* [PATCH 3.18 01/25] ext4: set h_journal if there is a failure starting a reserved handle
2018-04-30 19:23 [PATCH 3.18 00/25] 3.18.108-stable review Greg Kroah-Hartman
@ 2018-04-30 19:23 ` Greg Kroah-Hartman
2018-04-30 19:23 ` [PATCH 3.18 02/25] ext4: add validity checks for bitmap block numbers Greg Kroah-Hartman
` (27 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: Greg Kroah-Hartman @ 2018-04-30 19:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Theodore Tso, Andreas Dilger, Jan Kara
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Theodore Ts'o <tytso@mit.edu>
commit b2569260d55228b617bd82aba6d0db2faeeb4116 upstream.
If ext4 tries to start a reserved handle via
jbd2_journal_start_reserved(), and the journal has been aborted, this
can result in a NULL pointer dereference. This is because the fields
h_journal and h_transaction in the handle structure share the same
memory, via a union, so jbd2_journal_start_reserved() will clear
h_journal before calling start_this_handle(). If this function fails
due to an aborted handle, h_journal will still be NULL, and the call
to jbd2_journal_free_reserved() will pass a NULL journal to
sub_reserve_credits().
This can be reproduced by running "kvm-xfstests -c dioread_nolock
generic/475".
Cc: stable@kernel.org # 3.11
Fixes: 8f7d89f36829b ("jbd2: transaction reservation support")
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Reviewed-by: Andreas Dilger <adilger@dilger.ca>
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/jbd2/transaction.c | 1 +
1 file changed, 1 insertion(+)
--- a/fs/jbd2/transaction.c
+++ b/fs/jbd2/transaction.c
@@ -515,6 +515,7 @@ int jbd2_journal_start_reserved(handle_t
*/
ret = start_this_handle(journal, handle, GFP_NOFS);
if (ret < 0) {
+ handle->h_journal = journal;
jbd2_journal_free_reserved(handle);
return ret;
}
^ permalink raw reply [flat|nested] 32+ messages in thread* [PATCH 3.18 02/25] ext4: add validity checks for bitmap block numbers
2018-04-30 19:23 [PATCH 3.18 00/25] 3.18.108-stable review Greg Kroah-Hartman
2018-04-30 19:23 ` [PATCH 3.18 01/25] ext4: set h_journal if there is a failure starting a reserved handle Greg Kroah-Hartman
@ 2018-04-30 19:23 ` Greg Kroah-Hartman
2018-04-30 19:23 ` [PATCH 3.18 03/25] ext4: fix bitmap position validation Greg Kroah-Hartman
` (26 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: Greg Kroah-Hartman @ 2018-04-30 19:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Wen Xu, Theodore Tso, Harsh Shandilya
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Theodore Ts'o <tytso@mit.edu>
commit 7dac4a1726a9c64a517d595c40e95e2d0d135f6f upstream.
An privileged attacker can cause a crash by mounting a crafted ext4
image which triggers a out-of-bounds read in the function
ext4_valid_block_bitmap() in fs/ext4/balloc.c.
This issue has been assigned CVE-2018-1093.
Backport notes:
3.18.y is missing commit 6a797d273783 ("ext4: call out CRC and corruption errors with specific error codes")
so the EFSCORRUPTED label doesn't exist. Replaced
all instances of EFSCORRUPTED with EUCLEAN since that's
what 6a797d273783 defined it as.
BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=199181
BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1560782
Reported-by: Wen Xu <wen.xu@gatech.edu>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@vger.kernel.org
[harsh@prjkt.io: s/EFSCORRUPTED/EUCLEAN/ fs/ext4/balloc.c]
Signed-off-by: Harsh Shandilya <harsh@prjkt.io>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext4/balloc.c | 16 ++++++++++++++--
fs/ext4/ialloc.c | 8 +++++++-
2 files changed, 21 insertions(+), 3 deletions(-)
--- a/fs/ext4/balloc.c
+++ b/fs/ext4/balloc.c
@@ -338,20 +338,25 @@ static ext4_fsblk_t ext4_valid_block_bit
/* check whether block bitmap block number is set */
blk = ext4_block_bitmap(sb, desc);
offset = blk - group_first_block;
- if (!ext4_test_bit(EXT4_B2C(sbi, offset), bh->b_data))
+ if (offset < 0 || EXT4_B2C(sbi, offset) >= sb->s_blocksize ||
+ !ext4_test_bit(EXT4_B2C(sbi, offset), bh->b_data))
/* bad block bitmap */
return blk;
/* check whether the inode bitmap block number is set */
blk = ext4_inode_bitmap(sb, desc);
offset = blk - group_first_block;
- if (!ext4_test_bit(EXT4_B2C(sbi, offset), bh->b_data))
+ if (offset < 0 || EXT4_B2C(sbi, offset) >= sb->s_blocksize ||
+ !ext4_test_bit(EXT4_B2C(sbi, offset), bh->b_data))
/* bad block bitmap */
return blk;
/* check whether the inode table block number is set */
blk = ext4_inode_table(sb, desc);
offset = blk - group_first_block;
+ if (offset < 0 || EXT4_B2C(sbi, offset) >= sb->s_blocksize ||
+ EXT4_B2C(sbi, offset + sbi->s_itb_per_group) >= sb->s_blocksize)
+ return blk;
next_zero_bit = ext4_find_next_zero_bit(bh->b_data,
EXT4_B2C(sbi, offset + EXT4_SB(sb)->s_itb_per_group),
EXT4_B2C(sbi, offset));
@@ -414,6 +419,7 @@ struct buffer_head *
ext4_read_block_bitmap_nowait(struct super_block *sb, ext4_group_t block_group)
{
struct ext4_group_desc *desc;
+ struct ext4_sb_info *sbi = EXT4_SB(sb);
struct buffer_head *bh;
ext4_fsblk_t bitmap_blk;
@@ -421,6 +427,12 @@ ext4_read_block_bitmap_nowait(struct sup
if (!desc)
return NULL;
bitmap_blk = ext4_block_bitmap(sb, desc);
+ if ((bitmap_blk <= le32_to_cpu(sbi->s_es->s_first_data_block)) ||
+ (bitmap_blk >= ext4_blocks_count(sbi->s_es))) {
+ ext4_error(sb, "Invalid block bitmap block %llu in "
+ "block_group %u", bitmap_blk, block_group);
+ return ERR_PTR(-EUCLEAN);
+ }
bh = sb_getblk(sb, bitmap_blk);
if (unlikely(!bh)) {
ext4_error(sb, "Cannot get buffer for block bitmap - "
--- a/fs/ext4/ialloc.c
+++ b/fs/ext4/ialloc.c
@@ -84,16 +84,22 @@ static struct buffer_head *
ext4_read_inode_bitmap(struct super_block *sb, ext4_group_t block_group)
{
struct ext4_group_desc *desc;
+ struct ext4_sb_info *sbi = EXT4_SB(sb);
struct buffer_head *bh = NULL;
ext4_fsblk_t bitmap_blk;
struct ext4_group_info *grp;
- struct ext4_sb_info *sbi = EXT4_SB(sb);
desc = ext4_get_group_desc(sb, block_group, NULL);
if (!desc)
return NULL;
bitmap_blk = ext4_inode_bitmap(sb, desc);
+ if ((bitmap_blk <= le32_to_cpu(sbi->s_es->s_first_data_block)) ||
+ (bitmap_blk >= ext4_blocks_count(sbi->s_es))) {
+ ext4_error(sb, "Invalid inode bitmap blk %llu in "
+ "block_group %u", bitmap_blk, block_group);
+ return ERR_PTR(-EUCLEAN);
+ }
bh = sb_getblk(sb, bitmap_blk);
if (unlikely(!bh)) {
ext4_error(sb, "Cannot read inode bitmap - "
^ permalink raw reply [flat|nested] 32+ messages in thread* [PATCH 3.18 03/25] ext4: fix bitmap position validation
2018-04-30 19:23 [PATCH 3.18 00/25] 3.18.108-stable review Greg Kroah-Hartman
2018-04-30 19:23 ` [PATCH 3.18 01/25] ext4: set h_journal if there is a failure starting a reserved handle Greg Kroah-Hartman
2018-04-30 19:23 ` [PATCH 3.18 02/25] ext4: add validity checks for bitmap block numbers Greg Kroah-Hartman
@ 2018-04-30 19:23 ` Greg Kroah-Hartman
2018-04-30 19:23 ` [PATCH 3.18 04/25] usbip: usbip_host: fix to hold parent lock for device_attach() calls Greg Kroah-Hartman
` (25 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: Greg Kroah-Hartman @ 2018-04-30 19:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lukas Czerner, Theodore Tso, Ilya Dryomov
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukas Czerner <lczerner@redhat.com>
commit 22be37acce25d66ecf6403fc8f44df9c5ded2372 upstream.
Currently in ext4_valid_block_bitmap() we expect the bitmap to be
positioned anywhere between 0 and s_blocksize clusters, but that's
wrong because the bitmap can be placed anywhere in the block group. This
causes false positives when validating bitmaps on perfectly valid file
system layouts. Fix it by checking whether the bitmap is within the group
boundary.
