* [PATCH 3.18 01/85] tracing: Fix double free of event_trigger_data
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
@ 2018-08-07 18:51 ` Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 3.18 02/85] tracing: Fix possible double free in event_enable_trigger_func() Greg Kroah-Hartman
` (80 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, stable, Masami Hiramatsu,
Steven Rostedt (VMware)
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt (VMware) <rostedt@goodmis.org>
commit 1863c387259b629e4ebfb255495f67cd06aa229b upstream.
Running the following:
# cd /sys/kernel/debug/tracing
# echo 500000 > buffer_size_kb
[ Or some other number that takes up most of memory ]
# echo snapshot > events/sched/sched_switch/trigger
Triggers the following bug:
------------[ cut here ]------------
kernel BUG at mm/slub.c:296!
invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC PTI
CPU: 6 PID: 6878 Comm: bash Not tainted 4.18.0-rc6-test+ #1066
Hardware name: Hewlett-Packard HP Compaq Pro 6300 SFF/339A, BIOS K01 v03.03 07/14/2016
RIP: 0010:kfree+0x16c/0x180
Code: 05 41 0f b6 72 51 5b 5d 41 5c 4c 89 d7 e9 ac b3 f8 ff 48 89 d9 48 89 da 41 b8 01 00 00 00 5b 5d 41 5c 4c 89 d6 e9 f4 f3 ff ff <0f> 0b 0f 0b 48 8b 3d d9 d8 f9 00 e9 c1 fe ff ff 0f 1f 40 00 0f 1f
RSP: 0018:ffffb654436d3d88 EFLAGS: 00010246
RAX: ffff91a9d50f3d80 RBX: ffff91a9d50f3d80 RCX: ffff91a9d50f3d80
RDX: 00000000000006a4 RSI: ffff91a9de5a60e0 RDI: ffff91a9d9803500
RBP: ffffffff8d267c80 R08: 00000000000260e0 R09: ffffffff8c1a56be
R10: fffff0d404543cc0 R11: 0000000000000389 R12: ffffffff8c1a56be
R13: ffff91a9d9930e18 R14: ffff91a98c0c2890 R15: ffffffff8d267d00
FS: 00007f363ea64700(0000) GS:ffff91a9de580000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055c1cacc8e10 CR3: 00000000d9b46003 CR4: 00000000001606e0
Call Trace:
event_trigger_callback+0xee/0x1d0
event_trigger_write+0xfc/0x1a0
__vfs_write+0x33/0x190
? handle_mm_fault+0x115/0x230
? _cond_resched+0x16/0x40
vfs_write+0xb0/0x190
ksys_write+0x52/0xc0
do_syscall_64+0x5a/0x160
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f363e16ab50
Code: 73 01 c3 48 8b 0d 38 83 2c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 79 db 2c 00 00 75 10 b8 01 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 1e e3 01 00 48 89 04 24
RSP: 002b:00007fff9a4c6378 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 00007f363e16ab50
RDX: 0000000000000009 RSI: 000055c1cacc8e10 RDI: 0000000000000001
RBP: 000055c1cacc8e10 R08: 00007f363e435740 R09: 00007f363ea64700
R10: 0000000000000073 R11: 0000000000000246 R12: 0000000000000009
R13: 0000000000000001 R14: 00007f363e4345e0 R15: 00007f363e4303c0
Modules linked in: ip6table_filter ip6_tables snd_hda_codec_hdmi snd_hda_codec_realtek snd_hda_codec_generic snd_hda_intel snd_hda_codec snd_hwdep snd_hda_core snd_seq snd_seq_device i915 snd_pcm snd_timer i2c_i801 snd soundcore i2c_algo_bit drm_kms_helper
86_pkg_temp_thermal video kvm_intel kvm irqbypass wmi e1000e
---[ end trace d301afa879ddfa25 ]---
The cause is because the register_snapshot_trigger() call failed to
allocate the snapshot buffer, and then called unregister_trigger()
which freed the data that was passed to it. Then on return to the
function that called register_snapshot_trigger(), as it sees it
failed to register, it frees the trigger_data again and causes
a double free.
By calling event_trigger_init() on the trigger_data (which only ups
the reference counter for it), and then event_trigger_free() afterward,
the trigger_data would not get freed by the registering trigger function
as it would only up and lower the ref count for it. If the register
trigger function fails, then the event_trigger_free() called after it
will free the trigger data normally.
Link: http://lkml.kernel.org/r/20180724191331.738eb819@gandalf.local.home
Cc: stable@vger.kerne.org
Fixes: 93e31ffbf417 ("tracing: Add 'snapshot' event trigger command")
Reported-by: Masami Hiramatsu <mhiramat@kernel.org>
Reviewed-by: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/trace_events_trigger.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
--- a/kernel/trace/trace_events_trigger.c
+++ b/kernel/trace/trace_events_trigger.c
@@ -663,6 +663,8 @@ event_trigger_callback(struct event_comm
goto out_free;
out_reg:
+ /* Up the trigger_data count to make sure reg doesn't free it on failure */
+ event_trigger_init(trigger_ops, trigger_data);
ret = cmd_ops->reg(glob, trigger_ops, trigger_data, file);
/*
* The above returns on success the # of functions enabled,
@@ -670,11 +672,13 @@ event_trigger_callback(struct event_comm
* Consider no functions a failure too.
*/
if (!ret) {
+ cmd_ops->unreg(glob, trigger_ops, trigger_data, file);
ret = -ENOENT;
- goto out_free;
- } else if (ret < 0)
- goto out_free;
- ret = 0;
+ } else if (ret > 0)
+ ret = 0;
+
+ /* Down the counter of trigger_data or free it if not used anymore */
+ event_trigger_free(trigger_ops, trigger_data);
out:
return ret;
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 02/85] tracing: Fix possible double free in event_enable_trigger_func()
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 3.18 01/85] tracing: Fix double free of event_trigger_data Greg Kroah-Hartman
@ 2018-08-07 18:51 ` Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 3.18 03/85] tracing/kprobes: Fix trace_probe flags on enable_trace_kprobe() failure Greg Kroah-Hartman
` (79 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:51 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Steven Rostedt (VMware)
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt (VMware) <rostedt@goodmis.org>
commit 15cc78644d0075e76d59476a4467e7143860f660 upstream.
There was a case that triggered a double free in event_trigger_callback()
due to the called reg() function freeing the trigger_data and then it
getting freed again by the error return by the caller. The solution there
was to up the trigger_data ref count.
Code inspection found that event_enable_trigger_func() has the same issue,
but is not as easy to trigger (requires harder to trigger failures). It
needs to be solved slightly different as it needs more to clean up when the
reg() function fails.
Link: http://lkml.kernel.org/r/20180725124008.7008e586@gandalf.local.home
Cc: stable@vger.kernel.org
Fixes: 7862ad1846e99 ("tracing: Add 'enable_event' and 'disable_event' event trigger commands")
Reivewed-by: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/trace_events_trigger.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/kernel/trace/trace_events_trigger.c
+++ b/kernel/trace/trace_events_trigger.c
@@ -1231,6 +1231,9 @@ event_enable_trigger_func(struct event_c
goto out;
}
+ /* Up the trigger_data count to make sure nothing frees it on failure */
+ event_trigger_init(trigger_ops, trigger_data);
+
if (trigger) {
number = strsep(&trigger, ":");
@@ -1281,6 +1284,7 @@ event_enable_trigger_func(struct event_c
goto out_disable;
/* Just return zero, not the number of enabled functions */
ret = 0;
+ event_trigger_free(trigger_ops, trigger_data);
out:
return ret;
@@ -1291,7 +1295,7 @@ event_enable_trigger_func(struct event_c
out_free:
if (cmd_ops->set_filter)
cmd_ops->set_filter(NULL, trigger_data, NULL);
- kfree(trigger_data);
+ event_trigger_free(trigger_ops, trigger_data);
kfree(enable_data);
goto out;
}
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 03/85] tracing/kprobes: Fix trace_probe flags on enable_trace_kprobe() failure
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 3.18 01/85] tracing: Fix double free of event_trigger_data Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 3.18 02/85] tracing: Fix possible double free in event_enable_trigger_func() Greg Kroah-Hartman
@ 2018-08-07 18:51 ` Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 3.18 04/85] tracing: Quiet gcc warning about maybe unused link variable Greg Kroah-Hartman
` (78 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ingo Molnar, Masami Hiramatsu,
Josh Poimboeuf, Artem Savkov, Steven Rostedt (VMware)
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Artem Savkov <asavkov@redhat.com>
commit 57ea2a34adf40f3a6e88409aafcf803b8945619a upstream.
If enable_trace_kprobe fails to enable the probe in enable_k(ret)probe
it returns an error, but does not unset the tp flags it set previously.
This results in a probe being considered enabled and failures like being
unable to remove the probe through kprobe_events file since probes_open()
expects every probe to be disabled.
Link: http://lkml.kernel.org/r/20180725102826.8300-1-asavkov@redhat.com
Link: http://lkml.kernel.org/r/20180725142038.4765-1-asavkov@redhat.com
Cc: Ingo Molnar <mingo@redhat.com>
Cc: stable@vger.kernel.org
Fixes: 41a7dd420c57 ("tracing/kprobes: Support ftrace_event_file base multibuffer")
Acked-by: Masami Hiramatsu <mhiramat@kernel.org>
Reviewed-by: Josh Poimboeuf <jpoimboe@redhat.com>
Signed-off-by: Artem Savkov <asavkov@redhat.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/trace_kprobe.c | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
--- a/kernel/trace/trace_kprobe.c
+++ b/kernel/trace/trace_kprobe.c
@@ -361,11 +361,10 @@ static struct trace_kprobe *find_trace_k
static int
enable_trace_kprobe(struct trace_kprobe *tk, struct ftrace_event_file *file)
{
+ struct event_file_link *link;
int ret = 0;
if (file) {
- struct event_file_link *link;
-
link = kmalloc(sizeof(*link), GFP_KERNEL);
if (!link) {
ret = -ENOMEM;
@@ -385,6 +384,16 @@ enable_trace_kprobe(struct trace_kprobe
else
ret = enable_kprobe(&tk->rp.kp);
}
+
+ if (ret) {
+ if (file) {
+ list_del_rcu(&link->list);
+ kfree(link);
+ tk->tp.flags &= ~TP_FLAG_TRACE;
+ } else {
+ tk->tp.flags &= ~TP_FLAG_PROFILE;
+ }
+ }
out:
return ret;
}
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 04/85] tracing: Quiet gcc warning about maybe unused link variable
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (2 preceding siblings ...)
2018-08-07 18:51 ` [PATCH 3.18 03/85] tracing/kprobes: Fix trace_probe flags on enable_trace_kprobe() failure Greg Kroah-Hartman
@ 2018-08-07 18:51 ` Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 3.18 05/85] ALSA: emu10k1: add error handling for snd_ctl_add Greg Kroah-Hartman
` (77 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, kbuild test robot, Steven Rostedt (VMware)
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt (VMware) <rostedt@goodmis.org>
commit 2519c1bbe38d7acacc9aacba303ca6f97482ed53 upstream.
Commit 57ea2a34adf4 ("tracing/kprobes: Fix trace_probe flags on
enable_trace_kprobe() failure") added an if statement that depends on another
if statement that gcc doesn't see will initialize the "link" variable and
gives the warning:
"warning: 'link' may be used uninitialized in this function"
It is really a false positive, but to quiet the warning, and also to make
sure that it never actually is used uninitialized, initialize the "link"
variable to NULL and add an if (!WARN_ON_ONCE(!link)) where the compiler
thinks it could be used uninitialized.
Cc: stable@vger.kernel.org
Fixes: 57ea2a34adf4 ("tracing/kprobes: Fix trace_probe flags on enable_trace_kprobe() failure")
Reported-by: kbuild test robot <lkp@intel.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/trace_kprobe.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/kernel/trace/trace_kprobe.c
+++ b/kernel/trace/trace_kprobe.c
@@ -361,7 +361,7 @@ static struct trace_kprobe *find_trace_k
static int
enable_trace_kprobe(struct trace_kprobe *tk, struct ftrace_event_file *file)
{
- struct event_file_link *link;
+ struct event_file_link *link = NULL;
int ret = 0;
if (file) {
@@ -387,7 +387,9 @@ enable_trace_kprobe(struct trace_kprobe
if (ret) {
if (file) {
- list_del_rcu(&link->list);
+ /* Notice the if is true on not WARN() */
+ if (!WARN_ON_ONCE(!link))
+ list_del_rcu(&link->list);
kfree(link);
tk->tp.flags &= ~TP_FLAG_TRACE;
} else {
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 05/85] ALSA: emu10k1: add error handling for snd_ctl_add
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (3 preceding siblings ...)
2018-08-07 18:51 ` [PATCH 3.18 04/85] tracing: Quiet gcc warning about maybe unused link variable Greg Kroah-Hartman
@ 2018-08-07 18:51 ` Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 3.18 06/85] ALSA: fm801: " Greg Kroah-Hartman
` (76 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Zhouyang Jia, Takashi Iwai, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhouyang Jia <jiazhouyang09@gmail.com>
[ Upstream commit 6d531e7b972cb62ded011c2dfcc2d9f72ea6c421 ]
When snd_ctl_add fails, the lack of error-handling code may
cause unexpected results.
This patch adds error-handling code after calling snd_ctl_add.
Signed-off-by: Zhouyang Jia <jiazhouyang09@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/emu10k1/emupcm.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/sound/pci/emu10k1/emupcm.c
+++ b/sound/pci/emu10k1/emupcm.c
@@ -1875,7 +1875,9 @@ int snd_emu10k1_pcm_efx(struct snd_emu10
if (!kctl)
return -ENOMEM;
kctl->id.device = device;
- snd_ctl_add(emu->card, kctl);
+ err = snd_ctl_add(emu->card, kctl);
+ if (err < 0)
+ return err;
snd_pcm_lib_preallocate_pages_for_all(pcm, SNDRV_DMA_TYPE_DEV, snd_dma_pci_data(emu->pci), 64*1024, 64*1024);
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 06/85] ALSA: fm801: add error handling for snd_ctl_add
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (4 preceding siblings ...)
2018-08-07 18:51 ` [PATCH 3.18 05/85] ALSA: emu10k1: add error handling for snd_ctl_add Greg Kroah-Hartman
@ 2018-08-07 18:51 ` Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 3.18 07/85] mm: vmalloc: avoid racy handling of debugobjects in vunmap Greg Kroah-Hartman
` (75 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Zhouyang Jia, Andy Shevchenko,
Takashi Iwai, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhouyang Jia <jiazhouyang09@gmail.com>
[ Upstream commit ef1ffbe7889e99f5b5cccb41c89e5c94f50f3218 ]
When snd_ctl_add fails, the lack of error-handling code may
cause unexpected results.
This patch adds error-handling code after calling snd_ctl_add.
Signed-off-by: Zhouyang Jia <jiazhouyang09@gmail.com>
Acked-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/fm801.c | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)
--- a/sound/pci/fm801.c
+++ b/sound/pci/fm801.c
@@ -1070,11 +1070,19 @@ static int snd_fm801_mixer(struct fm801
if ((err = snd_ac97_mixer(chip->ac97_bus, &ac97, &chip->ac97_sec)) < 0)
return err;
}
- for (i = 0; i < FM801_CONTROLS; i++)
- snd_ctl_add(chip->card, snd_ctl_new1(&snd_fm801_controls[i], chip));
+ for (i = 0; i < FM801_CONTROLS; i++) {
+ err = snd_ctl_add(chip->card,
+ snd_ctl_new1(&snd_fm801_controls[i], chip));
+ if (err < 0)
+ return err;
+ }
if (chip->multichannel) {
- for (i = 0; i < FM801_CONTROLS_MULTI; i++)
- snd_ctl_add(chip->card, snd_ctl_new1(&snd_fm801_controls_multi[i], chip));
+ for (i = 0; i < FM801_CONTROLS_MULTI; i++) {
+ err = snd_ctl_add(chip->card,
+ snd_ctl_new1(&snd_fm801_controls_multi[i], chip));
+ if (err < 0)
+ return err;
+ }
}
return 0;
}
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 07/85] mm: vmalloc: avoid racy handling of debugobjects in vunmap
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (5 preceding siblings ...)
2018-08-07 18:51 ` [PATCH 3.18 06/85] ALSA: fm801: " Greg Kroah-Hartman
@ 2018-08-07 18:51 ` Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 3.18 08/85] mm/slub.c: add __printf verification to slab_err() Greg Kroah-Hartman
` (74 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Chintan Pandya, Andrew Morton,
Ard Biesheuvel, Byungchul Park, Catalin Marinas,
Florian Fainelli, Johannes Weiner, Laura Abbott, Vlastimil Babka,
Wei Yang, Yisheng Xie, Linus Torvalds, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chintan Pandya <cpandya@codeaurora.org>
[ Upstream commit f3c01d2f3ade6790db67f80fef60df84424f8964 ]
Currently, __vunmap flow is,
1) Release the VM area
2) Free the debug objects corresponding to that vm area.
This leave some race window open.
1) Release the VM area
1.5) Some other client gets the same vm area
1.6) This client allocates new debug objects on the same
vm area
2) Free the debug objects corresponding to this vm area.
Here, we actually free 'other' client's debug objects.
Fix this by freeing the debug objects first and then releasing the VM
area.
Link: http://lkml.kernel.org/r/1523961828-9485-2-git-send-email-cpandya@codeaurora.org
Signed-off-by: Chintan Pandya <cpandya@codeaurora.org>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Byungchul Park <byungchul.park@lge.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Florian Fainelli <f.fainelli@gmail.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Laura Abbott <labbott@redhat.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Wei Yang <richard.weiyang@gmail.com>
Cc: Yisheng Xie <xieyisheng1@huawei.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/vmalloc.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -1440,7 +1440,7 @@ static void __vunmap(const void *addr, i
addr))
return;
- area = remove_vm_area(addr);
+ area = find_vmap_area((unsigned long)addr)->vm;
if (unlikely(!area)) {
WARN(1, KERN_ERR "Trying to vfree() nonexistent vm area (%p)\n",
addr);
@@ -1450,6 +1450,7 @@ static void __vunmap(const void *addr, i
debug_check_no_locks_freed(addr, area->size);
debug_check_no_obj_freed(addr, area->size);
+ remove_vm_area(addr);
if (deallocate_pages) {
int i;
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 08/85] mm/slub.c: add __printf verification to slab_err()
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (6 preceding siblings ...)
2018-08-07 18:51 ` [PATCH 3.18 07/85] mm: vmalloc: avoid racy handling of debugobjects in vunmap Greg Kroah-Hartman
@ 2018-08-07 18:51 ` Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 3.18 09/85] rtc: ensure rtc_set_alarm fails when alarms are not supported Greg Kroah-Hartman
` (73 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mathieu Malaterre, Andrew Morton,
Christoph Lameter, Pekka Enberg, David Rientjes, Joonsoo Kim,
Linus Torvalds, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathieu Malaterre <malat@debian.org>
[ Upstream commit a38965bf941b7c2af50de09c96bc5f03e136caef ]
__printf is useful to verify format and arguments. Remove the following
warning (with W=1):
mm/slub.c:721:2: warning: function might be possible candidate for `gnu_printf' format attribute [-Wsuggest-attribute=format]
Link: http://lkml.kernel.org/r/20180505200706.19986-1-malat@debian.org
Signed-off-by: Mathieu Malaterre <malat@debian.org>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Christoph Lameter <cl@linux.com>
Cc: Pekka Enberg <penberg@kernel.org>
Cc: David Rientjes <rientjes@google.com>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/slub.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -636,7 +636,7 @@ static void object_err(struct kmem_cache
print_trailer(s, page, object);
}
-static void slab_err(struct kmem_cache *s, struct page *page,
+static __printf(3, 4) void slab_err(struct kmem_cache *s, struct page *page,
const char *fmt, ...)
{
va_list args;
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 09/85] rtc: ensure rtc_set_alarm fails when alarms are not supported
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (7 preceding siblings ...)
2018-08-07 18:51 ` [PATCH 3.18 08/85] mm/slub.c: add __printf verification to slab_err() Greg Kroah-Hartman
@ 2018-08-07 18:51 ` Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 3.18 10/85] infiniband: fix a possible use-after-free bug Greg Kroah-Hartman
` (72 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:51 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alexandre Belloni, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandre Belloni <alexandre.belloni@bootlin.com>
[ Upstream commit abfdff44bc38e9e2ef7929f633fb8462632299d4 ]
When using RTC_ALM_SET or RTC_WKALM_SET with rtc_wkalrm.enabled not set,
rtc_timer_enqueue() is not called and rtc_set_alarm() may succeed but the
subsequent RTC_AIE_ON ioctl will fail. RTC_ALM_READ would also fail in that
case.
Ensure rtc_set_alarm() fails when alarms are not supported to avoid letting
programs think the alarms are working for a particular RTC when they are
not.
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/rtc/interface.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/rtc/interface.c
+++ b/drivers/rtc/interface.c
@@ -381,6 +381,11 @@ int rtc_set_alarm(struct rtc_device *rtc
{
int err;
+ if (!rtc->ops)
+ return -ENODEV;
+ else if (!rtc->ops->set_alarm)
+ return -EINVAL;
+
err = rtc_valid_tm(&alarm->time);
if (err != 0)
return err;
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 10/85] infiniband: fix a possible use-after-free bug
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (8 preceding siblings ...)
2018-08-07 18:51 ` [PATCH 3.18 09/85] rtc: ensure rtc_set_alarm fails when alarms are not supported Greg Kroah-Hartman
@ 2018-08-07 18:51 ` Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 3.18 11/85] hvc_opal: dont set tb_ticks_per_usec in udbg_init_opal_common() Greg Kroah-Hartman
` (71 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Noam Rathaus, Cong Wang,
Jason Gunthorpe, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cong Wang <xiyou.wangcong@gmail.com>
[ Upstream commit cb2595c1393b4a5211534e6f0a0fbad369e21ad8 ]
ucma_process_join() will free the new allocated "mc" struct,
if there is any error after that, especially the copy_to_user().
But in parallel, ucma_leave_multicast() could find this "mc"
through idr_find() before ucma_process_join() frees it, since it
is already published.
So "mc" could be used in ucma_leave_multicast() after it is been
allocated and freed in ucma_process_join(), since we don't refcnt
it.
Fix this by separating "publish" from ID allocation, so that we
can get an ID first and publish it later after copy_to_user().
Fixes: c8f6a362bf3e ("RDMA/cma: Add multicast communication support")
Reported-by: Noam Rathaus <noamr@beyondsecurity.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/core/ucma.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/drivers/infiniband/core/ucma.c
+++ b/drivers/infiniband/core/ucma.c
@@ -180,7 +180,7 @@ static struct ucma_multicast* ucma_alloc
return NULL;
mutex_lock(&mut);
- mc->id = idr_alloc(&multicast_idr, mc, 0, 0, GFP_KERNEL);
+ mc->id = idr_alloc(&multicast_idr, NULL, 0, 0, GFP_KERNEL);
mutex_unlock(&mut);
if (mc->id < 0)
goto error;
@@ -1262,6 +1262,10 @@ static ssize_t ucma_process_join(struct
goto err3;
}
+ mutex_lock(&mut);
+ idr_replace(&multicast_idr, mc, mc->id);
+ mutex_unlock(&mut);
+
mutex_unlock(&file->mut);
ucma_put_ctx(ctx);
return 0;
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 11/85] hvc_opal: dont set tb_ticks_per_usec in udbg_init_opal_common()
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (9 preceding siblings ...)
