* [PATCH 4.4 01/60] 9p: fix a potential acl leak
2017-05-11 14:12 [PATCH 4.4 00/60] 4.4.68-stable review Greg Kroah-Hartman
@ 2017-05-11 14:12 ` Greg Kroah-Hartman
2017-05-11 14:12 ` [PATCH 4.4 02/60] ARM: 8452/3: PJ4: make coprocessor access sequences buildable in Thumb2 mode Greg Kroah-Hartman
` (56 subsequent siblings)
57 siblings, 0 replies; 68+ messages in thread
From: Greg Kroah-Hartman @ 2017-05-11 14:12 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Cong Wang, Mark Salyzyn, Jan Kara,
Greg Kurz, Eric Van Hensbergen, Ron Minnich, Latchesar Ionkov,
Andrew Morton, Linus Torvalds
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cong Wang <xiyou.wangcong@gmail.com>
commit b5c66bab72a6a65edb15beb60b90d3cb84c5763b upstream.
posix_acl_update_mode() could possibly clear 'acl', if so we leak the
memory pointed by 'acl'. Save this pointer before calling
posix_acl_update_mode() and release the memory if 'acl' really gets
cleared.
Link: http://lkml.kernel.org/r/1486678332-2430-1-git-send-email-xiyou.wangcong@gmail.com
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Reported-by: Mark Salyzyn <salyzyn@android.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: Greg Kurz <groug@kaod.org>
Cc: Eric Van Hensbergen <ericvh@gmail.com>
Cc: Ron Minnich <rminnich@sandia.gov>
Cc: Latchesar Ionkov <lucho@ionkov.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/9p/acl.c | 2 ++
1 file changed, 2 insertions(+)
--- a/fs/9p/acl.c
+++ b/fs/9p/acl.c
@@ -283,6 +283,7 @@ static int v9fs_xattr_set_acl(const stru
case ACL_TYPE_ACCESS:
if (acl) {
struct iattr iattr;
+ struct posix_acl *old_acl = acl;
retval = posix_acl_update_mode(inode, &iattr.ia_mode, &acl);
if (retval)
@@ -293,6 +294,7 @@ static int v9fs_xattr_set_acl(const stru
* by the mode bits. So don't
* update ACL.
*/
+ posix_acl_release(old_acl);
value = NULL;
size = 0;
}
^ permalink raw reply [flat|nested] 68+ messages in thread* [PATCH 4.4 02/60] ARM: 8452/3: PJ4: make coprocessor access sequences buildable in Thumb2 mode
2017-05-11 14:12 [PATCH 4.4 00/60] 4.4.68-stable review Greg Kroah-Hartman
2017-05-11 14:12 ` [PATCH 4.4 01/60] 9p: fix a potential acl leak Greg Kroah-Hartman
@ 2017-05-11 14:12 ` Greg Kroah-Hartman
2017-05-11 14:12 ` [PATCH 4.4 03/60] cpupower: Fix turbo frequency reporting for pre-Sandy Bridge cores Greg Kroah-Hartman
` (55 subsequent siblings)
57 siblings, 0 replies; 68+ messages in thread
From: Greg Kroah-Hartman @ 2017-05-11 14:12 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Nicolas Pitre,
Ard Biesheuvel, Russell King
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
commit 5008efc83bf85b647aa1cbc44718b1675bbb7444 upstream.
The PJ4 inline asm sequence to write to cp15 cannot be built in Thumb-2
mode, due to the way it performs arithmetic on the program counter, so it
is built in ARM mode instead. However, building C files in ARM mode under
CONFIG_THUMB2_KERNEL is problematic, since the instrumentation performed
by subsystems like ftrace does not expect having to deal with interworking
branches.
Since the sequence in question is simply a poor man's ISB instruction,
let's use a straight 'isb' instead when building in Thumb2 mode. Thumb2
implies V7, so 'isb' should always be supported in that case.
Acked-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Nicolas Pitre <nico@linaro.org>
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/kernel/Makefile | 1 -
arch/arm/kernel/pj4-cp0.c | 4 ++++
2 files changed, 4 insertions(+), 1 deletion(-)
--- a/arch/arm/kernel/Makefile
+++ b/arch/arm/kernel/Makefile
@@ -73,7 +73,6 @@ obj-$(CONFIG_IWMMXT) += iwmmxt.o
obj-$(CONFIG_PERF_EVENTS) += perf_regs.o perf_callchain.o
obj-$(CONFIG_HW_PERF_EVENTS) += perf_event_xscale.o perf_event_v6.o \
perf_event_v7.o
-CFLAGS_pj4-cp0.o := -marm
AFLAGS_iwmmxt.o := -Wa,-mcpu=iwmmxt
obj-$(CONFIG_ARM_CPU_TOPOLOGY) += topology.o
obj-$(CONFIG_VDSO) += vdso.o
--- a/arch/arm/kernel/pj4-cp0.c
+++ b/arch/arm/kernel/pj4-cp0.c
@@ -66,9 +66,13 @@ static void __init pj4_cp_access_write(u
__asm__ __volatile__ (
"mcr p15, 0, %1, c1, c0, 2\n\t"
+#ifdef CONFIG_THUMB2_KERNEL
+ "isb\n\t"
+#else
"mrc p15, 0, %0, c1, c0, 2\n\t"
"mov %0, %0\n\t"
"sub pc, pc, #4\n\t"
+#endif
: "=r" (temp) : "r" (value));
}
^ permalink raw reply [flat|nested] 68+ messages in thread* [PATCH 4.4 03/60] cpupower: Fix turbo frequency reporting for pre-Sandy Bridge cores
2017-05-11 14:12 [PATCH 4.4 00/60] 4.4.68-stable review Greg Kroah-Hartman
2017-05-11 14:12 ` [PATCH 4.4 01/60] 9p: fix a potential acl leak Greg Kroah-Hartman
2017-05-11 14:12 ` [PATCH 4.4 02/60] ARM: 8452/3: PJ4: make coprocessor access sequences buildable in Thumb2 mode Greg Kroah-Hartman
@ 2017-05-11 14:12 ` Greg Kroah-Hartman
2017-05-11 14:12 ` [PATCH 4.4 04/60] powerpc/powernv: Fix opal_exit tracepoint opcode Greg Kroah-Hartman
` (54 subsequent siblings)
57 siblings, 0 replies; 68+ messages in thread
From: Greg Kroah-Hartman @ 2017-05-11 14:12 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, GSR, Ben Hutchings, Rafael J. Wysocki
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <ben@decadent.org.uk>
commit 4cca0457686e4ee1677d69469e4ddfd94d389a80 upstream.
The switch that conditionally sets CPUPOWER_CAP_HAS_TURBO_RATIO and
CPUPOWER_CAP_IS_SNB flags is missing a break, so all cores get both
flags set and an assumed base clock of 100 MHz for turbo values.
Reported-by: GSR <gsr.bugs@infernal-iceberg.com>
Tested-by: GSR <gsr.bugs@infernal-iceberg.com>
References: https://bugs.debian.org/859978
Fixes: 8fb2e440b223 (cpupower: Show Intel turbo ratio support via ...)
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/power/cpupower/utils/helpers/cpuid.c | 1 +
1 file changed, 1 insertion(+)
--- a/tools/power/cpupower/utils/helpers/cpuid.c
+++ b/tools/power/cpupower/utils/helpers/cpuid.c
@@ -156,6 +156,7 @@ out:
*/
case 0x2C: /* Westmere EP - Gulftown */
cpu_info->caps |= CPUPOWER_CAP_HAS_TURBO_RATIO;
+ break;
case 0x2A: /* SNB */
case 0x2D: /* SNB Xeon */
case 0x3A: /* IVB */
^ permalink raw reply [flat|nested] 68+ messages in thread* [PATCH 4.4 04/60] powerpc/powernv: Fix opal_exit tracepoint opcode
2017-05-11 14:12 [PATCH 4.4 00/60] 4.4.68-stable review Greg Kroah-Hartman
` (2 preceding siblings ...)
2017-05-11 14:12 ` [PATCH 4.4 03/60] cpupower: Fix turbo frequency reporting for pre-Sandy Bridge cores Greg Kroah-Hartman
@ 2017-05-11 14:12 ` Greg Kroah-Hartman
2017-05-11 14:12 ` [PATCH 4.4 05/60] power: supply: bq24190_charger: Fix irq trigger to IRQF_TRIGGER_FALLING Greg Kroah-Hartman
` (53 subsequent siblings)
57 siblings, 0 replies; 68+ messages in thread
From: Greg Kroah-Hartman @ 2017-05-11 14:12 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Michael Ellerman
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Ellerman <mpe@ellerman.id.au>
commit a7e0fb6c2029a780444d09560f739e020d54fe4d upstream.
Currently the opal_exit tracepoint usually shows the opcode as 0:
<idle>-0 [047] d.h. 635.654292: opal_entry: opcode=63
<idle>-0 [047] d.h. 635.654296: opal_exit: opcode=0 retval=0
kopald-1209 [019] d... 636.420943: opal_entry: opcode=10
kopald-1209 [019] d... 636.420959: opal_exit: opcode=0 retval=0
This is because we incorrectly load the opcode into r0 before calling
__trace_opal_exit(), whereas it expects the opcode in r3 (first function
parameter). In fact we are leaving the retval in r3, so opcode and
retval will always show the same value.
Instead load the opcode into r3, resulting in:
<idle>-0 [040] d.h. 636.618625: opal_entry: opcode=63
<idle>-0 [040] d.h. 636.618627: opal_exit: opcode=63 retval=0
Fixes: c49f63530bb6 ("powernv: Add OPAL tracepoints")
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/platforms/powernv/opal-wrappers.S | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/powerpc/platforms/powernv/opal-wrappers.S
+++ b/arch/powerpc/platforms/powernv/opal-wrappers.S
@@ -148,7 +148,7 @@ opal_tracepoint_entry:
opal_tracepoint_return:
std r3,STK_REG(R31)(r1)
mr r4,r3
- ld r0,STK_REG(R23)(r1)
+ ld r3,STK_REG(R23)(r1)
bl __trace_opal_exit
ld r3,STK_REG(R31)(r1)
addi r1,r1,STACKFRAMESIZE
^ permalink raw reply [flat|nested] 68+ messages in thread* [PATCH 4.4 05/60] power: supply: bq24190_charger: Fix irq trigger to IRQF_TRIGGER_FALLING
2017-05-11 14:12 [PATCH 4.4 00/60] 4.4.68-stable review Greg Kroah-Hartman
` (3 preceding siblings ...)
2017-05-11 14:12 ` [PATCH 4.4 04/60] powerpc/powernv: Fix opal_exit tracepoint opcode Greg Kroah-Hartman
@ 2017-05-11 14:12 ` Greg Kroah-Hartman
2017-05-11 14:12 ` [PATCH 4.4 06/60] power: supply: bq24190_charger: Call set_mode_host() on pm_resume() Greg Kroah-Hartman
` (52 subsequent siblings)
57 siblings, 0 replies; 68+ messages in thread
From: Greg Kroah-Hartman @ 2017-05-11 14:12 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Liam Breck, Mark Greer,
Tony Lindgren, Sebastian Reichel
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liam Breck <liam@networkimprov.net>
commit 767eee362fd72bb2ca44cc80419ca4b38c6d8369 upstream.
The interrupt signal is TRIGGER_FALLING. This is is specified in the
data sheet PIN FUNCTIONS: "The INT pin sends active low, 256us
pulse to host to report charger device status and fault."
Also the direction can be seen in the data sheet Figure 37 "BQ24190
with D+/D- Detection and USB On-The-Go (OTG)" which shows a 10k
pull-up resistor installed for the sample configurations.
Fixes: d7bf353fd0aa3 ("bq24190_charger: Add support for TI BQ24190 Battery Charger")
Signed-off-by: Liam Breck <kernel@networkimprov.net>
Acked-by: Mark Greer <mgreer@animalcreek.com>
Acked-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sebastian Reichel <sre@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/power/bq24190_charger.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/power/bq24190_charger.c
+++ b/drivers/power/bq24190_charger.c
@@ -1394,7 +1394,7 @@ static int bq24190_probe(struct i2c_clie
ret = devm_request_threaded_irq(dev, bdi->irq, NULL,
bq24190_irq_handler_thread,
- IRQF_TRIGGER_RISING | IRQF_ONESHOT,
+ IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
"bq24190-charger", bdi);
if (ret < 0) {
dev_err(dev, "Can't set up irq handler\n");
^ permalink raw reply [flat|nested] 68+ messages in thread* [PATCH 4.4 06/60] power: supply: bq24190_charger: Call set_mode_host() on pm_resume()
2017-05-11 14:12 [PATCH 4.4 00/60] 4.4.68-stable review Greg Kroah-Hartman
` (4 preceding siblings ...)
2017-05-11 14:12 ` [PATCH 4.4 05/60] power: supply: bq24190_charger: Fix irq trigger to IRQF_TRIGGER_FALLING Greg Kroah-Hartman
@ 2017-05-11 14:12 ` Greg Kroah-Hartman
2017-05-11 14:12 ` [PATCH 4.4 07/60] power: supply: bq24190_charger: Install irq_handler_thread() at end of probe() Greg Kroah-Hartman
` (51 subsequent siblings)
57 siblings, 0 replies; 68+ messages in thread
From: Greg Kroah-Hartman @ 2017-05-11 14:12 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Liam Breck, Mark Greer,
Tony Lindgren, Sebastian Reichel
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liam Breck <liam@networkimprov.net>
commit e05ad7e0741ce0505e1df157c62b22b95172bb97 upstream.
pm_resume() does a register_reset() which clears charger host mode.
Fix by calling set_mode_host() after the reset.
Fixes: d7bf353fd0aa3 ("bq24190_charger: Add support for TI BQ24190 Battery Charger")
Signed-off-by: Liam Breck <kernel@networkimprov.net>
Acked-by: Mark Greer <mgreer@animalcreek.com>
Acked-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sebastian Reichel <sre@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/power/bq24190_charger.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/power/bq24190_charger.c
+++ b/drivers/power/bq24190_charger.c
@@ -1494,6 +1494,7 @@ static int bq24190_pm_resume(struct devi
pm_runtime_get_sync(bdi->dev);
bq24190_register_reset(bdi);
+ bq24190_set_mode_host(bdi);
pm_runtime_put_sync(bdi->dev);
/* Things may have changed while suspended so alert upper layer */
^ permalink raw reply [flat|nested] 68+ messages in thread* [PATCH 4.4 07/60] power: supply: bq24190_charger: Install irq_handler_thread() at end of probe()
2017-05-11 14:12 [PATCH 4.4 00/60] 4.4.68-stable review Greg Kroah-Hartman
` (5 preceding siblings ...)
2017-05-11 14:12 ` [PATCH 4.4 06/60] power: supply: bq24190_charger: Call set_mode_host() on pm_resume() Greg Kroah-Hartman
@ 2017-05-11 14:12 ` Greg Kroah-Hartman
2017-05-11 14:12 ` [PATCH 4.4 08/60] power: supply: bq24190_charger: Call power_supply_changed() for relevant component Greg Kroah-Hartman
` (50 subsequent siblings)
57 siblings, 0 replies; 68+ messages in thread
From: Greg Kroah-Hartman @ 2017-05-11 14:12 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Liam Breck, Mark Greer,
Tony Lindgren, Sebastian Reichel
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liam Breck <liam@networkimprov.net>
commit d62acc5ef0621463446091ebd7a345e06e9ab80c upstream.
The device specific data is not fully initialized on
request_threaded_irq(). This may cause a crash when the IRQ handler
tries to reference them.
Fix the issue by installing IRQ handler at the end of the probe.
Fixes: d7bf353fd0aa3 ("bq24190_charger: Add support for TI BQ24190 Battery Charger")
Signed-off-by: Liam Breck <kernel@networkimprov.net>
Acked-by: Mark Greer <mgreer@animalcreek.com>
Acked-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sebastian Reichel <sre@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/power/bq24190_charger.c | 31 ++++++++++++++++---------------
1 file changed, 16 insertions(+), 15 deletions(-)
--- a/drivers/power/bq24190_charger.c
+++ b/drivers/power/bq24190_charger.c
@@ -1392,22 +1392,13 @@ static int bq24190_probe(struct i2c_clie
return -EINVAL;
}
- ret = devm_request_threaded_irq(dev, bdi->irq, NULL,
- bq24190_irq_handler_thread,
- IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
- "bq24190-charger", bdi);
- if (ret < 0) {
- dev_err(dev, "Can't set up irq handler\n");
- goto out1;
- }
-
pm_runtime_enable(dev);
pm_runtime_resume(dev);
ret = bq24190_hw_init(bdi);
if (ret < 0) {
dev_err(dev, "Hardware init failed\n");
- goto out2;
+ goto out1;
}
charger_cfg.drv_data = bdi;
@@ -1418,7 +1409,7 @@ static int bq24190_probe(struct i2c_clie
if (IS_ERR(bdi->charger)) {
dev_err(dev, "Can't register charger\n");
ret = PTR_ERR(bdi->charger);
- goto out2;
+ goto out1;
}
battery_cfg.drv_data = bdi;
@@ -1427,24 +1418,34 @@ static int bq24190_probe(struct i2c_clie
if (IS_ERR(bdi->battery)) {
dev_err(dev, "Can't register battery\n");
ret = PTR_ERR(bdi->battery);
- goto out3;
+ goto out2;
}
ret = bq24190_sysfs_create_group(bdi);
if (ret) {
dev_err(dev, "Can't create sysfs entries\n");
+ goto out3;
+ }
+
+ ret = devm_request_threaded_irq(dev, bdi->irq, NULL,
+ bq24190_irq_handler_thread,
+ IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
+ "bq24190-charger", bdi);
+ if (ret < 0) {
+ dev_err(dev, "Can't set up irq handler\n");
goto out4;
}
return 0;
out4:
- power_supply_unregister(bdi->battery);
+ bq24190_sysfs_remove_group(bdi);
out3:
- power_supply_unregister(bdi->charger);
+ power_supply_unregister(bdi->battery);
out2:
- pm_runtime_disable(dev);
+ power_supply_unregister(bdi->charger);
out1:
+ pm_runtime_disable(dev);
if (bdi->gpio_int)
gpio_free(bdi->gpio_int);
^ permalink raw reply [flat|nested] 68+ messages in thread* [PATCH 4.4 08/60] power: supply: bq24190_charger: Call power_supply_changed() for relevant component
2017-05-11 14:12 [PATCH 4.4 00/60] 4.4.68-stable review Greg Kroah-Hartman
` (6 preceding siblings ...)
2017-05-11 14:12 ` [PATCH 4.4 07/60] power: supply: bq24190_charger: Install irq_handler_thread() at end of probe() Greg Kroah-Hartman
@ 2017-05-11 14:12 ` Greg Kroah-Hartman
2017-05-11 14:12 ` [PATCH 4.4 09/60] power: supply: bq24190_charger: Dont read fault register outside irq_handle_thread() Greg Kroah-Hartman
` (49 subsequent siblings)
57 siblings, 0 replies; 68+ messages in thread
From: Greg Kroah-Hartman @ 2017-05-11 14:12 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Liam Breck, Mark Greer,
Tony Lindgren, Sebastian Reichel
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liam Breck <liam@networkimprov.net>
commit 2d9fee6a42ea170e4378b3363a7ad385d0e67281 upstream.
We wrongly get uevents for bq24190-charger and bq24190-battery on every
register change.
Fix by checking the association with charger and battery before
emitting uevent(s).
Fixes: d7bf353fd0aa3 ("bq24190_charger: Add support for TI BQ24190 Battery Charger")
Signed-off-by: Liam Breck <kernel@networkimprov.net>
Acked-by: Mark Greer <mgreer@animalcreek.com>
Acked-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sebastian Reichel <sre@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/power/bq24190_charger.c | 50 +++++++++++++++++++++-------------------
1 file changed, 27 insertions(+), 23 deletions(-)
--- a/drivers/power/bq24190_charger.c
+++ b/drivers/power/bq24190_charger.c
@@ -159,7 +159,6 @@ struct bq24190_dev_info {
unsigned int gpio_int;
unsigned int irq;
struct mutex f_reg_lock;
- bool first_time;
bool charger_health_valid;
bool battery_health_valid;
bool battery_status_valid;
@@ -1197,7 +1196,10 @@ static const struct power_supply_desc bq
static irqreturn_t bq24190_irq_handler_thread(int irq, void *data)
{
struct bq24190_dev_info *bdi = data;
- bool alert_userspace = false;
+ const u8 battery_mask_ss = BQ24190_REG_SS_CHRG_STAT_MASK;
+ const u8 battery_mask_f = BQ24190_REG_F_BAT_FAULT_MASK
+ | BQ24190_REG_F_NTC_FAULT_MASK;
+ bool alert_charger = false, alert_battery = false;
u8 ss_reg = 0, f_reg = 0;
int ret;
@@ -1225,8 +1227,12 @@ static irqreturn_t bq24190_irq_handler_t
ret);
}
+ if ((bdi->ss_reg & battery_mask_ss) != (ss_reg & battery_mask_ss))
+ alert_battery = true;
+ if ((bdi->ss_reg & ~battery_mask_ss) != (ss_reg & ~battery_mask_ss))
+ alert_charger = true;
+
bdi->ss_reg = ss_reg;
- alert_userspace = true;
}
mutex_lock(&bdi->f_reg_lock);
@@ -1239,33 +1245,23 @@ static irqreturn_t bq24190_irq_handler_t
}
if (f_reg != bdi->f_reg) {
+ if ((bdi->f_reg & battery_mask_f) != (f_reg & battery_mask_f))
+ alert_battery = true;
+ if ((bdi->f_reg & ~battery_mask_f) != (f_reg & ~battery_mask_f))
+ alert_charger = true;
+
bdi->f_reg = f_reg;
bdi->charger_health_valid = true;
bdi->battery_health_valid = true;
bdi->battery_status_valid = true;
-
- alert_userspace = true;
}
mutex_unlock(&bdi->f_reg_lock);
- /*
- * Sometimes bq24190 gives a steady trickle of interrupts even
- * though the watchdog timer is turned off and neither the STATUS
- * nor FAULT registers have changed. Weed out these sprurious
- * interrupts so userspace isn't alerted for no reason.
- * In addition, the chip always generates an interrupt after
- * register reset so we should ignore that one (the very first
- * interrupt received).
- */
- if (alert_userspace) {
- if (!bdi->first_time) {
- power_supply_changed(bdi->charger);
- power_supply_changed(bdi->battery);
- } else {
- bdi->first_time = false;
- }
- }
+ if (alert_charger)
+ power_supply_changed(bdi->charger);
+ if (alert_battery)
+ power_supply_changed(bdi->battery);
out:
pm_runtime_put_sync(bdi->dev);
@@ -1300,6 +1296,10 @@ static int bq24190_hw_init(struct bq2419
goto out;
ret = bq24190_set_mode_host(bdi);
+ if (ret < 0)
+ goto out;
+
+ ret = bq24190_read(bdi, BQ24190_REG_SS, &bdi->ss_reg);
out:
pm_runtime_put_sync(bdi->dev);
return ret;
@@ -1375,7 +1375,8 @@ static int bq24190_probe(struct i2c_clie
bdi->model = id->driver_data;
strncpy(bdi->model_name, id->name, I2C_NAME_SIZE);
mutex_init(&bdi->f_reg_lock);
- bdi->first_time = true;
+ bdi->f_reg = 0;
+ bdi->ss_reg = BQ24190_REG_SS_VBUS_STAT_MASK; /* impossible state */
bdi->charger_health_valid = false;
bdi->battery_health_valid = false;
bdi->battery_status_valid = false;
@@ -1489,6 +1490,8 @@ static int bq24190_pm_resume(struct devi
struct i2c_client *client = to_i2c_client(dev);
struct bq24190_dev_info *bdi = i2c_get_clientdata(client);
+ bdi->f_reg = 0;
+ bdi->ss_reg = BQ24190_REG_SS_VBUS_STAT_MASK; /* impossible state */
bdi->charger_health_valid = false;
bdi->battery_health_valid = false;
bdi->battery_status_valid = false;
@@ -1496,6 +1499,7 @@ static int bq24190_pm_resume(struct devi
pm_runtime_get_sync(bdi->dev);
bq24190_register_reset(bdi);
bq24190_set_mode_host(bdi);
+ bq24190_read(bdi, BQ24190_REG_SS, &bdi->ss_reg);
pm_runtime_put_sync(bdi->dev);
/* Things may have changed while suspended so alert upper layer */
^ permalink raw reply [flat|nested] 68+ messages in thread* [PATCH 4.4 09/60] power: supply: bq24190_charger: Dont read fault register outside irq_handle_thread()
2017-05-11 14:12 [PATCH 4.4 00/60] 4.4.68-stable review Greg Kroah-Hartman
` (7 preceding siblings ...)
2017-05-11 14:12 ` [PATCH 4.4 08/60] power: supply: bq24190_charger: Call power_supply_changed() for relevant component Greg Kroah-Hartman
@ 2017-05-11 14:12 ` Greg Kroah-Hartman
2017-05-11 14:12 ` [PATCH 4.4 10/60] power: supply: bq24190_charger: Handle fault before status on interrupt Greg Kroah-Hartman
` (48 subsequent siblings)
57 siblings, 0 replies; 68+ messages in thread
From: Greg Kroah-Hartman @ 2017-05-11 14:12 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Liam Breck, Mark Greer,
Tony Lindgren, Sebastian Reichel
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liam Breck <liam@networkimprov.net>
commit 68abfb8015832ddf728b911769659468efaf8bd9 upstream.