The problem can be reproduced using the following
mkfs -t ext3 -E stride=256 /dev/vdb1
mount /dev/vdb1 /mnt/test
cd /mnt/test
wget https://cdn.kernel.org/pub/linux/kernel/v4.x/linux-4.16.3.tar.xz
tar xf linux-4.16.3.tar.xz
This will result in the warnings in the logs
EXT4-fs error (device vdb1): ext4_validate_block_bitmap:399: comm tar: bg 84: block 2774529: invalid block bitmap
[ Changed slightly for clarity and to not drop a overflow test -- TYT ]
Signed-off-by: Lukas Czerner <lczerner@redhat.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Reported-by: Ilya Dryomov <idryomov@gmail.com>
Fixes: 7dac4a1726a9 ("ext4: add validity checks for bitmap block numbers")
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext4/balloc.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
--- a/fs/ext4/balloc.c
+++ b/fs/ext4/balloc.c
@@ -321,6 +321,7 @@ static ext4_fsblk_t ext4_valid_block_bit
struct ext4_sb_info *sbi = EXT4_SB(sb);
ext4_grpblk_t offset;
ext4_grpblk_t next_zero_bit;
+ ext4_grpblk_t max_bit = EXT4_CLUSTERS_PER_GROUP(sb);
ext4_fsblk_t blk;
ext4_fsblk_t group_first_block;
@@ -338,7 +339,7 @@ static ext4_fsblk_t ext4_valid_block_bit
/* check whether block bitmap block number is set */
blk = ext4_block_bitmap(sb, desc);
offset = blk - group_first_block;
- if (offset < 0 || EXT4_B2C(sbi, offset) >= sb->s_blocksize ||
+ if (offset < 0 || EXT4_B2C(sbi, offset) >= max_bit ||
!ext4_test_bit(EXT4_B2C(sbi, offset), bh->b_data))
/* bad block bitmap */
return blk;
@@ -346,7 +347,7 @@ static ext4_fsblk_t ext4_valid_block_bit
/* check whether the inode bitmap block number is set */
blk = ext4_inode_bitmap(sb, desc);
offset = blk - group_first_block;
- if (offset < 0 || EXT4_B2C(sbi, offset) >= sb->s_blocksize ||
+ if (offset < 0 || EXT4_B2C(sbi, offset) >= max_bit ||
!ext4_test_bit(EXT4_B2C(sbi, offset), bh->b_data))
/* bad block bitmap */
return blk;
@@ -354,8 +355,8 @@ static ext4_fsblk_t ext4_valid_block_bit
/* check whether the inode table block number is set */
blk = ext4_inode_table(sb, desc);
offset = blk - group_first_block;
- if (offset < 0 || EXT4_B2C(sbi, offset) >= sb->s_blocksize ||
- EXT4_B2C(sbi, offset + sbi->s_itb_per_group) >= sb->s_blocksize)
+ if (offset < 0 || EXT4_B2C(sbi, offset) >= max_bit ||
+ EXT4_B2C(sbi, offset + sbi->s_itb_per_group) >= max_bit)
return blk;
next_zero_bit = ext4_find_next_zero_bit(bh->b_data,
EXT4_B2C(sbi, offset + EXT4_SB(sb)->s_itb_per_group),
^ permalink raw reply [flat|nested] 32+ messages in thread* [PATCH 3.18 04/25] usbip: usbip_host: fix to hold parent lock for device_attach() calls
2018-04-30 19:23 [PATCH 3.18 00/25] 3.18.108-stable review Greg Kroah-Hartman
` (2 preceding siblings ...)
2018-04-30 19:23 ` [PATCH 3.18 03/25] ext4: fix bitmap position validation Greg Kroah-Hartman
@ 2018-04-30 19:23 ` Greg Kroah-Hartman
2018-04-30 19:23 ` [PATCH 3.18 05/25] usbip: vhci_hcd: Fix usb device and sockfd leaks Greg Kroah-Hartman
` (24 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: Greg Kroah-Hartman @ 2018-04-30 19:23 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Shuah Khan
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuah Khan <shuahkh@osg.samsung.com>
commit 4bfb141bc01312a817d36627cc47c93f801c216d upstream.
usbip_host calls device_attach() without holding dev->parent lock.
Fix it.
Signed-off-by: Shuah Khan <shuahkh@osg.samsung.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/usbip/stub_main.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/usb/usbip/stub_main.c
+++ b/drivers/usb/usbip/stub_main.c
@@ -201,7 +201,12 @@ static ssize_t rebind_store(struct devic
if (!bid)
return -ENODEV;
+ /* device_attach() callers should hold parent lock for USB */
+ if (bid->udev->dev.parent)
+ device_lock(bid->udev->dev.parent);
ret = device_attach(&bid->udev->dev);
+ if (bid->udev->dev.parent)
+ device_unlock(bid->udev->dev.parent);
if (ret < 0) {
dev_err(&bid->udev->dev, "rebind failed\n");
return ret;
^ permalink raw reply [flat|nested] 32+ messages in thread* [PATCH 3.18 05/25] usbip: vhci_hcd: Fix usb device and sockfd leaks
2018-04-30 19:23 [PATCH 3.18 00/25] 3.18.108-stable review Greg Kroah-Hartman
` (3 preceding siblings ...)
2018-04-30 19:23 ` [PATCH 3.18 04/25] usbip: usbip_host: fix to hold parent lock for device_attach() calls Greg Kroah-Hartman
@ 2018-04-30 19:23 ` Greg Kroah-Hartman
2018-04-30 19:23 ` [PATCH 3.18 06/25] USB: serial: ftdi_sio: use jtag quirk for Arrow USB Blaster Greg Kroah-Hartman
` (23 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: Greg Kroah-Hartman @ 2018-04-30 19:23 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Shuah Khan
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuah Khan <shuahkh@osg.samsung.com>
commit 9020a7efe537856eb3e826ebebdf38a5d07a7857 upstream.
vhci_hcd fails to do reset to put usb device and sockfd in the
module remove/stop paths. Fix the leak.
Signed-off-by: Shuah Khan <shuahkh@osg.samsung.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/usbip/usbip_common.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/usbip/usbip_common.h
+++ b/drivers/usb/usbip/usbip_common.h
@@ -248,7 +248,7 @@ enum usbip_side {
#define SDEV_EVENT_ERROR_SUBMIT (USBIP_EH_SHUTDOWN | USBIP_EH_RESET)
#define SDEV_EVENT_ERROR_MALLOC (USBIP_EH_SHUTDOWN | USBIP_EH_UNUSABLE)
-#define VDEV_EVENT_REMOVED (USBIP_EH_SHUTDOWN | USBIP_EH_BYE)
+#define VDEV_EVENT_REMOVED (USBIP_EH_SHUTDOWN | USBIP_EH_RESET | USBIP_EH_BYE)
#define VDEV_EVENT_DOWN (USBIP_EH_SHUTDOWN | USBIP_EH_RESET)
#define VDEV_EVENT_ERROR_TCP (USBIP_EH_SHUTDOWN | USBIP_EH_RESET)
#define VDEV_EVENT_ERROR_MALLOC (USBIP_EH_SHUTDOWN | USBIP_EH_UNUSABLE)
^ permalink raw reply [flat|nested] 32+ messages in thread* [PATCH 3.18 06/25] USB: serial: ftdi_sio: use jtag quirk for Arrow USB Blaster
2018-04-30 19:23 [PATCH 3.18 00/25] 3.18.108-stable review Greg Kroah-Hartman
` (4 preceding siblings ...)
2018-04-30 19:23 ` [PATCH 3.18 05/25] usbip: vhci_hcd: Fix usb device and sockfd leaks Greg Kroah-Hartman
@ 2018-04-30 19:23 ` Greg Kroah-Hartman
2018-04-30 19:23 ` [PATCH 3.18 07/25] USB: serial: cp210x: add ID for NI USB serial console Greg Kroah-Hartman
` (22 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: Greg Kroah-Hartman @ 2018-04-30 19:23 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Vasyl Vavrychuk, Johan Hovold
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasyl Vavrychuk <vvavrychuk@gmail.com>
commit 470b5d6f0cf4674be2d1ec94e54283a1770b6a1a upstream.
Arrow USB Blaster integrated on MAX1000 board uses the same vendor ID
(0x0403) and product ID (0x6010) as the "original" FTDI device.
This patch avoids picking up by ftdi_sio of the first interface of this
USB device. After that this device can be used by Arrow user-space JTAG
driver.
Signed-off-by: Vasyl Vavrychuk <vvavrychuk@gmail.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/ftdi_sio.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -1908,7 +1908,8 @@ static int ftdi_8u2232c_probe(struct usb
return ftdi_jtag_probe(serial);
if (udev->product &&
- (!strcmp(udev->product, "BeagleBone/XDS100V2") ||
+ (!strcmp(udev->product, "Arrow USB Blaster") ||
+ !strcmp(udev->product, "BeagleBone/XDS100V2") ||
!strcmp(udev->product, "SNAP Connect E10")))
return ftdi_jtag_probe(serial);
^ permalink raw reply [flat|nested] 32+ messages in thread* [PATCH 3.18 07/25] USB: serial: cp210x: add ID for NI USB serial console
2018-04-30 19:23 [PATCH 3.18 00/25] 3.18.108-stable review Greg Kroah-Hartman
` (5 preceding siblings ...)
2018-04-30 19:23 ` [PATCH 3.18 06/25] USB: serial: ftdi_sio: use jtag quirk for Arrow USB Blaster Greg Kroah-Hartman
@ 2018-04-30 19:23 ` Greg Kroah-Hartman
2018-04-30 19:23 ` [PATCH 3.18 08/25] usb: core: Add quirk for HP v222w 16GB Mini Greg Kroah-Hartman
` (21 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: Greg Kroah-Hartman @ 2018-04-30 19:23 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Kyle Roeschley, Johan Hovold
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kyle Roeschley <kyle.roeschley@ni.com>
commit 1e23aace21515a8f7615a1de016c0ea8d4e0cc6e upstream.
Added the USB VID and PID for the USB serial console on some National
Instruments devices.
Signed-off-by: Kyle Roeschley <kyle.roeschley@ni.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/cp210x.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -207,6 +207,7 @@ static const struct usb_device_id id_tab
{ USB_DEVICE(0x3195, 0xF190) }, /* Link Instruments MSO-19 */
{ USB_DEVICE(0x3195, 0xF280) }, /* Link Instruments MSO-28 */
{ USB_DEVICE(0x3195, 0xF281) }, /* Link Instruments MSO-28 */
+ { USB_DEVICE(0x3923, 0x7A0B) }, /* National Instruments USB Serial Console */
{ USB_DEVICE(0x413C, 0x9500) }, /* DW700 GPS USB interface */
{ } /* Terminating Entry */
};
^ permalink raw reply [flat|nested] 32+ messages in thread* [PATCH 3.18 08/25] usb: core: Add quirk for HP v222w 16GB Mini
2018-04-30 19:23 [PATCH 3.18 00/25] 3.18.108-stable review Greg Kroah-Hartman
` (6 preceding siblings ...)