2018-08-07 18:51 ` [PATCH 3.18 10/85] infiniband: fix a possible use-after-free bug Greg Kroah-Hartman
@ 2018-08-07 18:51 ` Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 3.18 12/85] RDMA/mad: Convert BUG_ONs to error flows Greg Kroah-Hartman
` (70 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Stewart Smith, Michael Ellerman, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stewart Smith <stewart@linux.ibm.com>
[ Upstream commit 447808bf500a7cc92173266a59f8a494e132b122 ]
time_init() will set up tb_ticks_per_usec based on reality.
time_init() is called *after* udbg_init_opal_common() during boot.
from arch/powerpc/kernel/time.c:
unsigned long tb_ticks_per_usec = 100; /* sane default */
Currently, all powernv systems have a timebase frequency of 512mhz
(512000000/1000000 == 0x200) - although there's nothing written
down anywhere that I can find saying that we couldn't make that
different based on the requirements in the ISA.
So, we've been (accidentally) thwacking the (currently) correct
(for powernv at least) value for tb_ticks_per_usec earlier than
we otherwise would have.
The "sane default" seems to be adequate for our purposes between
udbg_init_opal_common() and time_init() being called, and if it isn't,
then we should probably be setting it somewhere that isn't hvc_opal.c!
Signed-off-by: Stewart Smith <stewart@linux.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/hvc/hvc_opal.c | 1 -
1 file changed, 1 deletion(-)
--- a/drivers/tty/hvc/hvc_opal.c
+++ b/drivers/tty/hvc/hvc_opal.c
@@ -337,7 +337,6 @@ static void udbg_init_opal_common(void)
udbg_putc = udbg_opal_putc;
udbg_getc = udbg_opal_getc;
udbg_getc_poll = udbg_opal_getc_poll;
- tb_ticks_per_usec = 0x200; /* Make udelay not suck */
}
void __init hvc_opal_init_early(void)
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 12/85] RDMA/mad: Convert BUG_ONs to error flows
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (10 preceding siblings ...)
2018-08-07 18:51 ` [PATCH 3.18 11/85] hvc_opal: dont set tb_ticks_per_usec in udbg_init_opal_common() Greg Kroah-Hartman
@ 2018-08-07 18:51 ` Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 3.18 13/85] usbip: usbip_detach: Fix memory, udev context and udev leak Greg Kroah-Hartman
` (69 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Leon Romanovsky, Doug Ledford, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <leonro@mellanox.com>
[ Upstream commit 2468b82d69e3a53d024f28d79ba0fdb8bf43dfbf ]
Let's perform checks in-place instead of BUG_ONs.
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/core/mad.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
--- a/drivers/infiniband/core/mad.c
+++ b/drivers/infiniband/core/mad.c
@@ -1466,7 +1466,8 @@ static int add_oui_reg_req(struct ib_mad
mad_reg_req->oui, 3)) {
method = &(*vendor_table)->vendor_class[
vclass]->method_table[i];
- BUG_ON(!*method);
+ if (!*method)
+ goto error3;
goto check_in_use;
}
}
@@ -1476,10 +1477,12 @@ static int add_oui_reg_req(struct ib_mad
vclass]->oui[i])) {
method = &(*vendor_table)->vendor_class[
vclass]->method_table[i];
- BUG_ON(*method);
/* Allocate method table for this OUI */
- if ((ret = allocate_method_table(method)))
- goto error3;
+ if (!*method) {
+ ret = allocate_method_table(method);
+ if (ret)
+ goto error3;
+ }
memcpy((*vendor_table)->vendor_class[vclass]->oui[i],
mad_reg_req->oui, 3);
goto check_in_use;
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 13/85] usbip: usbip_detach: Fix memory, udev context and udev leak
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (11 preceding siblings ...)
2018-08-07 18:51 ` [PATCH 3.18 12/85] RDMA/mad: Convert BUG_ONs to error flows Greg Kroah-Hartman
@ 2018-08-07 18:51 ` Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 3.18 14/85] perf/x86/intel/uncore: Correct fixed counter index check in generic code Greg Kroah-Hartman
` (68 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Shuah Khan (Samsung OSG), Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Shuah Khan (Samsung OSG)" <shuah@kernel.org>
[ Upstream commit d179f99a651685b19333360e6558110da2fe9bd7 ]
detach_port() fails to call usbip_vhci_driver_close() from its error
path after usbip_vhci_detach_device() returns failure, leaking memory
allocated in usbip_vhci_driver_open() and holding udev_context and udev
references. Fix it to call usbip_vhci_driver_close().
Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/usb/usbip/src/usbip_detach.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
--- a/tools/usb/usbip/src/usbip_detach.c
+++ b/tools/usb/usbip/src/usbip_detach.c
@@ -43,7 +43,7 @@ void usbip_detach_usage(void)
static int detach_port(char *port)
{
- int ret;
+ int ret = 0;
uint8_t portnum;
char path[PATH_MAX+1];
@@ -71,9 +71,12 @@ static int detach_port(char *port)
}
ret = usbip_vhci_detach_device(portnum);
- if (ret < 0)
- return -1;
+ if (ret < 0) {
+ ret = -1;
+ goto call_driver_close;
+ }
+call_driver_close:
usbip_vhci_driver_close();
return ret;
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 14/85] perf/x86/intel/uncore: Correct fixed counter index check in generic code
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (12 preceding siblings ...)
2018-08-07 18:51 ` [PATCH 3.18 13/85] usbip: usbip_detach: Fix memory, udev context and udev leak Greg Kroah-Hartman
@ 2018-08-07 18:51 ` Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 3.18 15/85] perf/x86/intel/uncore: Correct fixed counter index check for NHM Greg Kroah-Hartman
` (67 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Kan Liang, Peter Zijlstra (Intel),
Thomas Gleixner, Linus Torvalds, acme, eranian, Ingo Molnar,
Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kan Liang <kan.liang@intel.com>
[ Upstream commit 4749f8196452eeb73cf2086a6a9705bae479d33d ]
There is no index which is bigger than UNCORE_PMC_IDX_FIXED. The only
exception is client IMC uncore, which has been specially handled.
For generic code, it is not correct to use >= to check fixed counter.
The code quality issue will bring problem when a new counter index is
introduced.
Signed-off-by: Kan Liang <kan.liang@intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: acme@kernel.org
Cc: eranian@google.com
Link: http://lkml.kernel.org/r/1525371913-10597-3-git-send-email-kan.liang@intel.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/cpu/perf_event_intel_uncore.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/x86/kernel/cpu/perf_event_intel_uncore.c
+++ b/arch/x86/kernel/cpu/perf_event_intel_uncore.c
@@ -175,7 +175,7 @@ void uncore_perf_event_update(struct int
u64 prev_count, new_count, delta;
int shift;
- if (event->hw.idx >= UNCORE_PMC_IDX_FIXED)
+ if (event->hw.idx == UNCORE_PMC_IDX_FIXED)
shift = 64 - uncore_fixed_ctr_bits(box);
else
shift = 64 - uncore_perf_ctr_bits(box);
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 15/85] perf/x86/intel/uncore: Correct fixed counter index check for NHM
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (13 preceding siblings ...)
2018-08-07 18:51 ` [PATCH 3.18 14/85] perf/x86/intel/uncore: Correct fixed counter index check in generic code Greg Kroah-Hartman
@ 2018-08-07 18:51 ` Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 3.18 16/85] ASoC: dpcm: fix BE dai not hw_free and shutdown Greg Kroah-Hartman
` (66 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Kan Liang, Peter Zijlstra (Intel),
Thomas Gleixner, Linus Torvalds, acme, eranian, Ingo Molnar,
Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kan Liang <kan.liang@intel.com>
[ Upstream commit d71f11c076c420c4e2fceb4faefa144e055e0935 ]
For Nehalem and Westmere, there is only one fixed counter for W-Box.
There is no index which is bigger than UNCORE_PMC_IDX_FIXED.
It is not correct to use >= to check fixed counter.
The code quality issue will bring problem when new counter index is
introduced.
Signed-off-by: Kan Liang <kan.liang@intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: acme@kernel.org
Cc: eranian@google.com
Link: http://lkml.kernel.org/r/1525371913-10597-2-git-send-email-kan.liang@intel.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/cpu/perf_event_intel_uncore_nhmex.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/x86/kernel/cpu/perf_event_intel_uncore_nhmex.c
+++ b/arch/x86/kernel/cpu/perf_event_intel_uncore_nhmex.c
@@ -240,7 +240,7 @@ static void nhmex_uncore_msr_enable_even
{
struct hw_perf_event *hwc = &event->hw;
- if (hwc->idx >= UNCORE_PMC_IDX_FIXED)
+ if (hwc->idx == UNCORE_PMC_IDX_FIXED)
wrmsrl(hwc->config_base, NHMEX_PMON_CTL_EN_BIT0);
else if (box->pmu->type->event_mask & NHMEX_PMON_CTL_EN_BIT0)
wrmsrl(hwc->config_base, hwc->config | NHMEX_PMON_CTL_EN_BIT22);
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 16/85] ASoC: dpcm: fix BE dai not hw_free and shutdown
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (14 preceding siblings ...)
2018-08-07 18:51 ` [PATCH 3.18 15/85] perf/x86/intel/uncore: Correct fixed counter index check for NHM Greg Kroah-Hartman
@ 2018-08-07 18:51 ` Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 3.18 17/85] mwifiex: handle race during mwifiex_usb_disconnect Greg Kroah-Hartman
` (65 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, KaiChieh Chuang, Mark Brown, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kai Chieh Chuang <kaichieh.chuang@mediatek.com>
[ Upstream commit 9c0ac70ad24d76b873c1551e27790c7f6a815d5c ]
In case, one BE is used by two FE1/FE2
FE1--->BE-->
|
FE2----]
when FE1/FE2 call dpcm_be_dai_hw_free() together
the BE users will be 2 (> 1), hence cannot be hw_free
the be state will leave at, ex. SND_SOC_DPCM_STATE_STOP
later FE1/FE2 call dpcm_be_dai_shutdown(),
will be skip due to wrong state.
leaving the BE not being hw_free and shutdown.
The BE dai will be hw_free later when calling
dpcm_be_dai_shutdown() if still in invalid state.
Signed-off-by: KaiChieh Chuang <kaichieh.chuang@mediatek.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/soc-pcm.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/sound/soc/soc-pcm.c
+++ b/sound/soc/soc-pcm.c
@@ -1611,8 +1611,10 @@ int dpcm_be_dai_shutdown(struct snd_soc_
continue;
if ((be->dpcm[stream].state != SND_SOC_DPCM_STATE_HW_FREE) &&
- (be->dpcm[stream].state != SND_SOC_DPCM_STATE_OPEN))
- continue;
+ (be->dpcm[stream].state != SND_SOC_DPCM_STATE_OPEN)) {
+ soc_pcm_hw_free(be_substream);
+ be->dpcm[stream].state = SND_SOC_DPCM_STATE_HW_FREE;
+ }
dev_dbg(be->dev, "ASoC: close BE %s\n",
dpcm->fe->dai_link->name);
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 17/85] mwifiex: handle race during mwifiex_usb_disconnect
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (15 preceding siblings ...)
2018-08-07 18:51 ` [PATCH 3.18 16/85] ASoC: dpcm: fix BE dai not hw_free and shutdown Greg Kroah-Hartman
@ 2018-08-07 18:51 ` Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 3.18 18/85] wlcore: sdio: check for valid platform device data before suspend Greg Kroah-Hartman
` (64 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ganapathi Bhat, Kalle Valo, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ganapathi Bhat <gbhat@marvell.com>
[ Upstream commit b817047ae70c0bd67b677b65d0d69d72cd6e9728 ]
Race condition is observed during rmmod of mwifiex_usb:
1. The rmmod thread will call mwifiex_usb_disconnect(), download
SHUTDOWN command and do wait_event_interruptible_timeout(),
waiting for response.
2. The main thread will handle the response and will do a
wake_up_interruptible(), unblocking rmmod thread.
3. On getting unblocked, rmmod thread will make rx_cmd.urb = NULL in
mwifiex_usb_free().
4. The main thread will try to resubmit rx_cmd.urb in
mwifiex_usb_submit_rx_urb(), which is NULL.
To fix, wait for main thread to complete before calling
mwifiex_usb_free().
Signed-off-by: Ganapathi Bhat <gbhat@marvell.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/mwifiex/usb.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/net/wireless/mwifiex/usb.c
+++ b/drivers/net/wireless/mwifiex/usb.c
@@ -556,6 +556,9 @@ static void mwifiex_usb_disconnect(struc
MWIFIEX_FUNC_SHUTDOWN);
}
+ if (adapter->workqueue)
+ flush_workqueue(adapter->workqueue);
+
mwifiex_usb_free(card);
dev_dbg(adapter->dev, "%s: removing card\n", __func__);
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 18/85] wlcore: sdio: check for valid platform device data before suspend
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (16 preceding siblings ...)
2018-08-07 18:51 ` [PATCH 3.18 17/85] mwifiex: handle race during mwifiex_usb_disconnect Greg Kroah-Hartman
@ 2018-08-07 18:51 ` Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 3.18 19/85] PCI: Prevent sysfs disable of device while driver is attached Greg Kroah-Hartman
` (63 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Eyal Reizer, Kalle Valo, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eyal Reizer <eyalreizer@gmail.com>
[ Upstream commit 6e91d48371e79862ea2c05867aaebe4afe55a865 ]
the wl pointer can be null In case only wlcore_sdio is probed while
no WiLink module is successfully probed, as in the case of mounting a
wl12xx module while using a device tree file configured with wl18xx
related settings.
In this case the system was crashing in wl1271_suspend() as platform
device data is not set.
Make sure wl the pointer is valid before using it.
Signed-off-by: Eyal Reizer <eyalr@ti.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/ti/wlcore/sdio.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/net/wireless/ti/wlcore/sdio.c
+++ b/drivers/net/wireless/ti/wlcore/sdio.c
@@ -342,6 +342,11 @@ static int wl1271_suspend(struct device
mmc_pm_flag_t sdio_flags;
int ret = 0;
+ if (!wl) {
+ dev_err(dev, "no wilink module was probed\n");
+ goto out;
+ }
+
dev_dbg(dev, "wl1271 suspend. wow_enabled: %d\n",
wl->wow_enabled);
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 19/85] PCI: Prevent sysfs disable of device while driver is attached
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (17 preceding siblings ...)
2018-08-07 18:51 ` [PATCH 3.18 18/85] wlcore: sdio: check for valid platform device data before suspend Greg Kroah-Hartman
@ 2018-08-07 18:51 ` Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 3.18 20/85] ath: Add regulatory mapping for FCC3_ETSIC Greg Kroah-Hartman
` (62 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Christoph Hellwig, Bjorn Helgaas,
Johannes Thumshirn, Keith Busch, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <hch@lst.de>
[ Upstream commit 6f5cdfa802733dcb561bf664cc89d203f2fd958f ]
Manipulating the enable_cnt behind the back of the driver will wreak
complete havoc with the kernel state, so disallow it.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Acked-by: Keith Busch <keith.busch@intel.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/pci-sysfs.c | 15 +++++++++------
1 file changed, 9 insertions(+), 6 deletions(-)
--- a/drivers/pci/pci-sysfs.c
+++ b/drivers/pci/pci-sysfs.c
@@ -199,13 +199,16 @@ static ssize_t enable_store(struct devic
if (!capable(CAP_SYS_ADMIN))
return -EPERM;
- if (!val) {
- if (pci_is_enabled(pdev))
- pci_disable_device(pdev);
- else
- result = -EIO;
- } else
+ device_lock(dev);
+ if (dev->driver)
+ result = -EBUSY;
+ else if (val)
result = pci_enable_device(pdev);
+ else if (pci_is_enabled(pdev))
+ pci_disable_device(pdev);
+ else
+ result = -EIO;
+ device_unlock(dev);
return result < 0 ? result : count;
}
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 20/85] ath: Add regulatory mapping for FCC3_ETSIC
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (18 preceding siblings ...)
2018-08-07 18:51 ` [PATCH 3.18 19/85] PCI: Prevent sysfs disable of device while driver is attached Greg Kroah-Hartman
@ 2018-08-07 18:51 ` Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 3.18 21/85] ath: Add regulatory mapping for ETSI8_WORLD Greg Kroah-Hartman
` (61 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sven Eckelmann, Kalle Valo, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <sven.eckelmann@openmesh.com>
[ Upstream commit 01fb2994a98dc72c8818c274f7b5983d5dd885c7 ]
The regdomain code is used to select the correct the correct conformance
test limits (CTL) for a country. If the regdomain code isn't available and
it is still programmed in the EEPROM then it will cause an error and stop
the initialization with:
Invalid EEPROM contents
The current CTL mappings for this regdomain code are:
* 2.4GHz: ETSI
* 5GHz: FCC
Signed-off-by: Sven Eckelmann <sven.eckelmann@openmesh.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/ath/regd_common.h | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/net/wireless/ath/regd_common.h
+++ b/drivers/net/wireless/ath/regd_common.h
@@ -35,6 +35,7 @@ enum EnumRd {
FRANCE_RES = 0x31,
FCC3_FCCA = 0x3A,
FCC3_WORLD = 0x3B,
+ FCC3_ETSIC = 0x3F,
ETSI1_WORLD = 0x37,
ETSI3_ETSIA = 0x32,
@@ -168,6 +169,7 @@ static struct reg_dmn_pair_mapping regDo
{FCC2_ETSIC, CTL_FCC, CTL_ETSI},
{FCC3_FCCA, CTL_FCC, CTL_FCC},
{FCC3_WORLD, CTL_FCC, CTL_ETSI},
+ {FCC3_ETSIC, CTL_FCC, CTL_ETSI},
{FCC4_FCCA, CTL_FCC, CTL_FCC},
{FCC5_FCCA, CTL_FCC, CTL_FCC},
{FCC6_FCCA, CTL_FCC, CTL_FCC},
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 21/85] ath: Add regulatory mapping for ETSI8_WORLD
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (19 preceding siblings ...)
2018-08-07 18:51 ` [PATCH 3.18 20/85] ath: Add regulatory mapping for FCC3_ETSIC Greg Kroah-Hartman
@ 2018-08-07 18:51 ` Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 3.18 22/85] ath: Add regulatory mapping for APL13_WORLD Greg Kroah-Hartman
` (60 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sven Eckelmann, Kalle Valo, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <sven.eckelmann@openmesh.com>
[ Upstream commit 45faf6e096da8bb80e1ddf8c08a26a9601d9469e ]
The regdomain code is used to select the correct the correct conformance
test limits (CTL) for a country. If the regdomain code isn't available and
it is still programmed in the EEPROM then it will cause an error and stop
the initialization with:
Invalid EEPROM contents
The current CTL mappings for this regdomain code are:
* 2.4GHz: ETSI
* 5GHz: ETSI
Signed-off-by: Sven Eckelmann <sven.eckelmann@openmesh.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/ath/regd_common.h | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/net/wireless/ath/regd_common.h
+++ b/drivers/net/wireless/ath/regd_common.h
@@ -45,6 +45,7 @@ enum EnumRd {
ETSI4_ETSIC = 0x38,
ETSI5_WORLD = 0x39,
ETSI6_WORLD = 0x34,
+ ETSI8_WORLD = 0x3D,
ETSI_RESERVED = 0x33,
MKK1_MKKA = 0x40,
@@ -181,6 +182,7 @@ static struct reg_dmn_pair_mapping regDo
{ETSI4_WORLD, CTL_ETSI, CTL_ETSI},
{ETSI5_WORLD, CTL_ETSI, CTL_ETSI},
{ETSI6_WORLD, CTL_ETSI, CTL_ETSI},
+ {ETSI8_WORLD, CTL_ETSI, CTL_ETSI},
/* XXX: For ETSI3_ETSIA, Was NO_CTL meant for the 2 GHz band ? */
{ETSI3_ETSIA, CTL_ETSI, CTL_ETSI},
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 22/85] ath: Add regulatory mapping for APL13_WORLD
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (20 preceding siblings ...)
2018-08-07 18:51 ` [PATCH 3.18 21/85] ath: Add regulatory mapping for ETSI8_WORLD Greg Kroah-Hartman
@ 2018-08-07 18:51 ` Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 3.18 23/85] ath: Add regulatory mapping for APL2_FCCA Greg Kroah-Hartman
` (59 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sven Eckelmann, Kalle Valo, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <sven.eckelmann@openmesh.com>
[ Upstream commit 9ba8df0c52b3e6baa436374b429d3d73bd09a320 ]
The regdomain code is used to select the correct the correct conformance
test limits (CTL) for a country. If the regdomain code isn't available and
it is still programmed in the EEPROM then it will cause an error and stop
the initialization with:
Invalid EEPROM contents
The current CTL mappings for this regdomain code are:
* 2.4GHz: ETSI
* 5GHz: ETSI
Signed-off-by: Sven Eckelmann <sven.eckelmann@openmesh.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/ath/regd_common.h | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/net/wireless/ath/regd_common.h
+++ b/drivers/net/wireless/ath/regd_common.h
@@ -69,6 +69,7 @@ enum EnumRd {
APL1_ETSIC = 0x55,
APL2_ETSIC = 0x56,
APL5_WORLD = 0x58,
+ APL13_WORLD = 0x5A,
APL6_WORLD = 0x5B,
APL7_FCCA = 0x5C,
APL8_WORLD = 0x5D,
@@ -195,6 +196,7 @@ static struct reg_dmn_pair_mapping regDo
{APL3_WORLD, CTL_FCC, CTL_ETSI},
{APL4_WORLD, CTL_FCC, CTL_ETSI},
{APL5_WORLD, CTL_FCC, CTL_ETSI},
+ {APL13_WORLD, CTL_ETSI, CTL_ETSI},
{APL6_WORLD, CTL_ETSI, CTL_ETSI},
{APL8_WORLD, CTL_ETSI, CTL_ETSI},
{APL9_WORLD, CTL_ETSI, CTL_ETSI},
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 23/85] ath: Add regulatory mapping for APL2_FCCA
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (21 preceding siblings ...)
2018-08-07 18:51 ` [PATCH 3.18 22/85] ath: Add regulatory mapping for APL13_WORLD Greg Kroah-Hartman
@ 2018-08-07 18:51 ` Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 3.18 24/85] ath: Add regulatory mapping for Uganda Greg Kroah-Hartman
` (58 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sven Eckelmann, Kalle Valo, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <sven.eckelmann@openmesh.com>
[ Upstream commit 4f183687e3fad3ce0e06e38976cad81bc4541990 ]
The regdomain code is used to select the correct the correct conformance
test limits (CTL) for a country. If the regdomain code isn't available and
it is still programmed in the EEPROM then it will cause an error and stop
the initialization with:
Invalid EEPROM contents
The current CTL mappings for this regdomain code are:
* 2.4GHz: FCC
* 5GHz: FCC
Signed-off-by: Sven Eckelmann <sven.eckelmann@openmesh.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/ath/regd_common.h | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/net/wireless/ath/regd_common.h
+++ b/drivers/net/wireless/ath/regd_common.h
@@ -61,6 +61,7 @@ enum EnumRd {
MKK1_MKKA1 = 0x4A,
MKK1_MKKA2 = 0x4B,
MKK1_MKKC = 0x4C,
+ APL2_FCCA = 0x4D,
APL3_FCCA = 0x50,
APL1_WORLD = 0x52,
@@ -193,6 +194,7 @@ static struct reg_dmn_pair_mapping regDo
{FCC1_FCCA, CTL_FCC, CTL_FCC},
{APL1_WORLD, CTL_FCC, CTL_ETSI},
{APL2_WORLD, CTL_FCC, CTL_ETSI},
+ {APL2_FCCA, CTL_FCC, CTL_FCC},
{APL3_WORLD, CTL_FCC, CTL_ETSI},
{APL4_WORLD, CTL_FCC, CTL_ETSI},
{APL5_WORLD, CTL_FCC, CTL_ETSI},
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 24/85] ath: Add regulatory mapping for Uganda
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (22 preceding siblings ...)