Caching the fault register after a single I2C read may not keep an accurate
value.
Fix by doing two reads in irq_handle_thread() and using the cached value
elsewhere. If a safety timer fault later clears itself, we apparently don't get
an interrupt (INT), however other interrupts would refresh the register cache.
>From the data sheet: "When a fault occurs, the charger device sends out INT
and keeps the fault state in REG09 until the host reads the fault register.
Before the host reads REG09 and all the faults are cleared, the charger
device would not send any INT upon new faults. In order to read the
current fault status, the host has to read REG09 two times consecutively.
The 1st reads fault register status from the last read [1] and the 2nd reads
the current fault register status."
[1] presumably a typo; should be "last fault"
Fixes: d7bf353fd0aa3 ("bq24190_charger: Add support for TI BQ24190 Battery Charger")
Signed-off-by: Liam Breck <kernel@networkimprov.net>
Acked-by: Mark Greer <mgreer@animalcreek.com>
Acked-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sebastian Reichel <sre@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/power/bq24190_charger.c | 94 +++++++++++-----------------------------
1 file changed, 27 insertions(+), 67 deletions(-)
--- a/drivers/power/bq24190_charger.c
+++ b/drivers/power/bq24190_charger.c
@@ -144,10 +144,7 @@
* so the first read after a fault returns the latched value and subsequent
* reads return the current value. In order to return the fault status
* to the user, have the interrupt handler save the reg's value and retrieve
- * it in the appropriate health/status routine. Each routine has its own
- * flag indicating whether it should use the value stored by the last run
- * of the interrupt handler or do an actual reg read. That way each routine
- * can report back whatever fault may have occured.
+ * it in the appropriate health/status routine.
*/
struct bq24190_dev_info {
struct i2c_client *client;
@@ -159,9 +156,6 @@ struct bq24190_dev_info {
unsigned int gpio_int;
unsigned int irq;
struct mutex f_reg_lock;
- bool charger_health_valid;
- bool battery_health_valid;
- bool battery_status_valid;
u8 f_reg;
u8 ss_reg;
u8 watchdog;
@@ -635,21 +629,11 @@ static int bq24190_charger_get_health(st
union power_supply_propval *val)
{
u8 v;
- int health, ret;
+ int health;
mutex_lock(&bdi->f_reg_lock);
-
- if (bdi->charger_health_valid) {
- v = bdi->f_reg;
- bdi->charger_health_valid = false;
- mutex_unlock(&bdi->f_reg_lock);
- } else {
- mutex_unlock(&bdi->f_reg_lock);
-
- ret = bq24190_read(bdi, BQ24190_REG_F, &v);
- if (ret < 0)
- return ret;
- }
+ v = bdi->f_reg;
+ mutex_unlock(&bdi->f_reg_lock);
if (v & BQ24190_REG_F_BOOST_FAULT_MASK) {
/*
@@ -936,18 +920,8 @@ static int bq24190_battery_get_status(st
int status, ret;
mutex_lock(&bdi->f_reg_lock);
-
- if (bdi->battery_status_valid) {
- chrg_fault = bdi->f_reg;
- bdi->battery_status_valid = false;
- mutex_unlock(&bdi->f_reg_lock);
- } else {
- mutex_unlock(&bdi->f_reg_lock);
-
- ret = bq24190_read(bdi, BQ24190_REG_F, &chrg_fault);
- if (ret < 0)
- return ret;
- }
+ chrg_fault = bdi->f_reg;
+ mutex_unlock(&bdi->f_reg_lock);
chrg_fault &= BQ24190_REG_F_CHRG_FAULT_MASK;
chrg_fault >>= BQ24190_REG_F_CHRG_FAULT_SHIFT;
@@ -995,21 +969,11 @@ static int bq24190_battery_get_health(st
union power_supply_propval *val)
{
u8 v;
- int health, ret;
+ int health;
mutex_lock(&bdi->f_reg_lock);
-
- if (bdi->battery_health_valid) {
- v = bdi->f_reg;
- bdi->battery_health_valid = false;
- mutex_unlock(&bdi->f_reg_lock);
- } else {
- mutex_unlock(&bdi->f_reg_lock);
-
- ret = bq24190_read(bdi, BQ24190_REG_F, &v);
- if (ret < 0)
- return ret;
- }
+ v = bdi->f_reg;
+ mutex_unlock(&bdi->f_reg_lock);
if (v & BQ24190_REG_F_BAT_FAULT_MASK) {
health = POWER_SUPPLY_HEALTH_OVERVOLTAGE;
@@ -1201,7 +1165,7 @@ static irqreturn_t bq24190_irq_handler_t
| BQ24190_REG_F_NTC_FAULT_MASK;
bool alert_charger = false, alert_battery = false;
u8 ss_reg = 0, f_reg = 0;
- int ret;
+ int i, ret;
pm_runtime_get_sync(bdi->dev);
@@ -1231,33 +1195,35 @@ static irqreturn_t bq24190_irq_handler_t
alert_battery = true;
if ((bdi->ss_reg & ~battery_mask_ss) != (ss_reg & ~battery_mask_ss))
alert_charger = true;
-
bdi->ss_reg = ss_reg;
}
- mutex_lock(&bdi->f_reg_lock);
-
- ret = bq24190_read(bdi, BQ24190_REG_F, &f_reg);
- if (ret < 0) {
- mutex_unlock(&bdi->f_reg_lock);
- dev_err(bdi->dev, "Can't read F reg: %d\n", ret);
- goto out;
- }
+ i = 0;
+ do {
+ ret = bq24190_read(bdi, BQ24190_REG_F, &f_reg);
+ if (ret < 0) {
+ dev_err(bdi->dev, "Can't read F reg: %d\n", ret);
+ goto out;
+ }
+ } while (f_reg && ++i < 2);
if (f_reg != bdi->f_reg) {
+ dev_info(bdi->dev,
+ "Fault: boost %d, charge %d, battery %d, ntc %d\n",
+ !!(f_reg & BQ24190_REG_F_BOOST_FAULT_MASK),
+ !!(f_reg & BQ24190_REG_F_CHRG_FAULT_MASK),
+ !!(f_reg & BQ24190_REG_F_BAT_FAULT_MASK),
+ !!(f_reg & BQ24190_REG_F_NTC_FAULT_MASK));
+
+ mutex_lock(&bdi->f_reg_lock);
if ((bdi->f_reg & battery_mask_f) != (f_reg & battery_mask_f))
alert_battery = true;
if ((bdi->f_reg & ~battery_mask_f) != (f_reg & ~battery_mask_f))
alert_charger = true;
-
bdi->f_reg = f_reg;
- bdi->charger_health_valid = true;
- bdi->battery_health_valid = true;
- bdi->battery_status_valid = true;
+ mutex_unlock(&bdi->f_reg_lock);
}
- mutex_unlock(&bdi->f_reg_lock);
-
if (alert_charger)
power_supply_changed(bdi->charger);
if (alert_battery)
@@ -1377,9 +1343,6 @@ static int bq24190_probe(struct i2c_clie
mutex_init(&bdi->f_reg_lock);
bdi->f_reg = 0;
bdi->ss_reg = BQ24190_REG_SS_VBUS_STAT_MASK; /* impossible state */
- bdi->charger_health_valid = false;
- bdi->battery_health_valid = false;
- bdi->battery_status_valid = false;
i2c_set_clientdata(client, bdi);
@@ -1492,9 +1455,6 @@ static int bq24190_pm_resume(struct devi
bdi->f_reg = 0;
bdi->ss_reg = BQ24190_REG_SS_VBUS_STAT_MASK; /* impossible state */
- bdi->charger_health_valid = false;
- bdi->battery_health_valid = false;
- bdi->battery_status_valid = false;
pm_runtime_get_sync(bdi->dev);
bq24190_register_reset(bdi);
^ permalink raw reply [flat|nested] 68+ messages in thread* [PATCH 4.4 10/60] power: supply: bq24190_charger: Handle fault before status on interrupt
2017-05-11 14:12 [PATCH 4.4 00/60] 4.4.68-stable review Greg Kroah-Hartman
` (8 preceding siblings ...)
2017-05-11 14:12 ` [PATCH 4.4 09/60] power: supply: bq24190_charger: Dont read fault register outside irq_handle_thread() Greg Kroah-Hartman
@ 2017-05-11 14:12 ` Greg Kroah-Hartman
2017-05-11 14:12 ` [PATCH 4.4 11/60] leds: ktd2692: avoid harmless maybe-uninitialized warning Greg Kroah-Hartman
` (47 subsequent siblings)
57 siblings, 0 replies; 68+ messages in thread
From: Greg Kroah-Hartman @ 2017-05-11 14:12 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Liam Breck, Mark Greer,
Tony Lindgren, Sebastian Reichel
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liam Breck <liam@networkimprov.net>
commit ba52e75718784fda1b683ee0bfded72a0b83b047 upstream.
Reading both fault and status registers and logging any fault should
take priority over handling status register update.
Fix by moving the status handling to later in interrupt routine.
Fixes: d7bf353fd0aa3 ("bq24190_charger: Add support for TI BQ24190 Battery Charger")
Signed-off-by: Liam Breck <kernel@networkimprov.net>
Acked-by: Mark Greer <mgreer@animalcreek.com>
Acked-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sebastian Reichel <sre@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/power/bq24190_charger.c | 46 ++++++++++++++++++++--------------------
1 file changed, 23 insertions(+), 23 deletions(-)
--- a/drivers/power/bq24190_charger.c
+++ b/drivers/power/bq24190_charger.c
@@ -1175,29 +1175,6 @@ static irqreturn_t bq24190_irq_handler_t
goto out;
}
- if (ss_reg != bdi->ss_reg) {
- /*
- * The device is in host mode so when PG_STAT goes from 1->0
- * (i.e., power removed) HIZ needs to be disabled.
- */
- if ((bdi->ss_reg & BQ24190_REG_SS_PG_STAT_MASK) &&
- !(ss_reg & BQ24190_REG_SS_PG_STAT_MASK)) {
- ret = bq24190_write_mask(bdi, BQ24190_REG_ISC,
- BQ24190_REG_ISC_EN_HIZ_MASK,
- BQ24190_REG_ISC_EN_HIZ_SHIFT,
- 0);
- if (ret < 0)
- dev_err(bdi->dev, "Can't access ISC reg: %d\n",
- ret);
- }
-
- if ((bdi->ss_reg & battery_mask_ss) != (ss_reg & battery_mask_ss))
- alert_battery = true;
- if ((bdi->ss_reg & ~battery_mask_ss) != (ss_reg & ~battery_mask_ss))
- alert_charger = true;
- bdi->ss_reg = ss_reg;
- }
-
i = 0;
do {
ret = bq24190_read(bdi, BQ24190_REG_F, &f_reg);
@@ -1224,6 +1201,29 @@ static irqreturn_t bq24190_irq_handler_t
mutex_unlock(&bdi->f_reg_lock);
}
+ if (ss_reg != bdi->ss_reg) {
+ /*
+ * The device is in host mode so when PG_STAT goes from 1->0
+ * (i.e., power removed) HIZ needs to be disabled.
+ */
+ if ((bdi->ss_reg & BQ24190_REG_SS_PG_STAT_MASK) &&
+ !(ss_reg & BQ24190_REG_SS_PG_STAT_MASK)) {
+ ret = bq24190_write_mask(bdi, BQ24190_REG_ISC,
+ BQ24190_REG_ISC_EN_HIZ_MASK,
+ BQ24190_REG_ISC_EN_HIZ_SHIFT,
+ 0);
+ if (ret < 0)
+ dev_err(bdi->dev, "Can't access ISC reg: %d\n",
+ ret);
+ }
+
+ if ((bdi->ss_reg & battery_mask_ss) != (ss_reg & battery_mask_ss))
+ alert_battery = true;
+ if ((bdi->ss_reg & ~battery_mask_ss) != (ss_reg & ~battery_mask_ss))
+ alert_charger = true;
+ bdi->ss_reg = ss_reg;
+ }
+
if (alert_charger)
power_supply_changed(bdi->charger);
if (alert_battery)
^ permalink raw reply [flat|nested] 68+ messages in thread* [PATCH 4.4 11/60] leds: ktd2692: avoid harmless maybe-uninitialized warning
2017-05-11 14:12 [PATCH 4.4 00/60] 4.4.68-stable review Greg Kroah-Hartman
` (9 preceding siblings ...)
2017-05-11 14:12 ` [PATCH 4.4 10/60] power: supply: bq24190_charger: Handle fault before status on interrupt Greg Kroah-Hartman
@ 2017-05-11 14:12 ` Greg Kroah-Hartman
2017-05-11 14:12 ` [PATCH 4.4 12/60] ARM: OMAP5 / DRA7: Fix HYP mode boot for thumb2 build Greg Kroah-Hartman
` (46 subsequent siblings)
57 siblings, 0 replies; 68+ messages in thread
From: Greg Kroah-Hartman @ 2017-05-11 14:12 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Pavel Machek,
Jacek Anaszewski
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <arnd@arndb.de>
commit cbe99c538d1776009e8710755bb6e726f7fffa9b upstream.
gcc gets confused about the control flow in ktd2692_parse_dt(), causing
it to warn about what seems like a potential bug:
drivers/leds/leds-ktd2692.c: In function 'ktd2692_probe':
drivers/leds/leds-ktd2692.c:244:15: error: '*((void *)&led_cfg+8)' may be used uninitialized in this function [-Werror=maybe-uninitialized]
drivers/leds/leds-ktd2692.c:225:7: error: 'led_cfg.flash_max_microamp' may be used uninitialized in this function [-Werror=maybe-uninitialized]
drivers/leds/leds-ktd2692.c:232:3: error: 'led_cfg.movie_max_microamp' may be used uninitialized in this function [-Werror=maybe-uninitialized]
The code is fine, and slightly reworking it in an equivalent way lets
gcc figure that out too, which gets rid of the warning.
Fixes: 77e7915b15bb ("leds: ktd2692: Add missing of_node_put")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Pavel Machek <pavel@ucw.cz>
Signed-off-by: Jacek Anaszewski <jacek.anaszewski@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/leds/leds-ktd2692.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/drivers/leds/leds-ktd2692.c
+++ b/drivers/leds/leds-ktd2692.c
@@ -296,15 +296,15 @@ static int ktd2692_parse_dt(struct ktd26
return -ENXIO;
led->ctrl_gpio = devm_gpiod_get(dev, "ctrl", GPIOD_ASIS);
- if (IS_ERR(led->ctrl_gpio)) {
- ret = PTR_ERR(led->ctrl_gpio);
+ ret = PTR_ERR_OR_ZERO(led->ctrl_gpio);
+ if (ret) {
dev_err(dev, "cannot get ctrl-gpios %d\n", ret);
return ret;
}
led->aux_gpio = devm_gpiod_get(dev, "aux", GPIOD_ASIS);
- if (IS_ERR(led->aux_gpio)) {
- ret = PTR_ERR(led->aux_gpio);
+ ret = PTR_ERR_OR_ZERO(led->aux_gpio);
+ if (ret) {
dev_err(dev, "cannot get aux-gpios %d\n", ret);
return ret;
}
^ permalink raw reply [flat|nested] 68+ messages in thread* [PATCH 4.4 12/60] ARM: OMAP5 / DRA7: Fix HYP mode boot for thumb2 build
2017-05-11 14:12 [PATCH 4.4 00/60] 4.4.68-stable review Greg Kroah-Hartman
` (10 preceding siblings ...)
2017-05-11 14:12 ` [PATCH 4.4 11/60] leds: ktd2692: avoid harmless maybe-uninitialized warning Greg Kroah-Hartman
@ 2017-05-11 14:12 ` Greg Kroah-Hartman
2017-05-11 14:12 ` [PATCH 4.4 13/60] mwifiex: debugfs: Fix (sometimes) off-by-1 SSID print Greg Kroah-Hartman
` (45 subsequent siblings)
57 siblings, 0 replies; 68+ messages in thread
From: Greg Kroah-Hartman @ 2017-05-11 14:12 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Matthijs van Duin, Tony Lindgren
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthijs van Duin <matthijsvanduin@gmail.com>
commit 448c077eeb02240c430db2a2c3bf5285a4c65d66 upstream.
'adr' yields a data-pointer, not a function-pointer.
Fixes: 999f934de195 ("ARM: omap5/dra7xx: Enable booting secondary
CPU in HYP mode")
Signed-off-by: Matthijs van Duin <matthijsvanduin@gmail.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/mach-omap2/omap-headsmp.S | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/arch/arm/mach-omap2/omap-headsmp.S
+++ b/arch/arm/mach-omap2/omap-headsmp.S
@@ -17,6 +17,7 @@
#include <linux/linkage.h>
#include <linux/init.h>
+#include <asm/assembler.h>
#include "omap44xx.h"
@@ -56,7 +57,7 @@ wait_2: ldr r2, =AUX_CORE_BOOT0_PA @ rea
cmp r0, r4
bne wait_2
ldr r12, =API_HYP_ENTRY
- adr r0, hyp_boot
+ badr r0, hyp_boot
smc #0
hyp_boot:
b secondary_startup
^ permalink raw reply [flat|nested] 68+ messages in thread* [PATCH 4.4 13/60] mwifiex: debugfs: Fix (sometimes) off-by-1 SSID print
2017-05-11 14:12 [PATCH 4.4 00/60] 4.4.68-stable review Greg Kroah-Hartman
` (11 preceding siblings ...)
2017-05-11 14:12 ` [PATCH 4.4 12/60] ARM: OMAP5 / DRA7: Fix HYP mode boot for thumb2 build Greg Kroah-Hartman
@ 2017-05-11 14:12 ` Greg Kroah-Hartman
2017-05-11 14:12 ` [PATCH 4.4 14/60] mwifiex: remove redundant dma padding in AMSDU Greg Kroah-Hartman
` (44 subsequent siblings)
57 siblings, 0 replies; 68+ messages in thread
From: Greg Kroah-Hartman @ 2017-05-11 14:12 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Brian Norris, Kalle Valo
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Norris <briannorris@chromium.org>
commit 6183468a23fc6b6903f8597982017ad2c7fdefcf upstream.
Similar to commit fcd2042e8d36 ("mwifiex: printk() overflow with 32-byte
SSIDs"), we failed to account for the existence of 32-char SSIDs in our
debugfs code. Unlike in that case though, we zeroed out the containing
struct first, and I'm pretty sure we're guaranteed to have some padding
after the 'ssid.ssid' and 'ssid.ssid_len' fields (the struct is 33 bytes
long).
So, this is the difference between:
# cat /sys/kernel/debug/mwifiex/mlan0/info
...
essid="0123456789abcdef0123456789abcdef "
...
and the correct output:
# cat /sys/kernel/debug/mwifiex/mlan0/info
...
essid="0123456789abcdef0123456789abcdef"
...
Fixes: 5e6e3a92b9a4 ("wireless: mwifiex: initial commit for Marvell mwifiex driver")
Signed-off-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/mwifiex/debugfs.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/net/wireless/mwifiex/debugfs.c
+++ b/drivers/net/wireless/mwifiex/debugfs.c
@@ -115,7 +115,8 @@ mwifiex_info_read(struct file *file, cha
if (GET_BSS_ROLE(priv) == MWIFIEX_BSS_ROLE_STA) {
p += sprintf(p, "multicast_count=\"%d\"\n",
netdev_mc_count(netdev));
- p += sprintf(p, "essid=\"%s\"\n", info.ssid.ssid);
+ p += sprintf(p, "essid=\"%.*s\"\n", info.ssid.ssid_len,
+ info.ssid.ssid);
p += sprintf(p, "bssid=\"%pM\"\n", info.bssid);
p += sprintf(p, "channel=\"%d\"\n", (int) info.bss_chan);
p += sprintf(p, "country_code = \"%s\"\n", info.country_code);
^ permalink raw reply [flat|nested] 68+ messages in thread* [PATCH 4.4 14/60] mwifiex: remove redundant dma padding in AMSDU
2017-05-11 14:12 [PATCH 4.4 00/60] 4.4.68-stable review Greg Kroah-Hartman
` (12 preceding siblings ...)
2017-05-11 14:12 ` [PATCH 4.4 13/60] mwifiex: debugfs: Fix (sometimes) off-by-1 SSID print Greg Kroah-Hartman
@ 2017-05-11 14:12 ` Greg Kroah-Hartman
2017-05-11 14:12 ` [PATCH 4.4 15/60] mwifiex: Avoid skipping WEP key deletion for AP Greg Kroah-Hartman
` (43 subsequent siblings)
57 siblings, 0 replies; 68+ messages in thread
From: Greg Kroah-Hartman @ 2017-05-11 14:12 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Xinming Hu, Amitkumar Karwar, Kalle Valo
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xinming Hu <huxm@marvell.com>
commit 5f0a221f59ad6b72202ef9c6e232086de8c336f2 upstream.
We already ensure 64 bytes alignment and add padding if required
during skb_aggr allocation.
Alignment and padding in mwifiex_11n_form_amsdu_txpd() is redundant.
We may end up accessing more data than allocated size with this.
This patch fixes following issue by removing redundant padding.
[ 370.241338] skbuff: skb_over_panic: text:ffffffffc046946a len:3550
put:72 head:ffff880000110000 data:ffff8800001100e4 tail:0xec2 end:0xec0 dev:<NULL>
[ 370.241374] ------------[ cut here ]------------
[ 370.241382] kernel BUG at net/core/skbuff.c:104!
370.244032] Call Trace:
[ 370.244041] [<ffffffff8c3df5ec>] skb_put+0x44/0x45
[ 370.244055] [<ffffffffc046946a>]
mwifiex_11n_aggregate_pkt+0x1e9/0xa50 [mwifiex]
[ 370.244067] [<ffffffffc0467c16>] mwifiex_wmm_process_tx+0x44a/0x6b7
[mwifiex]
[ 370.244074] [<ffffffffc0411eb8>] ? 0xffffffffc0411eb8
[ 370.244084] [<ffffffffc046116b>] mwifiex_main_process+0x476/0x5a5
[mwifiex]
[ 370.244098] [<ffffffffc0461298>] mwifiex_main_process+0x5a3/0x5a5
[mwifiex]
[ 370.244113] [<ffffffff8be7e9ff>] process_one_work+0x1a4/0x309
[ 370.244123] [<ffffffff8be7f4ca>] worker_thread+0x20c/0x2ee
[ 370.244130] [<ffffffff8be7f2be>] ? rescuer_thread+0x383/0x383
[ 370.244136] [<ffffffff8be7f2be>] ? rescuer_thread+0x383/0x383
[ 370.244143] [<ffffffff8be83742>] kthread+0x11c/0x124
[ 370.244150] [<ffffffff8be83626>] ? kthread_parkme+0x24/0x24
[ 370.244157] [<ffffffff8c4da1ef>] ret_from_fork+0x3f/0x70
[ 370.244168] [<ffffffff8be83626>] ? kthread_parkme+0x24/0x24
Fixes: 84b313b35f8158d ("mwifiex: make tx packet 64 byte DMA aligned")
Signed-off-by: Xinming Hu <huxm@marvell.com>
Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/mwifiex/11n_aggr.c | 19 +++++++------------
1 file changed, 7 insertions(+), 12 deletions(-)
--- a/drivers/net/wireless/mwifiex/11n_aggr.c
+++ b/drivers/net/wireless/mwifiex/11n_aggr.c
@@ -101,13 +101,6 @@ mwifiex_11n_form_amsdu_txpd(struct mwifi
{
struct txpd *local_tx_pd;
struct mwifiex_txinfo *tx_info = MWIFIEX_SKB_TXCB(skb);
- unsigned int pad;
- int headroom = (priv->adapter->iface_type ==
- MWIFIEX_USB) ? 0 : INTF_HEADER_LEN;
-
- pad = ((void *)skb->data - sizeof(*local_tx_pd) -
- headroom - NULL) & (MWIFIEX_DMA_ALIGN_SZ - 1);
- skb_push(skb, pad);
skb_push(skb, sizeof(*local_tx_pd));
@@ -121,12 +114,10 @@ mwifiex_11n_form_amsdu_txpd(struct mwifi
local_tx_pd->bss_num = priv->bss_num;
local_tx_pd->bss_type = priv->bss_type;
/* Always zero as the data is followed by struct txpd */
- local_tx_pd->tx_pkt_offset = cpu_to_le16(sizeof(struct txpd) +
- pad);
+ local_tx_pd->tx_pkt_offset = cpu_to_le16(sizeof(struct txpd));
local_tx_pd->tx_pkt_type = cpu_to_le16(PKT_TYPE_AMSDU);
local_tx_pd->tx_pkt_length = cpu_to_le16(skb->len -
- sizeof(*local_tx_pd) -
- pad);
+ sizeof(*local_tx_pd));
if (tx_info->flags & MWIFIEX_BUF_FLAG_TDLS_PKT)
local_tx_pd->flags |= MWIFIEX_TXPD_FLAGS_TDLS_PACKET;
@@ -190,7 +181,11 @@ mwifiex_11n_aggregate_pkt(struct mwifiex
ra_list_flags);
return -1;
}
- skb_reserve(skb_aggr, MWIFIEX_MIN_DATA_HEADER_LEN);
+
+ /* skb_aggr->data already 64 byte align, just reserve bus interface
+ * header and txpd.
