Mauelshagen, NeilBrown
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <neilb@suse.com>
commit ee5d004fd0591536a061451eba2b187092e9127c upstream.
The 'event_work' worker used by dm-raid may still be running
when the array is stopped. This can result in an oops.
So flush the workqueue on which it is run after detaching
and before destroying the device.
Reported-by: Heinz Mauelshagen <heinzm@redhat.com>
Signed-off-by: NeilBrown <neilb@suse.com>
Fixes: 9d09e663d550 ("dm: raid456 basic support")
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/md.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -5285,6 +5285,8 @@ EXPORT_SYMBOL_GPL(md_stop_writes);
static void __md_stop(struct mddev *mddev)
{
mddev->ready = 0;
+ /* Ensure ->event_work is done */
+ flush_workqueue(md_misc_wq);
mddev->pers->stop(mddev);
if (mddev->pers->sync_request && mddev->to_remove == NULL)
mddev->to_remove = &md_redundancy_group;
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 65/79] powerpc/MSI: Fix race condition in tearing down MSI interrupts
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (62 preceding siblings ...)
2015-10-18 2:05 ` [PATCH 3.14 64/79] md: flush ->event_work before stopping array Greg Kroah-Hartman
@ 2015-10-18 2:05 ` Greg Kroah-Hartman
2015-10-18 2:05 ` [PATCH 3.14 66/79] UBI: Validate data_size Greg Kroah-Hartman
` (14 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:05 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alexey Kardashevskiy, Paul Mackerras,
Michael Ellerman
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Mackerras <paulus@ozlabs.org>
commit e297c939b745e420ef0b9dc989cb87bda617b399 upstream.
This fixes a race which can result in the same virtual IRQ number
being assigned to two different MSI interrupts. The most visible
consequence of that is usually a warning and stack trace from the
sysfs code about an attempt to create a duplicate entry in sysfs.
The race happens when one CPU (say CPU 0) is disposing of an MSI
while another CPU (say CPU 1) is setting up an MSI. CPU 0 calls
(for example) pnv_teardown_msi_irqs(), which calls
msi_bitmap_free_hwirqs() to indicate that the MSI (i.e. its
hardware IRQ number) is no longer in use. Then, before CPU 0 gets
to calling irq_dispose_mapping() to free up the virtal IRQ number,
CPU 1 comes in and calls msi_bitmap_alloc_hwirqs() to allocate an
MSI, and gets the same hardware IRQ number that CPU 0 just freed.
CPU 1 then calls irq_create_mapping() to get a virtual IRQ number,
which sees that there is currently a mapping for that hardware IRQ
number and returns the corresponding virtual IRQ number (which is
the same virtual IRQ number that CPU 0 was using). CPU 0 then
calls irq_dispose_mapping() and frees that virtual IRQ number.
Now, if another CPU comes along and calls irq_create_mapping(), it
is likely to get the virtual IRQ number that was just freed,
resulting in the same virtual IRQ number apparently being used for
two different hardware interrupts.
To fix this race, we just move the call to msi_bitmap_free_hwirqs()
to after the call to irq_dispose_mapping(). Since virq_to_hw()
doesn't work for the virtual IRQ number after irq_dispose_mapping()
has been called, we need to call it before irq_dispose_mapping() and
remember the result for the msi_bitmap_free_hwirqs() call.
The pattern of calling msi_bitmap_free_hwirqs() before
irq_dispose_mapping() appears in 5 places under arch/powerpc, and
appears to have originated in commit 05af7bd2d75e ("[POWERPC] MPIC
U3/U4 MSI backend") from 2007.
Fixes: 05af7bd2d75e ("[POWERPC] MPIC U3/U4 MSI backend")
Reported-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: Paul Mackerras <paulus@samba.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/platforms/powernv/pci.c | 5 +++--
arch/powerpc/sysdev/fsl_msi.c | 5 +++--
arch/powerpc/sysdev/mpic_pasemi_msi.c | 6 ++++--
arch/powerpc/sysdev/mpic_u3msi.c | 5 +++--
arch/powerpc/sysdev/ppc4xx_msi.c | 5 +++--
5 files changed, 16 insertions(+), 10 deletions(-)
--- a/arch/powerpc/platforms/powernv/pci.c
+++ b/arch/powerpc/platforms/powernv/pci.c
@@ -109,6 +109,7 @@ static void pnv_teardown_msi_irqs(struct
struct pci_controller *hose = pci_bus_to_host(pdev->bus);
struct pnv_phb *phb = hose->private_data;
struct msi_desc *entry;
+ irq_hw_number_t hwirq;
if (WARN_ON(!phb))
return;
@@ -116,10 +117,10 @@ static void pnv_teardown_msi_irqs(struct
list_for_each_entry(entry, &pdev->msi_list, list) {
if (entry->irq == NO_IRQ)
continue;
+ hwirq = virq_to_hw(entry->irq);
irq_set_msi_desc(entry->irq, NULL);
- msi_bitmap_free_hwirqs(&phb->msi_bmp,
- virq_to_hw(entry->irq) - phb->msi_base, 1);
irq_dispose_mapping(entry->irq);
+ msi_bitmap_free_hwirqs(&phb->msi_bmp, hwirq - phb->msi_base, 1);
}
}
#endif /* CONFIG_PCI_MSI */
--- a/arch/powerpc/sysdev/fsl_msi.c
+++ b/arch/powerpc/sysdev/fsl_msi.c
@@ -121,15 +121,16 @@ static void fsl_teardown_msi_irqs(struct
{
struct msi_desc *entry;
struct fsl_msi *msi_data;
+ irq_hw_number_t hwirq;
list_for_each_entry(entry, &pdev->msi_list, list) {
if (entry->irq == NO_IRQ)
continue;
+ hwirq = virq_to_hw(entry->irq);
msi_data = irq_get_chip_data(entry->irq);
irq_set_msi_desc(entry->irq, NULL);
- msi_bitmap_free_hwirqs(&msi_data->bitmap,
- virq_to_hw(entry->irq), 1);
irq_dispose_mapping(entry->irq);
+ msi_bitmap_free_hwirqs(&msi_data->bitmap, hwirq, 1);
}
return;
--- a/arch/powerpc/sysdev/mpic_pasemi_msi.c
+++ b/arch/powerpc/sysdev/mpic_pasemi_msi.c
@@ -74,6 +74,7 @@ static int pasemi_msi_check_device(struc
static void pasemi_msi_teardown_msi_irqs(struct pci_dev *pdev)
{
struct msi_desc *entry;
+ irq_hw_number_t hwirq;
pr_debug("pasemi_msi_teardown_msi_irqs, pdev %p\n", pdev);
@@ -81,10 +82,11 @@ static void pasemi_msi_teardown_msi_irqs
if (entry->irq == NO_IRQ)
continue;
+ hwirq = virq_to_hw(entry->irq);
irq_set_msi_desc(entry->irq, NULL);
- msi_bitmap_free_hwirqs(&msi_mpic->msi_bitmap,
- virq_to_hw(entry->irq), ALLOC_CHUNK);
irq_dispose_mapping(entry->irq);
+ msi_bitmap_free_hwirqs(&msi_mpic->msi_bitmap,
+ hwirq, ALLOC_CHUNK);
}
return;
--- a/arch/powerpc/sysdev/mpic_u3msi.c
+++ b/arch/powerpc/sysdev/mpic_u3msi.c
@@ -124,15 +124,16 @@ static int u3msi_msi_check_device(struct
static void u3msi_teardown_msi_irqs(struct pci_dev *pdev)
{
struct msi_desc *entry;
+ irq_hw_number_t hwirq;
list_for_each_entry(entry, &pdev->msi_list, list) {
if (entry->irq == NO_IRQ)
continue;
+ hwirq = virq_to_hw(entry->irq);
irq_set_msi_desc(entry->irq, NULL);
- msi_bitmap_free_hwirqs(&msi_mpic->msi_bitmap,
- virq_to_hw(entry->irq), 1);
irq_dispose_mapping(entry->irq);
+ msi_bitmap_free_hwirqs(&msi_mpic->msi_bitmap, hwirq, 1);
}
return;
--- a/arch/powerpc/sysdev/ppc4xx_msi.c
+++ b/arch/powerpc/sysdev/ppc4xx_msi.c
@@ -121,16 +121,17 @@ void ppc4xx_teardown_msi_irqs(struct pci
{
struct msi_desc *entry;
struct ppc4xx_msi *msi_data = &ppc4xx_msi;
+ irq_hw_number_t hwirq;
dev_dbg(&dev->dev, "PCIE-MSI: tearing down msi irqs\n");
list_for_each_entry(entry, &dev->msi_list, list) {
if (entry->irq == NO_IRQ)
continue;
+ hwirq = virq_to_hw(entry->irq);
irq_set_msi_desc(entry->irq, NULL);
- msi_bitmap_free_hwirqs(&msi_data->bitmap,
- virq_to_hw(entry->irq), 1);
irq_dispose_mapping(entry->irq);
+ msi_bitmap_free_hwirqs(&msi_data->bitmap, hwirq, 1);
}
}
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 66/79] UBI: Validate data_size
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (63 preceding siblings ...)