2018-08-07 18:51 ` [PATCH 3.18 23/85] ath: Add regulatory mapping for APL2_FCCA Greg Kroah-Hartman
@ 2018-08-07 18:51 ` Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 3.18 25/85] ath: Add regulatory mapping for Tanzania Greg Kroah-Hartman
` (57 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sven Eckelmann, Kalle Valo, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <sven.eckelmann@openmesh.com>
[ Upstream commit 1ea3986ad2bc72081c69f3fbc1e5e0eeb3c44f17 ]
The country code is used by the ath to detect the ISO 3166-1 alpha-2 name
and to select the correct conformance test limits (CTL) for a country. If
the country isn't available and it is still programmed in the EEPROM then
it will cause an error and stop the initialization with:
Invalid EEPROM contents
The current CTL mappings for this country are:
* 2.4GHz: ETSI
* 5GHz: FCC
Signed-off-by: Sven Eckelmann <sven.eckelmann@openmesh.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/ath/regd.h | 1 +
drivers/net/wireless/ath/regd_common.h | 1 +
2 files changed, 2 insertions(+)
--- a/drivers/net/wireless/ath/regd.h
+++ b/drivers/net/wireless/ath/regd.h
@@ -175,6 +175,7 @@ enum CountryCode {
CTRY_TUNISIA = 788,
CTRY_TURKEY = 792,
CTRY_UAE = 784,
+ CTRY_UGANDA = 800,
CTRY_UKRAINE = 804,
CTRY_UNITED_KINGDOM = 826,
CTRY_UNITED_STATES = 840,
--- a/drivers/net/wireless/ath/regd_common.h
+++ b/drivers/net/wireless/ath/regd_common.h
@@ -467,6 +467,7 @@ static struct country_code_to_enum_rd al
{CTRY_TRINIDAD_Y_TOBAGO, FCC3_WORLD, "TT"},
{CTRY_TUNISIA, ETSI3_WORLD, "TN"},
{CTRY_TURKEY, ETSI3_WORLD, "TR"},
+ {CTRY_UGANDA, FCC3_WORLD, "UG"},
{CTRY_UKRAINE, NULL1_WORLD, "UA"},
{CTRY_UAE, NULL1_WORLD, "AE"},
{CTRY_UNITED_KINGDOM, ETSI1_WORLD, "GB"},
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 25/85] ath: Add regulatory mapping for Tanzania
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (23 preceding siblings ...)
2018-08-07 18:51 ` [PATCH 3.18 24/85] ath: Add regulatory mapping for Uganda Greg Kroah-Hartman
@ 2018-08-07 18:51 ` Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 3.18 26/85] ath: Add regulatory mapping for Serbia Greg Kroah-Hartman
` (56 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sven Eckelmann, Kalle Valo, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <sven.eckelmann@openmesh.com>
[ Upstream commit 667ddac5745fb9fddfe8f7fd2523070f50bd4442 ]
The country code is used by the ath to detect the ISO 3166-1 alpha-2 name
and to select the correct conformance test limits (CTL) for a country. If
the country isn't available and it is still programmed in the EEPROM then
it will cause an error and stop the initialization with:
Invalid EEPROM contents
The current CTL mappings for this country are:
* 2.4GHz: ETSI
* 5GHz: FCC
Signed-off-by: Sven Eckelmann <sven.eckelmann@openmesh.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/ath/regd.h | 1 +
drivers/net/wireless/ath/regd_common.h | 1 +
2 files changed, 2 insertions(+)
--- a/drivers/net/wireless/ath/regd.h
+++ b/drivers/net/wireless/ath/regd.h
@@ -170,6 +170,7 @@ enum CountryCode {
CTRY_SWITZERLAND = 756,
CTRY_SYRIA = 760,
CTRY_TAIWAN = 158,
+ CTRY_TANZANIA = 834,
CTRY_THAILAND = 764,
CTRY_TRINIDAD_Y_TOBAGO = 780,
CTRY_TUNISIA = 788,
--- a/drivers/net/wireless/ath/regd_common.h
+++ b/drivers/net/wireless/ath/regd_common.h
@@ -463,6 +463,7 @@ static struct country_code_to_enum_rd al
{CTRY_SWITZERLAND, ETSI1_WORLD, "CH"},
{CTRY_SYRIA, NULL1_WORLD, "SY"},
{CTRY_TAIWAN, APL3_FCCA, "TW"},
+ {CTRY_TANZANIA, APL1_WORLD, "TZ"},
{CTRY_THAILAND, FCC3_WORLD, "TH"},
{CTRY_TRINIDAD_Y_TOBAGO, FCC3_WORLD, "TT"},
{CTRY_TUNISIA, ETSI3_WORLD, "TN"},
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 26/85] ath: Add regulatory mapping for Serbia
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (24 preceding siblings ...)
2018-08-07 18:51 ` [PATCH 3.18 25/85] ath: Add regulatory mapping for Tanzania Greg Kroah-Hartman
@ 2018-08-07 18:51 ` Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 3.18 27/85] ath: Add regulatory mapping for Bermuda Greg Kroah-Hartman
` (55 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sven Eckelmann, Kalle Valo, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <sven.eckelmann@openmesh.com>
[ Upstream commit 2a3169a54bb53717928392a04fb84deb765b51f1 ]
The country code is used by the ath to detect the ISO 3166-1 alpha-2 name
and to select the correct conformance test limits (CTL) for a country. If
the country isn't available and it is still programmed in the EEPROM then
it will cause an error and stop the initialization with:
Invalid EEPROM contents
The current CTL mappings for this country are:
* 2.4GHz: ETSI
* 5GHz: ETSI
Signed-off-by: Sven Eckelmann <sven.eckelmann@openmesh.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/ath/regd.h | 1 +
drivers/net/wireless/ath/regd_common.h | 1 +
2 files changed, 2 insertions(+)
--- a/drivers/net/wireless/ath/regd.h
+++ b/drivers/net/wireless/ath/regd.h
@@ -159,6 +159,7 @@ enum CountryCode {
CTRY_ROMANIA = 642,
CTRY_RUSSIA = 643,
CTRY_SAUDI_ARABIA = 682,
+ CTRY_SERBIA = 688,
CTRY_SERBIA_MONTENEGRO = 891,
CTRY_SINGAPORE = 702,
CTRY_SLOVAKIA = 703,
--- a/drivers/net/wireless/ath/regd_common.h
+++ b/drivers/net/wireless/ath/regd_common.h
@@ -452,6 +452,7 @@ static struct country_code_to_enum_rd al
{CTRY_ROMANIA, NULL1_WORLD, "RO"},
{CTRY_RUSSIA, NULL1_WORLD, "RU"},
{CTRY_SAUDI_ARABIA, NULL1_WORLD, "SA"},
+ {CTRY_SERBIA, ETSI1_WORLD, "RS"},
{CTRY_SERBIA_MONTENEGRO, ETSI1_WORLD, "CS"},
{CTRY_SINGAPORE, APL6_WORLD, "SG"},
{CTRY_SLOVAKIA, ETSI1_WORLD, "SK"},
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 27/85] ath: Add regulatory mapping for Bermuda
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (25 preceding siblings ...)
2018-08-07 18:51 ` [PATCH 3.18 26/85] ath: Add regulatory mapping for Serbia Greg Kroah-Hartman
@ 2018-08-07 18:51 ` Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 3.18 28/85] ath: Add regulatory mapping for Bahamas Greg Kroah-Hartman
` (54 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sven Eckelmann, Kalle Valo, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <sven.eckelmann@openmesh.com>
[ Upstream commit 9c790f2d234f65697e3b0948adbfdf36dbe63dd7 ]
The country code is used by the ath to detect the ISO 3166-1 alpha-2 name
and to select the correct conformance test limits (CTL) for a country. If
the country isn't available and it is still programmed in the EEPROM then
it will cause an error and stop the initialization with:
Invalid EEPROM contents
The current CTL mappings for this country are:
* 2.4GHz: FCC
* 5GHz: FCC
Signed-off-by: Sven Eckelmann <sven.eckelmann@openmesh.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/ath/regd.h | 1 +
drivers/net/wireless/ath/regd_common.h | 1 +
2 files changed, 2 insertions(+)
--- a/drivers/net/wireless/ath/regd.h
+++ b/drivers/net/wireless/ath/regd.h
@@ -74,6 +74,7 @@ enum CountryCode {
CTRY_BELARUS = 112,
CTRY_BELGIUM = 56,
CTRY_BELIZE = 84,
+ CTRY_BERMUDA = 60,
CTRY_BOLIVIA = 68,
CTRY_BOSNIA_HERZ = 70,
CTRY_BRAZIL = 76,
--- a/drivers/net/wireless/ath/regd_common.h
+++ b/drivers/net/wireless/ath/regd_common.h
@@ -313,6 +313,7 @@ static struct country_code_to_enum_rd al
{CTRY_BELGIUM, ETSI1_WORLD, "BE"},
{CTRY_BELGIUM2, ETSI4_WORLD, "BL"},
{CTRY_BELIZE, APL1_ETSIC, "BZ"},
+ {CTRY_BERMUDA, FCC3_FCCA, "BM"},
{CTRY_BOLIVIA, APL1_ETSIC, "BO"},
{CTRY_BOSNIA_HERZ, ETSI1_WORLD, "BA"},
{CTRY_BRAZIL, FCC3_WORLD, "BR"},
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 28/85] ath: Add regulatory mapping for Bahamas
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (26 preceding siblings ...)
2018-08-07 18:51 ` [PATCH 3.18 27/85] ath: Add regulatory mapping for Bermuda Greg Kroah-Hartman
@ 2018-08-07 18:51 ` Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 3.18 33/85] powerpc/8xx: fix invalid register expression in head_8xx.S Greg Kroah-Hartman
` (53 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sven Eckelmann, Kalle Valo, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <sven.eckelmann@openmesh.com>
[ Upstream commit 699e2302c286a14afe7b7394151ce6c4e1790cc1 ]
The country code is used by the ath to detect the ISO 3166-1 alpha-2 name
and to select the correct conformance test limits (CTL) for a country. If
the country isn't available and it is still programmed in the EEPROM then
it will cause an error and stop the initialization with:
Invalid EEPROM contents
The current CTL mappings for this country are:
* 2.4GHz: ETSI
* 5GHz: FCC
Signed-off-by: Sven Eckelmann <sven.eckelmann@openmesh.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/ath/regd.h | 1 +
drivers/net/wireless/ath/regd_common.h | 1 +
2 files changed, 2 insertions(+)
--- a/drivers/net/wireless/ath/regd.h
+++ b/drivers/net/wireless/ath/regd.h
@@ -68,6 +68,7 @@ enum CountryCode {
CTRY_AUSTRALIA = 36,
CTRY_AUSTRIA = 40,
CTRY_AZERBAIJAN = 31,
+ CTRY_BAHAMAS = 44,
CTRY_BAHRAIN = 48,
CTRY_BANGLADESH = 50,
CTRY_BARBADOS = 52,
--- a/drivers/net/wireless/ath/regd_common.h
+++ b/drivers/net/wireless/ath/regd_common.h
@@ -306,6 +306,7 @@ static struct country_code_to_enum_rd al
{CTRY_AUSTRALIA2, FCC6_WORLD, "AU"},
{CTRY_AUSTRIA, ETSI1_WORLD, "AT"},
{CTRY_AZERBAIJAN, ETSI4_WORLD, "AZ"},
+ {CTRY_BAHAMAS, FCC3_WORLD, "BS"},
{CTRY_BAHRAIN, APL6_WORLD, "BH"},
{CTRY_BANGLADESH, NULL1_WORLD, "BD"},
{CTRY_BARBADOS, FCC2_WORLD, "BB"},
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 33/85] powerpc/8xx: fix invalid register expression in head_8xx.S
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (27 preceding siblings ...)
2018-08-07 18:51 ` [PATCH 3.18 28/85] ath: Add regulatory mapping for Bahamas Greg Kroah-Hartman
@ 2018-08-07 18:51 ` Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 3.18 34/85] PCI: pciehp: Request control of native hotplug only if supported Greg Kroah-Hartman
` (52 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Christophe Leroy, Michael Ellerman,
Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <christophe.leroy@c-s.fr>
[ Upstream commit e4ccb1dae6bdef228d729c076c38161ef6e7ca34 ]
New binutils generate the following warning
AS arch/powerpc/kernel/head_8xx.o
arch/powerpc/kernel/head_8xx.S: Assembler messages:
arch/powerpc/kernel/head_8xx.S:916: Warning: invalid register expression
This patch fixes it.
Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/kernel/head_8xx.S | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/powerpc/kernel/head_8xx.S
+++ b/arch/powerpc/kernel/head_8xx.S
@@ -722,7 +722,7 @@ start_here:
tovirt(r6,r6)
lis r5, abatron_pteptrs@h
ori r5, r5, abatron_pteptrs@l
- stw r5, 0xf0(r0) /* Must match your Abatron config file */
+ stw r5, 0xf0(0) /* Must match your Abatron config file */
tophys(r5,r5)
stw r6, 0(r5)
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 34/85] PCI: pciehp: Request control of native hotplug only if supported
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (28 preceding siblings ...)
2018-08-07 18:51 ` [PATCH 3.18 33/85] powerpc/8xx: fix invalid register expression in head_8xx.S Greg Kroah-Hartman
@ 2018-08-07 18:51 ` Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 3.18 35/85] scsi: ufs: fix exception event handling Greg Kroah-Hartman
` (51 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Bjorn Helgaas, Mika Westerberg,
Rafael J. Wysocki, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mika Westerberg <mika.westerberg@linux.intel.com>
[ Upstream commit 408fec36a1ab3d14273c2116b449ef1e9be3cb8b ]
Currently we request control of native PCIe hotplug unconditionally.
Native PCIe hotplug events are handled by the pciehp driver, and if it is
not enabled those events will be lost.
Request control of native PCIe hotplug only if the pciehp driver is
enabled, so we will actually handle native PCIe hotplug events.
Suggested-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/acpi/pci_root.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/acpi/pci_root.c
+++ b/drivers/acpi/pci_root.c
@@ -476,9 +476,11 @@ static void negotiate_os_control(struct
}
control = OSC_PCI_EXPRESS_CAPABILITY_CONTROL
- | OSC_PCI_EXPRESS_NATIVE_HP_CONTROL
| OSC_PCI_EXPRESS_PME_CONTROL;
+ if (IS_ENABLED(CONFIG_HOTPLUG_PCI_PCIE))
+ control |= OSC_PCI_EXPRESS_NATIVE_HP_CONTROL;
+
if (pci_aer_available()) {
if (aer_acpi_firmware_first())
dev_info(&device->dev,
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 35/85] scsi: ufs: fix exception event handling
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (29 preceding siblings ...)
2018-08-07 18:51 ` [PATCH 3.18 34/85] PCI: pciehp: Request control of native hotplug only if supported Greg Kroah-Hartman
@ 2018-08-07 18:51 ` Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 3.18 36/85] ALSA: emu10k1: Rate-limit error messages about page errors Greg Kroah-Hartman
` (50 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Subhash Jadavani, Maya Erez, Can Guo,
Asutosh Das, Martin K. Petersen, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maya Erez <merez@codeaurora.org>
[ Upstream commit 2e3611e9546c2ed4def152a51dfd34e8dddae7a5 ]
The device can set the exception event bit in one of the response UPIU,
for example to notify the need for urgent BKOPs operation. In such a
case, the host driver calls ufshcd_exception_event_handler to handle
this notification. When trying to check the exception event status (for
finding the cause for the exception event), the device may be busy with
additional SCSI commands handling and may not respond within the 100ms
timeout.
To prevent that, we need to block SCSI commands during handling of
exception events and allow retransmissions of the query requests, in
case of timeout.
Signed-off-by: Subhash Jadavani <subhashj@codeaurora.org>
Signed-off-by: Maya Erez <merez@codeaurora.org>
Signed-off-by: Can Guo <cang@codeaurora.org>
Signed-off-by: Asutosh Das <asutoshd@codeaurora.org>
Reviewed-by: Subhash Jadavani <subhashj@codeaurora.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/ufs/ufshcd.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -3330,6 +3330,7 @@ static void ufshcd_exception_event_handl
hba = container_of(work, struct ufs_hba, eeh_work);
pm_runtime_get_sync(hba->dev);
+ scsi_block_requests(hba->host);
err = ufshcd_get_ee_status(hba, &status);
if (err) {
dev_err(hba->dev, "%s: failed to get exception status %d\n",
@@ -3345,6 +3346,7 @@ static void ufshcd_exception_event_handl
__func__, err);
}
out:
+ scsi_unblock_requests(hba->host);
pm_runtime_put_sync(hba->dev);
return;
}
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 36/85] ALSA: emu10k1: Rate-limit error messages about page errors
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (30 preceding siblings ...)
2018-08-07 18:51 ` [PATCH 3.18 35/85] scsi: ufs: fix exception event handling Greg Kroah-Hartman
@ 2018-08-07 18:51 ` Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 3.18 37/85] regulator: pfuze100: add .is_enable() for pfuze100_swb_regulator_ops Greg Kroah-Hartman
` (49 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:51 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Iwai, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
[ Upstream commit 11d42c81036324697d367600bfc16f6dd37636fd ]
The error messages at sanity checks of memory pages tend to repeat too
many times once when it hits, and without the rate limit, it may flood
and become unreadable. Replace such messages with the *_ratelimited()
variant.
Bugzilla: http://bugzilla.opensuse.org/show_bug.cgi?id=1093027
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/emu10k1/memory.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/sound/pci/emu10k1/memory.c
+++ b/sound/pci/emu10k1/memory.c
@@ -237,13 +237,13 @@ __found_pages:
static int is_valid_page(struct snd_emu10k1 *emu, dma_addr_t addr)
{
if (addr & ~emu->dma_mask) {
- dev_err(emu->card->dev,
+ dev_err_ratelimited(emu->card->dev,
"max memory size is 0x%lx (addr = 0x%lx)!!\n",
emu->dma_mask, (unsigned long)addr);
return 0;
}
if (addr & (EMUPAGESIZE-1)) {
- dev_err(emu->card->dev, "page is not aligned\n");
+ dev_err_ratelimited(emu->card->dev, "page is not aligned\n");
return 0;
}
return 1;
@@ -334,7 +334,7 @@ snd_emu10k1_alloc_pages(struct snd_emu10
else
addr = snd_pcm_sgbuf_get_addr(substream, ofs);
if (! is_valid_page(emu, addr)) {
- dev_err(emu->card->dev,
+ dev_err_ratelimited(emu->card->dev,
"emu: failure page = %d\n", idx);
mutex_unlock(&hdr->block_mutex);
return NULL;
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 37/85] regulator: pfuze100: add .is_enable() for pfuze100_swb_regulator_ops
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (31 preceding siblings ...)
2018-08-07 18:51 ` [PATCH 3.18 36/85] ALSA: emu10k1: Rate-limit error messages about page errors Greg Kroah-Hartman
@ 2018-08-07 18:51 ` Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 3.18 38/85] md: fix NULL dereference of mddev->pers in remove_and_add_spares() Greg Kroah-Hartman
` (48 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Anson Huang, Mark Brown, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anson Huang <Anson.Huang@nxp.com>
[ Upstream commit 0b01fd3d40fe6402e5fa3b491ef23109feb1aaa5 ]
If is_enabled() is not defined, regulator core will assume
this regulator is already enabled, then it can NOT be really
enabled after disabled.
Based on Li Jun's patch from the NXP kernel tree.
Signed-off-by: Anson Huang <Anson.Huang@nxp.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/regulator/pfuze100-regulator.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/regulator/pfuze100-regulator.c
+++ b/drivers/regulator/pfuze100-regulator.c
@@ -142,6 +142,7 @@ static struct regulator_ops pfuze100_sw_
static struct regulator_ops pfuze100_swb_regulator_ops = {
.enable = regulator_enable_regmap,
.disable = regulator_disable_regmap,
+ .is_enabled = regulator_is_enabled_regmap,
.list_voltage = regulator_list_voltage_table,
.map_voltage = regulator_map_voltage_ascend,
.set_voltage_sel = regulator_set_voltage_sel_regmap,
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 38/85] md: fix NULL dereference of mddev->pers in remove_and_add_spares()
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (32 preceding siblings ...)
2018-08-07 18:51 ` [PATCH 3.18 37/85] regulator: pfuze100: add .is_enable() for pfuze100_swb_regulator_ops Greg Kroah-Hartman
@ 2018-08-07 18:51 ` Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 3.18 39/85] media: smiapp: fix timeout checking in smiapp_read_nvm Greg Kroah-Hartman
` (47 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Yufen Yu, Shaohua Li, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yufen Yu <yuyufen@huawei.com>
[ Upstream commit c42a0e2675721e1444f56e6132a07b7b1ec169ac ]
We met NULL pointer BUG as follow:
[ 151.760358] BUG: unable to handle kernel NULL pointer dereference at 0000000000000060
[ 151.761340] PGD 80000001011eb067 P4D 80000001011eb067 PUD 1011ea067 PMD 0
[ 151.762039] Oops: 0000 [#1] SMP PTI
[ 151.762406] Modules linked in:
[ 151.762723] CPU: 2 PID: 3561 Comm: mdadm-test Kdump: loaded Not tainted 4.17.0-rc1+ #238
[ 151.763542] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1.fc26 04/01/2014
[ 151.764432] RIP: 0010:remove_and_add_spares.part.56+0x13c/0x3a0
[ 151.765061] RSP: 0018:ffffc90001d7fcd8 EFLAGS: 00010246
[ 151.765590] RAX: 0000000000000000 RBX: ffff88013601d600 RCX: 0000000000000000
[ 151.766306] RDX: 0000000000000000 RSI: ffff88013601d600 RDI: ffff880136187000
[ 151.767014] RBP: ffff880136187018 R08: 0000000000000003 R09: 0000000000000051
[ 151.767728] R10: ffffc90001d7fed8 R11: 0000000000000000 R12: ffff88013601d600
[ 151.768447] R13: ffff8801298b1300 R14: ffff880136187000 R15: 0000000000000000
[ 151.769160] FS: 00007f2624276700(0000) GS:ffff88013ae80000(0000) knlGS:0000000000000000
[ 151.769971] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 151.770554] CR2: 0000000000000060 CR3: 0000000111aac000 CR4: 00000000000006e0
[ 151.771272] Call Trace:
[ 151.771542] md_ioctl+0x1df2/0x1e10
[ 151.771906] ? __switch_to+0x129/0x440
[ 151.772295] ? __schedule+0x244/0x850
[ 151.772672] blkdev_ioctl+0x4bd/0x970
[ 151.773048] block_ioctl+0x39/0x40
[ 151.773402] do_vfs_ioctl+0xa4/0x610
[ 151.773770] ? dput.part.23+0x87/0x100
[ 151.774151] ksys_ioctl+0x70/0x80
[ 151.774493] __x64_sys_ioctl+0x16/0x20
[ 151.774877] do_syscall_64+0x5b/0x180
[ 151.775258] entry_SYSCALL_64_after_hwframe+0x44/0xa9
For raid6, when two disk of the array are offline, two spare disks can
be added into the array. Before spare disks recovery completing,
system reboot and mdadm thinks it is ok to restart the degraded
array by md_ioctl(). Since disks in raid6 is not only_parity(),
raid5_run() will abort, when there is no PPL feature or not setting
'start_dirty_degraded' parameter. Therefore, mddev->pers is NULL.