+ */
+ skb_reserve(skb_aggr, headroom + sizeof(struct txpd));
tx_info_aggr = MWIFIEX_SKB_TXCB(skb_aggr);
memset(tx_info_aggr, 0, sizeof(*tx_info_aggr));
^ permalink raw reply [flat|nested] 68+ messages in thread* [PATCH 4.4 15/60] mwifiex: Avoid skipping WEP key deletion for AP
2017-05-11 14:12 [PATCH 4.4 00/60] 4.4.68-stable review Greg Kroah-Hartman
` (13 preceding siblings ...)
2017-05-11 14:12 ` [PATCH 4.4 14/60] mwifiex: remove redundant dma padding in AMSDU Greg Kroah-Hartman
@ 2017-05-11 14:12 ` Greg Kroah-Hartman
2017-05-11 14:12 ` [PATCH 4.4 16/60] x86/ioapic: Restore IO-APIC irq_chip retrigger callback Greg Kroah-Hartman
` (42 subsequent siblings)
57 siblings, 0 replies; 68+ messages in thread
From: Greg Kroah-Hartman @ 2017-05-11 14:12 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ganapathi Bhat, Amitkumar Karwar, Kalle Valo
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ganapathi Bhat <gbhat@marvell.com>
commit a5b60de6972decc6b50a39abb376077c3c3621c8 upstream.
This patch fixes the issue specific to AP. AP is started with WEP
security and external station is connected to it. Data path works
in this case. Now if AP is restarted with WPA/WPA2 security,
station is able to connect but ping fails.
Driver skips the deletion of WEP keys if interface type is AP.
Removing that redundant check resolves the issue.
Fixes: e57f1734d87a ("mwifiex: add key material v2 support")
Signed-off-by: Ganapathi Bhat <gbhat@marvell.com>
Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/mwifiex/sta_ioctl.c | 2 --
1 file changed, 2 deletions(-)
--- a/drivers/net/wireless/mwifiex/sta_ioctl.c
+++ b/drivers/net/wireless/mwifiex/sta_ioctl.c
@@ -1098,8 +1098,6 @@ int mwifiex_set_encode(struct mwifiex_pr
encrypt_key.is_rx_seq_valid = true;
}
} else {
- if (GET_BSS_ROLE(priv) == MWIFIEX_BSS_ROLE_UAP)
- return 0;
encrypt_key.key_disable = true;
if (mac_addr)
memcpy(encrypt_key.mac_addr, mac_addr, ETH_ALEN);
^ permalink raw reply [flat|nested] 68+ messages in thread* [PATCH 4.4 16/60] x86/ioapic: Restore IO-APIC irq_chip retrigger callback
2017-05-11 14:12 [PATCH 4.4 00/60] 4.4.68-stable review Greg Kroah-Hartman
` (14 preceding siblings ...)
2017-05-11 14:12 ` [PATCH 4.4 15/60] mwifiex: Avoid skipping WEP key deletion for AP Greg Kroah-Hartman
@ 2017-05-11 14:12 ` Greg Kroah-Hartman
2017-05-11 17:05 ` Ben Hutchings
2017-05-11 14:12 ` [PATCH 4.4 18/60] clk: Make x86/ conditional on CONFIG_COMMON_CLK Greg Kroah-Hartman
` (41 subsequent siblings)
57 siblings, 1 reply; 68+ messages in thread
From: Greg Kroah-Hartman @ 2017-05-11 14:12 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ruslan Ruslichenko,
xe-linux-external, Thomas Gleixner
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruslan Ruslichenko <rruslich@cisco.com>
commit a9b4f08770b415f30f2fb0f8329a370c8f554aa3 upstream.
commit d32932d02e18 removed the irq_retrigger callback from the IO-APIC
chip and did not add it to the new IO-APIC-IR irq chip.
There is no harm because the interrupts are resent in software when the
retrigger callback is NULL, but it's less efficient. So restore them.
[ tglx: Massaged changelog ]
Fixes: d32932d02e18 ("x86/irq: Convert IOAPIC to use hierarchical irqdomain interfaces")
Signed-off-by: Ruslan Ruslichenko <rruslich@cisco.com>
Cc: xe-linux-external@cisco.com
Link: http://lkml.kernel.org/r/1484662432-13580-1-git-send-email-rruslich@cisco.com
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/apic/io_apic.c | 2 ++
1 file changed, 2 insertions(+)
--- a/arch/x86/kernel/apic/io_apic.c
+++ b/arch/x86/kernel/apic/io_apic.c
@@ -1875,6 +1875,7 @@ static struct irq_chip ioapic_chip __rea
.irq_ack = irq_chip_ack_parent,
.irq_eoi = ioapic_ack_level,
.irq_set_affinity = ioapic_set_affinity,
+ .irq_retrigger = irq_chip_retrigger_hierarchy,
.flags = IRQCHIP_SKIP_SET_WAKE,
};
@@ -1886,6 +1887,7 @@ static struct irq_chip ioapic_ir_chip __
.irq_ack = irq_chip_ack_parent,
.irq_eoi = ioapic_ir_ack_level,
.irq_set_affinity = ioapic_set_affinity,
+ .irq_retrigger = irq_chip_retrigger_hierarchy,
.flags = IRQCHIP_SKIP_SET_WAKE,
};
^ permalink raw reply [flat|nested] 68+ messages in thread* Re: [PATCH 4.4 16/60] x86/ioapic: Restore IO-APIC irq_chip retrigger callback
2017-05-11 14:12 ` [PATCH 4.4 16/60] x86/ioapic: Restore IO-APIC irq_chip retrigger callback Greg Kroah-Hartman
@ 2017-05-11 17:05 ` Ben Hutchings
2017-05-11 21:17 ` Thomas Gleixner
0 siblings, 1 reply; 68+ messages in thread
From: Ben Hutchings @ 2017-05-11 17:05 UTC (permalink / raw)
To: Greg Kroah-Hartman, Ruslan Ruslichenko, Thomas Gleixner
Cc: linux-kernel, stable, xe-linux-external
On Thu, 2017-05-11 at 16:12 +0200, Greg Kroah-Hartman wrote:
> 4.4-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Ruslan Ruslichenko <rruslich@cisco.com>
>
> commit a9b4f08770b415f30f2fb0f8329a370c8f554aa3 upstream.
>
> commit d32932d02e18 removed the irq_retrigger callback from the IO-APIC
> chip and did not add it to the new IO-APIC-IR irq chip.
>
> There is no harm because the interrupts are resent in software when the
> retrigger callback is NULL, but it's less efficient. So restore them.
Sounds like it's not important enough for stable, then?
Ben.
> [ tglx: Massaged changelog ]
>
> Fixes: d32932d02e18 ("x86/irq: Convert IOAPIC to use hierarchical irqdomain interfaces")
> Signed-off-by: Ruslan Ruslichenko <rruslich@cisco.com>
> Cc: xe-linux-external@cisco.com
> Link: http://lkml.kernel.org/r/1484662432-13580-1-git-send-email-rruslich@cisco.com
> Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
>
> ---
> arch/x86/kernel/apic/io_apic.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> --- a/arch/x86/kernel/apic/io_apic.c
> +++ b/arch/x86/kernel/apic/io_apic.c
> @@ -1875,6 +1875,7 @@ static struct irq_chip ioapic_chip __rea
> .irq_ack = irq_chip_ack_parent,
> .irq_eoi = ioapic_ack_level,
> .irq_set_affinity = ioapic_set_affinity,
> + .irq_retrigger = irq_chip_retrigger_hierarchy,
> .flags = IRQCHIP_SKIP_SET_WAKE,
> };
>
> @@ -1886,6 +1887,7 @@ static struct irq_chip ioapic_ir_chip __
> .irq_ack = irq_chip_ack_parent,
> .irq_eoi = ioapic_ir_ack_level,
> .irq_set_affinity = ioapic_set_affinity,
> + .irq_retrigger = irq_chip_retrigger_hierarchy,
> .flags = IRQCHIP_SKIP_SET_WAKE,
> };
>
>
>
>
--
Ben Hutchings
Software Developer, Codethink Ltd.
^ permalink raw reply [flat|nested] 68+ messages in thread* Re: [PATCH 4.4 16/60] x86/ioapic: Restore IO-APIC irq_chip retrigger callback
2017-05-11 17:05 ` Ben Hutchings
@ 2017-05-11 21:17 ` Thomas Gleixner
2017-05-12 9:42 ` Greg Kroah-Hartman
0 siblings, 1 reply; 68+ messages in thread
From: Thomas Gleixner @ 2017-05-11 21:17 UTC (permalink / raw)
To: Ben Hutchings
Cc: Greg Kroah-Hartman, Ruslan Ruslichenko, linux-kernel, stable,
xe-linux-external
On Thu, 11 May 2017, Ben Hutchings wrote:
> On Thu, 2017-05-11 at 16:12 +0200, Greg Kroah-Hartman wrote:
> > 4.4-stable review patch. If anyone has any objections, please let me know.
> >
> > ------------------
> >
> > From: Ruslan Ruslichenko <rruslich@cisco.com>
> >
> > commit a9b4f08770b415f30f2fb0f8329a370c8f554aa3 upstream.
> >
> > commit d32932d02e18 removed the irq_retrigger callback from the IO-APIC
> > chip and did not add it to the new IO-APIC-IR irq chip.
> >
> > There is no harm because the interrupts are resent in software when the
> > retrigger callback is NULL, but it's less efficient. So restore them.
>
> Sounds like it's not important enough for stable, then?
Actually that changelog is wrong, but this commit got reverted because it
triggered some crap code.
After we fixed that it was brought back with:
020eb3daaba2857b32c4cf4c82f503d6a00a67de
The related fixes are:
47512cfd0d7a8bd6ab71d01cd89fca19eb2093eb
6cf18e6927c0b224f972e3042fb85770d63cb9f8
which are both tagged for stable as well.
Thanks,
tglx
^ permalink raw reply [flat|nested] 68+ messages in thread* Re: [PATCH 4.4 16/60] x86/ioapic: Restore IO-APIC irq_chip retrigger callback
2017-05-11 21:17 ` Thomas Gleixner
@ 2017-05-12 9:42 ` Greg Kroah-Hartman
0 siblings, 0 replies; 68+ messages in thread
From: Greg Kroah-Hartman @ 2017-05-12 9:42 UTC (permalink / raw)
To: Thomas Gleixner
Cc: Ben Hutchings, Ruslan Ruslichenko, linux-kernel, stable,
xe-linux-external
On Thu, May 11, 2017 at 11:17:59PM +0200, Thomas Gleixner wrote:
> On Thu, 11 May 2017, Ben Hutchings wrote:
>
> > On Thu, 2017-05-11 at 16:12 +0200, Greg Kroah-Hartman wrote:
> > > 4.4-stable review patch. If anyone has any objections, please let me know.
> > >
> > > ------------------
> > >
> > > From: Ruslan Ruslichenko <rruslich@cisco.com>
> > >
> > > commit a9b4f08770b415f30f2fb0f8329a370c8f554aa3 upstream.
> > >
> > > commit d32932d02e18 removed the irq_retrigger callback from the IO-APIC
> > > chip and did not add it to the new IO-APIC-IR irq chip.
> > >
> > > There is no harm because the interrupts are resent in software when the
> > > retrigger callback is NULL, but it's less efficient. So restore them.
> >
> > Sounds like it's not important enough for stable, then?
>
> Actually that changelog is wrong, but this commit got reverted because it
> triggered some crap code.
>
> After we fixed that it was brought back with:
>
> 020eb3daaba2857b32c4cf4c82f503d6a00a67de
>
> The related fixes are:
>
> 47512cfd0d7a8bd6ab71d01cd89fca19eb2093eb
> 6cf18e6927c0b224f972e3042fb85770d63cb9f8
>
> which are both tagged for stable as well.
Those both are in stable already, so this should be safe to add, so I'll
leave it as-is.
thanks,
greg k-h
^ permalink raw reply [flat|nested] 68+ messages in thread
* [PATCH 4.4 18/60] clk: Make x86/ conditional on CONFIG_COMMON_CLK
2017-05-11 14:12 [PATCH 4.4 00/60] 4.4.68-stable review Greg Kroah-Hartman
` (15 preceding siblings ...)
2017-05-11 14:12 ` [PATCH 4.4 16/60] x86/ioapic: Restore IO-APIC irq_chip retrigger callback Greg Kroah-Hartman
@ 2017-05-11 14:12 ` Greg Kroah-Hartman
2017-05-11 14:12 ` [PATCH 4.4 19/60] kprobes/x86: Fix kernel panic when certain exception-handling addresses are probed Greg Kroah-Hartman
` (40 subsequent siblings)
57 siblings, 0 replies; 68+ messages in thread
From: Greg Kroah-Hartman @ 2017-05-11 14:12 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Pierre-Louis Bossart,
Andy Shevchenko, Stephen Boyd
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
commit f35b6542c3ac3f28056d298348a81f7d56d3a041 upstream.
Fix Makefile for x86 support, dependency on CONFIG_COMMON_CLK
was not explicit
Fixes: 701190fd7419 ('clk: x86: add support for Lynxpoint LPSS clocks')
Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Acked-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/clk/Makefile | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/clk/Makefile
+++ b/drivers/clk/Makefile
@@ -78,7 +78,9 @@ obj-$(CONFIG_ARCH_TEGRA) += tegra/
obj-$(CONFIG_ARCH_OMAP2PLUS) += ti/
obj-$(CONFIG_ARCH_U8500) += ux500/
obj-$(CONFIG_COMMON_CLK_VERSATILE) += versatile/
+ifeq ($(CONFIG_COMMON_CLK), y)
obj-$(CONFIG_X86) += x86/
+endif
obj-$(CONFIG_ARCH_ZX) += zte/
obj-$(CONFIG_ARCH_ZYNQ) += zynq/
obj-$(CONFIG_H8300) += h8300/
^ permalink raw reply [flat|nested] 68+ messages in thread* [PATCH 4.4 19/60] kprobes/x86: Fix kernel panic when certain exception-handling addresses are probed
2017-05-11 14:12 [PATCH 4.4 00/60] 4.4.68-stable review Greg Kroah-Hartman
` (16 preceding siblings ...)
2017-05-11 14:12 ` [PATCH 4.4 18/60] clk: Make x86/ conditional on CONFIG_COMMON_CLK Greg Kroah-Hartman
@ 2017-05-11 14:12 ` Greg Kroah-Hartman
2017-05-11 14:12 ` [PATCH 4.4 20/60] x86/platform/intel-mid: Correct MSI IRQ line for watchdog device Greg Kroah-Hartman
` (39 subsequent siblings)
57 siblings, 0 replies; 68+ messages in thread
From: Greg Kroah-Hartman @ 2017-05-11 14:12 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Masami Hiramatsu, Borislav Petkov,
Linus Torvalds, Peter Zijlstra, Thomas Gleixner, Ingo Molnar
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masami Hiramatsu <mhiramat@kernel.org>
commit 75013fb16f8484898eaa8d0b08fed942d790f029 upstream.
Fix to the exception table entry check by using probed address
instead of the address of copied instruction.
This bug may cause unexpected kernel panic if user probe an address
where an exception can happen which should be fixup by __ex_table
(e.g. copy_from_user.)
Unless user puts a kprobe on such address, this doesn't
cause any problem.
This bug has been introduced years ago, by commit:
464846888d9a ("x86/kprobes: Fix a bug which can modify kernel code permanently").
Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Fixes: 464846888d9a ("x86/kprobes: Fix a bug which can modify kernel code permanently")
Link: http://lkml.kernel.org/r/148829899399.28855.12581062400757221722.stgit@devbox
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/kprobes/common.h | 2 +-
arch/x86/kernel/kprobes/core.c | 6 +++---
arch/x86/kernel/kprobes/opt.c | 2 +-
3 files changed, 5 insertions(+), 5 deletions(-)
--- a/arch/x86/kernel/kprobes/common.h
+++ b/arch/x86/kernel/kprobes/common.h
@@ -67,7 +67,7 @@
#endif
/* Ensure if the instruction can be boostable */
-extern int can_boost(kprobe_opcode_t *instruction);
+extern int can_boost(kprobe_opcode_t *instruction, void *addr);
/* Recover instruction if given address is probed */
extern unsigned long recover_probed_instruction(kprobe_opcode_t *buf,
unsigned long addr);
--- a/arch/x86/kernel/kprobes/core.c
+++ b/arch/x86/kernel/kprobes/core.c
@@ -163,12 +163,12 @@ NOKPROBE_SYMBOL(skip_prefixes);
* Returns non-zero if opcode is boostable.
* RIP relative instructions are adjusted at copying time in 64 bits mode
*/
-int can_boost(kprobe_opcode_t *opcodes)
+int can_boost(kprobe_opcode_t *opcodes, void *addr)
{
kprobe_opcode_t opcode;
kprobe_opcode_t *orig_opcodes = opcodes;
- if (search_exception_tables((unsigned long)opcodes))
+ if (search_exception_tables((unsigned long)addr))
return 0; /* Page fault may occur on this address. */
retry:
@@ -413,7 +413,7 @@ static int arch_copy_kprobe(struct kprob
* __copy_instruction can modify the displacement of the instruction,
* but it doesn't affect boostable check.
*/
- if (can_boost(p->ainsn.insn))
+ if (can_boost(p->ainsn.insn, p->addr))
p->ainsn.boostable = 0;
else
p->ainsn.boostable = -1;
--- a/arch/x86/kernel/kprobes/opt.c
+++ b/arch/x86/kernel/kprobes/opt.c
@@ -177,7 +177,7 @@ static int copy_optimized_instructions(u
while (len < RELATIVEJUMP_SIZE) {
ret = __copy_instruction(dest + len, src + len);
- if (!ret || !can_boost(dest + len))
+ if (!ret || !can_boost(dest + len, src + len))
return -EINVAL;
len += ret;
}
^ permalink raw reply [flat|nested] 68+ messages in thread* [PATCH 4.4 20/60] x86/platform/intel-mid: Correct MSI IRQ line for watchdog device
2017-05-11 14:12 [PATCH 4.4 00/60] 4.4.68-stable review Greg Kroah-Hartman
` (17 preceding siblings ...)
2017-05-11 14:12 ` [PATCH 4.4 19/60] kprobes/x86: Fix kernel panic when certain exception-handling addresses are probed Greg Kroah-Hartman
@ 2017-05-11 14:12 ` Greg Kroah-Hartman
2017-05-11 14:12 ` [PATCH 4.4 24/60] usb: host: ehci-exynos: Decrese node refcount on exynos_ehci_get_phy() error paths Greg Kroah-Hartman
` (38 subsequent siblings)
57 siblings, 0 replies; 68+ messages in thread
From: Greg Kroah-Hartman @ 2017-05-11 14:12 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andy Shevchenko, Borislav Petkov,
David Cohen, H. Peter Anvin, Linus Torvalds, Peter Zijlstra,
Thomas Gleixner, Ingo Molnar
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
commit 80354c29025833acd72ddac1ffa21c6cb50128cd upstream.
The interrupt line used for the watchdog is 12, according to the official
Intel Edison BSP code.
And indeed after fixing it we start getting an interrupt and thus the
watchdog starts working again:
[ 191.699951] Kernel panic - not syncing: Kernel Watchdog
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: David Cohen <david.a.cohen@linux.intel.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Fixes: 78a3bb9e408b ("x86: intel-mid: add watchdog platform code for Merrifield")
Link: http://lkml.kernel.org/r/20170312150744.45493-1-andriy.shevchenko@linux.intel.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/platform/intel-mid/device_libs/platform_wdt.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/x86/platform/intel-mid/device_libs/platform_wdt.c
+++ b/arch/x86/platform/intel-mid/device_libs/platform_wdt.c
@@ -17,7 +17,7 @@
#include <asm/intel-mid.h>
#include <asm/io_apic.h>
-#define TANGIER_EXT_TIMER0_MSI 15
+#define TANGIER_EXT_TIMER0_MSI 12
static struct platform_device wdt_dev = {
.name = "intel_mid_wdt",
^ permalink raw reply [flat|nested] 68+ messages in thread* [PATCH 4.4 24/60] usb: host: ehci-exynos: Decrese node refcount on exynos_ehci_get_phy() error paths
2017-05-11 14:12 [PATCH 4.4 00/60] 4.4.68-stable review Greg Kroah-Hartman
` (18 preceding siblings ...)
2017-05-11 14:12 ` [PATCH 4.4 20/60] x86/platform/intel-mid: Correct MSI IRQ line for watchdog device Greg Kroah-Hartman
@ 2017-05-11 14:12 ` Greg Kroah-Hartman
2017-05-11 14:12 ` [PATCH 4.4 25/60] usb: host: ohci-exynos: " Greg Kroah-Hartman
` (37 subsequent siblings)
57 siblings, 0 replies; 68+ messages in thread
From: Greg Kroah-Hartman @ 2017-05-11 14:12 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski, Alan Stern,
Javier Martinez Canillas
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzk@kernel.org>
commit 3f6026b1dcb3c8ee71198c485a72ac674c6890dd upstream.
Returning from for_each_available_child_of_node() loop requires cleaning
up node refcount. Error paths lacked it so for example in case of
deferred probe, the refcount of phy node was left increased.
Fixes: 6d40500ac9b6 ("usb: ehci/ohci-exynos: Fix of_node_put() for child when getting PHYs")
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Reviewed-by: Javier Martinez Canillas <javier@osg.samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/ehci-exynos.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/usb/host/ehci-exynos.c
+++ b/drivers/usb/host/ehci-exynos.c
@@ -77,10 +77,12 @@ static int exynos_ehci_get_phy(struct de
if (IS_ERR(phy)) {
ret = PTR_ERR(phy);
if (ret == -EPROBE_DEFER) {
+ of_node_put(child);
return ret;
} else if (ret != -ENOSYS && ret != -ENODEV) {
dev_err(dev,
"Error retrieving usb2 phy: %d\n", ret);
+ of_node_put(child);
return ret;
}
}
^ permalink raw reply [flat|nested] 68+ messages in thread* [PATCH 4.4 25/60] usb: host: ohci-exynos: Decrese node refcount on exynos_ehci_get_phy() error paths
2017-05-11 14:12 [PATCH 4.4 00/60] 4.4.68-stable review Greg Kroah-Hartman
` (19 preceding siblings ...)
2017-05-11 14:12 ` [PATCH 4.4 24/60] usb: host: ehci-exynos: Decrese node refcount on exynos_ehci_get_phy() error paths Greg Kroah-Hartman
@ 2017-05-11 14:12 ` Greg Kroah-Hartman
2017-05-11 14:12 ` [PATCH 4.4 26/60] usb: chipidea: Only read/write OTGSC from one place Greg Kroah-Hartman
` (36 subsequent siblings)
57 siblings, 0 replies; 68+ messages in thread
From: Greg Kroah-Hartman @ 2017-05-11 14:12 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski, Alan Stern,
Javier Martinez Canillas
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzk@kernel.org>
commit 68bd6fc3cfa98ef253e17307ccafd8ef907b5556 upstream.
Returning from for_each_available_child_of_node() loop requires cleaning
up node refcount. Error paths lacked it so for example in case of
deferred probe, the refcount of phy node was left increased.
Fixes: 6d40500ac9b6 ("usb: ehci/ohci-exynos: Fix of_node_put() for child when getting PHYs")
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Reviewed-by: Javier Martinez Canillas <javier@osg.samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/ohci-exynos.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/usb/host/ohci-exynos.c
+++ b/drivers/usb/host/ohci-exynos.c
@@ -66,10 +66,12 @@ static int exynos_ohci_get_phy(struct de
if (IS_ERR(phy)) {
ret = PTR_ERR(phy);
if (ret == -EPROBE_DEFER) {
+ of_node_put(child);
return ret;
} else if (ret != -ENOSYS && ret != -ENODEV) {
dev_err(dev,
"Error retrieving usb2 phy: %d\n", ret);
+ of_node_put(child);
return ret;
}
}
^ permalink raw reply [flat|nested] 68+ messages in thread* [PATCH 4.4 26/60] usb: chipidea: Only read/write OTGSC from one place
2017-05-11 14:12 [PATCH 4.4 00/60] 4.4.68-stable review Greg Kroah-Hartman
` (20 preceding siblings ...)
2017-05-11 14:12 ` [PATCH 4.4 25/60] usb: host: ohci-exynos: " Greg Kroah-Hartman
@ 2017-05-11 14:12 ` Greg Kroah-Hartman
2017-05-11 14:12 ` [PATCH 4.4 27/60] usb: chipidea: Handle extcon events properly Greg Kroah-Hartman
` (35 subsequent siblings)
57 siblings, 0 replies; 68+ messages in thread
From: Greg Kroah-Hartman @ 2017-05-11 14:12 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Peter Chen, Ivan T. Ivanov, Stephen Boyd
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Boyd <stephen.boyd@linaro.org>
commit f60f8ccd54e03c1afafb2b20ceb029a0eaf7a134 upstream.
With the id and vbus detection done via extcon we need to make
sure we poll the status of OTGSC properly by considering what the
extcon is saying, and not just what the register is saying. Let's
move this hw_wait_reg() function to the only place it's used and
simplify it for polling the OTGSC register. Then we can make
certain we only use the hw_read_otgsc() API to read OTGSC, which
will make sure we properly handle extcon events.