2015-10-18 2:05 ` [PATCH 3.14 65/79] powerpc/MSI: Fix race condition in tearing down MSI interrupts Greg Kroah-Hartman
@ 2015-10-18 2:05 ` Greg Kroah-Hartman
2015-10-18 2:05 ` [PATCH 3.14 67/79] UBI: return ENOSPC if no enough space available Greg Kroah-Hartman
` (13 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:05 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Richard Weinberger, David Gstir
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Weinberger <richard@nod.at>
commit 281fda27673f833a01d516658a64d22a32c8e072 upstream.
Make sure that data_size is less than LEB size.
Otherwise a handcrafted UBI image is able to trigger
an out of bounds memory access in ubi_compare_lebs().
Signed-off-by: Richard Weinberger <richard@nod.at>
Reviewed-by: David Gstir <david@sigma-star.at>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/ubi/io.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/mtd/ubi/io.c
+++ b/drivers/mtd/ubi/io.c
@@ -921,6 +921,11 @@ static int validate_vid_hdr(const struct
goto bad;
}
+ if (data_size > ubi->leb_size) {
+ ubi_err("bad data_size");
+ goto bad;
+ }
+
if (vol_type == UBI_VID_STATIC) {
/*
* Although from high-level point of view static volumes may
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 67/79] UBI: return ENOSPC if no enough space available
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (64 preceding siblings ...)
2015-10-18 2:05 ` [PATCH 3.14 66/79] UBI: Validate data_size Greg Kroah-Hartman
@ 2015-10-18 2:05 ` Greg Kroah-Hartman
2015-10-18 2:06 ` [PATCH 3.14 68/79] dcache: Handle escaped paths in prepend_path Greg Kroah-Hartman
` (12 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:05 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sheng Yong, Richard Weinberger, David Gstir
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: shengyong <shengyong1@huawei.com>
commit 7c7feb2ebfc9c0552c51f0c050db1d1a004faac5 upstream.
UBI: attaching mtd1 to ubi0
UBI: scanning is finished
UBI error: init_volumes: not enough PEBs, required 706, available 686
UBI error: ubi_wl_init: no enough physical eraseblocks (-20, need 1)
UBI error: ubi_attach_mtd_dev: failed to attach mtd1, error -12 <= NOT ENOMEM
UBI error: ubi_init: cannot attach mtd1
If available PEBs are not enough when initializing volumes, return -ENOSPC
directly. If available PEBs are not enough when initializing WL, return
-ENOSPC instead of -ENOMEM.
Signed-off-by: Sheng Yong <shengyong1@huawei.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Reviewed-by: David Gstir <david@sigma-star.at>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/ubi/vtbl.c | 1 +
drivers/mtd/ubi/wl.c | 1 +
2 files changed, 2 insertions(+)
--- a/drivers/mtd/ubi/vtbl.c
+++ b/drivers/mtd/ubi/vtbl.c
@@ -651,6 +651,7 @@ static int init_volumes(struct ubi_devic
if (ubi->corr_peb_count)
ubi_err("%d PEBs are corrupted and not used",
ubi->corr_peb_count);
+ return -ENOSPC;
}
ubi->rsvd_pebs += reserved_pebs;
ubi->avail_pebs -= reserved_pebs;
--- a/drivers/mtd/ubi/wl.c
+++ b/drivers/mtd/ubi/wl.c
@@ -1974,6 +1974,7 @@ int ubi_wl_init(struct ubi_device *ubi,
if (ubi->corr_peb_count)
ubi_err("%d PEBs are corrupted and not used",
ubi->corr_peb_count);
+ err = -ENOSPC;
goto out_free;
}
ubi->avail_pebs -= reserved_pebs;
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 68/79] dcache: Handle escaped paths in prepend_path
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (65 preceding siblings ...)
2015-10-18 2:05 ` [PATCH 3.14 67/79] UBI: return ENOSPC if no enough space available Greg Kroah-Hartman
@ 2015-10-18 2:06 ` Greg Kroah-Hartman
2015-10-18 2:06 ` [PATCH 3.14 69/79] vfs: Test for and handle paths that are unreachable from their mnt_root Greg Kroah-Hartman
` (11 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:06 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Eric W. Biederman, Al Viro
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Eric W. Biederman" <ebiederm@xmission.com>
commit cde93be45a8a90d8c264c776fab63487b5038a65 upstream.
A rename can result in a dentry that by walking up d_parent
will never reach it's mnt_root. For lack of a better term
I call this an escaped path.
prepend_path is called by four different functions __d_path,
d_absolute_path, d_path, and getcwd.
__d_path only wants to see paths are connected to the root it passes
in. So __d_path needs prepend_path to return an error.
d_absolute_path similarly wants to see paths that are connected to
some root. Escaped paths are not connected to any mnt_root so
d_absolute_path needs prepend_path to return an error greater
than 1. So escaped paths will be treated like paths on lazily
unmounted mounts.
getcwd needs to prepend "(unreachable)" so getcwd also needs
prepend_path to return an error.
d_path is the interesting hold out. d_path just wants to print
something, and does not care about the weird cases. Which raises
the question what should be printed?
Given that <escaped_path>/<anything> should result in -ENOENT I
believe it is desirable for escaped paths to be printed as empty
paths. As there are not really any meaninful path components when
considered from the perspective of a mount tree.
So tweak prepend_path to return an empty path with an new error
code of 3 when it encounters an escaped path.