2018-04-30 19:23 ` [PATCH 3.18 07/25] USB: serial: cp210x: add ID for NI USB serial console Greg Kroah-Hartman
@ 2018-04-30 19:23 ` Greg Kroah-Hartman
2018-04-30 19:23 ` [PATCH 3.18 09/25] USB: Increment wakeup count on remote wakeup Greg Kroah-Hartman
` (20 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: Greg Kroah-Hartman @ 2018-04-30 19:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Kamil Lulko, Kuppuswamy Sathyanarayanan
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kamil Lulko <kamilx.lulko@intel.com>
commit 3180dabe08e3653bf0a838553905d88f3773f29c upstream.
Add DELAY_INIT quirk to fix the following problem with HP
v222w 16GB Mini:
usb 1-3: unable to read config index 0 descriptor/start: -110
usb 1-3: can't read configurations, error -110
usb 1-3: can't set config #1, error -110
Signed-off-by: Kamil Lulko <kamilx.lulko@intel.com>
Signed-off-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/core/quirks.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -41,6 +41,9 @@ static const struct usb_device_id usb_qu
{ USB_DEVICE(0x03f0, 0x0701), .driver_info =
USB_QUIRK_STRING_FETCH_255 },
+ /* HP v222w 16GB Mini USB Drive */
+ { USB_DEVICE(0x03f0, 0x3f40), .driver_info = USB_QUIRK_DELAY_INIT },
+
/* Creative SB Audigy 2 NX */
{ USB_DEVICE(0x041e, 0x3020), .driver_info = USB_QUIRK_RESET_RESUME },
^ permalink raw reply [flat|nested] 32+ messages in thread* [PATCH 3.18 09/25] USB: Increment wakeup count on remote wakeup.
2018-04-30 19:23 [PATCH 3.18 00/25] 3.18.108-stable review Greg Kroah-Hartman
` (7 preceding siblings ...)
2018-04-30 19:23 ` [PATCH 3.18 08/25] usb: core: Add quirk for HP v222w 16GB Mini Greg Kroah-Hartman
@ 2018-04-30 19:23 ` Greg Kroah-Hartman
2018-04-30 19:23 ` [PATCH 3.18 10/25] ALSA: usb-audio: Skip broken EU on Dell dock USB-audio Greg Kroah-Hartman
` (19 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: Greg Kroah-Hartman @ 2018-04-30 19:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ravi Chandra Sadineni, Alan Stern
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ravi Chandra Sadineni <ravisadineni@chromium.org>
commit 83a62c51ba7b3c0bf45150c4eac7aefc6c785e94 upstream.
On chromebooks we depend on wakeup count to identify the wakeup source.
But currently USB devices do not increment the wakeup count when they
trigger the remote wake. This patch addresses the same.
Resume condition is reported differently on USB 2.0 and USB 3.0 devices.
On USB 2.0 devices, a wake capable device, if wake enabled, drives
resume signal to indicate a remote wake (USB 2.0 spec section 7.1.7.7).
The upstream facing port then sets C_PORT_SUSPEND bit and reports a
port change event (USB 2.0 spec section 11.24.2.7.2.3). Thus if a port
has resumed before driving the resume signal from the host and
C_PORT_SUSPEND is set, then the device attached to the given port might
be the reason for the last system wakeup. Increment the wakeup count for
the same.
On USB 3.0 devices, a function may signal that it wants to exit from device
suspend by sending a Function Wake Device Notification to the host (USB3.0
spec section 8.5.6.4) Thus on receiving the Function Wake, increment the
wakeup count.
Signed-off-by: Ravi Chandra Sadineni <ravisadineni@chromium.org>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/core/hcd.c | 1 +
drivers/usb/core/hub.c | 10 +++++++++-
2 files changed, 10 insertions(+), 1 deletion(-)
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -2289,6 +2289,7 @@ void usb_hcd_resume_root_hub (struct usb
spin_lock_irqsave (&hcd_root_hub_lock, flags);
if (hcd->rh_registered) {
+ pm_wakeup_event(&hcd->self.root_hub->dev, 0);
set_bit(HCD_FLAG_WAKEUP_PENDING, &hcd->flags);
queue_work(pm_wq, &hcd->wakeup_work);
}
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -633,12 +633,17 @@ void usb_wakeup_notification(struct usb_
unsigned int portnum)
{
struct usb_hub *hub;
+ struct usb_port *port_dev;
if (!hdev)
return;
hub = usb_hub_to_struct_hub(hdev);
if (hub) {
+ port_dev = hub->ports[portnum - 1];
+ if (port_dev && port_dev->child)
+ pm_wakeup_event(&port_dev->child->dev, 0);
+
set_bit(portnum, hub->wakeup_bits);
kick_hub_wq(hub);
}
@@ -3363,8 +3368,11 @@ int usb_port_resume(struct usb_device *u
/* Skip the initial Clear-Suspend step for a remote wakeup */
status = hub_port_status(hub, port1, &portstatus, &portchange);
- if (status == 0 && !port_is_suspended(hub, portstatus))
+ if (status == 0 && !port_is_suspended(hub, portstatus)) {
+ if (portchange & USB_PORT_STAT_C_SUSPEND)
+ pm_wakeup_event(&udev->dev, 0);
goto SuspendCleared;
+ }
/* see 7.1.7.7; affects power usage, but not budgeting */
if (hub_is_superspeed(hub->hdev))
^ permalink raw reply [flat|nested] 32+ messages in thread* [PATCH 3.18 10/25] ALSA: usb-audio: Skip broken EU on Dell dock USB-audio
2018-04-30 19:23 [PATCH 3.18 00/25] 3.18.108-stable review Greg Kroah-Hartman
` (8 preceding siblings ...)
2018-04-30 19:23 ` [PATCH 3.18 09/25] USB: Increment wakeup count on remote wakeup Greg Kroah-Hartman
@ 2018-04-30 19:23 ` Greg Kroah-Hartman
2018-04-30 19:23 ` [PATCH 3.18 11/25] virtio: add ability to iterate over vqs Greg Kroah-Hartman
` (18 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: Greg Kroah-Hartman @ 2018-04-30 19:23 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Iwai
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit 1d8d6428d1da642ddd75b0be2d1bb1123ff8e017 upstream.
The Dell Dock USB-audio device with 0bda:4014 is behaving notoriously
bad, and we have already applied some workaround to avoid the firmware
hiccup. Yet we still need to skip one thing, the Extension Unit at ID
4, which doesn't react correctly to the mixer ctl access.
Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=1090658
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/usb/mixer_maps.c | 3 +++
1 file changed, 3 insertions(+)
--- a/sound/usb/mixer_maps.c
+++ b/sound/usb/mixer_maps.c
@@ -353,8 +353,11 @@ static struct usbmix_name_map dragonfly_
/*
* Dell usb dock with ALC4020 codec had a firmware problem where it got
* screwed up when zero volume is passed; just skip it as a workaround
+ *
+ * Also the extension unit gives an access error, so skip it as well.
*/
static const struct usbmix_name_map dell_alc4020_map[] = {
+ { 4, NULL }, /* extension unit */
{ 16, NULL },
{ 19, NULL },
{ 0 }
^ permalink raw reply [flat|nested] 32+ messages in thread* [PATCH 3.18 11/25] virtio: add ability to iterate over vqs
2018-04-30 19:23 [PATCH 3.18 00/25] 3.18.108-stable review Greg Kroah-Hartman
` (9 preceding siblings ...)
2018-04-30 19:23 ` [PATCH 3.18 10/25] ALSA: usb-audio: Skip broken EU on Dell dock USB-audio Greg Kroah-Hartman
@ 2018-04-30 19:23 ` Greg Kroah-Hartman
2018-04-30 19:23 ` [PATCH 3.18 12/25] virtio_console: free buffers after reset Greg Kroah-Hartman
` (17 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: Greg Kroah-Hartman @ 2018-04-30 19:23 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Michael S. Tsirkin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael S. Tsirkin <mst@redhat.com>
commit 24a7e4d20783c0514850f24a5c41ede46ab058f0 upstream.
For cleanup it's helpful to be able to simply scan all vqs and discard
all data. Add an iterator to do that.
Cc: stable@vger.kernel.org
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/virtio.h | 3 +++
1 file changed, 3 insertions(+)
--- a/include/linux/virtio.h
+++ b/include/linux/virtio.h
@@ -122,6 +122,9 @@ int virtio_device_freeze(struct virtio_d
int virtio_device_restore(struct virtio_device *dev);
#endif
+#define virtio_device_for_each_vq(vdev, vq) \
+ list_for_each_entry(vq, &vdev->vqs, list)
+
/**
* virtio_driver - operations for a virtio I/O driver
* @driver: underlying device driver (populate name and owner).
^ permalink raw reply [flat|nested] 32+ messages in thread* [PATCH 3.18 12/25] virtio_console: free buffers after reset
2018-04-30 19:23 [PATCH 3.18 00/25] 3.18.108-stable review Greg Kroah-Hartman
` (10 preceding siblings ...)
2018-04-30 19:23 ` [PATCH 3.18 11/25] virtio: add ability to iterate over vqs Greg Kroah-Hartman
@ 2018-04-30 19:23 ` Greg Kroah-Hartman
2018-04-30 19:23 ` [PATCH 3.18 13/25] tty: n_gsm: Fix long delays with control frame timeouts in ADM mode Greg Kroah-Hartman
` (16 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: Greg Kroah-Hartman @ 2018-04-30 19:23 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Tiwei Bie, Michael S. Tsirkin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael S. Tsirkin <mst@redhat.com>
commit a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b upstream.
Console driver is out of spec. The spec says:
A driver MUST NOT decrement the available idx on a live
virtqueue (ie. there is no way to “unexpose” buffers).
and it does exactly that by trying to detach unused buffers
without doing a device reset first.