Acked-by: Peter Chen <peter.chen@nxp.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: "Ivan T. Ivanov" <iivanov.xz@gmail.com>
Fixes: 3ecb3e09b042 ("usb: chipidea: Use extcon framework for VBUS and ID detect")
Signed-off-by: Stephen Boyd <stephen.boyd@linaro.org>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/chipidea/ci.h | 3 ---
drivers/usb/chipidea/core.c | 32 --------------------------------
drivers/usb/chipidea/otg.c | 34 ++++++++++++++++++++++++++++++----
3 files changed, 30 insertions(+), 39 deletions(-)
--- a/drivers/usb/chipidea/ci.h
+++ b/drivers/usb/chipidea/ci.h
@@ -428,9 +428,6 @@ int hw_port_test_set(struct ci_hdrc *ci,
u8 hw_port_test_get(struct ci_hdrc *ci);
-int hw_wait_reg(struct ci_hdrc *ci, enum ci_hw_regs reg, u32 mask,
- u32 value, unsigned int timeout_ms);
-
void ci_platform_configure(struct ci_hdrc *ci);
#endif /* __DRIVERS_USB_CHIPIDEA_CI_H */
--- a/drivers/usb/chipidea/core.c
+++ b/drivers/usb/chipidea/core.c
@@ -518,38 +518,6 @@ int hw_device_reset(struct ci_hdrc *ci)
return 0;
}
-/**
- * hw_wait_reg: wait the register value
- *
- * Sometimes, it needs to wait register value before going on.
- * Eg, when switch to device mode, the vbus value should be lower
- * than OTGSC_BSV before connects to host.
- *
- * @ci: the controller
- * @reg: register index
- * @mask: mast bit
- * @value: the bit value to wait
- * @timeout_ms: timeout in millisecond
- *
- * This function returns an error code if timeout
- */
-int hw_wait_reg(struct ci_hdrc *ci, enum ci_hw_regs reg, u32 mask,
- u32 value, unsigned int timeout_ms)
-{
- unsigned long elapse = jiffies + msecs_to_jiffies(timeout_ms);
-
- while (hw_read(ci, reg, mask) != value) {
- if (time_after(jiffies, elapse)) {
- dev_err(ci->dev, "timeout waiting for %08x in %d\n",
- mask, reg);
- return -ETIMEDOUT;
- }
- msleep(20);
- }
-
- return 0;
-}
-
static irqreturn_t ci_irq(int irq, void *data)
{
struct ci_hdrc *ci = data;
--- a/drivers/usb/chipidea/otg.c
+++ b/drivers/usb/chipidea/otg.c
@@ -104,7 +104,31 @@ void ci_handle_vbus_change(struct ci_hdr
usb_gadget_vbus_disconnect(&ci->gadget);
}
-#define CI_VBUS_STABLE_TIMEOUT_MS 5000
+/**
+ * When we switch to device mode, the vbus value should be lower
+ * than OTGSC_BSV before connecting to host.
+ *
+ * @ci: the controller
+ *
+ * This function returns an error code if timeout
+ */
+static int hw_wait_vbus_lower_bsv(struct ci_hdrc *ci)
+{
+ unsigned long elapse = jiffies + msecs_to_jiffies(5000);
+ u32 mask = OTGSC_BSV;
+
+ while (hw_read_otgsc(ci, mask)) {
+ if (time_after(jiffies, elapse)) {
+ dev_err(ci->dev, "timeout waiting for %08x in OTGSC\n",
+ mask);
+ return -ETIMEDOUT;
+ }
+ msleep(20);
+ }
+
+ return 0;
+}
+
static void ci_handle_id_switch(struct ci_hdrc *ci)
{
enum ci_role role = ci_otg_role(ci);
@@ -116,9 +140,11 @@ static void ci_handle_id_switch(struct c
ci_role_stop(ci);
if (role == CI_ROLE_GADGET)
- /* wait vbus lower than OTGSC_BSV */
- hw_wait_reg(ci, OP_OTGSC, OTGSC_BSV, 0,
- CI_VBUS_STABLE_TIMEOUT_MS);
+ /*
+ * wait vbus lower than OTGSC_BSV before connecting
+ * to host
+ */
+ hw_wait_vbus_lower_bsv(ci);
ci_role_start(ci, role);
}
^ permalink raw reply [flat|nested] 68+ messages in thread* [PATCH 4.4 27/60] usb: chipidea: Handle extcon events properly
2017-05-11 14:12 [PATCH 4.4 00/60] 4.4.68-stable review Greg Kroah-Hartman
` (21 preceding siblings ...)
2017-05-11 14:12 ` [PATCH 4.4 26/60] usb: chipidea: Only read/write OTGSC from one place Greg Kroah-Hartman
@ 2017-05-11 14:12 ` Greg Kroah-Hartman
2017-05-11 14:12 ` [PATCH 4.4 28/60] USB: serial: keyspan_pda: fix receive sanity checks Greg Kroah-Hartman
` (34 subsequent siblings)
57 siblings, 0 replies; 68+ messages in thread
From: Greg Kroah-Hartman @ 2017-05-11 14:12 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Peter Chen, Ivan T. Ivanov, Stephen Boyd
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Boyd <stephen.boyd@linaro.org>
commit a89b94b53371bbfa582787c2fa3378000ea4263d upstream.
We're currently emulating the vbus and id interrupts in the OTGSC
read API, but we also need to make sure that if we're handling
the events with extcon that we don't enable the interrupts for
those events in the hardware. Therefore, properly emulate this
register if we're using extcon, but don't enable the interrupts.
This allows me to get my cable connect/disconnect working
properly without getting spurious interrupts on my device that
uses an extcon for these two events.
Acked-by: Peter Chen <peter.chen@nxp.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: "Ivan T. Ivanov" <iivanov.xz@gmail.com>
Fixes: 3ecb3e09b042 ("usb: chipidea: Use extcon framework for VBUS and ID detect")
Signed-off-by: Stephen Boyd <stephen.boyd@linaro.org>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/chipidea/otg.c | 46 ++++++++++++++++++++++++++++++++++++++-----
include/linux/usb/chipidea.h | 2 +
2 files changed, 43 insertions(+), 5 deletions(-)
--- a/drivers/usb/chipidea/otg.c
+++ b/drivers/usb/chipidea/otg.c
@@ -44,12 +44,15 @@ u32 hw_read_otgsc(struct ci_hdrc *ci, u3
else
val &= ~OTGSC_BSVIS;
- cable->changed = false;
-
if (cable->state)
val |= OTGSC_BSV;
else
val &= ~OTGSC_BSV;
+
+ if (cable->enabled)
+ val |= OTGSC_BSVIE;
+ else
+ val &= ~OTGSC_BSVIE;
}
cable = &ci->platdata->id_extcon;
@@ -59,15 +62,18 @@ u32 hw_read_otgsc(struct ci_hdrc *ci, u3
else
val &= ~OTGSC_IDIS;
- cable->changed = false;
-
if (cable->state)
val |= OTGSC_ID;
else
val &= ~OTGSC_ID;
+
+ if (cable->enabled)
+ val |= OTGSC_IDIE;
+ else
+ val &= ~OTGSC_IDIE;
}
- return val;
+ return val & mask;
}
/**
@@ -77,6 +83,36 @@ u32 hw_read_otgsc(struct ci_hdrc *ci, u3
*/
void hw_write_otgsc(struct ci_hdrc *ci, u32 mask, u32 data)
{
+ struct ci_hdrc_cable *cable;
+
+ cable = &ci->platdata->vbus_extcon;
+ if (!IS_ERR(cable->edev)) {
+ if (data & mask & OTGSC_BSVIS)
+ cable->changed = false;
+
+ /* Don't enable vbus interrupt if using external notifier */
+ if (data & mask & OTGSC_BSVIE) {
+ cable->enabled = true;
+ data &= ~OTGSC_BSVIE;
+ } else if (mask & OTGSC_BSVIE) {
+ cable->enabled = false;
+ }
+ }
+
+ cable = &ci->platdata->id_extcon;
+ if (!IS_ERR(cable->edev)) {
+ if (data & mask & OTGSC_IDIS)
+ cable->changed = false;
+
+ /* Don't enable id interrupt if using external notifier */
+ if (data & mask & OTGSC_IDIE) {
+ cable->enabled = true;
+ data &= ~OTGSC_IDIE;
+ } else if (mask & OTGSC_IDIE) {
+ cable->enabled = false;
+ }
+ }
+
hw_write(ci, OP_OTGSC, mask | OTGSC_INT_STATUS_BITS, data);
}
--- a/include/linux/usb/chipidea.h
+++ b/include/linux/usb/chipidea.h
@@ -14,6 +14,7 @@ struct ci_hdrc;
* struct ci_hdrc_cable - structure for external connector cable state tracking
* @state: current state of the line
* @changed: set to true when extcon event happen
+ * @enabled: set to true if we've enabled the vbus or id interrupt
* @edev: device which generate events
* @ci: driver state of the chipidea device
* @nb: hold event notification callback
@@ -22,6 +23,7 @@ struct ci_hdrc;
struct ci_hdrc_cable {
bool state;
bool changed;
+ bool enabled;
struct extcon_dev *edev;
struct ci_hdrc *ci;
struct notifier_block nb;
^ permalink raw reply [flat|nested] 68+ messages in thread* [PATCH 4.4 28/60] USB: serial: keyspan_pda: fix receive sanity checks
2017-05-11 14:12 [PATCH 4.4 00/60] 4.4.68-stable review Greg Kroah-Hartman
` (22 preceding siblings ...)
2017-05-11 14:12 ` [PATCH 4.4 27/60] usb: chipidea: Handle extcon events properly Greg Kroah-Hartman
@ 2017-05-11 14:12 ` Greg Kroah-Hartman
2017-05-11 14:12 ` [PATCH 4.4 29/60] USB: serial: digi_acceleport: fix incomplete rx sanity check Greg Kroah-Hartman
` (33 subsequent siblings)
57 siblings, 0 replies; 68+ messages in thread
From: Greg Kroah-Hartman @ 2017-05-11 14:12 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit c528fcb116e61afc379a2e0a0f70906b937f1e2c upstream.
Make sure to check for short transfers before parsing the receive buffer
to avoid acting on stale data.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/keyspan_pda.c | 19 ++++++++++++++-----
1 file changed, 14 insertions(+), 5 deletions(-)
--- a/drivers/usb/serial/keyspan_pda.c
+++ b/drivers/usb/serial/keyspan_pda.c
@@ -139,6 +139,7 @@ static void keyspan_pda_rx_interrupt(str
{
struct usb_serial_port *port = urb->context;
unsigned char *data = urb->transfer_buffer;
+ unsigned int len = urb->actual_length;
int retval;
int status = urb->status;
struct keyspan_pda_private *priv;
@@ -159,18 +160,26 @@ static void keyspan_pda_rx_interrupt(str
goto exit;
}
+ if (len < 1) {
+ dev_warn(&port->dev, "short message received\n");
+ goto exit;
+ }
+
/* see if the message is data or a status interrupt */
switch (data[0]) {
case 0:
/* rest of message is rx data */
- if (urb->actual_length) {
- tty_insert_flip_string(&port->port, data + 1,
- urb->actual_length - 1);
- tty_flip_buffer_push(&port->port);
- }
+ if (len < 2)
+ break;
+ tty_insert_flip_string(&port->port, data + 1, len - 1);
+ tty_flip_buffer_push(&port->port);
break;
case 1:
/* status interrupt */
+ if (len < 3) {
+ dev_warn(&port->dev, "short interrupt message received\n");
+ break;
+ }
dev_dbg(&port->dev, "rx int, d1=%d, d2=%d\n", data[1], data[2]);
switch (data[1]) {
case 1: /* modemline change */
^ permalink raw reply [flat|nested] 68+ messages in thread* [PATCH 4.4 29/60] USB: serial: digi_acceleport: fix incomplete rx sanity check
2017-05-11 14:12 [PATCH 4.4 00/60] 4.4.68-stable review Greg Kroah-Hartman
` (23 preceding siblings ...)
2017-05-11 14:12 ` [PATCH 4.4 28/60] USB: serial: keyspan_pda: fix receive sanity checks Greg Kroah-Hartman
@ 2017-05-11 14:12 ` Greg Kroah-Hartman
2017-05-11 14:12 ` [PATCH 4.4 30/60] USB: serial: ssu100: fix control-message error handling Greg Kroah-Hartman
` (32 subsequent siblings)
57 siblings, 0 replies; 68+ messages in thread
From: Greg Kroah-Hartman @ 2017-05-11 14:12 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 1b0aed2b1600f6e5c7b9acfbd610a4e351ef5232 upstream.
Make sure the received data has the required headers before parsing it.
Also drop the redundant urb-status check, which has already been handled
by the caller.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/digi_acceleport.c | 38 +++++++++++++++++++++--------------
1 file changed, 23 insertions(+), 15 deletions(-)
--- a/drivers/usb/serial/digi_acceleport.c
+++ b/drivers/usb/serial/digi_acceleport.c
@@ -1399,25 +1399,30 @@ static int digi_read_inb_callback(struct
{
struct usb_serial_port *port = urb->context;
struct digi_port *priv = usb_get_serial_port_data(port);
- int opcode = ((unsigned char *)urb->transfer_buffer)[0];
- int len = ((unsigned char *)urb->transfer_buffer)[1];
- int port_status = ((unsigned char *)urb->transfer_buffer)[2];
- unsigned char *data = ((unsigned char *)urb->transfer_buffer) + 3;
+ unsigned char *buf = urb->transfer_buffer;
+ int opcode;
+ int len;
+ int port_status;
+ unsigned char *data;
int flag, throttled;
- int status = urb->status;
-
- /* do not process callbacks on closed ports */
- /* but do continue the read chain */
- if (urb->status == -ENOENT)
- return 0;
/* short/multiple packet check */
+ if (urb->actual_length < 2) {
+ dev_warn(&port->dev, "short packet received\n");
+ return -1;
+ }
+
+ opcode = buf[0];
+ len = buf[1];
+
if (urb->actual_length != len + 2) {
- dev_err(&port->dev, "%s: INCOMPLETE OR MULTIPLE PACKET, "
- "status=%d, port=%d, opcode=%d, len=%d, "
- "actual_length=%d, status=%d\n", __func__, status,
- priv->dp_port_num, opcode, len, urb->actual_length,
- port_status);
+ dev_err(&port->dev, "malformed packet received: port=%d, opcode=%d, len=%d, actual_length=%u\n",
+ priv->dp_port_num, opcode, len, urb->actual_length);
+ return -1;
+ }
+
+ if (opcode == DIGI_CMD_RECEIVE_DATA && len < 1) {
+ dev_err(&port->dev, "malformed data packet received\n");
return -1;
}
@@ -1431,6 +1436,9 @@ static int digi_read_inb_callback(struct
/* receive data */
if (opcode == DIGI_CMD_RECEIVE_DATA) {
+ port_status = buf[2];
+ data = &buf[3];
+
/* get flag from port_status */
flag = 0;
^ permalink raw reply [flat|nested] 68+ messages in thread* [PATCH 4.4 30/60] USB: serial: ssu100: fix control-message error handling
2017-05-11 14:12 [PATCH 4.4 00/60] 4.4.68-stable review Greg Kroah-Hartman
` (24 preceding siblings ...)
2017-05-11 14:12 ` [PATCH 4.4 29/60] USB: serial: digi_acceleport: fix incomplete rx sanity check Greg Kroah-Hartman
@ 2017-05-11 14:12 ` Greg Kroah-Hartman
2017-05-11 14:12 ` [PATCH 4.4 31/60] USB: serial: io_edgeport: fix epic-descriptor handling Greg Kroah-Hartman
` (31 subsequent siblings)
57 siblings, 0 replies; 68+ messages in thread
From: Greg Kroah-Hartman @ 2017-05-11 14:12 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 1eac5c244f705182d1552a53e2f74e2775ed95d6 upstream.
Make sure to detect short control-message transfers rather than continue
with zero-initialised data when retrieving modem status and during
device initialisation.
Fixes: 52af95459939 ("USB: add USB serial ssu100 driver")
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/ssu100.c | 31 ++++++++++++++++++++++++-------
1 file changed, 24 insertions(+), 7 deletions(-)
--- a/drivers/usb/serial/ssu100.c
+++ b/drivers/usb/serial/ssu100.c
@@ -80,9 +80,17 @@ static inline int ssu100_setdevice(struc
static inline int ssu100_getdevice(struct usb_device *dev, u8 *data)
{
- return usb_control_msg(dev, usb_rcvctrlpipe(dev, 0),
- QT_SET_GET_DEVICE, 0xc0, 0, 0,
- data, 3, 300);
+ int ret;
+
+ ret = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0),
+ QT_SET_GET_DEVICE, 0xc0, 0, 0,
+ data, 3, 300);
+ if (ret < 3) {
+ if (ret >= 0)
+ ret = -EIO;
+ }
+
+ return ret;
}
static inline int ssu100_getregister(struct usb_device *dev,
@@ -90,10 +98,17 @@ static inline int ssu100_getregister(str
unsigned short reg,
u8 *data)
{
- return usb_control_msg(dev, usb_rcvctrlpipe(dev, 0),
- QT_SET_GET_REGISTER, 0xc0, reg,
- uart, data, sizeof(*data), 300);
+ int ret;
+ ret = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0),
+ QT_SET_GET_REGISTER, 0xc0, reg,
+ uart, data, sizeof(*data), 300);
+ if (ret < sizeof(*data)) {
+ if (ret >= 0)
+ ret = -EIO;
+ }
+
+ return ret;
}
@@ -289,8 +304,10 @@ static int ssu100_open(struct tty_struct
QT_OPEN_CLOSE_CHANNEL,
QT_TRANSFER_IN, 0x01,
0, data, 2, 300);
- if (result < 0) {
+ if (result < 2) {
dev_dbg(&port->dev, "%s - open failed %i\n", __func__, result);
+ if (result >= 0)
+ result = -EIO;
kfree(data);
return result;
}
^ permalink raw reply [flat|nested] 68+ messages in thread* [PATCH 4.4 31/60] USB: serial: io_edgeport: fix epic-descriptor handling
2017-05-11 14:12 [PATCH 4.4 00/60] 4.4.68-stable review Greg Kroah-Hartman
` (25 preceding siblings ...)
2017-05-11 14:12 ` [PATCH 4.4 30/60] USB: serial: ssu100: fix control-message error handling Greg Kroah-Hartman
@ 2017-05-11 14:12 ` Greg Kroah-Hartman
2017-05-11 14:12 ` [PATCH 4.4 32/60] USB: serial: ti_usb_3410_5052: fix control-message error handling Greg Kroah-Hartman
` (30 subsequent siblings)
57 siblings, 0 replies; 68+ messages in thread
From: Greg Kroah-Hartman @ 2017-05-11 14:12 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit e4457d9798adb96272468e93da663de9bd0a4198 upstream.
Use a dedicated buffer for the DMA transfer and make sure to detect
short transfers to avoid parsing a corrupt descriptor.
Fixes: 6e8cf7751f9f ("USB: add EPIC support to the io_edgeport driver")
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/io_edgeport.c | 24 ++++++++++++++++++------
1 file changed, 18 insertions(+), 6 deletions(-)
--- a/drivers/usb/serial/io_edgeport.c
+++ b/drivers/usb/serial/io_edgeport.c
@@ -492,20 +492,24 @@ static int get_epic_descriptor(struct ed
int result;
struct usb_serial *serial = ep->serial;
struct edgeport_product_info *product_info = &ep->product_info;
- struct edge_compatibility_descriptor *epic = &ep->epic_descriptor;
+ struct edge_compatibility_descriptor *epic;
struct edge_compatibility_bits *bits;
struct device *dev = &serial->dev->dev;
ep->is_epic = 0;
+
+ epic = kmalloc(sizeof(*epic), GFP_KERNEL);
+ if (!epic)
+ return -ENOMEM;
+
result = usb_control_msg(serial->dev, usb_rcvctrlpipe(serial->dev, 0),
USB_REQUEST_ION_GET_EPIC_DESC,
0xC0, 0x00, 0x00,
- &ep->epic_descriptor,
- sizeof(struct edge_compatibility_descriptor),
+ epic, sizeof(*epic),
300);
-
- if (result > 0) {
+ if (result == sizeof(*epic)) {
ep->is_epic = 1;
+ memcpy(&ep->epic_descriptor, epic, sizeof(*epic));
memset(product_info, 0, sizeof(struct edgeport_product_info));
product_info->NumPorts = epic->NumPorts;
@@ -534,8 +538,16 @@ static int get_epic_descriptor(struct ed
dev_dbg(dev, " IOSPWriteLCR : %s\n", bits->IOSPWriteLCR ? "TRUE": "FALSE");
dev_dbg(dev, " IOSPSetBaudRate : %s\n", bits->IOSPSetBaudRate ? "TRUE": "FALSE");
dev_dbg(dev, " TrueEdgeport : %s\n", bits->TrueEdgeport ? "TRUE": "FALSE");
+
+ result = 0;
+ } else if (result >= 0) {
+ dev_warn(&serial->interface->dev, "short epic descriptor received: %d\n",
+ result);
+ result = -EIO;
}
+ kfree(epic);
+
return result;
}
@@ -2789,7 +2801,7 @@ static int edge_startup(struct usb_seria
dev_info(&serial->dev->dev, "%s detected\n", edge_serial->name);
/* Read the epic descriptor */
- if (get_epic_descriptor(edge_serial) <= 0) {
+ if (get_epic_descriptor(edge_serial) < 0) {
/* memcpy descriptor to Supports structures */
memcpy(&edge_serial->epic_descriptor.Supports, descriptor,
sizeof(struct edge_compatibility_bits));
^ permalink raw reply [flat|nested] 68+ messages in thread* [PATCH 4.4 32/60] USB: serial: ti_usb_3410_5052: fix control-message error handling
2017-05-11 14:12 [PATCH 4.4 00/60] 4.4.68-stable review Greg Kroah-Hartman
` (26 preceding siblings ...)
2017-05-11 14:12 ` [PATCH 4.4 31/60] USB: serial: io_edgeport: fix epic-descriptor handling Greg Kroah-Hartman
@ 2017-05-11 14:12 ` Greg Kroah-Hartman
2017-05-11 14:12 ` [PATCH 4.4 33/60] USB: serial: ark3116: fix open " Greg Kroah-Hartman
` (29 subsequent siblings)
57 siblings, 0 replies; 68+ messages in thread
From: Greg Kroah-Hartman @ 2017-05-11 14:12 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 39712e8bfa8d3aa6ce1e60fc9d62c9b076c17a30 upstream.
Make sure to detect and return an error on zero-length control-message
transfers when reading from the device.
This addresses a potential failure to detect an empty transmit buffer
during close.
Also remove a redundant check for short transfer when sending a command.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/ti_usb_3410_5052.c | 12 ++++--------
1 file changed, 4 insertions(+), 8 deletions(-)
--- a/drivers/usb/serial/ti_usb_3410_5052.c
+++ b/drivers/usb/serial/ti_usb_3410_5052.c
@@ -1352,13 +1352,10 @@ static int ti_command_out_sync(struct ti
(USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT),
value, moduleid, data, size, 1000);
- if (status == size)
- status = 0;
-
- if (status > 0)
- status = -ECOMM;
+ if (status < 0)
+ return status;
- return status;
+ return 0;
}
@@ -1374,8 +1371,7 @@ static int ti_command_in_sync(struct ti_
if (status == size)
status = 0;
-
- if (status > 0)
+ else if (status >= 0)
status = -ECOMM;
return status;
^ permalink raw reply [flat|nested] 68+ messages in thread* [PATCH 4.4 33/60] USB: serial: ark3116: fix open error handling
2017-05-11 14:12 [PATCH 4.4 00/60] 4.4.68-stable review Greg Kroah-Hartman
` (27 preceding siblings ...)
2017-05-11 14:12 ` [PATCH 4.4 32/60] USB: serial: ti_usb_3410_5052: fix control-message error handling Greg Kroah-Hartman
@ 2017-05-11 14:12 ` Greg Kroah-Hartman
2017-05-11 14:12 ` [PATCH 4.4 34/60] USB: serial: ftdi_sio: fix latency-timer " Greg Kroah-Hartman
` (28 subsequent siblings)
57 siblings, 0 replies; 68+ messages in thread
From: Greg Kroah-Hartman @ 2017-05-11 14:12 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit b631433b175f1002a31020e09bbfc2e5caecf290 upstream.
Fix open error handling which failed to detect errors when reading the
MSR and LSR registers, something which could lead to the shadow
registers being initialised from errnos.
Note that calling the generic close implementation is sufficient in the
error paths as the interrupt urb has not yet been submitted and the
register updates have not been made.
Fixes: f4c1e8d597d1 ("USB: ark3116: Make existing functions 16450-aware
and add close and release functions.")