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/dcache.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -2787,6 +2787,13 @@ restart:
if (dentry == vfsmnt->mnt_root || IS_ROOT(dentry)) {
struct mount *parent = ACCESS_ONCE(mnt->mnt_parent);
+ /* Escaped? */
+ if (dentry != vfsmnt->mnt_root) {
+ bptr = *buffer;
+ blen = *buflen;
+ error = 3;
+ break;
+ }
/* Global root? */
if (mnt != parent) {
dentry = ACCESS_ONCE(mnt->mnt_mountpoint);
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 69/79] vfs: Test for and handle paths that are unreachable from their mnt_root
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (66 preceding siblings ...)
2015-10-18 2:06 ` [PATCH 3.14 68/79] dcache: Handle escaped paths in prepend_path Greg Kroah-Hartman
@ 2015-10-18 2:06 ` Greg Kroah-Hartman
2015-10-18 2:06 ` [PATCH 3.14 70/79] arm64: readahead: fault retry breaks mmap file read random detection Greg Kroah-Hartman
` (10 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:06 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Eric W. Biederman, Al Viro
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Eric W. Biederman" <ebiederm@xmission.com>
commit 397d425dc26da728396e66d392d5dcb8dac30c37 upstream.
In rare cases a directory can be renamed out from under a bind mount.
In those cases without special handling it becomes possible to walk up
the directory tree to the root dentry of the filesystem and down
from the root dentry to every other file or directory on the filesystem.
Like division by zero .. from an unconnected path can not be given
a useful semantic as there is no predicting at which path component
the code will realize it is unconnected. We certainly can not match
the current behavior as the current behavior is a security hole.
Therefore when encounting .. when following an unconnected path
return -ENOENT.
- Add a function path_connected to verify path->dentry is reachable
from path->mnt.mnt_root. AKA to validate that rename did not do
something nasty to the bind mount.
To avoid races path_connected must be called after following a path
component to it's next path component.
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/namei.c | 31 ++++++++++++++++++++++++++++---
1 file changed, 28 insertions(+), 3 deletions(-)
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -484,6 +484,24 @@ void path_put(const struct path *path)
}
EXPORT_SYMBOL(path_put);
+/**
+ * path_connected - Verify that a path->dentry is below path->mnt.mnt_root
+ * @path: nameidate to verify
+ *
+ * Rename can sometimes move a file or directory outside of a bind
+ * mount, path_connected allows those cases to be detected.
+ */
+static bool path_connected(const struct path *path)
+{
+ struct vfsmount *mnt = path->mnt;
+
+ /* Only bind mounts can have disconnected paths */
+ if (mnt->mnt_root == mnt->mnt_sb->s_root)
+ return true;
+
+ return is_subdir(path->dentry, mnt->mnt_root);
+}
+
/*
* Path walking has 2 modes, rcu-walk and ref-walk (see
* Documentation/filesystems/path-lookup.txt). In situations when we can't
@@ -1149,6 +1167,8 @@ static int follow_dotdot_rcu(struct name
goto failed;
nd->path.dentry = parent;
nd->seq = seq;
+ if (unlikely(!path_connected(&nd->path)))
+ goto failed;
break;
}
if (!follow_up_rcu(&nd->path))
@@ -1242,7 +1262,7 @@ static void follow_mount(struct path *pa
}
}
-static void follow_dotdot(struct nameidata *nd)
+static int follow_dotdot(struct nameidata *nd)
{
if (!nd->root.mnt)
set_root(nd);
@@ -1258,6 +1278,10 @@ static void follow_dotdot(struct nameida
/* rare case of legitimate dget_parent()... */
nd->path.dentry = dget_parent(nd->path.dentry);
dput(old);
+ if (unlikely(!path_connected(&nd->path))) {
+ path_put(&nd->path);
+ return -ENOENT;
+ }
break;
}
if (!follow_up(&nd->path))
@@ -1265,6 +1289,7 @@ static void follow_dotdot(struct nameida
}
follow_mount(&nd->path);
nd->inode = nd->path.dentry->d_inode;
+ return 0;
}
/*
@@ -1488,7 +1513,7 @@ static inline int handle_dots(struct nam
if (follow_dotdot_rcu(nd))
return -ECHILD;
} else
- follow_dotdot(nd);
+ return follow_dotdot(nd);
}
return 0;
}
@@ -2214,7 +2239,7 @@ mountpoint_last(struct nameidata *nd, st
if (unlikely(nd->last_type != LAST_NORM)) {
error = handle_dots(nd, nd->last_type);
if (error)
- goto out;
+ return error;
dentry = dget(nd->path.dentry);
goto done;
}
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 70/79] arm64: readahead: fault retry breaks mmap file read random detection
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (67 preceding siblings ...)
2015-10-18 2:06 ` [PATCH 3.14 69/79] vfs: Test for and handle paths that are unreachable from their mnt_root Greg Kroah-Hartman
@ 2015-10-18 2:06 ` Greg Kroah-Hartman
2015-10-18 2:06 ` [PATCH 3.14 71/79] m68k: Define asmlinkage_protect Greg Kroah-Hartman
` (9 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:06 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Shaohua Li, Rik van Riel,
Wu Fengguang, Mark Salyzyn, Riley Andrews, Will Deacon
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Salyzyn <salyzyn@android.com>
commit 569ba74a7ba69f46ce2950bf085b37fea2408385 upstream.
This is the arm64 portion of commit 45cac65b0fcd ("readahead: fault
retry breaks mmap file read random detection"), which was absent from
the initial port and has since gone unnoticed. The original commit says:
> .fault now can retry. The retry can break state machine of .fault. In
> filemap_fault, if page is miss, ra->mmap_miss is increased. In the second
> try, since the page is in page cache now, ra->mmap_miss is decreased. And
> these are done in one fault, so we can't detect random mmap file access.
>
> Add a new flag to indicate .fault is tried once. In the second try, skip
> ra->mmap_miss decreasing. The filemap_fault state machine is ok with it.
With this change, Mark reports that:
> Random read improves by 250%, sequential read improves by 40%, and
> random write by 400% to an eMMC device with dm crypto wrapped around it.
Cc: Shaohua Li <shli@kernel.org>
Cc: Rik van Riel <riel@redhat.com>
Cc: Wu Fengguang <fengguang.wu@intel.com>
Signed-off-by: Mark Salyzyn <salyzyn@android.com>
Signed-off-by: Riley Andrews <riandrews@android.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/mm/fault.c | 1 +
1 file changed, 1 insertion(+)
--- a/arch/arm64/mm/fault.c
+++ b/arch/arm64/mm/fault.c
@@ -278,6 +278,7 @@ retry:
* starvation.
*/
mm_flags &= ~FAULT_FLAG_ALLOW_RETRY;
+ mm_flags |= FAULT_FLAG_TRIED;
goto retry;
}
}
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 71/79] m68k: Define asmlinkage_protect
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (68 preceding siblings ...)
2015-10-18 2:06 ` [PATCH 3.14 70/79] arm64: readahead: fault retry breaks mmap file read random detection Greg Kroah-Hartman
@ 2015-10-18 2:06 ` Greg Kroah-Hartman
2015-10-18 2:06 ` [PATCH 3.14 72/79] fib_rules: Fix dump_rules() not to exit early Greg Kroah-Hartman
` (8 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:06 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andreas Schwab, Geert Uytterhoeven
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Schwab <schwab@linux-m68k.org>
commit 8474ba74193d302e8340dddd1e16c85cc4b98caf upstream.
Make sure the compiler does not modify arguments of syscall functions.