But, mddev->raid_disks has been set and it will not be cleared when
raid5_run abort. md_ioctl() can execute cmd 'HOT_REMOVE_DISK' to
remove a disk by mdadm, which will cause NULL pointer dereference
in remove_and_add_spares() finally.
Signed-off-by: Yufen Yu <yuyufen@huawei.com>
Signed-off-by: Shaohua Li <shli@fb.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/md.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -5676,6 +5676,9 @@ static int hot_remove_disk(struct mddev
char b[BDEVNAME_SIZE];
struct md_rdev *rdev;
+ if (!mddev->pers)
+ return -ENODEV;
+
rdev = find_rdev(mddev, dev);
if (!rdev)
return -ENXIO;
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 39/85] media: smiapp: fix timeout checking in smiapp_read_nvm
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (33 preceding siblings ...)
2018-08-07 18:51 ` [PATCH 3.18 38/85] md: fix NULL dereference of mddev->pers in remove_and_add_spares() Greg Kroah-Hartman
@ 2018-08-07 18:51 ` Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 3.18 40/85] ALSA: usb-audio: Apply rate limit to warning messages in URB complete callback Greg Kroah-Hartman
` (46 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Colin Ian King, Sakari Ailus,
Mauro Carvalho Chehab, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Colin Ian King <colin.king@canonical.com>
[ Upstream commit 7a2148dfda8001c983f0effd9afd8a7fa58e99c4 ]
The current code decrements the timeout counter i and the end of
each loop i is incremented, so the check for timeout will always
be false and hence the timeout mechanism is just a dead code path.
Potentially, if the RD_READY bit is not set, we could end up in
an infinite loop.
Fix this so the timeout starts from 1000 and decrements to zero,
if at the end of the loop i is zero we have a timeout condition.
Detected by CoverityScan, CID#1324008 ("Logically dead code")
Fixes: ccfc97bdb5ae ("[media] smiapp: Add driver")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/i2c/smiapp/smiapp-core.c | 11 +++++------
1 file changed, 5 insertions(+), 6 deletions(-)
--- a/drivers/media/i2c/smiapp/smiapp-core.c
+++ b/drivers/media/i2c/smiapp/smiapp-core.c
@@ -939,7 +939,7 @@ static int smiapp_read_nvm(struct smiapp
if (rval)
goto out;
- for (i = 0; i < 1000; i++) {
+ for (i = 1000; i > 0; i--) {
rval = smiapp_read(
sensor,
SMIAPP_REG_U8_DATA_TRANSFER_IF_1_STATUS, &s);
@@ -950,11 +950,10 @@ static int smiapp_read_nvm(struct smiapp
if (s & SMIAPP_DATA_TRANSFER_IF_1_STATUS_RD_READY)
break;
- if (--i == 0) {
- rval = -ETIMEDOUT;
- goto out;
- }
-
+ }
+ if (!i) {
+ rval = -ETIMEDOUT;
+ goto out;
}
for (i = 0; i < SMIAPP_NVM_PAGE_SIZE; i++) {
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 40/85] ALSA: usb-audio: Apply rate limit to warning messages in URB complete callback
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (34 preceding siblings ...)
2018-08-07 18:51 ` [PATCH 3.18 39/85] media: smiapp: fix timeout checking in smiapp_read_nvm Greg Kroah-Hartman
@ 2018-08-07 18:51 ` Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 3.18 41/85] drm/radeon: fix mode_valids return type Greg Kroah-Hartman
` (45 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:51 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Iwai, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
[ Upstream commit 377a879d9832f4ba69bd6a1fc996bb4181b1e504 ]
retire_capture_urb() may print warning messages when the given URB
doesn't align, and this may flood the system log easily.
Put the rate limit to the message for avoiding it.
Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=1093485
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/usb/pcm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/sound/usb/pcm.c
+++ b/sound/usb/pcm.c
@@ -1263,7 +1263,7 @@ static void retire_capture_urb(struct sn
if (bytes % (runtime->sample_bits >> 3) != 0) {
int oldbytes = bytes;
bytes = frames * stride;
- dev_warn(&subs->dev->dev,
+ dev_warn_ratelimited(&subs->dev->dev,
"Corrected urb data len. %d->%d\n",
oldbytes, bytes);
}
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 41/85] drm/radeon: fix mode_valids return type
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (35 preceding siblings ...)
2018-08-07 18:51 ` [PATCH 3.18 40/85] ALSA: usb-audio: Apply rate limit to warning messages in URB complete callback Greg Kroah-Hartman
@ 2018-08-07 18:51 ` Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 3.18 43/85] HID: i2c-hid: check if device is there before really probing Greg Kroah-Hartman
` (44 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Luc Van Oostenryck, Alex Deucher,
Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luc Van Oostenryck <luc.vanoostenryck@gmail.com>
[ Upstream commit 7a47f20eb1fb8fa8d7a8fe3a4fd8c721f04c2174 ]
The method struct drm_connector_helper_funcs::mode_valid is defined
as returning an 'enum drm_mode_status' but the driver implementation
for this method uses an 'int' for it.
Fix this by using 'enum drm_mode_status' in the driver too.
Signed-off-by: Luc Van Oostenryck <luc.vanoostenryck@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/radeon/radeon_connectors.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -804,7 +804,7 @@ static int radeon_lvds_get_modes(struct
return ret;
}
-static int radeon_lvds_mode_valid(struct drm_connector *connector,
+static enum drm_mode_status radeon_lvds_mode_valid(struct drm_connector *connector,
struct drm_display_mode *mode)
{
struct drm_encoder *encoder = radeon_best_single_encoder(connector);
@@ -947,7 +947,7 @@ static int radeon_vga_get_modes(struct d
return ret;
}
-static int radeon_vga_mode_valid(struct drm_connector *connector,
+static enum drm_mode_status radeon_vga_mode_valid(struct drm_connector *connector,
struct drm_display_mode *mode)
{
struct drm_device *dev = connector->dev;
@@ -1086,7 +1086,7 @@ static int radeon_tv_get_modes(struct dr
return 1;
}
-static int radeon_tv_mode_valid(struct drm_connector *connector,
+static enum drm_mode_status radeon_tv_mode_valid(struct drm_connector *connector,
struct drm_display_mode *mode)
{
if ((mode->hdisplay > 1024) || (mode->vdisplay > 768))
@@ -1387,7 +1387,7 @@ static void radeon_dvi_force(struct drm_
radeon_connector->use_digital = true;
}
-static int radeon_dvi_mode_valid(struct drm_connector *connector,
+static enum drm_mode_status radeon_dvi_mode_valid(struct drm_connector *connector,
struct drm_display_mode *mode)
{
struct drm_device *dev = connector->dev;
@@ -1666,7 +1666,7 @@ out:
return ret;
}
-static int radeon_dp_mode_valid(struct drm_connector *connector,
+static enum drm_mode_status radeon_dp_mode_valid(struct drm_connector *connector,
struct drm_display_mode *mode)
{
struct drm_device *dev = connector->dev;
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 43/85] HID: i2c-hid: check if device is there before really probing
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (36 preceding siblings ...)
2018-08-07 18:51 ` [PATCH 3.18 41/85] drm/radeon: fix mode_valids return type Greg Kroah-Hartman
@ 2018-08-07 18:51 ` Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 3.18 44/85] tty: Fix data race in tty_insert_flip_string_fixed_flag Greg Kroah-Hartman
` (43 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dmitry Torokhov, Benjamin Tissoires,
Jiri Kosina, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <dtor@chromium.org>
[ Upstream commit b3a81b6c4fc6730ac49e20d789a93c0faabafc98 ]
On many Chromebooks touch devices are multi-sourced; the components are
electrically compatible and one can be freely swapped for another without
changing the OS image or firmware.
To avoid bunch of scary messages when device is not actually present in the
system let's try testing basic communication with it and if there is no
response terminate probe early with -ENXIO.
Signed-off-by: Dmitry Torokhov <dtor@chromium.org>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/i2c-hid/i2c-hid.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/drivers/hid/i2c-hid/i2c-hid.c
+++ b/drivers/hid/i2c-hid/i2c-hid.c
@@ -981,6 +981,14 @@ static int i2c_hid_probe(struct i2c_clie
pm_runtime_set_active(&client->dev);
pm_runtime_enable(&client->dev);
+ /* Make sure there is something at this address */
+ ret = i2c_smbus_read_byte(client);
+ if (ret < 0) {
+ dev_dbg(&client->dev, "nothing at this address: %d\n", ret);
+ ret = -ENXIO;
+ goto err_pm;
+ }
+
ret = i2c_hid_fetch_hid_descriptor(ihid);
if (ret < 0)
goto err_pm;
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 44/85] tty: Fix data race in tty_insert_flip_string_fixed_flag
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (37 preceding siblings ...)
2018-08-07 18:51 ` [PATCH 3.18 43/85] HID: i2c-hid: check if device is there before really probing Greg Kroah-Hartman
@ 2018-08-07 18:51 ` Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 3.18 45/85] libata: Fix command retry decision Greg Kroah-Hartman
` (42 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:51 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, DaeRyong Jeong, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: DaeRyong Jeong <threeearcat@gmail.com>
[ Upstream commit b6da31b2c07c46f2dcad1d86caa835227a16d9ff ]
Unlike normal serials, in pty layer, there is no guarantee that multiple
threads don't insert input characters at the same time. If it is happened,
tty_insert_flip_string_fixed_flag can be executed concurrently. This can
lead slab out-of-bounds write in tty_insert_flip_string_fixed_flag.
Call sequences are as follows.
CPU0 CPU1
n_tty_ioctl_helper n_tty_ioctl_helper
__start_tty tty_send_xchar
tty_wakeup pty_write
n_hdlc_tty_wakeup tty_insert_flip_string
n_hdlc_send_frames tty_insert_flip_string_fixed_flag
pty_write
tty_insert_flip_string
tty_insert_flip_string_fixed_flag
To fix the race, acquire port->lock in pty_write() before it inserts input
characters to tty buffer. It prevents multiple threads from inserting
input characters concurrently.
The crash log is as follows:
BUG: KASAN: slab-out-of-bounds in tty_insert_flip_string_fixed_flag+0xb5/
0x130 drivers/tty/tty_buffer.c:316 at addr ffff880114fcc121
Write of size 1792 by task syz-executor0/30017
CPU: 1 PID: 30017 Comm: syz-executor0 Not tainted 4.8.0 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
BIOS rel-1.8.2-0-g33fbe13 by qemu-project.org 04/01/2014
0000000000000000 ffff88011638f888 ffffffff81694cc3 ffff88007d802140
ffff880114fcb300 ffff880114fcc300 ffff880114fcb300 ffff88011638f8b0
ffffffff8130075c ffff88011638f940 ffff88007d802140 ffff880194fcc121
Call Trace:
__dump_stack lib/dump_stack.c:15 [inline]
dump_stack+0xb3/0x110 lib/dump_stack.c:51
kasan_object_err+0x1c/0x70 mm/kasan/report.c:156
print_address_description mm/kasan/report.c:194 [inline]
kasan_report_error+0x1f7/0x4e0 mm/kasan/report.c:283
kasan_report+0x36/0x40 mm/kasan/report.c:303
check_memory_region_inline mm/kasan/kasan.c:292 [inline]
check_memory_region+0x13e/0x1a0 mm/kasan/kasan.c:299
memcpy+0x37/0x50 mm/kasan/kasan.c:335
tty_insert_flip_string_fixed_flag+0xb5/0x130 drivers/tty/tty_buffer.c:316
tty_insert_flip_string include/linux/tty_flip.h:35 [inline]
pty_write+0x7f/0xc0 drivers/tty/pty.c:115
n_hdlc_send_frames+0x1d4/0x3b0 drivers/tty/n_hdlc.c:419
n_hdlc_tty_wakeup+0x73/0xa0 drivers/tty/n_hdlc.c:496
tty_wakeup+0x92/0xb0 drivers/tty/tty_io.c:601
__start_tty.part.26+0x66/0x70 drivers/tty/tty_io.c:1018
__start_tty+0x34/0x40 drivers/tty/tty_io.c:1013
n_tty_ioctl_helper+0x146/0x1e0 drivers/tty/tty_ioctl.c:1138
n_hdlc_tty_ioctl+0xb3/0x2b0 drivers/tty/n_hdlc.c:794
tty_ioctl+0xa85/0x16d0 drivers/tty/tty_io.c:2992
vfs_ioctl fs/ioctl.c:43 [inline]
do_vfs_ioctl+0x13e/0xba0 fs/ioctl.c:679
SYSC_ioctl fs/ioctl.c:694 [inline]
SyS_ioctl+0x8f/0xc0 fs/ioctl.c:685
entry_SYSCALL_64_fastpath+0x1f/0xbd
Signed-off-by: DaeRyong Jeong <threeearcat@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/pty.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/tty/pty.c
+++ b/drivers/tty/pty.c
@@ -114,16 +114,19 @@ static int pty_space(struct tty_struct *
static int pty_write(struct tty_struct *tty, const unsigned char *buf, int c)
{
struct tty_struct *to = tty->link;
+ unsigned long flags;
if (tty->stopped)
return 0;
if (c > 0) {
+ spin_lock_irqsave(&to->port->lock, flags);
/* Stuff the data into the input queue of the other end */
c = tty_insert_flip_string(to->port, buf, c);
/* And shovel */
if (c)
tty_flip_buffer_push(to->port);
+ spin_unlock_irqrestore(&to->port->lock, flags);
}
return c;
}
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 45/85] libata: Fix command retry decision
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (38 preceding siblings ...)
2018-08-07 18:51 ` [PATCH 3.18 44/85] tty: Fix data race in tty_insert_flip_string_fixed_flag Greg Kroah-Hartman
@ 2018-08-07 18:51 ` Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 3.18 46/85] media: saa7164: Fix driver name in debug output Greg Kroah-Hartman
` (41 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Damien Le Moal, Hannes Reinecke,
Tejun Heo, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <damien.lemoal@wdc.com>
[ Upstream commit 804689ad2d9b66d0d3920b48cf05881049d44589 ]
For failed commands with valid sense data (e.g. NCQ commands),
scsi_check_sense() is used in ata_analyze_tf() to determine if the
command can be retried. In such case, rely on this decision and ignore
the command error mask based decision done in ata_worth_retry().
This fixes useless retries of commands such as unaligned writes on zoned
disks (TYPE_ZAC).
Signed-off-by: Damien Le Moal <damien.lemoal@wdc.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/ata/libata-eh.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -2173,12 +2173,16 @@ static void ata_eh_link_autopsy(struct a
if (qc->err_mask & ~AC_ERR_OTHER)
qc->err_mask &= ~AC_ERR_OTHER;
- /* SENSE_VALID trumps dev/unknown error and revalidation */
+ /*
+ * SENSE_VALID trumps dev/unknown error and revalidation. Upper
+ * layers will determine whether the command is worth retrying
+ * based on the sense data and device class/type. Otherwise,
+ * determine directly if the command is worth retrying using its
+ * error mask and flags.
+ */
if (qc->flags & ATA_QCFLAG_SENSE_VALID)
qc->err_mask &= ~(AC_ERR_DEV | AC_ERR_OTHER);
-
- /* determine whether the command is worth retrying */
- if (ata_eh_worth_retry(qc))
+ else if (ata_eh_worth_retry(qc))
qc->flags |= ATA_QCFLAG_RETRY;
/* accumulate error info */
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 46/85] media: saa7164: Fix driver name in debug output
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (39 preceding siblings ...)
2018-08-07 18:51 ` [PATCH 3.18 45/85] libata: Fix command retry decision Greg Kroah-Hartman
@ 2018-08-07 18:51 ` Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 3.18 47/85] s390/cpum_sf: Add data entry sizes to sampling trailer entry Greg Kroah-Hartman
` (40 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Brad Love, Hans Verkuil,
Mauro Carvalho Chehab, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brad Love <brad@nextdimension.cc>
[ Upstream commit 0cc4655cb57af0b7e105d075c4f83f8046efafe7 ]
This issue was reported by a user who downloaded a corrupt saa7164
firmware, then went looking for a valid xc5000 firmware to fix the
error displayed...but the device in question has no xc5000, thus after
much effort, the wild goose chase eventually led to a support call.
The xc5000 has nothing to do with saa7164 (as far as I can tell),
so replace the string with saa7164 as well as give a meaningful
hint on the firmware mismatch.
Signed-off-by: Brad Love <brad@nextdimension.cc>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/pci/saa7164/saa7164-fw.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/media/pci/saa7164/saa7164-fw.c
+++ b/drivers/media/pci/saa7164/saa7164-fw.c
@@ -430,7 +430,8 @@ int saa7164_downloadfirmware(struct saa7
__func__, fw->size);
if (fw->size != fwlength) {
- printk(KERN_ERR "xc5000: firmware incorrect size\n");
+ printk(KERN_ERR "saa7164: firmware incorrect size %zu != %u\n",
+ fw->size, fwlength);
ret = -ENOMEM;
goto out;
}
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 47/85] s390/cpum_sf: Add data entry sizes to sampling trailer entry
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (40 preceding siblings ...)
2018-08-07 18:51 ` [PATCH 3.18 46/85] media: saa7164: Fix driver name in debug output Greg Kroah-Hartman
@ 2018-08-07 18:51 ` Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 3.18 48/85] perf: fix invalid bit in diagnostic entry Greg Kroah-Hartman
` (39 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thomas Richter, Hendrik Brueckner,
Martin Schwidefsky, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Richter <tmricht@linux.ibm.com>
[ Upstream commit 77715b7ddb446bd39a06f3376e85f4bb95b29bb8 ]
The CPU Measurement sampling facility creates a trailer entry for each
Sample-Data-Block of stored samples. The trailer entry contains the sizes
(in bytes) of the stored sampling types:
- basic-sampling data entry size
- diagnostic-sampling data entry size
Both sizes are 2 bytes long.
This patch changes the trailer entry definition to reflect this.
Fixes: fcc77f507333 ("s390/cpum_sf: Atomically reset trailer entry fields of sample-data-blocks")
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Reviewed-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/include/asm/cpu_mf.h | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/arch/s390/include/asm/cpu_mf.h
+++ b/arch/s390/include/asm/cpu_mf.h
@@ -134,7 +134,9 @@ struct hws_trailer_entry {
unsigned int f:1; /* 0 - Block Full Indicator */
unsigned int a:1; /* 1 - Alert request control */
unsigned int t:1; /* 2 - Timestamp format */
- unsigned long long:61; /* 3 - 63: Reserved */
+ unsigned int :29; /* 3 - 31: Reserved */
+ unsigned int bsdes:16; /* 32-47: size of basic SDE */
+ unsigned int dsdes:16; /* 48-63: size of diagnostic SDE */
};
unsigned long long flags; /* 0 - 63: All indicators */
};
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 48/85] perf: fix invalid bit in diagnostic entry
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (41 preceding siblings ...)
2018-08-07 18:51 ` [PATCH 3.18 47/85] s390/cpum_sf: Add data entry sizes to sampling trailer entry Greg Kroah-Hartman
@ 2018-08-07 18:51 ` Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 3.18 49/85] scsi: 3w-9xxx: fix a missing-check bug Greg Kroah-Hartman
` (38 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thomas Richter, Hendrik Brueckner,
Martin Schwidefsky, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Richter <tmricht@linux.ibm.com>
[ Upstream commit 3c0a83b14ea71fef5ccc93a3bd2de5f892be3194 ]
The s390 CPU measurement facility sampling mode supports basic entries
and diagnostic entries. Each entry has a valid bit to indicate the
status of the entry as valid or invalid.
This bit is bit 31 in the diagnostic entry, but the bit mask definition
refers to bit 30.
Fix this by making the reserved field one bit larger.
Fixes: 7e75fc3ff4cf ("s390/cpum_sf: Add raw data sampling to support the diagnostic-sampling function")
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Reviewed-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/include/asm/cpu_mf.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/s390/include/asm/cpu_mf.h
+++ b/arch/s390/include/asm/cpu_mf.h
@@ -118,7 +118,7 @@ struct hws_basic_entry {
struct hws_diag_entry {
unsigned int def:16; /* 0-15 Data Entry Format */
- unsigned int R:14; /* 16-19 and 20-30 reserved */
+ unsigned int R:15; /* 16-19 and 20-30 reserved */
unsigned int I:1; /* 31 entry valid or invalid */
u8 data[]; /* Machine-dependent sample data */
} __packed;
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 49/85] scsi: 3w-9xxx: fix a missing-check bug
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (42 preceding siblings ...)
2018-08-07 18:51 ` [PATCH 3.18 48/85] perf: fix invalid bit in diagnostic entry Greg Kroah-Hartman
@ 2018-08-07 18:51 ` Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 3.18 50/85] scsi: 3w-xxxx: " Greg Kroah-Hartman
` (37 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Wenwen Wang, Adam Radford,
Martin K. Petersen, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wenwen Wang <wang6495@umn.edu>
[ Upstream commit c9318a3e0218bc9dacc25be46b9eec363259536f ]
In twa_chrdev_ioctl(), the ioctl driver command is firstly copied from
the userspace pointer 'argp' and saved to the kernel object
'driver_command'. Then a security check is performed on the data buffer
size indicated by 'driver_command', which is
'driver_command.buffer_length'. If the security check is passed, the
entire ioctl command is copied again from the 'argp' pointer and saved
to the kernel object 'tw_ioctl'. Then, various operations are performed
on 'tw_ioctl' according to the 'cmd'. Given that the 'argp' pointer
resides in userspace, a malicious userspace process can race to change
the buffer size between the two copies. This way, the user can bypass
the security check and inject invalid data buffer size. This can cause
potential security issues in the following execution.
This patch checks for capable(CAP_SYS_ADMIN) in twa_chrdev_open()t o
avoid the above issues.
Signed-off-by: Wenwen Wang <wang6495@umn.edu>
Acked-by: Adam Radford <aradford@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/3w-9xxx.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/scsi/3w-9xxx.c
+++ b/drivers/scsi/3w-9xxx.c
@@ -901,6 +901,11 @@ static int twa_chrdev_open(struct inode
unsigned int minor_number;
int retval = TW_IOCTL_ERROR_OS_ENODEV;
+ if (!capable(CAP_SYS_ADMIN)) {
+ retval = -EACCES;
+ goto out;
+ }
+
minor_number = iminor(inode);
if (minor_number >= twa_device_extension_count)
goto out;
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 50/85] scsi: 3w-xxxx: fix a missing-check bug
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (43 preceding siblings ...)
2018-08-07 18:51 ` [PATCH 3.18 49/85] scsi: 3w-9xxx: fix a missing-check bug Greg Kroah-Hartman
@ 2018-08-07 18:51 ` Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 3.18 51/85] scsi: megaraid: silence a static checker bug Greg Kroah-Hartman
` (36 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Wenwen Wang, Adam Radford,
Martin K. Petersen, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wenwen Wang <wang6495@umn.edu>
[ Upstream commit 9899e4d3523faaef17c67141aa80ff2088f17871 ]
In tw_chrdev_ioctl(), the length of the data buffer is firstly copied
from the userspace pointer 'argp' and saved to the kernel object
'data_buffer_length'. Then a security check is performed on it to make
sure that the length is not more than 'TW_MAX_IOCTL_SECTORS *
512'. Otherwise, an error code -EINVAL is returned. If the security
check is passed, the entire ioctl command is copied again from the
'argp' pointer and saved to the kernel object 'tw_ioctl'. Then, various
operations are performed on 'tw_ioctl' according to the 'cmd'. Given
that the 'argp' pointer resides in userspace, a malicious userspace
process can race to change the buffer length between the two
copies. This way, the user can bypass the security check and inject
invalid data buffer length. This can cause potential security issues in
the following execution.