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/ark3116.c | 25 +++++++++++++++++++------
1 file changed, 19 insertions(+), 6 deletions(-)
--- a/drivers/usb/serial/ark3116.c
+++ b/drivers/usb/serial/ark3116.c
@@ -373,23 +373,29 @@ static int ark3116_open(struct tty_struc
dev_dbg(&port->dev,
"%s - usb_serial_generic_open failed: %d\n",
__func__, result);
- goto err_out;
+ goto err_free;
}
/* remove any data still left: also clears error state */
ark3116_read_reg(serial, UART_RX, buf);
/* read modem status */
- priv->msr = ark3116_read_reg(serial, UART_MSR, buf);
+ result = ark3116_read_reg(serial, UART_MSR, buf);
+ if (result < 0)
+ goto err_close;
+ priv->msr = *buf;
+
/* read line status */
- priv->lsr = ark3116_read_reg(serial, UART_LSR, buf);
+ result = ark3116_read_reg(serial, UART_LSR, buf);
+ if (result < 0)
+ goto err_close;
+ priv->lsr = *buf;
result = usb_submit_urb(port->interrupt_in_urb, GFP_KERNEL);
if (result) {
dev_err(&port->dev, "submit irq_in urb failed %d\n",
result);
- ark3116_close(port);
- goto err_out;
+ goto err_close;
}
/* activate interrupts */
@@ -402,8 +408,15 @@ static int ark3116_open(struct tty_struc
if (tty)
ark3116_set_termios(tty, port, NULL);
-err_out:
kfree(buf);
+
+ return 0;
+
+err_close:
+ usb_serial_generic_close(port);
+err_free:
+ kfree(buf);
+
return result;
}
^ permalink raw reply [flat|nested] 68+ messages in thread* [PATCH 4.4 34/60] USB: serial: ftdi_sio: fix latency-timer error handling
2017-05-11 14:12 [PATCH 4.4 00/60] 4.4.68-stable review Greg Kroah-Hartman
` (28 preceding siblings ...)
2017-05-11 14:12 ` [PATCH 4.4 33/60] USB: serial: ark3116: fix open " Greg Kroah-Hartman
@ 2017-05-11 14:12 ` Greg Kroah-Hartman
2017-05-11 14:12 ` [PATCH 4.4 35/60] USB: serial: quatech2: fix control-message " Greg Kroah-Hartman
` (27 subsequent siblings)
57 siblings, 0 replies; 68+ messages in thread
From: Greg Kroah-Hartman @ 2017-05-11 14:12 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit e3e574ad85a208cb179f33720bb5f12b453de33c upstream.
Make sure to detect short responses when reading the latency timer to
avoid using stale buffer data.
Note that no heap data would currently leak through sysfs as
ASYNC_LOW_LATENCY is set by default.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/ftdi_sio.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -1439,10 +1439,13 @@ static int read_latency_timer(struct usb
FTDI_SIO_GET_LATENCY_TIMER_REQUEST_TYPE,
0, priv->interface,
buf, 1, WDR_TIMEOUT);
- if (rv < 0)
+ if (rv < 1) {
dev_err(&port->dev, "Unable to read latency timer: %i\n", rv);
- else
+ if (rv >= 0)
+ rv = -EIO;
+ } else {
priv->latency = buf[0];
+ }
kfree(buf);
^ permalink raw reply [flat|nested] 68+ messages in thread* [PATCH 4.4 35/60] USB: serial: quatech2: fix control-message error handling
2017-05-11 14:12 [PATCH 4.4 00/60] 4.4.68-stable review Greg Kroah-Hartman
` (29 preceding siblings ...)
2017-05-11 14:12 ` [PATCH 4.4 34/60] USB: serial: ftdi_sio: fix latency-timer " Greg Kroah-Hartman
@ 2017-05-11 14:12 ` Greg Kroah-Hartman
2017-05-11 14:12 ` [PATCH 4.4 36/60] USB: serial: mct_u232: fix modem-status " Greg Kroah-Hartman
` (26 subsequent siblings)
57 siblings, 0 replies; 68+ messages in thread
From: Greg Kroah-Hartman @ 2017-05-11 14:12 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 8c34cb8ddfe808d557b51da983ff10c02793beb2 upstream.
Make sure to detect short control-message transfers when fetching
modem and line state in open and when retrieving registers.
This specifically makes sure that an errno is returned to user space on
errors in TIOCMGET instead of a zero bitmask.
Also drop the unused getdevice function which also lacked appropriate
error handling.
Fixes: f7a33e608d9a ("USB: serial: add quatech2 usb to serial driver")
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/quatech2.c | 24 +++++++++++++-----------
1 file changed, 13 insertions(+), 11 deletions(-)
--- a/drivers/usb/serial/quatech2.c
+++ b/drivers/usb/serial/quatech2.c
@@ -188,22 +188,22 @@ static inline int qt2_setdevice(struct u
}
-static inline int qt2_getdevice(struct usb_device *dev, u8 *data)
-{
- return usb_control_msg(dev, usb_rcvctrlpipe(dev, 0),
- QT_SET_GET_DEVICE, 0xc0, 0, 0,
- data, 3, QT2_USB_TIMEOUT);
-}
-
static inline int qt2_getregister(struct usb_device *dev,
u8 uart,
u8 reg,
u8 *data)
{
- return usb_control_msg(dev, usb_rcvctrlpipe(dev, 0),
- QT_SET_GET_REGISTER, 0xc0, reg,
- uart, data, sizeof(*data), QT2_USB_TIMEOUT);
+ int ret;
+ ret = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0),
+ QT_SET_GET_REGISTER, 0xc0, reg,
+ uart, data, sizeof(*data), QT2_USB_TIMEOUT);
+ if (ret < sizeof(*data)) {
+ if (ret >= 0)
+ ret = -EIO;
+ }
+
+ return ret;
}
static inline int qt2_setregister(struct usb_device *dev,
@@ -372,9 +372,11 @@ static int qt2_open(struct tty_struct *t
0xc0, 0,
device_port, data, 2, QT2_USB_TIMEOUT);
- if (status < 0) {
+ if (status < 2) {
dev_err(&port->dev, "%s - open port failed %i\n", __func__,
status);
+ if (status >= 0)
+ status = -EIO;
kfree(data);
return status;
}
^ permalink raw reply [flat|nested] 68+ messages in thread* [PATCH 4.4 36/60] USB: serial: mct_u232: fix modem-status error handling
2017-05-11 14:12 [PATCH 4.4 00/60] 4.4.68-stable review Greg Kroah-Hartman
` (30 preceding siblings ...)
2017-05-11 14:12 ` [PATCH 4.4 35/60] USB: serial: quatech2: fix control-message " Greg Kroah-Hartman
@ 2017-05-11 14:12 ` Greg Kroah-Hartman
2017-05-11 14:13 ` [PATCH 4.4 37/60] USB: serial: io_edgeport: fix descriptor " Greg Kroah-Hartman
` (25 subsequent siblings)
57 siblings, 0 replies; 68+ messages in thread
From: Greg Kroah-Hartman @ 2017-05-11 14:12 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 36356a669eddb32917fc4b5c2b9b8bf80ede69de upstream.
Make sure to detect short control-message transfers so that errors are
logged when reading the modem status at open.
Note that while this also avoids initialising the modem status using
uninitialised heap data, these bits could not leak to user space as they
are currently not used.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/mct_u232.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/drivers/usb/serial/mct_u232.c
+++ b/drivers/usb/serial/mct_u232.c
@@ -322,8 +322,12 @@ static int mct_u232_get_modem_stat(struc
MCT_U232_GET_REQUEST_TYPE,
0, 0, buf, MCT_U232_GET_MODEM_STAT_SIZE,
WDR_TIMEOUT);
- if (rc < 0) {
+ if (rc < MCT_U232_GET_MODEM_STAT_SIZE) {
dev_err(&port->dev, "Get MODEM STATus failed (error = %d)\n", rc);
+
+ if (rc >= 0)
+ rc = -EIO;
+
*msr = 0;
} else {
*msr = buf[0];
^ permalink raw reply [flat|nested] 68+ messages in thread* [PATCH 4.4 37/60] USB: serial: io_edgeport: fix descriptor error handling
2017-05-11 14:12 [PATCH 4.4 00/60] 4.4.68-stable review Greg Kroah-Hartman
` (31 preceding siblings ...)
2017-05-11 14:12 ` [PATCH 4.4 36/60] USB: serial: mct_u232: fix modem-status " Greg Kroah-Hartman
@ 2017-05-11 14:13 ` Greg Kroah-Hartman
2017-05-11 14:13 ` [PATCH 4.4 38/60] USB: serial: sierra: fix bogus alternate-setting assumption Greg Kroah-Hartman
` (24 subsequent siblings)
57 siblings, 0 replies; 68+ messages in thread
From: Greg Kroah-Hartman @ 2017-05-11 14:13 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 3c0e25d883d06a1fbd1ad35257e8abaa57befb37 upstream.
Make sure to detect short control-message transfers and log an error
when reading incomplete manufacturer and boot descriptors.
Note that the default all-zero descriptors will now be used after a
short transfer is detected instead of partially initialised ones.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/io_edgeport.c | 24 +++++++++++++++---------
1 file changed, 15 insertions(+), 9 deletions(-)
--- a/drivers/usb/serial/io_edgeport.c
+++ b/drivers/usb/serial/io_edgeport.c
@@ -2109,8 +2109,7 @@ static int rom_write(struct usb_serial *
* rom_read
* reads a number of bytes from the Edgeport device starting at the given
* address.
- * If successful returns the number of bytes read, otherwise it returns
- * a negative error number of the problem.
+ * Returns zero on success or a negative error number.
****************************************************************************/
static int rom_read(struct usb_serial *serial, __u16 extAddr,
__u16 addr, __u16 length, __u8 *data)
@@ -2135,12 +2134,17 @@ static int rom_read(struct usb_serial *s
USB_REQUEST_ION_READ_ROM,
0xC0, addr, extAddr, transfer_buffer,
current_length, 300);
- if (result < 0)
+ if (result < current_length) {
+ if (result >= 0)
+ result = -EIO;
break;
+ }
memcpy(data, transfer_buffer, current_length);
length -= current_length;
addr += current_length;
data += current_length;
+
+ result = 0;
}
kfree(transfer_buffer);
@@ -2597,9 +2601,10 @@ static void get_manufacturing_desc(struc
EDGE_MANUF_DESC_LEN,
(__u8 *)(&edge_serial->manuf_descriptor));
- if (response < 1)
- dev_err(dev, "error in getting manufacturer descriptor\n");
- else {
+ if (response < 0) {
+ dev_err(dev, "error in getting manufacturer descriptor: %d\n",
+ response);
+ } else {
char string[30];
dev_dbg(dev, "**Manufacturer Descriptor\n");
dev_dbg(dev, " RomSize: %dK\n",
@@ -2656,9 +2661,10 @@ static void get_boot_desc(struct edgepor
EDGE_BOOT_DESC_LEN,
(__u8 *)(&edge_serial->boot_descriptor));
- if (response < 1)
- dev_err(dev, "error in getting boot descriptor\n");
- else {
+ if (response < 0) {
+ dev_err(dev, "error in getting boot descriptor: %d\n",
+ response);
+ } else {
dev_dbg(dev, "**Boot Descriptor:\n");
dev_dbg(dev, " BootCodeLength: %d\n",
le16_to_cpu(edge_serial->boot_descriptor.BootCodeLength));
^ permalink raw reply [flat|nested] 68+ messages in thread* [PATCH 4.4 38/60] USB: serial: sierra: fix bogus alternate-setting assumption
2017-05-11 14:12 [PATCH 4.4 00/60] 4.4.68-stable review Greg Kroah-Hartman
` (32 preceding siblings ...)
2017-05-11 14:13 ` [PATCH 4.4 37/60] USB: serial: io_edgeport: fix descriptor " Greg Kroah-Hartman
@ 2017-05-11 14:13 ` Greg Kroah-Hartman
2017-05-12 11:26 ` Ben Hutchings
2017-05-11 14:13 ` [PATCH 4.4 39/60] phy: qcom-usb-hs: Add depends on EXTCON Greg Kroah-Hartman
` (23 subsequent siblings)
57 siblings, 1 reply; 68+ messages in thread
From: Greg Kroah-Hartman @ 2017-05-11 14:13 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 16620b483eaf7750413bae472f4363b6b959fcaa upstream.
Interface numbers do not change when enabling alternate settings as
comment and code in this driver suggested.
Remove the confusing comment and redundant retrieval of the interface
number in probe, while simplifying and renaming the interface-number
helper.
Fixes: 4db2299da213 ("sierra: driver interface blacklisting")
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/sierra.c | 28 +++++-----------------------
1 file changed, 5 insertions(+), 23 deletions(-)
--- a/drivers/usb/serial/sierra.c
+++ b/drivers/usb/serial/sierra.c
@@ -137,24 +137,9 @@ static int is_himemory(const u8 ifnum,
return 0;
}
-static int sierra_calc_interface(struct usb_serial *serial)
+static u8 sierra_interface_num(struct usb_serial *serial)
{
- int interface;
- struct usb_interface *p_interface;
- struct usb_host_interface *p_host_interface;
-
- /* Get the interface structure pointer from the serial struct */
- p_interface = serial->interface;
-
- /* Get a pointer to the host interface structure */
- p_host_interface = p_interface->cur_altsetting;
-
- /* read the interface descriptor for this active altsetting
- * to find out the interface number we are on
- */
- interface = p_host_interface->desc.bInterfaceNumber;
-
- return interface;
+ return serial->interface->cur_altsetting->desc.bInterfaceNumber;
}
static int sierra_probe(struct usb_serial *serial,
@@ -165,7 +150,7 @@ static int sierra_probe(struct usb_seria
u8 ifnum;
udev = serial->dev;
- ifnum = sierra_calc_interface(serial);
+ ifnum = sierra_interface_num(serial);
/*
* If this interface supports more than 1 alternate
@@ -178,9 +163,6 @@ static int sierra_probe(struct usb_seria
usb_set_interface(udev, ifnum, 1);
}
- /* ifnum could have changed - by calling usb_set_interface */
- ifnum = sierra_calc_interface(serial);
-
if (is_blacklisted(ifnum,
(struct sierra_iface_info *)id->driver_info)) {
dev_dbg(&serial->dev->dev,
@@ -342,7 +324,7 @@ static int sierra_send_setup(struct usb_
/* If composite device then properly report interface */
if (serial->num_ports == 1) {
- interface = sierra_calc_interface(serial);
+ interface = sierra_interface_num(serial);
/* Control message is sent only to interfaces with
* interrupt_in endpoints
*/
@@ -916,7 +898,7 @@ static int sierra_port_probe(struct usb_
/* Determine actual memory requirements */
if (serial->num_ports == 1) {
/* Get interface number for composite device */
- ifnum = sierra_calc_interface(serial);
+ ifnum = sierra_interface_num(serial);
himemoryp = &typeB_interface_list;
} else {
/* This is really the usb-serial port number of the interface
^ permalink raw reply [flat|nested] 68+ messages in thread* Re: [PATCH 4.4 38/60] USB: serial: sierra: fix bogus alternate-setting assumption
2017-05-11 14:13 ` [PATCH 4.4 38/60] USB: serial: sierra: fix bogus alternate-setting assumption Greg Kroah-Hartman
@ 2017-05-12 11:26 ` Ben Hutchings
2017-05-12 12:14 ` Johan Hovold
0 siblings, 1 reply; 68+ messages in thread
From: Ben Hutchings @ 2017-05-12 11:26 UTC (permalink / raw)
To: Greg Kroah-Hartman, Johan Hovold; +Cc: linux-kernel, stable
On Thu, 2017-05-11 at 16:13 +0200, Greg Kroah-Hartman wrote:
> 4.4-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Johan Hovold <johan@kernel.org>
>
> commit 16620b483eaf7750413bae472f4363b6b959fcaa upstream.
>
> Interface numbers do not change when enabling alternate settings as
> comment and code in this driver suggested.
>
> Remove the confusing comment and redundant retrieval of the interface
> number in probe, while simplifying and renaming the interface-number
> helper.
This looks like cleanup with no functional impact, so unless it's needed
as preparation for something else I think it should be dropped.
Ben.
> Fixes: 4db2299da213 ("sierra: driver interface blacklisting")
> Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Signed-off-by: Johan Hovold <johan@kernel.org>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
>
> ---
> drivers/usb/serial/sierra.c | 28 +++++-----------------------
> 1 file changed, 5 insertions(+), 23 deletions(-)
>
> --- a/drivers/usb/serial/sierra.c
> +++ b/drivers/usb/serial/sierra.c
> @@ -137,24 +137,9 @@ static int is_himemory(const u8 ifnum,
> return 0;
> }
>
> -static int sierra_calc_interface(struct usb_serial *serial)
> +static u8 sierra_interface_num(struct usb_serial *serial)
> {
> - int interface;
> - struct usb_interface *p_interface;
> - struct usb_host_interface *p_host_interface;
> -
> - /* Get the interface structure pointer from the serial struct */
> - p_interface = serial->interface;
> -
> - /* Get a pointer to the host interface structure */
> - p_host_interface = p_interface->cur_altsetting;
> -
> - /* read the interface descriptor for this active altsetting
> - * to find out the interface number we are on
> - */
> - interface = p_host_interface->desc.bInterfaceNumber;
> -
> - return interface;
> + return serial->interface->cur_altsetting->desc.bInterfaceNumber;
> }
>
> static int sierra_probe(struct usb_serial *serial,
> @@ -165,7 +150,7 @@ static int sierra_probe(struct usb_seria
> u8 ifnum;
>
> udev = serial->dev;
> - ifnum = sierra_calc_interface(serial);
> + ifnum = sierra_interface_num(serial);
>
> /*
> * If this interface supports more than 1 alternate
> @@ -178,9 +163,6 @@ static int sierra_probe(struct usb_seria
> usb_set_interface(udev, ifnum, 1);
> }
>
> - /* ifnum could have changed - by calling usb_set_interface */
> - ifnum = sierra_calc_interface(serial);
> -
> if (is_blacklisted(ifnum,
> (struct sierra_iface_info *)id->driver_info)) {
> dev_dbg(&serial->dev->dev,
> @@ -342,7 +324,7 @@ static int sierra_send_setup(struct usb_
>
> /* If composite device then properly report interface */
> if (serial->num_ports == 1) {
> - interface = sierra_calc_interface(serial);
> + interface = sierra_interface_num(serial);
> /* Control message is sent only to interfaces with
> * interrupt_in endpoints
> */
> @@ -916,7 +898,7 @@ static int sierra_port_probe(struct usb_
> /* Determine actual memory requirements */
> if (serial->num_ports == 1) {
> /* Get interface number for composite device */
> - ifnum = sierra_calc_interface(serial);
> + ifnum = sierra_interface_num(serial);
> himemoryp = &typeB_interface_list;
> } else {
> /* This is really the usb-serial port number of the interface
>
>
>
--
Ben Hutchings
Software Developer, Codethink Ltd.
^ permalink raw reply [flat|nested] 68+ messages in thread* Re: [PATCH 4.4 38/60] USB: serial: sierra: fix bogus alternate-setting assumption
2017-05-12 11:26 ` Ben Hutchings
@ 2017-05-12 12:14 ` Johan Hovold
2017-05-12 13:10 ` Greg Kroah-Hartman
0 siblings, 1 reply; 68+ messages in thread
From: Johan Hovold @ 2017-05-12 12:14 UTC (permalink / raw)
To: Ben Hutchings; +Cc: Greg Kroah-Hartman, Johan Hovold, linux-kernel, stable
On Fri, May 12, 2017 at 12:26:17PM +0100, Ben Hutchings wrote:
> On Thu, 2017-05-11 at 16:13 +0200, Greg Kroah-Hartman wrote:
> > 4.4-stable review patch. If anyone has any objections, please let me know.
> >
> > ------------------
> >
> > From: Johan Hovold <johan@kernel.org>
> >
> > commit 16620b483eaf7750413bae472f4363b6b959fcaa upstream.
> >
> > Interface numbers do not change when enabling alternate settings as
> > comment and code in this driver suggested.
> >
> > Remove the confusing comment and redundant retrieval of the interface
> > number in probe, while simplifying and renaming the interface-number
> > helper.
>
> This looks like cleanup with no functional impact, so unless it's needed
> as preparation for something else I think it should be dropped.
Indeed, this one is not needed in -stable.
Thanks,
Johan
^ permalink raw reply [flat|nested] 68+ messages in thread
* Re: [PATCH 4.4 38/60] USB: serial: sierra: fix bogus alternate-setting assumption
2017-05-12 12:14 ` Johan Hovold
@ 2017-05-12 13:10 ` Greg Kroah-Hartman
0 siblings, 0 replies; 68+ messages in thread
From: Greg Kroah-Hartman @ 2017-05-12 13:10 UTC (permalink / raw)
To: Johan Hovold; +Cc: Ben Hutchings, linux-kernel, stable
On Fri, May 12, 2017 at 02:14:03PM +0200, Johan Hovold wrote:
> On Fri, May 12, 2017 at 12:26:17PM +0100, Ben Hutchings wrote:
> > On Thu, 2017-05-11 at 16:13 +0200, Greg Kroah-Hartman wrote:
> > > 4.4-stable review patch. If anyone has any objections, please let me know.
> > >
> > > ------------------
> > >
> > > From: Johan Hovold <johan@kernel.org>
> > >
> > > commit 16620b483eaf7750413bae472f4363b6b959fcaa upstream.
> > >
> > > Interface numbers do not change when enabling alternate settings as
> > > comment and code in this driver suggested.
> > >
> > > Remove the confusing comment and redundant retrieval of the interface
> > > number in probe, while simplifying and renaming the interface-number
> > > helper.
> >
> > This looks like cleanup with no functional impact, so unless it's needed
> > as preparation for something else I think it should be dropped.
>
> Indeed, this one is not needed in -stable.
Ah, my fault, I thought this was fixing an issue there, sorry about
that.
Now removed from all of the queues, thanks Ben.
greg k-h
^ permalink raw reply [flat|nested] 68+ messages in thread
* [PATCH 4.4 39/60] phy: qcom-usb-hs: Add depends on EXTCON
2017-05-11 14:12 [PATCH 4.4 00/60] 4.4.68-stable review Greg Kroah-Hartman
` (33 preceding siblings ...)
2017-05-11 14:13 ` [PATCH 4.4 38/60] USB: serial: sierra: fix bogus alternate-setting assumption Greg Kroah-Hartman
@ 2017-05-11 14:13 ` Greg Kroah-Hartman
2017-05-11 14:13 ` [PATCH 4.4 40/60] serial: 8250_omap: Fix probe and remove for PM runtime Greg Kroah-Hartman
` (22 subsequent siblings)
57 siblings, 0 replies; 68+ messages in thread
From: Greg Kroah-Hartman @ 2017-05-11 14:13 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Stephen Boyd, Kishon Vijay Abraham I
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Boyd <stephen.boyd@linaro.org>
commit 1a09b6a7c10e22c489a8b212dd6862b1fd9674ad upstream.
We get the following compile errors if EXTCON is enabled as a
module but this driver is builtin:
drivers/built-in.o: In function `qcom_usb_hs_phy_power_off':
phy-qcom-usb-hs.c:(.text+0x1089): undefined reference to `extcon_unregister_notifier'
drivers/built-in.o: In function `qcom_usb_hs_phy_probe':
phy-qcom-usb-hs.c:(.text+0x11b5): undefined reference to `extcon_get_edev_by_phandle'
drivers/built-in.o: In function `qcom_usb_hs_phy_power_on':
phy-qcom-usb-hs.c:(.text+0x128e): undefined reference to `extcon_get_state'
phy-qcom-usb-hs.c:(.text+0x12a9): undefined reference to `extcon_register_notifier'
so let's mark this as needing to follow the modular status of
the extcon framework.
Fixes: 9994a33865f4 e2427b09ba929c2b9 (phy: Add support for Qualcomm's USB HS phy")
Signed-off-by: Stephen Boyd <stephen.boyd@linaro.org>
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/phy/Kconfig | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/phy/Kconfig
+++ b/drivers/phy/Kconfig
@@ -368,6 +368,7 @@ config PHY_QCOM_UFS
config PHY_TUSB1210
tristate "TI TUSB1210 ULPI PHY module"
depends on USB_ULPI_BUS
+ depends on EXTCON || !EXTCON # if EXTCON=m, this cannot be built-in
select GENERIC_PHY
help
Support for TI TUSB1210 USB ULPI PHY.
^ permalink raw reply [flat|nested] 68+ messages in thread* [PATCH 4.4 40/60] serial: 8250_omap: Fix probe and remove for PM runtime
2017-05-11 14:12 [PATCH 4.4 00/60] 4.4.68-stable review Greg Kroah-Hartman
` (34 preceding siblings ...)
2017-05-11 14:13 ` [PATCH 4.4 39/60] phy: qcom-usb-hs: Add depends on EXTCON Greg Kroah-Hartman
@ 2017-05-11 14:13 ` Greg Kroah-Hartman
2017-05-11 14:13 ` [PATCH 4.4 41/60] scsi: mac_scsi: Fix MAC_SCSI=m option when SCSI=m Greg Kroah-Hartman
` (21 subsequent siblings)
57 siblings, 0 replies; 68+ messages in thread
From: Greg Kroah-Hartman @ 2017-05-11 14:13 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Tony Lindgren
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Lindgren <tony@atomide.com>
commit 4e0f5cc65098ea32a1e77baae74215b9bd5276b1 upstream.
Otherwise the interconnect related code implementing PM runtime will
produce these errors on a failed probe:
omap_uart 48066000.serial: omap_device: omap_device_enable() called from invalid state 1
omap_uart 48066000.serial: use pm_runtime_put_sync_suspend() in driver?
Note that we now also need to check for priv in omap8250_runtime_suspend()
as it has not yet been registered if probe fails. And we need to use
pm_runtime_put_sync() to properly idle the device like we already do
in omap8250_remove().