Defer detaching the buffers until device unplug.
Of course this means we might get an interrupt for
a vq without an attached port now. Handle that by
discarding the consumed buffer.
Reported-by: Tiwei Bie <tiwei.bie@intel.com>
Fixes: b3258ff1d6 ("virtio: Decrement avail idx on buffer detach")
Cc: stable@vger.kernel.org
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/char/virtio_console.c | 49 ++++++++++++++++++++----------------------
1 file changed, 24 insertions(+), 25 deletions(-)
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -1398,7 +1398,6 @@ static int add_port(struct ports_device
{
char debugfs_name[16];
struct port *port;
- struct port_buffer *buf;
dev_t devt;
unsigned int nr_added_bufs;
int err;
@@ -1509,8 +1508,6 @@ static int add_port(struct ports_device
return 0;
free_inbufs:
- while ((buf = virtqueue_detach_unused_buf(port->in_vq)))
- free_buf(buf, true);
free_device:
device_destroy(pdrvdata.class, port->dev->devt);
free_cdev:
@@ -1535,34 +1532,14 @@ static void remove_port(struct kref *kre
static void remove_port_data(struct port *port)
{
- struct port_buffer *buf;
-
spin_lock_irq(&port->inbuf_lock);
/* Remove unused data this port might have received. */
discard_port_data(port);
spin_unlock_irq(&port->inbuf_lock);
- /* Remove buffers we queued up for the Host to send us data in. */
- do {
- spin_lock_irq(&port->inbuf_lock);
- buf = virtqueue_detach_unused_buf(port->in_vq);
- spin_unlock_irq(&port->inbuf_lock);
- if (buf)
- free_buf(buf, true);
- } while (buf);
-
spin_lock_irq(&port->outvq_lock);
reclaim_consumed_buffers(port);
spin_unlock_irq(&port->outvq_lock);
-
- /* Free pending buffers from the out-queue. */
- do {
- spin_lock_irq(&port->outvq_lock);
- buf = virtqueue_detach_unused_buf(port->out_vq);
- spin_unlock_irq(&port->outvq_lock);
- if (buf)
- free_buf(buf, true);
- } while (buf);
}
/*
@@ -1783,13 +1760,24 @@ static void control_work_handler(struct
spin_unlock(&portdev->c_ivq_lock);
}
+static void flush_bufs(struct virtqueue *vq, bool can_sleep)
+{
+ struct port_buffer *buf;
+ unsigned int len;
+
+ while ((buf = virtqueue_get_buf(vq, &len)))
+ free_buf(buf, can_sleep);
+}
+
static void out_intr(struct virtqueue *vq)
{
struct port *port;
port = find_port_by_vq(vq->vdev->priv, vq);
- if (!port)
+ if (!port) {
+ flush_bufs(vq, false);
return;
+ }
wake_up_interruptible(&port->waitqueue);
}
@@ -1800,8 +1788,10 @@ static void in_intr(struct virtqueue *vq
unsigned long flags;
port = find_port_by_vq(vq->vdev->priv, vq);
- if (!port)
+ if (!port) {
+ flush_bufs(vq, false);
return;
+ }
spin_lock_irqsave(&port->inbuf_lock, flags);
port->inbuf = get_inbuf(port);
@@ -1976,6 +1966,15 @@ static const struct file_operations port
static void remove_vqs(struct ports_device *portdev)
{
+ struct virtqueue *vq;
+
+ virtio_device_for_each_vq(portdev->vdev, vq) {
+ struct port_buffer *buf;
+
+ flush_bufs(vq, true);
+ while ((buf = virtqueue_detach_unused_buf(vq)))
+ free_buf(buf, true);
+ }
portdev->vdev->config->del_vqs(portdev->vdev);
kfree(portdev->in_vqs);
kfree(portdev->out_vqs);
^ permalink raw reply [flat|nested] 32+ messages in thread* [PATCH 3.18 13/25] tty: n_gsm: Fix long delays with control frame timeouts in ADM mode
2018-04-30 19:23 [PATCH 3.18 00/25] 3.18.108-stable review Greg Kroah-Hartman
` (11 preceding siblings ...)
2018-04-30 19:23 ` [PATCH 3.18 12/25] virtio_console: free buffers after reset Greg Kroah-Hartman
@ 2018-04-30 19:23 ` Greg Kroah-Hartman
2018-04-30 19:23 ` [PATCH 3.18 14/25] tty: n_gsm: Fix DLCI handling for ADM mode if debug & 2 is not set Greg Kroah-Hartman
` (15 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: Greg Kroah-Hartman @ 2018-04-30 19:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, linux-serial, Alan Cox, Dan Williams,
Jiri Prchal, Jiri Slaby, Marcel Partap, Merlijn Wajer,
Michael Nazzareno Trimarchi, Michael Scott, Pavel Machek,
Peter Hurley, Russ Gorby, Sascha Hauer, Sebastian Reichel,
Tony Lindgren
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Lindgren <tony@atomide.com>
commit e9ec22547986dd32c5c70da78107ce35dbff1344 upstream.
Commit ea3d8465ab9b ("tty: n_gsm: Allow ADM response in addition to UA for
control dlci") added support for DLCI to stay in Asynchronous Disconnected
Mode (ADM). But we still get long delays waiting for commands to other
DLCI to complete:
--> 5) C: SABM(P)
Q> 0) C: UIH(F)
Q> 0) C: UIH(F)
Q> 0) C: UIH(F)
...
This happens because gsm_control_send() sets cretries timer to T2 that is
by default set to 34. This will cause resend for T2 times for the control
frame. In ADM mode, we will never get a response so the control frame, so
retries are just delaying all the commands.
Let's fix the issue by setting DLCI_MODE_ADM flag after detecting the ADM
mode for the control DLCI. Then we can use that in gsm_control_send() to
set retries to 1. This means the control frame will be sent once allowing
the other end at an opportunity to switch from ADM to ABM mode.
Note that retries will be decremented in gsm_control_retransmit() so
we don't want to set it to 0 here.
Fixes: ea3d8465ab9b ("tty: n_gsm: Allow ADM response in addition to UA for control dlci")
Cc: linux-serial@vger.kernel.org
Cc: Alan Cox <alan@llwyncelyn.cymru>
Cc: Dan Williams <dcbw@redhat.com>
Cc: Jiri Prchal <jiri.prchal@aksignal.cz>
Cc: Jiri Slaby <jslaby@suse.cz>
Cc: Marcel Partap <mpartap@gmx.net>
Cc: Merlijn Wajer <merlijn@wizzup.org>
Cc: Michael Nazzareno Trimarchi <michael@amarulasolutions.com>
Cc: Michael Scott <michael.scott@linaro.org>
Cc: Pavel Machek <pavel@ucw.cz>
Cc: Peter Hurley <peter@hurleysoftware.com>
Cc: Russ Gorby <russ.gorby@intel.com>
Cc: Sascha Hauer <s.hauer@pengutronix.de>
Cc: Sebastian Reichel <sre@kernel.org>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/n_gsm.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
--- a/drivers/tty/n_gsm.c
+++ b/drivers/tty/n_gsm.c
@@ -137,6 +137,9 @@ struct gsm_dlci {
struct mutex mutex;
/* Link layer */
+ int mode;
+#define DLCI_MODE_ABM 0 /* Normal Asynchronous Balanced Mode */
+#define DLCI_MODE_ADM 1 /* Asynchronous Disconnected Mode */
spinlock_t lock; /* Protects the internal state */
struct timer_list t1; /* Retransmit timer for SABM and UA */
int retries;
@@ -1380,7 +1383,13 @@ retry:
ctrl->data = data;
ctrl->len = clen;
gsm->pending_cmd = ctrl;
- gsm->cretries = gsm->n2;
+
+ /* If DLCI0 is in ADM mode skip retries, it won't respond */
+ if (gsm->dlci[0]->mode == DLCI_MODE_ADM)
+ gsm->cretries = 1;
+ else
+ gsm->cretries = gsm->n2;
+
mod_timer(&gsm->t2_timer, jiffies + gsm->t2 * HZ / 100);
gsm_control_transmit(gsm, ctrl);
spin_unlock_irqrestore(&gsm->control_lock, flags);
@@ -1488,6 +1497,7 @@ static void gsm_dlci_t1(unsigned long da
if (debug & 8)
pr_info("DLCI %d opening in ADM mode.\n",
dlci->addr);
+ dlci->mode = DLCI_MODE_ADM;
gsm_dlci_open(dlci);
} else {
gsm_dlci_close(dlci);
^ permalink raw reply [flat|nested] 32+ messages in thread* [PATCH 3.18 14/25] tty: n_gsm: Fix DLCI handling for ADM mode if debug & 2 is not set
2018-04-30 19:23 [PATCH 3.18 00/25] 3.18.108-stable review Greg Kroah-Hartman
` (12 preceding siblings ...)
2018-04-30 19:23 ` [PATCH 3.18 13/25] tty: n_gsm: Fix long delays with control frame timeouts in ADM mode Greg Kroah-Hartman
@ 2018-04-30 19:23 ` Greg Kroah-Hartman
2018-04-30 19:23 ` [PATCH 3.18 15/25] tty: Use __GFP_NOFAIL for tty_ldisc_get() Greg Kroah-Hartman
` (14 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: Greg Kroah-Hartman @ 2018-04-30 19:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, linux-serial, Alan Cox, Dan Williams,
Jiri Prchal, Jiri Slaby, Marcel Partap, Merlijn Wajer,
Michael Nazzareno Trimarchi, Michael Scott, Pavel Machek,
Peter Hurley, Russ Gorby, Sascha Hauer, Sebastian Reichel,
Tony Lindgren
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Lindgren <tony@atomide.com>
commit b2d89ad9c9682e795ed6eeb9ed455789ad6cedf1 upstream.