This patch checks for capable(CAP_SYS_ADMIN) in tw_chrdev_open() to
avoid the above issues.
Signed-off-by: Wenwen Wang <wang6495@umn.edu>
Acked-by: Adam Radford <aradford@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/3w-xxxx.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/scsi/3w-xxxx.c
+++ b/drivers/scsi/3w-xxxx.c
@@ -1047,6 +1047,9 @@ static int tw_chrdev_open(struct inode *
dprintk(KERN_WARNING "3w-xxxx: tw_ioctl_open()\n");
+ if (!capable(CAP_SYS_ADMIN))
+ return -EACCES;
+
minor_number = iminor(inode);
if (minor_number >= tw_device_extension_count)
return -ENODEV;
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 51/85] scsi: megaraid: silence a static checker bug
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (44 preceding siblings ...)
2018-08-07 18:51 ` [PATCH 3.18 50/85] scsi: 3w-xxxx: " Greg Kroah-Hartman
@ 2018-08-07 18:51 ` Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 3.18 52/85] bpf: fix references to free_bpf_prog_info() in comments Greg Kroah-Hartman
` (35 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Martin K. Petersen,
Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
[ Upstream commit 27e833dabab74ee665e487e291c9afc6d71effba ]
If we had more than 32 megaraid cards then it would cause memory
corruption. That's not likely, of course, but it's handy to enforce it
and make the static checker happy.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/megaraid.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/scsi/megaraid.c
+++ b/drivers/scsi/megaraid.c
@@ -4200,6 +4200,9 @@ megaraid_probe_one(struct pci_dev *pdev,
int irq, i, j;
int error = -ENODEV;
+ if (hba_count >= MAX_CONTROLLERS)
+ goto out;
+
if (pci_enable_device(pdev))
goto out;
pci_set_master(pdev);
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 52/85] bpf: fix references to free_bpf_prog_info() in comments
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (45 preceding siblings ...)
2018-08-07 18:51 ` [PATCH 3.18 51/85] scsi: megaraid: silence a static checker bug Greg Kroah-Hartman
@ 2018-08-07 18:51 ` Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 3.18 53/85] media: siano: get rid of __le32/__le16 cast warnings Greg Kroah-Hartman
` (34 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jakub Kicinski, Quentin Monnet,
Daniel Borkmann, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <jakub.kicinski@netronome.com>
[ Upstream commit ab7f5bf0928be2f148d000a6eaa6c0a36e74750e ]
Comments in the verifier refer to free_bpf_prog_info() which
seems to have never existed in tree. Replace it with
free_used_maps().
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: Quentin Monnet <quentin.monnet@netronome.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/bpf/verifier.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -1763,7 +1763,7 @@ static int replace_map_fd_with_map_ptr(s
/* hold the map. If the program is rejected by verifier,
* the map will be released by release_maps() or it
* will be used by the valid program until it's unloaded
- * and all maps are released in free_bpf_prog_info()
+ * and all maps are released in free_used_maps()
*/
atomic_inc(&map->refcnt);
@@ -1929,7 +1929,7 @@ free_log_buf:
free_env:
if (!prog->aux->used_maps)
/* if we didn't copy map pointers into bpf_prog_info, release
- * them now. Otherwise free_bpf_prog_info() will release them.
+ * them now. Otherwise free_used_maps() will release them.
*/
release_maps(env);
kfree(env);
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 53/85] media: siano: get rid of __le32/__le16 cast warnings
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (46 preceding siblings ...)
2018-08-07 18:51 ` [PATCH 3.18 52/85] bpf: fix references to free_bpf_prog_info() in comments Greg Kroah-Hartman
@ 2018-08-07 18:51 ` Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 3.18 54/85] ALSA: hda/ca0132: fix build failure when a local macro is defined Greg Kroah-Hartman
` (33 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mauro Carvalho Chehab,
Mauro Carvalho Chehab, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mauro Carvalho Chehab <mchehab@s-opensource.com>
[ Upstream commit e1b7f11b37def5f3021c06e8c2b4953e099357aa ]
Those are all false-positives that appear with smatch when building for
arm:
drivers/media/common/siano/smsendian.c:38:36: warning: cast to restricted __le32
drivers/media/common/siano/smsendian.c:38:36: warning: cast to restricted __le32
drivers/media/common/siano/smsendian.c:38:36: warning: cast to restricted __le32
drivers/media/common/siano/smsendian.c:38:36: warning: cast to restricted __le32
drivers/media/common/siano/smsendian.c:38:36: warning: cast to restricted __le32
drivers/media/common/siano/smsendian.c:38:36: warning: cast to restricted __le32
drivers/media/common/siano/smsendian.c:47:44: warning: cast to restricted __le32
drivers/media/common/siano/smsendian.c:47:44: warning: cast to restricted __le32
drivers/media/common/siano/smsendian.c:47:44: warning: cast to restricted __le32
drivers/media/common/siano/smsendian.c:47:44: warning: cast to restricted __le32
drivers/media/common/siano/smsendian.c:47:44: warning: cast to restricted __le32
drivers/media/common/siano/smsendian.c:47:44: warning: cast to restricted __le32
drivers/media/common/siano/smsendian.c:67:35: warning: cast to restricted __le16
drivers/media/common/siano/smsendian.c:67:35: warning: cast to restricted __le16
drivers/media/common/siano/smsendian.c:67:35: warning: cast to restricted __le16
drivers/media/common/siano/smsendian.c:67:35: warning: cast to restricted __le16
drivers/media/common/siano/smsendian.c:84:44: warning: cast to restricted __le32
drivers/media/common/siano/smsendian.c:84:44: warning: cast to restricted __le32
drivers/media/common/siano/smsendian.c:84:44: warning: cast to restricted __le32
drivers/media/common/siano/smsendian.c:84:44: warning: cast to restricted __le32
drivers/media/common/siano/smsendian.c:84:44: warning: cast to restricted __le32
drivers/media/common/siano/smsendian.c:84:44: warning: cast to restricted __le32
drivers/media/common/siano/smsendian.c:98:26: warning: cast to restricted __le16
drivers/media/common/siano/smsendian.c:98:26: warning: cast to restricted __le16
drivers/media/common/siano/smsendian.c:98:26: warning: cast to restricted __le16
drivers/media/common/siano/smsendian.c:98:26: warning: cast to restricted __le16
drivers/media/common/siano/smsendian.c:99:28: warning: cast to restricted __le16
drivers/media/common/siano/smsendian.c:99:28: warning: cast to restricted __le16
drivers/media/common/siano/smsendian.c:99:28: warning: cast to restricted __le16
drivers/media/common/siano/smsendian.c:99:28: warning: cast to restricted __le16
drivers/media/common/siano/smsendian.c:100:27: warning: cast to restricted __le16
drivers/media/common/siano/smsendian.c:100:27: warning: cast to restricted __le16
drivers/media/common/siano/smsendian.c:100:27: warning: cast to restricted __le16
drivers/media/common/siano/smsendian.c:100:27: warning: cast to restricted __le16
Get rid of them by adding explicit forced casts.
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/common/siano/smsendian.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
--- a/drivers/media/common/siano/smsendian.c
+++ b/drivers/media/common/siano/smsendian.c
@@ -35,7 +35,7 @@ void smsendian_handle_tx_message(void *b
switch (msg->x_msg_header.msg_type) {
case MSG_SMS_DATA_DOWNLOAD_REQ:
{
- msg->msg_data[0] = le32_to_cpu(msg->msg_data[0]);
+ msg->msg_data[0] = le32_to_cpu((__force __le32)(msg->msg_data[0]));
break;
}
@@ -44,7 +44,7 @@ void smsendian_handle_tx_message(void *b
sizeof(struct sms_msg_hdr))/4;
for (i = 0; i < msg_words; i++)
- msg->msg_data[i] = le32_to_cpu(msg->msg_data[i]);
+ msg->msg_data[i] = le32_to_cpu((__force __le32)msg->msg_data[i]);
break;
}
@@ -64,7 +64,7 @@ void smsendian_handle_rx_message(void *b
{
struct sms_version_res *ver =
(struct sms_version_res *) msg;
- ver->chip_model = le16_to_cpu(ver->chip_model);
+ ver->chip_model = le16_to_cpu((__force __le16)ver->chip_model);
break;
}
@@ -81,7 +81,7 @@ void smsendian_handle_rx_message(void *b
sizeof(struct sms_msg_hdr))/4;
for (i = 0; i < msg_words; i++)
- msg->msg_data[i] = le32_to_cpu(msg->msg_data[i]);
+ msg->msg_data[i] = le32_to_cpu((__force __le32)msg->msg_data[i]);
break;
}
@@ -95,9 +95,9 @@ void smsendian_handle_message_header(voi
#ifdef __BIG_ENDIAN
struct sms_msg_hdr *phdr = (struct sms_msg_hdr *)msg;
- phdr->msg_type = le16_to_cpu(phdr->msg_type);
- phdr->msg_length = le16_to_cpu(phdr->msg_length);
- phdr->msg_flags = le16_to_cpu(phdr->msg_flags);
+ phdr->msg_type = le16_to_cpu((__force __le16)phdr->msg_type);
+ phdr->msg_length = le16_to_cpu((__force __le16)phdr->msg_length);
+ phdr->msg_flags = le16_to_cpu((__force __le16)phdr->msg_flags);
#endif /* __BIG_ENDIAN */
}
EXPORT_SYMBOL_GPL(smsendian_handle_message_header);
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 54/85] ALSA: hda/ca0132: fix build failure when a local macro is defined
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (47 preceding siblings ...)
2018-08-07 18:51 ` [PATCH 3.18 53/85] media: siano: get rid of __le32/__le16 cast warnings Greg Kroah-Hartman
@ 2018-08-07 18:51 ` Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 3.18 55/85] drm/gma500: fix psb_intel_lvds_mode_valid()s return type Greg Kroah-Hartman
` (32 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Connor McAdams, Takashi Sakamoto,
Takashi Iwai, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
[ Upstream commit 8e142e9e628975b0dddd05cf1b095331dff6e2de ]
DECLARE_TLV_DB_SCALE (alias of SNDRV_CTL_TLVD_DECLARE_DB_SCALE) is used but
tlv.h is not included. This causes build failure when local macro is
defined by comment-out.
This commit fixes the bug. At the same time, the alias macro is replaced
with a destination macro added at a commit 46e860f76804 ("ALSA: rename
TLV-related macros so that they're friendly to user applications")
Reported-by: Connor McAdams <conmanx360@gmail.com>
Fixes: 44f0c9782cc6 ('ALSA: hda/ca0132: Add tuning controls')
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/patch_ca0132.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/sound/pci/hda/patch_ca0132.c
+++ b/sound/pci/hda/patch_ca0132.c
@@ -38,6 +38,10 @@
/* Enable this to see controls for tuning purpose. */
/*#define ENABLE_TUNING_CONTROLS*/
+#ifdef ENABLE_TUNING_CONTROLS
+#include <sound/tlv.h>
+#endif
+
#define FLOAT_ZERO 0x00000000
#define FLOAT_ONE 0x3f800000
#define FLOAT_TWO 0x40000000
@@ -3037,8 +3041,8 @@ static int equalizer_ctl_put(struct snd_
return 1;
}
-static const DECLARE_TLV_DB_SCALE(voice_focus_db_scale, 2000, 100, 0);
-static const DECLARE_TLV_DB_SCALE(eq_db_scale, -2400, 100, 0);
+static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(voice_focus_db_scale, 2000, 100, 0);
+static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(eq_db_scale, -2400, 100, 0);
static int add_tuning_control(struct hda_codec *codec,
hda_nid_t pnid, hda_nid_t nid,
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 55/85] drm/gma500: fix psb_intel_lvds_mode_valid()s return type
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (48 preceding siblings ...)
2018-08-07 18:51 ` [PATCH 3.18 54/85] ALSA: hda/ca0132: fix build failure when a local macro is defined Greg Kroah-Hartman
@ 2018-08-07 18:51 ` Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 3.18 56/85] ipconfig: Correctly initialise ic_nameservers Greg Kroah-Hartman
` (31 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Luc Van Oostenryck, Daniel Vetter,
Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luc Van Oostenryck <luc.vanoostenryck@gmail.com>
[ Upstream commit 2ea009095c6e7396915a1d0dd480c41f02985f79 ]
The method struct drm_connector_helper_funcs::mode_valid is defined
as returning an 'enum drm_mode_status' but the driver implementation
for this method, psb_intel_lvds_mode_valid(), uses an 'int' for it.
Fix this by using 'enum drm_mode_status' for psb_intel_lvds_mode_valid().
Signed-off-by: Luc Van Oostenryck <luc.vanoostenryck@gmail.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20180424131458.2060-1-luc.vanoostenryck@gmail.com
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/gma500/psb_intel_drv.h | 2 +-
drivers/gpu/drm/gma500/psb_intel_lvds.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/gpu/drm/gma500/psb_intel_drv.h
+++ b/drivers/gpu/drm/gma500/psb_intel_drv.h
@@ -251,7 +251,7 @@ extern int intelfb_remove(struct drm_dev
extern bool psb_intel_lvds_mode_fixup(struct drm_encoder *encoder,
const struct drm_display_mode *mode,
struct drm_display_mode *adjusted_mode);
-extern int psb_intel_lvds_mode_valid(struct drm_connector *connector,
+extern enum drm_mode_status psb_intel_lvds_mode_valid(struct drm_connector *connector,
struct drm_display_mode *mode);
extern int psb_intel_lvds_set_property(struct drm_connector *connector,
struct drm_property *property,
--- a/drivers/gpu/drm/gma500/psb_intel_lvds.c
+++ b/drivers/gpu/drm/gma500/psb_intel_lvds.c
@@ -343,7 +343,7 @@ static void psb_intel_lvds_restore(struc
}
}
-int psb_intel_lvds_mode_valid(struct drm_connector *connector,
+enum drm_mode_status psb_intel_lvds_mode_valid(struct drm_connector *connector,
struct drm_display_mode *mode)
{
struct drm_psb_private *dev_priv = connector->dev->dev_private;
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 56/85] ipconfig: Correctly initialise ic_nameservers
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (49 preceding siblings ...)
2018-08-07 18:51 ` [PATCH 3.18 55/85] drm/gma500: fix psb_intel_lvds_mode_valid()s return type Greg Kroah-Hartman
@ 2018-08-07 18:51 ` Greg Kroah-Hartman
2018-08-07 18:51 ` [PATCH 3.18 57/85] rsi: Fix invalid vdd warning in mmc Greg Kroah-Hartman
` (30 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Chris Novakovic, David S. Miller,
Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Novakovic <chris@chrisn.me.uk>
[ Upstream commit 300eec7c0a2495f771709c7642aa15f7cc148b83 ]
ic_nameservers, which stores the list of name servers discovered by
ipconfig, is initialised (i.e. has all of its elements set to NONE, or
0xffffffff) by ic_nameservers_predef() in the following scenarios:
- before the "ip=" and "nfsaddrs=" kernel command line parameters are
parsed (in ip_auto_config_setup());
- before autoconfiguring via DHCP or BOOTP (in ic_bootp_init()), in
order to clear any values that may have been set after parsing "ip="
or "nfsaddrs=" and are no longer needed.
This means that ic_nameservers_predef() is not called when neither "ip="
nor "nfsaddrs=" is specified on the kernel command line. In this
scenario, every element in ic_nameservers remains set to 0x00000000,
which is indistinguishable from ANY and causes pnp_seq_show() to write
the following (bogus) information to /proc/net/pnp:
#MANUAL
nameserver 0.0.0.0
nameserver 0.0.0.0
nameserver 0.0.0.0
This is potentially problematic for systems that blindly link
/etc/resolv.conf to /proc/net/pnp.
Ensure that ic_nameservers is also initialised when neither "ip=" nor
"nfsaddrs=" are specified by calling ic_nameservers_predef() in
ip_auto_config(), but only when ip_auto_config_setup() was not called
earlier. This causes the following to be written to /proc/net/pnp, and
is consistent with what gets written when ipconfig is configured
manually but no name servers are specified on the kernel command line:
#MANUAL
Signed-off-by: Chris Novakovic <chris@chrisn.me.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/ipconfig.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
--- a/net/ipv4/ipconfig.c
+++ b/net/ipv4/ipconfig.c
@@ -772,6 +772,11 @@ static void __init ic_bootp_init_ext(u8
*/
static inline void __init ic_bootp_init(void)
{
+ /* Re-initialise all name servers to NONE, in case any were set via the
+ * "ip=" or "nfsaddrs=" kernel command line parameters: any IP addresses
+ * specified there will already have been decoded but are no longer
+ * needed
+ */
ic_nameservers_predef();
dev_add_pack(&bootp_packet_type);
@@ -1404,6 +1409,13 @@ static int __init ip_auto_config(void)
int err;
unsigned int i;
+ /* Initialise all name servers to NONE (but only if the "ip=" or
+ * "nfsaddrs=" kernel command line parameters weren't decoded, otherwise
+ * we'll overwrite the IP addresses specified there)
+ */
+ if (ic_set_manually == 0)
+ ic_nameservers_predef();
+
#ifdef CONFIG_PROC_FS
proc_create("pnp", S_IRUGO, init_net.proc_net, &pnp_seq_fops);
#endif /* CONFIG_PROC_FS */
@@ -1605,6 +1617,7 @@ static int __init ip_auto_config_setup(c
return 1;
}
+ /* Initialise all name servers to NONE */
ic_nameservers_predef();
/* Parse string for static IP assignment. */
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 57/85] rsi: Fix invalid vdd warning in mmc
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (50 preceding siblings ...)
2018-08-07 18:51 ` [PATCH 3.18 56/85] ipconfig: Correctly initialise ic_nameservers Greg Kroah-Hartman
@ 2018-08-07 18:51 ` Greg Kroah-Hartman
2018-08-07 18:52 ` [PATCH 3.18 58/85] microblaze: Fix simpleImage format generation Greg Kroah-Hartman
` (29 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Siva Rebbagondla, Amitkumar Karwar,
Kalle Valo, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Siva Rebbagondla <siva.rebbagondla@redpinesignals.com>
[ Upstream commit 78e450719c702784e42af6da912d3692fd3da0cb ]
While performing cleanup, driver is messing with card->ocr
value by not masking rocr against ocr_avail. Below panic
is observed with some of the SDIO host controllers due to
this. Issue is resolved by reverting incorrect modifications
to vdd.
[ 927.423821] mmc1: Invalid vdd 0x1f
[ 927.423925] Modules linked in: rsi_sdio(+) cmac bnep arc4 rsi_91x
mac80211 cfg80211 btrsi rfcomm bluetooth ecdh_generic
[ 927.424073] CPU: 0 PID: 1624 Comm: insmod Tainted: G W 4.15.0-1000-caracalla #1
[ 927.424075] Hardware name: Dell Inc. Edge Gateway 3003/ , BIOS 01.00.06 01/22/2018
[ 927.424082] RIP: 0010:sdhci_set_power_noreg+0xdd/0x190[sdhci]
[ 927.424085] RSP: 0018:ffffac3fc064b930 EFLAGS: 00010282
[ 927.424107] Call Trace:
[ 927.424118] sdhci_set_power+0x5a/0x60 [sdhci]
[ 927.424125] sdhci_set_ios+0x360/0x3b0 [sdhci]
[ 927.424133] mmc_set_initial_state+0x92/0x120
[ 927.424137] mmc_power_up.part.34+0x33/0x1d0
[ 927.424141] mmc_power_up+0x17/0x20
[ 927.424147] mmc_sdio_runtime_resume+0x2d/0x50
[ 927.424151] mmc_runtime_resume+0x17/0x20
[ 927.424156] __rpm_callback+0xc4/0x200
[ 927.424161] ? idr_alloc_cyclic+0x57/0xd0
[ 927.424165] ? mmc_runtime_suspend+0x20/0x20
[ 927.424169] rpm_callback+0x24/0x80
[ 927.424172] ? mmc_runtime_suspend+0x20/0x20
[ 927.424176] rpm_resume+0x4b3/0x6c0
[ 927.424181] __pm_runtime_resume+0x4e/0x80
[ 927.424188] driver_probe_device+0x41/0x490
[ 927.424192] __driver_attach+0xdf/0xf0
[ 927.424196] ? driver_probe_device+0x490/0x490
[ 927.424201] bus_for_each_dev+0x6c/0xc0
[ 927.424205] driver_attach+0x1e/0x20
[ 927.424209] bus_add_driver+0x1f4/0x270
[ 927.424217] ? rsi_sdio_ack_intr+0x50/0x50 [rsi_sdio]
[ 927.424221] driver_register+0x60/0xe0
[ 927.424227] ? rsi_sdio_ack_intr+0x50/0x50 [rsi_sdio]
[ 927.424231] sdio_register_driver+0x20/0x30
[ 927.424237] rsi_module_init+0x16/0x40 [rsi_sdio]
Signed-off-by: Siva Rebbagondla <siva.rebbagondla@redpinesignals.com>
Signed-off-by: Amitkumar Karwar <amit.karwar@redpinesignals.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/rsi/rsi_91x_sdio.c | 2 --
1 file changed, 2 deletions(-)
--- a/drivers/net/wireless/rsi/rsi_91x_sdio.c
+++ b/drivers/net/wireless/rsi/rsi_91x_sdio.c
@@ -155,7 +155,6 @@ static void rsi_reset_card(struct sdio_f
int err;
struct mmc_card *card = pfunction->card;
struct mmc_host *host = card->host;
- s32 bit = (fls(host->ocr_avail) - 1);
u8 cmd52_resp;
u32 clock, resp, i;
u16 rca;
@@ -175,7 +174,6 @@ static void rsi_reset_card(struct sdio_f
msleep(20);
/* Initialize the SDIO card */
- host->ios.vdd = bit;
host->ios.chip_select = MMC_CS_DONTCARE;
host->ios.bus_mode = MMC_BUSMODE_OPENDRAIN;
host->ios.power_mode = MMC_POWER_UP;
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 58/85] microblaze: Fix simpleImage format generation
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (51 preceding siblings ...)
2018-08-07 18:51 ` [PATCH 3.18 57/85] rsi: Fix invalid vdd warning in mmc Greg Kroah-Hartman
@ 2018-08-07 18:52 ` Greg Kroah-Hartman
2018-08-07 18:52 ` [PATCH 3.18 59/85] usb: hub: Dont wait for connect state at resume for powered-off ports Greg Kroah-Hartman
` (28 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:52 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Michal Simek, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Simek <michal.simek@xilinx.com>
[ Upstream commit ece97f3a5fb50cf5f98886fbc63c9665f2bb199d ]
simpleImage generation was broken for some time. This patch is fixing
steps how simpleImage.*.ub file is generated. Steps are objdump of
vmlinux and create .ub.
Also make sure that there is striped elf version with .strip suffix.