Fixes: 61929cf0169d ("tty: serial: Add 8250-core based omap driver")
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/8250/8250_omap.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/drivers/tty/serial/8250/8250_omap.c
+++ b/drivers/tty/serial/8250/8250_omap.c
@@ -1235,7 +1235,8 @@ static int omap8250_probe(struct platfor
pm_runtime_put_autosuspend(&pdev->dev);
return 0;
err:
- pm_runtime_put(&pdev->dev);
+ pm_runtime_dont_use_autosuspend(&pdev->dev);
+ pm_runtime_put_sync(&pdev->dev);
pm_runtime_disable(&pdev->dev);
return ret;
}
@@ -1244,6 +1245,7 @@ static int omap8250_remove(struct platfo
{
struct omap8250_priv *priv = platform_get_drvdata(pdev);
+ pm_runtime_dont_use_autosuspend(&pdev->dev);
pm_runtime_put_sync(&pdev->dev);
pm_runtime_disable(&pdev->dev);
serial8250_unregister_port(priv->line);
@@ -1343,6 +1345,10 @@ static int omap8250_runtime_suspend(stru
struct omap8250_priv *priv = dev_get_drvdata(dev);
struct uart_8250_port *up;
+ /* In case runtime-pm tries this before we are setup */
+ if (!priv)
+ return 0;
+
up = serial8250_get_port(priv->line);
/*
* When using 'no_console_suspend', the console UART must not be
^ permalink raw reply [flat|nested] 68+ messages in thread* [PATCH 4.4 41/60] scsi: mac_scsi: Fix MAC_SCSI=m option when SCSI=m
2017-05-11 14:12 [PATCH 4.4 00/60] 4.4.68-stable review Greg Kroah-Hartman
` (35 preceding siblings ...)
2017-05-11 14:13 ` [PATCH 4.4 40/60] serial: 8250_omap: Fix probe and remove for PM runtime Greg Kroah-Hartman
@ 2017-05-11 14:13 ` Greg Kroah-Hartman
2017-05-11 14:13 ` [PATCH 4.4 42/60] scsi: scsi_dh_emc: return success in clariion_std_inquiry() Greg Kroah-Hartman
` (20 subsequent siblings)
57 siblings, 0 replies; 68+ messages in thread
From: Greg Kroah-Hartman @ 2017-05-11 14:13 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Finn Thain, Martin K. Petersen
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Finn Thain <fthain@telegraphics.com.au>
commit 2559a1ef688f933835912c731bed2254146a9b04 upstream.
The mac_scsi driver still gets disabled when SCSI=m. This should have
been fixed back when I enabled the tristate but I didn't see the bug.
Fixes: 6e9ae6d560e1 ("[PATCH] mac_scsi: Add module option to Kconfig")
Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/Kconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/scsi/Kconfig
+++ b/drivers/scsi/Kconfig
@@ -1637,7 +1637,7 @@ config ATARI_SCSI_RESET_BOOT
config MAC_SCSI
tristate "Macintosh NCR5380 SCSI"
- depends on MAC && SCSI=y
+ depends on MAC && SCSI
select SCSI_SPI_ATTRS
help
This is the NCR 5380 SCSI controller included on most of the 68030
^ permalink raw reply [flat|nested] 68+ messages in thread* [PATCH 4.4 42/60] scsi: scsi_dh_emc: return success in clariion_std_inquiry()
2017-05-11 14:12 [PATCH 4.4 00/60] 4.4.68-stable review Greg Kroah-Hartman
` (36 preceding siblings ...)
2017-05-11 14:13 ` [PATCH 4.4 41/60] scsi: mac_scsi: Fix MAC_SCSI=m option when SCSI=m Greg Kroah-Hartman
@ 2017-05-11 14:13 ` Greg Kroah-Hartman
2017-05-12 11:36 ` Ben Hutchings
2017-05-11 14:13 ` [PATCH 4.4 43/60] MIPS: R2-on-R6 MULTU/MADDU/MSUBU emulation bugfix Greg Kroah-Hartman
` (19 subsequent siblings)
57 siblings, 1 reply; 68+ messages in thread
From: Greg Kroah-Hartman @ 2017-05-11 14:13 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Hannes Reinecke,
Martin K. Petersen
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
commit 4d7d39a18b8b81511f0b893b7d2203790bf8a58b upstream.
We accidentally return an uninitialized variable on success.
Fixes: b6ff1b14cdf4 ("[SCSI] scsi_dh: Update EMC handler")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/device_handler/scsi_dh_emc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/scsi/device_handler/scsi_dh_emc.c
+++ b/drivers/scsi/device_handler/scsi_dh_emc.c
@@ -456,7 +456,7 @@ static int clariion_prep_fn(struct scsi_
static int clariion_std_inquiry(struct scsi_device *sdev,
struct clariion_dh_data *csdev)
{
- int err;
+ int err = SCSI_DH_OK;
char *sp_model;
err = send_inquiry_cmd(sdev, 0, csdev);
^ permalink raw reply [flat|nested] 68+ messages in thread* Re: [PATCH 4.4 42/60] scsi: scsi_dh_emc: return success in clariion_std_inquiry()
2017-05-11 14:13 ` [PATCH 4.4 42/60] scsi: scsi_dh_emc: return success in clariion_std_inquiry() Greg Kroah-Hartman
@ 2017-05-12 11:36 ` Ben Hutchings
2017-05-12 13:12 ` Greg Kroah-Hartman
0 siblings, 1 reply; 68+ messages in thread
From: Ben Hutchings @ 2017-05-12 11:36 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, stable, Dan Carpenter, Hannes Reinecke, Martin K. Petersen
On Thu, 2017-05-11 at 16:13 +0200, Greg Kroah-Hartman wrote:
> 4.4-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Dan Carpenter <dan.carpenter@oracle.com>
>
> commit 4d7d39a18b8b81511f0b893b7d2203790bf8a58b upstream.
>
> We accidentally return an uninitialized variable on success.
No we don't.
> Fixes: b6ff1b14cdf4 ("[SCSI] scsi_dh: Update EMC handler")
Actually fixes: b78205c93297 ("scsi_dh_emc: switch to
scsi_execute_req_flags()") so this is only needed for 4.11.y.
Ben.
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> Reviewed-by: Hannes Reinecke <hare@suse.de>
> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
>
> ---
> drivers/scsi/device_handler/scsi_dh_emc.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> --- a/drivers/scsi/device_handler/scsi_dh_emc.c
> +++ b/drivers/scsi/device_handler/scsi_dh_emc.c
> @@ -456,7 +456,7 @@ static int clariion_prep_fn(struct scsi_
> static int clariion_std_inquiry(struct scsi_device *sdev,
> struct clariion_dh_data *csdev)
> {
> - int err;
> + int err = SCSI_DH_OK;
> char *sp_model;
>
> err = send_inquiry_cmd(sdev, 0, csdev);
>
>
>
--
Ben Hutchings
Software Developer, Codethink Ltd.
^ permalink raw reply [flat|nested] 68+ messages in thread* Re: [PATCH 4.4 42/60] scsi: scsi_dh_emc: return success in clariion_std_inquiry()
2017-05-12 11:36 ` Ben Hutchings
@ 2017-05-12 13:12 ` Greg Kroah-Hartman
0 siblings, 0 replies; 68+ messages in thread
From: Greg Kroah-Hartman @ 2017-05-12 13:12 UTC (permalink / raw)
To: Ben Hutchings
Cc: linux-kernel, stable, Dan Carpenter, Hannes Reinecke, Martin K. Petersen
On Fri, May 12, 2017 at 12:36:13PM +0100, Ben Hutchings wrote:
> On Thu, 2017-05-11 at 16:13 +0200, Greg Kroah-Hartman wrote:
> > 4.4-stable review patch. If anyone has any objections, please let me know.
> >
> > ------------------
> >
> > From: Dan Carpenter <dan.carpenter@oracle.com>
> >
> > commit 4d7d39a18b8b81511f0b893b7d2203790bf8a58b upstream.
> >
> > We accidentally return an uninitialized variable on success.
>
> No we don't.
>
> > Fixes: b6ff1b14cdf4 ("[SCSI] scsi_dh: Update EMC handler")
>
> Actually fixes: b78205c93297 ("scsi_dh_emc: switch to
> scsi_execute_req_flags()") so this is only needed for 4.11.y.
Ah, thanks for catching this, removed now from all of the queues.
greg k-h
^ permalink raw reply [flat|nested] 68+ messages in thread
* [PATCH 4.4 43/60] MIPS: R2-on-R6 MULTU/MADDU/MSUBU emulation bugfix
2017-05-11 14:12 [PATCH 4.4 00/60] 4.4.68-stable review Greg Kroah-Hartman
` (37 preceding siblings ...)
2017-05-11 14:13 ` [PATCH 4.4 42/60] scsi: scsi_dh_emc: return success in clariion_std_inquiry() Greg Kroah-Hartman
@ 2017-05-11 14:13 ` Greg Kroah-Hartman
2017-05-11 14:13 ` [PATCH 4.4 44/60] brcmfmac: Ensure pointer correctly set if skb data location changes Greg Kroah-Hartman
` (18 subsequent siblings)
57 siblings, 0 replies; 68+ messages in thread
From: Greg Kroah-Hartman @ 2017-05-11 14:13 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Leonid Yegoshin, Nikola.Veljkovic,
paul.burton, yamada.masahiro, akpm, andrea.gelmini, macro,
linux-mips, Ralf Baechle
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leonid Yegoshin <Leonid.Yegoshin@imgtec.com>
commit d65e5677ad5b3a49c43f60ec07644dc1f87bbd2e upstream.
MIPS instructions MULTU, MADDU and MSUBU emulation requires registers HI/LO
to be converted to signed 32bits before 64bit sign extension on MIPS64.
Bug was found on running MIPS32 R2 test application on MIPS64 R6 kernel.
Fixes: b0a668fb2038 ("MIPS: kernel: mips-r2-to-r6-emul: Add R2 emulator for MIPS R6")
Signed-off-by: Leonid Yegoshin <Leonid.Yegoshin@imgtec.com>
Reported-by: Nikola.Veljkovic@imgtec.com
Cc: paul.burton@imgtec.com
Cc: yamada.masahiro@socionext.com
Cc: akpm@linux-foundation.org
Cc: andrea.gelmini@gelma.net
Cc: macro@imgtec.com
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/14043/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/mips/kernel/mips-r2-to-r6-emul.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
--- a/arch/mips/kernel/mips-r2-to-r6-emul.c
+++ b/arch/mips/kernel/mips-r2-to-r6-emul.c
@@ -434,8 +434,8 @@ static int multu_func(struct pt_regs *re
rs = regs->regs[MIPSInst_RS(ir)];
res = (u64)rt * (u64)rs;
rt = res;
- regs->lo = (s64)rt;
- regs->hi = (s64)(res >> 32);
+ regs->lo = (s64)(s32)rt;
+ regs->hi = (s64)(s32)(res >> 32);
MIPS_R2_STATS(muls);
@@ -671,9 +671,9 @@ static int maddu_func(struct pt_regs *re
res += ((((s64)rt) << 32) | (u32)rs);
rt = res;
- regs->lo = (s64)rt;
+ regs->lo = (s64)(s32)rt;
rs = res >> 32;
- regs->hi = (s64)rs;
+ regs->hi = (s64)(s32)rs;
MIPS_R2_STATS(dsps);
@@ -729,9 +729,9 @@ static int msubu_func(struct pt_regs *re
res = ((((s64)rt) << 32) | (u32)rs) - res;
rt = res;
- regs->lo = (s64)rt;
+ regs->lo = (s64)(s32)rt;
rs = res >> 32;
- regs->hi = (s64)rs;
+ regs->hi = (s64)(s32)rs;
MIPS_R2_STATS(dsps);
^ permalink raw reply [flat|nested] 68+ messages in thread* [PATCH 4.4 44/60] brcmfmac: Ensure pointer correctly set if skb data location changes
2017-05-11 14:12 [PATCH 4.4 00/60] 4.4.68-stable review Greg Kroah-Hartman
` (38 preceding siblings ...)
2017-05-11 14:13 ` [PATCH 4.4 43/60] MIPS: R2-on-R6 MULTU/MADDU/MSUBU emulation bugfix Greg Kroah-Hartman
@ 2017-05-11 14:13 ` Greg Kroah-Hartman
2017-05-11 14:13 ` [PATCH 4.4 45/60] brcmfmac: Make skb header writable before use Greg Kroah-Hartman
` (17 subsequent siblings)
57 siblings, 0 replies; 68+ messages in thread
From: Greg Kroah-Hartman @ 2017-05-11 14:13 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, James Hughes, Arend van Spriel, Kalle Valo
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Hughes <james.hughes@raspberrypi.org>
commit 455a1eb4654c24560eb9dfc634f29cba3d87601e upstream.
The incoming skb header may be resized if header space is
insufficient, which might change the data adddress in the skb.
Ensure that a cached pointer to that data is correctly set by
moving assignment to after any possible changes.
Signed-off-by: James Hughes <james.hughes@raspberrypi.org>
Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/brcm80211/brcmfmac/core.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/net/wireless/brcm80211/brcmfmac/core.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/core.c
@@ -211,7 +211,7 @@ static netdev_tx_t brcmf_netdev_start_xm
int ret;
struct brcmf_if *ifp = netdev_priv(ndev);
struct brcmf_pub *drvr = ifp->drvr;
- struct ethhdr *eh = (struct ethhdr *)(skb->data);
+ struct ethhdr *eh;
brcmf_dbg(DATA, "Enter, idx=%d\n", ifp->bssidx);
@@ -257,6 +257,8 @@ static netdev_tx_t brcmf_netdev_start_xm
goto done;
}
+ eh = (struct ethhdr *)(skb->data);
+
if (eh->h_proto == htons(ETH_P_PAE))
atomic_inc(&ifp->pend_8021x_cnt);
^ permalink raw reply [flat|nested] 68+ messages in thread* [PATCH 4.4 45/60] brcmfmac: Make skb header writable before use
2017-05-11 14:12 [PATCH 4.4 00/60] 4.4.68-stable review Greg Kroah-Hartman
` (39 preceding siblings ...)
2017-05-11 14:13 ` [PATCH 4.4 44/60] brcmfmac: Ensure pointer correctly set if skb data location changes Greg Kroah-Hartman
@ 2017-05-11 14:13 ` Greg Kroah-Hartman
2017-05-11 14:13 ` [PATCH 4.4 46/60] staging: wlan-ng: add missing byte order conversion Greg Kroah-Hartman
` (16 subsequent siblings)
57 siblings, 0 replies; 68+ messages in thread
From: Greg Kroah-Hartman @ 2017-05-11 14:13 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, James Hughes, Arend van Spriel, Kalle Valo
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Hughes <james.hughes@raspberrypi.org>
commit 9cc4b7cb86cbcc6330a3faa8cd65268cd2d3c227 upstream.
The driver was making changes to the skb_header without
ensuring it was writable (i.e. uncloned).
This patch also removes some boiler plate header size
checking/adjustment code as that is also handled by the
skb_cow_header function used to make header writable.
Signed-off-by: James Hughes <james.hughes@raspberrypi.org>
Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/brcm80211/brcmfmac/core.c | 19 +++++--------------
1 file changed, 5 insertions(+), 14 deletions(-)
--- a/drivers/net/wireless/brcm80211/brcmfmac/core.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/core.c
@@ -232,22 +232,13 @@ static netdev_tx_t brcmf_netdev_start_xm
goto done;
}
- /* Make sure there's enough room for any header */
- if (skb_headroom(skb) < drvr->hdrlen) {
- struct sk_buff *skb2;
-
- brcmf_dbg(INFO, "%s: insufficient headroom\n",
+ /* Make sure there's enough writable headroom*/
+ ret = skb_cow_head(skb, drvr->hdrlen);
+ if (ret < 0) {
+ brcmf_err("%s: skb_cow_head failed\n",
brcmf_ifname(drvr, ifp->bssidx));
- drvr->bus_if->tx_realloc++;
- skb2 = skb_realloc_headroom(skb, drvr->hdrlen);
dev_kfree_skb(skb);
- skb = skb2;
- if (skb == NULL) {
- brcmf_err("%s: skb_realloc_headroom failed\n",
- brcmf_ifname(drvr, ifp->bssidx));
- ret = -ENOMEM;
- goto done;
- }
+ goto done;
}
/* validate length for ether packet */
^ permalink raw reply [flat|nested] 68+ messages in thread* [PATCH 4.4 46/60] staging: wlan-ng: add missing byte order conversion
2017-05-11 14:12 [PATCH 4.4 00/60] 4.4.68-stable review Greg Kroah-Hartman
` (40 preceding siblings ...)
2017-05-11 14:13 ` [PATCH 4.4 45/60] brcmfmac: Make skb header writable before use Greg Kroah-Hartman
@ 2017-05-11 14:13 ` Greg Kroah-Hartman
2017-05-11 14:13 ` [PATCH 4.4 47/60] staging: emxx_udc: remove incorrect __init annotations Greg Kroah-Hartman
` (15 subsequent siblings)
57 siblings, 0 replies; 68+ messages in thread
From: Greg Kroah-Hartman @ 2017-05-11 14:13 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Igor Pylypiv
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Igor Pylypiv <igor.pylypiv@gmail.com>
commit 2c474b8579e9b67ff72b2bcefce9f53c7f4469d4 upstream.
Conversion macros le16_to_cpu was removed and that caused new sparse warning
sparse output:
drivers/staging/wlan-ng/p80211netdev.c:241:44: warning: incorrect type in argument 2 (different base types)
drivers/staging/wlan-ng/p80211netdev.c:241:44: expected unsigned short [unsigned] [usertype] fc
drivers/staging/wlan-ng/p80211netdev.c:241:44: got restricted __le16 [usertype] fc
Fixes: 7ad82572348c ("staging:wlan-ng:Fix sparse warning")
Signed-off-by: Igor Pylypiv <igor.pylypiv@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/wlan-ng/p80211netdev.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/staging/wlan-ng/p80211netdev.c
+++ b/drivers/staging/wlan-ng/p80211netdev.c
@@ -232,7 +232,7 @@ static int p80211_convert_to_ether(wland
struct p80211_hdr_a3 *hdr;
hdr = (struct p80211_hdr_a3 *) skb->data;
- if (p80211_rx_typedrop(wlandev, hdr->fc))
+ if (p80211_rx_typedrop(wlandev, le16_to_cpu(hdr->fc)))
return CONV_TO_ETHER_SKIPPED;
/* perform mcast filtering: allow my local address through but reject
^ permalink raw reply [flat|nested] 68+ messages in thread* [PATCH 4.4 47/60] staging: emxx_udc: remove incorrect __init annotations
2017-05-11 14:12 [PATCH 4.4 00/60] 4.4.68-stable review Greg Kroah-Hartman
` (41 preceding siblings ...)
2017-05-11 14:13 ` [PATCH 4.4 46/60] staging: wlan-ng: add missing byte order conversion Greg Kroah-Hartman
@ 2017-05-11 14:13 ` Greg Kroah-Hartman
2017-05-11 14:13 ` [PATCH 4.4 48/60] ALSA: hda - Fix deadlock of controller device lock at unbinding Greg Kroah-Hartman
` (14 subsequent siblings)
57 siblings, 0 replies; 68+ messages in thread
From: Greg Kroah-Hartman @ 2017-05-11 14:13 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Arnd Bergmann
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <arnd@arndb.de>
commit 4f3445067d5f78fb8d1970b02610f85c2f377ea4 upstream.
The probe function is not marked __init, but some other functions
are. This leads to a warning on older compilers (e.g. gcc-4.3),
and can cause executing freed memory when built with those
compilers:
WARNING: drivers/staging/emxx_udc/emxx_udc.o(.text+0x2d78): Section mismatch in reference from the function nbu2ss_drv_probe() to the function .init.text:nbu2ss_drv_contest_init()
This removes the annotations.
Fixes: 33aa8d45a4fe ("staging: emxx_udc: Add Emma Mobile USB Gadget driver")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/emxx_udc/emxx_udc.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/staging/emxx_udc/emxx_udc.c
+++ b/drivers/staging/emxx_udc/emxx_udc.c
@@ -3181,7 +3181,7 @@ static const struct {
};
/*-------------------------------------------------------------------------*/
-static void __init nbu2ss_drv_ep_init(struct nbu2ss_udc *udc)
+static void nbu2ss_drv_ep_init(struct nbu2ss_udc *udc)
{
int i;
@@ -3211,7 +3211,7 @@ static void __init nbu2ss_drv_ep_init(st
/*-------------------------------------------------------------------------*/
/* platform_driver */
-static int __init nbu2ss_drv_contest_init(
+static int nbu2ss_drv_contest_init(
struct platform_device *pdev,
struct nbu2ss_udc *udc)
{
^ permalink raw reply [flat|nested] 68+ messages in thread* [PATCH 4.4 48/60] ALSA: hda - Fix deadlock of controller device lock at unbinding
2017-05-11 14:12 [PATCH 4.4 00/60] 4.4.68-stable review Greg Kroah-Hartman
` (42 preceding siblings ...)
2017-05-11 14:13 ` [PATCH 4.4 47/60] staging: emxx_udc: remove incorrect __init annotations Greg Kroah-Hartman
@ 2017-05-11 14:13 ` Greg Kroah-Hartman
2017-05-11 14:13 ` [PATCH 4.4 49/60] tcp: do not underestimate skb->truesize in tcp_trim_head() Greg Kroah-Hartman
` (13 subsequent siblings)
57 siblings, 0 replies; 68+ messages in thread
From: Greg Kroah-Hartman @ 2017-05-11 14:13 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Imre Deak, Takashi Iwai
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit ab949d519601880fd46e8bc1445d6a453bf2dc09 upstream.
Imre Deak reported a deadlock of HD-audio driver at unbinding while
it's still in probing. Since we probe the codecs asynchronously in a
work, the codec driver probe may still be kicked off while the
controller itself is being unbound. And, azx_remove() tries to
process all pending tasks via cancel_work_sync() for fixing the other
races (see commit [0b8c82190c12: ALSA: hda - Cancel probe work instead
of flush at remove]), now we may meet a bizarre deadlock:
Unbind snd_hda_intel via sysfs:
device_release_driver() ->
device_lock(snd_hda_intel) ->
azx_remove() ->
cancel_work_sync(azx_probe_work)
azx_probe_work():
codec driver probe() ->
__driver_attach() ->
device_lock(snd_hda_intel)
This deadlock is caused by the fact that both device_release_driver()
and driver_probe_device() take both the device and its parent locks at
the same time. The codec device sets the controller device as its
parent, and this lock is taken before the probe() callback is called,
while the controller remove() callback gets called also with the same
lock.
In this patch, as an ugly workaround, we unlock the controller device
temporarily during cancel_work_sync() call. The race against another
bind call should be still suppressed by the parent's device lock.
Reported-by: Imre Deak <imre.deak@intel.com>
Fixes: 0b8c82190c12 ("ALSA: hda - Cancel probe work instead of flush at remove")
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/hda_intel.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -2166,7 +2166,20 @@ static void azx_remove(struct pci_dev *p
/* cancel the pending probing work */
chip = card->private_data;
hda = container_of(chip, struct hda_intel, chip);
+ /* FIXME: below is an ugly workaround.
+ * Both device_release_driver() and driver_probe_device()
+ * take *both* the device's and its parent's lock before
+ * calling the remove() and probe() callbacks. The codec
+ * probe takes the locks of both the codec itself and its
+ * parent, i.e. the PCI controller dev. Meanwhile, when
+ * the PCI controller is unbound, it takes its lock, too
+ * ==> ouch, a deadlock!
+ * As a workaround, we unlock temporarily here the controller
+ * device during cancel_work_sync() call.
+ */
+ device_unlock(&pci->dev);
cancel_work_sync(&hda->probe_work);
+ device_lock(&pci->dev);
snd_card_free(card);
}
^ permalink raw reply [flat|nested] 68+ messages in thread* [PATCH 4.4 49/60] tcp: do not underestimate skb->truesize in tcp_trim_head()
2017-05-11 14:12 [PATCH 4.4 00/60] 4.4.68-stable review Greg Kroah-Hartman
` (43 preceding siblings ...)
2017-05-11 14:13 ` [PATCH 4.4 48/60] ALSA: hda - Fix deadlock of controller device lock at unbinding Greg Kroah-Hartman
@ 2017-05-11 14:13 ` Greg Kroah-Hartman
2017-05-11 14:13 ` [PATCH 4.4 50/60] bpf, arm64: fix jit branch offset related to ldimm64 Greg Kroah-Hartman
` (12 subsequent siblings)
57 siblings, 0 replies; 68+ messages in thread
From: Greg Kroah-Hartman @ 2017-05-11 14:13 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Eric Dumazet, Andrey Konovalov,
David S. Miller
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 7162fb242cb8322beb558828fd26b33c3e9fc805 ]
Andrey found a way to trigger the WARN_ON_ONCE(delta < len) in
skb_try_coalesce() using syzkaller and a filter attached to a TCP
socket over loopback interface.
I believe one issue with looped skbs is that tcp_trim_head() can end up
producing skb with under estimated truesize.
It hardly matters for normal conditions, since packets sent over
loopback are never truncated.