At least on droid 4 with control channel in ADM mode, there is no response
to Modem Status Command (MSC). Currently gsmtty_modem_update() expects to
have data in dlci->modem_rx unless debug & 2 is set. This means that on
droid 4, things only work if debug & 2 is set.
Let's fix the issue by ignoring empty dlci->modem_rx for ADM mode. In
the AMD mode, CMD_MSC will never respond and gsm_process_modem() won't
get called to set dlci->modem_rx.
And according to ts_127010v140000p.pdf, MSC is only relevant if basic
option is chosen, so let's test for that too.
Fixes: ea3d8465ab9b ("tty: n_gsm: Allow ADM response in addition to UA for control dlci")
Cc: linux-serial@vger.kernel.org
Cc: Alan Cox <alan@llwyncelyn.cymru>
Cc: Dan Williams <dcbw@redhat.com>
Cc: Jiri Prchal <jiri.prchal@aksignal.cz>
Cc: Jiri Slaby <jslaby@suse.cz>
Cc: Marcel Partap <mpartap@gmx.net>
Cc: Merlijn Wajer <merlijn@wizzup.org>
Cc: Michael Nazzareno Trimarchi <michael@amarulasolutions.com>
Cc: Michael Scott <michael.scott@linaro.org>
Cc: Pavel Machek <pavel@ucw.cz>
Cc: Peter Hurley <peter@hurleysoftware.com>
Cc: Russ Gorby <russ.gorby@intel.com>
Cc: Sascha Hauer <s.hauer@pengutronix.de>
Cc: Sebastian Reichel <sre@kernel.org>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/n_gsm.c | 11 +++++++++++
1 file changed, 11 insertions(+)
--- a/drivers/tty/n_gsm.c
+++ b/drivers/tty/n_gsm.c
@@ -2892,11 +2892,22 @@ static int gsmtty_modem_update(struct gs
static int gsm_carrier_raised(struct tty_port *port)
{
struct gsm_dlci *dlci = container_of(port, struct gsm_dlci, port);
+ struct gsm_mux *gsm = dlci->gsm;
+
/* Not yet open so no carrier info */
if (dlci->state != DLCI_OPEN)
return 0;
if (debug & 2)
return 1;
+
+ /*
+ * Basic mode with control channel in ADM mode may not respond
+ * to CMD_MSC at all and modem_rx is empty.
+ */
+ if (gsm->encoding == 0 && gsm->dlci[0]->mode == DLCI_MODE_ADM &&
+ !dlci->modem_rx)
+ return 1;
+
return dlci->modem_rx & TIOCM_CD;
}
^ permalink raw reply [flat|nested] 32+ messages in thread* [PATCH 3.18 15/25] tty: Use __GFP_NOFAIL for tty_ldisc_get()
2018-04-30 19:23 [PATCH 3.18 00/25] 3.18.108-stable review Greg Kroah-Hartman
` (13 preceding siblings ...)
2018-04-30 19:23 ` [PATCH 3.18 14/25] tty: n_gsm: Fix DLCI handling for ADM mode if debug & 2 is not set Greg Kroah-Hartman
@ 2018-04-30 19:23 ` Greg Kroah-Hartman
2018-04-30 19:23 ` [PATCH 3.18 16/25] ALSA: core: Report audio_tstamp in snd_pcm_sync_ptr Greg Kroah-Hartman
` (13 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: Greg Kroah-Hartman @ 2018-04-30 19:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tetsuo Handa, syzbot, Michal Hocko,
Vegard Nossum, Dmitry Vyukov, Jiri Slaby, Peter Hurley,
One Thousand Gnomes, Linus Torvalds
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
commit bcdd0ca8cb8730573afebcaae4138f8f4c8eaa20 upstream.
syzbot is reporting crashes triggered by memory allocation fault injection
at tty_ldisc_get() [1]. As an attempt to handle OOM in a graceful way, we
have tried commit 5362544bebe85071 ("tty: don't panic on OOM in
tty_set_ldisc()"). But we reverted that attempt by commit a8983d01f9b7d600
("Revert "tty: don't panic on OOM in tty_set_ldisc()"") due to reproducible
crash. We should spend resource for finding and fixing race condition bugs
rather than complicate error paths for 2 * sizeof(void *) bytes allocation
failure.
[1] https://syzkaller.appspot.com/bug?id=489d33fa386453859ead58ff5171d43772b13aa3
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Reported-by: syzbot <syzbot+40b7287c2dc987c48c81@syzkaller.appspotmail.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Vegard Nossum <vegard.nossum@gmail.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Jiri Slaby <jslaby@suse.com>
Cc: Peter Hurley <peter@hurleysoftware.com>
Cc: One Thousand Gnomes <gnomes@lxorguk.ukuu.org.uk>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/tty_ldisc.c | 11 +++++------
1 file changed, 5 insertions(+), 6 deletions(-)
--- a/drivers/tty/tty_ldisc.c
+++ b/drivers/tty/tty_ldisc.c
@@ -171,12 +171,11 @@ static struct tty_ldisc *tty_ldisc_get(s
return ERR_CAST(ldops);
}
- ld = kmalloc(sizeof(struct tty_ldisc), GFP_KERNEL);
- if (ld == NULL) {
- put_ldops(ldops);
- return ERR_PTR(-ENOMEM);
- }
-
+ /*
+ * There is no way to handle allocation failure of only 16 bytes.
+ * Let's simplify error handling and save more memory.
+ */
+ ld = kmalloc(sizeof(struct tty_ldisc), GFP_KERNEL | __GFP_NOFAIL);
ld->ops = ldops;
ld->tty = tty;
^ permalink raw reply [flat|nested] 32+ messages in thread* [PATCH 3.18 16/25] ALSA: core: Report audio_tstamp in snd_pcm_sync_ptr
2018-04-30 19:23 [PATCH 3.18 00/25] 3.18.108-stable review Greg Kroah-Hartman
` (14 preceding siblings ...)
2018-04-30 19:23 ` [PATCH 3.18 15/25] tty: Use __GFP_NOFAIL for tty_ldisc_get() Greg Kroah-Hartman
@ 2018-04-30 19:23 ` Greg Kroah-Hartman
2018-04-30 19:23 ` [PATCH 3.18 17/25] ALSA: seq: oss: Fix unbalanced use lock for synth MIDI device Greg Kroah-Hartman
` (12 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: Greg Kroah-Hartman @ 2018-04-30 19:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, David Henningsson, Takashi Sakamoto,
Takashi Iwai
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Henningsson <diwic@ubuntu.com>
commit f853dcaae2f5bbe021161e421bd1576845bae8f6 upstream.
It looks like a simple mistake that this struct member
was forgotten.
Audio_tstamp isn't used much, and on some archs (such as x86) this
ioctl is not used by default, so that might be the reason why this
has slipped for so long.
Fixes: 4eeaaeaea1ce ("ALSA: core: add hooks for audio timestamps")
Signed-off-by: David Henningsson <diwic@ubuntu.com>
Reviewed-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Cc: <stable@vger.kernel.org> # v3.8+
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/core/pcm_native.c | 1 +
1 file changed, 1 insertion(+)
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -2695,6 +2695,7 @@ static int snd_pcm_sync_ptr(struct snd_p
sync_ptr.s.status.hw_ptr = status->hw_ptr;
sync_ptr.s.status.tstamp = status->tstamp;
sync_ptr.s.status.suspended_state = status->suspended_state;
+ sync_ptr.s.status.audio_tstamp = status->audio_tstamp;
snd_pcm_stream_unlock_irq(substream);
if (copy_to_user(_sync_ptr, &sync_ptr, sizeof(sync_ptr)))
return -EFAULT;
^ permalink raw reply [flat|nested] 32+ messages in thread* [PATCH 3.18 17/25] ALSA: seq: oss: Fix unbalanced use lock for synth MIDI device
2018-04-30 19:23 [PATCH 3.18 00/25] 3.18.108-stable review Greg Kroah-Hartman
` (15 preceding siblings ...)
2018-04-30 19:23 ` [PATCH 3.18 16/25] ALSA: core: Report audio_tstamp in snd_pcm_sync_ptr Greg Kroah-Hartman
@ 2018-04-30 19:23 ` Greg Kroah-Hartman
2018-04-30 19:23 ` [PATCH 3.18 18/25] mtd: cfi: cmdset_0001: Do not allow read/write to suspend erase block Greg Kroah-Hartman
` (11 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: Greg Kroah-Hartman @ 2018-04-30 19:23 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Iwai
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit f5e94b4c6ebdabe0f602d796e0430180927521a0 upstream.
When get_synthdev() is called for a MIDI device, it returns the fixed
midi_synth_dev without the use refcounting. OTOH, the caller is
supposed to unreference unconditionally after the usage, so this would
lead to unbalanced refcount.
This patch corrects the behavior and keep up the refcount balance also
for the MIDI synth device.
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/core/seq/oss/seq_oss_synth.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
--- a/sound/core/seq/oss/seq_oss_synth.c
+++ b/sound/core/seq/oss/seq_oss_synth.c
@@ -363,10 +363,14 @@ get_synthdev(struct seq_oss_devinfo *dp,
return NULL;
if (! dp->synths[dev].opened)
return NULL;
- if (dp->synths[dev].is_midi)
- return &midi_synth_dev;
- if ((rec = get_sdev(dev)) == NULL)
- return NULL;
+ if (dp->synths[dev].is_midi) {
+ rec = &midi_synth_dev;
+ snd_use_lock_use(&rec->use_lock);
+ } else {
+ rec = get_sdev(dev);
+ if (!rec)
+ return NULL;
+ }
if (! rec->opened) {
snd_use_lock_free(&rec->use_lock);
return NULL;
^ permalink raw reply [flat|nested] 32+ messages in thread* [PATCH 3.18 18/25] mtd: cfi: cmdset_0001: Do not allow read/write to suspend erase block.
2018-04-30 19:23 [PATCH 3.18 00/25] 3.18.108-stable review Greg Kroah-Hartman
` (16 preceding siblings ...)