Signed-off-by: Michal Simek <michal.simek@xilinx.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/microblaze/boot/Makefile | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
--- a/arch/microblaze/boot/Makefile
+++ b/arch/microblaze/boot/Makefile
@@ -21,18 +21,20 @@ $(obj)/linux.bin.gz: $(obj)/linux.bin FO
quiet_cmd_cp = CP $< $@$2
cmd_cp = cat $< >$@$2 || (rm -f $@ && echo false)
-quiet_cmd_strip = STRIP $@
+quiet_cmd_strip = STRIP $< $@$2
cmd_strip = $(STRIP) -K microblaze_start -K _end -K __log_buf \
- -K _fdt_start vmlinux -o $@
+ -K _fdt_start $< -o $@$2
UIMAGE_LOADADDR = $(CONFIG_KERNEL_BASE_ADDR)
+UIMAGE_IN = $@
+UIMAGE_OUT = $@.ub
$(obj)/simpleImage.%: vmlinux FORCE
$(call if_changed,cp,.unstrip)
$(call if_changed,objcopy)
$(call if_changed,uimage)
- $(call if_changed,strip)
- @echo 'Kernel: $@ is ready' ' (#'`cat .version`')'
+ $(call if_changed,strip,.strip)
+ @echo 'Kernel: $(UIMAGE_OUT) is ready' ' (#'`cat .version`')'
clean-files += simpleImage.*.unstrip linux.bin.ub
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 59/85] usb: hub: Dont wait for connect state at resume for powered-off ports
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (52 preceding siblings ...)
2018-08-07 18:52 ` [PATCH 3.18 58/85] microblaze: Fix simpleImage format generation Greg Kroah-Hartman
@ 2018-08-07 18:52 ` Greg Kroah-Hartman
2018-08-07 18:52 ` [PATCH 3.18 60/85] crypto: authencesn - dont leak pointers to authenc keys Greg Kroah-Hartman
` (27 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dominik Bozek,
Kuppuswamy Sathyanarayanan, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dominik Bozek <dominikx.bozek@intel.com>
[ Upstream commit 5d111f5190848d6fb1c414dc57797efea3526a2f ]
wait_for_connected() wait till a port change status to
USB_PORT_STAT_CONNECTION, but this is not possible if
the port is unpowered. The loop will only exit at timeout.
Such case take place if an over-current incident happen
while system is in S3. Then during resume wait_for_connected()
will wait 2s, which may be noticeable by the user.
Signed-off-by: Dominik Bozek <dominikx.bozek@intel.com>
Signed-off-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/core/hub.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -3310,6 +3310,10 @@ static int wait_for_ss_port_enable(struc
while (delay_ms < 2000) {
if (status || *portstatus & USB_PORT_STAT_CONNECTION)
break;
+ if (!port_is_power_on(hub, *portstatus)) {
+ status = -ENODEV;
+ break;
+ }
msleep(20);
delay_ms += 20;
status = hub_port_status(hub, *port1, portstatus, portchange);
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 60/85] crypto: authencesn - dont leak pointers to authenc keys
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (53 preceding siblings ...)
2018-08-07 18:52 ` [PATCH 3.18 59/85] usb: hub: Dont wait for connect state at resume for powered-off ports Greg Kroah-Hartman
@ 2018-08-07 18:52 ` Greg Kroah-Hartman
2018-08-07 18:52 ` [PATCH 3.18 61/85] crypto: authenc " Greg Kroah-Hartman
` (26 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tudor Ambarus, Herbert Xu, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tudor-Dan Ambarus <tudor.ambarus@microchip.com>
[ Upstream commit 31545df391d58a3bb60e29b1192644a6f2b5a8dd ]
In crypto_authenc_esn_setkey we save pointers to the authenc keys
in a local variable of type struct crypto_authenc_keys and we don't
zeroize it after use. Fix this and don't leak pointers to the
authenc keys.
Signed-off-by: Tudor Ambarus <tudor.ambarus@microchip.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
crypto/authencesn.c | 1 +
1 file changed, 1 insertion(+)
--- a/crypto/authencesn.c
+++ b/crypto/authencesn.c
@@ -86,6 +86,7 @@ static int crypto_authenc_esn_setkey(str
CRYPTO_TFM_RES_MASK);
out:
+ memzero_explicit(&keys, sizeof(keys));
return err;
badkey:
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 61/85] crypto: authenc - dont leak pointers to authenc keys
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (54 preceding siblings ...)
2018-08-07 18:52 ` [PATCH 3.18 60/85] crypto: authencesn - dont leak pointers to authenc keys Greg Kroah-Hartman
@ 2018-08-07 18:52 ` Greg Kroah-Hartman
2018-08-07 18:52 ` [PATCH 3.18 62/85] media: omap3isp: fix unbalanced dma_iommu_mapping Greg Kroah-Hartman
` (25 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tudor Ambarus, Herbert Xu, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tudor-Dan Ambarus <tudor.ambarus@microchip.com>
[ Upstream commit ad2fdcdf75d169e7a5aec6c7cb421c0bec8ec711 ]
In crypto_authenc_setkey we save pointers to the authenc keys in
a local variable of type struct crypto_authenc_keys and we don't
zeroize it after use. Fix this and don't leak pointers to the
authenc keys.
Signed-off-by: Tudor Ambarus <tudor.ambarus@microchip.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
crypto/authenc.c | 1 +
1 file changed, 1 insertion(+)
--- a/crypto/authenc.c
+++ b/crypto/authenc.c
@@ -112,6 +112,7 @@ static int crypto_authenc_setkey(struct
CRYPTO_TFM_RES_MASK);
out:
+ memzero_explicit(&keys, sizeof(keys));
return err;
badkey:
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 62/85] media: omap3isp: fix unbalanced dma_iommu_mapping
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (55 preceding siblings ...)
2018-08-07 18:52 ` [PATCH 3.18 61/85] crypto: authenc " Greg Kroah-Hartman
@ 2018-08-07 18:52 ` Greg Kroah-Hartman
2018-08-07 18:52 ` [PATCH 3.18 63/85] media: si470x: fix __be16 annotations Greg Kroah-Hartman
` (24 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Pavel Machek, Suman Anna,
Laurent Pinchart, Sakari Ailus, Mauro Carvalho Chehab,
Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Suman Anna <s-anna@ti.com>
[ Upstream commit b7e1e6859fbf60519fd82d7120cee106a6019512 ]
The OMAP3 ISP driver manages its MMU mappings through the IOMMU-aware
ARM DMA backend. The current code creates a dma_iommu_mapping and
attaches this to the ISP device, but never detaches the mapping in
either the probe failure paths or the driver remove path resulting
in an unbalanced mapping refcount and a memory leak. Fix this properly.
Reported-by: Pavel Machek <pavel@ucw.cz>
Signed-off-by: Suman Anna <s-anna@ti.com>
Tested-by: Pavel Machek <pavel@ucw.cz>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/platform/omap3isp/isp.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/drivers/media/platform/omap3isp/isp.c
+++ b/drivers/media/platform/omap3isp/isp.c
@@ -2117,6 +2117,7 @@ error_csiphy:
static void isp_detach_iommu(struct isp_device *isp)
{
+ arm_iommu_detach_device(isp->dev);
arm_iommu_release_mapping(isp->mapping);
isp->mapping = NULL;
iommu_group_remove_device(isp->dev);
@@ -2150,8 +2151,7 @@ static int isp_attach_iommu(struct isp_d
mapping = arm_iommu_create_mapping(&platform_bus_type, SZ_1G, SZ_2G);
if (IS_ERR(mapping)) {
dev_err(isp->dev, "failed to create ARM IOMMU mapping\n");
- ret = PTR_ERR(mapping);
- goto error;
+ return PTR_ERR(mapping);
}
isp->mapping = mapping;
@@ -2166,7 +2166,8 @@ static int isp_attach_iommu(struct isp_d
return 0;
error:
- isp_detach_iommu(isp);
+ arm_iommu_release_mapping(isp->mapping);
+ isp->mapping = NULL;
return ret;
}
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 63/85] media: si470x: fix __be16 annotations
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (56 preceding siblings ...)
2018-08-07 18:52 ` [PATCH 3.18 62/85] media: omap3isp: fix unbalanced dma_iommu_mapping Greg Kroah-Hartman
@ 2018-08-07 18:52 ` Greg Kroah-Hartman
2018-08-07 18:52 ` [PATCH 3.18 64/85] random: mix rdrand with entropy sent in from userspace Greg Kroah-Hartman
` (23 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mauro Carvalho Chehab, Sasha Levin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mauro Carvalho Chehab <mchehab@s-opensource.com>
[ Upstream commit 90db5c829692a0a7845e977e45719b4699216bd4 ]
The annotations there are wrong as warned:
drivers/media/radio/si470x/radio-si470x-i2c.c:107:35: warning: cast to restricted __be16
drivers/media/radio/si470x/radio-si470x-i2c.c:107:35: warning: cast to restricted __be16
drivers/media/radio/si470x/radio-si470x-i2c.c:107:35: warning: cast to restricted __be16
drivers/media/radio/si470x/radio-si470x-i2c.c:107:35: warning: cast to restricted __be16
drivers/media/radio/si470x/radio-si470x-i2c.c:129:24: warning: incorrect type in assignment (different base types)
drivers/media/radio/si470x/radio-si470x-i2c.c:129:24: expected unsigned short [unsigned] [short] <noident>
drivers/media/radio/si470x/radio-si470x-i2c.c:129:24: got restricted __be16 [usertype] <noident>
drivers/media/radio/si470x/radio-si470x-i2c.c:163:39: warning: cast to restricted __be16
drivers/media/radio/si470x/radio-si470x-i2c.c:163:39: warning: cast to restricted __be16
drivers/media/radio/si470x/radio-si470x-i2c.c:163:39: warning: cast to restricted __be16
drivers/media/radio/si470x/radio-si470x-i2c.c:163:39: warning: cast to restricted __be16
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/radio/si470x/radio-si470x-i2c.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/media/radio/si470x/radio-si470x-i2c.c
+++ b/drivers/media/radio/si470x/radio-si470x-i2c.c
@@ -96,7 +96,7 @@ MODULE_PARM_DESC(max_rds_errors, "RDS ma
*/
int si470x_get_register(struct si470x_device *radio, int regnr)
{
- u16 buf[READ_REG_NUM];
+ __be16 buf[READ_REG_NUM];
struct i2c_msg msgs[1] = {
{
.addr = radio->client->addr,
@@ -121,7 +121,7 @@ int si470x_get_register(struct si470x_de
int si470x_set_register(struct si470x_device *radio, int regnr)
{
int i;
- u16 buf[WRITE_REG_NUM];
+ __be16 buf[WRITE_REG_NUM];
struct i2c_msg msgs[1] = {
{
.addr = radio->client->addr,
@@ -151,7 +151,7 @@ int si470x_set_register(struct si470x_de
static int si470x_get_all_registers(struct si470x_device *radio)
{
int i;
- u16 buf[READ_REG_NUM];
+ __be16 buf[READ_REG_NUM];
struct i2c_msg msgs[1] = {
{
.addr = radio->client->addr,
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 64/85] random: mix rdrand with entropy sent in from userspace
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (57 preceding siblings ...)
2018-08-07 18:52 ` [PATCH 3.18 63/85] media: si470x: fix __be16 annotations Greg Kroah-Hartman
@ 2018-08-07 18:52 ` Greg Kroah-Hartman
2018-08-07 18:52 ` [PATCH 3.18 65/85] squashfs: be more careful about metadata corruption Greg Kroah-Hartman
` (22 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:52 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Theodore Tso, Arnd Bergmann
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Theodore Ts'o <tytso@mit.edu>
commit 81e69df38e2911b642ec121dec319fad2a4782f3 upstream.
Fedora has integrated the jitter entropy daemon to work around slow
boot problems, especially on VM's that don't support virtio-rng:
https://bugzilla.redhat.com/show_bug.cgi?id=1572944
It's understandable why they did this, but the Jitter entropy daemon
works fundamentally on the principle: "the CPU microarchitecture is
**so** complicated and we can't figure it out, so it *must* be
random". Yes, it uses statistical tests to "prove" it is secure, but
AES_ENCRYPT(NSA_KEY, COUNTER++) will also pass statistical tests with
flying colors.
So if RDRAND is available, mix it into entropy submitted from
userspace. It can't hurt, and if you believe the NSA has backdoored
RDRAND, then they probably have enough details about the Intel
microarchitecture that they can reverse engineer how the Jitter
entropy daemon affects the microarchitecture, and attack its output
stream. And if RDRAND is in fact an honest DRNG, it will immeasurably
improve on what the Jitter entropy daemon might produce.
This also provides some protection against someone who is able to read
or set the entropy seed file.
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@vger.kernel.org
Cc: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/char/random.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -1417,14 +1417,22 @@ static int
write_pool(struct entropy_store *r, const char __user *buffer, size_t count)
{
size_t bytes;
- __u32 buf[16];
+ __u32 t, buf[16];
const char __user *p = buffer;
while (count > 0) {
+ int b, i = 0;
+
bytes = min(count, sizeof(buf));
if (copy_from_user(&buf, p, bytes))
return -EFAULT;
+ for (b = bytes ; b > 0 ; b -= sizeof(__u32), i++) {
+ if (!arch_get_random_int(&t))
+ break;
+ buf[i] ^= t;
+ }
+
count -= bytes;
p += bytes;
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 65/85] squashfs: be more careful about metadata corruption
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (58 preceding siblings ...)
2018-08-07 18:52 ` [PATCH 3.18 64/85] random: mix rdrand with entropy sent in from userspace Greg Kroah-Hartman
@ 2018-08-07 18:52 ` Greg Kroah-Hartman
2018-08-07 18:52 ` [PATCH 3.18 66/85] NET: stmmac: align DMA stuff to largest cache line length Greg Kroah-Hartman
` (21 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Anatoly Trosinenko, Al Viro,
Phillip Lougher, stable, Linus Torvalds
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Torvalds <torvalds@linux-foundation.org>
commit 01cfb7937a9af2abb1136c7e89fbf3fd92952956 upstream.
Anatoly Trosinenko reports that a corrupted squashfs image can cause a
kernel oops. It turns out that squashfs can end up being confused about
negative fragment lengths.
The regular squashfs_read_data() does check for negative lengths, but
squashfs_read_metadata() did not, and the fragment size code just
blindly trusted the on-disk value. Fix both the fragment parsing and
the metadata reading code.
Reported-by: Anatoly Trosinenko <anatoly.trosinenko@gmail.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Phillip Lougher <phillip@squashfs.org.uk>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/squashfs/cache.c | 3 +++
fs/squashfs/file.c | 8 ++++++--
fs/squashfs/fragment.c | 4 +---
fs/squashfs/squashfs_fs.h | 6 ++++++
4 files changed, 16 insertions(+), 5 deletions(-)
--- a/fs/squashfs/cache.c
+++ b/fs/squashfs/cache.c
@@ -350,6 +350,9 @@ int squashfs_read_metadata(struct super_
TRACE("Entered squashfs_read_metadata [%llx:%x]\n", *block, *offset);
+ if (unlikely(length < 0))
+ return -EIO;
+
while (length) {
entry = squashfs_cache_get(sb, msblk->block_cache, *block, 0);
if (entry->error) {
--- a/fs/squashfs/file.c
+++ b/fs/squashfs/file.c
@@ -194,7 +194,11 @@ static long long read_indexes(struct sup
}
for (i = 0; i < blocks; i++) {
- int size = le32_to_cpu(blist[i]);
+ int size = squashfs_block_size(blist[i]);
+ if (size < 0) {
+ err = size;
+ goto failure;
+ }
block += SQUASHFS_COMPRESSED_SIZE_BLOCK(size);
}
n -= blocks;
@@ -367,7 +371,7 @@ static int read_blocklist(struct inode *
sizeof(size));
if (res < 0)
return res;
- return le32_to_cpu(size);
+ return squashfs_block_size(size);
}
/* Copy data into page cache */
--- a/fs/squashfs/fragment.c
+++ b/fs/squashfs/fragment.c
@@ -61,9 +61,7 @@ int squashfs_frag_lookup(struct super_bl
return size;
*fragment_block = le64_to_cpu(fragment_entry.start_block);
- size = le32_to_cpu(fragment_entry.size);
-
- return size;
+ return squashfs_block_size(fragment_entry.size);
}
--- a/fs/squashfs/squashfs_fs.h
+++ b/fs/squashfs/squashfs_fs.h
@@ -129,6 +129,12 @@
#define SQUASHFS_COMPRESSED_BLOCK(B) (!((B) & SQUASHFS_COMPRESSED_BIT_BLOCK))
+static inline int squashfs_block_size(__le32 raw)
+{
+ u32 size = le32_to_cpu(raw);
+ return (size >> 25) ? -EIO : size;
+}
+
/*
* Inode number ops. Inodes consist of a compressed block number, and an
* uncompressed offset within that block
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 66/85] NET: stmmac: align DMA stuff to largest cache line length
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (59 preceding siblings ...)
2018-08-07 18:52 ` [PATCH 3.18 65/85] squashfs: be more careful about metadata corruption Greg Kroah-Hartman
@ 2018-08-07 18:52 ` Greg Kroah-Hartman
2018-08-07 18:52 ` [PATCH 3.18 67/85] xen-netfront: wait xenbus state change when load module manually Greg Kroah-Hartman
` (20 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:52 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Eugeniy Paltsev, David S. Miller
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eugeniy Paltsev <Eugeniy.Paltsev@synopsys.com>
[ Upstream commit 9939a46d90c6c76f4533d534dbadfa7b39dc6acc ]
As for today STMMAC_ALIGN macro (which is used to align DMA stuff)
relies on L1 line length (L1_CACHE_BYTES).
This isn't correct in case of system with several cache levels
which might have L1 cache line length smaller than L2 line. This
can lead to sharing one cache line between DMA buffer and other
data, so we can lose this data while invalidate DMA buffer before
DMA transaction.
Fix that by using SMP_CACHE_BYTES instead of L1_CACHE_BYTES for
aligning.
Signed-off-by: Eugeniy Paltsev <Eugeniy.Paltsev@synopsys.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -53,7 +53,7 @@
#include "stmmac.h"
#include <linux/reset.h>
-#define STMMAC_ALIGN(x) L1_CACHE_ALIGN(x)
+#define STMMAC_ALIGN(x) __ALIGN_KERNEL(x, SMP_CACHE_BYTES)
/* Module parameters */
#define TX_TIMEO 5000
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 67/85] xen-netfront: wait xenbus state change when load module manually
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (60 preceding siblings ...)
2018-08-07 18:52 ` [PATCH 3.18 66/85] NET: stmmac: align DMA stuff to largest cache line length Greg Kroah-Hartman
@ 2018-08-07 18:52 ` Greg Kroah-Hartman
2018-08-07 18:52 ` [PATCH 3.18 68/85] tcp: do not force quickack when receiving out-of-order packets Greg Kroah-Hartman
` (19 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:52 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Xiao Liang, David S. Miller
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiao Liang <xiliang@redhat.com>
[ Upstream commit 822fb18a82abaf4ee7058793d95d340f5dab7bfc ]
When loading module manually, after call xenbus_switch_state to initializes
the state of the netfront device, the driver state did not change so fast
that may lead no dev created in latest kernel. This patch adds wait to make
sure xenbus knows the driver is not in closed/unknown state.
Current state:
[vm]# ethtool eth0
Settings for eth0:
Link detected: yes
[vm]# modprobe -r xen_netfront
[vm]# modprobe xen_netfront
[vm]# ethtool eth0
Settings for eth0:
Cannot get device settings: No such device
Cannot get wake-on-lan settings: No such device
Cannot get message level: No such device
Cannot get link status: No such device
No data available
With the patch installed.
[vm]# ethtool eth0
Settings for eth0:
Link detected: yes
[vm]# modprobe -r xen_netfront
[vm]# modprobe xen_netfront
[vm]# ethtool eth0
Settings for eth0:
Link detected: yes
Signed-off-by: Xiao Liang <xiliang@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/xen-netfront.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -85,6 +85,7 @@ struct netfront_cb {
/* IRQ name is queue name with "-tx" or "-rx" appended */
#define IRQ_NAME_SIZE (QUEUE_NAME_SIZE + 3)
+static DECLARE_WAIT_QUEUE_HEAD(module_load_q);
static DECLARE_WAIT_QUEUE_HEAD(module_unload_q);
struct netfront_stats {
@@ -1359,6 +1360,11 @@ static struct net_device *xennet_create_
netif_carrier_off(netdev);
xenbus_switch_state(dev, XenbusStateInitialising);
+ wait_event(module_load_q,
+ xenbus_read_driver_state(dev->otherend) !=
+ XenbusStateClosed &&
+ xenbus_read_driver_state(dev->otherend) !=
+ XenbusStateUnknown);
return netdev;
exit:
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 68/85] tcp: do not force quickack when receiving out-of-order packets
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (61 preceding siblings ...)
2018-08-07 18:52 ` [PATCH 3.18 67/85] xen-netfront: wait xenbus state change when load module manually Greg Kroah-Hartman
@ 2018-08-07 18:52 ` Greg Kroah-Hartman
2018-08-07 18:52 ` [PATCH 3.18 69/85] tcp: add max_quickacks param to tcp_incr_quickack and tcp_enter_quickack_mode Greg Kroah-Hartman
` (18 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Eric Dumazet, Neal Cardwell,
Soheil Hassas Yeganeh, David S. Miller
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit a3893637e1eb0ef5eb1bbc52b3a8d2dfa317a35d ]
As explained in commit 9f9843a751d0 ("tcp: properly handle stretch
acks in slow start"), TCP stacks have to consider how many packets
are acknowledged in one single ACK, because of GRO, but also
because of ACK compression or losses.
We plan to add SACK compression in the following patch, we
must therefore not call tcp_enter_quickack_mode()
Signed-off-by: Eric Dumazet <edumazet@google.com>
Acked-by: Neal Cardwell <ncardwell@google.com>
Acked-by: Soheil Hassas Yeganeh <soheil@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/tcp_input.c | 2 --
1 file changed, 2 deletions(-)
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -4512,8 +4512,6 @@ drop:
if (!before(TCP_SKB_CB(skb)->seq, tp->rcv_nxt + tcp_receive_window(tp)))
goto out_of_window;
- tcp_enter_quickack_mode(sk);
-
if (before(TCP_SKB_CB(skb)->seq, tp->rcv_nxt)) {
/* Partial packet, seq < rcv_next < end_seq */
SOCK_DEBUG(sk, "partial packet: rcv_next %X seq %X - %X\n",
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 69/85] tcp: add max_quickacks param to tcp_incr_quickack and tcp_enter_quickack_mode
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (62 preceding siblings ...)
2018-08-07 18:52 ` [PATCH 3.18 68/85] tcp: do not force quickack when receiving out-of-order packets Greg Kroah-Hartman
@ 2018-08-07 18:52 ` Greg Kroah-Hartman
2018-08-07 18:52 ` [PATCH 3.18 70/85] tcp: do not aggressively quick ack after ECN events Greg Kroah-Hartman
` (17 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Eric Dumazet, Soheil Hassas Yeganeh,
Neal Cardwell, David S. Miller
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 9a9c9b51e54618861420093ae6e9b50a961914c5 ]
We want to add finer control of the number of ACK packets sent after
ECN events.