Bytes trimmed from skb->head should not change skb truesize, since
skb->head is not reallocated.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/tcp_output.c | 19 ++++++++++++-------
1 file changed, 12 insertions(+), 7 deletions(-)
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -1221,7 +1221,7 @@ int tcp_fragment(struct sock *sk, struct
* eventually). The difference is that pulled data not copied, but
* immediately discarded.
*/
-static void __pskb_trim_head(struct sk_buff *skb, int len)
+static int __pskb_trim_head(struct sk_buff *skb, int len)
{
struct skb_shared_info *shinfo;
int i, k, eat;
@@ -1231,7 +1231,7 @@ static void __pskb_trim_head(struct sk_b
__skb_pull(skb, eat);
len -= eat;
if (!len)
- return;
+ return 0;
}
eat = len;
k = 0;
@@ -1257,23 +1257,28 @@ static void __pskb_trim_head(struct sk_b
skb_reset_tail_pointer(skb);
skb->data_len -= len;
skb->len = skb->data_len;
+ return len;
}
/* Remove acked data from a packet in the transmit queue. */
int tcp_trim_head(struct sock *sk, struct sk_buff *skb, u32 len)
{
+ u32 delta_truesize;
+
if (skb_unclone(skb, GFP_ATOMIC))
return -ENOMEM;
- __pskb_trim_head(skb, len);
+ delta_truesize = __pskb_trim_head(skb, len);
TCP_SKB_CB(skb)->seq += len;
skb->ip_summed = CHECKSUM_PARTIAL;
- skb->truesize -= len;
- sk->sk_wmem_queued -= len;
- sk_mem_uncharge(sk, len);
- sock_set_flag(sk, SOCK_QUEUE_SHRUNK);
+ if (delta_truesize) {
+ skb->truesize -= delta_truesize;
+ sk->sk_wmem_queued -= delta_truesize;
+ sk_mem_uncharge(sk, delta_truesize);
+ sock_set_flag(sk, SOCK_QUEUE_SHRUNK);
+ }
/* Any change of skb->len requires recalculation of tso factor. */
if (tcp_skb_pcount(skb) > 1)
^ permalink raw reply [flat|nested] 68+ messages in thread* [PATCH 4.4 50/60] bpf, arm64: fix jit branch offset related to ldimm64
2017-05-11 14:12 [PATCH 4.4 00/60] 4.4.68-stable review Greg Kroah-Hartman
` (44 preceding siblings ...)
2017-05-11 14:13 ` [PATCH 4.4 49/60] tcp: do not underestimate skb->truesize in tcp_trim_head() Greg Kroah-Hartman
@ 2017-05-11 14:13 ` Greg Kroah-Hartman
2017-05-11 14:13 ` [PATCH 4.4 51/60] tcp: fix wraparound issue in tcp_lp Greg Kroah-Hartman
` (11 subsequent siblings)
57 siblings, 0 replies; 68+ messages in thread
From: Greg Kroah-Hartman @ 2017-05-11 14:13 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, David S. Miller, Daniel Borkmann,
Alexei Starovoitov, Xi Wang
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <daniel@iogearbox.net>
[ Upstream commit ddc665a4bb4b728b4e6ecec8db1b64efa9184b9c ]
When the instruction right before the branch destination is
a 64 bit load immediate, we currently calculate the wrong
jump offset in the ctx->offset[] array as we only account
one instruction slot for the 64 bit load immediate although
it uses two BPF instructions. Fix it up by setting the offset
into the right slot after we incremented the index.
Before (ldimm64 test 1):
[...]
00000020: 52800007 mov w7, #0x0 // #0
00000024: d2800060 mov x0, #0x3 // #3
00000028: d2800041 mov x1, #0x2 // #2
0000002c: eb01001f cmp x0, x1
00000030: 54ffff82 b.cs 0x00000020
00000034: d29fffe7 mov x7, #0xffff // #65535
00000038: f2bfffe7 movk x7, #0xffff, lsl #16
0000003c: f2dfffe7 movk x7, #0xffff, lsl #32
00000040: f2ffffe7 movk x7, #0xffff, lsl #48
00000044: d29dddc7 mov x7, #0xeeee // #61166
00000048: f2bdddc7 movk x7, #0xeeee, lsl #16
0000004c: f2ddddc7 movk x7, #0xeeee, lsl #32
00000050: f2fdddc7 movk x7, #0xeeee, lsl #48
[...]
After (ldimm64 test 1):
[...]
00000020: 52800007 mov w7, #0x0 // #0
00000024: d2800060 mov x0, #0x3 // #3
00000028: d2800041 mov x1, #0x2 // #2
0000002c: eb01001f cmp x0, x1
00000030: 540000a2 b.cs 0x00000044
00000034: d29fffe7 mov x7, #0xffff // #65535
00000038: f2bfffe7 movk x7, #0xffff, lsl #16
0000003c: f2dfffe7 movk x7, #0xffff, lsl #32
00000040: f2ffffe7 movk x7, #0xffff, lsl #48
00000044: d29dddc7 mov x7, #0xeeee // #61166
00000048: f2bdddc7 movk x7, #0xeeee, lsl #16
0000004c: f2ddddc7 movk x7, #0xeeee, lsl #32
00000050: f2fdddc7 movk x7, #0xeeee, lsl #48
[...]
Also, add a couple of test cases to make sure JITs pass
this test. Tested on Cavium ThunderX ARMv8. The added
test cases all pass after the fix.
Fixes: 8eee539ddea0 ("arm64: bpf: fix out-of-bounds read in bpf2a64_offset()")
Reported-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Cc: Xi Wang <xi.wang@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/net/bpf_jit_comp.c | 8 +++----
lib/test_bpf.c | 45 ++++++++++++++++++++++++++++++++++++++++++
2 files changed, 49 insertions(+), 4 deletions(-)
--- a/arch/arm64/net/bpf_jit_comp.c
+++ b/arch/arm64/net/bpf_jit_comp.c
@@ -728,14 +728,14 @@ static int build_body(struct jit_ctx *ct
int ret;
ret = build_insn(insn, ctx);
-
- if (ctx->image == NULL)
- ctx->offset[i] = ctx->idx;
-
if (ret > 0) {
i++;
+ if (ctx->image == NULL)
+ ctx->offset[i] = ctx->idx;
continue;
}
+ if (ctx->image == NULL)
+ ctx->offset[i] = ctx->idx;
if (ret)
return ret;
}
--- a/lib/test_bpf.c
+++ b/lib/test_bpf.c
@@ -4315,6 +4315,51 @@ static struct bpf_test tests[] = {
{ },
{ { 0, 1 } },
},
+ {
+ /* Mainly testing JIT + imm64 here. */
+ "JMP_JGE_X: ldimm64 test 1",
+ .u.insns_int = {
+ BPF_ALU32_IMM(BPF_MOV, R0, 0),
+ BPF_LD_IMM64(R1, 3),
+ BPF_LD_IMM64(R2, 2),
+ BPF_JMP_REG(BPF_JGE, R1, R2, 2),
+ BPF_LD_IMM64(R0, 0xffffffffffffffffUL),
+ BPF_LD_IMM64(R0, 0xeeeeeeeeeeeeeeeeUL),
+ BPF_EXIT_INSN(),
+ },
+ INTERNAL,
+ { },
+ { { 0, 0xeeeeeeeeU } },
+ },
+ {
+ "JMP_JGE_X: ldimm64 test 2",
+ .u.insns_int = {
+ BPF_ALU32_IMM(BPF_MOV, R0, 0),
+ BPF_LD_IMM64(R1, 3),
+ BPF_LD_IMM64(R2, 2),
+ BPF_JMP_REG(BPF_JGE, R1, R2, 0),
+ BPF_LD_IMM64(R0, 0xffffffffffffffffUL),
+ BPF_EXIT_INSN(),
+ },
+ INTERNAL,
+ { },
+ { { 0, 0xffffffffU } },
+ },
+ {
+ "JMP_JGE_X: ldimm64 test 3",
+ .u.insns_int = {
+ BPF_ALU32_IMM(BPF_MOV, R0, 1),
+ BPF_LD_IMM64(R1, 3),
+ BPF_LD_IMM64(R2, 2),
+ BPF_JMP_REG(BPF_JGE, R1, R2, 4),
+ BPF_LD_IMM64(R0, 0xffffffffffffffffUL),
+ BPF_LD_IMM64(R0, 0xeeeeeeeeeeeeeeeeUL),
+ BPF_EXIT_INSN(),
+ },
+ INTERNAL,
+ { },
+ { { 0, 1 } },
+ },
/* BPF_JMP | BPF_JNE | BPF_X */
{
"JMP_JNE_X: if (3 != 2) return 1",
^ permalink raw reply [flat|nested] 68+ messages in thread* [PATCH 4.4 51/60] tcp: fix wraparound issue in tcp_lp
2017-05-11 14:12 [PATCH 4.4 00/60] 4.4.68-stable review Greg Kroah-Hartman
` (45 preceding siblings ...)
2017-05-11 14:13 ` [PATCH 4.4 50/60] bpf, arm64: fix jit branch offset related to ldimm64 Greg Kroah-Hartman
@ 2017-05-11 14:13 ` Greg Kroah-Hartman
2017-05-11 14:13 ` [PATCH 4.4 52/60] tcp: do not inherit fastopen_req from parent Greg Kroah-Hartman
` (10 subsequent siblings)
57 siblings, 0 replies; 68+ messages in thread
From: Greg Kroah-Hartman @ 2017-05-11 14:13 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Eric Dumazet, David S. Miller
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit a9f11f963a546fea9144f6a6d1a307e814a387e7 ]
Be careful when comparing tcp_time_stamp to some u32 quantity,
otherwise result can be surprising.
Fixes: 7c106d7e782b ("[TCP]: TCP Low Priority congestion control")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/tcp_lp.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/net/ipv4/tcp_lp.c
+++ b/net/ipv4/tcp_lp.c
@@ -264,13 +264,15 @@ static void tcp_lp_pkts_acked(struct soc
{
struct tcp_sock *tp = tcp_sk(sk);
struct lp *lp = inet_csk_ca(sk);
+ u32 delta;
if (rtt_us > 0)
tcp_lp_rtt_sample(sk, rtt_us);
/* calc inference */
- if (tcp_time_stamp > tp->rx_opt.rcv_tsecr)
- lp->inference = 3 * (tcp_time_stamp - tp->rx_opt.rcv_tsecr);
+ delta = tcp_time_stamp - tp->rx_opt.rcv_tsecr;
+ if ((s32)delta > 0)
+ lp->inference = 3 * delta;
/* test if within inference */
if (lp->last_drop && (tcp_time_stamp - lp->last_drop < lp->inference))
^ permalink raw reply [flat|nested] 68+ messages in thread* [PATCH 4.4 52/60] tcp: do not inherit fastopen_req from parent
2017-05-11 14:12 [PATCH 4.4 00/60] 4.4.68-stable review Greg Kroah-Hartman
` (46 preceding siblings ...)
2017-05-11 14:13 ` [PATCH 4.4 51/60] tcp: fix wraparound issue in tcp_lp Greg Kroah-Hartman
@ 2017-05-11 14:13 ` Greg Kroah-Hartman
2017-05-11 14:13 ` [PATCH 4.4 53/60] ipv4, ipv6: ensure raw socket message is big enough to hold an IP header Greg Kroah-Hartman
` (9 subsequent siblings)
57 siblings, 0 replies; 68+ messages in thread
From: Greg Kroah-Hartman @ 2017-05-11 14:13 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Eric Dumazet, Andrey Konovalov,
Wei Wang, David S. Miller
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 8b485ce69876c65db12ed390e7f9c0d2a64eff2c ]
Under fuzzer stress, it is possible that a child gets a non NULL
fastopen_req pointer from its parent at accept() time, when/if parent
morphs from listener to active session.
We need to make sure this can not happen, by clearing the field after
socket cloning.
BUG: Double free or freeing an invalid pointer
Unexpected shadow byte: 0xFB
CPU: 3 PID: 20933 Comm: syz-executor3 Not tainted 4.11.0+ #306
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs
01/01/2011
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:16 [inline]
dump_stack+0x292/0x395 lib/dump_stack.c:52
kasan_object_err+0x1c/0x70 mm/kasan/report.c:164
kasan_report_double_free+0x5c/0x70 mm/kasan/report.c:185
kasan_slab_free+0x9d/0xc0 mm/kasan/kasan.c:580
slab_free_hook mm/slub.c:1357 [inline]
slab_free_freelist_hook mm/slub.c:1379 [inline]
slab_free mm/slub.c:2961 [inline]
kfree+0xe8/0x2b0 mm/slub.c:3882
tcp_free_fastopen_req net/ipv4/tcp.c:1077 [inline]
tcp_disconnect+0xc15/0x13e0 net/ipv4/tcp.c:2328
inet_child_forget+0xb8/0x600 net/ipv4/inet_connection_sock.c:898
inet_csk_reqsk_queue_add+0x1e7/0x250
net/ipv4/inet_connection_sock.c:928
tcp_get_cookie_sock+0x21a/0x510 net/ipv4/syncookies.c:217
cookie_v4_check+0x1a19/0x28b0 net/ipv4/syncookies.c:384
tcp_v4_cookie_check net/ipv4/tcp_ipv4.c:1384 [inline]
tcp_v4_do_rcv+0x731/0x940 net/ipv4/tcp_ipv4.c:1421
tcp_v4_rcv+0x2dc0/0x31c0 net/ipv4/tcp_ipv4.c:1715
ip_local_deliver_finish+0x4cc/0xc20 net/ipv4/ip_input.c:216
NF_HOOK include/linux/netfilter.h:257 [inline]
ip_local_deliver+0x1ce/0x700 net/ipv4/ip_input.c:257
dst_input include/net/dst.h:492 [inline]
ip_rcv_finish+0xb1d/0x20b0 net/ipv4/ip_input.c:396
NF_HOOK include/linux/netfilter.h:257 [inline]
ip_rcv+0xd8c/0x19c0 net/ipv4/ip_input.c:487
__netif_receive_skb_core+0x1ad1/0x3400 net/core/dev.c:4210
__netif_receive_skb+0x2a/0x1a0 net/core/dev.c:4248
process_backlog+0xe5/0x6c0 net/core/dev.c:4868
napi_poll net/core/dev.c:5270 [inline]
net_rx_action+0xe70/0x18e0 net/core/dev.c:5335
__do_softirq+0x2fb/0xb99 kernel/softirq.c:284
do_softirq_own_stack+0x1c/0x30 arch/x86/entry/entry_64.S:899
</IRQ>
do_softirq.part.17+0x1e8/0x230 kernel/softirq.c:328
do_softirq kernel/softirq.c:176 [inline]
__local_bh_enable_ip+0x1cf/0x1e0 kernel/softirq.c:181
local_bh_enable include/linux/bottom_half.h:31 [inline]
rcu_read_unlock_bh include/linux/rcupdate.h:931 [inline]
ip_finish_output2+0x9ab/0x15e0 net/ipv4/ip_output.c:230
ip_finish_output+0xa35/0xdf0 net/ipv4/ip_output.c:316
NF_HOOK_COND include/linux/netfilter.h:246 [inline]
ip_output+0x1f6/0x7b0 net/ipv4/ip_output.c:404
dst_output include/net/dst.h:486 [inline]
ip_local_out+0x95/0x160 net/ipv4/ip_output.c:124
ip_queue_xmit+0x9a8/0x1a10 net/ipv4/ip_output.c:503
tcp_transmit_skb+0x1ade/0x3470 net/ipv4/tcp_output.c:1057
tcp_write_xmit+0x79e/0x55b0 net/ipv4/tcp_output.c:2265
__tcp_push_pending_frames+0xfa/0x3a0 net/ipv4/tcp_output.c:2450
tcp_push+0x4ee/0x780 net/ipv4/tcp.c:683
tcp_sendmsg+0x128d/0x39b0 net/ipv4/tcp.c:1342
inet_sendmsg+0x164/0x5b0 net/ipv4/af_inet.c:762
sock_sendmsg_nosec net/socket.c:633 [inline]
sock_sendmsg+0xca/0x110 net/socket.c:643
SYSC_sendto+0x660/0x810 net/socket.c:1696
SyS_sendto+0x40/0x50 net/socket.c:1664
entry_SYSCALL_64_fastpath+0x1f/0xbe
RIP: 0033:0x446059
RSP: 002b:00007faa6761fb58 EFLAGS: 00000282 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 0000000000000017 RCX: 0000000000446059
RDX: 0000000000000001 RSI: 0000000020ba3fcd RDI: 0000000000000017
RBP: 00000000006e40a0 R08: 0000000020ba4ff0 R09: 0000000000000010
R10: 0000000020000000 R11: 0000000000000282 R12: 0000000000708150
R13: 0000000000000000 R14: 00007faa676209c0 R15: 00007faa67620700
Object at ffff88003b5bbcb8, in cache kmalloc-64 size: 64
Allocated:
PID = 20909
save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59
save_stack+0x43/0xd0 mm/kasan/kasan.c:513
set_track mm/kasan/kasan.c:525 [inline]
kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:616
kmem_cache_alloc_trace+0x82/0x270 mm/slub.c:2745
kmalloc include/linux/slab.h:490 [inline]
kzalloc include/linux/slab.h:663 [inline]
tcp_sendmsg_fastopen net/ipv4/tcp.c:1094 [inline]
tcp_sendmsg+0x221a/0x39b0 net/ipv4/tcp.c:1139
inet_sendmsg+0x164/0x5b0 net/ipv4/af_inet.c:762
sock_sendmsg_nosec net/socket.c:633 [inline]
sock_sendmsg+0xca/0x110 net/socket.c:643
SYSC_sendto+0x660/0x810 net/socket.c:1696
SyS_sendto+0x40/0x50 net/socket.c:1664
entry_SYSCALL_64_fastpath+0x1f/0xbe
Freed:
PID = 20909
save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59
save_stack+0x43/0xd0 mm/kasan/kasan.c:513
set_track mm/kasan/kasan.c:525 [inline]
kasan_slab_free+0x73/0xc0 mm/kasan/kasan.c:589
slab_free_hook mm/slub.c:1357 [inline]
slab_free_freelist_hook mm/slub.c:1379 [inline]
slab_free mm/slub.c:2961 [inline]
kfree+0xe8/0x2b0 mm/slub.c:3882
tcp_free_fastopen_req net/ipv4/tcp.c:1077 [inline]
tcp_disconnect+0xc15/0x13e0 net/ipv4/tcp.c:2328
__inet_stream_connect+0x20c/0xf90 net/ipv4/af_inet.c:593
tcp_sendmsg_fastopen net/ipv4/tcp.c:1111 [inline]
tcp_sendmsg+0x23a8/0x39b0 net/ipv4/tcp.c:1139
inet_sendmsg+0x164/0x5b0 net/ipv4/af_inet.c:762
sock_sendmsg_nosec net/socket.c:633 [inline]
sock_sendmsg+0xca/0x110 net/socket.c:643
SYSC_sendto+0x660/0x810 net/socket.c:1696
SyS_sendto+0x40/0x50 net/socket.c:1664
entry_SYSCALL_64_fastpath+0x1f/0xbe
Fixes: e994b2f0fb92 ("tcp: do not lock listener to process SYN packets")
Fixes: 7db92362d2fe ("tcp: fix potential double free issue for fastopen_req")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Acked-by: Wei Wang <weiwan@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/tcp_minisocks.c | 1 +
1 file changed, 1 insertion(+)
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -547,6 +547,7 @@ struct sock *tcp_create_openreq_child(co
newicsk->icsk_ack.last_seg_size = skb->len - newtp->tcp_header_len;
newtp->rx_opt.mss_clamp = req->mss;
tcp_ecn_openreq_child(newtp, req);
+ newtp->fastopen_req = NULL;
newtp->fastopen_rsk = NULL;
newtp->syn_data_acked = 0;
newtp->rack.mstamp.v64 = 0;
^ permalink raw reply [flat|nested] 68+ messages in thread* [PATCH 4.4 53/60] ipv4, ipv6: ensure raw socket message is big enough to hold an IP header
2017-05-11 14:12 [PATCH 4.4 00/60] 4.4.68-stable review Greg Kroah-Hartman
` (47 preceding siblings ...)
2017-05-11 14:13 ` [PATCH 4.4 52/60] tcp: do not inherit fastopen_req from parent Greg Kroah-Hartman
@ 2017-05-11 14:13 ` Greg Kroah-Hartman
2017-05-11 14:13 ` [PATCH 4.4 54/60] rtnetlink: NUL-terminate IFLA_PHYS_PORT_NAME string Greg Kroah-Hartman
` (8 subsequent siblings)
57 siblings, 0 replies; 68+ messages in thread
From: Greg Kroah-Hartman @ 2017-05-11 14:13 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alexander Potapenko, David S. Miller
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Potapenko <glider@google.com>
[ Upstream commit 86f4c90a1c5c1493f07f2d12c1079f5bf01936f2 ]
raw_send_hdrinc() and rawv6_send_hdrinc() expect that the buffer copied
from the userspace contains the IPv4/IPv6 header, so if too few bytes are
copied, parts of the header may remain uninitialized.
This bug has been detected with KMSAN.
For the record, the KMSAN report:
==================================================================
BUG: KMSAN: use of unitialized memory in nf_ct_frag6_gather+0xf5a/0x44a0
inter: 0
CPU: 0 PID: 1036 Comm: probe Not tainted 4.11.0-rc5+ #2455
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:16
dump_stack+0x143/0x1b0 lib/dump_stack.c:52
kmsan_report+0x16b/0x1e0 mm/kmsan/kmsan.c:1078
__kmsan_warning_32+0x5c/0xa0 mm/kmsan/kmsan_instr.c:510
nf_ct_frag6_gather+0xf5a/0x44a0 net/ipv6/netfilter/nf_conntrack_reasm.c:577
ipv6_defrag+0x1d9/0x280 net/ipv6/netfilter/nf_defrag_ipv6_hooks.c:68
nf_hook_entry_hookfn ./include/linux/netfilter.h:102
nf_hook_slow+0x13f/0x3c0 net/netfilter/core.c:310
nf_hook ./include/linux/netfilter.h:212
NF_HOOK ./include/linux/netfilter.h:255
rawv6_send_hdrinc net/ipv6/raw.c:673
rawv6_sendmsg+0x2fcb/0x41a0 net/ipv6/raw.c:919
inet_sendmsg+0x3f8/0x6d0 net/ipv4/af_inet.c:762
sock_sendmsg_nosec net/socket.c:633
sock_sendmsg net/socket.c:643
SYSC_sendto+0x6a5/0x7c0 net/socket.c:1696
SyS_sendto+0xbc/0xe0 net/socket.c:1664
do_syscall_64+0x72/0xa0 arch/x86/entry/common.c:285
entry_SYSCALL64_slow_path+0x25/0x25 arch/x86/entry/entry_64.S:246
RIP: 0033:0x436e03
RSP: 002b:00007ffce48baf38 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00000000004002b0 RCX: 0000000000436e03
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003
RBP: 00007ffce48baf90 R08: 00007ffce48baf50 R09: 000000000000001c
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000401790 R14: 0000000000401820 R15: 0000000000000000
origin: 00000000d9400053
save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59
kmsan_save_stack_with_flags mm/kmsan/kmsan.c:362
kmsan_internal_poison_shadow+0xb1/0x1a0 mm/kmsan/kmsan.c:257
kmsan_poison_shadow+0x6d/0xc0 mm/kmsan/kmsan.c:270
slab_alloc_node mm/slub.c:2735
__kmalloc_node_track_caller+0x1f4/0x390 mm/slub.c:4341
__kmalloc_reserve net/core/skbuff.c:138
__alloc_skb+0x2cd/0x740 net/core/skbuff.c:231
alloc_skb ./include/linux/skbuff.h:933
alloc_skb_with_frags+0x209/0xbc0 net/core/skbuff.c:4678
sock_alloc_send_pskb+0x9ff/0xe00 net/core/sock.c:1903
sock_alloc_send_skb+0xe4/0x100 net/core/sock.c:1920
rawv6_send_hdrinc net/ipv6/raw.c:638
rawv6_sendmsg+0x2918/0x41a0 net/ipv6/raw.c:919
inet_sendmsg+0x3f8/0x6d0 net/ipv4/af_inet.c:762
sock_sendmsg_nosec net/socket.c:633
sock_sendmsg net/socket.c:643
SYSC_sendto+0x6a5/0x7c0 net/socket.c:1696
SyS_sendto+0xbc/0xe0 net/socket.c:1664
do_syscall_64+0x72/0xa0 arch/x86/entry/common.c:285
return_from_SYSCALL_64+0x0/0x6a arch/x86/entry/entry_64.S:246
==================================================================
, triggered by the following syscalls:
socket(PF_INET6, SOCK_RAW, IPPROTO_RAW) = 3
sendto(3, NULL, 0, 0, {sa_family=AF_INET6, sin6_port=htons(0), inet_pton(AF_INET6, "ff00::", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0}, 28) = -1 EPERM
A similar report is triggered in net/ipv4/raw.c if we use a PF_INET socket
instead of a PF_INET6 one.