2018-04-30 19:23 ` [PATCH 3.18 17/25] ALSA: seq: oss: Fix unbalanced use lock for synth MIDI device Greg Kroah-Hartman
@ 2018-04-30 19:23 ` Greg Kroah-Hartman
2018-04-30 19:23 ` [PATCH 3.18 19/25] mtd: cfi: cmdset_0001: Workaround Micron Erase suspend bug Greg Kroah-Hartman
` (10 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: Greg Kroah-Hartman @ 2018-04-30 19:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Joakim Tjernlund, Richard Weinberger,
Boris Brezillon
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joakim Tjernlund <joakim.tjernlund@transmode.se>
commit 6510bbc88e3258631831ade49033537081950605 upstream.
Currently it is possible to read and/or write to suspend EB's.
Writing /dev/mtdX or /dev/mtdblockX from several processes may
break the flash state machine.
Signed-off-by: Joakim Tjernlund <joakim.tjernlund@infinera.com>
Cc: <stable@vger.kernel.org>
Reviewed-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/chips/cfi_cmdset_0001.c | 16 +++++++++++-----
include/linux/mtd/flashchip.h | 1 +
2 files changed, 12 insertions(+), 5 deletions(-)
--- a/drivers/mtd/chips/cfi_cmdset_0001.c
+++ b/drivers/mtd/chips/cfi_cmdset_0001.c
@@ -825,21 +825,25 @@ static int chip_ready (struct map_info *
(mode == FL_WRITING && (cfip->SuspendCmdSupport & 1))))
goto sleep;
+ /* Do not allow suspend iff read/write to EB address */
+ if ((adr & chip->in_progress_block_mask) ==
+ chip->in_progress_block_addr)
+ goto sleep;
/* Erase suspend */
- map_write(map, CMD(0xB0), adr);
+ map_write(map, CMD(0xB0), chip->in_progress_block_addr);
/* If the flash has finished erasing, then 'erase suspend'
* appears to make some (28F320) flash devices switch to
* 'read' mode. Make sure that we switch to 'read status'
* mode so we get the right data. --rmk
*/
- map_write(map, CMD(0x70), adr);
+ map_write(map, CMD(0x70), chip->in_progress_block_addr);
chip->oldstate = FL_ERASING;
chip->state = FL_ERASE_SUSPENDING;
chip->erase_suspended = 1;
for (;;) {
- status = map_read(map, adr);
+ status = map_read(map, chip->in_progress_block_addr);
if (map_word_andequal(map, status, status_OK, status_OK))
break;
@@ -1035,8 +1039,8 @@ static void put_chip(struct map_info *ma
sending the 0x70 (Read Status) command to an erasing
chip and expecting it to be ignored, that's what we
do. */
- map_write(map, CMD(0xd0), adr);
- map_write(map, CMD(0x70), adr);
+ map_write(map, CMD(0xd0), chip->in_progress_block_addr);
+ map_write(map, CMD(0x70), chip->in_progress_block_addr);
chip->oldstate = FL_READY;
chip->state = FL_ERASING;
break;
@@ -1927,6 +1931,8 @@ static int __xipram do_erase_oneblock(st
map_write(map, CMD(0xD0), adr);
chip->state = FL_ERASING;
chip->erase_suspended = 0;
+ chip->in_progress_block_addr = adr;
+ chip->in_progress_block_mask = ~(len - 1);
ret = INVAL_CACHE_AND_WAIT(map, chip, adr,
adr, len,
--- a/include/linux/mtd/flashchip.h
+++ b/include/linux/mtd/flashchip.h
@@ -85,6 +85,7 @@ struct flchip {
unsigned int write_suspended:1;
unsigned int erase_suspended:1;
unsigned long in_progress_block_addr;
+ unsigned long in_progress_block_mask;
struct mutex mutex;
wait_queue_head_t wq; /* Wait on here when we're waiting for the chip
^ permalink raw reply [flat|nested] 32+ messages in thread* [PATCH 3.18 19/25] mtd: cfi: cmdset_0001: Workaround Micron Erase suspend bug.
2018-04-30 19:23 [PATCH 3.18 00/25] 3.18.108-stable review Greg Kroah-Hartman
` (17 preceding siblings ...)
2018-04-30 19:23 ` [PATCH 3.18 18/25] mtd: cfi: cmdset_0001: Do not allow read/write to suspend erase block Greg Kroah-Hartman
@ 2018-04-30 19:23 ` Greg Kroah-Hartman
2018-04-30 19:23 ` [PATCH 3.18 20/25] mtd: cfi: cmdset_0002: Do not allow read/write to suspend erase block Greg Kroah-Hartman
` (9 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: Greg Kroah-Hartman @ 2018-04-30 19:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Joakim Tjernlund, Richard Weinberger,
Boris Brezillon
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joakim Tjernlund <joakim.tjernlund@transmode.se>
commit 46a16a2283f9e678a4e26829175e0c37a5191860 upstream.
Some Micron chips does not work well wrt Erase suspend for
boot blocks. This avoids the issue by not allowing Erase suspend
for the boot blocks for the 28F00AP30(1GBit) chip.
Signed-off-by: Joakim Tjernlund <joakim.tjernlund@infinera.com>
Cc: <stable@vger.kernel.org>
Reviewed-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/chips/cfi_cmdset_0001.c | 17 +++++++++++++++++
1 file changed, 17 insertions(+)
--- a/drivers/mtd/chips/cfi_cmdset_0001.c
+++ b/drivers/mtd/chips/cfi_cmdset_0001.c
@@ -45,6 +45,7 @@
#define I82802AB 0x00ad
#define I82802AC 0x00ac
#define PF38F4476 0x881c
+#define M28F00AP30 0x8963
/* STMicroelectronics chips */
#define M50LPW080 0x002F
#define M50FLW080A 0x0080
@@ -375,6 +376,17 @@ static void cfi_fixup_major_minor(struct
extp->MinorVersion = '1';
}
+static int cfi_is_micron_28F00AP30(struct cfi_private *cfi, struct flchip *chip)
+{
+ /*
+ * Micron(was Numonyx) 1Gbit bottom boot are buggy w.r.t
+ * Erase Supend for their small Erase Blocks(0x8000)
+ */
+ if (cfi->mfr == CFI_MFR_INTEL && cfi->id == M28F00AP30)
+ return 1;
+ return 0;
+}
+
static inline struct cfi_pri_intelext *
read_pri_intelext(struct map_info *map, __u16 adr)
{
@@ -830,6 +842,11 @@ static int chip_ready (struct map_info *
chip->in_progress_block_addr)
goto sleep;
+ /* do not suspend small EBs, buggy Micron Chips */
+ if (cfi_is_micron_28F00AP30(cfi, chip) &&
+ (chip->in_progress_block_mask == ~(0x8000-1)))
+ goto sleep;
+
/* Erase suspend */
map_write(map, CMD(0xB0), chip->in_progress_block_addr);
^ permalink raw reply [flat|nested] 32+ messages in thread* [PATCH 3.18 20/25] mtd: cfi: cmdset_0002: Do not allow read/write to suspend erase block.
2018-04-30 19:23 [PATCH 3.18 00/25] 3.18.108-stable review Greg Kroah-Hartman
` (18 preceding siblings ...)
2018-04-30 19:23 ` [PATCH 3.18 19/25] mtd: cfi: cmdset_0001: Workaround Micron Erase suspend bug Greg Kroah-Hartman
@ 2018-04-30 19:23 ` Greg Kroah-Hartman
2018-04-30 19:23 ` [PATCH 3.18 21/25] kobject: dont use WARN for registration failures Greg Kroah-Hartman
` (8 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: Greg Kroah-Hartman @ 2018-04-30 19:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Joakim Tjernlund, Richard Weinberger,
Boris Brezillon
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joakim Tjernlund <joakim.tjernlund@infinera.com>
commit 7b70eb14392a7cf505f9b358d06c33b5af73d1e7 upstream.
Currently it is possible to read and/or write to suspend EB's.
Writing /dev/mtdX or /dev/mtdblockX from several processes may
break the flash state machine.
Taken from cfi_cmdset_0001 driver.
Signed-off-by: Joakim Tjernlund <joakim.tjernlund@infinera.com>
Cc: <stable@vger.kernel.org>
Reviewed-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/chips/cfi_cmdset_0002.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
--- a/drivers/mtd/chips/cfi_cmdset_0002.c
+++ b/drivers/mtd/chips/cfi_cmdset_0002.c
@@ -814,9 +814,10 @@ static int get_chip(struct map_info *map
(mode == FL_WRITING && (cfip->EraseSuspend & 0x2))))
goto sleep;
- /* We could check to see if we're trying to access the sector
- * that is currently being erased. However, no user will try
- * anything like that so we just wait for the timeout. */
+ /* Do not allow suspend iff read/write to EB address */
+ if ((adr & chip->in_progress_block_mask) ==
+ chip->in_progress_block_addr)
+ goto sleep;
/* Erase suspend */
/* It's harmless to issue the Erase-Suspend and Erase-Resume
@@ -2265,6 +2266,7 @@ static int __xipram do_erase_chip(struct
chip->state = FL_ERASING;
chip->erase_suspended = 0;
chip->in_progress_block_addr = adr;
+ chip->in_progress_block_mask = ~(map->size - 1);
INVALIDATE_CACHE_UDELAY(map, chip,
adr, map->size,
@@ -2354,6 +2356,7 @@ static int __xipram do_erase_oneblock(st
chip->state = FL_ERASING;
chip->erase_suspended = 0;
chip->in_progress_block_addr = adr;
+ chip->in_progress_block_mask = ~(len - 1);
INVALIDATE_CACHE_UDELAY(map, chip,
adr, len,
^ permalink raw reply [flat|nested] 32+ messages in thread* [PATCH 3.18 21/25] kobject: dont use WARN for registration failures
2018-04-30 19:23 [PATCH 3.18 00/25] 3.18.108-stable review Greg Kroah-Hartman
` (19 preceding siblings ...)