This patch is not changing current behavior, it only enables following
change.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Acked-by: Soheil Hassas Yeganeh <soheil@google.com>
Acked-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/net/tcp.h | 2 +-
net/ipv4/tcp_dctcp.c | 4 ++--
net/ipv4/tcp_input.c | 24 +++++++++++++-----------
3 files changed, 16 insertions(+), 14 deletions(-)
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -372,7 +372,7 @@ ssize_t tcp_splice_read(struct socket *s
struct pipe_inode_info *pipe, size_t len,
unsigned int flags);
-void tcp_enter_quickack_mode(struct sock *sk);
+void tcp_enter_quickack_mode(struct sock *sk, unsigned int max_quickacks);
static inline void tcp_dec_quickack_mode(struct sock *sk,
const unsigned int pkts)
{
--- a/net/ipv4/tcp_dctcp.c
+++ b/net/ipv4/tcp_dctcp.c
@@ -135,7 +135,7 @@ static void dctcp_ce_state_0_to_1(struct
*/
if (inet_csk(sk)->icsk_ack.pending & ICSK_ACK_TIMER)
__tcp_send_ack(sk, ca->prior_rcv_nxt);
- tcp_enter_quickack_mode(sk);
+ tcp_enter_quickack_mode(sk, 1);
}
ca->prior_rcv_nxt = tp->rcv_nxt;
@@ -156,7 +156,7 @@ static void dctcp_ce_state_1_to_0(struct
*/
if (inet_csk(sk)->icsk_ack.pending & ICSK_ACK_TIMER)
__tcp_send_ack(sk, ca->prior_rcv_nxt);
- tcp_enter_quickack_mode(sk);
+ tcp_enter_quickack_mode(sk, 1);
}
ca->prior_rcv_nxt = tp->rcv_nxt;
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -171,21 +171,23 @@ static void tcp_measure_rcv_mss(struct s
}
}
-static void tcp_incr_quickack(struct sock *sk)
+static void tcp_incr_quickack(struct sock *sk, unsigned int max_quickacks)
{
struct inet_connection_sock *icsk = inet_csk(sk);
unsigned int quickacks = tcp_sk(sk)->rcv_wnd / (2 * icsk->icsk_ack.rcv_mss);
if (quickacks == 0)
quickacks = 2;
+ quickacks = min(quickacks, max_quickacks);
if (quickacks > icsk->icsk_ack.quick)
- icsk->icsk_ack.quick = min(quickacks, TCP_MAX_QUICKACKS);
+ icsk->icsk_ack.quick = quickacks;
}
-void tcp_enter_quickack_mode(struct sock *sk)
+void tcp_enter_quickack_mode(struct sock *sk, unsigned int max_quickacks)
{
struct inet_connection_sock *icsk = inet_csk(sk);
- tcp_incr_quickack(sk);
+
+ tcp_incr_quickack(sk, max_quickacks);
icsk->icsk_ack.pingpong = 0;
icsk->icsk_ack.ato = TCP_ATO_MIN;
}
@@ -228,7 +230,7 @@ static void __tcp_ecn_check_ce(struct tc
* it is probably a retransmit.
*/
if (tp->ecn_flags & TCP_ECN_SEEN)
- tcp_enter_quickack_mode((struct sock *)tp);
+ tcp_enter_quickack_mode((struct sock *)tp, TCP_MAX_QUICKACKS);
break;
case INET_ECN_CE:
if (tcp_ca_needs_ecn((struct sock *)tp))
@@ -236,7 +238,7 @@ static void __tcp_ecn_check_ce(struct tc
if (!(tp->ecn_flags & TCP_ECN_DEMAND_CWR)) {
/* Better not delay acks, sender can have a very low cwnd */
- tcp_enter_quickack_mode((struct sock *)tp);
+ tcp_enter_quickack_mode((struct sock *)tp, TCP_MAX_QUICKACKS);
tp->ecn_flags |= TCP_ECN_DEMAND_CWR;
}
tp->ecn_flags |= TCP_ECN_SEEN;
@@ -644,7 +646,7 @@ static void tcp_event_data_recv(struct s
/* The _first_ data packet received, initialize
* delayed ACK engine.
*/
- tcp_incr_quickack(sk);
+ tcp_incr_quickack(sk, TCP_MAX_QUICKACKS);
icsk->icsk_ack.ato = TCP_ATO_MIN;
} else {
int m = now - icsk->icsk_ack.lrcvtime;
@@ -660,7 +662,7 @@ static void tcp_event_data_recv(struct s
/* Too long gap. Apparently sender failed to
* restart window, so that we send ACKs quickly.
*/
- tcp_incr_quickack(sk);
+ tcp_incr_quickack(sk, TCP_MAX_QUICKACKS);
sk_mem_reclaim(sk);
}
}
@@ -4001,7 +4003,7 @@ static void tcp_send_dupack(struct sock
if (TCP_SKB_CB(skb)->end_seq != TCP_SKB_CB(skb)->seq &&
before(TCP_SKB_CB(skb)->seq, tp->rcv_nxt)) {
NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_DELAYEDACKLOST);
- tcp_enter_quickack_mode(sk);
+ tcp_enter_quickack_mode(sk, TCP_MAX_QUICKACKS);
if (tcp_is_sack(tp) && sysctl_tcp_dsack) {
u32 end_seq = TCP_SKB_CB(skb)->end_seq;
@@ -4501,7 +4503,7 @@ queue_and_out:
tcp_dsack_set(sk, TCP_SKB_CB(skb)->seq, TCP_SKB_CB(skb)->end_seq);
out_of_window:
- tcp_enter_quickack_mode(sk);
+ tcp_enter_quickack_mode(sk, TCP_MAX_QUICKACKS);
inet_csk_schedule_ack(sk);
drop:
__kfree_skb(skb);
@@ -5521,7 +5523,7 @@ static int tcp_rcv_synsent_state_process
* to stand against the temptation 8) --ANK
*/
inet_csk_schedule_ack(sk);
- tcp_enter_quickack_mode(sk);
+ tcp_enter_quickack_mode(sk, TCP_MAX_QUICKACKS);
inet_csk_reset_xmit_timer(sk, ICSK_TIME_DACK,
TCP_DELACK_MAX, TCP_RTO_MAX);
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 70/85] tcp: do not aggressively quick ack after ECN events
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (63 preceding siblings ...)
2018-08-07 18:52 ` [PATCH 3.18 69/85] tcp: add max_quickacks param to tcp_incr_quickack and tcp_enter_quickack_mode Greg Kroah-Hartman
@ 2018-08-07 18:52 ` Greg Kroah-Hartman
2018-08-07 18:52 ` [PATCH 3.18 71/85] tcp: refactor tcp_ecn_check_ce to remove sk type cast Greg Kroah-Hartman
` (16 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Eric Dumazet, Soheil Hassas Yeganeh,
Yuchung Cheng, Neal Cardwell, David S. Miller
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 522040ea5fdd1c33bbf75e1d7c7c0422b96a94ef ]
ECN signals currently forces TCP to enter quickack mode for
up to 16 (TCP_MAX_QUICKACKS) following incoming packets.
We believe this is not needed, and only sending one immediate ack
for the current packet should be enough.
This should reduce the extra load noticed in DCTCP environments,
after congestion events.
This is part 2 of our effort to reduce pure ACK packets.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Acked-by: Soheil Hassas Yeganeh <soheil@google.com>
Acked-by: Yuchung Cheng <ycheng@google.com>
Acked-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/tcp_input.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -230,7 +230,7 @@ static void __tcp_ecn_check_ce(struct tc
* it is probably a retransmit.
*/
if (tp->ecn_flags & TCP_ECN_SEEN)
- tcp_enter_quickack_mode((struct sock *)tp, TCP_MAX_QUICKACKS);
+ tcp_enter_quickack_mode((struct sock *)tp, 1);
break;
case INET_ECN_CE:
if (tcp_ca_needs_ecn((struct sock *)tp))
@@ -238,7 +238,7 @@ static void __tcp_ecn_check_ce(struct tc
if (!(tp->ecn_flags & TCP_ECN_DEMAND_CWR)) {
/* Better not delay acks, sender can have a very low cwnd */
- tcp_enter_quickack_mode((struct sock *)tp, TCP_MAX_QUICKACKS);
+ tcp_enter_quickack_mode((struct sock *)tp, 1);
tp->ecn_flags |= TCP_ECN_DEMAND_CWR;
}
tp->ecn_flags |= TCP_ECN_SEEN;
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 71/85] tcp: refactor tcp_ecn_check_ce to remove sk type cast
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (64 preceding siblings ...)
2018-08-07 18:52 ` [PATCH 3.18 70/85] tcp: do not aggressively quick ack after ECN events Greg Kroah-Hartman
@ 2018-08-07 18:52 ` Greg Kroah-Hartman
2018-08-07 18:52 ` [PATCH 3.18 72/85] tcp: add one more quick ack after after ECN events Greg Kroah-Hartman
` (15 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Yousuk Seung, Neal Cardwell,
Yuchung Cheng, Eric Dumazet, Soheil Hassas Yeganeh,
David S. Miller
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yousuk Seung <ysseung@google.com>
[ Upstream commit f4c9f85f3b2cb7669830cd04d0be61192a4d2436 ]
Refactor tcp_ecn_check_ce and __tcp_ecn_check_ce to accept struct sock*
instead of tcp_sock* to clean up type casts. This is a pure refactor
patch.
Signed-off-by: Yousuk Seung <ysseung@google.com>
Signed-off-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: Yuchung Cheng <ycheng@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Acked-by: Soheil Hassas Yeganeh <soheil@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/tcp_input.c | 26 ++++++++++++++------------
1 file changed, 14 insertions(+), 12 deletions(-)
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -221,8 +221,10 @@ static void tcp_ecn_withdraw_cwr(struct
tp->ecn_flags &= ~TCP_ECN_DEMAND_CWR;
}
-static void __tcp_ecn_check_ce(struct tcp_sock *tp, const struct sk_buff *skb)
+static void __tcp_ecn_check_ce(struct sock *sk, const struct sk_buff *skb)
{
+ struct tcp_sock *tp = tcp_sk(sk);
+
switch (TCP_SKB_CB(skb)->ip_dsfield & INET_ECN_MASK) {
case INET_ECN_NOT_ECT:
/* Funny extension: if ECT is not set on a segment,
@@ -230,31 +232,31 @@ static void __tcp_ecn_check_ce(struct tc
* it is probably a retransmit.
*/
if (tp->ecn_flags & TCP_ECN_SEEN)
- tcp_enter_quickack_mode((struct sock *)tp, 1);
+ tcp_enter_quickack_mode(sk, 1);
break;
case INET_ECN_CE:
- if (tcp_ca_needs_ecn((struct sock *)tp))
- tcp_ca_event((struct sock *)tp, CA_EVENT_ECN_IS_CE);
+ if (tcp_ca_needs_ecn(sk))
+ tcp_ca_event(sk, CA_EVENT_ECN_IS_CE);
if (!(tp->ecn_flags & TCP_ECN_DEMAND_CWR)) {
/* Better not delay acks, sender can have a very low cwnd */
- tcp_enter_quickack_mode((struct sock *)tp, 1);
+ tcp_enter_quickack_mode(sk, 1);
tp->ecn_flags |= TCP_ECN_DEMAND_CWR;
}
tp->ecn_flags |= TCP_ECN_SEEN;
break;
default:
- if (tcp_ca_needs_ecn((struct sock *)tp))
- tcp_ca_event((struct sock *)tp, CA_EVENT_ECN_NO_CE);
+ if (tcp_ca_needs_ecn(sk))
+ tcp_ca_event(sk, CA_EVENT_ECN_NO_CE);
tp->ecn_flags |= TCP_ECN_SEEN;
break;
}
}
-static void tcp_ecn_check_ce(struct tcp_sock *tp, const struct sk_buff *skb)
+static void tcp_ecn_check_ce(struct sock *sk, const struct sk_buff *skb)
{
- if (tp->ecn_flags & TCP_ECN_OK)
- __tcp_ecn_check_ce(tp, skb);
+ if (tcp_sk(sk)->ecn_flags & TCP_ECN_OK)
+ __tcp_ecn_check_ce(sk, skb);
}
static void tcp_ecn_rcv_synack(struct tcp_sock *tp, const struct tcphdr *th)
@@ -668,7 +670,7 @@ static void tcp_event_data_recv(struct s
}
icsk->icsk_ack.lrcvtime = now;
- tcp_ecn_check_ce(tp, skb);
+ tcp_ecn_check_ce(sk, skb);
if (skb->len >= 128)
tcp_grow_window(sk, skb);
@@ -4231,7 +4233,7 @@ static void tcp_data_queue_ofo(struct so
struct sk_buff *skb1;
u32 seq, end_seq;
- tcp_ecn_check_ce(tp, skb);
+ tcp_ecn_check_ce(sk, skb);
if (unlikely(tcp_try_rmem_schedule(sk, skb, skb->truesize))) {
NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPOFODROP);
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 72/85] tcp: add one more quick ack after after ECN events
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (65 preceding siblings ...)
2018-08-07 18:52 ` [PATCH 3.18 71/85] tcp: refactor tcp_ecn_check_ce to remove sk type cast Greg Kroah-Hartman
@ 2018-08-07 18:52 ` Greg Kroah-Hartman
2018-08-07 18:52 ` [PATCH 3.18 73/85] ipv4: remove BUG_ON() from fib_compute_spec_dst Greg Kroah-Hartman
` (14 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Eric Dumazet, Neal Cardwell,
Lawrence Brakmo, David S. Miller
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 15ecbe94a45ef88491ca459b26efdd02f91edb6d ]
Larry Brakmo proposal ( https://patchwork.ozlabs.org/patch/935233/
tcp: force cwnd at least 2 in tcp_cwnd_reduction) made us rethink
about our recent patch removing ~16 quick acks after ECN events.
tcp_enter_quickack_mode(sk, 1) makes sure one immediate ack is sent,
but in the case the sender cwnd was lowered to 1, we do not want
to have a delayed ack for the next packet we will receive.
Fixes: 522040ea5fdd ("tcp: do not aggressively quick ack after ECN events")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Neal Cardwell <ncardwell@google.com>
Cc: Lawrence Brakmo <brakmo@fb.com>
Acked-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/tcp_input.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -232,7 +232,7 @@ static void __tcp_ecn_check_ce(struct so
* it is probably a retransmit.
*/
if (tp->ecn_flags & TCP_ECN_SEEN)
- tcp_enter_quickack_mode(sk, 1);
+ tcp_enter_quickack_mode(sk, 2);
break;
case INET_ECN_CE:
if (tcp_ca_needs_ecn(sk))
@@ -240,7 +240,7 @@ static void __tcp_ecn_check_ce(struct so
if (!(tp->ecn_flags & TCP_ECN_DEMAND_CWR)) {
/* Better not delay acks, sender can have a very low cwnd */
- tcp_enter_quickack_mode(sk, 1);
+ tcp_enter_quickack_mode(sk, 2);
tp->ecn_flags |= TCP_ECN_DEMAND_CWR;
}
tp->ecn_flags |= TCP_ECN_SEEN;
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 73/85] ipv4: remove BUG_ON() from fib_compute_spec_dst
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (66 preceding siblings ...)
2018-08-07 18:52 ` [PATCH 3.18 72/85] tcp: add one more quick ack after after ECN events Greg Kroah-Hartman
@ 2018-08-07 18:52 ` Greg Kroah-Hartman
2018-08-07 18:52 ` [PATCH 3.18 74/85] inet: frag: enforce memory limits earlier Greg Kroah-Hartman
` (13 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lorenzo Bianconi, David S. Miller
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
[ Upstream commit 9fc12023d6f51551d6ca9ed7e02ecc19d79caf17 ]
Remove BUG_ON() from fib_compute_spec_dst routine and check
in_dev pointer during flowi4 data structure initialization.
fib_compute_spec_dst routine can be run concurrently with device removal
where ip_ptr net_device pointer is set to NULL. This can happen
if userspace enables pkt info on UDP rx socket and the device
is removed while traffic is flowing
Fixes: 35ebf65e851c ("ipv4: Create and use fib_compute_spec_dst() helper")
Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/fib_frontend.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -209,19 +209,19 @@ __be32 fib_compute_spec_dst(struct sk_bu
return ip_hdr(skb)->daddr;
in_dev = __in_dev_get_rcu(dev);
- BUG_ON(!in_dev);
net = dev_net(dev);
scope = RT_SCOPE_UNIVERSE;
if (!ipv4_is_zeronet(ip_hdr(skb)->saddr)) {
+ bool vmark = in_dev && IN_DEV_SRC_VMARK(in_dev);
fl4.flowi4_oif = 0;
fl4.flowi4_iif = LOOPBACK_IFINDEX;
fl4.daddr = ip_hdr(skb)->saddr;
fl4.saddr = 0;
fl4.flowi4_tos = RT_TOS(ip_hdr(skb)->tos);
fl4.flowi4_scope = scope;
- fl4.flowi4_mark = IN_DEV_SRC_VMARK(in_dev) ? skb->mark : 0;
+ fl4.flowi4_mark = vmark ? skb->mark : 0;
if (!fib_lookup(net, &fl4, &res))
return FIB_RES_PREFSRC(net, res);
} else {
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 74/85] inet: frag: enforce memory limits earlier
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (67 preceding siblings ...)
2018-08-07 18:52 ` [PATCH 3.18 73/85] ipv4: remove BUG_ON() from fib_compute_spec_dst Greg Kroah-Hartman
@ 2018-08-07 18:52 ` Greg Kroah-Hartman
2018-08-07 18:52 ` [PATCH 3.18 75/85] net: dsa: Do not suspend/resume closed slave_dev Greg Kroah-Hartman
` (12 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Eric Dumazet, Jann Horn,
Florian Westphal, Peter Oskolkov, Paolo Abeni, David S. Miller
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 56e2c94f055d328f5f6b0a5c1721cca2f2d4e0a1 ]
We currently check current frags memory usage only when
a new frag queue is created. This allows attackers to first
consume the memory budget (default : 4 MB) creating thousands
of frag queues, then sending tiny skbs to exceed high_thresh
limit by 2 to 3 order of magnitude.
Note that before commit 648700f76b03 ("inet: frags: use rhashtables
for reassembly units"), work queue could be starved under DOS,
getting no cpu cycles.
After commit 648700f76b03, only the per frag queue timer can eventually
remove an incomplete frag queue and its skbs.
Fixes: b13d3cbfb8e8 ("inet: frag: move eviction of queues to work queue")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Jann Horn <jannh@google.com>
Cc: Florian Westphal <fw@strlen.de>
Cc: Peter Oskolkov <posk@google.com>
Cc: Paolo Abeni <pabeni@redhat.com>
Acked-by: Florian Westphal <fw@strlen.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/inet_fragment.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
--- a/net/ipv4/inet_fragment.c
+++ b/net/ipv4/inet_fragment.c
@@ -379,11 +379,6 @@ static struct inet_frag_queue *inet_frag
{
struct inet_frag_queue *q;
- if (frag_mem_limit(nf) > nf->high_thresh) {
- inet_frag_schedule_worker(f);
- return NULL;
- }
-
q = kmem_cache_zalloc(f->frags_cachep, GFP_ATOMIC);
if (q == NULL)
return NULL;
@@ -420,6 +415,11 @@ struct inet_frag_queue *inet_frag_find(s
struct inet_frag_queue *q;
int depth = 0;
+ if (!nf->high_thresh || frag_mem_limit(nf) > nf->high_thresh) {
+ inet_frag_schedule_worker(f);
+ return NULL;
+ }
+
if (frag_mem_limit(nf) > nf->low_thresh)
inet_frag_schedule_worker(f);
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 75/85] net: dsa: Do not suspend/resume closed slave_dev
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (68 preceding siblings ...)
2018-08-07 18:52 ` [PATCH 3.18 74/85] inet: frag: enforce memory limits earlier Greg Kroah-Hartman
@ 2018-08-07 18:52 ` Greg Kroah-Hartman
2018-08-07 18:52 ` [PATCH 3.18 76/85] squashfs: more metadata hardening Greg Kroah-Hartman
` (11 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Florian Fainelli, Andrew Lunn,
David S. Miller
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Fainelli <f.fainelli@gmail.com>
[ Upstream commit a94c689e6c9e72e722f28339e12dff191ee5a265 ]
If a DSA slave network device was previously disabled, there is no need
to suspend or resume it.
Fixes: 2446254915a7 ("net: dsa: allow switch drivers to implement suspend/resume hooks")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/dsa/slave.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/net/dsa/slave.c
+++ b/net/dsa/slave.c
@@ -503,6 +503,9 @@ int dsa_slave_suspend(struct net_device
{
struct dsa_slave_priv *p = netdev_priv(slave_dev);
+ if (!netif_running(slave_dev))
+ return 0;
+
netif_device_detach(slave_dev);
if (p->phy) {
@@ -520,6 +523,9 @@ int dsa_slave_resume(struct net_device *
{
struct dsa_slave_priv *p = netdev_priv(slave_dev);
+ if (!netif_running(slave_dev))
+ return 0;
+
netif_device_attach(slave_dev);
if (p->phy) {
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 76/85] squashfs: more metadata hardening
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (69 preceding siblings ...)
2018-08-07 18:52 ` [PATCH 3.18 75/85] net: dsa: Do not suspend/resume closed slave_dev Greg Kroah-Hartman
@ 2018-08-07 18:52 ` Greg Kroah-Hartman
2018-08-07 18:52 ` [PATCH 3.18 78/85] can: ems_usb: Fix memory leak on ems_usb_disconnect() Greg Kroah-Hartman
` (10 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Anatoly Trosinenko, Phillip Lougher,
stable, Linus Torvalds
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Torvalds <torvalds@linux-foundation.org>
commit d512584780d3e6a7cacb2f482834849453d444a1 upstream.
Anatoly reports another squashfs fuzzing issue, where the decompression
parameters themselves are in a compressed block.
This causes squashfs_read_data() to be called in order to read the
decompression options before the decompression stream having been set
up, making squashfs go sideways.
Reported-by: Anatoly Trosinenko <anatoly.trosinenko@gmail.com>
Acked-by: Phillip Lougher <phillip.lougher@gmail.com>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/squashfs/block.c | 2 ++
1 file changed, 2 insertions(+)
--- a/fs/squashfs/block.c
+++ b/fs/squashfs/block.c
@@ -166,6 +166,8 @@ int squashfs_read_data(struct super_bloc
}
if (compressed) {
+ if (!msblk->stream)
+ goto read_failure;
length = squashfs_decompress(msblk, bh, b, offset, length,
output);
if (length < 0)
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 78/85] can: ems_usb: Fix memory leak on ems_usb_disconnect()
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (70 preceding siblings ...)
2018-08-07 18:52 ` [PATCH 3.18 76/85] squashfs: more metadata hardening Greg Kroah-Hartman
@ 2018-08-07 18:52 ` Greg Kroah-Hartman
2018-08-07 18:52 ` [PATCH 3.18 79/85] virtio_balloon: fix another race between migration and ballooning Greg Kroah-Hartman
` (9 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Anton Vasilyev, Marc Kleine-Budde
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anton Vasilyev <vasilyev@ispras.ru>
commit 72c05f32f4a5055c9c8fe889bb6903ec959c0aad upstream.
ems_usb_probe() allocates memory for dev->tx_msg_buffer, but there
is no its deallocation in ems_usb_disconnect().
Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Anton Vasilyev <vasilyev@ispras.ru>
Cc: <stable@vger.kernel.org>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/can/usb/ems_usb.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/net/can/usb/ems_usb.c
+++ b/drivers/net/can/usb/ems_usb.c
@@ -1083,6 +1083,7 @@ static void ems_usb_disconnect(struct us
usb_free_urb(dev->intr_urb);
kfree(dev->intr_in_buffer);
+ kfree(dev->tx_msg_buffer);
}
}
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 79/85] virtio_balloon: fix another race between migration and ballooning
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (71 preceding siblings ...)