Signed-off-by: Alexander Potapenko <glider@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/raw.c | 3 +++
net/ipv6/raw.c | 2 ++
2 files changed, 5 insertions(+)
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -354,6 +354,9 @@ static int raw_send_hdrinc(struct sock *
rt->dst.dev->mtu);
return -EMSGSIZE;
}
+ if (length < sizeof(struct iphdr))
+ return -EINVAL;
+
if (flags&MSG_PROBE)
goto out;
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -630,6 +630,8 @@ static int rawv6_send_hdrinc(struct sock
ipv6_local_error(sk, EMSGSIZE, fl6, rt->dst.dev->mtu);
return -EMSGSIZE;
}
+ if (length < sizeof(struct ipv6hdr))
+ return -EINVAL;
if (flags&MSG_PROBE)
goto out;
^ permalink raw reply [flat|nested] 68+ messages in thread* [PATCH 4.4 54/60] rtnetlink: NUL-terminate IFLA_PHYS_PORT_NAME string
2017-05-11 14:12 [PATCH 4.4 00/60] 4.4.68-stable review Greg Kroah-Hartman
` (48 preceding siblings ...)
2017-05-11 14:13 ` [PATCH 4.4 53/60] ipv4, ipv6: ensure raw socket message is big enough to hold an IP header Greg Kroah-Hartman
@ 2017-05-11 14:13 ` Greg Kroah-Hartman
2017-05-11 14:13 ` [PATCH 4.4 55/60] ipv6: initialize route null entry in addrconf_init() Greg Kroah-Hartman
` (7 subsequent siblings)
57 siblings, 0 replies; 68+ messages in thread
From: Greg Kroah-Hartman @ 2017-05-11 14:13 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Michal Schmidt, David S. Miller
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Schmidt <mschmidt@redhat.com>
[ Upstream commit 77ef033b687c3e030017c94a29bf6ea3aaaef678 ]
IFLA_PHYS_PORT_NAME is a string attribute, so terminate it with \0.
Otherwise libnl3 fails to validate netlink messages with this attribute.
"ip -detail a" assumes too that the attribute is NUL-terminated when
printing it. It often was, due to padding.
I noticed this as libvirtd failing to start on a system with sfc driver
after upgrading it to Linux 4.11, i.e. when sfc added support for
phys_port_name.
Signed-off-by: Michal Schmidt <mschmidt@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/core/rtnetlink.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1018,7 +1018,7 @@ static int rtnl_phys_port_name_fill(stru
return err;
}
- if (nla_put(skb, IFLA_PHYS_PORT_NAME, strlen(name), name))
+ if (nla_put_string(skb, IFLA_PHYS_PORT_NAME, name))
return -EMSGSIZE;
return 0;
^ permalink raw reply [flat|nested] 68+ messages in thread* [PATCH 4.4 55/60] ipv6: initialize route null entry in addrconf_init()
2017-05-11 14:12 [PATCH 4.4 00/60] 4.4.68-stable review Greg Kroah-Hartman
` (49 preceding siblings ...)
2017-05-11 14:13 ` [PATCH 4.4 54/60] rtnetlink: NUL-terminate IFLA_PHYS_PORT_NAME string Greg Kroah-Hartman
@ 2017-05-11 14:13 ` Greg Kroah-Hartman
2017-05-11 14:13 ` [PATCH 4.4 56/60] ipv6: reorder ip6_route_dev_notifier after ipv6_dev_notf Greg Kroah-Hartman
` (6 subsequent siblings)
57 siblings, 0 replies; 68+ messages in thread
From: Greg Kroah-Hartman @ 2017-05-11 14:13 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andrey Konovalov, Cong Wang, David S. Miller
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: WANG Cong <xiyou.wangcong@gmail.com>
[ Upstream commit 2f460933f58eee3393aba64f0f6d14acb08d1724 ]
Andrey reported a crash on init_net.ipv6.ip6_null_entry->rt6i_idev
since it is always NULL.
This is clearly wrong, we have code to initialize it to loopback_dev,
unfortunately the order is still not correct.
loopback_dev is registered very early during boot, we lose a chance
to re-initialize it in notifier. addrconf_init() is called after
ip6_route_init(), which means we have no chance to correct it.
Fix it by moving this initialization explicitly after
ipv6_add_dev(init_net.loopback_dev) in addrconf_init().
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/net/ip6_route.h | 1 +
net/ipv6/addrconf.c | 2 ++
net/ipv6/route.c | 26 +++++++++++++++-----------
3 files changed, 18 insertions(+), 11 deletions(-)
--- a/include/net/ip6_route.h
+++ b/include/net/ip6_route.h
@@ -77,6 +77,7 @@ static inline struct dst_entry *ip6_rout
struct dst_entry *ip6_route_lookup(struct net *net, struct flowi6 *fl6,
int flags);
+void ip6_route_init_special_entries(void);
int ip6_route_init(void);
void ip6_route_cleanup(void);
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -5940,6 +5940,8 @@ int __init addrconf_init(void)
goto errlo;
}
+ ip6_route_init_special_entries();
+
for (i = 0; i < IN6_ADDR_HSIZE; i++)
INIT_HLIST_HEAD(&inet6_addr_lst[i]);
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -3681,6 +3681,21 @@ static struct notifier_block ip6_route_d
.priority = 0,
};
+void __init ip6_route_init_special_entries(void)
+{
+ /* Registering of the loopback is done before this portion of code,
+ * the loopback reference in rt6_info will not be taken, do it
+ * manually for init_net */
+ init_net.ipv6.ip6_null_entry->dst.dev = init_net.loopback_dev;
+ init_net.ipv6.ip6_null_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
+ #ifdef CONFIG_IPV6_MULTIPLE_TABLES
+ init_net.ipv6.ip6_prohibit_entry->dst.dev = init_net.loopback_dev;
+ init_net.ipv6.ip6_prohibit_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
+ init_net.ipv6.ip6_blk_hole_entry->dst.dev = init_net.loopback_dev;
+ init_net.ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
+ #endif
+}
+
int __init ip6_route_init(void)
{
int ret;
@@ -3707,17 +3722,6 @@ int __init ip6_route_init(void)
ip6_dst_blackhole_ops.kmem_cachep = ip6_dst_ops_template.kmem_cachep;
- /* Registering of the loopback is done before this portion of code,
- * the loopback reference in rt6_info will not be taken, do it
- * manually for init_net */
- init_net.ipv6.ip6_null_entry->dst.dev = init_net.loopback_dev;
- init_net.ipv6.ip6_null_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
- #ifdef CONFIG_IPV6_MULTIPLE_TABLES
- init_net.ipv6.ip6_prohibit_entry->dst.dev = init_net.loopback_dev;
- init_net.ipv6.ip6_prohibit_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
- init_net.ipv6.ip6_blk_hole_entry->dst.dev = init_net.loopback_dev;
- init_net.ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
- #endif
ret = fib6_init();
if (ret)
goto out_register_subsys;
^ permalink raw reply [flat|nested] 68+ messages in thread* [PATCH 4.4 56/60] ipv6: reorder ip6_route_dev_notifier after ipv6_dev_notf
2017-05-11 14:12 [PATCH 4.4 00/60] 4.4.68-stable review Greg Kroah-Hartman
` (50 preceding siblings ...)
2017-05-11 14:13 ` [PATCH 4.4 55/60] ipv6: initialize route null entry in addrconf_init() Greg Kroah-Hartman
@ 2017-05-11 14:13 ` Greg Kroah-Hartman
2017-05-11 14:13 ` [PATCH 4.4 57/60] bnxt_en: allocate enough space for ->ntp_fltr_bmap Greg Kroah-Hartman
` (5 subsequent siblings)
57 siblings, 0 replies; 68+ messages in thread
From: Greg Kroah-Hartman @ 2017-05-11 14:13 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, David Ahern, Cong Wang, David S. Miller
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: WANG Cong <xiyou.wangcong@gmail.com>
[ Upstream commit 242d3a49a2a1a71d8eb9f953db1bcaa9d698ce00 ]
For each netns (except init_net), we initialize its null entry
in 3 places:
1) The template itself, as we use kmemdup()
2) Code around dst_init_metrics() in ip6_route_net_init()
3) ip6_route_dev_notify(), which is supposed to initialize it after
loopback registers
Unfortunately the last one still happens in a wrong order because
we expect to initialize net->ipv6.ip6_null_entry->rt6i_idev to
net->loopback_dev's idev, thus we have to do that after we add
idev to loopback. However, this notifier has priority == 0 same as
ipv6_dev_notf, and ipv6_dev_notf is registered after
ip6_route_dev_notifier so it is called actually after
ip6_route_dev_notifier. This is similar to commit 2f460933f58e
("ipv6: initialize route null entry in addrconf_init()") which
fixes init_net.
Fix it by picking a smaller priority for ip6_route_dev_notifier.
Also, we have to release the refcnt accordingly when unregistering
loopback_dev because device exit functions are called before subsys
exit functions.
Acked-by: David Ahern <dsahern@gmail.com>
Tested-by: David Ahern <dsahern@gmail.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/net/addrconf.h | 2 ++
net/ipv6/addrconf.c | 1 +
net/ipv6/route.c | 13 +++++++++++--
3 files changed, 14 insertions(+), 2 deletions(-)
--- a/include/net/addrconf.h
+++ b/include/net/addrconf.h
@@ -19,6 +19,8 @@
#define ADDRCONF_TIMER_FUZZ (HZ / 4)
#define ADDRCONF_TIMER_FUZZ_MAX (HZ)
+#define ADDRCONF_NOTIFY_PRIORITY 0
+
#include <linux/in.h>
#include <linux/in6.h>
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -3306,6 +3306,7 @@ static int addrconf_notify(struct notifi
*/
static struct notifier_block ipv6_dev_notf = {
.notifier_call = addrconf_notify,
+ .priority = ADDRCONF_NOTIFY_PRIORITY,
};
static void addrconf_type_change(struct net_device *dev, unsigned long event)
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -3363,7 +3363,10 @@ static int ip6_route_dev_notify(struct n
struct net_device *dev = netdev_notifier_info_to_dev(ptr);
struct net *net = dev_net(dev);
- if (event == NETDEV_REGISTER && (dev->flags & IFF_LOOPBACK)) {
+ if (!(dev->flags & IFF_LOOPBACK))
+ return NOTIFY_OK;
+
+ if (event == NETDEV_REGISTER) {
net->ipv6.ip6_null_entry->dst.dev = dev;
net->ipv6.ip6_null_entry->rt6i_idev = in6_dev_get(dev);
#ifdef CONFIG_IPV6_MULTIPLE_TABLES
@@ -3372,6 +3375,12 @@ static int ip6_route_dev_notify(struct n
net->ipv6.ip6_blk_hole_entry->dst.dev = dev;
net->ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(dev);
#endif
+ } else if (event == NETDEV_UNREGISTER) {
+ in6_dev_put(net->ipv6.ip6_null_entry->rt6i_idev);
+#ifdef CONFIG_IPV6_MULTIPLE_TABLES
+ in6_dev_put(net->ipv6.ip6_prohibit_entry->rt6i_idev);
+ in6_dev_put(net->ipv6.ip6_blk_hole_entry->rt6i_idev);
+#endif
}
return NOTIFY_OK;
@@ -3678,7 +3687,7 @@ static struct pernet_operations ip6_rout
static struct notifier_block ip6_route_dev_notifier = {
.notifier_call = ip6_route_dev_notify,
- .priority = 0,
+ .priority = ADDRCONF_NOTIFY_PRIORITY - 10,
};
void __init ip6_route_init_special_entries(void)
^ permalink raw reply [flat|nested] 68+ messages in thread* [PATCH 4.4 57/60] bnxt_en: allocate enough space for ->ntp_fltr_bmap
2017-05-11 14:12 [PATCH 4.4 00/60] 4.4.68-stable review Greg Kroah-Hartman
` (51 preceding siblings ...)
2017-05-11 14:13 ` [PATCH 4.4 56/60] ipv6: reorder ip6_route_dev_notifier after ipv6_dev_notf Greg Kroah-Hartman
@ 2017-05-11 14:13 ` Greg Kroah-Hartman
2017-05-11 14:13 ` [PATCH 4.4 58/60] f2fs: sanity check segment count Greg Kroah-Hartman
` (4 subsequent siblings)
57 siblings, 0 replies; 68+ messages in thread
From: Greg Kroah-Hartman @ 2017-05-11 14:13 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Michael Chan, David S. Miller
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
[ Upstream commit ac45bd93a5035c2f39c9862b8b6ed692db0fdc87 ]
We have the number of longs, but we need to calculate the number of
bytes required.
Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Michael Chan <michael.chan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/broadcom/bnxt/bnxt.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -2473,7 +2473,8 @@ static int bnxt_alloc_ntp_fltrs(struct b
INIT_HLIST_HEAD(&bp->ntp_fltr_hash_tbl[i]);
bp->ntp_fltr_count = 0;
- bp->ntp_fltr_bmap = kzalloc(BITS_TO_LONGS(BNXT_NTP_FLTR_MAX_FLTR),
+ bp->ntp_fltr_bmap = kcalloc(BITS_TO_LONGS(BNXT_NTP_FLTR_MAX_FLTR),
+ sizeof(long),
GFP_KERNEL);
if (!bp->ntp_fltr_bmap)
^ permalink raw reply [flat|nested] 68+ messages in thread* [PATCH 4.4 58/60] f2fs: sanity check segment count
2017-05-11 14:12 [PATCH 4.4 00/60] 4.4.68-stable review Greg Kroah-Hartman
` (52 preceding siblings ...)
2017-05-11 14:13 ` [PATCH 4.4 57/60] bnxt_en: allocate enough space for ->ntp_fltr_bmap Greg Kroah-Hartman
@ 2017-05-11 14:13 ` Greg Kroah-Hartman
2017-05-11 14:13 ` [PATCH 4.4 60/60] block: get rid of blk_integrity_revalidate() Greg Kroah-Hartman
` (3 subsequent siblings)
57 siblings, 0 replies; 68+ messages in thread
From: Greg Kroah-Hartman @ 2017-05-11 14:13 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jin Qian, Jaegeuk Kim
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jin Qian <jinqian@google.com>
commit b9dd46188edc2f0d1f37328637860bb65a771124 upstream.
F2FS uses 4 bytes to represent block address. As a result, supported
size of disk is 16 TB and it equals to 16 * 1024 * 1024 / 2 segments.
Signed-off-by: Jin Qian <jinqian@google.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/f2fs/super.c | 7 +++++++
include/linux/f2fs_fs.h | 6 ++++++
2 files changed, 13 insertions(+)
--- a/fs/f2fs/super.c
+++ b/fs/f2fs/super.c
@@ -1059,6 +1059,13 @@ static int sanity_check_raw_super(struct
return 1;
}
+ if (le32_to_cpu(raw_super->segment_count) > F2FS_MAX_SEGMENT) {
+ f2fs_msg(sb, KERN_INFO,
+ "Invalid segment count (%u)",
+ le32_to_cpu(raw_super->segment_count));
+ return 1;
+ }
+
/* check CP/SIT/NAT/SSA/MAIN_AREA area boundary */
if (sanity_check_area_boundary(sb, raw_super))
return 1;
--- a/include/linux/f2fs_fs.h
+++ b/include/linux/f2fs_fs.h
@@ -284,6 +284,12 @@ struct f2fs_nat_block {
#define SIT_ENTRY_PER_BLOCK (PAGE_CACHE_SIZE / sizeof(struct f2fs_sit_entry))
/*
+ * F2FS uses 4 bytes to represent block address. As a result, supported size of
+ * disk is 16 TB and it equals to 16 * 1024 * 1024 / 2 segments.
+ */
+#define F2FS_MAX_SEGMENT ((16 * 1024 * 1024) / 2)
+
+/*
* Note that f2fs_sit_entry->vblocks has the following bit-field information.
* [15:10] : allocation type such as CURSEG_XXXX_TYPE
* [9:0] : valid block count
^ permalink raw reply [flat|nested] 68+ messages in thread* [PATCH 4.4 60/60] block: get rid of blk_integrity_revalidate()
2017-05-11 14:12 [PATCH 4.4 00/60] 4.4.68-stable review Greg Kroah-Hartman
` (53 preceding siblings ...)
2017-05-11 14:13 ` [PATCH 4.4 58/60] f2fs: sanity check segment count Greg Kroah-Hartman
@ 2017-05-11 14:13 ` Greg Kroah-Hartman
2017-05-11 21:03 ` [PATCH 4.4 00/60] 4.4.68-stable review Guenter Roeck
` (2 subsequent siblings)
57 siblings, 0 replies; 68+ messages in thread
From: Greg Kroah-Hartman @ 2017-05-11 14:13 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Martin K. Petersen,
Christoph Hellwig, Mike Snitzer, Dan Williams, Ilya Dryomov,
Jens Axboe
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilya Dryomov <idryomov@gmail.com>
commit 19b7ccf8651df09d274671b53039c672a52ad84d upstream.
Commit 25520d55cdb6 ("block: Inline blk_integrity in struct gendisk")
introduced blk_integrity_revalidate(), which seems to assume ownership
of the stable pages flag and unilaterally clears it if no blk_integrity
profile is registered:
if (bi->profile)
disk->queue->backing_dev_info->capabilities |=
BDI_CAP_STABLE_WRITES;
else
disk->queue->backing_dev_info->capabilities &=
~BDI_CAP_STABLE_WRITES;
It's called from revalidate_disk() and rescan_partitions(), making it
impossible to enable stable pages for drivers that support partitions
and don't use blk_integrity: while the call in revalidate_disk() can be
trivially worked around (see zram, which doesn't support partitions and
hence gets away with zram_revalidate_disk()), rescan_partitions() can
be triggered from userspace at any time. This breaks rbd, where the
ceph messenger is responsible for generating/verifying CRCs.
Since blk_integrity_{un,}register() "must" be used for (un)registering
the integrity profile with the block layer, move BDI_CAP_STABLE_WRITES
setting there. This way drivers that call blk_integrity_register() and
use integrity infrastructure won't interfere with drivers that don't
but still want stable pages.
Fixes: 25520d55cdb6 ("block: Inline blk_integrity in struct gendisk")
Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Mike Snitzer <snitzer@redhat.com>
Tested-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
[idryomov@gmail.com: backport to < 4.11: bdi is embedded in queue]
Signed-off-by: Jens Axboe <axboe@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
block/blk-integrity.c | 19 ++-----------------
block/partition-generic.c | 1 -
fs/block_dev.c | 1 -
include/linux/genhd.h | 2 --
4 files changed, 2 insertions(+), 21 deletions(-)
--- a/block/blk-integrity.c
+++ b/block/blk-integrity.c
@@ -417,7 +417,7 @@ void blk_integrity_register(struct gendi
bi->tuple_size = template->tuple_size;
bi->tag_size = template->tag_size;
- blk_integrity_revalidate(disk);
+ disk->queue->backing_dev_info.capabilities |= BDI_CAP_STABLE_WRITES;
}
EXPORT_SYMBOL(blk_integrity_register);
@@ -430,26 +430,11 @@ EXPORT_SYMBOL(blk_integrity_register);
*/
void blk_integrity_unregister(struct gendisk *disk)
{
- blk_integrity_revalidate(disk);
+ disk->queue->backing_dev_info.capabilities &= ~BDI_CAP_STABLE_WRITES;
memset(&disk->queue->integrity, 0, sizeof(struct blk_integrity));
}
EXPORT_SYMBOL(blk_integrity_unregister);
-void blk_integrity_revalidate(struct gendisk *disk)
-{
- struct blk_integrity *bi = &disk->queue->integrity;
-
- if (!(disk->flags & GENHD_FL_UP))
- return;
-
- if (bi->profile)
- disk->queue->backing_dev_info.capabilities |=
- BDI_CAP_STABLE_WRITES;
- else
- disk->queue->backing_dev_info.capabilities &=
- ~BDI_CAP_STABLE_WRITES;
-}
-
void blk_integrity_add(struct gendisk *disk)
{
if (kobject_init_and_add(&disk->integrity_kobj, &integrity_ktype,
--- a/block/partition-generic.c
+++ b/block/partition-generic.c
@@ -435,7 +435,6 @@ rescan:
if (disk->fops->revalidate_disk)
disk->fops->revalidate_disk(disk);
- blk_integrity_revalidate(disk);
check_disk_size_change(disk, bdev);
bdev->bd_invalidated = 0;
if (!get_capacity(disk) || !(state = check_partition(disk, bdev)))
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -1098,7 +1098,6 @@ int revalidate_disk(struct gendisk *disk
if (disk->fops->revalidate_disk)
ret = disk->fops->revalidate_disk(disk);
- blk_integrity_revalidate(disk);
bdev = bdget_disk(disk, 0);
if (!bdev)
return ret;
--- a/include/linux/genhd.h
+++ b/include/linux/genhd.h
@@ -742,11 +742,9 @@ static inline void part_nr_sects_write(s
#if defined(CONFIG_BLK_DEV_INTEGRITY)
extern void blk_integrity_add(struct gendisk *);
extern void blk_integrity_del(struct gendisk *);
-extern void blk_integrity_revalidate(struct gendisk *);
#else /* CONFIG_BLK_DEV_INTEGRITY */
static inline void blk_integrity_add(struct gendisk *disk) { }
static inline void blk_integrity_del(struct gendisk *disk) { }
-static inline void blk_integrity_revalidate(struct gendisk *disk) { }
#endif /* CONFIG_BLK_DEV_INTEGRITY */
#else /* CONFIG_BLOCK */
^ permalink raw reply [flat|nested] 68+ messages in thread* Re: [PATCH 4.4 00/60] 4.4.68-stable review
2017-05-11 14:12 [PATCH 4.4 00/60] 4.4.68-stable review Greg Kroah-Hartman
` (54 preceding siblings ...)
2017-05-11 14:13 ` [PATCH 4.4 60/60] block: get rid of blk_integrity_revalidate() Greg Kroah-Hartman
@ 2017-05-11 21:03 ` Guenter Roeck
2017-05-12 15:54 ` Greg Kroah-Hartman
2017-05-12 15:26 ` Shuah Khan
2017-05-12 19:49 ` Guenter Roeck
57 siblings, 1 reply; 68+ messages in thread
From: Guenter Roeck @ 2017-05-11 21:03 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, torvalds, akpm, shuahkh, patches, ben.hutchings, stable
On Thu, May 11, 2017 at 04:12:23PM +0200, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.4.68 release.
> There are 60 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sat May 13 14:12:22 UTC 2017.
> Anything received after that time might be too late.
>
Build results:
total: 145 pass: 145 fail: 0
Qemu test results:
total: 115 pass: 115 fail: 0
Details are available at http://kerneltests.org/builders.
Guenter
^ permalink raw reply [flat|nested] 68+ messages in thread* Re: [PATCH 4.4 00/60] 4.4.68-stable review
2017-05-11 21:03 ` [PATCH 4.4 00/60] 4.4.68-stable review Guenter Roeck
@ 2017-05-12 15:54 ` Greg Kroah-Hartman
0 siblings, 0 replies; 68+ messages in thread
From: Greg Kroah-Hartman @ 2017-05-12 15:54 UTC (permalink / raw)
To: Guenter Roeck
Cc: linux-kernel, torvalds, akpm, shuahkh, patches, ben.hutchings, stable
On Thu, May 11, 2017 at 02:03:13PM -0700, Guenter Roeck wrote:
> On Thu, May 11, 2017 at 04:12:23PM +0200, Greg Kroah-Hartman wrote:
> > This is the start of the stable review cycle for the 4.4.68 release.
> > There are 60 patches in this series, all will be posted as a response
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
> >
> > Responses should be made by Sat May 13 14:12:22 UTC 2017.
> > Anything received after that time might be too late.
> >
>
> Build results:
> total: 145 pass: 145 fail: 0
> Qemu test results:
> total: 115 pass: 115 fail: 0
Thanks for testing and letting me know.
greg k-h
^ permalink raw reply [flat|nested] 68+ messages in thread
* Re: [PATCH 4.4 00/60] 4.4.68-stable review
2017-05-11 14:12 [PATCH 4.4 00/60] 4.4.68-stable review Greg Kroah-Hartman
` (55 preceding siblings ...)
2017-05-11 21:03 ` [PATCH 4.4 00/60] 4.4.68-stable review Guenter Roeck
@ 2017-05-12 15:26 ` Shuah Khan
2017-05-12 19:49 ` Guenter Roeck
57 siblings, 0 replies; 68+ messages in thread
From: Shuah Khan @ 2017-05-12 15:26 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel
Cc: torvalds, akpm, linux, patches, ben.hutchings, stable, Shuah Khan
On 05/11/2017 08:12 AM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.4.68 release.
> There are 60 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sat May 13 14:12:22 UTC 2017.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.68-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
^ permalink raw reply [flat|nested] 68+ messages in thread* Re: [PATCH 4.4 00/60] 4.4.68-stable review
2017-05-11 14:12 [PATCH 4.4 00/60] 4.4.68-stable review Greg Kroah-Hartman
` (56 preceding siblings ...)
2017-05-12 15:26 ` Shuah Khan
@ 2017-05-12 19:49 ` Guenter Roeck
57 siblings, 0 replies; 68+ messages in thread
From: Guenter Roeck @ 2017-05-12 19:49 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, torvalds, akpm, shuahkh, patches, ben.hutchings, stable
On Thu, May 11, 2017 at 04:12:23PM +0200, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.4.68 release.
> There are 60 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sat May 13 14:12:22 UTC 2017.
> Anything received after that time might be too late.
>
Build results:
total: 145 pass: 145 fail: 0
Qemu test results:
total: 115 pass: 115 fail: 0
Details are available at http://kerneltests.org/builders.
Guenter
^ permalink raw reply [flat|nested] 68+ messages in thread