This can happen if the compiler generates a tailcall to another
function. For example, without asmlinkage_protect sys_openat is compiled
into this function:
sys_openat:
clr.l %d0
move.w 18(%sp),%d0
move.l %d0,16(%sp)
jbra do_sys_open
Note how the fourth argument is modified in place, modifying the register
%d4 that gets restored from this stack slot when the function returns to
user-space. The caller may expect the register to be unmodified across
system calls.
Signed-off-by: Andreas Schwab <schwab@linux-m68k.org>
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/m68k/include/asm/linkage.h | 30 ++++++++++++++++++++++++++++++
1 file changed, 30 insertions(+)
--- a/arch/m68k/include/asm/linkage.h
+++ b/arch/m68k/include/asm/linkage.h
@@ -4,4 +4,34 @@
#define __ALIGN .align 4
#define __ALIGN_STR ".align 4"
+/*
+ * Make sure the compiler doesn't do anything stupid with the
+ * arguments on the stack - they are owned by the *caller*, not
+ * the callee. This just fools gcc into not spilling into them,
+ * and keeps it from doing tailcall recursion and/or using the
+ * stack slots for temporaries, since they are live and "used"
+ * all the way to the end of the function.
+ */
+#define asmlinkage_protect(n, ret, args...) \
+ __asmlinkage_protect##n(ret, ##args)
+#define __asmlinkage_protect_n(ret, args...) \
+ __asm__ __volatile__ ("" : "=r" (ret) : "0" (ret), ##args)
+#define __asmlinkage_protect0(ret) \
+ __asmlinkage_protect_n(ret)
+#define __asmlinkage_protect1(ret, arg1) \
+ __asmlinkage_protect_n(ret, "m" (arg1))
+#define __asmlinkage_protect2(ret, arg1, arg2) \
+ __asmlinkage_protect_n(ret, "m" (arg1), "m" (arg2))
+#define __asmlinkage_protect3(ret, arg1, arg2, arg3) \
+ __asmlinkage_protect_n(ret, "m" (arg1), "m" (arg2), "m" (arg3))
+#define __asmlinkage_protect4(ret, arg1, arg2, arg3, arg4) \
+ __asmlinkage_protect_n(ret, "m" (arg1), "m" (arg2), "m" (arg3), \
+ "m" (arg4))
+#define __asmlinkage_protect5(ret, arg1, arg2, arg3, arg4, arg5) \
+ __asmlinkage_protect_n(ret, "m" (arg1), "m" (arg2), "m" (arg3), \
+ "m" (arg4), "m" (arg5))
+#define __asmlinkage_protect6(ret, arg1, arg2, arg3, arg4, arg5, arg6) \
+ __asmlinkage_protect_n(ret, "m" (arg1), "m" (arg2), "m" (arg3), \
+ "m" (arg4), "m" (arg5), "m" (arg6))
+
#endif
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 72/79] fib_rules: Fix dump_rules() not to exit early
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (69 preceding siblings ...)
2015-10-18 2:06 ` [PATCH 3.14 71/79] m68k: Define asmlinkage_protect Greg Kroah-Hartman
@ 2015-10-18 2:06 ` Greg Kroah-Hartman
2015-10-18 2:06 ` [PATCH 3.14 73/79] genirq: Fix race in register_irq_proc() Greg Kroah-Hartman
` (7 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:06 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Roland Dreier
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roland Dreier <roland@purestorage.com>
Backports of 41fc014332d9 ("fib_rules: fix fib rule dumps across
multiple skbs") introduced a regression in "ip rule show" - it ends up
dumping the first rule over and over and never exiting, because 3.19
and earlier are missing commit 053c095a82cf ("netlink: make
nlmsg_end() and genlmsg_end() void"), so fib_nl_fill_rule() ends up
returning skb->len (i.e. > 0) in the success case.
Fix this by checking the return code for < 0 instead of != 0.
Signed-off-by: Roland Dreier <roland@purestorage.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/core/fib_rules.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/core/fib_rules.c
+++ b/net/core/fib_rules.c
@@ -631,7 +631,7 @@ static int dump_rules(struct sk_buff *sk
err = fib_nl_fill_rule(skb, rule, NETLINK_CB(cb->skb).portid,
cb->nlh->nlmsg_seq, RTM_NEWRULE,
NLM_F_MULTI, ops);
- if (err)
+ if (err < 0)
break;
skip:
idx++;
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 73/79] genirq: Fix race in register_irq_proc()
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (70 preceding siblings ...)
2015-10-18 2:06 ` [PATCH 3.14 72/79] fib_rules: Fix dump_rules() not to exit early Greg Kroah-Hartman
@ 2015-10-18 2:06 ` Greg Kroah-Hartman
2015-10-18 2:06 ` [PATCH 3.14 74/79] jbd2: avoid infinite loop when destroying aborted journal Greg Kroah-Hartman
` (6 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:06 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ben Hutchings, Thomas Gleixner
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <ben@decadent.org.uk>
commit 95c2b17534654829db428f11bcf4297c059a2a7e upstream.
Per-IRQ directories in procfs are created only when a handler is first
added to the irqdesc, not when the irqdesc is created. In the case of
a shared IRQ, multiple tasks can race to create a directory. This
race condition seems to have been present forever, but is easier to
hit with async probing.
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Link: http://lkml.kernel.org/r/1443266636.2004.2.camel@decadent.org.uk
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/irq/proc.c | 19 +++++++++++++++++--
1 file changed, 17 insertions(+), 2 deletions(-)
--- a/kernel/irq/proc.c
+++ b/kernel/irq/proc.c
@@ -12,6 +12,7 @@
#include <linux/seq_file.h>
#include <linux/interrupt.h>
#include <linux/kernel_stat.h>
+#include <linux/mutex.h>
#include "internals.h"
@@ -326,18 +327,29 @@ void register_handler_proc(unsigned int
void register_irq_proc(unsigned int irq, struct irq_desc *desc)
{
+ static DEFINE_MUTEX(register_lock);
char name [MAX_NAMELEN];
- if (!root_irq_dir || (desc->irq_data.chip == &no_irq_chip) || desc->dir)
+ if (!root_irq_dir || (desc->irq_data.chip == &no_irq_chip))
return;
+ /*
+ * irq directories are registered only when a handler is
+ * added, not when the descriptor is created, so multiple
+ * tasks might try to register at the same time.
+ */
+ mutex_lock(®ister_lock);
+
+ if (desc->dir)
+ goto out_unlock;
+
memset(name, 0, MAX_NAMELEN);
sprintf(name, "%d", irq);
/* create /proc/irq/1234 */
desc->dir = proc_mkdir(name, root_irq_dir);
if (!desc->dir)
- return;
+ goto out_unlock;
#ifdef CONFIG_SMP
/* create /proc/irq/<irq>/smp_affinity */
@@ -358,6 +370,9 @@ void register_irq_proc(unsigned int irq,
proc_create_data("spurious", 0444, desc->dir,
&irq_spurious_proc_fops, (void *)(long)irq);
+
+out_unlock:
+ mutex_unlock(®ister_lock);
}
void unregister_irq_proc(unsigned int irq, struct irq_desc *desc)
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 74/79] jbd2: avoid infinite loop when destroying aborted journal
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (71 preceding siblings ...)