2018-08-07 18:52 ` [PATCH 3.18 78/85] can: ems_usb: Fix memory leak on ems_usb_disconnect() Greg Kroah-Hartman
@ 2018-08-07 18:52 ` Greg Kroah-Hartman
2018-08-07 18:52 ` [PATCH 3.18 80/85] crypto: padlock-aes - Fix Nano workaround data corruption Greg Kroah-Hartman
` (8 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jiang Biao, Huang Chong, Michael S. Tsirkin
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiang Biao <jiang.biao2@zte.com.cn>
commit 89da619bc18d79bca5304724c11d4ba3b67ce2c6 upstream.
Kernel panic when with high memory pressure, calltrace looks like,
PID: 21439 TASK: ffff881be3afedd0 CPU: 16 COMMAND: "java"
#0 [ffff881ec7ed7630] machine_kexec at ffffffff81059beb
#1 [ffff881ec7ed7690] __crash_kexec at ffffffff81105942
#2 [ffff881ec7ed7760] crash_kexec at ffffffff81105a30
#3 [ffff881ec7ed7778] oops_end at ffffffff816902c8
#4 [ffff881ec7ed77a0] no_context at ffffffff8167ff46
#5 [ffff881ec7ed77f0] __bad_area_nosemaphore at ffffffff8167ffdc
#6 [ffff881ec7ed7838] __node_set at ffffffff81680300
#7 [ffff881ec7ed7860] __do_page_fault at ffffffff8169320f
#8 [ffff881ec7ed78c0] do_page_fault at ffffffff816932b5
#9 [ffff881ec7ed78f0] page_fault at ffffffff8168f4c8
[exception RIP: _raw_spin_lock_irqsave+47]
RIP: ffffffff8168edef RSP: ffff881ec7ed79a8 RFLAGS: 00010046
RAX: 0000000000000246 RBX: ffffea0019740d00 RCX: ffff881ec7ed7fd8
RDX: 0000000000020000 RSI: 0000000000000016 RDI: 0000000000000008
RBP: ffff881ec7ed79a8 R8: 0000000000000246 R9: 000000000001a098
R10: ffff88107ffda000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000008 R14: ffff881ec7ed7a80 R15: ffff881be3afedd0
ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018
It happens in the pagefault and results in double pagefault
during compacting pages when memory allocation fails.
Analysed the vmcore, the page leads to second pagefault is corrupted
with _mapcount=-256, but private=0.
It's caused by the race between migration and ballooning, and lock
missing in virtballoon_migratepage() of virtio_balloon driver.
This patch fix the bug.
Fixes: e22504296d4f64f ("virtio_balloon: introduce migration primitives to balloon pages")
Cc: stable@vger.kernel.org
Signed-off-by: Jiang Biao <jiang.biao2@zte.com.cn>
Signed-off-by: Huang Chong <huang.chong@zte.com.cn>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/virtio/virtio_balloon.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/virtio/virtio_balloon.c
+++ b/drivers/virtio/virtio_balloon.c
@@ -416,7 +416,9 @@ static int virtballoon_migratepage(struc
tell_host(vb, vb->inflate_vq);
/* balloon's page migration 2nd step -- deflate "page" */
+ spin_lock_irqsave(&vb_dev_info->pages_lock, flags);
balloon_page_delete(page);
+ spin_unlock_irqrestore(&vb_dev_info->pages_lock, flags);
vb->num_pfns = VIRTIO_BALLOON_PAGES_PER_PAGE;
set_page_pfns(vb->pfns, page);
tell_host(vb, vb->deflate_vq);
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 80/85] crypto: padlock-aes - Fix Nano workaround data corruption
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (72 preceding siblings ...)
2018-08-07 18:52 ` [PATCH 3.18 79/85] virtio_balloon: fix another race between migration and ballooning Greg Kroah-Hartman
@ 2018-08-07 18:52 ` Greg Kroah-Hartman
2018-08-07 18:52 ` [PATCH 3.18 81/85] scsi: sg: fix minor memory leak in error path Greg Kroah-Hartman
` (7 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:52 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jamie Heilman, Herbert Xu
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <herbert@gondor.apana.org.au>
commit 46d8c4b28652d35dc6cfb5adf7f54e102fc04384 upstream.
This was detected by the self-test thanks to Ard's chunking patch.
I finally got around to testing this out on my ancient Via box. It
turns out that the workaround got the assembly wrong and we end up
doing count + initial cycles of the loop instead of just count.
This obviously causes corruption, either by overwriting the source
that is yet to be processed, or writing over the end of the buffer.
On CPUs that don't require the workaround only ECB is affected.
On Nano CPUs both ECB and CBC are affected.
This patch fixes it by doing the subtraction prior to the assembly.
Fixes: a76c1c23d0c3 ("crypto: padlock-aes - work around Nano CPU...")
Cc: <stable@vger.kernel.org>
Reported-by: Jamie Heilman <jamie@audible.transient.net>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/crypto/padlock-aes.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/drivers/crypto/padlock-aes.c
+++ b/drivers/crypto/padlock-aes.c
@@ -266,6 +266,8 @@ static inline void padlock_xcrypt_ecb(co
return;
}
+ count -= initial;
+
if (initial)
asm volatile (".byte 0xf3,0x0f,0xa7,0xc8" /* rep xcryptecb */
: "+S"(input), "+D"(output)
@@ -273,7 +275,7 @@ static inline void padlock_xcrypt_ecb(co
asm volatile (".byte 0xf3,0x0f,0xa7,0xc8" /* rep xcryptecb */
: "+S"(input), "+D"(output)
- : "d"(control_word), "b"(key), "c"(count - initial));
+ : "d"(control_word), "b"(key), "c"(count));
}
static inline u8 *padlock_xcrypt_cbc(const u8 *input, u8 *output, void *key,
@@ -284,6 +286,8 @@ static inline u8 *padlock_xcrypt_cbc(con
if (count < cbc_fetch_blocks)
return cbc_crypt(input, output, key, iv, control_word, count);
+ count -= initial;
+
if (initial)
asm volatile (".byte 0xf3,0x0f,0xa7,0xd0" /* rep xcryptcbc */
: "+S" (input), "+D" (output), "+a" (iv)
@@ -291,7 +295,7 @@ static inline u8 *padlock_xcrypt_cbc(con
asm volatile (".byte 0xf3,0x0f,0xa7,0xd0" /* rep xcryptcbc */
: "+S" (input), "+D" (output), "+a" (iv)
- : "d" (control_word), "b" (key), "c" (count-initial));
+ : "d" (control_word), "b" (key), "c" (count));
return iv;
}
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 81/85] scsi: sg: fix minor memory leak in error path
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (73 preceding siblings ...)
2018-08-07 18:52 ` [PATCH 3.18 80/85] crypto: padlock-aes - Fix Nano workaround data corruption Greg Kroah-Hartman
@ 2018-08-07 18:52 ` Greg Kroah-Hartman
2018-08-07 18:52 ` [PATCH 3.18 82/85] scsi: qla2xxx: Fix ISP recovery on unload Greg Kroah-Hartman
` (6 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ewan D. Milne, Tony Battersby,
Bart Van Assche, Martin K. Petersen
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Battersby <tonyb@cybernetics.com>
commit c170e5a8d222537e98aa8d4fddb667ff7a2ee114 upstream.
Fix a minor memory leak when there is an error opening a /dev/sg device.
Fixes: cc833acbee9d ("sg: O_EXCL and other lock handling")
Cc: <stable@vger.kernel.org>
Reviewed-by: Ewan D. Milne <emilne@redhat.com>
Signed-off-by: Tony Battersby <tonyb@cybernetics.com>
Reviewed-by: Bart Van Assche <bart.vanassche@wdc.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/sg.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -2242,6 +2242,7 @@ sg_add_sfp(Sg_device * sdp)
write_lock_irqsave(&sdp->sfd_lock, iflags);
if (atomic_read(&sdp->detaching)) {
write_unlock_irqrestore(&sdp->sfd_lock, iflags);
+ kfree(sfp);
return ERR_PTR(-ENODEV);
}
list_add_tail(&sfp->sfd_siblings, &sdp->sfds);
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 82/85] scsi: qla2xxx: Fix ISP recovery on unload
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (74 preceding siblings ...)
2018-08-07 18:52 ` [PATCH 3.18 81/85] scsi: sg: fix minor memory leak in error path Greg Kroah-Hartman
@ 2018-08-07 18:52 ` Greg Kroah-Hartman
2018-08-07 18:52 ` [PATCH 3.18 83/85] scsi: qla2xxx: Return error when TMF returns Greg Kroah-Hartman
` (5 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Quinn Tran, Himanshu Madhani,
Martin K. Petersen
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quinn Tran <quinn.tran@cavium.com>
commit b08abbd9f5996309f021684f9ca74da30dcca36a upstream.
During unload process, the chip can encounter problem where a FW dump would
be captured. For this case, the full reset sequence will be skip to bring
the chip back to full operational state.
Fixes: e315cd28b9ef ("[SCSI] qla2xxx: Code changes for qla data structure refactoring")
Cc: <stable@vger.kernel.org>
Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_os.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -5000,8 +5000,9 @@ qla2x00_do_dpc(void *data)
}
}
- if (test_and_clear_bit(ISP_ABORT_NEEDED,
- &base_vha->dpc_flags)) {
+ if (test_and_clear_bit
+ (ISP_ABORT_NEEDED, &base_vha->dpc_flags) &&
+ !test_bit(UNLOADING, &base_vha->dpc_flags)) {
ql_dbg(ql_dbg_dpc, base_vha, 0x4007,
"ISP abort scheduled.\n");
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 83/85] scsi: qla2xxx: Return error when TMF returns
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (75 preceding siblings ...)
2018-08-07 18:52 ` [PATCH 3.18 82/85] scsi: qla2xxx: Fix ISP recovery on unload Greg Kroah-Hartman
@ 2018-08-07 18:52 ` Greg Kroah-Hartman
2018-08-07 18:52 ` [PATCH 3.18 84/85] ring_buffer: tracing: Inherit the tracing setting to next ring buffer Greg Kroah-Hartman
` (4 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Anil Gurumurthy, Himanshu Madhani,
Martin K. Petersen
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anil Gurumurthy <anil.gurumurthy@cavium.com>
commit b4146c4929ef61d5afca011474d59d0918a0cd82 upstream.
Propagate the task management completion status properly to avoid
unnecessary waits for commands to complete.
Fixes: faef62d13463 ("[SCSI] qla2xxx: Fix Task Management command asynchronous handling")
Cc: <stable@vger.kernel.org>
Signed-off-by: Anil Gurumurthy <anil.gurumurthy@cavium.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_init.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -325,11 +325,10 @@ qla2x00_async_tm_cmd(fc_port_t *fcport,
wait_for_completion(&tm_iocb->u.tmf.comp);
- rval = tm_iocb->u.tmf.comp_status == CS_COMPLETE ?
- QLA_SUCCESS : QLA_FUNCTION_FAILED;
+ rval = tm_iocb->u.tmf.data;
- if ((rval != QLA_SUCCESS) || tm_iocb->u.tmf.data) {
- ql_dbg(ql_dbg_taskm, vha, 0x8030,
+ if (rval != QLA_SUCCESS) {
+ ql_log(ql_log_warn, vha, 0x8030,
"TM IOCB failed (%x).\n", rval);
}
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 84/85] ring_buffer: tracing: Inherit the tracing setting to next ring buffer
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (76 preceding siblings ...)
2018-08-07 18:52 ` [PATCH 3.18 83/85] scsi: qla2xxx: Return error when TMF returns Greg Kroah-Hartman
@ 2018-08-07 18:52 ` Greg Kroah-Hartman
2018-08-07 18:52 ` [PATCH 3.18 85/85] jfs: Fix inconsistency between memory allocation and ea_buf->max_size Greg Kroah-Hartman
` (3 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ingo Molnar, Shuah Khan, Tom Zanussi,
Hiraku Toyooka, Masami Hiramatsu, Steven Rostedt (VMware),
Sudip Mukherjee
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masami Hiramatsu <mhiramat@kernel.org>
commit 73c8d8945505acdcbae137c2e00a1232e0be709f upstream.
Maintain the tracing on/off setting of the ring_buffer when switching
to the trace buffer snapshot.
Taking a snapshot is done by swapping the backup ring buffer
(max_tr_buffer). But since the tracing on/off setting is defined
by the ring buffer, when swapping it, the tracing on/off setting
can also be changed. This causes a strange result like below:
/sys/kernel/debug/tracing # cat tracing_on
1
/sys/kernel/debug/tracing # echo 0 > tracing_on
/sys/kernel/debug/tracing # cat tracing_on
0
/sys/kernel/debug/tracing # echo 1 > snapshot
/sys/kernel/debug/tracing # cat tracing_on
1
/sys/kernel/debug/tracing # echo 1 > snapshot
/sys/kernel/debug/tracing # cat tracing_on
0
We don't touch tracing_on, but snapshot changes tracing_on
setting each time. This is an anomaly, because user doesn't know
that each "ring_buffer" stores its own tracing-enable state and
the snapshot is done by swapping ring buffers.
Link: http://lkml.kernel.org/r/153149929558.11274.11730609978254724394.stgit@devbox
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Tom Zanussi <tom.zanussi@linux.intel.com>
Cc: Hiraku Toyooka <hiraku.toyooka@cybertrust.co.jp>
Cc: stable@vger.kernel.org
Fixes: debdd57f5145 ("tracing: Make a snapshot feature available from userspace")
Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
[ Updated commit log and comment in the code ]
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/ring_buffer.h | 1 +
kernel/trace/ring_buffer.c | 16 ++++++++++++++++
kernel/trace/trace.c | 6 ++++++
3 files changed, 23 insertions(+)
--- a/include/linux/ring_buffer.h
+++ b/include/linux/ring_buffer.h
@@ -162,6 +162,7 @@ void ring_buffer_record_enable(struct ri
void ring_buffer_record_off(struct ring_buffer *buffer);
void ring_buffer_record_on(struct ring_buffer *buffer);
int ring_buffer_record_is_on(struct ring_buffer *buffer);
+int ring_buffer_record_is_set_on(struct ring_buffer *buffer);
void ring_buffer_record_disable_cpu(struct ring_buffer *buffer, int cpu);
void ring_buffer_record_enable_cpu(struct ring_buffer *buffer, int cpu);
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -3153,6 +3153,22 @@ int ring_buffer_record_is_on(struct ring
}
/**
+ * ring_buffer_record_is_set_on - return true if the ring buffer is set writable
+ * @buffer: The ring buffer to see if write is set enabled
+ *
+ * Returns true if the ring buffer is set writable by ring_buffer_record_on().
+ * Note that this does NOT mean it is in a writable state.
+ *
+ * It may return true when the ring buffer has been disabled by
+ * ring_buffer_record_disable(), as that is a temporary disabling of
+ * the ring buffer.
+ */
+int ring_buffer_record_is_set_on(struct ring_buffer *buffer)
+{
+ return !(atomic_read(&buffer->record_disabled) & RB_BUFFER_OFF);
+}
+
+/**
* ring_buffer_record_disable_cpu - stop all writes into the cpu_buffer
* @buffer: The ring buffer to stop writes to.
* @cpu: The CPU buffer to stop
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -1023,6 +1023,12 @@ update_max_tr(struct trace_array *tr, st
arch_spin_lock(&tr->max_lock);
+ /* Inherit the recordable setting from trace_buffer */
+ if (ring_buffer_record_is_set_on(tr->trace_buffer.buffer))
+ ring_buffer_record_on(tr->max_buffer.buffer);
+ else
+ ring_buffer_record_off(tr->max_buffer.buffer);
+
buf = tr->trace_buffer.buffer;
tr->trace_buffer.buffer = tr->max_buffer.buffer;
tr->max_buffer.buffer = buf;
^ permalink raw reply [flat|nested] 85+ messages in thread* [PATCH 3.18 85/85] jfs: Fix inconsistency between memory allocation and ea_buf->max_size
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (77 preceding siblings ...)
2018-08-07 18:52 ` [PATCH 3.18 84/85] ring_buffer: tracing: Inherit the tracing setting to next ring buffer Greg Kroah-Hartman
@ 2018-08-07 18:52 ` Greg Kroah-Hartman
2018-08-07 22:33 ` [PATCH 3.18 00/85] 3.18.118-stable review Nathan Chancellor
` (2 subsequent siblings)
81 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-07 18:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Shankara Pailoor, Dave Kleikamp,
Guenter Roeck
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shankara Pailoor <shankarapailoor@gmail.com>
commit 92d34134193e5b129dc24f8d79cb9196626e8d7a upstream.
The code is assuming the buffer is max_size length, but we weren't
allocating enough space for it.
Signed-off-by: Shankara Pailoor <shankarapailoor@gmail.com>
Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Cc: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/jfs/xattr.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
--- a/fs/jfs/xattr.c
+++ b/fs/jfs/xattr.c
@@ -493,15 +493,17 @@ static int ea_get(struct inode *inode, s
if (size > PSIZE) {
/*
* To keep the rest of the code simple. Allocate a
- * contiguous buffer to work with
+ * contiguous buffer to work with. Make the buffer large
+ * enough to make use of the whole extent.
*/
- ea_buf->xattr = kmalloc(size, GFP_KERNEL);
+ ea_buf->max_size = (size + sb->s_blocksize - 1) &
+ ~(sb->s_blocksize - 1);
+
+ ea_buf->xattr = kmalloc(ea_buf->max_size, GFP_KERNEL);
if (ea_buf->xattr == NULL)
return -ENOMEM;
ea_buf->flag = EA_MALLOC;
- ea_buf->max_size = (size + sb->s_blocksize - 1) &
- ~(sb->s_blocksize - 1);
if (ea_size == 0)
return 0;
^ permalink raw reply [flat|nested] 85+ messages in thread* Re: [PATCH 3.18 00/85] 3.18.118-stable review
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (78 preceding siblings ...)
2018-08-07 18:52 ` [PATCH 3.18 85/85] jfs: Fix inconsistency between memory allocation and ea_buf->max_size Greg Kroah-Hartman
@ 2018-08-07 22:33 ` Nathan Chancellor
2018-08-08 6:35 ` Greg Kroah-Hartman
2018-08-08 2:52 ` Shuah Khan
2018-08-08 16:05 ` Guenter Roeck
81 siblings, 1 reply; 85+ messages in thread
From: Nathan Chancellor @ 2018-08-07 22:33 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, torvalds, akpm, linux, shuah, patches,
ben.hutchings, lkft-triage, stable
On Tue, Aug 07, 2018 at 08:51:02PM +0200, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 3.18.118 release.
> There are 85 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu Aug 9 17:23:43 UTC 2018.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v3.x/stable-review/patch-3.18.118-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-3.18.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
Merged, compiled with -Werror, and installed onto my Pixel XL.
No initial issues noticed in dmesg or general usage.
Thanks!
Nathan
^ permalink raw reply [flat|nested] 85+ messages in thread* Re: [PATCH 3.18 00/85] 3.18.118-stable review
2018-08-07 22:33 ` [PATCH 3.18 00/85] 3.18.118-stable review Nathan Chancellor
@ 2018-08-08 6:35 ` Greg Kroah-Hartman
0 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-08 6:35 UTC (permalink / raw)
To: Nathan Chancellor
Cc: linux-kernel, torvalds, akpm, linux, shuah, patches,
ben.hutchings, lkft-triage, stable
On Tue, Aug 07, 2018 at 03:33:29PM -0700, Nathan Chancellor wrote:
> On Tue, Aug 07, 2018 at 08:51:02PM +0200, Greg Kroah-Hartman wrote:
> > This is the start of the stable review cycle for the 3.18.118 release.
> > There are 85 patches in this series, all will be posted as a response
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
> >
> > Responses should be made by Thu Aug 9 17:23:43 UTC 2018.
> > Anything received after that time might be too late.
> >
> > The whole patch series can be found in one patch at:
> > https://www.kernel.org/pub/linux/kernel/v3.x/stable-review/patch-3.18.118-rc1.gz
> > or in the git tree and branch at:
> > git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-3.18.y
> > and the diffstat can be found below.
> >
> > thanks,
> >
> > greg k-h
> >
>
> Merged, compiled with -Werror, and installed onto my Pixel XL.
>
> No initial issues noticed in dmesg or general usage.
Thanks for testing three of these and letting me know.
greg k-h
^ permalink raw reply [flat|nested] 85+ messages in thread
* Re: [PATCH 3.18 00/85] 3.18.118-stable review
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (79 preceding siblings ...)
2018-08-07 22:33 ` [PATCH 3.18 00/85] 3.18.118-stable review Nathan Chancellor
@ 2018-08-08 2:52 ` Shuah Khan
2018-08-08 5:29 ` Greg Kroah-Hartman
2018-08-08 16:05 ` Guenter Roeck
81 siblings, 1 reply; 85+ messages in thread
From: Shuah Khan @ 2018-08-08 2:52 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel
Cc: torvalds, akpm, linux, patches, ben.hutchings, lkft-triage,
stable, Shuah Khan
On 08/07/2018 12:51 PM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 3.18.118 release.
> There are 85 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu Aug 9 17:23:43 UTC 2018.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v3.x/stable-review/patch-3.18.118-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-3.18.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
^ permalink raw reply [flat|nested] 85+ messages in thread* Re: [PATCH 3.18 00/85] 3.18.118-stable review
2018-08-08 2:52 ` Shuah Khan
@ 2018-08-08 5:29 ` Greg Kroah-Hartman
0 siblings, 0 replies; 85+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-08 5:29 UTC (permalink / raw)
To: Shuah Khan
Cc: linux-kernel, torvalds, akpm, linux, patches, ben.hutchings,
lkft-triage, stable
On Tue, Aug 07, 2018 at 08:52:59PM -0600, Shuah Khan wrote:
> On 08/07/2018 12:51 PM, Greg Kroah-Hartman wrote:
> > This is the start of the stable review cycle for the 3.18.118 release.
> > There are 85 patches in this series, all will be posted as a response
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
> >
> > Responses should be made by Thu Aug 9 17:23:43 UTC 2018.
> > Anything received after that time might be too late.
> >
> > The whole patch series can be found in one patch at:
> > https://www.kernel.org/pub/linux/kernel/v3.x/stable-review/patch-3.18.118-rc1.gz
> > or in the git tree and branch at:
> > git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-3.18.y
> > and the diffstat can be found below.
> >
> > thanks,
> >
> > greg k-h
> >
>
> Compiled and booted on my test system. No dmesg regressions.
Thanks for testing all of these and letting me know.
greg k-h
^ permalink raw reply [flat|nested] 85+ messages in thread
* Re: [PATCH 3.18 00/85] 3.18.118-stable review
2018-08-07 18:51 [PATCH 3.18 00/85] 3.18.118-stable review Greg Kroah-Hartman
` (80 preceding siblings ...)
2018-08-08 2:52 ` Shuah Khan
@ 2018-08-08 16:05 ` Guenter Roeck
81 siblings, 0 replies; 85+ messages in thread
From: Guenter Roeck @ 2018-08-08 16:05 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, torvalds, akpm, shuah, patches, ben.hutchings,
lkft-triage, stable
On Tue, Aug 07, 2018 at 08:51:02PM +0200, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 3.18.118 release.
> There are 85 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu Aug 9 17:23:43 UTC 2018.
> Anything received after that time might be too late.
>
Build results:
total: 138 pass: 138 fail: 0
Qemu test results:
total: 198 pass: 198 fail: 0
Details are available at http://kerneltests.org/builders/.
Guenter
^ permalink raw reply [flat|nested] 85+ messages in thread