2018-04-30 19:23 ` [PATCH 3.18 20/25] mtd: cfi: cmdset_0002: Do not allow read/write to suspend erase block Greg Kroah-Hartman
@ 2018-04-30 19:23 ` Greg Kroah-Hartman
2018-04-30 19:23 ` [PATCH 3.18 22/25] scsi: sd: Defer spinning up drive while SANITIZE is in progress Greg Kroah-Hartman
` (7 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: Greg Kroah-Hartman @ 2018-04-30 19:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dmitry Vyukov,
syzbot+209c0f67f99fec8eb14b, syzbot+7fb6d9525a4528104e05,
syzbot+2e63711063e2d8f9ea27, syzbot+de73361ee4971b6e6f75
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Vyukov <dvyukov@google.com>
commit 3e14c6abbfb5c94506edda9d8e2c145d79375798 upstream.
This WARNING proved to be noisy. The function still returns an error
and callers should handle it. That's how most of kernel code works.
Downgrade the WARNING to pr_err() and leave WARNINGs for kernel bugs.
Signed-off-by: Dmitry Vyukov <dvyukov@google.com>
Reported-by: syzbot+209c0f67f99fec8eb14b@syzkaller.appspotmail.com
Reported-by: syzbot+7fb6d9525a4528104e05@syzkaller.appspotmail.com
Reported-by: syzbot+2e63711063e2d8f9ea27@syzkaller.appspotmail.com
Reported-by: syzbot+de73361ee4971b6e6f75@syzkaller.appspotmail.com
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
lib/kobject.c | 12 +++++-------
1 file changed, 5 insertions(+), 7 deletions(-)
--- a/lib/kobject.c
+++ b/lib/kobject.c
@@ -234,14 +234,12 @@ static int kobject_add_internal(struct k
/* be noisy on error issues */
if (error == -EEXIST)
- WARN(1, "%s failed for %s with "
- "-EEXIST, don't try to register things with "
- "the same name in the same directory.\n",
- __func__, kobject_name(kobj));
+ pr_err("%s failed for %s with -EEXIST, don't try to register things with the same name in the same directory.\n",
+ __func__, kobject_name(kobj));
else
- WARN(1, "%s failed for %s (error: %d parent: %s)\n",
- __func__, kobject_name(kobj), error,
- parent ? kobject_name(parent) : "'none'");
+ pr_err("%s failed for %s (error: %d parent: %s)\n",
+ __func__, kobject_name(kobj), error,
+ parent ? kobject_name(parent) : "'none'");
} else
kobj->state_in_sysfs = 1;
^ permalink raw reply [flat|nested] 32+ messages in thread* [PATCH 3.18 22/25] scsi: sd: Defer spinning up drive while SANITIZE is in progress
2018-04-30 19:23 [PATCH 3.18 00/25] 3.18.108-stable review Greg Kroah-Hartman
` (20 preceding siblings ...)
2018-04-30 19:23 ` [PATCH 3.18 21/25] kobject: dont use WARN for registration failures Greg Kroah-Hartman
@ 2018-04-30 19:23 ` Greg Kroah-Hartman
2018-04-30 19:23 ` [PATCH 3.18 23/25] ASoC: fsl_esai: Fix divisor calculation failure at lower ratio Greg Kroah-Hartman
` (6 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: Greg Kroah-Hartman @ 2018-04-30 19:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mahesh Rajashekhara, Martin K. Petersen
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mahesh Rajashekhara <mahesh.rajashekhara@microsemi.com>
commit 505aa4b6a8834a2300971c5220c380c3271ebde3 upstream.
A drive being sanitized will return NOT READY / ASC 0x4 / ASCQ
0x1b ("LOGICAL UNIT NOT READY. SANITIZE IN PROGRESS").
Prevent spinning up the drive until this condition clears.
[mkp: tweaked commit message]
Signed-off-by: Mahesh Rajashekhara <mahesh.rajashekhara@microsemi.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/sd.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -1848,6 +1848,8 @@ sd_spinup_disk(struct scsi_disk *sdkp)
break; /* standby */
if (sshdr.asc == 4 && sshdr.ascq == 0xc)
break; /* unavailable */
+ if (sshdr.asc == 4 && sshdr.ascq == 0x1b)
+ break; /* sanitize in progress */
/*
* Issue command to spin up drive when not ready
*/
^ permalink raw reply [flat|nested] 32+ messages in thread* [PATCH 3.18 23/25] ASoC: fsl_esai: Fix divisor calculation failure at lower ratio
2018-04-30 19:23 [PATCH 3.18 00/25] 3.18.108-stable review Greg Kroah-Hartman
` (21 preceding siblings ...)
2018-04-30 19:23 ` [PATCH 3.18 22/25] scsi: sd: Defer spinning up drive while SANITIZE is in progress Greg Kroah-Hartman
@ 2018-04-30 19:23 ` Greg Kroah-Hartman
2018-04-30 19:23 ` [PATCH 3.18 24/25] libceph: validate con->state at the top of try_write() Greg Kroah-Hartman
` (5 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: Greg Kroah-Hartman @ 2018-04-30 19:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Marek Vasut, Nicolin Chen,
Fabio Estevam, Mark Brown
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolin Chen <nicoleotsuka@gmail.com>
commit c656941df9bc80f7ec65b92ca73c42f8b0b62628 upstream.
When the desired ratio is less than 256, the savesub (tolerance)
in the calculation would become 0. This will then fail the loop-
search immediately without reporting any errors.
But if the ratio is smaller enough, there is no need to calculate
the tolerance because PM divisor alone is enough to get the ratio.
So a simple fix could be just to set PM directly instead of going
into the loop-search.
Reported-by: Marek Vasut <marex@denx.de>
Signed-off-by: Nicolin Chen <nicoleotsuka@gmail.com>
Tested-by: Marek Vasut <marex@denx.de>
Reviewed-by: Fabio Estevam <fabio.estevam@nxp.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/fsl/fsl_esai.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/sound/soc/fsl/fsl_esai.c
+++ b/sound/soc/fsl/fsl_esai.c
@@ -143,6 +143,13 @@ static int fsl_esai_divisor_cal(struct s
psr = ratio <= 256 * maxfp ? ESAI_xCCR_xPSR_BYPASS : ESAI_xCCR_xPSR_DIV8;
+ /* Do not loop-search if PM (1 ~ 256) alone can serve the ratio */
+ if (ratio <= 256) {
+ pm = ratio;
+ fp = 1;
+ goto out;
+ }
+
/* Set the max fluctuation -- 0.1% of the max devisor */
savesub = (psr ? 1 : 8) * 256 * maxfp / 1000;
^ permalink raw reply [flat|nested] 32+ messages in thread* [PATCH 3.18 24/25] libceph: validate con->state at the top of try_write()
2018-04-30 19:23 [PATCH 3.18 00/25] 3.18.108-stable review Greg Kroah-Hartman
` (22 preceding siblings ...)
2018-04-30 19:23 ` [PATCH 3.18 23/25] ASoC: fsl_esai: Fix divisor calculation failure at lower ratio Greg Kroah-Hartman
@ 2018-04-30 19:23 ` Greg Kroah-Hartman
2018-04-30 19:23 ` [PATCH 3.18 25/25] Revert "perf tests: Decompress kernel module before objdump" Greg Kroah-Hartman
` (4 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: Greg Kroah-Hartman @ 2018-04-30 19:23 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ilya Dryomov, Jason Dillaman
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilya Dryomov <idryomov@gmail.com>
commit 9c55ad1c214d9f8c4594ac2c3fa392c1c32431a7 upstream.
ceph_con_workfn() validates con->state before calling try_read() and
then try_write(). However, try_read() temporarily releases con->mutex,
notably in process_message() and ceph_con_in_msg_alloc(), opening the
window for ceph_con_close() to sneak in, close the connection and
release con->sock. When try_write() is called on the assumption that
con->state is still valid (i.e. not STANDBY or CLOSED), a NULL sock
gets passed to the networking stack:
BUG: unable to handle kernel NULL pointer dereference at 0000000000000020
IP: selinux_socket_sendmsg+0x5/0x20
Make sure con->state is valid at the top of try_write() and add an
explicit BUG_ON for this, similar to try_read().
Cc: stable@vger.kernel.org
Link: https://tracker.ceph.com/issues/23706
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Reviewed-by: Jason Dillaman <dillaman@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ceph/messenger.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -2449,6 +2449,11 @@ static int try_write(struct ceph_connect
int ret = 1;
dout("try_write start %p state %lu\n", con, con->state);
+ if (con->state != CON_STATE_PREOPEN &&
+ con->state != CON_STATE_CONNECTING &&
+ con->state != CON_STATE_NEGOTIATING &&
+ con->state != CON_STATE_OPEN)
+ return 0;
more:
dout("try_write out_kvec_bytes %d\n", con->out_kvec_bytes);
@@ -2474,6 +2479,8 @@ more:
}
more_kvec:
+ BUG_ON(!con->sock);
+
/* kvec data queued? */
if (con->out_skip) {
ret = write_partial_skip(con);
^ permalink raw reply [flat|nested] 32+ messages in thread* [PATCH 3.18 25/25] Revert "perf tests: Decompress kernel module before objdump"
2018-04-30 19:23 [PATCH 3.18 00/25] 3.18.108-stable review Greg Kroah-Hartman
` (23 preceding siblings ...)
2018-04-30 19:23 ` [PATCH 3.18 24/25] libceph: validate con->state at the top of try_write() Greg Kroah-Hartman
@ 2018-04-30 19:23 ` Greg Kroah-Hartman
2018-05-01 1:04 ` [PATCH 3.18 00/25] 3.18.108-stable review kernelci.org bot
` (3 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: Greg Kroah-Hartman @ 2018-04-30 19:23 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Pavlos Parissis, Lei Chen,
Maxime Hadjinlian, Murilo Opsfelder Araujo, Namhyung Kim,
Adrian Hunter, Jiri Olsa, David Ahern, Peter Zijlstra, Wang Nan,
kernel-team, Arnaldo Carvalho de Melo, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This reverts commit 091b3b4ba55daf8b28f40794aefdaa0bdb5af7a1 which is
commit 94df1040b1e6aacd8dec0ba3c61d7e77cd695f26 upstream.