2015-10-18 2:06 ` [PATCH 3.14 73/79] genirq: Fix race in register_irq_proc() Greg Kroah-Hartman
@ 2015-10-18 2:06 ` Greg Kroah-Hartman
2015-10-18 2:06 ` [PATCH 3.14 75/79] clk: ti: fix dual-registration of uart4_ick Greg Kroah-Hartman
` (5 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:06 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Eryu Guan, Jan Kara, Theodore Tso
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <jack@suse.com>
commit 841df7df196237ea63233f0f9eaa41db53afd70f upstream.
Commit 6f6a6fda2945 "jbd2: fix ocfs2 corrupt when updating journal
superblock fails" changed jbd2_cleanup_journal_tail() to return EIO
when the journal is aborted. That makes logic in
jbd2_log_do_checkpoint() bail out which is fine, except that
jbd2_journal_destroy() expects jbd2_log_do_checkpoint() to always make
a progress in cleaning the journal. Without it jbd2_journal_destroy()
just loops in an infinite loop.
Fix jbd2_journal_destroy() to cleanup journal checkpoint lists of
jbd2_log_do_checkpoint() fails with error.
Reported-by: Eryu Guan <guaneryu@gmail.com>
Tested-by: Eryu Guan <guaneryu@gmail.com>
Fixes: 6f6a6fda294506dfe0e3e0a253bb2d2923f28f0a
Signed-off-by: Jan Kara <jack@suse.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/jbd2/checkpoint.c | 39 +++++++++++++++++++++++++++++++++------
fs/jbd2/commit.c | 2 +-
fs/jbd2/journal.c | 11 ++++++++++-
include/linux/jbd2.h | 3 ++-
4 files changed, 46 insertions(+), 9 deletions(-)
--- a/fs/jbd2/checkpoint.c
+++ b/fs/jbd2/checkpoint.c
@@ -475,14 +475,15 @@ int jbd2_cleanup_journal_tail(journal_t
* journal_clean_one_cp_list
*
* Find all the written-back checkpoint buffers in the given list and
- * release them.
+ * release them. If 'destroy' is set, clean all buffers unconditionally.
*
* Called with the journal locked.
* Called with j_list_lock held.
* Returns number of buffers reaped (for debug)
*/
-static int journal_clean_one_cp_list(struct journal_head *jh, int *released)
+static int journal_clean_one_cp_list(struct journal_head *jh, bool destroy,
+ int *released)
{
struct journal_head *last_jh;
struct journal_head *next_jh = jh;
@@ -496,7 +497,10 @@ static int journal_clean_one_cp_list(str
do {
jh = next_jh;
next_jh = jh->b_cpnext;
- ret = __try_to_free_cp_buf(jh);
+ if (!destroy)
+ ret = __try_to_free_cp_buf(jh);
+ else
+ ret = __jbd2_journal_remove_checkpoint(jh) + 1;
if (ret) {
freed++;
if (ret == 2) {
@@ -521,13 +525,14 @@ static int journal_clean_one_cp_list(str
* journal_clean_checkpoint_list
*
* Find all the written-back checkpoint buffers in the journal and release them.
+ * If 'destroy' is set, release all buffers unconditionally.
*
* Called with the journal locked.
* Called with j_list_lock held.
* Returns number of buffers reaped (for debug)
*/
-int __jbd2_journal_clean_checkpoint_list(journal_t *journal)
+int __jbd2_journal_clean_checkpoint_list(journal_t *journal, bool destroy)
{
transaction_t *transaction, *last_transaction, *next_transaction;
int ret = 0;
@@ -543,7 +548,7 @@ int __jbd2_journal_clean_checkpoint_list
transaction = next_transaction;
next_transaction = transaction->t_cpnext;
ret += journal_clean_one_cp_list(transaction->
- t_checkpoint_list, &released);
+ t_checkpoint_list, destroy, &released);
/*
* This function only frees up some memory if possible so we
* dont have an obligation to finish processing. Bail out if
@@ -559,7 +564,7 @@ int __jbd2_journal_clean_checkpoint_list
* we can possibly see not yet submitted buffers on io_list
*/
ret += journal_clean_one_cp_list(transaction->
- t_checkpoint_io_list, &released);
+ t_checkpoint_io_list, destroy, &released);
if (need_resched())
goto out;
} while (transaction != last_transaction);
@@ -568,6 +573,28 @@ out:
}
/*
+ * Remove buffers from all checkpoint lists as journal is aborted and we just
+ * need to free memory
+ */
+void jbd2_journal_destroy_checkpoint(journal_t *journal)
+{
+ /*
+ * We loop because __jbd2_journal_clean_checkpoint_list() may abort
+ * early due to a need of rescheduling.
+ */
+ while (1) {
+ spin_lock(&journal->j_list_lock);
+ if (!journal->j_checkpoint_transactions) {
+ spin_unlock(&journal->j_list_lock);
+ break;
+ }
+ __jbd2_journal_clean_checkpoint_list(journal, true);
+ spin_unlock(&journal->j_list_lock);
+ cond_resched();
+ }
+}
+
+/*
* journal_remove_checkpoint: called after a buffer has been committed
* to disk (either by being write-back flushed to disk, or being
* committed to the log).
--- a/fs/jbd2/commit.c
+++ b/fs/jbd2/commit.c
@@ -510,7 +510,7 @@ void jbd2_journal_commit_transaction(jou
* frees some memory
*/
spin_lock(&journal->j_list_lock);
- __jbd2_journal_clean_checkpoint_list(journal);
+ __jbd2_journal_clean_checkpoint_list(journal, false);
spin_unlock(&journal->j_list_lock);
jbd_debug(3, "JBD2: commit phase 1\n");
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c
@@ -1708,8 +1708,17 @@ int jbd2_journal_destroy(journal_t *jour
while (journal->j_checkpoint_transactions != NULL) {
spin_unlock(&journal->j_list_lock);
mutex_lock(&journal->j_checkpoint_mutex);
- jbd2_log_do_checkpoint(journal);
+ err = jbd2_log_do_checkpoint(journal);
mutex_unlock(&journal->j_checkpoint_mutex);
+ /*
+ * If checkpointing failed, just free the buffers to avoid
+ * looping forever
+ */
+ if (err) {
+ jbd2_journal_destroy_checkpoint(journal);
+ spin_lock(&journal->j_list_lock);
+ break;
+ }
spin_lock(&journal->j_list_lock);
}
--- a/include/linux/jbd2.h
+++ b/include/linux/jbd2.h
@@ -1042,8 +1042,9 @@ void jbd2_update_log_tail(journal_t *jou
extern void jbd2_journal_commit_transaction(journal_t *);
/* Checkpoint list management */
-int __jbd2_journal_clean_checkpoint_list(journal_t *journal);
+int __jbd2_journal_clean_checkpoint_list(journal_t *journal, bool destroy);
int __jbd2_journal_remove_checkpoint(struct journal_head *);
+void jbd2_journal_destroy_checkpoint(journal_t *journal);
void __jbd2_journal_insert_checkpoint(struct journal_head *, transaction_t *);
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 75/79] clk: ti: fix dual-registration of uart4_ick
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (72 preceding siblings ...)
2015-10-18 2:06 ` [PATCH 3.14 74/79] jbd2: avoid infinite loop when destroying aborted journal Greg Kroah-Hartman
@ 2015-10-18 2:06 ` Greg Kroah-Hartman
2015-10-18 2:06 ` [PATCH 3.14 76/79] dm cache: fix NULL pointer when switching from cleaner policy Greg Kroah-Hartman
` (4 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:06 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, mturquette, sboyd, linux-clk,
linux-omap, linux-kernel, Ben Dooks, Tero Kristo
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Dooks <ben.dooks@codethink.co.uk>
commit 19e79687de22f23bcfb5e79cce3daba20af228d1 upstream.