It breaks the build of perf on 3.18.y, so I'm dropping it.
Reported-by: Pavlos Parissis <pavlos.parissis@gmail.com>
Reported-by: Lei Chen <chenl.lei@gmail.com>
Reported-by: Maxime Hadjinlian <maxime.hadjinlian@gmail.com>
Reported-by: Murilo Opsfelder Araujo <muriloo@linux.ibm.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: David Ahern <dsahern@gmail.com>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Wang Nan <wangnan0@huawei.com>
Cc: kernel-team@lge.com
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/perf/tests/code-reading.c | 20 +-------------------
1 file changed, 1 insertion(+), 19 deletions(-)
--- a/tools/perf/tests/code-reading.c
+++ b/tools/perf/tests/code-reading.c
@@ -141,8 +141,6 @@ static int read_object_code(u64 addr, si
unsigned char buf2[BUFSZ];
size_t ret_len;
u64 objdump_addr;
- const char *objdump_name;
- char decomp_name[KMOD_DECOMP_LEN];
int ret;
pr_debug("Reading object code for memory address: %#"PRIx64"\n", addr);
@@ -204,25 +202,9 @@ static int read_object_code(u64 addr, si
state->done[state->done_cnt++] = al.map->start;
}
- objdump_name = al.map->dso->long_name;
- if (dso__needs_decompress(al.map->dso)) {
- if (dso__decompress_kmodule_path(al.map->dso, objdump_name,
- decomp_name,
- sizeof(decomp_name)) < 0) {
- pr_debug("decompression failed\n");
- return -1;
- }
-
- objdump_name = decomp_name;
- }
-
/* Read the object code using objdump */
objdump_addr = map__rip_2objdump(al.map, al.addr);
- ret = read_via_objdump(objdump_name, objdump_addr, buf2, len);
-
- if (dso__needs_decompress(al.map->dso))
- unlink(objdump_name);
-
+ ret = read_via_objdump(al.map->dso->long_name, objdump_addr, buf2, len);
if (ret > 0) {
/*
* The kernel maps are inaccurate - assume objdump is right in
^ permalink raw reply [flat|nested] 32+ messages in thread* Re: [PATCH 3.18 00/25] 3.18.108-stable review
2018-04-30 19:23 [PATCH 3.18 00/25] 3.18.108-stable review Greg Kroah-Hartman
` (24 preceding siblings ...)
2018-04-30 19:23 ` [PATCH 3.18 25/25] Revert "perf tests: Decompress kernel module before objdump" Greg Kroah-Hartman
@ 2018-05-01 1:04 ` kernelci.org bot
2018-05-01 6:14 ` Harsh Shandilya
` (2 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: kernelci.org bot @ 2018-05-01 1:04 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel
Cc: Greg Kroah-Hartman, torvalds, akpm, linux, shuah, patches,
ben.hutchings, lkft-triage, stable
stable-rc/linux-3.18.y boot: 62 boots: 0 failed, 62 passed (v3.18.107-26-g261b9a2d80e9)
Full Boot Summary: https://kernelci.org/boot/all/job/stable-rc/branch/linux-3.18.y/kernel/v3.18.107-26-g261b9a2d80e9/
Full Build Summary: https://kernelci.org/build/stable-rc/branch/linux-3.18.y/kernel/v3.18.107-26-g261b9a2d80e9/
Tree: stable-rc
Branch: linux-3.18.y
Git Describe: v3.18.107-26-g261b9a2d80e9
Git Commit: 261b9a2d80e901dfcaaf4feeaa2b900685f53a96
Git URL: http://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
Tested: 31 unique boards, 12 SoC families, 15 builds out of 183
---
For more info write to <info@kernelci.org>
^ permalink raw reply [flat|nested] 32+ messages in thread* Re: [PATCH 3.18 00/25] 3.18.108-stable review
2018-04-30 19:23 [PATCH 3.18 00/25] 3.18.108-stable review Greg Kroah-Hartman
` (25 preceding siblings ...)
2018-05-01 1:04 ` [PATCH 3.18 00/25] 3.18.108-stable review kernelci.org bot
@ 2018-05-01 6:14 ` Harsh Shandilya
2018-05-01 15:02 ` Greg Kroah-Hartman
2018-05-01 13:18 ` Guenter Roeck
2018-05-01 19:04 ` Shuah Khan
28 siblings, 1 reply; 32+ messages in thread
From: Harsh Shandilya @ 2018-05-01 6:14 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel
Cc: torvalds, akpm, linux, shuah, patches, ben.hutchings,
lkft-triage, stable
On 1 May 2018 12:53:07 AM IST, Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote:
>This is the start of the stable review cycle for the 3.18.108 release.
>There are 25 patches in this series, all will be posted as a response
>to this one. If anyone has any issues with these being applied, please
>let me know.
>
>Responses should be made by Wed May 2 18:39:02 UTC 2018.
>Anything received after that time might be too late.
>
>The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v3.x/stable-review/patch-3.18.108-rc1.gz
>or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
>linux-3.18.y
>and the diffstat can be found below.
>
>thanks,
>
>greg k-h
Builds and boots on the OnePlus3T, no immediate regressions. Thanks for the update!
--
Harsh Shandilya, PRJKT Development LLC
^ permalink raw reply [flat|nested] 32+ messages in thread* Re: [PATCH 3.18 00/25] 3.18.108-stable review
2018-05-01 6:14 ` Harsh Shandilya
@ 2018-05-01 15:02 ` Greg Kroah-Hartman
0 siblings, 0 replies; 32+ messages in thread
From: Greg Kroah-Hartman @ 2018-05-01 15:02 UTC (permalink / raw)
To: Harsh Shandilya
Cc: linux-kernel, torvalds, akpm, linux, shuah, patches,
ben.hutchings, lkft-triage, stable
On Tue, May 01, 2018 at 11:44:52AM +0530, Harsh Shandilya wrote:
> On 1 May 2018 12:53:07 AM IST, Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote:
> >This is the start of the stable review cycle for the 3.18.108 release.
> >There are 25 patches in this series, all will be posted as a response
> >to this one. If anyone has any issues with these being applied, please
> >let me know.
> >
> >Responses should be made by Wed May 2 18:39:02 UTC 2018.
> >Anything received after that time might be too late.
> >
> >The whole patch series can be found in one patch at:
> > https://www.kernel.org/pub/linux/kernel/v3.x/stable-review/patch-3.18.108-rc1.gz
> >or in the git tree and branch at:
> > git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
> >linux-3.18.y
> >and the diffstat can be found below.
> >
> >thanks,
> >
> >greg k-h
> Builds and boots on the OnePlus3T, no immediate regressions. Thanks for the update!
thanks for testing!
greg k-h
^ permalink raw reply [flat|nested] 32+ messages in thread
* Re: [PATCH 3.18 00/25] 3.18.108-stable review
2018-04-30 19:23 [PATCH 3.18 00/25] 3.18.108-stable review Greg Kroah-Hartman
` (26 preceding siblings ...)
2018-05-01 6:14 ` Harsh Shandilya
@ 2018-05-01 13:18 ` Guenter Roeck
2018-05-01 15:02 ` Greg Kroah-Hartman
2018-05-01 19:04 ` Shuah Khan
28 siblings, 1 reply; 32+ messages in thread
From: Guenter Roeck @ 2018-05-01 13:18 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel
Cc: torvalds, akpm, shuah, patches, ben.hutchings, lkft-triage, stable
On 04/30/2018 12:23 PM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 3.18.108 release.
> There are 25 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed May 2 18:39:02 UTC 2018.
> Anything received after that time might be too late.
>
Build results:
total: 136 pass: 136 fail: 0
Qemu test results:
total: 119 pass: 119 fail: 0
Details are available at http://kerneltests.org/builders.
Guenter
^ permalink raw reply [flat|nested] 32+ messages in thread* Re: [PATCH 3.18 00/25] 3.18.108-stable review
2018-05-01 13:18 ` Guenter Roeck
@ 2018-05-01 15:02 ` Greg Kroah-Hartman
0 siblings, 0 replies; 32+ messages in thread
From: Greg Kroah-Hartman @ 2018-05-01 15:02 UTC (permalink / raw)
To: Guenter Roeck
Cc: linux-kernel, torvalds, akpm, shuah, patches, ben.hutchings,
lkft-triage, stable
On Tue, May 01, 2018 at 06:18:45AM -0700, Guenter Roeck wrote:
> On 04/30/2018 12:23 PM, Greg Kroah-Hartman wrote:
> > This is the start of the stable review cycle for the 3.18.108 release.
> > There are 25 patches in this series, all will be posted as a response
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
> >
> > Responses should be made by Wed May 2 18:39:02 UTC 2018.
> > Anything received after that time might be too late.
> >
>
> Build results:
> total: 136 pass: 136 fail: 0
> Qemu test results:
> total: 119 pass: 119 fail: 0
>
> Details are available at http://kerneltests.org/builders.
Great, thanks for letting me know and testing all of these.
greg k-h
^ permalink raw reply [flat|nested] 32+ messages in thread
* Re: [PATCH 3.18 00/25] 3.18.108-stable review
2018-04-30 19:23 [PATCH 3.18 00/25] 3.18.108-stable review Greg Kroah-Hartman
` (27 preceding siblings ...)
2018-05-01 13:18 ` Guenter Roeck
@ 2018-05-01 19:04 ` Shuah Khan
28 siblings, 0 replies; 32+ messages in thread
From: Shuah Khan @ 2018-05-01 19:04 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel
Cc: torvalds, akpm, linux, patches, ben.hutchings, lkft-triage,
stable, Shuah Khan
On 04/30/2018 01:23 PM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 3.18.108 release.
> There are 25 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed May 2 18:39:02 UTC 2018.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v3.x/stable-review/patch-3.18.108-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-3.18.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
^ permalink raw reply [flat|nested] 32+ messages in thread