On the OMAP AM3517 platform the uart4_ick gets registered
twice, causing any power management to /dev/ttyO3 to fail
when trying to wake the device up.
This solves the following oops:
[] Unhandled fault: external abort on non-linefetch (0x1028) at 0xfa09e008
[] PC is at serial_omap_pm+0x48/0x15c
[] LR is at _raw_spin_unlock_irqrestore+0x30/0x5c
Fixes: aafd900cab87 ("CLK: TI: add omap3 clock init file")
Cc: mturquette@baylibre.com
Cc: sboyd@codeaurora.org
Cc: linux-clk@vger.kernel.org
Cc: linux-omap@vger.kernel.org
Cc: linux-kernel@lists.codethink.co.uk
Signed-off-by: Ben Dooks <ben.dooks@codethink.co.uk>
Signed-off-by: Tero Kristo <t-kristo@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/clk/ti/clk-3xxx.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/clk/ti/clk-3xxx.c
+++ b/drivers/clk/ti/clk-3xxx.c
@@ -174,7 +174,6 @@ static struct ti_dt_clk omap3xxx_clks[]
DT_CLK(NULL, "gpio2_ick", "gpio2_ick"),
DT_CLK(NULL, "wdt3_ick", "wdt3_ick"),
DT_CLK(NULL, "uart3_ick", "uart3_ick"),
- DT_CLK(NULL, "uart4_ick", "uart4_ick"),
DT_CLK(NULL, "gpt9_ick", "gpt9_ick"),
DT_CLK(NULL, "gpt8_ick", "gpt8_ick"),
DT_CLK(NULL, "gpt7_ick", "gpt7_ick"),
@@ -317,6 +316,7 @@ static struct ti_dt_clk am35xx_clks[] =
static struct ti_dt_clk omap36xx_clks[] = {
DT_CLK(NULL, "omap_192m_alwon_fck", "omap_192m_alwon_fck"),
DT_CLK(NULL, "uart4_fck", "uart4_fck"),
+ DT_CLK(NULL, "uart4_ick", "uart4_ick"),
{ .node_name = NULL },
};
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 76/79] dm cache: fix NULL pointer when switching from cleaner policy
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (73 preceding siblings ...)
2015-10-18 2:06 ` [PATCH 3.14 75/79] clk: ti: fix dual-registration of uart4_ick Greg Kroah-Hartman
@ 2015-10-18 2:06 ` Greg Kroah-Hartman
2015-10-18 2:06 ` [PATCH 3.14 77/79] staging: speakup: fix speakup-r regression Greg Kroah-Hartman
` (3 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:06 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Joe Thornber, Mike Snitzer
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Thornber <ejt@redhat.com>
commit 2bffa1503c5c06192eb1459180fac4416575a966 upstream.
The cleaner policy doesn't make use of the per cache block hint space in
the metadata (unlike the other policies). When switching from the
cleaner policy to mq or smq a NULL pointer crash (in dm_tm_new_block)
was observed. The crash was caused by bugs in dm-cache-metadata.c
when trying to skip creation of the hint btree.
The minimal fix is to change hint size for the cleaner policy to 4 bytes
(only hint size supported).
Signed-off-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-cache-policy-cleaner.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/md/dm-cache-policy-cleaner.c
+++ b/drivers/md/dm-cache-policy-cleaner.c
@@ -434,7 +434,7 @@ static struct dm_cache_policy *wb_create
static struct dm_cache_policy_type wb_policy_type = {
.name = "cleaner",
.version = {1, 0, 0},
- .hint_size = 0,
+ .hint_size = 4,
.owner = THIS_MODULE,
.create = wb_create
};
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 77/79] staging: speakup: fix speakup-r regression
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (74 preceding siblings ...)
2015-10-18 2:06 ` [PATCH 3.14 76/79] dm cache: fix NULL pointer when switching from cleaner policy Greg Kroah-Hartman
@ 2015-10-18 2:06 ` Greg Kroah-Hartman
2015-10-18 2:06 ` [PATCH 3.14 78/79] mm/slab: fix unexpected index mapping result of kmalloc_size(INDEX_NODE+1) Greg Kroah-Hartman
` (2 subsequent siblings)
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:06 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Samuel Thibault, John Covici
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: "covici@ccs.covici.com" <covici@ccs.covici.com>
commit b1d562acc78f0af46de0dfe447410bc40bdb7ece upstream.
Here is a patch to make speakup-r work again.
It broke in 3.6 due to commit 4369c64c79a22b98d3b7eff9d089196cd878a10a
"Input: Send events one packet at a time)
The problem was that the fakekey.c routine to fake a down arrow no
longer functioned properly and putting the input_sync fixed it.
Fixes: 4369c64c79a22b98d3b7eff9d089196cd878a10a
Acked-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Signed-off-by: John Covici <covici@ccs.covici.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/speakup/fakekey.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/staging/speakup/fakekey.c
+++ b/drivers/staging/speakup/fakekey.c
@@ -81,6 +81,7 @@ void speakup_fake_down_arrow(void)
__this_cpu_write(reporting_keystroke, true);
input_report_key(virt_keyboard, KEY_DOWN, PRESSED);
input_report_key(virt_keyboard, KEY_DOWN, RELEASED);
+ input_sync(virt_keyboard);
__this_cpu_write(reporting_keystroke, false);
/* reenable preemption */
^ permalink raw reply [flat|nested] 88+ messages in thread* [PATCH 3.14 78/79] mm/slab: fix unexpected index mapping result of kmalloc_size(INDEX_NODE+1)
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (75 preceding siblings ...)
2015-10-18 2:06 ` [PATCH 3.14 77/79] staging: speakup: fix speakup-r regression Greg Kroah-Hartman
@ 2015-10-18 2:06 ` Greg Kroah-Hartman
2015-10-19 4:10 ` [PATCH 3.14 00/79] 3.14.55-stable review Guenter Roeck
2015-10-19 15:20 ` Shuah Khan
78 siblings, 0 replies; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-18 2:06 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Joonsoo Kim, Liuhailong,
Christoph Lameter, Pekka Enberg, David Rientjes, Andrew Morton,
Linus Torvalds
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joonsoo Kim <js1304@gmail.com>
commit 03a2d2a3eafe4015412cf4e9675ca0e2d9204074 upstream.
Commit description is copied from the original post of this bug:
http://comments.gmane.org/gmane.linux.kernel.mm/135349
Kernels after v3.9 use kmalloc_size(INDEX_NODE + 1) to get the next
larger cache size than the size index INDEX_NODE mapping. In kernels
3.9 and earlier we used malloc_sizes[INDEX_L3 + 1].cs_size.
However, sometimes we can't get the right output we expected via
kmalloc_size(INDEX_NODE + 1), causing a BUG().
The mapping table in the latest kernel is like:
index = {0, 1, 2 , 3, 4, 5, 6, n}
size = {0, 96, 192, 8, 16, 32, 64, 2^n}
The mapping table before 3.10 is like this:
index = {0 , 1 , 2, 3, 4 , 5 , 6, n}
size = {32, 64, 96, 128, 192, 256, 512, 2^(n+3)}
The problem on my mips64 machine is as follows:
(1) When configured DEBUG_SLAB && DEBUG_PAGEALLOC && DEBUG_LOCK_ALLOC
&& DEBUG_SPINLOCK, the sizeof(struct kmem_cache_node) will be "150",
and the macro INDEX_NODE turns out to be "2": #define INDEX_NODE
kmalloc_index(sizeof(struct kmem_cache_node))
(2) Then the result of kmalloc_size(INDEX_NODE + 1) is 8.
(3) Then "if(size >= kmalloc_size(INDEX_NODE + 1)" will lead to "size
= PAGE_SIZE".
(4) Then "if ((size >= (PAGE_SIZE >> 3))" test will be satisfied and
"flags |= CFLGS_OFF_SLAB" will be covered.
(5) if (flags & CFLGS_OFF_SLAB)" test will be satisfied and will go to
"cachep->slabp_cache = kmalloc_slab(slab_size, 0u)", and the result
here may be NULL while kernel bootup.
(6) Finally,"BUG_ON(ZERO_OR_NULL_PTR(cachep->slabp_cache));" causes the
BUG info as the following shows (may be only mips64 has this problem):
This patch fixes the problem of kmalloc_size(INDEX_NODE + 1) and removes
the BUG by adding 'size >= 256' check to guarantee that all necessary
small sized slabs are initialized regardless sequence of slab size in
mapping table.
Fixes: e33660165c90 ("slab: Use common kmalloc_index/kmalloc_size...")
Signed-off-by: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Reported-by: Liuhailong <liu.hailong6@zte.com.cn>
Acked-by: Christoph Lameter <cl@linux.com>
Cc: Pekka Enberg <penberg@kernel.org>
Cc: David Rientjes <rientjes@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/slab.c | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -2271,9 +2271,16 @@ __kmem_cache_create (struct kmem_cache *
size += BYTES_PER_WORD;
}
#if FORCED_DEBUG && defined(CONFIG_DEBUG_PAGEALLOC)
- if (size >= kmalloc_size(INDEX_NODE + 1)
- && cachep->object_size > cache_line_size()
- && ALIGN(size, cachep->align) < PAGE_SIZE) {
+ /*
+ * To activate debug pagealloc, off-slab management is necessary
+ * requirement. In early phase of initialization, small sized slab
+ * doesn't get initialized so it would not be possible. So, we need
+ * to check size >= 256. It guarantees that all necessary small
+ * sized slab is initialized in current slab initialization sequence.
+ */
+ if (!slab_early_init && size >= kmalloc_size(INDEX_NODE) &&
+ size >= 256 && cachep->object_size > cache_line_size() &&
+ ALIGN(size, cachep->align) < PAGE_SIZE) {
cachep->obj_offset += PAGE_SIZE - ALIGN(size, cachep->align);
size = PAGE_SIZE;
}
^ permalink raw reply [flat|nested] 88+ messages in thread* Re: [PATCH 3.14 00/79] 3.14.55-stable review
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (76 preceding siblings ...)
2015-10-18 2:06 ` [PATCH 3.14 78/79] mm/slab: fix unexpected index mapping result of kmalloc_size(INDEX_NODE+1) Greg Kroah-Hartman
@ 2015-10-19 4:10 ` Guenter Roeck
2015-10-19 15:14 ` Greg Kroah-Hartman
2015-10-19 15:20 ` Shuah Khan
78 siblings, 1 reply; 88+ messages in thread
From: Guenter Roeck @ 2015-10-19 4:10 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel
Cc: torvalds, akpm, shuah.kh, stable, Richard Kuo
On 10/17/2015 07:04 PM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 3.14.55 release.
> There are 79 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Tue Oct 20 02:00:11 UTC 2015.
> Anything received after that time might be too late.
>
Build results:
total: 127 pass: 125 fail: 2
Failed builds:
hexagon:defconfig
hexagon:allnoconfig
Qemu test results:
total: 80 pass: 80 fail: 0
The hexagon build failures are different than before, but the builds still fail.
In file included from include/linux/mm.h:19:0,
from arch/hexagon/kernel/asm-offsets.c:28:
include/linux/bit_spinlock.h: In function 'bit_spin_unlock':
include/linux/bit_spinlock.h:62:2: error: implicit declaration of function 'smp_mb__before_clear_bit'
In file included from arch/hexagon/kernel/asm-offsets.c:29:0:
include/linux/interrupt.h: In function 'tasklet_disable_nosync':
include/linux/interrupt.h:541:2: error: implicit declaration of function 'smp_mb__after_atomic_inc'
include/linux/interrupt.h: In function 'tasklet_enable':
include/linux/interrupt.h:553:2: error: implicit declaration of function 'smp_mb__before_atomic_dec'
Details are available at http://server.roeck-us.net:8010/builders.
Guenter
^ permalink raw reply [flat|nested] 88+ messages in thread* Re: [PATCH 3.14 00/79] 3.14.55-stable review
2015-10-19 4:10 ` [PATCH 3.14 00/79] 3.14.55-stable review Guenter Roeck
@ 2015-10-19 15:14 ` Greg Kroah-Hartman
2015-10-19 19:13 ` Richard Kuo
0 siblings, 1 reply; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-19 15:14 UTC (permalink / raw)
To: Guenter Roeck; +Cc: linux-kernel, torvalds, akpm, shuah.kh, stable, Richard Kuo
On Sun, Oct 18, 2015 at 09:10:20PM -0700, Guenter Roeck wrote:
> On 10/17/2015 07:04 PM, Greg Kroah-Hartman wrote:
> >This is the start of the stable review cycle for the 3.14.55 release.
> >There are 79 patches in this series, all will be posted as a response
> >to this one. If anyone has any issues with these being applied, please
> >let me know.
> >
> >Responses should be made by Tue Oct 20 02:00:11 UTC 2015.
> >Anything received after that time might be too late.
> >
>
> Build results:
> total: 127 pass: 125 fail: 2
> Failed builds:
> hexagon:defconfig
> hexagon:allnoconfig
>
> Qemu test results:
> total: 80 pass: 80 fail: 0
>
> The hexagon build failures are different than before, but the builds still fail.
>
> In file included from include/linux/mm.h:19:0,
> from arch/hexagon/kernel/asm-offsets.c:28:
> include/linux/bit_spinlock.h: In function 'bit_spin_unlock':
> include/linux/bit_spinlock.h:62:2: error: implicit declaration of function 'smp_mb__before_clear_bit'
> In file included from arch/hexagon/kernel/asm-offsets.c:29:0:
> include/linux/interrupt.h: In function 'tasklet_disable_nosync':
> include/linux/interrupt.h:541:2: error: implicit declaration of function 'smp_mb__after_atomic_inc'
> include/linux/interrupt.h: In function 'tasklet_enable':
> include/linux/interrupt.h:553:2: error: implicit declaration of function 'smp_mb__before_atomic_dec'
Odd, any idea what we can do to fix it?
greg k-h
^ permalink raw reply [flat|nested] 88+ messages in thread
* Re: [PATCH 3.14 00/79] 3.14.55-stable review
2015-10-19 15:14 ` Greg Kroah-Hartman
@ 2015-10-19 19:13 ` Richard Kuo
2015-10-19 20:09 ` Greg Kroah-Hartman
0 siblings, 1 reply; 88+ messages in thread
From: Richard Kuo @ 2015-10-19 19:13 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: Guenter Roeck, linux-kernel, torvalds, akpm, shuah.kh, stable
On Mon, Oct 19, 2015 at 08:14:47AM -0700, Greg Kroah-Hartman wrote:
> On Sun, Oct 18, 2015 at 09:10:20PM -0700, Guenter Roeck wrote:
> > On 10/17/2015 07:04 PM, Greg Kroah-Hartman wrote:
> > >This is the start of the stable review cycle for the 3.14.55 release.
> > >There are 79 patches in this series, all will be posted as a response
> > >to this one. If anyone has any issues with these being applied, please
> > >let me know.
> > >
> > >Responses should be made by Tue Oct 20 02:00:11 UTC 2015.
> > >Anything received after that time might be too late.
> > >
> >
> > Build results:
> > total: 127 pass: 125 fail: 2
> > Failed builds:
> > hexagon:defconfig
> > hexagon:allnoconfig
> >
> > Qemu test results:
> > total: 80 pass: 80 fail: 0
> >
> > The hexagon build failures are different than before, but the builds still fail.
> >
> > In file included from include/linux/mm.h:19:0,
> > from arch/hexagon/kernel/asm-offsets.c:28:
> > include/linux/bit_spinlock.h: In function 'bit_spin_unlock':
> > include/linux/bit_spinlock.h:62:2: error: implicit declaration of function 'smp_mb__before_clear_bit'
> > In file included from arch/hexagon/kernel/asm-offsets.c:29:0:
> > include/linux/interrupt.h: In function 'tasklet_disable_nosync':
> > include/linux/interrupt.h:541:2: error: implicit declaration of function 'smp_mb__after_atomic_inc'
> > include/linux/interrupt.h: In function 'tasklet_enable':
> > include/linux/interrupt.h:553:2: error: implicit declaration of function 'smp_mb__before_atomic_dec'
>
> Odd, any idea what we can do to fix it?
>
> greg k-h
Apologies, the previous patch was the wrong one.
It really should have been this one:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=2ab08ee9f0a4eba27c7c4ce0b6d5118e8a18554b
There was a stale barrier.h left in the directory.
I tested this patch along with "sched: Fix TASK_DEAD race in finish_task_switch"
on v3.14 and it compiled for me.
Thanks,
Richard Kuo
--
Qualcomm Innovation Center, Inc.
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum,
a Linux Foundation Collaborative Project
^ permalink raw reply [flat|nested] 88+ messages in thread
* Re: [PATCH 3.14 00/79] 3.14.55-stable review
2015-10-19 19:13 ` Richard Kuo
@ 2015-10-19 20:09 ` Greg Kroah-Hartman
2015-10-19 21:31 ` Richard Kuo
0 siblings, 1 reply; 88+ messages in thread
From: Greg Kroah-Hartman @ 2015-10-19 20:09 UTC (permalink / raw)
To: Richard Kuo; +Cc: Guenter Roeck, linux-kernel, torvalds, akpm, shuah.kh, stable
On Mon, Oct 19, 2015 at 02:13:31PM -0500, Richard Kuo wrote:
> On Mon, Oct 19, 2015 at 08:14:47AM -0700, Greg Kroah-Hartman wrote:
> > On Sun, Oct 18, 2015 at 09:10:20PM -0700, Guenter Roeck wrote:
> > > On 10/17/2015 07:04 PM, Greg Kroah-Hartman wrote:
> > > >This is the start of the stable review cycle for the 3.14.55 release.
> > > >There are 79 patches in this series, all will be posted as a response
> > > >to this one. If anyone has any issues with these being applied, please
> > > >let me know.
> > > >
> > > >Responses should be made by Tue Oct 20 02:00:11 UTC 2015.
> > > >Anything received after that time might be too late.
> > > >
> > >
> > > Build results:
> > > total: 127 pass: 125 fail: 2
> > > Failed builds:
> > > hexagon:defconfig
> > > hexagon:allnoconfig
> > >
> > > Qemu test results:
> > > total: 80 pass: 80 fail: 0
> > >
> > > The hexagon build failures are different than before, but the builds still fail.
> > >
> > > In file included from include/linux/mm.h:19:0,
> > > from arch/hexagon/kernel/asm-offsets.c:28:
> > > include/linux/bit_spinlock.h: In function 'bit_spin_unlock':
> > > include/linux/bit_spinlock.h:62:2: error: implicit declaration of function 'smp_mb__before_clear_bit'
> > > In file included from arch/hexagon/kernel/asm-offsets.c:29:0:
> > > include/linux/interrupt.h: In function 'tasklet_disable_nosync':
> > > include/linux/interrupt.h:541:2: error: implicit declaration of function 'smp_mb__after_atomic_inc'
> > > include/linux/interrupt.h: In function 'tasklet_enable':
> > > include/linux/interrupt.h:553:2: error: implicit declaration of function 'smp_mb__before_atomic_dec'
> >
> > Odd, any idea what we can do to fix it?
> >
> > greg k-h
>
> Apologies, the previous patch was the wrong one.
So should I delete it? And if so, can you refresh my memory as to which
patch it was?
> It really should have been this one:
>
> https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=2ab08ee9f0a4eba27c7c4ce0b6d5118e8a18554b
>
> There was a stale barrier.h left in the directory.
I've applied this one now as well, thanks.
greg k-h
^ permalink raw reply [flat|nested] 88+ messages in thread
* Re: [PATCH 3.14 00/79] 3.14.55-stable review
2015-10-19 20:09 ` Greg Kroah-Hartman
@ 2015-10-19 21:31 ` Richard Kuo
0 siblings, 0 replies; 88+ messages in thread
From: Richard Kuo @ 2015-10-19 21:31 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: Guenter Roeck, linux-kernel, torvalds, akpm, shuah.kh, stable
On Mon, Oct 19, 2015 at 01:09:50PM -0700, Greg Kroah-Hartman wrote:
> > Apologies, the previous patch was the wrong one.
>
> So should I delete it? And if so, can you refresh my memory as to which
> patch it was?
This was the errant patch that you can remove from the queue.
>From 94cf42f823bc904305b0ee93a09bcd51ba380497 Mon Sep 17 00:00:00 2001
From: Peter Zijlstra <peterz@infradead.org>
Date: Thu, 13 Mar 2014 19:00:36 +0100
Subject: arch,hexagon: Convert smp_mb__*()
Thanks,
Richard Kuo
--
Qualcomm Innovation Center, Inc.
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum,
a Linux Foundation Collaborative Project
^ permalink raw reply [flat|nested] 88+ messages in thread
* Re: [PATCH 3.14 00/79] 3.14.55-stable review
2015-10-18 2:04 [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman
` (77 preceding siblings ...)
2015-10-19 4:10 ` [PATCH 3.14 00/79] 3.14.55-stable review Guenter Roeck
@ 2015-10-19 15:20 ` Shuah Khan
78 siblings, 0 replies; 88+ messages in thread
From: Shuah Khan @ 2015-10-19 15:20 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel; +Cc: torvalds, akpm, linux, shuah.kh, stable
On 10/17/2015 08:04 PM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 3.14.55 release.
> There are 79 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Tue Oct 20 02:00:11 UTC 2015.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> kernel.org/pub/linux/kernel/v3.x/stable-review/patch-3.14.55-rc1.gz
> and the diffstat can be found below.
>
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
--
Shuah Khan
Sr. Linux Kernel Developer
Open Source Innovation Group
Samsung Research America (Silicon Valley)
shuahkh@osg.samsung.com | (970) 217-8978
^ permalink raw reply [flat|nested] 88+ messages in thread